Another fix for [6537] - make sure that .innerHTML isn't used on non-HTML documents...

[jquery.git] / src / manipulation.js

diff --git a/src/manipulation.js b/src/manipulation.js
index 4746dc8..73b0de3 100644 (file)
--- a/src/manipulation.js
+++ b/src/manipulation.js
@@ -4,6 +4,7 @@ var rinlinejQuery = / jQuery\d+="(?:\d+|null)"/g,
        rselfClosing = /^(?:abbr|br|col|img|input|link|meta|param|hr|area|embed)$/i,
        rtagName = /<(\w+)/,
        rtbody = /<tbody/i,
+       rhtml = /</,
        fcloseTag = function(all, front, tag){
                return rselfClosing.test(tag) ?
                        all :
@@ -188,15 +189,15 @@ jQuery.fn.extend({
 
                // See if we can take a shortcut and just use innerHTML
                } else if ( typeof value === "string" && !/<script/i.test( value ) &&
+                       this[0] && !jQuery.isXMLDoc( this[0] ) &&
                        !wrapMap[ (rtagName.exec( value ) || ["", ""])[1].toLowerCase() ] ) {
 
                        for ( var i = 0, l = this.length; i < l; i++ ) {
                                // Remove element nodes and prevent memory leaks
                                if ( this[i].nodeType === 1 ) {
                                        cleanData( this[i].getElementsByTagName("*") );
+                                       this[i].innerHTML = value;
                                }
-
-                               this[i].innerHTML = value;
                        }
 
                } else {
@@ -233,7 +234,7 @@ jQuery.fn.extend({
                        if ( args[0] && args[0].parentNode && args[0].parentNode.nodeType === 11 ) {
                                results = { fragment: args[0].parentNode };
                        } else {
-                               results = buildFragment( args, this[0], scripts );
+                               results = buildFragment( args, this, scripts );
                        }
 
                        first = results.fragment.firstChild;
@@ -368,7 +369,10 @@ jQuery.extend({
                        if ( !elem ) { return; }
 
                        // Convert html string into DOM nodes
-                       if ( typeof elem === "string" ) {
+                       if ( typeof elem === "string" && !rhtml.test( elem ) ) {
+                               elem = context.createTextNode( elem );
+
+                       } else if ( typeof elem === "string" ) {
                                // Fix "XHTML"-style tags in all browsers
                                elem = elem.replace(rxhtmlTag, fcloseTag);