xref: /sqlite-3.40.0/src/resolve.c (revision a8e41eca)
1 /*
2 ** 2008 August 18
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 **
13 ** This file contains routines used for walking the parser tree and
14 ** resolve all identifiers by associating them with a particular
15 ** table and column.
16 */
17 #include "sqliteInt.h"
18 
19 /*
20 ** Walk the expression tree pExpr and increase the aggregate function
21 ** depth (the Expr.op2 field) by N on every TK_AGG_FUNCTION node.
22 ** This needs to occur when copying a TK_AGG_FUNCTION node from an
23 ** outer query into an inner subquery.
24 **
25 ** incrAggFunctionDepth(pExpr,n) is the main routine.  incrAggDepth(..)
26 ** is a helper function - a callback for the tree walker.
27 */
28 static int incrAggDepth(Walker *pWalker, Expr *pExpr){
29   if( pExpr->op==TK_AGG_FUNCTION ) pExpr->op2 += pWalker->u.n;
30   return WRC_Continue;
31 }
32 static void incrAggFunctionDepth(Expr *pExpr, int N){
33   if( N>0 ){
34     Walker w;
35     memset(&w, 0, sizeof(w));
36     w.xExprCallback = incrAggDepth;
37     w.u.n = N;
38     sqlite3WalkExpr(&w, pExpr);
39   }
40 }
41 
42 /*
43 ** Turn the pExpr expression into an alias for the iCol-th column of the
44 ** result set in pEList.
45 **
46 ** If the reference is followed by a COLLATE operator, then make sure
47 ** the COLLATE operator is preserved.  For example:
48 **
49 **     SELECT a+b, c+d FROM t1 ORDER BY 1 COLLATE nocase;
50 **
51 ** Should be transformed into:
52 **
53 **     SELECT a+b, c+d FROM t1 ORDER BY (a+b) COLLATE nocase;
54 **
55 ** The nSubquery parameter specifies how many levels of subquery the
56 ** alias is removed from the original expression.  The usual value is
57 ** zero but it might be more if the alias is contained within a subquery
58 ** of the original expression.  The Expr.op2 field of TK_AGG_FUNCTION
59 ** structures must be increased by the nSubquery amount.
60 */
61 static void resolveAlias(
62   Parse *pParse,         /* Parsing context */
63   ExprList *pEList,      /* A result set */
64   int iCol,              /* A column in the result set.  0..pEList->nExpr-1 */
65   Expr *pExpr,           /* Transform this into an alias to the result set */
66   const char *zType,     /* "GROUP" or "ORDER" or "" */
67   int nSubquery          /* Number of subqueries that the label is moving */
68 ){
69   Expr *pOrig;           /* The iCol-th column of the result set */
70   Expr *pDup;            /* Copy of pOrig */
71   sqlite3 *db;           /* The database connection */
72 
73   assert( iCol>=0 && iCol<pEList->nExpr );
74   pOrig = pEList->a[iCol].pExpr;
75   assert( pOrig!=0 );
76   db = pParse->db;
77   pDup = sqlite3ExprDup(db, pOrig, 0);
78   if( pDup!=0 ){
79     if( zType[0]!='G' ) incrAggFunctionDepth(pDup, nSubquery);
80     if( pExpr->op==TK_COLLATE ){
81       pDup = sqlite3ExprAddCollateString(pParse, pDup, pExpr->u.zToken);
82     }
83 
84     /* Before calling sqlite3ExprDelete(), set the EP_Static flag. This
85     ** prevents ExprDelete() from deleting the Expr structure itself,
86     ** allowing it to be repopulated by the memcpy() on the following line.
87     ** The pExpr->u.zToken might point into memory that will be freed by the
88     ** sqlite3DbFree(db, pDup) on the last line of this block, so be sure to
89     ** make a copy of the token before doing the sqlite3DbFree().
90     */
91     ExprSetProperty(pExpr, EP_Static);
92     sqlite3ExprDelete(db, pExpr);
93     memcpy(pExpr, pDup, sizeof(*pExpr));
94     if( !ExprHasProperty(pExpr, EP_IntValue) && pExpr->u.zToken!=0 ){
95       assert( (pExpr->flags & (EP_Reduced|EP_TokenOnly))==0 );
96       pExpr->u.zToken = sqlite3DbStrDup(db, pExpr->u.zToken);
97       pExpr->flags |= EP_MemToken;
98     }
99     if( ExprHasProperty(pExpr, EP_WinFunc) ){
100       if( pExpr->y.pWin!=0 ){
101         pExpr->y.pWin->pOwner = pExpr;
102       }else{
103         assert( db->mallocFailed );
104       }
105     }
106     sqlite3DbFree(db, pDup);
107   }
108   ExprSetProperty(pExpr, EP_Alias);
109 }
110 
111 
112 /*
113 ** Return TRUE if the name zCol occurs anywhere in the USING clause.
114 **
115 ** Return FALSE if the USING clause is NULL or if it does not contain
116 ** zCol.
117 */
118 static int nameInUsingClause(IdList *pUsing, const char *zCol){
119   if( pUsing ){
120     int k;
121     for(k=0; k<pUsing->nId; k++){
122       if( sqlite3StrICmp(pUsing->a[k].zName, zCol)==0 ) return 1;
123     }
124   }
125   return 0;
126 }
127 
128 /*
129 ** Subqueries stores the original database, table and column names for their
130 ** result sets in ExprList.a[].zSpan, in the form "DATABASE.TABLE.COLUMN".
131 ** Check to see if the zSpan given to this routine matches the zDb, zTab,
132 ** and zCol.  If any of zDb, zTab, and zCol are NULL then those fields will
133 ** match anything.
134 */
135 int sqlite3MatchEName(
136   const struct ExprList_item *pItem,
137   const char *zCol,
138   const char *zTab,
139   const char *zDb
140 ){
141   int n;
142   const char *zSpan;
143   if( pItem->eEName!=ENAME_TAB ) return 0;
144   zSpan = pItem->zEName;
145   for(n=0; ALWAYS(zSpan[n]) && zSpan[n]!='.'; n++){}
146   if( zDb && (sqlite3StrNICmp(zSpan, zDb, n)!=0 || zDb[n]!=0) ){
147     return 0;
148   }
149   zSpan += n+1;
150   for(n=0; ALWAYS(zSpan[n]) && zSpan[n]!='.'; n++){}
151   if( zTab && (sqlite3StrNICmp(zSpan, zTab, n)!=0 || zTab[n]!=0) ){
152     return 0;
153   }
154   zSpan += n+1;
155   if( zCol && sqlite3StrICmp(zSpan, zCol)!=0 ){
156     return 0;
157   }
158   return 1;
159 }
160 
161 /*
162 ** Return TRUE if the double-quoted string  mis-feature should be supported.
163 */
164 static int areDoubleQuotedStringsEnabled(sqlite3 *db, NameContext *pTopNC){
165   if( db->init.busy ) return 1;  /* Always support for legacy schemas */
166   if( pTopNC->ncFlags & NC_IsDDL ){
167     /* Currently parsing a DDL statement */
168     if( sqlite3WritableSchema(db) && (db->flags & SQLITE_DqsDML)!=0 ){
169       return 1;
170     }
171     return (db->flags & SQLITE_DqsDDL)!=0;
172   }else{
173     /* Currently parsing a DML statement */
174     return (db->flags & SQLITE_DqsDML)!=0;
175   }
176 }
177 
178 /*
179 ** The argument is guaranteed to be a non-NULL Expr node of type TK_COLUMN.
180 ** return the appropriate colUsed mask.
181 */
182 Bitmask sqlite3ExprColUsed(Expr *pExpr){
183   int n;
184   Table *pExTab;
185 
186   n = pExpr->iColumn;
187   pExTab = pExpr->y.pTab;
188   assert( pExTab!=0 );
189   if( (pExTab->tabFlags & TF_HasGenerated)!=0
190    && (pExTab->aCol[n].colFlags & COLFLAG_GENERATED)!=0
191   ){
192     testcase( pExTab->nCol==BMS-1 );
193     testcase( pExTab->nCol==BMS );
194     return pExTab->nCol>=BMS ? ALLBITS : MASKBIT(pExTab->nCol)-1;
195   }else{
196     testcase( n==BMS-1 );
197     testcase( n==BMS );
198     if( n>=BMS ) n = BMS-1;
199     return ((Bitmask)1)<<n;
200   }
201 }
202 
203 /*
204 ** Given the name of a column of the form X.Y.Z or Y.Z or just Z, look up
205 ** that name in the set of source tables in pSrcList and make the pExpr
206 ** expression node refer back to that source column.  The following changes
207 ** are made to pExpr:
208 **
209 **    pExpr->iDb           Set the index in db->aDb[] of the database X
210 **                         (even if X is implied).
211 **    pExpr->iTable        Set to the cursor number for the table obtained
212 **                         from pSrcList.
213 **    pExpr->y.pTab        Points to the Table structure of X.Y (even if
214 **                         X and/or Y are implied.)
215 **    pExpr->iColumn       Set to the column number within the table.
216 **    pExpr->op            Set to TK_COLUMN.
217 **    pExpr->pLeft         Any expression this points to is deleted
218 **    pExpr->pRight        Any expression this points to is deleted.
219 **
220 ** The zDb variable is the name of the database (the "X").  This value may be
221 ** NULL meaning that name is of the form Y.Z or Z.  Any available database
222 ** can be used.  The zTable variable is the name of the table (the "Y").  This
223 ** value can be NULL if zDb is also NULL.  If zTable is NULL it
224 ** means that the form of the name is Z and that columns from any table
225 ** can be used.
226 **
227 ** If the name cannot be resolved unambiguously, leave an error message
228 ** in pParse and return WRC_Abort.  Return WRC_Prune on success.
