Stage 2 Draft / June 23, 2026

SafePromiseResolve

1 SafePromiseResolve Abstract Operations

These operations provide a mechanism for resolving a promise such that, if resolution would synchronously execute arbitrary user code, the user-code-running portion is deferred to a subsequent microtask. On return from SafePromiseResolve, the caller's PromiseCapability Record is guaranteed to be latched: any subsequent call to its [[Resolve]] or [[Reject]] is a no-op, regardless of whether the deferred job has yet run.

1.1 HasPropertyWhichCouldRunUserCode ( o, propertyKey, kind )

The abstract operation HasPropertyWhichCouldRunUserCode takes arguments o (an Object), propertyKey (a property key), and kind (any, set or get) and returns a Boolean. It walks the prototype chain of o looking for propertyKey, returning true if retrieving the property could run user code when performing the operation of kind: that is, the property is a getter, setter, or a Proxy is encountered on the chain. It performs the following steps when called:

  1. If o is null, return false.
  2. If o has a [[ProxyHandler]] internal slot, return true.
  3. Let desc be o.[[GetOwnProperty]](propertyKey).
  4. If desc is not undefined, then
    1. If desc has a [[Get]] field and kind is any or get, return true.
    2. If desc has a [[Set]] field and kind is any or set, return true.
  5. return HasPropertyWhichCouldRunUserCode(o.[[GetPrototypeOf]](), propertyKey, kind).
 Note

This relies on ordinary [[GetPrototypeOf]] never running user code. A Proxy is handled by short-circuiting with true before any of its MOP is invoked.

1.2 RequiresDeferredPromiseResolution ( value )

The abstract operation RequiresDeferredPromiseResolution takes argument value (an ECMAScript language value) and returns a Boolean. It determines whether the synchronous steps of resolving a promise with value might execute user code. It performs the following steps when called:

  1. If value is not an Object, return false.
  2. If HasPropertyWhichCouldRunUserCode(value, "then", get) is true, return true.
  3. Let thenValue be ! value.[[Get]]("then").
  4. If IsCallable(thenValue) is true, return true.
  5. Return false.

1.3 PerformPromiseResolution ( promise, resolution, called )

The abstract operation PerformPromiseResolution takes arguments promise (a Promise), resolution (an ECMAScript language value), and called (sync or deferred) and returns either a normal completion containing unused or an abrupt completion. It performs the value-inspecting steps of resolving promise with resolution. It performs the following steps when called:

  1. Assert: promise has a [[PromiseState]] internal slot.
  2. If SameValue(resolution, promise) is true, then
    1. Let selfResolutionError be a newly created TypeError object.
    2. Perform RejectPromise(promise, selfResolutionError).
    3. Return unused.
  3. If resolution is not an Object, then
    1. Perform FulfillPromise(promise, resolution).
    2. Return unused.
  4. Let then be Completion(Get(resolution, "then")).
  5. If then is an abrupt completion, then
    1. Perform RejectPromise(promise, then.[[Value]]).
    2. Return unused.
  6. Let thenAction be then.[[Value]].
  7. If IsCallable(thenAction) is false, then
    1. Perform FulfillPromise(promise, resolution).
    2. Return unused.
  8. If called is deferred, then
    1. Perform ? PerformPromiseResolveThenable(promise, resolution, thenAction).
    2. Return unused.
  9. Let thenJobCallback be HostMakeJobCallback(thenAction).
  10. Let job be NewPromiseResolveThenableJob(promise, resolution, thenJobCallback).
  11. Perform HostEnqueuePromiseJob(job.[[Job]], job.[[Realm]]).
  12. Return unused.

1.4 NewPromiseResolveThenableJob ( promiseToResolve, thenable, then )

The abstract operation NewPromiseResolveThenableJob takes arguments promiseToResolve (a Promise), thenable (an Object), and then (a JobCallback Record) and returns a Record with fields [[Job]] (a Job Abstract Closure) and [[Realm]] (a Realm Record). It performs the following steps when called:

  1. Let job be a new Job Abstract Closure with no parameters that captures promiseToResolve, thenable, and then and performs the following steps when called:
    1. Return ? PerformPromiseResolveThenable(promiseToResolve, thenable, then).
    2. Let resolvingFunctions be CreateResolvingFunctions(promiseToResolve).
    3. Let thenCallResult be Completion(HostCallJobCallback(then, thenable, « resolvingFunctions.[[Resolve]], resolvingFunctions.[[Reject]] »)).
    4. If thenCallResult is an abrupt completion, then
      1. Return ? Call(resolvingFunctions.[[Reject]], undefined, « thenCallResult.[[Value]] »).
    5. Return ! thenCallResult.
  2. Let getThenRealmResult be Completion(GetFunctionRealm(then.[[Callback]])).
  3. If getThenRealmResult is a normal completion, let thenRealm be getThenRealmResult.[[Value]].
  4. Else, let thenRealm be the current Realm Record.
  5. NOTE: thenRealm is never null. When then.[[Callback]] is a revoked Proxy and no code runs, thenRealm is used to create error objects.
  6. Return the Record { [[Job]]: job, [[Realm]]: thenRealm }.
 Note

This Job uses the supplied thenable and its then method to resolve the given promise. This process must take place as a Job to ensure that the evaluation of the then method occurs after evaluation of any surrounding code has completed.

