diff options
| -rw-r--r-- | src/manipulation.js | 12 | ||||
| -rw-r--r-- | test/data/manipulation/iframe-denied.html | 36 | ||||
| -rw-r--r-- | test/unit/manipulation.js | 6 |
3 files changed, 46 insertions, 8 deletions
diff --git a/src/manipulation.js b/src/manipulation.js index 3cfc97c3b..f87e3ca94 100644 --- a/src/manipulation.js +++ b/src/manipulation.js @@ -489,15 +489,11 @@ jQuery.buildFragment = function( args, context, scripts ) { first = args[ 0 ]; // Set context from what may come in as undefined or a jQuery collection or a node + // Updated to fix #12266 where accessing context[0] could throw an exception in IE9/10 & + // also doubles as fix for #8950 where plain objects caused createDocumentFragment exception context = context || document; - context = (context[0] || context).ownerDocument || context[0] || context; - - // Ensure that an attr object doesn't incorrectly stand in as a document object - // Chrome and Firefox seem to allow this to occur and will throw exception - // Fixes #8950 - if ( typeof context.createDocumentFragment === "undefined" ) { - context = document; - } + context = !context.nodeType && context[0] || context; + context = context.ownerDocument || context; // Only cache "small" (1/2 KB) HTML strings that are associated with the main document // Cloning options loses the selected state, so don't cache them diff --git a/test/data/manipulation/iframe-denied.html b/test/data/manipulation/iframe-denied.html new file mode 100644 index 000000000..f2e3e83a4 --- /dev/null +++ b/test/data/manipulation/iframe-denied.html @@ -0,0 +1,36 @@ +<!DOCTYPE html> +<html> + <head> + <meta charset=utf-8 /> + <title>body</title> + </head> + <body> + <div id="qunit-fixture"></div> + <script src="../../../dist/jquery.js"></script> + <script> + var script = document.getElementsByTagName( "script" )[ 0 ], + div = document.createElement( "div" ), + src = "http://google.com", + success = true, + error = ""; + + script.parentNode.appendChild( div ); + div.innerHTML = "<iframe name=\"test\" src=\"" + src + "\">"; + + jQuery(function() { + try { + jQuery( "<div>hello<div>world</div>!</div>" ).appendTo( "#qunit-fixture" ); + } catch( e ) { + success = false; + error = e; + } + + window.parent.iframeCallback({ + status: success, + description: "buildFragment sets the context without throwing an exception" + + ( error ? ": " + error : "" ) + }); + }); + </script> + </body> +</html> diff --git a/test/unit/manipulation.js b/test/unit/manipulation.js index a33856282..d63b3ff86 100644 --- a/test/unit/manipulation.js +++ b/test/unit/manipulation.js @@ -1933,3 +1933,9 @@ test("checked state is cloned with clone()", function(){ elem.checked = true; equal( jQuery(elem).clone().attr("id","clone")[0].checked, true, "Checked true state correctly cloned" ); }); + +testIframeWithCallback( "buildFragment works even if document[0] is iframe's window object in IE9/10 (#12266)", "manipulation/iframe-denied.html", function( test ) { + expect( 1 ); + + ok( test.status, test.description ); +}); |