Cap native_crash.log + reduce HangWatchdog spam (fix 480 MB log explosion)

Agent-Logs-Url: https://github.com/winnerspiros/osu/sessions/f482c98e-d59c-488f-bda7-739eeb3fb56b

Co-authored-by: winnerspiros <1675249+winnerspiros@users.noreply.github.com>

Author: Copilot

osu.Android/CrashDiagnostics.cs

@@ -34,6 +34,22 @@ internal static class CrashDiagnostics
         public const string CRASH_LOG_NAME = "native_crash.log";
         public const string SENTINEL_NAME = "crash_handler_installed.txt";
 
+        // Hard size cap on a single native_crash.log file. When reached we rotate the
+        // file to "<name>.1" (overwriting any previous backup) and start a fresh log.
+        // This bounds *each* of the internal and external locations to ~2× the cap
+        // worst-case, regardless of how many crash-restart cycles the device endures.
+        //
+        // The cap exists to defeat the failure mode observed in the field where a
+        // tight ANR-restart loop produced ~480 MB of native_crash.log on the user's
+        // device storage in a few hours — every restart appended the previous
+        // process's HangWatchdog dumps to the external log via
+        // MirrorInternalLogToExternal, with no upper bound. 3 MiB is enough to hold
+        // ~6 full HangWatchdog hang dumps including the per-thread /proc snapshot,
+        // i.e. comfortably more than one process's worth of evidence after the new
+        // HangWatchdog cap (max_dumps_per_process=20) is applied.
+        private const long native_crash_log_max_bytes = 3L * 1024 * 1024;
+        private const string crash_log_backup_suffix = ".1";
+
         private static int initialised;
         private static int managedHooksInstalled;
 
@@ -167,6 +183,17 @@ public static void MirrorInternalLogToExternal()
 
                 string externalPath = Path.Combine(externalDir, CRASH_LOG_NAME);
 
+                // Defeat the unbounded-growth failure mode: a tight ANR-restart
+                // loop calls MirrorInternalLogToExternal on every startup, each
+                // of which appends the previous process's full HangWatchdog
+                // dump set to the external log. Without this rotation the
+                // external file grew to hundreds of MB on the user's device
+                // (one report: 480 MB across a single afternoon). Rotating
+                // *before* the append guarantees the resulting file is at most
+                // <native_crash_log_max_bytes + this_payload_size>, and a
+                // single ".1" backup retains the previous generation.
+                rotateIfTooLarge(externalPath);
+
                 try
                 {
                     // Append, not overwrite — keep external as the running historical log.
@@ -379,6 +406,14 @@ private static void tryAppend(string? dir, string payload)
             try
             {
                 string path = Path.Combine(dir, CRASH_LOG_NAME);
+
+                // Bound the file size before opening for append. A pathological
+                // crash-restart loop would otherwise write hundreds of MB into
+                // this single file — the rotation cap (one historical backup,
+                // each ≤ native_crash_log_max_bytes) keeps the worst-case at
+                // ~2× the cap regardless of how long the loop runs.
+                rotateIfTooLarge(path);
+
                 using var fs = new FileStream(path, FileMode.Append, FileAccess.Write, FileShare.ReadWrite);
                 using var sw = new StreamWriter(fs);
                 sw.Write(payload);
@@ -390,6 +425,44 @@ private static void tryAppend(string? dir, string payload)
             }
         }
 
+        // If <path> exists and is at or above the size cap, move it to
+        // "<path>.1" (overwriting any previous backup) so the next write starts
+        // a fresh file. Best-effort and never throws — diagnostics paths must
+        // not introduce new failure modes.
+        private static void rotateIfTooLarge(string path)
+        {
+            try
+            {
+                if (!File.Exists(path)) return;
+
+                long length;
+                try { length = new FileInfo(path).Length; }
+                catch { return; }
+
+                if (length < native_crash_log_max_bytes) return;
+
+                string backup = path + crash_log_backup_suffix;
+
+                try { if (File.Exists(backup)) File.Delete(backup); }
+                catch (Exception e) { Debug.WriteLine($"[osu!] CrashDiagnostics.rotateIfTooLarge: could not delete prior backup {backup}: {e.Message}"); }
+
+                try { File.Move(path, backup); }
+                catch (Exception e)
+                {
+                    // If rename fails (e.g. cross-device on some FUSE setups),
+                    // fall back to in-place truncation rather than leaving the
+                    // file unbounded.
+                    Debug.WriteLine($"[osu!] CrashDiagnostics.rotateIfTooLarge: rename failed ({e.Message}); truncating in place");
+                    try { File.WriteAllText(path, string.Empty); }
+                    catch (Exception inner) { Debug.WriteLine($"[osu!] CrashDiagnostics.rotateIfTooLarge: truncate also failed: {inner.Message}"); }
+                }
+            }
+            catch (Exception e)
+            {
+                Debug.WriteLine($"[osu!] CrashDiagnostics.rotateIfTooLarge outer failure for {path}: {e.Message}");
+            }
+        }
+
         private static void resolveDirs(Context context)
         {
             try