229 */
230 static int lookupName(
231   Parse *pParse,       /* The parsing context */
232   const char *zDb,     /* Name of the database containing table, or NULL */
233   const char *zTab,    /* Name of table containing column, or NULL */
234   const char *zCol,    /* Name of the column. */
235   NameContext *pNC,    /* The name context used to resolve the name */
236   Expr *pExpr          /* Make this EXPR node point to the selected column */
237 ){
238   int i, j;                         /* Loop counters */
239   int cnt = 0;                      /* Number of matching column names */
240   int cntTab = 0;                   /* Number of matching table names */
241   int nSubquery = 0;                /* How many levels of subquery */
242   sqlite3 *db = pParse->db;         /* The database connection */
243   struct SrcList_item *pItem;       /* Use for looping over pSrcList items */
244   struct SrcList_item *pMatch = 0;  /* The matching pSrcList item */
245   NameContext *pTopNC = pNC;        /* First namecontext in the list */
246   Schema *pSchema = 0;              /* Schema of the expression */
247   int eNewExprOp = TK_COLUMN;       /* New value for pExpr->op on success */
248   Table *pTab = 0;                  /* Table hold the row */
249   Column *pCol;                     /* A column of pTab */
250 
251   assert( pNC );     /* the name context cannot be NULL. */
252   assert( zCol );    /* The Z in X.Y.Z cannot be NULL */
253   assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
254 
255   /* Initialize the node to no-match */
256   pExpr->iTable = -1;
257   ExprSetVVAProperty(pExpr, EP_NoReduce);
258 
259   /* Translate the schema name in zDb into a pointer to the corresponding
260   ** schema.  If not found, pSchema will remain NULL and nothing will match
261   ** resulting in an appropriate error message toward the end of this routine
262   */
263   if( zDb ){
264     testcase( pNC->ncFlags & NC_PartIdx );
265     testcase( pNC->ncFlags & NC_IsCheck );
266     if( (pNC->ncFlags & (NC_PartIdx|NC_IsCheck))!=0 ){
267       /* Silently ignore database qualifiers inside CHECK constraints and
268       ** partial indices.  Do not raise errors because that might break
269       ** legacy and because it does not hurt anything to just ignore the
270       ** database name. */
271       zDb = 0;
272     }else{
273       for(i=0; i<db->nDb; i++){
274         assert( db->aDb[i].zDbSName );
275         if( sqlite3StrICmp(db->aDb[i].zDbSName,zDb)==0 ){
276           pSchema = db->aDb[i].pSchema;
277           break;
278         }
279       }
280       if( i==db->nDb && sqlite3StrICmp("main", zDb)==0 ){
281         /* This branch is taken when the main database has been renamed
282         ** using SQLITE_DBCONFIG_MAINDBNAME. */
283         pSchema = db->aDb[0].pSchema;
284         zDb = db->aDb[0].zDbSName;
285       }
286     }
287   }
288 
289   /* Start at the inner-most context and move outward until a match is found */
290   assert( pNC && cnt==0 );
291   do{
292     ExprList *pEList;
293     SrcList *pSrcList = pNC->pSrcList;
294 
295     if( pSrcList ){
296       for(i=0, pItem=pSrcList->a; i<pSrcList->nSrc; i++, pItem++){
297         u8 hCol;
298         pTab = pItem->pTab;
299         assert( pTab!=0 && pTab->zName!=0 );
300         assert( pTab->nCol>0 );
301         if( pItem->pSelect && (pItem->pSelect->selFlags & SF_NestedFrom)!=0 ){
302           int hit = 0;
303           pEList = pItem->pSelect->pEList;
304           for(j=0; j<pEList->nExpr; j++){
305             if( sqlite3MatchEName(&pEList->a[j], zCol, zTab, zDb) ){
306               cnt++;
307               cntTab = 2;
308               pMatch = pItem;
309               pExpr->iColumn = j;
310               hit = 1;
311             }
312           }
313           if( hit || zTab==0 ) continue;
314         }
315         if( zDb && pTab->pSchema!=pSchema ){
316           continue;
317         }
318         if( zTab ){
319           const char *zTabName = pItem->zAlias ? pItem->zAlias : pTab->zName;
320           assert( zTabName!=0 );
321           if( sqlite3StrICmp(zTabName, zTab)!=0 ){
322             continue;
323           }
324           if( IN_RENAME_OBJECT && pItem->zAlias ){
325             sqlite3RenameTokenRemap(pParse, 0, (void*)&pExpr->y.pTab);
326           }
327         }
328         if( 0==(cntTab++) ){
329           pMatch = pItem;
330         }
331         hCol = sqlite3StrIHash(zCol);
332         for(j=0, pCol=pTab->aCol; j<pTab->nCol; j++, pCol++){
333           if( pCol->hName==hCol && sqlite3StrICmp(pCol->zName, zCol)==0 ){
334             /* If there has been exactly one prior match and this match
335             ** is for the right-hand table of a NATURAL JOIN or is in a
336             ** USING clause, then skip this match.
337             */
338             if( cnt==1 ){
339               if( pItem->fg.jointype & JT_NATURAL ) continue;
340               if( nameInUsingClause(pItem->pUsing, zCol) ) continue;
341             }
342             cnt++;
343             pMatch = pItem;
344             /* Substitute the rowid (column -1) for the INTEGER PRIMARY KEY */
345             pExpr->iColumn = j==pTab->iPKey ? -1 : (i16)j;
346             break;
347           }
348         }
349       }
350       if( pMatch ){
351         pExpr->iTable = pMatch->iCursor;
352         pExpr->y.pTab = pMatch->pTab;
353         /* RIGHT JOIN not (yet) supported */
354         assert( (pMatch->fg.jointype & JT_RIGHT)==0 );
355         if( (pMatch->fg.jointype & JT_LEFT)!=0 ){
356           ExprSetProperty(pExpr, EP_CanBeNull);
357         }
358         pSchema = pExpr->y.pTab->pSchema;
359       }
360     } /* if( pSrcList ) */
361 
362 #if !defined(SQLITE_OMIT_TRIGGER) || !defined(SQLITE_OMIT_UPSERT)
363     /* If we have not already resolved the name, then maybe
364     ** it is a new.* or old.* trigger argument reference.  Or
365     ** maybe it is an excluded.* from an upsert.
366     */
367     if( zDb==0 && zTab!=0 && cntTab==0 ){
368       pTab = 0;
369 #ifndef SQLITE_OMIT_TRIGGER
370       if( pParse->pTriggerTab!=0 ){
371         int op = pParse->eTriggerOp;
372         assert( op==TK_DELETE || op==TK_UPDATE || op==TK_INSERT );
373         if( op!=TK_DELETE && sqlite3StrICmp("new",zTab) == 0 ){
374           pExpr->iTable = 1;
375           pTab = pParse->pTriggerTab;
376         }else if( op!=TK_INSERT && sqlite3StrICmp("old",zTab)==0 ){
377           pExpr->iTable = 0;
378           pTab = pParse->pTriggerTab;
379         }
380       }
381 #endif /* SQLITE_OMIT_TRIGGER */
382 #ifndef SQLITE_OMIT_UPSERT
383       if( (pNC->ncFlags & NC_UUpsert)!=0 ){
384         Upsert *pUpsert = pNC->uNC.pUpsert;
385         if( pUpsert && sqlite3StrICmp("excluded",zTab)==0 ){
386           pTab = pUpsert->pUpsertSrc->a[0].pTab;
387           pExpr->iTable = 2;
388         }
389       }
390 #endif /* SQLITE_OMIT_UPSERT */
391 
392       if( pTab ){
393         int iCol;
394         u8 hCol = sqlite3StrIHash(zCol);
395         pSchema = pTab->pSchema;
396         cntTab++;
397         for(iCol=0, pCol=pTab->aCol; iCol<pTab->nCol; iCol++, pCol++){
398           if( pCol->hName==hCol && sqlite3StrICmp(pCol->zName, zCol)==0 ){
399             if( iCol==pTab->iPKey ){
400               iCol = -1;
401             }
402             break;
403           }
404         }
405         if( iCol>=pTab->nCol && sqlite3IsRowid(zCol) && VisibleRowid(pTab) ){
406           /* IMP: R-51414-32910 */
407           iCol = -1;
408         }
409         if( iCol<pTab->nCol ){
410           cnt++;
411 #ifndef SQLITE_OMIT_UPSERT
412           if( pExpr->iTable==2 ){
413             testcase( iCol==(-1) );
414             if( IN_RENAME_OBJECT ){
415               pExpr->iColumn = iCol;
416               pExpr->y.pTab = pTab;
417               eNewExprOp = TK_COLUMN;
418             }else{
419               pExpr->iTable = pNC->uNC.pUpsert->regData + iCol;
420               eNewExprOp = TK_REGISTER;
421               ExprSetProperty(pExpr, EP_Alias);
422             }
423           }else
424 #endif /* SQLITE_OMIT_UPSERT */
425           {
426 #ifndef SQLITE_OMIT_TRIGGER
427             if( iCol<0 ){
428               pExpr->affExpr = SQLITE_AFF_INTEGER;
429             }else if( pExpr->iTable==0 ){
430               testcase( iCol==31 );
431               testcase( iCol==32 );
432               pParse->oldmask |= (iCol>=32 ? 0xffffffff : (((u32)1)<<iCol));
433             }else{
434               testcase( iCol==31 );
435               testcase( iCol==32 );
436               pParse->newmask |= (iCol>=32 ? 0xffffffff : (((u32)1)<<iCol));
437             }
438             pExpr->y.pTab = pTab;
439             pExpr->iColumn = (i16)iCol;
440             eNewExprOp = TK_TRIGGER;
441 #endif /* SQLITE_OMIT_TRIGGER */
442           }
443         }
444       }
445     }
446 #endif /* !defined(SQLITE_OMIT_TRIGGER) || !defined(SQLITE_OMIT_UPSERT) */
447 
448     /*
449     ** Perhaps the name is a reference to the ROWID
450     */
451     if( cnt==0
452      && cntTab==1
453      && pMatch
454      && (pNC->ncFlags & (NC_IdxExpr|NC_GenCol))==0
455      && sqlite3IsRowid(zCol)
456      && VisibleRowid(pMatch->pTab)
457     ){
458       cnt = 1;
459       pExpr->iColumn = -1;
460       pExpr->affExpr = SQLITE_AFF_INTEGER;
461     }
462 
463     /*
464     ** If the input is of the form Z (not Y.Z or X.Y.Z) then the name Z
465     ** might refer to an result-set alias.  This happens, for example, when
466     ** we are resolving names in the WHERE clause of the following command:
467     **
468     **     SELECT a+b AS x FROM table WHERE x<10;
469     **
470     ** In cases like this, replace pExpr with a copy of the expression that
471     ** forms the result set entry ("a+b" in the example) and return immediately.
472     ** Note that the expression in the result set should have already been
473     ** resolved by the time the WHERE clause is resolved.
474     **
475     ** The ability to use an output result-set column in the WHERE, GROUP BY,
476     ** or HAVING clauses, or as part of a larger expression in the ORDER BY
477     ** clause is not standard SQL.  This is a (goofy) SQLite extension, that
478     ** is supported for backwards compatibility only. Hence, we issue a warning
479     ** on sqlite3_log() whenever the capability is used.
480     */
481     if( (pNC->ncFlags & NC_UEList)!=0
482      && cnt==0
483      && zTab==0
484     ){
485       pEList = pNC->uNC.pEList;
486       assert( pEList!=0 );
487       for(j=0; j<pEList->nExpr; j++){
488         char *zAs = pEList->a[j].zEName;
489         if( pEList->a[j].eEName==ENAME_NAME
490          && sqlite3_stricmp(zAs, zCol)==0
491         ){
492           Expr *pOrig;
493           assert( pExpr->pLeft==0 && pExpr->pRight==0 );
494           assert( pExpr->x.pList==0 );
495           assert( pExpr->x.pSelect==0 );
496           pOrig = pEList->a[j].pExpr;
497           if( (pNC->ncFlags&NC_AllowAgg)==0 && ExprHasProperty(pOrig, EP_Agg) ){
498             sqlite3ErrorMsg(pParse, "misuse of aliased aggregate %s", zAs);
499             return WRC_Abort;
500           }
501           if( ExprHasProperty(pOrig, EP_Win)
502            && ((pNC->ncFlags&NC_AllowWin)==0 || pNC!=pTopNC )
503           ){
504             sqlite3ErrorMsg(pParse, "misuse of aliased window function %s",zAs);
505             return WRC_Abort;
506           }
507           if( sqlite3ExprVectorSize(pOrig)!=1 ){
508             sqlite3ErrorMsg(pParse, "row value misused");
509             return WRC_Abort;
510           }
511           resolveAlias(pParse, pEList, j, pExpr, "", nSubquery);
512           cnt = 1;
513           pMatch = 0;
514           assert( zTab==0 && zDb==0 );
515           if( IN_RENAME_OBJECT ){
516             sqlite3RenameTokenRemap(pParse, 0, (void*)pExpr);
517           }
518           goto lookupname_end;
519         }
520       }
521     }
522 
523     /* Advance to the next name context.  The loop will exit when either
524     ** we have a match (cnt>0) or when we run out of name contexts.
