expo-modules-jsi 57.0.8 → 57.1.0

package/CHANGELOG.md

@@ -10,6 +10,25 @@
 
 ### 💡 Others
 
+## 57.1.0 — 2026-09-08
+
+### 🎉 New features
+
+- [iOS] Add a `JavaScriptEncodable` conformance for `Task` that encodes it to a JS `Promise` settling with the task's result, so native code can hand JavaScript a promise as a value. ([#47861](https://github.com/expo/expo/pull/47861) by [@tsapeta](https://github.com/tsapeta))
+- [iOS] Split the `Array`, `Optional`, and `Dictionary` `JavaScriptCodable` conformances into separate `JavaScriptDecodable` and `JavaScriptEncodable` halves so an encode-only element type such as `Task` can be carried through a container's encode. ([#47861](https://github.com/expo/expo/pull/47861) by [@tsapeta](https://github.com/tsapeta))
+- [iOS] Add a `JavaScriptPromise.resolve` overload that takes a `JavaScriptEncodable` value, encoding it on the JavaScript thread and rejecting the promise if encoding or the resolver call throws. ([#47862](https://github.com/expo/expo/pull/47862) by [@tsapeta](https://github.com/tsapeta))
+
+### 🐛 Bug fixes
+
+- [iOS] Fixed a use-after-free when a non-owning `JavaScriptRuntime` wrapper outlives its runtime (e.g. it is captured by a task abandoned on reload): its cached `jsi::PropNameID`s were destroyed against the freed runtime when the wrapper deallocated. The teardown sweep now flushes the cache on the JavaScript thread while the runtime is still valid. ([#47927](https://github.com/expo/expo/pull/47927) by [@tsapeta](https://github.com/tsapeta))
+- [iOS] `JavaScriptPromise` no longer traps when a resolve or reject call throws, which can realistically only happen against a runtime that is being torn down: a failed resolver call rejects the promise instead and a failed rejecter call is dropped. ([#47862](https://github.com/expo/expo/pull/47862) by [@tsapeta](https://github.com/tsapeta))
+
+### 💡 Others
+
+- [iOS] Made creating a deferred `JavaScriptPromise` ~1.2× faster by building it from a cached JavaScript closure instead of a host function executor. ([#49714](https://github.com/expo/expo/pull/49714) by [@tsapeta](https://github.com/tsapeta))
+- [iOS] Reduced the native overhead of synchronous host function calls and host object property accessors that return `undefined`, `null`, a boolean or a number: the result is written into the engine's slot without engine calls, and errors are reported only when one was actually thrown instead of being checked on every call. ([#49761](https://github.com/expo/expo/pull/49761) by [@tsapeta](https://github.com/tsapeta))
+- [iOS] Reduced the native overhead of synchronous host function calls whose closure receives `this` as a `JavaScriptValue`, by letting the calling module destroy the arguments buffer directly. ([#49769](https://github.com/expo/expo/pull/49769) by [@tsapeta](https://github.com/tsapeta))
+
 ## 57.0.8 — 2026-09-04
 
 ### 🎉 New features
@@ -18,6 +37,7 @@
 
 ### 🐛 Bug fixes
 
+- [iOS] Fixed the build against React Native older than 0.86 (e.g. react-native-macos 0.81), where `jsi::Runtime::getStringData` is a protected member that Swift cannot call. String decoding now goes through a C++ wrapper that uses the public `jsi::String::getStringData` helper on those versions. ([#49790](https://github.com/expo/expo/pull/49790) by [@tsapeta](https://github.com/tsapeta))
 - [iOS] Fixed `JavaScriptPropNameID(_:string:)` and the array's string-keyed subscript truncating non-ASCII property keys: they passed `String.count` (the grapheme-cluster count) as the UTF-8 byte length to `PropNameID::forUtf8`, so keys like `"café"` or `"🎉"` were built from mangled bytes and no longer matched the intended property. ([#48329](https://github.com/expo/expo/pull/48329) by [@tsapeta](https://github.com/tsapeta))
 - [iOS] Fixed the prebuilt `ExpoModulesJSI.xcframework` shipping with code coverage instrumentation: building through the auto-generated SwiftPM scheme made Xcode pass `-profile-generate -profile-coverage-mapping` to swiftc even for a plain Release `build`, adding a counter increment to every function on the host function call path and about 40% to the binary size. The benchmark target had the same instrumentation and now runs without it. ([#49637](https://github.com/expo/expo/pull/49637) by [@tsapeta](https://github.com/tsapeta))
 - [iOS] Fixed property names with non-ASCII characters being mangled when accessed by name from Swift, such as `getProperty`, `setProperty`, `hasProperty`, the array string subscript and dictionary conversions. ([#49679](https://github.com/expo/expo/pull/49679) by [@tsapeta](https://github.com/tsapeta))

