When EventDispatcher is in working(flag _inDispatch == 1) and removeEventListener is called:

if (_inDispatch == 0)
{
listeners->erase(iter);
CC_SAFE_RELEASE(l);
}

its mean the listener was not be remove from listeners,until updateListeners to be call 。

In the dispatchTouchEvent member functionc：
sortEventListeners() to cause Gt0Index be set： listeners->setGt0Index(index)

then, updateListeners to call and remove listener that not remove before, so that the size of fixedPriorityListeners is change.

so cause the assert to failed.
CCASSERT(listeners->getGt0Index() <= static_cast<ssize_t>(fixedPriorityListeners->size()), "Out of range exception!"); (line:734)