xref: /sqlite-3.40.0/src/select.c (revision e99cb2da)
1 /*
2 ** 2001 September 15
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 ** This file contains C code routines that are called by the parser
13 ** to handle SELECT statements in SQLite.
14 */
15 #include "sqliteInt.h"
16 
17 /*
18 ** Trace output macros
19 */
20 #if SELECTTRACE_ENABLED
21 /***/ int sqlite3SelectTrace = 0;
22 # define SELECTTRACE(K,P,S,X)  \
23   if(sqlite3SelectTrace&(K))   \
24     sqlite3DebugPrintf("%u/%d/%p: ",(S)->selId,(P)->addrExplain,(S)),\
25     sqlite3DebugPrintf X
26 #else
27 # define SELECTTRACE(K,P,S,X)
28 #endif
29 
30 
31 /*
32 ** An instance of the following object is used to record information about
33 ** how to process the DISTINCT keyword, to simplify passing that information
34 ** into the selectInnerLoop() routine.
35 */
36 typedef struct DistinctCtx DistinctCtx;
37 struct DistinctCtx {
38   u8 isTnct;      /* True if the DISTINCT keyword is present */
39   u8 eTnctType;   /* One of the WHERE_DISTINCT_* operators */
40   int tabTnct;    /* Ephemeral table used for DISTINCT processing */
41   int addrTnct;   /* Address of OP_OpenEphemeral opcode for tabTnct */
42 };
43 
44 /*
45 ** An instance of the following object is used to record information about
46 ** the ORDER BY (or GROUP BY) clause of query is being coded.
47 **
48 ** The aDefer[] array is used by the sorter-references optimization. For
49 ** example, assuming there is no index that can be used for the ORDER BY,
50 ** for the query:
51 **
52 **     SELECT a, bigblob FROM t1 ORDER BY a LIMIT 10;
53 **
54 ** it may be more efficient to add just the "a" values to the sorter, and
55 ** retrieve the associated "bigblob" values directly from table t1 as the
56 ** 10 smallest "a" values are extracted from the sorter.
57 **
58 ** When the sorter-reference optimization is used, there is one entry in the
59 ** aDefer[] array for each database table that may be read as values are
60 ** extracted from the sorter.
61 */
62 typedef struct SortCtx SortCtx;
63 struct SortCtx {
64   ExprList *pOrderBy;   /* The ORDER BY (or GROUP BY clause) */
65   int nOBSat;           /* Number of ORDER BY terms satisfied by indices */
66   int iECursor;         /* Cursor number for the sorter */
67   int regReturn;        /* Register holding block-output return address */
68   int labelBkOut;       /* Start label for the block-output subroutine */
69   int addrSortIndex;    /* Address of the OP_SorterOpen or OP_OpenEphemeral */
70   int labelDone;        /* Jump here when done, ex: LIMIT reached */
71   int labelOBLopt;      /* Jump here when sorter is full */
72   u8 sortFlags;         /* Zero or more SORTFLAG_* bits */
73 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
74   u8 nDefer;            /* Number of valid entries in aDefer[] */
75   struct DeferredCsr {
76     Table *pTab;        /* Table definition */
77     int iCsr;           /* Cursor number for table */
78     int nKey;           /* Number of PK columns for table pTab (>=1) */
79   } aDefer[4];
80 #endif
81   struct RowLoadInfo *pDeferredRowLoad;  /* Deferred row loading info or NULL */
82 };
83 #define SORTFLAG_UseSorter  0x01   /* Use SorterOpen instead of OpenEphemeral */
84 
85 /*
86 ** Delete all the content of a Select structure.  Deallocate the structure
87 ** itself only if bFree is true.
88 */
89 static void clearSelect(sqlite3 *db, Select *p, int bFree){
90   while( p ){
91     Select *pPrior = p->pPrior;
92     sqlite3ExprListDelete(db, p->pEList);
93     sqlite3SrcListDelete(db, p->pSrc);
94     sqlite3ExprDelete(db, p->pWhere);
95     sqlite3ExprListDelete(db, p->pGroupBy);
96     sqlite3ExprDelete(db, p->pHaving);
97     sqlite3ExprListDelete(db, p->pOrderBy);
98     sqlite3ExprDelete(db, p->pLimit);
99 #ifndef SQLITE_OMIT_WINDOWFUNC
100     if( OK_IF_ALWAYS_TRUE(p->pWinDefn) ){
101       sqlite3WindowListDelete(db, p->pWinDefn);
102     }
103     assert( p->pWin==0 );
104 #endif
105     if( OK_IF_ALWAYS_TRUE(p->pWith) ) sqlite3WithDelete(db, p->pWith);
106     if( bFree ) sqlite3DbFreeNN(db, p);
107     p = pPrior;
108     bFree = 1;
109   }
110 }
111 
112 /*
113 ** Initialize a SelectDest structure.
114 */
115 void sqlite3SelectDestInit(SelectDest *pDest, int eDest, int iParm){
116   pDest->eDest = (u8)eDest;
117   pDest->iSDParm = iParm;
118   pDest->zAffSdst = 0;
119   pDest->iSdst = 0;
120   pDest->nSdst = 0;
121 }
122 
123 
124 /*
125 ** Allocate a new Select structure and return a pointer to that
126 ** structure.
127 */
128 Select *sqlite3SelectNew(
129   Parse *pParse,        /* Parsing context */
130   ExprList *pEList,     /* which columns to include in the result */
131   SrcList *pSrc,        /* the FROM clause -- which tables to scan */
132   Expr *pWhere,         /* the WHERE clause */
133   ExprList *pGroupBy,   /* the GROUP BY clause */
134   Expr *pHaving,        /* the HAVING clause */
135   ExprList *pOrderBy,   /* the ORDER BY clause */
136   u32 selFlags,         /* Flag parameters, such as SF_Distinct */
137   Expr *pLimit          /* LIMIT value.  NULL means not used */
138 ){
139   Select *pNew;
140   Select standin;
141   pNew = sqlite3DbMallocRawNN(pParse->db, sizeof(*pNew) );
142   if( pNew==0 ){
143     assert( pParse->db->mallocFailed );
144     pNew = &standin;
145   }
146   if( pEList==0 ){
147     pEList = sqlite3ExprListAppend(pParse, 0,
148                                    sqlite3Expr(pParse->db,TK_ASTERISK,0));
149   }
150   pNew->pEList = pEList;
151   pNew->op = TK_SELECT;
152   pNew->selFlags = selFlags;
153   pNew->iLimit = 0;
154   pNew->iOffset = 0;
155   pNew->selId = ++pParse->nSelect;
156   pNew->addrOpenEphm[0] = -1;
157   pNew->addrOpenEphm[1] = -1;
158   pNew->nSelectRow = 0;
159   if( pSrc==0 ) pSrc = sqlite3DbMallocZero(pParse->db, sizeof(*pSrc));
160   pNew->pSrc = pSrc;
161   pNew->pWhere = pWhere;
162   pNew->pGroupBy = pGroupBy;
163   pNew->pHaving = pHaving;
164   pNew->pOrderBy = pOrderBy;
165   pNew->pPrior = 0;
166   pNew->pNext = 0;
167   pNew->pLimit = pLimit;
168   pNew->pWith = 0;
169 #ifndef SQLITE_OMIT_WINDOWFUNC
170   pNew->pWin = 0;
171   pNew->pWinDefn = 0;
172 #endif
173   if( pParse->db->mallocFailed ) {
174     clearSelect(pParse->db, pNew, pNew!=&standin);
175     pNew = 0;
176   }else{
177     assert( pNew->pSrc!=0 || pParse->nErr>0 );
178   }
179   assert( pNew!=&standin );
180   return pNew;
181 }
182 
183 
184 /*
185 ** Delete the given Select structure and all of its substructures.
186 */
187 void sqlite3SelectDelete(sqlite3 *db, Select *p){
188   if( OK_IF_ALWAYS_TRUE(p) ) clearSelect(db, p, 1);
189 }
190 
191 /*
192 ** Return a pointer to the right-most SELECT statement in a compound.
193 */
194 static Select *findRightmost(Select *p){
195   while( p->pNext ) p = p->pNext;
196   return p;
197 }
198 
199 /*
200 ** Given 1 to 3 identifiers preceding the JOIN keyword, determine the
201 ** type of join.  Return an integer constant that expresses that type
202 ** in terms of the following bit values:
203 **
204 **     JT_INNER
205 **     JT_CROSS
206 **     JT_OUTER
207 **     JT_NATURAL
208 **     JT_LEFT
209 **     JT_RIGHT
210 **
211 ** A full outer join is the combination of JT_LEFT and JT_RIGHT.
212 **
213 ** If an illegal or unsupported join type is seen, then still return
214 ** a join type, but put an error in the pParse structure.
215 */
216 int sqlite3JoinType(Parse *pParse, Token *pA, Token *pB, Token *pC){
217   int jointype = 0;
218   Token *apAll[3];
219   Token *p;
220                              /*   0123456789 123456789 123456789 123 */
221   static const char zKeyText[] = "naturaleftouterightfullinnercross";
222   static const struct {
223     u8 i;        /* Beginning of keyword text in zKeyText[] */
224     u8 nChar;    /* Length of the keyword in characters */
225     u8 code;     /* Join type mask */
226   } aKeyword[] = {
227     /* natural */ { 0,  7, JT_NATURAL                },
228     /* left    */ { 6,  4, JT_LEFT|JT_OUTER          },
229     /* outer   */ { 10, 5, JT_OUTER                  },
230     /* right   */ { 14, 5, JT_RIGHT|JT_OUTER         },
231     /* full    */ { 19, 4, JT_LEFT|JT_RIGHT|JT_OUTER },
232     /* inner   */ { 23, 5, JT_INNER                  },
233     /* cross   */ { 28, 5, JT_INNER|JT_CROSS         },
234   };
235   int i, j;
236   apAll[0] = pA;
237   apAll[1] = pB;
238   apAll[2] = pC;
239   for(i=0; i<3 && apAll[i]; i++){
240     p = apAll[i];
241     for(j=0; j<ArraySize(aKeyword); j++){
242       if( p->n==aKeyword[j].nChar
243           && sqlite3StrNICmp((char*)p->z, &zKeyText[aKeyword[j].i], p->n)==0 ){
244         jointype |= aKeyword[j].code;
245         break;
246       }
247     }
248     testcase( j==0 || j==1 || j==2 || j==3 || j==4 || j==5 || j==6 );
249     if( j>=ArraySize(aKeyword) ){
250       jointype |= JT_ERROR;
251       break;
252     }
253   }
254   if(
255      (jointype & (JT_INNER|JT_OUTER))==(JT_INNER|JT_OUTER) ||
256      (jointype & JT_ERROR)!=0
257   ){
258     const char *zSp = " ";
259     assert( pB!=0 );
260     if( pC==0 ){ zSp++; }
261     sqlite3ErrorMsg(pParse, "unknown or unsupported join type: "
262        "%T %T%s%T", pA, pB, zSp, pC);
263     jointype = JT_INNER;
264   }else if( (jointype & JT_OUTER)!=0
265          && (jointype & (JT_LEFT|JT_RIGHT))!=JT_LEFT ){
266     sqlite3ErrorMsg(pParse,
267       "RIGHT and FULL OUTER JOINs are not currently supported");
268     jointype = JT_INNER;
269   }
270   return jointype;
271 }
272 
273 /*
274 ** Return the index of a column in a table.  Return -1 if the column
275 ** is not contained in the table.
276 */
277 static int columnIndex(Table *pTab, const char *zCol){
278   int i;
279   for(i=0; i<pTab->nCol; i++){
280     if( sqlite3StrICmp(pTab->aCol[i].zName, zCol)==0 ) return i;
281   }
282   return -1;
283 }
284 
285 /*
286 ** Search the first N tables in pSrc, from left to right, looking for a
287 ** table that has a column named zCol.
288 **
289 ** When found, set *piTab and *piCol to the table index and column index
290 ** of the matching column and return TRUE.
291 **
292 ** If not found, return FALSE.
293 */
294 static int tableAndColumnIndex(
295   SrcList *pSrc,       /* Array of tables to search */
296   int N,               /* Number of tables in pSrc->a[] to search */
297   const char *zCol,    /* Name of the column we are looking for */
298   int *piTab,          /* Write index of pSrc->a[] here */
299   int *piCol           /* Write index of pSrc->a[*piTab].pTab->aCol[] here */
300 ){
301   int i;               /* For looping over tables in pSrc */
302   int iCol;            /* Index of column matching zCol */
303 
304   assert( (piTab==0)==(piCol==0) );  /* Both or neither are NULL */
305   for(i=0; i<N; i++){
306     iCol = columnIndex(pSrc->a[i].pTab, zCol);
307     if( iCol>=0 ){
308       if( piTab ){
309         *piTab = i;
310         *piCol = iCol;
311       }
312       return 1;
313     }
314   }
315   return 0;
316 }
317 
318 /*
319 ** This function is used to add terms implied by JOIN syntax to the
320 ** WHERE clause expression of a SELECT statement. The new term, which
321 ** is ANDed with the existing WHERE clause, is of the form:
322 **
323 **    (tab1.col1 = tab2.col2)
324 **
325 ** where tab1 is the iSrc'th table in SrcList pSrc and tab2 is the
326 ** (iSrc+1)'th. Column col1 is column iColLeft of tab1, and col2 is
327 ** column iColRight of tab2.
328 */
329 static void addWhereTerm(
330   Parse *pParse,                  /* Parsing context */
331   SrcList *pSrc,                  /* List of tables in FROM clause */
332   int iLeft,                      /* Index of first table to join in pSrc */
333   int iColLeft,                   /* Index of column in first table */
334   int iRight,                     /* Index of second table in pSrc */
335   int iColRight,                  /* Index of column in second table */
336   int isOuterJoin,                /* True if this is an OUTER join */
337   Expr **ppWhere                  /* IN/OUT: The WHERE clause to add to */
338 ){
339   sqlite3 *db = pParse->db;
340   Expr *pE1;
341   Expr *pE2;
342   Expr *pEq;
343 
344   assert( iLeft<iRight );
345   assert( pSrc->nSrc>iRight );
346   assert( pSrc->a[iLeft].pTab );
347   assert( pSrc->a[iRight].pTab );
348 
349   pE1 = sqlite3CreateColumnExpr(db, pSrc, iLeft, iColLeft);
350   pE2 = sqlite3CreateColumnExpr(db, pSrc, iRight, iColRight);
351 
352   pEq = sqlite3PExpr(pParse, TK_EQ, pE1, pE2);
353   if( pEq && isOuterJoin ){
354     ExprSetProperty(pEq, EP_FromJoin);
355     assert( !ExprHasProperty(pEq, EP_TokenOnly|EP_Reduced) );
356     ExprSetVVAProperty(pEq, EP_NoReduce);
357     pEq->iRightJoinTable = (i16)pE2->iTable;
358   }
359   *ppWhere = sqlite3ExprAnd(pParse, *ppWhere, pEq);
360 }
361 
362 /*
363 ** Set the EP_FromJoin property on all terms of the given expression.
364 ** And set the Expr.iRightJoinTable to iTable for every term in the
365 ** expression.
366 **
367 ** The EP_FromJoin property is used on terms of an expression to tell
368 ** the LEFT OUTER JOIN processing logic that this term is part of the
369 ** join restriction specified in the ON or USING clause and not a part
370 ** of the more general WHERE clause.  These terms are moved over to the
371 ** WHERE clause during join processing but we need to remember that they
372 ** originated in the ON or USING clause.
373 **
374 ** The Expr.iRightJoinTable tells the WHERE clause processing that the
375 ** expression depends on table iRightJoinTable even if that table is not
376 ** explicitly mentioned in the expression.  That information is needed
377 ** for cases like this:
378 **
379 **    SELECT * FROM t1 LEFT JOIN t2 ON t1.a=t2.b AND t1.x=5
380 **
381 ** The where clause needs to defer the handling of the t1.x=5
382 ** term until after the t2 loop of the join.  In that way, a
383 ** NULL t2 row will be inserted whenever t1.x!=5.  If we do not
384 ** defer the handling of t1.x=5, it will be processed immediately
385 ** after the t1 loop and rows with t1.x!=5 will never appear in
386 ** the output, which is incorrect.
387 */
388 void sqlite3SetJoinExpr(Expr *p, int iTable){
389   while( p ){
390     ExprSetProperty(p, EP_FromJoin);
391     assert( !ExprHasProperty(p, EP_TokenOnly|EP_Reduced) );
392     ExprSetVVAProperty(p, EP_NoReduce);
393     p->iRightJoinTable = (i16)iTable;
394     if( p->op==TK_FUNCTION && p->x.pList ){
395       int i;
396       for(i=0; i<p->x.pList->nExpr; i++){
397         sqlite3SetJoinExpr(p->x.pList->a[i].pExpr, iTable);
398       }
399     }
400     sqlite3SetJoinExpr(p->pLeft, iTable);
401     p = p->pRight;
402   }
403 }
404 
405 /* Undo the work of sqlite3SetJoinExpr(). In the expression p, convert every
406 ** term that is marked with EP_FromJoin and iRightJoinTable==iTable into
407 ** an ordinary term that omits the EP_FromJoin mark.
408 **
409 ** This happens when a LEFT JOIN is simplified into an ordinary JOIN.
410 */
411 static void unsetJoinExpr(Expr *p, int iTable){
412   while( p ){
413     if( ExprHasProperty(p, EP_FromJoin)
414      && (iTable<0 || p->iRightJoinTable==iTable) ){
415       ExprClearProperty(p, EP_FromJoin);
416     }
417     if( p->op==TK_FUNCTION && p->x.pList ){
418       int i;
419       for(i=0; i<p->x.pList->nExpr; i++){
420         unsetJoinExpr(p->x.pList->a[i].pExpr, iTable);
421       }
422     }
423     unsetJoinExpr(p->pLeft, iTable);
424     p = p->pRight;
425   }
426 }
427 
428 /*
429 ** This routine processes the join information for a SELECT statement.
430 ** ON and USING clauses are converted into extra terms of the WHERE clause.
431 ** NATURAL joins also create extra WHERE clause terms.
432 **
433 ** The terms of a FROM clause are contained in the Select.pSrc structure.
434 ** The left most table is the first entry in Select.pSrc.  The right-most
435 ** table is the last entry.  The join operator is held in the entry to
436 ** the left.  Thus entry 0 contains the join operator for the join between
437 ** entries 0 and 1.  Any ON or USING clauses associated with the join are
438 ** also attached to the left entry.
439 **
440 ** This routine returns the number of errors encountered.
441 */
442 static int sqliteProcessJoin(Parse *pParse, Select *p){
443   SrcList *pSrc;                  /* All tables in the FROM clause */
444   int i, j;                       /* Loop counters */
445   struct SrcList_item *pLeft;     /* Left table being joined */
446   struct SrcList_item *pRight;    /* Right table being joined */
447 
448   pSrc = p->pSrc;
449   pLeft = &pSrc->a[0];
450   pRight = &pLeft[1];
451   for(i=0; i<pSrc->nSrc-1; i++, pRight++, pLeft++){
452     Table *pRightTab = pRight->pTab;
453     int isOuter;
454 
455     if( NEVER(pLeft->pTab==0 || pRightTab==0) ) continue;
456     isOuter = (pRight->fg.jointype & JT_OUTER)!=0;
457 
458     /* When the NATURAL keyword is present, add WHERE clause terms for
459     ** every column that the two tables have in common.
460     */
461     if( pRight->fg.jointype & JT_NATURAL ){
462       if( pRight->pOn || pRight->pUsing ){
463         sqlite3ErrorMsg(pParse, "a NATURAL join may not have "
464            "an ON or USING clause", 0);
465         return 1;
466       }
467       for(j=0; j<pRightTab->nCol; j++){
468         char *zName;   /* Name of column in the right table */
469         int iLeft;     /* Matching left table */
470         int iLeftCol;  /* Matching column in the left table */
471 
472         zName = pRightTab->aCol[j].zName;
473         if( tableAndColumnIndex(pSrc, i+1, zName, &iLeft, &iLeftCol) ){
474           addWhereTerm(pParse, pSrc, iLeft, iLeftCol, i+1, j,
475                        isOuter, &p->pWhere);
476         }
477       }
478     }
479 
480     /* Disallow both ON and USING clauses in the same join
481     */
482     if( pRight->pOn && pRight->pUsing ){
483       sqlite3ErrorMsg(pParse, "cannot have both ON and USING "
484         "clauses in the same join");
485       return 1;
486     }
487 
488     /* Add the ON clause to the end of the WHERE clause, connected by
489     ** an AND operator.
490     */
491     if( pRight->pOn ){
492       if( isOuter ) sqlite3SetJoinExpr(pRight->pOn, pRight->iCursor);
493       p->pWhere = sqlite3ExprAnd(pParse, p->pWhere, pRight->pOn);
494       pRight->pOn = 0;
495     }
496 
497     /* Create extra terms on the WHERE clause for each column named
498     ** in the USING clause.  Example: If the two tables to be joined are
499     ** A and B and the USING clause names X, Y, and Z, then add this
500     ** to the WHERE clause:    A.X=B.X AND A.Y=B.Y AND A.Z=B.Z
501     ** Report an error if any column mentioned in the USING clause is
502     ** not contained in both tables to be joined.
503     */
504     if( pRight->pUsing ){
505       IdList *pList = pRight->pUsing;
506       for(j=0; j<pList->nId; j++){
507         char *zName;     /* Name of the term in the USING clause */
508         int iLeft;       /* Table on the left with matching column name */
509         int iLeftCol;    /* Column number of matching column on the left */
510         int iRightCol;   /* Column number of matching column on the right */
511 
512         zName = pList->a[j].zName;
513         iRightCol = columnIndex(pRightTab, zName);
514         if( iRightCol<0
515          || !tableAndColumnIndex(pSrc, i+1, zName, &iLeft, &iLeftCol)
516         ){
517           sqlite3ErrorMsg(pParse, "cannot join using column %s - column "
518             "not present in both tables", zName);
519           return 1;
520         }
521         addWhereTerm(pParse, pSrc, iLeft, iLeftCol, i+1, iRightCol,
522                      isOuter, &p->pWhere);
523       }
524     }
525   }
526   return 0;
527 }
528 
529 /*
530 ** An instance of this object holds information (beyond pParse and pSelect)
531 ** needed to load the next result row that is to be added to the sorter.
532 */
533 typedef struct RowLoadInfo RowLoadInfo;
534 struct RowLoadInfo {
535   int regResult;               /* Store results in array of registers here */
536   u8 ecelFlags;                /* Flag argument to ExprCodeExprList() */
537 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
538   ExprList *pExtra;            /* Extra columns needed by sorter refs */
539   int regExtraResult;          /* Where to load the extra columns */
540 #endif
541 };
542 
543 /*
544 ** This routine does the work of loading query data into an array of
545 ** registers so that it can be added to the sorter.
546 */
547 static void innerLoopLoadRow(
548   Parse *pParse,             /* Statement under construction */
549   Select *pSelect,           /* The query being coded */
550   RowLoadInfo *pInfo         /* Info needed to complete the row load */
551 ){
552   sqlite3ExprCodeExprList(pParse, pSelect->pEList, pInfo->regResult,
553                           0, pInfo->ecelFlags);
554 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
555   if( pInfo->pExtra ){
556     sqlite3ExprCodeExprList(pParse, pInfo->pExtra, pInfo->regExtraResult, 0, 0);
557     sqlite3ExprListDelete(pParse->db, pInfo->pExtra);
558   }
559 #endif
560 }
561 
562 /*
563 ** Code the OP_MakeRecord instruction that generates the entry to be
564 ** added into the sorter.
565 **
566 ** Return the register in which the result is stored.
567 */
568 static int makeSorterRecord(
569   Parse *pParse,
570   SortCtx *pSort,
571   Select *pSelect,
572   int regBase,
573   int nBase
574 ){
575   int nOBSat = pSort->nOBSat;
576   Vdbe *v = pParse->pVdbe;
577   int regOut = ++pParse->nMem;
578   if( pSort->pDeferredRowLoad ){
579     innerLoopLoadRow(pParse, pSelect, pSort->pDeferredRowLoad);
580   }
581   sqlite3VdbeAddOp3(v, OP_MakeRecord, regBase+nOBSat, nBase-nOBSat, regOut);
582   return regOut;
583 }
584 
585 /*
586 ** Generate code that will push the record in registers regData
587 ** through regData+nData-1 onto the sorter.
588 */
589 static void pushOntoSorter(
590   Parse *pParse,         /* Parser context */
591   SortCtx *pSort,        /* Information about the ORDER BY clause */
592   Select *pSelect,       /* The whole SELECT statement */
593   int regData,           /* First register holding data to be sorted */
594   int regOrigData,       /* First register holding data before packing */
595   int nData,             /* Number of elements in the regData data array */
596   int nPrefixReg         /* No. of reg prior to regData available for use */
597 ){
598   Vdbe *v = pParse->pVdbe;                         /* Stmt under construction */
599   int bSeq = ((pSort->sortFlags & SORTFLAG_UseSorter)==0);
600   int nExpr = pSort->pOrderBy->nExpr;              /* No. of ORDER BY terms */
601   int nBase = nExpr + bSeq + nData;                /* Fields in sorter record */
602   int regBase;                                     /* Regs for sorter record */
603   int regRecord = 0;                               /* Assembled sorter record */
604   int nOBSat = pSort->nOBSat;                      /* ORDER BY terms to skip */
605   int op;                            /* Opcode to add sorter record to sorter */
606   int iLimit;                        /* LIMIT counter */
607   int iSkip = 0;                     /* End of the sorter insert loop */
608 
609   assert( bSeq==0 || bSeq==1 );
610 
611   /* Three cases:
612   **   (1) The data to be sorted has already been packed into a Record
613   **       by a prior OP_MakeRecord.  In this case nData==1 and regData
614   **       will be completely unrelated to regOrigData.
615   **   (2) All output columns are included in the sort record.  In that
616   **       case regData==regOrigData.
617   **   (3) Some output columns are omitted from the sort record due to
618   **       the SQLITE_ENABLE_SORTER_REFERENCE optimization, or due to the
619   **       SQLITE_ECEL_OMITREF optimization, or due to the
620   **       SortCtx.pDeferredRowLoad optimiation.  In any of these cases
621   **       regOrigData is 0 to prevent this routine from trying to copy
622   **       values that might not yet exist.
623   */
624   assert( nData==1 || regData==regOrigData || regOrigData==0 );
625 
626   if( nPrefixReg ){
627     assert( nPrefixReg==nExpr+bSeq );
628     regBase = regData - nPrefixReg;
629   }else{
630     regBase = pParse->nMem + 1;
631     pParse->nMem += nBase;
632   }
633   assert( pSelect->iOffset==0 || pSelect->iLimit!=0 );
634   iLimit = pSelect->iOffset ? pSelect->iOffset+1 : pSelect->iLimit;
635   pSort->labelDone = sqlite3VdbeMakeLabel(pParse);
636   sqlite3ExprCodeExprList(pParse, pSort->pOrderBy, regBase, regOrigData,
637                           SQLITE_ECEL_DUP | (regOrigData? SQLITE_ECEL_REF : 0));
638   if( bSeq ){
639     sqlite3VdbeAddOp2(v, OP_Sequence, pSort->iECursor, regBase+nExpr);
640   }
641   if( nPrefixReg==0 && nData>0 ){
642     sqlite3ExprCodeMove(pParse, regData, regBase+nExpr+bSeq, nData);
643   }
644   if( nOBSat>0 ){
645     int regPrevKey;   /* The first nOBSat columns of the previous row */
646     int addrFirst;    /* Address of the OP_IfNot opcode */
647     int addrJmp;      /* Address of the OP_Jump opcode */
648     VdbeOp *pOp;      /* Opcode that opens the sorter */
649     int nKey;         /* Number of sorting key columns, including OP_Sequence */
650     KeyInfo *pKI;     /* Original KeyInfo on the sorter table */
651 
652     regRecord = makeSorterRecord(pParse, pSort, pSelect, regBase, nBase);
653     regPrevKey = pParse->nMem+1;
654     pParse->nMem += pSort->nOBSat;
655     nKey = nExpr - pSort->nOBSat + bSeq;
656     if( bSeq ){
657       addrFirst = sqlite3VdbeAddOp1(v, OP_IfNot, regBase+nExpr);
658     }else{
659       addrFirst = sqlite3VdbeAddOp1(v, OP_SequenceTest, pSort->iECursor);
660     }
661     VdbeCoverage(v);
662     sqlite3VdbeAddOp3(v, OP_Compare, regPrevKey, regBase, pSort->nOBSat);
663     pOp = sqlite3VdbeGetOp(v, pSort->addrSortIndex);
664     if( pParse->db->mallocFailed ) return;
665     pOp->p2 = nKey + nData;
666     pKI = pOp->p4.pKeyInfo;
667     memset(pKI->aSortFlags, 0, pKI->nKeyField); /* Makes OP_Jump testable */
668     sqlite3VdbeChangeP4(v, -1, (char*)pKI, P4_KEYINFO);
669     testcase( pKI->nAllField > pKI->nKeyField+2 );
670     pOp->p4.pKeyInfo = sqlite3KeyInfoFromExprList(pParse,pSort->pOrderBy,nOBSat,
671                                            pKI->nAllField-pKI->nKeyField-1);
672     pOp = 0; /* Ensure pOp not used after sqltie3VdbeAddOp3() */
673     addrJmp = sqlite3VdbeCurrentAddr(v);
674     sqlite3VdbeAddOp3(v, OP_Jump, addrJmp+1, 0, addrJmp+1); VdbeCoverage(v);
675     pSort->labelBkOut = sqlite3VdbeMakeLabel(pParse);
676     pSort->regReturn = ++pParse->nMem;
677     sqlite3VdbeAddOp2(v, OP_Gosub, pSort->regReturn, pSort->labelBkOut);
678     sqlite3VdbeAddOp1(v, OP_ResetSorter, pSort->iECursor);
679     if( iLimit ){
680       sqlite3VdbeAddOp2(v, OP_IfNot, iLimit, pSort->labelDone);
681       VdbeCoverage(v);
682     }
683     sqlite3VdbeJumpHere(v, addrFirst);
684     sqlite3ExprCodeMove(pParse, regBase, regPrevKey, pSort->nOBSat);
685     sqlite3VdbeJumpHere(v, addrJmp);
686   }
687   if( iLimit ){
688     /* At this point the values for the new sorter entry are stored
689     ** in an array of registers. They need to be composed into a record
690     ** and inserted into the sorter if either (a) there are currently
691     ** less than LIMIT+OFFSET items or (b) the new record is smaller than
692     ** the largest record currently in the sorter. If (b) is true and there
693     ** are already LIMIT+OFFSET items in the sorter, delete the largest
694     ** entry before inserting the new one. This way there are never more
695     ** than LIMIT+OFFSET items in the sorter.
696     **
697     ** If the new record does not need to be inserted into the sorter,
698     ** jump to the next iteration of the loop. If the pSort->labelOBLopt
699     ** value is not zero, then it is a label of where to jump.  Otherwise,
700     ** just bypass the row insert logic.  See the header comment on the
701     ** sqlite3WhereOrderByLimitOptLabel() function for additional info.
702     */
703     int iCsr = pSort->iECursor;
704     sqlite3VdbeAddOp2(v, OP_IfNotZero, iLimit, sqlite3VdbeCurrentAddr(v)+4);
705     VdbeCoverage(v);
706     sqlite3VdbeAddOp2(v, OP_Last, iCsr, 0);
707     iSkip = sqlite3VdbeAddOp4Int(v, OP_IdxLE,
708                                  iCsr, 0, regBase+nOBSat, nExpr-nOBSat);
709     VdbeCoverage(v);
710     sqlite3VdbeAddOp1(v, OP_Delete, iCsr);
711   }
712   if( regRecord==0 ){
713     regRecord = makeSorterRecord(pParse, pSort, pSelect, regBase, nBase);
714   }
715   if( pSort->sortFlags & SORTFLAG_UseSorter ){
716     op = OP_SorterInsert;
717   }else{
718     op = OP_IdxInsert;
719   }
720   sqlite3VdbeAddOp4Int(v, op, pSort->iECursor, regRecord,
721                        regBase+nOBSat, nBase-nOBSat);
722   if( iSkip ){
723     sqlite3VdbeChangeP2(v, iSkip,
724          pSort->labelOBLopt ? pSort->labelOBLopt : sqlite3VdbeCurrentAddr(v));
725   }
726 }
727 
728 /*
729 ** Add code to implement the OFFSET
730 */
731 static void codeOffset(
732   Vdbe *v,          /* Generate code into this VM */
733   int iOffset,      /* Register holding the offset counter */
734   int iContinue     /* Jump here to skip the current record */
735 ){
736   if( iOffset>0 ){
737     sqlite3VdbeAddOp3(v, OP_IfPos, iOffset, iContinue, 1); VdbeCoverage(v);
738     VdbeComment((v, "OFFSET"));
739   }
740 }
741 
742 /*
743 ** Add code that will check to make sure the N registers starting at iMem
744 ** form a distinct entry.  iTab is a sorting index that holds previously
745 ** seen combinations of the N values.  A new entry is made in iTab
746 ** if the current N values are new.
747 **
748 ** A jump to addrRepeat is made and the N+1 values are popped from the
749 ** stack if the top N elements are not distinct.
750 */
751 static void codeDistinct(
752   Parse *pParse,     /* Parsing and code generating context */
753   int iTab,          /* A sorting index used to test for distinctness */
754   int addrRepeat,    /* Jump to here if not distinct */
755   int N,             /* Number of elements */
756   int iMem           /* First element */
757 ){
758   Vdbe *v;
759   int r1;
760 
761   v = pParse->pVdbe;
762   r1 = sqlite3GetTempReg(pParse);
763   sqlite3VdbeAddOp4Int(v, OP_Found, iTab, addrRepeat, iMem, N); VdbeCoverage(v);
764   sqlite3VdbeAddOp3(v, OP_MakeRecord, iMem, N, r1);
765   sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iTab, r1, iMem, N);
766   sqlite3VdbeChangeP5(v, OPFLAG_USESEEKRESULT);
767   sqlite3ReleaseTempReg(pParse, r1);
768 }
769 
770 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
771 /*
772 ** This function is called as part of inner-loop generation for a SELECT
773 ** statement with an ORDER BY that is not optimized by an index. It
774 ** determines the expressions, if any, that the sorter-reference
775 ** optimization should be used for. The sorter-reference optimization
776 ** is used for SELECT queries like:
777 **
778 **   SELECT a, bigblob FROM t1 ORDER BY a LIMIT 10
779 **
780 ** If the optimization is used for expression "bigblob", then instead of
781 ** storing values read from that column in the sorter records, the PK of
782 ** the row from table t1 is stored instead. Then, as records are extracted from
783 ** the sorter to return to the user, the required value of bigblob is
784 ** retrieved directly from table t1. If the values are very large, this
785 ** can be more efficient than storing them directly in the sorter records.
786 **
787 ** The ExprList_item.bSorterRef flag is set for each expression in pEList
788 ** for which the sorter-reference optimization should be enabled.
789 ** Additionally, the pSort->aDefer[] array is populated with entries
790 ** for all cursors required to evaluate all selected expressions. Finally.
791 ** output variable (*ppExtra) is set to an expression list containing
792 ** expressions for all extra PK values that should be stored in the
793 ** sorter records.
794 */
795 static void selectExprDefer(
796   Parse *pParse,                  /* Leave any error here */
797   SortCtx *pSort,                 /* Sorter context */
798   ExprList *pEList,               /* Expressions destined for sorter */
799   ExprList **ppExtra              /* Expressions to append to sorter record */
800 ){
801   int i;
802   int nDefer = 0;
803   ExprList *pExtra = 0;
804   for(i=0; i<pEList->nExpr; i++){
805     struct ExprList_item *pItem = &pEList->a[i];
806     if( pItem->u.x.iOrderByCol==0 ){
807       Expr *pExpr = pItem->pExpr;
808       Table *pTab = pExpr->y.pTab;
809       if( pExpr->op==TK_COLUMN && pExpr->iColumn>=0 && pTab && !IsVirtual(pTab)
810        && (pTab->aCol[pExpr->iColumn].colFlags & COLFLAG_SORTERREF)
811       ){
812         int j;
813         for(j=0; j<nDefer; j++){
814           if( pSort->aDefer[j].iCsr==pExpr->iTable ) break;
815         }
816         if( j==nDefer ){
817           if( nDefer==ArraySize(pSort->aDefer) ){
818             continue;
819           }else{
820             int nKey = 1;
821             int k;
822             Index *pPk = 0;
823             if( !HasRowid(pTab) ){
824               pPk = sqlite3PrimaryKeyIndex(pTab);
825               nKey = pPk->nKeyCol;
826             }
827             for(k=0; k<nKey; k++){
828               Expr *pNew = sqlite3PExpr(pParse, TK_COLUMN, 0, 0);
829               if( pNew ){
830                 pNew->iTable = pExpr->iTable;
831                 pNew->y.pTab = pExpr->y.pTab;
832                 pNew->iColumn = pPk ? pPk->aiColumn[k] : -1;
833                 pExtra = sqlite3ExprListAppend(pParse, pExtra, pNew);
834               }
835             }
836             pSort->aDefer[nDefer].pTab = pExpr->y.pTab;
837             pSort->aDefer[nDefer].iCsr = pExpr->iTable;
838             pSort->aDefer[nDefer].nKey = nKey;
839             nDefer++;
840           }
841         }
842         pItem->bSorterRef = 1;
843       }
844     }
845   }
846   pSort->nDefer = (u8)nDefer;
847   *ppExtra = pExtra;
848 }
849 #endif
850 
851 /*
852 ** This routine generates the code for the inside of the inner loop
853 ** of a SELECT.
854 **
855 ** If srcTab is negative, then the p->pEList expressions
856 ** are evaluated in order to get the data for this row.  If srcTab is
857 ** zero or more, then data is pulled from srcTab and p->pEList is used only
858 ** to get the number of columns and the collation sequence for each column.
859 */
860 static void selectInnerLoop(
861   Parse *pParse,          /* The parser context */
862   Select *p,              /* The complete select statement being coded */
863   int srcTab,             /* Pull data from this table if non-negative */
864   SortCtx *pSort,         /* If not NULL, info on how to process ORDER BY */
865   DistinctCtx *pDistinct, /* If not NULL, info on how to process DISTINCT */
866   SelectDest *pDest,      /* How to dispose of the results */
867   int iContinue,          /* Jump here to continue with next row */
868   int iBreak              /* Jump here to break out of the inner loop */
869 ){
870   Vdbe *v = pParse->pVdbe;
871   int i;
872   int hasDistinct;            /* True if the DISTINCT keyword is present */
873   int eDest = pDest->eDest;   /* How to dispose of results */
874   int iParm = pDest->iSDParm; /* First argument to disposal method */
875   int nResultCol;             /* Number of result columns */
876   int nPrefixReg = 0;         /* Number of extra registers before regResult */
877   RowLoadInfo sRowLoadInfo;   /* Info for deferred row loading */
878 
879   /* Usually, regResult is the first cell in an array of memory cells
880   ** containing the current result row. In this case regOrig is set to the
881   ** same value. However, if the results are being sent to the sorter, the
882   ** values for any expressions that are also part of the sort-key are omitted
883   ** from this array. In this case regOrig is set to zero.  */
884   int regResult;              /* Start of memory holding current results */
885   int regOrig;                /* Start of memory holding full result (or 0) */
886 
887   assert( v );
888   assert( p->pEList!=0 );
889   hasDistinct = pDistinct ? pDistinct->eTnctType : WHERE_DISTINCT_NOOP;
890   if( pSort && pSort->pOrderBy==0 ) pSort = 0;
891   if( pSort==0 && !hasDistinct ){
892     assert( iContinue!=0 );
893     codeOffset(v, p->iOffset, iContinue);
894   }
895 
896   /* Pull the requested columns.
