xref: /sqlite-3.40.0/src/resolve.c (revision 29368eab)
1 /*
2 ** 2008 August 18
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 **
13 ** This file contains routines used for walking the parser tree and
14 ** resolve all identifiers by associating them with a particular
15 ** table and column.
16 */
17 #include "sqliteInt.h"
18 
19 /*
20 ** Walk the expression tree pExpr and increase the aggregate function
21 ** depth (the Expr.op2 field) by N on every TK_AGG_FUNCTION node.
22 ** This needs to occur when copying a TK_AGG_FUNCTION node from an
23 ** outer query into an inner subquery.
24 **
25 ** incrAggFunctionDepth(pExpr,n) is the main routine.  incrAggDepth(..)
26 ** is a helper function - a callback for the tree walker.
27 */
28 static int incrAggDepth(Walker *pWalker, Expr *pExpr){
29   if( pExpr->op==TK_AGG_FUNCTION ) pExpr->op2 += pWalker->u.n;
30   return WRC_Continue;
31 }
32 static void incrAggFunctionDepth(Expr *pExpr, int N){
33   if( N>0 ){
34     Walker w;
35     memset(&w, 0, sizeof(w));
36     w.xExprCallback = incrAggDepth;
37     w.u.n = N;
38     sqlite3WalkExpr(&w, pExpr);
39   }
40 }
41 
42 /*
43 ** Turn the pExpr expression into an alias for the iCol-th column of the
44 ** result set in pEList.
45 **
46 ** If the reference is followed by a COLLATE operator, then make sure
47 ** the COLLATE operator is preserved.  For example:
48 **
49 **     SELECT a+b, c+d FROM t1 ORDER BY 1 COLLATE nocase;
50 **
51 ** Should be transformed into:
52 **
53 **     SELECT a+b, c+d FROM t1 ORDER BY (a+b) COLLATE nocase;
54 **
55 ** The nSubquery parameter specifies how many levels of subquery the
56 ** alias is removed from the original expression.  The usual value is
57 ** zero but it might be more if the alias is contained within a subquery
58 ** of the original expression.  The Expr.op2 field of TK_AGG_FUNCTION
59 ** structures must be increased by the nSubquery amount.
60 */
61 static void resolveAlias(
62   Parse *pParse,         /* Parsing context */
63   ExprList *pEList,      /* A result set */
64   int iCol,              /* A column in the result set.  0..pEList->nExpr-1 */
65   Expr *pExpr,           /* Transform this into an alias to the result set */
66   const char *zType,     /* "GROUP" or "ORDER" or "" */
67   int nSubquery          /* Number of subqueries that the label is moving */
68 ){
69   Expr *pOrig;           /* The iCol-th column of the result set */
70   Expr *pDup;            /* Copy of pOrig */
71   sqlite3 *db;           /* The database connection */
72 
73   assert( iCol>=0 && iCol<pEList->nExpr );
74   pOrig = pEList->a[iCol].pExpr;
75   assert( pOrig!=0 );
76   db = pParse->db;
77   pDup = sqlite3ExprDup(db, pOrig, 0);
78   if( pDup!=0 ){
79     if( zType[0]!='G' ) incrAggFunctionDepth(pDup, nSubquery);
80     if( pExpr->op==TK_COLLATE ){
81       pDup = sqlite3ExprAddCollateString(pParse, pDup, pExpr->u.zToken);
82     }
83 
84     /* Before calling sqlite3ExprDelete(), set the EP_Static flag. This
85     ** prevents ExprDelete() from deleting the Expr structure itself,
86     ** allowing it to be repopulated by the memcpy() on the following line.
87     ** The pExpr->u.zToken might point into memory that will be freed by the
88     ** sqlite3DbFree(db, pDup) on the last line of this block, so be sure to
89     ** make a copy of the token before doing the sqlite3DbFree().
90     */
91     ExprSetProperty(pExpr, EP_Static);
92     sqlite3ExprDelete(db, pExpr);
93     memcpy(pExpr, pDup, sizeof(*pExpr));
94     if( !ExprHasProperty(pExpr, EP_IntValue) && pExpr->u.zToken!=0 ){
95       assert( (pExpr->flags & (EP_Reduced|EP_TokenOnly))==0 );
96       pExpr->u.zToken = sqlite3DbStrDup(db, pExpr->u.zToken);
97       pExpr->flags |= EP_MemToken;
98     }
99     if( ExprHasProperty(pExpr, EP_WinFunc) ){
100       if( pExpr->y.pWin!=0 ){
101         pExpr->y.pWin->pOwner = pExpr;
102       }else{
103         assert( db->mallocFailed );
104       }
105     }
106     sqlite3DbFree(db, pDup);
107   }
108   ExprSetProperty(pExpr, EP_Alias);
109 }
110 
111 
112 /*
113 ** Return TRUE if the name zCol occurs anywhere in the USING clause.
114 **
115 ** Return FALSE if the USING clause is NULL or if it does not contain
116 ** zCol.
117 */
118 static int nameInUsingClause(IdList *pUsing, const char *zCol){
119   if( pUsing ){
120     int k;
121     for(k=0; k<pUsing->nId; k++){
122       if( sqlite3StrICmp(pUsing->a[k].zName, zCol)==0 ) return 1;
123     }
124   }
125   return 0;
126 }
127 
128 /*
129 ** Subqueries stores the original database, table and column names for their
130 ** result sets in ExprList.a[].zSpan, in the form "DATABASE.TABLE.COLUMN".
131 ** Check to see if the zSpan given to this routine matches the zDb, zTab,
132 ** and zCol.  If any of zDb, zTab, and zCol are NULL then those fields will
133 ** match anything.
134 */
135 int sqlite3MatchSpanName(
136   const char *zSpan,
137   const char *zCol,
138   const char *zTab,
139   const char *zDb
140 ){
141   int n;
142   for(n=0; ALWAYS(zSpan[n]) && zSpan[n]!='.'; n++){}
143   if( zDb && (sqlite3StrNICmp(zSpan, zDb, n)!=0 || zDb[n]!=0) ){
144     return 0;
145   }
146   zSpan += n+1;
147   for(n=0; ALWAYS(zSpan[n]) && zSpan[n]!='.'; n++){}
148   if( zTab && (sqlite3StrNICmp(zSpan, zTab, n)!=0 || zTab[n]!=0) ){
149     return 0;
150   }
151   zSpan += n+1;
152   if( zCol && sqlite3StrICmp(zSpan, zCol)!=0 ){
153     return 0;
154   }
155   return 1;
156 }
157 
158 /*
159 ** Return TRUE if the double-quoted string  mis-feature should be supported.
160 */
161 static int areDoubleQuotedStringsEnabled(sqlite3 *db, NameContext *pTopNC){
162   if( db->init.busy ) return 1;  /* Always support for legacy schemas */
163   if( pTopNC->ncFlags & NC_IsDDL ){
164     /* Currently parsing a DDL statement */
165     if( sqlite3WritableSchema(db) && (db->flags & SQLITE_DqsDML)!=0 ){
166       return 1;
167     }
168     return (db->flags & SQLITE_DqsDDL)!=0;
169   }else{
170     /* Currently parsing a DML statement */
171     return (db->flags & SQLITE_DqsDML)!=0;
172   }
173 }
174 
175 /*
176 ** Given the name of a column of the form X.Y.Z or Y.Z or just Z, look up
177 ** that name in the set of source tables in pSrcList and make the pExpr
178 ** expression node refer back to that source column.  The following changes
179 ** are made to pExpr:
180 **
181 **    pExpr->iDb           Set the index in db->aDb[] of the database X
182 **                         (even if X is implied).
183 **    pExpr->iTable        Set to the cursor number for the table obtained
184 **                         from pSrcList.
185 **    pExpr->y.pTab        Points to the Table structure of X.Y (even if
186 **                         X and/or Y are implied.)
187 **    pExpr->iColumn       Set to the column number within the table.
188 **    pExpr->op            Set to TK_COLUMN.
189 **    pExpr->pLeft         Any expression this points to is deleted
190 **    pExpr->pRight        Any expression this points to is deleted.
191 **
192 ** The zDb variable is the name of the database (the "X").  This value may be
193 ** NULL meaning that name is of the form Y.Z or Z.  Any available database
194 ** can be used.  The zTable variable is the name of the table (the "Y").  This
195 ** value can be NULL if zDb is also NULL.  If zTable is NULL it
196 ** means that the form of the name is Z and that columns from any table
197 ** can be used.
198 **
199 ** If the name cannot be resolved unambiguously, leave an error message
200 ** in pParse and return WRC_Abort.  Return WRC_Prune on success.
