fix(engine): allow JS resource cleanup after interrupting execution

.github/workflows/test.yml

@@ -134,9 +134,6 @@ jobs:
         if: runner.os == 'macOS'
         with:
           flutter-version: ${{ env.FLUTTER_VERSION }}
-      - name: Test Windows FFmpeg memory and stream lifecycle
-        if: runner.os == 'Windows'
-        run: go test -v -count=1 -timeout 180s ./pkg/download/engine/ffmpeg ./pkg/download/engine/inject/stream ./pkg/download/engine
       - name: Install Linux WebView dependencies
         if: runner.os == 'Linux'
         run: |

internal/fetcher/fetcher.go

@@ -46,10 +46,6 @@ type Uploader interface {
 	WaitUpload() error
 }
 
-type DownloadCounter interface {
-	ReceivedBytes() int64
-}
-
 // FetcherMeta defines the meta information of a fetcher.
 type FetcherMeta struct {
 	Req  *base.Request  `json:"req"`

internal/protocol/bt/download_test.go

@@ -290,82 +290,6 @@ func TestBTDownloadSelectedFiles(t *testing.T) {
 	if f.Meta().Res.Size != 48*1024 {
 		t.Fatal("selected resource size is incorrect")
 	}
-	if downloaded := f.Progress().TotalDownloaded(); downloaded != 48*1024 || f.ReceivedBytes() <= downloaded {
-		t.Fatalf("selected progress = %d, received traffic = %d; want 48 KiB of progress and traffic across the shared piece", downloaded, f.ReceivedBytes())
-	}
-}
-
-func TestBTProgressOnlyCountsVerifiedFileBytes(t *testing.T) {
-	const fileSize = 56 * 1024
-	fixture := makeBTFixtureWithPieceSize(t, map[string][]byte{
-		"a.bin": btPayload(fileSize, "verified-a"),
-		"b.bin": btPayload(fileSize, "verified-b"),
-	}, 16*1024, false, true, 64*1024)
-	f := btDownloadFetcher(t, nil)
-	btResolve(t, f, fixture.Magnet)
-	dir := t.TempDir()
-	f.Meta().Opts = &base.Options{Path: dir}
-	btStart(t, f)
-	deadline := time.Now().Add(8 * time.Second)
-	for f.torrent.Files()[0].BytesCompleted() == 0 && time.Now().Before(deadline) {
-		time.Sleep(10 * time.Millisecond)
-	}
-	btPause(t, f)
-	if f.torrent.Files()[0].BytesCompleted() == 0 || f.torrent.Piece(0).State().Complete {
-		t.Fatal("expected some received bytes in a piece that is still incomplete")
-	}
-	if f.ReceivedBytes() == 0 {
-		t.Fatal("received traffic must be visible before a piece is verified")
-	}
-	if progress := f.Progress(); len(progress) != 2 || progress[0] != 0 {
-		t.Errorf("progress before the first file's piece is verified = %v, want zero for the first file", progress)
-	}
-	fixture.Limiter.SetLimit(rate.Inf)
-	btStart(t, f)
-	btAwaitDone(t, f)
-	fixture.AssertFiles(t, dir)
-	progress := f.Progress()
-	if len(progress) != 2 || progress[0] != fileSize || progress[1] != fileSize {
-		t.Fatalf("verified progress at completion = %v, want %d for each file", progress, fileSize)
-	}
-}
-
-func TestBTUploadedBytesSamplesLiveTraffic(t *testing.T) {
-	payload := btPayload(48*1024, "upload-counter")
-	fixture := newBTFixture(t, map[string][]byte{"": payload}, 0)
-	const saved = 1024
-	f := &Fetcher{
-		torrent:       fixture.Torrent,
-		data:          &fetcherData{SeedBytes: saved},
-		seedBaseBytes: saved,
-	}
-	f.torrentReady.Store(true)
-	f.torrentUpload.Store(true)
-
-	cfg := torrent.TestingConfig(t)
-	cfg.DataDir = t.TempDir()
-	cfg.DisableTrackers = true
-	cfg.DisableUTP = true
-	cfg.DisableIPv6 = true
-	peer, err := torrent.NewClient(cfg)
-	if err != nil {
-		t.Fatal(err)
-	}
-	t.Cleanup(func() { peer.Close() })
-	download, _, err := peer.AddTorrentSpec(torrent.TorrentSpecFromMetaInfo(fixture.MetaInfo))
-	if err != nil {
-		t.Fatal(err)
-	}
-	download.AddPeers([]torrent.PeerInfo{{Addr: fixture.Seeder.ListenAddrs()[0]}})
-	download.DownloadAll()
-	select {
-	case <-download.Complete().On():
-	case <-time.After(10 * time.Second):
-		t.Fatal("loopback peer did not complete")
-	}
-	if got, want := f.UploadedBytes(), int64(saved+len(payload)); got != want {
-		t.Fatalf("uploaded bytes = %d, want %d including the saved bytes", got, want)
-	}
 }
 
 func TestBTPauseAndResume(t *testing.T) {

internal/protocol/bt/fetcher.go

@@ -10,7 +10,6 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
-	"sort"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -43,10 +42,9 @@ type Fetcher struct {
 	ctl    *controller.Controller
 	config *config
 
-	torrent       *torrent.Torrent
-	meta          *fetcher.FetcherMeta
-	data          *fetcherData
-	seedBaseBytes int64
+	torrent *torrent.Torrent
+	meta    *fetcher.FetcherMeta
+	data    *fetcherData
 
 	torrentReady    atomic.Bool
 	torrentUpload   atomic.Bool
@@ -465,46 +463,14 @@ func (f *Fetcher) Progress() fetcher.Progress {
 	if !f.torrentReady.Load() {
 		return append(fetcher.Progress(nil), f.data.Progress...)
 	}
-	pieceSize := f.torrent.Info().PieceLength
-	var offset int64
-	var verified []verifiedByteRange
-	for _, run := range f.torrent.PieceStateRuns() {
-		end := offset + int64(run.Length)*pieceSize
-		if pieceVerified(run.PieceState) {
-			verified = append(verified, verifiedByteRange{start: offset, end: end})
-		}
-		offset = end
-	}
-	files := f.torrent.Files()
 	for i := range f.data.Progress {
 		selectIndex := f.meta.Opts.SelectFiles[i]
-		file := files[selectIndex]
-		f.data.Progress[i] = verifiedFileBytes(verified, file.Offset(), file.Length())
+		file := f.torrent.Files()[selectIndex]
+		f.data.Progress[i] = file.BytesCompleted()
 	}
 	return append(fetcher.Progress(nil), f.data.Progress...)
 }
 
-type verifiedByteRange struct {
-	start, end int64
-}
-
-func verifiedFileBytes(verified []verifiedByteRange, offset, length int64) int64 {
-	first := sort.Search(len(verified), func(i int) bool { return verified[i].end > offset })
-	fileEnd := offset + length
-	var completed int64
-	for _, run := range verified[first:] {
-		if run.start >= fileEnd {
-			break
-		}
-		completed += min(fileEnd, run.end) - max(offset, run.start)
-	}
-	return completed
-}
-
-func pieceVerified(state torrent.PieceState) bool {
-	return state.Ok && state.Complete && !state.Hashing && !state.QueuedForHash
-}
-
 func (f *Fetcher) Wait() error {
 	f.mu.Lock()
 	var closed <-chan struct{}
@@ -621,7 +587,7 @@ func (f *Fetcher) isDoneLocked() bool {
 		file := f.torrent.Files()[index]
 		for i := file.BeginPieceIndex(); i < file.EndPieceIndex(); i++ {
 			state := f.torrent.Piece(i).State()
-			if !pieceVerified(state) {
+			if !state.Ok || !state.Complete || state.Hashing || state.QueuedForHash {
 				return false
 			}
 		}
@@ -719,13 +685,11 @@ func (f *Fetcher) Upload() (err error) {
 }
 
