Pith. sign in

REVIEW 4 major objections 6 minor 99 references

Tracing Errors, Constructing Fixes: Repository-Level Memory Error Repair via Typestate-Guided Context Retrieval

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A typestate-guided retrieval scheme lets an LLM repair 37 of 49 real-world C memory errors, outperforming prior template-based and LLM-agent repair tools.

desk verdict The core idea is solid and novel, but the headline numbers don't match the paper's own tables, so the empirical claims need a serious audit before they can be trusted. read the letter →

arxiv 2506.18394 v1 pith:QO52ZJBT submitted 2025-06-23 cs.SE

Xiao Cheng , Zhihao Guo , Huan Huo , Yulei Sui This is my paper
classification cs.SE
keywords memoryerrorrepairautomatedprogramlargelanguagemodelstypestateanalysiscontextretrievaluse-after-freedouble-freeleak
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that repository-level memory errors in C can be repaired automatically by steering a large language model with runtime information about the erroneous memory object. It introduces LTFix, which replays the error, traces the object's lifecycle through a finite typestate automaton, and feeds the LLM only the resulting typestate-changing contexts. The paper reports 37 of 49 real-world memory errors fixed across 14 open-source projects, several times more than prior memory-error repair tools, while using dramatically fewer tokens than an agentic LLM baseline. If true, this would make template-free, semantics-aware memory repair practical for large C codebases.

What carries the argument

The load-bearing mechanism is the finite typestate automaton (FTA), a quintuple of states and transitions that models memory-object lifecycles for use-after-free, double-free, and memory-leak errors, with states such as uninitialized, live, dead, and error. The authors use a debugger to step through the program from the nearest allocation to the error-triggering point, recording a program context at every typestate-changing breakpoint. Each context contains the location, the typestate transition, and a backtrace; the sequence of these contexts forms the context trace that is fed to the LLM, along with the error-propagation path, to generate the patch.

What would settle it

Release the 49 PoCs, ground-truth patches, and comparison scripts, then have an independent team re-run LTFix and the baselines on a held-out set of at least 20 newly disclosed memory-error CVEs with developer-merged fixes; if the reported 37-of-49 success rate does not approximately transfer, the central claim is refuted.

Watch

Extended reading notes

Core claim

The paper's central claim is that a finite typestate automaton can select a compact but semantically rich execution trace that gives an LLM enough interprocedural memory-management context to synthesize correct, multi-location fixes. In the authors' experiments, LTFix repairs 37 out of 49 real-world memory errors from 14 projects totaling over a million lines of code, compared with 2 errors for SAVER and 11 for ProveNFix, and it fixes 94% more errors than SWE-agent while consuming about 41 times fewer tokens. The paper also reports three zero-day memory errors whose fixes were accepted and implemented by the original developers.

Load-bearing premise

The load-bearing premise is that the 49-error benchmark the authors assembled is a fair and representative sample of real-world repository-level memory errors, and that their ground-truth comparison procedure reliably tells a correct fix from a plausible but wrong one.

Editorial extensions

If this is right

  • If the reported numbers hold, typestate-guided context retrieval is currently the most effective automated method for repository-level C memory error repair, repairing 14.50 times more errors than SAVER and 2.36 times more than ProveNFix on the paper's benchmark.
  • The approach can repair use-after-free, double-free, and memory-leak errors that require coordinated changes across multiple functions, not just single-location template fixes.
  • The dramatic token reduction, about 41 times fewer than SWE-agent, suggests that targeted program-analysis-guided retrieval can make LLM repair economically viable for large repositories.
  • The three developer-accepted zero-day fixes indicate that the generated patches can be of production quality rather than merely passing a test suite.
  • Ablation results show that removing the context trace drops fixed errors from 37 to 22 and increases the number of newly introduced errors, demonstrating that the typestate trace is a necessary component for the reported performance.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the benchmark is representative, the same typestate-guided retrieval pattern could transfer to other languages and error classes, such as Rust ownership violations or Java resource leaks, where a runtime automaton can be defined over object lifecycle operations.
  • The method depends on having a reproducible proof-of-concept input, so an obvious extension is to combine LTFix with automatic input generation, such as fuzzing or concolic execution, to widen coverage beyond hand-crafted PoCs.
  • Because the LLM may have seen some of the benchmark projects and patches during training, the 37 of 49 success rate should be revalidated on a fresh set of post-training vulnerabilities before treating it as a stable property of the method rather than of the model's memorized knowledge.
  • The paper's validation relies on matching developer ground truth, but the comparison procedure is not shown; an independent re-evaluation with released artifacts would strengthen the claim and provide a reusable benchmark for future work.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper presents LTFix, an automated program repair system for repository-level C memory errors (use-after-free, double-free, and memory leak). The approach replays a proof-of-concept input with a dynamic analysis tool, uses finite typestate automata to guide GDB-based extraction of an error-propagation path and a context trace, and then feeds this information to Claude 3.5 Sonnet through structured prompting to generate a patch. The central empirical claim is that LTFix repairs 37 of 49 real-world memory errors from 14 open-source projects, surpassing SAVER and ProveNFix by stated factors, fixing three zero-day errors accepted by developers, and consuming far fewer tokens than SWE-agent. The paper also reports ablations showing the contribution of typestate-guided context retrieval.