201 */
202 static int lookupName(
203   Parse *pParse,       /* The parsing context */
204   const char *zDb,     /* Name of the database containing table, or NULL */
205   const char *zTab,    /* Name of table containing column, or NULL */
206   const char *zCol,    /* Name of the column. */
207   NameContext *pNC,    /* The name context used to resolve the name */
208   Expr *pExpr          /* Make this EXPR node point to the selected column */
209 ){
210   int i, j;                         /* Loop counters */
211   int cnt = 0;                      /* Number of matching column names */
212   int cntTab = 0;                   /* Number of matching table names */
213   int nSubquery = 0;                /* How many levels of subquery */
214   sqlite3 *db = pParse->db;         /* The database connection */
215   struct SrcList_item *pItem;       /* Use for looping over pSrcList items */
216   struct SrcList_item *pMatch = 0;  /* The matching pSrcList item */
217   NameContext *pTopNC = pNC;        /* First namecontext in the list */
218   Schema *pSchema = 0;              /* Schema of the expression */
219   int eNewExprOp = TK_COLUMN;       /* New value for pExpr->op on success */
220   Table *pTab = 0;                  /* Table hold the row */
221   Column *pCol;                     /* A column of pTab */
222 
223   assert( pNC );     /* the name context cannot be NULL. */
224   assert( zCol );    /* The Z in X.Y.Z cannot be NULL */
225   assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
226 
227   /* Initialize the node to no-match */
228   pExpr->iTable = -1;
229   ExprSetVVAProperty(pExpr, EP_NoReduce);
230 
231   /* Translate the schema name in zDb into a pointer to the corresponding
232   ** schema.  If not found, pSchema will remain NULL and nothing will match
233   ** resulting in an appropriate error message toward the end of this routine
234   */
235   if( zDb ){
236     testcase( pNC->ncFlags & NC_PartIdx );
237     testcase( pNC->ncFlags & NC_IsCheck );
238     if( (pNC->ncFlags & (NC_PartIdx|NC_IsCheck))!=0 ){
239       /* Silently ignore database qualifiers inside CHECK constraints and
240       ** partial indices.  Do not raise errors because that might break
241       ** legacy and because it does not hurt anything to just ignore the
242       ** database name. */
243       zDb = 0;
244     }else{
245       for(i=0; i<db->nDb; i++){
246         assert( db->aDb[i].zDbSName );
247         if( sqlite3StrICmp(db->aDb[i].zDbSName,zDb)==0 ){
248           pSchema = db->aDb[i].pSchema;
249           break;
250         }
251       }
252     }
253   }
254 
255   /* Start at the inner-most context and move outward until a match is found */
256   assert( pNC && cnt==0 );
257   do{
258     ExprList *pEList;
259     SrcList *pSrcList = pNC->pSrcList;
260 
261     if( pSrcList ){
262       for(i=0, pItem=pSrcList->a; i<pSrcList->nSrc; i++, pItem++){
263         pTab = pItem->pTab;
264         assert( pTab!=0 && pTab->zName!=0 );
265         assert( pTab->nCol>0 );
266         if( pItem->pSelect && (pItem->pSelect->selFlags & SF_NestedFrom)!=0 ){
267           int hit = 0;
268           pEList = pItem->pSelect->pEList;
269           for(j=0; j<pEList->nExpr; j++){
270             if( sqlite3MatchSpanName(pEList->a[j].zSpan, zCol, zTab, zDb) ){
271               cnt++;
272               cntTab = 2;
273               pMatch = pItem;
274               pExpr->iColumn = j;
275               hit = 1;
276             }
277           }
278           if( hit || zTab==0 ) continue;
279         }
280         if( zDb && pTab->pSchema!=pSchema ){
281           continue;
282         }
283         if( zTab ){
284           const char *zTabName = pItem->zAlias ? pItem->zAlias : pTab->zName;
285           assert( zTabName!=0 );
286           if( sqlite3StrICmp(zTabName, zTab)!=0 ){
287             continue;
288           }
289           if( IN_RENAME_OBJECT && pItem->zAlias ){
290             sqlite3RenameTokenRemap(pParse, 0, (void*)&pExpr->y.pTab);
291           }
292         }
293         if( 0==(cntTab++) ){
294           pMatch = pItem;
295         }
296         for(j=0, pCol=pTab->aCol; j<pTab->nCol; j++, pCol++){
297           if( sqlite3StrICmp(pCol->zName, zCol)==0 ){
298             /* If there has been exactly one prior match and this match
299             ** is for the right-hand table of a NATURAL JOIN or is in a
300             ** USING clause, then skip this match.
301             */
302             if( cnt==1 ){
303               if( pItem->fg.jointype & JT_NATURAL ) continue;
304               if( nameInUsingClause(pItem->pUsing, zCol) ) continue;
305             }
306             cnt++;
307             pMatch = pItem;
308             /* Substitute the rowid (column -1) for the INTEGER PRIMARY KEY */
309             pExpr->iColumn = j==pTab->iPKey ? -1 : (i16)j;
310             break;
311           }
312         }
313       }
314       if( pMatch ){
315         pExpr->iTable = pMatch->iCursor;
316         pExpr->y.pTab = pMatch->pTab;
317         /* RIGHT JOIN not (yet) supported */
318         assert( (pMatch->fg.jointype & JT_RIGHT)==0 );
319         if( (pMatch->fg.jointype & JT_LEFT)!=0 ){
320           ExprSetProperty(pExpr, EP_CanBeNull);
321         }
322         pSchema = pExpr->y.pTab->pSchema;
323       }
324     } /* if( pSrcList ) */
325 
326 #if !defined(SQLITE_OMIT_TRIGGER) || !defined(SQLITE_OMIT_UPSERT)
327     /* If we have not already resolved the name, then maybe
328     ** it is a new.* or old.* trigger argument reference.  Or
329     ** maybe it is an excluded.* from an upsert.
330     */
331     if( zDb==0 && zTab!=0 && cntTab==0 ){
332       pTab = 0;
333 #ifndef SQLITE_OMIT_TRIGGER
334       if( pParse->pTriggerTab!=0 ){
335         int op = pParse->eTriggerOp;
336         assert( op==TK_DELETE || op==TK_UPDATE || op==TK_INSERT );
337         if( op!=TK_DELETE && sqlite3StrICmp("new",zTab) == 0 ){
338           pExpr->iTable = 1;
339           pTab = pParse->pTriggerTab;
340         }else if( op!=TK_INSERT && sqlite3StrICmp("old",zTab)==0 ){
341           pExpr->iTable = 0;
342           pTab = pParse->pTriggerTab;
343         }
344       }
345 #endif /* SQLITE_OMIT_TRIGGER */
346 #ifndef SQLITE_OMIT_UPSERT
347       if( (pNC->ncFlags & NC_UUpsert)!=0 ){
348         Upsert *pUpsert = pNC->uNC.pUpsert;
349         if( pUpsert && sqlite3StrICmp("excluded",zTab)==0 ){
350           pTab = pUpsert->pUpsertSrc->a[0].pTab;
351           pExpr->iTable = 2;
352         }
353       }
354 #endif /* SQLITE_OMIT_UPSERT */
355 
356       if( pTab ){
357         int iCol;
358         pSchema = pTab->pSchema;
359         cntTab++;
360         for(iCol=0, pCol=pTab->aCol; iCol<pTab->nCol; iCol++, pCol++){
361           if( sqlite3StrICmp(pCol->zName, zCol)==0 ){
362             if( iCol==pTab->iPKey ){
363               iCol = -1;
364             }
365             break;
366           }
367         }
368         if( iCol>=pTab->nCol && sqlite3IsRowid(zCol) && VisibleRowid(pTab) ){
369           /* IMP: R-51414-32910 */
370           iCol = -1;
371         }
372         if( iCol<pTab->nCol ){
373           cnt++;
374 #ifndef SQLITE_OMIT_UPSERT
375           if( pExpr->iTable==2 ){
376             testcase( iCol==(-1) );
377             if( IN_RENAME_OBJECT ){
378               pExpr->iColumn = iCol;
379               pExpr->y.pTab = pTab;
380               eNewExprOp = TK_COLUMN;
381             }else{
382               pExpr->iTable = pNC->uNC.pUpsert->regData + iCol;
383               eNewExprOp = TK_REGISTER;
384               ExprSetProperty(pExpr, EP_Alias);
385             }
386           }else
387 #endif /* SQLITE_OMIT_UPSERT */
388           {
389 #ifndef SQLITE_OMIT_TRIGGER
390             if( iCol<0 ){
391               pExpr->affExpr = SQLITE_AFF_INTEGER;
392             }else if( pExpr->iTable==0 ){
393               testcase( iCol==31 );
394               testcase( iCol==32 );
395               pParse->oldmask |= (iCol>=32 ? 0xffffffff : (((u32)1)<<iCol));
396             }else{
397               testcase( iCol==31 );
398               testcase( iCol==32 );
399               pParse->newmask |= (iCol>=32 ? 0xffffffff : (((u32)1)<<iCol));
400             }
401             pExpr->y.pTab = pTab;
402             pExpr->iColumn = (i16)iCol;
403             eNewExprOp = TK_TRIGGER;
404 #endif /* SQLITE_OMIT_TRIGGER */
405           }
406         }
407       }
408     }
409 #endif /* !defined(SQLITE_OMIT_TRIGGER) || !defined(SQLITE_OMIT_UPSERT) */
410 
411     /*
412     ** Perhaps the name is a reference to the ROWID
413     */
414     if( cnt==0
415      && cntTab==1
416      && pMatch
417      && (pNC->ncFlags & (NC_IdxExpr|NC_GenCol))==0
418      && sqlite3IsRowid(zCol)
419      && VisibleRowid(pMatch->pTab)
420     ){
421       cnt = 1;
422       pExpr->iColumn = -1;
423       pExpr->affExpr = SQLITE_AFF_INTEGER;
424     }
425 
426     /*
427     ** If the input is of the form Z (not Y.Z or X.Y.Z) then the name Z
428     ** might refer to an result-set alias.  This happens, for example, when
429     ** we are resolving names in the WHERE clause of the following command:
430     **
431     **     SELECT a+b AS x FROM table WHERE x<10;
432     **
433     ** In cases like this, replace pExpr with a copy of the expression that
434     ** forms the result set entry ("a+b" in the example) and return immediately.
435     ** Note that the expression in the result set should have already been
436     ** resolved by the time the WHERE clause is resolved.
437     **
438     ** The ability to use an output result-set column in the WHERE, GROUP BY,
439     ** or HAVING clauses, or as part of a larger expression in the ORDER BY
440     ** clause is not standard SQL.  This is a (goofy) SQLite extension, that
441     ** is supported for backwards compatibility only. Hence, we issue a warning
442     ** on sqlite3_log() whenever the capability is used.
443     */
444     if( (pNC->ncFlags & NC_UEList)!=0
445      && cnt==0
446      && zTab==0
447     ){
448       pEList = pNC->uNC.pEList;
449       assert( pEList!=0 );
450       for(j=0; j<pEList->nExpr; j++){
451         char *zAs = pEList->a[j].zName;
452         if( zAs!=0 && sqlite3StrICmp(zAs, zCol)==0 ){
453           Expr *pOrig;
454           assert( pExpr->pLeft==0 && pExpr->pRight==0 );
455           assert( pExpr->x.pList==0 );
456           assert( pExpr->x.pSelect==0 );
457           pOrig = pEList->a[j].pExpr;
458           if( (pNC->ncFlags&NC_AllowAgg)==0 && ExprHasProperty(pOrig, EP_Agg) ){
459             sqlite3ErrorMsg(pParse, "misuse of aliased aggregate %s", zAs);
460             return WRC_Abort;
461           }
462           if( ExprHasProperty(pOrig, EP_Win)
463            && ((pNC->ncFlags&NC_AllowWin)==0 || pNC!=pTopNC )
464           ){
465             sqlite3ErrorMsg(pParse, "misuse of aliased window function %s",zAs);
466             return WRC_Abort;
467           }
468           if( sqlite3ExprVectorSize(pOrig)!=1 ){
469             sqlite3ErrorMsg(pParse, "row value misused");
470             return WRC_Abort;
471           }
472           resolveAlias(pParse, pEList, j, pExpr, "", nSubquery);
473           cnt = 1;
474           pMatch = 0;
475           assert( zTab==0 && zDb==0 );
476           if( IN_RENAME_OBJECT ){
477             sqlite3RenameTokenRemap(pParse, 0, (void*)pExpr);
478           }
479           goto lookupname_end;
480         }
481       }
482     }
483 
484     /* Advance to the next name context.  The loop will exit when either
485     ** we have a match (cnt>0) or when we run out of name contexts.
