workaround toString() quirks on global context (#4814)

test/compress/sandbox.js

@@ -176,13 +176,13 @@ issue_4054: {
 issue_4811_1: {
     input: {
         for (var PASS in this);
-        console.log(PASS, this);
+        console.log(PASS, this, {} < this);
     }
     expect: {
         for (var PASS in this);
-        console.log(PASS, this);
+        console.log(PASS, this, {} < this);
     }
-    expect_stdout: "PASS [object global]"
+    expect_stdout: "PASS [object global] true"
 }
 
 issue_4811_2: {
@@ -192,12 +192,12 @@ issue_4811_2: {
     input: {
         (async function() {});
         for (var PASS in this);
-        console.log(PASS, this);
+        console.log(PASS, this, {} < this);
     }
     expect: {
         for (var PASS in this);
-        console.log(PASS, this);
+        console.log(PASS, this, {} < this);
     }
-    expect_stdout: "PASS [object global]"
+    expect_stdout: "PASS [object global] true"
     node_version: ">=8"
 }

test/mocha/reduce.js

@@ -366,7 +366,7 @@ describe("test/reduce.js", function() {
         var code = [
             "(async function() {});",
             "for (var k in this);",
-            "console.log(k);",
+            "console.log(k, 42 + this);",
         ].join("\n");
         var result = reduce_test(code, {
             mangle: false,

test/sandbox.js

@@ -170,12 +170,6 @@ function setup(global, builtins, setup_log, setup_tty) {
         },
         global: { get: self },
         self: { get: self },
-        // for Node.js v8+
-        toString: {
-            get: function() {
-                return global_toString;
-            },
-        },
         window: { get: self },
     };
     [
@@ -205,15 +199,19 @@ function setup(global, builtins, setup_log, setup_tty) {
         } catch (e) {}
     });
     Object.defineProperties(global, props);
+    // for Node.js v8+
+    if (global.toString !== Object.prototype.toString) {
+        global.__proto__ = Object.defineProperty(Object.create(global.__proto__), "toString", {
+            value: function() {
+                return "[object global]";
+            },
+        });
+    }
 
     function self() {
         return this;
     }
 
-    function global_toString() {
-        return "[object global]";
-    }
-
     function safe_log(arg, cache) {
         if (arg) switch (typeof arg) {
           case "function":

test/ufuzz/index.js

@@ -2206,8 +2206,7 @@ function log(options) {
 function sort_globals(code) {
     var globals = run_code("throw Object.keys(this).sort(" + function(global) {
         return function(m, n) {
-            return (n == "toString") - (m == "toString")
+            return (typeof global[n] == "function") - (typeof global[m] == "function")
-                || (typeof global[n] == "function") - (typeof global[m] == "function")
                 || (m < n ? -1 : m > n ? 1 : 0);
         };
     } + "(this));" + code);