Make TreeScopeEventContext have a RefPtr to TreeScope.rootNode to guard TreeScope.

LayoutTests/fast/dom/shadow/event-path-after-deleting-tree-scope-crash.html

Index: LayoutTests/fast/dom/shadow/event-path-after-deleting-tree-scope-crash.html
diff --git a/LayoutTests/fast/dom/shadow/event-path-after-deleting-tree-scope-crash.html b/LayoutTests/fast/dom/shadow/event-path-after-deleting-tree-scope-crash.html
new file mode 100644
index 0000000000000000000000000000000000000000..24c87833cf9abbbc5825276208dd5262c9970638
--- /dev/null
+++ b/LayoutTests/fast/dom/shadow/event-path-after-deleting-tree-scope-crash.html
@@ -0,0 +1,16 @@
+<p>Passes if it doesn't crash.</p>
+<script>
+if (window.testRunner)
+    testRunner.dumpAsText();
+docType = document.implementation.createDocumentType('doc', '-//W3C//DTD XHTML 1.0 Transitional//EN', 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd');
+doc = document.implementation.createDocument('.', 'doc', docType);

[dglazkov, 2014/12/17 16:48:55]

Interesting! Why is it significant to have this constructed as an XHTML doc, and
not just document.implementation.createHTMLDocument?

[hayato, 2014/12/18 05:54:29]

Yeah, there is no reason to use XHTML here.

This test case is from the cruster-fuzzer and I wasn't aware that I could use
document.implementation.createHTMLDocument instead here.

Let me land the patch after simplifying the HTML further.

+var iframe = doc.createElement('iframe');
+delete docType;
+delete doc;
+mouseEvent = document.createEvent('MouseEvents');
+mouseEvent.initMouseEvent('click', true, true, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);
+iframe.dispatchEvent(mouseEvent);
+document.documentElement.appendChild(iframe);
+gc();
+mouseEvent.path;
+</script>