Fix crash on null ptr dereference in EventPath propagation

Source/core/dom/shadow/ShadowRoot.h

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Neither the name of Google Inc. nor the names of its
@@ skipping 52 matching lines @@
     {
         return adoptRefWillBeNoop(new ShadowRoot(document, type));
     }
 
     void recalcStyle(StyleRecalcChange);
 
     // Disambiguate between Node and TreeScope hierarchies; TreeScope's implementation is simpler.
     using TreeScope::document;
     using TreeScope::getElementById;
 
+    // TODO(kochi): crbug.com/507413 In non-Oilpan, host() may return null during queued
+    // async event handling.
     Element* host() const { return toElement(parentOrShadowHostNode()); }
     ElementShadow* owner() const { return host() ? host()->shadow() : 0; }
 
     ShadowRoot* youngerShadowRoot() const { return prev(); }
 
     ShadowRoot* olderShadowRootForBindings() const;
     bool isOpen() const { return type() == ShadowRootType::OpenByDefault || type() == ShadowRootType::Open; }
 
     bool isYoungest() const { return !youngerShadowRoot(); }
     bool isOldest() const { return !olderShadowRoot(); }
@@ skipping 85 matching lines @@
     return adjustedFocusedElement();
 }
 
 DEFINE_NODE_TYPE_CASTS(ShadowRoot, isShadowRoot());
 DEFINE_TYPE_CASTS(ShadowRoot, TreeScope, treeScope, treeScope->rootNode().isShadowRoot(), treeScope.rootNode().isShadowRoot());
 DEFINE_TYPE_CASTS(TreeScope, ShadowRoot, shadowRoot, true, true);
 
 } // namespace blink
 
 #endif // ShadowRoot_h