xref: /sqlite-3.40.0/src/resolve.c (revision 6695f47e)
1 /*
2 ** 2008 August 18
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 **
13 ** This file contains routines used for walking the parser tree and
14 ** resolve all identifiers by associating them with a particular
15 ** table and column.
16 */
17 #include "sqliteInt.h"
18 #include <stdlib.h>
19 #include <string.h>
20 
21 /*
22 ** Turn the pExpr expression into an alias for the iCol-th column of the
23 ** result set in pEList.
24 **
25 ** If the result set column is a simple column reference, then this routine
26 ** makes an exact copy.  But for any other kind of expression, this
27 ** routine make a copy of the result set column as the argument to the
28 ** TK_AS operator.  The TK_AS operator causes the expression to be
29 ** evaluated just once and then reused for each alias.
30 **
31 ** The reason for suppressing the TK_AS term when the expression is a simple
32 ** column reference is so that the column reference will be recognized as
33 ** usable by indices within the WHERE clause processing logic.
34 **
35 ** Hack:  The TK_AS operator is inhibited if zType[0]=='G'.  This means
36 ** that in a GROUP BY clause, the expression is evaluated twice.  Hence:
37 **
38 **     SELECT random()%5 AS x, count(*) FROM tab GROUP BY x
39 **
40 ** Is equivalent to:
41 **
42 **     SELECT random()%5 AS x, count(*) FROM tab GROUP BY random()%5
43 **
44 ** The result of random()%5 in the GROUP BY clause is probably different
45 ** from the result in the result-set.  We might fix this someday.  Or
46 ** then again, we might not...
47 */
48 static void resolveAlias(
49   Parse *pParse,         /* Parsing context */
50   ExprList *pEList,      /* A result set */
51   int iCol,              /* A column in the result set.  0..pEList->nExpr-1 */
52   Expr *pExpr,           /* Transform this into an alias to the result set */
53   const char *zType      /* "GROUP" or "ORDER" or "" */
54 ){
55   Expr *pOrig;           /* The iCol-th column of the result set */
56   Expr *pDup;            /* Copy of pOrig */
57   sqlite3 *db;           /* The database connection */
58 
59   assert( iCol>=0 && iCol<pEList->nExpr );
60   pOrig = pEList->a[iCol].pExpr;
61   assert( pOrig!=0 );
62   assert( pOrig->flags & EP_Resolved );
63   db = pParse->db;
64   if( pOrig->op!=TK_COLUMN && zType[0]!='G' ){
65     pDup = sqlite3ExprDup(db, pOrig, 0);
66     pDup = sqlite3PExpr(pParse, TK_AS, pDup, 0, 0);
67     if( pDup==0 ) return;
68     if( pEList->a[iCol].iAlias==0 ){
69       pEList->a[iCol].iAlias = (u16)(++pParse->nAlias);
70     }
71     pDup->iTable = pEList->a[iCol].iAlias;
72   }else if( ExprHasProperty(pOrig, EP_IntValue) || pOrig->u.zToken==0 ){
73     pDup = sqlite3ExprDup(db, pOrig, 0);
74     if( pDup==0 ) return;
75   }else{
76     char *zToken = pOrig->u.zToken;
77     assert( zToken!=0 );
78     pOrig->u.zToken = 0;
79     pDup = sqlite3ExprDup(db, pOrig, 0);
80     pOrig->u.zToken = zToken;
81     if( pDup==0 ) return;
82     assert( (pDup->flags & (EP_Reduced|EP_TokenOnly))==0 );
83     pDup->flags2 |= EP2_MallocedToken;
84     pDup->u.zToken = sqlite3DbStrDup(db, zToken);
85   }
86   if( pExpr->flags & EP_ExpCollate ){
87     pDup->pColl = pExpr->pColl;
88     pDup->flags |= EP_ExpCollate;
89   }
90 
91   /* Before calling sqlite3ExprDelete(), set the EP_Static flag. This
92   ** prevents ExprDelete() from deleting the Expr structure itself,
93   ** allowing it to be repopulated by the memcpy() on the following line.
94   */
95   ExprSetProperty(pExpr, EP_Static);
96   sqlite3ExprDelete(db, pExpr);
97   memcpy(pExpr, pDup, sizeof(*pExpr));
98   sqlite3DbFree(db, pDup);
99 }
100 
101 /*
102 ** Given the name of a column of the form X.Y.Z or Y.Z or just Z, look up
103 ** that name in the set of source tables in pSrcList and make the pExpr
104 ** expression node refer back to that source column.  The following changes
105 ** are made to pExpr:
106 **
107 **    pExpr->iDb           Set the index in db->aDb[] of the database X
108 **                         (even if X is implied).
109 **    pExpr->iTable        Set to the cursor number for the table obtained
110 **                         from pSrcList.
111 **    pExpr->pTab          Points to the Table structure of X.Y (even if
112 **                         X and/or Y are implied.)
113 **    pExpr->iColumn       Set to the column number within the table.
114 **    pExpr->op            Set to TK_COLUMN.
115 **    pExpr->pLeft         Any expression this points to is deleted
116 **    pExpr->pRight        Any expression this points to is deleted.
117 **
118 ** The zDb variable is the name of the database (the "X").  This value may be
119 ** NULL meaning that name is of the form Y.Z or Z.  Any available database
120 ** can be used.  The zTable variable is the name of the table (the "Y").  This
121 ** value can be NULL if zDb is also NULL.  If zTable is NULL it
122 ** means that the form of the name is Z and that columns from any table
123 ** can be used.
124 **
125 ** If the name cannot be resolved unambiguously, leave an error message
126 ** in pParse and return WRC_Abort.  Return WRC_Prune on success.
