xref: /sqlite-3.40.0/src/resolve.c (revision fadc0e34)
1 /*
2 ** 2008 August 18
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 **
13 ** This file contains routines used for walking the parser tree and
14 ** resolve all identifiers by associating them with a particular
15 ** table and column.
16 */
17 #include "sqliteInt.h"
18 
19 /*
20 ** Magic table number to mean the EXCLUDED table in an UPSERT statement.
21 */
22 #define EXCLUDED_TABLE_NUMBER  2
23 
24 /*
25 ** Walk the expression tree pExpr and increase the aggregate function
26 ** depth (the Expr.op2 field) by N on every TK_AGG_FUNCTION node.
27 ** This needs to occur when copying a TK_AGG_FUNCTION node from an
28 ** outer query into an inner subquery.
29 **
30 ** incrAggFunctionDepth(pExpr,n) is the main routine.  incrAggDepth(..)
31 ** is a helper function - a callback for the tree walker.
32 **
33 ** See also the sqlite3WindowExtraAggFuncDepth() routine in window.c
34 */
35 static int incrAggDepth(Walker *pWalker, Expr *pExpr){
36   if( pExpr->op==TK_AGG_FUNCTION ) pExpr->op2 += pWalker->u.n;
37   return WRC_Continue;
38 }
39 static void incrAggFunctionDepth(Expr *pExpr, int N){
40   if( N>0 ){
41     Walker w;
42     memset(&w, 0, sizeof(w));
43     w.xExprCallback = incrAggDepth;
44     w.u.n = N;
45     sqlite3WalkExpr(&w, pExpr);
46   }
47 }
48 
49 /*
50 ** Turn the pExpr expression into an alias for the iCol-th column of the
51 ** result set in pEList.
52 **
53 ** If the reference is followed by a COLLATE operator, then make sure
54 ** the COLLATE operator is preserved.  For example:
55 **
56 **     SELECT a+b, c+d FROM t1 ORDER BY 1 COLLATE nocase;
57 **
58 ** Should be transformed into:
59 **
60 **     SELECT a+b, c+d FROM t1 ORDER BY (a+b) COLLATE nocase;
61 **
62 ** The nSubquery parameter specifies how many levels of subquery the
63 ** alias is removed from the original expression.  The usual value is
64 ** zero but it might be more if the alias is contained within a subquery
65 ** of the original expression.  The Expr.op2 field of TK_AGG_FUNCTION
66 ** structures must be increased by the nSubquery amount.
67 */
68 static void resolveAlias(
69   Parse *pParse,         /* Parsing context */
70   ExprList *pEList,      /* A result set */
71   int iCol,              /* A column in the result set.  0..pEList->nExpr-1 */
72   Expr *pExpr,           /* Transform this into an alias to the result set */
73   int nSubquery          /* Number of subqueries that the label is moving */
74 ){
75   Expr *pOrig;           /* The iCol-th column of the result set */
76   Expr *pDup;            /* Copy of pOrig */
77   sqlite3 *db;           /* The database connection */
78 
79   assert( iCol>=0 && iCol<pEList->nExpr );
80   pOrig = pEList->a[iCol].pExpr;
81   assert( pOrig!=0 );
82   db = pParse->db;
83   pDup = sqlite3ExprDup(db, pOrig, 0);
84   if( pDup!=0 ){
85     incrAggFunctionDepth(pDup, nSubquery);
86     if( pExpr->op==TK_COLLATE ){
87       pDup = sqlite3ExprAddCollateString(pParse, pDup, pExpr->u.zToken);
88     }
89 
90     /* Before calling sqlite3ExprDelete(), set the EP_Static flag. This
91     ** prevents ExprDelete() from deleting the Expr structure itself,
92     ** allowing it to be repopulated by the memcpy() on the following line.
93     ** The pExpr->u.zToken might point into memory that will be freed by the
94     ** sqlite3DbFree(db, pDup) on the last line of this block, so be sure to
95     ** make a copy of the token before doing the sqlite3DbFree().
96     */
97     ExprSetProperty(pExpr, EP_Static);
98     sqlite3ExprDelete(db, pExpr);
99     memcpy(pExpr, pDup, sizeof(*pExpr));
100     if( !ExprHasProperty(pExpr, EP_IntValue) && pExpr->u.zToken!=0 ){
101       assert( (pExpr->flags & (EP_Reduced|EP_TokenOnly))==0 );
102       pExpr->u.zToken = sqlite3DbStrDup(db, pExpr->u.zToken);
103       pExpr->flags |= EP_MemToken;
104     }
105     if( ExprHasProperty(pExpr, EP_WinFunc) ){
106       if( pExpr->y.pWin!=0 ){
107         pExpr->y.pWin->pOwner = pExpr;
108       }else{
109         assert( db->mallocFailed );
110       }
111     }
112     sqlite3DbFree(db, pDup);
113   }
114 }
115 
116 
117 /*
118 ** Return TRUE if the name zCol occurs anywhere in the USING clause.
119 **
120 ** Return FALSE if the USING clause is NULL or if it does not contain
121 ** zCol.
122 */
123 static int nameInUsingClause(IdList *pUsing, const char *zCol){
124   if( pUsing ){
125     int k;
126     for(k=0; k<pUsing->nId; k++){
127       if( sqlite3StrICmp(pUsing->a[k].zName, zCol)==0 ) return 1;
128     }
129   }
130   return 0;
131 }
132 
133 /*
134 ** Subqueries stores the original database, table and column names for their
135 ** result sets in ExprList.a[].zSpan, in the form "DATABASE.TABLE.COLUMN".
136 ** Check to see if the zSpan given to this routine matches the zDb, zTab,
137 ** and zCol.  If any of zDb, zTab, and zCol are NULL then those fields will
138 ** match anything.
139 */
140 int sqlite3MatchEName(
141   const struct ExprList_item *pItem,
142   const char *zCol,
143   const char *zTab,
144   const char *zDb
145 ){
146   int n;
147   const char *zSpan;
148   if( pItem->eEName!=ENAME_TAB ) return 0;
149   zSpan = pItem->zEName;
150   for(n=0; ALWAYS(zSpan[n]) && zSpan[n]!='.'; n++){}
151   if( zDb && (sqlite3StrNICmp(zSpan, zDb, n)!=0 || zDb[n]!=0) ){
152     return 0;
153   }
154   zSpan += n+1;
155   for(n=0; ALWAYS(zSpan[n]) && zSpan[n]!='.'; n++){}
156   if( zTab && (sqlite3StrNICmp(zSpan, zTab, n)!=0 || zTab[n]!=0) ){
157     return 0;
158   }
159   zSpan += n+1;
160   if( zCol && sqlite3StrICmp(zSpan, zCol)!=0 ){
161     return 0;
162   }
163   return 1;
164 }
165 
166 /*
167 ** Return TRUE if the double-quoted string  mis-feature should be supported.
168 */
169 static int areDoubleQuotedStringsEnabled(sqlite3 *db, NameContext *pTopNC){
170   if( db->init.busy ) return 1;  /* Always support for legacy schemas */
171   if( pTopNC->ncFlags & NC_IsDDL ){
172     /* Currently parsing a DDL statement */
173     if( sqlite3WritableSchema(db) && (db->flags & SQLITE_DqsDML)!=0 ){
174       return 1;
175     }
176     return (db->flags & SQLITE_DqsDDL)!=0;
177   }else{
178     /* Currently parsing a DML statement */
179     return (db->flags & SQLITE_DqsDML)!=0;
180   }
181 }
182 
183 /*
184 ** The argument is guaranteed to be a non-NULL Expr node of type TK_COLUMN.
185 ** return the appropriate colUsed mask.
186 */
187 Bitmask sqlite3ExprColUsed(Expr *pExpr){
188   int n;
189   Table *pExTab;
190 
191   n = pExpr->iColumn;
192   pExTab = pExpr->y.pTab;
193   assert( pExTab!=0 );
194   if( (pExTab->tabFlags & TF_HasGenerated)!=0
195    && (pExTab->aCol[n].colFlags & COLFLAG_GENERATED)!=0
196   ){
197     testcase( pExTab->nCol==BMS-1 );
198     testcase( pExTab->nCol==BMS );
199     return pExTab->nCol>=BMS ? ALLBITS : MASKBIT(pExTab->nCol)-1;
200   }else{
201     testcase( n==BMS-1 );
202     testcase( n==BMS );
203     if( n>=BMS ) n = BMS-1;
204     return ((Bitmask)1)<<n;
205   }
206 }
207 
208 /*
209 ** Given the name of a column of the form X.Y.Z or Y.Z or just Z, look up
210 ** that name in the set of source tables in pSrcList and make the pExpr
211 ** expression node refer back to that source column.  The following changes
212 ** are made to pExpr:
213 **
214 **    pExpr->iDb           Set the index in db->aDb[] of the database X
215 **                         (even if X is implied).
216 **    pExpr->iTable        Set to the cursor number for the table obtained
217 **                         from pSrcList.
218 **    pExpr->y.pTab        Points to the Table structure of X.Y (even if
219 **                         X and/or Y are implied.)
220 **    pExpr->iColumn       Set to the column number within the table.
221 **    pExpr->op            Set to TK_COLUMN.
222 **    pExpr->pLeft         Any expression this points to is deleted
223 **    pExpr->pRight        Any expression this points to is deleted.
224 **
225 ** The zDb variable is the name of the database (the "X").  This value may be
226 ** NULL meaning that name is of the form Y.Z or Z.  Any available database
227 ** can be used.  The zTable variable is the name of the table (the "Y").  This
228 ** value can be NULL if zDb is also NULL.  If zTable is NULL it
229 ** means that the form of the name is Z and that columns from any table
230 ** can be used.
231 **
232 ** If the name cannot be resolved unambiguously, leave an error message
233 ** in pParse and return WRC_Abort.  Return WRC_Prune on success.