525     */
526     if( cnt ) break;
527     pNC = pNC->pNext;
528     nSubquery++;
529   }while( pNC );
530 
531 
532   /*
533   ** If X and Y are NULL (in other words if only the column name Z is
534   ** supplied) and the value of Z is enclosed in double-quotes, then
535   ** Z is a string literal if it doesn't match any column names.  In that
536   ** case, we need to return right away and not make any changes to
537   ** pExpr.
538   **
539   ** Because no reference was made to outer contexts, the pNC->nRef
540   ** fields are not changed in any context.
541   */
542   if( cnt==0 && zTab==0 ){
543     assert( pExpr->op==TK_ID );
544     if( ExprHasProperty(pExpr,EP_DblQuoted)
545      && areDoubleQuotedStringsEnabled(db, pTopNC)
546     ){
547       /* If a double-quoted identifier does not match any known column name,
548       ** then treat it as a string.
549       **
550       ** This hack was added in the early days of SQLite in a misguided attempt
551       ** to be compatible with MySQL 3.x, which used double-quotes for strings.
552       ** I now sorely regret putting in this hack. The effect of this hack is
553       ** that misspelled identifier names are silently converted into strings
554       ** rather than causing an error, to the frustration of countless
555       ** programmers. To all those frustrated programmers, my apologies.
556       **
557       ** Someday, I hope to get rid of this hack. Unfortunately there is
558       ** a huge amount of legacy SQL that uses it. So for now, we just
559       ** issue a warning.
560       */
561       sqlite3_log(SQLITE_WARNING,
562         "double-quoted string literal: \"%w\"", zCol);
563 #ifdef SQLITE_ENABLE_NORMALIZE
564       sqlite3VdbeAddDblquoteStr(db, pParse->pVdbe, zCol);
565 #endif
566       pExpr->op = TK_STRING;
567       pExpr->y.pTab = 0;
568       return WRC_Prune;
569     }
570     if( sqlite3ExprIdToTrueFalse(pExpr) ){
571       return WRC_Prune;
572     }
573   }
574 
575   /*
576   ** cnt==0 means there was not match.  cnt>1 means there were two or
577   ** more matches.  Either way, we have an error.
578   */
579   if( cnt!=1 ){
580     const char *zErr;
581     zErr = cnt==0 ? "no such column" : "ambiguous column name";
582     if( zDb ){
583       sqlite3ErrorMsg(pParse, "%s: %s.%s.%s", zErr, zDb, zTab, zCol);
584     }else if( zTab ){
585       sqlite3ErrorMsg(pParse, "%s: %s.%s", zErr, zTab, zCol);
586     }else{
587       sqlite3ErrorMsg(pParse, "%s: %s", zErr, zCol);
588     }
589     pParse->checkSchema = 1;
590     pTopNC->nErr++;
591   }
592 
593   /* If a column from a table in pSrcList is referenced, then record
594   ** this fact in the pSrcList.a[].colUsed bitmask.  Column 0 causes
595   ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.  Bit 63 is
596   ** set if the 63rd or any subsequent column is used.
597   **
598   ** The colUsed mask is an optimization used to help determine if an
599   ** index is a covering index.  The correct answer is still obtained
600   ** if the mask contains extra set bits.  However, it is important to
601   ** avoid setting bits beyond the maximum column number of the table.
602   ** (See ticket [b92e5e8ec2cdbaa1]).
603   **
604   ** If a generated column is referenced, set bits for every column
605   ** of the table.
606   */
607   if( pExpr->iColumn>=0 && pMatch!=0 ){
608     pMatch->colUsed |= sqlite3ExprColUsed(pExpr);
609   }
610 
611   /* Clean up and return
612   */
613   sqlite3ExprDelete(db, pExpr->pLeft);
614   pExpr->pLeft = 0;
615   sqlite3ExprDelete(db, pExpr->pRight);
616   pExpr->pRight = 0;
617   pExpr->op = eNewExprOp;
618   ExprSetProperty(pExpr, EP_Leaf);
619 lookupname_end:
620   if( cnt==1 ){
621     assert( pNC!=0 );
622     if( !ExprHasProperty(pExpr, EP_Alias) ){
623       sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList);
624     }
625     /* Increment the nRef value on all name contexts from TopNC up to
626     ** the point where the name matched. */
627     for(;;){
628       assert( pTopNC!=0 );
629       pTopNC->nRef++;
630       if( pTopNC==pNC ) break;
631       pTopNC = pTopNC->pNext;
632     }
633     return WRC_Prune;
634   } else {
635     return WRC_Abort;
636   }
637 }
638 
639 /*
640 ** Allocate and return a pointer to an expression to load the column iCol
641 ** from datasource iSrc in SrcList pSrc.
642 */
643 Expr *sqlite3CreateColumnExpr(sqlite3 *db, SrcList *pSrc, int iSrc, int iCol){
644   Expr *p = sqlite3ExprAlloc(db, TK_COLUMN, 0, 0);
645   if( p ){
646     struct SrcList_item *pItem = &pSrc->a[iSrc];
647     Table *pTab = p->y.pTab = pItem->pTab;
648     p->iTable = pItem->iCursor;
649     if( p->y.pTab->iPKey==iCol ){
650       p->iColumn = -1;
651     }else{
652       p->iColumn = (ynVar)iCol;
653       if( (pTab->tabFlags & TF_HasGenerated)!=0
654        && (pTab->aCol[iCol].colFlags & COLFLAG_GENERATED)!=0
655       ){
656         testcase( pTab->nCol==63 );
657         testcase( pTab->nCol==64 );
658         pItem->colUsed = pTab->nCol>=64 ? ALLBITS : MASKBIT(pTab->nCol)-1;
659       }else{
660         testcase( iCol==BMS );
661         testcase( iCol==BMS-1 );
662         pItem->colUsed |= ((Bitmask)1)<<(iCol>=BMS ? BMS-1 : iCol);
663       }
664     }
665   }
666   return p;
667 }
668 
669 /*
670 ** Report an error that an expression is not valid for some set of
671 ** pNC->ncFlags values determined by validMask.
672 **
673 ** static void notValid(
674 **   Parse *pParse,       // Leave error message here
675 **   NameContext *pNC,    // The name context
676 **   const char *zMsg,    // Type of error
677 **   int validMask,       // Set of contexts for which prohibited
678 **   Expr *pExpr          // Invalidate this expression on error
679 ** ){...}
680 **
681 ** As an optimization, since the conditional is almost always false
682 ** (because errors are rare), the conditional is moved outside of the
683 ** function call using a macro.
684 */
685 static void notValidImpl(
686    Parse *pParse,       /* Leave error message here */
687    NameContext *pNC,    /* The name context */
688    const char *zMsg,    /* Type of error */
689    Expr *pExpr          /* Invalidate this expression on error */
690 ){
691   const char *zIn = "partial index WHERE clauses";
692   if( pNC->ncFlags & NC_IdxExpr )      zIn = "index expressions";
693 #ifndef SQLITE_OMIT_CHECK
694   else if( pNC->ncFlags & NC_IsCheck ) zIn = "CHECK constraints";
695 #endif
696 #ifndef SQLITE_OMIT_GENERATED_COLUMNS
697   else if( pNC->ncFlags & NC_GenCol ) zIn = "generated columns";
698 #endif
699   sqlite3ErrorMsg(pParse, "%s prohibited in %s", zMsg, zIn);
700   if( pExpr ) pExpr->op = TK_NULL;
701 }
702 #define sqlite3ResolveNotValid(P,N,M,X,E) \
703   assert( ((X)&~(NC_IsCheck|NC_PartIdx|NC_IdxExpr|NC_GenCol))==0 ); \
704   if( ((N)->ncFlags & (X))!=0 ) notValidImpl(P,N,M,E);
705 
706 /*
707 ** Expression p should encode a floating point value between 1.0 and 0.0.
708 ** Return 1024 times this value.  Or return -1 if p is not a floating point
709 ** value between 1.0 and 0.0.
710 */
711 static int exprProbability(Expr *p){
712   double r = -1.0;
713   if( p->op!=TK_FLOAT ) return -1;
714   sqlite3AtoF(p->u.zToken, &r, sqlite3Strlen30(p->u.zToken), SQLITE_UTF8);
715   assert( r>=0.0 );
716   if( r>1.0 ) return -1;
717   return (int)(r*134217728.0);
718 }
719 
720 /*
721 ** This routine is callback for sqlite3WalkExpr().
722 **
723 ** Resolve symbolic names into TK_COLUMN operators for the current
724 ** node in the expression tree.  Return 0 to continue the search down
725 ** the tree or 2 to abort the tree walk.
726 **
727 ** This routine also does error checking and name resolution for
728 ** function names.  The operator for aggregate functions is changed
729 ** to TK_AGG_FUNCTION.
730 */
731 static int resolveExprStep(Walker *pWalker, Expr *pExpr){
732   NameContext *pNC;
733   Parse *pParse;
734 
735   pNC = pWalker->u.pNC;
736   assert( pNC!=0 );
737   pParse = pNC->pParse;
738   assert( pParse==pWalker->pParse );
739 
740 #ifndef NDEBUG
741   if( pNC->pSrcList && pNC->pSrcList->nAlloc>0 ){
742     SrcList *pSrcList = pNC->pSrcList;
743     int i;
744     for(i=0; i<pNC->pSrcList->nSrc; i++){
745       assert( pSrcList->a[i].iCursor>=0 && pSrcList->a[i].iCursor<pParse->nTab);
746     }
747   }
748 #endif
749   switch( pExpr->op ){
750 
751 #if defined(SQLITE_ENABLE_UPDATE_DELETE_LIMIT) && !defined(SQLITE_OMIT_SUBQUERY)
752     /* The special operator TK_ROW means use the rowid for the first
753     ** column in the FROM clause.  This is used by the LIMIT and ORDER BY
754     ** clause processing on UPDATE and DELETE statements.