Significance. If the empirical claims hold, LTFix would be a valuable contribution: it addresses the underexplored problem of interprocedural, repository-level memory error repair with LLMs, and its design is grounded in standard typestate formalisms rather than ad-hoc neural heuristics. The formalization of the error-propagation path and context trace is clear, the automata are taken from prior literature, and the ablation study is informative. However, the empirical contribution is currently not verifiable from the manuscript: no code, data, prompts, benchmark construction details, or validation artifacts are available, and several headline numbers in Section 5 are internally inconsistent. These issues are load-bearing for the paper's main claims and must be resolved before the results can be assessed.

major comments (4)
  1. [§5.5.1, Table 4] The headline counts are internally inconsistent. The LTFix #E✓ entries in Table 4 sum to 41 (3+1+2+5+3+1+1+12+2+2+4+2+2+1), not the stated total of 37. Per-project error counts also disagree with Table 2: tree is listed with 3 errors in Table 2 but 2 in Table 4, and recutiles with 5 in Table 2 but 6 in Table 4. In addition, the abstract's '14.50x and 2.36x more errors' do not match Table 4 totals: 37 vs. SAVER's #E✓=2 gives 18.5x, and 37 vs. ProveNFix's #E✓=11 gives 3.36x; using #Δ✓ instead gives 11x and 3.67x. Because the 37/49 count and the derived improvement ratios are the paper's central empirical claim, the tables and claims must be reconciled and re-verified.
  2. [§5.5.1, Table 4, Figure 8, §5.7] The claim that LTFix achieves its improvements 'without introducing any new errors' is contradicted by the paper's own data: Table 4's smallC row reports #Δ✗=1 for LTFix, Figure 8 shows #Δ✗=1 for LTFix, and Section 5.7 states that LTFix introduces one new error in the ablation. The safety claim should be restated to acknowledge this introduced error, or the tables and figures should be corrected.
  3. [Data Availability Statement] The paper states that implementation details and data will be made publicly available upon acceptance and that 'Full details will be disclosed upon paper acceptance' for the benchmark. Neither the code, the benchmark, the PoC inputs, the prompts, the generated patches, nor the ground-truth matching protocol are provided in the manuscript or supplement. Because the evaluation is entirely empirical and the benchmark was constructed by the authors, the headline numbers, the comparison margins, and the three zero-day fixes cannot be independently checked. Reviewer-accessible artifacts are essential for evaluating an empirical systems paper of this kind.
  4. [§5.1, §5.3] The benchmark construction and correctness validation involve judgment calls that are not described. The text says errors were 'confirmed by respective project developers,' that ground-truth fixes were collected from maintainers, and that a correct patch must be 'manually validated to align with the ground truth,' but the procedure for matching generated patches to ground truth, the error-to-project assignment, and the construction rules for PoC inputs are not given. Without this information, the fairness of the comparison and the correctness criterion are not assessable.
minor comments (6)
  1. [Table 2 vs. Table 4] Project names are inconsistent between tables: 'SmallerC' in Table 2 appears as 'smallC' in Table 4, and 'recutiles' is used in Table 4 while Table 2 and the case study use 'recutiles'/'recutils'. Use consistent naming and versions.
  2. [Table 3] Table 3 has duplicated '#E' column headers, making it unclear which counts belong to SAVER, ProveNFix, and LTFix. Add explicit per-tool column headers.
  3. [Figure 8] The caption contains the typo 'effectivenss', and the axis labels such as '#∆ #∆ ✓ #∆ O #∆ X #E✓' should be separated for readability.
  4. [§5.1] The consistency criterion of 'at least four out of five runs' is not fully specified: clarify whether an error is counted as fixed when four of five runs generate the same correct patch, and report per-run variance for the main results.
  5. [§5.2] There is a typo, 'Futhermore', in the paragraph describing SAVER and ProveNFix configuration.
  6. [Algorithm 1] The condition 'frame.addr = addr_e' on line 10 is not defined in GDB terms; specify how the error address is matched to the statement's memory operand, especially for memory leaks where the error is detected at program exit rather than at a use or free.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: typestate-guided context retrieval is extracted from actual execution and validated against external developer-provided ground truth; the self-citations are not load-bearing.

full rationale

LTFix's pipeline is not circular in the load-bearing sense. The finite typestate automata are taken from prior literature ([4,13,18,68], with [11] a non-load-bearing self-citation for general typestate analysis), and the automata are not derived from the LLM's output or from the benchmark's ground-truth patches. The error-propagation path and context trace are extracted with GDB from actual program execution (Algorithm 1) using only the error address, PoC input, and FTA; the LLM receives these as inputs and generates a patch. Correctness is validated against externally collected developer-approved patches ('we collect patches approved and implemented by project maintainers', §5.1) and against test-suite/fuzzing outcomes, not against the prompt inputs themselves. The 'Correctness' arguments for Algorithm 1 and rules [ETP]/[CXT] are definitional restatements of the paper's own Definitions 2-6, but they are internal formal consistency checks, not empirical predictions, so they do not constitute circular derivation. The main concerns noted elsewhere—the self-constructed, undisclosed benchmark and internal count discrepancies in Tables 2/4 and §5.5.1—are verifiability and correctness issues rather than circularity, and are out of scope for this pass.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The paper does not introduce new theoretical entities or physical objects. Its central claim rests on the benchmark construction, the typestate model of memory, and the reliance on GDB and Claude 3.5 Sonnet. No free parameters are fitted in the formal sense, but the benchmark and validation criteria are hand-curated, which is the main source of uncertainty.

