xref: /sqlite-3.40.0/src/resolve.c (revision dee0359d)
1 /*
2 ** 2008 August 18
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 **
13 ** This file contains routines used for walking the parser tree and
14 ** resolve all identifiers by associating them with a particular
15 ** table and column.
16 */
17 #include "sqliteInt.h"
18 
19 /*
20 ** Magic table number to mean the EXCLUDED table in an UPSERT statement.
21 */
22 #define EXCLUDED_TABLE_NUMBER  2
23 
24 /*
25 ** Walk the expression tree pExpr and increase the aggregate function
26 ** depth (the Expr.op2 field) by N on every TK_AGG_FUNCTION node.
27 ** This needs to occur when copying a TK_AGG_FUNCTION node from an
28 ** outer query into an inner subquery.
29 **
30 ** incrAggFunctionDepth(pExpr,n) is the main routine.  incrAggDepth(..)
31 ** is a helper function - a callback for the tree walker.
32 **
33 ** See also the sqlite3WindowExtraAggFuncDepth() routine in window.c
34 */
35 static int incrAggDepth(Walker *pWalker, Expr *pExpr){
36   if( pExpr->op==TK_AGG_FUNCTION ) pExpr->op2 += pWalker->u.n;
37   return WRC_Continue;
38 }
39 static void incrAggFunctionDepth(Expr *pExpr, int N){
40   if( N>0 ){
41     Walker w;
42     memset(&w, 0, sizeof(w));
43     w.xExprCallback = incrAggDepth;
44     w.u.n = N;
45     sqlite3WalkExpr(&w, pExpr);
46   }
47 }
48 
49 /*
50 ** Turn the pExpr expression into an alias for the iCol-th column of the
51 ** result set in pEList.
52 **
53 ** If the reference is followed by a COLLATE operator, then make sure
54 ** the COLLATE operator is preserved.  For example:
55 **
56 **     SELECT a+b, c+d FROM t1 ORDER BY 1 COLLATE nocase;
57 **
58 ** Should be transformed into:
59 **
60 **     SELECT a+b, c+d FROM t1 ORDER BY (a+b) COLLATE nocase;
61 **
62 ** The nSubquery parameter specifies how many levels of subquery the
63 ** alias is removed from the original expression.  The usual value is
64 ** zero but it might be more if the alias is contained within a subquery
65 ** of the original expression.  The Expr.op2 field of TK_AGG_FUNCTION
66 ** structures must be increased by the nSubquery amount.
67 */
68 static void resolveAlias(
69   Parse *pParse,         /* Parsing context */
70   ExprList *pEList,      /* A result set */
71   int iCol,              /* A column in the result set.  0..pEList->nExpr-1 */
72   Expr *pExpr,           /* Transform this into an alias to the result set */
73   int nSubquery          /* Number of subqueries that the label is moving */
74 ){
75   Expr *pOrig;           /* The iCol-th column of the result set */
76   Expr *pDup;            /* Copy of pOrig */
77   sqlite3 *db;           /* The database connection */
78 
79   assert( iCol>=0 && iCol<pEList->nExpr );
80   pOrig = pEList->a[iCol].pExpr;
81   assert( pOrig!=0 );
82   db = pParse->db;
83   pDup = sqlite3ExprDup(db, pOrig, 0);
84   if( db->mallocFailed ){
85     sqlite3ExprDelete(db, pDup);
86     pDup = 0;
87   }else{
88     incrAggFunctionDepth(pDup, nSubquery);
89     if( pExpr->op==TK_COLLATE ){
90       assert( !ExprHasProperty(pExpr, EP_IntValue) );
91       pDup = sqlite3ExprAddCollateString(pParse, pDup, pExpr->u.zToken);
92     }
93 
94     /* Before calling sqlite3ExprDelete(), set the EP_Static flag. This
95     ** prevents ExprDelete() from deleting the Expr structure itself,
96     ** allowing it to be repopulated by the memcpy() on the following line.
97     ** The pExpr->u.zToken might point into memory that will be freed by the
98     ** sqlite3DbFree(db, pDup) on the last line of this block, so be sure to
99     ** make a copy of the token before doing the sqlite3DbFree().
100     */
101     ExprSetProperty(pExpr, EP_Static);
102     sqlite3ExprDelete(db, pExpr);
103     memcpy(pExpr, pDup, sizeof(*pExpr));
104     if( !ExprHasProperty(pExpr, EP_IntValue) && pExpr->u.zToken!=0 ){
105       assert( (pExpr->flags & (EP_Reduced|EP_TokenOnly))==0 );
106       pExpr->u.zToken = sqlite3DbStrDup(db, pExpr->u.zToken);
107       pExpr->flags |= EP_MemToken;
108     }
109     if( ExprHasProperty(pExpr, EP_WinFunc) ){
110       if( ALWAYS(pExpr->y.pWin!=0) ){
111         pExpr->y.pWin->pOwner = pExpr;
112       }
113     }
114     sqlite3DbFree(db, pDup);
115   }
116 }
117 
118 
119 /*
120 ** Return TRUE if the name zCol occurs anywhere in the USING clause.
121 **
122 ** Return FALSE if the USING clause is NULL or if it does not contain
123 ** zCol.
124 */
125 static int nameInUsingClause(IdList *pUsing, const char *zCol){
126   if( pUsing ){
127     int k;
128     for(k=0; k<pUsing->nId; k++){
129       if( sqlite3StrICmp(pUsing->a[k].zName, zCol)==0 ) return 1;
130     }
131   }
132   return 0;
133 }
134 
135 /*
136 ** Subqueries stores the original database, table and column names for their
137 ** result sets in ExprList.a[].zSpan, in the form "DATABASE.TABLE.COLUMN".
138 ** Check to see if the zSpan given to this routine matches the zDb, zTab,
139 ** and zCol.  If any of zDb, zTab, and zCol are NULL then those fields will
140 ** match anything.
141 */
142 int sqlite3MatchEName(
143   const struct ExprList_item *pItem,
144   const char *zCol,
145   const char *zTab,
146   const char *zDb
147 ){
148   int n;
149   const char *zSpan;
150   if( pItem->eEName!=ENAME_TAB ) return 0;
151   zSpan = pItem->zEName;
152   for(n=0; ALWAYS(zSpan[n]) && zSpan[n]!='.'; n++){}
153   if( zDb && (sqlite3StrNICmp(zSpan, zDb, n)!=0 || zDb[n]!=0) ){
154     return 0;
155   }
156   zSpan += n+1;
157   for(n=0; ALWAYS(zSpan[n]) && zSpan[n]!='.'; n++){}
158   if( zTab && (sqlite3StrNICmp(zSpan, zTab, n)!=0 || zTab[n]!=0) ){
159     return 0;
160   }
161   zSpan += n+1;
162   if( zCol && sqlite3StrICmp(zSpan, zCol)!=0 ){
163     return 0;
164   }
165   return 1;
166 }
167 
168 /*
169 ** Return TRUE if the double-quoted string  mis-feature should be supported.
170 */
171 static int areDoubleQuotedStringsEnabled(sqlite3 *db, NameContext *pTopNC){
172   if( db->init.busy ) return 1;  /* Always support for legacy schemas */
173   if( pTopNC->ncFlags & NC_IsDDL ){
174     /* Currently parsing a DDL statement */
175     if( sqlite3WritableSchema(db) && (db->flags & SQLITE_DqsDML)!=0 ){
176       return 1;
177     }
178     return (db->flags & SQLITE_DqsDDL)!=0;
179   }else{
180     /* Currently parsing a DML statement */
181     return (db->flags & SQLITE_DqsDML)!=0;
182   }
183 }
184 
185 /*
186 ** The argument is guaranteed to be a non-NULL Expr node of type TK_COLUMN.
187 ** return the appropriate colUsed mask.
188 */
189 Bitmask sqlite3ExprColUsed(Expr *pExpr){
190   int n;
191   Table *pExTab;
192 
193   n = pExpr->iColumn;
194   assert( ExprUseYTab(pExpr) );
195   pExTab = pExpr->y.pTab;
196   assert( pExTab!=0 );
197   if( (pExTab->tabFlags & TF_HasGenerated)!=0
198    && (pExTab->aCol[n].colFlags & COLFLAG_GENERATED)!=0
199   ){
200     testcase( pExTab->nCol==BMS-1 );
201     testcase( pExTab->nCol==BMS );
202     return pExTab->nCol>=BMS ? ALLBITS : MASKBIT(pExTab->nCol)-1;
203   }else{
204     testcase( n==BMS-1 );
205     testcase( n==BMS );
206     if( n>=BMS ) n = BMS-1;
207     return ((Bitmask)1)<<n;
208   }
209 }
210 
211 /*
212 ** Given the name of a column of the form X.Y.Z or Y.Z or just Z, look up
213 ** that name in the set of source tables in pSrcList and make the pExpr
214 ** expression node refer back to that source column.  The following changes
215 ** are made to pExpr:
216 **
217 **    pExpr->iDb           Set the index in db->aDb[] of the database X
218 **                         (even if X is implied).
219 **    pExpr->iTable        Set to the cursor number for the table obtained
220 **                         from pSrcList.
221 **    pExpr->y.pTab        Points to the Table structure of X.Y (even if
222 **                         X and/or Y are implied.)
223 **    pExpr->iColumn       Set to the column number within the table.
224 **    pExpr->op            Set to TK_COLUMN.
225 **    pExpr->pLeft         Any expression this points to is deleted
226 **    pExpr->pRight        Any expression this points to is deleted.
227 **
228 ** The zDb variable is the name of the database (the "X").  This value may be
229 ** NULL meaning that name is of the form Y.Z or Z.  Any available database
230 ** can be used.  The zTable variable is the name of the table (the "Y").  This
231 ** value can be NULL if zDb is also NULL.  If zTable is NULL it
232 ** means that the form of the name is Z and that columns from any table
233 ** can be used.
234 **
235 ** If the name cannot be resolved unambiguously, leave an error message
236 ** in pParse and return WRC_Abort.  Return WRC_Prune on success.