 func (f *Fetcher) doUpload(fromUpload bool) {
-	f.mu.Lock()
 	if !f.torrentUpload.CompareAndSwap(false, true) {
-		f.mu.Unlock()
 		return
 	}
-	f.seedBaseBytes = f.data.SeedBytes
-	initialTime := f.data.SeedTime
+	f.mu.Lock()
+	initialBytes, initialTime := f.data.SeedBytes, f.data.SeedTime
 	torrentClosed := f.torrent.Closed()
 	f.mu.Unlock()
 	var doneTime int64
@@ -743,7 +707,8 @@ func (f *Fetcher) doUpload(fromUpload bool) {
 				f.mu.Unlock()
 				continue
 			}
-			f.refreshSeedBytesLocked()
+			stats := f.torrentStats()
+			f.data.SeedBytes = initialBytes + stats.BytesWrittenData.Int64()
 			if !fromUpload && !f.isDoneLocked() {
 				f.mu.Unlock()
 				continue
@@ -776,27 +741,9 @@ func (f *Fetcher) torrentStats() torrent.TorrentStats {
 func (f *Fetcher) UploadedBytes() int64 {
 	f.mu.Lock()
 	defer f.mu.Unlock()
-	if f.torrentReady.Load() && f.torrentUpload.Load() {
-		f.refreshSeedBytesLocked()
-	}
 	return f.data.SeedBytes
 }
 
-func (f *Fetcher) refreshSeedBytesLocked() {
-	stats := f.torrentStats()
-	f.data.SeedBytes = max(f.data.SeedBytes, f.seedBaseBytes+stats.BytesWrittenData.Int64())
-}
-
-func (f *Fetcher) ReceivedBytes() int64 {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	if !f.torrentReady.Load() {
-		return 0
-	}
-	stats := f.torrentStats()
-	return stats.BytesReadUsefulData.Int64()
-}
-
 func (f *Fetcher) WaitUpload() (err error) {
 	<-f.uploadDoneCh
 	return nil

internal/protocol/bt/fixture_test.go

@@ -46,11 +46,6 @@ func newBTHybridFixture(t testing.TB, payload []byte) *btFixture {
 }
 
 func makeBTFixture(t testing.TB, files map[string][]byte, bytesPerSecond int, v2, private bool) *btFixture {
-	t.Helper()
-	return makeBTFixtureWithPieceSize(t, files, bytesPerSecond, v2, private, 16*1024)
-}
-
-func makeBTFixtureWithPieceSize(t testing.TB, files map[string][]byte, bytesPerSecond int, v2, private bool, pieceSize int64) *btFixture {
 	t.Helper()
 	source := t.TempDir()
 	name := "payload.bin"
@@ -69,7 +64,7 @@ func makeBTFixtureWithPieceSize(t testing.TB, files map[string][]byte, bytesPerS
 		}
 		expected[filepath.Join(name, filepath.FromSlash(path))] = append([]byte(nil), data...)
 	}
-	info := metainfo.Info{PieceLength: pieceSize}
+	info := metainfo.Info{PieceLength: 16 * 1024}
 	if err := info.BuildFromFilePath(root); err != nil {
 		t.Fatal(err)
 	}

pkg/download/crash_log_test.go

@@ -1,26 +0,0 @@
-package download
-
-import (
-	"os"
-	"path/filepath"
-	"runtime/debug"
-	"testing"
-)
-
-func TestLogPanicPreservesPreviousCrash(t *testing.T) {
-	dir := t.TempDir()
-	path := filepath.Join(dir, "crash.log")
-	const previous = "previous crash traceback\n"
-	if err := os.WriteFile(path, []byte(previous), 0600); err != nil {
-		t.Fatal(err)
-	}
-	logPanic(dir)
-	t.Cleanup(func() { _ = debug.SetCrashOutput(nil, debug.CrashOptions{}) })
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if string(data) != previous {
-		t.Fatalf("previous crash was overwritten: %q", data)
-	}
-}

pkg/download/downloader.go

@@ -345,12 +345,7 @@ func (d *Downloader) Setup() error {
 						}
 
 						current := task.fetcher.Progress().TotalDownloaded()
-						delta := max(0, current-task.Progress.Downloaded)
-						if counter, ok := task.fetcher.(fetcher.DownloadCounter); ok && task.Status == base.DownloadStatusRunning {
-							received := counter.ReceivedBytes()
-							delta = received - task.receivedBytes
-							task.receivedBytes = received
-						}
+						delta := current - task.Progress.Downloaded
 						if task.Meta != nil && task.Meta.Req != nil {
 							if producer := d.blob.Production(task.Meta.Req.URL); producer != nil {
 								downloaded, received := producer.Progress()
@@ -358,20 +353,19 @@ func (d *Downloader) Setup() error {
 									task.producer = producer
 									task.producerReceived = 0
 									task.speedArr = nil
-									task.downloadSampledAt = time.Time{}
 								}
 								current = downloaded
 								delta = max(0, received-task.producerReceived)
 								task.producerReceived = received
 							}
 						}
+						tick := float64(d.cfg.RefreshInterval) / 1000
 						downloadDataChanged := false
 						uploading := task.Uploading
 						if task.Status == base.DownloadStatusRunning {
 							downloadDataChanged = current != task.Progress.Downloaded
 							task.Progress.Used = task.timer.Used()
-							elapsed := sampleSeconds(&task.downloadSampledAt, time.Now())
-							task.Progress.Speed = task.updateSpeed(delta, elapsed)
+							task.Progress.Speed = task.updateSpeed(max(0, delta), tick)
 							task.Progress.Downloaded = current
 						}
 
@@ -380,8 +374,7 @@ func (d *Downloader) Setup() error {
 							uploader := task.fetcher.(fetcher.Uploader)
 							currentUploaded := uploader.UploadedBytes()
 							uploadDataChanged = currentUploaded != task.Progress.Uploaded
-							elapsed := sampleSeconds(&task.uploadSampledAt, time.Now())
-							task.Progress.UploadSpeed = task.updateUploadSpeed(currentUploaded-task.Progress.Uploaded, elapsed)
+							task.Progress.UploadSpeed = task.updateUploadSpeed(currentUploaded-task.Progress.Uploaded, tick)
 							task.Progress.Uploaded = currentUploaded
 						}
 						task.statusLock.Unlock()
@@ -2412,7 +2405,9 @@ func (d *Downloader) doStart(task *Task) (err error) {
 				return err
 			}
 		}
-		d.triggerOnStart(task)
+		if err := d.triggerOnStart(task); err != nil {
+			return err
+		}
 		if !d.taskIsRunningGeneration(task, generation) {
 			return nil
 		}
@@ -2460,8 +2455,6 @@ func (d *Downloader) doStart(task *Task) (err error) {
 			return nil
 		}
 		task.Progress.Speed = 0
-		task.speedArr = nil
-		task.downloadSampledAt = time.Time{}
 		task.timer.Start()
 		task.statusLock.Unlock()
 		if err := task.fetcher.Start(); err != nil {
@@ -2659,12 +2652,11 @@ func logPanic(logDir string) {
 	if err := util.CreateDirIfNotExist(logDir); err != nil {
 		return
 	}
-	f, err := os.OpenFile(filepath.Join(logDir, "crash.log"), os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
+	f, err := os.Create(filepath.Join(logDir, "crash.log"))
 	if err != nil {
 		return
 	}
-	defer f.Close() // SetCrashOutput duplicates the descriptor.
-	_ = debug.SetCrashOutput(f, debug.CrashOptions{})
+	debug.SetCrashOutput(f, debug.CrashOptions{})
 }
 
 func (d *Downloader) assignFetcherManager(task *Task) error {
@@ -3071,10 +3063,8 @@ func initTask(task *Task) {
 	task.lock = &sync.Mutex{}
 	task.statsLock = &sync.Mutex{}
 	task.blobRefLock = &sync.Mutex{}
-	task.speedArr = nil
-	task.uploadSpeedArr = nil
-	task.downloadSampledAt = time.Time{}
-	task.uploadSampledAt = time.Time{}
+	task.speedArr = make([]int64, 0)
+	task.uploadSpeedArr = make([]int64, 0)
 }
 
