Nowadays, many applications do not exist independently but rely on various frameworks or libraries. The complex internal implementation and frequent evolution of APIs induce unknown misuses and unexpected post-release crashes. To automatically locate buggy methods based on the limited infor- mation in crash stack traces, existing approaches either perform static tracing on the call graph or construct a large-scale dataset with crash-fixing records for machine learning. These approaches are limited by the completeness of the call graph (CG) and heavily rely on manually labeled similar cases. Besides, they only take the application code under analysis regardless of the exception triggering procedure in the bottom-level code, which hinders the developers to understand the fault localization results.

To achieve effective debugging on complex framework-specific crashes, we propose a code-separation-based locating approach that does not completely rely on the CG edges and does not require any prior knowledge. Our key insight is that one crash stack trace with the description information can be mapped to a definite exception-thrown point in the framework, the syntax analysis of which can help to figure out the root cause of the crash-triggering procedure. Thus, we can construct reusable summaries for all the framework-specific exceptions and use this information to achieve fault localization. The challenge is which information can we extract to effectively support the fault localization in the application code. In this paper, we design and construct the \textit{exception-throwing summaries}, which describe the key variables and APIs that relate to the triggering of exceptions from the view of the framework users. Then, we perform static analysis to automatically compute such summaries and make a data tracking of these key variables and APIs in the application code to locate faults. In the scenario of locating Android framework-specific crashing faults, our tool CrashTracker exhibited an overall MRR metric value of 0.91, and outperforms the state-of-the-art tool Anchor with higher precision using a compact candidate set. Moreover, CrashTracker provides explainable reasons for each reported buggy candidate.