package/apple/Benchmarks/PromiseBenchmarks.swift

@@ -0,0 +1,43 @@
+// Copyright 2026-present 650 Industries. All rights reserved.
+
+import ExpoModulesJSI
+import Testing
+
+/// Benchmarks for creating and settling deferred promises from Swift. The engine floor is measured
+/// from JavaScript for comparison, so the wrapper's own overhead can be read off directly.
+extension JSIBenchmarks {
+  @Test
+  func `engine floor: new Promise from JavaScript`() async throws {
+    try await benchmarkCase { runtime in
+      let driver = try runtime.eval(
+        "(function(n) { for (var i = 0; i < n; i++) new Promise(function (a, b) {}); })"
+      ).getFunction()
+      try benchmark("engine floor: new Promise from JS", runtime: runtime) { iterations in
+        _ = try driver.call(arguments: iterations)
+      }
+    }
+  }
+
+  @Test
+  func `create deferred promise`() async throws {
+    try await benchmarkCase { runtime in
+      try benchmark("JavaScriptPromise(runtime): create deferred", runtime: runtime) { iterations in
+        for _ in 0..<iterations {
+          _ = try JavaScriptPromise(runtime)
+        }
+      }
+    }
+  }
+
+  @Test
+  func `create and resolve deferred promise`() async throws {
+    try await benchmarkCase { runtime in
+      try benchmark("JavaScriptPromise(runtime): create and resolve", runtime: runtime) { iterations in
+        for _ in 0..<iterations {
+          let promise = try JavaScriptPromise(runtime)
+          promise.resolve(42.0)
+        }
+      }
+    }
+  }
+}

package/apple/Sources/ExpoModulesJSI/Coding/JavaScriptCodable+Containers.swift

@@ -1,15 +1,15 @@
 // Copyright 2025-present 650 Industries. All rights reserved.
 
-// `JavaScriptCodable` conformances for the standard container and wrapper types — `Array`,
-// `Optional`, and `Dictionary` — each conditional on its element/wrapped type conforming, and
-// each recursing statically into that element's conversion.
+// `JavaScriptCodable` conformances for the standard container and wrapper types (`Array`,
+// `Optional`, `Dictionary`), each recursing statically into its element/wrapped type's conversion.
 //
-// `JavaScriptCodable` is a composition type alias, so a conformance clause spells out both halves:
-// `extension Array: JavaScriptDecodable, JavaScriptEncodable where Element: JavaScriptCodable`.
+// The decodable and encodable halves are separate conditional conformances, each gated only on the
+// half it needs. A type conforming to both still gets both halves, but an encode-only element type
+// (e.g. `Task`, which has no `decode`) can still be carried through a container's encode.
 
 // MARK: - Array
 
-extension Array: JavaScriptDecodable, JavaScriptEncodable where Element: JavaScriptCodable {
+extension Array: JavaScriptDecodable where Element: JavaScriptDecodable {
   @JavaScriptActor
   @inlinable
   public static func decode(_ value: borrowing JavaScriptValue, in runtime: borrowing JavaScriptRuntime) throws
@@ -26,7 +26,9 @@ extension Array: JavaScriptDecodable, JavaScriptEncodable where Element: JavaScr
       return try Element.decode(element, in: runtime)
     }
   }
+}
 
+extension Array: JavaScriptEncodable where Element: JavaScriptEncodable {
   @JavaScriptActor
   @inlinable
   public static func encode(_ value: [Element], in runtime: borrowing JavaScriptRuntime) throws
@@ -42,7 +44,7 @@ extension Array: JavaScriptDecodable, JavaScriptEncodable where Element: JavaScr
 
