New upstream version 12.2.9

CHANGELOG.md

@@ -2,6 +2,26 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
 
+## 12.2.9
+
+### Security (14 changes)
+
+- Standardize error response when route is missing.
+- Do not display project labels that are not visible for user accessing group labels.
+- Show cross-referenced label and milestones in issues' activities only to authorized users.
+- Analyze incoming GraphQL queries and check for recursion.
+- Disallow unprivileged users from commenting on private repository commits.
+- Don't allow maintainers of a target project to delete the source branch of a merge request from a fork.
+- Require Maintainer permission on group where project is transferred to.
+- Don't leak private members in project member autocomplete suggestions.
+- Return 404 on LFS request if project doesn't exist.
+- Mask sentry auth token in Error Tracking dashboard.
+- Fixes a Open Redirect issue in `InternalRedirect`.
+- Sanitize search text to prevent XSS.
+- Sanitize all wiki markup formats with GitLab sanitization pipelines.
+- Fix stored XSS issue for grafana_url.
+
+
 ## 12.2.8
 
 - No changes.

VERSION

@@ -1 +1 @@
-12.2.8
+12.2.9

app/assets/javascripts/project_find_file.js

@@ -5,6 +5,7 @@ import fuzzaldrinPlus from 'fuzzaldrin-plus';
 import axios from '~/lib/utils/axios_utils';
 import flash from '~/flash';
 import { __ } from '~/locale';
+import sanitize from 'sanitize-html';
 
 // highlight text(awefwbwgtc -> <b>a</b>wefw<b>b</b>wgt<b>c</b> )
 const highlighter = function(element, text, matches) {
@@ -75,7 +76,7 @@ export default class ProjectFindFile {
 
   findFile() {
     var result, searchText;
-    searchText = this.inputElement.val();
+    searchText = sanitize(this.inputElement.val());
     result =
       searchText.length > 0 ? fuzzaldrinPlus.filter(this.filePaths, searchText) : this.filePaths;
     return this.renderList(result, searchText);

app/controllers/application_controller.rb

@@ -14,7 +14,7 @@ class ApplicationController < ActionController::Base
   include SessionlessAuthentication
   include ConfirmEmailWarning
 
-  before_action :authenticate_user!
+  before_action :authenticate_user!, except: [:route_not_found]
   before_action :enforce_terms!, if: :should_enforce_terms?
   before_action :validate_user_service_ticket!
   before_action :check_password_expiration
@@ -92,7 +92,9 @@ class ApplicationController < ActionController::Base
     if current_user
       not_found
     else
-      authenticate_user!
+      store_location_for(:user, request.fullpath) unless request.xhr?
+
+      redirect_to new_user_session_path, alert: I18n.t('devise.failure.unauthenticated')
     end
   end
 

app/controllers/concerns/internal_redirect.rb

@@ -6,7 +6,7 @@ module InternalRedirect
   def safe_redirect_path(path)
     return unless path
     # Verify that the string starts with a `/` and a known route character.
-    return unless path =~ %r{^/[-\w].*$}
+    return unless path =~ %r{\A/[-\w].*\z}
 
     uri = URI(path)
     # Ignore anything path of the redirect except for the path, querystring and,

app/controllers/concerns/lfs_request.rb

@@ -34,6 +34,7 @@ module LfsRequest
   end
 
   def lfs_check_access!
+    return render_lfs_not_found unless project
     return if download_request? && lfs_download_access?
     return if upload_request? && lfs_upload_access?
 

app/finders/labels_finder.rb

@@ -51,7 +51,7 @@ class LabelsFinder < UnionFinder
       end
 
       label_ids << Label.where(group_id: projects.group_ids)
-      label_ids << Label.where(project_id: projects.select(:id)) unless only_group_labels?
+      label_ids << Label.where(project_id: ids_user_can_read_labels(projects)) unless only_group_labels?
     end
 
     label_ids
@@ -188,4 +188,10 @@ class LabelsFinder < UnionFinder
       groups.select { |group| authorized_to_read_labels?(group) }
     end
   end
+
+  # rubocop: disable CodeReuse/ActiveRecord
+  def ids_user_can_read_labels(projects)
+    Project.where(id: projects.select(:id)).ids_with_issuables_available_for(current_user)
+  end
+  # rubocop: enable CodeReuse/ActiveRecord
 end

app/graphql/gitlab_schema.rb

@@ -18,15 +18,15 @@ class GitlabSchema < GraphQL::Schema
   use Gitlab::Graphql::GenericTracing
 
   query_analyzer Gitlab::Graphql::QueryAnalyzers::LoggerAnalyzer.new
-
-  query(Types::QueryType)
-
-  default_max_page_size 100
+  query_analyzer Gitlab::Graphql::QueryAnalyzers::RecursionAnalyzer.new
 
   max_complexity DEFAULT_MAX_COMPLEXITY
   max_depth DEFAULT_MAX_DEPTH
 
-  mutation(Types::MutationType)
+  query Types::QueryType
+  mutation Types::MutationType
+
+  default_max_page_size 100
 
   class << self
     def multiplex(queries, **kwargs)

app/helpers/markup_helper.rb

@@ -133,15 +133,7 @@ module MarkupHelper
       issuable_state_filter_enabled: true
     )
 
-    html =
-      case wiki_page.format
-      when :markdown
-        markdown_unsafe(text, context)
-      when :asciidoc
-        asciidoc_unsafe(text)
-      else
-        wiki_page.formatted_content.html_safe
-      end
+    html = markup_unsafe(wiki_page.path, text, context)
 
     prepare_for_rendering(html, context)
   end

app/models/application_setting.rb

@@ -7,6 +7,13 @@ class ApplicationSetting < ApplicationRecord
   include IgnorableColumn
   include ChronicDurationAttribute
 
+  GRAFANA_URL_RULES = {
+    allow_localhost: true,
+    allow_local_network: true,
+    enforce_sanitization: true,
+    require_absolute: false
+  }.freeze
+
   add_authentication_token_field :runners_registration_token, encrypted: -> { Feature.enabled?(:application_settings_tokens_optional_encryption, default_enabled: true) ? :optional : :required }
   add_authentication_token_field :health_check_access_token
 
@@ -55,6 +62,11 @@ class ApplicationSetting < ApplicationRecord
             allow_nil: false,
             qualified_domain_array: true
 
+  validates :grafana_url,
+            allow_blank: true,
+            allow_nil: true,
+            addressable_url: GRAFANA_URL_RULES
+
   validates :session_expire_delay,
             presence: true,
             numericality: { only_integer: true, greater_than_or_equal_to: 0 }
@@ -72,7 +84,6 @@ class ApplicationSetting < ApplicationRecord
   validates :after_sign_out_path,
             allow_blank: true,
             addressable_url: true
-
   validates :admin_notification_email,
             devise_email: true,
             allow_blank: true
@@ -303,6 +314,14 @@ class ApplicationSetting < ApplicationRecord
     current_without_cache
   end
 