755     */
756     case TK_ROW: {
757       SrcList *pSrcList = pNC->pSrcList;
758       struct SrcList_item *pItem;
759       assert( pSrcList && pSrcList->nSrc==1 );
760       pItem = pSrcList->a;
761       assert( HasRowid(pItem->pTab) && pItem->pTab->pSelect==0 );
762       pExpr->op = TK_COLUMN;
763       pExpr->y.pTab = pItem->pTab;
764       pExpr->iTable = pItem->iCursor;
765       pExpr->iColumn = -1;
766       pExpr->affExpr = SQLITE_AFF_INTEGER;
767       break;
768     }
769 #endif /* defined(SQLITE_ENABLE_UPDATE_DELETE_LIMIT)
770           && !defined(SQLITE_OMIT_SUBQUERY) */
771 
772     /* A column name:                    ID
773     ** Or table name and column name:    ID.ID
774     ** Or a database, table and column:  ID.ID.ID
775     **
776     ** The TK_ID and TK_OUT cases are combined so that there will only
777     ** be one call to lookupName().  Then the compiler will in-line
778     ** lookupName() for a size reduction and performance increase.
779     */
780     case TK_ID:
781     case TK_DOT: {
782       const char *zColumn;
783       const char *zTable;
784       const char *zDb;
785       Expr *pRight;
786 
787       if( pExpr->op==TK_ID ){
788         zDb = 0;
789         zTable = 0;
790         zColumn = pExpr->u.zToken;
791       }else{
792         Expr *pLeft = pExpr->pLeft;
793         testcase( pNC->ncFlags & NC_IdxExpr );
794         testcase( pNC->ncFlags & NC_GenCol );
795         sqlite3ResolveNotValid(pParse, pNC, "the \".\" operator",
796                                NC_IdxExpr|NC_GenCol, 0);
797         pRight = pExpr->pRight;
798         if( pRight->op==TK_ID ){
799           zDb = 0;
800         }else{
801           assert( pRight->op==TK_DOT );
802           zDb = pLeft->u.zToken;
803           pLeft = pRight->pLeft;
804           pRight = pRight->pRight;
805         }
806         zTable = pLeft->u.zToken;
807         zColumn = pRight->u.zToken;
808         if( IN_RENAME_OBJECT ){
809           sqlite3RenameTokenRemap(pParse, (void*)pExpr, (void*)pRight);
810           sqlite3RenameTokenRemap(pParse, (void*)&pExpr->y.pTab, (void*)pLeft);
811         }
812       }
813       return lookupName(pParse, zDb, zTable, zColumn, pNC, pExpr);
814     }
815 
816     /* Resolve function names
817     */
818     case TK_FUNCTION: {
819       ExprList *pList = pExpr->x.pList;    /* The argument list */
820       int n = pList ? pList->nExpr : 0;    /* Number of arguments */
821       int no_such_func = 0;       /* True if no such function exists */
822       int wrong_num_args = 0;     /* True if wrong number of arguments */
823       int is_agg = 0;             /* True if is an aggregate function */
824       int nId;                    /* Number of characters in function name */
825       const char *zId;            /* The function name. */
826       FuncDef *pDef;              /* Information about the function */
827       u8 enc = ENC(pParse->db);   /* The database encoding */
828       int savedAllowFlags = (pNC->ncFlags & (NC_AllowAgg | NC_AllowWin));
829 #ifndef SQLITE_OMIT_WINDOWFUNC
830       Window *pWin = (IsWindowFunc(pExpr) ? pExpr->y.pWin : 0);
831 #endif
832       assert( !ExprHasProperty(pExpr, EP_xIsSelect) );
833       zId = pExpr->u.zToken;
834       nId = sqlite3Strlen30(zId);
835       pDef = sqlite3FindFunction(pParse->db, zId, n, enc, 0);
836       if( pDef==0 ){
837         pDef = sqlite3FindFunction(pParse->db, zId, -2, enc, 0);
838         if( pDef==0 ){
839           no_such_func = 1;
840         }else{
841           wrong_num_args = 1;
842         }
843       }else{
844         is_agg = pDef->xFinalize!=0;
845         if( pDef->funcFlags & SQLITE_FUNC_UNLIKELY ){
846           ExprSetProperty(pExpr, EP_Unlikely);
847           if( n==2 ){
848             pExpr->iTable = exprProbability(pList->a[1].pExpr);
849             if( pExpr->iTable<0 ){
850               sqlite3ErrorMsg(pParse,
851                 "second argument to likelihood() must be a "
852                 "constant between 0.0 and 1.0");
853               pNC->nErr++;
854             }
855           }else{
856             /* EVIDENCE-OF: R-61304-29449 The unlikely(X) function is
857             ** equivalent to likelihood(X, 0.0625).
858             ** EVIDENCE-OF: R-01283-11636 The unlikely(X) function is
859             ** short-hand for likelihood(X,0.0625).
860             ** EVIDENCE-OF: R-36850-34127 The likely(X) function is short-hand
861             ** for likelihood(X,0.9375).
862             ** EVIDENCE-OF: R-53436-40973 The likely(X) function is equivalent
863             ** to likelihood(X,0.9375). */
864             /* TUNING: unlikely() probability is 0.0625.  likely() is 0.9375 */
865             pExpr->iTable = pDef->zName[0]=='u' ? 8388608 : 125829120;
866           }
867         }
868 #ifndef SQLITE_OMIT_AUTHORIZATION
869         {
870           int auth = sqlite3AuthCheck(pParse, SQLITE_FUNCTION, 0,pDef->zName,0);
871           if( auth!=SQLITE_OK ){
872             if( auth==SQLITE_DENY ){
873               sqlite3ErrorMsg(pParse, "not authorized to use function: %s",
874                                       pDef->zName);
875               pNC->nErr++;
876             }
877             pExpr->op = TK_NULL;
878             return WRC_Prune;
879           }
880         }
881 #endif
882         if( pDef->funcFlags & (SQLITE_FUNC_CONSTANT|SQLITE_FUNC_SLOCHNG) ){
883           /* For the purposes of the EP_ConstFunc flag, date and time
884           ** functions and other functions that change slowly are considered
885           ** constant because they are constant for the duration of one query.
886           ** This allows them to be factored out of inner loops. */
887           ExprSetProperty(pExpr,EP_ConstFunc);
888         }
889         if( (pDef->funcFlags & SQLITE_FUNC_CONSTANT)==0 ){
890           /* Clearly non-deterministic functions like random(), but also
891           ** date/time functions that use 'now', and other functions like
892           ** sqlite_version() that might change over time cannot be used
893           ** in an index or generated column.  Curiously, they can be used
894           ** in a CHECK constraint.  SQLServer, MySQL, and PostgreSQL all
895           ** all this. */
896           sqlite3ResolveNotValid(pParse, pNC, "non-deterministic functions",
897                                  NC_IdxExpr|NC_PartIdx|NC_GenCol, 0);
898         }else{
899           assert( (NC_SelfRef & 0xff)==NC_SelfRef ); /* Must fit in 8 bits */
900           pExpr->op2 = pNC->ncFlags & NC_SelfRef;
901           if( pNC->ncFlags & NC_FromDDL ) ExprSetProperty(pExpr, EP_FromDDL);
902         }
903         if( (pDef->funcFlags & SQLITE_FUNC_INTERNAL)!=0
904          && pParse->nested==0
905          && (pParse->db->mDbFlags & DBFLAG_InternalFunc)==0
906         ){
907           /* Internal-use-only functions are disallowed unless the
908           ** SQL is being compiled using sqlite3NestedParse() or
909           ** the SQLITE_TESTCTRL_INTERNAL_FUNCTIONS test-control has be
910           ** used to activate internal functionsn for testing purposes */
911           no_such_func = 1;
912           pDef = 0;
913         }else
914         if( (pDef->funcFlags & (SQLITE_FUNC_DIRECT|SQLITE_FUNC_UNSAFE))!=0
915          && !IN_RENAME_OBJECT
916         ){
917           sqlite3ExprFunctionUsable(pParse, pExpr, pDef);
918         }
919       }
920 
921       if( 0==IN_RENAME_OBJECT ){
922 #ifndef SQLITE_OMIT_WINDOWFUNC
923         assert( is_agg==0 || (pDef->funcFlags & SQLITE_FUNC_MINMAX)
924           || (pDef->xValue==0 && pDef->xInverse==0)
925           || (pDef->xValue && pDef->xInverse && pDef->xSFunc && pDef->xFinalize)
926         );
927         if( pDef && pDef->xValue==0 && pWin ){
928           sqlite3ErrorMsg(pParse,
929               "%.*s() may not be used as a window function", nId, zId
930           );
931           pNC->nErr++;
932         }else if(
933               (is_agg && (pNC->ncFlags & NC_AllowAgg)==0)
934            || (is_agg && (pDef->funcFlags&SQLITE_FUNC_WINDOW) && !pWin)
935            || (is_agg && pWin && (pNC->ncFlags & NC_AllowWin)==0)
936         ){
937           const char *zType;
938           if( (pDef->funcFlags & SQLITE_FUNC_WINDOW) || pWin ){
939             zType = "window";
940           }else{
941             zType = "aggregate";
942           }
943           sqlite3ErrorMsg(pParse, "misuse of %s function %.*s()",zType,nId,zId);
944           pNC->nErr++;
945           is_agg = 0;
946         }
947 #else
948         if( (is_agg && (pNC->ncFlags & NC_AllowAgg)==0) ){
949           sqlite3ErrorMsg(pParse,"misuse of aggregate function %.*s()",nId,zId);
950           pNC->nErr++;
951           is_agg = 0;
952         }
953 #endif
954         else if( no_such_func && pParse->db->init.busy==0
955 #ifdef SQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
956                   && pParse->explain==0
957 #endif
958         ){
959           sqlite3ErrorMsg(pParse, "no such function: %.*s", nId, zId);
960           pNC->nErr++;
961         }else if( wrong_num_args ){
962           sqlite3ErrorMsg(pParse,"wrong number of arguments to function %.*s()",
963                nId, zId);
964           pNC->nErr++;
965         }
966 #ifndef SQLITE_OMIT_WINDOWFUNC
967         else if( is_agg==0 && ExprHasProperty(pExpr, EP_WinFunc) ){
968           sqlite3ErrorMsg(pParse,
969               "FILTER may not be used with non-aggregate %.*s()",
970               nId, zId
971           );
972           pNC->nErr++;
973         }
974 #endif
975         if( is_agg ){
976           /* Window functions may not be arguments of aggregate functions.
