Landing pull request 365. jQuery.buildFragment, ensure doc is a document; Fixes #8950.

More Details:
 - https://github.com/jquery/jquery/pull/365
 - http://bugs.jquery.com/ticket/8950

1 files changed, 16 insertions, 3 deletions

diff --git a/src/manipulation.js b/src/manipulation.js
index 136260450..a148658f5 100644
--- a/src/manipulation.js
+++ b/src/manipulation.js
@@ -438,8 +438,21 @@ function cloneFixAttributes( src, dest ) {
 }
 
 jQuery.buildFragment = function( args, nodes, scripts ) {
-	var fragment, cacheable, cacheresults,
-		doc = (nodes && nodes[0] ? nodes[0].ownerDocument || nodes[0] : document);
+	var fragment, cacheable, cacheresults, doc;
+
+  // nodes may contain either an explicit document object,
+  // a jQuery collection or context object.
+  // If nodes[0] contains a valid object to assign to doc
+  if ( nodes && nodes[0] ) {
+    doc = nodes[0].ownerDocument || nodes[0];
+  }
+
+  // Ensure that an attr object doesn't incorrectly stand in as a document object
+	// Chrome and Firefox seem to allow this to occur and will throw exception
+	// Fixes #8950
+	if ( !doc.createDocumentFragment ) {
+		doc = document;
+	}
 
 	// Only cache "small" (1/2 KB) HTML strings that are associated with the main document
 	// Cloning options loses the selected state, so don't cache them
@@ -747,4 +760,4 @@ function evalScript( i, elem ) {
 	}
 }
 
-})( jQuery );
+})( jQuery );
\ No newline at end of file