 // MARK: - Optional
 
-extension Optional: JavaScriptDecodable, JavaScriptEncodable where Wrapped: JavaScriptCodable {
+extension Optional: JavaScriptDecodable where Wrapped: JavaScriptDecodable {
   // Optional copies nothing itself, so it overrides the zero-copy overload too and forwards the
   // borrowed value straight through — a wrapped primitive argument stays fully zero-copy.
   @JavaScriptActor
@@ -66,7 +68,9 @@ extension Optional: JavaScriptDecodable, JavaScriptEncodable where Wrapped: Java
     }
     return try Wrapped.decode(value, in: runtime)
   }
+}
 
+extension Optional: JavaScriptEncodable where Wrapped: JavaScriptEncodable {
   @JavaScriptActor
   @inlinable
   public static func encode(_ value: Wrapped?, in runtime: borrowing JavaScriptRuntime) throws
@@ -82,7 +86,7 @@ extension Optional: JavaScriptDecodable, JavaScriptEncodable where Wrapped: Java
 
 // MARK: - Dictionary
 
-extension Dictionary: JavaScriptDecodable, JavaScriptEncodable where Key == String, Value: JavaScriptCodable {
+extension Dictionary: JavaScriptDecodable where Key == String, Value: JavaScriptDecodable {
   @JavaScriptActor
   @inlinable
   public static func decode(_ value: borrowing JavaScriptValue, in runtime: borrowing JavaScriptRuntime) throws
@@ -102,7 +106,9 @@ extension Dictionary: JavaScriptDecodable, JavaScriptEncodable where Key == Stri
     }
     return result
   }
+}
 
+extension Dictionary: JavaScriptEncodable where Key == String, Value: JavaScriptEncodable {
   @JavaScriptActor
   @inlinable
   public static func encode(_ value: [String: Value], in runtime: borrowing JavaScriptRuntime) throws

package/apple/Sources/ExpoModulesJSI/Coding/JavaScriptCodable+Task.swift

@@ -0,0 +1,35 @@
+// Copyright 2025-present 650 Industries. All rights reserved.
+
+// `JavaScriptEncodable` conformance for `Task`, encoding it to a JavaScript `Promise`. This lets
+// native code hand JavaScript a promise as a value: the return of a synchronous `@JS func` whose
+// result type is `Task`, or a `Task` nested inside another encoded value. `createAsyncFunction`
+// only wraps a function's own return in a promise, so a `Task` is how to produce one anywhere else.
+//
+// Encode-only: a promise decodes by awaiting it through `JavaScriptPromise`, not by reconstructing
+// a `Task`. One conditional conformance covers throwing and non-throwing tasks (Swift forbids two
+// conformances even with disjoint bounds, and `Task.value` is `async throws` for any `Failure`).
+
+/// Encodes a `Task` to a JavaScript promise that settles with the task's result.
+extension Task: JavaScriptEncodable where Success: JavaScriptEncodable, Failure: Error {
+  /// Returns a pending promise immediately and settles it on the JavaScript thread once the task
+  /// completes: fulfilling with the encoded `Success` value, or rejecting with the thrown error.
+  @JavaScriptActor
+  public static func encode(_ value: Task<Success, Failure>, in runtime: borrowing JavaScriptRuntime) throws
+    -> JavaScriptValue
+  {
+    let promise = try JavaScriptPromise(copy runtime)
+    // A detached task awaits the result off the JavaScript thread, then settles the promise. It must
+    // not inherit `@JavaScriptActor`: that actor runs jobs synchronously on the current thread rather
+    // than hopping to the JS thread, so a resumed continuation would land on whatever thread the task
+    // finished on. `resolve`/`reject` hop to the JS thread internally (and the encodable `resolve`
+    // encodes there), so settling from here is safe regardless of this task's thread.
+    Task<Void, Never>.detached {
+      do {
+        promise.resolve(try await value.value)
+      } catch {
+        promise.reject(error)
+      }
+    }
+    return promise.asValue()
+  }
+}