897   */
898   nResultCol = p->pEList->nExpr;
899 
900   if( pDest->iSdst==0 ){
901     if( pSort ){
902       nPrefixReg = pSort->pOrderBy->nExpr;
903       if( !(pSort->sortFlags & SORTFLAG_UseSorter) ) nPrefixReg++;
904       pParse->nMem += nPrefixReg;
905     }
906     pDest->iSdst = pParse->nMem+1;
907     pParse->nMem += nResultCol;
908   }else if( pDest->iSdst+nResultCol > pParse->nMem ){
909     /* This is an error condition that can result, for example, when a SELECT
910     ** on the right-hand side of an INSERT contains more result columns than
911     ** there are columns in the table on the left.  The error will be caught
912     ** and reported later.  But we need to make sure enough memory is allocated
913     ** to avoid other spurious errors in the meantime. */
914     pParse->nMem += nResultCol;
915   }
916   pDest->nSdst = nResultCol;
917   regOrig = regResult = pDest->iSdst;
918   if( srcTab>=0 ){
919     for(i=0; i<nResultCol; i++){
920       sqlite3VdbeAddOp3(v, OP_Column, srcTab, i, regResult+i);
921       VdbeComment((v, "%s", p->pEList->a[i].zName));
922     }
923   }else if( eDest!=SRT_Exists ){
924 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
925     ExprList *pExtra = 0;
926 #endif
927     /* If the destination is an EXISTS(...) expression, the actual
928     ** values returned by the SELECT are not required.
929     */
930     u8 ecelFlags;    /* "ecel" is an abbreviation of "ExprCodeExprList" */
931     ExprList *pEList;
932     if( eDest==SRT_Mem || eDest==SRT_Output || eDest==SRT_Coroutine ){
933       ecelFlags = SQLITE_ECEL_DUP;
934     }else{
935       ecelFlags = 0;
936     }
937     if( pSort && hasDistinct==0 && eDest!=SRT_EphemTab && eDest!=SRT_Table ){
938       /* For each expression in p->pEList that is a copy of an expression in
939       ** the ORDER BY clause (pSort->pOrderBy), set the associated
940       ** iOrderByCol value to one more than the index of the ORDER BY
941       ** expression within the sort-key that pushOntoSorter() will generate.
942       ** This allows the p->pEList field to be omitted from the sorted record,
943       ** saving space and CPU cycles.  */
944       ecelFlags |= (SQLITE_ECEL_OMITREF|SQLITE_ECEL_REF);
945 
946       for(i=pSort->nOBSat; i<pSort->pOrderBy->nExpr; i++){
947         int j;
948         if( (j = pSort->pOrderBy->a[i].u.x.iOrderByCol)>0 ){
949           p->pEList->a[j-1].u.x.iOrderByCol = i+1-pSort->nOBSat;
950         }
951       }
952 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
953       selectExprDefer(pParse, pSort, p->pEList, &pExtra);
954       if( pExtra && pParse->db->mallocFailed==0 ){
955         /* If there are any extra PK columns to add to the sorter records,
956         ** allocate extra memory cells and adjust the OpenEphemeral
957         ** instruction to account for the larger records. This is only
958         ** required if there are one or more WITHOUT ROWID tables with
959         ** composite primary keys in the SortCtx.aDefer[] array.  */
960         VdbeOp *pOp = sqlite3VdbeGetOp(v, pSort->addrSortIndex);
961         pOp->p2 += (pExtra->nExpr - pSort->nDefer);
962         pOp->p4.pKeyInfo->nAllField += (pExtra->nExpr - pSort->nDefer);
963         pParse->nMem += pExtra->nExpr;
964       }
965 #endif
966 
967       /* Adjust nResultCol to account for columns that are omitted
968       ** from the sorter by the optimizations in this branch */
969       pEList = p->pEList;
970       for(i=0; i<pEList->nExpr; i++){
971         if( pEList->a[i].u.x.iOrderByCol>0
972 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
973          || pEList->a[i].bSorterRef
974 #endif
975         ){
976           nResultCol--;
977           regOrig = 0;
978         }
979       }
980 
981       testcase( regOrig );
982       testcase( eDest==SRT_Set );
983       testcase( eDest==SRT_Mem );
984       testcase( eDest==SRT_Coroutine );
985       testcase( eDest==SRT_Output );
986       assert( eDest==SRT_Set || eDest==SRT_Mem
987            || eDest==SRT_Coroutine || eDest==SRT_Output );
988     }
989     sRowLoadInfo.regResult = regResult;
990     sRowLoadInfo.ecelFlags = ecelFlags;
991 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
992     sRowLoadInfo.pExtra = pExtra;
993     sRowLoadInfo.regExtraResult = regResult + nResultCol;
994     if( pExtra ) nResultCol += pExtra->nExpr;
995 #endif
996     if( p->iLimit
997      && (ecelFlags & SQLITE_ECEL_OMITREF)!=0
998      && nPrefixReg>0
999     ){
1000       assert( pSort!=0 );
1001       assert( hasDistinct==0 );
1002       pSort->pDeferredRowLoad = &sRowLoadInfo;
1003       regOrig = 0;
1004     }else{
1005       innerLoopLoadRow(pParse, p, &sRowLoadInfo);
1006     }
1007   }
1008 
1009   /* If the DISTINCT keyword was present on the SELECT statement
1010   ** and this row has been seen before, then do not make this row
1011   ** part of the result.
1012   */
1013   if( hasDistinct ){
1014     switch( pDistinct->eTnctType ){
1015       case WHERE_DISTINCT_ORDERED: {
1016         VdbeOp *pOp;            /* No longer required OpenEphemeral instr. */
1017         int iJump;              /* Jump destination */
1018         int regPrev;            /* Previous row content */
1019 
1020         /* Allocate space for the previous row */
1021         regPrev = pParse->nMem+1;
1022         pParse->nMem += nResultCol;
1023 
1024         /* Change the OP_OpenEphemeral coded earlier to an OP_Null
1025         ** sets the MEM_Cleared bit on the first register of the
1026         ** previous value.  This will cause the OP_Ne below to always
1027         ** fail on the first iteration of the loop even if the first
1028         ** row is all NULLs.
1029         */
1030         sqlite3VdbeChangeToNoop(v, pDistinct->addrTnct);
1031         pOp = sqlite3VdbeGetOp(v, pDistinct->addrTnct);
1032         pOp->opcode = OP_Null;
1033         pOp->p1 = 1;
1034         pOp->p2 = regPrev;
1035         pOp = 0;  /* Ensure pOp is not used after sqlite3VdbeAddOp() */
1036 
1037         iJump = sqlite3VdbeCurrentAddr(v) + nResultCol;
1038         for(i=0; i<nResultCol; i++){
1039           CollSeq *pColl = sqlite3ExprCollSeq(pParse, p->pEList->a[i].pExpr);
1040           if( i<nResultCol-1 ){
1041             sqlite3VdbeAddOp3(v, OP_Ne, regResult+i, iJump, regPrev+i);
1042             VdbeCoverage(v);
1043           }else{
1044             sqlite3VdbeAddOp3(v, OP_Eq, regResult+i, iContinue, regPrev+i);
1045             VdbeCoverage(v);
1046            }
1047           sqlite3VdbeChangeP4(v, -1, (const char *)pColl, P4_COLLSEQ);
1048           sqlite3VdbeChangeP5(v, SQLITE_NULLEQ);
1049         }
1050         assert( sqlite3VdbeCurrentAddr(v)==iJump || pParse->db->mallocFailed );
1051         sqlite3VdbeAddOp3(v, OP_Copy, regResult, regPrev, nResultCol-1);
1052         break;
1053       }
1054 
1055       case WHERE_DISTINCT_UNIQUE: {
1056         sqlite3VdbeChangeToNoop(v, pDistinct->addrTnct);
1057         break;
1058       }
1059 
1060       default: {
1061         assert( pDistinct->eTnctType==WHERE_DISTINCT_UNORDERED );
1062         codeDistinct(pParse, pDistinct->tabTnct, iContinue, nResultCol,
1063                      regResult);
1064         break;
1065       }
1066     }
1067     if( pSort==0 ){
1068       codeOffset(v, p->iOffset, iContinue);
1069     }
1070   }
1071 
1072   switch( eDest ){
1073     /* In this mode, write each query result to the key of the temporary
1074     ** table iParm.
1075     */
1076 #ifndef SQLITE_OMIT_COMPOUND_SELECT
1077     case SRT_Union: {
1078       int r1;
1079       r1 = sqlite3GetTempReg(pParse);
1080       sqlite3VdbeAddOp3(v, OP_MakeRecord, regResult, nResultCol, r1);
1081       sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, r1, regResult, nResultCol);
1082       sqlite3ReleaseTempReg(pParse, r1);
1083       break;
1084     }
1085 
1086     /* Construct a record from the query result, but instead of
1087     ** saving that record, use it as a key to delete elements from
1088     ** the temporary table iParm.
1089     */
1090     case SRT_Except: {
1091       sqlite3VdbeAddOp3(v, OP_IdxDelete, iParm, regResult, nResultCol);
1092       break;
1093     }
1094 #endif /* SQLITE_OMIT_COMPOUND_SELECT */
1095 
1096     /* Store the result as data using a unique key.
1097     */
1098     case SRT_Fifo:
1099     case SRT_DistFifo:
1100     case SRT_Table:
1101     case SRT_EphemTab: {
1102       int r1 = sqlite3GetTempRange(pParse, nPrefixReg+1);
1103       testcase( eDest==SRT_Table );
1104       testcase( eDest==SRT_EphemTab );
1105       testcase( eDest==SRT_Fifo );
1106       testcase( eDest==SRT_DistFifo );
1107       sqlite3VdbeAddOp3(v, OP_MakeRecord, regResult, nResultCol, r1+nPrefixReg);
1108 #ifndef SQLITE_OMIT_CTE
1109       if( eDest==SRT_DistFifo ){
1110         /* If the destination is DistFifo, then cursor (iParm+1) is open
1111         ** on an ephemeral index. If the current row is already present
1112         ** in the index, do not write it to the output. If not, add the
1113         ** current row to the index and proceed with writing it to the
1114         ** output table as well.  */
1115         int addr = sqlite3VdbeCurrentAddr(v) + 4;
1116         sqlite3VdbeAddOp4Int(v, OP_Found, iParm+1, addr, r1, 0);
1117         VdbeCoverage(v);
1118         sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm+1, r1,regResult,nResultCol);
1119         assert( pSort==0 );
1120       }
1121 #endif
1122       if( pSort ){
1123         assert( regResult==regOrig );
1124         pushOntoSorter(pParse, pSort, p, r1+nPrefixReg, regOrig, 1, nPrefixReg);
1125       }else{
1126         int r2 = sqlite3GetTempReg(pParse);
1127         sqlite3VdbeAddOp2(v, OP_NewRowid, iParm, r2);
1128         sqlite3VdbeAddOp3(v, OP_Insert, iParm, r1, r2);
1129         sqlite3VdbeChangeP5(v, OPFLAG_APPEND);
1130         sqlite3ReleaseTempReg(pParse, r2);
1131       }
1132       sqlite3ReleaseTempRange(pParse, r1, nPrefixReg+1);
1133       break;
1134     }
1135 
1136 #ifndef SQLITE_OMIT_SUBQUERY
1137     /* If we are creating a set for an "expr IN (SELECT ...)" construct,
1138     ** then there should be a single item on the stack.  Write this
1139     ** item into the set table with bogus data.
1140     */
1141     case SRT_Set: {
1142       if( pSort ){
1143         /* At first glance you would think we could optimize out the
1144         ** ORDER BY in this case since the order of entries in the set
1145         ** does not matter.  But there might be a LIMIT clause, in which
1146         ** case the order does matter */
1147         pushOntoSorter(
1148             pParse, pSort, p, regResult, regOrig, nResultCol, nPrefixReg);
1149       }else{
1150         int r1 = sqlite3GetTempReg(pParse);
1151         assert( sqlite3Strlen30(pDest->zAffSdst)==nResultCol );
1152         sqlite3VdbeAddOp4(v, OP_MakeRecord, regResult, nResultCol,
1153             r1, pDest->zAffSdst, nResultCol);
1154         sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, r1, regResult, nResultCol);
1155         sqlite3ReleaseTempReg(pParse, r1);
1156       }
1157       break;
1158     }
1159 
1160     /* If any row exist in the result set, record that fact and abort.
1161     */
1162     case SRT_Exists: {
1163       sqlite3VdbeAddOp2(v, OP_Integer, 1, iParm);
1164       /* The LIMIT clause will terminate the loop for us */
1165       break;
1166     }
1167 
1168     /* If this is a scalar select that is part of an expression, then
1169     ** store the results in the appropriate memory cell or array of
1170     ** memory cells and break out of the scan loop.
1171     */
1172     case SRT_Mem: {
1173       if( pSort ){
1174         assert( nResultCol<=pDest->nSdst );
1175         pushOntoSorter(
1176             pParse, pSort, p, regResult, regOrig, nResultCol, nPrefixReg);
1177       }else{
1178         assert( nResultCol==pDest->nSdst );
1179         assert( regResult==iParm );
1180         /* The LIMIT clause will jump out of the loop for us */
1181       }
1182       break;
1183     }
1184 #endif /* #ifndef SQLITE_OMIT_SUBQUERY */
1185 
1186     case SRT_Coroutine:       /* Send data to a co-routine */
1187     case SRT_Output: {        /* Return the results */
1188       testcase( eDest==SRT_Coroutine );
1189       testcase( eDest==SRT_Output );
1190       if( pSort ){
1191         pushOntoSorter(pParse, pSort, p, regResult, regOrig, nResultCol,
1192                        nPrefixReg);
1193       }else if( eDest==SRT_Coroutine ){
1194         sqlite3VdbeAddOp1(v, OP_Yield, pDest->iSDParm);
1195       }else{
1196         sqlite3VdbeAddOp2(v, OP_ResultRow, regResult, nResultCol);
1197       }
1198       break;
1199     }
1200 
1201 #ifndef SQLITE_OMIT_CTE
1202     /* Write the results into a priority queue that is order according to
1203     ** pDest->pOrderBy (in pSO).  pDest->iSDParm (in iParm) is the cursor for an
1204     ** index with pSO->nExpr+2 columns.  Build a key using pSO for the first
1205     ** pSO->nExpr columns, then make sure all keys are unique by adding a
1206     ** final OP_Sequence column.  The last column is the record as a blob.
1207     */
1208     case SRT_DistQueue:
1209     case SRT_Queue: {
1210       int nKey;
1211       int r1, r2, r3;
1212       int addrTest = 0;
1213       ExprList *pSO;
1214       pSO = pDest->pOrderBy;
1215       assert( pSO );
1216       nKey = pSO->nExpr;
1217       r1 = sqlite3GetTempReg(pParse);
1218       r2 = sqlite3GetTempRange(pParse, nKey+2);
1219       r3 = r2+nKey+1;
1220       if( eDest==SRT_DistQueue ){
1221         /* If the destination is DistQueue, then cursor (iParm+1) is open
1222         ** on a second ephemeral index that holds all values every previously
1223         ** added to the queue. */
1224         addrTest = sqlite3VdbeAddOp4Int(v, OP_Found, iParm+1, 0,
1225                                         regResult, nResultCol);
1226         VdbeCoverage(v);
1227       }
1228       sqlite3VdbeAddOp3(v, OP_MakeRecord, regResult, nResultCol, r3);
1229       if( eDest==SRT_DistQueue ){
1230         sqlite3VdbeAddOp2(v, OP_IdxInsert, iParm+1, r3);
1231         sqlite3VdbeChangeP5(v, OPFLAG_USESEEKRESULT);
1232       }
1233       for(i=0; i<nKey; i++){
1234         sqlite3VdbeAddOp2(v, OP_SCopy,
1235                           regResult + pSO->a[i].u.x.iOrderByCol - 1,
1236                           r2+i);
1237       }
1238       sqlite3VdbeAddOp2(v, OP_Sequence, iParm, r2+nKey);
1239       sqlite3VdbeAddOp3(v, OP_MakeRecord, r2, nKey+2, r1);
1240       sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, r1, r2, nKey+2);
1241       if( addrTest ) sqlite3VdbeJumpHere(v, addrTest);
1242       sqlite3ReleaseTempReg(pParse, r1);
1243       sqlite3ReleaseTempRange(pParse, r2, nKey+2);
1244       break;
1245     }
1246 #endif /* SQLITE_OMIT_CTE */
1247 
1248 
1249 
1250 #if !defined(SQLITE_OMIT_TRIGGER)
1251     /* Discard the results.  This is used for SELECT statements inside
1252     ** the body of a TRIGGER.  The purpose of such selects is to call
1253     ** user-defined functions that have side effects.  We do not care
1254     ** about the actual results of the select.
1255     */
1256     default: {
1257       assert( eDest==SRT_Discard );
1258       break;
1259     }
1260 #endif
1261   }
1262 
1263   /* Jump to the end of the loop if the LIMIT is reached.  Except, if
1264   ** there is a sorter, in which case the sorter has already limited
1265   ** the output for us.
1266   */
1267   if( pSort==0 && p->iLimit ){
1268     sqlite3VdbeAddOp2(v, OP_DecrJumpZero, p->iLimit, iBreak); VdbeCoverage(v);
1269   }
1270 }
1271 
1272 /*
1273 ** Allocate a KeyInfo object sufficient for an index of N key columns and
1274 ** X extra columns.
1275 */
1276 KeyInfo *sqlite3KeyInfoAlloc(sqlite3 *db, int N, int X){
1277   int nExtra = (N+X)*(sizeof(CollSeq*)+1) - sizeof(CollSeq*);
1278   KeyInfo *p = sqlite3DbMallocRawNN(db, sizeof(KeyInfo) + nExtra);
1279   if( p ){
1280     p->aSortFlags = (u8*)&p->aColl[N+X];
1281     p->nKeyField = (u16)N;
1282     p->nAllField = (u16)(N+X);
1283     p->enc = ENC(db);
1284     p->db = db;
1285     p->nRef = 1;
1286     memset(&p[1], 0, nExtra);
1287   }else{
1288     sqlite3OomFault(db);
1289   }
1290   return p;
1291 }
1292 
1293 /*
1294 ** Deallocate a KeyInfo object
1295 */
1296 void sqlite3KeyInfoUnref(KeyInfo *p){
1297   if( p ){
1298     assert( p->nRef>0 );
1299     p->nRef--;
1300     if( p->nRef==0 ) sqlite3DbFreeNN(p->db, p);
1301   }
1302 }
1303 
1304 /*
1305 ** Make a new pointer to a KeyInfo object
1306 */
1307 KeyInfo *sqlite3KeyInfoRef(KeyInfo *p){
1308   if( p ){
1309     assert( p->nRef>0 );
1310     p->nRef++;
1311   }
1312   return p;
1313 }
1314 
1315 #ifdef SQLITE_DEBUG
1316 /*
1317 ** Return TRUE if a KeyInfo object can be change.  The KeyInfo object
1318 ** can only be changed if this is just a single reference to the object.
1319 **
1320 ** This routine is used only inside of assert() statements.
1321 */
1322 int sqlite3KeyInfoIsWriteable(KeyInfo *p){ return p->nRef==1; }
1323 #endif /* SQLITE_DEBUG */
1324 
1325 /*
1326 ** Given an expression list, generate a KeyInfo structure that records
1327 ** the collating sequence for each expression in that expression list.
1328 **
1329 ** If the ExprList is an ORDER BY or GROUP BY clause then the resulting
1330 ** KeyInfo structure is appropriate for initializing a virtual index to
1331 ** implement that clause.  If the ExprList is the result set of a SELECT
1332 ** then the KeyInfo structure is appropriate for initializing a virtual
1333 ** index to implement a DISTINCT test.
1334 **
1335 ** Space to hold the KeyInfo structure is obtained from malloc.  The calling
1336 ** function is responsible for seeing that this structure is eventually
1337 ** freed.
1338 */
1339 KeyInfo *sqlite3KeyInfoFromExprList(
1340   Parse *pParse,       /* Parsing context */
1341   ExprList *pList,     /* Form the KeyInfo object from this ExprList */
1342   int iStart,          /* Begin with this column of pList */
1343   int nExtra           /* Add this many extra columns to the end */
1344 ){
1345   int nExpr;
1346   KeyInfo *pInfo;
1347   struct ExprList_item *pItem;
1348   sqlite3 *db = pParse->db;
1349   int i;
1350 
1351   nExpr = pList->nExpr;
1352   pInfo = sqlite3KeyInfoAlloc(db, nExpr-iStart, nExtra+1);
1353   if( pInfo ){
1354     assert( sqlite3KeyInfoIsWriteable(pInfo) );
1355     for(i=iStart, pItem=pList->a+iStart; i<nExpr; i++, pItem++){
1356       pInfo->aColl[i-iStart] = sqlite3ExprNNCollSeq(pParse, pItem->pExpr);
1357       pInfo->aSortFlags[i-iStart] = pItem->sortFlags;
1358     }
1359   }
1360   return pInfo;
1361 }
1362 
1363 /*
1364 ** Name of the connection operator, used for error messages.
1365 */
1366 static const char *selectOpName(int id){
1367   char *z;
1368   switch( id ){
1369     case TK_ALL:       z = "UNION ALL";   break;
1370     case TK_INTERSECT: z = "INTERSECT";   break;
1371     case TK_EXCEPT:    z = "EXCEPT";      break;
1372     default:           z = "UNION";       break;
1373   }
1374   return z;
1375 }
1376 
1377 #ifndef SQLITE_OMIT_EXPLAIN
1378 /*
1379 ** Unless an "EXPLAIN QUERY PLAN" command is being processed, this function
1380 ** is a no-op. Otherwise, it adds a single row of output to the EQP result,
1381 ** where the caption is of the form:
1382 **
1383 **   "USE TEMP B-TREE FOR xxx"
1384 **
1385 ** where xxx is one of "DISTINCT", "ORDER BY" or "GROUP BY". Exactly which
1386 ** is determined by the zUsage argument.
1387 */
1388 static void explainTempTable(Parse *pParse, const char *zUsage){
1389   ExplainQueryPlan((pParse, 0, "USE TEMP B-TREE FOR %s", zUsage));
1390 }
1391 
1392 /*
1393 ** Assign expression b to lvalue a. A second, no-op, version of this macro
1394 ** is provided when SQLITE_OMIT_EXPLAIN is defined. This allows the code
1395 ** in sqlite3Select() to assign values to structure member variables that
1396 ** only exist if SQLITE_OMIT_EXPLAIN is not defined without polluting the
1397 ** code with #ifndef directives.
1398 */
1399 # define explainSetInteger(a, b) a = b
1400 
1401 #else
1402 /* No-op versions of the explainXXX() functions and macros. */
1403 # define explainTempTable(y,z)
1404 # define explainSetInteger(y,z)
1405 #endif
1406 
1407 
1408 /*
1409 ** If the inner loop was generated using a non-null pOrderBy argument,
1410 ** then the results were placed in a sorter.  After the loop is terminated
1411 ** we need to run the sorter and output the results.  The following
1412 ** routine generates the code needed to do that.
1413 */
1414 static void generateSortTail(
1415   Parse *pParse,    /* Parsing context */
1416   Select *p,        /* The SELECT statement */
1417   SortCtx *pSort,   /* Information on the ORDER BY clause */
1418   int nColumn,      /* Number of columns of data */
1419   SelectDest *pDest /* Write the sorted results here */
1420 ){
1421   Vdbe *v = pParse->pVdbe;                     /* The prepared statement */
1422   int addrBreak = pSort->labelDone;            /* Jump here to exit loop */
1423   int addrContinue = sqlite3VdbeMakeLabel(pParse);/* Jump here for next cycle */
1424   int addr;                       /* Top of output loop. Jump for Next. */
1425   int addrOnce = 0;
1426   int iTab;
1427   ExprList *pOrderBy = pSort->pOrderBy;
1428   int eDest = pDest->eDest;
1429   int iParm = pDest->iSDParm;
1430   int regRow;
1431   int regRowid;
1432   int iCol;
1433   int nKey;                       /* Number of key columns in sorter record */
1434   int iSortTab;                   /* Sorter cursor to read from */
1435   int i;
1436   int bSeq;                       /* True if sorter record includes seq. no. */
1437   int nRefKey = 0;
1438   struct ExprList_item *aOutEx = p->pEList->a;
1439 
1440   assert( addrBreak<0 );
1441   if( pSort->labelBkOut ){
1442     sqlite3VdbeAddOp2(v, OP_Gosub, pSort->regReturn, pSort->labelBkOut);
1443     sqlite3VdbeGoto(v, addrBreak);
1444     sqlite3VdbeResolveLabel(v, pSort->labelBkOut);
1445   }
1446 
1447 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1448   /* Open any cursors needed for sorter-reference expressions */
1449   for(i=0; i<pSort->nDefer; i++){
1450     Table *pTab = pSort->aDefer[i].pTab;
1451     int iDb = sqlite3SchemaToIndex(pParse->db, pTab->pSchema);
1452     sqlite3OpenTable(pParse, pSort->aDefer[i].iCsr, iDb, pTab, OP_OpenRead);
1453     nRefKey = MAX(nRefKey, pSort->aDefer[i].nKey);
1454   }
1455 #endif
1456 
1457   iTab = pSort->iECursor;
1458   if( eDest==SRT_Output || eDest==SRT_Coroutine || eDest==SRT_Mem ){
1459     regRowid = 0;
1460     regRow = pDest->iSdst;
1461   }else{
1462     regRowid = sqlite3GetTempReg(pParse);
1463     if( eDest==SRT_EphemTab || eDest==SRT_Table ){
1464       regRow = sqlite3GetTempReg(pParse);
1465       nColumn = 0;
1466     }else{
1467       regRow = sqlite3GetTempRange(pParse, nColumn);
1468     }
1469   }
1470   nKey = pOrderBy->nExpr - pSort->nOBSat;
1471   if( pSort->sortFlags & SORTFLAG_UseSorter ){
1472     int regSortOut = ++pParse->nMem;
1473     iSortTab = pParse->nTab++;
1474     if( pSort->labelBkOut ){
1475       addrOnce = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
1476     }
1477     sqlite3VdbeAddOp3(v, OP_OpenPseudo, iSortTab, regSortOut,
1478         nKey+1+nColumn+nRefKey);
1479     if( addrOnce ) sqlite3VdbeJumpHere(v, addrOnce);
1480     addr = 1 + sqlite3VdbeAddOp2(v, OP_SorterSort, iTab, addrBreak);
1481     VdbeCoverage(v);
1482     codeOffset(v, p->iOffset, addrContinue);
1483     sqlite3VdbeAddOp3(v, OP_SorterData, iTab, regSortOut, iSortTab);
1484     bSeq = 0;
1485   }else{
1486     addr = 1 + sqlite3VdbeAddOp2(v, OP_Sort, iTab, addrBreak); VdbeCoverage(v);
1487     codeOffset(v, p->iOffset, addrContinue);
1488     iSortTab = iTab;
1489     bSeq = 1;
1490   }
1491   for(i=0, iCol=nKey+bSeq-1; i<nColumn; i++){
1492 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1493     if( aOutEx[i].bSorterRef ) continue;
1494 #endif
1495     if( aOutEx[i].u.x.iOrderByCol==0 ) iCol++;
1496   }
1497 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1498   if( pSort->nDefer ){
1499     int iKey = iCol+1;
1500     int regKey = sqlite3GetTempRange(pParse, nRefKey);
1501 
1502     for(i=0; i<pSort->nDefer; i++){
1503       int iCsr = pSort->aDefer[i].iCsr;
1504       Table *pTab = pSort->aDefer[i].pTab;
1505       int nKey = pSort->aDefer[i].nKey;
1506 
1507       sqlite3VdbeAddOp1(v, OP_NullRow, iCsr);
1508       if( HasRowid(pTab) ){
1509         sqlite3VdbeAddOp3(v, OP_Column, iSortTab, iKey++, regKey);
1510         sqlite3VdbeAddOp3(v, OP_SeekRowid, iCsr,
1511             sqlite3VdbeCurrentAddr(v)+1, regKey);
1512       }else{
1513         int k;
1514         int iJmp;
1515         assert( sqlite3PrimaryKeyIndex(pTab)->nKeyCol==nKey );
1516         for(k=0; k<nKey; k++){
1517           sqlite3VdbeAddOp3(v, OP_Column, iSortTab, iKey++, regKey+k);
1518         }
1519         iJmp = sqlite3VdbeCurrentAddr(v);
1520         sqlite3VdbeAddOp4Int(v, OP_SeekGE, iCsr, iJmp+2, regKey, nKey);
1521         sqlite3VdbeAddOp4Int(v, OP_IdxLE, iCsr, iJmp+3, regKey, nKey);
1522         sqlite3VdbeAddOp1(v, OP_NullRow, iCsr);
1523       }
1524     }
1525     sqlite3ReleaseTempRange(pParse, regKey, nRefKey);
1526   }
1527 #endif
1528   for(i=nColumn-1; i>=0; i--){
1529 #ifdef SQLITE_ENABLE_SORTER_REFERENCES
1530     if( aOutEx[i].bSorterRef ){
1531       sqlite3ExprCode(pParse, aOutEx[i].pExpr, regRow+i);
1532     }else
1533 #endif
1534     {
1535       int iRead;
1536       if( aOutEx[i].u.x.iOrderByCol ){
1537         iRead = aOutEx[i].u.x.iOrderByCol-1;
1538       }else{
1539         iRead = iCol--;
1540       }
1541       sqlite3VdbeAddOp3(v, OP_Column, iSortTab, iRead, regRow+i);
1542       VdbeComment((v, "%s", aOutEx[i].zName?aOutEx[i].zName : aOutEx[i].zSpan));
1543     }
1544   }
1545   switch( eDest ){
1546     case SRT_Table:
1547     case SRT_EphemTab: {
1548       sqlite3VdbeAddOp3(v, OP_Column, iSortTab, nKey+bSeq, regRow);
1549       sqlite3VdbeAddOp2(v, OP_NewRowid, iParm, regRowid);
1550       sqlite3VdbeAddOp3(v, OP_Insert, iParm, regRow, regRowid);
1551       sqlite3VdbeChangeP5(v, OPFLAG_APPEND);
1552       break;
1553     }
1554 #ifndef SQLITE_OMIT_SUBQUERY
1555     case SRT_Set: {
1556       assert( nColumn==sqlite3Strlen30(pDest->zAffSdst) );
1557       sqlite3VdbeAddOp4(v, OP_MakeRecord, regRow, nColumn, regRowid,
1558                         pDest->zAffSdst, nColumn);
1559       sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iParm, regRowid, regRow, nColumn);
1560       break;
1561     }
1562     case SRT_Mem: {
1563       /* The LIMIT clause will terminate the loop for us */
1564       break;
1565     }
1566 #endif
1567     default: {
1568       assert( eDest==SRT_Output || eDest==SRT_Coroutine );
1569       testcase( eDest==SRT_Output );
1570       testcase( eDest==SRT_Coroutine );
1571       if( eDest==SRT_Output ){
1572         sqlite3VdbeAddOp2(v, OP_ResultRow, pDest->iSdst, nColumn);
1573       }else{
1574         sqlite3VdbeAddOp1(v, OP_Yield, pDest->iSDParm);
1575       }
1576       break;
1577     }
1578   }
1579   if( regRowid ){
1580     if( eDest==SRT_Set ){
1581       sqlite3ReleaseTempRange(pParse, regRow, nColumn);
1582     }else{
1583       sqlite3ReleaseTempReg(pParse, regRow);
1584     }
1585     sqlite3ReleaseTempReg(pParse, regRowid);
1586   }
1587   /* The bottom of the loop
1588   */
1589   sqlite3VdbeResolveLabel(v, addrContinue);
1590   if( pSort->sortFlags & SORTFLAG_UseSorter ){
1591     sqlite3VdbeAddOp2(v, OP_SorterNext, iTab, addr); VdbeCoverage(v);
1592   }else{
1593     sqlite3VdbeAddOp2(v, OP_Next, iTab, addr); VdbeCoverage(v);
1594   }
1595   if( pSort->regReturn ) sqlite3VdbeAddOp1(v, OP_Return, pSort->regReturn);
1596   sqlite3VdbeResolveLabel(v, addrBreak);
1597 }
1598 
1599 /*
1600 ** Return a pointer to a string containing the 'declaration type' of the
1601 ** expression pExpr. The string may be treated as static by the caller.
1602 **
1603 ** Also try to estimate the size of the returned value and return that
1604 ** result in *pEstWidth.
1605 **
1606 ** The declaration type is the exact datatype definition extracted from the
1607 ** original CREATE TABLE statement if the expression is a column. The
1608 ** declaration type for a ROWID field is INTEGER. Exactly when an expression
1609 ** is considered a column can be complex in the presence of subqueries. The
1610 ** result-set expression in all of the following SELECT statements is
1611 ** considered a column by this function.
1612 **
1613 **   SELECT col FROM tbl;
1614 **   SELECT (SELECT col FROM tbl;
1615 **   SELECT (SELECT col FROM tbl);
1616 **   SELECT abc FROM (SELECT col AS abc FROM tbl);
1617 **
1618 ** The declaration type for any expression other than a column is NULL.
1619 **
1620 ** This routine has either 3 or 6 parameters depending on whether or not
1621 ** the SQLITE_ENABLE_COLUMN_METADATA compile-time option is used.
1622 */
1623 #ifdef SQLITE_ENABLE_COLUMN_METADATA
1624 # define columnType(A,B,C,D,E) columnTypeImpl(A,B,C,D,E)
1625 #else /* if !defined(SQLITE_ENABLE_COLUMN_METADATA) */
1626 # define columnType(A,B,C,D,E) columnTypeImpl(A,B)
1627 #endif
1628 static const char *columnTypeImpl(
1629   NameContext *pNC,
1630 #ifndef SQLITE_ENABLE_COLUMN_METADATA
1631   Expr *pExpr
1632 #else
1633   Expr *pExpr,
1634   const char **pzOrigDb,
1635   const char **pzOrigTab,
1636   const char **pzOrigCol
1637 #endif
1638 ){
1639   char const *zType = 0;
1640   int j;
1641 #ifdef SQLITE_ENABLE_COLUMN_METADATA
1642   char const *zOrigDb = 0;
1643   char const *zOrigTab = 0;
1644   char const *zOrigCol = 0;
1645 #endif
1646 
1647   assert( pExpr!=0 );
1648   assert( pNC->pSrcList!=0 );
1649   switch( pExpr->op ){
1650     case TK_COLUMN: {
1651       /* The expression is a column. Locate the table the column is being
1652       ** extracted from in NameContext.pSrcList. This table may be real
1653       ** database table or a subquery.
1654       */
1655       Table *pTab = 0;            /* Table structure column is extracted from */
1656       Select *pS = 0;             /* Select the column is extracted from */
1657       int iCol = pExpr->iColumn;  /* Index of column in pTab */
1658       while( pNC && !pTab ){
1659         SrcList *pTabList = pNC->pSrcList;
1660         for(j=0;j<pTabList->nSrc && pTabList->a[j].iCursor!=pExpr->iTable;j++);
1661         if( j<pTabList->nSrc ){
1662           pTab = pTabList->a[j].pTab;
1663           pS = pTabList->a[j].pSelect;
1664         }else{
1665           pNC = pNC->pNext;
1666         }
1667       }
1668 
1669       if( pTab==0 ){
1670         /* At one time, code such as "SELECT new.x" within a trigger would
1671         ** cause this condition to run.  Since then, we have restructured how
1672         ** trigger code is generated and so this condition is no longer
1673         ** possible. However, it can still be true for statements like
1674         ** the following:
1675         **
1676         **   CREATE TABLE t1(col INTEGER);
1677         **   SELECT (SELECT t1.col) FROM FROM t1;
1678         **
1679         ** when columnType() is called on the expression "t1.col" in the
1680         ** sub-select. In this case, set the column type to NULL, even
1681         ** though it should really be "INTEGER".
1682         **
1683         ** This is not a problem, as the column type of "t1.col" is never
1684         ** used. When columnType() is called on the expression
1685         ** "(SELECT t1.col)", the correct type is returned (see the TK_SELECT
1686         ** branch below.  */
1687         break;
1688       }
1689 
1690       assert( pTab && pExpr->y.pTab==pTab );
1691       if( pS ){
1692         /* The "table" is actually a sub-select or a view in the FROM clause
1693         ** of the SELECT statement. Return the declaration type and origin
1694         ** data for the result-set column of the sub-select.
1695         */
1696         if( iCol>=0 && iCol<pS->pEList->nExpr ){
1697           /* If iCol is less than zero, then the expression requests the
1698           ** rowid of the sub-select or view. This expression is legal (see
1699           ** test case misc2.2.2) - it always evaluates to NULL.
1700           */
1701           NameContext sNC;
1702           Expr *p = pS->pEList->a[iCol].pExpr;
1703           sNC.pSrcList = pS->pSrc;
1704           sNC.pNext = pNC;
1705           sNC.pParse = pNC->pParse;
1706           zType = columnType(&sNC, p,&zOrigDb,&zOrigTab,&zOrigCol);
1707         }
1708       }else{
1709         /* A real table or a CTE table */
1710         assert( !pS );
1711 #ifdef SQLITE_ENABLE_COLUMN_METADATA
1712         if( iCol<0 ) iCol = pTab->iPKey;
1713         assert( iCol==XN_ROWID || (iCol>=0 && iCol<pTab->nCol) );
1714         if( iCol<0 ){
1715           zType = "INTEGER";
1716           zOrigCol = "rowid";
1717         }else{
1718           zOrigCol = pTab->aCol[iCol].zName;
1719           zType = sqlite3ColumnType(&pTab->aCol[iCol],0);
1720         }
1721         zOrigTab = pTab->zName;
1722         if( pNC->pParse && pTab->pSchema ){
1723           int iDb = sqlite3SchemaToIndex(pNC->pParse->db, pTab->pSchema);
1724           zOrigDb = pNC->pParse->db->aDb[iDb].zDbSName;
1725         }
1726 #else
1727         assert( iCol==XN_ROWID || (iCol>=0 && iCol<pTab->nCol) );
1728         if( iCol<0 ){
1729           zType = "INTEGER";
1730         }else{
1731           zType = sqlite3ColumnType(&pTab->aCol[iCol],0);
1732         }
1733 #endif
1734       }
1735       break;
1736     }
1737 #ifndef SQLITE_OMIT_SUBQUERY
1738     case TK_SELECT: {
1739       /* The expression is a sub-select. Return the declaration type and
1740       ** origin info for the single column in the result set of the SELECT
1741       ** statement.
1742       */
1743       NameContext sNC;
1744       Select *pS = pExpr->x.pSelect;
1745       Expr *p = pS->pEList->a[0].pExpr;
1746       assert( ExprHasProperty(pExpr, EP_xIsSelect) );
1747       sNC.pSrcList = pS->pSrc;
1748       sNC.pNext = pNC;
1749       sNC.pParse = pNC->pParse;
1750       zType = columnType(&sNC, p, &zOrigDb, &zOrigTab, &zOrigCol);
1751       break;
1752     }
1753 #endif
1754   }
1755 
1756 #ifdef SQLITE_ENABLE_COLUMN_METADATA
1757   if( pzOrigDb ){
1758     assert( pzOrigTab && pzOrigCol );
1759     *pzOrigDb = zOrigDb;
1760     *pzOrigTab = zOrigTab;
1761     *pzOrigCol = zOrigCol;
1762   }
1763 #endif
1764   return zType;
1765 }
1766 
1767 /*
1768 ** Generate code that will tell the VDBE the declaration types of columns
1769 ** in the result set.
