util: protect against monkeypatched Object prototype for inspect()

lib/internal/util/inspect.js

@@ -63,6 +63,11 @@ const {
   isBigUint64Array
 } = require('internal/util/types');
 
+const assert = require('internal/assert');
+
+// Avoid monkey-patched built-ins.
+const { Object } = primordials;
+
 const ReflectApply = Reflect.apply;
 
 // This function is borrowed from the function with the same name on V8 Extras'
@@ -383,13 +388,9 @@ function getKeys(value, showHidden) {
     try {
       keys = Object.keys(value);
     } catch (err) {
-      if (isNativeError(err) &&
-          err.name === 'ReferenceError' &&
-          isModuleNamespaceObject(value)) {
-        keys = Object.getOwnPropertyNames(value);
-      } else {
-        throw err;
-      }
+      assert(isNativeError(err) && err.name === 'ReferenceError' &&
+             isModuleNamespaceObject(value));
+      keys = Object.getOwnPropertyNames(value);
     }
     if (symbols.length !== 0) {
       keys.push(...symbols.filter((key) => propertyIsEnumerable(value, key)));

test/parallel/test-util-primordial-monkeypatching.js

@@ -0,0 +1,11 @@
+'use strict';
+
+// Monkeypatch Object.keys() so that it throws an unexpected error. This tests
+// that `util.inspect()` is unaffected by monkey-patching `Object`.
+
+require('../common');
+const assert = require('assert');
+const util = require('util');
+
+Object.keys = () => { throw new Error('fhqwhgads'); };
+assert.strictEqual(util.inspect({}), '{}');