Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

PathFix: Automated Program Repair with Expected Path

Xu He, Shu Wang, Kun Sun

TL;DR

PathFix tackles two persistent challenges in automated program repair: imprecise specifications and patch overfitting. It introduces a path-sensitive approach that derives exact expected-path constraints from correct executions, enabling precise patch synthesis via a component-based solver, with a verification loop to avoid overfitting. An LLM-enhanced integration augments specification inference, constraint summarization, and patch generation to handle complex control-flow constructs such as loops and recursion, improving scalability. Empirical evaluation on QuixBugs and real Busybox/Coreutils bugs shows PathFix surpasses existing static-analysis-based and LLM-based methods in repair success and efficiency, validating the practical impact of combining rigorous path constraints with AI-assisted synthesis. The work highlights a promising direction for reliable APR in real-world software pipelines, while noting limitations in recursion-heavy and deeply nested contexts that warrant further loop invariants and more robust LLM tooling.

Abstract

Automated program repair (APR) techniques are effective in fixing inevitable defects in software, enhancing development efficiency and software robustness. However, due to the difficulty of generating precise specifications, existing APR methods face two main challenges: generating too many plausible patch candidates and overfitting them to partial test cases. To tackle these challenges, we introduce a new APR method named PathFix, which leverages path-sensitive constraints extracted from correct execution paths to generate patches for repairing buggy code. It is based on one observation: if a buggy program is repairable, at least one expected path is supposed to replace the fault path in the patched program. PathFix operates in four main steps. First, it traces fault paths reaching the fault output in the buggy program. Second, it derives expected paths by analyzing the desired correct output on the control flow graph, where an expected path defines how a feasible patch leads to the correct execution. Third, PathFix generates and evaluates patches by solving state constraints along the expected path. Fourth, we validate the correctness of the generated patch. To further enhance repair performance and mitigate scalability issues introduced by path-sensitive analysis, we integrate a large language model (LLM) into our framework. Experimental results show that PathFix outperforms existing solutions, particularly in handling complex program structures such as loops and recursion.

PathFix: Automated Program Repair with Expected Path

TL;DR

PathFix tackles two persistent challenges in automated program repair: imprecise specifications and patch overfitting. It introduces a path-sensitive approach that derives exact expected-path constraints from correct executions, enabling precise patch synthesis via a component-based solver, with a verification loop to avoid overfitting. An LLM-enhanced integration augments specification inference, constraint summarization, and patch generation to handle complex control-flow constructs such as loops and recursion, improving scalability. Empirical evaluation on QuixBugs and real Busybox/Coreutils bugs shows PathFix surpasses existing static-analysis-based and LLM-based methods in repair success and efficiency, validating the practical impact of combining rigorous path constraints with AI-assisted synthesis. The work highlights a promising direction for reliable APR in real-world software pipelines, while noting limitations in recursion-heavy and deeply nested contexts that warrant further loop invariants and more robust LLM tooling.

Abstract

Automated program repair (APR) techniques are effective in fixing inevitable defects in software, enhancing development efficiency and software robustness. However, due to the difficulty of generating precise specifications, existing APR methods face two main challenges: generating too many plausible patch candidates and overfitting them to partial test cases. To tackle these challenges, we introduce a new APR method named PathFix, which leverages path-sensitive constraints extracted from correct execution paths to generate patches for repairing buggy code. It is based on one observation: if a buggy program is repairable, at least one expected path is supposed to replace the fault path in the patched program. PathFix operates in four main steps. First, it traces fault paths reaching the fault output in the buggy program. Second, it derives expected paths by analyzing the desired correct output on the control flow graph, where an expected path defines how a feasible patch leads to the correct execution. Third, PathFix generates and evaluates patches by solving state constraints along the expected path. Fourth, we validate the correctness of the generated patch. To further enhance repair performance and mitigate scalability issues introduced by path-sensitive analysis, we integrate a large language model (LLM) into our framework. Experimental results show that PathFix outperforms existing solutions, particularly in handling complex program structures such as loops and recursion.
Paper Structure (27 sections, 8 equations, 7 figures, 5 tables)

This paper contains 27 sections, 8 equations, 7 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Expected Path
  4. LLM enhanced Static Analysis and Program Repair
  5. A Motivating Example
  6. Limitations of Existing Solutions
  7. PathFix Workflow
  8. System Design
  9. Fault Path Identification
  10. Specification Inference
  11. Patch Synthesis
  12. Patch Verification
  13. LLM Enhancement
  14. Evaluation
  15. Experimental Setup
  16. ...and 12 more sections

Figures (7)

  • Figure 1: The expected and fault paths in the target program.
  • Figure 2: Specification inference (the expected paths and variable states in path constraints).
  • Figure 3: The static-analysis-based framework of PathFix. (LLM is plugged into 3 steps: Path Pruning, Constraint Summarization, and Patch Synthesis)
  • Figure 4: Three patterns of expected paths in the target program.
  • Figure 5: LLM-enhanced Workflow: Step 1. Identify invalid expected paths.
  • ...and 2 more figures

Theorems & Definitions (1)

  • proof