237 */
238 static int lookupName(
239   Parse *pParse,       /* The parsing context */
240   const char *zDb,     /* Name of the database containing table, or NULL */
241   const char *zTab,    /* Name of table containing column, or NULL */
242   const char *zCol,    /* Name of the column. */
243   NameContext *pNC,    /* The name context used to resolve the name */
244   Expr *pExpr          /* Make this EXPR node point to the selected column */
245 ){
246   int i, j;                         /* Loop counters */
247   int cnt = 0;                      /* Number of matching column names */
248   int cntTab = 0;                   /* Number of matching table names */
249   int nSubquery = 0;                /* How many levels of subquery */
250   sqlite3 *db = pParse->db;         /* The database connection */
251   SrcItem *pItem;                   /* Use for looping over pSrcList items */
252   SrcItem *pMatch = 0;              /* The matching pSrcList item */
253   NameContext *pTopNC = pNC;        /* First namecontext in the list */
254   Schema *pSchema = 0;              /* Schema of the expression */
255   int eNewExprOp = TK_COLUMN;       /* New value for pExpr->op on success */
256   Table *pTab = 0;                  /* Table hold the row */
257   Column *pCol;                     /* A column of pTab */
258 
259   assert( pNC );     /* the name context cannot be NULL. */
260   assert( zCol );    /* The Z in X.Y.Z cannot be NULL */
261   assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
262 
263   /* Initialize the node to no-match */
264   pExpr->iTable = -1;
265   ExprSetVVAProperty(pExpr, EP_NoReduce);
266 
267   /* Translate the schema name in zDb into a pointer to the corresponding
268   ** schema.  If not found, pSchema will remain NULL and nothing will match
269   ** resulting in an appropriate error message toward the end of this routine
270   */
271   if( zDb ){
272     testcase( pNC->ncFlags & NC_PartIdx );
273     testcase( pNC->ncFlags & NC_IsCheck );
274     if( (pNC->ncFlags & (NC_PartIdx|NC_IsCheck))!=0 ){
275       /* Silently ignore database qualifiers inside CHECK constraints and
276       ** partial indices.  Do not raise errors because that might break
277       ** legacy and because it does not hurt anything to just ignore the
278       ** database name. */
279       zDb = 0;
280     }else{
281       for(i=0; i<db->nDb; i++){
282         assert( db->aDb[i].zDbSName );
283         if( sqlite3StrICmp(db->aDb[i].zDbSName,zDb)==0 ){
284           pSchema = db->aDb[i].pSchema;
285           break;
286         }
287       }
288       if( i==db->nDb && sqlite3StrICmp("main", zDb)==0 ){
289         /* This branch is taken when the main database has been renamed
290         ** using SQLITE_DBCONFIG_MAINDBNAME. */
291         pSchema = db->aDb[0].pSchema;
292         zDb = db->aDb[0].zDbSName;
293       }
294     }
295   }
296 
297   /* Start at the inner-most context and move outward until a match is found */
298   assert( pNC && cnt==0 );
299   do{
300     ExprList *pEList;
301     SrcList *pSrcList = pNC->pSrcList;
302 
303     if( pSrcList ){
304       for(i=0, pItem=pSrcList->a; i<pSrcList->nSrc; i++, pItem++){
305         u8 hCol;
306         pTab = pItem->pTab;
307         assert( pTab!=0 && pTab->zName!=0 );
308         assert( pTab->nCol>0 || pParse->nErr );
309         if( pItem->pSelect && (pItem->pSelect->selFlags & SF_NestedFrom)!=0 ){
310           int hit = 0;
311           pEList = pItem->pSelect->pEList;
312           for(j=0; j<pEList->nExpr; j++){
313             if( sqlite3MatchEName(&pEList->a[j], zCol, zTab, zDb) ){
314               cnt++;
315               cntTab = 2;
316               pMatch = pItem;
317               pExpr->iColumn = j;
318               hit = 1;
319             }
320           }
321           if( hit || zTab==0 ) continue;
322         }
323         if( zDb && pTab->pSchema!=pSchema ){
324           continue;
325         }
326         if( zTab ){
327           const char *zTabName = pItem->zAlias ? pItem->zAlias : pTab->zName;
328           assert( zTabName!=0 );
329           if( sqlite3StrICmp(zTabName, zTab)!=0 ){
330             continue;
331           }
332           assert( ExprUseYTab(pExpr) );
333           if( IN_RENAME_OBJECT && pItem->zAlias ){
334             sqlite3RenameTokenRemap(pParse, 0, (void*)&pExpr->y.pTab);
335           }
336         }
337         hCol = sqlite3StrIHash(zCol);
338         for(j=0, pCol=pTab->aCol; j<pTab->nCol; j++, pCol++){
339           if( pCol->hName==hCol
340            && sqlite3StrICmp(pCol->zCnName, zCol)==0
341           ){
342             /* If there has been exactly one prior match and this match
343             ** is for the right-hand table of a NATURAL JOIN or is in a
344             ** USING clause, then skip this match.
345             */
346             if( cnt==1 ){
347               if( pItem->fg.jointype & JT_NATURAL ) continue;
348               if( nameInUsingClause(pItem->pUsing, zCol) ) continue;
349             }
350             cnt++;
351             pMatch = pItem;
352             /* Substitute the rowid (column -1) for the INTEGER PRIMARY KEY */
353             pExpr->iColumn = j==pTab->iPKey ? -1 : (i16)j;
354             break;
355           }
356         }
357         if( 0==cnt && VisibleRowid(pTab) ){
358           cntTab++;
359           pMatch = pItem;
360         }
361       }
362       if( pMatch ){
363         pExpr->iTable = pMatch->iCursor;
364         assert( ExprUseYTab(pExpr) );
365         pExpr->y.pTab = pMatch->pTab;
366         /* RIGHT JOIN not (yet) supported */
367         assert( (pMatch->fg.jointype & JT_RIGHT)==0 );
368         if( (pMatch->fg.jointype & JT_LEFT)!=0 ){
369           ExprSetProperty(pExpr, EP_CanBeNull);
370         }
371         pSchema = pExpr->y.pTab->pSchema;
372       }
373     } /* if( pSrcList ) */
374 
375 #if !defined(SQLITE_OMIT_TRIGGER) || !defined(SQLITE_OMIT_UPSERT)
376     /* If we have not already resolved the name, then maybe
377     ** it is a new.* or old.* trigger argument reference.  Or
378     ** maybe it is an excluded.* from an upsert.  Or maybe it is
379     ** a reference in the RETURNING clause to a table being modified.
380     */
381     if( cnt==0 && zDb==0 ){
382       pTab = 0;
383 #ifndef SQLITE_OMIT_TRIGGER
384       if( pParse->pTriggerTab!=0 ){
385         int op = pParse->eTriggerOp;
386         assert( op==TK_DELETE || op==TK_UPDATE || op==TK_INSERT );
387         if( pParse->bReturning ){
388           if( (pNC->ncFlags & NC_UBaseReg)!=0
389            && (zTab==0 || sqlite3StrICmp(zTab,pParse->pTriggerTab->zName)==0)
390           ){
391             pExpr->iTable = op!=TK_DELETE;
392             pTab = pParse->pTriggerTab;
393           }
394         }else if( op!=TK_DELETE && zTab && sqlite3StrICmp("new",zTab) == 0 ){
395           pExpr->iTable = 1;
396           pTab = pParse->pTriggerTab;
397         }else if( op!=TK_INSERT && zTab && sqlite3StrICmp("old",zTab)==0 ){
398           pExpr->iTable = 0;
399           pTab = pParse->pTriggerTab;
400         }
401       }
402 #endif /* SQLITE_OMIT_TRIGGER */
403 #ifndef SQLITE_OMIT_UPSERT
404       if( (pNC->ncFlags & NC_UUpsert)!=0 && zTab!=0 ){
405         Upsert *pUpsert = pNC->uNC.pUpsert;
406         if( pUpsert && sqlite3StrICmp("excluded",zTab)==0 ){
407           pTab = pUpsert->pUpsertSrc->a[0].pTab;
408           pExpr->iTable = EXCLUDED_TABLE_NUMBER;
409         }
410       }
411 #endif /* SQLITE_OMIT_UPSERT */
412 
413       if( pTab ){
414         int iCol;
415         u8 hCol = sqlite3StrIHash(zCol);
416         pSchema = pTab->pSchema;
417         cntTab++;
418         for(iCol=0, pCol=pTab->aCol; iCol<pTab->nCol; iCol++, pCol++){
419           if( pCol->hName==hCol
420            && sqlite3StrICmp(pCol->zCnName, zCol)==0
421           ){
422             if( iCol==pTab->iPKey ){
423               iCol = -1;
424             }
425             break;
426           }
427         }
428         if( iCol>=pTab->nCol && sqlite3IsRowid(zCol) && VisibleRowid(pTab) ){
429           /* IMP: R-51414-32910 */
430           iCol = -1;
431         }
432         if( iCol<pTab->nCol ){
433           cnt++;
434           pMatch = 0;
435 #ifndef SQLITE_OMIT_UPSERT
436           if( pExpr->iTable==EXCLUDED_TABLE_NUMBER ){
437             testcase( iCol==(-1) );
438             assert( ExprUseYTab(pExpr) );
439             if( IN_RENAME_OBJECT ){
440               pExpr->iColumn = iCol;
441               pExpr->y.pTab = pTab;
442               eNewExprOp = TK_COLUMN;
443             }else{
444               pExpr->iTable = pNC->uNC.pUpsert->regData +
445                  sqlite3TableColumnToStorage(pTab, iCol);
446               eNewExprOp = TK_REGISTER;
447             }
448           }else
449 #endif /* SQLITE_OMIT_UPSERT */
450           {
451             assert( ExprUseYTab(pExpr) );
452             pExpr->y.pTab = pTab;
453             if( pParse->bReturning ){
454               eNewExprOp = TK_REGISTER;
455               pExpr->iTable = pNC->uNC.iBaseReg + (pTab->nCol+1)*pExpr->iTable +
456                  sqlite3TableColumnToStorage(pTab, iCol) + 1;
457             }else{
458               pExpr->iColumn = (i16)iCol;
459               eNewExprOp = TK_TRIGGER;
460 #ifndef SQLITE_OMIT_TRIGGER
461               if( iCol<0 ){
462                 pExpr->affExpr = SQLITE_AFF_INTEGER;
463               }else if( pExpr->iTable==0 ){
464                 testcase( iCol==31 );
465                 testcase( iCol==32 );
466                 pParse->oldmask |= (iCol>=32 ? 0xffffffff : (((u32)1)<<iCol));
467               }else{
468                 testcase( iCol==31 );
469                 testcase( iCol==32 );
470                 pParse->newmask |= (iCol>=32 ? 0xffffffff : (((u32)1)<<iCol));
471               }
472 #endif /* SQLITE_OMIT_TRIGGER */
473             }
474           }
475         }
476       }
477     }
478 #endif /* !defined(SQLITE_OMIT_TRIGGER) || !defined(SQLITE_OMIT_UPSERT) */
479 
480     /*
481     ** Perhaps the name is a reference to the ROWID
482     */
483     if( cnt==0
484      && cntTab==1
485      && pMatch
486      && (pNC->ncFlags & (NC_IdxExpr|NC_GenCol))==0
487      && sqlite3IsRowid(zCol)
488      && ALWAYS(VisibleRowid(pMatch->pTab))
489     ){
490       cnt = 1;
491       pExpr->iColumn = -1;
492       pExpr->affExpr = SQLITE_AFF_INTEGER;
493     }
494 
495     /*
496     ** If the input is of the form Z (not Y.Z or X.Y.Z) then the name Z
497     ** might refer to an result-set alias.  This happens, for example, when
498     ** we are resolving names in the WHERE clause of the following command:
499     **
500     **     SELECT a+b AS x FROM table WHERE x<10;
501     **
502     ** In cases like this, replace pExpr with a copy of the expression that
503     ** forms the result set entry ("a+b" in the example) and return immediately.
504     ** Note that the expression in the result set should have already been
505     ** resolved by the time the WHERE clause is resolved.
506     **
507     ** The ability to use an output result-set column in the WHERE, GROUP BY,
508     ** or HAVING clauses, or as part of a larger expression in the ORDER BY
509     ** clause is not standard SQL.  This is a (goofy) SQLite extension, that
510     ** is supported for backwards compatibility only. Hence, we issue a warning
511     ** on sqlite3_log() whenever the capability is used.
512     */
513     if( cnt==0
514      && (pNC->ncFlags & NC_UEList)!=0
515      && zTab==0
516     ){
517       pEList = pNC->uNC.pEList;
518       assert( pEList!=0 );
519       for(j=0; j<pEList->nExpr; j++){
520         char *zAs = pEList->a[j].zEName;
521         if( pEList->a[j].eEName==ENAME_NAME
522          && sqlite3_stricmp(zAs, zCol)==0
523         ){
524           Expr *pOrig;
525           assert( pExpr->pLeft==0 && pExpr->pRight==0 );
526           assert( ExprUseXList(pExpr)==0 || pExpr->x.pList==0 );
527           assert( ExprUseXSelect(pExpr)==0 || pExpr->x.pSelect==0 );
528           pOrig = pEList->a[j].pExpr;
529           if( (pNC->ncFlags&NC_AllowAgg)==0 && ExprHasProperty(pOrig, EP_Agg) ){
530             sqlite3ErrorMsg(pParse, "misuse of aliased aggregate %s", zAs);
531             return WRC_Abort;
532           }
533           if( ExprHasProperty(pOrig, EP_Win)
534            && ((pNC->ncFlags&NC_AllowWin)==0 || pNC!=pTopNC )
535           ){
536             sqlite3ErrorMsg(pParse, "misuse of aliased window function %s",zAs);
537             return WRC_Abort;
538           }
539           if( sqlite3ExprVectorSize(pOrig)!=1 ){
540             sqlite3ErrorMsg(pParse, "row value misused");
541             return WRC_Abort;
542           }
543           resolveAlias(pParse, pEList, j, pExpr, nSubquery);
544           cnt = 1;
545           pMatch = 0;
546           assert( zTab==0 && zDb==0 );
547           if( IN_RENAME_OBJECT ){
548             sqlite3RenameTokenRemap(pParse, 0, (void*)pExpr);
549           }
550           goto lookupname_end;
551         }
552       }
553     }
554 
555     /* Advance to the next name context.  The loop will exit when either
556     ** we have a match (cnt>0) or when we run out of name contexts.
557     */
558     if( cnt ) break;
559     pNC = pNC->pNext;
560     nSubquery++;
561   }while( pNC );
562 
563 
564   /*
565   ** If X and Y are NULL (in other words if only the column name Z is
566   ** supplied) and the value of Z is enclosed in double-quotes, then
567   ** Z is a string literal if it doesn't match any column names.  In that
568   ** case, we need to return right away and not make any changes to
569   ** pExpr.
570   **
571   ** Because no reference was made to outer contexts, the pNC->nRef
572   ** fields are not changed in any context.
573   */
574   if( cnt==0 && zTab==0 ){
575     assert( pExpr->op==TK_ID );
576     if( ExprHasProperty(pExpr,EP_DblQuoted)
577      && areDoubleQuotedStringsEnabled(db, pTopNC)
578     ){
579       /* If a double-quoted identifier does not match any known column name,
580       ** then treat it as a string.
581       **
582       ** This hack was added in the early days of SQLite in a misguided attempt
583       ** to be compatible with MySQL 3.x, which used double-quotes for strings.
584       ** I now sorely regret putting in this hack. The effect of this hack is
585       ** that misspelled identifier names are silently converted into strings
586       ** rather than causing an error, to the frustration of countless
587       ** programmers. To all those frustrated programmers, my apologies.
588       **
589       ** Someday, I hope to get rid of this hack. Unfortunately there is
590       ** a huge amount of legacy SQL that uses it. So for now, we just
591       ** issue a warning.
592       */
593       sqlite3_log(SQLITE_WARNING,
594         "double-quoted string literal: \"%w\"", zCol);
595 #ifdef SQLITE_ENABLE_NORMALIZE
596       sqlite3VdbeAddDblquoteStr(db, pParse->pVdbe, zCol);
597 #endif
598       pExpr->op = TK_STRING;
599       memset(&pExpr->y, 0, sizeof(pExpr->y));
600       return WRC_Prune;
601     }
602     if( sqlite3ExprIdToTrueFalse(pExpr) ){
603       return WRC_Prune;
604     }
605   }
606 
607   /*
608   ** cnt==0 means there was not match.  cnt>1 means there were two or
609   ** more matches.  Either way, we have an error.
610   */
611   if( cnt!=1 ){
612     const char *zErr;
613     zErr = cnt==0 ? "no such column" : "ambiguous column name";
614     if( zDb ){
615       sqlite3ErrorMsg(pParse, "%s: %s.%s.%s", zErr, zDb, zTab, zCol);
616     }else if( zTab ){
617       sqlite3ErrorMsg(pParse, "%s: %s.%s", zErr, zTab, zCol);
618     }else{
619       sqlite3ErrorMsg(pParse, "%s: %s", zErr, zCol);
620     }
621     pParse->checkSchema = 1;
622     pTopNC->nNcErr++;
623   }
624 
625   /* If a column from a table in pSrcList is referenced, then record
626   ** this fact in the pSrcList.a[].colUsed bitmask.  Column 0 causes
627   ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.  Bit 63 is
628   ** set if the 63rd or any subsequent column is used.
629   **
630   ** The colUsed mask is an optimization used to help determine if an
631   ** index is a covering index.  The correct answer is still obtained
632   ** if the mask contains extra set bits.  However, it is important to
633   ** avoid setting bits beyond the maximum column number of the table.
634   ** (See ticket [b92e5e8ec2cdbaa1]).
635   **
636   ** If a generated column is referenced, set bits for every column
637   ** of the table.
638   */
639   if( pExpr->iColumn>=0 && pMatch!=0 ){
640     pMatch->colUsed |= sqlite3ExprColUsed(pExpr);
641   }
642 
643   /* Clean up and return
644   */
645   if( !ExprHasProperty(pExpr,(EP_TokenOnly|EP_Leaf)) ){
646     sqlite3ExprDelete(db, pExpr->pLeft);
647     pExpr->pLeft = 0;
648     sqlite3ExprDelete(db, pExpr->pRight);
649     pExpr->pRight = 0;
650   }
651   pExpr->op = eNewExprOp;
652   ExprSetProperty(pExpr, EP_Leaf);
653 lookupname_end:
654   if( cnt==1 ){
655     assert( pNC!=0 );
656 #ifndef SQLITE_OMIT_AUTHORIZATION
657     if( pParse->db->xAuth
658      && (pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER)
659     ){
660       sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList);
661     }
662 #endif
663     /* Increment the nRef value on all name contexts from TopNC up to
664     ** the point where the name matched. */
665     for(;;){
666       assert( pTopNC!=0 );
667       pTopNC->nRef++;
668       if( pTopNC==pNC ) break;
669       pTopNC = pTopNC->pNext;
670     }
671     return WRC_Prune;
672   } else {
673     return WRC_Abort;
674   }
675 }
676 
677 /*
678 ** Allocate and return a pointer to an expression to load the column iCol
679 ** from datasource iSrc in SrcList pSrc.
680 */
681 Expr *sqlite3CreateColumnExpr(sqlite3 *db, SrcList *pSrc, int iSrc, int iCol){
682   Expr *p = sqlite3ExprAlloc(db, TK_COLUMN, 0, 0);
683   if( p ){
684     SrcItem *pItem = &pSrc->a[iSrc];
685     Table *pTab;
686     assert( ExprUseYTab(p) );
687     pTab = p->y.pTab = pItem->pTab;
688     p->iTable = pItem->iCursor;
689     if( p->y.pTab->iPKey==iCol ){
690       p->iColumn = -1;
691     }else{
692       p->iColumn = (ynVar)iCol;
693       if( (pTab->tabFlags & TF_HasGenerated)!=0
694        && (pTab->aCol[iCol].colFlags & COLFLAG_GENERATED)!=0
695       ){
696         testcase( pTab->nCol==63 );
697         testcase( pTab->nCol==64 );
698         pItem->colUsed = pTab->nCol>=64 ? ALLBITS : MASKBIT(pTab->nCol)-1;
699       }else{
700         testcase( iCol==BMS );
701         testcase( iCol==BMS-1 );
702         pItem->colUsed |= ((Bitmask)1)<<(iCol>=BMS ? BMS-1 : iCol);
703       }
704     }
705   }
706   return p;
707 }
708 
709 /*
710 ** Report an error that an expression is not valid for some set of
711 ** pNC->ncFlags values determined by validMask.
712 **
713 ** static void notValid(
714 **   Parse *pParse,       // Leave error message here
715 **   NameContext *pNC,    // The name context
716 **   const char *zMsg,    // Type of error
717 **   int validMask,       // Set of contexts for which prohibited
718 **   Expr *pExpr          // Invalidate this expression on error
719 ** ){...}
720 **
721 ** As an optimization, since the conditional is almost always false
722 ** (because errors are rare), the conditional is moved outside of the
723 ** function call using a macro.
724 */
725 static void notValidImpl(
726    Parse *pParse,       /* Leave error message here */
727    NameContext *pNC,    /* The name context */
728    const char *zMsg,    /* Type of error */
729    Expr *pExpr          /* Invalidate this expression on error */
730 ){
731   const char *zIn = "partial index WHERE clauses";
732   if( pNC->ncFlags & NC_IdxExpr )      zIn = "index expressions";
733 #ifndef SQLITE_OMIT_CHECK
734   else if( pNC->ncFlags & NC_IsCheck ) zIn = "CHECK constraints";
735 #endif
736 #ifndef SQLITE_OMIT_GENERATED_COLUMNS
737   else if( pNC->ncFlags & NC_GenCol ) zIn = "generated columns";
738 #endif
739   sqlite3ErrorMsg(pParse, "%s prohibited in %s", zMsg, zIn);
740   if( pExpr ) pExpr->op = TK_NULL;
741 }
742 #define sqlite3ResolveNotValid(P,N,M,X,E) \
743   assert( ((X)&~(NC_IsCheck|NC_PartIdx|NC_IdxExpr|NC_GenCol))==0 ); \
744   if( ((N)->ncFlags & (X))!=0 ) notValidImpl(P,N,M,E);
745 
746 /*
747 ** Expression p should encode a floating point value between 1.0 and 0.0.
748 ** Return 1024 times this value.  Or return -1 if p is not a floating point
749 ** value between 1.0 and 0.0.
750 */
751 static int exprProbability(Expr *p){
752   double r = -1.0;
753   if( p->op!=TK_FLOAT ) return -1;
754   assert( !ExprHasProperty(p, EP_IntValue) );
755   sqlite3AtoF(p->u.zToken, &r, sqlite3Strlen30(p->u.zToken), SQLITE_UTF8);
756   assert( r>=0.0 );
757   if( r>1.0 ) return -1;
758   return (int)(r*134217728.0);
759 }
760 
761 /*
762 ** This routine is callback for sqlite3WalkExpr().
763 **
764 ** Resolve symbolic names into TK_COLUMN operators for the current
765 ** node in the expression tree.  Return 0 to continue the search down
766 ** the tree or 2 to abort the tree walk.
767 **
768 ** This routine also does error checking and name resolution for
769 ** function names.  The operator for aggregate functions is changed
770 ** to TK_AGG_FUNCTION.
771 */
772 static int resolveExprStep(Walker *pWalker, Expr *pExpr){
773   NameContext *pNC;
774   Parse *pParse;
775 
776   pNC = pWalker->u.pNC;
777   assert( pNC!=0 );
778   pParse = pNC->pParse;
779   assert( pParse==pWalker->pParse );
780 
781 #ifndef NDEBUG
782   if( pNC->pSrcList && pNC->pSrcList->nAlloc>0 ){
783     SrcList *pSrcList = pNC->pSrcList;
784     int i;
785     for(i=0; i<pNC->pSrcList->nSrc; i++){
786       assert( pSrcList->a[i].iCursor>=0 && pSrcList->a[i].iCursor<pParse->nTab);
787     }
788   }
789 #endif
790   switch( pExpr->op ){
791 
792     /* The special operator TK_ROW means use the rowid for the first
793     ** column in the FROM clause.  This is used by the LIMIT and ORDER BY
794     ** clause processing on UPDATE and DELETE statements, and by
795     ** UPDATE ... FROM statement processing.
