Coerce s.url to string before calling replace, since replace is also …

…a method of a Location object. Fixes #7531.

src/ajax.js

@@ -198,7 +198,10 @@ jQuery.extend({
 		var s = jQuery.extend(true, {}, jQuery.ajaxSettings, origSettings),
 			jsonp, status, data, type = s.type.toUpperCase(), noContent = rnoContent.test(type);
 
-		s.url = s.url.replace( rhash, "" );
+		// toString fixes people passing a window.location or
+		// document.location to $.ajax, which worked in 1.4.2 and
+		// earlier (bug #7531). It should be removed in 1.5.
+		s.url = s.url.toString().replace( rhash, "" );
 
 		// Use original (not extended) context object if it was provided
 		s.context = origSettings && origSettings.context != null ? origSettings.context : s;

test/unit/ajax.js

@@ -1350,6 +1350,16 @@ test("jQuery.ajax - active counter", function() {
     ok( jQuery.active == 0, "ajax active counter should be zero: " + jQuery.active );
 });
 
+test( "jQuery.ajax - Location object as url (#7531)", 1, function () {
+	var success = false;
+	try {
+		var xhr = jQuery.ajax({ url: document.location });
+		success = true;
+		xhr.abort();
+	} catch (e) {}
+
+	ok( success, "document.location did not generate exception" );
+});
 
 }