package/apple/Sources/ExpoModulesJSI/Contexts/HostCallbackContext.swift

@@ -12,17 +12,17 @@ internal protocol HostCallbackContext: AnyObject {
 /// `_withUnsafeGuaranteedRef` promises the compiler that both objects outlive the closure, so no
 /// retain or release is emitted for either. Both promises hold for a JSI callback: the JSI owner
 /// of the context is the caller, and a synchronous callback runs while the runtime executes JS,
-/// with the wrapper owned for the runtime's whole lifetime. The body returns nothing because
-/// `_withUnsafeGuaranteedRef` needs a `Copyable` result; callbacks write their `jsi::Value`
-/// result into the slot the C++ caller provides instead.
+/// with the wrapper owned for the runtime's whole lifetime. The body's result must be `Copyable`
+/// because `_withUnsafeGuaranteedRef` requires it; callbacks write their `jsi::Value` result into the
+/// slot the C++ caller provides and return only whether an error was stored.
 @inline(__always)
-internal func withGuaranteedContext<Context: HostCallbackContext>(
+internal func withGuaranteedContext<Context: HostCallbackContext, Result>(
   _ pointer: UnsafeMutableRawPointer,
-  _ body: (_ context: Context, _ runtime: JavaScriptRuntime) -> Void
-) {
-  Unmanaged<Context>.fromOpaque(pointer)._withUnsafeGuaranteedRef { context in
-    context.runtime._withUnsafeGuaranteedRef { runtime in
-      body(context, runtime)
+  _ body: (_ context: Context, _ runtime: JavaScriptRuntime) -> Result
+) -> Result {
+  return Unmanaged<Context>.fromOpaque(pointer)._withUnsafeGuaranteedRef { context in
+    return context.runtime._withUnsafeGuaranteedRef { runtime in
+      return body(context, runtime)
     }
   }
 }

package/apple/Sources/ExpoModulesJSI/Runtime/JavaScriptRuntime.swift

@@ -133,6 +133,7 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
     // when the last reference is gone. `deinit` is `nonisolated`, so it can touch the actor-isolated
     // registry directly given that exclusive access.
     propNameIdsRegistry.removeAll()
+    cachedDeferredPromiseFactory = nil
     expo.destroyRuntime(runtimePointee)
   }
 
@@ -182,14 +183,14 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
       context: UnsafeMutableRawPointer,
       propertyName: UnsafePointer<CChar>,
       resultPtr: UnsafeMutablePointer<facebook.jsi.Value>
-    ) {
+    ) -> Bool {
       let propertyName = String(cString: propertyName)
       nonisolated(unsafe) let resultPtr = resultPtr
 
-      withGuaranteedContext(context) { (context: HostObjectContext, runtime) in
-        resultPtr.pointee = JavaScriptActor.assumeIsolated {
+      return withGuaranteedContext(context) { (context: HostObjectContext, runtime) in
+        return JavaScriptActor.assumeIsolated {
           return forwardingSwiftErrorsToJS(runtime: runtime) {
-            return try context.get(propertyName).asJSIValue()
+            try context.get(propertyName).writeJSIValue(to: resultPtr)
           }
         }
       }
@@ -197,10 +198,10 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
 
     func setter(
       context: UnsafeMutableRawPointer, propertyName: UnsafePointer<CChar>, valuePointer: UnsafeMutableRawPointer
-    ) {
+    ) -> Bool {
       let propertyName = String(cString: propertyName)
 
-      withGuaranteedContext(context) { (context: HostObjectContext, runtime) in
+      return withGuaranteedContext(context) { (context: HostObjectContext, runtime) in
         guard let set = context.set else {
           // Unreachable in practice: when the user passed `nil` for `set`, the call site
           // below at `expo.HostObjectCallbacks(...)` also passes `nil` to C++, and
@@ -211,8 +212,8 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
         }
         let value = JavaScriptValue(runtime, valuePointer.assumingMemoryBound(to: facebook.jsi.Value.self).move())
 
-        JavaScriptActor.assumeIsolated {
-          forwardingSwiftErrorsToJS(runtime: runtime) {
+        return JavaScriptActor.assumeIsolated {
+          return forwardingSwiftErrorsToJS(runtime: runtime) {
             try set(propertyName, value)
           }
         }
@@ -253,7 +254,7 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
     let context = Unmanaged.passRetained(HostObjectContext(runtime: self, get, set, getPropertyNames, dealloc))
       .toOpaque()
     let setterPointer:
-      (@convention(c) (UnsafeMutableRawPointer, UnsafePointer<CChar>, UnsafeMutableRawPointer) -> Void)? = setter
+      (@convention(c) (UnsafeMutableRawPointer, UnsafePointer<CChar>, UnsafeMutableRawPointer) -> Bool)? = setter
     // Pass a null setter to C++ when the Swift setter is nil so that JS assignment
     // raises a `jsi::JSError` directly, without crossing the Swift boundary.
     let callbacks = expo.HostObjectCallbacks(
@@ -693,6 +694,13 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
   @JavaScriptActor
   internal var propNameIdsRegistry: [String: JavaScriptPropNameID] = [:]
 