486     */
487     if( cnt ) break;
488     pNC = pNC->pNext;
489     nSubquery++;
490   }while( pNC );
491 
492 
493   /*
494   ** If X and Y are NULL (in other words if only the column name Z is
495   ** supplied) and the value of Z is enclosed in double-quotes, then
496   ** Z is a string literal if it doesn't match any column names.  In that
497   ** case, we need to return right away and not make any changes to
498   ** pExpr.
499   **
500   ** Because no reference was made to outer contexts, the pNC->nRef
501   ** fields are not changed in any context.
502   */
503   if( cnt==0 && zTab==0 ){
504     assert( pExpr->op==TK_ID );
505     if( ExprHasProperty(pExpr,EP_DblQuoted)
506      && areDoubleQuotedStringsEnabled(db, pTopNC)
507     ){
508       /* If a double-quoted identifier does not match any known column name,
509       ** then treat it as a string.
510       **
511       ** This hack was added in the early days of SQLite in a misguided attempt
512       ** to be compatible with MySQL 3.x, which used double-quotes for strings.
513       ** I now sorely regret putting in this hack. The effect of this hack is
514       ** that misspelled identifier names are silently converted into strings
515       ** rather than causing an error, to the frustration of countless
516       ** programmers. To all those frustrated programmers, my apologies.
517       **
518       ** Someday, I hope to get rid of this hack. Unfortunately there is
519       ** a huge amount of legacy SQL that uses it. So for now, we just
520       ** issue a warning.
521       */
522       sqlite3_log(SQLITE_WARNING,
523         "double-quoted string literal: \"%w\"", zCol);
524 #ifdef SQLITE_ENABLE_NORMALIZE
525       sqlite3VdbeAddDblquoteStr(db, pParse->pVdbe, zCol);
526 #endif
527       pExpr->op = TK_STRING;
528       pExpr->y.pTab = 0;
529       return WRC_Prune;
530     }
531     if( sqlite3ExprIdToTrueFalse(pExpr) ){
532       return WRC_Prune;
533     }
534   }
535 
536   /*
537   ** cnt==0 means there was not match.  cnt>1 means there were two or
538   ** more matches.  Either way, we have an error.
539   */
540   if( cnt!=1 ){
541     const char *zErr;
542     zErr = cnt==0 ? "no such column" : "ambiguous column name";
543     if( zDb ){
544       sqlite3ErrorMsg(pParse, "%s: %s.%s.%s", zErr, zDb, zTab, zCol);
545     }else if( zTab ){
546       sqlite3ErrorMsg(pParse, "%s: %s.%s", zErr, zTab, zCol);
547     }else{
548       sqlite3ErrorMsg(pParse, "%s: %s", zErr, zCol);
549     }
550     pParse->checkSchema = 1;
551     pTopNC->nErr++;
552   }
553 
554   /* If a column from a table in pSrcList is referenced, then record
555   ** this fact in the pSrcList.a[].colUsed bitmask.  Column 0 causes
556   ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.  Bit 63 is
557   ** set if the 63rd or any subsequent column is used.
558   **
559   ** The colUsed mask is an optimization used to help determine if an
560   ** index is a covering index.  The correct answer is still obtained
561   ** if the mask contains extra set bits.  However, it is important to
562   ** avoid setting bits beyond the maximum column number of the table.
563   ** (See ticket [b92e5e8ec2cdbaa1]).
564   **
565   ** If a generated column is referenced, set bits for every column
566   ** of the table.
567   */
568   if( pExpr->iColumn>=0 && pMatch!=0 ){
569     int n = pExpr->iColumn;
570     Table *pExTab = pExpr->y.pTab;
571     assert( pExTab!=0 );
572     assert( pMatch->iCursor==pExpr->iTable );
573     if( (pExTab->tabFlags & TF_HasGenerated)!=0
574      && (pExTab->aCol[n].colFlags & COLFLAG_GENERATED)!=0
575     ){
576       testcase( pExTab->nCol==BMS-1 );
577       testcase( pExTab->nCol==BMS );
578       pMatch->colUsed = pExTab->nCol>=BMS ? ALLBITS : MASKBIT(pExTab->nCol)-1;
579     }else{
580       testcase( n==BMS-1 );
581       testcase( n==BMS );
582       if( n>=BMS ) n = BMS-1;
583       pMatch->colUsed |= ((Bitmask)1)<<n;
584     }
585   }
586 
587   /* Clean up and return
588   */
589   sqlite3ExprDelete(db, pExpr->pLeft);
590   pExpr->pLeft = 0;
591   sqlite3ExprDelete(db, pExpr->pRight);
592   pExpr->pRight = 0;
593   pExpr->op = eNewExprOp;
594   ExprSetProperty(pExpr, EP_Leaf);
595 lookupname_end:
596   if( cnt==1 ){
597     assert( pNC!=0 );
598     if( !ExprHasProperty(pExpr, EP_Alias) ){
599       sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList);
600     }
601     /* Increment the nRef value on all name contexts from TopNC up to
602     ** the point where the name matched. */
603     for(;;){
604       assert( pTopNC!=0 );
605       pTopNC->nRef++;
606       if( pTopNC==pNC ) break;
607       pTopNC = pTopNC->pNext;
608     }
609     return WRC_Prune;
610   } else {
611     return WRC_Abort;
612   }
613 }
614 
615 /*
616 ** Allocate and return a pointer to an expression to load the column iCol
617 ** from datasource iSrc in SrcList pSrc.
618 */
619 Expr *sqlite3CreateColumnExpr(sqlite3 *db, SrcList *pSrc, int iSrc, int iCol){
620   Expr *p = sqlite3ExprAlloc(db, TK_COLUMN, 0, 0);
621   if( p ){
622     struct SrcList_item *pItem = &pSrc->a[iSrc];
623     Table *pTab = p->y.pTab = pItem->pTab;
624     p->iTable = pItem->iCursor;
625     if( p->y.pTab->iPKey==iCol ){
626       p->iColumn = -1;
627     }else{
628       p->iColumn = (ynVar)iCol;
629       if( (pTab->tabFlags & TF_HasGenerated)!=0
630        && (pTab->aCol[iCol].colFlags & COLFLAG_GENERATED)!=0
631       ){
632         testcase( pTab->nCol==63 );
633         testcase( pTab->nCol==64 );
634         pItem->colUsed = pTab->nCol>=64 ? ALLBITS : MASKBIT(pTab->nCol)-1;
635       }else{
636         testcase( iCol==BMS );
637         testcase( iCol==BMS-1 );
638         pItem->colUsed |= ((Bitmask)1)<<(iCol>=BMS ? BMS-1 : iCol);
639       }
640     }
641   }
642   return p;
643 }
644 
645 /*
646 ** Report an error that an expression is not valid for some set of
647 ** pNC->ncFlags values determined by validMask.
648 **
649 ** static void notValid(
650 **   Parse *pParse,       // Leave error message here
651 **   NameContext *pNC,    // The name context
652 **   const char *zMsg,    // Type of error
653 **   int validMask,       // Set of contexts for which prohibited
654 **   Expr *pExpr          // Invalidate this expression on error
655 ** ){...}
656 **
657 ** As an optimization, since the conditional is almost always false
658 ** (because errors are rare), the conditional is moved outside of the
659 ** function call using a macro.
660 */
661 static void notValidImpl(
662    Parse *pParse,       /* Leave error message here */
663    NameContext *pNC,    /* The name context */
664    const char *zMsg,    /* Type of error */
665    Expr *pExpr          /* Invalidate this expression on error */
666 ){
667   const char *zIn = "partial index WHERE clauses";
668   if( pNC->ncFlags & NC_IdxExpr )      zIn = "index expressions";
669 #ifndef SQLITE_OMIT_CHECK
670   else if( pNC->ncFlags & NC_IsCheck ) zIn = "CHECK constraints";
671 #endif
672 #ifndef SQLITE_OMIT_GENERATED_COLUMNS
673   else if( pNC->ncFlags & NC_GenCol ) zIn = "generated columns";
674 #endif
675   sqlite3ErrorMsg(pParse, "%s prohibited in %s", zMsg, zIn);
676   if( pExpr ) pExpr->op = TK_NULL;
677 }
678 #define sqlite3ResolveNotValid(P,N,M,X,E) \
679   assert( ((X)&~(NC_IsCheck|NC_PartIdx|NC_IdxExpr|NC_GenCol))==0 ); \
680   if( ((N)->ncFlags & (X))!=0 ) notValidImpl(P,N,M,E);
681 
682 /*
683 ** Expression p should encode a floating point value between 1.0 and 0.0.
684 ** Return 1024 times this value.  Or return -1 if p is not a floating point
685 ** value between 1.0 and 0.0.
686 */
687 static int exprProbability(Expr *p){
688   double r = -1.0;
689   if( p->op!=TK_FLOAT ) return -1;
690   sqlite3AtoF(p->u.zToken, &r, sqlite3Strlen30(p->u.zToken), SQLITE_UTF8);
691   assert( r>=0.0 );
692   if( r>1.0 ) return -1;
693   return (int)(r*134217728.0);
694 }
695 
696 /*
697 ** This routine is callback for sqlite3WalkExpr().
698 **
699 ** Resolve symbolic names into TK_COLUMN operators for the current
700 ** node in the expression tree.  Return 0 to continue the search down
701 ** the tree or 2 to abort the tree walk.
702 **
703 ** This routine also does error checking and name resolution for
704 ** function names.  The operator for aggregate functions is changed
705 ** to TK_AGG_FUNCTION.
706 */
707 static int resolveExprStep(Walker *pWalker, Expr *pExpr){
708   NameContext *pNC;
709   Parse *pParse;
710 
711   pNC = pWalker->u.pNC;
712   assert( pNC!=0 );
713   pParse = pNC->pParse;
714   assert( pParse==pWalker->pParse );
715 
716 #ifndef NDEBUG
717   if( pNC->pSrcList && pNC->pSrcList->nAlloc>0 ){
718     SrcList *pSrcList = pNC->pSrcList;
719     int i;
720     for(i=0; i<pNC->pSrcList->nSrc; i++){
721       assert( pSrcList->a[i].iCursor>=0 && pSrcList->a[i].iCursor<pParse->nTab);
722     }
723   }
724 #endif
725   switch( pExpr->op ){
726 
727 #if defined(SQLITE_ENABLE_UPDATE_DELETE_LIMIT) && !defined(SQLITE_OMIT_SUBQUERY)
728     /* The special operator TK_ROW means use the rowid for the first
729     ** column in the FROM clause.  This is used by the LIMIT and ORDER BY
730     ** clause processing on UPDATE and DELETE statements.
