xref: /sqlite-3.40.0/src/vdbe.c (revision c023e03e)
1 /*
2 ** 2001 September 15
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 ** The code in this file implements the Virtual Database Engine (VDBE)
13 **
14 ** The SQL parser generates a program which is then executed by
15 ** the VDBE to do the work of the SQL statement.  VDBE programs are
16 ** similar in form to assembly language.  The program consists of
17 ** a linear sequence of operations.  Each operation has an opcode
18 ** and 3 operands.  Operands P1 and P2 are integers.  Operand P3
19 ** is a null-terminated string.   The P2 operand must be non-negative.
20 ** Opcodes will typically ignore one or more operands.  Many opcodes
21 ** ignore all three operands.
22 **
23 ** Computation results are stored on a stack.  Each entry on the
24 ** stack is either an integer, a null-terminated string, a floating point
25 ** number, or the SQL "NULL" value.  An inplicit conversion from one
26 ** type to the other occurs as necessary.
27 **
28 ** Most of the code in this file is taken up by the sqliteVdbeExec()
29 ** function which does the work of interpreting a VDBE program.
30 ** But other routines are also provided to help in building up
31 ** a program instruction by instruction.
32 **
33 ** Various scripts scan this source file in order to generate HTML
34 ** documentation, headers files, or other derived files.  The formatting
35 ** of the code in this file is, therefore, important.  See other comments
36 ** in this file for details.  If in doubt, do not deviate from existing
37 ** commenting and indentation practices when changing or adding code.
38 **
39 ** $Id: vdbe.c,v 1.237 2003/08/26 11:35:00 drh Exp $
40 */
41 #include "sqliteInt.h"
42 #include "os.h"
43 #include <ctype.h>
44 
45 /*
46 ** The makefile scans this source file and creates the following
47 ** array of string constants which are the names of all VDBE opcodes.
48 ** This array is defined in a separate source code file named opcode.c
49 ** which is automatically generated by the makefile.
50 */
51 extern char *sqliteOpcodeNames[];
52 
53 /*
54 ** The following global variable is incremented every time a cursor
55 ** moves, either by the OP_MoveTo or the OP_Next opcode.  The test
56 ** procedures use this information to make sure that indices are
57 ** working correctly.  This variable has no function other than to
58 ** help verify the correct operation of the library.
59 */
60 int sqlite_search_count = 0;
61 
62 /*
63 ** SQL is translated into a sequence of instructions to be
64 ** executed by a virtual machine.  Each instruction is an instance
65 ** of the following structure.
66 */
67 typedef struct VdbeOp Op;
68 
69 /*
70 ** Boolean values
71 */
72 typedef unsigned char Bool;
73 
74 /*
75 ** A cursor is a pointer into a single BTree within a database file.
76 ** The cursor can seek to a BTree entry with a particular key, or
77 ** loop over all entries of the Btree.  You can also insert new BTree
78 ** entries or retrieve the key or data from the entry that the cursor
79 ** is currently pointing to.
80 **
81 ** Every cursor that the virtual machine has open is represented by an
82 ** instance of the following structure.
83 **
84 ** If the Cursor.isTriggerRow flag is set it means that this cursor is
85 ** really a single row that represents the NEW or OLD pseudo-table of
86 ** a row trigger.  The data for the row is stored in Cursor.pData and
87 ** the rowid is in Cursor.iKey.
88 */
89 struct Cursor {
90   BtCursor *pCursor;    /* The cursor structure of the backend */
91   int lastRecno;        /* Last recno from a Next or NextIdx operation */
92   int nextRowid;        /* Next rowid returned by OP_NewRowid */
93   Bool recnoIsValid;    /* True if lastRecno is valid */
94   Bool keyAsData;       /* The OP_Column command works on key instead of data */
95   Bool atFirst;         /* True if pointing to first entry */
96   Bool useRandomRowid;  /* Generate new record numbers semi-randomly */
97   Bool nullRow;         /* True if pointing to a row with no data */
98   Bool nextRowidValid;  /* True if the nextRowid field is valid */
99   Bool pseudoTable;     /* This is a NEW or OLD pseudo-tables of a trigger */
100   Btree *pBt;           /* Separate file holding temporary table */
101   int nData;            /* Number of bytes in pData */
102   char *pData;          /* Data for a NEW or OLD pseudo-table */
103   int iKey;             /* Key for the NEW or OLD pseudo-table row */
104 };
105 typedef struct Cursor Cursor;
106 
107 /*
108 ** A sorter builds a list of elements to be sorted.  Each element of
109 ** the list is an instance of the following structure.
110 */
111 typedef struct Sorter Sorter;
112 struct Sorter {
113   int nKey;           /* Number of bytes in the key */
114   char *zKey;         /* The key by which we will sort */
115   int nData;          /* Number of bytes in the data */
116   char *pData;        /* The data associated with this key */
117   Sorter *pNext;      /* Next in the list */
118 };
119 
120 /*
121 ** Number of buckets used for merge-sort.
122 */
123 #define NSORT 30
124 
125 /*
126 ** Number of bytes of string storage space available to each stack
127 ** layer without having to malloc.  NBFS is short for Number of Bytes
128 ** For Strings.
129 */
130 #define NBFS 32
131 
132 /*
133 ** A single level of the stack is an instance of the following
134 ** structure.  Except, string values are stored on a separate
135 ** list of of pointers to character.  The reason for storing
136 ** strings separately is so that they can be easily passed
137 ** to the callback function.
138 */
139 struct Stack {
140   int i;         /* Integer value */
141   int n;         /* Number of characters in string value, including '\0' */
142   int flags;     /* Some combination of STK_Null, STK_Str, STK_Dyn, etc. */
143   double r;      /* Real value */
144   char z[NBFS];  /* Space for short strings */
145 };
146 typedef struct Stack Stack;
147 
148 /*
149 ** Memory cells use the same structure as the stack except that space
150 ** for an arbitrary string is added.
151 */
152 struct Mem {
153   Stack s;       /* All values of the memory cell besides string */
154   char *z;       /* String value for this memory cell */
155 };
156 typedef struct Mem Mem;
157 
158 /*
159 ** Allowed values for Stack.flags
160 */
161 #define STK_Null      0x0001   /* Value is NULL */
162 #define STK_Str       0x0002   /* Value is a string */
163 #define STK_Int       0x0004   /* Value is an integer */
164 #define STK_Real      0x0008   /* Value is a real number */
165 #define STK_Dyn       0x0010   /* Need to call sqliteFree() on zStack[] */
166 #define STK_Static    0x0020   /* zStack[] points to a static string */
167 #define STK_Ephem     0x0040   /* zStack[] points to an ephemeral string */
168 
169 /* The following STK_ value appears only in AggElem.aMem.s.flag fields.
170 ** It indicates that the corresponding AggElem.aMem.z points to a
171 ** aggregate function context that needs to be finalized.
172 */
173 #define STK_AggCtx    0x0040   /* zStack[] points to an agg function context */
174 
175 /*
176 ** The "context" argument for a installable function.  A pointer to an
177 ** instance of this structure is the first argument to the routines used
178 ** implement the SQL functions.
179 **
180 ** There is a typedef for this structure in sqlite.h.  So all routines,
181 ** even the public interface to SQLite, can use a pointer to this structure.
182 ** But this file is the only place where the internal details of this
183 ** structure are known.
184 **
185 ** This structure is defined inside of vdbe.c because it uses substructures
186 ** (Stack) which are only defined there.
187 */
188 struct sqlite_func {
189   FuncDef *pFunc;   /* Pointer to function information.  MUST BE FIRST */
190   Stack s;          /* Small strings, ints, and double values go here */
191   char *z;          /* Space for holding dynamic string results */
192   void *pAgg;       /* Aggregate context */
193   u8 isError;       /* Set to true for an error */
194   u8 isStep;        /* Current in the step function */
195   int cnt;          /* Number of times that the step function has been called */
196 };
197 
198 /*
199 ** An Agg structure describes an Aggregator.  Each Agg consists of
200 ** zero or more Aggregator elements (AggElem).  Each AggElem contains
201 ** a key and one or more values.  The values are used in processing
202 ** aggregate functions in a SELECT.  The key is used to implement
203 ** the GROUP BY clause of a select.
204 */
205 typedef struct Agg Agg;
206 typedef struct AggElem AggElem;
207 struct Agg {
208   int nMem;            /* Number of values stored in each AggElem */
209   AggElem *pCurrent;   /* The AggElem currently in focus */
210   HashElem *pSearch;   /* The hash element for pCurrent */
211   Hash hash;           /* Hash table of all aggregate elements */
212   FuncDef **apFunc;    /* Information about aggregate functions */
213 };
214 struct AggElem {
215   char *zKey;          /* The key to this AggElem */
216   int nKey;            /* Number of bytes in the key, including '\0' at end */
217   Mem aMem[1];         /* The values for this AggElem */
218 };
219 
220 /*
221 ** A Set structure is used for quick testing to see if a value
222 ** is part of a small set.  Sets are used to implement code like
223 ** this:
224 **            x.y IN ('hi','hoo','hum')
225 */
226 typedef struct Set Set;
227 struct Set {
228   Hash hash;             /* A set is just a hash table */
229   HashElem *prev;        /* Previously accessed hash elemen */
230 };
231 
232 /*
233 ** A Keylist is a bunch of keys into a table.  The keylist can
234 ** grow without bound.  The keylist stores the ROWIDs of database
235 ** records that need to be deleted or updated.
236 */
237 typedef struct Keylist Keylist;
238 struct Keylist {
239   int nKey;         /* Number of slots in aKey[] */
240   int nUsed;        /* Next unwritten slot in aKey[] */
241   int nRead;        /* Next unread slot in aKey[] */
242   Keylist *pNext;   /* Next block of keys */
243   int aKey[1];      /* One or more keys.  Extra space allocated as needed */
244 };
245 
246 /*
247 ** An instance of the virtual machine.  This structure contains the complete
248 ** state of the virtual machine.
249 **
250 ** The "sqlite_vm" structure pointer that is returned by sqlite_compile()
251 ** is really a pointer to an instance of this structure.
252 */
253 struct Vdbe {
254   sqlite *db;         /* The whole database */
255   Vdbe *pPrev,*pNext; /* Linked list of VDBEs with the same Vdbe.db */
256   FILE *trace;        /* Write an execution trace here, if not NULL */
257   int nOp;            /* Number of instructions in the program */
258   int nOpAlloc;       /* Number of slots allocated for aOp[] */
259   Op *aOp;            /* Space to hold the virtual machine's program */
260   int nLabel;         /* Number of labels used */
261   int nLabelAlloc;    /* Number of slots allocated in aLabel[] */
262   int *aLabel;        /* Space to hold the labels */
263   int tos;            /* Index of top of stack */
264   Stack *aStack;      /* The operand stack, except string values */
265   char **zStack;      /* Text or binary values of the stack */
266   char **azColName;   /* Becomes the 4th parameter to callbacks */
267   int nCursor;        /* Number of slots in aCsr[] */
268   Cursor *aCsr;       /* One element of this array for each open cursor */
269   Sorter *pSort;      /* A linked list of objects to be sorted */
270   FILE *pFile;        /* At most one open file handler */
271   int nField;         /* Number of file fields */
272   char **azField;     /* Data for each file field */
273   char *zLine;            /* A single line from the input file */
274   int magic;              /* Magic number for sanity checking */
275   int nLineAlloc;         /* Number of spaces allocated for zLine */
276   int nMem;               /* Number of memory locations currently allocated */
277   Mem *aMem;              /* The memory locations */
278   Agg agg;                /* Aggregate information */
279   int nSet;               /* Number of sets allocated */
280   Set *aSet;              /* An array of sets */
281   int nCallback;          /* Number of callbacks invoked so far */
282   Keylist *pList;         /* A list of ROWIDs */
283   int keylistStackDepth;  /* The size of the "keylist" stack */
284   Keylist **keylistStack; /* The stack used by opcodes ListPush & ListPop */
285   int pc;                 /* The program counter */
286   int rc;                 /* Value to return */
287   unsigned uniqueCnt;     /* Used by OP_MakeRecord when P2!=0 */
288   int errorAction;        /* Recovery action to do in case of an error */
289   int undoTransOnError;   /* If error, either ROLLBACK or COMMIT */
290   int inTempTrans;        /* True if temp database is transactioned */
291   int returnStack[100];   /* Return address stack for OP_Gosub & OP_Return */
292   int returnDepth;        /* Next unused element in returnStack[] */
293   int nResColumn;         /* Number of columns in one row of the result set */
294   char **azResColumn;                        /* Values for one row of result */
295   int (*xCallback)(void*,int,char**,char**); /* Callback for SELECT results */
296   void *pCbArg;                              /* First argument to xCallback() */
297   int popStack;           /* Pop the stack this much on entry to VdbeExec() */
298   char *zErrMsg;          /* Error message written here */
299   u8 explain;             /* True if EXPLAIN present on SQL command */
300 };
301 
302 /*
303 ** The following are allowed values for Vdbe.magic
304 */
305 #define VDBE_MAGIC_INIT     0x26bceaa5    /* Building a VDBE program */
306 #define VDBE_MAGIC_RUN      0xbdf20da3    /* VDBE is ready to execute */
307 #define VDBE_MAGIC_HALT     0x519c2973    /* VDBE has completed execution */
308 #define VDBE_MAGIC_DEAD     0xb606c3c8    /* The VDBE has been deallocated */
309 
310 /*
311 ** When debugging the code generator in a symbolic debugger, one can
312 ** set the sqlite_vdbe_addop_trace to 1 and all opcodes will be printed
313 ** as they are added to the instruction stream.
314 */
315 #ifndef NDEBUG
316 int sqlite_vdbe_addop_trace = 0;
317 static void vdbePrintOp(FILE*, int, Op*);
318 #endif
319 
320 /*
321 ** Create a new virtual database engine.
322 */
323 Vdbe *sqliteVdbeCreate(sqlite *db){
324   Vdbe *p;
325   p = sqliteMalloc( sizeof(Vdbe) );
326   if( p==0 ) return 0;
327   p->db = db;
328   if( db->pVdbe ){
329     db->pVdbe->pPrev = p;
330   }
331   p->pNext = db->pVdbe;
332   p->pPrev = 0;
333   db->pVdbe = p;
334   p->magic = VDBE_MAGIC_INIT;
335   return p;
336 }
337 
338 /*
339 ** Turn tracing on or off
340 */
341 void sqliteVdbeTrace(Vdbe *p, FILE *trace){
342   p->trace = trace;
343 }
344 
345 /*
346 ** Add a new instruction to the list of instructions current in the
347 ** VDBE.  Return the address of the new instruction.
348 **
349 ** Parameters:
350 **
351 **    p               Pointer to the VDBE
352 **
353 **    op              The opcode for this instruction
354 **
355 **    p1, p2          First two of the three possible operands.
356 **
357 ** Use the sqliteVdbeResolveLabel() function to fix an address and
358 ** the sqliteVdbeChangeP3() function to change the value of the P3
359 ** operand.
360 */
361 int sqliteVdbeAddOp(Vdbe *p, int op, int p1, int p2){
362   int i;
363 
364   i = p->nOp;
365   p->nOp++;
366   assert( p->magic==VDBE_MAGIC_INIT );
367   if( i>=p->nOpAlloc ){
368     int oldSize = p->nOpAlloc;
369     Op *aNew;
370     p->nOpAlloc = p->nOpAlloc*2 + 100;
371     aNew = sqliteRealloc(p->aOp, p->nOpAlloc*sizeof(Op));
372     if( aNew==0 ){
373       p->nOpAlloc = oldSize;
374       return 0;
375     }
376     p->aOp = aNew;
377     memset(&p->aOp[oldSize], 0, (p->nOpAlloc-oldSize)*sizeof(Op));
378   }
379   p->aOp[i].opcode = op;
380   p->aOp[i].p1 = p1;
381   if( p2<0 && (-1-p2)<p->nLabel && p->aLabel[-1-p2]>=0 ){
382     p2 = p->aLabel[-1-p2];
383   }
384   p->aOp[i].p2 = p2;
385   p->aOp[i].p3 = 0;
386   p->aOp[i].p3type = P3_NOTUSED;
387 #ifndef NDEBUG
388   if( sqlite_vdbe_addop_trace ) vdbePrintOp(0, i, &p->aOp[i]);
389 #endif
390   return i;
391 }
392 
393 /*
394 ** Create a new symbolic label for an instruction that has yet to be
395 ** coded.  The symbolic label is really just a negative number.  The
396 ** label can be used as the P2 value of an operation.  Later, when
397 ** the label is resolved to a specific address, the VDBE will scan
398 ** through its operation list and change all values of P2 which match
399 ** the label into the resolved address.
400 **
401 ** The VDBE knows that a P2 value is a label because labels are
402 ** always negative and P2 values are suppose to be non-negative.
403 ** Hence, a negative P2 value is a label that has yet to be resolved.
404 */
405 int sqliteVdbeMakeLabel(Vdbe *p){
406   int i;
407   i = p->nLabel++;
408   assert( p->magic==VDBE_MAGIC_INIT );
409   if( i>=p->nLabelAlloc ){
410     int *aNew;
411     p->nLabelAlloc = p->nLabelAlloc*2 + 10;
412     aNew = sqliteRealloc( p->aLabel, p->nLabelAlloc*sizeof(p->aLabel[0]));
413     if( aNew==0 ){
414       sqliteFree(p->aLabel);
415     }
416     p->aLabel = aNew;
417   }
418   if( p->aLabel==0 ){
419     p->nLabel = 0;
420     p->nLabelAlloc = 0;
421     return 0;
422   }
423   p->aLabel[i] = -1;
424   return -1-i;
425 }
426 
427 /*
428 ** Resolve label "x" to be the address of the next instruction to
429 ** be inserted.  The parameter "x" must have been obtained from
430 ** a prior call to sqliteVdbeMakeLabel().
431 */
432 void sqliteVdbeResolveLabel(Vdbe *p, int x){
433   int j;
434   assert( p->magic==VDBE_MAGIC_INIT );
435   if( x<0 && (-x)<=p->nLabel && p->aOp ){
436     if( p->aLabel[-1-x]==p->nOp ) return;
437     assert( p->aLabel[-1-x]<0 );
438     p->aLabel[-1-x] = p->nOp;
439     for(j=0; j<p->nOp; j++){
440       if( p->aOp[j].p2==x ) p->aOp[j].p2 = p->nOp;
441     }
442   }
443 }
444 
445 /*
446 ** Return the address of the next instruction to be inserted.
447 */
448 int sqliteVdbeCurrentAddr(Vdbe *p){
449   assert( p->magic==VDBE_MAGIC_INIT );
450   return p->nOp;
451 }
452 
453 /*
454 ** Add a whole list of operations to the operation stack.  Return the
455 ** address of the first operation added.
456 */
457 int sqliteVdbeAddOpList(Vdbe *p, int nOp, VdbeOp const *aOp){
458   int addr;
459   assert( p->magic==VDBE_MAGIC_INIT );
460   if( p->nOp + nOp >= p->nOpAlloc ){
461     int oldSize = p->nOpAlloc;
462     Op *aNew;
463     p->nOpAlloc = p->nOpAlloc*2 + nOp + 10;
464     aNew = sqliteRealloc(p->aOp, p->nOpAlloc*sizeof(Op));
465     if( aNew==0 ){
466       p->nOpAlloc = oldSize;
467       return 0;
468     }
469     p->aOp = aNew;
470     memset(&p->aOp[oldSize], 0, (p->nOpAlloc-oldSize)*sizeof(Op));
471   }
472   addr = p->nOp;
473   if( nOp>0 ){
474     int i;
475     for(i=0; i<nOp; i++){
476       int p2 = aOp[i].p2;
477       p->aOp[i+addr] = aOp[i];
478       if( p2<0 ) p->aOp[i+addr].p2 = addr + ADDR(p2);
479       p->aOp[i+addr].p3type = aOp[i].p3 ? P3_STATIC : P3_NOTUSED;
480 #ifndef NDEBUG
481       if( sqlite_vdbe_addop_trace ) vdbePrintOp(0, i+addr, &p->aOp[i+addr]);
482 #endif
483     }
484     p->nOp += nOp;
485   }
486   return addr;
487 }
488 
489 /*
490 ** Change the value of the P1 operand for a specific instruction.
491 ** This routine is useful when a large program is loaded from a
492 ** static array using sqliteVdbeAddOpList but we want to make a
493 ** few minor changes to the program.
494 */
495 void sqliteVdbeChangeP1(Vdbe *p, int addr, int val){
496   assert( p->magic==VDBE_MAGIC_INIT );
497   if( p && addr>=0 && p->nOp>addr && p->aOp ){
498     p->aOp[addr].p1 = val;
499   }
500 }
501 
502 /*
503 ** Change the value of the P2 operand for a specific instruction.
504 ** This routine is useful for setting a jump destination.
505 */
506 void sqliteVdbeChangeP2(Vdbe *p, int addr, int val){
507   assert( val>=0 );
508   assert( p->magic==VDBE_MAGIC_INIT );
509   if( p && addr>=0 && p->nOp>addr && p->aOp ){
510     p->aOp[addr].p2 = val;
511   }
512 }
513 
514 /*
515 ** Change the value of the P3 operand for a specific instruction.
516 ** This routine is useful when a large program is loaded from a
517 ** static array using sqliteVdbeAddOpList but we want to make a
518 ** few minor changes to the program.
519 **
520 ** If n>=0 then the P3 operand is dynamic, meaning that a copy of
521 ** the string is made into memory obtained from sqliteMalloc().
522 ** A value of n==0 means copy bytes of zP3 up to and including the
523 ** first null byte.  If n>0 then copy n+1 bytes of zP3.
524 **
525 ** If n==P3_STATIC  it means that zP3 is a pointer to a constant static
526 ** string and we can just copy the pointer.  n==P3_POINTER means zP3 is
527 ** a pointer to some object other than a string.
528 **
529 ** If addr<0 then change P3 on the most recently inserted instruction.
530 */
531 void sqliteVdbeChangeP3(Vdbe *p, int addr, const char *zP3, int n){
532   Op *pOp;
533   assert( p->magic==VDBE_MAGIC_INIT );
534   if( p==0 || p->aOp==0 ) return;
535   if( addr<0 || addr>=p->nOp ){
536     addr = p->nOp - 1;
537     if( addr<0 ) return;
538   }
539   pOp = &p->aOp[addr];
540   if( pOp->p3 && pOp->p3type==P3_DYNAMIC ){
541     sqliteFree(pOp->p3);
542     pOp->p3 = 0;
543   }
544   if( zP3==0 ){
545     pOp->p3 = 0;
546     pOp->p3type = P3_NOTUSED;
547   }else if( n<0 ){
548     pOp->p3 = (char*)zP3;
549     pOp->p3type = n;
550   }else{
551     sqliteSetNString(&pOp->p3, zP3, n, 0);
552     pOp->p3type = P3_DYNAMIC;
553   }
554 }
555 
556 /*
557 ** If the P3 operand to the specified instruction appears
558 ** to be a quoted string token, then this procedure removes
559 ** the quotes.
560 **
561 ** The quoting operator can be either a grave ascent (ASCII 0x27)
562 ** or a double quote character (ASCII 0x22).  Two quotes in a row
563 ** resolve to be a single actual quote character within the string.
