一句话：提出 LLM 驱动的白盒 SQL 测试生成框架 DBcover，借助 SQL-路径知识图谱显著提升 RDBMS 代码覆盖率。
关系数据库管理系统代码规模庞大、逻辑复杂，测试覆盖率难以提升。传统 fuzzing 依赖随机 SQL 生成，无法刻画 SQL 与代码路径之间的对应关系（SQL-to-path correspondence），覆盖率低；符号执行方法虽在原理上可行，却计算开销过高、难以扩展到大型系统。本文提出 DBcover，一个 LLM 驱动的数据库测试生成框架，通过上下文推理实现白盒、代码感知的 SQL 测试生成。它用轻量动态分析抽取 SQL 与路径的对应关系及调用图作为全局上下文，并以目标函数周边的源码依赖信息作为局部上下文，将两类上下文统一组织成知识图谱，支持迭代生成中的高效检索、推理与复用。生成采用两阶段策略：种子选择阶段依据知识图中的 SQL-路径关系挑选语义相关的已有测试用例，查询生成阶段由 LLM 结合全局与局部上下文，以细粒度推理流水线合成可触发未覆盖代码的 SQL 测试。实验表明 DBcover 显著优于现有 fuzzer，在 PostgreSQL 与 MySQL 上分别达到 80.1% 和 82.3% 的覆盖率，并在企业级闭源数据库 KingbaseES 上验证了有效性与实用性。
Relational Database Management Systems (RDBMSs) form the backbone of modern data-intensive applications, making their reliability and robustness of paramount importance. However, due to the large code base and immense code complexity, achieving high coverage in RDBMS testing remains a formidable challenge. Traditional fuzzing approaches rely on random SQL generation, which fails to capture the intricate correspondence between SQL and paths (SQL-to-path correspondence) within the codebase, leading to low code coverage. Symbolic execution–based methods can, in principle, address this issue but incur prohibitive computational costs and suffer from scalability bottlenecks on large systems. We propose DBcover, an LLM-driven database test generation framework that performs white-box, code-aware SQL test generation through contextual reasoning. DBcover integrates lightweight dynamic analysis to extract SQL-to-path correspondence and call graphs as global context, and constructs source-level dependency information around target functions as local context. Both types of contextual information are organized within a unified knowledge graph, enabling efficient retrieval, reasoning, and reuse across iterative test generation. Built upon this contextual foundation, DBcover adopts a two-phase test generation strategy. In the seed selection phase, it identifies a semantically relevant existing test case by analyzing SQL-to-path relationships within the knowledge graph. In the query generation phase, the LLM, equipped with both global and local context, employs a fine-grained reasoning pipeline to synthesize new SQL test cases that accurately trigger previously uncovered code regions. Experimental results show that DBcover substantially outperforms existing fuzzers, achieving \(80.1\%\) and \(82.3\%\) coverage on PostgreSQL and MySQL. Experiments conducted on an enterprise RDBMS KingbaseES demonstrate the effectiveness and practical applicability of our approach on closed-source RDBMSs.
@inproceedings{paperbot11592,
title = {DBcover: A White-box SQL Test Generation Framework for Coverage Improvement},
author = {Yankai Rong and Shuang Liu and Jinhao Dong and Qiang Yin and Wei Lu and Jianhua Wang and Xiaoyong Du},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3774748.3793626}
}