234 */
235 static int lookupName(
236   Parse *pParse,       /* The parsing context */
237   const char *zDb,     /* Name of the database containing table, or NULL */
238   const char *zTab,    /* Name of table containing column, or NULL */
239   const char *zCol,    /* Name of the column. */
240   NameContext *pNC,    /* The name context used to resolve the name */
241   Expr *pExpr          /* Make this EXPR node point to the selected column */
242 ){
243   int i, j;                         /* Loop counters */
244   int cnt = 0;                      /* Number of matching column names */
245   int cntTab = 0;                   /* Number of matching table names */
246   int nSubquery = 0;                /* How many levels of subquery */
247   sqlite3 *db = pParse->db;         /* The database connection */
248   struct SrcList_item *pItem;       /* Use for looping over pSrcList items */
249   struct SrcList_item *pMatch = 0;  /* The matching pSrcList item */
250   NameContext *pTopNC = pNC;        /* First namecontext in the list */
251   Schema *pSchema = 0;              /* Schema of the expression */
252   int eNewExprOp = TK_COLUMN;       /* New value for pExpr->op on success */
253   Table *pTab = 0;                  /* Table hold the row */
254   Column *pCol;                     /* A column of pTab */
255 
256   assert( pNC );     /* the name context cannot be NULL. */
257   assert( zCol );    /* The Z in X.Y.Z cannot be NULL */
258   assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
259 
260   /* Initialize the node to no-match */
261   pExpr->iTable = -1;
262   ExprSetVVAProperty(pExpr, EP_NoReduce);
263 
264   /* Translate the schema name in zDb into a pointer to the corresponding
265   ** schema.  If not found, pSchema will remain NULL and nothing will match
266   ** resulting in an appropriate error message toward the end of this routine
267   */
268   if( zDb ){
269     testcase( pNC->ncFlags & NC_PartIdx );
270     testcase( pNC->ncFlags & NC_IsCheck );
271     if( (pNC->ncFlags & (NC_PartIdx|NC_IsCheck))!=0 ){
272       /* Silently ignore database qualifiers inside CHECK constraints and
273       ** partial indices.  Do not raise errors because that might break
274       ** legacy and because it does not hurt anything to just ignore the
275       ** database name. */
276       zDb = 0;
277     }else{
278       for(i=0; i<db->nDb; i++){
279         assert( db->aDb[i].zDbSName );
280         if( sqlite3StrICmp(db->aDb[i].zDbSName,zDb)==0 ){
281           pSchema = db->aDb[i].pSchema;
282           break;
283         }
284       }
285       if( i==db->nDb && sqlite3StrICmp("main", zDb)==0 ){
286         /* This branch is taken when the main database has been renamed
287         ** using SQLITE_DBCONFIG_MAINDBNAME. */
288         pSchema = db->aDb[0].pSchema;
289         zDb = db->aDb[0].zDbSName;
290       }
291     }
292   }
293 
294   /* Start at the inner-most context and move outward until a match is found */
295   assert( pNC && cnt==0 );
296   do{
297     ExprList *pEList;
298     SrcList *pSrcList = pNC->pSrcList;
299 
300     if( pSrcList ){
301       for(i=0, pItem=pSrcList->a; i<pSrcList->nSrc; i++, pItem++){
302         u8 hCol;
303         pTab = pItem->pTab;
304         assert( pTab!=0 && pTab->zName!=0 );
305         assert( pTab->nCol>0 );
306         if( pItem->pSelect && (pItem->pSelect->selFlags & SF_NestedFrom)!=0 ){
307           int hit = 0;
308           pEList = pItem->pSelect->pEList;
309           for(j=0; j<pEList->nExpr; j++){
310             if( sqlite3MatchEName(&pEList->a[j], zCol, zTab, zDb) ){
311               cnt++;
312               cntTab = 2;
313               pMatch = pItem;
314               pExpr->iColumn = j;
315               hit = 1;
316             }
317           }
318           if( hit || zTab==0 ) continue;
319         }
320         if( zDb && pTab->pSchema!=pSchema ){
321           continue;
322         }
323         if( zTab ){
324           const char *zTabName = pItem->zAlias ? pItem->zAlias : pTab->zName;
325           assert( zTabName!=0 );
326           if( sqlite3StrICmp(zTabName, zTab)!=0 ){
327             continue;
328           }
329           if( IN_RENAME_OBJECT && pItem->zAlias ){
330             sqlite3RenameTokenRemap(pParse, 0, (void*)&pExpr->y.pTab);
331           }
332         }
333         if( 0==(cntTab++) ){
334           pMatch = pItem;
335         }
336         hCol = sqlite3StrIHash(zCol);
337         for(j=0, pCol=pTab->aCol; j<pTab->nCol; j++, pCol++){
338           if( pCol->hName==hCol && sqlite3StrICmp(pCol->zName, zCol)==0 ){
339             /* If there has been exactly one prior match and this match
340             ** is for the right-hand table of a NATURAL JOIN or is in a
341             ** USING clause, then skip this match.
342             */
343             if( cnt==1 ){
344               if( pItem->fg.jointype & JT_NATURAL ) continue;
345               if( nameInUsingClause(pItem->pUsing, zCol) ) continue;
346             }
347             cnt++;
348             pMatch = pItem;
349             /* Substitute the rowid (column -1) for the INTEGER PRIMARY KEY */
350             pExpr->iColumn = j==pTab->iPKey ? -1 : (i16)j;
351             break;
352           }
353         }
354       }
355       if( pMatch ){
356         pExpr->iTable = pMatch->iCursor;
357         pExpr->y.pTab = pMatch->pTab;
358         /* RIGHT JOIN not (yet) supported */
359         assert( (pMatch->fg.jointype & JT_RIGHT)==0 );
360         if( (pMatch->fg.jointype & JT_LEFT)!=0 ){
361           ExprSetProperty(pExpr, EP_CanBeNull);
362         }
363         pSchema = pExpr->y.pTab->pSchema;
364       }
365     } /* if( pSrcList ) */
366 
367 #if !defined(SQLITE_OMIT_TRIGGER) || !defined(SQLITE_OMIT_UPSERT)
368     /* If we have not already resolved the name, then maybe
369     ** it is a new.* or old.* trigger argument reference.  Or
370     ** maybe it is an excluded.* from an upsert.  Or maybe it is
371     ** a reference in the RETURNING clause to a table being modified.
372     */
373     if( cnt==0 && zDb==0 ){
374       pTab = 0;
375 #ifndef SQLITE_OMIT_TRIGGER
376       if( pParse->pTriggerTab!=0 ){
377         int op = pParse->eTriggerOp;
378         assert( op==TK_DELETE || op==TK_UPDATE || op==TK_INSERT );
379         if( op!=TK_DELETE && zTab && sqlite3StrICmp("new",zTab) == 0 ){
380           pExpr->iTable = 1;
381           pTab = pParse->pTriggerTab;
382         }else if( op!=TK_INSERT && zTab && sqlite3StrICmp("old",zTab)==0 ){
383           pExpr->iTable = 0;
384           pTab = pParse->pTriggerTab;
385         }else if( pParse->bReturning && (pNC->ncFlags & NC_UBaseReg)!=0 ){
386           pExpr->iTable = op!=TK_DELETE;
387           pTab = pParse->pTriggerTab;
388         }
389       }
390 #endif /* SQLITE_OMIT_TRIGGER */
391 #ifndef SQLITE_OMIT_UPSERT
392       if( (pNC->ncFlags & NC_UUpsert)!=0 && zTab!=0 ){
393         Upsert *pUpsert = pNC->uNC.pUpsert;
394         if( pUpsert && sqlite3StrICmp("excluded",zTab)==0 ){
395           pTab = pUpsert->pUpsertSrc->a[0].pTab;
396           pExpr->iTable = EXCLUDED_TABLE_NUMBER;
397         }
398       }
399 #endif /* SQLITE_OMIT_UPSERT */
400 
401       if( pTab ){
402         int iCol;
403         u8 hCol = sqlite3StrIHash(zCol);
404         pSchema = pTab->pSchema;
405         cntTab++;
406         for(iCol=0, pCol=pTab->aCol; iCol<pTab->nCol; iCol++, pCol++){
407           if( pCol->hName==hCol && sqlite3StrICmp(pCol->zName, zCol)==0 ){
408             if( iCol==pTab->iPKey ){
409               iCol = -1;
410             }
411             break;
412           }
413         }
414         if( iCol>=pTab->nCol && sqlite3IsRowid(zCol) && VisibleRowid(pTab) ){
415           /* IMP: R-51414-32910 */
416           iCol = -1;
417         }
418         if( iCol<pTab->nCol ){
419           cnt++;
420 #ifndef SQLITE_OMIT_UPSERT
421           if( pExpr->iTable==EXCLUDED_TABLE_NUMBER ){
422             testcase( iCol==(-1) );
423             if( IN_RENAME_OBJECT ){
424               pExpr->iColumn = iCol;
425               pExpr->y.pTab = pTab;
426               eNewExprOp = TK_COLUMN;
427             }else{
428               pExpr->iTable = pNC->uNC.pUpsert->regData +
429                  sqlite3TableColumnToStorage(pTab, iCol);
430               eNewExprOp = TK_REGISTER;
431             }
432           }else
433 #endif /* SQLITE_OMIT_UPSERT */
434           {
435             pExpr->y.pTab = pTab;
436             if( pParse->bReturning ){
437               eNewExprOp = TK_REGISTER;
438               pExpr->iTable = pNC->uNC.iBaseReg + (pTab->nCol+1)*pExpr->iTable
439                                 + iCol + 1;
440             }else{
441               pExpr->iColumn = (i16)iCol;
442               eNewExprOp = TK_TRIGGER;
443 #ifndef SQLITE_OMIT_TRIGGER
444               if( iCol<0 ){
445                 pExpr->affExpr = SQLITE_AFF_INTEGER;
446               }else if( pExpr->iTable==0 ){
447                 testcase( iCol==31 );
448                 testcase( iCol==32 );
449                 pParse->oldmask |= (iCol>=32 ? 0xffffffff : (((u32)1)<<iCol));
450               }else{
451                 testcase( iCol==31 );
452                 testcase( iCol==32 );
453                 pParse->newmask |= (iCol>=32 ? 0xffffffff : (((u32)1)<<iCol));
454               }
455 #endif /* SQLITE_OMIT_TRIGGER */
456             }
457           }
458         }
459       }
460     }
461 #endif /* !defined(SQLITE_OMIT_TRIGGER) || !defined(SQLITE_OMIT_UPSERT) */
462 
463     /*
464     ** Perhaps the name is a reference to the ROWID
465     */
466     if( cnt==0
467      && cntTab==1
468      && pMatch
469      && (pNC->ncFlags & (NC_IdxExpr|NC_GenCol))==0
470      && sqlite3IsRowid(zCol)
471      && VisibleRowid(pMatch->pTab)
472     ){
473       cnt = 1;
474       pExpr->iColumn = -1;
475       pExpr->affExpr = SQLITE_AFF_INTEGER;
476     }
477 
478     /*
479     ** If the input is of the form Z (not Y.Z or X.Y.Z) then the name Z
480     ** might refer to an result-set alias.  This happens, for example, when
481     ** we are resolving names in the WHERE clause of the following command:
482     **
483     **     SELECT a+b AS x FROM table WHERE x<10;
484     **
485     ** In cases like this, replace pExpr with a copy of the expression that
486     ** forms the result set entry ("a+b" in the example) and return immediately.
487     ** Note that the expression in the result set should have already been
488     ** resolved by the time the WHERE clause is resolved.
489     **
490     ** The ability to use an output result-set column in the WHERE, GROUP BY,
491     ** or HAVING clauses, or as part of a larger expression in the ORDER BY
492     ** clause is not standard SQL.  This is a (goofy) SQLite extension, that
493     ** is supported for backwards compatibility only. Hence, we issue a warning
494     ** on sqlite3_log() whenever the capability is used.
