DBcover: A White-box SQL Test Generation Framework for Coverage Improvement

Yan-Kai Rong, Shuang Liu, Jinhao Dong, Qiang Yin, Wei Lu, Jian-Hua Wang, Xiaoyong Du. 2026.

What this paper does with SQLancer

ShQveL, which enhances SQLancer++ with LLM-synthesised SQL fragments, is one of DBcover's baselines and is reported to achieve substantially lower coverage because it lacks the seed corpus and context DBcover uses. SQLancer itself is cited as an early syntax-driven generator. DBcover generates SQL tests for RDBMSs with white-box knowledge of the engine. Lightweight dynamic analysis extracts the correspondence between SQL inputs and execution paths along with call graphs as global context, and source-level information around target functions as local context, organised in a knowledge graph. Generation then runs in two phases: pick a seed whose execution path is near the uncovered target, then prompt an LLM with both contexts to reach uncovered code. It reports 80.1% and 82.3% coverage on PostgreSQL and MySQL. Written by claude-opus-5 from the 10 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited, not used; nothing in the mentions describes reusing its code.

extends technique — no

No technique is extended; the citation is background.

compares with — yes

ShQveL, built on SQLancer++, is one of the baselines, and M4 and M5 report its coverage against DBcover's and explain the difference.

•ShQveL [ 34] enhances existing SQL test case generator (SQLancer++ [ 33]) by leveraging LLM to synthesize SQL fragments. M3 · 4.1.4 Baselines: · page 8

ShQveL—a standalone LLM-augmented generator that does not leverage the seed corpus—achieves substantially lower coverage (31. M4 · 4.2 Comparison with Baselines · page 8

Both SQUIRREL and shQveL lack such context information, and thus cannot effectively cover the target code region. M5 · 4.2 Comparison with Baselines · page 8

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

SQLancer publications it cites (4)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
8	Jinsheng Ba and Manuel Rigger. 2023. Testing database engines via query plan guidance. In (ICSE). IEEE, 2060–2071.	sqlancer publication · QPG
21	M. Rigger. 2020. Sqlancer: Detecting Logic Bugs in DBMS. https://github.com/ sqlancer/sqlancer.	sqlancer publication
33	Suyang Zhong and Manuel Rigger. 2025. Scaling Automated Database System Testing.arXiv preprint arXiv:2503.21424(2025).	sqlancer publication
34	Suyang Zhong and Manuel Rigger. 2025. Testing Database Systems with Large Language Model Synthesized Fragments.arXiv preprint arXiv:2505.02012(2025). 12	sqlancer publication

Every place it refers to SQLancer (10)

10 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	In recent years, a variety of automated SQL test case generation techniques have been proposed [ 8,14,16,32], aiming to produce both syntactically and semantically valid queries.	citation marker background	1 Introduction page 1
M2	4 Baselines: •Base: The baseline approach refers to using the initial set of regression test cases as input, executing the test cases on 7 Table 1: Line coverage achieved by the compared methods DBMS Base SQUIRREL ShQveL DBcover nse DBcover PostgreSQL 68.	name baseline	4.1.4 Baselines: page 7
M3	•ShQveL [ 34] enhances existing SQL test case generator (SQLancer++ [ 33]) by leveraging LLM to synthesize SQL fragments.	name baseline	4.1.4 Baselines: page 8
M4	ShQveL—a standalone LLM-augmented generator that does not leverage the seed corpus—achieves substantially lower coverage (31.	name result comparison	4.2 Comparison with Baselines page 8
M5	Both SQUIRREL and shQveL lack such context information, and thus cannot effectively cover the target code region.	name result comparison	4.2 Comparison with Baselines page 8
M6	1 RDBMS Test Case Generation Methods In traditional DBMS test case generation, fuzzing [ 9,14,16,24,32– 34] has received extensive attention due to its efficiency in automatically producing diverse inputs and triggering program behaviors.	citation marker background	5.1 RDBMS Test Case Generation Methods page 10
M7	Early tools like SQLsmith [ 22], SQLancer [ 21] and Apollo [ 15] generate single statements via syntax-driven traversal.	name background	5.1 RDBMS Test Case Generation Methods page 10
M8	2 LLM for Test Case Generation With the rapid progress of large language models (LLMs) in code understanding and generation, LLM-driven test case generation has surged recently [ 6,11,18,25–31,34].	citation marker background	5.1 RDBMS Test Case Generation Methods page 11
M9	In the augmentation paradigm, LLMs are integrated into existing test generators to enhance their generation process [ 13,17,34].	citation marker background	5.1 RDBMS Test Case Generation Methods page 11
M10	For instance, ShQveL [ 34] extracts SQL features through LLM interactions and incorporates them into existing generators, increasing behavioral coverage while maintaining efficiency.	name definition	5.1 RDBMS Test Case Generation Methods page 11

This page is rendered from _data/papers/paper_arxiv_2608_25573.json, extracted from arxiv. 12 pages, 34 references parsed.