731     */
732     case TK_ROW: {
733       SrcList *pSrcList = pNC->pSrcList;
734       struct SrcList_item *pItem;
735       assert( pSrcList && pSrcList->nSrc==1 );
736       pItem = pSrcList->a;
737       assert( HasRowid(pItem->pTab) && pItem->pTab->pSelect==0 );
738       pExpr->op = TK_COLUMN;
739       pExpr->y.pTab = pItem->pTab;
740       pExpr->iTable = pItem->iCursor;
741       pExpr->iColumn = -1;
742       pExpr->affExpr = SQLITE_AFF_INTEGER;
743       break;
744     }
745 #endif /* defined(SQLITE_ENABLE_UPDATE_DELETE_LIMIT)
746           && !defined(SQLITE_OMIT_SUBQUERY) */
747 
748     /* A column name:                    ID
749     ** Or table name and column name:    ID.ID
750     ** Or a database, table and column:  ID.ID.ID
751     **
752     ** The TK_ID and TK_OUT cases are combined so that there will only
753     ** be one call to lookupName().  Then the compiler will in-line
754     ** lookupName() for a size reduction and performance increase.
755     */
756     case TK_ID:
757     case TK_DOT: {
758       const char *zColumn;
759       const char *zTable;
760       const char *zDb;
761       Expr *pRight;
762 
763       if( pExpr->op==TK_ID ){
764         zDb = 0;
765         zTable = 0;
766         zColumn = pExpr->u.zToken;
767       }else{
768         Expr *pLeft = pExpr->pLeft;
769         testcase( pNC->ncFlags & NC_IdxExpr );
770         testcase( pNC->ncFlags & NC_GenCol );
771         sqlite3ResolveNotValid(pParse, pNC, "the \".\" operator",
772                                NC_IdxExpr|NC_GenCol, 0);
773         pRight = pExpr->pRight;
774         if( pRight->op==TK_ID ){
775           zDb = 0;
776         }else{
777           assert( pRight->op==TK_DOT );
778           zDb = pLeft->u.zToken;
779           pLeft = pRight->pLeft;
780           pRight = pRight->pRight;
781         }
782         zTable = pLeft->u.zToken;
783         zColumn = pRight->u.zToken;
784         if( IN_RENAME_OBJECT ){
785           sqlite3RenameTokenRemap(pParse, (void*)pExpr, (void*)pRight);
786           sqlite3RenameTokenRemap(pParse, (void*)&pExpr->y.pTab, (void*)pLeft);
787         }
788       }
789       return lookupName(pParse, zDb, zTable, zColumn, pNC, pExpr);
790     }
791 
792     /* Resolve function names
793     */
794     case TK_FUNCTION: {
795       ExprList *pList = pExpr->x.pList;    /* The argument list */
796       int n = pList ? pList->nExpr : 0;    /* Number of arguments */
797       int no_such_func = 0;       /* True if no such function exists */
798       int wrong_num_args = 0;     /* True if wrong number of arguments */
799       int is_agg = 0;             /* True if is an aggregate function */
800       int nId;                    /* Number of characters in function name */
801       const char *zId;            /* The function name. */
802       FuncDef *pDef;              /* Information about the function */
803       u8 enc = ENC(pParse->db);   /* The database encoding */
804       int savedAllowFlags = (pNC->ncFlags & (NC_AllowAgg | NC_AllowWin));
805 #ifndef SQLITE_OMIT_WINDOWFUNC
806       Window *pWin = (IsWindowFunc(pExpr) ? pExpr->y.pWin : 0);
807 #endif
808       assert( !ExprHasProperty(pExpr, EP_xIsSelect) );
809       zId = pExpr->u.zToken;
810       nId = sqlite3Strlen30(zId);
811       pDef = sqlite3FindFunction(pParse->db, zId, n, enc, 0);
812       if( pDef==0 ){
813         pDef = sqlite3FindFunction(pParse->db, zId, -2, enc, 0);
814         if( pDef==0 ){
815           no_such_func = 1;
816         }else{
817           wrong_num_args = 1;
818         }
819       }else{
820         is_agg = pDef->xFinalize!=0;
821         if( pDef->funcFlags & SQLITE_FUNC_UNLIKELY ){
822           ExprSetProperty(pExpr, EP_Unlikely);
823           if( n==2 ){
824             pExpr->iTable = exprProbability(pList->a[1].pExpr);
825             if( pExpr->iTable<0 ){
826               sqlite3ErrorMsg(pParse,
827                 "second argument to likelihood() must be a "
828                 "constant between 0.0 and 1.0");
829               pNC->nErr++;
830             }
831           }else{
832             /* EVIDENCE-OF: R-61304-29449 The unlikely(X) function is
833             ** equivalent to likelihood(X, 0.0625).
834             ** EVIDENCE-OF: R-01283-11636 The unlikely(X) function is
835             ** short-hand for likelihood(X,0.0625).
836             ** EVIDENCE-OF: R-36850-34127 The likely(X) function is short-hand
837             ** for likelihood(X,0.9375).
838             ** EVIDENCE-OF: R-53436-40973 The likely(X) function is equivalent
839             ** to likelihood(X,0.9375). */
840             /* TUNING: unlikely() probability is 0.0625.  likely() is 0.9375 */
841             pExpr->iTable = pDef->zName[0]=='u' ? 8388608 : 125829120;
842           }
843         }
844 #ifndef SQLITE_OMIT_AUTHORIZATION
845         {
846           int auth = sqlite3AuthCheck(pParse, SQLITE_FUNCTION, 0,pDef->zName,0);
847           if( auth!=SQLITE_OK ){
848             if( auth==SQLITE_DENY ){
849               sqlite3ErrorMsg(pParse, "not authorized to use function: %s",
850                                       pDef->zName);
851               pNC->nErr++;
852             }
853             pExpr->op = TK_NULL;
854             return WRC_Prune;
855           }
856         }
857 #endif
858         if( pDef->funcFlags & (SQLITE_FUNC_CONSTANT|SQLITE_FUNC_SLOCHNG) ){
859           /* For the purposes of the EP_ConstFunc flag, date and time
860           ** functions and other functions that change slowly are considered
861           ** constant because they are constant for the duration of one query.
862           ** This allows them to be factored out of inner loops. */
863           ExprSetProperty(pExpr,EP_ConstFunc);
864         }
865         if( (pDef->funcFlags & SQLITE_FUNC_CONSTANT)==0 ){
866           /* Date/time functions that use 'now', and other functions like
867           ** sqlite_version() that might change over time cannot be used
868           ** in an index. */
869           sqlite3ResolveNotValid(pParse, pNC, "non-deterministic functions",
870                                  NC_SelfRef, 0);
871         }else{
872           assert( (NC_SelfRef & 0xff)==NC_SelfRef ); /* Must fit in 8 bits */
873           pExpr->op2 = pNC->ncFlags & NC_SelfRef;
874         }
875         if( (pDef->funcFlags & SQLITE_FUNC_INTERNAL)!=0
876          && pParse->nested==0
877          && sqlite3Config.bInternalFunctions==0
878         ){
879           /* Internal-use-only functions are disallowed unless the
880           ** SQL is being compiled using sqlite3NestedParse() */
881           no_such_func = 1;
882           pDef = 0;
883         }else
884         if( (pDef->funcFlags & SQLITE_FUNC_DIRECT)!=0
885          && ExprHasProperty(pExpr, EP_Indirect)
886          && !IN_RENAME_OBJECT
887         ){
888           /* Functions tagged with SQLITE_DIRECTONLY may not be used
889           ** inside of triggers and views */
890           sqlite3ErrorMsg(pParse, "%s() prohibited in triggers and views",
891                           pDef->zName);
892         }
893       }
894 
895       if( 0==IN_RENAME_OBJECT ){
896 #ifndef SQLITE_OMIT_WINDOWFUNC
897         assert( is_agg==0 || (pDef->funcFlags & SQLITE_FUNC_MINMAX)
898           || (pDef->xValue==0 && pDef->xInverse==0)
899           || (pDef->xValue && pDef->xInverse && pDef->xSFunc && pDef->xFinalize)
900         );
901         if( pDef && pDef->xValue==0 && pWin ){
902           sqlite3ErrorMsg(pParse,
903               "%.*s() may not be used as a window function", nId, zId
904           );
905           pNC->nErr++;
906         }else if(
907               (is_agg && (pNC->ncFlags & NC_AllowAgg)==0)
908            || (is_agg && (pDef->funcFlags&SQLITE_FUNC_WINDOW) && !pWin)
909            || (is_agg && pWin && (pNC->ncFlags & NC_AllowWin)==0)
910         ){
911           const char *zType;
912           if( (pDef->funcFlags & SQLITE_FUNC_WINDOW) || pWin ){
913             zType = "window";
914           }else{
915             zType = "aggregate";
916           }
917           sqlite3ErrorMsg(pParse, "misuse of %s function %.*s()",zType,nId,zId);
918           pNC->nErr++;
919           is_agg = 0;
920         }
921 #else
922         if( (is_agg && (pNC->ncFlags & NC_AllowAgg)==0) ){
923           sqlite3ErrorMsg(pParse,"misuse of aggregate function %.*s()",nId,zId);
924           pNC->nErr++;
925           is_agg = 0;
926         }
927 #endif
928         else if( no_such_func && pParse->db->init.busy==0
929 #ifdef SQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
930                   && pParse->explain==0
931 #endif
932         ){
933           sqlite3ErrorMsg(pParse, "no such function: %.*s", nId, zId);
934           pNC->nErr++;
935         }else if( wrong_num_args ){
936           sqlite3ErrorMsg(pParse,"wrong number of arguments to function %.*s()",
937                nId, zId);
938           pNC->nErr++;
939         }
940 #ifndef SQLITE_OMIT_WINDOWFUNC
941         else if( is_agg==0 && ExprHasProperty(pExpr, EP_WinFunc) ){
942           sqlite3ErrorMsg(pParse,
943               "FILTER may not be used with non-aggregate %.*s()",
944               nId, zId
945           );
946           pNC->nErr++;
947         }
948 #endif
949         if( is_agg ){
950           /* Window functions may not be arguments of aggregate functions.