+  def grafana_url
+    if Gitlab::UrlBlocker.blocked_url?(self[:grafana_url], GRAFANA_URL_RULES)
+      ApplicationSetting.column_defaults["grafana_url"]
+    else
+      self[:grafana_url]
+    end
+  end
+
   # By default, the backend is Rails.cache, which uses
   # ActiveSupport::Cache::RedisStore. Since loading ApplicationSetting
   # can cause a significant amount of load on Redis, let's cache it in

app/models/concerns/mentionable/reference_regexes.rb

@@ -13,7 +13,9 @@ module Mentionable
     def self.other_patterns
       [
         Commit.reference_pattern,
-        MergeRequest.reference_pattern
+        MergeRequest.reference_pattern,
+        Label.reference_pattern,
+        Milestone.reference_pattern
       ]
     end
 

app/models/discussion.rb

@@ -16,6 +16,7 @@ class Discussion
             :commit_id,
             :for_commit?,
             :for_merge_request?,
+            :noteable_ability_name,
             :to_ability_name,
             :editable?,
             :visible_for?,

app/models/member.rb

@@ -8,6 +8,7 @@ class Member < ApplicationRecord
   include Gitlab::Access
   include Presentable
   include Gitlab::Utils::StrongMemoize
+  include FromUnion
 
   attr_accessor :raw_invite_token
 

app/models/merge_request.rb

@@ -67,6 +67,14 @@ class MergeRequest < ApplicationRecord
   has_many :merge_request_assignees
   has_many :assignees, class_name: "User", through: :merge_request_assignees
 
+  KNOWN_MERGE_PARAMS = [
+    :auto_merge_strategy,
+    :should_remove_source_branch,
+    :force_remove_source_branch,
+    :commit_message,
+    :squash_commit_message,
+    :sha
+  ].freeze
   serialize :merge_params, Hash # rubocop:disable Cop/ActiveRecordSerialize
 
   after_create :ensure_merge_request_diff

app/models/milestone.rb

@@ -254,6 +254,10 @@ class Milestone < ApplicationRecord
     group || project
   end
 
+  def to_ability_name
+    model_name.singular
+  end
+
   def group_milestone?
     group_id.present?
   end

app/models/note.rb

@@ -353,6 +353,10 @@ class Note < ApplicationRecord
   end
 
   def to_ability_name
+    model_name.singular
+  end
+
+  def noteable_ability_name
     for_snippet? ? noteable.class.name.underscore : noteable_type.demodulize.underscore
   end
 

app/models/project.rb

@@ -581,11 +581,11 @@ class Project < ApplicationRecord
       joins(:namespace).where(namespaces: { type: 'Group' }).select(:namespace_id)
     end
 
-    # Returns ids of projects with milestones available for given user
+    # Returns ids of projects with issuables available for given user
     #
-    # Used on queries to find milestones which user can see
-    # For example: Milestone.where(project_id: ids_with_milestone_available_for(user))
-    def ids_with_milestone_available_for(user)
+    # Used on queries to find milestones or labels which user can see
+    # For example: Milestone.where(project_id: ids_with_issuables_available_for(user))
+    def ids_with_issuables_available_for(user)
       with_issues_enabled = with_issues_available_for_user(user).select(:id)
       with_merge_requests_enabled = with_merge_requests_available_for_user(user).select(:id)
 
@@ -1223,6 +1223,10 @@ class Project < ApplicationRecord
     end
   end
 
+  def to_ability_name
+    model_name.singular
+  end
+
   # rubocop: disable CodeReuse/ServiceClass
   def execute_hooks(data, hooks_scope = :push_hooks)
     run_after_commit_or_now do

app/models/system_note_metadata.rb

@@ -10,6 +10,7 @@ class SystemNoteMetadata < ApplicationRecord
     commit cross_reference
     close duplicate
     moved merge
+    label milestone
   ].freeze
 
   ICON_TYPES = %w[

app/models/wiki_page.rb

@@ -138,6 +138,12 @@ class WikiPage
     @version ||= @page.version
   end
 
+  def path
+    return unless persisted?
+
+    @path ||= @page.path
+  end
+
   def versions(options = {})
     return [] unless persisted?
 

app/policies/commit_policy.rb

@@ -4,4 +4,5 @@ class CommitPolicy < BasePolicy
   delegate { @subject.project }
 
   rule { can?(:download_code) }.enable :read_commit
+  rule { ~can?(:read_commit) }.prevent :create_note
 end

app/policies/group_policy.rb

@@ -124,6 +124,8 @@ class GroupPolicy < BasePolicy
   rule { developer & developer_maintainer_access }.enable :create_projects
   rule { create_projects_disabled }.prevent :create_projects
 
+  rule { maintainer & can?(:create_projects) }.enable :transfer_projects
+
   def access_level
     return GroupMember::NO_ACCESS if @user.nil?
 

app/policies/namespace_policy.rb

@@ -14,4 +14,6 @@ class NamespacePolicy < BasePolicy
   end
 
   rule { personal_project & ~can_create_personal_project }.prevent :create_projects
+
+  rule { (owner | admin) & can?(:create_projects) }.enable :transfer_projects
 end

app/policies/note_policy.rb

@@ -9,7 +9,7 @@ class NotePolicy < BasePolicy
 
   condition(:editable, scope: :subject) { @subject.editable? }
 
-  condition(:can_read_noteable) { can?(:"read_#{@subject.to_ability_name}") }
+  condition(:can_read_noteable) { can?(:"read_#{@subject.noteable_ability_name}") }
 
   condition(:is_visible) { @subject.visible_for?(@user) }
 

app/services/auto_merge/base_service.rb

@@ -3,12 +3,13 @@
 module AutoMerge
   class BaseService < ::BaseService
     include Gitlab::Utils::StrongMemoize
+    include MergeRequests::AssignsMergeParams
 
     def execute(merge_request)
-      merge_request.merge_params.merge!(params)
+      assign_allowed_merge_params(merge_request, params.merge(auto_merge_strategy: strategy))
+
       merge_request.auto_merge_enabled = true
       merge_request.merge_user = current_user
-      merge_request.auto_merge_strategy = strategy
 
       return :failed unless merge_request.save
 
@@ -21,7 +22,7 @@ module AutoMerge
     end
 
     def update(merge_request)
-      merge_request.merge_params.merge!(params)
+      assign_allowed_merge_params(merge_request, params.merge(auto_merge_strategy: strategy))
 
       return :failed unless merge_request.save
 

app/services/concerns/merge_requests/assigns_merge_params.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module MergeRequests
+  module AssignsMergeParams
+    def self.included(klass)
+      raise "#{self} can not be included in #{klass} without implementing #current_user" unless klass.method_defined?(:current_user)
+    end
+
+    def assign_allowed_merge_params(merge_request, merge_params)
+      known_merge_params = merge_params.to_h.with_indifferent_access.slice(*MergeRequest::KNOWN_MERGE_PARAMS)
+
+      # Not checking `MergeRequest#can_remove_source_branch` as that includes
+      # other checks that aren't needed here.
+      known_merge_params.delete(:force_remove_source_branch) unless current_user.can?(:push_code, merge_request.source_project)
+
+      merge_request.merge_params.merge!(known_merge_params)
+
+      # Delete the known params now that they're assigned, so we don't try to
+      # assign them through an `#assign_attributes` later.
+      # They could be coming in as strings or symbols
+      merge_params.to_h.with_indifferent_access.except!(*MergeRequest::KNOWN_MERGE_PARAMS)
+    end
+  end
+end

app/services/error_tracking/list_projects_service.rb

@@ -32,7 +32,7 @@ module ErrorTracking
           project_slug: 'proj'
         )
 