free parameters (2)
  • Benchmark error set and ground-truth fixes = 49 errors across 14 projects
    The set of errors, their PoCs, and the ground-truth fixes were curated by the authors. The selection criteria and the exact comparison procedure are not disclosed, so the benchmark itself acts as a hand-chosen evaluation set that can influence the headline numbers.
  • Consistency threshold of 4 out of 5 runs = 80%
    The paper defines a result as valid if it is consistent in at least four out of five runs, but it does not specify what 'consistency' means in practice or how disagreements across runs were resolved when counting fixed errors.
assumptions (4)
  • domain assumption The finite typestate automata in Table 1 correctly model C heap memory operations for UAF, double-free, and memory leaks.
    The automata assume a simplified model of memory lifecycle (uninit, live, dead, error) and operations (alloc, free, use, realloc, set_null, exit). This model ignores aliasing complexity, reference counting, and some real-world APIs, so it is a domain assumption that may not hold for all programs.
  • domain assumption GDB step-by-step execution on the PoC input produces a full execution path that covers the error-triggering statement.
    Algorithm 1 assumes the error is deterministic under the PoC input and that GDB can step through the relevant execution without missing the error address. This is stated in the algorithm and is reasonable for replayed errors, but it is a load-bearing assumption about the debugging infrastructure.
  • domain assumption The error address (addr_e) provided by the dynamic analysis tool is sufficient to identify the memory object and its aliases.
    The algorithm filters typestate changes by comparing the current frame's address to addr_e. This assumes that the same address identifies the object being freed and used, which may fail for realloc or for aliased pointers that change addresses.
  • domain assumption Claude 3.5 Sonnet can generate semantically correct patches given the context trace, error report, and propagation path.
    The whole system depends on the capability of the specific commercial LLM. The paper acknowledges this by noting that LLM selection is a threat to validity, but the central claim is still contingent on this model's behavior.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Tracing Errors, Constructing Fixes: Repository-Level Memory Error Repair via Typestate-Guided Context Retrieval." pith.science (2026). https://pith.science/paper/QO52ZJBT

@misc{pith2026250618394,
  author       = {Pith},
  title        = {Pith review of: Tracing Errors, Constructing Fixes: Repository-Level Memory Error Repair via Typestate-Guided Context Retrieval},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QO52ZJBT}},
  note         = {Machine review of arXiv:2506.18394}
}
read the original abstract

Memory-related errors in C programming continue to pose significant challenges in software development, primarily due to the complexities of manual memory management inherent in the language. These errors frequently serve as vectors for severe vulnerabilities, while their repair requires extensive knowledge of program logic and C's memory model. Automated Program Repair (APR) has emerged as a critical research area to address these challenges. Traditional APR approaches rely on expert-designed strategies and predefined templates, which are labor-intensive and constrained by the effectiveness of manual specifications. Deep learning techniques offer a promising alternative by automatically extracting repair patterns, but they require substantial training datasets and often lack interpretability. This paper introduces LTFix, a novel approach that harnesses the potential of Large Language Models (LLMs) for automated memory error repair, especially for complex repository-level errors that span multiple functions and files. We address two fundamental challenges in LLM-based memory error repair: a limited understanding of interprocedural memory management patterns and context window limitations for repository-wide analysis. Our approach utilizes a finite typestate automaton to guide the tracking of error-propagation paths and context trace, capturing both spatial (memory states) and temporal (execution history) dimensions of error behavior. This typestate-guided context retrieval strategy provides the LLM with concise yet semantically rich information relevant to erroneous memory management, effectively addressing the token limitation of LLMs.

Figures

Figures reproduced from arXiv: 2506.18394 by the authors.

Figure 1
Figure 1. An overview of our framework. the location of the current point, the typestate transition, and the backtrace of the calling stack gathered at the current breakpoint. (c) Prompting LLM for Program Repair. Finally, we design a multi-step structured prompting method that incrementally deliver role and task description [64], error report, context trace and error-propagation path to the LLM for generating an appropriate … view at source ↗
Figure 2
Figure 2. A motivating example illustrating how LTFix repairs a use-after-free error. change point, we extract its associated context, which includes the typestate transition, the location, and the backtrace. The program contexts at the three typestate change points collectively form a context trace. For instance, in the final error context, the typestate transition indicates a shift from dead to error due to a use operation.… view at source ↗
Figure 3
Figure 3. An example of typestate transitions and program contexts. [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: The inference rule for typestate-guided error-propagation path extraction. [PITH_FULL_IMAGE:figures/full_fig_p012_4.png]
Figure 5
Figure 5. Figure 5: An example of context trace by revisiting Example [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: The inference rule for typestate-guided context trace construction. [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: LTFix’s patches for: (a) a memory leak in the recutiles [23] project; (b) a memory leak in the chibicc [61] project; (c) a double-free vulnerability (CVE-2023-38434 [58]) in the xHTTP [20] project; and (d) a memory leak error in the scrot [70] project. filename, extn);…
Figure 8
Figure 8. Figure 8: Comparison of fixing effectivenss between [PITH_FULL_IMAGE:figures/full_fig_p019_8.png]
Figure 9
Figure 9. Figure 9: Comparison of the number of tokens consumed by [PITH_FULL_IMAGE:figures/full_fig_p020_9.png]
Figure 10
Figure 10. Figure 10: Ablation analysis result. 5.7 Ablation Analysis (RQ3) [PITH_FULL_IMAGE:figures/full_fig_p021_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

