new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/bug645985.js
@@ -0,0 +1,5 @@
+function f(o) {
+    o += "";
+    o.hasOwnProperty("x");
+}
+f({});

--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -4471,17 +4471,17 @@ mjit::Compiler::testSingletonPropertyTyp
         break;
 
       case JSVAL_TYPE_BOOLEAN:
         key = JSProto_Boolean;
         break;
 
       case JSVAL_TYPE_OBJECT:
       case JSVAL_TYPE_UNKNOWN:
-        if (types->objectCount == 1) {
+        if (types->objectCount == 1 && !top->isNotType(JSVAL_TYPE_OBJECT)) {
             JS_ASSERT_IF(top->isTypeKnown(), top->isType(JSVAL_TYPE_OBJECT));
             types::TypeObject *object = (types::TypeObject *) types->objectSet;
             if (object->proto) {
                 if (!testSingletonProperty(object->proto, id))
                     return false;
 
                 /* If we don't know this is an object, we will need a test. */
                 *testObject = (type != JSVAL_TYPE_OBJECT) && !top->isTypeKnown();