1770 */
1771 static void generateColumnTypes(
1772   Parse *pParse,      /* Parser context */
1773   SrcList *pTabList,  /* List of tables */
1774   ExprList *pEList    /* Expressions defining the result set */
1775 ){
1776 #ifndef SQLITE_OMIT_DECLTYPE
1777   Vdbe *v = pParse->pVdbe;
1778   int i;
1779   NameContext sNC;
1780   sNC.pSrcList = pTabList;
1781   sNC.pParse = pParse;
1782   sNC.pNext = 0;
1783   for(i=0; i<pEList->nExpr; i++){
1784     Expr *p = pEList->a[i].pExpr;
1785     const char *zType;
1786 #ifdef SQLITE_ENABLE_COLUMN_METADATA
1787     const char *zOrigDb = 0;
1788     const char *zOrigTab = 0;
1789     const char *zOrigCol = 0;
1790     zType = columnType(&sNC, p, &zOrigDb, &zOrigTab, &zOrigCol);
1791 
1792     /* The vdbe must make its own copy of the column-type and other
1793     ** column specific strings, in case the schema is reset before this
1794     ** virtual machine is deleted.
1795     */
1796     sqlite3VdbeSetColName(v, i, COLNAME_DATABASE, zOrigDb, SQLITE_TRANSIENT);
1797     sqlite3VdbeSetColName(v, i, COLNAME_TABLE, zOrigTab, SQLITE_TRANSIENT);
1798     sqlite3VdbeSetColName(v, i, COLNAME_COLUMN, zOrigCol, SQLITE_TRANSIENT);
1799 #else
1800     zType = columnType(&sNC, p, 0, 0, 0);
1801 #endif
1802     sqlite3VdbeSetColName(v, i, COLNAME_DECLTYPE, zType, SQLITE_TRANSIENT);
1803   }
1804 #endif /* !defined(SQLITE_OMIT_DECLTYPE) */
1805 }
1806 
1807 
1808 /*
1809 ** Compute the column names for a SELECT statement.
1810 **
1811 ** The only guarantee that SQLite makes about column names is that if the
1812 ** column has an AS clause assigning it a name, that will be the name used.
1813 ** That is the only documented guarantee.  However, countless applications
1814 ** developed over the years have made baseless assumptions about column names
1815 ** and will break if those assumptions changes.  Hence, use extreme caution
1816 ** when modifying this routine to avoid breaking legacy.
1817 **
1818 ** See Also: sqlite3ColumnsFromExprList()
1819 **
1820 ** The PRAGMA short_column_names and PRAGMA full_column_names settings are
1821 ** deprecated.  The default setting is short=ON, full=OFF.  99.9% of all
1822 ** applications should operate this way.  Nevertheless, we need to support the
1823 ** other modes for legacy:
1824 **
1825 **    short=OFF, full=OFF:      Column name is the text of the expression has it
1826 **                              originally appears in the SELECT statement.  In
1827 **                              other words, the zSpan of the result expression.
1828 **
1829 **    short=ON, full=OFF:       (This is the default setting).  If the result
1830 **                              refers directly to a table column, then the
1831 **                              result column name is just the table column
1832 **                              name: COLUMN.  Otherwise use zSpan.
1833 **
1834 **    full=ON, short=ANY:       If the result refers directly to a table column,
1835 **                              then the result column name with the table name
1836 **                              prefix, ex: TABLE.COLUMN.  Otherwise use zSpan.
1837 */
1838 static void generateColumnNames(
1839   Parse *pParse,      /* Parser context */
1840   Select *pSelect     /* Generate column names for this SELECT statement */
1841 ){
1842   Vdbe *v = pParse->pVdbe;
1843   int i;
1844   Table *pTab;
1845   SrcList *pTabList;
1846   ExprList *pEList;
1847   sqlite3 *db = pParse->db;
1848   int fullName;    /* TABLE.COLUMN if no AS clause and is a direct table ref */
1849   int srcName;     /* COLUMN or TABLE.COLUMN if no AS clause and is direct */
1850 
1851 #ifndef SQLITE_OMIT_EXPLAIN
1852   /* If this is an EXPLAIN, skip this step */
1853   if( pParse->explain ){
1854     return;
1855   }
1856 #endif
1857 
1858   if( pParse->colNamesSet ) return;
1859   /* Column names are determined by the left-most term of a compound select */
1860   while( pSelect->pPrior ) pSelect = pSelect->pPrior;
1861   SELECTTRACE(1,pParse,pSelect,("generating column names\n"));
1862   pTabList = pSelect->pSrc;
1863   pEList = pSelect->pEList;
1864   assert( v!=0 );
1865   assert( pTabList!=0 );
1866   pParse->colNamesSet = 1;
1867   fullName = (db->flags & SQLITE_FullColNames)!=0;
1868   srcName = (db->flags & SQLITE_ShortColNames)!=0 || fullName;
1869   sqlite3VdbeSetNumCols(v, pEList->nExpr);
1870   for(i=0; i<pEList->nExpr; i++){
1871     Expr *p = pEList->a[i].pExpr;
1872 
1873     assert( p!=0 );
1874     assert( p->op!=TK_AGG_COLUMN );  /* Agg processing has not run yet */
1875     assert( p->op!=TK_COLUMN || p->y.pTab!=0 ); /* Covering idx not yet coded */
1876     if( pEList->a[i].zName ){
1877       /* An AS clause always takes first priority */
1878       char *zName = pEList->a[i].zName;
1879       sqlite3VdbeSetColName(v, i, COLNAME_NAME, zName, SQLITE_TRANSIENT);
1880     }else if( srcName && p->op==TK_COLUMN ){
1881       char *zCol;
1882       int iCol = p->iColumn;
1883       pTab = p->y.pTab;
1884       assert( pTab!=0 );
1885       if( iCol<0 ) iCol = pTab->iPKey;
1886       assert( iCol==-1 || (iCol>=0 && iCol<pTab->nCol) );
1887       if( iCol<0 ){
1888         zCol = "rowid";
1889       }else{
1890         zCol = pTab->aCol[iCol].zName;
1891       }
1892       if( fullName ){
1893         char *zName = 0;
1894         zName = sqlite3MPrintf(db, "%s.%s", pTab->zName, zCol);
1895         sqlite3VdbeSetColName(v, i, COLNAME_NAME, zName, SQLITE_DYNAMIC);
1896       }else{
1897         sqlite3VdbeSetColName(v, i, COLNAME_NAME, zCol, SQLITE_TRANSIENT);
1898       }
1899     }else{
1900       const char *z = pEList->a[i].zSpan;
1901       z = z==0 ? sqlite3MPrintf(db, "column%d", i+1) : sqlite3DbStrDup(db, z);
1902       sqlite3VdbeSetColName(v, i, COLNAME_NAME, z, SQLITE_DYNAMIC);
1903     }
1904   }
1905   generateColumnTypes(pParse, pTabList, pEList);
1906 }
1907 
1908 /*
1909 ** Given an expression list (which is really the list of expressions
1910 ** that form the result set of a SELECT statement) compute appropriate
1911 ** column names for a table that would hold the expression list.
1912 **
1913 ** All column names will be unique.
1914 **
1915 ** Only the column names are computed.  Column.zType, Column.zColl,
1916 ** and other fields of Column are zeroed.
1917 **
1918 ** Return SQLITE_OK on success.  If a memory allocation error occurs,
1919 ** store NULL in *paCol and 0 in *pnCol and return SQLITE_NOMEM.
1920 **
1921 ** The only guarantee that SQLite makes about column names is that if the
1922 ** column has an AS clause assigning it a name, that will be the name used.
1923 ** That is the only documented guarantee.  However, countless applications
1924 ** developed over the years have made baseless assumptions about column names
1925 ** and will break if those assumptions changes.  Hence, use extreme caution
1926 ** when modifying this routine to avoid breaking legacy.
1927 **
1928 ** See Also: generateColumnNames()
1929 */
1930 int sqlite3ColumnsFromExprList(
1931   Parse *pParse,          /* Parsing context */
1932   ExprList *pEList,       /* Expr list from which to derive column names */
1933   i16 *pnCol,             /* Write the number of columns here */
1934   Column **paCol          /* Write the new column list here */
1935 ){
1936   sqlite3 *db = pParse->db;   /* Database connection */
1937   int i, j;                   /* Loop counters */
1938   u32 cnt;                    /* Index added to make the name unique */
1939   Column *aCol, *pCol;        /* For looping over result columns */
1940   int nCol;                   /* Number of columns in the result set */
1941   char *zName;                /* Column name */
1942   int nName;                  /* Size of name in zName[] */
1943   Hash ht;                    /* Hash table of column names */
1944 
1945   sqlite3HashInit(&ht);
1946   if( pEList ){
1947     nCol = pEList->nExpr;
1948     aCol = sqlite3DbMallocZero(db, sizeof(aCol[0])*nCol);
1949     testcase( aCol==0 );
1950     if( nCol>32767 ) nCol = 32767;
1951   }else{
1952     nCol = 0;
1953     aCol = 0;
1954   }
1955   assert( nCol==(i16)nCol );
1956   *pnCol = nCol;
1957   *paCol = aCol;
1958 
1959   for(i=0, pCol=aCol; i<nCol && !db->mallocFailed; i++, pCol++){
1960     /* Get an appropriate name for the column
1961     */
1962     if( (zName = pEList->a[i].zName)!=0 ){
1963       /* If the column contains an "AS <name>" phrase, use <name> as the name */
1964     }else{
1965       Expr *pColExpr = sqlite3ExprSkipCollateAndLikely(pEList->a[i].pExpr);
1966       while( pColExpr->op==TK_DOT ){
1967         pColExpr = pColExpr->pRight;
1968         assert( pColExpr!=0 );
1969       }
1970       if( pColExpr->op==TK_COLUMN ){
1971         /* For columns use the column name name */
1972         int iCol = pColExpr->iColumn;
1973         Table *pTab = pColExpr->y.pTab;
1974         assert( pTab!=0 );
1975         if( iCol<0 ) iCol = pTab->iPKey;
1976         zName = iCol>=0 ? pTab->aCol[iCol].zName : "rowid";
1977       }else if( pColExpr->op==TK_ID ){
1978         assert( !ExprHasProperty(pColExpr, EP_IntValue) );
1979         zName = pColExpr->u.zToken;
1980       }else{
1981         /* Use the original text of the column expression as its name */
1982         zName = pEList->a[i].zSpan;
1983       }
1984     }
1985     if( zName ){
1986       zName = sqlite3DbStrDup(db, zName);
1987     }else{
1988       zName = sqlite3MPrintf(db,"column%d",i+1);
1989     }
1990 
1991     /* Make sure the column name is unique.  If the name is not unique,
1992     ** append an integer to the name so that it becomes unique.
1993     */
1994     cnt = 0;
1995     while( zName && sqlite3HashFind(&ht, zName)!=0 ){
1996       nName = sqlite3Strlen30(zName);
1997       if( nName>0 ){
1998         for(j=nName-1; j>0 && sqlite3Isdigit(zName[j]); j--){}
1999         if( zName[j]==':' ) nName = j;
2000       }
2001       zName = sqlite3MPrintf(db, "%.*z:%u", nName, zName, ++cnt);
2002       if( cnt>3 ) sqlite3_randomness(sizeof(cnt), &cnt);
2003     }
2004     pCol->zName = zName;
2005     sqlite3ColumnPropertiesFromName(0, pCol);
2006     if( zName && sqlite3HashInsert(&ht, zName, pCol)==pCol ){
2007       sqlite3OomFault(db);
2008     }
2009   }
2010   sqlite3HashClear(&ht);
2011   if( db->mallocFailed ){
2012     for(j=0; j<i; j++){
2013       sqlite3DbFree(db, aCol[j].zName);
2014     }
2015     sqlite3DbFree(db, aCol);
2016     *paCol = 0;
2017     *pnCol = 0;
2018     return SQLITE_NOMEM_BKPT;
2019   }
2020   return SQLITE_OK;
2021 }
2022 
2023 /*
2024 ** Add type and collation information to a column list based on
2025 ** a SELECT statement.
2026 **
2027 ** The column list presumably came from selectColumnNamesFromExprList().
2028 ** The column list has only names, not types or collations.  This
2029 ** routine goes through and adds the types and collations.
2030 **
2031 ** This routine requires that all identifiers in the SELECT
2032 ** statement be resolved.
2033 */
2034 void sqlite3SelectAddColumnTypeAndCollation(
2035   Parse *pParse,        /* Parsing contexts */
2036   Table *pTab,          /* Add column type information to this table */
2037   Select *pSelect,      /* SELECT used to determine types and collations */
2038   char aff              /* Default affinity for columns */
2039 ){
2040   sqlite3 *db = pParse->db;
2041   NameContext sNC;
2042   Column *pCol;
2043   CollSeq *pColl;
2044   int i;
2045   Expr *p;
2046   struct ExprList_item *a;
2047 
2048   assert( pSelect!=0 );
2049   assert( (pSelect->selFlags & SF_Resolved)!=0 );
2050   assert( pTab->nCol==pSelect->pEList->nExpr || db->mallocFailed );
2051   if( db->mallocFailed ) return;
2052   memset(&sNC, 0, sizeof(sNC));
2053   sNC.pSrcList = pSelect->pSrc;
2054   a = pSelect->pEList->a;
2055   for(i=0, pCol=pTab->aCol; i<pTab->nCol; i++, pCol++){
2056     const char *zType;
2057     int n, m;
2058     p = a[i].pExpr;
2059     zType = columnType(&sNC, p, 0, 0, 0);
2060     /* pCol->szEst = ... // Column size est for SELECT tables never used */
2061     pCol->affinity = sqlite3ExprAffinity(p);
2062     if( zType ){
2063       m = sqlite3Strlen30(zType);
2064       n = sqlite3Strlen30(pCol->zName);
2065       pCol->zName = sqlite3DbReallocOrFree(db, pCol->zName, n+m+2);
2066       if( pCol->zName ){
2067         memcpy(&pCol->zName[n+1], zType, m+1);
2068         pCol->colFlags |= COLFLAG_HASTYPE;
2069       }
2070     }
2071     if( pCol->affinity<=SQLITE_AFF_NONE ) pCol->affinity = aff;
2072     pColl = sqlite3ExprCollSeq(pParse, p);
2073     if( pColl && pCol->zColl==0 ){
2074       pCol->zColl = sqlite3DbStrDup(db, pColl->zName);
2075     }
2076   }
2077   pTab->szTabRow = 1; /* Any non-zero value works */
2078 }
2079 
2080 /*
2081 ** Given a SELECT statement, generate a Table structure that describes
2082 ** the result set of that SELECT.
2083 */
2084 Table *sqlite3ResultSetOfSelect(Parse *pParse, Select *pSelect, char aff){
2085   Table *pTab;
2086   sqlite3 *db = pParse->db;
2087   u64 savedFlags;
2088 
2089   savedFlags = db->flags;
2090   db->flags &= ~(u64)SQLITE_FullColNames;
2091   db->flags |= SQLITE_ShortColNames;
2092   sqlite3SelectPrep(pParse, pSelect, 0);
2093   db->flags = savedFlags;
2094   if( pParse->nErr ) return 0;
2095   while( pSelect->pPrior ) pSelect = pSelect->pPrior;
2096   pTab = sqlite3DbMallocZero(db, sizeof(Table) );
2097   if( pTab==0 ){
2098     return 0;
2099   }
2100   pTab->nTabRef = 1;
2101   pTab->zName = 0;
2102   pTab->nRowLogEst = 200; assert( 200==sqlite3LogEst(1048576) );
2103   sqlite3ColumnsFromExprList(pParse, pSelect->pEList, &pTab->nCol, &pTab->aCol);
2104   sqlite3SelectAddColumnTypeAndCollation(pParse, pTab, pSelect, aff);
2105   pTab->iPKey = -1;
2106   if( db->mallocFailed ){
2107     sqlite3DeleteTable(db, pTab);
2108     return 0;
2109   }
2110   return pTab;
2111 }
2112 
2113 /*
2114 ** Get a VDBE for the given parser context.  Create a new one if necessary.
2115 ** If an error occurs, return NULL and leave a message in pParse.
2116 */
2117 Vdbe *sqlite3GetVdbe(Parse *pParse){
2118   if( pParse->pVdbe ){
2119     return pParse->pVdbe;
2120   }
2121   if( pParse->pToplevel==0
2122    && OptimizationEnabled(pParse->db,SQLITE_FactorOutConst)
2123   ){
2124     pParse->okConstFactor = 1;
2125   }
2126   return sqlite3VdbeCreate(pParse);
2127 }
2128 
2129 
2130 /*
2131 ** Compute the iLimit and iOffset fields of the SELECT based on the
2132 ** pLimit expressions.  pLimit->pLeft and pLimit->pRight hold the expressions
2133 ** that appear in the original SQL statement after the LIMIT and OFFSET
2134 ** keywords.  Or NULL if those keywords are omitted. iLimit and iOffset
2135 ** are the integer memory register numbers for counters used to compute
2136 ** the limit and offset.  If there is no limit and/or offset, then
2137 ** iLimit and iOffset are negative.
2138 **
2139 ** This routine changes the values of iLimit and iOffset only if
2140 ** a limit or offset is defined by pLimit->pLeft and pLimit->pRight.  iLimit
2141 ** and iOffset should have been preset to appropriate default values (zero)
2142 ** prior to calling this routine.
2143 **
2144 ** The iOffset register (if it exists) is initialized to the value
2145 ** of the OFFSET.  The iLimit register is initialized to LIMIT.  Register
2146 ** iOffset+1 is initialized to LIMIT+OFFSET.
2147 **
2148 ** Only if pLimit->pLeft!=0 do the limit registers get
2149 ** redefined.  The UNION ALL operator uses this property to force
2150 ** the reuse of the same limit and offset registers across multiple
2151 ** SELECT statements.
2152 */
2153 static void computeLimitRegisters(Parse *pParse, Select *p, int iBreak){
2154   Vdbe *v = 0;
2155   int iLimit = 0;
2156   int iOffset;
2157   int n;
2158   Expr *pLimit = p->pLimit;
2159 
2160   if( p->iLimit ) return;
2161 
2162   /*
2163   ** "LIMIT -1" always shows all rows.  There is some
2164   ** controversy about what the correct behavior should be.
2165   ** The current implementation interprets "LIMIT 0" to mean
2166   ** no rows.
2167   */
2168   if( pLimit ){
2169     assert( pLimit->op==TK_LIMIT );
2170     assert( pLimit->pLeft!=0 );
2171     p->iLimit = iLimit = ++pParse->nMem;
2172     v = sqlite3GetVdbe(pParse);
2173     assert( v!=0 );
2174     if( sqlite3ExprIsInteger(pLimit->pLeft, &n) ){
2175       sqlite3VdbeAddOp2(v, OP_Integer, n, iLimit);
2176       VdbeComment((v, "LIMIT counter"));
2177       if( n==0 ){
2178         sqlite3VdbeGoto(v, iBreak);
2179       }else if( n>=0 && p->nSelectRow>sqlite3LogEst((u64)n) ){
2180         p->nSelectRow = sqlite3LogEst((u64)n);
2181         p->selFlags |= SF_FixedLimit;
2182       }
2183     }else{
2184       sqlite3ExprCode(pParse, pLimit->pLeft, iLimit);
2185       sqlite3VdbeAddOp1(v, OP_MustBeInt, iLimit); VdbeCoverage(v);
2186       VdbeComment((v, "LIMIT counter"));
2187       sqlite3VdbeAddOp2(v, OP_IfNot, iLimit, iBreak); VdbeCoverage(v);
2188     }
2189     if( pLimit->pRight ){
2190       p->iOffset = iOffset = ++pParse->nMem;
2191       pParse->nMem++;   /* Allocate an extra register for limit+offset */
2192       sqlite3ExprCode(pParse, pLimit->pRight, iOffset);
2193       sqlite3VdbeAddOp1(v, OP_MustBeInt, iOffset); VdbeCoverage(v);
2194       VdbeComment((v, "OFFSET counter"));
2195       sqlite3VdbeAddOp3(v, OP_OffsetLimit, iLimit, iOffset+1, iOffset);
2196       VdbeComment((v, "LIMIT+OFFSET"));
2197     }
2198   }
2199 }
2200 
2201 #ifndef SQLITE_OMIT_COMPOUND_SELECT
2202 /*
2203 ** Return the appropriate collating sequence for the iCol-th column of
2204 ** the result set for the compound-select statement "p".  Return NULL if
2205 ** the column has no default collating sequence.
2206 **
2207 ** The collating sequence for the compound select is taken from the
2208 ** left-most term of the select that has a collating sequence.
2209 */
2210 static CollSeq *multiSelectCollSeq(Parse *pParse, Select *p, int iCol){
2211   CollSeq *pRet;
2212   if( p->pPrior ){
2213     pRet = multiSelectCollSeq(pParse, p->pPrior, iCol);
2214   }else{
2215     pRet = 0;
2216   }
2217   assert( iCol>=0 );
2218   /* iCol must be less than p->pEList->nExpr.  Otherwise an error would
2219   ** have been thrown during name resolution and we would not have gotten
2220   ** this far */
2221   if( pRet==0 && ALWAYS(iCol<p->pEList->nExpr) ){
2222     pRet = sqlite3ExprCollSeq(pParse, p->pEList->a[iCol].pExpr);
2223   }
2224   return pRet;
2225 }
2226 
2227 /*
2228 ** The select statement passed as the second parameter is a compound SELECT
2229 ** with an ORDER BY clause. This function allocates and returns a KeyInfo
2230 ** structure suitable for implementing the ORDER BY.
2231 **
2232 ** Space to hold the KeyInfo structure is obtained from malloc. The calling
2233 ** function is responsible for ensuring that this structure is eventually
2234 ** freed.
2235 */
2236 static KeyInfo *multiSelectOrderByKeyInfo(Parse *pParse, Select *p, int nExtra){
2237   ExprList *pOrderBy = p->pOrderBy;
2238   int nOrderBy = p->pOrderBy->nExpr;
2239   sqlite3 *db = pParse->db;
2240   KeyInfo *pRet = sqlite3KeyInfoAlloc(db, nOrderBy+nExtra, 1);
2241   if( pRet ){
2242     int i;
2243     for(i=0; i<nOrderBy; i++){
2244       struct ExprList_item *pItem = &pOrderBy->a[i];
2245       Expr *pTerm = pItem->pExpr;
2246       CollSeq *pColl;
2247 
2248       if( pTerm->flags & EP_Collate ){
2249         pColl = sqlite3ExprCollSeq(pParse, pTerm);
2250       }else{
2251         pColl = multiSelectCollSeq(pParse, p, pItem->u.x.iOrderByCol-1);
2252         if( pColl==0 ) pColl = db->pDfltColl;
2253         pOrderBy->a[i].pExpr =
2254           sqlite3ExprAddCollateString(pParse, pTerm, pColl->zName);
2255       }
2256       assert( sqlite3KeyInfoIsWriteable(pRet) );
2257       pRet->aColl[i] = pColl;
2258       pRet->aSortFlags[i] = pOrderBy->a[i].sortFlags;
2259     }
2260   }
2261 
2262   return pRet;
2263 }
2264 
2265 #ifndef SQLITE_OMIT_CTE
2266 /*
2267 ** This routine generates VDBE code to compute the content of a WITH RECURSIVE
2268 ** query of the form:
2269 **
2270 **   <recursive-table> AS (<setup-query> UNION [ALL] <recursive-query>)
2271 **                         \___________/             \_______________/
2272 **                           p->pPrior                      p
2273 **
2274 **
2275 ** There is exactly one reference to the recursive-table in the FROM clause
2276 ** of recursive-query, marked with the SrcList->a[].fg.isRecursive flag.
2277 **
2278 ** The setup-query runs once to generate an initial set of rows that go
2279 ** into a Queue table.  Rows are extracted from the Queue table one by
2280 ** one.  Each row extracted from Queue is output to pDest.  Then the single
2281 ** extracted row (now in the iCurrent table) becomes the content of the
2282 ** recursive-table for a recursive-query run.  The output of the recursive-query
2283 ** is added back into the Queue table.  Then another row is extracted from Queue
2284 ** and the iteration continues until the Queue table is empty.
2285 **
2286 ** If the compound query operator is UNION then no duplicate rows are ever
2287 ** inserted into the Queue table.  The iDistinct table keeps a copy of all rows
2288 ** that have ever been inserted into Queue and causes duplicates to be
2289 ** discarded.  If the operator is UNION ALL, then duplicates are allowed.
2290 **
2291 ** If the query has an ORDER BY, then entries in the Queue table are kept in
2292 ** ORDER BY order and the first entry is extracted for each cycle.  Without
2293 ** an ORDER BY, the Queue table is just a FIFO.
2294 **
2295 ** If a LIMIT clause is provided, then the iteration stops after LIMIT rows
2296 ** have been output to pDest.  A LIMIT of zero means to output no rows and a
2297 ** negative LIMIT means to output all rows.  If there is also an OFFSET clause
2298 ** with a positive value, then the first OFFSET outputs are discarded rather
2299 ** than being sent to pDest.  The LIMIT count does not begin until after OFFSET
2300 ** rows have been skipped.
2301 */
2302 static void generateWithRecursiveQuery(
2303   Parse *pParse,        /* Parsing context */
2304   Select *p,            /* The recursive SELECT to be coded */
2305   SelectDest *pDest     /* What to do with query results */
2306 ){
2307   SrcList *pSrc = p->pSrc;      /* The FROM clause of the recursive query */
2308   int nCol = p->pEList->nExpr;  /* Number of columns in the recursive table */
2309   Vdbe *v = pParse->pVdbe;      /* The prepared statement under construction */
2310   Select *pSetup = p->pPrior;   /* The setup query */
2311   int addrTop;                  /* Top of the loop */
2312   int addrCont, addrBreak;      /* CONTINUE and BREAK addresses */
2313   int iCurrent = 0;             /* The Current table */
2314   int regCurrent;               /* Register holding Current table */
2315   int iQueue;                   /* The Queue table */
2316   int iDistinct = 0;            /* To ensure unique results if UNION */
2317   int eDest = SRT_Fifo;         /* How to write to Queue */
2318   SelectDest destQueue;         /* SelectDest targetting the Queue table */
2319   int i;                        /* Loop counter */
2320   int rc;                       /* Result code */
2321   ExprList *pOrderBy;           /* The ORDER BY clause */
2322   Expr *pLimit;                 /* Saved LIMIT and OFFSET */
2323   int regLimit, regOffset;      /* Registers used by LIMIT and OFFSET */
2324 
2325 #ifndef SQLITE_OMIT_WINDOWFUNC
2326   if( p->pWin ){
2327     sqlite3ErrorMsg(pParse, "cannot use window functions in recursive queries");
2328     return;
2329   }
2330 #endif
2331 
2332   /* Obtain authorization to do a recursive query */
2333   if( sqlite3AuthCheck(pParse, SQLITE_RECURSIVE, 0, 0, 0) ) return;
2334 
2335   /* Process the LIMIT and OFFSET clauses, if they exist */
2336   addrBreak = sqlite3VdbeMakeLabel(pParse);
2337   p->nSelectRow = 320;  /* 4 billion rows */
2338   computeLimitRegisters(pParse, p, addrBreak);
2339   pLimit = p->pLimit;
2340   regLimit = p->iLimit;
2341   regOffset = p->iOffset;
2342   p->pLimit = 0;
2343   p->iLimit = p->iOffset = 0;
2344   pOrderBy = p->pOrderBy;
2345 
2346   /* Locate the cursor number of the Current table */
2347   for(i=0; ALWAYS(i<pSrc->nSrc); i++){
2348     if( pSrc->a[i].fg.isRecursive ){
2349       iCurrent = pSrc->a[i].iCursor;
2350       break;
2351     }
2352   }
2353 
2354   /* Allocate cursors numbers for Queue and Distinct.  The cursor number for
2355   ** the Distinct table must be exactly one greater than Queue in order
2356   ** for the SRT_DistFifo and SRT_DistQueue destinations to work. */
2357   iQueue = pParse->nTab++;
2358   if( p->op==TK_UNION ){
2359     eDest = pOrderBy ? SRT_DistQueue : SRT_DistFifo;
2360     iDistinct = pParse->nTab++;
2361   }else{
2362     eDest = pOrderBy ? SRT_Queue : SRT_Fifo;
2363   }
2364   sqlite3SelectDestInit(&destQueue, eDest, iQueue);
2365 
2366   /* Allocate cursors for Current, Queue, and Distinct. */
2367   regCurrent = ++pParse->nMem;
2368   sqlite3VdbeAddOp3(v, OP_OpenPseudo, iCurrent, regCurrent, nCol);
2369   if( pOrderBy ){
2370     KeyInfo *pKeyInfo = multiSelectOrderByKeyInfo(pParse, p, 1);
2371     sqlite3VdbeAddOp4(v, OP_OpenEphemeral, iQueue, pOrderBy->nExpr+2, 0,
2372                       (char*)pKeyInfo, P4_KEYINFO);
2373     destQueue.pOrderBy = pOrderBy;
2374   }else{
2375     sqlite3VdbeAddOp2(v, OP_OpenEphemeral, iQueue, nCol);
2376   }
2377   VdbeComment((v, "Queue table"));
2378   if( iDistinct ){
2379     p->addrOpenEphm[0] = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, iDistinct, 0);
2380     p->selFlags |= SF_UsesEphemeral;
2381   }
2382 
2383   /* Detach the ORDER BY clause from the compound SELECT */
2384   p->pOrderBy = 0;
2385 
2386   /* Store the results of the setup-query in Queue. */
2387   pSetup->pNext = 0;
2388   ExplainQueryPlan((pParse, 1, "SETUP"));
2389   rc = sqlite3Select(pParse, pSetup, &destQueue);
2390   pSetup->pNext = p;
2391   if( rc ) goto end_of_recursive_query;
2392 
2393   /* Find the next row in the Queue and output that row */
2394   addrTop = sqlite3VdbeAddOp2(v, OP_Rewind, iQueue, addrBreak); VdbeCoverage(v);
2395 
2396   /* Transfer the next row in Queue over to Current */
2397   sqlite3VdbeAddOp1(v, OP_NullRow, iCurrent); /* To reset column cache */
2398   if( pOrderBy ){
2399     sqlite3VdbeAddOp3(v, OP_Column, iQueue, pOrderBy->nExpr+1, regCurrent);
2400   }else{
2401     sqlite3VdbeAddOp2(v, OP_RowData, iQueue, regCurrent);
2402   }
2403   sqlite3VdbeAddOp1(v, OP_Delete, iQueue);
2404 
2405   /* Output the single row in Current */
2406   addrCont = sqlite3VdbeMakeLabel(pParse);
2407   codeOffset(v, regOffset, addrCont);
2408   selectInnerLoop(pParse, p, iCurrent,
2409       0, 0, pDest, addrCont, addrBreak);
2410   if( regLimit ){
2411     sqlite3VdbeAddOp2(v, OP_DecrJumpZero, regLimit, addrBreak);
2412     VdbeCoverage(v);
2413   }
2414   sqlite3VdbeResolveLabel(v, addrCont);
2415 
2416   /* Execute the recursive SELECT taking the single row in Current as
2417   ** the value for the recursive-table. Store the results in the Queue.
2418   */
2419   if( p->selFlags & SF_Aggregate ){
2420     sqlite3ErrorMsg(pParse, "recursive aggregate queries not supported");
2421   }else{
2422     p->pPrior = 0;
2423     ExplainQueryPlan((pParse, 1, "RECURSIVE STEP"));
2424     sqlite3Select(pParse, p, &destQueue);
2425     assert( p->pPrior==0 );
2426     p->pPrior = pSetup;
2427   }
2428 
2429   /* Keep running the loop until the Queue is empty */
2430   sqlite3VdbeGoto(v, addrTop);
2431   sqlite3VdbeResolveLabel(v, addrBreak);
2432 
2433 end_of_recursive_query:
2434   sqlite3ExprListDelete(pParse->db, p->pOrderBy);
2435   p->pOrderBy = pOrderBy;
2436   p->pLimit = pLimit;
2437   return;
2438 }
2439 #endif /* SQLITE_OMIT_CTE */
2440 
2441 /* Forward references */
2442 static int multiSelectOrderBy(
2443   Parse *pParse,        /* Parsing context */
2444   Select *p,            /* The right-most of SELECTs to be coded */
2445   SelectDest *pDest     /* What to do with query results */
2446 );
2447 
2448 /*
2449 ** Handle the special case of a compound-select that originates from a
2450 ** VALUES clause.  By handling this as a special case, we avoid deep
2451 ** recursion, and thus do not need to enforce the SQLITE_LIMIT_COMPOUND_SELECT
2452 ** on a VALUES clause.
2453 **
2454 ** Because the Select object originates from a VALUES clause:
2455 **   (1) There is no LIMIT or OFFSET or else there is a LIMIT of exactly 1
2456 **   (2) All terms are UNION ALL
2457 **   (3) There is no ORDER BY clause
2458 **
2459 ** The "LIMIT of exactly 1" case of condition (1) comes about when a VALUES
2460 ** clause occurs within scalar expression (ex: "SELECT (VALUES(1),(2),(3))").
2461 ** The sqlite3CodeSubselect will have added the LIMIT 1 clause in tht case.
2462 ** Since the limit is exactly 1, we only need to evalutes the left-most VALUES.
2463 */
2464 static int multiSelectValues(
2465   Parse *pParse,        /* Parsing context */
2466   Select *p,            /* The right-most of SELECTs to be coded */
2467   SelectDest *pDest     /* What to do with query results */
2468 ){
2469   int nRow = 1;
2470   int rc = 0;
2471   int bShowAll = p->pLimit==0;
2472   assert( p->selFlags & SF_MultiValue );
2473   do{
2474     assert( p->selFlags & SF_Values );
2475     assert( p->op==TK_ALL || (p->op==TK_SELECT && p->pPrior==0) );
2476     assert( p->pNext==0 || p->pEList->nExpr==p->pNext->pEList->nExpr );
2477     if( p->pWin ) return -1;
2478     if( p->pPrior==0 ) break;
2479     assert( p->pPrior->pNext==p );
2480     p = p->pPrior;
2481     nRow += bShowAll;
2482   }while(1);
2483   ExplainQueryPlan((pParse, 0, "SCAN %d CONSTANT ROW%s", nRow,
2484                     nRow==1 ? "" : "S"));
2485   while( p ){
2486     selectInnerLoop(pParse, p, -1, 0, 0, pDest, 1, 1);
2487     if( !bShowAll ) break;
2488     p->nSelectRow = nRow;
2489     p = p->pNext;
2490   }
2491   return rc;
2492 }
2493 
2494 /*
2495 ** This routine is called to process a compound query form from
2496 ** two or more separate queries using UNION, UNION ALL, EXCEPT, or
2497 ** INTERSECT
2498 **
2499 ** "p" points to the right-most of the two queries.  the query on the
2500 ** left is p->pPrior.  The left query could also be a compound query
2501 ** in which case this routine will be called recursively.
2502 **
2503 ** The results of the total query are to be written into a destination
2504 ** of type eDest with parameter iParm.
2505 **
2506 ** Example 1:  Consider a three-way compound SQL statement.
2507 **
2508 **     SELECT a FROM t1 UNION SELECT b FROM t2 UNION SELECT c FROM t3
2509 **
2510 ** This statement is parsed up as follows:
2511 **
2512 **     SELECT c FROM t3
2513 **      |
2514 **      `----->  SELECT b FROM t2
2515 **                |
2516 **                `------>  SELECT a FROM t1
2517 **
2518 ** The arrows in the diagram above represent the Select.pPrior pointer.
2519 ** So if this routine is called with p equal to the t3 query, then
2520 ** pPrior will be the t2 query.  p->op will be TK_UNION in this case.
2521 **
2522 ** Notice that because of the way SQLite parses compound SELECTs, the
2523 ** individual selects always group from left to right.
2524 */
2525 static int multiSelect(
2526   Parse *pParse,        /* Parsing context */
2527   Select *p,            /* The right-most of SELECTs to be coded */
2528   SelectDest *pDest     /* What to do with query results */
2529 ){
2530   int rc = SQLITE_OK;   /* Success code from a subroutine */
2531   Select *pPrior;       /* Another SELECT immediately to our left */
2532   Vdbe *v;              /* Generate code to this VDBE */
2533   SelectDest dest;      /* Alternative data destination */
2534   Select *pDelete = 0;  /* Chain of simple selects to delete */
2535   sqlite3 *db;          /* Database connection */
2536 
2537   /* Make sure there is no ORDER BY or LIMIT clause on prior SELECTs.  Only
2538   ** the last (right-most) SELECT in the series may have an ORDER BY or LIMIT.
2539   */
2540   assert( p && p->pPrior );  /* Calling function guarantees this much */
2541   assert( (p->selFlags & SF_Recursive)==0 || p->op==TK_ALL || p->op==TK_UNION );
2542   assert( p->selFlags & SF_Compound );
2543   db = pParse->db;
2544   pPrior = p->pPrior;
2545   dest = *pDest;
2546   if( pPrior->pOrderBy || pPrior->pLimit ){
2547     sqlite3ErrorMsg(pParse,"%s clause should come after %s not before",
2548       pPrior->pOrderBy!=0 ? "ORDER BY" : "LIMIT", selectOpName(p->op));
2549     rc = 1;
2550     goto multi_select_end;
2551   }
2552 
2553   v = sqlite3GetVdbe(pParse);
2554   assert( v!=0 );  /* The VDBE already created by calling function */
2555 
2556   /* Create the destination temporary table if necessary
2557   */
2558   if( dest.eDest==SRT_EphemTab ){
2559     assert( p->pEList );
2560     sqlite3VdbeAddOp2(v, OP_OpenEphemeral, dest.iSDParm, p->pEList->nExpr);
2561     dest.eDest = SRT_Table;
2562   }
2563 
2564   /* Special handling for a compound-select that originates as a VALUES clause.
2565   */
2566   if( p->selFlags & SF_MultiValue ){
2567     rc = multiSelectValues(pParse, p, &dest);
2568     if( rc>=0 ) goto multi_select_end;
2569     rc = SQLITE_OK;
2570   }
2571 
2572   /* Make sure all SELECTs in the statement have the same number of elements
2573   ** in their result sets.
2574   */
2575   assert( p->pEList && pPrior->pEList );
2576   assert( p->pEList->nExpr==pPrior->pEList->nExpr );
2577 
2578 #ifndef SQLITE_OMIT_CTE
2579   if( p->selFlags & SF_Recursive ){
2580     generateWithRecursiveQuery(pParse, p, &dest);
2581   }else
2582 #endif
2583 
2584   /* Compound SELECTs that have an ORDER BY clause are handled separately.
2585   */
2586   if( p->pOrderBy ){
2587     return multiSelectOrderBy(pParse, p, pDest);
2588   }else{
2589 
2590 #ifndef SQLITE_OMIT_EXPLAIN
2591     if( pPrior->pPrior==0 ){
2592       ExplainQueryPlan((pParse, 1, "COMPOUND QUERY"));
2593       ExplainQueryPlan((pParse, 1, "LEFT-MOST SUBQUERY"));
2594     }
2595 #endif
2596 
2597     /* Generate code for the left and right SELECT statements.
