Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Automatically analyzes bugs #69

Open
Hexilee opened this issue Jun 28, 2020 · 0 comments
Open

Automatically analyzes bugs #69

Hexilee opened this issue Jun 28, 2020 · 0 comments

Comments

@Hexilee
Copy link
Contributor

Hexilee commented Jun 28, 2020

Analyzing fuzz-bugs manually is boring and ineffective, we need some tools to find the minimally reproducible SQL automatically.

For example, we find the following tow queries behave differently in TiDB:

--Origin
SELECT
    tmp1.id_3 AS col_1,
    tmp1.col_int_3 AS col_2,
    tmp1.col_float_3 AS col_3,
    tmp2.id_0 AS col_4,
    tmp2.col_int_0 AS col_5,
    tmp3.id_2 AS col_6,
    tmp3.col_varchar_2 AS col_7,
    tmp4.id_1 AS col_8,
    tmp4.col_float_1 AS col_9
FROM
    (
        (
            table_int_float AS tmp1
            RIGHT JOIN table_int AS tmp2 ON !("N" <= tmp1.id_3)
        )
        JOIN table_varchar AS tmp3 ON !(
            ""
            AND 1
        )
    )
    RIGHT JOIN table_float AS tmp4 ON !(tmp1.col_float_3 IS NULL)
WHERE
    (8.835640563878916e-01 != "Keu+~E") IS NOT NULL;

--TLP Transformed
SELECT
    tmp1.id_3 AS col_1,
    tmp1.col_int_3 AS col_2,
    tmp1.col_float_3 AS col_3,
    tmp2.id_0 AS col_4,
    tmp2.col_int_0 AS col_5,
    tmp3.id_2 AS col_6,
    tmp3.col_varchar_2 AS col_7,
    tmp4.id_1 AS col_8,
    tmp4.col_float_1 AS col_9
FROM
    (
        (
            table_int_float AS tmp1
            RIGHT JOIN table_int AS tmp2 ON !("N" <= tmp1.id_3)
        )
        JOIN table_varchar AS tmp3 ON !(
            ""
            AND 1
        )
    )
    RIGHT JOIN table_float AS tmp4 ON !(tmp1.col_float_3 IS NULL)
WHERE
    (8.835640563878916e-01 != "Keu+~E") IS NOT NULL
    AND (
        !(
            (NULLIF("<'T", NULL))
            XOR (
                CASE
                    WHEN "2024-01-31 01:40:35" THEN tmp3.col_varchar_2
                END
            )
        )
    ) IS TRUE
UNION
ALL
SELECT
    tmp1.id_3 AS col_1,
    tmp1.col_int_3 AS col_2,
    tmp1.col_float_3 AS col_3,
    tmp2.id_0 AS col_4,
    tmp2.col_int_0 AS col_5,
    tmp3.id_2 AS col_6,
    tmp3.col_varchar_2 AS col_7,
    tmp4.id_1 AS col_8,
    tmp4.col_float_1 AS col_9
FROM
    (
        (
            table_int_float AS tmp1
            RIGHT JOIN table_int AS tmp2 ON !("N" <= tmp1.id_3)
        )
        JOIN table_varchar AS tmp3 ON !(
            ""
            AND 1
        )
    )
    RIGHT JOIN table_float AS tmp4 ON !(tmp1.col_float_3 IS NULL)
WHERE
    (8.835640563878916e-01 != "Keu+~E") IS NOT NULL
    AND (
        !(
            (NULLIF("<'T", NULL))
            XOR (
                CASE
                    WHEN "2024-01-31 01:40:35" THEN tmp3.col_varchar_2
                END
            )
        )
    ) IS FALSE
UNION
ALL
SELECT
    tmp1.id_3 AS col_1,
    tmp1.col_int_3 AS col_2,
    tmp1.col_float_3 AS col_3,
    tmp2.id_0 AS col_4,
    tmp2.col_int_0 AS col_5,
    tmp3.id_2 AS col_6,
    tmp3.col_varchar_2 AS col_7,
    tmp4.id_1 AS col_8,
    tmp4.col_float_1 AS col_9
FROM
    (
        (
            table_int_float AS tmp1
            RIGHT JOIN table_int AS tmp2 ON !("N" <= tmp1.id_3)
        )
        JOIN table_varchar AS tmp3 ON !(
            ""
            AND 1
        )
    )
    RIGHT JOIN table_float AS tmp4 ON !(tmp1.col_float_3 IS NULL)
WHERE
    (8.835640563878916e-01 != "Keu+~E") IS NOT NULL
    AND (
        !(
            (NULLIF("<'T", NULL))
            XOR (
                CASE
                    WHEN "2024-01-31 01:40:35" THEN tmp3.col_varchar_2
                END
            )
        )
    ) IS NULL;

How to find the minimally reproducible query?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant