Method HandleProcessEvent

PresentData/PresentMonTraceConsumer.cpp:2748–2853

}

void PMTraceConsumer::HandleProcessEvent(EVENT_RECORD* pEventRecord)
{
    auto const& hdr = pEventRecord->EventHeader;

    ProcessEvent event;
    event.QpcTime = hdr.TimeStamp.QuadPart;

    if (hdr.ProviderId == Microsoft_Windows_Kernel_Process::GUID) {
        switch (hdr.EventDescriptor.Id) {
        case Microsoft_Windows_Kernel_Process::ProcessStart_Start::Id:
        case Microsoft_Windows_Kernel_Process::ProcessRundown_Info::Id: {
            EventDataDesc desc[] = {
                { L"ProcessID" },
                { L"ImageName" },
            };
            mMetadata.GetEventData(pEventRecord, desc, _countof(desc));
            event.ProcessId     = desc[0].GetData<uint32_t>();
            auto ImageName      = desc[1].GetData<std::wstring>();
            event.IsStartEvent  = true;

            // When run as-administrator, ImageName will be a fully-qualified path.
            // e.g.: \Device\HarddiskVolume...\...\Proces.exe.  We prune off everything other than
            // the filename here to be consistent.
            size_t start = ImageName.find_last_of(L'\\') + 1;
            event.ImageFileName = ImageName.c_str() + start;
            break;
        }
        case Microsoft_Windows_Kernel_Process::ProcessStop_Stop::Id: {
            EventDataDesc desc[] = {
                { L"ProcessID" },
            };
            mMetadata.GetEventData(pEventRecord, desc, _countof(desc));
            event.ProcessId    = desc[0].GetData<uint32_t>();
            event.IsStartEvent = false;

            // Clean up PC Latency tracking data for this process to prevent memory leaks.
            // This is necessary because PCLStatsShutdown events are application-controlled
            // and may not be sent if the app crashes or terminates abnormally.
            if (mTrackPcLatency) {
                std::erase_if(mPclTimingDataByPclFrameId, [&event](const auto& p) {
                    return p.first.second == event.ProcessId;
                });
                mLatestPingTimestampByProcessId.erase(event.ProcessId);
            }
            // Clean up App Timing data as well...
            if (mTrackAppTiming) {
                std::erase_if(mAppTimingDataByAppFrameId, [&event](const auto& p) {
                    return p.second.ProcessId == event.ProcessId;
                });
                std::erase_if(mPresentByAppFrameId, [&event](const auto& p) {
                    return p.first.second == event.ProcessId;
                });
            }
            break;
        }
        default:
            assert(!mFilteredEvents); // Assert that filtering is working if expected
            return;