I can confirm this, though the problem lies now somewhere else. The quoted code was removed from jQuery(), but the problem is still there. I added a few assertions to show it.

I've tried the fix I suggested, and it worked.

It seems that it's a JavaScript issue (it's what Firebug shows, and in IE the problem is there too): getElementsByTagName( 'object' ) returns an array of functions. They are not functions, they are just DOM elements with a function type instead of an object type. All the OBJECT's properties are there, and I couldn't find more differences except the type.

Actually my test was wrong, it works fine with the latest revision.

The code you quote doesn't exist anymore in jQuery, therefore can't cause any more harm.

Works for FF, but still fails in IE.

Fixed.

OBJECT.getElementsByTagName("*") and OBJECT.all return no elements

This is the IE7 bug this one is related to.

I've posted a long message with details and a fix in the dev list.

Fixed in SVN rev 994. I just added a check enforcing all "*" searches to be converted into "param". This isn't fully optimal, but at least its consistent cross-platform now.

Will it fail on a markup like this ? (http://www.w3.org/TR/html401/struct/objects.html)

<P>                 <!-- First, try the Python applet -->
<OBJECT title="The Earth as seen from space" 
        classid="http://www.observer.mars/TheEarth.py">
                    <!-- Else, try the MPEG video -->
  <OBJECT data="TheEarth.mpeg" type="application/mpeg">
                    <!-- Else, try the GIF image -->
    <OBJECT data="TheEarth.gif" type="image/gif">
                    <!-- Else render the text -->
     The <STRONG>Earth</STRONG> as seen from space.
    </OBJECT>
  </OBJECT>
</OBJECT>

I've retouched my fix, following John's style. It's just 89 packed bytes fatter, and should work fine with the above 'official' example.

jQuery.getElementsByTagName declaration:

getElementsByTagName: function( e, t, rec ) {
	t = t.toUpperCase();
	if( rec !== false ) rec = true;
	var r = [];
	for ( var c = e.firstChild; c; c = c.nextSibling ) {
		if ( c.nodeType == 1 && ( c.nodeName == t || t == "*" ) )
			r.push( c );
		if( rec ) 
			r = r.concat( jQuery.getElementsByTagName( c, t ) );
	}
	return r;
},

First refactored chunk (children):

// Perform our own iteration and filter
for ( var i = 0, rl = ret.length; i < rl; i++ )
	r = r.concat( jQuery.getElementsByTagName( ret[i], m[1], false ) );

Second refactored chunk (descendants):

// Grab the tag name being searched for
var tag = m[1] != "" || m[0] == "" ? "*" : m[2];
// We need to find all descendant elements, it is more
// efficient to use getAll() when we are already further down
// the tree - we try to recognize that here
for ( var i = 0, rl = ret.length; i < rl; i++ )
	jQuery.merge( r,
		m[1] != "" && ret.length != 1 ?
			jQuery.getAll( ret[i], [], m[1], m[2], rec ) :
		// Handle IE7 being really dumb about <object>s
		ret[i].nodeName.toUpperCase() == "OBJECT" && tag == "*" ?
			jQuery.getElementsByTagName( ret[i], tag ) :
			ret[i].getElementsByTagName( tag )
	);

No, it won't fail on that markup, since you could do:

$("object").find("object, strong")

Honestly, if you can show me a public web site that puts anything besides params inside of an object, I'll be more included to fix this. As it stands, you're still able to select descendant elements by type - and able to select all params using "*".

The biggest issue that I have with this fix is that it will significantly degrade the performance of select-by-tag queries.

You mean performance degradation strictly limited to selections that resolve to a call to OBJECT.getElementsByTagName("*")...

Ok, I'm moving this to being resolved - the current fix seems to solve the most-pressing issues related to this bug, without sacrificing any speed, or adding a significant amount of code.

I've also contacted the IE team - so they are aware of the issue, and are working to resolve it.

#7553 is a duplicate of this ticket.