99 extracted references · 70 canonical work pages

  1. [1]

    Alexander Borisov. 1999. Fast C/C++ HTML 5 Parser. https://github.com/lexborisov/myhtml

    1999

  2. [2]

    Alexey Frunze. 2021. Smaller C is a simple and small single-pass C compiler. https://github.com/alexfru/SmallerC

    2021

  3. [3]

    Anthropic. 2024. Claude 3.5 Sonnet. https://www.anthropic.com/news/claude-3-5-sonnet

    2024

  4. [4]

    Eric Bodden. 2010. Efficient hybrid typestate analysis by determining continuation-equivalent states. In2010 ACM/IEEE 32nd International Conference on Software Engineering (ICSE ’12) . ACM

    2010

  5. [5]

    Nikita Borisov, George Danezis, Prateek Mittal, and Parisa Tabriz. 2007. Denial of service or denial of security?. In Proceedings of the 14th ACM conference on Computer and communications security (CCS ’07) . ACM

    2007

  6. [6]

    Juan Caballero, Gustavo Grieco, Mark Marron, and Antonio Nappa. 2012. Undangle: early detection of dangling pointers in use-after-free and double-free vulnerabilities. InProceedings of the 2012 International Symposium on Software Testing and Analysis (ISSTA ’12)

    2012

  7. [7]

    Cesanta Software Limited. 2023. mJS: Restricted JavaScript engine. https://github.com/cesanta/mjs

    2023

  8. [8]

    Haogang Chen, Yandong Mao, Xi Wang, Dong Zhou, Nickolai Zeldovich, and M Frans Kaashoek. 2011. Linux kernel vulnerabilities: State-of-the-art defenses and open problems. In Proceedings of the Second Asia-Pacific Workshop on Systems. ACM

    2011

Show all 99 references
  1. [9]

    Zimin Chen, Steve Kommrusch, Michele Tufano, Louis-Noël Pouchet, Denys Poshyvanyk, and Martin Monperrus

  2. [10]

    Baijun Cheng, Cen Zhang, Kailong Wang, Ling Shi, Yang Liu, Haoyu Wang, Yao Guo, and Xiangqun Chen. 2024. Semantic-Enhanced Indirect Call Analysis with Large Language Models. In 39th IEEE/ACM International Conference on Automated Software Engineering (ASE ’24) . IEEE/ACM

    2024

  3. [11]

    Xiao Cheng, Jiawei Ren, and Yulei Sui. 2024. Fast Graph Simplification for Path-Sensitive Typestate Analysis through Tempo-Spatial Multi-Point Slicing. Proc. ACM Softw. Eng. FSE (2024)

    2024

  4. [12]

    CISA. 2023. The Urgent Need for Memory Safety in Software Products. https://www.cisa.gov/news-events/news/ urgent-need-memory-safety-software-products

    2023

  5. [13]

    Manuvir Das, Sorin Lerner, and Mark Seigle. 2002. ESP: Path-Sensitive Program Verification in Polynomial Time. In Proceedings of the ACM SIGPLAN 2002 conference on Programming language design and implementation (PLDI ’02) . ACM

    2002

  6. [14]

    Devanbu, and Vincent J

    Yangruibo Ding, Baishakhi Ray, Premkumar T. Devanbu, and Vincent J. Hellendoorn. 2020. Patching as Translation: the Data and the Metaphor. In 35th IEEE/ACM International Conference on Automated Software Engineering (ASE ’20)

    2020

  7. [15]

    DWARF Debugging Information Format Committee. 2017. DWARF Debugging Information Format Version 5. https: //dwarfstd.org/doc/DWARF5.pdf

    2017

  8. [16]

    Electrux. 2024. ls with coloring and icons. https://github.com/Electrux/ls_extended

    2024

  9. [17]

    Fabrice Bellard. 2021. QuickJS Javascript Engine. https://github.com/bellard/quickjs

    2021

  10. [18]

    Fink, Eran Yahav, Nurit Dor, G

    Stephen J. Fink, Eran Yahav, Nurit Dor, G. Ramalingam, and Emmanuel Geay. 2006. Effective typestate verification in the presence of aliasing. In Proceedings of the ACM/SIGSOFT International Symposium on Software Testing and Analysis , Vol. 1, No. 1, Article . Publication date:...