977           ** Or arguments of other window functions. But aggregate functions
978           ** may be arguments for window functions.  */
979 #ifndef SQLITE_OMIT_WINDOWFUNC
980           pNC->ncFlags &= ~(NC_AllowWin | (!pWin ? NC_AllowAgg : 0));
981 #else
982           pNC->ncFlags &= ~NC_AllowAgg;
983 #endif
984         }
985       }
986 #ifndef SQLITE_OMIT_WINDOWFUNC
987       else if( ExprHasProperty(pExpr, EP_WinFunc) ){
988         is_agg = 1;
989       }
990 #endif
991       sqlite3WalkExprList(pWalker, pList);
992       if( is_agg ){
993 #ifndef SQLITE_OMIT_WINDOWFUNC
994         if( pWin ){
995           Select *pSel = pNC->pWinSelect;
996           assert( pWin==pExpr->y.pWin );
997           if( IN_RENAME_OBJECT==0 ){
998             sqlite3WindowUpdate(pParse, pSel ? pSel->pWinDefn : 0, pWin, pDef);
999           }
1000           sqlite3WalkExprList(pWalker, pWin->pPartition);
1001           sqlite3WalkExprList(pWalker, pWin->pOrderBy);
1002           sqlite3WalkExpr(pWalker, pWin->pFilter);
1003           sqlite3WindowLink(pSel, pWin);
1004           pNC->ncFlags |= NC_HasWin;
1005         }else
1006 #endif /* SQLITE_OMIT_WINDOWFUNC */
1007         {
1008           NameContext *pNC2 = pNC;
1009           pExpr->op = TK_AGG_FUNCTION;
1010           pExpr->op2 = 0;
1011 #ifndef SQLITE_OMIT_WINDOWFUNC
1012           if( ExprHasProperty(pExpr, EP_WinFunc) ){
1013             sqlite3WalkExpr(pWalker, pExpr->y.pWin->pFilter);
1014           }
1015 #endif
1016           while( pNC2 && !sqlite3FunctionUsesThisSrc(pExpr, pNC2->pSrcList) ){
1017             pExpr->op2++;
1018             pNC2 = pNC2->pNext;
1019           }
1020           assert( pDef!=0 || IN_RENAME_OBJECT );
1021           if( pNC2 && pDef ){
1022             assert( SQLITE_FUNC_MINMAX==NC_MinMaxAgg );
1023             testcase( (pDef->funcFlags & SQLITE_FUNC_MINMAX)!=0 );
1024             pNC2->ncFlags |= NC_HasAgg | (pDef->funcFlags & SQLITE_FUNC_MINMAX);
1025 
1026           }
1027         }
1028         pNC->ncFlags |= savedAllowFlags;
1029       }
1030       /* FIX ME:  Compute pExpr->affinity based on the expected return
1031       ** type of the function
1032       */
1033       return WRC_Prune;
1034     }
1035 #ifndef SQLITE_OMIT_SUBQUERY
1036     case TK_SELECT:
1037     case TK_EXISTS:  testcase( pExpr->op==TK_EXISTS );
1038 #endif
1039     case TK_IN: {
1040       testcase( pExpr->op==TK_IN );
1041       if( ExprHasProperty(pExpr, EP_xIsSelect) ){
1042         int nRef = pNC->nRef;
1043         testcase( pNC->ncFlags & NC_IsCheck );
1044         testcase( pNC->ncFlags & NC_PartIdx );
1045         testcase( pNC->ncFlags & NC_IdxExpr );
1046         testcase( pNC->ncFlags & NC_GenCol );
1047         sqlite3ResolveNotValid(pParse, pNC, "subqueries",
1048                  NC_IsCheck|NC_PartIdx|NC_IdxExpr|NC_GenCol, pExpr);
1049         sqlite3WalkSelect(pWalker, pExpr->x.pSelect);
1050         assert( pNC->nRef>=nRef );
1051         if( nRef!=pNC->nRef ){
1052           ExprSetProperty(pExpr, EP_VarSelect);
1053           pNC->ncFlags |= NC_VarSelect;
1054         }
1055       }
1056       break;
1057     }
1058     case TK_VARIABLE: {
1059       testcase( pNC->ncFlags & NC_IsCheck );
1060       testcase( pNC->ncFlags & NC_PartIdx );
1061       testcase( pNC->ncFlags & NC_IdxExpr );
1062       testcase( pNC->ncFlags & NC_GenCol );
1063       sqlite3ResolveNotValid(pParse, pNC, "parameters",
1064                NC_IsCheck|NC_PartIdx|NC_IdxExpr|NC_GenCol, pExpr);
1065       break;
1066     }
1067     case TK_IS:
1068     case TK_ISNOT: {
1069       Expr *pRight = sqlite3ExprSkipCollateAndLikely(pExpr->pRight);
1070       assert( !ExprHasProperty(pExpr, EP_Reduced) );
1071       /* Handle special cases of "x IS TRUE", "x IS FALSE", "x IS NOT TRUE",
1072       ** and "x IS NOT FALSE". */
1073       if( pRight && pRight->op==TK_ID ){
1074         int rc = resolveExprStep(pWalker, pRight);
1075         if( rc==WRC_Abort ) return WRC_Abort;
1076         if( pRight->op==TK_TRUEFALSE ){
1077           pExpr->op2 = pExpr->op;
1078           pExpr->op = TK_TRUTH;
1079           return WRC_Continue;
1080         }
1081       }
1082       /* Fall thru */
1083     }
1084     case TK_BETWEEN:
1085     case TK_EQ:
1086     case TK_NE:
1087     case TK_LT:
1088     case TK_LE:
1089     case TK_GT:
1090     case TK_GE: {
1091       int nLeft, nRight;
1092       if( pParse->db->mallocFailed ) break;
1093       assert( pExpr->pLeft!=0 );
1094       nLeft = sqlite3ExprVectorSize(pExpr->pLeft);
1095       if( pExpr->op==TK_BETWEEN ){
1096         nRight = sqlite3ExprVectorSize(pExpr->x.pList->a[0].pExpr);
1097         if( nRight==nLeft ){
1098           nRight = sqlite3ExprVectorSize(pExpr->x.pList->a[1].pExpr);
1099         }
1100       }else{
1101         assert( pExpr->pRight!=0 );
1102         nRight = sqlite3ExprVectorSize(pExpr->pRight);
1103       }
1104       if( nLeft!=nRight ){
1105         testcase( pExpr->op==TK_EQ );
1106         testcase( pExpr->op==TK_NE );
1107         testcase( pExpr->op==TK_LT );
1108         testcase( pExpr->op==TK_LE );
1109         testcase( pExpr->op==TK_GT );
1110         testcase( pExpr->op==TK_GE );
1111         testcase( pExpr->op==TK_IS );
1112         testcase( pExpr->op==TK_ISNOT );
1113         testcase( pExpr->op==TK_BETWEEN );
1114         sqlite3ErrorMsg(pParse, "row value misused");
1115       }
1116       break;
1117     }
1118   }
1119   return (pParse->nErr || pParse->db->mallocFailed) ? WRC_Abort : WRC_Continue;
1120 }
1121 
1122 /*
1123 ** pEList is a list of expressions which are really the result set of the
1124 ** a SELECT statement.  pE is a term in an ORDER BY or GROUP BY clause.
1125 ** This routine checks to see if pE is a simple identifier which corresponds
1126 ** to the AS-name of one of the terms of the expression list.  If it is,
1127 ** this routine return an integer between 1 and N where N is the number of
1128 ** elements in pEList, corresponding to the matching entry.  If there is
1129 ** no match, or if pE is not a simple identifier, then this routine
1130 ** return 0.
1131 **
1132 ** pEList has been resolved.  pE has not.
1133 */
1134 static int resolveAsName(
1135   Parse *pParse,     /* Parsing context for error messages */
1136   ExprList *pEList,  /* List of expressions to scan */
1137   Expr *pE           /* Expression we are trying to match */
1138 ){
1139   int i;             /* Loop counter */
1140 
1141   UNUSED_PARAMETER(pParse);
1142 
1143   if( pE->op==TK_ID ){
1144     char *zCol = pE->u.zToken;
1145     for(i=0; i<pEList->nExpr; i++){
1146       if( pEList->a[i].eEName==ENAME_NAME
1147        && sqlite3_stricmp(pEList->a[i].zEName, zCol)==0
1148       ){
1149         return i+1;
1150       }
1151     }
1152   }
1153   return 0;
1154 }
1155 
1156 /*
1157 ** pE is a pointer to an expression which is a single term in the
1158 ** ORDER BY of a compound SELECT.  The expression has not been
1159 ** name resolved.
1160 **
1161 ** At the point this routine is called, we already know that the
1162 ** ORDER BY term is not an integer index into the result set.  That
1163 ** case is handled by the calling routine.
1164 **
1165 ** Attempt to match pE against result set columns in the left-most
1166 ** SELECT statement.  Return the index i of the matching column,
1167 ** as an indication to the caller that it should sort by the i-th column.
1168 ** The left-most column is 1.  In other words, the value returned is the
1169 ** same integer value that would be used in the SQL statement to indicate
1170 ** the column.
1171 **
1172 ** If there is no match, return 0.  Return -1 if an error occurs.
1173 */
1174 static int resolveOrderByTermToExprList(
1175   Parse *pParse,     /* Parsing context for error messages */
1176   Select *pSelect,   /* The SELECT statement with the ORDER BY clause */
1177   Expr *pE           /* The specific ORDER BY term */
1178 ){
1179   int i;             /* Loop counter */
1180   ExprList *pEList;  /* The columns of the result set */
1181   NameContext nc;    /* Name context for resolving pE */
1182   sqlite3 *db;       /* Database connection */
1183   int rc;            /* Return code from subprocedures */
1184   u8 savedSuppErr;   /* Saved value of db->suppressErr */
1185 
1186   assert( sqlite3ExprIsInteger(pE, &i)==0 );
1187   pEList = pSelect->pEList;
1188 
1189   /* Resolve all names in the ORDER BY term expression
1190   */
1191   memset(&nc, 0, sizeof(nc));
1192   nc.pParse = pParse;
1193   nc.pSrcList = pSelect->pSrc;
1194   nc.uNC.pEList = pEList;
1195   nc.ncFlags = NC_AllowAgg|NC_UEList;
1196   nc.nErr = 0;
1197   db = pParse->db;
1198   savedSuppErr = db->suppressErr;
1199   if( IN_RENAME_OBJECT==0 ) db->suppressErr = 1;
1200   rc = sqlite3ResolveExprNames(&nc, pE);
1201   db->suppressErr = savedSuppErr;
1202   if( rc ) return 0;
1203 
1204   /* Try to match the ORDER BY expression against an expression
1205   ** in the result set.  Return an 1-based index of the matching
1206   ** result-set entry.
1207   */
1208   for(i=0; i<pEList->nExpr; i++){
1209     if( sqlite3ExprCompare(0, pEList->a[i].pExpr, pE, -1)<2 ){
1210       return i+1;
1211     }
1212   }
1213 
1214   /* If no match, return 0. */
1215   return 0;
1216 }
1217 
1218 /*
1219 ** Generate an ORDER BY or GROUP BY term out-of-range error.
1220 */
1221 static void resolveOutOfRangeError(
1222   Parse *pParse,         /* The error context into which to write the error */
1223   const char *zType,     /* "ORDER" or "GROUP" */
1224   int i,                 /* The index (1-based) of the term out of range */
1225   int mx                 /* Largest permissible value of i */
1226 ){
1227   sqlite3ErrorMsg(pParse,
1228     "%r %s BY term out of range - should be "
1229     "between 1 and %d", i, zType, mx);
1230 }
1231 
1232 /*
1233 ** Analyze the ORDER BY clause in a compound SELECT statement.   Modify
1234 ** each term of the ORDER BY clause is a constant integer between 1
1235 ** and N where N is the number of columns in the compound SELECT.
1236 **
1237 ** ORDER BY terms that are already an integer between 1 and N are
1238 ** unmodified.  ORDER BY terms that are integers outside the range of
1239 ** 1 through N generate an error.  ORDER BY terms that are expressions
1240 ** are matched against result set expressions of compound SELECT
1241 ** beginning with the left-most SELECT and working toward the right.
