Chrome Version: ToT
OS: All

What steps will reproduce the problem?
(1) Run http://w3c-test.org/dom/events/Event-dispatch-click.html with Google Chrome with a11y enabled, or content shell --run-layout-test
(or run-webkit-tests external/wpt/dom/events/Event-dispatch-click.html)

What is the expected result?
No crash

What happens instead?
Crash in EventDispatcher::dispatchEventPostProcess() because m_event->target() is null.

Please use labels and text to provide additional information.

The crasher test is:

async_test(function(t) {
  var input = document.createElement("input")
  input.type = "checkbox"
  dump.appendChild(input)
  var clickEvent = new MouseEvent("click")
  var finalTarget = document.createElement("doesnotmatter")
  finalTarget.onclick = t.step_func_done(function() {
    assert_equals(clickEvent.target, finalTarget)
  })
  input.onchange = t.step_func(function() {
    finalTarget.dispatchEvent(clickEvent)
  })
  input.dispatchEvent(clickEvent)
}, "redispatch during post-click handling")

It tries to re-dispatch a dispatching click event.
The inner dispatchEvent() clears |target| at the end of process, and dispatchEventPostProcess() for the outer dispatchEvent() crashes.

https://dom.spec.whatwg.org/#dom-eventtarget-dispatchevent
In this case, the inner dispatchEvent() should throw an InvalidStateError according to the standard.

Firefox correctly handles this test.