一句话：提出差分查询执行（DQE），利用相同谓词下不同 SQL 语句应访问相同行来检测 DBMS 的 SELECT、UPDATE、DELETE 逻辑错误。
数据库管理系统（DBMS）通过 SQL 为应用提供高效的数据检索与操作，但实现错误会导致逻辑错误：SELECT 查询返回错误结果，或 UPDATE、DELETE 查询产生错误的数据库状态。现有工作主要关注 SELECT 查询中的逻辑错误，而 UPDATE 和 DELETE 查询中的逻辑错误尚未被处理。本文提出一种新颖且通用的差分查询执行方法（DQE）来检测 SELECT、UPDATE 和 DELETE 查询中的逻辑错误。其核心思想是：具有相同谓词的 SQL 查询通常访问数据库中相同的行。例如，被谓词 φ 的 UPDATE 查询更新的行也应被同一谓词 φ 的 SELECT 查询获取，否则就暴露出目标 DBMS 的逻辑错误。为评估 DQE 的有效性与通用性，作者在五个生产级 DBMS（MySQL、MariaDB、TiDB、CockroachDB 和 SQLite）上应用该方法，共检测到 50 个唯一错误，其中 41 个已被确认，11 个已被修复。作者期望 DQE 的简洁性和通用性能够显著提升 DBMS 的可靠性。
Database Management Systems (DBMSs) provide efficient data retrieval and manipulation for many applications through Structured Query Language (SQL). Incorrect implementations of DBMSs can result in logic bugs, which cause SELECT queries to fetch incorrect results, or UPDATE and DELETE queries to generate incorrect database states. Existing approaches mainly focus on detecting logic bugs in SELECT queries. However, logic bugs in UPDATE and DELETE queries have not been tackled. In this paper, we propose a novel and general approach, which we have termed Differential Query Execution (DQE), to detect logic bugs in SELECT, UPDATE and DELETE queries of DBMSs. The core idea of DQE is that different SQL queries with the same predicate usually access the same rows in a database. For example, a row updated by an UPDATE query with a predicate φ should also be fetched by a SELECT query with the same predicate φ, If not, a logic bug is revealed in the target DBMS. To evaluate the effectiveness and generality of DQE, we apply DQE on five production-level DBMSs, i.e., MySQL, MariaDB, TiDB, CockroachDB and SQLite. In total, we have detected 50 unique bugs in these DBMSs, 41 of which have been confirmed, and 11 have been fixed. We expect that the simplicity and generality of DQE can greatly improve the reliability of DBMSs.
@inproceedings{SongDCDWWZH23,
title = {Testing Database Systems via Differential Query Execution},
author = {Jiansen Song and Wensheng Dou and Ziyu Cui and Qianwang Dai and Wei Wang and Jun Wei and Hua Zhong and Tao Huang},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00175}
}