Finding Bugs in Database Systems via Query Partitioning
summary
Automated testing partitions a query into three cases — ϕ, NOT ϕ, and ϕ IS NULL — then recomposes them (using UNION ALL) and compares results; implemented as Ternary Logic Partitioning (TLP) inside SQLancer. It finds logic bugs (not crashes): about 200 unique bugs across MySQL, TiDB, CockroachDB, DuckDB and others. Concrete examples include MySQL returning an empty result for a 0 vs −0 equality and CockroachDB miscomputing MAX via incorrect partition composition. Continuous integration adoption shows it works.
AI-written summary · about
chapters (11)
- 0:00Query Partitioning intro
- 1:05Logic bugs in DB systems
- 3:01Differential testing challenges
- 4:06Core idea of query partitioning
- 5:38Ternary Logic Partitioning strategy
- 7:41Testing WHERE clauses with TLP
- 8:33Testing aggregates with TLP
- 11:20SQLancer implementation
- 12:27TLP WHERE oracle effectiveness
- 13:15TLP adoption and impact
- 14:21Summary
related talks
10mHow to test software without writing tests
36mSQLancer: Automatically Finding Bugs in Database Management Systems
19mPinolo: Detecting Logical Bugs in Database Management Systems with Approximate...
06mSQLancer: Finding Logic Bugs in Database Management Systems
14mDetecting Logic Bugs in Database Engines via Equivalent Expression Transformation
11mDetecting Transactional Bugs in Database Engines via Graph-Based Oracle Construction
49mHow do we do it? Testing and Verifying bugs for released software
15mDDLumos: Understanding and Detecting Atomic DDL Bugs in DBMSs