ZendDiff: Differential Testing of PHP Interpreter
Read the paper · doi:10.1109/ase63991.2025.00095
What this paper does with SQLancer
Almost every citation here is to FlowFusion, a PHP fuzzer co-authored by one of SQLancer's authors, which ZendDiff adopts as its program generator and measures against -- not to SQLancer itself. SQLancer's own papers appear only as methodological references for using code coverage and for a four-month evaluation period. This paper is a good illustration of why an author's other work has to be kept apart from SQLancer's.
ZendDiff finds logic bugs in the PHP interpreter by differential testing. The authors observe that existing PHP bug-finding targets crashes or sanitizer oracles and misses silent wrong results, and that PHP's JIT compilation mode provides a second implementation of the same specification to compare against. ZendDiff compares JIT and non-JIT execution with program state probing, JIT-aware mutation, and dual verification for non-determinism. It has found 51 previously unknown logic bugs, 37 already fixed.
How it was classified
uses infrastructure — no
ZendDiff adopts FlowFusion as its generator, which is a different tool by an overlapping set of authors. Nothing here says SQLancer is used.
extends technique — no
No technique is extended; the citation is background.
compares with — no
No empirical comparison against SQLancer is reported in the mentions.
describes as state of the art — no
The citation does not characterise SQLancer as the state of the art.
SQLancer publications it cites (4)
Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.
| # | Entry | Matched as |
|---|---|---|
| 7 | Y. Jiang, C. Zhang, B. Ruan, J. Liu, M. Rigger, R. H. Yap, and Z. Liang, “Fuzzing the PHP interpreter via dataflow fusion,” in 34th USENIX Security Symposium (USENIX Security 25), 2025, pp. 6143–6158. | project authored |
| 40 | M. Rigger and Z. Su, “Finding bugs in database systems via query partitioning,” Proc. ACM Program. Lang., vol. 4, no. OOPSLA, nov 2020. [Online]. Available: https://doi-org.libproxy1.nus.edu.sg/10.1145/ 3428279 | sqlancer publication · TLP |
| 41 | ——, “Testing database engines via pivoted query synthesis,” in Proceedings of the 14th USENIX Conference on Operating Systems Design and Implementation, 2020. | sqlancer publication · PQS |
| 44 | M. Kamm, M. Rigger, C. Zhang, and Z. Su, “Testing graph database engines via query partitioning,” in Proceedings of the 32nd ACMSIGSOFT International Symposium on Software Testing and Analysis, 2023, p. 140–149. | project authored |
Every place it refers to SQLancer (10)
10 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.
| Id | Sentence | Found by | Where |
|---|---|---|---|
| M1 | Research efforts [ 3,4,5,6,7,8] have been devoted to uncovering various bugs in the PHP interpreter. |
citation marker project authored |
I INTRODUCTION page 1 |
| M2 | For example, FlowFusion [ 7], utilizes dataflow-guided test case fusion techniques to generate semantic test cases. |
citation marker project authored |
I INTRODUCTION page 1 |
| M3 | As the PHP program generator, ZendDiff adopts FlowFusion [ 7], the state-of-the-art and only generator built for PHP. |
citation marker project authored |
II BACKGROUND page 3 |
| M4 | Figure 2 illustrates the overall workflow of ZendDiff :Test Case Generation (1) leverages an off-the-shelf test case generation approach [ 7] to create a large and diverse corpus. |
citation marker project authored |
III APPROACH page 4 |
| M5 | Differential Input Preparation To generate unique and high-quality test cases for differential testing, ZendDiff leverages an existing state-of-the-art PHP test case generation technique, FlowFusion [ 7] (see Section II). |
citation marker project authored |
A Differential Input Preparation page 4 |
| M6 | Original test cases generated by FlowFusion [ 7] often invoke dynamic introspection APIs such as get_defined_functions() andget_ defined_vars(), which randomly access internal functions and variables. |
citation marker project authored |
IV IMPLEMENTATION page 5 |
| M7 | Code coverage is a widely adopted metric in evaluating fuzzing and testing approaches [ 40,41], as it provides a clear and quantifiable way to evaluate which parts of the code have been executed during tests. |
citation marker |
V EVALUATION page 6 |
| M8 | This testing was carried out over a four-month period, following well-established evaluation methodologies for automated bug-detection tools [ 41,44]. |
citation marker |
A Discovering Previously Unknown Logic Bugs page 6 |
| M9 | Improved Effectiveness of ZendDiff We first evaluate ZendDiff ’s improved effectiveness through a comparison with FlowFusion [ 7], the state-of-the-art PHPspecific fuzzer. |
citation marker project authored |
B Improved Effectiveness of ZendDiff page 8 |
| M10 | FlowFusion [ 7] merges code semantics from two or more seed programs to generate new fuzzing inputs and effectively finds hundreds of memory errors in the PHP interpreter. |
citation marker project authored |
C Ablation Study of ZendDiff page 10 |