fix unsafe evaluate of function property (#2927)

fixes #2926

lib/compress.js

@@ -2232,6 +2232,7 @@ merge(Compressor.prototype, {
             "slice",
         ].concat(object_fns),
         Boolean: object_fns,
+        Function: object_fns,
         Number: [
             "toExponential",
             "toFixed",
@@ -2340,10 +2341,10 @@ merge(Compressor.prototype, {
         });
         def(AST_Function, function(compressor) {
             if (compressor.option("unsafe")) {
-                var node = this;
                 var fn = function() {};
+                fn.node = this;
                 fn.toString = function() {
-                    return node.print_to_string();
+                    return this.node.print_to_string();
                 };
                 return fn;
             }
@@ -2523,6 +2524,14 @@ merge(Compressor.prototype, {
                 } else {
                     val = exp._eval(compressor, depth + 1);
                     if (!val || val === exp || !HOP(val, key)) return this;
+                    if (typeof val == "function") switch (key) {
+                      case "name":
+                        return val.node.name ? val.node.name.name : "";
+                      case "length":
+                        return val.node.argnames.length;
+                      default:
+                        return this;
+                    }
                 }
                 return val[key];
             }