Fossil SCM

Update the built-in SQLite to the latest trunk version that includes all of the fixes that were in the 3.27.2 release.

drh 2019-02-25 17:01 trunk

Commit 4d6086702eec78af6f531c8206b4f165cb1dff827df9d17fff9ee129ad14ca6b

Parent effa89302a7143d…

2 files changed +477 -385 +6 -6

M src/sqlite3.c

+477 -385

		--- src/sqlite3.c
		+++ src/sqlite3.c
		@@ -1,8 +1,8 @@
1	1	/******************************************************************************
2	2	** This file is an amalgamation of many separate C source files from SQLite
3		-** version 3.27.1. By combining all the individual C code files into this
	3	+** version 3.28.0. By combining all the individual C code files into this
4	4	** single large file, the entire code can be compiled as a single translation
5	5	** unit. This allows many compilers to do optimizations that would not be
6	6	** possible if the files were compiled separately. Performance improvements
7	7	** of 5% or more are commonly seen when SQLite is compiled as a single
8	8	** translation unit.
		@@ -1160,13 +1160,13 @@
1160	1160	**
1161	1161	** See also: [sqlite3_libversion()],
1162	1162	** [sqlite3_libversion_number()], [sqlite3_sourceid()],
1163	1163	** [sqlite_version()] and [sqlite_source_id()].
1164	1164	*/
1165		-#define SQLITE_VERSION "3.27.1"
1166		-#define SQLITE_VERSION_NUMBER 3027001
1167		-#define SQLITE_SOURCE_ID "2019-02-08 13:17:39 0eca3dd3d38b31c92b49ca2d311128b74584714d9e7de895b1a6286ef959a1dd"
	1165	+#define SQLITE_VERSION "3.28.0"
	1166	+#define SQLITE_VERSION_NUMBER 3028000
	1167	+#define SQLITE_SOURCE_ID "2019-02-25 14:52:43 9da4fb59b28686630d63a79988b458726332cf06cc0e6e84d7c0a7600f5fcab0"
1168	1168
1169	1169	/*
1170	1170	** CAPI3REF: Run-Time Library Version Numbers
1171	1171	** KEYWORDS: sqlite3_version sqlite3_sourceid
1172	1172	**
		@@ -3406,11 +3406,11 @@
3406	3406	** ^Changes made as part of [foreign key actions] are included in the
3407	3407	** count, but those made as part of REPLACE constraint resolution are
3408	3408	** not. ^Changes to a view that are intercepted by INSTEAD OF triggers
3409	3409	** are not counted.
3410	3410	**
3411		-** This the [sqlite3_total_changes(D)] interface only reports the number
	3411	+** The [sqlite3_total_changes(D)] interface only reports the number
3412	3412	** of rows that changed due to SQL statement run against database
3413	3413	** connection D. Any changes by other database connections are ignored.
3414	3414	** To detect changes against a database file from other database
3415	3415	** connections use the [PRAGMA data_version] command or the
3416	3416	** [SQLITE_FCNTL_DATA_VERSION] [file control].
		@@ -12338,11 +12338,11 @@
12338	12338	** xSetAuxdata(pFts5, pAux, xDelete)
12339	12339	**
12340	12340	** Save the pointer passed as the second argument as the extension functions
12341	12341	** "auxiliary data". The pointer may then be retrieved by the current or any
12342	12342	** future invocation of the same fts5 extension function made as part of
12343		-** of the same MATCH query using the xGetAuxdata() API.
	12343	+** the same MATCH query using the xGetAuxdata() API.
12344	12344	**
12345	12345	** Each extension function is allocated a single auxiliary data slot for
12346	12346	** each FTS query (MATCH expression). If the extension function is invoked
12347	12347	** more than once for a single FTS query, then all invocations share a
12348	12348	** single auxiliary data context.
		@@ -12353,11 +12353,11 @@
12353	12353	** point.
12354	12354	**
12355	12355	** The xDelete callback, if one is specified, is also invoked on the
12356	12356	** auxiliary data pointer after the FTS5 query has finished.
12357	12357	**
12358		-** If an error (e.g. an OOM condition) occurs within this function, an
	12358	+** If an error (e.g. an OOM condition) occurs within this function,
12359	12359	** the auxiliary data is set to NULL and an error code returned. If the
12360	12360	** xDelete parameter was not NULL, it is invoked on the auxiliary data
12361	12361	** pointer before returning.
12362	12362	**
12363	12363	**
		@@ -14935,61 +14935,60 @@
14935	14935	#define OP_ColumnsUsed 118
14936	14936	#define OP_SeekHit 119 /* synopsis: seekHit=P2 */
14937	14937	#define OP_Sequence 120 /* synopsis: r[P2]=cursor[P1].ctr++ */
14938	14938	#define OP_NewRowid 121 /* synopsis: r[P2]=rowid */
14939	14939	#define OP_Insert 122 /* synopsis: intkey=r[P3] data=r[P2] */
14940		-#define OP_InsertInt 123 /* synopsis: intkey=P3 data=r[P2] */
14941		-#define OP_Delete 124
14942		-#define OP_ResetCount 125
14943		-#define OP_SorterCompare 126 /* synopsis: if key(P1)!=trim(r[P3],P4) goto P2 */
14944		-#define OP_SorterData 127 /* synopsis: r[P2]=data */
14945		-#define OP_RowData 128 /* synopsis: r[P2]=data */
14946		-#define OP_Rowid 129 /* synopsis: r[P2]=rowid */
14947		-#define OP_NullRow 130
14948		-#define OP_SeekEnd 131
14949		-#define OP_SorterInsert 132 /* synopsis: key=r[P2] */
14950		-#define OP_IdxInsert 133 /* synopsis: key=r[P2] */
14951		-#define OP_IdxDelete 134 /* synopsis: key=r[P2@P3] */
14952		-#define OP_DeferredSeek 135 /* synopsis: Move P3 to P1.rowid if needed */
14953		-#define OP_IdxRowid 136 /* synopsis: r[P2]=rowid */
14954		-#define OP_Destroy 137
14955		-#define OP_Clear 138
14956		-#define OP_ResetSorter 139
14957		-#define OP_CreateBtree 140 /* synopsis: r[P2]=root iDb=P1 flags=P3 */
	14940	+#define OP_Delete 123
	14941	+#define OP_ResetCount 124
	14942	+#define OP_SorterCompare 125 /* synopsis: if key(P1)!=trim(r[P3],P4) goto P2 */
	14943	+#define OP_SorterData 126 /* synopsis: r[P2]=data */
	14944	+#define OP_RowData 127 /* synopsis: r[P2]=data */
	14945	+#define OP_Rowid 128 /* synopsis: r[P2]=rowid */
	14946	+#define OP_NullRow 129
	14947	+#define OP_SeekEnd 130
	14948	+#define OP_SorterInsert 131 /* synopsis: key=r[P2] */
	14949	+#define OP_IdxInsert 132 /* synopsis: key=r[P2] */
	14950	+#define OP_IdxDelete 133 /* synopsis: key=r[P2@P3] */
	14951	+#define OP_DeferredSeek 134 /* synopsis: Move P3 to P1.rowid if needed */
	14952	+#define OP_IdxRowid 135 /* synopsis: r[P2]=rowid */
	14953	+#define OP_Destroy 136
	14954	+#define OP_Clear 137
	14955	+#define OP_ResetSorter 138
	14956	+#define OP_CreateBtree 139 /* synopsis: r[P2]=root iDb=P1 flags=P3 */
	14957	+#define OP_SqlExec 140
14958	14958	#define OP_Real 141 /* same as TK_FLOAT, synopsis: r[P2]=P4 */
14959		-#define OP_SqlExec 142
14960		-#define OP_ParseSchema 143
14961		-#define OP_LoadAnalysis 144
14962		-#define OP_DropTable 145
14963		-#define OP_DropIndex 146
14964		-#define OP_DropTrigger 147
14965		-#define OP_IntegrityCk 148
14966		-#define OP_RowSetAdd 149 /* synopsis: rowset(P1)=r[P2] */
14967		-#define OP_Param 150
14968		-#define OP_FkCounter 151 /* synopsis: fkctr[P1]+=P2 */
14969		-#define OP_MemMax 152 /* synopsis: r[P1]=max(r[P1],r[P2]) */
14970		-#define OP_OffsetLimit 153 /* synopsis: if r[P1]>0 then r[P2]=r[P1]+max(0,r[P3]) else r[P2]=(-1) */
14971		-#define OP_AggInverse 154 /* synopsis: accum=r[P3] inverse(r[P2@P5]) */
14972		-#define OP_AggStep 155 /* synopsis: accum=r[P3] step(r[P2@P5]) */
14973		-#define OP_AggStep1 156 /* synopsis: accum=r[P3] step(r[P2@P5]) */
14974		-#define OP_AggValue 157 /* synopsis: r[P3]=value N=P2 */
14975		-#define OP_AggFinal 158 /* synopsis: accum=r[P1] N=P2 */
14976		-#define OP_Expire 159
14977		-#define OP_TableLock 160 /* synopsis: iDb=P1 root=P2 write=P3 */
14978		-#define OP_VBegin 161
14979		-#define OP_VCreate 162
14980		-#define OP_VDestroy 163
14981		-#define OP_VOpen 164
14982		-#define OP_VColumn 165 /* synopsis: r[P3]=vcolumn(P2) */
14983		-#define OP_VRename 166
14984		-#define OP_Pagecount 167
14985		-#define OP_MaxPgcnt 168
14986		-#define OP_Trace 169
14987		-#define OP_CursorHint 170
14988		-#define OP_Noop 171
14989		-#define OP_Explain 172
14990		-#define OP_Abortable 173
	14959	+#define OP_ParseSchema 142
	14960	+#define OP_LoadAnalysis 143
	14961	+#define OP_DropTable 144
	14962	+#define OP_DropIndex 145
	14963	+#define OP_DropTrigger 146
	14964	+#define OP_IntegrityCk 147
	14965	+#define OP_RowSetAdd 148 /* synopsis: rowset(P1)=r[P2] */
	14966	+#define OP_Param 149
	14967	+#define OP_FkCounter 150 /* synopsis: fkctr[P1]+=P2 */
	14968	+#define OP_MemMax 151 /* synopsis: r[P1]=max(r[P1],r[P2]) */
	14969	+#define OP_OffsetLimit 152 /* synopsis: if r[P1]>0 then r[P2]=r[P1]+max(0,r[P3]) else r[P2]=(-1) */
	14970	+#define OP_AggInverse 153 /* synopsis: accum=r[P3] inverse(r[P2@P5]) */
	14971	+#define OP_AggStep 154 /* synopsis: accum=r[P3] step(r[P2@P5]) */
	14972	+#define OP_AggStep1 155 /* synopsis: accum=r[P3] step(r[P2@P5]) */
	14973	+#define OP_AggValue 156 /* synopsis: r[P3]=value N=P2 */
	14974	+#define OP_AggFinal 157 /* synopsis: accum=r[P1] N=P2 */
	14975	+#define OP_Expire 158
	14976	+#define OP_TableLock 159 /* synopsis: iDb=P1 root=P2 write=P3 */
	14977	+#define OP_VBegin 160
	14978	+#define OP_VCreate 161
	14979	+#define OP_VDestroy 162
	14980	+#define OP_VOpen 163
	14981	+#define OP_VColumn 164 /* synopsis: r[P3]=vcolumn(P2) */
	14982	+#define OP_VRename 165
	14983	+#define OP_Pagecount 166
	14984	+#define OP_MaxPgcnt 167
	14985	+#define OP_Trace 168
	14986	+#define OP_CursorHint 169
	14987	+#define OP_Noop 170
	14988	+#define OP_Explain 171
	14989	+#define OP_Abortable 172
14991	14990
14992	14991	/* Properties such as "out2" or "jump" that are specified in
14993	14992	** comments following the "case" for each opcode in the vdbe.c
14994	14993	** are encoded into bitvectors as follows:
14995	14994	*/
		@@ -15014,16 +15013,16 @@
15014	15013	/* 88 */ 0x12, 0x20, 0x00, 0x00, 0x26, 0x26, 0x26, 0x26,\
15015	15014	/* 96 */ 0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x00, 0x12,\
15016	15015	/* 104 */ 0x10, 0x10, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,\
15017	15016	/* 112 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
15018	15017	/* 120 */ 0x10, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
15019		-/* 128 */ 0x00, 0x10, 0x00, 0x00, 0x04, 0x04, 0x00, 0x00,\
15020		-/* 136 */ 0x10, 0x10, 0x00, 0x00, 0x10, 0x10, 0x00, 0x00,\
15021		-/* 144 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x10, 0x00,\
15022		-/* 152 */ 0x04, 0x1a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
15023		-/* 160 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10,\
15024		-/* 168 */ 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,}
	15018	+/* 128 */ 0x10, 0x00, 0x00, 0x04, 0x04, 0x00, 0x00, 0x10,\
	15019	+/* 136 */ 0x10, 0x00, 0x00, 0x10, 0x00, 0x10, 0x00, 0x00,\
	15020	+/* 144 */ 0x00, 0x00, 0x00, 0x00, 0x06, 0x10, 0x00, 0x04,\
	15021	+/* 152 */ 0x1a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
	15022	+/* 160 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x10,\
	15023	+/* 168 */ 0x00, 0x00, 0x00, 0x00, 0x00,}
15025	15024
15026	15025	/* The sqlite3P2Values() routine is able to run faster if it knows
15027	15026	** the value of the largest JUMP opcode. The smaller the maximum
15028	15027	** JUMP opcode the better, so the mkopcodeh.tcl script that
15029	15028	** generated this include file strives to group all JUMP opcodes
		@@ -16324,10 +16323,11 @@
16324	16323	int (xCommitCallback)(void); /* Invoked at every commit. */
16325	16324	void pRollbackArg; / Argument to xRollbackCallback() */
16326	16325	void (xRollbackCallback)(void); /* Invoked at every commit. */
16327	16326	void *pUpdateArg;
16328	16327	void (xUpdateCallback)(void,int, const char,const char,sqlite_int64);
	16328	+ Parse pParse; / Current parse */
16329	16329	#ifdef SQLITE_ENABLE_PREUPDATE_HOOK
16330	16330	void pPreUpdateArg; / First argument to xPreUpdateCallback */
16331	16331	void (xPreUpdateCallback)( / Registered using sqlite3_preupdate_hook() */
16332	16332	void,sqlite3,int,char const,char const,sqlite3_int64,sqlite3_int64
16333	16333	);
		@@ -17987,10 +17987,11 @@
17987	17987	TableLock aTableLock; / Required table locks for shared-cache mode */
17988	17988	#endif
17989	17989	AutoincInfo pAinc; / Information about AUTOINCREMENT counters */
17990	17990	Parse pToplevel; / Parse structure for main program (or NULL) */
17991	17991	Table pTriggerTab; / Table triggers are being coded for */
	17992	+ Parse pParentParse; / Parent parser if this parser is nested */
17992	17993	int addrCrTab; /* Address of OP_CreateBtree opcode on CREATE TABLE */
17993	17994	u32 nQueryLoop; /* Est number of iterations of a query (10log2(N)) /
17994	17995	u32 oldmask; /* Mask of old.* columns referenced */
17995	17996	u32 newmask; /* Mask of new.* columns referenced */
17996	17997	u8 eTriggerOp; /* TK_UPDATE, TK_INSERT or TK_DELETE */
		@@ -19172,11 +19173,11 @@
19172	19173	SQLITE_PRIVATE void sqlite3AlterRenameTable(Parse, SrcList, Token*);
19173	19174	SQLITE_PRIVATE void sqlite3AlterRenameColumn(Parse, SrcList, Token, Token);
19174	19175	SQLITE_PRIVATE int sqlite3GetToken(const unsigned char , int );
19175	19176	SQLITE_PRIVATE void sqlite3NestedParse(Parse, const char, ...);
19176	19177	SQLITE_PRIVATE void sqlite3ExpirePreparedStatements(sqlite3*, int);
19177		-SQLITE_PRIVATE void sqlite3CodeRhsOfIN(Parse, Expr, int, int);
	19178	+SQLITE_PRIVATE void sqlite3CodeRhsOfIN(Parse, Expr, int);
19178	19179	SQLITE_PRIVATE int sqlite3CodeSubselect(Parse, Expr);
19179	19180	SQLITE_PRIVATE void sqlite3SelectPrep(Parse, Select, NameContext*);
19180	19181	SQLITE_PRIVATE void sqlite3SelectWrongNumTermsError(Parse pParse, Select p);
19181	19182	SQLITE_PRIVATE int sqlite3MatchSpanName(const char, const char, const char, const char);
19182	19183	SQLITE_PRIVATE int sqlite3ResolveExprNames(NameContext, Expr);
		@@ -27119,10 +27120,13 @@
27119	27120	db->mallocFailed = 1;
27120	27121	if( db->nVdbeExec>0 ){
27121	27122	db->u1.isInterrupted = 1;
27122	27123	}
27123	27124	db->lookaside.bDisable++;
	27125	+ if( db->pParse ){
	27126	+ db->pParse->rc = SQLITE_NOMEM_BKPT;
	27127	+ }
27124	27128	}
27125	27129	}
27126	27130
27127	27131	/*
27128	27132	** This routine reactivates the memory allocator and clears the
		@@ -27312,11 +27316,11 @@
27312	27316	** Set the StrAccum object to an error mode.
27313	27317	*/
27314	27318	static void setStrAccumError(StrAccum *p, u8 eError){
27315	27319	assert( eError==SQLITE_NOMEM \|\| eError==SQLITE_TOOBIG );
27316	27320	p->accError = eError;
27317		- p->nAlloc = 0;
	27321	+ if( p->mxAlloc ) sqlite3_str_reset(p);
27318	27322	}
27319	27323
27320	27324	/*
27321	27325	** Extra argument values from a PrintfArguments object
27322	27326	*/
		@@ -27342,10 +27346,11 @@
27342	27346	** SQL from requesting large allocations using the precision or width
27343	27347	** field of the printf() function.
27344	27348	*/
27345	27349	static char printfTempBuf(sqlite3_str pAccum, sqlite3_int64 n){
27346	27350	char *z;
	27351	+ if( pAccum->accError ) return 0;
27347	27352	if( n>pAccum->nAlloc && n>pAccum->mxAlloc ){
27348	27353	setStrAccumError(pAccum, SQLITE_TOOBIG);
27349	27354	return 0;
27350	27355	}
27351	27356	z = sqlite3DbMallocRaw(pAccum->db, n);
		@@ -28061,13 +28066,12 @@
28061	28066	testcase(p->accError==SQLITE_TOOBIG);
28062	28067	testcase(p->accError==SQLITE_NOMEM);
28063	28068	return 0;
28064	28069	}
28065	28070	if( p->mxAlloc==0 ){
28066		- N = p->nAlloc - p->nChar - 1;
28067	28071	setStrAccumError(p, SQLITE_TOOBIG);
28068		- return N;
	28072	+ return p->nAlloc - p->nChar - 1;
28069	28073	}else{
28070	28074	char *zOld = isMalloced(p) ? p->zText : 0;
28071	28075	i64 szNew = p->nChar;
28072	28076	szNew += N + 1;
28073	28077	if( szNew+p->nChar<=p->mxAlloc ){
		@@ -28135,11 +28139,11 @@
28135	28139	*/
28136	28140	SQLITE_API void sqlite3_str_append(sqlite3_str p, const char z, int N){
28137	28141	assert( z!=0 \|\| N==0 );
28138	28142	assert( p->zText!=0 \|\| p->nChar==0 \|\| p->accError );
28139	28143	assert( N>=0 );
28140		- assert( p->accError==0 \|\| p->nAlloc==0 );
	28144	+ assert( p->accError==0 \|\| p->nAlloc==0 \|\| p->mxAlloc==0 );
28141	28145	if( p->nChar+N >= p->nAlloc ){
28142	28146	enlargeAndAppend(p,z,N);
28143	28147	}else if( N ){
28144	28148	assert( p->zText );
28145	28149	p->nChar += N;
		@@ -32137,61 +32141,60 @@
32137	32141	/* 118 */ "ColumnsUsed" OpHelp(""),
32138	32142	/* 119 */ "SeekHit" OpHelp("seekHit=P2"),
32139	32143	/* 120 */ "Sequence" OpHelp("r[P2]=cursor[P1].ctr++"),
32140	32144	/* 121 */ "NewRowid" OpHelp("r[P2]=rowid"),
32141	32145	/* 122 */ "Insert" OpHelp("intkey=r[P3] data=r[P2]"),
32142		- /* 123 */ "InsertInt" OpHelp("intkey=P3 data=r[P2]"),
32143		- /* 124 */ "Delete" OpHelp(""),
32144		- /* 125 */ "ResetCount" OpHelp(""),
32145		- /* 126 */ "SorterCompare" OpHelp("if key(P1)!=trim(r[P3],P4) goto P2"),
32146		- /* 127 */ "SorterData" OpHelp("r[P2]=data"),
32147		- /* 128 */ "RowData" OpHelp("r[P2]=data"),
32148		- /* 129 */ "Rowid" OpHelp("r[P2]=rowid"),
32149		- /* 130 */ "NullRow" OpHelp(""),
32150		- /* 131 */ "SeekEnd" OpHelp(""),
32151		- /* 132 */ "SorterInsert" OpHelp("key=r[P2]"),
32152		- /* 133 */ "IdxInsert" OpHelp("key=r[P2]"),
32153		- /* 134 */ "IdxDelete" OpHelp("key=r[P2@P3]"),
32154		- /* 135 */ "DeferredSeek" OpHelp("Move P3 to P1.rowid if needed"),
32155		- /* 136 */ "IdxRowid" OpHelp("r[P2]=rowid"),
32156		- /* 137 */ "Destroy" OpHelp(""),
32157		- /* 138 */ "Clear" OpHelp(""),
32158		- /* 139 */ "ResetSorter" OpHelp(""),
32159		- /* 140 */ "CreateBtree" OpHelp("r[P2]=root iDb=P1 flags=P3"),
	32146	+ /* 123 */ "Delete" OpHelp(""),
	32147	+ /* 124 */ "ResetCount" OpHelp(""),
	32148	+ /* 125 */ "SorterCompare" OpHelp("if key(P1)!=trim(r[P3],P4) goto P2"),
	32149	+ /* 126 */ "SorterData" OpHelp("r[P2]=data"),
	32150	+ /* 127 */ "RowData" OpHelp("r[P2]=data"),
	32151	+ /* 128 */ "Rowid" OpHelp("r[P2]=rowid"),
	32152	+ /* 129 */ "NullRow" OpHelp(""),
	32153	+ /* 130 */ "SeekEnd" OpHelp(""),
	32154	+ /* 131 */ "SorterInsert" OpHelp("key=r[P2]"),
	32155	+ /* 132 */ "IdxInsert" OpHelp("key=r[P2]"),
	32156	+ /* 133 */ "IdxDelete" OpHelp("key=r[P2@P3]"),
	32157	+ /* 134 */ "DeferredSeek" OpHelp("Move P3 to P1.rowid if needed"),
	32158	+ /* 135 */ "IdxRowid" OpHelp("r[P2]=rowid"),
	32159	+ /* 136 */ "Destroy" OpHelp(""),
	32160	+ /* 137 */ "Clear" OpHelp(""),
	32161	+ /* 138 */ "ResetSorter" OpHelp(""),
	32162	+ /* 139 */ "CreateBtree" OpHelp("r[P2]=root iDb=P1 flags=P3"),
	32163	+ /* 140 */ "SqlExec" OpHelp(""),
32160	32164	/* 141 */ "Real" OpHelp("r[P2]=P4"),
32161		- /* 142 */ "SqlExec" OpHelp(""),
32162		- /* 143 */ "ParseSchema" OpHelp(""),
32163		- /* 144 */ "LoadAnalysis" OpHelp(""),
32164		- /* 145 */ "DropTable" OpHelp(""),
32165		- /* 146 */ "DropIndex" OpHelp(""),
32166		- /* 147 */ "DropTrigger" OpHelp(""),
32167		- /* 148 */ "IntegrityCk" OpHelp(""),
32168		- /* 149 */ "RowSetAdd" OpHelp("rowset(P1)=r[P2]"),
32169		- /* 150 */ "Param" OpHelp(""),
32170		- /* 151 */ "FkCounter" OpHelp("fkctr[P1]+=P2"),
32171		- /* 152 */ "MemMax" OpHelp("r[P1]=max(r[P1],r[P2])"),
32172		- /* 153 */ "OffsetLimit" OpHelp("if r[P1]>0 then r[P2]=r[P1]+max(0,r[P3]) else r[P2]=(-1)"),
32173		- /* 154 */ "AggInverse" OpHelp("accum=r[P3] inverse(r[P2@P5])"),
32174		- /* 155 */ "AggStep" OpHelp("accum=r[P3] step(r[P2@P5])"),
32175		- /* 156 */ "AggStep1" OpHelp("accum=r[P3] step(r[P2@P5])"),
32176		- /* 157 */ "AggValue" OpHelp("r[P3]=value N=P2"),
32177		- /* 158 */ "AggFinal" OpHelp("accum=r[P1] N=P2"),
32178		- /* 159 */ "Expire" OpHelp(""),
32179		- /* 160 */ "TableLock" OpHelp("iDb=P1 root=P2 write=P3"),
32180		- /* 161 */ "VBegin" OpHelp(""),
32181		- /* 162 */ "VCreate" OpHelp(""),
32182		- /* 163 */ "VDestroy" OpHelp(""),
32183		- /* 164 */ "VOpen" OpHelp(""),
32184		- /* 165 */ "VColumn" OpHelp("r[P3]=vcolumn(P2)"),
32185		- /* 166 */ "VRename" OpHelp(""),
32186		- /* 167 */ "Pagecount" OpHelp(""),
32187		- /* 168 */ "MaxPgcnt" OpHelp(""),
32188		- /* 169 */ "Trace" OpHelp(""),
32189		- /* 170 */ "CursorHint" OpHelp(""),
32190		- /* 171 */ "Noop" OpHelp(""),
32191		- /* 172 */ "Explain" OpHelp(""),
32192		- /* 173 */ "Abortable" OpHelp(""),
	32165	+ /* 142 */ "ParseSchema" OpHelp(""),
	32166	+ /* 143 */ "LoadAnalysis" OpHelp(""),
	32167	+ /* 144 */ "DropTable" OpHelp(""),
	32168	+ /* 145 */ "DropIndex" OpHelp(""),
	32169	+ /* 146 */ "DropTrigger" OpHelp(""),
	32170	+ /* 147 */ "IntegrityCk" OpHelp(""),
	32171	+ /* 148 */ "RowSetAdd" OpHelp("rowset(P1)=r[P2]"),
	32172	+ /* 149 */ "Param" OpHelp(""),
	32173	+ /* 150 */ "FkCounter" OpHelp("fkctr[P1]+=P2"),
	32174	+ /* 151 */ "MemMax" OpHelp("r[P1]=max(r[P1],r[P2])"),
	32175	+ /* 152 */ "OffsetLimit" OpHelp("if r[P1]>0 then r[P2]=r[P1]+max(0,r[P3]) else r[P2]=(-1)"),
	32176	+ /* 153 */ "AggInverse" OpHelp("accum=r[P3] inverse(r[P2@P5])"),
	32177	+ /* 154 */ "AggStep" OpHelp("accum=r[P3] step(r[P2@P5])"),
	32178	+ /* 155 */ "AggStep1" OpHelp("accum=r[P3] step(r[P2@P5])"),
	32179	+ /* 156 */ "AggValue" OpHelp("r[P3]=value N=P2"),
	32180	+ /* 157 */ "AggFinal" OpHelp("accum=r[P1] N=P2"),
	32181	+ /* 158 */ "Expire" OpHelp(""),
	32182	+ /* 159 */ "TableLock" OpHelp("iDb=P1 root=P2 write=P3"),
	32183	+ /* 160 */ "VBegin" OpHelp(""),
	32184	+ /* 161 */ "VCreate" OpHelp(""),
	32185	+ /* 162 */ "VDestroy" OpHelp(""),
	32186	+ /* 163 */ "VOpen" OpHelp(""),
	32187	+ /* 164 */ "VColumn" OpHelp("r[P3]=vcolumn(P2)"),
	32188	+ /* 165 */ "VRename" OpHelp(""),
	32189	+ /* 166 */ "Pagecount" OpHelp(""),
	32190	+ /* 167 */ "MaxPgcnt" OpHelp(""),
	32191	+ /* 168 */ "Trace" OpHelp(""),
	32192	+ /* 169 */ "CursorHint" OpHelp(""),
	32193	+ /* 170 */ "Noop" OpHelp(""),
	32194	+ /* 171 */ "Explain" OpHelp(""),
	32195	+ /* 172 */ "Abortable" OpHelp(""),
32193	32196	};
32194	32197	return azName[i];
32195	32198	}
32196	32199	#endif
32197	32200
		@@ -40217,10 +40220,13 @@
40217	40220	static sqlite3_vfs aVfs[] = {
40218	40221	#if SQLITE_ENABLE_LOCKING_STYLE && defined(__APPLE__)
40219	40222	UNIXVFS("unix", autolockIoFinder ),
40220	40223	#elif OS_VXWORKS
40221	40224	UNIXVFS("unix", vxworksIoFinder ),
	40225	+#elif __Fuchsia__
	40226	+ /* We are told that Fuchsia only supports dot-file locking */
	40227	+ UNIXVFS("unix", dotlockIoFinder ),
40222	40228	#else
40223	40229	UNIXVFS("unix", posixIoFinder ),
40224	40230	#endif
40225	40231	UNIXVFS("unix-none", nolockIoFinder ),
40226	40232	UNIXVFS("unix-dotfile", dotlockIoFinder ),
		@@ -58162,11 +58168,11 @@
58162	58168	** Release a lock obtained by an earlier successful call to
58163	58169	** sqlite3PagerSnapshotCheck().
58164	58170	*/
58165	58171	SQLITE_PRIVATE void sqlite3PagerSnapshotUnlock(Pager *pPager){
58166	58172	assert( pPager->pWal );
58167		- return sqlite3WalSnapshotUnlock(pPager->pWal);
	58173	+ sqlite3WalSnapshotUnlock(pPager->pWal);
58168	58174	}
58169	58175
58170	58176	#endif /* SQLITE_ENABLE_SNAPSHOT */
58171	58177	#endif /* !SQLITE_OMIT_WAL */
58172	58178
		@@ -62338,11 +62344,11 @@
62338	62344	u8 max1bytePayload; /* min(maxLocal,127) */
62339	62345	u8 nOverflow; /* Number of overflow cell bodies in aCell[] */
62340	62346	u16 maxLocal; /* Copy of BtShared.maxLocal or BtShared.maxLeaf */
62341	62347	u16 minLocal; /* Copy of BtShared.minLocal or BtShared.minLeaf */
62342	62348	u16 cellOffset; /* Index in aData of first cell pointer */
62343		- u16 nFree; /* Number of free bytes on the page */
	62349	+ int nFree; /* Number of free bytes on the page. -1 for unknown */
62344	62350	u16 nCell; /* Number of cells on this page, local and ovfl */
62345	62351	u16 maskPage; /* Mask for page offset */
62346	62352	u16 aiOvfl[4]; /* Insert the i-th overflow cell before the aiOvfl-th
62347	62353	** non-overflow cell */
62348	62354	u8 apOvfl[4]; / Pointers to the body of overflow cells */
		@@ -64492,12 +64498,12 @@
64492	64498	** offsets to each pointer in the cell-pointer array than it is to
64493	64499	** reconstruct the entire page. */
64494	64500	if( (int)data[hdr+7]<=nMaxFrag ){
64495	64501	int iFree = get2byte(&data[hdr+1]);
64496	64502
64497		- /* If the initial freeblock offset were out of bounds, that would
64498		- ** have been detected by btreeInitPage() when it was computing the
	64503	+ /* If the initial freeblock offset were out of bounds, that would have
	64504	+ ** been detected by btreeComputeFreeSpace() when it was computing the
64499	64505	** number of free bytes on the page. */
64500	64506	assert( iFree<=usableSize-4 );
64501	64507	if( iFree ){
64502	64508	int iFree2 = get2byte(&data[iFree]);
64503	64509	if( iFree2>usableSize-4 ) return SQLITE_CORRUPT_PAGE(pPage);
		@@ -64565,10 +64571,11 @@
64565	64571	memcpy(&data[cbrk], &src[pc], size);
64566	64572	}
64567	64573	data[hdr+7] = 0;
64568	64574
64569	64575	defragment_out:
	64576	+ assert( pPage->nFree>=0 );
64570	64577	if( data[hdr+7]+cbrk-iCellFirst!=pPage->nFree ){
64571	64578	return SQLITE_CORRUPT_PAGE(pPage);
64572	64579	}
64573	64580	assert( cbrk>=iCellFirst );
64574	64581	put2byte(&data[hdr+5], cbrk);
		@@ -64592,54 +64599,61 @@
64592	64599	** Slots on the free list that are between 1 and 3 bytes larger than nByte
64593	64600	** will be ignored if adding the extra space to the fragmentation count
64594	64601	** causes the fragmentation count to exceed 60.
64595	64602	*/
64596	64603	static u8 pageFindSlot(MemPage pPg, int nByte, int *pRc){
64597		- const int hdr = pPg->hdrOffset;
64598		- u8 * const aData = pPg->aData;
64599		- int iAddr = hdr + 1;
64600		- int pc = get2byte(&aData[iAddr]);
64601		- int x;
64602		- int usableSize = pPg->pBt->usableSize;
64603		- int size; /* Size of the free slot */
	64604	+ const int hdr = pPg->hdrOffset; /* Offset to page header */
	64605	+ u8 * const aData = pPg->aData; /* Page data */
	64606	+ int iAddr = hdr + 1; /* Address of ptr to pc */
	64607	+ int pc = get2byte(&aData[iAddr]); /* Address of a free slot */
	64608	+ int x; /* Excess size of the slot */
	64609	+ int maxPC = pPg->pBt->usableSize - nByte; /* Max address for a usable slot */
	64610	+ int size; /* Size of the free slot */
64604	64611
64605	64612	assert( pc>0 );
64606		- while( pc<=usableSize-4 ){
	64613	+ while( pc<=maxPC ){
64607	64614	/* EVIDENCE-OF: R-22710-53328 The third and fourth bytes of each
64608	64615	** freeblock form a big-endian integer which is the size of the freeblock
64609	64616	** in bytes, including the 4-byte header. */
64610	64617	size = get2byte(&aData[pc+2]);
64611	64618	if( (x = size - nByte)>=0 ){
64612	64619	testcase( x==4 );
64613	64620	testcase( x==3 );
64614		- if( size+pc > usableSize ){
64615		- *pRc = SQLITE_CORRUPT_PAGE(pPg);
64616		- return 0;
64617		- }else if( x<4 ){
	64621	+ if( x<4 ){
64618	64622	/* EVIDENCE-OF: R-11498-58022 In a well-formed b-tree page, the total
64619	64623	** number of bytes in fragments may not exceed 60. */
64620	64624	if( aData[hdr+7]>57 ) return 0;
64621	64625
64622	64626	/* Remove the slot from the free-list. Update the number of
64623	64627	** fragmented bytes within the page. */
64624	64628	memcpy(&aData[iAddr], &aData[pc], 2);
64625	64629	aData[hdr+7] += (u8)x;
	64630	+ }else if( x+pc > maxPC ){
	64631	+ /* This slot extends off the end of the usable part of the page */
	64632	+ *pRc = SQLITE_CORRUPT_PAGE(pPg);
	64633	+ return 0;
64626	64634	}else{
64627	64635	/* The slot remains on the free-list. Reduce its size to account
64628		- ** for the portion used by the new allocation. */
	64636	+ ** for the portion used by the new allocation. */
64629	64637	put2byte(&aData[pc+2], x);
64630	64638	}
64631	64639	return &aData[pc + x];
64632	64640	}
64633	64641	iAddr = pc;
64634	64642	pc = get2byte(&aData[pc]);
64635		- if( pc<iAddr+size ) break;
	64643	+ if( pc<iAddr+size ){
	64644	+ if( pc ){
	64645	+ /* The next slot in the chain is not past the end of the current slot */
	64646	+ *pRc = SQLITE_CORRUPT_PAGE(pPg);
	64647	+ }
	64648	+ return 0;
	64649	+ }
64636	64650	}
64637		- if( pc ){
	64651	+ if( pc>maxPC+nByte-4 ){
	64652	+ /* The free slot chain extends off the end of the page */
64638	64653	*pRc = SQLITE_CORRUPT_PAGE(pPg);
64639	64654	}
64640		-
64641	64655	return 0;
64642	64656	}
64643	64657
64644	64658	/*
64645	64659	** Allocate nByte bytes of space from within the B-Tree page passed
		@@ -64685,13 +64699,13 @@
64685	64699	}else{
64686	64700	return SQLITE_CORRUPT_PAGE(pPage);
64687	64701	}
64688	64702	}
64689	64703
64690		- /* If there is enough space between gap and top for one more cell pointer
64691		- ** array entry offset, and if the freelist is not empty, then search the
64692		- ** freelist looking for a free slot big enough to satisfy the request.
	64704	+ /* If there is enough space between gap and top for one more cell pointer,
	64705	+ ** and if the freelist is not empty, then search the
	64706	+ ** freelist looking for a slot big enough to satisfy the request.
64693	64707	*/
64694	64708	testcase( gap+2==top );
64695	64709	testcase( gap+1==top );
64696	64710	testcase( gap==top );
64697	64711	if( (data[hdr+2] \|\| data[hdr+1]) && gap+2<=top ){
		@@ -64709,19 +64723,20 @@
64709	64723	** to see if defragmentation is necessary.
64710	64724	*/
64711	64725	testcase( gap+2+nByte==top );
64712	64726	if( gap+2+nByte>top ){
64713	64727	assert( pPage->nCell>0 \|\| CORRUPT_DB );
	64728	+ assert( pPage->nFree>=0 );
64714	64729	rc = defragmentPage(pPage, MIN(4, pPage->nFree - (2+nByte)));
64715	64730	if( rc ) return rc;
64716	64731	top = get2byteNotZero(&data[hdr+5]);
64717	64732	assert( gap+2+nByte<=top );
64718	64733	}
64719	64734
64720	64735
64721	64736	/* Allocate memory from the gap in between the cell pointer array
64722		- ** and the cell content area. The btreeInitPage() call has already
	64737	+ ** and the cell content area. The btreeComputeFreeSpace() call has already
64723	64738	** validated the freelist. Given that the freelist is valid, there
64724	64739	** is no way that the allocation can extend off the end of the page.
64725	64740	** The assert() below verifies the previous sentence.
64726	64741	*/
64727	64742	top -= nByte;
		@@ -64736,11 +64751,11 @@
64736	64751	** The first byte of the new free block is pPage->aData[iStart]
64737	64752	** and the size of the block is iSize bytes.
64738	64753	**
64739	64754	** Adjacent freeblocks are coalesced.
64740	64755	**
64741		-** Note that even though the freeblock list was checked by btreeInitPage(),
	64756	+** Even though the freeblock list was checked by btreeComputeFreeSpace(),
64742	64757	** that routine will not detect overlap between cells or freeblocks. Nor
64743	64758	** does it detect cells or freeblocks that encrouch into the reserved bytes
64744	64759	** at the end of the page. So do additional corruption checks inside this
64745	64760	** routine and return SQLITE_CORRUPT if any problems are found.
64746	64761	*/
		@@ -64898,25 +64913,18 @@
64898	64913	pPage->max1bytePayload = pBt->max1bytePayload;
64899	64914	return SQLITE_OK;
64900	64915	}
64901	64916
64902	64917	/*
64903		-** Initialize the auxiliary information for a disk block.
64904		-**
64905		-** Return SQLITE_OK on success. If we see that the page does
64906		-** not contain a well-formed database page, then return
64907		-** SQLITE_CORRUPT. Note that a return of SQLITE_OK does not
64908		-** guarantee that the page is well-formed. It only shows that
64909		-** we failed to detect any corruption.
	64918	+** Compute the amount of freespace on the page. In other words, fill
	64919	+** in the pPage->nFree field.
64910	64920	*/
64911		-static int btreeInitPage(MemPage *pPage){
	64921	+static int btreeComputeFreeSpace(MemPage *pPage){
64912	64922	int pc; /* Address of a freeblock within pPage->aData[] */
64913	64923	u8 hdr; /* Offset to beginning of page header */
64914	64924	u8 data; / Equal to pPage->aData */
64915		- BtShared pBt; / The main btree structure */
64916	64925	int usableSize; /* Amount of usable space on each page */
64917		- u16 cellOffset; /* Offset from start of page to first cell pointer */
64918	64926	int nFree; /* Number of unused bytes on the page */
64919	64927	int top; /* First byte of the cell content area */
64920	64928	int iCellFirst; /* First allowable cell or freeblock offset */
64921	64929	int iCellLast; /* Last possible cell or freeblock offset */
64922	64930
		@@ -64924,75 +64932,22 @@
64924	64932	assert( pPage->pBt->db!=0 );
64925	64933	assert( sqlite3_mutex_held(pPage->pBt->mutex) );
64926	64934	assert( pPage->pgno==sqlite3PagerPagenumber(pPage->pDbPage) );
64927	64935	assert( pPage == sqlite3PagerGetExtra(pPage->pDbPage) );
64928	64936	assert( pPage->aData == sqlite3PagerGetData(pPage->pDbPage) );
64929		- assert( pPage->isInit==0 );
	64937	+ assert( pPage->isInit==1 );
	64938	+ assert( pPage->nFree<0 );
64930	64939
64931		- pBt = pPage->pBt;
	64940	+ usableSize = pPage->pBt->usableSize;
64932	64941	hdr = pPage->hdrOffset;
64933	64942	data = pPage->aData;
64934		- /* EVIDENCE-OF: R-28594-02890 The one-byte flag at offset 0 indicating
64935		- ** the b-tree page type. */
64936		- if( decodeFlags(pPage, data[hdr]) ){
64937		- return SQLITE_CORRUPT_PAGE(pPage);
64938		- }
64939		- assert( pBt->pageSize>=512 && pBt->pageSize<=65536 );
64940		- pPage->maskPage = (u16)(pBt->pageSize - 1);
64941		- pPage->nOverflow = 0;
64942		- usableSize = pBt->usableSize;
64943		- pPage->cellOffset = cellOffset = hdr + 8 + pPage->childPtrSize;
64944		- pPage->aDataEnd = &data[usableSize];
64945		- pPage->aCellIdx = &data[cellOffset];
64946		- pPage->aDataOfst = &data[pPage->childPtrSize];
64947	64943	/* EVIDENCE-OF: R-58015-48175 The two-byte integer at offset 5 designates
64948	64944	** the start of the cell content area. A zero value for this integer is
64949	64945	** interpreted as 65536. */
64950	64946	top = get2byteNotZero(&data[hdr+5]);
64951		- /* EVIDENCE-OF: R-37002-32774 The two-byte integer at offset 3 gives the
64952		- ** number of cells on the page. */
64953		- pPage->nCell = get2byte(&data[hdr+3]);
64954		- if( pPage->nCell>MX_CELL(pBt) ){
64955		- /* To many cells for a single page. The page must be corrupt */
64956		- return SQLITE_CORRUPT_PAGE(pPage);
64957		- }
64958		- testcase( pPage->nCell==MX_CELL(pBt) );
64959		- /* EVIDENCE-OF: R-24089-57979 If a page contains no cells (which is only
64960		- ** possible for a root page of a table that contains no rows) then the
64961		- ** offset to the cell content area will equal the page size minus the
64962		- ** bytes of reserved space. */
64963		- assert( pPage->nCell>0 \|\| top==usableSize \|\| CORRUPT_DB );
64964		-
64965		- /* A malformed database page might cause us to read past the end
64966		- ** of page when parsing a cell.
64967		- **
64968		- ** The following block of code checks early to see if a cell extends
64969		- ** past the end of a page boundary and causes SQLITE_CORRUPT to be
64970		- ** returned if it does.
64971		- */
64972		- iCellFirst = cellOffset + 2*pPage->nCell;
	64947	+ iCellFirst = hdr + 8 + pPage->childPtrSize + 2*pPage->nCell;
64973	64948	iCellLast = usableSize - 4;
64974		- if( pBt->db->flags & SQLITE_CellSizeCk ){
64975		- int i; /* Index into the cell pointer array */
64976		- int sz; /* Size of a cell */
64977		-
64978		- if( !pPage->leaf ) iCellLast--;
64979		- for(i=0; i<pPage->nCell; i++){
64980		- pc = get2byteAligned(&data[cellOffset+i*2]);
64981		- testcase( pc==iCellFirst );
64982		- testcase( pc==iCellLast );
64983		- if( pc<iCellFirst \|\| pc>iCellLast ){
64984		- return SQLITE_CORRUPT_PAGE(pPage);
64985		- }
64986		- sz = pPage->xCellSize(pPage, &data[pc]);
64987		- testcase( pc+sz==usableSize );
64988		- if( pc+sz>usableSize ){
64989		- return SQLITE_CORRUPT_PAGE(pPage);
64990		- }
64991		- }
64992		- if( !pPage->leaf ) iCellLast++;
64993		- }
64994	64949
64995	64950	/* Compute the total free space on the page
64996	64951	** EVIDENCE-OF: R-23588-34450 The two-byte integer at offset 1 gives the
64997	64952	** start of the first freeblock on the page, or is zero if there are no
64998	64953	** freeblocks. */
		@@ -65036,11 +64991,104 @@
65036	64991	*/
65037	64992	if( nFree>usableSize ){
65038	64993	return SQLITE_CORRUPT_PAGE(pPage);
65039	64994	}
65040	64995	pPage->nFree = (u16)(nFree - iCellFirst);
	64996	+ return SQLITE_OK;
	64997	+}
	64998	+
	64999	+/*
	65000	+** Do additional sanity check after btreeInitPage() if
	65001	+** PRAGMA cell_size_check=ON
	65002	+*/
	65003	+static SQLITE_NOINLINE int btreeCellSizeCheck(MemPage *pPage){
	65004	+ int iCellFirst; /* First allowable cell or freeblock offset */
	65005	+ int iCellLast; /* Last possible cell or freeblock offset */
	65006	+ int i; /* Index into the cell pointer array */
	65007	+ int sz; /* Size of a cell */
	65008	+ int pc; /* Address of a freeblock within pPage->aData[] */
	65009	+ u8 data; / Equal to pPage->aData */
	65010	+ int usableSize; /* Maximum usable space on the page */
	65011	+ int cellOffset; /* Start of cell content area */
	65012	+
	65013	+ iCellFirst = pPage->cellOffset + 2*pPage->nCell;
	65014	+ usableSize = pPage->pBt->usableSize;
	65015	+ iCellLast = usableSize - 4;
	65016	+ data = pPage->aData;
	65017	+ cellOffset = pPage->cellOffset;
	65018	+ if( !pPage->leaf ) iCellLast--;
	65019	+ for(i=0; i<pPage->nCell; i++){
	65020	+ pc = get2byteAligned(&data[cellOffset+i*2]);
	65021	+ testcase( pc==iCellFirst );
	65022	+ testcase( pc==iCellLast );
	65023	+ if( pc<iCellFirst \|\| pc>iCellLast ){
	65024	+ return SQLITE_CORRUPT_PAGE(pPage);
	65025	+ }
	65026	+ sz = pPage->xCellSize(pPage, &data[pc]);
	65027	+ testcase( pc+sz==usableSize );
	65028	+ if( pc+sz>usableSize ){
	65029	+ return SQLITE_CORRUPT_PAGE(pPage);
	65030	+ }
	65031	+ }
	65032	+ return SQLITE_OK;
	65033	+}
	65034	+
	65035	+/*
	65036	+** Initialize the auxiliary information for a disk block.
	65037	+**
	65038	+** Return SQLITE_OK on success. If we see that the page does
	65039	+** not contain a well-formed database page, then return
	65040	+** SQLITE_CORRUPT. Note that a return of SQLITE_OK does not
	65041	+** guarantee that the page is well-formed. It only shows that
	65042	+** we failed to detect any corruption.
	65043	+*/
	65044	+static int btreeInitPage(MemPage *pPage){
	65045	+ u8 data; / Equal to pPage->aData */
	65046	+ BtShared pBt; / The main btree structure */
	65047	+
	65048	+ assert( pPage->pBt!=0 );
	65049	+ assert( pPage->pBt->db!=0 );
	65050	+ assert( sqlite3_mutex_held(pPage->pBt->mutex) );
	65051	+ assert( pPage->pgno==sqlite3PagerPagenumber(pPage->pDbPage) );
	65052	+ assert( pPage == sqlite3PagerGetExtra(pPage->pDbPage) );
	65053	+ assert( pPage->aData == sqlite3PagerGetData(pPage->pDbPage) );
	65054	+ assert( pPage->isInit==0 );
	65055	+
	65056	+ pBt = pPage->pBt;
	65057	+ data = pPage->aData + pPage->hdrOffset;
	65058	+ /* EVIDENCE-OF: R-28594-02890 The one-byte flag at offset 0 indicating
	65059	+ ** the b-tree page type. */
	65060	+ if( decodeFlags(pPage, data[0]) ){
	65061	+ return SQLITE_CORRUPT_PAGE(pPage);
	65062	+ }
	65063	+ assert( pBt->pageSize>=512 && pBt->pageSize<=65536 );
	65064	+ pPage->maskPage = (u16)(pBt->pageSize - 1);
	65065	+ pPage->nOverflow = 0;
	65066	+ pPage->cellOffset = pPage->hdrOffset + 8 + pPage->childPtrSize;
	65067	+ pPage->aCellIdx = data + pPage->childPtrSize + 8;
	65068	+ pPage->aDataEnd = pPage->aData + pBt->usableSize;
	65069	+ pPage->aDataOfst = pPage->aData + pPage->childPtrSize;
	65070	+ /* EVIDENCE-OF: R-37002-32774 The two-byte integer at offset 3 gives the
	65071	+ ** number of cells on the page. */
	65072	+ pPage->nCell = get2byte(&data[3]);
	65073	+ if( pPage->nCell>MX_CELL(pBt) ){
	65074	+ /* To many cells for a single page. The page must be corrupt */
	65075	+ return SQLITE_CORRUPT_PAGE(pPage);
	65076	+ }
	65077	+ testcase( pPage->nCell==MX_CELL(pBt) );
	65078	+ /* EVIDENCE-OF: R-24089-57979 If a page contains no cells (which is only
	65079	+ ** possible for a root page of a table that contains no rows) then the
	65080	+ ** offset to the cell content area will equal the page size minus the
	65081	+ ** bytes of reserved space. */
	65082	+ assert( pPage->nCell>0
	65083	+ \|\| get2byteNotZero(&data[5])==pBt->usableSize
	65084	+ \|\| CORRUPT_DB );
	65085	+ pPage->nFree = -1; /* Indicate that this value is yet uncomputed */
65041	65086	pPage->isInit = 1;
	65087	+ if( pBt->db->flags & SQLITE_CellSizeCk ){
	65088	+ return btreeCellSizeCheck(pPage);
	65089	+ }
65042	65090	return SQLITE_OK;
65043	65091	}
65044	65092
65045	65093	/*
65046	65094	** Set up a raw page so that it looks like a database page holding
		@@ -65179,38 +65227,38 @@
65179	65227	assert( pCur==0 \|\| bReadOnly==pCur->curPagerFlags );
65180	65228	assert( pCur==0 \|\| pCur->iPage>0 );
65181	65229
65182	65230	if( pgno>btreePagecount(pBt) ){
65183	65231	rc = SQLITE_CORRUPT_BKPT;
65184		- goto getAndInitPage_error;
	65232	+ goto getAndInitPage_error1;
65185	65233	}
65186	65234	rc = sqlite3PagerGet(pBt->pPager, pgno, (DbPage**)&pDbPage, bReadOnly);
65187	65235	if( rc ){
65188		- goto getAndInitPage_error;
	65236	+ goto getAndInitPage_error1;
65189	65237	}
65190	65238	ppPage = (MemPage)sqlite3PagerGetExtra(pDbPage);
65191	65239	if( (*ppPage)->isInit==0 ){
65192	65240	btreePageFromDbPage(pDbPage, pgno, pBt);
65193	65241	rc = btreeInitPage(*ppPage);
65194	65242	if( rc!=SQLITE_OK ){
65195		- releasePage(*ppPage);
65196		- goto getAndInitPage_error;
	65243	+ goto getAndInitPage_error2;
65197	65244	}
65198	65245	}
65199	65246	assert( (*ppPage)->pgno==pgno );
65200	65247	assert( (*ppPage)->aData==sqlite3PagerGetData(pDbPage) );
65201	65248
65202	65249	/* If obtaining a child page for a cursor, we must verify that the page is
65203	65250	** compatible with the root page. */
65204	65251	if( pCur && ((ppPage)->nCell<1 \|\| (ppPage)->intKey!=pCur->curIntKey) ){
65205	65252	rc = SQLITE_CORRUPT_PGNO(pgno);
65206		- releasePage(*ppPage);
65207		- goto getAndInitPage_error;
	65253	+ goto getAndInitPage_error2;
65208	65254	}
65209	65255	return SQLITE_OK;
65210	65256
65211		-getAndInitPage_error:
	65257	+getAndInitPage_error2:
	65258	+ releasePage(*ppPage);
	65259	+getAndInitPage_error1:
65212	65260	if( pCur ){
65213	65261	pCur->iPage--;
65214	65262	pCur->pPage = pCur->apPage[pCur->iPage];
65215	65263	}
65216	65264	testcase( pgno==0 );
		@@ -69618,10 +69666,11 @@
69618	69666	if( *pRC ) return;
69619	69667	assert( idx>=0 && idx<pPage->nCell );
69620	69668	assert( CORRUPT_DB \|\| sz==cellSize(pPage, idx) );
69621	69669	assert( sqlite3PagerIswriteable(pPage->pDbPage) );
69622	69670	assert( sqlite3_mutex_held(pPage->pBt->mutex) );
	69671	+ assert( pPage->nFree>=0 );
69623	69672	data = pPage->aData;
69624	69673	ptr = &pPage->aCellIdx[2*idx];
69625	69674	pc = get2byte(ptr);
69626	69675	hdr = pPage->hdrOffset;
69627	69676	testcase( pc==get2byte(&data[hdr+5]) );
		@@ -69688,10 +69737,11 @@
69688	69737	** malformed cell from a leaf page to an interior page, if the cell size
69689	69738	** wanted to be less than 4 but got rounded up to 4 on the leaf, then size
69690	69739	** might be less than 8 (leaf-size + pointer) on the interior node. Hence
69691	69740	** the term after the \|\| in the following assert(). */
69692	69741	assert( sz==pPage->xCellSize(pPage, pCell) \|\| (sz==8 && iChild>0) );
	69742	+ assert( pPage->nFree>=0 );
69693	69743	if( pPage->nOverflow \|\| sz+2>pPage->nFree ){
69694	69744	if( pTemp ){
69695	69745	memcpy(pTemp, pCell, sz);
69696	69746	pCell = pTemp;
69697	69747	}
		@@ -69745,11 +69795,11 @@
69745	69795	memmove(pIns+2, pIns, 2*(pPage->nCell - i));
69746	69796	put2byte(pIns, idx);
69747	69797	pPage->nCell++;
69748	69798	/* increment the cell count */
69749	69799	if( (++data[pPage->hdrOffset+4])==0 ) data[pPage->hdrOffset+3]++;
69750		- assert( get2byte(&data[pPage->hdrOffset+3])==pPage->nCell );
	69800	+ assert( get2byte(&data[pPage->hdrOffset+3])==pPage->nCell \|\| CORRUPT_DB );
69751	69801	#ifndef SQLITE_OMIT_AUTOVACUUM
69752	69802	if( pPage->pBt->autoVacuum ){
69753	69803	/* The cell may contain a pointer to an overflow page. If so, write
69754	69804	** the entry for the overflow page into the pointer map.
69755	69805	*/
		@@ -69832,12 +69882,17 @@
69832	69882	**
69833	69883	** For a table-btree, the concept is similar, except only apEnd[0]..apEnd[2]
69834	69884	** are used and they point to the leaf pages only, and the ixNx value are:
69835	69885	**
69836	69886	** ixNx[0] = Number of cells in Child-1.
69837		-** ixNx[1] = Number of cells in Child-1 and Child-2 + 1 for 1st divider.
69838		-** ixNx[2] = Number of cells in Child-1 and Child-2 + both divider cells
	69887	+** ixNx[1] = Number of cells in Child-1 and Child-2.
	69888	+** ixNx[2] = Total number of cells.
	69889	+**
	69890	+** Sometimes when deleting, a child page can have zero cells. In those
	69891	+** cases, ixNx[] entries with higher indexes, and the corresponding apEnd[]
	69892	+** entries, shift down. The end result is that each ixNx[] entry should
	69893	+** be larger than the previous
69839	69894	*/
69840	69895	typedef struct CellArray CellArray;
69841	69896	struct CellArray {
69842	69897	int nCell; /* Number of cells in apCell[] */
69843	69898	MemPage pRef; / Reference page */
		@@ -70239,12 +70294,14 @@
70239	70294	Pgno pgnoNew; /* Page number of pNew */
70240	70295
70241	70296	assert( sqlite3_mutex_held(pPage->pBt->mutex) );
70242	70297	assert( sqlite3PagerIswriteable(pParent->pDbPage) );
70243	70298	assert( pPage->nOverflow==1 );
70244		-
	70299	+
70245	70300	if( pPage->nCell==0 ) return SQLITE_CORRUPT_BKPT; /* dbfuzz001.test */
	70301	+ assert( pPage->nFree>=0 );
	70302	+ assert( pParent->nFree>=0 );
70246	70303
70247	70304	/* Allocate a new page. This page will become the right-sibling of
70248	70305	** pPage. Make the parent page writable, so that the new divider cell
70249	70306	** may be inserted. If both these operations are successful, proceed.
70250	70307	*/
		@@ -70410,10 +70467,11 @@
70410	70467	** fairly obscure circumstances, even though it is a copy of initialized
70411	70468	** page pFrom.
70412	70469	*/
70413	70470	pTo->isInit = 0;
70414	70471	rc = btreeInitPage(pTo);
	70472	+ if( rc==SQLITE_OK ) rc = btreeComputeFreeSpace(pTo);
70415	70473	if( rc!=SQLITE_OK ){
70416	70474	*pRC = rc;
70417	70475	return;
70418	70476	}
70419	70477
		@@ -70518,10 +70576,11 @@
70518	70576	assert( pParent->nOverflow==0 \|\| pParent->aiOvfl[0]==iParentIdx );
70519	70577
70520	70578	if( !aOvflSpace ){
70521	70579	return SQLITE_NOMEM_BKPT;
70522	70580	}
	70581	+ assert( pParent->nFree>=0 );
70523	70582
70524	70583	/* Find the sibling pages to balance. Also locate the cells in pParent
70525	70584	** that divide the siblings. An attempt is made to find NN siblings on
70526	70585	** either side of pPage. More siblings are taken from one side, however,
70527	70586	** if there are fewer than NN siblings on the other side. If pParent
		@@ -70556,10 +70615,17 @@
70556	70615	while( 1 ){
70557	70616	rc = getAndInitPage(pBt, pgno, &apOld[i], 0, 0);
70558	70617	if( rc ){
70559	70618	memset(apOld, 0, (i+1)sizeof(MemPage));
70560	70619	goto balance_cleanup;
	70620	+ }
	70621	+ if( apOld[i]->nFree<0 ){
	70622	+ rc = btreeComputeFreeSpace(apOld[i]);
	70623	+ if( rc ){
	70624	+ memset(apOld, 0, (i)sizeof(MemPage));
	70625	+ goto balance_cleanup;
	70626	+ }
70561	70627	}
70562	70628	nMaxCells += 1+apOld[i]->nCell+apOld[i]->nOverflow;
70563	70629	if( (i--)==0 ) break;
70564	70630
70565	70631	if( pParent->nOverflow && i+nxDiv==pParent->aiOvfl[0] ){
		@@ -70751,15 +70817,19 @@
70751	70817	usableSpace = pBt->usableSize - 12 + leafCorrection;
70752	70818	for(i=k=0; i<nOld; i++, k++){
70753	70819	MemPage *p = apOld[i];
70754	70820	b.apEnd[k] = p->aDataEnd;
70755	70821	b.ixNx[k] = cntOld[i];
	70822	+ if( k && b.ixNx[k]==b.ixNx[k-1] ){
	70823	+ k--; /* Omit b.ixNx[] entry for child pages with no cells */
	70824	+ }
70756	70825	if( !leafData ){
70757	70826	k++;
70758	70827	b.apEnd[k] = pParent->aDataEnd;
70759	70828	b.ixNx[k] = cntOld[i]+1;
70760	70829	}
	70830	+ assert( p->nFree>=0 );
70761	70831	szNew[i] = usableSpace - p->nFree;
70762	70832	for(j=0; j<p->nOverflow; j++){
70763	70833	szNew[i] += 2 + p->xCellSize(p, p->apOvfl[j]);
70764	70834	}
70765	70835	cntNew[i] = cntOld[i];
		@@ -70981,22 +71051,21 @@
70981	71051	** populated, not here.
70982	71052	*/
70983	71053	if( ISAUTOVACUUM ){
70984	71054	MemPage *pOld;
70985	71055	MemPage *pNew = pOld = apNew[0];
70986		- u8 *aOld = pNew->aData;
70987	71056	int cntOldNext = pNew->nCell + pNew->nOverflow;
70988		- int usableSize = pBt->usableSize;
70989	71057	int iNew = 0;
70990	71058	int iOld = 0;
70991	71059
70992	71060	for(i=0; i<b.nCell; i++){
70993	71061	u8 *pCell = b.apCell[i];
70994		- if( i==cntOldNext ){
70995		- pOld = (++iOld)<nNew ? apNew[iOld] : apOld[iOld];
	71062	+ while( i==cntOldNext ){
	71063	+ iOld++;
	71064	+ assert( iOld<nNew \|\| iOld<nOld );
	71065	+ pOld = iOld<nNew ? apNew[iOld] : apOld[iOld];
70996	71066	cntOldNext += pOld->nCell + pOld->nOverflow + !leafData;
70997		- aOld = pOld->aData;
70998	71067	}
