Async & Functional — Find the Bug¶

Twelve snippets, each hiding one concurrency or async defect. The bug compiles, passes a casual read, and usually passes the happy-path test too — that is exactly why it ships. Find it before you open the answer. The fix is rarely "add a keyword"; it is usually a structural change to how the work is awaited, bounded, or isolated.

Table of Contents¶

1. Snippet 1 — forEach with an async callback (JS)
2. Snippet 2 — await inside a loop, accidentally sequential (TS)
3. Snippet 3 — The floating promise (TS)
4. Snippet 4 — asyncio task created but never awaited (Python)
5. Snippet 5 — Shared mutable accumulator across concurrent tasks (Go)
6. Snippet 6 — Promise.all fails fast and leaks in-flight work (JS)
7. Snippet 7 — No timeout, slow task leaks forever (Python)
8. Snippet 8 — Blocking the event loop with sync I/O (JS)
9. Snippet 9 — Mixing a callback API with async without promisifying (JS)
10. Snippet 10 — context ignored, goroutine outlives its caller (Go)
11. Snippet 11 — Unbounded fan-out, no backpressure (TS)
12. Snippet 12 — Shared mutable default + a "pure" function that isn't (Python)
13. Scorecard
14. Related Topics

How to Use¶

Read each snippet and answer three questions before expanding the collapsible answer:

1. What is the observable failure? A wrong value, a crash, a leak, or "works on my machine, dies under load."
2. Why is it intermittent or invisible? Async bugs hide because the happy path schedules things in the order you imagined. Production reorders them.
3. What is the structural fix? Not the smallest patch that makes one test green — the change that makes the bug impossible to reintroduce.

The defects are grouped roughly from "wrong result" to "leaks and resource exhaustion." Difficulty is marked per snippet. If you find a second bug not in the answer, you are reading well — note it.

Snippet 1 — forEach with an async callback (JS)¶

Difficulty: Warm-up

async function deleteStaleSessions(sessionIds, store) {
  console.log(`Deleting ${sessionIds.length} sessions...`);

  sessionIds.forEach(async (id) => {
    await store.delete(id);
  });

  console.log("All sessions deleted.");
  return { deleted: sessionIds.length };
}

// Caller
const result = await deleteStaleSessions(ids, redisStore);
console.log("Result returned:", result.deleted);

What's wrong?

async function deleteStaleSessions(sessionIds, store) {
  // Concurrent: all deletes in flight, wait for all.
  await Promise.all(sessionIds.map((id) => store.delete(id)));

  // OR sequential, if the store can't take the load:
  // for (const id of sessionIds) await store.delete(id);

  return { deleted: sessionIds.length };
}

Snippet 2 — await inside a loop, accidentally sequential (TS)¶

Difficulty: Easy

async function loadDashboard(userId: string): Promise<Dashboard> {
  const sources = ["profile", "billing", "usage", "notifications", "feed"];
  const data: Record<string, unknown> = {};

  for (const source of sources) {
    data[source] = await fetchSection(userId, source); // each ~120ms
  }

  return assembleDashboard(data);
}

What's wrong?

async function loadDashboard(userId: string): Promise<Dashboard> {
  const sources = ["profile", "billing", "usage", "notifications", "feed"] as const;

  const entries = await Promise.all(
    sources.map(async (source) => [source, await fetchSection(userId, source)] as const),
  );

  return assembleDashboard(Object.fromEntries(entries));
}

Snippet 3 — The floating promise (TS)¶

Difficulty: Easy

class OrderService {
  async placeOrder(order: Order): Promise<OrderId> {
    const id = await this.repo.save(order);

    // Fire off the confirmation email — we don't want to block on it.
    this.emailer.sendConfirmation(order.customerEmail, id);

    this.metrics.increment("orders.placed");
    return id;
  }
}

What's wrong?

async placeOrder(order: Order): Promise<OrderId> {
  const id = await this.repo.save(order);

  // Fire-and-forget, but never let the rejection float.
  void this.emailer
    .sendConfirmation(order.customerEmail, id)
    .catch((err) => this.logger.error("confirmation email failed", { id, err }));

  this.metrics.increment("orders.placed");
  return id;
}

Snippet 4 — asyncio task created but never awaited (Python)¶

Difficulty: Medium

import asyncio

async def warm_caches(keys, cache, db):
    for key in keys:
        asyncio.create_task(_warm_one(key, cache, db))
    # All warming tasks scheduled — return immediately.

async def _warm_one(key, cache, db):
    value = await db.fetch(key)
    await cache.set(key, value)

async def handle_startup():
    await warm_caches(important_keys, cache, db)
    print("Caches warmed, accepting traffic.")