2598     */
2599     switch( p->op ){
2600       case TK_ALL: {
2601         int addr = 0;
2602         int nLimit;
2603         assert( !pPrior->pLimit );
2604         pPrior->iLimit = p->iLimit;
2605         pPrior->iOffset = p->iOffset;
2606         pPrior->pLimit = p->pLimit;
2607         rc = sqlite3Select(pParse, pPrior, &dest);
2608         p->pLimit = 0;
2609         if( rc ){
2610           goto multi_select_end;
2611         }
2612         p->pPrior = 0;
2613         p->iLimit = pPrior->iLimit;
2614         p->iOffset = pPrior->iOffset;
2615         if( p->iLimit ){
2616           addr = sqlite3VdbeAddOp1(v, OP_IfNot, p->iLimit); VdbeCoverage(v);
2617           VdbeComment((v, "Jump ahead if LIMIT reached"));
2618           if( p->iOffset ){
2619             sqlite3VdbeAddOp3(v, OP_OffsetLimit,
2620                               p->iLimit, p->iOffset+1, p->iOffset);
2621           }
2622         }
2623         ExplainQueryPlan((pParse, 1, "UNION ALL"));
2624         rc = sqlite3Select(pParse, p, &dest);
2625         testcase( rc!=SQLITE_OK );
2626         pDelete = p->pPrior;
2627         p->pPrior = pPrior;
2628         p->nSelectRow = sqlite3LogEstAdd(p->nSelectRow, pPrior->nSelectRow);
2629         if( pPrior->pLimit
2630          && sqlite3ExprIsInteger(pPrior->pLimit->pLeft, &nLimit)
2631          && nLimit>0 && p->nSelectRow > sqlite3LogEst((u64)nLimit)
2632         ){
2633           p->nSelectRow = sqlite3LogEst((u64)nLimit);
2634         }
2635         if( addr ){
2636           sqlite3VdbeJumpHere(v, addr);
2637         }
2638         break;
2639       }
2640       case TK_EXCEPT:
2641       case TK_UNION: {
2642         int unionTab;    /* Cursor number of the temp table holding result */
2643         u8 op = 0;       /* One of the SRT_ operations to apply to self */
2644         int priorOp;     /* The SRT_ operation to apply to prior selects */
2645         Expr *pLimit;    /* Saved values of p->nLimit  */
2646         int addr;
2647         SelectDest uniondest;
2648 
2649         testcase( p->op==TK_EXCEPT );
2650         testcase( p->op==TK_UNION );
2651         priorOp = SRT_Union;
2652         if( dest.eDest==priorOp ){
2653           /* We can reuse a temporary table generated by a SELECT to our
2654           ** right.
2655           */
2656           assert( p->pLimit==0 );      /* Not allowed on leftward elements */
2657           unionTab = dest.iSDParm;
2658         }else{
2659           /* We will need to create our own temporary table to hold the
2660           ** intermediate results.
2661           */
2662           unionTab = pParse->nTab++;
2663           assert( p->pOrderBy==0 );
2664           addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, unionTab, 0);
2665           assert( p->addrOpenEphm[0] == -1 );
2666           p->addrOpenEphm[0] = addr;
2667           findRightmost(p)->selFlags |= SF_UsesEphemeral;
2668           assert( p->pEList );
2669         }
2670 
2671         /* Code the SELECT statements to our left
2672         */
2673         assert( !pPrior->pOrderBy );
2674         sqlite3SelectDestInit(&uniondest, priorOp, unionTab);
2675         rc = sqlite3Select(pParse, pPrior, &uniondest);
2676         if( rc ){
2677           goto multi_select_end;
2678         }
2679 
2680         /* Code the current SELECT statement
2681         */
2682         if( p->op==TK_EXCEPT ){
2683           op = SRT_Except;
2684         }else{
2685           assert( p->op==TK_UNION );
2686           op = SRT_Union;
2687         }
2688         p->pPrior = 0;
2689         pLimit = p->pLimit;
2690         p->pLimit = 0;
2691         uniondest.eDest = op;
2692         ExplainQueryPlan((pParse, 1, "%s USING TEMP B-TREE",
2693                           selectOpName(p->op)));
2694         rc = sqlite3Select(pParse, p, &uniondest);
2695         testcase( rc!=SQLITE_OK );
2696         /* Query flattening in sqlite3Select() might refill p->pOrderBy.
2697         ** Be sure to delete p->pOrderBy, therefore, to avoid a memory leak. */
2698         sqlite3ExprListDelete(db, p->pOrderBy);
2699         pDelete = p->pPrior;
2700         p->pPrior = pPrior;
2701         p->pOrderBy = 0;
2702         if( p->op==TK_UNION ){
2703           p->nSelectRow = sqlite3LogEstAdd(p->nSelectRow, pPrior->nSelectRow);
2704         }
2705         sqlite3ExprDelete(db, p->pLimit);
2706         p->pLimit = pLimit;
2707         p->iLimit = 0;
2708         p->iOffset = 0;
2709 
2710         /* Convert the data in the temporary table into whatever form
2711         ** it is that we currently need.
2712         */
2713         assert( unionTab==dest.iSDParm || dest.eDest!=priorOp );
2714         if( dest.eDest!=priorOp ){
2715           int iCont, iBreak, iStart;
2716           assert( p->pEList );
2717           iBreak = sqlite3VdbeMakeLabel(pParse);
2718           iCont = sqlite3VdbeMakeLabel(pParse);
2719           computeLimitRegisters(pParse, p, iBreak);
2720           sqlite3VdbeAddOp2(v, OP_Rewind, unionTab, iBreak); VdbeCoverage(v);
2721           iStart = sqlite3VdbeCurrentAddr(v);
2722           selectInnerLoop(pParse, p, unionTab,
2723                           0, 0, &dest, iCont, iBreak);
2724           sqlite3VdbeResolveLabel(v, iCont);
2725           sqlite3VdbeAddOp2(v, OP_Next, unionTab, iStart); VdbeCoverage(v);
2726           sqlite3VdbeResolveLabel(v, iBreak);
2727           sqlite3VdbeAddOp2(v, OP_Close, unionTab, 0);
2728         }
2729         break;
2730       }
2731       default: assert( p->op==TK_INTERSECT ); {
2732         int tab1, tab2;
2733         int iCont, iBreak, iStart;
2734         Expr *pLimit;
2735         int addr;
2736         SelectDest intersectdest;
2737         int r1;
2738 
2739         /* INTERSECT is different from the others since it requires
2740         ** two temporary tables.  Hence it has its own case.  Begin
2741         ** by allocating the tables we will need.
2742         */
2743         tab1 = pParse->nTab++;
2744         tab2 = pParse->nTab++;
2745         assert( p->pOrderBy==0 );
2746 
2747         addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, tab1, 0);
2748         assert( p->addrOpenEphm[0] == -1 );
2749         p->addrOpenEphm[0] = addr;
2750         findRightmost(p)->selFlags |= SF_UsesEphemeral;
2751         assert( p->pEList );
2752 
2753         /* Code the SELECTs to our left into temporary table "tab1".
2754         */
2755         sqlite3SelectDestInit(&intersectdest, SRT_Union, tab1);
2756         rc = sqlite3Select(pParse, pPrior, &intersectdest);
2757         if( rc ){
2758           goto multi_select_end;
2759         }
2760 
2761         /* Code the current SELECT into temporary table "tab2"
2762         */
2763         addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, tab2, 0);
2764         assert( p->addrOpenEphm[1] == -1 );
2765         p->addrOpenEphm[1] = addr;
2766         p->pPrior = 0;
2767         pLimit = p->pLimit;
2768         p->pLimit = 0;
2769         intersectdest.iSDParm = tab2;
2770         ExplainQueryPlan((pParse, 1, "%s USING TEMP B-TREE",
2771                           selectOpName(p->op)));
2772         rc = sqlite3Select(pParse, p, &intersectdest);
2773         testcase( rc!=SQLITE_OK );
2774         pDelete = p->pPrior;
2775         p->pPrior = pPrior;
2776         if( p->nSelectRow>pPrior->nSelectRow ){
2777           p->nSelectRow = pPrior->nSelectRow;
2778         }
2779         sqlite3ExprDelete(db, p->pLimit);
2780         p->pLimit = pLimit;
2781 
2782         /* Generate code to take the intersection of the two temporary
2783         ** tables.
2784         */
2785         assert( p->pEList );
2786         iBreak = sqlite3VdbeMakeLabel(pParse);
2787         iCont = sqlite3VdbeMakeLabel(pParse);
2788         computeLimitRegisters(pParse, p, iBreak);
2789         sqlite3VdbeAddOp2(v, OP_Rewind, tab1, iBreak); VdbeCoverage(v);
2790         r1 = sqlite3GetTempReg(pParse);
2791         iStart = sqlite3VdbeAddOp2(v, OP_RowData, tab1, r1);
2792         sqlite3VdbeAddOp4Int(v, OP_NotFound, tab2, iCont, r1, 0);
2793         VdbeCoverage(v);
2794         sqlite3ReleaseTempReg(pParse, r1);
2795         selectInnerLoop(pParse, p, tab1,
2796                         0, 0, &dest, iCont, iBreak);
2797         sqlite3VdbeResolveLabel(v, iCont);
2798         sqlite3VdbeAddOp2(v, OP_Next, tab1, iStart); VdbeCoverage(v);
2799         sqlite3VdbeResolveLabel(v, iBreak);
2800         sqlite3VdbeAddOp2(v, OP_Close, tab2, 0);
2801         sqlite3VdbeAddOp2(v, OP_Close, tab1, 0);
2802         break;
2803       }
2804     }
2805 
2806   #ifndef SQLITE_OMIT_EXPLAIN
2807     if( p->pNext==0 ){
2808       ExplainQueryPlanPop(pParse);
2809     }
2810   #endif
2811   }
2812   if( pParse->nErr ) goto multi_select_end;
2813 
2814   /* Compute collating sequences used by
2815   ** temporary tables needed to implement the compound select.
2816   ** Attach the KeyInfo structure to all temporary tables.
2817   **
2818   ** This section is run by the right-most SELECT statement only.
2819   ** SELECT statements to the left always skip this part.  The right-most
2820   ** SELECT might also skip this part if it has no ORDER BY clause and
2821   ** no temp tables are required.
2822   */
2823   if( p->selFlags & SF_UsesEphemeral ){
2824     int i;                        /* Loop counter */
2825     KeyInfo *pKeyInfo;            /* Collating sequence for the result set */
2826     Select *pLoop;                /* For looping through SELECT statements */
2827     CollSeq **apColl;             /* For looping through pKeyInfo->aColl[] */
2828     int nCol;                     /* Number of columns in result set */
2829 
2830     assert( p->pNext==0 );
2831     nCol = p->pEList->nExpr;
2832     pKeyInfo = sqlite3KeyInfoAlloc(db, nCol, 1);
2833     if( !pKeyInfo ){
2834       rc = SQLITE_NOMEM_BKPT;
2835       goto multi_select_end;
2836     }
2837     for(i=0, apColl=pKeyInfo->aColl; i<nCol; i++, apColl++){
2838       *apColl = multiSelectCollSeq(pParse, p, i);
2839       if( 0==*apColl ){
2840         *apColl = db->pDfltColl;
2841       }
2842     }
2843 
2844     for(pLoop=p; pLoop; pLoop=pLoop->pPrior){
2845       for(i=0; i<2; i++){
2846         int addr = pLoop->addrOpenEphm[i];
2847         if( addr<0 ){
2848           /* If [0] is unused then [1] is also unused.  So we can
2849           ** always safely abort as soon as the first unused slot is found */
2850           assert( pLoop->addrOpenEphm[1]<0 );
2851           break;
2852         }
2853         sqlite3VdbeChangeP2(v, addr, nCol);
2854         sqlite3VdbeChangeP4(v, addr, (char*)sqlite3KeyInfoRef(pKeyInfo),
2855                             P4_KEYINFO);
2856         pLoop->addrOpenEphm[i] = -1;
2857       }
2858     }
2859     sqlite3KeyInfoUnref(pKeyInfo);
2860   }
2861 
2862 multi_select_end:
2863   pDest->iSdst = dest.iSdst;
2864   pDest->nSdst = dest.nSdst;
2865   sqlite3SelectDelete(db, pDelete);
2866   return rc;
2867 }
2868 #endif /* SQLITE_OMIT_COMPOUND_SELECT */
2869 
2870 /*
2871 ** Error message for when two or more terms of a compound select have different
2872 ** size result sets.
2873 */
2874 void sqlite3SelectWrongNumTermsError(Parse *pParse, Select *p){
2875   if( p->selFlags & SF_Values ){
2876     sqlite3ErrorMsg(pParse, "all VALUES must have the same number of terms");
2877   }else{
2878     sqlite3ErrorMsg(pParse, "SELECTs to the left and right of %s"
2879       " do not have the same number of result columns", selectOpName(p->op));
2880   }
2881 }
2882 
2883 /*
2884 ** Code an output subroutine for a coroutine implementation of a
2885 ** SELECT statment.
2886 **
2887 ** The data to be output is contained in pIn->iSdst.  There are
2888 ** pIn->nSdst columns to be output.  pDest is where the output should
2889 ** be sent.
2890 **
2891 ** regReturn is the number of the register holding the subroutine
2892 ** return address.
2893 **
2894 ** If regPrev>0 then it is the first register in a vector that
2895 ** records the previous output.  mem[regPrev] is a flag that is false
2896 ** if there has been no previous output.  If regPrev>0 then code is
2897 ** generated to suppress duplicates.  pKeyInfo is used for comparing
2898 ** keys.
2899 **
2900 ** If the LIMIT found in p->iLimit is reached, jump immediately to
2901 ** iBreak.
2902 */
2903 static int generateOutputSubroutine(
2904   Parse *pParse,          /* Parsing context */
2905   Select *p,              /* The SELECT statement */
2906   SelectDest *pIn,        /* Coroutine supplying data */
2907   SelectDest *pDest,      /* Where to send the data */
2908   int regReturn,          /* The return address register */
2909   int regPrev,            /* Previous result register.  No uniqueness if 0 */
2910   KeyInfo *pKeyInfo,      /* For comparing with previous entry */
2911   int iBreak              /* Jump here if we hit the LIMIT */
2912 ){
2913   Vdbe *v = pParse->pVdbe;
2914   int iContinue;
2915   int addr;
2916 
2917   addr = sqlite3VdbeCurrentAddr(v);
2918   iContinue = sqlite3VdbeMakeLabel(pParse);
2919 
2920   /* Suppress duplicates for UNION, EXCEPT, and INTERSECT
2921   */
2922   if( regPrev ){
2923     int addr1, addr2;
2924     addr1 = sqlite3VdbeAddOp1(v, OP_IfNot, regPrev); VdbeCoverage(v);
2925     addr2 = sqlite3VdbeAddOp4(v, OP_Compare, pIn->iSdst, regPrev+1, pIn->nSdst,
2926                               (char*)sqlite3KeyInfoRef(pKeyInfo), P4_KEYINFO);
2927     sqlite3VdbeAddOp3(v, OP_Jump, addr2+2, iContinue, addr2+2); VdbeCoverage(v);
2928     sqlite3VdbeJumpHere(v, addr1);
2929     sqlite3VdbeAddOp3(v, OP_Copy, pIn->iSdst, regPrev+1, pIn->nSdst-1);
2930     sqlite3VdbeAddOp2(v, OP_Integer, 1, regPrev);
2931   }
2932   if( pParse->db->mallocFailed ) return 0;
2933 
2934   /* Suppress the first OFFSET entries if there is an OFFSET clause
2935   */
2936   codeOffset(v, p->iOffset, iContinue);
2937 
2938   assert( pDest->eDest!=SRT_Exists );
2939   assert( pDest->eDest!=SRT_Table );
2940   switch( pDest->eDest ){
2941     /* Store the result as data using a unique key.
2942     */
2943     case SRT_EphemTab: {
2944       int r1 = sqlite3GetTempReg(pParse);
2945       int r2 = sqlite3GetTempReg(pParse);
2946       sqlite3VdbeAddOp3(v, OP_MakeRecord, pIn->iSdst, pIn->nSdst, r1);
2947       sqlite3VdbeAddOp2(v, OP_NewRowid, pDest->iSDParm, r2);
2948       sqlite3VdbeAddOp3(v, OP_Insert, pDest->iSDParm, r1, r2);
2949       sqlite3VdbeChangeP5(v, OPFLAG_APPEND);
2950       sqlite3ReleaseTempReg(pParse, r2);
2951       sqlite3ReleaseTempReg(pParse, r1);
2952       break;
2953     }
2954 
2955 #ifndef SQLITE_OMIT_SUBQUERY
2956     /* If we are creating a set for an "expr IN (SELECT ...)".
2957     */
2958     case SRT_Set: {
2959       int r1;
2960       testcase( pIn->nSdst>1 );
2961       r1 = sqlite3GetTempReg(pParse);
2962       sqlite3VdbeAddOp4(v, OP_MakeRecord, pIn->iSdst, pIn->nSdst,
2963           r1, pDest->zAffSdst, pIn->nSdst);
2964       sqlite3VdbeAddOp4Int(v, OP_IdxInsert, pDest->iSDParm, r1,
2965                            pIn->iSdst, pIn->nSdst);
2966       sqlite3ReleaseTempReg(pParse, r1);
2967       break;
2968     }
2969 
2970     /* If this is a scalar select that is part of an expression, then
2971     ** store the results in the appropriate memory cell and break out
2972     ** of the scan loop.  Note that the select might return multiple columns
2973     ** if it is the RHS of a row-value IN operator.
2974     */
2975     case SRT_Mem: {
2976       if( pParse->nErr==0 ){
2977         testcase( pIn->nSdst>1 );
2978         sqlite3ExprCodeMove(pParse, pIn->iSdst, pDest->iSDParm, pIn->nSdst);
2979       }
2980       /* The LIMIT clause will jump out of the loop for us */
2981       break;
2982     }
2983 #endif /* #ifndef SQLITE_OMIT_SUBQUERY */
2984 
2985     /* The results are stored in a sequence of registers
2986     ** starting at pDest->iSdst.  Then the co-routine yields.
2987     */
2988     case SRT_Coroutine: {
2989       if( pDest->iSdst==0 ){
2990         pDest->iSdst = sqlite3GetTempRange(pParse, pIn->nSdst);
2991         pDest->nSdst = pIn->nSdst;
2992       }
2993       sqlite3ExprCodeMove(pParse, pIn->iSdst, pDest->iSdst, pIn->nSdst);
2994       sqlite3VdbeAddOp1(v, OP_Yield, pDest->iSDParm);
2995       break;
2996     }
2997 
2998     /* If none of the above, then the result destination must be
2999     ** SRT_Output.  This routine is never called with any other
3000     ** destination other than the ones handled above or SRT_Output.
3001     **
3002     ** For SRT_Output, results are stored in a sequence of registers.
3003     ** Then the OP_ResultRow opcode is used to cause sqlite3_step() to
3004     ** return the next row of result.
3005     */
3006     default: {
3007       assert( pDest->eDest==SRT_Output );
3008       sqlite3VdbeAddOp2(v, OP_ResultRow, pIn->iSdst, pIn->nSdst);
3009       break;
3010     }
3011   }
3012 
3013   /* Jump to the end of the loop if the LIMIT is reached.
3014   */
3015   if( p->iLimit ){
3016     sqlite3VdbeAddOp2(v, OP_DecrJumpZero, p->iLimit, iBreak); VdbeCoverage(v);
3017   }
3018 
3019   /* Generate the subroutine return
3020   */
3021   sqlite3VdbeResolveLabel(v, iContinue);
3022   sqlite3VdbeAddOp1(v, OP_Return, regReturn);
3023 
3024   return addr;
3025 }
3026 
3027 /*
3028 ** Alternative compound select code generator for cases when there
3029 ** is an ORDER BY clause.
3030 **
3031 ** We assume a query of the following form:
3032 **
3033 **      <selectA>  <operator>  <selectB>  ORDER BY <orderbylist>
3034 **
3035 ** <operator> is one of UNION ALL, UNION, EXCEPT, or INTERSECT.  The idea
3036 ** is to code both <selectA> and <selectB> with the ORDER BY clause as
3037 ** co-routines.  Then run the co-routines in parallel and merge the results
3038 ** into the output.  In addition to the two coroutines (called selectA and
3039 ** selectB) there are 7 subroutines:
3040 **
3041 **    outA:    Move the output of the selectA coroutine into the output
3042 **             of the compound query.
3043 **
3044 **    outB:    Move the output of the selectB coroutine into the output
3045 **             of the compound query.  (Only generated for UNION and
3046 **             UNION ALL.  EXCEPT and INSERTSECT never output a row that
3047 **             appears only in B.)
3048 **
3049 **    AltB:    Called when there is data from both coroutines and A<B.
3050 **
3051 **    AeqB:    Called when there is data from both coroutines and A==B.
3052 **
3053 **    AgtB:    Called when there is data from both coroutines and A>B.
3054 **
3055 **    EofA:    Called when data is exhausted from selectA.
3056 **
3057 **    EofB:    Called when data is exhausted from selectB.
3058 **
3059 ** The implementation of the latter five subroutines depend on which
3060 ** <operator> is used:
3061 **
3062 **
3063 **             UNION ALL         UNION            EXCEPT          INTERSECT
3064 **          -------------  -----------------  --------------  -----------------
3065 **   AltB:   outA, nextA      outA, nextA       outA, nextA         nextA
3066 **
3067 **   AeqB:   outA, nextA         nextA             nextA         outA, nextA
3068 **
3069 **   AgtB:   outB, nextB      outB, nextB          nextB            nextB
3070 **
3071 **   EofA:   outB, nextB      outB, nextB          halt             halt
3072 **
3073 **   EofB:   outA, nextA      outA, nextA       outA, nextA         halt
3074 **
3075 ** In the AltB, AeqB, and AgtB subroutines, an EOF on A following nextA
3076 ** causes an immediate jump to EofA and an EOF on B following nextB causes
3077 ** an immediate jump to EofB.  Within EofA and EofB, and EOF on entry or
3078 ** following nextX causes a jump to the end of the select processing.
3079 **
3080 ** Duplicate removal in the UNION, EXCEPT, and INTERSECT cases is handled
3081 ** within the output subroutine.  The regPrev register set holds the previously
3082 ** output value.  A comparison is made against this value and the output
3083 ** is skipped if the next results would be the same as the previous.
3084 **
3085 ** The implementation plan is to implement the two coroutines and seven
3086 ** subroutines first, then put the control logic at the bottom.  Like this:
3087 **
3088 **          goto Init
3089 **     coA: coroutine for left query (A)
3090 **     coB: coroutine for right query (B)
3091 **    outA: output one row of A
3092 **    outB: output one row of B (UNION and UNION ALL only)
3093 **    EofA: ...
3094 **    EofB: ...
3095 **    AltB: ...
3096 **    AeqB: ...
3097 **    AgtB: ...
3098 **    Init: initialize coroutine registers
3099 **          yield coA
3100 **          if eof(A) goto EofA
3101 **          yield coB
3102 **          if eof(B) goto EofB
3103 **    Cmpr: Compare A, B
3104 **          Jump AltB, AeqB, AgtB
3105 **     End: ...
3106 **
3107 ** We call AltB, AeqB, AgtB, EofA, and EofB "subroutines" but they are not
3108 ** actually called using Gosub and they do not Return.  EofA and EofB loop
3109 ** until all data is exhausted then jump to the "end" labe.  AltB, AeqB,
3110 ** and AgtB jump to either L2 or to one of EofA or EofB.
3111 */
3112 #ifndef SQLITE_OMIT_COMPOUND_SELECT
3113 static int multiSelectOrderBy(
3114   Parse *pParse,        /* Parsing context */
3115   Select *p,            /* The right-most of SELECTs to be coded */
3116   SelectDest *pDest     /* What to do with query results */
3117 ){
3118   int i, j;             /* Loop counters */
3119   Select *pPrior;       /* Another SELECT immediately to our left */
3120   Vdbe *v;              /* Generate code to this VDBE */
3121   SelectDest destA;     /* Destination for coroutine A */
3122   SelectDest destB;     /* Destination for coroutine B */
3123   int regAddrA;         /* Address register for select-A coroutine */
3124   int regAddrB;         /* Address register for select-B coroutine */
3125   int addrSelectA;      /* Address of the select-A coroutine */
3126   int addrSelectB;      /* Address of the select-B coroutine */
3127   int regOutA;          /* Address register for the output-A subroutine */
3128   int regOutB;          /* Address register for the output-B subroutine */
3129   int addrOutA;         /* Address of the output-A subroutine */
3130   int addrOutB = 0;     /* Address of the output-B subroutine */
3131   int addrEofA;         /* Address of the select-A-exhausted subroutine */
3132   int addrEofA_noB;     /* Alternate addrEofA if B is uninitialized */
3133   int addrEofB;         /* Address of the select-B-exhausted subroutine */
3134   int addrAltB;         /* Address of the A<B subroutine */
3135   int addrAeqB;         /* Address of the A==B subroutine */
3136   int addrAgtB;         /* Address of the A>B subroutine */
3137   int regLimitA;        /* Limit register for select-A */
3138   int regLimitB;        /* Limit register for select-A */
3139   int regPrev;          /* A range of registers to hold previous output */
3140   int savedLimit;       /* Saved value of p->iLimit */
3141   int savedOffset;      /* Saved value of p->iOffset */
3142   int labelCmpr;        /* Label for the start of the merge algorithm */
3143   int labelEnd;         /* Label for the end of the overall SELECT stmt */
3144   int addr1;            /* Jump instructions that get retargetted */
3145   int op;               /* One of TK_ALL, TK_UNION, TK_EXCEPT, TK_INTERSECT */
3146   KeyInfo *pKeyDup = 0; /* Comparison information for duplicate removal */
3147   KeyInfo *pKeyMerge;   /* Comparison information for merging rows */
3148   sqlite3 *db;          /* Database connection */
3149   ExprList *pOrderBy;   /* The ORDER BY clause */
3150   int nOrderBy;         /* Number of terms in the ORDER BY clause */
3151   int *aPermute;        /* Mapping from ORDER BY terms to result set columns */
3152 
3153   assert( p->pOrderBy!=0 );
3154   assert( pKeyDup==0 ); /* "Managed" code needs this.  Ticket #3382. */
3155   db = pParse->db;
3156   v = pParse->pVdbe;
3157   assert( v!=0 );       /* Already thrown the error if VDBE alloc failed */
3158   labelEnd = sqlite3VdbeMakeLabel(pParse);
3159   labelCmpr = sqlite3VdbeMakeLabel(pParse);
3160 
3161 
3162   /* Patch up the ORDER BY clause
3163   */
3164   op = p->op;
3165   pPrior = p->pPrior;
3166   assert( pPrior->pOrderBy==0 );
3167   pOrderBy = p->pOrderBy;
3168   assert( pOrderBy );
3169   nOrderBy = pOrderBy->nExpr;
3170 
3171   /* For operators other than UNION ALL we have to make sure that
3172   ** the ORDER BY clause covers every term of the result set.  Add
3173   ** terms to the ORDER BY clause as necessary.
3174   */
3175   if( op!=TK_ALL ){
3176     for(i=1; db->mallocFailed==0 && i<=p->pEList->nExpr; i++){
3177       struct ExprList_item *pItem;
3178       for(j=0, pItem=pOrderBy->a; j<nOrderBy; j++, pItem++){
3179         assert( pItem->u.x.iOrderByCol>0 );
3180         if( pItem->u.x.iOrderByCol==i ) break;
3181       }
3182       if( j==nOrderBy ){
3183         Expr *pNew = sqlite3Expr(db, TK_INTEGER, 0);
3184         if( pNew==0 ) return SQLITE_NOMEM_BKPT;
3185         pNew->flags |= EP_IntValue;
3186         pNew->u.iValue = i;
3187         p->pOrderBy = pOrderBy = sqlite3ExprListAppend(pParse, pOrderBy, pNew);
3188         if( pOrderBy ) pOrderBy->a[nOrderBy++].u.x.iOrderByCol = (u16)i;
3189       }
3190     }
3191   }
3192 
3193   /* Compute the comparison permutation and keyinfo that is used with
3194   ** the permutation used to determine if the next
3195   ** row of results comes from selectA or selectB.  Also add explicit
3196   ** collations to the ORDER BY clause terms so that when the subqueries
3197   ** to the right and the left are evaluated, they use the correct
3198   ** collation.
3199   */
3200   aPermute = sqlite3DbMallocRawNN(db, sizeof(int)*(nOrderBy + 1));
3201   if( aPermute ){
3202     struct ExprList_item *pItem;
3203     aPermute[0] = nOrderBy;
3204     for(i=1, pItem=pOrderBy->a; i<=nOrderBy; i++, pItem++){
3205       assert( pItem->u.x.iOrderByCol>0 );
3206       assert( pItem->u.x.iOrderByCol<=p->pEList->nExpr );
3207       aPermute[i] = pItem->u.x.iOrderByCol - 1;
3208     }
3209     pKeyMerge = multiSelectOrderByKeyInfo(pParse, p, 1);
3210   }else{
3211     pKeyMerge = 0;
3212   }
3213 
3214   /* Reattach the ORDER BY clause to the query.
3215   */
3216   p->pOrderBy = pOrderBy;
3217   pPrior->pOrderBy = sqlite3ExprListDup(pParse->db, pOrderBy, 0);
3218 
3219   /* Allocate a range of temporary registers and the KeyInfo needed
3220   ** for the logic that removes duplicate result rows when the
3221   ** operator is UNION, EXCEPT, or INTERSECT (but not UNION ALL).
3222   */
3223   if( op==TK_ALL ){
3224     regPrev = 0;
3225   }else{
3226     int nExpr = p->pEList->nExpr;
3227     assert( nOrderBy>=nExpr || db->mallocFailed );
3228     regPrev = pParse->nMem+1;
3229     pParse->nMem += nExpr+1;
3230     sqlite3VdbeAddOp2(v, OP_Integer, 0, regPrev);
3231     pKeyDup = sqlite3KeyInfoAlloc(db, nExpr, 1);
3232     if( pKeyDup ){
3233       assert( sqlite3KeyInfoIsWriteable(pKeyDup) );
3234       for(i=0; i<nExpr; i++){
3235         pKeyDup->aColl[i] = multiSelectCollSeq(pParse, p, i);
3236         pKeyDup->aSortFlags[i] = 0;
3237       }
3238     }
3239   }
3240 
3241   /* Separate the left and the right query from one another
3242   */
3243   p->pPrior = 0;
3244   pPrior->pNext = 0;
3245   sqlite3ResolveOrderGroupBy(pParse, p, p->pOrderBy, "ORDER");
3246   if( pPrior->pPrior==0 ){
3247     sqlite3ResolveOrderGroupBy(pParse, pPrior, pPrior->pOrderBy, "ORDER");
3248   }
3249 
3250   /* Compute the limit registers */
3251   computeLimitRegisters(pParse, p, labelEnd);
3252   if( p->iLimit && op==TK_ALL ){
3253     regLimitA = ++pParse->nMem;
3254     regLimitB = ++pParse->nMem;
3255     sqlite3VdbeAddOp2(v, OP_Copy, p->iOffset ? p->iOffset+1 : p->iLimit,
3256                                   regLimitA);
3257     sqlite3VdbeAddOp2(v, OP_Copy, regLimitA, regLimitB);
3258   }else{
3259     regLimitA = regLimitB = 0;
3260   }
3261   sqlite3ExprDelete(db, p->pLimit);
3262   p->pLimit = 0;
3263 
3264   regAddrA = ++pParse->nMem;
3265   regAddrB = ++pParse->nMem;
3266   regOutA = ++pParse->nMem;
3267   regOutB = ++pParse->nMem;
3268   sqlite3SelectDestInit(&destA, SRT_Coroutine, regAddrA);
3269   sqlite3SelectDestInit(&destB, SRT_Coroutine, regAddrB);
3270 
3271   ExplainQueryPlan((pParse, 1, "MERGE (%s)", selectOpName(p->op)));
3272 
3273   /* Generate a coroutine to evaluate the SELECT statement to the
3274   ** left of the compound operator - the "A" select.
3275   */
3276   addrSelectA = sqlite3VdbeCurrentAddr(v) + 1;
3277   addr1 = sqlite3VdbeAddOp3(v, OP_InitCoroutine, regAddrA, 0, addrSelectA);
3278   VdbeComment((v, "left SELECT"));
3279   pPrior->iLimit = regLimitA;
3280   ExplainQueryPlan((pParse, 1, "LEFT"));
3281   sqlite3Select(pParse, pPrior, &destA);
3282   sqlite3VdbeEndCoroutine(v, regAddrA);
3283   sqlite3VdbeJumpHere(v, addr1);
3284 
3285   /* Generate a coroutine to evaluate the SELECT statement on
3286   ** the right - the "B" select
3287   */
3288   addrSelectB = sqlite3VdbeCurrentAddr(v) + 1;
3289   addr1 = sqlite3VdbeAddOp3(v, OP_InitCoroutine, regAddrB, 0, addrSelectB);
3290   VdbeComment((v, "right SELECT"));
3291   savedLimit = p->iLimit;
3292   savedOffset = p->iOffset;
3293   p->iLimit = regLimitB;
3294   p->iOffset = 0;
3295   ExplainQueryPlan((pParse, 1, "RIGHT"));
3296   sqlite3Select(pParse, p, &destB);
3297   p->iLimit = savedLimit;
3298   p->iOffset = savedOffset;
3299   sqlite3VdbeEndCoroutine(v, regAddrB);
3300 
3301   /* Generate a subroutine that outputs the current row of the A
3302   ** select as the next output row of the compound select.
3303   */
3304   VdbeNoopComment((v, "Output routine for A"));
3305   addrOutA = generateOutputSubroutine(pParse,
3306                  p, &destA, pDest, regOutA,
3307                  regPrev, pKeyDup, labelEnd);
3308 
3309   /* Generate a subroutine that outputs the current row of the B
3310   ** select as the next output row of the compound select.
3311   */
3312   if( op==TK_ALL || op==TK_UNION ){
3313     VdbeNoopComment((v, "Output routine for B"));
3314     addrOutB = generateOutputSubroutine(pParse,
3315                  p, &destB, pDest, regOutB,
3316                  regPrev, pKeyDup, labelEnd);
3317   }
3318   sqlite3KeyInfoUnref(pKeyDup);
3319 
3320   /* Generate a subroutine to run when the results from select A
3321   ** are exhausted and only data in select B remains.
3322   */
3323   if( op==TK_EXCEPT || op==TK_INTERSECT ){
3324     addrEofA_noB = addrEofA = labelEnd;
3325   }else{
3326     VdbeNoopComment((v, "eof-A subroutine"));
3327     addrEofA = sqlite3VdbeAddOp2(v, OP_Gosub, regOutB, addrOutB);
3328     addrEofA_noB = sqlite3VdbeAddOp2(v, OP_Yield, regAddrB, labelEnd);
3329                                      VdbeCoverage(v);
3330     sqlite3VdbeGoto(v, addrEofA);
3331     p->nSelectRow = sqlite3LogEstAdd(p->nSelectRow, pPrior->nSelectRow);
3332   }
3333 
3334   /* Generate a subroutine to run when the results from select B
3335   ** are exhausted and only data in select A remains.
3336   */
3337   if( op==TK_INTERSECT ){
3338     addrEofB = addrEofA;
3339     if( p->nSelectRow > pPrior->nSelectRow ) p->nSelectRow = pPrior->nSelectRow;
3340   }else{
3341     VdbeNoopComment((v, "eof-B subroutine"));
3342     addrEofB = sqlite3VdbeAddOp2(v, OP_Gosub, regOutA, addrOutA);
3343     sqlite3VdbeAddOp2(v, OP_Yield, regAddrA, labelEnd); VdbeCoverage(v);
3344     sqlite3VdbeGoto(v, addrEofB);
3345   }
3346 
3347   /* Generate code to handle the case of A<B
3348   */
3349   VdbeNoopComment((v, "A-lt-B subroutine"));
3350   addrAltB = sqlite3VdbeAddOp2(v, OP_Gosub, regOutA, addrOutA);
3351   sqlite3VdbeAddOp2(v, OP_Yield, regAddrA, addrEofA); VdbeCoverage(v);
3352   sqlite3VdbeGoto(v, labelCmpr);
3353 
3354   /* Generate code to handle the case of A==B
3355   */
3356   if( op==TK_ALL ){
3357     addrAeqB = addrAltB;
3358   }else if( op==TK_INTERSECT ){
3359     addrAeqB = addrAltB;
3360     addrAltB++;
3361   }else{
3362     VdbeNoopComment((v, "A-eq-B subroutine"));
3363     addrAeqB =
3364     sqlite3VdbeAddOp2(v, OP_Yield, regAddrA, addrEofA); VdbeCoverage(v);
3365     sqlite3VdbeGoto(v, labelCmpr);
3366   }
3367 
3368   /* Generate code to handle the case of A>B
3369   */
3370   VdbeNoopComment((v, "A-gt-B subroutine"));
3371   addrAgtB = sqlite3VdbeCurrentAddr(v);
3372   if( op==TK_ALL || op==TK_UNION ){
3373     sqlite3VdbeAddOp2(v, OP_Gosub, regOutB, addrOutB);
3374   }
3375   sqlite3VdbeAddOp2(v, OP_Yield, regAddrB, addrEofB); VdbeCoverage(v);
3376   sqlite3VdbeGoto(v, labelCmpr);
3377 
3378   /* This code runs once to initialize everything.
3379   */
3380   sqlite3VdbeJumpHere(v, addr1);
3381   sqlite3VdbeAddOp2(v, OP_Yield, regAddrA, addrEofA_noB); VdbeCoverage(v);
3382   sqlite3VdbeAddOp2(v, OP_Yield, regAddrB, addrEofB); VdbeCoverage(v);
3383 
3384   /* Implement the main merge loop
3385   */
3386   sqlite3VdbeResolveLabel(v, labelCmpr);
3387   sqlite3VdbeAddOp4(v, OP_Permutation, 0, 0, 0, (char*)aPermute, P4_INTARRAY);
3388   sqlite3VdbeAddOp4(v, OP_Compare, destA.iSdst, destB.iSdst, nOrderBy,
3389                          (char*)pKeyMerge, P4_KEYINFO);
3390   sqlite3VdbeChangeP5(v, OPFLAG_PERMUTE);
3391   sqlite3VdbeAddOp3(v, OP_Jump, addrAltB, addrAeqB, addrAgtB); VdbeCoverage(v);
3392 
3393   /* Jump to the this point in order to terminate the query.
3394   */
3395   sqlite3VdbeResolveLabel(v, labelEnd);
3396 
3397   /* Reassembly the compound query so that it will be freed correctly
3398   ** by the calling function */
3399   if( p->pPrior ){
3400     sqlite3SelectDelete(db, p->pPrior);
3401   }
3402   p->pPrior = pPrior;
3403   pPrior->pNext = p;
3404 
3405   /*** TBD:  Insert subroutine calls to close cursors on incomplete
3406   **** subqueries ****/
3407   ExplainQueryPlanPop(pParse);
3408   return pParse->nErr!=0;
3409 }
3410 #endif
3411 
3412 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
3413 
3414 /* An instance of the SubstContext object describes an substitution edit
3415 ** to be performed on a parse tree.
3416 **
3417 ** All references to columns in table iTable are to be replaced by corresponding
3418 ** expressions in pEList.
3419 */
3420 typedef struct SubstContext {
3421   Parse *pParse;            /* The parsing context */
3422   int iTable;               /* Replace references to this table */
3423   int iNewTable;            /* New table number */
3424   int isLeftJoin;           /* Add TK_IF_NULL_ROW opcodes on each replacement */
3425   ExprList *pEList;         /* Replacement expressions */
3426 } SubstContext;
3427 
3428 /* Forward Declarations */
3429 static void substExprList(SubstContext*, ExprList*);
3430 static void substSelect(SubstContext*, Select*, int);
3431 
3432 /*
3433 ** Scan through the expression pExpr.  Replace every reference to
3434 ** a column in table number iTable with a copy of the iColumn-th
3435 ** entry in pEList.  (But leave references to the ROWID column
3436 ** unchanged.)
