Fix ulong/uint/ushort event properties displayed as signed types in event viewer

[Copilot]

Problem

Event properties with unsigned integer types (ulong, uint, ushort) were being displayed as their signed equivalents (long, int, short) in the event viewer, even when the event source explicitly wrote unsigned values.

For example, when writing a ulong value using:

[NonEvent]
private unsafe void WriteEvent(int eventId, ulong arg1)
{
    if (IsEnabled())
    {
        EventData* descrs = stackalloc EventData[1];
        descrs[0] = new EventData { DataPointer = (IntPtr)(&arg1), Size = 8 };
        WriteEventCore(eventId, 1, descrs);
    }
}

The value would be displayed as a long in the event viewer instead of ulong, causing confusion and potentially displaying negative values for large unsigned numbers.

Solution

Updated the PayloadFetch constructor in DynamicTraceEventParser.cs to preserve unsigned types when parsing event metadata from registered trace event parsers (TDH - Trace Data Helper):

• TdhInputType.UInt16 now maps to typeof(ushort) instead of typeof(short)
• TdhInputType.UInt32 now maps to typeof(uint) instead of typeof(int)
• TdhInputType.UInt64 now maps to typeof(ulong) instead of typeof(long)

The TdhInputType.UInt8 case was not modified as it already correctly maps to typeof(byte).

Implementation Details

The fix separates the handling of signed and unsigned types in the switch statement. Each unsigned type now has its own case that sets the appropriate .NET unsigned type. The PayloadValue method already had proper support for reading these unsigned types (TypeCode.UInt16, TypeCode.UInt32, TypeCode.UInt64), so no changes were needed there.

This change makes the DynamicTraceEventParser behavior consistent with EventPipeMetadata, which already correctly uses unsigned types for EventPipe events.

Fixes issue where unsigned event properties were displayed as signed types.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>ulong event property is displayed as long in event viewer.</issue_title>
<issue_description>I have a method to write ulong event in my event source:

    [NonEvent]
    private unsafe void WriteEvent(int eventId, ulong arg1)
    {
        if (IsEnabled())
        {
            EventData* descrs = stackalloc EventData[1];
            descrs[0] = new EventData { DataPointer = (IntPtr)(&arg1), Size = 8 };
            WriteEventCore(eventId, 1, descrs);
        }
    }

Yet it is still displayed as a long value inside the events grid view.

Is this expected behavior or fixable?</issue_description>

Comments on the Issue (you are @copilot in this section)

@brianrob I am not surprised at this. Looking at the code - at a minimum, this is coming from the `PayloadFetch` struct, which converts incoming signed and unsigned types into their signed .NET equivalents.

I am not sure how easy this is to fix, but I would hope relatively simple. Let's start with copilot trying to update PayloadFetch to differentiate between signed and unsigned types and see if that solves the problem.

Copilot: Please focus specifically on changing the handling of UInt16, UInt32, and UInt64. Don't touch UInt8. You should be able to update the switch statement to set the .NET type to be the unsigned type that matches the input type, rather than translating to the signed .NET type.</comment_new>

Fixes #2309

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[brianrob]

The copilot requests were failing on this PR. Closing in favor of #2315.