127 */
128 static int lookupName(
129   Parse *pParse,       /* The parsing context */
130   const char *zDb,     /* Name of the database containing table, or NULL */
131   const char *zTab,    /* Name of table containing column, or NULL */
132   const char *zCol,    /* Name of the column. */
133   NameContext *pNC,    /* The name context used to resolve the name */
134   Expr *pExpr          /* Make this EXPR node point to the selected column */
135 ){
136   int i, j;            /* Loop counters */
137   int cnt = 0;                      /* Number of matching column names */
138   int cntTab = 0;                   /* Number of matching table names */
139   sqlite3 *db = pParse->db;         /* The database connection */
140   struct SrcList_item *pItem;       /* Use for looping over pSrcList items */
141   struct SrcList_item *pMatch = 0;  /* The matching pSrcList item */
142   NameContext *pTopNC = pNC;        /* First namecontext in the list */
143   Schema *pSchema = 0;              /* Schema of the expression */
144   int isTrigger = 0;
145 
146   assert( pNC );     /* the name context cannot be NULL. */
147   assert( zCol );    /* The Z in X.Y.Z cannot be NULL */
148   assert( ~ExprHasAnyProperty(pExpr, EP_TokenOnly|EP_Reduced) );
149 
150   /* Initialize the node to no-match */
151   pExpr->iTable = -1;
152   pExpr->pTab = 0;
153   ExprSetIrreducible(pExpr);
154 
155   /* Start at the inner-most context and move outward until a match is found */
156   while( pNC && cnt==0 ){
157     ExprList *pEList;
158     SrcList *pSrcList = pNC->pSrcList;
159 
160     if( pSrcList ){
161       for(i=0, pItem=pSrcList->a; i<pSrcList->nSrc; i++, pItem++){
162         Table *pTab;
163         int iDb;
164         Column *pCol;
165 
166         pTab = pItem->pTab;
167         assert( pTab!=0 && pTab->zName!=0 );
168         iDb = sqlite3SchemaToIndex(db, pTab->pSchema);
169         assert( pTab->nCol>0 );
170         if( zTab ){
171           if( pItem->zAlias ){
172             char *zTabName = pItem->zAlias;
173             if( sqlite3StrICmp(zTabName, zTab)!=0 ) continue;
174           }else{
175             char *zTabName = pTab->zName;
176             if( NEVER(zTabName==0) || sqlite3StrICmp(zTabName, zTab)!=0 ){
177               continue;
178             }
179             if( zDb!=0 && sqlite3StrICmp(db->aDb[iDb].zName, zDb)!=0 ){
180               continue;
181             }
182           }
183         }
184         if( 0==(cntTab++) ){
185           pExpr->iTable = pItem->iCursor;
186           pExpr->pTab = pTab;
187           pSchema = pTab->pSchema;
188           pMatch = pItem;
189         }
190         for(j=0, pCol=pTab->aCol; j<pTab->nCol; j++, pCol++){
191           if( sqlite3StrICmp(pCol->zName, zCol)==0 ){
192             IdList *pUsing;
193             cnt++;
194             pExpr->iTable = pItem->iCursor;
195             pExpr->pTab = pTab;
196             pMatch = pItem;
197             pSchema = pTab->pSchema;
198             /* Substitute the rowid (column -1) for the INTEGER PRIMARY KEY */
199             pExpr->iColumn = j==pTab->iPKey ? -1 : (i16)j;
200             if( i<pSrcList->nSrc-1 ){
201               if( pItem[1].jointype & JT_NATURAL ){
202                 /* If this match occurred in the left table of a natural join,
203                 ** then skip the right table to avoid a duplicate match */
204                 pItem++;
205                 i++;
206               }else if( (pUsing = pItem[1].pUsing)!=0 ){
207                 /* If this match occurs on a column that is in the USING clause
208                 ** of a join, skip the search of the right table of the join
209                 ** to avoid a duplicate match there. */
210                 int k;
211                 for(k=0; k<pUsing->nId; k++){
212                   if( sqlite3StrICmp(pUsing->a[k].zName, zCol)==0 ){
213                     pItem++;
214                     i++;
215                     break;
216                   }
217                 }
218               }
219             }
220             break;
221           }
222         }
223       }
224     }
225 
226 #ifndef SQLITE_OMIT_TRIGGER
227     /* If we have not already resolved the name, then maybe
228     ** it is a new.* or old.* trigger argument reference
229     */
230     if( zDb==0 && zTab!=0 && cnt==0 && pParse->pTriggerTab!=0 ){
231       int op = pParse->eTriggerOp;
232       Table *pTab = 0;
233       assert( op==TK_DELETE || op==TK_UPDATE || op==TK_INSERT );
234       if( op!=TK_DELETE && sqlite3StrICmp("new",zTab) == 0 ){
235         pExpr->iTable = 1;
236         pTab = pParse->pTriggerTab;
237       }else if( op!=TK_INSERT && sqlite3StrICmp("old",zTab)==0 ){
238         pExpr->iTable = 0;
239         pTab = pParse->pTriggerTab;
240       }
241 
242       if( pTab ){
243         int iCol;
244         pSchema = pTab->pSchema;
245         cntTab++;
246         if( sqlite3IsRowid(zCol) ){
247           iCol = -1;
248         }else{
249           for(iCol=0; iCol<pTab->nCol; iCol++){
250             Column *pCol = &pTab->aCol[iCol];
251             if( sqlite3StrICmp(pCol->zName, zCol)==0 ){
252               if( iCol==pTab->iPKey ){
253                 iCol = -1;
254               }
255               break;
256             }
257           }
258         }
259         if( iCol<pTab->nCol ){
260           cnt++;
261           if( iCol<0 ){
262             pExpr->affinity = SQLITE_AFF_INTEGER;
263           }else if( pExpr->iTable==0 ){
264             testcase( iCol==31 );
265             testcase( iCol==32 );
266             pParse->oldmask |= (iCol>=32 ? 0xffffffff : (((u32)1)<<iCol));
267           }else{
268             testcase( iCol==31 );
269             testcase( iCol==32 );
270             pParse->newmask |= (iCol>=32 ? 0xffffffff : (((u32)1)<<iCol));
271           }
272           pExpr->iColumn = (i16)iCol;
273           pExpr->pTab = pTab;
274           isTrigger = 1;
275         }
276       }
277     }
278 #endif /* !defined(SQLITE_OMIT_TRIGGER) */
279 
280     /*
281     ** Perhaps the name is a reference to the ROWID
282     */
283     if( cnt==0 && cntTab==1 && sqlite3IsRowid(zCol) ){
284       cnt = 1;
285       pExpr->iColumn = -1;
286       pExpr->affinity = SQLITE_AFF_INTEGER;
287     }
288 
289     /*
290     ** If the input is of the form Z (not Y.Z or X.Y.Z) then the name Z
291     ** might refer to an result-set alias.  This happens, for example, when
292     ** we are resolving names in the WHERE clause of the following command:
293     **
294     **     SELECT a+b AS x FROM table WHERE x<10;
295     **
296     ** In cases like this, replace pExpr with a copy of the expression that
297     ** forms the result set entry ("a+b" in the example) and return immediately.
