xref: /sqlite-3.40.0/src/select.c (revision 8210233c)
1 /*
2 ** 2001 September 15
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 ** This file contains C code routines that are called by the parser
13 ** to handle SELECT statements in SQLite.
14 */
15 #include "sqliteInt.h"
16 
17 /*
18 ** An instance of the following object is used to record information about
19 ** how to process the DISTINCT keyword, to simplify passing that information
20 ** into the selectInnerLoop() routine.
21 */
22 typedef struct DistinctCtx DistinctCtx;
23 struct DistinctCtx {
24   u8 isTnct;      /* True if the DISTINCT keyword is present */
25   u8 eTnctType;   /* One of the WHERE_DISTINCT_* operators */
26   int tabTnct;    /* Ephemeral table used for DISTINCT processing */
27   int addrTnct;   /* Address of OP_OpenEphemeral opcode for tabTnct */
28 };
29 
30 /*
31 ** An instance of the following object is used to record information about
32 ** the ORDER BY (or GROUP BY) clause of query is being coded.
33 **
34 ** The aDefer[] array is used by the sorter-references optimization. For
35 ** example, assuming there is no index that can be used for the ORDER BY,
36 ** for the query:
37 **
38 **     SELECT a, bigblob FROM t1 ORDER BY a LIMIT 10;
39 **
40 ** it may be more efficient to add just the "a" values to the sorter, and
41 ** retrieve the associated "bigblob" values directly from table t1 as the
42 ** 10 smallest "a" values are extracted from the sorter.
43 **
44 ** When the sorter-reference optimization is used, there is one entry in the
45 ** aDefer[] array for each database table that may be read as values are
46 ** extracted from the sorter.
47 */
48 typedef struct SortCtx SortCtx;
49 struct SortCtx {
50   ExprList *pOrderBy;   /* The ORDER BY (or GROUP BY clause) */
51   int nOBSat;           /* Number of ORDER BY terms satisfied by indices */
52   int iECursor;         /* Cursor number for the sorter */
53   int regReturn;        /* Register holding block-output return address */
54   int labelBkOut;       /* Start label for the block-output subroutine */
55   int addrSortIndex;    /* Address of the OP_SorterOpen or OP_OpenEphemeral */
56   int labelDone;        /* Jump here when done, ex: LIMIT reached */
57   int labelOBLopt;      /* Jump here when sorter is full */
58   u8 sortFlags;         /* Zero or more SORTFLAG_* bits */
59 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
60   u8 nDefer;            /* Number of valid entries in aDefer[] */
61   struct DeferredCsr {
62     Table *pTab;        /* Table definition */
63     int iCsr;           /* Cursor number for table */
64     int nKey;           /* Number of PK columns for table pTab (>=1) */
65   } aDefer[4];
66 #endif
67   struct RowLoadInfo *pDeferredRowLoad;  /* Deferred row loading info or NULL */
68 };
69 #define SORTFLAG_UseSorter  0x01   /* Use SorterOpen instead of OpenEphemeral */
70 
71 /*
72 ** Delete all the content of a Select structure.  Deallocate the structure
73 ** itself depending on the value of bFree
74 **
75 ** If bFree==1, call sqlite3DbFree() on the p object.
76 ** If bFree==0, Leave the first Select object unfreed
77 */
78 static void clearSelect(sqlite3 *db, Select *p, int bFree){
79   while( p ){
80     Select *pPrior = p->pPrior;
81     sqlite3ExprListDelete(db, p->pEList);
82     sqlite3SrcListDelete(db, p->pSrc);
83     sqlite3ExprDelete(db, p->pWhere);
84     sqlite3ExprListDelete(db, p->pGroupBy);
85     sqlite3ExprDelete(db, p->pHaving);
86     sqlite3ExprListDelete(db, p->pOrderBy);
87     sqlite3ExprDelete(db, p->pLimit);
88     if( OK_IF_ALWAYS_TRUE(p->pWith) ) sqlite3WithDelete(db, p->pWith);
89 #ifndef SQLITE_OMIT_WINDOWFUNC
90     if( OK_IF_ALWAYS_TRUE(p->pWinDefn) ){
91       sqlite3WindowListDelete(db, p->pWinDefn);
92     }
93     while( p->pWin ){
94       assert( p->pWin->ppThis==&p->pWin );
95       sqlite3WindowUnlinkFromSelect(p->pWin);
96     }
97 #endif
98     if( bFree ) sqlite3DbFreeNN(db, p);
99     p = pPrior;
100     bFree = 1;
101   }
102 }
103 
104 /*
105 ** Initialize a SelectDest structure.
106 */
107 void sqlite3SelectDestInit(SelectDest *pDest, int eDest, int iParm){
108   pDest->eDest = (u8)eDest;
109   pDest->iSDParm = iParm;
110   pDest->iSDParm2 = 0;
111   pDest->zAffSdst = 0;
112   pDest->iSdst = 0;
113   pDest->nSdst = 0;
114 }
115 
116 
117 /*
118 ** Allocate a new Select structure and return a pointer to that
119 ** structure.
120 */
121 Select *sqlite3SelectNew(
122   Parse *pParse,        /* Parsing context */
123   ExprList *pEList,     /* which columns to include in the result */
124   SrcList *pSrc,        /* the FROM clause -- which tables to scan */
125   Expr *pWhere,         /* the WHERE clause */
126   ExprList *pGroupBy,   /* the GROUP BY clause */
127   Expr *pHaving,        /* the HAVING clause */
128   ExprList *pOrderBy,   /* the ORDER BY clause */
129   u32 selFlags,         /* Flag parameters, such as SF_Distinct */
130   Expr *pLimit          /* LIMIT value.  NULL means not used */
131 ){
132   Select *pNew, *pAllocated;
133   Select standin;
134   pAllocated = pNew = sqlite3DbMallocRawNN(pParse->db, sizeof(*pNew) );
135   if( pNew==0 ){
136     assert( pParse->db->mallocFailed );
137     pNew = &standin;
138   }
139   if( pEList==0 ){
140     pEList = sqlite3ExprListAppend(pParse, 0,
141                                    sqlite3Expr(pParse->db,TK_ASTERISK,0));
142   }
143   pNew->pEList = pEList;
144   pNew->op = TK_SELECT;
145   pNew->selFlags = selFlags;
146   pNew->iLimit = 0;
147   pNew->iOffset = 0;
148   pNew->selId = ++pParse->nSelect;
149   pNew->addrOpenEphm[0] = -1;
150   pNew->addrOpenEphm[1] = -1;
151   pNew->nSelectRow = 0;
152   if( pSrc==0 ) pSrc = sqlite3DbMallocZero(pParse->db, sizeof(*pSrc));
153   pNew->pSrc = pSrc;
154   pNew->pWhere = pWhere;
155   pNew->pGroupBy = pGroupBy;
156   pNew->pHaving = pHaving;
157   pNew->pOrderBy = pOrderBy;
158   pNew->pPrior = 0;
159   pNew->pNext = 0;
160   pNew->pLimit = pLimit;
161   pNew->pWith = 0;
162 #ifndef SQLITE_OMIT_WINDOWFUNC
163   pNew->pWin = 0;
164   pNew->pWinDefn = 0;
165 #endif
166   if( pParse->db->mallocFailed ) {
167     clearSelect(pParse->db, pNew, pNew!=&standin);
168     pAllocated = 0;
169   }else{
170     assert( pNew->pSrc!=0 || pParse->nErr>0 );
171   }
172   return pAllocated;
173 }
174 
175 
176 /*
177 ** Delete the given Select structure and all of its substructures.
178 */
179 void sqlite3SelectDelete(sqlite3 *db, Select *p){
180   if( OK_IF_ALWAYS_TRUE(p) ) clearSelect(db, p, 1);
181 }
182 
183 /*
184 ** Return a pointer to the right-most SELECT statement in a compound.
185 */
186 static Select *findRightmost(Select *p){
187   while( p->pNext ) p = p->pNext;
188   return p;
189 }
190 
191 /*
192 ** Given 1 to 3 identifiers preceding the JOIN keyword, determine the
193 ** type of join.  Return an integer constant that expresses that type
194 ** in terms of the following bit values:
195 **
196 **     JT_INNER
197 **     JT_CROSS
198 **     JT_OUTER
199 **     JT_NATURAL
200 **     JT_LEFT
201 **     JT_RIGHT
202 **
203 ** A full outer join is the combination of JT_LEFT and JT_RIGHT.
204 **
205 ** If an illegal or unsupported join type is seen, then still return
206 ** a join type, but put an error in the pParse structure.
207 */
208 int sqlite3JoinType(Parse *pParse, Token *pA, Token *pB, Token *pC){
209   int jointype = 0;
210   Token *apAll[3];
211   Token *p;
212                              /*   0123456789 123456789 123456789 123 */
213   static const char zKeyText[] = "naturaleftouterightfullinnercross";
214   static const struct {
215     u8 i;        /* Beginning of keyword text in zKeyText[] */
216     u8 nChar;    /* Length of the keyword in characters */
217     u8 code;     /* Join type mask */
218   } aKeyword[] = {
219     /* natural */ { 0,  7, JT_NATURAL                },
220     /* left    */ { 6,  4, JT_LEFT|JT_OUTER          },
221     /* outer   */ { 10, 5, JT_OUTER                  },
222     /* right   */ { 14, 5, JT_RIGHT|JT_OUTER         },
223     /* full    */ { 19, 4, JT_LEFT|JT_RIGHT|JT_OUTER },
224     /* inner   */ { 23, 5, JT_INNER                  },
225     /* cross   */ { 28, 5, JT_INNER|JT_CROSS         },
226   };
227   int i, j;
228   apAll[0] = pA;
229   apAll[1] = pB;
230   apAll[2] = pC;
231   for(i=0; i<3 && apAll[i]; i++){
232     p = apAll[i];
233     for(j=0; j<ArraySize(aKeyword); j++){
234       if( p->n==aKeyword[j].nChar
235           && sqlite3StrNICmp((char*)p->z, &zKeyText[aKeyword[j].i], p->n)==0 ){
236         jointype |= aKeyword[j].code;
237         break;
238       }
239     }
240     testcase( j==0 || j==1 || j==2 || j==3 || j==4 || j==5 || j==6 );
241     if( j>=ArraySize(aKeyword) ){
242       jointype |= JT_ERROR;
243       break;
244     }
245   }
246   if(
247      (jointype & (JT_INNER|JT_OUTER))==(JT_INNER|JT_OUTER) ||
248      (jointype & JT_ERROR)!=0
249   ){
250     const char *zSp = " ";
251     assert( pB!=0 );
252     if( pC==0 ){ zSp++; }
253     sqlite3ErrorMsg(pParse, "unknown or unsupported join type: "
254        "%T %T%s%T", pA, pB, zSp, pC);
255     jointype = JT_INNER;
256   }else if( (jointype & JT_OUTER)!=0
257          && (jointype & (JT_LEFT|JT_RIGHT))!=JT_LEFT ){
258     sqlite3ErrorMsg(pParse,
259       "RIGHT and FULL OUTER JOINs are not currently supported");
260     jointype = JT_INNER;
261   }
262   return jointype;
263 }
264 
265 /*
266 ** Return the index of a column in a table.  Return -1 if the column
267 ** is not contained in the table.
268 */
269 int sqlite3ColumnIndex(Table *pTab, const char *zCol){
270   int i;
271   u8 h = sqlite3StrIHash(zCol);
272   Column *pCol;
273   for(pCol=pTab->aCol, i=0; i<pTab->nCol; pCol++, i++){
274     if( pCol->hName==h && sqlite3StrICmp(pCol->zName, zCol)==0 ) return i;
275   }
276   return -1;
277 }
278 
279 /*
280 ** Search the first N tables in pSrc, from left to right, looking for a
281 ** table that has a column named zCol.
282 **
283 ** When found, set *piTab and *piCol to the table index and column index
284 ** of the matching column and return TRUE.
285 **
286 ** If not found, return FALSE.
287 */
288 static int tableAndColumnIndex(
289   SrcList *pSrc,       /* Array of tables to search */
290   int N,               /* Number of tables in pSrc->a[] to search */
291   const char *zCol,    /* Name of the column we are looking for */
292   int *piTab,          /* Write index of pSrc->a[] here */
293   int *piCol,          /* Write index of pSrc->a[*piTab].pTab->aCol[] here */
294   int bIgnoreHidden    /* True to ignore hidden columns */
295 ){
296   int i;               /* For looping over tables in pSrc */
297   int iCol;            /* Index of column matching zCol */
298 
299   assert( (piTab==0)==(piCol==0) );  /* Both or neither are NULL */
300   for(i=0; i<N; i++){
301     iCol = sqlite3ColumnIndex(pSrc->a[i].pTab, zCol);
302     if( iCol>=0
303      && (bIgnoreHidden==0 || IsHiddenColumn(&pSrc->a[i].pTab->aCol[iCol])==0)
304     ){
305       if( piTab ){
306         *piTab = i;
307         *piCol = iCol;
308       }
309       return 1;
310     }
311   }
312   return 0;
313 }
314 
315 /*
316 ** This function is used to add terms implied by JOIN syntax to the
317 ** WHERE clause expression of a SELECT statement. The new term, which
318 ** is ANDed with the existing WHERE clause, is of the form:
319 **
320 **    (tab1.col1 = tab2.col2)
321 **
322 ** where tab1 is the iSrc'th table in SrcList pSrc and tab2 is the
323 ** (iSrc+1)'th. Column col1 is column iColLeft of tab1, and col2 is
324 ** column iColRight of tab2.
325 */
326 static void addWhereTerm(
327   Parse *pParse,                  /* Parsing context */
328   SrcList *pSrc,                  /* List of tables in FROM clause */
329   int iLeft,                      /* Index of first table to join in pSrc */
330   int iColLeft,                   /* Index of column in first table */
331   int iRight,                     /* Index of second table in pSrc */
332   int iColRight,                  /* Index of column in second table */
333   int isOuterJoin,                /* True if this is an OUTER join */
334   Expr **ppWhere                  /* IN/OUT: The WHERE clause to add to */
335 ){
336   sqlite3 *db = pParse->db;
337   Expr *pE1;
338   Expr *pE2;
339   Expr *pEq;
340 
341   assert( iLeft<iRight );
342   assert( pSrc->nSrc>iRight );
343   assert( pSrc->a[iLeft].pTab );
344   assert( pSrc->a[iRight].pTab );
345 
346   pE1 = sqlite3CreateColumnExpr(db, pSrc, iLeft, iColLeft);
347   pE2 = sqlite3CreateColumnExpr(db, pSrc, iRight, iColRight);
348 
349   pEq = sqlite3PExpr(pParse, TK_EQ, pE1, pE2);
350   if( pEq && isOuterJoin ){
351     ExprSetProperty(pEq, EP_FromJoin);
352     assert( !ExprHasProperty(pEq, EP_TokenOnly|EP_Reduced) );
353     ExprSetVVAProperty(pEq, EP_NoReduce);
354     pEq->iRightJoinTable = pE2->iTable;
355   }
356   *ppWhere = sqlite3ExprAnd(pParse, *ppWhere, pEq);
357 }
358 
359 /*
360 ** Set the EP_FromJoin property on all terms of the given expression.
361 ** And set the Expr.iRightJoinTable to iTable for every term in the
362 ** expression.
363 **
364 ** The EP_FromJoin property is used on terms of an expression to tell
365 ** the LEFT OUTER JOIN processing logic that this term is part of the
366 ** join restriction specified in the ON or USING clause and not a part
367 ** of the more general WHERE clause.  These terms are moved over to the
368 ** WHERE clause during join processing but we need to remember that they
369 ** originated in the ON or USING clause.
370 **
371 ** The Expr.iRightJoinTable tells the WHERE clause processing that the
372 ** expression depends on table iRightJoinTable even if that table is not
373 ** explicitly mentioned in the expression.  That information is needed
374 ** for cases like this:
375 **
376 **    SELECT * FROM t1 LEFT JOIN t2 ON t1.a=t2.b AND t1.x=5
377 **
378 ** The where clause needs to defer the handling of the t1.x=5
379 ** term until after the t2 loop of the join.  In that way, a
380 ** NULL t2 row will be inserted whenever t1.x!=5.  If we do not
381 ** defer the handling of t1.x=5, it will be processed immediately
382 ** after the t1 loop and rows with t1.x!=5 will never appear in
383 ** the output, which is incorrect.
384 */
385 void sqlite3SetJoinExpr(Expr *p, int iTable){
386   while( p ){
387     ExprSetProperty(p, EP_FromJoin);
388     assert( !ExprHasProperty(p, EP_TokenOnly|EP_Reduced) );
389     ExprSetVVAProperty(p, EP_NoReduce);
390     p->iRightJoinTable = iTable;
391     if( p->op==TK_FUNCTION && p->x.pList ){
392       int i;
393       for(i=0; i<p->x.pList->nExpr; i++){
394         sqlite3SetJoinExpr(p->x.pList->a[i].pExpr, iTable);
395       }
396     }
397     sqlite3SetJoinExpr(p->pLeft, iTable);
398     p = p->pRight;
399   }
400 }
401 
402 /* Undo the work of sqlite3SetJoinExpr(). In the expression p, convert every
403 ** term that is marked with EP_FromJoin and iRightJoinTable==iTable into
404 ** an ordinary term that omits the EP_FromJoin mark.
405 **
406 ** This happens when a LEFT JOIN is simplified into an ordinary JOIN.
407 */
408 static void unsetJoinExpr(Expr *p, int iTable){
409   while( p ){
410     if( ExprHasProperty(p, EP_FromJoin)
411      && (iTable<0 || p->iRightJoinTable==iTable) ){
412       ExprClearProperty(p, EP_FromJoin);
413     }
414     if( p->op==TK_COLUMN && p->iTable==iTable ){
415       ExprClearProperty(p, EP_CanBeNull);
416     }
417     if( p->op==TK_FUNCTION && p->x.pList ){
418       int i;
419       for(i=0; i<p->x.pList->nExpr; i++){
420         unsetJoinExpr(p->x.pList->a[i].pExpr, iTable);
421       }
422     }
423     unsetJoinExpr(p->pLeft, iTable);
424     p = p->pRight;
425   }
426 }
427 
428 /*
429 ** This routine processes the join information for a SELECT statement.
430 ** ON and USING clauses are converted into extra terms of the WHERE clause.
431 ** NATURAL joins also create extra WHERE clause terms.
432 **
433 ** The terms of a FROM clause are contained in the Select.pSrc structure.
434 ** The left most table is the first entry in Select.pSrc.  The right-most
435 ** table is the last entry.  The join operator is held in the entry to
436 ** the left.  Thus entry 0 contains the join operator for the join between
437 ** entries 0 and 1.  Any ON or USING clauses associated with the join are
438 ** also attached to the left entry.
439 **
440 ** This routine returns the number of errors encountered.
441 */
442 static int sqliteProcessJoin(Parse *pParse, Select *p){
443   SrcList *pSrc;                  /* All tables in the FROM clause */
444   int i, j;                       /* Loop counters */
445   SrcItem *pLeft;                 /* Left table being joined */
446   SrcItem *pRight;                /* Right table being joined */
447 
448   pSrc = p->pSrc;
449   pLeft = &pSrc->a[0];
450   pRight = &pLeft[1];
451   for(i=0; i<pSrc->nSrc-1; i++, pRight++, pLeft++){
452     Table *pRightTab = pRight->pTab;
453     int isOuter;
454 
455     if( NEVER(pLeft->pTab==0 || pRightTab==0) ) continue;
456     isOuter = (pRight->fg.jointype & JT_OUTER)!=0;
457 
458     /* When the NATURAL keyword is present, add WHERE clause terms for
459     ** every column that the two tables have in common.
460     */
461     if( pRight->fg.jointype & JT_NATURAL ){
462       if( pRight->pOn || pRight->pUsing ){
463         sqlite3ErrorMsg(pParse, "a NATURAL join may not have "
464            "an ON or USING clause", 0);
465         return 1;
466       }
467       for(j=0; j<pRightTab->nCol; j++){
468         char *zName;   /* Name of column in the right table */
469         int iLeft;     /* Matching left table */
470         int iLeftCol;  /* Matching column in the left table */
471 
472         if( IsHiddenColumn(&pRightTab->aCol[j]) ) continue;
473         zName = pRightTab->aCol[j].zName;
474         if( tableAndColumnIndex(pSrc, i+1, zName, &iLeft, &iLeftCol, 1) ){
475           addWhereTerm(pParse, pSrc, iLeft, iLeftCol, i+1, j,
476                 isOuter, &p->pWhere);
477         }
478       }
479     }
480 
481     /* Disallow both ON and USING clauses in the same join
482     */
483     if( pRight->pOn && pRight->pUsing ){
484       sqlite3ErrorMsg(pParse, "cannot have both ON and USING "
485         "clauses in the same join");
486       return 1;
487     }
488 
489     /* Add the ON clause to the end of the WHERE clause, connected by
490     ** an AND operator.
491     */
492     if( pRight->pOn ){
493       if( isOuter ) sqlite3SetJoinExpr(pRight->pOn, pRight->iCursor);
494       p->pWhere = sqlite3ExprAnd(pParse, p->pWhere, pRight->pOn);
495       pRight->pOn = 0;
496     }
497 
498     /* Create extra terms on the WHERE clause for each column named
499     ** in the USING clause.  Example: If the two tables to be joined are
500     ** A and B and the USING clause names X, Y, and Z, then add this
501     ** to the WHERE clause:    A.X=B.X AND A.Y=B.Y AND A.Z=B.Z
502     ** Report an error if any column mentioned in the USING clause is
503     ** not contained in both tables to be joined.
504     */
505     if( pRight->pUsing ){
506       IdList *pList = pRight->pUsing;
507       for(j=0; j<pList->nId; j++){
508         char *zName;     /* Name of the term in the USING clause */
509         int iLeft;       /* Table on the left with matching column name */
510         int iLeftCol;    /* Column number of matching column on the left */
511         int iRightCol;   /* Column number of matching column on the right */
512 
513         zName = pList->a[j].zName;
514         iRightCol = sqlite3ColumnIndex(pRightTab, zName);
515         if( iRightCol<0
516          || !tableAndColumnIndex(pSrc, i+1, zName, &iLeft, &iLeftCol, 0)
517         ){
518           sqlite3ErrorMsg(pParse, "cannot join using column %s - column "
519             "not present in both tables", zName);
520           return 1;
521         }
522         addWhereTerm(pParse, pSrc, iLeft, iLeftCol, i+1, iRightCol,
523                      isOuter, &p->pWhere);
524       }
525     }
526   }
527   return 0;
528 }
529 
530 /*
531 ** An instance of this object holds information (beyond pParse and pSelect)
532 ** needed to load the next result row that is to be added to the sorter.
533 */
534 typedef struct RowLoadInfo RowLoadInfo;
535 struct RowLoadInfo {
536   int regResult;               /* Store results in array of registers here */
537   u8 ecelFlags;                /* Flag argument to ExprCodeExprList() */
538 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
539   ExprList *pExtra;            /* Extra columns needed by sorter refs */
540   int regExtraResult;          /* Where to load the extra columns */
541 #endif
542 };
543 
544 /*
545 ** This routine does the work of loading query data into an array of
546 ** registers so that it can be added to the sorter.
547 */
548 static void innerLoopLoadRow(
549   Parse *pParse,             /* Statement under construction */
550   Select *pSelect,           /* The query being coded */
551   RowLoadInfo *pInfo         /* Info needed to complete the row load */
552 ){
553   sqlite3ExprCodeExprList(pParse, pSelect->pEList, pInfo->regResult,
554                           0, pInfo->ecelFlags);
555 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
556   if( pInfo->pExtra ){
557     sqlite3ExprCodeExprList(pParse, pInfo->pExtra, pInfo->regExtraResult, 0, 0);
558     sqlite3ExprListDelete(pParse->db, pInfo->pExtra);
559   }
560 #endif
561 }
562 
563 /*
564 ** Code the OP_MakeRecord instruction that generates the entry to be
565 ** added into the sorter.
566 **
567 ** Return the register in which the result is stored.
568 */
569 static int makeSorterRecord(
570   Parse *pParse,
571   SortCtx *pSort,
572   Select *pSelect,
573   int regBase,
574   int nBase
575 ){
576   int nOBSat = pSort->nOBSat;
577   Vdbe *v = pParse->pVdbe;
578   int regOut = ++pParse->nMem;
579   if( pSort->pDeferredRowLoad ){
580     innerLoopLoadRow(pParse, pSelect, pSort->pDeferredRowLoad);
581   }
582   sqlite3VdbeAddOp3(v, OP_MakeRecord, regBase+nOBSat, nBase-nOBSat, regOut);
583   return regOut;
584 }
585 
586 /*
587 ** Generate code that will push the record in registers regData
588 ** through regData+nData-1 onto the sorter.
589 */
590 static void pushOntoSorter(
591   Parse *pParse,         /* Parser context */
592   SortCtx *pSort,        /* Information about the ORDER BY clause */
593   Select *pSelect,       /* The whole SELECT statement */
594   int regData,           /* First register holding data to be sorted */
595   int regOrigData,       /* First register holding data before packing */
596   int nData,             /* Number of elements in the regData data array */
597   int nPrefixReg         /* No. of reg prior to regData available for use */
598 ){
599   Vdbe *v = pParse->pVdbe;                         /* Stmt under construction */
600   int bSeq = ((pSort->sortFlags & SORTFLAG_UseSorter)==0);
601   int nExpr = pSort->pOrderBy->nExpr;              /* No. of ORDER BY terms */
602   int nBase = nExpr + bSeq + nData;                /* Fields in sorter record */
603   int regBase;                                     /* Regs for sorter record */
604   int regRecord = 0;                               /* Assembled sorter record */
605   int nOBSat = pSort->nOBSat;                      /* ORDER BY terms to skip */
606   int op;                            /* Opcode to add sorter record to sorter */
607   int iLimit;                        /* LIMIT counter */
608   int iSkip = 0;                     /* End of the sorter insert loop */
609 
610   assert( bSeq==0 || bSeq==1 );
611 
612   /* Three cases:
613   **   (1) The data to be sorted has already been packed into a Record
614   **       by a prior OP_MakeRecord.  In this case nData==1 and regData
615   **       will be completely unrelated to regOrigData.
616   **   (2) All output columns are included in the sort record.  In that
617   **       case regData==regOrigData.
618   **   (3) Some output columns are omitted from the sort record due to
619   **       the SQLITE_ENABLE_SORTER_REFERENCE optimization, or due to the
620   **       SQLITE_ECEL_OMITREF optimization, or due to the
621   **       SortCtx.pDeferredRowLoad optimiation.  In any of these cases
622   **       regOrigData is 0 to prevent this routine from trying to copy
623   **       values that might not yet exist.
624   */
625   assert( nData==1 || regData==regOrigData || regOrigData==0 );
626 
627   if( nPrefixReg ){
628     assert( nPrefixReg==nExpr+bSeq );
629     regBase = regData - nPrefixReg;
630   }else{
631     regBase = pParse->nMem + 1;
632     pParse->nMem += nBase;
633   }
634   assert( pSelect->iOffset==0 || pSelect->iLimit!=0 );
635   iLimit = pSelect->iOffset ? pSelect->iOffset+1 : pSelect->iLimit;
636   pSort->labelDone = sqlite3VdbeMakeLabel(pParse);
637   sqlite3ExprCodeExprList(pParse, pSort->pOrderBy, regBase, regOrigData,
638                           SQLITE_ECEL_DUP | (regOrigData? SQLITE_ECEL_REF : 0));
639   if( bSeq ){
640     sqlite3VdbeAddOp2(v, OP_Sequence, pSort->iECursor, regBase+nExpr);
641   }
642   if( nPrefixReg==0 && nData>0 ){
643     sqlite3ExprCodeMove(pParse, regData, regBase+nExpr+bSeq, nData);
644   }
645   if( nOBSat>0 ){
646     int regPrevKey;   /* The first nOBSat columns of the previous row */
647     int addrFirst;    /* Address of the OP_IfNot opcode */
648     int addrJmp;      /* Address of the OP_Jump opcode */
649     VdbeOp *pOp;      /* Opcode that opens the sorter */
650     int nKey;         /* Number of sorting key columns, including OP_Sequence */
651     KeyInfo *pKI;     /* Original KeyInfo on the sorter table */
652 
653     regRecord = makeSorterRecord(pParse, pSort, pSelect, regBase, nBase);
654     regPrevKey = pParse->nMem+1;
655     pParse->nMem += pSort->nOBSat;
656     nKey = nExpr - pSort->nOBSat + bSeq;
657     if( bSeq ){
658       addrFirst = sqlite3VdbeAddOp1(v, OP_IfNot, regBase+nExpr);
659     }else{
660       addrFirst = sqlite3VdbeAddOp1(v, OP_SequenceTest, pSort->iECursor);
661     }
662     VdbeCoverage(v);
663     sqlite3VdbeAddOp3(v, OP_Compare, regPrevKey, regBase, pSort->nOBSat);
664     pOp = sqlite3VdbeGetOp(v, pSort->addrSortIndex);
665     if( pParse->db->mallocFailed ) return;
666     pOp->p2 = nKey + nData;
667     pKI = pOp->p4.pKeyInfo;
668     memset(pKI->aSortFlags, 0, pKI->nKeyField); /* Makes OP_Jump testable */
669     sqlite3VdbeChangeP4(v, -1, (char*)pKI, P4_KEYINFO);
670     testcase( pKI->nAllField > pKI->nKeyField+2 );
671     pOp->p4.pKeyInfo = sqlite3KeyInfoFromExprList(pParse,pSort->pOrderBy,nOBSat,
672                                            pKI->nAllField-pKI->nKeyField-1);
673     pOp = 0; /* Ensure pOp not used after sqltie3VdbeAddOp3() */
674     addrJmp = sqlite3VdbeCurrentAddr(v);
675     sqlite3VdbeAddOp3(v, OP_Jump, addrJmp+1, 0, addrJmp+1); VdbeCoverage(v);
676     pSort->labelBkOut = sqlite3VdbeMakeLabel(pParse);
677     pSort->regReturn = ++pParse->nMem;
678     sqlite3VdbeAddOp2(v, OP_Gosub, pSort->regReturn, pSort->labelBkOut);
679     sqlite3VdbeAddOp1(v, OP_ResetSorter, pSort->iECursor);
680     if( iLimit ){
681       sqlite3VdbeAddOp2(v, OP_IfNot, iLimit, pSort->labelDone);
682       VdbeCoverage(v);
683     }
684     sqlite3VdbeJumpHere(v, addrFirst);
685     sqlite3ExprCodeMove(pParse, regBase, regPrevKey, pSort->nOBSat);
686     sqlite3VdbeJumpHere(v, addrJmp);
687   }
688   if( iLimit ){
689     /* At this point the values for the new sorter entry are stored
690     ** in an array of registers. They need to be composed into a record
691     ** and inserted into the sorter if either (a) there are currently
692     ** less than LIMIT+OFFSET items or (b) the new record is smaller than
693     ** the largest record currently in the sorter. If (b) is true and there
694     ** are already LIMIT+OFFSET items in the sorter, delete the largest
695     ** entry before inserting the new one. This way there are never more
696     ** than LIMIT+OFFSET items in the sorter.
697     **
698     ** If the new record does not need to be inserted into the sorter,
699     ** jump to the next iteration of the loop. If the pSort->labelOBLopt
700     ** value is not zero, then it is a label of where to jump.  Otherwise,
701     ** just bypass the row insert logic.  See the header comment on the
702     ** sqlite3WhereOrderByLimitOptLabel() function for additional info.
703     */
704     int iCsr = pSort->iECursor;
705     sqlite3VdbeAddOp2(v, OP_IfNotZero, iLimit, sqlite3VdbeCurrentAddr(v)+4);
706     VdbeCoverage(v);
707     sqlite3VdbeAddOp2(v, OP_Last, iCsr, 0);
708     iSkip = sqlite3VdbeAddOp4Int(v, OP_IdxLE,
709                                  iCsr, 0, regBase+nOBSat, nExpr-nOBSat);
710     VdbeCoverage(v);
711     sqlite3VdbeAddOp1(v, OP_Delete, iCsr);
712   }
713   if( regRecord==0 ){
714     regRecord = makeSorterRecord(pParse, pSort, pSelect, regBase, nBase);
715   }
716   if( pSort->sortFlags & SORTFLAG_UseSorter ){
717     op = OP_SorterInsert;
718   }else{
719     op = OP_IdxInsert;
720   }
721   sqlite3VdbeAddOp4Int(v, op, pSort->iECursor, regRecord,
722                        regBase+nOBSat, nBase-nOBSat);
723   if( iSkip ){
724     sqlite3VdbeChangeP2(v, iSkip,
725          pSort->labelOBLopt ? pSort->labelOBLopt : sqlite3VdbeCurrentAddr(v));
726   }
727 }
728 
729 /*
730 ** Add code to implement the OFFSET
731 */
732 static void codeOffset(
733   Vdbe *v,          /* Generate code into this VM */
734   int iOffset,      /* Register holding the offset counter */
735   int iContinue     /* Jump here to skip the current record */
736 ){
737   if( iOffset>0 ){
738     sqlite3VdbeAddOp3(v, OP_IfPos, iOffset, iContinue, 1); VdbeCoverage(v);
739     VdbeComment((v, "OFFSET"));
740   }
741 }
742 
743 /*
744 ** Add code that will check to make sure the N registers starting at iMem
745 ** form a distinct entry.  iTab is a sorting index that holds previously
746 ** seen combinations of the N values.  A new entry is made in iTab
747 ** if the current N values are new.
748 **
749 ** A jump to addrRepeat is made and the N+1 values are popped from the
750 ** stack if the top N elements are not distinct.
751 */
752 static void codeDistinct(
753   Parse *pParse,     /* Parsing and code generating context */
754   int iTab,          /* A sorting index used to test for distinctness */
755   int addrRepeat,    /* Jump to here if not distinct */
756   int N,             /* Number of elements */
757   int iMem           /* First element */
758 ){
759   Vdbe *v;
760   int r1;
761 
762   v = pParse->pVdbe;
763   r1 = sqlite3GetTempReg(pParse);
764   sqlite3VdbeAddOp4Int(v, OP_Found, iTab, addrRepeat, iMem, N); VdbeCoverage(v);
765   sqlite3VdbeAddOp3(v, OP_MakeRecord, iMem, N, r1);
766   sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iTab, r1, iMem, N);
767   sqlite3VdbeChangeP5(v, OPFLAG_USESEEKRESULT);
768   sqlite3ReleaseTempReg(pParse, r1);
769 }
770 
771 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
772 /*
773 ** This function is called as part of inner-loop generation for a SELECT
774 ** statement with an ORDER BY that is not optimized by an index. It
775 ** determines the expressions, if any, that the sorter-reference
776 ** optimization should be used for. The sorter-reference optimization
777 ** is used for SELECT queries like:
778 **
779 **   SELECT a, bigblob FROM t1 ORDER BY a LIMIT 10
780 **
781 ** If the optimization is used for expression "bigblob", then instead of
782 ** storing values read from that column in the sorter records, the PK of
783 ** the row from table t1 is stored instead. Then, as records are extracted from
784 ** the sorter to return to the user, the required value of bigblob is
785 ** retrieved directly from table t1. If the values are very large, this
786 ** can be more efficient than storing them directly in the sorter records.
787 **
788 ** The ExprList_item.bSorterRef flag is set for each expression in pEList
789 ** for which the sorter-reference optimization should be enabled.
790 ** Additionally, the pSort->aDefer[] array is populated with entries
791 ** for all cursors required to evaluate all selected expressions. Finally.
792 ** output variable (*ppExtra) is set to an expression list containing
793 ** expressions for all extra PK values that should be stored in the
794 ** sorter records.
795 */
796 static void selectExprDefer(
797   Parse *pParse,                  /* Leave any error here */
798   SortCtx *pSort,                 /* Sorter context */
799   ExprList *pEList,               /* Expressions destined for sorter */
800   ExprList **ppExtra              /* Expressions to append to sorter record */
801 ){
802   int i;
803   int nDefer = 0;
804   ExprList *pExtra = 0;
805   for(i=0; i<pEList->nExpr; i++){
806     struct ExprList_item *pItem = &pEList->a[i];
807     if( pItem->u.x.iOrderByCol==0 ){
808       Expr *pExpr = pItem->pExpr;
809       Table *pTab = pExpr->y.pTab;
810       if( pExpr->op==TK_COLUMN && pExpr->iColumn>=0 && pTab && !IsVirtual(pTab)
811        && (pTab->aCol[pExpr->iColumn].colFlags & COLFLAG_SORTERREF)
812       ){
813         int j;
814         for(j=0; j<nDefer; j++){
815           if( pSort->aDefer[j].iCsr==pExpr->iTable ) break;
816         }
817         if( j==nDefer ){
818           if( nDefer==ArraySize(pSort->aDefer) ){
819             continue;
820           }else{
821             int nKey = 1;
822             int k;
823             Index *pPk = 0;
824             if( !HasRowid(pTab) ){
825               pPk = sqlite3PrimaryKeyIndex(pTab);
826               nKey = pPk->nKeyCol;
827             }
828             for(k=0; k<nKey; k++){
829               Expr *pNew = sqlite3PExpr(pParse, TK_COLUMN, 0, 0);
830               if( pNew ){
831                 pNew->iTable = pExpr->iTable;
832                 pNew->y.pTab = pExpr->y.pTab;
833                 pNew->iColumn = pPk ? pPk->aiColumn[k] : -1;
834                 pExtra = sqlite3ExprListAppend(pParse, pExtra, pNew);
835               }
836             }
837             pSort->aDefer[nDefer].pTab = pExpr->y.pTab;
838             pSort->aDefer[nDefer].iCsr = pExpr->iTable;
839             pSort->aDefer[nDefer].nKey = nKey;
840             nDefer++;
841           }
842         }
843         pItem->bSorterRef = 1;
844       }
845     }
846   }
847   pSort->nDefer = (u8)nDefer;
848   *ppExtra = pExtra;
849 }
850 #endif
851 
852 /*
853 ** This routine generates the code for the inside of the inner loop
854 ** of a SELECT.
855 **
856 ** If srcTab is negative, then the p->pEList expressions
857 ** are evaluated in order to get the data for this row.  If srcTab is
858 ** zero or more, then data is pulled from srcTab and p->pEList is used only
859 ** to get the number of columns and the collation sequence for each column.
860 */
861 static void selectInnerLoop(
862   Parse *pParse,          /* The parser context */
863   Select *p,              /* The complete select statement being coded */
864   int srcTab,             /* Pull data from this table if non-negative */
865   SortCtx *pSort,         /* If not NULL, info on how to process ORDER BY */
866   DistinctCtx *pDistinct, /* If not NULL, info on how to process DISTINCT */
867   SelectDest *pDest,      /* How to dispose of the results */
868   int iContinue,          /* Jump here to continue with next row */
869   int iBreak              /* Jump here to break out of the inner loop */
870 ){
871   Vdbe *v = pParse->pVdbe;
872   int i;
873   int hasDistinct;            /* True if the DISTINCT keyword is present */
874   int eDest = pDest->eDest;   /* How to dispose of results */
875   int iParm = pDest->iSDParm; /* First argument to disposal method */
876   int nResultCol;             /* Number of result columns */
877   int nPrefixReg = 0;         /* Number of extra registers before regResult */
878   RowLoadInfo sRowLoadInfo;   /* Info for deferred row loading */
879 
880   /* Usually, regResult is the first cell in an array of memory cells
881   ** containing the current result row. In this case regOrig is set to the
882   ** same value. However, if the results are being sent to the sorter, the
883   ** values for any expressions that are also part of the sort-key are omitted
884   ** from this array. In this case regOrig is set to zero.  */
885   int regResult;              /* Start of memory holding current results */
886   int regOrig;                /* Start of memory holding full result (or 0) */
887 
888   assert( v );
889   assert( p->pEList!=0 );
890   hasDistinct = pDistinct ? pDistinct->eTnctType : WHERE_DISTINCT_NOOP;
891   if( pSort && pSort->pOrderBy==0 ) pSort = 0;
892   if( pSort==0 && !hasDistinct ){
893     assert( iContinue!=0 );
894     codeOffset(v, p->iOffset, iContinue);
895   }
896 
897   /* Pull the requested columns.
898   */
899   nResultCol = p->pEList->nExpr;
900 
901   if( pDest->iSdst==0 ){
902     if( pSort ){
903       nPrefixReg = pSort->pOrderBy->nExpr;
904       if( !(pSort->sortFlags & SORTFLAG_UseSorter) ) nPrefixReg++;
905       pParse->nMem += nPrefixReg;
906     }
907     pDest->iSdst = pParse->nMem+1;
908     pParse->nMem += nResultCol;
909   }else if( pDest->iSdst+nResultCol > pParse->nMem ){
910     /* This is an error condition that can result, for example, when a SELECT
911     ** on the right-hand side of an INSERT contains more result columns than
912     ** there are columns in the table on the left.  The error will be caught
913     ** and reported later.  But we need to make sure enough memory is allocated
914     ** to avoid other spurious errors in the meantime. */
915     pParse->nMem += nResultCol;
916   }
917   pDest->nSdst = nResultCol;
918   regOrig = regResult = pDest->iSdst;
919   if( srcTab>=0 ){
920     for(i=0; i<nResultCol; i++){
921       sqlite3VdbeAddOp3(v, OP_Column, srcTab, i, regResult+i);
922       VdbeComment((v, "%s", p->pEList->a[i].zEName));
923     }
924   }else if( eDest!=SRT_Exists ){
925 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
926     ExprList *pExtra = 0;
927 #endif
928     /* If the destination is an EXISTS(...) expression, the actual
929     ** values returned by the SELECT are not required.
930     */
931     u8 ecelFlags;    /* "ecel" is an abbreviation of "ExprCodeExprList" */
932     ExprList *pEList;
933     if( eDest==SRT_Mem || eDest==SRT_Output || eDest==SRT_Coroutine ){
934       ecelFlags = SQLITE_ECEL_DUP;
935     }else{
936       ecelFlags = 0;
937     }
938     if( pSort && hasDistinct==0 && eDest!=SRT_EphemTab && eDest!=SRT_Table ){
939       /* For each expression in p->pEList that is a copy of an expression in
940       ** the ORDER BY clause (pSort->pOrderBy), set the associated
941       ** iOrderByCol value to one more than the index of the ORDER BY
942       ** expression within the sort-key that pushOntoSorter() will generate.