796     */
797     case TK_ROW: {
798       SrcList *pSrcList = pNC->pSrcList;
799       SrcItem *pItem;
800       assert( pSrcList && pSrcList->nSrc>=1 );
801       pItem = pSrcList->a;
802       pExpr->op = TK_COLUMN;
803       assert( ExprUseYTab(pExpr) );
804       pExpr->y.pTab = pItem->pTab;
805       pExpr->iTable = pItem->iCursor;
806       pExpr->iColumn--;
807       pExpr->affExpr = SQLITE_AFF_INTEGER;
808       break;
809     }
810 
811     /* An optimization:  Attempt to convert
812     **
813     **      "expr IS NOT NULL"  -->  "TRUE"
814     **      "expr IS NULL"      -->  "FALSE"
815     **
816     ** if we can prove that "expr" is never NULL.  Call this the
817     ** "NOT NULL strength reduction optimization".
818     **
819     ** If this optimization occurs, also restore the NameContext ref-counts
820     ** to the state they where in before the "column" LHS expression was
821     ** resolved.  This prevents "column" from being counted as having been
822     ** referenced, which might prevent a SELECT from being erroneously
823     ** marked as correlated.
824     */
825     case TK_NOTNULL:
826     case TK_ISNULL: {
827       int anRef[8];
828       NameContext *p;
829       int i;
830       for(i=0, p=pNC; p && i<ArraySize(anRef); p=p->pNext, i++){
831         anRef[i] = p->nRef;
832       }
833       sqlite3WalkExpr(pWalker, pExpr->pLeft);
834       if( 0==sqlite3ExprCanBeNull(pExpr->pLeft) && !IN_RENAME_OBJECT ){
835         testcase( ExprHasProperty(pExpr, EP_FromJoin) );
836         assert( !ExprHasProperty(pExpr, EP_IntValue) );
837         if( pExpr->op==TK_NOTNULL ){
838           pExpr->u.zToken = "true";
839           ExprSetProperty(pExpr, EP_IsTrue);
840         }else{
841           pExpr->u.zToken = "false";
842           ExprSetProperty(pExpr, EP_IsFalse);
843         }
844         pExpr->op = TK_TRUEFALSE;
845         for(i=0, p=pNC; p && i<ArraySize(anRef); p=p->pNext, i++){
846           p->nRef = anRef[i];
847         }
848         sqlite3ExprDelete(pParse->db, pExpr->pLeft);
849         pExpr->pLeft = 0;
850       }
851       return WRC_Prune;
852     }
853 
854     /* A column name:                    ID
855     ** Or table name and column name:    ID.ID
856     ** Or a database, table and column:  ID.ID.ID
857     **
858     ** The TK_ID and TK_OUT cases are combined so that there will only
859     ** be one call to lookupName().  Then the compiler will in-line
860     ** lookupName() for a size reduction and performance increase.
861     */
862     case TK_ID:
863     case TK_DOT: {
864       const char *zColumn;
865       const char *zTable;
866       const char *zDb;
867       Expr *pRight;
868 
869       if( pExpr->op==TK_ID ){
870         zDb = 0;
871         zTable = 0;
872         assert( !ExprHasProperty(pExpr, EP_IntValue) );
873         zColumn = pExpr->u.zToken;
874       }else{
875         Expr *pLeft = pExpr->pLeft;
876         testcase( pNC->ncFlags & NC_IdxExpr );
877         testcase( pNC->ncFlags & NC_GenCol );
878         sqlite3ResolveNotValid(pParse, pNC, "the \".\" operator",
879                                NC_IdxExpr|NC_GenCol, 0);
880         pRight = pExpr->pRight;
881         if( pRight->op==TK_ID ){
882           zDb = 0;
883         }else{
884           assert( pRight->op==TK_DOT );
885           assert( !ExprHasProperty(pRight, EP_IntValue) );
886           zDb = pLeft->u.zToken;
887           pLeft = pRight->pLeft;
888           pRight = pRight->pRight;
889         }
890         assert( ExprUseUToken(pLeft) && ExprUseUToken(pRight) );
891         zTable = pLeft->u.zToken;
892         zColumn = pRight->u.zToken;
893         assert( ExprUseYTab(pExpr) );
894         if( IN_RENAME_OBJECT ){
895           sqlite3RenameTokenRemap(pParse, (void*)pExpr, (void*)pRight);
896           sqlite3RenameTokenRemap(pParse, (void*)&pExpr->y.pTab, (void*)pLeft);
897         }
898       }
899       return lookupName(pParse, zDb, zTable, zColumn, pNC, pExpr);
900     }
901 
902     /* Resolve function names
903     */
904     case TK_FUNCTION: {
905       ExprList *pList = pExpr->x.pList;    /* The argument list */
906       int n = pList ? pList->nExpr : 0;    /* Number of arguments */
907       int no_such_func = 0;       /* True if no such function exists */
908       int wrong_num_args = 0;     /* True if wrong number of arguments */
909       int is_agg = 0;             /* True if is an aggregate function */
910       int nId;                    /* Number of characters in function name */
911       const char *zId;            /* The function name. */
912       FuncDef *pDef;              /* Information about the function */
913       u8 enc = ENC(pParse->db);   /* The database encoding */
914       int savedAllowFlags = (pNC->ncFlags & (NC_AllowAgg | NC_AllowWin));
915 #ifndef SQLITE_OMIT_WINDOWFUNC
916       Window *pWin = (IsWindowFunc(pExpr) ? pExpr->y.pWin : 0);
917 #endif
918       assert( !ExprHasProperty(pExpr, EP_xIsSelect|EP_IntValue) );
919       zId = pExpr->u.zToken;
920       nId = sqlite3Strlen30(zId);
921       pDef = sqlite3FindFunction(pParse->db, zId, n, enc, 0);
922       if( pDef==0 ){
923         pDef = sqlite3FindFunction(pParse->db, zId, -2, enc, 0);
924         if( pDef==0 ){
925           no_such_func = 1;
926         }else{
927           wrong_num_args = 1;
928         }
929       }else{
930         is_agg = pDef->xFinalize!=0;
931         if( pDef->funcFlags & SQLITE_FUNC_UNLIKELY ){
932           ExprSetProperty(pExpr, EP_Unlikely);
933           if( n==2 ){
934             pExpr->iTable = exprProbability(pList->a[1].pExpr);
935             if( pExpr->iTable<0 ){
936               sqlite3ErrorMsg(pParse,
937                 "second argument to likelihood() must be a "
938                 "constant between 0.0 and 1.0");
939               pNC->nNcErr++;
940             }
941           }else{
942             /* EVIDENCE-OF: R-61304-29449 The unlikely(X) function is
943             ** equivalent to likelihood(X, 0.0625).
944             ** EVIDENCE-OF: R-01283-11636 The unlikely(X) function is
945             ** short-hand for likelihood(X,0.0625).
946             ** EVIDENCE-OF: R-36850-34127 The likely(X) function is short-hand
947             ** for likelihood(X,0.9375).
948             ** EVIDENCE-OF: R-53436-40973 The likely(X) function is equivalent
949             ** to likelihood(X,0.9375). */
950             /* TUNING: unlikely() probability is 0.0625.  likely() is 0.9375 */
951             pExpr->iTable = pDef->zName[0]=='u' ? 8388608 : 125829120;
952           }
953         }
954 #ifndef SQLITE_OMIT_AUTHORIZATION
955         {
956           int auth = sqlite3AuthCheck(pParse, SQLITE_FUNCTION, 0,pDef->zName,0);
957           if( auth!=SQLITE_OK ){
958             if( auth==SQLITE_DENY ){
959               sqlite3ErrorMsg(pParse, "not authorized to use function: %s",
960                                       pDef->zName);
961               pNC->nNcErr++;
962             }
963             pExpr->op = TK_NULL;
964             return WRC_Prune;
965           }
966         }
967 #endif
968         if( pDef->funcFlags & (SQLITE_FUNC_CONSTANT|SQLITE_FUNC_SLOCHNG) ){
969           /* For the purposes of the EP_ConstFunc flag, date and time
970           ** functions and other functions that change slowly are considered
971           ** constant because they are constant for the duration of one query.
972           ** This allows them to be factored out of inner loops. */
973           ExprSetProperty(pExpr,EP_ConstFunc);
974         }
975         if( (pDef->funcFlags & SQLITE_FUNC_CONSTANT)==0 ){
976           /* Clearly non-deterministic functions like random(), but also
977           ** date/time functions that use 'now', and other functions like
978           ** sqlite_version() that might change over time cannot be used
979           ** in an index or generated column.  Curiously, they can be used
980           ** in a CHECK constraint.  SQLServer, MySQL, and PostgreSQL all
981           ** all this. */
982           sqlite3ResolveNotValid(pParse, pNC, "non-deterministic functions",
983                                  NC_IdxExpr|NC_PartIdx|NC_GenCol, 0);
984         }else{
985           assert( (NC_SelfRef & 0xff)==NC_SelfRef ); /* Must fit in 8 bits */
986           pExpr->op2 = pNC->ncFlags & NC_SelfRef;
987           if( pNC->ncFlags & NC_FromDDL ) ExprSetProperty(pExpr, EP_FromDDL);
988         }
989         if( (pDef->funcFlags & SQLITE_FUNC_INTERNAL)!=0
990          && pParse->nested==0
991          && (pParse->db->mDbFlags & DBFLAG_InternalFunc)==0
992         ){
993           /* Internal-use-only functions are disallowed unless the
994           ** SQL is being compiled using sqlite3NestedParse() or
995           ** the SQLITE_TESTCTRL_INTERNAL_FUNCTIONS test-control has be
996           ** used to activate internal functionsn for testing purposes */
997           no_such_func = 1;
998           pDef = 0;
999         }else
1000         if( (pDef->funcFlags & (SQLITE_FUNC_DIRECT|SQLITE_FUNC_UNSAFE))!=0
1001          && !IN_RENAME_OBJECT
1002         ){
1003           sqlite3ExprFunctionUsable(pParse, pExpr, pDef);
1004         }
1005       }
1006 
1007       if( 0==IN_RENAME_OBJECT ){
1008 #ifndef SQLITE_OMIT_WINDOWFUNC
1009         assert( is_agg==0 || (pDef->funcFlags & SQLITE_FUNC_MINMAX)
1010           || (pDef->xValue==0 && pDef->xInverse==0)
1011           || (pDef->xValue && pDef->xInverse && pDef->xSFunc && pDef->xFinalize)
1012         );
1013         if( pDef && pDef->xValue==0 && pWin ){
1014           sqlite3ErrorMsg(pParse,
1015               "%.*s() may not be used as a window function", nId, zId
1016           );
1017           pNC->nNcErr++;
1018         }else if(
1019               (is_agg && (pNC->ncFlags & NC_AllowAgg)==0)
1020            || (is_agg && (pDef->funcFlags&SQLITE_FUNC_WINDOW) && !pWin)
1021            || (is_agg && pWin && (pNC->ncFlags & NC_AllowWin)==0)
1022         ){
1023           const char *zType;
1024           if( (pDef->funcFlags & SQLITE_FUNC_WINDOW) || pWin ){
1025             zType = "window";
1026           }else{
1027             zType = "aggregate";
1028           }
1029           sqlite3ErrorMsg(pParse, "misuse of %s function %.*s()",zType,nId,zId);
1030           pNC->nNcErr++;
1031           is_agg = 0;
1032         }
1033 #else
1034         if( (is_agg && (pNC->ncFlags & NC_AllowAgg)==0) ){
1035           sqlite3ErrorMsg(pParse,"misuse of aggregate function %.*s()",nId,zId);
1036           pNC->nNcErr++;
1037           is_agg = 0;
1038         }
1039 #endif
1040         else if( no_such_func && pParse->db->init.busy==0
1041 #ifdef SQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
1042                   && pParse->explain==0
1043 #endif
1044         ){
1045           sqlite3ErrorMsg(pParse, "no such function: %.*s", nId, zId);
1046           pNC->nNcErr++;
1047         }else if( wrong_num_args ){
1048           sqlite3ErrorMsg(pParse,"wrong number of arguments to function %.*s()",
1049                nId, zId);
1050           pNC->nNcErr++;
1051         }
1052 #ifndef SQLITE_OMIT_WINDOWFUNC
1053         else if( is_agg==0 && ExprHasProperty(pExpr, EP_WinFunc) ){
1054           sqlite3ErrorMsg(pParse,
1055               "FILTER may not be used with non-aggregate %.*s()",
1056               nId, zId
1057           );
1058           pNC->nNcErr++;
1059         }
1060 #endif
1061         if( is_agg ){
1062           /* Window functions may not be arguments of aggregate functions.
