xref: /sqlite-3.40.0/src/select.c (revision db08a6d1)
1 /*
2 ** 2001 September 15
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 ** This file contains C code routines that are called by the parser
13 ** to handle SELECT statements in SQLite.
14 */
15 #include "sqliteInt.h"
16 
17 /*
18 ** An instance of the following object is used to record information about
19 ** how to process the DISTINCT keyword, to simplify passing that information
20 ** into the selectInnerLoop() routine.
21 */
22 typedef struct DistinctCtx DistinctCtx;
23 struct DistinctCtx {
24   u8 isTnct;      /* 0: Not distinct. 1: DISTICT  2: DISTINCT and ORDER BY */
25   u8 eTnctType;   /* One of the WHERE_DISTINCT_* operators */
26   int tabTnct;    /* Ephemeral table used for DISTINCT processing */
27   int addrTnct;   /* Address of OP_OpenEphemeral opcode for tabTnct */
28 };
29 
30 /*
31 ** An instance of the following object is used to record information about
32 ** the ORDER BY (or GROUP BY) clause of query is being coded.
33 **
34 ** The aDefer[] array is used by the sorter-references optimization. For
35 ** example, assuming there is no index that can be used for the ORDER BY,
36 ** for the query:
37 **
38 **     SELECT a, bigblob FROM t1 ORDER BY a LIMIT 10;
39 **
40 ** it may be more efficient to add just the "a" values to the sorter, and
41 ** retrieve the associated "bigblob" values directly from table t1 as the
42 ** 10 smallest "a" values are extracted from the sorter.
43 **
44 ** When the sorter-reference optimization is used, there is one entry in the
45 ** aDefer[] array for each database table that may be read as values are
46 ** extracted from the sorter.
47 */
48 typedef struct SortCtx SortCtx;
49 struct SortCtx {
50   ExprList *pOrderBy;   /* The ORDER BY (or GROUP BY clause) */
51   int nOBSat;           /* Number of ORDER BY terms satisfied by indices */
52   int iECursor;         /* Cursor number for the sorter */
53   int regReturn;        /* Register holding block-output return address */
54   int labelBkOut;       /* Start label for the block-output subroutine */
55   int addrSortIndex;    /* Address of the OP_SorterOpen or OP_OpenEphemeral */
56   int labelDone;        /* Jump here when done, ex: LIMIT reached */
57   int labelOBLopt;      /* Jump here when sorter is full */
58   u8 sortFlags;         /* Zero or more SORTFLAG_* bits */
59 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
60   u8 nDefer;            /* Number of valid entries in aDefer[] */
61   struct DeferredCsr {
62     Table *pTab;        /* Table definition */
63     int iCsr;           /* Cursor number for table */
64     int nKey;           /* Number of PK columns for table pTab (>=1) */
65   } aDefer[4];
66 #endif
67   struct RowLoadInfo *pDeferredRowLoad;  /* Deferred row loading info or NULL */
68 };
69 #define SORTFLAG_UseSorter  0x01   /* Use SorterOpen instead of OpenEphemeral */
70 
71 /*
72 ** Delete all the content of a Select structure.  Deallocate the structure
73 ** itself depending on the value of bFree
74 **
75 ** If bFree==1, call sqlite3DbFree() on the p object.
76 ** If bFree==0, Leave the first Select object unfreed
77 */
78 static void clearSelect(sqlite3 *db, Select *p, int bFree){
79   while( p ){
80     Select *pPrior = p->pPrior;
81     sqlite3ExprListDelete(db, p->pEList);
82     sqlite3SrcListDelete(db, p->pSrc);
83     sqlite3ExprDelete(db, p->pWhere);
84     sqlite3ExprListDelete(db, p->pGroupBy);
85     sqlite3ExprDelete(db, p->pHaving);
86     sqlite3ExprListDelete(db, p->pOrderBy);
87     sqlite3ExprDelete(db, p->pLimit);
88     if( OK_IF_ALWAYS_TRUE(p->pWith) ) sqlite3WithDelete(db, p->pWith);
89 #ifndef SQLITE_OMIT_WINDOWFUNC
90     if( OK_IF_ALWAYS_TRUE(p->pWinDefn) ){
91       sqlite3WindowListDelete(db, p->pWinDefn);
92     }
93     while( p->pWin ){
94       assert( p->pWin->ppThis==&p->pWin );
95       sqlite3WindowUnlinkFromSelect(p->pWin);
96     }
97 #endif
98     if( bFree ) sqlite3DbFreeNN(db, p);
99     p = pPrior;
100     bFree = 1;
101   }
102 }
103 
104 /*
105 ** Initialize a SelectDest structure.
106 */
107 void sqlite3SelectDestInit(SelectDest *pDest, int eDest, int iParm){
108   pDest->eDest = (u8)eDest;
109   pDest->iSDParm = iParm;
110   pDest->iSDParm2 = 0;
111   pDest->zAffSdst = 0;
112   pDest->iSdst = 0;
113   pDest->nSdst = 0;
114 }
115 
116 
117 /*
118 ** Allocate a new Select structure and return a pointer to that
119 ** structure.
120 */
121 Select *sqlite3SelectNew(
122   Parse *pParse,        /* Parsing context */
123   ExprList *pEList,     /* which columns to include in the result */
124   SrcList *pSrc,        /* the FROM clause -- which tables to scan */
125   Expr *pWhere,         /* the WHERE clause */
126   ExprList *pGroupBy,   /* the GROUP BY clause */
127   Expr *pHaving,        /* the HAVING clause */
128   ExprList *pOrderBy,   /* the ORDER BY clause */
129   u32 selFlags,         /* Flag parameters, such as SF_Distinct */
130   Expr *pLimit          /* LIMIT value.  NULL means not used */
131 ){
132   Select *pNew, *pAllocated;
133   Select standin;
134   pAllocated = pNew = sqlite3DbMallocRawNN(pParse->db, sizeof(*pNew) );
135   if( pNew==0 ){
136     assert( pParse->db->mallocFailed );
137     pNew = &standin;
138   }
139   if( pEList==0 ){
140     pEList = sqlite3ExprListAppend(pParse, 0,
141                                    sqlite3Expr(pParse->db,TK_ASTERISK,0));
142   }
143   pNew->pEList = pEList;
144   pNew->op = TK_SELECT;
145   pNew->selFlags = selFlags;
146   pNew->iLimit = 0;
147   pNew->iOffset = 0;
148   pNew->selId = ++pParse->nSelect;
149   pNew->addrOpenEphm[0] = -1;
150   pNew->addrOpenEphm[1] = -1;
151   pNew->nSelectRow = 0;
152   if( pSrc==0 ) pSrc = sqlite3DbMallocZero(pParse->db, sizeof(*pSrc));
153   pNew->pSrc = pSrc;
154   pNew->pWhere = pWhere;
155   pNew->pGroupBy = pGroupBy;
156   pNew->pHaving = pHaving;
157   pNew->pOrderBy = pOrderBy;
158   pNew->pPrior = 0;
159   pNew->pNext = 0;
160   pNew->pLimit = pLimit;
161   pNew->pWith = 0;
162 #ifndef SQLITE_OMIT_WINDOWFUNC
163   pNew->pWin = 0;
164   pNew->pWinDefn = 0;
165 #endif
166   if( pParse->db->mallocFailed ) {
167     clearSelect(pParse->db, pNew, pNew!=&standin);
168     pAllocated = 0;
169   }else{
170     assert( pNew->pSrc!=0 || pParse->nErr>0 );
171   }
172   return pAllocated;
173 }
174 
175 
176 /*
177 ** Delete the given Select structure and all of its substructures.
178 */
179 void sqlite3SelectDelete(sqlite3 *db, Select *p){
180   if( OK_IF_ALWAYS_TRUE(p) ) clearSelect(db, p, 1);
181 }
182 
183 /*
184 ** Return a pointer to the right-most SELECT statement in a compound.
185 */
186 static Select *findRightmost(Select *p){
187   while( p->pNext ) p = p->pNext;
188   return p;
189 }
190 
191 /*
192 ** Given 1 to 3 identifiers preceding the JOIN keyword, determine the
193 ** type of join.  Return an integer constant that expresses that type
194 ** in terms of the following bit values:
195 **
196 **     JT_INNER
197 **     JT_CROSS
198 **     JT_OUTER
199 **     JT_NATURAL
200 **     JT_LEFT
201 **     JT_RIGHT
202 **
203 ** A full outer join is the combination of JT_LEFT and JT_RIGHT.
204 **
205 ** If an illegal or unsupported join type is seen, then still return
206 ** a join type, but put an error in the pParse structure.
207 */
208 int sqlite3JoinType(Parse *pParse, Token *pA, Token *pB, Token *pC){
209   int jointype = 0;
210   Token *apAll[3];
211   Token *p;
212                              /*   0123456789 123456789 123456789 123 */
213   static const char zKeyText[] = "naturaleftouterightfullinnercross";
214   static const struct {
215     u8 i;        /* Beginning of keyword text in zKeyText[] */
216     u8 nChar;    /* Length of the keyword in characters */
217     u8 code;     /* Join type mask */
218   } aKeyword[] = {
219     /* natural */ { 0,  7, JT_NATURAL                },
220     /* left    */ { 6,  4, JT_LEFT|JT_OUTER          },
221     /* outer   */ { 10, 5, JT_OUTER                  },
222     /* right   */ { 14, 5, JT_RIGHT|JT_OUTER         },
223     /* full    */ { 19, 4, JT_LEFT|JT_RIGHT|JT_OUTER },
224     /* inner   */ { 23, 5, JT_INNER                  },
225     /* cross   */ { 28, 5, JT_INNER|JT_CROSS         },
226   };
227   int i, j;
228   apAll[0] = pA;
229   apAll[1] = pB;
230   apAll[2] = pC;
231   for(i=0; i<3 && apAll[i]; i++){
232     p = apAll[i];
233     for(j=0; j<ArraySize(aKeyword); j++){
234       if( p->n==aKeyword[j].nChar
235           && sqlite3StrNICmp((char*)p->z, &zKeyText[aKeyword[j].i], p->n)==0 ){
236         jointype |= aKeyword[j].code;
237         break;
238       }
239     }
240     testcase( j==0 || j==1 || j==2 || j==3 || j==4 || j==5 || j==6 );
241     if( j>=ArraySize(aKeyword) ){
242       jointype |= JT_ERROR;
243       break;
244     }
245   }
246   if(
247      (jointype & (JT_INNER|JT_OUTER))==(JT_INNER|JT_OUTER) ||
248      (jointype & JT_ERROR)!=0
249   ){
250     const char *zSp = " ";
251     assert( pB!=0 );
252     if( pC==0 ){ zSp++; }
253     sqlite3ErrorMsg(pParse, "unknown or unsupported join type: "
254        "%T %T%s%T", pA, pB, zSp, pC);
255     jointype = JT_INNER;
256   }else if( (jointype & JT_OUTER)!=0
257          && (jointype & (JT_LEFT|JT_RIGHT))!=JT_LEFT ){
258     sqlite3ErrorMsg(pParse,
259       "RIGHT and FULL OUTER JOINs are not currently supported");
260     jointype = JT_INNER;
261   }
262   return jointype;
263 }
264 
265 /*
266 ** Return the index of a column in a table.  Return -1 if the column
267 ** is not contained in the table.
268 */
269 int sqlite3ColumnIndex(Table *pTab, const char *zCol){
270   int i;
271   u8 h = sqlite3StrIHash(zCol);
272   Column *pCol;
273   for(pCol=pTab->aCol, i=0; i<pTab->nCol; pCol++, i++){
274     if( pCol->hName==h && sqlite3StrICmp(pCol->zCnName, zCol)==0 ) return i;
275   }
276   return -1;
277 }
278 
279 /*
280 ** Search the first N tables in pSrc, from left to right, looking for a
281 ** table that has a column named zCol.
282 **
283 ** When found, set *piTab and *piCol to the table index and column index
284 ** of the matching column and return TRUE.
285 **
286 ** If not found, return FALSE.
287 */
288 static int tableAndColumnIndex(
289   SrcList *pSrc,       /* Array of tables to search */
290   int N,               /* Number of tables in pSrc->a[] to search */
291   const char *zCol,    /* Name of the column we are looking for */
292   int *piTab,          /* Write index of pSrc->a[] here */
293   int *piCol,          /* Write index of pSrc->a[*piTab].pTab->aCol[] here */
294   int bIgnoreHidden    /* True to ignore hidden columns */
295 ){
296   int i;               /* For looping over tables in pSrc */
297   int iCol;            /* Index of column matching zCol */
298 
299   assert( (piTab==0)==(piCol==0) );  /* Both or neither are NULL */
300   for(i=0; i<N; i++){
301     iCol = sqlite3ColumnIndex(pSrc->a[i].pTab, zCol);
302     if( iCol>=0
303      && (bIgnoreHidden==0 || IsHiddenColumn(&pSrc->a[i].pTab->aCol[iCol])==0)
304     ){
305       if( piTab ){
306         *piTab = i;
307         *piCol = iCol;
308       }
309       return 1;
310     }
311   }
312   return 0;
313 }
314 
315 /*
316 ** This function is used to add terms implied by JOIN syntax to the
317 ** WHERE clause expression of a SELECT statement. The new term, which
318 ** is ANDed with the existing WHERE clause, is of the form:
319 **
320 **    (tab1.col1 = tab2.col2)
321 **
322 ** where tab1 is the iSrc'th table in SrcList pSrc and tab2 is the
323 ** (iSrc+1)'th. Column col1 is column iColLeft of tab1, and col2 is
324 ** column iColRight of tab2.
325 */
326 static void addWhereTerm(
327   Parse *pParse,                  /* Parsing context */
328   SrcList *pSrc,                  /* List of tables in FROM clause */
329   int iLeft,                      /* Index of first table to join in pSrc */
330   int iColLeft,                   /* Index of column in first table */
331   int iRight,                     /* Index of second table in pSrc */
332   int iColRight,                  /* Index of column in second table */
333   int isOuterJoin,                /* True if this is an OUTER join */
334   Expr **ppWhere                  /* IN/OUT: The WHERE clause to add to */
335 ){
336   sqlite3 *db = pParse->db;
337   Expr *pE1;
338   Expr *pE2;
339   Expr *pEq;
340 
341   assert( iLeft<iRight );
342   assert( pSrc->nSrc>iRight );
343   assert( pSrc->a[iLeft].pTab );
344   assert( pSrc->a[iRight].pTab );
345 
346   pE1 = sqlite3CreateColumnExpr(db, pSrc, iLeft, iColLeft);
347   pE2 = sqlite3CreateColumnExpr(db, pSrc, iRight, iColRight);
348 
349   pEq = sqlite3PExpr(pParse, TK_EQ, pE1, pE2);
350   assert( pE2!=0 || pEq==0 );  /* Due to db->mallocFailed test
351                                ** in sqlite3DbMallocRawNN() called from
352                                ** sqlite3PExpr(). */
353   if( pEq && isOuterJoin ){
354     ExprSetProperty(pEq, EP_FromJoin);
355     assert( !ExprHasProperty(pEq, EP_TokenOnly|EP_Reduced) );
356     ExprSetVVAProperty(pEq, EP_NoReduce);
357     pEq->w.iRightJoinTable = pE2->iTable;
358   }
359   *ppWhere = sqlite3ExprAnd(pParse, *ppWhere, pEq);
360 }
361 
362 /*
363 ** Set the EP_FromJoin property on all terms of the given expression.
364 ** And set the Expr.w.iRightJoinTable to iTable for every term in the
365 ** expression.
366 **
367 ** The EP_FromJoin property is used on terms of an expression to tell
368 ** the LEFT OUTER JOIN processing logic that this term is part of the
369 ** join restriction specified in the ON or USING clause and not a part
370 ** of the more general WHERE clause.  These terms are moved over to the
371 ** WHERE clause during join processing but we need to remember that they
372 ** originated in the ON or USING clause.
373 **
374 ** The Expr.w.iRightJoinTable tells the WHERE clause processing that the
375 ** expression depends on table w.iRightJoinTable even if that table is not
376 ** explicitly mentioned in the expression.  That information is needed
377 ** for cases like this:
378 **
379 **    SELECT * FROM t1 LEFT JOIN t2 ON t1.a=t2.b AND t1.x=5
380 **
381 ** The where clause needs to defer the handling of the t1.x=5
382 ** term until after the t2 loop of the join.  In that way, a
383 ** NULL t2 row will be inserted whenever t1.x!=5.  If we do not
384 ** defer the handling of t1.x=5, it will be processed immediately
385 ** after the t1 loop and rows with t1.x!=5 will never appear in
386 ** the output, which is incorrect.
387 */
388 void sqlite3SetJoinExpr(Expr *p, int iTable){
389   while( p ){
390     ExprSetProperty(p, EP_FromJoin);
391     assert( !ExprHasProperty(p, EP_TokenOnly|EP_Reduced) );
392     ExprSetVVAProperty(p, EP_NoReduce);
393     p->w.iRightJoinTable = iTable;
394     if( p->op==TK_FUNCTION ){
395       assert( ExprUseXList(p) );
396       if( p->x.pList ){
397         int i;
398         for(i=0; i<p->x.pList->nExpr; i++){
399           sqlite3SetJoinExpr(p->x.pList->a[i].pExpr, iTable);
400         }
401       }
402     }
403     sqlite3SetJoinExpr(p->pLeft, iTable);
404     p = p->pRight;
405   }
406 }
407 
408 /* Undo the work of sqlite3SetJoinExpr(). In the expression p, convert every
409 ** term that is marked with EP_FromJoin and w.iRightJoinTable==iTable into
410 ** an ordinary term that omits the EP_FromJoin mark.
411 **
412 ** This happens when a LEFT JOIN is simplified into an ordinary JOIN.
413 */
414 static void unsetJoinExpr(Expr *p, int iTable){
415   while( p ){
416     if( ExprHasProperty(p, EP_FromJoin)
417      && (iTable<0 || p->w.iRightJoinTable==iTable) ){
418       ExprClearProperty(p, EP_FromJoin);
419     }
420     if( p->op==TK_COLUMN && p->iTable==iTable ){
421       ExprClearProperty(p, EP_CanBeNull);
422     }
423     if( p->op==TK_FUNCTION ){
424       assert( ExprUseXList(p) );
425       if( p->x.pList ){
426         int i;
427         for(i=0; i<p->x.pList->nExpr; i++){
428           unsetJoinExpr(p->x.pList->a[i].pExpr, iTable);
429         }
430       }
431     }
432     unsetJoinExpr(p->pLeft, iTable);
433     p = p->pRight;
434   }
435 }
436 
437 /*
438 ** This routine processes the join information for a SELECT statement.
439 ** ON and USING clauses are converted into extra terms of the WHERE clause.
440 ** NATURAL joins also create extra WHERE clause terms.
441 **
442 ** The terms of a FROM clause are contained in the Select.pSrc structure.
443 ** The left most table is the first entry in Select.pSrc.  The right-most
444 ** table is the last entry.  The join operator is held in the entry to
445 ** the left.  Thus entry 0 contains the join operator for the join between
446 ** entries 0 and 1.  Any ON or USING clauses associated with the join are
447 ** also attached to the left entry.
448 **
449 ** This routine returns the number of errors encountered.
450 */
451 static int sqliteProcessJoin(Parse *pParse, Select *p){
452   SrcList *pSrc;                  /* All tables in the FROM clause */
453   int i, j;                       /* Loop counters */
454   SrcItem *pLeft;                 /* Left table being joined */
455   SrcItem *pRight;                /* Right table being joined */
456 
457   pSrc = p->pSrc;
458   pLeft = &pSrc->a[0];
459   pRight = &pLeft[1];
460   for(i=0; i<pSrc->nSrc-1; i++, pRight++, pLeft++){
461     Table *pRightTab = pRight->pTab;
462     int isOuter;
463 
464     if( NEVER(pLeft->pTab==0 || pRightTab==0) ) continue;
465     isOuter = (pRight->fg.jointype & JT_OUTER)!=0;
466 
467     /* When the NATURAL keyword is present, add WHERE clause terms for
468     ** every column that the two tables have in common.
469     */
470     if( pRight->fg.jointype & JT_NATURAL ){
471       if( pRight->fg.isUsing || pRight->u3.pOn ){
472         sqlite3ErrorMsg(pParse, "a NATURAL join may not have "
473            "an ON or USING clause", 0);
474         return 1;
475       }
476       for(j=0; j<pRightTab->nCol; j++){
477         char *zName;   /* Name of column in the right table */
478         int iLeft;     /* Matching left table */
479         int iLeftCol;  /* Matching column in the left table */
480 
481         if( IsHiddenColumn(&pRightTab->aCol[j]) ) continue;
482         zName = pRightTab->aCol[j].zCnName;
483         if( tableAndColumnIndex(pSrc, i+1, zName, &iLeft, &iLeftCol, 1) ){
484           addWhereTerm(pParse, pSrc, iLeft, iLeftCol, i+1, j,
485                 isOuter, &p->pWhere);
486         }
487       }
488     }
489 
490     /* Create extra terms on the WHERE clause for each column named
491     ** in the USING clause.  Example: If the two tables to be joined are
492     ** A and B and the USING clause names X, Y, and Z, then add this
493     ** to the WHERE clause:    A.X=B.X AND A.Y=B.Y AND A.Z=B.Z
494     ** Report an error if any column mentioned in the USING clause is
495     ** not contained in both tables to be joined.
496     */
497     if( pRight->fg.isUsing ){
498       IdList *pList = pRight->u3.pUsing;
499       assert( pList!=0 );
500       for(j=0; j<pList->nId; j++){
501         char *zName;     /* Name of the term in the USING clause */
502         int iLeft;       /* Table on the left with matching column name */
503         int iLeftCol;    /* Column number of matching column on the left */
504         int iRightCol;   /* Column number of matching column on the right */
505 
506         zName = pList->a[j].zName;
507         iRightCol = sqlite3ColumnIndex(pRightTab, zName);
508         if( iRightCol<0
509          || !tableAndColumnIndex(pSrc, i+1, zName, &iLeft, &iLeftCol, 0)
510         ){
511           sqlite3ErrorMsg(pParse, "cannot join using column %s - column "
512             "not present in both tables", zName);
513           return 1;
514         }
515         addWhereTerm(pParse, pSrc, iLeft, iLeftCol, i+1, iRightCol,
516                      isOuter, &p->pWhere);
517       }
518     }
519 
520     /* Add the ON clause to the end of the WHERE clause, connected by
521     ** an AND operator.
522     */
523     else if( pRight->u3.pOn ){
524       if( isOuter ) sqlite3SetJoinExpr(pRight->u3.pOn, pRight->iCursor);
525       p->pWhere = sqlite3ExprAnd(pParse, p->pWhere, pRight->u3.pOn);
526       pRight->u3.pOn = 0;
527     }
528   }
529   return 0;
530 }
531 
532 /*
533 ** An instance of this object holds information (beyond pParse and pSelect)
534 ** needed to load the next result row that is to be added to the sorter.
535 */
536 typedef struct RowLoadInfo RowLoadInfo;
537 struct RowLoadInfo {
538   int regResult;               /* Store results in array of registers here */
539   u8 ecelFlags;                /* Flag argument to ExprCodeExprList() */
540 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
541   ExprList *pExtra;            /* Extra columns needed by sorter refs */
542   int regExtraResult;          /* Where to load the extra columns */
543 #endif
544 };
545 
546 /*
547 ** This routine does the work of loading query data into an array of
548 ** registers so that it can be added to the sorter.
549 */
550 static void innerLoopLoadRow(
551   Parse *pParse,             /* Statement under construction */
552   Select *pSelect,           /* The query being coded */
553   RowLoadInfo *pInfo         /* Info needed to complete the row load */
554 ){
555   sqlite3ExprCodeExprList(pParse, pSelect->pEList, pInfo->regResult,
556                           0, pInfo->ecelFlags);
557 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
558   if( pInfo->pExtra ){
559     sqlite3ExprCodeExprList(pParse, pInfo->pExtra, pInfo->regExtraResult, 0, 0);
560     sqlite3ExprListDelete(pParse->db, pInfo->pExtra);
561   }
562 #endif
563 }
564 
565 /*
566 ** Code the OP_MakeRecord instruction that generates the entry to be
567 ** added into the sorter.
568 **
569 ** Return the register in which the result is stored.
570 */
571 static int makeSorterRecord(
572   Parse *pParse,
573   SortCtx *pSort,
574   Select *pSelect,
575   int regBase,
576   int nBase
577 ){
578   int nOBSat = pSort->nOBSat;
579   Vdbe *v = pParse->pVdbe;
580   int regOut = ++pParse->nMem;
581   if( pSort->pDeferredRowLoad ){
582     innerLoopLoadRow(pParse, pSelect, pSort->pDeferredRowLoad);
583   }
584   sqlite3VdbeAddOp3(v, OP_MakeRecord, regBase+nOBSat, nBase-nOBSat, regOut);
585   return regOut;
586 }
587 
588 /*
589 ** Generate code that will push the record in registers regData
590 ** through regData+nData-1 onto the sorter.
591 */
592 static void pushOntoSorter(
593   Parse *pParse,         /* Parser context */
594   SortCtx *pSort,        /* Information about the ORDER BY clause */
595   Select *pSelect,       /* The whole SELECT statement */
596   int regData,           /* First register holding data to be sorted */
597   int regOrigData,       /* First register holding data before packing */
598   int nData,             /* Number of elements in the regData data array */
599   int nPrefixReg         /* No. of reg prior to regData available for use */
600 ){
601   Vdbe *v = pParse->pVdbe;                         /* Stmt under construction */
602   int bSeq = ((pSort->sortFlags & SORTFLAG_UseSorter)==0);
603   int nExpr = pSort->pOrderBy->nExpr;              /* No. of ORDER BY terms */
604   int nBase = nExpr + bSeq + nData;                /* Fields in sorter record */
605   int regBase;                                     /* Regs for sorter record */
606   int regRecord = 0;                               /* Assembled sorter record */
607   int nOBSat = pSort->nOBSat;                      /* ORDER BY terms to skip */
608   int op;                            /* Opcode to add sorter record to sorter */
609   int iLimit;                        /* LIMIT counter */
610   int iSkip = 0;                     /* End of the sorter insert loop */
611 
612   assert( bSeq==0 || bSeq==1 );
613 
614   /* Three cases:
615   **   (1) The data to be sorted has already been packed into a Record
616   **       by a prior OP_MakeRecord.  In this case nData==1 and regData
617   **       will be completely unrelated to regOrigData.
618   **   (2) All output columns are included in the sort record.  In that
619   **       case regData==regOrigData.
620   **   (3) Some output columns are omitted from the sort record due to
621   **       the SQLITE_ENABLE_SORTER_REFERENCE optimization, or due to the
622   **       SQLITE_ECEL_OMITREF optimization, or due to the
623   **       SortCtx.pDeferredRowLoad optimiation.  In any of these cases
624   **       regOrigData is 0 to prevent this routine from trying to copy
625   **       values that might not yet exist.
626   */
627   assert( nData==1 || regData==regOrigData || regOrigData==0 );
628 
629   if( nPrefixReg ){
630     assert( nPrefixReg==nExpr+bSeq );
631     regBase = regData - nPrefixReg;
632   }else{
633     regBase = pParse->nMem + 1;
634     pParse->nMem += nBase;
635   }
636   assert( pSelect->iOffset==0 || pSelect->iLimit!=0 );
637   iLimit = pSelect->iOffset ? pSelect->iOffset+1 : pSelect->iLimit;
638   pSort->labelDone = sqlite3VdbeMakeLabel(pParse);
639   sqlite3ExprCodeExprList(pParse, pSort->pOrderBy, regBase, regOrigData,
640                           SQLITE_ECEL_DUP | (regOrigData? SQLITE_ECEL_REF : 0));
641   if( bSeq ){
642     sqlite3VdbeAddOp2(v, OP_Sequence, pSort->iECursor, regBase+nExpr);
643   }
644   if( nPrefixReg==0 && nData>0 ){
645     sqlite3ExprCodeMove(pParse, regData, regBase+nExpr+bSeq, nData);
646   }
647   if( nOBSat>0 ){
648     int regPrevKey;   /* The first nOBSat columns of the previous row */
649     int addrFirst;    /* Address of the OP_IfNot opcode */
650     int addrJmp;      /* Address of the OP_Jump opcode */
651     VdbeOp *pOp;      /* Opcode that opens the sorter */
652     int nKey;         /* Number of sorting key columns, including OP_Sequence */
653     KeyInfo *pKI;     /* Original KeyInfo on the sorter table */
654 
655     regRecord = makeSorterRecord(pParse, pSort, pSelect, regBase, nBase);
656     regPrevKey = pParse->nMem+1;
657     pParse->nMem += pSort->nOBSat;
658     nKey = nExpr - pSort->nOBSat + bSeq;
659     if( bSeq ){
660       addrFirst = sqlite3VdbeAddOp1(v, OP_IfNot, regBase+nExpr);
661     }else{
662       addrFirst = sqlite3VdbeAddOp1(v, OP_SequenceTest, pSort->iECursor);
663     }
664     VdbeCoverage(v);
665     sqlite3VdbeAddOp3(v, OP_Compare, regPrevKey, regBase, pSort->nOBSat);
666     pOp = sqlite3VdbeGetOp(v, pSort->addrSortIndex);
667     if( pParse->db->mallocFailed ) return;
668     pOp->p2 = nKey + nData;
669     pKI = pOp->p4.pKeyInfo;
670     memset(pKI->aSortFlags, 0, pKI->nKeyField); /* Makes OP_Jump testable */
671     sqlite3VdbeChangeP4(v, -1, (char*)pKI, P4_KEYINFO);
672     testcase( pKI->nAllField > pKI->nKeyField+2 );
673     pOp->p4.pKeyInfo = sqlite3KeyInfoFromExprList(pParse,pSort->pOrderBy,nOBSat,
674                                            pKI->nAllField-pKI->nKeyField-1);
675     pOp = 0; /* Ensure pOp not used after sqltie3VdbeAddOp3() */
676     addrJmp = sqlite3VdbeCurrentAddr(v);
677     sqlite3VdbeAddOp3(v, OP_Jump, addrJmp+1, 0, addrJmp+1); VdbeCoverage(v);
678     pSort->labelBkOut = sqlite3VdbeMakeLabel(pParse);
679     pSort->regReturn = ++pParse->nMem;
680     sqlite3VdbeAddOp2(v, OP_Gosub, pSort->regReturn, pSort->labelBkOut);
681     sqlite3VdbeAddOp1(v, OP_ResetSorter, pSort->iECursor);
682     if( iLimit ){
683       sqlite3VdbeAddOp2(v, OP_IfNot, iLimit, pSort->labelDone);
684       VdbeCoverage(v);
685     }
686     sqlite3VdbeJumpHere(v, addrFirst);
687     sqlite3ExprCodeMove(pParse, regBase, regPrevKey, pSort->nOBSat);
688     sqlite3VdbeJumpHere(v, addrJmp);
689   }
690   if( iLimit ){
691     /* At this point the values for the new sorter entry are stored
692     ** in an array of registers. They need to be composed into a record
693     ** and inserted into the sorter if either (a) there are currently
694     ** less than LIMIT+OFFSET items or (b) the new record is smaller than
695     ** the largest record currently in the sorter. If (b) is true and there
696     ** are already LIMIT+OFFSET items in the sorter, delete the largest
697     ** entry before inserting the new one. This way there are never more
698     ** than LIMIT+OFFSET items in the sorter.
699     **
700     ** If the new record does not need to be inserted into the sorter,
701     ** jump to the next iteration of the loop. If the pSort->labelOBLopt
702     ** value is not zero, then it is a label of where to jump.  Otherwise,
703     ** just bypass the row insert logic.  See the header comment on the
704     ** sqlite3WhereOrderByLimitOptLabel() function for additional info.
705     */
706     int iCsr = pSort->iECursor;
707     sqlite3VdbeAddOp2(v, OP_IfNotZero, iLimit, sqlite3VdbeCurrentAddr(v)+4);
708     VdbeCoverage(v);
709     sqlite3VdbeAddOp2(v, OP_Last, iCsr, 0);
710     iSkip = sqlite3VdbeAddOp4Int(v, OP_IdxLE,
711                                  iCsr, 0, regBase+nOBSat, nExpr-nOBSat);
712     VdbeCoverage(v);
713     sqlite3VdbeAddOp1(v, OP_Delete, iCsr);
714   }
715   if( regRecord==0 ){
716     regRecord = makeSorterRecord(pParse, pSort, pSelect, regBase, nBase);
717   }
718   if( pSort->sortFlags & SORTFLAG_UseSorter ){
719     op = OP_SorterInsert;
720   }else{
721     op = OP_IdxInsert;
722   }
723   sqlite3VdbeAddOp4Int(v, op, pSort->iECursor, regRecord,
724                        regBase+nOBSat, nBase-nOBSat);
725   if( iSkip ){
726     sqlite3VdbeChangeP2(v, iSkip,
727          pSort->labelOBLopt ? pSort->labelOBLopt : sqlite3VdbeCurrentAddr(v));
728   }
729 }
730 
731 /*
732 ** Add code to implement the OFFSET
733 */
734 static void codeOffset(
735   Vdbe *v,          /* Generate code into this VM */
736   int iOffset,      /* Register holding the offset counter */
737   int iContinue     /* Jump here to skip the current record */
738 ){
739   if( iOffset>0 ){
740     sqlite3VdbeAddOp3(v, OP_IfPos, iOffset, iContinue, 1); VdbeCoverage(v);
741     VdbeComment((v, "OFFSET"));
742   }
743 }
744 
745 /*
746 ** Add code that will check to make sure the array of registers starting at
747 ** iMem form a distinct entry. This is used by both "SELECT DISTINCT ..." and
748 ** distinct aggregates ("SELECT count(DISTINCT <expr>) ..."). Three strategies
749 ** are available. Which is used depends on the value of parameter eTnctType,
750 ** as follows:
751 **
752 **   WHERE_DISTINCT_UNORDERED/WHERE_DISTINCT_NOOP:
753 **     Build an ephemeral table that contains all entries seen before and
754 **     skip entries which have been seen before.
755 **
756 **     Parameter iTab is the cursor number of an ephemeral table that must
757 **     be opened before the VM code generated by this routine is executed.
758 **     The ephemeral cursor table is queried for a record identical to the
759 **     record formed by the current array of registers. If one is found,
760 **     jump to VM address addrRepeat. Otherwise, insert a new record into
761 **     the ephemeral cursor and proceed.
762 **
763 **     The returned value in this case is a copy of parameter iTab.
764 **
765 **   WHERE_DISTINCT_ORDERED:
766 **     In this case rows are being delivered sorted order. The ephermal
767 **     table is not required. Instead, the current set of values
768 **     is compared against previous row. If they match, the new row
769 **     is not distinct and control jumps to VM address addrRepeat. Otherwise,
770 **     the VM program proceeds with processing the new row.
771 **
772 **     The returned value in this case is the register number of the first
773 **     in an array of registers used to store the previous result row so that
774 **     it can be compared to the next. The caller must ensure that this
775 **     register is initialized to NULL.  (The fixDistinctOpenEph() routine
776 **     will take care of this initialization.)
777 **
778 **   WHERE_DISTINCT_UNIQUE:
779 **     In this case it has already been determined that the rows are distinct.
780 **     No special action is required. The return value is zero.
781 **
782 ** Parameter pEList is the list of expressions used to generated the
783 ** contents of each row. It is used by this routine to determine (a)
784 ** how many elements there are in the array of registers and (b) the
785 ** collation sequences that should be used for the comparisons if
786 ** eTnctType is WHERE_DISTINCT_ORDERED.
787 */
788 static int codeDistinct(
789   Parse *pParse,     /* Parsing and code generating context */
790   int eTnctType,     /* WHERE_DISTINCT_* value */
791   int iTab,          /* A sorting index used to test for distinctness */
792   int addrRepeat,    /* Jump to here if not distinct */
793   ExprList *pEList,  /* Expression for each element */
794   int regElem        /* First element */
795 ){
796   int iRet = 0;
797   int nResultCol = pEList->nExpr;
798   Vdbe *v = pParse->pVdbe;
799 
800   switch( eTnctType ){
801     case WHERE_DISTINCT_ORDERED: {
802       int i;
803       int iJump;              /* Jump destination */
804       int regPrev;            /* Previous row content */
805 
806       /* Allocate space for the previous row */
807       iRet = regPrev = pParse->nMem+1;
808       pParse->nMem += nResultCol;
809 
810       iJump = sqlite3VdbeCurrentAddr(v) + nResultCol;
811       for(i=0; i<nResultCol; i++){
812         CollSeq *pColl = sqlite3ExprCollSeq(pParse, pEList->a[i].pExpr);
813         if( i<nResultCol-1 ){
814           sqlite3VdbeAddOp3(v, OP_Ne, regElem+i, iJump, regPrev+i);
815           VdbeCoverage(v);
816         }else{
817           sqlite3VdbeAddOp3(v, OP_Eq, regElem+i, addrRepeat, regPrev+i);
818           VdbeCoverage(v);
819          }
820         sqlite3VdbeChangeP4(v, -1, (const char *)pColl, P4_COLLSEQ);
821         sqlite3VdbeChangeP5(v, SQLITE_NULLEQ);
822       }
823       assert( sqlite3VdbeCurrentAddr(v)==iJump || pParse->db->mallocFailed );
824       sqlite3VdbeAddOp3(v, OP_Copy, regElem, regPrev, nResultCol-1);
825       break;
826     }
827 
828     case WHERE_DISTINCT_UNIQUE: {
829       /* nothing to do */
830       break;
831     }
832 
833     default: {
834       int r1 = sqlite3GetTempReg(pParse);
835       sqlite3VdbeAddOp4Int(v, OP_Found, iTab, addrRepeat, regElem, nResultCol);
836       VdbeCoverage(v);
837       sqlite3VdbeAddOp3(v, OP_MakeRecord, regElem, nResultCol, r1);
838       sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iTab, r1, regElem, nResultCol);
839       sqlite3VdbeChangeP5(v, OPFLAG_USESEEKRESULT);
840       sqlite3ReleaseTempReg(pParse, r1);
841       iRet = iTab;
842       break;
843     }
844   }
845 
846   return iRet;
847 }
848 
849 /*
850 ** This routine runs after codeDistinct().  It makes necessary
851 ** adjustments to the OP_OpenEphemeral opcode that the codeDistinct()
852 ** routine made use of.  This processing must be done separately since
853 ** sometimes codeDistinct is called before the OP_OpenEphemeral is actually
854 ** laid down.
855 **
856 ** WHERE_DISTINCT_NOOP:
857 ** WHERE_DISTINCT_UNORDERED:
858 **
859 **     No adjustments necessary.  This function is a no-op.
860 **
861 ** WHERE_DISTINCT_UNIQUE:
862 **
863 **     The ephemeral table is not needed.  So change the
864 **     OP_OpenEphemeral opcode into an OP_Noop.
865 **
866 ** WHERE_DISTINCT_ORDERED:
867 **
868 **     The ephemeral table is not needed.  But we do need register
869 **     iVal to be initialized to NULL.  So change the OP_OpenEphemeral
870 **     into an OP_Null on the iVal register.
871 */
872 static void fixDistinctOpenEph(
873   Parse *pParse,     /* Parsing and code generating context */
874   int eTnctType,     /* WHERE_DISTINCT_* value */
875   int iVal,          /* Value returned by codeDistinct() */
876   int iOpenEphAddr   /* Address of OP_OpenEphemeral instruction for iTab */
877 ){
878   if( pParse->nErr==0
879    && (eTnctType==WHERE_DISTINCT_UNIQUE || eTnctType==WHERE_DISTINCT_ORDERED)
880   ){
881     Vdbe *v = pParse->pVdbe;
882     sqlite3VdbeChangeToNoop(v, iOpenEphAddr);
883     if( sqlite3VdbeGetOp(v, iOpenEphAddr+1)->opcode==OP_Explain ){
884       sqlite3VdbeChangeToNoop(v, iOpenEphAddr+1);
885     }
886     if( eTnctType==WHERE_DISTINCT_ORDERED ){
887       /* Change the OP_OpenEphemeral to an OP_Null that sets the MEM_Cleared
888       ** bit on the first register of the previous value.  This will cause the
889       ** OP_Ne added in codeDistinct() to always fail on the first iteration of
890       ** the loop even if the first row is all NULLs.  */
891       VdbeOp *pOp = sqlite3VdbeGetOp(v, iOpenEphAddr);
892       pOp->opcode = OP_Null;
893       pOp->p1 = 1;
894       pOp->p2 = iVal;
895     }
896   }
897 }
898 
899 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
900 /*
901 ** This function is called as part of inner-loop generation for a SELECT
902 ** statement with an ORDER BY that is not optimized by an index. It
903 ** determines the expressions, if any, that the sorter-reference
904 ** optimization should be used for. The sorter-reference optimization
905 ** is used for SELECT queries like:
906 **
907 **   SELECT a, bigblob FROM t1 ORDER BY a LIMIT 10
908 **
909 ** If the optimization is used for expression "bigblob", then instead of
910 ** storing values read from that column in the sorter records, the PK of
911 ** the row from table t1 is stored instead. Then, as records are extracted from
912 ** the sorter to return to the user, the required value of bigblob is
913 ** retrieved directly from table t1. If the values are very large, this
914 ** can be more efficient than storing them directly in the sorter records.
915 **
916 ** The ExprList_item.bSorterRef flag is set for each expression in pEList
917 ** for which the sorter-reference optimization should be enabled.
918 ** Additionally, the pSort->aDefer[] array is populated with entries
919 ** for all cursors required to evaluate all selected expressions. Finally.
920 ** output variable (*ppExtra) is set to an expression list containing
921 ** expressions for all extra PK values that should be stored in the
922 ** sorter records.
923 */
924 static void selectExprDefer(
925   Parse *pParse,                  /* Leave any error here */
926   SortCtx *pSort,                 /* Sorter context */
927   ExprList *pEList,               /* Expressions destined for sorter */
928   ExprList **ppExtra              /* Expressions to append to sorter record */
929 ){
930   int i;
931   int nDefer = 0;
932   ExprList *pExtra = 0;
933   for(i=0; i<pEList->nExpr; i++){
934     struct ExprList_item *pItem = &pEList->a[i];
935     if( pItem->u.x.iOrderByCol==0 ){
936       Expr *pExpr = pItem->pExpr;
937       Table *pTab;
938       if( pExpr->op==TK_COLUMN
939        && pExpr->iColumn>=0
940        && ALWAYS( ExprUseYTab(pExpr) )
941        && (pTab = pExpr->y.pTab)!=0
942        && IsOrdinaryTable(pTab)
943        && (pTab->aCol[pExpr->iColumn].colFlags & COLFLAG_SORTERREF)!=0
944       ){
945         int j;
946         for(j=0; j<nDefer; j++){
947           if( pSort->aDefer[j].iCsr==pExpr->iTable ) break;
948         }
949         if( j==nDefer ){
950           if( nDefer==ArraySize(pSort->aDefer) ){
951             continue;
952           }else{
953             int nKey = 1;
954             int k;
955             Index *pPk = 0;
956             if( !HasRowid(pTab) ){
957               pPk = sqlite3PrimaryKeyIndex(pTab);
958               nKey = pPk->nKeyCol;
959             }
960             for(k=0; k<nKey; k++){
961               Expr *pNew = sqlite3PExpr(pParse, TK_COLUMN, 0, 0);
962               if( pNew ){
963                 pNew->iTable = pExpr->iTable;
964                 assert( ExprUseYTab(pNew) );
965                 pNew->y.pTab = pExpr->y.pTab;
966                 pNew->iColumn = pPk ? pPk->aiColumn[k] : -1;
967                 pExtra = sqlite3ExprListAppend(pParse, pExtra, pNew);
968               }
969             }
970             pSort->aDefer[nDefer].pTab = pExpr->y.pTab;
971             pSort->aDefer[nDefer].iCsr = pExpr->iTable;
972             pSort->aDefer[nDefer].nKey = nKey;
973             nDefer++;
974           }
975         }
976         pItem->bSorterRef = 1;
977       }
978     }
979   }
980   pSort->nDefer = (u8)nDefer;
981   *ppExtra = pExtra;
982 }
983 #endif
984 
985 /*
986 ** This routine generates the code for the inside of the inner loop
987 ** of a SELECT.
988 **
989 ** If srcTab is negative, then the p->pEList expressions
990 ** are evaluated in order to get the data for this row.  If srcTab is
991 ** zero or more, then data is pulled from srcTab and p->pEList is used only
992 ** to get the number of columns and the collation sequence for each column.