564 */
565 void sqliteVdbeDequoteP3(Vdbe *p, int addr){
566   Op *pOp;
567   assert( p->magic==VDBE_MAGIC_INIT );
568   if( p->aOp==0 || addr<0 || addr>=p->nOp ) return;
569   pOp = &p->aOp[addr];
570   if( pOp->p3==0 || pOp->p3[0]==0 ) return;
571   if( pOp->p3type==P3_POINTER ) return;
572   if( pOp->p3type!=P3_DYNAMIC ){
573     pOp->p3 = sqliteStrDup(pOp->p3);
574     pOp->p3type = P3_DYNAMIC;
575   }
576   sqliteDequote(pOp->p3);
577 }
578 
579 /*
580 ** On the P3 argument of the given instruction, change all
581 ** strings of whitespace characters into a single space and
582 ** delete leading and trailing whitespace.
583 */
584 void sqliteVdbeCompressSpace(Vdbe *p, int addr){
585   unsigned char *z;
586   int i, j;
587   Op *pOp;
588   assert( p->magic==VDBE_MAGIC_INIT );
589   if( p->aOp==0 || addr<0 || addr>=p->nOp ) return;
590   pOp = &p->aOp[addr];
591   if( pOp->p3type==P3_POINTER ){
592     return;
593   }
594   if( pOp->p3type!=P3_DYNAMIC ){
595     pOp->p3 = sqliteStrDup(pOp->p3);
596     pOp->p3type = P3_DYNAMIC;
597   }
598   z = (unsigned char*)pOp->p3;
599   if( z==0 ) return;
600   i = j = 0;
601   while( isspace(z[i]) ){ i++; }
602   while( z[i] ){
603     if( isspace(z[i]) ){
604       z[j++] = ' ';
605       while( isspace(z[++i]) ){}
606     }else{
607       z[j++] = z[i++];
608     }
609   }
610   while( j>0 && isspace(z[j-1]) ){ j--; }
611   z[j] = 0;
612 }
613 
614 /*
615 ** Search for the current program for the given opcode and P2
616 ** value.  Return the address plus 1 if found and 0 if not found.
617 */
618 int sqliteVdbeFindOp(Vdbe *p, int op, int p2){
619   int i;
620   assert( p->magic==VDBE_MAGIC_INIT );
621   for(i=0; i<p->nOp; i++){
622     if( p->aOp[i].opcode==op && p->aOp[i].p2==p2 ) return i+1;
623   }
624   return 0;
625 }
626 
627 /*
628 ** Return the opcode for a given address.
629 */
630 VdbeOp *sqliteVdbeGetOp(Vdbe *p, int addr){
631   assert( p->magic==VDBE_MAGIC_INIT );
632   assert( addr>=0 && addr<p->nOp );
633   return &p->aOp[addr];
634 }
635 
636 /*
637 ** The following group or routines are employed by installable functions
638 ** to return their results.
639 **
640 ** The sqlite_set_result_string() routine can be used to return a string
641 ** value or to return a NULL.  To return a NULL, pass in NULL for zResult.
642 ** A copy is made of the string before this routine returns so it is safe
643 ** to pass in an ephemeral string.
644 **
645 ** sqlite_set_result_error() works like sqlite_set_result_string() except
646 ** that it signals a fatal error.  The string argument, if any, is the
647 ** error message.  If the argument is NULL a generic substitute error message
648 ** is used.
649 **
650 ** The sqlite_set_result_int() and sqlite_set_result_double() set the return
651 ** value of the user function to an integer or a double.
652 **
653 ** These routines are defined here in vdbe.c because they depend on knowing
654 ** the internals of the sqlite_func structure which is only defined in
655 ** this source file.
656 */
657 char *sqlite_set_result_string(sqlite_func *p, const char *zResult, int n){
658   assert( !p->isStep );
659   if( p->s.flags & STK_Dyn ){
660     sqliteFree(p->z);
661   }
662   if( zResult==0 ){
663     p->s.flags = STK_Null;
664     n = 0;
665     p->z = 0;
666     p->s.n = 0;
667   }else{
668     if( n<0 ) n = strlen(zResult);
669     if( n<NBFS-1 ){
670       memcpy(p->s.z, zResult, n);
671       p->s.z[n] = 0;
672       p->s.flags = STK_Str;
673       p->z = p->s.z;
674     }else{
675       p->z = sqliteMallocRaw( n+1 );
676       if( p->z ){
677         memcpy(p->z, zResult, n);
678         p->z[n] = 0;
679       }
680       p->s.flags = STK_Str | STK_Dyn;
681     }
682     p->s.n = n+1;
683   }
684   return p->z;
685 }
686 void sqlite_set_result_int(sqlite_func *p, int iResult){
687   assert( !p->isStep );
688   if( p->s.flags & STK_Dyn ){
689     sqliteFree(p->z);
690   }
691   p->s.i = iResult;
692   p->s.flags = STK_Int;
693 }
694 void sqlite_set_result_double(sqlite_func *p, double rResult){
695   assert( !p->isStep );
696   if( p->s.flags & STK_Dyn ){
697     sqliteFree(p->z);
698   }
699   p->s.r = rResult;
700   p->s.flags = STK_Real;
701 }
702 void sqlite_set_result_error(sqlite_func *p, const char *zMsg, int n){
703   assert( !p->isStep );
704   sqlite_set_result_string(p, zMsg, n);
705   p->isError = 1;
706 }
707 
708 /*
709 ** Extract the user data from a sqlite_func structure and return a
710 ** pointer to it.
711 **
712 ** This routine is defined here in vdbe.c because it depends on knowing
713 ** the internals of the sqlite_func structure which is only defined in
714 ** this source file.
715 */
716 void *sqlite_user_data(sqlite_func *p){
717   assert( p && p->pFunc );
718   return p->pFunc->pUserData;
719 }
720 
721 /*
722 ** Allocate or return the aggregate context for a user function.  A new
723 ** context is allocated on the first call.  Subsequent calls return the
724 ** same context that was returned on prior calls.
725 **
726 ** This routine is defined here in vdbe.c because it depends on knowing
727 ** the internals of the sqlite_func structure which is only defined in
728 ** this source file.
729 */
730 void *sqlite_aggregate_context(sqlite_func *p, int nByte){
731   assert( p && p->pFunc && p->pFunc->xStep );
732   if( p->pAgg==0 ){
733     if( nByte<=NBFS ){
734       p->pAgg = (void*)p->z;
735     }else{
736       p->pAgg = sqliteMalloc( nByte );
737     }
738   }
739   return p->pAgg;
740 }
741 
742 /*
743 ** Return the number of times the Step function of a aggregate has been
744 ** called.
745 **
746 ** This routine is defined here in vdbe.c because it depends on knowing
747 ** the internals of the sqlite_func structure which is only defined in
748 ** this source file.
749 */
750 int sqlite_aggregate_count(sqlite_func *p){
751   assert( p && p->pFunc && p->pFunc->xStep );
752   return p->cnt;
753 }
754 
755 /*
756 ** Advance the virtual machine to the next output row.
757 **
758 ** The return vale will be either SQLITE_BUSY, SQLITE_DONE,
759 ** SQLITE_ROW, SQLITE_ERROR, or SQLITE_MISUSE.
760 **
761 ** SQLITE_BUSY means that the virtual machine attempted to open
762 ** a locked database and there is no busy callback registered.
763 ** Call sqlite_step() again to retry the open.  *pN is set to 0
764 ** and *pazColName and *pazValue are both set to NULL.
765 **
766 ** SQLITE_DONE means that the virtual machine has finished
767 ** executing.  sqlite_step() should not be called again on this
768 ** virtual machine.  *pN and *pazColName are set appropriately
769 ** but *pazValue is set to NULL.
770 **
771 ** SQLITE_ROW means that the virtual machine has generated another
772 ** row of the result set.  *pN is set to the number of columns in
773 ** the row.  *pazColName is set to the names of the columns followed
774 ** by the column datatypes.  *pazValue is set to the values of each
775 ** column in the row.  The value of the i-th column is (*pazValue)[i].
776 ** The name of the i-th column is (*pazColName)[i] and the datatype
777 ** of the i-th column is (*pazColName)[i+*pN].
778 **
779 ** SQLITE_ERROR means that a run-time error (such as a constraint
780 ** violation) has occurred.  The details of the error will be returned
781 ** by the next call to sqlite_finalize().  sqlite_step() should not
782 ** be called again on the VM.
783 **
784 ** SQLITE_MISUSE means that the this routine was called inappropriately.
785 ** Perhaps it was called on a virtual machine that had already been
786 ** finalized or on one that had previously returned SQLITE_ERROR or
787 ** SQLITE_DONE.  Or it could be the case the the same database connection
788 ** is being used simulataneously by two or more threads.
789 */
790 int sqlite_step(
791   sqlite_vm *pVm,              /* The virtual machine to execute */
792   int *pN,                     /* OUT: Number of columns in result */
793   const char ***pazValue,      /* OUT: Column data */
794   const char ***pazColName     /* OUT: Column names and datatypes */
795 ){
796   Vdbe *p = (Vdbe*)pVm;
797   sqlite *db;
798   int rc;
799 
800   if( p->magic!=VDBE_MAGIC_RUN ){
801     return SQLITE_MISUSE;
802   }
803   db = p->db;
804   if( sqliteSafetyOn(db) ){
805     return SQLITE_MISUSE;
806   }
807   if( p->explain ){
808     rc = sqliteVdbeList(p);
809   }else{
810     rc = sqliteVdbeExec(p);
811   }
812   if( rc==SQLITE_DONE || rc==SQLITE_ROW ){
813     if( pazColName ) *pazColName = (const char**)p->azColName;
814     if( pN ) *pN = p->nResColumn;
815   }else{
816     if( pazColName) *pazColName = 0;
817     if( pN ) *pN = 0;
818   }
819   if( pazValue ){
820     if( rc==SQLITE_ROW ){
821       *pazValue = (const char**)p->azResColumn;
822     }else{
823       *pazValue = 0;
824     }
825   }
826   if( sqliteSafetyOff(db) ){
827     return SQLITE_MISUSE;
828   }
829   return rc;
830 }
831 
832 /*
833 ** Reset an Agg structure.  Delete all its contents.
834 **
835 ** For installable aggregate functions, if the step function has been
836 ** called, make sure the finalizer function has also been called.  The
837 ** finalizer might need to free memory that was allocated as part of its
838 ** private context.  If the finalizer has not been called yet, call it
839 ** now.
840 */
841 static void AggReset(Agg *pAgg){
842   int i;
843   HashElem *p;
844   for(p = sqliteHashFirst(&pAgg->hash); p; p = sqliteHashNext(p)){
845     AggElem *pElem = sqliteHashData(p);
846     assert( pAgg->apFunc!=0 );
847     for(i=0; i<pAgg->nMem; i++){
848       Mem *pMem = &pElem->aMem[i];
849       if( pAgg->apFunc[i] && (pMem->s.flags & STK_AggCtx)!=0 ){
850         sqlite_func ctx;
851         ctx.pFunc = pAgg->apFunc[i];
852         ctx.s.flags = STK_Null;
853         ctx.z = 0;
854         ctx.pAgg = pMem->z;
855         ctx.cnt = pMem->s.i;
856         ctx.isStep = 0;
857         ctx.isError = 0;
858         (*pAgg->apFunc[i]->xFinalize)(&ctx);
859         if( pMem->z!=0 && pMem->z!=pMem->s.z ){
860           sqliteFree(pMem->z);
861         }
862       }else if( pMem->s.flags & STK_Dyn ){
863         sqliteFree(pMem->z);
864       }
865     }
866     sqliteFree(pElem);
867   }
868   sqliteHashClear(&pAgg->hash);
869   sqliteFree(pAgg->apFunc);
870   pAgg->apFunc = 0;
871   pAgg->pCurrent = 0;
872   pAgg->pSearch = 0;
873   pAgg->nMem = 0;
874 }
875 
876 /*
877 ** Insert a new aggregate element and make it the element that
878 ** has focus.
879 **
880 ** Return 0 on success and 1 if memory is exhausted.
881 */
882 static int AggInsert(Agg *p, char *zKey, int nKey){
883   AggElem *pElem, *pOld;
884   int i;
885   pElem = sqliteMalloc( sizeof(AggElem) + nKey +
886                         (p->nMem-1)*sizeof(pElem->aMem[0]) );
887   if( pElem==0 ) return 1;
888   pElem->zKey = (char*)&pElem->aMem[p->nMem];
889   memcpy(pElem->zKey, zKey, nKey);
890   pElem->nKey = nKey;
891   pOld = sqliteHashInsert(&p->hash, pElem->zKey, pElem->nKey, pElem);
892   if( pOld!=0 ){
893     assert( pOld==pElem );  /* Malloc failed on insert */
894     sqliteFree(pOld);
895     return 0;
896   }
897   for(i=0; i<p->nMem; i++){
898     pElem->aMem[i].s.flags = STK_Null;
899   }
900   p->pCurrent = pElem;
901   return 0;
902 }
903 
904 /*
905 ** Get the AggElem currently in focus
906 */
907 #define AggInFocus(P)   ((P).pCurrent ? (P).pCurrent : _AggInFocus(&(P)))
908 static AggElem *_AggInFocus(Agg *p){
909   HashElem *pElem = sqliteHashFirst(&p->hash);
910   if( pElem==0 ){
911     AggInsert(p,"",1);
912     pElem = sqliteHashFirst(&p->hash);
913   }
914   return pElem ? sqliteHashData(pElem) : 0;
915 }
916 
917 /*
918 ** Convert the given stack entity into a string if it isn't one
919 ** already.
920 */
921 #define Stringify(P,I) if((aStack[I].flags & STK_Str)==0){hardStringify(P,I);}
922 static int hardStringify(Vdbe *p, int i){
923   Stack *pStack = &p->aStack[i];
924   int fg = pStack->flags;
925   if( fg & STK_Real ){
926     sprintf(pStack->z,"%.15g",pStack->r);
927   }else if( fg & STK_Int ){
928     sprintf(pStack->z,"%d",pStack->i);
929   }else{
930     pStack->z[0] = 0;
931   }
932   p->zStack[i] = pStack->z;
933   pStack->n = strlen(pStack->z)+1;
934   pStack->flags = STK_Str;
935   return 0;
936 }
937 
938 /*
939 ** Convert the given stack entity into a string that has been obtained
940 ** from sqliteMalloc().  This is different from Stringify() above in that
941 ** Stringify() will use the NBFS bytes of static string space if the string
942 ** will fit but this routine always mallocs for space.
943 ** Return non-zero if we run out of memory.
944 */
945 #define Dynamicify(P,I) ((aStack[I].flags & STK_Dyn)==0 ? hardDynamicify(P,I):0)
946 static int hardDynamicify(Vdbe *p, int i){
947   Stack *pStack = &p->aStack[i];
948   int fg = pStack->flags;
949   char *z;
950   if( (fg & STK_Str)==0 ){
951     hardStringify(p, i);
952   }
953   assert( (fg & STK_Dyn)==0 );
954   z = sqliteMallocRaw( pStack->n );
955   if( z==0 ) return 1;
956   memcpy(z, p->zStack[i], pStack->n);
957   p->zStack[i] = z;
958   pStack->flags |= STK_Dyn;
959   return 0;
960 }
961 
962 /*
963 ** An ephemeral string value (signified by the STK_Ephem flag) contains
964 ** a pointer to a dynamically allocated string where some other entity
965 ** is responsible for deallocating that string.  Because the stack entry
966 ** does not control the string, it might be deleted without the stack
967 ** entry knowing it.
968 **
969 ** This routine converts an ephemeral string into a dynamically allocated
970 ** string that the stack entry itself controls.  In other words, it
971 ** converts an STK_Ephem string into an STK_Dyn string.
972 */
973 #define Deephemeralize(P,I) \
974    if( ((P)->aStack[I].flags&STK_Ephem)!=0 && hardDeephem(P,I) ){ goto no_mem;}
975 static int hardDeephem(Vdbe *p, int i){
976   Stack *pStack = &p->aStack[i];
977   char **pzStack = &p->zStack[i];
978   char *z;
979   assert( (pStack->flags & STK_Ephem)!=0 );
980   z = sqliteMallocRaw( pStack->n );
981   if( z==0 ) return 1;
982   memcpy(z, *pzStack, pStack->n);
983   *pzStack = z;
984   pStack->flags &= ~STK_Ephem;
985   pStack->flags |= STK_Dyn;
986   return 0;
987 }
988 
989 /*
990 ** Release the memory associated with the given stack level
991 */
992 #define Release(P,I)  if((P)->aStack[I].flags&STK_Dyn){ hardRelease(P,I); }
993 static void hardRelease(Vdbe *p, int i){
994   sqliteFree(p->zStack[i]);
995   p->zStack[i] = 0;
996   p->aStack[i].flags &= ~(STK_Str|STK_Dyn|STK_Static|STK_Ephem);
997 }
998 
999 /*
1000 ** Return TRUE if zNum is a 32-bit signed integer and write
1001 ** the value of the integer into *pNum.  If zNum is not an integer
1002 ** or is an integer that is too large to be expressed with just 32
1003 ** bits, then return false.
1004 **
1005 ** Under Linux (RedHat 7.2) this routine is much faster than atoi()
1006 ** for converting strings into integers.
1007 */
1008 static int toInt(const char *zNum, int *pNum){
1009   int v = 0;
1010   int neg;
1011   int i, c;
1012   if( *zNum=='-' ){
1013     neg = 1;
1014     zNum++;
1015   }else if( *zNum=='+' ){
1016     neg = 0;
1017     zNum++;
1018   }else{
1019     neg = 0;
1020   }
1021   for(i=0; (c=zNum[i])>='0' && c<='9'; i++){
1022     v = v*10 + c - '0';
1023   }
1024   *pNum = neg ? -v : v;
1025   return c==0 && i>0 && (i<10 || (i==10 && memcmp(zNum,"2147483647",10)<=0));
1026 }
1027 
1028 /*
1029 ** Convert the given stack entity into a integer if it isn't one
1030 ** already.
1031 **
1032 ** Any prior string or real representation is invalidated.
1033 ** NULLs are converted into 0.
1034 */
1035 #define Integerify(P,I) \
1036     if(((P)->aStack[(I)].flags&STK_Int)==0){ hardIntegerify(P,I); }
1037 static void hardIntegerify(Vdbe *p, int i){
1038   if( p->aStack[i].flags & STK_Real ){
1039     p->aStack[i].i = (int)p->aStack[i].r;
1040     Release(p, i);
1041   }else if( p->aStack[i].flags & STK_Str ){
1042     toInt(p->zStack[i], &p->aStack[i].i);
1043     Release(p, i);
1044   }else{
1045     p->aStack[i].i = 0;
1046   }
1047   p->aStack[i].flags = STK_Int;
1048 }
1049 
1050 /*
1051 ** Get a valid Real representation for the given stack element.
1052 **
1053 ** Any prior string or integer representation is retained.
1054 ** NULLs are converted into 0.0.
1055 */
1056 #define Realify(P,I) \
1057     if(((P)->aStack[(I)].flags&STK_Real)==0){ hardRealify(P,I); }
1058 static void hardRealify(Vdbe *p, int i){
1059   if( p->aStack[i].flags & STK_Str ){
1060     p->aStack[i].r = atof(p->zStack[i]);
1061   }else if( p->aStack[i].flags & STK_Int ){
1062     p->aStack[i].r = p->aStack[i].i;
1063   }else{
1064     p->aStack[i].r = 0.0;
1065   }
1066   p->aStack[i].flags |= STK_Real;
1067 }
1068 
1069 /*
1070 ** Pop the stack N times.  Free any memory associated with the
1071 ** popped stack elements.
1072 */
1073 static void PopStack(Vdbe *p, int N){
1074   assert( N>=0 );
1075   if( p->zStack==0 ) return;
1076   assert( p->aStack || sqlite_malloc_failed );
1077   if( p->aStack==0 ) return;
1078   while( N-- > 0 ){
1079     if( p->aStack[p->tos].flags & STK_Dyn ){
1080       sqliteFree(p->zStack[p->tos]);
1081     }
1082     p->aStack[p->tos].flags = 0;
1083     p->zStack[p->tos] = 0;
1084     p->tos--;
1085   }
1086 }
1087 
1088 /*
1089 ** Here is a macro to handle the common case of popping the stack
1090 ** once.  This macro only works from within the sqliteVdbeExec()
1091 ** function.
1092 */
1093 #define POPSTACK \
1094   assert(p->tos>=0); \
1095   if( aStack[p->tos].flags & STK_Dyn ) sqliteFree(zStack[p->tos]); \
1096   p->tos--;
1097 
1098 /*
1099 ** Delete a keylist
1100 */
1101 static void KeylistFree(Keylist *p){
1102   while( p ){
1103     Keylist *pNext = p->pNext;
1104     sqliteFree(p);
1105     p = pNext;
1106   }
1107 }
1108 
1109 /*
1110 ** Close a cursor and release all the resources that cursor happens
1111 ** to hold.
1112 */
1113 static void cleanupCursor(Cursor *pCx){
1114   if( pCx->pCursor ){
1115     sqliteBtreeCloseCursor(pCx->pCursor);
1116   }
1117   if( pCx->pBt ){
1118     sqliteBtreeClose(pCx->pBt);
1119   }
1120   sqliteFree(pCx->pData);
1121   memset(pCx, 0, sizeof(Cursor));
1122 }
1123 
1124 /*
1125 ** Close all cursors
1126 */
1127 static void closeAllCursors(Vdbe *p){
1128   int i;
1129   for(i=0; i<p->nCursor; i++){
1130     cleanupCursor(&p->aCsr[i]);
1131   }
1132   sqliteFree(p->aCsr);
1133   p->aCsr = 0;
1134   p->nCursor = 0;
1135 }
1136 
1137 /*
1138 ** Remove any elements that remain on the sorter for the VDBE given.
1139 */
1140 static void SorterReset(Vdbe *p){
1141   while( p->pSort ){
1142     Sorter *pSorter = p->pSort;
1143     p->pSort = pSorter->pNext;
1144     sqliteFree(pSorter->zKey);
1145     sqliteFree(pSorter->pData);
1146     sqliteFree(pSorter);
1147   }
1148 }
1149 
1150 /*
1151 ** Clean up the VM after execution.
1152 **
1153 ** This routine will automatically close any cursors, lists, and/or
1154 ** sorters that were left open.
1155 */
1156 static void Cleanup(Vdbe *p){
1157   int i;
1158   PopStack(p, p->tos+1);
1159   closeAllCursors(p);
1160   if( p->aMem ){
1161     for(i=0; i<p->nMem; i++){
1162       if( p->aMem[i].s.flags & STK_Dyn ){
1163         sqliteFree(p->aMem[i].z);
1164       }
1165     }
1166   }
1167   sqliteFree(p->aMem);
1168   p->aMem = 0;
1169   p->nMem = 0;
1170   if( p->pList ){
1171     KeylistFree(p->pList);
1172     p->pList = 0;
1173   }
1174   SorterReset(p);
1175   if( p->pFile ){
1176     if( p->pFile!=stdin ) fclose(p->pFile);
1177     p->pFile = 0;
1178   }
1179   if( p->azField ){
1180     sqliteFree(p->azField);
1181     p->azField = 0;
1182   }
1183   p->nField = 0;
1184   if( p->zLine ){
1185     sqliteFree(p->zLine);
1186     p->zLine = 0;
1187   }
1188   p->nLineAlloc = 0;
1189   AggReset(&p->agg);
1190   if( p->aSet ){
1191     for(i=0; i<p->nSet; i++){
1192       sqliteHashClear(&p->aSet[i].hash);
1193     }
1194   }
1195   sqliteFree(p->aSet);
1196   p->aSet = 0;
1197   p->nSet = 0;
1198   if( p->keylistStack ){
1199     int ii;
1200     for(ii = 0; ii < p->keylistStackDepth; ii++){
1201       KeylistFree(p->keylistStack[ii]);
1202     }
1203     sqliteFree(p->keylistStack);
1204     p->keylistStackDepth = 0;
1205     p->keylistStack = 0;
1206   }
1207   sqliteFree(p->zErrMsg);
1208   p->zErrMsg = 0;
1209   p->magic = VDBE_MAGIC_DEAD;
1210 }
1211 
1212 /*
1213 ** Delete an entire VDBE.