1242 ** At the first match, the ORDER BY expression is transformed into
1243 ** the integer column number.
1244 **
1245 ** Return the number of errors seen.
1246 */
1247 static int resolveCompoundOrderBy(
1248   Parse *pParse,        /* Parsing context.  Leave error messages here */
1249   Select *pSelect       /* The SELECT statement containing the ORDER BY */
1250 ){
1251   int i;
1252   ExprList *pOrderBy;
1253   ExprList *pEList;
1254   sqlite3 *db;
1255   int moreToDo = 1;
1256 
1257   pOrderBy = pSelect->pOrderBy;
1258   if( pOrderBy==0 ) return 0;
1259   db = pParse->db;
1260   if( pOrderBy->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
1261     sqlite3ErrorMsg(pParse, "too many terms in ORDER BY clause");
1262     return 1;
1263   }
1264   for(i=0; i<pOrderBy->nExpr; i++){
1265     pOrderBy->a[i].done = 0;
1266   }
1267   pSelect->pNext = 0;
1268   while( pSelect->pPrior ){
1269     pSelect->pPrior->pNext = pSelect;
1270     pSelect = pSelect->pPrior;
1271   }
1272   while( pSelect && moreToDo ){
1273     struct ExprList_item *pItem;
1274     moreToDo = 0;
1275     pEList = pSelect->pEList;
1276     assert( pEList!=0 );
1277     for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
1278       int iCol = -1;
1279       Expr *pE, *pDup;
1280       if( pItem->done ) continue;
1281       pE = sqlite3ExprSkipCollateAndLikely(pItem->pExpr);
1282       if( sqlite3ExprIsInteger(pE, &iCol) ){
1283         if( iCol<=0 || iCol>pEList->nExpr ){
1284           resolveOutOfRangeError(pParse, "ORDER", i+1, pEList->nExpr);
1285           return 1;
1286         }
1287       }else{
1288         iCol = resolveAsName(pParse, pEList, pE);
1289         if( iCol==0 ){
1290           /* Now test if expression pE matches one of the values returned
1291           ** by pSelect. In the usual case this is done by duplicating the
1292           ** expression, resolving any symbols in it, and then comparing
1293           ** it against each expression returned by the SELECT statement.
1294           ** Once the comparisons are finished, the duplicate expression
1295           ** is deleted.
1296           **
1297           ** Or, if this is running as part of an ALTER TABLE operation,
1298           ** resolve the symbols in the actual expression, not a duplicate.
1299           ** And, if one of the comparisons is successful, leave the expression
1300           ** as is instead of transforming it to an integer as in the usual
1301           ** case. This allows the code in alter.c to modify column
1302           ** refererences within the ORDER BY expression as required.  */
1303           if( IN_RENAME_OBJECT ){
1304             pDup = pE;
1305           }else{
1306             pDup = sqlite3ExprDup(db, pE, 0);
1307           }
1308           if( !db->mallocFailed ){
1309             assert(pDup);
1310             iCol = resolveOrderByTermToExprList(pParse, pSelect, pDup);
1311           }
1312           if( !IN_RENAME_OBJECT ){
1313             sqlite3ExprDelete(db, pDup);
1314           }
1315         }
1316       }
1317       if( iCol>0 ){
1318         /* Convert the ORDER BY term into an integer column number iCol,
1319         ** taking care to preserve the COLLATE clause if it exists */
1320         if( !IN_RENAME_OBJECT ){
1321           Expr *pNew = sqlite3Expr(db, TK_INTEGER, 0);
1322           if( pNew==0 ) return 1;
1323           pNew->flags |= EP_IntValue;
1324           pNew->u.iValue = iCol;
1325           if( pItem->pExpr==pE ){
1326             pItem->pExpr = pNew;
1327           }else{
1328             Expr *pParent = pItem->pExpr;
1329             assert( pParent->op==TK_COLLATE );
1330             while( pParent->pLeft->op==TK_COLLATE ) pParent = pParent->pLeft;
1331             assert( pParent->pLeft==pE );
1332             pParent->pLeft = pNew;
1333           }
1334           sqlite3ExprDelete(db, pE);
1335           pItem->u.x.iOrderByCol = (u16)iCol;
1336         }
1337         pItem->done = 1;
1338       }else{
1339         moreToDo = 1;
1340       }
1341     }
1342     pSelect = pSelect->pNext;
1343   }
1344   for(i=0; i<pOrderBy->nExpr; i++){
1345     if( pOrderBy->a[i].done==0 ){
1346       sqlite3ErrorMsg(pParse, "%r ORDER BY term does not match any "
1347             "column in the result set", i+1);
1348       return 1;
1349     }
1350   }
1351   return 0;
1352 }
1353 
1354 /*
1355 ** Check every term in the ORDER BY or GROUP BY clause pOrderBy of
1356 ** the SELECT statement pSelect.  If any term is reference to a
1357 ** result set expression (as determined by the ExprList.a.u.x.iOrderByCol
1358 ** field) then convert that term into a copy of the corresponding result set
1359 ** column.
1360 **
1361 ** If any errors are detected, add an error message to pParse and
1362 ** return non-zero.  Return zero if no errors are seen.
1363 */
1364 int sqlite3ResolveOrderGroupBy(
1365   Parse *pParse,        /* Parsing context.  Leave error messages here */
1366   Select *pSelect,      /* The SELECT statement containing the clause */
1367   ExprList *pOrderBy,   /* The ORDER BY or GROUP BY clause to be processed */
1368   const char *zType     /* "ORDER" or "GROUP" */
1369 ){
1370   int i;
1371   sqlite3 *db = pParse->db;
1372   ExprList *pEList;
1373   struct ExprList_item *pItem;
1374 
1375   if( pOrderBy==0 || pParse->db->mallocFailed || IN_RENAME_OBJECT ) return 0;
1376   if( pOrderBy->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
1377     sqlite3ErrorMsg(pParse, "too many terms in %s BY clause", zType);
1378     return 1;
1379   }
1380   pEList = pSelect->pEList;
1381   assert( pEList!=0 );  /* sqlite3SelectNew() guarantees this */
1382   for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
1383     if( pItem->u.x.iOrderByCol ){
1384       if( pItem->u.x.iOrderByCol>pEList->nExpr ){
1385         resolveOutOfRangeError(pParse, zType, i+1, pEList->nExpr);
1386         return 1;
1387       }
1388       resolveAlias(pParse, pEList, pItem->u.x.iOrderByCol-1, pItem->pExpr,
1389                    zType,0);
1390     }
1391   }
1392   return 0;
1393 }
1394 
1395 #ifndef SQLITE_OMIT_WINDOWFUNC
1396 /*
1397 ** Walker callback for windowRemoveExprFromSelect().
1398 */
1399 static int resolveRemoveWindowsCb(Walker *pWalker, Expr *pExpr){
1400   UNUSED_PARAMETER(pWalker);
1401   if( ExprHasProperty(pExpr, EP_WinFunc) ){
1402     Window *pWin = pExpr->y.pWin;
1403     sqlite3WindowUnlinkFromSelect(pWin);
1404   }
1405   return WRC_Continue;
1406 }
1407 
1408 /*
1409 ** Remove any Window objects owned by the expression pExpr from the
1410 ** Select.pWin list of Select object pSelect.
1411 */
1412 static void windowRemoveExprFromSelect(Select *pSelect, Expr *pExpr){
1413   if( pSelect->pWin ){
1414     Walker sWalker;
1415     memset(&sWalker, 0, sizeof(Walker));
1416     sWalker.xExprCallback = resolveRemoveWindowsCb;
1417     sWalker.u.pSelect = pSelect;
1418     sqlite3WalkExpr(&sWalker, pExpr);
1419   }
1420 }
1421 #else
1422 # define windowRemoveExprFromSelect(a, b)
1423 #endif /* SQLITE_OMIT_WINDOWFUNC */
1424 
1425 /*
1426 ** pOrderBy is an ORDER BY or GROUP BY clause in SELECT statement pSelect.
1427 ** The Name context of the SELECT statement is pNC.  zType is either
1428 ** "ORDER" or "GROUP" depending on which type of clause pOrderBy is.
1429 **
1430 ** This routine resolves each term of the clause into an expression.
1431 ** If the order-by term is an integer I between 1 and N (where N is the
1432 ** number of columns in the result set of the SELECT) then the expression
1433 ** in the resolution is a copy of the I-th result-set expression.  If
1434 ** the order-by term is an identifier that corresponds to the AS-name of
1435 ** a result-set expression, then the term resolves to a copy of the
1436 ** result-set expression.  Otherwise, the expression is resolved in
1437 ** the usual way - using sqlite3ResolveExprNames().
1438 **
1439 ** This routine returns the number of errors.  If errors occur, then
1440 ** an appropriate error message might be left in pParse.  (OOM errors
1441 ** excepted.)
1442 */
1443 static int resolveOrderGroupBy(
1444   NameContext *pNC,     /* The name context of the SELECT statement */
1445   Select *pSelect,      /* The SELECT statement holding pOrderBy */
1446   ExprList *pOrderBy,   /* An ORDER BY or GROUP BY clause to resolve */
1447   const char *zType     /* Either "ORDER" or "GROUP", as appropriate */
1448 ){
1449   int i, j;                      /* Loop counters */
1450   int iCol;                      /* Column number */
1451   struct ExprList_item *pItem;   /* A term of the ORDER BY clause */
1452   Parse *pParse;                 /* Parsing context */
1453   int nResult;                   /* Number of terms in the result set */
1454 
1455   if( pOrderBy==0 ) return 0;
1456   nResult = pSelect->pEList->nExpr;
1457   pParse = pNC->pParse;
1458   for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
1459     Expr *pE = pItem->pExpr;
1460     Expr *pE2 = sqlite3ExprSkipCollateAndLikely(pE);
1461     if( zType[0]!='G' ){
1462       iCol = resolveAsName(pParse, pSelect->pEList, pE2);
1463       if( iCol>0 ){
1464         /* If an AS-name match is found, mark this ORDER BY column as being
1465         ** a copy of the iCol-th result-set column.  The subsequent call to
1466         ** sqlite3ResolveOrderGroupBy() will convert the expression to a
1467         ** copy of the iCol-th result-set expression. */
1468         pItem->u.x.iOrderByCol = (u16)iCol;
1469         continue;
1470       }
1471     }
1472     if( sqlite3ExprIsInteger(pE2, &iCol) ){
1473       /* The ORDER BY term is an integer constant.  Again, set the column
1474       ** number so that sqlite3ResolveOrderGroupBy() will convert the
1475       ** order-by term to a copy of the result-set expression */
1476       if( iCol<1 || iCol>0xffff ){
1477         resolveOutOfRangeError(pParse, zType, i+1, nResult);
1478         return 1;
1479       }
1480       pItem->u.x.iOrderByCol = (u16)iCol;
1481       continue;
1482     }
1483 
1484     /* Otherwise, treat the ORDER BY term as an ordinary expression */
1485     pItem->u.x.iOrderByCol = 0;
1486     if( sqlite3ResolveExprNames(pNC, pE) ){
1487       return 1;
1488     }
1489     for(j=0; j<pSelect->pEList->nExpr; j++){
1490       if( sqlite3ExprCompare(0, pE, pSelect->pEList->a[j].pExpr, -1)==0 ){
1491         /* Since this expresion is being changed into a reference
1492         ** to an identical expression in the result set, remove all Window
1493         ** objects belonging to the expression from the Select.pWin list. */
1494         windowRemoveExprFromSelect(pSelect, pE);
1495         pItem->u.x.iOrderByCol = j+1;
1496       }
1497     }
1498   }
1499   return sqlite3ResolveOrderGroupBy(pParse, pSelect, pOrderBy, zType);
1500 }
1501 
1502 /*
1503 ** Resolve names in the SELECT statement p and all of its descendants.