-        setting.token = params[:token]
+        setting.token = token(setting)
         setting.enabled = true
       end
     end
@@ -40,5 +40,12 @@ module ErrorTracking
     def can_read?
       can?(current_user, :read_sentry_issue, project)
     end
+
+    def token(setting)
+      # Use param token if not masked, otherwise use database token
+      return params[:token] unless /\A\*+\z/.match?(params[:token])
+
+      setting.token
+    end
   end
 end

app/services/merge_requests/base_service.rb

@@ -2,6 +2,8 @@
 
 module MergeRequests
   class BaseService < ::IssuableBaseService
+    include MergeRequests::AssignsMergeParams
+
     def create_note(merge_request, state = merge_request.state)
       SystemNoteService.change_status(merge_request, merge_request.target_project, current_user, state, nil)
     end
@@ -31,6 +33,18 @@ module MergeRequests
 
     private
 
+    def create(merge_request)
+      self.params = assign_allowed_merge_params(merge_request, params)
+
+      super
+    end
+
+    def update(merge_request)
+      self.params = assign_allowed_merge_params(merge_request, params)
+
+      super
+    end
+
     def handle_wip_event(merge_request)
       if wip_event = params.delete(:wip_event)
         # We update the title that is provided in the params or we use the mr title

app/services/merge_requests/build_service.rb

@@ -10,13 +10,14 @@ module MergeRequests
       # TODO: this should handle all quick actions that don't have side effects
       # https://gitlab.com/gitlab-org/gitlab-ce/issues/53658
       merge_quick_actions_into_params!(merge_request, only: [:target_branch])
-      merge_request.merge_params['force_remove_source_branch'] = params.delete(:force_remove_source_branch) if params.has_key?(:force_remove_source_branch)
 
       # Assign the projects first so we can use policies for `filter_params`
       merge_request.author = current_user
       merge_request.source_project = find_source_project
       merge_request.target_project = find_target_project
 
+      self.params = assign_allowed_merge_params(merge_request, params)
+
       filter_params(merge_request)
       merge_request.assign_attributes(params.to_h.compact)
 

app/services/merge_requests/create_service.rb

@@ -9,7 +9,6 @@ module MergeRequests
       merge_request.target_project = @project
       merge_request.source_project = @source_project
       merge_request.source_branch = params[:source_branch]
-      merge_request.merge_params['force_remove_source_branch'] = params.delete(:force_remove_source_branch)
 
       create(merge_request)
     end

app/services/merge_requests/update_service.rb

@@ -16,10 +16,6 @@ module MergeRequests
         params.delete(:force_remove_source_branch)
       end
 
-      if params.has_key?(:force_remove_source_branch)
-        merge_request.merge_params['force_remove_source_branch'] = params.delete(:force_remove_source_branch)
-      end
-
       handle_wip_event(merge_request)
       update_task_event(merge_request) || update(merge_request)
     end

app/services/notification_service.rb

@@ -281,7 +281,7 @@ class NotificationService
   end
 
   def send_new_note_notifications(note)
-    notify_method = "note_#{note.to_ability_name}_email".to_sym
+    notify_method = "note_#{note.noteable_ability_name}_email".to_sym
 
     recipients = NotificationRecipientService.build_new_note_recipients(note)
     recipients.each do |recipient|

app/services/projects/operations/update_service.rb

@@ -34,15 +34,17 @@ module Projects
           organization_slug: settings.dig(:project, :organization_slug)
         )
 
-        {
+        params = {
           error_tracking_setting_attributes: {
             api_url: api_url,
-            token: settings[:token],
             enabled: settings[:enabled],
             project_name: settings.dig(:project, :name),
             organization_name: settings.dig(:project, :organization_name)
           }
         }
+        params[:error_tracking_setting_attributes][:token] = settings[:token] unless /\A\*+\z/.match?(settings[:token]) # Don't update token if we receive masked value
+
+        params
       end
     end
   end

app/services/projects/participants_service.rb

@@ -7,16 +7,69 @@ module Projects
     def execute(noteable)
       @noteable = noteable
 
-      participants = noteable_owner + participants_in_noteable + all_members + groups + project_members
+      participants =
+        noteable_owner +
+        participants_in_noteable +
+        all_members +
+        groups +
+        project_members
+
       participants.uniq
     end
 
     def project_members
-      @project_members ||= sorted(project.team.members)
+      @project_members ||= sorted(get_project_members)
+    end
+
+    def get_project_members
+      members = Member.from_union([project_members_through_ancestral_groups,
+                                   project_members_through_invited_groups,
+                                   individual_project_members])
+
+      User.id_in(members.select(:user_id))
     end
 
     def all_members
       [{ username: "all", name: "All Project and Group Members", count: project_members.count }]
     end
+
+    private
+
+    def project_members_through_invited_groups
+      groups_with_ancestors_ids = Gitlab::ObjectHierarchy
+        .new(visible_groups)
+        .base_and_ancestors
+        .pluck_primary_key
+
+      GroupMember
+        .active_without_invites_and_requests
+        .with_source_id(groups_with_ancestors_ids)
+    end
+
+    def visible_groups
+      visible_groups = project.invited_groups
+
+      unless project_owner?
+        visible_groups = visible_groups.public_or_visible_to_user(current_user)
+      end
+
+      visible_groups
+    end
+
+    def project_members_through_ancestral_groups
+      project.group.present? ? project.group.members_with_parents : Member.none
+    end
+
+    def individual_project_members
+      project.project_members
+    end
+
+    def project_owner?
+      if project.group.present?
+        project.group.owners.include?(current_user)
+      else
+        project.namespace.owner == current_user
+      end
+    end
   end
 end

app/services/projects/transfer_service.rb

@@ -95,7 +95,7 @@ module Projects
       @new_namespace &&
         can?(current_user, :change_namespace, project) &&
         @new_namespace.id != project.namespace_id &&
-        current_user.can?(:create_projects, @new_namespace)
+        current_user.can?(:transfer_projects, @new_namespace)
     end
 
     def update_namespace_and_visibility(to_namespace)

app/validators/addressable_url_validator.rb

@@ -49,7 +49,8 @@ class AddressableUrlValidator < ActiveModel::EachValidator
     allow_local_network: true,
     ascii_only: false,
     enforce_user: false,
-    enforce_sanitization: false
+    enforce_sanitization: false,
+    require_absolute: true
   }.freeze
 
   DEFAULT_OPTIONS = BLOCKER_VALIDATE_OPTIONS.merge({

app/views/projects/settings/operations/_error_tracking.html.haml

@@ -17,4 +17,4 @@
         project: error_tracking_setting_project_json,
         api_host: setting.api_host,
         enabled: setting.enabled.to_json,
-        token: setting.token } }
+        token: setting.token.present? ? '*' * 12 : nil } }

core-js/configurator.js

@@ -1,7 +1,12 @@
+var has = require('./internals/has');
 var isArray = require('./internals/is-array');
 var isForced = require('./internals/is-forced');
+var shared = require('./internals/shared-store');
+
 var data = isForced.data;
 var normalize = isForced.normalize;
+var USE_FUNCTION_CONSTRUCTOR = 'USE_FUNCTION_CONSTRUCTOR';
+var ASYNC_ITERATOR_PROTOTYPE = 'AsyncIteratorPrototype';
 
 var setAggressivenessLevel = function (object, constant) {
   if (isArray(object)) for (var i = 0; i < object.length; i++) data[normalize(object[i])] = constant;
@@ -12,5 +17,7 @@ module.exports = function (options) {
     setAggressivenessLevel(options.useNative, isForced.NATIVE);
     setAggressivenessLevel(options.usePolyfill, isForced.POLYFILL);
     setAggressivenessLevel(options.useFeatureDetection, null);
+    if (has(options, USE_FUNCTION_CONSTRUCTOR)) shared[USE_FUNCTION_CONSTRUCTOR] = !!options[USE_FUNCTION_CONSTRUCTOR];
+    if (has(options, ASYNC_ITERATOR_PROTOTYPE)) shared[USE_FUNCTION_CONSTRUCTOR] = options[ASYNC_ITERATOR_PROTOTYPE];
   }
 };

core-js/es/global-this.js

@@ -0,0 +1,3 @@
+require('../modules/esnext.global-this');
+
+module.exports = require('../internals/global');

