fix corner case in `unsafe` `evaluate` (#4887)

fixes #4886

1 files changed, 2 insertions, 1 deletions

diff --git a/lib/compress.js b/lib/compress.js
index ce126c80..0506f61c 100644
--- a/lib/compress.js
+++ b/lib/compress.js
@@ -4344,6 +4344,7 @@ merge(Compressor.prototype, {
             }
             return this;
         });
+        var nonsafe_props = makePredicate("__proto__ toString valueOf");
         def(AST_Object, function(compressor, ignore_side_effects, cached, depth) {
             if (compressor.option("unsafe")) {
                 var val = {};
@@ -4355,7 +4356,7 @@ merge(Compressor.prototype, {
                         key = key._eval(compressor, ignore_side_effects, cached, depth);
                         if (key === prop.key) return this;
                     }
-                    if (key == "toString" || key == "valueOf") return this;
+                    if (nonsafe_props[key]) return this;
                     val[key] = prop.value._eval(compressor, ignore_side_effects, cached, depth);
                     if (val[key] === prop.value) return this;
                 }