util: fix inspection of typed arrays with unusual length

This makes sure `util.inspect()` does not throw in case the typed
array's length property was set to something invalid. Instead,
always use the original information.

PR-URL: #31458
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Anto Aravinth <anto.aravinth.cse@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

lib/internal/util/inspect.js

@@ -813,7 +813,7 @@ function formatRaw(ctx, value, recurseTimes, typedArray) {
         return `${braces[0]}]`;
       // Special handle the value. The original value is required below. The
       // bound function is required to reconstruct missing information.
-      formatter = formatTypedArray.bind(null, bound);
+      formatter = formatTypedArray.bind(null, bound, size);
       extrasType = kArrayExtrasType;
     } else if (isMapIterator(value)) {
       keys = getKeys(value, ctx.showHidden);
@@ -1389,8 +1389,8 @@ function formatArray(ctx, value, recurseTimes) {
   return output;
 }
 
-function formatTypedArray(value, ctx, ignored, recurseTimes) {
-  const maxLength = MathMin(MathMax(0, ctx.maxArrayLength), value.length);
+function formatTypedArray(value, length, ctx, ignored, recurseTimes) {
+  const maxLength = MathMin(MathMax(0, ctx.maxArrayLength), length);
   const remaining = value.length - maxLength;
   const output = new Array(maxLength);
   const elementFormatter = value.length > 0 && typeof value[0] === 'number' ?

test/parallel/test-util-inspect.js

@@ -311,6 +311,12 @@ assert(!/Object/.test(
   );
 });
 
+{
+  const brokenLength = new Float32Array(2);
+  Object.defineProperty(brokenLength, 'length', { value: -1 });
+  assert.strictEqual(inspect(brokenLength), 'Float32Array(2) [ 0n, 0n ]');
+}
+
 assert.strictEqual(
   util.inspect(Object.create({}, {
     visible: { value: 1, enumerable: true },