993 */
994 static void selectInnerLoop(
995   Parse *pParse,          /* The parser context */
996   Select *p,              /* The complete select statement being coded */
997   int srcTab,             /* Pull data from this table if non-negative */
998   SortCtx *pSort,         /* If not NULL, info on how to process ORDER BY */
999   DistinctCtx *pDistinct, /* If not NULL, info on how to process DISTINCT */
1000   SelectDest *pDest,      /* How to dispose of the results */
1001   int iContinue,          /* Jump here to continue with next row */
1002   int iBreak              /* Jump here to break out of the inner loop */
1003 ){
1004   Vdbe *v = pParse->pVdbe;
1005   int i;
1006   int hasDistinct;            /* True if the DISTINCT keyword is present */
1007   int eDest = pDest->eDest;   /* How to dispose of results */
1008   int iParm = pDest->iSDParm; /* First argument to disposal method */
1009   int nResultCol;             /* Number of result columns */
1010   int nPrefixReg = 0;         /* Number of extra registers before regResult */
1011   RowLoadInfo sRowLoadInfo;   /* Info for deferred row loading */
1012 
1013   /* Usually, regResult is the first cell in an array of memory cells
1014   ** containing the current result row. In this case regOrig is set to the
1015   ** same value. However, if the results are being sent to the sorter, the
1016   ** values for any expressions that are also part of the sort-key are omitted
1017   ** from this array. In this case regOrig is set to zero.  */
1018   int regResult;              /* Start of memory holding current results */
1019   int regOrig;                /* Start of memory holding full result (or 0) */
1020 
1021   assert( v );
1022   assert( p->pEList!=0 );
1023   hasDistinct = pDistinct ? pDistinct->eTnctType : WHERE_DISTINCT_NOOP;
1024   if( pSort && pSort->pOrderBy==0 ) pSort = 0;
1025   if( pSort==0 && !hasDistinct ){
1026     assert( iContinue!=0 );
1027     codeOffset(v, p->iOffset, iContinue);
1028   }
1029 
1030   /* Pull the requested columns.
1031   */
1032   nResultCol = p->pEList->nExpr;
1033 
1034   if( pDest->iSdst==0 ){
1035     if( pSort ){
1036       nPrefixReg = pSort->pOrderBy->nExpr;
1037       if( !(pSort->sortFlags & SORTFLAG_UseSorter) ) nPrefixReg++;
1038       pParse->nMem += nPrefixReg;
1039     }
1040     pDest->iSdst = pParse->nMem+1;
1041     pParse->nMem += nResultCol;
1042   }else if( pDest->iSdst+nResultCol > pParse->nMem ){
1043     /* This is an error condition that can result, for example, when a SELECT
1044     ** on the right-hand side of an INSERT contains more result columns than
1045     ** there are columns in the table on the left.  The error will be caught
1046     ** and reported later.  But we need to make sure enough memory is allocated
1047     ** to avoid other spurious errors in the meantime. */
1048     pParse->nMem += nResultCol;
1049   }
1050   pDest->nSdst = nResultCol;
1051   regOrig = regResult = pDest->iSdst;
1052   if( srcTab>=0 ){
1053     for(i=0; i<nResultCol; i++){
1054       sqlite3VdbeAddOp3(v, OP_Column, srcTab, i, regResult+i);
1055       VdbeComment((v, "%s", p->pEList->a[i].zEName));
1056     }
1057   }else if( eDest!=SRT_Exists ){
1058 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1059     ExprList *pExtra = 0;
1060 #endif
1061     /* If the destination is an EXISTS(...) expression, the actual
1062     ** values returned by the SELECT are not required.
1063     */
1064     u8 ecelFlags;    /* "ecel" is an abbreviation of "ExprCodeExprList" */
1065     ExprList *pEList;
1066     if( eDest==SRT_Mem || eDest==SRT_Output || eDest==SRT_Coroutine ){
1067       ecelFlags = SQLITE_ECEL_DUP;
1068     }else{
1069       ecelFlags = 0;
1070     }
1071     if( pSort && hasDistinct==0 && eDest!=SRT_EphemTab && eDest!=SRT_Table ){
1072       /* For each expression in p->pEList that is a copy of an expression in
1073       ** the ORDER BY clause (pSort->pOrderBy), set the associated
1074       ** iOrderByCol value to one more than the index of the ORDER BY
1075       ** expression within the sort-key that pushOntoSorter() will generate.
1076       ** This allows the p->pEList field to be omitted from the sorted record,
1077       ** saving space and CPU cycles.  */
1078       ecelFlags |= (SQLITE_ECEL_OMITREF|SQLITE_ECEL_REF);
1079 
1080       for(i=pSort->nOBSat; i<pSort->pOrderBy->nExpr; i++){
1081         int j;
1082         if( (j = pSort->pOrderBy->a[i].u.x.iOrderByCol)>0 ){
1083           p->pEList->a[j-1].u.x.iOrderByCol = i+1-pSort->nOBSat;
1084         }
1085       }
1086 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1087       selectExprDefer(pParse, pSort, p->pEList, &pExtra);
1088       if( pExtra && pParse->db->mallocFailed==0 ){
1089         /* If there are any extra PK columns to add to the sorter records,
1090         ** allocate extra memory cells and adjust the OpenEphemeral
1091         ** instruction to account for the larger records. This is only
1092         ** required if there are one or more WITHOUT ROWID tables with
1093         ** composite primary keys in the SortCtx.aDefer[] array.  */
1094         VdbeOp *pOp = sqlite3VdbeGetOp(v, pSort->addrSortIndex);
1095         pOp->p2 += (pExtra->nExpr - pSort->nDefer);
1096         pOp->p4.pKeyInfo->nAllField += (pExtra->nExpr - pSort->nDefer);
1097         pParse->nMem += pExtra->nExpr;
1098       }
1099 #endif
1100 
1101       /* Adjust nResultCol to account for columns that are omitted
1102       ** from the sorter by the optimizations in this branch */
1103       pEList = p->pEList;
1104       for(i=0; i<pEList->nExpr; i++){
1105         if( pEList->a[i].u.x.iOrderByCol>0
1106 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1107          || pEList->a[i].bSorterRef
1108 #endif
1109         ){
1110           nResultCol--;
1111           regOrig = 0;
1112         }
1113       }
1114 
1115       testcase( regOrig );
1116       testcase( eDest==SRT_Set );
1117       testcase( eDest==SRT_Mem );
1118       testcase( eDest==SRT_Coroutine );
1119       testcase( eDest==SRT_Output );
1120       assert( eDest==SRT_Set || eDest==SRT_Mem
1121            || eDest==SRT_Coroutine || eDest==SRT_Output
1122            || eDest==SRT_Upfrom );
1123     }
1124     sRowLoadInfo.regResult = regResult;
1125     sRowLoadInfo.ecelFlags = ecelFlags;
1126 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1127     sRowLoadInfo.pExtra = pExtra;
1128     sRowLoadInfo.regExtraResult = regResult + nResultCol;
1129     if( pExtra ) nResultCol += pExtra->nExpr;
1130 #endif
1131     if( p->iLimit
1132      && (ecelFlags & SQLITE_ECEL_OMITREF)!=0
1133      && nPrefixReg>0
1134     ){
1135       assert( pSort!=0 );
1136       assert( hasDistinct==0 );
1137       pSort->pDeferredRowLoad = &sRowLoadInfo;
1138       regOrig = 0;
1139     }else{
1140       innerLoopLoadRow(pParse, p, &sRowLoadInfo);
1141     }
1142   }
1143 
1144   /* If the DISTINCT keyword was present on the SELECT statement
1145   ** and this row has been seen before, then do not make this row
1146   ** part of the result.
1147   */
1148   if( hasDistinct ){
1149     int eType = pDistinct->eTnctType;
1150     int iTab = pDistinct->tabTnct;
1151     assert( nResultCol==p->pEList->nExpr );
1152     iTab = codeDistinct(pParse, eType, iTab, iContinue, p->pEList, regResult);
1153     fixDistinctOpenEph(pParse, eType, iTab, pDistinct->addrTnct);
1154     if( pSort==0 ){
1155       codeOffset(v, p->iOffset, iContinue);
1156     }
1157   }
1158 
1159   switch( eDest ){
1160     /* In this mode, write each query result to the key of the temporary
1161     ** table iParm.
1162     */
1163 #ifndef SQLITE_OMIT_COMPOUND_SELECT
1164     case SRT_Union: {
1165       int r1;
1166       r1 = sqlite3GetTempReg(pParse);
1167       sqlite3VdbeAddOp3(v, OP_MakeRecord, regResult, nResultCol, r1);
1168       sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, r1, regResult, nResultCol);
1169       sqlite3ReleaseTempReg(pParse, r1);
1170       break;
1171     }
1172 
1173     /* Construct a record from the query result, but instead of
1174     ** saving that record, use it as a key to delete elements from
1175     ** the temporary table iParm.
1176     */
1177     case SRT_Except: {
1178       sqlite3VdbeAddOp3(v, OP_IdxDelete, iParm, regResult, nResultCol);
1179       break;
1180     }
1181 #endif /* SQLITE_OMIT_COMPOUND_SELECT */
1182 
1183     /* Store the result as data using a unique key.
1184     */
1185     case SRT_Fifo:
1186     case SRT_DistFifo:
1187     case SRT_Table:
1188     case SRT_EphemTab: {
1189       int r1 = sqlite3GetTempRange(pParse, nPrefixReg+1);
1190       testcase( eDest==SRT_Table );
1191       testcase( eDest==SRT_EphemTab );
1192       testcase( eDest==SRT_Fifo );
1193       testcase( eDest==SRT_DistFifo );
1194       sqlite3VdbeAddOp3(v, OP_MakeRecord, regResult, nResultCol, r1+nPrefixReg);
1195 #ifndef SQLITE_OMIT_CTE
1196       if( eDest==SRT_DistFifo ){
1197         /* If the destination is DistFifo, then cursor (iParm+1) is open
1198         ** on an ephemeral index. If the current row is already present
1199         ** in the index, do not write it to the output. If not, add the
1200         ** current row to the index and proceed with writing it to the
1201         ** output table as well.  */
1202         int addr = sqlite3VdbeCurrentAddr(v) + 4;
1203         sqlite3VdbeAddOp4Int(v, OP_Found, iParm+1, addr, r1, 0);
1204         VdbeCoverage(v);
1205         sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm+1, r1,regResult,nResultCol);
1206         assert( pSort==0 );
1207       }
1208 #endif
1209       if( pSort ){
1210         assert( regResult==regOrig );
1211         pushOntoSorter(pParse, pSort, p, r1+nPrefixReg, regOrig, 1, nPrefixReg);
1212       }else{
1213         int r2 = sqlite3GetTempReg(pParse);
1214         sqlite3VdbeAddOp2(v, OP_NewRowid, iParm, r2);
1215         sqlite3VdbeAddOp3(v, OP_Insert, iParm, r1, r2);
1216         sqlite3VdbeChangeP5(v, OPFLAG_APPEND);
1217         sqlite3ReleaseTempReg(pParse, r2);
1218       }
1219       sqlite3ReleaseTempRange(pParse, r1, nPrefixReg+1);
1220       break;
1221     }
1222 
1223     case SRT_Upfrom: {
1224       if( pSort ){
1225         pushOntoSorter(
1226             pParse, pSort, p, regResult, regOrig, nResultCol, nPrefixReg);
1227       }else{
1228         int i2 = pDest->iSDParm2;
1229         int r1 = sqlite3GetTempReg(pParse);
1230 
1231         /* If the UPDATE FROM join is an aggregate that matches no rows, it
1232         ** might still be trying to return one row, because that is what
1233         ** aggregates do.  Don't record that empty row in the output table. */
1234         sqlite3VdbeAddOp2(v, OP_IsNull, regResult, iBreak); VdbeCoverage(v);
1235 
1236         sqlite3VdbeAddOp3(v, OP_MakeRecord,
1237                           regResult+(i2<0), nResultCol-(i2<0), r1);
1238         if( i2<0 ){
1239           sqlite3VdbeAddOp3(v, OP_Insert, iParm, r1, regResult);
1240         }else{
1241           sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, r1, regResult, i2);
1242         }
1243       }
1244       break;
1245     }
1246 
1247 #ifndef SQLITE_OMIT_SUBQUERY
1248     /* If we are creating a set for an "expr IN (SELECT ...)" construct,
1249     ** then there should be a single item on the stack.  Write this
1250     ** item into the set table with bogus data.
1251     */
1252     case SRT_Set: {
1253       if( pSort ){
1254         /* At first glance you would think we could optimize out the
1255         ** ORDER BY in this case since the order of entries in the set
1256         ** does not matter.  But there might be a LIMIT clause, in which
1257         ** case the order does matter */
1258         pushOntoSorter(
1259             pParse, pSort, p, regResult, regOrig, nResultCol, nPrefixReg);
1260       }else{
1261         int r1 = sqlite3GetTempReg(pParse);
1262         assert( sqlite3Strlen30(pDest->zAffSdst)==nResultCol );
1263         sqlite3VdbeAddOp4(v, OP_MakeRecord, regResult, nResultCol,
1264             r1, pDest->zAffSdst, nResultCol);
1265         sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, r1, regResult, nResultCol);
1266         sqlite3ReleaseTempReg(pParse, r1);
1267       }
1268       break;
1269     }
1270 
1271 
1272     /* If any row exist in the result set, record that fact and abort.
1273     */
1274     case SRT_Exists: {
1275       sqlite3VdbeAddOp2(v, OP_Integer, 1, iParm);
1276       /* The LIMIT clause will terminate the loop for us */
1277       break;
1278     }
1279 
1280     /* If this is a scalar select that is part of an expression, then
1281     ** store the results in the appropriate memory cell or array of
1282     ** memory cells and break out of the scan loop.
1283     */
1284     case SRT_Mem: {
1285       if( pSort ){
1286         assert( nResultCol<=pDest->nSdst );
1287         pushOntoSorter(
1288             pParse, pSort, p, regResult, regOrig, nResultCol, nPrefixReg);
1289       }else{
1290         assert( nResultCol==pDest->nSdst );
1291         assert( regResult==iParm );
1292         /* The LIMIT clause will jump out of the loop for us */
1293       }
1294       break;
1295     }
1296 #endif /* #ifndef SQLITE_OMIT_SUBQUERY */
1297 
1298     case SRT_Coroutine:       /* Send data to a co-routine */
1299     case SRT_Output: {        /* Return the results */
1300       testcase( eDest==SRT_Coroutine );
1301       testcase( eDest==SRT_Output );
1302       if( pSort ){
1303         pushOntoSorter(pParse, pSort, p, regResult, regOrig, nResultCol,
1304                        nPrefixReg);
1305       }else if( eDest==SRT_Coroutine ){
1306         sqlite3VdbeAddOp1(v, OP_Yield, pDest->iSDParm);
1307       }else{
1308         sqlite3VdbeAddOp2(v, OP_ResultRow, regResult, nResultCol);
1309       }
1310       break;
1311     }
1312 
1313 #ifndef SQLITE_OMIT_CTE
1314     /* Write the results into a priority queue that is order according to
1315     ** pDest->pOrderBy (in pSO).  pDest->iSDParm (in iParm) is the cursor for an
1316     ** index with pSO->nExpr+2 columns.  Build a key using pSO for the first
1317     ** pSO->nExpr columns, then make sure all keys are unique by adding a
1318     ** final OP_Sequence column.  The last column is the record as a blob.
1319     */
1320     case SRT_DistQueue:
1321     case SRT_Queue: {
1322       int nKey;
1323       int r1, r2, r3;
1324       int addrTest = 0;
1325       ExprList *pSO;
1326       pSO = pDest->pOrderBy;
1327       assert( pSO );
1328       nKey = pSO->nExpr;
1329       r1 = sqlite3GetTempReg(pParse);
1330       r2 = sqlite3GetTempRange(pParse, nKey+2);
1331       r3 = r2+nKey+1;
1332       if( eDest==SRT_DistQueue ){
1333         /* If the destination is DistQueue, then cursor (iParm+1) is open
1334         ** on a second ephemeral index that holds all values every previously
1335         ** added to the queue. */
1336         addrTest = sqlite3VdbeAddOp4Int(v, OP_Found, iParm+1, 0,
1337                                         regResult, nResultCol);
1338         VdbeCoverage(v);
1339       }
1340       sqlite3VdbeAddOp3(v, OP_MakeRecord, regResult, nResultCol, r3);
1341       if( eDest==SRT_DistQueue ){
1342         sqlite3VdbeAddOp2(v, OP_IdxInsert, iParm+1, r3);
1343         sqlite3VdbeChangeP5(v, OPFLAG_USESEEKRESULT);
1344       }
1345       for(i=0; i<nKey; i++){
1346         sqlite3VdbeAddOp2(v, OP_SCopy,
1347                           regResult + pSO->a[i].u.x.iOrderByCol - 1,
1348                           r2+i);
1349       }
1350       sqlite3VdbeAddOp2(v, OP_Sequence, iParm, r2+nKey);
1351       sqlite3VdbeAddOp3(v, OP_MakeRecord, r2, nKey+2, r1);
1352       sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, r1, r2, nKey+2);
1353       if( addrTest ) sqlite3VdbeJumpHere(v, addrTest);
1354       sqlite3ReleaseTempReg(pParse, r1);
1355       sqlite3ReleaseTempRange(pParse, r2, nKey+2);
1356       break;
1357     }
1358 #endif /* SQLITE_OMIT_CTE */
1359 
1360 
1361 
1362 #if !defined(SQLITE_OMIT_TRIGGER)
1363     /* Discard the results.  This is used for SELECT statements inside
1364     ** the body of a TRIGGER.  The purpose of such selects is to call
1365     ** user-defined functions that have side effects.  We do not care
1366     ** about the actual results of the select.
1367     */
1368     default: {
1369       assert( eDest==SRT_Discard );
1370       break;
1371     }
1372 #endif
1373   }
1374 
1375   /* Jump to the end of the loop if the LIMIT is reached.  Except, if
1376   ** there is a sorter, in which case the sorter has already limited
1377   ** the output for us.
1378   */
1379   if( pSort==0 && p->iLimit ){
1380     sqlite3VdbeAddOp2(v, OP_DecrJumpZero, p->iLimit, iBreak); VdbeCoverage(v);
1381   }
1382 }
1383 
1384 /*
1385 ** Allocate a KeyInfo object sufficient for an index of N key columns and
1386 ** X extra columns.
1387 */
1388 KeyInfo *sqlite3KeyInfoAlloc(sqlite3 *db, int N, int X){
1389   int nExtra = (N+X)*(sizeof(CollSeq*)+1) - sizeof(CollSeq*);
1390   KeyInfo *p = sqlite3DbMallocRawNN(db, sizeof(KeyInfo) + nExtra);
1391   if( p ){
1392     p->aSortFlags = (u8*)&p->aColl[N+X];
1393     p->nKeyField = (u16)N;
1394     p->nAllField = (u16)(N+X);
1395     p->enc = ENC(db);
1396     p->db = db;
1397     p->nRef = 1;
1398     memset(&p[1], 0, nExtra);
1399   }else{
1400     return (KeyInfo*)sqlite3OomFault(db);
1401   }
1402   return p;
1403 }
1404 
1405 /*
1406 ** Deallocate a KeyInfo object
1407 */
1408 void sqlite3KeyInfoUnref(KeyInfo *p){
1409   if( p ){
1410     assert( p->nRef>0 );
1411     p->nRef--;
1412     if( p->nRef==0 ) sqlite3DbFreeNN(p->db, p);
1413   }
1414 }
1415 
1416 /*
1417 ** Make a new pointer to a KeyInfo object
1418 */
1419 KeyInfo *sqlite3KeyInfoRef(KeyInfo *p){
1420   if( p ){
1421     assert( p->nRef>0 );
1422     p->nRef++;
1423   }
1424   return p;
1425 }
1426 
1427 #ifdef SQLITE_DEBUG
1428 /*
1429 ** Return TRUE if a KeyInfo object can be change.  The KeyInfo object
1430 ** can only be changed if this is just a single reference to the object.
1431 **
1432 ** This routine is used only inside of assert() statements.
1433 */
1434 int sqlite3KeyInfoIsWriteable(KeyInfo *p){ return p->nRef==1; }
1435 #endif /* SQLITE_DEBUG */
1436 
1437 /*
1438 ** Given an expression list, generate a KeyInfo structure that records
1439 ** the collating sequence for each expression in that expression list.
1440 **
1441 ** If the ExprList is an ORDER BY or GROUP BY clause then the resulting
1442 ** KeyInfo structure is appropriate for initializing a virtual index to
1443 ** implement that clause.  If the ExprList is the result set of a SELECT
1444 ** then the KeyInfo structure is appropriate for initializing a virtual
1445 ** index to implement a DISTINCT test.
1446 **
1447 ** Space to hold the KeyInfo structure is obtained from malloc.  The calling
1448 ** function is responsible for seeing that this structure is eventually
1449 ** freed.
1450 */
1451 KeyInfo *sqlite3KeyInfoFromExprList(
1452   Parse *pParse,       /* Parsing context */
1453   ExprList *pList,     /* Form the KeyInfo object from this ExprList */
1454   int iStart,          /* Begin with this column of pList */
1455   int nExtra           /* Add this many extra columns to the end */
1456 ){
1457   int nExpr;
1458   KeyInfo *pInfo;
1459   struct ExprList_item *pItem;
1460   sqlite3 *db = pParse->db;
1461   int i;
1462 
1463   nExpr = pList->nExpr;
1464   pInfo = sqlite3KeyInfoAlloc(db, nExpr-iStart, nExtra+1);
1465   if( pInfo ){
1466     assert( sqlite3KeyInfoIsWriteable(pInfo) );
1467     for(i=iStart, pItem=pList->a+iStart; i<nExpr; i++, pItem++){
1468       pInfo->aColl[i-iStart] = sqlite3ExprNNCollSeq(pParse, pItem->pExpr);
1469       pInfo->aSortFlags[i-iStart] = pItem->sortFlags;
1470     }
1471   }
1472   return pInfo;
1473 }
1474 
1475 /*
1476 ** Name of the connection operator, used for error messages.
1477 */
1478 const char *sqlite3SelectOpName(int id){
1479   char *z;
1480   switch( id ){
1481     case TK_ALL:       z = "UNION ALL";   break;
1482     case TK_INTERSECT: z = "INTERSECT";   break;
1483     case TK_EXCEPT:    z = "EXCEPT";      break;
1484     default:           z = "UNION";       break;
1485   }
1486   return z;
1487 }
1488 
1489 #ifndef SQLITE_OMIT_EXPLAIN
1490 /*
1491 ** Unless an "EXPLAIN QUERY PLAN" command is being processed, this function
1492 ** is a no-op. Otherwise, it adds a single row of output to the EQP result,
1493 ** where the caption is of the form:
1494 **
1495 **   "USE TEMP B-TREE FOR xxx"
1496 **
1497 ** where xxx is one of "DISTINCT", "ORDER BY" or "GROUP BY". Exactly which
1498 ** is determined by the zUsage argument.
1499 */
1500 static void explainTempTable(Parse *pParse, const char *zUsage){
1501   ExplainQueryPlan((pParse, 0, "USE TEMP B-TREE FOR %s", zUsage));
1502 }
1503 
1504 /*
1505 ** Assign expression b to lvalue a. A second, no-op, version of this macro
1506 ** is provided when SQLITE_OMIT_EXPLAIN is defined. This allows the code
1507 ** in sqlite3Select() to assign values to structure member variables that
1508 ** only exist if SQLITE_OMIT_EXPLAIN is not defined without polluting the
1509 ** code with #ifndef directives.
1510 */
1511 # define explainSetInteger(a, b) a = b
1512 
1513 #else
1514 /* No-op versions of the explainXXX() functions and macros. */
1515 # define explainTempTable(y,z)
1516 # define explainSetInteger(y,z)
1517 #endif
1518 
1519 
1520 /*
1521 ** If the inner loop was generated using a non-null pOrderBy argument,
1522 ** then the results were placed in a sorter.  After the loop is terminated
1523 ** we need to run the sorter and output the results.  The following
1524 ** routine generates the code needed to do that.
1525 */
1526 static void generateSortTail(
1527   Parse *pParse,    /* Parsing context */
1528   Select *p,        /* The SELECT statement */
1529   SortCtx *pSort,   /* Information on the ORDER BY clause */
1530   int nColumn,      /* Number of columns of data */
1531   SelectDest *pDest /* Write the sorted results here */
1532 ){
1533   Vdbe *v = pParse->pVdbe;                     /* The prepared statement */
1534   int addrBreak = pSort->labelDone;            /* Jump here to exit loop */
1535   int addrContinue = sqlite3VdbeMakeLabel(pParse);/* Jump here for next cycle */
1536   int addr;                       /* Top of output loop. Jump for Next. */
1537   int addrOnce = 0;
1538   int iTab;
1539   ExprList *pOrderBy = pSort->pOrderBy;
1540   int eDest = pDest->eDest;
1541   int iParm = pDest->iSDParm;
1542   int regRow;
1543   int regRowid;
1544   int iCol;
1545   int nKey;                       /* Number of key columns in sorter record */
1546   int iSortTab;                   /* Sorter cursor to read from */
1547   int i;
1548   int bSeq;                       /* True if sorter record includes seq. no. */
1549   int nRefKey = 0;
1550   struct ExprList_item *aOutEx = p->pEList->a;
1551 
1552   assert( addrBreak<0 );
1553   if( pSort->labelBkOut ){
1554     sqlite3VdbeAddOp2(v, OP_Gosub, pSort->regReturn, pSort->labelBkOut);
1555     sqlite3VdbeGoto(v, addrBreak);
1556     sqlite3VdbeResolveLabel(v, pSort->labelBkOut);
1557   }
1558 
1559 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1560   /* Open any cursors needed for sorter-reference expressions */
1561   for(i=0; i<pSort->nDefer; i++){
1562     Table *pTab = pSort->aDefer[i].pTab;
1563     int iDb = sqlite3SchemaToIndex(pParse->db, pTab->pSchema);
1564     sqlite3OpenTable(pParse, pSort->aDefer[i].iCsr, iDb, pTab, OP_OpenRead);
1565     nRefKey = MAX(nRefKey, pSort->aDefer[i].nKey);
1566   }
1567 #endif
1568 
1569   iTab = pSort->iECursor;
1570   if( eDest==SRT_Output || eDest==SRT_Coroutine || eDest==SRT_Mem ){
1571     if( eDest==SRT_Mem && p->iOffset ){
1572       sqlite3VdbeAddOp2(v, OP_Null, 0, pDest->iSdst);
1573     }
1574     regRowid = 0;
1575     regRow = pDest->iSdst;
1576   }else{
1577     regRowid = sqlite3GetTempReg(pParse);
1578     if( eDest==SRT_EphemTab || eDest==SRT_Table ){
1579       regRow = sqlite3GetTempReg(pParse);
1580       nColumn = 0;
1581     }else{
1582       regRow = sqlite3GetTempRange(pParse, nColumn);
1583     }
1584   }
1585   nKey = pOrderBy->nExpr - pSort->nOBSat;
1586   if( pSort->sortFlags & SORTFLAG_UseSorter ){
1587     int regSortOut = ++pParse->nMem;
1588     iSortTab = pParse->nTab++;
1589     if( pSort->labelBkOut ){
1590       addrOnce = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
1591     }
1592     sqlite3VdbeAddOp3(v, OP_OpenPseudo, iSortTab, regSortOut,
1593         nKey+1+nColumn+nRefKey);
1594     if( addrOnce ) sqlite3VdbeJumpHere(v, addrOnce);
1595     addr = 1 + sqlite3VdbeAddOp2(v, OP_SorterSort, iTab, addrBreak);
1596     VdbeCoverage(v);
1597     codeOffset(v, p->iOffset, addrContinue);
1598     sqlite3VdbeAddOp3(v, OP_SorterData, iTab, regSortOut, iSortTab);
1599     bSeq = 0;
1600   }else{
1601     addr = 1 + sqlite3VdbeAddOp2(v, OP_Sort, iTab, addrBreak); VdbeCoverage(v);
1602     codeOffset(v, p->iOffset, addrContinue);
1603     iSortTab = iTab;
1604     bSeq = 1;
1605   }
1606   for(i=0, iCol=nKey+bSeq-1; i<nColumn; i++){
1607 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1608     if( aOutEx[i].bSorterRef ) continue;
1609 #endif
1610     if( aOutEx[i].u.x.iOrderByCol==0 ) iCol++;
1611   }
1612 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1613   if( pSort->nDefer ){
1614     int iKey = iCol+1;
1615     int regKey = sqlite3GetTempRange(pParse, nRefKey);
1616 
1617     for(i=0; i<pSort->nDefer; i++){
1618       int iCsr = pSort->aDefer[i].iCsr;
1619       Table *pTab = pSort->aDefer[i].pTab;
1620       int nKey = pSort->aDefer[i].nKey;
1621 
1622       sqlite3VdbeAddOp1(v, OP_NullRow, iCsr);
1623       if( HasRowid(pTab) ){
1624         sqlite3VdbeAddOp3(v, OP_Column, iSortTab, iKey++, regKey);
1625         sqlite3VdbeAddOp3(v, OP_SeekRowid, iCsr,
1626             sqlite3VdbeCurrentAddr(v)+1, regKey);
1627       }else{
1628         int k;
1629         int iJmp;
1630         assert( sqlite3PrimaryKeyIndex(pTab)->nKeyCol==nKey );
1631         for(k=0; k<nKey; k++){
1632           sqlite3VdbeAddOp3(v, OP_Column, iSortTab, iKey++, regKey+k);
1633         }
1634         iJmp = sqlite3VdbeCurrentAddr(v);
1635         sqlite3VdbeAddOp4Int(v, OP_SeekGE, iCsr, iJmp+2, regKey, nKey);
1636         sqlite3VdbeAddOp4Int(v, OP_IdxLE, iCsr, iJmp+3, regKey, nKey);
1637         sqlite3VdbeAddOp1(v, OP_NullRow, iCsr);
1638       }
1639     }
1640     sqlite3ReleaseTempRange(pParse, regKey, nRefKey);
1641   }
1642 #endif
1643   for(i=nColumn-1; i>=0; i--){
1644 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1645     if( aOutEx[i].bSorterRef ){
1646       sqlite3ExprCode(pParse, aOutEx[i].pExpr, regRow+i);
1647     }else
1648 #endif
1649     {
1650       int iRead;
1651       if( aOutEx[i].u.x.iOrderByCol ){
1652         iRead = aOutEx[i].u.x.iOrderByCol-1;
1653       }else{
1654         iRead = iCol--;
1655       }
1656       sqlite3VdbeAddOp3(v, OP_Column, iSortTab, iRead, regRow+i);
1657       VdbeComment((v, "%s", aOutEx[i].zEName));
1658     }
1659   }
1660   switch( eDest ){
1661     case SRT_Table:
1662     case SRT_EphemTab: {
1663       sqlite3VdbeAddOp3(v, OP_Column, iSortTab, nKey+bSeq, regRow);
1664       sqlite3VdbeAddOp2(v, OP_NewRowid, iParm, regRowid);
1665       sqlite3VdbeAddOp3(v, OP_Insert, iParm, regRow, regRowid);
1666       sqlite3VdbeChangeP5(v, OPFLAG_APPEND);
1667       break;
1668     }
1669 #ifndef SQLITE_OMIT_SUBQUERY
1670     case SRT_Set: {
1671       assert( nColumn==sqlite3Strlen30(pDest->zAffSdst) );
1672       sqlite3VdbeAddOp4(v, OP_MakeRecord, regRow, nColumn, regRowid,
1673                         pDest->zAffSdst, nColumn);
1674       sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, regRowid, regRow, nColumn);
1675       break;
1676     }
1677     case SRT_Mem: {
1678       /* The LIMIT clause will terminate the loop for us */
1679       break;
1680     }
1681 #endif
1682     case SRT_Upfrom: {
1683       int i2 = pDest->iSDParm2;
1684       int r1 = sqlite3GetTempReg(pParse);
1685       sqlite3VdbeAddOp3(v, OP_MakeRecord,regRow+(i2<0),nColumn-(i2<0),r1);
1686       if( i2<0 ){
1687         sqlite3VdbeAddOp3(v, OP_Insert, iParm, r1, regRow);
1688       }else{
1689         sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, r1, regRow, i2);
1690       }
1691       break;
1692     }
1693     default: {
1694       assert( eDest==SRT_Output || eDest==SRT_Coroutine );
1695       testcase( eDest==SRT_Output );
1696       testcase( eDest==SRT_Coroutine );
1697       if( eDest==SRT_Output ){
1698         sqlite3VdbeAddOp2(v, OP_ResultRow, pDest->iSdst, nColumn);
1699       }else{
1700         sqlite3VdbeAddOp1(v, OP_Yield, pDest->iSDParm);
1701       }
1702       break;
1703     }
1704   }
1705   if( regRowid ){
1706     if( eDest==SRT_Set ){
1707       sqlite3ReleaseTempRange(pParse, regRow, nColumn);
1708     }else{
1709       sqlite3ReleaseTempReg(pParse, regRow);
1710     }
1711     sqlite3ReleaseTempReg(pParse, regRowid);
1712   }
1713   /* The bottom of the loop
1714   */
1715   sqlite3VdbeResolveLabel(v, addrContinue);
1716   if( pSort->sortFlags & SORTFLAG_UseSorter ){
1717     sqlite3VdbeAddOp2(v, OP_SorterNext, iTab, addr); VdbeCoverage(v);
1718   }else{
1719     sqlite3VdbeAddOp2(v, OP_Next, iTab, addr); VdbeCoverage(v);
1720   }
1721   if( pSort->regReturn ) sqlite3VdbeAddOp1(v, OP_Return, pSort->regReturn);
1722   sqlite3VdbeResolveLabel(v, addrBreak);
1723 }
1724 
1725 /*
1726 ** Return a pointer to a string containing the 'declaration type' of the
1727 ** expression pExpr. The string may be treated as static by the caller.
1728 **
1729 ** Also try to estimate the size of the returned value and return that
1730 ** result in *pEstWidth.
1731 **
1732 ** The declaration type is the exact datatype definition extracted from the
1733 ** original CREATE TABLE statement if the expression is a column. The
1734 ** declaration type for a ROWID field is INTEGER. Exactly when an expression
1735 ** is considered a column can be complex in the presence of subqueries. The
1736 ** result-set expression in all of the following SELECT statements is
1737 ** considered a column by this function.
1738 **
1739 **   SELECT col FROM tbl;
1740 **   SELECT (SELECT col FROM tbl;
1741 **   SELECT (SELECT col FROM tbl);
1742 **   SELECT abc FROM (SELECT col AS abc FROM tbl);
1743 **
1744 ** The declaration type for any expression other than a column is NULL.
1745 **
1746 ** This routine has either 3 or 6 parameters depending on whether or not
1747 ** the SQLITE_ENABLE_COLUMN_METADATA compile-time option is used.
1748 */
1749 #ifdef SQLITE_ENABLE_COLUMN_METADATA
1750 # define columnType(A,B,C,D,E) columnTypeImpl(A,B,C,D,E)
1751 #else /* if !defined(SQLITE_ENABLE_COLUMN_METADATA) */
1752 # define columnType(A,B,C,D,E) columnTypeImpl(A,B)
1753 #endif
1754 static const char *columnTypeImpl(
1755   NameContext *pNC,
1756 #ifndef SQLITE_ENABLE_COLUMN_METADATA
1757   Expr *pExpr
1758 #else
1759   Expr *pExpr,
1760   const char **pzOrigDb,
1761   const char **pzOrigTab,
1762   const char **pzOrigCol
1763 #endif
1764 ){
1765   char const *zType = 0;
1766   int j;
1767 #ifdef SQLITE_ENABLE_COLUMN_METADATA
1768   char const *zOrigDb = 0;
1769   char const *zOrigTab = 0;
1770   char const *zOrigCol = 0;
1771 #endif
1772 
1773   assert( pExpr!=0 );
1774   assert( pNC->pSrcList!=0 );
1775   switch( pExpr->op ){
1776     case TK_COLUMN: {
1777       /* The expression is a column. Locate the table the column is being
1778       ** extracted from in NameContext.pSrcList. This table may be real
1779       ** database table or a subquery.
1780       */
1781       Table *pTab = 0;            /* Table structure column is extracted from */
1782       Select *pS = 0;             /* Select the column is extracted from */
1783       int iCol = pExpr->iColumn;  /* Index of column in pTab */
1784       while( pNC && !pTab ){
1785         SrcList *pTabList = pNC->pSrcList;
1786         for(j=0;j<pTabList->nSrc && pTabList->a[j].iCursor!=pExpr->iTable;j++);
1787         if( j<pTabList->nSrc ){
1788           pTab = pTabList->a[j].pTab;
1789           pS = pTabList->a[j].pSelect;
1790         }else{
1791           pNC = pNC->pNext;
1792         }
1793       }
1794 
1795       if( pTab==0 ){
1796         /* At one time, code such as "SELECT new.x" within a trigger would
1797         ** cause this condition to run.  Since then, we have restructured how
1798         ** trigger code is generated and so this condition is no longer
1799         ** possible. However, it can still be true for statements like
1800         ** the following:
1801         **
1802         **   CREATE TABLE t1(col INTEGER);
1803         **   SELECT (SELECT t1.col) FROM FROM t1;
1804         **
1805         ** when columnType() is called on the expression "t1.col" in the
1806         ** sub-select. In this case, set the column type to NULL, even
1807         ** though it should really be "INTEGER".
1808         **
1809         ** This is not a problem, as the column type of "t1.col" is never
1810         ** used. When columnType() is called on the expression
1811         ** "(SELECT t1.col)", the correct type is returned (see the TK_SELECT
1812         ** branch below.  */
1813         break;
1814       }
1815 
1816       assert( pTab && ExprUseYTab(pExpr) && pExpr->y.pTab==pTab );
1817       if( pS ){
1818         /* The "table" is actually a sub-select or a view in the FROM clause
1819         ** of the SELECT statement. Return the declaration type and origin
1820         ** data for the result-set column of the sub-select.
1821         */
1822         if( iCol<pS->pEList->nExpr
1823 #ifdef SQLITE_ALLOW_ROWID_IN_VIEW
1824          && iCol>=0
1825 #else
1826          && ALWAYS(iCol>=0)
1827 #endif
1828         ){
1829           /* If iCol is less than zero, then the expression requests the
1830           ** rowid of the sub-select or view. This expression is legal (see
1831           ** test case misc2.2.2) - it always evaluates to NULL.
1832           */
1833           NameContext sNC;
1834           Expr *p = pS->pEList->a[iCol].pExpr;
1835           sNC.pSrcList = pS->pSrc;
1836           sNC.pNext = pNC;
1837           sNC.pParse = pNC->pParse;
1838           zType = columnType(&sNC, p,&zOrigDb,&zOrigTab,&zOrigCol);
1839         }
1840       }else{
1841         /* A real table or a CTE table */
1842         assert( !pS );
1843 #ifdef SQLITE_ENABLE_COLUMN_METADATA
1844         if( iCol<0 ) iCol = pTab->iPKey;
1845         assert( iCol==XN_ROWID || (iCol>=0 && iCol<pTab->nCol) );
1846         if( iCol<0 ){
1847           zType = "INTEGER";
1848           zOrigCol = "rowid";
1849         }else{
1850           zOrigCol = pTab->aCol[iCol].zCnName;
1851           zType = sqlite3ColumnType(&pTab->aCol[iCol],0);
1852         }
1853         zOrigTab = pTab->zName;
1854         if( pNC->pParse && pTab->pSchema ){
1855           int iDb = sqlite3SchemaToIndex(pNC->pParse->db, pTab->pSchema);
1856           zOrigDb = pNC->pParse->db->aDb[iDb].zDbSName;
1857         }
1858 #else
1859         assert( iCol==XN_ROWID || (iCol>=0 && iCol<pTab->nCol) );
1860         if( iCol<0 ){
1861           zType = "INTEGER";
1862         }else{
1863           zType = sqlite3ColumnType(&pTab->aCol[iCol],0);
1864         }
1865 #endif
1866       }
1867       break;
1868     }
1869 #ifndef SQLITE_OMIT_SUBQUERY
1870     case TK_SELECT: {
1871       /* The expression is a sub-select. Return the declaration type and
1872       ** origin info for the single column in the result set of the SELECT
1873       ** statement.
1874       */
1875       NameContext sNC;
1876       Select *pS;
1877       Expr *p;
1878       assert( ExprUseXSelect(pExpr) );
1879       pS = pExpr->x.pSelect;
1880       p = pS->pEList->a[0].pExpr;
1881       sNC.pSrcList = pS->pSrc;
1882       sNC.pNext = pNC;
1883       sNC.pParse = pNC->pParse;
1884       zType = columnType(&sNC, p, &zOrigDb, &zOrigTab, &zOrigCol);
1885       break;
1886     }
1887 #endif
1888   }
1889 
1890 #ifdef SQLITE_ENABLE_COLUMN_METADATA
1891   if( pzOrigDb ){
1892     assert( pzOrigTab && pzOrigCol );
1893     *pzOrigDb = zOrigDb;
1894     *pzOrigTab = zOrigTab;
1895     *pzOrigCol = zOrigCol;
1896   }
1897 #endif
1898   return zType;
1899 }
1900 
1901 /*
1902 ** Generate code that will tell the VDBE the declaration types of columns
1903 ** in the result set.
1904 */
1905 static void generateColumnTypes(
1906   Parse *pParse,      /* Parser context */
1907   SrcList *pTabList,  /* List of tables */
1908   ExprList *pEList    /* Expressions defining the result set */
1909 ){
1910 #ifndef SQLITE_OMIT_DECLTYPE
1911   Vdbe *v = pParse->pVdbe;
1912   int i;
1913   NameContext sNC;
1914   sNC.pSrcList = pTabList;
1915   sNC.pParse = pParse;
1916   sNC.pNext = 0;
1917   for(i=0; i<pEList->nExpr; i++){
1918     Expr *p = pEList->a[i].pExpr;
1919     const char *zType;
1920 #ifdef SQLITE_ENABLE_COLUMN_METADATA
1921     const char *zOrigDb = 0;
1922     const char *zOrigTab = 0;
1923     const char *zOrigCol = 0;
1924     zType = columnType(&sNC, p, &zOrigDb, &zOrigTab, &zOrigCol);
1925 
1926     /* The vdbe must make its own copy of the column-type and other
1927     ** column specific strings, in case the schema is reset before this
1928     ** virtual machine is deleted.
1929     */
1930     sqlite3VdbeSetColName(v, i, COLNAME_DATABASE, zOrigDb, SQLITE_TRANSIENT);
1931     sqlite3VdbeSetColName(v, i, COLNAME_TABLE, zOrigTab, SQLITE_TRANSIENT);
1932     sqlite3VdbeSetColName(v, i, COLNAME_COLUMN, zOrigCol, SQLITE_TRANSIENT);
1933 #else
1934     zType = columnType(&sNC, p, 0, 0, 0);
1935 #endif
1936     sqlite3VdbeSetColName(v, i, COLNAME_DECLTYPE, zType, SQLITE_TRANSIENT);
1937   }
1938 #endif /* !defined(SQLITE_OMIT_DECLTYPE) */
1939 }
1940 
1941 
1942 /*
1943 ** Compute the column names for a SELECT statement.
1944 **
1945 ** The only guarantee that SQLite makes about column names is that if the
1946 ** column has an AS clause assigning it a name, that will be the name used.
1947 ** That is the only documented guarantee.  However, countless applications
1948 ** developed over the years have made baseless assumptions about column names
1949 ** and will break if those assumptions changes.  Hence, use extreme caution
1950 ** when modifying this routine to avoid breaking legacy.
1951 **
1952 ** See Also: sqlite3ColumnsFromExprList()
1953 **
1954 ** The PRAGMA short_column_names and PRAGMA full_column_names settings are
1955 ** deprecated.  The default setting is short=ON, full=OFF.  99.9% of all
1956 ** applications should operate this way.  Nevertheless, we need to support the
1957 ** other modes for legacy:
1958 **
1959 **    short=OFF, full=OFF:      Column name is the text of the expression has it
1960 **                              originally appears in the SELECT statement.  In
1961 **                              other words, the zSpan of the result expression.
1962 **
1963 **    short=ON, full=OFF:       (This is the default setting).  If the result
1964 **                              refers directly to a table column, then the
1965 **                              result column name is just the table column
1966 **                              name: COLUMN.  Otherwise use zSpan.
1967 **
1968 **    full=ON, short=ANY:       If the result refers directly to a table column,
1969 **                              then the result column name with the table name
1970 **                              prefix, ex: TABLE.COLUMN.  Otherwise use zSpan.
