xref: /sqlite-3.40.0/src/resolve.c (revision de7a820f)
1 /*
2 ** 2008 August 18
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 **
13 ** This file contains routines used for walking the parser tree and
14 ** resolve all identifiers by associating them with a particular
15 ** table and column.
16 */
17 #include "sqliteInt.h"
18 
19 /*
20 ** Magic table number to mean the EXCLUDED table in an UPSERT statement.
21 */
22 #define EXCLUDED_TABLE_NUMBER  2
23 
24 /*
25 ** Walk the expression tree pExpr and increase the aggregate function
26 ** depth (the Expr.op2 field) by N on every TK_AGG_FUNCTION node.
27 ** This needs to occur when copying a TK_AGG_FUNCTION node from an
28 ** outer query into an inner subquery.
29 **
30 ** incrAggFunctionDepth(pExpr,n) is the main routine.  incrAggDepth(..)
31 ** is a helper function - a callback for the tree walker.
32 **
33 ** See also the sqlite3WindowExtraAggFuncDepth() routine in window.c
34 */
35 static int incrAggDepth(Walker *pWalker, Expr *pExpr){
36   if( pExpr->op==TK_AGG_FUNCTION ) pExpr->op2 += pWalker->u.n;
37   return WRC_Continue;
38 }
39 static void incrAggFunctionDepth(Expr *pExpr, int N){
40   if( N>0 ){
41     Walker w;
42     memset(&w, 0, sizeof(w));
43     w.xExprCallback = incrAggDepth;
44     w.u.n = N;
45     sqlite3WalkExpr(&w, pExpr);
46   }
47 }
48 
49 /*
50 ** Turn the pExpr expression into an alias for the iCol-th column of the
51 ** result set in pEList.
52 **
53 ** If the reference is followed by a COLLATE operator, then make sure
54 ** the COLLATE operator is preserved.  For example:
55 **
56 **     SELECT a+b, c+d FROM t1 ORDER BY 1 COLLATE nocase;
57 **
58 ** Should be transformed into:
59 **
60 **     SELECT a+b, c+d FROM t1 ORDER BY (a+b) COLLATE nocase;
61 **
62 ** The nSubquery parameter specifies how many levels of subquery the
63 ** alias is removed from the original expression.  The usual value is
64 ** zero but it might be more if the alias is contained within a subquery
65 ** of the original expression.  The Expr.op2 field of TK_AGG_FUNCTION
66 ** structures must be increased by the nSubquery amount.
67 */
68 static void resolveAlias(
69   Parse *pParse,         /* Parsing context */
70   ExprList *pEList,      /* A result set */
71   int iCol,              /* A column in the result set.  0..pEList->nExpr-1 */
72   Expr *pExpr,           /* Transform this into an alias to the result set */
73   int nSubquery          /* Number of subqueries that the label is moving */
74 ){
75   Expr *pOrig;           /* The iCol-th column of the result set */
76   Expr *pDup;            /* Copy of pOrig */
77   sqlite3 *db;           /* The database connection */
78 
79   assert( iCol>=0 && iCol<pEList->nExpr );
80   pOrig = pEList->a[iCol].pExpr;
81   assert( pOrig!=0 );
82   db = pParse->db;
83   pDup = sqlite3ExprDup(db, pOrig, 0);
84   if( db->mallocFailed ){
85     sqlite3ExprDelete(db, pDup);
86     pDup = 0;
87   }else{
88     incrAggFunctionDepth(pDup, nSubquery);
89     if( pExpr->op==TK_COLLATE ){
90       assert( !ExprHasProperty(pExpr, EP_IntValue) );
91       pDup = sqlite3ExprAddCollateString(pParse, pDup, pExpr->u.zToken);
92     }
93 
94     /* Before calling sqlite3ExprDelete(), set the EP_Static flag. This
95     ** prevents ExprDelete() from deleting the Expr structure itself,
96     ** allowing it to be repopulated by the memcpy() on the following line.
97     ** The pExpr->u.zToken might point into memory that will be freed by the
98     ** sqlite3DbFree(db, pDup) on the last line of this block, so be sure to
99     ** make a copy of the token before doing the sqlite3DbFree().
100     */
101     ExprSetProperty(pExpr, EP_Static);
102     sqlite3ExprDelete(db, pExpr);
103     memcpy(pExpr, pDup, sizeof(*pExpr));
104     if( !ExprHasProperty(pExpr, EP_IntValue) && pExpr->u.zToken!=0 ){
105       assert( (pExpr->flags & (EP_Reduced|EP_TokenOnly))==0 );
106       pExpr->u.zToken = sqlite3DbStrDup(db, pExpr->u.zToken);
107       pExpr->flags |= EP_MemToken;
108     }
109     if( ExprHasProperty(pExpr, EP_WinFunc) ){
110       if( ALWAYS(pExpr->y.pWin!=0) ){
111         pExpr->y.pWin->pOwner = pExpr;
112       }
113     }
114     sqlite3DbFree(db, pDup);
115   }
116 }
117 
118 /*
119 ** Subqueries stores the original database, table and column names for their
120 ** result sets in ExprList.a[].zSpan, in the form "DATABASE.TABLE.COLUMN".
121 ** Check to see if the zSpan given to this routine matches the zDb, zTab,
122 ** and zCol.  If any of zDb, zTab, and zCol are NULL then those fields will
123 ** match anything.
124 */
125 int sqlite3MatchEName(
126   const struct ExprList_item *pItem,
127   const char *zCol,
128   const char *zTab,
129   const char *zDb
130 ){
131   int n;
132   const char *zSpan;
133   if( pItem->eEName!=ENAME_TAB ) return 0;
134   zSpan = pItem->zEName;
135   for(n=0; ALWAYS(zSpan[n]) && zSpan[n]!='.'; n++){}
136   if( zDb && (sqlite3StrNICmp(zSpan, zDb, n)!=0 || zDb[n]!=0) ){
137     return 0;
138   }
139   zSpan += n+1;
140   for(n=0; ALWAYS(zSpan[n]) && zSpan[n]!='.'; n++){}
141   if( zTab && (sqlite3StrNICmp(zSpan, zTab, n)!=0 || zTab[n]!=0) ){
142     return 0;
143   }
144   zSpan += n+1;
145   if( zCol && sqlite3StrICmp(zSpan, zCol)!=0 ){
146     return 0;
147   }
148   return 1;
149 }
150 
151 /*
152 ** Return TRUE if the double-quoted string  mis-feature should be supported.
153 */
154 static int areDoubleQuotedStringsEnabled(sqlite3 *db, NameContext *pTopNC){
155   if( db->init.busy ) return 1;  /* Always support for legacy schemas */
156   if( pTopNC->ncFlags & NC_IsDDL ){
157     /* Currently parsing a DDL statement */
158     if( sqlite3WritableSchema(db) && (db->flags & SQLITE_DqsDML)!=0 ){
159       return 1;
160     }
161     return (db->flags & SQLITE_DqsDDL)!=0;
162   }else{
163     /* Currently parsing a DML statement */
164     return (db->flags & SQLITE_DqsDML)!=0;
165   }
166 }
167 
168 /*
169 ** The argument is guaranteed to be a non-NULL Expr node of type TK_COLUMN.
170 ** return the appropriate colUsed mask.
171 */
172 Bitmask sqlite3ExprColUsed(Expr *pExpr){
173   int n;
174   Table *pExTab;
175 
176   n = pExpr->iColumn;
177   assert( ExprUseYTab(pExpr) );
178   pExTab = pExpr->y.pTab;
179   assert( pExTab!=0 );
180   if( (pExTab->tabFlags & TF_HasGenerated)!=0
181    && (pExTab->aCol[n].colFlags & COLFLAG_GENERATED)!=0
182   ){
183     testcase( pExTab->nCol==BMS-1 );
184     testcase( pExTab->nCol==BMS );
185     return pExTab->nCol>=BMS ? ALLBITS : MASKBIT(pExTab->nCol)-1;
186   }else{
187     testcase( n==BMS-1 );
188     testcase( n==BMS );
189     if( n>=BMS ) n = BMS-1;
190     return ((Bitmask)1)<<n;
191   }
192 }
193 
194 /*
195 ** Create a new expression term for the column specified by pMatch and
196 ** iColumn.  Append this new expression term to the FULL JOIN Match set
197 ** in *ppList.  Create a new *ppList if this is the first term in the
198 ** set.
199 */
200 static void extendFJMatch(
201   Parse *pParse,          /* Parsing context */
202   ExprList **ppList,      /* ExprList to extend */
203   SrcItem *pMatch,        /* Source table containing the column */
204   i16 iColumn             /* The column number */
205 ){
206   Expr *pNew = sqlite3ExprAlloc(pParse->db, TK_COLUMN, 0, 0);
207   if( pNew ){
208     pNew->iTable = pMatch->iCursor;
209     pNew->iColumn = iColumn;
210     pNew->y.pTab = pMatch->pTab;
211     assert( (pMatch->fg.jointype & (JT_LEFT|JT_LTORJ))!=0 );
212     ExprSetProperty(pNew, EP_CanBeNull);
213     *ppList = sqlite3ExprListAppend(pParse, *ppList, pNew);
214   }
215 }
216 
217 /*
218 ** Given the name of a column of the form X.Y.Z or Y.Z or just Z, look up
219 ** that name in the set of source tables in pSrcList and make the pExpr
220 ** expression node refer back to that source column.  The following changes
221 ** are made to pExpr:
222 **
223 **    pExpr->iDb           Set the index in db->aDb[] of the database X
224 **                         (even if X is implied).
225 **    pExpr->iTable        Set to the cursor number for the table obtained
226 **                         from pSrcList.
227 **    pExpr->y.pTab        Points to the Table structure of X.Y (even if
228 **                         X and/or Y are implied.)
229 **    pExpr->iColumn       Set to the column number within the table.
230 **    pExpr->op            Set to TK_COLUMN.
231 **    pExpr->pLeft         Any expression this points to is deleted
232 **    pExpr->pRight        Any expression this points to is deleted.
233 **
234 ** The zDb variable is the name of the database (the "X").  This value may be
235 ** NULL meaning that name is of the form Y.Z or Z.  Any available database
236 ** can be used.  The zTable variable is the name of the table (the "Y").  This
237 ** value can be NULL if zDb is also NULL.  If zTable is NULL it
238 ** means that the form of the name is Z and that columns from any table
239 ** can be used.
240 **
241 ** If the name cannot be resolved unambiguously, leave an error message
242 ** in pParse and return WRC_Abort.  Return WRC_Prune on success.