951           ** Or arguments of other window functions. But aggregate functions
952           ** may be arguments for window functions.  */
953 #ifndef SQLITE_OMIT_WINDOWFUNC
954           pNC->ncFlags &= ~(NC_AllowWin | (!pWin ? NC_AllowAgg : 0));
955 #else
956           pNC->ncFlags &= ~NC_AllowAgg;
957 #endif
958         }
959       }
960 #ifndef SQLITE_OMIT_WINDOWFUNC
961       else if( ExprHasProperty(pExpr, EP_WinFunc) ){
962         is_agg = 1;
963       }
964 #endif
965       sqlite3WalkExprList(pWalker, pList);
966       if( is_agg ){
967 #ifndef SQLITE_OMIT_WINDOWFUNC
968         if( pWin ){
969           Select *pSel = pNC->pWinSelect;
970           assert( pWin==pExpr->y.pWin );
971           if( IN_RENAME_OBJECT==0 ){
972             sqlite3WindowUpdate(pParse, pSel ? pSel->pWinDefn : 0, pWin, pDef);
973           }
974           sqlite3WalkExprList(pWalker, pWin->pPartition);
975           sqlite3WalkExprList(pWalker, pWin->pOrderBy);
976           sqlite3WalkExpr(pWalker, pWin->pFilter);
977           sqlite3WindowLink(pSel, pWin);
978           pNC->ncFlags |= NC_HasWin;
979         }else
980 #endif /* SQLITE_OMIT_WINDOWFUNC */
981         {
982           NameContext *pNC2 = pNC;
983           pExpr->op = TK_AGG_FUNCTION;
984           pExpr->op2 = 0;
985 #ifndef SQLITE_OMIT_WINDOWFUNC
986           if( ExprHasProperty(pExpr, EP_WinFunc) ){
987             sqlite3WalkExpr(pWalker, pExpr->y.pWin->pFilter);
988           }
989 #endif
990           while( pNC2 && !sqlite3FunctionUsesThisSrc(pExpr, pNC2->pSrcList) ){
991             pExpr->op2++;
992             pNC2 = pNC2->pNext;
993           }
994           assert( pDef!=0 || IN_RENAME_OBJECT );
995           if( pNC2 && pDef ){
996             assert( SQLITE_FUNC_MINMAX==NC_MinMaxAgg );
997             testcase( (pDef->funcFlags & SQLITE_FUNC_MINMAX)!=0 );
998             pNC2->ncFlags |= NC_HasAgg | (pDef->funcFlags & SQLITE_FUNC_MINMAX);
999 
1000           }
1001         }
1002         pNC->ncFlags |= savedAllowFlags;
1003       }
1004       /* FIX ME:  Compute pExpr->affinity based on the expected return
1005       ** type of the function
1006       */
1007       return WRC_Prune;
1008     }
1009 #ifndef SQLITE_OMIT_SUBQUERY
1010     case TK_SELECT:
1011     case TK_EXISTS:  testcase( pExpr->op==TK_EXISTS );
1012 #endif
1013     case TK_IN: {
1014       testcase( pExpr->op==TK_IN );
1015       if( ExprHasProperty(pExpr, EP_xIsSelect) ){
1016         int nRef = pNC->nRef;
1017         testcase( pNC->ncFlags & NC_IsCheck );
1018         testcase( pNC->ncFlags & NC_PartIdx );
1019         testcase( pNC->ncFlags & NC_IdxExpr );
1020         testcase( pNC->ncFlags & NC_GenCol );
1021         sqlite3ResolveNotValid(pParse, pNC, "subqueries",
1022                  NC_IsCheck|NC_PartIdx|NC_IdxExpr|NC_GenCol, pExpr);
1023         sqlite3WalkSelect(pWalker, pExpr->x.pSelect);
1024         assert( pNC->nRef>=nRef );
1025         if( nRef!=pNC->nRef ){
1026           ExprSetProperty(pExpr, EP_VarSelect);
1027           pNC->ncFlags |= NC_VarSelect;
1028         }
1029       }
1030       break;
1031     }
1032     case TK_VARIABLE: {
1033       testcase( pNC->ncFlags & NC_IsCheck );
1034       testcase( pNC->ncFlags & NC_PartIdx );
1035       testcase( pNC->ncFlags & NC_IdxExpr );
1036       testcase( pNC->ncFlags & NC_GenCol );
1037       sqlite3ResolveNotValid(pParse, pNC, "parameters",
1038                NC_IsCheck|NC_PartIdx|NC_IdxExpr|NC_GenCol, pExpr);
1039       break;
1040     }
1041     case TK_IS:
1042     case TK_ISNOT: {
1043       Expr *pRight = sqlite3ExprSkipCollateAndLikely(pExpr->pRight);
1044       assert( !ExprHasProperty(pExpr, EP_Reduced) );
1045       /* Handle special cases of "x IS TRUE", "x IS FALSE", "x IS NOT TRUE",
1046       ** and "x IS NOT FALSE". */
1047       if( pRight->op==TK_ID ){
1048         int rc = resolveExprStep(pWalker, pRight);
1049         if( rc==WRC_Abort ) return WRC_Abort;
1050         if( pRight->op==TK_TRUEFALSE ){
1051           pExpr->op2 = pExpr->op;
1052           pExpr->op = TK_TRUTH;
1053           return WRC_Continue;
1054         }
1055       }
1056       /* Fall thru */
1057     }
1058     case TK_BETWEEN:
1059     case TK_EQ:
1060     case TK_NE:
1061     case TK_LT:
1062     case TK_LE:
1063     case TK_GT:
1064     case TK_GE: {
1065       int nLeft, nRight;
1066       if( pParse->db->mallocFailed ) break;
1067       assert( pExpr->pLeft!=0 );
1068       nLeft = sqlite3ExprVectorSize(pExpr->pLeft);
1069       if( pExpr->op==TK_BETWEEN ){
1070         nRight = sqlite3ExprVectorSize(pExpr->x.pList->a[0].pExpr);
1071         if( nRight==nLeft ){
1072           nRight = sqlite3ExprVectorSize(pExpr->x.pList->a[1].pExpr);
1073         }
1074       }else{
1075         assert( pExpr->pRight!=0 );
1076         nRight = sqlite3ExprVectorSize(pExpr->pRight);
1077       }
1078       if( nLeft!=nRight ){
1079         testcase( pExpr->op==TK_EQ );
1080         testcase( pExpr->op==TK_NE );
1081         testcase( pExpr->op==TK_LT );
1082         testcase( pExpr->op==TK_LE );
1083         testcase( pExpr->op==TK_GT );
1084         testcase( pExpr->op==TK_GE );
1085         testcase( pExpr->op==TK_IS );
1086         testcase( pExpr->op==TK_ISNOT );
1087         testcase( pExpr->op==TK_BETWEEN );
1088         sqlite3ErrorMsg(pParse, "row value misused");
1089       }
1090       break;
1091     }
1092   }
1093   return (pParse->nErr || pParse->db->mallocFailed) ? WRC_Abort : WRC_Continue;
1094 }
1095 
1096 /*
1097 ** pEList is a list of expressions which are really the result set of the
1098 ** a SELECT statement.  pE is a term in an ORDER BY or GROUP BY clause.
1099 ** This routine checks to see if pE is a simple identifier which corresponds
1100 ** to the AS-name of one of the terms of the expression list.  If it is,
1101 ** this routine return an integer between 1 and N where N is the number of
1102 ** elements in pEList, corresponding to the matching entry.  If there is
1103 ** no match, or if pE is not a simple identifier, then this routine
1104 ** return 0.
1105 **
1106 ** pEList has been resolved.  pE has not.
1107 */
1108 static int resolveAsName(
1109   Parse *pParse,     /* Parsing context for error messages */
1110   ExprList *pEList,  /* List of expressions to scan */
1111   Expr *pE           /* Expression we are trying to match */
1112 ){
1113   int i;             /* Loop counter */
1114 
1115   UNUSED_PARAMETER(pParse);
1116 
1117   if( pE->op==TK_ID ){
1118     char *zCol = pE->u.zToken;
1119     for(i=0; i<pEList->nExpr; i++){
1120       char *zAs = pEList->a[i].zName;
1121       if( zAs!=0 && sqlite3StrICmp(zAs, zCol)==0 ){
1122         return i+1;
1123       }
1124     }
1125   }
1126   return 0;
1127 }
1128 
1129 /*
1130 ** pE is a pointer to an expression which is a single term in the
1131 ** ORDER BY of a compound SELECT.  The expression has not been
1132 ** name resolved.
1133 **
1134 ** At the point this routine is called, we already know that the
1135 ** ORDER BY term is not an integer index into the result set.  That
1136 ** case is handled by the calling routine.
1137 **
1138 ** Attempt to match pE against result set columns in the left-most
1139 ** SELECT statement.  Return the index i of the matching column,
1140 ** as an indication to the caller that it should sort by the i-th column.
1141 ** The left-most column is 1.  In other words, the value returned is the
1142 ** same integer value that would be used in the SQL statement to indicate
1143 ** the column.
1144 **
1145 ** If there is no match, return 0.  Return -1 if an error occurs.
1146 */
1147 static int resolveOrderByTermToExprList(
1148   Parse *pParse,     /* Parsing context for error messages */
1149   Select *pSelect,   /* The SELECT statement with the ORDER BY clause */
1150   Expr *pE           /* The specific ORDER BY term */
1151 ){
1152   int i;             /* Loop counter */
1153   ExprList *pEList;  /* The columns of the result set */
1154   NameContext nc;    /* Name context for resolving pE */
1155   sqlite3 *db;       /* Database connection */
1156   int rc;            /* Return code from subprocedures */
1157   u8 savedSuppErr;   /* Saved value of db->suppressErr */
1158 
1159   assert( sqlite3ExprIsInteger(pE, &i)==0 );
1160   pEList = pSelect->pEList;
1161 
1162   /* Resolve all names in the ORDER BY term expression
1163   */
1164   memset(&nc, 0, sizeof(nc));
1165   nc.pParse = pParse;
1166   nc.pSrcList = pSelect->pSrc;
1167   nc.uNC.pEList = pEList;
1168   nc.ncFlags = NC_AllowAgg|NC_UEList;
1169   nc.nErr = 0;
1170   db = pParse->db;
1171   savedSuppErr = db->suppressErr;
1172   db->suppressErr = 1;
1173   rc = sqlite3ResolveExprNames(&nc, pE);
1174   db->suppressErr = savedSuppErr;
1175   if( rc ) return 0;
1176 
1177   /* Try to match the ORDER BY expression against an expression
1178   ** in the result set.  Return an 1-based index of the matching
1179   ** result-set entry.
1180   */
1181   for(i=0; i<pEList->nExpr; i++){
1182     if( sqlite3ExprCompare(0, pEList->a[i].pExpr, pE, -1)<2 ){
1183       return i+1;
1184     }
1185   }
1186 
1187   /* If no match, return 0. */
1188   return 0;
1189 }
1190 
1191 /*
1192 ** Generate an ORDER BY or GROUP BY term out-of-range error.
1193 */
1194 static void resolveOutOfRangeError(
1195   Parse *pParse,         /* The error context into which to write the error */
1196   const char *zType,     /* "ORDER" or "GROUP" */
1197   int i,                 /* The index (1-based) of the term out of range */
1198   int mx                 /* Largest permissible value of i */
1199 ){
1200   sqlite3ErrorMsg(pParse,
1201     "%r %s BY term out of range - should be "
1202     "between 1 and %d", i, zType, mx);
1203 }
1204 
1205 /*
1206 ** Analyze the ORDER BY clause in a compound SELECT statement.   Modify
1207 ** each term of the ORDER BY clause is a constant integer between 1
1208 ** and N where N is the number of columns in the compound SELECT.
