fix corner case in unsafe evaluate (#4887)

fixes #4886

lib/compress.js

@@ -4344,6 +4344,7 @@ merge(Compressor.prototype, {
             }
             return this;
         });
+        var nonsafe_props = makePredicate("__proto__ toString valueOf");
         def(AST_Object, function(compressor, ignore_side_effects, cached, depth) {
             if (compressor.option("unsafe")) {
                 var val = {};
@@ -4355,7 +4356,7 @@ merge(Compressor.prototype, {
                         key = key._eval(compressor, ignore_side_effects, cached, depth);
                         if (key === prop.key) return this;
                     }
-                    if (key == "toString" || key == "valueOf") return this;
+                    if (nonsafe_props[key]) return this;
                     val[key] = prop.value._eval(compressor, ignore_side_effects, cached, depth);
                     if (val[key] === prop.value) return this;
                 }

test/compress/evaluate.js

@@ -3181,3 +3181,23 @@ issue_4552: {
     }
     expect_stdout: "NaN"
 }
+
+issue_4886: {
+    options = {
+        evaluate: true,
+        unsafe: true,
+    }
+    input: {
+        console.log("length" in {
+            __proto__: function() {},
+            length: void 0,
+        });
+    }
+    expect: {
+        console.log("length" in {
+            __proto__: function() {},
+            length: void 0,
+        });
+    }
+    expect_stdout: "true"
+}