3437 **
3438 ** This routine is part of the flattening procedure.  A subquery
3439 ** whose result set is defined by pEList appears as entry in the
3440 ** FROM clause of a SELECT such that the VDBE cursor assigned to that
3441 ** FORM clause entry is iTable.  This routine makes the necessary
3442 ** changes to pExpr so that it refers directly to the source table
3443 ** of the subquery rather the result set of the subquery.
3444 */
3445 static Expr *substExpr(
3446   SubstContext *pSubst,  /* Description of the substitution */
3447   Expr *pExpr            /* Expr in which substitution occurs */
3448 ){
3449   if( pExpr==0 ) return 0;
3450   if( ExprHasProperty(pExpr, EP_FromJoin)
3451    && pExpr->iRightJoinTable==pSubst->iTable
3452   ){
3453     pExpr->iRightJoinTable = pSubst->iNewTable;
3454   }
3455   if( pExpr->op==TK_COLUMN && pExpr->iTable==pSubst->iTable ){
3456     if( pExpr->iColumn<0 ){
3457       pExpr->op = TK_NULL;
3458     }else{
3459       Expr *pNew;
3460       Expr *pCopy = pSubst->pEList->a[pExpr->iColumn].pExpr;
3461       Expr ifNullRow;
3462       assert( pSubst->pEList!=0 && pExpr->iColumn<pSubst->pEList->nExpr );
3463       assert( pExpr->pRight==0 );
3464       if( sqlite3ExprIsVector(pCopy) ){
3465         sqlite3VectorErrorMsg(pSubst->pParse, pCopy);
3466       }else{
3467         sqlite3 *db = pSubst->pParse->db;
3468         if( pSubst->isLeftJoin && pCopy->op!=TK_COLUMN ){
3469           memset(&ifNullRow, 0, sizeof(ifNullRow));
3470           ifNullRow.op = TK_IF_NULL_ROW;
3471           ifNullRow.pLeft = pCopy;
3472           ifNullRow.iTable = pSubst->iNewTable;
3473           pCopy = &ifNullRow;
3474         }
3475         testcase( ExprHasProperty(pCopy, EP_Subquery) );
3476         pNew = sqlite3ExprDup(db, pCopy, 0);
3477         if( pNew && pSubst->isLeftJoin ){
3478           ExprSetProperty(pNew, EP_CanBeNull);
3479         }
3480         if( pNew && ExprHasProperty(pExpr,EP_FromJoin) ){
3481           pNew->iRightJoinTable = pExpr->iRightJoinTable;
3482           ExprSetProperty(pNew, EP_FromJoin);
3483         }
3484         sqlite3ExprDelete(db, pExpr);
3485         pExpr = pNew;
3486 
3487         /* Ensure that the expression now has an implicit collation sequence,
3488         ** just as it did when it was a column of a view or sub-query. */
3489         if( pExpr ){
3490           if( pExpr->op!=TK_COLUMN && pExpr->op!=TK_COLLATE ){
3491             CollSeq *pColl = sqlite3ExprCollSeq(pSubst->pParse, pExpr);
3492             pExpr = sqlite3ExprAddCollateString(pSubst->pParse, pExpr,
3493                 (pColl ? pColl->zName : "BINARY")
3494             );
3495           }
3496           ExprClearProperty(pExpr, EP_Collate);
3497         }
3498       }
3499     }
3500   }else{
3501     if( pExpr->op==TK_IF_NULL_ROW && pExpr->iTable==pSubst->iTable ){
3502       pExpr->iTable = pSubst->iNewTable;
3503     }
3504     pExpr->pLeft = substExpr(pSubst, pExpr->pLeft);
3505     pExpr->pRight = substExpr(pSubst, pExpr->pRight);
3506     if( ExprHasProperty(pExpr, EP_xIsSelect) ){
3507       substSelect(pSubst, pExpr->x.pSelect, 1);
3508     }else{
3509       substExprList(pSubst, pExpr->x.pList);
3510     }
3511 #ifndef SQLITE_OMIT_WINDOWFUNC
3512     if( ExprHasProperty(pExpr, EP_WinFunc) ){
3513       Window *pWin = pExpr->y.pWin;
3514       pWin->pFilter = substExpr(pSubst, pWin->pFilter);
3515       substExprList(pSubst, pWin->pPartition);
3516       substExprList(pSubst, pWin->pOrderBy);
3517     }
3518 #endif
3519   }
3520   return pExpr;
3521 }
3522 static void substExprList(
3523   SubstContext *pSubst, /* Description of the substitution */
3524   ExprList *pList       /* List to scan and in which to make substitutes */
3525 ){
3526   int i;
3527   if( pList==0 ) return;
3528   for(i=0; i<pList->nExpr; i++){
3529     pList->a[i].pExpr = substExpr(pSubst, pList->a[i].pExpr);
3530   }
3531 }
3532 static void substSelect(
3533   SubstContext *pSubst, /* Description of the substitution */
3534   Select *p,            /* SELECT statement in which to make substitutions */
3535   int doPrior           /* Do substitutes on p->pPrior too */
3536 ){
3537   SrcList *pSrc;
3538   struct SrcList_item *pItem;
3539   int i;
3540   if( !p ) return;
3541   do{
3542     substExprList(pSubst, p->pEList);
3543     substExprList(pSubst, p->pGroupBy);
3544     substExprList(pSubst, p->pOrderBy);
3545     p->pHaving = substExpr(pSubst, p->pHaving);
3546     p->pWhere = substExpr(pSubst, p->pWhere);
3547     pSrc = p->pSrc;
3548     assert( pSrc!=0 );
3549     for(i=pSrc->nSrc, pItem=pSrc->a; i>0; i--, pItem++){
3550       substSelect(pSubst, pItem->pSelect, 1);
3551       if( pItem->fg.isTabFunc ){
3552         substExprList(pSubst, pItem->u1.pFuncArg);
3553       }
3554     }
3555   }while( doPrior && (p = p->pPrior)!=0 );
3556 }
3557 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
3558 
3559 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
3560 /*
3561 ** This routine attempts to flatten subqueries as a performance optimization.
3562 ** This routine returns 1 if it makes changes and 0 if no flattening occurs.
3563 **
3564 ** To understand the concept of flattening, consider the following
3565 ** query:
3566 **
3567 **     SELECT a FROM (SELECT x+y AS a FROM t1 WHERE z<100) WHERE a>5
3568 **
3569 ** The default way of implementing this query is to execute the
3570 ** subquery first and store the results in a temporary table, then
3571 ** run the outer query on that temporary table.  This requires two
3572 ** passes over the data.  Furthermore, because the temporary table
3573 ** has no indices, the WHERE clause on the outer query cannot be
3574 ** optimized.
3575 **
3576 ** This routine attempts to rewrite queries such as the above into
3577 ** a single flat select, like this:
3578 **
3579 **     SELECT x+y AS a FROM t1 WHERE z<100 AND a>5
3580 **
3581 ** The code generated for this simplification gives the same result
3582 ** but only has to scan the data once.  And because indices might
3583 ** exist on the table t1, a complete scan of the data might be
3584 ** avoided.
3585 **
3586 ** Flattening is subject to the following constraints:
3587 **
3588 **  (**)  We no longer attempt to flatten aggregate subqueries. Was:
3589 **        The subquery and the outer query cannot both be aggregates.
3590 **
3591 **  (**)  We no longer attempt to flatten aggregate subqueries. Was:
3592 **        (2) If the subquery is an aggregate then
3593 **        (2a) the outer query must not be a join and
3594 **        (2b) the outer query must not use subqueries
3595 **             other than the one FROM-clause subquery that is a candidate
3596 **             for flattening.  (This is due to ticket [2f7170d73bf9abf80]
3597 **             from 2015-02-09.)
3598 **
3599 **   (3)  If the subquery is the right operand of a LEFT JOIN then
3600 **        (3a) the subquery may not be a join and
3601 **        (3b) the FROM clause of the subquery may not contain a virtual
3602 **             table and
3603 **        (3c) the outer query may not be an aggregate.
3604 **        (3d) the outer query may not be DISTINCT.
3605 **
3606 **   (4)  The subquery can not be DISTINCT.
3607 **
3608 **  (**)  At one point restrictions (4) and (5) defined a subset of DISTINCT
3609 **        sub-queries that were excluded from this optimization. Restriction
3610 **        (4) has since been expanded to exclude all DISTINCT subqueries.
3611 **
3612 **  (**)  We no longer attempt to flatten aggregate subqueries.  Was:
3613 **        If the subquery is aggregate, the outer query may not be DISTINCT.
3614 **
3615 **   (7)  The subquery must have a FROM clause.  TODO:  For subqueries without
3616 **        A FROM clause, consider adding a FROM clause with the special
3617 **        table sqlite_once that consists of a single row containing a
3618 **        single NULL.
3619 **
3620 **   (8)  If the subquery uses LIMIT then the outer query may not be a join.
3621 **
3622 **   (9)  If the subquery uses LIMIT then the outer query may not be aggregate.
3623 **
3624 **  (**)  Restriction (10) was removed from the code on 2005-02-05 but we
3625 **        accidently carried the comment forward until 2014-09-15.  Original
3626 **        constraint: "If the subquery is aggregate then the outer query
3627 **        may not use LIMIT."
3628 **
3629 **  (11)  The subquery and the outer query may not both have ORDER BY clauses.
3630 **
3631 **  (**)  Not implemented.  Subsumed into restriction (3).  Was previously
3632 **        a separate restriction deriving from ticket #350.
3633 **
3634 **  (13)  The subquery and outer query may not both use LIMIT.
3635 **
3636 **  (14)  The subquery may not use OFFSET.
3637 **
3638 **  (15)  If the outer query is part of a compound select, then the
3639 **        subquery may not use LIMIT.
3640 **        (See ticket #2339 and ticket [02a8e81d44]).
3641 **
3642 **  (16)  If the outer query is aggregate, then the subquery may not
3643 **        use ORDER BY.  (Ticket #2942)  This used to not matter
3644 **        until we introduced the group_concat() function.
3645 **
3646 **  (17)  If the subquery is a compound select, then
3647 **        (17a) all compound operators must be a UNION ALL, and
3648 **        (17b) no terms within the subquery compound may be aggregate
3649 **              or DISTINCT, and
3650 **        (17c) every term within the subquery compound must have a FROM clause
3651 **        (17d) the outer query may not be
3652 **              (17d1) aggregate, or
3653 **              (17d2) DISTINCT, or
3654 **              (17d3) a join.
3655 **
3656 **        The parent and sub-query may contain WHERE clauses. Subject to
3657 **        rules (11), (13) and (14), they may also contain ORDER BY,
3658 **        LIMIT and OFFSET clauses.  The subquery cannot use any compound
3659 **        operator other than UNION ALL because all the other compound
3660 **        operators have an implied DISTINCT which is disallowed by
3661 **        restriction (4).
3662 **
3663 **        Also, each component of the sub-query must return the same number
3664 **        of result columns. This is actually a requirement for any compound
3665 **        SELECT statement, but all the code here does is make sure that no
3666 **        such (illegal) sub-query is flattened. The caller will detect the
3667 **        syntax error and return a detailed message.
3668 **
3669 **  (18)  If the sub-query is a compound select, then all terms of the
3670 **        ORDER BY clause of the parent must be simple references to
3671 **        columns of the sub-query.
3672 **
3673 **  (19)  If the subquery uses LIMIT then the outer query may not
3674 **        have a WHERE clause.
3675 **
3676 **  (20)  If the sub-query is a compound select, then it must not use
3677 **        an ORDER BY clause.  Ticket #3773.  We could relax this constraint
3678 **        somewhat by saying that the terms of the ORDER BY clause must
3679 **        appear as unmodified result columns in the outer query.  But we
3680 **        have other optimizations in mind to deal with that case.
3681 **
3682 **  (21)  If the subquery uses LIMIT then the outer query may not be
3683 **        DISTINCT.  (See ticket [752e1646fc]).
3684 **
3685 **  (22)  The subquery may not be a recursive CTE.
3686 **
3687 **  (**)  Subsumed into restriction (17d3).  Was: If the outer query is
3688 **        a recursive CTE, then the sub-query may not be a compound query.
3689 **        This restriction is because transforming the
3690 **        parent to a compound query confuses the code that handles
3691 **        recursive queries in multiSelect().
3692 **
3693 **  (**)  We no longer attempt to flatten aggregate subqueries.  Was:
3694 **        The subquery may not be an aggregate that uses the built-in min() or
3695 **        or max() functions.  (Without this restriction, a query like:
3696 **        "SELECT x FROM (SELECT max(y), x FROM t1)" would not necessarily
3697 **        return the value X for which Y was maximal.)
3698 **
3699 **  (25)  If either the subquery or the parent query contains a window
3700 **        function in the select list or ORDER BY clause, flattening
3701 **        is not attempted.
3702 **
3703 **
3704 ** In this routine, the "p" parameter is a pointer to the outer query.
3705 ** The subquery is p->pSrc->a[iFrom].  isAgg is true if the outer query
3706 ** uses aggregates.
3707 **
3708 ** If flattening is not attempted, this routine is a no-op and returns 0.
3709 ** If flattening is attempted this routine returns 1.
3710 **
3711 ** All of the expression analysis must occur on both the outer query and
3712 ** the subquery before this routine runs.
3713 */
3714 static int flattenSubquery(
3715   Parse *pParse,       /* Parsing context */
3716   Select *p,           /* The parent or outer SELECT statement */
3717   int iFrom,           /* Index in p->pSrc->a[] of the inner subquery */
3718   int isAgg            /* True if outer SELECT uses aggregate functions */
3719 ){
3720   const char *zSavedAuthContext = pParse->zAuthContext;
3721   Select *pParent;    /* Current UNION ALL term of the other query */
3722   Select *pSub;       /* The inner query or "subquery" */
3723   Select *pSub1;      /* Pointer to the rightmost select in sub-query */
3724   SrcList *pSrc;      /* The FROM clause of the outer query */
3725   SrcList *pSubSrc;   /* The FROM clause of the subquery */
3726   int iParent;        /* VDBE cursor number of the pSub result set temp table */
3727   int iNewParent = -1;/* Replacement table for iParent */
3728   int isLeftJoin = 0; /* True if pSub is the right side of a LEFT JOIN */
3729   int i;              /* Loop counter */
3730   Expr *pWhere;                    /* The WHERE clause */
3731   struct SrcList_item *pSubitem;   /* The subquery */
3732   sqlite3 *db = pParse->db;
3733 
3734   /* Check to see if flattening is permitted.  Return 0 if not.
3735   */
3736   assert( p!=0 );
3737   assert( p->pPrior==0 );
3738   if( OptimizationDisabled(db, SQLITE_QueryFlattener) ) return 0;
3739   pSrc = p->pSrc;
3740   assert( pSrc && iFrom>=0 && iFrom<pSrc->nSrc );
3741   pSubitem = &pSrc->a[iFrom];
3742   iParent = pSubitem->iCursor;
3743   pSub = pSubitem->pSelect;
3744   assert( pSub!=0 );
3745 
3746 #ifndef SQLITE_OMIT_WINDOWFUNC
3747   if( p->pWin || pSub->pWin ) return 0;                  /* Restriction (25) */
3748 #endif
3749 
3750   pSubSrc = pSub->pSrc;
3751   assert( pSubSrc );
3752   /* Prior to version 3.1.2, when LIMIT and OFFSET had to be simple constants,
3753   ** not arbitrary expressions, we allowed some combining of LIMIT and OFFSET
3754   ** because they could be computed at compile-time.  But when LIMIT and OFFSET
3755   ** became arbitrary expressions, we were forced to add restrictions (13)
3756   ** and (14). */
3757   if( pSub->pLimit && p->pLimit ) return 0;              /* Restriction (13) */
3758   if( pSub->pLimit && pSub->pLimit->pRight ) return 0;   /* Restriction (14) */
3759   if( (p->selFlags & SF_Compound)!=0 && pSub->pLimit ){
3760     return 0;                                            /* Restriction (15) */
3761   }
3762   if( pSubSrc->nSrc==0 ) return 0;                       /* Restriction (7)  */
3763   if( pSub->selFlags & SF_Distinct ) return 0;           /* Restriction (4)  */
3764   if( pSub->pLimit && (pSrc->nSrc>1 || isAgg) ){
3765      return 0;         /* Restrictions (8)(9) */
3766   }
3767   if( p->pOrderBy && pSub->pOrderBy ){
3768      return 0;                                           /* Restriction (11) */
3769   }
3770   if( isAgg && pSub->pOrderBy ) return 0;                /* Restriction (16) */
3771   if( pSub->pLimit && p->pWhere ) return 0;              /* Restriction (19) */
3772   if( pSub->pLimit && (p->selFlags & SF_Distinct)!=0 ){
3773      return 0;         /* Restriction (21) */
3774   }
3775   if( pSub->selFlags & (SF_Recursive) ){
3776     return 0; /* Restrictions (22) */
3777   }
3778 
3779   /*
3780   ** If the subquery is the right operand of a LEFT JOIN, then the
3781   ** subquery may not be a join itself (3a). Example of why this is not
3782   ** allowed:
3783   **
3784   **         t1 LEFT OUTER JOIN (t2 JOIN t3)
3785   **
3786   ** If we flatten the above, we would get
3787   **
3788   **         (t1 LEFT OUTER JOIN t2) JOIN t3
3789   **
3790   ** which is not at all the same thing.
3791   **
3792   ** If the subquery is the right operand of a LEFT JOIN, then the outer
3793   ** query cannot be an aggregate. (3c)  This is an artifact of the way
3794   ** aggregates are processed - there is no mechanism to determine if
3795   ** the LEFT JOIN table should be all-NULL.
3796   **
3797   ** See also tickets #306, #350, and #3300.
3798   */
3799   if( (pSubitem->fg.jointype & JT_OUTER)!=0 ){
3800     isLeftJoin = 1;
3801     if( pSubSrc->nSrc>1                   /* (3a) */
3802      || isAgg                             /* (3b) */
3803      || IsVirtual(pSubSrc->a[0].pTab)     /* (3c) */
3804      || (p->selFlags & SF_Distinct)!=0    /* (3d) */
3805     ){
3806       return 0;
3807     }
3808   }
3809 #ifdef SQLITE_EXTRA_IFNULLROW
3810   else if( iFrom>0 && !isAgg ){
3811     /* Setting isLeftJoin to -1 causes OP_IfNullRow opcodes to be generated for
3812     ** every reference to any result column from subquery in a join, even
3813     ** though they are not necessary.  This will stress-test the OP_IfNullRow
3814     ** opcode. */
3815     isLeftJoin = -1;
3816   }
3817 #endif
3818 
3819   /* Restriction (17): If the sub-query is a compound SELECT, then it must
3820   ** use only the UNION ALL operator. And none of the simple select queries
3821   ** that make up the compound SELECT are allowed to be aggregate or distinct
3822   ** queries.
3823   */
3824   if( pSub->pPrior ){
3825     if( pSub->pOrderBy ){
3826       return 0;  /* Restriction (20) */
3827     }
3828     if( isAgg || (p->selFlags & SF_Distinct)!=0 || pSrc->nSrc!=1 ){
3829       return 0; /* (17d1), (17d2), or (17d3) */
3830     }
3831     for(pSub1=pSub; pSub1; pSub1=pSub1->pPrior){
3832       testcase( (pSub1->selFlags & (SF_Distinct|SF_Aggregate))==SF_Distinct );
3833       testcase( (pSub1->selFlags & (SF_Distinct|SF_Aggregate))==SF_Aggregate );
3834       assert( pSub->pSrc!=0 );
3835       assert( pSub->pEList->nExpr==pSub1->pEList->nExpr );
3836       if( (pSub1->selFlags & (SF_Distinct|SF_Aggregate))!=0    /* (17b) */
3837        || (pSub1->pPrior && pSub1->op!=TK_ALL)                 /* (17a) */
3838        || pSub1->pSrc->nSrc<1                                  /* (17c) */
3839       ){
3840         return 0;
3841       }
3842       testcase( pSub1->pSrc->nSrc>1 );
3843     }
3844 
3845     /* Restriction (18). */
3846     if( p->pOrderBy ){
3847       int ii;
3848       for(ii=0; ii<p->pOrderBy->nExpr; ii++){
3849         if( p->pOrderBy->a[ii].u.x.iOrderByCol==0 ) return 0;
3850       }
3851     }
3852   }
3853 
3854   /* Ex-restriction (23):
3855   ** The only way that the recursive part of a CTE can contain a compound
3856   ** subquery is for the subquery to be one term of a join.  But if the
3857   ** subquery is a join, then the flattening has already been stopped by
3858   ** restriction (17d3)
3859   */
3860   assert( (p->selFlags & SF_Recursive)==0 || pSub->pPrior==0 );
3861 
3862   /***** If we reach this point, flattening is permitted. *****/
3863   SELECTTRACE(1,pParse,p,("flatten %u.%p from term %d\n",
3864                    pSub->selId, pSub, iFrom));
3865 
3866   /* Authorize the subquery */
3867   pParse->zAuthContext = pSubitem->zName;
3868   TESTONLY(i =) sqlite3AuthCheck(pParse, SQLITE_SELECT, 0, 0, 0);
3869   testcase( i==SQLITE_DENY );
3870   pParse->zAuthContext = zSavedAuthContext;
3871 
3872   /* If the sub-query is a compound SELECT statement, then (by restrictions
3873   ** 17 and 18 above) it must be a UNION ALL and the parent query must
3874   ** be of the form:
3875   **
3876   **     SELECT <expr-list> FROM (<sub-query>) <where-clause>
3877   **
3878   ** followed by any ORDER BY, LIMIT and/or OFFSET clauses. This block
3879   ** creates N-1 copies of the parent query without any ORDER BY, LIMIT or
3880   ** OFFSET clauses and joins them to the left-hand-side of the original
3881   ** using UNION ALL operators. In this case N is the number of simple
3882   ** select statements in the compound sub-query.
3883   **
3884   ** Example:
3885   **
3886   **     SELECT a+1 FROM (
3887   **        SELECT x FROM tab
3888   **        UNION ALL
3889   **        SELECT y FROM tab
3890   **        UNION ALL
3891   **        SELECT abs(z*2) FROM tab2
3892   **     ) WHERE a!=5 ORDER BY 1
3893   **
3894   ** Transformed into:
3895   **
3896   **     SELECT x+1 FROM tab WHERE x+1!=5
3897   **     UNION ALL
3898   **     SELECT y+1 FROM tab WHERE y+1!=5
3899   **     UNION ALL
3900   **     SELECT abs(z*2)+1 FROM tab2 WHERE abs(z*2)+1!=5
3901   **     ORDER BY 1
3902   **
3903   ** We call this the "compound-subquery flattening".
3904   */
3905   for(pSub=pSub->pPrior; pSub; pSub=pSub->pPrior){
3906     Select *pNew;
3907     ExprList *pOrderBy = p->pOrderBy;
3908     Expr *pLimit = p->pLimit;
3909     Select *pPrior = p->pPrior;
3910     p->pOrderBy = 0;
3911     p->pSrc = 0;
3912     p->pPrior = 0;
3913     p->pLimit = 0;
3914     pNew = sqlite3SelectDup(db, p, 0);
3915     p->pLimit = pLimit;
3916     p->pOrderBy = pOrderBy;
3917     p->pSrc = pSrc;
3918     p->op = TK_ALL;
3919     if( pNew==0 ){
3920       p->pPrior = pPrior;
3921     }else{
3922       pNew->pPrior = pPrior;
3923       if( pPrior ) pPrior->pNext = pNew;
3924       pNew->pNext = p;
3925       p->pPrior = pNew;
3926       SELECTTRACE(2,pParse,p,("compound-subquery flattener"
3927                               " creates %u as peer\n",pNew->selId));
3928     }
3929     if( db->mallocFailed ) return 1;
3930   }
3931 
3932   /* Begin flattening the iFrom-th entry of the FROM clause
3933   ** in the outer query.
3934   */
3935   pSub = pSub1 = pSubitem->pSelect;
3936 
3937   /* Delete the transient table structure associated with the
3938   ** subquery
3939   */
3940   sqlite3DbFree(db, pSubitem->zDatabase);
3941   sqlite3DbFree(db, pSubitem->zName);
3942   sqlite3DbFree(db, pSubitem->zAlias);
3943   pSubitem->zDatabase = 0;
3944   pSubitem->zName = 0;
3945   pSubitem->zAlias = 0;
3946   pSubitem->pSelect = 0;
3947 
3948   /* Defer deleting the Table object associated with the
3949   ** subquery until code generation is
3950   ** complete, since there may still exist Expr.pTab entries that
3951   ** refer to the subquery even after flattening.  Ticket #3346.
3952   **
3953   ** pSubitem->pTab is always non-NULL by test restrictions and tests above.
3954   */
3955   if( ALWAYS(pSubitem->pTab!=0) ){
3956     Table *pTabToDel = pSubitem->pTab;
3957     if( pTabToDel->nTabRef==1 ){
3958       Parse *pToplevel = sqlite3ParseToplevel(pParse);
3959       pTabToDel->pNextZombie = pToplevel->pZombieTab;
3960       pToplevel->pZombieTab = pTabToDel;
3961     }else{
3962       pTabToDel->nTabRef--;
3963     }
3964     pSubitem->pTab = 0;
3965   }
3966 
3967   /* The following loop runs once for each term in a compound-subquery
3968   ** flattening (as described above).  If we are doing a different kind
3969   ** of flattening - a flattening other than a compound-subquery flattening -
3970   ** then this loop only runs once.
3971   **
3972   ** This loop moves all of the FROM elements of the subquery into the
3973   ** the FROM clause of the outer query.  Before doing this, remember
3974   ** the cursor number for the original outer query FROM element in
3975   ** iParent.  The iParent cursor will never be used.  Subsequent code
3976   ** will scan expressions looking for iParent references and replace
3977   ** those references with expressions that resolve to the subquery FROM
3978   ** elements we are now copying in.
3979   */
3980   for(pParent=p; pParent; pParent=pParent->pPrior, pSub=pSub->pPrior){
3981     int nSubSrc;
3982     u8 jointype = 0;
3983     assert( pSub!=0 );
3984     pSubSrc = pSub->pSrc;     /* FROM clause of subquery */
3985     nSubSrc = pSubSrc->nSrc;  /* Number of terms in subquery FROM clause */
3986     pSrc = pParent->pSrc;     /* FROM clause of the outer query */
3987 
3988     if( pSrc ){
3989       assert( pParent==p );  /* First time through the loop */
3990       jointype = pSubitem->fg.jointype;
3991     }else{
3992       assert( pParent!=p );  /* 2nd and subsequent times through the loop */
3993       pSrc = sqlite3SrcListAppend(pParse, 0, 0, 0);
3994       if( pSrc==0 ) break;
3995       pParent->pSrc = pSrc;
3996     }
3997 
3998     /* The subquery uses a single slot of the FROM clause of the outer
3999     ** query.  If the subquery has more than one element in its FROM clause,
4000     ** then expand the outer query to make space for it to hold all elements
4001     ** of the subquery.
4002     **
4003     ** Example:
4004     **
4005     **    SELECT * FROM tabA, (SELECT * FROM sub1, sub2), tabB;
4006     **
4007     ** The outer query has 3 slots in its FROM clause.  One slot of the
4008     ** outer query (the middle slot) is used by the subquery.  The next
4009     ** block of code will expand the outer query FROM clause to 4 slots.
4010     ** The middle slot is expanded to two slots in order to make space
4011     ** for the two elements in the FROM clause of the subquery.
4012     */
4013     if( nSubSrc>1 ){
4014       pSrc = sqlite3SrcListEnlarge(pParse, pSrc, nSubSrc-1,iFrom+1);
4015       if( pSrc==0 ) break;
4016       pParent->pSrc = pSrc;
4017     }
4018 
4019     /* Transfer the FROM clause terms from the subquery into the
4020     ** outer query.
4021     */
4022     for(i=0; i<nSubSrc; i++){
4023       sqlite3IdListDelete(db, pSrc->a[i+iFrom].pUsing);
4024       assert( pSrc->a[i+iFrom].fg.isTabFunc==0 );
4025       pSrc->a[i+iFrom] = pSubSrc->a[i];
4026       iNewParent = pSubSrc->a[i].iCursor;
4027       memset(&pSubSrc->a[i], 0, sizeof(pSubSrc->a[i]));
4028     }
4029     pSrc->a[iFrom].fg.jointype = jointype;
4030 
4031     /* Now begin substituting subquery result set expressions for
4032     ** references to the iParent in the outer query.
4033     **
4034     ** Example:
4035     **
4036     **   SELECT a+5, b*10 FROM (SELECT x*3 AS a, y+10 AS b FROM t1) WHERE a>b;
4037     **   \                     \_____________ subquery __________/          /
4038     **    \_____________________ outer query ______________________________/
4039     **
4040     ** We look at every expression in the outer query and every place we see
4041     ** "a" we substitute "x*3" and every place we see "b" we substitute "y+10".
4042     */
4043     if( pSub->pOrderBy ){
4044       /* At this point, any non-zero iOrderByCol values indicate that the
4045       ** ORDER BY column expression is identical to the iOrderByCol'th
4046       ** expression returned by SELECT statement pSub. Since these values
4047       ** do not necessarily correspond to columns in SELECT statement pParent,
4048       ** zero them before transfering the ORDER BY clause.
4049       **
4050       ** Not doing this may cause an error if a subsequent call to this
4051       ** function attempts to flatten a compound sub-query into pParent
4052       ** (the only way this can happen is if the compound sub-query is
4053       ** currently part of pSub->pSrc). See ticket [d11a6e908f].  */
4054       ExprList *pOrderBy = pSub->pOrderBy;
4055       for(i=0; i<pOrderBy->nExpr; i++){
4056         pOrderBy->a[i].u.x.iOrderByCol = 0;
4057       }
4058       assert( pParent->pOrderBy==0 );
4059       pParent->pOrderBy = pOrderBy;
4060       pSub->pOrderBy = 0;
4061     }
4062     pWhere = pSub->pWhere;
4063     pSub->pWhere = 0;
4064     if( isLeftJoin>0 ){
4065       sqlite3SetJoinExpr(pWhere, iNewParent);
4066     }
4067     pParent->pWhere = sqlite3ExprAnd(pParse, pWhere, pParent->pWhere);
4068     if( db->mallocFailed==0 ){
4069       SubstContext x;
4070       x.pParse = pParse;
4071       x.iTable = iParent;
4072       x.iNewTable = iNewParent;
4073       x.isLeftJoin = isLeftJoin;
4074       x.pEList = pSub->pEList;
4075       substSelect(&x, pParent, 0);
4076     }
4077 
4078     /* The flattened query is a compound if either the inner or the
4079     ** outer query is a compound. */
4080     pParent->selFlags |= pSub->selFlags & SF_Compound;
4081     assert( (pSub->selFlags & SF_Distinct)==0 ); /* restriction (17b) */
4082 
4083     /*
4084     ** SELECT ... FROM (SELECT ... LIMIT a OFFSET b) LIMIT x OFFSET y;
4085     **
4086     ** One is tempted to try to add a and b to combine the limits.  But this
4087     ** does not work if either limit is negative.
4088     */
4089     if( pSub->pLimit ){
4090       pParent->pLimit = pSub->pLimit;
4091       pSub->pLimit = 0;
4092     }
4093   }
4094 
4095   /* Finially, delete what is left of the subquery and return
4096   ** success.
4097   */
4098   sqlite3SelectDelete(db, pSub1);
4099 
4100 #if SELECTTRACE_ENABLED
4101   if( sqlite3SelectTrace & 0x100 ){
4102     SELECTTRACE(0x100,pParse,p,("After flattening:\n"));
4103     sqlite3TreeViewSelect(0, p, 0);
4104   }
4105 #endif
4106 
4107   return 1;
4108 }
4109 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
4110 
4111 /*
4112 ** A structure to keep track of all of the column values that are fixed to
4113 ** a known value due to WHERE clause constraints of the form COLUMN=VALUE.
4114 */
4115 typedef struct WhereConst WhereConst;
4116 struct WhereConst {
4117   Parse *pParse;   /* Parsing context */
4118   int nConst;      /* Number for COLUMN=CONSTANT terms */
4119   int nChng;       /* Number of times a constant is propagated */
4120   Expr **apExpr;   /* [i*2] is COLUMN and [i*2+1] is VALUE */
4121 };
4122 
4123 /*
4124 ** Add a new entry to the pConst object.  Except, do not add duplicate
4125 ** pColumn entires.
4126 */
4127 static void constInsert(
4128   WhereConst *pConst,      /* The WhereConst into which we are inserting */
4129   Expr *pColumn,           /* The COLUMN part of the constraint */
4130   Expr *pValue             /* The VALUE part of the constraint */
4131 ){
4132   int i;
4133   assert( pColumn->op==TK_COLUMN );
4134 
4135   /* 2018-10-25 ticket [cf5ed20f]
4136   ** Make sure the same pColumn is not inserted more than once */
4137   for(i=0; i<pConst->nConst; i++){
4138     const Expr *pExpr = pConst->apExpr[i*2];
4139     assert( pExpr->op==TK_COLUMN );
4140     if( pExpr->iTable==pColumn->iTable
4141      && pExpr->iColumn==pColumn->iColumn
4142     ){
4143       return;  /* Already present.  Return without doing anything. */
4144     }
4145   }
4146 
4147   pConst->nConst++;
4148   pConst->apExpr = sqlite3DbReallocOrFree(pConst->pParse->db, pConst->apExpr,
4149                          pConst->nConst*2*sizeof(Expr*));
4150   if( pConst->apExpr==0 ){
4151     pConst->nConst = 0;
4152   }else{
4153     if( ExprHasProperty(pValue, EP_FixedCol) ) pValue = pValue->pLeft;
4154     pConst->apExpr[pConst->nConst*2-2] = pColumn;
4155     pConst->apExpr[pConst->nConst*2-1] = pValue;
4156   }
4157 }
4158 
4159 /*
4160 ** Find all terms of COLUMN=VALUE or VALUE=COLUMN in pExpr where VALUE
4161 ** is a constant expression and where the term must be true because it
4162 ** is part of the AND-connected terms of the expression.  For each term
4163 ** found, add it to the pConst structure.
4164 */
4165 static void findConstInWhere(WhereConst *pConst, Expr *pExpr){
4166   Expr *pRight, *pLeft;
4167   if( pExpr==0 ) return;
4168   if( ExprHasProperty(pExpr, EP_FromJoin) ) return;
4169   if( pExpr->op==TK_AND ){
4170     findConstInWhere(pConst, pExpr->pRight);
4171     findConstInWhere(pConst, pExpr->pLeft);
4172     return;
4173   }
4174   if( pExpr->op!=TK_EQ ) return;
4175   pRight = pExpr->pRight;
4176   pLeft = pExpr->pLeft;
4177   assert( pRight!=0 );
4178   assert( pLeft!=0 );
4179   if( pRight->op==TK_COLUMN
4180    && !ExprHasProperty(pRight, EP_FixedCol)
4181    && sqlite3ExprIsConstant(pLeft)
4182    && sqlite3IsBinary(sqlite3ExprCompareCollSeq(pConst->pParse,pExpr))
4183   ){
4184     constInsert(pConst, pRight, pLeft);
4185   }else
4186   if( pLeft->op==TK_COLUMN
4187    && !ExprHasProperty(pLeft, EP_FixedCol)
4188    && sqlite3ExprIsConstant(pRight)
4189    && sqlite3IsBinary(sqlite3ExprCompareCollSeq(pConst->pParse,pExpr))
4190   ){
4191     constInsert(pConst, pLeft, pRight);
4192   }
4193 }
4194 
4195 /*
4196 ** This is a Walker expression callback.  pExpr is a candidate expression
4197 ** to be replaced by a value.  If pExpr is equivalent to one of the
4198 ** columns named in pWalker->u.pConst, then overwrite it with its
4199 ** corresponding value.
4200 */
4201 static int propagateConstantExprRewrite(Walker *pWalker, Expr *pExpr){
4202   int i;
4203   WhereConst *pConst;
4204   if( pExpr->op!=TK_COLUMN ) return WRC_Continue;
4205   if( ExprHasProperty(pExpr, EP_FixedCol) ) return WRC_Continue;
4206   pConst = pWalker->u.pConst;
4207   for(i=0; i<pConst->nConst; i++){
4208     Expr *pColumn = pConst->apExpr[i*2];
4209     if( pColumn==pExpr ) continue;
4210     if( pColumn->iTable!=pExpr->iTable ) continue;
4211     if( pColumn->iColumn!=pExpr->iColumn ) continue;
4212     /* A match is found.  Add the EP_FixedCol property */
4213     pConst->nChng++;
4214     ExprClearProperty(pExpr, EP_Leaf);
4215     ExprSetProperty(pExpr, EP_FixedCol);
4216     assert( pExpr->pLeft==0 );
4217     pExpr->pLeft = sqlite3ExprDup(pConst->pParse->db, pConst->apExpr[i*2+1], 0);
4218     break;
4219   }
4220   return WRC_Prune;
4221 }
4222 
4223 /*
4224 ** The WHERE-clause constant propagation optimization.
4225 **
4226 ** If the WHERE clause contains terms of the form COLUMN=CONSTANT or
4227 ** CONSTANT=COLUMN that must be tree (in other words, if the terms top-level
4228 ** AND-connected terms that are not part of a ON clause from a LEFT JOIN)
4229 ** then throughout the query replace all other occurrences of COLUMN
4230 ** with CONSTANT within the WHERE clause.
4231 **
4232 ** For example, the query:
4233 **
4234 **      SELECT * FROM t1, t2, t3 WHERE t1.a=39 AND t2.b=t1.a AND t3.c=t2.b
4235 **
4236 ** Is transformed into
4237 **
4238 **      SELECT * FROM t1, t2, t3 WHERE t1.a=39 AND t2.b=39 AND t3.c=39
4239 **
4240 ** Return true if any transformations where made and false if not.
4241 **
4242 ** Implementation note:  Constant propagation is tricky due to affinity
4243 ** and collating sequence interactions.  Consider this example:
4244 **
4245 **    CREATE TABLE t1(a INT,b TEXT);
4246 **    INSERT INTO t1 VALUES(123,'0123');
4247 **    SELECT * FROM t1 WHERE a=123 AND b=a;
4248 **    SELECT * FROM t1 WHERE a=123 AND b=123;
4249 **
4250 ** The two SELECT statements above should return different answers.  b=a
4251 ** is alway true because the comparison uses numeric affinity, but b=123
4252 ** is false because it uses text affinity and '0123' is not the same as '123'.
4253 ** To work around this, the expression tree is not actually changed from
4254 ** "b=a" to "b=123" but rather the "a" in "b=a" is tagged with EP_FixedCol
4255 ** and the "123" value is hung off of the pLeft pointer.  Code generator
4256 ** routines know to generate the constant "123" instead of looking up the
4257 ** column value.  Also, to avoid collation problems, this optimization is
4258 ** only attempted if the "a=123" term uses the default BINARY collation.