943       ** This allows the p->pEList field to be omitted from the sorted record,
944       ** saving space and CPU cycles.  */
945       ecelFlags |= (SQLITE_ECEL_OMITREF|SQLITE_ECEL_REF);
946 
947       for(i=pSort->nOBSat; i<pSort->pOrderBy->nExpr; i++){
948         int j;
949         if( (j = pSort->pOrderBy->a[i].u.x.iOrderByCol)>0 ){
950           p->pEList->a[j-1].u.x.iOrderByCol = i+1-pSort->nOBSat;
951         }
952       }
953 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
954       selectExprDefer(pParse, pSort, p->pEList, &pExtra);
955       if( pExtra && pParse->db->mallocFailed==0 ){
956         /* If there are any extra PK columns to add to the sorter records,
957         ** allocate extra memory cells and adjust the OpenEphemeral
958         ** instruction to account for the larger records. This is only
959         ** required if there are one or more WITHOUT ROWID tables with
960         ** composite primary keys in the SortCtx.aDefer[] array.  */
961         VdbeOp *pOp = sqlite3VdbeGetOp(v, pSort->addrSortIndex);
962         pOp->p2 += (pExtra->nExpr - pSort->nDefer);
963         pOp->p4.pKeyInfo->nAllField += (pExtra->nExpr - pSort->nDefer);
964         pParse->nMem += pExtra->nExpr;
965       }
966 #endif
967 
968       /* Adjust nResultCol to account for columns that are omitted
969       ** from the sorter by the optimizations in this branch */
970       pEList = p->pEList;
971       for(i=0; i<pEList->nExpr; i++){
972         if( pEList->a[i].u.x.iOrderByCol>0
973 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
974          || pEList->a[i].bSorterRef
975 #endif
976         ){
977           nResultCol--;
978           regOrig = 0;
979         }
980       }
981 
982       testcase( regOrig );
983       testcase( eDest==SRT_Set );
984       testcase( eDest==SRT_Mem );
985       testcase( eDest==SRT_Coroutine );
986       testcase( eDest==SRT_Output );
987       assert( eDest==SRT_Set || eDest==SRT_Mem
988            || eDest==SRT_Coroutine || eDest==SRT_Output
989            || eDest==SRT_Upfrom );
990     }
991     sRowLoadInfo.regResult = regResult;
992     sRowLoadInfo.ecelFlags = ecelFlags;
993 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
994     sRowLoadInfo.pExtra = pExtra;
995     sRowLoadInfo.regExtraResult = regResult + nResultCol;
996     if( pExtra ) nResultCol += pExtra->nExpr;
997 #endif
998     if( p->iLimit
999      && (ecelFlags & SQLITE_ECEL_OMITREF)!=0
1000      && nPrefixReg>0
1001     ){
1002       assert( pSort!=0 );
1003       assert( hasDistinct==0 );
1004       pSort->pDeferredRowLoad = &sRowLoadInfo;
1005       regOrig = 0;
1006     }else{
1007       innerLoopLoadRow(pParse, p, &sRowLoadInfo);
1008     }
1009   }
1010 
1011   /* If the DISTINCT keyword was present on the SELECT statement
1012   ** and this row has been seen before, then do not make this row
1013   ** part of the result.
1014   */
1015   if( hasDistinct ){
1016     switch( pDistinct->eTnctType ){
1017       case WHERE_DISTINCT_ORDERED: {
1018         VdbeOp *pOp;            /* No longer required OpenEphemeral instr. */
1019         int iJump;              /* Jump destination */
1020         int regPrev;            /* Previous row content */
1021 
1022         /* Allocate space for the previous row */
1023         regPrev = pParse->nMem+1;
1024         pParse->nMem += nResultCol;
1025 
1026         /* Change the OP_OpenEphemeral coded earlier to an OP_Null
1027         ** sets the MEM_Cleared bit on the first register of the
1028         ** previous value.  This will cause the OP_Ne below to always
1029         ** fail on the first iteration of the loop even if the first
1030         ** row is all NULLs.
1031         */
1032         sqlite3VdbeChangeToNoop(v, pDistinct->addrTnct);
1033         pOp = sqlite3VdbeGetOp(v, pDistinct->addrTnct);
1034         pOp->opcode = OP_Null;
1035         pOp->p1 = 1;
1036         pOp->p2 = regPrev;
1037         pOp = 0;  /* Ensure pOp is not used after sqlite3VdbeAddOp() */
1038 
1039         iJump = sqlite3VdbeCurrentAddr(v) + nResultCol;
1040         for(i=0; i<nResultCol; i++){
1041           CollSeq *pColl = sqlite3ExprCollSeq(pParse, p->pEList->a[i].pExpr);
1042           if( i<nResultCol-1 ){
1043             sqlite3VdbeAddOp3(v, OP_Ne, regResult+i, iJump, regPrev+i);
1044             VdbeCoverage(v);
1045           }else{
1046             sqlite3VdbeAddOp3(v, OP_Eq, regResult+i, iContinue, regPrev+i);
1047             VdbeCoverage(v);
1048            }
1049           sqlite3VdbeChangeP4(v, -1, (const char *)pColl, P4_COLLSEQ);
1050           sqlite3VdbeChangeP5(v, SQLITE_NULLEQ);
1051         }
1052         assert( sqlite3VdbeCurrentAddr(v)==iJump || pParse->db->mallocFailed );
1053         sqlite3VdbeAddOp3(v, OP_Copy, regResult, regPrev, nResultCol-1);
1054         break;
1055       }
1056 
1057       case WHERE_DISTINCT_UNIQUE: {
1058         sqlite3VdbeChangeToNoop(v, pDistinct->addrTnct);
1059         break;
1060       }
1061 
1062       default: {
1063         assert( pDistinct->eTnctType==WHERE_DISTINCT_UNORDERED );
1064         codeDistinct(pParse, pDistinct->tabTnct, iContinue, nResultCol,
1065                      regResult);
1066         break;
1067       }
1068     }
1069     if( pSort==0 ){
1070       codeOffset(v, p->iOffset, iContinue);
1071     }
1072   }
1073 
1074   switch( eDest ){
1075     /* In this mode, write each query result to the key of the temporary
1076     ** table iParm.
1077     */
1078 #ifndef SQLITE_OMIT_COMPOUND_SELECT
1079     case SRT_Union: {
1080       int r1;
1081       r1 = sqlite3GetTempReg(pParse);
1082       sqlite3VdbeAddOp3(v, OP_MakeRecord, regResult, nResultCol, r1);
1083       sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, r1, regResult, nResultCol);
1084       sqlite3ReleaseTempReg(pParse, r1);
1085       break;
1086     }
1087 
1088     /* Construct a record from the query result, but instead of
1089     ** saving that record, use it as a key to delete elements from
1090     ** the temporary table iParm.
1091     */
1092     case SRT_Except: {
1093       sqlite3VdbeAddOp3(v, OP_IdxDelete, iParm, regResult, nResultCol);
1094       break;
1095     }
1096 #endif /* SQLITE_OMIT_COMPOUND_SELECT */
1097 
1098     /* Store the result as data using a unique key.
1099     */
1100     case SRT_Fifo:
1101     case SRT_DistFifo:
1102     case SRT_Table:
1103     case SRT_EphemTab: {
1104       int r1 = sqlite3GetTempRange(pParse, nPrefixReg+1);
1105       testcase( eDest==SRT_Table );
1106       testcase( eDest==SRT_EphemTab );
1107       testcase( eDest==SRT_Fifo );
1108       testcase( eDest==SRT_DistFifo );
1109       sqlite3VdbeAddOp3(v, OP_MakeRecord, regResult, nResultCol, r1+nPrefixReg);
1110 #ifndef SQLITE_OMIT_CTE
1111       if( eDest==SRT_DistFifo ){
1112         /* If the destination is DistFifo, then cursor (iParm+1) is open
1113         ** on an ephemeral index. If the current row is already present
1114         ** in the index, do not write it to the output. If not, add the
1115         ** current row to the index and proceed with writing it to the
1116         ** output table as well.  */
1117         int addr = sqlite3VdbeCurrentAddr(v) + 4;
1118         sqlite3VdbeAddOp4Int(v, OP_Found, iParm+1, addr, r1, 0);
1119         VdbeCoverage(v);
1120         sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm+1, r1,regResult,nResultCol);
1121         assert( pSort==0 );
1122       }
1123 #endif
1124       if( pSort ){
1125         assert( regResult==regOrig );
1126         pushOntoSorter(pParse, pSort, p, r1+nPrefixReg, regOrig, 1, nPrefixReg);
1127       }else{
1128         int r2 = sqlite3GetTempReg(pParse);
1129         sqlite3VdbeAddOp2(v, OP_NewRowid, iParm, r2);
1130         sqlite3VdbeAddOp3(v, OP_Insert, iParm, r1, r2);
1131         sqlite3VdbeChangeP5(v, OPFLAG_APPEND);
1132         sqlite3ReleaseTempReg(pParse, r2);
1133       }
1134       sqlite3ReleaseTempRange(pParse, r1, nPrefixReg+1);
1135       break;
1136     }
1137 
1138     case SRT_Upfrom: {
1139       if( pSort ){
1140         pushOntoSorter(
1141             pParse, pSort, p, regResult, regOrig, nResultCol, nPrefixReg);
1142       }else{
1143         int i2 = pDest->iSDParm2;
1144         int r1 = sqlite3GetTempReg(pParse);
1145 
1146         /* If the UPDATE FROM join is an aggregate that matches no rows, it
1147         ** might still be trying to return one row, because that is what
1148         ** aggregates do.  Don't record that empty row in the output table. */
1149         sqlite3VdbeAddOp2(v, OP_IsNull, regResult, iBreak); VdbeCoverage(v);
1150 
1151         sqlite3VdbeAddOp3(v, OP_MakeRecord,
1152                           regResult+(i2<0), nResultCol-(i2<0), r1);
1153         if( i2<0 ){
1154           sqlite3VdbeAddOp3(v, OP_Insert, iParm, r1, regResult);
1155         }else{
1156           sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, r1, regResult, i2);
1157         }
1158       }
1159       break;
1160     }
1161 
1162 #ifndef SQLITE_OMIT_SUBQUERY
1163     /* If we are creating a set for an "expr IN (SELECT ...)" construct,
1164     ** then there should be a single item on the stack.  Write this
1165     ** item into the set table with bogus data.
1166     */
1167     case SRT_Set: {
1168       if( pSort ){
1169         /* At first glance you would think we could optimize out the
1170         ** ORDER BY in this case since the order of entries in the set
1171         ** does not matter.  But there might be a LIMIT clause, in which
1172         ** case the order does matter */
1173         pushOntoSorter(
1174             pParse, pSort, p, regResult, regOrig, nResultCol, nPrefixReg);
1175       }else{
1176         int r1 = sqlite3GetTempReg(pParse);
1177         assert( sqlite3Strlen30(pDest->zAffSdst)==nResultCol );
1178         sqlite3VdbeAddOp4(v, OP_MakeRecord, regResult, nResultCol,
1179             r1, pDest->zAffSdst, nResultCol);
1180         sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, r1, regResult, nResultCol);
1181         sqlite3ReleaseTempReg(pParse, r1);
1182       }
1183       break;
1184     }
1185 
1186 
1187     /* If any row exist in the result set, record that fact and abort.
1188     */
1189     case SRT_Exists: {
1190       sqlite3VdbeAddOp2(v, OP_Integer, 1, iParm);
1191       /* The LIMIT clause will terminate the loop for us */
1192       break;
1193     }
1194 
1195     /* If this is a scalar select that is part of an expression, then
1196     ** store the results in the appropriate memory cell or array of
1197     ** memory cells and break out of the scan loop.
1198     */
1199     case SRT_Mem: {
1200       if( pSort ){
1201         assert( nResultCol<=pDest->nSdst );
1202         pushOntoSorter(
1203             pParse, pSort, p, regResult, regOrig, nResultCol, nPrefixReg);
1204       }else{
1205         assert( nResultCol==pDest->nSdst );
1206         assert( regResult==iParm );
1207         /* The LIMIT clause will jump out of the loop for us */
1208       }
1209       break;
1210     }
1211 #endif /* #ifndef SQLITE_OMIT_SUBQUERY */
1212 
1213     case SRT_Coroutine:       /* Send data to a co-routine */
1214     case SRT_Output: {        /* Return the results */
1215       testcase( eDest==SRT_Coroutine );
1216       testcase( eDest==SRT_Output );
1217       if( pSort ){
1218         pushOntoSorter(pParse, pSort, p, regResult, regOrig, nResultCol,
1219                        nPrefixReg);
1220       }else if( eDest==SRT_Coroutine ){
1221         sqlite3VdbeAddOp1(v, OP_Yield, pDest->iSDParm);
1222       }else{
1223         sqlite3VdbeAddOp2(v, OP_ResultRow, regResult, nResultCol);
1224       }
1225       break;
1226     }
1227 
1228 #ifndef SQLITE_OMIT_CTE
1229     /* Write the results into a priority queue that is order according to
1230     ** pDest->pOrderBy (in pSO).  pDest->iSDParm (in iParm) is the cursor for an
1231     ** index with pSO->nExpr+2 columns.  Build a key using pSO for the first
1232     ** pSO->nExpr columns, then make sure all keys are unique by adding a
1233     ** final OP_Sequence column.  The last column is the record as a blob.
1234     */
1235     case SRT_DistQueue:
1236     case SRT_Queue: {
1237       int nKey;
1238       int r1, r2, r3;
1239       int addrTest = 0;
1240       ExprList *pSO;
1241       pSO = pDest->pOrderBy;
1242       assert( pSO );
1243       nKey = pSO->nExpr;
1244       r1 = sqlite3GetTempReg(pParse);
1245       r2 = sqlite3GetTempRange(pParse, nKey+2);
1246       r3 = r2+nKey+1;
1247       if( eDest==SRT_DistQueue ){
1248         /* If the destination is DistQueue, then cursor (iParm+1) is open
1249         ** on a second ephemeral index that holds all values every previously
1250         ** added to the queue. */
1251         addrTest = sqlite3VdbeAddOp4Int(v, OP_Found, iParm+1, 0,
1252                                         regResult, nResultCol);
1253         VdbeCoverage(v);
1254       }
1255       sqlite3VdbeAddOp3(v, OP_MakeRecord, regResult, nResultCol, r3);
1256       if( eDest==SRT_DistQueue ){
1257         sqlite3VdbeAddOp2(v, OP_IdxInsert, iParm+1, r3);
1258         sqlite3VdbeChangeP5(v, OPFLAG_USESEEKRESULT);
1259       }
1260       for(i=0; i<nKey; i++){
1261         sqlite3VdbeAddOp2(v, OP_SCopy,
1262                           regResult + pSO->a[i].u.x.iOrderByCol - 1,
1263                           r2+i);
1264       }
1265       sqlite3VdbeAddOp2(v, OP_Sequence, iParm, r2+nKey);
1266       sqlite3VdbeAddOp3(v, OP_MakeRecord, r2, nKey+2, r1);
1267       sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, r1, r2, nKey+2);
1268       if( addrTest ) sqlite3VdbeJumpHere(v, addrTest);
1269       sqlite3ReleaseTempReg(pParse, r1);
1270       sqlite3ReleaseTempRange(pParse, r2, nKey+2);
1271       break;
1272     }
1273 #endif /* SQLITE_OMIT_CTE */
1274 
1275 
1276 
1277 #if !defined(SQLITE_OMIT_TRIGGER)
1278     /* Discard the results.  This is used for SELECT statements inside
1279     ** the body of a TRIGGER.  The purpose of such selects is to call
1280     ** user-defined functions that have side effects.  We do not care
1281     ** about the actual results of the select.
1282     */
1283     default: {
1284       assert( eDest==SRT_Discard );
1285       break;
1286     }
1287 #endif
1288   }
1289 
1290   /* Jump to the end of the loop if the LIMIT is reached.  Except, if
1291   ** there is a sorter, in which case the sorter has already limited
1292   ** the output for us.
1293   */
1294   if( pSort==0 && p->iLimit ){
1295     sqlite3VdbeAddOp2(v, OP_DecrJumpZero, p->iLimit, iBreak); VdbeCoverage(v);
1296   }
1297 }
1298 
1299 /*
1300 ** Allocate a KeyInfo object sufficient for an index of N key columns and
1301 ** X extra columns.
1302 */
1303 KeyInfo *sqlite3KeyInfoAlloc(sqlite3 *db, int N, int X){
1304   int nExtra = (N+X)*(sizeof(CollSeq*)+1) - sizeof(CollSeq*);
1305   KeyInfo *p = sqlite3DbMallocRawNN(db, sizeof(KeyInfo) + nExtra);
1306   if( p ){
1307     p->aSortFlags = (u8*)&p->aColl[N+X];
1308     p->nKeyField = (u16)N;
1309     p->nAllField = (u16)(N+X);
1310     p->enc = ENC(db);
1311     p->db = db;
1312     p->nRef = 1;
1313     memset(&p[1], 0, nExtra);
1314   }else{
1315     sqlite3OomFault(db);
1316   }
1317   return p;
1318 }
1319 
1320 /*
1321 ** Deallocate a KeyInfo object
1322 */
1323 void sqlite3KeyInfoUnref(KeyInfo *p){
1324   if( p ){
1325     assert( p->nRef>0 );
1326     p->nRef--;
1327     if( p->nRef==0 ) sqlite3DbFreeNN(p->db, p);
1328   }
1329 }
1330 
1331 /*
1332 ** Make a new pointer to a KeyInfo object
1333 */
1334 KeyInfo *sqlite3KeyInfoRef(KeyInfo *p){
1335   if( p ){
1336     assert( p->nRef>0 );
1337     p->nRef++;
1338   }
1339   return p;
1340 }
1341 
1342 #ifdef SQLITE_DEBUG
1343 /*
1344 ** Return TRUE if a KeyInfo object can be change.  The KeyInfo object
1345 ** can only be changed if this is just a single reference to the object.
1346 **
1347 ** This routine is used only inside of assert() statements.
1348 */
1349 int sqlite3KeyInfoIsWriteable(KeyInfo *p){ return p->nRef==1; }
1350 #endif /* SQLITE_DEBUG */
1351 
1352 /*
1353 ** Given an expression list, generate a KeyInfo structure that records
1354 ** the collating sequence for each expression in that expression list.
1355 **
1356 ** If the ExprList is an ORDER BY or GROUP BY clause then the resulting
1357 ** KeyInfo structure is appropriate for initializing a virtual index to
1358 ** implement that clause.  If the ExprList is the result set of a SELECT
1359 ** then the KeyInfo structure is appropriate for initializing a virtual
1360 ** index to implement a DISTINCT test.
1361 **
1362 ** Space to hold the KeyInfo structure is obtained from malloc.  The calling
1363 ** function is responsible for seeing that this structure is eventually
1364 ** freed.
1365 */
1366 KeyInfo *sqlite3KeyInfoFromExprList(
1367   Parse *pParse,       /* Parsing context */
1368   ExprList *pList,     /* Form the KeyInfo object from this ExprList */
1369   int iStart,          /* Begin with this column of pList */
1370   int nExtra           /* Add this many extra columns to the end */
1371 ){
1372   int nExpr;
1373   KeyInfo *pInfo;
1374   struct ExprList_item *pItem;
1375   sqlite3 *db = pParse->db;
1376   int i;
1377 
1378   nExpr = pList->nExpr;
1379   pInfo = sqlite3KeyInfoAlloc(db, nExpr-iStart, nExtra+1);
1380   if( pInfo ){
1381     assert( sqlite3KeyInfoIsWriteable(pInfo) );
1382     for(i=iStart, pItem=pList->a+iStart; i<nExpr; i++, pItem++){
1383       pInfo->aColl[i-iStart] = sqlite3ExprNNCollSeq(pParse, pItem->pExpr);
1384       pInfo->aSortFlags[i-iStart] = pItem->sortFlags;
1385     }
1386   }
1387   return pInfo;
1388 }
1389 
1390 /*
1391 ** Name of the connection operator, used for error messages.
1392 */
1393 const char *sqlite3SelectOpName(int id){
1394   char *z;
1395   switch( id ){
1396     case TK_ALL:       z = "UNION ALL";   break;
1397     case TK_INTERSECT: z = "INTERSECT";   break;
1398     case TK_EXCEPT:    z = "EXCEPT";      break;
1399     default:           z = "UNION";       break;
1400   }
1401   return z;
1402 }
1403 
1404 #ifndef SQLITE_OMIT_EXPLAIN
1405 /*
1406 ** Unless an "EXPLAIN QUERY PLAN" command is being processed, this function
1407 ** is a no-op. Otherwise, it adds a single row of output to the EQP result,
1408 ** where the caption is of the form:
1409 **
1410 **   "USE TEMP B-TREE FOR xxx"
1411 **
1412 ** where xxx is one of "DISTINCT", "ORDER BY" or "GROUP BY". Exactly which
1413 ** is determined by the zUsage argument.
1414 */
1415 static void explainTempTable(Parse *pParse, const char *zUsage){
1416   ExplainQueryPlan((pParse, 0, "USE TEMP B-TREE FOR %s", zUsage));
1417 }
1418 
1419 /*
1420 ** Assign expression b to lvalue a. A second, no-op, version of this macro
1421 ** is provided when SQLITE_OMIT_EXPLAIN is defined. This allows the code
1422 ** in sqlite3Select() to assign values to structure member variables that
1423 ** only exist if SQLITE_OMIT_EXPLAIN is not defined without polluting the
1424 ** code with #ifndef directives.
1425 */
1426 # define explainSetInteger(a, b) a = b
1427 
1428 #else
1429 /* No-op versions of the explainXXX() functions and macros. */
1430 # define explainTempTable(y,z)
1431 # define explainSetInteger(y,z)
1432 #endif
1433 
1434 
1435 /*
1436 ** If the inner loop was generated using a non-null pOrderBy argument,
1437 ** then the results were placed in a sorter.  After the loop is terminated
1438 ** we need to run the sorter and output the results.  The following
1439 ** routine generates the code needed to do that.
1440 */
1441 static void generateSortTail(
1442   Parse *pParse,    /* Parsing context */
1443   Select *p,        /* The SELECT statement */
1444   SortCtx *pSort,   /* Information on the ORDER BY clause */
1445   int nColumn,      /* Number of columns of data */
1446   SelectDest *pDest /* Write the sorted results here */
1447 ){
1448   Vdbe *v = pParse->pVdbe;                     /* The prepared statement */
1449   int addrBreak = pSort->labelDone;            /* Jump here to exit loop */
1450   int addrContinue = sqlite3VdbeMakeLabel(pParse);/* Jump here for next cycle */
1451   int addr;                       /* Top of output loop. Jump for Next. */
1452   int addrOnce = 0;
1453   int iTab;
1454   ExprList *pOrderBy = pSort->pOrderBy;
1455   int eDest = pDest->eDest;
1456   int iParm = pDest->iSDParm;
1457   int regRow;
1458   int regRowid;
1459   int iCol;
1460   int nKey;                       /* Number of key columns in sorter record */
1461   int iSortTab;                   /* Sorter cursor to read from */
1462   int i;
1463   int bSeq;                       /* True if sorter record includes seq. no. */
1464   int nRefKey = 0;
1465   struct ExprList_item *aOutEx = p->pEList->a;
1466 
1467   assert( addrBreak<0 );
1468   if( pSort->labelBkOut ){
1469     sqlite3VdbeAddOp2(v, OP_Gosub, pSort->regReturn, pSort->labelBkOut);
1470     sqlite3VdbeGoto(v, addrBreak);
1471     sqlite3VdbeResolveLabel(v, pSort->labelBkOut);
1472   }
1473 
1474 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1475   /* Open any cursors needed for sorter-reference expressions */
1476   for(i=0; i<pSort->nDefer; i++){
1477     Table *pTab = pSort->aDefer[i].pTab;
1478     int iDb = sqlite3SchemaToIndex(pParse->db, pTab->pSchema);
1479     sqlite3OpenTable(pParse, pSort->aDefer[i].iCsr, iDb, pTab, OP_OpenRead);
1480     nRefKey = MAX(nRefKey, pSort->aDefer[i].nKey);
1481   }
1482 #endif
1483 
1484   iTab = pSort->iECursor;
1485   if( eDest==SRT_Output || eDest==SRT_Coroutine || eDest==SRT_Mem ){
1486     regRowid = 0;
1487     regRow = pDest->iSdst;
1488   }else{
1489     regRowid = sqlite3GetTempReg(pParse);
1490     if( eDest==SRT_EphemTab || eDest==SRT_Table ){
1491       regRow = sqlite3GetTempReg(pParse);
1492       nColumn = 0;
1493     }else{
1494       regRow = sqlite3GetTempRange(pParse, nColumn);
1495     }
1496   }
1497   nKey = pOrderBy->nExpr - pSort->nOBSat;
1498   if( pSort->sortFlags & SORTFLAG_UseSorter ){
1499     int regSortOut = ++pParse->nMem;
1500     iSortTab = pParse->nTab++;
1501     if( pSort->labelBkOut ){
1502       addrOnce = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
1503     }
1504     sqlite3VdbeAddOp3(v, OP_OpenPseudo, iSortTab, regSortOut,
1505         nKey+1+nColumn+nRefKey);
1506     if( addrOnce ) sqlite3VdbeJumpHere(v, addrOnce);
1507     addr = 1 + sqlite3VdbeAddOp2(v, OP_SorterSort, iTab, addrBreak);
1508     VdbeCoverage(v);
1509     codeOffset(v, p->iOffset, addrContinue);
1510     sqlite3VdbeAddOp3(v, OP_SorterData, iTab, regSortOut, iSortTab);
1511     bSeq = 0;
1512   }else{
1513     addr = 1 + sqlite3VdbeAddOp2(v, OP_Sort, iTab, addrBreak); VdbeCoverage(v);
1514     codeOffset(v, p->iOffset, addrContinue);
1515     iSortTab = iTab;
1516     bSeq = 1;
1517   }
1518   for(i=0, iCol=nKey+bSeq-1; i<nColumn; i++){
1519 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1520     if( aOutEx[i].bSorterRef ) continue;
1521 #endif
1522     if( aOutEx[i].u.x.iOrderByCol==0 ) iCol++;
1523   }
1524 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1525   if( pSort->nDefer ){
1526     int iKey = iCol+1;
1527     int regKey = sqlite3GetTempRange(pParse, nRefKey);
1528 
1529     for(i=0; i<pSort->nDefer; i++){
1530       int iCsr = pSort->aDefer[i].iCsr;
1531       Table *pTab = pSort->aDefer[i].pTab;
1532       int nKey = pSort->aDefer[i].nKey;
1533 
1534       sqlite3VdbeAddOp1(v, OP_NullRow, iCsr);
1535       if( HasRowid(pTab) ){
1536         sqlite3VdbeAddOp3(v, OP_Column, iSortTab, iKey++, regKey);
1537         sqlite3VdbeAddOp3(v, OP_SeekRowid, iCsr,
1538             sqlite3VdbeCurrentAddr(v)+1, regKey);
1539       }else{
1540         int k;
1541         int iJmp;
1542         assert( sqlite3PrimaryKeyIndex(pTab)->nKeyCol==nKey );
1543         for(k=0; k<nKey; k++){
1544           sqlite3VdbeAddOp3(v, OP_Column, iSortTab, iKey++, regKey+k);
1545         }
1546         iJmp = sqlite3VdbeCurrentAddr(v);
1547         sqlite3VdbeAddOp4Int(v, OP_SeekGE, iCsr, iJmp+2, regKey, nKey);
1548         sqlite3VdbeAddOp4Int(v, OP_IdxLE, iCsr, iJmp+3, regKey, nKey);
1549         sqlite3VdbeAddOp1(v, OP_NullRow, iCsr);
1550       }
1551     }
1552     sqlite3ReleaseTempRange(pParse, regKey, nRefKey);
1553   }
1554 #endif
1555   for(i=nColumn-1; i>=0; i--){
1556 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1557     if( aOutEx[i].bSorterRef ){
1558       sqlite3ExprCode(pParse, aOutEx[i].pExpr, regRow+i);
1559     }else
1560 #endif
1561     {
1562       int iRead;
1563       if( aOutEx[i].u.x.iOrderByCol ){
1564         iRead = aOutEx[i].u.x.iOrderByCol-1;
1565       }else{
1566         iRead = iCol--;
1567       }
1568       sqlite3VdbeAddOp3(v, OP_Column, iSortTab, iRead, regRow+i);
1569       VdbeComment((v, "%s", aOutEx[i].zEName));
1570     }
1571   }
1572   switch( eDest ){
1573     case SRT_Table:
1574     case SRT_EphemTab: {
1575       sqlite3VdbeAddOp3(v, OP_Column, iSortTab, nKey+bSeq, regRow);
1576       sqlite3VdbeAddOp2(v, OP_NewRowid, iParm, regRowid);
1577       sqlite3VdbeAddOp3(v, OP_Insert, iParm, regRow, regRowid);
1578       sqlite3VdbeChangeP5(v, OPFLAG_APPEND);
1579       break;
1580     }
1581 #ifndef SQLITE_OMIT_SUBQUERY
1582     case SRT_Set: {
1583       assert( nColumn==sqlite3Strlen30(pDest->zAffSdst) );
1584       sqlite3VdbeAddOp4(v, OP_MakeRecord, regRow, nColumn, regRowid,
1585                         pDest->zAffSdst, nColumn);
1586       sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, regRowid, regRow, nColumn);
1587       break;
1588     }
1589     case SRT_Mem: {
1590       /* The LIMIT clause will terminate the loop for us */
1591       break;
1592     }
1593 #endif
1594     case SRT_Upfrom: {
1595       int i2 = pDest->iSDParm2;
1596       int r1 = sqlite3GetTempReg(pParse);
1597       sqlite3VdbeAddOp3(v, OP_MakeRecord,regRow+(i2<0),nColumn-(i2<0),r1);
1598       if( i2<0 ){
1599         sqlite3VdbeAddOp3(v, OP_Insert, iParm, r1, regRow);
1600       }else{
1601         sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, r1, regRow, i2);
1602       }
1603       break;
1604     }
1605     default: {
1606       assert( eDest==SRT_Output || eDest==SRT_Coroutine );
1607       testcase( eDest==SRT_Output );
1608       testcase( eDest==SRT_Coroutine );
1609       if( eDest==SRT_Output ){
1610         sqlite3VdbeAddOp2(v, OP_ResultRow, pDest->iSdst, nColumn);
1611       }else{
1612         sqlite3VdbeAddOp1(v, OP_Yield, pDest->iSDParm);
1613       }
1614       break;
1615     }
1616   }
1617   if( regRowid ){
1618     if( eDest==SRT_Set ){
1619       sqlite3ReleaseTempRange(pParse, regRow, nColumn);
1620     }else{
1621       sqlite3ReleaseTempReg(pParse, regRow);
1622     }
1623     sqlite3ReleaseTempReg(pParse, regRowid);
1624   }
1625   /* The bottom of the loop
1626   */
1627   sqlite3VdbeResolveLabel(v, addrContinue);
1628   if( pSort->sortFlags & SORTFLAG_UseSorter ){
1629     sqlite3VdbeAddOp2(v, OP_SorterNext, iTab, addr); VdbeCoverage(v);
1630   }else{
1631     sqlite3VdbeAddOp2(v, OP_Next, iTab, addr); VdbeCoverage(v);
1632   }
1633   if( pSort->regReturn ) sqlite3VdbeAddOp1(v, OP_Return, pSort->regReturn);
1634   sqlite3VdbeResolveLabel(v, addrBreak);
1635 }
1636 
1637 /*
1638 ** Return a pointer to a string containing the 'declaration type' of the
1639 ** expression pExpr. The string may be treated as static by the caller.
1640 **
1641 ** Also try to estimate the size of the returned value and return that
1642 ** result in *pEstWidth.
1643 **
1644 ** The declaration type is the exact datatype definition extracted from the
1645 ** original CREATE TABLE statement if the expression is a column. The
1646 ** declaration type for a ROWID field is INTEGER. Exactly when an expression
1647 ** is considered a column can be complex in the presence of subqueries. The
1648 ** result-set expression in all of the following SELECT statements is
1649 ** considered a column by this function.
1650 **
1651 **   SELECT col FROM tbl;
1652 **   SELECT (SELECT col FROM tbl;
1653 **   SELECT (SELECT col FROM tbl);
1654 **   SELECT abc FROM (SELECT col AS abc FROM tbl);
1655 **
1656 ** The declaration type for any expression other than a column is NULL.
1657 **
1658 ** This routine has either 3 or 6 parameters depending on whether or not
1659 ** the SQLITE_ENABLE_COLUMN_METADATA compile-time option is used.
1660 */
1661 #ifdef SQLITE_ENABLE_COLUMN_METADATA
1662 # define columnType(A,B,C,D,E) columnTypeImpl(A,B,C,D,E)
1663 #else /* if !defined(SQLITE_ENABLE_COLUMN_METADATA) */
1664 # define columnType(A,B,C,D,E) columnTypeImpl(A,B)
1665 #endif
1666 static const char *columnTypeImpl(
1667   NameContext *pNC,
1668 #ifndef SQLITE_ENABLE_COLUMN_METADATA
1669   Expr *pExpr
1670 #else
1671   Expr *pExpr,
1672   const char **pzOrigDb,
1673   const char **pzOrigTab,
1674   const char **pzOrigCol
1675 #endif
1676 ){
1677   char const *zType = 0;
1678   int j;
1679 #ifdef SQLITE_ENABLE_COLUMN_METADATA
1680   char const *zOrigDb = 0;
1681   char const *zOrigTab = 0;
1682   char const *zOrigCol = 0;
1683 #endif
1684 
1685   assert( pExpr!=0 );
1686   assert( pNC->pSrcList!=0 );
1687   switch( pExpr->op ){
1688     case TK_COLUMN: {
1689       /* The expression is a column. Locate the table the column is being
1690       ** extracted from in NameContext.pSrcList. This table may be real
1691       ** database table or a subquery.
1692       */
1693       Table *pTab = 0;            /* Table structure column is extracted from */
1694       Select *pS = 0;             /* Select the column is extracted from */
1695       int iCol = pExpr->iColumn;  /* Index of column in pTab */
1696       while( pNC && !pTab ){
1697         SrcList *pTabList = pNC->pSrcList;
1698         for(j=0;j<pTabList->nSrc && pTabList->a[j].iCursor!=pExpr->iTable;j++);
1699         if( j<pTabList->nSrc ){
1700           pTab = pTabList->a[j].pTab;
1701           pS = pTabList->a[j].pSelect;
1702         }else{
1703           pNC = pNC->pNext;
1704         }
1705       }
1706 
1707       if( pTab==0 ){
1708         /* At one time, code such as "SELECT new.x" within a trigger would
1709         ** cause this condition to run.  Since then, we have restructured how
1710         ** trigger code is generated and so this condition is no longer
1711         ** possible. However, it can still be true for statements like
1712         ** the following:
1713         **
1714         **   CREATE TABLE t1(col INTEGER);
1715         **   SELECT (SELECT t1.col) FROM FROM t1;
1716         **
1717         ** when columnType() is called on the expression "t1.col" in the
1718         ** sub-select. In this case, set the column type to NULL, even
1719         ** though it should really be "INTEGER".
1720         **
1721         ** This is not a problem, as the column type of "t1.col" is never
1722         ** used. When columnType() is called on the expression
1723         ** "(SELECT t1.col)", the correct type is returned (see the TK_SELECT
1724         ** branch below.  */
1725         break;
1726       }
1727 
1728       assert( pTab && pExpr->y.pTab==pTab );
1729       if( pS ){
1730         /* The "table" is actually a sub-select or a view in the FROM clause
1731         ** of the SELECT statement. Return the declaration type and origin
1732         ** data for the result-set column of the sub-select.
1733         */
1734         if( iCol>=0 && iCol<pS->pEList->nExpr ){
1735           /* If iCol is less than zero, then the expression requests the
1736           ** rowid of the sub-select or view. This expression is legal (see
1737           ** test case misc2.2.2) - it always evaluates to NULL.
1738           */
1739           NameContext sNC;
1740           Expr *p = pS->pEList->a[iCol].pExpr;
1741           sNC.pSrcList = pS->pSrc;
1742           sNC.pNext = pNC;
1743           sNC.pParse = pNC->pParse;
1744           zType = columnType(&sNC, p,&zOrigDb,&zOrigTab,&zOrigCol);
1745         }
1746       }else{
1747         /* A real table or a CTE table */
1748         assert( !pS );
1749 #ifdef SQLITE_ENABLE_COLUMN_METADATA
1750         if( iCol<0 ) iCol = pTab->iPKey;
1751         assert( iCol==XN_ROWID || (iCol>=0 && iCol<pTab->nCol) );
1752         if( iCol<0 ){
1753           zType = "INTEGER";
1754           zOrigCol = "rowid";
1755         }else{
1756           zOrigCol = pTab->aCol[iCol].zName;
1757           zType = sqlite3ColumnType(&pTab->aCol[iCol],0);
1758         }
1759         zOrigTab = pTab->zName;
1760         if( pNC->pParse && pTab->pSchema ){
1761           int iDb = sqlite3SchemaToIndex(pNC->pParse->db, pTab->pSchema);
1762           zOrigDb = pNC->pParse->db->aDb[iDb].zDbSName;
1763         }
1764 #else
1765         assert( iCol==XN_ROWID || (iCol>=0 && iCol<pTab->nCol) );
1766         if( iCol<0 ){
1767           zType = "INTEGER";
1768         }else{
1769           zType = sqlite3ColumnType(&pTab->aCol[iCol],0);
1770         }
1771 #endif
1772       }
1773       break;
1774     }
1775 #ifndef SQLITE_OMIT_SUBQUERY
1776     case TK_SELECT: {
1777       /* The expression is a sub-select. Return the declaration type and
1778       ** origin info for the single column in the result set of the SELECT
1779       ** statement.
1780       */
1781       NameContext sNC;
1782       Select *pS = pExpr->x.pSelect;
1783       Expr *p = pS->pEList->a[0].pExpr;
1784       assert( ExprHasProperty(pExpr, EP_xIsSelect) );
1785       sNC.pSrcList = pS->pSrc;
1786       sNC.pNext = pNC;
1787       sNC.pParse = pNC->pParse;
1788       zType = columnType(&sNC, p, &zOrigDb, &zOrigTab, &zOrigCol);
1789       break;
1790     }
1791 #endif
1792   }
1793 
1794 #ifdef SQLITE_ENABLE_COLUMN_METADATA
1795   if( pzOrigDb ){
1796     assert( pzOrigTab && pzOrigCol );
1797     *pzOrigDb = zOrigDb;
1798     *pzOrigTab = zOrigTab;
1799     *pzOrigCol = zOrigCol;
1800   }
1801 #endif
1802   return zType;
1803 }
1804 
1805 /*
1806 ** Generate code that will tell the VDBE the declaration types of columns
1807 ** in the result set.
1808 */
1809 static void generateColumnTypes(
1810   Parse *pParse,      /* Parser context */
1811   SrcList *pTabList,  /* List of tables */
1812   ExprList *pEList    /* Expressions defining the result set */
1813 ){
1814 #ifndef SQLITE_OMIT_DECLTYPE
1815   Vdbe *v = pParse->pVdbe;
1816   int i;
1817   NameContext sNC;
1818   sNC.pSrcList = pTabList;
1819   sNC.pParse = pParse;
1820   sNC.pNext = 0;
1821   for(i=0; i<pEList->nExpr; i++){
1822     Expr *p = pEList->a[i].pExpr;
1823     const char *zType;
1824 #ifdef SQLITE_ENABLE_COLUMN_METADATA
1825     const char *zOrigDb = 0;
1826     const char *zOrigTab = 0;
1827     const char *zOrigCol = 0;
1828     zType = columnType(&sNC, p, &zOrigDb, &zOrigTab, &zOrigCol);
1829 
1830     /* The vdbe must make its own copy of the column-type and other
1831     ** column specific strings, in case the schema is reset before this
1832     ** virtual machine is deleted.
1833     */
1834     sqlite3VdbeSetColName(v, i, COLNAME_DATABASE, zOrigDb, SQLITE_TRANSIENT);
1835     sqlite3VdbeSetColName(v, i, COLNAME_TABLE, zOrigTab, SQLITE_TRANSIENT);
1836     sqlite3VdbeSetColName(v, i, COLNAME_COLUMN, zOrigCol, SQLITE_TRANSIENT);
1837 #else
1838     zType = columnType(&sNC, p, 0, 0, 0);
1839 #endif
1840     sqlite3VdbeSetColName(v, i, COLNAME_DECLTYPE, zType, SQLITE_TRANSIENT);
1841   }
1842 #endif /* !defined(SQLITE_OMIT_DECLTYPE) */
1843 }
1844 
1845 
1846 /*
1847 ** Compute the column names for a SELECT statement.
1848 **
1849 ** The only guarantee that SQLite makes about column names is that if the
1850 ** column has an AS clause assigning it a name, that will be the name used.
1851 ** That is the only documented guarantee.  However, countless applications
1852 ** developed over the years have made baseless assumptions about column names
1853 ** and will break if those assumptions changes.  Hence, use extreme caution
1854 ** when modifying this routine to avoid breaking legacy.
1855 **
1856 ** See Also: sqlite3ColumnsFromExprList()
1857 **
1858 ** The PRAGMA short_column_names and PRAGMA full_column_names settings are
1859 ** deprecated.  The default setting is short=ON, full=OFF.  99.9% of all
1860 ** applications should operate this way.  Nevertheless, we need to support the
1861 ** other modes for legacy:
1862 **
1863 **    short=OFF, full=OFF:      Column name is the text of the expression has it
1864 **                              originally appears in the SELECT statement.  In
1865 **                              other words, the zSpan of the result expression.
1866 **
1867 **    short=ON, full=OFF:       (This is the default setting).  If the result
1868 **                              refers directly to a table column, then the
1869 **                              result column name is just the table column
1870 **                              name: COLUMN.  Otherwise use zSpan.
1871 **
1872 **    full=ON, short=ANY:       If the result refers directly to a table column,
1873 **                              then the result column name with the table name
1874 **                              prefix, ex: TABLE.COLUMN.  Otherwise use zSpan.
