Fix crash on null ptr dereference in EventPath propagation

Source/core/dom/Node.h

Index: Source/core/dom/Node.h
diff --git a/Source/core/dom/Node.h b/Source/core/dom/Node.h
index 0b7532bea9cf156e1539fb5dc399c6b6cf4a6b05..987850210a64146ebf12895c5dba9392f61f1cc1 100644
--- a/Source/core/dom/Node.h
+++ b/Source/core/dom/Node.h
@@ -295,6 +295,9 @@ public:
     bool hasCustomStyleCallbacks() const { return getFlag(HasCustomStyleCallbacksFlag); }
 
     // If this node is in a shadow tree, returns its shadow host. Otherwise, returns nullptr.
+    // TODO(kochi): crbug.com/507413 shadowHost() can return nullptr even when it is in a
+    // shadow tree but its root is detached from its host. This can happen when handling
+    // queued events (e.g. during execCommand()).
     Element* shadowHost() const;
     ShadowRoot* containingShadowRoot() const;
     ShadowRoot* youngestShadowRoot() const;