    2006

  11. [19]

    Andrea Fioraldi, Dominik Maier, Heiko Eißfeldt, and Marc Heuse. 2020. AFL++ : Combining Incremental Steps of Fuzzing Research. In 14th USENIX Workshop on Offensive Technologies (WOOT 20) . USENIX Association

    2020

  12. [20]

    Francesco Cozzuto. 2022. A lightweight HTTP server as a library. https://github.com/cozis/xHTTP

    2022

  13. [21]

    Free Software Foundation. 2011. Debugging with GDB. https://sourceware.org/gdb/current/onlinedocs/gdb.html

    2011

  14. [22]

    Free Software Foundation, Inc. 1991. A handy little utility to display a tree view of directories. https://github.com/ execjosh/tree

    1991

  15. [23]

    Free Software Foundation, Inc. 2007. GNU Recutils. https://www.gnu.org/software/recutils/

    2007

  16. [24]

    Free Software Foundation, Inc. 2007. Radare2: Libre Reversing Framework for Unix Geeks. https://github.com/ radareorg/radare2

    2007

  17. [25]

    Qing Gao, Yingfei Xiong, Yaqing Mi, Lu Zhang, Weikun Yang, Zhaoping Zhou, Bing Xie, and Hong Mei. 2015. Safe Memory-Leak Fixing for C Programs. In 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering (ICSE ’15)

    2015

  18. [26]

    Luca Gazzola, Daniela Micucci, and Leonardo Mariani. 2019. Automatic Software Repair: A Survey. IEEE Transactions on Software Engineering (2019)

    2019

  19. [27]

    Yaru Hao, Yutao Sun, Li Dong, Zhixiong Han, Yuxian Gu, and Furu Wei. 2022. Structured Prompting: Scaling In-Context Learning to 1,000 Examples

    2022

  20. [28]

    Seongjoon Hong, Junhee Lee, Jeongsoo Lee, and Hakjoo Oh. 2020. SAVER: scalable, precise, and safe memory-error repair. In Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering (ICSE ’20) . ACM

    2020

  21. [29]

    Kai Huang, Xiangxin Meng, Jian Zhang, Yang Liu, Wenjie Wang, Shuhao Li, and Yuqing Zhang. 2023. An Empirical Study on Fine-Tuning Large Language Models of Code for Automated Program Repair. In 38th IEEE/ACM International Conference on Automated Software Engineering, ASE 2023, ...

    2023

  22. [30]

    Qing Huang, Zhiwen Luo, Zhenchang Xing, Jinshan Zeng, Jieshan Chen, Xiwei Xu, and Yong Chen. 2024. Revealing the Unseen: AI Chain on LLMs for Predicting Implicit Data Flows to Generate Data Flow Graphs in Dynamically-Typed Code. ACM Transactions on Software Engineering and Met...

    2024

  23. [31]

    Nan Jiang, Thibaud Lutellier, Yiling Lou, Lin Tan, Dan Goldwasser, and Xiangyu Zhang. 2023. KNOD: Domain Knowledge Distilled Tree Decoder for Automated Program Repair. In 45th IEEE/ACM International Conference on Software Engineering (ICSE ’23) . IEEE

    2023

  24. [32]

    Nan Jiang, Thibaud Lutellier, and Lin Tan. 2021. CURE: Code-Aware Neural Machine Translation for Automatic Program Repair. In 43rd IEEE/ACM International Conference on Software Engineering (ICSE ’21) . IEEE

    2021

  25. [33]

    Matthew Jin, Syed Shahriar, Michele Tufano, Xin Shi, Shuai Lu, Neel Sundaresan, and Alexey Svyatkovskiy. 2023. InferFix: End-to-End Program Repair with LLMs. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Softw...

    2023

  26. [34]

    Harshit Joshi, José Pablo Cambronero Sánchez, Sumit Gulwani, Vu Le, Gust Verbruggen, and Ivan Radicek. 2023. Repair Is Nearly Generation: Multilingual Program Repair with LLMs. In Thirty-Seventh AAAI Conference on Artificial Intelligence, AAAI 2023, Thirty-Fifth Conference on ...

    2023

  27. [35]

    Le, David Lo, and Claire Le Goues

    Xuan Bach D. Le, David Lo, and Claire Le Goues. 2016. History Driven Program Repair. In 2016 IEEE 23rd International Conference on Software Analysis, Evolution, and Reengineering (SANER ’16)

    2016

  28. [36]

    Claire Le Goues, Michael Pradel, and Abhik Roychoudhury. 2019. Automated program repair. Commun. ACM (2019)

    2019

  29. [37]

    Byoungyoung Lee, Chengyu Song, Yeongjin Jang, Tielei Wang, Taesoo Kim, Long Lu, and Wenke Lee. 2015. Preventing Use-after-free with Dangling Pointers Nullification. In NDSS

    2015

  30. [38]

    Junhee Lee, Seongjoon Hong, and Hakjoo Oh. 2018. MemFix: static analysis-based repair of memory deallocation errors for C. In Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (FS...