1875 */
1876 static void generateColumnNames(
1877   Parse *pParse,      /* Parser context */
1878   Select *pSelect     /* Generate column names for this SELECT statement */
1879 ){
1880   Vdbe *v = pParse->pVdbe;
1881   int i;
1882   Table *pTab;
1883   SrcList *pTabList;
1884   ExprList *pEList;
1885   sqlite3 *db = pParse->db;
1886   int fullName;    /* TABLE.COLUMN if no AS clause and is a direct table ref */
1887   int srcName;     /* COLUMN or TABLE.COLUMN if no AS clause and is direct */
1888 
1889 #ifndef SQLITE_OMIT_EXPLAIN
1890   /* If this is an EXPLAIN, skip this step */
1891   if( pParse->explain ){
1892     return;
1893   }
1894 #endif
1895 
1896   if( pParse->colNamesSet ) return;
1897   /* Column names are determined by the left-most term of a compound select */
1898   while( pSelect->pPrior ) pSelect = pSelect->pPrior;
1899   SELECTTRACE(1,pParse,pSelect,("generating column names\n"));
1900   pTabList = pSelect->pSrc;
1901   pEList = pSelect->pEList;
1902   assert( v!=0 );
1903   assert( pTabList!=0 );
1904   pParse->colNamesSet = 1;
1905   fullName = (db->flags & SQLITE_FullColNames)!=0;
1906   srcName = (db->flags & SQLITE_ShortColNames)!=0 || fullName;
1907   sqlite3VdbeSetNumCols(v, pEList->nExpr);
1908   for(i=0; i<pEList->nExpr; i++){
1909     Expr *p = pEList->a[i].pExpr;
1910 
1911     assert( p!=0 );
1912     assert( p->op!=TK_AGG_COLUMN );  /* Agg processing has not run yet */
1913     assert( p->op!=TK_COLUMN || p->y.pTab!=0 ); /* Covering idx not yet coded */
1914     if( pEList->a[i].zEName && pEList->a[i].eEName==ENAME_NAME ){
1915       /* An AS clause always takes first priority */
1916       char *zName = pEList->a[i].zEName;
1917       sqlite3VdbeSetColName(v, i, COLNAME_NAME, zName, SQLITE_TRANSIENT);
1918     }else if( srcName && p->op==TK_COLUMN ){
1919       char *zCol;
1920       int iCol = p->iColumn;
1921       pTab = p->y.pTab;
1922       assert( pTab!=0 );
1923       if( iCol<0 ) iCol = pTab->iPKey;
1924       assert( iCol==-1 || (iCol>=0 && iCol<pTab->nCol) );
1925       if( iCol<0 ){
1926         zCol = "rowid";
1927       }else{
1928         zCol = pTab->aCol[iCol].zName;
1929       }
1930       if( fullName ){
1931         char *zName = 0;
1932         zName = sqlite3MPrintf(db, "%s.%s", pTab->zName, zCol);
1933         sqlite3VdbeSetColName(v, i, COLNAME_NAME, zName, SQLITE_DYNAMIC);
1934       }else{
1935         sqlite3VdbeSetColName(v, i, COLNAME_NAME, zCol, SQLITE_TRANSIENT);
1936       }
1937     }else{
1938       const char *z = pEList->a[i].zEName;
1939       z = z==0 ? sqlite3MPrintf(db, "column%d", i+1) : sqlite3DbStrDup(db, z);
1940       sqlite3VdbeSetColName(v, i, COLNAME_NAME, z, SQLITE_DYNAMIC);
1941     }
1942   }
1943   generateColumnTypes(pParse, pTabList, pEList);
1944 }
1945 
1946 /*
1947 ** Given an expression list (which is really the list of expressions
1948 ** that form the result set of a SELECT statement) compute appropriate
1949 ** column names for a table that would hold the expression list.
1950 **
1951 ** All column names will be unique.
1952 **
1953 ** Only the column names are computed.  Column.zType, Column.zColl,
1954 ** and other fields of Column are zeroed.
1955 **
1956 ** Return SQLITE_OK on success.  If a memory allocation error occurs,
1957 ** store NULL in *paCol and 0 in *pnCol and return SQLITE_NOMEM.
1958 **
1959 ** The only guarantee that SQLite makes about column names is that if the
1960 ** column has an AS clause assigning it a name, that will be the name used.
1961 ** That is the only documented guarantee.  However, countless applications
1962 ** developed over the years have made baseless assumptions about column names
1963 ** and will break if those assumptions changes.  Hence, use extreme caution
1964 ** when modifying this routine to avoid breaking legacy.
1965 **
1966 ** See Also: generateColumnNames()
1967 */
1968 int sqlite3ColumnsFromExprList(
1969   Parse *pParse,          /* Parsing context */
1970   ExprList *pEList,       /* Expr list from which to derive column names */
1971   i16 *pnCol,             /* Write the number of columns here */
1972   Column **paCol          /* Write the new column list here */
1973 ){
1974   sqlite3 *db = pParse->db;   /* Database connection */
1975   int i, j;                   /* Loop counters */
1976   u32 cnt;                    /* Index added to make the name unique */
1977   Column *aCol, *pCol;        /* For looping over result columns */
1978   int nCol;                   /* Number of columns in the result set */
1979   char *zName;                /* Column name */
1980   int nName;                  /* Size of name in zName[] */
1981   Hash ht;                    /* Hash table of column names */
1982   Table *pTab;
1983 
1984   sqlite3HashInit(&ht);
1985   if( pEList ){
1986     nCol = pEList->nExpr;
1987     aCol = sqlite3DbMallocZero(db, sizeof(aCol[0])*nCol);
1988     testcase( aCol==0 );
1989     if( NEVER(nCol>32767) ) nCol = 32767;
1990   }else{
1991     nCol = 0;
1992     aCol = 0;
1993   }
1994   assert( nCol==(i16)nCol );
1995   *pnCol = nCol;
1996   *paCol = aCol;
1997 
1998   for(i=0, pCol=aCol; i<nCol && !db->mallocFailed; i++, pCol++){
1999     /* Get an appropriate name for the column
2000     */
2001     if( (zName = pEList->a[i].zEName)!=0 && pEList->a[i].eEName==ENAME_NAME ){
2002       /* If the column contains an "AS <name>" phrase, use <name> as the name */
2003     }else{
2004       Expr *pColExpr = sqlite3ExprSkipCollateAndLikely(pEList->a[i].pExpr);
2005       while( ALWAYS(pColExpr!=0) && pColExpr->op==TK_DOT ){
2006         pColExpr = pColExpr->pRight;
2007         assert( pColExpr!=0 );
2008       }
2009       if( pColExpr->op==TK_COLUMN && (pTab = pColExpr->y.pTab)!=0 ){
2010         /* For columns use the column name name */
2011         int iCol = pColExpr->iColumn;
2012         if( iCol<0 ) iCol = pTab->iPKey;
2013         zName = iCol>=0 ? pTab->aCol[iCol].zName : "rowid";
2014       }else if( pColExpr->op==TK_ID ){
2015         assert( !ExprHasProperty(pColExpr, EP_IntValue) );
2016         zName = pColExpr->u.zToken;
2017       }else{
2018         /* Use the original text of the column expression as its name */
2019         zName = pEList->a[i].zEName;
2020       }
2021     }
2022     if( zName && !sqlite3IsTrueOrFalse(zName) ){
2023       zName = sqlite3DbStrDup(db, zName);
2024     }else{
2025       zName = sqlite3MPrintf(db,"column%d",i+1);
2026     }
2027 
2028     /* Make sure the column name is unique.  If the name is not unique,
2029     ** append an integer to the name so that it becomes unique.
2030     */
2031     cnt = 0;
2032     while( zName && sqlite3HashFind(&ht, zName)!=0 ){
2033       nName = sqlite3Strlen30(zName);
2034       if( nName>0 ){
2035         for(j=nName-1; j>0 && sqlite3Isdigit(zName[j]); j--){}
2036         if( zName[j]==':' ) nName = j;
2037       }
2038       zName = sqlite3MPrintf(db, "%.*z:%u", nName, zName, ++cnt);
2039       if( cnt>3 ) sqlite3_randomness(sizeof(cnt), &cnt);
2040     }
2041     pCol->zName = zName;
2042     pCol->hName = sqlite3StrIHash(zName);
2043     sqlite3ColumnPropertiesFromName(0, pCol);
2044     if( zName && sqlite3HashInsert(&ht, zName, pCol)==pCol ){
2045       sqlite3OomFault(db);
2046     }
2047   }
2048   sqlite3HashClear(&ht);
2049   if( db->mallocFailed ){
2050     for(j=0; j<i; j++){
2051       sqlite3DbFree(db, aCol[j].zName);
2052     }
2053     sqlite3DbFree(db, aCol);
2054     *paCol = 0;
2055     *pnCol = 0;
2056     return SQLITE_NOMEM_BKPT;
2057   }
2058   return SQLITE_OK;
2059 }
2060 
2061 /*
2062 ** Add type and collation information to a column list based on
2063 ** a SELECT statement.
2064 **
2065 ** The column list presumably came from selectColumnNamesFromExprList().
2066 ** The column list has only names, not types or collations.  This
2067 ** routine goes through and adds the types and collations.
2068 **
2069 ** This routine requires that all identifiers in the SELECT
2070 ** statement be resolved.
2071 */
2072 void sqlite3SelectAddColumnTypeAndCollation(
2073   Parse *pParse,        /* Parsing contexts */
2074   Table *pTab,          /* Add column type information to this table */
2075   Select *pSelect,      /* SELECT used to determine types and collations */
2076   char aff              /* Default affinity for columns */
2077 ){
2078   sqlite3 *db = pParse->db;
2079   NameContext sNC;
2080   Column *pCol;
2081   CollSeq *pColl;
2082   int i;
2083   Expr *p;
2084   struct ExprList_item *a;
2085 
2086   assert( pSelect!=0 );
2087   assert( (pSelect->selFlags & SF_Resolved)!=0 );
2088   assert( pTab->nCol==pSelect->pEList->nExpr || db->mallocFailed );
2089   if( db->mallocFailed ) return;
2090   memset(&sNC, 0, sizeof(sNC));
2091   sNC.pSrcList = pSelect->pSrc;
2092   a = pSelect->pEList->a;
2093   for(i=0, pCol=pTab->aCol; i<pTab->nCol; i++, pCol++){
2094     const char *zType;
2095     int n, m;
2096     pTab->tabFlags |= (pCol->colFlags & COLFLAG_NOINSERT);
2097     p = a[i].pExpr;
2098     zType = columnType(&sNC, p, 0, 0, 0);
2099     /* pCol->szEst = ... // Column size est for SELECT tables never used */
2100     pCol->affinity = sqlite3ExprAffinity(p);
2101     if( zType ){
2102       m = sqlite3Strlen30(zType);
2103       n = sqlite3Strlen30(pCol->zName);
2104       pCol->zName = sqlite3DbReallocOrFree(db, pCol->zName, n+m+2);
2105       if( pCol->zName ){
2106         memcpy(&pCol->zName[n+1], zType, m+1);
2107         pCol->colFlags |= COLFLAG_HASTYPE;
2108       }
2109     }
2110     if( pCol->affinity<=SQLITE_AFF_NONE ) pCol->affinity = aff;
2111     pColl = sqlite3ExprCollSeq(pParse, p);
2112     if( pColl && pCol->zColl==0 ){
2113       pCol->zColl = sqlite3DbStrDup(db, pColl->zName);
2114     }
2115   }
2116   pTab->szTabRow = 1; /* Any non-zero value works */
2117 }
2118 
2119 /*
2120 ** Given a SELECT statement, generate a Table structure that describes
2121 ** the result set of that SELECT.
2122 */
2123 Table *sqlite3ResultSetOfSelect(Parse *pParse, Select *pSelect, char aff){
2124   Table *pTab;
2125   sqlite3 *db = pParse->db;
2126   u64 savedFlags;
2127 
2128   savedFlags = db->flags;
2129   db->flags &= ~(u64)SQLITE_FullColNames;
2130   db->flags |= SQLITE_ShortColNames;
2131   sqlite3SelectPrep(pParse, pSelect, 0);
2132   db->flags = savedFlags;
2133   if( pParse->nErr ) return 0;
2134   while( pSelect->pPrior ) pSelect = pSelect->pPrior;
2135   pTab = sqlite3DbMallocZero(db, sizeof(Table) );
2136   if( pTab==0 ){
2137     return 0;
2138   }
2139   pTab->nTabRef = 1;
2140   pTab->zName = 0;
2141   pTab->nRowLogEst = 200; assert( 200==sqlite3LogEst(1048576) );
2142   sqlite3ColumnsFromExprList(pParse, pSelect->pEList, &pTab->nCol, &pTab->aCol);
2143   sqlite3SelectAddColumnTypeAndCollation(pParse, pTab, pSelect, aff);
2144   pTab->iPKey = -1;
2145   if( db->mallocFailed ){
2146     sqlite3DeleteTable(db, pTab);
2147     return 0;
2148   }
2149   return pTab;
2150 }
2151 
2152 /*
2153 ** Get a VDBE for the given parser context.  Create a new one if necessary.
2154 ** If an error occurs, return NULL and leave a message in pParse.
2155 */
2156 Vdbe *sqlite3GetVdbe(Parse *pParse){
2157   if( pParse->pVdbe ){
2158     return pParse->pVdbe;
2159   }
2160   if( pParse->pToplevel==0
2161    && OptimizationEnabled(pParse->db,SQLITE_FactorOutConst)
2162   ){
2163     pParse->okConstFactor = 1;
2164   }
2165   return sqlite3VdbeCreate(pParse);
2166 }
2167 
2168 
2169 /*
2170 ** Compute the iLimit and iOffset fields of the SELECT based on the
2171 ** pLimit expressions.  pLimit->pLeft and pLimit->pRight hold the expressions
2172 ** that appear in the original SQL statement after the LIMIT and OFFSET
2173 ** keywords.  Or NULL if those keywords are omitted. iLimit and iOffset
2174 ** are the integer memory register numbers for counters used to compute
2175 ** the limit and offset.  If there is no limit and/or offset, then
2176 ** iLimit and iOffset are negative.
2177 **
2178 ** This routine changes the values of iLimit and iOffset only if
2179 ** a limit or offset is defined by pLimit->pLeft and pLimit->pRight.  iLimit
2180 ** and iOffset should have been preset to appropriate default values (zero)
2181 ** prior to calling this routine.
2182 **
2183 ** The iOffset register (if it exists) is initialized to the value
2184 ** of the OFFSET.  The iLimit register is initialized to LIMIT.  Register
2185 ** iOffset+1 is initialized to LIMIT+OFFSET.
2186 **
2187 ** Only if pLimit->pLeft!=0 do the limit registers get
2188 ** redefined.  The UNION ALL operator uses this property to force
2189 ** the reuse of the same limit and offset registers across multiple
2190 ** SELECT statements.
2191 */
2192 static void computeLimitRegisters(Parse *pParse, Select *p, int iBreak){
2193   Vdbe *v = 0;
2194   int iLimit = 0;
2195   int iOffset;
2196   int n;
2197   Expr *pLimit = p->pLimit;
2198 
2199   if( p->iLimit ) return;
2200 
2201   /*
2202   ** "LIMIT -1" always shows all rows.  There is some
2203   ** controversy about what the correct behavior should be.
2204   ** The current implementation interprets "LIMIT 0" to mean
2205   ** no rows.
2206   */
2207   if( pLimit ){
2208     assert( pLimit->op==TK_LIMIT );
2209     assert( pLimit->pLeft!=0 );
2210     p->iLimit = iLimit = ++pParse->nMem;
2211     v = sqlite3GetVdbe(pParse);
2212     assert( v!=0 );
2213     if( sqlite3ExprIsInteger(pLimit->pLeft, &n) ){
2214       sqlite3VdbeAddOp2(v, OP_Integer, n, iLimit);
2215       VdbeComment((v, "LIMIT counter"));
2216       if( n==0 ){
2217         sqlite3VdbeGoto(v, iBreak);
2218       }else if( n>=0 && p->nSelectRow>sqlite3LogEst((u64)n) ){
2219         p->nSelectRow = sqlite3LogEst((u64)n);
2220         p->selFlags |= SF_FixedLimit;
2221       }
2222     }else{
2223       sqlite3ExprCode(pParse, pLimit->pLeft, iLimit);
2224       sqlite3VdbeAddOp1(v, OP_MustBeInt, iLimit); VdbeCoverage(v);
2225       VdbeComment((v, "LIMIT counter"));
2226       sqlite3VdbeAddOp2(v, OP_IfNot, iLimit, iBreak); VdbeCoverage(v);
2227     }
2228     if( pLimit->pRight ){
2229       p->iOffset = iOffset = ++pParse->nMem;
2230       pParse->nMem++;   /* Allocate an extra register for limit+offset */
2231       sqlite3ExprCode(pParse, pLimit->pRight, iOffset);
2232       sqlite3VdbeAddOp1(v, OP_MustBeInt, iOffset); VdbeCoverage(v);
2233       VdbeComment((v, "OFFSET counter"));
2234       sqlite3VdbeAddOp3(v, OP_OffsetLimit, iLimit, iOffset+1, iOffset);
2235       VdbeComment((v, "LIMIT+OFFSET"));
2236     }
2237   }
2238 }
2239 
2240 #ifndef SQLITE_OMIT_COMPOUND_SELECT
2241 /*
2242 ** Return the appropriate collating sequence for the iCol-th column of
2243 ** the result set for the compound-select statement "p".  Return NULL if
2244 ** the column has no default collating sequence.
2245 **
2246 ** The collating sequence for the compound select is taken from the
2247 ** left-most term of the select that has a collating sequence.
2248 */
2249 static CollSeq *multiSelectCollSeq(Parse *pParse, Select *p, int iCol){
2250   CollSeq *pRet;
2251   if( p->pPrior ){
2252     pRet = multiSelectCollSeq(pParse, p->pPrior, iCol);
2253   }else{
2254     pRet = 0;
2255   }
2256   assert( iCol>=0 );
2257   /* iCol must be less than p->pEList->nExpr.  Otherwise an error would
2258   ** have been thrown during name resolution and we would not have gotten
2259   ** this far */
2260   if( pRet==0 && ALWAYS(iCol<p->pEList->nExpr) ){
2261     pRet = sqlite3ExprCollSeq(pParse, p->pEList->a[iCol].pExpr);
2262   }
2263   return pRet;
2264 }
2265 
2266 /*
2267 ** The select statement passed as the second parameter is a compound SELECT
2268 ** with an ORDER BY clause. This function allocates and returns a KeyInfo
2269 ** structure suitable for implementing the ORDER BY.
2270 **
2271 ** Space to hold the KeyInfo structure is obtained from malloc. The calling
2272 ** function is responsible for ensuring that this structure is eventually
2273 ** freed.
2274 */
2275 static KeyInfo *multiSelectOrderByKeyInfo(Parse *pParse, Select *p, int nExtra){
2276   ExprList *pOrderBy = p->pOrderBy;
2277   int nOrderBy = p->pOrderBy->nExpr;
2278   sqlite3 *db = pParse->db;
2279   KeyInfo *pRet = sqlite3KeyInfoAlloc(db, nOrderBy+nExtra, 1);
2280   if( pRet ){
2281     int i;
2282     for(i=0; i<nOrderBy; i++){
2283       struct ExprList_item *pItem = &pOrderBy->a[i];
2284       Expr *pTerm = pItem->pExpr;
2285       CollSeq *pColl;
2286 
2287       if( pTerm->flags & EP_Collate ){
2288         pColl = sqlite3ExprCollSeq(pParse, pTerm);
2289       }else{
2290         pColl = multiSelectCollSeq(pParse, p, pItem->u.x.iOrderByCol-1);
2291         if( pColl==0 ) pColl = db->pDfltColl;
2292         pOrderBy->a[i].pExpr =
2293           sqlite3ExprAddCollateString(pParse, pTerm, pColl->zName);
2294       }
2295       assert( sqlite3KeyInfoIsWriteable(pRet) );
2296       pRet->aColl[i] = pColl;
2297       pRet->aSortFlags[i] = pOrderBy->a[i].sortFlags;
2298     }
2299   }
2300 
2301   return pRet;
2302 }
2303 
2304 #ifndef SQLITE_OMIT_CTE
2305 /*
2306 ** This routine generates VDBE code to compute the content of a WITH RECURSIVE
2307 ** query of the form:
2308 **
2309 **   <recursive-table> AS (<setup-query> UNION [ALL] <recursive-query>)
2310 **                         \___________/             \_______________/
2311 **                           p->pPrior                      p
2312 **
2313 **
2314 ** There is exactly one reference to the recursive-table in the FROM clause
2315 ** of recursive-query, marked with the SrcList->a[].fg.isRecursive flag.
2316 **
2317 ** The setup-query runs once to generate an initial set of rows that go
2318 ** into a Queue table.  Rows are extracted from the Queue table one by
2319 ** one.  Each row extracted from Queue is output to pDest.  Then the single
2320 ** extracted row (now in the iCurrent table) becomes the content of the
2321 ** recursive-table for a recursive-query run.  The output of the recursive-query
2322 ** is added back into the Queue table.  Then another row is extracted from Queue
2323 ** and the iteration continues until the Queue table is empty.
2324 **
2325 ** If the compound query operator is UNION then no duplicate rows are ever
2326 ** inserted into the Queue table.  The iDistinct table keeps a copy of all rows
2327 ** that have ever been inserted into Queue and causes duplicates to be
2328 ** discarded.  If the operator is UNION ALL, then duplicates are allowed.
2329 **
2330 ** If the query has an ORDER BY, then entries in the Queue table are kept in
2331 ** ORDER BY order and the first entry is extracted for each cycle.  Without
2332 ** an ORDER BY, the Queue table is just a FIFO.
2333 **
2334 ** If a LIMIT clause is provided, then the iteration stops after LIMIT rows
2335 ** have been output to pDest.  A LIMIT of zero means to output no rows and a
2336 ** negative LIMIT means to output all rows.  If there is also an OFFSET clause
2337 ** with a positive value, then the first OFFSET outputs are discarded rather
2338 ** than being sent to pDest.  The LIMIT count does not begin until after OFFSET
2339 ** rows have been skipped.
2340 */
2341 static void generateWithRecursiveQuery(
2342   Parse *pParse,        /* Parsing context */
2343   Select *p,            /* The recursive SELECT to be coded */
2344   SelectDest *pDest     /* What to do with query results */
2345 ){
2346   SrcList *pSrc = p->pSrc;      /* The FROM clause of the recursive query */
2347   int nCol = p->pEList->nExpr;  /* Number of columns in the recursive table */
2348   Vdbe *v = pParse->pVdbe;      /* The prepared statement under construction */
2349   Select *pSetup = p->pPrior;   /* The setup query */
2350   Select *pFirstRec;            /* Left-most recursive term */
2351   int addrTop;                  /* Top of the loop */
2352   int addrCont, addrBreak;      /* CONTINUE and BREAK addresses */
2353   int iCurrent = 0;             /* The Current table */
2354   int regCurrent;               /* Register holding Current table */
2355   int iQueue;                   /* The Queue table */
2356   int iDistinct = 0;            /* To ensure unique results if UNION */
2357   int eDest = SRT_Fifo;         /* How to write to Queue */
2358   SelectDest destQueue;         /* SelectDest targetting the Queue table */
2359   int i;                        /* Loop counter */
2360   int rc;                       /* Result code */
2361   ExprList *pOrderBy;           /* The ORDER BY clause */
2362   Expr *pLimit;                 /* Saved LIMIT and OFFSET */
2363   int regLimit, regOffset;      /* Registers used by LIMIT and OFFSET */
2364 
2365 #ifndef SQLITE_OMIT_WINDOWFUNC
2366   if( p->pWin ){
2367     sqlite3ErrorMsg(pParse, "cannot use window functions in recursive queries");
2368     return;
2369   }
2370 #endif
2371 
2372   /* Obtain authorization to do a recursive query */
2373   if( sqlite3AuthCheck(pParse, SQLITE_RECURSIVE, 0, 0, 0) ) return;
2374 
2375   /* Process the LIMIT and OFFSET clauses, if they exist */
2376   addrBreak = sqlite3VdbeMakeLabel(pParse);
2377   p->nSelectRow = 320;  /* 4 billion rows */
2378   computeLimitRegisters(pParse, p, addrBreak);
2379   pLimit = p->pLimit;
2380   regLimit = p->iLimit;
2381   regOffset = p->iOffset;
2382   p->pLimit = 0;
2383   p->iLimit = p->iOffset = 0;
2384   pOrderBy = p->pOrderBy;
2385 
2386   /* Locate the cursor number of the Current table */
2387   for(i=0; ALWAYS(i<pSrc->nSrc); i++){
2388     if( pSrc->a[i].fg.isRecursive ){
2389       iCurrent = pSrc->a[i].iCursor;
2390       break;
2391     }
2392   }
2393 
2394   /* Allocate cursors numbers for Queue and Distinct.  The cursor number for
2395   ** the Distinct table must be exactly one greater than Queue in order
2396   ** for the SRT_DistFifo and SRT_DistQueue destinations to work. */
2397   iQueue = pParse->nTab++;
2398   if( p->op==TK_UNION ){
2399     eDest = pOrderBy ? SRT_DistQueue : SRT_DistFifo;
2400     iDistinct = pParse->nTab++;
2401   }else{
2402     eDest = pOrderBy ? SRT_Queue : SRT_Fifo;
2403   }
2404   sqlite3SelectDestInit(&destQueue, eDest, iQueue);
2405 
2406   /* Allocate cursors for Current, Queue, and Distinct. */
2407   regCurrent = ++pParse->nMem;
2408   sqlite3VdbeAddOp3(v, OP_OpenPseudo, iCurrent, regCurrent, nCol);
2409   if( pOrderBy ){
2410     KeyInfo *pKeyInfo = multiSelectOrderByKeyInfo(pParse, p, 1);
2411     sqlite3VdbeAddOp4(v, OP_OpenEphemeral, iQueue, pOrderBy->nExpr+2, 0,
2412                       (char*)pKeyInfo, P4_KEYINFO);
2413     destQueue.pOrderBy = pOrderBy;
2414   }else{
2415     sqlite3VdbeAddOp2(v, OP_OpenEphemeral, iQueue, nCol);
2416   }
2417   VdbeComment((v, "Queue table"));
2418   if( iDistinct ){
2419     p->addrOpenEphm[0] = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, iDistinct, 0);
2420     p->selFlags |= SF_UsesEphemeral;
2421   }
2422 
2423   /* Detach the ORDER BY clause from the compound SELECT */
2424   p->pOrderBy = 0;
2425 
2426   /* Figure out how many elements of the compound SELECT are part of the
2427   ** recursive query.  Make sure no recursive elements use aggregate
2428   ** functions.  Mark the recursive elements as UNION ALL even if they
2429   ** are really UNION because the distinctness will be enforced by the
2430   ** iDistinct table.  pFirstRec is left pointing to the left-most
2431   ** recursive term of the CTE.
2432   */
2433   pFirstRec = p;
2434   for(pFirstRec=p; ALWAYS(pFirstRec!=0); pFirstRec=pFirstRec->pPrior){
2435     if( pFirstRec->selFlags & SF_Aggregate ){
2436       sqlite3ErrorMsg(pParse, "recursive aggregate queries not supported");
2437       goto end_of_recursive_query;
2438     }
2439     pFirstRec->op = TK_ALL;
2440     if( (pFirstRec->pPrior->selFlags & SF_Recursive)==0 ) break;
2441   }
2442 
2443   /* Store the results of the setup-query in Queue. */
2444   pSetup = pFirstRec->pPrior;
2445   pSetup->pNext = 0;
2446   ExplainQueryPlan((pParse, 1, "SETUP"));
2447   rc = sqlite3Select(pParse, pSetup, &destQueue);
2448   pSetup->pNext = p;
2449   if( rc ) goto end_of_recursive_query;
2450 
2451   /* Find the next row in the Queue and output that row */
2452   addrTop = sqlite3VdbeAddOp2(v, OP_Rewind, iQueue, addrBreak); VdbeCoverage(v);
2453 
2454   /* Transfer the next row in Queue over to Current */
2455   sqlite3VdbeAddOp1(v, OP_NullRow, iCurrent); /* To reset column cache */
2456   if( pOrderBy ){
2457     sqlite3VdbeAddOp3(v, OP_Column, iQueue, pOrderBy->nExpr+1, regCurrent);
2458   }else{
2459     sqlite3VdbeAddOp2(v, OP_RowData, iQueue, regCurrent);
2460   }
2461   sqlite3VdbeAddOp1(v, OP_Delete, iQueue);
2462 
2463   /* Output the single row in Current */
2464   addrCont = sqlite3VdbeMakeLabel(pParse);
2465   codeOffset(v, regOffset, addrCont);
2466   selectInnerLoop(pParse, p, iCurrent,
2467       0, 0, pDest, addrCont, addrBreak);
2468   if( regLimit ){
2469     sqlite3VdbeAddOp2(v, OP_DecrJumpZero, regLimit, addrBreak);
2470     VdbeCoverage(v);
2471   }
2472   sqlite3VdbeResolveLabel(v, addrCont);
2473 
2474   /* Execute the recursive SELECT taking the single row in Current as
2475   ** the value for the recursive-table. Store the results in the Queue.
2476   */
2477   pFirstRec->pPrior = 0;
2478   ExplainQueryPlan((pParse, 1, "RECURSIVE STEP"));
2479   sqlite3Select(pParse, p, &destQueue);
2480   assert( pFirstRec->pPrior==0 );
2481   pFirstRec->pPrior = pSetup;
2482 
2483   /* Keep running the loop until the Queue is empty */
2484   sqlite3VdbeGoto(v, addrTop);
2485   sqlite3VdbeResolveLabel(v, addrBreak);
2486 
2487 end_of_recursive_query:
2488   sqlite3ExprListDelete(pParse->db, p->pOrderBy);
2489   p->pOrderBy = pOrderBy;
2490   p->pLimit = pLimit;
2491   return;
2492 }
2493 #endif /* SQLITE_OMIT_CTE */
2494 
2495 /* Forward references */
2496 static int multiSelectOrderBy(
2497   Parse *pParse,        /* Parsing context */
2498   Select *p,            /* The right-most of SELECTs to be coded */
2499   SelectDest *pDest     /* What to do with query results */
2500 );
2501 
2502 /*
2503 ** Handle the special case of a compound-select that originates from a
2504 ** VALUES clause.  By handling this as a special case, we avoid deep
2505 ** recursion, and thus do not need to enforce the SQLITE_LIMIT_COMPOUND_SELECT
2506 ** on a VALUES clause.
2507 **
2508 ** Because the Select object originates from a VALUES clause:
2509 **   (1) There is no LIMIT or OFFSET or else there is a LIMIT of exactly 1
2510 **   (2) All terms are UNION ALL
2511 **   (3) There is no ORDER BY clause
2512 **
2513 ** The "LIMIT of exactly 1" case of condition (1) comes about when a VALUES
2514 ** clause occurs within scalar expression (ex: "SELECT (VALUES(1),(2),(3))").
2515 ** The sqlite3CodeSubselect will have added the LIMIT 1 clause in tht case.
2516 ** Since the limit is exactly 1, we only need to evalutes the left-most VALUES.
2517 */
2518 static int multiSelectValues(
2519   Parse *pParse,        /* Parsing context */
2520   Select *p,            /* The right-most of SELECTs to be coded */
2521   SelectDest *pDest     /* What to do with query results */
2522 ){
2523   int nRow = 1;
2524   int rc = 0;
2525   int bShowAll = p->pLimit==0;
2526   assert( p->selFlags & SF_MultiValue );
2527   do{
2528     assert( p->selFlags & SF_Values );
2529     assert( p->op==TK_ALL || (p->op==TK_SELECT && p->pPrior==0) );
2530     assert( p->pNext==0 || p->pEList->nExpr==p->pNext->pEList->nExpr );
2531 #ifndef SQLITE_OMIT_WINDOWFUNC
2532     if( p->pWin ) return -1;
2533 #endif
2534     if( p->pPrior==0 ) break;
2535     assert( p->pPrior->pNext==p );
2536     p = p->pPrior;
2537     nRow += bShowAll;
2538   }while(1);
2539   ExplainQueryPlan((pParse, 0, "SCAN %d CONSTANT ROW%s", nRow,
2540                     nRow==1 ? "" : "S"));
2541   while( p ){
2542     selectInnerLoop(pParse, p, -1, 0, 0, pDest, 1, 1);
2543     if( !bShowAll ) break;
2544     p->nSelectRow = nRow;
2545     p = p->pNext;
2546   }
2547   return rc;
2548 }
2549 
2550 /*
2551 ** Return true if the SELECT statement which is known to be the recursive
2552 ** part of a recursive CTE still has its anchor terms attached.  If the
2553 ** anchor terms have already been removed, then return false.
2554 */
2555 static int hasAnchor(Select *p){
2556   while( p && (p->selFlags & SF_Recursive)!=0 ){ p = p->pPrior; }
2557   return p!=0;
2558 }
2559 
2560 /*
2561 ** This routine is called to process a compound query form from
2562 ** two or more separate queries using UNION, UNION ALL, EXCEPT, or
2563 ** INTERSECT
2564 **
2565 ** "p" points to the right-most of the two queries.  the query on the
2566 ** left is p->pPrior.  The left query could also be a compound query
2567 ** in which case this routine will be called recursively.
2568 **
2569 ** The results of the total query are to be written into a destination
2570 ** of type eDest with parameter iParm.
2571 **
2572 ** Example 1:  Consider a three-way compound SQL statement.
2573 **
2574 **     SELECT a FROM t1 UNION SELECT b FROM t2 UNION SELECT c FROM t3
2575 **
2576 ** This statement is parsed up as follows:
2577 **
2578 **     SELECT c FROM t3
2579 **      |
2580 **      `----->  SELECT b FROM t2
2581 **                |
2582 **                `------>  SELECT a FROM t1
2583 **
2584 ** The arrows in the diagram above represent the Select.pPrior pointer.
2585 ** So if this routine is called with p equal to the t3 query, then
2586 ** pPrior will be the t2 query.  p->op will be TK_UNION in this case.
2587 **
2588 ** Notice that because of the way SQLite parses compound SELECTs, the
2589 ** individual selects always group from left to right.
2590 */
2591 static int multiSelect(
2592   Parse *pParse,        /* Parsing context */
2593   Select *p,            /* The right-most of SELECTs to be coded */
2594   SelectDest *pDest     /* What to do with query results */
2595 ){
2596   int rc = SQLITE_OK;   /* Success code from a subroutine */
2597   Select *pPrior;       /* Another SELECT immediately to our left */
2598   Vdbe *v;              /* Generate code to this VDBE */
2599   SelectDest dest;      /* Alternative data destination */
2600   Select *pDelete = 0;  /* Chain of simple selects to delete */
2601   sqlite3 *db;          /* Database connection */
2602 
2603   /* Make sure there is no ORDER BY or LIMIT clause on prior SELECTs.  Only
2604   ** the last (right-most) SELECT in the series may have an ORDER BY or LIMIT.
2605   */
2606   assert( p && p->pPrior );  /* Calling function guarantees this much */
2607   assert( (p->selFlags & SF_Recursive)==0 || p->op==TK_ALL || p->op==TK_UNION );
2608   assert( p->selFlags & SF_Compound );
2609   db = pParse->db;
2610   pPrior = p->pPrior;
2611   dest = *pDest;
2612   assert( pPrior->pOrderBy==0 );
2613   assert( pPrior->pLimit==0 );
2614 
2615   v = sqlite3GetVdbe(pParse);
2616   assert( v!=0 );  /* The VDBE already created by calling function */
2617 
2618   /* Create the destination temporary table if necessary
2619   */
2620   if( dest.eDest==SRT_EphemTab ){
2621     assert( p->pEList );
2622     sqlite3VdbeAddOp2(v, OP_OpenEphemeral, dest.iSDParm, p->pEList->nExpr);
2623     dest.eDest = SRT_Table;
2624   }
2625 
2626   /* Special handling for a compound-select that originates as a VALUES clause.
2627   */
2628   if( p->selFlags & SF_MultiValue ){
2629     rc = multiSelectValues(pParse, p, &dest);
2630     if( rc>=0 ) goto multi_select_end;
2631     rc = SQLITE_OK;
2632   }
2633 
2634   /* Make sure all SELECTs in the statement have the same number of elements
2635   ** in their result sets.
2636   */
2637   assert( p->pEList && pPrior->pEList );
2638   assert( p->pEList->nExpr==pPrior->pEList->nExpr );
2639 
2640 #ifndef SQLITE_OMIT_CTE
2641   if( (p->selFlags & SF_Recursive)!=0 && hasAnchor(p) ){
2642     generateWithRecursiveQuery(pParse, p, &dest);
2643   }else
2644 #endif
2645 
2646   /* Compound SELECTs that have an ORDER BY clause are handled separately.
2647   */
2648   if( p->pOrderBy ){
2649     return multiSelectOrderBy(pParse, p, pDest);
2650   }else{
2651 
2652 #ifndef SQLITE_OMIT_EXPLAIN
2653     if( pPrior->pPrior==0 ){
2654       ExplainQueryPlan((pParse, 1, "COMPOUND QUERY"));
2655       ExplainQueryPlan((pParse, 1, "LEFT-MOST SUBQUERY"));
2656     }
2657 #endif
2658 
2659     /* Generate code for the left and right SELECT statements.
2660     */
2661     switch( p->op ){
2662       case TK_ALL: {
2663         int addr = 0;
2664         int nLimit;
2665         assert( !pPrior->pLimit );
2666         pPrior->iLimit = p->iLimit;
2667         pPrior->iOffset = p->iOffset;
2668         pPrior->pLimit = p->pLimit;
2669         rc = sqlite3Select(pParse, pPrior, &dest);
2670         pPrior->pLimit = 0;
2671         if( rc ){
2672           goto multi_select_end;
2673         }
2674         p->pPrior = 0;
2675         p->iLimit = pPrior->iLimit;
2676         p->iOffset = pPrior->iOffset;
2677         if( p->iLimit ){
2678           addr = sqlite3VdbeAddOp1(v, OP_IfNot, p->iLimit); VdbeCoverage(v);
2679           VdbeComment((v, "Jump ahead if LIMIT reached"));
2680           if( p->iOffset ){
2681             sqlite3VdbeAddOp3(v, OP_OffsetLimit,
2682                               p->iLimit, p->iOffset+1, p->iOffset);
2683           }
2684         }
2685         ExplainQueryPlan((pParse, 1, "UNION ALL"));
2686         rc = sqlite3Select(pParse, p, &dest);
2687         testcase( rc!=SQLITE_OK );
2688         pDelete = p->pPrior;
2689         p->pPrior = pPrior;
2690         p->nSelectRow = sqlite3LogEstAdd(p->nSelectRow, pPrior->nSelectRow);
2691         if( p->pLimit
2692          && sqlite3ExprIsInteger(p->pLimit->pLeft, &nLimit)
2693          && nLimit>0 && p->nSelectRow > sqlite3LogEst((u64)nLimit)
2694         ){
2695           p->nSelectRow = sqlite3LogEst((u64)nLimit);
2696         }
2697         if( addr ){
2698           sqlite3VdbeJumpHere(v, addr);
2699         }
2700         break;
2701       }
2702       case TK_EXCEPT:
2703       case TK_UNION: {
2704         int unionTab;    /* Cursor number of the temp table holding result */
2705         u8 op = 0;       /* One of the SRT_ operations to apply to self */
2706         int priorOp;     /* The SRT_ operation to apply to prior selects */
2707         Expr *pLimit;    /* Saved values of p->nLimit  */
2708         int addr;
2709         SelectDest uniondest;
2710 
2711         testcase( p->op==TK_EXCEPT );
2712         testcase( p->op==TK_UNION );
2713         priorOp = SRT_Union;
2714         if( dest.eDest==priorOp ){
2715           /* We can reuse a temporary table generated by a SELECT to our
2716           ** right.
2717           */
2718           assert( p->pLimit==0 );      /* Not allowed on leftward elements */
2719           unionTab = dest.iSDParm;
2720         }else{
2721           /* We will need to create our own temporary table to hold the
2722           ** intermediate results.
2723           */
2724           unionTab = pParse->nTab++;
2725           assert( p->pOrderBy==0 );
2726           addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, unionTab, 0);
2727           assert( p->addrOpenEphm[0] == -1 );
2728           p->addrOpenEphm[0] = addr;
2729           findRightmost(p)->selFlags |= SF_UsesEphemeral;
2730           assert( p->pEList );
2731         }
2732 
2733 
2734         /* Code the SELECT statements to our left
2735         */
2736         assert( !pPrior->pOrderBy );
2737         sqlite3SelectDestInit(&uniondest, priorOp, unionTab);
2738         rc = sqlite3Select(pParse, pPrior, &uniondest);
2739         if( rc ){
2740           goto multi_select_end;
2741         }
2742 
2743         /* Code the current SELECT statement
2744         */
2745         if( p->op==TK_EXCEPT ){
2746           op = SRT_Except;
2747         }else{
2748           assert( p->op==TK_UNION );
2749           op = SRT_Union;
2750         }
2751         p->pPrior = 0;
2752         pLimit = p->pLimit;
2753         p->pLimit = 0;
2754         uniondest.eDest = op;
2755         ExplainQueryPlan((pParse, 1, "%s USING TEMP B-TREE",
2756                           sqlite3SelectOpName(p->op)));
2757         rc = sqlite3Select(pParse, p, &uniondest);
2758         testcase( rc!=SQLITE_OK );
2759         assert( p->pOrderBy==0 );
2760         pDelete = p->pPrior;
2761         p->pPrior = pPrior;
2762         p->pOrderBy = 0;
2763         if( p->op==TK_UNION ){
2764           p->nSelectRow = sqlite3LogEstAdd(p->nSelectRow, pPrior->nSelectRow);
2765         }
2766         sqlite3ExprDelete(db, p->pLimit);
2767         p->pLimit = pLimit;
2768         p->iLimit = 0;
2769         p->iOffset = 0;
2770 
2771         /* Convert the data in the temporary table into whatever form
2772         ** it is that we currently need.
