Crashed at ImageEventListener::cast & ConditionEventListener::cast

Source/core/events/EventTarget.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *           (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ skipping 90 matching lines @@
         argv.append(toNode() ? toNode()->nodeName() : interfaceName());
         argv.append(eventType);
         activityLogger->logEvent("blinkAddEventListener", argv.size(), argv.data());
     }
 
     return ensureEventTargetData().eventListenerMap.add(eventType, listener, useCapture);
 }
 
 bool EventTarget::removeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
+    // FIXME: listener null check should throw TypeError (and be done in
+    // generated bindings), but breaks legacy content. http://crbug.com/249598
+    if (!listener)
+        return false;
+
     EventTargetData* d = eventTargetData();
     if (!d)
         return false;
 
     size_t indexOfRemovedListener;
 
     if (!d->eventListenerMap.remove(eventType, listener.get(), useCapture, indexOfRemovedListener))
         return false;
 
     // Notify firing events planning to invoke the listener at 'index' that
@@ skipping 261 matching lines @@
     // they have one less listener to invoke.
     if (d->firingEventIterators) {
         for (size_t i = 0; i < d->firingEventIterators->size(); ++i) {
             d->firingEventIterators->at(i).iterator = 0;
             d->firingEventIterators->at(i).end = 0;
         }
     }
 }
 
 } // namespace blink