1.5 PerformPromiseResolveThenable ( promiseToResolve, thenable, then )

The abstract operation PerformPromiseResolveThenable takes arguments promiseToResolve (a Promise), thenable (an Object), and then (a JobCallback Record or a function object) and returns either a normal completion containing an ECMAScript language value or a throw completion. It performs the following steps when called:

  1. Let resolvingFunctions be CreateResolvingFunctions(promiseToResolve).
  2. If then is a function object, then
    1. Let thenCallResult be Completion(Call(then, thenable, « resolvingFunctions.[[Resolve]], resolvingFunctions.[[Reject]] »)).
  3. Else,
    1. Let thenCallResult be Completion(HostCallJobCallback(then, thenable, « resolvingFunctions.[[Resolve]], resolvingFunctions.[[Reject]] »)).
  4. If thenCallResult is an abrupt completion, then
    1. Return ? Call(resolvingFunctions.[[Reject]], undefined, « thenCallResult.[[Value]] »).
  5. Return ! thenCallResult.

1.6 CreateResolvingFunctions ( toResolve )

The abstract operation CreateResolvingFunctions takes argument toResolve (a Promise) and returns a Record with fields [[Resolve]] (a function object) and [[Reject]] (a function object). This is a modification of the existing CreateResolvingFunctions. It performs the following steps when called:

  1. Let promiseOrEmpty be the Record { [[Value]]: toResolve }.
  2. Let resolveSteps be a new Abstract Closure with parameters (resolution) that captures promiseOrEmpty and performs the following steps when called:
    1. If promiseOrEmpty.[[Value]] is empty, return undefined.
    2. Let promise be promiseOrEmpty.[[Value]].
    3. Set promiseOrEmpty.[[Value]] to empty.
    4. Perform ? PerformPromiseResolution(promise, resolution, sync).
    5. If SameValue(resolution, promise) is true, then
      1. Let selfResolutionError be a newly created TypeError object.
      2. Perform RejectPromise(promise, selfResolutionError).
      3. Return undefined.
    6. If resolution is not an Object, then
      1. Perform FulfillPromise(promise, resolution).
      2. Return undefined.
    7. Let then be Completion(Get(resolution, "then")).
    8. If then is an abrupt completion, then
      1. Perform RejectPromise(promise, then.[[Value]]).
      2. Return undefined.
    9. Let thenAction be then.[[Value]].
    10. If IsCallable(thenAction) is false, then
      1. Perform FulfillPromise(promise, resolution).
      2. Return undefined.
    11. Let thenJobCallback be HostMakeJobCallback(thenAction).
    12. Let job be NewPromiseResolveThenableJob(promise, resolution, thenJobCallback).
    13. Perform HostEnqueuePromiseJob(job.[[Job]], job.[[Realm]]).
    14. Return undefined.
  3. Let resolve be CreateBuiltinFunction(resolveSteps, 1, "", « »).
  4. Let rejectSteps be a new Abstract Closure with parameters (reason) that captures promiseOrEmpty and performs the following steps when called:
    1. If promiseOrEmpty.[[Value]] is empty, return undefined.
    2. Let promise be promiseOrEmpty.[[Value]].
    3. Set promiseOrEmpty.[[Value]] to empty.
    4. Perform RejectPromise(promise, reason).
    5. Return undefined.
  5. Let reject be CreateBuiltinFunction(rejectSteps, 1, "", « »).
  6. Return the Record { [[Resolve]]: resolve, [[Reject]]: reject }.

1.7 SafePromiseResolve ( promiseCapability, resolution )

The abstract operation SafePromiseResolve takes arguments promiseCapability (a PromiseCapability Record) and resolution (an ECMAScript language value) and returns either a normal completion containing undefined or a throw completion. It resolves promiseCapability.[[Promise]] with resolution, deferring the user-code-running steps to a subsequent microtask if resolution might execute user code synchronously. In either branch, promiseCapability's resolving functions are latched on return. Safe in this sense refers only to the execution of user code during the execution of the promise resolve. It performs the following steps when called:

  1. If RequiresDeferredPromiseResolution(resolution) is false, then
    1. Return ? Call(promiseCapability.[[Resolve]], undefined, « resolution »).
  2. Let promise be promiseCapability.[[Promise]].
  3. Let deferredSteps be a new Abstract Closure with parameters (onFulfilled, onRejected) that captures promise and resolution and performs the following steps when called:
    1. Perform ? PerformPromiseResolution(promise, resolution, deferred).
    2. Return undefined.
  4. Let deferredThen be CreateBuiltinFunction(deferredSteps, 2, "", « »).
  5. Let wrapper be OrdinaryObjectCreate(null).
  6. Perform ! CreateDataPropertyOrThrow(wrapper, "then", deferredThen).
  7. Return ? Call(promiseCapability.[[Resolve]], undefined, « wrapper »).
 Note

This idea is thanks to Justin Ridgewell who suggested the wrapper idea.

The wrapper object is never exposed to user code. It is constructed solely so that resolving promise with it uses the existing thenable support for good rather than evil; we mark the promise as not eligible for overriding resolve, and a job is created for running the 'then' code.

Copyright & Software License

Software License

All Software contained in this document ("Software") is protected by copyright and is being made available under the "BSD License", included below. This Software may be subject to third party rights (rights from parties other than Ecma International), including patent rights, and no licenses under such third party rights are granted under this license even if the third party concerned is a member of Ecma International. SEE THE ECMA CODE OF CONDUCT IN PATENT MATTERS AVAILABLE AT https://ecma-international.org/memento/codeofconduct.htm FOR INFORMATION REGARDING THE LICENSING OF PATENT CLAIMS THAT ARE REQUIRED TO IMPLEMENT ECMA INTERNATIONAL STANDARDS.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

  1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
  2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
  3. Neither the name of the authors nor Ecma International may be used to endorse or promote products derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE ECMA INTERNATIONAL "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ECMA INTERNATIONAL BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.