From 9c6f64c7b51d50e334ef1183e2937ad77c0a68b0 Mon Sep 17 00:00:00 2001
From: Bruno PIERRE <brunopierre4@yahoo.fr>
Date: Mon, 24 Jan 2022 18:55:16 +0100
Subject: [PATCH] Core: Don't rely on splice being present on input

Without this fix calling `jQuery.uniqueSort` on an array-like can result in:

TypeError: results.splice is not a function
    at Function.jQuery.uniqueSort (https://code.jquery.com/jquery-git.js:664:12)
    at jQuery.fn.init.find (https://code.jquery.com/jquery-git.js:2394:27)
    at gocusihafe.js:3:4

Closes gh-4986
---
 src/selector/uniqueSort.js |  3 ++-
 src/var/splice.js          |  3 +++
 test/unit/selector.js      | 12 +++++++-----
 3 files changed, 12 insertions(+), 6 deletions(-)
 create mode 100644 src/var/splice.js

diff --git a/src/selector/uniqueSort.js b/src/selector/uniqueSort.js
index 127cc7068..e9438485c 100644
--- a/src/selector/uniqueSort.js
+++ b/src/selector/uniqueSort.js
@@ -1,6 +1,7 @@
 import jQuery from "../core.js";
 import document from "../var/document.js";
 import sort from "../var/sort.js";
+import splice from "../var/splice.js";
 
 var hasDuplicate;
 
@@ -80,7 +81,7 @@ jQuery.uniqueSort = function( results ) {
 			}
 		}
 		while ( j-- ) {
-			results.splice( duplicates[ j ], 1 );
+			splice.call( results, duplicates[ j ], 1 );
 		}
 	}
 
diff --git a/src/var/splice.js b/src/var/splice.js
new file mode 100644
index 000000000..7b3661cd1
--- /dev/null
+++ b/src/var/splice.js
@@ -0,0 +1,3 @@
+import arr from "./arr.js";
+
+export default arr.splice;
diff --git a/test/unit/selector.js b/test/unit/selector.js
index 6cf288c19..2b0c251cf 100644
--- a/test/unit/selector.js
+++ b/test/unit/selector.js
@@ -1895,9 +1895,7 @@ QUnit.test( "jQuery.uniqueSort", function( assert ) {
 		}
 	}
 	Arrayish.prototype = {
-		slice: [].slice,
-		sort: [].sort,
-		splice: [].splice
+		sliceForTestOnly: [].slice
 	};
 
 	var i, tests,
@@ -1959,8 +1957,12 @@ QUnit.test( "jQuery.uniqueSort", function( assert ) {
 
 	jQuery.each( tests, function( label, test ) {
 		var length = test.length || test.input.length;
-		assert.deepEqual( jQuery.uniqueSort( test.input ).slice( 0, length ), test.expected, label + " (array)" );
-		assert.deepEqual( jQuery.uniqueSort( new Arrayish( test.input ) ).slice( 0, length ), test.expected, label + " (quasi-array)" );
+		// We duplicate `test.input` because otherwise it is modified by `uniqueSort`
+		// and the second test becomes worthless.
+		assert.deepEqual( jQuery.uniqueSort( test.input.slice( 0 ) ).slice( 0, length ),
+			test.expected, label + " (array)" );
+		assert.deepEqual( jQuery.uniqueSort( new Arrayish( test.input ) ).sliceForTestOnly( 0, length ),
+			test.expected, label + " (quasi-array)" );
 	} );
 } );