Fixes #13200 - innerHTML in buildFragment need end tags

diff --git a/src/manipulation.js b/src/manipulation.js
index 984f80307f0bfba42de79775806ab75a1462ee56..5b462645c224f12bddbe56096dc01f6dcac6d303 100644 (file)
--- a/src/manipulation.js
+++ b/src/manipulation.js
@@ -29,18 +29,18 @@ var nodeNames = "abbr|article|aside|audio|bdi|canvas|data|datalist|details|figca
        rscriptTypeMasked = /^true\/(.*)/,
        rcleanScript = /^\s*<!(?:\[CDATA\[|--)|(?:\]\]|--)>\s*$/g,
        wrapMap = {
-               option: [ 1, "<select multiple='multiple'>" ],
-               legend: [ 1, "<fieldset>" ],
-               area: [ 1, "<map>" ],
-               param: [ 1, "<object>" ],
-               thead: [ 1, "<table>" ],
-               tr: [ 2, "<table><tbody>" ],
-               col: [ 2, "<table><tbody></tbody><colgroup>", "</table>" ],
-               td: [ 3, "<table><tbody><tr>" ],
+               option: [ 1, "<select multiple='multiple'>", "</select>" ],
+               legend: [ 1, "<fieldset>", "</fieldset>" ],
+               area: [ 1, "<map>", "</map>" ],
+               param: [ 1, "<object>", "</object>" ],
+               thead: [ 1, "<table>", "</table>" ],
+               tr: [ 2, "<table><tbody>", "</tbody></table>" ],
+               col: [ 2, "<table><tbody></tbody><colgroup>", "</colgroup></table>" ],
+               td: [ 3, "<table><tbody><tr>", "</tr></tbody></table>" ],
 
                // IE6-8 can't serialize link, script, style, or any html5 (NoScope) tags,
                // unless wrapped in a div with non-breaking characters in front of it.
-               _default: jQuery.support.htmlSerialize ? [ 0, "" ] : [ 1, "X<div>"  ]
+               _default: jQuery.support.htmlSerialize ? [ 0, "", "" ] : [ 1, "X<div>", "</div>"  ]
        },
        safeFragment = createSafeFragment( document ),
        fragmentDiv = safeFragment.appendChild( document.createElement("div") );
@@ -647,7 +647,8 @@ jQuery.extend({
                                        // Deserialize a standard representation
                                        tag = ( rtagName.exec( elem ) || ["", ""] )[1].toLowerCase();
                                        wrap = wrapMap[ tag ] || wrapMap._default;
-                                       tmp.innerHTML = wrap[1] + elem.replace( rxhtmlTag, "<$1></$2>" ) + ( wrap[2] || "" );
+
+                                       tmp.innerHTML = wrap[1] + elem.replace( rxhtmlTag, "<$1></$2>" ) + wrap[2];
 
                                        // Descend through wrappers to the right content
                                        j = wrap[0];