← Research building on SQLancer

Yushan Zhang, Peisen Yao, Rongxin Wu, Charles Zhang. 2021. arXiv.org.

Read the paper · doi:10.14711/thesis-991012980220103412 · arXiv:2107.03660

What this paper does with SQLancer

PQS, NoREC and TLP are the hand-written transformations the paper sets out to synthesise automatically, and it argues each presumes an explicitly equivalent query pair. SQLancer is named as the only available comparable tool, and the authors then state they omitted the comparison, giving three reasons. This work automates the discovery of query transformations for DBMS correctness testing. Existing transformation-based approaches generate an equivalent query pair and check that the system returns the same results, but rely on transformations written by hand, which limits the input space they explore. The proposed method synthesises many candidate transformations by mutating a query while preserving its duplicate sensitivity -- a necessary condition for equivalence -- then filters out the non-equivalent ones with a query equivalence checker. The tool, Eqsql, found 30 confirmed unique bugs in MySQL, TiDB and CynosDB in two months. Written by claude-opus-5 from the 10 places this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited, not used; nothing in the mentions describes reusing its code.

extends technique — uncertain

The synthesised transformations occupy the same space as NoREC's and TLP's and the paper positions itself as automating what they do by hand, but no mention read claims to extend a named technique.

compares with — no

M7 says the comparison with SQLancer was omitted, giving three reasons. A pattern fired on that sentence, which records the absence of a comparison rather than one.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

SQLancer publications it cites (3)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#EntryMatched as
1 M. Rigger and Z. Su, “Testing database engines via pivoted query synthesis,” in 14th USENIX Symposium on Operating Systems Design and Implementation. USENIX Association, Nov. 2020. sqlancer publication · PQS
8 M. Rigger and Z. Su, “Detecting optimization bugs in database engines via non-optimizing reference engine construction,” in Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Sym... sqlancer publication · NOREC
10 M. Rigger and Z. Su, “Finding bugs in database systems via query partitioning,” Proceedings of the ACM on Programming Languages, vol. 4, no. OOPSLA, pp. 1–30, 2020. sqlancer publication · TLP

Every place it refers to SQLancer (10)

10 sentences, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id Sentence Found by Where
M1 Unexpectedly, researchers could still find hundreds of queries where the popular and production-level DBMSs return wrong result sets [1], though these systems have been extensively tested during their development [2], [3]. citation marker
motivation 		I INTRODUCTION
page 1
M2 Recent studies [6]–[10] have proposed several approaches to better explore the query space. citation marker
background 		I INTRODUCTION
page 1
M3 For example, TLP [10] first generates a query Qand then uses a predefined transformation to on Qto obtain a new equivalent queryQ′. technique
definition 		I INTRODUCTION
page 1
M4 To be more specific, the transformation rule of the existing studies [1], [8], [10] presumes that the generated query pair should explicitly include a “where” predicate (e. citation marker
motivation 		I INTRODUCTION
page 1
M5 Previous work NoREC [8] can only detect such bugs because it only manipulates the “where” predicate to create an unoptimized query mutant. technique
motivation 		III CATEGORY 1: SELECT-FROM-WHERE
page 2
M6 Thus, the only available tool is SQLancer [1], [8], [10]. name
background 		A Evaluation Setup
page 8
M7 We omitted comparison with SQLancer for three reasons. name
background 		A Evaluation Setup
page 8
M8 More recently, PQS [1] synthesizes queries instead of solving constraints. technique
definition 		D RQ3: Coverage Improvement
page 10
M9 Though PQS can generate the test oracle more practically than the previous work, it can only reveal bugs with a symptom of missing the picked row. technique
motivation 		D RQ3: Coverage Improvement
page 10
M10 Similarly, NoREC [8] constructs a non-optimizing version of a query and compares the result. technique
definition 		D RQ3: Coverage Improvement
page 10

This page is rendered from _data/papers/paper_doi_10_14711_thesis_991012980220103412.json, extracted from arxiv. 11 pages, 43 references parsed.