70999	71068	if( i==cntNew[iNew] ){
71000	71069	pNew = apNew[++iNew];
71001	71070	if( !leafData ) continue;
71002	71071	}
		@@ -71007,11 +71076,11 @@
71007	71076	** if sibling page iOld had the same page number as pNew, and if
71008	71077	** pCell really was a part of sibling page iOld (not a divider or
71009	71078	** overflow cell), we can skip updating the pointer map entries. */
71010	71079	if( iOld>=nNew
71011	71080	\|\| pNew->pgno!=aPgno[iOld]
71012		- \|\| !SQLITE_WITHIN(pCell,aOld,&aOld[usableSize])
	71081	+ \|\| !SQLITE_WITHIN(pCell,pOld->aData,pOld->aDataEnd)
71013	71082	){
71014	71083	if( !leafCorrection ){
71015	71084	ptrmapPut(pBt, get4byte(pCell), PTRMAP_BTREE, pNew->pgno, &rc);
71016	71085	}
71017	71086	if( cachedCellSize(&b,i)>pNew->minLocal ){
		@@ -71257,11 +71326,11 @@
71257	71326	releasePage(pChild);
71258	71327	return rc;
71259	71328	}
71260	71329	assert( sqlite3PagerIswriteable(pChild->pDbPage) );
71261	71330	assert( sqlite3PagerIswriteable(pRoot->pDbPage) );
71262		- assert( pChild->nCell==pRoot->nCell );
	71331	+ assert( pChild->nCell==pRoot->nCell \|\| CORRUPT_DB );
71263	71332
71264	71333	TRACE(("BALANCE: copy root %d into %d\n", pRoot->pgno, pChild->pgno));
71265	71334
71266	71335	/* Copy the overflow cells from pRoot to pChild */
71267	71336	memcpy(pChild->aiOvfl, pRoot->aiOvfl,
		@@ -71299,10 +71368,11 @@
71299	71368
71300	71369	do {
71301	71370	int iPage = pCur->iPage;
71302	71371	MemPage *pPage = pCur->pPage;
71303	71372
	71373	+ if( NEVER(pPage->nFree<0) && btreeComputeFreeSpace(pPage) ) break;
71304	71374	if( iPage==0 ){
71305	71375	if( pPage->nOverflow ){
71306	71376	/* The root page of the b-tree is overfull. In this case call the
71307	71377	** balance_deeper() function to create a new child for the root-page
71308	71378	** and copy the current contents of the root-page to it. The
		@@ -71327,10 +71397,13 @@
71327	71397	}else{
71328	71398	MemPage * const pParent = pCur->apPage[iPage-1];
71329	71399	int const iIdx = pCur->aiIdx[iPage-1];
71330	71400
71331	71401	rc = sqlite3PagerWrite(pParent->pDbPage);
	71402	+ if( rc==SQLITE_OK && pParent->nFree<0 ){
	71403	+ rc = btreeComputeFreeSpace(pParent);
	71404	+ }
71332	71405	if( rc==SQLITE_OK ){
71333	71406	#ifndef SQLITE_OMIT_QUICKBALANCE
71334	71407	if( pPage->intKeyLeaf
71335	71408	&& pPage->nOverflow==1
71336	71409	&& pPage->aiOvfl[0]==pPage->nCell
		@@ -71673,10 +71746,14 @@
71673	71746	assert( pCur->eState==CURSOR_VALID \|\| (pCur->eState==CURSOR_INVALID && loc) );
71674	71747
71675	71748	pPage = pCur->pPage;
71676	71749	assert( pPage->intKey \|\| pX->nKey>=0 );
71677	71750	assert( pPage->leaf \|\| !pPage->intKey );
	71751	+ if( pPage->nFree<0 ){
	71752	+ rc = btreeComputeFreeSpace(pPage);
	71753	+ if( rc ) return rc;
	71754	+ }
71678	71755
71679	71756	TRACE(("INSERT: table=%d nkey=%lld ndata=%d page=%d %s\n",
71680	71757	pCur->pgnoRoot, pX->nKey, pX->nData, pPage->pgno,
71681	71758	loc==0 ? "overwrite" : "new entry"));
71682	71759	assert( pPage->isInit );
		@@ -71823,10 +71900,11 @@
71823	71900
71824	71901	iCellDepth = pCur->iPage;
71825	71902	iCellIdx = pCur->ix;
71826	71903	pPage = pCur->pPage;
71827	71904	pCell = findCell(pPage, iCellIdx);
	71905	+ if( pPage->nFree<0 && btreeComputeFreeSpace(pPage) ) return SQLITE_CORRUPT;
71828	71906
71829	71907	/* If the bPreserve flag is set to true, then the cursor position must
71830	71908	** be preserved following this delete operation. If the current delete
71831	71909	** will cause a b-tree rebalance, then this is done by saving the cursor
71832	71910	** key and leaving the cursor in CURSOR_REQUIRESEEK state before
		@@ -71893,10 +71971,14 @@
71893	71971	MemPage *pLeaf = pCur->pPage;
71894	71972	int nCell;
71895	71973	Pgno n;
71896	71974	unsigned char *pTmp;
71897	71975
	71976	+ if( pLeaf->nFree<0 ){
	71977	+ rc = btreeComputeFreeSpace(pLeaf);
	71978	+ if( rc ) return rc;
	71979	+ }
71898	71980	if( iCellDepth<pCur->iPage-1 ){
71899	71981	n = pCur->apPage[iCellDepth+1]->pgno;
71900	71982	}else{
71901	71983	n = pCur->pPage->pgno;
71902	71984	}
		@@ -72784,10 +72866,15 @@
72784	72866	assert( rc==SQLITE_CORRUPT ); /* The only possible error from InitPage */
72785	72867	checkAppendMsg(pCheck,
72786	72868	"btreeInitPage() returns error code %d", rc);
72787	72869	goto end_of_check;
72788	72870	}
	72871	+ if( (rc = btreeComputeFreeSpace(pPage))!=0 ){
	72872	+ assert( rc==SQLITE_CORRUPT );
	72873	+ checkAppendMsg(pCheck, "free space corruption", rc);
	72874	+ goto end_of_check;
	72875	+ }
72789	72876	data = pPage->aData;
72790	72877	hdr = pPage->hdrOffset;
72791	72878
72792	72879	/* Set up for cell analysis */
72793	72880	pCheck->zPfx = "On tree page %d cell %d: ";
		@@ -72916,23 +73003,23 @@
72916	73003	** freeblocks on the page.
72917	73004	*/
72918	73005	i = get2byte(&data[hdr+1]);
72919	73006	while( i>0 ){
72920	73007	int size, j;
72921		- assert( (u32)i<=usableSize-4 ); /* Enforced by btreeInitPage() */
	73008	+ assert( (u32)i<=usableSize-4 ); /* Enforced by btreeComputeFreeSpace() */
72922	73009	size = get2byte(&data[i+2]);
72923		- assert( (u32)(i+size)<=usableSize ); /* Enforced by btreeInitPage() */
	73010	+ assert( (u32)(i+size)<=usableSize ); /* due to btreeComputeFreeSpace() */
72924	73011	btreeHeapInsert(heap, (((u32)i)<<16)\|(i+size-1));
72925	73012	/* EVIDENCE-OF: R-58208-19414 The first 2 bytes of a freeblock are a
72926	73013	** big-endian integer which is the offset in the b-tree page of the next
72927	73014	** freeblock in the chain, or zero if the freeblock is the last on the
72928	73015	** chain. */
72929	73016	j = get2byte(&data[i]);
72930	73017	/* EVIDENCE-OF: R-06866-39125 Freeblocks are always connected in order of
72931	73018	** increasing offset. */
72932		- assert( j==0 \|\| j>i+size ); /* Enforced by btreeInitPage() */
72933		- assert( (u32)j<=usableSize-4 ); /* Enforced by btreeInitPage() */
	73019	+ assert( j==0 \|\| j>i+size ); /* Enforced by btreeComputeFreeSpace() */
	73020	+ assert( (u32)j<=usableSize-4 ); /* Enforced by btreeComputeFreeSpace() */
72934	73021	i = j;
72935	73022	}
72936	73023	/* Analyze the min-heap looking for overlap between cells and/or
72937	73024	** freeblocks, and counting the number of untracked bytes in nFrag.
72938	73025	**
		@@ -74393,12 +74480,11 @@
74393	74480	return rc;
74394	74481	#endif
74395	74482	}
74396	74483
74397	74484	/*
74398		-** Make sure pMem->z points to a writable allocation of at least
74399		-** min(n,32) bytes.
	74485	+** Make sure pMem->z points to a writable allocation of at least n bytes.
74400	74486	**
74401	74487	** If the bPreserve argument is true, then copy of the content of
74402	74488	** pMem->z into the new allocation. pMem must be either a string or
74403	74489	** blob if bPreserve is true. If bPreserve is false, any prior content
74404	74490	** in pMem->z is discarded.
		@@ -74413,11 +74499,10 @@
74413	74499	assert( bPreserve==0 \|\| pMem->flags&(MEM_Blob\|MEM_Str) );
74414	74500	testcase( bPreserve && pMem->z==0 );
74415	74501
74416	74502	assert( pMem->szMalloc==0
74417	74503	\|\| pMem->szMalloc==sqlite3DbMallocSize(pMem->db, pMem->zMalloc) );
74418		- if( n<32 ) n = 32;
74419	74504	if( pMem->szMalloc>0 && bPreserve && pMem->z==pMem->zMalloc ){
74420	74505	pMem->z = pMem->zMalloc = sqlite3DbReallocOrFree(pMem->db, pMem->z, n);
74421	74506	bPreserve = 0;
74422	74507	}else{
74423	74508	if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
		@@ -75262,11 +75347,10 @@
75262	75347	flags = (enc==0?MEM_Blob:MEM_Str);
75263	75348	if( nByte<0 ){
75264	75349	assert( enc!=0 );
75265	75350	if( enc==SQLITE_UTF8 ){
75266	75351	nByte = 0x7fffffff & (int)strlen(z);
75267		- if( nByte>iLimit ) nByte = iLimit+1;
75268	75352	}else{
75269	75353	for(nByte=0; nByte<=iLimit && (z[nByte] \| z[nByte+1]); nByte+=2){}
75270	75354	}
75271	75355	flags \|= MEM_Term;
75272	75356	}
		@@ -75274,33 +75358,34 @@
75274	75358	/* The following block sets the new values of Mem.z and Mem.xDel. It
75275	75359	** also sets a flag in local variable "flags" to indicate the memory
75276	75360	** management (one of MEM_Dyn or MEM_Static).
75277	75361	*/
75278	75362	if( xDel==SQLITE_TRANSIENT ){
75279		- int nAlloc = nByte;
	75363	+ u32 nAlloc = nByte;
75280	75364	if( flags&MEM_Term ){
75281	75365	nAlloc += (enc==SQLITE_UTF8?1:2);
75282	75366	}
75283	75367	if( nByte>iLimit ){
75284	75368	return SQLITE_TOOBIG;
75285	75369	}
75286	75370	testcase( nAlloc==0 );
75287	75371	testcase( nAlloc==31 );
75288	75372	testcase( nAlloc==32 );
75289		- if( sqlite3VdbeMemClearAndResize(pMem, MAX(nAlloc,32)) ){
	75373	+ if( sqlite3VdbeMemClearAndResize(pMem, (int)MAX(nAlloc,32)) ){
75290	75374	return SQLITE_NOMEM_BKPT;
75291	75375	}
75292	75376	memcpy(pMem->z, z, nAlloc);
75293		- }else if( xDel==SQLITE_DYNAMIC ){
75294		- sqlite3VdbeMemRelease(pMem);
75295		- pMem->zMalloc = pMem->z = (char *)z;
75296		- pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
75297	75377	}else{
75298	75378	sqlite3VdbeMemRelease(pMem);
75299	75379	pMem->z = (char *)z;
75300		- pMem->xDel = xDel;
75301		- flags \|= ((xDel==SQLITE_STATIC)?MEM_Static:MEM_Dyn);
	75380	+ if( xDel==SQLITE_DYNAMIC ){
	75381	+ pMem->zMalloc = pMem->z;
	75382	+ pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
	75383	+ }else{
	75384	+ pMem->xDel = xDel;
	75385	+ flags \|= ((xDel==SQLITE_STATIC)?MEM_Static:MEM_Dyn);
	75386	+ }
75302	75387	}
75303	75388
75304	75389	pMem->n = nByte;
75305	75390	pMem->flags = flags;
75306	75391	pMem->enc = (enc==0 ? SQLITE_UTF8 : enc);
		@@ -82206,14 +82291,14 @@
82206	82291	**
82207	82292	** If the result is not a simple column reference (if it is an expression
82208	82293	** or a constant) then useTypes 2, 3, and 4 return NULL.
82209	82294	*/
82210	82295	static const void *columnName(
82211		- sqlite3_stmt *pStmt,
82212		- int N,
82213		- const void (xFunc)(Mem*),
82214		- int useType
	82296	+ sqlite3_stmt pStmt, / The statement */
	82297	+ int N, /* Which column to get the name for */
	82298	+ int useUtf16, /* True to return the name as UTF16 */
	82299	+ int useType /* What type of name */
82215	82300	){
82216	82301	const void *ret;
82217	82302	Vdbe *p;
82218	82303	int n;
82219	82304	sqlite3 *db;
		@@ -82230,12 +82315,16 @@
82230	82315	n = sqlite3_column_count(pStmt);
82231	82316	if( N<n && N>=0 ){
82232	82317	N += useType*n;
82233	82318	sqlite3_mutex_enter(db->mutex);
82234	82319	assert( db->mallocFailed==0 );
82235		- ret = xFunc(&p->aColName[N]);
82236		- /* A malloc may have failed inside of the xFunc() call. If this
	82320	+ if( useUtf16 ){
	82321	+ ret = sqlite3_value_text16((sqlite3_value*)&p->aColName[N]);
	82322	+ }else{
	82323	+ ret = sqlite3_value_text((sqlite3_value*)&p->aColName[N]);
	82324	+ }
	82325	+ /* A malloc may have failed inside of the _text() call. If this
82237	82326	** is the case, clear the mallocFailed flag and return NULL.
82238	82327	*/
82239	82328	if( db->mallocFailed ){
82240	82329	sqlite3OomClear(db);
82241	82330	ret = 0;
		@@ -82248,17 +82337,15 @@
82248	82337	/*
82249	82338	** Return the name of the Nth column of the result set returned by SQL
82250	82339	** statement pStmt.
82251	82340	*/
82252	82341	SQLITE_API const char sqlite3_column_name(sqlite3_stmt pStmt, int N){
82253		- return columnName(
82254		- pStmt, N, (const void()(Mem*))sqlite3_value_text, COLNAME_NAME);
	82342	+ return columnName(pStmt, N, 0, COLNAME_NAME);
82255	82343	}
82256	82344	#ifndef SQLITE_OMIT_UTF16
82257	82345	SQLITE_API const void sqlite3_column_name16(sqlite3_stmt pStmt, int N){
82258		- return columnName(
82259		- pStmt, N, (const void()(Mem*))sqlite3_value_text16, COLNAME_NAME);
	82346	+ return columnName(pStmt, N, 1, COLNAME_NAME);
82260	82347	}
82261	82348	#endif
82262	82349
82263	82350	/*
82264	82351	** Constraint: If you have ENABLE_COLUMN_METADATA then you must
		@@ -82273,17 +82360,15 @@
82273	82360	/*
82274	82361	** Return the column declaration type (if applicable) of the 'i'th column
82275	82362	** of the result set of SQL statement pStmt.
82276	82363	*/
82277	82364	SQLITE_API const char sqlite3_column_decltype(sqlite3_stmt pStmt, int N){
82278		- return columnName(
82279		- pStmt, N, (const void()(Mem*))sqlite3_value_text, COLNAME_DECLTYPE);
	82365	+ return columnName(pStmt, N, 0, COLNAME_DECLTYPE);
82280	82366	}
82281	82367	#ifndef SQLITE_OMIT_UTF16
82282	82368	SQLITE_API const void sqlite3_column_decltype16(sqlite3_stmt pStmt, int N){
82283		- return columnName(
82284		- pStmt, N, (const void()(Mem*))sqlite3_value_text16, COLNAME_DECLTYPE);
	82369	+ return columnName(pStmt, N, 1, COLNAME_DECLTYPE);
82285	82370	}
82286	82371	#endif /* SQLITE_OMIT_UTF16 */
82287	82372	#endif /* SQLITE_OMIT_DECLTYPE */
82288	82373
82289	82374	#ifdef SQLITE_ENABLE_COLUMN_METADATA
		@@ -82291,49 +82376,43 @@
82291	82376	** Return the name of the database from which a result column derives.
82292	82377	** NULL is returned if the result column is an expression or constant or
82293	82378	** anything else which is not an unambiguous reference to a database column.
82294	82379	*/
82295	82380	SQLITE_API const char sqlite3_column_database_name(sqlite3_stmt pStmt, int N){
82296		- return columnName(
82297		- pStmt, N, (const void()(Mem*))sqlite3_value_text, COLNAME_DATABASE);
	82381	+ return columnName(pStmt, N, 0, COLNAME_DATABASE);
82298	82382	}
82299	82383	#ifndef SQLITE_OMIT_UTF16
82300	82384	SQLITE_API const void sqlite3_column_database_name16(sqlite3_stmt pStmt, int N){
82301		- return columnName(
82302		- pStmt, N, (const void()(Mem*))sqlite3_value_text16, COLNAME_DATABASE);
	82385	+ return columnName(pStmt, N, 1, COLNAME_DATABASE);
82303	82386	}
82304	82387	#endif /* SQLITE_OMIT_UTF16 */
82305	82388
82306	82389	/*
82307	82390	** Return the name of the table from which a result column derives.
82308	82391	** NULL is returned if the result column is an expression or constant or
82309	82392	** anything else which is not an unambiguous reference to a database column.
82310	82393	*/
82311	82394	SQLITE_API const char sqlite3_column_table_name(sqlite3_stmt pStmt, int N){
82312		- return columnName(
82313		- pStmt, N, (const void()(Mem*))sqlite3_value_text, COLNAME_TABLE);
	82395	+ return columnName(pStmt, N, 0, COLNAME_TABLE);
82314	82396	}
82315	82397	#ifndef SQLITE_OMIT_UTF16
82316	82398	SQLITE_API const void sqlite3_column_table_name16(sqlite3_stmt pStmt, int N){
82317		- return columnName(
82318		- pStmt, N, (const void()(Mem*))sqlite3_value_text16, COLNAME_TABLE);
	82399	+ return columnName(pStmt, N, 1, COLNAME_TABLE);
82319	82400	}
82320	82401	#endif /* SQLITE_OMIT_UTF16 */
82321	82402
82322	82403	/*
82323	82404	** Return the name of the table column from which a result column derives.
82324	82405	** NULL is returned if the result column is an expression or constant or
82325	82406	** anything else which is not an unambiguous reference to a database column.
82326	82407	*/
82327	82408	SQLITE_API const char sqlite3_column_origin_name(sqlite3_stmt pStmt, int N){
82328		- return columnName(
82329		- pStmt, N, (const void()(Mem*))sqlite3_value_text, COLNAME_COLUMN);
	82409	+ return columnName(pStmt, N, 0, COLNAME_COLUMN);
82330	82410	}
82331	82411	#ifndef SQLITE_OMIT_UTF16
82332	82412	SQLITE_API const void sqlite3_column_origin_name16(sqlite3_stmt pStmt, int N){
82333		- return columnName(
82334		- pStmt, N, (const void()(Mem*))sqlite3_value_text16, COLNAME_COLUMN);
	82413	+ return columnName(pStmt, N, 1, COLNAME_COLUMN);
82335	82414	}
82336	82415	#endif /* SQLITE_OMIT_UTF16 */
82337	82416	#endif /* SQLITE_ENABLE_COLUMN_METADATA */
82338	82417
82339	82418
		@@ -83975,10 +84054,19 @@
83975	84054	#endif
83976	84055	/* INSERT STACK UNION HERE */
83977	84056
83978	84057	assert( p->magic==VDBE_MAGIC_RUN ); /* sqlite3_step() verifies this */
83979	84058	sqlite3VdbeEnter(p);
	84059	+#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
	84060	+ if( db->xProgress ){
	84061	+ u32 iPrior = p->aCounter[SQLITE_STMTSTATUS_VM_STEP];
	84062	+ assert( 0 < db->nProgressOps );
	84063	+ nProgressLimit = db->nProgressOps - (iPrior % db->nProgressOps);
	84064	+ }else{
	84065	+ nProgressLimit = 0xffffffff;
	84066	+ }
	84067	+#endif
83980	84068	if( p->rc==SQLITE_NOMEM ){
83981	84069	/* This happens if a malloc() inside a call to sqlite3_column_text() or
83982	84070	** sqlite3_column_text16() failed. */
83983	84071	goto no_mem;
83984	84072	}
		@@ -83988,19 +84076,10 @@
83988	84076	assert( p->explain==0 );
83989	84077	p->pResultSet = 0;
83990	84078	db->busyHandler.nBusy = 0;
83991	84079	if( db->u1.isInterrupted ) goto abort_due_to_interrupt;
83992	84080	sqlite3VdbeIOTraceSql(p);
83993		-#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
83994		- if( db->xProgress ){
83995		- u32 iPrior = p->aCounter[SQLITE_STMTSTATUS_VM_STEP];
83996		- assert( 0 < db->nProgressOps );
83997		- nProgressLimit = db->nProgressOps - (iPrior % db->nProgressOps);
83998		- }else{
83999		- nProgressLimit = 0xffffffff;
84000		- }
84001		-#endif
84002	84081	#ifdef SQLITE_DEBUG
84003	84082	sqlite3BeginBenignMalloc();
84004	84083	if( p->pc==0
84005	84084	&& (p->db->flags & (SQLITE_VdbeListing\|SQLITE_VdbeEQP\|SQLITE_VdbeTrace))!=0
84006	84085	){
		@@ -84172,14 +84251,15 @@
84172	84251	** of VDBE ops have been executed (either since this invocation of
84173	84252	** sqlite3VdbeExec() or since last time the progress callback was called).
84174	84253	** If the progress callback returns non-zero, exit the virtual machine with
84175	84254	** a return code SQLITE_ABORT.
84176	84255	*/
84177		- if( nVmStep>=nProgressLimit && db->xProgress!=0 ){
	84256	+ while( nVmStep>=nProgressLimit && db->xProgress!=0 ){
84178	84257	assert( db->nProgressOps!=0 );
84179		- nProgressLimit = nVmStep + db->nProgressOps - (nVmStep%db->nProgressOps);
	84258	+ nProgressLimit += db->nProgressOps;
84180	84259	if( db->xProgress(db->pProgressArg) ){
	84260	+ nProgressLimit = 0xffffffff;
84181	84261	rc = SQLITE_INTERRUPT;
84182	84262	goto abort_due_to_error;
84183	84263	}
84184	84264	}
84185	84265	#endif
		@@ -84454,10 +84534,11 @@
84454	84534
84455	84535	#ifndef SQLITE_OMIT_UTF16
84456	84536	if( encoding!=SQLITE_UTF8 ){
84457	84537	rc = sqlite3VdbeMemSetStr(pOut, pOp->p4.z, -1, SQLITE_UTF8, SQLITE_STATIC);
84458	84538	assert( rc==SQLITE_OK \|\| rc==SQLITE_TOOBIG );
	84539	+ if( rc ) goto too_big;
84459	84540	if( SQLITE_OK!=sqlite3VdbeChangeEncoding(pOut, encoding) ) goto no_mem;
84460	84541	assert( pOut->szMalloc>0 && pOut->zMalloc==pOut->z );
84461	84542	assert( VdbeMemDynamic(pOut)==0 );
84462	84543	pOut->szMalloc = 0;
84463	84544	pOut->flags \|= MEM_Static;
		@@ -84466,11 +84547,10 @@
84466	84547	}
84467	84548	pOp->p4type = P4_DYNAMIC;
84468	84549	pOp->p4.z = pOut->z;
84469	84550	pOp->p1 = pOut->n;
84470	84551	}
84471		- testcase( rc==SQLITE_TOOBIG );
84472	84552	#endif
84473	84553	if( pOp->p1>db->aLimit[SQLITE_LIMIT_LENGTH] ){
84474	84554	goto too_big;
84475	84555	}
84476	84556	assert( rc==SQLITE_OK );
		@@ -84721,22 +84801,10 @@
84721	84801	int i;
84722	84802	assert( p->nResColumn==pOp->p2 );
84723	84803	assert( pOp->p1>0 );
84724	84804	assert( pOp->p1+pOp->p2<=(p->nMem+1 - p->nCursor)+1 );
84725	84805
84726		-#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
84727		- /* Run the progress counter just before returning.
84728		- */
84729		- if( db->xProgress!=0
84730		- && nVmStep>=nProgressLimit
84731		- && db->xProgress(db->pProgressArg)!=0
84732		- ){
84733		- rc = SQLITE_INTERRUPT;
84734		- goto abort_due_to_error;
84735		- }
84736		-#endif
84737		-
84738	84806	/* If this statement has violated immediate foreign key constraints, do
84739	84807	** not return the number of rows modified. And do not RELEASE the statement
84740	84808	** transaction. It needs to be rolled back. */
84741	84809	if( SQLITE_OK!=(rc = sqlite3VdbeCheckFk(p, 0)) ){
84742	84810	assert( db->flags&SQLITE_CountRows );
		@@ -85959,19 +86027,19 @@
85959	86027	offset64 = aOffset[i];
85960	86028	zHdr = zData + pC->iHdrOffset;
85961	86029	zEndHdr = zData + aOffset[0];
85962	86030	testcase( zHdr>=zEndHdr );
85963	86031	do{
85964		- if( (t = zHdr[0])<0x80 ){
	86032	+ if( (pC->aType[i] = t = zHdr[0])<0x80 ){
85965	86033	zHdr++;
85966	86034	offset64 += sqlite3VdbeOneByteSerialTypeLen(t);
85967	86035	}else{
85968	86036	zHdr += sqlite3GetVarint32(zHdr, &t);
	86037	+ pC->aType[i] = t;
85969	86038	offset64 += sqlite3VdbeSerialTypeLen(t);
85970	86039	}
85971		- pC->aType[i++] = t;
85972		- aOffset[i] = (u32)(offset64 & 0xffffffff);
	86040	+ aOffset[++i] = (u32)(offset64 & 0xffffffff);
85973	86041	}while( i<=p2 && zHdr<zEndHdr );
85974	86042
85975	86043	/* The record is corrupt if any of the following are true:
85976	86044	** (1) the bytes of the header extend past the declared header size
85977	86045	** (2) the entire header was used but not all data was used
		@@ -87933,18 +88001,11 @@
87933	88001	** cause any problems.)
87934	88002	**
87935	88003	** This instruction only works on tables. The equivalent instruction
87936	88004	** for indices is OP_IdxInsert.
87937	88005	*/
87938		-/* Opcode: InsertInt P1 P2 P3 P4 P5
87939		-** Synopsis: intkey=P3 data=r[P2]
87940		-**
87941		-** This works exactly like OP_Insert except that the key is the
87942		-** integer value P3, not the value of the integer stored in register P3.
87943		-*/
87944		-case OP_Insert:
87945		-case OP_InsertInt: {
	88006	+case OP_Insert: {
87946	88007	Mem pData; / MEM cell holding data for the record to be inserted */
87947	88008	Mem pKey; / MEM cell holding key for the record */
87948	88009	VdbeCursor pC; / Cursor to table into which insert is written */
87949	88010	int seekResult; /* Result of prior seek or 0 if no USESEEKRESULT flag */
87950	88011	const char zDb; / database name - used by the update hook */
		@@ -87961,20 +88022,15 @@
87961	88022	assert( (pOp->p5 & OPFLAG_ISNOOP) \|\| pC->isTable );
87962	88023	assert( pOp->p4type==P4_TABLE \|\| pOp->p4type>=P4_STATIC );
87963	88024	REGISTER_TRACE(pOp->p2, pData);
87964	88025	sqlite3VdbeIncrWriteCounter(p, pC);
87965	88026
87966		- if( pOp->opcode==OP_Insert ){
87967		- pKey = &aMem[pOp->p3];
87968		- assert( pKey->flags & MEM_Int );
87969		- assert( memIsValid(pKey) );
87970		- REGISTER_TRACE(pOp->p3, pKey);
87971		- x.nKey = pKey->u.i;
87972		- }else{
87973		- assert( pOp->opcode==OP_InsertInt );
87974		- x.nKey = pOp->p3;
87975		- }
	88027	+ pKey = &aMem[pOp->p3];
	88028	+ assert( pKey->flags & MEM_Int );
	88029	+ assert( memIsValid(pKey) );
	88030	+ REGISTER_TRACE(pOp->p3, pKey);
	88031	+ x.nKey = pKey->u.i;
87976	88032
87977	88033	if( pOp->p4type==P4_TABLE && HAS_UPDATE_HOOK(db) ){
87978	88034	assert( pC->iDb>=0 );
87979	88035	zDb = db->aDb[pC->iDb].zDbSName;
87980	88036	pTab = pOp->p4.pTab;
		@@ -89538,12 +89594,11 @@
89538	89594	aMem[i].flags \|= MEM_Undefined; /* Cause a fault if this reg is reused */
89539	89595	}
89540	89596	}
89541	89597	#endif
89542	89598	pOp = &aOp[-1];
89543		-
89544		- break;
	89599	+ goto check_for_interrupt;
89545	89600	}
89546	89601
89547	89602	/* Opcode: Param P1 P2 * * *
89548	89603	**
89549	89604	** This opcode is only ever present in sub-programs called via the
		@@ -90948,11 +91003,20 @@
90948	91003
90949	91004	/* This is the only way out of this procedure. We have to
90950	91005	** release the mutexes on btrees that were acquired at the
90951	91006	** top. */
90952	91007	vdbe_return:
90953		- testcase( nVmStep>0 );
	91008	+#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
	91009	+ while( nVmStep>=nProgressLimit && db->xProgress!=0 ){
	91010	+ nProgressLimit += db->nProgressOps;
	91011	+ if( db->xProgress(db->pProgressArg) ){
	91012	+ nProgressLimit = 0xffffffff;
	91013	+ rc = SQLITE_INTERRUPT;
	91014	+ goto abort_due_to_error;
	91015	+ }
	91016	+ }
	91017	+#endif
90954	91018	p->aCounter[SQLITE_STMTSTATUS_VM_STEP] += (int)nVmStep;
90955	91019	sqlite3VdbeLeave(p);
90956	91020	assert( rc!=SQLITE_OK \|\| nExtraDelete==0
90957	91021	\|\| sqlite3_strlike("DELETE%",p->zSql,0)!=0
90958	91022	);
		@@ -96129,10 +96193,42 @@
96129	96193	}
96130	96194	}
96131	96195	return 0;
96132	96196	}
96133	96197
	96198	+#ifndef SQLITE_OMIT_WINDOWFUNC
	96199	+/*
	96200	+** Walker callback for resolveRemoveWindows().
	96201	+*/
	96202	+static int resolveRemoveWindowsCb(Walker pWalker, Expr pExpr){
	96203	+ if( ExprHasProperty(pExpr, EP_WinFunc) ){
	96204	+ Window **pp;
	96205	+ for(pp=&pWalker->u.pSelect->pWin; pp; pp=&(pp)->pNextWin){
	96206	+ if( *pp==pExpr->y.pWin ){
	96207	+ pp = (pp)->pNextWin;
	96208	+ break;
	96209	+ }
	96210	+ }
	96211	+ }
	96212	+ return WRC_Continue;
	96213	+}
	96214	+
	96215	+/*
	96216	+** Remove any Window objects owned by the expression pExpr from the
	96217	+** Select.pWin list of Select object pSelect.
	96218	+*/
	96219	+static void resolveRemoveWindows(Select pSelect, Expr pExpr){
	96220	+ Walker sWalker;
	96221	+ memset(&sWalker, 0, sizeof(Walker));
	96222	+ sWalker.xExprCallback = resolveRemoveWindowsCb;
	96223	+ sWalker.u.pSelect = pSelect;
	96224	+ sqlite3WalkExpr(&sWalker, pExpr);
	96225	+}
	96226	+#else
	96227	+# define resolveRemoveWindows(x,y)
	96228	+#endif
	96229	+
96134	96230	/*
96135	96231	** pOrderBy is an ORDER BY or GROUP BY clause in SELECT statement pSelect.
96136	96232	** The Name context of the SELECT statement is pNC. zType is either
96137	96233	** "ORDER" or "GROUP" depending on which type of clause pOrderBy is.
96138	96234	**
		@@ -96195,23 +96291,14 @@
96195	96291	if( sqlite3ResolveExprNames(pNC, pE) ){
96196	96292	return 1;
96197	96293	}
96198	96294	for(j=0; j<pSelect->pEList->nExpr; j++){
96199	96295	if( sqlite3ExprCompare(0, pE, pSelect->pEList->a[j].pExpr, -1)==0 ){
96200		-#ifndef SQLITE_OMIT_WINDOWFUNC
96201		- if( ExprHasProperty(pE, EP_WinFunc) ){
96202		- /* Since this window function is being changed into a reference
96203		- ** to the same window function the result set, remove the instance
96204		- ** of this window function from the Select.pWin list. */
96205		- Window **pp;
96206		- for(pp=&pSelect->pWin; pp; pp=&(pp)->pNextWin){
96207		- if( *pp==pE->y.pWin ){
96208		- pp = (pp)->pNextWin;
96209		- }
96210		- }
96211		- }
96212		-#endif
	96296	+ /* Since this expresion is being changed into a reference
	96297	+ ** to an identical expression in the result set, remove all Window
	96298	+ ** objects belonging to the expression from the Select.pWin list. */
	96299	+ resolveRemoveWindows(pSelect, pE);
96213	96300	pItem->u.x.iOrderByCol = j+1;
96214	96301	}
96215	96302	}
96216	96303	}
96217	96304	return sqlite3ResolveOrderGroupBy(pParse, pSelect, pOrderBy, zType);
		@@ -96419,10 +96506,11 @@
96419	96506	return WRC_Abort;
96420	96507	}
96421	96508	}
96422	96509	}
96423	96510
	96511	+#ifndef SQLITE_OMIT_WINDOWFUNC
96424	96512	if( IN_RENAME_OBJECT ){
96425	96513	Window *pWin;
96426	96514	for(pWin=p->pWinDefn; pWin; pWin=pWin->pNextWin){
96427	96515	if( sqlite3ResolveExprListNames(&sNC, pWin->pOrderBy)
96428	96516	\|\| sqlite3ResolveExprListNames(&sNC, pWin->pPartition)
		@@ -96429,10 +96517,11 @@
96429	96517	){
96430	96518	return WRC_Abort;
96431	96519	}
96432	96520	}
96433	96521	}
	96522	+#endif
96434	96523
96435	96524	/* If this is part of a compound SELECT, check that it has the right
96436	96525	** number of expressions in the select list. */
96437	96526	if( p->pNext && p->pEList->nExpr!=p->pNext->pEList->nExpr ){
96438	96527	sqlite3SelectWrongNumTermsError(pParse, p->pNext);
		@@ -99179,18 +99268,15 @@
99179	99268	u32 savedNQueryLoop = pParse->nQueryLoop;
99180	99269	int rMayHaveNull = 0;
99181	99270	eType = IN_INDEX_EPH;
99182	99271	if( inFlags & IN_INDEX_LOOP ){
99183	99272	pParse->nQueryLoop = 0;
99184		- if( pX->pLeft->iColumn<0 && !ExprHasProperty(pX, EP_xIsSelect) ){
99185		- eType = IN_INDEX_ROWID;
99186		- }
99187	99273	}else if( prRhsHasNull ){
99188	99274	*prRhsHasNull = rMayHaveNull = ++pParse->nMem;
99189	99275	}
99190	99276	assert( pX->op==TK_IN );
99191		- sqlite3CodeRhsOfIN(pParse, pX, iTab, eType==IN_INDEX_ROWID);
	99277	+ sqlite3CodeRhsOfIN(pParse, pX, iTab);
99192	99278	if( rMayHaveNull ){
99193	99279	sqlite3SetHasNullFlag(v, iTab, rMayHaveNull);
99194	99280	}
99195	99281	pParse->nQueryLoop = savedNQueryLoop;
99196	99282	}
		@@ -99287,16 +99373,10 @@
99287	99373	** constructed ephermeral table is returned. The first time the ephemeral
99288	99374	** table is computed, the cursor number is also stored in pExpr->iTable,
99289	99375	** however the cursor number returned might not be the same, as it might
99290	99376	** have been duplicated using OP_OpenDup.
99291	99377	**
99292		-** If parameter isRowid is non-zero, then LHS of the IN operator is guaranteed
99293		-** to be a non-null integer. In this case, the ephemeral table can be an
99294		-** table B-Tree that keyed by only integers. The more general cases uses
99295		-** an index B-Tree which can have arbitrary keys, but is slower to both
99296		-** read and write.
99297		-**
99298	99378	** If the LHS expression ("x" in the examples) is a column value, or
99299	99379	** the SELECT statement returns a column value, then the affinity of that
99300	99380	** column is used to build the index keys. If both 'x' and the
99301	99381	** SELECT... statement are columns, then numeric affinity is used
99302	99382	** if either column has NUMERIC or INTEGER affinity. If neither
		@@ -99304,12 +99384,11 @@
99304	99384	** is used.
99305	99385	*/
99306	99386	SQLITE_PRIVATE void sqlite3CodeRhsOfIN(
99307	99387	Parse pParse, / Parsing context */
99308	99388	Expr pExpr, / The IN operator */
99309		- int iTab, /* Use this cursor number */
99310		- int isRowid /* If true, LHS is a rowid */
	99389	+ int iTab /* Use this cursor number */
99311	99390	){
99312	99391	int addrOnce = 0; /* Address of the OP_Once instruction at top */
99313	99392	int addr; /* Address of OP_OpenEphemeral instruction */
99314	99393	Expr pLeft; / the LHS of the IN operator */
99315	99394	KeyInfo pKeyInfo = 0; / Key information */
		@@ -99358,26 +99437,24 @@
99358	99437	}
99359	99438
99360	99439	/* Check to see if this is a vector IN operator */
99361	99440	pLeft = pExpr->pLeft;
99362	99441	nVal = sqlite3ExprVectorSize(pLeft);
99363		- assert( !isRowid \|\| nVal==1 );
99364	99442
99365	99443	/* Construct the ephemeral table that will contain the content of
99366	99444	** RHS of the IN operator.
99367	99445	*/
99368	99446	pExpr->iTable = iTab;
99369		- addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral,
99370		- pExpr->iTable, (isRowid?0:nVal));
	99447	+ addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, pExpr->iTable, nVal);
99371	99448	#ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
99372	99449	if( ExprHasProperty(pExpr, EP_xIsSelect) ){
99373	99450	VdbeComment((v, "Result of SELECT %u", pExpr->x.pSelect->selId));
99374	99451	}else{
99375	99452	VdbeComment((v, "RHS of IN operator"));
99376	99453	}
99377	99454	#endif
99378		- pKeyInfo = isRowid ? 0 : sqlite3KeyInfoAlloc(pParse->db, nVal, 1);
	99455	+ pKeyInfo = sqlite3KeyInfoAlloc(pParse->db, nVal, 1);
99379	99456
99380	99457	if( ExprHasProperty(pExpr, EP_xIsSelect) ){
99381	99458	/* Case 1: expr IN (SELECT ...)
99382	99459	**
99383	99460	** Generate code to write the results of the select into the temporary
		@@ -99387,11 +99464,10 @@
99387	99464	ExprList *pEList = pSelect->pEList;
99388	99465
99389	99466	ExplainQueryPlan((pParse, 1, "%sLIST SUBQUERY %d",
99390	99467	addrOnce?"":"CORRELATED ", pSelect->selId
99391	99468	));
99392		- assert( !isRowid );
99393	99469	/* If the LHS and RHS of the IN operator do not match, that
99394	99470	** error will have been caught long before we reach this point. */
99395	99471	if( ALWAYS(pEList->nExpr==nVal) ){
99396	99472	SelectDest dest;
99397	99473	int i;
		@@ -99440,14 +99516,12 @@
99440	99516	}
99441	99517
99442	99518	/* Loop through each expression in <exprlist>. */
99443	99519	r1 = sqlite3GetTempReg(pParse);
99444	99520	r2 = sqlite3GetTempReg(pParse);
99445		- if( isRowid ) sqlite3VdbeAddOp4(v, OP_Blob, 0, r2, 0, "", P4_STATIC);
99446	99521	for(i=pList->nExpr, pItem=pList->a; i>0; i--, pItem++){
99447	99522	Expr *pE2 = pItem->pExpr;
99448		- int iValToIns;
99449	99523
99450	99524	/* If the expression is not constant then we will need to
99451	99525	** disable the test that was generated above that makes sure
99452	99526	** this code only executes once. Because for a non-constant
99453	99527	** expression we need to rerun this code each time.
		@@ -99456,24 +99530,13 @@
99456	99530	sqlite3VdbeChangeToNoop(v, addrOnce);
99457	99531	addrOnce = 0;
99458	99532	}
99459	99533
99460	99534	/* Evaluate the expression and insert it into the temp table */
99461		- if( isRowid && sqlite3ExprIsInteger(pE2, &iValToIns) ){
99462		- sqlite3VdbeAddOp3(v, OP_InsertInt, iTab, r2, iValToIns);
99463		- }else{
99464		- r3 = sqlite3ExprCodeTarget(pParse, pE2, r1);
99465		- if( isRowid ){
99466		- sqlite3VdbeAddOp2(v, OP_MustBeInt, r3,
99467		- sqlite3VdbeCurrentAddr(v)+2);
99468		- VdbeCoverage(v);
99469		- sqlite3VdbeAddOp3(v, OP_Insert, iTab, r2, r3);
99470		- }else{
99471		- sqlite3VdbeAddOp4(v, OP_MakeRecord, r3, 1, r2, &affinity, 1);
99472		- sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iTab, r2, r3, 1);
99473		- }
99474		- }
	99535	+ r3 = sqlite3ExprCodeTarget(pParse, pE2, r1);
	99536	+ sqlite3VdbeAddOp4(v, OP_MakeRecord, r3, 1, r2, &affinity, 1);
	99537	+ sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iTab, r2, r3, 1);
99475	99538	}
99476	99539	sqlite3ReleaseTempReg(pParse, r1);
99477	99540	sqlite3ReleaseTempReg(pParse, r2);
99478	99541	}
99479	99542	if( pKeyInfo ){
		@@ -106852,11 +106915,15 @@
106852	106915	assert( pParse->nested<10 ); /* Nesting should only be of limited depth */
106853	106916	va_start(ap, zFormat);
106854	106917	zSql = sqlite3VMPrintf(db, zFormat, ap);
106855	106918	va_end(ap);
106856	106919	if( zSql==0 ){
106857		- return; /* A malloc must have failed */
	106920	+ /* This can result either from an OOM or because the formatted string
	106921	+ ** exceeds SQLITE_LIMIT_LENGTH. In the latter case, we need to set
	106922	+ ** an error */
	106923	+ if( !db->mallocFailed ) pParse->rc = SQLITE_TOOBIG;
	106924	+ return;
106858	106925	}
106859	106926	pParse->nested++;
106860	106927	memcpy(saveBuf, PARSE_TAIL(pParse), PARSE_TAIL_SZ);
106861	106928	memset(PARSE_TAIL(pParse), 0, PARSE_TAIL_SZ);
106862	106929	sqlite3RunParser(pParse, zSql, &zErrMsg);
		@@ -108413,10 +108480,11 @@
108413	108480	if( db->mallocFailed \|\| pParse->nErr ) return;
108414	108481	pPk = sqlite3PrimaryKeyIndex(pTab);
108415	108482	pTab->iPKey = -1;
108416	108483	}else{
108417	108484	pPk = sqlite3PrimaryKeyIndex(pTab);
	108485	+ assert( pPk!=0 );
108418	108486
108419	108487	/*
108420	108488	** Remove all redundant columns from the PRIMARY KEY. For example, change
108421	108489	** "PRIMARY KEY(a,b,a,b,c,b,c,d)" into just "PRIMARY KEY(a,b,c,d)". Later
108422	108490	** code assumes the PRIMARY KEY contains no repeated columns.
		@@ -108582,10 +108650,15 @@
108582	108650	}
108583	108651	p->tnum = db->init.newTnum;
108584	108652	if( p->tnum==1 ) p->tabFlags \|= TF_Readonly;
108585	108653	}
108586	108654
	108655	+ assert( (p->tabFlags & TF_HasPrimaryKey)==0
	108656	+ \|\| p->iPKey>=0 \|\| sqlite3PrimaryKeyIndex(p)!=0 );
	108657	+ assert( (p->tabFlags & TF_HasPrimaryKey)!=0
	108658	+ \|\| (p->iPKey<0 && sqlite3PrimaryKeyIndex(p)==0) );
	108659	+
108587	108660	/* Special processing for WITHOUT ROWID Tables */
108588	108661	if( tabOpts & TF_WithoutRowid ){
108589	108662	if( (p->tabFlags & TF_Autoincrement) ){
108590	108663	sqlite3ErrorMsg(pParse,
108591	108664	"AUTOINCREMENT not allowed on WITHOUT ROWID tables");
		@@ -117855,11 +117928,13 @@
117855	117928	}
117856	117929	}
117857	117930	sqlite3VdbeAddOp3(v, OP_MakeRecord, regIdx, pIdx->nColumn, aRegIdx[ix]);
117858	117931	VdbeComment((v, "for %s", pIdx->zName));
117859	117932	#ifdef SQLITE_ENABLE_NULL_TRIM
117860		- if( pIdx->idxType==2 ) sqlite3SetMakeRecordP5(v, pIdx->pTable);
	117933	+ if( pIdx->idxType==SQLITE_IDXTYPE_PRIMARYKEY ){
	117934	+ sqlite3SetMakeRecordP5(v, pIdx->pTable);
	117935	+ }
117861	117936	#endif
117862	117937
117863	117938	/* In an UPDATE operation, if this index is the PRIMARY KEY index
117864	117939	** of a WITHOUT ROWID table and there has been no change the
117865	117940	** primary key, then no collision is possible. The collision detection
		@@ -118105,14 +118180,17 @@
118105	118180	assert( pParse->nested==0 );
118106	118181	pik_flags \|= OPFLAG_NCHANGE;
118107	118182	pik_flags \|= (update_flags & OPFLAG_SAVEPOSITION);
118108	118183	#ifdef SQLITE_ENABLE_PREUPDATE_HOOK
118109	118184	if( update_flags==0 ){
118110		- sqlite3VdbeAddOp4(v, OP_InsertInt,
118111		- iIdxCur+i, aRegIdx[i], 0, (char*)pTab, P4_TABLE
	118185	+ int r = sqlite3GetTempReg(pParse);
	118186	+ sqlite3VdbeAddOp2(v, OP_Integer, 0, r);
	118187	+ sqlite3VdbeAddOp4(v, OP_Insert,
	118188	+ iIdxCur+i, aRegIdx[i], r, (char*)pTab, P4_TABLE
118112	118189	);
118113	118190	sqlite3VdbeChangeP5(v, OPFLAG_ISNOOP);
	118191	+ sqlite3ReleaseTempReg(pParse, r);
118114	118192	}
118115	118193	#endif
118116	118194	}
118117	118195	sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iIdxCur+i, aRegIdx[i],
118118	118196	aRegIdx[i]+1,
		@@ -118533,11 +118611,11 @@
118533	118611	addr2 = sqlite3VdbeAddOp3(v, OP_NotExists, iDest, 0, regRowid);
118534	118612	VdbeCoverage(v);
118535	118613	sqlite3RowidConstraint(pParse, onError, pDest);
118536	118614	sqlite3VdbeJumpHere(v, addr2);
118537	118615	autoIncStep(pParse, regAutoinc, regRowid);
118538		- }else if( pDest->pIndex==0 ){
	118616	+ }else if( pDest->pIndex==0 && !(db->mDbFlags & DBFLAG_Vacuum) ){
118539	118617	addr1 = sqlite3VdbeAddOp2(v, OP_NewRowid, iDest, regRowid);
118540	118618	}else{
118541	118619	addr1 = sqlite3VdbeAddOp2(v, OP_Rowid, iSrc, regRowid);
118542	118620	assert( (pDest->tabFlags & TF_Autoincrement)==0 );
118543	118621	}
		@@ -118596,11 +118674,11 @@
118596	118674	if( i==pSrcIdx->nColumn ){
118597	118675	idxInsFlags = OPFLAG_USESEEKRESULT;
118598	118676	sqlite3VdbeAddOp1(v, OP_SeekEnd, iDest);
118599	118677	}
118600	118678	}
118601		- if( !HasRowid(pSrc) && pDestIdx->idxType==2 ){
	118679	+ if( !HasRowid(pSrc) && pDestIdx->idxType==SQLITE_IDXTYPE_PRIMARYKEY ){
118602	118680	idxInsFlags \|= OPFLAG_NCHANGE;
118603	118681	}
118604	118682	sqlite3VdbeAddOp2(v, OP_IdxInsert, iDest, regData);
118605	118683	sqlite3VdbeChangeP5(v, idxInsFlags\|OPFLAG_APPEND);
118606	118684	sqlite3VdbeAddOp2(v, OP_Next, iSrc, addr1+1); VdbeCoverage(v);
		@@ -136425,11 +136503,10 @@
136425	136503	pIn += i;
136426	136504	for(i=iEq;i<pLoop->nLTerm; i++){
136427	136505	if( pLoop->aLTerm[i]->pExpr==pX ){
136428	136506	int iOut = iReg + i - iEq;
136429	136507	if( eType==IN_INDEX_ROWID ){
136430		- testcase( nEq>1 ); /* Happens with a UNIQUE index on ROWID */
136431	136508	pIn->addrInTop = sqlite3VdbeAddOp2(v, OP_Rowid, iTab, iOut);
136432	136509	}else{
136433	136510	int iCol = aiMap ? aiMap[iMap++] : 0;
136434	136511	pIn->addrInTop = sqlite3VdbeAddOp3(v,OP_Column,iTab, iCol, iOut);
136435	136512	}
		@@ -137187,10 +137264,13 @@
137187	137264	if( iRowidReg!=iReleaseReg ) sqlite3ReleaseTempReg(pParse, iReleaseReg);
137188	137265	addrNxt = pLevel->addrNxt;
137189	137266	sqlite3VdbeAddOp3(v, OP_SeekRowid, iCur, addrNxt, iRowidReg);
137190	137267	VdbeCoverage(v);
137191	137268	pLevel->op = OP_Noop;
	137269	+ if( (pTerm->prereqAll & pLevel->notReady)==0 ){
	137270	+ pTerm->wtFlags \|= TERM_CODED;
	137271	+ }
137192	137272	}else if( (pLoop->wsFlags & WHERE_IPK)!=0
137193	137273	&& (pLoop->wsFlags & WHERE_COLUMN_RANGE)!=0
137194	137274	){
137195	137275	/* Case 3: We have an inequality comparison against the ROWID field.
137196	137276	*/
		@@ -153009,10 +153089,11 @@
153009	153089	int n = 0; /* Length of the next token token */
153010	153090	int tokenType; /* type of the next token */
153011	153091	int lastTokenParsed = -1; /* type of the previous token */
153012	153092	sqlite3 db = pParse->db; / The database connection */
153013	153093	int mxSqlLen; /* Max length of an SQL string */
	153094	+ VVA_ONLY( u8 startedWithOom = db->mallocFailed );
153014	153095	#ifdef sqlite3Parser_ENGINEALWAYSONSTACK
153015	153096	yyParser sEngine; /* Space to hold the Lemon-generated Parser object */
153016	153097	#endif
153017	153098
153018	153099	assert( zSql!=0 );
		@@ -153043,10 +153124,12 @@
153043	153124	#endif
153044	153125	assert( pParse->pNewTable==0 );
153045	153126	assert( pParse->pNewTrigger==0 );
153046	153127	assert( pParse->nVar==0 );
153047	153128	assert( pParse->pVList==0 );
	153129	+ pParse->pParentParse = db->pParse;
	153130	+ db->pParse = pParse;
153048	153131	while( 1 ){
153049	153132	n = sqlite3GetToken((u8*)zSql, &tokenType);
153050	153133	mxSqlLen -= n;
153051	153134	if( mxSqlLen<0 ){
153052	153135	pParse->rc = SQLITE_TOOBIG;
		@@ -153099,11 +153182,12 @@
153099	153182	pParse->sLastToken.z = zSql;
153100	153183	pParse->sLastToken.n = n;
153101	153184	sqlite3Parser(pEngine, tokenType, pParse->sLastToken);
153102	153185	lastTokenParsed = tokenType;
153103	153186	zSql += n;
153104		- if( pParse->rc!=SQLITE_OK \|\| db->mallocFailed ) break;
	153187	+ assert( db->mallocFailed==0 \|\| pParse->rc!=SQLITE_OK \|\| startedWithOom );
	153188	+ if( pParse->rc!=SQLITE_OK ) break;
153105	153189	}
153106	153190	assert( nErr==0 );
153107	153191	#ifdef YYTRACKMAXSTACKDEPTH
153108	153192	sqlite3_mutex_enter(sqlite3MallocMutex());
153109	153193	sqlite3StatusHighwater(SQLITE_STATUS_PARSER_STACK,
		@@ -153167,10 +153251,12 @@
153167	153251	while( pParse->pZombieTab ){
153168	153252	Table *p = pParse->pZombieTab;
153169	153253	pParse->pZombieTab = p->pNextZombie;
153170	153254	sqlite3DeleteTable(db, p);
153171	153255	}
	153256	+ db->pParse = pParse->pParentParse;
	153257	+ pParse->pParentParse = 0;
153172	153258	assert( nErr==0 \|\| pParse->rc!=SQLITE_OK );
153173	153259	return nErr;
153174	153260	}
153175	153261
153176	153262
		@@ -170805,11 +170891,13 @@
170805	170891
170806	170892	fts3SegReaderSetEof(pReader);
170807	170893
170808	170894	/* If iCurrentBlock>=iLeafEndBlock, this is an EOF condition. All leaf
170809	170895	** blocks have already been traversed. */
170810		- assert( pReader->iCurrentBlock<=pReader->iLeafEndBlock );
	170896	+#ifdef CORRUPT_DB
	170897	+ assert( pReader->iCurrentBlock<=pReader->iLeafEndBlock \|\| CORRUPT_DB );
	170898	+#endif
170811	170899	if( pReader->iCurrentBlock>=pReader->iLeafEndBlock ){
170812	170900	return SQLITE_OK;
170813	170901	}
170814	170902
170815	170903	rc = sqlite3Fts3ReadBlock(
		@@ -172692,12 +172780,14 @@
172692	172780	bIgnoreEmpty = (iLevel!=FTS3_SEGCURSOR_PENDING) && (iNewLevel>iMaxLevel);
172693	172781	}
172694	172782	if( rc!=SQLITE_OK ) goto finished;
172695	172783
172696	172784	assert( csr.nSegment>0 );
172697		- assert( iNewLevel>=getAbsoluteLevel(p, iLangid, iIndex, 0) );
172698		- assert( iNewLevel<getAbsoluteLevel(p, iLangid, iIndex,FTS3_SEGDIR_MAXLEVEL) );
	172785	+ assert_fts3_nc( iNewLevel>=getAbsoluteLevel(p, iLangid, iIndex, 0) );
	172786	+ assert_fts3_nc(
	172787	+ iNewLevel<getAbsoluteLevel(p, iLangid, iIndex,FTS3_SEGDIR_MAXLEVEL)
	172788	+ );
172699	172789
172700	172790	memset(&filter, 0, sizeof(Fts3SegFilter));
172701	172791	filter.flags = FTS3_SEGMENT_REQUIRE_POS;
172702	172792	filter.flags \|= (bIgnoreEmpty ? FTS3_SEGMENT_IGNORE_EMPTY : 0);
172703	172793
		@@ -176712,11 +176802,11 @@
176712	176802	UNUSED_PARAMETER(iPhrase);
176713	176803	rc = sqlite3Fts3EvalPhrasePoslist(p->pCsr, pExpr, p->iCol, &pList);
176714	176804	nTerm = pExpr->pPhrase->nToken;
176715	176805	if( pList ){
176716	176806	fts3GetDeltaPosition(&pList, &iPos);
176717		- assert( iPos>=0 );
	176807	+ assert_fts3_nc( iPos>=0 );
176718	176808	}
176719	176809
176720	176810	for(iTerm=0; iTerm<nTerm; iTerm++){
176721	176811	TermOffset *pT = &p->aTerm[p->iTerm++];
176722	176812	pT->iOff = nTerm-iTerm-1;
		@@ -176822,11 +176912,11 @@
176822	176912
176823	176913	if( !pTerm ){
176824	176914	/* All offsets for this column have been gathered. */
176825	176915	rc = SQLITE_DONE;
176826	176916	}else{
176827		- assert( iCurrent<=iMinPos );
	176917	+ assert_fts3_nc( iCurrent<=iMinPos );
176828	176918	if( 0==(0xFE&*pTerm->pList) ){
176829	176919	pTerm->pList = 0;
176830	176920	}else{
176831	176921	fts3GetDeltaPosition(&pTerm->pList, &pTerm->iPos);
176832	176922	}
		@@ -188622,10 +188712,11 @@
188622	188712	if( aOut==0 ){
188623	188713	sqlite3_result_error_nomem(context);
188624	188714	}else{
188625	188715	nOut2 = rbuDeltaApply(aOrig, nOrig, aDelta, nDelta, aOut);
188626	188716	if( nOut2!=nOut ){
	188717	+ sqlite3_free(aOut);
188627	188718	sqlite3_result_error(context, "corrupt fossil delta", -1);
188628	188719	}else{
188629	188720	sqlite3_result_blob(context, aOut, nOut, sqlite3_free);
188630	188721	}
188631	188722	}
		@@ -199681,11 +199772,11 @@
199681	199772	** xSetAuxdata(pFts5, pAux, xDelete)
199682	199773	**
199683	199774	** Save the pointer passed as the second argument as the extension functions
199684	199775	** "auxiliary data". The pointer may then be retrieved by the current or any
199685	199776	** future invocation of the same fts5 extension function made as part of
199686		-** of the same MATCH query using the xGetAuxdata() API.
	199777	+** the same MATCH query using the xGetAuxdata() API.
199687	199778	**
199688	199779	** Each extension function is allocated a single auxiliary data slot for
199689	199780	** each FTS query (MATCH expression). If the extension function is invoked
199690	199781	** more than once for a single FTS query, then all invocations share a
199691	199782	** single auxiliary data context.
		@@ -199696,11 +199787,11 @@
199696	199787	** point.
199697	199788	**
199698	199789	** The xDelete callback, if one is specified, is also invoked on the
199699	199790	** auxiliary data pointer after the FTS5 query has finished.
199700	199791	**
199701		-** If an error (e.g. an OOM condition) occurs within this function, an
	199792	+** If an error (e.g. an OOM condition) occurs within this function,
199702	199793	** the auxiliary data is set to NULL and an error code returned. If the
199703	199794	** xDelete parameter was not NULL, it is invoked on the auxiliary data
199704	199795	** pointer before returning.
199705	199796	**
199706	199797	**
		@@ -212031,17 +212122,18 @@
212031	212122	}
212032	212123
212033	212124	/* Set up the new page-index array */
212034	212125	fts5BufferAppendVarint(&p->rc, &buf, 4);
212035	212126	if( pSeg->iLeafPgno==pSeg->iTermLeafPgno
212036		- && pSeg->iEndofDoclist<pData->szLeaf
212037		- ){
	212127	+ && pSeg->iEndofDoclist<pData->szLeaf
	212128	+ && pSeg->iPgidxOff<=pData->nn
	212129	+ ){
212038	212130	int nDiff = pData->szLeaf - pSeg->iEndofDoclist;
212039	212131	fts5BufferAppendVarint(&p->rc, &buf, buf.n - 1 - nDiff - 4);
212040	212132	fts5BufferAppendBlob(&p->rc, &buf,
212041	212133	pData->nn - pSeg->iPgidxOff, &pData->p[pSeg->iPgidxOff]
212042		- );
	212134	+ );
212043	212135	}
212044	212136
212045	212137	pSeg->pSeg->pgnoFirst = pSeg->iTermLeafPgno;
212046	212138	fts5DataDelete(p, FTS5_SEGMENT_ROWID(iId, 1), iLeafRowid);
212047	212139	fts5DataWrite(p, iLeafRowid, buf.p, buf.n);
		@@ -217074,11 +217166,11 @@
217074	217166	int nArg, /* Number of args */
217075	217167	sqlite3_value *apUnused / Function arguments */
217076	217168	){
217077	217169	assert( nArg==0 );
217078	217170	UNUSED_PARAM2(nArg, apUnused);
217079		- sqlite3_result_text(pCtx, "fts5: 2019-02-08 13:17:39 0eca3dd3d38b31c92b49ca2d311128b74584714d9e7de895b1a6286ef959a1dd", -1, SQLITE_TRANSIENT);
	217171	+ sqlite3_result_text(pCtx, "fts5: 2019-02-25 14:52:43 9da4fb59b28686630d63a79988b458726332cf06cc0e6e84d7c0a7600f5fcab0", -1, SQLITE_TRANSIENT);
217080	217172	}
217081	217173
217082	217174	/*
217083	217175	** Return true if zName is the extension on one of the shadow tables used
217084	217176	** by this module.
		@@ -221838,12 +221930,12 @@
221838	221930	}
221839	221931	#endif /* SQLITE_CORE */
221840	221932	#endif /* !defined(SQLITE_CORE) \|\| defined(SQLITE_ENABLE_STMTVTAB) */
221841	221933
221842	221934	/************ End of stmt.c **********************************************/
221843		-#if __LINE__!=221843
	221935	+#if __LINE__!=221935
221844	221936	#undef SQLITE_SOURCE_ID
221845		-#define SQLITE_SOURCE_ID "2019-02-08 13:17:39 0eca3dd3d38b31c92b49ca2d311128b74584714d9e7de895b1a6286ef959alt2"
	221937	+#define SQLITE_SOURCE_ID "2019-02-25 14:52:43 9da4fb59b28686630d63a79988b458726332cf06cc0e6e84d7c0a7600f5falt2"
221846	221938	#endif
221847	221939	/* Return the source-id for this library */
221848	221940	SQLITE_API const char *sqlite3_sourceid(void){ return SQLITE_SOURCE_ID; }
221849	221941	/************************ End of sqlite3.c ****************************/
221850	221942