243 */
244 static int lookupName(
245   Parse *pParse,       /* The parsing context */
246   const char *zDb,     /* Name of the database containing table, or NULL */
247   const char *zTab,    /* Name of table containing column, or NULL */
248   const char *zCol,    /* Name of the column. */
249   NameContext *pNC,    /* The name context used to resolve the name */
250   Expr *pExpr          /* Make this EXPR node point to the selected column */
251 ){
252   int i, j;                         /* Loop counters */
253   int cnt = 0;                      /* Number of matching column names */
254   int cntTab = 0;                   /* Number of matching table names */
255   int nSubquery = 0;                /* How many levels of subquery */
256   sqlite3 *db = pParse->db;         /* The database connection */
257   SrcItem *pItem;                   /* Use for looping over pSrcList items */
258   SrcItem *pMatch = 0;              /* The matching pSrcList item */
259   NameContext *pTopNC = pNC;        /* First namecontext in the list */
260   Schema *pSchema = 0;              /* Schema of the expression */
261   int eNewExprOp = TK_COLUMN;       /* New value for pExpr->op on success */
262   Table *pTab = 0;                  /* Table holding the row */
263   Column *pCol;                     /* A column of pTab */
264   ExprList *pFJMatch = 0;           /* Matches for FULL JOIN .. USING */
265 
266   assert( pNC );     /* the name context cannot be NULL. */
267   assert( zCol );    /* The Z in X.Y.Z cannot be NULL */
268   assert( zDb==0 || zTab!=0 );
269   assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
270 
271   /* Initialize the node to no-match */
272   pExpr->iTable = -1;
273   ExprSetVVAProperty(pExpr, EP_NoReduce);
274 
275   /* Translate the schema name in zDb into a pointer to the corresponding
276   ** schema.  If not found, pSchema will remain NULL and nothing will match
277   ** resulting in an appropriate error message toward the end of this routine
278   */
279   if( zDb ){
280     testcase( pNC->ncFlags & NC_PartIdx );
281     testcase( pNC->ncFlags & NC_IsCheck );
282     if( (pNC->ncFlags & (NC_PartIdx|NC_IsCheck))!=0 ){
283       /* Silently ignore database qualifiers inside CHECK constraints and
284       ** partial indices.  Do not raise errors because that might break
285       ** legacy and because it does not hurt anything to just ignore the
286       ** database name. */
287       zDb = 0;
288     }else{
289       for(i=0; i<db->nDb; i++){
290         assert( db->aDb[i].zDbSName );
291         if( sqlite3StrICmp(db->aDb[i].zDbSName,zDb)==0 ){
292           pSchema = db->aDb[i].pSchema;
293           break;
294         }
295       }
296       if( i==db->nDb && sqlite3StrICmp("main", zDb)==0 ){
297         /* This branch is taken when the main database has been renamed
298         ** using SQLITE_DBCONFIG_MAINDBNAME. */
299         pSchema = db->aDb[0].pSchema;
300         zDb = db->aDb[0].zDbSName;
301       }
302     }
303   }
304 
305   /* Start at the inner-most context and move outward until a match is found */
306   assert( pNC && cnt==0 );
307   do{
308     ExprList *pEList;
309     SrcList *pSrcList = pNC->pSrcList;
310 
311     if( pSrcList ){
312       for(i=0, pItem=pSrcList->a; i<pSrcList->nSrc; i++, pItem++){
313         u8 hCol;
314         pTab = pItem->pTab;
315         assert( pTab!=0 && pTab->zName!=0 );
316         assert( pTab->nCol>0 || pParse->nErr );
317         assert( pItem->fg.isNestedFrom == IsNestedFrom(pItem->pSelect) );
318         if( pItem->fg.isNestedFrom ){
319           /* In this case, pItem is a subquery that has been formed from a
320           ** parenthesized subset of the FROM clause terms.  Example:
321           **   .... FROM t1 LEFT JOIN (t2 RIGHT JOIN t3 USING(x)) USING(y) ...
322           **                          \_________________________/
323           **             This pItem -------------^
324           */
325           int hit = 0;
326           assert( pItem->pSelect!=0 );
327           pEList = pItem->pSelect->pEList;
328           assert( pEList!=0 );
329           assert( pEList->nExpr==pTab->nCol );
330           for(j=0; j<pEList->nExpr; j++){
331             if( !sqlite3MatchEName(&pEList->a[j], zCol, zTab, zDb) ){
332               continue;
333             }
334             if( cnt>0 ){
335               if( pItem->fg.isUsing==0
336                || sqlite3IdListIndex(pItem->u3.pUsing, zCol)<0
337               ){
338                 /* Two or more tables have the same column name which is
339                 ** not joined by USING.  This is an error.  Signal as much
340                 ** by clearing pFJMatch and letting cnt go above 1. */
341                 sqlite3ExprListDelete(db, pFJMatch);
342                 pFJMatch = 0;
343               }else
344               if( (pItem->fg.jointype & JT_RIGHT)==0 ){
345                 /* An INNER or LEFT JOIN.  Use the left-most table */
346                 continue;
347               }else
348               if( (pItem->fg.jointype & JT_LEFT)==0 ){
349                 /* A RIGHT JOIN.  Use the right-most table */
350                 cnt = 0;
351                 sqlite3ExprListDelete(db, pFJMatch);
352                 pFJMatch = 0;
353               }else{
354                 /* For a FULL JOIN, we must construct a coalesce() func */
355                 extendFJMatch(pParse, &pFJMatch, pMatch, pExpr->iColumn);
356               }
357             }
358             cnt++;
359             cntTab = 2;
360             pMatch = pItem;
361             pExpr->iColumn = j;
362             pEList->a[j].bUsed = 1;
363             hit = 1;
364           }
365           if( hit || zTab==0 ) continue;
366         }
367         assert( zDb==0 || zTab!=0 );
368         if( zTab ){
369           const char *zTabName;
370           if( zDb ){
371             if( pTab->pSchema!=pSchema ) continue;
372             if( pSchema==0 && strcmp(zDb,"*")!=0 ) continue;
373           }
374           zTabName = pItem->zAlias ? pItem->zAlias : pTab->zName;
375           assert( zTabName!=0 );
376           if( sqlite3StrICmp(zTabName, zTab)!=0 ){
377             continue;
378           }
379           assert( ExprUseYTab(pExpr) );
380           if( IN_RENAME_OBJECT && pItem->zAlias ){
381             sqlite3RenameTokenRemap(pParse, 0, (void*)&pExpr->y.pTab);
382           }
383         }
384         hCol = sqlite3StrIHash(zCol);
385         for(j=0, pCol=pTab->aCol; j<pTab->nCol; j++, pCol++){
386           if( pCol->hName==hCol
387            && sqlite3StrICmp(pCol->zCnName, zCol)==0
388           ){
389             if( cnt>0 ){
390               if( pItem->fg.isUsing==0
391                || sqlite3IdListIndex(pItem->u3.pUsing, zCol)<0
392               ){
393                 /* Two or more tables have the same column name which is
394                 ** not joined by USING.  This is an error.  Signal as much
395                 ** by clearing pFJMatch and letting cnt go above 1. */
396                 sqlite3ExprListDelete(db, pFJMatch);
397                 pFJMatch = 0;
398               }else
399               if( (pItem->fg.jointype & JT_RIGHT)==0 ){
400                 /* An INNER or LEFT JOIN.  Use the left-most table */
401                 continue;
402               }else
403               if( (pItem->fg.jointype & JT_LEFT)==0 ){
404                 /* A RIGHT JOIN.  Use the right-most table */
405                 cnt = 0;
406                 sqlite3ExprListDelete(db, pFJMatch);
407                 pFJMatch = 0;
408               }else{
409                 /* For a FULL JOIN, we must construct a coalesce() func */
410                 extendFJMatch(pParse, &pFJMatch, pMatch, pExpr->iColumn);
411               }
412             }
413             cnt++;
414             pMatch = pItem;
415             /* Substitute the rowid (column -1) for the INTEGER PRIMARY KEY */
416             pExpr->iColumn = j==pTab->iPKey ? -1 : (i16)j;
417             if( pItem->fg.isNestedFrom ){
418               sqlite3SrcItemColumnUsed(pItem, j);
419             }
420             break;
421           }
422         }
423         if( 0==cnt && VisibleRowid(pTab) ){
424           cntTab++;
425           pMatch = pItem;
426         }
427       }
428       if( pMatch ){
429         pExpr->iTable = pMatch->iCursor;
430         assert( ExprUseYTab(pExpr) );
431         pExpr->y.pTab = pMatch->pTab;
432         if( (pMatch->fg.jointype & (JT_LEFT|JT_LTORJ))!=0 ){
433           ExprSetProperty(pExpr, EP_CanBeNull);
434         }
435         pSchema = pExpr->y.pTab->pSchema;
436       }
437     } /* if( pSrcList ) */
438 
439 #if !defined(SQLITE_OMIT_TRIGGER) || !defined(SQLITE_OMIT_UPSERT)
440     /* If we have not already resolved the name, then maybe
441     ** it is a new.* or old.* trigger argument reference.  Or
442     ** maybe it is an excluded.* from an upsert.  Or maybe it is
443     ** a reference in the RETURNING clause to a table being modified.
444     */
445     if( cnt==0 && zDb==0 ){
446       pTab = 0;
447 #ifndef SQLITE_OMIT_TRIGGER
448       if( pParse->pTriggerTab!=0 ){
449         int op = pParse->eTriggerOp;
450         assert( op==TK_DELETE || op==TK_UPDATE || op==TK_INSERT );
451         if( pParse->bReturning ){
452           if( (pNC->ncFlags & NC_UBaseReg)!=0
453            && (zTab==0 || sqlite3StrICmp(zTab,pParse->pTriggerTab->zName)==0)
454           ){
455             pExpr->iTable = op!=TK_DELETE;
456             pTab = pParse->pTriggerTab;
457           }
458         }else if( op!=TK_DELETE && zTab && sqlite3StrICmp("new",zTab) == 0 ){
459           pExpr->iTable = 1;
460           pTab = pParse->pTriggerTab;
461         }else if( op!=TK_INSERT && zTab && sqlite3StrICmp("old",zTab)==0 ){
462           pExpr->iTable = 0;
463           pTab = pParse->pTriggerTab;
464         }
465       }
466 #endif /* SQLITE_OMIT_TRIGGER */
467 #ifndef SQLITE_OMIT_UPSERT
468       if( (pNC->ncFlags & NC_UUpsert)!=0 && zTab!=0 ){
469         Upsert *pUpsert = pNC->uNC.pUpsert;
470         if( pUpsert && sqlite3StrICmp("excluded",zTab)==0 ){
471           pTab = pUpsert->pUpsertSrc->a[0].pTab;
472           pExpr->iTable = EXCLUDED_TABLE_NUMBER;
473         }
474       }
475 #endif /* SQLITE_OMIT_UPSERT */
476 
477       if( pTab ){
478         int iCol;
479         u8 hCol = sqlite3StrIHash(zCol);
480         pSchema = pTab->pSchema;
481         cntTab++;
482         for(iCol=0, pCol=pTab->aCol; iCol<pTab->nCol; iCol++, pCol++){
483           if( pCol->hName==hCol
484            && sqlite3StrICmp(pCol->zCnName, zCol)==0
485           ){
486             if( iCol==pTab->iPKey ){
487               iCol = -1;
488             }
489             break;
490           }
491         }
492         if( iCol>=pTab->nCol && sqlite3IsRowid(zCol) && VisibleRowid(pTab) ){
493           /* IMP: R-51414-32910 */
494           iCol = -1;
495         }
496         if( iCol<pTab->nCol ){
497           cnt++;
498           pMatch = 0;
499 #ifndef SQLITE_OMIT_UPSERT
500           if( pExpr->iTable==EXCLUDED_TABLE_NUMBER ){
501             testcase( iCol==(-1) );
502             assert( ExprUseYTab(pExpr) );
503             if( IN_RENAME_OBJECT ){
504               pExpr->iColumn = iCol;
505               pExpr->y.pTab = pTab;
506               eNewExprOp = TK_COLUMN;
507             }else{
508               pExpr->iTable = pNC->uNC.pUpsert->regData +
509                  sqlite3TableColumnToStorage(pTab, iCol);
510               eNewExprOp = TK_REGISTER;
511             }
512           }else
513 #endif /* SQLITE_OMIT_UPSERT */
514           {
515             assert( ExprUseYTab(pExpr) );
516             pExpr->y.pTab = pTab;
517             if( pParse->bReturning ){
518               eNewExprOp = TK_REGISTER;
519               pExpr->op2 = TK_COLUMN;
520               pExpr->iTable = pNC->uNC.iBaseReg + (pTab->nCol+1)*pExpr->iTable +
521                  sqlite3TableColumnToStorage(pTab, iCol) + 1;
522             }else{
523               pExpr->iColumn = (i16)iCol;
524               eNewExprOp = TK_TRIGGER;
525 #ifndef SQLITE_OMIT_TRIGGER
526               if( iCol<0 ){
527                 pExpr->affExpr = SQLITE_AFF_INTEGER;
528               }else if( pExpr->iTable==0 ){
529                 testcase( iCol==31 );
530                 testcase( iCol==32 );
531                 pParse->oldmask |= (iCol>=32 ? 0xffffffff : (((u32)1)<<iCol));
532               }else{
533                 testcase( iCol==31 );
534                 testcase( iCol==32 );
535                 pParse->newmask |= (iCol>=32 ? 0xffffffff : (((u32)1)<<iCol));
536               }
537 #endif /* SQLITE_OMIT_TRIGGER */
538             }
539           }
540         }
541       }
542     }
543 #endif /* !defined(SQLITE_OMIT_TRIGGER) || !defined(SQLITE_OMIT_UPSERT) */
544 
545     /*
546     ** Perhaps the name is a reference to the ROWID
547     */
548     if( cnt==0
549      && cntTab==1
550      && pMatch
551      && (pNC->ncFlags & (NC_IdxExpr|NC_GenCol))==0
552      && sqlite3IsRowid(zCol)
553      && ALWAYS(VisibleRowid(pMatch->pTab))
554     ){
555       cnt = 1;
556       pExpr->iColumn = -1;
557       pExpr->affExpr = SQLITE_AFF_INTEGER;
558     }
559 
560     /*
561     ** If the input is of the form Z (not Y.Z or X.Y.Z) then the name Z
562     ** might refer to an result-set alias.  This happens, for example, when
563     ** we are resolving names in the WHERE clause of the following command:
564     **
565     **     SELECT a+b AS x FROM table WHERE x<10;
566     **
567     ** In cases like this, replace pExpr with a copy of the expression that
568     ** forms the result set entry ("a+b" in the example) and return immediately.
