From 5c2d08704e289dd2745bcb0557b35a9c0e6af4a4 Mon Sep 17 00:00:00 2001 From: Michał Gołębiowski-Owczarek Date: Mon, 19 Oct 2020 21:17:51 +0200 Subject: Event: Don't crash if an element is removed on blur In Chrome, if an element having a `focusout` handler is blurred by clicking outside of it, it invokes the handler synchronously. If that handler calls `.remove()` on the element, the data is cleared, leaving private data undefined. We're reading a property from that data so we need to guard against this. Fixes gh-4417 Closes gh-4799 --- src/event.js | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/event.js b/src/event.js index b8c5e96fe..4418fbbbf 100644 --- a/src/event.js +++ b/src/event.js @@ -558,7 +558,13 @@ function leverageNative( el, type, expectSync ) { // Cancel the outer synthetic event event.stopImmediatePropagation(); event.preventDefault(); - return result.value; + + // Support: Chrome 86+ + // In Chrome, if an element having a focusout handler is blurred by + // clicking outside of it, it invokes the handler synchronously. If + // that handler calls `.remove()` on the element, the data is cleared, + // leaving `result` undefined. We need to guard against this. + return result && result.value; } // If this is an inner synthetic event for an event with a bubbling surrogate -- cgit v1.2.3