← Research building on SQLancer

Xiao-Xu Niu, Gong Chen, Jin-Fu Chen, Xiaoyuan Xie. 2026.

Read the paper · arXiv:2608.30385

What this paper does with SQLancer

TLP is one of ERIQ's four baselines, named among state-of-the-art DBMS logic-bug detection approaches alongside EDC, Radar and EET, and included partly because EDC's own evaluation used it. The comparison is a careful one: rather than running each tool, the authors reconstruct test cases from each approach's relation and construction procedure starting from the same minimised cases. TLP detected 9 of ERIQ's 54 bugs -- more than any other baseline, and still a sixth of the total. PQS, NoREC and TLP are each described in related work as the query-level oracles ERIQ is positioned against. ERIQ builds a second representation of a query's intermediate results that must be equivalent to the first, and reports a bug when the two disagree. Where earlier oracles transform the query, the expression, or the database state, ERIQ works on what the query produces part-way through, which reaches bugs in how intermediate results are materialised and reused. On MySQL, MariaDB, Percona and OceanBase it found 54 logic bugs. Written by claude-opus-5 from the 18 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

The baselines are reconstructed from each approach's published procedure rather than run from SQLancer, and nothing states that ERIQ's implementation reuses the codebase.

extends technique — no

ERIQ constructs equivalent representations of intermediate results, which M3 lists as distinct from transforming, partitioning or constructing queries. It is a different oracle, not a generalisation of TLP.

compares with — yes

M5 names TLP as one of four baselines, and M9, M10 and M11 report how many of ERIQ's bugs each baseline could detect and how many each found on its own.

Ternary Logic Partitioning (TLP)

We selected 4 state-of-the-art DBMS logic bug detection approaches as baselines: EDC [ 4], Radar [ 34], EET [ 11], and TLP [ 30]. M5 · 4.1 Experimental Setup · page 6
DBMSERIQ EDC Radar EETTLP MySQL 26 4 4 5 6 MariaDB 11 2 1 1 3 Percona 13 2 1 0 0 OceanBase 4 0 0 0 0 Total 54 8 6 6 9 Among the 54 unique logic bugs detected by ERIQ, EDC, Radar, EET, and TLP could detect 8, 6, 6, and 9 bugs, respectively, corresponding to 14. M9 · 4.3 RQ2: Comparison with Existing Approaches · page 7
TLP detected the largest number of ERIQ-detected bugs in this analysis, but only 9 of the 54 bugs; the other baselines detected even fewer. M10 · 4.3 RQ2: Comparison with Existing Approaches · page 7
Across the 4 target DBMSs, ERIQ detected 54 logic bugs, whereas EDC, Radar, EET, and TLP detected 16, 2, 1, and 6 bugs, respectively. M11 · 4.3 RQ2: Comparison with Existing Approaches · page 7

describes as state of the art — yes

M2 and M5 both describe TLP as one of four state-of-the-art DBMS logic bug detection approaches.

We further compared ERIQ with four state-of-the-art DBMS logic bug detection approaches: EDC [ 4], Radar [ 34], EET [ 11], and TLP [ 30]. M2 · 1 Introduction · page 1
We selected 4 state-of-the-art DBMS logic bug detection approaches as baselines: EDC [ 4], Radar [ 34], EET [ 11], and TLP [ 30]. M5 · 4.1 Experimental Setup · page 6

SQLancer publications it cites (7)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#EntryMatched as
1 Jinsheng Ba and Manuel Rigger. 2023. Testing Database Engines via Query Plan Guidance. In Engineering (ICSE). IEEE, 2060–2071. https://doi.org/10.1109/icse48619.2023. 00174 sqlancer publication · QPG
2 Jinsheng Ba and Manuel Rigger. 2024. Keep it simple: Testing Databases via Differential Query Plans.Proceedings of the ACM on Management of Data2, 3 (2024), 1–26. https://doi.org/10.1145/3654991 sqlancer publication · DQP
29 Manuel Rigger and Zhendong Su. 2020. Detecting Optimization Bugs in Database Engines via Non-optimizing Reference Engine Construction. InProceedings of the 28th ACM Joint Meeting on European Software Engineering Confe... sqlancer publication · NOREC
30 Manuel Rigger and Zhendong Su. 2020. Finding Bugs in Database Systems via Query Partitioning.Proceedings of the ACM on Programming Languages4, OOPSLA (2020), 1–30. https://doi.org/10.1145/3428279 sqlancer publication · TLP
31 Manuel Rigger and Zhendong Su. 2020. Testing Database Engines via Pivoted Query Synthesis. In14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20). 667–682. https://www.usenix.org/conference/o... sqlancer publication · PQS
36 SQLancer. 2026. Automated Testing to Find Logic and Performance Bugs in Database Systems. https://github.com/sqlancer/sqlancer Accessed: 2026-08-01. sqlancer publication
42 Chi Zhang and Manuel Rigger. 2025. Constant Optimization Driven Database System Testing.Proceedings of the ACM on Management of Data3, 1 (2025), 1–24. https://doi.org/10.1145/3709674 sqlancer publication · CODDTEST