569     ** Note that the expression in the result set should have already been
570     ** resolved by the time the WHERE clause is resolved.
571     **
572     ** The ability to use an output result-set column in the WHERE, GROUP BY,
573     ** or HAVING clauses, or as part of a larger expression in the ORDER BY
574     ** clause is not standard SQL.  This is a (goofy) SQLite extension, that
575     ** is supported for backwards compatibility only. Hence, we issue a warning
576     ** on sqlite3_log() whenever the capability is used.
577     */
578     if( cnt==0
579      && (pNC->ncFlags & NC_UEList)!=0
580      && zTab==0
581     ){
582       pEList = pNC->uNC.pEList;
583       assert( pEList!=0 );
584       for(j=0; j<pEList->nExpr; j++){
585         char *zAs = pEList->a[j].zEName;
586         if( pEList->a[j].eEName==ENAME_NAME
587          && sqlite3_stricmp(zAs, zCol)==0
588         ){
589           Expr *pOrig;
590           assert( pExpr->pLeft==0 && pExpr->pRight==0 );
591           assert( ExprUseXList(pExpr)==0 || pExpr->x.pList==0 );
592           assert( ExprUseXSelect(pExpr)==0 || pExpr->x.pSelect==0 );
593           pOrig = pEList->a[j].pExpr;
594           if( (pNC->ncFlags&NC_AllowAgg)==0 && ExprHasProperty(pOrig, EP_Agg) ){
595             sqlite3ErrorMsg(pParse, "misuse of aliased aggregate %s", zAs);
596             return WRC_Abort;
597           }
598           if( ExprHasProperty(pOrig, EP_Win)
599            && ((pNC->ncFlags&NC_AllowWin)==0 || pNC!=pTopNC )
600           ){
601             sqlite3ErrorMsg(pParse, "misuse of aliased window function %s",zAs);
602             return WRC_Abort;
603           }
604           if( sqlite3ExprVectorSize(pOrig)!=1 ){
605             sqlite3ErrorMsg(pParse, "row value misused");
606             return WRC_Abort;
607           }
608           resolveAlias(pParse, pEList, j, pExpr, nSubquery);
609           cnt = 1;
610           pMatch = 0;
611           assert( zTab==0 && zDb==0 );
612           if( IN_RENAME_OBJECT ){
613             sqlite3RenameTokenRemap(pParse, 0, (void*)pExpr);
614           }
615           goto lookupname_end;
616         }
617       }
618     }
619 
620     /* Advance to the next name context.  The loop will exit when either
621     ** we have a match (cnt>0) or when we run out of name contexts.
622     */
623     if( cnt ) break;
624     pNC = pNC->pNext;
625     nSubquery++;
626   }while( pNC );
627 
628 
629   /*
630   ** If X and Y are NULL (in other words if only the column name Z is
631   ** supplied) and the value of Z is enclosed in double-quotes, then
632   ** Z is a string literal if it doesn't match any column names.  In that
633   ** case, we need to return right away and not make any changes to
634   ** pExpr.
635   **
636   ** Because no reference was made to outer contexts, the pNC->nRef
637   ** fields are not changed in any context.
638   */
639   if( cnt==0 && zTab==0 ){
640     assert( pExpr->op==TK_ID );
641     if( ExprHasProperty(pExpr,EP_DblQuoted)
642      && areDoubleQuotedStringsEnabled(db, pTopNC)
643     ){
644       /* If a double-quoted identifier does not match any known column name,
645       ** then treat it as a string.
646       **
647       ** This hack was added in the early days of SQLite in a misguided attempt
648       ** to be compatible with MySQL 3.x, which used double-quotes for strings.
649       ** I now sorely regret putting in this hack. The effect of this hack is
650       ** that misspelled identifier names are silently converted into strings
651       ** rather than causing an error, to the frustration of countless
652       ** programmers. To all those frustrated programmers, my apologies.
653       **
654       ** Someday, I hope to get rid of this hack. Unfortunately there is
655       ** a huge amount of legacy SQL that uses it. So for now, we just
656       ** issue a warning.
657       */
658       sqlite3_log(SQLITE_WARNING,
659         "double-quoted string literal: \"%w\"", zCol);
660 #ifdef SQLITE_ENABLE_NORMALIZE
661       sqlite3VdbeAddDblquoteStr(db, pParse->pVdbe, zCol);
662 #endif
663       pExpr->op = TK_STRING;
664       memset(&pExpr->y, 0, sizeof(pExpr->y));
665       return WRC_Prune;
666     }
667     if( sqlite3ExprIdToTrueFalse(pExpr) ){
668       return WRC_Prune;
669     }
670   }
671 
672   /*
673   ** cnt==0 means there was not match.
674   ** cnt>1 means there were two or more matches.
675   **
676   ** cnt==0 is always an error.  cnt>1 is often an error, but might
677   ** be multiple matches for a NATURAL LEFT JOIN or a LEFT JOIN USING.
678   */
679   assert( pFJMatch==0 || cnt>0 );
680   assert( !ExprHasProperty(pExpr, EP_xIsSelect|EP_IntValue) );
681   if( cnt!=1 ){
682     const char *zErr;
683     if( pFJMatch ){
684       if( pFJMatch->nExpr==cnt-1 ){
685         if( ExprHasProperty(pExpr,EP_Leaf) ){
686           ExprClearProperty(pExpr,EP_Leaf);
687         }else{
688           sqlite3ExprDelete(db, pExpr->pLeft);
689           pExpr->pLeft = 0;
690           sqlite3ExprDelete(db, pExpr->pRight);
691           pExpr->pRight = 0;
692         }
693         extendFJMatch(pParse, &pFJMatch, pMatch, pExpr->iColumn);
694         pExpr->op = TK_FUNCTION;
695         pExpr->u.zToken = "coalesce";
696         pExpr->x.pList = pFJMatch;
697         cnt = 1;
698         goto lookupname_end;
699       }else{
700         sqlite3ExprListDelete(db, pFJMatch);
701         pFJMatch = 0;
702       }
703     }
704     zErr = cnt==0 ? "no such column" : "ambiguous column name";
705     if( zDb ){
706       sqlite3ErrorMsg(pParse, "%s: %s.%s.%s", zErr, zDb, zTab, zCol);
707     }else if( zTab ){
708       sqlite3ErrorMsg(pParse, "%s: %s.%s", zErr, zTab, zCol);
709     }else{
710       sqlite3ErrorMsg(pParse, "%s: %s", zErr, zCol);
711     }
712     sqlite3RecordErrorOffsetOfExpr(pParse->db, pExpr);
713     pParse->checkSchema = 1;
714     pTopNC->nNcErr++;
715   }
716   assert( pFJMatch==0 );
717 
718   /* Remove all substructure from pExpr */
719   if( !ExprHasProperty(pExpr,(EP_TokenOnly|EP_Leaf)) ){
720     sqlite3ExprDelete(db, pExpr->pLeft);
721     pExpr->pLeft = 0;
722     sqlite3ExprDelete(db, pExpr->pRight);
723     pExpr->pRight = 0;
724     ExprSetProperty(pExpr, EP_Leaf);
725   }
726 
727   /* If a column from a table in pSrcList is referenced, then record
728   ** this fact in the pSrcList.a[].colUsed bitmask.  Column 0 causes
729   ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.  Bit 63 is
730   ** set if the 63rd or any subsequent column is used.
731   **
732   ** The colUsed mask is an optimization used to help determine if an
733   ** index is a covering index.  The correct answer is still obtained
734   ** if the mask contains extra set bits.  However, it is important to
735   ** avoid setting bits beyond the maximum column number of the table.
736   ** (See ticket [b92e5e8ec2cdbaa1]).
737   **
738   ** If a generated column is referenced, set bits for every column
739   ** of the table.
740   */
741   if( pExpr->iColumn>=0 && pMatch!=0 ){
742     pMatch->colUsed |= sqlite3ExprColUsed(pExpr);
743   }
744 
745   pExpr->op = eNewExprOp;
746 lookupname_end:
747   if( cnt==1 ){
748     assert( pNC!=0 );
749 #ifndef SQLITE_OMIT_AUTHORIZATION
750     if( pParse->db->xAuth
751      && (pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER)
752     ){
753       sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList);
754     }
755 #endif
756     /* Increment the nRef value on all name contexts from TopNC up to
757     ** the point where the name matched. */
758     for(;;){
759       assert( pTopNC!=0 );
760       pTopNC->nRef++;
761       if( pTopNC==pNC ) break;
762       pTopNC = pTopNC->pNext;
763     }
764     return WRC_Prune;
765   } else {
766     return WRC_Abort;
767   }
768 }
769 
770 /*
771 ** Allocate and return a pointer to an expression to load the column iCol
772 ** from datasource iSrc in SrcList pSrc.
773 */
774 Expr *sqlite3CreateColumnExpr(sqlite3 *db, SrcList *pSrc, int iSrc, int iCol){
775   Expr *p = sqlite3ExprAlloc(db, TK_COLUMN, 0, 0);
776   if( p ){
777     SrcItem *pItem = &pSrc->a[iSrc];
778     Table *pTab;
779     assert( ExprUseYTab(p) );
780     pTab = p->y.pTab = pItem->pTab;
781     p->iTable = pItem->iCursor;
782     if( p->y.pTab->iPKey==iCol ){
783       p->iColumn = -1;
784     }else{
785       p->iColumn = (ynVar)iCol;
786       if( (pTab->tabFlags & TF_HasGenerated)!=0
787        && (pTab->aCol[iCol].colFlags & COLFLAG_GENERATED)!=0
788       ){
789         testcase( pTab->nCol==63 );
790         testcase( pTab->nCol==64 );
791         pItem->colUsed = pTab->nCol>=64 ? ALLBITS : MASKBIT(pTab->nCol)-1;
792       }else{
793         testcase( iCol==BMS );
794         testcase( iCol==BMS-1 );
795         pItem->colUsed |= ((Bitmask)1)<<(iCol>=BMS ? BMS-1 : iCol);
796       }
797     }
798   }
799   return p;
800 }
801 
802 /*
803 ** Report an error that an expression is not valid for some set of
804 ** pNC->ncFlags values determined by validMask.
805 **
806 ** static void notValid(
807 **   Parse *pParse,       // Leave error message here
808 **   NameContext *pNC,    // The name context
809 **   const char *zMsg,    // Type of error
810 **   int validMask,       // Set of contexts for which prohibited
811 **   Expr *pExpr          // Invalidate this expression on error
812 ** ){...}
813 **
814 ** As an optimization, since the conditional is almost always false
815 ** (because errors are rare), the conditional is moved outside of the
816 ** function call using a macro.
817 */
818 static void notValidImpl(
819    Parse *pParse,       /* Leave error message here */
820    NameContext *pNC,    /* The name context */
821    const char *zMsg,    /* Type of error */
822    Expr *pExpr,         /* Invalidate this expression on error */
823    Expr *pError         /* Associate error with this expression */
824 ){
825   const char *zIn = "partial index WHERE clauses";
826   if( pNC->ncFlags & NC_IdxExpr )      zIn = "index expressions";
827 #ifndef SQLITE_OMIT_CHECK
828   else if( pNC->ncFlags & NC_IsCheck ) zIn = "CHECK constraints";
829 #endif
830 #ifndef SQLITE_OMIT_GENERATED_COLUMNS
831   else if( pNC->ncFlags & NC_GenCol ) zIn = "generated columns";
832 #endif
833   sqlite3ErrorMsg(pParse, "%s prohibited in %s", zMsg, zIn);
834   if( pExpr ) pExpr->op = TK_NULL;
835   sqlite3RecordErrorOffsetOfExpr(pParse->db, pError);
836 }
837 #define sqlite3ResolveNotValid(P,N,M,X,E,R) \
838   assert( ((X)&~(NC_IsCheck|NC_PartIdx|NC_IdxExpr|NC_GenCol))==0 ); \
839   if( ((N)->ncFlags & (X))!=0 ) notValidImpl(P,N,M,E,R);
840 
841 /*
842 ** Expression p should encode a floating point value between 1.0 and 0.0.
843 ** Return 1024 times this value.  Or return -1 if p is not a floating point
844 ** value between 1.0 and 0.0.
845 */
846 static int exprProbability(Expr *p){
847   double r = -1.0;
848   if( p->op!=TK_FLOAT ) return -1;
849   assert( !ExprHasProperty(p, EP_IntValue) );
850   sqlite3AtoF(p->u.zToken, &r, sqlite3Strlen30(p->u.zToken), SQLITE_UTF8);
851   assert( r>=0.0 );
852   if( r>1.0 ) return -1;
853   return (int)(r*134217728.0);
854 }
855 
856 /*
857 ** This routine is callback for sqlite3WalkExpr().
858 **
859 ** Resolve symbolic names into TK_COLUMN operators for the current
860 ** node in the expression tree.  Return 0 to continue the search down
861 ** the tree or 2 to abort the tree walk.
862 **
863 ** This routine also does error checking and name resolution for
864 ** function names.  The operator for aggregate functions is changed
865 ** to TK_AGG_FUNCTION.
866 */
867 static int resolveExprStep(Walker *pWalker, Expr *pExpr){
868   NameContext *pNC;
869   Parse *pParse;
870 
871   pNC = pWalker->u.pNC;
872   assert( pNC!=0 );
873   pParse = pNC->pParse;
874   assert( pParse==pWalker->pParse );
875 
876 #ifndef NDEBUG
877   if( pNC->pSrcList && pNC->pSrcList->nAlloc>0 ){
878     SrcList *pSrcList = pNC->pSrcList;
879     int i;
880     for(i=0; i<pNC->pSrcList->nSrc; i++){
881       assert( pSrcList->a[i].iCursor>=0 && pSrcList->a[i].iCursor<pParse->nTab);
882     }
883   }
884 #endif
885   switch( pExpr->op ){
886 
887     /* The special operator TK_ROW means use the rowid for the first
888     ** column in the FROM clause.  This is used by the LIMIT and ORDER BY
889     ** clause processing on UPDATE and DELETE statements, and by
890     ** UPDATE ... FROM statement processing.
891     */
892     case TK_ROW: {
893       SrcList *pSrcList = pNC->pSrcList;
894       SrcItem *pItem;
895       assert( pSrcList && pSrcList->nSrc>=1 );
896       pItem = pSrcList->a;
897       pExpr->op = TK_COLUMN;
898       assert( ExprUseYTab(pExpr) );
899       pExpr->y.pTab = pItem->pTab;
900       pExpr->iTable = pItem->iCursor;
901       pExpr->iColumn--;
902       pExpr->affExpr = SQLITE_AFF_INTEGER;
903       break;
904     }
905 
906     /* An optimization:  Attempt to convert
907     **
908     **      "expr IS NOT NULL"  -->  "TRUE"
909     **      "expr IS NULL"      -->  "FALSE"
910     **
911     ** if we can prove that "expr" is never NULL.  Call this the
912     ** "NOT NULL strength reduction optimization".
913     **
914     ** If this optimization occurs, also restore the NameContext ref-counts
915     ** to the state they where in before the "column" LHS expression was
916     ** resolved.  This prevents "column" from being counted as having been
917     ** referenced, which might prevent a SELECT from being erroneously
918     ** marked as correlated.
919     */
920     case TK_NOTNULL:
921     case TK_ISNULL: {
922       int anRef[8];
923       NameContext *p;
924       int i;
925       for(i=0, p=pNC; p && i<ArraySize(anRef); p=p->pNext, i++){
926         anRef[i] = p->nRef;
927       }
928       sqlite3WalkExpr(pWalker, pExpr->pLeft);
929       if( 0==sqlite3ExprCanBeNull(pExpr->pLeft) && !IN_RENAME_OBJECT ){
930         testcase( ExprHasProperty(pExpr, EP_FromJoin) );
931         assert( !ExprHasProperty(pExpr, EP_IntValue) );
932         if( pExpr->op==TK_NOTNULL ){
933           pExpr->u.zToken = "true";
934           ExprSetProperty(pExpr, EP_IsTrue);
935         }else{
936           pExpr->u.zToken = "false";
937           ExprSetProperty(pExpr, EP_IsFalse);
938         }
939         pExpr->op = TK_TRUEFALSE;
940         for(i=0, p=pNC; p && i<ArraySize(anRef); p=p->pNext, i++){
941           p->nRef = anRef[i];
942         }
943         sqlite3ExprDelete(pParse->db, pExpr->pLeft);
944         pExpr->pLeft = 0;
945       }
946       return WRC_Prune;
947     }
948 
949     /* A column name:                    ID
950     ** Or table name and column name:    ID.ID
951     ** Or a database, table and column:  ID.ID.ID
952     **
953     ** The TK_ID and TK_OUT cases are combined so that there will only
954     ** be one call to lookupName().  Then the compiler will in-line
955     ** lookupName() for a size reduction and performance increase.
956     */
957     case TK_ID:
958     case TK_DOT: {
959       const char *zColumn;
960       const char *zTable;
961       const char *zDb;
962       Expr *pRight;
963 
964       if( pExpr->op==TK_ID ){
965         zDb = 0;
966         zTable = 0;
967         assert( !ExprHasProperty(pExpr, EP_IntValue) );
968         zColumn = pExpr->u.zToken;
969       }else{
970         Expr *pLeft = pExpr->pLeft;
971         testcase( pNC->ncFlags & NC_IdxExpr );
972         testcase( pNC->ncFlags & NC_GenCol );
973         sqlite3ResolveNotValid(pParse, pNC, "the \".\" operator",
974                                NC_IdxExpr|NC_GenCol, 0, pExpr);
975         pRight = pExpr->pRight;
976         if( pRight->op==TK_ID ){
977           zDb = 0;
978         }else{
979           assert( pRight->op==TK_DOT );
980           assert( !ExprHasProperty(pRight, EP_IntValue) );
981           zDb = pLeft->u.zToken;
982           pLeft = pRight->pLeft;
983           pRight = pRight->pRight;
984         }
985         assert( ExprUseUToken(pLeft) && ExprUseUToken(pRight) );
986         zTable = pLeft->u.zToken;
987         zColumn = pRight->u.zToken;
988         assert( ExprUseYTab(pExpr) );
989         if( IN_RENAME_OBJECT ){
990           sqlite3RenameTokenRemap(pParse, (void*)pExpr, (void*)pRight);
991           sqlite3RenameTokenRemap(pParse, (void*)&pExpr->y.pTab, (void*)pLeft);
992         }
993       }
994       return lookupName(pParse, zDb, zTable, zColumn, pNC, pExpr);
995     }
996 
997     /* Resolve function names
998     */
999     case TK_FUNCTION: {
1000       ExprList *pList = pExpr->x.pList;    /* The argument list */
1001       int n = pList ? pList->nExpr : 0;    /* Number of arguments */
1002       int no_such_func = 0;       /* True if no such function exists */
1003       int wrong_num_args = 0;     /* True if wrong number of arguments */
1004       int is_agg = 0;             /* True if is an aggregate function */
1005       const char *zId;            /* The function name. */
1006       FuncDef *pDef;              /* Information about the function */
1007       u8 enc = ENC(pParse->db);   /* The database encoding */
1008       int savedAllowFlags = (pNC->ncFlags & (NC_AllowAgg | NC_AllowWin));
1009 #ifndef SQLITE_OMIT_WINDOWFUNC
1010       Window *pWin = (IsWindowFunc(pExpr) ? pExpr->y.pWin : 0);
1011 #endif
1012       assert( !ExprHasProperty(pExpr, EP_xIsSelect|EP_IntValue) );
1013       zId = pExpr->u.zToken;
1014       pDef = sqlite3FindFunction(pParse->db, zId, n, enc, 0);
1015       if( pDef==0 ){
1016         pDef = sqlite3FindFunction(pParse->db, zId, -2, enc, 0);
1017         if( pDef==0 ){
1018           no_such_func = 1;
1019         }else{
1020           wrong_num_args = 1;
1021         }
1022       }else{
1023         is_agg = pDef->xFinalize!=0;
1024         if( pDef->funcFlags & SQLITE_FUNC_UNLIKELY ){
1025           ExprSetProperty(pExpr, EP_Unlikely);
1026           if( n==2 ){
1027             pExpr->iTable = exprProbability(pList->a[1].pExpr);
1028             if( pExpr->iTable<0 ){
1029               sqlite3ErrorMsg(pParse,
1030                 "second argument to %#T() must be a "
1031                 "constant between 0.0 and 1.0", pExpr);
1032               pNC->nNcErr++;
1033             }
1034           }else{
1035             /* EVIDENCE-OF: R-61304-29449 The unlikely(X) function is
1036             ** equivalent to likelihood(X, 0.0625).
1037             ** EVIDENCE-OF: R-01283-11636 The unlikely(X) function is
1038             ** short-hand for likelihood(X,0.0625).
1039             ** EVIDENCE-OF: R-36850-34127 The likely(X) function is short-hand
1040             ** for likelihood(X,0.9375).
1041             ** EVIDENCE-OF: R-53436-40973 The likely(X) function is equivalent
1042             ** to likelihood(X,0.9375). */
1043             /* TUNING: unlikely() probability is 0.0625.  likely() is 0.9375 */
1044             pExpr->iTable = pDef->zName[0]=='u' ? 8388608 : 125829120;
1045           }
1046         }
1047 #ifndef SQLITE_OMIT_AUTHORIZATION
1048         {
1049           int auth = sqlite3AuthCheck(pParse, SQLITE_FUNCTION, 0,pDef->zName,0);
1050           if( auth!=SQLITE_OK ){
1051             if( auth==SQLITE_DENY ){
1052               sqlite3ErrorMsg(pParse, "not authorized to use function: %#T",
1053                                       pExpr);
1054               pNC->nNcErr++;
1055             }
1056             pExpr->op = TK_NULL;
1057             return WRC_Prune;
1058           }
1059         }
1060 #endif
1061         if( pDef->funcFlags & (SQLITE_FUNC_CONSTANT|SQLITE_FUNC_SLOCHNG) ){
1062           /* For the purposes of the EP_ConstFunc flag, date and time
1063           ** functions and other functions that change slowly are considered
1064           ** constant because they are constant for the duration of one query.