1504 */
1505 static int resolveSelectStep(Walker *pWalker, Select *p){
1506   NameContext *pOuterNC;  /* Context that contains this SELECT */
1507   NameContext sNC;        /* Name context of this SELECT */
1508   int isCompound;         /* True if p is a compound select */
1509   int nCompound;          /* Number of compound terms processed so far */
1510   Parse *pParse;          /* Parsing context */
1511   int i;                  /* Loop counter */
1512   ExprList *pGroupBy;     /* The GROUP BY clause */
1513   Select *pLeftmost;      /* Left-most of SELECT of a compound */
1514   sqlite3 *db;            /* Database connection */
1515 
1516 
1517   assert( p!=0 );
1518   if( p->selFlags & SF_Resolved ){
1519     return WRC_Prune;
1520   }
1521   pOuterNC = pWalker->u.pNC;
1522   pParse = pWalker->pParse;
1523   db = pParse->db;
1524 
1525   /* Normally sqlite3SelectExpand() will be called first and will have
1526   ** already expanded this SELECT.  However, if this is a subquery within
1527   ** an expression, sqlite3ResolveExprNames() will be called without a
1528   ** prior call to sqlite3SelectExpand().  When that happens, let
1529   ** sqlite3SelectPrep() do all of the processing for this SELECT.
1530   ** sqlite3SelectPrep() will invoke both sqlite3SelectExpand() and
1531   ** this routine in the correct order.
1532   */
1533   if( (p->selFlags & SF_Expanded)==0 ){
1534     sqlite3SelectPrep(pParse, p, pOuterNC);
1535     return (pParse->nErr || db->mallocFailed) ? WRC_Abort : WRC_Prune;
1536   }
1537 
1538   isCompound = p->pPrior!=0;
1539   nCompound = 0;
1540   pLeftmost = p;
1541   while( p ){
1542     assert( (p->selFlags & SF_Expanded)!=0 );
1543     assert( (p->selFlags & SF_Resolved)==0 );
1544     p->selFlags |= SF_Resolved;
1545 
1546     /* Resolve the expressions in the LIMIT and OFFSET clauses. These
1547     ** are not allowed to refer to any names, so pass an empty NameContext.
1548     */
1549     memset(&sNC, 0, sizeof(sNC));
1550     sNC.pParse = pParse;
1551     sNC.pWinSelect = p;
1552     if( sqlite3ResolveExprNames(&sNC, p->pLimit) ){
1553       return WRC_Abort;
1554     }
1555 
1556     /* If the SF_Converted flags is set, then this Select object was
1557     ** was created by the convertCompoundSelectToSubquery() function.
1558     ** In this case the ORDER BY clause (p->pOrderBy) should be resolved
1559     ** as if it were part of the sub-query, not the parent. This block
1560     ** moves the pOrderBy down to the sub-query. It will be moved back
1561     ** after the names have been resolved.  */
1562     if( p->selFlags & SF_Converted ){
1563       Select *pSub = p->pSrc->a[0].pSelect;
1564       assert( p->pSrc->nSrc==1 && p->pOrderBy );
1565       assert( pSub->pPrior && pSub->pOrderBy==0 );
1566       pSub->pOrderBy = p->pOrderBy;
1567       p->pOrderBy = 0;
1568     }
1569 
1570     /* Recursively resolve names in all subqueries
1571     */
1572     for(i=0; i<p->pSrc->nSrc; i++){
1573       struct SrcList_item *pItem = &p->pSrc->a[i];
1574       if( pItem->pSelect && (pItem->pSelect->selFlags & SF_Resolved)==0 ){
1575         NameContext *pNC;         /* Used to iterate name contexts */
1576         int nRef = 0;             /* Refcount for pOuterNC and outer contexts */
1577         const char *zSavedContext = pParse->zAuthContext;
1578 
1579         /* Count the total number of references to pOuterNC and all of its
1580         ** parent contexts. After resolving references to expressions in
1581         ** pItem->pSelect, check if this value has changed. If so, then
1582         ** SELECT statement pItem->pSelect must be correlated. Set the
1583         ** pItem->fg.isCorrelated flag if this is the case. */
1584         for(pNC=pOuterNC; pNC; pNC=pNC->pNext) nRef += pNC->nRef;
1585 
1586         if( pItem->zName ) pParse->zAuthContext = pItem->zName;
1587         sqlite3ResolveSelectNames(pParse, pItem->pSelect, pOuterNC);
1588         pParse->zAuthContext = zSavedContext;
1589         if( pParse->nErr || db->mallocFailed ) return WRC_Abort;
1590 
1591         for(pNC=pOuterNC; pNC; pNC=pNC->pNext) nRef -= pNC->nRef;
1592         assert( pItem->fg.isCorrelated==0 && nRef<=0 );
1593         pItem->fg.isCorrelated = (nRef!=0);
1594       }
1595     }
1596 
1597     /* Set up the local name-context to pass to sqlite3ResolveExprNames() to
1598     ** resolve the result-set expression list.
1599     */
1600     sNC.ncFlags = NC_AllowAgg|NC_AllowWin;
1601     sNC.pSrcList = p->pSrc;
1602     sNC.pNext = pOuterNC;
1603 
1604     /* Resolve names in the result set. */
1605     if( sqlite3ResolveExprListNames(&sNC, p->pEList) ) return WRC_Abort;
1606     sNC.ncFlags &= ~NC_AllowWin;
1607 
1608     /* If there are no aggregate functions in the result-set, and no GROUP BY
1609     ** expression, do not allow aggregates in any of the other expressions.
1610     */
1611     assert( (p->selFlags & SF_Aggregate)==0 );
1612     pGroupBy = p->pGroupBy;
1613     if( pGroupBy || (sNC.ncFlags & NC_HasAgg)!=0 ){
1614       assert( NC_MinMaxAgg==SF_MinMaxAgg );
1615       p->selFlags |= SF_Aggregate | (sNC.ncFlags&NC_MinMaxAgg);
1616     }else{
1617       sNC.ncFlags &= ~NC_AllowAgg;
1618     }
1619 
1620     /* If a HAVING clause is present, then there must be a GROUP BY clause.
1621     */
1622     if( p->pHaving && !pGroupBy ){
1623       sqlite3ErrorMsg(pParse, "a GROUP BY clause is required before HAVING");
1624       return WRC_Abort;
1625     }
1626 
1627     /* Add the output column list to the name-context before parsing the
1628     ** other expressions in the SELECT statement. This is so that
1629     ** expressions in the WHERE clause (etc.) can refer to expressions by
1630     ** aliases in the result set.
1631     **
1632     ** Minor point: If this is the case, then the expression will be
1633     ** re-evaluated for each reference to it.
1634     */
1635     assert( (sNC.ncFlags & (NC_UAggInfo|NC_UUpsert))==0 );
1636     sNC.uNC.pEList = p->pEList;
1637     sNC.ncFlags |= NC_UEList;
1638     if( sqlite3ResolveExprNames(&sNC, p->pHaving) ) return WRC_Abort;
1639     if( sqlite3ResolveExprNames(&sNC, p->pWhere) ) return WRC_Abort;
1640 
1641     /* Resolve names in table-valued-function arguments */
1642     for(i=0; i<p->pSrc->nSrc; i++){
1643       struct SrcList_item *pItem = &p->pSrc->a[i];
1644       if( pItem->fg.isTabFunc
1645        && sqlite3ResolveExprListNames(&sNC, pItem->u1.pFuncArg)
1646       ){
1647         return WRC_Abort;
1648       }
1649     }
1650 
1651     /* The ORDER BY and GROUP BY clauses may not refer to terms in
1652     ** outer queries
1653     */
1654     sNC.pNext = 0;
1655     sNC.ncFlags |= NC_AllowAgg|NC_AllowWin;
1656 
1657     /* If this is a converted compound query, move the ORDER BY clause from
1658     ** the sub-query back to the parent query. At this point each term
1659     ** within the ORDER BY clause has been transformed to an integer value.
1660     ** These integers will be replaced by copies of the corresponding result
1661     ** set expressions by the call to resolveOrderGroupBy() below.  */
1662     if( p->selFlags & SF_Converted ){
1663       Select *pSub = p->pSrc->a[0].pSelect;
1664       p->pOrderBy = pSub->pOrderBy;
1665       pSub->pOrderBy = 0;
1666     }
1667 
1668     /* Process the ORDER BY clause for singleton SELECT statements.
1669     ** The ORDER BY clause for compounds SELECT statements is handled
1670     ** below, after all of the result-sets for all of the elements of
1671     ** the compound have been resolved.
1672     **
1673     ** If there is an ORDER BY clause on a term of a compound-select other
1674     ** than the right-most term, then that is a syntax error.  But the error
1675     ** is not detected until much later, and so we need to go ahead and
1676     ** resolve those symbols on the incorrect ORDER BY for consistency.
1677     */
1678     if( isCompound<=nCompound  /* Defer right-most ORDER BY of a compound */
1679      && resolveOrderGroupBy(&sNC, p, p->pOrderBy, "ORDER")
1680     ){
1681       return WRC_Abort;
1682     }
1683     if( db->mallocFailed ){
1684       return WRC_Abort;
1685     }
1686     sNC.ncFlags &= ~NC_AllowWin;
1687 
1688     /* Resolve the GROUP BY clause.  At the same time, make sure
1689     ** the GROUP BY clause does not contain aggregate functions.
