313787 2026-04-30 16:18:37 -0700 Promise resolvers keep the Promise alive even after resolution 2026-05-01 17:26:57 -0700 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified NEW InRadar P2 Normal --- 1 bakkot webkit-unassigned webkit-bug-importer oldest_to_newest 2206426 0 479406 bakkot 2026-04-30 16:18:37 -0700 Created attachment 479406 repro showing high heap usage even after GC Once a Promise has resolved, its resolvers become no-ops and should not prevent the Promise from being gc'd, but they do. This is most noticeable when using Promise.race to race a long-pending and a short-pending Promise: the race completes quickly with the value from the short-pending Promise, which is then kept alive until the long-pending Promise completes, because the long-pending Promise holds a resolver for the Promise.race Promise and this bug causes that to keep said Promise alive. V8 has the same bug which I am in the process of fixing. SpiderMonkey does not. This has been plaguing developers for years, see e.g. https://github.com/nodejs/node/issues/17469 https://x.com/KentonVarda/status/2044935325554823193 etc I am pretty sure all that's necessary to fix this is to null out the `JSFunctionWithFields::Field::ResolvingPromise` field on both `callee` and `other` immediate after this bit: https://github.com/WebKit/WebKit/blob/013da9aa8cc1a0e26f5f34408efa118956499193/Source/JavaScriptCore/runtime/JSPromise.cpp#L418-L421 but I haven't actually confirmed that. Attachment uses Bun because it exposes the APIs necessary to make this obvious, sorry I don't have a cleaner repro. 2206741 1 webkit-bug-importer 2026-05-01 17:26:57 -0700 <rdar://problem/176061996> 479406 2026-04-30 16:18:37 -0700 2026-04-30 16:18:37 -0700 repro showing high heap usage even after GC promise-for-bun.js text/javascript 627 bakkot aW1wb3J0IHsgaGVhcFN0YXRzIH0gZnJvbSAiYnVuOmpzYyI7CgoKZnVuY3Rpb24gcmFuZG9tU3Ry aW5nKGxlbmd0aCkgewogIGxldCByZXN1bHQgPSAiIjsKICBjb25zdCBjaGFyYWN0ZXJzID0gIkFC Q0RFRkdISUpLTE1OT1BRUlNUVVZXWFlaYWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU2 Nzg5IjsKICBmb3IgKGxldCBpID0gMDsgaSA8IGxlbmd0aDsgaSsrKSB7CiAgICByZXN1bHQgKz0g Y2hhcmFjdGVycy5jaGFyQXQoTWF0aC5mbG9vcihNYXRoLnJhbmRvbSgpICogY2hhcmFjdGVycy5s ZW5ndGgpKTsKICB9CiAgcmV0dXJuIHJlc3VsdDsKfQoKKGFzeW5jIGZ1bmN0aW9uICgpIHsKICBj b25zdCBwZW5kaW5nID0gbmV3IFByb21pc2UoKCkgPT4ge30pOwogIGZvciAobGV0IGkgPSAwOyBp IDwgMTAwMDA7IGkrKykgewogICAgYXdhaXQgUHJvbWlzZS5yYWNlKFtwZW5kaW5nLCBQcm9taXNl LnJlc29sdmUocmFuZG9tU3RyaW5nKDEwMDApKV0pOwogICAgaWYgKGkgJSAxMDAwID09PSAwKSB7 CiAgICAgIGF3YWl0IG5ldyBQcm9taXNlKHJlcyA9PiBzZXRUaW1lb3V0KHJlcywgMTApKTsKICAg ICAgQnVuLmdjKCk7CiAgICB9CiAgfQogIGNvbnNvbGUubG9nKGhlYXBTdGF0cygpKTsKfSkoKTsK