core-js/es/index.js

@@ -41,6 +41,7 @@ require('../modules/es.object.lookup-setter');
 require('../modules/es.function.bind');
 require('../modules/es.function.name');
 require('../modules/es.function.has-instance');
+require('../modules/es.global-this');
 require('../modules/es.array.from');
 require('../modules/es.array.is-array');
 require('../modules/es.array.of');

core-js/features/async-iterator/as-indexed-pairs.js

@@ -0,0 +1,10 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.promise');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.async-iterator.constructor');
+require('../../modules/esnext.async-iterator.as-indexed-pairs');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('AsyncIterator', 'asIndexedPairs');

core-js/features/async-iterator/drop.js

@@ -0,0 +1,10 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.promise');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.async-iterator.constructor');
+require('../../modules/esnext.async-iterator.drop');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('AsyncIterator', 'drop');

core-js/features/async-iterator/every.js

@@ -0,0 +1,10 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.promise');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.async-iterator.constructor');
+require('../../modules/esnext.async-iterator.every');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('AsyncIterator', 'every');

core-js/features/async-iterator/filter.js

@@ -0,0 +1,10 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.promise');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.async-iterator.constructor');
+require('../../modules/esnext.async-iterator.filter');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('AsyncIterator', 'filter');

core-js/features/async-iterator/find.js

@@ -0,0 +1,10 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.promise');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.async-iterator.constructor');
+require('../../modules/esnext.async-iterator.find');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('AsyncIterator', 'find');

core-js/features/async-iterator/flat-map.js

@@ -0,0 +1,10 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.promise');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.async-iterator.constructor');
+require('../../modules/esnext.async-iterator.flat-map');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('AsyncIterator', 'flatMap');

core-js/features/async-iterator/for-each.js

@@ -0,0 +1,10 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.promise');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.async-iterator.constructor');
+require('../../modules/esnext.async-iterator.for-each');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('AsyncIterator', 'forEach');

core-js/features/async-iterator/from.js

@@ -0,0 +1,10 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.promise');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.async-iterator.constructor');
+require('../../modules/esnext.async-iterator.from');
+require('../../modules/web.dom-collections.iterator');
+
+var path = require('../../internals/path');
+
+module.exports = path.AsyncIterator.from;

core-js/features/async-iterator/index.js

@@ -0,0 +1,22 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.promise');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.async-iterator.constructor');
+require('../../modules/esnext.async-iterator.as-indexed-pairs');
+require('../../modules/esnext.async-iterator.drop');
+require('../../modules/esnext.async-iterator.every');
+require('../../modules/esnext.async-iterator.filter');
+require('../../modules/esnext.async-iterator.find');
+require('../../modules/esnext.async-iterator.flat-map');
+require('../../modules/esnext.async-iterator.for-each');
+require('../../modules/esnext.async-iterator.from');
+require('../../modules/esnext.async-iterator.map');
+require('../../modules/esnext.async-iterator.reduce');
+require('../../modules/esnext.async-iterator.some');
+require('../../modules/esnext.async-iterator.take');
+require('../../modules/esnext.async-iterator.to-array');
+require('../../modules/web.dom-collections.iterator');
+
+var path = require('../../internals/path');
+
+module.exports = path.AsyncIterator;

core-js/features/async-iterator/map.js

@@ -0,0 +1,10 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.promise');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.async-iterator.constructor');
+require('../../modules/esnext.async-iterator.map');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('AsyncIterator', 'map');

core-js/features/async-iterator/reduce.js

@@ -0,0 +1,10 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.promise');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.async-iterator.constructor');
+require('../../modules/esnext.async-iterator.reduce');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('AsyncIterator', 'reduce');

core-js/features/async-iterator/some.js

@@ -0,0 +1,10 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.promise');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.async-iterator.constructor');
+require('../../modules/esnext.async-iterator.some');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('AsyncIterator', 'some');

core-js/features/async-iterator/take.js

@@ -0,0 +1,10 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.promise');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.async-iterator.constructor');
+require('../../modules/esnext.async-iterator.take');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('AsyncIterator', 'take');

core-js/features/async-iterator/to-array.js

@@ -0,0 +1,10 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.promise');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.async-iterator.constructor');
+require('../../modules/esnext.async-iterator.to-array');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('AsyncIterator', 'toArray');

core-js/features/global-this.js

@@ -1,3 +1 @@
-require('../modules/esnext.global-this');
-
-module.exports = require('../internals/global');
+module.exports = require('../es/global-this');

core-js/features/iterator/as-indexed-pairs.js

@@ -0,0 +1,10 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.iterator.constructor');
+require('../../modules/esnext.iterator.as-indexed-pairs');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('Iterator', 'asIndexedPairs');
+

core-js/features/iterator/drop.js

@@ -0,0 +1,9 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.iterator.constructor');
+require('../../modules/esnext.iterator.drop');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('Iterator', 'drop');

core-js/features/iterator/every.js

@@ -0,0 +1,9 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.iterator.constructor');
+require('../../modules/esnext.iterator.every');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('Iterator', 'every');

core-js/features/iterator/filter.js

@@ -0,0 +1,9 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.iterator.constructor');
+require('../../modules/esnext.iterator.filter');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('Iterator', 'filter');

core-js/features/iterator/find.js

@@ -0,0 +1,9 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.iterator.constructor');
+require('../../modules/esnext.iterator.find');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('Iterator', 'find');

core-js/features/iterator/flat-map.js

@@ -0,0 +1,9 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.iterator.constructor');
+require('../../modules/esnext.iterator.flat-map');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('Iterator', 'flatMap');

core-js/features/iterator/for-each.js

@@ -0,0 +1,9 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.iterator.constructor');
+require('../../modules/esnext.iterator.for-each');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('Iterator', 'forEach');

core-js/features/iterator/from.js

@@ -0,0 +1,9 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.iterator.constructor');
+require('../../modules/esnext.iterator.from');
+require('../../modules/web.dom-collections.iterator');
+
+var path = require('../../internals/path');
+
+module.exports = path.Iterator.from;

core-js/features/iterator/index.js

@@ -0,0 +1,21 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.iterator.constructor');
+require('../../modules/esnext.iterator.as-indexed-pairs');
+require('../../modules/esnext.iterator.drop');
+require('../../modules/esnext.iterator.every');
+require('../../modules/esnext.iterator.filter');
+require('../../modules/esnext.iterator.find');
+require('../../modules/esnext.iterator.flat-map');
+require('../../modules/esnext.iterator.for-each');
+require('../../modules/esnext.iterator.from');
+require('../../modules/esnext.iterator.map');
+require('../../modules/esnext.iterator.reduce');
+require('../../modules/esnext.iterator.some');
+require('../../modules/esnext.iterator.take');
+require('../../modules/esnext.iterator.to-array');
+require('../../modules/web.dom-collections.iterator');
+
+var path = require('../../internals/path');
+
+module.exports = path.Iterator;

core-js/features/iterator/map.js

@@ -0,0 +1,9 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.iterator.constructor');
+require('../../modules/esnext.iterator.map');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('Iterator', 'map');

core-js/features/iterator/reduce.js

@@ -0,0 +1,9 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.iterator.constructor');
+require('../../modules/esnext.iterator.reduce');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('Iterator', 'reduce');

core-js/features/iterator/some.js

@@ -0,0 +1,9 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.iterator.constructor');
+require('../../modules/esnext.iterator.some');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('Iterator', 'some');

core-js/features/iterator/take.js

@@ -0,0 +1,9 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.iterator.constructor');
+require('../../modules/esnext.iterator.take');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('Iterator', 'take');