osu.Android/HangWatchdog.cs

@@ -30,9 +30,14 @@ namespace osu.Android
     ///
     /// <para>
     /// The hang threshold is intentionally short (5s): the runtime log can grow
-    /// to ~70MB on the user's device, so we'd rather over-dump than miss a
-    /// stall, but we still rate-limit re-dumps of the same hang to one every
-    /// 10s so we don't fill the log in a single second of frozen state.
+    /// quickly on a stuck device, so we'd rather over-detect than miss a stall.
+    /// We rate-limit re-dumps of the same hang to one every 30s and cap the
+    /// per-process dump count at 20 so a permanently-hung process cannot on its
+    /// own fill the bounded <c>native_crash.log</c> budget — earlier (200-dump,
+    /// 10s-cooldown) settings were the dominant contributor to the ~480 MB
+    /// log explosion observed in the field on devices stuck in an ANR-restart
+    /// loop, where every restart appended the previous process's full dump set
+    /// to the external log via <c>MirrorInternalLogToExternal</c>.
     /// </para>
     /// </summary>
     internal static class HangWatchdog
@@ -47,14 +52,22 @@ internal static class HangWatchdog
         private const int heartbeat_interval_ms = 1_000;
 
         // Minimum gap between two consecutive snapshots while still hung. Without
-        // this, a 60s hang would generate 12 full /proc/self/task dumps and
-        // potentially blow the log size cap in a few seconds.
-        private const int redump_cooldown_ms = 10_000;
+        // this, a 60s hang would generate many full /proc/self/task dumps and
+        // potentially blow the log size cap in a few seconds. 30s is plenty for
+        // a "still hung" signal — the HangWatchdog is for diagnosing *that* the
+        // thread hung and *roughly when*, not for sampling its state every
+        // second; the high-frequency sampling rate in earlier iterations was
+        // the dominant contributor to the 480 MB log explosion observed in the
+        // field on devices stuck in an ANR-restart loop.
+        private const int redump_cooldown_ms = 30_000;
 
         // Maximum number of distinct hang dumps written for the lifetime of the
         // process. Prevents pathological "permanent hang plus runaway watchdog"
         // from filling the log indefinitely if the cooldown logic ever misbehaves.
-        private const int max_dumps_per_process = 200;
+        // 20 dumps × ~6 KB ≈ 120 KB worst-case per process, well within the
+        // CrashDiagnostics rotation cap (~3 MiB) so a single hung process can
+        // never on its own exhaust the bounded native_crash.log budget.
+        private const int max_dumps_per_process = 20;
 
         private static int started;
         private static Thread? monitorThread;

osu.Android/LogManagement.cs

@@ -39,10 +39,13 @@ namespace osu.Android
     internal static class LogManagement
     {
         // Hard cap on the total bytes consumed by *.log files in the log directory.
-        // 20 MiB matches the explicit user request and is large enough to retain
-        // ~30 successive Important-level launches even when each one logs an
-        // unhandled exception with full stack trace.
-        public const long MAX_LOG_BYTES = 20L * 1024 * 1024;
+        // 6 MiB is chosen so that the user's overall on-disk diagnostics budget
+        // (~20 MiB target) divides into ~6 MiB runtime logs + ~6 MiB internal
+        // native_crash.log (capped via CrashDiagnostics rotation) + ~6 MiB
+        // external native_crash.log (same cap). Important-level logs are very
+        // small per launch (~327 bytes for a clean cold start observed in the
+        // field), so 6 MiB still retains thousands of successive launches.
+        public const long MAX_LOG_BYTES = 6L * 1024 * 1024;
 
         // Subdirectory under the game storage root where the framework logger
         // writes per-session log files. Mirrors osu.Game/IO/OsuStorage.cs:140