Anomaly Pattern-guided Transaction Bug Testing in Relational Databases
Read the paper · arXiv:2511.17377
What this paper does with SQLancer
APTrans's database and SQL generation is SQLancer's, extended. The paper states it develops its generation method based on SQLancer and builds on the SQLancer framework, extending it to support table joins in both database and statement generation, because the base version generates isolated tables and real workloads involve tables connected by join keys. Type constraints were added for the same reason, since SQLancer's expressions produce many semantic errors from type mismatches. Those generated statements and databases are then the input to the anomaly-pattern constraint solver, which is APTrans's own. Its baselines are TxCheck and Troc rather than any SQLancer oracle.
APTrans tests transaction handling in relational DBMSs under different isolation levels. It identifies two obstacles: generating transactions that actually expose bugs, since those need specific transactional constraints, and deciding whether an outcome is wrong, since the correct result of randomly generated transactions is usually unknown. It addresses the first with generation guided by predefined anomaly patterns and the second with a two-phase explicit and implicit error detection process. On MySQL, MariaDB and OceanBase it found 13 previously unknown transaction bugs, 11 confirmed.
How it was classified
uses infrastructure — yes (generator)
M3 states the database and SQL statement generation is developed based on SQLancer, M4 and M7 that they extended it to support joins and type constraints, and M8 that SQLancer generates the statements transaction construction consumes. The reuse is of the generator; the anomaly-pattern machinery on top is the paper's own.
We develop our database and SQL statement generation method based on SQLancer [ 4] and extend it to support table join operations for both database generation and SQL statement generation.
To simulate real-world scenarios, which usually involve multiple tables connected with join keys, we extend SQLancer to support table join operations for both database generation and SQL statement generation.
Building upon the SQLancer framework, we have extended the SQL statement generation to include JOIN operations and type constraints, thereby producing a more diverse set of SQL statements while ensuring the semantic correctness of the SQL statements.
We use SQLancer to generate a large number of random SQL statements for transaction generation.
extends technique — no
What is extended is SQLancer's generation -- joins and type constraints -- not any of its test oracles. APTrans's oracle is anomaly-pattern-based error detection.
compares with — no
M11 names the two comparison methods as TxCheck and Troc. No SQLancer oracle is run against APTrans.
describes as state of the art — no
TxCheck and Troc are the methods called state-of-the-art here; SQLancer is described by what it generates.
SQLancer publications it cites (6)
Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.
| # | Entry | Matched as |
|---|---|---|
| 4 | 2025. SQLancer. https://github.com/sqlancer/sqlancer. (visited in April 2025). | sqlancer publication |
| 7 | Jinsheng Ba and Manuel Rigger. 2023. Testing database engines via query plan guidance. In ing (ICSE). IEEE, 2060–2071. | sqlancer publication · QPG |
| 14 | Zu-Ming Jiang, Si Liu, Manuel Rigger, and Zhendong Su. 2023. Detecting Transactional Bugs in Database Engines via {Graph-Based}Oracle Construction. In 17th USENIX Symposium on Operating Systems Design and Implementati... | project authored |
| 25 | Manuel Rigger and Zhendong Su. 2020. Detecting optimization bugs in database engines via non-optimizing reference engine construction. In Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conf... | sqlancer publication · NOREC |
| 26 | Manuel Rigger and Zhendong Su. 2020. Finding bugs in database systems via query partitioning. Proceedings of the ACM on Programming Languages 4, OOPSLA (2020), 1–30. | sqlancer publication · TLP |
| 27 | Manuel Rigger and Zhendong Su. 2020. Testing database engines via pivoted query synthesis. In 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20). 667–682. | sqlancer publication · PQS |
Every place it refers to SQLancer (14)
14 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.
| Id | Sentence | Found by | Where |
|---|---|---|---|
| M1 | Existing approaches for testing transaction anomalies, such as Troc [ 10] and TxCheck [ 14], typically generate test transactions by randomly selecting SQL statements from a predefined set. |
citation marker project authored |
1 INTRODUCTION page 2 |
| M2 | TxCheck [ 14], on the other hand, attempts to decouple a transaction into independent and dependent SQL statements. |
citation marker project authored |
1 INTRODUCTION page 2 |
| M3 | We develop our database and SQL statement generation method based on SQLancer [ 4] and extend it to support table join operations for both database generation and SQL statement generation. |
name |
3.2 Database and SQL statement Generation page 4 |
| M4 | To simulate real-world scenarios, which usually involve multiple tables connected with join keys, we extend SQLancer to support table join operations for both database generation and SQL statement generation. |
name |
3.2.1 Database Generation. In database transaction testing, the page 4 |
| M5 | The base version of SQLancer supports the generation of isolated tables and the basic CREATE TABLE statements. |
name |
3.2.1 Database Generation. In database transaction testing, the page 4 |
| M6 | SQLancer generates random data by creating INSER T statements for tables. |
name |
3.2.1 Database Generation. In database transaction testing, the page 4 |
| M7 | Building upon the SQLancer framework, we have extended the SQL statement generation to include JOIN operations and type constraints, thereby producing a more diverse set of SQL statements while ensuring the semantic correctness of the SQL statements. |
name |
3.2.1 Database Generation. In database transaction testing, the page 4 |
| M8 | We use SQLancer to generate a large number of random SQL statements for transaction generation. |
name |
3.2.1 Database Generation. In database transaction testing, the page 4 |
| M9 | However, SQLancer suffers from numerous semantic errors, most of which are caused by type mismatches in expressions. |
name |
3.2.1 Database Generation. In database transaction testing, the page 4 |
| M10 | It takes the three types of constraints extracted from an anomaly pattern, the set of SQL statements and database generated by SQLancer as inputs and progressively construct transactions satisfying the constraints. |
name |
3.3.1 Constraint Extraction. To implement anomaly pattern-guided page 6 |
| M11 | We compare APTrans with two stateof-the-art testing methods: TxCheck [ 14] and Troc [ 10]. |
citation marker project authored |
4.1 Experimental Setup page 8 |
| M12 | Troc [ 10] and TxCheck [ 14] are recent methods for detecting database transaction bugs. |
citation marker project authored |
5 RELATED WORK page 12 |
| M13 | Its successor, SQLancer [ 25–27], introduces three metamorphic testing oracles: PQS [ 27], NoREC [ 25], and TLP [ 26], significantly improving its ability to detect logical bugs. |
name |
5 RELATED WORK page 12 |
| M14 | Recent innovations have introduced paradigm shifts in testing strategies: QPG [ 7] uses query plan-guided database state mutation, while DQE [ 28] applies differential execution analysis across SELECT, UPDATE, and DELETE statements. |
technique |
5 RELATED WORK page 12 |