#4723 is a duplicate of this bug.

#7059 is a duplicate of this bug.

Retargeting for next release.

I've been working around this issue for my current project. The VML elements have a scopeName value of 'rvml'. It appears to be consistent across versions so I was able to change the event.target when that condition was met.

3rd party pull request

I was replaced all occurrences of "elem.type" to "jQuery.elemGetType(elem)" and patched Sizzle to version from 3 Nov 2010.

#!js
jQuery.extend({
  elemGetType: function(elem) {
    if (elem && jQuery.browser.msie && elem.scopeName &&
        elem.scopeName != 'HTML' &&
        document.namespaces.item(elem.scopeName).urn.toLowerCase() ==
        'urn:schemas-microsoft-com:vml') {
      return 'vml';
    }
    return elem.type
  }
})

And it works correctly.

Note: this will also trigger if you have live change events turned on (for any selector) and then click on a VML element. Crashes inside jQuery.event.special.change.click when accessing the elem.type property.

Please make sure the fix applies to all cases.

Is it possible to get an expected release version/date for this fix? I see that the problem still exists with jQuery 1.5.

This bug causes big problems using jQuery together with Openlayers in IE7/8, especially in combination with jQuery's .live() handler on Forms with Map interaction - selecting features on vector layers and such...

Implemented 4031651@…'s fix above - and it solves my problem...

I'm having the same problem with OpenLayers in IE 7/8 that stein.hoem@... described above. I can confirm that applying the fix provided by 4031651@… solves the problem. This is with jQuery 1.5. A definitive fix would be greatly appreciated.

I'd like to upvote this. The patch above works, and just needs to be pulled into master. I'd greatly appreciate this fix being rolled in. Thanks for your time.

I have VML in my page and get the error on 1.5 line 3743 which is:

if ( not ^ (elem.className && (" " + elem.className + " ").replace(/[\\t\\n\\r]/g, " ").indexOf(match) >= 0) ) {

The fix above did NOT work for me.

the code in my file that (apparently) fails is the first class selector such as:

$('.icdEntryArea').change(function()
    {
        setFlyerText();
    });

whereas, this selector does NOT fail:

$('div.icdEntryArea').change(function()
    {
        setFlyerText();
    });

I could NOT reproduce this in fiddle.

On page refresh, I get error on line 3877

text: function( elem ) {
			return "text" === elem.type;

then the above details.

Just to follow up on my earlier comment. Fixes to this will need to be tested in IE8 with "Browser Mode" set to "IE8 compatibility view" and "Document Mode" set to "IE7 Standards" mode as failure manifests itself differently there than in IE8 in standards mode.

I did a bunch of testing and found the following:

Issues:

preFilter: { where it accesses elem.className

Access to the elem.scopeName

filters: { where it accesses elem.type

I found this manifests itself in MY page when I used .delegate and .live. Basically, the VML namespaced elements do not have those attributes, and instead of "undefined" or null returning, it just fails and needs a new browser page to recover - refresh (CTRL-F5 does not do the trick).

I have a quite large and complex page and was not able to pare it down and reproduce in a jsfiddle page.

I attempted to artificially create those attributes (type and class) but this did not workaround the issue.

Here is the full extent of my VML markup with my artificial type and class attributes injected:

<xml:namespace ns="urn:schemas-microsoft-com:vml" prefix="v" xmlns:o="urn:schemas-microsoft-com:office:office" />
<div id="cptIcdTopContainer">
    <div id="flyerDiv">
        <v:group id="GroupFlyer" type="vml" class='vml' >
        <v:shape id="diagnosisFlyerHeader" coordsize="300,300" type="vml" class='vml' >
            <v:path textpathok="True" v="m 0,300 l 300,150" type="vml" class='vml' />
            <v:path  v="m 0,300 l 300,150" type="vml" class='vml' />
            <v:fill on="True" color="#000000" type="vml" class='vml' />
            <v:stroke on="false" type="vml" class='vml' />
            <v:textpath on="True" fitpath="false" string="      DIAGNOSIS" type="vml" class='vml' />
        </v:shape>
        <v:shape id="diagnosisFlyerTag1" coordsize="300,300" type="vml" class='vml' >
            <v:path textpathok="True" v="m 0,300 l 300,150" type="vml" class='vml' />
            <v:path  v="m 0,300 l 300,150" type="vml" class='vml' />
            <v:fill on="True" color="#0101FF" type="vml" class='vml' />
            <v:stroke on="false" type="vml" />
            <v:textpath id="flyerTag1" on="True" fitpath="false" string="" type="textpath" class='vml' />
        </v:shape>
        <v:shape id="diagnosisFlyerTag2" coordsize="300,300" type="vml" class='vml' >
            <v:path textpathok="True" v="m 0,300 l 300,150" type="vml" class='vml' />
            <v:fill on="True"  color="#0101FF" type="vml" class='vml' />
            <v:stroke on="false" type="vml" class='vml' />
            <v:textpath id="flyerTag2" on="True" fitpath="false" string="" type="textpath"  class='vml' />
        </v:shape>
        <v:shape id="diagnosisFlyerTag3" coordsize="300,300" type="vml" class='vml' >
            <v:path textpathok="True" v="m 0,300 l 300,150" type="vml" class='vml' />
            <v:fill on="True"  color="#0101FF" type="vml" class='vml' />
            <v:stroke on="false" type="vml" class='vml' />
            <v:textpath id="flyerTag3" on="True" fitpath="false" string="" type="textpath" class='vml' />
        </v:shape>
        <v:shape id="diagnosisFlyerTag4" coordsize="300,300" type="vml" class='vml' >
            <v:path textpathok="True" v="m 0,300 l 300,150" type="vml" class='vml' />
            <v:fill on="True"  color="#0101FF" type="vml" class='vml' />
            <v:stroke on="false" />
            <v:textpath id="flyerTag4" on="True" fitpath="false" string="" type="textpath"  class='vml' />
        </v:shape>
        <v:shape id="diagnosisFlyerTag5" coordsize="300,300" type="vml" class='vml' >
            <v:path textpathok="True" v="m 0,300 l 300,150" type="vml" class='vml' />
            <v:fill on="True"  color="#0101FF" type="vml" class='vml' />
            <v:stroke on="false" type="vml" />
            <v:textpath id="flyerTag5" on="True" fitpath="false" string="" type="textpath"  class='vml' />
        </v:shape>
        <v:shape id="diagnosisFlyerTag6" coordsize="300,300" type="vml" class='vml' >
            <v:path textpathok="True" v="m 0,300 l 300,150" type="vml" class='vml' />
            <v:fill on="True"  color="#0101FF" type="vml" />
            <v:stroke on="false" type="vml" />
            <v:textpath id="flyerTag6" on="True" fitpath="false" string="" type="textpath"  class='vml' />
        </v:shape>
        <!-- draw lines for the flyer text -->
        <v:shape id="diagnosisFlyerLines" coordsize="510,300" stroke="true" strokecolor="gray"
            fill="false" type="vml" class='vml' >
            <!-- draw the lines -->
            <v:path textpathok="false"
                v="
                 m  -8,305 r 510,-150 x 
                 m  40,305 r 510,-150 x  
                 m  90,305 r 510,-150 x 
                 m 140,305 r 510,-150 x 
                 m 190,305 r 510,-150 x 
                 m 240,305 r 510,-150 x 
                 m 290,305 r 510,-150 x
                 m -8,305 r 300,0 x" type="vml" class='vml' />
        </v:shape>
    </v:group>
    </div>
</div>

