src: skip JS callback for settled Promise.race losers

When Promise.race() or Promise.any() settles, V8 fires
kPromiseResolveAfterResolved / kPromiseRejectAfterResolved for each
"losing" promise. The PromiseRejectCallback in node_task_queue.cc was
crossing into JS for these events, but since the multipleResolves
event reached EOL in v25 (PR #58707), the JS handler does nothing.

The unnecessary C++-to-JS boundary crossings accumulate references in
a tight loop, causing OOM when using Promise.race() with
immediately-resolving promises.

Return early in PromiseRejectCallback() for these two events, skipping
the JS callback entirely. Also remove the dead case branches and
unused constant imports from the JS side.

Move early returns for kPromiseResolveAfterResolved and
kPromiseRejectAfterResolved before Number::New and CHECK(!callback),
avoiding unnecessary work. Remove dead NODE_DEFINE_CONSTANT exports
and fix comment placement in the JS switch statement. Bump test
--max-old-space-size from 20 to 64 for safety on instrumented builds.

Fixes: #51452
Refs: #60184
Refs: #61960
PR-URL: #62336
Refs: #51452
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>

Author: Felipeness

lib/internal/process/promises.js

@@ -14,8 +14,6 @@ const {
   promiseRejectEvents: {
     kPromiseRejectWithNoHandler,
     kPromiseHandlerAddedAfterReject,
-    kPromiseRejectAfterResolved,
-    kPromiseResolveAfterResolved,
   },
   setPromiseRejectCallback,
 } = internalBinding('task_queue');
@@ -161,21 +159,15 @@ function promiseRejectHandler(type, promise, reason) {
   if (unhandledRejectionsMode === undefined) {
     unhandledRejectionsMode = getUnhandledRejectionsMode();
   }
+  // kPromiseRejectAfterResolved and kPromiseResolveAfterResolved are
+  // filtered out in C++ (src/node_task_queue.cc) and never reach JS.
   switch (type) {
     case kPromiseRejectWithNoHandler: // 0
       unhandledRejection(promise, reason);
       break;
     case kPromiseHandlerAddedAfterReject: // 1
       handledRejection(promise);
       break;
-    case kPromiseRejectAfterResolved: // 2
-      // Do nothing in this case. Previous we would emit a multipleResolves
-      // event but that was deprecated then later removed.
-      break;
-    case kPromiseResolveAfterResolved: // 3
-      // Do nothing in this case. Previous we would emit a multipleResolves
-      // event but that was deprecated then later removed.
-      break;
   }
 }
 

src/node_task_queue.cc

@@ -53,7 +53,11 @@ void PromiseRejectCallback(PromiseRejectMessage message) {
 
   Environment* env = Environment::GetCurrent(isolate);
 
-  if (env == nullptr || !env->can_call_into_js()) return;
+  if (env == nullptr || !env->can_call_into_js() ||
+      event != kPromiseRejectWithNoHandler &&
+      event != kPromiseHandlerAddedAfterReject) {
+    return;
+  }
 
   Local<Function> callback = env->promise_reject_callback();
   // The promise is rejected before JS land calls SetPromiseRejectCallback
@@ -77,10 +81,6 @@ void PromiseRejectCallback(PromiseRejectMessage message) {
                   "rejections",
                   "unhandled", unhandledRejections,
                   "handledAfter", rejectionsHandledAfter);
-  } else if (event == kPromiseResolveAfterResolved) {
-    value = message.GetValue();
-  } else if (event == kPromiseRejectAfterResolved) {
-    value = message.GetValue();
   } else {
     return;
   }
@@ -173,8 +173,6 @@ static void Initialize(Local<Object> target,
   Local<Object> events = Object::New(isolate);
   NODE_DEFINE_CONSTANT(events, kPromiseRejectWithNoHandler);
   NODE_DEFINE_CONSTANT(events, kPromiseHandlerAddedAfterReject);
-  NODE_DEFINE_CONSTANT(events, kPromiseResolveAfterResolved);
-  NODE_DEFINE_CONSTANT(events, kPromiseRejectAfterResolved);
 
   target->Set(env->context(),
               FIXED_ONE_BYTE_STRING(isolate, "promiseRejectEvents"),

test/parallel/test-promise-race-memory-leak.js

@@ -0,0 +1,24 @@
+// Flags: --max-old-space-size=64
+'use strict';
+
+// Regression test for https://github.com/nodejs/node/issues/51452
+// When Promise.race() settles, V8 fires kPromiseResolveAfterResolved /
+// kPromiseRejectAfterResolved for each "losing" promise. Before this fix,
+// the C++ PromiseRejectCallback crossed into JS for these no-op events,
+// accumulating references and causing OOM in tight async loops.
+// With --max-old-space-size=64, this test would crash before completing
+// if the leak is present.
+
+const common = require('../common');
+
+async function main() {
+  for (let i = 0; i < 100_000; i++) {
+    await Promise.race([
+      Promise.resolve(1),
+      Promise.resolve(2),
+      Promise.resolve(3),
+    ]);
+  }
+}
+
+main().then(common.mustCall());