src/third_party/mozjs-45/js/src/jit-test/tests/jaeger/bug645985.js

function f(o) {
    o += "";
    o.hasOwnProperty("x");
}
f({});