    2018

  31. [39]

    Haonan Li, Yu Hao, Yizhuo Zhai, and Zhiyun Qian. 2024. Enhancing Static Analysis for Practical Bug Detection: An LLM-Integrated Approach. Proceedings of the ACM on Programming Languages OOPSLA1 (2024)

    2024

  32. [40]

    Yi Li, Shaohua Wang, and Tien N. Nguyen. 2020. DLFix: Context-based Code Transformation Learning for Automated Program Repair. In 2020 IEEE/ACM 42nd International Conference on Software Engineering (ICSE) . 602–614

    2020

  33. [41]

    Yi Li, Shaohua Wang, and Tien N. Nguyen. 2022. DEAR: a novel deep learning-based approach for automated program repair. In Proceedings of the 44th International Conference on Software Engineering (ICSE ’22) . ACM

    2022

  34. [42]

    Bissyandé, Dongsun Kim, Peng Wu, Jacques Klein, Xiaoguang Mao, and Yves Le Traon

    Kui Liu, Shangwen Wang, Anil Koyuncu, Kisub Kim, Tegawendé F. Bissyandé, Dongsun Kim, Peng Wu, Jacques Klein, Xiaoguang Mao, and Yves Le Traon. 2020. On the efficiency of test suite based program repair: A Systematic Assessment of 16 Automated Repair Systems for Java Programs....

    2020

  35. [43]

    Nelson F Liu, Kevin Lin, John Hewitt, Ashwin Paranjape, Michele Bevilacqua, Fabio Petroni, and Percy Liang. 2024. Lost in the middle: How language models use long contexts. Transactions of the Association for Computational Linguistics (2024)

    2024

  36. [44]

    Thibaud Lutellier, Hung Viet Pham, Lawrence Pang, Yitong Li, Moshi Wei, and Lin Tan. 2020. CoCoNuT: combining context-aware neural translation models using ensemble for program repair. In Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analy...

    2020

  37. [45]

    Ehsan Mashhadi and Hadi Hemmati. 2021. Applying CodeBERT for Automated Program Repair of Java Simple Bugs. In 18th IEEE/ACM International Conference on Mining Software Repositories (MSR ’21) . IEEE

    2021

  38. [46]

    Sergey Mechtaev, Jooyong Yi, and Abhik Roychoudhury. 2015. DirectFix: Looking for Simple Program Repairs. In 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering (ICSE ’15)

    2015

  39. [47]

    Sergey Mechtaev, Jooyong Yi, and Abhik Roychoudhury. 2016. Angelix: Scalable multiline program patch synthesis via symbolic analysis. In Proceedings of the 38th International Conference on Software Engineering . ACM, 691–701

    2016

  40. [48]

    Meta. 2021. A static analyzer for Java, C, C++, and Objective-C. https://fbinfer.com/

    2021

  41. [49]

    MITRE. 2024. CWE-401: Missing Release of Memory after Effective Lifetime. https://cwe.mitre.org/data/definitions/ 401.html

    2024

  42. [50]

    MITRE. 2024. CWE-415: Double Free. https://cwe.mitre.org/data/definitions/415.html

    2024

  43. [51]

    MITRE. 2024. CWE-416: Use After Free. https://cwe.mitre.org/data/definitions/416.html

    2024

  44. [52]

    Martin Monperrus. 2018. Automatic Software Repair: A Bibliography. ACM Comput. Surv. (2018)

    2018

  45. [53]

    Murali, M

    A. Murali, M. Alfadel, M. Nagappan, M. Xu, and C. Sun. 2024. AddressWatcher: Sanitizer based Localization of Memory Leak Fixes. IEEE Transactions on Software Engineering (2024)

    2024

  46. [54]

    Nicholas Nethercote and Julian Seward. 2007. Valgrind: a framework for heavyweight dynamic binary instrumentation. In Proceedings of the 28th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI ’07) . ACM

    2007

  47. [55]

    Hoang Duong Thien Nguyen, Dawei Qi, Abhik Roychoudhury, and Satish Chandra. 2013. SemFix: Program repair via semantic analysis. In 2013 35th International Conference on Software Engineering (ICSE) . 772–781. https://doi.org/10. 1109/ICSE.2013.6606623

    2013

  48. [56]

    Thanh-Toan Nguyen, Quang-Trung Ta, Ilya Sergey, and Wei-Ngan Chin. 2021. Automated Repair of Heap-Manipulating Programs Using Deductive Synthesis. InVerification, Model Checking, and Abstract Interpretation, Fritz Henglein, Sharon Shoham, and Yakir Vizel (Eds.)

    2021

  49. [57]

    NIST. 2019. CVE-2019-6455. https://nvd.nist.gov/vuln/detail/CVE-2019-6455

    2019

  50. [58]

    NIST. 2023. CVE-2023-38434. https://nvd.nist.gov/vuln/detail/CVE-2023-38434

    2023

  51. [59]

    Kexin Pei, David Bieber, Kensen Shi, Charles Sutton, and Pengcheng Yin. 2023. Can large language models reason about program invariants?. In International Conference on Machine Learning . PMLR, 27496–27520

    2023

  52. [60]

    Peter Johnson and other Yasm developers. 2014. Yasm Assembler mainline development tree. https://yasm.tortall.net/

    2014

  53. [61]

    Rui Ueyama. 2019. chibicc: A Small C Compiler. https://github.com/rui314/chibicc.git

    2019

  54. [62]