+  // MARK: - Deferred promise factory
+
+  /// The JavaScript function ``JavaScriptPromise`` uses to create deferred promises, built on first
+  /// use and released with the runtime. See `JavaScriptPromise.init(_:)` for why it exists.
+  @JavaScriptActor
+  internal var cachedDeferredPromiseFactory: JavaScriptValue?
+
   // MARK: - Long-lived objects
 
   /// Registry of JSI objects (such as in-flight promises) that must outlive the native call that
@@ -716,13 +724,19 @@ open class JavaScriptRuntime: Equatable, Identifiable, @unchecked Sendable {
       // collection keeps it alive for the sweep; it does not retain the runtime.
       let longLivedObjects = self.longLivedObjects
       let nativeState = JavaScriptNativeState()
-      nativeState.setDeallocator { nativeState in
+      nativeState.setDeallocator { [weak self] nativeState in
         // Fires as the teardown object is released on the JavaScript thread with the runtime still
         // valid, so releasing JSI state here is safe. Mirrors the caveat on `AppContext.NativeState`:
         // a future cross-runtime path that could drop this state from another thread would have to
         // hop back to the JavaScript thread first.
         JavaScriptActor.assumeIsolated {
           longLivedObjects.clear()
+          // Also flush the cached `jsi::PropNameID`s and the deferred-promise factory: a non-owning
+          // wrapper can outlive its runtime (e.g. captured by a task abandoned on reload) and would
+          // otherwise destroy them against the freed runtime when it deallocates. `self` is weak so
+          // the teardown object doesn't retain the wrapper; the owning wrapper clears both in `deinit`.
+          self?.propNameIdsRegistry.removeAll()
+          self?.cachedDeferredPromiseFactory = nil
         }
       }
       let object = createObject()
@@ -750,7 +764,7 @@ private func createFunctionClosure(
     argumentsPtr: UnsafePointer<facebook.jsi.Value>,
     argumentsCount: Int,
     resultPtr: UnsafeMutablePointer<facebook.jsi.Value>
-  ) {
+  ) -> Bool {
     // `assumeIsolated` runs `operation` synchronously, in this very scope — it never escapes and never
     // hops threads (see `JavaScriptActor.assumeIsolated`). So rather than materializing the move-only
     // `JavaScriptValuesBuffer` out here and smuggling it across the closure boundary through a
@@ -766,13 +780,13 @@ private func createFunctionClosure(
 
     // See `withGuaranteedContext` for why neither the context nor the runtime is retained here, and
     // why the result is written to the caller's slot instead of being returned.
-    withGuaranteedContext(context) { (context: HostFunctionContext, runtime) in
-      resultPtr.pointee = JavaScriptActor.assumeIsolated {
+    return withGuaranteedContext(context) { (context: HostFunctionContext, runtime) in
+      return JavaScriptActor.assumeIsolated {
         return forwardingSwiftErrorsToJS(runtime: runtime) {
           let this = UnsafeMutablePointer(mutating: thisPtr).move()
           let arguments = JavaScriptValuesBuffer(runtime, start: argumentsPtr, count: argumentsCount)
           let thisValue = JavaScriptValue(runtime, this)
-          return try context.call(thisValue, consume arguments).asJSIValue()
+          try context.call(thisValue, consume arguments).writeJSIValue(to: resultPtr)
         }
       }
     }
@@ -797,7 +811,7 @@ private func createFunctionClosure(
     argumentsPtr: UnsafePointer<facebook.jsi.Value>,
     argumentsCount: Int,
     resultPtr: UnsafeMutablePointer<facebook.jsi.Value>
-  ) {
+  ) -> Bool {
     // Same call-scoped reasoning as the owning-`this` overload above (see its comment) for why the
     // buffer is built inside the synchronous `assumeIsolated` closure. Here `this` is additionally
     // handed in as a borrowed `JavaScriptUnownedValue` pointing straight at the C++-owned `this` slot:
@@ -809,12 +823,12 @@ private func createFunctionClosure(
 