Every place it refers to SQLancer (18)

18 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id Sentence Found by Where
M1 For example, NoREC [ 29] compares the results of optimized and unoptimized queries; TLP [ 30] partitions queries based on ternary logic; PQS [ 31] checks whether a selected pivot row appears in the result of a generated query; Pinolo [ 8] checks result containment between synthesized queries and a seed query; EET [1... technique
definition 		1 Introduction
page 1
M2 We further compared ERIQ with four state-of-the-art DBMS logic bug detection approaches: EDC [ 4], Radar [ 34], EET [ 11], and TLP [ 30]. technique
state of the art 		1 Introduction
page 1
M3 For example, existing approaches expose bugs by transforming, partitioning, or constructing queries [ 8,29– 31], transforming query expressions [ 11,42], varying database metadata [ 34], or using precomputed results of data operation expressions [4]. citation marker
background 		2.3 Key Insight
page 3
M4 These DBMSs have been extensively tested by many existing approaches [ 2,4,10,14,33,41]. citation marker
background 		4.1 Experimental Setup
page 6
M5 We selected 4 state-of-the-art DBMS logic bug detection approaches as baselines: EDC [ 4], Radar [ 34], EET [ 11], and TLP [ 30]. technique
state of the art 		4.1 Experimental Setup
page 6
M6 Radar, EET, and TLP were additionally included because they were used as baselines in EDC’s evaluation. technique
baseline 		4.1 Experimental Setup
page 6
M7 1: EDC [ 4], Radar [ 34], EET [ 11], and TLP [ 30]. technique
baseline 		4.3 RQ2: Comparison with Existing Approaches
page 6
M8 Specifically, we started from each minimized test case and constructed corresponding test cases following the relation and construction procedure defined by each approach [ 4,11,30,34]. citation marker
result comparison 		4.3 RQ2: Comparison with Existing Approaches
page 6
M9 DBMSERIQ EDC Radar EETTLP MySQL 26 4 4 5 6 MariaDB 11 2 1 1 3 Percona 13 2 1 0 0 OceanBase 4 0 0 0 0 Total 54 8 6 6 9 Among the 54 unique logic bugs detected by ERIQ, EDC, Radar, EET, and TLP could detect 8, 6, 6, and 9 bugs, respectively, corresponding to 14. technique
result comparison 		4.3 RQ2: Comparison with Existing Approaches
page 7
M10 TLP detected the largest number of ERIQ-detected bugs in this analysis, but only 9 of the 54 bugs; the other baselines detected even fewer. technique
result comparison 		4.3 RQ2: Comparison with Existing Approaches
page 7
M11 Across the 4 target DBMSs, ERIQ detected 54 logic bugs, whereas EDC, Radar, EET, and TLP detected 16, 2, 1, and 6 bugs, respectively. technique
result comparison 		4.3 RQ2: Comparison with Existing Approaches
page 7
M12 Existing approaches have proposed various techniques for detecting DBMS logic bugs [ 2,4,8,11,29– 31,34–36,38,39,42]. citation marker
background 		6 Related Work
page 10
M13 PQS [ 31] synthesizes queries that are guaranteed to return a selected pivot row and detects bugs when the pivot row is missing from the result. technique
definition 		6 Related Work
page 10
M14 NoREC [ 29] rewrites a query into a form that inhibits DBMS optimizations and compares the results of the original and rewritten queries. technique
definition 		6 Related Work
page 10
M15 TLP [ 30] partitions a query according to ternary logic and checks whether the combined results of the partitioned queries are consistent with the original query result. technique
definition 		6 Related Work
page 10
M16 EET [ 11] and CODDTest [ 42] apply equivalent transformations to query expressions and compare the results of the original and transformed queries. technique
definition 		6 Related Work
page 10
M17 Existing DBMS test case generation techniques aim to improve the validity and diversity of generated SQL inputs [ 1,3,5–7,10,12,13,15,32,37,40,43]. citation marker
background 		6 Related Work
page 11
M18 QPG [ 1] uses query-plan diversity to guide databasestate mutations, and MIST [ 3] combines hierarchical SQL-feature guidance, error feedback, and coverage-guided Monte Carlo tree search for LLM-based DBMS test-case generation. technique
definition 		6 Related Work
page 11

This page is rendered from _data/papers/paper_arxiv_2608_30385.json, extracted from arxiv. 12 pages, 43 references parsed.