Clustering Duplicate Crash Reports
Reviewed by Jorge Aranda / 2012-07-18
Keywords: Bug Reports
Dang2012 Yingnong Dang, Rongxin Wu, Hongyu Zhang, Dongmei Zhang, and Peter Nobel: "ReBucket: A method for clustering duplicate crash reports based on call stack similarity". 2012 34th International Conference on Software Engineering (ICSE), 10.1109/icse.2012.6227111.
Software often crashes. Once a crash happens, a crash report could be sent to software developers for investigation upon user permission. To facilitate efficient handling of crashes, crash reports received by Microsoft's Windows Error Reporting (WER) system are organized into a set of "buckets". Each bucket contains duplicate crash reports that are deemed as manifestations of the same bug. The bucket information is important for prioritizing efforts to resolve crashing bugs. To improve the accuracy of bucketing, we propose ReBucket, a method for clustering crash reports based on call stack matching. ReBucket measures the similarities of call stacks in crash reports and then assigns the reports to appropriate buckets based on the similarity values. We evaluate ReBucket using crash data collected from five widely-used Microsoft products. The results show that ReBucket achieves better overall performance than the existing methods. On average, the F-measure obtained by ReBucket is about 0.88.
For successful software products, one nasty consequence of a massive user base is the similarly massive amount of crash reports that they produce. Somebody (or some tool) needs to sift through all of them and categorize them to figure out if there's anything that's new and worthy of investigation, as well as which bugs are in most urgent need of attention. Dang et al developed a method to cluster these crash reports (the paper describes it in some detail), and it seems to have pretty good results so far—and although it has been tried only on Microsoft data, the authors are planning to move onto other projects as well.