 func (d *Downloader) releaseBlobTask(task *Task) {

pkg/download/engine/cancellation_test.go

@@ -0,0 +1,47 @@
+package engine
+
+import (
+	"context"
+	"errors"
+	"github.com/dop251/goja"
+	"testing"
+	"time"
+)
+
+func TestCloseUnblocksPendingPromise(t *testing.T) {
+	e := NewEngine(nil)
+	entered := make(chan struct{})
+	_, err := e.runOnLoop(func(r *goja.Runtime) (goja.Value, error) {
+		return goja.Undefined(), r.Set("entered", func() { close(entered) })
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	done := make(chan error, 1)
+	go func() { _, err := e.RunString(`entered(); new Promise(()=>{});`); done <- err }()
+	select {
+	case <-entered:
+	case <-time.After(time.Second):
+		t.Fatal("script did not enter")
+	}
+	e.Close()
+	select {
+	case err := <-done:
+		if err == nil {
+			t.Fatal("closed execution returned success")
+		}
+	case <-time.After(300 * time.Millisecond):
+		t.Fatal("Engine.Close left the Promise waiter blocked")
+	}
+}
+
+func TestExecutionDeadlineInterruptsSynchronousScript(t *testing.T) {
+	e := NewEngine(nil)
+	defer e.Close()
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Millisecond)
+	defer cancel()
+	_, err := e.RunStringContext(ctx, `while (true) {}`)
+	if !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("got %v, want deadline exceeded", err)
+	}
+}

pkg/download/engine/engine.go

@@ -1,6 +1,7 @@
 package engine
 
 import (
+	"context"
 	_ "embed"
 	"errors"
 	"fmt"
@@ -26,6 +27,7 @@ var polyfillScript string
 
 type Engine struct {
 	loop *eventloop.EventLoop
+	done chan struct{}
 
 	closeOnce sync.Once
 	cleanupMu sync.Mutex
@@ -39,7 +41,13 @@ type JSFunction func(goja.FunctionCall) goja.Value
 // RunString executes the script and returns the go type value
 // if script result is promise, it will be resolved
 func (e *Engine) RunString(script string) (value any, err error) {
-	return e.runOnLoop(func(runtime *goja.Runtime) (goja.Value, error) {
+	return e.RunStringContext(context.Background(), script)
+}
+
+// RunStringContext bounds an execution, including awaited promises. Cancelling
+// an execution closes its engine so outstanding operations cannot outlive it.
+func (e *Engine) RunStringContext(ctx context.Context, script string) (any, error) {
+	return e.runOnLoopContext(ctx, func(runtime *goja.Runtime) (goja.Value, error) {
 		return runtime.RunString(script)
 	})
 }
@@ -47,7 +55,11 @@ func (e *Engine) RunString(script string) (value any, err error) {
 // CallFunction calls the function and returns the go type value
 // if function result is promise, it will be resolved
 func (e *Engine) CallFunction(fn any, args ...any) (value any, err error) {
-	return e.runOnLoop(func(runtime *goja.Runtime) (goja.Value, error) {
+	return e.CallFunctionContext(context.Background(), fn, args...)
+}
+
+func (e *Engine) CallFunctionContext(ctx context.Context, fn any, args ...any) (value any, err error) {
+	return e.runOnLoopContext(ctx, func(runtime *goja.Runtime) (goja.Value, error) {
 		var jsArgs []goja.Value
 		for _, arg := range args {
 			jsArgs = append(jsArgs, runtime.ToValue(arg))
@@ -69,6 +81,20 @@ func (e *Engine) CallFunction(fn any, args ...any) (value any, err error) {
 }
 
 func (e *Engine) runOnLoop(fn func(runtime *goja.Runtime) (goja.Value, error)) (any, error) {
+	return e.runOnLoopContext(context.Background(), fn)
+}
+
+var ErrClosed = errors.New("engine closed")
+
+func (e *Engine) runOnLoopContext(ctx context.Context, fn func(runtime *goja.Runtime) (goja.Value, error)) (any, error) {
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	select {
+	case <-e.done:
+		return nil, ErrClosed
+	default:
+	}
 	type result struct {
 		value any
 		err   error
@@ -132,15 +158,31 @@ func (e *Engine) runOnLoop(fn func(runtime *goja.Runtime) (goja.Value, error)) (
 	if !ok {
 		return nil, errors.New("engine loop terminated")
 	}
-	res := <-ch
-	if res.err != nil {
-		return nil, res.err
+	select {
+	case res := <-ch:
+		return res.value, res.err
+	case <-ctx.Done():
+		// Interrupt synchronous JS too; a select alone only stops Promise waiting.
+		e.Close()
+		return nil, ctx.Err()
+	case <-e.done:
+		return nil, ErrClosed
 	}
-	return res.value, nil
 }
 
 func (e *Engine) Close() {
 	e.closeOnce.Do(func() {
+		close(e.done)
+		e.Runtime.Interrupt(ErrClosed)
+		// Wait for interrupted JS to leave the loop, then allow cleanup hooks
+		// to execute their JS cancellation callbacks before terminating it.
+		cleared := make(chan struct{})
+		if e.loop.RunOnLoop(func(runtime *goja.Runtime) {
+			runtime.ClearInterrupt()
+			close(cleared)
+		}) {
+			<-cleared
+		}
 		e.cleanupMu.Lock()
 		cleanups := e.cleanups
 		e.cleanups = nil
@@ -177,6 +219,7 @@ func NewEngine(cfg *Config) *Engine {
 	loop := eventloop.NewEventLoop()
 	engine := &Engine{
 		loop: loop,
+		done: make(chan struct{}),
 	}
 	loop.Start()
 	done := make(chan struct{})

pkg/download/engine/ffmpeg/README.md

@@ -174,12 +174,3 @@ compilation memory, host buffers and JS allocations are additional to the
 linear-memory limit. Playback support depends on the selected codecs, not just
 the `.mp4` suffix. Platform execution and performance must be tested on target
 devices, especially mobile/32-bit devices.
-
-On 64-bit Windows, instance linear memory uses a reserved virtual address range with
-pages committed as it grows. Module completion, errors and cancellation release
-this range directly through `VirtualFree`, rather than waiting for Go's garbage
-collector to reclaim large buffers. Growing an instance preserves its address
-without copying the previous buffer. The 512 MiB limit is unchanged; reservation
-does not commit that entire amount. Shared compilation remains resident after
-the first merge, so process memory is not expected to return exactly to the
-pre-FFmpeg baseline. This does not diagnose unrelated idle memory growth.

pkg/download/engine/ffmpeg/memory.go

@@ -1,32 +0,0 @@
-package ffmpeg
-
-import (
-	"context"
-	"sync"
-
-	"github.com/tetratelabs/wazero/experimental"
-)
-
-// The runtime does not always invoke Free when a module's start function traps.
-// Keep host ownership until execution returns, including failed instantiation.
-func withOwnedMemory(ctx context.Context, allocator experimental.MemoryAllocator) (context.Context, func()) {
-	var memories []*ownedLinearMemory
-	ctx = experimental.WithMemoryAllocator(ctx, experimental.MemoryAllocatorFunc(
-		func(cap, max uint64) experimental.LinearMemory {
-			memory := &ownedLinearMemory{LinearMemory: allocator.Allocate(cap, max)}
-			memories = append(memories, memory)
-			return memory
-		}))
-	return ctx, func() {
-		for _, memory := range memories {
-			memory.Free()
-		}
-	}
-}
-
-type ownedLinearMemory struct {
-	experimental.LinearMemory
-	once sync.Once
-}
-
-func (m *ownedLinearMemory) Free() { m.once.Do(m.LinearMemory.Free) }

pkg/download/engine/ffmpeg/memory_other.go

@@ -1,7 +0,0 @@
-//go:build !windows || (!amd64 && !arm64)
-
-package ffmpeg
-
-import "context"
-
-func withLinearMemory(ctx context.Context) (context.Context, func()) { return ctx, func() {} }