298     ** Note that the expression in the result set should have already been
299     ** resolved by the time the WHERE clause is resolved.
300     */
301     if( cnt==0 && (pEList = pNC->pEList)!=0 && zTab==0 ){
302       for(j=0; j<pEList->nExpr; j++){
303         char *zAs = pEList->a[j].zName;
304         if( zAs!=0 && sqlite3StrICmp(zAs, zCol)==0 ){
305           Expr *pOrig;
306           assert( pExpr->pLeft==0 && pExpr->pRight==0 );
307           assert( pExpr->x.pList==0 );
308           assert( pExpr->x.pSelect==0 );
309           pOrig = pEList->a[j].pExpr;
310           if( !pNC->allowAgg && ExprHasProperty(pOrig, EP_Agg) ){
311             sqlite3ErrorMsg(pParse, "misuse of aliased aggregate %s", zAs);
312             return WRC_Abort;
313           }
314           resolveAlias(pParse, pEList, j, pExpr, "");
315           cnt = 1;
316           pMatch = 0;
317           assert( zTab==0 && zDb==0 );
318           goto lookupname_end;
319         }
320       }
321     }
322 
323     /* Advance to the next name context.  The loop will exit when either
324     ** we have a match (cnt>0) or when we run out of name contexts.
325     */
326     if( cnt==0 ){
327       pNC = pNC->pNext;
328     }
329   }
330 
331   /*
332   ** If X and Y are NULL (in other words if only the column name Z is
333   ** supplied) and the value of Z is enclosed in double-quotes, then
334   ** Z is a string literal if it doesn't match any column names.  In that
335   ** case, we need to return right away and not make any changes to
336   ** pExpr.
337   **
338   ** Because no reference was made to outer contexts, the pNC->nRef
339   ** fields are not changed in any context.
340   */
341   if( cnt==0 && zTab==0 && ExprHasProperty(pExpr,EP_DblQuoted) ){
342     pExpr->op = TK_STRING;
343     pExpr->pTab = 0;
344     return WRC_Prune;
345   }
346 
347   /*
348   ** cnt==0 means there was not match.  cnt>1 means there were two or
349   ** more matches.  Either way, we have an error.
350   */
351   if( cnt!=1 ){
352     const char *zErr;
353     zErr = cnt==0 ? "no such column" : "ambiguous column name";
354     if( zDb ){
355       sqlite3ErrorMsg(pParse, "%s: %s.%s.%s", zErr, zDb, zTab, zCol);
356     }else if( zTab ){
357       sqlite3ErrorMsg(pParse, "%s: %s.%s", zErr, zTab, zCol);
358     }else{
359       sqlite3ErrorMsg(pParse, "%s: %s", zErr, zCol);
360     }
361     pTopNC->nErr++;
362   }
363 
364   /* If a column from a table in pSrcList is referenced, then record
365   ** this fact in the pSrcList.a[].colUsed bitmask.  Column 0 causes
366   ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.  If the
367   ** column number is greater than the number of bits in the bitmask
368   ** then set the high-order bit of the bitmask.
369   */
370   if( pExpr->iColumn>=0 && pMatch!=0 ){
371     int n = pExpr->iColumn;
372     testcase( n==BMS-1 );
373     if( n>=BMS ){
374       n = BMS-1;
375     }
376     assert( pMatch->iCursor==pExpr->iTable );
377     pMatch->colUsed |= ((Bitmask)1)<<n;
378   }
379 
380   /* Clean up and return
381   */
382   sqlite3ExprDelete(db, pExpr->pLeft);
383   pExpr->pLeft = 0;
384   sqlite3ExprDelete(db, pExpr->pRight);
385   pExpr->pRight = 0;
386   pExpr->op = (isTrigger ? TK_TRIGGER : TK_COLUMN);
387 lookupname_end:
388   if( cnt==1 ){
389     assert( pNC!=0 );
390     sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList);
391     /* Increment the nRef value on all name contexts from TopNC up to
392     ** the point where the name matched. */
393     for(;;){
394       assert( pTopNC!=0 );
395       pTopNC->nRef++;
396       if( pTopNC==pNC ) break;
397       pTopNC = pTopNC->pNext;
398     }
399     return WRC_Prune;
400   } else {
401     return WRC_Abort;
402   }
403 }
404 
405 /*
406 ** Allocate and return a pointer to an expression to load the column iCol
407 ** from datasource iSrc datasource in SrcList pSrc.
408 */
409 Expr *sqlite3CreateColumnExpr(sqlite3 *db, SrcList *pSrc, int iSrc, int iCol){
410   Expr *p = sqlite3ExprAlloc(db, TK_COLUMN, 0, 0);
411   if( p ){
412     struct SrcList_item *pItem = &pSrc->a[iSrc];
413     p->pTab = pItem->pTab;
414     p->iTable = pItem->iCursor;
415     if( p->pTab->iPKey==iCol ){
416       p->iColumn = -1;
417     }else{
418       p->iColumn = (ynVar)iCol;
419       pItem->colUsed |= ((Bitmask)1)<<(iCol>=BMS ? BMS-1 : iCol);
420     }
421     ExprSetProperty(p, EP_Resolved);
422   }
423   return p;
424 }
425 
426 /*
427 ** This routine is callback for sqlite3WalkExpr().
428 **
429 ** Resolve symbolic names into TK_COLUMN operators for the current
430 ** node in the expression tree.  Return 0 to continue the search down
431 ** the tree or 2 to abort the tree walk.
432 **
433 ** This routine also does error checking and name resolution for
434 ** function names.  The operator for aggregate functions is changed
435 ** to TK_AGG_FUNCTION.