    Sean Barrett. 2017. stb single-file public domain libraries for C/C++. https://github.com/nothings/stb

    2017

  55. [63]

    Konstantin Serebryany, Derek Bruening, Alexander Potapenko, and Dmitriy Vyukov. 2012. AddressSanitizer: A Fast Address Sanity Checker. In 2012 USENIX Annual Technical Conference (USENIX ATC 12) . USENIX Association

    2012

  56. [64]

    Murray Shanahan, Kyle McDonell, and Laria Reynolds. 2023. Role play with large language models. Nature 623, 7987 (2023), 493–498

    2023

  57. [65]

    Congzheng Song and Ananth Raghunathan. 2020. Information leakage in embedding models. In Proceedings of the 2020 ACM SIGSAC conference on computer and communications security . 377–390

    2020

  58. [66]

    Yahui Song, Xiang Gao, Wenhua Li, Wei-Ngan Chin, and Abhik Roychoudhury. 2024. ProveNFix: Temporal Property- Guided Program Repair. Proc. ACM Softw. Eng. FSE (2024)

    2024

  59. [67]

    Steven Massey, Volodymyr Shymanskyy. 2019. A fast WebAssembly interpreter and the most universal WASM runtime. https://github.com/wasm3/wasm3

    2019

  60. [68]

    Strom and Shaula Yemini

    Robert E. Strom and Shaula Yemini. 1986. Typestate: A programming language concept for enhancing software reliability. IEEE Transactions on Software Engineering (1986)

    1986

  61. [69]

    Yulei Sui, Ding Ye, and Jingling Xue. 2012. Static memory leak detection using full-sparse value-flow analysis. In Proceedings of the 2012 International Symposium on Software Testing and Analysis (ISSTA ’12)

    2012

  62. [70]

    Tom Gilbert. 2000. SCReenshOT - command line screen capture utility. https://github.com/resurrecting-open-source- projects/scrot

    2000

  63. [71]

    Michele Tufano, Cody Watson, Gabriele Bavota, Massimiliano Di Penta, Martin White, and Denys Poshyvanyk. 2019. An Empirical Study on Learning Bug-Fixing Patches in the Wild via Neural Machine Translation. ACM Trans. Softw. Eng. Methodol. (2019)

    2019

  64. [72]

    Rijnard van Tonder and Claire Le Goues. 2018. Static automated program repair for heap properties. In Proceedings of the 40th International Conference on Software Engineering (ICSE ’18) . ACM. , Vol. 1, No. 1, Article . Publication date: September 2025. Tracing Errors, Constru...

    2018

  65. [73]

    Chengpeng Wang, Jipeng Zhang, Rongxin Wu, and Charles Zhang. 2024. DAInfer: Inferring API Aliasing Specifications from Library Documentation via Neurosymbolic Optimization. Proc. ACM Softw. Eng. FSE (2024)

    2024

  66. [74]

    Chengpeng Wang, Wuqi Zhang, Zian Su, Xiangzhe Xu, Xiaoheng Xie, and Xiangyu Zhang. 2025. LLMDFA: Analyzing Dataflow in Code with Large Language Models. Advances in Neural Information Processing Systems 37 (2025), 131545– 131574

    2025

  67. [75]

    Chengpeng Wang, Wuqi Zhang, Zian Su, Xiangzhe Xu, and Xiangyu Zhang. 2024. Sanitizing Large Language Models in Bug Detection with Data-Flow. In Findings of the Association for Computational Linguistics: EMNLP 2024 , Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen (Eds.). Ass...

    2024 doi

  68. [76]

    Haijun Wang, Xiaofei Xie, Shang-Wei Lin, Yun Lin, Yuekang Li, Shengchao Qin, Yang Liu, and Ting Liu. 2019. Locating vulnerabilities in binaries via memory layout recovering. InProceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Sympos...

    2019

  69. [77]

    Xu, Xiangru Tang, Mingchen Zhuge, Jiayi Pan, Yueqi Song, Bowen Li, Jaskirat Singh, Hoang H

    Xingyao Wang, Boxuan Li, Yufan Song, Frank F. Xu, Xiangru Tang, Mingchen Zhuge, Jiayi Pan, Yueqi Song, Bowen Li, Jaskirat Singh, Hoang H. Tran, Fuqiang Li, Ren Ma, Mingzhang Zheng, Bill Qian, Yanjun Shao, Niklas Muennighoff, Yizhe Zhang, Binyuan Hui, Junyang Lin, Robert Brenna...

    2024 arXiv

  70. [78]

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al . 2022. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems 35 (2022), 24824–24837

    2022

  71. [79]

    Yuxiang Wei, Chunqiu Steven Xia, and Lingming Zhang. 2023. Copiloting the Copilots: Fusing Large Language Models with Completion Engines for Automated Program Repair. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations...

