Fix #12266. IE9/10 says document[0] is document.frames[0]? Close gh-903.

src/manipulation.js

@@ -489,15 +489,11 @@ jQuery.buildFragment = function( args, context, scripts ) {
 		first = args[ 0 ];
 
 	// Set context from what may come in as undefined or a jQuery collection or a node
+	// Updated to fix #12266 where accessing context[0] could throw an exception in IE9/10 &
+	// also doubles as fix for #8950 where plain objects caused createDocumentFragment exception
 	context = context || document;
-	context = (context[0] || context).ownerDocument || context[0] || context;
-
-	// Ensure that an attr object doesn't incorrectly stand in as a document object
-	// Chrome and Firefox seem to allow this to occur and will throw exception
-	// Fixes #8950
-	if ( typeof context.createDocumentFragment === "undefined" ) {
-		context = document;
-	}
+	context = !context.nodeType && context[0] || context;
+	context = context.ownerDocument || context;
 
 	// Only cache "small" (1/2 KB) HTML strings that are associated with the main document
 	// Cloning options loses the selected state, so don't cache them

test/data/manipulation/iframe-denied.html

+<!DOCTYPE html>
+<html>
+	<head>
+		<meta charset=utf-8 />
+		<title>body</title>
+	</head>
+	<body>
+		<div id="qunit-fixture"></div>
+		<script src="../../../dist/jquery.js"></script>
+		<script>
+			var script = document.getElementsByTagName( "script" )[ 0 ],
+				div = document.createElement( "div" ),
+				src = "http://google.com",
+				success = true,
+				error = "";
+
+			script.parentNode.appendChild( div );
+			div.innerHTML = "<iframe name=\"test\" src=\"" + src + "\">";
+
+			jQuery(function() {
+				try {
+					jQuery( "<div>hello<div>world</div>!</div>" ).appendTo( "#qunit-fixture" );
+				} catch( e ) {
+					success = false;
+					error = e;
+				}
+
+				window.parent.iframeCallback({
+					status: success,
+					description: "buildFragment sets the context without throwing an exception" +
+						( error ? ": " + error : "" )
+				});
+			});
+			</script>
+	</body>
+</html>

test/unit/manipulation.js

@@ -1933,3 +1933,9 @@ test("checked state is cloned with clone()", function(){
 	elem.checked = true;
 	equal( jQuery(elem).clone().attr("id","clone")[0].checked, true, "Checked true state correctly cloned" );
 });
+
+testIframeWithCallback( "buildFragment works even if document[0] is iframe's window object in IE9/10 (#12266)", "manipulation/iframe-denied.html", function( test ) {
+	expect( 1 );
+
+	ok( test.status, test.description );
+});