	--- src/sqlite3.c
	+++ src/sqlite3.c
	@@ -1,8 +1,8 @@
1	/******************************************************************************
2	** This file is an amalgamation of many separate C source files from SQLite
3	** version 3.27.1. By combining all the individual C code files into this
4	** single large file, the entire code can be compiled as a single translation
5	** unit. This allows many compilers to do optimizations that would not be
6	** possible if the files were compiled separately. Performance improvements
7	** of 5% or more are commonly seen when SQLite is compiled as a single
8	** translation unit.
	@@ -1160,13 +1160,13 @@
1160	**
1161	** See also: [sqlite3_libversion()],
1162	** [sqlite3_libversion_number()], [sqlite3_sourceid()],
1163	** [sqlite_version()] and [sqlite_source_id()].
1164	*/
1165	#define SQLITE_VERSION "3.27.1"
1166	#define SQLITE_VERSION_NUMBER 3027001
1167	#define SQLITE_SOURCE_ID "2019-02-08 13:17:39 0eca3dd3d38b31c92b49ca2d311128b74584714d9e7de895b1a6286ef959a1dd"
1168
1169	/*
1170	** CAPI3REF: Run-Time Library Version Numbers
1171	** KEYWORDS: sqlite3_version sqlite3_sourceid
1172	**
	@@ -3406,11 +3406,11 @@
3406	** ^Changes made as part of [foreign key actions] are included in the
3407	** count, but those made as part of REPLACE constraint resolution are
3408	** not. ^Changes to a view that are intercepted by INSTEAD OF triggers
3409	** are not counted.
3410	**
3411	** This the [sqlite3_total_changes(D)] interface only reports the number
3412	** of rows that changed due to SQL statement run against database
3413	** connection D. Any changes by other database connections are ignored.
3414	** To detect changes against a database file from other database
3415	** connections use the [PRAGMA data_version] command or the
3416	** [SQLITE_FCNTL_DATA_VERSION] [file control].
	@@ -12338,11 +12338,11 @@
12338	** xSetAuxdata(pFts5, pAux, xDelete)
12339	**
12340	** Save the pointer passed as the second argument as the extension functions
12341	** "auxiliary data". The pointer may then be retrieved by the current or any
12342	** future invocation of the same fts5 extension function made as part of
12343	** of the same MATCH query using the xGetAuxdata() API.
12344	**
12345	** Each extension function is allocated a single auxiliary data slot for
12346	** each FTS query (MATCH expression). If the extension function is invoked
12347	** more than once for a single FTS query, then all invocations share a
12348	** single auxiliary data context.
	@@ -12353,11 +12353,11 @@
12353	** point.
12354	**
12355	** The xDelete callback, if one is specified, is also invoked on the
12356	** auxiliary data pointer after the FTS5 query has finished.
12357	**
12358	** If an error (e.g. an OOM condition) occurs within this function, an
12359	** the auxiliary data is set to NULL and an error code returned. If the
12360	** xDelete parameter was not NULL, it is invoked on the auxiliary data
12361	** pointer before returning.
12362	**
12363	**
	@@ -14935,61 +14935,60 @@
14935	#define OP_ColumnsUsed 118
14936	#define OP_SeekHit 119 /* synopsis: seekHit=P2 */
14937	#define OP_Sequence 120 /* synopsis: r[P2]=cursor[P1].ctr++ */
14938	#define OP_NewRowid 121 /* synopsis: r[P2]=rowid */
14939	#define OP_Insert 122 /* synopsis: intkey=r[P3] data=r[P2] */
14940	#define OP_InsertInt 123 /* synopsis: intkey=P3 data=r[P2] */
14941	#define OP_Delete 124
14942	#define OP_ResetCount 125
14943	#define OP_SorterCompare 126 /* synopsis: if key(P1)!=trim(r[P3],P4) goto P2 */
14944	#define OP_SorterData 127 /* synopsis: r[P2]=data */
14945	#define OP_RowData 128 /* synopsis: r[P2]=data */
14946	#define OP_Rowid 129 /* synopsis: r[P2]=rowid */
14947	#define OP_NullRow 130
14948	#define OP_SeekEnd 131
14949	#define OP_SorterInsert 132 /* synopsis: key=r[P2] */
14950	#define OP_IdxInsert 133 /* synopsis: key=r[P2] */
14951	#define OP_IdxDelete 134 /* synopsis: key=r[P2@P3] */
14952	#define OP_DeferredSeek 135 /* synopsis: Move P3 to P1.rowid if needed */
14953	#define OP_IdxRowid 136 /* synopsis: r[P2]=rowid */
14954	#define OP_Destroy 137
14955	#define OP_Clear 138
14956	#define OP_ResetSorter 139
14957	#define OP_CreateBtree 140 /* synopsis: r[P2]=root iDb=P1 flags=P3 */
14958	#define OP_Real 141 /* same as TK_FLOAT, synopsis: r[P2]=P4 */
14959	#define OP_SqlExec 142
14960	#define OP_ParseSchema 143
14961	#define OP_LoadAnalysis 144
14962	#define OP_DropTable 145
14963	#define OP_DropIndex 146
14964	#define OP_DropTrigger 147
14965	#define OP_IntegrityCk 148
14966	#define OP_RowSetAdd 149 /* synopsis: rowset(P1)=r[P2] */
14967	#define OP_Param 150
14968	#define OP_FkCounter 151 /* synopsis: fkctr[P1]+=P2 */
14969	#define OP_MemMax 152 /* synopsis: r[P1]=max(r[P1],r[P2]) */
14970	#define OP_OffsetLimit 153 /* synopsis: if r[P1]>0 then r[P2]=r[P1]+max(0,r[P3]) else r[P2]=(-1) */
14971	#define OP_AggInverse 154 /* synopsis: accum=r[P3] inverse(r[P2@P5]) */
14972	#define OP_AggStep 155 /* synopsis: accum=r[P3] step(r[P2@P5]) */
14973	#define OP_AggStep1 156 /* synopsis: accum=r[P3] step(r[P2@P5]) */
14974	#define OP_AggValue 157 /* synopsis: r[P3]=value N=P2 */
14975	#define OP_AggFinal 158 /* synopsis: accum=r[P1] N=P2 */
14976	#define OP_Expire 159
14977	#define OP_TableLock 160 /* synopsis: iDb=P1 root=P2 write=P3 */
14978	#define OP_VBegin 161
14979	#define OP_VCreate 162
14980	#define OP_VDestroy 163
14981	#define OP_VOpen 164
14982	#define OP_VColumn 165 /* synopsis: r[P3]=vcolumn(P2) */
14983	#define OP_VRename 166
14984	#define OP_Pagecount 167
14985	#define OP_MaxPgcnt 168
14986	#define OP_Trace 169
14987	#define OP_CursorHint 170
14988	#define OP_Noop 171
14989	#define OP_Explain 172
14990	#define OP_Abortable 173
14991
14992	/* Properties such as "out2" or "jump" that are specified in
14993	** comments following the "case" for each opcode in the vdbe.c
14994	** are encoded into bitvectors as follows:
14995	*/
	@@ -15014,16 +15013,16 @@
15014	/* 88 */ 0x12, 0x20, 0x00, 0x00, 0x26, 0x26, 0x26, 0x26,\
15015	/* 96 */ 0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x00, 0x12,\
15016	/* 104 */ 0x10, 0x10, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,\
15017	/* 112 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
15018	/* 120 */ 0x10, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
15019	/* 128 */ 0x00, 0x10, 0x00, 0x00, 0x04, 0x04, 0x00, 0x00,\
15020	/* 136 */ 0x10, 0x10, 0x00, 0x00, 0x10, 0x10, 0x00, 0x00,\
15021	/* 144 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x10, 0x00,\
15022	/* 152 */ 0x04, 0x1a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
15023	/* 160 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10,\
15024	/* 168 */ 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,}
15025
15026	/* The sqlite3P2Values() routine is able to run faster if it knows
15027	** the value of the largest JUMP opcode. The smaller the maximum
15028	** JUMP opcode the better, so the mkopcodeh.tcl script that
15029	** generated this include file strives to group all JUMP opcodes
	@@ -16324,10 +16323,11 @@
16324	int (xCommitCallback)(void); /* Invoked at every commit. */
16325	void pRollbackArg; / Argument to xRollbackCallback() */
16326	void (xRollbackCallback)(void); /* Invoked at every commit. */
16327	void *pUpdateArg;
16328	void (xUpdateCallback)(void,int, const char,const char,sqlite_int64);