1971 */
1972 void sqlite3GenerateColumnNames(
1973   Parse *pParse,      /* Parser context */
1974   Select *pSelect     /* Generate column names for this SELECT statement */
1975 ){
1976   Vdbe *v = pParse->pVdbe;
1977   int i;
1978   Table *pTab;
1979   SrcList *pTabList;
1980   ExprList *pEList;
1981   sqlite3 *db = pParse->db;
1982   int fullName;    /* TABLE.COLUMN if no AS clause and is a direct table ref */
1983   int srcName;     /* COLUMN or TABLE.COLUMN if no AS clause and is direct */
1984 
1985 #ifndef SQLITE_OMIT_EXPLAIN
1986   /* If this is an EXPLAIN, skip this step */
1987   if( pParse->explain ){
1988     return;
1989   }
1990 #endif
1991 
1992   if( pParse->colNamesSet ) return;
1993   /* Column names are determined by the left-most term of a compound select */
1994   while( pSelect->pPrior ) pSelect = pSelect->pPrior;
1995   SELECTTRACE(1,pParse,pSelect,("generating column names\n"));
1996   pTabList = pSelect->pSrc;
1997   pEList = pSelect->pEList;
1998   assert( v!=0 );
1999   assert( pTabList!=0 );
2000   pParse->colNamesSet = 1;
2001   fullName = (db->flags & SQLITE_FullColNames)!=0;
2002   srcName = (db->flags & SQLITE_ShortColNames)!=0 || fullName;
2003   sqlite3VdbeSetNumCols(v, pEList->nExpr);
2004   for(i=0; i<pEList->nExpr; i++){
2005     Expr *p = pEList->a[i].pExpr;
2006 
2007     assert( p!=0 );
2008     assert( p->op!=TK_AGG_COLUMN );  /* Agg processing has not run yet */
2009     assert( p->op!=TK_COLUMN
2010         || (ExprUseYTab(p) && p->y.pTab!=0) ); /* Covering idx not yet coded */
2011     if( pEList->a[i].zEName && pEList->a[i].eEName==ENAME_NAME ){
2012       /* An AS clause always takes first priority */
2013       char *zName = pEList->a[i].zEName;
2014       sqlite3VdbeSetColName(v, i, COLNAME_NAME, zName, SQLITE_TRANSIENT);
2015     }else if( srcName && p->op==TK_COLUMN ){
2016       char *zCol;
2017       int iCol = p->iColumn;
2018       pTab = p->y.pTab;
2019       assert( pTab!=0 );
2020       if( iCol<0 ) iCol = pTab->iPKey;
2021       assert( iCol==-1 || (iCol>=0 && iCol<pTab->nCol) );
2022       if( iCol<0 ){
2023         zCol = "rowid";
2024       }else{
2025         zCol = pTab->aCol[iCol].zCnName;
2026       }
2027       if( fullName ){
2028         char *zName = 0;
2029         zName = sqlite3MPrintf(db, "%s.%s", pTab->zName, zCol);
2030         sqlite3VdbeSetColName(v, i, COLNAME_NAME, zName, SQLITE_DYNAMIC);
2031       }else{
2032         sqlite3VdbeSetColName(v, i, COLNAME_NAME, zCol, SQLITE_TRANSIENT);
2033       }
2034     }else{
2035       const char *z = pEList->a[i].zEName;
2036       z = z==0 ? sqlite3MPrintf(db, "column%d", i+1) : sqlite3DbStrDup(db, z);
2037       sqlite3VdbeSetColName(v, i, COLNAME_NAME, z, SQLITE_DYNAMIC);
2038     }
2039   }
2040   generateColumnTypes(pParse, pTabList, pEList);
2041 }
2042 
2043 /*
2044 ** Given an expression list (which is really the list of expressions
2045 ** that form the result set of a SELECT statement) compute appropriate
2046 ** column names for a table that would hold the expression list.
2047 **
2048 ** All column names will be unique.
2049 **
2050 ** Only the column names are computed.  Column.zType, Column.zColl,
2051 ** and other fields of Column are zeroed.
2052 **
2053 ** Return SQLITE_OK on success.  If a memory allocation error occurs,
2054 ** store NULL in *paCol and 0 in *pnCol and return SQLITE_NOMEM.
2055 **
2056 ** The only guarantee that SQLite makes about column names is that if the
2057 ** column has an AS clause assigning it a name, that will be the name used.
2058 ** That is the only documented guarantee.  However, countless applications
2059 ** developed over the years have made baseless assumptions about column names
2060 ** and will break if those assumptions changes.  Hence, use extreme caution
2061 ** when modifying this routine to avoid breaking legacy.
2062 **
2063 ** See Also: sqlite3GenerateColumnNames()
2064 */
2065 int sqlite3ColumnsFromExprList(
2066   Parse *pParse,          /* Parsing context */
2067   ExprList *pEList,       /* Expr list from which to derive column names */
2068   i16 *pnCol,             /* Write the number of columns here */
2069   Column **paCol          /* Write the new column list here */
2070 ){
2071   sqlite3 *db = pParse->db;   /* Database connection */
2072   int i, j;                   /* Loop counters */
2073   u32 cnt;                    /* Index added to make the name unique */
2074   Column *aCol, *pCol;        /* For looping over result columns */
2075   int nCol;                   /* Number of columns in the result set */
2076   char *zName;                /* Column name */
2077   int nName;                  /* Size of name in zName[] */
2078   Hash ht;                    /* Hash table of column names */
2079   Table *pTab;
2080 
2081   sqlite3HashInit(&ht);
2082   if( pEList ){
2083     nCol = pEList->nExpr;
2084     aCol = sqlite3DbMallocZero(db, sizeof(aCol[0])*nCol);
2085     testcase( aCol==0 );
2086     if( NEVER(nCol>32767) ) nCol = 32767;
2087   }else{
2088     nCol = 0;
2089     aCol = 0;
2090   }
2091   assert( nCol==(i16)nCol );
2092   *pnCol = nCol;
2093   *paCol = aCol;
2094 
2095   for(i=0, pCol=aCol; i<nCol && !db->mallocFailed; i++, pCol++){
2096     /* Get an appropriate name for the column
2097     */
2098     if( (zName = pEList->a[i].zEName)!=0 && pEList->a[i].eEName==ENAME_NAME ){
2099       /* If the column contains an "AS <name>" phrase, use <name> as the name */
2100     }else{
2101       Expr *pColExpr = sqlite3ExprSkipCollateAndLikely(pEList->a[i].pExpr);
2102       while( ALWAYS(pColExpr!=0) && pColExpr->op==TK_DOT ){
2103         pColExpr = pColExpr->pRight;
2104         assert( pColExpr!=0 );
2105       }
2106       if( pColExpr->op==TK_COLUMN
2107        && ALWAYS( ExprUseYTab(pColExpr) )
2108        && (pTab = pColExpr->y.pTab)!=0
2109       ){
2110         /* For columns use the column name name */
2111         int iCol = pColExpr->iColumn;
2112         if( iCol<0 ) iCol = pTab->iPKey;
2113         zName = iCol>=0 ? pTab->aCol[iCol].zCnName : "rowid";
2114       }else if( pColExpr->op==TK_ID ){
2115         assert( !ExprHasProperty(pColExpr, EP_IntValue) );
2116         zName = pColExpr->u.zToken;
2117       }else{
2118         /* Use the original text of the column expression as its name */
2119         zName = pEList->a[i].zEName;
2120       }
2121     }
2122     if( zName && !sqlite3IsTrueOrFalse(zName) ){
2123       zName = sqlite3DbStrDup(db, zName);
2124     }else{
2125       zName = sqlite3MPrintf(db,"column%d",i+1);
2126     }
2127 
2128     /* Make sure the column name is unique.  If the name is not unique,
2129     ** append an integer to the name so that it becomes unique.
2130     */
2131     cnt = 0;
2132     while( zName && sqlite3HashFind(&ht, zName)!=0 ){
2133       nName = sqlite3Strlen30(zName);
2134       if( nName>0 ){
2135         for(j=nName-1; j>0 && sqlite3Isdigit(zName[j]); j--){}
2136         if( zName[j]==':' ) nName = j;
2137       }
2138       zName = sqlite3MPrintf(db, "%.*z:%u", nName, zName, ++cnt);
2139       if( cnt>3 ) sqlite3_randomness(sizeof(cnt), &cnt);
2140     }
2141     pCol->zCnName = zName;
2142     pCol->hName = sqlite3StrIHash(zName);
2143     sqlite3ColumnPropertiesFromName(0, pCol);
2144     if( zName && sqlite3HashInsert(&ht, zName, pCol)==pCol ){
2145       sqlite3OomFault(db);
2146     }
2147   }
2148   sqlite3HashClear(&ht);
2149   if( db->mallocFailed ){
2150     for(j=0; j<i; j++){
2151       sqlite3DbFree(db, aCol[j].zCnName);
2152     }
2153     sqlite3DbFree(db, aCol);
2154     *paCol = 0;
2155     *pnCol = 0;
2156     return SQLITE_NOMEM_BKPT;
2157   }
2158   return SQLITE_OK;
2159 }
2160 
2161 /*
2162 ** Add type and collation information to a column list based on
2163 ** a SELECT statement.
2164 **
2165 ** The column list presumably came from selectColumnNamesFromExprList().
2166 ** The column list has only names, not types or collations.  This
2167 ** routine goes through and adds the types and collations.
2168 **
2169 ** This routine requires that all identifiers in the SELECT
2170 ** statement be resolved.
2171 */
2172 void sqlite3SelectAddColumnTypeAndCollation(
2173   Parse *pParse,        /* Parsing contexts */
2174   Table *pTab,          /* Add column type information to this table */
2175   Select *pSelect,      /* SELECT used to determine types and collations */
2176   char aff              /* Default affinity for columns */
2177 ){
2178   sqlite3 *db = pParse->db;
2179   NameContext sNC;
2180   Column *pCol;
2181   CollSeq *pColl;
2182   int i;
2183   Expr *p;
2184   struct ExprList_item *a;
2185 
2186   assert( pSelect!=0 );
2187   assert( (pSelect->selFlags & SF_Resolved)!=0 );
2188   assert( pTab->nCol==pSelect->pEList->nExpr || db->mallocFailed );
2189   if( db->mallocFailed ) return;
2190   memset(&sNC, 0, sizeof(sNC));
2191   sNC.pSrcList = pSelect->pSrc;
2192   a = pSelect->pEList->a;
2193   for(i=0, pCol=pTab->aCol; i<pTab->nCol; i++, pCol++){
2194     const char *zType;
2195     i64 n, m;
2196     pTab->tabFlags |= (pCol->colFlags & COLFLAG_NOINSERT);
2197     p = a[i].pExpr;
2198     zType = columnType(&sNC, p, 0, 0, 0);
2199     /* pCol->szEst = ... // Column size est for SELECT tables never used */
2200     pCol->affinity = sqlite3ExprAffinity(p);
2201     if( zType ){
2202       m = sqlite3Strlen30(zType);
2203       n = sqlite3Strlen30(pCol->zCnName);
2204       pCol->zCnName = sqlite3DbReallocOrFree(db, pCol->zCnName, n+m+2);
2205       if( pCol->zCnName ){
2206         memcpy(&pCol->zCnName[n+1], zType, m+1);
2207         pCol->colFlags |= COLFLAG_HASTYPE;
2208       }else{
2209         testcase( pCol->colFlags & COLFLAG_HASTYPE );
2210         pCol->colFlags &= ~(COLFLAG_HASTYPE|COLFLAG_HASCOLL);
2211       }
2212     }
2213     if( pCol->affinity<=SQLITE_AFF_NONE ) pCol->affinity = aff;
2214     pColl = sqlite3ExprCollSeq(pParse, p);
2215     if( pColl ){
2216       assert( pTab->pIndex==0 );
2217       sqlite3ColumnSetColl(db, pCol, pColl->zName);
2218     }
2219   }
2220   pTab->szTabRow = 1; /* Any non-zero value works */
2221 }
2222 
2223 /*
2224 ** Given a SELECT statement, generate a Table structure that describes
2225 ** the result set of that SELECT.
2226 */
2227 Table *sqlite3ResultSetOfSelect(Parse *pParse, Select *pSelect, char aff){
2228   Table *pTab;
2229   sqlite3 *db = pParse->db;
2230   u64 savedFlags;
2231 
2232   savedFlags = db->flags;
2233   db->flags &= ~(u64)SQLITE_FullColNames;
2234   db->flags |= SQLITE_ShortColNames;
2235   sqlite3SelectPrep(pParse, pSelect, 0);
2236   db->flags = savedFlags;
2237   if( pParse->nErr ) return 0;
2238   while( pSelect->pPrior ) pSelect = pSelect->pPrior;
2239   pTab = sqlite3DbMallocZero(db, sizeof(Table) );
2240   if( pTab==0 ){
2241     return 0;
2242   }
2243   pTab->nTabRef = 1;
2244   pTab->zName = 0;
2245   pTab->nRowLogEst = 200; assert( 200==sqlite3LogEst(1048576) );
2246   sqlite3ColumnsFromExprList(pParse, pSelect->pEList, &pTab->nCol, &pTab->aCol);
2247   sqlite3SelectAddColumnTypeAndCollation(pParse, pTab, pSelect, aff);
2248   pTab->iPKey = -1;
2249   if( db->mallocFailed ){
2250     sqlite3DeleteTable(db, pTab);
2251     return 0;
2252   }
2253   return pTab;
2254 }
2255 
2256 /*
2257 ** Get a VDBE for the given parser context.  Create a new one if necessary.
2258 ** If an error occurs, return NULL and leave a message in pParse.
2259 */
2260 Vdbe *sqlite3GetVdbe(Parse *pParse){
2261   if( pParse->pVdbe ){
2262     return pParse->pVdbe;
2263   }
2264   if( pParse->pToplevel==0
2265    && OptimizationEnabled(pParse->db,SQLITE_FactorOutConst)
2266   ){
2267     pParse->okConstFactor = 1;
2268   }
2269   return sqlite3VdbeCreate(pParse);
2270 }
2271 
2272 
2273 /*
2274 ** Compute the iLimit and iOffset fields of the SELECT based on the
2275 ** pLimit expressions.  pLimit->pLeft and pLimit->pRight hold the expressions
2276 ** that appear in the original SQL statement after the LIMIT and OFFSET
2277 ** keywords.  Or NULL if those keywords are omitted. iLimit and iOffset
2278 ** are the integer memory register numbers for counters used to compute
2279 ** the limit and offset.  If there is no limit and/or offset, then
2280 ** iLimit and iOffset are negative.
2281 **
2282 ** This routine changes the values of iLimit and iOffset only if
2283 ** a limit or offset is defined by pLimit->pLeft and pLimit->pRight.  iLimit
2284 ** and iOffset should have been preset to appropriate default values (zero)
2285 ** prior to calling this routine.
2286 **
2287 ** The iOffset register (if it exists) is initialized to the value
2288 ** of the OFFSET.  The iLimit register is initialized to LIMIT.  Register
2289 ** iOffset+1 is initialized to LIMIT+OFFSET.
2290 **
2291 ** Only if pLimit->pLeft!=0 do the limit registers get
2292 ** redefined.  The UNION ALL operator uses this property to force
2293 ** the reuse of the same limit and offset registers across multiple
2294 ** SELECT statements.
2295 */
2296 static void computeLimitRegisters(Parse *pParse, Select *p, int iBreak){
2297   Vdbe *v = 0;
2298   int iLimit = 0;
2299   int iOffset;
2300   int n;
2301   Expr *pLimit = p->pLimit;
2302 
2303   if( p->iLimit ) return;
2304 
2305   /*
2306   ** "LIMIT -1" always shows all rows.  There is some
2307   ** controversy about what the correct behavior should be.
2308   ** The current implementation interprets "LIMIT 0" to mean
2309   ** no rows.
2310   */
2311   if( pLimit ){
2312     assert( pLimit->op==TK_LIMIT );
2313     assert( pLimit->pLeft!=0 );
2314     p->iLimit = iLimit = ++pParse->nMem;
2315     v = sqlite3GetVdbe(pParse);
2316     assert( v!=0 );
2317     if( sqlite3ExprIsInteger(pLimit->pLeft, &n) ){
2318       sqlite3VdbeAddOp2(v, OP_Integer, n, iLimit);
2319       VdbeComment((v, "LIMIT counter"));
2320       if( n==0 ){
2321         sqlite3VdbeGoto(v, iBreak);
2322       }else if( n>=0 && p->nSelectRow>sqlite3LogEst((u64)n) ){
2323         p->nSelectRow = sqlite3LogEst((u64)n);
2324         p->selFlags |= SF_FixedLimit;
2325       }
2326     }else{
2327       sqlite3ExprCode(pParse, pLimit->pLeft, iLimit);
2328       sqlite3VdbeAddOp1(v, OP_MustBeInt, iLimit); VdbeCoverage(v);
2329       VdbeComment((v, "LIMIT counter"));
2330       sqlite3VdbeAddOp2(v, OP_IfNot, iLimit, iBreak); VdbeCoverage(v);
2331     }
2332     if( pLimit->pRight ){
2333       p->iOffset = iOffset = ++pParse->nMem;
2334       pParse->nMem++;   /* Allocate an extra register for limit+offset */
2335       sqlite3ExprCode(pParse, pLimit->pRight, iOffset);
2336       sqlite3VdbeAddOp1(v, OP_MustBeInt, iOffset); VdbeCoverage(v);
2337       VdbeComment((v, "OFFSET counter"));
2338       sqlite3VdbeAddOp3(v, OP_OffsetLimit, iLimit, iOffset+1, iOffset);
2339       VdbeComment((v, "LIMIT+OFFSET"));
2340     }
2341   }
2342 }
2343 
2344 #ifndef SQLITE_OMIT_COMPOUND_SELECT
2345 /*
2346 ** Return the appropriate collating sequence for the iCol-th column of
2347 ** the result set for the compound-select statement "p".  Return NULL if
2348 ** the column has no default collating sequence.
2349 **
2350 ** The collating sequence for the compound select is taken from the
2351 ** left-most term of the select that has a collating sequence.
2352 */
2353 static CollSeq *multiSelectCollSeq(Parse *pParse, Select *p, int iCol){
2354   CollSeq *pRet;
2355   if( p->pPrior ){
2356     pRet = multiSelectCollSeq(pParse, p->pPrior, iCol);
2357   }else{
2358     pRet = 0;
2359   }
2360   assert( iCol>=0 );
2361   /* iCol must be less than p->pEList->nExpr.  Otherwise an error would
2362   ** have been thrown during name resolution and we would not have gotten
2363   ** this far */
2364   if( pRet==0 && ALWAYS(iCol<p->pEList->nExpr) ){
2365     pRet = sqlite3ExprCollSeq(pParse, p->pEList->a[iCol].pExpr);
2366   }
2367   return pRet;
2368 }
2369 
2370 /*
2371 ** The select statement passed as the second parameter is a compound SELECT
2372 ** with an ORDER BY clause. This function allocates and returns a KeyInfo
2373 ** structure suitable for implementing the ORDER BY.
2374 **
2375 ** Space to hold the KeyInfo structure is obtained from malloc. The calling
2376 ** function is responsible for ensuring that this structure is eventually
2377 ** freed.
2378 */
2379 static KeyInfo *multiSelectOrderByKeyInfo(Parse *pParse, Select *p, int nExtra){
2380   ExprList *pOrderBy = p->pOrderBy;
2381   int nOrderBy = ALWAYS(pOrderBy!=0) ? pOrderBy->nExpr : 0;
2382   sqlite3 *db = pParse->db;
2383   KeyInfo *pRet = sqlite3KeyInfoAlloc(db, nOrderBy+nExtra, 1);
2384   if( pRet ){
2385     int i;
2386     for(i=0; i<nOrderBy; i++){
2387       struct ExprList_item *pItem = &pOrderBy->a[i];
2388       Expr *pTerm = pItem->pExpr;
2389       CollSeq *pColl;
2390 
2391       if( pTerm->flags & EP_Collate ){
2392         pColl = sqlite3ExprCollSeq(pParse, pTerm);
2393       }else{
2394         pColl = multiSelectCollSeq(pParse, p, pItem->u.x.iOrderByCol-1);
2395         if( pColl==0 ) pColl = db->pDfltColl;
2396         pOrderBy->a[i].pExpr =
2397           sqlite3ExprAddCollateString(pParse, pTerm, pColl->zName);
2398       }
2399       assert( sqlite3KeyInfoIsWriteable(pRet) );
2400       pRet->aColl[i] = pColl;
2401       pRet->aSortFlags[i] = pOrderBy->a[i].sortFlags;
2402     }
2403   }
2404 
2405   return pRet;
2406 }
2407 
2408 #ifndef SQLITE_OMIT_CTE
2409 /*
2410 ** This routine generates VDBE code to compute the content of a WITH RECURSIVE
2411 ** query of the form:
2412 **
2413 **   <recursive-table> AS (<setup-query> UNION [ALL] <recursive-query>)
2414 **                         \___________/             \_______________/
2415 **                           p->pPrior                      p
2416 **
2417 **
2418 ** There is exactly one reference to the recursive-table in the FROM clause
2419 ** of recursive-query, marked with the SrcList->a[].fg.isRecursive flag.
2420 **
2421 ** The setup-query runs once to generate an initial set of rows that go
2422 ** into a Queue table.  Rows are extracted from the Queue table one by
2423 ** one.  Each row extracted from Queue is output to pDest.  Then the single
2424 ** extracted row (now in the iCurrent table) becomes the content of the
2425 ** recursive-table for a recursive-query run.  The output of the recursive-query
2426 ** is added back into the Queue table.  Then another row is extracted from Queue
2427 ** and the iteration continues until the Queue table is empty.
2428 **
2429 ** If the compound query operator is UNION then no duplicate rows are ever
2430 ** inserted into the Queue table.  The iDistinct table keeps a copy of all rows
2431 ** that have ever been inserted into Queue and causes duplicates to be
2432 ** discarded.  If the operator is UNION ALL, then duplicates are allowed.
2433 **
2434 ** If the query has an ORDER BY, then entries in the Queue table are kept in
2435 ** ORDER BY order and the first entry is extracted for each cycle.  Without
2436 ** an ORDER BY, the Queue table is just a FIFO.
2437 **
2438 ** If a LIMIT clause is provided, then the iteration stops after LIMIT rows
2439 ** have been output to pDest.  A LIMIT of zero means to output no rows and a
2440 ** negative LIMIT means to output all rows.  If there is also an OFFSET clause
2441 ** with a positive value, then the first OFFSET outputs are discarded rather
2442 ** than being sent to pDest.  The LIMIT count does not begin until after OFFSET
2443 ** rows have been skipped.
2444 */
2445 static void generateWithRecursiveQuery(
2446   Parse *pParse,        /* Parsing context */
2447   Select *p,            /* The recursive SELECT to be coded */
2448   SelectDest *pDest     /* What to do with query results */
2449 ){
2450   SrcList *pSrc = p->pSrc;      /* The FROM clause of the recursive query */
2451   int nCol = p->pEList->nExpr;  /* Number of columns in the recursive table */
2452   Vdbe *v = pParse->pVdbe;      /* The prepared statement under construction */
2453   Select *pSetup;               /* The setup query */
2454   Select *pFirstRec;            /* Left-most recursive term */
2455   int addrTop;                  /* Top of the loop */
2456   int addrCont, addrBreak;      /* CONTINUE and BREAK addresses */
2457   int iCurrent = 0;             /* The Current table */
2458   int regCurrent;               /* Register holding Current table */
2459   int iQueue;                   /* The Queue table */
2460   int iDistinct = 0;            /* To ensure unique results if UNION */
2461   int eDest = SRT_Fifo;         /* How to write to Queue */
2462   SelectDest destQueue;         /* SelectDest targetting the Queue table */
2463   int i;                        /* Loop counter */
2464   int rc;                       /* Result code */
2465   ExprList *pOrderBy;           /* The ORDER BY clause */
2466   Expr *pLimit;                 /* Saved LIMIT and OFFSET */
2467   int regLimit, regOffset;      /* Registers used by LIMIT and OFFSET */
2468 
2469 #ifndef SQLITE_OMIT_WINDOWFUNC
2470   if( p->pWin ){
2471     sqlite3ErrorMsg(pParse, "cannot use window functions in recursive queries");
2472     return;
2473   }
2474 #endif
2475 
2476   /* Obtain authorization to do a recursive query */
2477   if( sqlite3AuthCheck(pParse, SQLITE_RECURSIVE, 0, 0, 0) ) return;
2478 
2479   /* Process the LIMIT and OFFSET clauses, if they exist */
2480   addrBreak = sqlite3VdbeMakeLabel(pParse);
2481   p->nSelectRow = 320;  /* 4 billion rows */
2482   computeLimitRegisters(pParse, p, addrBreak);
2483   pLimit = p->pLimit;
2484   regLimit = p->iLimit;
2485   regOffset = p->iOffset;
2486   p->pLimit = 0;
2487   p->iLimit = p->iOffset = 0;
2488   pOrderBy = p->pOrderBy;
2489 
2490   /* Locate the cursor number of the Current table */
2491   for(i=0; ALWAYS(i<pSrc->nSrc); i++){
2492     if( pSrc->a[i].fg.isRecursive ){
2493       iCurrent = pSrc->a[i].iCursor;
2494       break;
2495     }
2496   }
2497 
2498   /* Allocate cursors numbers for Queue and Distinct.  The cursor number for
2499   ** the Distinct table must be exactly one greater than Queue in order
2500   ** for the SRT_DistFifo and SRT_DistQueue destinations to work. */
2501   iQueue = pParse->nTab++;
2502   if( p->op==TK_UNION ){
2503     eDest = pOrderBy ? SRT_DistQueue : SRT_DistFifo;
2504     iDistinct = pParse->nTab++;
2505   }else{
2506     eDest = pOrderBy ? SRT_Queue : SRT_Fifo;
2507   }
2508   sqlite3SelectDestInit(&destQueue, eDest, iQueue);
2509 
2510   /* Allocate cursors for Current, Queue, and Distinct. */
2511   regCurrent = ++pParse->nMem;
2512   sqlite3VdbeAddOp3(v, OP_OpenPseudo, iCurrent, regCurrent, nCol);
2513   if( pOrderBy ){
2514     KeyInfo *pKeyInfo = multiSelectOrderByKeyInfo(pParse, p, 1);
2515     sqlite3VdbeAddOp4(v, OP_OpenEphemeral, iQueue, pOrderBy->nExpr+2, 0,
2516                       (char*)pKeyInfo, P4_KEYINFO);
2517     destQueue.pOrderBy = pOrderBy;
2518   }else{
2519     sqlite3VdbeAddOp2(v, OP_OpenEphemeral, iQueue, nCol);
2520   }
2521   VdbeComment((v, "Queue table"));
2522   if( iDistinct ){
2523     p->addrOpenEphm[0] = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, iDistinct, 0);
2524     p->selFlags |= SF_UsesEphemeral;
2525   }
2526 
2527   /* Detach the ORDER BY clause from the compound SELECT */
2528   p->pOrderBy = 0;
2529 
2530   /* Figure out how many elements of the compound SELECT are part of the
2531   ** recursive query.  Make sure no recursive elements use aggregate
2532   ** functions.  Mark the recursive elements as UNION ALL even if they
2533   ** are really UNION because the distinctness will be enforced by the
2534   ** iDistinct table.  pFirstRec is left pointing to the left-most
2535   ** recursive term of the CTE.
2536   */
2537   for(pFirstRec=p; ALWAYS(pFirstRec!=0); pFirstRec=pFirstRec->pPrior){
2538     if( pFirstRec->selFlags & SF_Aggregate ){
2539       sqlite3ErrorMsg(pParse, "recursive aggregate queries not supported");
2540       goto end_of_recursive_query;
2541     }
2542     pFirstRec->op = TK_ALL;
2543     if( (pFirstRec->pPrior->selFlags & SF_Recursive)==0 ) break;
2544   }
2545 
2546   /* Store the results of the setup-query in Queue. */
2547   pSetup = pFirstRec->pPrior;
2548   pSetup->pNext = 0;
2549   ExplainQueryPlan((pParse, 1, "SETUP"));
2550   rc = sqlite3Select(pParse, pSetup, &destQueue);
2551   pSetup->pNext = p;
2552   if( rc ) goto end_of_recursive_query;
2553 
2554   /* Find the next row in the Queue and output that row */
2555   addrTop = sqlite3VdbeAddOp2(v, OP_Rewind, iQueue, addrBreak); VdbeCoverage(v);
2556 
2557   /* Transfer the next row in Queue over to Current */
2558   sqlite3VdbeAddOp1(v, OP_NullRow, iCurrent); /* To reset column cache */
2559   if( pOrderBy ){
2560     sqlite3VdbeAddOp3(v, OP_Column, iQueue, pOrderBy->nExpr+1, regCurrent);
2561   }else{
2562     sqlite3VdbeAddOp2(v, OP_RowData, iQueue, regCurrent);
2563   }
2564   sqlite3VdbeAddOp1(v, OP_Delete, iQueue);
2565 
2566   /* Output the single row in Current */
2567   addrCont = sqlite3VdbeMakeLabel(pParse);
2568   codeOffset(v, regOffset, addrCont);
2569   selectInnerLoop(pParse, p, iCurrent,
2570       0, 0, pDest, addrCont, addrBreak);
2571   if( regLimit ){
2572     sqlite3VdbeAddOp2(v, OP_DecrJumpZero, regLimit, addrBreak);
2573     VdbeCoverage(v);
2574   }
2575   sqlite3VdbeResolveLabel(v, addrCont);
2576 
2577   /* Execute the recursive SELECT taking the single row in Current as
2578   ** the value for the recursive-table. Store the results in the Queue.
2579   */
2580   pFirstRec->pPrior = 0;
2581   ExplainQueryPlan((pParse, 1, "RECURSIVE STEP"));
2582   sqlite3Select(pParse, p, &destQueue);
2583   assert( pFirstRec->pPrior==0 );
2584   pFirstRec->pPrior = pSetup;
2585 
2586   /* Keep running the loop until the Queue is empty */
2587   sqlite3VdbeGoto(v, addrTop);
2588   sqlite3VdbeResolveLabel(v, addrBreak);
2589 
2590 end_of_recursive_query:
2591   sqlite3ExprListDelete(pParse->db, p->pOrderBy);
2592   p->pOrderBy = pOrderBy;
2593   p->pLimit = pLimit;
2594   return;
2595 }
2596 #endif /* SQLITE_OMIT_CTE */
2597 
2598 /* Forward references */
2599 static int multiSelectOrderBy(
2600   Parse *pParse,        /* Parsing context */
2601   Select *p,            /* The right-most of SELECTs to be coded */
2602   SelectDest *pDest     /* What to do with query results */
2603 );
2604 
2605 /*
2606 ** Handle the special case of a compound-select that originates from a
2607 ** VALUES clause.  By handling this as a special case, we avoid deep
2608 ** recursion, and thus do not need to enforce the SQLITE_LIMIT_COMPOUND_SELECT
2609 ** on a VALUES clause.
2610 **
2611 ** Because the Select object originates from a VALUES clause:
2612 **   (1) There is no LIMIT or OFFSET or else there is a LIMIT of exactly 1
2613 **   (2) All terms are UNION ALL
2614 **   (3) There is no ORDER BY clause
2615 **
2616 ** The "LIMIT of exactly 1" case of condition (1) comes about when a VALUES
2617 ** clause occurs within scalar expression (ex: "SELECT (VALUES(1),(2),(3))").
2618 ** The sqlite3CodeSubselect will have added the LIMIT 1 clause in tht case.
2619 ** Since the limit is exactly 1, we only need to evaluate the left-most VALUES.
2620 */
2621 static int multiSelectValues(
2622   Parse *pParse,        /* Parsing context */
2623   Select *p,            /* The right-most of SELECTs to be coded */
2624   SelectDest *pDest     /* What to do with query results */
2625 ){
2626   int nRow = 1;
2627   int rc = 0;
2628   int bShowAll = p->pLimit==0;
2629   assert( p->selFlags & SF_MultiValue );
2630   do{
2631     assert( p->selFlags & SF_Values );
2632     assert( p->op==TK_ALL || (p->op==TK_SELECT && p->pPrior==0) );
2633     assert( p->pNext==0 || p->pEList->nExpr==p->pNext->pEList->nExpr );
2634 #ifndef SQLITE_OMIT_WINDOWFUNC
2635     if( p->pWin ) return -1;
2636 #endif
2637     if( p->pPrior==0 ) break;
2638     assert( p->pPrior->pNext==p );
2639     p = p->pPrior;
2640     nRow += bShowAll;
2641   }while(1);
2642   ExplainQueryPlan((pParse, 0, "SCAN %d CONSTANT ROW%s", nRow,
2643                     nRow==1 ? "" : "S"));
2644   while( p ){
2645     selectInnerLoop(pParse, p, -1, 0, 0, pDest, 1, 1);
2646     if( !bShowAll ) break;
2647     p->nSelectRow = nRow;
2648     p = p->pNext;
2649   }
2650   return rc;
2651 }
2652 
2653 /*
2654 ** Return true if the SELECT statement which is known to be the recursive
2655 ** part of a recursive CTE still has its anchor terms attached.  If the
2656 ** anchor terms have already been removed, then return false.
2657 */
2658 static int hasAnchor(Select *p){
2659   while( p && (p->selFlags & SF_Recursive)!=0 ){ p = p->pPrior; }
2660   return p!=0;
2661 }
2662 
2663 /*
2664 ** This routine is called to process a compound query form from
2665 ** two or more separate queries using UNION, UNION ALL, EXCEPT, or
2666 ** INTERSECT
2667 **
2668 ** "p" points to the right-most of the two queries.  the query on the
2669 ** left is p->pPrior.  The left query could also be a compound query
2670 ** in which case this routine will be called recursively.
2671 **
2672 ** The results of the total query are to be written into a destination
2673 ** of type eDest with parameter iParm.
2674 **
2675 ** Example 1:  Consider a three-way compound SQL statement.
2676 **
2677 **     SELECT a FROM t1 UNION SELECT b FROM t2 UNION SELECT c FROM t3
2678 **
2679 ** This statement is parsed up as follows:
2680 **
2681 **     SELECT c FROM t3
2682 **      |
2683 **      `----->  SELECT b FROM t2
2684 **                |
2685 **                `------>  SELECT a FROM t1
2686 **
2687 ** The arrows in the diagram above represent the Select.pPrior pointer.
2688 ** So if this routine is called with p equal to the t3 query, then
2689 ** pPrior will be the t2 query.  p->op will be TK_UNION in this case.
2690 **
2691 ** Notice that because of the way SQLite parses compound SELECTs, the
2692 ** individual selects always group from left to right.
2693 */
2694 static int multiSelect(
2695   Parse *pParse,        /* Parsing context */
2696   Select *p,            /* The right-most of SELECTs to be coded */
2697   SelectDest *pDest     /* What to do with query results */
2698 ){
2699   int rc = SQLITE_OK;   /* Success code from a subroutine */
2700   Select *pPrior;       /* Another SELECT immediately to our left */
2701   Vdbe *v;              /* Generate code to this VDBE */
2702   SelectDest dest;      /* Alternative data destination */
2703   Select *pDelete = 0;  /* Chain of simple selects to delete */
2704   sqlite3 *db;          /* Database connection */
2705 
2706   /* Make sure there is no ORDER BY or LIMIT clause on prior SELECTs.  Only
2707   ** the last (right-most) SELECT in the series may have an ORDER BY or LIMIT.
2708   */
2709   assert( p && p->pPrior );  /* Calling function guarantees this much */
2710   assert( (p->selFlags & SF_Recursive)==0 || p->op==TK_ALL || p->op==TK_UNION );
2711   assert( p->selFlags & SF_Compound );
2712   db = pParse->db;
2713   pPrior = p->pPrior;
2714   dest = *pDest;
2715   assert( pPrior->pOrderBy==0 );
2716   assert( pPrior->pLimit==0 );
2717 
2718   v = sqlite3GetVdbe(pParse);
2719   assert( v!=0 );  /* The VDBE already created by calling function */
2720 
2721   /* Create the destination temporary table if necessary
2722   */
2723   if( dest.eDest==SRT_EphemTab ){
2724     assert( p->pEList );
2725     sqlite3VdbeAddOp2(v, OP_OpenEphemeral, dest.iSDParm, p->pEList->nExpr);
2726     dest.eDest = SRT_Table;
2727   }
2728 
2729   /* Special handling for a compound-select that originates as a VALUES clause.
2730   */
2731   if( p->selFlags & SF_MultiValue ){
2732     rc = multiSelectValues(pParse, p, &dest);
2733     if( rc>=0 ) goto multi_select_end;
2734     rc = SQLITE_OK;
2735   }
2736 
2737   /* Make sure all SELECTs in the statement have the same number of elements
2738   ** in their result sets.
2739   */
2740   assert( p->pEList && pPrior->pEList );
2741   assert( p->pEList->nExpr==pPrior->pEList->nExpr );
2742 
2743 #ifndef SQLITE_OMIT_CTE
2744   if( (p->selFlags & SF_Recursive)!=0 && hasAnchor(p) ){
2745     generateWithRecursiveQuery(pParse, p, &dest);
2746   }else
2747 #endif
2748 
2749   /* Compound SELECTs that have an ORDER BY clause are handled separately.
2750   */
2751   if( p->pOrderBy ){
2752     return multiSelectOrderBy(pParse, p, pDest);
2753   }else{
2754 
2755 #ifndef SQLITE_OMIT_EXPLAIN
2756     if( pPrior->pPrior==0 ){
2757       ExplainQueryPlan((pParse, 1, "COMPOUND QUERY"));
2758       ExplainQueryPlan((pParse, 1, "LEFT-MOST SUBQUERY"));
2759     }
2760 #endif
2761 
2762     /* Generate code for the left and right SELECT statements.
2763     */
2764     switch( p->op ){
2765       case TK_ALL: {
2766         int addr = 0;
2767         int nLimit = 0;  /* Initialize to suppress harmless compiler warning */
2768         assert( !pPrior->pLimit );
2769         pPrior->iLimit = p->iLimit;
2770         pPrior->iOffset = p->iOffset;
2771         pPrior->pLimit = p->pLimit;
2772         SELECTTRACE(1, pParse, p, ("multiSelect UNION ALL left...\n"));
2773         rc = sqlite3Select(pParse, pPrior, &dest);
2774         pPrior->pLimit = 0;
2775         if( rc ){
2776           goto multi_select_end;
2777         }
2778         p->pPrior = 0;
2779         p->iLimit = pPrior->iLimit;
2780         p->iOffset = pPrior->iOffset;
2781         if( p->iLimit ){
2782           addr = sqlite3VdbeAddOp1(v, OP_IfNot, p->iLimit); VdbeCoverage(v);
2783           VdbeComment((v, "Jump ahead if LIMIT reached"));
2784           if( p->iOffset ){
2785             sqlite3VdbeAddOp3(v, OP_OffsetLimit,
2786                               p->iLimit, p->iOffset+1, p->iOffset);
2787           }
2788         }
2789         ExplainQueryPlan((pParse, 1, "UNION ALL"));
2790         SELECTTRACE(1, pParse, p, ("multiSelect UNION ALL right...\n"));
2791         rc = sqlite3Select(pParse, p, &dest);
2792         testcase( rc!=SQLITE_OK );
2793         pDelete = p->pPrior;
2794         p->pPrior = pPrior;
2795         p->nSelectRow = sqlite3LogEstAdd(p->nSelectRow, pPrior->nSelectRow);
2796         if( p->pLimit
2797          && sqlite3ExprIsInteger(p->pLimit->pLeft, &nLimit)
2798          && nLimit>0 && p->nSelectRow > sqlite3LogEst((u64)nLimit)
2799         ){
2800           p->nSelectRow = sqlite3LogEst((u64)nLimit);
2801         }
2802         if( addr ){
2803           sqlite3VdbeJumpHere(v, addr);
2804         }
2805         break;
2806       }
2807       case TK_EXCEPT:
2808       case TK_UNION: {
2809         int unionTab;    /* Cursor number of the temp table holding result */
2810         u8 op = 0;       /* One of the SRT_ operations to apply to self */
2811         int priorOp;     /* The SRT_ operation to apply to prior selects */
2812         Expr *pLimit;    /* Saved values of p->nLimit  */
2813         int addr;
2814         SelectDest uniondest;
2815 
2816         testcase( p->op==TK_EXCEPT );
2817         testcase( p->op==TK_UNION );
2818         priorOp = SRT_Union;
2819         if( dest.eDest==priorOp ){
2820           /* We can reuse a temporary table generated by a SELECT to our
2821           ** right.
2822           */
2823           assert( p->pLimit==0 );      /* Not allowed on leftward elements */
2824           unionTab = dest.iSDParm;
2825         }else{
2826           /* We will need to create our own temporary table to hold the
2827           ** intermediate results.
2828           */
2829           unionTab = pParse->nTab++;
2830           assert( p->pOrderBy==0 );
2831           addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, unionTab, 0);
2832           assert( p->addrOpenEphm[0] == -1 );
2833           p->addrOpenEphm[0] = addr;
2834           findRightmost(p)->selFlags |= SF_UsesEphemeral;
2835           assert( p->pEList );
2836         }
2837 
2838 
2839         /* Code the SELECT statements to our left
2840         */
2841         assert( !pPrior->pOrderBy );
2842         sqlite3SelectDestInit(&uniondest, priorOp, unionTab);
2843         SELECTTRACE(1, pParse, p, ("multiSelect EXCEPT/UNION left...\n"));
2844         rc = sqlite3Select(pParse, pPrior, &uniondest);
2845         if( rc ){
2846           goto multi_select_end;
2847         }
2848 
2849         /* Code the current SELECT statement
2850         */
2851         if( p->op==TK_EXCEPT ){
2852           op = SRT_Except;
2853         }else{
2854           assert( p->op==TK_UNION );
2855           op = SRT_Union;
2856         }
2857         p->pPrior = 0;
2858         pLimit = p->pLimit;
2859         p->pLimit = 0;
2860         uniondest.eDest = op;
2861         ExplainQueryPlan((pParse, 1, "%s USING TEMP B-TREE",
2862                           sqlite3SelectOpName(p->op)));
2863         SELECTTRACE(1, pParse, p, ("multiSelect EXCEPT/UNION right...\n"));
2864         rc = sqlite3Select(pParse, p, &uniondest);
2865         testcase( rc!=SQLITE_OK );
2866         assert( p->pOrderBy==0 );
2867         pDelete = p->pPrior;
2868         p->pPrior = pPrior;
2869         p->pOrderBy = 0;
2870         if( p->op==TK_UNION ){
2871           p->nSelectRow = sqlite3LogEstAdd(p->nSelectRow, pPrior->nSelectRow);
2872         }
2873         sqlite3ExprDelete(db, p->pLimit);
2874         p->pLimit = pLimit;
2875         p->iLimit = 0;
2876         p->iOffset = 0;
2877 
2878         /* Convert the data in the temporary table into whatever form
2879         ** it is that we currently need.
2880         */
2881         assert( unionTab==dest.iSDParm || dest.eDest!=priorOp );
2882         assert( p->pEList || db->mallocFailed );
2883         if( dest.eDest!=priorOp && db->mallocFailed==0 ){
2884           int iCont, iBreak, iStart;
2885           iBreak = sqlite3VdbeMakeLabel(pParse);
2886           iCont = sqlite3VdbeMakeLabel(pParse);
2887           computeLimitRegisters(pParse, p, iBreak);
2888           sqlite3VdbeAddOp2(v, OP_Rewind, unionTab, iBreak); VdbeCoverage(v);
2889           iStart = sqlite3VdbeCurrentAddr(v);
2890           selectInnerLoop(pParse, p, unionTab,
2891                           0, 0, &dest, iCont, iBreak);
2892           sqlite3VdbeResolveLabel(v, iCont);
2893           sqlite3VdbeAddOp2(v, OP_Next, unionTab, iStart); VdbeCoverage(v);
2894           sqlite3VdbeResolveLabel(v, iBreak);
2895           sqlite3VdbeAddOp2(v, OP_Close, unionTab, 0);
2896         }
2897         break;
2898       }
2899       default: assert( p->op==TK_INTERSECT ); {
2900         int tab1, tab2;
2901         int iCont, iBreak, iStart;
2902         Expr *pLimit;
2903         int addr;
2904         SelectDest intersectdest;
2905         int r1;
2906 
2907         /* INTERSECT is different from the others since it requires
2908         ** two temporary tables.  Hence it has its own case.  Begin
2909         ** by allocating the tables we will need.
2910         */
2911         tab1 = pParse->nTab++;
2912         tab2 = pParse->nTab++;
2913         assert( p->pOrderBy==0 );
2914 
2915         addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, tab1, 0);
2916         assert( p->addrOpenEphm[0] == -1 );
2917         p->addrOpenEphm[0] = addr;
2918         findRightmost(p)->selFlags |= SF_UsesEphemeral;
2919         assert( p->pEList );
2920 
2921         /* Code the SELECTs to our left into temporary table "tab1".
