GDsmith: Detecting Bugs in Graph Database Engines

Weisheng Lin, Ziyue Hua, Luyao Ren, Z. Li, Lu Zhang, Tao Xie. 2022. arXiv.org.

What this paper does with SQLancer

GDsmith says plainly that its framework is derived from SQLancer, carrying that tool's approach from relational engines to Cypher, and its artifact holds SQLancer's source under a renamed package. PQS, NoREC and TLP are summarised as the relational oracles that came before it. GDsmith tests graph database engines that use Cypher. Its central difficulty is that random test generation struggles to produce property graphs and queries complex enough to return non-empty results, which is what wrong-result bugs require. GDsmith ensures every generated query meets the semantic requirements, and raises the chance of complex non-empty results with graph-guided generation of pattern combinations and data-guided generation of conditions. It detected bugs across three popular open-source graph engines. Written by claude-opus-5 from the 4 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — yes (implementation)

M1 states the framework is derived from SQLancer. The artifact carrying SQLancer source under a renamed package agrees.

Its framework is derived from SQLancer [ 23] (which is a tool to automatically test relational database engines). M1 · 4.1.2 Implementation. We implement the GDsmith prototype with · page 7

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

Its artifact

ddaa2000/GDsmith carries renamed sqlancer package, sqlancer source content match.

Repository is named after GDsmith, the tool this paper says it built, and is about database testing.
# GDsmith
source

src/main/java/org/example/gdsmith/Randomly.java is SQLancer's Randomly.java, with the package renamed to org.example.gdsmith (8 of 8 identifiers match: StringGenerationStrategy, SOPHISTICATED, cachedLongs, cachedStrings, cachedDoubles).
private static StringGenerationStrategy stringGenerationStrategy = StringGenerationStrategy.ALPHANUMERIC;
source

SQLancer publications it cites (4)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
23	Manuel Rigger. 2022. SQLancer: Detecting Logic Bugs in DBMS. https://github. com/sqlancer/sqlancer	sqlancer publication
24	Manuel Rigger and Zhendong Su. 2020. Detecting optimization bugs in database engines via non-optimizing reference engine construction. In ESEC/FSE ’20: 28th ACM Joint European Software Engineering Conference and Sympo...	sqlancer publication · NOREC
25	Manuel Rigger and Zhendong Su. 2020. Finding bugs in database systems via query partitioning. Proc. ACM Program. Lang. 4, OOPSLA (2020), 211:1–211:30. https://doi.org/10.1145/3428279	sqlancer publication · TLP
26	Manuel Rigger and Zhendong Su. 2020. Testing Database Engines via Pivoted Query Synthesis. In 14th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2020, Virtual Event, November 4-6, 2020. USENIX ...	sqlancer publication · PQS

Every place it refers to SQLancer (4)

4 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	Its framework is derived from SQLancer [ 23] (which is a tool to automatically test relational database engines).	name reuse implementation	4.1.2 Implementation. We implement the GDsmith prototype with page 7
M2	PQS [ 26] detects wrong-result bugs by checking whether a specific record is fetched correctly.	technique definition	5 RELATED WORK page 10
M3	NoREC [ 24] detects bugs in relational database engines by applying a semantics-preserving transformation to a given SQL query to disable the engine’s optimizations and addresses PQS’ high implementation effort.	technique definition	5 RELATED WORK page 10
M4	TLP [ 25] derives multiple SQL queries that compute a partial result of the initial query.	technique definition	5 RELATED WORK page 10

This page is rendered from _data/papers/paper_arxiv_2206_08530.json, extracted from arxiv. 12 pages, 39 references parsed.