16329	#ifdef SQLITE_ENABLE_PREUPDATE_HOOK
16330	void pPreUpdateArg; / First argument to xPreUpdateCallback */
16331	void (xPreUpdateCallback)( / Registered using sqlite3_preupdate_hook() */
16332	void,sqlite3,int,char const,char const,sqlite3_int64,sqlite3_int64
16333	);
	@@ -17987,10 +17987,11 @@
17987	TableLock aTableLock; / Required table locks for shared-cache mode */
17988	#endif
17989	AutoincInfo pAinc; / Information about AUTOINCREMENT counters */
17990	Parse pToplevel; / Parse structure for main program (or NULL) */
17991	Table pTriggerTab; / Table triggers are being coded for */

17992	int addrCrTab; /* Address of OP_CreateBtree opcode on CREATE TABLE */
17993	u32 nQueryLoop; /* Est number of iterations of a query (10log2(N)) /
17994	u32 oldmask; /* Mask of old.* columns referenced */
17995	u32 newmask; /* Mask of new.* columns referenced */
17996	u8 eTriggerOp; /* TK_UPDATE, TK_INSERT or TK_DELETE */
	@@ -19172,11 +19173,11 @@
19172	SQLITE_PRIVATE void sqlite3AlterRenameTable(Parse, SrcList, Token*);
19173	SQLITE_PRIVATE void sqlite3AlterRenameColumn(Parse, SrcList, Token, Token);
19174	SQLITE_PRIVATE int sqlite3GetToken(const unsigned char , int );
19175	SQLITE_PRIVATE void sqlite3NestedParse(Parse, const char, ...);
19176	SQLITE_PRIVATE void sqlite3ExpirePreparedStatements(sqlite3*, int);
19177	SQLITE_PRIVATE void sqlite3CodeRhsOfIN(Parse, Expr, int, int);
19178	SQLITE_PRIVATE int sqlite3CodeSubselect(Parse, Expr);
19179	SQLITE_PRIVATE void sqlite3SelectPrep(Parse, Select, NameContext*);
19180	SQLITE_PRIVATE void sqlite3SelectWrongNumTermsError(Parse pParse, Select p);
19181	SQLITE_PRIVATE int sqlite3MatchSpanName(const char, const char, const char, const char);
19182	SQLITE_PRIVATE int sqlite3ResolveExprNames(NameContext, Expr);
	@@ -27119,10 +27120,13 @@
27119	db->mallocFailed = 1;
27120	if( db->nVdbeExec>0 ){
27121	db->u1.isInterrupted = 1;
27122	}
27123	db->lookaside.bDisable++;



27124	}
27125	}
27126
27127	/*
27128	** This routine reactivates the memory allocator and clears the
	@@ -27312,11 +27316,11 @@
27312	** Set the StrAccum object to an error mode.
27313	*/
27314	static void setStrAccumError(StrAccum *p, u8 eError){
27315	assert( eError==SQLITE_NOMEM \|\| eError==SQLITE_TOOBIG );
27316	p->accError = eError;
27317	p->nAlloc = 0;
27318	}
27319
27320	/*
27321	** Extra argument values from a PrintfArguments object
27322	*/
	@@ -27342,10 +27346,11 @@
27342	** SQL from requesting large allocations using the precision or width
27343	** field of the printf() function.
27344	*/
27345	static char printfTempBuf(sqlite3_str pAccum, sqlite3_int64 n){
27346	char *z;

27347	if( n>pAccum->nAlloc && n>pAccum->mxAlloc ){
27348	setStrAccumError(pAccum, SQLITE_TOOBIG);
27349	return 0;
27350	}
27351	z = sqlite3DbMallocRaw(pAccum->db, n);
	@@ -28061,13 +28066,12 @@
28061	testcase(p->accError==SQLITE_TOOBIG);
28062	testcase(p->accError==SQLITE_NOMEM);
28063	return 0;
28064	}
28065	if( p->mxAlloc==0 ){
28066	N = p->nAlloc - p->nChar - 1;
28067	setStrAccumError(p, SQLITE_TOOBIG);
28068	return N;
28069	}else{
28070	char *zOld = isMalloced(p) ? p->zText : 0;
28071	i64 szNew = p->nChar;
28072	szNew += N + 1;
28073	if( szNew+p->nChar<=p->mxAlloc ){
	@@ -28135,11 +28139,11 @@
28135	*/
28136	SQLITE_API void sqlite3_str_append(sqlite3_str p, const char z, int N){
28137	assert( z!=0 \|\| N==0 );
28138	assert( p->zText!=0 \|\| p->nChar==0 \|\| p->accError );
28139	assert( N>=0 );
28140	assert( p->accError==0 \|\| p->nAlloc==0 );
28141	if( p->nChar+N >= p->nAlloc ){
28142	enlargeAndAppend(p,z,N);
28143	}else if( N ){
28144	assert( p->zText );
28145	p->nChar += N;
	@@ -32137,61 +32141,60 @@
32137	/* 118 */ "ColumnsUsed" OpHelp(""),
32138	/* 119 */ "SeekHit" OpHelp("seekHit=P2"),
32139	/* 120 */ "Sequence" OpHelp("r[P2]=cursor[P1].ctr++"),
32140	/* 121 */ "NewRowid" OpHelp("r[P2]=rowid"),
32141	/* 122 */ "Insert" OpHelp("intkey=r[P3] data=r[P2]"),
32142	/* 123 */ "InsertInt" OpHelp("intkey=P3 data=r[P2]"),
32143	/* 124 */ "Delete" OpHelp(""),
32144	/* 125 */ "ResetCount" OpHelp(""),
32145	/* 126 */ "SorterCompare" OpHelp("if key(P1)!=trim(r[P3],P4) goto P2"),
32146	/* 127 */ "SorterData" OpHelp("r[P2]=data"),
32147	/* 128 */ "RowData" OpHelp("r[P2]=data"),
32148	/* 129 */ "Rowid" OpHelp("r[P2]=rowid"),
32149	/* 130 */ "NullRow" OpHelp(""),
32150	/* 131 */ "SeekEnd" OpHelp(""),
32151	/* 132 */ "SorterInsert" OpHelp("key=r[P2]"),
32152	/* 133 */ "IdxInsert" OpHelp("key=r[P2]"),
32153	/* 134 */ "IdxDelete" OpHelp("key=r[P2@P3]"),
32154	/* 135 */ "DeferredSeek" OpHelp("Move P3 to P1.rowid if needed"),
32155	/* 136 */ "IdxRowid" OpHelp("r[P2]=rowid"),
32156	/* 137 */ "Destroy" OpHelp(""),
32157	/* 138 */ "Clear" OpHelp(""),
32158	/* 139 */ "ResetSorter" OpHelp(""),
32159	/* 140 */ "CreateBtree" OpHelp("r[P2]=root iDb=P1 flags=P3"),
32160	/* 141 */ "Real" OpHelp("r[P2]=P4"),
32161	/* 142 */ "SqlExec" OpHelp(""),
32162	/* 143 */ "ParseSchema" OpHelp(""),
32163	/* 144 */ "LoadAnalysis" OpHelp(""),
32164	/* 145 */ "DropTable" OpHelp(""),
32165	/* 146 */ "DropIndex" OpHelp(""),
32166	/* 147 */ "DropTrigger" OpHelp(""),
32167	/* 148 */ "IntegrityCk" OpHelp(""),
32168	/* 149 */ "RowSetAdd" OpHelp("rowset(P1)=r[P2]"),
32169	/* 150 */ "Param" OpHelp(""),
32170	/* 151 */ "FkCounter" OpHelp("fkctr[P1]+=P2"),
32171	/* 152 */ "MemMax" OpHelp("r[P1]=max(r[P1],r[P2])"),
32172	/* 153 */ "OffsetLimit" OpHelp("if r[P1]>0 then r[P2]=r[P1]+max(0,r[P3]) else r[P2]=(-1)"),
32173	/* 154 */ "AggInverse" OpHelp("accum=r[P3] inverse(r[P2@P5])"),
32174	/* 155 */ "AggStep" OpHelp("accum=r[P3] step(r[P2@P5])"),
32175	/* 156 */ "AggStep1" OpHelp("accum=r[P3] step(r[P2@P5])"),
32176	/* 157 */ "AggValue" OpHelp("r[P3]=value N=P2"),
32177	/* 158 */ "AggFinal" OpHelp("accum=r[P1] N=P2"),
32178	/* 159 */ "Expire" OpHelp(""),
32179	/* 160 */ "TableLock" OpHelp("iDb=P1 root=P2 write=P3"),
32180	/* 161 */ "VBegin" OpHelp(""),
32181	/* 162 */ "VCreate" OpHelp(""),
32182	/* 163 */ "VDestroy" OpHelp(""),
32183	/* 164 */ "VOpen" OpHelp(""),
32184	/* 165 */ "VColumn" OpHelp("r[P3]=vcolumn(P2)"),
32185	/* 166 */ "VRename" OpHelp(""),
32186	/* 167 */ "Pagecount" OpHelp(""),
32187	/* 168 */ "MaxPgcnt" OpHelp(""),
32188	/* 169 */ "Trace" OpHelp(""),
32189	/* 170 */ "CursorHint" OpHelp(""),
32190	/* 171 */ "Noop" OpHelp(""),
32191	/* 172 */ "Explain" OpHelp(""),
32192	/* 173 */ "Abortable" OpHelp(""),
32193	};
32194	return azName[i];
32195	}
32196	#endif
32197
	@@ -40217,10 +40220,13 @@
40217	static sqlite3_vfs aVfs[] = {
40218	#if SQLITE_ENABLE_LOCKING_STYLE && defined(__APPLE__)
40219	UNIXVFS("unix", autolockIoFinder ),
40220	#elif OS_VXWORKS
40221	UNIXVFS("unix", vxworksIoFinder ),



40222	#else
40223	UNIXVFS("unix", posixIoFinder ),
40224	#endif
40225	UNIXVFS("unix-none", nolockIoFinder ),
40226	UNIXVFS("unix-dotfile", dotlockIoFinder ),
	@@ -58162,11 +58168,11 @@
58162	** Release a lock obtained by an earlier successful call to
58163	** sqlite3PagerSnapshotCheck().
58164	*/
58165	SQLITE_PRIVATE void sqlite3PagerSnapshotUnlock(Pager *pPager){
58166	assert( pPager->pWal );
58167	return sqlite3WalSnapshotUnlock(pPager->pWal);
58168	}
58169
58170	#endif /* SQLITE_ENABLE_SNAPSHOT */
58171	#endif /* !SQLITE_OMIT_WAL */
58172
	@@ -62338,11 +62344,11 @@
62338	u8 max1bytePayload; /* min(maxLocal,127) */
62339	u8 nOverflow; /* Number of overflow cell bodies in aCell[] */
62340	u16 maxLocal; /* Copy of BtShared.maxLocal or BtShared.maxLeaf */
62341	u16 minLocal; /* Copy of BtShared.minLocal or BtShared.minLeaf */
62342	u16 cellOffset; /* Index in aData of first cell pointer */
62343	u16 nFree; /* Number of free bytes on the page */
62344	u16 nCell; /* Number of cells on this page, local and ovfl */
62345	u16 maskPage; /* Mask for page offset */
62346	u16 aiOvfl[4]; /* Insert the i-th overflow cell before the aiOvfl-th
62347	** non-overflow cell */
62348	u8 apOvfl[4]; / Pointers to the body of overflow cells */
	@@ -64492,12 +64498,12 @@
64492	** offsets to each pointer in the cell-pointer array than it is to
64493	** reconstruct the entire page. */
64494	if( (int)data[hdr+7]<=nMaxFrag ){
64495	int iFree = get2byte(&data[hdr+1]);
64496
64497	/* If the initial freeblock offset were out of bounds, that would
64498	** have been detected by btreeInitPage() when it was computing the
64499	** number of free bytes on the page. */
64500	assert( iFree<=usableSize-4 );
64501	if( iFree ){
64502	int iFree2 = get2byte(&data[iFree]);
64503	if( iFree2>usableSize-4 ) return SQLITE_CORRUPT_PAGE(pPage);
	@@ -64565,10 +64571,11 @@
64565	memcpy(&data[cbrk], &src[pc], size);
64566	}
64567	data[hdr+7] = 0;
64568
64569	defragment_out:

64570	if( data[hdr+7]+cbrk-iCellFirst!=pPage->nFree ){
64571	return SQLITE_CORRUPT_PAGE(pPage);
64572	}
64573	assert( cbrk>=iCellFirst );
64574	put2byte(&data[hdr+5], cbrk);
	@@ -64592,54 +64599,61 @@
64592	** Slots on the free list that are between 1 and 3 bytes larger than nByte
64593	** will be ignored if adding the extra space to the fragmentation count
64594	** causes the fragmentation count to exceed 60.
64595	*/
64596	static u8 pageFindSlot(MemPage pPg, int nByte, int *pRc){
64597	const int hdr = pPg->hdrOffset;
64598	u8 * const aData = pPg->aData;
64599	int iAddr = hdr + 1;
64600	int pc = get2byte(&aData[iAddr]);
64601	int x;
64602	int usableSize = pPg->pBt->usableSize;
64603	int size; /* Size of the free slot */
64604
64605	assert( pc>0 );
64606	while( pc<=usableSize-4 ){
64607	/* EVIDENCE-OF: R-22710-53328 The third and fourth bytes of each
64608	** freeblock form a big-endian integer which is the size of the freeblock
64609	** in bytes, including the 4-byte header. */
64610	size = get2byte(&aData[pc+2]);
64611	if( (x = size - nByte)>=0 ){
64612	testcase( x==4 );
64613	testcase( x==3 );
64614	if( size+pc > usableSize ){
64615	*pRc = SQLITE_CORRUPT_PAGE(pPg);
64616	return 0;
64617	}else if( x<4 ){
64618	/* EVIDENCE-OF: R-11498-58022 In a well-formed b-tree page, the total
64619	** number of bytes in fragments may not exceed 60. */
64620	if( aData[hdr+7]>57 ) return 0;
64621
64622	/* Remove the slot from the free-list. Update the number of
64623	** fragmented bytes within the page. */
64624	memcpy(&aData[iAddr], &aData[pc], 2);
64625	aData[hdr+7] += (u8)x;




64626	}else{
64627	/* The slot remains on the free-list. Reduce its size to account
64628	** for the portion used by the new allocation. */
64629	put2byte(&aData[pc+2], x);
64630	}
64631	return &aData[pc + x];
64632	}
64633	iAddr = pc;
64634	pc = get2byte(&aData[pc]);
64635	if( pc<iAddr+size ) break;






64636	}
64637	if( pc ){

64638	*pRc = SQLITE_CORRUPT_PAGE(pPg);
64639	}
64640
64641	return 0;
64642	}
64643
64644	/*
64645	** Allocate nByte bytes of space from within the B-Tree page passed
	@@ -64685,13 +64699,13 @@
64685	}else{
64686	return SQLITE_CORRUPT_PAGE(pPage);
64687	}
64688	}
64689
64690	/* If there is enough space between gap and top for one more cell pointer
64691	** array entry offset, and if the freelist is not empty, then search the
64692	** freelist looking for a free slot big enough to satisfy the request.
64693	*/
64694	testcase( gap+2==top );
64695	testcase( gap+1==top );
64696	testcase( gap==top );
64697	if( (data[hdr+2] \|\| data[hdr+1]) && gap+2<=top ){
	@@ -64709,19 +64723,20 @@
64709	** to see if defragmentation is necessary.
64710	*/
64711	testcase( gap+2+nByte==top );
64712	if( gap+2+nByte>top ){
64713	assert( pPage->nCell>0 \|\| CORRUPT_DB );

64714	rc = defragmentPage(pPage, MIN(4, pPage->nFree - (2+nByte)));
64715	if( rc ) return rc;
64716	top = get2byteNotZero(&data[hdr+5]);
64717	assert( gap+2+nByte<=top );
64718	}
64719
64720
64721	/* Allocate memory from the gap in between the cell pointer array
64722	** and the cell content area. The btreeInitPage() call has already
64723	** validated the freelist. Given that the freelist is valid, there
64724	** is no way that the allocation can extend off the end of the page.
64725	** The assert() below verifies the previous sentence.
64726	*/
64727	top -= nByte;
	@@ -64736,11 +64751,11 @@
64736	** The first byte of the new free block is pPage->aData[iStart]
64737	** and the size of the block is iSize bytes.
64738	**
64739	** Adjacent freeblocks are coalesced.
64740	**
64741	** Note that even though the freeblock list was checked by btreeInitPage(),
64742	** that routine will not detect overlap between cells or freeblocks. Nor
64743	** does it detect cells or freeblocks that encrouch into the reserved bytes
64744	** at the end of the page. So do additional corruption checks inside this
64745	** routine and return SQLITE_CORRUPT if any problems are found.
64746	*/
	@@ -64898,25 +64913,18 @@
64898	pPage->max1bytePayload = pBt->max1bytePayload;
64899	return SQLITE_OK;
64900	}
64901
64902	/*
64903	** Initialize the auxiliary information for a disk block.
64904	**
64905	** Return SQLITE_OK on success. If we see that the page does
64906	** not contain a well-formed database page, then return
64907	** SQLITE_CORRUPT. Note that a return of SQLITE_OK does not
64908	** guarantee that the page is well-formed. It only shows that
64909	** we failed to detect any corruption.
64910	*/
64911	static int btreeInitPage(MemPage *pPage){
64912	int pc; /* Address of a freeblock within pPage->aData[] */
64913	u8 hdr; /* Offset to beginning of page header */
64914	u8 data; / Equal to pPage->aData */
64915	BtShared pBt; / The main btree structure */
64916	int usableSize; /* Amount of usable space on each page */
64917	u16 cellOffset; /* Offset from start of page to first cell pointer */
64918	int nFree; /* Number of unused bytes on the page */
64919	int top; /* First byte of the cell content area */
64920	int iCellFirst; /* First allowable cell or freeblock offset */
64921	int iCellLast; /* Last possible cell or freeblock offset */
64922
	@@ -64924,75 +64932,22 @@
64924	assert( pPage->pBt->db!=0 );
64925	assert( sqlite3_mutex_held(pPage->pBt->mutex) );
64926	assert( pPage->pgno==sqlite3PagerPagenumber(pPage->pDbPage) );
64927	assert( pPage == sqlite3PagerGetExtra(pPage->pDbPage) );
64928	assert( pPage->aData == sqlite3PagerGetData(pPage->pDbPage) );
64929	assert( pPage->isInit==0 );