2922         */
2923         sqlite3SelectDestInit(&intersectdest, SRT_Union, tab1);
2924         SELECTTRACE(1, pParse, p, ("multiSelect INTERSECT left...\n"));
2925         rc = sqlite3Select(pParse, pPrior, &intersectdest);
2926         if( rc ){
2927           goto multi_select_end;
2928         }
2929 
2930         /* Code the current SELECT into temporary table "tab2"
2931         */
2932         addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, tab2, 0);
2933         assert( p->addrOpenEphm[1] == -1 );
2934         p->addrOpenEphm[1] = addr;
2935         p->pPrior = 0;
2936         pLimit = p->pLimit;
2937         p->pLimit = 0;
2938         intersectdest.iSDParm = tab2;
2939         ExplainQueryPlan((pParse, 1, "%s USING TEMP B-TREE",
2940                           sqlite3SelectOpName(p->op)));
2941         SELECTTRACE(1, pParse, p, ("multiSelect INTERSECT right...\n"));
2942         rc = sqlite3Select(pParse, p, &intersectdest);
2943         testcase( rc!=SQLITE_OK );
2944         pDelete = p->pPrior;
2945         p->pPrior = pPrior;
2946         if( p->nSelectRow>pPrior->nSelectRow ){
2947           p->nSelectRow = pPrior->nSelectRow;
2948         }
2949         sqlite3ExprDelete(db, p->pLimit);
2950         p->pLimit = pLimit;
2951 
2952         /* Generate code to take the intersection of the two temporary
2953         ** tables.
2954         */
2955         if( rc ) break;
2956         assert( p->pEList );
2957         iBreak = sqlite3VdbeMakeLabel(pParse);
2958         iCont = sqlite3VdbeMakeLabel(pParse);
2959         computeLimitRegisters(pParse, p, iBreak);
2960         sqlite3VdbeAddOp2(v, OP_Rewind, tab1, iBreak); VdbeCoverage(v);
2961         r1 = sqlite3GetTempReg(pParse);
2962         iStart = sqlite3VdbeAddOp2(v, OP_RowData, tab1, r1);
2963         sqlite3VdbeAddOp4Int(v, OP_NotFound, tab2, iCont, r1, 0);
2964         VdbeCoverage(v);
2965         sqlite3ReleaseTempReg(pParse, r1);
2966         selectInnerLoop(pParse, p, tab1,
2967                         0, 0, &dest, iCont, iBreak);
2968         sqlite3VdbeResolveLabel(v, iCont);
2969         sqlite3VdbeAddOp2(v, OP_Next, tab1, iStart); VdbeCoverage(v);
2970         sqlite3VdbeResolveLabel(v, iBreak);
2971         sqlite3VdbeAddOp2(v, OP_Close, tab2, 0);
2972         sqlite3VdbeAddOp2(v, OP_Close, tab1, 0);
2973         break;
2974       }
2975     }
2976 
2977   #ifndef SQLITE_OMIT_EXPLAIN
2978     if( p->pNext==0 ){
2979       ExplainQueryPlanPop(pParse);
2980     }
2981   #endif
2982   }
2983   if( pParse->nErr ) goto multi_select_end;
2984 
2985   /* Compute collating sequences used by
2986   ** temporary tables needed to implement the compound select.
2987   ** Attach the KeyInfo structure to all temporary tables.
2988   **
2989   ** This section is run by the right-most SELECT statement only.
2990   ** SELECT statements to the left always skip this part.  The right-most
2991   ** SELECT might also skip this part if it has no ORDER BY clause and
2992   ** no temp tables are required.
2993   */
2994   if( p->selFlags & SF_UsesEphemeral ){
2995     int i;                        /* Loop counter */
2996     KeyInfo *pKeyInfo;            /* Collating sequence for the result set */
2997     Select *pLoop;                /* For looping through SELECT statements */
2998     CollSeq **apColl;             /* For looping through pKeyInfo->aColl[] */
2999     int nCol;                     /* Number of columns in result set */
3000 
3001     assert( p->pNext==0 );
3002     assert( p->pEList!=0 );
3003     nCol = p->pEList->nExpr;
3004     pKeyInfo = sqlite3KeyInfoAlloc(db, nCol, 1);
3005     if( !pKeyInfo ){
3006       rc = SQLITE_NOMEM_BKPT;
3007       goto multi_select_end;
3008     }
3009     for(i=0, apColl=pKeyInfo->aColl; i<nCol; i++, apColl++){
3010       *apColl = multiSelectCollSeq(pParse, p, i);
3011       if( 0==*apColl ){
3012         *apColl = db->pDfltColl;
3013       }
3014     }
3015 
3016     for(pLoop=p; pLoop; pLoop=pLoop->pPrior){
3017       for(i=0; i<2; i++){
3018         int addr = pLoop->addrOpenEphm[i];
3019         if( addr<0 ){
3020           /* If [0] is unused then [1] is also unused.  So we can
3021           ** always safely abort as soon as the first unused slot is found */
3022           assert( pLoop->addrOpenEphm[1]<0 );
3023           break;
3024         }
3025         sqlite3VdbeChangeP2(v, addr, nCol);
3026         sqlite3VdbeChangeP4(v, addr, (char*)sqlite3KeyInfoRef(pKeyInfo),
3027                             P4_KEYINFO);
3028         pLoop->addrOpenEphm[i] = -1;
3029       }
3030     }
3031     sqlite3KeyInfoUnref(pKeyInfo);
3032   }
3033 
3034 multi_select_end:
3035   pDest->iSdst = dest.iSdst;
3036   pDest->nSdst = dest.nSdst;
3037   if( pDelete ){
3038     sqlite3ParserAddCleanup(pParse,
3039         (void(*)(sqlite3*,void*))sqlite3SelectDelete,
3040         pDelete);
3041   }
3042   return rc;
3043 }
3044 #endif /* SQLITE_OMIT_COMPOUND_SELECT */
3045 
3046 /*
3047 ** Error message for when two or more terms of a compound select have different
3048 ** size result sets.
3049 */
3050 void sqlite3SelectWrongNumTermsError(Parse *pParse, Select *p){
3051   if( p->selFlags & SF_Values ){
3052     sqlite3ErrorMsg(pParse, "all VALUES must have the same number of terms");
3053   }else{
3054     sqlite3ErrorMsg(pParse, "SELECTs to the left and right of %s"
3055       " do not have the same number of result columns",
3056       sqlite3SelectOpName(p->op));
3057   }
3058 }
3059 
3060 /*
3061 ** Code an output subroutine for a coroutine implementation of a
3062 ** SELECT statment.
3063 **
3064 ** The data to be output is contained in pIn->iSdst.  There are
3065 ** pIn->nSdst columns to be output.  pDest is where the output should
3066 ** be sent.
3067 **
3068 ** regReturn is the number of the register holding the subroutine
3069 ** return address.
3070 **
3071 ** If regPrev>0 then it is the first register in a vector that
3072 ** records the previous output.  mem[regPrev] is a flag that is false
3073 ** if there has been no previous output.  If regPrev>0 then code is
3074 ** generated to suppress duplicates.  pKeyInfo is used for comparing
3075 ** keys.
3076 **
3077 ** If the LIMIT found in p->iLimit is reached, jump immediately to
3078 ** iBreak.
3079 */
3080 static int generateOutputSubroutine(
3081   Parse *pParse,          /* Parsing context */
3082   Select *p,              /* The SELECT statement */
3083   SelectDest *pIn,        /* Coroutine supplying data */
3084   SelectDest *pDest,      /* Where to send the data */
3085   int regReturn,          /* The return address register */
3086   int regPrev,            /* Previous result register.  No uniqueness if 0 */
3087   KeyInfo *pKeyInfo,      /* For comparing with previous entry */
3088   int iBreak              /* Jump here if we hit the LIMIT */
3089 ){
3090   Vdbe *v = pParse->pVdbe;
3091   int iContinue;
3092   int addr;
3093 
3094   addr = sqlite3VdbeCurrentAddr(v);
3095   iContinue = sqlite3VdbeMakeLabel(pParse);
3096 
3097   /* Suppress duplicates for UNION, EXCEPT, and INTERSECT
3098   */
3099   if( regPrev ){
3100     int addr1, addr2;
3101     addr1 = sqlite3VdbeAddOp1(v, OP_IfNot, regPrev); VdbeCoverage(v);
3102     addr2 = sqlite3VdbeAddOp4(v, OP_Compare, pIn->iSdst, regPrev+1, pIn->nSdst,
3103                               (char*)sqlite3KeyInfoRef(pKeyInfo), P4_KEYINFO);
3104     sqlite3VdbeAddOp3(v, OP_Jump, addr2+2, iContinue, addr2+2); VdbeCoverage(v);
3105     sqlite3VdbeJumpHere(v, addr1);
3106     sqlite3VdbeAddOp3(v, OP_Copy, pIn->iSdst, regPrev+1, pIn->nSdst-1);
3107     sqlite3VdbeAddOp2(v, OP_Integer, 1, regPrev);
3108   }
3109   if( pParse->db->mallocFailed ) return 0;
3110 
3111   /* Suppress the first OFFSET entries if there is an OFFSET clause
3112   */
3113   codeOffset(v, p->iOffset, iContinue);
3114 
3115   assert( pDest->eDest!=SRT_Exists );
3116   assert( pDest->eDest!=SRT_Table );
3117   switch( pDest->eDest ){
3118     /* Store the result as data using a unique key.
3119     */
3120     case SRT_EphemTab: {
3121       int r1 = sqlite3GetTempReg(pParse);
3122       int r2 = sqlite3GetTempReg(pParse);
3123       sqlite3VdbeAddOp3(v, OP_MakeRecord, pIn->iSdst, pIn->nSdst, r1);
3124       sqlite3VdbeAddOp2(v, OP_NewRowid, pDest->iSDParm, r2);
3125       sqlite3VdbeAddOp3(v, OP_Insert, pDest->iSDParm, r1, r2);
3126       sqlite3VdbeChangeP5(v, OPFLAG_APPEND);
3127       sqlite3ReleaseTempReg(pParse, r2);
3128       sqlite3ReleaseTempReg(pParse, r1);
3129       break;
3130     }
3131 
3132 #ifndef SQLITE_OMIT_SUBQUERY
3133     /* If we are creating a set for an "expr IN (SELECT ...)".
3134     */
3135     case SRT_Set: {
3136       int r1;
3137       testcase( pIn->nSdst>1 );
3138       r1 = sqlite3GetTempReg(pParse);
3139       sqlite3VdbeAddOp4(v, OP_MakeRecord, pIn->iSdst, pIn->nSdst,
3140           r1, pDest->zAffSdst, pIn->nSdst);
3141       sqlite3VdbeAddOp4Int(v, OP_IdxInsert, pDest->iSDParm, r1,
3142                            pIn->iSdst, pIn->nSdst);
3143       sqlite3ReleaseTempReg(pParse, r1);
3144       break;
3145     }
3146 
3147     /* If this is a scalar select that is part of an expression, then
3148     ** store the results in the appropriate memory cell and break out
3149     ** of the scan loop.  Note that the select might return multiple columns
3150     ** if it is the RHS of a row-value IN operator.
3151     */
3152     case SRT_Mem: {
3153       testcase( pIn->nSdst>1 );
3154       sqlite3ExprCodeMove(pParse, pIn->iSdst, pDest->iSDParm, pIn->nSdst);
3155       /* The LIMIT clause will jump out of the loop for us */
3156       break;
3157     }
3158 #endif /* #ifndef SQLITE_OMIT_SUBQUERY */
3159 
3160     /* The results are stored in a sequence of registers
3161     ** starting at pDest->iSdst.  Then the co-routine yields.
3162     */
3163     case SRT_Coroutine: {
3164       if( pDest->iSdst==0 ){
3165         pDest->iSdst = sqlite3GetTempRange(pParse, pIn->nSdst);
3166         pDest->nSdst = pIn->nSdst;
3167       }
3168       sqlite3ExprCodeMove(pParse, pIn->iSdst, pDest->iSdst, pIn->nSdst);
3169       sqlite3VdbeAddOp1(v, OP_Yield, pDest->iSDParm);
3170       break;
3171     }
3172 
3173     /* If none of the above, then the result destination must be
3174     ** SRT_Output.  This routine is never called with any other
3175     ** destination other than the ones handled above or SRT_Output.
3176     **
3177     ** For SRT_Output, results are stored in a sequence of registers.
3178     ** Then the OP_ResultRow opcode is used to cause sqlite3_step() to
3179     ** return the next row of result.
3180     */
3181     default: {
3182       assert( pDest->eDest==SRT_Output );
3183       sqlite3VdbeAddOp2(v, OP_ResultRow, pIn->iSdst, pIn->nSdst);
3184       break;
3185     }
3186   }
3187 
3188   /* Jump to the end of the loop if the LIMIT is reached.
3189   */
3190   if( p->iLimit ){
3191     sqlite3VdbeAddOp2(v, OP_DecrJumpZero, p->iLimit, iBreak); VdbeCoverage(v);
3192   }
3193 
3194   /* Generate the subroutine return
3195   */
3196   sqlite3VdbeResolveLabel(v, iContinue);
3197   sqlite3VdbeAddOp1(v, OP_Return, regReturn);
3198 
3199   return addr;
3200 }
3201 
3202 /*
3203 ** Alternative compound select code generator for cases when there
3204 ** is an ORDER BY clause.
3205 **
3206 ** We assume a query of the following form:
3207 **
3208 **      <selectA>  <operator>  <selectB>  ORDER BY <orderbylist>
3209 **
3210 ** <operator> is one of UNION ALL, UNION, EXCEPT, or INTERSECT.  The idea
3211 ** is to code both <selectA> and <selectB> with the ORDER BY clause as
3212 ** co-routines.  Then run the co-routines in parallel and merge the results
3213 ** into the output.  In addition to the two coroutines (called selectA and
3214 ** selectB) there are 7 subroutines:
3215 **
3216 **    outA:    Move the output of the selectA coroutine into the output
3217 **             of the compound query.
3218 **
3219 **    outB:    Move the output of the selectB coroutine into the output
3220 **             of the compound query.  (Only generated for UNION and
3221 **             UNION ALL.  EXCEPT and INSERTSECT never output a row that
3222 **             appears only in B.)
3223 **
3224 **    AltB:    Called when there is data from both coroutines and A<B.
3225 **
3226 **    AeqB:    Called when there is data from both coroutines and A==B.
3227 **
3228 **    AgtB:    Called when there is data from both coroutines and A>B.
3229 **
3230 **    EofA:    Called when data is exhausted from selectA.
3231 **
3232 **    EofB:    Called when data is exhausted from selectB.
3233 **
3234 ** The implementation of the latter five subroutines depend on which
3235 ** <operator> is used:
3236 **
3237 **
3238 **             UNION ALL         UNION            EXCEPT          INTERSECT
3239 **          -------------  -----------------  --------------  -----------------
3240 **   AltB:   outA, nextA      outA, nextA       outA, nextA         nextA
3241 **
3242 **   AeqB:   outA, nextA         nextA             nextA         outA, nextA
3243 **
3244 **   AgtB:   outB, nextB      outB, nextB          nextB            nextB
3245 **
3246 **   EofA:   outB, nextB      outB, nextB          halt             halt
3247 **
3248 **   EofB:   outA, nextA      outA, nextA       outA, nextA         halt
3249 **
3250 ** In the AltB, AeqB, and AgtB subroutines, an EOF on A following nextA
3251 ** causes an immediate jump to EofA and an EOF on B following nextB causes
3252 ** an immediate jump to EofB.  Within EofA and EofB, and EOF on entry or
3253 ** following nextX causes a jump to the end of the select processing.
3254 **
3255 ** Duplicate removal in the UNION, EXCEPT, and INTERSECT cases is handled
3256 ** within the output subroutine.  The regPrev register set holds the previously
3257 ** output value.  A comparison is made against this value and the output
3258 ** is skipped if the next results would be the same as the previous.
3259 **
3260 ** The implementation plan is to implement the two coroutines and seven
3261 ** subroutines first, then put the control logic at the bottom.  Like this:
3262 **
3263 **          goto Init
3264 **     coA: coroutine for left query (A)
3265 **     coB: coroutine for right query (B)
3266 **    outA: output one row of A
3267 **    outB: output one row of B (UNION and UNION ALL only)
3268 **    EofA: ...
3269 **    EofB: ...
3270 **    AltB: ...
3271 **    AeqB: ...
3272 **    AgtB: ...
3273 **    Init: initialize coroutine registers
3274 **          yield coA
3275 **          if eof(A) goto EofA
3276 **          yield coB
3277 **          if eof(B) goto EofB
3278 **    Cmpr: Compare A, B
3279 **          Jump AltB, AeqB, AgtB
3280 **     End: ...
3281 **
3282 ** We call AltB, AeqB, AgtB, EofA, and EofB "subroutines" but they are not
3283 ** actually called using Gosub and they do not Return.  EofA and EofB loop
3284 ** until all data is exhausted then jump to the "end" labe.  AltB, AeqB,
3285 ** and AgtB jump to either L2 or to one of EofA or EofB.
3286 */
3287 #ifndef SQLITE_OMIT_COMPOUND_SELECT
3288 static int multiSelectOrderBy(
3289   Parse *pParse,        /* Parsing context */
3290   Select *p,            /* The right-most of SELECTs to be coded */
3291   SelectDest *pDest     /* What to do with query results */
3292 ){
3293   int i, j;             /* Loop counters */
3294   Select *pPrior;       /* Another SELECT immediately to our left */
3295   Select *pSplit;       /* Left-most SELECT in the right-hand group */
3296   int nSelect;          /* Number of SELECT statements in the compound */
3297   Vdbe *v;              /* Generate code to this VDBE */
3298   SelectDest destA;     /* Destination for coroutine A */
3299   SelectDest destB;     /* Destination for coroutine B */
3300   int regAddrA;         /* Address register for select-A coroutine */
3301   int regAddrB;         /* Address register for select-B coroutine */
3302   int addrSelectA;      /* Address of the select-A coroutine */
3303   int addrSelectB;      /* Address of the select-B coroutine */
3304   int regOutA;          /* Address register for the output-A subroutine */
3305   int regOutB;          /* Address register for the output-B subroutine */
3306   int addrOutA;         /* Address of the output-A subroutine */
3307   int addrOutB = 0;     /* Address of the output-B subroutine */
3308   int addrEofA;         /* Address of the select-A-exhausted subroutine */
3309   int addrEofA_noB;     /* Alternate addrEofA if B is uninitialized */
3310   int addrEofB;         /* Address of the select-B-exhausted subroutine */
3311   int addrAltB;         /* Address of the A<B subroutine */
3312   int addrAeqB;         /* Address of the A==B subroutine */
3313   int addrAgtB;         /* Address of the A>B subroutine */
3314   int regLimitA;        /* Limit register for select-A */
3315   int regLimitB;        /* Limit register for select-A */
3316   int regPrev;          /* A range of registers to hold previous output */
3317   int savedLimit;       /* Saved value of p->iLimit */
3318   int savedOffset;      /* Saved value of p->iOffset */
3319   int labelCmpr;        /* Label for the start of the merge algorithm */
3320   int labelEnd;         /* Label for the end of the overall SELECT stmt */
3321   int addr1;            /* Jump instructions that get retargetted */
3322   int op;               /* One of TK_ALL, TK_UNION, TK_EXCEPT, TK_INTERSECT */
3323   KeyInfo *pKeyDup = 0; /* Comparison information for duplicate removal */
3324   KeyInfo *pKeyMerge;   /* Comparison information for merging rows */
3325   sqlite3 *db;          /* Database connection */
3326   ExprList *pOrderBy;   /* The ORDER BY clause */
3327   int nOrderBy;         /* Number of terms in the ORDER BY clause */
3328   u32 *aPermute;        /* Mapping from ORDER BY terms to result set columns */
3329 
3330   assert( p->pOrderBy!=0 );
3331   assert( pKeyDup==0 ); /* "Managed" code needs this.  Ticket #3382. */
3332   db = pParse->db;
3333   v = pParse->pVdbe;
3334   assert( v!=0 );       /* Already thrown the error if VDBE alloc failed */
3335   labelEnd = sqlite3VdbeMakeLabel(pParse);
3336   labelCmpr = sqlite3VdbeMakeLabel(pParse);
3337 
3338 
3339   /* Patch up the ORDER BY clause
3340   */
3341   op = p->op;
3342   assert( p->pPrior->pOrderBy==0 );
3343   pOrderBy = p->pOrderBy;
3344   assert( pOrderBy );
3345   nOrderBy = pOrderBy->nExpr;
3346 
3347   /* For operators other than UNION ALL we have to make sure that
3348   ** the ORDER BY clause covers every term of the result set.  Add
3349   ** terms to the ORDER BY clause as necessary.
3350   */
3351   if( op!=TK_ALL ){
3352     for(i=1; db->mallocFailed==0 && i<=p->pEList->nExpr; i++){
3353       struct ExprList_item *pItem;
3354       for(j=0, pItem=pOrderBy->a; j<nOrderBy; j++, pItem++){
3355         assert( pItem!=0 );
3356         assert( pItem->u.x.iOrderByCol>0 );
3357         if( pItem->u.x.iOrderByCol==i ) break;
3358       }
3359       if( j==nOrderBy ){
3360         Expr *pNew = sqlite3Expr(db, TK_INTEGER, 0);
3361         if( pNew==0 ) return SQLITE_NOMEM_BKPT;
3362         pNew->flags |= EP_IntValue;
3363         pNew->u.iValue = i;
3364         p->pOrderBy = pOrderBy = sqlite3ExprListAppend(pParse, pOrderBy, pNew);
3365         if( pOrderBy ) pOrderBy->a[nOrderBy++].u.x.iOrderByCol = (u16)i;
3366       }
3367     }
3368   }
3369 
3370   /* Compute the comparison permutation and keyinfo that is used with
3371   ** the permutation used to determine if the next
3372   ** row of results comes from selectA or selectB.  Also add explicit
3373   ** collations to the ORDER BY clause terms so that when the subqueries
3374   ** to the right and the left are evaluated, they use the correct
3375   ** collation.
3376   */
3377   aPermute = sqlite3DbMallocRawNN(db, sizeof(u32)*(nOrderBy + 1));
3378   if( aPermute ){
3379     struct ExprList_item *pItem;
3380     aPermute[0] = nOrderBy;
3381     for(i=1, pItem=pOrderBy->a; i<=nOrderBy; i++, pItem++){
3382       assert( pItem!=0 );
3383       assert( pItem->u.x.iOrderByCol>0 );
3384       assert( pItem->u.x.iOrderByCol<=p->pEList->nExpr );
3385       aPermute[i] = pItem->u.x.iOrderByCol - 1;
3386     }
3387     pKeyMerge = multiSelectOrderByKeyInfo(pParse, p, 1);
3388   }else{
3389     pKeyMerge = 0;
3390   }
3391 
3392   /* Allocate a range of temporary registers and the KeyInfo needed
3393   ** for the logic that removes duplicate result rows when the
3394   ** operator is UNION, EXCEPT, or INTERSECT (but not UNION ALL).
3395   */
3396   if( op==TK_ALL ){
3397     regPrev = 0;
3398   }else{
3399     int nExpr = p->pEList->nExpr;
3400     assert( nOrderBy>=nExpr || db->mallocFailed );
3401     regPrev = pParse->nMem+1;
3402     pParse->nMem += nExpr+1;
3403     sqlite3VdbeAddOp2(v, OP_Integer, 0, regPrev);
3404     pKeyDup = sqlite3KeyInfoAlloc(db, nExpr, 1);
3405     if( pKeyDup ){
3406       assert( sqlite3KeyInfoIsWriteable(pKeyDup) );
3407       for(i=0; i<nExpr; i++){
3408         pKeyDup->aColl[i] = multiSelectCollSeq(pParse, p, i);
3409         pKeyDup->aSortFlags[i] = 0;
3410       }
3411     }
3412   }
3413 
3414   /* Separate the left and the right query from one another
3415   */
3416   nSelect = 1;
3417   if( (op==TK_ALL || op==TK_UNION)
3418    && OptimizationEnabled(db, SQLITE_BalancedMerge)
3419   ){
3420     for(pSplit=p; pSplit->pPrior!=0 && pSplit->op==op; pSplit=pSplit->pPrior){
3421       nSelect++;
3422       assert( pSplit->pPrior->pNext==pSplit );
3423     }
3424   }
3425   if( nSelect<=3 ){
3426     pSplit = p;
3427   }else{
3428     pSplit = p;
3429     for(i=2; i<nSelect; i+=2){ pSplit = pSplit->pPrior; }
3430   }
3431   pPrior = pSplit->pPrior;
3432   assert( pPrior!=0 );
3433   pSplit->pPrior = 0;
3434   pPrior->pNext = 0;
3435   assert( p->pOrderBy == pOrderBy );
3436   assert( pOrderBy!=0 || db->mallocFailed );
3437   pPrior->pOrderBy = sqlite3ExprListDup(pParse->db, pOrderBy, 0);
3438   sqlite3ResolveOrderGroupBy(pParse, p, p->pOrderBy, "ORDER");
3439   sqlite3ResolveOrderGroupBy(pParse, pPrior, pPrior->pOrderBy, "ORDER");
3440 
3441   /* Compute the limit registers */
3442   computeLimitRegisters(pParse, p, labelEnd);
3443   if( p->iLimit && op==TK_ALL ){
3444     regLimitA = ++pParse->nMem;
3445     regLimitB = ++pParse->nMem;
3446     sqlite3VdbeAddOp2(v, OP_Copy, p->iOffset ? p->iOffset+1 : p->iLimit,
3447                                   regLimitA);
3448     sqlite3VdbeAddOp2(v, OP_Copy, regLimitA, regLimitB);
3449   }else{
3450     regLimitA = regLimitB = 0;
3451   }
3452   sqlite3ExprDelete(db, p->pLimit);
3453   p->pLimit = 0;
3454 
3455   regAddrA = ++pParse->nMem;
3456   regAddrB = ++pParse->nMem;
3457   regOutA = ++pParse->nMem;
3458   regOutB = ++pParse->nMem;
3459   sqlite3SelectDestInit(&destA, SRT_Coroutine, regAddrA);
3460   sqlite3SelectDestInit(&destB, SRT_Coroutine, regAddrB);
3461 
3462   ExplainQueryPlan((pParse, 1, "MERGE (%s)", sqlite3SelectOpName(p->op)));
3463 
3464   /* Generate a coroutine to evaluate the SELECT statement to the
3465   ** left of the compound operator - the "A" select.
3466   */
3467   addrSelectA = sqlite3VdbeCurrentAddr(v) + 1;
3468   addr1 = sqlite3VdbeAddOp3(v, OP_InitCoroutine, regAddrA, 0, addrSelectA);
3469   VdbeComment((v, "left SELECT"));
3470   pPrior->iLimit = regLimitA;
3471   ExplainQueryPlan((pParse, 1, "LEFT"));
3472   sqlite3Select(pParse, pPrior, &destA);
3473   sqlite3VdbeEndCoroutine(v, regAddrA);
3474   sqlite3VdbeJumpHere(v, addr1);
3475 
3476   /* Generate a coroutine to evaluate the SELECT statement on
3477   ** the right - the "B" select
3478   */
3479   addrSelectB = sqlite3VdbeCurrentAddr(v) + 1;
3480   addr1 = sqlite3VdbeAddOp3(v, OP_InitCoroutine, regAddrB, 0, addrSelectB);
3481   VdbeComment((v, "right SELECT"));
3482   savedLimit = p->iLimit;
3483   savedOffset = p->iOffset;
3484   p->iLimit = regLimitB;
3485   p->iOffset = 0;
3486   ExplainQueryPlan((pParse, 1, "RIGHT"));
3487   sqlite3Select(pParse, p, &destB);
3488   p->iLimit = savedLimit;
3489   p->iOffset = savedOffset;
3490   sqlite3VdbeEndCoroutine(v, regAddrB);
3491 
3492   /* Generate a subroutine that outputs the current row of the A
3493   ** select as the next output row of the compound select.
3494   */
3495   VdbeNoopComment((v, "Output routine for A"));
3496   addrOutA = generateOutputSubroutine(pParse,
3497                  p, &destA, pDest, regOutA,
3498                  regPrev, pKeyDup, labelEnd);
3499 
3500   /* Generate a subroutine that outputs the current row of the B
3501   ** select as the next output row of the compound select.
3502   */
3503   if( op==TK_ALL || op==TK_UNION ){
3504     VdbeNoopComment((v, "Output routine for B"));
3505     addrOutB = generateOutputSubroutine(pParse,
3506                  p, &destB, pDest, regOutB,
3507                  regPrev, pKeyDup, labelEnd);
3508   }
3509   sqlite3KeyInfoUnref(pKeyDup);
3510 
3511   /* Generate a subroutine to run when the results from select A
3512   ** are exhausted and only data in select B remains.
3513   */
3514   if( op==TK_EXCEPT || op==TK_INTERSECT ){
3515     addrEofA_noB = addrEofA = labelEnd;
3516   }else{
3517     VdbeNoopComment((v, "eof-A subroutine"));
3518     addrEofA = sqlite3VdbeAddOp2(v, OP_Gosub, regOutB, addrOutB);
3519     addrEofA_noB = sqlite3VdbeAddOp2(v, OP_Yield, regAddrB, labelEnd);
3520                                      VdbeCoverage(v);
3521     sqlite3VdbeGoto(v, addrEofA);
3522     p->nSelectRow = sqlite3LogEstAdd(p->nSelectRow, pPrior->nSelectRow);
3523   }
3524 
3525   /* Generate a subroutine to run when the results from select B
3526   ** are exhausted and only data in select A remains.
3527   */
3528   if( op==TK_INTERSECT ){
3529     addrEofB = addrEofA;
3530     if( p->nSelectRow > pPrior->nSelectRow ) p->nSelectRow = pPrior->nSelectRow;
3531   }else{
3532     VdbeNoopComment((v, "eof-B subroutine"));
3533     addrEofB = sqlite3VdbeAddOp2(v, OP_Gosub, regOutA, addrOutA);
3534     sqlite3VdbeAddOp2(v, OP_Yield, regAddrA, labelEnd); VdbeCoverage(v);
3535     sqlite3VdbeGoto(v, addrEofB);
3536   }
3537 
3538   /* Generate code to handle the case of A<B
3539   */
3540   VdbeNoopComment((v, "A-lt-B subroutine"));
3541   addrAltB = sqlite3VdbeAddOp2(v, OP_Gosub, regOutA, addrOutA);
3542   sqlite3VdbeAddOp2(v, OP_Yield, regAddrA, addrEofA); VdbeCoverage(v);
3543   sqlite3VdbeGoto(v, labelCmpr);
3544 
3545   /* Generate code to handle the case of A==B
3546   */
3547   if( op==TK_ALL ){
3548     addrAeqB = addrAltB;
3549   }else if( op==TK_INTERSECT ){
3550     addrAeqB = addrAltB;
3551     addrAltB++;
3552   }else{
3553     VdbeNoopComment((v, "A-eq-B subroutine"));
3554     addrAeqB =
3555     sqlite3VdbeAddOp2(v, OP_Yield, regAddrA, addrEofA); VdbeCoverage(v);
3556     sqlite3VdbeGoto(v, labelCmpr);
3557   }
3558 
3559   /* Generate code to handle the case of A>B
3560   */
3561   VdbeNoopComment((v, "A-gt-B subroutine"));
3562   addrAgtB = sqlite3VdbeCurrentAddr(v);
3563   if( op==TK_ALL || op==TK_UNION ){
3564     sqlite3VdbeAddOp2(v, OP_Gosub, regOutB, addrOutB);
3565   }
3566   sqlite3VdbeAddOp2(v, OP_Yield, regAddrB, addrEofB); VdbeCoverage(v);
3567   sqlite3VdbeGoto(v, labelCmpr);
3568 
3569   /* This code runs once to initialize everything.
3570   */
3571   sqlite3VdbeJumpHere(v, addr1);
3572   sqlite3VdbeAddOp2(v, OP_Yield, regAddrA, addrEofA_noB); VdbeCoverage(v);
3573   sqlite3VdbeAddOp2(v, OP_Yield, regAddrB, addrEofB); VdbeCoverage(v);
3574 
3575   /* Implement the main merge loop
3576   */
3577   sqlite3VdbeResolveLabel(v, labelCmpr);
3578   sqlite3VdbeAddOp4(v, OP_Permutation, 0, 0, 0, (char*)aPermute, P4_INTARRAY);
3579   sqlite3VdbeAddOp4(v, OP_Compare, destA.iSdst, destB.iSdst, nOrderBy,
3580                          (char*)pKeyMerge, P4_KEYINFO);
3581   sqlite3VdbeChangeP5(v, OPFLAG_PERMUTE);
3582   sqlite3VdbeAddOp3(v, OP_Jump, addrAltB, addrAeqB, addrAgtB); VdbeCoverage(v);
3583 
3584   /* Jump to the this point in order to terminate the query.
3585   */
3586   sqlite3VdbeResolveLabel(v, labelEnd);
3587 
3588   /* Reassembly the compound query so that it will be freed correctly
3589   ** by the calling function */
3590   if( pSplit->pPrior ){
3591     sqlite3SelectDelete(db, pSplit->pPrior);
3592   }
3593   pSplit->pPrior = pPrior;
3594   pPrior->pNext = pSplit;
3595   sqlite3ExprListDelete(db, pPrior->pOrderBy);
3596   pPrior->pOrderBy = 0;
3597 
3598   /*** TBD:  Insert subroutine calls to close cursors on incomplete
3599   **** subqueries ****/
3600   ExplainQueryPlanPop(pParse);
3601   return pParse->nErr!=0;
3602 }
3603 #endif
3604 
3605 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
3606 
3607 /* An instance of the SubstContext object describes an substitution edit
3608 ** to be performed on a parse tree.
3609 **
3610 ** All references to columns in table iTable are to be replaced by corresponding
3611 ** expressions in pEList.
3612 */
3613 typedef struct SubstContext {
3614   Parse *pParse;            /* The parsing context */
3615   int iTable;               /* Replace references to this table */
3616   int iNewTable;            /* New table number */
3617   int isLeftJoin;           /* Add TK_IF_NULL_ROW opcodes on each replacement */
3618   ExprList *pEList;         /* Replacement expressions */
3619 } SubstContext;
3620 
3621 /* Forward Declarations */
3622 static void substExprList(SubstContext*, ExprList*);
3623 static void substSelect(SubstContext*, Select*, int);
3624 
3625 /*
3626 ** Scan through the expression pExpr.  Replace every reference to
3627 ** a column in table number iTable with a copy of the iColumn-th
3628 ** entry in pEList.  (But leave references to the ROWID column
3629 ** unchanged.)
3630 **
3631 ** This routine is part of the flattening procedure.  A subquery
3632 ** whose result set is defined by pEList appears as entry in the
3633 ** FROM clause of a SELECT such that the VDBE cursor assigned to that
3634 ** FORM clause entry is iTable.  This routine makes the necessary
3635 ** changes to pExpr so that it refers directly to the source table
3636 ** of the subquery rather the result set of the subquery.
3637 */
3638 static Expr *substExpr(
3639   SubstContext *pSubst,  /* Description of the substitution */
3640   Expr *pExpr            /* Expr in which substitution occurs */
3641 ){
3642   if( pExpr==0 ) return 0;
3643   if( ExprHasProperty(pExpr, EP_FromJoin)
3644    && pExpr->w.iRightJoinTable==pSubst->iTable
3645   ){
3646     pExpr->w.iRightJoinTable = pSubst->iNewTable;
3647   }
3648   if( pExpr->op==TK_COLUMN
3649    && pExpr->iTable==pSubst->iTable
3650    && !ExprHasProperty(pExpr, EP_FixedCol)
3651   ){
3652 #ifdef SQLITE_ALLOW_ROWID_IN_VIEW
3653     if( pExpr->iColumn<0 ){
3654       pExpr->op = TK_NULL;
3655     }else
3656 #endif
3657     {
3658       Expr *pNew;
3659       Expr *pCopy = pSubst->pEList->a[pExpr->iColumn].pExpr;
3660       Expr ifNullRow;
3661       assert( pSubst->pEList!=0 && pExpr->iColumn<pSubst->pEList->nExpr );
3662       assert( pExpr->pRight==0 );
3663       if( sqlite3ExprIsVector(pCopy) ){
3664         sqlite3VectorErrorMsg(pSubst->pParse, pCopy);
3665       }else{
3666         sqlite3 *db = pSubst->pParse->db;
3667         if( pSubst->isLeftJoin && pCopy->op!=TK_COLUMN ){
3668           memset(&ifNullRow, 0, sizeof(ifNullRow));
3669           ifNullRow.op = TK_IF_NULL_ROW;
3670           ifNullRow.pLeft = pCopy;
3671           ifNullRow.iTable = pSubst->iNewTable;
3672           ifNullRow.flags = EP_IfNullRow;
3673           pCopy = &ifNullRow;
3674         }
3675         testcase( ExprHasProperty(pCopy, EP_Subquery) );
3676         pNew = sqlite3ExprDup(db, pCopy, 0);
3677         if( db->mallocFailed ){
3678           sqlite3ExprDelete(db, pNew);
3679           return pExpr;
3680         }
3681         if( pSubst->isLeftJoin ){
3682           ExprSetProperty(pNew, EP_CanBeNull);
3683         }
3684         if( ExprHasProperty(pExpr,EP_FromJoin) ){
3685           sqlite3SetJoinExpr(pNew, pExpr->w.iRightJoinTable);
3686         }
3687         sqlite3ExprDelete(db, pExpr);
3688         pExpr = pNew;
3689 
3690         /* Ensure that the expression now has an implicit collation sequence,
3691         ** just as it did when it was a column of a view or sub-query. */
3692         if( pExpr->op!=TK_COLUMN && pExpr->op!=TK_COLLATE ){
3693           CollSeq *pColl = sqlite3ExprCollSeq(pSubst->pParse, pExpr);
3694           pExpr = sqlite3ExprAddCollateString(pSubst->pParse, pExpr,
3695               (pColl ? pColl->zName : "BINARY")
3696           );
3697         }
3698         ExprClearProperty(pExpr, EP_Collate);
3699       }
3700     }
3701   }else{
3702     if( pExpr->op==TK_IF_NULL_ROW && pExpr->iTable==pSubst->iTable ){
3703       pExpr->iTable = pSubst->iNewTable;
3704     }
3705     pExpr->pLeft = substExpr(pSubst, pExpr->pLeft);
3706     pExpr->pRight = substExpr(pSubst, pExpr->pRight);
3707     if( ExprUseXSelect(pExpr) ){
3708       substSelect(pSubst, pExpr->x.pSelect, 1);
3709     }else{
3710       substExprList(pSubst, pExpr->x.pList);
3711     }
3712 #ifndef SQLITE_OMIT_WINDOWFUNC
3713     if( ExprHasProperty(pExpr, EP_WinFunc) ){
3714       Window *pWin = pExpr->y.pWin;
3715       pWin->pFilter = substExpr(pSubst, pWin->pFilter);
3716       substExprList(pSubst, pWin->pPartition);
3717       substExprList(pSubst, pWin->pOrderBy);
3718     }
3719 #endif
3720   }
3721   return pExpr;
3722 }
3723 static void substExprList(
3724   SubstContext *pSubst, /* Description of the substitution */
3725   ExprList *pList       /* List to scan and in which to make substitutes */
3726 ){
3727   int i;
3728   if( pList==0 ) return;
3729   for(i=0; i<pList->nExpr; i++){
3730     pList->a[i].pExpr = substExpr(pSubst, pList->a[i].pExpr);
3731   }
3732 }
3733 static void substSelect(
3734   SubstContext *pSubst, /* Description of the substitution */
3735   Select *p,            /* SELECT statement in which to make substitutions */
3736   int doPrior           /* Do substitutes on p->pPrior too */
3737 ){
3738   SrcList *pSrc;
3739   SrcItem *pItem;
3740   int i;
3741   if( !p ) return;
3742   do{
3743     substExprList(pSubst, p->pEList);
3744     substExprList(pSubst, p->pGroupBy);
3745     substExprList(pSubst, p->pOrderBy);
3746     p->pHaving = substExpr(pSubst, p->pHaving);
3747     p->pWhere = substExpr(pSubst, p->pWhere);
3748     pSrc = p->pSrc;
3749     assert( pSrc!=0 );
3750     for(i=pSrc->nSrc, pItem=pSrc->a; i>0; i--, pItem++){
3751       substSelect(pSubst, pItem->pSelect, 1);
3752       if( pItem->fg.isTabFunc ){
3753         substExprList(pSubst, pItem->u1.pFuncArg);
3754       }
3755     }
3756   }while( doPrior && (p = p->pPrior)!=0 );
3757 }
3758 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
3759 
3760 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
3761 /*
3762 ** pSelect is a SELECT statement and pSrcItem is one item in the FROM
3763 ** clause of that SELECT.
3764 **
3765 ** This routine scans the entire SELECT statement and recomputes the
3766 ** pSrcItem->colUsed mask.
3767 */
3768 static int recomputeColumnsUsedExpr(Walker *pWalker, Expr *pExpr){
3769   SrcItem *pItem;
3770   if( pExpr->op!=TK_COLUMN ) return WRC_Continue;
3771   pItem = pWalker->u.pSrcItem;
3772   if( pItem->iCursor!=pExpr->iTable ) return WRC_Continue;
3773   if( pExpr->iColumn<0 ) return WRC_Continue;
3774   pItem->colUsed |= sqlite3ExprColUsed(pExpr);
3775   return WRC_Continue;
3776 }
3777 static void recomputeColumnsUsed(
3778   Select *pSelect,                 /* The complete SELECT statement */
3779   SrcItem *pSrcItem                /* Which FROM clause item to recompute */
3780 ){
3781   Walker w;
3782   if( NEVER(pSrcItem->pTab==0) ) return;
3783   memset(&w, 0, sizeof(w));
3784   w.xExprCallback = recomputeColumnsUsedExpr;
3785   w.xSelectCallback = sqlite3SelectWalkNoop;
3786   w.u.pSrcItem = pSrcItem;
3787   pSrcItem->colUsed = 0;
3788   sqlite3WalkSelect(&w, pSelect);
3789 }
3790 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
3791 
3792 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
3793 /*
3794 ** Assign new cursor numbers to each of the items in pSrc. For each
3795 ** new cursor number assigned, set an entry in the aCsrMap[] array
3796 ** to map the old cursor number to the new:
3797 **
3798 **     aCsrMap[iOld+1] = iNew;
3799 **
3800 ** The array is guaranteed by the caller to be large enough for all
3801 ** existing cursor numbers in pSrc.  aCsrMap[0] is the array size.
3802 **
3803 ** If pSrc contains any sub-selects, call this routine recursively
3804 ** on the FROM clause of each such sub-select, with iExcept set to -1.
3805 */
3806 static void srclistRenumberCursors(
3807   Parse *pParse,                  /* Parse context */
3808   int *aCsrMap,                   /* Array to store cursor mappings in */
3809   SrcList *pSrc,                  /* FROM clause to renumber */
3810   int iExcept                     /* FROM clause item to skip */
3811 ){
3812   int i;
3813   SrcItem *pItem;
3814   for(i=0, pItem=pSrc->a; i<pSrc->nSrc; i++, pItem++){
3815     if( i!=iExcept ){
3816       Select *p;
3817       assert( pItem->iCursor < aCsrMap[0] );
3818       if( !pItem->fg.isRecursive || aCsrMap[pItem->iCursor+1]==0 ){
3819         aCsrMap[pItem->iCursor+1] = pParse->nTab++;
3820       }
3821       pItem->iCursor = aCsrMap[pItem->iCursor+1];
3822       for(p=pItem->pSelect; p; p=p->pPrior){
3823         srclistRenumberCursors(pParse, aCsrMap, p->pSrc, -1);
3824       }
3825     }
3826   }
3827 }
3828 
3829 /*
3830 ** *piCursor is a cursor number.  Change it if it needs to be mapped.
3831 */
3832 static void renumberCursorDoMapping(Walker *pWalker, int *piCursor){
3833   int *aCsrMap = pWalker->u.aiCol;
3834   int iCsr = *piCursor;
3835   if( iCsr < aCsrMap[0] && aCsrMap[iCsr+1]>0 ){
3836     *piCursor = aCsrMap[iCsr+1];
3837   }
3838 }
3839 
3840 /*
3841 ** Expression walker callback used by renumberCursors() to update
3842 ** Expr objects to match newly assigned cursor numbers.
3843 */
3844 static int renumberCursorsCb(Walker *pWalker, Expr *pExpr){
3845   int op = pExpr->op;
3846   if( op==TK_COLUMN || op==TK_IF_NULL_ROW ){
3847     renumberCursorDoMapping(pWalker, &pExpr->iTable);
3848   }
3849   if( ExprHasProperty(pExpr, EP_FromJoin) ){
3850     renumberCursorDoMapping(pWalker, &pExpr->w.iRightJoinTable);
3851   }
3852   return WRC_Continue;
3853 }
3854 
3855 /*
3856 ** Assign a new cursor number to each cursor in the FROM clause (Select.pSrc)
3857 ** of the SELECT statement passed as the second argument, and to each
3858 ** cursor in the FROM clause of any FROM clause sub-selects, recursively.
