See https://github.com/w3c/web-platform-tests/pull/10686 and https://github.com/whatwg/html/pull/3653.
I believe the issue is that EventListenerMap::clear() clears m_entries but fails to call markAsRemoved() on each RegisteredEventListener. Therefore, if somebody already had a reference to the RegisteredEventListeners, it can still fire events at them.
Yeah, that sounds similar to how the standard works. When you invoke removeEventListener() it both removes from the list and sets a removed flag that dispatch will take into account.
I think this should work similar (and it does in Chrome and Firefox).
Created attachment 339310 [details]
Comment on attachment 339310 [details]
Clearing flags on attachment: 339310
Committed r231248: <https://trac.webkit.org/changeset/231248>
All reviewed patches have been landed. Closing bug.