64930
64931	pBt = pPage->pBt;
64932	hdr = pPage->hdrOffset;
64933	data = pPage->aData;
64934	/* EVIDENCE-OF: R-28594-02890 The one-byte flag at offset 0 indicating
64935	** the b-tree page type. */
64936	if( decodeFlags(pPage, data[hdr]) ){
64937	return SQLITE_CORRUPT_PAGE(pPage);
64938	}
64939	assert( pBt->pageSize>=512 && pBt->pageSize<=65536 );
64940	pPage->maskPage = (u16)(pBt->pageSize - 1);
64941	pPage->nOverflow = 0;
64942	usableSize = pBt->usableSize;
64943	pPage->cellOffset = cellOffset = hdr + 8 + pPage->childPtrSize;
64944	pPage->aDataEnd = &data[usableSize];
64945	pPage->aCellIdx = &data[cellOffset];
64946	pPage->aDataOfst = &data[pPage->childPtrSize];
64947	/* EVIDENCE-OF: R-58015-48175 The two-byte integer at offset 5 designates
64948	** the start of the cell content area. A zero value for this integer is
64949	** interpreted as 65536. */
64950	top = get2byteNotZero(&data[hdr+5]);
64951	/* EVIDENCE-OF: R-37002-32774 The two-byte integer at offset 3 gives the
64952	** number of cells on the page. */
64953	pPage->nCell = get2byte(&data[hdr+3]);
64954	if( pPage->nCell>MX_CELL(pBt) ){
64955	/* To many cells for a single page. The page must be corrupt */
64956	return SQLITE_CORRUPT_PAGE(pPage);
64957	}
64958	testcase( pPage->nCell==MX_CELL(pBt) );
64959	/* EVIDENCE-OF: R-24089-57979 If a page contains no cells (which is only
64960	** possible for a root page of a table that contains no rows) then the
64961	** offset to the cell content area will equal the page size minus the
64962	** bytes of reserved space. */
64963	assert( pPage->nCell>0 \|\| top==usableSize \|\| CORRUPT_DB );
64964
64965	/* A malformed database page might cause us to read past the end
64966	** of page when parsing a cell.
64967	**
64968	** The following block of code checks early to see if a cell extends
64969	** past the end of a page boundary and causes SQLITE_CORRUPT to be
64970	** returned if it does.
64971	*/
64972	iCellFirst = cellOffset + 2*pPage->nCell;
64973	iCellLast = usableSize - 4;
64974	if( pBt->db->flags & SQLITE_CellSizeCk ){
64975	int i; /* Index into the cell pointer array */
64976	int sz; /* Size of a cell */
64977
64978	if( !pPage->leaf ) iCellLast--;
64979	for(i=0; i<pPage->nCell; i++){
64980	pc = get2byteAligned(&data[cellOffset+i*2]);
64981	testcase( pc==iCellFirst );
64982	testcase( pc==iCellLast );
64983	if( pc<iCellFirst \|\| pc>iCellLast ){
64984	return SQLITE_CORRUPT_PAGE(pPage);
64985	}
64986	sz = pPage->xCellSize(pPage, &data[pc]);
64987	testcase( pc+sz==usableSize );
64988	if( pc+sz>usableSize ){
64989	return SQLITE_CORRUPT_PAGE(pPage);
64990	}
64991	}
64992	if( !pPage->leaf ) iCellLast++;
64993	}
64994
64995	/* Compute the total free space on the page
64996	** EVIDENCE-OF: R-23588-34450 The two-byte integer at offset 1 gives the
64997	** start of the first freeblock on the page, or is zero if there are no
64998	** freeblocks. */
	@@ -65036,11 +64991,104 @@
65036	*/
65037	if( nFree>usableSize ){
65038	return SQLITE_CORRUPT_PAGE(pPage);
65039	}
65040	pPage->nFree = (u16)(nFree - iCellFirst);


























































































65041	pPage->isInit = 1;



65042	return SQLITE_OK;
65043	}
65044
65045	/*
65046	** Set up a raw page so that it looks like a database page holding
	@@ -65179,38 +65227,38 @@
65179	assert( pCur==0 \|\| bReadOnly==pCur->curPagerFlags );
65180	assert( pCur==0 \|\| pCur->iPage>0 );
65181
65182	if( pgno>btreePagecount(pBt) ){
65183	rc = SQLITE_CORRUPT_BKPT;
65184	goto getAndInitPage_error;
65185	}
65186	rc = sqlite3PagerGet(pBt->pPager, pgno, (DbPage**)&pDbPage, bReadOnly);
65187	if( rc ){
65188	goto getAndInitPage_error;
65189	}
65190	ppPage = (MemPage)sqlite3PagerGetExtra(pDbPage);
65191	if( (*ppPage)->isInit==0 ){
65192	btreePageFromDbPage(pDbPage, pgno, pBt);
65193	rc = btreeInitPage(*ppPage);
65194	if( rc!=SQLITE_OK ){
65195	releasePage(*ppPage);
65196	goto getAndInitPage_error;
65197	}
65198	}
65199	assert( (*ppPage)->pgno==pgno );
65200	assert( (*ppPage)->aData==sqlite3PagerGetData(pDbPage) );
65201
65202	/* If obtaining a child page for a cursor, we must verify that the page is
65203	** compatible with the root page. */
65204	if( pCur && ((ppPage)->nCell<1 \|\| (ppPage)->intKey!=pCur->curIntKey) ){
65205	rc = SQLITE_CORRUPT_PGNO(pgno);
65206	releasePage(*ppPage);
65207	goto getAndInitPage_error;
65208	}
65209	return SQLITE_OK;
65210
65211	getAndInitPage_error:


65212	if( pCur ){
65213	pCur->iPage--;
65214	pCur->pPage = pCur->apPage[pCur->iPage];
65215	}
65216	testcase( pgno==0 );
	@@ -69618,10 +69666,11 @@
69618	if( *pRC ) return;
69619	assert( idx>=0 && idx<pPage->nCell );
69620	assert( CORRUPT_DB \|\| sz==cellSize(pPage, idx) );
69621	assert( sqlite3PagerIswriteable(pPage->pDbPage) );
69622	assert( sqlite3_mutex_held(pPage->pBt->mutex) );

69623	data = pPage->aData;
69624	ptr = &pPage->aCellIdx[2*idx];
69625	pc = get2byte(ptr);
69626	hdr = pPage->hdrOffset;
69627	testcase( pc==get2byte(&data[hdr+5]) );
	@@ -69688,10 +69737,11 @@
69688	** malformed cell from a leaf page to an interior page, if the cell size
69689	** wanted to be less than 4 but got rounded up to 4 on the leaf, then size
69690	** might be less than 8 (leaf-size + pointer) on the interior node. Hence
69691	** the term after the \|\| in the following assert(). */
69692	assert( sz==pPage->xCellSize(pPage, pCell) \|\| (sz==8 && iChild>0) );

69693	if( pPage->nOverflow \|\| sz+2>pPage->nFree ){
69694	if( pTemp ){
69695	memcpy(pTemp, pCell, sz);
69696	pCell = pTemp;
69697	}
	@@ -69745,11 +69795,11 @@
69745	memmove(pIns+2, pIns, 2*(pPage->nCell - i));
69746	put2byte(pIns, idx);
69747	pPage->nCell++;
69748	/* increment the cell count */
69749	if( (++data[pPage->hdrOffset+4])==0 ) data[pPage->hdrOffset+3]++;
69750	assert( get2byte(&data[pPage->hdrOffset+3])==pPage->nCell );
69751	#ifndef SQLITE_OMIT_AUTOVACUUM
69752	if( pPage->pBt->autoVacuum ){
69753	/* The cell may contain a pointer to an overflow page. If so, write
69754	** the entry for the overflow page into the pointer map.
69755	*/
	@@ -69832,12 +69882,17 @@
69832	**
69833	** For a table-btree, the concept is similar, except only apEnd[0]..apEnd[2]
69834	** are used and they point to the leaf pages only, and the ixNx value are:
69835	**
69836	** ixNx[0] = Number of cells in Child-1.
69837	** ixNx[1] = Number of cells in Child-1 and Child-2 + 1 for 1st divider.
69838	** ixNx[2] = Number of cells in Child-1 and Child-2 + both divider cells





69839	*/
69840	typedef struct CellArray CellArray;
69841	struct CellArray {
69842	int nCell; /* Number of cells in apCell[] */
69843	MemPage pRef; / Reference page */
	@@ -70239,12 +70294,14 @@
70239	Pgno pgnoNew; /* Page number of pNew */
70240
70241	assert( sqlite3_mutex_held(pPage->pBt->mutex) );
70242	assert( sqlite3PagerIswriteable(pParent->pDbPage) );
70243	assert( pPage->nOverflow==1 );
70244
70245	if( pPage->nCell==0 ) return SQLITE_CORRUPT_BKPT; /* dbfuzz001.test */


70246
70247	/* Allocate a new page. This page will become the right-sibling of
70248	** pPage. Make the parent page writable, so that the new divider cell
70249	** may be inserted. If both these operations are successful, proceed.
70250	*/
	@@ -70410,10 +70467,11 @@
70410	** fairly obscure circumstances, even though it is a copy of initialized
70411	** page pFrom.
70412	*/
70413	pTo->isInit = 0;
70414	rc = btreeInitPage(pTo);

70415	if( rc!=SQLITE_OK ){
70416	*pRC = rc;
70417	return;
70418	}
70419
	@@ -70518,10 +70576,11 @@
70518	assert( pParent->nOverflow==0 \|\| pParent->aiOvfl[0]==iParentIdx );
70519
70520	if( !aOvflSpace ){
70521	return SQLITE_NOMEM_BKPT;
70522	}

70523
70524	/* Find the sibling pages to balance. Also locate the cells in pParent
70525	** that divide the siblings. An attempt is made to find NN siblings on
70526	** either side of pPage. More siblings are taken from one side, however,
70527	** if there are fewer than NN siblings on the other side. If pParent
	@@ -70556,10 +70615,17 @@
70556	while( 1 ){
70557	rc = getAndInitPage(pBt, pgno, &apOld[i], 0, 0);
70558	if( rc ){
70559	memset(apOld, 0, (i+1)sizeof(MemPage));
70560	goto balance_cleanup;







70561	}
70562	nMaxCells += 1+apOld[i]->nCell+apOld[i]->nOverflow;
70563	if( (i--)==0 ) break;
70564
70565	if( pParent->nOverflow && i+nxDiv==pParent->aiOvfl[0] ){
	@@ -70751,15 +70817,19 @@
70751	usableSpace = pBt->usableSize - 12 + leafCorrection;
70752	for(i=k=0; i<nOld; i++, k++){
70753	MemPage *p = apOld[i];
70754	b.apEnd[k] = p->aDataEnd;
70755	b.ixNx[k] = cntOld[i];



70756	if( !leafData ){
70757	k++;
70758	b.apEnd[k] = pParent->aDataEnd;
70759	b.ixNx[k] = cntOld[i]+1;
70760	}

70761	szNew[i] = usableSpace - p->nFree;
70762	for(j=0; j<p->nOverflow; j++){
70763	szNew[i] += 2 + p->xCellSize(p, p->apOvfl[j]);
70764	}
70765	cntNew[i] = cntOld[i];
	@@ -70981,22 +71051,21 @@
70981	** populated, not here.
70982	*/
70983	if( ISAUTOVACUUM ){
70984	MemPage *pOld;
70985	MemPage *pNew = pOld = apNew[0];
70986	u8 *aOld = pNew->aData;
70987	int cntOldNext = pNew->nCell + pNew->nOverflow;
70988	int usableSize = pBt->usableSize;
70989	int iNew = 0;
70990	int iOld = 0;
70991
70992	for(i=0; i<b.nCell; i++){
70993	u8 *pCell = b.apCell[i];
70994	if( i==cntOldNext ){
70995	pOld = (++iOld)<nNew ? apNew[iOld] : apOld[iOld];


70996	cntOldNext += pOld->nCell + pOld->nOverflow + !leafData;
70997	aOld = pOld->aData;
70998	}
70999	if( i==cntNew[iNew] ){
71000	pNew = apNew[++iNew];
71001	if( !leafData ) continue;
71002	}
	@@ -71007,11 +71076,11 @@
71007	** if sibling page iOld had the same page number as pNew, and if
71008	** pCell really was a part of sibling page iOld (not a divider or
71009	** overflow cell), we can skip updating the pointer map entries. */
71010	if( iOld>=nNew
71011	\|\| pNew->pgno!=aPgno[iOld]
71012	\|\| !SQLITE_WITHIN(pCell,aOld,&aOld[usableSize])
71013	){
71014	if( !leafCorrection ){
71015	ptrmapPut(pBt, get4byte(pCell), PTRMAP_BTREE, pNew->pgno, &rc);
71016	}
71017	if( cachedCellSize(&b,i)>pNew->minLocal ){
	@@ -71257,11 +71326,11 @@
71257	releasePage(pChild);
71258	return rc;
71259	}
71260	assert( sqlite3PagerIswriteable(pChild->pDbPage) );
71261	assert( sqlite3PagerIswriteable(pRoot->pDbPage) );
71262	assert( pChild->nCell==pRoot->nCell );
71263
71264	TRACE(("BALANCE: copy root %d into %d\n", pRoot->pgno, pChild->pgno));
71265
71266	/* Copy the overflow cells from pRoot to pChild */
71267	memcpy(pChild->aiOvfl, pRoot->aiOvfl,
	@@ -71299,10 +71368,11 @@
71299
71300	do {
71301	int iPage = pCur->iPage;
71302	MemPage *pPage = pCur->pPage;
71303

71304	if( iPage==0 ){
71305	if( pPage->nOverflow ){
71306	/* The root page of the b-tree is overfull. In this case call the
71307	** balance_deeper() function to create a new child for the root-page
71308	** and copy the current contents of the root-page to it. The
	@@ -71327,10 +71397,13 @@
71327	}else{
71328	MemPage * const pParent = pCur->apPage[iPage-1];
71329	int const iIdx = pCur->aiIdx[iPage-1];
71330
71331	rc = sqlite3PagerWrite(pParent->pDbPage);



71332	if( rc==SQLITE_OK ){
71333	#ifndef SQLITE_OMIT_QUICKBALANCE
71334	if( pPage->intKeyLeaf
71335	&& pPage->nOverflow==1
71336	&& pPage->aiOvfl[0]==pPage->nCell
	@@ -71673,10 +71746,14 @@
71673	assert( pCur->eState==CURSOR_VALID \|\| (pCur->eState==CURSOR_INVALID && loc) );
71674
71675	pPage = pCur->pPage;
71676	assert( pPage->intKey \|\| pX->nKey>=0 );
71677	assert( pPage->leaf \|\| !pPage->intKey );




71678
71679	TRACE(("INSERT: table=%d nkey=%lld ndata=%d page=%d %s\n",
71680	pCur->pgnoRoot, pX->nKey, pX->nData, pPage->pgno,
71681	loc==0 ? "overwrite" : "new entry"));
71682	assert( pPage->isInit );
	@@ -71823,10 +71900,11 @@
71823
71824	iCellDepth = pCur->iPage;
71825	iCellIdx = pCur->ix;
71826	pPage = pCur->pPage;
71827	pCell = findCell(pPage, iCellIdx);

71828
71829	/* If the bPreserve flag is set to true, then the cursor position must
71830	** be preserved following this delete operation. If the current delete
71831	** will cause a b-tree rebalance, then this is done by saving the cursor
71832	** key and leaving the cursor in CURSOR_REQUIRESEEK state before
	@@ -71893,10 +71971,14 @@
71893	MemPage *pLeaf = pCur->pPage;
71894	int nCell;
71895	Pgno n;
71896	unsigned char *pTmp;
71897




71898	if( iCellDepth<pCur->iPage-1 ){
71899	n = pCur->apPage[iCellDepth+1]->pgno;
71900	}else{
71901	n = pCur->pPage->pgno;
71902	}
	@@ -72784,10 +72866,15 @@
72784	assert( rc==SQLITE_CORRUPT ); /* The only possible error from InitPage */
72785	checkAppendMsg(pCheck,
72786	"btreeInitPage() returns error code %d", rc);
72787	goto end_of_check;
72788	}





72789	data = pPage->aData;
72790	hdr = pPage->hdrOffset;
72791
72792	/* Set up for cell analysis */
72793	pCheck->zPfx = "On tree page %d cell %d: ";
	@@ -72916,23 +73003,23 @@
72916	** freeblocks on the page.
72917	*/
72918	i = get2byte(&data[hdr+1]);
72919	while( i>0 ){
72920	int size, j;
72921	assert( (u32)i<=usableSize-4 ); /* Enforced by btreeInitPage() */
72922	size = get2byte(&data[i+2]);
72923	assert( (u32)(i+size)<=usableSize ); /* Enforced by btreeInitPage() */
72924	btreeHeapInsert(heap, (((u32)i)<<16)\|(i+size-1));
72925	/* EVIDENCE-OF: R-58208-19414 The first 2 bytes of a freeblock are a
72926	** big-endian integer which is the offset in the b-tree page of the next
72927	** freeblock in the chain, or zero if the freeblock is the last on the
72928	** chain. */
72929	j = get2byte(&data[i]);
72930	/* EVIDENCE-OF: R-06866-39125 Freeblocks are always connected in order of
72931	** increasing offset. */
72932	assert( j==0 \|\| j>i+size ); /* Enforced by btreeInitPage() */
72933	assert( (u32)j<=usableSize-4 ); /* Enforced by btreeInitPage() */
72934	i = j;
72935	}
72936	/* Analyze the min-heap looking for overlap between cells and/or
72937	** freeblocks, and counting the number of untracked bytes in nFrag.
72938	**
	@@ -74393,12 +74480,11 @@
74393	return rc;
74394	#endif
74395	}
74396
74397	/*
74398	** Make sure pMem->z points to a writable allocation of at least
74399	** min(n,32) bytes.
74400	**
74401	** If the bPreserve argument is true, then copy of the content of
74402	** pMem->z into the new allocation. pMem must be either a string or
74403	** blob if bPreserve is true. If bPreserve is false, any prior content
74404	** in pMem->z is discarded.
	@@ -74413,11 +74499,10 @@
74413	assert( bPreserve==0 \|\| pMem->flags&(MEM_Blob\|MEM_Str) );
74414	testcase( bPreserve && pMem->z==0 );
74415
74416	assert( pMem->szMalloc==0
74417	\|\| pMem->szMalloc==sqlite3DbMallocSize(pMem->db, pMem->zMalloc) );
74418	if( n<32 ) n = 32;
74419	if( pMem->szMalloc>0 && bPreserve && pMem->z==pMem->zMalloc ){
74420	pMem->z = pMem->zMalloc = sqlite3DbReallocOrFree(pMem->db, pMem->z, n);
74421	bPreserve = 0;
74422	}else{
74423	if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
	@@ -75262,11 +75347,10 @@
75262	flags = (enc==0?MEM_Blob:MEM_Str);
75263	if( nByte<0 ){
75264	assert( enc!=0 );
75265	if( enc==SQLITE_UTF8 ){
75266	nByte = 0x7fffffff & (int)strlen(z);
75267	if( nByte>iLimit ) nByte = iLimit+1;
75268	}else{
75269	for(nByte=0; nByte<=iLimit && (z[nByte] \| z[nByte+1]); nByte+=2){}
75270	}
75271	flags \|= MEM_Term;
75272	}
	@@ -75274,33 +75358,34 @@
75274	/* The following block sets the new values of Mem.z and Mem.xDel. It
75275	** also sets a flag in local variable "flags" to indicate the memory
75276	** management (one of MEM_Dyn or MEM_Static).
75277	*/
75278	if( xDel==SQLITE_TRANSIENT ){
75279	int nAlloc = nByte;
75280	if( flags&MEM_Term ){
75281	nAlloc += (enc==SQLITE_UTF8?1:2);
75282	}
75283	if( nByte>iLimit ){
75284	return SQLITE_TOOBIG;
75285	}
75286	testcase( nAlloc==0 );
75287	testcase( nAlloc==31 );
75288	testcase( nAlloc==32 );
75289	if( sqlite3VdbeMemClearAndResize(pMem, MAX(nAlloc,32)) ){
75290	return SQLITE_NOMEM_BKPT;
75291	}
75292	memcpy(pMem->z, z, nAlloc);
75293	}else if( xDel==SQLITE_DYNAMIC ){
75294	sqlite3VdbeMemRelease(pMem);
75295	pMem->zMalloc = pMem->z = (char *)z;
75296	pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
75297	}else{
75298	sqlite3VdbeMemRelease(pMem);
75299	pMem->z = (char *)z;
75300	pMem->xDel = xDel;
75301	flags \|= ((xDel==SQLITE_STATIC)?MEM_Static:MEM_Dyn);





75302	}
75303
75304	pMem->n = nByte;
75305	pMem->flags = flags;
75306	pMem->enc = (enc==0 ? SQLITE_UTF8 : enc);
	@@ -82206,14 +82291,14 @@
82206	**
82207	** If the result is not a simple column reference (if it is an expression
82208	** or a constant) then useTypes 2, 3, and 4 return NULL.
82209	*/
82210	static const void *columnName(
82211	sqlite3_stmt *pStmt,
82212	int N,
82213	const void (xFunc)(Mem*),
82214	int useType
82215	){
82216	const void *ret;
82217	Vdbe *p;
82218	int n;
82219	sqlite3 *db;
	@@ -82230,12 +82315,16 @@
82230	n = sqlite3_column_count(pStmt);
82231	if( N<n && N>=0 ){
82232	N += useType*n;
82233	sqlite3_mutex_enter(db->mutex);
82234	assert( db->mallocFailed==0 );
82235	ret = xFunc(&p->aColName[N]);
82236	/* A malloc may have failed inside of the xFunc() call. If this




82237	** is the case, clear the mallocFailed flag and return NULL.
82238	*/
82239	if( db->mallocFailed ){
82240	sqlite3OomClear(db);
82241	ret = 0;
	@@ -82248,17 +82337,15 @@
82248	/*
82249	** Return the name of the Nth column of the result set returned by SQL
82250	** statement pStmt.
82251	*/
82252	SQLITE_API const char sqlite3_column_name(sqlite3_stmt pStmt, int N){
82253	return columnName(
82254	pStmt, N, (const void()(Mem*))sqlite3_value_text, COLNAME_NAME);
82255	}
82256	#ifndef SQLITE_OMIT_UTF16
82257	SQLITE_API const void sqlite3_column_name16(sqlite3_stmt pStmt, int N){
82258	return columnName(
82259	pStmt, N, (const void()(Mem*))sqlite3_value_text16, COLNAME_NAME);
82260	}
82261	#endif
82262
82263	/*
82264	** Constraint: If you have ENABLE_COLUMN_METADATA then you must
	@@ -82273,17 +82360,15 @@
82273	/*
82274	** Return the column declaration type (if applicable) of the 'i'th column
82275	** of the result set of SQL statement pStmt.
82276	*/
82277	SQLITE_API const char sqlite3_column_decltype(sqlite3_stmt pStmt, int N){
82278	return columnName(
82279	pStmt, N, (const void()(Mem*))sqlite3_value_text, COLNAME_DECLTYPE);
82280	}
82281	#ifndef SQLITE_OMIT_UTF16
82282	SQLITE_API const void sqlite3_column_decltype16(sqlite3_stmt pStmt, int N){
82283	return columnName(
82284	pStmt, N, (const void()(Mem*))sqlite3_value_text16, COLNAME_DECLTYPE);
82285	}
82286	#endif /* SQLITE_OMIT_UTF16 */
82287	#endif /* SQLITE_OMIT_DECLTYPE */
82288
82289	#ifdef SQLITE_ENABLE_COLUMN_METADATA
	@@ -82291,49 +82376,43 @@
82291	** Return the name of the database from which a result column derives.
82292	** NULL is returned if the result column is an expression or constant or
82293	** anything else which is not an unambiguous reference to a database column.
82294	*/
82295	SQLITE_API const char sqlite3_column_database_name(sqlite3_stmt pStmt, int N){
82296	return columnName(
82297	pStmt, N, (const void()(Mem*))sqlite3_value_text, COLNAME_DATABASE);
82298	}
82299	#ifndef SQLITE_OMIT_UTF16
82300	SQLITE_API const void sqlite3_column_database_name16(sqlite3_stmt pStmt, int N){
82301	return columnName(
82302	pStmt, N, (const void()(Mem*))sqlite3_value_text16, COLNAME_DATABASE);
82303	}
82304	#endif /* SQLITE_OMIT_UTF16 */
82305
82306	/*
82307	** Return the name of the table from which a result column derives.
82308	** NULL is returned if the result column is an expression or constant or
82309	** anything else which is not an unambiguous reference to a database column.
82310	*/
82311	SQLITE_API const char sqlite3_column_table_name(sqlite3_stmt pStmt, int N){
82312	return columnName(
82313	pStmt, N, (const void()(Mem*))sqlite3_value_text, COLNAME_TABLE);
82314	}
82315	#ifndef SQLITE_OMIT_UTF16
82316	SQLITE_API const void sqlite3_column_table_name16(sqlite3_stmt pStmt, int N){
82317	return columnName(
82318	pStmt, N, (const void()(Mem*))sqlite3_value_text16, COLNAME_TABLE);
82319	}
82320	#endif /* SQLITE_OMIT_UTF16 */
82321
82322	/*
82323	** Return the name of the table column from which a result column derives.
82324	** NULL is returned if the result column is an expression or constant or
82325	** anything else which is not an unambiguous reference to a database column.
82326	*/
82327	SQLITE_API const char sqlite3_column_origin_name(sqlite3_stmt pStmt, int N){
82328	return columnName(
82329	pStmt, N, (const void()(Mem*))sqlite3_value_text, COLNAME_COLUMN);
82330	}
82331	#ifndef SQLITE_OMIT_UTF16
82332	SQLITE_API const void sqlite3_column_origin_name16(sqlite3_stmt pStmt, int N){
82333	return columnName(
82334	pStmt, N, (const void()(Mem*))sqlite3_value_text16, COLNAME_COLUMN);
82335	}
82336	#endif /* SQLITE_OMIT_UTF16 */
82337	#endif /* SQLITE_ENABLE_COLUMN_METADATA */
82338
82339
	@@ -83975,10 +84054,19 @@
83975	#endif
83976	/* INSERT STACK UNION HERE */
83977
83978	assert( p->magic==VDBE_MAGIC_RUN ); /* sqlite3_step() verifies this */
83979	sqlite3VdbeEnter(p);









83980	if( p->rc==SQLITE_NOMEM ){
83981	/* This happens if a malloc() inside a call to sqlite3_column_text() or
83982	** sqlite3_column_text16() failed. */
83983	goto no_mem;
83984	}
	@@ -83988,19 +84076,10 @@
83988	assert( p->explain==0 );
83989	p->pResultSet = 0;
83990	db->busyHandler.nBusy = 0;
83991	if( db->u1.isInterrupted ) goto abort_due_to_interrupt;
83992	sqlite3VdbeIOTraceSql(p);
83993	#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
83994	if( db->xProgress ){
83995	u32 iPrior = p->aCounter[SQLITE_STMTSTATUS_VM_STEP];
83996	assert( 0 < db->nProgressOps );
83997	nProgressLimit = db->nProgressOps - (iPrior % db->nProgressOps);
83998	}else{
83999	nProgressLimit = 0xffffffff;
84000	}
84001	#endif
84002	#ifdef SQLITE_DEBUG
84003	sqlite3BeginBenignMalloc();
84004	if( p->pc==0
84005	&& (p->db->flags & (SQLITE_VdbeListing\|SQLITE_VdbeEQP\|SQLITE_VdbeTrace))!=0
84006	){
	@@ -84172,14 +84251,15 @@
84172	** of VDBE ops have been executed (either since this invocation of
84173	** sqlite3VdbeExec() or since last time the progress callback was called).
84174	** If the progress callback returns non-zero, exit the virtual machine with
84175	** a return code SQLITE_ABORT.
84176	*/
84177	if( nVmStep>=nProgressLimit && db->xProgress!=0 ){
84178	assert( db->nProgressOps!=0 );
84179	nProgressLimit = nVmStep + db->nProgressOps - (nVmStep%db->nProgressOps);
84180	if( db->xProgress(db->pProgressArg) ){

84181	rc = SQLITE_INTERRUPT;
84182	goto abort_due_to_error;
84183	}
84184	}
84185	#endif
	@@ -84454,10 +84534,11 @@
84454
84455	#ifndef SQLITE_OMIT_UTF16
84456	if( encoding!=SQLITE_UTF8 ){
84457	rc = sqlite3VdbeMemSetStr(pOut, pOp->p4.z, -1, SQLITE_UTF8, SQLITE_STATIC);
84458	assert( rc==SQLITE_OK \|\| rc==SQLITE_TOOBIG );

84459	if( SQLITE_OK!=sqlite3VdbeChangeEncoding(pOut, encoding) ) goto no_mem;
84460	assert( pOut->szMalloc>0 && pOut->zMalloc==pOut->z );
84461	assert( VdbeMemDynamic(pOut)==0 );
84462	pOut->szMalloc = 0;
84463	pOut->flags \|= MEM_Static;
	@@ -84466,11 +84547,10 @@
84466	}
84467	pOp->p4type = P4_DYNAMIC;
84468	pOp->p4.z = pOut->z;
84469	pOp->p1 = pOut->n;
84470	}
84471	testcase( rc==SQLITE_TOOBIG );
84472	#endif
84473	if( pOp->p1>db->aLimit[SQLITE_LIMIT_LENGTH] ){
84474	goto too_big;
84475	}
84476	assert( rc==SQLITE_OK );
	@@ -84721,22 +84801,10 @@
84721	int i;
84722	assert( p->nResColumn==pOp->p2 );
84723	assert( pOp->p1>0 );
84724	assert( pOp->p1+pOp->p2<=(p->nMem+1 - p->nCursor)+1 );
84725
84726	#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
84727	/* Run the progress counter just before returning.
84728	*/
84729	if( db->xProgress!=0
84730	&& nVmStep>=nProgressLimit
84731	&& db->xProgress(db->pProgressArg)!=0
84732	){
84733	rc = SQLITE_INTERRUPT;
84734	goto abort_due_to_error;
84735	}
84736	#endif
84737
84738	/* If this statement has violated immediate foreign key constraints, do
84739	** not return the number of rows modified. And do not RELEASE the statement
84740	** transaction. It needs to be rolled back. */
84741	if( SQLITE_OK!=(rc = sqlite3VdbeCheckFk(p, 0)) ){
84742	assert( db->flags&SQLITE_CountRows );
	@@ -85959,19 +86027,19 @@
85959	offset64 = aOffset[i];
85960	zHdr = zData + pC->iHdrOffset;
85961	zEndHdr = zData + aOffset[0];
85962	testcase( zHdr>=zEndHdr );
85963	do{
85964	if( (t = zHdr[0])<0x80 ){
85965	zHdr++;
85966	offset64 += sqlite3VdbeOneByteSerialTypeLen(t);
85967	}else{
85968	zHdr += sqlite3GetVarint32(zHdr, &t);

85969	offset64 += sqlite3VdbeSerialTypeLen(t);
85970	}
85971	pC->aType[i++] = t;
85972	aOffset[i] = (u32)(offset64 & 0xffffffff);
85973	}while( i<=p2 && zHdr<zEndHdr );
85974
85975	/* The record is corrupt if any of the following are true:
85976	** (1) the bytes of the header extend past the declared header size
85977	** (2) the entire header was used but not all data was used
	@@ -87933,18 +88001,11 @@
87933	** cause any problems.)
87934	**
87935	** This instruction only works on tables. The equivalent instruction
87936	** for indices is OP_IdxInsert.
87937	*/
87938	/* Opcode: InsertInt P1 P2 P3 P4 P5
87939	** Synopsis: intkey=P3 data=r[P2]
87940	**
87941	** This works exactly like OP_Insert except that the key is the
87942	** integer value P3, not the value of the integer stored in register P3.
87943	*/
87944	case OP_Insert:
87945	case OP_InsertInt: {
87946	Mem pData; / MEM cell holding data for the record to be inserted */
87947	Mem pKey; / MEM cell holding key for the record */
87948	VdbeCursor pC; / Cursor to table into which insert is written */
87949	int seekResult; /* Result of prior seek or 0 if no USESEEKRESULT flag */
87950	const char zDb; / database name - used by the update hook */
	@@ -87961,20 +88022,15 @@
87961	assert( (pOp->p5 & OPFLAG_ISNOOP) \|\| pC->isTable );
87962	assert( pOp->p4type==P4_TABLE \|\| pOp->p4type>=P4_STATIC );
87963	REGISTER_TRACE(pOp->p2, pData);
87964	sqlite3VdbeIncrWriteCounter(p, pC);
87965
87966	if( pOp->opcode==OP_Insert ){
87967	pKey = &aMem[pOp->p3];
87968	assert( pKey->flags & MEM_Int );
87969	assert( memIsValid(pKey) );
87970	REGISTER_TRACE(pOp->p3, pKey);
87971	x.nKey = pKey->u.i;
87972	}else{
87973	assert( pOp->opcode==OP_InsertInt );
87974	x.nKey = pOp->p3;
87975	}
87976
87977	if( pOp->p4type==P4_TABLE && HAS_UPDATE_HOOK(db) ){
87978	assert( pC->iDb>=0 );
87979	zDb = db->aDb[pC->iDb].zDbSName;
87980	pTab = pOp->p4.pTab;
	@@ -89538,12 +89594,11 @@
89538	aMem[i].flags \|= MEM_Undefined; /* Cause a fault if this reg is reused */
89539	}
89540	}
89541	#endif
89542	pOp = &aOp[-1];
89543
89544	break;
89545	}
89546
89547	/* Opcode: Param P1 P2 * * *
89548	**
89549	** This opcode is only ever present in sub-programs called via the
	@@ -90948,11 +91003,20 @@
90948
90949	/* This is the only way out of this procedure. We have to
90950	** release the mutexes on btrees that were acquired at the
90951	** top. */
90952	vdbe_return:
90953	testcase( nVmStep>0 );









90954	p->aCounter[SQLITE_STMTSTATUS_VM_STEP] += (int)nVmStep;
90955	sqlite3VdbeLeave(p);
90956	assert( rc!=SQLITE_OK \|\| nExtraDelete==0
90957	\|\| sqlite3_strlike("DELETE%",p->zSql,0)!=0
90958	);
	@@ -96129,10 +96193,42 @@
96129	}
96130	}
96131	return 0;
96132	}
96133
































96134	/*
96135	** pOrderBy is an ORDER BY or GROUP BY clause in SELECT statement pSelect.
96136	** The Name context of the SELECT statement is pNC. zType is either
96137	** "ORDER" or "GROUP" depending on which type of clause pOrderBy is.
96138	**
	@@ -96195,23 +96291,14 @@
96195	if( sqlite3ResolveExprNames(pNC, pE) ){
96196	return 1;
96197	}
96198	for(j=0; j<pSelect->pEList->nExpr; j++){
96199	if( sqlite3ExprCompare(0, pE, pSelect->pEList->a[j].pExpr, -1)==0 ){
96200	#ifndef SQLITE_OMIT_WINDOWFUNC
96201	if( ExprHasProperty(pE, EP_WinFunc) ){
96202	/* Since this window function is being changed into a reference
96203	** to the same window function the result set, remove the instance
96204	** of this window function from the Select.pWin list. */
96205	Window **pp;
96206	for(pp=&pSelect->pWin; pp; pp=&(pp)->pNextWin){
96207	if( *pp==pE->y.pWin ){
96208	pp = (pp)->pNextWin;
96209	}
96210	}
96211	}
96212	#endif
96213	pItem->u.x.iOrderByCol = j+1;
96214	}
96215	}
96216	}
96217	return sqlite3ResolveOrderGroupBy(pParse, pSelect, pOrderBy, zType);
	@@ -96419,10 +96506,11 @@
96419	return WRC_Abort;
96420	}
96421	}
96422	}
96423

96424	if( IN_RENAME_OBJECT ){
96425	Window *pWin;
96426	for(pWin=p->pWinDefn; pWin; pWin=pWin->pNextWin){
96427	if( sqlite3ResolveExprListNames(&sNC, pWin->pOrderBy)
96428	\|\| sqlite3ResolveExprListNames(&sNC, pWin->pPartition)
	@@ -96429,10 +96517,11 @@
96429	){
96430	return WRC_Abort;
96431	}
96432	}
96433	}

96434
96435	/* If this is part of a compound SELECT, check that it has the right
96436	** number of expressions in the select list. */
96437	if( p->pNext && p->pEList->nExpr!=p->pNext->pEList->nExpr ){
96438	sqlite3SelectWrongNumTermsError(pParse, p->pNext);
	@@ -99179,18 +99268,15 @@
99179	u32 savedNQueryLoop = pParse->nQueryLoop;
99180	int rMayHaveNull = 0;
99181	eType = IN_INDEX_EPH;
99182	if( inFlags & IN_INDEX_LOOP ){
99183	pParse->nQueryLoop = 0;
99184	if( pX->pLeft->iColumn<0 && !ExprHasProperty(pX, EP_xIsSelect) ){
99185	eType = IN_INDEX_ROWID;
99186	}
99187	}else if( prRhsHasNull ){
99188	*prRhsHasNull = rMayHaveNull = ++pParse->nMem;
99189	}
99190	assert( pX->op==TK_IN );
99191	sqlite3CodeRhsOfIN(pParse, pX, iTab, eType==IN_INDEX_ROWID);
99192	if( rMayHaveNull ){
99193	sqlite3SetHasNullFlag(v, iTab, rMayHaveNull);
99194	}
99195	pParse->nQueryLoop = savedNQueryLoop;
99196	}
	@@ -99287,16 +99373,10 @@
99287	** constructed ephermeral table is returned. The first time the ephemeral
99288	** table is computed, the cursor number is also stored in pExpr->iTable,
99289	** however the cursor number returned might not be the same, as it might
99290	** have been duplicated using OP_OpenDup.
99291	**
99292	** If parameter isRowid is non-zero, then LHS of the IN operator is guaranteed
99293	** to be a non-null integer. In this case, the ephemeral table can be an
99294	** table B-Tree that keyed by only integers. The more general cases uses
99295	** an index B-Tree which can have arbitrary keys, but is slower to both
99296	** read and write.
99297	**
99298	** If the LHS expression ("x" in the examples) is a column value, or
99299	** the SELECT statement returns a column value, then the affinity of that
99300	** column is used to build the index keys. If both 'x' and the
99301	** SELECT... statement are columns, then numeric affinity is used
99302	** if either column has NUMERIC or INTEGER affinity. If neither
	@@ -99304,12 +99384,11 @@
99304	** is used.
99305	*/
99306	SQLITE_PRIVATE void sqlite3CodeRhsOfIN(
99307	Parse pParse, / Parsing context */
99308	Expr pExpr, / The IN operator */
99309	int iTab, /* Use this cursor number */
99310	int isRowid /* If true, LHS is a rowid */
99311	){
99312	int addrOnce = 0; /* Address of the OP_Once instruction at top */
99313	int addr; /* Address of OP_OpenEphemeral instruction */
99314	Expr pLeft; / the LHS of the IN operator */
99315	KeyInfo pKeyInfo = 0; / Key information */
	@@ -99358,26 +99437,24 @@
99358	}
99359
99360	/* Check to see if this is a vector IN operator */
99361	pLeft = pExpr->pLeft;
99362	nVal = sqlite3ExprVectorSize(pLeft);
99363	assert( !isRowid \|\| nVal==1 );
99364
99365	/* Construct the ephemeral table that will contain the content of
99366	** RHS of the IN operator.
99367	*/
99368	pExpr->iTable = iTab;
99369	addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral,
99370	pExpr->iTable, (isRowid?0:nVal));
99371	#ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
99372	if( ExprHasProperty(pExpr, EP_xIsSelect) ){
99373	VdbeComment((v, "Result of SELECT %u", pExpr->x.pSelect->selId));
99374	}else{
99375	VdbeComment((v, "RHS of IN operator"));
99376	}
99377	#endif
99378	pKeyInfo = isRowid ? 0 : sqlite3KeyInfoAlloc(pParse->db, nVal, 1);
99379
99380	if( ExprHasProperty(pExpr, EP_xIsSelect) ){
99381	/* Case 1: expr IN (SELECT ...)
99382	**
99383	** Generate code to write the results of the select into the temporary
	@@ -99387,11 +99464,10 @@
99387	ExprList *pEList = pSelect->pEList;
99388
99389	ExplainQueryPlan((pParse, 1, "%sLIST SUBQUERY %d",
99390	addrOnce?"":"CORRELATED ", pSelect->selId
99391	));
99392	assert( !isRowid );
99393	/* If the LHS and RHS of the IN operator do not match, that
99394	** error will have been caught long before we reach this point. */
99395	if( ALWAYS(pEList->nExpr==nVal) ){
99396	SelectDest dest;
99397	int i;
	@@ -99440,14 +99516,12 @@
99440	}
99441
99442	/* Loop through each expression in <exprlist>. */
99443	r1 = sqlite3GetTempReg(pParse);
99444	r2 = sqlite3GetTempReg(pParse);
99445	if( isRowid ) sqlite3VdbeAddOp4(v, OP_Blob, 0, r2, 0, "", P4_STATIC);
99446	for(i=pList->nExpr, pItem=pList->a; i>0; i--, pItem++){
99447	Expr *pE2 = pItem->pExpr;
99448	int iValToIns;
99449
99450	/* If the expression is not constant then we will need to
99451	** disable the test that was generated above that makes sure
99452	** this code only executes once. Because for a non-constant
99453	** expression we need to rerun this code each time.
	@@ -99456,24 +99530,13 @@
99456	sqlite3VdbeChangeToNoop(v, addrOnce);
99457	addrOnce = 0;
99458	}
99459
99460	/* Evaluate the expression and insert it into the temp table */
99461	if( isRowid && sqlite3ExprIsInteger(pE2, &iValToIns) ){
99462	sqlite3VdbeAddOp3(v, OP_InsertInt, iTab, r2, iValToIns);
99463	}else{
99464	r3 = sqlite3ExprCodeTarget(pParse, pE2, r1);
99465	if( isRowid ){
99466	sqlite3VdbeAddOp2(v, OP_MustBeInt, r3,
99467	sqlite3VdbeCurrentAddr(v)+2);
99468	VdbeCoverage(v);
99469	sqlite3VdbeAddOp3(v, OP_Insert, iTab, r2, r3);
99470	}else{
99471	sqlite3VdbeAddOp4(v, OP_MakeRecord, r3, 1, r2, &affinity, 1);
99472	sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iTab, r2, r3, 1);
99473	}
99474	}
99475	}
99476	sqlite3ReleaseTempReg(pParse, r1);
99477	sqlite3ReleaseTempReg(pParse, r2);
99478	}
99479	if( pKeyInfo ){
	@@ -106852,11 +106915,15 @@
106852	assert( pParse->nested<10 ); /* Nesting should only be of limited depth */
106853	va_start(ap, zFormat);
106854	zSql = sqlite3VMPrintf(db, zFormat, ap);
106855	va_end(ap);
106856	if( zSql==0 ){
106857	return; /* A malloc must have failed */