2773         */
2774         assert( unionTab==dest.iSDParm || dest.eDest!=priorOp );
2775         assert( p->pEList || db->mallocFailed );
2776         if( dest.eDest!=priorOp && db->mallocFailed==0 ){
2777           int iCont, iBreak, iStart;
2778           iBreak = sqlite3VdbeMakeLabel(pParse);
2779           iCont = sqlite3VdbeMakeLabel(pParse);
2780           computeLimitRegisters(pParse, p, iBreak);
2781           sqlite3VdbeAddOp2(v, OP_Rewind, unionTab, iBreak); VdbeCoverage(v);
2782           iStart = sqlite3VdbeCurrentAddr(v);
2783           selectInnerLoop(pParse, p, unionTab,
2784                           0, 0, &dest, iCont, iBreak);
2785           sqlite3VdbeResolveLabel(v, iCont);
2786           sqlite3VdbeAddOp2(v, OP_Next, unionTab, iStart); VdbeCoverage(v);
2787           sqlite3VdbeResolveLabel(v, iBreak);
2788           sqlite3VdbeAddOp2(v, OP_Close, unionTab, 0);
2789         }
2790         break;
2791       }
2792       default: assert( p->op==TK_INTERSECT ); {
2793         int tab1, tab2;
2794         int iCont, iBreak, iStart;
2795         Expr *pLimit;
2796         int addr;
2797         SelectDest intersectdest;
2798         int r1;
2799 
2800         /* INTERSECT is different from the others since it requires
2801         ** two temporary tables.  Hence it has its own case.  Begin
2802         ** by allocating the tables we will need.
2803         */
2804         tab1 = pParse->nTab++;
2805         tab2 = pParse->nTab++;
2806         assert( p->pOrderBy==0 );
2807 
2808         addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, tab1, 0);
2809         assert( p->addrOpenEphm[0] == -1 );
2810         p->addrOpenEphm[0] = addr;
2811         findRightmost(p)->selFlags |= SF_UsesEphemeral;
2812         assert( p->pEList );
2813 
2814         /* Code the SELECTs to our left into temporary table "tab1".
2815         */
2816         sqlite3SelectDestInit(&intersectdest, SRT_Union, tab1);
2817         rc = sqlite3Select(pParse, pPrior, &intersectdest);
2818         if( rc ){
2819           goto multi_select_end;
2820         }
2821 
2822         /* Code the current SELECT into temporary table "tab2"
2823         */
2824         addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, tab2, 0);
2825         assert( p->addrOpenEphm[1] == -1 );
2826         p->addrOpenEphm[1] = addr;
2827         p->pPrior = 0;
2828         pLimit = p->pLimit;
2829         p->pLimit = 0;
2830         intersectdest.iSDParm = tab2;
2831         ExplainQueryPlan((pParse, 1, "%s USING TEMP B-TREE",
2832                           sqlite3SelectOpName(p->op)));
2833         rc = sqlite3Select(pParse, p, &intersectdest);
2834         testcase( rc!=SQLITE_OK );
2835         pDelete = p->pPrior;
2836         p->pPrior = pPrior;
2837         if( p->nSelectRow>pPrior->nSelectRow ){
2838           p->nSelectRow = pPrior->nSelectRow;
2839         }
2840         sqlite3ExprDelete(db, p->pLimit);
2841         p->pLimit = pLimit;
2842 
2843         /* Generate code to take the intersection of the two temporary
2844         ** tables.
2845         */
2846         if( rc ) break;
2847         assert( p->pEList );
2848         iBreak = sqlite3VdbeMakeLabel(pParse);
2849         iCont = sqlite3VdbeMakeLabel(pParse);
2850         computeLimitRegisters(pParse, p, iBreak);
2851         sqlite3VdbeAddOp2(v, OP_Rewind, tab1, iBreak); VdbeCoverage(v);
2852         r1 = sqlite3GetTempReg(pParse);
2853         iStart = sqlite3VdbeAddOp2(v, OP_RowData, tab1, r1);
2854         sqlite3VdbeAddOp4Int(v, OP_NotFound, tab2, iCont, r1, 0);
2855         VdbeCoverage(v);
2856         sqlite3ReleaseTempReg(pParse, r1);
2857         selectInnerLoop(pParse, p, tab1,
2858                         0, 0, &dest, iCont, iBreak);
2859         sqlite3VdbeResolveLabel(v, iCont);
2860         sqlite3VdbeAddOp2(v, OP_Next, tab1, iStart); VdbeCoverage(v);
2861         sqlite3VdbeResolveLabel(v, iBreak);
2862         sqlite3VdbeAddOp2(v, OP_Close, tab2, 0);
2863         sqlite3VdbeAddOp2(v, OP_Close, tab1, 0);
2864         break;
2865       }
2866     }
2867 
2868   #ifndef SQLITE_OMIT_EXPLAIN
2869     if( p->pNext==0 ){
2870       ExplainQueryPlanPop(pParse);
2871     }
2872   #endif
2873   }
2874   if( pParse->nErr ) goto multi_select_end;
2875 
2876   /* Compute collating sequences used by
2877   ** temporary tables needed to implement the compound select.
2878   ** Attach the KeyInfo structure to all temporary tables.
2879   **
2880   ** This section is run by the right-most SELECT statement only.
2881   ** SELECT statements to the left always skip this part.  The right-most
2882   ** SELECT might also skip this part if it has no ORDER BY clause and
2883   ** no temp tables are required.
2884   */
2885   if( p->selFlags & SF_UsesEphemeral ){
2886     int i;                        /* Loop counter */
2887     KeyInfo *pKeyInfo;            /* Collating sequence for the result set */
2888     Select *pLoop;                /* For looping through SELECT statements */
2889     CollSeq **apColl;             /* For looping through pKeyInfo->aColl[] */
2890     int nCol;                     /* Number of columns in result set */
2891 
2892     assert( p->pNext==0 );
2893     nCol = p->pEList->nExpr;
2894     pKeyInfo = sqlite3KeyInfoAlloc(db, nCol, 1);
2895     if( !pKeyInfo ){
2896       rc = SQLITE_NOMEM_BKPT;
2897       goto multi_select_end;
2898     }
2899     for(i=0, apColl=pKeyInfo->aColl; i<nCol; i++, apColl++){
2900       *apColl = multiSelectCollSeq(pParse, p, i);
2901       if( 0==*apColl ){
2902         *apColl = db->pDfltColl;
2903       }
2904     }
2905 
2906     for(pLoop=p; pLoop; pLoop=pLoop->pPrior){
2907       for(i=0; i<2; i++){
2908         int addr = pLoop->addrOpenEphm[i];
2909         if( addr<0 ){
2910           /* If [0] is unused then [1] is also unused.  So we can
2911           ** always safely abort as soon as the first unused slot is found */
2912           assert( pLoop->addrOpenEphm[1]<0 );
2913           break;
2914         }
2915         sqlite3VdbeChangeP2(v, addr, nCol);
2916         sqlite3VdbeChangeP4(v, addr, (char*)sqlite3KeyInfoRef(pKeyInfo),
2917                             P4_KEYINFO);
2918         pLoop->addrOpenEphm[i] = -1;
2919       }
2920     }
2921     sqlite3KeyInfoUnref(pKeyInfo);
2922   }
2923 
2924 multi_select_end:
2925   pDest->iSdst = dest.iSdst;
2926   pDest->nSdst = dest.nSdst;
2927   sqlite3SelectDelete(db, pDelete);
2928   return rc;
2929 }
2930 #endif /* SQLITE_OMIT_COMPOUND_SELECT */
2931 
2932 /*
2933 ** Error message for when two or more terms of a compound select have different
2934 ** size result sets.
2935 */
2936 void sqlite3SelectWrongNumTermsError(Parse *pParse, Select *p){
2937   if( p->selFlags & SF_Values ){
2938     sqlite3ErrorMsg(pParse, "all VALUES must have the same number of terms");
2939   }else{
2940     sqlite3ErrorMsg(pParse, "SELECTs to the left and right of %s"
2941       " do not have the same number of result columns",
2942       sqlite3SelectOpName(p->op));
2943   }
2944 }
2945 
2946 /*
2947 ** Code an output subroutine for a coroutine implementation of a
2948 ** SELECT statment.
2949 **
2950 ** The data to be output is contained in pIn->iSdst.  There are
2951 ** pIn->nSdst columns to be output.  pDest is where the output should
2952 ** be sent.
2953 **
2954 ** regReturn is the number of the register holding the subroutine
2955 ** return address.
2956 **
2957 ** If regPrev>0 then it is the first register in a vector that
2958 ** records the previous output.  mem[regPrev] is a flag that is false
2959 ** if there has been no previous output.  If regPrev>0 then code is
2960 ** generated to suppress duplicates.  pKeyInfo is used for comparing
2961 ** keys.
2962 **
2963 ** If the LIMIT found in p->iLimit is reached, jump immediately to
2964 ** iBreak.
2965 */
2966 static int generateOutputSubroutine(
2967   Parse *pParse,          /* Parsing context */
2968   Select *p,              /* The SELECT statement */
2969   SelectDest *pIn,        /* Coroutine supplying data */
2970   SelectDest *pDest,      /* Where to send the data */
2971   int regReturn,          /* The return address register */
2972   int regPrev,            /* Previous result register.  No uniqueness if 0 */
2973   KeyInfo *pKeyInfo,      /* For comparing with previous entry */
2974   int iBreak              /* Jump here if we hit the LIMIT */
2975 ){
2976   Vdbe *v = pParse->pVdbe;
2977   int iContinue;
2978   int addr;
2979 
2980   addr = sqlite3VdbeCurrentAddr(v);
2981   iContinue = sqlite3VdbeMakeLabel(pParse);
2982 
2983   /* Suppress duplicates for UNION, EXCEPT, and INTERSECT
2984   */
2985   if( regPrev ){
2986     int addr1, addr2;
2987     addr1 = sqlite3VdbeAddOp1(v, OP_IfNot, regPrev); VdbeCoverage(v);
2988     addr2 = sqlite3VdbeAddOp4(v, OP_Compare, pIn->iSdst, regPrev+1, pIn->nSdst,
2989                               (char*)sqlite3KeyInfoRef(pKeyInfo), P4_KEYINFO);
2990     sqlite3VdbeAddOp3(v, OP_Jump, addr2+2, iContinue, addr2+2); VdbeCoverage(v);
2991     sqlite3VdbeJumpHere(v, addr1);
2992     sqlite3VdbeAddOp3(v, OP_Copy, pIn->iSdst, regPrev+1, pIn->nSdst-1);
2993     sqlite3VdbeAddOp2(v, OP_Integer, 1, regPrev);
2994   }
2995   if( pParse->db->mallocFailed ) return 0;
2996 
2997   /* Suppress the first OFFSET entries if there is an OFFSET clause
2998   */
2999   codeOffset(v, p->iOffset, iContinue);
3000 
3001   assert( pDest->eDest!=SRT_Exists );
3002   assert( pDest->eDest!=SRT_Table );
3003   switch( pDest->eDest ){
3004     /* Store the result as data using a unique key.
3005     */
3006     case SRT_EphemTab: {
3007       int r1 = sqlite3GetTempReg(pParse);
3008       int r2 = sqlite3GetTempReg(pParse);
3009       sqlite3VdbeAddOp3(v, OP_MakeRecord, pIn->iSdst, pIn->nSdst, r1);
3010       sqlite3VdbeAddOp2(v, OP_NewRowid, pDest->iSDParm, r2);
3011       sqlite3VdbeAddOp3(v, OP_Insert, pDest->iSDParm, r1, r2);
3012       sqlite3VdbeChangeP5(v, OPFLAG_APPEND);
3013       sqlite3ReleaseTempReg(pParse, r2);
3014       sqlite3ReleaseTempReg(pParse, r1);
3015       break;
3016     }
3017 
3018 #ifndef SQLITE_OMIT_SUBQUERY
3019     /* If we are creating a set for an "expr IN (SELECT ...)".
3020     */
3021     case SRT_Set: {
3022       int r1;
3023       testcase( pIn->nSdst>1 );
3024       r1 = sqlite3GetTempReg(pParse);
3025       sqlite3VdbeAddOp4(v, OP_MakeRecord, pIn->iSdst, pIn->nSdst,
3026           r1, pDest->zAffSdst, pIn->nSdst);
3027       sqlite3VdbeAddOp4Int(v, OP_IdxInsert, pDest->iSDParm, r1,
3028                            pIn->iSdst, pIn->nSdst);
3029       sqlite3ReleaseTempReg(pParse, r1);
3030       break;
3031     }
3032 
3033     /* If this is a scalar select that is part of an expression, then
3034     ** store the results in the appropriate memory cell and break out
3035     ** of the scan loop.  Note that the select might return multiple columns
3036     ** if it is the RHS of a row-value IN operator.
3037     */
3038     case SRT_Mem: {
3039       testcase( pIn->nSdst>1 );
3040       sqlite3ExprCodeMove(pParse, pIn->iSdst, pDest->iSDParm, pIn->nSdst);
3041       /* The LIMIT clause will jump out of the loop for us */
3042       break;
3043     }
3044 #endif /* #ifndef SQLITE_OMIT_SUBQUERY */
3045 
3046     /* The results are stored in a sequence of registers
3047     ** starting at pDest->iSdst.  Then the co-routine yields.
3048     */
3049     case SRT_Coroutine: {
3050       if( pDest->iSdst==0 ){
3051         pDest->iSdst = sqlite3GetTempRange(pParse, pIn->nSdst);
3052         pDest->nSdst = pIn->nSdst;
3053       }
3054       sqlite3ExprCodeMove(pParse, pIn->iSdst, pDest->iSdst, pIn->nSdst);
3055       sqlite3VdbeAddOp1(v, OP_Yield, pDest->iSDParm);
3056       break;
3057     }
3058 
3059     /* If none of the above, then the result destination must be
3060     ** SRT_Output.  This routine is never called with any other
3061     ** destination other than the ones handled above or SRT_Output.
3062     **
3063     ** For SRT_Output, results are stored in a sequence of registers.
3064     ** Then the OP_ResultRow opcode is used to cause sqlite3_step() to
3065     ** return the next row of result.
3066     */
3067     default: {
3068       assert( pDest->eDest==SRT_Output );
3069       sqlite3VdbeAddOp2(v, OP_ResultRow, pIn->iSdst, pIn->nSdst);
3070       break;
3071     }
3072   }
3073 
3074   /* Jump to the end of the loop if the LIMIT is reached.
3075   */
3076   if( p->iLimit ){
3077     sqlite3VdbeAddOp2(v, OP_DecrJumpZero, p->iLimit, iBreak); VdbeCoverage(v);
3078   }
3079 
3080   /* Generate the subroutine return
3081   */
3082   sqlite3VdbeResolveLabel(v, iContinue);
3083   sqlite3VdbeAddOp1(v, OP_Return, regReturn);
3084 
3085   return addr;
3086 }
3087 
3088 /*
3089 ** Alternative compound select code generator for cases when there
3090 ** is an ORDER BY clause.
3091 **
3092 ** We assume a query of the following form:
3093 **
3094 **      <selectA>  <operator>  <selectB>  ORDER BY <orderbylist>
3095 **
3096 ** <operator> is one of UNION ALL, UNION, EXCEPT, or INTERSECT.  The idea
3097 ** is to code both <selectA> and <selectB> with the ORDER BY clause as
3098 ** co-routines.  Then run the co-routines in parallel and merge the results
3099 ** into the output.  In addition to the two coroutines (called selectA and
3100 ** selectB) there are 7 subroutines:
3101 **
3102 **    outA:    Move the output of the selectA coroutine into the output
3103 **             of the compound query.
3104 **
3105 **    outB:    Move the output of the selectB coroutine into the output
3106 **             of the compound query.  (Only generated for UNION and
3107 **             UNION ALL.  EXCEPT and INSERTSECT never output a row that
3108 **             appears only in B.)
3109 **
3110 **    AltB:    Called when there is data from both coroutines and A<B.
3111 **
3112 **    AeqB:    Called when there is data from both coroutines and A==B.
3113 **
3114 **    AgtB:    Called when there is data from both coroutines and A>B.
3115 **
3116 **    EofA:    Called when data is exhausted from selectA.
3117 **
3118 **    EofB:    Called when data is exhausted from selectB.
3119 **
3120 ** The implementation of the latter five subroutines depend on which
3121 ** <operator> is used:
3122 **
3123 **
3124 **             UNION ALL         UNION            EXCEPT          INTERSECT
3125 **          -------------  -----------------  --------------  -----------------
3126 **   AltB:   outA, nextA      outA, nextA       outA, nextA         nextA
3127 **
3128 **   AeqB:   outA, nextA         nextA             nextA         outA, nextA
3129 **
3130 **   AgtB:   outB, nextB      outB, nextB          nextB            nextB
3131 **
3132 **   EofA:   outB, nextB      outB, nextB          halt             halt
3133 **
3134 **   EofB:   outA, nextA      outA, nextA       outA, nextA         halt
3135 **
3136 ** In the AltB, AeqB, and AgtB subroutines, an EOF on A following nextA
3137 ** causes an immediate jump to EofA and an EOF on B following nextB causes
3138 ** an immediate jump to EofB.  Within EofA and EofB, and EOF on entry or
3139 ** following nextX causes a jump to the end of the select processing.
3140 **
3141 ** Duplicate removal in the UNION, EXCEPT, and INTERSECT cases is handled
3142 ** within the output subroutine.  The regPrev register set holds the previously
3143 ** output value.  A comparison is made against this value and the output
3144 ** is skipped if the next results would be the same as the previous.
3145 **
3146 ** The implementation plan is to implement the two coroutines and seven
3147 ** subroutines first, then put the control logic at the bottom.  Like this:
3148 **
3149 **          goto Init
3150 **     coA: coroutine for left query (A)
3151 **     coB: coroutine for right query (B)
3152 **    outA: output one row of A
3153 **    outB: output one row of B (UNION and UNION ALL only)
3154 **    EofA: ...
3155 **    EofB: ...
3156 **    AltB: ...
3157 **    AeqB: ...
3158 **    AgtB: ...
3159 **    Init: initialize coroutine registers
3160 **          yield coA
3161 **          if eof(A) goto EofA
3162 **          yield coB
3163 **          if eof(B) goto EofB
3164 **    Cmpr: Compare A, B
3165 **          Jump AltB, AeqB, AgtB
3166 **     End: ...
3167 **
3168 ** We call AltB, AeqB, AgtB, EofA, and EofB "subroutines" but they are not
3169 ** actually called using Gosub and they do not Return.  EofA and EofB loop
3170 ** until all data is exhausted then jump to the "end" labe.  AltB, AeqB,
3171 ** and AgtB jump to either L2 or to one of EofA or EofB.
3172 */
3173 #ifndef SQLITE_OMIT_COMPOUND_SELECT
3174 static int multiSelectOrderBy(
3175   Parse *pParse,        /* Parsing context */
3176   Select *p,            /* The right-most of SELECTs to be coded */
3177   SelectDest *pDest     /* What to do with query results */
3178 ){
3179   int i, j;             /* Loop counters */
3180   Select *pPrior;       /* Another SELECT immediately to our left */
3181   Vdbe *v;              /* Generate code to this VDBE */
3182   SelectDest destA;     /* Destination for coroutine A */
3183   SelectDest destB;     /* Destination for coroutine B */
3184   int regAddrA;         /* Address register for select-A coroutine */
3185   int regAddrB;         /* Address register for select-B coroutine */
3186   int addrSelectA;      /* Address of the select-A coroutine */
3187   int addrSelectB;      /* Address of the select-B coroutine */
3188   int regOutA;          /* Address register for the output-A subroutine */
3189   int regOutB;          /* Address register for the output-B subroutine */
3190   int addrOutA;         /* Address of the output-A subroutine */
3191   int addrOutB = 0;     /* Address of the output-B subroutine */
3192   int addrEofA;         /* Address of the select-A-exhausted subroutine */
3193   int addrEofA_noB;     /* Alternate addrEofA if B is uninitialized */
3194   int addrEofB;         /* Address of the select-B-exhausted subroutine */
3195   int addrAltB;         /* Address of the A<B subroutine */
3196   int addrAeqB;         /* Address of the A==B subroutine */
3197   int addrAgtB;         /* Address of the A>B subroutine */
3198   int regLimitA;        /* Limit register for select-A */
3199   int regLimitB;        /* Limit register for select-A */
3200   int regPrev;          /* A range of registers to hold previous output */
3201   int savedLimit;       /* Saved value of p->iLimit */
3202   int savedOffset;      /* Saved value of p->iOffset */
3203   int labelCmpr;        /* Label for the start of the merge algorithm */
3204   int labelEnd;         /* Label for the end of the overall SELECT stmt */
3205   int addr1;            /* Jump instructions that get retargetted */
3206   int op;               /* One of TK_ALL, TK_UNION, TK_EXCEPT, TK_INTERSECT */
3207   KeyInfo *pKeyDup = 0; /* Comparison information for duplicate removal */
3208   KeyInfo *pKeyMerge;   /* Comparison information for merging rows */
3209   sqlite3 *db;          /* Database connection */
3210   ExprList *pOrderBy;   /* The ORDER BY clause */
3211   int nOrderBy;         /* Number of terms in the ORDER BY clause */
3212   u32 *aPermute;        /* Mapping from ORDER BY terms to result set columns */
3213 
3214   assert( p->pOrderBy!=0 );
3215   assert( pKeyDup==0 ); /* "Managed" code needs this.  Ticket #3382. */
3216   db = pParse->db;
3217   v = pParse->pVdbe;
3218   assert( v!=0 );       /* Already thrown the error if VDBE alloc failed */
3219   labelEnd = sqlite3VdbeMakeLabel(pParse);
3220   labelCmpr = sqlite3VdbeMakeLabel(pParse);
3221 
3222 
3223   /* Patch up the ORDER BY clause
3224   */
3225   op = p->op;
3226   pPrior = p->pPrior;
3227   assert( pPrior->pOrderBy==0 );
3228   pOrderBy = p->pOrderBy;
3229   assert( pOrderBy );
3230   nOrderBy = pOrderBy->nExpr;
3231 
3232   /* For operators other than UNION ALL we have to make sure that
3233   ** the ORDER BY clause covers every term of the result set.  Add
3234   ** terms to the ORDER BY clause as necessary.
3235   */
3236   if( op!=TK_ALL ){
3237     for(i=1; db->mallocFailed==0 && i<=p->pEList->nExpr; i++){
3238       struct ExprList_item *pItem;
3239       for(j=0, pItem=pOrderBy->a; j<nOrderBy; j++, pItem++){
3240         assert( pItem->u.x.iOrderByCol>0 );
3241         if( pItem->u.x.iOrderByCol==i ) break;
3242       }
3243       if( j==nOrderBy ){
3244         Expr *pNew = sqlite3Expr(db, TK_INTEGER, 0);
3245         if( pNew==0 ) return SQLITE_NOMEM_BKPT;
3246         pNew->flags |= EP_IntValue;
3247         pNew->u.iValue = i;
3248         p->pOrderBy = pOrderBy = sqlite3ExprListAppend(pParse, pOrderBy, pNew);
3249         if( pOrderBy ) pOrderBy->a[nOrderBy++].u.x.iOrderByCol = (u16)i;
3250       }
3251     }
3252   }
3253 
3254   /* Compute the comparison permutation and keyinfo that is used with
3255   ** the permutation used to determine if the next
3256   ** row of results comes from selectA or selectB.  Also add explicit
3257   ** collations to the ORDER BY clause terms so that when the subqueries
3258   ** to the right and the left are evaluated, they use the correct
3259   ** collation.
3260   */
3261   aPermute = sqlite3DbMallocRawNN(db, sizeof(u32)*(nOrderBy + 1));
3262   if( aPermute ){
3263     struct ExprList_item *pItem;
3264     aPermute[0] = nOrderBy;
3265     for(i=1, pItem=pOrderBy->a; i<=nOrderBy; i++, pItem++){
3266       assert( pItem->u.x.iOrderByCol>0 );
3267       assert( pItem->u.x.iOrderByCol<=p->pEList->nExpr );
3268       aPermute[i] = pItem->u.x.iOrderByCol - 1;
3269     }
3270     pKeyMerge = multiSelectOrderByKeyInfo(pParse, p, 1);
3271   }else{
3272     pKeyMerge = 0;
3273   }
3274 
3275   /* Reattach the ORDER BY clause to the query.
3276   */
3277   p->pOrderBy = pOrderBy;
3278   pPrior->pOrderBy = sqlite3ExprListDup(pParse->db, pOrderBy, 0);
3279 
3280   /* Allocate a range of temporary registers and the KeyInfo needed
3281   ** for the logic that removes duplicate result rows when the
3282   ** operator is UNION, EXCEPT, or INTERSECT (but not UNION ALL).
3283   */
3284   if( op==TK_ALL ){
3285     regPrev = 0;
3286   }else{
3287     int nExpr = p->pEList->nExpr;
3288     assert( nOrderBy>=nExpr || db->mallocFailed );
3289     regPrev = pParse->nMem+1;
3290     pParse->nMem += nExpr+1;
3291     sqlite3VdbeAddOp2(v, OP_Integer, 0, regPrev);
3292     pKeyDup = sqlite3KeyInfoAlloc(db, nExpr, 1);
3293     if( pKeyDup ){
3294       assert( sqlite3KeyInfoIsWriteable(pKeyDup) );
3295       for(i=0; i<nExpr; i++){
3296         pKeyDup->aColl[i] = multiSelectCollSeq(pParse, p, i);
3297         pKeyDup->aSortFlags[i] = 0;
3298       }
3299     }
3300   }
3301 
3302   /* Separate the left and the right query from one another
3303   */
3304   p->pPrior = 0;
3305   pPrior->pNext = 0;
3306   sqlite3ResolveOrderGroupBy(pParse, p, p->pOrderBy, "ORDER");
3307   if( pPrior->pPrior==0 ){
3308     sqlite3ResolveOrderGroupBy(pParse, pPrior, pPrior->pOrderBy, "ORDER");
3309   }
3310 
3311   /* Compute the limit registers */
3312   computeLimitRegisters(pParse, p, labelEnd);
3313   if( p->iLimit && op==TK_ALL ){
3314     regLimitA = ++pParse->nMem;
3315     regLimitB = ++pParse->nMem;
3316     sqlite3VdbeAddOp2(v, OP_Copy, p->iOffset ? p->iOffset+1 : p->iLimit,
3317                                   regLimitA);
3318     sqlite3VdbeAddOp2(v, OP_Copy, regLimitA, regLimitB);
3319   }else{
3320     regLimitA = regLimitB = 0;
3321   }
3322   sqlite3ExprDelete(db, p->pLimit);
3323   p->pLimit = 0;
3324 
3325   regAddrA = ++pParse->nMem;
3326   regAddrB = ++pParse->nMem;
3327   regOutA = ++pParse->nMem;
3328   regOutB = ++pParse->nMem;
3329   sqlite3SelectDestInit(&destA, SRT_Coroutine, regAddrA);
3330   sqlite3SelectDestInit(&destB, SRT_Coroutine, regAddrB);
3331 
3332   ExplainQueryPlan((pParse, 1, "MERGE (%s)", sqlite3SelectOpName(p->op)));
3333 
3334   /* Generate a coroutine to evaluate the SELECT statement to the
3335   ** left of the compound operator - the "A" select.
3336   */
3337   addrSelectA = sqlite3VdbeCurrentAddr(v) + 1;
3338   addr1 = sqlite3VdbeAddOp3(v, OP_InitCoroutine, regAddrA, 0, addrSelectA);
3339   VdbeComment((v, "left SELECT"));
3340   pPrior->iLimit = regLimitA;
3341   ExplainQueryPlan((pParse, 1, "LEFT"));
3342   sqlite3Select(pParse, pPrior, &destA);
3343   sqlite3VdbeEndCoroutine(v, regAddrA);
3344   sqlite3VdbeJumpHere(v, addr1);
3345 
3346   /* Generate a coroutine to evaluate the SELECT statement on
3347   ** the right - the "B" select
3348   */
3349   addrSelectB = sqlite3VdbeCurrentAddr(v) + 1;
3350   addr1 = sqlite3VdbeAddOp3(v, OP_InitCoroutine, regAddrB, 0, addrSelectB);
3351   VdbeComment((v, "right SELECT"));
3352   savedLimit = p->iLimit;
3353   savedOffset = p->iOffset;
3354   p->iLimit = regLimitB;
3355   p->iOffset = 0;
3356   ExplainQueryPlan((pParse, 1, "RIGHT"));
3357   sqlite3Select(pParse, p, &destB);
3358   p->iLimit = savedLimit;
3359   p->iOffset = savedOffset;
3360   sqlite3VdbeEndCoroutine(v, regAddrB);
3361 
3362   /* Generate a subroutine that outputs the current row of the A
3363   ** select as the next output row of the compound select.
3364   */
3365   VdbeNoopComment((v, "Output routine for A"));
3366   addrOutA = generateOutputSubroutine(pParse,
3367                  p, &destA, pDest, regOutA,
3368                  regPrev, pKeyDup, labelEnd);
3369 
3370   /* Generate a subroutine that outputs the current row of the B
3371   ** select as the next output row of the compound select.
3372   */
3373   if( op==TK_ALL || op==TK_UNION ){
3374     VdbeNoopComment((v, "Output routine for B"));
3375     addrOutB = generateOutputSubroutine(pParse,
3376                  p, &destB, pDest, regOutB,
3377                  regPrev, pKeyDup, labelEnd);
3378   }
3379   sqlite3KeyInfoUnref(pKeyDup);
3380 
3381   /* Generate a subroutine to run when the results from select A
3382   ** are exhausted and only data in select B remains.
3383   */
3384   if( op==TK_EXCEPT || op==TK_INTERSECT ){
3385     addrEofA_noB = addrEofA = labelEnd;
3386   }else{
3387     VdbeNoopComment((v, "eof-A subroutine"));
3388     addrEofA = sqlite3VdbeAddOp2(v, OP_Gosub, regOutB, addrOutB);
3389     addrEofA_noB = sqlite3VdbeAddOp2(v, OP_Yield, regAddrB, labelEnd);
3390                                      VdbeCoverage(v);
3391     sqlite3VdbeGoto(v, addrEofA);
3392     p->nSelectRow = sqlite3LogEstAdd(p->nSelectRow, pPrior->nSelectRow);
3393   }
3394 
3395   /* Generate a subroutine to run when the results from select B
3396   ** are exhausted and only data in select A remains.
3397   */
3398   if( op==TK_INTERSECT ){
3399     addrEofB = addrEofA;
3400     if( p->nSelectRow > pPrior->nSelectRow ) p->nSelectRow = pPrior->nSelectRow;
3401   }else{
3402     VdbeNoopComment((v, "eof-B subroutine"));
3403     addrEofB = sqlite3VdbeAddOp2(v, OP_Gosub, regOutA, addrOutA);
3404     sqlite3VdbeAddOp2(v, OP_Yield, regAddrA, labelEnd); VdbeCoverage(v);
3405     sqlite3VdbeGoto(v, addrEofB);
3406   }
3407 
3408   /* Generate code to handle the case of A<B
3409   */
3410   VdbeNoopComment((v, "A-lt-B subroutine"));
3411   addrAltB = sqlite3VdbeAddOp2(v, OP_Gosub, regOutA, addrOutA);
3412   sqlite3VdbeAddOp2(v, OP_Yield, regAddrA, addrEofA); VdbeCoverage(v);
3413   sqlite3VdbeGoto(v, labelCmpr);
3414 
3415   /* Generate code to handle the case of A==B
3416   */
3417   if( op==TK_ALL ){
3418     addrAeqB = addrAltB;
3419   }else if( op==TK_INTERSECT ){
3420     addrAeqB = addrAltB;
3421     addrAltB++;
3422   }else{
3423     VdbeNoopComment((v, "A-eq-B subroutine"));
3424     addrAeqB =
3425     sqlite3VdbeAddOp2(v, OP_Yield, regAddrA, addrEofA); VdbeCoverage(v);
3426     sqlite3VdbeGoto(v, labelCmpr);
3427   }
3428 
3429   /* Generate code to handle the case of A>B
3430   */
3431   VdbeNoopComment((v, "A-gt-B subroutine"));
3432   addrAgtB = sqlite3VdbeCurrentAddr(v);
3433   if( op==TK_ALL || op==TK_UNION ){
3434     sqlite3VdbeAddOp2(v, OP_Gosub, regOutB, addrOutB);
3435   }
3436   sqlite3VdbeAddOp2(v, OP_Yield, regAddrB, addrEofB); VdbeCoverage(v);
3437   sqlite3VdbeGoto(v, labelCmpr);
3438 
3439   /* This code runs once to initialize everything.
3440   */
3441   sqlite3VdbeJumpHere(v, addr1);
3442   sqlite3VdbeAddOp2(v, OP_Yield, regAddrA, addrEofA_noB); VdbeCoverage(v);
3443   sqlite3VdbeAddOp2(v, OP_Yield, regAddrB, addrEofB); VdbeCoverage(v);
3444 
3445   /* Implement the main merge loop
3446   */
3447   sqlite3VdbeResolveLabel(v, labelCmpr);
3448   sqlite3VdbeAddOp4(v, OP_Permutation, 0, 0, 0, (char*)aPermute, P4_INTARRAY);
3449   sqlite3VdbeAddOp4(v, OP_Compare, destA.iSdst, destB.iSdst, nOrderBy,
3450                          (char*)pKeyMerge, P4_KEYINFO);
3451   sqlite3VdbeChangeP5(v, OPFLAG_PERMUTE);
3452   sqlite3VdbeAddOp3(v, OP_Jump, addrAltB, addrAeqB, addrAgtB); VdbeCoverage(v);
3453 
3454   /* Jump to the this point in order to terminate the query.
3455   */
3456   sqlite3VdbeResolveLabel(v, labelEnd);
3457 
3458   /* Reassembly the compound query so that it will be freed correctly
3459   ** by the calling function */
3460   if( p->pPrior ){
3461     sqlite3SelectDelete(db, p->pPrior);
3462   }
3463   p->pPrior = pPrior;
3464   pPrior->pNext = p;
3465 
3466   /*** TBD:  Insert subroutine calls to close cursors on incomplete
3467   **** subqueries ****/
3468   ExplainQueryPlanPop(pParse);
3469   return pParse->nErr!=0;
3470 }
3471 #endif
3472 
3473 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
3474 
3475 /* An instance of the SubstContext object describes an substitution edit
3476 ** to be performed on a parse tree.
3477 **
3478 ** All references to columns in table iTable are to be replaced by corresponding
3479 ** expressions in pEList.
3480 */
3481 typedef struct SubstContext {
3482   Parse *pParse;            /* The parsing context */
3483   int iTable;               /* Replace references to this table */
3484   int iNewTable;            /* New table number */
3485   int isLeftJoin;           /* Add TK_IF_NULL_ROW opcodes on each replacement */
3486   ExprList *pEList;         /* Replacement expressions */
3487 } SubstContext;
3488 
3489 /* Forward Declarations */
3490 static void substExprList(SubstContext*, ExprList*);
3491 static void substSelect(SubstContext*, Select*, int);
3492 
3493 /*
3494 ** Scan through the expression pExpr.  Replace every reference to
3495 ** a column in table number iTable with a copy of the iColumn-th
3496 ** entry in pEList.  (But leave references to the ROWID column
3497 ** unchanged.)
3498 **
3499 ** This routine is part of the flattening procedure.  A subquery
3500 ** whose result set is defined by pEList appears as entry in the
3501 ** FROM clause of a SELECT such that the VDBE cursor assigned to that
3502 ** FORM clause entry is iTable.  This routine makes the necessary
3503 ** changes to pExpr so that it refers directly to the source table
3504 ** of the subquery rather the result set of the subquery.
3505 */
3506 static Expr *substExpr(
3507   SubstContext *pSubst,  /* Description of the substitution */
3508   Expr *pExpr            /* Expr in which substitution occurs */
3509 ){
3510   if( pExpr==0 ) return 0;
3511   if( ExprHasProperty(pExpr, EP_FromJoin)
3512    && pExpr->iRightJoinTable==pSubst->iTable
3513   ){
3514     pExpr->iRightJoinTable = pSubst->iNewTable;
3515   }
3516   if( pExpr->op==TK_COLUMN
3517    && pExpr->iTable==pSubst->iTable
3518    && !ExprHasProperty(pExpr, EP_FixedCol)
3519   ){
3520     if( pExpr->iColumn<0 ){
3521       pExpr->op = TK_NULL;
3522     }else{
3523       Expr *pNew;
3524       Expr *pCopy = pSubst->pEList->a[pExpr->iColumn].pExpr;
3525       Expr ifNullRow;
3526       assert( pSubst->pEList!=0 && pExpr->iColumn<pSubst->pEList->nExpr );
3527       assert( pExpr->pRight==0 );
3528       if( sqlite3ExprIsVector(pCopy) ){
3529         sqlite3VectorErrorMsg(pSubst->pParse, pCopy);
3530       }else{
3531         sqlite3 *db = pSubst->pParse->db;
3532         if( pSubst->isLeftJoin && pCopy->op!=TK_COLUMN ){
3533           memset(&ifNullRow, 0, sizeof(ifNullRow));
3534           ifNullRow.op = TK_IF_NULL_ROW;
3535           ifNullRow.pLeft = pCopy;
3536           ifNullRow.iTable = pSubst->iNewTable;
3537           ifNullRow.flags = EP_IfNullRow;
3538           pCopy = &ifNullRow;
3539         }
3540         testcase( ExprHasProperty(pCopy, EP_Subquery) );
3541         pNew = sqlite3ExprDup(db, pCopy, 0);
3542         if( pNew && pSubst->isLeftJoin ){
3543           ExprSetProperty(pNew, EP_CanBeNull);
3544         }
3545         if( pNew && ExprHasProperty(pExpr,EP_FromJoin) ){
3546           sqlite3SetJoinExpr(pNew, pExpr->iRightJoinTable);
3547         }
3548         sqlite3ExprDelete(db, pExpr);
3549         pExpr = pNew;
3550 
3551         /* Ensure that the expression now has an implicit collation sequence,
3552         ** just as it did when it was a column of a view or sub-query. */
3553         if( pExpr ){
3554           if( pExpr->op!=TK_COLUMN && pExpr->op!=TK_COLLATE ){
3555             CollSeq *pColl = sqlite3ExprCollSeq(pSubst->pParse, pExpr);
3556             pExpr = sqlite3ExprAddCollateString(pSubst->pParse, pExpr,
3557                 (pColl ? pColl->zName : "BINARY")
3558             );
3559           }
3560           ExprClearProperty(pExpr, EP_Collate);
3561         }
3562       }
3563     }
3564   }else{
3565     if( pExpr->op==TK_IF_NULL_ROW && pExpr->iTable==pSubst->iTable ){
3566       pExpr->iTable = pSubst->iNewTable;
3567     }
3568     pExpr->pLeft = substExpr(pSubst, pExpr->pLeft);
3569     pExpr->pRight = substExpr(pSubst, pExpr->pRight);
3570     if( ExprHasProperty(pExpr, EP_xIsSelect) ){
3571       substSelect(pSubst, pExpr->x.pSelect, 1);
3572     }else{
3573       substExprList(pSubst, pExpr->x.pList);
3574     }
3575 #ifndef SQLITE_OMIT_WINDOWFUNC
3576     if( ExprHasProperty(pExpr, EP_WinFunc) ){
3577       Window *pWin = pExpr->y.pWin;
3578       pWin->pFilter = substExpr(pSubst, pWin->pFilter);
3579       substExprList(pSubst, pWin->pPartition);
3580       substExprList(pSubst, pWin->pOrderBy);
3581     }
3582 #endif
3583   }
3584   return pExpr;
3585 }
3586 static void substExprList(
3587   SubstContext *pSubst, /* Description of the substitution */
3588   ExprList *pList       /* List to scan and in which to make substitutes */
3589 ){
3590   int i;
3591   if( pList==0 ) return;
3592   for(i=0; i<pList->nExpr; i++){
3593     pList->a[i].pExpr = substExpr(pSubst, pList->a[i].pExpr);
3594   }
3595 }
3596 static void substSelect(
3597   SubstContext *pSubst, /* Description of the substitution */
3598   Select *p,            /* SELECT statement in which to make substitutions */
3599   int doPrior           /* Do substitutes on p->pPrior too */
3600 ){
3601   SrcList *pSrc;
3602   SrcItem *pItem;
3603   int i;
3604   if( !p ) return;
3605   do{
3606     substExprList(pSubst, p->pEList);
3607     substExprList(pSubst, p->pGroupBy);
3608     substExprList(pSubst, p->pOrderBy);
3609     p->pHaving = substExpr(pSubst, p->pHaving);
3610     p->pWhere = substExpr(pSubst, p->pWhere);
3611     pSrc = p->pSrc;
3612     assert( pSrc!=0 );
3613     for(i=pSrc->nSrc, pItem=pSrc->a; i>0; i--, pItem++){
3614       substSelect(pSubst, pItem->pSelect, 1);
3615       if( pItem->fg.isTabFunc ){
3616         substExprList(pSubst, pItem->u1.pFuncArg);
3617       }
3618     }
3619   }while( doPrior && (p = p->pPrior)!=0 );
3620 }
3621 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
3622 
3623 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
3624 /*
3625 ** pSelect is a SELECT statement and pSrcItem is one item in the FROM
3626 ** clause of that SELECT.
3627 **
3628 ** This routine scans the entire SELECT statement and recomputes the
3629 ** pSrcItem->colUsed mask.
3630 */
3631 static int recomputeColumnsUsedExpr(Walker *pWalker, Expr *pExpr){
3632   SrcItem *pItem;
3633   if( pExpr->op!=TK_COLUMN ) return WRC_Continue;
3634   pItem = pWalker->u.pSrcItem;
3635   if( pItem->iCursor!=pExpr->iTable ) return WRC_Continue;
3636   if( pExpr->iColumn<0 ) return WRC_Continue;
3637   pItem->colUsed |= sqlite3ExprColUsed(pExpr);
3638   return WRC_Continue;
3639 }
3640 static void recomputeColumnsUsed(
3641   Select *pSelect,                 /* The complete SELECT statement */
3642   SrcItem *pSrcItem                /* Which FROM clause item to recompute */
3643 ){
3644   Walker w;
3645   if( NEVER(pSrcItem->pTab==0) ) return;
3646   memset(&w, 0, sizeof(w));
3647   w.xExprCallback = recomputeColumnsUsedExpr;
3648   w.xSelectCallback = sqlite3SelectWalkNoop;
3649   w.u.pSrcItem = pSrcItem;
3650   pSrcItem->colUsed = 0;
3651   sqlite3WalkSelect(&w, pSelect);
3652 }
3653 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
3654 
3655 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
3656 /*
3657 ** Assign new cursor numbers to each of the items in pSrc. For each
3658 ** new cursor number assigned, set an entry in the aCsrMap[] array
3659 ** to map the old cursor number to the new:
3660 **
3661 **     aCsrMap[iOld] = iNew;
3662 **
3663 ** The array is guaranteed by the caller to be large enough for all
3664 ** existing cursor numbers in pSrc.
