Crash log annotation and inference of software bugs

Bugs cause software to misbehave, sometimes with serious consequences. A software crash can cause you tolose data; a vulnerable web browsers may allow others to access sensitive private information; faulty softwarein medical or airline equipment may even cost lives. While software engineering techniques and rigoroustesting are effective in reducing the number of bugs, they cannot eliminate them completely. A commontechnique used to investigate bugs in production systems is the use of crash dumps: information about theprogram state and relevant memory contents at the time of the crash. These memory contents are collected inraw binary form, without any information about the type of data and the values they represent, but thisinformation is key to investing and fixing bugs. Using information about the paths through which a programaccesses certain memory locations and using knowledge about the representation of data types, these rawbinary data can be annotated with the types of data and the values they represent. In the presence of bugs,however, different annotation rules may lead to conflicting annotations. Indeed, the most common source ofbugs is different parts of the program using the same memory location in conflicting ways, e.g., treating it asdifferent types of data. The first goal of this proposal is to develop algorithms to reconcile conflictingannotations and assign a confidence score to the resulting reconciled annotations. The second goal is to scopeout a long-term research plan that focuses on developing a system that can mine large collections of crashdumps collected from millions of users of Google's Chrome browser to produce actionable bug summaries fordevelopers explaining what the system thinks went wrong along with a list of supporting evidence collectedfrom these crash reports and the deductive steps taken to reach this conclusion. A developer can then take sucha bug summary as a starting point of efforts to fix the bug. This type of bug summarization can be performedby an expert developer, but this is time consuming. Thus, in order to effectively address the bugs reported inmillions of automatically generated crash dumps, this process needs to be automated using efficient algorithms.