3859 ** Except, do not assign a new cursor number to the iExcept'th element in
3860 ** the FROM clause of (*p). Update all expressions and other references
3861 ** to refer to the new cursor numbers.
3862 **
3863 ** Argument aCsrMap is an array that may be used for temporary working
3864 ** space. Two guarantees are made by the caller:
3865 **
3866 **   * the array is larger than the largest cursor number used within the
3867 **     select statement passed as an argument, and
3868 **
3869 **   * the array entries for all cursor numbers that do *not* appear in
3870 **     FROM clauses of the select statement as described above are
3871 **     initialized to zero.
3872 */
3873 static void renumberCursors(
3874   Parse *pParse,                  /* Parse context */
3875   Select *p,                      /* Select to renumber cursors within */
3876   int iExcept,                    /* FROM clause item to skip */
3877   int *aCsrMap                    /* Working space */
3878 ){
3879   Walker w;
3880   srclistRenumberCursors(pParse, aCsrMap, p->pSrc, iExcept);
3881   memset(&w, 0, sizeof(w));
3882   w.u.aiCol = aCsrMap;
3883   w.xExprCallback = renumberCursorsCb;
3884   w.xSelectCallback = sqlite3SelectWalkNoop;
3885   sqlite3WalkSelect(&w, p);
3886 }
3887 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
3888 
3889 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
3890 /*
3891 ** This routine attempts to flatten subqueries as a performance optimization.
3892 ** This routine returns 1 if it makes changes and 0 if no flattening occurs.
3893 **
3894 ** To understand the concept of flattening, consider the following
3895 ** query:
3896 **
3897 **     SELECT a FROM (SELECT x+y AS a FROM t1 WHERE z<100) WHERE a>5
3898 **
3899 ** The default way of implementing this query is to execute the
3900 ** subquery first and store the results in a temporary table, then
3901 ** run the outer query on that temporary table.  This requires two
3902 ** passes over the data.  Furthermore, because the temporary table
3903 ** has no indices, the WHERE clause on the outer query cannot be
3904 ** optimized.
3905 **
3906 ** This routine attempts to rewrite queries such as the above into
3907 ** a single flat select, like this:
3908 **
3909 **     SELECT x+y AS a FROM t1 WHERE z<100 AND a>5
3910 **
3911 ** The code generated for this simplification gives the same result
3912 ** but only has to scan the data once.  And because indices might
3913 ** exist on the table t1, a complete scan of the data might be
3914 ** avoided.
3915 **
3916 ** Flattening is subject to the following constraints:
3917 **
3918 **  (**)  We no longer attempt to flatten aggregate subqueries. Was:
3919 **        The subquery and the outer query cannot both be aggregates.
3920 **
3921 **  (**)  We no longer attempt to flatten aggregate subqueries. Was:
3922 **        (2) If the subquery is an aggregate then
3923 **        (2a) the outer query must not be a join and
3924 **        (2b) the outer query must not use subqueries
3925 **             other than the one FROM-clause subquery that is a candidate
3926 **             for flattening.  (This is due to ticket [2f7170d73bf9abf80]
3927 **             from 2015-02-09.)
3928 **
3929 **   (3)  If the subquery is the right operand of a LEFT JOIN then
3930 **        (3a) the subquery may not be a join and
3931 **        (3b) the FROM clause of the subquery may not contain a virtual
3932 **             table and
3933 **        (3c) the outer query may not be an aggregate.
3934 **        (3d) the outer query may not be DISTINCT.
3935 **
3936 **   (4)  The subquery can not be DISTINCT.
3937 **
3938 **  (**)  At one point restrictions (4) and (5) defined a subset of DISTINCT
3939 **        sub-queries that were excluded from this optimization. Restriction
3940 **        (4) has since been expanded to exclude all DISTINCT subqueries.
3941 **
3942 **  (**)  We no longer attempt to flatten aggregate subqueries.  Was:
3943 **        If the subquery is aggregate, the outer query may not be DISTINCT.
3944 **
3945 **   (7)  The subquery must have a FROM clause.  TODO:  For subqueries without
3946 **        A FROM clause, consider adding a FROM clause with the special
3947 **        table sqlite_once that consists of a single row containing a
3948 **        single NULL.
3949 **
3950 **   (8)  If the subquery uses LIMIT then the outer query may not be a join.
3951 **
3952 **   (9)  If the subquery uses LIMIT then the outer query may not be aggregate.
3953 **
3954 **  (**)  Restriction (10) was removed from the code on 2005-02-05 but we
3955 **        accidently carried the comment forward until 2014-09-15.  Original
3956 **        constraint: "If the subquery is aggregate then the outer query
3957 **        may not use LIMIT."
3958 **
3959 **  (11)  The subquery and the outer query may not both have ORDER BY clauses.
3960 **
3961 **  (**)  Not implemented.  Subsumed into restriction (3).  Was previously
3962 **        a separate restriction deriving from ticket #350.
3963 **
3964 **  (13)  The subquery and outer query may not both use LIMIT.
3965 **
3966 **  (14)  The subquery may not use OFFSET.
3967 **
3968 **  (15)  If the outer query is part of a compound select, then the
3969 **        subquery may not use LIMIT.
3970 **        (See ticket #2339 and ticket [02a8e81d44]).
3971 **
3972 **  (16)  If the outer query is aggregate, then the subquery may not
3973 **        use ORDER BY.  (Ticket #2942)  This used to not matter
3974 **        until we introduced the group_concat() function.
3975 **
3976 **  (17)  If the subquery is a compound select, then
3977 **        (17a) all compound operators must be a UNION ALL, and
3978 **        (17b) no terms within the subquery compound may be aggregate
3979 **              or DISTINCT, and
3980 **        (17c) every term within the subquery compound must have a FROM clause
3981 **        (17d) the outer query may not be
3982 **              (17d1) aggregate, or
3983 **              (17d2) DISTINCT
3984 **        (17e) the subquery may not contain window functions, and
3985 **        (17f) the subquery must not be the RHS of a LEFT JOIN.
3986 **
3987 **        The parent and sub-query may contain WHERE clauses. Subject to
3988 **        rules (11), (13) and (14), they may also contain ORDER BY,
3989 **        LIMIT and OFFSET clauses.  The subquery cannot use any compound
3990 **        operator other than UNION ALL because all the other compound
3991 **        operators have an implied DISTINCT which is disallowed by
3992 **        restriction (4).
3993 **
3994 **        Also, each component of the sub-query must return the same number
3995 **        of result columns. This is actually a requirement for any compound
3996 **        SELECT statement, but all the code here does is make sure that no
3997 **        such (illegal) sub-query is flattened. The caller will detect the
3998 **        syntax error and return a detailed message.
3999 **
4000 **  (18)  If the sub-query is a compound select, then all terms of the
4001 **        ORDER BY clause of the parent must be copies of a term returned
4002 **        by the parent query.
4003 **
4004 **  (19)  If the subquery uses LIMIT then the outer query may not
4005 **        have a WHERE clause.
4006 **
4007 **  (20)  If the sub-query is a compound select, then it must not use
4008 **        an ORDER BY clause.  Ticket #3773.  We could relax this constraint
4009 **        somewhat by saying that the terms of the ORDER BY clause must
4010 **        appear as unmodified result columns in the outer query.  But we
4011 **        have other optimizations in mind to deal with that case.
4012 **
4013 **  (21)  If the subquery uses LIMIT then the outer query may not be
4014 **        DISTINCT.  (See ticket [752e1646fc]).
4015 **
4016 **  (22)  The subquery may not be a recursive CTE.
4017 **
4018 **  (23)  If the outer query is a recursive CTE, then the sub-query may not be
4019 **        a compound query.  This restriction is because transforming the
4020 **        parent to a compound query confuses the code that handles
4021 **        recursive queries in multiSelect().
4022 **
4023 **  (**)  We no longer attempt to flatten aggregate subqueries.  Was:
4024 **        The subquery may not be an aggregate that uses the built-in min() or
4025 **        or max() functions.  (Without this restriction, a query like:
4026 **        "SELECT x FROM (SELECT max(y), x FROM t1)" would not necessarily
4027 **        return the value X for which Y was maximal.)
4028 **
4029 **  (25)  If either the subquery or the parent query contains a window
4030 **        function in the select list or ORDER BY clause, flattening
4031 **        is not attempted.
4032 **
4033 **
4034 ** In this routine, the "p" parameter is a pointer to the outer query.
4035 ** The subquery is p->pSrc->a[iFrom].  isAgg is true if the outer query
4036 ** uses aggregates.
4037 **
4038 ** If flattening is not attempted, this routine is a no-op and returns 0.
4039 ** If flattening is attempted this routine returns 1.
4040 **
4041 ** All of the expression analysis must occur on both the outer query and
4042 ** the subquery before this routine runs.
4043 */
4044 static int flattenSubquery(
4045   Parse *pParse,       /* Parsing context */
4046   Select *p,           /* The parent or outer SELECT statement */
4047   int iFrom,           /* Index in p->pSrc->a[] of the inner subquery */
4048   int isAgg            /* True if outer SELECT uses aggregate functions */
4049 ){
4050   const char *zSavedAuthContext = pParse->zAuthContext;
4051   Select *pParent;    /* Current UNION ALL term of the other query */
4052   Select *pSub;       /* The inner query or "subquery" */
4053   Select *pSub1;      /* Pointer to the rightmost select in sub-query */
4054   SrcList *pSrc;      /* The FROM clause of the outer query */
4055   SrcList *pSubSrc;   /* The FROM clause of the subquery */
4056   int iParent;        /* VDBE cursor number of the pSub result set temp table */
4057   int iNewParent = -1;/* Replacement table for iParent */
4058   int isLeftJoin = 0; /* True if pSub is the right side of a LEFT JOIN */
4059   int i;              /* Loop counter */
4060   Expr *pWhere;                    /* The WHERE clause */
4061   SrcItem *pSubitem;               /* The subquery */
4062   sqlite3 *db = pParse->db;
4063   Walker w;                        /* Walker to persist agginfo data */
4064   int *aCsrMap = 0;
4065 
4066   /* Check to see if flattening is permitted.  Return 0 if not.
4067   */
4068   assert( p!=0 );
4069   assert( p->pPrior==0 );
4070   if( OptimizationDisabled(db, SQLITE_QueryFlattener) ) return 0;
4071   pSrc = p->pSrc;
4072   assert( pSrc && iFrom>=0 && iFrom<pSrc->nSrc );
4073   pSubitem = &pSrc->a[iFrom];
4074   iParent = pSubitem->iCursor;
4075   pSub = pSubitem->pSelect;
4076   assert( pSub!=0 );
4077 
4078 #ifndef SQLITE_OMIT_WINDOWFUNC
4079   if( p->pWin || pSub->pWin ) return 0;                  /* Restriction (25) */
4080 #endif
4081 
4082   pSubSrc = pSub->pSrc;
4083   assert( pSubSrc );
4084   /* Prior to version 3.1.2, when LIMIT and OFFSET had to be simple constants,
4085   ** not arbitrary expressions, we allowed some combining of LIMIT and OFFSET
4086   ** because they could be computed at compile-time.  But when LIMIT and OFFSET
4087   ** became arbitrary expressions, we were forced to add restrictions (13)
4088   ** and (14). */
4089   if( pSub->pLimit && p->pLimit ) return 0;              /* Restriction (13) */
4090   if( pSub->pLimit && pSub->pLimit->pRight ) return 0;   /* Restriction (14) */
4091   if( (p->selFlags & SF_Compound)!=0 && pSub->pLimit ){
4092     return 0;                                            /* Restriction (15) */
4093   }
4094   if( pSubSrc->nSrc==0 ) return 0;                       /* Restriction (7)  */
4095   if( pSub->selFlags & SF_Distinct ) return 0;           /* Restriction (4)  */
4096   if( pSub->pLimit && (pSrc->nSrc>1 || isAgg) ){
4097      return 0;         /* Restrictions (8)(9) */
4098   }
4099   if( p->pOrderBy && pSub->pOrderBy ){
4100      return 0;                                           /* Restriction (11) */
4101   }
4102   if( isAgg && pSub->pOrderBy ) return 0;                /* Restriction (16) */
4103   if( pSub->pLimit && p->pWhere ) return 0;              /* Restriction (19) */
4104   if( pSub->pLimit && (p->selFlags & SF_Distinct)!=0 ){
4105      return 0;         /* Restriction (21) */
4106   }
4107   if( pSub->selFlags & (SF_Recursive) ){
4108     return 0; /* Restrictions (22) */
4109   }
4110 
4111   /*
4112   ** If the subquery is the right operand of a LEFT JOIN, then the
4113   ** subquery may not be a join itself (3a). Example of why this is not
4114   ** allowed:
4115   **
4116   **         t1 LEFT OUTER JOIN (t2 JOIN t3)
4117   **
4118   ** If we flatten the above, we would get
4119   **
4120   **         (t1 LEFT OUTER JOIN t2) JOIN t3
4121   **
4122   ** which is not at all the same thing.
4123   **
4124   ** If the subquery is the right operand of a LEFT JOIN, then the outer
4125   ** query cannot be an aggregate. (3c)  This is an artifact of the way
4126   ** aggregates are processed - there is no mechanism to determine if
4127   ** the LEFT JOIN table should be all-NULL.
4128   **
4129   ** See also tickets #306, #350, and #3300.
4130   */
4131   if( (pSubitem->fg.jointype & JT_OUTER)!=0 ){
4132     isLeftJoin = 1;
4133     if( pSubSrc->nSrc>1                   /* (3a) */
4134      || isAgg                             /* (3b) */
4135      || IsVirtual(pSubSrc->a[0].pTab)     /* (3c) */
4136      || (p->selFlags & SF_Distinct)!=0    /* (3d) */
4137     ){
4138       return 0;
4139     }
4140   }
4141 #ifdef SQLITE_EXTRA_IFNULLROW
4142   else if( iFrom>0 && !isAgg ){
4143     /* Setting isLeftJoin to -1 causes OP_IfNullRow opcodes to be generated for
4144     ** every reference to any result column from subquery in a join, even
4145     ** though they are not necessary.  This will stress-test the OP_IfNullRow
4146     ** opcode. */
4147     isLeftJoin = -1;
4148   }
4149 #endif
4150 
4151   /* Restriction (17): If the sub-query is a compound SELECT, then it must
4152   ** use only the UNION ALL operator. And none of the simple select queries
4153   ** that make up the compound SELECT are allowed to be aggregate or distinct
4154   ** queries.
4155   */
4156   if( pSub->pPrior ){
4157     if( pSub->pOrderBy ){
4158       return 0;  /* Restriction (20) */
4159     }
4160     if( isAgg || (p->selFlags & SF_Distinct)!=0 || isLeftJoin>0 ){
4161       return 0; /* (17d1), (17d2), or (17f) */
4162     }
4163     for(pSub1=pSub; pSub1; pSub1=pSub1->pPrior){
4164       testcase( (pSub1->selFlags & (SF_Distinct|SF_Aggregate))==SF_Distinct );
4165       testcase( (pSub1->selFlags & (SF_Distinct|SF_Aggregate))==SF_Aggregate );
4166       assert( pSub->pSrc!=0 );
4167       assert( (pSub->selFlags & SF_Recursive)==0 );
4168       assert( pSub->pEList->nExpr==pSub1->pEList->nExpr );
4169       if( (pSub1->selFlags & (SF_Distinct|SF_Aggregate))!=0    /* (17b) */
4170        || (pSub1->pPrior && pSub1->op!=TK_ALL)                 /* (17a) */
4171        || pSub1->pSrc->nSrc<1                                  /* (17c) */
4172 #ifndef SQLITE_OMIT_WINDOWFUNC
4173        || pSub1->pWin                                          /* (17e) */
4174 #endif
4175       ){
4176         return 0;
4177       }
4178       testcase( pSub1->pSrc->nSrc>1 );
4179     }
4180 
4181     /* Restriction (18). */
4182     if( p->pOrderBy ){
4183       int ii;
4184       for(ii=0; ii<p->pOrderBy->nExpr; ii++){
4185         if( p->pOrderBy->a[ii].u.x.iOrderByCol==0 ) return 0;
4186       }
4187     }
4188 
4189     /* Restriction (23) */
4190     if( (p->selFlags & SF_Recursive) ) return 0;
4191 
4192     if( pSrc->nSrc>1 ){
4193       if( pParse->nSelect>500 ) return 0;
4194       aCsrMap = sqlite3DbMallocZero(db, ((i64)pParse->nTab+1)*sizeof(int));
4195       if( aCsrMap ) aCsrMap[0] = pParse->nTab;
4196     }
4197   }
4198 
4199   /***** If we reach this point, flattening is permitted. *****/
4200   SELECTTRACE(1,pParse,p,("flatten %u.%p from term %d\n",
4201                    pSub->selId, pSub, iFrom));
4202 
4203   /* Authorize the subquery */
4204   pParse->zAuthContext = pSubitem->zName;
4205   TESTONLY(i =) sqlite3AuthCheck(pParse, SQLITE_SELECT, 0, 0, 0);
4206   testcase( i==SQLITE_DENY );
4207   pParse->zAuthContext = zSavedAuthContext;
4208 
4209   /* Delete the transient structures associated with thesubquery */
4210   pSub1 = pSubitem->pSelect;
4211   sqlite3DbFree(db, pSubitem->zDatabase);
4212   sqlite3DbFree(db, pSubitem->zName);
4213   sqlite3DbFree(db, pSubitem->zAlias);
4214   pSubitem->zDatabase = 0;
4215   pSubitem->zName = 0;
4216   pSubitem->zAlias = 0;
4217   pSubitem->pSelect = 0;
4218   assert( pSubitem->fg.isUsing!=0 || pSubitem->u3.pOn==0 );
4219 
4220   /* If the sub-query is a compound SELECT statement, then (by restrictions
4221   ** 17 and 18 above) it must be a UNION ALL and the parent query must
4222   ** be of the form:
4223   **
4224   **     SELECT <expr-list> FROM (<sub-query>) <where-clause>
4225   **
4226   ** followed by any ORDER BY, LIMIT and/or OFFSET clauses. This block
4227   ** creates N-1 copies of the parent query without any ORDER BY, LIMIT or
4228   ** OFFSET clauses and joins them to the left-hand-side of the original
4229   ** using UNION ALL operators. In this case N is the number of simple
4230   ** select statements in the compound sub-query.
4231   **
4232   ** Example:
4233   **
4234   **     SELECT a+1 FROM (
4235   **        SELECT x FROM tab
4236   **        UNION ALL
4237   **        SELECT y FROM tab
4238   **        UNION ALL
4239   **        SELECT abs(z*2) FROM tab2
4240   **     ) WHERE a!=5 ORDER BY 1
4241   **
4242   ** Transformed into:
4243   **
4244   **     SELECT x+1 FROM tab WHERE x+1!=5
4245   **     UNION ALL
4246   **     SELECT y+1 FROM tab WHERE y+1!=5
4247   **     UNION ALL
4248   **     SELECT abs(z*2)+1 FROM tab2 WHERE abs(z*2)+1!=5
4249   **     ORDER BY 1
4250   **
4251   ** We call this the "compound-subquery flattening".
4252   */
4253   for(pSub=pSub->pPrior; pSub; pSub=pSub->pPrior){
4254     Select *pNew;
4255     ExprList *pOrderBy = p->pOrderBy;
4256     Expr *pLimit = p->pLimit;
4257     Select *pPrior = p->pPrior;
4258     Table *pItemTab = pSubitem->pTab;
4259     pSubitem->pTab = 0;
4260     p->pOrderBy = 0;
4261     p->pPrior = 0;
4262     p->pLimit = 0;
4263     pNew = sqlite3SelectDup(db, p, 0);
4264     p->pLimit = pLimit;
4265     p->pOrderBy = pOrderBy;
4266     p->op = TK_ALL;
4267     pSubitem->pTab = pItemTab;
4268     if( pNew==0 ){
4269       p->pPrior = pPrior;
4270     }else{
4271       pNew->selId = ++pParse->nSelect;
4272       if( aCsrMap && ALWAYS(db->mallocFailed==0) ){
4273         renumberCursors(pParse, pNew, iFrom, aCsrMap);
4274       }
4275       pNew->pPrior = pPrior;
4276       if( pPrior ) pPrior->pNext = pNew;
4277       pNew->pNext = p;
4278       p->pPrior = pNew;
4279       SELECTTRACE(2,pParse,p,("compound-subquery flattener"
4280                               " creates %u as peer\n",pNew->selId));
4281     }
4282     assert( pSubitem->pSelect==0 );
4283   }
4284   sqlite3DbFree(db, aCsrMap);
4285   if( db->mallocFailed ){
4286     pSubitem->pSelect = pSub1;
4287     return 1;
4288   }
4289 
4290   /* Defer deleting the Table object associated with the
4291   ** subquery until code generation is
4292   ** complete, since there may still exist Expr.pTab entries that
4293   ** refer to the subquery even after flattening.  Ticket #3346.
4294   **
4295   ** pSubitem->pTab is always non-NULL by test restrictions and tests above.
4296   */
4297   if( ALWAYS(pSubitem->pTab!=0) ){
4298     Table *pTabToDel = pSubitem->pTab;
4299     if( pTabToDel->nTabRef==1 ){
4300       Parse *pToplevel = sqlite3ParseToplevel(pParse);
4301       sqlite3ParserAddCleanup(pToplevel,
4302          (void(*)(sqlite3*,void*))sqlite3DeleteTable,
4303          pTabToDel);
4304       testcase( pToplevel->earlyCleanup );
4305     }else{
4306       pTabToDel->nTabRef--;
4307     }
4308     pSubitem->pTab = 0;
4309   }
4310 
4311   /* The following loop runs once for each term in a compound-subquery
4312   ** flattening (as described above).  If we are doing a different kind
4313   ** of flattening - a flattening other than a compound-subquery flattening -
4314   ** then this loop only runs once.
4315   **
4316   ** This loop moves all of the FROM elements of the subquery into the
4317   ** the FROM clause of the outer query.  Before doing this, remember
4318   ** the cursor number for the original outer query FROM element in
4319   ** iParent.  The iParent cursor will never be used.  Subsequent code
4320   ** will scan expressions looking for iParent references and replace
4321   ** those references with expressions that resolve to the subquery FROM
4322   ** elements we are now copying in.
4323   */
4324   pSub = pSub1;
4325   for(pParent=p; pParent; pParent=pParent->pPrior, pSub=pSub->pPrior){
4326     int nSubSrc;
4327     u8 jointype = 0;
4328     assert( pSub!=0 );
4329     pSubSrc = pSub->pSrc;     /* FROM clause of subquery */
4330     nSubSrc = pSubSrc->nSrc;  /* Number of terms in subquery FROM clause */
4331     pSrc = pParent->pSrc;     /* FROM clause of the outer query */
4332 
4333     if( pParent==p ){
4334       jointype = pSubitem->fg.jointype;     /* First time through the loop */
4335     }
4336 
4337     /* The subquery uses a single slot of the FROM clause of the outer
4338     ** query.  If the subquery has more than one element in its FROM clause,
4339     ** then expand the outer query to make space for it to hold all elements
4340     ** of the subquery.
4341     **
4342     ** Example:
4343     **
4344     **    SELECT * FROM tabA, (SELECT * FROM sub1, sub2), tabB;
4345     **
4346     ** The outer query has 3 slots in its FROM clause.  One slot of the
4347     ** outer query (the middle slot) is used by the subquery.  The next
4348     ** block of code will expand the outer query FROM clause to 4 slots.
4349     ** The middle slot is expanded to two slots in order to make space
4350     ** for the two elements in the FROM clause of the subquery.
4351     */
4352     if( nSubSrc>1 ){
4353       pSrc = sqlite3SrcListEnlarge(pParse, pSrc, nSubSrc-1,iFrom+1);
4354       if( pSrc==0 ) break;
4355       pParent->pSrc = pSrc;
4356     }
4357 
4358     /* Transfer the FROM clause terms from the subquery into the
4359     ** outer query.
4360     */
4361     for(i=0; i<nSubSrc; i++){
4362       SrcItem *pItem = &pSrc->a[i+iFrom];
4363       if( pItem->fg.isUsing ) sqlite3IdListDelete(db, pItem->u3.pUsing);
4364       assert( pItem->fg.isTabFunc==0 );
4365       *pItem = pSubSrc->a[i];
4366       iNewParent = pSubSrc->a[i].iCursor;
4367       memset(&pSubSrc->a[i], 0, sizeof(pSubSrc->a[i]));
4368     }
4369     pSrc->a[iFrom].fg.jointype = jointype;
4370 
4371     /* Now begin substituting subquery result set expressions for
4372     ** references to the iParent in the outer query.
4373     **
4374     ** Example:
4375     **
4376     **   SELECT a+5, b*10 FROM (SELECT x*3 AS a, y+10 AS b FROM t1) WHERE a>b;
4377     **   \                     \_____________ subquery __________/          /
4378     **    \_____________________ outer query ______________________________/
4379     **
4380     ** We look at every expression in the outer query and every place we see
4381     ** "a" we substitute "x*3" and every place we see "b" we substitute "y+10".
4382     */
4383     if( pSub->pOrderBy && (pParent->selFlags & SF_NoopOrderBy)==0 ){
4384       /* At this point, any non-zero iOrderByCol values indicate that the
4385       ** ORDER BY column expression is identical to the iOrderByCol'th
4386       ** expression returned by SELECT statement pSub. Since these values
4387       ** do not necessarily correspond to columns in SELECT statement pParent,
4388       ** zero them before transfering the ORDER BY clause.
4389       **
4390       ** Not doing this may cause an error if a subsequent call to this
4391       ** function attempts to flatten a compound sub-query into pParent
4392       ** (the only way this can happen is if the compound sub-query is
4393       ** currently part of pSub->pSrc). See ticket [d11a6e908f].  */
4394       ExprList *pOrderBy = pSub->pOrderBy;
4395       for(i=0; i<pOrderBy->nExpr; i++){
4396         pOrderBy->a[i].u.x.iOrderByCol = 0;
4397       }
4398       assert( pParent->pOrderBy==0 );
4399       pParent->pOrderBy = pOrderBy;
4400       pSub->pOrderBy = 0;
4401     }
4402     pWhere = pSub->pWhere;
4403     pSub->pWhere = 0;
4404     if( isLeftJoin>0 ){
4405       sqlite3SetJoinExpr(pWhere, iNewParent);
4406     }
4407     if( pWhere ){
4408       if( pParent->pWhere ){
4409         pParent->pWhere = sqlite3PExpr(pParse, TK_AND, pWhere, pParent->pWhere);
4410       }else{
4411         pParent->pWhere = pWhere;
4412       }
4413     }
4414     if( db->mallocFailed==0 ){
4415       SubstContext x;
4416       x.pParse = pParse;
4417       x.iTable = iParent;
4418       x.iNewTable = iNewParent;
4419       x.isLeftJoin = isLeftJoin;
4420       x.pEList = pSub->pEList;
4421       substSelect(&x, pParent, 0);
4422     }
4423 
4424     /* The flattened query is a compound if either the inner or the
4425     ** outer query is a compound. */
4426     pParent->selFlags |= pSub->selFlags & SF_Compound;
4427     assert( (pSub->selFlags & SF_Distinct)==0 ); /* restriction (17b) */
4428 
4429     /*
4430     ** SELECT ... FROM (SELECT ... LIMIT a OFFSET b) LIMIT x OFFSET y;
4431     **
4432     ** One is tempted to try to add a and b to combine the limits.  But this
4433     ** does not work if either limit is negative.
4434     */
4435     if( pSub->pLimit ){
4436       pParent->pLimit = pSub->pLimit;
4437       pSub->pLimit = 0;
4438     }
4439 
4440     /* Recompute the SrcList_item.colUsed masks for the flattened
4441     ** tables. */
4442     for(i=0; i<nSubSrc; i++){
4443       recomputeColumnsUsed(pParent, &pSrc->a[i+iFrom]);
4444     }
4445   }
4446 
4447   /* Finially, delete what is left of the subquery and return
4448   ** success.
4449   */
4450   sqlite3AggInfoPersistWalkerInit(&w, pParse);
4451   sqlite3WalkSelect(&w,pSub1);
4452   sqlite3SelectDelete(db, pSub1);
4453 
4454 #if TREETRACE_ENABLED
4455   if( sqlite3TreeTrace & 0x100 ){
4456     SELECTTRACE(0x100,pParse,p,("After flattening:\n"));
4457     sqlite3TreeViewSelect(0, p, 0);
4458   }
4459 #endif
4460 
4461   return 1;
4462 }
4463 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
4464 
4465 /*
4466 ** A structure to keep track of all of the column values that are fixed to
4467 ** a known value due to WHERE clause constraints of the form COLUMN=VALUE.
4468 */
4469 typedef struct WhereConst WhereConst;
4470 struct WhereConst {
4471   Parse *pParse;   /* Parsing context */
4472   u8 *pOomFault;   /* Pointer to pParse->db->mallocFailed */
4473   int nConst;      /* Number for COLUMN=CONSTANT terms */
4474   int nChng;       /* Number of times a constant is propagated */
4475   int bHasAffBlob; /* At least one column in apExpr[] as affinity BLOB */
4476   Expr **apExpr;   /* [i*2] is COLUMN and [i*2+1] is VALUE */
4477 };
4478 
4479 /*
4480 ** Add a new entry to the pConst object.  Except, do not add duplicate
4481 ** pColumn entires.  Also, do not add if doing so would not be appropriate.
4482 **
4483 ** The caller guarantees the pColumn is a column and pValue is a constant.
4484 ** This routine has to do some additional checks before completing the
4485 ** insert.
4486 */
4487 static void constInsert(
4488   WhereConst *pConst,  /* The WhereConst into which we are inserting */
4489   Expr *pColumn,       /* The COLUMN part of the constraint */
4490   Expr *pValue,        /* The VALUE part of the constraint */
4491   Expr *pExpr          /* Overall expression: COLUMN=VALUE or VALUE=COLUMN */
4492 ){
4493   int i;
4494   assert( pColumn->op==TK_COLUMN );
4495   assert( sqlite3ExprIsConstant(pValue) );
4496 
4497   if( ExprHasProperty(pColumn, EP_FixedCol) ) return;
4498   if( sqlite3ExprAffinity(pValue)!=0 ) return;
4499   if( !sqlite3IsBinary(sqlite3ExprCompareCollSeq(pConst->pParse,pExpr)) ){
4500     return;
4501   }
4502 
4503   /* 2018-10-25 ticket [cf5ed20f]
4504   ** Make sure the same pColumn is not inserted more than once */
4505   for(i=0; i<pConst->nConst; i++){
4506     const Expr *pE2 = pConst->apExpr[i*2];
4507     assert( pE2->op==TK_COLUMN );
4508     if( pE2->iTable==pColumn->iTable
4509      && pE2->iColumn==pColumn->iColumn
4510     ){
4511       return;  /* Already present.  Return without doing anything. */
4512     }
4513   }
4514   if( sqlite3ExprAffinity(pColumn)==SQLITE_AFF_BLOB ){
4515     pConst->bHasAffBlob = 1;
4516   }
4517 
4518   pConst->nConst++;
4519   pConst->apExpr = sqlite3DbReallocOrFree(pConst->pParse->db, pConst->apExpr,
4520                          pConst->nConst*2*sizeof(Expr*));
4521   if( pConst->apExpr==0 ){
4522     pConst->nConst = 0;
4523   }else{
4524     pConst->apExpr[pConst->nConst*2-2] = pColumn;
4525     pConst->apExpr[pConst->nConst*2-1] = pValue;
4526   }
4527 }
4528 
4529 /*
4530 ** Find all terms of COLUMN=VALUE or VALUE=COLUMN in pExpr where VALUE
4531 ** is a constant expression and where the term must be true because it
4532 ** is part of the AND-connected terms of the expression.  For each term
4533 ** found, add it to the pConst structure.
4534 */
4535 static void findConstInWhere(WhereConst *pConst, Expr *pExpr){
4536   Expr *pRight, *pLeft;
4537   if( NEVER(pExpr==0) ) return;
4538   if( ExprHasProperty(pExpr, EP_FromJoin) ) return;
4539   if( pExpr->op==TK_AND ){
4540     findConstInWhere(pConst, pExpr->pRight);
4541     findConstInWhere(pConst, pExpr->pLeft);
4542     return;
4543   }
4544   if( pExpr->op!=TK_EQ ) return;
4545   pRight = pExpr->pRight;
4546   pLeft = pExpr->pLeft;
4547   assert( pRight!=0 );
4548   assert( pLeft!=0 );
4549   if( pRight->op==TK_COLUMN && sqlite3ExprIsConstant(pLeft) ){
4550     constInsert(pConst,pRight,pLeft,pExpr);
4551   }
4552   if( pLeft->op==TK_COLUMN && sqlite3ExprIsConstant(pRight) ){
4553     constInsert(pConst,pLeft,pRight,pExpr);
4554   }
4555 }
4556 
4557 /*
4558 ** This is a helper function for Walker callback propagateConstantExprRewrite().
4559 **
4560 ** Argument pExpr is a candidate expression to be replaced by a value. If
4561 ** pExpr is equivalent to one of the columns named in pWalker->u.pConst,
4562 ** then overwrite it with the corresponding value. Except, do not do so
4563 ** if argument bIgnoreAffBlob is non-zero and the affinity of pExpr
4564 ** is SQLITE_AFF_BLOB.
4565 */
4566 static int propagateConstantExprRewriteOne(
4567   WhereConst *pConst,
4568   Expr *pExpr,
4569   int bIgnoreAffBlob
4570 ){
4571   int i;
4572   if( pConst->pOomFault[0] ) return WRC_Prune;
4573   if( pExpr->op!=TK_COLUMN ) return WRC_Continue;
4574   if( ExprHasProperty(pExpr, EP_FixedCol|EP_FromJoin) ){
4575     testcase( ExprHasProperty(pExpr, EP_FixedCol) );
4576     testcase( ExprHasProperty(pExpr, EP_FromJoin) );
4577     return WRC_Continue;
4578   }
4579   for(i=0; i<pConst->nConst; i++){
4580     Expr *pColumn = pConst->apExpr[i*2];
4581     if( pColumn==pExpr ) continue;
4582     if( pColumn->iTable!=pExpr->iTable ) continue;
4583     if( pColumn->iColumn!=pExpr->iColumn ) continue;
4584     if( bIgnoreAffBlob && sqlite3ExprAffinity(pColumn)==SQLITE_AFF_BLOB ){
4585       break;
4586     }
4587     /* A match is found.  Add the EP_FixedCol property */
4588     pConst->nChng++;
4589     ExprClearProperty(pExpr, EP_Leaf);
4590     ExprSetProperty(pExpr, EP_FixedCol);
4591     assert( pExpr->pLeft==0 );
4592     pExpr->pLeft = sqlite3ExprDup(pConst->pParse->db, pConst->apExpr[i*2+1], 0);
4593     if( pConst->pParse->db->mallocFailed ) return WRC_Prune;
4594     break;
4595   }
4596   return WRC_Prune;
4597 }
4598 
4599 /*
4600 ** This is a Walker expression callback. pExpr is a node from the WHERE
4601 ** clause of a SELECT statement. This function examines pExpr to see if
4602 ** any substitutions based on the contents of pWalker->u.pConst should
4603 ** be made to pExpr or its immediate children.
4604 **
4605 ** A substitution is made if:
4606 **
4607 **   + pExpr is a column with an affinity other than BLOB that matches
4608 **     one of the columns in pWalker->u.pConst, or
4609 **
4610 **   + pExpr is a binary comparison operator (=, <=, >=, <, >) that
4611 **     uses an affinity other than TEXT and one of its immediate
4612 **     children is a column that matches one of the columns in
4613 **     pWalker->u.pConst.
4614 */
4615 static int propagateConstantExprRewrite(Walker *pWalker, Expr *pExpr){
4616   WhereConst *pConst = pWalker->u.pConst;
4617   assert( TK_GT==TK_EQ+1 );
4618   assert( TK_LE==TK_EQ+2 );
4619   assert( TK_LT==TK_EQ+3 );
4620   assert( TK_GE==TK_EQ+4 );
4621   if( pConst->bHasAffBlob ){
4622     if( (pExpr->op>=TK_EQ && pExpr->op<=TK_GE)
4623      || pExpr->op==TK_IS
4624     ){
4625       propagateConstantExprRewriteOne(pConst, pExpr->pLeft, 0);
4626       if( pConst->pOomFault[0] ) return WRC_Prune;
4627       if( sqlite3ExprAffinity(pExpr->pLeft)!=SQLITE_AFF_TEXT ){
4628         propagateConstantExprRewriteOne(pConst, pExpr->pRight, 0);
4629       }
4630     }
4631   }
4632   return propagateConstantExprRewriteOne(pConst, pExpr, pConst->bHasAffBlob);
4633 }
4634 
4635 /*
4636 ** The WHERE-clause constant propagation optimization.
4637 **
4638 ** If the WHERE clause contains terms of the form COLUMN=CONSTANT or
4639 ** CONSTANT=COLUMN that are top-level AND-connected terms that are not
4640 ** part of a ON clause from a LEFT JOIN, then throughout the query
4641 ** replace all other occurrences of COLUMN with CONSTANT.
4642 **
4643 ** For example, the query:
4644 **
4645 **      SELECT * FROM t1, t2, t3 WHERE t1.a=39 AND t2.b=t1.a AND t3.c=t2.b
4646 **
4647 ** Is transformed into
4648 **
4649 **      SELECT * FROM t1, t2, t3 WHERE t1.a=39 AND t2.b=39 AND t3.c=39
4650 **
4651 ** Return true if any transformations where made and false if not.
4652 **
4653 ** Implementation note:  Constant propagation is tricky due to affinity
4654 ** and collating sequence interactions.  Consider this example:
4655 **
4656 **    CREATE TABLE t1(a INT,b TEXT);
4657 **    INSERT INTO t1 VALUES(123,'0123');
4658 **    SELECT * FROM t1 WHERE a=123 AND b=a;
4659 **    SELECT * FROM t1 WHERE a=123 AND b=123;
4660 **
4661 ** The two SELECT statements above should return different answers.  b=a
4662 ** is alway true because the comparison uses numeric affinity, but b=123
4663 ** is false because it uses text affinity and '0123' is not the same as '123'.
4664 ** To work around this, the expression tree is not actually changed from
4665 ** "b=a" to "b=123" but rather the "a" in "b=a" is tagged with EP_FixedCol
4666 ** and the "123" value is hung off of the pLeft pointer.  Code generator
4667 ** routines know to generate the constant "123" instead of looking up the
4668 ** column value.  Also, to avoid collation problems, this optimization is
4669 ** only attempted if the "a=123" term uses the default BINARY collation.
4670 **
4671 ** 2021-05-25 forum post 6a06202608: Another troublesome case is...
4672 **
4673 **    CREATE TABLE t1(x);
4674 **    INSERT INTO t1 VALUES(10.0);
4675 **    SELECT 1 FROM t1 WHERE x=10 AND x LIKE 10;
4676 **
4677 ** The query should return no rows, because the t1.x value is '10.0' not '10'
4678 ** and '10.0' is not LIKE '10'.  But if we are not careful, the first WHERE
4679 ** term "x=10" will cause the second WHERE term to become "10 LIKE 10",
4680 ** resulting in a false positive.  To avoid this, constant propagation for
4681 ** columns with BLOB affinity is only allowed if the constant is used with
4682 ** operators ==, <=, <, >=, >, or IS in a way that will cause the correct
4683 ** type conversions to occur.  See logic associated with the bHasAffBlob flag
4684 ** for details.
4685 */
4686 static int propagateConstants(
4687   Parse *pParse,   /* The parsing context */
4688   Select *p        /* The query in which to propagate constants */
4689 ){
4690   WhereConst x;
4691   Walker w;
4692   int nChng = 0;
4693   x.pParse = pParse;
4694   x.pOomFault = &pParse->db->mallocFailed;
4695   do{
4696     x.nConst = 0;
4697     x.nChng = 0;
4698     x.apExpr = 0;
4699     x.bHasAffBlob = 0;
4700     findConstInWhere(&x, p->pWhere);
4701     if( x.nConst ){
4702       memset(&w, 0, sizeof(w));
4703       w.pParse = pParse;
4704       w.xExprCallback = propagateConstantExprRewrite;
4705       w.xSelectCallback = sqlite3SelectWalkNoop;
4706       w.xSelectCallback2 = 0;
4707       w.walkerDepth = 0;
4708       w.u.pConst = &x;
4709       sqlite3WalkExpr(&w, p->pWhere);
4710       sqlite3DbFree(x.pParse->db, x.apExpr);
4711       nChng += x.nChng;
4712     }
4713   }while( x.nChng );
4714   return nChng;
4715 }
4716 
4717 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
4718 # if !defined(SQLITE_OMIT_WINDOWFUNC)
4719 /*
4720 ** This function is called to determine whether or not it is safe to
4721 ** push WHERE clause expression pExpr down to FROM clause sub-query
4722 ** pSubq, which contains at least one window function. Return 1
4723 ** if it is safe and the expression should be pushed down, or 0
4724 ** otherwise.
4725 **
4726 ** It is only safe to push the expression down if it consists only
4727 ** of constants and copies of expressions that appear in the PARTITION
4728 ** BY clause of all window function used by the sub-query. It is safe
4729 ** to filter out entire partitions, but not rows within partitions, as
4730 ** this may change the results of the window functions.
4731 **
4732 ** At the time this function is called it is guaranteed that
4733 **
4734 **   * the sub-query uses only one distinct window frame, and
4735 **   * that the window frame has a PARTITION BY clase.
4736 */
4737 static int pushDownWindowCheck(Parse *pParse, Select *pSubq, Expr *pExpr){
4738   assert( pSubq->pWin->pPartition );
4739   assert( (pSubq->selFlags & SF_MultiPart)==0 );
4740   assert( pSubq->pPrior==0 );
4741   return sqlite3ExprIsConstantOrGroupBy(pParse, pExpr, pSubq->pWin->pPartition);
4742 }
4743 # endif /* SQLITE_OMIT_WINDOWFUNC */
4744 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
4745 
4746 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
4747 /*
4748 ** Make copies of relevant WHERE clause terms of the outer query into
4749 ** the WHERE clause of subquery.  Example:
4750 **
4751 **    SELECT * FROM (SELECT a AS x, c-d AS y FROM t1) WHERE x=5 AND y=10;
4752 **
4753 ** Transformed into:
4754 **
4755 **    SELECT * FROM (SELECT a AS x, c-d AS y FROM t1 WHERE a=5 AND c-d=10)
4756 **     WHERE x=5 AND y=10;
4757 **
4758 ** The hope is that the terms added to the inner query will make it more
4759 ** efficient.
4760 **
4761 ** Do not attempt this optimization if:
4762 **
4763 **   (1) (** This restriction was removed on 2017-09-29.  We used to
4764 **           disallow this optimization for aggregate subqueries, but now
4765 **           it is allowed by putting the extra terms on the HAVING clause.
4766 **           The added HAVING clause is pointless if the subquery lacks
4767 **           a GROUP BY clause.  But such a HAVING clause is also harmless
4768 **           so there does not appear to be any reason to add extra logic
4769 **           to suppress it. **)
4770 **
4771 **   (2) The inner query is the recursive part of a common table expression.
4772 **
4773 **   (3) The inner query has a LIMIT clause (since the changes to the WHERE
4774 **       clause would change the meaning of the LIMIT).
4775 **
4776 **   (4) The inner query is the right operand of a LEFT JOIN and the
4777 **       expression to be pushed down does not come from the ON clause
4778 **       on that LEFT JOIN.
4779 **
4780 **   (5) The WHERE clause expression originates in the ON or USING clause
4781 **       of a LEFT JOIN where iCursor is not the right-hand table of that
4782 **       left join.  An example:
4783 **
4784 **           SELECT *
4785 **           FROM (SELECT 1 AS a1 UNION ALL SELECT 2) AS aa
4786 **           JOIN (SELECT 1 AS b2 UNION ALL SELECT 2) AS bb ON (a1=b2)
4787 **           LEFT JOIN (SELECT 8 AS c3 UNION ALL SELECT 9) AS cc ON (b2=2);
4788 **
4789 **       The correct answer is three rows:  (1,1,NULL),(2,2,8),(2,2,9).
4790 **       But if the (b2=2) term were to be pushed down into the bb subquery,
4791 **       then the (1,1,NULL) row would be suppressed.