1065           ** This allows them to be factored out of inner loops. */
1066           ExprSetProperty(pExpr,EP_ConstFunc);
1067         }
1068         if( (pDef->funcFlags & SQLITE_FUNC_CONSTANT)==0 ){
1069           /* Clearly non-deterministic functions like random(), but also
1070           ** date/time functions that use 'now', and other functions like
1071           ** sqlite_version() that might change over time cannot be used
1072           ** in an index or generated column.  Curiously, they can be used
1073           ** in a CHECK constraint.  SQLServer, MySQL, and PostgreSQL all
1074           ** all this. */
1075           sqlite3ResolveNotValid(pParse, pNC, "non-deterministic functions",
1076                                  NC_IdxExpr|NC_PartIdx|NC_GenCol, 0, pExpr);
1077         }else{
1078           assert( (NC_SelfRef & 0xff)==NC_SelfRef ); /* Must fit in 8 bits */
1079           pExpr->op2 = pNC->ncFlags & NC_SelfRef;
1080           if( pNC->ncFlags & NC_FromDDL ) ExprSetProperty(pExpr, EP_FromDDL);
1081         }
1082         if( (pDef->funcFlags & SQLITE_FUNC_INTERNAL)!=0
1083          && pParse->nested==0
1084          && (pParse->db->mDbFlags & DBFLAG_InternalFunc)==0
1085         ){
1086           /* Internal-use-only functions are disallowed unless the
1087           ** SQL is being compiled using sqlite3NestedParse() or
1088           ** the SQLITE_TESTCTRL_INTERNAL_FUNCTIONS test-control has be
1089           ** used to activate internal functions for testing purposes */
1090           no_such_func = 1;
1091           pDef = 0;
1092         }else
1093         if( (pDef->funcFlags & (SQLITE_FUNC_DIRECT|SQLITE_FUNC_UNSAFE))!=0
1094          && !IN_RENAME_OBJECT
1095         ){
1096           sqlite3ExprFunctionUsable(pParse, pExpr, pDef);
1097         }
1098       }
1099 
1100       if( 0==IN_RENAME_OBJECT ){
1101 #ifndef SQLITE_OMIT_WINDOWFUNC
1102         assert( is_agg==0 || (pDef->funcFlags & SQLITE_FUNC_MINMAX)
1103           || (pDef->xValue==0 && pDef->xInverse==0)
1104           || (pDef->xValue && pDef->xInverse && pDef->xSFunc && pDef->xFinalize)
1105         );
1106         if( pDef && pDef->xValue==0 && pWin ){
1107           sqlite3ErrorMsg(pParse,
1108               "%#T() may not be used as a window function", pExpr
1109           );
1110           pNC->nNcErr++;
1111         }else if(
1112               (is_agg && (pNC->ncFlags & NC_AllowAgg)==0)
1113            || (is_agg && (pDef->funcFlags&SQLITE_FUNC_WINDOW) && !pWin)
1114            || (is_agg && pWin && (pNC->ncFlags & NC_AllowWin)==0)
1115         ){
1116           const char *zType;
1117           if( (pDef->funcFlags & SQLITE_FUNC_WINDOW) || pWin ){
1118             zType = "window";
1119           }else{
1120             zType = "aggregate";
1121           }
1122           sqlite3ErrorMsg(pParse, "misuse of %s function %#T()",zType,pExpr);
1123           pNC->nNcErr++;
1124           is_agg = 0;
1125         }
1126 #else
1127         if( (is_agg && (pNC->ncFlags & NC_AllowAgg)==0) ){
1128           sqlite3ErrorMsg(pParse,"misuse of aggregate function %#T()",pExpr);
1129           pNC->nNcErr++;
1130           is_agg = 0;
1131         }
1132 #endif
1133         else if( no_such_func && pParse->db->init.busy==0
1134 #ifdef SQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
1135                   && pParse->explain==0
1136 #endif
1137         ){
1138           sqlite3ErrorMsg(pParse, "no such function: %#T", pExpr);
1139           pNC->nNcErr++;
1140         }else if( wrong_num_args ){
1141           sqlite3ErrorMsg(pParse,"wrong number of arguments to function %#T()",
1142                pExpr);
1143           pNC->nNcErr++;
1144         }
1145 #ifndef SQLITE_OMIT_WINDOWFUNC
1146         else if( is_agg==0 && ExprHasProperty(pExpr, EP_WinFunc) ){
1147           sqlite3ErrorMsg(pParse,
1148               "FILTER may not be used with non-aggregate %#T()",
1149               pExpr
1150           );
1151           pNC->nNcErr++;
1152         }
1153 #endif
1154         if( is_agg ){
1155           /* Window functions may not be arguments of aggregate functions.
1156           ** Or arguments of other window functions. But aggregate functions
1157           ** may be arguments for window functions.  */
1158 #ifndef SQLITE_OMIT_WINDOWFUNC
1159           pNC->ncFlags &= ~(NC_AllowWin | (!pWin ? NC_AllowAgg : 0));
1160 #else
1161           pNC->ncFlags &= ~NC_AllowAgg;
1162 #endif
1163         }
1164       }
1165 #ifndef SQLITE_OMIT_WINDOWFUNC
1166       else if( ExprHasProperty(pExpr, EP_WinFunc) ){
1167         is_agg = 1;
1168       }
1169 #endif
1170       sqlite3WalkExprList(pWalker, pList);
1171       if( is_agg ){
1172 #ifndef SQLITE_OMIT_WINDOWFUNC
1173         if( pWin ){
1174           Select *pSel = pNC->pWinSelect;
1175           assert( pWin==0 || (ExprUseYWin(pExpr) && pWin==pExpr->y.pWin) );
1176           if( IN_RENAME_OBJECT==0 ){
1177             sqlite3WindowUpdate(pParse, pSel ? pSel->pWinDefn : 0, pWin, pDef);
1178             if( pParse->db->mallocFailed ) break;
1179           }
1180           sqlite3WalkExprList(pWalker, pWin->pPartition);
1181           sqlite3WalkExprList(pWalker, pWin->pOrderBy);
1182           sqlite3WalkExpr(pWalker, pWin->pFilter);
1183           sqlite3WindowLink(pSel, pWin);
1184           pNC->ncFlags |= NC_HasWin;
1185         }else
1186 #endif /* SQLITE_OMIT_WINDOWFUNC */
1187         {
1188           NameContext *pNC2;          /* For looping up thru outer contexts */
1189           pExpr->op = TK_AGG_FUNCTION;
1190           pExpr->op2 = 0;
1191 #ifndef SQLITE_OMIT_WINDOWFUNC
1192           if( ExprHasProperty(pExpr, EP_WinFunc) ){
1193             sqlite3WalkExpr(pWalker, pExpr->y.pWin->pFilter);
1194           }
1195 #endif
1196           pNC2 = pNC;
1197           while( pNC2
1198               && sqlite3ReferencesSrcList(pParse, pExpr, pNC2->pSrcList)==0
1199           ){
1200             pExpr->op2++;
1201             pNC2 = pNC2->pNext;
1202           }
1203           assert( pDef!=0 || IN_RENAME_OBJECT );
1204           if( pNC2 && pDef ){
1205             assert( SQLITE_FUNC_MINMAX==NC_MinMaxAgg );
1206             assert( SQLITE_FUNC_ANYORDER==NC_OrderAgg );
1207             testcase( (pDef->funcFlags & SQLITE_FUNC_MINMAX)!=0 );
1208             testcase( (pDef->funcFlags & SQLITE_FUNC_ANYORDER)!=0 );
1209             pNC2->ncFlags |= NC_HasAgg
1210               | ((pDef->funcFlags^SQLITE_FUNC_ANYORDER)
1211                   & (SQLITE_FUNC_MINMAX|SQLITE_FUNC_ANYORDER));
1212           }
1213         }
1214         pNC->ncFlags |= savedAllowFlags;
1215       }
1216       /* FIX ME:  Compute pExpr->affinity based on the expected return
1217       ** type of the function
1218       */
1219       return WRC_Prune;
1220     }
1221 #ifndef SQLITE_OMIT_SUBQUERY
1222     case TK_SELECT:
1223     case TK_EXISTS:  testcase( pExpr->op==TK_EXISTS );
1224 #endif
1225     case TK_IN: {
1226       testcase( pExpr->op==TK_IN );
1227       if( ExprUseXSelect(pExpr) ){
1228         int nRef = pNC->nRef;
1229         testcase( pNC->ncFlags & NC_IsCheck );
1230         testcase( pNC->ncFlags & NC_PartIdx );
1231         testcase( pNC->ncFlags & NC_IdxExpr );
1232         testcase( pNC->ncFlags & NC_GenCol );
1233         if( pNC->ncFlags & NC_SelfRef ){
1234           notValidImpl(pParse, pNC, "subqueries", pExpr, pExpr);
1235         }else{
1236           sqlite3WalkSelect(pWalker, pExpr->x.pSelect);
1237         }
1238         assert( pNC->nRef>=nRef );
1239         if( nRef!=pNC->nRef ){
1240           ExprSetProperty(pExpr, EP_VarSelect);
1241           pNC->ncFlags |= NC_VarSelect;
1242         }
1243       }
1244       break;
1245     }
1246     case TK_VARIABLE: {
1247       testcase( pNC->ncFlags & NC_IsCheck );
1248       testcase( pNC->ncFlags & NC_PartIdx );
1249       testcase( pNC->ncFlags & NC_IdxExpr );
1250       testcase( pNC->ncFlags & NC_GenCol );
1251       sqlite3ResolveNotValid(pParse, pNC, "parameters",
1252                NC_IsCheck|NC_PartIdx|NC_IdxExpr|NC_GenCol, pExpr, pExpr);
1253       break;
1254     }
1255     case TK_IS:
1256     case TK_ISNOT: {
1257       Expr *pRight = sqlite3ExprSkipCollateAndLikely(pExpr->pRight);
1258       assert( !ExprHasProperty(pExpr, EP_Reduced) );
1259       /* Handle special cases of "x IS TRUE", "x IS FALSE", "x IS NOT TRUE",
1260       ** and "x IS NOT FALSE". */
1261       if( ALWAYS(pRight) && (pRight->op==TK_ID || pRight->op==TK_TRUEFALSE) ){
1262         int rc = resolveExprStep(pWalker, pRight);
1263         if( rc==WRC_Abort ) return WRC_Abort;
1264         if( pRight->op==TK_TRUEFALSE ){
1265           pExpr->op2 = pExpr->op;
1266           pExpr->op = TK_TRUTH;
1267           return WRC_Continue;
1268         }
1269       }
1270       /* no break */ deliberate_fall_through
1271     }
1272     case TK_BETWEEN:
1273     case TK_EQ:
1274     case TK_NE:
1275     case TK_LT:
1276     case TK_LE:
1277     case TK_GT:
1278     case TK_GE: {
1279       int nLeft, nRight;
1280       if( pParse->db->mallocFailed ) break;
1281       assert( pExpr->pLeft!=0 );
1282       nLeft = sqlite3ExprVectorSize(pExpr->pLeft);
1283       if( pExpr->op==TK_BETWEEN ){
1284         assert( ExprUseXList(pExpr) );
1285         nRight = sqlite3ExprVectorSize(pExpr->x.pList->a[0].pExpr);
1286         if( nRight==nLeft ){
1287           nRight = sqlite3ExprVectorSize(pExpr->x.pList->a[1].pExpr);
1288         }
1289       }else{
1290         assert( pExpr->pRight!=0 );
1291         nRight = sqlite3ExprVectorSize(pExpr->pRight);
1292       }
1293       if( nLeft!=nRight ){
1294         testcase( pExpr->op==TK_EQ );
1295         testcase( pExpr->op==TK_NE );
1296         testcase( pExpr->op==TK_LT );
1297         testcase( pExpr->op==TK_LE );
1298         testcase( pExpr->op==TK_GT );
1299         testcase( pExpr->op==TK_GE );
1300         testcase( pExpr->op==TK_IS );
1301         testcase( pExpr->op==TK_ISNOT );
1302         testcase( pExpr->op==TK_BETWEEN );
1303         sqlite3ErrorMsg(pParse, "row value misused");
1304         sqlite3RecordErrorOffsetOfExpr(pParse->db, pExpr);
1305       }
1306       break;
1307     }
1308   }
1309   assert( pParse->db->mallocFailed==0 || pParse->nErr!=0 );
1310   return pParse->nErr ? WRC_Abort : WRC_Continue;
1311 }
1312 
1313 /*
1314 ** pEList is a list of expressions which are really the result set of the
1315 ** a SELECT statement.  pE is a term in an ORDER BY or GROUP BY clause.
1316 ** This routine checks to see if pE is a simple identifier which corresponds
1317 ** to the AS-name of one of the terms of the expression list.  If it is,
1318 ** this routine return an integer between 1 and N where N is the number of
1319 ** elements in pEList, corresponding to the matching entry.  If there is
1320 ** no match, or if pE is not a simple identifier, then this routine
1321 ** return 0.
1322 **
1323 ** pEList has been resolved.  pE has not.
1324 */
1325 static int resolveAsName(
1326   Parse *pParse,     /* Parsing context for error messages */
1327   ExprList *pEList,  /* List of expressions to scan */
1328   Expr *pE           /* Expression we are trying to match */
1329 ){
1330   int i;             /* Loop counter */
1331 
1332   UNUSED_PARAMETER(pParse);
1333 
1334   if( pE->op==TK_ID ){
1335     const char *zCol;
1336     assert( !ExprHasProperty(pE, EP_IntValue) );
1337     zCol = pE->u.zToken;
1338     for(i=0; i<pEList->nExpr; i++){
1339       if( pEList->a[i].eEName==ENAME_NAME
1340        && sqlite3_stricmp(pEList->a[i].zEName, zCol)==0
1341       ){
1342         return i+1;
1343       }
1344     }
1345   }
1346   return 0;
1347 }
1348 
1349 /*
1350 ** pE is a pointer to an expression which is a single term in the
1351 ** ORDER BY of a compound SELECT.  The expression has not been
1352 ** name resolved.
