# biome suspicious/noPrototypeBuiltins: fix changes program behavior

Internal evidence sheet generated by fixhunt. Not an issue text. A human re-verifies, checks the duplicates
below, and writes the upstream report in their own words following the project's AI policy.

- Tool: biome 2.5.15
- Rule: suspicious/noPrototypeBuiltins (tool labels the fix: safe, this fix reported as safe)
- Oracle: fix-changes-behavior
- Judge (Nemotron 3 Ultra, advisory): intended-change, severity low. The rule rewrites `fakeAll.hasOwnProperty('length')` to `Object.hasOwn(fakeAll, 'length')` to bypass any shadowed `hasOwnProperty` method. The program deliberately sets `__proto__ = null` so the object lacks the built-in method; the original call throws and is caught, producing no output, while the fixed call succeeds and prints `false false`. This behavioral change is exactly what the rule documents as its purpose.
- Program: minimized from 17 to 7 lines

## Reproducer

```js
const fakeAll = { 
};
fakeAll.__proto__ = null;
try {
  console.log(fakeAll == null, fakeAll.hasOwnProperty('length'));
} catch (e) {
}
```

## Commands

```sh
node prog.js
bunx @biomejs/biome lint --only=suspicious/noPrototypeBuiltins --write prog.js
node prog.js
```

## Observed

```
stdout before:

stdout after:
false false
```

## Diff applied by the fix

```diff
--- orig.js	2026-10-22 13:36:31.528125165 -0400
+++ fixed.js	2026-10-22 13:36:33.948166044 -0400
@@ -2,6 +2,6 @@
 };
 fakeAll.__proto__ = null;
 try {
-  console.log(fakeAll == null, fakeAll.hasOwnProperty('length'));
+  console.log(fakeAll == null, Object.hasOwn(fakeAll, 'length'));
 } catch (e) {
 }
```

## Why the rewrite is not equivalent (model draft, verify before use)

The original call `fakeAll.hasOwnProperty('length')` uses the inherited method from `Object.prototype`, but since `__proto__` is set to `null`, `fakeAll` has no prototype chain, so accessing `.hasOwnProperty` throws a TypeError because the property is undefined. This error is caught, so nothing is printed. The fix replaces it with `Object.hasOwn(fakeAll, 'length')`, which is a standalone function that does not rely on the object’s prototype and safely returns `false`. Thus, the try block now executes fully, printing `false false` instead of catching an error and printing nothing. The behavior changes because the fix avoids a thrown exception that was previously silenced.

## Upstream search

Queries: "noPrototypeBuiltins fix", "suspicious noPrototypeBuiltins hasOwnProperty call", "Object.hasOwn replacement pattern", "prototype null object property check"

- related: https://github.com/biomejs/biome/issues/10769
  useLiteralKeys flags __proto__ in computed member expression with unsafe fix conflicting with noProto, same rule domain but different construct

<details><summary>All hits</summary>

- [github, open] 💅 `useSortedProperties` can produce invalid CSS when the final semicolon is omitted — https://github.com/biomejs/biome/issues/12417
- [github, open] 💅 `useSortedProperties` moves Sass variable declarations below their uses — https://github.com/biomejs/biome/issues/12414
- [github, open] 💅 `useSortedProperties` can change behavior when reordering nested CSS rules — https://github.com/biomejs/biome/issues/12413
- [github, open] 💅 `noUnnecessaryConditions`: false positive on an overloaded call with `undefined` as the default argument (Vue `inject`) — https://github.com/biomejs/biome/issues/12040
- [github, open] 💅 `noSkippedTests` conditionally skip fix suggestion — https://github.com/biomejs/biome/issues/9295
- [github, open] 💅 Actually used private method considered unused — https://github.com/biomejs/biome/issues/8185
- [github, open] 💅 cannot detect that the StrictMode component of React is being exported. — https://github.com/biomejs/biome/issues/10609
- [github, open] 💅 noUnnecessaryConditions callback overload false positive — https://github.com/biomejs/biome/issues/11439
- [github, open] 💅 lint/a11y/useAnchorContent: the PascalCase component allowance is applied only to self-closing elements — https://github.com/biomejs/biome/issues/11872
- [github, open] 💅 useLiteralKeys flags `__proto__` in a computed member expression and offers an unsafe fix that conflicts with noProto — https://github.com/biomejs/biome/issues/10769
- [github, closed] 💅 `noThisInStatic` safe fix is not safe — https://github.com/biomejs/biome/issues/10011

</details>