3665 **
3666 ** If pSrc contains any sub-selects, call this routine recursively
3667 ** on the FROM clause of each such sub-select, with iExcept set to -1.
3668 */
3669 static void srclistRenumberCursors(
3670   Parse *pParse,                  /* Parse context */
3671   int *aCsrMap,                   /* Array to store cursor mappings in */
3672   SrcList *pSrc,                  /* FROM clause to renumber */
3673   int iExcept                     /* FROM clause item to skip */
3674 ){
3675   int i;
3676   SrcItem *pItem;
3677   for(i=0, pItem=pSrc->a; i<pSrc->nSrc; i++, pItem++){
3678     if( i!=iExcept ){
3679       Select *p;
3680       pItem->iCursor = aCsrMap[pItem->iCursor] = pParse->nTab++;
3681       for(p=pItem->pSelect; p; p=p->pPrior){
3682         srclistRenumberCursors(pParse, aCsrMap, p->pSrc, -1);
3683       }
3684     }
3685   }
3686 }
3687 
3688 /*
3689 ** Expression walker callback used by renumberCursors() to update
3690 ** Expr objects to match newly assigned cursor numbers.
3691 */
3692 static int renumberCursorsCb(Walker *pWalker, Expr *pExpr){
3693   int *aCsrMap = pWalker->u.aiCol;
3694   int op = pExpr->op;
3695   if( (op==TK_COLUMN || op==TK_IF_NULL_ROW) && aCsrMap[pExpr->iTable] ){
3696     pExpr->iTable = aCsrMap[pExpr->iTable];
3697   }
3698   if( ExprHasProperty(pExpr, EP_FromJoin) && aCsrMap[pExpr->iRightJoinTable] ){
3699     pExpr->iRightJoinTable = aCsrMap[pExpr->iRightJoinTable];
3700   }
3701   return WRC_Continue;
3702 }
3703 
3704 /*
3705 ** Assign a new cursor number to each cursor in the FROM clause (Select.pSrc)
3706 ** of the SELECT statement passed as the second argument, and to each
3707 ** cursor in the FROM clause of any FROM clause sub-selects, recursively.
3708 ** Except, do not assign a new cursor number to the iExcept'th element in
3709 ** the FROM clause of (*p). Update all expressions and other references
3710 ** to refer to the new cursor numbers.
3711 **
3712 ** Argument aCsrMap is an array that may be used for temporary working
3713 ** space. Two guarantees are made by the caller:
3714 **
3715 **   * the array is larger than the largest cursor number used within the
3716 **     select statement passed as an argument, and
3717 **
3718 **   * the array entries for all cursor numbers that do *not* appear in
3719 **     FROM clauses of the select statement as described above are
3720 **     initialized to zero.
3721 */
3722 static void renumberCursors(
3723   Parse *pParse,                  /* Parse context */
3724   Select *p,                      /* Select to renumber cursors within */
3725   int iExcept,                    /* FROM clause item to skip */
3726   int *aCsrMap                    /* Working space */
3727 ){
3728   Walker w;
3729   srclistRenumberCursors(pParse, aCsrMap, p->pSrc, iExcept);
3730   memset(&w, 0, sizeof(w));
3731   w.u.aiCol = aCsrMap;
3732   w.xExprCallback = renumberCursorsCb;
3733   w.xSelectCallback = sqlite3SelectWalkNoop;
3734   sqlite3WalkSelect(&w, p);
3735 }
3736 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
3737 
3738 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
3739 /*
3740 ** This routine attempts to flatten subqueries as a performance optimization.
3741 ** This routine returns 1 if it makes changes and 0 if no flattening occurs.
3742 **
3743 ** To understand the concept of flattening, consider the following
3744 ** query:
3745 **
3746 **     SELECT a FROM (SELECT x+y AS a FROM t1 WHERE z<100) WHERE a>5
3747 **
3748 ** The default way of implementing this query is to execute the
3749 ** subquery first and store the results in a temporary table, then
3750 ** run the outer query on that temporary table.  This requires two
3751 ** passes over the data.  Furthermore, because the temporary table
3752 ** has no indices, the WHERE clause on the outer query cannot be
3753 ** optimized.
3754 **
3755 ** This routine attempts to rewrite queries such as the above into
3756 ** a single flat select, like this:
3757 **
3758 **     SELECT x+y AS a FROM t1 WHERE z<100 AND a>5
3759 **
3760 ** The code generated for this simplification gives the same result
3761 ** but only has to scan the data once.  And because indices might
3762 ** exist on the table t1, a complete scan of the data might be
3763 ** avoided.
3764 **
3765 ** Flattening is subject to the following constraints:
3766 **
3767 **  (**)  We no longer attempt to flatten aggregate subqueries. Was:
3768 **        The subquery and the outer query cannot both be aggregates.
3769 **
3770 **  (**)  We no longer attempt to flatten aggregate subqueries. Was:
3771 **        (2) If the subquery is an aggregate then
3772 **        (2a) the outer query must not be a join and
3773 **        (2b) the outer query must not use subqueries
3774 **             other than the one FROM-clause subquery that is a candidate
3775 **             for flattening.  (This is due to ticket [2f7170d73bf9abf80]
3776 **             from 2015-02-09.)
3777 **
3778 **   (3)  If the subquery is the right operand of a LEFT JOIN then
3779 **        (3a) the subquery may not be a join and
3780 **        (3b) the FROM clause of the subquery may not contain a virtual
3781 **             table and
3782 **        (3c) the outer query may not be an aggregate.
3783 **        (3d) the outer query may not be DISTINCT.
3784 **
3785 **   (4)  The subquery can not be DISTINCT.
3786 **
3787 **  (**)  At one point restrictions (4) and (5) defined a subset of DISTINCT
3788 **        sub-queries that were excluded from this optimization. Restriction
3789 **        (4) has since been expanded to exclude all DISTINCT subqueries.
3790 **
3791 **  (**)  We no longer attempt to flatten aggregate subqueries.  Was:
3792 **        If the subquery is aggregate, the outer query may not be DISTINCT.
3793 **
3794 **   (7)  The subquery must have a FROM clause.  TODO:  For subqueries without
3795 **        A FROM clause, consider adding a FROM clause with the special
3796 **        table sqlite_once that consists of a single row containing a
3797 **        single NULL.
3798 **
3799 **   (8)  If the subquery uses LIMIT then the outer query may not be a join.
3800 **
3801 **   (9)  If the subquery uses LIMIT then the outer query may not be aggregate.
3802 **
3803 **  (**)  Restriction (10) was removed from the code on 2005-02-05 but we
3804 **        accidently carried the comment forward until 2014-09-15.  Original
3805 **        constraint: "If the subquery is aggregate then the outer query
3806 **        may not use LIMIT."
3807 **
3808 **  (11)  The subquery and the outer query may not both have ORDER BY clauses.
3809 **
3810 **  (**)  Not implemented.  Subsumed into restriction (3).  Was previously
3811 **        a separate restriction deriving from ticket #350.
3812 **
3813 **  (13)  The subquery and outer query may not both use LIMIT.
3814 **
3815 **  (14)  The subquery may not use OFFSET.
3816 **
3817 **  (15)  If the outer query is part of a compound select, then the
3818 **        subquery may not use LIMIT.
3819 **        (See ticket #2339 and ticket [02a8e81d44]).
3820 **
3821 **  (16)  If the outer query is aggregate, then the subquery may not
3822 **        use ORDER BY.  (Ticket #2942)  This used to not matter
3823 **        until we introduced the group_concat() function.
3824 **
3825 **  (17)  If the subquery is a compound select, then
3826 **        (17a) all compound operators must be a UNION ALL, and
3827 **        (17b) no terms within the subquery compound may be aggregate
3828 **              or DISTINCT, and
3829 **        (17c) every term within the subquery compound must have a FROM clause
3830 **        (17d) the outer query may not be
3831 **              (17d1) aggregate, or
3832 **              (17d2) DISTINCT
3833 **        (17e) the subquery may not contain window functions, and
3834 **        (17f) the subquery must not be the RHS of a LEFT JOIN.
3835 **
3836 **        The parent and sub-query may contain WHERE clauses. Subject to
3837 **        rules (11), (13) and (14), they may also contain ORDER BY,
3838 **        LIMIT and OFFSET clauses.  The subquery cannot use any compound
3839 **        operator other than UNION ALL because all the other compound
3840 **        operators have an implied DISTINCT which is disallowed by
3841 **        restriction (4).
3842 **
3843 **        Also, each component of the sub-query must return the same number
3844 **        of result columns. This is actually a requirement for any compound
3845 **        SELECT statement, but all the code here does is make sure that no
3846 **        such (illegal) sub-query is flattened. The caller will detect the
3847 **        syntax error and return a detailed message.
3848 **
3849 **  (18)  If the sub-query is a compound select, then all terms of the
3850 **        ORDER BY clause of the parent must be copies of a term returned
3851 **        by the parent query.
3852 **
3853 **  (19)  If the subquery uses LIMIT then the outer query may not
3854 **        have a WHERE clause.
3855 **
3856 **  (20)  If the sub-query is a compound select, then it must not use
3857 **        an ORDER BY clause.  Ticket #3773.  We could relax this constraint
3858 **        somewhat by saying that the terms of the ORDER BY clause must
3859 **        appear as unmodified result columns in the outer query.  But we
3860 **        have other optimizations in mind to deal with that case.
3861 **
3862 **  (21)  If the subquery uses LIMIT then the outer query may not be
3863 **        DISTINCT.  (See ticket [752e1646fc]).
3864 **
3865 **  (22)  The subquery may not be a recursive CTE.
3866 **
3867 **  (23)  If the outer query is a recursive CTE, then the sub-query may not be
3868 **        a compound query.  This restriction is because transforming the
3869 **        parent to a compound query confuses the code that handles
3870 **        recursive queries in multiSelect().
3871 **
3872 **  (**)  We no longer attempt to flatten aggregate subqueries.  Was:
3873 **        The subquery may not be an aggregate that uses the built-in min() or
3874 **        or max() functions.  (Without this restriction, a query like:
3875 **        "SELECT x FROM (SELECT max(y), x FROM t1)" would not necessarily
3876 **        return the value X for which Y was maximal.)
3877 **
3878 **  (25)  If either the subquery or the parent query contains a window
3879 **        function in the select list or ORDER BY clause, flattening
3880 **        is not attempted.
3881 **
3882 **
3883 ** In this routine, the "p" parameter is a pointer to the outer query.
3884 ** The subquery is p->pSrc->a[iFrom].  isAgg is true if the outer query
3885 ** uses aggregates.
3886 **
3887 ** If flattening is not attempted, this routine is a no-op and returns 0.
3888 ** If flattening is attempted this routine returns 1.
3889 **
3890 ** All of the expression analysis must occur on both the outer query and
3891 ** the subquery before this routine runs.
3892 */
3893 static int flattenSubquery(
3894   Parse *pParse,       /* Parsing context */
3895   Select *p,           /* The parent or outer SELECT statement */
3896   int iFrom,           /* Index in p->pSrc->a[] of the inner subquery */
3897   int isAgg            /* True if outer SELECT uses aggregate functions */
3898 ){
3899   const char *zSavedAuthContext = pParse->zAuthContext;
3900   Select *pParent;    /* Current UNION ALL term of the other query */
3901   Select *pSub;       /* The inner query or "subquery" */
3902   Select *pSub1;      /* Pointer to the rightmost select in sub-query */
3903   SrcList *pSrc;      /* The FROM clause of the outer query */
3904   SrcList *pSubSrc;   /* The FROM clause of the subquery */
3905   int iParent;        /* VDBE cursor number of the pSub result set temp table */
3906   int iNewParent = -1;/* Replacement table for iParent */
3907   int isLeftJoin = 0; /* True if pSub is the right side of a LEFT JOIN */
3908   int i;              /* Loop counter */
3909   Expr *pWhere;                    /* The WHERE clause */
3910   SrcItem *pSubitem;               /* The subquery */
3911   sqlite3 *db = pParse->db;
3912   Walker w;                        /* Walker to persist agginfo data */
3913   int *aCsrMap = 0;
3914 
3915   /* Check to see if flattening is permitted.  Return 0 if not.
3916   */
3917   assert( p!=0 );
3918   assert( p->pPrior==0 );
3919   if( OptimizationDisabled(db, SQLITE_QueryFlattener) ) return 0;
3920   pSrc = p->pSrc;
3921   assert( pSrc && iFrom>=0 && iFrom<pSrc->nSrc );
3922   pSubitem = &pSrc->a[iFrom];
3923   iParent = pSubitem->iCursor;
3924   pSub = pSubitem->pSelect;
3925   assert( pSub!=0 );
3926 
3927 #ifndef SQLITE_OMIT_WINDOWFUNC
3928   if( p->pWin || pSub->pWin ) return 0;                  /* Restriction (25) */
3929 #endif
3930 
3931   pSubSrc = pSub->pSrc;
3932   assert( pSubSrc );
3933   /* Prior to version 3.1.2, when LIMIT and OFFSET had to be simple constants,
3934   ** not arbitrary expressions, we allowed some combining of LIMIT and OFFSET
3935   ** because they could be computed at compile-time.  But when LIMIT and OFFSET
3936   ** became arbitrary expressions, we were forced to add restrictions (13)
3937   ** and (14). */
3938   if( pSub->pLimit && p->pLimit ) return 0;              /* Restriction (13) */
3939   if( pSub->pLimit && pSub->pLimit->pRight ) return 0;   /* Restriction (14) */
3940   if( (p->selFlags & SF_Compound)!=0 && pSub->pLimit ){
3941     return 0;                                            /* Restriction (15) */
3942   }
3943   if( pSubSrc->nSrc==0 ) return 0;                       /* Restriction (7)  */
3944   if( pSub->selFlags & SF_Distinct ) return 0;           /* Restriction (4)  */
3945   if( pSub->pLimit && (pSrc->nSrc>1 || isAgg) ){
3946      return 0;         /* Restrictions (8)(9) */
3947   }
3948   if( p->pOrderBy && pSub->pOrderBy ){
3949      return 0;                                           /* Restriction (11) */
3950   }
3951   if( isAgg && pSub->pOrderBy ) return 0;                /* Restriction (16) */
3952   if( pSub->pLimit && p->pWhere ) return 0;              /* Restriction (19) */
3953   if( pSub->pLimit && (p->selFlags & SF_Distinct)!=0 ){
3954      return 0;         /* Restriction (21) */
3955   }
3956   if( pSub->selFlags & (SF_Recursive) ){
3957     return 0; /* Restrictions (22) */
3958   }
3959 
3960   /*
3961   ** If the subquery is the right operand of a LEFT JOIN, then the
3962   ** subquery may not be a join itself (3a). Example of why this is not
3963   ** allowed:
3964   **
3965   **         t1 LEFT OUTER JOIN (t2 JOIN t3)
3966   **
3967   ** If we flatten the above, we would get
3968   **
3969   **         (t1 LEFT OUTER JOIN t2) JOIN t3
3970   **
3971   ** which is not at all the same thing.
3972   **
3973   ** If the subquery is the right operand of a LEFT JOIN, then the outer
3974   ** query cannot be an aggregate. (3c)  This is an artifact of the way
3975   ** aggregates are processed - there is no mechanism to determine if
3976   ** the LEFT JOIN table should be all-NULL.
3977   **
3978   ** See also tickets #306, #350, and #3300.
3979   */
3980   if( (pSubitem->fg.jointype & JT_OUTER)!=0 ){
3981     isLeftJoin = 1;
3982     if( pSubSrc->nSrc>1                   /* (3a) */
3983      || isAgg                             /* (3b) */
3984      || IsVirtual(pSubSrc->a[0].pTab)     /* (3c) */
3985      || (p->selFlags & SF_Distinct)!=0    /* (3d) */
3986     ){
3987       return 0;
3988     }
3989   }
3990 #ifdef SQLITE_EXTRA_IFNULLROW
3991   else if( iFrom>0 && !isAgg ){
3992     /* Setting isLeftJoin to -1 causes OP_IfNullRow opcodes to be generated for
3993     ** every reference to any result column from subquery in a join, even
3994     ** though they are not necessary.  This will stress-test the OP_IfNullRow
3995     ** opcode. */
3996     isLeftJoin = -1;
3997   }
3998 #endif
3999 
4000   /* Restriction (17): If the sub-query is a compound SELECT, then it must
4001   ** use only the UNION ALL operator. And none of the simple select queries
4002   ** that make up the compound SELECT are allowed to be aggregate or distinct
4003   ** queries.
4004   */
4005   if( pSub->pPrior ){
4006     if( pSub->pOrderBy ){
4007       return 0;  /* Restriction (20) */
4008     }
4009     if( isAgg || (p->selFlags & SF_Distinct)!=0 || isLeftJoin>0 ){
4010       return 0; /* (17d1), (17d2), or (17f) */
4011     }
4012     for(pSub1=pSub; pSub1; pSub1=pSub1->pPrior){
4013       testcase( (pSub1->selFlags & (SF_Distinct|SF_Aggregate))==SF_Distinct );
4014       testcase( (pSub1->selFlags & (SF_Distinct|SF_Aggregate))==SF_Aggregate );
4015       assert( pSub->pSrc!=0 );
4016       assert( (pSub->selFlags & SF_Recursive)==0 );
4017       assert( pSub->pEList->nExpr==pSub1->pEList->nExpr );
4018       if( (pSub1->selFlags & (SF_Distinct|SF_Aggregate))!=0    /* (17b) */
4019        || (pSub1->pPrior && pSub1->op!=TK_ALL)                 /* (17a) */
4020        || pSub1->pSrc->nSrc<1                                  /* (17c) */
4021 #ifndef SQLITE_OMIT_WINDOWFUNC
4022        || pSub1->pWin                                          /* (17e) */
4023 #endif
4024       ){
4025         return 0;
4026       }
4027       testcase( pSub1->pSrc->nSrc>1 );
4028     }
4029 
4030     /* Restriction (18). */
4031     if( p->pOrderBy ){
4032       int ii;
4033       for(ii=0; ii<p->pOrderBy->nExpr; ii++){
4034         if( p->pOrderBy->a[ii].u.x.iOrderByCol==0 ) return 0;
4035       }
4036     }
4037 
4038     /* Restriction (23) */
4039     if( (p->selFlags & SF_Recursive) ) return 0;
4040 
4041     if( pSrc->nSrc>1 ){
4042       if( pParse->nSelect>500 ) return 0;
4043       aCsrMap = sqlite3DbMallocZero(db, pParse->nTab*sizeof(int));
4044     }
4045   }
4046 
4047   /***** If we reach this point, flattening is permitted. *****/
4048   SELECTTRACE(1,pParse,p,("flatten %u.%p from term %d\n",
4049                    pSub->selId, pSub, iFrom));
4050 
4051   /* Authorize the subquery */
4052   pParse->zAuthContext = pSubitem->zName;
4053   TESTONLY(i =) sqlite3AuthCheck(pParse, SQLITE_SELECT, 0, 0, 0);
4054   testcase( i==SQLITE_DENY );
4055   pParse->zAuthContext = zSavedAuthContext;
4056 
4057   /* Delete the transient structures associated with thesubquery */
4058   pSub1 = pSubitem->pSelect;
4059   sqlite3DbFree(db, pSubitem->zDatabase);
4060   sqlite3DbFree(db, pSubitem->zName);
4061   sqlite3DbFree(db, pSubitem->zAlias);
4062   pSubitem->zDatabase = 0;
4063   pSubitem->zName = 0;
4064   pSubitem->zAlias = 0;
4065   pSubitem->pSelect = 0;
4066   assert( pSubitem->pOn==0 );
4067 
4068   /* If the sub-query is a compound SELECT statement, then (by restrictions
4069   ** 17 and 18 above) it must be a UNION ALL and the parent query must
4070   ** be of the form:
4071   **
4072   **     SELECT <expr-list> FROM (<sub-query>) <where-clause>
4073   **
4074   ** followed by any ORDER BY, LIMIT and/or OFFSET clauses. This block
4075   ** creates N-1 copies of the parent query without any ORDER BY, LIMIT or
4076   ** OFFSET clauses and joins them to the left-hand-side of the original
4077   ** using UNION ALL operators. In this case N is the number of simple
4078   ** select statements in the compound sub-query.
4079   **
4080   ** Example:
4081   **
4082   **     SELECT a+1 FROM (
4083   **        SELECT x FROM tab
4084   **        UNION ALL
4085   **        SELECT y FROM tab
4086   **        UNION ALL
4087   **        SELECT abs(z*2) FROM tab2
4088   **     ) WHERE a!=5 ORDER BY 1
4089   **
4090   ** Transformed into:
4091   **
4092   **     SELECT x+1 FROM tab WHERE x+1!=5
4093   **     UNION ALL
4094   **     SELECT y+1 FROM tab WHERE y+1!=5
4095   **     UNION ALL
4096   **     SELECT abs(z*2)+1 FROM tab2 WHERE abs(z*2)+1!=5
4097   **     ORDER BY 1
4098   **
4099   ** We call this the "compound-subquery flattening".
4100   */
4101   for(pSub=pSub->pPrior; pSub; pSub=pSub->pPrior){
4102     Select *pNew;
4103     ExprList *pOrderBy = p->pOrderBy;
4104     Expr *pLimit = p->pLimit;
4105     Select *pPrior = p->pPrior;
4106     Table *pItemTab = pSubitem->pTab;
4107     pSubitem->pTab = 0;
4108     p->pOrderBy = 0;
4109     p->pPrior = 0;
4110     p->pLimit = 0;
4111     pNew = sqlite3SelectDup(db, p, 0);
4112     p->pLimit = pLimit;
4113     p->pOrderBy = pOrderBy;
4114     p->op = TK_ALL;
4115     pSubitem->pTab = pItemTab;
4116     if( pNew==0 ){
4117       p->pPrior = pPrior;
4118     }else{
4119       pNew->selId = ++pParse->nSelect;
4120       if( aCsrMap && db->mallocFailed==0 ){
4121         renumberCursors(pParse, pNew, iFrom, aCsrMap);
4122       }
4123       pNew->pPrior = pPrior;
4124       if( pPrior ) pPrior->pNext = pNew;
4125       pNew->pNext = p;
4126       p->pPrior = pNew;
4127       SELECTTRACE(2,pParse,p,("compound-subquery flattener"
4128                               " creates %u as peer\n",pNew->selId));
4129     }
4130     assert( pSubitem->pSelect==0 );
4131   }
4132   sqlite3DbFree(db, aCsrMap);
4133   if( db->mallocFailed ){
4134     pSubitem->pSelect = pSub1;
4135     return 1;
4136   }
4137 
4138   /* Defer deleting the Table object associated with the
4139   ** subquery until code generation is
4140   ** complete, since there may still exist Expr.pTab entries that
4141   ** refer to the subquery even after flattening.  Ticket #3346.
4142   **
4143   ** pSubitem->pTab is always non-NULL by test restrictions and tests above.
4144   */
4145   if( ALWAYS(pSubitem->pTab!=0) ){
4146     Table *pTabToDel = pSubitem->pTab;
4147     if( pTabToDel->nTabRef==1 ){
4148       Parse *pToplevel = sqlite3ParseToplevel(pParse);
4149       sqlite3ParserAddCleanup(pToplevel,
4150          (void(*)(sqlite3*,void*))sqlite3DeleteTable,
4151          pTabToDel);
4152       testcase( pToplevel->earlyCleanup );
4153     }else{
4154       pTabToDel->nTabRef--;
4155     }
4156     pSubitem->pTab = 0;
4157   }
4158 
4159   /* The following loop runs once for each term in a compound-subquery
4160   ** flattening (as described above).  If we are doing a different kind
4161   ** of flattening - a flattening other than a compound-subquery flattening -
4162   ** then this loop only runs once.
4163   **
4164   ** This loop moves all of the FROM elements of the subquery into the
4165   ** the FROM clause of the outer query.  Before doing this, remember
4166   ** the cursor number for the original outer query FROM element in
4167   ** iParent.  The iParent cursor will never be used.  Subsequent code
4168   ** will scan expressions looking for iParent references and replace
4169   ** those references with expressions that resolve to the subquery FROM
4170   ** elements we are now copying in.
4171   */
4172   pSub = pSub1;
4173   for(pParent=p; pParent; pParent=pParent->pPrior, pSub=pSub->pPrior){
4174     int nSubSrc;
4175     u8 jointype = 0;
4176     assert( pSub!=0 );
4177     pSubSrc = pSub->pSrc;     /* FROM clause of subquery */
4178     nSubSrc = pSubSrc->nSrc;  /* Number of terms in subquery FROM clause */
4179     pSrc = pParent->pSrc;     /* FROM clause of the outer query */
4180 
4181     if( pParent==p ){
4182       jointype = pSubitem->fg.jointype;     /* First time through the loop */
4183     }
4184 
4185     /* The subquery uses a single slot of the FROM clause of the outer
4186     ** query.  If the subquery has more than one element in its FROM clause,
4187     ** then expand the outer query to make space for it to hold all elements
4188     ** of the subquery.
4189     **
4190     ** Example:
4191     **
4192     **    SELECT * FROM tabA, (SELECT * FROM sub1, sub2), tabB;
4193     **
4194     ** The outer query has 3 slots in its FROM clause.  One slot of the
4195     ** outer query (the middle slot) is used by the subquery.  The next
4196     ** block of code will expand the outer query FROM clause to 4 slots.
4197     ** The middle slot is expanded to two slots in order to make space
4198     ** for the two elements in the FROM clause of the subquery.
4199     */
4200     if( nSubSrc>1 ){
4201       pSrc = sqlite3SrcListEnlarge(pParse, pSrc, nSubSrc-1,iFrom+1);
4202       if( pSrc==0 ) break;
4203       pParent->pSrc = pSrc;
4204     }
4205 
4206     /* Transfer the FROM clause terms from the subquery into the
4207     ** outer query.
4208     */
4209     for(i=0; i<nSubSrc; i++){
4210       sqlite3IdListDelete(db, pSrc->a[i+iFrom].pUsing);
4211       assert( pSrc->a[i+iFrom].fg.isTabFunc==0 );
4212       pSrc->a[i+iFrom] = pSubSrc->a[i];
4213       iNewParent = pSubSrc->a[i].iCursor;
4214       memset(&pSubSrc->a[i], 0, sizeof(pSubSrc->a[i]));
4215     }
4216     pSrc->a[iFrom].fg.jointype = jointype;
4217 
4218     /* Now begin substituting subquery result set expressions for
4219     ** references to the iParent in the outer query.
4220     **
4221     ** Example:
4222     **
4223     **   SELECT a+5, b*10 FROM (SELECT x*3 AS a, y+10 AS b FROM t1) WHERE a>b;
4224     **   \                     \_____________ subquery __________/          /
4225     **    \_____________________ outer query ______________________________/
4226     **
4227     ** We look at every expression in the outer query and every place we see
4228     ** "a" we substitute "x*3" and every place we see "b" we substitute "y+10".
4229     */
4230     if( pSub->pOrderBy && (pParent->selFlags & SF_NoopOrderBy)==0 ){
4231       /* At this point, any non-zero iOrderByCol values indicate that the
4232       ** ORDER BY column expression is identical to the iOrderByCol'th
4233       ** expression returned by SELECT statement pSub. Since these values
4234       ** do not necessarily correspond to columns in SELECT statement pParent,
4235       ** zero them before transfering the ORDER BY clause.
4236       **
4237       ** Not doing this may cause an error if a subsequent call to this
4238       ** function attempts to flatten a compound sub-query into pParent
4239       ** (the only way this can happen is if the compound sub-query is
4240       ** currently part of pSub->pSrc). See ticket [d11a6e908f].  */
4241       ExprList *pOrderBy = pSub->pOrderBy;
4242       for(i=0; i<pOrderBy->nExpr; i++){
4243         pOrderBy->a[i].u.x.iOrderByCol = 0;
4244       }
4245       assert( pParent->pOrderBy==0 );
4246       pParent->pOrderBy = pOrderBy;
4247       pSub->pOrderBy = 0;
4248     }
4249     pWhere = pSub->pWhere;
4250     pSub->pWhere = 0;
4251     if( isLeftJoin>0 ){
4252       sqlite3SetJoinExpr(pWhere, iNewParent);
4253     }
4254     if( pWhere ){
4255       if( pParent->pWhere ){
4256         pParent->pWhere = sqlite3PExpr(pParse, TK_AND, pWhere, pParent->pWhere);
4257       }else{
4258         pParent->pWhere = pWhere;
4259       }
4260     }
4261     if( db->mallocFailed==0 ){
4262       SubstContext x;
4263       x.pParse = pParse;
4264       x.iTable = iParent;
4265       x.iNewTable = iNewParent;
4266       x.isLeftJoin = isLeftJoin;
4267       x.pEList = pSub->pEList;
4268       substSelect(&x, pParent, 0);
4269     }
4270 
4271     /* The flattened query is a compound if either the inner or the
4272     ** outer query is a compound. */
4273     pParent->selFlags |= pSub->selFlags & SF_Compound;
4274     assert( (pSub->selFlags & SF_Distinct)==0 ); /* restriction (17b) */
4275 
4276     /*
4277     ** SELECT ... FROM (SELECT ... LIMIT a OFFSET b) LIMIT x OFFSET y;
4278     **
4279     ** One is tempted to try to add a and b to combine the limits.  But this
4280     ** does not work if either limit is negative.
4281     */
4282     if( pSub->pLimit ){
4283       pParent->pLimit = pSub->pLimit;
4284       pSub->pLimit = 0;
4285     }
4286 
4287     /* Recompute the SrcList_item.colUsed masks for the flattened
4288     ** tables. */
4289     for(i=0; i<nSubSrc; i++){
4290       recomputeColumnsUsed(pParent, &pSrc->a[i+iFrom]);
4291     }
4292   }
4293 
4294   /* Finially, delete what is left of the subquery and return
4295   ** success.
4296   */
4297   sqlite3AggInfoPersistWalkerInit(&w, pParse);
4298   sqlite3WalkSelect(&w,pSub1);
4299   sqlite3SelectDelete(db, pSub1);
4300 
4301 #if SELECTTRACE_ENABLED
4302   if( sqlite3SelectTrace & 0x100 ){
4303     SELECTTRACE(0x100,pParse,p,("After flattening:\n"));
4304     sqlite3TreeViewSelect(0, p, 0);
4305   }
4306 #endif
4307 
4308   return 1;
4309 }
4310 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
4311 
4312 /*
4313 ** A structure to keep track of all of the column values that are fixed to
4314 ** a known value due to WHERE clause constraints of the form COLUMN=VALUE.
4315 */
4316 typedef struct WhereConst WhereConst;
4317 struct WhereConst {
4318   Parse *pParse;   /* Parsing context */
4319   int nConst;      /* Number for COLUMN=CONSTANT terms */
4320   int nChng;       /* Number of times a constant is propagated */
4321   Expr **apExpr;   /* [i*2] is COLUMN and [i*2+1] is VALUE */
4322 };
4323 
4324 /*
4325 ** Add a new entry to the pConst object.  Except, do not add duplicate
4326 ** pColumn entires.  Also, do not add if doing so would not be appropriate.
4327 **
4328 ** The caller guarantees the pColumn is a column and pValue is a constant.
4329 ** This routine has to do some additional checks before completing the
4330 ** insert.
4331 */
4332 static void constInsert(
4333   WhereConst *pConst,  /* The WhereConst into which we are inserting */
4334   Expr *pColumn,       /* The COLUMN part of the constraint */
4335   Expr *pValue,        /* The VALUE part of the constraint */
4336   Expr *pExpr          /* Overall expression: COLUMN=VALUE or VALUE=COLUMN */
4337 ){
4338   int i;
4339   assert( pColumn->op==TK_COLUMN );
4340   assert( sqlite3ExprIsConstant(pValue) );
4341 
4342   if( ExprHasProperty(pColumn, EP_FixedCol) ) return;
4343   if( sqlite3ExprAffinity(pValue)!=0 ) return;
4344   if( !sqlite3IsBinary(sqlite3ExprCompareCollSeq(pConst->pParse,pExpr)) ){
4345     return;
4346   }
4347 
4348   /* 2018-10-25 ticket [cf5ed20f]
4349   ** Make sure the same pColumn is not inserted more than once */
4350   for(i=0; i<pConst->nConst; i++){
4351     const Expr *pE2 = pConst->apExpr[i*2];
4352     assert( pE2->op==TK_COLUMN );
4353     if( pE2->iTable==pColumn->iTable
4354      && pE2->iColumn==pColumn->iColumn
4355     ){
4356       return;  /* Already present.  Return without doing anything. */
4357     }
4358   }
4359 
4360   pConst->nConst++;
4361   pConst->apExpr = sqlite3DbReallocOrFree(pConst->pParse->db, pConst->apExpr,
4362                          pConst->nConst*2*sizeof(Expr*));
4363   if( pConst->apExpr==0 ){
4364     pConst->nConst = 0;
4365   }else{
4366     pConst->apExpr[pConst->nConst*2-2] = pColumn;
4367     pConst->apExpr[pConst->nConst*2-1] = pValue;
4368   }
4369 }
4370 
4371 /*
4372 ** Find all terms of COLUMN=VALUE or VALUE=COLUMN in pExpr where VALUE
4373 ** is a constant expression and where the term must be true because it
4374 ** is part of the AND-connected terms of the expression.  For each term
4375 ** found, add it to the pConst structure.
4376 */
4377 static void findConstInWhere(WhereConst *pConst, Expr *pExpr){
4378   Expr *pRight, *pLeft;
4379   if( pExpr==0 ) return;
4380   if( ExprHasProperty(pExpr, EP_FromJoin) ) return;
4381   if( pExpr->op==TK_AND ){
4382     findConstInWhere(pConst, pExpr->pRight);
4383     findConstInWhere(pConst, pExpr->pLeft);
4384     return;
4385   }
4386   if( pExpr->op!=TK_EQ ) return;
4387   pRight = pExpr->pRight;
4388   pLeft = pExpr->pLeft;
4389   assert( pRight!=0 );
4390   assert( pLeft!=0 );
4391   if( pRight->op==TK_COLUMN && sqlite3ExprIsConstant(pLeft) ){
4392     constInsert(pConst,pRight,pLeft,pExpr);
4393   }
4394   if( pLeft->op==TK_COLUMN && sqlite3ExprIsConstant(pRight) ){
4395     constInsert(pConst,pLeft,pRight,pExpr);
4396   }
4397 }
4398 
4399 /*
4400 ** This is a Walker expression callback.  pExpr is a candidate expression
4401 ** to be replaced by a value.  If pExpr is equivalent to one of the
4402 ** columns named in pWalker->u.pConst, then overwrite it with its
4403 ** corresponding value.
4404 */
4405 static int propagateConstantExprRewrite(Walker *pWalker, Expr *pExpr){
4406   int i;
4407   WhereConst *pConst;
4408   if( pExpr->op!=TK_COLUMN ) return WRC_Continue;
4409   if( ExprHasProperty(pExpr, EP_FixedCol|EP_FromJoin) ){
4410     testcase( ExprHasProperty(pExpr, EP_FixedCol) );
4411     testcase( ExprHasProperty(pExpr, EP_FromJoin) );
4412     return WRC_Continue;
4413   }
4414   pConst = pWalker->u.pConst;
4415   for(i=0; i<pConst->nConst; i++){
4416     Expr *pColumn = pConst->apExpr[i*2];
4417     if( pColumn==pExpr ) continue;
4418     if( pColumn->iTable!=pExpr->iTable ) continue;
4419     if( pColumn->iColumn!=pExpr->iColumn ) continue;
4420     /* A match is found.  Add the EP_FixedCol property */
4421     pConst->nChng++;
4422     ExprClearProperty(pExpr, EP_Leaf);
4423     ExprSetProperty(pExpr, EP_FixedCol);
4424     assert( pExpr->pLeft==0 );
4425     pExpr->pLeft = sqlite3ExprDup(pConst->pParse->db, pConst->apExpr[i*2+1], 0);
4426     break;
4427   }
4428   return WRC_Prune;
4429 }
4430 
4431 /*
4432 ** The WHERE-clause constant propagation optimization.
4433 **
4434 ** If the WHERE clause contains terms of the form COLUMN=CONSTANT or
4435 ** CONSTANT=COLUMN that are top-level AND-connected terms that are not
4436 ** part of a ON clause from a LEFT JOIN, then throughout the query
4437 ** replace all other occurrences of COLUMN with CONSTANT.
4438 **
4439 ** For example, the query:
4440 **
4441 **      SELECT * FROM t1, t2, t3 WHERE t1.a=39 AND t2.b=t1.a AND t3.c=t2.b
4442 **
4443 ** Is transformed into
4444 **
4445 **      SELECT * FROM t1, t2, t3 WHERE t1.a=39 AND t2.b=39 AND t3.c=39
4446 **
4447 ** Return true if any transformations where made and false if not.
4448 **
4449 ** Implementation note:  Constant propagation is tricky due to affinity
4450 ** and collating sequence interactions.  Consider this example:
4451 **
4452 **    CREATE TABLE t1(a INT,b TEXT);
4453 **    INSERT INTO t1 VALUES(123,'0123');
4454 **    SELECT * FROM t1 WHERE a=123 AND b=a;
4455 **    SELECT * FROM t1 WHERE a=123 AND b=123;
4456 **
4457 ** The two SELECT statements above should return different answers.  b=a
4458 ** is alway true because the comparison uses numeric affinity, but b=123
4459 ** is false because it uses text affinity and '0123' is not the same as '123'.
4460 ** To work around this, the expression tree is not actually changed from
4461 ** "b=a" to "b=123" but rather the "a" in "b=a" is tagged with EP_FixedCol
4462 ** and the "123" value is hung off of the pLeft pointer.  Code generator
4463 ** routines know to generate the constant "123" instead of looking up the
4464 ** column value.  Also, to avoid collation problems, this optimization is
4465 ** only attempted if the "a=123" term uses the default BINARY collation.
4466 */
4467 static int propagateConstants(
4468   Parse *pParse,   /* The parsing context */
4469   Select *p        /* The query in which to propagate constants */
4470 ){
4471   WhereConst x;
4472   Walker w;
4473   int nChng = 0;
4474   x.pParse = pParse;
4475   do{
4476     x.nConst = 0;
4477     x.nChng = 0;
4478     x.apExpr = 0;
4479     findConstInWhere(&x, p->pWhere);
4480     if( x.nConst ){
4481       memset(&w, 0, sizeof(w));
4482       w.pParse = pParse;
4483       w.xExprCallback = propagateConstantExprRewrite;
4484       w.xSelectCallback = sqlite3SelectWalkNoop;
4485       w.xSelectCallback2 = 0;
4486       w.walkerDepth = 0;
4487       w.u.pConst = &x;
4488       sqlite3WalkExpr(&w, p->pWhere);
4489       sqlite3DbFree(x.pParse->db, x.apExpr);
4490       nChng += x.nChng;
4491     }
4492   }while( x.nChng );
4493   return nChng;
4494 }
4495 
4496 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
4497 # if !defined(SQLITE_OMIT_WINDOWFUNC)
4498 /*
4499 ** This function is called to determine whether or not it is safe to
4500 ** push WHERE clause expression pExpr down to FROM clause sub-query
4501 ** pSubq, which contains at least one window function. Return 1
4502 ** if it is safe and the expression should be pushed down, or 0
4503 ** otherwise.
4504 **
4505 ** It is only safe to push the expression down if it consists only
4506 ** of constants and copies of expressions that appear in the PARTITION
4507 ** BY clause of all window function used by the sub-query. It is safe
4508 ** to filter out entire partitions, but not rows within partitions, as
4509 ** this may change the results of the window functions.
4510 **
4511 ** At the time this function is called it is guaranteed that
4512 **
4513 **   * the sub-query uses only one distinct window frame, and
4514 **   * that the window frame has a PARTITION BY clase.
4515 */
4516 static int pushDownWindowCheck(Parse *pParse, Select *pSubq, Expr *pExpr){
4517   assert( pSubq->pWin->pPartition );
4518   assert( (pSubq->selFlags & SF_MultiPart)==0 );
4519   assert( pSubq->pPrior==0 );
4520   return sqlite3ExprIsConstantOrGroupBy(pParse, pExpr, pSubq->pWin->pPartition);
4521 }
4522 # endif /* SQLITE_OMIT_WINDOWFUNC */
4523 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
4524 
4525 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
4526 /*
4527 ** Make copies of relevant WHERE clause terms of the outer query into
4528 ** the WHERE clause of subquery.  Example:
4529 **
4530 **    SELECT * FROM (SELECT a AS x, c-d AS y FROM t1) WHERE x=5 AND y=10;
4531 **
4532 ** Transformed into:
4533 **
4534 **    SELECT * FROM (SELECT a AS x, c-d AS y FROM t1 WHERE a=5 AND c-d=10)
4535 **     WHERE x=5 AND y=10;
4536 **
4537 ** The hope is that the terms added to the inner query will make it more
4538 ** efficient.
4539 **
4540 ** Do not attempt this optimization if:
4541 **
4542 **   (1) (** This restriction was removed on 2017-09-29.  We used to
4543 **           disallow this optimization for aggregate subqueries, but now
4544 **           it is allowed by putting the extra terms on the HAVING clause.
4545 **           The added HAVING clause is pointless if the subquery lacks
4546 **           a GROUP BY clause.  But such a HAVING clause is also harmless
4547 **           so there does not appear to be any reason to add extra logic
4548 **           to suppress it. **)
4549 **
4550 **   (2) The inner query is the recursive part of a common table expression.
4551 **
4552 **   (3) The inner query has a LIMIT clause (since the changes to the WHERE
4553 **       clause would change the meaning of the LIMIT).
