TiDB and SQLancer

← All database systems

TiDB is supported by SQLancer — the main repository ships a testing implementation for it. SQLancer is credited with 172 bugs in it, reported between 2020-03-26 and 2026-08-31. Its source is at pingcap/tidb.

A further 12 reports were filed and rejected by the developers as invalid or duplicate. Those are kept in the dataset for transparency and are excluded from every count here.

How the bugs break down

By year reported

2020

61

2022

8

2023

12

2024

1

2025

42

2026

36

Year not recorded

12

Who found them

Found by the SQLancer project

154

Found by someone outside the project

7

Reporter not recorded

11

By status

Fixed

58

Confirmed

48

Open

66

By symptom

Logic bug

30

Unexpected error

27

Crash

4

Unclassified

111

By technique

Technique not recorded

137

Ternary Logic Partitioning (TLP)

31

Pivoted Query Synthesis (PQS)

2

Differential Query Plans (DQP)

1

Non-optimizing Reference Engine Construction (NoREC)

1

Why each bug counts

The reproducer carries SQLancer's generated schema

79

Listed in the project's own bug repository

42

The report names a SQLancer oracle

32

Filed by someone who runs SQLancer campaigns

17

The report names SQLancer

2

Who reported them (8)

Manuel Rigger

61

DerZc

44

Chi Zhang

10

bajinsheng

9

wanteatfruit

9

TheoristCoder

8

Zhaokun Xiang

7

hawkingrei

4

Every bug on record (184)

One row per report, newest first, each linking to the report itself. Rejected reports are marked and are not part of any count above.

