r/sqlite • u/copilot_husky • 13d ago

Reliability Lessons From SQLite - Richard Hipp | SSW 2026

https://youtube.com/watch?v=V_qzqY1bb7I&si=RgMXpVIIxNR6l7ML

All about testing

35 Upvotes

97% Upvoted

2 comments sorted by

3

u/anthropoid 13d ago

or: How I Learned To Stop Worrying and Test The Crap Out Of My Software

4

u/rasekrodriguez 12d ago

The part of that testing page that catches people out is the tension section. SQLite holds 100% MC/DC on the core library, and the project's own docs say plainly that this works against fuzz resistance rather than with it. MC/DC discourages defensive code with unreachable branches, and without that defensive code a fuzzer is likelier to find a path that breaks something.

Their framing is that MC/DC gets you code that is robust in normal use, while fuzzing gets you code that is robust against a malicious input, and that doing both at once is genuinely hard. The strategy shifted after AFL arrived in 2014: they kept the 100% MC/DC, but most of the testing CPU now goes to fuzzing instead.

What redeems it is that the two compose in one direction. Because coverage is already total, when a fuzzer does find something they can fix it fast and with little risk of introducing a fresh bug on the way.