436 */
437 static int resolveExprStep(Walker *pWalker, Expr *pExpr){
438   NameContext *pNC;
439   Parse *pParse;
440 
441   pNC = pWalker->u.pNC;
442   assert( pNC!=0 );
443   pParse = pNC->pParse;
444   assert( pParse==pWalker->pParse );
445 
446   if( ExprHasAnyProperty(pExpr, EP_Resolved) ) return WRC_Prune;
447   ExprSetProperty(pExpr, EP_Resolved);
448 #ifndef NDEBUG
449   if( pNC->pSrcList && pNC->pSrcList->nAlloc>0 ){
450     SrcList *pSrcList = pNC->pSrcList;
451     int i;
452     for(i=0; i<pNC->pSrcList->nSrc; i++){
453       assert( pSrcList->a[i].iCursor>=0 && pSrcList->a[i].iCursor<pParse->nTab);
454     }
455   }
456 #endif
457   switch( pExpr->op ){
458 
459 #if defined(SQLITE_ENABLE_UPDATE_DELETE_LIMIT) && !defined(SQLITE_OMIT_SUBQUERY)
460     /* The special operator TK_ROW means use the rowid for the first
461     ** column in the FROM clause.  This is used by the LIMIT and ORDER BY
462     ** clause processing on UPDATE and DELETE statements.
463     */
464     case TK_ROW: {
465       SrcList *pSrcList = pNC->pSrcList;
466       struct SrcList_item *pItem;
467       assert( pSrcList && pSrcList->nSrc==1 );
468       pItem = pSrcList->a;
469       pExpr->op = TK_COLUMN;
470       pExpr->pTab = pItem->pTab;
471       pExpr->iTable = pItem->iCursor;
472       pExpr->iColumn = -1;
473       pExpr->affinity = SQLITE_AFF_INTEGER;
474       break;
475     }
476 #endif /* defined(SQLITE_ENABLE_UPDATE_DELETE_LIMIT) && !defined(SQLITE_OMIT_SUBQUERY) */
477 
478     /* A lone identifier is the name of a column.
479     */
480     case TK_ID: {
481       return lookupName(pParse, 0, 0, pExpr->u.zToken, pNC, pExpr);
482     }
483 
484     /* A table name and column name:     ID.ID
485     ** Or a database, table and column:  ID.ID.ID
486     */
487     case TK_DOT: {
488       const char *zColumn;
489       const char *zTable;
490       const char *zDb;
491       Expr *pRight;
492 
493       /* if( pSrcList==0 ) break; */
494       pRight = pExpr->pRight;
495       if( pRight->op==TK_ID ){
496         zDb = 0;
497         zTable = pExpr->pLeft->u.zToken;
498         zColumn = pRight->u.zToken;
499       }else{
500         assert( pRight->op==TK_DOT );
501         zDb = pExpr->pLeft->u.zToken;
502         zTable = pRight->pLeft->u.zToken;
503         zColumn = pRight->pRight->u.zToken;
504       }
505       return lookupName(pParse, zDb, zTable, zColumn, pNC, pExpr);
506     }
507 
508     /* Resolve function names
509     */
510     case TK_CONST_FUNC:
511     case TK_FUNCTION: {
512       ExprList *pList = pExpr->x.pList;    /* The argument list */
513       int n = pList ? pList->nExpr : 0;    /* Number of arguments */
514       int no_such_func = 0;       /* True if no such function exists */
515       int wrong_num_args = 0;     /* True if wrong number of arguments */
516       int is_agg = 0;             /* True if is an aggregate function */
517       int auth;                   /* Authorization to use the function */
518       int nId;                    /* Number of characters in function name */
519       const char *zId;            /* The function name. */
520       FuncDef *pDef;              /* Information about the function */
521       u8 enc = ENC(pParse->db);   /* The database encoding */
522 
523       testcase( pExpr->op==TK_CONST_FUNC );
524       assert( !ExprHasProperty(pExpr, EP_xIsSelect) );
525       zId = pExpr->u.zToken;
526       nId = sqlite3Strlen30(zId);
527       pDef = sqlite3FindFunction(pParse->db, zId, nId, n, enc, 0);
528       if( pDef==0 ){
529         pDef = sqlite3FindFunction(pParse->db, zId, nId, -1, enc, 0);
530         if( pDef==0 ){
531           no_such_func = 1;
532         }else{
533           wrong_num_args = 1;
534         }
535       }else{
536         is_agg = pDef->xFunc==0;
537       }
538 #ifndef SQLITE_OMIT_AUTHORIZATION
539       if( pDef ){
540         auth = sqlite3AuthCheck(pParse, SQLITE_FUNCTION, 0, pDef->zName, 0);
541         if( auth!=SQLITE_OK ){
542           if( auth==SQLITE_DENY ){
543             sqlite3ErrorMsg(pParse, "not authorized to use function: %s",
544                                     pDef->zName);
545             pNC->nErr++;
546           }
547           pExpr->op = TK_NULL;
548           return WRC_Prune;
549         }
550       }
551 #endif
552       if( is_agg && !pNC->allowAgg ){
553         sqlite3ErrorMsg(pParse, "misuse of aggregate function %.*s()", nId,zId);
554         pNC->nErr++;
555         is_agg = 0;
556       }else if( no_such_func ){
557         sqlite3ErrorMsg(pParse, "no such function: %.*s", nId, zId);
558         pNC->nErr++;
559       }else if( wrong_num_args ){
560         sqlite3ErrorMsg(pParse,"wrong number of arguments to function %.*s()",
561              nId, zId);
562         pNC->nErr++;
563       }
564       if( is_agg ){
565         pExpr->op = TK_AGG_FUNCTION;
566         pNC->hasAgg = 1;
567       }
568       if( is_agg ) pNC->allowAgg = 0;
569       sqlite3WalkExprList(pWalker, pList);
570       if( is_agg ) pNC->allowAgg = 1;
571       /* FIX ME:  Compute pExpr->affinity based on the expected return
572       ** type of the function
573       */
574       return WRC_Prune;
575     }
576 #ifndef SQLITE_OMIT_SUBQUERY
577     case TK_SELECT:
578     case TK_EXISTS:  testcase( pExpr->op==TK_EXISTS );
579 #endif
580     case TK_IN: {
581       testcase( pExpr->op==TK_IN );
582       if( ExprHasProperty(pExpr, EP_xIsSelect) ){
583         int nRef = pNC->nRef;
584 #ifndef SQLITE_OMIT_CHECK
585         if( pNC->isCheck ){
586           sqlite3ErrorMsg(pParse,"subqueries prohibited in CHECK constraints");
587         }
588 #endif
589         sqlite3WalkSelect(pWalker, pExpr->x.pSelect);
590         assert( pNC->nRef>=nRef );
591         if( nRef!=pNC->nRef ){
592           ExprSetProperty(pExpr, EP_VarSelect);
593         }
594       }
595       break;
596     }
597 #ifndef SQLITE_OMIT_CHECK
598     case TK_VARIABLE: {
599       if( pNC->isCheck ){
600         sqlite3ErrorMsg(pParse,"parameters prohibited in CHECK constraints");
601       }
602       break;
603     }
604 #endif
605   }
606   return (pParse->nErr || pParse->db->mallocFailed) ? WRC_Abort : WRC_Continue;
607 }
608 
609 /*
610 ** pEList is a list of expressions which are really the result set of the
611 ** a SELECT statement.  pE is a term in an ORDER BY or GROUP BY clause.