Reported	Report	Status	Technique	Reporter
2026-08-31	With pseudo statistics, GROUP BY / DISTINCT over COALESCE(float_col) collapses rows into wrong groups and m...	open	NOREC	Manuel-Neuer1
2026-08-16	`MIN(GREATEST(, DATE)) GROUP BY` over a `(ROW_NUMBER() = 1)` filter view returns DATETIME ...	open	—	wanteatfruit
2026-08-14	Grouped `REPEAT` over a `WITH` CTE returns a string; the same query on the table returns NULL	open	—	wanteatfruit
2026-08-12	`ENUM` numeric predicates wrong through `UNION ALL`	open	—	wanteatfruit
2026-08-12	Inconsistent results from `REGEXP_REPLACE` on a `CACHE` table	open	—	wanteatfruit
2026-08-09	`STDDEV_POP` / `VAR_*` over `BIGINT UNSIGNED` near `2^64` wrong on `UNION ALL`	open	—	wanteatfruit
2026-08-05	`predicate_push_down` returns a nil plan	open	—	wanteatfruit
2026-08-05	`ANY_VALUE()` in a view raises planner error 1105 `Can't find column Column#N in schema`	open	—	wanteatfruit
2026-08-05	An aggregate window function inside a view breaks correlated quantified subqueries (`< ANY` / `= ALL` / `IN...	open	—	wanteatfruit
2026-07-30	`UNION ALL` relation + `IN (correlated subquery)` over an `ALL` subquery panics	open	—	wanteatfruit
2026-06-17	TiDB nightly panic in mockstore/unistore badger Table.HasOverlap during transaction rollback cleanup	open	—	Annie191
2026-03-17	TiKV panic in impl_like::like with invalid regexp pattern (slice out of bounds)	fixed	—	LLMTesting-Ojiken
2026-03-01	Redundant sort in the query plan of normal SELECT, causes it slower than the prepared SELECT	open	—	DerZc
2026-03-01	Redundant Selection and Projection in the query plan of normal SELECT, causes it slower than the prepared S...	open	—	DerZc
2026-03-01	Redundant HashAgg in the query plan of normal SELECT, causes it slower than the prepared SELECT	fixed	—	DerZc
2026-03-01	Inefficient query plan generated by the normal SELECT than the prepared SELECT with false HAVING condition	fixed	—	DerZc
2026-03-01	Inefficient query plan generated by the normal SELECT than the prepared SELECT when use subquery in the SEL...	open	—	DerZc
2026-03-01	Inefficient query plan generated by normal SELECT compare to the prepared SELECT with false condition	open	—	DerZc
2026-03-01	Index with StreamAgg used in the prepared SELECT but not in the normal SELECT	fixed	—	DerZc
2026-02-28	planner: missing-column 1105 with RIGHT JOIN + ORDER BY subtraction expression	fixed	DQP	hawkingrei
2026-02-17	The simple prepared query run out of 1 GiB memory with only 70 rows	open	—	DerZc
2026-02-14	planner/executor: internal missing-column error with JOIN ... USING + qualified column predicate	fixed	PQS	hawkingrei
2026-02-13	runtime error: index out of range on ANY subquery predicate	fixed	PQS	hawkingrei
2026-02-09	runtime error: nil pointer dereference with RIGHT JOINs and views (TLP)	fixed	TLP	hawkingrei
2026-02-02	Inconsistent behaviour between normal and prepared SELECT when use subquery in ON condition	open	—	DerZc
2026-01-28	Index out of bound when calling DEALLOCATE statement in JDBC	open	—	DerZc
2026-01-27	nil pointer dereference triggered by INSERT	open	—	DerZc
2026-01-27	index out of bound only triggered when query run twice	open	—	DerZc
2026-01-27	Inconsistent result between normal SELECT and prepared SELECT, related to GROUP BY	open	—	DerZc
2026-01-26	cast an invalid string to DATETIME returns NULL in normal SELECT, but triggers an error in prepared SELECT	open	—	DerZc
2026-01-26	Incorrect result of ELT function when used in WHERE clause of prepared statement	open	—	DerZc
2026-01-22	Inconsistent results of DATA_FORMAT when used in normal SELECT and prepared SELECT	open	—	DerZc
2026-01-22	Deterministic query returns indeterministic results	fixed	—	DerZc
2026-01-22	BIT_AND returns incorrect result in prepared statement	open	—	DerZc
2026-01-03	Unexpected error "Cannot convert string '\x15t\x03\x10\x93' from binary to utf8mb4"	open	—	DerZc
2026-01-03	Undeterministic result of deterministic query	open	—	DerZc
2025-12-29	Unexpected error on prepared statement "ERROR 1105 (HY000) at line 16: Data Too Long, field len 11, data le...	open	—	DerZc
2025-12-29	Unexpected error "Incorrect string value: '0.8949238218722565' for function inet_aton"	open	—	DerZc
2025-12-29	Unexpected error "Column 't1.c0' in field list is ambiguous"	fixed	—	DerZc
2025-12-05	runtime error: index out of range [7] with length 4	open	—	DerZc
