# biome suspicious/noPrototypeBuiltins: fix changes program behavior

Internal evidence sheet generated by fixhunt. Not an issue text. A human re-verifies, checks the duplicates
below, and writes the upstream report in their own words following the project's AI policy.

- Tool: biome 2.5.15
- Rule: suspicious/noPrototypeBuiltins (tool labels the fix: safe, this fix reported as safe)
- Oracle: fix-changes-behavior
- Judge (Nemotron 3 Ultra, advisory): intended-change, severity low. The rule intentionally replaces direct prototype method calls with static Object.hasOwn to avoid shadowing vulnerabilities. The original code threw a TypeError when accessing hasOwnProperty on null, while the fixed code throws a different TypeError from Object.hasOwn when passed null. This behavioral difference is the documented purpose of the rule—bypassing the object's own property lookup—so the change is intended, not a bug.
- Program: minimized from 13 to 9 lines

## Reproducer

```js
let obj = null;
try {
} catch (e) {
}
try {
  console.log(obj.hasOwnProperty('prop'));
} catch (e) {
  console.log('Direct call threw:', e.name, e.message);
}
```

## Commands

```sh
node prog.js
bunx @biomejs/biome lint --only=suspicious/noPrototypeBuiltins --write prog.js
node prog.js
```

## Observed

```
stdout before:
Direct call threw: TypeError Cannot read properties of null (reading 'hasOwnProperty')
stdout after:
Direct call threw: TypeError Cannot convert undefined or null to object
```

## Diff applied by the fix

```diff
--- orig.js	2026-10-22 13:36:46.462377459 -0400
+++ fixed.js	2026-10-22 13:36:48.434410778 -0400
@@ -3,7 +3,7 @@
 } catch (e) {
 }
 try {
-  console.log(obj.hasOwnProperty('prop'));
+  console.log(Object.hasOwn(obj, 'prop'));
 } catch (e) {
   console.log('Direct call threw:', e.name, e.message);
 }
```

## Why the rewrite is not equivalent (model draft, verify before use)

The original code calls hasOwnProperty directly on `obj`, which is null; accessing any property on null throws "Cannot read properties of null". The replacement uses Object.hasOwn(null, 'prop'), which first attempts to convert its first argument to an object via ToObject, and converting null or undefined throws "Cannot convert undefined or null to object". Though both throw TypeErrors, the error messages differ, so the observable output changes, proving the rewrite is not semantics‑preserving.

## Upstream search

Queries: "noPrototypeBuiltins fix", "suspicious noPrototypeBuiltins hasOwnProperty method", "Object.hasOwn replacement direct property access", "null object prototype builtin usage"

- related: https://github.com/biomejs/biome/issues/10769
  useLiteralKeys rule flags __proto__ in computed member expression, same prototype builtins concern but different rule and construct

<details><summary>All hits</summary>

- [github, open] 💅 `useSortedProperties` can produce invalid CSS when the final semicolon is omitted — https://github.com/biomejs/biome/issues/12417
- [github, open] 💅 `useSortedProperties` moves Sass variable declarations below their uses — https://github.com/biomejs/biome/issues/12414
- [github, open] 💅 `useSortedProperties` can change behavior when reordering nested CSS rules — https://github.com/biomejs/biome/issues/12413
- [github, open] 💅 `noUnnecessaryConditions`: false positive on an overloaded call with `undefined` as the default argument (Vue `inject`) — https://github.com/biomejs/biome/issues/12040
- [github, open] 💅 `noSkippedTests` conditionally skip fix suggestion — https://github.com/biomejs/biome/issues/9295
- [github, open] 💅 Actually used private method considered unused — https://github.com/biomejs/biome/issues/8185
- [github, open] 💅 cannot detect that the StrictMode component of React is being exported. — https://github.com/biomejs/biome/issues/10609
- [github, open] 💅 noUnnecessaryConditions callback overload false positive — https://github.com/biomejs/biome/issues/11439
- [github, open] 💅 lint/a11y/useAnchorContent: the PascalCase component allowance is applied only to self-closing elements — https://github.com/biomejs/biome/issues/11872
- [github, open] 💅 useLiteralKeys flags `__proto__` in a computed member expression and offers an unsafe fix that conflicts with noProto — https://github.com/biomejs/biome/issues/10769
- [github, closed] 💅 `noThisInStatic` safe fix is not safe — https://github.com/biomejs/biome/issues/10011

</details>