core-js/features/iterator/to-array.js

@@ -0,0 +1,9 @@
+require('../../modules/es.object.to-string');
+require('../../modules/es.string.iterator');
+require('../../modules/esnext.iterator.constructor');
+require('../../modules/esnext.iterator.to-array');
+require('../../modules/web.dom-collections.iterator');
+
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('Iterator', 'toArray');

core-js/features/map/index.js

@@ -17,4 +17,6 @@ require('../../modules/esnext.map.merge');
 require('../../modules/esnext.map.reduce');
 require('../../modules/esnext.map.some');
 require('../../modules/esnext.map.update');
+// TODO: remove from `core-js@4`
 require('../../modules/esnext.map.update-or-insert');
+require('../../modules/esnext.map.upsert');

core-js/features/map/update-or-insert.js

@@ -1,3 +1,4 @@
+// TODO: remove from `core-js@4`
 require('../../modules/es.map');
 require('../../modules/esnext.map.update-or-insert');
 var entryUnbind = require('../../internals/entry-unbind');

core-js/features/map/upsert.js

@@ -0,0 +1,5 @@
+require('../../modules/es.map');
+require('../../modules/esnext.map.upsert');
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('Map', 'upsert');

core-js/features/weak-map/index.js

@@ -3,3 +3,4 @@ module.exports = require('../../es/weak-map');
 require('../../modules/esnext.weak-map.from');
 require('../../modules/esnext.weak-map.of');
 require('../../modules/esnext.weak-map.delete-all');
+require('../../modules/esnext.weak-map.upsert');

core-js/features/weak-map/upsert.js

@@ -0,0 +1,5 @@
+require('../../modules/es.weak-map');
+require('../../modules/esnext.weak-map.upsert');
+var entryUnbind = require('../../internals/entry-unbind');
+
+module.exports = entryUnbind('WeakMap', 'upsert');

core-js/internals/add-to-unscopables.js

@@ -1,6 +1,6 @@
 var wellKnownSymbol = require('../internals/well-known-symbol');
 var create = require('../internals/object-create');
-var hide = require('../internals/hide');
+var createNonEnumerableProperty = require('../internals/create-non-enumerable-property');
 
 var UNSCOPABLES = wellKnownSymbol('unscopables');
 var ArrayPrototype = Array.prototype;
@@ -8,7 +8,7 @@ var ArrayPrototype = Array.prototype;
 // Array.prototype[@@unscopables]
 // https://tc39.github.io/ecma262/#sec-array.prototype-@@unscopables
 if (ArrayPrototype[UNSCOPABLES] == undefined) {
-  hide(ArrayPrototype, UNSCOPABLES, create(null));
+  createNonEnumerableProperty(ArrayPrototype, UNSCOPABLES, create(null));
 }
 
 // add a key to Array.prototype[@@unscopables]

core-js/internals/array-buffer-view-core.js

@@ -4,7 +4,7 @@ var global = require('../internals/global');
 var isObject = require('../internals/is-object');
 var has = require('../internals/has');
 var classof = require('../internals/classof');
-var hide = require('../internals/hide');
+var createNonEnumerableProperty = require('../internals/create-non-enumerable-property');
 var redefine = require('../internals/redefine');
 var defineProperty = require('../internals/object-define-property').f;
 var getPrototypeOf = require('../internals/object-get-prototype-of');
@@ -140,7 +140,7 @@ if (DESCRIPTORS && !has(TypedArrayPrototype, TO_STRING_TAG)) {
     return isObject(this) ? this[TYPED_ARRAY_TAG] : undefined;
   } });
   for (NAME in TypedArrayConstructorsList) if (global[NAME]) {
-    hide(global[NAME], TYPED_ARRAY_TAG, NAME);
+    createNonEnumerableProperty(global[NAME], TYPED_ARRAY_TAG, NAME);
   }
 }
 

core-js/internals/array-buffer.js

@@ -2,7 +2,7 @@
 var global = require('../internals/global');
 var DESCRIPTORS = require('../internals/descriptors');
 var NATIVE_ARRAY_BUFFER = require('../internals/array-buffer-view-core').NATIVE_ARRAY_BUFFER;
-var hide = require('../internals/hide');
+var createNonEnumerableProperty = require('../internals/create-non-enumerable-property');
 var redefineAll = require('../internals/redefine-all');
 var fails = require('../internals/fails');
 var anInstance = require('../internals/an-instance');
@@ -268,7 +268,9 @@ if (!NATIVE_ARRAY_BUFFER) {
     };
     var ArrayBufferPrototype = $ArrayBuffer[PROTOTYPE] = NativeArrayBuffer[PROTOTYPE];
     for (var keys = getOwnPropertyNames(NativeArrayBuffer), j = 0, key; keys.length > j;) {
-      if (!((key = keys[j++]) in $ArrayBuffer)) hide($ArrayBuffer, key, NativeArrayBuffer[key]);
+      if (!((key = keys[j++]) in $ArrayBuffer)) {
+        createNonEnumerableProperty($ArrayBuffer, key, NativeArrayBuffer[key]);
+      }
     }
     ArrayBufferPrototype.constructor = $ArrayBuffer;
   }
@@ -289,5 +291,8 @@ if (!NATIVE_ARRAY_BUFFER) {
 
 setToStringTag($ArrayBuffer, ARRAY_BUFFER);
 setToStringTag($DataView, DATA_VIEW);
-exports[ARRAY_BUFFER] = $ArrayBuffer;
-exports[DATA_VIEW] = $DataView;
+
+module.exports = {
+  ArrayBuffer: $ArrayBuffer,
+  DataView: $DataView
+};

core-js/internals/array-from.js

@@ -17,13 +17,14 @@ module.exports = function from(arrayLike /* , mapfn = undefined, thisArg = undef
   var mapping = mapfn !== undefined;
   var index = 0;
   var iteratorMethod = getIteratorMethod(O);
-  var length, result, step, iterator;
+  var length, result, step, iterator, next;
   if (mapping) mapfn = bind(mapfn, argumentsLength > 2 ? arguments[2] : undefined, 2);
   // if the target is not iterable or it's an array with the default iterator - use a simple case
   if (iteratorMethod != undefined && !(C == Array && isArrayIteratorMethod(iteratorMethod))) {
     iterator = iteratorMethod.call(O);
+    next = iterator.next;
     result = new C();
-    for (;!(step = iterator.next()).done; index++) {
+    for (;!(step = next.call(iterator)).done; index++) {
       createProperty(result, index, mapping
         ? callWithSafeIterationClosing(iterator, mapfn, [step.value, index], true)
         : step.value

core-js/internals/array-method-has-species-support.js

@@ -1,10 +1,14 @@
 var fails = require('../internals/fails');
 var wellKnownSymbol = require('../internals/well-known-symbol');
+var V8_VERSION = require('../internals/v8-version');
 
 var SPECIES = wellKnownSymbol('species');
 
 module.exports = function (METHOD_NAME) {
-  return !fails(function () {
+  // We can't use this feature detection in V8 since it causes
+  // deoptimization and serious performance degradation
+  // https://github.com/zloirock/core-js/issues/677
+  return V8_VERSION >= 51 || !fails(function () {
     var array = [];
     var constructor = array.constructor = {};
     constructor[SPECIES] = function () {

