Landing pull request 365. jQuery.buildFragment, ensure doc is a document; Fixes #8950.

More Details:
 - https://github.com/jquery/jquery/pull/365
 - http://bugs.jquery.com/ticket/8950

src/manipulation.js

@@ -438,8 +438,21 @@ function cloneFixAttributes( src, dest ) {
 }
 
 jQuery.buildFragment = function( args, nodes, scripts ) {
-	var fragment, cacheable, cacheresults,
-		doc = (nodes && nodes[0] ? nodes[0].ownerDocument || nodes[0] : document);
+	var fragment, cacheable, cacheresults, doc;
+
+  // nodes may contain either an explicit document object,
+  // a jQuery collection or context object.
+  // If nodes[0] contains a valid object to assign to doc
+  if ( nodes && nodes[0] ) {
+    doc = nodes[0].ownerDocument || nodes[0];
+  }
+
+  // Ensure that an attr object doesn't incorrectly stand in as a document object
+	// Chrome and Firefox seem to allow this to occur and will throw exception
+	// Fixes #8950
+	if ( !doc.createDocumentFragment ) {
+		doc = document;
+	}
 
 	// Only cache "small" (1/2 KB) HTML strings that are associated with the main document
 	// Cloning options loses the selected state, so don't cache them
@@ -747,4 +760,4 @@ function evalScript( i, elem ) {
 	}
 }
 
-})( jQuery );
+})( jQuery );
\ No newline at end of file

test/unit/manipulation.js

@@ -1393,7 +1393,7 @@ test("jQuery.buildFragment - no plain-text caching (Bug #6779)", function() {
 		}
 		catch(e) {}
 	}
-    equals($f.text(), bad.join(""), "Cached strings that match Object properties");
+	equals($f.text(), bad.join(""), "Cached strings that match Object properties");
 	$f.remove();
 });
 
@@ -1421,3 +1421,13 @@ test( "jQuery.html - execute scripts escaped with html comment or CDATA (#9221)"
 	         '</script>'
 	     ].join ( "\n" ) ).appendTo( "#qunit-fixture" );
 });
+
+test("jQuery.buildFragment - plain objects are not a document #8950", function() {
+	expect(1);
+
+	try {
+		jQuery('<input type="hidden">', {});
+		ok( true, "Does not allow attribute object to be treated like a doc object");
+	} catch (e) {}
+
+});