Meta (Facebook)

Verified evidenceCreator to judgeStraight-through

Getafix automated patch suggestion and validation for null-dereference bugs

Routine static-analysis bugs can receive machine-proposed patches behind compilation and analyzer-clean gates.

Software engineering · Global engineering organisation; workflow applies inside Facebook's production codebase, including a bounded Instagram-subset backlog experiment

Collections: Human still decides · Queue eliminated

An editorial scene for Meta (Facebook) contrasts reports a bug or crash against a specific line of code. with reports a bug against a specific line and forwards its metadata to getafix. in the getafix automated patch suggestion and validation for null-dereference bugs workflow.

Executive brief

The operating-model shift, in one view.

The instructive part is the layering of gates. Getafix does not hand engineers every candidate; it hands them only the ones that already compile and satisfy the analyser (and, via SapFix, pass the failing test). That is what makes reviewer-role work economically — the engineer never spends time on a proposal that would fail the basic checks a compiler and analyser can already run. It is also honest about scope: the 53% headline is a bounded Instagram backlog result, and the smaller +6-point / +8-point production lifts on return-not-nullable and field-not-nullable are what actually run at Facebook scale.

AI value · Instagram null-method-call backlog: proportion of bugs successfully auto-patched

Verified

Getafix attempted patches for about 60% of the ~2,000 null-method-call bugs; about 90% of attempted patches passed automated validation (compilable and Infer no longer emitted the warning); overall, 1,077 bugs (approximately 53%) were successfully auto-patched.

This is a scoped backlog experiment inside one codebase (Instagram), not a company-wide production acceptance rate.

Before

Reports a bug or crash against a specific line of code. → Reads the report and context, then manually authors a patch such as a null check or annotation. → Compiles, runs tests, and either lands the patch or iterates. → Accumulates static-analysis findings because routine remediation loses priority to feature work.

After

Reports a bug against a specific line and forwards its metadata to Getafix. → Selects a fix pattern using hierarchical clustering and anti-unification mined from thousands of past human patches. → Compiles the patch and reruns the analyzer; Sapienz cases also rerun the crash-triggering test. → Reviews the proposed…

Human boundary

Why it matters

Routine static-analysis bugs can receive machine-proposed patches behind compilation and analyzer-clean gates.

How the work changed

Before

How the work ran before the change.

Step 1 of 4
Static-analysis or automated test-generation tool
Reports a bug or crash against a specific line of code.
ControlAnalyser rules define what counts as a bug.
Step 2 of 4
Facebook engineer
Reads the report and context, then manually authors a patch such as a null check or annotation.
ControlEngineer's own judgement and lint-rule guidance; routine remediation competes for time with higher-complexity work.
Step 3 of 4
Facebook engineer and reviewer
Compiles, runs tests, and either lands the patch or iterates.
ControlHuman review and existing test suite.
Step 4 of 4
Engineering leadership
Accumulates static-analysis findings because routine remediation loses priority to feature work.
ControlNo dedicated capability for closing a backlog at scale.

What changed

Routine static-analysis bugs can receive machine-proposed patches behind compilation and analyzer-clean gates.

Decision rightHuman moves from creator to judge

After

How the same work runs now.

Step 1 of 4
Static-analysis or automated test-generation tool
Reports a bug against a specific line and forwards its metadata to Getafix.
ControlSame analyser rules.
Step 2 of 4
Getafix
Selects a fix pattern using hierarchical clustering and anti-unification mined from thousands of past human patches.
ControlPattern-ranking strategy: more specific patterns beat more general ones for a given context; unmodified surrounding code is included as pattern context, which restricts application to plausible sites.
Step 3 of 4
Automated validation
Compiles the patch and reruns the analyzer; Sapienz cases also rerun the crash-triggering test.
ControlOnly fixes that are compilable and analyser-clean (and, for Sapienz, test-passing) are surfaced.
Step 4 of 4
Facebook engineer
Reviews the proposed patch in the code-review portal and accepts, rejects, or replaces it.
ControlHuman review remains the acceptance gate; complex or rejected cases stay in the human exception path.

Process model built from the published workflow evidence for Meta (Facebook). Every step, actor, and control appears in full below.

Every step, actor, and control

Exception path

For a given bug: Getafix may decline to attempt a patch (about 40% of Instagram null-method-call bugs); an attempted patch may fail automated validation (compile or analyser-clean check) and is discarded; an engineer may reject a validated patch during code review; Getafix also flows candidate patches into SapFix, which retries against test outcomes. In every case the engineer remains the last reviewer, and non-null-dereference patterns remain out of scope.

