From 9df4f1de12728b44a4b0f91748f12421008d9079 Mon Sep 17 00:00:00 2001
From: "Ahmed.S.ElAfifi" <ahmed.s.elafifi@gmail.com>
Date: Mon, 19 Aug 2019 10:04:01 +0200
Subject: [PATCH] Core: Use Array.prototype.flat where supported

Calling `Array.prototype.concat.apply( [], inputArray )` to flatten `inputArray`
crashes for large arrays; using `Array.prototype.flat` avoids these issues in
browsers that support it. In case it's necessary to support these large arrays
even in older browsers, a polyfill for `Array.prototype.flat` can be loaded.
This is already being done by many applications.

Fixes gh-4320
Closes gh-4459
---
 src/core.js         |  6 +++---
 src/manipulation.js |  6 +++---
 src/var/concat.js   |  7 -------
 src/var/flat.js     | 15 +++++++++++++++
 test/unit/core.js   | 19 ++++++++++++++++++-
 5 files changed, 39 insertions(+), 14 deletions(-)
 delete mode 100644 src/var/concat.js
 create mode 100644 src/var/flat.js

diff --git a/src/core.js b/src/core.js
index 0999da9f56..af5d442144 100644
--- a/src/core.js
+++ b/src/core.js
@@ -6,7 +6,7 @@ define( [
 	"./var/arr",
 	"./var/getProto",
 	"./var/slice",
-	"./var/concat",
+	"./var/flat",
 	"./var/push",
 	"./var/indexOf",
 	"./var/class2type",
@@ -18,7 +18,7 @@ define( [
 	"./var/isWindow",
 	"./core/DOMEval",
 	"./core/toType"
-], function( arr, getProto, slice, concat, push, indexOf,
+], function( arr, getProto, slice, flat, push, indexOf,
 	class2type, toString, hasOwn, fnToString, ObjectFunctionString,
 	support, isWindow, DOMEval, toType ) {
 
@@ -397,7 +397,7 @@ jQuery.extend( {
 		}
 
 		// Flatten any nested arrays
-		return concat.apply( [], ret );
+		return flat( ret );
 	},
 
 	// A global GUID counter for objects
diff --git a/src/manipulation.js b/src/manipulation.js
index fc4c659fd7..11bd5b0798 100644
--- a/src/manipulation.js
+++ b/src/manipulation.js
@@ -1,7 +1,7 @@
 define( [
 	"./core",
 	"./core/isAttached",
-	"./var/concat",
+	"./var/flat",
 	"./var/isIE",
 	"./var/push",
 	"./core/access",
@@ -22,7 +22,7 @@ define( [
 	"./traversing",
 	"./selector",
 	"./event"
-], function( jQuery, isAttached, concat, isIE, push, access, rtagName,
+], function( jQuery, isAttached, flat, isIE, push, access, rtagName,
 	rscriptType, wrapMap, getAll, setGlobalEval, buildFragment,
 	dataPriv, dataUser, acceptData, DOMEval, nodeName ) {
 
@@ -103,7 +103,7 @@ function cloneCopyEvent( src, dest ) {
 function domManip( collection, args, callback, ignored ) {
 
 	// Flatten any nested arrays
-	args = concat.apply( [], args );
+	args = flat( args );
 
 	var fragment, first, scripts, hasScripts, node, doc,
 		i = 0,
diff --git a/src/var/concat.js b/src/var/concat.js
deleted file mode 100644
index e47c19d753..0000000000
--- a/src/var/concat.js
+++ /dev/null
@@ -1,7 +0,0 @@
-define( [
-	"./arr"
-], function( arr ) {
-	"use strict";
-
-	return arr.concat;
-} );
diff --git a/src/var/flat.js b/src/var/flat.js
new file mode 100644
index 0000000000..6c7a27169e
--- /dev/null
+++ b/src/var/flat.js
@@ -0,0 +1,15 @@
+define( [
+	"./arr"
+], function( arr ) {
+
+"use strict";
+
+// Support: IE 11+, Edge 18+
+// Provide fallback for browsers without Array#flat.
+return arr.flat ? function( array ) {
+	return arr.flat.call( array );
+} : function( array ) {
+	return arr.concat.apply( [], array );
+};
+
+} );
diff --git a/test/unit/core.js b/test/unit/core.js
index be09163acf..bc5d2fc258 100644
--- a/test/unit/core.js
+++ b/test/unit/core.js
@@ -681,7 +681,7 @@ QUnit.test( "map()", function( assert ) {
 } );
 
 QUnit.test( "jQuery.map", function( assert ) {
-	assert.expect( 25 );
+	assert.expect( 28 );
 
 	var i, label, result, callback;
 
@@ -781,6 +781,23 @@ QUnit.test( "jQuery.map", function( assert ) {
 		return k % 2 ? k : [ k, k, k ];
 	} );
 	assert.equal( result.join( "" ), "00012223", "Array results flattened (#2616)" );
+
+	result = jQuery.map( [ [ [ 1, 2 ], 3 ], 4 ], function( v, k ) {
+		return v;
+	} );
+	assert.equal( result.length, 3, "Array flatten only one level down" );
+	assert.ok( Array.isArray( result[ 0 ] ), "Array flatten only one level down" );
+
+	// Support: IE 11+, Edge 18+
+	// Skip the test in browsers without Array#flat.
+	if ( Array.prototype.flat ) {
+		result = jQuery.map( Array( 300000 ), function( v, k ) {
+			return k;
+		} );
+		assert.equal( result.length, 300000, "Able to map 300000 records without any problems (#4320)" );
+	} else {
+		assert.ok( "skip", "Array#flat doesn't supported on all browsers" );
+	}
 } );
 
 QUnit.test( "jQuery.merge()", function( assert ) {