US 8,949,675 B2Granted

Error report processing using call stack similarity

AssigneeMicrosoft Corporation

InventorsDongmei Zhang, Yingnong Dang, Song Ge

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques for error report processing are described herein. Error reports, received by a developer due to program crashes, may be organized into a plurality of “buckets.” The buckets may be based in part on a name and a version of the application associated with a crash. Additionally, a call stack of the computer on which the crash occurred may be associated with each error report. The error reports may be “re-bucketed” into meta-buckets to provide additional information to programmers working to resolve software errors. The re-bucketing may be based in part on measuring similarity of call stacks of a plurality of error reports. The similarity of two call stacks—a measure of likelihood that two error reports were caused by a same error—may be based in part on functions in common, a distance of those functions from the crash point, and an offset distance between the common functions.

Claims19

Dependent claims

A system comprising:

one or more processors;
one or more computer-readable storage devices storing computer-executable instructions that, when executed, cause the one or more processors to perform acts comprising:
receiving error reports, the error reports organized within a plurality of buckets, the buckets based in part on an application name associated with a crash, individual ones of the error reports having a call stack;
re-bucketing the error reports into meta-buckets, individual ones of the meta-buckets having call stacks having a similarity that is greater than a threshold value, and the re-bucketing comprising clustering error reports into a cluster, wherein any two error reports within the cluster have a first call stack and a second call stack, respectively, the first call stack and the second call stack being for a first application and a second application, the first application being different from the second application;
ascertaining a similarity between the first call stack and the second call stack based at least in part on evaluation by a similarity function applied to a first subsequence and a second subsequence of the respective first call stack and second call stack;
training the similarity function by refinement of values used in the similarity function for at least one of a coefficient value for distance to a crash point or a coefficient value for alignment offset;
and
generating a report associated with at least one meta-bucket.

5 more elements

A method for error report processing, comprising:

under control of one or more processors configured with executable instructions:
receiving error reports, the error reports organized within a plurality of buckets, the buckets based in part on an application name associated with a crash, each error report having a call stack;
clustering the error reports based in part on call stack similarity, to thereby produce a cluster of associated error reports, the error reports having call stacks having a similarity that is greater than a threshold value;
and
generating a report for error reports within the cluster, the report including a directed graph, the directed graph including:
representations of a plurality of functions showing a distance of each function from a crash point;
and
a plurality of weighted vectors providing a plurality of different paths through the plurality of functions to the crash point.

5 more elements

A method for error report processing, comprising:

under control of one or more processors configured with executable instructions:
receiving error reports, the error reports organized within a plurality of buckets, the buckets based in part on an application name associated with a crash, each error report having a call stack;
re-bucketing the error reports into meta-buckets, the re-bucketing based in part on measuring call stack similarity, to thereby associate in each meta-bucket a plurality of error reports having call stacks having a similarity that is greater than a threshold value, the measuring call stack similarity including:
identifying immune functions within two call stacks;
matching functions, by identifying a same function in the two call stacks in two error reports, wherein the same function is not an immune function;
measuring a distance from matched functions to a crash point;
and
measuring an offset distance between the matched functions;
and
generating a report for error reports within at least one meta-bucket, the report including a directed graph, the directed graph including:
representations of a plurality of functions showing a distance of each function from a crash point;
and
a plurality of weighted vectors providing a plurality of different paths through the plurality of functions to the crash point.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 12/957,090Filed 30 Nov 2010
Published: US 2012/0137182 A131 May 2012
Granted: 3 Feb 2015
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

G06F 11/0781
Error or fault reporting or storing: error filtering or prioritizing based on a policy defined by the user or on a policy defined by a…
G06F 11/0775
Error or fault reporting or storing: content or structure details of the error report, e.g. specific table structure, specific error fields
G06F 11/0778
Error or fault reporting or storing: dumping, i.e. gathering error/state information after a fault for later diagnosis
G06F 11/0787
Error or fault reporting or storing: storage of error reports, e.g. persistent data storage, storage using memory protection