4554 **
4555 **   (4) The inner query is the right operand of a LEFT JOIN and the
4556 **       expression to be pushed down does not come from the ON clause
4557 **       on that LEFT JOIN.
4558 **
4559 **   (5) The WHERE clause expression originates in the ON or USING clause
4560 **       of a LEFT JOIN where iCursor is not the right-hand table of that
4561 **       left join.  An example:
4562 **
4563 **           SELECT *
4564 **           FROM (SELECT 1 AS a1 UNION ALL SELECT 2) AS aa
4565 **           JOIN (SELECT 1 AS b2 UNION ALL SELECT 2) AS bb ON (a1=b2)
4566 **           LEFT JOIN (SELECT 8 AS c3 UNION ALL SELECT 9) AS cc ON (b2=2);
4567 **
4568 **       The correct answer is three rows:  (1,1,NULL),(2,2,8),(2,2,9).
4569 **       But if the (b2=2) term were to be pushed down into the bb subquery,
4570 **       then the (1,1,NULL) row would be suppressed.
4571 **
4572 **   (6) Window functions make things tricky as changes to the WHERE clause
4573 **       of the inner query could change the window over which window
4574 **       functions are calculated. Therefore, do not attempt the optimization
4575 **       if:
4576 **
4577 **     (6a) The inner query uses multiple incompatible window partitions.
4578 **
4579 **     (6b) The inner query is a compound and uses window-functions.
4580 **
4581 **     (6c) The WHERE clause does not consist entirely of constants and
4582 **          copies of expressions found in the PARTITION BY clause of
4583 **          all window-functions used by the sub-query. It is safe to
4584 **          filter out entire partitions, as this does not change the
4585 **          window over which any window-function is calculated.
4586 **
4587 **   (7) The inner query is a Common Table Expression (CTE) that should
4588 **       be materialized.  (This restriction is implemented in the calling
4589 **       routine.)
4590 **
4591 ** Return 0 if no changes are made and non-zero if one or more WHERE clause
4592 ** terms are duplicated into the subquery.
4593 */
4594 static int pushDownWhereTerms(
4595   Parse *pParse,        /* Parse context (for malloc() and error reporting) */
4596   Select *pSubq,        /* The subquery whose WHERE clause is to be augmented */
4597   Expr *pWhere,         /* The WHERE clause of the outer query */
4598   int iCursor,          /* Cursor number of the subquery */
4599   int isLeftJoin        /* True if pSubq is the right term of a LEFT JOIN */
4600 ){
4601   Expr *pNew;
4602   int nChng = 0;
4603   if( pWhere==0 ) return 0;
4604   if( pSubq->selFlags & (SF_Recursive|SF_MultiPart) ) return 0;
4605 
4606 #ifndef SQLITE_OMIT_WINDOWFUNC
4607   if( pSubq->pPrior ){
4608     Select *pSel;
4609     for(pSel=pSubq; pSel; pSel=pSel->pPrior){
4610       if( pSel->pWin ) return 0;    /* restriction (6b) */
4611     }
4612   }else{
4613     if( pSubq->pWin && pSubq->pWin->pPartition==0 ) return 0;
4614   }
4615 #endif
4616 
4617 #ifdef SQLITE_DEBUG
4618   /* Only the first term of a compound can have a WITH clause.  But make
4619   ** sure no other terms are marked SF_Recursive in case something changes
4620   ** in the future.
4621   */
4622   {
4623     Select *pX;
4624     for(pX=pSubq; pX; pX=pX->pPrior){
4625       assert( (pX->selFlags & (SF_Recursive))==0 );
4626     }
4627   }
4628 #endif
4629 
4630   if( pSubq->pLimit!=0 ){
4631     return 0; /* restriction (3) */
4632   }
4633   while( pWhere->op==TK_AND ){
4634     nChng += pushDownWhereTerms(pParse, pSubq, pWhere->pRight,
4635                                 iCursor, isLeftJoin);
4636     pWhere = pWhere->pLeft;
4637   }
4638   if( isLeftJoin
4639    && (ExprHasProperty(pWhere,EP_FromJoin)==0
4640          || pWhere->iRightJoinTable!=iCursor)
4641   ){
4642     return 0; /* restriction (4) */
4643   }
4644   if( ExprHasProperty(pWhere,EP_FromJoin) && pWhere->iRightJoinTable!=iCursor ){
4645     return 0; /* restriction (5) */
4646   }
4647   if( sqlite3ExprIsTableConstant(pWhere, iCursor) ){
4648     nChng++;
4649     pSubq->selFlags |= SF_PushDown;
4650     while( pSubq ){
4651       SubstContext x;
4652       pNew = sqlite3ExprDup(pParse->db, pWhere, 0);
4653       unsetJoinExpr(pNew, -1);
4654       x.pParse = pParse;
4655       x.iTable = iCursor;
4656       x.iNewTable = iCursor;
4657       x.isLeftJoin = 0;
4658       x.pEList = pSubq->pEList;
4659       pNew = substExpr(&x, pNew);
4660 #ifndef SQLITE_OMIT_WINDOWFUNC
4661       if( pSubq->pWin && 0==pushDownWindowCheck(pParse, pSubq, pNew) ){
4662         /* Restriction 6c has prevented push-down in this case */
4663         sqlite3ExprDelete(pParse->db, pNew);
4664         nChng--;
4665         break;
4666       }
4667 #endif
4668       if( pSubq->selFlags & SF_Aggregate ){
4669         pSubq->pHaving = sqlite3ExprAnd(pParse, pSubq->pHaving, pNew);
4670       }else{
4671         pSubq->pWhere = sqlite3ExprAnd(pParse, pSubq->pWhere, pNew);
4672       }
4673       pSubq = pSubq->pPrior;
4674     }
4675   }
4676   return nChng;
4677 }
4678 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
4679 
4680 /*
4681 ** The pFunc is the only aggregate function in the query.  Check to see
4682 ** if the query is a candidate for the min/max optimization.
4683 **
4684 ** If the query is a candidate for the min/max optimization, then set
4685 ** *ppMinMax to be an ORDER BY clause to be used for the optimization
4686 ** and return either WHERE_ORDERBY_MIN or WHERE_ORDERBY_MAX depending on
4687 ** whether pFunc is a min() or max() function.
4688 **
4689 ** If the query is not a candidate for the min/max optimization, return
4690 ** WHERE_ORDERBY_NORMAL (which must be zero).
4691 **
4692 ** This routine must be called after aggregate functions have been
4693 ** located but before their arguments have been subjected to aggregate
4694 ** analysis.
4695 */
4696 static u8 minMaxQuery(sqlite3 *db, Expr *pFunc, ExprList **ppMinMax){
4697   int eRet = WHERE_ORDERBY_NORMAL;      /* Return value */
4698   ExprList *pEList = pFunc->x.pList;    /* Arguments to agg function */
4699   const char *zFunc;                    /* Name of aggregate function pFunc */
4700   ExprList *pOrderBy;
4701   u8 sortFlags = 0;
4702 
4703   assert( *ppMinMax==0 );
4704   assert( pFunc->op==TK_AGG_FUNCTION );
4705   assert( !IsWindowFunc(pFunc) );
4706   if( pEList==0
4707    || pEList->nExpr!=1
4708    || ExprHasProperty(pFunc, EP_WinFunc)
4709    || OptimizationDisabled(db, SQLITE_MinMaxOpt)
4710   ){
4711     return eRet;
4712   }
4713   zFunc = pFunc->u.zToken;
4714   if( sqlite3StrICmp(zFunc, "min")==0 ){
4715     eRet = WHERE_ORDERBY_MIN;
4716     if( sqlite3ExprCanBeNull(pEList->a[0].pExpr) ){
4717       sortFlags = KEYINFO_ORDER_BIGNULL;
4718     }
4719   }else if( sqlite3StrICmp(zFunc, "max")==0 ){
4720     eRet = WHERE_ORDERBY_MAX;
4721     sortFlags = KEYINFO_ORDER_DESC;
4722   }else{
4723     return eRet;
4724   }
4725   *ppMinMax = pOrderBy = sqlite3ExprListDup(db, pEList, 0);
4726   assert( pOrderBy!=0 || db->mallocFailed );
4727   if( pOrderBy ) pOrderBy->a[0].sortFlags = sortFlags;
4728   return eRet;
4729 }
4730 
4731 /*
4732 ** The select statement passed as the first argument is an aggregate query.
4733 ** The second argument is the associated aggregate-info object. This
4734 ** function tests if the SELECT is of the form:
4735 **
4736 **   SELECT count(*) FROM <tbl>
4737 **
4738 ** where table is a database table, not a sub-select or view. If the query
4739 ** does match this pattern, then a pointer to the Table object representing
4740 ** <tbl> is returned. Otherwise, 0 is returned.
4741 */
4742 static Table *isSimpleCount(Select *p, AggInfo *pAggInfo){
4743   Table *pTab;
4744   Expr *pExpr;
4745 
4746   assert( !p->pGroupBy );
4747 
4748   if( p->pWhere || p->pEList->nExpr!=1
4749    || p->pSrc->nSrc!=1 || p->pSrc->a[0].pSelect
4750   ){
4751     return 0;
4752   }
4753   pTab = p->pSrc->a[0].pTab;
4754   pExpr = p->pEList->a[0].pExpr;
4755   assert( pTab && !pTab->pSelect && pExpr );
4756 
4757   if( IsVirtual(pTab) ) return 0;
4758   if( pExpr->op!=TK_AGG_FUNCTION ) return 0;
4759   if( NEVER(pAggInfo->nFunc==0) ) return 0;
4760   if( (pAggInfo->aFunc[0].pFunc->funcFlags&SQLITE_FUNC_COUNT)==0 ) return 0;
4761   if( ExprHasProperty(pExpr, EP_Distinct|EP_WinFunc) ) return 0;
4762 
4763   return pTab;
4764 }
4765 
4766 /*
4767 ** If the source-list item passed as an argument was augmented with an
4768 ** INDEXED BY clause, then try to locate the specified index. If there
4769 ** was such a clause and the named index cannot be found, return
4770 ** SQLITE_ERROR and leave an error in pParse. Otherwise, populate
4771 ** pFrom->pIndex and return SQLITE_OK.
4772 */
4773 int sqlite3IndexedByLookup(Parse *pParse, SrcItem *pFrom){
4774   Table *pTab = pFrom->pTab;
4775   char *zIndexedBy = pFrom->u1.zIndexedBy;
4776   Index *pIdx;
4777   assert( pTab!=0 );
4778   assert( pFrom->fg.isIndexedBy!=0 );
4779 
4780   for(pIdx=pTab->pIndex;
4781       pIdx && sqlite3StrICmp(pIdx->zName, zIndexedBy);
4782       pIdx=pIdx->pNext
4783   );
4784   if( !pIdx ){
4785     sqlite3ErrorMsg(pParse, "no such index: %s", zIndexedBy, 0);
4786     pParse->checkSchema = 1;
4787     return SQLITE_ERROR;
4788   }
4789   pFrom->u2.pIBIndex = pIdx;
4790   return SQLITE_OK;
4791 }
4792 
4793 /*
4794 ** Detect compound SELECT statements that use an ORDER BY clause with
4795 ** an alternative collating sequence.
4796 **
4797 **    SELECT ... FROM t1 EXCEPT SELECT ... FROM t2 ORDER BY .. COLLATE ...
4798 **
4799 ** These are rewritten as a subquery:
4800 **
4801 **    SELECT * FROM (SELECT ... FROM t1 EXCEPT SELECT ... FROM t2)
4802 **     ORDER BY ... COLLATE ...
4803 **
4804 ** This transformation is necessary because the multiSelectOrderBy() routine
4805 ** above that generates the code for a compound SELECT with an ORDER BY clause
4806 ** uses a merge algorithm that requires the same collating sequence on the
4807 ** result columns as on the ORDER BY clause.  See ticket
4808 ** http://www.sqlite.org/src/info/6709574d2a
4809 **
4810 ** This transformation is only needed for EXCEPT, INTERSECT, and UNION.
4811 ** The UNION ALL operator works fine with multiSelectOrderBy() even when
4812 ** there are COLLATE terms in the ORDER BY.
4813 */
4814 static int convertCompoundSelectToSubquery(Walker *pWalker, Select *p){
4815   int i;
4816   Select *pNew;
4817   Select *pX;
4818   sqlite3 *db;
4819   struct ExprList_item *a;
4820   SrcList *pNewSrc;
4821   Parse *pParse;
4822   Token dummy;
4823 
4824   if( p->pPrior==0 ) return WRC_Continue;
4825   if( p->pOrderBy==0 ) return WRC_Continue;
4826   for(pX=p; pX && (pX->op==TK_ALL || pX->op==TK_SELECT); pX=pX->pPrior){}
4827   if( pX==0 ) return WRC_Continue;
4828   a = p->pOrderBy->a;
4829 #ifndef SQLITE_OMIT_WINDOWFUNC
4830   /* If iOrderByCol is already non-zero, then it has already been matched
4831   ** to a result column of the SELECT statement. This occurs when the
4832   ** SELECT is rewritten for window-functions processing and then passed
4833   ** to sqlite3SelectPrep() and similar a second time. The rewriting done
4834   ** by this function is not required in this case. */
4835   if( a[0].u.x.iOrderByCol ) return WRC_Continue;
4836 #endif
4837   for(i=p->pOrderBy->nExpr-1; i>=0; i--){
4838     if( a[i].pExpr->flags & EP_Collate ) break;
4839   }
4840   if( i<0 ) return WRC_Continue;
4841 
4842   /* If we reach this point, that means the transformation is required. */
4843 
4844   pParse = pWalker->pParse;
4845   db = pParse->db;
4846   pNew = sqlite3DbMallocZero(db, sizeof(*pNew) );
4847   if( pNew==0 ) return WRC_Abort;
4848   memset(&dummy, 0, sizeof(dummy));
4849   pNewSrc = sqlite3SrcListAppendFromTerm(pParse,0,0,0,&dummy,pNew,0,0);
4850   if( pNewSrc==0 ) return WRC_Abort;
4851   *pNew = *p;
4852   p->pSrc = pNewSrc;
4853   p->pEList = sqlite3ExprListAppend(pParse, 0, sqlite3Expr(db, TK_ASTERISK, 0));
4854   p->op = TK_SELECT;
4855   p->pWhere = 0;
4856   pNew->pGroupBy = 0;
4857   pNew->pHaving = 0;
4858   pNew->pOrderBy = 0;
4859   p->pPrior = 0;
4860   p->pNext = 0;
4861   p->pWith = 0;
4862 #ifndef SQLITE_OMIT_WINDOWFUNC
4863   p->pWinDefn = 0;
4864 #endif
4865   p->selFlags &= ~SF_Compound;
4866   assert( (p->selFlags & SF_Converted)==0 );
4867   p->selFlags |= SF_Converted;
4868   assert( pNew->pPrior!=0 );
4869   pNew->pPrior->pNext = pNew;
4870   pNew->pLimit = 0;
4871   return WRC_Continue;
4872 }
4873 
4874 /*
4875 ** Check to see if the FROM clause term pFrom has table-valued function
4876 ** arguments.  If it does, leave an error message in pParse and return
4877 ** non-zero, since pFrom is not allowed to be a table-valued function.
4878 */
4879 static int cannotBeFunction(Parse *pParse, SrcItem *pFrom){
4880   if( pFrom->fg.isTabFunc ){
4881     sqlite3ErrorMsg(pParse, "'%s' is not a function", pFrom->zName);
4882     return 1;
4883   }
4884   return 0;
4885 }
4886 
4887 #ifndef SQLITE_OMIT_CTE
4888 /*
4889 ** Argument pWith (which may be NULL) points to a linked list of nested
4890 ** WITH contexts, from inner to outermost. If the table identified by
4891 ** FROM clause element pItem is really a common-table-expression (CTE)
4892 ** then return a pointer to the CTE definition for that table. Otherwise
4893 ** return NULL.
4894 **
4895 ** If a non-NULL value is returned, set *ppContext to point to the With
4896 ** object that the returned CTE belongs to.
4897 */
4898 static struct Cte *searchWith(
4899   With *pWith,                    /* Current innermost WITH clause */
4900   SrcItem *pItem,                 /* FROM clause element to resolve */
4901   With **ppContext                /* OUT: WITH clause return value belongs to */
4902 ){
4903   const char *zName = pItem->zName;
4904   With *p;
4905   assert( pItem->zDatabase==0 );
4906   assert( zName!=0 );
4907   for(p=pWith; p; p=p->pOuter){
4908     int i;
4909     for(i=0; i<p->nCte; i++){
4910       if( sqlite3StrICmp(zName, p->a[i].zName)==0 ){
4911         *ppContext = p;
4912         return &p->a[i];
4913       }
4914     }
4915   }
4916   return 0;
4917 }
4918 
4919 /* The code generator maintains a stack of active WITH clauses
4920 ** with the inner-most WITH clause being at the top of the stack.
4921 **
4922 ** This routine pushes the WITH clause passed as the second argument
4923 ** onto the top of the stack. If argument bFree is true, then this
4924 ** WITH clause will never be popped from the stack. In this case it
4925 ** should be freed along with the Parse object. In other cases, when
4926 ** bFree==0, the With object will be freed along with the SELECT
4927 ** statement with which it is associated.
4928 */
4929 void sqlite3WithPush(Parse *pParse, With *pWith, u8 bFree){
4930   if( pWith ){
4931     assert( pParse->pWith!=pWith );
4932     pWith->pOuter = pParse->pWith;
4933     pParse->pWith = pWith;
4934     if( bFree ){
4935       sqlite3ParserAddCleanup(pParse,
4936          (void(*)(sqlite3*,void*))sqlite3WithDelete,
4937          pWith);
4938       testcase( pParse->earlyCleanup );
4939     }
4940   }
4941 }
4942 
4943 /*
4944 ** This function checks if argument pFrom refers to a CTE declared by
4945 ** a WITH clause on the stack currently maintained by the parser (on the
4946 ** pParse->pWith linked list).  And if currently processing a CTE
4947 ** CTE expression, through routine checks to see if the reference is
4948 ** a recursive reference to the CTE.
4949 **
4950 ** If pFrom matches a CTE according to either of these two above, pFrom->pTab
4951 ** and other fields are populated accordingly.
4952 **
4953 ** Return 0 if no match is found.
4954 ** Return 1 if a match is found.
4955 ** Return 2 if an error condition is detected.
4956 */
4957 static int resolveFromTermToCte(
4958   Parse *pParse,                  /* The parsing context */
4959   Walker *pWalker,                /* Current tree walker */
4960   SrcItem *pFrom                  /* The FROM clause term to check */
4961 ){
4962   Cte *pCte;               /* Matched CTE (or NULL if no match) */
4963   With *pWith;             /* The matching WITH */
4964 
4965   assert( pFrom->pTab==0 );
4966   if( pParse->pWith==0 ){
4967     /* There are no WITH clauses in the stack.  No match is possible */
4968     return 0;
4969   }
4970   if( pFrom->zDatabase!=0 ){
4971     /* The FROM term contains a schema qualifier (ex: main.t1) and so
4972     ** it cannot possibly be a CTE reference. */
4973     return 0;
4974   }
4975   pCte = searchWith(pParse->pWith, pFrom, &pWith);
4976   if( pCte ){
4977     sqlite3 *db = pParse->db;
4978     Table *pTab;
4979     ExprList *pEList;
4980     Select *pSel;
4981     Select *pLeft;                /* Left-most SELECT statement */
4982     Select *pRecTerm;             /* Left-most recursive term */
4983     int bMayRecursive;            /* True if compound joined by UNION [ALL] */
4984     With *pSavedWith;             /* Initial value of pParse->pWith */
4985     int iRecTab = -1;             /* Cursor for recursive table */
4986     CteUse *pCteUse;
4987 
4988     /* If pCte->zCteErr is non-NULL at this point, then this is an illegal
4989     ** recursive reference to CTE pCte. Leave an error in pParse and return
4990     ** early. If pCte->zCteErr is NULL, then this is not a recursive reference.
4991     ** In this case, proceed.  */
4992     if( pCte->zCteErr ){
4993       sqlite3ErrorMsg(pParse, pCte->zCteErr, pCte->zName);
4994       return 2;
4995     }
4996     if( cannotBeFunction(pParse, pFrom) ) return 2;
4997 
4998     assert( pFrom->pTab==0 );
4999     pTab = sqlite3DbMallocZero(db, sizeof(Table));
5000     if( pTab==0 ) return 2;
5001     pCteUse = pCte->pUse;
5002     if( pCteUse==0 ){
5003       pCte->pUse = pCteUse = sqlite3DbMallocZero(db, sizeof(pCteUse[0]));
5004       if( pCteUse==0
5005        || sqlite3ParserAddCleanup(pParse,sqlite3DbFree,pCteUse)==0
5006       ){
5007         sqlite3DbFree(db, pTab);
5008         return 2;
5009       }
5010       pCteUse->eM10d = pCte->eM10d;
5011     }
5012     pFrom->pTab = pTab;
5013     pTab->nTabRef = 1;
5014     pTab->zName = sqlite3DbStrDup(db, pCte->zName);
5015     pTab->iPKey = -1;
5016     pTab->nRowLogEst = 200; assert( 200==sqlite3LogEst(1048576) );
5017     pTab->tabFlags |= TF_Ephemeral | TF_NoVisibleRowid;
5018     pFrom->pSelect = sqlite3SelectDup(db, pCte->pSelect, 0);
5019     if( db->mallocFailed ) return 2;
5020     assert( pFrom->pSelect );
5021     pFrom->fg.isCte = 1;
5022     pFrom->u2.pCteUse = pCteUse;
5023     pCteUse->nUse++;
5024     if( pCteUse->nUse>=2 && pCteUse->eM10d==M10d_Any ){
5025       pCteUse->eM10d = M10d_Yes;
5026     }
5027 
5028     /* Check if this is a recursive CTE. */
5029     pRecTerm = pSel = pFrom->pSelect;
5030     bMayRecursive = ( pSel->op==TK_ALL || pSel->op==TK_UNION );
5031     while( bMayRecursive && pRecTerm->op==pSel->op ){
5032       int i;
5033       SrcList *pSrc = pRecTerm->pSrc;
5034       assert( pRecTerm->pPrior!=0 );
5035       for(i=0; i<pSrc->nSrc; i++){
5036         SrcItem *pItem = &pSrc->a[i];
5037         if( pItem->zDatabase==0
5038          && pItem->zName!=0
5039          && 0==sqlite3StrICmp(pItem->zName, pCte->zName)
5040         ){
5041           pItem->pTab = pTab;
5042           pTab->nTabRef++;
5043           pItem->fg.isRecursive = 1;
5044           if( pRecTerm->selFlags & SF_Recursive ){
5045             sqlite3ErrorMsg(pParse,
5046                "multiple references to recursive table: %s", pCte->zName
5047             );
5048             return 2;
5049           }
5050           pRecTerm->selFlags |= SF_Recursive;
5051           if( iRecTab<0 ) iRecTab = pParse->nTab++;
5052           pItem->iCursor = iRecTab;
5053         }
5054       }
5055       if( (pRecTerm->selFlags & SF_Recursive)==0 ) break;
5056       pRecTerm = pRecTerm->pPrior;
5057     }
5058 
5059     pCte->zCteErr = "circular reference: %s";
5060     pSavedWith = pParse->pWith;
5061     pParse->pWith = pWith;
5062     if( pSel->selFlags & SF_Recursive ){
5063       int rc;
5064       assert( pRecTerm!=0 );
5065       assert( (pRecTerm->selFlags & SF_Recursive)==0 );
5066       assert( pRecTerm->pNext!=0 );
5067       assert( (pRecTerm->pNext->selFlags & SF_Recursive)!=0 );
5068       assert( pRecTerm->pWith==0 );
5069       pRecTerm->pWith = pSel->pWith;
5070       rc = sqlite3WalkSelect(pWalker, pRecTerm);
5071       pRecTerm->pWith = 0;
5072       if( rc ){
5073         pParse->pWith = pSavedWith;
5074         return 2;
5075       }
5076     }else{
5077       if( sqlite3WalkSelect(pWalker, pSel) ){
5078         pParse->pWith = pSavedWith;
5079         return 2;
5080       }
5081     }
5082     pParse->pWith = pWith;
5083 
5084     for(pLeft=pSel; pLeft->pPrior; pLeft=pLeft->pPrior);
5085     pEList = pLeft->pEList;
5086     if( pCte->pCols ){
5087       if( pEList && pEList->nExpr!=pCte->pCols->nExpr ){
5088         sqlite3ErrorMsg(pParse, "table %s has %d values for %d columns",
5089             pCte->zName, pEList->nExpr, pCte->pCols->nExpr
5090         );
5091         pParse->pWith = pSavedWith;
5092         return 2;
5093       }
5094       pEList = pCte->pCols;
5095     }
5096 
5097     sqlite3ColumnsFromExprList(pParse, pEList, &pTab->nCol, &pTab->aCol);
5098     if( bMayRecursive ){
5099       if( pSel->selFlags & SF_Recursive ){
5100         pCte->zCteErr = "multiple recursive references: %s";
5101       }else{
5102         pCte->zCteErr = "recursive reference in a subquery: %s";
5103       }
5104       sqlite3WalkSelect(pWalker, pSel);
5105     }
5106     pCte->zCteErr = 0;
5107     pParse->pWith = pSavedWith;
5108     return 1;  /* Success */
5109   }
5110   return 0;  /* No match */
5111 }
5112 #endif
5113 
5114 #ifndef SQLITE_OMIT_CTE
5115 /*
5116 ** If the SELECT passed as the second argument has an associated WITH
5117 ** clause, pop it from the stack stored as part of the Parse object.
5118 **
5119 ** This function is used as the xSelectCallback2() callback by
5120 ** sqlite3SelectExpand() when walking a SELECT tree to resolve table
5121 ** names and other FROM clause elements.
5122 */
5123 static void selectPopWith(Walker *pWalker, Select *p){
5124   Parse *pParse = pWalker->pParse;
5125   if( OK_IF_ALWAYS_TRUE(pParse->pWith) && p->pPrior==0 ){
5126     With *pWith = findRightmost(p)->pWith;
5127     if( pWith!=0 ){
5128       assert( pParse->pWith==pWith || pParse->nErr );
5129       pParse->pWith = pWith->pOuter;
5130     }
5131   }
5132 }
5133 #else
5134 #define selectPopWith 0
5135 #endif
5136 
5137 /*
5138 ** The SrcList_item structure passed as the second argument represents a
5139 ** sub-query in the FROM clause of a SELECT statement. This function
5140 ** allocates and populates the SrcList_item.pTab object. If successful,
5141 ** SQLITE_OK is returned. Otherwise, if an OOM error is encountered,
5142 ** SQLITE_NOMEM.
5143 */
5144 int sqlite3ExpandSubquery(Parse *pParse, SrcItem *pFrom){
5145   Select *pSel = pFrom->pSelect;
5146   Table *pTab;
5147 
5148   assert( pSel );
5149   pFrom->pTab = pTab = sqlite3DbMallocZero(pParse->db, sizeof(Table));
5150   if( pTab==0 ) return SQLITE_NOMEM;
5151   pTab->nTabRef = 1;
5152   if( pFrom->zAlias ){
5153     pTab->zName = sqlite3DbStrDup(pParse->db, pFrom->zAlias);
5154   }else{
5155     pTab->zName = sqlite3MPrintf(pParse->db, "subquery_%u", pSel->selId);
5156   }
5157   while( pSel->pPrior ){ pSel = pSel->pPrior; }
5158   sqlite3ColumnsFromExprList(pParse, pSel->pEList,&pTab->nCol,&pTab->aCol);
5159   pTab->iPKey = -1;
5160   pTab->nRowLogEst = 200; assert( 200==sqlite3LogEst(1048576) );
5161   pTab->tabFlags |= TF_Ephemeral;
5162 
5163   return pParse->nErr ? SQLITE_ERROR : SQLITE_OK;
5164 }
5165 
5166 /*
5167 ** This routine is a Walker callback for "expanding" a SELECT statement.
5168 ** "Expanding" means to do the following:
5169 **
5170 **    (1)  Make sure VDBE cursor numbers have been assigned to every
5171 **         element of the FROM clause.
5172 **
5173 **    (2)  Fill in the pTabList->a[].pTab fields in the SrcList that
5174 **         defines FROM clause.  When views appear in the FROM clause,
5175 **         fill pTabList->a[].pSelect with a copy of the SELECT statement
5176 **         that implements the view.  A copy is made of the view's SELECT
5177 **         statement so that we can freely modify or delete that statement
5178 **         without worrying about messing up the persistent representation
5179 **         of the view.
5180 **
5181 **    (3)  Add terms to the WHERE clause to accommodate the NATURAL keyword
5182 **         on joins and the ON and USING clause of joins.
5183 **
5184 **    (4)  Scan the list of columns in the result set (pEList) looking
5185 **         for instances of the "*" operator or the TABLE.* operator.
5186 **         If found, expand each "*" to be every column in every table
5187 **         and TABLE.* to be every column in TABLE.
5188 **
5189 */
5190 static int selectExpander(Walker *pWalker, Select *p){
5191   Parse *pParse = pWalker->pParse;
5192   int i, j, k, rc;
5193   SrcList *pTabList;
5194   ExprList *pEList;
5195   SrcItem *pFrom;
5196   sqlite3 *db = pParse->db;
5197   Expr *pE, *pRight, *pExpr;
5198   u16 selFlags = p->selFlags;
5199   u32 elistFlags = 0;
5200 
5201   p->selFlags |= SF_Expanded;
5202   if( db->mallocFailed  ){
5203     return WRC_Abort;
5204   }
5205   assert( p->pSrc!=0 );
5206   if( (selFlags & SF_Expanded)!=0 ){
5207     return WRC_Prune;
5208   }
5209   if( pWalker->eCode ){
5210     /* Renumber selId because it has been copied from a view */
5211     p->selId = ++pParse->nSelect;
5212   }
5213   pTabList = p->pSrc;
5214   pEList = p->pEList;
5215   sqlite3WithPush(pParse, p->pWith, 0);
5216 
5217   /* Make sure cursor numbers have been assigned to all entries in
5218   ** the FROM clause of the SELECT statement.
5219   */
5220   sqlite3SrcListAssignCursors(pParse, pTabList);
5221 
5222   /* Look up every table named in the FROM clause of the select.  If
5223   ** an entry of the FROM clause is a subquery instead of a table or view,
5224   ** then create a transient table structure to describe the subquery.
5225   */
5226   for(i=0, pFrom=pTabList->a; i<pTabList->nSrc; i++, pFrom++){
5227     Table *pTab;
5228     assert( pFrom->fg.isRecursive==0 || pFrom->pTab!=0 );
5229     if( pFrom->pTab ) continue;
5230     assert( pFrom->fg.isRecursive==0 );
5231     if( pFrom->zName==0 ){
5232 #ifndef SQLITE_OMIT_SUBQUERY
5233       Select *pSel = pFrom->pSelect;
5234       /* A sub-query in the FROM clause of a SELECT */
5235       assert( pSel!=0 );
5236       assert( pFrom->pTab==0 );
5237       if( sqlite3WalkSelect(pWalker, pSel) ) return WRC_Abort;
5238       if( sqlite3ExpandSubquery(pParse, pFrom) ) return WRC_Abort;
5239 #endif
5240 #ifndef SQLITE_OMIT_CTE
5241     }else if( (rc = resolveFromTermToCte(pParse, pWalker, pFrom))!=0 ){
5242       if( rc>1 ) return WRC_Abort;
5243       pTab = pFrom->pTab;
5244       assert( pTab!=0 );
5245 #endif
5246     }else{
5247       /* An ordinary table or view name in the FROM clause */
5248       assert( pFrom->pTab==0 );
5249       pFrom->pTab = pTab = sqlite3LocateTableItem(pParse, 0, pFrom);
5250       if( pTab==0 ) return WRC_Abort;
5251       if( pTab->nTabRef>=0xffff ){
5252         sqlite3ErrorMsg(pParse, "too many references to \"%s\": max 65535",
5253            pTab->zName);
5254         pFrom->pTab = 0;
5255         return WRC_Abort;
5256       }
5257       pTab->nTabRef++;
5258       if( !IsVirtual(pTab) && cannotBeFunction(pParse, pFrom) ){
5259         return WRC_Abort;
5260       }
5261 #if !defined(SQLITE_OMIT_VIEW) || !defined(SQLITE_OMIT_VIRTUALTABLE)
5262       if( IsVirtual(pTab) || pTab->pSelect ){
5263         i16 nCol;
5264         u8 eCodeOrig = pWalker->eCode;
5265         if( sqlite3ViewGetColumnNames(pParse, pTab) ) return WRC_Abort;
5266         assert( pFrom->pSelect==0 );
5267         if( pTab->pSelect
5268          && (db->flags & SQLITE_EnableView)==0
5269          && pTab->pSchema!=db->aDb[1].pSchema
5270         ){
5271           sqlite3ErrorMsg(pParse, "access to view \"%s\" prohibited",
5272             pTab->zName);
5273         }
5274 #ifndef SQLITE_OMIT_VIRTUALTABLE
5275         if( IsVirtual(pTab)
5276          && pFrom->fg.fromDDL
5277          && ALWAYS(pTab->pVTable!=0)
5278          && pTab->pVTable->eVtabRisk > ((db->flags & SQLITE_TrustedSchema)!=0)
5279         ){
5280           sqlite3ErrorMsg(pParse, "unsafe use of virtual table \"%s\"",
5281                                   pTab->zName);
5282         }
5283 #endif
5284         pFrom->pSelect = sqlite3SelectDup(db, pTab->pSelect, 0);
5285         nCol = pTab->nCol;
5286         pTab->nCol = -1;
5287         pWalker->eCode = 1;  /* Turn on Select.selId renumbering */
5288         sqlite3WalkSelect(pWalker, pFrom->pSelect);
5289         pWalker->eCode = eCodeOrig;
5290         pTab->nCol = nCol;
5291       }
5292 #endif
5293     }
5294 
5295     /* Locate the index named by the INDEXED BY clause, if any. */
5296     if( pFrom->fg.isIndexedBy && sqlite3IndexedByLookup(pParse, pFrom) ){
5297       return WRC_Abort;
5298     }
5299   }
5300 
5301   /* Process NATURAL keywords, and ON and USING clauses of joins.
5302   */
5303   if( pParse->nErr || db->mallocFailed || sqliteProcessJoin(pParse, p) ){
5304     return WRC_Abort;
5305   }
5306 
5307   /* For every "*" that occurs in the column list, insert the names of
5308   ** all columns in all tables.  And for every TABLE.* insert the names
5309   ** of all columns in TABLE.  The parser inserted a special expression
5310   ** with the TK_ASTERISK operator for each "*" that it found in the column
5311   ** list.  The following code just has to locate the TK_ASTERISK
5312   ** expressions and expand each one to the list of all columns in
5313   ** all tables.
5314   **
5315   ** The first loop just checks to see if there are any "*" operators
5316   ** that need expanding.
5317   */
5318   for(k=0; k<pEList->nExpr; k++){
5319     pE = pEList->a[k].pExpr;
5320     if( pE->op==TK_ASTERISK ) break;
5321     assert( pE->op!=TK_DOT || pE->pRight!=0 );
5322     assert( pE->op!=TK_DOT || (pE->pLeft!=0 && pE->pLeft->op==TK_ID) );
5323     if( pE->op==TK_DOT && pE->pRight->op==TK_ASTERISK ) break;
5324     elistFlags |= pE->flags;
5325   }
5326   if( k<pEList->nExpr ){
5327     /*
5328     ** If we get here it means the result set contains one or more "*"
5329     ** operators that need to be expanded.  Loop through each expression
5330     ** in the result set and expand them one by one.
5331     */
5332     struct ExprList_item *a = pEList->a;
5333     ExprList *pNew = 0;
5334     int flags = pParse->db->flags;
5335     int longNames = (flags & SQLITE_FullColNames)!=0
5336                       && (flags & SQLITE_ShortColNames)==0;
5337 
5338     for(k=0; k<pEList->nExpr; k++){
5339       pE = a[k].pExpr;
5340       elistFlags |= pE->flags;
5341       pRight = pE->pRight;
5342       assert( pE->op!=TK_DOT || pRight!=0 );
5343       if( pE->op!=TK_ASTERISK
5344        && (pE->op!=TK_DOT || pRight->op!=TK_ASTERISK)
5345       ){
5346         /* This particular expression does not need to be expanded.
5347         */
5348         pNew = sqlite3ExprListAppend(pParse, pNew, a[k].pExpr);
5349         if( pNew ){
5350           pNew->a[pNew->nExpr-1].zEName = a[k].zEName;
5351           pNew->a[pNew->nExpr-1].eEName = a[k].eEName;
5352           a[k].zEName = 0;
5353         }
5354         a[k].pExpr = 0;
5355       }else{
5356         /* This expression is a "*" or a "TABLE.*" and needs to be
5357         ** expanded. */
5358         int tableSeen = 0;      /* Set to 1 when TABLE matches */
5359         char *zTName = 0;       /* text of name of TABLE */
5360         if( pE->op==TK_DOT ){
5361           assert( pE->pLeft!=0 );
5362           assert( !ExprHasProperty(pE->pLeft, EP_IntValue) );
5363           zTName = pE->pLeft->u.zToken;
5364         }
5365         for(i=0, pFrom=pTabList->a; i<pTabList->nSrc; i++, pFrom++){
5366           Table *pTab = pFrom->pTab;
5367           Select *pSub = pFrom->pSelect;
5368           char *zTabName = pFrom->zAlias;
5369           const char *zSchemaName = 0;
5370           int iDb;
5371           if( zTabName==0 ){
5372             zTabName = pTab->zName;
5373           }
5374           if( db->mallocFailed ) break;
5375           if( pSub==0 || (pSub->selFlags & SF_NestedFrom)==0 ){
5376             pSub = 0;
5377             if( zTName && sqlite3StrICmp(zTName, zTabName)!=0 ){
5378               continue;
5379             }
5380             iDb = sqlite3SchemaToIndex(db, pTab->pSchema);
5381             zSchemaName = iDb>=0 ? db->aDb[iDb].zDbSName : "*";
5382           }
5383           for(j=0; j<pTab->nCol; j++){
5384             char *zName = pTab->aCol[j].zName;
5385             char *zColname;  /* The computed column name */
5386             char *zToFree;   /* Malloced string that needs to be freed */
5387             Token sColname;  /* Computed column name as a token */
5388 
5389             assert( zName );
5390             if( zTName && pSub
5391              && sqlite3MatchEName(&pSub->pEList->a[j], 0, zTName, 0)==0
5392             ){
5393               continue;
5394             }
5395 
5396             /* If a column is marked as 'hidden', omit it from the expanded
5397             ** result-set list unless the SELECT has the SF_IncludeHidden
5398             ** bit set.
5399             */
5400             if( (p->selFlags & SF_IncludeHidden)==0
5401              && IsHiddenColumn(&pTab->aCol[j])
5402             ){
5403               continue;
5404             }
5405             tableSeen = 1;
5406 
5407             if( i>0 && zTName==0 ){
5408               if( (pFrom->fg.jointype & JT_NATURAL)!=0
5409                 && tableAndColumnIndex(pTabList, i, zName, 0, 0, 1)
5410               ){
5411                 /* In a NATURAL join, omit the join columns from the
5412                 ** table to the right of the join */
5413                 continue;
5414               }
5415               if( sqlite3IdListIndex(pFrom->pUsing, zName)>=0 ){
5416                 /* In a join with a USING clause, omit columns in the
5417                 ** using clause from the table on the right. */
5418                 continue;
5419               }
5420             }
5421             pRight = sqlite3Expr(db, TK_ID, zName);
5422             zColname = zName;
5423             zToFree = 0;
5424             if( longNames || pTabList->nSrc>1 ){
5425               Expr *pLeft;
5426               pLeft = sqlite3Expr(db, TK_ID, zTabName);
5427               pExpr = sqlite3PExpr(pParse, TK_DOT, pLeft, pRight);
5428               if( zSchemaName ){
5429                 pLeft = sqlite3Expr(db, TK_ID, zSchemaName);
5430                 pExpr = sqlite3PExpr(pParse, TK_DOT, pLeft, pExpr);
5431               }
5432               if( longNames ){
5433                 zColname = sqlite3MPrintf(db, "%s.%s", zTabName, zName);
5434                 zToFree = zColname;
5435               }
5436             }else{
5437               pExpr = pRight;
5438             }
5439             pNew = sqlite3ExprListAppend(pParse, pNew, pExpr);
5440             sqlite3TokenInit(&sColname, zColname);
5441             sqlite3ExprListSetName(pParse, pNew, &sColname, 0);
5442             if( pNew && (p->selFlags & SF_NestedFrom)!=0 && !IN_RENAME_OBJECT ){
5443               struct ExprList_item *pX = &pNew->a[pNew->nExpr-1];
5444               sqlite3DbFree(db, pX->zEName);
5445               if( pSub ){
5446                 pX->zEName = sqlite3DbStrDup(db, pSub->pEList->a[j].zEName);
5447                 testcase( pX->zEName==0 );
5448               }else{
5449                 pX->zEName = sqlite3MPrintf(db, "%s.%s.%s",
5450                                            zSchemaName, zTabName, zColname);
5451                 testcase( pX->zEName==0 );
5452               }
5453               pX->eEName = ENAME_TAB;
5454             }
5455             sqlite3DbFree(db, zToFree);
5456           }
5457         }
5458         if( !tableSeen ){
5459           if( zTName ){
5460             sqlite3ErrorMsg(pParse, "no such table: %s", zTName);
5461           }else{
5462             sqlite3ErrorMsg(pParse, "no tables specified");
5463           }
5464         }
5465       }
5466     }
5467     sqlite3ExprListDelete(db, pEList);
5468     p->pEList = pNew;
5469   }
5470   if( p->pEList ){
5471     if( p->pEList->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
5472       sqlite3ErrorMsg(pParse, "too many columns in result set");
5473       return WRC_Abort;
5474     }
5475     if( (elistFlags & (EP_HasFunc|EP_Subquery))!=0 ){
5476       p->selFlags |= SF_ComplexResult;
5477     }
5478   }
5479   return WRC_Continue;
5480 }
5481 
5482 #if SQLITE_DEBUG
5483 /*
5484 ** Always assert.  This xSelectCallback2 implementation proves that the
5485 ** xSelectCallback2 is never invoked.
