Skip to content(if available)orjump to list(if available)

Fixrleak: Fixing Java Resource Leaks with GenAI

sigotirandolas

> This analysis ensures that FixrLeak skips functions where resources are passed as parameters, returned, or stored in fields, as these resources often outlive the function’s scope.

> FixrLeak delivers precise, reliable fixes while leaving more complex cases for advanced analysis at the caller level.

In other words, this will only fix trivial leaks, which are best seen as a language design issue and can be fixed by RAII, reference counting, etc.

It won't fix the more insidious leaks like `UNBOUNDED_QUEUE.add(item)` that are more likely to pass through code review in the first place.

stevoski

> “Resource leaks, where resources like files, database connections, or streams aren’t properly released after use, are a persistent issue in Java applications”

This was true maybe back in 2005. Java has had try-with-resources for a loooong time. As I see it this has been the dominant idiom for ages, for handling resources that might leak.

okr

People tend to forget. Stream-API is a good candidate, that people like to not consider for leakage. If you don't own your stream, if you do not definitly know, that your stream comes from a collection, then ya better close it with a try-block.

bob778

How much effort was spent automating this to fix 112 instances across Uber’s code base? I assume code reviews would catch any new issues so this seems like overkill for a small one-off task?

hawk_

Spotbugs or checkstyle etc... would catch these. What does AI add here?

xyst

It gives marketing team at Uber to say "wE uSe AI hErE!!1". C-levels approve since anything AI gets a nice pump.

Engineering wise. This adds nothing. It’s an absolute waste of compute and energy to run this through LLMs

xyst

Using AI when a static scanner like SonarQube easily picks up these types of resource leaks, especially in Java.

Peak waste.

What’s next?

"Get rid of your GitHub dependabot alerts and replace it with my shitty ChatGPT wrapper”

rvz

> Using AI when a static scanner like SonarQube easily picks up these types of resource leaks, especially in Java.

Exactly.

It's very disappointing to see that Uber engineers would rather trust an LLM to that claims to spot these issues when a battle-tested scanner such as SonarQube would have caught this in the first place.

The LLM hype-train is almost just as bad as the JavaScript hype train in the 2010s where some of the worst technologies are used on everything.

rvz

Why exactly do you need LLMs for this when efficient alternatives like SonarQube or checkstyle already do this without the expensive waste LLMs create?

This adds little to no technical advantage over existing solutions what so ever for this particular use case.

yahoozoo

stupid af