fixhunt

biome suspicious/noCompareNegZero

labelled safe
Runs / 2026-10-17T21-08-16-345Z-q7ui-biome-suspicious_noCompareNegZerobiome 2.5.152026-10-17 21:08 UTC8 programs × 2 round(s)16 programs, 3 fired, 3 fixed, 0 findings, 6 rejectedmodel cost $0.0026

Analysis Nemotron 3 Super

Flags comparisons where either operand is exactly the literal value '-0'.

Fix: Replaces every occurrence of the literal '-0' in a comparison expression with the literal '0'.

12 hazards
  • Rewriting '-0' to '0' inside a template literal changes the string value produced at runtime.
  • If '-0' appears as a property key (e.g., obj[-0]), replacing it with '0' alters the property name accessed due to key coercion differences.
  • When '-0' is used as a label in a labeled statement, substituting it with '0' creates a different label, breaking goto-like control flow via break/continue.
  • In a destructuring pattern like [-0] = arr, changing '-0' to '0' modifies the ignored element index, potentially affecting which values are skipped.
  • If '-0' is written as part of a numeric literal in a comment (e.g., // threshold: -0), the fix erroneously alters the comment text, misleading future readers.
  • When '-0' is embedded in a regular expression literal (e.g., /-0/), rewriting it to '/0/' changes the pattern matched, causing test or exec to behave differently.
  • In a tagged template literal like fn`-0`, substituting '-0' with '0' changes the cooked string value passed to the tag function, altering its output.
  • If '-0' occurs within a JSX text node (e.g., {-0}), replacing it with '0' changes the rendered string content in the DOM.
  • When '-0' is used as a hexadecimal escape in a string (e.g., '\x2d\x30'), the tool does not recognize it, so no rewrite occurs—but if it did, it would corrupt the escape sequence.
  • In WebAssembly text format embedded as a string (e.g., '(i32.const -0)'), rewriting '-0' to '0' changes the constant value, altering module semantics.
  • If '-0' is part of a URL or API endpoint string (e.g., `fetch('/api/-0')`), substituting it with '0' changes the resource requested, leading to 404 or wrong data.
  • When '-0' is used as a CSS unit or value in a style string (e.g., 'margin: -0px'), replacing it with '0' alters the computed style, though visually identical, it may affect CSSOM property access.

Programs

idresulttitlehazard
r1-p001silent prediction offTagged Template LiteralIn a tagged template literal like fn`-0`, substituting '-0' with '0' changes the cooked string value passed to the tag function, altering its output.
r1-p002invalidVar Hoisting and Redefinitionvar hoisting and re-declaration inside loops or after use
r1-p003invalidLabel StatementWhen '-0' is used as a label in a labeled statement, substituting it with '0' creates a different label, breaking goto-like control flow via break/continue.
r1-p004silentHexadecimal Escape in StringWhen '-0' is used as a hexadecimal escape in a string (e.g., '\x2d\x30'), the tool does not recognize it, so no rewrite occurs—but if it did, it would corrupt the escape sequence.
r1-p005invalidStrict vs Sloppy Mode Semanticsstrict vs sloppy mode semantics
r1-p006invalidTemporal Dead Zonetemporal dead zone after code is hoisted or reordered
r1-p007silent prediction offURL or API Endpoint StringIf '-0' is part of a URL or API endpoint string (e.g., `fetch('/api/-0')`), substituting it with '0' changes the resource requested, leading to 404 or wrong data.
r1-p008silent prediction offThis Binding: Arrow vs Functionthis binding: arrow vs function, methods extracted from objects, call/apply/bind
r2-p001fix okException during equality checkexceptions thrown inside the code the fix removes or rewrites
r2-p002silent prediction offTagged template literal changeIn a tagged template literal like fn`-0`, substituting '-0' with '0' changes the cooked string value passed to the tag function, altering its output.
r2-p003invalidName collision after shadowingname collisions across scopes after a move (shadowing)
r2-p004silent prediction offRegex literal pattern changeWhen '-0' is embedded in a regular expression literal (e.g., /-0/), rewriting it to '/0/' changes the pattern matched, causing test or exec to behave differently.
r2-p005fix okFunction declaration in block scopefunction declarations inside blocks, switch cases, labeled statements
r2-p006invalidJSX text node content changeIf '-0' occurs within a JSX text node (e.g., {-0}), replacing it with '0' changes the rendered string content in the DOM.
r2-p007silent prediction offWASM constant in stringIn WebAssembly text format embedded as a string (e.g., '(i32.const -0)'), rewriting '-0' to '0' changes the constant value, altering module semantics.
r2-p008fix okClass field with negative zeroclass fields, static blocks, private names, super calls