1353 **
1354 ** At the point this routine is called, we already know that the
1355 ** ORDER BY term is not an integer index into the result set.  That
1356 ** case is handled by the calling routine.
1357 **
1358 ** Attempt to match pE against result set columns in the left-most
1359 ** SELECT statement.  Return the index i of the matching column,
1360 ** as an indication to the caller that it should sort by the i-th column.
1361 ** The left-most column is 1.  In other words, the value returned is the
1362 ** same integer value that would be used in the SQL statement to indicate
1363 ** the column.
1364 **
1365 ** If there is no match, return 0.  Return -1 if an error occurs.
1366 */
1367 static int resolveOrderByTermToExprList(
1368   Parse *pParse,     /* Parsing context for error messages */
1369   Select *pSelect,   /* The SELECT statement with the ORDER BY clause */
1370   Expr *pE           /* The specific ORDER BY term */
1371 ){
1372   int i;             /* Loop counter */
1373   ExprList *pEList;  /* The columns of the result set */
1374   NameContext nc;    /* Name context for resolving pE */
1375   sqlite3 *db;       /* Database connection */
1376   int rc;            /* Return code from subprocedures */
1377   u8 savedSuppErr;   /* Saved value of db->suppressErr */
1378 
1379   assert( sqlite3ExprIsInteger(pE, &i)==0 );
1380   pEList = pSelect->pEList;
1381 
1382   /* Resolve all names in the ORDER BY term expression
1383   */
1384   memset(&nc, 0, sizeof(nc));
1385   nc.pParse = pParse;
1386   nc.pSrcList = pSelect->pSrc;
1387   nc.uNC.pEList = pEList;
1388   nc.ncFlags = NC_AllowAgg|NC_UEList|NC_NoSelect;
1389   nc.nNcErr = 0;
1390   db = pParse->db;
1391   savedSuppErr = db->suppressErr;
1392   db->suppressErr = 1;
1393   rc = sqlite3ResolveExprNames(&nc, pE);
1394   db->suppressErr = savedSuppErr;
1395   if( rc ) return 0;
1396 
1397   /* Try to match the ORDER BY expression against an expression
1398   ** in the result set.  Return an 1-based index of the matching
1399   ** result-set entry.
1400   */
1401   for(i=0; i<pEList->nExpr; i++){
1402     if( sqlite3ExprCompare(0, pEList->a[i].pExpr, pE, -1)<2 ){
1403       return i+1;
1404     }
1405   }
1406 
1407   /* If no match, return 0. */
1408   return 0;
1409 }
1410 
1411 /*
1412 ** Generate an ORDER BY or GROUP BY term out-of-range error.
1413 */
1414 static void resolveOutOfRangeError(
1415   Parse *pParse,         /* The error context into which to write the error */
1416   const char *zType,     /* "ORDER" or "GROUP" */
1417   int i,                 /* The index (1-based) of the term out of range */
1418   int mx,                /* Largest permissible value of i */
1419   Expr *pError           /* Associate the error with the expression */
1420 ){
1421   sqlite3ErrorMsg(pParse,
1422     "%r %s BY term out of range - should be "
1423     "between 1 and %d", i, zType, mx);
1424   sqlite3RecordErrorOffsetOfExpr(pParse->db, pError);
1425 }
1426 
1427 /*
1428 ** Analyze the ORDER BY clause in a compound SELECT statement.   Modify
1429 ** each term of the ORDER BY clause is a constant integer between 1
1430 ** and N where N is the number of columns in the compound SELECT.
1431 **
1432 ** ORDER BY terms that are already an integer between 1 and N are
1433 ** unmodified.  ORDER BY terms that are integers outside the range of
1434 ** 1 through N generate an error.  ORDER BY terms that are expressions
1435 ** are matched against result set expressions of compound SELECT
1436 ** beginning with the left-most SELECT and working toward the right.
1437 ** At the first match, the ORDER BY expression is transformed into
1438 ** the integer column number.
1439 **
1440 ** Return the number of errors seen.
1441 */
1442 static int resolveCompoundOrderBy(
1443   Parse *pParse,        /* Parsing context.  Leave error messages here */
1444   Select *pSelect       /* The SELECT statement containing the ORDER BY */
1445 ){
1446   int i;
1447   ExprList *pOrderBy;
1448   ExprList *pEList;
1449   sqlite3 *db;
1450   int moreToDo = 1;
1451 
1452   pOrderBy = pSelect->pOrderBy;
1453   if( pOrderBy==0 ) return 0;
1454   db = pParse->db;
1455   if( pOrderBy->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
1456     sqlite3ErrorMsg(pParse, "too many terms in ORDER BY clause");
1457     return 1;
1458   }
1459   for(i=0; i<pOrderBy->nExpr; i++){
1460     pOrderBy->a[i].done = 0;
1461   }
1462   pSelect->pNext = 0;
1463   while( pSelect->pPrior ){
1464     pSelect->pPrior->pNext = pSelect;
1465     pSelect = pSelect->pPrior;
1466   }
1467   while( pSelect && moreToDo ){
1468     struct ExprList_item *pItem;
1469     moreToDo = 0;
1470     pEList = pSelect->pEList;
1471     assert( pEList!=0 );
1472     for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
1473       int iCol = -1;
1474       Expr *pE, *pDup;
1475       if( pItem->done ) continue;
1476       pE = sqlite3ExprSkipCollateAndLikely(pItem->pExpr);
1477       if( NEVER(pE==0) ) continue;
1478       if( sqlite3ExprIsInteger(pE, &iCol) ){
1479         if( iCol<=0 || iCol>pEList->nExpr ){
1480           resolveOutOfRangeError(pParse, "ORDER", i+1, pEList->nExpr, pE);
1481           return 1;
1482         }
1483       }else{
1484         iCol = resolveAsName(pParse, pEList, pE);
1485         if( iCol==0 ){
1486           /* Now test if expression pE matches one of the values returned
1487           ** by pSelect. In the usual case this is done by duplicating the
1488           ** expression, resolving any symbols in it, and then comparing
1489           ** it against each expression returned by the SELECT statement.
1490           ** Once the comparisons are finished, the duplicate expression
1491           ** is deleted.
1492           **
1493           ** If this is running as part of an ALTER TABLE operation and
1494           ** the symbols resolve successfully, also resolve the symbols in the
1495           ** actual expression. This allows the code in alter.c to modify
1496           ** column references within the ORDER BY expression as required.  */
1497           pDup = sqlite3ExprDup(db, pE, 0);
1498           if( !db->mallocFailed ){
1499             assert(pDup);
1500             iCol = resolveOrderByTermToExprList(pParse, pSelect, pDup);
1501             if( IN_RENAME_OBJECT && iCol>0 ){
1502               resolveOrderByTermToExprList(pParse, pSelect, pE);
1503             }
1504           }
1505           sqlite3ExprDelete(db, pDup);
1506         }
1507       }
1508       if( iCol>0 ){
1509         /* Convert the ORDER BY term into an integer column number iCol,
1510         ** taking care to preserve the COLLATE clause if it exists. */
1511         if( !IN_RENAME_OBJECT ){
1512           Expr *pNew = sqlite3Expr(db, TK_INTEGER, 0);
1513           if( pNew==0 ) return 1;
1514           pNew->flags |= EP_IntValue;
1515           pNew->u.iValue = iCol;
1516           if( pItem->pExpr==pE ){
1517             pItem->pExpr = pNew;
1518           }else{
1519             Expr *pParent = pItem->pExpr;
1520             assert( pParent->op==TK_COLLATE );
1521             while( pParent->pLeft->op==TK_COLLATE ) pParent = pParent->pLeft;
1522             assert( pParent->pLeft==pE );
1523             pParent->pLeft = pNew;
1524           }
1525           sqlite3ExprDelete(db, pE);
1526           pItem->u.x.iOrderByCol = (u16)iCol;
1527         }
1528         pItem->done = 1;
1529       }else{
1530         moreToDo = 1;
1531       }
1532     }
1533     pSelect = pSelect->pNext;
1534   }
1535   for(i=0; i<pOrderBy->nExpr; i++){
1536     if( pOrderBy->a[i].done==0 ){
1537       sqlite3ErrorMsg(pParse, "%r ORDER BY term does not match any "
1538             "column in the result set", i+1);
1539       return 1;
1540     }
1541   }
1542   return 0;
1543 }
1544 
1545 /*
1546 ** Check every term in the ORDER BY or GROUP BY clause pOrderBy of
1547 ** the SELECT statement pSelect.  If any term is reference to a
1548 ** result set expression (as determined by the ExprList.a.u.x.iOrderByCol
1549 ** field) then convert that term into a copy of the corresponding result set
1550 ** column.
1551 **
1552 ** If any errors are detected, add an error message to pParse and
1553 ** return non-zero.  Return zero if no errors are seen.
1554 */
1555 int sqlite3ResolveOrderGroupBy(
1556   Parse *pParse,        /* Parsing context.  Leave error messages here */
1557   Select *pSelect,      /* The SELECT statement containing the clause */
1558   ExprList *pOrderBy,   /* The ORDER BY or GROUP BY clause to be processed */
1559   const char *zType     /* "ORDER" or "GROUP" */
1560 ){
1561   int i;
1562   sqlite3 *db = pParse->db;
1563   ExprList *pEList;
1564   struct ExprList_item *pItem;
1565 
1566   if( pOrderBy==0 || pParse->db->mallocFailed || IN_RENAME_OBJECT ) return 0;
1567   if( pOrderBy->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
1568     sqlite3ErrorMsg(pParse, "too many terms in %s BY clause", zType);
1569     return 1;
1570   }
1571   pEList = pSelect->pEList;
1572   assert( pEList!=0 );  /* sqlite3SelectNew() guarantees this */
1573   for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
1574     if( pItem->u.x.iOrderByCol ){
1575       if( pItem->u.x.iOrderByCol>pEList->nExpr ){
1576         resolveOutOfRangeError(pParse, zType, i+1, pEList->nExpr, 0);
1577         return 1;
1578       }
1579       resolveAlias(pParse, pEList, pItem->u.x.iOrderByCol-1, pItem->pExpr,0);
1580     }
1581   }
1582   return 0;
1583 }
1584 
1585 #ifndef SQLITE_OMIT_WINDOWFUNC
1586 /*
1587 ** Walker callback for windowRemoveExprFromSelect().
1588 */
1589 static int resolveRemoveWindowsCb(Walker *pWalker, Expr *pExpr){
1590   UNUSED_PARAMETER(pWalker);
1591   if( ExprHasProperty(pExpr, EP_WinFunc) ){
1592     Window *pWin = pExpr->y.pWin;
1593     sqlite3WindowUnlinkFromSelect(pWin);
1594   }
1595   return WRC_Continue;
1596 }
1597 
1598 /*
1599 ** Remove any Window objects owned by the expression pExpr from the
1600 ** Select.pWin list of Select object pSelect.
1601 */
1602 static void windowRemoveExprFromSelect(Select *pSelect, Expr *pExpr){
1603   if( pSelect->pWin ){
1604     Walker sWalker;
1605     memset(&sWalker, 0, sizeof(Walker));
1606     sWalker.xExprCallback = resolveRemoveWindowsCb;
1607     sWalker.u.pSelect = pSelect;
1608     sqlite3WalkExpr(&sWalker, pExpr);
1609   }
1610 }
1611 #else
1612 # define windowRemoveExprFromSelect(a, b)
1613 #endif /* SQLITE_OMIT_WINDOWFUNC */
1614 
1615 /*
1616 ** pOrderBy is an ORDER BY or GROUP BY clause in SELECT statement pSelect.
1617 ** The Name context of the SELECT statement is pNC.  zType is either
1618 ** "ORDER" or "GROUP" depending on which type of clause pOrderBy is.
1619 **
1620 ** This routine resolves each term of the clause into an expression.
1621 ** If the order-by term is an integer I between 1 and N (where N is the
1622 ** number of columns in the result set of the SELECT) then the expression
1623 ** in the resolution is a copy of the I-th result-set expression.  If
1624 ** the order-by term is an identifier that corresponds to the AS-name of
1625 ** a result-set expression, then the term resolves to a copy of the
1626 ** result-set expression.  Otherwise, the expression is resolved in
1627 ** the usual way - using sqlite3ResolveExprNames().