     // See `withGuaranteedContext` for why neither the context nor the runtime is retained here, and
     // why the result is written to the caller's slot instead of being returned.
-    withGuaranteedContext(context) { (context: UnownedThisHostFunctionContext, runtime) in
-      resultPtr.pointee = JavaScriptActor.assumeIsolated {
+    return withGuaranteedContext(context) { (context: UnownedThisHostFunctionContext, runtime) in
+      return JavaScriptActor.assumeIsolated {
         return forwardingSwiftErrorsToJS(runtime: runtime) {
           let arguments = JavaScriptValuesBuffer(runtime, start: argumentsPtr, count: argumentsCount)
           let thisValue = JavaScriptUnownedValue(runtime.pointee, thisPtr)
-          return try context.call(thisValue, consume arguments).asJSIValue()
+          try context.call(thisValue, consume arguments).writeJSIValue(to: resultPtr)
         }
       }
     }

package/apple/Sources/ExpoModulesJSI/Runtime/JavaScriptValuesBuffer.swift

@@ -3,24 +3,44 @@ internal import jsi
 /// A buffer that stores instances of `facebook.jsi.Value` with the ability to convert them to `JavaScriptValue` on element access
 /// without the need to create a new container (e.g. `std.vector<facebook.jsi.Value>` or `[JavaScriptValue]`).
 /// Used mainly to pass function arguments from C++ to Swift.
+// `@frozen` so client modules, which consume a buffer in every host function closure, can destroy it
+// with a direct call to its `deinit` instead of a metadata accessor plus a value witness dispatch.
+@frozen
 public struct JavaScriptValuesBuffer: JavaScriptType, ~Copyable {
-  // Safe to use unowned — the buffer's lifetime is scoped to a host function call,
+  // MARK: - Layout
+
+  // Every stored property below is part of the frozen layout: adding, removing or reordering one
+  // changes the ABI that client modules compiled against, and each type has to be public, which is
+  // why the storage is kept as a raw pointer and rebuilt into its C++ view on access.
+
+  // Safe to use unowned: the buffer's lifetime is scoped to a host function call,
   // so the runtime is always alive while the buffer exists.
   //
   // `unowned(unsafe)` rather than `unowned`: the runtime object carries a refcount side table (other
   // wrappers hold it `weak`), so a safe `unowned` retain/release on it takes the slow side-table path
   // on every buffer construction and destruction. Profiling showed that pair as roughly a third of the
-  // native-side cost of a no-op `@JS` host call. `unowned(unsafe)` is a plain pointer store/load.
+  // native-side cost of a no-op host function call. `unowned(unsafe)` is a plain pointer store/load.
   internal unowned(unsafe) let runtime: JavaScriptRuntime
 
-  // The raw `facebook.jsi.IRuntime`, cached alongside the `JavaScriptRuntime` wrapper. `IRuntime` is
-  // an immortal reference (`jsi.apinotes`), so reading it costs no ARC, whereas reading `.pointee`
-  // off the `unowned` wrapper emits an unowned retain/release on every access. The hot decode path
-  // (`unownedValue(at:)`, `set`) reads this; `subscript`/`copy` still need the wrapper.
-  internal nonisolated(unsafe) let iRuntime: facebook.jsi.IRuntime
+  // The start of the storage, type-erased because `facebook.jsi.Value` is not a public type.
+  internal nonisolated(unsafe) let start: UnsafeMutableRawPointer?
+
+  /// The number of values in the buffer.
+  public let count: Int
+
+  internal let ownsMemory: Bool
+
+  // MARK: - C++ views
 
-  internal nonisolated(unsafe) let bufferPointer: UnsafeMutableBufferPointer<facebook.jsi.Value>
-  private let ownsMemory: Bool
+  // `IRuntime` is an immortal reference (`jsi.apinotes`) and `runtime` is `unowned(unsafe)`, so this is
+  // two plain loads with no reference counting.
+  internal var iRuntime: facebook.jsi.IRuntime {
+    return runtime.pointee
+  }
+
+  internal var bufferPointer: UnsafeMutableBufferPointer<facebook.jsi.Value> {
+    return UnsafeMutableBufferPointer(start: start?.assumingMemoryBound(to: facebook.jsi.Value.self), count: count)
+  }
 
