fix(fontstring): SetFormattedText uses engine str_format, not _G

SetFormattedText resolved _G.string.format and called it, so an addon
that replaced string.format could hijack or break it. Push the engine's
own str_format C function instead (strlib "format" entry 0x007FD3D0,
verified by decode) and pcall it -- immune to global replacement, and
matching retail, whose SetFormattedText formats in C. Also simpler: one
PushCClosure replaces the _G table walk and its two failure branches.

Verified in-game: with both string.format and the format global replaced
by a stub, SetFormattedText("%d apples", 5) still renders "5 apples".

Author: brues-code

docs/API.md

@@ -4173,10 +4173,9 @@ f:SetText("a really long guild or player name that will not fit")
 ### `fontstring:SetFormattedText(format [, ...])`
 
 Sets the text to `string.format(format, ...)`. Later clients added
-the method as a convenience over `SetText(format(...))`. The format
-runs through the live `string.format`, so a bad format string raises
-the same Lua error it would in script. The set goes through the same
-engine path as `SetText`, so escape handling is identical.
+the method as a convenience over `SetText(format(...))`. A bad format
+string raises a normal Lua error. The set goes through the same engine
+path as `SetText`, so escape handling is identical.
 
 ```lua
 f:SetFormattedText("%d/%d (%.1f%%)", cur, max, cur / max * 100)

src/Offsets.h

@@ -4823,6 +4823,15 @@ enum Offsets {
     // `BaseLib::StringLib` registers `string.gmatch` as a direct alias of
     // this function pointer — no wrapper.
     FUN_LUA_STR_GFIND = 0x007FCFA0,
+    // `str_format` — the Lua 5.0 `string.format` C function (`int
+    // __fastcall(void *L)`), strlib entry at `0x00822dc0`. Verified by decode:
+    // reads the format at arg 1, handles `%%`, `%d/i/c`, `%e/E/f/g/G`,
+    // `%o/u/x/X`, `%s`, `%q`, with the "invalid option to 'format'" / "invalid
+    // format (width or precision too long)" errors. FontString:SetFormattedText
+    // pushes THIS directly and pcalls it, rather than resolving `_G.string.format`
+    // — so an addon replacing `string.format` cannot hijack or break it (matches
+    // retail, whose SetFormattedText formats in C).
+    FUN_LUA_STR_FORMAT = 0x007FD3D0,
     // `math_fmod` — the Lua 5.0 `math.mod` C function (mathlib entry at
     // `0x00822cb0`): `luaL_checknumber(1/2)` → `fmod(x, y)` → `lua_pushnumber`.
     // 5.1 renamed the Lua-facing name to `math.fmod` with the identical C

src/fontstring/Metrics.cpp

@@ -52,11 +52,14 @@
 //                               re-invalidates the layout like SetText does.
 //                               1.12 has no SetWordWrap, so SetMaxLines(1) is
 //                               how you get a single-line, ellipsized label.
-//   SetFormattedText(fmt,...) — string.format + SetText convenience; the
-//                               format runs through Lua's own string.format
-//                               under pcall, the set through the engine's
-//                               FUN_FONTSTRING_SET_TEXT (keeping the text
-//                               sanitizer/pipe handling identical to SetText).
+//   SetFormattedText(fmt,...) — string.format + SetText convenience. The format
+//                               runs through the engine's OWN str_format C
+//                               function (FUN_LUA_STR_FORMAT) under pcall — NOT
+//                               _G.string.format, so an addon replacing
+//                               string.format can't hijack it (matches retail).
+//                               The set goes through FUN_FONTSTRING_SET_TEXT,
+//                               keeping the sanitizer/pipe handling identical to
+//                               SetText.
 //
 // Push conversion mirrors Script_GetStringWidth (0x0079E510): resolve self,
 // call the internal getter, convert anchor units → UI pixels, push.
@@ -366,24 +369,8 @@ int __fastcall Script_SetFormattedText(void *L) {
     }
     const int top = Game::Lua::GetTop(L);
     Game::Lua::CheckStack(L, top + 4);
-    // _G["string"]["format"] — the live library function, so any addon
-    // replacement of string.format is honoured, matching a Lua-side
-    // SetText(format(...)).
-    Game::Lua::PushString(L, "string");
-    Game::Lua::GetTable(L, Game::Lua::GLOBALS_INDEX);
-    if (Game::Lua::Type(L, -1) != Game::Lua::TYPE_TABLE) {
-        Game::Lua::SetTop(L, top);
-        Game::Lua::Error(L, "SetFormattedText: string library unavailable");
-        return 0;
-    }
-    Game::Lua::PushString(L, "format");
-    Game::Lua::GetTable(L, -2);
-    Game::Lua::Remove(L, -2);
-    if (Game::Lua::Type(L, -1) != Game::Lua::TYPE_FUNCTION) {
-        Game::Lua::SetTop(L, top);
-        Game::Lua::Error(L, "SetFormattedText: string.format unavailable");
-        return 0;
-    }
+    Game::Lua::PushCClosure(
+        L, reinterpret_cast<Game::Lua::CFunction>(Offsets::FUN_LUA_STR_FORMAT), 0);
     for (int i = 2; i <= top; ++i)
         Game::Lua::PushValue(L, i);
     if (Game::Lua::PCall(L, top - 1, 1, 0) != 0) {