495     */
496     if( (pNC->ncFlags & NC_UEList)!=0
497      && cnt==0
498      && zTab==0
499     ){
500       pEList = pNC->uNC.pEList;
501       assert( pEList!=0 );
502       for(j=0; j<pEList->nExpr; j++){
503         char *zAs = pEList->a[j].zEName;
504         if( pEList->a[j].eEName==ENAME_NAME
505          && sqlite3_stricmp(zAs, zCol)==0
506         ){
507           Expr *pOrig;
508           assert( pExpr->pLeft==0 && pExpr->pRight==0 );
509           assert( pExpr->x.pList==0 );
510           assert( pExpr->x.pSelect==0 );
511           pOrig = pEList->a[j].pExpr;
512           if( (pNC->ncFlags&NC_AllowAgg)==0 && ExprHasProperty(pOrig, EP_Agg) ){
513             sqlite3ErrorMsg(pParse, "misuse of aliased aggregate %s", zAs);
514             return WRC_Abort;
515           }
516           if( ExprHasProperty(pOrig, EP_Win)
517            && ((pNC->ncFlags&NC_AllowWin)==0 || pNC!=pTopNC )
518           ){
519             sqlite3ErrorMsg(pParse, "misuse of aliased window function %s",zAs);
520             return WRC_Abort;
521           }
522           if( sqlite3ExprVectorSize(pOrig)!=1 ){
523             sqlite3ErrorMsg(pParse, "row value misused");
524             return WRC_Abort;
525           }
526           resolveAlias(pParse, pEList, j, pExpr, nSubquery);
527           cnt = 1;
528           pMatch = 0;
529           assert( zTab==0 && zDb==0 );
530           if( IN_RENAME_OBJECT ){
531             sqlite3RenameTokenRemap(pParse, 0, (void*)pExpr);
532           }
533           goto lookupname_end;
534         }
535       }
536     }
537 
538     /* Advance to the next name context.  The loop will exit when either
539     ** we have a match (cnt>0) or when we run out of name contexts.
540     */
541     if( cnt ) break;
542     pNC = pNC->pNext;
543     nSubquery++;
544   }while( pNC );
545 
546 
547   /*
548   ** If X and Y are NULL (in other words if only the column name Z is
549   ** supplied) and the value of Z is enclosed in double-quotes, then
550   ** Z is a string literal if it doesn't match any column names.  In that
551   ** case, we need to return right away and not make any changes to
552   ** pExpr.
553   **
554   ** Because no reference was made to outer contexts, the pNC->nRef
555   ** fields are not changed in any context.
556   */
557   if( cnt==0 && zTab==0 ){
558     assert( pExpr->op==TK_ID );
559     if( ExprHasProperty(pExpr,EP_DblQuoted)
560      && areDoubleQuotedStringsEnabled(db, pTopNC)
561     ){
562       /* If a double-quoted identifier does not match any known column name,
563       ** then treat it as a string.
564       **
565       ** This hack was added in the early days of SQLite in a misguided attempt
566       ** to be compatible with MySQL 3.x, which used double-quotes for strings.
567       ** I now sorely regret putting in this hack. The effect of this hack is
568       ** that misspelled identifier names are silently converted into strings
569       ** rather than causing an error, to the frustration of countless
570       ** programmers. To all those frustrated programmers, my apologies.
571       **
572       ** Someday, I hope to get rid of this hack. Unfortunately there is
573       ** a huge amount of legacy SQL that uses it. So for now, we just
574       ** issue a warning.
575       */
576       sqlite3_log(SQLITE_WARNING,
577         "double-quoted string literal: \"%w\"", zCol);
578 #ifdef SQLITE_ENABLE_NORMALIZE
579       sqlite3VdbeAddDblquoteStr(db, pParse->pVdbe, zCol);
580 #endif
581       pExpr->op = TK_STRING;
582       pExpr->y.pTab = 0;
583       return WRC_Prune;
584     }
585     if( sqlite3ExprIdToTrueFalse(pExpr) ){
586       return WRC_Prune;
587     }
588   }
589 
590   /*
591   ** cnt==0 means there was not match.  cnt>1 means there were two or
592   ** more matches.  Either way, we have an error.
593   */
594   if( cnt!=1 ){
595     const char *zErr;
596     zErr = cnt==0 ? "no such column" : "ambiguous column name";
597     if( zDb ){
598       sqlite3ErrorMsg(pParse, "%s: %s.%s.%s", zErr, zDb, zTab, zCol);
599     }else if( zTab ){
600       sqlite3ErrorMsg(pParse, "%s: %s.%s", zErr, zTab, zCol);
601     }else{
602       sqlite3ErrorMsg(pParse, "%s: %s", zErr, zCol);
603     }
604     pParse->checkSchema = 1;
605     pTopNC->nErr++;
606   }
607 
608   /* If a column from a table in pSrcList is referenced, then record
609   ** this fact in the pSrcList.a[].colUsed bitmask.  Column 0 causes
610   ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.  Bit 63 is
611   ** set if the 63rd or any subsequent column is used.
612   **
613   ** The colUsed mask is an optimization used to help determine if an
614   ** index is a covering index.  The correct answer is still obtained
615   ** if the mask contains extra set bits.  However, it is important to
616   ** avoid setting bits beyond the maximum column number of the table.
617   ** (See ticket [b92e5e8ec2cdbaa1]).
618   **
619   ** If a generated column is referenced, set bits for every column
620   ** of the table.
621   */
622   if( pExpr->iColumn>=0 && pMatch!=0 ){
623     pMatch->colUsed |= sqlite3ExprColUsed(pExpr);
624   }
625 
626   /* Clean up and return
627   */
628   if( !ExprHasProperty(pExpr,(EP_TokenOnly|EP_Leaf)) ){
629     sqlite3ExprDelete(db, pExpr->pLeft);
630     pExpr->pLeft = 0;
631     sqlite3ExprDelete(db, pExpr->pRight);
632     pExpr->pRight = 0;
633   }
634   pExpr->op = eNewExprOp;
635   ExprSetProperty(pExpr, EP_Leaf);
636 lookupname_end:
637   if( cnt==1 ){
638     assert( pNC!=0 );
639     if( pParse->db->xAuth
640      && (pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER)
641     ){
642       sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList);
643     }
644     /* Increment the nRef value on all name contexts from TopNC up to
645     ** the point where the name matched. */
646     for(;;){
647       assert( pTopNC!=0 );
648       pTopNC->nRef++;
649       if( pTopNC==pNC ) break;
650       pTopNC = pTopNC->pNext;
651     }
652     return WRC_Prune;
653   } else {
654     return WRC_Abort;
655   }
656 }
657 
658 /*
659 ** Allocate and return a pointer to an expression to load the column iCol
660 ** from datasource iSrc in SrcList pSrc.
661 */
662 Expr *sqlite3CreateColumnExpr(sqlite3 *db, SrcList *pSrc, int iSrc, int iCol){
663   Expr *p = sqlite3ExprAlloc(db, TK_COLUMN, 0, 0);
664   if( p ){
665     struct SrcList_item *pItem = &pSrc->a[iSrc];
666     Table *pTab = p->y.pTab = pItem->pTab;
667     p->iTable = pItem->iCursor;
668     if( p->y.pTab->iPKey==iCol ){
669       p->iColumn = -1;
670     }else{
671       p->iColumn = (ynVar)iCol;
672       if( (pTab->tabFlags & TF_HasGenerated)!=0
673        && (pTab->aCol[iCol].colFlags & COLFLAG_GENERATED)!=0
674       ){
675         testcase( pTab->nCol==63 );
676         testcase( pTab->nCol==64 );
677         pItem->colUsed = pTab->nCol>=64 ? ALLBITS : MASKBIT(pTab->nCol)-1;
678       }else{
679         testcase( iCol==BMS );
680         testcase( iCol==BMS-1 );
681         pItem->colUsed |= ((Bitmask)1)<<(iCol>=BMS ? BMS-1 : iCol);
682       }
683     }
684   }
685   return p;
686 }
687 
688 /*
689 ** Report an error that an expression is not valid for some set of
690 ** pNC->ncFlags values determined by validMask.
691 **
692 ** static void notValid(
693 **   Parse *pParse,       // Leave error message here
694 **   NameContext *pNC,    // The name context
695 **   const char *zMsg,    // Type of error
696 **   int validMask,       // Set of contexts for which prohibited
697 **   Expr *pExpr          // Invalidate this expression on error
698 ** ){...}
699 **
700 ** As an optimization, since the conditional is almost always false
701 ** (because errors are rare), the conditional is moved outside of the
702 ** function call using a macro.
703 */
704 static void notValidImpl(
705    Parse *pParse,       /* Leave error message here */
706    NameContext *pNC,    /* The name context */
707    const char *zMsg,    /* Type of error */
708    Expr *pExpr          /* Invalidate this expression on error */
709 ){
710   const char *zIn = "partial index WHERE clauses";
711   if( pNC->ncFlags & NC_IdxExpr )      zIn = "index expressions";
712 #ifndef SQLITE_OMIT_CHECK
713   else if( pNC->ncFlags & NC_IsCheck ) zIn = "CHECK constraints";
714 #endif
715 #ifndef SQLITE_OMIT_GENERATED_COLUMNS
716   else if( pNC->ncFlags & NC_GenCol ) zIn = "generated columns";
717 #endif
718   sqlite3ErrorMsg(pParse, "%s prohibited in %s", zMsg, zIn);
719   if( pExpr ) pExpr->op = TK_NULL;
720 }
721 #define sqlite3ResolveNotValid(P,N,M,X,E) \
722   assert( ((X)&~(NC_IsCheck|NC_PartIdx|NC_IdxExpr|NC_GenCol))==0 ); \
723   if( ((N)->ncFlags & (X))!=0 ) notValidImpl(P,N,M,E);
724 
725 /*
726 ** Expression p should encode a floating point value between 1.0 and 0.0.
727 ** Return 1024 times this value.  Or return -1 if p is not a floating point
728 ** value between 1.0 and 0.0.
729 */
730 static int exprProbability(Expr *p){
731   double r = -1.0;
732   if( p->op!=TK_FLOAT ) return -1;
733   sqlite3AtoF(p->u.zToken, &r, sqlite3Strlen30(p->u.zToken), SQLITE_UTF8);
734   assert( r>=0.0 );
735   if( r>1.0 ) return -1;
736   return (int)(r*134217728.0);
737 }
738 
739 /*
740 ** This routine is callback for sqlite3WalkExpr().
741 **
742 ** Resolve symbolic names into TK_COLUMN operators for the current
743 ** node in the expression tree.  Return 0 to continue the search down
744 ** the tree or 2 to abort the tree walk.
745 **
746 ** This routine also does error checking and name resolution for
747 ** function names.  The operator for aggregate functions is changed
748 ** to TK_AGG_FUNCTION.
749 */
750 static int resolveExprStep(Walker *pWalker, Expr *pExpr){
751   NameContext *pNC;
752   Parse *pParse;
753 
754   pNC = pWalker->u.pNC;
755   assert( pNC!=0 );
756   pParse = pNC->pParse;
757   assert( pParse==pWalker->pParse );
758 
759 #ifndef NDEBUG
760   if( pNC->pSrcList && pNC->pSrcList->nAlloc>0 ){
761     SrcList *pSrcList = pNC->pSrcList;
762     int i;
763     for(i=0; i<pNC->pSrcList->nSrc; i++){
764       assert( pSrcList->a[i].iCursor>=0 && pSrcList->a[i].iCursor<pParse->nTab);
765     }
766   }
767 #endif
768   switch( pExpr->op ){
769 
770     /* The special operator TK_ROW means use the rowid for the first
771     ** column in the FROM clause.  This is used by the LIMIT and ORDER BY
772     ** clause processing on UPDATE and DELETE statements, and by
773     ** UPDATE ... FROM statement processing.
