src: skip JS callback for settled Promise.race losers

lib/internal/process/promises.js

@@ -14,8 +14,6 @@ const {
   promiseRejectEvents: {
     kPromiseRejectWithNoHandler,
     kPromiseHandlerAddedAfterReject,
-    kPromiseRejectAfterResolved,
-    kPromiseResolveAfterResolved,
   },
   setPromiseRejectCallback,
 } = internalBinding('task_queue');
@@ -161,21 +159,15 @@ function promiseRejectHandler(type, promise, reason) {
   if (unhandledRejectionsMode === undefined) {
     unhandledRejectionsMode = getUnhandledRejectionsMode();
   }
+  // kPromiseRejectAfterResolved and kPromiseResolveAfterResolved are
+  // filtered out in C++ (src/node_task_queue.cc) and never reach JS.
   switch (type) {
     case kPromiseRejectWithNoHandler: // 0
       unhandledRejection(promise, reason);
       break;
     case kPromiseHandlerAddedAfterReject: // 1
       handledRejection(promise);
       break;
-    case kPromiseRejectAfterResolved: // 2
-      // Do nothing in this case. Previous we would emit a multipleResolves
-      // event but that was deprecated then later removed.
-      break;
-    case kPromiseResolveAfterResolved: // 3
-      // Do nothing in this case. Previous we would emit a multipleResolves
-      // event but that was deprecated then later removed.
-      break;
   }
 }
 

src/node_task_queue.cc

@@ -55,6 +55,13 @@ void PromiseRejectCallback(PromiseRejectMessage message) {
 
   if (env == nullptr || !env->can_call_into_js()) return;
 
+  // multipleResolves was removed in v25 (PR #58707).  Skip all work for
+  // these events to avoid OOM in tight Promise.race() loops (#51452).
+  if (event == kPromiseResolveAfterResolved ||
+      event == kPromiseRejectAfterResolved) {
+    return;
+  }
+
   Local<Function> callback = env->promise_reject_callback();
   // The promise is rejected before JS land calls SetPromiseRejectCallback
   // to initializes the promise reject callback during bootstrap.
@@ -77,10 +84,6 @@ void PromiseRejectCallback(PromiseRejectMessage message) {
                   "rejections",
                   "unhandled", unhandledRejections,
                   "handledAfter", rejectionsHandledAfter);
-  } else if (event == kPromiseResolveAfterResolved) {
-    value = message.GetValue();
-  } else if (event == kPromiseRejectAfterResolved) {
-    value = message.GetValue();
   } else {
     return;
   }
@@ -173,8 +176,6 @@ static void Initialize(Local<Object> target,
   Local<Object> events = Object::New(isolate);
   NODE_DEFINE_CONSTANT(events, kPromiseRejectWithNoHandler);
   NODE_DEFINE_CONSTANT(events, kPromiseHandlerAddedAfterReject);
-  NODE_DEFINE_CONSTANT(events, kPromiseResolveAfterResolved);
-  NODE_DEFINE_CONSTANT(events, kPromiseRejectAfterResolved);
 
   target->Set(env->context(),
               FIXED_ONE_BYTE_STRING(isolate, "promiseRejectEvents"),

test/parallel/test-promise-race-memory-leak.js

@@ -0,0 +1,24 @@
+// Flags: --max-old-space-size=64
+'use strict';
+
+// Regression test for https://github.com/nodejs/node/issues/51452
+// When Promise.race() settles, V8 fires kPromiseResolveAfterResolved /
+// kPromiseRejectAfterResolved for each "losing" promise. Before this fix,
+// the C++ PromiseRejectCallback crossed into JS for these no-op events,
+// accumulating references and causing OOM in tight async loops.
+// With --max-old-space-size=64, this test would crash before completing
+// if the leak is present.
+
+const common = require('../common');
+
+async function main() {
+  for (let i = 0; i < 100_000; i++) {
+    await Promise.race([
+      Promise.resolve(1),
+      Promise.resolve(2),
+      Promise.resolve(3),
+    ]);
+  }
+}
+
+main().then(common.mustCall());