fix corner case in unsafe_math (#3677)

fixes #3676

lib/compress.js

@@ -6529,7 +6529,9 @@ merge(Compressor.prototype, {
                     && self.right.is_number(compressor)
                     && (self.operator != "+"
                         || self.right.left.is_boolean(compressor)
-                        || self.right.left.is_number(compressor))) {
+                        || self.right.left.is_number(compressor))
+                    && (self.right.left.is_constant_expression()
+                        || !self.right.right.has_side_effects(compressor))) {
                     self = make_node(AST_Binary, self, {
                         operator: align(self.operator, self.right.operator),
                         left: make_node(AST_Binary, self.left, {

test/compress/numbers.js

@@ -1135,3 +1135,35 @@ issue_3655: {
         "0",
     ]
 }
+
+issue_3676_1: {
+    options = {
+        evaluate: true,
+        unsafe_math: true,
+    }
+    input: {
+        var a = [];
+        console.log(false - (a - (a[1] = 42)));
+    }
+    expect: {
+        var a = [];
+        console.log(false - (a - (a[1] = 42)));
+    }
+    expect_stdout: "NaN"
+}
+
+issue_3676_2: {
+    options = {
+        evaluate: true,
+        unsafe_math: true,
+    }
+    input: {
+        var a;
+        console.log(false - ((a = []) - (a[1] = 42)));
+    }
+    expect: {
+        var a;
+        console.log(false - ((a = []) - (a[1] = 42)));
+    }
+    expect_stdout: "NaN"
+}