core-js/internals/async-iterator-iteration.js

@@ -0,0 +1,61 @@
+'use strict';
+// https://github.com/tc39/proposal-iterator-helpers
+var aFunction = require('../internals/a-function');
+var anObject = require('../internals/an-object');
+var getBuiltIn = require('../internals/get-built-in');
+
+var Promise = getBuiltIn('Promise');
+var push = [].push;
+
+var createMethod = function (TYPE) {
+  var IS_TO_ARRAY = TYPE == 0;
+  var IS_FOR_EACH = TYPE == 1;
+  var IS_EVERY = TYPE == 2;
+  var IS_SOME = TYPE == 3;
+  return function (iterator, fn) {
+    anObject(iterator);
+    var next = aFunction(iterator.next);
+    var array = IS_TO_ARRAY ? [] : undefined;
+    if (!IS_TO_ARRAY) aFunction(fn);
+
+    return new Promise(function (resolve, reject) {
+      var loop = function () {
+        try {
+          Promise.resolve(anObject(next.call(iterator))).then(function (step) {
+            try {
+              if (anObject(step).done) {
+                resolve(IS_TO_ARRAY ? array : IS_SOME ? false : IS_EVERY || undefined);
+              } else {
+                var value = step.value;
+                if (IS_TO_ARRAY) {
+                  push.call(array, value);
+                  loop();
+                } else {
+                  Promise.resolve(fn(value)).then(function (result) {
+                    if (IS_FOR_EACH) {
+                      loop();
+                    } else if (IS_EVERY) {
+                      result ? loop() : resolve(false);
+                    } else {
+                      result ? resolve(IS_SOME || value) : loop();
+                    }
+                  }, reject);
+                }
+              }
+            } catch (err) { reject(err); }
+          }, reject);
+        } catch (error) { reject(error); }
+      };
+
+      loop();
+    });
+  };
+};
+
+module.exports = {
+  toArray: createMethod(0),
+  forEach: createMethod(1),
+  every: createMethod(2),
+  some: createMethod(3),
+  find: createMethod(4)
+};

core-js/internals/async-iterator-prototype.js

@@ -0,0 +1,37 @@
+var global = require('../internals/global');
+var shared = require('../internals/shared-store');
+var getPrototypeOf = require('../internals/object-get-prototype-of');
+var has = require('../internals/has');
+var createNonEnumerableProperty = require('../internals/create-non-enumerable-property');
+var wellKnownSymbol = require('../internals/well-known-symbol');
+var IS_PURE = require('../internals/is-pure');
+
+var USE_FUNCTION_CONSTRUCTOR = 'USE_FUNCTION_CONSTRUCTOR';
+var ASYNC_ITERATOR = wellKnownSymbol('asyncIterator');
+var AsyncIterator = global.AsyncIterator;
+var PassedAsyncIteratorPrototype = shared.AsyncIteratorPrototype;
+var AsyncIteratorPrototype, prototype;
+
+if (!IS_PURE) {
+  if (PassedAsyncIteratorPrototype) {
+    AsyncIteratorPrototype = PassedAsyncIteratorPrototype;
+  } else if (typeof AsyncIterator == 'function') {
+    AsyncIteratorPrototype = AsyncIterator.prototype;
+  } else if (shared[USE_FUNCTION_CONSTRUCTOR] || global[USE_FUNCTION_CONSTRUCTOR]) {
+    try {
+      // eslint-disable-next-line no-new-func
+      prototype = getPrototypeOf(getPrototypeOf(getPrototypeOf(Function('return async function*(){}()')())));
+      if (getPrototypeOf(prototype) === Object.prototype) AsyncIteratorPrototype = prototype;
+    } catch (error) { /* empty */ }
+  }
+}
+
+if (!AsyncIteratorPrototype) AsyncIteratorPrototype = {};
+
+if (!has(AsyncIteratorPrototype, ASYNC_ITERATOR)) {
+  createNonEnumerableProperty(AsyncIteratorPrototype, ASYNC_ITERATOR, function () {
+    return this;
+  });
+}
+
+module.exports = AsyncIteratorPrototype;

core-js/internals/create-async-iterator-proxy.js

@@ -0,0 +1,61 @@
+'use strict';
+var path = require('../internals/path');
+var aFunction = require('../internals/a-function');
+var anObject = require('../internals/an-object');
+var create = require('../internals/object-create');
+var createNonEnumerableProperty = require('../internals/create-non-enumerable-property');
+var redefineAll = require('../internals/redefine-all');
+var wellKnownSymbol = require('../internals/well-known-symbol');
+var InternalStateModule = require('../internals/internal-state');
+var getBuiltIn = require('../internals/get-built-in');
+
+var Promise = getBuiltIn('Promise');
+
+var setInternalState = InternalStateModule.set;
+var getInternalState = InternalStateModule.get;
+
+var TO_STRING_TAG = wellKnownSymbol('toStringTag');
+
+var $return = function (value) {
+  var iterator = getInternalState(this).iterator;
+  var $$return = iterator['return'];
+  return $$return === undefined
+    ? Promise.resolve({ done: true, value: value })
+    : anObject($$return.call(iterator, value));
+};
+
+var $throw = function (value) {
+  var iterator = getInternalState(this).iterator;
+  var $$throw = iterator['throw'];
+  return $$throw === undefined
+    ? Promise.reject(value)
+    : $$throw.call(iterator, value);
+};
+
+module.exports = function (nextHandler, IS_ITERATOR) {
+  var AsyncIteratorProxy = function AsyncIterator(state) {
+    state.next = aFunction(state.iterator.next);
+    state.done = false;
+    setInternalState(this, state);
+  };
+
+  AsyncIteratorProxy.prototype = redefineAll(create(path.AsyncIterator.prototype), {
+    next: function next(arg) {
+      var state = getInternalState(this);
+      if (state.done) return Promise.resolve({ done: true, value: undefined });
+      try {
+        return Promise.resolve(anObject(nextHandler.call(state, arg, Promise)));
+      } catch (error) {
+        return Promise.reject(error);
+      }
+    },
+    'return': $return,
+    'throw': $throw
+  });
+
+  if (!IS_ITERATOR) {
+    createNonEnumerableProperty(AsyncIteratorProxy.prototype, TO_STRING_TAG, 'Generator');
+  }
+
+  return AsyncIteratorProxy;
+};

core-js/internals/create-iterator-proxy.js

@@ -0,0 +1,51 @@
+'use strict';
+var path = require('../internals/path');
+var aFunction = require('../internals/a-function');
+var anObject = require('../internals/an-object');
+var create = require('../internals/object-create');
+var createNonEnumerableProperty = require('../internals/create-non-enumerable-property');
+var redefineAll = require('../internals/redefine-all');
+var wellKnownSymbol = require('../internals/well-known-symbol');
+var InternalStateModule = require('../internals/internal-state');
+
+var setInternalState = InternalStateModule.set;
+var getInternalState = InternalStateModule.get;
+
+var TO_STRING_TAG = wellKnownSymbol('toStringTag');
+
+var $return = function (value) {
+  var iterator = getInternalState(this).iterator;
+  var $$return = iterator['return'];
+  return $$return === undefined ? { done: true, value: value } : anObject($$return.call(iterator, value));
+};
+
+var $throw = function (value) {
+  var iterator = getInternalState(this).iterator;
+  var $$throw = iterator['throw'];
+  if ($$throw === undefined) throw value;
+  return $$throw.call(iterator, value);
+};
+
+module.exports = function (nextHandler, IS_ITERATOR) {
+  var IteratorProxy = function Iterator(state) {
+    state.next = aFunction(state.iterator.next);
+    state.done = false;
+    setInternalState(this, state);
+  };
+
+  IteratorProxy.prototype = redefineAll(create(path.Iterator.prototype), {
+    next: function next() {
+      var state = getInternalState(this);
+      var result = state.done ? undefined : nextHandler.apply(state, arguments);
+      return { done: state.done, value: result };
+    },
+    'return': $return,
+    'throw': $throw
+  });
+
+  if (!IS_ITERATOR) {
+    createNonEnumerableProperty(IteratorProxy.prototype, TO_STRING_TAG, 'Generator');
+  }
+
+  return IteratorProxy;
+};