4259 */
4260 static int propagateConstants(
4261   Parse *pParse,   /* The parsing context */
4262   Select *p        /* The query in which to propagate constants */
4263 ){
4264   WhereConst x;
4265   Walker w;
4266   int nChng = 0;
4267   x.pParse = pParse;
4268   do{
4269     x.nConst = 0;
4270     x.nChng = 0;
4271     x.apExpr = 0;
4272     findConstInWhere(&x, p->pWhere);
4273     if( x.nConst ){
4274       memset(&w, 0, sizeof(w));
4275       w.pParse = pParse;
4276       w.xExprCallback = propagateConstantExprRewrite;
4277       w.xSelectCallback = sqlite3SelectWalkNoop;
4278       w.xSelectCallback2 = 0;
4279       w.walkerDepth = 0;
4280       w.u.pConst = &x;
4281       sqlite3WalkExpr(&w, p->pWhere);
4282       sqlite3DbFree(x.pParse->db, x.apExpr);
4283       nChng += x.nChng;
4284     }
4285   }while( x.nChng );
4286   return nChng;
4287 }
4288 
4289 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
4290 /*
4291 ** Make copies of relevant WHERE clause terms of the outer query into
4292 ** the WHERE clause of subquery.  Example:
4293 **
4294 **    SELECT * FROM (SELECT a AS x, c-d AS y FROM t1) WHERE x=5 AND y=10;
4295 **
4296 ** Transformed into:
4297 **
4298 **    SELECT * FROM (SELECT a AS x, c-d AS y FROM t1 WHERE a=5 AND c-d=10)
4299 **     WHERE x=5 AND y=10;
4300 **
4301 ** The hope is that the terms added to the inner query will make it more
4302 ** efficient.
4303 **
4304 ** Do not attempt this optimization if:
4305 **
4306 **   (1) (** This restriction was removed on 2017-09-29.  We used to
4307 **           disallow this optimization for aggregate subqueries, but now
4308 **           it is allowed by putting the extra terms on the HAVING clause.
4309 **           The added HAVING clause is pointless if the subquery lacks
4310 **           a GROUP BY clause.  But such a HAVING clause is also harmless
4311 **           so there does not appear to be any reason to add extra logic
4312 **           to suppress it. **)
4313 **
4314 **   (2) The inner query is the recursive part of a common table expression.
4315 **
4316 **   (3) The inner query has a LIMIT clause (since the changes to the WHERE
4317 **       clause would change the meaning of the LIMIT).
4318 **
4319 **   (4) The inner query is the right operand of a LEFT JOIN and the
4320 **       expression to be pushed down does not come from the ON clause
4321 **       on that LEFT JOIN.
4322 **
4323 **   (5) The WHERE clause expression originates in the ON or USING clause
4324 **       of a LEFT JOIN where iCursor is not the right-hand table of that
4325 **       left join.  An example:
4326 **
4327 **           SELECT *
4328 **           FROM (SELECT 1 AS a1 UNION ALL SELECT 2) AS aa
4329 **           JOIN (SELECT 1 AS b2 UNION ALL SELECT 2) AS bb ON (a1=b2)
4330 **           LEFT JOIN (SELECT 8 AS c3 UNION ALL SELECT 9) AS cc ON (b2=2);
4331 **
4332 **       The correct answer is three rows:  (1,1,NULL),(2,2,8),(2,2,9).
4333 **       But if the (b2=2) term were to be pushed down into the bb subquery,
4334 **       then the (1,1,NULL) row would be suppressed.
4335 **
4336 **   (6) The inner query features one or more window-functions (since
4337 **       changes to the WHERE clause of the inner query could change the
4338 **       window over which window functions are calculated).
4339 **
4340 ** Return 0 if no changes are made and non-zero if one or more WHERE clause
4341 ** terms are duplicated into the subquery.
4342 */
4343 static int pushDownWhereTerms(
4344   Parse *pParse,        /* Parse context (for malloc() and error reporting) */
4345   Select *pSubq,        /* The subquery whose WHERE clause is to be augmented */
4346   Expr *pWhere,         /* The WHERE clause of the outer query */
4347   int iCursor,          /* Cursor number of the subquery */
4348   int isLeftJoin        /* True if pSubq is the right term of a LEFT JOIN */
4349 ){
4350   Expr *pNew;
4351   int nChng = 0;
4352   if( pWhere==0 ) return 0;
4353   if( pSubq->selFlags & SF_Recursive ) return 0;  /* restriction (2) */
4354 
4355 #ifndef SQLITE_OMIT_WINDOWFUNC
4356   if( pSubq->pWin ) return 0;    /* restriction (6) */
4357 #endif
4358 
4359 #ifdef SQLITE_DEBUG
4360   /* Only the first term of a compound can have a WITH clause.  But make
4361   ** sure no other terms are marked SF_Recursive in case something changes
4362   ** in the future.
4363   */
4364   {
4365     Select *pX;
4366     for(pX=pSubq; pX; pX=pX->pPrior){
4367       assert( (pX->selFlags & (SF_Recursive))==0 );
4368     }
4369   }
4370 #endif
4371 
4372   if( pSubq->pLimit!=0 ){
4373     return 0; /* restriction (3) */
4374   }
4375   while( pWhere->op==TK_AND ){
4376     nChng += pushDownWhereTerms(pParse, pSubq, pWhere->pRight,
4377                                 iCursor, isLeftJoin);
4378     pWhere = pWhere->pLeft;
4379   }
4380   if( isLeftJoin
4381    && (ExprHasProperty(pWhere,EP_FromJoin)==0
4382          || pWhere->iRightJoinTable!=iCursor)
4383   ){
4384     return 0; /* restriction (4) */
4385   }
4386   if( ExprHasProperty(pWhere,EP_FromJoin) && pWhere->iRightJoinTable!=iCursor ){
4387     return 0; /* restriction (5) */
4388   }
4389   if( sqlite3ExprIsTableConstant(pWhere, iCursor) ){
4390     nChng++;
4391     while( pSubq ){
4392       SubstContext x;
4393       pNew = sqlite3ExprDup(pParse->db, pWhere, 0);
4394       unsetJoinExpr(pNew, -1);
4395       x.pParse = pParse;
4396       x.iTable = iCursor;
4397       x.iNewTable = iCursor;
4398       x.isLeftJoin = 0;
4399       x.pEList = pSubq->pEList;
4400       pNew = substExpr(&x, pNew);
4401       if( pSubq->selFlags & SF_Aggregate ){
4402         pSubq->pHaving = sqlite3ExprAnd(pParse, pSubq->pHaving, pNew);
4403       }else{
4404         pSubq->pWhere = sqlite3ExprAnd(pParse, pSubq->pWhere, pNew);
4405       }
4406       pSubq = pSubq->pPrior;
4407     }
4408   }
4409   return nChng;
4410 }
4411 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
4412 
4413 /*
4414 ** The pFunc is the only aggregate function in the query.  Check to see
4415 ** if the query is a candidate for the min/max optimization.
4416 **
4417 ** If the query is a candidate for the min/max optimization, then set
4418 ** *ppMinMax to be an ORDER BY clause to be used for the optimization
4419 ** and return either WHERE_ORDERBY_MIN or WHERE_ORDERBY_MAX depending on
4420 ** whether pFunc is a min() or max() function.
4421 **
4422 ** If the query is not a candidate for the min/max optimization, return
4423 ** WHERE_ORDERBY_NORMAL (which must be zero).
4424 **
4425 ** This routine must be called after aggregate functions have been
4426 ** located but before their arguments have been subjected to aggregate
4427 ** analysis.
4428 */
4429 static u8 minMaxQuery(sqlite3 *db, Expr *pFunc, ExprList **ppMinMax){
4430   int eRet = WHERE_ORDERBY_NORMAL;      /* Return value */
4431   ExprList *pEList = pFunc->x.pList;    /* Arguments to agg function */
4432   const char *zFunc;                    /* Name of aggregate function pFunc */
4433   ExprList *pOrderBy;
4434   u8 sortFlags;
4435 
4436   assert( *ppMinMax==0 );
4437   assert( pFunc->op==TK_AGG_FUNCTION );
4438   assert( !IsWindowFunc(pFunc) );
4439   if( pEList==0 || pEList->nExpr!=1 || ExprHasProperty(pFunc, EP_WinFunc) ){
4440     return eRet;
4441   }
4442   zFunc = pFunc->u.zToken;
4443   if( sqlite3StrICmp(zFunc, "min")==0 ){
4444     eRet = WHERE_ORDERBY_MIN;
4445     sortFlags = KEYINFO_ORDER_BIGNULL;
4446   }else if( sqlite3StrICmp(zFunc, "max")==0 ){
4447     eRet = WHERE_ORDERBY_MAX;
4448     sortFlags = KEYINFO_ORDER_DESC;
4449   }else{
4450     return eRet;
4451   }
4452   *ppMinMax = pOrderBy = sqlite3ExprListDup(db, pEList, 0);
4453   assert( pOrderBy!=0 || db->mallocFailed );
4454   if( pOrderBy ) pOrderBy->a[0].sortFlags = sortFlags;
4455   return eRet;
4456 }
4457 
4458 /*
4459 ** The select statement passed as the first argument is an aggregate query.
4460 ** The second argument is the associated aggregate-info object. This
4461 ** function tests if the SELECT is of the form:
4462 **
4463 **   SELECT count(*) FROM <tbl>
4464 **
4465 ** where table is a database table, not a sub-select or view. If the query
4466 ** does match this pattern, then a pointer to the Table object representing
4467 ** <tbl> is returned. Otherwise, 0 is returned.
4468 */
4469 static Table *isSimpleCount(Select *p, AggInfo *pAggInfo){
4470   Table *pTab;
4471   Expr *pExpr;
4472 
4473   assert( !p->pGroupBy );
4474 
4475   if( p->pWhere || p->pEList->nExpr!=1
4476    || p->pSrc->nSrc!=1 || p->pSrc->a[0].pSelect
4477   ){
4478     return 0;
4479   }
4480   pTab = p->pSrc->a[0].pTab;
4481   pExpr = p->pEList->a[0].pExpr;
4482   assert( pTab && !pTab->pSelect && pExpr );
4483 
4484   if( IsVirtual(pTab) ) return 0;
4485   if( pExpr->op!=TK_AGG_FUNCTION ) return 0;
4486   if( NEVER(pAggInfo->nFunc==0) ) return 0;
4487   if( (pAggInfo->aFunc[0].pFunc->funcFlags&SQLITE_FUNC_COUNT)==0 ) return 0;
4488   if( ExprHasProperty(pExpr, EP_Distinct|EP_WinFunc) ) return 0;
4489 
4490   return pTab;
4491 }
4492 
4493 /*
4494 ** If the source-list item passed as an argument was augmented with an
4495 ** INDEXED BY clause, then try to locate the specified index. If there
4496 ** was such a clause and the named index cannot be found, return
4497 ** SQLITE_ERROR and leave an error in pParse. Otherwise, populate
4498 ** pFrom->pIndex and return SQLITE_OK.
4499 */
4500 int sqlite3IndexedByLookup(Parse *pParse, struct SrcList_item *pFrom){
4501   if( pFrom->pTab && pFrom->fg.isIndexedBy ){
4502     Table *pTab = pFrom->pTab;
4503     char *zIndexedBy = pFrom->u1.zIndexedBy;
4504     Index *pIdx;
4505     for(pIdx=pTab->pIndex;
4506         pIdx && sqlite3StrICmp(pIdx->zName, zIndexedBy);
4507         pIdx=pIdx->pNext
4508     );
4509     if( !pIdx ){
4510       sqlite3ErrorMsg(pParse, "no such index: %s", zIndexedBy, 0);
4511       pParse->checkSchema = 1;
4512       return SQLITE_ERROR;
4513     }
4514     pFrom->pIBIndex = pIdx;
4515   }
4516   return SQLITE_OK;
4517 }
4518 /*
4519 ** Detect compound SELECT statements that use an ORDER BY clause with
4520 ** an alternative collating sequence.
4521 **
4522 **    SELECT ... FROM t1 EXCEPT SELECT ... FROM t2 ORDER BY .. COLLATE ...
4523 **
4524 ** These are rewritten as a subquery:
4525 **
4526 **    SELECT * FROM (SELECT ... FROM t1 EXCEPT SELECT ... FROM t2)
4527 **     ORDER BY ... COLLATE ...
4528 **
4529 ** This transformation is necessary because the multiSelectOrderBy() routine
4530 ** above that generates the code for a compound SELECT with an ORDER BY clause
4531 ** uses a merge algorithm that requires the same collating sequence on the
4532 ** result columns as on the ORDER BY clause.  See ticket
4533 ** http://www.sqlite.org/src/info/6709574d2a
4534 **
4535 ** This transformation is only needed for EXCEPT, INTERSECT, and UNION.
4536 ** The UNION ALL operator works fine with multiSelectOrderBy() even when
4537 ** there are COLLATE terms in the ORDER BY.
4538 */
4539 static int convertCompoundSelectToSubquery(Walker *pWalker, Select *p){
4540   int i;
4541   Select *pNew;
4542   Select *pX;
4543   sqlite3 *db;
4544   struct ExprList_item *a;
4545   SrcList *pNewSrc;
4546   Parse *pParse;
4547   Token dummy;
4548 
4549   if( p->pPrior==0 ) return WRC_Continue;
4550   if( p->pOrderBy==0 ) return WRC_Continue;
4551   for(pX=p; pX && (pX->op==TK_ALL || pX->op==TK_SELECT); pX=pX->pPrior){}
4552   if( pX==0 ) return WRC_Continue;
4553   a = p->pOrderBy->a;
4554   for(i=p->pOrderBy->nExpr-1; i>=0; i--){
4555     if( a[i].pExpr->flags & EP_Collate ) break;
4556   }
4557   if( i<0 ) return WRC_Continue;
4558 
4559   /* If we reach this point, that means the transformation is required. */
4560 
4561   pParse = pWalker->pParse;
4562   db = pParse->db;
4563   pNew = sqlite3DbMallocZero(db, sizeof(*pNew) );
4564   if( pNew==0 ) return WRC_Abort;
4565   memset(&dummy, 0, sizeof(dummy));
4566   pNewSrc = sqlite3SrcListAppendFromTerm(pParse,0,0,0,&dummy,pNew,0,0);
4567   if( pNewSrc==0 ) return WRC_Abort;
4568   *pNew = *p;
4569   p->pSrc = pNewSrc;
4570   p->pEList = sqlite3ExprListAppend(pParse, 0, sqlite3Expr(db, TK_ASTERISK, 0));
4571   p->op = TK_SELECT;
4572   p->pWhere = 0;
4573   pNew->pGroupBy = 0;
4574   pNew->pHaving = 0;
4575   pNew->pOrderBy = 0;
4576   p->pPrior = 0;
4577   p->pNext = 0;
4578   p->pWith = 0;
4579 #ifndef SQLITE_OMIT_WINDOWFUNC
4580   p->pWinDefn = 0;
4581 #endif
4582   p->selFlags &= ~SF_Compound;
4583   assert( (p->selFlags & SF_Converted)==0 );
4584   p->selFlags |= SF_Converted;
4585   assert( pNew->pPrior!=0 );
4586   pNew->pPrior->pNext = pNew;
4587   pNew->pLimit = 0;
4588   return WRC_Continue;
4589 }
4590 
4591 /*
4592 ** Check to see if the FROM clause term pFrom has table-valued function
4593 ** arguments.  If it does, leave an error message in pParse and return
4594 ** non-zero, since pFrom is not allowed to be a table-valued function.
4595 */
4596 static int cannotBeFunction(Parse *pParse, struct SrcList_item *pFrom){
4597   if( pFrom->fg.isTabFunc ){
4598     sqlite3ErrorMsg(pParse, "'%s' is not a function", pFrom->zName);
4599     return 1;
4600   }
4601   return 0;
4602 }
4603 
4604 #ifndef SQLITE_OMIT_CTE
4605 /*
4606 ** Argument pWith (which may be NULL) points to a linked list of nested
4607 ** WITH contexts, from inner to outermost. If the table identified by
4608 ** FROM clause element pItem is really a common-table-expression (CTE)
4609 ** then return a pointer to the CTE definition for that table. Otherwise
4610 ** return NULL.
4611 **
4612 ** If a non-NULL value is returned, set *ppContext to point to the With
4613 ** object that the returned CTE belongs to.
4614 */
4615 static struct Cte *searchWith(
4616   With *pWith,                    /* Current innermost WITH clause */
4617   struct SrcList_item *pItem,     /* FROM clause element to resolve */
4618   With **ppContext                /* OUT: WITH clause return value belongs to */
4619 ){
4620   const char *zName;
4621   if( pItem->zDatabase==0 && (zName = pItem->zName)!=0 ){
4622     With *p;
4623     for(p=pWith; p; p=p->pOuter){
4624       int i;
4625       for(i=0; i<p->nCte; i++){
4626         if( sqlite3StrICmp(zName, p->a[i].zName)==0 ){
4627           *ppContext = p;
4628           return &p->a[i];
4629         }
4630       }
4631     }
4632   }
4633   return 0;
4634 }
4635 
4636 /* The code generator maintains a stack of active WITH clauses
4637 ** with the inner-most WITH clause being at the top of the stack.
4638 **
4639 ** This routine pushes the WITH clause passed as the second argument
4640 ** onto the top of the stack. If argument bFree is true, then this
4641 ** WITH clause will never be popped from the stack. In this case it
4642 ** should be freed along with the Parse object. In other cases, when
4643 ** bFree==0, the With object will be freed along with the SELECT
4644 ** statement with which it is associated.
4645 */
4646 void sqlite3WithPush(Parse *pParse, With *pWith, u8 bFree){
4647   assert( bFree==0 || (pParse->pWith==0 && pParse->pWithToFree==0) );
4648   if( pWith ){
4649     assert( pParse->pWith!=pWith );
4650     pWith->pOuter = pParse->pWith;
4651     pParse->pWith = pWith;
4652     if( bFree ) pParse->pWithToFree = pWith;
4653   }
4654 }
4655 
4656 /*
4657 ** This function checks if argument pFrom refers to a CTE declared by
4658 ** a WITH clause on the stack currently maintained by the parser. And,
4659 ** if currently processing a CTE expression, if it is a recursive
4660 ** reference to the current CTE.
4661 **
4662 ** If pFrom falls into either of the two categories above, pFrom->pTab
4663 ** and other fields are populated accordingly. The caller should check
4664 ** (pFrom->pTab!=0) to determine whether or not a successful match
4665 ** was found.
4666 **
4667 ** Whether or not a match is found, SQLITE_OK is returned if no error
4668 ** occurs. If an error does occur, an error message is stored in the
4669 ** parser and some error code other than SQLITE_OK returned.
4670 */
4671 static int withExpand(
4672   Walker *pWalker,
4673   struct SrcList_item *pFrom
4674 ){
4675   Parse *pParse = pWalker->pParse;
4676   sqlite3 *db = pParse->db;
4677   struct Cte *pCte;               /* Matched CTE (or NULL if no match) */
4678   With *pWith;                    /* WITH clause that pCte belongs to */
4679 
4680   assert( pFrom->pTab==0 );
4681   if( pParse->nErr ){
4682     return SQLITE_ERROR;
4683   }
4684 
4685   pCte = searchWith(pParse->pWith, pFrom, &pWith);
4686   if( pCte ){
4687     Table *pTab;
4688     ExprList *pEList;
4689     Select *pSel;
4690     Select *pLeft;                /* Left-most SELECT statement */
4691     int bMayRecursive;            /* True if compound joined by UNION [ALL] */
4692     With *pSavedWith;             /* Initial value of pParse->pWith */
4693 
4694     /* If pCte->zCteErr is non-NULL at this point, then this is an illegal
4695     ** recursive reference to CTE pCte. Leave an error in pParse and return
4696     ** early. If pCte->zCteErr is NULL, then this is not a recursive reference.
4697     ** In this case, proceed.  */
4698     if( pCte->zCteErr ){
4699       sqlite3ErrorMsg(pParse, pCte->zCteErr, pCte->zName);
4700       return SQLITE_ERROR;
4701     }
4702     if( cannotBeFunction(pParse, pFrom) ) return SQLITE_ERROR;
4703 
4704     assert( pFrom->pTab==0 );
4705     pFrom->pTab = pTab = sqlite3DbMallocZero(db, sizeof(Table));
4706     if( pTab==0 ) return WRC_Abort;
4707     pTab->nTabRef = 1;
4708     pTab->zName = sqlite3DbStrDup(db, pCte->zName);
4709     pTab->iPKey = -1;
4710     pTab->nRowLogEst = 200; assert( 200==sqlite3LogEst(1048576) );
4711     pTab->tabFlags |= TF_Ephemeral | TF_NoVisibleRowid;
4712     pFrom->pSelect = sqlite3SelectDup(db, pCte->pSelect, 0);
4713     if( db->mallocFailed ) return SQLITE_NOMEM_BKPT;
4714     assert( pFrom->pSelect );
4715 
4716     /* Check if this is a recursive CTE. */
4717     pSel = pFrom->pSelect;
4718     bMayRecursive = ( pSel->op==TK_ALL || pSel->op==TK_UNION );
4719     if( bMayRecursive ){
4720       int i;
4721       SrcList *pSrc = pFrom->pSelect->pSrc;
4722       for(i=0; i<pSrc->nSrc; i++){
4723         struct SrcList_item *pItem = &pSrc->a[i];
4724         if( pItem->zDatabase==0
4725          && pItem->zName!=0
4726          && 0==sqlite3StrICmp(pItem->zName, pCte->zName)
4727           ){
4728           pItem->pTab = pTab;
4729           pItem->fg.isRecursive = 1;
4730           pTab->nTabRef++;
4731           pSel->selFlags |= SF_Recursive;
4732         }
4733       }
4734     }
4735 
4736     /* Only one recursive reference is permitted. */
4737     if( pTab->nTabRef>2 ){
4738       sqlite3ErrorMsg(
4739           pParse, "multiple references to recursive table: %s", pCte->zName
4740       );
4741       return SQLITE_ERROR;
4742     }
4743     assert( pTab->nTabRef==1 ||
4744             ((pSel->selFlags&SF_Recursive) && pTab->nTabRef==2 ));
4745 
4746     pCte->zCteErr = "circular reference: %s";
4747     pSavedWith = pParse->pWith;
4748     pParse->pWith = pWith;
4749     if( bMayRecursive ){
4750       Select *pPrior = pSel->pPrior;
4751       assert( pPrior->pWith==0 );
4752       pPrior->pWith = pSel->pWith;
4753       sqlite3WalkSelect(pWalker, pPrior);
4754       pPrior->pWith = 0;
4755     }else{
4756       sqlite3WalkSelect(pWalker, pSel);
4757     }
4758     pParse->pWith = pWith;
4759 
4760     for(pLeft=pSel; pLeft->pPrior; pLeft=pLeft->pPrior);
4761     pEList = pLeft->pEList;
4762     if( pCte->pCols ){
4763       if( pEList && pEList->nExpr!=pCte->pCols->nExpr ){
4764         sqlite3ErrorMsg(pParse, "table %s has %d values for %d columns",
4765             pCte->zName, pEList->nExpr, pCte->pCols->nExpr
4766         );
4767         pParse->pWith = pSavedWith;
4768         return SQLITE_ERROR;
4769       }
4770       pEList = pCte->pCols;
4771     }
4772 
4773     sqlite3ColumnsFromExprList(pParse, pEList, &pTab->nCol, &pTab->aCol);
4774     if( bMayRecursive ){
4775       if( pSel->selFlags & SF_Recursive ){
4776         pCte->zCteErr = "multiple recursive references: %s";
4777       }else{
4778         pCte->zCteErr = "recursive reference in a subquery: %s";
4779       }
4780       sqlite3WalkSelect(pWalker, pSel);
4781     }
4782     pCte->zCteErr = 0;
4783     pParse->pWith = pSavedWith;
4784   }
4785 
4786   return SQLITE_OK;
4787 }
4788 #endif
4789 
4790 #ifndef SQLITE_OMIT_CTE
4791 /*
4792 ** If the SELECT passed as the second argument has an associated WITH
4793 ** clause, pop it from the stack stored as part of the Parse object.
4794 **
4795 ** This function is used as the xSelectCallback2() callback by
4796 ** sqlite3SelectExpand() when walking a SELECT tree to resolve table
4797 ** names and other FROM clause elements.
4798 */
4799 static void selectPopWith(Walker *pWalker, Select *p){
4800   Parse *pParse = pWalker->pParse;
4801   if( OK_IF_ALWAYS_TRUE(pParse->pWith) && p->pPrior==0 ){
4802     With *pWith = findRightmost(p)->pWith;
4803     if( pWith!=0 ){
4804       assert( pParse->pWith==pWith );
4805       pParse->pWith = pWith->pOuter;
4806     }
4807   }
4808 }
4809 #else
4810 #define selectPopWith 0
4811 #endif
4812 
4813 /*
4814 ** The SrcList_item structure passed as the second argument represents a
4815 ** sub-query in the FROM clause of a SELECT statement. This function
4816 ** allocates and populates the SrcList_item.pTab object. If successful,
4817 ** SQLITE_OK is returned. Otherwise, if an OOM error is encountered,
4818 ** SQLITE_NOMEM.
4819 */
4820 int sqlite3ExpandSubquery(Parse *pParse, struct SrcList_item *pFrom){
4821   Select *pSel = pFrom->pSelect;
4822   Table *pTab;
4823 
4824   assert( pSel );
4825   pFrom->pTab = pTab = sqlite3DbMallocZero(pParse->db, sizeof(Table));
4826   if( pTab==0 ) return SQLITE_NOMEM;
4827   pTab->nTabRef = 1;
4828   if( pFrom->zAlias ){
4829     pTab->zName = sqlite3DbStrDup(pParse->db, pFrom->zAlias);
4830   }else{
4831     pTab->zName = sqlite3MPrintf(pParse->db, "subquery_%u", pSel->selId);
4832   }
4833   while( pSel->pPrior ){ pSel = pSel->pPrior; }
4834   sqlite3ColumnsFromExprList(pParse, pSel->pEList,&pTab->nCol,&pTab->aCol);
4835   pTab->iPKey = -1;
4836   pTab->nRowLogEst = 200; assert( 200==sqlite3LogEst(1048576) );
4837   pTab->tabFlags |= TF_Ephemeral;
4838 
4839   return pParse->nErr ? SQLITE_ERROR : SQLITE_OK;
4840 }
4841 
4842 /*
4843 ** This routine is a Walker callback for "expanding" a SELECT statement.
4844 ** "Expanding" means to do the following:
4845 **
4846 **    (1)  Make sure VDBE cursor numbers have been assigned to every
4847 **         element of the FROM clause.
4848 **
4849 **    (2)  Fill in the pTabList->a[].pTab fields in the SrcList that
4850 **         defines FROM clause.  When views appear in the FROM clause,
4851 **         fill pTabList->a[].pSelect with a copy of the SELECT statement
4852 **         that implements the view.  A copy is made of the view's SELECT
4853 **         statement so that we can freely modify or delete that statement
4854 **         without worrying about messing up the persistent representation
4855 **         of the view.
4856 **
4857 **    (3)  Add terms to the WHERE clause to accommodate the NATURAL keyword
4858 **         on joins and the ON and USING clause of joins.
4859 **
4860 **    (4)  Scan the list of columns in the result set (pEList) looking
4861 **         for instances of the "*" operator or the TABLE.* operator.
4862 **         If found, expand each "*" to be every column in every table
4863 **         and TABLE.* to be every column in TABLE.
4864 **
4865 */
4866 static int selectExpander(Walker *pWalker, Select *p){
4867   Parse *pParse = pWalker->pParse;
4868   int i, j, k;
4869   SrcList *pTabList;
4870   ExprList *pEList;
4871   struct SrcList_item *pFrom;
4872   sqlite3 *db = pParse->db;
4873   Expr *pE, *pRight, *pExpr;
4874   u16 selFlags = p->selFlags;
4875   u32 elistFlags = 0;
4876 
4877   p->selFlags |= SF_Expanded;
4878   if( db->mallocFailed  ){
4879     return WRC_Abort;
4880   }
4881   assert( p->pSrc!=0 );
4882   if( (selFlags & SF_Expanded)!=0 ){
4883     return WRC_Prune;
4884   }
4885   if( pWalker->eCode ){
4886     /* Renumber selId because it has been copied from a view */
4887     p->selId = ++pParse->nSelect;
4888   }
4889   pTabList = p->pSrc;
4890   pEList = p->pEList;
4891   sqlite3WithPush(pParse, p->pWith, 0);
4892 
4893   /* Make sure cursor numbers have been assigned to all entries in
4894   ** the FROM clause of the SELECT statement.
4895   */
4896   sqlite3SrcListAssignCursors(pParse, pTabList);
4897 
4898   /* Look up every table named in the FROM clause of the select.  If
4899   ** an entry of the FROM clause is a subquery instead of a table or view,
4900   ** then create a transient table structure to describe the subquery.
4901   */
4902   for(i=0, pFrom=pTabList->a; i<pTabList->nSrc; i++, pFrom++){
4903     Table *pTab;
4904     assert( pFrom->fg.isRecursive==0 || pFrom->pTab!=0 );
4905     if( pFrom->fg.isRecursive ) continue;
4906     assert( pFrom->pTab==0 );
4907 #ifndef SQLITE_OMIT_CTE
4908     if( withExpand(pWalker, pFrom) ) return WRC_Abort;
4909     if( pFrom->pTab ) {} else
4910 #endif
4911     if( pFrom->zName==0 ){
4912 #ifndef SQLITE_OMIT_SUBQUERY
4913       Select *pSel = pFrom->pSelect;
4914       /* A sub-query in the FROM clause of a SELECT */
4915       assert( pSel!=0 );
4916       assert( pFrom->pTab==0 );
4917       if( sqlite3WalkSelect(pWalker, pSel) ) return WRC_Abort;
4918       if( sqlite3ExpandSubquery(pParse, pFrom) ) return WRC_Abort;
4919 #endif
4920     }else{
4921       /* An ordinary table or view name in the FROM clause */
4922       assert( pFrom->pTab==0 );
4923       pFrom->pTab = pTab = sqlite3LocateTableItem(pParse, 0, pFrom);
4924       if( pTab==0 ) return WRC_Abort;
4925       if( pTab->nTabRef>=0xffff ){
4926         sqlite3ErrorMsg(pParse, "too many references to \"%s\": max 65535",
4927            pTab->zName);
4928         pFrom->pTab = 0;
4929         return WRC_Abort;
4930       }
4931       pTab->nTabRef++;
4932       if( !IsVirtual(pTab) && cannotBeFunction(pParse, pFrom) ){
4933         return WRC_Abort;
4934       }
4935 #if !defined(SQLITE_OMIT_VIEW) || !defined (SQLITE_OMIT_VIRTUALTABLE)
4936       if( IsVirtual(pTab) || pTab->pSelect ){
4937         i16 nCol;
4938         u8 eCodeOrig = pWalker->eCode;
4939         if( sqlite3ViewGetColumnNames(pParse, pTab) ) return WRC_Abort;
4940         assert( pFrom->pSelect==0 );
4941         if( pTab->pSelect && (db->flags & SQLITE_EnableView)==0 ){
4942           sqlite3ErrorMsg(pParse, "access to view \"%s\" prohibited",
4943               pTab->zName);
4944         }
4945         pFrom->pSelect = sqlite3SelectDup(db, pTab->pSelect, 0);
4946         nCol = pTab->nCol;
4947         pTab->nCol = -1;
4948         pWalker->eCode = 1;  /* Turn on Select.selId renumbering */
4949         sqlite3WalkSelect(pWalker, pFrom->pSelect);
4950         pWalker->eCode = eCodeOrig;
4951         pTab->nCol = nCol;
4952       }
4953 #endif
4954     }
4955 
4956     /* Locate the index named by the INDEXED BY clause, if any. */
4957     if( sqlite3IndexedByLookup(pParse, pFrom) ){
4958       return WRC_Abort;
4959     }
4960   }
4961 
4962   /* Process NATURAL keywords, and ON and USING clauses of joins.
4963   */
4964   if( db->mallocFailed || sqliteProcessJoin(pParse, p) ){
4965     return WRC_Abort;
4966   }
4967 
4968   /* For every "*" that occurs in the column list, insert the names of
4969   ** all columns in all tables.  And for every TABLE.* insert the names
4970   ** of all columns in TABLE.  The parser inserted a special expression
4971   ** with the TK_ASTERISK operator for each "*" that it found in the column
4972   ** list.  The following code just has to locate the TK_ASTERISK
4973   ** expressions and expand each one to the list of all columns in
4974   ** all tables.
4975   **
4976   ** The first loop just checks to see if there are any "*" operators
4977   ** that need expanding.
4978   */
4979   for(k=0; k<pEList->nExpr; k++){
4980     pE = pEList->a[k].pExpr;
4981     if( pE->op==TK_ASTERISK ) break;
4982     assert( pE->op!=TK_DOT || pE->pRight!=0 );
4983     assert( pE->op!=TK_DOT || (pE->pLeft!=0 && pE->pLeft->op==TK_ID) );
4984     if( pE->op==TK_DOT && pE->pRight->op==TK_ASTERISK ) break;
4985     elistFlags |= pE->flags;
4986   }
4987   if( k<pEList->nExpr ){
4988     /*
4989     ** If we get here it means the result set contains one or more "*"
4990     ** operators that need to be expanded.  Loop through each expression
4991     ** in the result set and expand them one by one.
4992     */
4993     struct ExprList_item *a = pEList->a;
4994     ExprList *pNew = 0;
4995     int flags = pParse->db->flags;
4996     int longNames = (flags & SQLITE_FullColNames)!=0
4997                       && (flags & SQLITE_ShortColNames)==0;
4998 
4999     for(k=0; k<pEList->nExpr; k++){
5000       pE = a[k].pExpr;
5001       elistFlags |= pE->flags;
5002       pRight = pE->pRight;
5003       assert( pE->op!=TK_DOT || pRight!=0 );
5004       if( pE->op!=TK_ASTERISK
5005        && (pE->op!=TK_DOT || pRight->op!=TK_ASTERISK)
5006       ){
5007         /* This particular expression does not need to be expanded.
5008         */
5009         pNew = sqlite3ExprListAppend(pParse, pNew, a[k].pExpr);
5010         if( pNew ){
5011           pNew->a[pNew->nExpr-1].zName = a[k].zName;
5012           pNew->a[pNew->nExpr-1].zSpan = a[k].zSpan;
5013           a[k].zName = 0;
5014           a[k].zSpan = 0;
5015         }
5016         a[k].pExpr = 0;
5017       }else{
5018         /* This expression is a "*" or a "TABLE.*" and needs to be
5019         ** expanded. */
5020         int tableSeen = 0;      /* Set to 1 when TABLE matches */
5021         char *zTName = 0;       /* text of name of TABLE */
5022         if( pE->op==TK_DOT ){
5023           assert( pE->pLeft!=0 );
5024           assert( !ExprHasProperty(pE->pLeft, EP_IntValue) );
5025           zTName = pE->pLeft->u.zToken;
5026         }
5027         for(i=0, pFrom=pTabList->a; i<pTabList->nSrc; i++, pFrom++){
5028           Table *pTab = pFrom->pTab;
5029           Select *pSub = pFrom->pSelect;
5030           char *zTabName = pFrom->zAlias;
5031           const char *zSchemaName = 0;
5032           int iDb;
5033           if( zTabName==0 ){
5034             zTabName = pTab->zName;
5035           }
5036           if( db->mallocFailed ) break;
5037           if( pSub==0 || (pSub->selFlags & SF_NestedFrom)==0 ){
5038             pSub = 0;
5039             if( zTName && sqlite3StrICmp(zTName, zTabName)!=0 ){
5040               continue;
5041             }
5042             iDb = sqlite3SchemaToIndex(db, pTab->pSchema);
5043             zSchemaName = iDb>=0 ? db->aDb[iDb].zDbSName : "*";
5044           }
5045           for(j=0; j<pTab->nCol; j++){
5046             char *zName = pTab->aCol[j].zName;
5047             char *zColname;  /* The computed column name */
5048             char *zToFree;   /* Malloced string that needs to be freed */
5049             Token sColname;  /* Computed column name as a token */
5050 
5051             assert( zName );
5052             if( zTName && pSub
5053              && sqlite3MatchSpanName(pSub->pEList->a[j].zSpan, 0, zTName, 0)==0
5054             ){
5055               continue;
5056             }
5057 
5058             /* If a column is marked as 'hidden', omit it from the expanded
5059             ** result-set list unless the SELECT has the SF_IncludeHidden
5060             ** bit set.
5061             */
5062             if( (p->selFlags & SF_IncludeHidden)==0
5063              && IsHiddenColumn(&pTab->aCol[j])
5064             ){
5065               continue;
5066             }
5067             tableSeen = 1;
5068 
5069             if( i>0 && zTName==0 ){
5070               if( (pFrom->fg.jointype & JT_NATURAL)!=0
5071                 && tableAndColumnIndex(pTabList, i, zName, 0, 0)
5072               ){
5073                 /* In a NATURAL join, omit the join columns from the
5074                 ** table to the right of the join */
5075                 continue;
5076               }
5077               if( sqlite3IdListIndex(pFrom->pUsing, zName)>=0 ){
5078                 /* In a join with a USING clause, omit columns in the
5079                 ** using clause from the table on the right. */
5080                 continue;
5081               }
5082             }
5083             pRight = sqlite3Expr(db, TK_ID, zName);
5084             zColname = zName;
5085             zToFree = 0;
5086             if( longNames || pTabList->nSrc>1 ){
5087               Expr *pLeft;
5088               pLeft = sqlite3Expr(db, TK_ID, zTabName);
5089               pExpr = sqlite3PExpr(pParse, TK_DOT, pLeft, pRight);
5090               if( zSchemaName ){
5091                 pLeft = sqlite3Expr(db, TK_ID, zSchemaName);
5092                 pExpr = sqlite3PExpr(pParse, TK_DOT, pLeft, pExpr);
5093               }
5094               if( longNames ){
5095                 zColname = sqlite3MPrintf(db, "%s.%s", zTabName, zName);
5096                 zToFree = zColname;
5097               }
5098             }else{
5099               pExpr = pRight;
5100             }
5101             pNew = sqlite3ExprListAppend(pParse, pNew, pExpr);
5102             sqlite3TokenInit(&sColname, zColname);
5103             sqlite3ExprListSetName(pParse, pNew, &sColname, 0);
5104             if( pNew && (p->selFlags & SF_NestedFrom)!=0 ){
5105               struct ExprList_item *pX = &pNew->a[pNew->nExpr-1];
5106               if( pSub ){
5107                 pX->zSpan = sqlite3DbStrDup(db, pSub->pEList->a[j].zSpan);
5108                 testcase( pX->zSpan==0 );
5109               }else{
5110                 pX->zSpan = sqlite3MPrintf(db, "%s.%s.%s",
5111                                            zSchemaName, zTabName, zColname);
5112                 testcase( pX->zSpan==0 );
5113               }
5114               pX->bSpanIsTab = 1;
5115             }
5116             sqlite3DbFree(db, zToFree);
5117           }
5118         }
5119         if( !tableSeen ){
5120           if( zTName ){
5121             sqlite3ErrorMsg(pParse, "no such table: %s", zTName);
5122           }else{
5123             sqlite3ErrorMsg(pParse, "no tables specified");
5124           }
5125         }
5126       }
5127     }
5128     sqlite3ExprListDelete(db, pEList);
5129     p->pEList = pNew;
5130   }
5131   if( p->pEList ){
5132     if( p->pEList->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
5133       sqlite3ErrorMsg(pParse, "too many columns in result set");
5134       return WRC_Abort;
5135     }
5136     if( (elistFlags & (EP_HasFunc|EP_Subquery))!=0 ){
5137       p->selFlags |= SF_ComplexResult;
5138     }
5139   }
5140   return WRC_Continue;
5141 }
5142 
5143 /*
5144 ** No-op routine for the parse-tree walker.
5145 **
5146 ** When this routine is the Walker.xExprCallback then expression trees
5147 ** are walked without any actions being taken at each node.  Presumably,
5148 ** when this routine is used for Walker.xExprCallback then
5149 ** Walker.xSelectCallback is set to do something useful for every
5150 ** subquery in the parser tree.
5151 */
5152 int sqlite3ExprWalkNoop(Walker *NotUsed, Expr *NotUsed2){
5153   UNUSED_PARAMETER2(NotUsed, NotUsed2);
5154   return WRC_Continue;
5155 }
5156 
5157 /*
5158 ** No-op routine for the parse-tree walker for SELECT statements.
