It's possible that an event task is still pending to be processed. Tasks don't hold ref to the XHR, but they do possibly grab it once processing starts.
This wasn't an issue before because we called remove_target_tasks immediately when ref reached 0. But gecko's CC doesn't necessarily call unlink/delete_cycle_collectable immediately when ref reaches 0, it usually delays it.
So a task could get processed between ref reaching 0 and the CC actually cleaning it.