pkg/download/engine/ffmpeg/memory_test.go

@@ -1,88 +0,0 @@
-package ffmpeg
-
-import (
-	"context"
-	"encoding/hex"
-	"testing"
-	"time"
-
-	"github.com/tetratelabs/wazero"
-	"github.com/tetratelabs/wazero/experimental"
-)
-
-// Verify the pinned runtime's allocator lifecycle on every development host:
-// host-owned buffers must not be released before execution ends, or retained
-// after failed instantiation, traps or cancellation.
-func TestLinearMemoryModuleLifecycle(t *testing.T) {
-	testLinearMemoryModuleLifecycle(t, func(_, _ uint64) experimental.LinearMemory {
-		return &testLinearMemory{}
-	})
-}
-
-type testLinearMemory struct{ buffer []byte }
-
-func (m *testLinearMemory) Reallocate(size uint64) []byte {
-	m.buffer = append(m.buffer, make([]byte, int(size)-len(m.buffer))...)
-	return m.buffer
-}
-func (m *testLinearMemory) Free() { m.buffer = nil }
-
-type trackedLinearMemory struct {
-	experimental.LinearMemory
-	freeCount int
-}
-
-func (m *trackedLinearMemory) Free() {
-	m.freeCount++
-	m.LinearMemory.Free()
-}
-
-func testLinearMemoryModuleLifecycle(t *testing.T, allocate experimental.MemoryAllocatorFunc) {
-	t.Helper()
-	for _, tt := range []struct {
-		name string
-		// A module with one memory (min=1/max=2 pages), optionally a start
-		// function that traps or loops until its context is cancelled.
-		wasm    string
-		wantErr bool
-	}{
-		{"close", "0061736d01000000050401010102", false},
-		{"trap", "0061736d01000000010401600000030201000504010101020801000a05010300000b", true},
-		{"cancel", "0061736d01000000010401600000030201000504010101020801000a0901070003400c000b0b", true},
-	} {
-		t.Run(tt.name, func(t *testing.T) {
-			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
-			defer cancel()
-			var memory *trackedLinearMemory
-			ctx, release := withOwnedMemory(ctx, experimental.MemoryAllocatorFunc(
-				func(_, max uint64) experimental.LinearMemory {
-					memory = &trackedLinearMemory{LinearMemory: allocate(0, max)}
-					return memory
-				}))
-			defer release()
-			rt := wazero.NewRuntimeWithConfig(ctx, wazero.NewRuntimeConfig().WithCloseOnContextDone(true))
-			defer rt.Close(context.Background())
-			binary, err := hex.DecodeString(tt.wasm)
-			if err != nil {
-				t.Fatal(err)
-			}
-			module, err := rt.Instantiate(ctx, binary)
-			if (err != nil) != tt.wantErr {
-				t.Fatalf("instantiate: %v", err)
-			}
-			if !tt.wantErr {
-				if memory == nil || memory.freeCount != 0 {
-					t.Fatal("module did not allocate native memory")
-				}
-				if err := module.Close(ctx); err != nil {
-					t.Fatal(err)
-				}
-			}
-			release()
-			release()
-			if memory == nil || memory.freeCount != 1 {
-				t.Fatal("host did not release memory exactly once")
-			}
-		})
-	}
-}

pkg/download/engine/ffmpeg/memory_windows.go

@@ -1,70 +0,0 @@
-//go:build windows && (amd64 || arm64)
-
-package ffmpeg
-
-import (
-	"context"
-	"fmt"
-	"unsafe"
-
-	"github.com/tetratelabs/wazero/experimental"
-	"golang.org/x/sys/windows"
-)
-
-// Keep large, short-lived WASM buffers out of the Go heap. Closing a module
-// releases its committed pages immediately, without waiting for GC/scavenging.
-func withLinearMemory(ctx context.Context) (context.Context, func()) {
-	return withOwnedMemory(ctx, experimental.MemoryAllocatorFunc(
-		func(_, max uint64) experimental.LinearMemory {
-			return &windowsLinearMemory{max: max}
-		}))
-}
-
-// Reserve the address range once, committing zero-filled pages on demand. This
-// avoids both copying the previous buffer and temporarily retaining two large
-// Go allocations when memory.grow runs. The backing address never changes.
-type windowsLinearMemory struct {
-	address uintptr
-	max     uint64
-	size    uint64
-	freed   bool
-}
-
-func (m *windowsLinearMemory) Reallocate(size uint64) []byte {
-	if m.freed || size > m.max || m.max > uint64(^uint(0)>>1) {
-		return nil
-	}
-	if size == 0 {
-		return []byte{}
-	}
-	if m.address == 0 {
-		address, err := windows.VirtualAlloc(0, uintptr(m.max), windows.MEM_RESERVE, windows.PAGE_READWRITE)
-		if err != nil {
-			panic(fmt.Errorf("ffmpeg: reserve WASM memory: %w", err))
-		}
-		m.address = address
-	}
-	if size > m.size {
-		_, err := windows.VirtualAlloc(m.address, uintptr(size), windows.MEM_COMMIT, windows.PAGE_READWRITE)
-		if err != nil {
-			if m.size == 0 {
-				// Instantiation cannot proceed without the minimum memory. Wazero
-				// has not taken ownership yet, so release the reservation here.
-				m.Free()
-				panic(fmt.Errorf("ffmpeg: commit WASM memory: %w", err))
-			}
-			return nil // memory.grow reports failure to the guest.
-		}
-		m.size = size
-	}
-	return unsafe.Slice((*byte)(unsafe.Pointer(m.address)), int(size))
-}
-
-func (m *windowsLinearMemory) Free() {
-	if m.address != 0 {
-		_ = windows.VirtualFree(m.address, 0, windows.MEM_RELEASE)
-		m.address = 0
-	}
-	m.size = 0
-	m.freed = true
-}

pkg/download/engine/ffmpeg/memory_windows_test.go

@@ -1,54 +0,0 @@
-//go:build windows && (amd64 || arm64)
-
-package ffmpeg
-
-import (
-	"testing"
-	"unsafe"
-
-	"github.com/tetratelabs/wazero/experimental"
-	"golang.org/x/sys/windows"
-)
-
-func TestWindowsLinearMemoryGrowthAndRelease(t *testing.T) {
-	const page = 65536
-	m := &windowsLinearMemory{max: 4 * page}
-	defer m.Free()
-	first := m.Reallocate(page)
-	if len(first) != page {
-		t.Fatalf("initial allocation: %d", len(first))
-	}
-	first[0], first[page-1] = 17, 29
-	address := m.address
-	grown := m.Reallocate(3 * page)
-	if unsafe.SliceData(first) != unsafe.SliceData(grown) || grown[0] != 17 || grown[page-1] != 29 {
-		t.Fatal("growing memory moved or lost existing bytes")
-	}
-	for _, b := range grown[page:] {
-		if b != 0 {
-			t.Fatal("newly committed memory is not zero-filled")
-		}
-	}
-	if m.Reallocate(5*page) != nil || m.address != address || m.size != 3*page {
-		t.Fatal("failed growth changed the existing allocation")
-	}
-	m.Free()
-	m.Free()
-	if m.address != 0 || m.Reallocate(page) != nil {
-		t.Fatal("freed memory can still be used")
-	}
-	var info windows.MemoryBasicInformation
-	if err := windows.VirtualQuery(address, &info, unsafe.Sizeof(info)); err != nil {
-		t.Fatal(err)
-	}
-	const memFree = 0x10000 // MEMORY_BASIC_INFORMATION.State: MEM_FREE.
-	if info.State != memFree {
-		t.Fatalf("pages remain reserved after Free: state=%x", info.State)
-	}
-}
-
-func TestWindowsLinearMemoryModuleLifecycle(t *testing.T) {
-	testLinearMemoryModuleLifecycle(t, func(_, max uint64) experimental.LinearMemory {
-		return &windowsLinearMemory{max: max}
-	})
-}

pkg/download/engine/ffmpeg/runtime.go

@@ -151,9 +151,7 @@ func RunAcquired(ctx context.Context, video, audio Input, out io.Writer, format
 	files := &inputFS{files: map[string]Input{"video": video, "audio": audio}}
 	fsconfig := wazero.NewFSConfig().(sysfs.FSConfig).WithSysFSMount(files, "/inputs")
 	logs := &tailLog{}
-	runCtx, freeMemory := withLinearMemory(ctx)
-	defer freeMemory()
-	rc, err := wasm.Run(runCtx, shared.runtime, shared.module, wasm.Args{
+	rc, err := wasm.Run(ctx, shared.runtime, shared.module, wasm.Args{
 		Name: "ffmpeg", Args: args, Stdout: out, Stderr: logs,
 		Config: func(c wazero.ModuleConfig) wazero.ModuleConfig { return c.WithFSConfig(fsconfig) },
 	})

pkg/download/extension.go

@@ -3,6 +3,7 @@ package download
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/url"
@@ -327,8 +328,8 @@ func (d *Downloader) triggerOnResolve(req *base.Request) (res *base.Resource, er
 	return
 }
 