5486 */
5487 void sqlite3SelectWalkAssert2(Walker *NotUsed, Select *NotUsed2){
5488   UNUSED_PARAMETER2(NotUsed, NotUsed2);
5489   assert( 0 );
5490 }
5491 #endif
5492 /*
5493 ** This routine "expands" a SELECT statement and all of its subqueries.
5494 ** For additional information on what it means to "expand" a SELECT
5495 ** statement, see the comment on the selectExpand worker callback above.
5496 **
5497 ** Expanding a SELECT statement is the first step in processing a
5498 ** SELECT statement.  The SELECT statement must be expanded before
5499 ** name resolution is performed.
5500 **
5501 ** If anything goes wrong, an error message is written into pParse.
5502 ** The calling function can detect the problem by looking at pParse->nErr
5503 ** and/or pParse->db->mallocFailed.
5504 */
5505 static void sqlite3SelectExpand(Parse *pParse, Select *pSelect){
5506   Walker w;
5507   w.xExprCallback = sqlite3ExprWalkNoop;
5508   w.pParse = pParse;
5509   if( OK_IF_ALWAYS_TRUE(pParse->hasCompound) ){
5510     w.xSelectCallback = convertCompoundSelectToSubquery;
5511     w.xSelectCallback2 = 0;
5512     sqlite3WalkSelect(&w, pSelect);
5513   }
5514   w.xSelectCallback = selectExpander;
5515   w.xSelectCallback2 = selectPopWith;
5516   w.eCode = 0;
5517   sqlite3WalkSelect(&w, pSelect);
5518 }
5519 
5520 
5521 #ifndef SQLITE_OMIT_SUBQUERY
5522 /*
5523 ** This is a Walker.xSelectCallback callback for the sqlite3SelectTypeInfo()
5524 ** interface.
5525 **
5526 ** For each FROM-clause subquery, add Column.zType and Column.zColl
5527 ** information to the Table structure that represents the result set
5528 ** of that subquery.
5529 **
5530 ** The Table structure that represents the result set was constructed
5531 ** by selectExpander() but the type and collation information was omitted
5532 ** at that point because identifiers had not yet been resolved.  This
5533 ** routine is called after identifier resolution.
5534 */
5535 static void selectAddSubqueryTypeInfo(Walker *pWalker, Select *p){
5536   Parse *pParse;
5537   int i;
5538   SrcList *pTabList;
5539   SrcItem *pFrom;
5540 
5541   assert( p->selFlags & SF_Resolved );
5542   if( p->selFlags & SF_HasTypeInfo ) return;
5543   p->selFlags |= SF_HasTypeInfo;
5544   pParse = pWalker->pParse;
5545   pTabList = p->pSrc;
5546   for(i=0, pFrom=pTabList->a; i<pTabList->nSrc; i++, pFrom++){
5547     Table *pTab = pFrom->pTab;
5548     assert( pTab!=0 );
5549     if( (pTab->tabFlags & TF_Ephemeral)!=0 ){
5550       /* A sub-query in the FROM clause of a SELECT */
5551       Select *pSel = pFrom->pSelect;
5552       if( pSel ){
5553         while( pSel->pPrior ) pSel = pSel->pPrior;
5554         sqlite3SelectAddColumnTypeAndCollation(pParse, pTab, pSel,
5555                                                SQLITE_AFF_NONE);
5556       }
5557     }
5558   }
5559 }
5560 #endif
5561 
5562 
5563 /*
5564 ** This routine adds datatype and collating sequence information to
5565 ** the Table structures of all FROM-clause subqueries in a
5566 ** SELECT statement.
5567 **
5568 ** Use this routine after name resolution.
5569 */
5570 static void sqlite3SelectAddTypeInfo(Parse *pParse, Select *pSelect){
5571 #ifndef SQLITE_OMIT_SUBQUERY
5572   Walker w;
5573   w.xSelectCallback = sqlite3SelectWalkNoop;
5574   w.xSelectCallback2 = selectAddSubqueryTypeInfo;
5575   w.xExprCallback = sqlite3ExprWalkNoop;
5576   w.pParse = pParse;
5577   sqlite3WalkSelect(&w, pSelect);
5578 #endif
5579 }
5580 
5581 
5582 /*
5583 ** This routine sets up a SELECT statement for processing.  The
5584 ** following is accomplished:
5585 **
5586 **     *  VDBE Cursor numbers are assigned to all FROM-clause terms.
5587 **     *  Ephemeral Table objects are created for all FROM-clause subqueries.
5588 **     *  ON and USING clauses are shifted into WHERE statements
5589 **     *  Wildcards "*" and "TABLE.*" in result sets are expanded.
5590 **     *  Identifiers in expression are matched to tables.
5591 **
5592 ** This routine acts recursively on all subqueries within the SELECT.
5593 */
5594 void sqlite3SelectPrep(
5595   Parse *pParse,         /* The parser context */
5596   Select *p,             /* The SELECT statement being coded. */
5597   NameContext *pOuterNC  /* Name context for container */
5598 ){
5599   assert( p!=0 || pParse->db->mallocFailed );
5600   if( pParse->db->mallocFailed ) return;
5601   if( p->selFlags & SF_HasTypeInfo ) return;
5602   sqlite3SelectExpand(pParse, p);
5603   if( pParse->nErr || pParse->db->mallocFailed ) return;
5604   sqlite3ResolveSelectNames(pParse, p, pOuterNC);
5605   if( pParse->nErr || pParse->db->mallocFailed ) return;
5606   sqlite3SelectAddTypeInfo(pParse, p);
5607 }
5608 
5609 /*
5610 ** Reset the aggregate accumulator.
5611 **
5612 ** The aggregate accumulator is a set of memory cells that hold
5613 ** intermediate results while calculating an aggregate.  This
5614 ** routine generates code that stores NULLs in all of those memory
5615 ** cells.
5616 */
5617 static void resetAccumulator(Parse *pParse, AggInfo *pAggInfo){
5618   Vdbe *v = pParse->pVdbe;
5619   int i;
5620   struct AggInfo_func *pFunc;
5621   int nReg = pAggInfo->nFunc + pAggInfo->nColumn;
5622   if( nReg==0 ) return;
5623   if( pParse->nErr || pParse->db->mallocFailed ) return;
5624 #ifdef SQLITE_DEBUG
5625   /* Verify that all AggInfo registers are within the range specified by
5626   ** AggInfo.mnReg..AggInfo.mxReg */
5627   assert( nReg==pAggInfo->mxReg-pAggInfo->mnReg+1 );
5628   for(i=0; i<pAggInfo->nColumn; i++){
5629     assert( pAggInfo->aCol[i].iMem>=pAggInfo->mnReg
5630          && pAggInfo->aCol[i].iMem<=pAggInfo->mxReg );
5631   }
5632   for(i=0; i<pAggInfo->nFunc; i++){
5633     assert( pAggInfo->aFunc[i].iMem>=pAggInfo->mnReg
5634          && pAggInfo->aFunc[i].iMem<=pAggInfo->mxReg );
5635   }
5636 #endif
5637   sqlite3VdbeAddOp3(v, OP_Null, 0, pAggInfo->mnReg, pAggInfo->mxReg);
5638   for(pFunc=pAggInfo->aFunc, i=0; i<pAggInfo->nFunc; i++, pFunc++){
5639     if( pFunc->iDistinct>=0 ){
5640       Expr *pE = pFunc->pFExpr;
5641       assert( !ExprHasProperty(pE, EP_xIsSelect) );
5642       if( pE->x.pList==0 || pE->x.pList->nExpr!=1 ){
5643         sqlite3ErrorMsg(pParse, "DISTINCT aggregates must have exactly one "
5644            "argument");
5645         pFunc->iDistinct = -1;
5646       }else{
5647         KeyInfo *pKeyInfo = sqlite3KeyInfoFromExprList(pParse, pE->x.pList,0,0);
5648         sqlite3VdbeAddOp4(v, OP_OpenEphemeral, pFunc->iDistinct, 0, 0,
5649                           (char*)pKeyInfo, P4_KEYINFO);
5650       }
5651     }
5652   }
5653 }
5654 
5655 /*
5656 ** Invoke the OP_AggFinalize opcode for every aggregate function
5657 ** in the AggInfo structure.
5658 */
5659 static void finalizeAggFunctions(Parse *pParse, AggInfo *pAggInfo){
5660   Vdbe *v = pParse->pVdbe;
5661   int i;
5662   struct AggInfo_func *pF;
5663   for(i=0, pF=pAggInfo->aFunc; i<pAggInfo->nFunc; i++, pF++){
5664     ExprList *pList = pF->pFExpr->x.pList;
5665     assert( !ExprHasProperty(pF->pFExpr, EP_xIsSelect) );
5666     sqlite3VdbeAddOp2(v, OP_AggFinal, pF->iMem, pList ? pList->nExpr : 0);
5667     sqlite3VdbeAppendP4(v, pF->pFunc, P4_FUNCDEF);
5668   }
5669 }
5670 
5671 
5672 /*
5673 ** Update the accumulator memory cells for an aggregate based on
5674 ** the current cursor position.
5675 **
5676 ** If regAcc is non-zero and there are no min() or max() aggregates
5677 ** in pAggInfo, then only populate the pAggInfo->nAccumulator accumulator
5678 ** registers if register regAcc contains 0. The caller will take care
5679 ** of setting and clearing regAcc.
5680 */
5681 static void updateAccumulator(Parse *pParse, int regAcc, AggInfo *pAggInfo){
5682   Vdbe *v = pParse->pVdbe;
5683   int i;
5684   int regHit = 0;
5685   int addrHitTest = 0;
5686   struct AggInfo_func *pF;
5687   struct AggInfo_col *pC;
5688 
5689   pAggInfo->directMode = 1;
5690   for(i=0, pF=pAggInfo->aFunc; i<pAggInfo->nFunc; i++, pF++){
5691     int nArg;
5692     int addrNext = 0;
5693     int regAgg;
5694     ExprList *pList = pF->pFExpr->x.pList;
5695     assert( !ExprHasProperty(pF->pFExpr, EP_xIsSelect) );
5696     assert( !IsWindowFunc(pF->pFExpr) );
5697     if( ExprHasProperty(pF->pFExpr, EP_WinFunc) ){
5698       Expr *pFilter = pF->pFExpr->y.pWin->pFilter;
5699       if( pAggInfo->nAccumulator
5700        && (pF->pFunc->funcFlags & SQLITE_FUNC_NEEDCOLL)
5701        && regAcc
5702       ){
5703         /* If regAcc==0, there there exists some min() or max() function
5704         ** without a FILTER clause that will ensure the magnet registers
5705         ** are populated. */
5706         if( regHit==0 ) regHit = ++pParse->nMem;
5707         /* If this is the first row of the group (regAcc contains 0), clear the
5708         ** "magnet" register regHit so that the accumulator registers
5709         ** are populated if the FILTER clause jumps over the the
5710         ** invocation of min() or max() altogether. Or, if this is not
5711         ** the first row (regAcc contains 1), set the magnet register so that
5712         ** the accumulators are not populated unless the min()/max() is invoked
5713         ** and indicates that they should be.  */
5714         sqlite3VdbeAddOp2(v, OP_Copy, regAcc, regHit);
5715       }
5716       addrNext = sqlite3VdbeMakeLabel(pParse);
5717       sqlite3ExprIfFalse(pParse, pFilter, addrNext, SQLITE_JUMPIFNULL);
5718     }
5719     if( pList ){
5720       nArg = pList->nExpr;
5721       regAgg = sqlite3GetTempRange(pParse, nArg);
5722       sqlite3ExprCodeExprList(pParse, pList, regAgg, 0, SQLITE_ECEL_DUP);
5723     }else{
5724       nArg = 0;
5725       regAgg = 0;
5726     }
5727     if( pF->iDistinct>=0 ){
5728       if( addrNext==0 ){
5729         addrNext = sqlite3VdbeMakeLabel(pParse);
5730       }
5731       testcase( nArg==0 );  /* Error condition */
5732       testcase( nArg>1 );   /* Also an error */
5733       codeDistinct(pParse, pF->iDistinct, addrNext, 1, regAgg);
5734     }
5735     if( pF->pFunc->funcFlags & SQLITE_FUNC_NEEDCOLL ){
5736       CollSeq *pColl = 0;
5737       struct ExprList_item *pItem;
5738       int j;
5739       assert( pList!=0 );  /* pList!=0 if pF->pFunc has NEEDCOLL */
5740       for(j=0, pItem=pList->a; !pColl && j<nArg; j++, pItem++){
5741         pColl = sqlite3ExprCollSeq(pParse, pItem->pExpr);
5742       }
5743       if( !pColl ){
5744         pColl = pParse->db->pDfltColl;
5745       }
5746       if( regHit==0 && pAggInfo->nAccumulator ) regHit = ++pParse->nMem;
5747       sqlite3VdbeAddOp4(v, OP_CollSeq, regHit, 0, 0, (char *)pColl, P4_COLLSEQ);
5748     }
5749     sqlite3VdbeAddOp3(v, OP_AggStep, 0, regAgg, pF->iMem);
5750     sqlite3VdbeAppendP4(v, pF->pFunc, P4_FUNCDEF);
5751     sqlite3VdbeChangeP5(v, (u8)nArg);
5752     sqlite3ReleaseTempRange(pParse, regAgg, nArg);
5753     if( addrNext ){
5754       sqlite3VdbeResolveLabel(v, addrNext);
5755     }
5756   }
5757   if( regHit==0 && pAggInfo->nAccumulator ){
5758     regHit = regAcc;
5759   }
5760   if( regHit ){
5761     addrHitTest = sqlite3VdbeAddOp1(v, OP_If, regHit); VdbeCoverage(v);
5762   }
5763   for(i=0, pC=pAggInfo->aCol; i<pAggInfo->nAccumulator; i++, pC++){
5764     sqlite3ExprCode(pParse, pC->pCExpr, pC->iMem);
5765   }
5766 
5767   pAggInfo->directMode = 0;
5768   if( addrHitTest ){
5769     sqlite3VdbeJumpHereOrPopInst(v, addrHitTest);
5770   }
5771 }
5772 
5773 /*
5774 ** Add a single OP_Explain instruction to the VDBE to explain a simple
5775 ** count(*) query ("SELECT count(*) FROM pTab").
5776 */
5777 #ifndef SQLITE_OMIT_EXPLAIN
5778 static void explainSimpleCount(
5779   Parse *pParse,                  /* Parse context */
5780   Table *pTab,                    /* Table being queried */
5781   Index *pIdx                     /* Index used to optimize scan, or NULL */
5782 ){
5783   if( pParse->explain==2 ){
5784     int bCover = (pIdx!=0 && (HasRowid(pTab) || !IsPrimaryKeyIndex(pIdx)));
5785     sqlite3VdbeExplain(pParse, 0, "SCAN %s%s%s",
5786         pTab->zName,
5787         bCover ? " USING COVERING INDEX " : "",
5788         bCover ? pIdx->zName : ""
5789     );
5790   }
5791 }
5792 #else
5793 # define explainSimpleCount(a,b,c)
5794 #endif
5795 
5796 /*
5797 ** sqlite3WalkExpr() callback used by havingToWhere().
5798 **
5799 ** If the node passed to the callback is a TK_AND node, return
5800 ** WRC_Continue to tell sqlite3WalkExpr() to iterate through child nodes.
5801 **
5802 ** Otherwise, return WRC_Prune. In this case, also check if the
5803 ** sub-expression matches the criteria for being moved to the WHERE
5804 ** clause. If so, add it to the WHERE clause and replace the sub-expression
5805 ** within the HAVING expression with a constant "1".
5806 */
5807 static int havingToWhereExprCb(Walker *pWalker, Expr *pExpr){
5808   if( pExpr->op!=TK_AND ){
5809     Select *pS = pWalker->u.pSelect;
5810     if( sqlite3ExprIsConstantOrGroupBy(pWalker->pParse, pExpr, pS->pGroupBy)
5811      && ExprAlwaysFalse(pExpr)==0
5812     ){
5813       sqlite3 *db = pWalker->pParse->db;
5814       Expr *pNew = sqlite3Expr(db, TK_INTEGER, "1");
5815       if( pNew ){
5816         Expr *pWhere = pS->pWhere;
5817         SWAP(Expr, *pNew, *pExpr);
5818         pNew = sqlite3ExprAnd(pWalker->pParse, pWhere, pNew);
5819         pS->pWhere = pNew;
5820         pWalker->eCode = 1;
5821       }
5822     }
5823     return WRC_Prune;
5824   }
5825   return WRC_Continue;
5826 }
5827 
5828 /*
5829 ** Transfer eligible terms from the HAVING clause of a query, which is
5830 ** processed after grouping, to the WHERE clause, which is processed before
5831 ** grouping. For example, the query:
5832 **
5833 **   SELECT * FROM <tables> WHERE a=? GROUP BY b HAVING b=? AND c=?
5834 **
5835 ** can be rewritten as:
5836 **
5837 **   SELECT * FROM <tables> WHERE a=? AND b=? GROUP BY b HAVING c=?
5838 **
5839 ** A term of the HAVING expression is eligible for transfer if it consists
5840 ** entirely of constants and expressions that are also GROUP BY terms that
5841 ** use the "BINARY" collation sequence.
5842 */
5843 static void havingToWhere(Parse *pParse, Select *p){
5844   Walker sWalker;
5845   memset(&sWalker, 0, sizeof(sWalker));
5846   sWalker.pParse = pParse;
5847   sWalker.xExprCallback = havingToWhereExprCb;
5848   sWalker.u.pSelect = p;
5849   sqlite3WalkExpr(&sWalker, p->pHaving);
5850 #if SELECTTRACE_ENABLED
5851   if( sWalker.eCode && (sqlite3SelectTrace & 0x100)!=0 ){
5852     SELECTTRACE(0x100,pParse,p,("Move HAVING terms into WHERE:\n"));
5853     sqlite3TreeViewSelect(0, p, 0);
5854   }
5855 #endif
5856 }
5857 
5858 /*
5859 ** Check to see if the pThis entry of pTabList is a self-join of a prior view.
5860 ** If it is, then return the SrcList_item for the prior view.  If it is not,
5861 ** then return 0.
5862 */
5863 static SrcItem *isSelfJoinView(
5864   SrcList *pTabList,           /* Search for self-joins in this FROM clause */
5865   SrcItem *pThis               /* Search for prior reference to this subquery */
5866 ){
5867   SrcItem *pItem;
5868   assert( pThis->pSelect!=0 );
5869   if( pThis->pSelect->selFlags & SF_PushDown ) return 0;
5870   for(pItem = pTabList->a; pItem<pThis; pItem++){
5871     Select *pS1;
5872     if( pItem->pSelect==0 ) continue;
5873     if( pItem->fg.viaCoroutine ) continue;
5874     if( pItem->zName==0 ) continue;
5875     assert( pItem->pTab!=0 );
5876     assert( pThis->pTab!=0 );
5877     if( pItem->pTab->pSchema!=pThis->pTab->pSchema ) continue;
5878     if( sqlite3_stricmp(pItem->zName, pThis->zName)!=0 ) continue;
5879     pS1 = pItem->pSelect;
5880     if( pItem->pTab->pSchema==0 && pThis->pSelect->selId!=pS1->selId ){
5881       /* The query flattener left two different CTE tables with identical
5882       ** names in the same FROM clause. */
5883       continue;
5884     }
5885     if( pItem->pSelect->selFlags & SF_PushDown ){
5886       /* The view was modified by some other optimization such as
5887       ** pushDownWhereTerms() */
5888       continue;
5889     }
5890     return pItem;
5891   }
5892   return 0;
5893 }
5894 
5895 /*
5896 ** Deallocate a single AggInfo object
5897 */
5898 static void agginfoFree(sqlite3 *db, AggInfo *p){
5899   sqlite3DbFree(db, p->aCol);
5900   sqlite3DbFree(db, p->aFunc);
5901   sqlite3DbFreeNN(db, p);
5902 }
5903 
5904 #ifdef SQLITE_COUNTOFVIEW_OPTIMIZATION
5905 /*
5906 ** Attempt to transform a query of the form
5907 **
5908 **    SELECT count(*) FROM (SELECT x FROM t1 UNION ALL SELECT y FROM t2)
5909 **
5910 ** Into this:
5911 **
5912 **    SELECT (SELECT count(*) FROM t1)+(SELECT count(*) FROM t2)
5913 **
5914 ** The transformation only works if all of the following are true:
5915 **
5916 **   *  The subquery is a UNION ALL of two or more terms
5917 **   *  The subquery does not have a LIMIT clause
5918 **   *  There is no WHERE or GROUP BY or HAVING clauses on the subqueries
5919 **   *  The outer query is a simple count(*) with no WHERE clause or other
5920 **      extraneous syntax.
5921 **
5922 ** Return TRUE if the optimization is undertaken.
5923 */
5924 static int countOfViewOptimization(Parse *pParse, Select *p){
5925   Select *pSub, *pPrior;
5926   Expr *pExpr;
5927   Expr *pCount;
5928   sqlite3 *db;
5929   if( (p->selFlags & SF_Aggregate)==0 ) return 0;   /* This is an aggregate */
5930   if( p->pEList->nExpr!=1 ) return 0;               /* Single result column */
5931   if( p->pWhere ) return 0;
5932   if( p->pGroupBy ) return 0;
5933   pExpr = p->pEList->a[0].pExpr;
5934   if( pExpr->op!=TK_AGG_FUNCTION ) return 0;        /* Result is an aggregate */
5935   if( sqlite3_stricmp(pExpr->u.zToken,"count") ) return 0;  /* Is count() */
5936   if( pExpr->x.pList!=0 ) return 0;                 /* Must be count(*) */
5937   if( p->pSrc->nSrc!=1 ) return 0;                  /* One table in FROM  */
5938   pSub = p->pSrc->a[0].pSelect;
5939   if( pSub==0 ) return 0;                           /* The FROM is a subquery */
5940   if( pSub->pPrior==0 ) return 0;                   /* Must be a compound ry */
5941   do{
5942     if( pSub->op!=TK_ALL && pSub->pPrior ) return 0;  /* Must be UNION ALL */
5943     if( pSub->pWhere ) return 0;                      /* No WHERE clause */
5944     if( pSub->pLimit ) return 0;                      /* No LIMIT clause */
5945     if( pSub->selFlags & SF_Aggregate ) return 0;     /* Not an aggregate */
5946     pSub = pSub->pPrior;                              /* Repeat over compound */
5947   }while( pSub );
5948 
5949   /* If we reach this point then it is OK to perform the transformation */
5950 
5951   db = pParse->db;
5952   pCount = pExpr;
5953   pExpr = 0;
5954   pSub = p->pSrc->a[0].pSelect;
5955   p->pSrc->a[0].pSelect = 0;
5956   sqlite3SrcListDelete(db, p->pSrc);
5957   p->pSrc = sqlite3DbMallocZero(pParse->db, sizeof(*p->pSrc));
5958   while( pSub ){
5959     Expr *pTerm;
5960     pPrior = pSub->pPrior;
5961     pSub->pPrior = 0;
5962     pSub->pNext = 0;
5963     pSub->selFlags |= SF_Aggregate;
5964     pSub->selFlags &= ~SF_Compound;
5965     pSub->nSelectRow = 0;
5966     sqlite3ExprListDelete(db, pSub->pEList);
5967     pTerm = pPrior ? sqlite3ExprDup(db, pCount, 0) : pCount;
5968     pSub->pEList = sqlite3ExprListAppend(pParse, 0, pTerm);
5969     pTerm = sqlite3PExpr(pParse, TK_SELECT, 0, 0);
5970     sqlite3PExprAddSelect(pParse, pTerm, pSub);
5971     if( pExpr==0 ){
5972       pExpr = pTerm;
5973     }else{
5974       pExpr = sqlite3PExpr(pParse, TK_PLUS, pTerm, pExpr);
5975     }
5976     pSub = pPrior;
5977   }
5978   p->pEList->a[0].pExpr = pExpr;
5979   p->selFlags &= ~SF_Aggregate;
5980 
5981 #if SELECTTRACE_ENABLED
5982   if( sqlite3SelectTrace & 0x400 ){
5983     SELECTTRACE(0x400,pParse,p,("After count-of-view optimization:\n"));
5984     sqlite3TreeViewSelect(0, p, 0);
5985   }
5986 #endif
5987   return 1;
5988 }
5989 #endif /* SQLITE_COUNTOFVIEW_OPTIMIZATION */
5990 
5991 /*
5992 ** Generate code for the SELECT statement given in the p argument.
5993 **
5994 ** The results are returned according to the SelectDest structure.
5995 ** See comments in sqliteInt.h for further information.
5996 **
5997 ** This routine returns the number of errors.  If any errors are
5998 ** encountered, then an appropriate error message is left in
5999 ** pParse->zErrMsg.
6000 **
6001 ** This routine does NOT free the Select structure passed in.  The
6002 ** calling function needs to do that.
6003 */
6004 int sqlite3Select(
6005   Parse *pParse,         /* The parser context */
6006   Select *p,             /* The SELECT statement being coded. */
6007   SelectDest *pDest      /* What to do with the query results */
6008 ){
6009   int i, j;              /* Loop counters */
6010   WhereInfo *pWInfo;     /* Return from sqlite3WhereBegin() */
6011   Vdbe *v;               /* The virtual machine under construction */
6012   int isAgg;             /* True for select lists like "count(*)" */
6013   ExprList *pEList = 0;  /* List of columns to extract. */
6014   SrcList *pTabList;     /* List of tables to select from */
6015   Expr *pWhere;          /* The WHERE clause.  May be NULL */
6016   ExprList *pGroupBy;    /* The GROUP BY clause.  May be NULL */
6017   Expr *pHaving;         /* The HAVING clause.  May be NULL */
6018   AggInfo *pAggInfo = 0; /* Aggregate information */
6019   int rc = 1;            /* Value to return from this function */
6020   DistinctCtx sDistinct; /* Info on how to code the DISTINCT keyword */
6021   SortCtx sSort;         /* Info on how to code the ORDER BY clause */
6022   int iEnd;              /* Address of the end of the query */
6023   sqlite3 *db;           /* The database connection */
6024   ExprList *pMinMaxOrderBy = 0;  /* Added ORDER BY for min/max queries */
6025   u8 minMaxFlag;                 /* Flag for min/max queries */
6026 
6027   db = pParse->db;
6028   v = sqlite3GetVdbe(pParse);
6029   if( p==0 || db->mallocFailed || pParse->nErr ){
6030     return 1;
6031   }
6032   if( sqlite3AuthCheck(pParse, SQLITE_SELECT, 0, 0, 0) ) return 1;
6033 #if SELECTTRACE_ENABLED
6034   SELECTTRACE(1,pParse,p, ("begin processing:\n", pParse->addrExplain));
6035   if( sqlite3SelectTrace & 0x100 ){
6036     sqlite3TreeViewSelect(0, p, 0);
6037   }
6038 #endif
6039 
6040   assert( p->pOrderBy==0 || pDest->eDest!=SRT_DistFifo );
6041   assert( p->pOrderBy==0 || pDest->eDest!=SRT_Fifo );
6042   assert( p->pOrderBy==0 || pDest->eDest!=SRT_DistQueue );
6043   assert( p->pOrderBy==0 || pDest->eDest!=SRT_Queue );
6044   if( IgnorableDistinct(pDest) ){
6045     assert(pDest->eDest==SRT_Exists     || pDest->eDest==SRT_Union ||
6046            pDest->eDest==SRT_Except     || pDest->eDest==SRT_Discard ||
6047            pDest->eDest==SRT_DistQueue  || pDest->eDest==SRT_DistFifo );
6048     /* All of these destinations are also able to ignore the ORDER BY clause */
6049     if( p->pOrderBy ){
6050 #if SELECTTRACE_ENABLED
6051       SELECTTRACE(1,pParse,p, ("dropping superfluous ORDER BY:\n"));
6052       if( sqlite3SelectTrace & 0x100 ){
6053         sqlite3TreeViewExprList(0, p->pOrderBy, 0, "ORDERBY");
6054       }
6055 #endif
6056       sqlite3ParserAddCleanup(pParse,
6057         (void(*)(sqlite3*,void*))sqlite3ExprListDelete,
6058         p->pOrderBy);
6059       testcase( pParse->earlyCleanup );
6060       p->pOrderBy = 0;
6061     }
6062     p->selFlags &= ~SF_Distinct;
6063     p->selFlags |= SF_NoopOrderBy;
6064   }
6065   sqlite3SelectPrep(pParse, p, 0);
6066   if( pParse->nErr || db->mallocFailed ){
6067     goto select_end;
6068   }
6069   assert( p->pEList!=0 );
6070 #if SELECTTRACE_ENABLED
6071   if( sqlite3SelectTrace & 0x104 ){
6072     SELECTTRACE(0x104,pParse,p, ("after name resolution:\n"));
6073     sqlite3TreeViewSelect(0, p, 0);
6074   }
6075 #endif
6076 
6077   /* If the SF_UpdateFrom flag is set, then this function is being called
6078   ** as part of populating the temp table for an UPDATE...FROM statement.
6079   ** In this case, it is an error if the target object (pSrc->a[0]) name
6080   ** or alias is duplicated within FROM clause (pSrc->a[1..n]).  */
6081   if( p->selFlags & SF_UpdateFrom ){
6082     SrcItem *p0 = &p->pSrc->a[0];
6083     for(i=1; i<p->pSrc->nSrc; i++){
6084       SrcItem *p1 = &p->pSrc->a[i];
6085       if( p0->pTab==p1->pTab && 0==sqlite3_stricmp(p0->zAlias, p1->zAlias) ){
6086         sqlite3ErrorMsg(pParse,
6087             "target object/alias may not appear in FROM clause: %s",
6088             p0->zAlias ? p0->zAlias : p0->pTab->zName
6089         );
6090         goto select_end;
6091       }
6092     }
6093   }
6094 
6095   if( pDest->eDest==SRT_Output ){
6096     generateColumnNames(pParse, p);
6097   }
6098 
6099 #ifndef SQLITE_OMIT_WINDOWFUNC
6100   rc = sqlite3WindowRewrite(pParse, p);
6101   if( rc ){
6102     assert( db->mallocFailed || pParse->nErr>0 );
6103     goto select_end;
6104   }
6105 #if SELECTTRACE_ENABLED
6106   if( p->pWin && (sqlite3SelectTrace & 0x108)!=0 ){
6107     SELECTTRACE(0x104,pParse,p, ("after window rewrite:\n"));
6108     sqlite3TreeViewSelect(0, p, 0);
6109   }
6110 #endif
6111 #endif /* SQLITE_OMIT_WINDOWFUNC */
6112   pTabList = p->pSrc;
6113   isAgg = (p->selFlags & SF_Aggregate)!=0;
6114   memset(&sSort, 0, sizeof(sSort));
6115   sSort.pOrderBy = p->pOrderBy;
6116 
6117   /* Try to do various optimizations (flattening subqueries, and strength
6118   ** reduction of join operators) in the FROM clause up into the main query
6119   */
6120 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
6121   for(i=0; !p->pPrior && i<pTabList->nSrc; i++){
6122     SrcItem *pItem = &pTabList->a[i];
6123     Select *pSub = pItem->pSelect;
6124     Table *pTab = pItem->pTab;
6125 
6126     /* The expander should have already created transient Table objects
6127     ** even for FROM clause elements such as subqueries that do not correspond
6128     ** to a real table */
6129     assert( pTab!=0 );
6130 
6131     /* Convert LEFT JOIN into JOIN if there are terms of the right table
6132     ** of the LEFT JOIN used in the WHERE clause.
6133     */
6134     if( (pItem->fg.jointype & JT_LEFT)!=0
6135      && sqlite3ExprImpliesNonNullRow(p->pWhere, pItem->iCursor)
6136      && OptimizationEnabled(db, SQLITE_SimplifyJoin)
6137     ){
6138       SELECTTRACE(0x100,pParse,p,
6139                 ("LEFT-JOIN simplifies to JOIN on term %d\n",i));
6140       pItem->fg.jointype &= ~(JT_LEFT|JT_OUTER);
6141       unsetJoinExpr(p->pWhere, pItem->iCursor);
6142     }
6143 
6144     /* No futher action if this term of the FROM clause is no a subquery */
6145     if( pSub==0 ) continue;
6146 
6147     /* Catch mismatch in the declared columns of a view and the number of
6148     ** columns in the SELECT on the RHS */
6149     if( pTab->nCol!=pSub->pEList->nExpr ){
6150       sqlite3ErrorMsg(pParse, "expected %d columns for '%s' but got %d",
6151                       pTab->nCol, pTab->zName, pSub->pEList->nExpr);
6152       goto select_end;
6153     }
6154 
6155     /* Do not try to flatten an aggregate subquery.
6156     **
6157     ** Flattening an aggregate subquery is only possible if the outer query
6158     ** is not a join.  But if the outer query is not a join, then the subquery
6159     ** will be implemented as a co-routine and there is no advantage to
6160     ** flattening in that case.
6161     */
6162     if( (pSub->selFlags & SF_Aggregate)!=0 ) continue;
6163     assert( pSub->pGroupBy==0 );
6164 
6165     /* If the outer query contains a "complex" result set (that is,
6166     ** if the result set of the outer query uses functions or subqueries)
6167     ** and if the subquery contains an ORDER BY clause and if
6168     ** it will be implemented as a co-routine, then do not flatten.  This
6169     ** restriction allows SQL constructs like this:
6170     **
6171     **  SELECT expensive_function(x)
6172     **    FROM (SELECT x FROM tab ORDER BY y LIMIT 10);
6173     **
6174     ** The expensive_function() is only computed on the 10 rows that
6175     ** are output, rather than every row of the table.
6176     **
6177     ** The requirement that the outer query have a complex result set
6178     ** means that flattening does occur on simpler SQL constraints without
6179     ** the expensive_function() like:
6180     **
6181     **  SELECT x FROM (SELECT x FROM tab ORDER BY y LIMIT 10);
6182     */
6183     if( pSub->pOrderBy!=0
6184      && i==0
6185      && (p->selFlags & SF_ComplexResult)!=0
6186      && (pTabList->nSrc==1
6187          || (pTabList->a[1].fg.jointype&(JT_LEFT|JT_CROSS))!=0)
6188     ){
6189       continue;
6190     }
6191 
6192     if( flattenSubquery(pParse, p, i, isAgg) ){
6193       if( pParse->nErr ) goto select_end;
6194       /* This subquery can be absorbed into its parent. */
6195       i = -1;
6196     }
6197     pTabList = p->pSrc;
6198     if( db->mallocFailed ) goto select_end;
6199     if( !IgnorableOrderby(pDest) ){
6200       sSort.pOrderBy = p->pOrderBy;
6201     }
6202   }
6203 #endif
6204 
6205 #ifndef SQLITE_OMIT_COMPOUND_SELECT
6206   /* Handle compound SELECT statements using the separate multiSelect()
6207   ** procedure.
6208   */
6209   if( p->pPrior ){
6210     rc = multiSelect(pParse, p, pDest);
6211 #if SELECTTRACE_ENABLED
6212     SELECTTRACE(0x1,pParse,p,("end compound-select processing\n"));
6213     if( (sqlite3SelectTrace & 0x2000)!=0 && ExplainQueryPlanParent(pParse)==0 ){
6214       sqlite3TreeViewSelect(0, p, 0);
6215     }
6216 #endif
6217     if( p->pNext==0 ) ExplainQueryPlanPop(pParse);
6218     return rc;
6219   }
6220 #endif
6221 
6222   /* Do the WHERE-clause constant propagation optimization if this is
6223   ** a join.  No need to speed time on this operation for non-join queries
6224   ** as the equivalent optimization will be handled by query planner in
6225   ** sqlite3WhereBegin().
6226   */
6227   if( pTabList->nSrc>1
6228    && OptimizationEnabled(db, SQLITE_PropagateConst)
6229    && propagateConstants(pParse, p)
6230   ){
6231 #if SELECTTRACE_ENABLED
6232     if( sqlite3SelectTrace & 0x100 ){
6233       SELECTTRACE(0x100,pParse,p,("After constant propagation:\n"));
6234       sqlite3TreeViewSelect(0, p, 0);
6235     }
6236 #endif
6237   }else{
6238     SELECTTRACE(0x100,pParse,p,("Constant propagation not helpful\n"));
6239   }
6240 
6241 #ifdef SQLITE_COUNTOFVIEW_OPTIMIZATION
6242   if( OptimizationEnabled(db, SQLITE_QueryFlattener|SQLITE_CountOfView)
6243    && countOfViewOptimization(pParse, p)
6244   ){
6245     if( db->mallocFailed ) goto select_end;
6246     pEList = p->pEList;
6247     pTabList = p->pSrc;
6248   }
6249 #endif
6250 
6251   /* For each term in the FROM clause, do two things:
6252   ** (1) Authorized unreferenced tables
6253   ** (2) Generate code for all sub-queries
6254   */
6255   for(i=0; i<pTabList->nSrc; i++){
6256     SrcItem *pItem = &pTabList->a[i];
6257     SrcItem *pPrior;
6258     SelectDest dest;
6259     Select *pSub;
6260 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
6261     const char *zSavedAuthContext;
6262 #endif
6263 
6264     /* Issue SQLITE_READ authorizations with a fake column name for any
6265     ** tables that are referenced but from which no values are extracted.
6266     ** Examples of where these kinds of null SQLITE_READ authorizations
6267     ** would occur:
6268     **
6269     **     SELECT count(*) FROM t1;   -- SQLITE_READ t1.""
6270     **     SELECT t1.* FROM t1, t2;   -- SQLITE_READ t2.""
6271     **
6272     ** The fake column name is an empty string.  It is possible for a table to
6273     ** have a column named by the empty string, in which case there is no way to
6274     ** distinguish between an unreferenced table and an actual reference to the
6275     ** "" column. The original design was for the fake column name to be a NULL,
6276     ** which would be unambiguous.  But legacy authorization callbacks might
6277     ** assume the column name is non-NULL and segfault.  The use of an empty
6278     ** string for the fake column name seems safer.
6279     */
6280     if( pItem->colUsed==0 && pItem->zName!=0 ){
6281       sqlite3AuthCheck(pParse, SQLITE_READ, pItem->zName, "", pItem->zDatabase);
6282     }
6283 
6284 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
6285     /* Generate code for all sub-queries in the FROM clause
6286     */
6287     pSub = pItem->pSelect;
6288     if( pSub==0 ) continue;
6289 
6290     /* The code for a subquery should only be generated once, though it is
6291     ** technically harmless for it to be generated multiple times. The
6292     ** following assert() will detect if something changes to cause
6293     ** the same subquery to be coded multiple times, as a signal to the
6294     ** developers to try to optimize the situation.
6295     **
6296     ** Update 2019-07-24:
6297     ** See ticket https://sqlite.org/src/tktview/c52b09c7f38903b1311cec40.
6298     ** The dbsqlfuzz fuzzer found a case where the same subquery gets
6299     ** coded twice.  So this assert() now becomes a testcase().  It should
6300     ** be very rare, though.
6301     */
6302     testcase( pItem->addrFillSub!=0 );
6303 
6304     /* Increment Parse.nHeight by the height of the largest expression
6305     ** tree referred to by this, the parent select. The child select
6306     ** may contain expression trees of at most
6307     ** (SQLITE_MAX_EXPR_DEPTH-Parse.nHeight) height. This is a bit
6308     ** more conservative than necessary, but much easier than enforcing
6309     ** an exact limit.
6310     */
6311     pParse->nHeight += sqlite3SelectExprHeight(p);
6312 
6313     /* Make copies of constant WHERE-clause terms in the outer query down
6314     ** inside the subquery.  This can help the subquery to run more efficiently.
6315     */
6316     if( OptimizationEnabled(db, SQLITE_PushDown)
6317      && (pItem->fg.isCte==0 || pItem->u2.pCteUse->eM10d!=M10d_Yes)
6318      && pushDownWhereTerms(pParse, pSub, p->pWhere, pItem->iCursor,
6319                            (pItem->fg.jointype & JT_OUTER)!=0)
6320     ){
6321 #if SELECTTRACE_ENABLED
6322       if( sqlite3SelectTrace & 0x100 ){
6323         SELECTTRACE(0x100,pParse,p,
6324             ("After WHERE-clause push-down into subquery %d:\n", pSub->selId));
6325         sqlite3TreeViewSelect(0, p, 0);
6326       }
6327 #endif
6328       assert( pItem->pSelect && (pItem->pSelect->selFlags & SF_PushDown)!=0 );
6329     }else{
6330       SELECTTRACE(0x100,pParse,p,("Push-down not possible\n"));
6331     }
6332 
6333     zSavedAuthContext = pParse->zAuthContext;
6334     pParse->zAuthContext = pItem->zName;
6335 
6336     /* Generate code to implement the subquery
6337     **
6338     ** The subquery is implemented as a co-routine if:
6339     **    (1)  the subquery is guaranteed to be the outer loop (so that
6340     **         it does not need to be computed more than once), and
6341     **    (2)  the subquery is not a CTE that should be materialized
6342     **
6343     ** TODO: Are there other reasons beside (1) and (2) to use a co-routine
6344     ** implementation?
6345     */
6346     if( i==0
6347      && (pTabList->nSrc==1
6348             || (pTabList->a[1].fg.jointype&(JT_LEFT|JT_CROSS))!=0)  /* (1) */
6349      && (pItem->fg.isCte==0 || pItem->u2.pCteUse->eM10d!=M10d_Yes)  /* (2) */
6350     ){
6351       /* Implement a co-routine that will return a single row of the result
6352       ** set on each invocation.
