Fix #10324. IE9 fumbles the innerHTML on object elements.

src/manipulation.js

@@ -423,6 +423,14 @@ function cloneFixAttributes( src, dest ) {
 	if ( nodeName === "object" ) {
 		dest.outerHTML = src.outerHTML;
 
+		// This path appears unavoidable for IE9. When cloning an object
+		// element in IE9, the outerHTML strategy above is not sufficient.
+		// If the src has innerHTML and the destination does not,
+		// copy the src.innerHTML into the dest.innerHTML. #10324
+		if ( jQuery.support.html5Clone && (src.innerHTML && !jQuery.trim(dest.innerHTML)) ) {
+			dest.innerHTML = src.innerHTML;
+		}
+
 	} else if ( nodeName === "input" && rcheckableType.test( src.type ) ) {
 		// IE6-8 fails to persist the checked state of a cloned checkbox
 		// or radio button. Worse, IE6-7 fail to give the cloned element

test/index.html

@@ -135,6 +135,7 @@ <h2 id="qunit-userAgent"></h2>
 				<param name="p1" value="x1" />
 				<param name="p2" value="x2" />
 			</object>
+			<object id="object2"><param name="test" value="test"></param></object>​
 
 			<span id="台北Táiběi"></span>
 			<span id="台北" lang="中文"></span>

test/unit/manipulation.js

@@ -568,6 +568,15 @@ test("IE8 serialization bug", function () {
 	equal( wrapper.children("link").length, 1, "Link elements are insertable with .html()");
 });
 
+test("html() object element #10324", function() {
+	expect( 1 );
+
+	var object = jQuery("#object2"),
+			clone = object.clone();
+
+	equal( clone.html(), object.html(), "html() returns correct innerhtml of cloned object elements" );
+});
+
 test("append(xml)", function() {
 	expect( 1 );
 
@@ -1771,4 +1780,4 @@ test("Guard against exceptions when clearing safeChildNodes", function() {
 	} catch(e) {}
 
 	ok( div && div.jquery, "Created nodes safely, guarded against exceptions on safeChildNodes[ -1 ]" );
-});
+});