一句话：以抽象规则的覆盖反馈引导查询生成，激活更多重写逻辑，从而发现查询重写器中的深层缺陷。
查询重写将查询转换为语义等价但更高效的形式，对查询优化至关重要；然而其实现受重写规则设计、规则交互与语义保持等因素影响，容易出现崩溃或错误结果。现有 DBMS 测试方法面向通用缺陷检测，覆盖的重写场景有限。本文提出抽象规则引导（ARG）模糊测试：抽象规则统一刻画触发重写的模式（如 AST 结构与相关约束）及其转换结果，通过跟踪已覆盖的抽象规则获得反馈，动态调整查询生成、优先探索未覆盖模式，以避免冗余并激活更多重写逻辑。作者实现 ARG 并测试 Apache Calcite、WeTune、SQLSolver 与 LearnedRewrite，共发现 38 个此前未知的缺陷（4 个崩溃、13 个非法 SQL 输出、21 个语义偏差），其中 19 个已确认。与 SQLsmith、SQLancer 相比，24 小时内 ARG 触发的规则分别多 76% 与 1017%，发现的缺陷多 13 与 15 个。
Query rewriters transform a query into a more efficient yet semantically equivalent form, which is vital for optimizing query execution. Despite its importance, query rewriting is inherently complex, influenced by factors including rewrite rule design, rule interactions, and semantic preservation. Consequently, its implementation struggles to prevent problems, which may result in system crashes or incorrect query results. Existing DBMS testing approaches are generally designed for broad bug detection. However, due to the diversity of rewrite rules, they cover only a limited subset of rewrite scenarios, potentially overlooking critical bugs.In this paper, we propose Abstract Rule Guided (ARG) fuzzing to detect bugs in query rewrites. The key idea is to use feedback from abstract rules to guide query generation, thereby activating more rewriting logic and enhancing bug detection. Abstract rules provide a unified representation of the patterns (e.g., AST structures and related constraints) that trigger rewrites, as well as the resulting transformations. We track abstract rules to identify which patterns have been covered. This feedback is then used to dynamically adjust query generation, prioritizing unexplored patterns to avoid redundancy and expose more rewriting logic. We implemented ARG to test four popular query rewrites, namely Apache Calcite, WeTune, SQLSolver, and LearnedRewrite. ARG discovered 38 previously unknown bugs, consisting of 4 crashes, 13 invalid SQL outputs, and 21 semantic deviations. Among them, 19 have been confirmed, while the remaining cases are still under investigation. We also compared ARG against popular DBMS testing tools. In 24 hours, ARG triggered 76% and 1017% more written rules, triggered 13 and 15 more bugs than SQLsmith and SQLancer, respectively.
DOI 原文 ·
@inproceedings{paperbot9321,
title = {ARG: Testing Query Rewriters via Abstract Rule Guided Fuzzing},
author = {Dawei Li and Yuxiao Guo and Qifan Liu and Jie Liang and Zhiyong Wu and Jingzhou Fu and Chi Zhang and Yu Jiang},
booktitle = {ASE},
year = {2025},
doi = {10.1109/ase63991.2025.00151}
}