fix corner case in properties (#4889)

fixes #4888

lib/compress.js

@@ -11533,6 +11533,7 @@ merge(Compressor.prototype, {
 
     AST_PropAccess.DEFMETHOD("flatten_object", function(key, compressor) {
         if (!compressor.option("properties")) return;
+        if (key === "__proto__") return;
         var expr = this.expression;
         if (expr instanceof AST_Object) {
             var props = expr.properties;

test/compress/properties.js

@@ -1446,3 +1446,20 @@ issue_4831_2: {
     expect_stdout: "PASS"
     node_version: ">=4"
 }
+
+issue_4888: {
+    options = {
+        properties: true,
+    }
+    input: {
+        console.log(typeof {
+            __proto__: 42,
+        }.__proto__);
+    }
+    expect: {
+        console.log(typeof {
+            __proto__: 42,
+        }.__proto__);
+    }
+    expect_stdout: "object"
+}