What's wrong?

async def warm_caches(keys, cache, db):
    tasks = [asyncio.create_task(_warm_one(key, cache, db)) for key in keys]
    results = await asyncio.gather(*tasks, return_exceptions=True)
    for key, res in zip(keys, results):
        if isinstance(res, Exception):
            logging.warning("cache warm failed for %s: %s", key, res)

async def warm_caches(keys, cache, db):
    async with asyncio.TaskGroup() as tg:
        for key in keys:
            tg.create_task(_warm_one(key, cache, db))
    # Block exits only when every task is done.

Snippet 5 — Shared mutable accumulator across concurrent tasks (Go)¶

Difficulty: Medium

func TotalSizes(ctx context.Context, urls []string) (int64, error) {
    var total int64
    var wg sync.WaitGroup

    for _, u := range urls {
        wg.Add(1)
        go func(u string) {
            defer wg.Done()
            n, err := fetchSize(ctx, u)
            if err != nil {
                return
            }
            total += n // accumulate
        }(u)
    }

    wg.Wait()
    return total, nil
}

What's wrong?

func TotalSizes(ctx context.Context, urls []string) (int64, error) {
    g, ctx := errgroup.WithContext(ctx)
    sizes := make([]int64, len(urls))

    for i, u := range urls {
        i, u := i, u // capture (pre-Go 1.22)
        g.Go(func() error {
            n, err := fetchSize(ctx, u)
            if err != nil {
                return fmt.Errorf("fetch %s: %w", u, err)
            }
            sizes[i] = n // each goroutine owns its own index — no race
            return nil
        })
    }
    if err := g.Wait(); err != nil {
        return 0, err
    }

    var total int64
    for _, n := range sizes {
        total += n
    }
    return total, nil
}

Snippet 6 — Promise.all fails fast and leaks in-flight work (JS)¶

Difficulty: Medium

async function provisionTenant(tenantId) {
  await Promise.all([
    createDatabase(tenantId),    // ~2s, allocates a real DB
    createBucket(tenantId),      // ~500ms, allocates S3 bucket
    createSearchIndex(tenantId), // ~300ms, fails fast if quota exceeded
  ]);

  return { tenantId, status: "ready" };
}

What's wrong?

async function provisionTenant(tenantId) {
  const steps = {
    db: createDatabase(tenantId),
    bucket: createBucket(tenantId),
    index: createSearchIndex(tenantId),
  };

  const results = await Promise.allSettled(Object.values(steps));

  if (results.some((r) => r.status === "rejected")) {
    // Everything has finished; tear down whatever succeeded.
    await rollbackTenant(tenantId); // idempotent: deletes db/bucket/index if present
    const reasons = results.filter((r) => r.status === "rejected").map((r) => r.reason);
    throw new AggregateError(reasons, `provisioning failed for ${tenantId}`);
  }

  return { tenantId, status: "ready" };
}

Snippet 7 — No timeout, slow task leaks forever (Python)¶

Difficulty: Medium

async def get_quote(symbol, providers):
    """Return the first provider that responds."""
    for provider in providers:
        try:
            return await provider.fetch(symbol)
        except ProviderError:
            continue
    raise NoQuoteError(symbol)

What's wrong?

async def get_quote(symbol, providers, per_provider_timeout=2.0):
    last_error = None
    for provider in providers:
        try:
            async with asyncio.timeout(per_provider_timeout):  # 3.11+
                return await provider.fetch(symbol)
        except (ProviderError, TimeoutError) as e:
            last_error = e
            continue
    raise NoQuoteError(symbol) from last_error

Snippet 8 — Blocking the event loop with sync I/O (JS)¶

Difficulty: Medium

import fs from "node:fs";

app.get("/report/:id", async (req, res) => {
  const template = fs.readFileSync(`./templates/${req.params.id}.html`, "utf8");
  const rows = await db.query("SELECT * FROM events WHERE report_id = $1", [req.params.id]);

  const hash = crypto.pbkdf2Sync(template, "salt", 600000, 64, "sha512"); // integrity check
  res.send(render(template, rows, hash));
});

What's wrong?

import { readFile } from "node:fs/promises";
import { pbkdf2 } from "node:crypto";
import { promisify } from "node:util";

const pbkdf2Async = promisify(pbkdf2); // runs on libuv's threadpool, not the event loop

app.get("/report/:id", async (req, res, next) => {
  try {
    const [template, rows] = await Promise.all([
      readFile(`./templates/${req.params.id}.html`, "utf8"),
      db.query("SELECT * FROM events WHERE report_id = $1", [req.params.id]),
    ]);
    const hash = await pbkdf2Async(template, "salt", 600000, 64, "sha512");
    res.send(render(template, rows, hash));
  } catch (err) {
    next(err);
  }
});

