fix corner case in unsafe (#3380)

lib/compress.js

@@ -3018,6 +3018,7 @@ merge(Compressor.prototype, {
                     if (arg === value) return this;
                     args.push(value);
                 }
+                if (key == "replace" && typeof args[1] == "function") return this;
                 try {
                     return val[key].apply(val, args);
                 } catch (ex) {
@@ -3139,6 +3140,7 @@ merge(Compressor.prototype, {
         } else if (expr instanceof AST_RegExp) {
             map = native_fns.RegExp;
         } else if (expr.is_string(compressor)) {
+            if (this.property == "replace") return false;
             map = native_fns.String;
         } else if (!this.may_throw_on_access(compressor)) {
             map = native_fns.Object;

test/compress/dead-code.js

@@ -942,3 +942,21 @@ issue_2929: {
     }
     expect_stdout: "PASS"
 }
+
+unsafe_string_replace: {
+    options = {
+        side_effects: true,
+        unsafe: true,
+    }
+    input: {
+        "foo".replace("f", function() {
+            console.log("PASS");
+        });
+    }
+    expect: {
+        "foo".replace("f", function() {
+            console.log("PASS");
+        });
+    }
+    expect_stdout: "PASS"
+}

test/compress/evaluate.js

@@ -1712,3 +1712,21 @@ unsafe_escaped: {
     }
     expect_stdout: "PASS"
 }
+
+unsafe_string_replace: {
+    options = {
+        evaluate: true,
+        unsafe: true,
+    }
+    input: {
+        "foo".replace("f", function() {
+            console.log("PASS");
+        });
+    }
+    expect: {
+        "foo".replace("f", function() {
+            console.log("PASS");
+        });
+    }
+    expect_stdout: "PASS"
+}