Fix crash on null ptr dereference in EventPath propagation

Source/core/events/EventPath.cpp

Index: Source/core/events/EventPath.cpp
diff --git a/Source/core/events/EventPath.cpp b/Source/core/events/EventPath.cpp
index 7a3c1b5013e7ffa2b6e381345586c1abae9727c9..027ed986e49d249c98ca2ddff26e21561342661d 100644
--- a/Source/core/events/EventPath.cpp
+++ b/Source/core/events/EventPath.cpp
@@ -132,7 +132,16 @@ void EventPath::calculatePath()
             if (m_event && shouldStopAtShadowRoot(*m_event, *toShadowRoot(current), *m_node))
                 break;
             current = current->shadowHost();
+#if !ENABLE(OILPAN)
+            // TODO(kochi): crbug.com/507413 This check is necessary when some asynchronous event
+            // is queued while its shadow host is removed and the shadow root gets the event
+            // immediately after it.  When Oilpan is enabled, this situation does not happen.
+            // Except this case, shadow root's host is assumed to be non-null.
+            if (current)
+                nodesInPath.append(current);
+#else
             nodesInPath.append(current);
+#endif
         } else {
             current = current->parentNode();
             if (current)