1209 **
1210 ** ORDER BY terms that are already an integer between 1 and N are
1211 ** unmodified.  ORDER BY terms that are integers outside the range of
1212 ** 1 through N generate an error.  ORDER BY terms that are expressions
1213 ** are matched against result set expressions of compound SELECT
1214 ** beginning with the left-most SELECT and working toward the right.
1215 ** At the first match, the ORDER BY expression is transformed into
1216 ** the integer column number.
1217 **
1218 ** Return the number of errors seen.
1219 */
1220 static int resolveCompoundOrderBy(
1221   Parse *pParse,        /* Parsing context.  Leave error messages here */
1222   Select *pSelect       /* The SELECT statement containing the ORDER BY */
1223 ){
1224   int i;
1225   ExprList *pOrderBy;
1226   ExprList *pEList;
1227   sqlite3 *db;
1228   int moreToDo = 1;
1229 
1230   pOrderBy = pSelect->pOrderBy;
1231   if( pOrderBy==0 ) return 0;
1232   db = pParse->db;
1233   if( pOrderBy->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
1234     sqlite3ErrorMsg(pParse, "too many terms in ORDER BY clause");
1235     return 1;
1236   }
1237   for(i=0; i<pOrderBy->nExpr; i++){
1238     pOrderBy->a[i].done = 0;
1239   }
1240   pSelect->pNext = 0;
1241   while( pSelect->pPrior ){
1242     pSelect->pPrior->pNext = pSelect;
1243     pSelect = pSelect->pPrior;
1244   }
1245   while( pSelect && moreToDo ){
1246     struct ExprList_item *pItem;
1247     moreToDo = 0;
1248     pEList = pSelect->pEList;
1249     assert( pEList!=0 );
1250     for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
1251       int iCol = -1;
1252       Expr *pE, *pDup;
1253       if( pItem->done ) continue;
1254       pE = sqlite3ExprSkipCollateAndLikely(pItem->pExpr);
1255       if( sqlite3ExprIsInteger(pE, &iCol) ){
1256         if( iCol<=0 || iCol>pEList->nExpr ){
1257           resolveOutOfRangeError(pParse, "ORDER", i+1, pEList->nExpr);
1258           return 1;
1259         }
1260       }else{
1261         iCol = resolveAsName(pParse, pEList, pE);
1262         if( iCol==0 ){
1263           /* Now test if expression pE matches one of the values returned
1264           ** by pSelect. In the usual case this is done by duplicating the
1265           ** expression, resolving any symbols in it, and then comparing
1266           ** it against each expression returned by the SELECT statement.
1267           ** Once the comparisons are finished, the duplicate expression
1268           ** is deleted.
1269           **
1270           ** Or, if this is running as part of an ALTER TABLE operation,
1271           ** resolve the symbols in the actual expression, not a duplicate.
1272           ** And, if one of the comparisons is successful, leave the expression
1273           ** as is instead of transforming it to an integer as in the usual
1274           ** case. This allows the code in alter.c to modify column
1275           ** refererences within the ORDER BY expression as required.  */
1276           if( IN_RENAME_OBJECT ){
1277             pDup = pE;
1278           }else{
1279             pDup = sqlite3ExprDup(db, pE, 0);
1280           }
1281           if( !db->mallocFailed ){
1282             assert(pDup);
1283             iCol = resolveOrderByTermToExprList(pParse, pSelect, pDup);
1284           }
1285           if( !IN_RENAME_OBJECT ){
1286             sqlite3ExprDelete(db, pDup);
1287           }
1288         }
1289       }
1290       if( iCol>0 ){
1291         /* Convert the ORDER BY term into an integer column number iCol,
1292         ** taking care to preserve the COLLATE clause if it exists */
1293         if( !IN_RENAME_OBJECT ){
1294           Expr *pNew = sqlite3Expr(db, TK_INTEGER, 0);
1295           if( pNew==0 ) return 1;
1296           pNew->flags |= EP_IntValue;
1297           pNew->u.iValue = iCol;
1298           if( pItem->pExpr==pE ){
1299             pItem->pExpr = pNew;
1300           }else{
1301             Expr *pParent = pItem->pExpr;
1302             assert( pParent->op==TK_COLLATE );
1303             while( pParent->pLeft->op==TK_COLLATE ) pParent = pParent->pLeft;
1304             assert( pParent->pLeft==pE );
1305             pParent->pLeft = pNew;
1306           }
1307           sqlite3ExprDelete(db, pE);
1308           pItem->u.x.iOrderByCol = (u16)iCol;
1309         }
1310         pItem->done = 1;
1311       }else{
1312         moreToDo = 1;
1313       }
1314     }
1315     pSelect = pSelect->pNext;
1316   }
1317   for(i=0; i<pOrderBy->nExpr; i++){
1318     if( pOrderBy->a[i].done==0 ){
1319       sqlite3ErrorMsg(pParse, "%r ORDER BY term does not match any "
1320             "column in the result set", i+1);
1321       return 1;
1322     }
1323   }
1324   return 0;
1325 }
1326 
1327 /*
1328 ** Check every term in the ORDER BY or GROUP BY clause pOrderBy of
1329 ** the SELECT statement pSelect.  If any term is reference to a
1330 ** result set expression (as determined by the ExprList.a.u.x.iOrderByCol
1331 ** field) then convert that term into a copy of the corresponding result set
1332 ** column.
1333 **
1334 ** If any errors are detected, add an error message to pParse and
1335 ** return non-zero.  Return zero if no errors are seen.
1336 */
1337 int sqlite3ResolveOrderGroupBy(
1338   Parse *pParse,        /* Parsing context.  Leave error messages here */
1339   Select *pSelect,      /* The SELECT statement containing the clause */
1340   ExprList *pOrderBy,   /* The ORDER BY or GROUP BY clause to be processed */
1341   const char *zType     /* "ORDER" or "GROUP" */
1342 ){
1343   int i;
1344   sqlite3 *db = pParse->db;
1345   ExprList *pEList;
1346   struct ExprList_item *pItem;
1347 
1348   if( pOrderBy==0 || pParse->db->mallocFailed || IN_RENAME_OBJECT ) return 0;
1349   if( pOrderBy->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
1350     sqlite3ErrorMsg(pParse, "too many terms in %s BY clause", zType);
1351     return 1;
1352   }
1353   pEList = pSelect->pEList;
1354   assert( pEList!=0 );  /* sqlite3SelectNew() guarantees this */
1355   for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
1356     if( pItem->u.x.iOrderByCol ){
1357       if( pItem->u.x.iOrderByCol>pEList->nExpr ){
1358         resolveOutOfRangeError(pParse, zType, i+1, pEList->nExpr);
1359         return 1;
1360       }
1361       resolveAlias(pParse, pEList, pItem->u.x.iOrderByCol-1, pItem->pExpr,
1362                    zType,0);
1363     }
1364   }
1365   return 0;
1366 }
1367 
1368 #ifndef SQLITE_OMIT_WINDOWFUNC
1369 /*
1370 ** Walker callback for windowRemoveExprFromSelect().
1371 */
1372 static int resolveRemoveWindowsCb(Walker *pWalker, Expr *pExpr){
1373   UNUSED_PARAMETER(pWalker);
1374   if( ExprHasProperty(pExpr, EP_WinFunc) ){
1375     Window *pWin = pExpr->y.pWin;
1376     sqlite3WindowUnlinkFromSelect(pWin);
1377   }
1378   return WRC_Continue;
1379 }
1380 
1381 /*
1382 ** Remove any Window objects owned by the expression pExpr from the
1383 ** Select.pWin list of Select object pSelect.
1384 */
1385 static void windowRemoveExprFromSelect(Select *pSelect, Expr *pExpr){
1386   if( pSelect->pWin ){
1387     Walker sWalker;
1388     memset(&sWalker, 0, sizeof(Walker));
1389     sWalker.xExprCallback = resolveRemoveWindowsCb;
1390     sWalker.u.pSelect = pSelect;
1391     sqlite3WalkExpr(&sWalker, pExpr);
1392   }
1393 }
1394 #else
1395 # define windowRemoveExprFromSelect(a, b)
1396 #endif /* SQLITE_OMIT_WINDOWFUNC */
1397 
1398 /*
1399 ** pOrderBy is an ORDER BY or GROUP BY clause in SELECT statement pSelect.
1400 ** The Name context of the SELECT statement is pNC.  zType is either
1401 ** "ORDER" or "GROUP" depending on which type of clause pOrderBy is.
1402 **
1403 ** This routine resolves each term of the clause into an expression.
1404 ** If the order-by term is an integer I between 1 and N (where N is the
1405 ** number of columns in the result set of the SELECT) then the expression
1406 ** in the resolution is a copy of the I-th result-set expression.  If
1407 ** the order-by term is an identifier that corresponds to the AS-name of
1408 ** a result-set expression, then the term resolves to a copy of the
1409 ** result-set expression.  Otherwise, the expression is resolved in
1410 ** the usual way - using sqlite3ResolveExprNames().
1411 **
1412 ** This routine returns the number of errors.  If errors occur, then
1413 ** an appropriate error message might be left in pParse.  (OOM errors
1414 ** excepted.)