2025-10-12	Unexpected error `interface conversion: expression.Expression is *expression.Constant, not *expression.Scal...	open	—	DerZc
2025-10-10	Unexpected error `Can't find column Column#3 in schema Column` when construct prepared statement for EXPLAIN	open	—	DerZc
2025-10-10	Unexpected error `%s value is out of range in '%s'`	open	—	DerZc
2025-10-10	Incorrect result of ELT when used in prepared statement.	open	—	DerZc
2025-09-23	Unexpected result of `<=>` in prepared statement	open	—	DerZc
2025-09-23	Incorrect type cast in prepared statement	open	—	DerZc
2025-09-23	Inconsistent behaviour of `\\` in normal query and prepared statement	open	—	DerZc
2025-09-22	Unexpected result when use HEX as the WHERE condition of prepared statement	open	—	DerZc
2025-09-21	Unexpected result of IFNULL and LIKE functions	open	—	DerZc
2025-09-21	Unexpected error `baseBuiltinFunc.vecEvalInt() should never be called, please contact the TiDB team for help`	open	—	DerZc
2025-09-21	Not well handle \ in REGEXP function	open	—	DerZc
2025-09-21	Incorrect type cast in prepared statement	open	—	DerZc
2025-09-21	Inconsistent behavior of `~` in normal query and prepared statement	open	—	DerZc
2025-09-21	Inconsistency between normal select and prepared statement query	open	—	DerZc
2025-08-01	Integer was cast to wrong char value in prepared statement.	open	—	DerZc
2025-07-30	`CASE WHEN` in prepared statement return wrong result on FLOAT value	open	—	DerZc
2025-07-24	`GROUP BY` returns different results in prepared statement and normal SELECT query	open	—	DerZc
2025-07-23	`CASE WHEN` returns different result in prepared statement and normal query	fixed	—	DerZc
2025-07-08	Unexpected result	fixed	—	DerZc
2025-05-26	Unexpected Multiple Join Result	fixed	—	Zhaokun Xiang
2025-05-25	Unexpected Inner Join result	fixed	—	Zhaokun Xiang
2025-05-01	Unexpected Result for NATURAL JOIN in TiFlash	fixed	—	bajinsheng
2025-04-18	Serious Wrong Result of Right Join involving subquery	verified	—	Zhaokun Xiang
2025-04-17	Join Crash When dealing with inner join involving subquery and like operator	fixed	—	Zhaokun Xiang
2025-04-16	Internal Error of PI() DIV FLOOR() Expression	open	—	TheoristCoder
2025-04-10	join with view produces 'interface conversion' with a small change on join condition	open	—	TheoristCoder
2025-03-28	Unexpected INNER JOIN Result	fixed	—	Zhaokun Xiang
2025-03-21	Wrong Inner Join Result	fixed	—	Zhaokun Xiang
2025-03-17	Wrong Join Result under the condition of <=> and NULL	fixed	—	TheoristCoder
2025-03-17	Incorrect Join result in the join condition containing Cast operator and additional true expression	fixed	—	TheoristCoder
2025-03-17	Incorrect Join Result under the condition containing date_format, REGEXP and additional true expression	open	—	TheoristCoder
2025-03-17	Discrepant Join Result on the same-value join condition	open	—	TheoristCoder
2025-03-17	Behaviour of expression index is incompatible with MySQL	open	—	EmilyOng
2025-03-14	Join Involving View and ATAN2 function produce wrong result	fixed	—	Zhaokun Xiang
2025-03-14	Incorrect Join Result After adding an additional true expression	open	—	TheoristCoder
2025-03-14	Cast double as datetime bug and adding expression causes different result	open	—	TheoristCoder
2025-01-27	Null-safe equals operator in WHERE clause might under-fetch rows	fixed	—	EmilyOng
2025-01-23	Where clause on right outer join might lead to rows not being fetched	fixed	—	EmilyOng
2024-01-17	Runtime error when using overflow integers	verified	—	Suyang Zhong
2023-12-14	Unexpected Results of IN expression With NATURAL RIGHT JOIN	fixed	—	Suyang Zhong
2023-06-15	Unexpected results of `ANY` operator	verified	—	Chi Zhang
2023-06-15	Unexpected error when `CHECK` a predicate that is always true.	fixed	—	Chi Zhang
2023-05-17	Unexpected error message `Data truncated for column '%s' at row %d`	fixed	—	DerZc
2023-05-08	Unexpected results when `CASE` and `IN` use together	verified	—	Chi Zhang
2023-05-06	Unexpected error `Unknown column 't1.c0' in 'where clause'`	verified	—	Chi Zhang
2023-04-24	Unexpected results of subquery in `INSERT`	verified	—	Chi Zhang
2023-04-20	`runtime error: index out of range [1] with length 1` on `SELECT`	verified	—	Chi Zhang
2023-04-13	An expression has two different value in two queries	verified	—	Chi Zhang
2023-04-11	Unexpected result of subquery	fixed	—	Chi Zhang