Snippet 9 — Mixing a callback API with async without promisifying (JS)¶

Difficulty: Medium

import { S3 } from "./legacy-s3-client.js"; // callback-style: getObject(key, cb)

async function loadConfig(key) {
  let result;

  s3.getObject(key, (err, data) => {
    if (err) throw err;
    result = JSON.parse(data.Body.toString());
  });

  return result;
}

What's wrong?

import { promisify } from "node:util";

async function loadConfig(key) {
  const getObject = promisify(s3.getObject).bind(s3);
  const data = await getObject(key); // resolves with data, rejects with err
  return JSON.parse(data.Body.toString());
}

Snippet 10 — context ignored, goroutine outlives its caller (Go)¶

Difficulty: Hard

func StreamUpdates(ctx context.Context, w http.ResponseWriter, sub *Subscription) {
    updates := make(chan Update)

    go func() {
        for u := range sub.Source() { // blocks on upstream feed
            updates <- u
        }
    }()

    for u := range updates {
        fmt.Fprintf(w, "data: %s\n\n", u.JSON())
        w.(http.Flusher).Flush()
    }
}

What's wrong?

func StreamUpdates(ctx context.Context, w http.ResponseWriter, sub *Subscription) {
    flusher := w.(http.Flusher)
    src := sub.Source() // assume cancellable / closeable on ctx

    for {
        select {
        case <-ctx.Done(): // client gone or request cancelled
            return
        case u, ok := <-src:
            if !ok {
                return // upstream closed
            }
            fmt.Fprintf(w, "data: %s\n\n", u.JSON())
            flusher.Flush()
        }
    }
}

Snippet 11 — Unbounded fan-out, no backpressure (TS)¶

Difficulty: Hard

async function migrateAllUsers(userIds: string[]): Promise<void> {
  await Promise.all(
    userIds.map((id) => migrateUser(id)), // each opens a DB txn + calls 2 APIs
  );
}

// Called with userIds.length === 4_000_000

What's wrong?

import pLimit from "p-limit";

async function migrateAllUsers(userIds: string[]): Promise<MigrationReport> {
  const limit = pLimit(20); // tune to pool size / downstream rate limits
  const report: MigrationReport = { ok: 0, failed: [] };

  await Promise.all(
    userIds.map((id) =>
      limit(async () => {
        try {
          await migrateUser(id);
          report.ok++;
        } catch (err) {
          report.failed.push({ id, err }); // don't let one failure abort the rest
        }
      }),
    ),
  );

  return report;
}

Snippet 12 — Shared mutable default + a "pure" function that isn't (Python)¶

Difficulty: Hard

async def fetch_batch(ids, cache={}):
    """Fetch ids, memoizing into `cache`. Returns {id: value}."""
    missing = [i for i in ids if i not in cache]

    results = await asyncio.gather(*(remote_fetch(i) for i in missing))
    for i, v in zip(missing, results):
        cache[i] = v

    return {i: cache[i] for i in ids}

What's wrong?

class BatchFetcher:
    def __init__(self):
        self._cache: dict[str, Value] = {}
        self._lock = asyncio.Lock()

    async def fetch_batch(self, ids):
        async with self._lock:  # serialize the read-fetch-write critical section
            missing = [i for i in self._cache.keys() ^ set(ids) if i not in self._cache]
            if missing:
                results = await asyncio.gather(*(remote_fetch(i) for i in missing))
                self._cache.update(zip(missing, results))
            return {i: self._cache[i] for i in ids}

Scorecard¶

Count the bugs you identified before expanding each answer. Partial credit if you spotted the symptom but not the structural fix.

The pattern across all twelve: async correctness is mostly about what you await, what you bound, what you cancel, and what state you share — not about sprinkling keywords. A function that starts work without awaiting, bounding, cancelling, and isolating it is broken even when the happy path is green.

Related Topics¶

• junior.md — the junior-level definitions of these async and functional concepts.
• tasks.md — hands-on exercises that build the habits these bugs violate.
• Chapter README — the positive rules for Async & Functional code.
• Anti-Patterns — the failure modes (callback hell, unbounded queues, coloured-function violations) that produce bugs like these.
• Refactoring — the mechanical techniques for safely restructuring async code once you've found the defect.