   /// A pointer to the first value of the buffer.
   /// If the baseAddress of this buffer is `nil`, the `count` is zero.
@@ -32,12 +52,7 @@ public struct JavaScriptValuesBuffer: JavaScriptType, ~Copyable {
   /// passing across Swift/ObjC++ boundaries where `facebook.jsi.Value` cannot
   /// appear in a public signature.
   public var rawBaseAddress: UnsafeRawPointer? {
-    return baseAddress.map { UnsafeRawPointer($0) }
-  }
-
-  /// The number of values in the buffer.
-  public var count: Int {
-    return bufferPointer.count
+    return start.map { UnsafeRawPointer($0) }
   }
 
   internal init(
@@ -45,8 +60,8 @@ public struct JavaScriptValuesBuffer: JavaScriptType, ~Copyable {
     ownsMemory: Bool = false
   ) {
     self.runtime = runtime
-    self.iRuntime = runtime.pointee
-    self.bufferPointer = buffer
+    self.start = UnsafeMutableRawPointer(buffer.baseAddress)
+    self.count = buffer.count
     self.ownsMemory = ownsMemory
   }
 

package/apple/Sources/ExpoModulesJSI/Runtime/Values/JavaScriptPromise.swift

@@ -80,19 +80,15 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
   public init(_ runtime: JavaScriptRuntime) throws {
     self.runtime = runtime
 
-    // Create function that is the promise setup. It is called immediately on `callAsConstructor`.
-    let setup = runtime.createFunction { [weak longLivedState] this, arguments in
-      longLivedState?.resolveFunction.reset(arguments[0])
-      longLivedState?.rejectFunction.reset(arguments[1])
-      return .undefined
-    }
-
-    let object =
-      try runtime
-      .global()
-      .getPropertyAsFunction(.cached(runtime, "Promise"))
-      .callAsConstructor(setup.asValue())
-    longLivedState.object.reset(object)
+    // The promise and its two settle functions come from a JavaScript closure that returns all three
+    // at once, rather than from `new Promise(executor)` with a host function as the executor. The
+    // host function route costs a native function and a Swift context object per promise, a re-entry
+    // from the engine into Swift while the constructor runs, and an owning copy of each settle
+    // function on the way back. The closure route is one JS call and three array reads.
+    let triple = try runtime.deferredPromiseFactory().getFunction().call().getArray()
+    longLivedState.object.reset(try triple.getValue(at: 0))
+    longLivedState.resolveFunction.reset(try triple.getValue(at: 1))
+    longLivedState.rejectFunction.reset(try triple.getValue(at: 2))
     try setUpCallbacks()
     // Register only after setup succeeds, so a failed initializer (e.g. `then` unavailable) doesn't
     // leave the state pinned in the collection until teardown. Owns the promise's JSI values from
@@ -121,6 +117,13 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
     } ?? .undefined
   }
 
+  /// Resolves the promise with a value that has a direct JavaScript representation.
+  ///
+  /// Preferred over the encodable overload for a type that is both ``JavaScriptRepresentable`` and
+  /// ``JavaScriptEncodable``, so existing values (primitives, containers, JSI value wrappers) keep
+  /// their established representation. For example a 64-bit integer stays a JS `number` here rather
+  /// than encoding to a `bigint` or rejecting for exceeding the safe-integer range.
+  /// If the resolver call throws, the promise is rejected instead.
   public func resolve<V: JavaScriptRepresentable>(_ value: V) {
     guard let runtime else {
       return
@@ -132,13 +135,58 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
       guard let resolver = longLivedState.resolveFunction.take() else {
         return
       }
-      // Call the actual resolver given in the Promise setup.
-      // This will also call `deferredPromise.resolve` in the `then` handler.
-      _ = try! resolver.getFunction().call(arguments: value)
+      do {
+        // Call the actual resolver given in the Promise setup.
+        // This will also call `deferredPromise.resolve` in the `then` handler.
+        _ = try resolver.getFunction().call(arguments: value)
 
