From 5318e3111afd4c307ad6851682620d7413824fc5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20Go=C5=82e=CC=A8biowski-Owczarek?=
 <m.goleb@gmail.com>
Date: Tue, 15 Nov 2022 15:43:18 +0100
Subject: [PATCH] Selector:Manipulation: Fix DOM manip within template contents

The `<template/>` element `contents` property is a document fragment that may
have a `null` `documentElement`. In Safari 16 this happens in more cases due
to recent spec changes - in particular, even if that document fragment is
explicitly adopted into an outer document. We're testing both of those cases
now.

The crash used to happen in `jQuery.contains` which is an alias for
`Sizzle.contains` in jQuery 3.x.

The Sizzle fix is at jquery/sizzle#490, released in Sizzle `2.3.8`. This
version of Sizzle is included in the parent commit.

A fix similar to the one from gh-5158 has also been applied here to the
`selector-native` version.

Fixes gh-5147
Closes gh-5159
Ref jquery/sizzle#490
Ref gh-5158
---
 src/selector-native.js    |  5 ++---
 test/unit/manipulation.js | 43 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+), 3 deletions(-)

diff --git a/src/selector-native.js b/src/selector-native.js
index 90a3745cf..faba51148 100644
--- a/src/selector-native.js
+++ b/src/selector-native.js
@@ -196,9 +196,8 @@ jQuery.extend( {
 		return ret;
 	},
 	contains: function( a, b ) {
-		var adown = a.nodeType === 9 ? a.documentElement : a,
-			bup = b && b.parentNode;
-		return a === bup || !!( bup && bup.nodeType === 1 && adown.contains( bup ) );
+		var bup = b && b.parentNode;
+		return a === bup || !!( bup && bup.nodeType === 1 && a.contains( bup ) );
 	},
 	isXMLDoc: function( elem ) {
 		var namespace = elem.namespaceURI,
diff --git a/test/unit/manipulation.js b/test/unit/manipulation.js
index 348912e6e..6bae15465 100644
--- a/test/unit/manipulation.js
+++ b/test/unit/manipulation.js
@@ -2837,6 +2837,49 @@ QUnit.test( "Make sure tr is not appended to the wrong tbody (gh-3439)", functio
 	assert.strictEqual( htmlOut, htmlExpected );
 } );
 
+[ true, false ].forEach( function( adoptedCase ) {
+	QUnit[
+		typeof HTMLTemplateElement === "function" ?
+			"test" :
+			"skip"
+	]( "Manip within <template /> content moved back & forth doesn't throw - " + (
+			adoptedCase ? "explicitly adopted" : "not explicitly adopted"
+		) + " (gh-5147)",
+		function( assert ) {
+			assert.expect( 1 );
+
+			var fragment, diva, divb,
+				div = jQuery( "" +
+					"<div>\n" +
+					"	<div><div class='a'></div></div>\n" +
+					"	<div><div class='b'></div></div>\n" +
+					"</div>" +
+					"" ),
+				template = jQuery( "<template></template>" );
+
+			jQuery( "#qunit-fixture" )
+				.append( div )
+				.append( template );
+
+			fragment = template[ 0 ].content;
+			diva = div.find( ".a" );
+			divb = div.find( ".b" );
+
+			if ( adoptedCase ) {
+				document.adoptNode( fragment );
+			}
+
+			fragment.appendChild( div.children()[ 0 ] );
+			fragment.appendChild( div.children()[ 0 ] );
+
+			diva.insertBefore( divb );
+
+			assert.strictEqual( diva.siblings( ".b" ).length, 1,
+				"Insertion worked" );
+		}
+	);
+} );
+
 QUnit.test( "Make sure tags with single-character names are found (gh-4124)", function( assert ) {
 	assert.expect( 1 );