4792 **
4793 **   (6) Window functions make things tricky as changes to the WHERE clause
4794 **       of the inner query could change the window over which window
4795 **       functions are calculated. Therefore, do not attempt the optimization
4796 **       if:
4797 **
4798 **     (6a) The inner query uses multiple incompatible window partitions.
4799 **
4800 **     (6b) The inner query is a compound and uses window-functions.
4801 **
4802 **     (6c) The WHERE clause does not consist entirely of constants and
4803 **          copies of expressions found in the PARTITION BY clause of
4804 **          all window-functions used by the sub-query. It is safe to
4805 **          filter out entire partitions, as this does not change the
4806 **          window over which any window-function is calculated.
4807 **
4808 **   (7) The inner query is a Common Table Expression (CTE) that should
4809 **       be materialized.  (This restriction is implemented in the calling
4810 **       routine.)
4811 **
4812 ** Return 0 if no changes are made and non-zero if one or more WHERE clause
4813 ** terms are duplicated into the subquery.
4814 */
4815 static int pushDownWhereTerms(
4816   Parse *pParse,        /* Parse context (for malloc() and error reporting) */
4817   Select *pSubq,        /* The subquery whose WHERE clause is to be augmented */
4818   Expr *pWhere,         /* The WHERE clause of the outer query */
4819   int iCursor,          /* Cursor number of the subquery */
4820   int isLeftJoin        /* True if pSubq is the right term of a LEFT JOIN */
4821 ){
4822   Expr *pNew;
4823   int nChng = 0;
4824   if( pWhere==0 ) return 0;
4825   if( pSubq->selFlags & (SF_Recursive|SF_MultiPart) ) return 0;
4826 
4827 #ifndef SQLITE_OMIT_WINDOWFUNC
4828   if( pSubq->pPrior ){
4829     Select *pSel;
4830     for(pSel=pSubq; pSel; pSel=pSel->pPrior){
4831       if( pSel->pWin ) return 0;    /* restriction (6b) */
4832     }
4833   }else{
4834     if( pSubq->pWin && pSubq->pWin->pPartition==0 ) return 0;
4835   }
4836 #endif
4837 
4838 #ifdef SQLITE_DEBUG
4839   /* Only the first term of a compound can have a WITH clause.  But make
4840   ** sure no other terms are marked SF_Recursive in case something changes
4841   ** in the future.
4842   */
4843   {
4844     Select *pX;
4845     for(pX=pSubq; pX; pX=pX->pPrior){
4846       assert( (pX->selFlags & (SF_Recursive))==0 );
4847     }
4848   }
4849 #endif
4850 
4851   if( pSubq->pLimit!=0 ){
4852     return 0; /* restriction (3) */
4853   }
4854   while( pWhere->op==TK_AND ){
4855     nChng += pushDownWhereTerms(pParse, pSubq, pWhere->pRight,
4856                                 iCursor, isLeftJoin);
4857     pWhere = pWhere->pLeft;
4858   }
4859   if( isLeftJoin
4860    && (ExprHasProperty(pWhere,EP_FromJoin)==0
4861          || pWhere->w.iRightJoinTable!=iCursor)
4862   ){
4863     return 0; /* restriction (4) */
4864   }
4865   if( ExprHasProperty(pWhere,EP_FromJoin)
4866    && pWhere->w.iRightJoinTable!=iCursor
4867   ){
4868     return 0; /* restriction (5) */
4869   }
4870   if( sqlite3ExprIsTableConstant(pWhere, iCursor) ){
4871     nChng++;
4872     pSubq->selFlags |= SF_PushDown;
4873     while( pSubq ){
4874       SubstContext x;
4875       pNew = sqlite3ExprDup(pParse->db, pWhere, 0);
4876       unsetJoinExpr(pNew, -1);
4877       x.pParse = pParse;
4878       x.iTable = iCursor;
4879       x.iNewTable = iCursor;
4880       x.isLeftJoin = 0;
4881       x.pEList = pSubq->pEList;
4882       pNew = substExpr(&x, pNew);
4883 #ifndef SQLITE_OMIT_WINDOWFUNC
4884       if( pSubq->pWin && 0==pushDownWindowCheck(pParse, pSubq, pNew) ){
4885         /* Restriction 6c has prevented push-down in this case */
4886         sqlite3ExprDelete(pParse->db, pNew);
4887         nChng--;
4888         break;
4889       }
4890 #endif
4891       if( pSubq->selFlags & SF_Aggregate ){
4892         pSubq->pHaving = sqlite3ExprAnd(pParse, pSubq->pHaving, pNew);
4893       }else{
4894         pSubq->pWhere = sqlite3ExprAnd(pParse, pSubq->pWhere, pNew);
4895       }
4896       pSubq = pSubq->pPrior;
4897     }
4898   }
4899   return nChng;
4900 }
4901 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
4902 
4903 /*
4904 ** The pFunc is the only aggregate function in the query.  Check to see
4905 ** if the query is a candidate for the min/max optimization.
4906 **
4907 ** If the query is a candidate for the min/max optimization, then set
4908 ** *ppMinMax to be an ORDER BY clause to be used for the optimization
4909 ** and return either WHERE_ORDERBY_MIN or WHERE_ORDERBY_MAX depending on
4910 ** whether pFunc is a min() or max() function.
4911 **
4912 ** If the query is not a candidate for the min/max optimization, return
4913 ** WHERE_ORDERBY_NORMAL (which must be zero).
4914 **
4915 ** This routine must be called after aggregate functions have been
4916 ** located but before their arguments have been subjected to aggregate
4917 ** analysis.
4918 */
4919 static u8 minMaxQuery(sqlite3 *db, Expr *pFunc, ExprList **ppMinMax){
4920   int eRet = WHERE_ORDERBY_NORMAL;      /* Return value */
4921   ExprList *pEList;                     /* Arguments to agg function */
4922   const char *zFunc;                    /* Name of aggregate function pFunc */
4923   ExprList *pOrderBy;
4924   u8 sortFlags = 0;
4925 
4926   assert( *ppMinMax==0 );
4927   assert( pFunc->op==TK_AGG_FUNCTION );
4928   assert( !IsWindowFunc(pFunc) );
4929   assert( ExprUseXList(pFunc) );
4930   pEList = pFunc->x.pList;
4931   if( pEList==0
4932    || pEList->nExpr!=1
4933    || ExprHasProperty(pFunc, EP_WinFunc)
4934    || OptimizationDisabled(db, SQLITE_MinMaxOpt)
4935   ){
4936     return eRet;
4937   }
4938   assert( !ExprHasProperty(pFunc, EP_IntValue) );
4939   zFunc = pFunc->u.zToken;
4940   if( sqlite3StrICmp(zFunc, "min")==0 ){
4941     eRet = WHERE_ORDERBY_MIN;
4942     if( sqlite3ExprCanBeNull(pEList->a[0].pExpr) ){
4943       sortFlags = KEYINFO_ORDER_BIGNULL;
4944     }
4945   }else if( sqlite3StrICmp(zFunc, "max")==0 ){
4946     eRet = WHERE_ORDERBY_MAX;
4947     sortFlags = KEYINFO_ORDER_DESC;
4948   }else{
4949     return eRet;
4950   }
4951   *ppMinMax = pOrderBy = sqlite3ExprListDup(db, pEList, 0);
4952   assert( pOrderBy!=0 || db->mallocFailed );
4953   if( pOrderBy ) pOrderBy->a[0].sortFlags = sortFlags;
4954   return eRet;
4955 }
4956 
4957 /*
4958 ** The select statement passed as the first argument is an aggregate query.
4959 ** The second argument is the associated aggregate-info object. This
4960 ** function tests if the SELECT is of the form:
4961 **
4962 **   SELECT count(*) FROM <tbl>
4963 **
4964 ** where table is a database table, not a sub-select or view. If the query
4965 ** does match this pattern, then a pointer to the Table object representing
4966 ** <tbl> is returned. Otherwise, NULL is returned.
4967 **
4968 ** This routine checks to see if it is safe to use the count optimization.
4969 ** A correct answer is still obtained (though perhaps more slowly) if
4970 ** this routine returns NULL when it could have returned a table pointer.
4971 ** But returning the pointer when NULL should have been returned can
4972 ** result in incorrect answers and/or crashes.  So, when in doubt, return NULL.
4973 */
4974 static Table *isSimpleCount(Select *p, AggInfo *pAggInfo){
4975   Table *pTab;
4976   Expr *pExpr;
4977 
4978   assert( !p->pGroupBy );
4979 
4980   if( p->pWhere
4981    || p->pEList->nExpr!=1
4982    || p->pSrc->nSrc!=1
4983    || p->pSrc->a[0].pSelect
4984    || pAggInfo->nFunc!=1
4985   ){
4986     return 0;
4987   }
4988   pTab = p->pSrc->a[0].pTab;
4989   assert( pTab!=0 );
4990   assert( !IsView(pTab) );
4991   if( !IsOrdinaryTable(pTab) ) return 0;
4992   pExpr = p->pEList->a[0].pExpr;
4993   assert( pExpr!=0 );
4994   if( pExpr->op!=TK_AGG_FUNCTION ) return 0;
4995   if( pExpr->pAggInfo!=pAggInfo ) return 0;
4996   if( (pAggInfo->aFunc[0].pFunc->funcFlags&SQLITE_FUNC_COUNT)==0 ) return 0;
4997   assert( pAggInfo->aFunc[0].pFExpr==pExpr );
4998   testcase( ExprHasProperty(pExpr, EP_Distinct) );
4999   testcase( ExprHasProperty(pExpr, EP_WinFunc) );
5000   if( ExprHasProperty(pExpr, EP_Distinct|EP_WinFunc) ) return 0;
5001 
5002   return pTab;
5003 }
5004 
5005 /*
5006 ** If the source-list item passed as an argument was augmented with an
5007 ** INDEXED BY clause, then try to locate the specified index. If there
5008 ** was such a clause and the named index cannot be found, return
5009 ** SQLITE_ERROR and leave an error in pParse. Otherwise, populate
5010 ** pFrom->pIndex and return SQLITE_OK.
5011 */
5012 int sqlite3IndexedByLookup(Parse *pParse, SrcItem *pFrom){
5013   Table *pTab = pFrom->pTab;
5014   char *zIndexedBy = pFrom->u1.zIndexedBy;
5015   Index *pIdx;
5016   assert( pTab!=0 );
5017   assert( pFrom->fg.isIndexedBy!=0 );
5018 
5019   for(pIdx=pTab->pIndex;
5020       pIdx && sqlite3StrICmp(pIdx->zName, zIndexedBy);
5021       pIdx=pIdx->pNext
5022   );
5023   if( !pIdx ){
5024     sqlite3ErrorMsg(pParse, "no such index: %s", zIndexedBy, 0);
5025     pParse->checkSchema = 1;
5026     return SQLITE_ERROR;
5027   }
5028   assert( pFrom->fg.isCte==0 );
5029   pFrom->u2.pIBIndex = pIdx;
5030   return SQLITE_OK;
5031 }
5032 
5033 /*
5034 ** Detect compound SELECT statements that use an ORDER BY clause with
5035 ** an alternative collating sequence.
5036 **
5037 **    SELECT ... FROM t1 EXCEPT SELECT ... FROM t2 ORDER BY .. COLLATE ...
5038 **
5039 ** These are rewritten as a subquery:
5040 **
5041 **    SELECT * FROM (SELECT ... FROM t1 EXCEPT SELECT ... FROM t2)
5042 **     ORDER BY ... COLLATE ...
5043 **
5044 ** This transformation is necessary because the multiSelectOrderBy() routine
5045 ** above that generates the code for a compound SELECT with an ORDER BY clause
5046 ** uses a merge algorithm that requires the same collating sequence on the
5047 ** result columns as on the ORDER BY clause.  See ticket
5048 ** http://www.sqlite.org/src/info/6709574d2a
5049 **
5050 ** This transformation is only needed for EXCEPT, INTERSECT, and UNION.
5051 ** The UNION ALL operator works fine with multiSelectOrderBy() even when
5052 ** there are COLLATE terms in the ORDER BY.
5053 */
5054 static int convertCompoundSelectToSubquery(Walker *pWalker, Select *p){
5055   int i;
5056   Select *pNew;
5057   Select *pX;
5058   sqlite3 *db;
5059   struct ExprList_item *a;
5060   SrcList *pNewSrc;
5061   Parse *pParse;
5062   Token dummy;
5063 
5064   if( p->pPrior==0 ) return WRC_Continue;
5065   if( p->pOrderBy==0 ) return WRC_Continue;
5066   for(pX=p; pX && (pX->op==TK_ALL || pX->op==TK_SELECT); pX=pX->pPrior){}
5067   if( pX==0 ) return WRC_Continue;
5068   a = p->pOrderBy->a;
5069 #ifndef SQLITE_OMIT_WINDOWFUNC
5070   /* If iOrderByCol is already non-zero, then it has already been matched
5071   ** to a result column of the SELECT statement. This occurs when the
5072   ** SELECT is rewritten for window-functions processing and then passed
5073   ** to sqlite3SelectPrep() and similar a second time. The rewriting done
5074   ** by this function is not required in this case. */
5075   if( a[0].u.x.iOrderByCol ) return WRC_Continue;
5076 #endif
5077   for(i=p->pOrderBy->nExpr-1; i>=0; i--){
5078     if( a[i].pExpr->flags & EP_Collate ) break;
5079   }
5080   if( i<0 ) return WRC_Continue;
5081 
5082   /* If we reach this point, that means the transformation is required. */
5083 
5084   pParse = pWalker->pParse;
5085   db = pParse->db;
5086   pNew = sqlite3DbMallocZero(db, sizeof(*pNew) );
5087   if( pNew==0 ) return WRC_Abort;
5088   memset(&dummy, 0, sizeof(dummy));
5089   pNewSrc = sqlite3SrcListAppendFromTerm(pParse,0,0,0,&dummy,pNew,0);
5090   if( pNewSrc==0 ) return WRC_Abort;
5091   *pNew = *p;
5092   p->pSrc = pNewSrc;
5093   p->pEList = sqlite3ExprListAppend(pParse, 0, sqlite3Expr(db, TK_ASTERISK, 0));
5094   p->op = TK_SELECT;
5095   p->pWhere = 0;
5096   pNew->pGroupBy = 0;
5097   pNew->pHaving = 0;
5098   pNew->pOrderBy = 0;
5099   p->pPrior = 0;
5100   p->pNext = 0;
5101   p->pWith = 0;
5102 #ifndef SQLITE_OMIT_WINDOWFUNC
5103   p->pWinDefn = 0;
5104 #endif
5105   p->selFlags &= ~SF_Compound;
5106   assert( (p->selFlags & SF_Converted)==0 );
5107   p->selFlags |= SF_Converted;
5108   assert( pNew->pPrior!=0 );
5109   pNew->pPrior->pNext = pNew;
5110   pNew->pLimit = 0;
5111   return WRC_Continue;
5112 }
5113 
5114 /*
5115 ** Check to see if the FROM clause term pFrom has table-valued function
5116 ** arguments.  If it does, leave an error message in pParse and return
5117 ** non-zero, since pFrom is not allowed to be a table-valued function.
5118 */
5119 static int cannotBeFunction(Parse *pParse, SrcItem *pFrom){
5120   if( pFrom->fg.isTabFunc ){
5121     sqlite3ErrorMsg(pParse, "'%s' is not a function", pFrom->zName);
5122     return 1;
5123   }
5124   return 0;
5125 }
5126 
5127 #ifndef SQLITE_OMIT_CTE
5128 /*
5129 ** Argument pWith (which may be NULL) points to a linked list of nested
5130 ** WITH contexts, from inner to outermost. If the table identified by
5131 ** FROM clause element pItem is really a common-table-expression (CTE)
5132 ** then return a pointer to the CTE definition for that table. Otherwise
5133 ** return NULL.
5134 **
5135 ** If a non-NULL value is returned, set *ppContext to point to the With
5136 ** object that the returned CTE belongs to.
5137 */
5138 static struct Cte *searchWith(
5139   With *pWith,                    /* Current innermost WITH clause */
5140   SrcItem *pItem,                 /* FROM clause element to resolve */
5141   With **ppContext                /* OUT: WITH clause return value belongs to */
5142 ){
5143   const char *zName = pItem->zName;
5144   With *p;
5145   assert( pItem->zDatabase==0 );
5146   assert( zName!=0 );
5147   for(p=pWith; p; p=p->pOuter){
5148     int i;
5149     for(i=0; i<p->nCte; i++){
5150       if( sqlite3StrICmp(zName, p->a[i].zName)==0 ){
5151         *ppContext = p;
5152         return &p->a[i];
5153       }
5154     }
5155     if( p->bView ) break;
5156   }
5157   return 0;
5158 }
5159 
5160 /* The code generator maintains a stack of active WITH clauses
5161 ** with the inner-most WITH clause being at the top of the stack.
5162 **
5163 ** This routine pushes the WITH clause passed as the second argument
5164 ** onto the top of the stack. If argument bFree is true, then this
5165 ** WITH clause will never be popped from the stack but should instead
5166 ** be freed along with the Parse object. In other cases, when
5167 ** bFree==0, the With object will be freed along with the SELECT
5168 ** statement with which it is associated.
5169 **
5170 ** This routine returns a copy of pWith.  Or, if bFree is true and
5171 ** the pWith object is destroyed immediately due to an OOM condition,
5172 ** then this routine return NULL.
5173 **
5174 ** If bFree is true, do not continue to use the pWith pointer after
5175 ** calling this routine,  Instead, use only the return value.
5176 */
5177 With *sqlite3WithPush(Parse *pParse, With *pWith, u8 bFree){
5178   if( pWith ){
5179     if( bFree ){
5180       pWith = (With*)sqlite3ParserAddCleanup(pParse,
5181                       (void(*)(sqlite3*,void*))sqlite3WithDelete,
5182                       pWith);
5183       if( pWith==0 ) return 0;
5184     }
5185     if( pParse->nErr==0 ){
5186       assert( pParse->pWith!=pWith );
5187       pWith->pOuter = pParse->pWith;
5188       pParse->pWith = pWith;
5189     }
5190   }
5191   return pWith;
5192 }
5193 
5194 /*
5195 ** This function checks if argument pFrom refers to a CTE declared by
5196 ** a WITH clause on the stack currently maintained by the parser (on the
5197 ** pParse->pWith linked list).  And if currently processing a CTE
5198 ** CTE expression, through routine checks to see if the reference is
5199 ** a recursive reference to the CTE.
5200 **
5201 ** If pFrom matches a CTE according to either of these two above, pFrom->pTab
5202 ** and other fields are populated accordingly.
5203 **
5204 ** Return 0 if no match is found.
5205 ** Return 1 if a match is found.
5206 ** Return 2 if an error condition is detected.
5207 */
5208 static int resolveFromTermToCte(
5209   Parse *pParse,                  /* The parsing context */
5210   Walker *pWalker,                /* Current tree walker */
5211   SrcItem *pFrom                  /* The FROM clause term to check */
5212 ){
5213   Cte *pCte;               /* Matched CTE (or NULL if no match) */
5214   With *pWith;             /* The matching WITH */
5215 
5216   assert( pFrom->pTab==0 );
5217   if( pParse->pWith==0 ){
5218     /* There are no WITH clauses in the stack.  No match is possible */
5219     return 0;
5220   }
5221   if( pParse->nErr ){
5222     /* Prior errors might have left pParse->pWith in a goofy state, so
5223     ** go no further. */
5224     return 0;
5225   }
5226   if( pFrom->zDatabase!=0 ){
5227     /* The FROM term contains a schema qualifier (ex: main.t1) and so
5228     ** it cannot possibly be a CTE reference. */
5229     return 0;
5230   }
5231   if( pFrom->fg.notCte ){
5232     /* The FROM term is specifically excluded from matching a CTE.
5233     **   (1)  It is part of a trigger that used to have zDatabase but had
5234     **        zDatabase removed by sqlite3FixTriggerStep().
5235     **   (2)  This is the first term in the FROM clause of an UPDATE.
5236     */
5237     return 0;
5238   }
5239   pCte = searchWith(pParse->pWith, pFrom, &pWith);
5240   if( pCte ){
5241     sqlite3 *db = pParse->db;
5242     Table *pTab;
5243     ExprList *pEList;
5244     Select *pSel;
5245     Select *pLeft;                /* Left-most SELECT statement */
5246     Select *pRecTerm;             /* Left-most recursive term */
5247     int bMayRecursive;            /* True if compound joined by UNION [ALL] */
5248     With *pSavedWith;             /* Initial value of pParse->pWith */
5249     int iRecTab = -1;             /* Cursor for recursive table */
5250     CteUse *pCteUse;
5251 
5252     /* If pCte->zCteErr is non-NULL at this point, then this is an illegal
5253     ** recursive reference to CTE pCte. Leave an error in pParse and return
5254     ** early. If pCte->zCteErr is NULL, then this is not a recursive reference.
5255     ** In this case, proceed.  */
5256     if( pCte->zCteErr ){
5257       sqlite3ErrorMsg(pParse, pCte->zCteErr, pCte->zName);
5258       return 2;
5259     }
5260     if( cannotBeFunction(pParse, pFrom) ) return 2;
5261 
5262     assert( pFrom->pTab==0 );
5263     pTab = sqlite3DbMallocZero(db, sizeof(Table));
5264     if( pTab==0 ) return 2;
5265     pCteUse = pCte->pUse;
5266     if( pCteUse==0 ){
5267       pCte->pUse = pCteUse = sqlite3DbMallocZero(db, sizeof(pCteUse[0]));
5268       if( pCteUse==0
5269        || sqlite3ParserAddCleanup(pParse,sqlite3DbFree,pCteUse)==0
5270       ){
5271         sqlite3DbFree(db, pTab);
5272         return 2;
5273       }
5274       pCteUse->eM10d = pCte->eM10d;
5275     }
5276     pFrom->pTab = pTab;
5277     pTab->nTabRef = 1;
5278     pTab->zName = sqlite3DbStrDup(db, pCte->zName);
5279     pTab->iPKey = -1;
5280     pTab->nRowLogEst = 200; assert( 200==sqlite3LogEst(1048576) );
5281     pTab->tabFlags |= TF_Ephemeral | TF_NoVisibleRowid;
5282     pFrom->pSelect = sqlite3SelectDup(db, pCte->pSelect, 0);
5283     if( db->mallocFailed ) return 2;
5284     pFrom->pSelect->selFlags |= SF_CopyCte;
5285     assert( pFrom->pSelect );
5286     if( pFrom->fg.isIndexedBy ){
5287       sqlite3ErrorMsg(pParse, "no such index: \"%s\"", pFrom->u1.zIndexedBy);
5288       return 2;
5289     }
5290     pFrom->fg.isCte = 1;
5291     pFrom->u2.pCteUse = pCteUse;
5292     pCteUse->nUse++;
5293     if( pCteUse->nUse>=2 && pCteUse->eM10d==M10d_Any ){
5294       pCteUse->eM10d = M10d_Yes;
5295     }
5296 
5297     /* Check if this is a recursive CTE. */
5298     pRecTerm = pSel = pFrom->pSelect;
5299     bMayRecursive = ( pSel->op==TK_ALL || pSel->op==TK_UNION );
5300     while( bMayRecursive && pRecTerm->op==pSel->op ){
5301       int i;
5302       SrcList *pSrc = pRecTerm->pSrc;
5303       assert( pRecTerm->pPrior!=0 );
5304       for(i=0; i<pSrc->nSrc; i++){
5305         SrcItem *pItem = &pSrc->a[i];
5306         if( pItem->zDatabase==0
5307          && pItem->zName!=0
5308          && 0==sqlite3StrICmp(pItem->zName, pCte->zName)
5309         ){
5310           pItem->pTab = pTab;
5311           pTab->nTabRef++;
5312           pItem->fg.isRecursive = 1;
5313           if( pRecTerm->selFlags & SF_Recursive ){
5314             sqlite3ErrorMsg(pParse,
5315                "multiple references to recursive table: %s", pCte->zName
5316             );
5317             return 2;
5318           }
5319           pRecTerm->selFlags |= SF_Recursive;
5320           if( iRecTab<0 ) iRecTab = pParse->nTab++;
5321           pItem->iCursor = iRecTab;
5322         }
5323       }
5324       if( (pRecTerm->selFlags & SF_Recursive)==0 ) break;
5325       pRecTerm = pRecTerm->pPrior;
5326     }
5327 
5328     pCte->zCteErr = "circular reference: %s";
5329     pSavedWith = pParse->pWith;
5330     pParse->pWith = pWith;
5331     if( pSel->selFlags & SF_Recursive ){
5332       int rc;
5333       assert( pRecTerm!=0 );
5334       assert( (pRecTerm->selFlags & SF_Recursive)==0 );
5335       assert( pRecTerm->pNext!=0 );
5336       assert( (pRecTerm->pNext->selFlags & SF_Recursive)!=0 );
5337       assert( pRecTerm->pWith==0 );
5338       pRecTerm->pWith = pSel->pWith;
5339       rc = sqlite3WalkSelect(pWalker, pRecTerm);
5340       pRecTerm->pWith = 0;
5341       if( rc ){
5342         pParse->pWith = pSavedWith;
5343         return 2;
5344       }
5345     }else{
5346       if( sqlite3WalkSelect(pWalker, pSel) ){
5347         pParse->pWith = pSavedWith;
5348         return 2;
5349       }
5350     }
5351     pParse->pWith = pWith;
5352 
5353     for(pLeft=pSel; pLeft->pPrior; pLeft=pLeft->pPrior);
5354     pEList = pLeft->pEList;
5355     if( pCte->pCols ){
5356       if( pEList && pEList->nExpr!=pCte->pCols->nExpr ){
5357         sqlite3ErrorMsg(pParse, "table %s has %d values for %d columns",
5358             pCte->zName, pEList->nExpr, pCte->pCols->nExpr
5359         );
5360         pParse->pWith = pSavedWith;
5361         return 2;
5362       }
5363       pEList = pCte->pCols;
5364     }
5365 
5366     sqlite3ColumnsFromExprList(pParse, pEList, &pTab->nCol, &pTab->aCol);
5367     if( bMayRecursive ){
5368       if( pSel->selFlags & SF_Recursive ){
5369         pCte->zCteErr = "multiple recursive references: %s";
5370       }else{
5371         pCte->zCteErr = "recursive reference in a subquery: %s";
5372       }
5373       sqlite3WalkSelect(pWalker, pSel);
5374     }
5375     pCte->zCteErr = 0;
5376     pParse->pWith = pSavedWith;
5377     return 1;  /* Success */
5378   }
5379   return 0;  /* No match */
5380 }
5381 #endif
5382 
5383 #ifndef SQLITE_OMIT_CTE
5384 /*
5385 ** If the SELECT passed as the second argument has an associated WITH
5386 ** clause, pop it from the stack stored as part of the Parse object.
5387 **
5388 ** This function is used as the xSelectCallback2() callback by
5389 ** sqlite3SelectExpand() when walking a SELECT tree to resolve table
5390 ** names and other FROM clause elements.
5391 */
5392 void sqlite3SelectPopWith(Walker *pWalker, Select *p){
5393   Parse *pParse = pWalker->pParse;
5394   if( OK_IF_ALWAYS_TRUE(pParse->pWith) && p->pPrior==0 ){
5395     With *pWith = findRightmost(p)->pWith;
5396     if( pWith!=0 ){
5397       assert( pParse->pWith==pWith || pParse->nErr );
5398       pParse->pWith = pWith->pOuter;
5399     }
5400   }
5401 }
5402 #endif
5403 
5404 /*
5405 ** The SrcList_item structure passed as the second argument represents a
5406 ** sub-query in the FROM clause of a SELECT statement. This function
5407 ** allocates and populates the SrcList_item.pTab object. If successful,
5408 ** SQLITE_OK is returned. Otherwise, if an OOM error is encountered,
5409 ** SQLITE_NOMEM.
5410 */
5411 int sqlite3ExpandSubquery(Parse *pParse, SrcItem *pFrom){
5412   Select *pSel = pFrom->pSelect;
5413   Table *pTab;
5414 
5415   assert( pSel );
5416   pFrom->pTab = pTab = sqlite3DbMallocZero(pParse->db, sizeof(Table));
5417   if( pTab==0 ) return SQLITE_NOMEM;
5418   pTab->nTabRef = 1;
5419   if( pFrom->zAlias ){
5420     pTab->zName = sqlite3DbStrDup(pParse->db, pFrom->zAlias);
5421   }else{
5422     pTab->zName = sqlite3MPrintf(pParse->db, "subquery_%u", pSel->selId);
5423   }
5424   while( pSel->pPrior ){ pSel = pSel->pPrior; }
5425   sqlite3ColumnsFromExprList(pParse, pSel->pEList,&pTab->nCol,&pTab->aCol);
5426   pTab->iPKey = -1;
5427   pTab->nRowLogEst = 200; assert( 200==sqlite3LogEst(1048576) );
5428 #ifndef SQLITE_ALLOW_ROWID_IN_VIEW
5429   /* The usual case - do not allow ROWID on a subquery */
5430   pTab->tabFlags |= TF_Ephemeral | TF_NoVisibleRowid;
5431 #else
5432   pTab->tabFlags |= TF_Ephemeral;  /* Legacy compatibility mode */
5433 #endif
5434 
5435 
5436   return pParse->nErr ? SQLITE_ERROR : SQLITE_OK;
5437 }
5438 
5439 /*
5440 ** This routine is a Walker callback for "expanding" a SELECT statement.
5441 ** "Expanding" means to do the following:
5442 **
5443 **    (1)  Make sure VDBE cursor numbers have been assigned to every
5444 **         element of the FROM clause.
5445 **
5446 **    (2)  Fill in the pTabList->a[].pTab fields in the SrcList that
5447 **         defines FROM clause.  When views appear in the FROM clause,
5448 **         fill pTabList->a[].pSelect with a copy of the SELECT statement
5449 **         that implements the view.  A copy is made of the view's SELECT
5450 **         statement so that we can freely modify or delete that statement
5451 **         without worrying about messing up the persistent representation
5452 **         of the view.
5453 **
5454 **    (3)  Add terms to the WHERE clause to accommodate the NATURAL keyword
5455 **         on joins and the ON and USING clause of joins.
5456 **
5457 **    (4)  Scan the list of columns in the result set (pEList) looking
5458 **         for instances of the "*" operator or the TABLE.* operator.
5459 **         If found, expand each "*" to be every column in every table
5460 **         and TABLE.* to be every column in TABLE.
5461 **
5462 */
5463 static int selectExpander(Walker *pWalker, Select *p){
5464   Parse *pParse = pWalker->pParse;
5465   int i, j, k, rc;
5466   SrcList *pTabList;
5467   ExprList *pEList;
5468   SrcItem *pFrom;
5469   sqlite3 *db = pParse->db;
5470   Expr *pE, *pRight, *pExpr;
5471   u16 selFlags = p->selFlags;
5472   u32 elistFlags = 0;
5473 
5474   p->selFlags |= SF_Expanded;
5475   if( db->mallocFailed  ){
5476     return WRC_Abort;
5477   }
5478   assert( p->pSrc!=0 );
5479   if( (selFlags & SF_Expanded)!=0 ){
5480     return WRC_Prune;
5481   }
5482   if( pWalker->eCode ){
5483     /* Renumber selId because it has been copied from a view */
5484     p->selId = ++pParse->nSelect;
5485   }
5486   pTabList = p->pSrc;
5487   pEList = p->pEList;
5488   if( pParse->pWith && (p->selFlags & SF_View) ){
5489     if( p->pWith==0 ){
5490       p->pWith = (With*)sqlite3DbMallocZero(db, sizeof(With));
5491       if( p->pWith==0 ){
5492         return WRC_Abort;
5493       }
5494     }
5495     p->pWith->bView = 1;
5496   }
5497   sqlite3WithPush(pParse, p->pWith, 0);
5498 
5499   /* Make sure cursor numbers have been assigned to all entries in
5500   ** the FROM clause of the SELECT statement.
5501   */
5502   sqlite3SrcListAssignCursors(pParse, pTabList);
5503 
5504   /* Look up every table named in the FROM clause of the select.  If
5505   ** an entry of the FROM clause is a subquery instead of a table or view,
5506   ** then create a transient table structure to describe the subquery.
5507   */
5508   for(i=0, pFrom=pTabList->a; i<pTabList->nSrc; i++, pFrom++){
5509     Table *pTab;
5510     assert( pFrom->fg.isRecursive==0 || pFrom->pTab!=0 );
5511     if( pFrom->pTab ) continue;
5512     assert( pFrom->fg.isRecursive==0 );
5513     if( pFrom->zName==0 ){
5514 #ifndef SQLITE_OMIT_SUBQUERY
5515       Select *pSel = pFrom->pSelect;
5516       /* A sub-query in the FROM clause of a SELECT */
5517       assert( pSel!=0 );
5518       assert( pFrom->pTab==0 );
5519       if( sqlite3WalkSelect(pWalker, pSel) ) return WRC_Abort;
5520       if( sqlite3ExpandSubquery(pParse, pFrom) ) return WRC_Abort;
5521 #endif
5522 #ifndef SQLITE_OMIT_CTE
5523     }else if( (rc = resolveFromTermToCte(pParse, pWalker, pFrom))!=0 ){
5524       if( rc>1 ) return WRC_Abort;
5525       pTab = pFrom->pTab;
5526       assert( pTab!=0 );
5527 #endif
5528     }else{
5529       /* An ordinary table or view name in the FROM clause */
5530       assert( pFrom->pTab==0 );
5531       pFrom->pTab = pTab = sqlite3LocateTableItem(pParse, 0, pFrom);
5532       if( pTab==0 ) return WRC_Abort;
5533       if( pTab->nTabRef>=0xffff ){
5534         sqlite3ErrorMsg(pParse, "too many references to \"%s\": max 65535",
5535            pTab->zName);
5536         pFrom->pTab = 0;
5537         return WRC_Abort;
5538       }
5539       pTab->nTabRef++;
5540       if( !IsVirtual(pTab) && cannotBeFunction(pParse, pFrom) ){
5541         return WRC_Abort;
5542       }
5543 #if !defined(SQLITE_OMIT_VIEW) || !defined(SQLITE_OMIT_VIRTUALTABLE)
5544       if( !IsOrdinaryTable(pTab) ){
5545         i16 nCol;
5546         u8 eCodeOrig = pWalker->eCode;
5547         if( sqlite3ViewGetColumnNames(pParse, pTab) ) return WRC_Abort;
5548         assert( pFrom->pSelect==0 );
5549         if( IsView(pTab) ){
5550           if( (db->flags & SQLITE_EnableView)==0
5551            && pTab->pSchema!=db->aDb[1].pSchema
5552           ){
5553             sqlite3ErrorMsg(pParse, "access to view \"%s\" prohibited",
5554               pTab->zName);
5555           }
5556           pFrom->pSelect = sqlite3SelectDup(db, pTab->u.view.pSelect, 0);
5557         }
5558 #ifndef SQLITE_OMIT_VIRTUALTABLE
5559         else if( ALWAYS(IsVirtual(pTab))
5560          && pFrom->fg.fromDDL
5561          && ALWAYS(pTab->u.vtab.p!=0)
5562          && pTab->u.vtab.p->eVtabRisk > ((db->flags & SQLITE_TrustedSchema)!=0)
5563         ){
5564           sqlite3ErrorMsg(pParse, "unsafe use of virtual table \"%s\"",
5565                                   pTab->zName);
5566         }
5567         assert( SQLITE_VTABRISK_Normal==1 && SQLITE_VTABRISK_High==2 );
5568 #endif
5569         nCol = pTab->nCol;
5570         pTab->nCol = -1;
5571         pWalker->eCode = 1;  /* Turn on Select.selId renumbering */
5572         sqlite3WalkSelect(pWalker, pFrom->pSelect);
5573         pWalker->eCode = eCodeOrig;
5574         pTab->nCol = nCol;
5575       }
5576 #endif
5577     }
5578 
5579     /* Locate the index named by the INDEXED BY clause, if any. */
5580     if( pFrom->fg.isIndexedBy && sqlite3IndexedByLookup(pParse, pFrom) ){
5581       return WRC_Abort;
5582     }
5583   }
5584 
5585   /* Process NATURAL keywords, and ON and USING clauses of joins.
5586   */
5587   assert( db->mallocFailed==0 || pParse->nErr!=0 );
5588   if( pParse->nErr || sqliteProcessJoin(pParse, p) ){
5589     return WRC_Abort;
5590   }
5591 
5592   /* For every "*" that occurs in the column list, insert the names of
5593   ** all columns in all tables.  And for every TABLE.* insert the names
5594   ** of all columns in TABLE.  The parser inserted a special expression
5595   ** with the TK_ASTERISK operator for each "*" that it found in the column
5596   ** list.  The following code just has to locate the TK_ASTERISK
5597   ** expressions and expand each one to the list of all columns in
5598   ** all tables.
5599   **
5600   ** The first loop just checks to see if there are any "*" operators
5601   ** that need expanding.
5602   */
5603   for(k=0; k<pEList->nExpr; k++){
5604     pE = pEList->a[k].pExpr;
5605     if( pE->op==TK_ASTERISK ) break;
5606     assert( pE->op!=TK_DOT || pE->pRight!=0 );
5607     assert( pE->op!=TK_DOT || (pE->pLeft!=0 && pE->pLeft->op==TK_ID) );
5608     if( pE->op==TK_DOT && pE->pRight->op==TK_ASTERISK ) break;
5609     elistFlags |= pE->flags;
5610   }
5611   if( k<pEList->nExpr ){
5612     /*
5613     ** If we get here it means the result set contains one or more "*"
5614     ** operators that need to be expanded.  Loop through each expression
5615     ** in the result set and expand them one by one.
5616     */
5617     struct ExprList_item *a = pEList->a;
5618     ExprList *pNew = 0;
5619     int flags = pParse->db->flags;
5620     int longNames = (flags & SQLITE_FullColNames)!=0
5621                       && (flags & SQLITE_ShortColNames)==0;
5622 
5623     for(k=0; k<pEList->nExpr; k++){
5624       pE = a[k].pExpr;
5625       elistFlags |= pE->flags;
5626       pRight = pE->pRight;
5627       assert( pE->op!=TK_DOT || pRight!=0 );
5628       if( pE->op!=TK_ASTERISK
5629        && (pE->op!=TK_DOT || pRight->op!=TK_ASTERISK)
5630       ){
5631         /* This particular expression does not need to be expanded.
5632         */
5633         pNew = sqlite3ExprListAppend(pParse, pNew, a[k].pExpr);
5634         if( pNew ){
5635           pNew->a[pNew->nExpr-1].zEName = a[k].zEName;
5636           pNew->a[pNew->nExpr-1].eEName = a[k].eEName;
5637           a[k].zEName = 0;
5638         }
5639         a[k].pExpr = 0;
5640       }else{
5641         /* This expression is a "*" or a "TABLE.*" and needs to be
5642         ** expanded. */
5643         int tableSeen = 0;      /* Set to 1 when TABLE matches */
5644         char *zTName = 0;       /* text of name of TABLE */
5645         if( pE->op==TK_DOT ){
5646           assert( pE->pLeft!=0 );
5647           assert( !ExprHasProperty(pE->pLeft, EP_IntValue) );
5648           zTName = pE->pLeft->u.zToken;
5649         }
5650         for(i=0, pFrom=pTabList->a; i<pTabList->nSrc; i++, pFrom++){
5651           Table *pTab = pFrom->pTab;
5652           Select *pSub = pFrom->pSelect;
5653           char *zTabName = pFrom->zAlias;
5654           const char *zSchemaName = 0;
5655           int iDb;
5656           if( zTabName==0 ){
5657             zTabName = pTab->zName;
5658           }
5659           if( db->mallocFailed ) break;
5660           if( pSub==0 || (pSub->selFlags & SF_NestedFrom)==0 ){
5661             pSub = 0;
5662             if( zTName && sqlite3StrICmp(zTName, zTabName)!=0 ){
5663               continue;
5664             }
5665             iDb = sqlite3SchemaToIndex(db, pTab->pSchema);
5666             zSchemaName = iDb>=0 ? db->aDb[iDb].zDbSName : "*";
5667           }
5668           for(j=0; j<pTab->nCol; j++){
5669             char *zName = pTab->aCol[j].zCnName;
5670             char *zColname;  /* The computed column name */
5671             char *zToFree;   /* Malloced string that needs to be freed */
5672             Token sColname;  /* Computed column name as a token */
5673 
5674             assert( zName );
5675             if( zTName && pSub
5676              && sqlite3MatchEName(&pSub->pEList->a[j], 0, zTName, 0)==0
5677             ){
5678               continue;
5679             }
5680 
5681             /* If a column is marked as 'hidden', omit it from the expanded
5682             ** result-set list unless the SELECT has the SF_IncludeHidden
5683             ** bit set.
5684             */
5685             if( (p->selFlags & SF_IncludeHidden)==0
5686              && IsHiddenColumn(&pTab->aCol[j])
5687             ){
5688               continue;
5689             }
5690             tableSeen = 1;
5691 
5692             if( i>0 && zTName==0 ){
5693               if( (pFrom->fg.jointype & JT_NATURAL)!=0
5694                 && tableAndColumnIndex(pTabList, i, zName, 0, 0, 1)
5695               ){
5696                 /* In a NATURAL join, omit the join columns from the
5697                 ** table to the right of the join */
5698                 continue;
5699               }
5700               if( pFrom->fg.isUsing
5701                && sqlite3IdListIndex(pFrom->u3.pUsing, zName)>=0
5702               ){
5703                 /* In a join with a USING clause, omit columns in the
5704                 ** using clause from the table on the right. */
5705                 continue;
5706               }
5707             }
5708             pRight = sqlite3Expr(db, TK_ID, zName);
5709             zColname = zName;
5710             zToFree = 0;
5711             if( longNames || pTabList->nSrc>1 ){
5712               Expr *pLeft;
5713               pLeft = sqlite3Expr(db, TK_ID, zTabName);
5714               pExpr = sqlite3PExpr(pParse, TK_DOT, pLeft, pRight);
5715               if( zSchemaName ){
5716                 pLeft = sqlite3Expr(db, TK_ID, zSchemaName);
5717                 pExpr = sqlite3PExpr(pParse, TK_DOT, pLeft, pExpr);
5718               }
5719               if( longNames ){
5720                 zColname = sqlite3MPrintf(db, "%s.%s", zTabName, zName);
5721                 zToFree = zColname;
5722               }
5723             }else{
5724               pExpr = pRight;
5725             }
5726             pNew = sqlite3ExprListAppend(pParse, pNew, pExpr);
5727             sqlite3TokenInit(&sColname, zColname);
5728             sqlite3ExprListSetName(pParse, pNew, &sColname, 0);
5729             if( pNew && (p->selFlags & SF_NestedFrom)!=0 && !IN_RENAME_OBJECT ){
5730               struct ExprList_item *pX = &pNew->a[pNew->nExpr-1];
5731               sqlite3DbFree(db, pX->zEName);
5732               if( pSub ){
5733                 pX->zEName = sqlite3DbStrDup(db, pSub->pEList->a[j].zEName);
5734                 testcase( pX->zEName==0 );
5735               }else{
5736                 pX->zEName = sqlite3MPrintf(db, "%s.%s.%s",
5737                                            zSchemaName, zTabName, zColname);
5738                 testcase( pX->zEName==0 );
5739               }
5740               pX->eEName = ENAME_TAB;
5741             }
5742             sqlite3DbFree(db, zToFree);
5743           }
5744         }
5745         if( !tableSeen ){
5746           if( zTName ){
5747             sqlite3ErrorMsg(pParse, "no such table: %s", zTName);
5748           }else{
5749             sqlite3ErrorMsg(pParse, "no tables specified");
5750           }
5751         }
5752       }
5753     }
5754     sqlite3ExprListDelete(db, pEList);
5755     p->pEList = pNew;
5756   }
5757   if( p->pEList ){
5758     if( p->pEList->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
5759       sqlite3ErrorMsg(pParse, "too many columns in result set");
5760       return WRC_Abort;
5761     }
5762     if( (elistFlags & (EP_HasFunc|EP_Subquery))!=0 ){
5763       p->selFlags |= SF_ComplexResult;
5764     }
5765   }
5766   return WRC_Continue;
5767 }
5768 
5769 #if SQLITE_DEBUG
5770 /*
5771 ** Always assert.  This xSelectCallback2 implementation proves that the
5772 ** xSelectCallback2 is never invoked.
5773 */
5774 void sqlite3SelectWalkAssert2(Walker *NotUsed, Select *NotUsed2){
5775   UNUSED_PARAMETER2(NotUsed, NotUsed2);
5776   assert( 0 );
5777 }
5778 #endif
5779 /*
5780 ** This routine "expands" a SELECT statement and all of its subqueries.
5781 ** For additional information on what it means to "expand" a SELECT
5782 ** statement, see the comment on the selectExpand worker callback above.