core-js/internals/define-iterator.js

@@ -4,7 +4,7 @@ var createIteratorConstructor = require('../internals/create-iterator-constructo
 var getPrototypeOf = require('../internals/object-get-prototype-of');
 var setPrototypeOf = require('../internals/object-set-prototype-of');
 var setToStringTag = require('../internals/set-to-string-tag');
-var hide = require('../internals/hide');
+var createNonEnumerableProperty = require('../internals/create-non-enumerable-property');
 var redefine = require('../internals/redefine');
 var wellKnownSymbol = require('../internals/well-known-symbol');
 var IS_PURE = require('../internals/is-pure');
@@ -51,7 +51,7 @@ module.exports = function (Iterable, NAME, IteratorConstructor, next, DEFAULT, I
         if (setPrototypeOf) {
           setPrototypeOf(CurrentIteratorPrototype, IteratorPrototype);
         } else if (typeof CurrentIteratorPrototype[ITERATOR] != 'function') {
-          hide(CurrentIteratorPrototype, ITERATOR, returnThis);
+          createNonEnumerableProperty(CurrentIteratorPrototype, ITERATOR, returnThis);
         }
       }
       // Set @@toStringTag to native iterators
@@ -68,7 +68,7 @@ module.exports = function (Iterable, NAME, IteratorConstructor, next, DEFAULT, I
 
   // define iterator
   if ((!IS_PURE || FORCED) && IterablePrototype[ITERATOR] !== defaultIterator) {
-    hide(IterablePrototype, ITERATOR, defaultIterator);
+    createNonEnumerableProperty(IterablePrototype, ITERATOR, defaultIterator);
   }
   Iterators[NAME] = defaultIterator;
 

core-js/internals/export.js

@@ -1,6 +1,6 @@
 var global = require('../internals/global');
 var getOwnPropertyDescriptor = require('../internals/object-get-own-property-descriptor').f;
-var hide = require('../internals/hide');
+var createNonEnumerableProperty = require('../internals/create-non-enumerable-property');
 var redefine = require('../internals/redefine');
 var setGlobal = require('../internals/set-global');
 var copyConstructorProperties = require('../internals/copy-constructor-properties');
@@ -46,7 +46,7 @@ module.exports = function (options, source) {
     }
     // add a flag to not completely full polyfills
     if (options.sham || (targetProperty && targetProperty.sham)) {
-      hide(sourceProperty, 'sham', true);
+      createNonEnumerableProperty(sourceProperty, 'sham', true);
     }
     // extend global
     redefine(target, key, sourceProperty, options);

core-js/internals/fix-regexp-well-known-symbol-logic.js

@@ -1,5 +1,5 @@
 'use strict';
-var hide = require('../internals/hide');
+var createNonEnumerableProperty = require('../internals/create-non-enumerable-property');
 var redefine = require('../internals/redefine');
 var fails = require('../internals/fails');
 var wellKnownSymbol = require('../internals/well-known-symbol');
@@ -44,15 +44,22 @@ module.exports = function (KEY, length, exec, sham) {
     // Symbol-named RegExp methods call .exec
     var execCalled = false;
     var re = /a/;
-    re.exec = function () { execCalled = true; return null; };
 
     if (KEY === 'split') {
+      // We can't use real regex here since it causes deoptimization
+      // and serious performance degradation in V8
+      // https://github.com/zloirock/core-js/issues/306
+      re = {};
       // RegExp[@@split] doesn't call the regex's exec method, but first creates
       // a new one. We need to return the patched regex when creating the new one.
       re.constructor = {};
       re.constructor[SPECIES] = function () { return re; };
+      re.flags = '';
+      re[SYMBOL] = /./[SYMBOL];
     }
 
+    re.exec = function () { execCalled = true; return null; };
+
     re[SYMBOL]('');
     return !execCalled;
   });
@@ -88,6 +95,6 @@ module.exports = function (KEY, length, exec, sham) {
       // 21.2.5.9 RegExp.prototype[@@search](string)
       : function (string) { return regexMethod.call(string, this); }
     );
-    if (sham) hide(RegExp.prototype[SYMBOL], 'sham', true);
+    if (sham) createNonEnumerableProperty(RegExp.prototype[SYMBOL], 'sham', true);
   }
 };

core-js/internals/get-async-iterator-method.js

@@ -0,0 +1,9 @@
+var getIteratorMethod = require('../internals/get-iterator-method');
+var wellKnownSymbol = require('../internals/well-known-symbol');
+
+var ASYNC_ITERATOR = wellKnownSymbol('asyncIterator');
+
+module.exports = function (it) {
+  var method = it[ASYNC_ITERATOR];
+  return method === undefined ? getIteratorMethod(it) : method;
+};

core-js/internals/global.js

@@ -1,4 +1,3 @@
-var O = 'object';
 var check = function (it) {
   return it && it.Math == Math && it;
 };
@@ -6,9 +5,9 @@ var check = function (it) {
 // https://github.com/zloirock/core-js/issues/86#issuecomment-115759028
 module.exports =
   // eslint-disable-next-line no-undef
-  check(typeof globalThis == O && globalThis) ||
-  check(typeof window == O && window) ||
-  check(typeof self == O && self) ||
-  check(typeof global == O && global) ||
+  check(typeof globalThis == 'object' && globalThis) ||
+  check(typeof window == 'object' && window) ||
+  check(typeof self == 'object' && self) ||
+  check(typeof global == 'object' && global) ||
   // eslint-disable-next-line no-new-func
   Function('return this')();

core-js/internals/internal-state.js

@@ -1,7 +1,7 @@
 var NATIVE_WEAK_MAP = require('../internals/native-weak-map');
 var global = require('../internals/global');
 var isObject = require('../internals/is-object');
-var hide = require('../internals/hide');
+var createNonEnumerableProperty = require('../internals/create-non-enumerable-property');
 var objectHas = require('../internals/has');
 var sharedKey = require('../internals/shared-key');
 var hiddenKeys = require('../internals/hidden-keys');
@@ -41,7 +41,7 @@ if (NATIVE_WEAK_MAP) {
   var STATE = sharedKey('state');
   hiddenKeys[STATE] = true;
   set = function (it, metadata) {
-    hide(it, STATE, metadata);
+    createNonEnumerableProperty(it, STATE, metadata);
     return metadata;
   };
   get = function (it) {

core-js/internals/iterate.js

@@ -12,7 +12,7 @@ var Result = function (stopped, result) {
 
 var iterate = module.exports = function (iterable, fn, that, AS_ENTRIES, IS_ITERATOR) {
   var boundFunction = bind(fn, that, AS_ENTRIES ? 2 : 1);
-  var iterator, iterFn, index, length, result, step;
+  var iterator, iterFn, index, length, result, next, step;
 
   if (IS_ITERATOR) {
     iterator = iterable;
@@ -31,9 +31,10 @@ var iterate = module.exports = function (iterable, fn, that, AS_ENTRIES, IS_ITER
     iterator = iterFn.call(iterable);
   }
 
-  while (!(step = iterator.next()).done) {
+  next = iterator.next;
+  while (!(step = next.call(iterator)).done) {
     result = callWithSafeIterationClosing(iterator, boundFunction, step.value, AS_ENTRIES);
-    if (result && result instanceof Result) return result;
+    if (typeof result == 'object' && result && result instanceof Result) return result;
   } return new Result(false);
 };
 

core-js/internals/iterators-core.js

@@ -1,6 +1,6 @@
 'use strict';
 var getPrototypeOf = require('../internals/object-get-prototype-of');
-var hide = require('../internals/hide');
+var createNonEnumerableProperty = require('../internals/create-non-enumerable-property');
 var has = require('../internals/has');
 var wellKnownSymbol = require('../internals/well-known-symbol');
 var IS_PURE = require('../internals/is-pure');
@@ -27,7 +27,9 @@ if ([].keys) {
 if (IteratorPrototype == undefined) IteratorPrototype = {};
 
