diff --git a/src/manipulation.js b/src/manipulation.js index 13626045..a148658f 100644 --- a/src/manipulation.js +++ b/src/manipulation.js @@ -438,8 +438,21 @@ function cloneFixAttributes( src, dest ) { } jQuery.buildFragment = function( args, nodes, scripts ) { - var fragment, cacheable, cacheresults, - doc = (nodes && nodes[0] ? nodes[0].ownerDocument || nodes[0] : document); + var fragment, cacheable, cacheresults, doc; + + // nodes may contain either an explicit document object, + // a jQuery collection or context object. + // If nodes[0] contains a valid object to assign to doc + if ( nodes && nodes[0] ) { + doc = nodes[0].ownerDocument || nodes[0]; + } + + // Ensure that an attr object doesn't incorrectly stand in as a document object + // Chrome and Firefox seem to allow this to occur and will throw exception + // Fixes #8950 + if ( !doc.createDocumentFragment ) { + doc = document; + } // Only cache "small" (1/2 KB) HTML strings that are associated with the main document // Cloning options loses the selected state, so don't cache them @@ -747,4 +760,4 @@ function evalScript( i, elem ) { } } -})( jQuery ); +})( jQuery ); \ No newline at end of file diff --git a/test/unit/manipulation.js b/test/unit/manipulation.js index 2f125b17..ad3d0484 100644 --- a/test/unit/manipulation.js +++ b/test/unit/manipulation.js @@ -1393,7 +1393,7 @@ test("jQuery.buildFragment - no plain-text caching (Bug #6779)", function() { } catch(e) {} } - equals($f.text(), bad.join(""), "Cached strings that match Object properties"); + equals($f.text(), bad.join(""), "Cached strings that match Object properties"); $f.remove(); }); @@ -1421,3 +1421,13 @@ test( "jQuery.html - execute scripts escaped with html comment or CDATA (#9221)" '' ].join ( "\n" ) ).appendTo( "#qunit-fixture" ); }); + +test("jQuery.buildFragment - plain objects are not a document #8950", function() { + expect(1); + + try { + jQuery('', {}); + ok( true, "Does not allow attribute object to be treated like a doc object"); + } catch (e) {} + +});