Landing pull request 365. jQuery.buildFragment, ensure doc is a document; Fixes #8950.

More Details:
 - https://github.com/jquery/jquery/pull/365
 - http://bugs.jquery.com/ticket/8950

src/manipulation.js

@@ -438,8 +438,21 @@ function cloneFixAttributes( src, dest ) {
 }
 
 jQuery.buildFragment = function( args, nodes, scripts ) {
-	var fragment, cacheable, cacheresults,
+	var fragment, cacheable, cacheresults, doc;
-		doc = (nodes && nodes[0] ? nodes[0].ownerDocument || nodes[0] : document);
+
+  // nodes may contain either an explicit document object,
+  // a jQuery collection or context object.
+  // If nodes[0] contains a valid object to assign to doc
+  if ( nodes && nodes[0] ) {
+    doc = nodes[0].ownerDocument || nodes[0];
+  }
+
+  // Ensure that an attr object doesn't incorrectly stand in as a document object
+	// Chrome and Firefox seem to allow this to occur and will throw exception
+	// Fixes #8950
+	if ( !doc.createDocumentFragment ) {
+		doc = document;
+	}
 
 	// Only cache "small" (1/2 KB) HTML strings that are associated with the main document
 	// Cloning options loses the selected state, so don't cache them

test/unit/manipulation.js

@@ -1421,3 +1421,13 @@ test( "jQuery.html - execute scripts escaped with html comment or CDATA (#9221)"
 	         '</script>'
 	     ].join ( "\n" ) ).appendTo( "#qunit-fixture" );
 });
+
+test("jQuery.buildFragment - plain objects are not a document #8950", function() {
+	expect(1);
+
+	try {
+		jQuery('<input type="hidden">', {});
+		ok( true, "Does not allow attribute object to be treated like a doc object");
+	} catch (e) {}
+
+});