774     */
775     case TK_ROW: {
776       SrcList *pSrcList = pNC->pSrcList;
777       struct SrcList_item *pItem;
778       assert( pSrcList && pSrcList->nSrc>=1 );
779       pItem = pSrcList->a;
780       pExpr->op = TK_COLUMN;
781       pExpr->y.pTab = pItem->pTab;
782       pExpr->iTable = pItem->iCursor;
783       pExpr->iColumn--;
784       pExpr->affExpr = SQLITE_AFF_INTEGER;
785       break;
786     }
787 
788     /* A column name:                    ID
789     ** Or table name and column name:    ID.ID
790     ** Or a database, table and column:  ID.ID.ID
791     **
792     ** The TK_ID and TK_OUT cases are combined so that there will only
793     ** be one call to lookupName().  Then the compiler will in-line
794     ** lookupName() for a size reduction and performance increase.
795     */
796     case TK_ID:
797     case TK_DOT: {
798       const char *zColumn;
799       const char *zTable;
800       const char *zDb;
801       Expr *pRight;
802 
803       if( pExpr->op==TK_ID ){
804         zDb = 0;
805         zTable = 0;
806         zColumn = pExpr->u.zToken;
807       }else{
808         Expr *pLeft = pExpr->pLeft;
809         testcase( pNC->ncFlags & NC_IdxExpr );
810         testcase( pNC->ncFlags & NC_GenCol );
811         sqlite3ResolveNotValid(pParse, pNC, "the \".\" operator",
812                                NC_IdxExpr|NC_GenCol, 0);
813         pRight = pExpr->pRight;
814         if( pRight->op==TK_ID ){
815           zDb = 0;
816         }else{
817           assert( pRight->op==TK_DOT );
818           zDb = pLeft->u.zToken;
819           pLeft = pRight->pLeft;
820           pRight = pRight->pRight;
821         }
822         zTable = pLeft->u.zToken;
823         zColumn = pRight->u.zToken;
824         if( IN_RENAME_OBJECT ){
825           sqlite3RenameTokenRemap(pParse, (void*)pExpr, (void*)pRight);
826           sqlite3RenameTokenRemap(pParse, (void*)&pExpr->y.pTab, (void*)pLeft);
827         }
828       }
829       return lookupName(pParse, zDb, zTable, zColumn, pNC, pExpr);
830     }
831 
832     /* Resolve function names
833     */
834     case TK_FUNCTION: {
835       ExprList *pList = pExpr->x.pList;    /* The argument list */
836       int n = pList ? pList->nExpr : 0;    /* Number of arguments */
837       int no_such_func = 0;       /* True if no such function exists */
838       int wrong_num_args = 0;     /* True if wrong number of arguments */
839       int is_agg = 0;             /* True if is an aggregate function */
840       int nId;                    /* Number of characters in function name */
841       const char *zId;            /* The function name. */
842       FuncDef *pDef;              /* Information about the function */
843       u8 enc = ENC(pParse->db);   /* The database encoding */
844       int savedAllowFlags = (pNC->ncFlags & (NC_AllowAgg | NC_AllowWin));
845 #ifndef SQLITE_OMIT_WINDOWFUNC
846       Window *pWin = (IsWindowFunc(pExpr) ? pExpr->y.pWin : 0);
847 #endif
848       assert( !ExprHasProperty(pExpr, EP_xIsSelect) );
849       zId = pExpr->u.zToken;
850       nId = sqlite3Strlen30(zId);
851       pDef = sqlite3FindFunction(pParse->db, zId, n, enc, 0);
852       if( pDef==0 ){
853         pDef = sqlite3FindFunction(pParse->db, zId, -2, enc, 0);
854         if( pDef==0 ){
855           no_such_func = 1;
856         }else{
857           wrong_num_args = 1;
858         }
859       }else{
860         is_agg = pDef->xFinalize!=0;
861         if( pDef->funcFlags & SQLITE_FUNC_UNLIKELY ){
862           ExprSetProperty(pExpr, EP_Unlikely);
863           if( n==2 ){
864             pExpr->iTable = exprProbability(pList->a[1].pExpr);
865             if( pExpr->iTable<0 ){
866               sqlite3ErrorMsg(pParse,
867                 "second argument to likelihood() must be a "
868                 "constant between 0.0 and 1.0");
869               pNC->nErr++;
870             }
871           }else{
872             /* EVIDENCE-OF: R-61304-29449 The unlikely(X) function is
873             ** equivalent to likelihood(X, 0.0625).
874             ** EVIDENCE-OF: R-01283-11636 The unlikely(X) function is
875             ** short-hand for likelihood(X,0.0625).
876             ** EVIDENCE-OF: R-36850-34127 The likely(X) function is short-hand
877             ** for likelihood(X,0.9375).
878             ** EVIDENCE-OF: R-53436-40973 The likely(X) function is equivalent
879             ** to likelihood(X,0.9375). */
880             /* TUNING: unlikely() probability is 0.0625.  likely() is 0.9375 */
881             pExpr->iTable = pDef->zName[0]=='u' ? 8388608 : 125829120;
882           }
883         }
884 #ifndef SQLITE_OMIT_AUTHORIZATION
885         {
886           int auth = sqlite3AuthCheck(pParse, SQLITE_FUNCTION, 0,pDef->zName,0);
887           if( auth!=SQLITE_OK ){
888             if( auth==SQLITE_DENY ){
889               sqlite3ErrorMsg(pParse, "not authorized to use function: %s",
890                                       pDef->zName);
891               pNC->nErr++;
892             }
893             pExpr->op = TK_NULL;
894             return WRC_Prune;
895           }
896         }
897 #endif
898         if( pDef->funcFlags & (SQLITE_FUNC_CONSTANT|SQLITE_FUNC_SLOCHNG) ){
899           /* For the purposes of the EP_ConstFunc flag, date and time
900           ** functions and other functions that change slowly are considered
901           ** constant because they are constant for the duration of one query.
902           ** This allows them to be factored out of inner loops. */
903           ExprSetProperty(pExpr,EP_ConstFunc);
904         }
905         if( (pDef->funcFlags & SQLITE_FUNC_CONSTANT)==0 ){
906           /* Clearly non-deterministic functions like random(), but also
907           ** date/time functions that use 'now', and other functions like
908           ** sqlite_version() that might change over time cannot be used
909           ** in an index or generated column.  Curiously, they can be used
910           ** in a CHECK constraint.  SQLServer, MySQL, and PostgreSQL all
911           ** all this. */
912           sqlite3ResolveNotValid(pParse, pNC, "non-deterministic functions",
913                                  NC_IdxExpr|NC_PartIdx|NC_GenCol, 0);
914         }else{
915           assert( (NC_SelfRef & 0xff)==NC_SelfRef ); /* Must fit in 8 bits */
916           pExpr->op2 = pNC->ncFlags & NC_SelfRef;
917           if( pNC->ncFlags & NC_FromDDL ) ExprSetProperty(pExpr, EP_FromDDL);
918         }
919         if( (pDef->funcFlags & SQLITE_FUNC_INTERNAL)!=0
920          && pParse->nested==0
921          && (pParse->db->mDbFlags & DBFLAG_InternalFunc)==0
922         ){
923           /* Internal-use-only functions are disallowed unless the
924           ** SQL is being compiled using sqlite3NestedParse() or
925           ** the SQLITE_TESTCTRL_INTERNAL_FUNCTIONS test-control has be
926           ** used to activate internal functionsn for testing purposes */
927           no_such_func = 1;
928           pDef = 0;
929         }else
930         if( (pDef->funcFlags & (SQLITE_FUNC_DIRECT|SQLITE_FUNC_UNSAFE))!=0
931          && !IN_RENAME_OBJECT
932         ){
933           sqlite3ExprFunctionUsable(pParse, pExpr, pDef);
934         }
935       }
936 
937       if( 0==IN_RENAME_OBJECT ){
938 #ifndef SQLITE_OMIT_WINDOWFUNC
939         assert( is_agg==0 || (pDef->funcFlags & SQLITE_FUNC_MINMAX)
940           || (pDef->xValue==0 && pDef->xInverse==0)
941           || (pDef->xValue && pDef->xInverse && pDef->xSFunc && pDef->xFinalize)
942         );
943         if( pDef && pDef->xValue==0 && pWin ){
944           sqlite3ErrorMsg(pParse,
945               "%.*s() may not be used as a window function", nId, zId
946           );
947           pNC->nErr++;
948         }else if(
949               (is_agg && (pNC->ncFlags & NC_AllowAgg)==0)
950            || (is_agg && (pDef->funcFlags&SQLITE_FUNC_WINDOW) && !pWin)
951            || (is_agg && pWin && (pNC->ncFlags & NC_AllowWin)==0)
952         ){
953           const char *zType;
954           if( (pDef->funcFlags & SQLITE_FUNC_WINDOW) || pWin ){
955             zType = "window";
956           }else{
957             zType = "aggregate";
958           }
959           sqlite3ErrorMsg(pParse, "misuse of %s function %.*s()",zType,nId,zId);
960           pNC->nErr++;
961           is_agg = 0;
962         }
963 #else
964         if( (is_agg && (pNC->ncFlags & NC_AllowAgg)==0) ){
965           sqlite3ErrorMsg(pParse,"misuse of aggregate function %.*s()",nId,zId);
966           pNC->nErr++;
967           is_agg = 0;
968         }
969 #endif
970         else if( no_such_func && pParse->db->init.busy==0
971 #ifdef SQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
972                   && pParse->explain==0
973 #endif
974         ){
975           sqlite3ErrorMsg(pParse, "no such function: %.*s", nId, zId);
976           pNC->nErr++;
977         }else if( wrong_num_args ){
978           sqlite3ErrorMsg(pParse,"wrong number of arguments to function %.*s()",
979                nId, zId);
980           pNC->nErr++;
981         }
982 #ifndef SQLITE_OMIT_WINDOWFUNC
983         else if( is_agg==0 && ExprHasProperty(pExpr, EP_WinFunc) ){
984           sqlite3ErrorMsg(pParse,
985               "FILTER may not be used with non-aggregate %.*s()",
986               nId, zId
987           );
988           pNC->nErr++;
989         }
990 #endif
991         if( is_agg ){
992           /* Window functions may not be arguments of aggregate functions.