612 ** This routine checks to see if pE is a simple identifier which corresponds
613 ** to the AS-name of one of the terms of the expression list.  If it is,
614 ** this routine return an integer between 1 and N where N is the number of
615 ** elements in pEList, corresponding to the matching entry.  If there is
616 ** no match, or if pE is not a simple identifier, then this routine
617 ** return 0.
618 **
619 ** pEList has been resolved.  pE has not.
620 */
621 static int resolveAsName(
622   Parse *pParse,     /* Parsing context for error messages */
623   ExprList *pEList,  /* List of expressions to scan */
624   Expr *pE           /* Expression we are trying to match */
625 ){
626   int i;             /* Loop counter */
627 
628   UNUSED_PARAMETER(pParse);
629 
630   if( pE->op==TK_ID ){
631     char *zCol = pE->u.zToken;
632     for(i=0; i<pEList->nExpr; i++){
633       char *zAs = pEList->a[i].zName;
634       if( zAs!=0 && sqlite3StrICmp(zAs, zCol)==0 ){
635         return i+1;
636       }
637     }
638   }
639   return 0;
640 }
641 
642 /*
643 ** pE is a pointer to an expression which is a single term in the
644 ** ORDER BY of a compound SELECT.  The expression has not been
645 ** name resolved.
646 **
647 ** At the point this routine is called, we already know that the
648 ** ORDER BY term is not an integer index into the result set.  That
649 ** case is handled by the calling routine.
650 **
651 ** Attempt to match pE against result set columns in the left-most
652 ** SELECT statement.  Return the index i of the matching column,
653 ** as an indication to the caller that it should sort by the i-th column.
654 ** The left-most column is 1.  In other words, the value returned is the
655 ** same integer value that would be used in the SQL statement to indicate
656 ** the column.
657 **
658 ** If there is no match, return 0.  Return -1 if an error occurs.
659 */
660 static int resolveOrderByTermToExprList(
661   Parse *pParse,     /* Parsing context for error messages */
662   Select *pSelect,   /* The SELECT statement with the ORDER BY clause */
663   Expr *pE           /* The specific ORDER BY term */
664 ){
665   int i;             /* Loop counter */
666   ExprList *pEList;  /* The columns of the result set */
667   NameContext nc;    /* Name context for resolving pE */
668 
669   assert( sqlite3ExprIsInteger(pE, &i)==0 );
670   pEList = pSelect->pEList;
671 
672   /* Resolve all names in the ORDER BY term expression
673   */
674   memset(&nc, 0, sizeof(nc));
675   nc.pParse = pParse;
676   nc.pSrcList = pSelect->pSrc;
677   nc.pEList = pEList;
678   nc.allowAgg = 1;
679   nc.nErr = 0;
680   if( sqlite3ResolveExprNames(&nc, pE) ){
681     sqlite3ErrorClear(pParse);
682     return 0;
683   }
684 
685   /* Try to match the ORDER BY expression against an expression
686   ** in the result set.  Return an 1-based index of the matching
687   ** result-set entry.
688   */
689   for(i=0; i<pEList->nExpr; i++){
690     if( sqlite3ExprCompare(pEList->a[i].pExpr, pE) ){
691       return i+1;
692     }
693   }
694 
695   /* If no match, return 0. */
696   return 0;
697 }
698 
699 /*
700 ** Generate an ORDER BY or GROUP BY term out-of-range error.
701 */
702 static void resolveOutOfRangeError(
703   Parse *pParse,         /* The error context into which to write the error */
704   const char *zType,     /* "ORDER" or "GROUP" */
705   int i,                 /* The index (1-based) of the term out of range */
706   int mx                 /* Largest permissible value of i */
707 ){
708   sqlite3ErrorMsg(pParse,
709     "%r %s BY term out of range - should be "
710     "between 1 and %d", i, zType, mx);
711 }
712 
713 /*
714 ** Analyze the ORDER BY clause in a compound SELECT statement.   Modify
715 ** each term of the ORDER BY clause is a constant integer between 1
716 ** and N where N is the number of columns in the compound SELECT.
717 **
718 ** ORDER BY terms that are already an integer between 1 and N are
719 ** unmodified.  ORDER BY terms that are integers outside the range of
720 ** 1 through N generate an error.  ORDER BY terms that are expressions
721 ** are matched against result set expressions of compound SELECT
722 ** beginning with the left-most SELECT and working toward the right.
723 ** At the first match, the ORDER BY expression is transformed into
724 ** the integer column number.
725 **
726 ** Return the number of errors seen.