Sources

r1-p001 · Tagged Template Literal
1function tag(strings) {
2 return strings[0];
3}
4const result = tag`-0`;
5console.log(result);
-0
r1-p002 · Var Hoisting and Redefinition (generated program does not parse: /home/sun/dev/diaghunt/runs/2026-10-17T21-08-1)
1for (let i = 0; i < 2; i++) {
2 var -0 = i;
3 console.log(-0);
4}
r1-p003 · Label Statement (generated program does not parse: /home/sun/dev/diaghunt/runs/2026-10-17T21-08-1)
1-0: {
2 break -0;
3}
4console.log('escaped');
r1-p004 · Hexadecimal Escape in String
1const s = '\x2d\x30'; // represents '-0'
2console.log(s);
-0
r1-p005 · Strict vs Sloppy Mode Semantics (generated program does not parse: /home/sun/dev/diaghunt/runs/2026-10-17T21-08-1)
1"use strict";
2try {
3 -0 = 5;
4} catch (e) {
5 console.log(e.name + ': ' + e.message);
6}
r1-p006 · Temporal Dead Zone (generated program does not parse: /home/sun/dev/diaghunt/runs/2026-10-17T21-08-1)
1console.log(typeof -0);
2let -0 = 42;
r1-p007 · URL or API Endpoint String
1const url = '/api/-0';
2console.log(url);
/api/-0
r1-p008 · This Binding: Arrow vs Function
1const obj = {
2 value: 42,
3 getValue: function() { return this.value; }
4};
5const fn = obj.getValue;
6console.log(fn()); // undefined in strict mode
7const bound = obj.getValue.bind(obj);
8console.log(bound()); // 42
r2-p001 · Exception during equality check
1function getX() { throw new Error('bad'); }
2try {
3 if (getX() == -0) {
4 console.log('equal');
5 }
6} catch (e) {
7 console.log(e.name + ': ' + e.message);
8}
--- orig.js	2026-10-17 17:08:32.541331072 -0400
+++ fixed.js	2026-10-17 17:08:32.820334031 -0400
@@ -1,6 +1,6 @@
 function getX() { throw new Error('bad'); }
 try {
-  if (getX() == -0) {
+  if (getX() == 0) {
     console.log('equal');
   }
 } catch (e) {

Error: bad
r2-p002 · Tagged template literal change
1function tag(strings) {
2 return strings[0] + strings[1];
3}
4console.log(tag`start-${-0}-end`);
start--end
r2-p003 · Name collision after shadowing (generated program does not parse: /home/sun/dev/diaghunt/runs/2026-10-17T21-08-1)
1let -0 = 42;
2function f() {
3 let -0 = 99;
4 if (-0 === -0) {
5 console.log('inner:', -0);
6 }
7}
8f();
9console.log('outer:', -0);
r2-p004 · Regex literal pattern change
1const regex = /-0/;
2console.log(regex.test('-0'));
3console.log(regex.test('0'));
true
false
r2-p005 · Function declaration in block scope
1{
2 function f() {
3 return -0;
4 }
5 console.log(f() === -0 ? 'is neg zero' : 'not');
6}
--- orig.js	2026-10-17 17:08:33.500341243 -0400
+++ fixed.js	2026-10-17 17:08:33.767344075 -0400
@@ -2,5 +2,5 @@
   function f() {
     return -0;
   }
-  console.log(f() === -0 ? 'is neg zero' : 'not');
+  console.log(f() === 0 ? 'is neg zero' : 'not');
 }

is neg zero
r2-p006 · JSX text node content change (generated program does not parse: /home/sun/dev/diaghunt/runs/2026-10-17T21-08-1)
1const elem = <span>{-0}</span>;
2console.log(String(elem.props.children));
r2-p007 · WASM constant in string
1const wasmStr = '(module (func (result i32) (i32.const -0)))';
2console.log(wasmStr.includes('-0') ? 'has negative zero' : 'does not');
has negative zero
r2-p008 · Class field with negative zero
1class C {
2 static field = -0;
3 constructor() {
4 if (C.field === -0) {
5 console.log('static field is -0');
6 }
7 }
8}
9new C();
--- orig.js	2026-10-17 17:08:34.203348698 -0400
+++ fixed.js	2026-10-17 17:08:34.488351720 -0400
@@ -1,7 +1,7 @@
 class C {
   static field = -0;
   constructor() {
-    if (C.field === -0) {
+    if (C.field === 0) {
       console.log('static field is -0');
     }
   }

static field is -0