The FileDescriptorWatcher POSIX wrapper is used by code running on TaskScheduler to watch for when file descriptors are readable/writable, on a dedicated I/O thread. The API has two issues in its current form:

1. It is not possible for calling code to protect against raciness when close()ing watched file-descriptors:
  a. The underlying WatchFileDescriptor call may be passed an invalid file-descriptor.
  b. The file-descriptor may be closed, and re-used, by the time WatchFileDescriptor executes, leading to the wrong file being watched.

2. The API provides no indication to the caller of whether the watch succeeded or failed:
  a. This makes it harder to diagnose brokenness in the underlying MessagePump*::FileDescriptorWatcher (see  issue 740305 ).
  b. This makes it harder to spot brokenness in production & test code via unit-tests (see  issue 740692 ).

#2 cannot be resolved without addressing #1, since there is currently no mechanism to provide the required synchronization.

For the wrapper to be safe, it should "own" the file-descriptors it watches, or the caller should be required to pass them to the FDW to be closed, rather than doing so itself.