From b8e5c5deb30ec1dfae58300f8c0ed2f02a50eede Mon Sep 17 00:00:00 2001
From: Aleen <aleen42@vip.qq.com>
Date: Sat, 14 Dec 2019 19:19:52 +0800
Subject: [PATCH] simulate object.create via ActiveXObject under IE8 #727

---
 packages/core-js/internals/object-create.js | 42 ++++++++++++++++-----
 1 file changed, 33 insertions(+), 9 deletions(-)

diff --git a/packages/core-js/internals/object-create.js b/packages/core-js/internals/object-create.js
index 4d1964867392..f41dd08440d0 100644
--- a/packages/core-js/internals/object-create.js
+++ b/packages/core-js/internals/object-create.js
@@ -8,16 +8,25 @@ var sharedKey = require('../internals/shared-key');
 
 var IE_PROTO = sharedKey('IE_PROTO');
 var PROTOTYPE = 'prototype';
+var SCRIPT = 'script';
 var EmptyConstructor = function () { /* empty */ };
+var scriptTag = function (content) {
+  var GT = '>';
+  var LT = '<';
+  return LT + SCRIPT + GT + content + LT + '/' + SCRIPT + GT;
+};
+
+// Create object with fake `null` prototype: use ActiveX Object with cleared prototype
+var NullProtoObjectViaActiveX = function (activeXDocument) {
+  activeXDocument.write(scriptTag(''));
+  activeXDocument.close();
+  return activeXDocument.parentWindow.Object;
+};
 
 // Create object with fake `null` prototype: use iframe Object with cleared prototype
-var NullProtoObject = function () {
+var NullProtoObjectViaIFrame = function () {
   // Thrash, waste and sodomy: IE GC bug
   var iframe = documentCreateElement('iframe');
-  var length = enumBugKeys.length;
-  var GT = '>';
-  var LT = '<';
-  var SCRIPT = 'script';
   var JS = 'java' + SCRIPT + ':';
   var iframeDocument;
   iframe.style.display = 'none';
@@ -26,13 +35,28 @@ var NullProtoObject = function () {
   iframe.src = String(JS);
   iframeDocument = iframe.contentWindow.document;
   iframeDocument.open();
-  iframeDocument.write(LT + SCRIPT + GT + 'document.F=Object' + LT + '/' + SCRIPT + GT);
+  iframeDocument.write(scriptTag('document.F=Object'));
   iframeDocument.close();
-  NullProtoObject = iframeDocument.F;
-  while (length--) delete NullProtoObject[PROTOTYPE][enumBugKeys[length]];
-  return NullProtoObject();
+  return iframeDocument.F;
 };
 
+// Check for document.domain and active x support
+// No need to use active x approach when document.domain is not set
+// see https://github.com/es-shims/es5-shim/issues/150
+// variation of https://github.com/kitcambridge/es5-shim/commit/4f738ac066346
+var activeXDocument;
+try {
+  activeXDocument = document.domain && new ActiveXObject('htmlfile');
+} catch (ignore) {}
+
+// IE8 cannot run released script when `activeXDocument` is generated inside the following IIFE
+var NullProtoObject = (function () {
+  var ProtoObject = activeXDocument ? NullProtoObjectViaActiveX(activeXDocument) : NullProtoObjectViaIFrame();
+  var length = enumBugKeys.length;
+  while (length--) delete ProtoObject[PROTOTYPE][enumBugKeys[length]];
+  return ProtoObject;
+})();
+
 hiddenKeys[IE_PROTO] = true;
 
 // `Object.create` method