-func (d *Downloader) triggerOnStart(task *Task) {
-	doTrigger(d,
+func (d *Downloader) triggerOnStart(task *Task) error {
+	return doTrigger(d,
 		EventOnStart,
 		task.Meta.Req,
 		&OnStartContext{
@@ -413,6 +414,13 @@ func doTrigger[T any](d *Downloader, event ActivationEvent, req *base.Request, c
 					}
 					engine, session := d.newExtensionEngine()
 					defer session.CloseIfIdle()
+					eventCtx, cancelEvent := context.WithTimeout(d.backgroundCtx, d.cfg.ExtensionEventTimeout)
+					defer cancelEvent()
+					defer func() {
+						if eventCtx.Err() != nil {
+							session.Close()
+						}
+					}()
 					gopeed.Runtime = &InstanceRuntime{
 						WebView: d.newExtensionWebViewRuntime(session, ext.buildIdentity()),
 					}
@@ -421,13 +429,13 @@ func doTrigger[T any](d *Downloader, event ActivationEvent, req *base.Request, c
 						gopeed.Logger.logger.Error().Err(err).Msgf("[%s] engine inject failed", ext.buildIdentity())
 						return
 					}
-					_, err = engine.RunString(string(scriptBuf))
+					_, err = engine.RunStringContext(eventCtx, string(scriptBuf))
 					if err != nil {
 						gopeed.Logger.logger.Error().Err(err).Msgf("[%s] run script failed", ext.buildIdentity())
 						return
 					}
 					if fn, ok := gopeed.Events[event]; ok {
-						_, err = engine.CallFunction(fn, ctx)
+						_, err = engine.CallFunctionContext(eventCtx, fn, ctx)
 						if err != nil {
 							gopeed.Logger.logger.Error().Err(err).Msgf("[%s] call function failed: %s", ext.buildIdentity(), event)
 							return
@@ -437,6 +445,9 @@ func doTrigger[T any](d *Downloader, event ActivationEvent, req *base.Request, c
 						}
 					}
 				}()
+				if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+					return err
+				}
 			}
 		}
 	}

pkg/download/extension_cancellation_test.go

@@ -0,0 +1,149 @@
+package download
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/GopeedLab/gopeed/internal/fetcher"
+	"github.com/GopeedLab/gopeed/pkg/base"
+)
+
+func installCancellationExtension(t *testing.T, d *Downloader, event, script string) {
+	t.Helper()
+	dir := t.TempDir()
+	manifest := fmt.Sprintf(`{"name":"cancel-%s","author":"test","title":"Cancel","version":"1.0.0","scripts":[{"event":%q,"match":{"urls":["*://example.com/*"]},"entry":"index.js"}]}`, event, event)
+	for name, body := range map[string]string{"manifest.json": manifest, "index.js": script} {
+		if err := os.WriteFile(filepath.Join(dir, name), []byte(body), 0600); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, err := d.InstallExtensionByFolder(dir, true); err != nil {
+		t.Fatal(err)
+	}
+}
+func newCancellationDownloader(t *testing.T) *Downloader {
+	t.Helper()
+	d := NewDownloader(&DownloaderConfig{Storage: NewMemStorage(), StorageDir: t.TempDir(), TempDir: t.TempDir(), FetchManagers: []fetcher.FetcherManager{&generationTestManager{holdOpen: true}}})
+	if err := d.Setup(); err != nil {
+		t.Fatal(err)
+	}
+	return d
+}
+func TestResolveExtensionStopsOnShutdown(t *testing.T) {
+	entered, release := make(chan struct{}), make(chan struct{})
+	var once sync.Once
+	defer once.Do(func() { close(release) })
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		close(entered)
+		select {
+		case <-release:
+		case <-r.Context().Done():
+		}
+		w.Write([]byte("ok"))
+	}))
+	defer server.Close()
+	d := newCancellationDownloader(t)
+	defer d.Close()
+	installCancellationExtension(t, d, "onResolve", fmt.Sprintf(`gopeed.events.onResolve(async ctx=>{await fetch(%q);});`, server.URL))
+	done := make(chan error, 1)
+	go func() { _, err := d.Resolve(&base.Request{URL: "https://example.com/cancel"}); done <- err }()
+	select {
+	case <-entered:
+	case <-time.After(2 * time.Second):
+		t.Fatal("handler did not enter")
+	}
+	if err := d.Close(); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case err := <-done:
+		if !errors.Is(err, context.Canceled) {
+			t.Errorf("got %v, want cancellation", err)
+		}
+	case <-time.After(300 * time.Millisecond):
+		once.Do(func() { close(release) })
+		t.Fatal("shutdown did not cancel extension Resolve")
+	}
+}
+func TestOnErrorCancellationReleasesTaskAPIs(t *testing.T) {
+	entered, release := make(chan struct{}), make(chan struct{})
+	var once sync.Once
+	defer once.Do(func() { close(release) })
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		close(entered)
+		select {
+		case <-release:
+		case <-r.Context().Done():
+		}
+		w.Write([]byte("ok"))
+	}))
+	defer server.Close()
+	d := newCancellationDownloader(t)
+	defer d.Close()
+	parent, cancel := context.WithCancel(d.backgroundCtx)
+	d.backgroundCtx = parent
+	defer cancel()
+	installCancellationExtension(t, d, "onError", fmt.Sprintf(`gopeed.events.onError(async ctx=>{await fetch(%q);});`, server.URL))
+	d.cfg.MaxRunning = 0
+	id, err := d.CreateDirect(&base.Request{URL: "generation://example.com/task"}, &base.Options{Path: t.TempDir()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	task := d.GetTask(id)
+	task.statusLock.Lock()
+	task.Status = base.DownloadStatusRunning
+	task.statusLock.Unlock()
+	handled := make(chan struct{})
+	go func() { d.doOnError(task, errors.New("source failed")); close(handled) }()
+	select {
+	case <-entered:
+	case <-time.After(2 * time.Second):
+		t.Fatal("onError did not enter")
+	}
+	status, stats := make(chan struct{}), make(chan struct{})
+	go func() { d.RuntimeStatus(id); close(status) }()
+	go func() { d.Stats(id); close(stats) }()
+	cancel()
+	for name, ch := range map[string]<-chan struct{}{"onError": handled, "RuntimeStatus": status, "Stats": stats} {
+		select {
+		case <-ch:
+		case <-time.After(300 * time.Millisecond):
+			once.Do(func() { close(release) })
+			<-handled
+			t.Fatalf("%s stayed blocked after cancellation", name)
+		}
+	}
+}
+
+func TestExtensionEventDeadlineRejectsUnsettledResolve(t *testing.T) {
+	d := newCancellationDownloader(t)
+	defer d.Close()
+	d.cfg.ExtensionEventTimeout = 30 * time.Millisecond
+	installCancellationExtension(t, d, "onResolve", `gopeed.events.onResolve(async ctx=>{await new Promise(()=>{});});`)
+	_, err := d.Resolve(&base.Request{URL: "https://example.com/timeout"})
+	if !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("got %v, want event deadline exceeded", err)
+	}
+}
+func TestExtensionStartDeadlinePreventsFetcherStart(t *testing.T) {
+	d := newCancellationDownloader(t)
+	defer d.Close()
+	d.cfg.ExtensionEventTimeout = 30 * time.Millisecond
+	installCancellationExtension(t, d, "onStart", `gopeed.events.onStart(async ctx=>{await new Promise(()=>{});});`)
+	id, err := d.CreateDirect(&base.Request{URL: "generation://example.com/timeout"}, &base.Options{Path: t.TempDir()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	waitForTaskStatus(t, d, id, base.DownloadStatusError, 2*time.Second)
+	if starts := d.cfg.FetchManagers[0].(*generationTestManager).starts.Load(); starts != 0 {
+		t.Fatalf("timed out onStart still started fetcher %d times", starts)
+	}
+}