2023-04-11	Unexpected error message on constant	verified	—	Chi Zhang
2023-04-11	Unexpected error in `ORDER BY`	verified	—	Chi Zhang
2022-10-29	rule PredicatePushDown pushes wrong filter across projection	unknown	—	bajinsheng
2022-10-28	Unexpected Estimated Rows by WHERE clause	open	—	bajinsheng
2022-10-26	Unexpected Results by RIGHT JOIN	unknown	—	bajinsheng
2022-10-26	Unexpected Estimated Rows by INNER JOIN	open	—	bajinsheng
2022-10-15	Unexpected Error: Failed to read auto-increment value from storage engine	unknown	—	bajinsheng
2022-10-15	Suspicious Estimated Rows by HAVING	open	—	bajinsheng
2022-10-14	Suspicious Estimated Rows by `JOIN`	open	—	bajinsheng
2022-10-14	Question About the Estimated Rows in `GROUP BY`	open	—	bajinsheng
2022-10-10	Error [types:1690]%s value is out of range in '%s'	unknown	—	bajinsheng
2022-10-07	Unexpected Results	unknown	—	bajinsheng
2022-10-06	runtime error: invalid memory address or nil pointer dereference	unknown	—	bajinsheng
2022-10-06	Incorrect Results by `REGEXP`	unknown	—	bajinsheng
2022-10-06	Incorrect Result by `LEFT JOIN`	unknown	—	bajinsheng
2022-08-04	Unexpected Result by CONCAT_WS	unknown	—	bajinsheng
2022-08-03	Inconsistent Results in SELECT	unknown	—	bajinsheng
2022-06-22	Unexpected Result with a FALSE Expression in WHERE	verified	—	bajinsheng
2022-06-21	Runtime error: invalid memory address	verified	—	bajinsheng
2022-06-20	unexpected unresolved column error when the view refers to dual table	fixed	—	bajinsheng
2020-04-23	Value in generated column depends on a WHERE clause	verified	TLP	Manuel Rigger
2020-04-23	Fetching from a view with an escaped backslash results in an unexpected syntax error	verified	—	Manuel Rigger
2020-04-23	A predicate with COLLATE 'binary' results in a server panic "invalid memory address or nil pointer derefere...	fixed	—	Manuel Rigger
2020-04-22	Using an index twice in an index hint results in an incorrect result	verified	TLP	Manuel Rigger
2020-04-22	UNIQUE constraint on boolean column results in an incorrect result in a comparison	verified	TLP	Manuel Rigger
2020-04-22	UNIQUE constraint on DECIMAL/floating-point columns causes incorrect result for NULL in AND	verified	TLP	Manuel Rigger
2020-04-22	SELECT with ORDER BY results in an "inconsistent index" error	verified	—	Manuel Rigger
2020-04-22	Inf value in FLOAT column causes JDBC driver error	verified	—	Manuel Rigger
2020-04-22	INSERT INTO with ON DUPLICATE clause results in an unexpected "key not exist" error	verified	—	Manuel Rigger
2020-04-22	INSERT INTO with ON DUPLICATE clause results in an unexpected "Miss column" error	verified	—	Manuel Rigger
2020-04-22	INSERT IGNORE allows NULL value in a NOT NULL generated column	verified	TLP	Manuel Rigger
2020-04-22	INL_HASH_JOIN hint causes an incorrect result for a table with a generated column	verified	TLP	Manuel Rigger
2020-04-22	CREATE TABLE with generated column unexpectedly causes a syntax error	verified	—	Manuel Rigger
2020-04-22	CREATE TABLE with generated column and escaped backslash causes a syntax error	verified	—	Manuel Rigger
2020-04-20	Incorrect result for LEFT JOIN AND NULLIF	verified	TLP	Manuel Rigger
2020-04-19	Unexpected error "Data Too Long" when using a WHERE clause in an UPDATE	verified	—	Manuel Rigger
2020-04-15	Using the DEFAULT() function results in an ambiguous column error	verified	—	Manuel Rigger
2020-04-15	Server panic for predicate t0.c0=9223372036854775808 when using partitions	verified	—	Manuel Rigger
2020-04-15	Server panic for NATURAL LEFT JOIN on partitioned table	verified	—	Manuel Rigger
2020-04-15	RIGHT JOIN with ELT() predicate returns an incorrect result	verified	TLP	Manuel Rigger
2020-04-15	NATURAL LEFT JOIN with a NOT predicate results in a server panic	fixed	—	Manuel Rigger
2020-04-15	NATURAL LEFT JOIN results in incorrect result for <=> operator	verified	TLP	Manuel Rigger
2020-04-15	Internal error message when using CASE in partitioned table	verified	—	Manuel Rigger
2020-04-15	Inserting into a partitioned table results in an "Missing session variable when eval builtin" error	verified	—	Manuel Rigger
2020-04-15	Incorrect result when using the empty string as a predicate in a RIGHT JOIN	verified	TLP	Manuel Rigger
2020-04-15	Incorrect result when using SPACE() in a predicate	verified	TLP	Manuel Rigger
2020-04-15	Incorrect result when fetching from a view	verified	TLP	Manuel Rigger
