Possible incorrect event.target on number inputs in IE9?

Since React 16.0.0, it looks like there might be a case where event.target on a change event in IE9 reports as the window, but I can’t reproduce it outside of the DOM test fixtures.

Steps to reproduce

1. Open this build of the fixtures: http://react-ie-9-target-issues.surge.sh in IE9
2. Enter text into an input
3. Observe that the event.target.value is the window, as recorded by the fixture

I can not reproduce this using the following CodePen:

https://codepen.io/nhunzaker/pen/dmeoxJ?editors=1010 Viewable in IE9 here: https://s.codepen.io/nhunzaker/debug/dmeoxJ/PNrvYLevqQbM

Here’s a diff of my changes with master: https://github.com/facebook/react/compare/master...nhunzaker:ie9-target-issue

Any idea what’s going on? Here’s what I think I need to check next:

• Differences in rAF polyfill
• Differences in map/set polyfill

This list will probably grow

[gaearon]

Fixed in React 16.4.1.

[kiran-r28]

Just an additional observation if it might help,

event.target for onChange returns [Window] for any character typed in an input field whereas deleting the character (backspace or delete) returns [HTMLInputElement].

event.target for onKeyUp returns [HTMLInputElement].