Pinolo: Detecting Logical Bugs in Database Management Systems with Approximate...
summary
PINOLO synthesizes queries that are guaranteed to be over-approximations or under-approximations of a seed SQL query by applying concrete mutators (predicate weakening/strengthening, comparison-operator swaps, DISTINCT and set-op edits) against randomly populated tables and iterating evaluation. It flags a logical bug when the DBMS result violates the expected inclusion relation. Evaluated on MySQL, MariaDB, TiDB and OceanBase, it finds 41 unique logical bugs (39 confirmed by developers), 23 serious, 10 present for over five years.
AI-written summary · about
chapters (7)
- 0:00Pinolo and DBMS bugs
- 3:15Detecting DBMS logical bugs
- 9:21Limitations of testing approaches
- 11:51Pinolo's metamorphic testing
- 14:39Experimental results and bugs
- 16:45Limitations and future work
- 18:09Summary
related talks
15mFinding Bugs in Database Systems via Query Partitioning
18mValScope: Value-Semantics-Aware Metamorphic Testing for Detecting Logical Bugs in DBMSs
14mDetecting Logic Bugs in Database Engines via Equivalent Expression Transformation
59mUnder-approximation for Scalable Bug Detection
36mSQLancer: Automatically Finding Bugs in Database Management Systems
15mDDLumos: Understanding and Detecting Atomic DDL Bugs in DBMSs
11mDetecting Transactional Bugs in Database Engines via Graph-Based Oracle Construction
20mPolygon: Symbolic Reasoning for SQL using Conflict-Driven Under-Approximation Search