5159 ** subquery in the parser tree.
5160 */
5161 int sqlite3SelectWalkNoop(Walker *NotUsed, Select *NotUsed2){
5162   UNUSED_PARAMETER2(NotUsed, NotUsed2);
5163   return WRC_Continue;
5164 }
5165 
5166 #if SQLITE_DEBUG
5167 /*
5168 ** Always assert.  This xSelectCallback2 implementation proves that the
5169 ** xSelectCallback2 is never invoked.
5170 */
5171 void sqlite3SelectWalkAssert2(Walker *NotUsed, Select *NotUsed2){
5172   UNUSED_PARAMETER2(NotUsed, NotUsed2);
5173   assert( 0 );
5174 }
5175 #endif
5176 /*
5177 ** This routine "expands" a SELECT statement and all of its subqueries.
5178 ** For additional information on what it means to "expand" a SELECT
5179 ** statement, see the comment on the selectExpand worker callback above.
5180 **
5181 ** Expanding a SELECT statement is the first step in processing a
5182 ** SELECT statement.  The SELECT statement must be expanded before
5183 ** name resolution is performed.
5184 **
5185 ** If anything goes wrong, an error message is written into pParse.
5186 ** The calling function can detect the problem by looking at pParse->nErr
5187 ** and/or pParse->db->mallocFailed.
5188 */
5189 static void sqlite3SelectExpand(Parse *pParse, Select *pSelect){
5190   Walker w;
5191   w.xExprCallback = sqlite3ExprWalkNoop;
5192   w.pParse = pParse;
5193   if( OK_IF_ALWAYS_TRUE(pParse->hasCompound) ){
5194     w.xSelectCallback = convertCompoundSelectToSubquery;
5195     w.xSelectCallback2 = 0;
5196     sqlite3WalkSelect(&w, pSelect);
5197   }
5198   w.xSelectCallback = selectExpander;
5199   w.xSelectCallback2 = selectPopWith;
5200   w.eCode = 0;
5201   sqlite3WalkSelect(&w, pSelect);
5202 }
5203 
5204 
5205 #ifndef SQLITE_OMIT_SUBQUERY
5206 /*
5207 ** This is a Walker.xSelectCallback callback for the sqlite3SelectTypeInfo()
5208 ** interface.
5209 **
5210 ** For each FROM-clause subquery, add Column.zType and Column.zColl
5211 ** information to the Table structure that represents the result set
5212 ** of that subquery.
5213 **
5214 ** The Table structure that represents the result set was constructed
5215 ** by selectExpander() but the type and collation information was omitted
5216 ** at that point because identifiers had not yet been resolved.  This
5217 ** routine is called after identifier resolution.
5218 */
5219 static void selectAddSubqueryTypeInfo(Walker *pWalker, Select *p){
5220   Parse *pParse;
5221   int i;
5222   SrcList *pTabList;
5223   struct SrcList_item *pFrom;
5224 
5225   assert( p->selFlags & SF_Resolved );
5226   if( p->selFlags & SF_HasTypeInfo ) return;
5227   p->selFlags |= SF_HasTypeInfo;
5228   pParse = pWalker->pParse;
5229   pTabList = p->pSrc;
5230   for(i=0, pFrom=pTabList->a; i<pTabList->nSrc; i++, pFrom++){
5231     Table *pTab = pFrom->pTab;
5232     assert( pTab!=0 );
5233     if( (pTab->tabFlags & TF_Ephemeral)!=0 ){
5234       /* A sub-query in the FROM clause of a SELECT */
5235       Select *pSel = pFrom->pSelect;
5236       if( pSel ){
5237         while( pSel->pPrior ) pSel = pSel->pPrior;
5238         sqlite3SelectAddColumnTypeAndCollation(pParse, pTab, pSel,
5239                                                SQLITE_AFF_NONE);
5240       }
5241     }
5242   }
5243 }
5244 #endif
5245 
5246 
5247 /*
5248 ** This routine adds datatype and collating sequence information to
5249 ** the Table structures of all FROM-clause subqueries in a
5250 ** SELECT statement.
5251 **
5252 ** Use this routine after name resolution.
5253 */
5254 static void sqlite3SelectAddTypeInfo(Parse *pParse, Select *pSelect){
5255 #ifndef SQLITE_OMIT_SUBQUERY
5256   Walker w;
5257   w.xSelectCallback = sqlite3SelectWalkNoop;
5258   w.xSelectCallback2 = selectAddSubqueryTypeInfo;
5259   w.xExprCallback = sqlite3ExprWalkNoop;
5260   w.pParse = pParse;
5261   sqlite3WalkSelect(&w, pSelect);
5262 #endif
5263 }
5264 
5265 
5266 /*
5267 ** This routine sets up a SELECT statement for processing.  The
5268 ** following is accomplished:
5269 **
5270 **     *  VDBE Cursor numbers are assigned to all FROM-clause terms.
5271 **     *  Ephemeral Table objects are created for all FROM-clause subqueries.
5272 **     *  ON and USING clauses are shifted into WHERE statements
5273 **     *  Wildcards "*" and "TABLE.*" in result sets are expanded.
5274 **     *  Identifiers in expression are matched to tables.
5275 **
5276 ** This routine acts recursively on all subqueries within the SELECT.
5277 */
5278 void sqlite3SelectPrep(
5279   Parse *pParse,         /* The parser context */
5280   Select *p,             /* The SELECT statement being coded. */
5281   NameContext *pOuterNC  /* Name context for container */
5282 ){
5283   assert( p!=0 || pParse->db->mallocFailed );
5284   if( pParse->db->mallocFailed ) return;
5285   if( p->selFlags & SF_HasTypeInfo ) return;
5286   sqlite3SelectExpand(pParse, p);
5287   if( pParse->nErr || pParse->db->mallocFailed ) return;
5288   sqlite3ResolveSelectNames(pParse, p, pOuterNC);
5289   if( pParse->nErr || pParse->db->mallocFailed ) return;
5290   sqlite3SelectAddTypeInfo(pParse, p);
5291 }
5292 
5293 /*
5294 ** Reset the aggregate accumulator.
5295 **
5296 ** The aggregate accumulator is a set of memory cells that hold
5297 ** intermediate results while calculating an aggregate.  This
5298 ** routine generates code that stores NULLs in all of those memory
5299 ** cells.
5300 */
5301 static void resetAccumulator(Parse *pParse, AggInfo *pAggInfo){
5302   Vdbe *v = pParse->pVdbe;
5303   int i;
5304   struct AggInfo_func *pFunc;
5305   int nReg = pAggInfo->nFunc + pAggInfo->nColumn;
5306   if( nReg==0 ) return;
5307 #ifdef SQLITE_DEBUG
5308   /* Verify that all AggInfo registers are within the range specified by
5309   ** AggInfo.mnReg..AggInfo.mxReg */
5310   assert( nReg==pAggInfo->mxReg-pAggInfo->mnReg+1 );
5311   for(i=0; i<pAggInfo->nColumn; i++){
5312     assert( pAggInfo->aCol[i].iMem>=pAggInfo->mnReg
5313          && pAggInfo->aCol[i].iMem<=pAggInfo->mxReg );
5314   }
5315   for(i=0; i<pAggInfo->nFunc; i++){
5316     assert( pAggInfo->aFunc[i].iMem>=pAggInfo->mnReg
5317          && pAggInfo->aFunc[i].iMem<=pAggInfo->mxReg );
5318   }
5319 #endif
5320   sqlite3VdbeAddOp3(v, OP_Null, 0, pAggInfo->mnReg, pAggInfo->mxReg);
5321   for(pFunc=pAggInfo->aFunc, i=0; i<pAggInfo->nFunc; i++, pFunc++){
5322     if( pFunc->iDistinct>=0 ){
5323       Expr *pE = pFunc->pExpr;
5324       assert( !ExprHasProperty(pE, EP_xIsSelect) );
5325       if( pE->x.pList==0 || pE->x.pList->nExpr!=1 ){
5326         sqlite3ErrorMsg(pParse, "DISTINCT aggregates must have exactly one "
5327            "argument");
5328         pFunc->iDistinct = -1;
5329       }else{
5330         KeyInfo *pKeyInfo = sqlite3KeyInfoFromExprList(pParse, pE->x.pList,0,0);
5331         sqlite3VdbeAddOp4(v, OP_OpenEphemeral, pFunc->iDistinct, 0, 0,
5332                           (char*)pKeyInfo, P4_KEYINFO);
5333       }
5334     }
5335   }
5336 }
5337 
5338 /*
5339 ** Invoke the OP_AggFinalize opcode for every aggregate function
5340 ** in the AggInfo structure.
5341 */
5342 static void finalizeAggFunctions(Parse *pParse, AggInfo *pAggInfo){
5343   Vdbe *v = pParse->pVdbe;
5344   int i;
5345   struct AggInfo_func *pF;
5346   for(i=0, pF=pAggInfo->aFunc; i<pAggInfo->nFunc; i++, pF++){
5347     ExprList *pList = pF->pExpr->x.pList;
5348     assert( !ExprHasProperty(pF->pExpr, EP_xIsSelect) );
5349     sqlite3VdbeAddOp2(v, OP_AggFinal, pF->iMem, pList ? pList->nExpr : 0);
5350     sqlite3VdbeAppendP4(v, pF->pFunc, P4_FUNCDEF);
5351   }
5352 }
5353 
5354 
5355 /*
5356 ** Update the accumulator memory cells for an aggregate based on
5357 ** the current cursor position.
5358 **
5359 ** If regAcc is non-zero and there are no min() or max() aggregates
5360 ** in pAggInfo, then only populate the pAggInfo->nAccumulator accumulator
5361 ** registers if register regAcc contains 0. The caller will take care
5362 ** of setting and clearing regAcc.
5363 */
5364 static void updateAccumulator(Parse *pParse, int regAcc, AggInfo *pAggInfo){
5365   Vdbe *v = pParse->pVdbe;
5366   int i;
5367   int regHit = 0;
5368   int addrHitTest = 0;
5369   struct AggInfo_func *pF;
5370   struct AggInfo_col *pC;
5371 
5372   pAggInfo->directMode = 1;
5373   for(i=0, pF=pAggInfo->aFunc; i<pAggInfo->nFunc; i++, pF++){
5374     int nArg;
5375     int addrNext = 0;
5376     int regAgg;
5377     ExprList *pList = pF->pExpr->x.pList;
5378     assert( !ExprHasProperty(pF->pExpr, EP_xIsSelect) );
5379     assert( !IsWindowFunc(pF->pExpr) );
5380     if( ExprHasProperty(pF->pExpr, EP_WinFunc) ){
5381       Expr *pFilter = pF->pExpr->y.pWin->pFilter;
5382       if( pAggInfo->nAccumulator
5383        && (pF->pFunc->funcFlags & SQLITE_FUNC_NEEDCOLL)
5384       ){
5385         if( regHit==0 ) regHit = ++pParse->nMem;
5386         /* If this is the first row of the group (regAcc==0), clear the
5387         ** "magnet" register regHit so that the accumulator registers
5388         ** are populated if the FILTER clause jumps over the the
5389         ** invocation of min() or max() altogether. Or, if this is not
5390         ** the first row (regAcc==1), set the magnet register so that the
5391         ** accumulators are not populated unless the min()/max() is invoked and
5392         ** indicates that they should be.  */
5393         sqlite3VdbeAddOp2(v, OP_Copy, regAcc, regHit);
5394       }
5395       addrNext = sqlite3VdbeMakeLabel(pParse);
5396       sqlite3ExprIfFalse(pParse, pFilter, addrNext, SQLITE_JUMPIFNULL);
5397     }
5398     if( pList ){
5399       nArg = pList->nExpr;
5400       regAgg = sqlite3GetTempRange(pParse, nArg);
5401       sqlite3ExprCodeExprList(pParse, pList, regAgg, 0, SQLITE_ECEL_DUP);
5402     }else{
5403       nArg = 0;
5404       regAgg = 0;
5405     }
5406     if( pF->iDistinct>=0 ){
5407       if( addrNext==0 ){
5408         addrNext = sqlite3VdbeMakeLabel(pParse);
5409       }
5410       testcase( nArg==0 );  /* Error condition */
5411       testcase( nArg>1 );   /* Also an error */
5412       codeDistinct(pParse, pF->iDistinct, addrNext, 1, regAgg);
5413     }
5414     if( pF->pFunc->funcFlags & SQLITE_FUNC_NEEDCOLL ){
5415       CollSeq *pColl = 0;
5416       struct ExprList_item *pItem;
5417       int j;
5418       assert( pList!=0 );  /* pList!=0 if pF->pFunc has NEEDCOLL */
5419       for(j=0, pItem=pList->a; !pColl && j<nArg; j++, pItem++){
5420         pColl = sqlite3ExprCollSeq(pParse, pItem->pExpr);
5421       }
5422       if( !pColl ){
5423         pColl = pParse->db->pDfltColl;
5424       }
5425       if( regHit==0 && pAggInfo->nAccumulator ) regHit = ++pParse->nMem;
5426       sqlite3VdbeAddOp4(v, OP_CollSeq, regHit, 0, 0, (char *)pColl, P4_COLLSEQ);
5427     }
5428     sqlite3VdbeAddOp3(v, OP_AggStep, 0, regAgg, pF->iMem);
5429     sqlite3VdbeAppendP4(v, pF->pFunc, P4_FUNCDEF);
5430     sqlite3VdbeChangeP5(v, (u8)nArg);
5431     sqlite3ReleaseTempRange(pParse, regAgg, nArg);
5432     if( addrNext ){
5433       sqlite3VdbeResolveLabel(v, addrNext);
5434     }
5435   }
5436   if( regHit==0 && pAggInfo->nAccumulator ){
5437     regHit = regAcc;
5438   }
5439   if( regHit ){
5440     addrHitTest = sqlite3VdbeAddOp1(v, OP_If, regHit); VdbeCoverage(v);
5441   }
5442   for(i=0, pC=pAggInfo->aCol; i<pAggInfo->nAccumulator; i++, pC++){
5443     sqlite3ExprCode(pParse, pC->pExpr, pC->iMem);
5444   }
5445 
5446   pAggInfo->directMode = 0;
5447   if( addrHitTest ){
5448     sqlite3VdbeJumpHere(v, addrHitTest);
5449   }
5450 }
5451 
5452 /*
5453 ** Add a single OP_Explain instruction to the VDBE to explain a simple
5454 ** count(*) query ("SELECT count(*) FROM pTab").
5455 */
5456 #ifndef SQLITE_OMIT_EXPLAIN
5457 static void explainSimpleCount(
5458   Parse *pParse,                  /* Parse context */
5459   Table *pTab,                    /* Table being queried */
5460   Index *pIdx                     /* Index used to optimize scan, or NULL */
5461 ){
5462   if( pParse->explain==2 ){
5463     int bCover = (pIdx!=0 && (HasRowid(pTab) || !IsPrimaryKeyIndex(pIdx)));
5464     sqlite3VdbeExplain(pParse, 0, "SCAN TABLE %s%s%s",
5465         pTab->zName,
5466         bCover ? " USING COVERING INDEX " : "",
5467         bCover ? pIdx->zName : ""
5468     );
5469   }
5470 }
5471 #else
5472 # define explainSimpleCount(a,b,c)
5473 #endif
5474 
5475 /*
5476 ** sqlite3WalkExpr() callback used by havingToWhere().
5477 **
5478 ** If the node passed to the callback is a TK_AND node, return
5479 ** WRC_Continue to tell sqlite3WalkExpr() to iterate through child nodes.
5480 **
5481 ** Otherwise, return WRC_Prune. In this case, also check if the
5482 ** sub-expression matches the criteria for being moved to the WHERE
5483 ** clause. If so, add it to the WHERE clause and replace the sub-expression
5484 ** within the HAVING expression with a constant "1".
5485 */
5486 static int havingToWhereExprCb(Walker *pWalker, Expr *pExpr){
5487   if( pExpr->op!=TK_AND ){
5488     Select *pS = pWalker->u.pSelect;
5489     if( sqlite3ExprIsConstantOrGroupBy(pWalker->pParse, pExpr, pS->pGroupBy) ){
5490       sqlite3 *db = pWalker->pParse->db;
5491       Expr *pNew = sqlite3Expr(db, TK_INTEGER, "1");
5492       if( pNew ){
5493         Expr *pWhere = pS->pWhere;
5494         SWAP(Expr, *pNew, *pExpr);
5495         pNew = sqlite3ExprAnd(pWalker->pParse, pWhere, pNew);
5496         pS->pWhere = pNew;
5497         pWalker->eCode = 1;
5498       }
5499     }
5500     return WRC_Prune;
5501   }
5502   return WRC_Continue;
5503 }
5504 
5505 /*
5506 ** Transfer eligible terms from the HAVING clause of a query, which is
5507 ** processed after grouping, to the WHERE clause, which is processed before
5508 ** grouping. For example, the query:
5509 **
5510 **   SELECT * FROM <tables> WHERE a=? GROUP BY b HAVING b=? AND c=?
5511 **
5512 ** can be rewritten as:
5513 **
5514 **   SELECT * FROM <tables> WHERE a=? AND b=? GROUP BY b HAVING c=?
5515 **
5516 ** A term of the HAVING expression is eligible for transfer if it consists
5517 ** entirely of constants and expressions that are also GROUP BY terms that
5518 ** use the "BINARY" collation sequence.
5519 */
5520 static void havingToWhere(Parse *pParse, Select *p){
5521   Walker sWalker;
5522   memset(&sWalker, 0, sizeof(sWalker));
5523   sWalker.pParse = pParse;
5524   sWalker.xExprCallback = havingToWhereExprCb;
5525   sWalker.u.pSelect = p;
5526   sqlite3WalkExpr(&sWalker, p->pHaving);
5527 #if SELECTTRACE_ENABLED
5528   if( sWalker.eCode && (sqlite3SelectTrace & 0x100)!=0 ){
5529     SELECTTRACE(0x100,pParse,p,("Move HAVING terms into WHERE:\n"));
5530     sqlite3TreeViewSelect(0, p, 0);
5531   }
5532 #endif
5533 }
5534 
5535 /*
5536 ** Check to see if the pThis entry of pTabList is a self-join of a prior view.
5537 ** If it is, then return the SrcList_item for the prior view.  If it is not,
5538 ** then return 0.
5539 */
5540 static struct SrcList_item *isSelfJoinView(
5541   SrcList *pTabList,           /* Search for self-joins in this FROM clause */
5542   struct SrcList_item *pThis   /* Search for prior reference to this subquery */
5543 ){
5544   struct SrcList_item *pItem;
5545   for(pItem = pTabList->a; pItem<pThis; pItem++){
5546     Select *pS1;
5547     if( pItem->pSelect==0 ) continue;
5548     if( pItem->fg.viaCoroutine ) continue;
5549     if( pItem->zName==0 ) continue;
5550     assert( pItem->pTab!=0 );
5551     assert( pThis->pTab!=0 );
5552     if( pItem->pTab->pSchema!=pThis->pTab->pSchema ) continue;
5553     if( sqlite3_stricmp(pItem->zName, pThis->zName)!=0 ) continue;
5554     pS1 = pItem->pSelect;
5555     if( pItem->pTab->pSchema==0 && pThis->pSelect->selId!=pS1->selId ){
5556       /* The query flattener left two different CTE tables with identical
5557       ** names in the same FROM clause. */
5558       continue;
5559     }
5560     if( sqlite3ExprCompare(0, pThis->pSelect->pWhere, pS1->pWhere, -1)
5561      || sqlite3ExprCompare(0, pThis->pSelect->pHaving, pS1->pHaving, -1)
5562     ){
5563       /* The view was modified by some other optimization such as
5564       ** pushDownWhereTerms() */
5565       continue;
5566     }
5567     return pItem;
5568   }
5569   return 0;
5570 }
5571 
5572 #ifdef SQLITE_COUNTOFVIEW_OPTIMIZATION
5573 /*
5574 ** Attempt to transform a query of the form
5575 **
5576 **    SELECT count(*) FROM (SELECT x FROM t1 UNION ALL SELECT y FROM t2)
5577 **
5578 ** Into this:
5579 **
5580 **    SELECT (SELECT count(*) FROM t1)+(SELECT count(*) FROM t2)
5581 **
5582 ** The transformation only works if all of the following are true:
5583 **
5584 **   *  The subquery is a UNION ALL of two or more terms
5585 **   *  The subquery does not have a LIMIT clause
5586 **   *  There is no WHERE or GROUP BY or HAVING clauses on the subqueries
5587 **   *  The outer query is a simple count(*) with no WHERE clause or other
5588 **      extraneous syntax.
5589 **
5590 ** Return TRUE if the optimization is undertaken.
5591 */
5592 static int countOfViewOptimization(Parse *pParse, Select *p){
5593   Select *pSub, *pPrior;
5594   Expr *pExpr;
5595   Expr *pCount;
5596   sqlite3 *db;
5597   if( (p->selFlags & SF_Aggregate)==0 ) return 0;   /* This is an aggregate */
5598   if( p->pEList->nExpr!=1 ) return 0;               /* Single result column */
5599   if( p->pWhere ) return 0;
5600   if( p->pGroupBy ) return 0;
5601   pExpr = p->pEList->a[0].pExpr;
5602   if( pExpr->op!=TK_AGG_FUNCTION ) return 0;        /* Result is an aggregate */
5603   if( sqlite3_stricmp(pExpr->u.zToken,"count") ) return 0;  /* Is count() */
5604   if( pExpr->x.pList!=0 ) return 0;                 /* Must be count(*) */
5605   if( p->pSrc->nSrc!=1 ) return 0;                  /* One table in FROM  */
5606   pSub = p->pSrc->a[0].pSelect;
5607   if( pSub==0 ) return 0;                           /* The FROM is a subquery */
5608   if( pSub->pPrior==0 ) return 0;                   /* Must be a compound ry */
5609   do{
5610     if( pSub->op!=TK_ALL && pSub->pPrior ) return 0;  /* Must be UNION ALL */
5611     if( pSub->pWhere ) return 0;                      /* No WHERE clause */
5612     if( pSub->pLimit ) return 0;                      /* No LIMIT clause */
5613     if( pSub->selFlags & SF_Aggregate ) return 0;     /* Not an aggregate */
5614     pSub = pSub->pPrior;                              /* Repeat over compound */
5615   }while( pSub );
5616 
5617   /* If we reach this point then it is OK to perform the transformation */
5618 
5619   db = pParse->db;
5620   pCount = pExpr;
5621   pExpr = 0;
5622   pSub = p->pSrc->a[0].pSelect;
5623   p->pSrc->a[0].pSelect = 0;
5624   sqlite3SrcListDelete(db, p->pSrc);
5625   p->pSrc = sqlite3DbMallocZero(pParse->db, sizeof(*p->pSrc));
5626   while( pSub ){
5627     Expr *pTerm;
5628     pPrior = pSub->pPrior;
5629     pSub->pPrior = 0;
5630     pSub->pNext = 0;
5631     pSub->selFlags |= SF_Aggregate;
5632     pSub->selFlags &= ~SF_Compound;
5633     pSub->nSelectRow = 0;
5634     sqlite3ExprListDelete(db, pSub->pEList);
5635     pTerm = pPrior ? sqlite3ExprDup(db, pCount, 0) : pCount;
5636     pSub->pEList = sqlite3ExprListAppend(pParse, 0, pTerm);
5637     pTerm = sqlite3PExpr(pParse, TK_SELECT, 0, 0);
5638     sqlite3PExprAddSelect(pParse, pTerm, pSub);
5639     if( pExpr==0 ){
5640       pExpr = pTerm;
5641     }else{
5642       pExpr = sqlite3PExpr(pParse, TK_PLUS, pTerm, pExpr);
5643     }
5644     pSub = pPrior;
5645   }
5646   p->pEList->a[0].pExpr = pExpr;
5647   p->selFlags &= ~SF_Aggregate;
5648 
5649 #if SELECTTRACE_ENABLED
5650   if( sqlite3SelectTrace & 0x400 ){
5651     SELECTTRACE(0x400,pParse,p,("After count-of-view optimization:\n"));
5652     sqlite3TreeViewSelect(0, p, 0);
5653   }
5654 #endif
5655   return 1;
5656 }
5657 #endif /* SQLITE_COUNTOFVIEW_OPTIMIZATION */
5658 
5659 /*
5660 ** Generate code for the SELECT statement given in the p argument.
5661 **
5662 ** The results are returned according to the SelectDest structure.
5663 ** See comments in sqliteInt.h for further information.
5664 **
5665 ** This routine returns the number of errors.  If any errors are
5666 ** encountered, then an appropriate error message is left in
5667 ** pParse->zErrMsg.
5668 **
5669 ** This routine does NOT free the Select structure passed in.  The
5670 ** calling function needs to do that.
5671 */
5672 int sqlite3Select(
5673   Parse *pParse,         /* The parser context */
5674   Select *p,             /* The SELECT statement being coded. */
5675   SelectDest *pDest      /* What to do with the query results */
5676 ){
5677   int i, j;              /* Loop counters */
5678   WhereInfo *pWInfo;     /* Return from sqlite3WhereBegin() */
5679   Vdbe *v;               /* The virtual machine under construction */
5680   int isAgg;             /* True for select lists like "count(*)" */
5681   ExprList *pEList = 0;  /* List of columns to extract. */
5682   SrcList *pTabList;     /* List of tables to select from */
5683   Expr *pWhere;          /* The WHERE clause.  May be NULL */
5684   ExprList *pGroupBy;    /* The GROUP BY clause.  May be NULL */
5685   Expr *pHaving;         /* The HAVING clause.  May be NULL */
5686   int rc = 1;            /* Value to return from this function */
5687   DistinctCtx sDistinct; /* Info on how to code the DISTINCT keyword */
5688   SortCtx sSort;         /* Info on how to code the ORDER BY clause */
5689   AggInfo sAggInfo;      /* Information used by aggregate queries */
5690   int iEnd;              /* Address of the end of the query */
5691   sqlite3 *db;           /* The database connection */
5692   ExprList *pMinMaxOrderBy = 0;  /* Added ORDER BY for min/max queries */
5693   u8 minMaxFlag;                 /* Flag for min/max queries */
5694 
5695   db = pParse->db;
5696   v = sqlite3GetVdbe(pParse);
5697   if( p==0 || db->mallocFailed || pParse->nErr ){
5698     return 1;
5699   }
5700   if( sqlite3AuthCheck(pParse, SQLITE_SELECT, 0, 0, 0) ) return 1;
5701   memset(&sAggInfo, 0, sizeof(sAggInfo));
5702 #if SELECTTRACE_ENABLED
5703   SELECTTRACE(1,pParse,p, ("begin processing:\n", pParse->addrExplain));
5704   if( sqlite3SelectTrace & 0x100 ){
5705     sqlite3TreeViewSelect(0, p, 0);
5706   }
5707 #endif
5708 
5709   assert( p->pOrderBy==0 || pDest->eDest!=SRT_DistFifo );
5710   assert( p->pOrderBy==0 || pDest->eDest!=SRT_Fifo );
5711   assert( p->pOrderBy==0 || pDest->eDest!=SRT_DistQueue );
5712   assert( p->pOrderBy==0 || pDest->eDest!=SRT_Queue );
5713   if( IgnorableOrderby(pDest) ){
5714     assert(pDest->eDest==SRT_Exists || pDest->eDest==SRT_Union ||
5715            pDest->eDest==SRT_Except || pDest->eDest==SRT_Discard ||
5716            pDest->eDest==SRT_Queue  || pDest->eDest==SRT_DistFifo ||
5717            pDest->eDest==SRT_DistQueue || pDest->eDest==SRT_Fifo);
5718     /* If ORDER BY makes no difference in the output then neither does
5719     ** DISTINCT so it can be removed too. */
5720     sqlite3ExprListDelete(db, p->pOrderBy);
5721     p->pOrderBy = 0;
5722     p->selFlags &= ~SF_Distinct;
5723   }
5724   sqlite3SelectPrep(pParse, p, 0);
5725   if( pParse->nErr || db->mallocFailed ){
5726     goto select_end;
5727   }
5728   assert( p->pEList!=0 );
5729 #if SELECTTRACE_ENABLED
5730   if( sqlite3SelectTrace & 0x104 ){
5731     SELECTTRACE(0x104,pParse,p, ("after name resolution:\n"));
5732     sqlite3TreeViewSelect(0, p, 0);
5733   }
5734 #endif
5735 
5736   if( pDest->eDest==SRT_Output ){
5737     generateColumnNames(pParse, p);
5738   }
5739 
5740 #ifndef SQLITE_OMIT_WINDOWFUNC
5741   if( sqlite3WindowRewrite(pParse, p) ){
5742     goto select_end;
5743   }
5744 #if SELECTTRACE_ENABLED
5745   if( p->pWin && (sqlite3SelectTrace & 0x108)!=0 ){
5746     SELECTTRACE(0x104,pParse,p, ("after window rewrite:\n"));
5747     sqlite3TreeViewSelect(0, p, 0);
5748   }
5749 #endif
5750 #endif /* SQLITE_OMIT_WINDOWFUNC */
5751   pTabList = p->pSrc;
5752   isAgg = (p->selFlags & SF_Aggregate)!=0;
5753   memset(&sSort, 0, sizeof(sSort));
5754   sSort.pOrderBy = p->pOrderBy;
5755 
5756   /* Try to various optimizations (flattening subqueries, and strength
5757   ** reduction of join operators) in the FROM clause up into the main query
5758   */
5759 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
5760   for(i=0; !p->pPrior && i<pTabList->nSrc; i++){
5761     struct SrcList_item *pItem = &pTabList->a[i];
5762     Select *pSub = pItem->pSelect;
5763     Table *pTab = pItem->pTab;
5764 
5765     /* Convert LEFT JOIN into JOIN if there are terms of the right table
5766     ** of the LEFT JOIN used in the WHERE clause.
5767     */
5768     if( (pItem->fg.jointype & JT_LEFT)!=0
5769      && sqlite3ExprImpliesNonNullRow(p->pWhere, pItem->iCursor)
5770      && OptimizationEnabled(db, SQLITE_SimplifyJoin)
5771     ){
5772       SELECTTRACE(0x100,pParse,p,
5773                 ("LEFT-JOIN simplifies to JOIN on term %d\n",i));
5774       pItem->fg.jointype &= ~(JT_LEFT|JT_OUTER);
5775       unsetJoinExpr(p->pWhere, pItem->iCursor);
5776     }
5777 
5778     /* No futher action if this term of the FROM clause is no a subquery */
5779     if( pSub==0 ) continue;
5780 
5781     /* Catch mismatch in the declared columns of a view and the number of
5782     ** columns in the SELECT on the RHS */
5783     if( pTab->nCol!=pSub->pEList->nExpr ){
5784       sqlite3ErrorMsg(pParse, "expected %d columns for '%s' but got %d",
5785                       pTab->nCol, pTab->zName, pSub->pEList->nExpr);
5786       goto select_end;
5787     }
5788 
5789     /* Do not try to flatten an aggregate subquery.
5790     **
5791     ** Flattening an aggregate subquery is only possible if the outer query
5792     ** is not a join.  But if the outer query is not a join, then the subquery
5793     ** will be implemented as a co-routine and there is no advantage to
5794     ** flattening in that case.
5795     */
5796     if( (pSub->selFlags & SF_Aggregate)!=0 ) continue;
5797     assert( pSub->pGroupBy==0 );
5798 
5799     /* If the outer query contains a "complex" result set (that is,
5800     ** if the result set of the outer query uses functions or subqueries)
5801     ** and if the subquery contains an ORDER BY clause and if
5802     ** it will be implemented as a co-routine, then do not flatten.  This
5803     ** restriction allows SQL constructs like this:
5804     **
5805     **  SELECT expensive_function(x)
5806     **    FROM (SELECT x FROM tab ORDER BY y LIMIT 10);
5807     **
5808     ** The expensive_function() is only computed on the 10 rows that
5809     ** are output, rather than every row of the table.
5810     **
5811     ** The requirement that the outer query have a complex result set
5812     ** means that flattening does occur on simpler SQL constraints without
5813     ** the expensive_function() like:
5814     **
5815     **  SELECT x FROM (SELECT x FROM tab ORDER BY y LIMIT 10);
5816     */
5817     if( pSub->pOrderBy!=0
5818      && i==0
5819      && (p->selFlags & SF_ComplexResult)!=0
5820      && (pTabList->nSrc==1
5821          || (pTabList->a[1].fg.jointype&(JT_LEFT|JT_CROSS))!=0)
5822     ){
5823       continue;
5824     }
5825 
5826     if( flattenSubquery(pParse, p, i, isAgg) ){
5827       if( pParse->nErr ) goto select_end;
5828       /* This subquery can be absorbed into its parent. */
5829       i = -1;
5830     }
5831     pTabList = p->pSrc;
5832     if( db->mallocFailed ) goto select_end;
5833     if( !IgnorableOrderby(pDest) ){
5834       sSort.pOrderBy = p->pOrderBy;
5835     }
5836   }
5837 #endif
5838 
5839 #ifndef SQLITE_OMIT_COMPOUND_SELECT
5840   /* Handle compound SELECT statements using the separate multiSelect()
5841   ** procedure.
5842   */
5843   if( p->pPrior ){
5844     rc = multiSelect(pParse, p, pDest);
5845 #if SELECTTRACE_ENABLED
5846     SELECTTRACE(0x1,pParse,p,("end compound-select processing\n"));
5847     if( (sqlite3SelectTrace & 0x2000)!=0 && ExplainQueryPlanParent(pParse)==0 ){
5848       sqlite3TreeViewSelect(0, p, 0);
5849     }
5850 #endif
5851     if( p->pNext==0 ) ExplainQueryPlanPop(pParse);
5852     return rc;
5853   }
5854 #endif
5855 
5856   /* Do the WHERE-clause constant propagation optimization if this is
5857   ** a join.  No need to speed time on this operation for non-join queries
5858   ** as the equivalent optimization will be handled by query planner in
5859   ** sqlite3WhereBegin().
5860   */
5861   if( pTabList->nSrc>1
5862    && OptimizationEnabled(db, SQLITE_PropagateConst)
5863    && propagateConstants(pParse, p)
5864   ){
5865 #if SELECTTRACE_ENABLED
5866     if( sqlite3SelectTrace & 0x100 ){
5867       SELECTTRACE(0x100,pParse,p,("After constant propagation:\n"));
5868       sqlite3TreeViewSelect(0, p, 0);
5869     }
5870 #endif
5871   }else{
5872     SELECTTRACE(0x100,pParse,p,("Constant propagation not helpful\n"));
5873   }
5874 
5875 #ifdef SQLITE_COUNTOFVIEW_OPTIMIZATION
5876   if( OptimizationEnabled(db, SQLITE_QueryFlattener|SQLITE_CountOfView)
5877    && countOfViewOptimization(pParse, p)
5878   ){
5879     if( db->mallocFailed ) goto select_end;
5880     pEList = p->pEList;
5881     pTabList = p->pSrc;
5882   }
5883 #endif
5884 
5885   /* For each term in the FROM clause, do two things:
5886   ** (1) Authorized unreferenced tables
5887   ** (2) Generate code for all sub-queries
5888   */
5889   for(i=0; i<pTabList->nSrc; i++){
5890     struct SrcList_item *pItem = &pTabList->a[i];
5891     SelectDest dest;
5892     Select *pSub;
5893 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
5894     const char *zSavedAuthContext;
5895 #endif
5896 
5897     /* Issue SQLITE_READ authorizations with a fake column name for any
5898     ** tables that are referenced but from which no values are extracted.
5899     ** Examples of where these kinds of null SQLITE_READ authorizations
5900     ** would occur:
5901     **
5902     **     SELECT count(*) FROM t1;   -- SQLITE_READ t1.""
5903     **     SELECT t1.* FROM t1, t2;   -- SQLITE_READ t2.""
5904     **
5905     ** The fake column name is an empty string.  It is possible for a table to
5906     ** have a column named by the empty string, in which case there is no way to
5907     ** distinguish between an unreferenced table and an actual reference to the
5908     ** "" column. The original design was for the fake column name to be a NULL,
5909     ** which would be unambiguous.  But legacy authorization callbacks might
5910     ** assume the column name is non-NULL and segfault.  The use of an empty
5911     ** string for the fake column name seems safer.
5912     */
5913     if( pItem->colUsed==0 && pItem->zName!=0 ){
5914       sqlite3AuthCheck(pParse, SQLITE_READ, pItem->zName, "", pItem->zDatabase);
5915     }
5916 
5917 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
5918     /* Generate code for all sub-queries in the FROM clause
5919     */
5920     pSub = pItem->pSelect;
5921     if( pSub==0 ) continue;
5922 
5923     /* The code for a subquery should only be generated once, though it is
5924     ** technically harmless for it to be generated multiple times. The
5925     ** following assert() will detect if something changes to cause
5926     ** the same subquery to be coded multiple times, as a signal to the
5927     ** developers to try to optimize the situation.
5928     **
5929     ** Update 2019-07-24:
5930     ** See ticket https://sqlite.org/src/tktview/c52b09c7f38903b1311cec40.
5931     ** The dbsqlfuzz fuzzer found a case where the same subquery gets
5932     ** coded twice.  So this assert() now becomes a testcase().  It should
5933     ** be very rare, though.
5934     */
5935     testcase( pItem->addrFillSub!=0 );
5936 
5937     /* Increment Parse.nHeight by the height of the largest expression
5938     ** tree referred to by this, the parent select. The child select
5939     ** may contain expression trees of at most
5940     ** (SQLITE_MAX_EXPR_DEPTH-Parse.nHeight) height. This is a bit
5941     ** more conservative than necessary, but much easier than enforcing
5942     ** an exact limit.
5943     */
5944     pParse->nHeight += sqlite3SelectExprHeight(p);
5945 
5946     /* Make copies of constant WHERE-clause terms in the outer query down
5947     ** inside the subquery.  This can help the subquery to run more efficiently.
5948     */
5949     if( OptimizationEnabled(db, SQLITE_PushDown)
5950      && pushDownWhereTerms(pParse, pSub, p->pWhere, pItem->iCursor,
5951                            (pItem->fg.jointype & JT_OUTER)!=0)
5952     ){
5953 #if SELECTTRACE_ENABLED
5954       if( sqlite3SelectTrace & 0x100 ){
5955         SELECTTRACE(0x100,pParse,p,
5956             ("After WHERE-clause push-down into subquery %d:\n", pSub->selId));
5957         sqlite3TreeViewSelect(0, p, 0);
5958       }
5959 #endif
5960     }else{
5961       SELECTTRACE(0x100,pParse,p,("Push-down not possible\n"));
5962     }
5963 
5964     zSavedAuthContext = pParse->zAuthContext;
5965     pParse->zAuthContext = pItem->zName;
5966 
5967     /* Generate code to implement the subquery
5968     **
5969     ** The subquery is implemented as a co-routine if the subquery is
5970     ** guaranteed to be the outer loop (so that it does not need to be
5971     ** computed more than once)
5972     **
5973     ** TODO: Are there other reasons beside (1) to use a co-routine
5974     ** implementation?
5975     */
5976     if( i==0
5977      && (pTabList->nSrc==1
5978             || (pTabList->a[1].fg.jointype&(JT_LEFT|JT_CROSS))!=0)  /* (1) */
5979     ){
5980       /* Implement a co-routine that will return a single row of the result
5981       ** set on each invocation.