pkg/download/extension_engine_session.go

@@ -59,6 +59,21 @@ func (s *engineSession) Release() {
 	}
 }
 
+// Close releases retained resources when the owning event is cancelled.
+func (s *engineSession) Close() {
+	s.mu.Lock()
+	if s.closed {
+		s.mu.Unlock()
+		return
+	}
+	s.closed = true
+	s.mu.Unlock()
+	s.runClosers()
+	if s.engine != nil {
+		s.engine.Close()
+	}
+}
+
 func (s *engineSession) CloseIfIdle() {
 	s.mu.Lock()
 	shouldClose := s.refs == 0 && !s.closed

pkg/download/model.go

@@ -75,23 +75,20 @@ type Task struct {
 	producer         production.Source
 	producerReceived int64
 
-	fetcherManager    fetcher.FetcherManager
-	fetcher           fetcher.Fetcher
-	timer             *util.Timer
-	statusLock        *sync.Mutex
-	lock              *sync.Mutex
-	statsLock         *sync.Mutex
-	statsLoaded       bool
-	stats             *fetcher.Stats
-	statsSnapshot     json.RawMessage
-	blobRefLock       *sync.Mutex
-	blobURL           string
-	runGeneration     uint64
-	speedArr          []speedSample
-	uploadSpeedArr    []speedSample
-	downloadSampledAt time.Time
-	uploadSampledAt   time.Time
-	receivedBytes     int64
+	fetcherManager fetcher.FetcherManager
+	fetcher        fetcher.Fetcher
+	timer          *util.Timer
+	statusLock     *sync.Mutex
+	lock           *sync.Mutex
+	statsLock      *sync.Mutex
+	statsLoaded    bool
+	stats          *fetcher.Stats
+	statsSnapshot  json.RawMessage
+	blobRefLock    *sync.Mutex
+	blobURL        string
+	runGeneration  uint64
+	speedArr       []int64
+	uploadSpeedArr []int64
 }
 
 // TaskRuntimeStatus is the lightweight, frequently refreshed view of a task.
@@ -198,21 +195,7 @@ func (t *Task) updateUploadSpeed(downloaded int64, usedTime float64) int64 {
 	return calcSpeed(&t.uploadSpeedArr, downloaded, usedTime)
 }
 
-type speedSample struct {
-	bytes   int64
-	seconds float64
-}
-
-func sampleSeconds(lastSample *time.Time, now time.Time) float64 {
-	previous := *lastSample
-	*lastSample = now
-	if previous.IsZero() {
-		return 0
-	}
-	return now.Sub(previous).Seconds()
-}
-
-func calcSpeed(speedArr *[]speedSample, downloaded int64, usedTime float64) int64 {
+func calcSpeed(speedArr *[]int64, downloaded int64, usedTime float64) int64 {
 	if usedTime <= 0 {
 		return 0
 	}
@@ -221,18 +204,18 @@ func calcSpeed(speedArr *[]speedSample, downloaded int64, usedTime float64) int6
 		return 0
 	}
 
-	*speedArr = append(*speedArr, speedSample{bytes: downloaded, seconds: usedTime})
-	var total int64
-	var elapsed float64
-	first := len(*speedArr)
-	for first > 0 && elapsed < 5 {
-		first--
-		sample := (*speedArr)[first]
-		total += sample.bytes
-		elapsed += sample.seconds
+	*speedArr = append(*speedArr, downloaded)
+	// Record last 5 seconds of download speed to calculate the average speed
+	if len(*speedArr) > int(5.0/usedTime) {
+		*speedArr = (*speedArr)[1:]
 	}
-	*speedArr = (*speedArr)[first:]
-	return int64(float64(total) / elapsed)
+
+	var total int64
+	for _, v := range *speedArr {
+		total += v
+	}
+
+	return int64(float64(total) / float64(len(*speedArr)) / usedTime)
 }
 
 type TaskFilter struct {
@@ -249,12 +232,15 @@ type DownloaderConfig struct {
 	Controller    *controller.Controller
 	FetchManagers []fetcher.FetcherManager
 
-	RefreshInterval   int // RefreshInterval time duration to refresh task progress(ms)
-	Storage           Storage
-	StorageDir        string
-	TempDir           string
-	WhiteDownloadDirs []string
-	WebViewProvider   enginewebview.Provider
+	// ExtensionEventTimeout bounds one script load and its awaited event handler.
+	// Zero uses one minute. Embedders may increase it for long-running handlers.
+	ExtensionEventTimeout time.Duration
+	RefreshInterval       int // RefreshInterval time duration to refresh task progress(ms)
+	Storage               Storage
+	StorageDir            string
+	TempDir               string
+	WhiteDownloadDirs     []string
+	WebViewProvider       enginewebview.Provider
 
 	ProductionMode bool
 
@@ -277,6 +263,9 @@ func (cfg *DownloaderConfig) Init() *DownloaderConfig {
 			new(ed2k.FetcherManager),
 		}
 	}
+	if cfg.ExtensionEventTimeout <= 0 {
+		cfg.ExtensionEventTimeout = time.Minute
+	}
 	if cfg.RefreshInterval == 0 {
 		cfg.RefreshInterval = 350
 	}

pkg/download/model_test.go

@@ -1,32 +1,9 @@
 package download
 
-import (
-	"testing"
-	"time"
-)
-
-func TestTransferSpeedWithUnevenSamples(t *testing.T) {
-	var task Task
-	for _, sample := range []struct {
-		bytes   int64
-		seconds float64
-	}{
-		{1000, 1},
-		{2000, 2},
-		{4000, 4},
-		{6000, 6},
-	} {
-		if got := task.updateSpeed(sample.bytes, sample.seconds); got != 1000 {
-			t.Errorf("download speed after %v seconds = %d, want 1000", sample.seconds, got)
-		}
-		if got := task.updateUploadSpeed(sample.bytes, sample.seconds); got != 1000 {
-			t.Errorf("upload speed after %v seconds = %d, want 1000", sample.seconds, got)
-		}
-	}
-}
+import "testing"
 
 func TestCalcSpeedResetOnRollback(t *testing.T) {
-	speedArr := []speedSample{{1024, 1}, {2048, 1}, {4096, 1}}
+	speedArr := []int64{1024, 2048, 4096}
 
 	if got := calcSpeed(&speedArr, -512, 1); got != 0 {
 		t.Fatalf("calcSpeed() = %d, want 0 after rollback", got)
@@ -39,17 +16,3 @@ func TestCalcSpeedResetOnRollback(t *testing.T) {
 		t.Fatalf("calcSpeed() = %d, want 1024 after reset", got)
 	}
 }
-
-func TestSampleSecondsUsesThePreviousSuccessfulSample(t *testing.T) {
-	start := time.Now()
-	var last time.Time
-	if got := sampleSeconds(&last, start); got != 0 {
-		t.Fatalf("first sample elapsed = %v, want 0", got)
-	}
-	if got := sampleSeconds(&last, start.Add(1500*time.Millisecond)); got != 1.5 {
-		t.Fatalf("elapsed after a delayed sample = %v, want 1.5", got)
-	}
-	if got := sampleSeconds(&last, start.Add(2*time.Second)); got != 0.5 {
-		t.Fatalf("elapsed after the next sample = %v, want 0.5", got)
-	}
-}

ui/flutter/lib/app/application/app_runtime_controller.dart

@@ -53,7 +53,6 @@ class AppRuntimeState {
 class AppRuntimeController extends AsyncNotifier<AppRuntimeState> {
   static StartConfig? _defaultStartConfig;
   Future<void> _preferenceWrites = Future<void>.value();
-  bool _analyticsStarted = false;
 
