GDsmith: Detecting Bugs in Cypher Graph Database Engines

Ziyue Hua, Weisheng Lin, Luyao Ren, Zongyang Li, Lu Zhang, Wenpin Jiao, Tao Xie. 2023. International Symposium on Software Testing and Analysis.

Read the paper · doi:10.1145/3597926.3598046

What this paper does with SQLancer

GDsmith says plainly that its framework is derived from SQLancer, carrying that tool's approach from relational engines to Cypher, and its artifact holds SQLancer's source under a renamed package. PQS, NoREC and TLP are summarised as the relational oracles that came before it. GDsmith tests graph database engines that use Cypher. Its central difficulty is that random test generation struggles to produce property graphs and queries complex enough to return non-empty results, which is what wrong-result bugs require. GDsmith ensures every generated query meets the semantic requirements, and raises the chance of complex non-empty results with graph-guided generation of pattern combinations and data-guided generation of conditions. It detected bugs across three popular open-source graph engines. Written by claude-opus-5 from the 4 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — yes (implementation)

M1 states the framework is derived from SQLancer. The artifact carrying SQLancer source under a renamed package agrees.

Its framework is derived from SQLancer [ 18] (which is a tool to automatically test relational database engines). M1 · 4.1.2 Implementation. We implement the GDsmith prototype with · page 8

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

Its artifact

ddaa2000/GDsmith carries renamed sqlancer package, sqlancer source content match.

Repository is named after GDsmith, the tool this paper says it built, and is about database testing.
# GDsmith
source

src/main/java/org/example/gdsmith/Randomly.java is SQLancer's Randomly.java, with the package renamed to org.example.gdsmith (8 of 8 identifiers match: StringGenerationStrategy, SOPHISTICATED, cachedLongs, cachedStrings, cachedDoubles).
private static StringGenerationStrategy stringGenerationStrategy = StringGenerationStrategy.ALPHANUMERIC;
source

SQLancer publications it cites (4)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
18	Manuel Rigger. 2022. SQLancer: Detecting Logic Bugs in DBMS. https://github. com/sqlancer/sqlancer	sqlancer publication
19	Manuel Rigger and Zhendong Su. 2020. Detecting Optimization Bugs in Database Engines via Non-optimizing Reference Engine Construction. In Proceedings of the 28th ACM Joint European Software Engineering Conference and ...	sqlancer publication · NOREC
20	Manuel Rigger and Zhendong Su. 2020. Finding Bugs in Database Systems via Query Partitioning. Proceedings of the ACM on Programming Languages (2020),211:1–211:30. https://doi.org/10.1145/3428279	sqlancer publication · TLP
21	Manuel Rigger and Zhendong Su. 2020. Testing Database Engines via Pivoted Query Synthesis. In Proceedings of the 14th USENIX Symposium on Operating Systems Design and Implementation. 667–682. https://www.usenix.org/co...	sqlancer publication · PQS

Every place it refers to SQLancer (4)

4 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	Its framework is derived from SQLancer [ 18] (which is a tool to automatically test relational database engines).	name reuse implementation	4.1.2 Implementation. We implement the GDsmith prototype with page 8
M2	PQS [ 21] detects wrong-result bugs by checking whether a specific record is fetched correctly.	technique definition	4.4 Threats to Validity page 11
M3	NoREC [19] detects bugs in a relational database engine by applying a semantic-preserving transformation to a given SQL query to disable the engine’s optimizations and addresses PQS’ high implementation effort.	technique definition	4.4 Threats to Validity page 11
M4	TLP [ 20] derives multiple SQL queries thatcompute a partial result of the initial query.	technique definition	4.4 Threats to Validity page 11

This page is rendered from _data/papers/paper_doi_10_1145_3597926_3598046.json, extracted from supplied pdf. 12 pages, 33 references parsed.