5982       */
5983       int addrTop = sqlite3VdbeCurrentAddr(v)+1;
5984 
5985       pItem->regReturn = ++pParse->nMem;
5986       sqlite3VdbeAddOp3(v, OP_InitCoroutine, pItem->regReturn, 0, addrTop);
5987       VdbeComment((v, "%s", pItem->pTab->zName));
5988       pItem->addrFillSub = addrTop;
5989       sqlite3SelectDestInit(&dest, SRT_Coroutine, pItem->regReturn);
5990       ExplainQueryPlan((pParse, 1, "CO-ROUTINE %u", pSub->selId));
5991       sqlite3Select(pParse, pSub, &dest);
5992       pItem->pTab->nRowLogEst = pSub->nSelectRow;
5993       pItem->fg.viaCoroutine = 1;
5994       pItem->regResult = dest.iSdst;
5995       sqlite3VdbeEndCoroutine(v, pItem->regReturn);
5996       sqlite3VdbeJumpHere(v, addrTop-1);
5997       sqlite3ClearTempRegCache(pParse);
5998     }else{
5999       /* Generate a subroutine that will fill an ephemeral table with
6000       ** the content of this subquery.  pItem->addrFillSub will point
6001       ** to the address of the generated subroutine.  pItem->regReturn
6002       ** is a register allocated to hold the subroutine return address
6003       */
6004       int topAddr;
6005       int onceAddr = 0;
6006       int retAddr;
6007       struct SrcList_item *pPrior;
6008 
6009       testcase( pItem->addrFillSub==0 ); /* Ticket c52b09c7f38903b1311 */
6010       pItem->regReturn = ++pParse->nMem;
6011       topAddr = sqlite3VdbeAddOp2(v, OP_Integer, 0, pItem->regReturn);
6012       pItem->addrFillSub = topAddr+1;
6013       if( pItem->fg.isCorrelated==0 ){
6014         /* If the subquery is not correlated and if we are not inside of
6015         ** a trigger, then we only need to compute the value of the subquery
6016         ** once. */
6017         onceAddr = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
6018         VdbeComment((v, "materialize \"%s\"", pItem->pTab->zName));
6019       }else{
6020         VdbeNoopComment((v, "materialize \"%s\"", pItem->pTab->zName));
6021       }
6022       pPrior = isSelfJoinView(pTabList, pItem);
6023       if( pPrior ){
6024         sqlite3VdbeAddOp2(v, OP_OpenDup, pItem->iCursor, pPrior->iCursor);
6025         assert( pPrior->pSelect!=0 );
6026         pSub->nSelectRow = pPrior->pSelect->nSelectRow;
6027       }else{
6028         sqlite3SelectDestInit(&dest, SRT_EphemTab, pItem->iCursor);
6029         ExplainQueryPlan((pParse, 1, "MATERIALIZE %u", pSub->selId));
6030         sqlite3Select(pParse, pSub, &dest);
6031       }
6032       pItem->pTab->nRowLogEst = pSub->nSelectRow;
6033       if( onceAddr ) sqlite3VdbeJumpHere(v, onceAddr);
6034       retAddr = sqlite3VdbeAddOp1(v, OP_Return, pItem->regReturn);
6035       VdbeComment((v, "end %s", pItem->pTab->zName));
6036       sqlite3VdbeChangeP1(v, topAddr, retAddr);
6037       sqlite3ClearTempRegCache(pParse);
6038     }
6039     if( db->mallocFailed ) goto select_end;
6040     pParse->nHeight -= sqlite3SelectExprHeight(p);
6041     pParse->zAuthContext = zSavedAuthContext;
6042 #endif
6043   }
6044 
6045   /* Various elements of the SELECT copied into local variables for
6046   ** convenience */
6047   pEList = p->pEList;
6048   pWhere = p->pWhere;
6049   pGroupBy = p->pGroupBy;
6050   pHaving = p->pHaving;
6051   sDistinct.isTnct = (p->selFlags & SF_Distinct)!=0;
6052 
6053 #if SELECTTRACE_ENABLED
6054   if( sqlite3SelectTrace & 0x400 ){
6055     SELECTTRACE(0x400,pParse,p,("After all FROM-clause analysis:\n"));
6056     sqlite3TreeViewSelect(0, p, 0);
6057   }
6058 #endif
6059 
6060   /* If the query is DISTINCT with an ORDER BY but is not an aggregate, and
6061   ** if the select-list is the same as the ORDER BY list, then this query
6062   ** can be rewritten as a GROUP BY. In other words, this:
6063   **
6064   **     SELECT DISTINCT xyz FROM ... ORDER BY xyz
6065   **
6066   ** is transformed to:
6067   **
6068   **     SELECT xyz FROM ... GROUP BY xyz ORDER BY xyz
6069   **
6070   ** The second form is preferred as a single index (or temp-table) may be
6071   ** used for both the ORDER BY and DISTINCT processing. As originally
6072   ** written the query must use a temp-table for at least one of the ORDER
6073   ** BY and DISTINCT, and an index or separate temp-table for the other.
6074   */
6075   if( (p->selFlags & (SF_Distinct|SF_Aggregate))==SF_Distinct
6076    && sqlite3ExprListCompare(sSort.pOrderBy, pEList, -1)==0
6077    && p->pWin==0
6078   ){
6079     p->selFlags &= ~SF_Distinct;
6080     pGroupBy = p->pGroupBy = sqlite3ExprListDup(db, pEList, 0);
6081     /* Notice that even thought SF_Distinct has been cleared from p->selFlags,
6082     ** the sDistinct.isTnct is still set.  Hence, isTnct represents the
6083     ** original setting of the SF_Distinct flag, not the current setting */
6084     assert( sDistinct.isTnct );
6085 
6086 #if SELECTTRACE_ENABLED
6087     if( sqlite3SelectTrace & 0x400 ){
6088       SELECTTRACE(0x400,pParse,p,("Transform DISTINCT into GROUP BY:\n"));
6089       sqlite3TreeViewSelect(0, p, 0);
6090     }
6091 #endif
6092   }
6093 
6094   /* If there is an ORDER BY clause, then create an ephemeral index to
6095   ** do the sorting.  But this sorting ephemeral index might end up
6096   ** being unused if the data can be extracted in pre-sorted order.
6097   ** If that is the case, then the OP_OpenEphemeral instruction will be
6098   ** changed to an OP_Noop once we figure out that the sorting index is
6099   ** not needed.  The sSort.addrSortIndex variable is used to facilitate
6100   ** that change.
6101   */
6102   if( sSort.pOrderBy ){
6103     KeyInfo *pKeyInfo;
6104     pKeyInfo = sqlite3KeyInfoFromExprList(
6105         pParse, sSort.pOrderBy, 0, pEList->nExpr);
6106     sSort.iECursor = pParse->nTab++;
6107     sSort.addrSortIndex =
6108       sqlite3VdbeAddOp4(v, OP_OpenEphemeral,
6109           sSort.iECursor, sSort.pOrderBy->nExpr+1+pEList->nExpr, 0,
6110           (char*)pKeyInfo, P4_KEYINFO
6111       );
6112   }else{
6113     sSort.addrSortIndex = -1;
6114   }
6115 
6116   /* If the output is destined for a temporary table, open that table.
6117   */
6118   if( pDest->eDest==SRT_EphemTab ){
6119     sqlite3VdbeAddOp2(v, OP_OpenEphemeral, pDest->iSDParm, pEList->nExpr);
6120   }
6121 
6122   /* Set the limiter.
6123   */
6124   iEnd = sqlite3VdbeMakeLabel(pParse);
6125   if( (p->selFlags & SF_FixedLimit)==0 ){
6126     p->nSelectRow = 320;  /* 4 billion rows */
6127   }
6128   computeLimitRegisters(pParse, p, iEnd);
6129   if( p->iLimit==0 && sSort.addrSortIndex>=0 ){
6130     sqlite3VdbeChangeOpcode(v, sSort.addrSortIndex, OP_SorterOpen);
6131     sSort.sortFlags |= SORTFLAG_UseSorter;
6132   }
6133 
6134   /* Open an ephemeral index to use for the distinct set.
6135   */
6136   if( p->selFlags & SF_Distinct ){
6137     sDistinct.tabTnct = pParse->nTab++;
6138     sDistinct.addrTnct = sqlite3VdbeAddOp4(v, OP_OpenEphemeral,
6139                        sDistinct.tabTnct, 0, 0,
6140                        (char*)sqlite3KeyInfoFromExprList(pParse, p->pEList,0,0),
6141                        P4_KEYINFO);
6142     sqlite3VdbeChangeP5(v, BTREE_UNORDERED);
6143     sDistinct.eTnctType = WHERE_DISTINCT_UNORDERED;
6144   }else{
6145     sDistinct.eTnctType = WHERE_DISTINCT_NOOP;
6146   }
6147 
6148   if( !isAgg && pGroupBy==0 ){
6149     /* No aggregate functions and no GROUP BY clause */
6150     u16 wctrlFlags = (sDistinct.isTnct ? WHERE_WANT_DISTINCT : 0)
6151                    | (p->selFlags & SF_FixedLimit);
6152 #ifndef SQLITE_OMIT_WINDOWFUNC
6153     Window *pWin = p->pWin;      /* Master window object (or NULL) */
6154     if( pWin ){
6155       sqlite3WindowCodeInit(pParse, pWin);
6156     }
6157 #endif
6158     assert( WHERE_USE_LIMIT==SF_FixedLimit );
6159 
6160 
6161     /* Begin the database scan. */
6162     SELECTTRACE(1,pParse,p,("WhereBegin\n"));
6163     pWInfo = sqlite3WhereBegin(pParse, pTabList, pWhere, sSort.pOrderBy,
6164                                p->pEList, wctrlFlags, p->nSelectRow);
6165     if( pWInfo==0 ) goto select_end;
6166     if( sqlite3WhereOutputRowCount(pWInfo) < p->nSelectRow ){
6167       p->nSelectRow = sqlite3WhereOutputRowCount(pWInfo);
6168     }
6169     if( sDistinct.isTnct && sqlite3WhereIsDistinct(pWInfo) ){
6170       sDistinct.eTnctType = sqlite3WhereIsDistinct(pWInfo);
6171     }
6172     if( sSort.pOrderBy ){
6173       sSort.nOBSat = sqlite3WhereIsOrdered(pWInfo);
6174       sSort.labelOBLopt = sqlite3WhereOrderByLimitOptLabel(pWInfo);
6175       if( sSort.nOBSat==sSort.pOrderBy->nExpr ){
6176         sSort.pOrderBy = 0;
6177       }
6178     }
6179 
6180     /* If sorting index that was created by a prior OP_OpenEphemeral
6181     ** instruction ended up not being needed, then change the OP_OpenEphemeral
6182     ** into an OP_Noop.
6183     */
6184     if( sSort.addrSortIndex>=0 && sSort.pOrderBy==0 ){
6185       sqlite3VdbeChangeToNoop(v, sSort.addrSortIndex);
6186     }
6187 
6188     assert( p->pEList==pEList );
6189 #ifndef SQLITE_OMIT_WINDOWFUNC
6190     if( pWin ){
6191       int addrGosub = sqlite3VdbeMakeLabel(pParse);
6192       int iCont = sqlite3VdbeMakeLabel(pParse);
6193       int iBreak = sqlite3VdbeMakeLabel(pParse);
6194       int regGosub = ++pParse->nMem;
6195 
6196       sqlite3WindowCodeStep(pParse, p, pWInfo, regGosub, addrGosub);
6197 
6198       sqlite3VdbeAddOp2(v, OP_Goto, 0, iBreak);
6199       sqlite3VdbeResolveLabel(v, addrGosub);
6200       VdbeNoopComment((v, "inner-loop subroutine"));
6201       sSort.labelOBLopt = 0;
6202       selectInnerLoop(pParse, p, -1, &sSort, &sDistinct, pDest, iCont, iBreak);
6203       sqlite3VdbeResolveLabel(v, iCont);
6204       sqlite3VdbeAddOp1(v, OP_Return, regGosub);
6205       VdbeComment((v, "end inner-loop subroutine"));
6206       sqlite3VdbeResolveLabel(v, iBreak);
6207     }else
6208 #endif /* SQLITE_OMIT_WINDOWFUNC */
6209     {
6210       /* Use the standard inner loop. */
6211       selectInnerLoop(pParse, p, -1, &sSort, &sDistinct, pDest,
6212           sqlite3WhereContinueLabel(pWInfo),
6213           sqlite3WhereBreakLabel(pWInfo));
6214 
6215       /* End the database scan loop.
6216       */
6217       sqlite3WhereEnd(pWInfo);
6218     }
6219   }else{
6220     /* This case when there exist aggregate functions or a GROUP BY clause
6221     ** or both */
6222     NameContext sNC;    /* Name context for processing aggregate information */
6223     int iAMem;          /* First Mem address for storing current GROUP BY */
6224     int iBMem;          /* First Mem address for previous GROUP BY */
6225     int iUseFlag;       /* Mem address holding flag indicating that at least
6226                         ** one row of the input to the aggregator has been
6227                         ** processed */
6228     int iAbortFlag;     /* Mem address which causes query abort if positive */
6229     int groupBySort;    /* Rows come from source in GROUP BY order */
6230     int addrEnd;        /* End of processing for this SELECT */
6231     int sortPTab = 0;   /* Pseudotable used to decode sorting results */
6232     int sortOut = 0;    /* Output register from the sorter */
6233     int orderByGrp = 0; /* True if the GROUP BY and ORDER BY are the same */
6234 
6235     /* Remove any and all aliases between the result set and the
6236     ** GROUP BY clause.
6237     */
6238     if( pGroupBy ){
6239       int k;                        /* Loop counter */
6240       struct ExprList_item *pItem;  /* For looping over expression in a list */
6241 
6242       for(k=p->pEList->nExpr, pItem=p->pEList->a; k>0; k--, pItem++){
6243         pItem->u.x.iAlias = 0;
6244       }
6245       for(k=pGroupBy->nExpr, pItem=pGroupBy->a; k>0; k--, pItem++){
6246         pItem->u.x.iAlias = 0;
6247       }
6248       assert( 66==sqlite3LogEst(100) );
6249       if( p->nSelectRow>66 ) p->nSelectRow = 66;
6250 
6251       /* If there is both a GROUP BY and an ORDER BY clause and they are
6252       ** identical, then it may be possible to disable the ORDER BY clause
6253       ** on the grounds that the GROUP BY will cause elements to come out
6254       ** in the correct order. It also may not - the GROUP BY might use a
6255       ** database index that causes rows to be grouped together as required
6256       ** but not actually sorted. Either way, record the fact that the
6257       ** ORDER BY and GROUP BY clauses are the same by setting the orderByGrp
6258       ** variable.  */
6259       if( sSort.pOrderBy && pGroupBy->nExpr==sSort.pOrderBy->nExpr ){
6260         int ii;
6261         /* The GROUP BY processing doesn't care whether rows are delivered in
6262         ** ASC or DESC order - only that each group is returned contiguously.
6263         ** So set the ASC/DESC flags in the GROUP BY to match those in the
6264         ** ORDER BY to maximize the chances of rows being delivered in an
6265         ** order that makes the ORDER BY redundant.  */
6266         for(ii=0; ii<pGroupBy->nExpr; ii++){
6267           u8 sortFlags = sSort.pOrderBy->a[ii].sortFlags & KEYINFO_ORDER_DESC;
6268           pGroupBy->a[ii].sortFlags = sortFlags;
6269         }
6270         if( sqlite3ExprListCompare(pGroupBy, sSort.pOrderBy, -1)==0 ){
6271           orderByGrp = 1;
6272         }
6273       }
6274     }else{
6275       assert( 0==sqlite3LogEst(1) );
6276       p->nSelectRow = 0;
6277     }
6278 
6279     /* Create a label to jump to when we want to abort the query */
6280     addrEnd = sqlite3VdbeMakeLabel(pParse);
6281 
6282     /* Convert TK_COLUMN nodes into TK_AGG_COLUMN and make entries in
6283     ** sAggInfo for all TK_AGG_FUNCTION nodes in expressions of the
6284     ** SELECT statement.
6285     */
6286     memset(&sNC, 0, sizeof(sNC));
6287     sNC.pParse = pParse;
6288     sNC.pSrcList = pTabList;
6289     sNC.uNC.pAggInfo = &sAggInfo;
6290     VVA_ONLY( sNC.ncFlags = NC_UAggInfo; )
6291     sAggInfo.mnReg = pParse->nMem+1;
6292     sAggInfo.nSortingColumn = pGroupBy ? pGroupBy->nExpr : 0;
6293     sAggInfo.pGroupBy = pGroupBy;
6294     sqlite3ExprAnalyzeAggList(&sNC, pEList);
6295     sqlite3ExprAnalyzeAggList(&sNC, sSort.pOrderBy);
6296     if( pHaving ){
6297       if( pGroupBy ){
6298         assert( pWhere==p->pWhere );
6299         assert( pHaving==p->pHaving );
6300         assert( pGroupBy==p->pGroupBy );
6301         havingToWhere(pParse, p);
6302         pWhere = p->pWhere;
6303       }
6304       sqlite3ExprAnalyzeAggregates(&sNC, pHaving);
6305     }
6306     sAggInfo.nAccumulator = sAggInfo.nColumn;
6307     if( p->pGroupBy==0 && p->pHaving==0 && sAggInfo.nFunc==1 ){
6308       minMaxFlag = minMaxQuery(db, sAggInfo.aFunc[0].pExpr, &pMinMaxOrderBy);
6309     }else{
6310       minMaxFlag = WHERE_ORDERBY_NORMAL;
6311     }
6312     for(i=0; i<sAggInfo.nFunc; i++){
6313       Expr *pExpr = sAggInfo.aFunc[i].pExpr;
6314       assert( !ExprHasProperty(pExpr, EP_xIsSelect) );
6315       sNC.ncFlags |= NC_InAggFunc;
6316       sqlite3ExprAnalyzeAggList(&sNC, pExpr->x.pList);
6317 #ifndef SQLITE_OMIT_WINDOWFUNC
6318       assert( !IsWindowFunc(pExpr) );
6319       if( ExprHasProperty(pExpr, EP_WinFunc) ){
6320         sqlite3ExprAnalyzeAggregates(&sNC, pExpr->y.pWin->pFilter);
6321       }
6322 #endif
6323       sNC.ncFlags &= ~NC_InAggFunc;
6324     }
6325     sAggInfo.mxReg = pParse->nMem;
6326     if( db->mallocFailed ) goto select_end;
6327 #if SELECTTRACE_ENABLED
6328     if( sqlite3SelectTrace & 0x400 ){
6329       int ii;
6330       SELECTTRACE(0x400,pParse,p,("After aggregate analysis:\n"));
6331       sqlite3TreeViewSelect(0, p, 0);
6332       for(ii=0; ii<sAggInfo.nColumn; ii++){
6333         sqlite3DebugPrintf("agg-column[%d] iMem=%d\n",
6334             ii, sAggInfo.aCol[ii].iMem);
6335         sqlite3TreeViewExpr(0, sAggInfo.aCol[ii].pExpr, 0);
6336       }
6337       for(ii=0; ii<sAggInfo.nFunc; ii++){
6338         sqlite3DebugPrintf("agg-func[%d]: iMem=%d\n",
6339             ii, sAggInfo.aFunc[ii].iMem);
6340         sqlite3TreeViewExpr(0, sAggInfo.aFunc[ii].pExpr, 0);
6341       }
6342     }
6343 #endif
6344 
6345 
6346     /* Processing for aggregates with GROUP BY is very different and
6347     ** much more complex than aggregates without a GROUP BY.
6348     */
6349     if( pGroupBy ){
6350       KeyInfo *pKeyInfo;  /* Keying information for the group by clause */
6351       int addr1;          /* A-vs-B comparision jump */
6352       int addrOutputRow;  /* Start of subroutine that outputs a result row */
6353       int regOutputRow;   /* Return address register for output subroutine */
6354       int addrSetAbort;   /* Set the abort flag and return */
6355       int addrTopOfLoop;  /* Top of the input loop */
6356       int addrSortingIdx; /* The OP_OpenEphemeral for the sorting index */
6357       int addrReset;      /* Subroutine for resetting the accumulator */
6358       int regReset;       /* Return address register for reset subroutine */
6359 
6360       /* If there is a GROUP BY clause we might need a sorting index to
6361       ** implement it.  Allocate that sorting index now.  If it turns out
6362       ** that we do not need it after all, the OP_SorterOpen instruction
6363       ** will be converted into a Noop.
6364       */
6365       sAggInfo.sortingIdx = pParse->nTab++;
6366       pKeyInfo = sqlite3KeyInfoFromExprList(pParse,pGroupBy,0,sAggInfo.nColumn);
6367       addrSortingIdx = sqlite3VdbeAddOp4(v, OP_SorterOpen,
6368           sAggInfo.sortingIdx, sAggInfo.nSortingColumn,
6369           0, (char*)pKeyInfo, P4_KEYINFO);
6370 
6371       /* Initialize memory locations used by GROUP BY aggregate processing
6372       */
6373       iUseFlag = ++pParse->nMem;
6374       iAbortFlag = ++pParse->nMem;
6375       regOutputRow = ++pParse->nMem;
6376       addrOutputRow = sqlite3VdbeMakeLabel(pParse);
6377       regReset = ++pParse->nMem;
6378       addrReset = sqlite3VdbeMakeLabel(pParse);
6379       iAMem = pParse->nMem + 1;
6380       pParse->nMem += pGroupBy->nExpr;
6381       iBMem = pParse->nMem + 1;
6382       pParse->nMem += pGroupBy->nExpr;
6383       sqlite3VdbeAddOp2(v, OP_Integer, 0, iAbortFlag);
6384       VdbeComment((v, "clear abort flag"));
6385       sqlite3VdbeAddOp3(v, OP_Null, 0, iAMem, iAMem+pGroupBy->nExpr-1);
6386 
6387       /* Begin a loop that will extract all source rows in GROUP BY order.
6388       ** This might involve two separate loops with an OP_Sort in between, or
6389       ** it might be a single loop that uses an index to extract information
6390       ** in the right order to begin with.
6391       */
6392       sqlite3VdbeAddOp2(v, OP_Gosub, regReset, addrReset);
6393       SELECTTRACE(1,pParse,p,("WhereBegin\n"));
6394       pWInfo = sqlite3WhereBegin(pParse, pTabList, pWhere, pGroupBy, 0,
6395           WHERE_GROUPBY | (orderByGrp ? WHERE_SORTBYGROUP : 0), 0
6396       );
6397       if( pWInfo==0 ) goto select_end;
6398       if( sqlite3WhereIsOrdered(pWInfo)==pGroupBy->nExpr ){
6399         /* The optimizer is able to deliver rows in group by order so
6400         ** we do not have to sort.  The OP_OpenEphemeral table will be
6401         ** cancelled later because we still need to use the pKeyInfo
6402         */
6403         groupBySort = 0;
6404       }else{
6405         /* Rows are coming out in undetermined order.  We have to push
6406         ** each row into a sorting index, terminate the first loop,
6407         ** then loop over the sorting index in order to get the output
6408         ** in sorted order
6409         */
6410         int regBase;
6411         int regRecord;
6412         int nCol;
6413         int nGroupBy;
6414 
6415         explainTempTable(pParse,
6416             (sDistinct.isTnct && (p->selFlags&SF_Distinct)==0) ?
6417                     "DISTINCT" : "GROUP BY");
6418 
6419         groupBySort = 1;
6420         nGroupBy = pGroupBy->nExpr;
6421         nCol = nGroupBy;
6422         j = nGroupBy;
6423         for(i=0; i<sAggInfo.nColumn; i++){
6424           if( sAggInfo.aCol[i].iSorterColumn>=j ){
6425             nCol++;
6426             j++;
6427           }
6428         }
6429         regBase = sqlite3GetTempRange(pParse, nCol);
6430         sqlite3ExprCodeExprList(pParse, pGroupBy, regBase, 0, 0);
6431         j = nGroupBy;
6432         for(i=0; i<sAggInfo.nColumn; i++){
6433           struct AggInfo_col *pCol = &sAggInfo.aCol[i];
6434           if( pCol->iSorterColumn>=j ){
6435             int r1 = j + regBase;
6436             sqlite3ExprCodeGetColumnOfTable(v,
6437                                pCol->pTab, pCol->iTable, pCol->iColumn, r1);
6438             j++;
6439           }
6440         }
6441         regRecord = sqlite3GetTempReg(pParse);
6442         sqlite3VdbeAddOp3(v, OP_MakeRecord, regBase, nCol, regRecord);
6443         sqlite3VdbeAddOp2(v, OP_SorterInsert, sAggInfo.sortingIdx, regRecord);
6444         sqlite3ReleaseTempReg(pParse, regRecord);
6445         sqlite3ReleaseTempRange(pParse, regBase, nCol);
6446         sqlite3WhereEnd(pWInfo);
6447         sAggInfo.sortingIdxPTab = sortPTab = pParse->nTab++;
6448         sortOut = sqlite3GetTempReg(pParse);
6449         sqlite3VdbeAddOp3(v, OP_OpenPseudo, sortPTab, sortOut, nCol);
6450         sqlite3VdbeAddOp2(v, OP_SorterSort, sAggInfo.sortingIdx, addrEnd);
6451         VdbeComment((v, "GROUP BY sort")); VdbeCoverage(v);
6452         sAggInfo.useSortingIdx = 1;
6453       }
6454 
6455       /* If the index or temporary table used by the GROUP BY sort
6456       ** will naturally deliver rows in the order required by the ORDER BY
6457       ** clause, cancel the ephemeral table open coded earlier.
6458       **
6459       ** This is an optimization - the correct answer should result regardless.
6460       ** Use the SQLITE_GroupByOrder flag with SQLITE_TESTCTRL_OPTIMIZER to
6461       ** disable this optimization for testing purposes.  */
6462       if( orderByGrp && OptimizationEnabled(db, SQLITE_GroupByOrder)
6463        && (groupBySort || sqlite3WhereIsSorted(pWInfo))
6464       ){
6465         sSort.pOrderBy = 0;
6466         sqlite3VdbeChangeToNoop(v, sSort.addrSortIndex);
6467       }
6468 
6469       /* Evaluate the current GROUP BY terms and store in b0, b1, b2...
6470       ** (b0 is memory location iBMem+0, b1 is iBMem+1, and so forth)
6471       ** Then compare the current GROUP BY terms against the GROUP BY terms
6472       ** from the previous row currently stored in a0, a1, a2...
6473       */
6474       addrTopOfLoop = sqlite3VdbeCurrentAddr(v);
6475       if( groupBySort ){
6476         sqlite3VdbeAddOp3(v, OP_SorterData, sAggInfo.sortingIdx,
6477                           sortOut, sortPTab);
6478       }
6479       for(j=0; j<pGroupBy->nExpr; j++){
6480         if( groupBySort ){
6481           sqlite3VdbeAddOp3(v, OP_Column, sortPTab, j, iBMem+j);
6482         }else{
6483           sAggInfo.directMode = 1;
6484           sqlite3ExprCode(pParse, pGroupBy->a[j].pExpr, iBMem+j);
6485         }
6486       }
6487       sqlite3VdbeAddOp4(v, OP_Compare, iAMem, iBMem, pGroupBy->nExpr,
6488                           (char*)sqlite3KeyInfoRef(pKeyInfo), P4_KEYINFO);
6489       addr1 = sqlite3VdbeCurrentAddr(v);
6490       sqlite3VdbeAddOp3(v, OP_Jump, addr1+1, 0, addr1+1); VdbeCoverage(v);
6491 
6492       /* Generate code that runs whenever the GROUP BY changes.
6493       ** Changes in the GROUP BY are detected by the previous code
6494       ** block.  If there were no changes, this block is skipped.
6495       **
6496       ** This code copies current group by terms in b0,b1,b2,...
6497       ** over to a0,a1,a2.  It then calls the output subroutine
6498       ** and resets the aggregate accumulator registers in preparation
6499       ** for the next GROUP BY batch.
6500       */
6501       sqlite3ExprCodeMove(pParse, iBMem, iAMem, pGroupBy->nExpr);
6502       sqlite3VdbeAddOp2(v, OP_Gosub, regOutputRow, addrOutputRow);
6503       VdbeComment((v, "output one row"));
6504       sqlite3VdbeAddOp2(v, OP_IfPos, iAbortFlag, addrEnd); VdbeCoverage(v);
6505       VdbeComment((v, "check abort flag"));
6506       sqlite3VdbeAddOp2(v, OP_Gosub, regReset, addrReset);
6507       VdbeComment((v, "reset accumulator"));
6508 
6509       /* Update the aggregate accumulators based on the content of
6510       ** the current row
6511       */
6512       sqlite3VdbeJumpHere(v, addr1);
6513       updateAccumulator(pParse, iUseFlag, &sAggInfo);
6514       sqlite3VdbeAddOp2(v, OP_Integer, 1, iUseFlag);
6515       VdbeComment((v, "indicate data in accumulator"));
6516 
6517       /* End of the loop
6518       */
6519       if( groupBySort ){
6520         sqlite3VdbeAddOp2(v, OP_SorterNext, sAggInfo.sortingIdx, addrTopOfLoop);
6521         VdbeCoverage(v);
6522       }else{
6523         sqlite3WhereEnd(pWInfo);
6524         sqlite3VdbeChangeToNoop(v, addrSortingIdx);
6525       }
6526 
6527       /* Output the final row of result
6528       */
6529       sqlite3VdbeAddOp2(v, OP_Gosub, regOutputRow, addrOutputRow);
6530       VdbeComment((v, "output final row"));
6531 
6532       /* Jump over the subroutines
6533       */
6534       sqlite3VdbeGoto(v, addrEnd);
6535 
6536       /* Generate a subroutine that outputs a single row of the result
6537       ** set.  This subroutine first looks at the iUseFlag.  If iUseFlag
6538       ** is less than or equal to zero, the subroutine is a no-op.  If
6539       ** the processing calls for the query to abort, this subroutine
6540       ** increments the iAbortFlag memory location before returning in
6541       ** order to signal the caller to abort.
6542       */
6543       addrSetAbort = sqlite3VdbeCurrentAddr(v);
6544       sqlite3VdbeAddOp2(v, OP_Integer, 1, iAbortFlag);
6545       VdbeComment((v, "set abort flag"));
6546       sqlite3VdbeAddOp1(v, OP_Return, regOutputRow);
6547       sqlite3VdbeResolveLabel(v, addrOutputRow);
6548       addrOutputRow = sqlite3VdbeCurrentAddr(v);
6549       sqlite3VdbeAddOp2(v, OP_IfPos, iUseFlag, addrOutputRow+2);
6550       VdbeCoverage(v);
6551       VdbeComment((v, "Groupby result generator entry point"));
6552       sqlite3VdbeAddOp1(v, OP_Return, regOutputRow);
6553       finalizeAggFunctions(pParse, &sAggInfo);
6554       sqlite3ExprIfFalse(pParse, pHaving, addrOutputRow+1, SQLITE_JUMPIFNULL);
6555       selectInnerLoop(pParse, p, -1, &sSort,
6556                       &sDistinct, pDest,
6557                       addrOutputRow+1, addrSetAbort);
6558       sqlite3VdbeAddOp1(v, OP_Return, regOutputRow);
6559       VdbeComment((v, "end groupby result generator"));
6560 
6561       /* Generate a subroutine that will reset the group-by accumulator
6562       */
6563       sqlite3VdbeResolveLabel(v, addrReset);
6564       resetAccumulator(pParse, &sAggInfo);
6565       sqlite3VdbeAddOp2(v, OP_Integer, 0, iUseFlag);
6566       VdbeComment((v, "indicate accumulator empty"));
6567       sqlite3VdbeAddOp1(v, OP_Return, regReset);
6568 
6569     } /* endif pGroupBy.  Begin aggregate queries without GROUP BY: */
6570     else {
6571 #ifndef SQLITE_OMIT_BTREECOUNT
6572       Table *pTab;
6573       if( (pTab = isSimpleCount(p, &sAggInfo))!=0 ){
6574         /* If isSimpleCount() returns a pointer to a Table structure, then
6575         ** the SQL statement is of the form:
6576         **
6577         **   SELECT count(*) FROM <tbl>
6578         **
6579         ** where the Table structure returned represents table <tbl>.
6580         **
6581         ** This statement is so common that it is optimized specially. The
6582         ** OP_Count instruction is executed either on the intkey table that
6583         ** contains the data for table <tbl> or on one of its indexes. It
6584         ** is better to execute the op on an index, as indexes are almost
6585         ** always spread across less pages than their corresponding tables.
6586         */
6587         const int iDb = sqlite3SchemaToIndex(pParse->db, pTab->pSchema);
6588         const int iCsr = pParse->nTab++;     /* Cursor to scan b-tree */
6589         Index *pIdx;                         /* Iterator variable */
6590         KeyInfo *pKeyInfo = 0;               /* Keyinfo for scanned index */
6591         Index *pBest = 0;                    /* Best index found so far */
6592         int iRoot = pTab->tnum;              /* Root page of scanned b-tree */
6593 
6594         sqlite3CodeVerifySchema(pParse, iDb);
6595         sqlite3TableLock(pParse, iDb, pTab->tnum, 0, pTab->zName);
6596 
6597         /* Search for the index that has the lowest scan cost.
6598         **
6599         ** (2011-04-15) Do not do a full scan of an unordered index.
6600         **
6601         ** (2013-10-03) Do not count the entries in a partial index.
6602         **
6603         ** In practice the KeyInfo structure will not be used. It is only
6604         ** passed to keep OP_OpenRead happy.
6605         */
6606         if( !HasRowid(pTab) ) pBest = sqlite3PrimaryKeyIndex(pTab);
6607         for(pIdx=pTab->pIndex; pIdx; pIdx=pIdx->pNext){
6608           if( pIdx->bUnordered==0
6609            && pIdx->szIdxRow<pTab->szTabRow
6610            && pIdx->pPartIdxWhere==0
6611            && (!pBest || pIdx->szIdxRow<pBest->szIdxRow)
6612           ){
6613             pBest = pIdx;
6614           }
6615         }
6616         if( pBest ){
6617           iRoot = pBest->tnum;
6618           pKeyInfo = sqlite3KeyInfoOfIndex(pParse, pBest);
6619         }
6620 
6621         /* Open a read-only cursor, execute the OP_Count, close the cursor. */
6622         sqlite3VdbeAddOp4Int(v, OP_OpenRead, iCsr, iRoot, iDb, 1);
6623         if( pKeyInfo ){
6624           sqlite3VdbeChangeP4(v, -1, (char *)pKeyInfo, P4_KEYINFO);
6625         }
6626         sqlite3VdbeAddOp2(v, OP_Count, iCsr, sAggInfo.aFunc[0].iMem);
6627         sqlite3VdbeAddOp1(v, OP_Close, iCsr);
6628         explainSimpleCount(pParse, pTab, pBest);
6629       }else
6630 #endif /* SQLITE_OMIT_BTREECOUNT */
6631       {
6632         int regAcc = 0;           /* "populate accumulators" flag */
6633 
6634         /* If there are accumulator registers but no min() or max() functions
6635         ** without FILTER clauses, allocate register regAcc. Register regAcc
6636         ** will contain 0 the first time the inner loop runs, and 1 thereafter.
6637         ** The code generated by updateAccumulator() uses this to ensure
6638         ** that the accumulator registers are (a) updated only once if
6639         ** there are no min() or max functions or (b) always updated for the
6640         ** first row visited by the aggregate, so that they are updated at
6641         ** least once even if the FILTER clause means the min() or max()
6642         ** function visits zero rows.  */
6643         if( sAggInfo.nAccumulator ){
6644           for(i=0; i<sAggInfo.nFunc; i++){
6645             if( ExprHasProperty(sAggInfo.aFunc[i].pExpr, EP_WinFunc) ) continue;
6646             if( sAggInfo.aFunc[i].pFunc->funcFlags&SQLITE_FUNC_NEEDCOLL ) break;
6647           }
6648           if( i==sAggInfo.nFunc ){
6649             regAcc = ++pParse->nMem;
6650             sqlite3VdbeAddOp2(v, OP_Integer, 0, regAcc);
6651           }
6652         }
6653 
6654         /* This case runs if the aggregate has no GROUP BY clause.  The
6655         ** processing is much simpler since there is only a single row
6656         ** of output.
6657         */
6658         assert( p->pGroupBy==0 );
6659         resetAccumulator(pParse, &sAggInfo);
6660 
6661         /* If this query is a candidate for the min/max optimization, then
6662         ** minMaxFlag will have been previously set to either
6663         ** WHERE_ORDERBY_MIN or WHERE_ORDERBY_MAX and pMinMaxOrderBy will
6664         ** be an appropriate ORDER BY expression for the optimization.
6665         */
6666         assert( minMaxFlag==WHERE_ORDERBY_NORMAL || pMinMaxOrderBy!=0 );
6667         assert( pMinMaxOrderBy==0 || pMinMaxOrderBy->nExpr==1 );
6668 
6669         SELECTTRACE(1,pParse,p,("WhereBegin\n"));
6670         pWInfo = sqlite3WhereBegin(pParse, pTabList, pWhere, pMinMaxOrderBy,
6671                                    0, minMaxFlag, 0);
6672         if( pWInfo==0 ){
6673           goto select_end;
6674         }
6675         updateAccumulator(pParse, regAcc, &sAggInfo);
6676         if( regAcc ) sqlite3VdbeAddOp2(v, OP_Integer, 1, regAcc);
6677         if( sqlite3WhereIsOrdered(pWInfo)>0 ){
6678           sqlite3VdbeGoto(v, sqlite3WhereBreakLabel(pWInfo));
6679           VdbeComment((v, "%s() by index",
6680                 (minMaxFlag==WHERE_ORDERBY_MIN?"min":"max")));
6681         }
6682         sqlite3WhereEnd(pWInfo);
6683         finalizeAggFunctions(pParse, &sAggInfo);
6684       }
6685 
6686       sSort.pOrderBy = 0;
6687       sqlite3ExprIfFalse(pParse, pHaving, addrEnd, SQLITE_JUMPIFNULL);
6688       selectInnerLoop(pParse, p, -1, 0, 0,
6689                       pDest, addrEnd, addrEnd);
6690     }
6691     sqlite3VdbeResolveLabel(v, addrEnd);
6692 
6693   } /* endif aggregate query */
6694 
6695   if( sDistinct.eTnctType==WHERE_DISTINCT_UNORDERED ){
6696     explainTempTable(pParse, "DISTINCT");
6697   }
6698 
6699   /* If there is an ORDER BY clause, then we need to sort the results
6700   ** and send them to the callback one by one.
6701   */
6702   if( sSort.pOrderBy ){
6703     explainTempTable(pParse,
6704                      sSort.nOBSat>0 ? "RIGHT PART OF ORDER BY":"ORDER BY");
6705     assert( p->pEList==pEList );
6706     generateSortTail(pParse, p, &sSort, pEList->nExpr, pDest);
6707   }
6708 
6709   /* Jump here to skip this query
6710   */
6711   sqlite3VdbeResolveLabel(v, iEnd);
6712 
6713   /* The SELECT has been coded. If there is an error in the Parse structure,
6714   ** set the return code to 1. Otherwise 0. */
6715   rc = (pParse->nErr>0);
6716 
6717   /* Control jumps to here if an error is encountered above, or upon
6718   ** successful coding of the SELECT.
6719   */
6720 select_end:
6721   sqlite3ExprListDelete(db, pMinMaxOrderBy);
6722   sqlite3DbFree(db, sAggInfo.aCol);
6723   sqlite3DbFree(db, sAggInfo.aFunc);
6724 #if SELECTTRACE_ENABLED
6725   SELECTTRACE(0x1,pParse,p,("end processing\n"));
6726   if( (sqlite3SelectTrace & 0x2000)!=0 && ExplainQueryPlanParent(pParse)==0 ){
6727     sqlite3TreeViewSelect(0, p, 0);
6728   }
6729 #endif
6730   ExplainQueryPlanPop(pParse);
6731   return rc;
6732 }
6733