    2023

  72. [80]

    Cheng Wen, Jialun Cao, Jie Su, Zhiwu Xu, Shengchao Qin, Mengda He, Haokun Li, Shing-Chi Cheung, and Cong Tian

  73. [81]

    Chunqiu Steven Xia, Yuxiang Wei, and Lingming Zhang. 2023. Automated Program Repair in the Era of Large Pre-trained Language Models. In 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE ’23)

    2023

  74. [82]

    Chunqiu Steven Xia and Lingming Zhang. 2023. Keep the Conversation Going: Fixing 162 out of 337 bugs for $0.42 each using ChatGPT. CoRR (2023)

    2023

  75. [83]

    Jiahong Xiang, Xiaoyang Xu, Fanchu Kong, Mingyuan Wu, Haotian Zhang, and Yuqun Zhang. 2024. How Far Can We Go with Practical Function-Level Program Repair? arXiv preprint arXiv:2404.12833 (2024)

    2024 arXiv

  76. [84]

    Yichen Xie and Alex Aiken. 2005. Context-and path-sensitive memory leak detection. In Proceedings of the 10th European software engineering conference held jointly with 13th ACM SIGSOFT international symposium on Foundations of software engineering. 115–125

    2005

  77. [85]

    Reiss, and Jifeng Xuan

    Qi Xin, Haojun Wu, Jinran Tang, Xinyu Liu, Steven P. Reiss, and Jifeng Xuan. 2024. Detecting, Creating, Repairing, and Understanding Indivisible Multi-Hunk Bugs. Proc. ACM Softw. Eng. FSE (2024)

    2024

  78. [86]

    Wen Xu, Juanru Li, Junliang Shu, Wenbo Yang, Tianyi Xie, Yuanyuan Zhang, and Dawu Gu. 2015. From collision to exploitation: Unleashing use-after-free vulnerabilities in linux kernel. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security . 414–425

    2015

  79. [87]

    Xuezheng Xu, Yulei Sui, Hua Yan, and Jingling Xue. 2019. VFix: Value-Flow-Guided Precise Program Repair for Null Pointer Dereferences. In 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE) . 512–523. https://doi.org/10.1109/ICSE.2019.00063

    2019

  80. [88]

    Hua Yan, Yulei Sui, Shiping Chen, and Jingling Xue. 2018. Spatio-temporal context reduction: a pointer-analysis-based static approach for detecting use-after-free vulnerabilities. In Proceedings of the 40th International Conference on Software Engineering (ICSE ’18) . ACM

    2018

  81. [89]

    John Yang, Carlos E Jimenez, Alexander Wettig, Kilian Lieret, Shunyu Yao, Karthik R Narasimhan, and Ofir Press

  82. [90]

    He Ye, Matias Martinez, Xiapu Luo, Tao Zhang, and Martin Monperrus. 2022. SelfAPR: Self-supervised Program Repair with Test Execution Diagnostics. In 37th IEEE/ACM International Conference on Automated Software Engineering (ASE ’22). ACM

    2022

  83. [91]

    He Ye, Matias Martinez, and Martin Monperrus. 2022. Neural Program Repair with Execution-based Backpropagation. In 44th IEEE/ACM 44th International Conference on Software Engineering (ICSE ’22) . ACM

    2022

  84. [92]

    In The Thirty-eighth Annual Conference on Neural Information Processing Systems

    SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering. In The Thirty-eighth Annual Conference on Neural Information Processing Systems . https://arxiv.org/abs/2405.15793

    arXiv

  85. [93]

    Quanjun Zhang, Chunrong Fang, Tongke Zhang, Bowen Yu, Weisong Sun, and Zhenyu Chen. 2023. Gamma: Revisiting Template-Based Automated Program Repair Via Mask Prediction. In 38th IEEE/ACM International Conference on Automated Software Engineering (ASE ’23) . IEEE

    2023

  86. [94]

    Yuntong Zhang, Haifeng Ruan, Zhiyu Fan, and Abhik Roychoudhury. 2024. AutoCodeRover: Autonomous Program Improvement. CoRR (2024)

    2024

  87. [95]

    Kechi Zhang, Jia Li, Ge Li, Xianjie Shi, and Zhi Jin. 2024. CodeAgent: Enhancing Code Generation with Tool-Integrated Agent Systems for Real-World Repo-level Coding Challenges. arXiv:2401.07339 [cs.SE] https://arxiv.org/abs/2401.07339 , Vol. 1, No. 1, Article . Publication dat...

    2024 arXiv

  88. [96]

    Qihao Zhu, Zeyu Sun, Wenjie Zhang, Yingfei Xiong, and Lu Zhang. 2023. Tare: Type-Aware Neural Program Repair. In 45th IEEE/ACM International Conference on Software Engineering (ICSE ’23) . IEEE. , Vol. 1, No. 1, Article . Publication date: September 2025

    2023

  89. [98]

    Qihao Zhu, Zeyu Sun, Yuan-an Xiao, Wenjie Zhang, Kang Yuan, Yingfei Xiong, and Lu Zhang. 2021. A syntax-guided edit decoder for neural program repair. In 29th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE ...

    2021

  90. [2021]

    IEEE Trans

    SequenceR: Sequence-to-Sequence Learning for End-to-End Program Repair. IEEE Trans. Software Eng. (2021)

    2021

  91. [2024]

    In Computer Aided Verification

    Enchanting Program Specification Synthesis by Large Language Models Using Static Analysis and Program Verification. In Computer Aided Verification. Springer Nature Switzerland

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.