一句话:提出自适应 SQL 生成平台 SQLancer++,将测试预言扩展到任意 SQL DBMS,并在 18 个系统中发现 196 个新 bug。
现有自动化 DBMS 测试依赖针对各 SQL 方言定制的查询生成器与专用测试预言,实现耗时数周,难以扩展到大量系统。本文提出愿景与平台 SQLancer++,旨在对任何支持公共 SQL 特性子集的基于 SQL 的 DBMS 应用测试预言。其核心技术贡献是一种自适应 SQL 语句生成架构:生成器先产生包含多种特性的语句,再通过与 DBMS 交互学习哪些特性被支持,从而随时间推移主要生成有效 SQL。作者在 18 个 DBMS 上评估 SQLancer++,共发现 196 个此前未知的唯一 bug,其中 180 个在报告后得到修复。该工作是实现规模化 DBMS 自动化测试的重要一步,但仍留下多项后续挑战。
Recently, various automated testing approaches have been proposed that use specialized test oracles to find hundreds of logic bugs in mature, widely-used Database Management Systems (DBMSs). These test oracles require database and query generators, which must account for the often significant differences between the SQL dialects of these systems. Since it can take weeks to implement such generators, many DBMS developers are unlikely to invest the time to adopt such automated testing approaches. In short, existing approaches fail to scale to the plethora of DBMSs. In this work, we present both a vision and a platform, SQLancer++, to apply test oracles to any SQL-based DBMS that supports a subset of common SQL features. Our technical core contribution is a novel architecture for an adaptive SQL statement generator. This adaptive SQL generator generates SQL statements with various features, some of which might not be supported by the given DBMS, and then learns through interaction with the DBMS, which of these are understood by the DBMS. Thus, over time, the generator will generate mostly valid SQL statements. We evaluated SQLancer++ across 18 DBMSs and discovered a total of 196 unique, previously unknown bugs, of which 180 were fixed after we reported them. While SQLancer++ is the first major step towards scaling automated DBMS testing, various follow-up challenges remain.