1214 */
1215 void sqliteVdbeDelete(Vdbe *p){
1216   int i;
1217   if( p==0 ) return;
1218   Cleanup(p);
1219   if( p->pPrev ){
1220     p->pPrev->pNext = p->pNext;
1221   }else{
1222     assert( p->db->pVdbe==p );
1223     p->db->pVdbe = p->pNext;
1224   }
1225   if( p->pNext ){
1226     p->pNext->pPrev = p->pPrev;
1227   }
1228   p->pPrev = p->pNext = 0;
1229   if( p->nOpAlloc==0 ){
1230     p->aOp = 0;
1231     p->nOp = 0;
1232   }
1233   for(i=0; i<p->nOp; i++){
1234     if( p->aOp[i].p3type==P3_DYNAMIC ){
1235       sqliteFree(p->aOp[i].p3);
1236     }
1237   }
1238   sqliteFree(p->aOp);
1239   sqliteFree(p->aLabel);
1240   sqliteFree(p->aStack);
1241   sqliteFree(p);
1242 }
1243 
1244 /*
1245 ** Give a listing of the program in the virtual machine.
1246 **
1247 ** The interface is the same as sqliteVdbeExec().  But instead of
1248 ** running the code, it invokes the callback once for each instruction.
1249 ** This feature is used to implement "EXPLAIN".
1250 */
1251 int sqliteVdbeList(
1252   Vdbe *p                   /* The VDBE */
1253 ){
1254   sqlite *db = p->db;
1255   int i;
1256   static char *azColumnNames[] = {
1257      "addr", "opcode", "p1",  "p2",  "p3",
1258      "int",  "text",   "int", "int", "text",
1259      0
1260   };
1261 
1262   assert( p->popStack==0 );
1263   assert( p->explain );
1264   p->azColName = azColumnNames;
1265   p->azResColumn = p->zStack;
1266   for(i=0; i<5; i++) p->zStack[i] = p->aStack[i].z;
1267   p->rc = SQLITE_OK;
1268   for(i=p->pc; p->rc==SQLITE_OK && i<p->nOp; i++){
1269     if( db->flags & SQLITE_Interrupt ){
1270       db->flags &= ~SQLITE_Interrupt;
1271       if( db->magic!=SQLITE_MAGIC_BUSY ){
1272         p->rc = SQLITE_MISUSE;
1273       }else{
1274         p->rc = SQLITE_INTERRUPT;
1275       }
1276       sqliteSetString(&p->zErrMsg, sqlite_error_string(p->rc), 0);
1277       break;
1278     }
1279     sprintf(p->zStack[0],"%d",i);
1280     sprintf(p->zStack[2],"%d", p->aOp[i].p1);
1281     sprintf(p->zStack[3],"%d", p->aOp[i].p2);
1282     if( p->aOp[i].p3type==P3_POINTER ){
1283       sprintf(p->aStack[4].z, "ptr(%#x)", (int)p->aOp[i].p3);
1284       p->zStack[4] = p->aStack[4].z;
1285     }else{
1286       p->zStack[4] = p->aOp[i].p3;
1287     }
1288     p->zStack[1] = sqliteOpcodeNames[p->aOp[i].opcode];
1289     if( p->xCallback==0 ){
1290       p->pc = i+1;
1291       p->azResColumn = p->zStack;
1292       p->nResColumn = 5;
1293       return SQLITE_ROW;
1294     }
1295     if( sqliteSafetyOff(db) ){
1296       p->rc = SQLITE_MISUSE;
1297       break;
1298     }
1299     if( p->xCallback(p->pCbArg, 5, p->zStack, p->azColName) ){
1300       p->rc = SQLITE_ABORT;
1301     }
1302     if( sqliteSafetyOn(db) ){
1303       p->rc = SQLITE_MISUSE;
1304     }
1305   }
1306   return p->rc==SQLITE_OK ? SQLITE_DONE : SQLITE_ERROR;
1307 }
1308 
1309 /*
1310 ** The parameters are pointers to the head of two sorted lists
1311 ** of Sorter structures.  Merge these two lists together and return
1312 ** a single sorted list.  This routine forms the core of the merge-sort
1313 ** algorithm.
1314 **
1315 ** In the case of a tie, left sorts in front of right.
1316 */
1317 static Sorter *Merge(Sorter *pLeft, Sorter *pRight){
1318   Sorter sHead;
1319   Sorter *pTail;
1320   pTail = &sHead;
1321   pTail->pNext = 0;
1322   while( pLeft && pRight ){
1323     int c = sqliteSortCompare(pLeft->zKey, pRight->zKey);
1324     if( c<=0 ){
1325       pTail->pNext = pLeft;
1326       pLeft = pLeft->pNext;
1327     }else{
1328       pTail->pNext = pRight;
1329       pRight = pRight->pNext;
1330     }
1331     pTail = pTail->pNext;
1332   }
1333   if( pLeft ){
1334     pTail->pNext = pLeft;
1335   }else if( pRight ){
1336     pTail->pNext = pRight;
1337   }
1338   return sHead.pNext;
1339 }
1340 
1341 /*
1342 ** Convert an integer in between the native integer format and
1343 ** the bigEndian format used as the record number for tables.
1344 **
1345 ** The bigEndian format (most significant byte first) is used for
1346 ** record numbers so that records will sort into the correct order
1347 ** even though memcmp() is used to compare the keys.  On machines
1348 ** whose native integer format is little endian (ex: i486) the
1349 ** order of bytes is reversed.  On native big-endian machines
1350 ** (ex: Alpha, Sparc, Motorola) the byte order is the same.
1351 **
1352 ** This function is its own inverse.  In other words
1353 **
1354 **         X == byteSwap(byteSwap(X))
1355 */
1356 static int byteSwap(int x){
1357   union {
1358      char zBuf[sizeof(int)];
1359      int i;
1360   } ux;
1361   ux.zBuf[3] = x&0xff;
1362   ux.zBuf[2] = (x>>8)&0xff;
1363   ux.zBuf[1] = (x>>16)&0xff;
1364   ux.zBuf[0] = (x>>24)&0xff;
1365   return ux.i;
1366 }
1367 
1368 /*
1369 ** When converting from the native format to the key format and back
1370 ** again, in addition to changing the byte order we invert the high-order
1371 ** bit of the most significant byte.  This causes negative numbers to
1372 ** sort before positive numbers in the memcmp() function.
1373 */
1374 #define keyToInt(X)   (byteSwap(X) ^ 0x80000000)
1375 #define intToKey(X)   (byteSwap((X) ^ 0x80000000))
1376 
1377 /*
1378 ** Code contained within the VERIFY() macro is not needed for correct
1379 ** execution.  It is there only to catch errors.  So when we compile
1380 ** with NDEBUG=1, the VERIFY() code is omitted.
1381 */
1382 #ifdef NDEBUG
1383 # define VERIFY(X)
1384 #else
1385 # define VERIFY(X) X
1386 #endif
1387 
1388 /*
1389 ** The following routine works like a replacement for the standard
1390 ** library routine fgets().  The difference is in how end-of-line (EOL)
1391 ** is handled.  Standard fgets() uses LF for EOL under unix, CRLF
1392 ** under windows, and CR under mac.  This routine accepts any of these
1393 ** character sequences as an EOL mark.  The EOL mark is replaced by
1394 ** a single LF character in zBuf.
1395 */
1396 static char *vdbe_fgets(char *zBuf, int nBuf, FILE *in){
1397   int i, c;
1398   for(i=0; i<nBuf-1 && (c=getc(in))!=EOF; i++){
1399     zBuf[i] = c;
1400     if( c=='\r' || c=='\n' ){
1401       if( c=='\r' ){
1402         zBuf[i] = '\n';
1403         c = getc(in);
1404         if( c!=EOF && c!='\n' ) ungetc(c, in);
1405       }
1406       i++;
1407       break;
1408     }
1409   }
1410   zBuf[i]  = 0;
1411   return i>0 ? zBuf : 0;
1412 }
1413 
1414 #if !defined(NDEBUG) || defined(VDBE_PROFILE)
1415 /*
1416 ** Print a single opcode.  This routine is used for debugging only.
1417 */
1418 static void vdbePrintOp(FILE *pOut, int pc, Op *pOp){
1419   char *zP3;
1420   char zPtr[40];
1421   if( pOp->p3type==P3_POINTER ){
1422     sprintf(zPtr, "ptr(%#x)", (int)pOp->p3);
1423     zP3 = zPtr;
1424   }else{
1425     zP3 = pOp->p3;
1426   }
1427   if( pOut==0 ) pOut = stdout;
1428   fprintf(pOut,"%4d %-12s %4d %4d %s\n",
1429       pc, sqliteOpcodeNames[pOp->opcode], pOp->p1, pOp->p2, zP3 ? zP3 : "");
1430   fflush(pOut);
1431 }
1432 #endif
1433 
1434 /*
1435 ** Make sure there is space in the Vdbe structure to hold at least
1436 ** mxCursor cursors.  If there is not currently enough space, then
1437 ** allocate more.
1438 **
1439 ** If a memory allocation error occurs, return 1.  Return 0 if
1440 ** everything works.
1441 */
1442 static int expandCursorArraySize(Vdbe *p, int mxCursor){
1443   if( mxCursor>=p->nCursor ){
1444     Cursor *aCsr = sqliteRealloc( p->aCsr, (mxCursor+1)*sizeof(Cursor) );
1445     if( aCsr==0 ) return 1;
1446     p->aCsr = aCsr;
1447     memset(&p->aCsr[p->nCursor], 0, sizeof(Cursor)*(mxCursor+1-p->nCursor));
1448     p->nCursor = mxCursor+1;
1449   }
1450   return 0;
1451 }
1452 
1453 #ifdef VDBE_PROFILE
1454 /*
1455 ** The following routine only works on pentium-class processors.
1456 ** It uses the RDTSC opcode to read cycle count value out of the
1457 ** processor and returns that value.  This can be used for high-res
1458 ** profiling.
1459 */
1460 __inline__ unsigned long long int hwtime(void){
1461   unsigned long long int x;
1462   __asm__("rdtsc\n\t"
1463           "mov %%edx, %%ecx\n\t"
1464           :"=A" (x));
1465   return x;
1466 }
1467 #endif
1468 
1469 /*
1470 ** The CHECK_FOR_INTERRUPT macro defined here looks to see if the
1471 ** sqlite_interrupt() routine has been called.  If it has been, then
1472 ** processing of the VDBE program is interrupted.
1473 **
1474 ** This macro added to every instruction that does a jump in order to
1475 ** implement a loop.  This test used to be on every single instruction,
1476 ** but that meant we more testing that we needed.  By only testing the
1477 ** flag on jump instructions, we get a (small) speed improvement.
1478 */
1479 #define CHECK_FOR_INTERRUPT \
1480    if( db->flags & SQLITE_Interrupt ) goto abort_due_to_interrupt;
1481 
1482 
1483 /*
1484 ** Prepare a virtual machine for execution.  This involves things such
1485 ** as allocating stack space and initializing the program counter.
1486 ** After the VDBE has be prepped, it can be executed by one or more
1487 ** calls to sqliteVdbeExec().
1488 **
1489 ** The behavior of sqliteVdbeExec() is influenced by the parameters to
1490 ** this routine.  If xCallback is NULL, then sqliteVdbeExec() will return
1491 ** with SQLITE_ROW whenever there is a row of the result set ready
1492 ** to be delivered.  p->azResColumn will point to the row and
1493 ** p->nResColumn gives the number of columns in the row.  If xCallback
1494 ** is not NULL, then the xCallback() routine is invoked to process each
1495 ** row in the result set.
1496 */
1497 void sqliteVdbeMakeReady(
1498   Vdbe *p,                       /* The VDBE */
1499   sqlite_callback xCallback,     /* Result callback */
1500   void *pCallbackArg,            /* 1st argument to xCallback() */
1501   int isExplain                  /* True if the EXPLAIN keywords is present */
1502 ){
1503   int n;
1504 
1505   assert( p!=0 );
1506   assert( p->aStack==0 );
1507   assert( p->magic==VDBE_MAGIC_INIT );
1508 
1509   /* Add a HALT instruction to the very end of the program.
1510   */
1511   sqliteVdbeAddOp(p, OP_Halt, 0, 0);
1512 
1513   /* No instruction ever pushes more than a single element onto the
1514   ** stack.  And the stack never grows on successive executions of the
1515   ** same loop.  So the total number of instructions is an upper bound
1516   ** on the maximum stack depth required.
1517   **
1518   ** Allocation all the stack space we will ever need.
1519   */
1520   n = isExplain ? 10 : p->nOp;
1521   p->aStack = sqliteMalloc( n*(sizeof(p->aStack[0]) + 2*sizeof(char*)) );
1522   p->zStack = (char**)&p->aStack[n];
1523   p->azColName = (char**)&p->zStack[n];
1524 
1525   sqliteHashInit(&p->agg.hash, SQLITE_HASH_BINARY, 0);
1526   p->agg.pSearch = 0;
1527 #ifdef MEMORY_DEBUG
1528   if( sqliteOsFileExists("vdbe_trace") ){
1529     p->trace = stdout;
1530   }
1531 #endif
1532   p->tos = -1;
1533   p->pc = 0;
1534   p->rc = SQLITE_OK;
1535   p->uniqueCnt = 0;
1536   p->returnDepth = 0;
1537   p->errorAction = OE_Abort;
1538   p->undoTransOnError = 0;
1539   p->xCallback = xCallback;
1540   p->pCbArg = pCallbackArg;
1541   p->popStack =  0;
1542   p->explain = isExplain;
1543   p->magic = VDBE_MAGIC_RUN;
1544 #ifdef VDBE_PROFILE
1545   for(i=0; i<p->nOp; i++){
1546     p->aOp[i].cnt = 0;
1547     p->aOp[i].cycles = 0;
1548   }
1549 #endif
1550 }
1551 
1552 /*
1553 ** Execute as much of a VDBE program as we can then return.
1554 **
1555 ** sqliteVdbeMakeReady() must be called before this routine in order to
1556 ** close the program with a final OP_Halt and to set up the callbacks
1557 ** and the error message pointer.
1558 **
1559 ** Whenever a row or result data is available, this routine will either
1560 ** invoke the result callback (if there is one) or return with
1561 ** SQLITE_ROW.
1562 **
1563 ** If an attempt is made to open a locked database, then this routine
1564 ** will either invoke the busy callback (if there is one) or it will
1565 ** return SQLITE_BUSY.
1566 **
1567 ** If an error occurs, an error message is written to memory obtained
1568 ** from sqliteMalloc() and p->zErrMsg is made to point to that memory.
1569 ** The error code is stored in p->rc and this routine returns SQLITE_ERROR.
1570 **
1571 ** If the callback ever returns non-zero, then the program exits
1572 ** immediately.  There will be no error message but the p->rc field is
1573 ** set to SQLITE_ABORT and this routine will return SQLITE_ERROR.
1574 **
1575 ** A memory allocation error causes p->rc to be set to SQLITE_NOMEM and this
1576 ** routine to return SQLITE_ERROR.
1577 **
1578 ** Other fatal errors return SQLITE_ERROR.
1579 **
1580 ** After this routine has finished, sqliteVdbeFinalize() should be
1581 ** used to clean up the mess that was left behind.
1582 */
1583 int sqliteVdbeExec(
1584   Vdbe *p                    /* The VDBE */
1585 ){
1586   int pc;                    /* The program counter */
1587   Op *pOp;                   /* Current operation */
1588   int rc = SQLITE_OK;        /* Value to return */
1589   sqlite *db = p->db;        /* The database */
1590   char **zStack = p->zStack; /* Text stack */
1591   Stack *aStack = p->aStack; /* Additional stack information */
1592   char zBuf[100];            /* Space to sprintf() an integer */
1593 #ifdef VDBE_PROFILE
1594   unsigned long long start;  /* CPU clock count at start of opcode */
1595   int origPc;                /* Program counter at start of opcode */
1596 #endif
1597 
1598   if( p->magic!=VDBE_MAGIC_RUN ) return SQLITE_MISUSE;
1599   assert( db->magic==SQLITE_MAGIC_BUSY );
1600   assert( p->rc==SQLITE_OK || p->rc==SQLITE_BUSY );
1601   p->rc = SQLITE_OK;
1602   assert( p->explain==0 );
1603   if( sqlite_malloc_failed ) goto no_mem;
1604   if( p->popStack ){
1605     PopStack(p, p->popStack);
1606     p->popStack = 0;
1607   }
1608   for(pc=p->pc; rc==SQLITE_OK; pc++){
1609     assert( pc>=0 && pc<p->nOp );
1610 #ifdef VDBE_PROFILE
1611     origPc = pc;
1612     start = hwtime();
1613 #endif
1614     pOp = &p->aOp[pc];
1615 
1616     /* Only allow tracing if NDEBUG is not defined.
1617     */
1618 #ifndef NDEBUG
1619     if( p->trace ){
1620       vdbePrintOp(p->trace, pc, pOp);
1621     }
1622 #endif
1623 
1624     switch( pOp->opcode ){
1625 
1626 /*****************************************************************************
1627 ** What follows is a massive switch statement where each case implements a
1628 ** separate instruction in the virtual machine.  If we follow the usual
1629 ** indentation conventions, each case should be indented by 6 spaces.  But
1630 ** that is a lot of wasted space on the left margin.  So the code within
1631 ** the switch statement will break with convention and be flush-left. Another
1632 ** big comment (similar to this one) will mark the point in the code where
1633 ** we transition back to normal indentation.
1634 **
1635 ** The formatting of each case is important.  The makefile for SQLite
1636 ** generates two C files "opcodes.h" and "opcodes.c" by scanning this
1637 ** file looking for lines that begin with "case OP_".  The opcodes.h files
1638 ** will be filled with #defines that give unique integer values to each
1639 ** opcode and the opcodes.c file is filled with an array of strings where
1640 ** each string is the symbolic name for the corresponding opcode.
1641 **
1642 ** Documentation about VDBE opcodes is generated by scanning this file
1643 ** for lines of that contain "Opcode:".  That line and all subsequent
1644 ** comment lines are used in the generation of the opcode.html documentation
1645 ** file.
1646 **
1647 ** SUMMARY:
1648 **
1649 **     Formatting is important to scripts that scan this file.
1650 **     Do not deviate from the formatting style currently in use.
1651 **
1652 *****************************************************************************/
1653 
1654 /* Opcode:  Goto * P2 *
1655 **
1656 ** An unconditional jump to address P2.
1657 ** The next instruction executed will be
1658 ** the one at index P2 from the beginning of
1659 ** the program.
1660 */
1661 case OP_Goto: {
1662   CHECK_FOR_INTERRUPT;
1663   pc = pOp->p2 - 1;
1664   break;
1665 }
1666 
1667 /* Opcode:  Gosub * P2 *
1668 **
1669 ** Push the current address plus 1 onto the return address stack
1670 ** and then jump to address P2.
1671 **
1672 ** The return address stack is of limited depth.  If too many
1673 ** OP_Gosub operations occur without intervening OP_Returns, then
1674 ** the return address stack will fill up and processing will abort
1675 ** with a fatal error.
1676 */
1677 case OP_Gosub: {
1678   if( p->returnDepth>=sizeof(p->returnStack)/sizeof(p->returnStack[0]) ){
1679     sqliteSetString(&p->zErrMsg, "return address stack overflow", 0);
1680     p->rc = SQLITE_INTERNAL;
1681     return SQLITE_ERROR;
1682   }
1683   p->returnStack[p->returnDepth++] = pc+1;
1684   pc = pOp->p2 - 1;
1685   break;
1686 }
1687 
1688 /* Opcode:  Return * * *
1689 **
1690 ** Jump immediately to the next instruction after the last unreturned
1691 ** OP_Gosub.  If an OP_Return has occurred for all OP_Gosubs, then
1692 ** processing aborts with a fatal error.
1693 */
1694 case OP_Return: {
1695   if( p->returnDepth<=0 ){
1696     sqliteSetString(&p->zErrMsg, "return address stack underflow", 0);
1697     p->rc = SQLITE_INTERNAL;
1698     return SQLITE_ERROR;
1699   }
1700   p->returnDepth--;
1701   pc = p->returnStack[p->returnDepth] - 1;
1702   break;
1703 }
1704 
1705 /* Opcode:  Halt P1 P2 *
1706 **
1707 ** Exit immediately.  All open cursors, Lists, Sorts, etc are closed
1708 ** automatically.
1709 **
1710 ** P1 is the result code returned by sqlite_exec().  For a normal
1711 ** halt, this should be SQLITE_OK (0).  For errors, it can be some
1712 ** other value.  If P1!=0 then P2 will determine whether or not to
1713 ** rollback the current transaction.  Do not rollback if P2==OE_Fail.
1714 ** Do the rollback if P2==OE_Rollback.  If P2==OE_Abort, then back
1715 ** out all changes that have occurred during this execution of the
1716 ** VDBE, but do not rollback the transaction.
1717 **
1718 ** There is an implied "Halt 0 0 0" instruction inserted at the very end of
1719 ** every program.  So a jump past the last instruction of the program
1720 ** is the same as executing Halt.
1721 */
1722 case OP_Halt: {
1723   p->magic = VDBE_MAGIC_HALT;
1724   if( pOp->p1!=SQLITE_OK ){
1725     p->rc = pOp->p1;
1726     p->errorAction = pOp->p2;
1727     if( pOp->p3 ){
1728       sqliteSetString(&p->zErrMsg, pOp->p3, 0);
1729     }
1730     return SQLITE_ERROR;
1731   }else{
1732     p->rc = SQLITE_OK;
1733     return SQLITE_DONE;
1734   }
1735 }
1736 
1737 /* Opcode: Integer P1 * P3
1738 **
1739 ** The integer value P1 is pushed onto the stack.  If P3 is not zero
1740 ** then it is assumed to be a string representation of the same integer.
1741 */
1742 case OP_Integer: {
1743   int i = ++p->tos;
1744   aStack[i].i = pOp->p1;
1745   aStack[i].flags = STK_Int;
1746   if( pOp->p3 ){
1747     zStack[i] = pOp->p3;
1748     aStack[i].flags |= STK_Str | STK_Static;
1749     aStack[i].n = strlen(pOp->p3)+1;
1750   }
1751   break;
1752 }
1753 
1754 /* Opcode: String * * P3
1755 **
1756 ** The string value P3 is pushed onto the stack.  If P3==0 then a
1757 ** NULL is pushed onto the stack.
1758 */
1759 case OP_String: {
1760   int i = ++p->tos;
1761   char *z;
1762   z = pOp->p3;
1763   if( z==0 ){
1764     zStack[i] = 0;
1765     aStack[i].n = 0;
1766     aStack[i].flags = STK_Null;
1767   }else{
1768     zStack[i] = z;
1769     aStack[i].n = strlen(z) + 1;
1770     aStack[i].flags = STK_Str | STK_Static;
1771   }
1772   break;
1773 }
1774 
1775 /* Opcode: Pop P1 * *
1776 **
1777 ** P1 elements are popped off of the top of stack and discarded.
1778 */
1779 case OP_Pop: {
1780   assert( p->tos+1>=pOp->p1 );
1781   PopStack(p, pOp->p1);
1782   break;
1783 }
1784 
1785 /* Opcode: Dup P1 P2 *
1786 **
1787 ** A copy of the P1-th element of the stack
1788 ** is made and pushed onto the top of the stack.
1789 ** The top of the stack is element 0.  So the
1790 ** instruction "Dup 0 0 0" will make a copy of the
1791 ** top of the stack.
1792 **
1793 ** If the content of the P1-th element is a dynamically
1794 ** allocated string, then a new copy of that string
1795 ** is made if P2==0.  If P2!=0, then just a pointer
1796 ** to the string is copied.
1797 **
1798 ** Also see the Pull instruction.
1799 */
1800 case OP_Dup: {
1801   int i = p->tos - pOp->p1;
1802   int j = ++p->tos;
1803   VERIFY( if( i<0 ) goto not_enough_stack; )
1804   memcpy(&aStack[j], &aStack[i], sizeof(aStack[i])-NBFS);
1805   if( aStack[j].flags & STK_Str ){
1806     int isStatic = (aStack[j].flags & STK_Static)!=0;
1807     if( pOp->p2 || isStatic ){
1808       zStack[j] = zStack[i];
1809       aStack[j].flags &= ~STK_Dyn;
1810       if( !isStatic ) aStack[j].flags |= STK_Ephem;
1811     }else if( aStack[i].n<=NBFS ){
1812       memcpy(aStack[j].z, zStack[i], aStack[j].n);
1813       zStack[j] = aStack[j].z;
1814       aStack[j].flags &= ~(STK_Static|STK_Dyn|STK_Ephem);
1815     }else{
1816       zStack[j] = sqliteMallocRaw( aStack[j].n );
1817       if( zStack[j]==0 ) goto no_mem;
1818       memcpy(zStack[j], zStack[i], aStack[j].n);
1819       aStack[j].flags &= ~(STK_Static|STK_Ephem);
1820       aStack[j].flags |= STK_Dyn;
1821     }
1822   }
1823   break;
1824 }
1825 
1826 /* Opcode: Pull P1 * *
1827 **
1828 ** The P1-th element is removed from its current location on
1829 ** the stack and pushed back on top of the stack.  The
1830 ** top of the stack is element 0, so "Pull 0 0 0" is
1831 ** a no-op.  "Pull 1 0 0" swaps the top two elements of
1832 ** the stack.
1833 **
1834 ** See also the Dup instruction.
1835 */
1836 case OP_Pull: {
1837   int from = p->tos - pOp->p1;
1838   int to = p->tos;
1839   int i;
1840   Stack ts;
1841   char *tz;
1842   VERIFY( if( from<0 ) goto not_enough_stack; )
1843   Deephemeralize(p, from);
1844   ts = aStack[from];
1845   tz = zStack[from];
1846   Deephemeralize(p, to);
1847   for(i=from; i<to; i++){
1848     Deephemeralize(p, i+1);
1849     aStack[i] = aStack[i+1];
1850     assert( (aStack[i].flags & STK_Ephem)==0 );
1851     if( aStack[i].flags & (STK_Dyn|STK_Static) ){
1852       zStack[i] = zStack[i+1];
1853     }else{
1854       zStack[i] = aStack[i].z;
1855     }
1856   }
1857   aStack[to] = ts;
1858   assert( (aStack[to].flags & STK_Ephem)==0 );
1859   if( aStack[to].flags & (STK_Dyn|STK_Static) ){
1860     zStack[to] = tz;
1861   }else{
1862     zStack[to] = aStack[to].z;
1863   }
1864   break;
1865 }
1866 
1867 /* Opcode: Push P1 * *
1868 **
1869 ** Overwrite the value of the P1-th element down on the
1870 ** stack (P1==0 is the top of the stack) with the value
1871 ** of the top of the stack.  Then pop the top of the stack.
1872 */
1873 case OP_Push: {
1874   int from = p->tos;
1875   int to = p->tos - pOp->p1;
1876 
1877   VERIFY( if( to<0 ) goto not_enough_stack; )
1878   if( aStack[to].flags & STK_Dyn ){
1879     sqliteFree(zStack[to]);
1880   }
1881   Deephemeralize(p, from);
1882   aStack[to] = aStack[from];
1883   if( aStack[to].flags & (STK_Dyn|STK_Static|STK_Ephem) ){
1884     zStack[to] = zStack[from];
1885   }else{
1886     zStack[to] = aStack[to].z;
1887   }
1888   aStack[from].flags = 0;
1889   p->tos--;
1890   break;
1891 }
1892 
1893 /* Opcode: ColumnName P1 * P3
1894 **
1895 ** P3 becomes the P1-th column name (first is 0).  An array of pointers
1896 ** to all column names is passed as the 4th parameter to the callback.
1897 */
1898 case OP_ColumnName: {
1899   assert( pOp->p1>=0 && pOp->p1<p->nOp );
1900   p->azColName[pOp->p1] = pOp->p3;
1901   p->nCallback = 0;
1902   break;
1903 }
1904 
1905 /* Opcode: Callback P1 * *
1906 **
1907 ** Pop P1 values off the stack and form them into an array.  Then
1908 ** invoke the callback function using the newly formed array as the
1909 ** 3rd parameter.
1910 */
1911 case OP_Callback: {
1912   int i = p->tos - pOp->p1 + 1;
1913   int j;
1914   VERIFY( if( i<0 ) goto not_enough_stack; )
1915   for(j=i; j<=p->tos; j++){
1916     if( aStack[j].flags & STK_Null ){
1917       zStack[j] = 0;
1918     }else{
1919       Stringify(p, j);
1920     }
1921   }
1922   zStack[p->tos+1] = 0;
1923   if( p->xCallback==0 ){
1924     p->azResColumn = &zStack[i];
1925     p->nResColumn = pOp->p1;
1926     p->popStack = pOp->p1;
1927     p->pc = pc + 1;
1928     return SQLITE_ROW;
1929   }
1930   if( sqliteSafetyOff(db) ) goto abort_due_to_misuse;
1931   if( p->xCallback(p->pCbArg, pOp->p1, &zStack[i], p->azColName)!=0 ){
1932     rc = SQLITE_ABORT;
1933   }
1934   if( sqliteSafetyOn(db) ) goto abort_due_to_misuse;
1935   p->nCallback++;
1936   PopStack(p, pOp->p1);
1937   if( sqlite_malloc_failed ) goto no_mem;
1938   break;
1939 }
1940 
1941 /* Opcode: NullCallback P1 * *
1942 **
1943 ** Invoke the callback function once with the 2nd argument (the
1944 ** number of columns) equal to P1 and with the 4th argument (the
1945 ** names of the columns) set according to prior OP_ColumnName
1946 ** instructions.  This is all like the regular
1947 ** OP_Callback or OP_SortCallback opcodes.  But the 3rd argument
1948 ** which normally contains a pointer to an array of pointers to
1949 ** data is NULL.
1950 **
1951 ** The callback is only invoked if there have been no prior calls
1952 ** to OP_Callback or OP_SortCallback.
1953 **
1954 ** This opcode is used to report the number and names of columns
1955 ** in cases where the result set is empty.
1956 */
1957 case OP_NullCallback: {
1958   if( p->nCallback==0 && p->xCallback!=0 ){
1959     if( sqliteSafetyOff(db) ) goto abort_due_to_misuse;
1960     if( p->xCallback(p->pCbArg, pOp->p1, 0, p->azColName)!=0 ){
1961       rc = SQLITE_ABORT;
1962     }
1963     if( sqliteSafetyOn(db) ) goto abort_due_to_misuse;
1964     p->nCallback++;
1965     if( sqlite_malloc_failed ) goto no_mem;
1966   }
1967   p->nResColumn = pOp->p1;
1968   break;
1969 }
1970 
1971 /* Opcode: Concat P1 P2 P3
1972 **
1973 ** Look at the first P1 elements of the stack.  Append them all
1974 ** together with the lowest element first.  Use P3 as a separator.
1975 ** Put the result on the top of the stack.  The original P1 elements
1976 ** are popped from the stack if P2==0 and retained if P2==1.  If
1977 ** any element of the stack is NULL, then the result is NULL.
1978 **
1979 ** If P3 is NULL, then use no separator.  When P1==1, this routine
1980 ** makes a copy of the top stack element into memory obtained
1981 ** from sqliteMalloc().
1982 */
1983 case OP_Concat: {
1984   char *zNew;
1985   int nByte;
1986   int nField;
1987   int i, j;
1988   char *zSep;
1989   int nSep;
1990 
1991   nField = pOp->p1;
1992   zSep = pOp->p3;
1993   if( zSep==0 ) zSep = "";
1994   nSep = strlen(zSep);
1995   VERIFY( if( p->tos+1<nField ) goto not_enough_stack; )
1996   nByte = 1 - nSep;
1997   for(i=p->tos-nField+1; i<=p->tos; i++){
1998     if( aStack[i].flags & STK_Null ){
1999       nByte = -1;
2000       break;
2001     }else{
2002       Stringify(p, i);
2003       nByte += aStack[i].n - 1 + nSep;
2004     }
2005   }
2006   if( nByte<0 ){
2007     if( pOp->p2==0 ) PopStack(p, nField);
2008     p->tos++;
2009     aStack[p->tos].flags = STK_Null;
2010     zStack[p->tos] = 0;
2011     break;
2012   }
2013   zNew = sqliteMallocRaw( nByte );
2014   if( zNew==0 ) goto no_mem;
2015   j = 0;
2016   for(i=p->tos-nField+1; i<=p->tos; i++){
2017     if( (aStack[i].flags & STK_Null)==0 ){
2018       memcpy(&zNew[j], zStack[i], aStack[i].n-1);
2019       j += aStack[i].n-1;
2020     }
2021     if( nSep>0 && i<p->tos ){
2022       memcpy(&zNew[j], zSep, nSep);
2023       j += nSep;
2024     }
2025   }
2026   zNew[j] = 0;
2027   if( pOp->p2==0 ) PopStack(p, nField);
2028   p->tos++;
2029   aStack[p->tos].n = nByte;
2030   aStack[p->tos].flags = STK_Str|STK_Dyn;
2031   zStack[p->tos] = zNew;
2032   break;
2033 }
2034 
2035 /* Opcode: Add * * *
2036 **
2037 ** Pop the top two elements from the stack, add them together,
2038 ** and push the result back onto the stack.  If either element
2039 ** is a string then it is converted to a double using the atof()
2040 ** function before the addition.
2041 ** If either operand is NULL, the result is NULL.
2042 */
2043 /* Opcode: Multiply * * *
2044 **
2045 ** Pop the top two elements from the stack, multiply them together,
2046 ** and push the result back onto the stack.  If either element
2047 ** is a string then it is converted to a double using the atof()
2048 ** function before the multiplication.
2049 ** If either operand is NULL, the result is NULL.
2050 */
2051 /* Opcode: Subtract * * *
2052 **
2053 ** Pop the top two elements from the stack, subtract the
2054 ** first (what was on top of the stack) from the second (the
2055 ** next on stack)
2056 ** and push the result back onto the stack.  If either element
2057 ** is a string then it is converted to a double using the atof()
2058 ** function before the subtraction.
2059 ** If either operand is NULL, the result is NULL.
2060 */
2061 /* Opcode: Divide * * *
2062 **
2063 ** Pop the top two elements from the stack, divide the
2064 ** first (what was on top of the stack) from the second (the
2065 ** next on stack)
2066 ** and push the result back onto the stack.  If either element
2067 ** is a string then it is converted to a double using the atof()
2068 ** function before the division.  Division by zero returns NULL.
2069 ** If either operand is NULL, the result is NULL.
2070 */
2071 /* Opcode: Remainder * * *
2072 **
2073 ** Pop the top two elements from the stack, divide the
2074 ** first (what was on top of the stack) from the second (the
2075 ** next on stack)
2076 ** and push the remainder after division onto the stack.  If either element
2077 ** is a string then it is converted to a double using the atof()
2078 ** function before the division.  Division by zero returns NULL.
2079 ** If either operand is NULL, the result is NULL.
2080 */
2081 case OP_Add:
2082 case OP_Subtract:
2083 case OP_Multiply:
2084 case OP_Divide:
2085 case OP_Remainder: {
2086   int tos = p->tos;
2087   int nos = tos - 1;
2088   VERIFY( if( nos<0 ) goto not_enough_stack; )
2089   if( ((aStack[tos].flags | aStack[nos].flags) & STK_Null)!=0 ){
2090     POPSTACK;
2091     Release(p, nos);
2092     aStack[nos].flags = STK_Null;
2093   }else if( (aStack[tos].flags & aStack[nos].flags & STK_Int)==STK_Int ){
2094     int a, b;
2095     a = aStack[tos].i;
2096     b = aStack[nos].i;
2097     switch( pOp->opcode ){
2098       case OP_Add:         b += a;       break;
2099       case OP_Subtract:    b -= a;       break;
2100       case OP_Multiply:    b *= a;       break;
2101       case OP_Divide: {
2102         if( a==0 ) goto divide_by_zero;
2103         b /= a;
2104         break;
2105       }
2106       default: {
2107         if( a==0 ) goto divide_by_zero;
2108         b %= a;
2109         break;
2110       }
2111     }
2112     POPSTACK;
2113     Release(p, nos);
2114     aStack[nos].i = b;
2115     aStack[nos].flags = STK_Int;
2116   }else{
2117     double a, b;
2118     Realify(p, tos);
2119     Realify(p, nos);
2120     a = aStack[tos].r;
2121     b = aStack[nos].r;
2122     switch( pOp->opcode ){
2123       case OP_Add:         b += a;       break;
2124       case OP_Subtract:    b -= a;       break;
2125       case OP_Multiply:    b *= a;       break;
2126       case OP_Divide: {
2127         if( a==0.0 ) goto divide_by_zero;
2128         b /= a;
2129         break;
2130       }
2131       default: {
2132         int ia = (int)a;
2133         int ib = (int)b;
2134         if( ia==0.0 ) goto divide_by_zero;
2135         b = ib % ia;
2136         break;
2137       }
2138     }
2139     POPSTACK;
2140     Release(p, nos);
2141     aStack[nos].r = b;
2142     aStack[nos].flags = STK_Real;
2143   }
2144   break;
2145 
2146 divide_by_zero:
2147   PopStack(p, 2);
2148   p->tos = nos;
2149   aStack[nos].flags = STK_Null;
2150   break;
2151 }
2152 
2153 /* Opcode: Function P1 * P3
2154 **
2155 ** Invoke a user function (P3 is a pointer to a Function structure that
2156 ** defines the function) with P1 string arguments taken from the stack.
2157 ** Pop all arguments from the stack and push back the result.
2158 **
2159 ** See also: AggFunc
2160 */
2161 case OP_Function: {
2162   int n, i;
2163   sqlite_func ctx;
2164 
2165   n = pOp->p1;
2166   VERIFY( if( n<0 ) goto bad_instruction; )
2167   VERIFY( if( p->tos+1<n ) goto not_enough_stack; )
2168   for(i=p->tos-n+1; i<=p->tos; i++){
2169     if( aStack[i].flags & STK_Null ){
2170       zStack[i] = 0;
2171     }else{
2172       Stringify(p, i);
2173     }
2174   }
2175   ctx.pFunc = (FuncDef*)pOp->p3;
2176   ctx.s.flags = STK_Null;
2177   ctx.z = 0;
2178   ctx.isError = 0;
2179   ctx.isStep = 0;
2180   (*ctx.pFunc->xFunc)(&ctx, n, (const char**)&zStack[p->tos-n+1]);
2181   PopStack(p, n);
2182   p->tos++;
2183   aStack[p->tos] = ctx.s;
2184   if( ctx.s.flags & STK_Dyn ){
2185     zStack[p->tos] = ctx.z;
2186   }else if( ctx.s.flags & STK_Str ){
2187     zStack[p->tos] = aStack[p->tos].z;
2188   }else{
2189     zStack[p->tos] = 0;
2190   }
2191   if( ctx.isError ){
2192     sqliteSetString(&p->zErrMsg,
2193        zStack[p->tos] ? zStack[p->tos] : "user function error", 0);
2194     rc = SQLITE_ERROR;
2195   }
2196   break;
2197 }
2198 
2199 /* Opcode: BitAnd * * *
2200 **
2201 ** Pop the top two elements from the stack.  Convert both elements
2202 ** to integers.  Push back onto the stack the bit-wise AND of the
2203 ** two elements.
2204 ** If either operand is NULL, the result is NULL.
2205 */
2206 /* Opcode: BitOr * * *
2207 **
2208 ** Pop the top two elements from the stack.  Convert both elements
2209 ** to integers.  Push back onto the stack the bit-wise OR of the
2210 ** two elements.
2211 ** If either operand is NULL, the result is NULL.
2212 */
2213 /* Opcode: ShiftLeft * * *
2214 **
2215 ** Pop the top two elements from the stack.  Convert both elements
2216 ** to integers.  Push back onto the stack the top element shifted
2217 ** left by N bits where N is the second element on the stack.
2218 ** If either operand is NULL, the result is NULL.
2219 */
2220 /* Opcode: ShiftRight * * *
2221 **
2222 ** Pop the top two elements from the stack.  Convert both elements
2223 ** to integers.  Push back onto the stack the top element shifted
2224 ** right by N bits where N is the second element on the stack.
2225 ** If either operand is NULL, the result is NULL.
2226 */
2227 case OP_BitAnd:
2228 case OP_BitOr:
2229 case OP_ShiftLeft:
2230 case OP_ShiftRight: {
2231   int tos = p->tos;
2232   int nos = tos - 1;
2233   int a, b;
2234   VERIFY( if( nos<0 ) goto not_enough_stack; )
2235   if( (aStack[tos].flags | aStack[nos].flags) & STK_Null ){
2236     POPSTACK;
2237     Release(p,nos);
2238     aStack[nos].flags = STK_Null;
2239     break;
2240   }
2241   Integerify(p, tos);
2242   Integerify(p, nos);
2243   a = aStack[tos].i;
2244   b = aStack[nos].i;
2245   switch( pOp->opcode ){
2246     case OP_BitAnd:      a &= b;     break;
2247     case OP_BitOr:       a |= b;     break;
2248     case OP_ShiftLeft:   a <<= b;    break;
2249     case OP_ShiftRight:  a >>= b;    break;
2250     default:   /* CANT HAPPEN */     break;
2251   }
2252   POPSTACK;
2253   Release(p, nos);
2254   aStack[nos].i = a;
2255   aStack[nos].flags = STK_Int;
2256   break;
2257 }
2258 
2259 /* Opcode: AddImm  P1 * *
2260 **
2261 ** Add the value P1 to whatever is on top of the stack.  The result
2262 ** is always an integer.
2263 **
2264 ** To force the top of the stack to be an integer, just add 0.
2265 */
2266 case OP_AddImm: {
2267   int tos = p->tos;
2268   VERIFY( if( tos<0 ) goto not_enough_stack; )
2269   Integerify(p, tos);
2270   aStack[tos].i += pOp->p1;
2271   break;
2272 }
2273 
2274 /* Opcode: IsNumeric P1 P2 *
2275 **
2276 ** Check the top of the stack to see if it is a numeric value.  A numeric
2277 ** value is an integer, a real number, or a string that looks like an
2278 ** integer or a real number.  When P1==0, pop the stack and jump to P2
2279 ** if the value is numeric.  Otherwise fall through and leave the stack
2280 ** unchanged.  The sense of the test is inverted when P1==1.
2281 */
2282 case OP_IsNumeric: {
2283   int tos = p->tos;
2284   int r;
2285   VERIFY( if( tos<0 ) goto not_enough_stack; )
2286   r = (aStack[tos].flags & (STK_Int|STK_Real))!=0
2287            || (zStack[tos] && sqliteIsNumber(zStack[tos]));
2288   if( pOp->p1 ){
2289     r = !r;
2290   }
2291   if( r ){
2292     POPSTACK;
2293     pc = pOp->p2 - 1;
2294   }
2295   break;
2296 }
2297 
2298 /* Opcode: MustBeInt P1 P2 *
2299 **
2300 ** Force the top of the stack to be an integer.  If the top of the
2301 ** stack is not an integer and cannot be converted into an integer
2302 ** with out data loss, then jump immediately to P2, or if P2==0
2303 ** raise an SQLITE_MISMATCH exception.
2304 **
2305 ** If the top of the stack is not an integer and P2 is not zero and
2306 ** P1 is 1, then the stack is popped.  In all other cases, the depth
2307 ** of the stack is unchanged.
2308 */
2309 case OP_MustBeInt: {
2310   int tos = p->tos;
2311   VERIFY( if( tos<0 ) goto not_enough_stack; )
2312   if( aStack[tos].flags & STK_Int ){
2313     /* Do nothing */
2314   }else if( aStack[tos].flags & STK_Real ){
2315     int i = aStack[tos].r;
2316     double r = (double)i;
2317     if( r!=aStack[tos].r ){
2318       goto mismatch;
2319     }
2320     aStack[tos].i = i;
2321   }else if( aStack[tos].flags & STK_Str ){
2322     int v;
2323     if( !toInt(zStack[tos], &v) ){
2324       double r;
2325       if( !sqliteIsNumber(zStack[tos]) ){
2326         goto mismatch;
2327       }
2328       Realify(p, tos);
2329       assert( (aStack[tos].flags & STK_Real)!=0 );
2330       v = aStack[tos].r;
2331       r = (double)v;
2332       if( r!=aStack[tos].r ){
2333         goto mismatch;
2334       }
2335     }
2336     aStack[tos].i = v;
2337   }else{
2338     goto mismatch;
2339   }
2340   Release(p, tos);
2341   aStack[tos].flags = STK_Int;
2342   break;
2343 
2344 mismatch:
2345   if( pOp->p2==0 ){
2346     rc = SQLITE_MISMATCH;
2347     goto abort_due_to_error;
2348   }else{
2349     if( pOp->p1 ) POPSTACK;
2350     pc = pOp->p2 - 1;
2351   }
2352   break;
2353 }
2354 
2355 /* Opcode: Eq P1 P2 *
2356 **
2357 ** Pop the top two elements from the stack.  If they are equal, then
2358 ** jump to instruction P2.  Otherwise, continue to the next instruction.
2359 **
2360 ** If either operand is NULL (and thus if the result is unknown) then
2361 ** take the jump if P1 is true.
2362 **
2363 ** If both values are numeric, they are converted to doubles using atof()
2364 ** and compared for equality that way.  Otherwise the strcmp() library
2365 ** routine is used for the comparison.  For a pure text comparison
2366 ** use OP_StrEq.
2367 **
2368 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
2369 ** stack if the jump would have been taken, or a 0 if not.  Push a
2370 ** NULL if either operand was NULL.
2371 */
2372 /* Opcode: Ne P1 P2 *
2373 **
2374 ** Pop the top two elements from the stack.  If they are not equal, then
2375 ** jump to instruction P2.  Otherwise, continue to the next instruction.
2376 **
2377 ** If either operand is NULL (and thus if the result is unknown) then
2378 ** take the jump if P1 is true.