1628 **
1629 ** This routine returns the number of errors.  If errors occur, then
1630 ** an appropriate error message might be left in pParse.  (OOM errors
1631 ** excepted.)
1632 */
1633 static int resolveOrderGroupBy(
1634   NameContext *pNC,     /* The name context of the SELECT statement */
1635   Select *pSelect,      /* The SELECT statement holding pOrderBy */
1636   ExprList *pOrderBy,   /* An ORDER BY or GROUP BY clause to resolve */
1637   const char *zType     /* Either "ORDER" or "GROUP", as appropriate */
1638 ){
1639   int i, j;                      /* Loop counters */
1640   int iCol;                      /* Column number */
1641   struct ExprList_item *pItem;   /* A term of the ORDER BY clause */
1642   Parse *pParse;                 /* Parsing context */
1643   int nResult;                   /* Number of terms in the result set */
1644 
1645   assert( pOrderBy!=0 );
1646   nResult = pSelect->pEList->nExpr;
1647   pParse = pNC->pParse;
1648   for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
1649     Expr *pE = pItem->pExpr;
1650     Expr *pE2 = sqlite3ExprSkipCollateAndLikely(pE);
1651     if( NEVER(pE2==0) ) continue;
1652     if( zType[0]!='G' ){
1653       iCol = resolveAsName(pParse, pSelect->pEList, pE2);
1654       if( iCol>0 ){
1655         /* If an AS-name match is found, mark this ORDER BY column as being
1656         ** a copy of the iCol-th result-set column.  The subsequent call to
1657         ** sqlite3ResolveOrderGroupBy() will convert the expression to a
1658         ** copy of the iCol-th result-set expression. */
1659         pItem->u.x.iOrderByCol = (u16)iCol;
1660         continue;
1661       }
1662     }
1663     if( sqlite3ExprIsInteger(pE2, &iCol) ){
1664       /* The ORDER BY term is an integer constant.  Again, set the column
1665       ** number so that sqlite3ResolveOrderGroupBy() will convert the
1666       ** order-by term to a copy of the result-set expression */
1667       if( iCol<1 || iCol>0xffff ){
1668         resolveOutOfRangeError(pParse, zType, i+1, nResult, pE2);
1669         return 1;
1670       }
1671       pItem->u.x.iOrderByCol = (u16)iCol;
1672       continue;
1673     }
1674 
1675     /* Otherwise, treat the ORDER BY term as an ordinary expression */
1676     pItem->u.x.iOrderByCol = 0;
1677     if( sqlite3ResolveExprNames(pNC, pE) ){
1678       return 1;
1679     }
1680     for(j=0; j<pSelect->pEList->nExpr; j++){
1681       if( sqlite3ExprCompare(0, pE, pSelect->pEList->a[j].pExpr, -1)==0 ){
1682         /* Since this expresion is being changed into a reference
1683         ** to an identical expression in the result set, remove all Window
1684         ** objects belonging to the expression from the Select.pWin list. */
1685         windowRemoveExprFromSelect(pSelect, pE);
1686         pItem->u.x.iOrderByCol = j+1;
1687       }
1688     }
1689   }
1690   return sqlite3ResolveOrderGroupBy(pParse, pSelect, pOrderBy, zType);
1691 }
1692 
1693 /*
1694 ** Resolve names in the SELECT statement p and all of its descendants.
1695 */
1696 static int resolveSelectStep(Walker *pWalker, Select *p){
1697   NameContext *pOuterNC;  /* Context that contains this SELECT */
1698   NameContext sNC;        /* Name context of this SELECT */
1699   int isCompound;         /* True if p is a compound select */
1700   int nCompound;          /* Number of compound terms processed so far */
1701   Parse *pParse;          /* Parsing context */
1702   int i;                  /* Loop counter */
1703   ExprList *pGroupBy;     /* The GROUP BY clause */
1704   Select *pLeftmost;      /* Left-most of SELECT of a compound */
1705   sqlite3 *db;            /* Database connection */
1706 
1707 
1708   assert( p!=0 );
1709   if( p->selFlags & SF_Resolved ){
1710     return WRC_Prune;
1711   }
1712   pOuterNC = pWalker->u.pNC;
1713   pParse = pWalker->pParse;
1714   db = pParse->db;
1715 
1716   /* Normally sqlite3SelectExpand() will be called first and will have
1717   ** already expanded this SELECT.  However, if this is a subquery within
1718   ** an expression, sqlite3ResolveExprNames() will be called without a
1719   ** prior call to sqlite3SelectExpand().  When that happens, let
1720   ** sqlite3SelectPrep() do all of the processing for this SELECT.
1721   ** sqlite3SelectPrep() will invoke both sqlite3SelectExpand() and
1722   ** this routine in the correct order.
1723   */
1724   if( (p->selFlags & SF_Expanded)==0 ){
1725     sqlite3SelectPrep(pParse, p, pOuterNC);
1726     return pParse->nErr ? WRC_Abort : WRC_Prune;
1727   }
1728 
1729   isCompound = p->pPrior!=0;
1730   nCompound = 0;
1731   pLeftmost = p;
1732   while( p ){
1733     assert( (p->selFlags & SF_Expanded)!=0 );
1734     assert( (p->selFlags & SF_Resolved)==0 );
1735     assert( db->suppressErr==0 ); /* SF_Resolved not set if errors suppressed */
1736     p->selFlags |= SF_Resolved;
1737 
1738 
1739     /* Resolve the expressions in the LIMIT and OFFSET clauses. These
1740     ** are not allowed to refer to any names, so pass an empty NameContext.
1741     */
1742     memset(&sNC, 0, sizeof(sNC));
1743     sNC.pParse = pParse;
1744     sNC.pWinSelect = p;
1745     if( sqlite3ResolveExprNames(&sNC, p->pLimit) ){
1746       return WRC_Abort;
1747     }
1748 
1749     /* If the SF_Converted flags is set, then this Select object was
1750     ** was created by the convertCompoundSelectToSubquery() function.
1751     ** In this case the ORDER BY clause (p->pOrderBy) should be resolved
1752     ** as if it were part of the sub-query, not the parent. This block
1753     ** moves the pOrderBy down to the sub-query. It will be moved back
1754     ** after the names have been resolved.  */
1755     if( p->selFlags & SF_Converted ){
1756       Select *pSub = p->pSrc->a[0].pSelect;
1757       assert( p->pSrc->nSrc==1 && p->pOrderBy );
1758       assert( pSub->pPrior && pSub->pOrderBy==0 );
1759       pSub->pOrderBy = p->pOrderBy;
1760       p->pOrderBy = 0;
1761     }
1762 
1763     /* Recursively resolve names in all subqueries in the FROM clause
1764     */
1765     for(i=0; i<p->pSrc->nSrc; i++){
1766       SrcItem *pItem = &p->pSrc->a[i];
1767       if( pItem->pSelect && (pItem->pSelect->selFlags & SF_Resolved)==0 ){
1768         int nRef = pOuterNC ? pOuterNC->nRef : 0;
1769         const char *zSavedContext = pParse->zAuthContext;
1770 
1771         if( pItem->zName ) pParse->zAuthContext = pItem->zName;
1772         sqlite3ResolveSelectNames(pParse, pItem->pSelect, pOuterNC);
1773         pParse->zAuthContext = zSavedContext;
1774         if( pParse->nErr ) return WRC_Abort;
1775         assert( db->mallocFailed==0 );
1776 
1777         /* If the number of references to the outer context changed when
1778         ** expressions in the sub-select were resolved, the sub-select
1779         ** is correlated. It is not required to check the refcount on any
1780         ** but the innermost outer context object, as lookupName() increments
1781         ** the refcount on all contexts between the current one and the
1782         ** context containing the column when it resolves a name. */
1783         if( pOuterNC ){
1784           assert( pItem->fg.isCorrelated==0 && pOuterNC->nRef>=nRef );
1785           pItem->fg.isCorrelated = (pOuterNC->nRef>nRef);
1786         }
1787       }
1788     }
1789 
1790     /* Set up the local name-context to pass to sqlite3ResolveExprNames() to
1791     ** resolve the result-set expression list.
1792     */
1793     sNC.ncFlags = NC_AllowAgg|NC_AllowWin;
1794     sNC.pSrcList = p->pSrc;
1795     sNC.pNext = pOuterNC;
1796 
1797     /* Resolve names in the result set. */
1798     if( sqlite3ResolveExprListNames(&sNC, p->pEList) ) return WRC_Abort;
1799     sNC.ncFlags &= ~NC_AllowWin;
1800 
1801     /* If there are no aggregate functions in the result-set, and no GROUP BY
1802     ** expression, do not allow aggregates in any of the other expressions.
1803     */
1804     assert( (p->selFlags & SF_Aggregate)==0 );
1805     pGroupBy = p->pGroupBy;
1806     if( pGroupBy || (sNC.ncFlags & NC_HasAgg)!=0 ){
1807       assert( NC_MinMaxAgg==SF_MinMaxAgg );
1808       assert( NC_OrderAgg==SF_OrderByReqd );
1809       p->selFlags |= SF_Aggregate | (sNC.ncFlags&(NC_MinMaxAgg|NC_OrderAgg));
1810     }else{
1811       sNC.ncFlags &= ~NC_AllowAgg;
1812     }
1813 
1814     /* Add the output column list to the name-context before parsing the
1815     ** other expressions in the SELECT statement. This is so that
1816     ** expressions in the WHERE clause (etc.) can refer to expressions by
1817     ** aliases in the result set.
1818     **
1819     ** Minor point: If this is the case, then the expression will be
1820     ** re-evaluated for each reference to it.
1821     */
1822     assert( (sNC.ncFlags & (NC_UAggInfo|NC_UUpsert|NC_UBaseReg))==0 );
1823     sNC.uNC.pEList = p->pEList;
1824     sNC.ncFlags |= NC_UEList;
1825     if( p->pHaving ){
1826       if( !pGroupBy ){
1827         sqlite3ErrorMsg(pParse, "a GROUP BY clause is required before HAVING");
1828         return WRC_Abort;
1829       }
1830       if( sqlite3ResolveExprNames(&sNC, p->pHaving) ) return WRC_Abort;
1831     }
1832     if( sqlite3ResolveExprNames(&sNC, p->pWhere) ) return WRC_Abort;
1833 
1834     /* Resolve names in table-valued-function arguments */
1835     for(i=0; i<p->pSrc->nSrc; i++){
1836       SrcItem *pItem = &p->pSrc->a[i];
1837       if( pItem->fg.isTabFunc
1838        && sqlite3ResolveExprListNames(&sNC, pItem->u1.pFuncArg)
1839       ){
1840         return WRC_Abort;
1841       }
1842     }
1843 
1844 #ifndef SQLITE_OMIT_WINDOWFUNC
1845     if( IN_RENAME_OBJECT ){
1846       Window *pWin;
1847       for(pWin=p->pWinDefn; pWin; pWin=pWin->pNextWin){
1848         if( sqlite3ResolveExprListNames(&sNC, pWin->pOrderBy)
1849          || sqlite3ResolveExprListNames(&sNC, pWin->pPartition)
1850         ){
1851           return WRC_Abort;
1852         }
1853       }
1854     }
1855 #endif
1856 
1857     /* The ORDER BY and GROUP BY clauses may not refer to terms in
1858     ** outer queries
1859     */
1860     sNC.pNext = 0;
1861     sNC.ncFlags |= NC_AllowAgg|NC_AllowWin;
1862 
1863     /* If this is a converted compound query, move the ORDER BY clause from
1864     ** the sub-query back to the parent query. At this point each term
1865     ** within the ORDER BY clause has been transformed to an integer value.
1866     ** These integers will be replaced by copies of the corresponding result
1867     ** set expressions by the call to resolveOrderGroupBy() below.  */
1868     if( p->selFlags & SF_Converted ){
1869       Select *pSub = p->pSrc->a[0].pSelect;
1870       p->pOrderBy = pSub->pOrderBy;
1871       pSub->pOrderBy = 0;
1872     }
1873 
1874     /* Process the ORDER BY clause for singleton SELECT statements.
1875     ** The ORDER BY clause for compounds SELECT statements is handled
1876     ** below, after all of the result-sets for all of the elements of
1877     ** the compound have been resolved.
