Effective Bug Detection in Graph Database Engines: An LLM-based Approach

Jiayi Wu, Zhengyu Wu, Ronghua Li, Hongchao Qin, Guoren Wang. 2024. arXiv.org.

What this paper does with SQLancer

TLP reaches this paper twice over. It is described directly among the relational oracles -- PQS, NoREC and TLP each summarised by mechanism -- and again as the technique GDBMeter carries into graph databases: the paper explains that the predicate-partitioning approach builds queries from a top-down expression generator and then applies Ternary Logic Partitioning to produce the true, false and null variants. That partitioning line is the alternative its LLM-based generation is positioned against, and nothing of SQLancer's is run or reused. This work uses a large language model to generate test queries for graph database engines, on the argument that the existing generators produce queries bounded by their templates and transformation rules. It contrasts differential testing across engines with metamorphic approaches that test one engine against itself. Written by claude-opus-5 from the 6 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

Queries are generated by a language model; nothing describes reuse of SQLancer's code or generator.

extends technique — no

The oracles are described as the existing approaches this work departs from, not developed.

compares with — no

The mentions describe the techniques rather than reporting a run against them; no comparison result involving TLP, NoREC or PQS appears.

describes as state of the art — no

Predicate partitioning is called widely adopted, which describes its uptake rather than claiming it is the state of the art.

SQLancer publications it cites (4)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
35	Manuel Rigger. 2022. SQLancer. https://github.com/sqlancer/sqlancer.	sqlancer publication
36	Manuel Rigger and Zhendong Su. 2020. Detecting optimization bugs in database engines via non-optimizing reference engine construction. In Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conf...	sqlancer publication · NOREC
37	Manuel Rigger and Zhendong Su. 2020. Finding bugs in database systems via query partitioning. Proceedings of the ACM on Programming Languages 4, OOPSLA (2020), 1–30.	sqlancer publication · TLP
38	Manuel Rigger and Zhendong Su. 2020. Testing database engines via pivoted query synthesis. In 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20). 667–682.	sqlancer publication · PQS

Every place it refers to SQLancer (6)

6 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	The former typically involves detecting bugs in graph database engines by generating equivalent queries[ 5] or utilizing predicate partitioning[ 23,24,37].	citation marker background	page 1
M2	In the predicate partitioning approach for detecting graph database engine bugs[ 24], it starts by constructing queries based on a top-down expression generator[ 35], and then apply Ternary Logic Partitioning techniques to create correspondent queries, namely the "True, False or Null" queries, for running on graph d...	technique definition	page 1
M3	Most current research focuses on the latter approach and the most widely adopted method is running randomly generated queries [3,35,43] on different graph database engines for bug detection.	citation marker background	page 2
M4	PQS[ 38] selects a target data from randomly generated tables, generates conditional expressions based on the target data, constructs an SQL query with a where or join clause, and determines the presence of bugs by checking if the result is included in the result set.	technique definition	page 11
M5	NoRec[ 36] converts the original SQL query into a nonoptimized SQL query and compares the results of these two SQL queries for consistency.	technique definition	page 11
M6	TLP[ 37] transforms randomly generated original SQL queries into three different logical queries based on the true, false, and null ternary logic.	technique definition	page 11

This page is rendered from _data/papers/paper_arxiv_2402_00292.json, extracted from arxiv. 12 pages, 50 references parsed.