993           ** Or arguments of other window functions. But aggregate functions
994           ** may be arguments for window functions.  */
995 #ifndef SQLITE_OMIT_WINDOWFUNC
996           pNC->ncFlags &= ~(NC_AllowWin | (!pWin ? NC_AllowAgg : 0));
997 #else
998           pNC->ncFlags &= ~NC_AllowAgg;
999 #endif
1000         }
1001       }
1002 #ifndef SQLITE_OMIT_WINDOWFUNC
1003       else if( ExprHasProperty(pExpr, EP_WinFunc) ){
1004         is_agg = 1;
1005       }
1006 #endif
1007       sqlite3WalkExprList(pWalker, pList);
1008       if( is_agg ){
1009 #ifndef SQLITE_OMIT_WINDOWFUNC
1010         if( pWin ){
1011           Select *pSel = pNC->pWinSelect;
1012           assert( pWin==pExpr->y.pWin );
1013           if( IN_RENAME_OBJECT==0 ){
1014             sqlite3WindowUpdate(pParse, pSel ? pSel->pWinDefn : 0, pWin, pDef);
1015           }
1016           sqlite3WalkExprList(pWalker, pWin->pPartition);
1017           sqlite3WalkExprList(pWalker, pWin->pOrderBy);
1018           sqlite3WalkExpr(pWalker, pWin->pFilter);
1019           sqlite3WindowLink(pSel, pWin);
1020           pNC->ncFlags |= NC_HasWin;
1021         }else
1022 #endif /* SQLITE_OMIT_WINDOWFUNC */
1023         {
1024           NameContext *pNC2 = pNC;
1025           pExpr->op = TK_AGG_FUNCTION;
1026           pExpr->op2 = 0;
1027 #ifndef SQLITE_OMIT_WINDOWFUNC
1028           if( ExprHasProperty(pExpr, EP_WinFunc) ){
1029             sqlite3WalkExpr(pWalker, pExpr->y.pWin->pFilter);
1030           }
1031 #endif
1032           while( pNC2 && !sqlite3FunctionUsesThisSrc(pExpr, pNC2->pSrcList) ){
1033             pExpr->op2++;
1034             pNC2 = pNC2->pNext;
1035           }
1036           assert( pDef!=0 || IN_RENAME_OBJECT );
1037           if( pNC2 && pDef ){
1038             assert( SQLITE_FUNC_MINMAX==NC_MinMaxAgg );
1039             testcase( (pDef->funcFlags & SQLITE_FUNC_MINMAX)!=0 );
1040             pNC2->ncFlags |= NC_HasAgg | (pDef->funcFlags & SQLITE_FUNC_MINMAX);
1041 
1042           }
1043         }
1044         pNC->ncFlags |= savedAllowFlags;
1045       }
1046       /* FIX ME:  Compute pExpr->affinity based on the expected return
1047       ** type of the function
1048       */
1049       return WRC_Prune;
1050     }
1051 #ifndef SQLITE_OMIT_SUBQUERY
1052     case TK_SELECT:
1053     case TK_EXISTS:  testcase( pExpr->op==TK_EXISTS );
1054 #endif
1055     case TK_IN: {
1056       testcase( pExpr->op==TK_IN );
1057       if( ExprHasProperty(pExpr, EP_xIsSelect) ){
1058         int nRef = pNC->nRef;
1059         testcase( pNC->ncFlags & NC_IsCheck );
1060         testcase( pNC->ncFlags & NC_PartIdx );
1061         testcase( pNC->ncFlags & NC_IdxExpr );
1062         testcase( pNC->ncFlags & NC_GenCol );
1063         sqlite3ResolveNotValid(pParse, pNC, "subqueries",
1064                  NC_IsCheck|NC_PartIdx|NC_IdxExpr|NC_GenCol, pExpr);
1065         sqlite3WalkSelect(pWalker, pExpr->x.pSelect);
1066         assert( pNC->nRef>=nRef );
1067         if( nRef!=pNC->nRef ){
1068           ExprSetProperty(pExpr, EP_VarSelect);
1069           pNC->ncFlags |= NC_VarSelect;
1070         }
1071       }
1072       break;
1073     }
1074     case TK_VARIABLE: {
1075       testcase( pNC->ncFlags & NC_IsCheck );
1076       testcase( pNC->ncFlags & NC_PartIdx );
1077       testcase( pNC->ncFlags & NC_IdxExpr );
1078       testcase( pNC->ncFlags & NC_GenCol );
1079       sqlite3ResolveNotValid(pParse, pNC, "parameters",
1080                NC_IsCheck|NC_PartIdx|NC_IdxExpr|NC_GenCol, pExpr);
1081       break;
1082     }
1083     case TK_IS:
1084     case TK_ISNOT: {
1085       Expr *pRight = sqlite3ExprSkipCollateAndLikely(pExpr->pRight);
1086       assert( !ExprHasProperty(pExpr, EP_Reduced) );
1087       /* Handle special cases of "x IS TRUE", "x IS FALSE", "x IS NOT TRUE",
1088       ** and "x IS NOT FALSE". */
1089       if( pRight && (pRight->op==TK_ID || pRight->op==TK_TRUEFALSE) ){
1090         int rc = resolveExprStep(pWalker, pRight);
1091         if( rc==WRC_Abort ) return WRC_Abort;
1092         if( pRight->op==TK_TRUEFALSE ){
1093           pExpr->op2 = pExpr->op;
1094           pExpr->op = TK_TRUTH;
1095           return WRC_Continue;
1096         }
1097       }
1098       /* no break */ deliberate_fall_through
1099     }
1100     case TK_BETWEEN:
1101     case TK_EQ:
1102     case TK_NE:
1103     case TK_LT:
1104     case TK_LE:
1105     case TK_GT:
1106     case TK_GE: {
1107       int nLeft, nRight;
1108       if( pParse->db->mallocFailed ) break;
1109       assert( pExpr->pLeft!=0 );
1110       nLeft = sqlite3ExprVectorSize(pExpr->pLeft);
1111       if( pExpr->op==TK_BETWEEN ){
1112         nRight = sqlite3ExprVectorSize(pExpr->x.pList->a[0].pExpr);
1113         if( nRight==nLeft ){
1114           nRight = sqlite3ExprVectorSize(pExpr->x.pList->a[1].pExpr);
1115         }
1116       }else{
1117         assert( pExpr->pRight!=0 );
1118         nRight = sqlite3ExprVectorSize(pExpr->pRight);
1119       }
1120       if( nLeft!=nRight ){
1121         testcase( pExpr->op==TK_EQ );
1122         testcase( pExpr->op==TK_NE );
1123         testcase( pExpr->op==TK_LT );
1124         testcase( pExpr->op==TK_LE );
1125         testcase( pExpr->op==TK_GT );
1126         testcase( pExpr->op==TK_GE );
1127         testcase( pExpr->op==TK_IS );
1128         testcase( pExpr->op==TK_ISNOT );
1129         testcase( pExpr->op==TK_BETWEEN );
1130         sqlite3ErrorMsg(pParse, "row value misused");
1131       }
1132       break;
1133     }
1134   }
1135   return (pParse->nErr || pParse->db->mallocFailed) ? WRC_Abort : WRC_Continue;
1136 }
1137 
1138 /*
1139 ** pEList is a list of expressions which are really the result set of the
1140 ** a SELECT statement.  pE is a term in an ORDER BY or GROUP BY clause.
1141 ** This routine checks to see if pE is a simple identifier which corresponds
1142 ** to the AS-name of one of the terms of the expression list.  If it is,
1143 ** this routine return an integer between 1 and N where N is the number of
1144 ** elements in pEList, corresponding to the matching entry.  If there is
1145 ** no match, or if pE is not a simple identifier, then this routine
1146 ** return 0.
1147 **
1148 ** pEList has been resolved.  pE has not.
1149 */
1150 static int resolveAsName(
1151   Parse *pParse,     /* Parsing context for error messages */
1152   ExprList *pEList,  /* List of expressions to scan */
1153   Expr *pE           /* Expression we are trying to match */
1154 ){
1155   int i;             /* Loop counter */
1156 
1157   UNUSED_PARAMETER(pParse);
1158 
1159   if( pE->op==TK_ID ){
1160     char *zCol = pE->u.zToken;
1161     for(i=0; i<pEList->nExpr; i++){
1162       if( pEList->a[i].eEName==ENAME_NAME
1163        && sqlite3_stricmp(pEList->a[i].zEName, zCol)==0
1164       ){
1165         return i+1;
1166       }
1167     }
1168   }
1169   return 0;
1170 }
1171 
1172 /*
1173 ** pE is a pointer to an expression which is a single term in the
1174 ** ORDER BY of a compound SELECT.  The expression has not been
1175 ** name resolved.
1176 **
1177 ** At the point this routine is called, we already know that the
1178 ** ORDER BY term is not an integer index into the result set.  That
1179 ** case is handled by the calling routine.
1180 **
1181 ** Attempt to match pE against result set columns in the left-most
1182 ** SELECT statement.  Return the index i of the matching column,
1183 ** as an indication to the caller that it should sort by the i-th column.
1184 ** The left-most column is 1.  In other words, the value returned is the
1185 ** same integer value that would be used in the SQL statement to indicate
1186 ** the column.
1187 **
1188 ** If there is no match, return 0.  Return -1 if an error occurs.
1189 */
1190 static int resolveOrderByTermToExprList(
1191   Parse *pParse,     /* Parsing context for error messages */
1192   Select *pSelect,   /* The SELECT statement with the ORDER BY clause */
1193   Expr *pE           /* The specific ORDER BY term */
1194 ){
1195   int i;             /* Loop counter */
1196   ExprList *pEList;  /* The columns of the result set */
1197   NameContext nc;    /* Name context for resolving pE */
1198   sqlite3 *db;       /* Database connection */
1199   int rc;            /* Return code from subprocedures */
1200   u8 savedSuppErr;   /* Saved value of db->suppressErr */
1201 
1202   assert( sqlite3ExprIsInteger(pE, &i)==0 );
1203   pEList = pSelect->pEList;
1204 
1205   /* Resolve all names in the ORDER BY term expression
1206   */
1207   memset(&nc, 0, sizeof(nc));
1208   nc.pParse = pParse;
1209   nc.pSrcList = pSelect->pSrc;
1210   nc.uNC.pEList = pEList;
1211   nc.ncFlags = NC_AllowAgg|NC_UEList;
1212   nc.nErr = 0;
1213   db = pParse->db;
1214   savedSuppErr = db->suppressErr;
1215   if( IN_RENAME_OBJECT==0 ) db->suppressErr = 1;
1216   rc = sqlite3ResolveExprNames(&nc, pE);
1217   db->suppressErr = savedSuppErr;
1218   if( rc ) return 0;
1219 
1220   /* Try to match the ORDER BY expression against an expression
1221   ** in the result set.  Return an 1-based index of the matching
1222   ** result-set entry.
1223   */
1224   for(i=0; i<pEList->nExpr; i++){
1225     if( sqlite3ExprCompare(0, pEList->a[i].pExpr, pE, -1)<2 ){
1226       return i+1;
1227     }
1228   }
1229 
1230   /* If no match, return 0. */
1231   return 0;
1232 }
1233 
1234 /*
1235 ** Generate an ORDER BY or GROUP BY term out-of-range error.
1236 */
1237 static void resolveOutOfRangeError(
1238   Parse *pParse,         /* The error context into which to write the error */
1239   const char *zType,     /* "ORDER" or "GROUP" */
1240   int i,                 /* The index (1-based) of the term out of range */
1241   int mx                 /* Largest permissible value of i */
1242 ){
1243   sqlite3ErrorMsg(pParse,
1244     "%r %s BY term out of range - should be "
1245     "between 1 and %d", i, zType, mx);
1246 }
1247 
1248 /*
1249 ** Analyze the ORDER BY clause in a compound SELECT statement.   Modify
1250 ** each term of the ORDER BY clause is a constant integer between 1
1251 ** and N where N is the number of columns in the compound SELECT.
