Getting windows eventlog entries even having sentry capturing the crashes

[JanFellner]

Maybe i was too naive but it turns out that creating windows eventlog entries from within the

sentry_options_set_on_crash(options, on_crash_callback, nullptr);

is kind of noooot 🥵 reliable even if you take extrem caution in not doing any heap allocations and trying to minify all stack allocations to the absolute minium. To get windows errors properly visualzed in the eventviewer in the standard pattern you need to gather a hell lot of stuff an send it properly. I had now time between the years to dig into it and it turns out that it is neither reliable nor fail save to do it from within the crash handling callback. (It´s basically just too much you need to do...)

An example about the data which would be need to get queried.

	Faulting application name: PerfWatson2.exe, version: 18.0.11222.15, time stamp: 0xfc6b3872
	Faulting module name: KERNELBASE.dll, version: 10.0.26100.7462, time stamp: 0xe9f9d656
	Exception code: 0xe0434352
	Fault offset: 0x00000000000c782a
	Faulting process id: 0x368C
	Faulting application start time: 0x1DC789C186EFE2B
	Faulting application path: C:\Program Files\Microsoft Visual Studio\18\Professional\Common7\IDE\PerfWatson2.exe
	Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
	Report Id: 9c532552-ef86-4968-9418-077d5d7c7a11
	Faulting package full name:
	Faulting package-relative application ID:

However i saw that CrashPad has an option to forward "stuff" to the operating system but i can´t find any code that would act on that flag. Am i missing something? I am posting it here as the original crashpad is not used but a fork and the discussion section is located here in sentry-native.

// Tell the crashpad handler how to behave...
CrashpadInfo* pCrashPadInfo = CrashpadInfo::GetCrashpadInfo();
if (pCrashPadInfo)
{
	// Tell crashpad to resolve referenced memory in local objects (e.g. std::string -> the memory the string points to)
	pCrashPadInfo->set_gather_indirectly_referenced_memory(crashpad::TriState::kEnabled, 10 * 1024 * 1024);
	// Enable that we are the module telling crashpad details for dumps
	pCrashPadInfo->set_crashpad_handler_behavior(crashpad::TriState::kEnabled);
	// Disable forwarding an event to the system handler (crashpad should handle it)
	pCrashPadInfo->set_system_crash_reporter_forwarding(crashpad::TriState::kDisabled);
}

Is that simply missing in crashpad_handler.exe🤔❓