106858	}
106859	pParse->nested++;
106860	memcpy(saveBuf, PARSE_TAIL(pParse), PARSE_TAIL_SZ);
106861	memset(PARSE_TAIL(pParse), 0, PARSE_TAIL_SZ);
106862	sqlite3RunParser(pParse, zSql, &zErrMsg);
	@@ -108413,10 +108480,11 @@
108413	if( db->mallocFailed \|\| pParse->nErr ) return;
108414	pPk = sqlite3PrimaryKeyIndex(pTab);
108415	pTab->iPKey = -1;
108416	}else{
108417	pPk = sqlite3PrimaryKeyIndex(pTab);

108418
108419	/*
108420	** Remove all redundant columns from the PRIMARY KEY. For example, change
108421	** "PRIMARY KEY(a,b,a,b,c,b,c,d)" into just "PRIMARY KEY(a,b,c,d)". Later
108422	** code assumes the PRIMARY KEY contains no repeated columns.
	@@ -108582,10 +108650,15 @@
108582	}
108583	p->tnum = db->init.newTnum;
108584	if( p->tnum==1 ) p->tabFlags \|= TF_Readonly;
108585	}
108586





108587	/* Special processing for WITHOUT ROWID Tables */
108588	if( tabOpts & TF_WithoutRowid ){
108589	if( (p->tabFlags & TF_Autoincrement) ){
108590	sqlite3ErrorMsg(pParse,
108591	"AUTOINCREMENT not allowed on WITHOUT ROWID tables");
	@@ -117855,11 +117928,13 @@
117855	}
117856	}
117857	sqlite3VdbeAddOp3(v, OP_MakeRecord, regIdx, pIdx->nColumn, aRegIdx[ix]);
117858	VdbeComment((v, "for %s", pIdx->zName));
117859	#ifdef SQLITE_ENABLE_NULL_TRIM
117860	if( pIdx->idxType==2 ) sqlite3SetMakeRecordP5(v, pIdx->pTable);


117861	#endif
117862
117863	/* In an UPDATE operation, if this index is the PRIMARY KEY index
117864	** of a WITHOUT ROWID table and there has been no change the
117865	** primary key, then no collision is possible. The collision detection
	@@ -118105,14 +118180,17 @@
118105	assert( pParse->nested==0 );
118106	pik_flags \|= OPFLAG_NCHANGE;
118107	pik_flags \|= (update_flags & OPFLAG_SAVEPOSITION);
118108	#ifdef SQLITE_ENABLE_PREUPDATE_HOOK
118109	if( update_flags==0 ){
118110	sqlite3VdbeAddOp4(v, OP_InsertInt,
118111	iIdxCur+i, aRegIdx[i], 0, (char*)pTab, P4_TABLE


118112	);
118113	sqlite3VdbeChangeP5(v, OPFLAG_ISNOOP);

118114	}
118115	#endif
118116	}
118117	sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iIdxCur+i, aRegIdx[i],
118118	aRegIdx[i]+1,
	@@ -118533,11 +118611,11 @@
118533	addr2 = sqlite3VdbeAddOp3(v, OP_NotExists, iDest, 0, regRowid);
118534	VdbeCoverage(v);
118535	sqlite3RowidConstraint(pParse, onError, pDest);
118536	sqlite3VdbeJumpHere(v, addr2);
118537	autoIncStep(pParse, regAutoinc, regRowid);
118538	}else if( pDest->pIndex==0 ){
118539	addr1 = sqlite3VdbeAddOp2(v, OP_NewRowid, iDest, regRowid);
118540	}else{
118541	addr1 = sqlite3VdbeAddOp2(v, OP_Rowid, iSrc, regRowid);
118542	assert( (pDest->tabFlags & TF_Autoincrement)==0 );
118543	}
	@@ -118596,11 +118674,11 @@
118596	if( i==pSrcIdx->nColumn ){
118597	idxInsFlags = OPFLAG_USESEEKRESULT;
118598	sqlite3VdbeAddOp1(v, OP_SeekEnd, iDest);
118599	}
118600	}
118601	if( !HasRowid(pSrc) && pDestIdx->idxType==2 ){
118602	idxInsFlags \|= OPFLAG_NCHANGE;
118603	}
118604	sqlite3VdbeAddOp2(v, OP_IdxInsert, iDest, regData);
118605	sqlite3VdbeChangeP5(v, idxInsFlags\|OPFLAG_APPEND);
118606	sqlite3VdbeAddOp2(v, OP_Next, iSrc, addr1+1); VdbeCoverage(v);
	@@ -136425,11 +136503,10 @@
136425	pIn += i;
136426	for(i=iEq;i<pLoop->nLTerm; i++){
136427	if( pLoop->aLTerm[i]->pExpr==pX ){
136428	int iOut = iReg + i - iEq;
136429	if( eType==IN_INDEX_ROWID ){
136430	testcase( nEq>1 ); /* Happens with a UNIQUE index on ROWID */
136431	pIn->addrInTop = sqlite3VdbeAddOp2(v, OP_Rowid, iTab, iOut);
136432	}else{
136433	int iCol = aiMap ? aiMap[iMap++] : 0;
136434	pIn->addrInTop = sqlite3VdbeAddOp3(v,OP_Column,iTab, iCol, iOut);
136435	}
	@@ -137187,10 +137264,13 @@
137187	if( iRowidReg!=iReleaseReg ) sqlite3ReleaseTempReg(pParse, iReleaseReg);
137188	addrNxt = pLevel->addrNxt;
137189	sqlite3VdbeAddOp3(v, OP_SeekRowid, iCur, addrNxt, iRowidReg);
137190	VdbeCoverage(v);
137191	pLevel->op = OP_Noop;



137192	}else if( (pLoop->wsFlags & WHERE_IPK)!=0
137193	&& (pLoop->wsFlags & WHERE_COLUMN_RANGE)!=0
137194	){
137195	/* Case 3: We have an inequality comparison against the ROWID field.
137196	*/
	@@ -153009,10 +153089,11 @@
153009	int n = 0; /* Length of the next token token */
153010	int tokenType; /* type of the next token */
153011	int lastTokenParsed = -1; /* type of the previous token */
153012	sqlite3 db = pParse->db; / The database connection */
153013	int mxSqlLen; /* Max length of an SQL string */

153014	#ifdef sqlite3Parser_ENGINEALWAYSONSTACK
153015	yyParser sEngine; /* Space to hold the Lemon-generated Parser object */
153016	#endif
153017
153018	assert( zSql!=0 );
	@@ -153043,10 +153124,12 @@
153043	#endif
153044	assert( pParse->pNewTable==0 );
153045	assert( pParse->pNewTrigger==0 );
153046	assert( pParse->nVar==0 );
153047	assert( pParse->pVList==0 );


153048	while( 1 ){
153049	n = sqlite3GetToken((u8*)zSql, &tokenType);
153050	mxSqlLen -= n;
153051	if( mxSqlLen<0 ){
153052	pParse->rc = SQLITE_TOOBIG;
	@@ -153099,11 +153182,12 @@
153099	pParse->sLastToken.z = zSql;
153100	pParse->sLastToken.n = n;
153101	sqlite3Parser(pEngine, tokenType, pParse->sLastToken);
153102	lastTokenParsed = tokenType;
153103	zSql += n;
153104	if( pParse->rc!=SQLITE_OK \|\| db->mallocFailed ) break;

153105	}
153106	assert( nErr==0 );
153107	#ifdef YYTRACKMAXSTACKDEPTH
153108	sqlite3_mutex_enter(sqlite3MallocMutex());
153109	sqlite3StatusHighwater(SQLITE_STATUS_PARSER_STACK,
	@@ -153167,10 +153251,12 @@
153167	while( pParse->pZombieTab ){
153168	Table *p = pParse->pZombieTab;
153169	pParse->pZombieTab = p->pNextZombie;
153170	sqlite3DeleteTable(db, p);
153171	}


153172	assert( nErr==0 \|\| pParse->rc!=SQLITE_OK );
153173	return nErr;
153174	}
153175
153176
	@@ -170805,11 +170891,13 @@
170805
170806	fts3SegReaderSetEof(pReader);
170807
170808	/* If iCurrentBlock>=iLeafEndBlock, this is an EOF condition. All leaf
170809	** blocks have already been traversed. */
170810	assert( pReader->iCurrentBlock<=pReader->iLeafEndBlock );


170811	if( pReader->iCurrentBlock>=pReader->iLeafEndBlock ){
170812	return SQLITE_OK;
170813	}
170814
170815	rc = sqlite3Fts3ReadBlock(
	@@ -172692,12 +172780,14 @@
172692	bIgnoreEmpty = (iLevel!=FTS3_SEGCURSOR_PENDING) && (iNewLevel>iMaxLevel);
172693	}
172694	if( rc!=SQLITE_OK ) goto finished;
172695
172696	assert( csr.nSegment>0 );
172697	assert( iNewLevel>=getAbsoluteLevel(p, iLangid, iIndex, 0) );
172698	assert( iNewLevel<getAbsoluteLevel(p, iLangid, iIndex,FTS3_SEGDIR_MAXLEVEL) );


172699
172700	memset(&filter, 0, sizeof(Fts3SegFilter));
172701	filter.flags = FTS3_SEGMENT_REQUIRE_POS;
172702	filter.flags \|= (bIgnoreEmpty ? FTS3_SEGMENT_IGNORE_EMPTY : 0);
172703
	@@ -176712,11 +176802,11 @@
176712	UNUSED_PARAMETER(iPhrase);
176713	rc = sqlite3Fts3EvalPhrasePoslist(p->pCsr, pExpr, p->iCol, &pList);
176714	nTerm = pExpr->pPhrase->nToken;
176715	if( pList ){
176716	fts3GetDeltaPosition(&pList, &iPos);
176717	assert( iPos>=0 );
176718	}
176719
176720	for(iTerm=0; iTerm<nTerm; iTerm++){
176721	TermOffset *pT = &p->aTerm[p->iTerm++];
176722	pT->iOff = nTerm-iTerm-1;
	@@ -176822,11 +176912,11 @@
176822
176823	if( !pTerm ){
176824	/* All offsets for this column have been gathered. */
176825	rc = SQLITE_DONE;
176826	}else{
176827	assert( iCurrent<=iMinPos );
176828	if( 0==(0xFE&*pTerm->pList) ){
176829	pTerm->pList = 0;
176830	}else{
176831	fts3GetDeltaPosition(&pTerm->pList, &pTerm->iPos);
176832	}
	@@ -188622,10 +188712,11 @@
188622	if( aOut==0 ){
188623	sqlite3_result_error_nomem(context);
188624	}else{
188625	nOut2 = rbuDeltaApply(aOrig, nOrig, aDelta, nDelta, aOut);
188626	if( nOut2!=nOut ){

188627	sqlite3_result_error(context, "corrupt fossil delta", -1);
188628	}else{
188629	sqlite3_result_blob(context, aOut, nOut, sqlite3_free);
188630	}
188631	}
	@@ -199681,11 +199772,11 @@
199681	** xSetAuxdata(pFts5, pAux, xDelete)
199682	**
199683	** Save the pointer passed as the second argument as the extension functions
199684	** "auxiliary data". The pointer may then be retrieved by the current or any
199685	** future invocation of the same fts5 extension function made as part of
199686	** of the same MATCH query using the xGetAuxdata() API.
199687	**
199688	** Each extension function is allocated a single auxiliary data slot for
199689	** each FTS query (MATCH expression). If the extension function is invoked
199690	** more than once for a single FTS query, then all invocations share a
199691	** single auxiliary data context.
	@@ -199696,11 +199787,11 @@
199696	** point.
199697	**
199698	** The xDelete callback, if one is specified, is also invoked on the
199699	** auxiliary data pointer after the FTS5 query has finished.
199700	**
199701	** If an error (e.g. an OOM condition) occurs within this function, an
199702	** the auxiliary data is set to NULL and an error code returned. If the
199703	** xDelete parameter was not NULL, it is invoked on the auxiliary data
199704	** pointer before returning.
199705	**
199706	**
	@@ -212031,17 +212122,18 @@
212031	}
212032
212033	/* Set up the new page-index array */
212034	fts5BufferAppendVarint(&p->rc, &buf, 4);
212035	if( pSeg->iLeafPgno==pSeg->iTermLeafPgno
212036	&& pSeg->iEndofDoclist<pData->szLeaf
212037	){

212038	int nDiff = pData->szLeaf - pSeg->iEndofDoclist;
212039	fts5BufferAppendVarint(&p->rc, &buf, buf.n - 1 - nDiff - 4);
212040	fts5BufferAppendBlob(&p->rc, &buf,
212041	pData->nn - pSeg->iPgidxOff, &pData->p[pSeg->iPgidxOff]
212042	);
212043	}
212044
212045	pSeg->pSeg->pgnoFirst = pSeg->iTermLeafPgno;
212046	fts5DataDelete(p, FTS5_SEGMENT_ROWID(iId, 1), iLeafRowid);
212047	fts5DataWrite(p, iLeafRowid, buf.p, buf.n);
	@@ -217074,11 +217166,11 @@
217074	int nArg, /* Number of args */
217075	sqlite3_value *apUnused / Function arguments */
217076	){
217077	assert( nArg==0 );
217078	UNUSED_PARAM2(nArg, apUnused);
217079	sqlite3_result_text(pCtx, "fts5: 2019-02-08 13:17:39 0eca3dd3d38b31c92b49ca2d311128b74584714d9e7de895b1a6286ef959a1dd", -1, SQLITE_TRANSIENT);
217080	}
217081
217082	/*
217083	** Return true if zName is the extension on one of the shadow tables used
217084	** by this module.
	@@ -221838,12 +221930,12 @@
221838	}
221839	#endif /* SQLITE_CORE */
221840	#endif /* !defined(SQLITE_CORE) \|\| defined(SQLITE_ENABLE_STMTVTAB) */
221841
221842	/************ End of stmt.c **********************************************/
221843	#if __LINE__!=221843
221844	#undef SQLITE_SOURCE_ID
221845	#define SQLITE_SOURCE_ID "2019-02-08 13:17:39 0eca3dd3d38b31c92b49ca2d311128b74584714d9e7de895b1a6286ef959alt2"
221846	#endif
221847	/* Return the source-id for this library */
221848	SQLITE_API const char *sqlite3_sourceid(void){ return SQLITE_SOURCE_ID; }
221849	/************************ End of sqlite3.c ****************************/
221850

	--- src/sqlite3.c
	+++ src/sqlite3.c
	@@ -1,8 +1,8 @@
1	/******************************************************************************
2	** This file is an amalgamation of many separate C source files from SQLite
3	** version 3.28.0. By combining all the individual C code files into this
4	** single large file, the entire code can be compiled as a single translation
5	** unit. This allows many compilers to do optimizations that would not be
6	** possible if the files were compiled separately. Performance improvements
7	** of 5% or more are commonly seen when SQLite is compiled as a single
8	** translation unit.
	@@ -1160,13 +1160,13 @@
1160	**
1161	** See also: [sqlite3_libversion()],
1162	** [sqlite3_libversion_number()], [sqlite3_sourceid()],
1163	** [sqlite_version()] and [sqlite_source_id()].
1164	*/
1165	#define SQLITE_VERSION "3.28.0"
1166	#define SQLITE_VERSION_NUMBER 3028000
1167	#define SQLITE_SOURCE_ID "2019-02-25 14:52:43 9da4fb59b28686630d63a79988b458726332cf06cc0e6e84d7c0a7600f5fcab0"
1168
1169	/*
1170	** CAPI3REF: Run-Time Library Version Numbers
1171	** KEYWORDS: sqlite3_version sqlite3_sourceid
1172	**
	@@ -3406,11 +3406,11 @@
3406	** ^Changes made as part of [foreign key actions] are included in the
3407	** count, but those made as part of REPLACE constraint resolution are
3408	** not. ^Changes to a view that are intercepted by INSTEAD OF triggers
3409	** are not counted.
3410	**
3411	** The [sqlite3_total_changes(D)] interface only reports the number
3412	** of rows that changed due to SQL statement run against database
3413	** connection D. Any changes by other database connections are ignored.
3414	** To detect changes against a database file from other database
3415	** connections use the [PRAGMA data_version] command or the
3416	** [SQLITE_FCNTL_DATA_VERSION] [file control].
	@@ -12338,11 +12338,11 @@
12338	** xSetAuxdata(pFts5, pAux, xDelete)
12339	**
12340	** Save the pointer passed as the second argument as the extension functions
12341	** "auxiliary data". The pointer may then be retrieved by the current or any
12342	** future invocation of the same fts5 extension function made as part of
12343	** the same MATCH query using the xGetAuxdata() API.
12344	**
12345	** Each extension function is allocated a single auxiliary data slot for
12346	** each FTS query (MATCH expression). If the extension function is invoked
12347	** more than once for a single FTS query, then all invocations share a
12348	** single auxiliary data context.
	@@ -12353,11 +12353,11 @@
12353	** point.
12354	**
12355	** The xDelete callback, if one is specified, is also invoked on the
12356	** auxiliary data pointer after the FTS5 query has finished.
12357	**
12358	** If an error (e.g. an OOM condition) occurs within this function,
12359	** the auxiliary data is set to NULL and an error code returned. If the
12360	** xDelete parameter was not NULL, it is invoked on the auxiliary data
12361	** pointer before returning.
12362	**
12363	**
	@@ -14935,61 +14935,60 @@
14935	#define OP_ColumnsUsed 118
14936	#define OP_SeekHit 119 /* synopsis: seekHit=P2 */
14937	#define OP_Sequence 120 /* synopsis: r[P2]=cursor[P1].ctr++ */
14938	#define OP_NewRowid 121 /* synopsis: r[P2]=rowid */
14939	#define OP_Insert 122 /* synopsis: intkey=r[P3] data=r[P2] */
14940	#define OP_Delete 123
14941	#define OP_ResetCount 124
14942	#define OP_SorterCompare 125 /* synopsis: if key(P1)!=trim(r[P3],P4) goto P2 */
14943	#define OP_SorterData 126 /* synopsis: r[P2]=data */
14944	#define OP_RowData 127 /* synopsis: r[P2]=data */
14945	#define OP_Rowid 128 /* synopsis: r[P2]=rowid */
14946	#define OP_NullRow 129
14947	#define OP_SeekEnd 130
14948	#define OP_SorterInsert 131 /* synopsis: key=r[P2] */
14949	#define OP_IdxInsert 132 /* synopsis: key=r[P2] */
14950	#define OP_IdxDelete 133 /* synopsis: key=r[P2@P3] */
14951	#define OP_DeferredSeek 134 /* synopsis: Move P3 to P1.rowid if needed */
14952	#define OP_IdxRowid 135 /* synopsis: r[P2]=rowid */
14953	#define OP_Destroy 136
14954	#define OP_Clear 137
14955	#define OP_ResetSorter 138
14956	#define OP_CreateBtree 139 /* synopsis: r[P2]=root iDb=P1 flags=P3 */
14957	#define OP_SqlExec 140
14958	#define OP_Real 141 /* same as TK_FLOAT, synopsis: r[P2]=P4 */
14959	#define OP_ParseSchema 142
14960	#define OP_LoadAnalysis 143
14961	#define OP_DropTable 144
14962	#define OP_DropIndex 145
14963	#define OP_DropTrigger 146
14964	#define OP_IntegrityCk 147
14965	#define OP_RowSetAdd 148 /* synopsis: rowset(P1)=r[P2] */
14966	#define OP_Param 149
14967	#define OP_FkCounter 150 /* synopsis: fkctr[P1]+=P2 */
14968	#define OP_MemMax 151 /* synopsis: r[P1]=max(r[P1],r[P2]) */
14969	#define OP_OffsetLimit 152 /* synopsis: if r[P1]>0 then r[P2]=r[P1]+max(0,r[P3]) else r[P2]=(-1) */
14970	#define OP_AggInverse 153 /* synopsis: accum=r[P3] inverse(r[P2@P5]) */
14971	#define OP_AggStep 154 /* synopsis: accum=r[P3] step(r[P2@P5]) */
14972	#define OP_AggStep1 155 /* synopsis: accum=r[P3] step(r[P2@P5]) */
14973	#define OP_AggValue 156 /* synopsis: r[P3]=value N=P2 */
14974	#define OP_AggFinal 157 /* synopsis: accum=r[P1] N=P2 */
14975	#define OP_Expire 158
14976	#define OP_TableLock 159 /* synopsis: iDb=P1 root=P2 write=P3 */
14977	#define OP_VBegin 160
14978	#define OP_VCreate 161
14979	#define OP_VDestroy 162
14980	#define OP_VOpen 163
14981	#define OP_VColumn 164 /* synopsis: r[P3]=vcolumn(P2) */
14982	#define OP_VRename 165
14983	#define OP_Pagecount 166
14984	#define OP_MaxPgcnt 167
14985	#define OP_Trace 168
14986	#define OP_CursorHint 169
14987	#define OP_Noop 170
14988	#define OP_Explain 171
14989	#define OP_Abortable 172

14990
14991	/* Properties such as "out2" or "jump" that are specified in
14992	** comments following the "case" for each opcode in the vdbe.c
14993	** are encoded into bitvectors as follows:
14994	*/
	@@ -15014,16 +15013,16 @@
15013	/* 88 */ 0x12, 0x20, 0x00, 0x00, 0x26, 0x26, 0x26, 0x26,\
15014	/* 96 */ 0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x00, 0x12,\
15015	/* 104 */ 0x10, 0x10, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,\
15016	/* 112 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
15017	/* 120 */ 0x10, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
15018	/* 128 */ 0x10, 0x00, 0x00, 0x04, 0x04, 0x00, 0x00, 0x10,\
15019	/* 136 */ 0x10, 0x00, 0x00, 0x10, 0x00, 0x10, 0x00, 0x00,\
15020	/* 144 */ 0x00, 0x00, 0x00, 0x00, 0x06, 0x10, 0x00, 0x04,\
15021	/* 152 */ 0x1a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
15022	/* 160 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x10,\
15023	/* 168 */ 0x00, 0x00, 0x00, 0x00, 0x00,}
15024
15025	/* The sqlite3P2Values() routine is able to run faster if it knows
15026	** the value of the largest JUMP opcode. The smaller the maximum
15027	** JUMP opcode the better, so the mkopcodeh.tcl script that
15028	** generated this include file strives to group all JUMP opcodes
	@@ -16324,10 +16323,11 @@
16323	int (xCommitCallback)(void); /* Invoked at every commit. */
16324	void pRollbackArg; / Argument to xRollbackCallback() */
16325	void (xRollbackCallback)(void); /* Invoked at every commit. */
16326	void *pUpdateArg;
16327	void (xUpdateCallback)(void,int, const char,const char,sqlite_int64);
16328	Parse pParse; / Current parse */
16329	#ifdef SQLITE_ENABLE_PREUPDATE_HOOK
16330	void pPreUpdateArg; / First argument to xPreUpdateCallback */
16331	void (xPreUpdateCallback)( / Registered using sqlite3_preupdate_hook() */
16332	void,sqlite3,int,char const,char const,sqlite3_int64,sqlite3_int64
16333	);
	@@ -17987,10 +17987,11 @@
17987	TableLock aTableLock; / Required table locks for shared-cache mode */
17988	#endif
17989	AutoincInfo pAinc; / Information about AUTOINCREMENT counters */
17990	Parse pToplevel; / Parse structure for main program (or NULL) */
17991	Table pTriggerTab; / Table triggers are being coded for */
17992	Parse pParentParse; / Parent parser if this parser is nested */
17993	int addrCrTab; /* Address of OP_CreateBtree opcode on CREATE TABLE */
17994	u32 nQueryLoop; /* Est number of iterations of a query (10log2(N)) /
17995	u32 oldmask; /* Mask of old.* columns referenced */
17996	u32 newmask; /* Mask of new.* columns referenced */
17997	u8 eTriggerOp; /* TK_UPDATE, TK_INSERT or TK_DELETE */
	@@ -19172,11 +19173,11 @@
19173	SQLITE_PRIVATE void sqlite3AlterRenameTable(Parse, SrcList, Token*);
19174	SQLITE_PRIVATE void sqlite3AlterRenameColumn(Parse, SrcList, Token, Token);
19175	SQLITE_PRIVATE int sqlite3GetToken(const unsigned char , int );
19176	SQLITE_PRIVATE void sqlite3NestedParse(Parse, const char, ...);
19177	SQLITE_PRIVATE void sqlite3ExpirePreparedStatements(sqlite3*, int);
19178	SQLITE_PRIVATE void sqlite3CodeRhsOfIN(Parse, Expr, int);
19179	SQLITE_PRIVATE int sqlite3CodeSubselect(Parse, Expr);
19180	SQLITE_PRIVATE void sqlite3SelectPrep(Parse, Select, NameContext*);
19181	SQLITE_PRIVATE void sqlite3SelectWrongNumTermsError(Parse pParse, Select p);
19182	SQLITE_PRIVATE int sqlite3MatchSpanName(const char, const char, const char, const char);
19183	SQLITE_PRIVATE int sqlite3ResolveExprNames(NameContext, Expr);
	@@ -27119,10 +27120,13 @@
27120	db->mallocFailed = 1;
27121	if( db->nVdbeExec>0 ){
27122	db->u1.isInterrupted = 1;
27123	}
27124	db->lookaside.bDisable++;
27125	if( db->pParse ){
27126	db->pParse->rc = SQLITE_NOMEM_BKPT;
27127	}
27128	}
27129	}
27130
27131	/*
27132	** This routine reactivates the memory allocator and clears the
	@@ -27312,11 +27316,11 @@
27316	** Set the StrAccum object to an error mode.
27317	*/
27318	static void setStrAccumError(StrAccum *p, u8 eError){
27319	assert( eError==SQLITE_NOMEM \|\| eError==SQLITE_TOOBIG );
27320	p->accError = eError;
27321	if( p->mxAlloc ) sqlite3_str_reset(p);
27322	}
27323
27324	/*
27325	** Extra argument values from a PrintfArguments object
27326	*/
	@@ -27342,10 +27346,11 @@
27346	** SQL from requesting large allocations using the precision or width
27347	** field of the printf() function.
27348	*/
27349	static char printfTempBuf(sqlite3_str pAccum, sqlite3_int64 n){
27350	char *z;
27351	if( pAccum->accError ) return 0;
27352	if( n>pAccum->nAlloc && n>pAccum->mxAlloc ){
27353	setStrAccumError(pAccum, SQLITE_TOOBIG);
27354	return 0;
27355	}
27356	z = sqlite3DbMallocRaw(pAccum->db, n);
	@@ -28061,13 +28066,12 @@
28066	testcase(p->accError==SQLITE_TOOBIG);
28067	testcase(p->accError==SQLITE_NOMEM);
28068	return 0;
28069	}
28070	if( p->mxAlloc==0 ){

28071	setStrAccumError(p, SQLITE_TOOBIG);
28072	return p->nAlloc - p->nChar - 1;
28073	}else{
28074	char *zOld = isMalloced(p) ? p->zText : 0;
28075	i64 szNew = p->nChar;
28076	szNew += N + 1;
28077	if( szNew+p->nChar<=p->mxAlloc ){
	@@ -28135,11 +28139,11 @@
28139	*/
28140	SQLITE_API void sqlite3_str_append(sqlite3_str p, const char z, int N){
28141	assert( z!=0 \|\| N==0 );
28142	assert( p->zText!=0 \|\| p->nChar==0 \|\| p->accError );
28143	assert( N>=0 );
28144	assert( p->accError==0 \|\| p->nAlloc==0 \|\| p->mxAlloc==0 );
28145	if( p->nChar+N >= p->nAlloc ){
28146	enlargeAndAppend(p,z,N);
28147	}else if( N ){
28148	assert( p->zText );
28149	p->nChar += N;
	@@ -32137,61 +32141,60 @@
32141	/* 118 */ "ColumnsUsed" OpHelp(""),
32142	/* 119 */ "SeekHit" OpHelp("seekHit=P2"),
32143	/* 120 */ "Sequence" OpHelp("r[P2]=cursor[P1].ctr++"),
32144	/* 121 */ "NewRowid" OpHelp("r[P2]=rowid"),
32145	/* 122 */ "Insert" OpHelp("intkey=r[P3] data=r[P2]"),
32146	/* 123 */ "Delete" OpHelp(""),
32147	/* 124 */ "ResetCount" OpHelp(""),
32148	/* 125 */ "SorterCompare" OpHelp("if key(P1)!=trim(r[P3],P4) goto P2"),
32149	/* 126 */ "SorterData" OpHelp("r[P2]=data"),
32150	/* 127 */ "RowData" OpHelp("r[P2]=data"),
32151	/* 128 */ "Rowid" OpHelp("r[P2]=rowid"),
32152	/* 129 */ "NullRow" OpHelp(""),
32153	/* 130 */ "SeekEnd" OpHelp(""),
32154	/* 131 */ "SorterInsert" OpHelp("key=r[P2]"),
32155	/* 132 */ "IdxInsert" OpHelp("key=r[P2]"),
32156	/* 133 */ "IdxDelete" OpHelp("key=r[P2@P3]"),
32157	/* 134 */ "DeferredSeek" OpHelp("Move P3 to P1.rowid if needed"),
32158	/* 135 */ "IdxRowid" OpHelp("r[P2]=rowid"),
32159	/* 136 */ "Destroy" OpHelp(""),
32160	/* 137 */ "Clear" OpHelp(""),
32161	/* 138 */ "ResetSorter" OpHelp(""),
32162	/* 139 */ "CreateBtree" OpHelp("r[P2]=root iDb=P1 flags=P3"),
32163	/* 140 */ "SqlExec" OpHelp(""),
32164	/* 141 */ "Real" OpHelp("r[P2]=P4"),
32165	/* 142 */ "ParseSchema" OpHelp(""),
32166	/* 143 */ "LoadAnalysis" OpHelp(""),
32167	/* 144 */ "DropTable" OpHelp(""),
32168	/* 145 */ "DropIndex" OpHelp(""),
32169	/* 146 */ "DropTrigger" OpHelp(""),
32170	/* 147 */ "IntegrityCk" OpHelp(""),
32171	/* 148 */ "RowSetAdd" OpHelp("rowset(P1)=r[P2]"),
32172	/* 149 */ "Param" OpHelp(""),
32173	/* 150 */ "FkCounter" OpHelp("fkctr[P1]+=P2"),
32174	/* 151 */ "MemMax" OpHelp("r[P1]=max(r[P1],r[P2])"),
32175	/* 152 */ "OffsetLimit" OpHelp("if r[P1]>0 then r[P2]=r[P1]+max(0,r[P3]) else r[P2]=(-1)"),
32176	/* 153 */ "AggInverse" OpHelp("accum=r[P3] inverse(r[P2@P5])"),
32177	/* 154 */ "AggStep" OpHelp("accum=r[P3] step(r[P2@P5])"),
32178	/* 155 */ "AggStep1" OpHelp("accum=r[P3] step(r[P2@P5])"),
32179	/* 156 */ "AggValue" OpHelp("r[P3]=value N=P2"),
32180	/* 157 */ "AggFinal" OpHelp("accum=r[P1] N=P2"),
32181	/* 158 */ "Expire" OpHelp(""),
32182	/* 159 */ "TableLock" OpHelp("iDb=P1 root=P2 write=P3"),
32183	/* 160 */ "VBegin" OpHelp(""),
32184	/* 161 */ "VCreate" OpHelp(""),
32185	/* 162 */ "VDestroy" OpHelp(""),
32186	/* 163 */ "VOpen" OpHelp(""),
32187	/* 164 */ "VColumn" OpHelp("r[P3]=vcolumn(P2)"),
32188	/* 165 */ "VRename" OpHelp(""),
32189	/* 166 */ "Pagecount" OpHelp(""),
32190	/* 167 */ "MaxPgcnt" OpHelp(""),
32191	/* 168 */ "Trace" OpHelp(""),
32192	/* 169 */ "CursorHint" OpHelp(""),
32193	/* 170 */ "Noop" OpHelp(""),
32194	/* 171 */ "Explain" OpHelp(""),
32195	/* 172 */ "Abortable" OpHelp(""),

32196	};
32197	return azName[i];
32198	}
32199	#endif
32200
	@@ -40217,10 +40220,13 @@
40220	static sqlite3_vfs aVfs[] = {
40221	#if SQLITE_ENABLE_LOCKING_STYLE && defined(__APPLE__)
40222	UNIXVFS("unix", autolockIoFinder ),
40223	#elif OS_VXWORKS
40224	UNIXVFS("unix", vxworksIoFinder ),
40225	#elif __Fuchsia__
40226	/* We are told that Fuchsia only supports dot-file locking */
40227	UNIXVFS("unix", dotlockIoFinder ),
40228	#else
40229	UNIXVFS("unix", posixIoFinder ),
40230	#endif
40231	UNIXVFS("unix-none", nolockIoFinder ),
40232	UNIXVFS("unix-dotfile", dotlockIoFinder ),
	@@ -58162,11 +58168,11 @@
58168	** Release a lock obtained by an earlier successful call to
58169	** sqlite3PagerSnapshotCheck().
58170	*/
58171	SQLITE_PRIVATE void sqlite3PagerSnapshotUnlock(Pager *pPager){
58172	assert( pPager->pWal );
58173	sqlite3WalSnapshotUnlock(pPager->pWal);
58174	}
58175
58176	#endif /* SQLITE_ENABLE_SNAPSHOT */
58177	#endif /* !SQLITE_OMIT_WAL */
58178
	@@ -62338,11 +62344,11 @@
62344	u8 max1bytePayload; /* min(maxLocal,127) */
62345	u8 nOverflow; /* Number of overflow cell bodies in aCell[] */
62346	u16 maxLocal; /* Copy of BtShared.maxLocal or BtShared.maxLeaf */
62347	u16 minLocal; /* Copy of BtShared.minLocal or BtShared.minLeaf */
62348	u16 cellOffset; /* Index in aData of first cell pointer */
62349	int nFree; /* Number of free bytes on the page. -1 for unknown */
62350	u16 nCell; /* Number of cells on this page, local and ovfl */
62351	u16 maskPage; /* Mask for page offset */
62352	u16 aiOvfl[4]; /* Insert the i-th overflow cell before the aiOvfl-th
62353	** non-overflow cell */
62354	u8 apOvfl[4]; / Pointers to the body of overflow cells */
	@@ -64492,12 +64498,12 @@
64498	** offsets to each pointer in the cell-pointer array than it is to
64499	** reconstruct the entire page. */
64500	if( (int)data[hdr+7]<=nMaxFrag ){
64501	int iFree = get2byte(&data[hdr+1]);
64502
64503	/* If the initial freeblock offset were out of bounds, that would have
64504	** been detected by btreeComputeFreeSpace() when it was computing the
64505	** number of free bytes on the page. */
64506	assert( iFree<=usableSize-4 );
64507	if( iFree ){
64508	int iFree2 = get2byte(&data[iFree]);
64509	if( iFree2>usableSize-4 ) return SQLITE_CORRUPT_PAGE(pPage);
	@@ -64565,10 +64571,11 @@
64571	memcpy(&data[cbrk], &src[pc], size);
64572	}
64573	data[hdr+7] = 0;
64574
64575	defragment_out:
64576	assert( pPage->nFree>=0 );
64577	if( data[hdr+7]+cbrk-iCellFirst!=pPage->nFree ){
64578	return SQLITE_CORRUPT_PAGE(pPage);
64579	}
64580	assert( cbrk>=iCellFirst );
64581	put2byte(&data[hdr+5], cbrk);
	@@ -64592,54 +64599,61 @@
64599	** Slots on the free list that are between 1 and 3 bytes larger than nByte
64600	** will be ignored if adding the extra space to the fragmentation count
64601	** causes the fragmentation count to exceed 60.
64602	*/
64603	static u8 pageFindSlot(MemPage pPg, int nByte, int *pRc){
64604	const int hdr = pPg->hdrOffset; /* Offset to page header */
64605	u8 * const aData = pPg->aData; /* Page data */
64606	int iAddr = hdr + 1; /* Address of ptr to pc */
64607	int pc = get2byte(&aData[iAddr]); /* Address of a free slot */
64608	int x; /* Excess size of the slot */
64609	int maxPC = pPg->pBt->usableSize - nByte; /* Max address for a usable slot */
64610	int size; /* Size of the free slot */
64611
64612	assert( pc>0 );
64613	while( pc<=maxPC ){
64614	/* EVIDENCE-OF: R-22710-53328 The third and fourth bytes of each
64615	** freeblock form a big-endian integer which is the size of the freeblock
64616	** in bytes, including the 4-byte header. */
64617	size = get2byte(&aData[pc+2]);
64618	if( (x = size - nByte)>=0 ){
64619	testcase( x==4 );
64620	testcase( x==3 );
64621	if( x<4 ){



64622	/* EVIDENCE-OF: R-11498-58022 In a well-formed b-tree page, the total
64623	** number of bytes in fragments may not exceed 60. */
64624	if( aData[hdr+7]>57 ) return 0;
64625
64626	/* Remove the slot from the free-list. Update the number of
64627	** fragmented bytes within the page. */
64628	memcpy(&aData[iAddr], &aData[pc], 2);
64629	aData[hdr+7] += (u8)x;
64630	}else if( x+pc > maxPC ){
64631	/* This slot extends off the end of the usable part of the page */
64632	*pRc = SQLITE_CORRUPT_PAGE(pPg);
64633	return 0;
64634	}else{
64635	/* The slot remains on the free-list. Reduce its size to account
64636	** for the portion used by the new allocation. */
64637	put2byte(&aData[pc+2], x);
64638	}
64639	return &aData[pc + x];
64640	}
64641	iAddr = pc;
64642	pc = get2byte(&aData[pc]);
64643	if( pc<iAddr+size ){
64644	if( pc ){
64645	/* The next slot in the chain is not past the end of the current slot */
64646	*pRc = SQLITE_CORRUPT_PAGE(pPg);
64647	}
64648	return 0;
64649	}
64650	}
64651	if( pc>maxPC+nByte-4 ){
64652	/* The free slot chain extends off the end of the page */
64653	*pRc = SQLITE_CORRUPT_PAGE(pPg);
64654	}

64655	return 0;
64656	}
64657
64658	/*
64659	** Allocate nByte bytes of space from within the B-Tree page passed
	@@ -64685,13 +64699,13 @@
64699	}else{
64700	return SQLITE_CORRUPT_PAGE(pPage);
64701	}
64702	}
64703
64704	/* If there is enough space between gap and top for one more cell pointer,
64705	** and if the freelist is not empty, then search the
64706	** freelist looking for a slot big enough to satisfy the request.
64707	*/
64708	testcase( gap+2==top );
64709	testcase( gap+1==top );
64710	testcase( gap==top );
64711	if( (data[hdr+2] \|\| data[hdr+1]) && gap+2<=top ){
	@@ -64709,19 +64723,20 @@
64723	** to see if defragmentation is necessary.
64724	*/
64725	testcase( gap+2+nByte==top );
64726	if( gap+2+nByte>top ){
64727	assert( pPage->nCell>0 \|\| CORRUPT_DB );
64728	assert( pPage->nFree>=0 );
64729	rc = defragmentPage(pPage, MIN(4, pPage->nFree - (2+nByte)));
64730	if( rc ) return rc;
64731	top = get2byteNotZero(&data[hdr+5]);
64732	assert( gap+2+nByte<=top );
64733	}
64734
64735
64736	/* Allocate memory from the gap in between the cell pointer array
64737	** and the cell content area. The btreeComputeFreeSpace() call has already
64738	** validated the freelist. Given that the freelist is valid, there
64739	** is no way that the allocation can extend off the end of the page.
64740	** The assert() below verifies the previous sentence.
64741	*/
64742	top -= nByte;
	@@ -64736,11 +64751,11 @@
64751	** The first byte of the new free block is pPage->aData[iStart]
64752	** and the size of the block is iSize bytes.
64753	**
64754	** Adjacent freeblocks are coalesced.
64755	**
64756	** Even though the freeblock list was checked by btreeComputeFreeSpace(),
64757	** that routine will not detect overlap between cells or freeblocks. Nor
64758	** does it detect cells or freeblocks that encrouch into the reserved bytes
64759	** at the end of the page. So do additional corruption checks inside this
64760	** routine and return SQLITE_CORRUPT if any problems are found.
64761	*/
	@@ -64898,25 +64913,18 @@
64913	pPage->max1bytePayload = pBt->max1bytePayload;
64914	return SQLITE_OK;
64915	}
64916
64917	/*
64918	** Compute the amount of freespace on the page. In other words, fill
64919	** in the pPage->nFree field.