727 */
728 static int resolveCompoundOrderBy(
729   Parse *pParse,        /* Parsing context.  Leave error messages here */
730   Select *pSelect       /* The SELECT statement containing the ORDER BY */
731 ){
732   int i;
733   ExprList *pOrderBy;
734   ExprList *pEList;
735   sqlite3 *db;
736   int moreToDo = 1;
737 
738   pOrderBy = pSelect->pOrderBy;
739   if( pOrderBy==0 ) return 0;
740   db = pParse->db;
741 #if SQLITE_MAX_COLUMN
742   if( pOrderBy->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
743     sqlite3ErrorMsg(pParse, "too many terms in ORDER BY clause");
744     return 1;
745   }
746 #endif
747   for(i=0; i<pOrderBy->nExpr; i++){
748     pOrderBy->a[i].done = 0;
749   }
750   pSelect->pNext = 0;
751   while( pSelect->pPrior ){
752     pSelect->pPrior->pNext = pSelect;
753     pSelect = pSelect->pPrior;
754   }
755   while( pSelect && moreToDo ){
756     struct ExprList_item *pItem;
757     moreToDo = 0;
758     pEList = pSelect->pEList;
759     assert( pEList!=0 );
760     for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
761       int iCol = -1;
762       Expr *pE, *pDup;
763       if( pItem->done ) continue;
764       pE = pItem->pExpr;
765       if( sqlite3ExprIsInteger(pE, &iCol) ){
766         if( iCol<=0 || iCol>pEList->nExpr ){
767           resolveOutOfRangeError(pParse, "ORDER", i+1, pEList->nExpr);
768           return 1;
769         }
770       }else{
771         iCol = resolveAsName(pParse, pEList, pE);
772         if( iCol==0 ){
773           pDup = sqlite3ExprDup(db, pE, 0);
774           if( !db->mallocFailed ){
775             assert(pDup);
776             iCol = resolveOrderByTermToExprList(pParse, pSelect, pDup);
777           }
778           sqlite3ExprDelete(db, pDup);
779         }
780       }
781       if( iCol>0 ){
782         CollSeq *pColl = pE->pColl;
783         int flags = pE->flags & EP_ExpCollate;
784         sqlite3ExprDelete(db, pE);
785         pItem->pExpr = pE = sqlite3Expr(db, TK_INTEGER, 0);
786         if( pE==0 ) return 1;
787         pE->pColl = pColl;
788         pE->flags |= EP_IntValue | flags;
789         pE->u.iValue = iCol;
790         pItem->iCol = (u16)iCol;
791         pItem->done = 1;
792       }else{
793         moreToDo = 1;
794       }
795     }
796     pSelect = pSelect->pNext;
797   }
798   for(i=0; i<pOrderBy->nExpr; i++){
799     if( pOrderBy->a[i].done==0 ){
800       sqlite3ErrorMsg(pParse, "%r ORDER BY term does not match any "
801             "column in the result set", i+1);
802       return 1;
803     }
804   }
805   return 0;
806 }
807 
808 /*
809 ** Check every term in the ORDER BY or GROUP BY clause pOrderBy of
810 ** the SELECT statement pSelect.  If any term is reference to a
811 ** result set expression (as determined by the ExprList.a.iCol field)
812 ** then convert that term into a copy of the corresponding result set
813 ** column.
814 **
815 ** If any errors are detected, add an error message to pParse and
816 ** return non-zero.  Return zero if no errors are seen.
817 */
818 int sqlite3ResolveOrderGroupBy(
819   Parse *pParse,        /* Parsing context.  Leave error messages here */
820   Select *pSelect,      /* The SELECT statement containing the clause */
821   ExprList *pOrderBy,   /* The ORDER BY or GROUP BY clause to be processed */
822   const char *zType     /* "ORDER" or "GROUP" */
823 ){
824   int i;
825   sqlite3 *db = pParse->db;
826   ExprList *pEList;
827   struct ExprList_item *pItem;
828 
829   if( pOrderBy==0 || pParse->db->mallocFailed ) return 0;
830 #if SQLITE_MAX_COLUMN
831   if( pOrderBy->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
832     sqlite3ErrorMsg(pParse, "too many terms in %s BY clause", zType);
833     return 1;
834   }
835 #endif
836   pEList = pSelect->pEList;
837   assert( pEList!=0 );  /* sqlite3SelectNew() guarantees this */
838   for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
839     if( pItem->iCol ){
840       if( pItem->iCol>pEList->nExpr ){
841         resolveOutOfRangeError(pParse, zType, i+1, pEList->nExpr);
842         return 1;
843       }
844       resolveAlias(pParse, pEList, pItem->iCol-1, pItem->pExpr, zType);
845     }
846   }
847   return 0;
848 }
849 
850 /*
851 ** pOrderBy is an ORDER BY or GROUP BY clause in SELECT statement pSelect.
852 ** The Name context of the SELECT statement is pNC.  zType is either
853 ** "ORDER" or "GROUP" depending on which type of clause pOrderBy is.
854 **
855 ** This routine resolves each term of the clause into an expression.
856 ** If the order-by term is an integer I between 1 and N (where N is the
857 ** number of columns in the result set of the SELECT) then the expression
858 ** in the resolution is a copy of the I-th result-set expression.  If
859 ** the order-by term is an identify that corresponds to the AS-name of
860 ** a result-set expression, then the term resolves to a copy of the
861 ** result-set expression.  Otherwise, the expression is resolved in
862 ** the usual way - using sqlite3ResolveExprNames().
863 **
864 ** This routine returns the number of errors.  If errors occur, then
865 ** an appropriate error message might be left in pParse.  (OOM errors
866 ** excepted.)
867 */
868 static int resolveOrderGroupBy(
869   NameContext *pNC,     /* The name context of the SELECT statement */
870   Select *pSelect,      /* The SELECT statement holding pOrderBy */
871   ExprList *pOrderBy,   /* An ORDER BY or GROUP BY clause to resolve */
872   const char *zType     /* Either "ORDER" or "GROUP", as appropriate */
873 ){
874   int i;                         /* Loop counter */
875   int iCol;                      /* Column number */
876   struct ExprList_item *pItem;   /* A term of the ORDER BY clause */
877   Parse *pParse;                 /* Parsing context */
878   int nResult;                   /* Number of terms in the result set */
879 
880   if( pOrderBy==0 ) return 0;
881   nResult = pSelect->pEList->nExpr;
882   pParse = pNC->pParse;
883   for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
884     Expr *pE = pItem->pExpr;
885     iCol = resolveAsName(pParse, pSelect->pEList, pE);
886     if( iCol>0 ){
887       /* If an AS-name match is found, mark this ORDER BY column as being
888       ** a copy of the iCol-th result-set column.  The subsequent call to
889       ** sqlite3ResolveOrderGroupBy() will convert the expression to a
890       ** copy of the iCol-th result-set expression. */
891       pItem->iCol = (u16)iCol;
892       continue;
893     }
894     if( sqlite3ExprIsInteger(pE, &iCol) ){
895       /* The ORDER BY term is an integer constant.  Again, set the column
896       ** number so that sqlite3ResolveOrderGroupBy() will convert the
897       ** order-by term to a copy of the result-set expression */
898       if( iCol<1 ){
899         resolveOutOfRangeError(pParse, zType, i+1, nResult);
900         return 1;
901       }
902       pItem->iCol = (u16)iCol;
903       continue;
904     }
905 
906     /* Otherwise, treat the ORDER BY term as an ordinary expression */
907     pItem->iCol = 0;
908     if( sqlite3ResolveExprNames(pNC, pE) ){
909       return 1;
910     }
911   }
912   return sqlite3ResolveOrderGroupBy(pParse, pSelect, pOrderBy, zType);
913 }
914 
915 /*
916 ** Resolve names in the SELECT statement p and all of its descendents.