   @override
   Future<AppRuntimeState> build() async {
@@ -74,7 +73,6 @@ class AppRuntimeController extends AsyncNotifier<AppRuntimeState> {
       startConfig
         ..apiEnable = true
         ..mcpEnable = config.api.mcpEnable;
-      await _initAnalytics(config);
     } else {
       startConfig
         ..apiEnable = config.api.enable
@@ -255,8 +253,7 @@ class AppRuntimeController extends AsyncNotifier<AppRuntimeState> {
   }
 
   Future<void> _initAnalytics(DownloaderConfig config) async {
-    if (_analyticsStarted || !AnalyticsConfig.isConfigured || !config.extra.analyticsEnabled) return;
-    _analyticsStarted = true;
+    if (!AnalyticsConfig.isConfigured || !config.extra.analyticsEnabled) return;
     try {
       final generatedClientId = await Analytics.instance.init(fallbackClientId: config.extra.deviceId);
       if (generatedClientId != null) {
@@ -265,7 +262,6 @@ class AppRuntimeController extends AsyncNotifier<AppRuntimeState> {
       }
       unawaited(Analytics.instance.logAppOpen());
     } catch (error, stackTrace) {
-      _analyticsStarted = false;
       logger.w('GA4 init failed', error, stackTrace);
     }
   }

ui/flutter/lib/app/application/downloader_config_init.dart

@@ -19,7 +19,7 @@ Future<DownloaderConfig> loadDownloaderConfig({
     config = await load();
   } catch (error, stackTrace) {
     onLoadError?.call(error, stackTrace);
-    config = DownloaderConfig()..extra.analyticsEnabled = false;
+    config = DownloaderConfig();
     loaded = false;
   }
   final changed = await initDownloaderConfig(config, defaultDownloadDir: defaultDownloadDir);

ui/flutter/test/app/application/downloader_config_init_test.dart

@@ -32,22 +32,8 @@ void main() {
       // The in-memory fallback still gets usable defaults.
       expect(config.downloadDir, '/downloads');
       expect(config.categories, hasLength(4));
-      expect(config.extra.analyticsEnabled, isFalse);
     });
 
-    for (final analyticsEnabled in [false, true]) {
-      test('preserves the saved analytics preference ($analyticsEnabled)', () async {
-        final stored = configWith()..extra.analyticsEnabled = analyticsEnabled;
-        final config = await loadDownloaderConfig(
-          load: () async => stored,
-          save: (_) async {},
-          defaultDownloadDir: () async => '/downloads',
-        );
-
-        expect(config.extra.analyticsEnabled, analyticsEnabled);
-      });
-    }
-
     test('skips persist when init changed nothing', () async {
       var saved = 0;
       await loadDownloaderConfig(

ui/flutter/windows/runner/CMakeLists.txt

@@ -7,7 +7,6 @@ project(runner LANGUAGES CXX)
 #
 # Any new source files that you add to the application should be added here.
 add_executable(${BINARY_NAME} WIN32
-  "crash_handler.cpp"
   "flutter_window.cpp"
   "main.cpp"
   "utils.cpp"
@@ -35,7 +34,6 @@ target_compile_definitions(${BINARY_NAME} PRIVATE "NOMINMAX")
 # dependencies here.
 target_link_libraries(${BINARY_NAME} PRIVATE flutter flutter_wrapper_app)
 target_link_libraries(${BINARY_NAME} PRIVATE "dwmapi.lib")
-target_link_libraries(${BINARY_NAME} PRIVATE "dbghelp.lib")
 target_include_directories(${BINARY_NAME} PRIVATE "${CMAKE_SOURCE_DIR}")
 
 # Run the Flutter tool portions of the build. This must not be removed.

ui/flutter/windows/runner/CRASH_DIAGNOSTICS.md

@@ -1,31 +0,0 @@
-# Windows native crash diagnostics
-
-The runner installs diagnostics before starting Flutter and plugins. Files are
-written beside the executable under `storage/logs`, matching Windows app storage:
-
-- `native-crash.log`: UTC timestamp, app version, process/thread, exception code,
-  faulting module/address/offset, and minidump success or the Windows error code.
-- `native-crash.dmp`: the most recent native crash, including thread stacks,
-  loaded modules and unloaded module information.
-- `crash.log`: Go runtime crash output, kept separately from native diagnostics.
-
-Logs are appended and existing dumps survive normal restarts. A subsequent native
-crash replaces the previous dump. Dump generation is best effort, particularly
-for stack exhaustion, heap corruption or unavailable disk space. Process kills
-and fail-fast termination can bypass exception handlers.
-
-The top-level unhandled filter covers native exceptions on process threads. An
-SEH boundary inside the runner's window callback records the original escaping exception
-before Windows wraps a window callback failure as `0xC000041D`. A vectored handler
-also observes that fatal callback status, since it can bypass the unhandled
-filter. All handlers continue exception processing; they do not attempt recovery
-or log ordinary handled first-chance exceptions.
-
-On Windows, verify a release build by exercising tray clicks, Explorer restart,
-system font changes and child-window open/close. In a disposable test build,
-raise an unhandled access violation inside a window callback and on a worker
-thread, then raise `0xC000041D`; check that the log and dump are written and
-survive relaunch. A debugger may intercept these before application handlers.
-Open the dump with WinDbg and matching runner/Flutter/plugin PDBs to locate the
-faulting stack. Minidumps can contain application data; inspect them before
-sharing.