64920	*/
64921	static int btreeComputeFreeSpace(MemPage *pPage){
64922	int pc; /* Address of a freeblock within pPage->aData[] */
64923	u8 hdr; /* Offset to beginning of page header */
64924	u8 data; / Equal to pPage->aData */

64925	int usableSize; /* Amount of usable space on each page */

64926	int nFree; /* Number of unused bytes on the page */
64927	int top; /* First byte of the cell content area */
64928	int iCellFirst; /* First allowable cell or freeblock offset */
64929	int iCellLast; /* Last possible cell or freeblock offset */
64930
	@@ -64924,75 +64932,22 @@
64932	assert( pPage->pBt->db!=0 );
64933	assert( sqlite3_mutex_held(pPage->pBt->mutex) );
64934	assert( pPage->pgno==sqlite3PagerPagenumber(pPage->pDbPage) );
64935	assert( pPage == sqlite3PagerGetExtra(pPage->pDbPage) );
64936	assert( pPage->aData == sqlite3PagerGetData(pPage->pDbPage) );
64937	assert( pPage->isInit==1 );
64938	assert( pPage->nFree<0 );
64939
64940	usableSize = pPage->pBt->usableSize;
64941	hdr = pPage->hdrOffset;
64942	data = pPage->aData;













64943	/* EVIDENCE-OF: R-58015-48175 The two-byte integer at offset 5 designates
64944	** the start of the cell content area. A zero value for this integer is
64945	** interpreted as 65536. */
64946	top = get2byteNotZero(&data[hdr+5]);
64947	iCellFirst = hdr + 8 + pPage->childPtrSize + 2*pPage->nCell;





















64948	iCellLast = usableSize - 4;




















64949
64950	/* Compute the total free space on the page
64951	** EVIDENCE-OF: R-23588-34450 The two-byte integer at offset 1 gives the
64952	** start of the first freeblock on the page, or is zero if there are no
64953	** freeblocks. */
	@@ -65036,11 +64991,104 @@
64991	*/
64992	if( nFree>usableSize ){
64993	return SQLITE_CORRUPT_PAGE(pPage);
64994	}
64995	pPage->nFree = (u16)(nFree - iCellFirst);
64996	return SQLITE_OK;
64997	}
64998
64999	/*
65000	** Do additional sanity check after btreeInitPage() if
65001	** PRAGMA cell_size_check=ON
65002	*/
65003	static SQLITE_NOINLINE int btreeCellSizeCheck(MemPage *pPage){
65004	int iCellFirst; /* First allowable cell or freeblock offset */
65005	int iCellLast; /* Last possible cell or freeblock offset */
65006	int i; /* Index into the cell pointer array */
65007	int sz; /* Size of a cell */
65008	int pc; /* Address of a freeblock within pPage->aData[] */
65009	u8 data; / Equal to pPage->aData */
65010	int usableSize; /* Maximum usable space on the page */
65011	int cellOffset; /* Start of cell content area */
65012
65013	iCellFirst = pPage->cellOffset + 2*pPage->nCell;
65014	usableSize = pPage->pBt->usableSize;
65015	iCellLast = usableSize - 4;
65016	data = pPage->aData;
65017	cellOffset = pPage->cellOffset;
65018	if( !pPage->leaf ) iCellLast--;
65019	for(i=0; i<pPage->nCell; i++){
65020	pc = get2byteAligned(&data[cellOffset+i*2]);
65021	testcase( pc==iCellFirst );
65022	testcase( pc==iCellLast );
65023	if( pc<iCellFirst \|\| pc>iCellLast ){
65024	return SQLITE_CORRUPT_PAGE(pPage);
65025	}
65026	sz = pPage->xCellSize(pPage, &data[pc]);
65027	testcase( pc+sz==usableSize );
65028	if( pc+sz>usableSize ){
65029	return SQLITE_CORRUPT_PAGE(pPage);
65030	}
65031	}
65032	return SQLITE_OK;
65033	}
65034
65035	/*
65036	** Initialize the auxiliary information for a disk block.
65037	**
65038	** Return SQLITE_OK on success. If we see that the page does
65039	** not contain a well-formed database page, then return
65040	** SQLITE_CORRUPT. Note that a return of SQLITE_OK does not
65041	** guarantee that the page is well-formed. It only shows that
65042	** we failed to detect any corruption.
65043	*/
65044	static int btreeInitPage(MemPage *pPage){
65045	u8 data; / Equal to pPage->aData */
65046	BtShared pBt; / The main btree structure */
65047
65048	assert( pPage->pBt!=0 );
65049	assert( pPage->pBt->db!=0 );
65050	assert( sqlite3_mutex_held(pPage->pBt->mutex) );
65051	assert( pPage->pgno==sqlite3PagerPagenumber(pPage->pDbPage) );
65052	assert( pPage == sqlite3PagerGetExtra(pPage->pDbPage) );
65053	assert( pPage->aData == sqlite3PagerGetData(pPage->pDbPage) );
65054	assert( pPage->isInit==0 );
65055
65056	pBt = pPage->pBt;
65057	data = pPage->aData + pPage->hdrOffset;
65058	/* EVIDENCE-OF: R-28594-02890 The one-byte flag at offset 0 indicating
65059	** the b-tree page type. */
65060	if( decodeFlags(pPage, data[0]) ){
65061	return SQLITE_CORRUPT_PAGE(pPage);
65062	}
65063	assert( pBt->pageSize>=512 && pBt->pageSize<=65536 );
65064	pPage->maskPage = (u16)(pBt->pageSize - 1);
65065	pPage->nOverflow = 0;
65066	pPage->cellOffset = pPage->hdrOffset + 8 + pPage->childPtrSize;
65067	pPage->aCellIdx = data + pPage->childPtrSize + 8;
65068	pPage->aDataEnd = pPage->aData + pBt->usableSize;
65069	pPage->aDataOfst = pPage->aData + pPage->childPtrSize;
65070	/* EVIDENCE-OF: R-37002-32774 The two-byte integer at offset 3 gives the
65071	** number of cells on the page. */
65072	pPage->nCell = get2byte(&data[3]);
65073	if( pPage->nCell>MX_CELL(pBt) ){
65074	/* To many cells for a single page. The page must be corrupt */
65075	return SQLITE_CORRUPT_PAGE(pPage);
65076	}
65077	testcase( pPage->nCell==MX_CELL(pBt) );
65078	/* EVIDENCE-OF: R-24089-57979 If a page contains no cells (which is only
65079	** possible for a root page of a table that contains no rows) then the
65080	** offset to the cell content area will equal the page size minus the
65081	** bytes of reserved space. */
65082	assert( pPage->nCell>0
65083	\|\| get2byteNotZero(&data[5])==pBt->usableSize
65084	\|\| CORRUPT_DB );
65085	pPage->nFree = -1; /* Indicate that this value is yet uncomputed */
65086	pPage->isInit = 1;
65087	if( pBt->db->flags & SQLITE_CellSizeCk ){
65088	return btreeCellSizeCheck(pPage);
65089	}
65090	return SQLITE_OK;
65091	}
65092
65093	/*
65094	** Set up a raw page so that it looks like a database page holding
	@@ -65179,38 +65227,38 @@
65227	assert( pCur==0 \|\| bReadOnly==pCur->curPagerFlags );
65228	assert( pCur==0 \|\| pCur->iPage>0 );
65229
65230	if( pgno>btreePagecount(pBt) ){
65231	rc = SQLITE_CORRUPT_BKPT;
65232	goto getAndInitPage_error1;
65233	}
65234	rc = sqlite3PagerGet(pBt->pPager, pgno, (DbPage**)&pDbPage, bReadOnly);
65235	if( rc ){
65236	goto getAndInitPage_error1;
65237	}
65238	ppPage = (MemPage)sqlite3PagerGetExtra(pDbPage);
65239	if( (*ppPage)->isInit==0 ){
65240	btreePageFromDbPage(pDbPage, pgno, pBt);
65241	rc = btreeInitPage(*ppPage);
65242	if( rc!=SQLITE_OK ){
65243	goto getAndInitPage_error2;

65244	}
65245	}
65246	assert( (*ppPage)->pgno==pgno );
65247	assert( (*ppPage)->aData==sqlite3PagerGetData(pDbPage) );
65248
65249	/* If obtaining a child page for a cursor, we must verify that the page is
65250	** compatible with the root page. */
65251	if( pCur && ((ppPage)->nCell<1 \|\| (ppPage)->intKey!=pCur->curIntKey) ){
65252	rc = SQLITE_CORRUPT_PGNO(pgno);
65253	goto getAndInitPage_error2;

65254	}
65255	return SQLITE_OK;
65256
65257	getAndInitPage_error2:
65258	releasePage(*ppPage);
65259	getAndInitPage_error1:
65260	if( pCur ){
65261	pCur->iPage--;
65262	pCur->pPage = pCur->apPage[pCur->iPage];
65263	}
65264	testcase( pgno==0 );
	@@ -69618,10 +69666,11 @@
69666	if( *pRC ) return;
69667	assert( idx>=0 && idx<pPage->nCell );
69668	assert( CORRUPT_DB \|\| sz==cellSize(pPage, idx) );
69669	assert( sqlite3PagerIswriteable(pPage->pDbPage) );
69670	assert( sqlite3_mutex_held(pPage->pBt->mutex) );
69671	assert( pPage->nFree>=0 );
69672	data = pPage->aData;
69673	ptr = &pPage->aCellIdx[2*idx];
69674	pc = get2byte(ptr);
69675	hdr = pPage->hdrOffset;
69676	testcase( pc==get2byte(&data[hdr+5]) );
	@@ -69688,10 +69737,11 @@
69737	** malformed cell from a leaf page to an interior page, if the cell size
69738	** wanted to be less than 4 but got rounded up to 4 on the leaf, then size
69739	** might be less than 8 (leaf-size + pointer) on the interior node. Hence
69740	** the term after the \|\| in the following assert(). */
69741	assert( sz==pPage->xCellSize(pPage, pCell) \|\| (sz==8 && iChild>0) );
69742	assert( pPage->nFree>=0 );
69743	if( pPage->nOverflow \|\| sz+2>pPage->nFree ){
69744	if( pTemp ){
69745	memcpy(pTemp, pCell, sz);
69746	pCell = pTemp;
69747	}
	@@ -69745,11 +69795,11 @@
69795	memmove(pIns+2, pIns, 2*(pPage->nCell - i));
69796	put2byte(pIns, idx);
69797	pPage->nCell++;
69798	/* increment the cell count */
69799	if( (++data[pPage->hdrOffset+4])==0 ) data[pPage->hdrOffset+3]++;
69800	assert( get2byte(&data[pPage->hdrOffset+3])==pPage->nCell \|\| CORRUPT_DB );
69801	#ifndef SQLITE_OMIT_AUTOVACUUM
69802	if( pPage->pBt->autoVacuum ){
69803	/* The cell may contain a pointer to an overflow page. If so, write
69804	** the entry for the overflow page into the pointer map.
69805	*/
	@@ -69832,12 +69882,17 @@
69882	**
69883	** For a table-btree, the concept is similar, except only apEnd[0]..apEnd[2]
69884	** are used and they point to the leaf pages only, and the ixNx value are:
69885	**
69886	** ixNx[0] = Number of cells in Child-1.
69887	** ixNx[1] = Number of cells in Child-1 and Child-2.
69888	** ixNx[2] = Total number of cells.
69889	**
69890	** Sometimes when deleting, a child page can have zero cells. In those
69891	** cases, ixNx[] entries with higher indexes, and the corresponding apEnd[]
69892	** entries, shift down. The end result is that each ixNx[] entry should
69893	** be larger than the previous
69894	*/
69895	typedef struct CellArray CellArray;
69896	struct CellArray {
69897	int nCell; /* Number of cells in apCell[] */
69898	MemPage pRef; / Reference page */
	@@ -70239,12 +70294,14 @@
70294	Pgno pgnoNew; /* Page number of pNew */
70295
70296	assert( sqlite3_mutex_held(pPage->pBt->mutex) );
70297	assert( sqlite3PagerIswriteable(pParent->pDbPage) );
70298	assert( pPage->nOverflow==1 );
70299
70300	if( pPage->nCell==0 ) return SQLITE_CORRUPT_BKPT; /* dbfuzz001.test */
70301	assert( pPage->nFree>=0 );
70302	assert( pParent->nFree>=0 );
70303
70304	/* Allocate a new page. This page will become the right-sibling of
70305	** pPage. Make the parent page writable, so that the new divider cell
70306	** may be inserted. If both these operations are successful, proceed.
70307	*/
	@@ -70410,10 +70467,11 @@
70467	** fairly obscure circumstances, even though it is a copy of initialized
70468	** page pFrom.
70469	*/
70470	pTo->isInit = 0;
70471	rc = btreeInitPage(pTo);
70472	if( rc==SQLITE_OK ) rc = btreeComputeFreeSpace(pTo);
70473	if( rc!=SQLITE_OK ){
70474	*pRC = rc;
70475	return;
70476	}
70477
	@@ -70518,10 +70576,11 @@
70576	assert( pParent->nOverflow==0 \|\| pParent->aiOvfl[0]==iParentIdx );
70577
70578	if( !aOvflSpace ){
70579	return SQLITE_NOMEM_BKPT;
70580	}
70581	assert( pParent->nFree>=0 );
70582
70583	/* Find the sibling pages to balance. Also locate the cells in pParent
70584	** that divide the siblings. An attempt is made to find NN siblings on
70585	** either side of pPage. More siblings are taken from one side, however,
70586	** if there are fewer than NN siblings on the other side. If pParent
	@@ -70556,10 +70615,17 @@
70615	while( 1 ){
70616	rc = getAndInitPage(pBt, pgno, &apOld[i], 0, 0);
70617	if( rc ){
70618	memset(apOld, 0, (i+1)sizeof(MemPage));
70619	goto balance_cleanup;
70620	}
70621	if( apOld[i]->nFree<0 ){
70622	rc = btreeComputeFreeSpace(apOld[i]);
70623	if( rc ){
70624	memset(apOld, 0, (i)sizeof(MemPage));
70625	goto balance_cleanup;
70626	}
70627	}
70628	nMaxCells += 1+apOld[i]->nCell+apOld[i]->nOverflow;
70629	if( (i--)==0 ) break;
70630
70631	if( pParent->nOverflow && i+nxDiv==pParent->aiOvfl[0] ){
	@@ -70751,15 +70817,19 @@
70817	usableSpace = pBt->usableSize - 12 + leafCorrection;
70818	for(i=k=0; i<nOld; i++, k++){
70819	MemPage *p = apOld[i];
70820	b.apEnd[k] = p->aDataEnd;
70821	b.ixNx[k] = cntOld[i];
70822	if( k && b.ixNx[k]==b.ixNx[k-1] ){
70823	k--; /* Omit b.ixNx[] entry for child pages with no cells */
70824	}
70825	if( !leafData ){
70826	k++;
70827	b.apEnd[k] = pParent->aDataEnd;
70828	b.ixNx[k] = cntOld[i]+1;
70829	}
70830	assert( p->nFree>=0 );
70831	szNew[i] = usableSpace - p->nFree;
70832	for(j=0; j<p->nOverflow; j++){
70833	szNew[i] += 2 + p->xCellSize(p, p->apOvfl[j]);
70834	}
70835	cntNew[i] = cntOld[i];
	@@ -70981,22 +71051,21 @@
71051	** populated, not here.
71052	*/
71053	if( ISAUTOVACUUM ){
71054	MemPage *pOld;
71055	MemPage *pNew = pOld = apNew[0];

71056	int cntOldNext = pNew->nCell + pNew->nOverflow;

71057	int iNew = 0;
71058	int iOld = 0;
71059
71060	for(i=0; i<b.nCell; i++){
71061	u8 *pCell = b.apCell[i];
71062	while( i==cntOldNext ){
71063	iOld++;
71064	assert( iOld<nNew \|\| iOld<nOld );
71065	pOld = iOld<nNew ? apNew[iOld] : apOld[iOld];
71066	cntOldNext += pOld->nCell + pOld->nOverflow + !leafData;

71067	}
71068	if( i==cntNew[iNew] ){
71069	pNew = apNew[++iNew];
71070	if( !leafData ) continue;
71071	}
	@@ -71007,11 +71076,11 @@
71076	** if sibling page iOld had the same page number as pNew, and if
71077	** pCell really was a part of sibling page iOld (not a divider or
71078	** overflow cell), we can skip updating the pointer map entries. */
71079	if( iOld>=nNew
71080	\|\| pNew->pgno!=aPgno[iOld]
71081	\|\| !SQLITE_WITHIN(pCell,pOld->aData,pOld->aDataEnd)
71082	){
71083	if( !leafCorrection ){
71084	ptrmapPut(pBt, get4byte(pCell), PTRMAP_BTREE, pNew->pgno, &rc);
71085	}
71086	if( cachedCellSize(&b,i)>pNew->minLocal ){
	@@ -71257,11 +71326,11 @@
71326	releasePage(pChild);
71327	return rc;
71328	}
71329	assert( sqlite3PagerIswriteable(pChild->pDbPage) );
71330	assert( sqlite3PagerIswriteable(pRoot->pDbPage) );
71331	assert( pChild->nCell==pRoot->nCell \|\| CORRUPT_DB );
71332
71333	TRACE(("BALANCE: copy root %d into %d\n", pRoot->pgno, pChild->pgno));
71334
71335	/* Copy the overflow cells from pRoot to pChild */
71336	memcpy(pChild->aiOvfl, pRoot->aiOvfl,
	@@ -71299,10 +71368,11 @@
71368
71369	do {
71370	int iPage = pCur->iPage;
71371	MemPage *pPage = pCur->pPage;
71372
71373	if( NEVER(pPage->nFree<0) && btreeComputeFreeSpace(pPage) ) break;
71374	if( iPage==0 ){
71375	if( pPage->nOverflow ){
71376	/* The root page of the b-tree is overfull. In this case call the
71377	** balance_deeper() function to create a new child for the root-page
71378	** and copy the current contents of the root-page to it. The
	@@ -71327,10 +71397,13 @@
71397	}else{
71398	MemPage * const pParent = pCur->apPage[iPage-1];
71399	int const iIdx = pCur->aiIdx[iPage-1];
71400
71401	rc = sqlite3PagerWrite(pParent->pDbPage);
71402	if( rc==SQLITE_OK && pParent->nFree<0 ){
71403	rc = btreeComputeFreeSpace(pParent);
71404	}
71405	if( rc==SQLITE_OK ){
71406	#ifndef SQLITE_OMIT_QUICKBALANCE
71407	if( pPage->intKeyLeaf
71408	&& pPage->nOverflow==1
71409	&& pPage->aiOvfl[0]==pPage->nCell
	@@ -71673,10 +71746,14 @@
71746	assert( pCur->eState==CURSOR_VALID \|\| (pCur->eState==CURSOR_INVALID && loc) );
71747
71748	pPage = pCur->pPage;
71749	assert( pPage->intKey \|\| pX->nKey>=0 );
71750	assert( pPage->leaf \|\| !pPage->intKey );
71751	if( pPage->nFree<0 ){
71752	rc = btreeComputeFreeSpace(pPage);
71753	if( rc ) return rc;
71754	}
71755
71756	TRACE(("INSERT: table=%d nkey=%lld ndata=%d page=%d %s\n",
71757	pCur->pgnoRoot, pX->nKey, pX->nData, pPage->pgno,
71758	loc==0 ? "overwrite" : "new entry"));
71759	assert( pPage->isInit );
	@@ -71823,10 +71900,11 @@
71900
71901	iCellDepth = pCur->iPage;
71902	iCellIdx = pCur->ix;
71903	pPage = pCur->pPage;
71904	pCell = findCell(pPage, iCellIdx);
71905	if( pPage->nFree<0 && btreeComputeFreeSpace(pPage) ) return SQLITE_CORRUPT;
71906
71907	/* If the bPreserve flag is set to true, then the cursor position must
71908	** be preserved following this delete operation. If the current delete
71909	** will cause a b-tree rebalance, then this is done by saving the cursor
71910	** key and leaving the cursor in CURSOR_REQUIRESEEK state before
	@@ -71893,10 +71971,14 @@
71971	MemPage *pLeaf = pCur->pPage;
71972	int nCell;
71973	Pgno n;
71974	unsigned char *pTmp;
71975
71976	if( pLeaf->nFree<0 ){
71977	rc = btreeComputeFreeSpace(pLeaf);
71978	if( rc ) return rc;
71979	}
71980	if( iCellDepth<pCur->iPage-1 ){
71981	n = pCur->apPage[iCellDepth+1]->pgno;
71982	}else{
71983	n = pCur->pPage->pgno;
71984	}
	@@ -72784,10 +72866,15 @@
72866	assert( rc==SQLITE_CORRUPT ); /* The only possible error from InitPage */
72867	checkAppendMsg(pCheck,
72868	"btreeInitPage() returns error code %d", rc);
72869	goto end_of_check;
72870	}
72871	if( (rc = btreeComputeFreeSpace(pPage))!=0 ){
72872	assert( rc==SQLITE_CORRUPT );
72873	checkAppendMsg(pCheck, "free space corruption", rc);
72874	goto end_of_check;
72875	}
72876	data = pPage->aData;
72877	hdr = pPage->hdrOffset;
72878
72879	/* Set up for cell analysis */
72880	pCheck->zPfx = "On tree page %d cell %d: ";
	@@ -72916,23 +73003,23 @@
73003	** freeblocks on the page.
73004	*/
73005	i = get2byte(&data[hdr+1]);
73006	while( i>0 ){
73007	int size, j;
73008	assert( (u32)i<=usableSize-4 ); /* Enforced by btreeComputeFreeSpace() */
73009	size = get2byte(&data[i+2]);
73010	assert( (u32)(i+size)<=usableSize ); /* due to btreeComputeFreeSpace() */
73011	btreeHeapInsert(heap, (((u32)i)<<16)\|(i+size-1));
73012	/* EVIDENCE-OF: R-58208-19414 The first 2 bytes of a freeblock are a
73013	** big-endian integer which is the offset in the b-tree page of the next
73014	** freeblock in the chain, or zero if the freeblock is the last on the
73015	** chain. */
73016	j = get2byte(&data[i]);
73017	/* EVIDENCE-OF: R-06866-39125 Freeblocks are always connected in order of
73018	** increasing offset. */
73019	assert( j==0 \|\| j>i+size ); /* Enforced by btreeComputeFreeSpace() */
73020	assert( (u32)j<=usableSize-4 ); /* Enforced by btreeComputeFreeSpace() */
73021	i = j;
73022	}
73023	/* Analyze the min-heap looking for overlap between cells and/or
73024	** freeblocks, and counting the number of untracked bytes in nFrag.
73025	**
	@@ -74393,12 +74480,11 @@
74480	return rc;
74481	#endif
74482	}
74483
74484	/*
74485	** Make sure pMem->z points to a writable allocation of at least n bytes.

74486	**
74487	** If the bPreserve argument is true, then copy of the content of
74488	** pMem->z into the new allocation. pMem must be either a string or
74489	** blob if bPreserve is true. If bPreserve is false, any prior content
74490	** in pMem->z is discarded.
	@@ -74413,11 +74499,10 @@
74499	assert( bPreserve==0 \|\| pMem->flags&(MEM_Blob\|MEM_Str) );
74500	testcase( bPreserve && pMem->z==0 );
74501
74502	assert( pMem->szMalloc==0
74503	\|\| pMem->szMalloc==sqlite3DbMallocSize(pMem->db, pMem->zMalloc) );

74504	if( pMem->szMalloc>0 && bPreserve && pMem->z==pMem->zMalloc ){
74505	pMem->z = pMem->zMalloc = sqlite3DbReallocOrFree(pMem->db, pMem->z, n);
74506	bPreserve = 0;
74507	}else{
74508	if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
	@@ -75262,11 +75347,10 @@
75347	flags = (enc==0?MEM_Blob:MEM_Str);
75348	if( nByte<0 ){
75349	assert( enc!=0 );
75350	if( enc==SQLITE_UTF8 ){
75351	nByte = 0x7fffffff & (int)strlen(z);

75352	}else{
75353	for(nByte=0; nByte<=iLimit && (z[nByte] \| z[nByte+1]); nByte+=2){}
75354	}
75355	flags \|= MEM_Term;
75356	}
	@@ -75274,33 +75358,34 @@
75358	/* The following block sets the new values of Mem.z and Mem.xDel. It
75359	** also sets a flag in local variable "flags" to indicate the memory
75360	** management (one of MEM_Dyn or MEM_Static).
75361	*/
75362	if( xDel==SQLITE_TRANSIENT ){
75363	u32 nAlloc = nByte;
75364	if( flags&MEM_Term ){
75365	nAlloc += (enc==SQLITE_UTF8?1:2);
75366	}
75367	if( nByte>iLimit ){
75368	return SQLITE_TOOBIG;
75369	}
75370	testcase( nAlloc==0 );
75371	testcase( nAlloc==31 );
75372	testcase( nAlloc==32 );
75373	if( sqlite3VdbeMemClearAndResize(pMem, (int)MAX(nAlloc,32)) ){
75374	return SQLITE_NOMEM_BKPT;
75375	}
75376	memcpy(pMem->z, z, nAlloc);




75377	}else{
75378	sqlite3VdbeMemRelease(pMem);
75379	pMem->z = (char *)z;
75380	if( xDel==SQLITE_DYNAMIC ){
75381	pMem->zMalloc = pMem->z;
75382	pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
75383	}else{
75384	pMem->xDel = xDel;
75385	flags \|= ((xDel==SQLITE_STATIC)?MEM_Static:MEM_Dyn);
75386	}
75387	}
75388
75389	pMem->n = nByte;
75390	pMem->flags = flags;
75391	pMem->enc = (enc==0 ? SQLITE_UTF8 : enc);
	@@ -82206,14 +82291,14 @@
82291	**
82292	** If the result is not a simple column reference (if it is an expression
82293	** or a constant) then useTypes 2, 3, and 4 return NULL.
82294	*/
82295	static const void *columnName(
82296	sqlite3_stmt pStmt, / The statement */
82297	int N, /* Which column to get the name for */
82298	int useUtf16, /* True to return the name as UTF16 */
82299	int useType /* What type of name */
82300	){
82301	const void *ret;
82302	Vdbe *p;
82303	int n;
82304	sqlite3 *db;
	@@ -82230,12 +82315,16 @@
82315	n = sqlite3_column_count(pStmt);
82316	if( N<n && N>=0 ){
82317	N += useType*n;
82318	sqlite3_mutex_enter(db->mutex);
82319	assert( db->mallocFailed==0 );
82320	if( useUtf16 ){
82321	ret = sqlite3_value_text16((sqlite3_value*)&p->aColName[N]);
82322	}else{
82323	ret = sqlite3_value_text((sqlite3_value*)&p->aColName[N]);
82324	}
82325	/* A malloc may have failed inside of the _text() call. If this
82326	** is the case, clear the mallocFailed flag and return NULL.
82327	*/
82328	if( db->mallocFailed ){
82329	sqlite3OomClear(db);
82330	ret = 0;
	@@ -82248,17 +82337,15 @@
82337	/*
82338	** Return the name of the Nth column of the result set returned by SQL
82339	** statement pStmt.
82340	*/
82341	SQLITE_API const char sqlite3_column_name(sqlite3_stmt pStmt, int N){
82342	return columnName(pStmt, N, 0, COLNAME_NAME);

82343	}
82344	#ifndef SQLITE_OMIT_UTF16
82345	SQLITE_API const void sqlite3_column_name16(sqlite3_stmt pStmt, int N){
82346	return columnName(pStmt, N, 1, COLNAME_NAME);

82347	}
82348	#endif
82349
82350	/*
82351	** Constraint: If you have ENABLE_COLUMN_METADATA then you must
	@@ -82273,17 +82360,15 @@
82360	/*
82361	** Return the column declaration type (if applicable) of the 'i'th column
82362	** of the result set of SQL statement pStmt.
82363	*/
82364	SQLITE_API const char sqlite3_column_decltype(sqlite3_stmt pStmt, int N){
82365	return columnName(pStmt, N, 0, COLNAME_DECLTYPE);

82366	}
82367	#ifndef SQLITE_OMIT_UTF16
82368	SQLITE_API const void sqlite3_column_decltype16(sqlite3_stmt pStmt, int N){
82369	return columnName(pStmt, N, 1, COLNAME_DECLTYPE);

82370	}
82371	#endif /* SQLITE_OMIT_UTF16 */
82372	#endif /* SQLITE_OMIT_DECLTYPE */
82373
82374	#ifdef SQLITE_ENABLE_COLUMN_METADATA
	@@ -82291,49 +82376,43 @@
82376	** Return the name of the database from which a result column derives.
82377	** NULL is returned if the result column is an expression or constant or
82378	** anything else which is not an unambiguous reference to a database column.
82379	*/
82380	SQLITE_API const char sqlite3_column_database_name(sqlite3_stmt pStmt, int N){
82381	return columnName(pStmt, N, 0, COLNAME_DATABASE);

82382	}
82383	#ifndef SQLITE_OMIT_UTF16
82384	SQLITE_API const void sqlite3_column_database_name16(sqlite3_stmt pStmt, int N){
82385	return columnName(pStmt, N, 1, COLNAME_DATABASE);

82386	}
82387	#endif /* SQLITE_OMIT_UTF16 */
82388
82389	/*
82390	** Return the name of the table from which a result column derives.
82391	** NULL is returned if the result column is an expression or constant or
82392	** anything else which is not an unambiguous reference to a database column.
82393	*/
82394	SQLITE_API const char sqlite3_column_table_name(sqlite3_stmt pStmt, int N){
82395	return columnName(pStmt, N, 0, COLNAME_TABLE);

82396	}
82397	#ifndef SQLITE_OMIT_UTF16
82398	SQLITE_API const void sqlite3_column_table_name16(sqlite3_stmt pStmt, int N){
82399	return columnName(pStmt, N, 1, COLNAME_TABLE);

82400	}
82401	#endif /* SQLITE_OMIT_UTF16 */
82402
82403	/*
82404	** Return the name of the table column from which a result column derives.
82405	** NULL is returned if the result column is an expression or constant or
82406	** anything else which is not an unambiguous reference to a database column.
82407	*/
82408	SQLITE_API const char sqlite3_column_origin_name(sqlite3_stmt pStmt, int N){
82409	return columnName(pStmt, N, 0, COLNAME_COLUMN);

82410	}
82411	#ifndef SQLITE_OMIT_UTF16
82412	SQLITE_API const void sqlite3_column_origin_name16(sqlite3_stmt pStmt, int N){
82413	return columnName(pStmt, N, 1, COLNAME_COLUMN);

82414	}
82415	#endif /* SQLITE_OMIT_UTF16 */
82416	#endif /* SQLITE_ENABLE_COLUMN_METADATA */
82417
82418
	@@ -83975,10 +84054,19 @@
84054	#endif
84055	/* INSERT STACK UNION HERE */
84056
84057	assert( p->magic==VDBE_MAGIC_RUN ); /* sqlite3_step() verifies this */
84058	sqlite3VdbeEnter(p);
84059	#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
84060	if( db->xProgress ){
84061	u32 iPrior = p->aCounter[SQLITE_STMTSTATUS_VM_STEP];
84062	assert( 0 < db->nProgressOps );
84063	nProgressLimit = db->nProgressOps - (iPrior % db->nProgressOps);
84064	}else{
84065	nProgressLimit = 0xffffffff;
84066	}
84067	#endif
84068	if( p->rc==SQLITE_NOMEM ){
84069	/* This happens if a malloc() inside a call to sqlite3_column_text() or
84070	** sqlite3_column_text16() failed. */
84071	goto no_mem;
84072	}
	@@ -83988,19 +84076,10 @@
84076	assert( p->explain==0 );
84077	p->pResultSet = 0;
84078	db->busyHandler.nBusy = 0;
84079	if( db->u1.isInterrupted ) goto abort_due_to_interrupt;
84080	sqlite3VdbeIOTraceSql(p);