917 */
918 static int resolveSelectStep(Walker *pWalker, Select *p){
919   NameContext *pOuterNC;  /* Context that contains this SELECT */
920   NameContext sNC;        /* Name context of this SELECT */
921   int isCompound;         /* True if p is a compound select */
922   int nCompound;          /* Number of compound terms processed so far */
923   Parse *pParse;          /* Parsing context */
924   ExprList *pEList;       /* Result set expression list */
925   int i;                  /* Loop counter */
926   ExprList *pGroupBy;     /* The GROUP BY clause */
927   Select *pLeftmost;      /* Left-most of SELECT of a compound */
928   sqlite3 *db;            /* Database connection */
929 
930 
931   assert( p!=0 );
932   if( p->selFlags & SF_Resolved ){
933     return WRC_Prune;
934   }
935   pOuterNC = pWalker->u.pNC;
936   pParse = pWalker->pParse;
937   db = pParse->db;
938 
939   /* Normally sqlite3SelectExpand() will be called first and will have
940   ** already expanded this SELECT.  However, if this is a subquery within
941   ** an expression, sqlite3ResolveExprNames() will be called without a
942   ** prior call to sqlite3SelectExpand().  When that happens, let
943   ** sqlite3SelectPrep() do all of the processing for this SELECT.
944   ** sqlite3SelectPrep() will invoke both sqlite3SelectExpand() and
945   ** this routine in the correct order.
946   */
947   if( (p->selFlags & SF_Expanded)==0 ){
948     sqlite3SelectPrep(pParse, p, pOuterNC);
949     return (pParse->nErr || db->mallocFailed) ? WRC_Abort : WRC_Prune;
950   }
951 
952   isCompound = p->pPrior!=0;
953   nCompound = 0;
954   pLeftmost = p;
955   while( p ){
956     assert( (p->selFlags & SF_Expanded)!=0 );
957     assert( (p->selFlags & SF_Resolved)==0 );
958     p->selFlags |= SF_Resolved;
959 
960     /* Resolve the expressions in the LIMIT and OFFSET clauses. These
961     ** are not allowed to refer to any names, so pass an empty NameContext.
962     */
963     memset(&sNC, 0, sizeof(sNC));
964     sNC.pParse = pParse;
965     if( sqlite3ResolveExprNames(&sNC, p->pLimit) ||
966         sqlite3ResolveExprNames(&sNC, p->pOffset) ){
967       return WRC_Abort;
968     }
969 
970     /* Set up the local name-context to pass to sqlite3ResolveExprNames() to
971     ** resolve the result-set expression list.
972     */
973     sNC.allowAgg = 1;
974     sNC.pSrcList = p->pSrc;
975     sNC.pNext = pOuterNC;
976 
977     /* Resolve names in the result set. */
978     pEList = p->pEList;
979     assert( pEList!=0 );
980     for(i=0; i<pEList->nExpr; i++){
981       Expr *pX = pEList->a[i].pExpr;
982       if( sqlite3ResolveExprNames(&sNC, pX) ){
983         return WRC_Abort;
984       }
985     }
986 
987     /* Recursively resolve names in all subqueries
988     */
989     for(i=0; i<p->pSrc->nSrc; i++){
990       struct SrcList_item *pItem = &p->pSrc->a[i];
991       if( pItem->pSelect ){
992         const char *zSavedContext = pParse->zAuthContext;
993         if( pItem->zName ) pParse->zAuthContext = pItem->zName;
994         sqlite3ResolveSelectNames(pParse, pItem->pSelect, pOuterNC);
995         pParse->zAuthContext = zSavedContext;
996         if( pParse->nErr || db->mallocFailed ) return WRC_Abort;
997       }
998     }
999 
1000     /* If there are no aggregate functions in the result-set, and no GROUP BY
1001     ** expression, do not allow aggregates in any of the other expressions.
1002     */
1003     assert( (p->selFlags & SF_Aggregate)==0 );
1004     pGroupBy = p->pGroupBy;
1005     if( pGroupBy || sNC.hasAgg ){
1006       p->selFlags |= SF_Aggregate;
1007     }else{
1008       sNC.allowAgg = 0;
1009     }
1010 
1011     /* If a HAVING clause is present, then there must be a GROUP BY clause.
1012     */
1013     if( p->pHaving && !pGroupBy ){
1014       sqlite3ErrorMsg(pParse, "a GROUP BY clause is required before HAVING");
1015       return WRC_Abort;
1016     }
1017 
1018     /* Add the expression list to the name-context before parsing the
1019     ** other expressions in the SELECT statement. This is so that
1020     ** expressions in the WHERE clause (etc.) can refer to expressions by
1021     ** aliases in the result set.
1022     **
1023     ** Minor point: If this is the case, then the expression will be
1024     ** re-evaluated for each reference to it.
1025     */
1026     sNC.pEList = p->pEList;
1027     if( sqlite3ResolveExprNames(&sNC, p->pWhere) ||
1028        sqlite3ResolveExprNames(&sNC, p->pHaving)
1029     ){
1030       return WRC_Abort;
1031     }
1032 
1033     /* The ORDER BY and GROUP BY clauses may not refer to terms in
1034     ** outer queries
1035     */
1036     sNC.pNext = 0;
1037     sNC.allowAgg = 1;
1038 
1039     /* Process the ORDER BY clause for singleton SELECT statements.
1040     ** The ORDER BY clause for compounds SELECT statements is handled
1041     ** below, after all of the result-sets for all of the elements of
1042     ** the compound have been resolved.
1043     */
1044     if( !isCompound && resolveOrderGroupBy(&sNC, p, p->pOrderBy, "ORDER") ){
1045       return WRC_Abort;
1046     }
1047     if( db->mallocFailed ){
1048       return WRC_Abort;
1049     }
1050 
1051     /* Resolve the GROUP BY clause.  At the same time, make sure
1052     ** the GROUP BY clause does not contain aggregate functions.
