Fix crash on null ptr dereference in EventPath propagation

Source/core/events/EventPath.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Neither the name of Google Inc. nor the names of its
@@ skipping 114 matching lines @@
                 }
                 nodesInPath.append(insertionPoint);
             }
             current = insertionPoints.last();
             continue;
         }
         if (current->isShadowRoot()) {
             if (m_event && shouldStopAtShadowRoot(*m_event, *toShadowRoot(current), *m_node))
                 break;
             current = current->shadowHost();
+#if !ENABLE(OILPAN)
+            // TODO(kochi): crbug.com/507413 This check is necessary when some asynchronous event
+            // is queued while its shadow host is removed and the shadow root gets the event
+            // immediately after it.  When Oilpan is enabled, this situation does not happen.
+            // Except this case, shadow root's host is assumed to be non-null.
+            if (current)
+                nodesInPath.append(current);
+#else
             nodesInPath.append(current);
+#endif
         } else {
             current = current->parentNode();
             if (current)
                 nodesInPath.append(current);
         }
     }
 
     m_nodeEventContexts.reserveCapacity(nodesInPath.size());
     for (Node* nodeInPath : nodesInPath) {
         m_nodeEventContexts.append(NodeEventContext(nodeInPath, eventTargetRespectingTargetRules(*nodeInPath)));
@@ skipping 216 matching lines @@
 #if ENABLE(OILPAN)
     visitor->trace(m_nodeEventContexts);
     visitor->trace(m_node);
     visitor->trace(m_event);
     visitor->trace(m_treeScopeEventContexts);
     visitor->trace(m_windowEventContext);
 #endif
 }
 
 } // namespace