2379 **
2380 ** If both values are numeric, they are converted to doubles using atof()
2381 ** and compared in that format.  Otherwise the strcmp() library
2382 ** routine is used for the comparison.  For a pure text comparison
2383 ** use OP_StrNe.
2384 **
2385 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
2386 ** stack if the jump would have been taken, or a 0 if not.  Push a
2387 ** NULL if either operand was NULL.
2388 */
2389 /* Opcode: Lt P1 P2 *
2390 **
2391 ** Pop the top two elements from the stack.  If second element (the
2392 ** next on stack) is less than the first (the top of stack), then
2393 ** jump to instruction P2.  Otherwise, continue to the next instruction.
2394 ** In other words, jump if NOS<TOS.
2395 **
2396 ** If either operand is NULL (and thus if the result is unknown) then
2397 ** take the jump if P1 is true.
2398 **
2399 ** If both values are numeric, they are converted to doubles using atof()
2400 ** and compared in that format.  Numeric values are always less than
2401 ** non-numeric values.  If both operands are non-numeric, the strcmp() library
2402 ** routine is used for the comparison.  For a pure text comparison
2403 ** use OP_StrLt.
2404 **
2405 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
2406 ** stack if the jump would have been taken, or a 0 if not.  Push a
2407 ** NULL if either operand was NULL.
2408 */
2409 /* Opcode: Le P1 P2 *
2410 **
2411 ** Pop the top two elements from the stack.  If second element (the
2412 ** next on stack) is less than or equal to the first (the top of stack),
2413 ** then jump to instruction P2. In other words, jump if NOS<=TOS.
2414 **
2415 ** If either operand is NULL (and thus if the result is unknown) then
2416 ** take the jump if P1 is true.
2417 **
2418 ** If both values are numeric, they are converted to doubles using atof()
2419 ** and compared in that format.  Numeric values are always less than
2420 ** non-numeric values.  If both operands are non-numeric, the strcmp() library
2421 ** routine is used for the comparison.  For a pure text comparison
2422 ** use OP_StrLe.
2423 **
2424 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
2425 ** stack if the jump would have been taken, or a 0 if not.  Push a
2426 ** NULL if either operand was NULL.
2427 */
2428 /* Opcode: Gt P1 P2 *
2429 **
2430 ** Pop the top two elements from the stack.  If second element (the
2431 ** next on stack) is greater than the first (the top of stack),
2432 ** then jump to instruction P2. In other words, jump if NOS>TOS.
2433 **
2434 ** If either operand is NULL (and thus if the result is unknown) then
2435 ** take the jump if P1 is true.
2436 **
2437 ** If both values are numeric, they are converted to doubles using atof()
2438 ** and compared in that format.  Numeric values are always less than
2439 ** non-numeric values.  If both operands are non-numeric, the strcmp() library
2440 ** routine is used for the comparison.  For a pure text comparison
2441 ** use OP_StrGt.
2442 **
2443 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
2444 ** stack if the jump would have been taken, or a 0 if not.  Push a
2445 ** NULL if either operand was NULL.
2446 */
2447 /* Opcode: Ge P1 P2 *
2448 **
2449 ** Pop the top two elements from the stack.  If second element (the next
2450 ** on stack) is greater than or equal to the first (the top of stack),
2451 ** then jump to instruction P2. In other words, jump if NOS>=TOS.
2452 **
2453 ** If either operand is NULL (and thus if the result is unknown) then
2454 ** take the jump if P1 is true.
2455 **
2456 ** If both values are numeric, they are converted to doubles using atof()
2457 ** and compared in that format.  Numeric values are always less than
2458 ** non-numeric values.  If both operands are non-numeric, the strcmp() library
2459 ** routine is used for the comparison.  For a pure text comparison
2460 ** use OP_StrGe.
2461 **
2462 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
2463 ** stack if the jump would have been taken, or a 0 if not.  Push a
2464 ** NULL if either operand was NULL.
2465 */
2466 case OP_Eq:
2467 case OP_Ne:
2468 case OP_Lt:
2469 case OP_Le:
2470 case OP_Gt:
2471 case OP_Ge: {
2472   int tos = p->tos;
2473   int nos = tos - 1;
2474   int c, v;
2475   int ft, fn;
2476   VERIFY( if( nos<0 ) goto not_enough_stack; )
2477   ft = aStack[tos].flags;
2478   fn = aStack[nos].flags;
2479   if( (ft | fn) & STK_Null ){
2480     POPSTACK;
2481     POPSTACK;
2482     if( pOp->p2 ){
2483       if( pOp->p1 ) pc = pOp->p2-1;
2484     }else{
2485       p->tos++;
2486       aStack[nos].flags = STK_Null;
2487     }
2488     break;
2489   }else if( (ft & fn & STK_Int)==STK_Int ){
2490     c = aStack[nos].i - aStack[tos].i;
2491   }else if( (ft & STK_Int)!=0 && (fn & STK_Str)!=0 && toInt(zStack[nos],&v) ){
2492     Release(p, nos);
2493     aStack[nos].i = v;
2494     aStack[nos].flags = STK_Int;
2495     c = aStack[nos].i - aStack[tos].i;
2496   }else if( (fn & STK_Int)!=0 && (ft & STK_Str)!=0 && toInt(zStack[tos],&v) ){
2497     Release(p, tos);
2498     aStack[tos].i = v;
2499     aStack[tos].flags = STK_Int;
2500     c = aStack[nos].i - aStack[tos].i;
2501   }else{
2502     Stringify(p, tos);
2503     Stringify(p, nos);
2504     c = sqliteCompare(zStack[nos], zStack[tos]);
2505   }
2506   switch( pOp->opcode ){
2507     case OP_Eq:    c = c==0;     break;
2508     case OP_Ne:    c = c!=0;     break;
2509     case OP_Lt:    c = c<0;      break;
2510     case OP_Le:    c = c<=0;     break;
2511     case OP_Gt:    c = c>0;      break;
2512     default:       c = c>=0;     break;
2513   }
2514   POPSTACK;
2515   POPSTACK;
2516   if( pOp->p2 ){
2517     if( c ) pc = pOp->p2-1;
2518   }else{
2519     p->tos++;
2520     aStack[nos].flags = STK_Int;
2521     aStack[nos].i = c;
2522   }
2523   break;
2524 }
2525 /* INSERT NO CODE HERE!
2526 **
2527 ** The opcode numbers are extracted from this source file by doing
2528 **
2529 **    grep '^case OP_' vdbe.c | ... >opcodes.h
2530 **
2531 ** The opcodes are numbered in the order that they appear in this file.
2532 ** But in order for the expression generating code to work right, the
2533 ** string comparison operators that follow must be numbered exactly 6
2534 ** greater than the numeric comparison opcodes above.  So no other
2535 ** cases can appear between the two.
2536 */
2537 /* Opcode: StrEq P1 P2 *
2538 **
2539 ** Pop the top two elements from the stack.  If they are equal, then
2540 ** jump to instruction P2.  Otherwise, continue to the next instruction.
2541 **
2542 ** If either operand is NULL (and thus if the result is unknown) then
2543 ** take the jump if P1 is true.
2544 **
2545 ** The strcmp() library routine is used for the comparison.  For a
2546 ** numeric comparison, use OP_Eq.
2547 **
2548 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
2549 ** stack if the jump would have been taken, or a 0 if not.  Push a
2550 ** NULL if either operand was NULL.
2551 */
2552 /* Opcode: StrNe P1 P2 *
2553 **
2554 ** Pop the top two elements from the stack.  If they are not equal, then
2555 ** jump to instruction P2.  Otherwise, continue to the next instruction.
2556 **
2557 ** If either operand is NULL (and thus if the result is unknown) then
2558 ** take the jump if P1 is true.
2559 **
2560 ** The strcmp() library routine is used for the comparison.  For a
2561 ** numeric comparison, use OP_Ne.
2562 **
2563 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
2564 ** stack if the jump would have been taken, or a 0 if not.  Push a
2565 ** NULL if either operand was NULL.
2566 */
2567 /* Opcode: StrLt P1 P2 *
2568 **
2569 ** Pop the top two elements from the stack.  If second element (the
2570 ** next on stack) is less than the first (the top of stack), then
2571 ** jump to instruction P2.  Otherwise, continue to the next instruction.
2572 ** In other words, jump if NOS<TOS.
2573 **
2574 ** If either operand is NULL (and thus if the result is unknown) then
2575 ** take the jump if P1 is true.
2576 **
2577 ** The strcmp() library routine is used for the comparison.  For a
2578 ** numeric comparison, use OP_Lt.
2579 **
2580 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
2581 ** stack if the jump would have been taken, or a 0 if not.  Push a
2582 ** NULL if either operand was NULL.
2583 */
2584 /* Opcode: StrLe P1 P2 *
2585 **
2586 ** Pop the top two elements from the stack.  If second element (the
2587 ** next on stack) is less than or equal to the first (the top of stack),
2588 ** then jump to instruction P2. In other words, jump if NOS<=TOS.
2589 **
2590 ** If either operand is NULL (and thus if the result is unknown) then
2591 ** take the jump if P1 is true.
2592 **
2593 ** The strcmp() library routine is used for the comparison.  For a
2594 ** numeric comparison, use OP_Le.
2595 **
2596 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
2597 ** stack if the jump would have been taken, or a 0 if not.  Push a
2598 ** NULL if either operand was NULL.
2599 */
2600 /* Opcode: StrGt P1 P2 *
2601 **
2602 ** Pop the top two elements from the stack.  If second element (the
2603 ** next on stack) is greater than the first (the top of stack),
2604 ** then jump to instruction P2. In other words, jump if NOS>TOS.
2605 **
2606 ** If either operand is NULL (and thus if the result is unknown) then
2607 ** take the jump if P1 is true.
2608 **
2609 ** The strcmp() library routine is used for the comparison.  For a
2610 ** numeric comparison, use OP_Gt.
2611 **
2612 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
2613 ** stack if the jump would have been taken, or a 0 if not.  Push a
2614 ** NULL if either operand was NULL.
2615 */
2616 /* Opcode: StrGe P1 P2 *
2617 **
2618 ** Pop the top two elements from the stack.  If second element (the next
2619 ** on stack) is greater than or equal to the first (the top of stack),
2620 ** then jump to instruction P2. In other words, jump if NOS>=TOS.
2621 **
2622 ** If either operand is NULL (and thus if the result is unknown) then
2623 ** take the jump if P1 is true.
2624 **
2625 ** The strcmp() library routine is used for the comparison.  For a
2626 ** numeric comparison, use OP_Ge.
2627 **
2628 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
2629 ** stack if the jump would have been taken, or a 0 if not.  Push a
2630 ** NULL if either operand was NULL.
2631 */
2632 case OP_StrEq:
2633 case OP_StrNe:
2634 case OP_StrLt:
2635 case OP_StrLe:
2636 case OP_StrGt:
2637 case OP_StrGe: {
2638   int tos = p->tos;
2639   int nos = tos - 1;
2640   int c;
2641   VERIFY( if( nos<0 ) goto not_enough_stack; )
2642   if( (aStack[nos].flags | aStack[tos].flags) & STK_Null ){
2643     POPSTACK;
2644     POPSTACK;
2645     if( pOp->p2 ){
2646       if( pOp->p1 ) pc = pOp->p2-1;
2647     }else{
2648       p->tos++;
2649       aStack[nos].flags = STK_Null;
2650     }
2651     break;
2652   }else{
2653     Stringify(p, tos);
2654     Stringify(p, nos);
2655     c = strcmp(zStack[nos], zStack[tos]);
2656   }
2657   /* The asserts on each case of the following switch are there to verify
2658   ** that string comparison opcodes are always exactly 6 greater than the
2659   ** corresponding numeric comparison opcodes.  The code generator depends
2660   ** on this fact.
2661   */
2662   switch( pOp->opcode ){
2663     case OP_StrEq:    c = c==0;    assert( pOp->opcode-6==OP_Eq );   break;
2664     case OP_StrNe:    c = c!=0;    assert( pOp->opcode-6==OP_Ne );   break;
2665     case OP_StrLt:    c = c<0;     assert( pOp->opcode-6==OP_Lt );   break;
2666     case OP_StrLe:    c = c<=0;    assert( pOp->opcode-6==OP_Le );   break;
2667     case OP_StrGt:    c = c>0;     assert( pOp->opcode-6==OP_Gt );   break;
2668     default:          c = c>=0;    assert( pOp->opcode-6==OP_Ge );   break;
2669   }
2670   POPSTACK;
2671   POPSTACK;
2672   if( pOp->p2 ){
2673     if( c ) pc = pOp->p2-1;
2674   }else{
2675     p->tos++;
2676     aStack[nos].flags = STK_Int;
2677     aStack[nos].i = c;
2678   }
2679   break;
2680 }
2681 
2682 /* Opcode: And * * *
2683 **
2684 ** Pop two values off the stack.  Take the logical AND of the
2685 ** two values and push the resulting boolean value back onto the
2686 ** stack.
2687 */
2688 /* Opcode: Or * * *
2689 **
2690 ** Pop two values off the stack.  Take the logical OR of the
2691 ** two values and push the resulting boolean value back onto the
2692 ** stack.
2693 */
2694 case OP_And:
2695 case OP_Or: {
2696   int tos = p->tos;
2697   int nos = tos - 1;
2698   int v1, v2;    /* 0==TRUE, 1==FALSE, 2==UNKNOWN or NULL */
2699 
2700   VERIFY( if( nos<0 ) goto not_enough_stack; )
2701   if( aStack[tos].flags & STK_Null ){
2702     v1 = 2;
2703   }else{
2704     Integerify(p, tos);
2705     v1 = aStack[tos].i==0;
2706   }
2707   if( aStack[nos].flags & STK_Null ){
2708     v2 = 2;
2709   }else{
2710     Integerify(p, nos);
2711     v2 = aStack[nos].i==0;
2712   }
2713   if( pOp->opcode==OP_And ){
2714     static const unsigned char and_logic[] = { 0, 1, 2, 1, 1, 1, 2, 1, 2 };
2715     v1 = and_logic[v1*3+v2];
2716   }else{
2717     static const unsigned char or_logic[] = { 0, 0, 0, 0, 1, 2, 0, 2, 2 };
2718     v1 = or_logic[v1*3+v2];
2719   }
2720   POPSTACK;
2721   Release(p, nos);
2722   if( v1==2 ){
2723     aStack[nos].flags = STK_Null;
2724   }else{
2725     aStack[nos].i = v1==0;
2726     aStack[nos].flags = STK_Int;
2727   }
2728   break;
2729 }
2730 
2731 /* Opcode: Negative * * *
2732 **
2733 ** Treat the top of the stack as a numeric quantity.  Replace it
2734 ** with its additive inverse.  If the top of the stack is NULL
2735 ** its value is unchanged.
2736 */
2737 /* Opcode: AbsValue * * *
2738 **
2739 ** Treat the top of the stack as a numeric quantity.  Replace it
2740 ** with its absolute value. If the top of the stack is NULL
2741 ** its value is unchanged.
2742 */
2743 case OP_Negative:
2744 case OP_AbsValue: {
2745   int tos = p->tos;
2746   VERIFY( if( tos<0 ) goto not_enough_stack; )
2747   if( aStack[tos].flags & STK_Real ){
2748     Release(p, tos);
2749     if( pOp->opcode==OP_Negative || aStack[tos].r<0.0 ){
2750       aStack[tos].r = -aStack[tos].r;
2751     }
2752     aStack[tos].flags = STK_Real;
2753   }else if( aStack[tos].flags & STK_Int ){
2754     Release(p, tos);
2755     if( pOp->opcode==OP_Negative ||  aStack[tos].i<0 ){
2756       aStack[tos].i = -aStack[tos].i;
2757     }
2758     aStack[tos].flags = STK_Int;
2759   }else if( aStack[tos].flags & STK_Null ){
2760     /* Do nothing */
2761   }else{
2762     Realify(p, tos);
2763     Release(p, tos);
2764     if( pOp->opcode==OP_Negative ||  aStack[tos].r<0.0 ){
2765       aStack[tos].r = -aStack[tos].r;
2766     }
2767     aStack[tos].flags = STK_Real;
2768   }
2769   break;
2770 }
2771 
2772 /* Opcode: Not * * *
2773 **
2774 ** Interpret the top of the stack as a boolean value.  Replace it
2775 ** with its complement.  If the top of the stack is NULL its value
2776 ** is unchanged.
2777 */
2778 case OP_Not: {
2779   int tos = p->tos;
2780   VERIFY( if( p->tos<0 ) goto not_enough_stack; )
2781   if( aStack[tos].flags & STK_Null ) break;  /* Do nothing to NULLs */
2782   Integerify(p, tos);
2783   Release(p, tos);
2784   aStack[tos].i = !aStack[tos].i;
2785   aStack[tos].flags = STK_Int;
2786   break;
2787 }
2788 
2789 /* Opcode: BitNot * * *
2790 **
2791 ** Interpret the top of the stack as an value.  Replace it
2792 ** with its ones-complement.  If the top of the stack is NULL its
2793 ** value is unchanged.
2794 */
2795 case OP_BitNot: {
2796   int tos = p->tos;
2797   VERIFY( if( p->tos<0 ) goto not_enough_stack; )
2798   if( aStack[tos].flags & STK_Null ) break;  /* Do nothing to NULLs */
2799   Integerify(p, tos);
2800   Release(p, tos);
2801   aStack[tos].i = ~aStack[tos].i;
2802   aStack[tos].flags = STK_Int;
2803   break;
2804 }
2805 
2806 /* Opcode: Noop * * *
2807 **
2808 ** Do nothing.  This instruction is often useful as a jump
2809 ** destination.
2810 */
2811 case OP_Noop: {
2812   break;
2813 }
2814 
2815 /* Opcode: If P1 P2 *
2816 **
2817 ** Pop a single boolean from the stack.  If the boolean popped is
2818 ** true, then jump to p2.  Otherwise continue to the next instruction.
2819 ** An integer is false if zero and true otherwise.  A string is
2820 ** false if it has zero length and true otherwise.
2821 **
2822 ** If the value popped of the stack is NULL, then take the jump if P1
2823 ** is true and fall through if P1 is false.
2824 */
2825 /* Opcode: IfNot P1 P2 *
2826 **
2827 ** Pop a single boolean from the stack.  If the boolean popped is
2828 ** false, then jump to p2.  Otherwise continue to the next instruction.
2829 ** An integer is false if zero and true otherwise.  A string is
2830 ** false if it has zero length and true otherwise.
2831 **
2832 ** If the value popped of the stack is NULL, then take the jump if P1
2833 ** is true and fall through if P1 is false.
2834 */
2835 case OP_If:
2836 case OP_IfNot: {
2837   int c;
2838   VERIFY( if( p->tos<0 ) goto not_enough_stack; )
2839   if( aStack[p->tos].flags & STK_Null ){
2840     c = pOp->p1;
2841   }else{
2842     Integerify(p, p->tos);
2843     c = aStack[p->tos].i;
2844     if( pOp->opcode==OP_IfNot ) c = !c;
2845   }
2846   POPSTACK;
2847   if( c ) pc = pOp->p2-1;
2848   break;
2849 }
2850 
2851 /* Opcode: IsNull P1 P2 *
2852 **
2853 ** If any of the top abs(P1) values on the stack are NULL, then jump
2854 ** to P2.  The stack is popped P1 times if P1>0.  If P1<0 then all values
2855 ** are left unchanged on the stack.
2856 */
2857 case OP_IsNull: {
2858   int i, cnt;
2859   cnt = pOp->p1;
2860   if( cnt<0 ) cnt = -cnt;
2861   VERIFY( if( p->tos+1-cnt<0 ) goto not_enough_stack; )
2862   for(i=0; i<cnt; i++){
2863     if( aStack[p->tos-i].flags & STK_Null ){
2864       pc = pOp->p2-1;
2865       break;
2866     }
2867   }
2868   if( pOp->p1>0 ) PopStack(p, cnt);
2869   break;
2870 }
2871 
2872 /* Opcode: NotNull P1 P2 *
2873 **
2874 ** Jump to P2 if the top value on the stack is not NULL.  Pop the
2875 ** stack if P1 is greater than zero.  If P1 is less than or equal to
2876 ** zero then leave the value on the stack.
2877 */
2878 case OP_NotNull: {
2879   VERIFY( if( p->tos<0 ) goto not_enough_stack; )
2880   if( (aStack[p->tos].flags & STK_Null)==0 ) pc = pOp->p2-1;
2881   if( pOp->p1>0 ){ POPSTACK; }
2882   break;
2883 }
2884 
2885 /* Opcode: MakeRecord P1 P2 *
2886 **
2887 ** Convert the top P1 entries of the stack into a single entry
2888 ** suitable for use as a data record in a database table.  The
2889 ** details of the format are irrelavant as long as the OP_Column
2890 ** opcode can decode the record later.  Refer to source code
2891 ** comments for the details of the record format.
2892 **
2893 ** If P2 is true (non-zero) and one or more of the P1 entries
2894 ** that go into building the record is NULL, then add some extra
2895 ** bytes to the record to make it distinct for other entries created
2896 ** during the same run of the VDBE.  The extra bytes added are a
2897 ** counter that is reset with each run of the VDBE, so records
2898 ** created this way will not necessarily be distinct across runs.
2899 ** But they should be distinct for transient tables (created using
2900 ** OP_OpenTemp) which is what they are intended for.
2901 **
2902 ** (Later:) The P2==1 option was intended to make NULLs distinct
2903 ** for the UNION operator.  But I have since discovered that NULLs
2904 ** are indistinct for UNION.  So this option is never used.
2905 */
2906 case OP_MakeRecord: {
2907   char *zNewRecord;
2908   int nByte;
2909   int nField;
2910   int i, j;
2911   int idxWidth;
2912   u32 addr;
2913   int addUnique = 0;   /* True to cause bytes to be added to make the
2914                        ** generated record distinct */
2915   char zTemp[NBFS];    /* Temp space for small records */
2916 
2917   /* Assuming the record contains N fields, the record format looks
2918   ** like this:
2919   **
2920   **   -------------------------------------------------------------------
2921   **   | idx0 | idx1 | ... | idx(N-1) | idx(N) | data0 | ... | data(N-1) |
2922   **   -------------------------------------------------------------------
2923   **
2924   ** All data fields are converted to strings before being stored and
2925   ** are stored with their null terminators.  NULL entries omit the
2926   ** null terminator.  Thus an empty string uses 1 byte and a NULL uses
2927   ** zero bytes.  Data(0) is taken from the lowest element of the stack
2928   ** and data(N-1) is the top of the stack.
2929   **
2930   ** Each of the idx() entries is either 1, 2, or 3 bytes depending on
2931   ** how big the total record is.  Idx(0) contains the offset to the start
2932   ** of data(0).  Idx(k) contains the offset to the start of data(k).
2933   ** Idx(N) contains the total number of bytes in the record.