1690     */
1691     if( pGroupBy ){
1692       struct ExprList_item *pItem;
1693 
1694       if( resolveOrderGroupBy(&sNC, p, pGroupBy, "GROUP") || db->mallocFailed ){
1695         return WRC_Abort;
1696       }
1697       for(i=0, pItem=pGroupBy->a; i<pGroupBy->nExpr; i++, pItem++){
1698         if( ExprHasProperty(pItem->pExpr, EP_Agg) ){
1699           sqlite3ErrorMsg(pParse, "aggregate functions are not allowed in "
1700               "the GROUP BY clause");
1701           return WRC_Abort;
1702         }
1703       }
1704     }
1705 
1706 #ifndef SQLITE_OMIT_WINDOWFUNC
1707     if( IN_RENAME_OBJECT ){
1708       Window *pWin;
1709       for(pWin=p->pWinDefn; pWin; pWin=pWin->pNextWin){
1710         if( sqlite3ResolveExprListNames(&sNC, pWin->pOrderBy)
1711          || sqlite3ResolveExprListNames(&sNC, pWin->pPartition)
1712         ){
1713           return WRC_Abort;
1714         }
1715       }
1716     }
1717 #endif
1718 
1719     /* If this is part of a compound SELECT, check that it has the right
1720     ** number of expressions in the select list. */
1721     if( p->pNext && p->pEList->nExpr!=p->pNext->pEList->nExpr ){
1722       sqlite3SelectWrongNumTermsError(pParse, p->pNext);
1723       return WRC_Abort;
1724     }
1725 
1726     /* Advance to the next term of the compound
1727     */
1728     p = p->pPrior;
1729     nCompound++;
1730   }
1731 
1732   /* Resolve the ORDER BY on a compound SELECT after all terms of
1733   ** the compound have been resolved.
1734   */
1735   if( isCompound && resolveCompoundOrderBy(pParse, pLeftmost) ){
1736     return WRC_Abort;
1737   }
1738 
1739   return WRC_Prune;
1740 }
1741 
1742 /*
1743 ** This routine walks an expression tree and resolves references to
1744 ** table columns and result-set columns.  At the same time, do error
1745 ** checking on function usage and set a flag if any aggregate functions
1746 ** are seen.
1747 **
1748 ** To resolve table columns references we look for nodes (or subtrees) of the
1749 ** form X.Y.Z or Y.Z or just Z where
1750 **
1751 **      X:   The name of a database.  Ex:  "main" or "temp" or
1752 **           the symbolic name assigned to an ATTACH-ed database.
1753 **
1754 **      Y:   The name of a table in a FROM clause.  Or in a trigger
1755 **           one of the special names "old" or "new".
1756 **
1757 **      Z:   The name of a column in table Y.
1758 **
1759 ** The node at the root of the subtree is modified as follows:
1760 **
1761 **    Expr.op        Changed to TK_COLUMN
1762 **    Expr.pTab      Points to the Table object for X.Y
1763 **    Expr.iColumn   The column index in X.Y.  -1 for the rowid.
1764 **    Expr.iTable    The VDBE cursor number for X.Y
1765 **
1766 **
1767 ** To resolve result-set references, look for expression nodes of the
1768 ** form Z (with no X and Y prefix) where the Z matches the right-hand
1769 ** size of an AS clause in the result-set of a SELECT.  The Z expression
1770 ** is replaced by a copy of the left-hand side of the result-set expression.
1771 ** Table-name and function resolution occurs on the substituted expression
1772 ** tree.  For example, in:
1773 **
1774 **      SELECT a+b AS x, c+d AS y FROM t1 ORDER BY x;
1775 **
1776 ** The "x" term of the order by is replaced by "a+b" to render:
1777 **
1778 **      SELECT a+b AS x, c+d AS y FROM t1 ORDER BY a+b;
1779 **
1780 ** Function calls are checked to make sure that the function is
1781 ** defined and that the correct number of arguments are specified.
1782 ** If the function is an aggregate function, then the NC_HasAgg flag is
1783 ** set and the opcode is changed from TK_FUNCTION to TK_AGG_FUNCTION.
1784 ** If an expression contains aggregate functions then the EP_Agg
1785 ** property on the expression is set.
1786 **
1787 ** An error message is left in pParse if anything is amiss.  The number
1788 ** if errors is returned.
1789 */
1790 int sqlite3ResolveExprNames(
1791   NameContext *pNC,       /* Namespace to resolve expressions in. */
1792   Expr *pExpr             /* The expression to be analyzed. */
1793 ){
1794   int savedHasAgg;
1795   Walker w;
1796 
1797   if( pExpr==0 ) return SQLITE_OK;
1798   savedHasAgg = pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
1799   pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
1800   w.pParse = pNC->pParse;
1801   w.xExprCallback = resolveExprStep;
1802   w.xSelectCallback = resolveSelectStep;
1803   w.xSelectCallback2 = 0;
1804   w.u.pNC = pNC;
1805 #if SQLITE_MAX_EXPR_DEPTH>0
1806   w.pParse->nHeight += pExpr->nHeight;
1807   if( sqlite3ExprCheckHeight(w.pParse, w.pParse->nHeight) ){
1808     return SQLITE_ERROR;
1809   }
1810 #endif
1811   sqlite3WalkExpr(&w, pExpr);
1812 #if SQLITE_MAX_EXPR_DEPTH>0
1813   w.pParse->nHeight -= pExpr->nHeight;
1814 #endif
1815   assert( EP_Agg==NC_HasAgg );
1816   assert( EP_Win==NC_HasWin );
1817   testcase( pNC->ncFlags & NC_HasAgg );
1818   testcase( pNC->ncFlags & NC_HasWin );
1819   ExprSetProperty(pExpr, pNC->ncFlags & (NC_HasAgg|NC_HasWin) );
1820   pNC->ncFlags |= savedHasAgg;
1821   return pNC->nErr>0 || w.pParse->nErr>0;
1822 }
1823 
1824 /*
1825 ** Resolve all names for all expression in an expression list.  This is
1826 ** just like sqlite3ResolveExprNames() except that it works for an expression
1827 ** list rather than a single expression.
1828 */
1829 int sqlite3ResolveExprListNames(
1830   NameContext *pNC,       /* Namespace to resolve expressions in. */
1831   ExprList *pList         /* The expression list to be analyzed. */
1832 ){
1833   int i;
1834   int savedHasAgg = 0;
1835   Walker w;
1836   if( pList==0 ) return WRC_Continue;
1837   w.pParse = pNC->pParse;
1838   w.xExprCallback = resolveExprStep;
1839   w.xSelectCallback = resolveSelectStep;
1840   w.xSelectCallback2 = 0;
1841   w.u.pNC = pNC;
1842   savedHasAgg = pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
1843   pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
1844   for(i=0; i<pList->nExpr; i++){
1845     Expr *pExpr = pList->a[i].pExpr;
1846     if( pExpr==0 ) continue;
1847 #if SQLITE_MAX_EXPR_DEPTH>0
1848     w.pParse->nHeight += pExpr->nHeight;
1849     if( sqlite3ExprCheckHeight(w.pParse, w.pParse->nHeight) ){
1850       return WRC_Abort;
1851     }
1852 #endif
1853     sqlite3WalkExpr(&w, pExpr);
1854 #if SQLITE_MAX_EXPR_DEPTH>0
1855     w.pParse->nHeight -= pExpr->nHeight;
1856 #endif
1857     assert( EP_Agg==NC_HasAgg );
1858     assert( EP_Win==NC_HasWin );
1859     testcase( pNC->ncFlags & NC_HasAgg );
1860     testcase( pNC->ncFlags & NC_HasWin );
1861     if( pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin) ){
1862       ExprSetProperty(pExpr, pNC->ncFlags & (NC_HasAgg|NC_HasWin) );
1863       savedHasAgg |= pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
1864       pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
1865     }
1866     if( pNC->nErr>0 || w.pParse->nErr>0 ) return WRC_Abort;
1867   }
1868   pNC->ncFlags |= savedHasAgg;
1869   return WRC_Continue;
1870 }
1871 
1872 /*
1873 ** Resolve all names in all expressions of a SELECT and in all
1874 ** decendents of the SELECT, including compounds off of p->pPrior,
1875 ** subqueries in expressions, and subqueries used as FROM clause
1876 ** terms.
1877 **
1878 ** See sqlite3ResolveExprNames() for a description of the kinds of
1879 ** transformations that occur.
1880 **
1881 ** All SELECT statements should have been expanded using
1882 ** sqlite3SelectExpand() prior to invoking this routine.
1883 */
1884 void sqlite3ResolveSelectNames(
1885   Parse *pParse,         /* The parser context */
1886   Select *p,             /* The SELECT statement being coded. */
1887   NameContext *pOuterNC  /* Name context for parent SELECT statement */
1888 ){
1889   Walker w;
1890 
1891   assert( p!=0 );
1892   w.xExprCallback = resolveExprStep;
1893   w.xSelectCallback = resolveSelectStep;
1894   w.xSelectCallback2 = 0;
1895   w.pParse = pParse;
1896   w.u.pNC = pOuterNC;
1897   sqlite3WalkSelect(&w, p);
1898 }
1899 
1900 /*
1901 ** Resolve names in expressions that can only reference a single table
1902 ** or which cannot reference any tables at all.  Examples:
1903 **
1904 **                                                    "type" flag
1905 **                                                    ------------
1906 **    (1)   CHECK constraints                         NC_IsCheck
1907 **    (2)   WHERE clauses on partial indices          NC_PartIdx
1908 **    (3)   Expressions in indexes on expressions     NC_IdxExpr
1909 **    (4)   Expression arguments to VACUUM INTO.      0
1910 **    (5)   GENERATED ALWAYS as expressions           NC_GenCol
1911 **
1912 ** In all cases except (4), the Expr.iTable value for Expr.op==TK_COLUMN
1913 ** nodes of the expression is set to -1 and the Expr.iColumn value is
1914 ** set to the column number.  In case (4), TK_COLUMN nodes cause an error.
1915 **
1916 ** Any errors cause an error message to be set in pParse.
1917 */
1918 int sqlite3ResolveSelfReference(
1919   Parse *pParse,   /* Parsing context */
1920   Table *pTab,     /* The table being referenced, or NULL */
1921   int type,        /* NC_IsCheck, NC_PartIdx, NC_IdxExpr, NC_GenCol, or 0 */
1922   Expr *pExpr,     /* Expression to resolve.  May be NULL. */
1923   ExprList *pList  /* Expression list to resolve.  May be NULL. */
1924 ){
1925   SrcList sSrc;                   /* Fake SrcList for pParse->pNewTable */
1926   NameContext sNC;                /* Name context for pParse->pNewTable */
1927   int rc;
1928 
1929   assert( type==0 || pTab!=0 );
1930   assert( type==NC_IsCheck || type==NC_PartIdx || type==NC_IdxExpr
1931           || type==NC_GenCol || pTab==0 );
1932   memset(&sNC, 0, sizeof(sNC));
1933   memset(&sSrc, 0, sizeof(sSrc));
1934   if( pTab ){
1935     sSrc.nSrc = 1;
1936     sSrc.a[0].zName = pTab->zName;
1937     sSrc.a[0].pTab = pTab;
1938     sSrc.a[0].iCursor = -1;
1939     if( pTab->pSchema!=pParse->db->aDb[1].pSchema ){
1940       /* Cause EP_FromDDL to be set on TK_FUNCTION nodes of non-TEMP
1941       ** schema elements */
1942       type |= NC_FromDDL;
1943     }
1944   }
1945   sNC.pParse = pParse;
1946   sNC.pSrcList = &sSrc;
1947   sNC.ncFlags = type | NC_IsDDL;
1948   if( (rc = sqlite3ResolveExprNames(&sNC, pExpr))!=SQLITE_OK ) return rc;
1949   if( pList ) rc = sqlite3ResolveExprListNames(&sNC, pList);
1950   return rc;
1951 }
1952