5783 **
5784 ** Expanding a SELECT statement is the first step in processing a
5785 ** SELECT statement.  The SELECT statement must be expanded before
5786 ** name resolution is performed.
5787 **
5788 ** If anything goes wrong, an error message is written into pParse.
5789 ** The calling function can detect the problem by looking at pParse->nErr
5790 ** and/or pParse->db->mallocFailed.
5791 */
5792 static void sqlite3SelectExpand(Parse *pParse, Select *pSelect){
5793   Walker w;
5794   w.xExprCallback = sqlite3ExprWalkNoop;
5795   w.pParse = pParse;
5796   if( OK_IF_ALWAYS_TRUE(pParse->hasCompound) ){
5797     w.xSelectCallback = convertCompoundSelectToSubquery;
5798     w.xSelectCallback2 = 0;
5799     sqlite3WalkSelect(&w, pSelect);
5800   }
5801   w.xSelectCallback = selectExpander;
5802   w.xSelectCallback2 = sqlite3SelectPopWith;
5803   w.eCode = 0;
5804   sqlite3WalkSelect(&w, pSelect);
5805 }
5806 
5807 
5808 #ifndef SQLITE_OMIT_SUBQUERY
5809 /*
5810 ** This is a Walker.xSelectCallback callback for the sqlite3SelectTypeInfo()
5811 ** interface.
5812 **
5813 ** For each FROM-clause subquery, add Column.zType and Column.zColl
5814 ** information to the Table structure that represents the result set
5815 ** of that subquery.
5816 **
5817 ** The Table structure that represents the result set was constructed
5818 ** by selectExpander() but the type and collation information was omitted
5819 ** at that point because identifiers had not yet been resolved.  This
5820 ** routine is called after identifier resolution.
5821 */
5822 static void selectAddSubqueryTypeInfo(Walker *pWalker, Select *p){
5823   Parse *pParse;
5824   int i;
5825   SrcList *pTabList;
5826   SrcItem *pFrom;
5827 
5828   assert( p->selFlags & SF_Resolved );
5829   if( p->selFlags & SF_HasTypeInfo ) return;
5830   p->selFlags |= SF_HasTypeInfo;
5831   pParse = pWalker->pParse;
5832   pTabList = p->pSrc;
5833   for(i=0, pFrom=pTabList->a; i<pTabList->nSrc; i++, pFrom++){
5834     Table *pTab = pFrom->pTab;
5835     assert( pTab!=0 );
5836     if( (pTab->tabFlags & TF_Ephemeral)!=0 ){
5837       /* A sub-query in the FROM clause of a SELECT */
5838       Select *pSel = pFrom->pSelect;
5839       if( pSel ){
5840         while( pSel->pPrior ) pSel = pSel->pPrior;
5841         sqlite3SelectAddColumnTypeAndCollation(pParse, pTab, pSel,
5842                                                SQLITE_AFF_NONE);
5843       }
5844     }
5845   }
5846 }
5847 #endif
5848 
5849 
5850 /*
5851 ** This routine adds datatype and collating sequence information to
5852 ** the Table structures of all FROM-clause subqueries in a
5853 ** SELECT statement.
5854 **
5855 ** Use this routine after name resolution.
5856 */
5857 static void sqlite3SelectAddTypeInfo(Parse *pParse, Select *pSelect){
5858 #ifndef SQLITE_OMIT_SUBQUERY
5859   Walker w;
5860   w.xSelectCallback = sqlite3SelectWalkNoop;
5861   w.xSelectCallback2 = selectAddSubqueryTypeInfo;
5862   w.xExprCallback = sqlite3ExprWalkNoop;
5863   w.pParse = pParse;
5864   sqlite3WalkSelect(&w, pSelect);
5865 #endif
5866 }
5867 
5868 
5869 /*
5870 ** This routine sets up a SELECT statement for processing.  The
5871 ** following is accomplished:
5872 **
5873 **     *  VDBE Cursor numbers are assigned to all FROM-clause terms.
5874 **     *  Ephemeral Table objects are created for all FROM-clause subqueries.
5875 **     *  ON and USING clauses are shifted into WHERE statements
5876 **     *  Wildcards "*" and "TABLE.*" in result sets are expanded.
5877 **     *  Identifiers in expression are matched to tables.
5878 **
5879 ** This routine acts recursively on all subqueries within the SELECT.
5880 */
5881 void sqlite3SelectPrep(
5882   Parse *pParse,         /* The parser context */
5883   Select *p,             /* The SELECT statement being coded. */
5884   NameContext *pOuterNC  /* Name context for container */
5885 ){
5886   assert( p!=0 || pParse->db->mallocFailed );
5887   assert( pParse->db->pParse==pParse );
5888   if( pParse->db->mallocFailed ) return;
5889   if( p->selFlags & SF_HasTypeInfo ) return;
5890   sqlite3SelectExpand(pParse, p);
5891   if( pParse->nErr ) return;
5892   sqlite3ResolveSelectNames(pParse, p, pOuterNC);
5893   if( pParse->nErr ) return;
5894   sqlite3SelectAddTypeInfo(pParse, p);
5895 }
5896 
5897 /*
5898 ** Reset the aggregate accumulator.
5899 **
5900 ** The aggregate accumulator is a set of memory cells that hold
5901 ** intermediate results while calculating an aggregate.  This
5902 ** routine generates code that stores NULLs in all of those memory
5903 ** cells.
5904 */
5905 static void resetAccumulator(Parse *pParse, AggInfo *pAggInfo){
5906   Vdbe *v = pParse->pVdbe;
5907   int i;
5908   struct AggInfo_func *pFunc;
5909   int nReg = pAggInfo->nFunc + pAggInfo->nColumn;
5910   assert( pParse->db->pParse==pParse );
5911   assert( pParse->db->mallocFailed==0 || pParse->nErr!=0 );
5912   if( nReg==0 ) return;
5913   if( pParse->nErr ) return;
5914 #ifdef SQLITE_DEBUG
5915   /* Verify that all AggInfo registers are within the range specified by
5916   ** AggInfo.mnReg..AggInfo.mxReg */
5917   assert( nReg==pAggInfo->mxReg-pAggInfo->mnReg+1 );
5918   for(i=0; i<pAggInfo->nColumn; i++){
5919     assert( pAggInfo->aCol[i].iMem>=pAggInfo->mnReg
5920          && pAggInfo->aCol[i].iMem<=pAggInfo->mxReg );
5921   }
5922   for(i=0; i<pAggInfo->nFunc; i++){
5923     assert( pAggInfo->aFunc[i].iMem>=pAggInfo->mnReg
5924          && pAggInfo->aFunc[i].iMem<=pAggInfo->mxReg );
5925   }
5926 #endif
5927   sqlite3VdbeAddOp3(v, OP_Null, 0, pAggInfo->mnReg, pAggInfo->mxReg);
5928   for(pFunc=pAggInfo->aFunc, i=0; i<pAggInfo->nFunc; i++, pFunc++){
5929     if( pFunc->iDistinct>=0 ){
5930       Expr *pE = pFunc->pFExpr;
5931       assert( ExprUseXList(pE) );
5932       if( pE->x.pList==0 || pE->x.pList->nExpr!=1 ){
5933         sqlite3ErrorMsg(pParse, "DISTINCT aggregates must have exactly one "
5934            "argument");
5935         pFunc->iDistinct = -1;
5936       }else{
5937         KeyInfo *pKeyInfo = sqlite3KeyInfoFromExprList(pParse, pE->x.pList,0,0);
5938         pFunc->iDistAddr = sqlite3VdbeAddOp4(v, OP_OpenEphemeral,
5939             pFunc->iDistinct, 0, 0, (char*)pKeyInfo, P4_KEYINFO);
5940         ExplainQueryPlan((pParse, 0, "USE TEMP B-TREE FOR %s(DISTINCT)",
5941                           pFunc->pFunc->zName));
5942       }
5943     }
5944   }
5945 }
5946 
5947 /*
5948 ** Invoke the OP_AggFinalize opcode for every aggregate function
5949 ** in the AggInfo structure.
5950 */
5951 static void finalizeAggFunctions(Parse *pParse, AggInfo *pAggInfo){
5952   Vdbe *v = pParse->pVdbe;
5953   int i;
5954   struct AggInfo_func *pF;
5955   for(i=0, pF=pAggInfo->aFunc; i<pAggInfo->nFunc; i++, pF++){
5956     ExprList *pList;
5957     assert( ExprUseXList(pF->pFExpr) );
5958     pList = pF->pFExpr->x.pList;
5959     sqlite3VdbeAddOp2(v, OP_AggFinal, pF->iMem, pList ? pList->nExpr : 0);
5960     sqlite3VdbeAppendP4(v, pF->pFunc, P4_FUNCDEF);
5961   }
5962 }
5963 
5964 
5965 /*
5966 ** Update the accumulator memory cells for an aggregate based on
5967 ** the current cursor position.
5968 **
5969 ** If regAcc is non-zero and there are no min() or max() aggregates
5970 ** in pAggInfo, then only populate the pAggInfo->nAccumulator accumulator
5971 ** registers if register regAcc contains 0. The caller will take care
5972 ** of setting and clearing regAcc.
5973 */
5974 static void updateAccumulator(
5975   Parse *pParse,
5976   int regAcc,
5977   AggInfo *pAggInfo,
5978   int eDistinctType
5979 ){
5980   Vdbe *v = pParse->pVdbe;
5981   int i;
5982   int regHit = 0;
5983   int addrHitTest = 0;
5984   struct AggInfo_func *pF;
5985   struct AggInfo_col *pC;
5986 
5987   pAggInfo->directMode = 1;
5988   for(i=0, pF=pAggInfo->aFunc; i<pAggInfo->nFunc; i++, pF++){
5989     int nArg;
5990     int addrNext = 0;
5991     int regAgg;
5992     ExprList *pList;
5993     assert( ExprUseXList(pF->pFExpr) );
5994     assert( !IsWindowFunc(pF->pFExpr) );
5995     pList = pF->pFExpr->x.pList;
5996     if( ExprHasProperty(pF->pFExpr, EP_WinFunc) ){
5997       Expr *pFilter = pF->pFExpr->y.pWin->pFilter;
5998       if( pAggInfo->nAccumulator
5999        && (pF->pFunc->funcFlags & SQLITE_FUNC_NEEDCOLL)
6000        && regAcc
6001       ){
6002         /* If regAcc==0, there there exists some min() or max() function
6003         ** without a FILTER clause that will ensure the magnet registers
6004         ** are populated. */
6005         if( regHit==0 ) regHit = ++pParse->nMem;
6006         /* If this is the first row of the group (regAcc contains 0), clear the
6007         ** "magnet" register regHit so that the accumulator registers
6008         ** are populated if the FILTER clause jumps over the the
6009         ** invocation of min() or max() altogether. Or, if this is not
6010         ** the first row (regAcc contains 1), set the magnet register so that
6011         ** the accumulators are not populated unless the min()/max() is invoked
6012         ** and indicates that they should be.  */
6013         sqlite3VdbeAddOp2(v, OP_Copy, regAcc, regHit);
6014       }
6015       addrNext = sqlite3VdbeMakeLabel(pParse);
6016       sqlite3ExprIfFalse(pParse, pFilter, addrNext, SQLITE_JUMPIFNULL);
6017     }
6018     if( pList ){
6019       nArg = pList->nExpr;
6020       regAgg = sqlite3GetTempRange(pParse, nArg);
6021       sqlite3ExprCodeExprList(pParse, pList, regAgg, 0, SQLITE_ECEL_DUP);
6022     }else{
6023       nArg = 0;
6024       regAgg = 0;
6025     }
6026     if( pF->iDistinct>=0 && pList ){
6027       if( addrNext==0 ){
6028         addrNext = sqlite3VdbeMakeLabel(pParse);
6029       }
6030       pF->iDistinct = codeDistinct(pParse, eDistinctType,
6031           pF->iDistinct, addrNext, pList, regAgg);
6032     }
6033     if( pF->pFunc->funcFlags & SQLITE_FUNC_NEEDCOLL ){
6034       CollSeq *pColl = 0;
6035       struct ExprList_item *pItem;
6036       int j;
6037       assert( pList!=0 );  /* pList!=0 if pF->pFunc has NEEDCOLL */
6038       for(j=0, pItem=pList->a; !pColl && j<nArg; j++, pItem++){
6039         pColl = sqlite3ExprCollSeq(pParse, pItem->pExpr);
6040       }
6041       if( !pColl ){
6042         pColl = pParse->db->pDfltColl;
6043       }
6044       if( regHit==0 && pAggInfo->nAccumulator ) regHit = ++pParse->nMem;
6045       sqlite3VdbeAddOp4(v, OP_CollSeq, regHit, 0, 0, (char *)pColl, P4_COLLSEQ);
6046     }
6047     sqlite3VdbeAddOp3(v, OP_AggStep, 0, regAgg, pF->iMem);
6048     sqlite3VdbeAppendP4(v, pF->pFunc, P4_FUNCDEF);
6049     sqlite3VdbeChangeP5(v, (u8)nArg);
6050     sqlite3ReleaseTempRange(pParse, regAgg, nArg);
6051     if( addrNext ){
6052       sqlite3VdbeResolveLabel(v, addrNext);
6053     }
6054   }
6055   if( regHit==0 && pAggInfo->nAccumulator ){
6056     regHit = regAcc;
6057   }
6058   if( regHit ){
6059     addrHitTest = sqlite3VdbeAddOp1(v, OP_If, regHit); VdbeCoverage(v);
6060   }
6061   for(i=0, pC=pAggInfo->aCol; i<pAggInfo->nAccumulator; i++, pC++){
6062     sqlite3ExprCode(pParse, pC->pCExpr, pC->iMem);
6063   }
6064 
6065   pAggInfo->directMode = 0;
6066   if( addrHitTest ){
6067     sqlite3VdbeJumpHereOrPopInst(v, addrHitTest);
6068   }
6069 }
6070 
6071 /*
6072 ** Add a single OP_Explain instruction to the VDBE to explain a simple
6073 ** count(*) query ("SELECT count(*) FROM pTab").
6074 */
6075 #ifndef SQLITE_OMIT_EXPLAIN
6076 static void explainSimpleCount(
6077   Parse *pParse,                  /* Parse context */
6078   Table *pTab,                    /* Table being queried */
6079   Index *pIdx                     /* Index used to optimize scan, or NULL */
6080 ){
6081   if( pParse->explain==2 ){
6082     int bCover = (pIdx!=0 && (HasRowid(pTab) || !IsPrimaryKeyIndex(pIdx)));
6083     sqlite3VdbeExplain(pParse, 0, "SCAN %s%s%s",
6084         pTab->zName,
6085         bCover ? " USING COVERING INDEX " : "",
6086         bCover ? pIdx->zName : ""
6087     );
6088   }
6089 }
6090 #else
6091 # define explainSimpleCount(a,b,c)
6092 #endif
6093 
6094 /*
6095 ** sqlite3WalkExpr() callback used by havingToWhere().
6096 **
6097 ** If the node passed to the callback is a TK_AND node, return
6098 ** WRC_Continue to tell sqlite3WalkExpr() to iterate through child nodes.
6099 **
6100 ** Otherwise, return WRC_Prune. In this case, also check if the
6101 ** sub-expression matches the criteria for being moved to the WHERE
6102 ** clause. If so, add it to the WHERE clause and replace the sub-expression
6103 ** within the HAVING expression with a constant "1".
6104 */
6105 static int havingToWhereExprCb(Walker *pWalker, Expr *pExpr){
6106   if( pExpr->op!=TK_AND ){
6107     Select *pS = pWalker->u.pSelect;
6108     /* This routine is called before the HAVING clause of the current
6109     ** SELECT is analyzed for aggregates. So if pExpr->pAggInfo is set
6110     ** here, it indicates that the expression is a correlated reference to a
6111     ** column from an outer aggregate query, or an aggregate function that
6112     ** belongs to an outer query. Do not move the expression to the WHERE
6113     ** clause in this obscure case, as doing so may corrupt the outer Select
6114     ** statements AggInfo structure.  */
6115     if( sqlite3ExprIsConstantOrGroupBy(pWalker->pParse, pExpr, pS->pGroupBy)
6116      && ExprAlwaysFalse(pExpr)==0
6117      && pExpr->pAggInfo==0
6118     ){
6119       sqlite3 *db = pWalker->pParse->db;
6120       Expr *pNew = sqlite3Expr(db, TK_INTEGER, "1");
6121       if( pNew ){
6122         Expr *pWhere = pS->pWhere;
6123         SWAP(Expr, *pNew, *pExpr);
6124         pNew = sqlite3ExprAnd(pWalker->pParse, pWhere, pNew);
6125         pS->pWhere = pNew;
6126         pWalker->eCode = 1;
6127       }
6128     }
6129     return WRC_Prune;
6130   }
6131   return WRC_Continue;
6132 }
6133 
6134 /*
6135 ** Transfer eligible terms from the HAVING clause of a query, which is
6136 ** processed after grouping, to the WHERE clause, which is processed before
6137 ** grouping. For example, the query:
6138 **
6139 **   SELECT * FROM <tables> WHERE a=? GROUP BY b HAVING b=? AND c=?
6140 **
6141 ** can be rewritten as:
6142 **
6143 **   SELECT * FROM <tables> WHERE a=? AND b=? GROUP BY b HAVING c=?
6144 **
6145 ** A term of the HAVING expression is eligible for transfer if it consists
6146 ** entirely of constants and expressions that are also GROUP BY terms that
6147 ** use the "BINARY" collation sequence.
6148 */
6149 static void havingToWhere(Parse *pParse, Select *p){
6150   Walker sWalker;
6151   memset(&sWalker, 0, sizeof(sWalker));
6152   sWalker.pParse = pParse;
6153   sWalker.xExprCallback = havingToWhereExprCb;
6154   sWalker.u.pSelect = p;
6155   sqlite3WalkExpr(&sWalker, p->pHaving);
6156 #if TREETRACE_ENABLED
6157   if( sWalker.eCode && (sqlite3TreeTrace & 0x100)!=0 ){
6158     SELECTTRACE(0x100,pParse,p,("Move HAVING terms into WHERE:\n"));
6159     sqlite3TreeViewSelect(0, p, 0);
6160   }
6161 #endif
6162 }
6163 
6164 /*
6165 ** Check to see if the pThis entry of pTabList is a self-join of a prior view.
6166 ** If it is, then return the SrcList_item for the prior view.  If it is not,
6167 ** then return 0.
6168 */
6169 static SrcItem *isSelfJoinView(
6170   SrcList *pTabList,           /* Search for self-joins in this FROM clause */
6171   SrcItem *pThis               /* Search for prior reference to this subquery */
6172 ){
6173   SrcItem *pItem;
6174   assert( pThis->pSelect!=0 );
6175   if( pThis->pSelect->selFlags & SF_PushDown ) return 0;
6176   for(pItem = pTabList->a; pItem<pThis; pItem++){
6177     Select *pS1;
6178     if( pItem->pSelect==0 ) continue;
6179     if( pItem->fg.viaCoroutine ) continue;
6180     if( pItem->zName==0 ) continue;
6181     assert( pItem->pTab!=0 );
6182     assert( pThis->pTab!=0 );
6183     if( pItem->pTab->pSchema!=pThis->pTab->pSchema ) continue;
6184     if( sqlite3_stricmp(pItem->zName, pThis->zName)!=0 ) continue;
6185     pS1 = pItem->pSelect;
6186     if( pItem->pTab->pSchema==0 && pThis->pSelect->selId!=pS1->selId ){
6187       /* The query flattener left two different CTE tables with identical
6188       ** names in the same FROM clause. */
6189       continue;
6190     }
6191     if( pItem->pSelect->selFlags & SF_PushDown ){
6192       /* The view was modified by some other optimization such as
6193       ** pushDownWhereTerms() */
6194       continue;
6195     }
6196     return pItem;
6197   }
6198   return 0;
6199 }
6200 
6201 /*
6202 ** Deallocate a single AggInfo object
6203 */
6204 static void agginfoFree(sqlite3 *db, AggInfo *p){
6205   sqlite3DbFree(db, p->aCol);
6206   sqlite3DbFree(db, p->aFunc);
6207   sqlite3DbFreeNN(db, p);
6208 }
6209 
6210 #ifdef SQLITE_COUNTOFVIEW_OPTIMIZATION
6211 /*
6212 ** Attempt to transform a query of the form
6213 **
6214 **    SELECT count(*) FROM (SELECT x FROM t1 UNION ALL SELECT y FROM t2)
6215 **
6216 ** Into this:
6217 **
6218 **    SELECT (SELECT count(*) FROM t1)+(SELECT count(*) FROM t2)
6219 **
6220 ** The transformation only works if all of the following are true:
6221 **
6222 **   *  The subquery is a UNION ALL of two or more terms
6223 **   *  The subquery does not have a LIMIT clause
6224 **   *  There is no WHERE or GROUP BY or HAVING clauses on the subqueries
6225 **   *  The outer query is a simple count(*) with no WHERE clause or other
6226 **      extraneous syntax.
6227 **
6228 ** Return TRUE if the optimization is undertaken.
6229 */
6230 static int countOfViewOptimization(Parse *pParse, Select *p){
6231   Select *pSub, *pPrior;
6232   Expr *pExpr;
6233   Expr *pCount;
6234   sqlite3 *db;
6235   if( (p->selFlags & SF_Aggregate)==0 ) return 0;   /* This is an aggregate */
6236   if( p->pEList->nExpr!=1 ) return 0;               /* Single result column */
6237   if( p->pWhere ) return 0;
6238   if( p->pGroupBy ) return 0;
6239   pExpr = p->pEList->a[0].pExpr;
6240   if( pExpr->op!=TK_AGG_FUNCTION ) return 0;        /* Result is an aggregate */
6241   assert( ExprUseUToken(pExpr) );
6242   if( sqlite3_stricmp(pExpr->u.zToken,"count") ) return 0;  /* Is count() */
6243   assert( ExprUseXList(pExpr) );
6244   if( pExpr->x.pList!=0 ) return 0;                 /* Must be count(*) */
6245   if( p->pSrc->nSrc!=1 ) return 0;                  /* One table in FROM  */
6246   pSub = p->pSrc->a[0].pSelect;
6247   if( pSub==0 ) return 0;                           /* The FROM is a subquery */
6248   if( pSub->pPrior==0 ) return 0;                   /* Must be a compound ry */
6249   do{
6250     if( pSub->op!=TK_ALL && pSub->pPrior ) return 0;  /* Must be UNION ALL */
6251     if( pSub->pWhere ) return 0;                      /* No WHERE clause */
6252     if( pSub->pLimit ) return 0;                      /* No LIMIT clause */
6253     if( pSub->selFlags & SF_Aggregate ) return 0;     /* Not an aggregate */
6254     pSub = pSub->pPrior;                              /* Repeat over compound */
6255   }while( pSub );
6256 
6257   /* If we reach this point then it is OK to perform the transformation */
6258 
6259   db = pParse->db;
6260   pCount = pExpr;
6261   pExpr = 0;
6262   pSub = p->pSrc->a[0].pSelect;
6263   p->pSrc->a[0].pSelect = 0;
6264   sqlite3SrcListDelete(db, p->pSrc);
6265   p->pSrc = sqlite3DbMallocZero(pParse->db, sizeof(*p->pSrc));
6266   while( pSub ){
6267     Expr *pTerm;
6268     pPrior = pSub->pPrior;
6269     pSub->pPrior = 0;
6270     pSub->pNext = 0;
6271     pSub->selFlags |= SF_Aggregate;
6272     pSub->selFlags &= ~SF_Compound;
6273     pSub->nSelectRow = 0;
6274     sqlite3ExprListDelete(db, pSub->pEList);
6275     pTerm = pPrior ? sqlite3ExprDup(db, pCount, 0) : pCount;
6276     pSub->pEList = sqlite3ExprListAppend(pParse, 0, pTerm);
6277     pTerm = sqlite3PExpr(pParse, TK_SELECT, 0, 0);
6278     sqlite3PExprAddSelect(pParse, pTerm, pSub);
6279     if( pExpr==0 ){
6280       pExpr = pTerm;
6281     }else{
6282       pExpr = sqlite3PExpr(pParse, TK_PLUS, pTerm, pExpr);
6283     }
6284     pSub = pPrior;
6285   }
6286   p->pEList->a[0].pExpr = pExpr;
6287   p->selFlags &= ~SF_Aggregate;
6288 
6289 #if TREETRACE_ENABLED
6290   if( sqlite3TreeTrace & 0x400 ){
6291     SELECTTRACE(0x400,pParse,p,("After count-of-view optimization:\n"));
6292     sqlite3TreeViewSelect(0, p, 0);
6293   }
6294 #endif
6295   return 1;
6296 }
6297 #endif /* SQLITE_COUNTOFVIEW_OPTIMIZATION */
6298 
6299 /*
6300 ** Generate code for the SELECT statement given in the p argument.
6301 **
6302 ** The results are returned according to the SelectDest structure.
6303 ** See comments in sqliteInt.h for further information.
6304 **
6305 ** This routine returns the number of errors.  If any errors are
6306 ** encountered, then an appropriate error message is left in
6307 ** pParse->zErrMsg.
6308 **
6309 ** This routine does NOT free the Select structure passed in.  The
6310 ** calling function needs to do that.
6311 */
6312 int sqlite3Select(
6313   Parse *pParse,         /* The parser context */
6314   Select *p,             /* The SELECT statement being coded. */
6315   SelectDest *pDest      /* What to do with the query results */
6316 ){
6317   int i, j;              /* Loop counters */
6318   WhereInfo *pWInfo;     /* Return from sqlite3WhereBegin() */
6319   Vdbe *v;               /* The virtual machine under construction */
6320   int isAgg;             /* True for select lists like "count(*)" */
6321   ExprList *pEList = 0;  /* List of columns to extract. */
6322   SrcList *pTabList;     /* List of tables to select from */
6323   Expr *pWhere;          /* The WHERE clause.  May be NULL */
6324   ExprList *pGroupBy;    /* The GROUP BY clause.  May be NULL */
6325   Expr *pHaving;         /* The HAVING clause.  May be NULL */
6326   AggInfo *pAggInfo = 0; /* Aggregate information */
6327   int rc = 1;            /* Value to return from this function */
6328   DistinctCtx sDistinct; /* Info on how to code the DISTINCT keyword */
6329   SortCtx sSort;         /* Info on how to code the ORDER BY clause */
6330   int iEnd;              /* Address of the end of the query */
6331   sqlite3 *db;           /* The database connection */
6332   ExprList *pMinMaxOrderBy = 0;  /* Added ORDER BY for min/max queries */
6333   u8 minMaxFlag;                 /* Flag for min/max queries */
6334 
6335   db = pParse->db;
6336   assert( pParse==db->pParse );
6337   v = sqlite3GetVdbe(pParse);
6338   if( p==0 || pParse->nErr ){
6339     return 1;
6340   }
6341   assert( db->mallocFailed==0 );
6342   if( sqlite3AuthCheck(pParse, SQLITE_SELECT, 0, 0, 0) ) return 1;
6343 #if TREETRACE_ENABLED
6344   SELECTTRACE(1,pParse,p, ("begin processing:\n", pParse->addrExplain));
6345   if( sqlite3TreeTrace & 0x10100 ){
6346     if( (sqlite3TreeTrace & 0x10001)==0x10000 ){
6347       sqlite3TreeViewLine(0, "In sqlite3Select() at %s:%d",
6348                            __FILE__, __LINE__);
6349     }
6350     sqlite3ShowSelect(p);
6351   }
6352 #endif
6353 
6354   assert( p->pOrderBy==0 || pDest->eDest!=SRT_DistFifo );
6355   assert( p->pOrderBy==0 || pDest->eDest!=SRT_Fifo );
6356   assert( p->pOrderBy==0 || pDest->eDest!=SRT_DistQueue );
6357   assert( p->pOrderBy==0 || pDest->eDest!=SRT_Queue );
6358   if( IgnorableDistinct(pDest) ){
6359     assert(pDest->eDest==SRT_Exists     || pDest->eDest==SRT_Union ||
6360            pDest->eDest==SRT_Except     || pDest->eDest==SRT_Discard ||
6361            pDest->eDest==SRT_DistQueue  || pDest->eDest==SRT_DistFifo );
6362     /* All of these destinations are also able to ignore the ORDER BY clause */
6363     if( p->pOrderBy ){
6364 #if TREETRACE_ENABLED
6365       SELECTTRACE(1,pParse,p, ("dropping superfluous ORDER BY:\n"));
6366       if( sqlite3TreeTrace & 0x100 ){
6367         sqlite3TreeViewExprList(0, p->pOrderBy, 0, "ORDERBY");
6368       }
6369 #endif
6370       sqlite3ParserAddCleanup(pParse,
6371         (void(*)(sqlite3*,void*))sqlite3ExprListDelete,
6372         p->pOrderBy);
6373       testcase( pParse->earlyCleanup );
6374       p->pOrderBy = 0;
6375     }
6376     p->selFlags &= ~SF_Distinct;
6377     p->selFlags |= SF_NoopOrderBy;
6378   }
6379   sqlite3SelectPrep(pParse, p, 0);
6380   if( pParse->nErr ){
6381     goto select_end;
6382   }
6383   assert( db->mallocFailed==0 );
6384   assert( p->pEList!=0 );
6385 #if TREETRACE_ENABLED
6386   if( sqlite3TreeTrace & 0x104 ){
6387     SELECTTRACE(0x104,pParse,p, ("after name resolution:\n"));
6388     sqlite3TreeViewSelect(0, p, 0);
6389   }
6390 #endif
6391 
6392   /* If the SF_UFSrcCheck flag is set, then this function is being called
6393   ** as part of populating the temp table for an UPDATE...FROM statement.
6394   ** In this case, it is an error if the target object (pSrc->a[0]) name
6395   ** or alias is duplicated within FROM clause (pSrc->a[1..n]).
6396   **
6397   ** Postgres disallows this case too. The reason is that some other
6398   ** systems handle this case differently, and not all the same way,
6399   ** which is just confusing. To avoid this, we follow PG's lead and
6400   ** disallow it altogether.  */
6401   if( p->selFlags & SF_UFSrcCheck ){
6402     SrcItem *p0 = &p->pSrc->a[0];
6403     for(i=1; i<p->pSrc->nSrc; i++){
6404       SrcItem *p1 = &p->pSrc->a[i];
6405       if( p0->pTab==p1->pTab && 0==sqlite3_stricmp(p0->zAlias, p1->zAlias) ){
6406         sqlite3ErrorMsg(pParse,
6407             "target object/alias may not appear in FROM clause: %s",
6408             p0->zAlias ? p0->zAlias : p0->pTab->zName
6409         );
6410         goto select_end;
6411       }
6412     }
6413 
6414     /* Clear the SF_UFSrcCheck flag. The check has already been performed,
6415     ** and leaving this flag set can cause errors if a compound sub-query
6416     ** in p->pSrc is flattened into this query and this function called
6417     ** again as part of compound SELECT processing.  */
6418     p->selFlags &= ~SF_UFSrcCheck;
6419   }
6420 
6421   if( pDest->eDest==SRT_Output ){
6422     sqlite3GenerateColumnNames(pParse, p);
6423   }
6424 
6425 #ifndef SQLITE_OMIT_WINDOWFUNC
6426   if( sqlite3WindowRewrite(pParse, p) ){
6427     assert( pParse->nErr );
6428     goto select_end;
6429   }
6430 #if TREETRACE_ENABLED
6431   if( p->pWin && (sqlite3TreeTrace & 0x108)!=0 ){
6432     SELECTTRACE(0x104,pParse,p, ("after window rewrite:\n"));
6433     sqlite3TreeViewSelect(0, p, 0);
6434   }
6435 #endif
6436 #endif /* SQLITE_OMIT_WINDOWFUNC */
6437   pTabList = p->pSrc;
6438   isAgg = (p->selFlags & SF_Aggregate)!=0;
6439   memset(&sSort, 0, sizeof(sSort));
6440   sSort.pOrderBy = p->pOrderBy;
6441 
6442   /* Try to do various optimizations (flattening subqueries, and strength
6443   ** reduction of join operators) in the FROM clause up into the main query
6444   */
6445 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
6446   for(i=0; !p->pPrior && i<pTabList->nSrc; i++){
6447     SrcItem *pItem = &pTabList->a[i];
6448     Select *pSub = pItem->pSelect;
6449     Table *pTab = pItem->pTab;
6450 
6451     /* The expander should have already created transient Table objects
6452     ** even for FROM clause elements such as subqueries that do not correspond
6453     ** to a real table */
6454     assert( pTab!=0 );
6455 
6456     /* Convert LEFT JOIN into JOIN if there are terms of the right table
6457     ** of the LEFT JOIN used in the WHERE clause.
6458     */
6459     if( (pItem->fg.jointype & JT_LEFT)!=0
6460      && sqlite3ExprImpliesNonNullRow(p->pWhere, pItem->iCursor)
6461      && OptimizationEnabled(db, SQLITE_SimplifyJoin)
6462     ){
6463       SELECTTRACE(0x100,pParse,p,
6464                 ("LEFT-JOIN simplifies to JOIN on term %d\n",i));
6465       pItem->fg.jointype &= ~(JT_LEFT|JT_OUTER);
6466       unsetJoinExpr(p->pWhere, pItem->iCursor);
6467     }
6468 
6469     /* No futher action if this term of the FROM clause is no a subquery */
6470     if( pSub==0 ) continue;
6471 
6472     /* Catch mismatch in the declared columns of a view and the number of
6473     ** columns in the SELECT on the RHS */
6474     if( pTab->nCol!=pSub->pEList->nExpr ){
6475       sqlite3ErrorMsg(pParse, "expected %d columns for '%s' but got %d",
6476                       pTab->nCol, pTab->zName, pSub->pEList->nExpr);
6477       goto select_end;
6478     }
6479 
6480     /* Do not try to flatten an aggregate subquery.
6481     **
6482     ** Flattening an aggregate subquery is only possible if the outer query
6483     ** is not a join.  But if the outer query is not a join, then the subquery
6484     ** will be implemented as a co-routine and there is no advantage to
6485     ** flattening in that case.
6486     */
6487     if( (pSub->selFlags & SF_Aggregate)!=0 ) continue;
6488     assert( pSub->pGroupBy==0 );
6489 
6490     /* If a FROM-clause subquery has an ORDER BY clause that is not
6491     ** really doing anything, then delete it now so that it does not
6492     ** interfere with query flattening.  See the discussion at
6493     ** https://sqlite.org/forum/forumpost/2d76f2bcf65d256a
6494     **
6495     ** Beware of these cases where the ORDER BY clause may not be safely
6496     ** omitted:
6497     **
6498     **    (1)   There is also a LIMIT clause
6499     **    (2)   The subquery was added to help with window-function
6500     **          processing
6501     **    (3)   The subquery is in the FROM clause of an UPDATE
6502     **    (4)   The outer query uses an aggregate function other than
6503     **          the built-in count(), min(), or max().
6504     **    (5)   The ORDER BY isn't going to accomplish anything because
6505     **          one of:
6506     **            (a)  The outer query has a different ORDER BY clause
6507     **            (b)  The subquery is part of a join
6508     **          See forum post 062d576715d277c8
6509     */
6510     if( pSub->pOrderBy!=0
6511      && (p->pOrderBy!=0 || pTabList->nSrc>1)      /* Condition (5) */
6512      && pSub->pLimit==0                           /* Condition (1) */
6513      && (pSub->selFlags & SF_OrderByReqd)==0      /* Condition (2) */
6514      && (p->selFlags & SF_OrderByReqd)==0         /* Condition (3) and (4) */
6515      && OptimizationEnabled(db, SQLITE_OmitOrderBy)
6516     ){
6517       SELECTTRACE(0x100,pParse,p,
6518                 ("omit superfluous ORDER BY on %r FROM-clause subquery\n",i+1));
6519       sqlite3ExprListDelete(db, pSub->pOrderBy);
6520       pSub->pOrderBy = 0;
6521     }
6522 
6523     /* If the outer query contains a "complex" result set (that is,
6524     ** if the result set of the outer query uses functions or subqueries)
6525     ** and if the subquery contains an ORDER BY clause and if
6526     ** it will be implemented as a co-routine, then do not flatten.  This
6527     ** restriction allows SQL constructs like this:
6528     **
6529     **  SELECT expensive_function(x)
6530     **    FROM (SELECT x FROM tab ORDER BY y LIMIT 10);
6531     **
6532     ** The expensive_function() is only computed on the 10 rows that
6533     ** are output, rather than every row of the table.
6534     **
6535     ** The requirement that the outer query have a complex result set
6536     ** means that flattening does occur on simpler SQL constraints without
6537     ** the expensive_function() like:
6538     **
6539     **  SELECT x FROM (SELECT x FROM tab ORDER BY y LIMIT 10);
6540     */
6541     if( pSub->pOrderBy!=0
6542      && i==0
6543      && (p->selFlags & SF_ComplexResult)!=0
6544      && (pTabList->nSrc==1
6545          || (pTabList->a[1].fg.jointype&(JT_LEFT|JT_CROSS))!=0)
6546     ){
6547       continue;
6548     }
6549 
6550     if( flattenSubquery(pParse, p, i, isAgg) ){
6551       if( pParse->nErr ) goto select_end;
6552       /* This subquery can be absorbed into its parent. */
6553       i = -1;
6554     }
6555     pTabList = p->pSrc;
6556     if( db->mallocFailed ) goto select_end;
6557     if( !IgnorableOrderby(pDest) ){
6558       sSort.pOrderBy = p->pOrderBy;
6559     }
6560   }
6561 #endif
6562 
6563 #ifndef SQLITE_OMIT_COMPOUND_SELECT
6564   /* Handle compound SELECT statements using the separate multiSelect()
6565   ** procedure.
6566   */
6567   if( p->pPrior ){
6568     rc = multiSelect(pParse, p, pDest);
6569 #if TREETRACE_ENABLED
6570     SELECTTRACE(0x1,pParse,p,("end compound-select processing\n"));
6571     if( (sqlite3TreeTrace & 0x2000)!=0 && ExplainQueryPlanParent(pParse)==0 ){
6572       sqlite3TreeViewSelect(0, p, 0);
6573     }
6574 #endif
6575     if( p->pNext==0 ) ExplainQueryPlanPop(pParse);
6576     return rc;
6577   }
6578 #endif
6579 
6580   /* Do the WHERE-clause constant propagation optimization if this is
6581   ** a join.  No need to speed time on this operation for non-join queries
6582   ** as the equivalent optimization will be handled by query planner in
6583   ** sqlite3WhereBegin().
6584   */
6585   if( p->pWhere!=0
6586    && p->pWhere->op==TK_AND
6587    && OptimizationEnabled(db, SQLITE_PropagateConst)
6588    && propagateConstants(pParse, p)
6589   ){
6590 #if TREETRACE_ENABLED
6591     if( sqlite3TreeTrace & 0x100 ){
6592       SELECTTRACE(0x100,pParse,p,("After constant propagation:\n"));
6593       sqlite3TreeViewSelect(0, p, 0);
6594     }
6595 #endif
6596   }else{
6597     SELECTTRACE(0x100,pParse,p,("Constant propagation not helpful\n"));
6598   }
6599 
6600 #ifdef SQLITE_COUNTOFVIEW_OPTIMIZATION
6601   if( OptimizationEnabled(db, SQLITE_QueryFlattener|SQLITE_CountOfView)
6602    && countOfViewOptimization(pParse, p)
6603   ){
6604     if( db->mallocFailed ) goto select_end;
6605     pEList = p->pEList;
6606     pTabList = p->pSrc;
6607   }
6608 #endif
6609 
6610   /* For each term in the FROM clause, do two things:
6611   ** (1) Authorized unreferenced tables
6612   ** (2) Generate code for all sub-queries
6613   */
6614   for(i=0; i<pTabList->nSrc; i++){
6615     SrcItem *pItem = &pTabList->a[i];
6616     SrcItem *pPrior;
6617     SelectDest dest;
6618     Select *pSub;
6619 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
6620     const char *zSavedAuthContext;
6621 #endif
6622 
6623     /* Issue SQLITE_READ authorizations with a fake column name for any
6624     ** tables that are referenced but from which no values are extracted.
6625     ** Examples of where these kinds of null SQLITE_READ authorizations
6626     ** would occur:
6627     **
6628     **     SELECT count(*) FROM t1;   -- SQLITE_READ t1.""
6629     **     SELECT t1.* FROM t1, t2;   -- SQLITE_READ t2.""
6630     **
6631     ** The fake column name is an empty string.  It is possible for a table to
6632     ** have a column named by the empty string, in which case there is no way to
6633     ** distinguish between an unreferenced table and an actual reference to the
6634     ** "" column. The original design was for the fake column name to be a NULL,
6635     ** which would be unambiguous.  But legacy authorization callbacks might
6636     ** assume the column name is non-NULL and segfault.  The use of an empty
6637     ** string for the fake column name seems safer.
6638     */
6639     if( pItem->colUsed==0 && pItem->zName!=0 ){
6640       sqlite3AuthCheck(pParse, SQLITE_READ, pItem->zName, "", pItem->zDatabase);
6641     }
6642 
6643 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
6644     /* Generate code for all sub-queries in the FROM clause
6645     */
6646     pSub = pItem->pSelect;
6647     if( pSub==0 ) continue;
6648 
6649     /* The code for a subquery should only be generated once. */
6650     assert( pItem->addrFillSub==0 );
6651 
6652     /* Increment Parse.nHeight by the height of the largest expression
6653     ** tree referred to by this, the parent select. The child select
6654     ** may contain expression trees of at most
6655     ** (SQLITE_MAX_EXPR_DEPTH-Parse.nHeight) height. This is a bit
6656     ** more conservative than necessary, but much easier than enforcing
6657     ** an exact limit.
6658     */
6659     pParse->nHeight += sqlite3SelectExprHeight(p);
6660 
6661     /* Make copies of constant WHERE-clause terms in the outer query down
6662     ** inside the subquery.  This can help the subquery to run more efficiently.
6663     */
6664     if( OptimizationEnabled(db, SQLITE_PushDown)
6665      && (pItem->fg.isCte==0
6666          || (pItem->u2.pCteUse->eM10d!=M10d_Yes && pItem->u2.pCteUse->nUse<2))
6667      && pushDownWhereTerms(pParse, pSub, p->pWhere, pItem->iCursor,
6668                            (pItem->fg.jointype & JT_OUTER)!=0)
6669     ){
6670 #if TREETRACE_ENABLED
6671       if( sqlite3TreeTrace & 0x100 ){
6672         SELECTTRACE(0x100,pParse,p,
6673             ("After WHERE-clause push-down into subquery %d:\n", pSub->selId));
6674         sqlite3TreeViewSelect(0, p, 0);
6675       }
6676 #endif
6677       assert( pItem->pSelect && (pItem->pSelect->selFlags & SF_PushDown)!=0 );
6678     }else{
6679       SELECTTRACE(0x100,pParse,p,("Push-down not possible\n"));
6680     }
6681 
6682     zSavedAuthContext = pParse->zAuthContext;
6683     pParse->zAuthContext = pItem->zName;
6684 
6685     /* Generate code to implement the subquery
6686     **
6687     ** The subquery is implemented as a co-routine if:
6688     **    (1)  the subquery is guaranteed to be the outer loop (so that
6689     **         it does not need to be computed more than once), and
6690     **    (2)  the subquery is not a CTE that should be materialized
6691     **
6692     ** TODO: Are there other reasons beside (1) and (2) to use a co-routine
6693     ** implementation?
6694     */
6695     if( i==0
6696      && (pTabList->nSrc==1
6697             || (pTabList->a[1].fg.jointype&(JT_LEFT|JT_CROSS))!=0)  /* (1) */
6698      && (pItem->fg.isCte==0 || pItem->u2.pCteUse->eM10d!=M10d_Yes)  /* (2) */
6699     ){
6700       /* Implement a co-routine that will return a single row of the result
6701       ** set on each invocation.
