DBcover: A White-box SQL Test Generation Framework for Coverage Improvement
TL;DR
DBcover is proposed, an LLM-driven database test generation framework that performs white-box, code-aware SQL test generation through contextual reasoning, and substantially outperforms existing fuzzers.
Abstract
Relational Database Management Systems (RDBMSs) form the backbone of modern data-intensive applications, making their reliability and robustness of paramount importance. However, due to the large code base and immense code complexity, achieving high coverage in RDBMS testing remains a formidable challenge. Traditional fuzzing approaches rely on random SQL generation, which fails to capture the intricate correspondence between SQL and paths (SQL-to-path correspondence) within the codebase, leading to low code coverage. Symbolic execution–based methods can, in principle, address this issue but incur prohibitive computational costs and suffer from scalability bottlenecks on large systems. We propose DBcover, an LLM-driven database test generation framework that performs white-box, code-aware SQL test generation through contextual reasoning. DBcover integrates lightweight dynamic analysis to extract SQL-to-path correspondence and call graphs as global context, and constructs source-level dependency information around target functions as local context. Both types of contextual information are organized within a unified knowledge graph, enabling efficient retrieval, reasoning, and reuse across iterative test generation. Built upon this contextual foundation, DBcover adopts a two-phase test generation strategy. In the seed selection phase, it identifies a semantically relevant existing test case by analyzing SQL-to-path relationships within the knowledge graph. In the query generation phase, the LLM, equipped with both global and local context, employs a fine-grained reasoning pipeline to synthesize new SQL test cases that accurately trigger previously uncovered code regions. Experimental results show that DBcover substantially outperforms existing fuzzers, achieving \(80.1\%\) and \(82.3\%\) coverage on PostgreSQL and MySQL. Experiments conducted on an enterprise RDBMS KingbaseES demonstrate the effectiveness and practical applicability of our approach on closed-source RDBMSs.