1063           ** Or arguments of other window functions. But aggregate functions
1064           ** may be arguments for window functions.  */
1065 #ifndef SQLITE_OMIT_WINDOWFUNC
1066           pNC->ncFlags &= ~(NC_AllowWin | (!pWin ? NC_AllowAgg : 0));
1067 #else
1068           pNC->ncFlags &= ~NC_AllowAgg;
1069 #endif
1070         }
1071       }
1072 #ifndef SQLITE_OMIT_WINDOWFUNC
1073       else if( ExprHasProperty(pExpr, EP_WinFunc) ){
1074         is_agg = 1;
1075       }
1076 #endif
1077       sqlite3WalkExprList(pWalker, pList);
1078       if( is_agg ){
1079 #ifndef SQLITE_OMIT_WINDOWFUNC
1080         if( pWin ){
1081           Select *pSel = pNC->pWinSelect;
1082           assert( pWin==0 || (ExprUseYWin(pExpr) && pWin==pExpr->y.pWin) );
1083           if( IN_RENAME_OBJECT==0 ){
1084             sqlite3WindowUpdate(pParse, pSel ? pSel->pWinDefn : 0, pWin, pDef);
1085             if( pParse->db->mallocFailed ) break;
1086           }
1087           sqlite3WalkExprList(pWalker, pWin->pPartition);
1088           sqlite3WalkExprList(pWalker, pWin->pOrderBy);
1089           sqlite3WalkExpr(pWalker, pWin->pFilter);
1090           sqlite3WindowLink(pSel, pWin);
1091           pNC->ncFlags |= NC_HasWin;
1092         }else
1093 #endif /* SQLITE_OMIT_WINDOWFUNC */
1094         {
1095           NameContext *pNC2 = pNC;
1096           pExpr->op = TK_AGG_FUNCTION;
1097           pExpr->op2 = 0;
1098 #ifndef SQLITE_OMIT_WINDOWFUNC
1099           if( ExprHasProperty(pExpr, EP_WinFunc) ){
1100             sqlite3WalkExpr(pWalker, pExpr->y.pWin->pFilter);
1101           }
1102 #endif
1103           while( pNC2 && !sqlite3FunctionUsesThisSrc(pExpr, pNC2->pSrcList) ){
1104             pExpr->op2++;
1105             pNC2 = pNC2->pNext;
1106           }
1107           assert( pDef!=0 || IN_RENAME_OBJECT );
1108           if( pNC2 && pDef ){
1109             assert( SQLITE_FUNC_MINMAX==NC_MinMaxAgg );
1110             assert( SQLITE_FUNC_ANYORDER==NC_OrderAgg );
1111             testcase( (pDef->funcFlags & SQLITE_FUNC_MINMAX)!=0 );
1112             testcase( (pDef->funcFlags & SQLITE_FUNC_ANYORDER)!=0 );
1113             pNC2->ncFlags |= NC_HasAgg
1114               | ((pDef->funcFlags^SQLITE_FUNC_ANYORDER)
1115                   & (SQLITE_FUNC_MINMAX|SQLITE_FUNC_ANYORDER));
1116           }
1117         }
1118         pNC->ncFlags |= savedAllowFlags;
1119       }
1120       /* FIX ME:  Compute pExpr->affinity based on the expected return
1121       ** type of the function
1122       */
1123       return WRC_Prune;
1124     }
1125 #ifndef SQLITE_OMIT_SUBQUERY
1126     case TK_SELECT:
1127     case TK_EXISTS:  testcase( pExpr->op==TK_EXISTS );
1128 #endif
1129     case TK_IN: {
1130       testcase( pExpr->op==TK_IN );
1131       if( ExprUseXSelect(pExpr) ){
1132         int nRef = pNC->nRef;
1133         testcase( pNC->ncFlags & NC_IsCheck );
1134         testcase( pNC->ncFlags & NC_PartIdx );
1135         testcase( pNC->ncFlags & NC_IdxExpr );
1136         testcase( pNC->ncFlags & NC_GenCol );
1137         if( pNC->ncFlags & NC_SelfRef ){
1138           notValidImpl(pParse, pNC, "subqueries", pExpr);
1139         }else{
1140           sqlite3WalkSelect(pWalker, pExpr->x.pSelect);
1141         }
1142         assert( pNC->nRef>=nRef );
1143         if( nRef!=pNC->nRef ){
1144           ExprSetProperty(pExpr, EP_VarSelect);
1145           pNC->ncFlags |= NC_VarSelect;
1146         }
1147       }
1148       break;
1149     }
1150     case TK_VARIABLE: {
1151       testcase( pNC->ncFlags & NC_IsCheck );
1152       testcase( pNC->ncFlags & NC_PartIdx );
1153       testcase( pNC->ncFlags & NC_IdxExpr );
1154       testcase( pNC->ncFlags & NC_GenCol );
1155       sqlite3ResolveNotValid(pParse, pNC, "parameters",
1156                NC_IsCheck|NC_PartIdx|NC_IdxExpr|NC_GenCol, pExpr);
1157       break;
1158     }
1159     case TK_IS:
1160     case TK_ISNOT: {
1161       Expr *pRight = sqlite3ExprSkipCollateAndLikely(pExpr->pRight);
1162       assert( !ExprHasProperty(pExpr, EP_Reduced) );
1163       /* Handle special cases of "x IS TRUE", "x IS FALSE", "x IS NOT TRUE",
1164       ** and "x IS NOT FALSE". */
1165       if( ALWAYS(pRight) && (pRight->op==TK_ID || pRight->op==TK_TRUEFALSE) ){
1166         int rc = resolveExprStep(pWalker, pRight);
1167         if( rc==WRC_Abort ) return WRC_Abort;
1168         if( pRight->op==TK_TRUEFALSE ){
1169           pExpr->op2 = pExpr->op;
1170           pExpr->op = TK_TRUTH;
1171           return WRC_Continue;
1172         }
1173       }
1174       /* no break */ deliberate_fall_through
1175     }
1176     case TK_BETWEEN:
1177     case TK_EQ:
1178     case TK_NE:
1179     case TK_LT:
1180     case TK_LE:
1181     case TK_GT:
1182     case TK_GE: {
1183       int nLeft, nRight;
1184       if( pParse->db->mallocFailed ) break;
1185       assert( pExpr->pLeft!=0 );
1186       nLeft = sqlite3ExprVectorSize(pExpr->pLeft);
1187       if( pExpr->op==TK_BETWEEN ){
1188         assert( ExprUseXList(pExpr) );
1189         nRight = sqlite3ExprVectorSize(pExpr->x.pList->a[0].pExpr);
1190         if( nRight==nLeft ){
1191           nRight = sqlite3ExprVectorSize(pExpr->x.pList->a[1].pExpr);
1192         }
1193       }else{
1194         assert( pExpr->pRight!=0 );
1195         nRight = sqlite3ExprVectorSize(pExpr->pRight);
1196       }
1197       if( nLeft!=nRight ){
1198         testcase( pExpr->op==TK_EQ );
1199         testcase( pExpr->op==TK_NE );
1200         testcase( pExpr->op==TK_LT );
1201         testcase( pExpr->op==TK_LE );
1202         testcase( pExpr->op==TK_GT );
1203         testcase( pExpr->op==TK_GE );
1204         testcase( pExpr->op==TK_IS );
1205         testcase( pExpr->op==TK_ISNOT );
1206         testcase( pExpr->op==TK_BETWEEN );
1207         sqlite3ErrorMsg(pParse, "row value misused");
1208       }
1209       break;
1210     }
1211   }
1212   return (pParse->nErr || pParse->db->mallocFailed) ? WRC_Abort : WRC_Continue;
1213 }
1214 
1215 /*
1216 ** pEList is a list of expressions which are really the result set of the
1217 ** a SELECT statement.  pE is a term in an ORDER BY or GROUP BY clause.
1218 ** This routine checks to see if pE is a simple identifier which corresponds
1219 ** to the AS-name of one of the terms of the expression list.  If it is,
1220 ** this routine return an integer between 1 and N where N is the number of
1221 ** elements in pEList, corresponding to the matching entry.  If there is
1222 ** no match, or if pE is not a simple identifier, then this routine
1223 ** return 0.
1224 **
1225 ** pEList has been resolved.  pE has not.
1226 */
1227 static int resolveAsName(
1228   Parse *pParse,     /* Parsing context for error messages */
1229   ExprList *pEList,  /* List of expressions to scan */
1230   Expr *pE           /* Expression we are trying to match */
1231 ){
1232   int i;             /* Loop counter */
1233 
1234   UNUSED_PARAMETER(pParse);
1235 
1236   if( pE->op==TK_ID ){
1237     const char *zCol;
1238     assert( !ExprHasProperty(pE, EP_IntValue) );
1239     zCol = pE->u.zToken;
1240     for(i=0; i<pEList->nExpr; i++){
1241       if( pEList->a[i].eEName==ENAME_NAME
1242        && sqlite3_stricmp(pEList->a[i].zEName, zCol)==0
1243       ){
1244         return i+1;
1245       }
1246     }
1247   }
1248   return 0;
1249 }
1250 
1251 /*
1252 ** pE is a pointer to an expression which is a single term in the
1253 ** ORDER BY of a compound SELECT.  The expression has not been
1254 ** name resolved.
1255 **
1256 ** At the point this routine is called, we already know that the
1257 ** ORDER BY term is not an integer index into the result set.  That
1258 ** case is handled by the calling routine.
1259 **
1260 ** Attempt to match pE against result set columns in the left-most
1261 ** SELECT statement.  Return the index i of the matching column,
1262 ** as an indication to the caller that it should sort by the i-th column.
1263 ** The left-most column is 1.  In other words, the value returned is the
1264 ** same integer value that would be used in the SQL statement to indicate
1265 ** the column.
1266 **
1267 ** If there is no match, return 0.  Return -1 if an error occurs.
1268 */
1269 static int resolveOrderByTermToExprList(
1270   Parse *pParse,     /* Parsing context for error messages */
1271   Select *pSelect,   /* The SELECT statement with the ORDER BY clause */
1272   Expr *pE           /* The specific ORDER BY term */
1273 ){
1274   int i;             /* Loop counter */
1275   ExprList *pEList;  /* The columns of the result set */
1276   NameContext nc;    /* Name context for resolving pE */
1277   sqlite3 *db;       /* Database connection */
1278   int rc;            /* Return code from subprocedures */
1279   u8 savedSuppErr;   /* Saved value of db->suppressErr */
1280 
1281   assert( sqlite3ExprIsInteger(pE, &i)==0 );
1282   pEList = pSelect->pEList;
1283 
1284   /* Resolve all names in the ORDER BY term expression
1285   */
1286   memset(&nc, 0, sizeof(nc));
1287   nc.pParse = pParse;
1288   nc.pSrcList = pSelect->pSrc;
1289   nc.uNC.pEList = pEList;
1290   nc.ncFlags = NC_AllowAgg|NC_UEList|NC_NoSelect;
1291   nc.nNcErr = 0;
1292   db = pParse->db;
1293   savedSuppErr = db->suppressErr;
1294   db->suppressErr = 1;
1295   rc = sqlite3ResolveExprNames(&nc, pE);
1296   db->suppressErr = savedSuppErr;
1297   if( rc ) return 0;
1298 
1299   /* Try to match the ORDER BY expression against an expression
1300   ** in the result set.  Return an 1-based index of the matching
1301   ** result-set entry.
