Software development life cycle is profoundly influenced by bugs: their introduction, identification, and eventual resolution account for a significant portion of software cost. This has motivated software engineering researchers and practitioners to propose different approaches for automating the identification and repair of software defects. Large language models have been adapted to the program repair task through few-shot demonstration learning and instruction prompting, treating this as an infilling task. However, these models have only focused on learning general bug-fixing patterns for uncategorized bugs mined from public repositories. In this paper, we propose InferFix: a transformer-based program repair framework paired with a state-of-the-art static analyzer to fix critical security and performance bugs. InferFix combines a Retriever -- transformer encoder model pretrained via contrastive learning objective, which aims at searching for semantically equivalent bugs and corresponding fixes; and a Generator -- a large language model (Codex Cushman) finetuned on supervised bug-fix data with prompts augmented via bug type annotations and semantically similar fixes retrieved from an external non-parametric memory. To train and evaluate our approach, we curated InferredBugs, a novel, metadata-rich dataset of bugs extracted by executing the Infer static analyzer on the change histories of thousands of Java and C# repositories. Our evaluation demonstrates that InferFix outperforms strong LLM baselines, with a top-1 accuracy of 65.6% for generating fixes in C# and 76.8% in Java. We discuss the deployment of InferFix alongside Infer at Microsoft which offers an end-to-end solution for detection, classification, and localization of bugs, as well as fixing and validation of candidate patches, integrated in the continuous integration pipeline to automate the software development workflow.

翻译：软件开发生命周期深受缺陷影响：缺陷的引入、识别及最终解决占据了软件成本的显著部分。这促使软件工程研究人员和从业者提出多种自动化识别与修复软件缺陷的方法。大语言模型已通过少样本演示学习和指令提示被适配至程序修复任务，将其视为一种填充任务。然而，现有模型仅聚焦于从公开代码仓库挖掘的未分类缺陷中学习通用修复模式。本文提出InferFix：一种结合先进静态分析仪的基于Transformer的程序修复框架，专用于修复关键安全与性能缺陷。InferFix融合了两大组件：检索器——基于对比学习目标预训练的Transformer编码器模型，旨在搜索语义等价的缺陷及其对应修复；生成器——在监督修复数据上微调的大语言模型（Codex Cushman），其提示通过缺陷类型注释和从外部非参数记忆库检索的语义相似修复进行增强。为训练和评估我们的方法，我们构建了InferredBugs——一个富含元数据的新型缺陷数据集，通过将Infer静态分析仪应用于数千个Java和C#仓库的变更历史而提取。评估表明，InferFix在C#修复生成中达到65.6%的Top-1准确率，在Java中达到76.8%，显著优于强基线大语言模型。我们讨论了InferFix与Infer在微软的联合部署方案，该方案提供从缺陷检测、分类、定位到候选补丁修复与验证的端到端解决方案，并集成至持续集成流水线以实现软件开发工作流的自动化。