Detecting Isolation Bugs via Transaction Oracle Construction

Wensheng Dou, Ziyu Cui, Qianwang Dai, Jiansen Song, Dong Wang, Yu Gao, Wei Wang, Jun Wei, Lei Chen, Han Wang, Hua Zhong, Tao Huang. 2023. International Conference on Software Engineering.

Read the paper · doi:10.1109/icse48619.2023.00101

What this paper does with SQLancer

SQLancer supplies Troc's generation and defines the gap Troc fills. The paper states that Troc's database and SQL statement generation is mainly based on SQLancer, and that the schema features it works with -- primary keys, indexes, data types and conditions -- are those SQLancer supports. SQLancer is also among the tools measured against, where the paper's point is structural: it and SQLsmith cannot generate transaction test cases and have no oracle for them, so isolation bugs are outside their reach entirely. PQS, TLP, NoREC and QPG are described as the single-query oracles this work is positioned beyond. Troc detects isolation bugs by constructing an oracle for transactions rather than for single queries. It converts a concurrent transaction schedule into an equivalent set of serial statements whose expected result is computable, so a discrepancy identifies an isolation bug. This addresses a gap the paper states directly: single-query testing approaches neither generate transaction test cases nor have an oracle for them. Written by claude-opus-5 from the 12 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — yes (generator)

M4 states Troc's database and SQL statement generation is mainly based on SQLancer, and M5 that the supported schema features are SQLancer's. The transaction oracle on top is Troc's own.

Troc’s database and SQL statement generation mainly bases on SQLancer [49]. M4 · C Database and SQL Statement Generation · page 5

, primary keys, indexes, various data types, and conditions that are supported by SQLancer [49]. M5 · C Database and SQL Statement Generation · page 5

extends technique — no

Troc constructs an oracle for transaction schedules, which M3 and M7 present as covering what the single-query oracles cannot address rather than generalising one of them.

compares with — yes

M6 names SQLancer among the tools in the overall bug detection comparison, and M7 reports the outcome: it cannot generate transaction test cases and has no oracle for them, so it finds none of these bugs.

, SQLsmith [24], SQLancer [26]–[28], Elle [23] and Cobra [22]. M6 · B Overall Bug Detection Results · page 9

, SQLsmith [24] and SQLancer [26]–[28], cannot generate transaction test cases, and do not have a test oracle for transaction test cases. M7 · B Overall Bug Detection Results · page 9

describes as state of the art — no

Automatic testing approaches are called effective at detecting bugs in DBMSs, which is not a claim that SQLancer is the state of the art.

Its artifact

criszy/Troc carries renamed sqlancer package, sqlancer source content match.

Repository names this paper.
Artifact for "Detecting Isolation Bugs via Transaction Oracle Construction" # Troc This is the artifact for the paper "Detecting Isolation Bugs via Transaction Oracle Construction". See [paper](http://www.tcse.cn/~cuiziyu20/papers/2023-icse-troc.pdf) to learn more details.
source

src/main/java/troc/Randomly.java is SQLancer's Randomly.java, with the package renamed to troc (8 of 8 identifiers match: StringGenerationStrategy, SOPHISTICATED, cachedLongs, cachedStrings, cachedDoubles).
private static StringGenerationStrategy stringGenerationStrategy = StringGenerationStrategy.SOPHISTICATED;
source

SQLancer publications it cites (6)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
26	M. Rigger and Z. Su, “Testing database engines via pivoted query synthesis,” in Proceedings of USENIX Symposium on Operating Systems Design and Implementation (OSDI), 2020, pp. 667–682.	sqlancer publication · PQS
27	——, “Finding bugs in database systems via query partitioning,” Proceedings of the ACM on Programming Languages, vol. 4, no. OOPSLA, pp. 211:1–211:30, 2020.	sqlancer publication · TLP
28	——, “Detecting optimization bugs in database engines via nonoptimizing reference engine construction,” in Proceedings of ACM Joint European Software Engineering Conference and Symposium on theF oundations of Software ...	sqlancer publication · NOREC
49	(2022) SQLancer. [Online]. Available: https://www.manuelrigger.at/ dbms-bugs/	sqlancer publication
69	J. Ba and M. Rigger, “Testing database engines via query plan guidance,”inProceedings of IEEE/ACM International Conference on Software Engineering (ICSE), 2023.	sqlancer publication · QPG
70	M. Kamm, M. Rigger, C. Zhang, and Z. Su, “Testing graph database engines via query partitioning,” in Proceedings of ACMSIGSOFT International Symposium on Software Testing and Analysis (ISSTA), 2023.	project authored

Every place it refers to SQLancer (12)

12 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	Automatic database testing approaches [24]–[28] can support these complex features in modern DBMSs, and have beenproved as an effective technique to detect bugs in DBMSs.	citation marker background	I INTRODUCTION page 1
M2	For example, SQLancer constructs the query partitioning oracle[27] and the containment oracle [26] for a single query.	name definition	I INTRODUCTION page 1
M3	Automatic database testing approaches like SQLancer [26]–[28] detect logic bugs for single queries (i.	name motivation	I INTRODUCTION page 2
M4	Troc’s database and SQL statement generation mainly bases on SQLancer [49].	name reuse component	C Database and SQL Statement Generation page 5
M5	, primary keys, indexes, various data types, and conditions that are supported by SQLancer [49].	name reuse component	C Database and SQL Statement Generation page 5
M6	, SQLsmith [24], SQLancer [26]–[28], Elle [23] and Cobra [22].	name baseline	B Overall Bug Detection Results page 9
M7	, SQLsmith [24] and SQLancer [26]–[28], cannot generate transaction test cases, and do not have a test oracle for transaction test cases.	name result comparison	B Overall Bug Detection Results page 9
M8	, logic bugs [25]–[28].	citation marker background	V DISCUSSION page 10
M9	, SQLancer [49].	name incidental	V DISCUSSION page 11
M10	Many approaches have been proposed for DBMS testing and graph database system testing [24]– [28], [48], [61]–[74].	citation marker background	VI RELA TED WORK page 11
M11	, PQS [26], TLP [27] and NoREC [28].	technique definition	VI RELA TED WORK page 11
M12	QPG [69] utilizes query plans to guide database state mutation for detecting bugs.	technique definition	VI RELA TED WORK page 11

This page is rendered from _data/papers/paper_doi_10_1109_icse48619_2023_00101.json, extracted from supplied pdf. 13 pages, 81 references parsed.