1302   */
1303   for(i=0; i<pEList->nExpr; i++){
1304     if( sqlite3ExprCompare(0, pEList->a[i].pExpr, pE, -1)<2 ){
1305       return i+1;
1306     }
1307   }
1308 
1309   /* If no match, return 0. */
1310   return 0;
1311 }
1312 
1313 /*
1314 ** Generate an ORDER BY or GROUP BY term out-of-range error.
1315 */
1316 static void resolveOutOfRangeError(
1317   Parse *pParse,         /* The error context into which to write the error */
1318   const char *zType,     /* "ORDER" or "GROUP" */
1319   int i,                 /* The index (1-based) of the term out of range */
1320   int mx                 /* Largest permissible value of i */
1321 ){
1322   sqlite3ErrorMsg(pParse,
1323     "%r %s BY term out of range - should be "
1324     "between 1 and %d", i, zType, mx);
1325 }
1326 
1327 /*
1328 ** Analyze the ORDER BY clause in a compound SELECT statement.   Modify
1329 ** each term of the ORDER BY clause is a constant integer between 1
1330 ** and N where N is the number of columns in the compound SELECT.
1331 **
1332 ** ORDER BY terms that are already an integer between 1 and N are
1333 ** unmodified.  ORDER BY terms that are integers outside the range of
1334 ** 1 through N generate an error.  ORDER BY terms that are expressions
1335 ** are matched against result set expressions of compound SELECT
1336 ** beginning with the left-most SELECT and working toward the right.
1337 ** At the first match, the ORDER BY expression is transformed into
1338 ** the integer column number.
1339 **
1340 ** Return the number of errors seen.
1341 */
1342 static int resolveCompoundOrderBy(
1343   Parse *pParse,        /* Parsing context.  Leave error messages here */
1344   Select *pSelect       /* The SELECT statement containing the ORDER BY */
1345 ){
1346   int i;
1347   ExprList *pOrderBy;
1348   ExprList *pEList;
1349   sqlite3 *db;
1350   int moreToDo = 1;
1351 
1352   pOrderBy = pSelect->pOrderBy;
1353   if( pOrderBy==0 ) return 0;
1354   db = pParse->db;
1355   if( pOrderBy->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
1356     sqlite3ErrorMsg(pParse, "too many terms in ORDER BY clause");
1357     return 1;
1358   }
1359   for(i=0; i<pOrderBy->nExpr; i++){
1360     pOrderBy->a[i].done = 0;
1361   }
1362   pSelect->pNext = 0;
1363   while( pSelect->pPrior ){
1364     pSelect->pPrior->pNext = pSelect;
1365     pSelect = pSelect->pPrior;
1366   }
1367   while( pSelect && moreToDo ){
1368     struct ExprList_item *pItem;
1369     moreToDo = 0;
1370     pEList = pSelect->pEList;
1371     assert( pEList!=0 );
1372     for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
1373       int iCol = -1;
1374       Expr *pE, *pDup;
1375       if( pItem->done ) continue;
1376       pE = sqlite3ExprSkipCollateAndLikely(pItem->pExpr);
1377       if( NEVER(pE==0) ) continue;
1378       if( sqlite3ExprIsInteger(pE, &iCol) ){
1379         if( iCol<=0 || iCol>pEList->nExpr ){
1380           resolveOutOfRangeError(pParse, "ORDER", i+1, pEList->nExpr);
1381           return 1;
1382         }
1383       }else{
1384         iCol = resolveAsName(pParse, pEList, pE);
1385         if( iCol==0 ){
1386           /* Now test if expression pE matches one of the values returned
1387           ** by pSelect. In the usual case this is done by duplicating the
1388           ** expression, resolving any symbols in it, and then comparing
1389           ** it against each expression returned by the SELECT statement.
1390           ** Once the comparisons are finished, the duplicate expression
1391           ** is deleted.
1392           **
1393           ** If this is running as part of an ALTER TABLE operation and
1394           ** the symbols resolve successfully, also resolve the symbols in the
1395           ** actual expression. This allows the code in alter.c to modify
1396           ** column references within the ORDER BY expression as required.  */
1397           pDup = sqlite3ExprDup(db, pE, 0);
1398           if( !db->mallocFailed ){
1399             assert(pDup);
1400             iCol = resolveOrderByTermToExprList(pParse, pSelect, pDup);
1401             if( IN_RENAME_OBJECT && iCol>0 ){
1402               resolveOrderByTermToExprList(pParse, pSelect, pE);
1403             }
1404           }
1405           sqlite3ExprDelete(db, pDup);
1406         }
1407       }
1408       if( iCol>0 ){
1409         /* Convert the ORDER BY term into an integer column number iCol,
1410         ** taking care to preserve the COLLATE clause if it exists. */
1411         if( !IN_RENAME_OBJECT ){
1412           Expr *pNew = sqlite3Expr(db, TK_INTEGER, 0);
1413           if( pNew==0 ) return 1;
1414           pNew->flags |= EP_IntValue;
1415           pNew->u.iValue = iCol;
1416           if( pItem->pExpr==pE ){
1417             pItem->pExpr = pNew;
1418           }else{
1419             Expr *pParent = pItem->pExpr;
1420             assert( pParent->op==TK_COLLATE );
1421             while( pParent->pLeft->op==TK_COLLATE ) pParent = pParent->pLeft;
1422             assert( pParent->pLeft==pE );
1423             pParent->pLeft = pNew;
1424           }
1425           sqlite3ExprDelete(db, pE);
1426           pItem->u.x.iOrderByCol = (u16)iCol;
1427         }
1428         pItem->done = 1;
1429       }else{
1430         moreToDo = 1;
1431       }
1432     }
1433     pSelect = pSelect->pNext;
1434   }
1435   for(i=0; i<pOrderBy->nExpr; i++){
1436     if( pOrderBy->a[i].done==0 ){
1437       sqlite3ErrorMsg(pParse, "%r ORDER BY term does not match any "
1438             "column in the result set", i+1);
1439       return 1;
1440     }
1441   }
1442   return 0;
1443 }
1444 
1445 /*
1446 ** Check every term in the ORDER BY or GROUP BY clause pOrderBy of
1447 ** the SELECT statement pSelect.  If any term is reference to a
1448 ** result set expression (as determined by the ExprList.a.u.x.iOrderByCol
1449 ** field) then convert that term into a copy of the corresponding result set
1450 ** column.
1451 **
1452 ** If any errors are detected, add an error message to pParse and
1453 ** return non-zero.  Return zero if no errors are seen.
1454 */
1455 int sqlite3ResolveOrderGroupBy(
1456   Parse *pParse,        /* Parsing context.  Leave error messages here */
1457   Select *pSelect,      /* The SELECT statement containing the clause */
1458   ExprList *pOrderBy,   /* The ORDER BY or GROUP BY clause to be processed */
1459   const char *zType     /* "ORDER" or "GROUP" */
1460 ){
1461   int i;
1462   sqlite3 *db = pParse->db;
1463   ExprList *pEList;
1464   struct ExprList_item *pItem;
1465 
1466   if( pOrderBy==0 || pParse->db->mallocFailed || IN_RENAME_OBJECT ) return 0;
1467   if( pOrderBy->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
1468     sqlite3ErrorMsg(pParse, "too many terms in %s BY clause", zType);
1469     return 1;
1470   }
1471   pEList = pSelect->pEList;
1472   assert( pEList!=0 );  /* sqlite3SelectNew() guarantees this */
1473   for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
1474     if( pItem->u.x.iOrderByCol ){
1475       if( pItem->u.x.iOrderByCol>pEList->nExpr ){
1476         resolveOutOfRangeError(pParse, zType, i+1, pEList->nExpr);
1477         return 1;
1478       }
1479       resolveAlias(pParse, pEList, pItem->u.x.iOrderByCol-1, pItem->pExpr,0);
1480     }
1481   }
1482   return 0;
1483 }
1484 
1485 #ifndef SQLITE_OMIT_WINDOWFUNC
1486 /*
1487 ** Walker callback for windowRemoveExprFromSelect().
1488 */
1489 static int resolveRemoveWindowsCb(Walker *pWalker, Expr *pExpr){
1490   UNUSED_PARAMETER(pWalker);
1491   if( ExprHasProperty(pExpr, EP_WinFunc) ){
1492     Window *pWin = pExpr->y.pWin;
1493     sqlite3WindowUnlinkFromSelect(pWin);
1494   }
1495   return WRC_Continue;
1496 }
1497 
1498 /*
1499 ** Remove any Window objects owned by the expression pExpr from the
1500 ** Select.pWin list of Select object pSelect.
1501 */
1502 static void windowRemoveExprFromSelect(Select *pSelect, Expr *pExpr){
1503   if( pSelect->pWin ){
1504     Walker sWalker;
1505     memset(&sWalker, 0, sizeof(Walker));
1506     sWalker.xExprCallback = resolveRemoveWindowsCb;
1507     sWalker.u.pSelect = pSelect;
1508     sqlite3WalkExpr(&sWalker, pExpr);
1509   }
1510 }
1511 #else
1512 # define windowRemoveExprFromSelect(a, b)
1513 #endif /* SQLITE_OMIT_WINDOWFUNC */
1514 
1515 /*
1516 ** pOrderBy is an ORDER BY or GROUP BY clause in SELECT statement pSelect.
1517 ** The Name context of the SELECT statement is pNC.  zType is either
1518 ** "ORDER" or "GROUP" depending on which type of clause pOrderBy is.
1519 **
1520 ** This routine resolves each term of the clause into an expression.
1521 ** If the order-by term is an integer I between 1 and N (where N is the
1522 ** number of columns in the result set of the SELECT) then the expression
1523 ** in the resolution is a copy of the I-th result-set expression.  If
1524 ** the order-by term is an identifier that corresponds to the AS-name of
1525 ** a result-set expression, then the term resolves to a copy of the
1526 ** result-set expression.  Otherwise, the expression is resolved in
1527 ** the usual way - using sqlite3ResolveExprNames().
1528 **
1529 ** This routine returns the number of errors.  If errors occur, then
1530 ** an appropriate error message might be left in pParse.  (OOM errors
1531 ** excepted.)