1415 */
1416 static int resolveOrderGroupBy(
1417   NameContext *pNC,     /* The name context of the SELECT statement */
1418   Select *pSelect,      /* The SELECT statement holding pOrderBy */
1419   ExprList *pOrderBy,   /* An ORDER BY or GROUP BY clause to resolve */
1420   const char *zType     /* Either "ORDER" or "GROUP", as appropriate */
1421 ){
1422   int i, j;                      /* Loop counters */
1423   int iCol;                      /* Column number */
1424   struct ExprList_item *pItem;   /* A term of the ORDER BY clause */
1425   Parse *pParse;                 /* Parsing context */
1426   int nResult;                   /* Number of terms in the result set */
1427 
1428   if( pOrderBy==0 ) return 0;
1429   nResult = pSelect->pEList->nExpr;
1430   pParse = pNC->pParse;
1431   for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
1432     Expr *pE = pItem->pExpr;
1433     Expr *pE2 = sqlite3ExprSkipCollateAndLikely(pE);
1434     if( zType[0]!='G' ){
1435       iCol = resolveAsName(pParse, pSelect->pEList, pE2);
1436       if( iCol>0 ){
1437         /* If an AS-name match is found, mark this ORDER BY column as being
1438         ** a copy of the iCol-th result-set column.  The subsequent call to
1439         ** sqlite3ResolveOrderGroupBy() will convert the expression to a
1440         ** copy of the iCol-th result-set expression. */
1441         pItem->u.x.iOrderByCol = (u16)iCol;
1442         continue;
1443       }
1444     }
1445     if( sqlite3ExprIsInteger(pE2, &iCol) ){
1446       /* The ORDER BY term is an integer constant.  Again, set the column
1447       ** number so that sqlite3ResolveOrderGroupBy() will convert the
1448       ** order-by term to a copy of the result-set expression */
1449       if( iCol<1 || iCol>0xffff ){
1450         resolveOutOfRangeError(pParse, zType, i+1, nResult);
1451         return 1;
1452       }
1453       pItem->u.x.iOrderByCol = (u16)iCol;
1454       continue;
1455     }
1456 
1457     /* Otherwise, treat the ORDER BY term as an ordinary expression */
1458     pItem->u.x.iOrderByCol = 0;
1459     if( sqlite3ResolveExprNames(pNC, pE) ){
1460       return 1;
1461     }
1462     for(j=0; j<pSelect->pEList->nExpr; j++){
1463       if( sqlite3ExprCompare(0, pE, pSelect->pEList->a[j].pExpr, -1)==0 ){
1464         /* Since this expresion is being changed into a reference
1465         ** to an identical expression in the result set, remove all Window
1466         ** objects belonging to the expression from the Select.pWin list. */
1467         windowRemoveExprFromSelect(pSelect, pE);
1468         pItem->u.x.iOrderByCol = j+1;
1469       }
1470     }
1471   }
1472   return sqlite3ResolveOrderGroupBy(pParse, pSelect, pOrderBy, zType);
1473 }
1474 
1475 /*
1476 ** Resolve names in the SELECT statement p and all of its descendants.
1477 */
1478 static int resolveSelectStep(Walker *pWalker, Select *p){
1479   NameContext *pOuterNC;  /* Context that contains this SELECT */
1480   NameContext sNC;        /* Name context of this SELECT */
1481   int isCompound;         /* True if p is a compound select */
1482   int nCompound;          /* Number of compound terms processed so far */
1483   Parse *pParse;          /* Parsing context */
1484   int i;                  /* Loop counter */
1485   ExprList *pGroupBy;     /* The GROUP BY clause */
1486   Select *pLeftmost;      /* Left-most of SELECT of a compound */
1487   sqlite3 *db;            /* Database connection */
1488 
1489 
1490   assert( p!=0 );
1491   if( p->selFlags & SF_Resolved ){
1492     return WRC_Prune;
1493   }
1494   pOuterNC = pWalker->u.pNC;
1495   pParse = pWalker->pParse;
1496   db = pParse->db;
1497 
1498   /* Normally sqlite3SelectExpand() will be called first and will have
1499   ** already expanded this SELECT.  However, if this is a subquery within
1500   ** an expression, sqlite3ResolveExprNames() will be called without a
1501   ** prior call to sqlite3SelectExpand().  When that happens, let
1502   ** sqlite3SelectPrep() do all of the processing for this SELECT.
1503   ** sqlite3SelectPrep() will invoke both sqlite3SelectExpand() and
1504   ** this routine in the correct order.
1505   */
1506   if( (p->selFlags & SF_Expanded)==0 ){
1507     sqlite3SelectPrep(pParse, p, pOuterNC);
1508     return (pParse->nErr || db->mallocFailed) ? WRC_Abort : WRC_Prune;
1509   }
1510 
1511   isCompound = p->pPrior!=0;
1512   nCompound = 0;
1513   pLeftmost = p;
1514   while( p ){
1515     assert( (p->selFlags & SF_Expanded)!=0 );
1516     assert( (p->selFlags & SF_Resolved)==0 );
1517     p->selFlags |= SF_Resolved;
1518 
1519     /* Resolve the expressions in the LIMIT and OFFSET clauses. These
1520     ** are not allowed to refer to any names, so pass an empty NameContext.
1521     */
1522     memset(&sNC, 0, sizeof(sNC));
1523     sNC.pParse = pParse;
1524     sNC.pWinSelect = p;
1525     if( sqlite3ResolveExprNames(&sNC, p->pLimit) ){
1526       return WRC_Abort;
1527     }
1528 
1529     /* If the SF_Converted flags is set, then this Select object was
1530     ** was created by the convertCompoundSelectToSubquery() function.
1531     ** In this case the ORDER BY clause (p->pOrderBy) should be resolved
1532     ** as if it were part of the sub-query, not the parent. This block
1533     ** moves the pOrderBy down to the sub-query. It will be moved back
1534     ** after the names have been resolved.  */
1535     if( p->selFlags & SF_Converted ){
1536       Select *pSub = p->pSrc->a[0].pSelect;
1537       assert( p->pSrc->nSrc==1 && p->pOrderBy );
1538       assert( pSub->pPrior && pSub->pOrderBy==0 );
1539       pSub->pOrderBy = p->pOrderBy;
1540       p->pOrderBy = 0;
1541     }
1542 
1543     /* Recursively resolve names in all subqueries
1544     */
1545     for(i=0; i<p->pSrc->nSrc; i++){
1546       struct SrcList_item *pItem = &p->pSrc->a[i];
1547       if( pItem->pSelect && (pItem->pSelect->selFlags & SF_Resolved)==0 ){
1548         NameContext *pNC;         /* Used to iterate name contexts */
1549         int nRef = 0;             /* Refcount for pOuterNC and outer contexts */
1550         const char *zSavedContext = pParse->zAuthContext;
1551 
1552         /* Count the total number of references to pOuterNC and all of its
1553         ** parent contexts. After resolving references to expressions in
1554         ** pItem->pSelect, check if this value has changed. If so, then
1555         ** SELECT statement pItem->pSelect must be correlated. Set the
1556         ** pItem->fg.isCorrelated flag if this is the case. */
1557         for(pNC=pOuterNC; pNC; pNC=pNC->pNext) nRef += pNC->nRef;
1558 
1559         if( pItem->zName ) pParse->zAuthContext = pItem->zName;
1560         sqlite3ResolveSelectNames(pParse, pItem->pSelect, pOuterNC);
1561         pParse->zAuthContext = zSavedContext;
1562         if( pParse->nErr || db->mallocFailed ) return WRC_Abort;
1563 
1564         for(pNC=pOuterNC; pNC; pNC=pNC->pNext) nRef -= pNC->nRef;
1565         assert( pItem->fg.isCorrelated==0 && nRef<=0 );
1566         pItem->fg.isCorrelated = (nRef!=0);
1567       }
1568     }
1569 
1570     /* Set up the local name-context to pass to sqlite3ResolveExprNames() to
1571     ** resolve the result-set expression list.
1572     */
1573     sNC.ncFlags = NC_AllowAgg|NC_AllowWin;
1574     sNC.pSrcList = p->pSrc;
1575     sNC.pNext = pOuterNC;
1576 
1577     /* Resolve names in the result set. */
1578     if( sqlite3ResolveExprListNames(&sNC, p->pEList) ) return WRC_Abort;
1579     sNC.ncFlags &= ~NC_AllowWin;
1580 
1581     /* If there are no aggregate functions in the result-set, and no GROUP BY
1582     ** expression, do not allow aggregates in any of the other expressions.
1583     */
1584     assert( (p->selFlags & SF_Aggregate)==0 );
1585     pGroupBy = p->pGroupBy;
1586     if( pGroupBy || (sNC.ncFlags & NC_HasAgg)!=0 ){
1587       assert( NC_MinMaxAgg==SF_MinMaxAgg );
1588       p->selFlags |= SF_Aggregate | (sNC.ncFlags&NC_MinMaxAgg);
1589     }else{
1590       sNC.ncFlags &= ~NC_AllowAgg;
1591     }
1592 
1593     /* If a HAVING clause is present, then there must be a GROUP BY clause.
1594     */
1595     if( p->pHaving && !pGroupBy ){
1596       sqlite3ErrorMsg(pParse, "a GROUP BY clause is required before HAVING");
1597       return WRC_Abort;
1598     }
1599 
1600     /* Add the output column list to the name-context before parsing the
1601     ** other expressions in the SELECT statement. This is so that
1602     ** expressions in the WHERE clause (etc.) can refer to expressions by
1603     ** aliases in the result set.
1604     **
1605     ** Minor point: If this is the case, then the expression will be
1606     ** re-evaluated for each reference to it.
1607     */
1608     assert( (sNC.ncFlags & (NC_UAggInfo|NC_UUpsert))==0 );
1609     sNC.uNC.pEList = p->pEList;
1610     sNC.ncFlags |= NC_UEList;
1611     if( sqlite3ResolveExprNames(&sNC, p->pHaving) ) return WRC_Abort;
1612     if( sqlite3ResolveExprNames(&sNC, p->pWhere) ) return WRC_Abort;
1613 
1614     /* Resolve names in table-valued-function arguments */
1615     for(i=0; i<p->pSrc->nSrc; i++){
1616       struct SrcList_item *pItem = &p->pSrc->a[i];
1617       if( pItem->fg.isTabFunc
1618        && sqlite3ResolveExprListNames(&sNC, pItem->u1.pFuncArg)
1619       ){
1620         return WRC_Abort;
1621       }
1622     }
1623 
1624     /* The ORDER BY and GROUP BY clauses may not refer to terms in
1625     ** outer queries
1626     */
1627     sNC.pNext = 0;
1628     sNC.ncFlags |= NC_AllowAgg|NC_AllowWin;
1629 
1630     /* If this is a converted compound query, move the ORDER BY clause from
1631     ** the sub-query back to the parent query. At this point each term
1632     ** within the ORDER BY clause has been transformed to an integer value.
1633     ** These integers will be replaced by copies of the corresponding result
1634     ** set expressions by the call to resolveOrderGroupBy() below.  */
1635     if( p->selFlags & SF_Converted ){
1636       Select *pSub = p->pSrc->a[0].pSelect;
1637       p->pOrderBy = pSub->pOrderBy;
1638       pSub->pOrderBy = 0;
1639     }
1640 
1641     /* Process the ORDER BY clause for singleton SELECT statements.
1642     ** The ORDER BY clause for compounds SELECT statements is handled
1643     ** below, after all of the result-sets for all of the elements of
1644     ** the compound have been resolved.
1645     **
1646     ** If there is an ORDER BY clause on a term of a compound-select other
1647     ** than the right-most term, then that is a syntax error.  But the error
1648     ** is not detected until much later, and so we need to go ahead and
1649     ** resolve those symbols on the incorrect ORDER BY for consistency.
