EventTarget::eventTargetData has three overrides. The default implementation is pure-virtual:
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/events/EventTarget.h?sq=package:chromium&dr=CSs&rcl=1471276009&l=173

Then EventTargetWithInlineData defines:
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/events/EventTarget.h?sq=package:chromium&dr=CSs&rcl=1471276009&l=206

EventTargetData* eventTargetData() final { return &m_eventTargetData; }

And there's also a quite complex Node implementation that accesses a global map:
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/dom/Node.cpp?sq=package:chromium&dr=CSs&rcl=1471276009&l=1861

EventTargetData* Node::eventTargetData()
{
    return hasEventTargetData() ? eventTargetDataMap().get(this) : nullptr;
}

In the unlikely case this methods gets devirtualized, it needs to be rewritten to something like:

if type is descendant of EventTargetWithInlineData then return &m_eventTargetData else if type is Node then access the global map else fail.

I don't expect to work on this anytime soon, and I file this issue only for completeness. The most likely fate of it is to be closed as obsolete or infeasible.