fix corner case in hoist_props (#5499)

fixes #5498

lib/compress.js

@@ -8311,8 +8311,10 @@ Compressor.prototype.compress = function(node) {
             if (fixed.escaped && fixed.escaped.depth == 1) return;
             return right instanceof AST_Object
                 && right.properties.length > 0
-                && all(right.properties, can_hoist_property)
-                && can_drop_symbol(sym, compressor);
+                && can_drop_symbol(sym, compressor)
+                && all(right.properties, function(prop) {
+                    return can_hoist_property(prop) && prop.key !== "__proto__";
+                });
         }
     });
 

test/compress/hoist_props.js

@@ -1203,3 +1203,24 @@ issue_5441: {
     }
     expect_stdout: "object"
 }
+
+issue_5498: {
+    options = {
+        hoist_props: true,
+        reduce_vars: true,
+        toplevel: true,
+    }
+    input: {
+        var o = {
+            __proto__: 42,
+        };
+        while (console.log(typeof o.__proto__));
+    }
+    expect: {
+        var o = {
+            __proto__: 42,
+        };
+        while (console.log(typeof o.__proto__));
+    }
+    expect_stdout: "object"
+}