Search through debug_meta fields (like code_file) in order to match .exe-cutable

[malkia]

Problem Statement

Normally when we have a crash in an .exe, we can use stack.package:*tool.exe* and it'll find instances with the crash. Unfortunately it may not find all instances, under some circumstatnces.

Suppose that tool.exe loads helper.dll and crashes there in such way that tool.exe is not in the crashed callstack (for example the .dll creates it's own thread, and only calls within the module are done).

This prevents us from finding all crashes using stack.package:*tool.exe*.

Thanks!

Solution Brainstorm

Two ways comes to mind:

1. sentry already saves some bits about the image in the debug_meta fields, like debug_meta.code_file[] where all loaded .exe, .dll etc. are stored. So if we allow search through these, then we would be able to find all isntances. TBH, doesn't have to be really the debug_meta field, it can be some synthetic field made after processing.

2. Alternatively, if the other (non-crashing) stacks were searchable, then most likely at least one of the stacks would've contained *tool.exe* (maybe apart from rare case, where we've ended up with process that has only threads without the .exe itself - not sure if this can happen, and I'm speaking from Windows side, on other systems might be different).

Product Area

Discover

[getsantry]

Assigning to @getsentry/support for routing ⏲️

[getsantry]

Routing to @getsentry/product-owners-issues for triage ⏲️

[leeandher]

Thanks for the feedback! I'm not super familiar with native crash reporting, but it's common request to add more data to what is indexed and searchable across the Sentry product. Unfortunately at the moment the team doesn't have the bandwidth to prioritize this, but I'll ensure it gets added to our backlog.