1650     */
1651     if( isCompound<=nCompound  /* Defer right-most ORDER BY of a compound */
1652      && resolveOrderGroupBy(&sNC, p, p->pOrderBy, "ORDER")
1653     ){
1654       return WRC_Abort;
1655     }
1656     if( db->mallocFailed ){
1657       return WRC_Abort;
1658     }
1659     sNC.ncFlags &= ~NC_AllowWin;
1660 
1661     /* Resolve the GROUP BY clause.  At the same time, make sure
1662     ** the GROUP BY clause does not contain aggregate functions.
1663     */
1664     if( pGroupBy ){
1665       struct ExprList_item *pItem;
1666 
1667       if( resolveOrderGroupBy(&sNC, p, pGroupBy, "GROUP") || db->mallocFailed ){
1668         return WRC_Abort;
1669       }
1670       for(i=0, pItem=pGroupBy->a; i<pGroupBy->nExpr; i++, pItem++){
1671         if( ExprHasProperty(pItem->pExpr, EP_Agg) ){
1672           sqlite3ErrorMsg(pParse, "aggregate functions are not allowed in "
1673               "the GROUP BY clause");
1674           return WRC_Abort;
1675         }
1676       }
1677     }
1678 
1679 #ifndef SQLITE_OMIT_WINDOWFUNC
1680     if( IN_RENAME_OBJECT ){
1681       Window *pWin;
1682       for(pWin=p->pWinDefn; pWin; pWin=pWin->pNextWin){
1683         if( sqlite3ResolveExprListNames(&sNC, pWin->pOrderBy)
1684          || sqlite3ResolveExprListNames(&sNC, pWin->pPartition)
1685         ){
1686           return WRC_Abort;
1687         }
1688       }
1689     }
1690 #endif
1691 
1692     /* If this is part of a compound SELECT, check that it has the right
1693     ** number of expressions in the select list. */
1694     if( p->pNext && p->pEList->nExpr!=p->pNext->pEList->nExpr ){
1695       sqlite3SelectWrongNumTermsError(pParse, p->pNext);
1696       return WRC_Abort;
1697     }
1698 
1699     /* Advance to the next term of the compound
1700     */
1701     p = p->pPrior;
1702     nCompound++;
1703   }
1704 
1705   /* Resolve the ORDER BY on a compound SELECT after all terms of
1706   ** the compound have been resolved.
1707   */
1708   if( isCompound && resolveCompoundOrderBy(pParse, pLeftmost) ){
1709     return WRC_Abort;
1710   }
1711 
1712   return WRC_Prune;
1713 }
1714 
1715 /*
1716 ** This routine walks an expression tree and resolves references to
1717 ** table columns and result-set columns.  At the same time, do error
1718 ** checking on function usage and set a flag if any aggregate functions
1719 ** are seen.
1720 **
1721 ** To resolve table columns references we look for nodes (or subtrees) of the
1722 ** form X.Y.Z or Y.Z or just Z where
1723 **
1724 **      X:   The name of a database.  Ex:  "main" or "temp" or
1725 **           the symbolic name assigned to an ATTACH-ed database.
1726 **
1727 **      Y:   The name of a table in a FROM clause.  Or in a trigger
1728 **           one of the special names "old" or "new".
1729 **
1730 **      Z:   The name of a column in table Y.
1731 **
1732 ** The node at the root of the subtree is modified as follows:
1733 **
1734 **    Expr.op        Changed to TK_COLUMN
1735 **    Expr.pTab      Points to the Table object for X.Y
1736 **    Expr.iColumn   The column index in X.Y.  -1 for the rowid.
1737 **    Expr.iTable    The VDBE cursor number for X.Y
1738 **
1739 **
1740 ** To resolve result-set references, look for expression nodes of the
1741 ** form Z (with no X and Y prefix) where the Z matches the right-hand
1742 ** size of an AS clause in the result-set of a SELECT.  The Z expression
1743 ** is replaced by a copy of the left-hand side of the result-set expression.
1744 ** Table-name and function resolution occurs on the substituted expression
1745 ** tree.  For example, in:
1746 **
1747 **      SELECT a+b AS x, c+d AS y FROM t1 ORDER BY x;
1748 **
1749 ** The "x" term of the order by is replaced by "a+b" to render:
1750 **
1751 **      SELECT a+b AS x, c+d AS y FROM t1 ORDER BY a+b;
1752 **
1753 ** Function calls are checked to make sure that the function is
1754 ** defined and that the correct number of arguments are specified.
1755 ** If the function is an aggregate function, then the NC_HasAgg flag is
1756 ** set and the opcode is changed from TK_FUNCTION to TK_AGG_FUNCTION.
1757 ** If an expression contains aggregate functions then the EP_Agg
1758 ** property on the expression is set.
1759 **
1760 ** An error message is left in pParse if anything is amiss.  The number
1761 ** if errors is returned.
1762 */
1763 int sqlite3ResolveExprNames(
1764   NameContext *pNC,       /* Namespace to resolve expressions in. */
1765   Expr *pExpr             /* The expression to be analyzed. */
1766 ){
1767   int savedHasAgg;
1768   Walker w;
1769 
1770   if( pExpr==0 ) return SQLITE_OK;
1771   savedHasAgg = pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
1772   pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
1773   w.pParse = pNC->pParse;
1774   w.xExprCallback = resolveExprStep;
1775   w.xSelectCallback = resolveSelectStep;
1776   w.xSelectCallback2 = 0;
1777   w.u.pNC = pNC;
1778 #if SQLITE_MAX_EXPR_DEPTH>0
1779   w.pParse->nHeight += pExpr->nHeight;
1780   if( sqlite3ExprCheckHeight(w.pParse, w.pParse->nHeight) ){
1781     return SQLITE_ERROR;
1782   }
1783 #endif
1784   sqlite3WalkExpr(&w, pExpr);
1785 #if SQLITE_MAX_EXPR_DEPTH>0
1786   w.pParse->nHeight -= pExpr->nHeight;
1787 #endif
1788   assert( EP_Agg==NC_HasAgg );
1789   assert( EP_Win==NC_HasWin );
1790   testcase( pNC->ncFlags & NC_HasAgg );
1791   testcase( pNC->ncFlags & NC_HasWin );
1792   ExprSetProperty(pExpr, pNC->ncFlags & (NC_HasAgg|NC_HasWin) );
1793   pNC->ncFlags |= savedHasAgg;
1794   return pNC->nErr>0 || w.pParse->nErr>0;
1795 }
1796 
1797 /*
1798 ** Resolve all names for all expression in an expression list.  This is
1799 ** just like sqlite3ResolveExprNames() except that it works for an expression
1800 ** list rather than a single expression.
1801 */
1802 int sqlite3ResolveExprListNames(
1803   NameContext *pNC,       /* Namespace to resolve expressions in. */
1804   ExprList *pList         /* The expression list to be analyzed. */
1805 ){
1806   int i;
1807   if( pList ){
1808     for(i=0; i<pList->nExpr; i++){
1809       if( sqlite3ResolveExprNames(pNC, pList->a[i].pExpr) ) return WRC_Abort;
1810     }
1811   }
1812   return WRC_Continue;
1813 }
1814 
1815 /*
1816 ** Resolve all names in all expressions of a SELECT and in all
1817 ** decendents of the SELECT, including compounds off of p->pPrior,
1818 ** subqueries in expressions, and subqueries used as FROM clause
1819 ** terms.
1820 **
1821 ** See sqlite3ResolveExprNames() for a description of the kinds of
1822 ** transformations that occur.
1823 **
1824 ** All SELECT statements should have been expanded using
1825 ** sqlite3SelectExpand() prior to invoking this routine.
1826 */
1827 void sqlite3ResolveSelectNames(
1828   Parse *pParse,         /* The parser context */
1829   Select *p,             /* The SELECT statement being coded. */
1830   NameContext *pOuterNC  /* Name context for parent SELECT statement */
1831 ){
1832   Walker w;
1833 
1834   assert( p!=0 );
1835   w.xExprCallback = resolveExprStep;
1836   w.xSelectCallback = resolveSelectStep;
1837   w.xSelectCallback2 = 0;
1838   w.pParse = pParse;
1839   w.u.pNC = pOuterNC;
1840   sqlite3WalkSelect(&w, p);
1841 }
1842 
1843 /*
1844 ** Resolve names in expressions that can only reference a single table
1845 ** or which cannot reference any tables at all.  Examples:
1846 **
1847 **                                                    "type" flag
1848 **                                                    ------------
1849 **    (1)   CHECK constraints                         NC_IsCheck
1850 **    (2)   WHERE clauses on partial indices          NC_PartIdx
1851 **    (3)   Expressions in indexes on expressions     NC_IdxExpr
1852 **    (4)   Expression arguments to VACUUM INTO.      0
1853 **    (5)   GENERATED ALWAYS as expressions           NC_GenCol
1854 **
1855 ** In all cases except (4), the Expr.iTable value for Expr.op==TK_COLUMN
1856 ** nodes of the expression is set to -1 and the Expr.iColumn value is
1857 ** set to the column number.  In case (4), TK_COLUMN nodes cause an error.
1858 **
1859 ** Any errors cause an error message to be set in pParse.
1860 */
1861 int sqlite3ResolveSelfReference(
1862   Parse *pParse,   /* Parsing context */
1863   Table *pTab,     /* The table being referenced, or NULL */
1864   int type,        /* NC_IsCheck, NC_PartIdx, NC_IdxExpr, NC_GenCol, or 0 */
1865   Expr *pExpr,     /* Expression to resolve.  May be NULL. */
1866   ExprList *pList  /* Expression list to resolve.  May be NULL. */
1867 ){
1868   SrcList sSrc;                   /* Fake SrcList for pParse->pNewTable */
1869   NameContext sNC;                /* Name context for pParse->pNewTable */
1870   int rc;
1871 
1872   assert( type==0 || pTab!=0 );
1873   assert( type==NC_IsCheck || type==NC_PartIdx || type==NC_IdxExpr
1874           || type==NC_GenCol || pTab==0 );
1875   memset(&sNC, 0, sizeof(sNC));
1876   memset(&sSrc, 0, sizeof(sSrc));
1877   if( pTab ){
1878     sSrc.nSrc = 1;
1879     sSrc.a[0].zName = pTab->zName;
1880     sSrc.a[0].pTab = pTab;
1881     sSrc.a[0].iCursor = -1;
1882   }
1883   sNC.pParse = pParse;
1884   sNC.pSrcList = &sSrc;
1885   sNC.ncFlags = type | NC_IsDDL;
1886   if( (rc = sqlite3ResolveExprNames(&sNC, pExpr))!=SQLITE_OK ) return rc;
1887   if( pList ) rc = sqlite3ResolveExprListNames(&sNC, pList);
1888   return rc;
1889 }
1890