1252 **
1253 ** ORDER BY terms that are already an integer between 1 and N are
1254 ** unmodified.  ORDER BY terms that are integers outside the range of
1255 ** 1 through N generate an error.  ORDER BY terms that are expressions
1256 ** are matched against result set expressions of compound SELECT
1257 ** beginning with the left-most SELECT and working toward the right.
1258 ** At the first match, the ORDER BY expression is transformed into
1259 ** the integer column number.
1260 **
1261 ** Return the number of errors seen.
1262 */
1263 static int resolveCompoundOrderBy(
1264   Parse *pParse,        /* Parsing context.  Leave error messages here */
1265   Select *pSelect       /* The SELECT statement containing the ORDER BY */
1266 ){
1267   int i;
1268   ExprList *pOrderBy;
1269   ExprList *pEList;
1270   sqlite3 *db;
1271   int moreToDo = 1;
1272 
1273   pOrderBy = pSelect->pOrderBy;
1274   if( pOrderBy==0 ) return 0;
1275   db = pParse->db;
1276   if( pOrderBy->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
1277     sqlite3ErrorMsg(pParse, "too many terms in ORDER BY clause");
1278     return 1;
1279   }
1280   for(i=0; i<pOrderBy->nExpr; i++){
1281     pOrderBy->a[i].done = 0;
1282   }
1283   pSelect->pNext = 0;
1284   while( pSelect->pPrior ){
1285     pSelect->pPrior->pNext = pSelect;
1286     pSelect = pSelect->pPrior;
1287   }
1288   while( pSelect && moreToDo ){
1289     struct ExprList_item *pItem;
1290     moreToDo = 0;
1291     pEList = pSelect->pEList;
1292     assert( pEList!=0 );
1293     for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
1294       int iCol = -1;
1295       Expr *pE, *pDup;
1296       if( pItem->done ) continue;
1297       pE = sqlite3ExprSkipCollateAndLikely(pItem->pExpr);
1298       if( NEVER(pE==0) ) continue;
1299       if( sqlite3ExprIsInteger(pE, &iCol) ){
1300         if( iCol<=0 || iCol>pEList->nExpr ){
1301           resolveOutOfRangeError(pParse, "ORDER", i+1, pEList->nExpr);
1302           return 1;
1303         }
1304       }else{
1305         iCol = resolveAsName(pParse, pEList, pE);
1306         if( iCol==0 ){
1307           /* Now test if expression pE matches one of the values returned
1308           ** by pSelect. In the usual case this is done by duplicating the
1309           ** expression, resolving any symbols in it, and then comparing
1310           ** it against each expression returned by the SELECT statement.
1311           ** Once the comparisons are finished, the duplicate expression
1312           ** is deleted.
1313           **
1314           ** Or, if this is running as part of an ALTER TABLE operation,
1315           ** resolve the symbols in the actual expression, not a duplicate.
1316           ** And, if one of the comparisons is successful, leave the expression
1317           ** as is instead of transforming it to an integer as in the usual
1318           ** case. This allows the code in alter.c to modify column
1319           ** refererences within the ORDER BY expression as required.  */
1320           if( IN_RENAME_OBJECT ){
1321             pDup = pE;
1322           }else{
1323             pDup = sqlite3ExprDup(db, pE, 0);
1324           }
1325           if( !db->mallocFailed ){
1326             assert(pDup);
1327             iCol = resolveOrderByTermToExprList(pParse, pSelect, pDup);
1328           }
1329           if( !IN_RENAME_OBJECT ){
1330             sqlite3ExprDelete(db, pDup);
1331           }
1332         }
1333       }
1334       if( iCol>0 ){
1335         /* Convert the ORDER BY term into an integer column number iCol,
1336         ** taking care to preserve the COLLATE clause if it exists */
1337         if( !IN_RENAME_OBJECT ){
1338           Expr *pNew = sqlite3Expr(db, TK_INTEGER, 0);
1339           if( pNew==0 ) return 1;
1340           pNew->flags |= EP_IntValue;
1341           pNew->u.iValue = iCol;
1342           if( pItem->pExpr==pE ){
1343             pItem->pExpr = pNew;
1344           }else{
1345             Expr *pParent = pItem->pExpr;
1346             assert( pParent->op==TK_COLLATE );
1347             while( pParent->pLeft->op==TK_COLLATE ) pParent = pParent->pLeft;
1348             assert( pParent->pLeft==pE );
1349             pParent->pLeft = pNew;
1350           }
1351           sqlite3ExprDelete(db, pE);
1352           pItem->u.x.iOrderByCol = (u16)iCol;
1353         }
1354         pItem->done = 1;
1355       }else{
1356         moreToDo = 1;
1357       }
1358     }
1359     pSelect = pSelect->pNext;
1360   }
1361   for(i=0; i<pOrderBy->nExpr; i++){
1362     if( pOrderBy->a[i].done==0 ){
1363       sqlite3ErrorMsg(pParse, "%r ORDER BY term does not match any "
1364             "column in the result set", i+1);
1365       return 1;
1366     }
1367   }
1368   return 0;
1369 }
1370 
1371 /*
1372 ** Check every term in the ORDER BY or GROUP BY clause pOrderBy of
1373 ** the SELECT statement pSelect.  If any term is reference to a
1374 ** result set expression (as determined by the ExprList.a.u.x.iOrderByCol
1375 ** field) then convert that term into a copy of the corresponding result set
1376 ** column.
1377 **
1378 ** If any errors are detected, add an error message to pParse and
1379 ** return non-zero.  Return zero if no errors are seen.
1380 */
1381 int sqlite3ResolveOrderGroupBy(
1382   Parse *pParse,        /* Parsing context.  Leave error messages here */
1383   Select *pSelect,      /* The SELECT statement containing the clause */
1384   ExprList *pOrderBy,   /* The ORDER BY or GROUP BY clause to be processed */
1385   const char *zType     /* "ORDER" or "GROUP" */
1386 ){
1387   int i;
1388   sqlite3 *db = pParse->db;
1389   ExprList *pEList;
1390   struct ExprList_item *pItem;
1391 
1392   if( pOrderBy==0 || pParse->db->mallocFailed || IN_RENAME_OBJECT ) return 0;
1393   if( pOrderBy->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
1394     sqlite3ErrorMsg(pParse, "too many terms in %s BY clause", zType);
1395     return 1;
1396   }
1397   pEList = pSelect->pEList;
1398   assert( pEList!=0 );  /* sqlite3SelectNew() guarantees this */
1399   for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
1400     if( pItem->u.x.iOrderByCol ){
1401       if( pItem->u.x.iOrderByCol>pEList->nExpr ){
1402         resolveOutOfRangeError(pParse, zType, i+1, pEList->nExpr);
1403         return 1;
1404       }
1405       resolveAlias(pParse, pEList, pItem->u.x.iOrderByCol-1, pItem->pExpr,0);
1406     }
1407   }
1408   return 0;
1409 }
1410 
1411 #ifndef SQLITE_OMIT_WINDOWFUNC
1412 /*
1413 ** Walker callback for windowRemoveExprFromSelect().
1414 */
1415 static int resolveRemoveWindowsCb(Walker *pWalker, Expr *pExpr){
1416   UNUSED_PARAMETER(pWalker);
1417   if( ExprHasProperty(pExpr, EP_WinFunc) ){
1418     Window *pWin = pExpr->y.pWin;
1419     sqlite3WindowUnlinkFromSelect(pWin);
1420   }
1421   return WRC_Continue;
1422 }
1423 
1424 /*
1425 ** Remove any Window objects owned by the expression pExpr from the
1426 ** Select.pWin list of Select object pSelect.
1427 */
1428 static void windowRemoveExprFromSelect(Select *pSelect, Expr *pExpr){
1429   if( pSelect->pWin ){
1430     Walker sWalker;
1431     memset(&sWalker, 0, sizeof(Walker));
1432     sWalker.xExprCallback = resolveRemoveWindowsCb;
1433     sWalker.u.pSelect = pSelect;
1434     sqlite3WalkExpr(&sWalker, pExpr);
1435   }
1436 }
1437 #else
1438 # define windowRemoveExprFromSelect(a, b)
1439 #endif /* SQLITE_OMIT_WINDOWFUNC */
1440 
1441 /*
1442 ** pOrderBy is an ORDER BY or GROUP BY clause in SELECT statement pSelect.
1443 ** The Name context of the SELECT statement is pNC.  zType is either
1444 ** "ORDER" or "GROUP" depending on which type of clause pOrderBy is.
1445 **
1446 ** This routine resolves each term of the clause into an expression.
1447 ** If the order-by term is an integer I between 1 and N (where N is the
1448 ** number of columns in the result set of the SELECT) then the expression
1449 ** in the resolution is a copy of the I-th result-set expression.  If
1450 ** the order-by term is an identifier that corresponds to the AS-name of
1451 ** a result-set expression, then the term resolves to a copy of the
1452 ** result-set expression.  Otherwise, the expression is resolved in
1453 ** the usual way - using sqlite3ResolveExprNames().
1454 **
1455 ** This routine returns the number of errors.  If errors occur, then
1456 ** an appropriate error message might be left in pParse.  (OOM errors
1457 ** excepted.)
1458 */
1459 static int resolveOrderGroupBy(
1460   NameContext *pNC,     /* The name context of the SELECT statement */
1461   Select *pSelect,      /* The SELECT statement holding pOrderBy */
1462   ExprList *pOrderBy,   /* An ORDER BY or GROUP BY clause to resolve */
1463   const char *zType     /* Either "ORDER" or "GROUP", as appropriate */
1464 ){
1465   int i, j;                      /* Loop counters */
1466   int iCol;                      /* Column number */
1467   struct ExprList_item *pItem;   /* A term of the ORDER BY clause */
1468   Parse *pParse;                 /* Parsing context */
1469   int nResult;                   /* Number of terms in the result set */
1470 
1471   if( pOrderBy==0 ) return 0;
1472   nResult = pSelect->pEList->nExpr;
1473   pParse = pNC->pParse;
1474   for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
1475     Expr *pE = pItem->pExpr;
1476     Expr *pE2 = sqlite3ExprSkipCollateAndLikely(pE);
1477     if( NEVER(pE2==0) ) continue;
1478     if( zType[0]!='G' ){
1479       iCol = resolveAsName(pParse, pSelect->pEList, pE2);
1480       if( iCol>0 ){
1481         /* If an AS-name match is found, mark this ORDER BY column as being
1482         ** a copy of the iCol-th result-set column.  The subsequent call to
1483         ** sqlite3ResolveOrderGroupBy() will convert the expression to a
1484         ** copy of the iCol-th result-set expression. */
1485         pItem->u.x.iOrderByCol = (u16)iCol;
1486         continue;
1487       }
1488     }
1489     if( sqlite3ExprIsInteger(pE2, &iCol) ){
1490       /* The ORDER BY term is an integer constant.  Again, set the column
1491       ** number so that sqlite3ResolveOrderGroupBy() will convert the
1492       ** order-by term to a copy of the result-set expression */
1493       if( iCol<1 || iCol>0xffff ){
1494         resolveOutOfRangeError(pParse, zType, i+1, nResult);
1495         return 1;
1496       }
1497       pItem->u.x.iOrderByCol = (u16)iCol;
1498       continue;
1499     }
1500 
1501     /* Otherwise, treat the ORDER BY term as an ordinary expression */
1502     pItem->u.x.iOrderByCol = 0;
1503     if( sqlite3ResolveExprNames(pNC, pE) ){
1504       return 1;
1505     }
1506     for(j=0; j<pSelect->pEList->nExpr; j++){
1507       if( sqlite3ExprCompare(0, pE, pSelect->pEList->a[j].pExpr, -1)==0 ){
1508         /* Since this expresion is being changed into a reference
1509         ** to an identical expression in the result set, remove all Window
1510         ** objects belonging to the expression from the Select.pWin list. */
1511         windowRemoveExprFromSelect(pSelect, pE);
1512         pItem->u.x.iOrderByCol = j+1;
1513       }
1514     }
1515   }
1516   return sqlite3ResolveOrderGroupBy(pParse, pSelect, pOrderBy, zType);
1517 }
1518 
1519 /*
1520 ** Resolve names in the SELECT statement p and all of its descendants.