2020-04-15	Incorrect result or run-time error after changing column type	verified	TLP	Manuel Rigger
2020-04-15	Incorrect result for LEFT JOIN and CASE operator	verified	TLP	Manuel Rigger
2020-04-15	Incorrect result for CAST to DATETIME	verified	TLP	Manuel Rigger
2020-04-15	A NOT NULL predicate unexpectedly evaluates to TRUE	closed duplicate	TLP	Manuel Rigger
2020-04-02	SELECT on table with generated column causes a server panic	fixed	—	Manuel Rigger
2020-04-02	RIGHT JOIN with CONCAT_WS fails to fetch a row	fixed	TLP	Manuel Rigger
2020-04-02	REGEXP predicate unexpectedly results in an error "No valid regexp pattern found"	fixed	—	Manuel Rigger
2020-04-02	LEFT JOIN on a view results in "runtime error: slice bounds out of range [:264] with capacity 256"	verified	—	Manuel Rigger
2020-04-02	Incorrect result when comparing a FLOAT/DOUBLE UNSIGNED with a negative number	verified	TLP	Manuel Rigger
2020-04-02	INSERT IGNORE causes an incorrect result for a query on a DECIMAL column	fixed	TLP	Manuel Rigger
2020-04-02	INL_MERGE_JOIN hint results in an error "Internal : Can't find a proper physical plan for this query"	verified	—	Manuel Rigger
2020-04-01	fast ANALYZE TABLE on INDEX PRIMARY causes an error "analyze worker panic"	fixed	—	Manuel Rigger
2020-04-01	Using a column both in a string comparison and as a boolean yields an incorrect result	fixed	TLP	Manuel Rigger
2020-04-01	USE_INDEX_MERGE results in an incorrect result for a generated column	fixed	TLP	Manuel Rigger
2020-04-01	USE_INDEX_MERGE on table with generated column causes a server crash	fixed	—	Manuel Rigger
2020-04-01	OR clause on FLOAT/DOUBLE column unexpectedly evaluates to TRUE	verified	TLP	Manuel Rigger
2020-04-01	LIKE operator malfunctions for COLLATE 'latin1_bin'	fixed	TLP	Manuel Rigger
2020-04-01	Incorrect result for a predicate that uses the CHAR() function	fixed	TLP	Manuel Rigger
2020-04-01	A USE_INDEX_MERGE hint causes a server panic	fixed	—	Manuel Rigger
2020-03-30	Query with a NATURAL LEFT JOIN unexpectedly results in an error	fixed	—	Manuel Rigger
2020-03-30	Query with RIGHT JOIN causes a server panic	fixed	—	Manuel Rigger
2020-03-30	Query results in "baseBuiltinFunc.vecEvalString() should never be called" error	verified	—	Manuel Rigger
2020-03-30	NATURAL RIGHT JOIN results in an unexpected "Unknown column" error	verified	—	Manuel Rigger
2020-03-30	Incorrect result for LEFT JOIN and NULL values	fixed	TLP	Manuel Rigger
2020-03-29	Join on tables with redundant indexes causes a server panic	fixed	—	Manuel Rigger
2020-03-29	GROUP BY clause nondeterministically results in an incorrect result or error	fixed	TLP	Manuel Rigger
2020-03-29	A predicate column1 = -column2 incorrectly evaluates to false for 0 values	fixed	TLP	Manuel Rigger
2020-03-27	Unexpected "Data truncation: %s value is out of range in '%s'" error in UNION query	fixed	—	Manuel Rigger
2020-03-27	COLLATE causes an incorrect result in the presence of an index	fixed	TLP	Manuel Rigger
2020-03-26	Incorrect result for query that uses an AND operator on floats	verified	TLP	Manuel Rigger
2020-03-26	Incorrect result for an UNION query and a generated column	fixed	TLP	Manuel Rigger
2020-03-26	Double negation causes incorrect result	fixed	TLP	Manuel Rigger
2020-03-26	ANALYZE TABLE results in "invalid encoded key" with tidb_enable_fast_analyze=1	fixed	—	Manuel Rigger
2020-03-26	ANALYZE TABLE results in "analyze worker panic" with tidb_enable_fast_analyze=1	fixed	—	Manuel Rigger
2020-03-26	ANALYZE TABLE causes SIGSEGV on latest trunk	fixed	—	Manuel Rigger
—	runtime error: index out of range [7] with length 4	open	—	—
—	incorrect unresolved column when using natural join	open	—	—
—	Unexpected Result with NATURAL RIGHT JOIN and Bitwise NOT	verified	—	Suyang Zhong
—	Unexpected Estimated Rows of `OR`	open	—	—
—	Unexpected Estimated Rows by GROUP BY	open	—	—
—	Unexpected Error for Function INET_ATON	open	—	—
—	Unexpected Error by CAST and CHAR functions	closed not a bug	—	—
—	Unexpected Error Overflow	open	—	—
—	Internal Error: Cannot found physical plan	open	—	—
—	Error For MPP Stream	fixed	—	—
—	ERROR 8141 (HY000): assertion failed	fixed	—	—
—	ERROR 1105 encoding failed	fixed	—	—
—	ERROR 1105 (HY000): interface conversion	fixed	—	—

Every figure on this page is computed from _data/impact/. The attribution policy explains what has to be true for a bug to be counted.