1053     */
1054     if( pGroupBy ){
1055       struct ExprList_item *pItem;
1056 
1057       if( resolveOrderGroupBy(&sNC, p, pGroupBy, "GROUP") || db->mallocFailed ){
1058         return WRC_Abort;
1059       }
1060       for(i=0, pItem=pGroupBy->a; i<pGroupBy->nExpr; i++, pItem++){
1061         if( ExprHasProperty(pItem->pExpr, EP_Agg) ){
1062           sqlite3ErrorMsg(pParse, "aggregate functions are not allowed in "
1063               "the GROUP BY clause");
1064           return WRC_Abort;
1065         }
1066       }
1067     }
1068 
1069     /* Advance to the next term of the compound
1070     */
1071     p = p->pPrior;
1072     nCompound++;
1073   }
1074 
1075   /* Resolve the ORDER BY on a compound SELECT after all terms of
1076   ** the compound have been resolved.
1077   */
1078   if( isCompound && resolveCompoundOrderBy(pParse, pLeftmost) ){
1079     return WRC_Abort;
1080   }
1081 
1082   return WRC_Prune;
1083 }
1084 
1085 /*
1086 ** This routine walks an expression tree and resolves references to
1087 ** table columns and result-set columns.  At the same time, do error
1088 ** checking on function usage and set a flag if any aggregate functions
1089 ** are seen.
1090 **
1091 ** To resolve table columns references we look for nodes (or subtrees) of the
1092 ** form X.Y.Z or Y.Z or just Z where
1093 **
1094 **      X:   The name of a database.  Ex:  "main" or "temp" or
1095 **           the symbolic name assigned to an ATTACH-ed database.
1096 **
1097 **      Y:   The name of a table in a FROM clause.  Or in a trigger
1098 **           one of the special names "old" or "new".
1099 **
1100 **      Z:   The name of a column in table Y.
1101 **
1102 ** The node at the root of the subtree is modified as follows:
1103 **
1104 **    Expr.op        Changed to TK_COLUMN
1105 **    Expr.pTab      Points to the Table object for X.Y
1106 **    Expr.iColumn   The column index in X.Y.  -1 for the rowid.
1107 **    Expr.iTable    The VDBE cursor number for X.Y
1108 **
1109 **
1110 ** To resolve result-set references, look for expression nodes of the
1111 ** form Z (with no X and Y prefix) where the Z matches the right-hand
1112 ** size of an AS clause in the result-set of a SELECT.  The Z expression
1113 ** is replaced by a copy of the left-hand side of the result-set expression.
1114 ** Table-name and function resolution occurs on the substituted expression
1115 ** tree.  For example, in:
1116 **
1117 **      SELECT a+b AS x, c+d AS y FROM t1 ORDER BY x;
1118 **
1119 ** The "x" term of the order by is replaced by "a+b" to render:
1120 **
1121 **      SELECT a+b AS x, c+d AS y FROM t1 ORDER BY a+b;
1122 **
1123 ** Function calls are checked to make sure that the function is
1124 ** defined and that the correct number of arguments are specified.
1125 ** If the function is an aggregate function, then the pNC->hasAgg is
1126 ** set and the opcode is changed from TK_FUNCTION to TK_AGG_FUNCTION.
1127 ** If an expression contains aggregate functions then the EP_Agg
1128 ** property on the expression is set.
1129 **
1130 ** An error message is left in pParse if anything is amiss.  The number
1131 ** if errors is returned.
1132 */
1133 int sqlite3ResolveExprNames(
1134   NameContext *pNC,       /* Namespace to resolve expressions in. */
1135   Expr *pExpr             /* The expression to be analyzed. */
1136 ){
1137   int savedHasAgg;
1138   Walker w;
1139 
1140   if( pExpr==0 ) return 0;
1141 #if SQLITE_MAX_EXPR_DEPTH>0
1142   {
1143     Parse *pParse = pNC->pParse;
1144     if( sqlite3ExprCheckHeight(pParse, pExpr->nHeight+pNC->pParse->nHeight) ){
1145       return 1;
1146     }
1147     pParse->nHeight += pExpr->nHeight;
1148   }
1149 #endif
1150   savedHasAgg = pNC->hasAgg;
1151   pNC->hasAgg = 0;
1152   w.xExprCallback = resolveExprStep;
1153   w.xSelectCallback = resolveSelectStep;
1154   w.pParse = pNC->pParse;
1155   w.u.pNC = pNC;
1156   sqlite3WalkExpr(&w, pExpr);
1157 #if SQLITE_MAX_EXPR_DEPTH>0
1158   pNC->pParse->nHeight -= pExpr->nHeight;
1159 #endif
1160   if( pNC->nErr>0 || w.pParse->nErr>0 ){
1161     ExprSetProperty(pExpr, EP_Error);
1162   }
1163   if( pNC->hasAgg ){
1164     ExprSetProperty(pExpr, EP_Agg);
1165   }else if( savedHasAgg ){
1166     pNC->hasAgg = 1;
1167   }
1168   return ExprHasProperty(pExpr, EP_Error);
1169 }
1170 
1171 
1172 /*
1173 ** Resolve all names in all expressions of a SELECT and in all
1174 ** decendents of the SELECT, including compounds off of p->pPrior,
1175 ** subqueries in expressions, and subqueries used as FROM clause
1176 ** terms.
1177 **
1178 ** See sqlite3ResolveExprNames() for a description of the kinds of
1179 ** transformations that occur.
1180 **
1181 ** All SELECT statements should have been expanded using
1182 ** sqlite3SelectExpand() prior to invoking this routine.
1183 */
1184 void sqlite3ResolveSelectNames(
1185   Parse *pParse,         /* The parser context */
1186   Select *p,             /* The SELECT statement being coded. */
1187   NameContext *pOuterNC  /* Name context for parent SELECT statement */
1188 ){
1189   Walker w;
1190 
1191   assert( p!=0 );
1192   w.xExprCallback = resolveExprStep;
1193   w.xSelectCallback = resolveSelectStep;
1194   w.pParse = pParse;
1195   w.u.pNC = pOuterNC;
1196   sqlite3WalkSelect(&w, p);
1197 }
1198