1521 */
1522 static int resolveSelectStep(Walker *pWalker, Select *p){
1523   NameContext *pOuterNC;  /* Context that contains this SELECT */
1524   NameContext sNC;        /* Name context of this SELECT */
1525   int isCompound;         /* True if p is a compound select */
1526   int nCompound;          /* Number of compound terms processed so far */
1527   Parse *pParse;          /* Parsing context */
1528   int i;                  /* Loop counter */
1529   ExprList *pGroupBy;     /* The GROUP BY clause */
1530   Select *pLeftmost;      /* Left-most of SELECT of a compound */
1531   sqlite3 *db;            /* Database connection */
1532 
1533 
1534   assert( p!=0 );
1535   if( p->selFlags & SF_Resolved ){
1536     return WRC_Prune;
1537   }
1538   pOuterNC = pWalker->u.pNC;
1539   pParse = pWalker->pParse;
1540   db = pParse->db;
1541 
1542   /* Normally sqlite3SelectExpand() will be called first and will have
1543   ** already expanded this SELECT.  However, if this is a subquery within
1544   ** an expression, sqlite3ResolveExprNames() will be called without a
1545   ** prior call to sqlite3SelectExpand().  When that happens, let
1546   ** sqlite3SelectPrep() do all of the processing for this SELECT.
1547   ** sqlite3SelectPrep() will invoke both sqlite3SelectExpand() and
1548   ** this routine in the correct order.
1549   */
1550   if( (p->selFlags & SF_Expanded)==0 ){
1551     sqlite3SelectPrep(pParse, p, pOuterNC);
1552     return (pParse->nErr || db->mallocFailed) ? WRC_Abort : WRC_Prune;
1553   }
1554 
1555   isCompound = p->pPrior!=0;
1556   nCompound = 0;
1557   pLeftmost = p;
1558   while( p ){
1559     assert( (p->selFlags & SF_Expanded)!=0 );
1560     assert( (p->selFlags & SF_Resolved)==0 );
1561     p->selFlags |= SF_Resolved;
1562 
1563     /* Resolve the expressions in the LIMIT and OFFSET clauses. These
1564     ** are not allowed to refer to any names, so pass an empty NameContext.
1565     */
1566     memset(&sNC, 0, sizeof(sNC));
1567     sNC.pParse = pParse;
1568     sNC.pWinSelect = p;
1569     if( sqlite3ResolveExprNames(&sNC, p->pLimit) ){
1570       return WRC_Abort;
1571     }
1572 
1573     /* If the SF_Converted flags is set, then this Select object was
1574     ** was created by the convertCompoundSelectToSubquery() function.
1575     ** In this case the ORDER BY clause (p->pOrderBy) should be resolved
1576     ** as if it were part of the sub-query, not the parent. This block
1577     ** moves the pOrderBy down to the sub-query. It will be moved back
1578     ** after the names have been resolved.  */
1579     if( p->selFlags & SF_Converted ){
1580       Select *pSub = p->pSrc->a[0].pSelect;
1581       assert( p->pSrc->nSrc==1 && p->pOrderBy );
1582       assert( pSub->pPrior && pSub->pOrderBy==0 );
1583       pSub->pOrderBy = p->pOrderBy;
1584       p->pOrderBy = 0;
1585     }
1586 
1587     /* Recursively resolve names in all subqueries
1588     */
1589     for(i=0; i<p->pSrc->nSrc; i++){
1590       struct SrcList_item *pItem = &p->pSrc->a[i];
1591       if( pItem->pSelect && (pItem->pSelect->selFlags & SF_Resolved)==0 ){
1592         NameContext *pNC;         /* Used to iterate name contexts */
1593         int nRef = 0;             /* Refcount for pOuterNC and outer contexts */
1594         const char *zSavedContext = pParse->zAuthContext;
1595 
1596         /* Count the total number of references to pOuterNC and all of its
1597         ** parent contexts. After resolving references to expressions in
1598         ** pItem->pSelect, check if this value has changed. If so, then
1599         ** SELECT statement pItem->pSelect must be correlated. Set the
1600         ** pItem->fg.isCorrelated flag if this is the case. */
1601         for(pNC=pOuterNC; pNC; pNC=pNC->pNext) nRef += pNC->nRef;
1602 
1603         if( pItem->zName ) pParse->zAuthContext = pItem->zName;
1604         sqlite3ResolveSelectNames(pParse, pItem->pSelect, pOuterNC);
1605         pParse->zAuthContext = zSavedContext;
1606         if( pParse->nErr || db->mallocFailed ) return WRC_Abort;
1607 
1608         for(pNC=pOuterNC; pNC; pNC=pNC->pNext) nRef -= pNC->nRef;
1609         assert( pItem->fg.isCorrelated==0 && nRef<=0 );
1610         pItem->fg.isCorrelated = (nRef!=0);
1611       }
1612     }
1613 
1614     /* Set up the local name-context to pass to sqlite3ResolveExprNames() to
1615     ** resolve the result-set expression list.
1616     */
1617     sNC.ncFlags = NC_AllowAgg|NC_AllowWin;
1618     sNC.pSrcList = p->pSrc;
1619     sNC.pNext = pOuterNC;
1620 
1621     /* Resolve names in the result set. */
1622     if( sqlite3ResolveExprListNames(&sNC, p->pEList) ) return WRC_Abort;
1623     sNC.ncFlags &= ~NC_AllowWin;
1624 
1625     /* If there are no aggregate functions in the result-set, and no GROUP BY
1626     ** expression, do not allow aggregates in any of the other expressions.
1627     */
1628     assert( (p->selFlags & SF_Aggregate)==0 );
1629     pGroupBy = p->pGroupBy;
1630     if( pGroupBy || (sNC.ncFlags & NC_HasAgg)!=0 ){
1631       assert( NC_MinMaxAgg==SF_MinMaxAgg );
1632       p->selFlags |= SF_Aggregate | (sNC.ncFlags&NC_MinMaxAgg);
1633     }else{
1634       sNC.ncFlags &= ~NC_AllowAgg;
1635     }
1636 
1637     /* If a HAVING clause is present, then there must be a GROUP BY clause.
1638     */
1639     if( p->pHaving && !pGroupBy ){
1640       sqlite3ErrorMsg(pParse, "a GROUP BY clause is required before HAVING");
1641       return WRC_Abort;
1642     }
1643 
1644     /* Add the output column list to the name-context before parsing the
1645     ** other expressions in the SELECT statement. This is so that
1646     ** expressions in the WHERE clause (etc.) can refer to expressions by
1647     ** aliases in the result set.
1648     **
1649     ** Minor point: If this is the case, then the expression will be
1650     ** re-evaluated for each reference to it.
1651     */
1652     assert( (sNC.ncFlags & (NC_UAggInfo|NC_UUpsert|NC_UBaseReg))==0 );
1653     sNC.uNC.pEList = p->pEList;
1654     sNC.ncFlags |= NC_UEList;
1655     if( sqlite3ResolveExprNames(&sNC, p->pHaving) ) return WRC_Abort;
1656     if( sqlite3ResolveExprNames(&sNC, p->pWhere) ) return WRC_Abort;
1657 
1658     /* Resolve names in table-valued-function arguments */
1659     for(i=0; i<p->pSrc->nSrc; i++){
1660       struct SrcList_item *pItem = &p->pSrc->a[i];
1661       if( pItem->fg.isTabFunc
1662        && sqlite3ResolveExprListNames(&sNC, pItem->u1.pFuncArg)
1663       ){
1664         return WRC_Abort;
1665       }
1666     }
1667 
1668     /* The ORDER BY and GROUP BY clauses may not refer to terms in
1669     ** outer queries
1670     */
1671     sNC.pNext = 0;
1672     sNC.ncFlags |= NC_AllowAgg|NC_AllowWin;
1673 
1674     /* If this is a converted compound query, move the ORDER BY clause from
1675     ** the sub-query back to the parent query. At this point each term
1676     ** within the ORDER BY clause has been transformed to an integer value.
1677     ** These integers will be replaced by copies of the corresponding result
1678     ** set expressions by the call to resolveOrderGroupBy() below.  */
1679     if( p->selFlags & SF_Converted ){
1680       Select *pSub = p->pSrc->a[0].pSelect;
1681       p->pOrderBy = pSub->pOrderBy;
1682       pSub->pOrderBy = 0;
1683     }
1684 
1685     /* Process the ORDER BY clause for singleton SELECT statements.
1686     ** The ORDER BY clause for compounds SELECT statements is handled
1687     ** below, after all of the result-sets for all of the elements of
1688     ** the compound have been resolved.
1689     **
1690     ** If there is an ORDER BY clause on a term of a compound-select other
1691     ** than the right-most term, then that is a syntax error.  But the error
1692     ** is not detected until much later, and so we need to go ahead and
1693     ** resolve those symbols on the incorrect ORDER BY for consistency.
1694     */
1695     if( isCompound<=nCompound  /* Defer right-most ORDER BY of a compound */
1696      && resolveOrderGroupBy(&sNC, p, p->pOrderBy, "ORDER")
1697     ){
1698       return WRC_Abort;
1699     }
1700     if( db->mallocFailed ){
1701       return WRC_Abort;
1702     }
1703     sNC.ncFlags &= ~NC_AllowWin;
1704 
1705     /* Resolve the GROUP BY clause.  At the same time, make sure
1706     ** the GROUP BY clause does not contain aggregate functions.