1532 */
1533 static int resolveOrderGroupBy(
1534   NameContext *pNC,     /* The name context of the SELECT statement */
1535   Select *pSelect,      /* The SELECT statement holding pOrderBy */
1536   ExprList *pOrderBy,   /* An ORDER BY or GROUP BY clause to resolve */
1537   const char *zType     /* Either "ORDER" or "GROUP", as appropriate */
1538 ){
1539   int i, j;                      /* Loop counters */
1540   int iCol;                      /* Column number */
1541   struct ExprList_item *pItem;   /* A term of the ORDER BY clause */
1542   Parse *pParse;                 /* Parsing context */
1543   int nResult;                   /* Number of terms in the result set */
1544 
1545   assert( pOrderBy!=0 );
1546   nResult = pSelect->pEList->nExpr;
1547   pParse = pNC->pParse;
1548   for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
1549     Expr *pE = pItem->pExpr;
1550     Expr *pE2 = sqlite3ExprSkipCollateAndLikely(pE);
1551     if( NEVER(pE2==0) ) continue;
1552     if( zType[0]!='G' ){
1553       iCol = resolveAsName(pParse, pSelect->pEList, pE2);
1554       if( iCol>0 ){
1555         /* If an AS-name match is found, mark this ORDER BY column as being
1556         ** a copy of the iCol-th result-set column.  The subsequent call to
1557         ** sqlite3ResolveOrderGroupBy() will convert the expression to a
1558         ** copy of the iCol-th result-set expression. */
1559         pItem->u.x.iOrderByCol = (u16)iCol;
1560         continue;
1561       }
1562     }
1563     if( sqlite3ExprIsInteger(pE2, &iCol) ){
1564       /* The ORDER BY term is an integer constant.  Again, set the column
1565       ** number so that sqlite3ResolveOrderGroupBy() will convert the
1566       ** order-by term to a copy of the result-set expression */
1567       if( iCol<1 || iCol>0xffff ){
1568         resolveOutOfRangeError(pParse, zType, i+1, nResult);
1569         return 1;
1570       }
1571       pItem->u.x.iOrderByCol = (u16)iCol;
1572       continue;
1573     }
1574 
1575     /* Otherwise, treat the ORDER BY term as an ordinary expression */
1576     pItem->u.x.iOrderByCol = 0;
1577     if( sqlite3ResolveExprNames(pNC, pE) ){
1578       return 1;
1579     }
1580     for(j=0; j<pSelect->pEList->nExpr; j++){
1581       if( sqlite3ExprCompare(0, pE, pSelect->pEList->a[j].pExpr, -1)==0 ){
1582         /* Since this expresion is being changed into a reference
1583         ** to an identical expression in the result set, remove all Window
1584         ** objects belonging to the expression from the Select.pWin list. */
1585         windowRemoveExprFromSelect(pSelect, pE);
1586         pItem->u.x.iOrderByCol = j+1;
1587       }
1588     }
1589   }
1590   return sqlite3ResolveOrderGroupBy(pParse, pSelect, pOrderBy, zType);
1591 }
1592 
1593 /*
1594 ** Resolve names in the SELECT statement p and all of its descendants.
1595 */
1596 static int resolveSelectStep(Walker *pWalker, Select *p){
1597   NameContext *pOuterNC;  /* Context that contains this SELECT */
1598   NameContext sNC;        /* Name context of this SELECT */
1599   int isCompound;         /* True if p is a compound select */
1600   int nCompound;          /* Number of compound terms processed so far */
1601   Parse *pParse;          /* Parsing context */
1602   int i;                  /* Loop counter */
1603   ExprList *pGroupBy;     /* The GROUP BY clause */
1604   Select *pLeftmost;      /* Left-most of SELECT of a compound */
1605   sqlite3 *db;            /* Database connection */
1606 
1607 
1608   assert( p!=0 );
1609   if( p->selFlags & SF_Resolved ){
1610     return WRC_Prune;
1611   }
1612   pOuterNC = pWalker->u.pNC;
1613   pParse = pWalker->pParse;
1614   db = pParse->db;
1615 
1616   /* Normally sqlite3SelectExpand() will be called first and will have
1617   ** already expanded this SELECT.  However, if this is a subquery within
1618   ** an expression, sqlite3ResolveExprNames() will be called without a
1619   ** prior call to sqlite3SelectExpand().  When that happens, let
1620   ** sqlite3SelectPrep() do all of the processing for this SELECT.
1621   ** sqlite3SelectPrep() will invoke both sqlite3SelectExpand() and
1622   ** this routine in the correct order.
1623   */
1624   if( (p->selFlags & SF_Expanded)==0 ){
1625     sqlite3SelectPrep(pParse, p, pOuterNC);
1626     return (pParse->nErr || db->mallocFailed) ? WRC_Abort : WRC_Prune;
1627   }
1628 
1629   isCompound = p->pPrior!=0;
1630   nCompound = 0;
1631   pLeftmost = p;
1632   while( p ){
1633     assert( (p->selFlags & SF_Expanded)!=0 );
1634     assert( (p->selFlags & SF_Resolved)==0 );
1635     assert( db->suppressErr==0 ); /* SF_Resolved not set if errors suppressed */
1636     p->selFlags |= SF_Resolved;
1637 
1638 
1639     /* Resolve the expressions in the LIMIT and OFFSET clauses. These
1640     ** are not allowed to refer to any names, so pass an empty NameContext.
1641     */
1642     memset(&sNC, 0, sizeof(sNC));
1643     sNC.pParse = pParse;
1644     sNC.pWinSelect = p;
1645     if( sqlite3ResolveExprNames(&sNC, p->pLimit) ){
1646       return WRC_Abort;
1647     }
1648 
1649     /* If the SF_Converted flags is set, then this Select object was
1650     ** was created by the convertCompoundSelectToSubquery() function.
1651     ** In this case the ORDER BY clause (p->pOrderBy) should be resolved
1652     ** as if it were part of the sub-query, not the parent. This block
1653     ** moves the pOrderBy down to the sub-query. It will be moved back
1654     ** after the names have been resolved.  */
1655     if( p->selFlags & SF_Converted ){
1656       Select *pSub = p->pSrc->a[0].pSelect;
1657       assert( p->pSrc->nSrc==1 && p->pOrderBy );
1658       assert( pSub->pPrior && pSub->pOrderBy==0 );
1659       pSub->pOrderBy = p->pOrderBy;
1660       p->pOrderBy = 0;
1661     }
1662 
1663     /* Recursively resolve names in all subqueries in the FROM clause
1664     */
1665     for(i=0; i<p->pSrc->nSrc; i++){
1666       SrcItem *pItem = &p->pSrc->a[i];
1667       if( pItem->pSelect && (pItem->pSelect->selFlags & SF_Resolved)==0 ){
1668         int nRef = pOuterNC ? pOuterNC->nRef : 0;
1669         const char *zSavedContext = pParse->zAuthContext;
1670 
1671         if( pItem->zName ) pParse->zAuthContext = pItem->zName;
1672         sqlite3ResolveSelectNames(pParse, pItem->pSelect, pOuterNC);
1673         pParse->zAuthContext = zSavedContext;
1674         if( pParse->nErr || db->mallocFailed ) return WRC_Abort;
1675 
1676         /* If the number of references to the outer context changed when
1677         ** expressions in the sub-select were resolved, the sub-select
1678         ** is correlated. It is not required to check the refcount on any
1679         ** but the innermost outer context object, as lookupName() increments
1680         ** the refcount on all contexts between the current one and the
1681         ** context containing the column when it resolves a name. */
1682         if( pOuterNC ){
1683           assert( pItem->fg.isCorrelated==0 && pOuterNC->nRef>=nRef );
1684           pItem->fg.isCorrelated = (pOuterNC->nRef>nRef);
1685         }
1686       }
1687     }
1688 
1689     /* Set up the local name-context to pass to sqlite3ResolveExprNames() to
1690     ** resolve the result-set expression list.
1691     */
1692     sNC.ncFlags = NC_AllowAgg|NC_AllowWin;
1693     sNC.pSrcList = p->pSrc;
1694     sNC.pNext = pOuterNC;
1695 
1696     /* Resolve names in the result set. */
1697     if( sqlite3ResolveExprListNames(&sNC, p->pEList) ) return WRC_Abort;
1698     sNC.ncFlags &= ~NC_AllowWin;
1699 
1700     /* If there are no aggregate functions in the result-set, and no GROUP BY
1701     ** expression, do not allow aggregates in any of the other expressions.
1702     */
1703     assert( (p->selFlags & SF_Aggregate)==0 );
1704     pGroupBy = p->pGroupBy;
1705     if( pGroupBy || (sNC.ncFlags & NC_HasAgg)!=0 ){
1706       assert( NC_MinMaxAgg==SF_MinMaxAgg );
1707       assert( NC_OrderAgg==SF_OrderByReqd );
1708       p->selFlags |= SF_Aggregate | (sNC.ncFlags&(NC_MinMaxAgg|NC_OrderAgg));
1709     }else{
1710       sNC.ncFlags &= ~NC_AllowAgg;
1711     }
1712 
1713     /* Add the output column list to the name-context before parsing the
1714     ** other expressions in the SELECT statement. This is so that
1715     ** expressions in the WHERE clause (etc.) can refer to expressions by
1716     ** aliases in the result set.
1717     **
1718     ** Minor point: If this is the case, then the expression will be
1719     ** re-evaluated for each reference to it.
1720     */
1721     assert( (sNC.ncFlags & (NC_UAggInfo|NC_UUpsert|NC_UBaseReg))==0 );
1722     sNC.uNC.pEList = p->pEList;
1723     sNC.ncFlags |= NC_UEList;
1724     if( p->pHaving ){
1725       if( !pGroupBy ){
1726         sqlite3ErrorMsg(pParse, "a GROUP BY clause is required before HAVING");
1727         return WRC_Abort;
1728       }
1729       if( sqlite3ResolveExprNames(&sNC, p->pHaving) ) return WRC_Abort;
1730     }
1731     if( sqlite3ResolveExprNames(&sNC, p->pWhere) ) return WRC_Abort;
1732 
1733     /* Resolve names in table-valued-function arguments */
1734     for(i=0; i<p->pSrc->nSrc; i++){
1735       SrcItem *pItem = &p->pSrc->a[i];
1736       if( pItem->fg.isTabFunc
1737        && sqlite3ResolveExprListNames(&sNC, pItem->u1.pFuncArg)
1738       ){
1739         return WRC_Abort;
1740       }
1741     }
1742 
1743 #ifndef SQLITE_OMIT_WINDOWFUNC
1744     if( IN_RENAME_OBJECT ){
1745       Window *pWin;
1746       for(pWin=p->pWinDefn; pWin; pWin=pWin->pNextWin){
1747         if( sqlite3ResolveExprListNames(&sNC, pWin->pOrderBy)
1748          || sqlite3ResolveExprListNames(&sNC, pWin->pPartition)
1749         ){
1750           return WRC_Abort;
1751         }
1752       }
1753     }
1754 #endif
1755 
1756     /* The ORDER BY and GROUP BY clauses may not refer to terms in
1757     ** outer queries
1758     */
1759     sNC.pNext = 0;
1760     sNC.ncFlags |= NC_AllowAgg|NC_AllowWin;
1761 
1762     /* If this is a converted compound query, move the ORDER BY clause from
1763     ** the sub-query back to the parent query. At this point each term
1764     ** within the ORDER BY clause has been transformed to an integer value.
1765     ** These integers will be replaced by copies of the corresponding result
1766     ** set expressions by the call to resolveOrderGroupBy() below.  */
1767     if( p->selFlags & SF_Converted ){
1768       Select *pSub = p->pSrc->a[0].pSelect;
1769       p->pOrderBy = pSub->pOrderBy;
1770       pSub->pOrderBy = 0;
1771     }
1772 
1773     /* Process the ORDER BY clause for singleton SELECT statements.
1774     ** The ORDER BY clause for compounds SELECT statements is handled
1775     ** below, after all of the result-sets for all of the elements of
1776     ** the compound have been resolved.
1777     **
1778     ** If there is an ORDER BY clause on a term of a compound-select other
1779     ** than the right-most term, then that is a syntax error.  But the error
1780     ** is not detected until much later, and so we need to go ahead and
1781     ** resolve those symbols on the incorrect ORDER BY for consistency.
1782     */
1783     if( p->pOrderBy!=0
1784      && isCompound<=nCompound  /* Defer right-most ORDER BY of a compound */
1785      && resolveOrderGroupBy(&sNC, p, p->pOrderBy, "ORDER")
1786     ){
1787       return WRC_Abort;
1788     }
1789     if( db->mallocFailed ){
1790       return WRC_Abort;
1791     }
1792     sNC.ncFlags &= ~NC_AllowWin;
1793 
1794     /* Resolve the GROUP BY clause.  At the same time, make sure
1795     ** the GROUP BY clause does not contain aggregate functions.
