Seems to be crashing at

elem[ name ] = value;

in the code below, in IE6 at least:

If applicable, access the attribute via the DOM 0 way

if ( name in elem && notxml && !special ) {

if ( set ) {

We can't allow the type property to be changed (since it causes problems in IE)

if ( name === "type" && rtype.test( elem.nodeName ) && elem.parentNode ) {

jQuery.error( "type property can't be changed" );

}

elem[ name ] = value;

}

Does this crash as well? (I don't have IE6 handy.)

  var e = document.createElement("li");
  e.value = 42;

Note that the value property of an li element is deprecated:

http://msdn.microsoft.com/en-us/library/ms535124(v=VS.85).aspx

dmethvin's comment that the property value is deprecated is correct.

When testing the above using vanilla JavaScript the exact same error (browser terminating unexpectedly) is incurred as when one uses jQuery to attempt to achieve the same result.

Given that this appears to be more of a vendor browser issue and not a jQuery core one, I am flagging as invalid due to the deprecation factor.

@value is not deprecated in HTML5. This should be fixed.

http://www.w3.org/TR/html5/grouping-content.html#the-li-element

I am not sure why I said it was deprecated, the link I gave doesn't say that so maybe it was changed recently.

The problem remains, however. We can't get Microsoft to change IE6 or IE7. So how should it be "fixed" reasonably? If we silently avoid setting

value

on IE6/7 then it will make debugging difficult. My recommendation would be wontfix for the code and simply document this but other solutions are welcome.

The crash only occurs if the element is not attached to the document and the attribute is set.

Workaround 1: Set the attribute after appending the element to the document.

Workaround 2: Set the attribute in the string directly, e.g. $('<li value="2">').