84081	#ifdef SQLITE_DEBUG
84082	sqlite3BeginBenignMalloc();
84083	if( p->pc==0
84084	&& (p->db->flags & (SQLITE_VdbeListing\|SQLITE_VdbeEQP\|SQLITE_VdbeTrace))!=0
84085	){
	@@ -84172,14 +84251,15 @@
84251	** of VDBE ops have been executed (either since this invocation of
84252	** sqlite3VdbeExec() or since last time the progress callback was called).
84253	** If the progress callback returns non-zero, exit the virtual machine with
84254	** a return code SQLITE_ABORT.
84255	*/
84256	while( nVmStep>=nProgressLimit && db->xProgress!=0 ){
84257	assert( db->nProgressOps!=0 );
84258	nProgressLimit += db->nProgressOps;
84259	if( db->xProgress(db->pProgressArg) ){
84260	nProgressLimit = 0xffffffff;
84261	rc = SQLITE_INTERRUPT;
84262	goto abort_due_to_error;
84263	}
84264	}
84265	#endif
	@@ -84454,10 +84534,11 @@
84534
84535	#ifndef SQLITE_OMIT_UTF16
84536	if( encoding!=SQLITE_UTF8 ){
84537	rc = sqlite3VdbeMemSetStr(pOut, pOp->p4.z, -1, SQLITE_UTF8, SQLITE_STATIC);
84538	assert( rc==SQLITE_OK \|\| rc==SQLITE_TOOBIG );
84539	if( rc ) goto too_big;
84540	if( SQLITE_OK!=sqlite3VdbeChangeEncoding(pOut, encoding) ) goto no_mem;
84541	assert( pOut->szMalloc>0 && pOut->zMalloc==pOut->z );
84542	assert( VdbeMemDynamic(pOut)==0 );
84543	pOut->szMalloc = 0;
84544	pOut->flags \|= MEM_Static;
	@@ -84466,11 +84547,10 @@
84547	}
84548	pOp->p4type = P4_DYNAMIC;
84549	pOp->p4.z = pOut->z;
84550	pOp->p1 = pOut->n;
84551	}

84552	#endif
84553	if( pOp->p1>db->aLimit[SQLITE_LIMIT_LENGTH] ){
84554	goto too_big;
84555	}
84556	assert( rc==SQLITE_OK );
	@@ -84721,22 +84801,10 @@
84801	int i;
84802	assert( p->nResColumn==pOp->p2 );
84803	assert( pOp->p1>0 );
84804	assert( pOp->p1+pOp->p2<=(p->nMem+1 - p->nCursor)+1 );
84805












84806	/* If this statement has violated immediate foreign key constraints, do
84807	** not return the number of rows modified. And do not RELEASE the statement
84808	** transaction. It needs to be rolled back. */
84809	if( SQLITE_OK!=(rc = sqlite3VdbeCheckFk(p, 0)) ){
84810	assert( db->flags&SQLITE_CountRows );
	@@ -85959,19 +86027,19 @@
86027	offset64 = aOffset[i];
86028	zHdr = zData + pC->iHdrOffset;
86029	zEndHdr = zData + aOffset[0];
86030	testcase( zHdr>=zEndHdr );
86031	do{
86032	if( (pC->aType[i] = t = zHdr[0])<0x80 ){
86033	zHdr++;
86034	offset64 += sqlite3VdbeOneByteSerialTypeLen(t);
86035	}else{
86036	zHdr += sqlite3GetVarint32(zHdr, &t);
86037	pC->aType[i] = t;
86038	offset64 += sqlite3VdbeSerialTypeLen(t);
86039	}
86040	aOffset[++i] = (u32)(offset64 & 0xffffffff);

86041	}while( i<=p2 && zHdr<zEndHdr );
86042
86043	/* The record is corrupt if any of the following are true:
86044	** (1) the bytes of the header extend past the declared header size
86045	** (2) the entire header was used but not all data was used
	@@ -87933,18 +88001,11 @@
88001	** cause any problems.)
88002	**
88003	** This instruction only works on tables. The equivalent instruction
88004	** for indices is OP_IdxInsert.
88005	*/
88006	case OP_Insert: {







88007	Mem pData; / MEM cell holding data for the record to be inserted */
88008	Mem pKey; / MEM cell holding key for the record */
88009	VdbeCursor pC; / Cursor to table into which insert is written */
88010	int seekResult; /* Result of prior seek or 0 if no USESEEKRESULT flag */
88011	const char zDb; / database name - used by the update hook */
	@@ -87961,20 +88022,15 @@
88022	assert( (pOp->p5 & OPFLAG_ISNOOP) \|\| pC->isTable );
88023	assert( pOp->p4type==P4_TABLE \|\| pOp->p4type>=P4_STATIC );
88024	REGISTER_TRACE(pOp->p2, pData);
88025	sqlite3VdbeIncrWriteCounter(p, pC);
88026
88027	pKey = &aMem[pOp->p3];
88028	assert( pKey->flags & MEM_Int );
88029	assert( memIsValid(pKey) );
88030	REGISTER_TRACE(pOp->p3, pKey);
88031	x.nKey = pKey->u.i;





88032
88033	if( pOp->p4type==P4_TABLE && HAS_UPDATE_HOOK(db) ){
88034	assert( pC->iDb>=0 );
88035	zDb = db->aDb[pC->iDb].zDbSName;
88036	pTab = pOp->p4.pTab;
	@@ -89538,12 +89594,11 @@
89594	aMem[i].flags \|= MEM_Undefined; /* Cause a fault if this reg is reused */
89595	}
89596	}
89597	#endif
89598	pOp = &aOp[-1];
89599	goto check_for_interrupt;

89600	}
89601
89602	/* Opcode: Param P1 P2 * * *
89603	**
89604	** This opcode is only ever present in sub-programs called via the
	@@ -90948,11 +91003,20 @@
91003
91004	/* This is the only way out of this procedure. We have to
91005	** release the mutexes on btrees that were acquired at the
91006	** top. */
91007	vdbe_return:
91008	#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
91009	while( nVmStep>=nProgressLimit && db->xProgress!=0 ){
91010	nProgressLimit += db->nProgressOps;
91011	if( db->xProgress(db->pProgressArg) ){
91012	nProgressLimit = 0xffffffff;
91013	rc = SQLITE_INTERRUPT;
91014	goto abort_due_to_error;
91015	}
91016	}
91017	#endif
91018	p->aCounter[SQLITE_STMTSTATUS_VM_STEP] += (int)nVmStep;
91019	sqlite3VdbeLeave(p);
91020	assert( rc!=SQLITE_OK \|\| nExtraDelete==0
91021	\|\| sqlite3_strlike("DELETE%",p->zSql,0)!=0
91022	);
	@@ -96129,10 +96193,42 @@
96193	}
96194	}
96195	return 0;
96196	}
96197
96198	#ifndef SQLITE_OMIT_WINDOWFUNC
96199	/*
96200	** Walker callback for resolveRemoveWindows().
96201	*/
96202	static int resolveRemoveWindowsCb(Walker pWalker, Expr pExpr){
96203	if( ExprHasProperty(pExpr, EP_WinFunc) ){
96204	Window **pp;
96205	for(pp=&pWalker->u.pSelect->pWin; pp; pp=&(pp)->pNextWin){
96206	if( *pp==pExpr->y.pWin ){
96207	pp = (pp)->pNextWin;
96208	break;
96209	}
96210	}
96211	}
96212	return WRC_Continue;
96213	}
96214
96215	/*
96216	** Remove any Window objects owned by the expression pExpr from the
96217	** Select.pWin list of Select object pSelect.
96218	*/
96219	static void resolveRemoveWindows(Select pSelect, Expr pExpr){
96220	Walker sWalker;
96221	memset(&sWalker, 0, sizeof(Walker));
96222	sWalker.xExprCallback = resolveRemoveWindowsCb;
96223	sWalker.u.pSelect = pSelect;
96224	sqlite3WalkExpr(&sWalker, pExpr);
96225	}
96226	#else
96227	# define resolveRemoveWindows(x,y)
96228	#endif
96229
96230	/*
96231	** pOrderBy is an ORDER BY or GROUP BY clause in SELECT statement pSelect.
96232	** The Name context of the SELECT statement is pNC. zType is either
96233	** "ORDER" or "GROUP" depending on which type of clause pOrderBy is.
96234	**
	@@ -96195,23 +96291,14 @@
96291	if( sqlite3ResolveExprNames(pNC, pE) ){
96292	return 1;
96293	}
96294	for(j=0; j<pSelect->pEList->nExpr; j++){
96295	if( sqlite3ExprCompare(0, pE, pSelect->pEList->a[j].pExpr, -1)==0 ){
96296	/* Since this expresion is being changed into a reference
96297	** to an identical expression in the result set, remove all Window
96298	** objects belonging to the expression from the Select.pWin list. */
96299	resolveRemoveWindows(pSelect, pE);









96300	pItem->u.x.iOrderByCol = j+1;
96301	}
96302	}
96303	}
96304	return sqlite3ResolveOrderGroupBy(pParse, pSelect, pOrderBy, zType);
	@@ -96419,10 +96506,11 @@
96506	return WRC_Abort;
96507	}
96508	}
96509	}
96510
96511	#ifndef SQLITE_OMIT_WINDOWFUNC
96512	if( IN_RENAME_OBJECT ){
96513	Window *pWin;
96514	for(pWin=p->pWinDefn; pWin; pWin=pWin->pNextWin){
96515	if( sqlite3ResolveExprListNames(&sNC, pWin->pOrderBy)
96516	\|\| sqlite3ResolveExprListNames(&sNC, pWin->pPartition)
	@@ -96429,10 +96517,11 @@
96517	){
96518	return WRC_Abort;
96519	}
96520	}
96521	}
96522	#endif
96523
96524	/* If this is part of a compound SELECT, check that it has the right
96525	** number of expressions in the select list. */
96526	if( p->pNext && p->pEList->nExpr!=p->pNext->pEList->nExpr ){
96527	sqlite3SelectWrongNumTermsError(pParse, p->pNext);
	@@ -99179,18 +99268,15 @@
99268	u32 savedNQueryLoop = pParse->nQueryLoop;
99269	int rMayHaveNull = 0;
99270	eType = IN_INDEX_EPH;
99271	if( inFlags & IN_INDEX_LOOP ){
99272	pParse->nQueryLoop = 0;



99273	}else if( prRhsHasNull ){
99274	*prRhsHasNull = rMayHaveNull = ++pParse->nMem;
99275	}
99276	assert( pX->op==TK_IN );
99277	sqlite3CodeRhsOfIN(pParse, pX, iTab);
99278	if( rMayHaveNull ){
99279	sqlite3SetHasNullFlag(v, iTab, rMayHaveNull);
99280	}
99281	pParse->nQueryLoop = savedNQueryLoop;
99282	}
	@@ -99287,16 +99373,10 @@
99373	** constructed ephermeral table is returned. The first time the ephemeral
99374	** table is computed, the cursor number is also stored in pExpr->iTable,
99375	** however the cursor number returned might not be the same, as it might
99376	** have been duplicated using OP_OpenDup.
99377	**






99378	** If the LHS expression ("x" in the examples) is a column value, or
99379	** the SELECT statement returns a column value, then the affinity of that
99380	** column is used to build the index keys. If both 'x' and the
99381	** SELECT... statement are columns, then numeric affinity is used
99382	** if either column has NUMERIC or INTEGER affinity. If neither
	@@ -99304,12 +99384,11 @@
99384	** is used.
99385	*/
99386	SQLITE_PRIVATE void sqlite3CodeRhsOfIN(
99387	Parse pParse, / Parsing context */
99388	Expr pExpr, / The IN operator */
99389	int iTab /* Use this cursor number */

99390	){
99391	int addrOnce = 0; /* Address of the OP_Once instruction at top */
99392	int addr; /* Address of OP_OpenEphemeral instruction */
99393	Expr pLeft; / the LHS of the IN operator */
99394	KeyInfo pKeyInfo = 0; / Key information */
	@@ -99358,26 +99437,24 @@
99437	}
99438
99439	/* Check to see if this is a vector IN operator */
99440	pLeft = pExpr->pLeft;
99441	nVal = sqlite3ExprVectorSize(pLeft);

99442
99443	/* Construct the ephemeral table that will contain the content of
99444	** RHS of the IN operator.
99445	*/
99446	pExpr->iTable = iTab;
99447	addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, pExpr->iTable, nVal);

99448	#ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
99449	if( ExprHasProperty(pExpr, EP_xIsSelect) ){
99450	VdbeComment((v, "Result of SELECT %u", pExpr->x.pSelect->selId));
99451	}else{
99452	VdbeComment((v, "RHS of IN operator"));
99453	}
99454	#endif
99455	pKeyInfo = sqlite3KeyInfoAlloc(pParse->db, nVal, 1);
99456
99457	if( ExprHasProperty(pExpr, EP_xIsSelect) ){
99458	/* Case 1: expr IN (SELECT ...)
99459	**
99460	** Generate code to write the results of the select into the temporary
	@@ -99387,11 +99464,10 @@
99464	ExprList *pEList = pSelect->pEList;
99465
99466	ExplainQueryPlan((pParse, 1, "%sLIST SUBQUERY %d",
99467	addrOnce?"":"CORRELATED ", pSelect->selId
99468	));

99469	/* If the LHS and RHS of the IN operator do not match, that
99470	** error will have been caught long before we reach this point. */
99471	if( ALWAYS(pEList->nExpr==nVal) ){
99472	SelectDest dest;
99473	int i;
	@@ -99440,14 +99516,12 @@
99516	}
99517
99518	/* Loop through each expression in <exprlist>. */
99519	r1 = sqlite3GetTempReg(pParse);
99520	r2 = sqlite3GetTempReg(pParse);

99521	for(i=pList->nExpr, pItem=pList->a; i>0; i--, pItem++){
99522	Expr *pE2 = pItem->pExpr;

99523
99524	/* If the expression is not constant then we will need to
99525	** disable the test that was generated above that makes sure
99526	** this code only executes once. Because for a non-constant
99527	** expression we need to rerun this code each time.
	@@ -99456,24 +99530,13 @@
99530	sqlite3VdbeChangeToNoop(v, addrOnce);
99531	addrOnce = 0;
99532	}
99533
99534	/* Evaluate the expression and insert it into the temp table */
99535	r3 = sqlite3ExprCodeTarget(pParse, pE2, r1);
99536	sqlite3VdbeAddOp4(v, OP_MakeRecord, r3, 1, r2, &affinity, 1);
99537	sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iTab, r2, r3, 1);











99538	}
99539	sqlite3ReleaseTempReg(pParse, r1);
99540	sqlite3ReleaseTempReg(pParse, r2);
99541	}
99542	if( pKeyInfo ){
	@@ -106852,11 +106915,15 @@
106915	assert( pParse->nested<10 ); /* Nesting should only be of limited depth */
106916	va_start(ap, zFormat);
106917	zSql = sqlite3VMPrintf(db, zFormat, ap);
106918	va_end(ap);
106919	if( zSql==0 ){
106920	/* This can result either from an OOM or because the formatted string
106921	** exceeds SQLITE_LIMIT_LENGTH. In the latter case, we need to set
106922	** an error */
106923	if( !db->mallocFailed ) pParse->rc = SQLITE_TOOBIG;
106924	return;
106925	}
106926	pParse->nested++;
106927	memcpy(saveBuf, PARSE_TAIL(pParse), PARSE_TAIL_SZ);
106928	memset(PARSE_TAIL(pParse), 0, PARSE_TAIL_SZ);
106929	sqlite3RunParser(pParse, zSql, &zErrMsg);
	@@ -108413,10 +108480,11 @@
108480	if( db->mallocFailed \|\| pParse->nErr ) return;
108481	pPk = sqlite3PrimaryKeyIndex(pTab);
108482	pTab->iPKey = -1;
108483	}else{
108484	pPk = sqlite3PrimaryKeyIndex(pTab);
108485	assert( pPk!=0 );
108486
108487	/*
108488	** Remove all redundant columns from the PRIMARY KEY. For example, change
108489	** "PRIMARY KEY(a,b,a,b,c,b,c,d)" into just "PRIMARY KEY(a,b,c,d)". Later
108490	** code assumes the PRIMARY KEY contains no repeated columns.
	@@ -108582,10 +108650,15 @@
108650	}
108651	p->tnum = db->init.newTnum;
108652	if( p->tnum==1 ) p->tabFlags \|= TF_Readonly;
108653	}
108654
108655	assert( (p->tabFlags & TF_HasPrimaryKey)==0
108656	\|\| p->iPKey>=0 \|\| sqlite3PrimaryKeyIndex(p)!=0 );
108657	assert( (p->tabFlags & TF_HasPrimaryKey)!=0
108658	\|\| (p->iPKey<0 && sqlite3PrimaryKeyIndex(p)==0) );
108659
108660	/* Special processing for WITHOUT ROWID Tables */
108661	if( tabOpts & TF_WithoutRowid ){
108662	if( (p->tabFlags & TF_Autoincrement) ){
108663	sqlite3ErrorMsg(pParse,
108664	"AUTOINCREMENT not allowed on WITHOUT ROWID tables");
	@@ -117855,11 +117928,13 @@
117928	}
117929	}
117930	sqlite3VdbeAddOp3(v, OP_MakeRecord, regIdx, pIdx->nColumn, aRegIdx[ix]);
117931	VdbeComment((v, "for %s", pIdx->zName));
117932	#ifdef SQLITE_ENABLE_NULL_TRIM
117933	if( pIdx->idxType==SQLITE_IDXTYPE_PRIMARYKEY ){
117934	sqlite3SetMakeRecordP5(v, pIdx->pTable);
117935	}
117936	#endif
117937
117938	/* In an UPDATE operation, if this index is the PRIMARY KEY index
117939	** of a WITHOUT ROWID table and there has been no change the
117940	** primary key, then no collision is possible. The collision detection
	@@ -118105,14 +118180,17 @@
118180	assert( pParse->nested==0 );
118181	pik_flags \|= OPFLAG_NCHANGE;
118182	pik_flags \|= (update_flags & OPFLAG_SAVEPOSITION);
118183	#ifdef SQLITE_ENABLE_PREUPDATE_HOOK
118184	if( update_flags==0 ){
118185	int r = sqlite3GetTempReg(pParse);
118186	sqlite3VdbeAddOp2(v, OP_Integer, 0, r);
118187	sqlite3VdbeAddOp4(v, OP_Insert,
118188	iIdxCur+i, aRegIdx[i], r, (char*)pTab, P4_TABLE
118189	);
118190	sqlite3VdbeChangeP5(v, OPFLAG_ISNOOP);
118191	sqlite3ReleaseTempReg(pParse, r);
118192	}
118193	#endif
118194	}
118195	sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iIdxCur+i, aRegIdx[i],
118196	aRegIdx[i]+1,
	@@ -118533,11 +118611,11 @@
118611	addr2 = sqlite3VdbeAddOp3(v, OP_NotExists, iDest, 0, regRowid);
118612	VdbeCoverage(v);
118613	sqlite3RowidConstraint(pParse, onError, pDest);
118614	sqlite3VdbeJumpHere(v, addr2);
118615	autoIncStep(pParse, regAutoinc, regRowid);
118616	}else if( pDest->pIndex==0 && !(db->mDbFlags & DBFLAG_Vacuum) ){
118617	addr1 = sqlite3VdbeAddOp2(v, OP_NewRowid, iDest, regRowid);
118618	}else{
118619	addr1 = sqlite3VdbeAddOp2(v, OP_Rowid, iSrc, regRowid);
118620	assert( (pDest->tabFlags & TF_Autoincrement)==0 );
118621	}
	@@ -118596,11 +118674,11 @@
118674	if( i==pSrcIdx->nColumn ){
118675	idxInsFlags = OPFLAG_USESEEKRESULT;
118676	sqlite3VdbeAddOp1(v, OP_SeekEnd, iDest);
118677	}
118678	}
118679	if( !HasRowid(pSrc) && pDestIdx->idxType==SQLITE_IDXTYPE_PRIMARYKEY ){
118680	idxInsFlags \|= OPFLAG_NCHANGE;
118681	}
118682	sqlite3VdbeAddOp2(v, OP_IdxInsert, iDest, regData);
118683	sqlite3VdbeChangeP5(v, idxInsFlags\|OPFLAG_APPEND);
118684	sqlite3VdbeAddOp2(v, OP_Next, iSrc, addr1+1); VdbeCoverage(v);
	@@ -136425,11 +136503,10 @@
136503	pIn += i;
136504	for(i=iEq;i<pLoop->nLTerm; i++){
136505	if( pLoop->aLTerm[i]->pExpr==pX ){
136506	int iOut = iReg + i - iEq;
136507	if( eType==IN_INDEX_ROWID ){

136508	pIn->addrInTop = sqlite3VdbeAddOp2(v, OP_Rowid, iTab, iOut);
136509	}else{
136510	int iCol = aiMap ? aiMap[iMap++] : 0;
136511	pIn->addrInTop = sqlite3VdbeAddOp3(v,OP_Column,iTab, iCol, iOut);
136512	}
	@@ -137187,10 +137264,13 @@
137264	if( iRowidReg!=iReleaseReg ) sqlite3ReleaseTempReg(pParse, iReleaseReg);
137265	addrNxt = pLevel->addrNxt;
137266	sqlite3VdbeAddOp3(v, OP_SeekRowid, iCur, addrNxt, iRowidReg);
137267	VdbeCoverage(v);
137268	pLevel->op = OP_Noop;
137269	if( (pTerm->prereqAll & pLevel->notReady)==0 ){
137270	pTerm->wtFlags \|= TERM_CODED;
137271	}
137272	}else if( (pLoop->wsFlags & WHERE_IPK)!=0
137273	&& (pLoop->wsFlags & WHERE_COLUMN_RANGE)!=0
137274	){
137275	/* Case 3: We have an inequality comparison against the ROWID field.
137276	*/
	@@ -153009,10 +153089,11 @@
153089	int n = 0; /* Length of the next token token */
153090	int tokenType; /* type of the next token */
153091	int lastTokenParsed = -1; /* type of the previous token */
153092	sqlite3 db = pParse->db; / The database connection */
153093	int mxSqlLen; /* Max length of an SQL string */
153094	VVA_ONLY( u8 startedWithOom = db->mallocFailed );
153095	#ifdef sqlite3Parser_ENGINEALWAYSONSTACK
153096	yyParser sEngine; /* Space to hold the Lemon-generated Parser object */
153097	#endif
153098
153099	assert( zSql!=0 );
	@@ -153043,10 +153124,12 @@
153124	#endif
153125	assert( pParse->pNewTable==0 );
153126	assert( pParse->pNewTrigger==0 );
153127	assert( pParse->nVar==0 );
153128	assert( pParse->pVList==0 );
153129	pParse->pParentParse = db->pParse;
153130	db->pParse = pParse;
153131	while( 1 ){
153132	n = sqlite3GetToken((u8*)zSql, &tokenType);
153133	mxSqlLen -= n;
153134	if( mxSqlLen<0 ){
153135	pParse->rc = SQLITE_TOOBIG;
	@@ -153099,11 +153182,12 @@
153182	pParse->sLastToken.z = zSql;
153183	pParse->sLastToken.n = n;
153184	sqlite3Parser(pEngine, tokenType, pParse->sLastToken);
153185	lastTokenParsed = tokenType;
153186	zSql += n;
153187	assert( db->mallocFailed==0 \|\| pParse->rc!=SQLITE_OK \|\| startedWithOom );
153188	if( pParse->rc!=SQLITE_OK ) break;
153189	}
153190	assert( nErr==0 );
153191	#ifdef YYTRACKMAXSTACKDEPTH
153192	sqlite3_mutex_enter(sqlite3MallocMutex());
153193	sqlite3StatusHighwater(SQLITE_STATUS_PARSER_STACK,
	@@ -153167,10 +153251,12 @@
153251	while( pParse->pZombieTab ){
153252	Table *p = pParse->pZombieTab;
153253	pParse->pZombieTab = p->pNextZombie;
153254	sqlite3DeleteTable(db, p);
153255	}
153256	db->pParse = pParse->pParentParse;
153257	pParse->pParentParse = 0;
153258	assert( nErr==0 \|\| pParse->rc!=SQLITE_OK );
153259	return nErr;
153260	}
153261
153262
	@@ -170805,11 +170891,13 @@
170891
170892	fts3SegReaderSetEof(pReader);
170893
170894	/* If iCurrentBlock>=iLeafEndBlock, this is an EOF condition. All leaf
170895	** blocks have already been traversed. */
170896	#ifdef CORRUPT_DB
170897	assert( pReader->iCurrentBlock<=pReader->iLeafEndBlock \|\| CORRUPT_DB );
170898	#endif
170899	if( pReader->iCurrentBlock>=pReader->iLeafEndBlock ){
170900	return SQLITE_OK;
170901	}
170902
170903	rc = sqlite3Fts3ReadBlock(
	@@ -172692,12 +172780,14 @@
172780	bIgnoreEmpty = (iLevel!=FTS3_SEGCURSOR_PENDING) && (iNewLevel>iMaxLevel);
172781	}
172782	if( rc!=SQLITE_OK ) goto finished;
172783
172784	assert( csr.nSegment>0 );
172785	assert_fts3_nc( iNewLevel>=getAbsoluteLevel(p, iLangid, iIndex, 0) );
172786	assert_fts3_nc(
172787	iNewLevel<getAbsoluteLevel(p, iLangid, iIndex,FTS3_SEGDIR_MAXLEVEL)
172788	);
172789
172790	memset(&filter, 0, sizeof(Fts3SegFilter));
172791	filter.flags = FTS3_SEGMENT_REQUIRE_POS;
172792	filter.flags \|= (bIgnoreEmpty ? FTS3_SEGMENT_IGNORE_EMPTY : 0);
172793
	@@ -176712,11 +176802,11 @@
176802	UNUSED_PARAMETER(iPhrase);
176803	rc = sqlite3Fts3EvalPhrasePoslist(p->pCsr, pExpr, p->iCol, &pList);
176804	nTerm = pExpr->pPhrase->nToken;
176805	if( pList ){
176806	fts3GetDeltaPosition(&pList, &iPos);
176807	assert_fts3_nc( iPos>=0 );
176808	}
176809
176810	for(iTerm=0; iTerm<nTerm; iTerm++){
176811	TermOffset *pT = &p->aTerm[p->iTerm++];
176812	pT->iOff = nTerm-iTerm-1;
	@@ -176822,11 +176912,11 @@
176912
176913	if( !pTerm ){
176914	/* All offsets for this column have been gathered. */
176915	rc = SQLITE_DONE;
176916	}else{
176917	assert_fts3_nc( iCurrent<=iMinPos );
176918	if( 0==(0xFE&*pTerm->pList) ){
176919	pTerm->pList = 0;
176920	}else{
176921	fts3GetDeltaPosition(&pTerm->pList, &pTerm->iPos);
176922	}
	@@ -188622,10 +188712,11 @@
188712	if( aOut==0 ){
188713	sqlite3_result_error_nomem(context);
188714	}else{
188715	nOut2 = rbuDeltaApply(aOrig, nOrig, aDelta, nDelta, aOut);
188716	if( nOut2!=nOut ){
188717	sqlite3_free(aOut);
188718	sqlite3_result_error(context, "corrupt fossil delta", -1);
188719	}else{
188720	sqlite3_result_blob(context, aOut, nOut, sqlite3_free);
188721	}
188722	}
	@@ -199681,11 +199772,11 @@
199772	** xSetAuxdata(pFts5, pAux, xDelete)
199773	**
199774	** Save the pointer passed as the second argument as the extension functions
199775	** "auxiliary data". The pointer may then be retrieved by the current or any
199776	** future invocation of the same fts5 extension function made as part of
199777	** the same MATCH query using the xGetAuxdata() API.
199778	**
199779	** Each extension function is allocated a single auxiliary data slot for
199780	** each FTS query (MATCH expression). If the extension function is invoked
199781	** more than once for a single FTS query, then all invocations share a
199782	** single auxiliary data context.
	@@ -199696,11 +199787,11 @@
199787	** point.
199788	**
199789	** The xDelete callback, if one is specified, is also invoked on the
199790	** auxiliary data pointer after the FTS5 query has finished.
199791	**
199792	** If an error (e.g. an OOM condition) occurs within this function,
199793	** the auxiliary data is set to NULL and an error code returned. If the
199794	** xDelete parameter was not NULL, it is invoked on the auxiliary data
199795	** pointer before returning.
199796	**
199797	**
	@@ -212031,17 +212122,18 @@
212122	}
212123
212124	/* Set up the new page-index array */
212125	fts5BufferAppendVarint(&p->rc, &buf, 4);
212126	if( pSeg->iLeafPgno==pSeg->iTermLeafPgno
212127	&& pSeg->iEndofDoclist<pData->szLeaf
212128	&& pSeg->iPgidxOff<=pData->nn
212129	){
212130	int nDiff = pData->szLeaf - pSeg->iEndofDoclist;
212131	fts5BufferAppendVarint(&p->rc, &buf, buf.n - 1 - nDiff - 4);
212132	fts5BufferAppendBlob(&p->rc, &buf,
212133	pData->nn - pSeg->iPgidxOff, &pData->p[pSeg->iPgidxOff]
212134	);
212135	}
212136
212137	pSeg->pSeg->pgnoFirst = pSeg->iTermLeafPgno;
212138	fts5DataDelete(p, FTS5_SEGMENT_ROWID(iId, 1), iLeafRowid);
212139	fts5DataWrite(p, iLeafRowid, buf.p, buf.n);
	@@ -217074,11 +217166,11 @@
217166	int nArg, /* Number of args */
217167	sqlite3_value *apUnused / Function arguments */
217168	){
217169	assert( nArg==0 );
217170	UNUSED_PARAM2(nArg, apUnused);
217171	sqlite3_result_text(pCtx, "fts5: 2019-02-25 14:52:43 9da4fb59b28686630d63a79988b458726332cf06cc0e6e84d7c0a7600f5fcab0", -1, SQLITE_TRANSIENT);
217172	}
217173
217174	/*
217175	** Return true if zName is the extension on one of the shadow tables used
217176	** by this module.
	@@ -221838,12 +221930,12 @@
221930	}
221931	#endif /* SQLITE_CORE */
221932	#endif /* !defined(SQLITE_CORE) \|\| defined(SQLITE_ENABLE_STMTVTAB) */
221933
221934	/************ End of stmt.c **********************************************/
221935	#if __LINE__!=221935
221936	#undef SQLITE_SOURCE_ID
221937	#define SQLITE_SOURCE_ID "2019-02-25 14:52:43 9da4fb59b28686630d63a79988b458726332cf06cc0e6e84d7c0a7600f5falt2"
221938	#endif
221939	/* Return the source-id for this library */
221940	SQLITE_API const char *sqlite3_sourceid(void){ return SQLITE_SOURCE_ID; }
221941	/************************ End of sqlite3.c ****************************/
221942

M src/sqlite3.h

+6 -6

		--- src/sqlite3.h
		+++ src/sqlite3.h
		@@ -121,13 +121,13 @@
121	121	**
122	122	** See also: [sqlite3_libversion()],
123	123	** [sqlite3_libversion_number()], [sqlite3_sourceid()],
124	124	** [sqlite_version()] and [sqlite_source_id()].
125	125	*/
126		-#define SQLITE_VERSION "3.27.1"
127		-#define SQLITE_VERSION_NUMBER 3027001
128		-#define SQLITE_SOURCE_ID "2019-02-08 13:17:39 0eca3dd3d38b31c92b49ca2d311128b74584714d9e7de895b1a6286ef959a1dd"
	126	+#define SQLITE_VERSION "3.28.0"
	127	+#define SQLITE_VERSION_NUMBER 3028000
	128	+#define SQLITE_SOURCE_ID "2019-02-25 14:52:43 9da4fb59b28686630d63a79988b458726332cf06cc0e6e84d7c0a7600f5fcab0"
129	129
130	130	/*
131	131	** CAPI3REF: Run-Time Library Version Numbers
132	132	** KEYWORDS: sqlite3_version sqlite3_sourceid
133	133	**
		@@ -2367,11 +2367,11 @@
2367	2367	** ^Changes made as part of [foreign key actions] are included in the
2368	2368	** count, but those made as part of REPLACE constraint resolution are
2369	2369	** not. ^Changes to a view that are intercepted by INSTEAD OF triggers
2370	2370	** are not counted.
2371	2371	**
2372		-** This the [sqlite3_total_changes(D)] interface only reports the number
	2372	+** The [sqlite3_total_changes(D)] interface only reports the number
2373	2373	** of rows that changed due to SQL statement run against database
2374	2374	** connection D. Any changes by other database connections are ignored.
2375	2375	** To detect changes against a database file from other database
2376	2376	** connections use the [PRAGMA data_version] command or the
2377	2377	** [SQLITE_FCNTL_DATA_VERSION] [file control].
		@@ -11299,11 +11299,11 @@
11299	11299	** xSetAuxdata(pFts5, pAux, xDelete)
11300	11300	**
11301	11301	** Save the pointer passed as the second argument as the extension functions
11302	11302	** "auxiliary data". The pointer may then be retrieved by the current or any
11303	11303	** future invocation of the same fts5 extension function made as part of
11304		-** of the same MATCH query using the xGetAuxdata() API.
	11304	+** the same MATCH query using the xGetAuxdata() API.
11305	11305	**
11306	11306	** Each extension function is allocated a single auxiliary data slot for
11307	11307	** each FTS query (MATCH expression). If the extension function is invoked
11308	11308	** more than once for a single FTS query, then all invocations share a
11309	11309	** single auxiliary data context.
		@@ -11314,11 +11314,11 @@
11314	11314	** point.
11315	11315	**
11316	11316	** The xDelete callback, if one is specified, is also invoked on the
11317	11317	** auxiliary data pointer after the FTS5 query has finished.
11318	11318	**
11319		-** If an error (e.g. an OOM condition) occurs within this function, an
	11319	+** If an error (e.g. an OOM condition) occurs within this function,
11320	11320	** the auxiliary data is set to NULL and an error code returned. If the
11321	11321	** xDelete parameter was not NULL, it is invoked on the auxiliary data
11322	11322	** pointer before returning.
11323	11323	**
11324	11324	**
11325	11325

	--- src/sqlite3.h
	+++ src/sqlite3.h
	@@ -121,13 +121,13 @@
121	**
122	** See also: [sqlite3_libversion()],
123	** [sqlite3_libversion_number()], [sqlite3_sourceid()],
124	** [sqlite_version()] and [sqlite_source_id()].
125	*/
126	#define SQLITE_VERSION "3.27.1"
127	#define SQLITE_VERSION_NUMBER 3027001
128	#define SQLITE_SOURCE_ID "2019-02-08 13:17:39 0eca3dd3d38b31c92b49ca2d311128b74584714d9e7de895b1a6286ef959a1dd"
129
130	/*
131	** CAPI3REF: Run-Time Library Version Numbers
132	** KEYWORDS: sqlite3_version sqlite3_sourceid
133	**
	@@ -2367,11 +2367,11 @@
2367	** ^Changes made as part of [foreign key actions] are included in the
2368	** count, but those made as part of REPLACE constraint resolution are
2369	** not. ^Changes to a view that are intercepted by INSTEAD OF triggers
2370	** are not counted.
2371	**
2372	** This the [sqlite3_total_changes(D)] interface only reports the number
2373	** of rows that changed due to SQL statement run against database
2374	** connection D. Any changes by other database connections are ignored.
2375	** To detect changes against a database file from other database
2376	** connections use the [PRAGMA data_version] command or the
2377	** [SQLITE_FCNTL_DATA_VERSION] [file control].
	@@ -11299,11 +11299,11 @@
11299	** xSetAuxdata(pFts5, pAux, xDelete)
11300	**
11301	** Save the pointer passed as the second argument as the extension functions
11302	** "auxiliary data". The pointer may then be retrieved by the current or any
11303	** future invocation of the same fts5 extension function made as part of
11304	** of the same MATCH query using the xGetAuxdata() API.
11305	**
11306	** Each extension function is allocated a single auxiliary data slot for
11307	** each FTS query (MATCH expression). If the extension function is invoked
11308	** more than once for a single FTS query, then all invocations share a
11309	** single auxiliary data context.
	@@ -11314,11 +11314,11 @@
11314	** point.
11315	**
11316	** The xDelete callback, if one is specified, is also invoked on the
11317	** auxiliary data pointer after the FTS5 query has finished.
11318	**
11319	** If an error (e.g. an OOM condition) occurs within this function, an
11320	** the auxiliary data is set to NULL and an error code returned. If the
11321	** xDelete parameter was not NULL, it is invoked on the auxiliary data
11322	** pointer before returning.
11323	**
11324	**
11325

	--- src/sqlite3.h
	+++ src/sqlite3.h
	@@ -121,13 +121,13 @@
121	**
122	** See also: [sqlite3_libversion()],
123	** [sqlite3_libversion_number()], [sqlite3_sourceid()],
124	** [sqlite_version()] and [sqlite_source_id()].
125	*/
126	#define SQLITE_VERSION "3.28.0"
127	#define SQLITE_VERSION_NUMBER 3028000
128	#define SQLITE_SOURCE_ID "2019-02-25 14:52:43 9da4fb59b28686630d63a79988b458726332cf06cc0e6e84d7c0a7600f5fcab0"
129
130	/*
131	** CAPI3REF: Run-Time Library Version Numbers
132	** KEYWORDS: sqlite3_version sqlite3_sourceid
133	**
	@@ -2367,11 +2367,11 @@
2367	** ^Changes made as part of [foreign key actions] are included in the
2368	** count, but those made as part of REPLACE constraint resolution are
2369	** not. ^Changes to a view that are intercepted by INSTEAD OF triggers
2370	** are not counted.
2371	**
2372	** The [sqlite3_total_changes(D)] interface only reports the number
2373	** of rows that changed due to SQL statement run against database
2374	** connection D. Any changes by other database connections are ignored.
2375	** To detect changes against a database file from other database
2376	** connections use the [PRAGMA data_version] command or the
2377	** [SQLITE_FCNTL_DATA_VERSION] [file control].
	@@ -11299,11 +11299,11 @@
11299	** xSetAuxdata(pFts5, pAux, xDelete)
11300	**
11301	** Save the pointer passed as the second argument as the extension functions
11302	** "auxiliary data". The pointer may then be retrieved by the current or any
11303	** future invocation of the same fts5 extension function made as part of
11304	** the same MATCH query using the xGetAuxdata() API.
11305	**
11306	** Each extension function is allocated a single auxiliary data slot for
11307	** each FTS query (MATCH expression). If the extension function is invoked
11308	** more than once for a single FTS query, then all invocations share a
11309	** single auxiliary data context.
	@@ -11314,11 +11314,11 @@
11314	** point.
11315	**
11316	** The xDelete callback, if one is specified, is also invoked on the
11317	** auxiliary data pointer after the FTS5 query has finished.
11318	**
11319	** If an error (e.g. an OOM condition) occurs within this function,
11320	** the auxiliary data is set to NULL and an error code returned. If the
11321	** xDelete parameter was not NULL, it is invoked on the auxiliary data
11322	** pointer before returning.
11323	**
11324	**
11325

Fossil SCM

Keyboard Shortcuts