# Squill: Testing DBMS with Correctness Feedback and Accurate Instantiation
## 5 Evaluation
### DBMS Bugs
\begin{table}
\begin{tabular}{l l l l l} \hline
**ID** & **Type** & **Description** & **Status** & **Reference** \\ \hline
**MySQL 8.0.29** & & & & \\
18 & HUAF & Item\_field::used\_tables\_for\_level0 & Verified & BUG108241 \\
19 & AF & handler::ha\_index\_next\_same() & Verified & BUG108242 \\
20 & AF & Bounds\_checked\_array::operator[]() & Verified & BUG108243 \\
21 & SEGV & KEY::records\_per\_key() & Verified & BUG108244 \\
22 & AF & add\_key\_fields() & Verified & BUG108246 \\
23 & AF & add\_key\_field() & Verified & BUG108247 \\
24 & AF & Query\_block::get\_derived\_expr() & Verified & BUG108248 \\
25 & AF & Item\_func\_case:find\_item() & Verified & BUG108249 \\
26 & SBoF & Query\_expression::prepare() & Verified & BUG108251 \\
27 & AF & Item\_func\_in::val\_int() & Verified & BUG108252 \\
28 & SEGV & Item\_ref::walk() & Verified & BUG108253 \\
29 & AF & copy\_contexts() & Verified & BUG108254 \\
30 & SBoF & Item\_func::fix\_fields() & Verified & BUG108255 \\ \hline \multicolumn{4}{l}{**MariaDB 10.335**} & & \\
31 & SEGV & update\_depend\_map\_for\_order() & Verified & MDEV-28502 \\
32 & SEGV & st\_select\_lex:next\_select() & Verified & MDEV-28502 \\
33 & SEGV & get\_addon\_fields() & Verified & MDEV-28503 \\
34 & SEGV & With\_element:get\_name() & Verified & MDEV-28504 \\
35 & SEGV & sub\_select() & Verified & MDEV-28505 \\
36 & AF & find\_field\_in\_table\_ref() & Verified & MDEV-28506 \\
37 & SEGV & Item\_field::fix\_outer\_field() & Verified & MDEV-28507 \\
38 & AF & create\_tmp\_table() & Fixed & MDEV-28508 \\
39 & SEGV & Bitmap::merge() & Verified & MDEV-28509 \\
40 & SEGV & get\_sort\_by\_table() & Verified & MDEV-28510 \\
41 & SEGV & Item\_subset:init\_expr\_cache\_tracker) & Verified & MDEV-28614 \\
42 & AF & handler::ha\_rnd\_next() & Verified & MDEV-28615 \\
43 & SEGV & Item\_ref::fix\_fields() & Verified & MDEV-28616 \\
44 & SEGV & TABLE\_LIST::set\_check\_materialized() & Fixed & MDEV-28617 \\
45 & SEGV & Item\_equal:val\_int() & Verified & MDEV-28618 \\
46 & SEGV & Window\_funcs\_sort:setup() & Verified & MDEV-28619 \\
47 & SEGV & Item\_subsetelect::get\_cache\_parameters() & Verified & MDEV-28620 \\
48 & AF & Item\_subsetelect:exec() & Verified & MDEV-28621 \\
49 & SEGV & Item\_exists\_subselect::exists\_in\_processor() & Verified & MDEV-28622 \\
50 & AF & resolve\_ref\_in\_select\_and\_group() & Verified & MDEV-28623 \\
51 & AF & Item\_field::fix\_fields() & Verified & MDEV-28624 \\ \hline \multicolumn{4}{l}{**MariaDB 10.10.0**} & & \\
52 & SBoF & st\_select\_lex\_unit::set\_unique\_exclude() & Verified & MDEV-29358 \\
53 & HUAF & Field::is\_null() & Verified & MDEV-29359 \\
54 & SEGV & grouping\_field\_transformer\_for\_where() & Verified & MDEV-29360 \\
55 & SBoF & resolve\_references\_to\_cte() & Verified & MDEV-29361 \\
56 & AF & Item\_singlerow\_subselect::val\_int() & Verified & MDEV-29362 \\
57 & HUAF & calc\_group\_buffer() & Verified & MDEV-29363 \\ \hline \multicolumn{4}{l}{**OceanBase 3.14**} & & \\
58 & AF & ObInsertResolver::resolve\_insert\_values() & Fixed & issues 986 \\
59 & HOF & ABitSet::myffsl() & Fixed & issues 987 \\
60 & SEGV & ObLatchMutex::try\_lock() & Fixed & issues 988 \\
61 & AF & ObSelectStmtPrinter::print\_with() & Fixed & issues 989 \\
62 & SEGV & sql::ObExpr::count() & Fixed & issues 995 \\
63 & SEGV & ObMergeJoinOp::ChildRowFetcher::next() & Fixed & issues 1000 \\ \hline \multicolumn{4}{l}{HUAF: heap-use-after-free. SBoF: stack-buffer-overflow. HOF: heap-buffer-overflow. SEGV: segmentation, violation. AE: assertion failure} \\ \end{tabular}
\end{table} 
Table 1: Cont. **Case Study. ** Squill detected a bug in MariaDB (ID 44 in Table 1, PoC in Listing 2), which can cause a DBMS crash by a null pointer accessing. This bug happened in INSERT...SELECT statements whose WHERE condition contains an IN/ANY/ALL predicand with a special GROUP clause, which can be eliminated and contains a subquery over a mergeable derived table referencing the updated table. It is caused by the incorrect access to the derived table which has been eliminated.