1796     */
1797     if( pGroupBy ){
1798       struct ExprList_item *pItem;
1799 
1800       if( resolveOrderGroupBy(&sNC, p, pGroupBy, "GROUP") || db->mallocFailed ){
1801         return WRC_Abort;
1802       }
1803       for(i=0, pItem=pGroupBy->a; i<pGroupBy->nExpr; i++, pItem++){
1804         if( ExprHasProperty(pItem->pExpr, EP_Agg) ){
1805           sqlite3ErrorMsg(pParse, "aggregate functions are not allowed in "
1806               "the GROUP BY clause");
1807           return WRC_Abort;
1808         }
1809       }
1810     }
1811 
1812     /* If this is part of a compound SELECT, check that it has the right
1813     ** number of expressions in the select list. */
1814     if( p->pNext && p->pEList->nExpr!=p->pNext->pEList->nExpr ){
1815       sqlite3SelectWrongNumTermsError(pParse, p->pNext);
1816       return WRC_Abort;
1817     }
1818 
1819     /* Advance to the next term of the compound
1820     */
1821     p = p->pPrior;
1822     nCompound++;
1823   }
1824 
1825   /* Resolve the ORDER BY on a compound SELECT after all terms of
1826   ** the compound have been resolved.
1827   */
1828   if( isCompound && resolveCompoundOrderBy(pParse, pLeftmost) ){
1829     return WRC_Abort;
1830   }
1831 
1832   return WRC_Prune;
1833 }
1834 
1835 /*
1836 ** This routine walks an expression tree and resolves references to
1837 ** table columns and result-set columns.  At the same time, do error
1838 ** checking on function usage and set a flag if any aggregate functions
1839 ** are seen.
1840 **
1841 ** To resolve table columns references we look for nodes (or subtrees) of the
1842 ** form X.Y.Z or Y.Z or just Z where
1843 **
1844 **      X:   The name of a database.  Ex:  "main" or "temp" or
1845 **           the symbolic name assigned to an ATTACH-ed database.
1846 **
1847 **      Y:   The name of a table in a FROM clause.  Or in a trigger
1848 **           one of the special names "old" or "new".
1849 **
1850 **      Z:   The name of a column in table Y.
1851 **
1852 ** The node at the root of the subtree is modified as follows:
1853 **
1854 **    Expr.op        Changed to TK_COLUMN
1855 **    Expr.pTab      Points to the Table object for X.Y
1856 **    Expr.iColumn   The column index in X.Y.  -1 for the rowid.
1857 **    Expr.iTable    The VDBE cursor number for X.Y
1858 **
1859 **
1860 ** To resolve result-set references, look for expression nodes of the
1861 ** form Z (with no X and Y prefix) where the Z matches the right-hand
1862 ** size of an AS clause in the result-set of a SELECT.  The Z expression
1863 ** is replaced by a copy of the left-hand side of the result-set expression.
1864 ** Table-name and function resolution occurs on the substituted expression
1865 ** tree.  For example, in:
1866 **
1867 **      SELECT a+b AS x, c+d AS y FROM t1 ORDER BY x;
1868 **
1869 ** The "x" term of the order by is replaced by "a+b" to render:
1870 **
1871 **      SELECT a+b AS x, c+d AS y FROM t1 ORDER BY a+b;
1872 **
1873 ** Function calls are checked to make sure that the function is
1874 ** defined and that the correct number of arguments are specified.
1875 ** If the function is an aggregate function, then the NC_HasAgg flag is
1876 ** set and the opcode is changed from TK_FUNCTION to TK_AGG_FUNCTION.
1877 ** If an expression contains aggregate functions then the EP_Agg
1878 ** property on the expression is set.
1879 **
1880 ** An error message is left in pParse if anything is amiss.  The number
1881 ** if errors is returned.
1882 */
1883 int sqlite3ResolveExprNames(
1884   NameContext *pNC,       /* Namespace to resolve expressions in. */
1885   Expr *pExpr             /* The expression to be analyzed. */
1886 ){
1887   int savedHasAgg;
1888   Walker w;
1889 
1890   if( pExpr==0 ) return SQLITE_OK;
1891   savedHasAgg = pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
1892   pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
1893   w.pParse = pNC->pParse;
1894   w.xExprCallback = resolveExprStep;
1895   w.xSelectCallback = (pNC->ncFlags & NC_NoSelect) ? 0 : resolveSelectStep;
1896   w.xSelectCallback2 = 0;
1897   w.u.pNC = pNC;
1898 #if SQLITE_MAX_EXPR_DEPTH>0
1899   w.pParse->nHeight += pExpr->nHeight;
1900   if( sqlite3ExprCheckHeight(w.pParse, w.pParse->nHeight) ){
1901     return SQLITE_ERROR;
1902   }
1903 #endif
1904   sqlite3WalkExpr(&w, pExpr);
1905 #if SQLITE_MAX_EXPR_DEPTH>0
1906   w.pParse->nHeight -= pExpr->nHeight;
1907 #endif
1908   assert( EP_Agg==NC_HasAgg );
1909   assert( EP_Win==NC_HasWin );
1910   testcase( pNC->ncFlags & NC_HasAgg );
1911   testcase( pNC->ncFlags & NC_HasWin );
1912   ExprSetProperty(pExpr, pNC->ncFlags & (NC_HasAgg|NC_HasWin) );
1913   pNC->ncFlags |= savedHasAgg;
1914   return pNC->nNcErr>0 || w.pParse->nErr>0;
1915 }
1916 
1917 /*
1918 ** Resolve all names for all expression in an expression list.  This is
1919 ** just like sqlite3ResolveExprNames() except that it works for an expression
1920 ** list rather than a single expression.
1921 */
1922 int sqlite3ResolveExprListNames(
1923   NameContext *pNC,       /* Namespace to resolve expressions in. */
1924   ExprList *pList         /* The expression list to be analyzed. */
1925 ){
1926   int i;
1927   int savedHasAgg = 0;
1928   Walker w;
1929   if( pList==0 ) return WRC_Continue;
1930   w.pParse = pNC->pParse;
1931   w.xExprCallback = resolveExprStep;
1932   w.xSelectCallback = resolveSelectStep;
1933   w.xSelectCallback2 = 0;
1934   w.u.pNC = pNC;
1935   savedHasAgg = pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
1936   pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
1937   for(i=0; i<pList->nExpr; i++){
1938     Expr *pExpr = pList->a[i].pExpr;
1939     if( pExpr==0 ) continue;
1940 #if SQLITE_MAX_EXPR_DEPTH>0
1941     w.pParse->nHeight += pExpr->nHeight;
1942     if( sqlite3ExprCheckHeight(w.pParse, w.pParse->nHeight) ){
1943       return WRC_Abort;
1944     }
1945 #endif
1946     sqlite3WalkExpr(&w, pExpr);
1947 #if SQLITE_MAX_EXPR_DEPTH>0
1948     w.pParse->nHeight -= pExpr->nHeight;
1949 #endif
1950     assert( EP_Agg==NC_HasAgg );
1951     assert( EP_Win==NC_HasWin );
1952     testcase( pNC->ncFlags & NC_HasAgg );
1953     testcase( pNC->ncFlags & NC_HasWin );
1954     if( pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg) ){
1955       ExprSetProperty(pExpr, pNC->ncFlags & (NC_HasAgg|NC_HasWin) );
1956       savedHasAgg |= pNC->ncFlags &
1957                           (NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
1958       pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
1959     }
1960     if( w.pParse->nErr>0 ) return WRC_Abort;
1961   }
1962   pNC->ncFlags |= savedHasAgg;
1963   return WRC_Continue;
1964 }
1965 
1966 /*
1967 ** Resolve all names in all expressions of a SELECT and in all
1968 ** decendents of the SELECT, including compounds off of p->pPrior,
1969 ** subqueries in expressions, and subqueries used as FROM clause
1970 ** terms.
1971 **
1972 ** See sqlite3ResolveExprNames() for a description of the kinds of
1973 ** transformations that occur.
1974 **
1975 ** All SELECT statements should have been expanded using
1976 ** sqlite3SelectExpand() prior to invoking this routine.
1977 */
1978 void sqlite3ResolveSelectNames(
1979   Parse *pParse,         /* The parser context */
1980   Select *p,             /* The SELECT statement being coded. */
1981   NameContext *pOuterNC  /* Name context for parent SELECT statement */
1982 ){
1983   Walker w;
1984 
1985   assert( p!=0 );
1986   w.xExprCallback = resolveExprStep;
1987   w.xSelectCallback = resolveSelectStep;
1988   w.xSelectCallback2 = 0;
1989   w.pParse = pParse;
1990   w.u.pNC = pOuterNC;
1991   sqlite3WalkSelect(&w, p);
1992 }
1993 
1994 /*
1995 ** Resolve names in expressions that can only reference a single table
1996 ** or which cannot reference any tables at all.  Examples:
1997 **
1998 **                                                    "type" flag
1999 **                                                    ------------
2000 **    (1)   CHECK constraints                         NC_IsCheck
2001 **    (2)   WHERE clauses on partial indices          NC_PartIdx
2002 **    (3)   Expressions in indexes on expressions     NC_IdxExpr
2003 **    (4)   Expression arguments to VACUUM INTO.      0
2004 **    (5)   GENERATED ALWAYS as expressions           NC_GenCol
2005 **
2006 ** In all cases except (4), the Expr.iTable value for Expr.op==TK_COLUMN
2007 ** nodes of the expression is set to -1 and the Expr.iColumn value is
2008 ** set to the column number.  In case (4), TK_COLUMN nodes cause an error.
2009 **
2010 ** Any errors cause an error message to be set in pParse.
2011 */
2012 int sqlite3ResolveSelfReference(
2013   Parse *pParse,   /* Parsing context */
2014   Table *pTab,     /* The table being referenced, or NULL */
2015   int type,        /* NC_IsCheck, NC_PartIdx, NC_IdxExpr, NC_GenCol, or 0 */
2016   Expr *pExpr,     /* Expression to resolve.  May be NULL. */
2017   ExprList *pList  /* Expression list to resolve.  May be NULL. */
2018 ){
2019   SrcList sSrc;                   /* Fake SrcList for pParse->pNewTable */
2020   NameContext sNC;                /* Name context for pParse->pNewTable */
2021   int rc;
2022 
2023   assert( type==0 || pTab!=0 );
2024   assert( type==NC_IsCheck || type==NC_PartIdx || type==NC_IdxExpr
2025           || type==NC_GenCol || pTab==0 );
2026   memset(&sNC, 0, sizeof(sNC));
2027   memset(&sSrc, 0, sizeof(sSrc));
2028   if( pTab ){
2029     sSrc.nSrc = 1;
2030     sSrc.a[0].zName = pTab->zName;
2031     sSrc.a[0].pTab = pTab;
2032     sSrc.a[0].iCursor = -1;
2033     if( pTab->pSchema!=pParse->db->aDb[1].pSchema ){
2034       /* Cause EP_FromDDL to be set on TK_FUNCTION nodes of non-TEMP
2035       ** schema elements */
2036       type |= NC_FromDDL;
2037     }
2038   }
2039   sNC.pParse = pParse;
2040   sNC.pSrcList = &sSrc;
2041   sNC.ncFlags = type | NC_IsDDL;
2042   if( (rc = sqlite3ResolveExprNames(&sNC, pExpr))!=SQLITE_OK ) return rc;
2043   if( pList ) rc = sqlite3ResolveExprListNames(&sNC, pList);
2044   return rc;
2045 }
2046