bug triage

The practical efficacy of continuous fuzzing in vulnerability detection remains poorly understood. Method: We conduct a cross-project quantitative analysis based on 1.12 million real-world fuzzing sessions from OSS-Fuzz, integrating coverage reports, fuzzing logs, and vulnerability bug reports. Contribution/Results: Our large-scale empirical study reveals that vulnerability discovery is highly concentrated in the early phase of continuous fuzzing—over 60% of vulnerabilities are detected within the first seven days. Moreover, we identify a strong dynamic correlation between sustained coverage growth and novel vulnerability discovery: iterative expansion of coverage boundaries directly drives subsequent vulnerability identification. These findings empirically validate the effectiveness of continuous fuzzing and provide data-driven guidance for optimizing operational strategies—including resource allocation and termination criteria—thereby filling a critical gap in evidence-based evaluation of fuzzing practices.

Traditional static code review struggles to detect non-crashing, behavior-level anomalies. This paper proposes a dynamic-enhanced code review method: it employs non-crashing fuzz testing to generate runtime invariants and construct cross-version program behavior models; integrates dynamic invariant inference with behavioral drift detection to automatically localize anomalous behavioral deviations induced by code changes; and further aligns behavioral signals with static code structure to precisely identify suspicious code blocks. This work is the first to systematically incorporate fuzz-testing-derived dynamic feedback into early-stage code review. Evaluation shows the approach achieves a 75% regression defect detection rate and up to 80% vulnerability detection rate, with significantly lower false positive rates than SAST tools and a tenfold improvement in detection efficiency—effectively addressing static analysis’s fundamental limitation in capturing dynamic behavioral semantics.

This paper addresses the dual challenges of low fault localization accuracy and weak root-cause interpretability in software debugging. To this end, we propose an interpretable diagnosis method based on multi-execution feature fusion. Through empirical analysis of 310 real-world defects, we first establish—systematically and for the first time—that scalar pairs constitute the strongest failure-correlated features. Building upon this insight, we design a joint modeling framework that integrates 17 fine-grained execution features, including variable values, branch conditions, and definition-use chains. We further develop a feature-importance-driven interpretable decision tree model that automatically generates human-readable diagnostic rules. Evaluation across 20 open-source projects demonstrates that our approach significantly improves both fault localization accuracy and root-cause identification depth, substantially reducing developer debugging time. The method achieves a favorable balance between high precision and strong interpretability.

Target selection in directed fuzzing has long lacked systematic investigation. Method: This paper conducts the first large-scale, quantitative evaluation of over a dozen target-selection strategies on 1,600+ real-world crash-inducing inputs; introduces lightweight code metrics—e.g., cyclomatic complexity and call depth—as principled alternatives to heuristic approaches; validates the effectiveness and generalizability of large language model (LLM)-assisted scoring for target prioritization; and treats target selection as an orthogonal optimization dimension, decoupled from instrumentation and mutation mechanisms. Contributions/Results: The proposed metrics outperform state-of-the-art heuristics, yielding a 23% average coverage improvement on OSS-Fuzz. The study integrates software metric analysis, crash-driven evaluation, sanitizer-based comparative experiments, and a cross-conference literature review, establishing both theoretical foundations and practical guidelines for directed fuzzing.

Spectrum-Based Fault Localization (SBFL) fails when no failing tests are available to trigger faults. Method: This paper systematically demonstrates, for the first time, that stack traces from crash reports can serve as pseudo-failure signals in lieu of actual failing tests, and proposes SBEST—a novel SBFL method that integrates exception-location semantics with method-call-graph reachability to embed stack-trace information into the spectrum analysis framework. SBEST jointly leverages test coverage matrices and parsed stack traces to enable precise fault localization even in the absence of failing tests. Results: Experiments show SBEST improves Mean Average Precision (MAP) by 32.22% and Mean Reciprocal Rank (MRR) by 17.43% over the baseline MAP method. Moreover, 98.3% of defect-fixing intentions align with stack-trace anomalies, and 78.3% of defective methods are reachable within an average of 0.34 call-graph hops. This work establishes a new lightweight, crash-driven paradigm for fault localization.

Existing testing approaches struggle to effectively detect functional bugs that do not cause program crashes: manually written unit tests are costly, heuristic-based test generation lacks semantic understanding, and fuzzing relies heavily on crash signals. To address this limitation, this work proposes LISA, a novel framework that uniquely integrates large language models (LLMs) with program invariants. LISA employs semantically guided API call sequence generation and an API n-gram–based feedback mechanism to iteratively refine test cases. The approach substantially improves both the detection rate and precision of functional defects, outperforming state-of-the-art fuzzing techniques and LLM-driven testing methods in terms of code coverage and the generation of high-confidence bug reports.

This work addresses the challenge of detecting logical vulnerabilities in mature codebases, which often evade traditional fuzzing and static analysis due to their need for multi-step reasoning, lack of explicit feedback, and dispersion across heterogeneous code structures. The authors propose an agent-based fuzzing approach that leverages a large language model as the core reasoning engine within a four-stage agent pipeline, enabling root cause analysis, hypothesis generation and validation, and automatic synthesis of executable proof-of-concept exploits. To enhance cross-structural vulnerability discovery, the method incorporates a scenario-aware deduplication strategy and a DPP-MAP diversity-driven seed scheduling algorithm. Evaluated on the V8 JavaScript engine, the approach uncovered 40 vulnerabilities (including 3 duplicates) within one month, earning $35,000 in bug bounties and leading to two assigned CVEs; when extended to SpiderMonkey and JavaScriptCore, it identified an additional 19 vulnerabilities.

This study addresses the persistent occurrence of software defects after release, particularly in C/C++ and Java systems, whose underlying causes remain poorly understood. Through a large-scale empirical analysis of over 14,000 open-source projects, the work systematically compares pre-release and post-release defect characteristics using multidimensional metrics—including code complexity, size, change frequency, and development history—and employs statistical modeling to uncover key patterns. It reveals for the first time that post-release defects are significantly concentrated in legacy modules that undergo frequent modifications, with their root causes primarily stemming from dynamic evolutionary pressures rather than static code structure. Furthermore, such defects exhibit longer repair cycles and higher complexity, offering empirical grounding for targeted testing strategies and improved reliability assurance.

Bug fixing is a complex and time-consuming task in software development. Bug localization research tends to focus on the accuracy of automated tools that suggest source code files for developers to look at. However, little is known about how developers use these tools in practice. This paper reports on an ongoing qualitative user study. Eleven participants worked through four realistic bug localization tasks in a controlled environment and were given varying levels of support information offered by a specialized tool. Participants were asked to think aloud in a semi-structured interview session. The preliminary findings provide insight into three aspects of practice: how developers interact with tools, the role social and contextual information plays, and problem solving. The study demonstrates that bug localization is complex and suggests that the adoption of effective tools depends on more than their accuracy.