2934   */
2935   nField = pOp->p1;
2936   VERIFY( if( p->tos+1<nField ) goto not_enough_stack; )
2937   nByte = 0;
2938   for(i=p->tos-nField+1; i<=p->tos; i++){
2939     if( (aStack[i].flags & STK_Null) ){
2940       addUnique = pOp->p2;
2941     }else{
2942       Stringify(p, i);
2943       nByte += aStack[i].n;
2944     }
2945   }
2946   if( addUnique ) nByte += sizeof(p->uniqueCnt);
2947   if( nByte + nField + 1 < 256 ){
2948     idxWidth = 1;
2949   }else if( nByte + 2*nField + 2 < 65536 ){
2950     idxWidth = 2;
2951   }else{
2952     idxWidth = 3;
2953   }
2954   nByte += idxWidth*(nField + 1);
2955   if( nByte>MAX_BYTES_PER_ROW ){
2956     rc = SQLITE_TOOBIG;
2957     goto abort_due_to_error;
2958   }
2959   if( nByte<=NBFS ){
2960     zNewRecord = zTemp;
2961   }else{
2962     zNewRecord = sqliteMallocRaw( nByte );
2963     if( zNewRecord==0 ) goto no_mem;
2964   }
2965   j = 0;
2966   addr = idxWidth*(nField+1) + addUnique*sizeof(p->uniqueCnt);
2967   for(i=p->tos-nField+1; i<=p->tos; i++){
2968     zNewRecord[j++] = addr & 0xff;
2969     if( idxWidth>1 ){
2970       zNewRecord[j++] = (addr>>8)&0xff;
2971       if( idxWidth>2 ){
2972         zNewRecord[j++] = (addr>>16)&0xff;
2973       }
2974     }
2975     if( (aStack[i].flags & STK_Null)==0 ){
2976       addr += aStack[i].n;
2977     }
2978   }
2979   zNewRecord[j++] = addr & 0xff;
2980   if( idxWidth>1 ){
2981     zNewRecord[j++] = (addr>>8)&0xff;
2982     if( idxWidth>2 ){
2983       zNewRecord[j++] = (addr>>16)&0xff;
2984     }
2985   }
2986   if( addUnique ){
2987     memcpy(&zNewRecord[j], &p->uniqueCnt, sizeof(p->uniqueCnt));
2988     p->uniqueCnt++;
2989     j += sizeof(p->uniqueCnt);
2990   }
2991   for(i=p->tos-nField+1; i<=p->tos; i++){
2992     if( (aStack[i].flags & STK_Null)==0 ){
2993       memcpy(&zNewRecord[j], zStack[i], aStack[i].n);
2994       j += aStack[i].n;
2995     }
2996   }
2997   PopStack(p, nField);
2998   p->tos++;
2999   aStack[p->tos].n = nByte;
3000   if( nByte<=NBFS ){
3001     assert( zNewRecord==zTemp );
3002     memcpy(aStack[p->tos].z, zTemp, nByte);
3003     zStack[p->tos] = aStack[p->tos].z;
3004     aStack[p->tos].flags = STK_Str;
3005   }else{
3006     assert( zNewRecord!=zTemp );
3007     aStack[p->tos].flags = STK_Str | STK_Dyn;
3008     zStack[p->tos] = zNewRecord;
3009   }
3010   break;
3011 }
3012 
3013 /* Opcode: MakeKey P1 P2 P3
3014 **
3015 ** Convert the top P1 entries of the stack into a single entry suitable
3016 ** for use as the key in an index.  The top P1 records are
3017 ** converted to strings and merged.  The null-terminators
3018 ** are retained and used as separators.
3019 ** The lowest entry in the stack is the first field and the top of the
3020 ** stack becomes the last.
3021 **
3022 ** If P2 is not zero, then the original entries remain on the stack
3023 ** and the new key is pushed on top.  If P2 is zero, the original
3024 ** data is popped off the stack first then the new key is pushed
3025 ** back in its place.
3026 **
3027 ** P3 is a string that is P1 characters long.  Each character is either
3028 ** an 'n' or a 't' to indicates if the argument should be numeric or
3029 ** text.  The first character corresponds to the lowest element on the
3030 ** stack.  If P3 is NULL then all arguments are assumed to be numeric.
3031 **
3032 ** The key is a concatenation of fields.  Each field is terminated by
3033 ** a single 0x00 character.  A NULL field is introduced by an 'a' and
3034 ** is followed immediately by its 0x00 terminator.  A numeric field is
3035 ** introduced by a single character 'b' and is followed by a sequence
3036 ** of characters that represent the number such that a comparison of
3037 ** the character string using memcpy() sorts the numbers in numerical
3038 ** order.  The character strings for numbers are generated using the
3039 ** sqliteRealToSortable() function.  A text field is introduced by a
3040 ** 'c' character and is followed by the exact text of the field.  The
3041 ** use of an 'a', 'b', or 'c' character at the beginning of each field
3042 ** guarantees that NULL sort before numbers and that numbers sort
3043 ** before text.  0x00 characters do not occur except as separators
3044 ** between fields.
3045 **
3046 ** See also: MakeIdxKey, SortMakeKey
3047 */
3048 /* Opcode: MakeIdxKey P1 P2 P3
3049 **
3050 ** Convert the top P1 entries of the stack into a single entry suitable
3051 ** for use as the key in an index.  In addition, take one additional integer
3052 ** off of the stack, treat that integer as a four-byte record number, and
3053 ** append the four bytes to the key.  Thus a total of P1+1 entries are
3054 ** popped from the stack for this instruction and a single entry is pushed
3055 ** back.  The first P1 entries that are popped are strings and the last
3056 ** entry (the lowest on the stack) is an integer record number.
3057 **
3058 ** The converstion of the first P1 string entries occurs just like in
3059 ** MakeKey.  Each entry is separated from the others by a null.
3060 ** The entire concatenation is null-terminated.  The lowest entry
3061 ** in the stack is the first field and the top of the stack becomes the
3062 ** last.
3063 **
3064 ** If P2 is not zero and one or more of the P1 entries that go into the
3065 ** generated key is NULL, then jump to P2 after the new key has been
3066 ** pushed on the stack.  In other words, jump to P2 if the key is
3067 ** guaranteed to be unique.  This jump can be used to skip a subsequent
3068 ** uniqueness test.
3069 **
3070 ** P3 is a string that is P1 characters long.  Each character is either
3071 ** an 'n' or a 't' to indicates if the argument should be numeric or
3072 ** text.  The first character corresponds to the lowest element on the
3073 ** stack.  If P3 is null then all arguments are assumed to be numeric.
3074 **
3075 ** See also:  MakeKey, SortMakeKey
3076 */
3077 case OP_MakeIdxKey:
3078 case OP_MakeKey: {
3079   char *zNewKey;
3080   int nByte;
3081   int nField;
3082   int addRowid;
3083   int i, j;
3084   int containsNull = 0;
3085   char zTemp[NBFS];
3086 
3087   addRowid = pOp->opcode==OP_MakeIdxKey;
3088   nField = pOp->p1;
3089   VERIFY( if( p->tos+1+addRowid<nField ) goto not_enough_stack; )
3090   nByte = 0;
3091   for(j=0, i=p->tos-nField+1; i<=p->tos; i++, j++){
3092     int flags = aStack[i].flags;
3093     int len;
3094     char *z;
3095     if( flags & STK_Null ){
3096       nByte += 2;
3097       containsNull = 1;
3098     }else if( pOp->p3 && pOp->p3[j]=='t' ){
3099       Stringify(p, i);
3100       aStack[i].flags &= ~(STK_Int|STK_Real);
3101       nByte += aStack[i].n+1;
3102     }else if( (flags & (STK_Real|STK_Int))!=0 || sqliteIsNumber(zStack[i]) ){
3103       if( (flags & (STK_Real|STK_Int))==STK_Int ){
3104         aStack[i].r = aStack[i].i;
3105       }else if( (flags & (STK_Real|STK_Int))==0 ){
3106         aStack[i].r = atof(zStack[i]);
3107       }
3108       Release(p, i);
3109       z = aStack[i].z;
3110       sqliteRealToSortable(aStack[i].r, z);
3111       len = strlen(z);
3112       zStack[i] = 0;
3113       aStack[i].flags = STK_Real;
3114       aStack[i].n = len+1;
3115       nByte += aStack[i].n+1;
3116     }else{
3117       nByte += aStack[i].n+1;
3118     }
3119   }
3120   if( nByte+sizeof(u32)>MAX_BYTES_PER_ROW ){
3121     rc = SQLITE_TOOBIG;
3122     goto abort_due_to_error;
3123   }
3124   if( addRowid ) nByte += sizeof(u32);
3125   if( nByte<=NBFS ){
3126     zNewKey = zTemp;
3127   }else{
3128     zNewKey = sqliteMallocRaw( nByte );
3129     if( zNewKey==0 ) goto no_mem;
3130   }
3131   j = 0;
3132   for(i=p->tos-nField+1; i<=p->tos; i++){
3133     if( aStack[i].flags & STK_Null ){
3134       zNewKey[j++] = 'a';
3135       zNewKey[j++] = 0;
3136     }else{
3137       if( aStack[i].flags & (STK_Int|STK_Real) ){
3138         zNewKey[j++] = 'b';
3139       }else{
3140         zNewKey[j++] = 'c';
3141       }
3142       memcpy(&zNewKey[j], zStack[i] ? zStack[i] : aStack[i].z, aStack[i].n);
3143       j += aStack[i].n;
3144     }
3145   }
3146   if( addRowid ){
3147     u32 iKey;
3148     Integerify(p, p->tos-nField);
3149     iKey = intToKey(aStack[p->tos-nField].i);
3150     memcpy(&zNewKey[j], &iKey, sizeof(u32));
3151     PopStack(p, nField+1);
3152     if( pOp->p2 && containsNull ) pc = pOp->p2 - 1;
3153   }else{
3154     if( pOp->p2==0 ) PopStack(p, nField+addRowid);
3155   }
3156   p->tos++;
3157   aStack[p->tos].n = nByte;
3158   if( nByte<=NBFS ){
3159     assert( zNewKey==zTemp );
3160     zStack[p->tos] = aStack[p->tos].z;
3161     memcpy(zStack[p->tos], zTemp, nByte);
3162     aStack[p->tos].flags = STK_Str;
3163   }else{
3164     aStack[p->tos].flags = STK_Str|STK_Dyn;
3165     zStack[p->tos] = zNewKey;
3166   }
3167   break;
3168 }
3169 
3170 /* Opcode: IncrKey * * *
3171 **
3172 ** The top of the stack should contain an index key generated by
3173 ** The MakeKey opcode.  This routine increases the least significant
3174 ** byte of that key by one.  This is used so that the MoveTo opcode
3175 ** will move to the first entry greater than the key rather than to
3176 ** the key itself.
3177 */
3178 case OP_IncrKey: {
3179   int tos = p->tos;
3180 
3181   VERIFY( if( tos<0 ) goto bad_instruction );
3182   Stringify(p, tos);
3183   if( aStack[tos].flags & (STK_Static|STK_Ephem) ){
3184     /* CANT HAPPEN.  The IncrKey opcode is only applied to keys
3185     ** generated by MakeKey or MakeIdxKey and the results of those
3186     ** operands are always dynamic strings.
3187     */
3188     goto abort_due_to_error;
3189   }
3190   zStack[tos][aStack[tos].n-1]++;
3191   break;
3192 }
3193 
3194 /* Opcode: Checkpoint P1 * *
3195 **
3196 ** Begin a checkpoint.  A checkpoint is the beginning of a operation that
3197 ** is part of a larger transaction but which might need to be rolled back
3198 ** itself without effecting the containing transaction.  A checkpoint will
3199 ** be automatically committed or rollback when the VDBE halts.
3200 **
3201 ** The checkpoint is begun on the database file with index P1.  The main
3202 ** database file has an index of 0 and the file used for temporary tables
3203 ** has an index of 1.
3204 */
3205 case OP_Checkpoint: {
3206   int i = pOp->p1;
3207   if( i>=0 && i<db->nDb && db->aDb[i].pBt && db->aDb[i].inTrans==1 ){
3208     rc = sqliteBtreeBeginCkpt(db->aDb[i].pBt);
3209     if( rc==SQLITE_OK ) db->aDb[i].inTrans = 2;
3210   }
3211   break;
3212 }
3213 
3214 /* Opcode: Transaction P1 * *
3215 **
3216 ** Begin a transaction.  The transaction ends when a Commit or Rollback
3217 ** opcode is encountered.  Depending on the ON CONFLICT setting, the
3218 ** transaction might also be rolled back if an error is encountered.
3219 **
3220 ** P1 is the index of the database file on which the transaction is
3221 ** started.  Index 0 is the main database file and index 1 is the
3222 ** file used for temporary tables.
3223 **
3224 ** A write lock is obtained on the database file when a transaction is
3225 ** started.  No other process can read or write the file while the
3226 ** transaction is underway.  Starting a transaction also creates a
3227 ** rollback journal.  A transaction must be started before any changes
3228 ** can be made to the database.
3229 */
3230 case OP_Transaction: {
3231   int busy = 1;
3232   int i = pOp->p1;
3233   assert( i>=0 && i<db->nDb );
3234   if( db->aDb[i].inTrans ) break;
3235   while( db->aDb[i].pBt!=0 && busy ){
3236     rc = sqliteBtreeBeginTrans(db->aDb[i].pBt);
3237     switch( rc ){
3238       case SQLITE_BUSY: {
3239         if( db->xBusyCallback==0 ){
3240           p->pc = pc;
3241           p->undoTransOnError = 1;
3242           p->rc = SQLITE_BUSY;
3243           return SQLITE_BUSY;
3244         }else if( (*db->xBusyCallback)(db->pBusyArg, "", busy++)==0 ){
3245           sqliteSetString(&p->zErrMsg, sqlite_error_string(rc), 0);
3246           busy = 0;
3247         }
3248         break;
3249       }
3250       case SQLITE_READONLY: {
3251         rc = SQLITE_OK;
3252         /* Fall thru into the next case */
3253       }
3254       case SQLITE_OK: {
3255         p->inTempTrans = 0;
3256         busy = 0;
3257         break;
3258       }
3259       default: {
3260         goto abort_due_to_error;
3261       }
3262     }
3263   }
3264   db->aDb[i].inTrans = 1;
3265   p->undoTransOnError = 1;
3266   break;
3267 }
3268 
3269 /* Opcode: Commit * * *
3270 **
3271 ** Cause all modifications to the database that have been made since the
3272 ** last Transaction to actually take effect.  No additional modifications
3273 ** are allowed until another transaction is started.  The Commit instruction
3274 ** deletes the journal file and releases the write lock on the database.
3275 ** A read lock continues to be held if there are still cursors open.
3276 */
3277 case OP_Commit: {
3278   int i;
3279   for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
3280     if( db->aDb[i].inTrans ){
3281       rc = sqliteBtreeCommit(db->aDb[i].pBt);
3282       db->aDb[i].inTrans = 0;
3283     }
3284   }
3285   if( rc==SQLITE_OK ){
3286     sqliteCommitInternalChanges(db);
3287   }else{
3288     sqliteRollbackAll(db);
3289   }
3290   break;
3291 }
3292 
3293 /* Opcode: Rollback P1 * *
3294 **
3295 ** Cause all modifications to the database that have been made since the
3296 ** last Transaction to be undone. The database is restored to its state
3297 ** before the Transaction opcode was executed.  No additional modifications
3298 ** are allowed until another transaction is started.
3299 **
3300 ** P1 is the index of the database file that is committed.  An index of 0
3301 ** is used for the main database and an index of 1 is used for the file used
3302 ** to hold temporary tables.
3303 **
3304 ** This instruction automatically closes all cursors and releases both
3305 ** the read and write locks on the indicated database.
3306 */
3307 case OP_Rollback: {
3308   sqliteRollbackAll(db);
3309   break;
3310 }
3311 
3312 /* Opcode: ReadCookie P1 P2 *
3313 **
3314 ** Read cookie number P2 from database P1 and push it onto the stack.
3315 ** P2==0 is the schema version.  P2==1 is the database format.
3316 ** P2==2 is the recommended pager cache size, and so forth.  P1==0 is
3317 ** the main database file and P1==1 is the database file used to store
3318 ** temporary tables.
3319 **
3320 ** There must be a read-lock on the database (either a transaction
3321 ** must be started or there must be an open cursor) before
3322 ** executing this instruction.
3323 */
3324 case OP_ReadCookie: {
3325   int i = ++p->tos;
3326   int aMeta[SQLITE_N_BTREE_META];
3327   assert( pOp->p2<SQLITE_N_BTREE_META );
3328   assert( pOp->p1>=0 && pOp->p1<db->nDb );
3329   assert( db->aDb[pOp->p1].pBt!=0 );
3330   rc = sqliteBtreeGetMeta(db->aDb[pOp->p1].pBt, aMeta);
3331   aStack[i].i = aMeta[1+pOp->p2];
3332   aStack[i].flags = STK_Int;
3333   break;
3334 }
3335 
3336 /* Opcode: SetCookie P1 P2 *
3337 **
3338 ** Write the top of the stack into cookie number P2 of database P1.
3339 ** P2==0 is the schema version.  P2==1 is the database format.
3340 ** P2==2 is the recommended pager cache size, and so forth.  P1==0 is
3341 ** the main database file and P1==1 is the database file used to store
3342 ** temporary tables.
3343 **
3344 ** A transaction must be started before executing this opcode.
3345 */
3346 case OP_SetCookie: {
3347   int aMeta[SQLITE_N_BTREE_META];
3348   assert( pOp->p2<SQLITE_N_BTREE_META );
3349   assert( pOp->p1>=0 && pOp->p1<db->nDb );
3350   assert( db->aDb[pOp->p1].pBt!=0 );
3351   VERIFY( if( p->tos<0 ) goto not_enough_stack; )
3352   Integerify(p, p->tos)
3353   rc = sqliteBtreeGetMeta(db->aDb[pOp->p1].pBt, aMeta);
3354   if( rc==SQLITE_OK ){
3355     aMeta[1+pOp->p2] = aStack[p->tos].i;
3356     rc = sqliteBtreeUpdateMeta(db->aDb[pOp->p1].pBt, aMeta);
3357   }
3358   POPSTACK;
3359   break;
3360 }
3361 
3362 /* Opcode: VerifyCookie P1 P2 *
3363 **
3364 ** Check the value of global database parameter number 0 (the
3365 ** schema version) and make sure it is equal to P2.
3366 ** P1 is the database number which is 0 for the main database file
3367 ** and 1 for the file holding temporary tables and some higher number
3368 ** for auxiliary databases.
3369 **
3370 ** The cookie changes its value whenever the database schema changes.
3371 ** This operation is used to detect when that the cookie has changed
3372 ** and that the current process needs to reread the schema.
3373 **
3374 ** Either a transaction needs to have been started or an OP_Open needs
3375 ** to be executed (to establish a read lock) before this opcode is
3376 ** invoked.
3377 */
3378 case OP_VerifyCookie: {
3379   int aMeta[SQLITE_N_BTREE_META];
3380   assert( pOp->p1>=0 && pOp->p1<db->nDb );
3381   rc = sqliteBtreeGetMeta(db->aDb[pOp->p1].pBt, aMeta);
3382   if( rc==SQLITE_OK && aMeta[1]!=pOp->p2 ){
3383     sqliteSetString(&p->zErrMsg, "database schema has changed", 0);
3384     rc = SQLITE_SCHEMA;
3385   }
3386   break;
3387 }
3388 
3389 /* Opcode: OpenRead P1 P2 P3
3390 **
3391 ** Open a read-only cursor for the database table whose root page is
3392 ** P2 in a database file.  The database file is determined by an
3393 ** integer from the top of the stack.  0 means the main database and
3394 ** 1 means the database used for temporary tables.  Give the new
3395 ** cursor an identifier of P1.  The P1 values need not be contiguous
3396 ** but all P1 values should be small integers.  It is an error for
3397 ** P1 to be negative.
3398 **
3399 ** If P2==0 then take the root page number from the next of the stack.
3400 **
3401 ** There will be a read lock on the database whenever there is an
3402 ** open cursor.  If the database was unlocked prior to this instruction
3403 ** then a read lock is acquired as part of this instruction.  A read
3404 ** lock allows other processes to read the database but prohibits
3405 ** any other process from modifying the database.  The read lock is
3406 ** released when all cursors are closed.  If this instruction attempts
3407 ** to get a read lock but fails, the script terminates with an
3408 ** SQLITE_BUSY error code.
3409 **
3410 ** The P3 value is the name of the table or index being opened.
3411 ** The P3 value is not actually used by this opcode and may be
3412 ** omitted.  But the code generator usually inserts the index or
3413 ** table name into P3 to make the code easier to read.
3414 **
3415 ** See also OpenWrite.
3416 */
3417 /* Opcode: OpenWrite P1 P2 P3
3418 **
3419 ** Open a read/write cursor named P1 on the table or index whose root
3420 ** page is P2.  If P2==0 then take the root page number from the stack.
3421 **
3422 ** The P3 value is the name of the table or index being opened.
3423 ** The P3 value is not actually used by this opcode and may be
3424 ** omitted.  But the code generator usually inserts the index or
3425 ** table name into P3 to make the code easier to read.
3426 **
3427 ** This instruction works just like OpenRead except that it opens the cursor
3428 ** in read/write mode.  For a given table, there can be one or more read-only
3429 ** cursors or a single read/write cursor but not both.
3430 **
3431 ** See also OpenRead.
3432 */
3433 case OP_OpenRead:
3434 case OP_OpenWrite: {
3435   int busy = 0;
3436   int i = pOp->p1;
3437   int tos = p->tos;
3438   int p2 = pOp->p2;
3439   int wrFlag;
3440   Btree *pX;
3441   int iDb;
3442 
3443   VERIFY( if( tos<0 ) goto not_enough_stack; );
3444   Integerify(p, tos);
3445   iDb = p->aStack[tos].i;
3446   tos--;
3447   VERIFY( if( iDb<0 || iDb>=db->nDb ) goto bad_instruction; );
3448   VERIFY( if( db->aDb[iDb].pBt==0 ) goto bad_instruction; );
3449   pX = db->aDb[iDb].pBt;
3450   wrFlag = pOp->opcode==OP_OpenWrite;
3451   if( p2<=0 ){
3452     VERIFY( if( tos<0 ) goto not_enough_stack; );
3453     Integerify(p, tos);
3454     p2 = p->aStack[tos].i;
3455     POPSTACK;
3456     if( p2<2 ){
3457       sqliteSetString(&p->zErrMsg, "root page number less than 2", 0);
3458       rc = SQLITE_INTERNAL;
3459       break;
3460     }
3461   }
3462   VERIFY( if( i<0 ) goto bad_instruction; )
3463   if( expandCursorArraySize(p, i) ) goto no_mem;
3464   cleanupCursor(&p->aCsr[i]);
3465   memset(&p->aCsr[i], 0, sizeof(Cursor));
3466   p->aCsr[i].nullRow = 1;
3467   if( pX==0 ) break;
3468   do{
3469     rc = sqliteBtreeCursor(pX, p2, wrFlag, &p->aCsr[i].pCursor);
3470     switch( rc ){
3471       case SQLITE_BUSY: {
3472         if( db->xBusyCallback==0 ){
3473           p->pc = pc;
3474           p->rc = SQLITE_BUSY;
3475           return SQLITE_BUSY;
3476         }else if( (*db->xBusyCallback)(db->pBusyArg, pOp->p3, ++busy)==0 ){
3477           sqliteSetString(&p->zErrMsg, sqlite_error_string(rc), 0);
3478           busy = 0;
3479         }
3480         break;
3481       }
3482       case SQLITE_OK: {
3483         busy = 0;
3484         break;
3485       }
3486       default: {
3487         goto abort_due_to_error;
3488       }
3489     }
3490   }while( busy );
3491   if( p2<=0 ){
3492     POPSTACK;
3493   }
3494   POPSTACK;
3495   break;
3496 }
3497 
3498 /* Opcode: OpenTemp P1 P2 *
3499 **
3500 ** Open a new cursor to a transient table.
