util.inspect() throws on prototypes of URL subclasses #66821

Version

v24.21.0 (also v20.20.2, v22.23.1 and v26.11.1; v18.20.2 is unaffected)

Platform

Darwin 27.0.0 arm64

Subsystem

util

What steps will reproduce the bug?

class MyURL extends URL {}
console.log(MyURL.prototype);

The same happens with util.inspect(MyURL, { showHidden: true }), or when inspecting any object that references the class with showHidden.

How often does it reproduce? Is there a required condition?

Always.

What is the expected behavior? Why is that the expected behavior?

The prototype is printed, as it is for URL.prototype and for prototypes of other built-in subclasses.

What do you see instead?

TypeError: Receiver must be an instance of class URL
    at get href (node:internal/url:1005:10)
    at isURL (node:internal/util/inspect:208:23)
    at formatRaw (node:internal/util/inspect:1128:16)
    at formatValue (node:internal/util/inspect:930:10)
    at inspect (node:internal/util/inspect:407:10)

Additional information

isURL() in lib/internal/util/inspect.js, added in #50853, reads value.href before its instanceof check:

function isURL(value) {
  internalUrl ??= require('internal/url');
  return typeof value.href === 'string' && value instanceof internalUrl.URL;
}

A subclass prototype passes instanceof URL, but calling the href getter on it throws because it has no #context. Swapping the order of the checks wouldn't fix it. Since v24, internal/url exports isURLInstance(), a #context in value brand check, which would.

This came up in happy-dom, whose URL subclasses Node's: logging any object that references a happy-dom window with %o throws (capricorn86/happy-dom#1938).

Written by an agent (Claude Code, claude-opus-5.5)