PlatformPipeLink was declared with plain NS_INLINE_DECL_THREADSAFE_REFCOUNTING(PlatformPipeLink). With that macro, the object is deleted on whatever thread releases the last strong reference. But PlatformPipeLink is a MessageLoopForIO::Watcher whose watch registration and I/O state are bound to the IO thread (mIOThread): its destructor tears down IO-thread-owned state (unregistering the watcher, closing/releasing the file-handle watch). If the last reference is dropped on a thread other than mIOThread — which can happen because references are held across threads in the IPC machinery — the destructor runs off the IO thread concurrently with, or in a wrong-thread relationship to, the IO thread’s own access to that watch state. That is the race: destruction on an arbitrary thread versus IO-thread use of the watcher, which can corrupt or use-after-free the watch registration.

The patch replaces the refcounting macro with NS_INLINE_DECL_THREADSAFE_REFCOUNTING_WITH_DELETE_ON_EVENT_TARGET(PlatformPipeLink, mIOThread.GetEventTarget()). Now, whichever thread drops the final reference, the actual destruction is dispatched to and executed on the IO thread’s event target, so the destructor’s teardown of the Watcher registration always runs on the same thread that owns and services it. This serializes destruction against the IO thread’s use of the object and removes the cross-thread race. The advisory’s class (“race condition in IPC”) matches the diff exactly: it is a destruction-thread/lifetime race fixed by pinning deletion to the IO thread.

The affected code is in XPCOM IPC plumbing shared across Firefox processes; triggering it requires the cross-thread last-release timing to coincide with IO-thread activity on the same link, so it is a timing-dependent race rather than a deterministic primitive. The consequence is a destruction/teardown race on IO-thread-owned watcher state — potential use-after-free or state corruption of the pipe link. Mozilla rates it low, consistent with the narrow, race-gated nature and lack of a shown direct attacker-controlled primitive; the fix deterministically eliminates the off-thread destruction.