Work removed

Manual authoring of routine null-dereference patches for the mined pattern families
Manual walk-through of Infer's blamed variable and surrounding context to construct the patch
Compile-and-re-run cycles to confirm the analyser is satisfied by the patch

Decision authority

Meta engineering sets which analyser patterns Getafix may attempt (initially Infer null-method-call and related null-pointer patterns) and the pattern-ranking strategy. Getafix decides whether to attempt a patch for a given bug and which specific patch to propose; the human engineer decides whether the surfaced patch lands. For the Instagram null-method-call backlog experiment, Meta expanded Getafix's authority to attempt patches on the full ~2,000-bug set and reports the automated success rate at each gate.

Before

01
Static-analysis or automated test-generation tool
Reports a bug or crash against a specific line of code.
Control: Analyser rules define what counts as a bug.
02
Facebook engineer
Reads the report and context, then manually authors a patch such as a null check or annotation.
Control: Engineer's own judgement and lint-rule guidance; routine remediation competes for time with higher-complexity work.
03
Facebook engineer and reviewer
Compiles, runs tests, and either lands the patch or iterates.
Control: Human review and existing test suite.
04
Engineering leadership
Accumulates static-analysis findings because routine remediation loses priority to feature work.
Control: No dedicated capability for closing a backlog at scale.

After

01
Static-analysis or automated test-generation tool
Reports a bug against a specific line and forwards its metadata to Getafix.
Control: Same analyser rules.
02
Getafix
Selects a fix pattern using hierarchical clustering and anti-unification mined from thousands of past human patches; instantiates the pattern using the blamed variable and surrounding code context; produces a candidate patch.
Control: Pattern-ranking strategy: more specific patterns beat more general ones for a given context; unmodified surrounding code is included as pattern context, which restricts application to plausible sites.
03
Automated validation
Compiles the patch and reruns the analyzer; Sapienz cases also rerun the crash-triggering test.
Control: Only fixes that are compilable and analyser-clean (and, for Sapienz, test-passing) are surfaced.
04
Facebook engineer
Reviews the proposed patch in the code-review portal and accepts, rejects, or replaces it.
Control: Human review remains the acceptance gate; complex or rejected cases stay in the human exception path.

Work that left the path

Manual authoring of routine null-dereference patches for the mined pattern families
Manual walk-through of Infer's blamed variable and surrounding context to construct the patch
Compile-and-re-run cycles to confirm the analyser is satisfied by the patch
Deferred remediation of previously-accepted Infer bugs sitting in a backlog for lack of engineer capacity

Human role before

Facebook engineers authored every patch for Infer-reported null dereferences and null-dereference crashes, and separately worked or deferred a backlog of previously accepted static-analysis findings.

Human role after

For the routine patterns Getafix mines, engineers shift from patch authors to patch reviewers with final accept/reject authority; the exception path — anything Getafix does not attempt, cannot validate, or the engineer rejects — is where engineer effort concentrates.

AI roleLearned patch generator plus automated validator. Getafix mines hierarchical fix patterns (with anti-unification for generalisation) from thousands of past human patches, instantiates them for a specific bug and its blamed variable, and only surfaces the patches that pass automated compile + analyser-clean checks. Getafix also feeds fix candidates to SapFix, which addresses Sapienz-detected crashes.

Outcomes

Instagram null-method-call backlog: proportion of bugs successfully auto-patched

Verified

Prior to Getafix, none of the ~2,000 Instagram null-method-call bugs in the backlog had an automatically-generated, validated patch offered against them.→Getafix attempted patches for about 60% of the ~2,000 null-method-call bugs; about 90% of attempted patches passed automated validation (compilable and Infer no longer emitted the warning); overall, 1,077 bugs (approximately 53%) were successfully auto-patched.

One-shot backlog experiment reported in the 2018-11-06 disclosure; specific run window not stated. · 'About 2,000' null-method-call bugs in a defined subset of the Instagram codebase.

This is a scoped backlog experiment inside one codebase (Instagram), not a company-wide production acceptance rate. 'Successfully automatically patched' means the patch was compilable and the analyser no longer emitted the warning; whether human review subsequently landed every one of the 1,077 patches is not separately quantified in the source.

