← Research building on SQLancer

Yu Li, Qiang Hu, Yao Zhang, Junjie Wang, Haoxuan Liu, Rui Wang, Yongqiang Lyu. 2026.

Read the paper · arXiv:2607.03741

What this paper does with SQLancer

SQLancer is cited as the relational tool that synthesises queries and validates them with advanced oracles, and the graph-database descendants of its techniques -- GraphGenie's transformations and GDBMeter's adaptation of ternary query partitioning -- are the related work GRAF sets its feedback-driven approach against. GRAF is a black-box fuzzer for graph database query engines. It argues that existing graph-system testing relies on differential and metamorphic testing whose consistency oracles restrict inputs to queries comparable across engines or transformations, leaving single-engine runtime failures under-explored. GRAF instantiates LLM-generated parameterised Cypher skeletons against the active graph state to produce valid, diverse queries, and applies five graph-specific mutation operators guided by execution feedback. It found 34 previously unknown bugs, 23 with CVEs. Written by claude-opus-5 from the 7 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited, not used; nothing in the mentions describes reusing its code.

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

SQLancer publications it cites (9)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#EntryMatched as
8 Manuel Rigger and Zhendong Su. Finding bugs in database systems via query partitioning.Proc. ACM Program. Lang., 4(OOPSLA), November 2020. sqlancer publication · TLP
9 Manuel Rigger and Zhendong Su. Testing database engines via pivoted query synthesis. InProceedings of the 14th USENIX Conference on Operating Systems Design and Implementation, OSDI’20, USA, 2020. USENIX Association. sqlancer publication · PQS
10 Manuel Rigger and Zhendong Su. Detecting optimization bugs in database engines via non-optimizing reference engine construction. In Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference... sqlancer publication · NOREC
19 Yuancheng Jiang, Jiahao Liu, Jinsheng Ba, Roland H. C. Yap, Zhenkai Liang, and Manuel Rigger. Detecting logic bugs in graph database management systems via injective and surjective graph query transformation. InProcee... project authored
20 Matteo Kamm, Manuel Rigger, Chengyu Zhang, and Zhendong Su. Testing graph database engines via query partitioning. InProceedings of the 32nd ACMSIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2... project authored
25 Jinsheng Ba and Manuel Rigger. Keep it simple: Testing databases via differential query plans. sqlancer publication · DQP
45 Chi Zhang and Manuel Rigger. Constant optimization driven database system testing.Proceedings of the ACM on Management of Data, 3:1 – 24, 2025. sqlancer publication · CODDTEST
47 Suyang Zhong and Manuel Rigger. Understanding and reusing test suites across database systems.Proceedings of the ACM on Management of Data, 2:1–26, 12 2024. project authored
48 Jinsheng Ba and Manuel Rigger. Testing database engines via query plan guidance. In Software Engineering (ICSE), pages 2060–2071, 2023. sqlancer publication · QPG

Every place it refers to SQLancer (7)

7 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id Sentence Found by Where
M1 Tools such as SQLsmith [7] and SQLancer [8]–[10] generate SQL queries based on abstract syntax tree models or formal semantics, successfully exposing bugs in mature systems such as PostgreSQL [11] and SQLite [12]. name
background 		I INTRODUCTION
page 1
M2 Existing approaches mainly rely on differential testing [15]–[17] and metamorphic testing [18]–[22]. citation marker project authored
background 		I INTRODUCTION
page 1
M3 Existing GDBMS testing methods [15]–[20], [22], [25] mainly rely on differential or metamorphic testing and typically lack feedback driven exploration. citation marker project authored
motivation 		I INTRODUCTION
page 2
M4 To construct more robust metamorphic relations, GraphGenie [19] introduces injective and surjective graph query transformations, which systematically alter the structural constraints and cardinality mappings of the original queries to uncover subtle logic bugs. citation marker project authored
background 		VI RELATED WORK
page 10
M5 GDBMeter [20] adapts the Ternary Query Partitioning (TQP) concept to graph databases, partitioning a core graph query into multiple sub-queries whose aggregated results should logically reconstruct the original result set. technique
definition 		VI RELATED WORK
page 10
M6 Fuzzing for DBMSs Existing DBMS fuzzing techniques [7]–[10], [13], [25], [40]–[48] include generation-based and mutation-based approaches. citation marker
background 		VI RELATED WORK
page 10
M7 To systematically detect logic bugs, SQLancer [8]–[10] automatically synthesizes queries and validates their correctness using advanced logical oracles like Ternary Logic Partitioning (TLP [8]). name
definition 		VI RELATED WORK
page 10

This page is rendered from _data/papers/paper_arxiv_2607_03741.json, extracted from arxiv. 12 pages, 49 references parsed.