Cross-Project Bug Localization: What Works, What Doesn't, and Why
Bug localization models require substantial within-project training data that newly active or small open-source projects rarely have. Cross-project learning (CPL) promises to close this gap by reusing labeled bugs from mature projects, but prior CPL studies evaluate a single model against ample-data within-project baselines that data-scarce projects cannot reach. We ask whether CPL's effectiveness is a property of the transfer setting or depends on model architecture. We evaluate three architecturally distinct models, embedding-based BLAZE, convolutional TRANP-CNN, and GNN-based adversarial COOBA, on 63 source to target pairs from 13 open-source Python projects under identical bug corpora, data splits, retrieval candidates, and baselines. The primary baseline is within-project limited training (WP-small, 20% of target labels, the same target-side share as CP-transfer). CPL outperforms WP-small most clearly for TRANP-CNN (Cohen's d = 0.95, win rate 81.0%, p < 0.001, robust to clustering pairs by target project), and less so for BLAZE (d = 0.49, win rate 60.3%, p = 0.002; not significant once pairs are clustered by target). COOBA, under our re-implementation, shows a small gain that does not survive multiple-comparison correction (d = 0.27, p = 0.027). Negative transfer affects 9.5% of TRANP-CNN pairs and 30.2% of BLAZE's and COOBA's. Cross-model direction agreement is only 44-54%: the same pair can help one architecture and harm another, although the models' gains are positively correlated (rho = 0.24-0.42). CPL outcomes are therefore architecture-dependent: practitioners should validate CPL for their chosen model, and CPL studies should report results per architecture.