Fix rate on return-not-nullable and field-not-nullable Infer bugs after Getafix suggestions were displayed alongside the bug reports

Verified

Prior to displaying Getafix suggestions: 56% of return-not-nullable and 51% of field-not-nullable Infer bugs were being fixed.→After Getafix suggestions were displayed: 62% of return-not-nullable and 59% of field-not-nullable bugs were fixed; Meta attributes a 'couple of hundred' additional fixes over the prior three months to the display of the auto-fixes.

Approximately three months prior to the 2018-11-06 publication. · Facebook's Infer return-not-nullable and field-not-nullable bug backlog during that three-month window (absolute counts not disclosed).

The lift is Meta-defined and Meta-measured; it captures whether a bug is fixed at all, not who authored the final landed patch. Meta explicitly attributes the additional fixes to displaying Getafix suggestions, but the source does not decompose the effect into 'engineer accepted the patch verbatim' vs 'engineer used it as inspiration'.

Share of SapFix's valid fix candidates supplied by Getafix

Verified

Under a purely engineer-authored patch flow, Getafix supplies 0% of SapFix's fix candidates.→Over the months preceding the 2018-11-06 disclosure, Getafix provided 'about half of the fix candidates that SapFix uses and considers valid' (all tests passed); of all Getafix-supplied candidates to SapFix, approximately 80% pass all tests.

Preceding months, ending at the 2018-11-06 publication. · SapFix's Sapienz-driven crash-fix pipeline at Facebook (absolute crash-fix counts not disclosed).

Meta-measured; the source does not disaggregate SapFix's total volume or per-crash acceptance rate. 'About half' is stated verbatim in the primary source.

What leaders can reuse

Anti-pattern

Reporting the Instagram 53% as if it were a company-wide production auto-fix acceptance rate. It is a bounded backlog experiment on one bug pattern in one codebase; the production-scale signal is the +6-percentage-point fix-rate lift on return-not-nullable and +8 on field-not-nullable when suggestions are shown. Conflating the two overstates the case exactly where a skeptical reader will check.

Questions

01Which bug patterns in our codebase are common enough that mining past patches would yield reusable fix templates?
02What is our equivalent of the compile-plus-analyser-clean gate that would let a proposed patch reach an engineer only if it already passes the cheap checks?
03What is the scope discipline that stops the auto-fixer from attempting a pattern it does not understand?
04How do we separate backlog remediation from feature-time remediation so the auto-fixer is measured against the right baseline?
05How do we report our results — as an experiment on a defined subset, or as a company-wide acceptance rate — and would we survive the skeptical read?

Portability conditions

A large repository of past human patches to mine, with the bug they resolved attached
A static analyser (or equivalent oracle) whose output can be used as an automated 'fix accepted' signal after re-analysis
A patch-review UI where a proposed patch can be surfaced next to the bug report without disrupting normal review
A well-defined pattern scope so the tool declines rather than guesses on unfamiliar bug categories
An acceptance that the initial value is in backlog and routine-remediation work, not in complex bug categories

Reputation risk

low: this is a Meta-internal developer-tools deployment with no direct customer-safety implication; every load-bearing figure is stated verbatim in Meta's own engineering blog. The primary reputational risk is misreading the Instagram 53% as a company-wide acceptance rate; the case must always be presented with the +6 / +8 percentage-point production lift as the wider-scope evidence.

Evidence and authority

What the public record supports.

Current · updated 2026-08-22

1 primary; publication outcomes are verified.

Bundle 1.0.0 · reviewed 2026-08-23 · stable ID bd5333cfd5519472

Sources

Getafix: How Facebook tools learn to fix bugs automaticallyEngineering at Meta (Facebook) · 2018-11-06 · primary

Read the evidence, freshness, caveat, and version policy.

Getafix automated patch suggestion and validation for null-dereference bugs

The operating-model shift, in one view.

How the work changed

Outcomes

Instagram null-method-call backlog: proportion of bugs successfully auto-patched

Fix rate on return-not-nullable and field-not-nullable Infer bugs after Getafix suggestions were displayed alongside the bug reports

Share of SapFix's valid fix candidates supplied by Getafix

What leaders can reuse

What the public record supports.

Related transformations

LLM-assisted 32-bit to 64-bit identifier migration

AI pair-programmed HTTP server

Generative AI agent assistance

GitHub Copilot-assisted daily engineering work

Sources