Crash when calling console.dir on a revoked Proxy

[noinkling]

Version

v18.1.0 (Windows), v16.15.0 (WSL1), v16.14.2 (WSL1), v16.14.0 (Windows), v12.16.1 (repl.it)

Platform

Microsoft Windows NT 10.0.19044.0 x64

Subsystem

console

What steps will reproduce the bug?

var r = Proxy.revocable({}, {});
r.revoke();
console.dir(r.proxy);  // or just console.dir(r)

How often does it reproduce? Is there a required condition?

No response

What is the expected behavior?

No response

What do you see instead?

v16.15.0 on WSL1:

node[6619]: ../src/node_util.cc:77:void node::util::GetConstructorName(const v8::FunctionCallbackInfo<v8::Value>&): Assertion `args[0]->IsObject()' failed.
 1: 0xb09c10 node::Abort() [node]
 2: 0xb09c8e  [node]
 3: 0xbba0b7  [node]
 4: 0xd552fe  [node]
 5: 0xd5671f v8::internal::Builtin_HandleApiCall(int, unsigned long*, v8::internal::Isolate*) [node]
 6: 0x15f2179  [node]
Aborted (core dumped)

v18.1.0 on Windows:

Command Prompt - node[808]: c:\ws\src\node_util.cc:77: Assertion `args[0]->IsObject()' failed.
 1: 00007FF7379EACAF node_api_throw_syntax_error+174639
 2: 00007FF737979286 v8::internal::wasm::WasmCode::safepoint_table_offset+67350
 3: 00007FF737979652 v8::internal::wasm::WasmCode::safepoint_table_offset+68322
 4: 00007FF7378DA1B4 v8::internal::interpreter::BytecodeLabel::bind+203028
 5: 00007FF7383B0369 v8::internal::Builtins::code+245689
 6: 00007FF7383AFF49 v8::internal::Builtins::code+244633
 7: 00007FF7383B020C v8::internal::Builtins::code+245340
 8: 00007FF7383B0070 v8::internal::Builtins::code+244928
 9: 00007FF738498E31 v8::internal::SetupIsolateDelegate::SetupHeap+566769
10: 00007FF6B85E6D2A

Additional information

util.inspect(r.proxy) (or console.log(r.proxy)) doesn't crash but it does throw an exception:

TypeError: Cannot read properties of null (reading 'Symbol(nodejs.util.inspect.custom)')
    at formatValue (node:internal/util/inspect:771:30)
    at Object.inspect (node:internal/util/inspect:347:10)

If you call util.inspect(r) (or console.log(r)) instead (i.e. on the wrapper object) the error is slightly different (presumably because it's wrapped in an assertion):

Error [ERR_INTERNAL_ASSERTION]: TypeError: Cannot read properties of null (reading 'Symbol(nodejs.util.inspect.custom)')
    at formatValue (node:internal/util/inspect:771:30)
    at formatProperty (node:internal/util/inspect:1819:11)
    at formatRaw (node:internal/util/inspect:1030:9)
    at formatValue (node:internal/util/inspect:817:10)
    at Object.inspect (node:internal/util/inspect:347:10)
    at REPL4:1:6
    at Script.runInThisContext (node:vm:129:12)
    at REPLServer.defaultEval (node:repl:566:29)
    at bound (node:domain:421:15)
    at REPLServer.runBound [as eval] (node:domain:432:12)
This is caused by either a bug in Node.js or incorrect usage of Node.js internals.
Please open an issue with this stack trace at https://github.com/nodejs/node/issues

    at __node_internal_captureLargerStackTrace (node:internal/errors:465:5)
    at new NodeError (node:internal/errors:372:5)
    at Function.fail (node:internal/assert:20:9)
    at handleMaxCallStackSize (node:internal/util/inspect:1459:10)
    at formatRaw (node:internal/util/inspect:1037:12)
    at formatValue (node:internal/util/inspect:817:10)
    at Object.inspect (node:internal/util/inspect:347:10) {
  code: 'ERR_INTERNAL_ASSERTION'
}

No problems in a Chrome devtools console.