1878     **
1879     ** If there is an ORDER BY clause on a term of a compound-select other
1880     ** than the right-most term, then that is a syntax error.  But the error
1881     ** is not detected until much later, and so we need to go ahead and
1882     ** resolve those symbols on the incorrect ORDER BY for consistency.
1883     */
1884     if( p->pOrderBy!=0
1885      && isCompound<=nCompound  /* Defer right-most ORDER BY of a compound */
1886      && resolveOrderGroupBy(&sNC, p, p->pOrderBy, "ORDER")
1887     ){
1888       return WRC_Abort;
1889     }
1890     if( db->mallocFailed ){
1891       return WRC_Abort;
1892     }
1893     sNC.ncFlags &= ~NC_AllowWin;
1894 
1895     /* Resolve the GROUP BY clause.  At the same time, make sure
1896     ** the GROUP BY clause does not contain aggregate functions.
1897     */
1898     if( pGroupBy ){
1899       struct ExprList_item *pItem;
1900 
1901       if( resolveOrderGroupBy(&sNC, p, pGroupBy, "GROUP") || db->mallocFailed ){
1902         return WRC_Abort;
1903       }
1904       for(i=0, pItem=pGroupBy->a; i<pGroupBy->nExpr; i++, pItem++){
1905         if( ExprHasProperty(pItem->pExpr, EP_Agg) ){
1906           sqlite3ErrorMsg(pParse, "aggregate functions are not allowed in "
1907               "the GROUP BY clause");
1908           return WRC_Abort;
1909         }
1910       }
1911     }
1912 
1913     /* If this is part of a compound SELECT, check that it has the right
1914     ** number of expressions in the select list. */
1915     if( p->pNext && p->pEList->nExpr!=p->pNext->pEList->nExpr ){
1916       sqlite3SelectWrongNumTermsError(pParse, p->pNext);
1917       return WRC_Abort;
1918     }
1919 
1920     /* Advance to the next term of the compound
1921     */
1922     p = p->pPrior;
1923     nCompound++;
1924   }
1925 
1926   /* Resolve the ORDER BY on a compound SELECT after all terms of
1927   ** the compound have been resolved.
1928   */
1929   if( isCompound && resolveCompoundOrderBy(pParse, pLeftmost) ){
1930     return WRC_Abort;
1931   }
1932 
1933   return WRC_Prune;
1934 }
1935 
1936 /*
1937 ** This routine walks an expression tree and resolves references to
1938 ** table columns and result-set columns.  At the same time, do error
1939 ** checking on function usage and set a flag if any aggregate functions
1940 ** are seen.
1941 **
1942 ** To resolve table columns references we look for nodes (or subtrees) of the
1943 ** form X.Y.Z or Y.Z or just Z where
1944 **
1945 **      X:   The name of a database.  Ex:  "main" or "temp" or
1946 **           the symbolic name assigned to an ATTACH-ed database.
1947 **
1948 **      Y:   The name of a table in a FROM clause.  Or in a trigger
1949 **           one of the special names "old" or "new".
1950 **
1951 **      Z:   The name of a column in table Y.
1952 **
1953 ** The node at the root of the subtree is modified as follows:
1954 **
1955 **    Expr.op        Changed to TK_COLUMN
1956 **    Expr.pTab      Points to the Table object for X.Y
1957 **    Expr.iColumn   The column index in X.Y.  -1 for the rowid.
1958 **    Expr.iTable    The VDBE cursor number for X.Y
1959 **
1960 **
1961 ** To resolve result-set references, look for expression nodes of the
1962 ** form Z (with no X and Y prefix) where the Z matches the right-hand
1963 ** size of an AS clause in the result-set of a SELECT.  The Z expression
1964 ** is replaced by a copy of the left-hand side of the result-set expression.
1965 ** Table-name and function resolution occurs on the substituted expression
1966 ** tree.  For example, in:
1967 **
1968 **      SELECT a+b AS x, c+d AS y FROM t1 ORDER BY x;
1969 **
1970 ** The "x" term of the order by is replaced by "a+b" to render:
1971 **
1972 **      SELECT a+b AS x, c+d AS y FROM t1 ORDER BY a+b;
1973 **
1974 ** Function calls are checked to make sure that the function is
1975 ** defined and that the correct number of arguments are specified.
1976 ** If the function is an aggregate function, then the NC_HasAgg flag is
1977 ** set and the opcode is changed from TK_FUNCTION to TK_AGG_FUNCTION.
1978 ** If an expression contains aggregate functions then the EP_Agg
1979 ** property on the expression is set.
1980 **
1981 ** An error message is left in pParse if anything is amiss.  The number
1982 ** if errors is returned.
1983 */
1984 int sqlite3ResolveExprNames(
1985   NameContext *pNC,       /* Namespace to resolve expressions in. */
1986   Expr *pExpr             /* The expression to be analyzed. */
1987 ){
1988   int savedHasAgg;
1989   Walker w;
1990 
1991   if( pExpr==0 ) return SQLITE_OK;
1992   savedHasAgg = pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
1993   pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
1994   w.pParse = pNC->pParse;
1995   w.xExprCallback = resolveExprStep;
1996   w.xSelectCallback = (pNC->ncFlags & NC_NoSelect) ? 0 : resolveSelectStep;
1997   w.xSelectCallback2 = 0;
1998   w.u.pNC = pNC;
1999 #if SQLITE_MAX_EXPR_DEPTH>0
2000   w.pParse->nHeight += pExpr->nHeight;
2001   if( sqlite3ExprCheckHeight(w.pParse, w.pParse->nHeight) ){
2002     return SQLITE_ERROR;
2003   }
2004 #endif
2005   sqlite3WalkExpr(&w, pExpr);
2006 #if SQLITE_MAX_EXPR_DEPTH>0
2007   w.pParse->nHeight -= pExpr->nHeight;
2008 #endif
2009   assert( EP_Agg==NC_HasAgg );
2010   assert( EP_Win==NC_HasWin );
2011   testcase( pNC->ncFlags & NC_HasAgg );
2012   testcase( pNC->ncFlags & NC_HasWin );
2013   ExprSetProperty(pExpr, pNC->ncFlags & (NC_HasAgg|NC_HasWin) );
2014   pNC->ncFlags |= savedHasAgg;
2015   return pNC->nNcErr>0 || w.pParse->nErr>0;
2016 }
2017 
2018 /*
2019 ** Resolve all names for all expression in an expression list.  This is
2020 ** just like sqlite3ResolveExprNames() except that it works for an expression
2021 ** list rather than a single expression.
2022 */
2023 int sqlite3ResolveExprListNames(
2024   NameContext *pNC,       /* Namespace to resolve expressions in. */
2025   ExprList *pList         /* The expression list to be analyzed. */
2026 ){
2027   int i;
2028   int savedHasAgg = 0;
2029   Walker w;
2030   if( pList==0 ) return WRC_Continue;
2031   w.pParse = pNC->pParse;
2032   w.xExprCallback = resolveExprStep;
2033   w.xSelectCallback = resolveSelectStep;
2034   w.xSelectCallback2 = 0;
2035   w.u.pNC = pNC;
2036   savedHasAgg = pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
2037   pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
2038   for(i=0; i<pList->nExpr; i++){
2039     Expr *pExpr = pList->a[i].pExpr;
2040     if( pExpr==0 ) continue;
2041 #if SQLITE_MAX_EXPR_DEPTH>0
2042     w.pParse->nHeight += pExpr->nHeight;
2043     if( sqlite3ExprCheckHeight(w.pParse, w.pParse->nHeight) ){
2044       return WRC_Abort;
2045     }
2046 #endif
2047     sqlite3WalkExpr(&w, pExpr);
2048 #if SQLITE_MAX_EXPR_DEPTH>0
2049     w.pParse->nHeight -= pExpr->nHeight;
2050 #endif
2051     assert( EP_Agg==NC_HasAgg );
2052     assert( EP_Win==NC_HasWin );
2053     testcase( pNC->ncFlags & NC_HasAgg );
2054     testcase( pNC->ncFlags & NC_HasWin );
2055     if( pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg) ){
2056       ExprSetProperty(pExpr, pNC->ncFlags & (NC_HasAgg|NC_HasWin) );
2057       savedHasAgg |= pNC->ncFlags &
2058                           (NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
2059       pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
2060     }
2061     if( w.pParse->nErr>0 ) return WRC_Abort;
2062   }
2063   pNC->ncFlags |= savedHasAgg;
2064   return WRC_Continue;
2065 }
2066 
2067 /*
2068 ** Resolve all names in all expressions of a SELECT and in all
2069 ** decendents of the SELECT, including compounds off of p->pPrior,
2070 ** subqueries in expressions, and subqueries used as FROM clause
2071 ** terms.
2072 **
2073 ** See sqlite3ResolveExprNames() for a description of the kinds of
2074 ** transformations that occur.
2075 **
2076 ** All SELECT statements should have been expanded using
2077 ** sqlite3SelectExpand() prior to invoking this routine.
2078 */
2079 void sqlite3ResolveSelectNames(
2080   Parse *pParse,         /* The parser context */
2081   Select *p,             /* The SELECT statement being coded. */
2082   NameContext *pOuterNC  /* Name context for parent SELECT statement */
2083 ){
2084   Walker w;
2085 
2086   assert( p!=0 );
2087   w.xExprCallback = resolveExprStep;
2088   w.xSelectCallback = resolveSelectStep;
2089   w.xSelectCallback2 = 0;
2090   w.pParse = pParse;
2091   w.u.pNC = pOuterNC;
2092   sqlite3WalkSelect(&w, p);
2093 }
2094 
2095 /*
2096 ** Resolve names in expressions that can only reference a single table
2097 ** or which cannot reference any tables at all.  Examples:
2098 **
2099 **                                                    "type" flag
2100 **                                                    ------------
2101 **    (1)   CHECK constraints                         NC_IsCheck
2102 **    (2)   WHERE clauses on partial indices          NC_PartIdx
2103 **    (3)   Expressions in indexes on expressions     NC_IdxExpr
2104 **    (4)   Expression arguments to VACUUM INTO.      0
2105 **    (5)   GENERATED ALWAYS as expressions           NC_GenCol
2106 **
2107 ** In all cases except (4), the Expr.iTable value for Expr.op==TK_COLUMN
2108 ** nodes of the expression is set to -1 and the Expr.iColumn value is
2109 ** set to the column number.  In case (4), TK_COLUMN nodes cause an error.
2110 **
2111 ** Any errors cause an error message to be set in pParse.
2112 */
2113 int sqlite3ResolveSelfReference(
2114   Parse *pParse,   /* Parsing context */
2115   Table *pTab,     /* The table being referenced, or NULL */
2116   int type,        /* NC_IsCheck, NC_PartIdx, NC_IdxExpr, NC_GenCol, or 0 */
2117   Expr *pExpr,     /* Expression to resolve.  May be NULL. */
2118   ExprList *pList  /* Expression list to resolve.  May be NULL. */
2119 ){
2120   SrcList sSrc;                   /* Fake SrcList for pParse->pNewTable */
2121   NameContext sNC;                /* Name context for pParse->pNewTable */
2122   int rc;
2123 
2124   assert( type==0 || pTab!=0 );
2125   assert( type==NC_IsCheck || type==NC_PartIdx || type==NC_IdxExpr
2126           || type==NC_GenCol || pTab==0 );
2127   memset(&sNC, 0, sizeof(sNC));
2128   memset(&sSrc, 0, sizeof(sSrc));
2129   if( pTab ){
2130     sSrc.nSrc = 1;
2131     sSrc.a[0].zName = pTab->zName;
2132     sSrc.a[0].pTab = pTab;
2133     sSrc.a[0].iCursor = -1;
2134     if( pTab->pSchema!=pParse->db->aDb[1].pSchema ){
2135       /* Cause EP_FromDDL to be set on TK_FUNCTION nodes of non-TEMP
2136       ** schema elements */
2137       type |= NC_FromDDL;
2138     }
2139   }
2140   sNC.pParse = pParse;
2141   sNC.pSrcList = &sSrc;
2142   sNC.ncFlags = type | NC_IsDDL;
2143   if( (rc = sqlite3ResolveExprNames(&sNC, pExpr))!=SQLITE_OK ) return rc;
2144   if( pList ) rc = sqlite3ResolveExprListNames(&sNC, pList);
2145   return rc;
2146 }
2147