event targets have two versions of .addEventListener. One takes 3 parameters, defined in nsIDOMEventTarget, and the other one 4 parameters, defined in nsIDOMNSEventTarget. nsDOMClassInfo handles .addEventTarget specially in nsEventReceiverSH/nsEventTargetSH::NewResolve http://mxr.mozilla.org/mozilla-central/source/dom/src/base/nsDOMClassInfo.cpp?mark=7226,7275-7277,7321,7328-7330#7225 (The link is valid until nsDOMClassInfo.cpp changes - hg annotate doesn't provide marking.) .addEventListener does seem handle the 4th parameter, but is that by accident?

This needs to happen before ship.

Sorry I didn't see this bug earlier. I understand this better now. There's not a bug, because the quick stub is shadowed by the special method created by NewResolve. But for the same reason, the quick stub for addEventListener() is unreachable; there's no point having it. The patch in bug 453331 removes it.