1707     */
1708     if( pGroupBy ){
1709       struct ExprList_item *pItem;
1710 
1711       if( resolveOrderGroupBy(&sNC, p, pGroupBy, "GROUP") || db->mallocFailed ){
1712         return WRC_Abort;
1713       }
1714       for(i=0, pItem=pGroupBy->a; i<pGroupBy->nExpr; i++, pItem++){
1715         if( ExprHasProperty(pItem->pExpr, EP_Agg) ){
1716           sqlite3ErrorMsg(pParse, "aggregate functions are not allowed in "
1717               "the GROUP BY clause");
1718           return WRC_Abort;
1719         }
1720       }
1721     }
1722 
1723 #ifndef SQLITE_OMIT_WINDOWFUNC
1724     if( IN_RENAME_OBJECT ){
1725       Window *pWin;
1726       for(pWin=p->pWinDefn; pWin; pWin=pWin->pNextWin){
1727         if( sqlite3ResolveExprListNames(&sNC, pWin->pOrderBy)
1728          || sqlite3ResolveExprListNames(&sNC, pWin->pPartition)
1729         ){
1730           return WRC_Abort;
1731         }
1732       }
1733     }
1734 #endif
1735 
1736     /* If this is part of a compound SELECT, check that it has the right
1737     ** number of expressions in the select list. */
1738     if( p->pNext && p->pEList->nExpr!=p->pNext->pEList->nExpr ){
1739       sqlite3SelectWrongNumTermsError(pParse, p->pNext);
1740       return WRC_Abort;
1741     }
1742 
1743     /* Advance to the next term of the compound
1744     */
1745     p = p->pPrior;
1746     nCompound++;
1747   }
1748 
1749   /* Resolve the ORDER BY on a compound SELECT after all terms of
1750   ** the compound have been resolved.
1751   */
1752   if( isCompound && resolveCompoundOrderBy(pParse, pLeftmost) ){
1753     return WRC_Abort;
1754   }
1755 
1756   return WRC_Prune;
1757 }
1758 
1759 /*
1760 ** This routine walks an expression tree and resolves references to
1761 ** table columns and result-set columns.  At the same time, do error
1762 ** checking on function usage and set a flag if any aggregate functions
1763 ** are seen.
1764 **
1765 ** To resolve table columns references we look for nodes (or subtrees) of the
1766 ** form X.Y.Z or Y.Z or just Z where
1767 **
1768 **      X:   The name of a database.  Ex:  "main" or "temp" or
1769 **           the symbolic name assigned to an ATTACH-ed database.
1770 **
1771 **      Y:   The name of a table in a FROM clause.  Or in a trigger
1772 **           one of the special names "old" or "new".
1773 **
1774 **      Z:   The name of a column in table Y.
1775 **
1776 ** The node at the root of the subtree is modified as follows:
1777 **
1778 **    Expr.op        Changed to TK_COLUMN
1779 **    Expr.pTab      Points to the Table object for X.Y
1780 **    Expr.iColumn   The column index in X.Y.  -1 for the rowid.
1781 **    Expr.iTable    The VDBE cursor number for X.Y
1782 **
1783 **
1784 ** To resolve result-set references, look for expression nodes of the
1785 ** form Z (with no X and Y prefix) where the Z matches the right-hand
1786 ** size of an AS clause in the result-set of a SELECT.  The Z expression
1787 ** is replaced by a copy of the left-hand side of the result-set expression.
1788 ** Table-name and function resolution occurs on the substituted expression
1789 ** tree.  For example, in:
1790 **
1791 **      SELECT a+b AS x, c+d AS y FROM t1 ORDER BY x;
1792 **
1793 ** The "x" term of the order by is replaced by "a+b" to render:
1794 **
1795 **      SELECT a+b AS x, c+d AS y FROM t1 ORDER BY a+b;
1796 **
1797 ** Function calls are checked to make sure that the function is
1798 ** defined and that the correct number of arguments are specified.
1799 ** If the function is an aggregate function, then the NC_HasAgg flag is
1800 ** set and the opcode is changed from TK_FUNCTION to TK_AGG_FUNCTION.
1801 ** If an expression contains aggregate functions then the EP_Agg
1802 ** property on the expression is set.
1803 **
1804 ** An error message is left in pParse if anything is amiss.  The number
1805 ** if errors is returned.
1806 */
1807 int sqlite3ResolveExprNames(
1808   NameContext *pNC,       /* Namespace to resolve expressions in. */
1809   Expr *pExpr             /* The expression to be analyzed. */
1810 ){
1811   int savedHasAgg;
1812   Walker w;
1813 
1814   if( pExpr==0 ) return SQLITE_OK;
1815   savedHasAgg = pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
1816   pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
1817   w.pParse = pNC->pParse;
1818   w.xExprCallback = resolveExprStep;
1819   w.xSelectCallback = resolveSelectStep;
1820   w.xSelectCallback2 = 0;
1821   w.u.pNC = pNC;
1822 #if SQLITE_MAX_EXPR_DEPTH>0
1823   w.pParse->nHeight += pExpr->nHeight;
1824   if( sqlite3ExprCheckHeight(w.pParse, w.pParse->nHeight) ){
1825     return SQLITE_ERROR;
1826   }
1827 #endif
1828   sqlite3WalkExpr(&w, pExpr);
1829 #if SQLITE_MAX_EXPR_DEPTH>0
1830   w.pParse->nHeight -= pExpr->nHeight;
1831 #endif
1832   assert( EP_Agg==NC_HasAgg );
1833   assert( EP_Win==NC_HasWin );
1834   testcase( pNC->ncFlags & NC_HasAgg );
1835   testcase( pNC->ncFlags & NC_HasWin );
1836   ExprSetProperty(pExpr, pNC->ncFlags & (NC_HasAgg|NC_HasWin) );
1837   pNC->ncFlags |= savedHasAgg;
1838   return pNC->nErr>0 || w.pParse->nErr>0;
1839 }
1840 
1841 /*
1842 ** Resolve all names for all expression in an expression list.  This is
1843 ** just like sqlite3ResolveExprNames() except that it works for an expression
1844 ** list rather than a single expression.
1845 */
1846 int sqlite3ResolveExprListNames(
1847   NameContext *pNC,       /* Namespace to resolve expressions in. */
1848   ExprList *pList         /* The expression list to be analyzed. */
1849 ){
1850   int i;
1851   int savedHasAgg = 0;
1852   Walker w;
1853   if( pList==0 ) return WRC_Continue;
1854   w.pParse = pNC->pParse;
1855   w.xExprCallback = resolveExprStep;
1856   w.xSelectCallback = resolveSelectStep;
1857   w.xSelectCallback2 = 0;
1858   w.u.pNC = pNC;
1859   savedHasAgg = pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
1860   pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
1861   for(i=0; i<pList->nExpr; i++){
1862     Expr *pExpr = pList->a[i].pExpr;
1863     if( pExpr==0 ) continue;
1864 #if SQLITE_MAX_EXPR_DEPTH>0
1865     w.pParse->nHeight += pExpr->nHeight;
1866     if( sqlite3ExprCheckHeight(w.pParse, w.pParse->nHeight) ){
1867       return WRC_Abort;
1868     }
1869 #endif
1870     sqlite3WalkExpr(&w, pExpr);
1871 #if SQLITE_MAX_EXPR_DEPTH>0
1872     w.pParse->nHeight -= pExpr->nHeight;
1873 #endif
1874     assert( EP_Agg==NC_HasAgg );
1875     assert( EP_Win==NC_HasWin );
1876     testcase( pNC->ncFlags & NC_HasAgg );
1877     testcase( pNC->ncFlags & NC_HasWin );
1878     if( pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin) ){
1879       ExprSetProperty(pExpr, pNC->ncFlags & (NC_HasAgg|NC_HasWin) );
1880       savedHasAgg |= pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
1881       pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
1882     }
1883     if( pNC->nErr>0 || w.pParse->nErr>0 ) return WRC_Abort;
1884   }
1885   pNC->ncFlags |= savedHasAgg;
1886   return WRC_Continue;
1887 }
1888 
1889 /*
1890 ** Resolve all names in all expressions of a SELECT and in all
1891 ** decendents of the SELECT, including compounds off of p->pPrior,
1892 ** subqueries in expressions, and subqueries used as FROM clause
1893 ** terms.
1894 **
1895 ** See sqlite3ResolveExprNames() for a description of the kinds of
1896 ** transformations that occur.
1897 **
1898 ** All SELECT statements should have been expanded using
1899 ** sqlite3SelectExpand() prior to invoking this routine.
1900 */
1901 void sqlite3ResolveSelectNames(
1902   Parse *pParse,         /* The parser context */
1903   Select *p,             /* The SELECT statement being coded. */
1904   NameContext *pOuterNC  /* Name context for parent SELECT statement */
1905 ){
1906   Walker w;
1907 
1908   assert( p!=0 );
1909   w.xExprCallback = resolveExprStep;
1910   w.xSelectCallback = resolveSelectStep;
1911   w.xSelectCallback2 = 0;
1912   w.pParse = pParse;
1913   w.u.pNC = pOuterNC;
1914   sqlite3WalkSelect(&w, p);
1915 }
1916 
1917 /*
1918 ** Resolve names in expressions that can only reference a single table
1919 ** or which cannot reference any tables at all.  Examples:
1920 **
1921 **                                                    "type" flag
1922 **                                                    ------------
1923 **    (1)   CHECK constraints                         NC_IsCheck
1924 **    (2)   WHERE clauses on partial indices          NC_PartIdx
1925 **    (3)   Expressions in indexes on expressions     NC_IdxExpr
1926 **    (4)   Expression arguments to VACUUM INTO.      0
1927 **    (5)   GENERATED ALWAYS as expressions           NC_GenCol
1928 **
1929 ** In all cases except (4), the Expr.iTable value for Expr.op==TK_COLUMN
1930 ** nodes of the expression is set to -1 and the Expr.iColumn value is
1931 ** set to the column number.  In case (4), TK_COLUMN nodes cause an error.
1932 **
1933 ** Any errors cause an error message to be set in pParse.
1934 */
1935 int sqlite3ResolveSelfReference(
1936   Parse *pParse,   /* Parsing context */
1937   Table *pTab,     /* The table being referenced, or NULL */
1938   int type,        /* NC_IsCheck, NC_PartIdx, NC_IdxExpr, NC_GenCol, or 0 */
1939   Expr *pExpr,     /* Expression to resolve.  May be NULL. */
1940   ExprList *pList  /* Expression list to resolve.  May be NULL. */
1941 ){
1942   SrcList sSrc;                   /* Fake SrcList for pParse->pNewTable */
1943   NameContext sNC;                /* Name context for pParse->pNewTable */
1944   int rc;
1945 
1946   assert( type==0 || pTab!=0 );
1947   assert( type==NC_IsCheck || type==NC_PartIdx || type==NC_IdxExpr
1948           || type==NC_GenCol || pTab==0 );
1949   memset(&sNC, 0, sizeof(sNC));
1950   memset(&sSrc, 0, sizeof(sSrc));
1951   if( pTab ){
1952     sSrc.nSrc = 1;
1953     sSrc.a[0].zName = pTab->zName;
1954     sSrc.a[0].pTab = pTab;
1955     sSrc.a[0].iCursor = -1;
1956     if( pTab->pSchema!=pParse->db->aDb[1].pSchema ){
1957       /* Cause EP_FromDDL to be set on TK_FUNCTION nodes of non-TEMP
1958       ** schema elements */
1959       type |= NC_FromDDL;
1960     }
1961   }
1962   sNC.pParse = pParse;
1963   sNC.pSrcList = &sSrc;
1964   sNC.ncFlags = type | NC_IsDDL;
1965   if( (rc = sqlite3ResolveExprNames(&sNC, pExpr))!=SQLITE_OK ) return rc;
1966   if( pList ) rc = sqlite3ResolveExprListNames(&sNC, pList);
1967   return rc;
1968 }
1969