From df980db4a887bf6d48d872d8dd61713dc42f7842 Mon Sep 17 00:00:00 2001
From: "Alex Lam S.L" <alexlamsl@gmail.com>
Date: Sat, 1 May 2021 00:24:39 +0100
Subject: [PATCH] fix corner case in `unsafe` `evaluate` (#4887)

fixes #4886
---
 lib/compress.js           |  3 ++-
 test/compress/evaluate.js | 20 ++++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/lib/compress.js b/lib/compress.js
index ce126c8094..0506f61c11 100644
--- a/lib/compress.js
+++ b/lib/compress.js
@@ -4344,6 +4344,7 @@ merge(Compressor.prototype, {
             }
             return this;
         });
+        var nonsafe_props = makePredicate("__proto__ toString valueOf");
         def(AST_Object, function(compressor, ignore_side_effects, cached, depth) {
             if (compressor.option("unsafe")) {
                 var val = {};
@@ -4355,7 +4356,7 @@ merge(Compressor.prototype, {
                         key = key._eval(compressor, ignore_side_effects, cached, depth);
                         if (key === prop.key) return this;
                     }
-                    if (key == "toString" || key == "valueOf") return this;
+                    if (nonsafe_props[key]) return this;
                     val[key] = prop.value._eval(compressor, ignore_side_effects, cached, depth);
                     if (val[key] === prop.value) return this;
                 }
diff --git a/test/compress/evaluate.js b/test/compress/evaluate.js
index c92e82bd98..98ce60e8f5 100644
--- a/test/compress/evaluate.js
+++ b/test/compress/evaluate.js
@@ -3181,3 +3181,23 @@ issue_4552: {
     }
     expect_stdout: "NaN"
 }
+
+issue_4886: {
+    options = {
+        evaluate: true,
+        unsafe: true,
+    }
+    input: {
+        console.log("length" in {
+            __proto__: function() {},
+            length: void 0,
+        });
+    }
+    expect: {
+        console.log("length" in {
+            __proto__: function() {},
+            length: void 0,
+        });
+    }
+    expect_stdout: "true"
+}