hotspot identification

This paper addresses the dual challenges of low fault localization accuracy and weak root-cause interpretability in software debugging. To this end, we propose an interpretable diagnosis method based on multi-execution feature fusion. Through empirical analysis of 310 real-world defects, we first establish—systematically and for the first time—that scalar pairs constitute the strongest failure-correlated features. Building upon this insight, we design a joint modeling framework that integrates 17 fine-grained execution features, including variable values, branch conditions, and definition-use chains. We further develop a feature-importance-driven interpretable decision tree model that automatically generates human-readable diagnostic rules. Evaluation across 20 open-source projects demonstrates that our approach significantly improves both fault localization accuracy and root-cause identification depth, substantially reducing developer debugging time. The method achieves a favorable balance between high precision and strong interpretability.

Spectrum-Based Fault Localization (SBFL) fails when no failing tests are available to trigger faults. Method: This paper systematically demonstrates, for the first time, that stack traces from crash reports can serve as pseudo-failure signals in lieu of actual failing tests, and proposes SBEST—a novel SBFL method that integrates exception-location semantics with method-call-graph reachability to embed stack-trace information into the spectrum analysis framework. SBEST jointly leverages test coverage matrices and parsed stack traces to enable precise fault localization even in the absence of failing tests. Results: Experiments show SBEST improves Mean Average Precision (MAP) by 32.22% and Mean Reciprocal Rank (MRR) by 17.43% over the baseline MAP method. Moreover, 98.3% of defect-fixing intentions align with stack-trace anomalies, and 78.3% of defective methods are reachable within an average of 0.34 call-graph hops. This work establishes a new lightweight, crash-driven paradigm for fault localization.

This study addresses the challenge in software maintenance of effectively quantifying the execution status of internal modules to identify redundant or critical components requiring modification or removal. To this end, it introduces spatial statistics theory into software engineering for the first time, proposing the concept of “software space.” By modeling execution data through a module call graph, the approach enables structured analysis of module-level execution behavior via spatial clustering visualization and statistical hypothesis testing. Experimental results demonstrate that the method successfully identifies both critical and redundant modules, thereby offering data-driven support for informed maintenance decisions.

Existing program behavior prediction models struggle to effectively capture dynamic inter-statement dependencies, limiting their performance in code coverage prediction and runtime error detection. To address this, we propose a dual-path joint modeling framework: (1) a static path that encodes control dependencies via control flow graphs (CFGs) and graph neural networks; and (2) a dynamic path that learns temporal execution dependencies from program execution traces. Crucially, we introduce node-level dual-path embedding to enable fine-grained, unified representation of both static and dynamic dependencies. To the best of our knowledge, this is the first work to jointly and coherently model static control-flow dependencies and dynamic execution-time dependencies within a single framework. Evaluated on code coverage prediction and runtime error localization tasks, our approach achieves significant improvements over state-of-the-art methods—yielding a 12.3% gain in prediction accuracy and an 18.7% increase in error localization precision.

This work addresses four classes of memory corruption vulnerabilities—heap/stack buffer overflows, use-after-free, and double-free—in binary executables. We propose a lightweight, test-unit-driven symbolic execution method that statically identifies vulnerable code units and performs localized symbolic execution to avoid full-path explosion. By integrating Z3-based SMT solving with supervised learning to model the mapping from system-level inputs to unit-specific inputs, our approach enables end-to-end generation of vulnerability-triggering inputs. This introduces the first “test-unit-driven” symbolic execution paradigm, implemented within the angr framework by unifying static analysis, SMT constraint solving, and machine learning. Evaluated on standard benchmark programs, our method achieves significantly improved detection accuracy and execution efficiency, successfully generating reproducible, system-level exploit inputs for real-world vulnerabilities.

This study addresses the limitations of traditional statistical fault localization (SFL), which relies solely on code execution traces and often fails to accurately pinpoint root causes. To overcome this, the authors systematically incorporate execution features—such as data flow, variable values, and branch conditions—extracted via the EFDD tool from the Tests4Py dataset. They train project-specific random forest models and map feature importance back to source code lines, integrating these insights with classical SFL formulas to enhance localization accuracy. Rigorous evaluation is conducted using a confounder-adjusted mixed-effects model and paired statistical tests. Experimental results demonstrate that the proposed approach significantly improves the accuracy of reference patches while reducing inspection effort at both line and function levels, confirming its robustness and practicality across multiple dimensions.

Traditional edge-covering fuzzing struggles to distinguish execution paths that differ only in parameter values, often missing critical state transitions. This work proposes a context-aware feedback mechanism for kernel fuzzing that captures data flow across function boundaries by leveraging LLVM instrumentation to record parameters and return values. It uniquely employs DWARF metadata to automatically resolve composite types without requiring source-code annotations. To enable efficient, zero-interference logging alongside existing tools like KCOV and syzkaller, the approach introduces a lock-free per-task ring buffer, supporting accurate parameter capture even for Rust kernel modules compiled under -O2 optimization. Evaluated across five vulnerability classes—including out-of-bounds accesses, use-after-free, double-free, deep propagation bugs, and Rust FFI issues—the method incurs less than 3% runtime overhead while significantly enhancing fuzzing guidance precision and security analysis efficiency.

Static program analysis faces significant challenges in uniformly modeling stack/heap memory behaviors and value semantics across multiple programming languages, which hinders precise detection of memory safety issues such as buffer overflows and null pointer dereferences. To address this limitation, this work proposes a generic memory analysis framework grounded in abstract interpretation. The framework introduces a novel, parameterizable partitioned state abstraction mechanism that decouples value analysis from memory structure analysis, enabling flexible and modular composition of stack and heap modeling through customizable abstract domains. Formally rigorous and language-agnostic by design, the framework has been implemented to provide unified support for C/C++, Java, and Python, substantially enhancing static detection capabilities for a broad range of memory-related errors.

This work addresses the pervasive yet elusive performance issues in mobile applications—such as UI jank and thermal throttling—caused by native libraries compiled with low-level optimization flags (e.g., O0/O1), which are notoriously difficult to detect. To tackle this, we propose OptDetect, the first end-to-end framework capable of identifying mixed optimization levels without requiring source code or build metadata. OptDetect leverages binary disassembly, machine learning–driven block-level optimization classification, and a weighted scoring aggregation scheme to accurately pinpoint under-optimized code segments. Evaluation on 830 popular apps reveals that 91.7% are affected by poorly optimized third-party libraries. Post-remediation results demonstrate up to a 63% reduction in CPU instructions, a median 42% drop in user-reported performance complaints, and a 0.14-point increase in app store ratings, confirming both the efficacy and industry-wide applicability of our approach.

This study presents the first systematic quantification of C/C++ undefined behavior (UB) triggered by real user interactions in a typical Linux desktop environment. By integrating compiler-based sanitizers with automated task execution, stack trace analysis, and log collection, the authors conduct an empirical investigation across 59 common desktop tasks. Their findings reveal that UB occurs frequently and is heavily concentrated in critical components such as graphics libraries: merely logging into GNOME generates over 500 sanitizer warnings, and nearly 11,000 unique UB reports are captured across 32 programs, with vtable pointer violations being the dominant category. This work underscores the pervasiveness and distribution patterns of UB in desktop software, providing an empirical foundation for improving system stability and security hardening.