ui/flutter/windows/runner/crash_handler.cpp

@@ -1,119 +0,0 @@
-#include "crash_handler.h"
-
-#include <dbghelp.h>
-#include <strsafe.h>
-
-#include <cstdint>
-#include <cstring>
-#include <filesystem>
-#include <string>
-#include <system_error>
-
-namespace {
-
-HANDLE crash_log = INVALID_HANDLE_VALUE;
-std::wstring dump_path;
-volatile LONG recording = 0;
-LPTOP_LEVEL_EXCEPTION_FILTER previous_filter = nullptr;
-
-void WriteLog(const char* text) {
-  if (crash_log == INVALID_HANDLE_VALUE) return;
-  DWORD written = 0;
-  WriteFile(crash_log, text, static_cast<DWORD>(strlen(text)), &written,
-            nullptr);
-  FlushFileBuffers(crash_log);
-}
-
-LONG WINAPI UnhandledException(EXCEPTION_POINTERS* exception) {
-  RecordNativeCrash(exception);
-  return previous_filter ? previous_filter(exception)
-                         : EXCEPTION_CONTINUE_SEARCH;
-}
-
-LONG CALLBACK FatalCallbackException(EXCEPTION_POINTERS* exception) {
-  // Windows can terminate on this callback exception without invoking the
-  // process's unhandled filter. Ignore ordinary first-chance exceptions (Go,
-  // Dart and plugins may handle those) and observe only this fatal status.
-  if (exception->ExceptionRecord->ExceptionCode == 0xC000041D) {
-    RecordNativeCrash(exception);
-  }
-  return EXCEPTION_CONTINUE_SEARCH;
-}
-
-}  // namespace
-
-LONG RecordNativeCrash(EXCEPTION_POINTERS* exception) {
-  if (!exception || InterlockedCompareExchange(&recording, 1, 0) != 0) {
-    return EXCEPTION_CONTINUE_SEARCH;
-  }
-
-  SYSTEMTIME time;
-  GetSystemTime(&time);
-  const auto* record = exception->ExceptionRecord;
-  HMODULE module = nullptr;
-  wchar_t module_path[MAX_PATH] = L"unknown";
-  GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS |
-                        GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
-                    reinterpret_cast<LPCWSTR>(record->ExceptionAddress),
-                    &module);
-  if (module) GetModuleFileNameW(module, module_path, MAX_PATH);
-
-  char line[2048] = {};
-  StringCchPrintfA(
-      line, ARRAYSIZE(line),
-      "\r\n%04u-%02u-%02uT%02u:%02u:%02uZ Gopeed %s pid=%lu tid=%lu "
-      "exception=0x%08lX address=%p module=%ls offset=0x%llX\r\n",
-      time.wYear, time.wMonth, time.wDay, time.wHour, time.wMinute,
-      time.wSecond, FLUTTER_VERSION, GetCurrentProcessId(), GetCurrentThreadId(),
-      record->ExceptionCode, record->ExceptionAddress, module_path,
-      static_cast<unsigned long long>(
-          reinterpret_cast<uintptr_t>(record->ExceptionAddress) -
-          reinterpret_cast<uintptr_t>(module)));
-  WriteLog(line);
-
-  HANDLE dump = CreateFileW(dump_path.c_str(), GENERIC_WRITE, 0, nullptr,
-                            CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, nullptr);
-  if (dump != INVALID_HANDLE_VALUE) {
-    MINIDUMP_EXCEPTION_INFORMATION info = {};
-    info.ThreadId = GetCurrentThreadId();
-    info.ExceptionPointers = exception;
-    info.ClientPointers = FALSE;
-    const BOOL ok = MiniDumpWriteDump(
-        GetCurrentProcess(), GetCurrentProcessId(), dump,
-        static_cast<MINIDUMP_TYPE>(MiniDumpNormal | MiniDumpWithThreadInfo |
-                                   MiniDumpWithUnloadedModules),
-        &info, nullptr, nullptr);
-    const DWORD error = ok ? ERROR_SUCCESS : GetLastError();
-    FlushFileBuffers(dump);
-    CloseHandle(dump);
-    StringCchPrintfA(line, ARRAYSIZE(line), "minidump success=%d error=%lu\r\n",
-                     ok, error);
-    WriteLog(line);
-  } else {
-    StringCchPrintfA(line, ARRAYSIZE(line), "minidump open error=%lu\r\n",
-                     GetLastError());
-    WriteLog(line);
-  }
-
-  // Do not swallow an exception or resume a potentially corrupted process.
-  return EXCEPTION_CONTINUE_SEARCH;
-}
-
-void InstallCrashHandler() {
-  // Match Dart's Windows storage path independently of the working directory.
-  wchar_t executable[32768] = {};
-  const DWORD length = GetModuleFileNameW(nullptr, executable, ARRAYSIZE(executable));
-  if (length == 0 || length >= ARRAYSIZE(executable)) return;
-  const auto directory = std::filesystem::path(executable).parent_path() /
-                         L"storage" / L"logs";
-  std::error_code error;
-  std::filesystem::create_directories(directory, error);
-  if (error) return;
-
-  dump_path = (directory / L"native-crash.dmp").wstring();
-  crash_log = CreateFileW((directory / L"native-crash.log").c_str(),
-                         FILE_APPEND_DATA, FILE_SHARE_READ, nullptr, OPEN_ALWAYS,
-                         FILE_ATTRIBUTE_NORMAL, nullptr);
-  previous_filter = SetUnhandledExceptionFilter(UnhandledException);
-  AddVectoredExceptionHandler(1, FatalCallbackException);
-}

ui/flutter/windows/runner/crash_handler.h

@@ -1,12 +0,0 @@
-#ifndef RUNNER_CRASH_HANDLER_H_
-#define RUNNER_CRASH_HANDLER_H_
-
-#include <windows.h>
-
-// Installs best-effort native diagnostics before Flutter or plugins start.
-void InstallCrashHandler();
-
-// Records the exception and continues normal Windows exception processing.
-LONG RecordNativeCrash(EXCEPTION_POINTERS* exception);
-
-#endif  // RUNNER_CRASH_HANDLER_H_

ui/flutter/windows/runner/flutter_window.cpp

@@ -63,9 +63,7 @@ FlutterWindow::MessageHandler(HWND hwnd, UINT const message,
 
   switch (message) {
     case WM_FONTCHANGE:
-      if (flutter_controller_ && flutter_controller_->engine()) {
-        flutter_controller_->engine()->ReloadSystemFonts();
-      }
+      flutter_controller_->engine()->ReloadSystemFonts();
       break;
   }
 

ui/flutter/windows/runner/main.cpp

@@ -5,7 +5,6 @@
 #include <desktop_multi_window/desktop_multi_window_plugin.h>
 
 #include "app_links/app_links_plugin_c_api.h"
-#include "crash_handler.h"
 #include "flutter_window.h"
 #include "flutter/generated_plugin_registrant.h"
 #include "utils.h"
@@ -44,7 +43,6 @@ bool IsMultiWindowLaunch(const std::vector<std::string>& arguments) {
 
 int APIENTRY wWinMain(_In_ HINSTANCE instance, _In_opt_ HINSTANCE prev,
                       _In_ wchar_t *command_line, _In_ int show_command) {
-  InstallCrashHandler();
   // Attach to console when present (e.g., 'flutter run') or create a
   // new console when running with a debugger.
   if (!::AttachConsole(ATTACH_PARENT_PROCESS) && ::IsDebuggerPresent()) {
@@ -79,12 +77,11 @@ int APIENTRY wWinMain(_In_ HINSTANCE instance, _In_opt_ HINSTANCE prev,
   window.SetQuitOnClose(true);
 
   ::MSG msg;
-  BOOL message_result;
-  while ((message_result = ::GetMessage(&msg, nullptr, 0, 0)) > 0) {
+  while (::GetMessage(&msg, nullptr, 0, 0)) {
     ::TranslateMessage(&msg);
     ::DispatchMessage(&msg);
   }
 
   ::CoUninitialize();
-  return message_result == -1 ? EXIT_FAILURE : static_cast<int>(msg.wParam);
+  return EXIT_SUCCESS;
 }

ui/flutter/windows/runner/win32_window.cpp

@@ -3,7 +3,6 @@
 #include <dwmapi.h>
 #include <flutter_windows.h>
 
-#include "crash_handler.h"
 #include "resource.h"
 
 namespace {
@@ -159,26 +158,19 @@ LRESULT CALLBACK Win32Window::WndProc(HWND const window,
                                       UINT const message,
                                       WPARAM const wparam,
                                       LPARAM const lparam) noexcept {
-  // Capture inside the callback, before user32 wraps or suppresses an escaping
-  // exception. Keep C++ objects requiring unwinding out of this SEH boundary.
-  __try {
-    if (message == WM_NCCREATE) {
-      auto window_struct = reinterpret_cast<CREATESTRUCT*>(lparam);
-      SetWindowLongPtr(window, GWLP_USERDATA,
-                       reinterpret_cast<LONG_PTR>(window_struct->lpCreateParams));
+  if (message == WM_NCCREATE) {
+    auto window_struct = reinterpret_cast<CREATESTRUCT*>(lparam);
+    SetWindowLongPtr(window, GWLP_USERDATA,
+                     reinterpret_cast<LONG_PTR>(window_struct->lpCreateParams));
 
-      auto that = static_cast<Win32Window*>(window_struct->lpCreateParams);
-      EnableFullDpiSupportIfAvailable(window);
-      that->window_handle_ = window;
-    } else if (Win32Window* that = GetThisFromHandle(window)) {
-      return that->MessageHandler(window, message, wparam, lparam);
-    }
-
-    return DefWindowProc(window, message, wparam, lparam);
-  } __except (RecordNativeCrash(GetExceptionInformation())) {
-    // The filter always continues the exception search; this is unreachable.
-    return 0;
+    auto that = static_cast<Win32Window*>(window_struct->lpCreateParams);
+    EnableFullDpiSupportIfAvailable(window);
+    that->window_handle_ = window;
+  } else if (Win32Window* that = GetThisFromHandle(window)) {
+    return that->MessageHandler(window, message, wparam, lparam);
   }
+
+  return DefWindowProc(window, message, wparam, lparam);
 }
 
 LRESULT