6353       */
6354       int addrTop = sqlite3VdbeCurrentAddr(v)+1;
6355 
6356       pItem->regReturn = ++pParse->nMem;
6357       sqlite3VdbeAddOp3(v, OP_InitCoroutine, pItem->regReturn, 0, addrTop);
6358       VdbeComment((v, "%!S", pItem));
6359       pItem->addrFillSub = addrTop;
6360       sqlite3SelectDestInit(&dest, SRT_Coroutine, pItem->regReturn);
6361       ExplainQueryPlan((pParse, 1, "CO-ROUTINE %!S", pItem));
6362       sqlite3Select(pParse, pSub, &dest);
6363       pItem->pTab->nRowLogEst = pSub->nSelectRow;
6364       pItem->fg.viaCoroutine = 1;
6365       pItem->regResult = dest.iSdst;
6366       sqlite3VdbeEndCoroutine(v, pItem->regReturn);
6367       sqlite3VdbeJumpHere(v, addrTop-1);
6368       sqlite3ClearTempRegCache(pParse);
6369     }else if( pItem->fg.isCte && pItem->u2.pCteUse->addrM9e>0 ){
6370       /* This is a CTE for which materialization code has already been
6371       ** generated.  Invoke the subroutine to compute the materialization,
6372       ** the make the pItem->iCursor be a copy of the ephemerial table that
6373       ** holds the result of the materialization. */
6374       CteUse *pCteUse = pItem->u2.pCteUse;
6375       sqlite3VdbeAddOp2(v, OP_Gosub, pCteUse->regRtn, pCteUse->addrM9e);
6376       if( pItem->iCursor!=pCteUse->iCur ){
6377         sqlite3VdbeAddOp2(v, OP_OpenDup, pItem->iCursor, pCteUse->iCur);
6378       }
6379       pSub->nSelectRow = pCteUse->nRowEst;
6380     }else if( (pPrior = isSelfJoinView(pTabList, pItem))!=0 ){
6381       /* This view has already been materialized by a prior entry in
6382       ** this same FROM clause.  Reuse it. */
6383       if( pPrior->addrFillSub ){
6384         sqlite3VdbeAddOp2(v, OP_Gosub, pPrior->regReturn, pPrior->addrFillSub);
6385       }
6386       sqlite3VdbeAddOp2(v, OP_OpenDup, pItem->iCursor, pPrior->iCursor);
6387       pSub->nSelectRow = pPrior->pSelect->nSelectRow;
6388     }else{
6389       /* Materalize the view.  If the view is not correlated, generate a
6390       ** subroutine to do the materialization so that subsequent uses of
6391       ** the same view can reuse the materialization. */
6392       int topAddr;
6393       int onceAddr = 0;
6394       int retAddr;
6395 
6396       testcase( pItem->addrFillSub==0 ); /* Ticket c52b09c7f38903b1311 */
6397       pItem->regReturn = ++pParse->nMem;
6398       topAddr = sqlite3VdbeAddOp2(v, OP_Integer, 0, pItem->regReturn);
6399       pItem->addrFillSub = topAddr+1;
6400       if( pItem->fg.isCorrelated==0 ){
6401         /* If the subquery is not correlated and if we are not inside of
6402         ** a trigger, then we only need to compute the value of the subquery
6403         ** once. */
6404         onceAddr = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
6405         VdbeComment((v, "materialize %!S", pItem));
6406       }else{
6407         VdbeNoopComment((v, "materialize %!S", pItem));
6408       }
6409       sqlite3SelectDestInit(&dest, SRT_EphemTab, pItem->iCursor);
6410       ExplainQueryPlan((pParse, 1, "MATERIALIZE %!S", pItem));
6411       sqlite3Select(pParse, pSub, &dest);
6412       pItem->pTab->nRowLogEst = pSub->nSelectRow;
6413       if( onceAddr ) sqlite3VdbeJumpHere(v, onceAddr);
6414       retAddr = sqlite3VdbeAddOp1(v, OP_Return, pItem->regReturn);
6415       VdbeComment((v, "end %!S", pItem));
6416       sqlite3VdbeChangeP1(v, topAddr, retAddr);
6417       sqlite3ClearTempRegCache(pParse);
6418       if( pItem->fg.isCte && pItem->fg.isCorrelated==0 ){
6419         CteUse *pCteUse = pItem->u2.pCteUse;
6420         pCteUse->addrM9e = pItem->addrFillSub;
6421         pCteUse->regRtn = pItem->regReturn;
6422         pCteUse->iCur = pItem->iCursor;
6423         pCteUse->nRowEst = pSub->nSelectRow;
6424       }
6425     }
6426     if( db->mallocFailed ) goto select_end;
6427     pParse->nHeight -= sqlite3SelectExprHeight(p);
6428     pParse->zAuthContext = zSavedAuthContext;
6429 #endif
6430   }
6431 
6432   /* Various elements of the SELECT copied into local variables for
6433   ** convenience */
6434   pEList = p->pEList;
6435   pWhere = p->pWhere;
6436   pGroupBy = p->pGroupBy;
6437   pHaving = p->pHaving;
6438   sDistinct.isTnct = (p->selFlags & SF_Distinct)!=0;
6439 
6440 #if SELECTTRACE_ENABLED
6441   if( sqlite3SelectTrace & 0x400 ){
6442     SELECTTRACE(0x400,pParse,p,("After all FROM-clause analysis:\n"));
6443     sqlite3TreeViewSelect(0, p, 0);
6444   }
6445 #endif
6446 
6447   /* If the query is DISTINCT with an ORDER BY but is not an aggregate, and
6448   ** if the select-list is the same as the ORDER BY list, then this query
6449   ** can be rewritten as a GROUP BY. In other words, this:
6450   **
6451   **     SELECT DISTINCT xyz FROM ... ORDER BY xyz
6452   **
6453   ** is transformed to:
6454   **
6455   **     SELECT xyz FROM ... GROUP BY xyz ORDER BY xyz
6456   **
6457   ** The second form is preferred as a single index (or temp-table) may be
6458   ** used for both the ORDER BY and DISTINCT processing. As originally
6459   ** written the query must use a temp-table for at least one of the ORDER
6460   ** BY and DISTINCT, and an index or separate temp-table for the other.
6461   */
6462   if( (p->selFlags & (SF_Distinct|SF_Aggregate))==SF_Distinct
6463    && sqlite3ExprListCompare(sSort.pOrderBy, pEList, -1)==0
6464 #ifndef SQLITE_OMIT_WINDOWFUNC
6465    && p->pWin==0
6466 #endif
6467   ){
6468     p->selFlags &= ~SF_Distinct;
6469     pGroupBy = p->pGroupBy = sqlite3ExprListDup(db, pEList, 0);
6470     p->selFlags |= SF_Aggregate;
6471     /* Notice that even thought SF_Distinct has been cleared from p->selFlags,
6472     ** the sDistinct.isTnct is still set.  Hence, isTnct represents the
6473     ** original setting of the SF_Distinct flag, not the current setting */
6474     assert( sDistinct.isTnct );
6475 
6476 #if SELECTTRACE_ENABLED
6477     if( sqlite3SelectTrace & 0x400 ){
6478       SELECTTRACE(0x400,pParse,p,("Transform DISTINCT into GROUP BY:\n"));
6479       sqlite3TreeViewSelect(0, p, 0);
6480     }
6481 #endif
6482   }
6483 
6484   /* If there is an ORDER BY clause, then create an ephemeral index to
6485   ** do the sorting.  But this sorting ephemeral index might end up
6486   ** being unused if the data can be extracted in pre-sorted order.
6487   ** If that is the case, then the OP_OpenEphemeral instruction will be
6488   ** changed to an OP_Noop once we figure out that the sorting index is
6489   ** not needed.  The sSort.addrSortIndex variable is used to facilitate
6490   ** that change.
6491   */
6492   if( sSort.pOrderBy ){
6493     KeyInfo *pKeyInfo;
6494     pKeyInfo = sqlite3KeyInfoFromExprList(
6495         pParse, sSort.pOrderBy, 0, pEList->nExpr);
6496     sSort.iECursor = pParse->nTab++;
6497     sSort.addrSortIndex =
6498       sqlite3VdbeAddOp4(v, OP_OpenEphemeral,
6499           sSort.iECursor, sSort.pOrderBy->nExpr+1+pEList->nExpr, 0,
6500           (char*)pKeyInfo, P4_KEYINFO
6501       );
6502   }else{
6503     sSort.addrSortIndex = -1;
6504   }
6505 
6506   /* If the output is destined for a temporary table, open that table.
6507   */
6508   if( pDest->eDest==SRT_EphemTab ){
6509     sqlite3VdbeAddOp2(v, OP_OpenEphemeral, pDest->iSDParm, pEList->nExpr);
6510   }
6511 
6512   /* Set the limiter.
6513   */
6514   iEnd = sqlite3VdbeMakeLabel(pParse);
6515   if( (p->selFlags & SF_FixedLimit)==0 ){
6516     p->nSelectRow = 320;  /* 4 billion rows */
6517   }
6518   computeLimitRegisters(pParse, p, iEnd);
6519   if( p->iLimit==0 && sSort.addrSortIndex>=0 ){
6520     sqlite3VdbeChangeOpcode(v, sSort.addrSortIndex, OP_SorterOpen);
6521     sSort.sortFlags |= SORTFLAG_UseSorter;
6522   }
6523 
6524   /* Open an ephemeral index to use for the distinct set.
6525   */
6526   if( p->selFlags & SF_Distinct ){
6527     sDistinct.tabTnct = pParse->nTab++;
6528     sDistinct.addrTnct = sqlite3VdbeAddOp4(v, OP_OpenEphemeral,
6529                        sDistinct.tabTnct, 0, 0,
6530                        (char*)sqlite3KeyInfoFromExprList(pParse, p->pEList,0,0),
6531                        P4_KEYINFO);
6532     sqlite3VdbeChangeP5(v, BTREE_UNORDERED);
6533     sDistinct.eTnctType = WHERE_DISTINCT_UNORDERED;
6534   }else{
6535     sDistinct.eTnctType = WHERE_DISTINCT_NOOP;
6536   }
6537 
6538   if( !isAgg && pGroupBy==0 ){
6539     /* No aggregate functions and no GROUP BY clause */
6540     u16 wctrlFlags = (sDistinct.isTnct ? WHERE_WANT_DISTINCT : 0)
6541                    | (p->selFlags & SF_FixedLimit);
6542 #ifndef SQLITE_OMIT_WINDOWFUNC
6543     Window *pWin = p->pWin;      /* Main window object (or NULL) */
6544     if( pWin ){
6545       sqlite3WindowCodeInit(pParse, p);
6546     }
6547 #endif
6548     assert( WHERE_USE_LIMIT==SF_FixedLimit );
6549 
6550 
6551     /* Begin the database scan. */
6552     SELECTTRACE(1,pParse,p,("WhereBegin\n"));
6553     pWInfo = sqlite3WhereBegin(pParse, pTabList, pWhere, sSort.pOrderBy,
6554                                p->pEList, wctrlFlags, p->nSelectRow);
6555     if( pWInfo==0 ) goto select_end;
6556     if( sqlite3WhereOutputRowCount(pWInfo) < p->nSelectRow ){
6557       p->nSelectRow = sqlite3WhereOutputRowCount(pWInfo);
6558     }
6559     if( sDistinct.isTnct && sqlite3WhereIsDistinct(pWInfo) ){
6560       sDistinct.eTnctType = sqlite3WhereIsDistinct(pWInfo);
6561     }
6562     if( sSort.pOrderBy ){
6563       sSort.nOBSat = sqlite3WhereIsOrdered(pWInfo);
6564       sSort.labelOBLopt = sqlite3WhereOrderByLimitOptLabel(pWInfo);
6565       if( sSort.nOBSat==sSort.pOrderBy->nExpr ){
6566         sSort.pOrderBy = 0;
6567       }
6568     }
6569     SELECTTRACE(1,pParse,p,("WhereBegin returns\n"));
6570 
6571     /* If sorting index that was created by a prior OP_OpenEphemeral
6572     ** instruction ended up not being needed, then change the OP_OpenEphemeral
6573     ** into an OP_Noop.
6574     */
6575     if( sSort.addrSortIndex>=0 && sSort.pOrderBy==0 ){
6576       sqlite3VdbeChangeToNoop(v, sSort.addrSortIndex);
6577     }
6578 
6579     assert( p->pEList==pEList );
6580 #ifndef SQLITE_OMIT_WINDOWFUNC
6581     if( pWin ){
6582       int addrGosub = sqlite3VdbeMakeLabel(pParse);
6583       int iCont = sqlite3VdbeMakeLabel(pParse);
6584       int iBreak = sqlite3VdbeMakeLabel(pParse);
6585       int regGosub = ++pParse->nMem;
6586 
6587       sqlite3WindowCodeStep(pParse, p, pWInfo, regGosub, addrGosub);
6588 
6589       sqlite3VdbeAddOp2(v, OP_Goto, 0, iBreak);
6590       sqlite3VdbeResolveLabel(v, addrGosub);
6591       VdbeNoopComment((v, "inner-loop subroutine"));
6592       sSort.labelOBLopt = 0;
6593       selectInnerLoop(pParse, p, -1, &sSort, &sDistinct, pDest, iCont, iBreak);
6594       sqlite3VdbeResolveLabel(v, iCont);
6595       sqlite3VdbeAddOp1(v, OP_Return, regGosub);
6596       VdbeComment((v, "end inner-loop subroutine"));
6597       sqlite3VdbeResolveLabel(v, iBreak);
6598     }else
6599 #endif /* SQLITE_OMIT_WINDOWFUNC */
6600     {
6601       /* Use the standard inner loop. */
6602       selectInnerLoop(pParse, p, -1, &sSort, &sDistinct, pDest,
6603           sqlite3WhereContinueLabel(pWInfo),
6604           sqlite3WhereBreakLabel(pWInfo));
6605 
6606       /* End the database scan loop.
6607       */
6608       SELECTTRACE(1,pParse,p,("WhereEnd\n"));
6609       sqlite3WhereEnd(pWInfo);
6610     }
6611   }else{
6612     /* This case when there exist aggregate functions or a GROUP BY clause
6613     ** or both */
6614     NameContext sNC;    /* Name context for processing aggregate information */
6615     int iAMem;          /* First Mem address for storing current GROUP BY */
6616     int iBMem;          /* First Mem address for previous GROUP BY */
6617     int iUseFlag;       /* Mem address holding flag indicating that at least
6618                         ** one row of the input to the aggregator has been
6619                         ** processed */
6620     int iAbortFlag;     /* Mem address which causes query abort if positive */
6621     int groupBySort;    /* Rows come from source in GROUP BY order */
6622     int addrEnd;        /* End of processing for this SELECT */
6623     int sortPTab = 0;   /* Pseudotable used to decode sorting results */
6624     int sortOut = 0;    /* Output register from the sorter */
6625     int orderByGrp = 0; /* True if the GROUP BY and ORDER BY are the same */
6626 
6627     /* Remove any and all aliases between the result set and the
6628     ** GROUP BY clause.
6629     */
6630     if( pGroupBy ){
6631       int k;                        /* Loop counter */
6632       struct ExprList_item *pItem;  /* For looping over expression in a list */
6633 
6634       for(k=p->pEList->nExpr, pItem=p->pEList->a; k>0; k--, pItem++){
6635         pItem->u.x.iAlias = 0;
6636       }
6637       for(k=pGroupBy->nExpr, pItem=pGroupBy->a; k>0; k--, pItem++){
6638         pItem->u.x.iAlias = 0;
6639       }
6640       assert( 66==sqlite3LogEst(100) );
6641       if( p->nSelectRow>66 ) p->nSelectRow = 66;
6642 
6643       /* If there is both a GROUP BY and an ORDER BY clause and they are
6644       ** identical, then it may be possible to disable the ORDER BY clause
6645       ** on the grounds that the GROUP BY will cause elements to come out
6646       ** in the correct order. It also may not - the GROUP BY might use a
6647       ** database index that causes rows to be grouped together as required
6648       ** but not actually sorted. Either way, record the fact that the
6649       ** ORDER BY and GROUP BY clauses are the same by setting the orderByGrp
6650       ** variable.  */
6651       if( sSort.pOrderBy && pGroupBy->nExpr==sSort.pOrderBy->nExpr ){
6652         int ii;
6653         /* The GROUP BY processing doesn't care whether rows are delivered in
6654         ** ASC or DESC order - only that each group is returned contiguously.
6655         ** So set the ASC/DESC flags in the GROUP BY to match those in the
6656         ** ORDER BY to maximize the chances of rows being delivered in an
6657         ** order that makes the ORDER BY redundant.  */
6658         for(ii=0; ii<pGroupBy->nExpr; ii++){
6659           u8 sortFlags = sSort.pOrderBy->a[ii].sortFlags & KEYINFO_ORDER_DESC;
6660           pGroupBy->a[ii].sortFlags = sortFlags;
6661         }
6662         if( sqlite3ExprListCompare(pGroupBy, sSort.pOrderBy, -1)==0 ){
6663           orderByGrp = 1;
6664         }
6665       }
6666     }else{
6667       assert( 0==sqlite3LogEst(1) );
6668       p->nSelectRow = 0;
6669     }
6670 
6671     /* Create a label to jump to when we want to abort the query */
6672     addrEnd = sqlite3VdbeMakeLabel(pParse);
6673 
6674     /* Convert TK_COLUMN nodes into TK_AGG_COLUMN and make entries in
6675     ** sAggInfo for all TK_AGG_FUNCTION nodes in expressions of the
6676     ** SELECT statement.
6677     */
6678     pAggInfo = sqlite3DbMallocZero(db, sizeof(*pAggInfo) );
6679     if( pAggInfo ){
6680       sqlite3ParserAddCleanup(pParse,
6681           (void(*)(sqlite3*,void*))agginfoFree, pAggInfo);
6682       testcase( pParse->earlyCleanup );
6683     }
6684     if( db->mallocFailed ){
6685       goto select_end;
6686     }
6687     pAggInfo->selId = p->selId;
6688     memset(&sNC, 0, sizeof(sNC));
6689     sNC.pParse = pParse;
6690     sNC.pSrcList = pTabList;
6691     sNC.uNC.pAggInfo = pAggInfo;
6692     VVA_ONLY( sNC.ncFlags = NC_UAggInfo; )
6693     pAggInfo->mnReg = pParse->nMem+1;
6694     pAggInfo->nSortingColumn = pGroupBy ? pGroupBy->nExpr : 0;
6695     pAggInfo->pGroupBy = pGroupBy;
6696     sqlite3ExprAnalyzeAggList(&sNC, pEList);
6697     sqlite3ExprAnalyzeAggList(&sNC, sSort.pOrderBy);
6698     if( pHaving ){
6699       if( pGroupBy ){
6700         assert( pWhere==p->pWhere );
6701         assert( pHaving==p->pHaving );
6702         assert( pGroupBy==p->pGroupBy );
6703         havingToWhere(pParse, p);
6704         pWhere = p->pWhere;
6705       }
6706       sqlite3ExprAnalyzeAggregates(&sNC, pHaving);
6707     }
6708     pAggInfo->nAccumulator = pAggInfo->nColumn;
6709     if( p->pGroupBy==0 && p->pHaving==0 && pAggInfo->nFunc==1 ){
6710       minMaxFlag = minMaxQuery(db, pAggInfo->aFunc[0].pFExpr, &pMinMaxOrderBy);
6711     }else{
6712       minMaxFlag = WHERE_ORDERBY_NORMAL;
6713     }
6714     for(i=0; i<pAggInfo->nFunc; i++){
6715       Expr *pExpr = pAggInfo->aFunc[i].pFExpr;
6716       assert( !ExprHasProperty(pExpr, EP_xIsSelect) );
6717       sNC.ncFlags |= NC_InAggFunc;
6718       sqlite3ExprAnalyzeAggList(&sNC, pExpr->x.pList);
6719 #ifndef SQLITE_OMIT_WINDOWFUNC
6720       assert( !IsWindowFunc(pExpr) );
6721       if( ExprHasProperty(pExpr, EP_WinFunc) ){
6722         sqlite3ExprAnalyzeAggregates(&sNC, pExpr->y.pWin->pFilter);
6723       }
6724 #endif
6725       sNC.ncFlags &= ~NC_InAggFunc;
6726     }
6727     pAggInfo->mxReg = pParse->nMem;
6728     if( db->mallocFailed ) goto select_end;
6729 #if SELECTTRACE_ENABLED
6730     if( sqlite3SelectTrace & 0x400 ){
6731       int ii;
6732       SELECTTRACE(0x400,pParse,p,("After aggregate analysis %p:\n", pAggInfo));
6733       sqlite3TreeViewSelect(0, p, 0);
6734       if( minMaxFlag ){
6735         sqlite3DebugPrintf("MIN/MAX Optimization (0x%02x) adds:\n", minMaxFlag);
6736         sqlite3TreeViewExprList(0, pMinMaxOrderBy, 0, "ORDERBY");
6737       }
6738       for(ii=0; ii<pAggInfo->nColumn; ii++){
6739         sqlite3DebugPrintf("agg-column[%d] iMem=%d\n",
6740             ii, pAggInfo->aCol[ii].iMem);
6741         sqlite3TreeViewExpr(0, pAggInfo->aCol[ii].pCExpr, 0);
6742       }
6743       for(ii=0; ii<pAggInfo->nFunc; ii++){
6744         sqlite3DebugPrintf("agg-func[%d]: iMem=%d\n",
6745             ii, pAggInfo->aFunc[ii].iMem);
6746         sqlite3TreeViewExpr(0, pAggInfo->aFunc[ii].pFExpr, 0);
6747       }
6748     }
6749 #endif
6750 
6751 
6752     /* Processing for aggregates with GROUP BY is very different and
6753     ** much more complex than aggregates without a GROUP BY.
6754     */
6755     if( pGroupBy ){
6756       KeyInfo *pKeyInfo;  /* Keying information for the group by clause */
6757       int addr1;          /* A-vs-B comparision jump */
6758       int addrOutputRow;  /* Start of subroutine that outputs a result row */
6759       int regOutputRow;   /* Return address register for output subroutine */
6760       int addrSetAbort;   /* Set the abort flag and return */
6761       int addrTopOfLoop;  /* Top of the input loop */
6762       int addrSortingIdx; /* The OP_OpenEphemeral for the sorting index */
6763       int addrReset;      /* Subroutine for resetting the accumulator */
6764       int regReset;       /* Return address register for reset subroutine */
6765 
6766       /* If there is a GROUP BY clause we might need a sorting index to
6767       ** implement it.  Allocate that sorting index now.  If it turns out
6768       ** that we do not need it after all, the OP_SorterOpen instruction
6769       ** will be converted into a Noop.
6770       */
6771       pAggInfo->sortingIdx = pParse->nTab++;
6772       pKeyInfo = sqlite3KeyInfoFromExprList(pParse, pGroupBy,
6773                                             0, pAggInfo->nColumn);
6774       addrSortingIdx = sqlite3VdbeAddOp4(v, OP_SorterOpen,
6775           pAggInfo->sortingIdx, pAggInfo->nSortingColumn,
6776           0, (char*)pKeyInfo, P4_KEYINFO);
6777 
6778       /* Initialize memory locations used by GROUP BY aggregate processing
6779       */
6780       iUseFlag = ++pParse->nMem;
6781       iAbortFlag = ++pParse->nMem;
6782       regOutputRow = ++pParse->nMem;
6783       addrOutputRow = sqlite3VdbeMakeLabel(pParse);
6784       regReset = ++pParse->nMem;
6785       addrReset = sqlite3VdbeMakeLabel(pParse);
6786       iAMem = pParse->nMem + 1;
6787       pParse->nMem += pGroupBy->nExpr;
6788       iBMem = pParse->nMem + 1;
6789       pParse->nMem += pGroupBy->nExpr;
6790       sqlite3VdbeAddOp2(v, OP_Integer, 0, iAbortFlag);
6791       VdbeComment((v, "clear abort flag"));
6792       sqlite3VdbeAddOp3(v, OP_Null, 0, iAMem, iAMem+pGroupBy->nExpr-1);
6793 
6794       /* Begin a loop that will extract all source rows in GROUP BY order.
6795       ** This might involve two separate loops with an OP_Sort in between, or
6796       ** it might be a single loop that uses an index to extract information
6797       ** in the right order to begin with.
6798       */
6799       sqlite3VdbeAddOp2(v, OP_Gosub, regReset, addrReset);
6800       SELECTTRACE(1,pParse,p,("WhereBegin\n"));
6801       pWInfo = sqlite3WhereBegin(pParse, pTabList, pWhere, pGroupBy, 0,
6802           WHERE_GROUPBY | (orderByGrp ? WHERE_SORTBYGROUP : 0), 0
6803       );
6804       if( pWInfo==0 ) goto select_end;
6805       SELECTTRACE(1,pParse,p,("WhereBegin returns\n"));
6806       if( sqlite3WhereIsOrdered(pWInfo)==pGroupBy->nExpr ){
6807         /* The optimizer is able to deliver rows in group by order so
6808         ** we do not have to sort.  The OP_OpenEphemeral table will be
6809         ** cancelled later because we still need to use the pKeyInfo
6810         */
6811         groupBySort = 0;
6812       }else{
6813         /* Rows are coming out in undetermined order.  We have to push
6814         ** each row into a sorting index, terminate the first loop,
6815         ** then loop over the sorting index in order to get the output
6816         ** in sorted order
6817         */
6818         int regBase;
6819         int regRecord;
6820         int nCol;
6821         int nGroupBy;
6822 
6823         explainTempTable(pParse,
6824             (sDistinct.isTnct && (p->selFlags&SF_Distinct)==0) ?
6825                     "DISTINCT" : "GROUP BY");
6826 
6827         groupBySort = 1;
6828         nGroupBy = pGroupBy->nExpr;
6829         nCol = nGroupBy;
6830         j = nGroupBy;
6831         for(i=0; i<pAggInfo->nColumn; i++){
6832           if( pAggInfo->aCol[i].iSorterColumn>=j ){
6833             nCol++;
6834             j++;
6835           }
6836         }
6837         regBase = sqlite3GetTempRange(pParse, nCol);
6838         sqlite3ExprCodeExprList(pParse, pGroupBy, regBase, 0, 0);
6839         j = nGroupBy;
6840         for(i=0; i<pAggInfo->nColumn; i++){
6841           struct AggInfo_col *pCol = &pAggInfo->aCol[i];
6842           if( pCol->iSorterColumn>=j ){
6843             int r1 = j + regBase;
6844             sqlite3ExprCodeGetColumnOfTable(v,
6845                                pCol->pTab, pCol->iTable, pCol->iColumn, r1);
6846             j++;
6847           }
6848         }
6849         regRecord = sqlite3GetTempReg(pParse);
6850         sqlite3VdbeAddOp3(v, OP_MakeRecord, regBase, nCol, regRecord);
6851         sqlite3VdbeAddOp2(v, OP_SorterInsert, pAggInfo->sortingIdx, regRecord);
6852         sqlite3ReleaseTempReg(pParse, regRecord);
6853         sqlite3ReleaseTempRange(pParse, regBase, nCol);
6854         SELECTTRACE(1,pParse,p,("WhereEnd\n"));
6855         sqlite3WhereEnd(pWInfo);
6856         pAggInfo->sortingIdxPTab = sortPTab = pParse->nTab++;
6857         sortOut = sqlite3GetTempReg(pParse);
6858         sqlite3VdbeAddOp3(v, OP_OpenPseudo, sortPTab, sortOut, nCol);
6859         sqlite3VdbeAddOp2(v, OP_SorterSort, pAggInfo->sortingIdx, addrEnd);
6860         VdbeComment((v, "GROUP BY sort")); VdbeCoverage(v);
6861         pAggInfo->useSortingIdx = 1;
6862       }
6863 
6864       /* If the index or temporary table used by the GROUP BY sort
6865       ** will naturally deliver rows in the order required by the ORDER BY
6866       ** clause, cancel the ephemeral table open coded earlier.
6867       **
6868       ** This is an optimization - the correct answer should result regardless.
6869       ** Use the SQLITE_GroupByOrder flag with SQLITE_TESTCTRL_OPTIMIZER to
6870       ** disable this optimization for testing purposes.  */
6871       if( orderByGrp && OptimizationEnabled(db, SQLITE_GroupByOrder)
6872        && (groupBySort || sqlite3WhereIsSorted(pWInfo))
6873       ){
6874         sSort.pOrderBy = 0;
6875         sqlite3VdbeChangeToNoop(v, sSort.addrSortIndex);
6876       }
6877 
6878       /* Evaluate the current GROUP BY terms and store in b0, b1, b2...
6879       ** (b0 is memory location iBMem+0, b1 is iBMem+1, and so forth)
6880       ** Then compare the current GROUP BY terms against the GROUP BY terms
6881       ** from the previous row currently stored in a0, a1, a2...
6882       */
6883       addrTopOfLoop = sqlite3VdbeCurrentAddr(v);
6884       if( groupBySort ){
6885         sqlite3VdbeAddOp3(v, OP_SorterData, pAggInfo->sortingIdx,
6886                           sortOut, sortPTab);
6887       }
6888       for(j=0; j<pGroupBy->nExpr; j++){
6889         if( groupBySort ){
6890           sqlite3VdbeAddOp3(v, OP_Column, sortPTab, j, iBMem+j);
6891         }else{
6892           pAggInfo->directMode = 1;
6893           sqlite3ExprCode(pParse, pGroupBy->a[j].pExpr, iBMem+j);
6894         }
6895       }
6896       sqlite3VdbeAddOp4(v, OP_Compare, iAMem, iBMem, pGroupBy->nExpr,
6897                           (char*)sqlite3KeyInfoRef(pKeyInfo), P4_KEYINFO);
6898       addr1 = sqlite3VdbeCurrentAddr(v);
6899       sqlite3VdbeAddOp3(v, OP_Jump, addr1+1, 0, addr1+1); VdbeCoverage(v);
6900 
6901       /* Generate code that runs whenever the GROUP BY changes.
6902       ** Changes in the GROUP BY are detected by the previous code
6903       ** block.  If there were no changes, this block is skipped.
6904       **
6905       ** This code copies current group by terms in b0,b1,b2,...
6906       ** over to a0,a1,a2.  It then calls the output subroutine
6907       ** and resets the aggregate accumulator registers in preparation
6908       ** for the next GROUP BY batch.
6909       */
6910       sqlite3ExprCodeMove(pParse, iBMem, iAMem, pGroupBy->nExpr);
6911       sqlite3VdbeAddOp2(v, OP_Gosub, regOutputRow, addrOutputRow);
6912       VdbeComment((v, "output one row"));
6913       sqlite3VdbeAddOp2(v, OP_IfPos, iAbortFlag, addrEnd); VdbeCoverage(v);
6914       VdbeComment((v, "check abort flag"));
6915       sqlite3VdbeAddOp2(v, OP_Gosub, regReset, addrReset);
6916       VdbeComment((v, "reset accumulator"));
6917 
6918       /* Update the aggregate accumulators based on the content of
6919       ** the current row
6920       */
6921       sqlite3VdbeJumpHere(v, addr1);
6922       updateAccumulator(pParse, iUseFlag, pAggInfo);
6923       sqlite3VdbeAddOp2(v, OP_Integer, 1, iUseFlag);
6924       VdbeComment((v, "indicate data in accumulator"));
6925 
6926       /* End of the loop
6927       */
6928       if( groupBySort ){
6929         sqlite3VdbeAddOp2(v, OP_SorterNext, pAggInfo->sortingIdx,addrTopOfLoop);
6930         VdbeCoverage(v);
6931       }else{
6932         SELECTTRACE(1,pParse,p,("WhereEnd\n"));
6933         sqlite3WhereEnd(pWInfo);
6934         sqlite3VdbeChangeToNoop(v, addrSortingIdx);
6935       }
6936 
6937       /* Output the final row of result
6938       */
6939       sqlite3VdbeAddOp2(v, OP_Gosub, regOutputRow, addrOutputRow);
6940       VdbeComment((v, "output final row"));
6941 
6942       /* Jump over the subroutines
6943       */
6944       sqlite3VdbeGoto(v, addrEnd);
6945 
6946       /* Generate a subroutine that outputs a single row of the result
6947       ** set.  This subroutine first looks at the iUseFlag.  If iUseFlag
6948       ** is less than or equal to zero, the subroutine is a no-op.  If
6949       ** the processing calls for the query to abort, this subroutine
6950       ** increments the iAbortFlag memory location before returning in
6951       ** order to signal the caller to abort.
6952       */
6953       addrSetAbort = sqlite3VdbeCurrentAddr(v);
6954       sqlite3VdbeAddOp2(v, OP_Integer, 1, iAbortFlag);
6955       VdbeComment((v, "set abort flag"));
6956       sqlite3VdbeAddOp1(v, OP_Return, regOutputRow);
6957       sqlite3VdbeResolveLabel(v, addrOutputRow);
6958       addrOutputRow = sqlite3VdbeCurrentAddr(v);
6959       sqlite3VdbeAddOp2(v, OP_IfPos, iUseFlag, addrOutputRow+2);
6960       VdbeCoverage(v);
6961       VdbeComment((v, "Groupby result generator entry point"));
6962       sqlite3VdbeAddOp1(v, OP_Return, regOutputRow);
6963       finalizeAggFunctions(pParse, pAggInfo);
6964       sqlite3ExprIfFalse(pParse, pHaving, addrOutputRow+1, SQLITE_JUMPIFNULL);
6965       selectInnerLoop(pParse, p, -1, &sSort,
6966                       &sDistinct, pDest,
6967                       addrOutputRow+1, addrSetAbort);
6968       sqlite3VdbeAddOp1(v, OP_Return, regOutputRow);
6969       VdbeComment((v, "end groupby result generator"));
6970 
6971       /* Generate a subroutine that will reset the group-by accumulator
6972       */
6973       sqlite3VdbeResolveLabel(v, addrReset);
6974       resetAccumulator(pParse, pAggInfo);
6975       sqlite3VdbeAddOp2(v, OP_Integer, 0, iUseFlag);
6976       VdbeComment((v, "indicate accumulator empty"));
6977       sqlite3VdbeAddOp1(v, OP_Return, regReset);
6978 
6979     } /* endif pGroupBy.  Begin aggregate queries without GROUP BY: */
6980     else {
6981       Table *pTab;
6982       if( (pTab = isSimpleCount(p, pAggInfo))!=0 ){
6983         /* If isSimpleCount() returns a pointer to a Table structure, then
6984         ** the SQL statement is of the form:
6985         **
6986         **   SELECT count(*) FROM <tbl>
6987         **
6988         ** where the Table structure returned represents table <tbl>.
6989         **
6990         ** This statement is so common that it is optimized specially. The
6991         ** OP_Count instruction is executed either on the intkey table that
6992         ** contains the data for table <tbl> or on one of its indexes. It
6993         ** is better to execute the op on an index, as indexes are almost
6994         ** always spread across less pages than their corresponding tables.
6995         */
6996         const int iDb = sqlite3SchemaToIndex(pParse->db, pTab->pSchema);
6997         const int iCsr = pParse->nTab++;     /* Cursor to scan b-tree */
6998         Index *pIdx;                         /* Iterator variable */
6999         KeyInfo *pKeyInfo = 0;               /* Keyinfo for scanned index */
7000         Index *pBest = 0;                    /* Best index found so far */
7001         Pgno iRoot = pTab->tnum;             /* Root page of scanned b-tree */
7002 
7003         sqlite3CodeVerifySchema(pParse, iDb);
7004         sqlite3TableLock(pParse, iDb, pTab->tnum, 0, pTab->zName);
7005 
7006         /* Search for the index that has the lowest scan cost.
7007         **
7008         ** (2011-04-15) Do not do a full scan of an unordered index.
7009         **
7010         ** (2013-10-03) Do not count the entries in a partial index.
7011         **
7012         ** In practice the KeyInfo structure will not be used. It is only
7013         ** passed to keep OP_OpenRead happy.
7014         */
7015         if( !HasRowid(pTab) ) pBest = sqlite3PrimaryKeyIndex(pTab);
7016         if( !p->pSrc->a[0].fg.notIndexed ){
7017           for(pIdx=pTab->pIndex; pIdx; pIdx=pIdx->pNext){
7018             if( pIdx->bUnordered==0
7019              && pIdx->szIdxRow<pTab->szTabRow
7020              && pIdx->pPartIdxWhere==0
7021              && (!pBest || pIdx->szIdxRow<pBest->szIdxRow)
7022             ){
7023               pBest = pIdx;
7024             }
7025           }
7026         }
7027         if( pBest ){
7028           iRoot = pBest->tnum;
7029           pKeyInfo = sqlite3KeyInfoOfIndex(pParse, pBest);
7030         }
7031 
7032         /* Open a read-only cursor, execute the OP_Count, close the cursor. */
7033         sqlite3VdbeAddOp4Int(v, OP_OpenRead, iCsr, (int)iRoot, iDb, 1);
7034         if( pKeyInfo ){
7035           sqlite3VdbeChangeP4(v, -1, (char *)pKeyInfo, P4_KEYINFO);
7036         }
7037         sqlite3VdbeAddOp2(v, OP_Count, iCsr, pAggInfo->aFunc[0].iMem);
7038         sqlite3VdbeAddOp1(v, OP_Close, iCsr);
7039         explainSimpleCount(pParse, pTab, pBest);
7040       }else{
7041         int regAcc = 0;           /* "populate accumulators" flag */
7042 
7043         /* If there are accumulator registers but no min() or max() functions
7044         ** without FILTER clauses, allocate register regAcc. Register regAcc
7045         ** will contain 0 the first time the inner loop runs, and 1 thereafter.
7046         ** The code generated by updateAccumulator() uses this to ensure
7047         ** that the accumulator registers are (a) updated only once if
7048         ** there are no min() or max functions or (b) always updated for the
7049         ** first row visited by the aggregate, so that they are updated at
7050         ** least once even if the FILTER clause means the min() or max()
7051         ** function visits zero rows.  */
7052         if( pAggInfo->nAccumulator ){
7053           for(i=0; i<pAggInfo->nFunc; i++){
7054             if( ExprHasProperty(pAggInfo->aFunc[i].pFExpr, EP_WinFunc) ){
7055               continue;
7056             }
7057             if( pAggInfo->aFunc[i].pFunc->funcFlags&SQLITE_FUNC_NEEDCOLL ){
7058               break;
7059             }
7060           }
7061           if( i==pAggInfo->nFunc ){
7062             regAcc = ++pParse->nMem;
7063             sqlite3VdbeAddOp2(v, OP_Integer, 0, regAcc);
7064           }
7065         }
7066 
7067         /* This case runs if the aggregate has no GROUP BY clause.  The
7068         ** processing is much simpler since there is only a single row
7069         ** of output.
7070         */
7071         assert( p->pGroupBy==0 );
7072         resetAccumulator(pParse, pAggInfo);
7073 
7074         /* If this query is a candidate for the min/max optimization, then
7075         ** minMaxFlag will have been previously set to either
7076         ** WHERE_ORDERBY_MIN or WHERE_ORDERBY_MAX and pMinMaxOrderBy will
7077         ** be an appropriate ORDER BY expression for the optimization.
7078         */
7079         assert( minMaxFlag==WHERE_ORDERBY_NORMAL || pMinMaxOrderBy!=0 );
7080         assert( pMinMaxOrderBy==0 || pMinMaxOrderBy->nExpr==1 );
7081 
7082         SELECTTRACE(1,pParse,p,("WhereBegin\n"));
7083         pWInfo = sqlite3WhereBegin(pParse, pTabList, pWhere, pMinMaxOrderBy,
7084                                    0, minMaxFlag, 0);
7085         if( pWInfo==0 ){
7086           goto select_end;
7087         }
7088         SELECTTRACE(1,pParse,p,("WhereBegin returns\n"));
7089         updateAccumulator(pParse, regAcc, pAggInfo);
7090         if( regAcc ) sqlite3VdbeAddOp2(v, OP_Integer, 1, regAcc);
7091         if( minMaxFlag ){
7092           sqlite3WhereMinMaxOptEarlyOut(v, pWInfo);
7093         }
7094         SELECTTRACE(1,pParse,p,("WhereEnd\n"));
7095         sqlite3WhereEnd(pWInfo);
7096         finalizeAggFunctions(pParse, pAggInfo);
7097       }
7098 
7099       sSort.pOrderBy = 0;
7100       sqlite3ExprIfFalse(pParse, pHaving, addrEnd, SQLITE_JUMPIFNULL);
7101       selectInnerLoop(pParse, p, -1, 0, 0,
7102                       pDest, addrEnd, addrEnd);
7103     }
7104     sqlite3VdbeResolveLabel(v, addrEnd);
7105 
7106   } /* endif aggregate query */
7107 
7108   if( sDistinct.eTnctType==WHERE_DISTINCT_UNORDERED ){
7109     explainTempTable(pParse, "DISTINCT");
7110   }
7111 
7112   /* If there is an ORDER BY clause, then we need to sort the results
7113   ** and send them to the callback one by one.
7114   */
7115   if( sSort.pOrderBy ){
7116     explainTempTable(pParse,
7117                      sSort.nOBSat>0 ? "RIGHT PART OF ORDER BY":"ORDER BY");
7118     assert( p->pEList==pEList );
7119     generateSortTail(pParse, p, &sSort, pEList->nExpr, pDest);
7120   }
7121 
7122   /* Jump here to skip this query
7123   */
7124   sqlite3VdbeResolveLabel(v, iEnd);
7125 
7126   /* The SELECT has been coded. If there is an error in the Parse structure,
7127   ** set the return code to 1. Otherwise 0. */
7128   rc = (pParse->nErr>0);
7129 
7130   /* Control jumps to here if an error is encountered above, or upon
7131   ** successful coding of the SELECT.
7132   */
7133 select_end:
7134   sqlite3ExprListDelete(db, pMinMaxOrderBy);
7135 #ifdef SQLITE_DEBUG
7136   if( pAggInfo && !db->mallocFailed ){
7137     for(i=0; i<pAggInfo->nColumn; i++){
7138       Expr *pExpr = pAggInfo->aCol[i].pCExpr;
7139       assert( pExpr!=0 );
7140       assert( pExpr->pAggInfo==pAggInfo );
7141       assert( pExpr->iAgg==i );
7142     }
7143     for(i=0; i<pAggInfo->nFunc; i++){
7144       Expr *pExpr = pAggInfo->aFunc[i].pFExpr;
7145       assert( pExpr!=0 );
7146       assert( pExpr->pAggInfo==pAggInfo );
7147       assert( pExpr->iAgg==i );
7148     }
7149   }
7150 #endif
7151 
7152 #if SELECTTRACE_ENABLED
7153   SELECTTRACE(0x1,pParse,p,("end processing\n"));
7154   if( (sqlite3SelectTrace & 0x2000)!=0 && ExplainQueryPlanParent(pParse)==0 ){
7155     sqlite3TreeViewSelect(0, p, 0);
7156   }
7157 #endif
7158   ExplainQueryPlanPop(pParse);
7159   return rc;
7160 }
7161