6702       */
6703       int addrTop = sqlite3VdbeCurrentAddr(v)+1;
6704 
6705       pItem->regReturn = ++pParse->nMem;
6706       sqlite3VdbeAddOp3(v, OP_InitCoroutine, pItem->regReturn, 0, addrTop);
6707       VdbeComment((v, "%!S", pItem));
6708       pItem->addrFillSub = addrTop;
6709       sqlite3SelectDestInit(&dest, SRT_Coroutine, pItem->regReturn);
6710       ExplainQueryPlan((pParse, 1, "CO-ROUTINE %!S", pItem));
6711       sqlite3Select(pParse, pSub, &dest);
6712       pItem->pTab->nRowLogEst = pSub->nSelectRow;
6713       pItem->fg.viaCoroutine = 1;
6714       pItem->regResult = dest.iSdst;
6715       sqlite3VdbeEndCoroutine(v, pItem->regReturn);
6716       sqlite3VdbeJumpHere(v, addrTop-1);
6717       sqlite3ClearTempRegCache(pParse);
6718     }else if( pItem->fg.isCte && pItem->u2.pCteUse->addrM9e>0 ){
6719       /* This is a CTE for which materialization code has already been
6720       ** generated.  Invoke the subroutine to compute the materialization,
6721       ** the make the pItem->iCursor be a copy of the ephemerial table that
6722       ** holds the result of the materialization. */
6723       CteUse *pCteUse = pItem->u2.pCteUse;
6724       sqlite3VdbeAddOp2(v, OP_Gosub, pCteUse->regRtn, pCteUse->addrM9e);
6725       if( pItem->iCursor!=pCteUse->iCur ){
6726         sqlite3VdbeAddOp2(v, OP_OpenDup, pItem->iCursor, pCteUse->iCur);
6727         VdbeComment((v, "%!S", pItem));
6728       }
6729       pSub->nSelectRow = pCteUse->nRowEst;
6730     }else if( (pPrior = isSelfJoinView(pTabList, pItem))!=0 ){
6731       /* This view has already been materialized by a prior entry in
6732       ** this same FROM clause.  Reuse it. */
6733       if( pPrior->addrFillSub ){
6734         sqlite3VdbeAddOp2(v, OP_Gosub, pPrior->regReturn, pPrior->addrFillSub);
6735       }
6736       sqlite3VdbeAddOp2(v, OP_OpenDup, pItem->iCursor, pPrior->iCursor);
6737       pSub->nSelectRow = pPrior->pSelect->nSelectRow;
6738     }else{
6739       /* Materialize the view.  If the view is not correlated, generate a
6740       ** subroutine to do the materialization so that subsequent uses of
6741       ** the same view can reuse the materialization. */
6742       int topAddr;
6743       int onceAddr = 0;
6744       int retAddr;
6745 
6746       pItem->regReturn = ++pParse->nMem;
6747       topAddr = sqlite3VdbeAddOp2(v, OP_Integer, 0, pItem->regReturn);
6748       pItem->addrFillSub = topAddr+1;
6749       if( pItem->fg.isCorrelated==0 ){
6750         /* If the subquery is not correlated and if we are not inside of
6751         ** a trigger, then we only need to compute the value of the subquery
6752         ** once. */
6753         onceAddr = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
6754         VdbeComment((v, "materialize %!S", pItem));
6755       }else{
6756         VdbeNoopComment((v, "materialize %!S", pItem));
6757       }
6758       sqlite3SelectDestInit(&dest, SRT_EphemTab, pItem->iCursor);
6759       ExplainQueryPlan((pParse, 1, "MATERIALIZE %!S", pItem));
6760       sqlite3Select(pParse, pSub, &dest);
6761       pItem->pTab->nRowLogEst = pSub->nSelectRow;
6762       if( onceAddr ) sqlite3VdbeJumpHere(v, onceAddr);
6763       retAddr = sqlite3VdbeAddOp1(v, OP_Return, pItem->regReturn);
6764       VdbeComment((v, "end %!S", pItem));
6765       sqlite3VdbeChangeP1(v, topAddr, retAddr);
6766       sqlite3ClearTempRegCache(pParse);
6767       if( pItem->fg.isCte && pItem->fg.isCorrelated==0 ){
6768         CteUse *pCteUse = pItem->u2.pCteUse;
6769         pCteUse->addrM9e = pItem->addrFillSub;
6770         pCteUse->regRtn = pItem->regReturn;
6771         pCteUse->iCur = pItem->iCursor;
6772         pCteUse->nRowEst = pSub->nSelectRow;
6773       }
6774     }
6775     if( db->mallocFailed ) goto select_end;
6776     pParse->nHeight -= sqlite3SelectExprHeight(p);
6777     pParse->zAuthContext = zSavedAuthContext;
6778 #endif
6779   }
6780 
6781   /* Various elements of the SELECT copied into local variables for
6782   ** convenience */
6783   pEList = p->pEList;
6784   pWhere = p->pWhere;
6785   pGroupBy = p->pGroupBy;
6786   pHaving = p->pHaving;
6787   sDistinct.isTnct = (p->selFlags & SF_Distinct)!=0;
6788 
6789 #if TREETRACE_ENABLED
6790   if( sqlite3TreeTrace & 0x400 ){
6791     SELECTTRACE(0x400,pParse,p,("After all FROM-clause analysis:\n"));
6792     sqlite3TreeViewSelect(0, p, 0);
6793   }
6794 #endif
6795 
6796   /* If the query is DISTINCT with an ORDER BY but is not an aggregate, and
6797   ** if the select-list is the same as the ORDER BY list, then this query
6798   ** can be rewritten as a GROUP BY. In other words, this:
6799   **
6800   **     SELECT DISTINCT xyz FROM ... ORDER BY xyz
6801   **
6802   ** is transformed to:
6803   **
6804   **     SELECT xyz FROM ... GROUP BY xyz ORDER BY xyz
6805   **
6806   ** The second form is preferred as a single index (or temp-table) may be
6807   ** used for both the ORDER BY and DISTINCT processing. As originally
6808   ** written the query must use a temp-table for at least one of the ORDER
6809   ** BY and DISTINCT, and an index or separate temp-table for the other.
6810   */
6811   if( (p->selFlags & (SF_Distinct|SF_Aggregate))==SF_Distinct
6812    && sqlite3ExprListCompare(sSort.pOrderBy, pEList, -1)==0
6813 #ifndef SQLITE_OMIT_WINDOWFUNC
6814    && p->pWin==0
6815 #endif
6816   ){
6817     p->selFlags &= ~SF_Distinct;
6818     pGroupBy = p->pGroupBy = sqlite3ExprListDup(db, pEList, 0);
6819     p->selFlags |= SF_Aggregate;
6820     /* Notice that even thought SF_Distinct has been cleared from p->selFlags,
6821     ** the sDistinct.isTnct is still set.  Hence, isTnct represents the
6822     ** original setting of the SF_Distinct flag, not the current setting */
6823     assert( sDistinct.isTnct );
6824     sDistinct.isTnct = 2;
6825 
6826 #if TREETRACE_ENABLED
6827     if( sqlite3TreeTrace & 0x400 ){
6828       SELECTTRACE(0x400,pParse,p,("Transform DISTINCT into GROUP BY:\n"));
6829       sqlite3TreeViewSelect(0, p, 0);
6830     }
6831 #endif
6832   }
6833 
6834   /* If there is an ORDER BY clause, then create an ephemeral index to
6835   ** do the sorting.  But this sorting ephemeral index might end up
6836   ** being unused if the data can be extracted in pre-sorted order.
6837   ** If that is the case, then the OP_OpenEphemeral instruction will be
6838   ** changed to an OP_Noop once we figure out that the sorting index is
6839   ** not needed.  The sSort.addrSortIndex variable is used to facilitate
6840   ** that change.
6841   */
6842   if( sSort.pOrderBy ){
6843     KeyInfo *pKeyInfo;
6844     pKeyInfo = sqlite3KeyInfoFromExprList(
6845         pParse, sSort.pOrderBy, 0, pEList->nExpr);
6846     sSort.iECursor = pParse->nTab++;
6847     sSort.addrSortIndex =
6848       sqlite3VdbeAddOp4(v, OP_OpenEphemeral,
6849           sSort.iECursor, sSort.pOrderBy->nExpr+1+pEList->nExpr, 0,
6850           (char*)pKeyInfo, P4_KEYINFO
6851       );
6852   }else{
6853     sSort.addrSortIndex = -1;
6854   }
6855 
6856   /* If the output is destined for a temporary table, open that table.
6857   */
6858   if( pDest->eDest==SRT_EphemTab ){
6859     sqlite3VdbeAddOp2(v, OP_OpenEphemeral, pDest->iSDParm, pEList->nExpr);
6860   }
6861 
6862   /* Set the limiter.
6863   */
6864   iEnd = sqlite3VdbeMakeLabel(pParse);
6865   if( (p->selFlags & SF_FixedLimit)==0 ){
6866     p->nSelectRow = 320;  /* 4 billion rows */
6867   }
6868   computeLimitRegisters(pParse, p, iEnd);
6869   if( p->iLimit==0 && sSort.addrSortIndex>=0 ){
6870     sqlite3VdbeChangeOpcode(v, sSort.addrSortIndex, OP_SorterOpen);
6871     sSort.sortFlags |= SORTFLAG_UseSorter;
6872   }
6873 
6874   /* Open an ephemeral index to use for the distinct set.
6875   */
6876   if( p->selFlags & SF_Distinct ){
6877     sDistinct.tabTnct = pParse->nTab++;
6878     sDistinct.addrTnct = sqlite3VdbeAddOp4(v, OP_OpenEphemeral,
6879                        sDistinct.tabTnct, 0, 0,
6880                        (char*)sqlite3KeyInfoFromExprList(pParse, p->pEList,0,0),
6881                        P4_KEYINFO);
6882     sqlite3VdbeChangeP5(v, BTREE_UNORDERED);
6883     sDistinct.eTnctType = WHERE_DISTINCT_UNORDERED;
6884   }else{
6885     sDistinct.eTnctType = WHERE_DISTINCT_NOOP;
6886   }
6887 
6888   if( !isAgg && pGroupBy==0 ){
6889     /* No aggregate functions and no GROUP BY clause */
6890     u16 wctrlFlags = (sDistinct.isTnct ? WHERE_WANT_DISTINCT : 0)
6891                    | (p->selFlags & SF_FixedLimit);
6892 #ifndef SQLITE_OMIT_WINDOWFUNC
6893     Window *pWin = p->pWin;      /* Main window object (or NULL) */
6894     if( pWin ){
6895       sqlite3WindowCodeInit(pParse, p);
6896     }
6897 #endif
6898     assert( WHERE_USE_LIMIT==SF_FixedLimit );
6899 
6900 
6901     /* Begin the database scan. */
6902     SELECTTRACE(1,pParse,p,("WhereBegin\n"));
6903     pWInfo = sqlite3WhereBegin(pParse, pTabList, pWhere, sSort.pOrderBy,
6904                                p->pEList, p, wctrlFlags, p->nSelectRow);
6905     if( pWInfo==0 ) goto select_end;
6906     if( sqlite3WhereOutputRowCount(pWInfo) < p->nSelectRow ){
6907       p->nSelectRow = sqlite3WhereOutputRowCount(pWInfo);
6908     }
6909     if( sDistinct.isTnct && sqlite3WhereIsDistinct(pWInfo) ){
6910       sDistinct.eTnctType = sqlite3WhereIsDistinct(pWInfo);
6911     }
6912     if( sSort.pOrderBy ){
6913       sSort.nOBSat = sqlite3WhereIsOrdered(pWInfo);
6914       sSort.labelOBLopt = sqlite3WhereOrderByLimitOptLabel(pWInfo);
6915       if( sSort.nOBSat==sSort.pOrderBy->nExpr ){
6916         sSort.pOrderBy = 0;
6917       }
6918     }
6919     SELECTTRACE(1,pParse,p,("WhereBegin returns\n"));
6920 
6921     /* If sorting index that was created by a prior OP_OpenEphemeral
6922     ** instruction ended up not being needed, then change the OP_OpenEphemeral
6923     ** into an OP_Noop.
6924     */
6925     if( sSort.addrSortIndex>=0 && sSort.pOrderBy==0 ){
6926       sqlite3VdbeChangeToNoop(v, sSort.addrSortIndex);
6927     }
6928 
6929     assert( p->pEList==pEList );
6930 #ifndef SQLITE_OMIT_WINDOWFUNC
6931     if( pWin ){
6932       int addrGosub = sqlite3VdbeMakeLabel(pParse);
6933       int iCont = sqlite3VdbeMakeLabel(pParse);
6934       int iBreak = sqlite3VdbeMakeLabel(pParse);
6935       int regGosub = ++pParse->nMem;
6936 
6937       sqlite3WindowCodeStep(pParse, p, pWInfo, regGosub, addrGosub);
6938 
6939       sqlite3VdbeAddOp2(v, OP_Goto, 0, iBreak);
6940       sqlite3VdbeResolveLabel(v, addrGosub);
6941       VdbeNoopComment((v, "inner-loop subroutine"));
6942       sSort.labelOBLopt = 0;
6943       selectInnerLoop(pParse, p, -1, &sSort, &sDistinct, pDest, iCont, iBreak);
6944       sqlite3VdbeResolveLabel(v, iCont);
6945       sqlite3VdbeAddOp1(v, OP_Return, regGosub);
6946       VdbeComment((v, "end inner-loop subroutine"));
6947       sqlite3VdbeResolveLabel(v, iBreak);
6948     }else
6949 #endif /* SQLITE_OMIT_WINDOWFUNC */
6950     {
6951       /* Use the standard inner loop. */
6952       selectInnerLoop(pParse, p, -1, &sSort, &sDistinct, pDest,
6953           sqlite3WhereContinueLabel(pWInfo),
6954           sqlite3WhereBreakLabel(pWInfo));
6955 
6956       /* End the database scan loop.
6957       */
6958       SELECTTRACE(1,pParse,p,("WhereEnd\n"));
6959       sqlite3WhereEnd(pWInfo);
6960     }
6961   }else{
6962     /* This case when there exist aggregate functions or a GROUP BY clause
6963     ** or both */
6964     NameContext sNC;    /* Name context for processing aggregate information */
6965     int iAMem;          /* First Mem address for storing current GROUP BY */
6966     int iBMem;          /* First Mem address for previous GROUP BY */
6967     int iUseFlag;       /* Mem address holding flag indicating that at least
6968                         ** one row of the input to the aggregator has been
6969                         ** processed */
6970     int iAbortFlag;     /* Mem address which causes query abort if positive */
6971     int groupBySort;    /* Rows come from source in GROUP BY order */
6972     int addrEnd;        /* End of processing for this SELECT */
6973     int sortPTab = 0;   /* Pseudotable used to decode sorting results */
6974     int sortOut = 0;    /* Output register from the sorter */
6975     int orderByGrp = 0; /* True if the GROUP BY and ORDER BY are the same */
6976 
6977     /* Remove any and all aliases between the result set and the
6978     ** GROUP BY clause.
6979     */
6980     if( pGroupBy ){
6981       int k;                        /* Loop counter */
6982       struct ExprList_item *pItem;  /* For looping over expression in a list */
6983 
6984       for(k=p->pEList->nExpr, pItem=p->pEList->a; k>0; k--, pItem++){
6985         pItem->u.x.iAlias = 0;
6986       }
6987       for(k=pGroupBy->nExpr, pItem=pGroupBy->a; k>0; k--, pItem++){
6988         pItem->u.x.iAlias = 0;
6989       }
6990       assert( 66==sqlite3LogEst(100) );
6991       if( p->nSelectRow>66 ) p->nSelectRow = 66;
6992 
6993       /* If there is both a GROUP BY and an ORDER BY clause and they are
6994       ** identical, then it may be possible to disable the ORDER BY clause
6995       ** on the grounds that the GROUP BY will cause elements to come out
6996       ** in the correct order. It also may not - the GROUP BY might use a
6997       ** database index that causes rows to be grouped together as required
6998       ** but not actually sorted. Either way, record the fact that the
6999       ** ORDER BY and GROUP BY clauses are the same by setting the orderByGrp
7000       ** variable.  */
7001       if( sSort.pOrderBy && pGroupBy->nExpr==sSort.pOrderBy->nExpr ){
7002         int ii;
7003         /* The GROUP BY processing doesn't care whether rows are delivered in
7004         ** ASC or DESC order - only that each group is returned contiguously.
7005         ** So set the ASC/DESC flags in the GROUP BY to match those in the
7006         ** ORDER BY to maximize the chances of rows being delivered in an
7007         ** order that makes the ORDER BY redundant.  */
7008         for(ii=0; ii<pGroupBy->nExpr; ii++){
7009           u8 sortFlags = sSort.pOrderBy->a[ii].sortFlags & KEYINFO_ORDER_DESC;
7010           pGroupBy->a[ii].sortFlags = sortFlags;
7011         }
7012         if( sqlite3ExprListCompare(pGroupBy, sSort.pOrderBy, -1)==0 ){
7013           orderByGrp = 1;
7014         }
7015       }
7016     }else{
7017       assert( 0==sqlite3LogEst(1) );
7018       p->nSelectRow = 0;
7019     }
7020 
7021     /* Create a label to jump to when we want to abort the query */
7022     addrEnd = sqlite3VdbeMakeLabel(pParse);
7023 
7024     /* Convert TK_COLUMN nodes into TK_AGG_COLUMN and make entries in
7025     ** sAggInfo for all TK_AGG_FUNCTION nodes in expressions of the
7026     ** SELECT statement.
7027     */
7028     pAggInfo = sqlite3DbMallocZero(db, sizeof(*pAggInfo) );
7029     if( pAggInfo ){
7030       sqlite3ParserAddCleanup(pParse,
7031           (void(*)(sqlite3*,void*))agginfoFree, pAggInfo);
7032       testcase( pParse->earlyCleanup );
7033     }
7034     if( db->mallocFailed ){
7035       goto select_end;
7036     }
7037     pAggInfo->selId = p->selId;
7038     memset(&sNC, 0, sizeof(sNC));
7039     sNC.pParse = pParse;
7040     sNC.pSrcList = pTabList;
7041     sNC.uNC.pAggInfo = pAggInfo;
7042     VVA_ONLY( sNC.ncFlags = NC_UAggInfo; )
7043     pAggInfo->mnReg = pParse->nMem+1;
7044     pAggInfo->nSortingColumn = pGroupBy ? pGroupBy->nExpr : 0;
7045     pAggInfo->pGroupBy = pGroupBy;
7046     sqlite3ExprAnalyzeAggList(&sNC, pEList);
7047     sqlite3ExprAnalyzeAggList(&sNC, sSort.pOrderBy);
7048     if( pHaving ){
7049       if( pGroupBy ){
7050         assert( pWhere==p->pWhere );
7051         assert( pHaving==p->pHaving );
7052         assert( pGroupBy==p->pGroupBy );
7053         havingToWhere(pParse, p);
7054         pWhere = p->pWhere;
7055       }
7056       sqlite3ExprAnalyzeAggregates(&sNC, pHaving);
7057     }
7058     pAggInfo->nAccumulator = pAggInfo->nColumn;
7059     if( p->pGroupBy==0 && p->pHaving==0 && pAggInfo->nFunc==1 ){
7060       minMaxFlag = minMaxQuery(db, pAggInfo->aFunc[0].pFExpr, &pMinMaxOrderBy);
7061     }else{
7062       minMaxFlag = WHERE_ORDERBY_NORMAL;
7063     }
7064     for(i=0; i<pAggInfo->nFunc; i++){
7065       Expr *pExpr = pAggInfo->aFunc[i].pFExpr;
7066       assert( ExprUseXList(pExpr) );
7067       sNC.ncFlags |= NC_InAggFunc;
7068       sqlite3ExprAnalyzeAggList(&sNC, pExpr->x.pList);
7069 #ifndef SQLITE_OMIT_WINDOWFUNC
7070       assert( !IsWindowFunc(pExpr) );
7071       if( ExprHasProperty(pExpr, EP_WinFunc) ){
7072         sqlite3ExprAnalyzeAggregates(&sNC, pExpr->y.pWin->pFilter);
7073       }
7074 #endif
7075       sNC.ncFlags &= ~NC_InAggFunc;
7076     }
7077     pAggInfo->mxReg = pParse->nMem;
7078     if( db->mallocFailed ) goto select_end;
7079 #if TREETRACE_ENABLED
7080     if( sqlite3TreeTrace & 0x400 ){
7081       int ii;
7082       SELECTTRACE(0x400,pParse,p,("After aggregate analysis %p:\n", pAggInfo));
7083       sqlite3TreeViewSelect(0, p, 0);
7084       if( minMaxFlag ){
7085         sqlite3DebugPrintf("MIN/MAX Optimization (0x%02x) adds:\n", minMaxFlag);
7086         sqlite3TreeViewExprList(0, pMinMaxOrderBy, 0, "ORDERBY");
7087       }
7088       for(ii=0; ii<pAggInfo->nColumn; ii++){
7089         sqlite3DebugPrintf("agg-column[%d] iMem=%d\n",
7090             ii, pAggInfo->aCol[ii].iMem);
7091         sqlite3TreeViewExpr(0, pAggInfo->aCol[ii].pCExpr, 0);
7092       }
7093       for(ii=0; ii<pAggInfo->nFunc; ii++){
7094         sqlite3DebugPrintf("agg-func[%d]: iMem=%d\n",
7095             ii, pAggInfo->aFunc[ii].iMem);
7096         sqlite3TreeViewExpr(0, pAggInfo->aFunc[ii].pFExpr, 0);
7097       }
7098     }
7099 #endif
7100 
7101 
7102     /* Processing for aggregates with GROUP BY is very different and
7103     ** much more complex than aggregates without a GROUP BY.
7104     */
7105     if( pGroupBy ){
7106       KeyInfo *pKeyInfo;  /* Keying information for the group by clause */
7107       int addr1;          /* A-vs-B comparision jump */
7108       int addrOutputRow;  /* Start of subroutine that outputs a result row */
7109       int regOutputRow;   /* Return address register for output subroutine */
7110       int addrSetAbort;   /* Set the abort flag and return */
7111       int addrTopOfLoop;  /* Top of the input loop */
7112       int addrSortingIdx; /* The OP_OpenEphemeral for the sorting index */
7113       int addrReset;      /* Subroutine for resetting the accumulator */
7114       int regReset;       /* Return address register for reset subroutine */
7115       ExprList *pDistinct = 0;
7116       u16 distFlag = 0;
7117       int eDist = WHERE_DISTINCT_NOOP;
7118 
7119       if( pAggInfo->nFunc==1
7120        && pAggInfo->aFunc[0].iDistinct>=0
7121        && ALWAYS(pAggInfo->aFunc[0].pFExpr!=0)
7122        && ALWAYS(ExprUseXList(pAggInfo->aFunc[0].pFExpr))
7123        && pAggInfo->aFunc[0].pFExpr->x.pList!=0
7124       ){
7125         Expr *pExpr = pAggInfo->aFunc[0].pFExpr->x.pList->a[0].pExpr;
7126         pExpr = sqlite3ExprDup(db, pExpr, 0);
7127         pDistinct = sqlite3ExprListDup(db, pGroupBy, 0);
7128         pDistinct = sqlite3ExprListAppend(pParse, pDistinct, pExpr);
7129         distFlag = pDistinct ? (WHERE_WANT_DISTINCT|WHERE_AGG_DISTINCT) : 0;
7130       }
7131 
7132       /* If there is a GROUP BY clause we might need a sorting index to
7133       ** implement it.  Allocate that sorting index now.  If it turns out
7134       ** that we do not need it after all, the OP_SorterOpen instruction
7135       ** will be converted into a Noop.
7136       */
7137       pAggInfo->sortingIdx = pParse->nTab++;
7138       pKeyInfo = sqlite3KeyInfoFromExprList(pParse, pGroupBy,
7139                                             0, pAggInfo->nColumn);
7140       addrSortingIdx = sqlite3VdbeAddOp4(v, OP_SorterOpen,
7141           pAggInfo->sortingIdx, pAggInfo->nSortingColumn,
7142           0, (char*)pKeyInfo, P4_KEYINFO);
7143 
7144       /* Initialize memory locations used by GROUP BY aggregate processing
7145       */
7146       iUseFlag = ++pParse->nMem;
7147       iAbortFlag = ++pParse->nMem;
7148       regOutputRow = ++pParse->nMem;
7149       addrOutputRow = sqlite3VdbeMakeLabel(pParse);
7150       regReset = ++pParse->nMem;
7151       addrReset = sqlite3VdbeMakeLabel(pParse);
7152       iAMem = pParse->nMem + 1;
7153       pParse->nMem += pGroupBy->nExpr;
7154       iBMem = pParse->nMem + 1;
7155       pParse->nMem += pGroupBy->nExpr;
7156       sqlite3VdbeAddOp2(v, OP_Integer, 0, iAbortFlag);
7157       VdbeComment((v, "clear abort flag"));
7158       sqlite3VdbeAddOp3(v, OP_Null, 0, iAMem, iAMem+pGroupBy->nExpr-1);
7159 
7160       /* Begin a loop that will extract all source rows in GROUP BY order.
7161       ** This might involve two separate loops with an OP_Sort in between, or
7162       ** it might be a single loop that uses an index to extract information
7163       ** in the right order to begin with.
7164       */
7165       sqlite3VdbeAddOp2(v, OP_Gosub, regReset, addrReset);
7166       SELECTTRACE(1,pParse,p,("WhereBegin\n"));
7167       pWInfo = sqlite3WhereBegin(pParse, pTabList, pWhere, pGroupBy, pDistinct,
7168           0, (sDistinct.isTnct==2 ? WHERE_DISTINCTBY : WHERE_GROUPBY)
7169           |  (orderByGrp ? WHERE_SORTBYGROUP : 0) | distFlag, 0
7170       );
7171       if( pWInfo==0 ){
7172         sqlite3ExprListDelete(db, pDistinct);
7173         goto select_end;
7174       }
7175       eDist = sqlite3WhereIsDistinct(pWInfo);
7176       SELECTTRACE(1,pParse,p,("WhereBegin returns\n"));
7177       if( sqlite3WhereIsOrdered(pWInfo)==pGroupBy->nExpr ){
7178         /* The optimizer is able to deliver rows in group by order so
7179         ** we do not have to sort.  The OP_OpenEphemeral table will be
7180         ** cancelled later because we still need to use the pKeyInfo
7181         */
7182         groupBySort = 0;
7183       }else{
7184         /* Rows are coming out in undetermined order.  We have to push
7185         ** each row into a sorting index, terminate the first loop,
7186         ** then loop over the sorting index in order to get the output
7187         ** in sorted order
7188         */
7189         int regBase;
7190         int regRecord;
7191         int nCol;
7192         int nGroupBy;
7193 
7194         explainTempTable(pParse,
7195             (sDistinct.isTnct && (p->selFlags&SF_Distinct)==0) ?
7196                     "DISTINCT" : "GROUP BY");
7197 
7198         groupBySort = 1;
7199         nGroupBy = pGroupBy->nExpr;
7200         nCol = nGroupBy;
7201         j = nGroupBy;
7202         for(i=0; i<pAggInfo->nColumn; i++){
7203           if( pAggInfo->aCol[i].iSorterColumn>=j ){
7204             nCol++;
7205             j++;
7206           }
7207         }
7208         regBase = sqlite3GetTempRange(pParse, nCol);
7209         sqlite3ExprCodeExprList(pParse, pGroupBy, regBase, 0, 0);
7210         j = nGroupBy;
7211         for(i=0; i<pAggInfo->nColumn; i++){
7212           struct AggInfo_col *pCol = &pAggInfo->aCol[i];
7213           if( pCol->iSorterColumn>=j ){
7214             int r1 = j + regBase;
7215             sqlite3ExprCodeGetColumnOfTable(v,
7216                                pCol->pTab, pCol->iTable, pCol->iColumn, r1);
7217             j++;
7218           }
7219         }
7220         regRecord = sqlite3GetTempReg(pParse);
7221         sqlite3VdbeAddOp3(v, OP_MakeRecord, regBase, nCol, regRecord);
7222         sqlite3VdbeAddOp2(v, OP_SorterInsert, pAggInfo->sortingIdx, regRecord);
7223         sqlite3ReleaseTempReg(pParse, regRecord);
7224         sqlite3ReleaseTempRange(pParse, regBase, nCol);
7225         SELECTTRACE(1,pParse,p,("WhereEnd\n"));
7226         sqlite3WhereEnd(pWInfo);
7227         pAggInfo->sortingIdxPTab = sortPTab = pParse->nTab++;
7228         sortOut = sqlite3GetTempReg(pParse);
7229         sqlite3VdbeAddOp3(v, OP_OpenPseudo, sortPTab, sortOut, nCol);
7230         sqlite3VdbeAddOp2(v, OP_SorterSort, pAggInfo->sortingIdx, addrEnd);
7231         VdbeComment((v, "GROUP BY sort")); VdbeCoverage(v);
7232         pAggInfo->useSortingIdx = 1;
7233       }
7234 
7235       /* If the index or temporary table used by the GROUP BY sort
7236       ** will naturally deliver rows in the order required by the ORDER BY
7237       ** clause, cancel the ephemeral table open coded earlier.
7238       **
7239       ** This is an optimization - the correct answer should result regardless.
7240       ** Use the SQLITE_GroupByOrder flag with SQLITE_TESTCTRL_OPTIMIZER to
7241       ** disable this optimization for testing purposes.  */
7242       if( orderByGrp && OptimizationEnabled(db, SQLITE_GroupByOrder)
7243        && (groupBySort || sqlite3WhereIsSorted(pWInfo))
7244       ){
7245         sSort.pOrderBy = 0;
7246         sqlite3VdbeChangeToNoop(v, sSort.addrSortIndex);
7247       }
7248 
7249       /* Evaluate the current GROUP BY terms and store in b0, b1, b2...
7250       ** (b0 is memory location iBMem+0, b1 is iBMem+1, and so forth)
7251       ** Then compare the current GROUP BY terms against the GROUP BY terms
7252       ** from the previous row currently stored in a0, a1, a2...
7253       */
7254       addrTopOfLoop = sqlite3VdbeCurrentAddr(v);
7255       if( groupBySort ){
7256         sqlite3VdbeAddOp3(v, OP_SorterData, pAggInfo->sortingIdx,
7257                           sortOut, sortPTab);
7258       }
7259       for(j=0; j<pGroupBy->nExpr; j++){
7260         if( groupBySort ){
7261           sqlite3VdbeAddOp3(v, OP_Column, sortPTab, j, iBMem+j);
7262         }else{
7263           pAggInfo->directMode = 1;
7264           sqlite3ExprCode(pParse, pGroupBy->a[j].pExpr, iBMem+j);
7265         }
7266       }
7267       sqlite3VdbeAddOp4(v, OP_Compare, iAMem, iBMem, pGroupBy->nExpr,
7268                           (char*)sqlite3KeyInfoRef(pKeyInfo), P4_KEYINFO);
7269       addr1 = sqlite3VdbeCurrentAddr(v);
7270       sqlite3VdbeAddOp3(v, OP_Jump, addr1+1, 0, addr1+1); VdbeCoverage(v);
7271 
7272       /* Generate code that runs whenever the GROUP BY changes.
7273       ** Changes in the GROUP BY are detected by the previous code
7274       ** block.  If there were no changes, this block is skipped.
7275       **
7276       ** This code copies current group by terms in b0,b1,b2,...
7277       ** over to a0,a1,a2.  It then calls the output subroutine
7278       ** and resets the aggregate accumulator registers in preparation
7279       ** for the next GROUP BY batch.
7280       */
7281       sqlite3ExprCodeMove(pParse, iBMem, iAMem, pGroupBy->nExpr);
7282       sqlite3VdbeAddOp2(v, OP_Gosub, regOutputRow, addrOutputRow);
7283       VdbeComment((v, "output one row"));
7284       sqlite3VdbeAddOp2(v, OP_IfPos, iAbortFlag, addrEnd); VdbeCoverage(v);
7285       VdbeComment((v, "check abort flag"));
7286       sqlite3VdbeAddOp2(v, OP_Gosub, regReset, addrReset);
7287       VdbeComment((v, "reset accumulator"));
7288 
7289       /* Update the aggregate accumulators based on the content of
7290       ** the current row
7291       */
7292       sqlite3VdbeJumpHere(v, addr1);
7293       updateAccumulator(pParse, iUseFlag, pAggInfo, eDist);
7294       sqlite3VdbeAddOp2(v, OP_Integer, 1, iUseFlag);
7295       VdbeComment((v, "indicate data in accumulator"));
7296 
7297       /* End of the loop
7298       */
7299       if( groupBySort ){
7300         sqlite3VdbeAddOp2(v, OP_SorterNext, pAggInfo->sortingIdx,addrTopOfLoop);
7301         VdbeCoverage(v);
7302       }else{
7303         SELECTTRACE(1,pParse,p,("WhereEnd\n"));
7304         sqlite3WhereEnd(pWInfo);
7305         sqlite3VdbeChangeToNoop(v, addrSortingIdx);
7306       }
7307       sqlite3ExprListDelete(db, pDistinct);
7308 
7309       /* Output the final row of result
7310       */
7311       sqlite3VdbeAddOp2(v, OP_Gosub, regOutputRow, addrOutputRow);
7312       VdbeComment((v, "output final row"));
7313 
7314       /* Jump over the subroutines
7315       */
7316       sqlite3VdbeGoto(v, addrEnd);
7317 
7318       /* Generate a subroutine that outputs a single row of the result
7319       ** set.  This subroutine first looks at the iUseFlag.  If iUseFlag
7320       ** is less than or equal to zero, the subroutine is a no-op.  If
7321       ** the processing calls for the query to abort, this subroutine
7322       ** increments the iAbortFlag memory location before returning in
7323       ** order to signal the caller to abort.
7324       */
7325       addrSetAbort = sqlite3VdbeCurrentAddr(v);
7326       sqlite3VdbeAddOp2(v, OP_Integer, 1, iAbortFlag);
7327       VdbeComment((v, "set abort flag"));
7328       sqlite3VdbeAddOp1(v, OP_Return, regOutputRow);
7329       sqlite3VdbeResolveLabel(v, addrOutputRow);
7330       addrOutputRow = sqlite3VdbeCurrentAddr(v);
7331       sqlite3VdbeAddOp2(v, OP_IfPos, iUseFlag, addrOutputRow+2);
7332       VdbeCoverage(v);
7333       VdbeComment((v, "Groupby result generator entry point"));
7334       sqlite3VdbeAddOp1(v, OP_Return, regOutputRow);
7335       finalizeAggFunctions(pParse, pAggInfo);
7336       sqlite3ExprIfFalse(pParse, pHaving, addrOutputRow+1, SQLITE_JUMPIFNULL);
7337       selectInnerLoop(pParse, p, -1, &sSort,
7338                       &sDistinct, pDest,
7339                       addrOutputRow+1, addrSetAbort);
7340       sqlite3VdbeAddOp1(v, OP_Return, regOutputRow);
7341       VdbeComment((v, "end groupby result generator"));
7342 
7343       /* Generate a subroutine that will reset the group-by accumulator
7344       */
7345       sqlite3VdbeResolveLabel(v, addrReset);
7346       resetAccumulator(pParse, pAggInfo);
7347       sqlite3VdbeAddOp2(v, OP_Integer, 0, iUseFlag);
7348       VdbeComment((v, "indicate accumulator empty"));
7349       sqlite3VdbeAddOp1(v, OP_Return, regReset);
7350 
7351       if( distFlag!=0 && eDist!=WHERE_DISTINCT_NOOP ){
7352         struct AggInfo_func *pF = &pAggInfo->aFunc[0];
7353         fixDistinctOpenEph(pParse, eDist, pF->iDistinct, pF->iDistAddr);
7354       }
7355     } /* endif pGroupBy.  Begin aggregate queries without GROUP BY: */
7356     else {
7357       Table *pTab;
7358       if( (pTab = isSimpleCount(p, pAggInfo))!=0 ){
7359         /* If isSimpleCount() returns a pointer to a Table structure, then
7360         ** the SQL statement is of the form:
7361         **
7362         **   SELECT count(*) FROM <tbl>
7363         **
7364         ** where the Table structure returned represents table <tbl>.
7365         **
7366         ** This statement is so common that it is optimized specially. The
7367         ** OP_Count instruction is executed either on the intkey table that
7368         ** contains the data for table <tbl> or on one of its indexes. It
7369         ** is better to execute the op on an index, as indexes are almost
7370         ** always spread across less pages than their corresponding tables.
7371         */
7372         const int iDb = sqlite3SchemaToIndex(pParse->db, pTab->pSchema);
7373         const int iCsr = pParse->nTab++;     /* Cursor to scan b-tree */
7374         Index *pIdx;                         /* Iterator variable */
7375         KeyInfo *pKeyInfo = 0;               /* Keyinfo for scanned index */
7376         Index *pBest = 0;                    /* Best index found so far */
7377         Pgno iRoot = pTab->tnum;             /* Root page of scanned b-tree */
7378 
7379         sqlite3CodeVerifySchema(pParse, iDb);
7380         sqlite3TableLock(pParse, iDb, pTab->tnum, 0, pTab->zName);
7381 
7382         /* Search for the index that has the lowest scan cost.
7383         **
7384         ** (2011-04-15) Do not do a full scan of an unordered index.
7385         **
7386         ** (2013-10-03) Do not count the entries in a partial index.
7387         **
7388         ** In practice the KeyInfo structure will not be used. It is only
7389         ** passed to keep OP_OpenRead happy.
7390         */
7391         if( !HasRowid(pTab) ) pBest = sqlite3PrimaryKeyIndex(pTab);
7392         if( !p->pSrc->a[0].fg.notIndexed ){
7393           for(pIdx=pTab->pIndex; pIdx; pIdx=pIdx->pNext){
7394             if( pIdx->bUnordered==0
7395              && pIdx->szIdxRow<pTab->szTabRow
7396              && pIdx->pPartIdxWhere==0
7397              && (!pBest || pIdx->szIdxRow<pBest->szIdxRow)
7398             ){
7399               pBest = pIdx;
7400             }
7401           }
7402         }
7403         if( pBest ){
7404           iRoot = pBest->tnum;
7405           pKeyInfo = sqlite3KeyInfoOfIndex(pParse, pBest);
7406         }
7407 
7408         /* Open a read-only cursor, execute the OP_Count, close the cursor. */
7409         sqlite3VdbeAddOp4Int(v, OP_OpenRead, iCsr, (int)iRoot, iDb, 1);
7410         if( pKeyInfo ){
7411           sqlite3VdbeChangeP4(v, -1, (char *)pKeyInfo, P4_KEYINFO);
7412         }
7413         sqlite3VdbeAddOp2(v, OP_Count, iCsr, pAggInfo->aFunc[0].iMem);
7414         sqlite3VdbeAddOp1(v, OP_Close, iCsr);
7415         explainSimpleCount(pParse, pTab, pBest);
7416       }else{
7417         int regAcc = 0;           /* "populate accumulators" flag */
7418         ExprList *pDistinct = 0;
7419         u16 distFlag = 0;
7420         int eDist;
7421 
7422         /* If there are accumulator registers but no min() or max() functions
7423         ** without FILTER clauses, allocate register regAcc. Register regAcc
7424         ** will contain 0 the first time the inner loop runs, and 1 thereafter.
7425         ** The code generated by updateAccumulator() uses this to ensure
7426         ** that the accumulator registers are (a) updated only once if
7427         ** there are no min() or max functions or (b) always updated for the
7428         ** first row visited by the aggregate, so that they are updated at
7429         ** least once even if the FILTER clause means the min() or max()
7430         ** function visits zero rows.  */
7431         if( pAggInfo->nAccumulator ){
7432           for(i=0; i<pAggInfo->nFunc; i++){
7433             if( ExprHasProperty(pAggInfo->aFunc[i].pFExpr, EP_WinFunc) ){
7434               continue;
7435             }
7436             if( pAggInfo->aFunc[i].pFunc->funcFlags&SQLITE_FUNC_NEEDCOLL ){
7437               break;
7438             }
7439           }
7440           if( i==pAggInfo->nFunc ){
7441             regAcc = ++pParse->nMem;
7442             sqlite3VdbeAddOp2(v, OP_Integer, 0, regAcc);
7443           }
7444         }else if( pAggInfo->nFunc==1 && pAggInfo->aFunc[0].iDistinct>=0 ){
7445           assert( ExprUseXList(pAggInfo->aFunc[0].pFExpr) );
7446           pDistinct = pAggInfo->aFunc[0].pFExpr->x.pList;
7447           distFlag = pDistinct ? (WHERE_WANT_DISTINCT|WHERE_AGG_DISTINCT) : 0;
7448         }
7449 
7450         /* This case runs if the aggregate has no GROUP BY clause.  The
7451         ** processing is much simpler since there is only a single row
7452         ** of output.
7453         */
7454         assert( p->pGroupBy==0 );
7455         resetAccumulator(pParse, pAggInfo);
7456 
7457         /* If this query is a candidate for the min/max optimization, then
7458         ** minMaxFlag will have been previously set to either
7459         ** WHERE_ORDERBY_MIN or WHERE_ORDERBY_MAX and pMinMaxOrderBy will
7460         ** be an appropriate ORDER BY expression for the optimization.
7461         */
7462         assert( minMaxFlag==WHERE_ORDERBY_NORMAL || pMinMaxOrderBy!=0 );
7463         assert( pMinMaxOrderBy==0 || pMinMaxOrderBy->nExpr==1 );
7464 
7465         SELECTTRACE(1,pParse,p,("WhereBegin\n"));
7466         pWInfo = sqlite3WhereBegin(pParse, pTabList, pWhere, pMinMaxOrderBy,
7467                                    pDistinct, 0, minMaxFlag|distFlag, 0);
7468         if( pWInfo==0 ){
7469           goto select_end;
7470         }
7471         SELECTTRACE(1,pParse,p,("WhereBegin returns\n"));
7472         eDist = sqlite3WhereIsDistinct(pWInfo);
7473         updateAccumulator(pParse, regAcc, pAggInfo, eDist);
7474         if( eDist!=WHERE_DISTINCT_NOOP ){
7475           struct AggInfo_func *pF = &pAggInfo->aFunc[0];
7476           fixDistinctOpenEph(pParse, eDist, pF->iDistinct, pF->iDistAddr);
7477         }
7478 
7479         if( regAcc ) sqlite3VdbeAddOp2(v, OP_Integer, 1, regAcc);
7480         if( minMaxFlag ){
7481           sqlite3WhereMinMaxOptEarlyOut(v, pWInfo);
7482         }
7483         SELECTTRACE(1,pParse,p,("WhereEnd\n"));
7484         sqlite3WhereEnd(pWInfo);
7485         finalizeAggFunctions(pParse, pAggInfo);
7486       }
7487 
7488       sSort.pOrderBy = 0;
7489       sqlite3ExprIfFalse(pParse, pHaving, addrEnd, SQLITE_JUMPIFNULL);
7490       selectInnerLoop(pParse, p, -1, 0, 0,
7491                       pDest, addrEnd, addrEnd);
7492     }
7493     sqlite3VdbeResolveLabel(v, addrEnd);
7494 
7495   } /* endif aggregate query */
7496 
7497   if( sDistinct.eTnctType==WHERE_DISTINCT_UNORDERED ){
7498     explainTempTable(pParse, "DISTINCT");
7499   }
7500 
7501   /* If there is an ORDER BY clause, then we need to sort the results
7502   ** and send them to the callback one by one.
7503   */
7504   if( sSort.pOrderBy ){
7505     explainTempTable(pParse,
7506                      sSort.nOBSat>0 ? "RIGHT PART OF ORDER BY":"ORDER BY");
7507     assert( p->pEList==pEList );
7508     generateSortTail(pParse, p, &sSort, pEList->nExpr, pDest);
7509   }
7510 
7511   /* Jump here to skip this query
7512   */
7513   sqlite3VdbeResolveLabel(v, iEnd);
7514 
7515   /* The SELECT has been coded. If there is an error in the Parse structure,
7516   ** set the return code to 1. Otherwise 0. */
7517   rc = (pParse->nErr>0);
7518 
7519   /* Control jumps to here if an error is encountered above, or upon
7520   ** successful coding of the SELECT.
7521   */
7522 select_end:
7523   assert( db->mallocFailed==0 || db->mallocFailed==1 );
7524   assert( db->mallocFailed==0 || pParse->nErr!=0 );
7525   sqlite3ExprListDelete(db, pMinMaxOrderBy);
7526 #ifdef SQLITE_DEBUG
7527   if( pAggInfo && !db->mallocFailed ){
7528     for(i=0; i<pAggInfo->nColumn; i++){
7529       Expr *pExpr = pAggInfo->aCol[i].pCExpr;
7530       assert( pExpr!=0 );
7531       assert( pExpr->pAggInfo==pAggInfo );
7532       assert( pExpr->iAgg==i );
7533     }
7534     for(i=0; i<pAggInfo->nFunc; i++){
7535       Expr *pExpr = pAggInfo->aFunc[i].pFExpr;
7536       assert( pExpr!=0 );
7537       assert( pExpr->pAggInfo==pAggInfo );
7538       assert( pExpr->iAgg==i );
7539     }
7540   }
7541 #endif
7542 
7543 #if TREETRACE_ENABLED
7544   SELECTTRACE(0x1,pParse,p,("end processing\n"));
7545   if( (sqlite3TreeTrace & 0x2000)!=0 && ExplainQueryPlanParent(pParse)==0 ){
7546     sqlite3TreeViewSelect(0, p, 0);
7547   }
7548 #endif
7549   ExplainQueryPlanPop(pParse);
7550   return rc;
7551 }
7552