3501 ** The transient cursor is always opened read/write even if
3502 ** the main database is read-only.  The transient table is deleted
3503 ** automatically when the cursor is closed.
3504 **
3505 ** The cursor points to a BTree table if P2==0 and to a BTree index
3506 ** if P2==1.  A BTree table must have an integer key and can have arbitrary
3507 ** data.  A BTree index has no data but can have an arbitrary key.
3508 **
3509 ** This opcode is used for tables that exist for the duration of a single
3510 ** SQL statement only.  Tables created using CREATE TEMPORARY TABLE
3511 ** are opened using OP_OpenRead or OP_OpenWrite.  "Temporary" in the
3512 ** context of this opcode means for the duration of a single SQL statement
3513 ** whereas "Temporary" in the context of CREATE TABLE means for the duration
3514 ** of the connection to the database.  Same word; different meanings.
3515 */
3516 case OP_OpenTemp: {
3517   int i = pOp->p1;
3518   Cursor *pCx;
3519   VERIFY( if( i<0 ) goto bad_instruction; )
3520   if( expandCursorArraySize(p, i) ) goto no_mem;
3521   pCx = &p->aCsr[i];
3522   cleanupCursor(pCx);
3523   memset(pCx, 0, sizeof(*pCx));
3524   pCx->nullRow = 1;
3525   rc = sqliteBtreeFactory(db, 0, 1, TEMP_PAGES, &pCx->pBt);
3526 
3527   if( rc==SQLITE_OK ){
3528     rc = sqliteBtreeBeginTrans(pCx->pBt);
3529   }
3530   if( rc==SQLITE_OK ){
3531     if( pOp->p2 ){
3532       int pgno;
3533       rc = sqliteBtreeCreateIndex(pCx->pBt, &pgno);
3534       if( rc==SQLITE_OK ){
3535         rc = sqliteBtreeCursor(pCx->pBt, pgno, 1, &pCx->pCursor);
3536       }
3537     }else{
3538       rc = sqliteBtreeCursor(pCx->pBt, 2, 1, &pCx->pCursor);
3539     }
3540   }
3541   break;
3542 }
3543 
3544 /* Opcode: OpenPseudo P1 * *
3545 **
3546 ** Open a new cursor that points to a fake table that contains a single
3547 ** row of data.  Any attempt to write a second row of data causes the
3548 ** first row to be deleted.  All data is deleted when the cursor is
3549 ** closed.
3550 **
3551 ** A pseudo-table created by this opcode is useful for holding the
3552 ** NEW or OLD tables in a trigger.
3553 */
3554 case OP_OpenPseudo: {
3555   int i = pOp->p1;
3556   Cursor *pCx;
3557   VERIFY( if( i<0 ) goto bad_instruction; )
3558   if( expandCursorArraySize(p, i) ) goto no_mem;
3559   pCx = &p->aCsr[i];
3560   cleanupCursor(pCx);
3561   memset(pCx, 0, sizeof(*pCx));
3562   pCx->nullRow = 1;
3563   pCx->pseudoTable = 1;
3564   break;
3565 }
3566 
3567 /* Opcode: Close P1 * *
3568 **
3569 ** Close a cursor previously opened as P1.  If P1 is not
3570 ** currently open, this instruction is a no-op.
3571 */
3572 case OP_Close: {
3573   int i = pOp->p1;
3574   if( i>=0 && i<p->nCursor ){
3575     cleanupCursor(&p->aCsr[i]);
3576   }
3577   break;
3578 }
3579 
3580 /* Opcode: MoveTo P1 P2 *
3581 **
3582 ** Pop the top of the stack and use its value as a key.  Reposition
3583 ** cursor P1 so that it points to an entry with a matching key.  If
3584 ** the table contains no record with a matching key, then the cursor
3585 ** is left pointing at the first record that is greater than the key.
3586 ** If there are no records greater than the key and P2 is not zero,
3587 ** then an immediate jump to P2 is made.
3588 **
3589 ** See also: Found, NotFound, Distinct, MoveLt
3590 */
3591 /* Opcode: MoveLt P1 P2 *
3592 **
3593 ** Pop the top of the stack and use its value as a key.  Reposition
3594 ** cursor P1 so that it points to the entry with the largest key that is
3595 ** less than the key popped from the stack.
3596 ** If there are no records less than than the key and P2
3597 ** is not zero then an immediate jump to P2 is made.
3598 **
3599 ** See also: MoveTo
3600 */
3601 case OP_MoveLt:
3602 case OP_MoveTo: {
3603   int i = pOp->p1;
3604   int tos = p->tos;
3605   Cursor *pC;
3606 
3607   VERIFY( if( tos<0 ) goto not_enough_stack; )
3608   assert( i>=0 && i<p->nCursor );
3609   pC = &p->aCsr[i];
3610   if( pC->pCursor!=0 ){
3611     int res, oc;
3612     if( aStack[tos].flags & STK_Int ){
3613       int iKey = intToKey(aStack[tos].i);
3614       sqliteBtreeMoveto(pC->pCursor, (char*)&iKey, sizeof(int), &res);
3615       pC->lastRecno = aStack[tos].i;
3616       pC->recnoIsValid = res==0;
3617     }else{
3618       Stringify(p, tos);
3619       sqliteBtreeMoveto(pC->pCursor, zStack[tos], aStack[tos].n, &res);
3620       pC->recnoIsValid = 0;
3621     }
3622     pC->nullRow = 0;
3623     sqlite_search_count++;
3624     oc = pOp->opcode;
3625     if( oc==OP_MoveTo && res<0 ){
3626       sqliteBtreeNext(pC->pCursor, &res);
3627       pC->recnoIsValid = 0;
3628       if( res && pOp->p2>0 ){
3629         pc = pOp->p2 - 1;
3630       }
3631     }else if( oc==OP_MoveLt ){
3632       if( res>=0 ){
3633         sqliteBtreePrevious(pC->pCursor, &res);
3634         pC->recnoIsValid = 0;
3635       }else{
3636         /* res might be negative because the table is empty.  Check to
3637         ** see if this is the case.
3638         */
3639         int keysize;
3640         res = sqliteBtreeKeySize(pC->pCursor,&keysize)!=0 || keysize==0;
3641       }
3642       if( res && pOp->p2>0 ){
3643         pc = pOp->p2 - 1;
3644       }
3645     }
3646   }
3647   POPSTACK;
3648   break;
3649 }
3650 
3651 /* Opcode: Distinct P1 P2 *
3652 **
3653 ** Use the top of the stack as a string key.  If a record with that key does
3654 ** not exist in the table of cursor P1, then jump to P2.  If the record
3655 ** does already exist, then fall thru.  The cursor is left pointing
3656 ** at the record if it exists. The key is not popped from the stack.
3657 **
3658 ** This operation is similar to NotFound except that this operation
3659 ** does not pop the key from the stack.
3660 **
3661 ** See also: Found, NotFound, MoveTo, IsUnique, NotExists
3662 */
3663 /* Opcode: Found P1 P2 *
3664 **
3665 ** Use the top of the stack as a string key.  If a record with that key
3666 ** does exist in table of P1, then jump to P2.  If the record
3667 ** does not exist, then fall thru.  The cursor is left pointing
3668 ** to the record if it exists.  The key is popped from the stack.
3669 **
3670 ** See also: Distinct, NotFound, MoveTo, IsUnique, NotExists
3671 */
3672 /* Opcode: NotFound P1 P2 *
3673 **
3674 ** Use the top of the stack as a string key.  If a record with that key
3675 ** does not exist in table of P1, then jump to P2.  If the record
3676 ** does exist, then fall thru.  The cursor is left pointing to the
3677 ** record if it exists.  The key is popped from the stack.
3678 **
3679 ** The difference between this operation and Distinct is that
3680 ** Distinct does not pop the key from the stack.
3681 **
3682 ** See also: Distinct, Found, MoveTo, NotExists, IsUnique
3683 */
3684 case OP_Distinct:
3685 case OP_NotFound:
3686 case OP_Found: {
3687   int i = pOp->p1;
3688   int tos = p->tos;
3689   int alreadyExists = 0;
3690   Cursor *pC;
3691   VERIFY( if( tos<0 ) goto not_enough_stack; )
3692   if( VERIFY( i>=0 && i<p->nCursor && ) (pC = &p->aCsr[i])->pCursor!=0 ){
3693     int res, rx;
3694     Stringify(p, tos);
3695     rx = sqliteBtreeMoveto(pC->pCursor, zStack[tos], aStack[tos].n, &res);
3696     alreadyExists = rx==SQLITE_OK && res==0;
3697   }
3698   if( pOp->opcode==OP_Found ){
3699     if( alreadyExists ) pc = pOp->p2 - 1;
3700   }else{
3701     if( !alreadyExists ) pc = pOp->p2 - 1;
3702   }
3703   if( pOp->opcode!=OP_Distinct ){
3704     POPSTACK;
3705   }
3706   break;
3707 }
3708 
3709 /* Opcode: IsUnique P1 P2 *
3710 **
3711 ** The top of the stack is an integer record number.  Call this
3712 ** record number R.  The next on the stack is an index key created
3713 ** using MakeIdxKey.  Call it K.  This instruction pops R from the
3714 ** stack but it leaves K unchanged.
3715 **
3716 ** P1 is an index.  So all but the last four bytes of K are an
3717 ** index string.  The last four bytes of K are a record number.
3718 **
3719 ** This instruction asks if there is an entry in P1 where the
3720 ** index string matches K but the record number is different
3721 ** from R.  If there is no such entry, then there is an immediate
3722 ** jump to P2.  If any entry does exist where the index string
3723 ** matches K but the record number is not R, then the record
3724 ** number for that entry is pushed onto the stack and control
3725 ** falls through to the next instruction.
3726 **
3727 ** See also: Distinct, NotFound, NotExists, Found
3728 */
3729 case OP_IsUnique: {
3730   int i = pOp->p1;
3731   int tos = p->tos;
3732   int nos = tos-1;
3733   BtCursor *pCrsr;
3734   int R;
3735 
3736   /* Pop the value R off the top of the stack
3737   */
3738   VERIFY( if( nos<0 ) goto not_enough_stack; )
3739   Integerify(p, tos);
3740   R = aStack[tos].i;
3741   POPSTACK;
3742   if( VERIFY( i>=0 && i<p->nCursor && ) (pCrsr = p->aCsr[i].pCursor)!=0 ){
3743     int res, rc;
3744     int v;         /* The record number on the P1 entry that matches K */
3745     char *zKey;    /* The value of K */
3746     int nKey;      /* Number of bytes in K */
3747 
3748     /* Make sure K is a string and make zKey point to K
3749     */
3750     Stringify(p, nos);
3751     zKey = zStack[nos];
3752     nKey = aStack[nos].n;
3753     assert( nKey >= 4 );
3754 
3755     /* Search for an entry in P1 where all but the last four bytes match K.
3756     ** If there is no such entry, jump immediately to P2.
3757     */
3758     rc = sqliteBtreeMoveto(pCrsr, zKey, nKey-4, &res);
3759     if( rc!=SQLITE_OK ) goto abort_due_to_error;
3760     if( res<0 ){
3761       rc = sqliteBtreeNext(pCrsr, &res);
3762       if( res ){
3763         pc = pOp->p2 - 1;
3764         break;
3765       }
3766     }
3767     rc = sqliteBtreeKeyCompare(pCrsr, zKey, nKey-4, 4, &res);
3768     if( rc!=SQLITE_OK ) goto abort_due_to_error;
3769     if( res>0 ){
3770       pc = pOp->p2 - 1;
3771       break;
3772     }
3773 
3774     /* At this point, pCrsr is pointing to an entry in P1 where all but
3775     ** the last for bytes of the key match K.  Check to see if the last
3776     ** four bytes of the key are different from R.  If the last four
3777     ** bytes equal R then jump immediately to P2.
3778     */
3779     sqliteBtreeKey(pCrsr, nKey - 4, 4, (char*)&v);
3780     v = keyToInt(v);
3781     if( v==R ){
3782       pc = pOp->p2 - 1;
3783       break;
3784     }
3785 
3786     /* The last four bytes of the key are different from R.  Convert the
3787     ** last four bytes of the key into an integer and push it onto the
3788     ** stack.  (These bytes are the record number of an entry that
3789     ** violates a UNIQUE constraint.)
3790     */
3791     p->tos++;
3792     aStack[tos].i = v;
3793     aStack[tos].flags = STK_Int;
3794   }
3795   break;
3796 }
3797 
3798 /* Opcode: NotExists P1 P2 *
3799 **
3800 ** Use the top of the stack as a integer key.  If a record with that key
3801 ** does not exist in table of P1, then jump to P2.  If the record
3802 ** does exist, then fall thru.  The cursor is left pointing to the
3803 ** record if it exists.  The integer key is popped from the stack.
3804 **
3805 ** The difference between this operation and NotFound is that this
3806 ** operation assumes the key is an integer and NotFound assumes it
3807 ** is a string.
3808 **
3809 ** See also: Distinct, Found, MoveTo, NotFound, IsUnique
3810 */
3811 case OP_NotExists: {
3812   int i = pOp->p1;
3813   int tos = p->tos;
3814   BtCursor *pCrsr;
3815   VERIFY( if( tos<0 ) goto not_enough_stack; )
3816   if( VERIFY( i>=0 && i<p->nCursor && ) (pCrsr = p->aCsr[i].pCursor)!=0 ){
3817     int res, rx, iKey;
3818     assert( aStack[tos].flags & STK_Int );
3819     iKey = intToKey(aStack[tos].i);
3820     rx = sqliteBtreeMoveto(pCrsr, (char*)&iKey, sizeof(int), &res);
3821     p->aCsr[i].lastRecno = aStack[tos].i;
3822     p->aCsr[i].recnoIsValid = res==0;
3823     p->aCsr[i].nullRow = 0;
3824     if( rx!=SQLITE_OK || res!=0 ){
3825       pc = pOp->p2 - 1;
3826       p->aCsr[i].recnoIsValid = 0;
3827     }
3828   }
3829   POPSTACK;
3830   break;
3831 }
3832 
3833 /* Opcode: NewRecno P1 * *
3834 **
3835 ** Get a new integer record number used as the key to a table.
3836 ** The record number is not previously used as a key in the database
3837 ** table that cursor P1 points to.  The new record number is pushed
3838 ** onto the stack.
3839 */
3840 case OP_NewRecno: {
3841   int i = pOp->p1;
3842   int v = 0;
3843   Cursor *pC;
3844   if( VERIFY( i<0 || i>=p->nCursor || ) (pC = &p->aCsr[i])->pCursor==0 ){
3845     v = 0;
3846   }else{
3847     /* The next rowid or record number (different terms for the same
3848     ** thing) is obtained in a two-step algorithm.
3849     **
3850     ** First we attempt to find the largest existing rowid and add one
3851     ** to that.  But if the largest existing rowid is already the maximum
3852     ** positive integer, we have to fall through to the second
3853     ** probabilistic algorithm
3854     **
3855     ** The second algorithm is to select a rowid at random and see if
3856     ** it already exists in the table.  If it does not exist, we have
3857     ** succeeded.  If the random rowid does exist, we select a new one
3858     ** and try again, up to 1000 times.
3859     **
3860     ** For a table with less than 2 billion entries, the probability
3861     ** of not finding a unused rowid is about 1.0e-300.  This is a
3862     ** non-zero probability, but it is still vanishingly small and should
3863     ** never cause a problem.  You are much, much more likely to have a
3864     ** hardware failure than for this algorithm to fail.
3865     **
3866     ** The analysis in the previous paragraph assumes that you have a good
3867     ** source of random numbers.  Is a library function like lrand48()
3868     ** good enough?  Maybe. Maybe not. It's hard to know whether there
3869     ** might be subtle bugs is some implementations of lrand48() that
3870     ** could cause problems. To avoid uncertainty, SQLite uses its own
3871     ** random number generator based on the RC4 algorithm.
3872     **
3873     ** To promote locality of reference for repetitive inserts, the
3874     ** first few attempts at chosing a random rowid pick values just a little
3875     ** larger than the previous rowid.  This has been shown experimentally
3876     ** to double the speed of the COPY operation.
3877     */
3878     int res, rx, cnt, x;
3879     cnt = 0;
3880     if( !pC->useRandomRowid ){
3881       if( pC->nextRowidValid ){
3882         v = pC->nextRowid;
3883       }else{
3884         rx = sqliteBtreeLast(pC->pCursor, &res);
3885         if( res ){
3886           v = 1;
3887         }else{
3888           sqliteBtreeKey(pC->pCursor, 0, sizeof(v), (void*)&v);
3889           v = keyToInt(v);
3890           if( v==0x7fffffff ){
3891             pC->useRandomRowid = 1;
3892           }else{
3893             v++;
3894           }
3895         }
3896       }
3897       if( v<0x7fffffff ){
3898         pC->nextRowidValid = 1;
3899         pC->nextRowid = v+1;
3900       }else{
3901         pC->nextRowidValid = 0;
3902       }
3903     }
3904     if( pC->useRandomRowid ){
3905       v = db->priorNewRowid;
3906       cnt = 0;
3907       do{
3908         if( v==0 || cnt>2 ){
3909           v = sqliteRandomInteger();
3910           if( cnt<5 ) v &= 0xffffff;
3911         }else{
3912           v += sqliteRandomByte() + 1;
3913         }
3914         if( v==0 ) continue;
3915         x = intToKey(v);
3916         rx = sqliteBtreeMoveto(pC->pCursor, &x, sizeof(int), &res);
3917         cnt++;
3918       }while( cnt<1000 && rx==SQLITE_OK && res==0 );
3919       db->priorNewRowid = v;
3920       if( rx==SQLITE_OK && res==0 ){
3921         rc = SQLITE_FULL;
3922         goto abort_due_to_error;
3923       }
3924     }
3925     pC->recnoIsValid = 0;
3926   }
3927   p->tos++;
3928   aStack[p->tos].i = v;
3929   aStack[p->tos].flags = STK_Int;
3930   break;
3931 }
3932 
3933 /* Opcode: PutIntKey P1 P2 *
3934 **
3935 ** Write an entry into the table of cursor P1.  A new entry is
3936 ** created if it doesn't already exist or the data for an existing
3937 ** entry is overwritten.  The data is the value on the top of the
3938 ** stack.  The key is the next value down on the stack.  The key must
3939 ** be an integer.  The stack is popped twice by this instruction.
3940 **
3941 ** If P2==1 then the row change count is incremented.  If P2==0 the
3942 ** row change count is unmodified.  The rowid is stored for subsequent
3943 ** return by the sqlite_last_insert_rowid() function if P2 is 1.
3944 */
3945 /* Opcode: PutStrKey P1 * *
3946 **
3947 ** Write an entry into the table of cursor P1.  A new entry is
3948 ** created if it doesn't already exist or the data for an existing
3949 ** entry is overwritten.  The data is the value on the top of the
3950 ** stack.  The key is the next value down on the stack.  The key must
3951 ** be a string.  The stack is popped twice by this instruction.
3952 **
3953 ** P1 may not be a pseudo-table opened using the OpenPseudo opcode.
3954 */
3955 case OP_PutIntKey:
3956 case OP_PutStrKey: {
3957   int tos = p->tos;
3958   int nos = p->tos-1;
3959   int i = pOp->p1;
3960   Cursor *pC;
3961   VERIFY( if( nos<0 ) goto not_enough_stack; )
3962   if( VERIFY( i>=0 && i<p->nCursor && )
3963       ((pC = &p->aCsr[i])->pCursor!=0 || pC->pseudoTable) ){
3964     char *zKey;
3965     int nKey, iKey;
3966     if( pOp->opcode==OP_PutStrKey ){
3967       Stringify(p, nos);
3968       nKey = aStack[nos].n;
3969       zKey = zStack[nos];
3970     }else{
3971       assert( aStack[nos].flags & STK_Int );
3972       nKey = sizeof(int);
3973       iKey = intToKey(aStack[nos].i);
3974       zKey = (char*)&iKey;
3975       if( pOp->p2 ){
3976         db->nChange++;
3977         db->lastRowid = aStack[nos].i;
3978       }
3979       if( pC->nextRowidValid && aStack[nos].i>=pC->nextRowid ){
3980         pC->nextRowidValid = 0;
3981       }
3982     }
3983     if( pC->pseudoTable ){
3984       /* PutStrKey does not work for pseudo-tables.
3985       ** The following assert makes sure we are not trying to use
3986       ** PutStrKey on a pseudo-table
3987       */
3988       assert( pOp->opcode==OP_PutIntKey );
3989       sqliteFree(pC->pData);
3990       pC->iKey = iKey;
3991       pC->nData = aStack[tos].n;
3992       if( aStack[tos].flags & STK_Dyn ){
3993         pC->pData = zStack[tos];
3994         zStack[tos] = 0;
3995         aStack[tos].flags = STK_Null;
3996       }else{
3997         pC->pData = sqliteMallocRaw( pC->nData );
3998         if( pC->pData ){
3999           memcpy(pC->pData, zStack[tos], pC->nData);
4000         }
4001       }
4002       pC->nullRow = 0;
4003     }else{
4004       rc = sqliteBtreeInsert(pC->pCursor, zKey, nKey,
4005                           zStack[tos], aStack[tos].n);
4006     }
4007     pC->recnoIsValid = 0;
4008   }
4009   POPSTACK;
4010   POPSTACK;
4011   break;
4012 }
4013 
4014 /* Opcode: Delete P1 P2 *
4015 **
4016 ** Delete the record at which the P1 cursor is currently pointing.
4017 **
4018 ** The cursor will be left pointing at either the next or the previous
4019 ** record in the table. If it is left pointing at the next record, then
4020 ** the next Next instruction will be a no-op.  Hence it is OK to delete
4021 ** a record from within an Next loop.
4022 **
4023 ** The row change counter is incremented if P2==1 and is unmodified
4024 ** if P2==0.
4025 **
4026 ** If P1 is a pseudo-table, then this instruction is a no-op.
4027 */
4028 case OP_Delete: {
4029   int i = pOp->p1;
4030   Cursor *pC;
4031   assert( i>=0 && i<p->nCursor );
4032   pC = &p->aCsr[i];
4033   if( pC->pCursor!=0 ){
4034     rc = sqliteBtreeDelete(pC->pCursor);
4035     pC->nextRowidValid = 0;
4036   }
4037   if( pOp->p2 ) db->nChange++;
4038   break;
4039 }
4040 
4041 /* Opcode: KeyAsData P1 P2 *
4042 **
4043 ** Turn the key-as-data mode for cursor P1 either on (if P2==1) or
4044 ** off (if P2==0).  In key-as-data mode, the OP_Column opcode pulls
4045 ** data off of the key rather than the data.  This is used for
4046 ** processing compound selects.
4047 */
4048 case OP_KeyAsData: {
4049   int i = pOp->p1;
4050   assert( i>=0 && i<p->nCursor );
4051   p->aCsr[i].keyAsData = pOp->p2;
4052   break;
4053 }
4054 
4055 /* Opcode: RowData P1 * *
4056 **
4057 ** Push onto the stack the complete row data for cursor P1.
4058 ** There is no interpretation of the data.  It is just copied
4059 ** onto the stack exactly as it is found in the database file.
4060 **
4061 ** If the cursor is not pointing to a valid row, a NULL is pushed
4062 ** onto the stack.