-      // The rejecter can't be called anymore. The state stays registered so it keeps owning the
-      // object until the wrapper is dropped (or the teardown sweep runs).
-      longLivedState.rejectFunction.release()
+        // The rejecter can't be called anymore. The state stays registered so it keeps owning the
+        // object until the wrapper is dropped (or the teardown sweep runs).
+        longLivedState.rejectFunction.release()
+      } catch {
+        // The resolver call failed; reject with the error instead. The rejecter call itself can
+        // realistically only throw when the runtime is being torn down, where dropping the settle
+        // is harmless because the JS world is going away.
+        let errorValue = JavaScriptError.from(error, in: runtime).toValue()
+        _ = try? longLivedState.rejectFunction.take()?.getFunction().call(arguments: errorValue)
+        longLivedState.resolveFunction.release()
+      }
+    }
+  }
+
+  /// Resolves the promise with a ``JavaScriptEncodable`` value, encoding it on the JavaScript thread.
+  ///
+  /// Encoding runs where `encode` is isolated to `@JavaScriptActor` and may touch the runtime, so a
+  /// caller need not hop there itself. If encoding or the resolver call throws, the promise is
+  /// rejected instead.
+  ///
+  /// Disfavored so a type that is both ``JavaScriptRepresentable`` and ``JavaScriptEncodable`` keeps
+  /// resolving through the representable overload above; this serves the encodable-only types.
+  @_disfavoredOverload
+  public func resolve<V: JavaScriptEncodable>(_ value: sending V) {
+    guard let runtime else {
+      return
+    }
+    // `resolve` is not isolated, so make sure to jump to JS thread; the encode happens there too.
+    runtime.schedule(priority: .immediate) { [longLivedState] in
+      // If the promise is already settled, do nothing.
+      guard let resolver = longLivedState.resolveFunction.take() else {
+        return
+      }
+      do {
+        let encoded = try V.encode(value, in: runtime)
+        // Call the actual resolver, which also calls `deferredPromise.resolve` in the `then` handler.
+        _ = try resolver.getFunction().call(arguments: encoded)
+        // The state stays registered so it keeps owning the object until the wrapper is dropped.
+        longLivedState.rejectFunction.release()
+      } catch {
+        // Encoding or the resolver call failed; reject with the error instead. The rejecter call
+        // itself can realistically only throw when the runtime is being torn down, where dropping
+        // the settle is harmless because the JS world is going away.
+        let errorValue = JavaScriptError.from(error, in: runtime).toValue()
+        _ = try? longLivedState.rejectFunction.take()?.getFunction().call(arguments: errorValue)
+        longLivedState.resolveFunction.release()
+      }
     }
   }
 
@@ -161,7 +209,9 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
 
       // Call the actual rejecter given in the Promise setup.
       // This will also call `deferredPromise.reject` in the `then` handler.
-      _ = try! rejecter.getFunction().call(arguments: errorValue)
+      // The call can realistically only throw when the runtime is being torn down, where dropping
+      // the settle is harmless because the JS world is going away.
+      _ = try? rejecter.getFunction().call(arguments: errorValue)
 
       // The resolver can't be called anymore. The state stays registered so it keeps owning the
       // object until the wrapper is dropped (or the teardown sweep runs).
@@ -201,3 +251,29 @@ public struct JavaScriptPromise: JavaScriptType, ~Copyable {
     }
   }
 }
+
+// MARK: - Deferred promise factory
+
+extension JavaScriptRuntime {
+  /// Returns the cached `() => [promise, resolve, reject]` function as a value, creating it on first use.
+  /// Evaluated from source so it captures nothing native; it is plain JavaScript the engine can
+  /// optimize like any other closure.
+  @JavaScriptActor
+  fileprivate func deferredPromiseFactory() throws -> JavaScriptValue {
+    if let factory = cachedDeferredPromiseFactory {
+      return factory
+    }
+    let factory = try eval(
+      label: "expo-modules-jsi/deferred-promise.js",
+      """
+      (function () {
+        let resolve, reject;
+        const promise = new Promise(function (a, b) { resolve = a; reject = b; });
+        return [promise, resolve, reject];
+      })
+      """
+    )
+    cachedDeferredPromiseFactory = factory
+    return factory
+  }
+}