Tested under :jquery 1.5

AND

/*!

• jQuery JavaScript Library vPulled Live From Git
• http://jquery.com/

*

• Copyright 2011, John Resig
• Dual licensed under the MIT or GPL Version 2 licenses.
• http://jquery.org/license

*

• Includes Sizzle.js
• http://sizzlejs.com/
• Copyright 2011, The Dojo Foundation
• Released under the MIT, BSD, and GPL Licenses.

*

• Date: Mon Feb 14 21:47:01 2011

*/

hacked jQuery core where mouse movement over my VML element caused a "fail"

                // Handle $(""), $(null), or $(undefined)
                if (!selector)
                {
                    return this;
                }
                // VML
                var vnodeType = 'vml';
                try { vnodeType = selector.nodeType; } catch (e) { /* kill IE exceptions on VML nodes */ }
                if (vnodeType === 'vml')
                {
                    return this;
                }
                // Handle $(DOMElement)
                if (selector.nodeType)
                {
                    this.context = this[0] = selector;
                    this.length = 1;
                    return this;
                }

1.5 version

@Changed 2 weeks ago by Mark Schultheiss

I don't think it's just in compatibility view, I have this problem in IE8 standards view. (Google Maps with polygon overlay with an onclick handler)

It appears that the issues I am experiencing with jquery+UJS driver+google maps may be related (problem described here http://stackoverflow.com/questions/5221787). Whenever I click on a marker, I get an IE "Fail" error pointing at jquery.js line 2838 (v 1.5.1).

Also, as @brandon pointed out, this is also true if you have any live selectors on the page and they are triggered.

Accessing the 'type' property on VML elements fails on IE. Fixes #7071.

Changeset: 0d8b247cab2f91e118d0b734028ce827e09a71f7

Test case from this ticket: http://gist.github.com/582889

Still failed.

I confirm the test mentionned above still fail

fail with v1.6.1pre

It appears this may be a wider issue using 'elem.type' elsewhere in jQuery. Even with 1.6.1 I'm experiencing the same problem using OpenLayers when I click on a map feature. Applying the fix made by John (http://bugs.jquery.com/ticket/7071#comment:19) locally to the following places fixed my issue, related to checking the 'type' of 'input' tags:

jquery.event.special.submit (events.js:714)

sizzle.selectors.filters.submit (sizzle.js:649)

(Apologies for not submitting a proper example but my JS isn't hot enough to isolate the problem as highlighted by OpenLayers)

how do we re-open this issue?

I can confirm that when I use ".live" or ".delegate" on my page the issue still exists in 1.6.1 version.

I'm not sure how the test that came with the patch is testing anything...

https://github.com/jquery/jquery/commit/0d8b247cab2f91e118d0b734028ce827e09a71f7/

At best it will throw an exception. That's not an adequate or even acceptable test.

I have a simple reduced test case that shows this (?) bug still exists in 1.6.1. (I have also tested on 1.6.2, still exists there.) My reduced case is here:

http://www.peakdemocracy.com/p/demo/error/statements1.html

Click on the polygon (triangle) and you'll see the error in IE7/8. The error disappears when you remove jquery-ujs, or when you remove

disableDefaultUI: true,

in the options for the googlemap.

This seems like a serious bug - jquery-ujs + googlemaps is enough to show it. How does one re-open this bug?

At the moment, this bug's conclusion can be explained on our Won't Fix page. However, there is someone who is working on providing a simple fix: Pull 434, however it is currently lacking a unit test. We are willing to consider solutions to it, and if you (or anyone else reading this ticket) would like to help find a solution, please continue the conversation here or on the pull request. We can open the ticket at any time if a viable solution is presented.

FYI this page still live: http://contribute.jquery.org/wont-fix/ (support issues with SVG/WML/etc).