 // 25.1.2.1.1 %IteratorPrototype%[@@iterator]()
-if (!IS_PURE && !has(IteratorPrototype, ITERATOR)) hide(IteratorPrototype, ITERATOR, returnThis);
+if (!IS_PURE && !has(IteratorPrototype, ITERATOR)) {
+  createNonEnumerableProperty(IteratorPrototype, ITERATOR, returnThis);
+}
 
 module.exports = {
   IteratorPrototype: IteratorPrototype,

core-js/internals/map-upsert.js

@@ -0,0 +1,23 @@
+'use strict';
+var anObject = require('../internals/an-object');
+
+// `Map.prototype.upsert` method
+// https://github.com/thumbsupep/proposal-upsert
+module.exports = function upsert(key, updateFn /* , insertFn */) {
+  var map = anObject(this);
+  var insertFn = arguments.length > 2 ? arguments[2] : undefined;
+  var value;
+  if (typeof updateFn != 'function' && typeof insertFn != 'function') {
+    throw TypeError('At least one callback required');
+  }
+  if (map.has(key)) {
+    value = map.get(key);
+    if (typeof updateFn == 'function') {
+      value = updateFn(value);
+      map.set(key, value);
+    }
+  } else if (typeof insertFn == 'function') {
+    value = insertFn();
+    map.set(key, value);
+  } return value;
+};

core-js/internals/microtask.js

@@ -42,7 +42,7 @@ if (!queueMicrotask) {
   } else if (MutationObserver && !/(iphone|ipod|ipad).*applewebkit/i.test(userAgent)) {
     toggle = true;
     node = document.createTextNode('');
-    new MutationObserver(flush).observe(node, { characterData: true }); // eslint-disable-line no-new
+    new MutationObserver(flush).observe(node, { characterData: true });
     notify = function () {
       node.data = toggle = !toggle;
     };

core-js/internals/native-url.js

@@ -5,13 +5,18 @@ var IS_PURE = require('../internals/is-pure');
 var ITERATOR = wellKnownSymbol('iterator');
 
 module.exports = !fails(function () {
-  var url = new URL('b?e=1', 'http://a');
+  var url = new URL('b?a=1&b=2&c=3', 'http://a');
   var searchParams = url.searchParams;
+  var result = '';
   url.pathname = 'c%20d';
+  searchParams.forEach(function (value, key) {
+    searchParams['delete']('b');
+    result += key + value;
+  });
   return (IS_PURE && !url.toJSON)
     || !searchParams.sort
-    || url.href !== 'http://a/c%20d?e=1'
-    || searchParams.get('e') !== '1'
+    || url.href !== 'http://a/c%20d?a=1&c=3'
+    || searchParams.get('c') !== '3'
     || String(new URLSearchParams('?a=1')) !== 'a=1'
     || !searchParams[ITERATOR]
     // throws in Edge
@@ -20,5 +25,9 @@ module.exports = !fails(function () {
     // not punycoded in Edge
     || new URL('http://тест').host !== 'xn--e1aybc'
     // not escaped in Chrome 62-
-    || new URL('http://a#б').hash !== '#%D0%B1';
+    || new URL('http://a#б').hash !== '#%D0%B1'
+    // fails in Chrome 66-
+    || result !== 'a1c3'
+    // throws in Safari
+    || new URL('http://x', undefined).host !== 'x';
 });

core-js/internals/redefine.js

@@ -1,6 +1,6 @@
 var global = require('../internals/global');
 var shared = require('../internals/shared');
-var hide = require('../internals/hide');
+var createNonEnumerableProperty = require('../internals/create-non-enumerable-property');
 var has = require('../internals/has');
 var setGlobal = require('../internals/set-global');
 var nativeFunctionToString = require('../internals/function-to-string');
@@ -19,7 +19,7 @@ shared('inspectSource', function (it) {
   var simple = options ? !!options.enumerable : false;
   var noTargetGet = options ? !!options.noTargetGet : false;
   if (typeof value == 'function') {
-    if (typeof key == 'string' && !has(value, 'name')) hide(value, 'name', key);
+    if (typeof key == 'string' && !has(value, 'name')) createNonEnumerableProperty(value, 'name', key);
     enforceInternalState(value).source = TEMPLATE.join(typeof key == 'string' ? key : '');
   }
   if (O === global) {
@@ -32,7 +32,7 @@ shared('inspectSource', function (it) {
     simple = true;
   }
   if (simple) O[key] = value;
-  else hide(O, key, value);
+  else createNonEnumerableProperty(O, key, value);
 // add fake Function#toString for correct work wrapped methods / constructors with methods like LoDash isNative
 })(Function.prototype, 'toString', function toString() {
   return typeof this == 'function' && getInternalState(this).source || nativeFunctionToString.call(this);

core-js/internals/set-global.js

@@ -1,9 +1,9 @@
 var global = require('../internals/global');
-var hide = require('../internals/hide');
+var createNonEnumerableProperty = require('../internals/create-non-enumerable-property');
 
 module.exports = function (key, value) {
   try {
-    hide(global, key, value);
+    createNonEnumerableProperty(global, key, value);
   } catch (error) {
     global[key] = value;
   } return value;

core-js/internals/shared-store.js

@@ -0,0 +1,7 @@
+var global = require('../internals/global');
+var setGlobal = require('../internals/set-global');
+
+var SHARED = '__core-js_shared__';
+var store = global[SHARED] || setGlobal(SHARED, {});
+
+module.exports = store;

core-js/internals/shared.js

@@ -1,14 +1,10 @@
-var global = require('../internals/global');
-var setGlobal = require('../internals/set-global');
 var IS_PURE = require('../internals/is-pure');
-
-var SHARED = '__core-js_shared__';
-var store = global[SHARED] || setGlobal(SHARED, {});
+var store = require('../internals/shared-store');
 
 (module.exports = function (key, value) {
   return store[key] || (store[key] = value !== undefined ? value : {});
 })('versions', []).push({
-  version: '3.2.1',
+  version: '3.3.5',
   mode: IS_PURE ? 'pure' : 'global',
   copyright: '© 2019 Denis Pushkarev (zloirock.ru)'
 });

core-js/internals/task.js

@@ -4,6 +4,7 @@ var classof = require('../internals/classof-raw');
 var bind = require('../internals/bind-context');
 var html = require('../internals/html');
 var createElement = require('../internals/document-create-element');
+var userAgent = require('../internals/user-agent');
 
 var location = global.location;
 var set = global.setImmediate;
@@ -67,7 +68,8 @@ if (!set || !clear) {
       Dispatch.now(runner(id));
     };
   // Browsers with MessageChannel, includes WebWorkers
-  } else if (MessageChannel) {
+  // except iOS - https://github.com/zloirock/core-js/issues/624
+  } else if (MessageChannel && !/(iphone|ipod|ipad).*applewebkit/i.test(userAgent)) {
     channel = new MessageChannel();
     port = channel.port2;
     channel.port1.onmessage = listener;

core-js/internals/to-offset.js

@@ -1,7 +1,7 @@
-var toInteger = require('../internals/to-integer');
+var toPositiveInteger = require('../internals/to-positive-integer');
 
 module.exports = function (it, BYTES) {
-  var offset = toInteger(it);
-  if (offset < 0 || offset % BYTES) throw RangeError('Wrong offset');
+  var offset = toPositiveInteger(it);
+  if (offset % BYTES) throw RangeError('Wrong offset');
   return offset;
 };