improve global context enumeration under sandbox (#4812)

fixes #4811

test/compress/sandbox.js

@@ -172,3 +172,32 @@ issue_4054: {
     }
     expect_stdout: "{ p: [Setter] }"
 }
+
+issue_4811_1: {
+    input: {
+        for (var PASS in this);
+        console.log(PASS, this);
+    }
+    expect: {
+        for (var PASS in this);
+        console.log(PASS, this);
+    }
+    expect_stdout: "PASS [object global]"
+}
+
+issue_4811_2: {
+    options = {
+        side_effects: true,
+    }
+    input: {
+        (async function() {});
+        for (var PASS in this);
+        console.log(PASS, this);
+    }
+    expect: {
+        for (var PASS in this);
+        console.log(PASS, this);
+    }
+    expect_stdout: "PASS [object global]"
+    node_version: ">=8"
+}

test/mocha/reduce.js

@@ -361,4 +361,22 @@ describe("test/reduce.js", function() {
         if (result.error) throw result.error;
         assert.strictEqual(result.code, read("test/input/reduce/destructured_catch.reduced.js"));
     });
+    it("Should not enumerate `toString` over global context", function() {
+        if (semver.satisfies(process.version, "<8")) return;
+        var code = [
+            "(async function() {});",
+            "for (var k in this);",
+            "console.log(k);",
+        ].join("\n");
+        var result = reduce_test(code, {
+            mangle: false,
+        });
+        if (result.error) throw result.error;
+        assert.strictEqual(result.code, [
+            "// Can't reproduce test failure",
+            "// minify options: {",
+            '//   "mangle": false',
+            "// }",
+        ].join("\n"));
+    });
 });

test/sandbox.js

@@ -170,6 +170,12 @@ function setup(global, builtins, setup_log, setup_tty) {
         },
         global: { get: self },
         self: { get: self },
+        // for Node.js v8+
+        toString: {
+            get: function() {
+                return global_toString;
+            },
+        },
         window: { get: self },
     };
     [
@@ -199,15 +205,15 @@ function setup(global, builtins, setup_log, setup_tty) {
         } catch (e) {}
     });
     Object.defineProperties(global, props);
-    // for Node.js v8+
-    global.toString = function() {
-        return "[object global]";
-    };
 
     function self() {
         return this;
     }
 
+    function global_toString() {
+        return "[object global]";
+    }
+
     function safe_log(arg, cache) {
         if (arg) switch (typeof arg) {
           case "function":