4063 */
4064 case OP_RowData: {
4065   int i = pOp->p1;
4066   int tos = ++p->tos;
4067   Cursor *pC;
4068   int n;
4069 
4070   assert( i>=0 && i<p->nCursor );
4071   pC = &p->aCsr[i];
4072   if( pC->nullRow ){
4073     aStack[tos].flags = STK_Null;
4074   }else if( pC->pCursor!=0 ){
4075     BtCursor *pCrsr = pC->pCursor;
4076     if( pC->nullRow ){
4077       aStack[tos].flags = STK_Null;
4078       break;
4079     }else if( pC->keyAsData ){
4080       sqliteBtreeKeySize(pCrsr, &n);
4081     }else{
4082       sqliteBtreeDataSize(pCrsr, &n);
4083     }
4084     aStack[tos].n = n;
4085     if( n<=NBFS ){
4086       aStack[tos].flags = STK_Str;
4087       zStack[tos] = aStack[tos].z;
4088     }else{
4089       char *z = sqliteMallocRaw( n );
4090       if( z==0 ) goto no_mem;
4091       aStack[tos].flags = STK_Str | STK_Dyn;
4092       zStack[tos] = z;
4093     }
4094     if( pC->keyAsData ){
4095       sqliteBtreeKey(pCrsr, 0, n, zStack[tos]);
4096     }else{
4097       sqliteBtreeData(pCrsr, 0, n, zStack[tos]);
4098     }
4099   }else if( pC->pseudoTable ){
4100     aStack[tos].n = pC->nData;
4101     zStack[tos] = pC->pData;
4102     aStack[tos].flags = STK_Str|STK_Ephem;
4103   }else{
4104     aStack[tos].flags = STK_Null;
4105   }
4106   break;
4107 }
4108 
4109 /* Opcode: Column P1 P2 *
4110 **
4111 ** Interpret the data that cursor P1 points to as
4112 ** a structure built using the MakeRecord instruction.
4113 ** (See the MakeRecord opcode for additional information about
4114 ** the format of the data.)
4115 ** Push onto the stack the value of the P2-th column contained
4116 ** in the data.
4117 **
4118 ** If the KeyAsData opcode has previously executed on this cursor,
4119 ** then the field might be extracted from the key rather than the
4120 ** data.
4121 **
4122 ** If P1 is negative, then the record is stored on the stack rather
4123 ** than in a table.  For P1==-1, the top of the stack is used.
4124 ** For P1==-2, the next on the stack is used.  And so forth.  The
4125 ** value pushed is always just a pointer into the record which is
4126 ** stored further down on the stack.  The column value is not copied.
4127 */
4128 case OP_Column: {
4129   int amt, offset, end, payloadSize;
4130   int i = pOp->p1;
4131   int p2 = pOp->p2;
4132   int tos = p->tos+1;
4133   Cursor *pC;
4134   char *zRec;
4135   BtCursor *pCrsr;
4136   int idxWidth;
4137   unsigned char aHdr[10];
4138 
4139   assert( i<p->nCursor );
4140   if( i<0 ){
4141     VERIFY( if( tos+i<0 ) goto bad_instruction; )
4142     VERIFY( if( (aStack[tos+i].flags & STK_Str)==0 ) goto bad_instruction; )
4143     zRec = zStack[tos+i];
4144     payloadSize = aStack[tos+i].n;
4145   }else if( (pC = &p->aCsr[i])->pCursor!=0 ){
4146     zRec = 0;
4147     pCrsr = pC->pCursor;
4148     if( pC->nullRow ){
4149       payloadSize = 0;
4150     }else if( pC->keyAsData ){
4151       sqliteBtreeKeySize(pCrsr, &payloadSize);
4152     }else{
4153       sqliteBtreeDataSize(pCrsr, &payloadSize);
4154     }
4155   }else if( pC->pseudoTable ){
4156     payloadSize = pC->nData;
4157     zRec = pC->pData;
4158     assert( payloadSize==0 || zRec!=0 );
4159   }else{
4160     payloadSize = 0;
4161   }
4162 
4163   /* Figure out how many bytes in the column data and where the column
4164   ** data begins.
4165   */
4166   if( payloadSize==0 ){
4167     aStack[tos].flags = STK_Null;
4168     p->tos = tos;
4169     break;
4170   }else if( payloadSize<256 ){
4171     idxWidth = 1;
4172   }else if( payloadSize<65536 ){
4173     idxWidth = 2;
4174   }else{
4175     idxWidth = 3;
4176   }
4177 
4178   /* Figure out where the requested column is stored and how big it is.
4179   */
4180   if( payloadSize < idxWidth*(p2+1) ){
4181     rc = SQLITE_CORRUPT;
4182     goto abort_due_to_error;
4183   }
4184   if( zRec ){
4185     memcpy(aHdr, &zRec[idxWidth*p2], idxWidth*2);
4186   }else if( pC->keyAsData ){
4187     sqliteBtreeKey(pCrsr, idxWidth*p2, idxWidth*2, (char*)aHdr);
4188   }else{
4189     sqliteBtreeData(pCrsr, idxWidth*p2, idxWidth*2, (char*)aHdr);
4190   }
4191   offset = aHdr[0];
4192   end = aHdr[idxWidth];
4193   if( idxWidth>1 ){
4194     offset |= aHdr[1]<<8;
4195     end |= aHdr[idxWidth+1]<<8;
4196     if( idxWidth>2 ){
4197       offset |= aHdr[2]<<16;
4198       end |= aHdr[idxWidth+2]<<16;
4199     }
4200   }
4201   amt = end - offset;
4202   if( amt<0 || offset<0 || end>payloadSize ){
4203     rc = SQLITE_CORRUPT;
4204     goto abort_due_to_error;
4205   }
4206 
4207   /* amt and offset now hold the offset to the start of data and the
4208   ** amount of data.  Go get the data and put it on the stack.
4209   */
4210   if( amt==0 ){
4211     aStack[tos].flags = STK_Null;
4212   }else if( zRec ){
4213     aStack[tos].flags = STK_Str | STK_Ephem;
4214     aStack[tos].n = amt;
4215     zStack[tos] = &zRec[offset];
4216   }else{
4217     if( amt<=NBFS ){
4218       aStack[tos].flags = STK_Str;
4219       zStack[tos] = aStack[tos].z;
4220       aStack[tos].n = amt;
4221     }else{
4222       char *z = sqliteMallocRaw( amt );
4223       if( z==0 ) goto no_mem;
4224       aStack[tos].flags = STK_Str | STK_Dyn;
4225       zStack[tos] = z;
4226       aStack[tos].n = amt;
4227     }
4228     if( pC->keyAsData ){
4229       sqliteBtreeKey(pCrsr, offset, amt, zStack[tos]);
4230     }else{
4231       sqliteBtreeData(pCrsr, offset, amt, zStack[tos]);
4232     }
4233   }
4234   p->tos = tos;
4235   break;
4236 }
4237 
4238 /* Opcode: Recno P1 * *
4239 **
4240 ** Push onto the stack an integer which is the first 4 bytes of the
4241 ** the key to the current entry in a sequential scan of the database
4242 ** file P1.  The sequential scan should have been started using the
4243 ** Next opcode.
4244 */
4245 case OP_Recno: {
4246   int i = pOp->p1;
4247   int tos = ++p->tos;
4248   Cursor *pC;
4249   int v;
4250 
4251   assert( i>=0 && i<p->nCursor );
4252   if( (pC = &p->aCsr[i])->recnoIsValid ){
4253     v = pC->lastRecno;
4254   }else if( pC->pseudoTable ){
4255     v = keyToInt(pC->iKey);
4256   }else if( pC->nullRow || pC->pCursor==0 ){
4257     aStack[tos].flags = STK_Null;
4258     break;
4259   }else{
4260     assert( pC->pCursor!=0 );
4261     sqliteBtreeKey(pC->pCursor, 0, sizeof(u32), (char*)&v);
4262     v = keyToInt(v);
4263   }
4264   aStack[tos].i = v;
4265   aStack[tos].flags = STK_Int;
4266   break;
4267 }
4268 
4269 /* Opcode: FullKey P1 * *
4270 **
4271 ** Extract the complete key from the record that cursor P1 is currently
4272 ** pointing to and push the key onto the stack as a string.
4273 **
4274 ** Compare this opcode to Recno.  The Recno opcode extracts the first
4275 ** 4 bytes of the key and pushes those bytes onto the stack as an
4276 ** integer.  This instruction pushes the entire key as a string.
4277 **
4278 ** This opcode may not be used on a pseudo-table.
4279 */
4280 case OP_FullKey: {
4281   int i = pOp->p1;
4282   int tos = ++p->tos;
4283   BtCursor *pCrsr;
4284 
4285   VERIFY( if( !p->aCsr[i].keyAsData ) goto bad_instruction; )
4286   VERIFY( if( p->aCsr[i].pseudoTable ) goto bad_instruction; )
4287   if( VERIFY( i>=0 && i<p->nCursor && ) (pCrsr = p->aCsr[i].pCursor)!=0 ){
4288     int amt;
4289     char *z;
4290 
4291     sqliteBtreeKeySize(pCrsr, &amt);
4292     if( amt<=0 ){
4293       rc = SQLITE_CORRUPT;
4294       goto abort_due_to_error;
4295     }
4296     if( amt>NBFS ){
4297       z = sqliteMallocRaw( amt );
4298       if( z==0 ) goto no_mem;
4299       aStack[tos].flags = STK_Str | STK_Dyn;
4300     }else{
4301       z = aStack[tos].z;
4302       aStack[tos].flags = STK_Str;
4303     }
4304     sqliteBtreeKey(pCrsr, 0, amt, z);
4305     zStack[tos] = z;
4306     aStack[tos].n = amt;
4307   }
4308   break;
4309 }
4310 
4311 /* Opcode: NullRow P1 * *
4312 **
4313 ** Move the cursor P1 to a null row.  Any OP_Column operations
4314 ** that occur while the cursor is on the null row will always push
4315 ** a NULL onto the stack.
4316 */
4317 case OP_NullRow: {
4318   int i = pOp->p1;
4319 
4320   assert( i>=0 && i<p->nCursor );
4321   p->aCsr[i].nullRow = 1;
4322   p->aCsr[i].recnoIsValid = 0;
4323   break;
4324 }
4325 
4326 /* Opcode: Last P1 P2 *
4327 **
4328 ** The next use of the Recno or Column or Next instruction for P1
4329 ** will refer to the last entry in the database table or index.
4330 ** If the table or index is empty and P2>0, then jump immediately to P2.
4331 ** If P2 is 0 or if the table or index is not empty, fall through
4332 ** to the following instruction.
4333 */
4334 case OP_Last: {
4335   int i = pOp->p1;
4336   Cursor *pC;
4337   BtCursor *pCrsr;
4338 
4339   assert( i>=0 && i<p->nCursor );
4340   pC = &p->aCsr[i];
4341   if( (pCrsr = pC->pCursor)!=0 ){
4342     int res;
4343     rc = sqliteBtreeLast(pCrsr, &res);
4344     p->aCsr[i].nullRow = res;
4345     if( res && pOp->p2>0 ){
4346       pc = pOp->p2 - 1;
4347     }
4348   }else{
4349     pC->nullRow = 0;
4350   }
4351   break;
4352 }
4353 
4354 /* Opcode: Rewind P1 P2 *
4355 **
4356 ** The next use of the Recno or Column or Next instruction for P1
4357 ** will refer to the first entry in the database table or index.
4358 ** If the table or index is empty and P2>0, then jump immediately to P2.
4359 ** If P2 is 0 or if the table or index is not empty, fall through
4360 ** to the following instruction.
4361 */
4362 case OP_Rewind: {
4363   int i = pOp->p1;
4364   Cursor *pC;
4365   BtCursor *pCrsr;
4366 
4367   assert( i>=0 && i<p->nCursor );
4368   pC = &p->aCsr[i];
4369   if( (pCrsr = pC->pCursor)!=0 ){
4370     int res;
4371     rc = sqliteBtreeFirst(pCrsr, &res);
4372     pC->atFirst = res==0;
4373     pC->nullRow = res;
4374     if( res && pOp->p2>0 ){
4375       pc = pOp->p2 - 1;
4376     }
4377   }else{
4378     pC->nullRow = 0;
4379   }
4380   break;
4381 }
4382 
4383 /* Opcode: Next P1 P2 *
4384 **
4385 ** Advance cursor P1 so that it points to the next key/data pair in its
4386 ** table or index.  If there are no more key/value pairs then fall through
4387 ** to the following instruction.  But if the cursor advance was successful,
4388 ** jump immediately to P2.
4389 **
4390 ** See also: Prev
4391 */
4392 /* Opcode: Prev P1 P2 *
4393 **
4394 ** Back up cursor P1 so that it points to the previous key/data pair in its
4395 ** table or index.  If there is no previous key/value pairs then fall through
4396 ** to the following instruction.  But if the cursor backup was successful,
4397 ** jump immediately to P2.
4398 */
4399 case OP_Prev:
4400 case OP_Next: {
4401   Cursor *pC;
4402   BtCursor *pCrsr;
4403 
4404   CHECK_FOR_INTERRUPT;
4405   assert( pOp->p1>=0 && pOp->p1<p->nCursor );
4406   pC = &p->aCsr[pOp->p1];
4407   if( (pCrsr = pC->pCursor)!=0 ){
4408     int res;
4409     if( pC->nullRow ){
4410       res = 1;
4411     }else{
4412       rc = pOp->opcode==OP_Next ? sqliteBtreeNext(pCrsr, &res) :
4413                                   sqliteBtreePrevious(pCrsr, &res);
4414       pC->nullRow = res;
4415     }
4416     if( res==0 ){
4417       pc = pOp->p2 - 1;
4418       sqlite_search_count++;
4419     }
4420   }else{
4421     pC->nullRow = 1;
4422   }
4423   pC->recnoIsValid = 0;
4424   break;
4425 }
4426 
4427 /* Opcode: IdxPut P1 P2 P3
4428 **
4429 ** The top of the stack holds a SQL index key made using the
4430 ** MakeIdxKey instruction.  This opcode writes that key into the
4431 ** index P1.  Data for the entry is nil.
4432 **
4433 ** If P2==1, then the key must be unique.  If the key is not unique,
4434 ** the program aborts with a SQLITE_CONSTRAINT error and the database
4435 ** is rolled back.  If P3 is not null, then it becomes part of the
4436 ** error message returned with the SQLITE_CONSTRAINT.
4437 */
4438 case OP_IdxPut: {
4439   int i = pOp->p1;
4440   int tos = p->tos;
4441   BtCursor *pCrsr;
4442   VERIFY( if( tos<0 ) goto not_enough_stack; )
4443   if( VERIFY( i>=0 && i<p->nCursor && ) (pCrsr = p->aCsr[i].pCursor)!=0 ){
4444     int nKey = aStack[tos].n;
4445     const char *zKey = zStack[tos];
4446     if( pOp->p2 ){
4447       int res, n;
4448       assert( aStack[tos].n >= 4 );
4449       rc = sqliteBtreeMoveto(pCrsr, zKey, nKey-4, &res);
4450       if( rc!=SQLITE_OK ) goto abort_due_to_error;
4451       while( res!=0 ){
4452         int c;
4453         sqliteBtreeKeySize(pCrsr, &n);
4454         if( n==nKey
4455            && sqliteBtreeKeyCompare(pCrsr, zKey, nKey-4, 4, &c)==SQLITE_OK
4456            && c==0
4457         ){
4458           rc = SQLITE_CONSTRAINT;
4459           if( pOp->p3 && pOp->p3[0] ){
4460             sqliteSetString(&p->zErrMsg, pOp->p3, 0);
4461           }
4462           goto abort_due_to_error;
4463         }
4464         if( res<0 ){
4465           sqliteBtreeNext(pCrsr, &res);
4466           res = +1;
4467         }else{
4468           break;
4469         }
4470       }
4471     }
4472     rc = sqliteBtreeInsert(pCrsr, zKey, nKey, "", 0);
4473   }
4474   POPSTACK;
4475   break;
4476 }
4477 
4478 /* Opcode: IdxDelete P1 * *
4479 **
4480 ** The top of the stack is an index key built using the MakeIdxKey opcode.
4481 ** This opcode removes that entry from the index.
4482 */
4483 case OP_IdxDelete: {
4484   int i = pOp->p1;
4485   int tos = p->tos;
4486   BtCursor *pCrsr;
4487   VERIFY( if( tos<0 ) goto not_enough_stack; )
4488   if( VERIFY( i>=0 && i<p->nCursor && ) (pCrsr = p->aCsr[i].pCursor)!=0 ){
4489     int rx, res;
4490     rx = sqliteBtreeMoveto(pCrsr, zStack[tos], aStack[tos].n, &res);
4491     if( rx==SQLITE_OK && res==0 ){
4492       rc = sqliteBtreeDelete(pCrsr);
4493     }
4494   }
4495   POPSTACK;
4496   break;
4497 }
4498 
4499 /* Opcode: IdxRecno P1 * *
4500 **
4501 ** Push onto the stack an integer which is the last 4 bytes of the
4502 ** the key to the current entry in index P1.  These 4 bytes should
4503 ** be the record number of the table entry to which this index entry
4504 ** points.
4505 **
4506 ** See also: Recno, MakeIdxKey.
4507 */
4508 case OP_IdxRecno: {
4509   int i = pOp->p1;
4510   int tos = ++p->tos;
4511   BtCursor *pCrsr;
4512 
4513   if( VERIFY( i>=0 && i<p->nCursor && ) (pCrsr = p->aCsr[i].pCursor)!=0 ){
4514     int v;
4515     int sz;
4516     sqliteBtreeKeySize(pCrsr, &sz);
4517     if( sz<sizeof(u32) ){
4518       aStack[tos].flags = STK_Null;
4519     }else{
4520       sqliteBtreeKey(pCrsr, sz - sizeof(u32), sizeof(u32), (char*)&v);
4521       v = keyToInt(v);
4522       aStack[tos].i = v;
4523       aStack[tos].flags = STK_Int;
4524     }
4525   }
4526   break;
4527 }
4528 
4529 /* Opcode: IdxGT P1 P2 *
4530 **
4531 ** Compare the top of the stack against the key on the index entry that
4532 ** cursor P1 is currently pointing to.  Ignore the last 4 bytes of the
4533 ** index entry.  If the index entry is greater than the top of the stack
4534 ** then jump to P2.  Otherwise fall through to the next instruction.
4535 ** In either case, the stack is popped once.
4536 */
4537 /* Opcode: IdxGE P1 P2 *
4538 **
4539 ** Compare the top of the stack against the key on the index entry that
4540 ** cursor P1 is currently pointing to.  Ignore the last 4 bytes of the
4541 ** index entry.  If the index entry is greater than or equal to
4542 ** the top of the stack
4543 ** then jump to P2.  Otherwise fall through to the next instruction.
4544 ** In either case, the stack is popped once.
4545 */
4546 /* Opcode: IdxLT P1 P2 *
4547 **
4548 ** Compare the top of the stack against the key on the index entry that
4549 ** cursor P1 is currently pointing to.  Ignore the last 4 bytes of the
4550 ** index entry.  If the index entry is less than the top of the stack
4551 ** then jump to P2.  Otherwise fall through to the next instruction.
4552 ** In either case, the stack is popped once.
4553 */
4554 case OP_IdxLT:
4555 case OP_IdxGT:
4556 case OP_IdxGE: {
4557   int i= pOp->p1;
4558   int tos = p->tos;
4559   BtCursor *pCrsr;
4560 
4561   if( VERIFY( i>=0 && i<p->nCursor && ) (pCrsr = p->aCsr[i].pCursor)!=0 ){
4562     int res, rc;
4563 
4564     Stringify(p, tos);
4565     rc = sqliteBtreeKeyCompare(pCrsr, zStack[tos], aStack[tos].n, 4, &res);
4566     if( rc!=SQLITE_OK ){
4567       break;
4568     }
4569     if( pOp->opcode==OP_IdxLT ){
4570       res = -res;
4571     }else if( pOp->opcode==OP_IdxGE ){
4572       res++;
4573     }
4574     if( res>0 ){
4575       pc = pOp->p2 - 1 ;
4576     }
4577   }
4578   POPSTACK;
4579   break;
4580 }
4581 
4582 /* Opcode: Destroy P1 P2 *
4583 **
4584 ** Delete an entire database table or index whose root page in the database
4585 ** file is given by P1.
4586 **
4587 ** The table being destroyed is in the main database file if P2==0.  If
4588 ** P2==1 then the table to be clear is in the auxiliary database file
4589 ** that is used to store tables create using CREATE TEMPORARY TABLE.
4590 **
4591 ** See also: Clear
4592 */
4593 case OP_Destroy: {
4594   rc = sqliteBtreeDropTable(db->aDb[pOp->p2].pBt, pOp->p1);
4595   break;
4596 }
4597 
4598 /* Opcode: Clear P1 P2 *
4599 **
4600 ** Delete all contents of the database table or index whose root page
4601 ** in the database file is given by P1.  But, unlike Destroy, do not
4602 ** remove the table or index from the database file.
4603 **
4604 ** The table being clear is in the main database file if P2==0.  If
4605 ** P2==1 then the table to be clear is in the auxiliary database file
4606 ** that is used to store tables create using CREATE TEMPORARY TABLE.
4607 **
4608 ** See also: Destroy
4609 */
4610 case OP_Clear: {
4611   rc = sqliteBtreeClearTable(db->aDb[pOp->p2].pBt, pOp->p1);
4612   break;
4613 }
4614 
4615 /* Opcode: CreateTable * P2 P3
4616 **
4617 ** Allocate a new table in the main database file if P2==0 or in the
4618 ** auxiliary database file if P2==1.  Push the page number
4619 ** for the root page of the new table onto the stack.
4620 **
4621 ** The root page number is also written to a memory location that P3
4622 ** points to.  This is the mechanism is used to write the root page
4623 ** number into the parser's internal data structures that describe the
4624 ** new table.
4625 **
4626 ** The difference between a table and an index is this:  A table must
4627 ** have a 4-byte integer key and can have arbitrary data.  An index
4628 ** has an arbitrary key but no data.
4629 **
4630 ** See also: CreateIndex
4631 */
4632 /* Opcode: CreateIndex * P2 P3
4633 **
4634 ** Allocate a new index in the main database file if P2==0 or in the
4635 ** auxiliary database file if P2==1.  Push the page number of the
4636 ** root page of the new index onto the stack.
4637 **
4638 ** See documentation on OP_CreateTable for additional information.
4639 */
4640 case OP_CreateIndex:
4641 case OP_CreateTable: {
4642   int i = ++p->tos;
4643   int pgno;
4644   assert( pOp->p3!=0 && pOp->p3type==P3_POINTER );
4645   assert( pOp->p2>=0 && pOp->p2<db->nDb );
4646   assert( db->aDb[pOp->p2].pBt!=0 );
4647   if( pOp->opcode==OP_CreateTable ){
4648     rc = sqliteBtreeCreateTable(db->aDb[pOp->p2].pBt, &pgno);
4649   }else{
4650     rc = sqliteBtreeCreateIndex(db->aDb[pOp->p2].pBt, &pgno);
4651   }
4652   if( rc==SQLITE_OK ){
4653     aStack[i].i = pgno;
4654     aStack[i].flags = STK_Int;
4655     *(u32*)pOp->p3 = pgno;
4656     pOp->p3 = 0;
4657   }
4658   break;
4659 }
4660 
4661 /* Opcode: IntegrityCk P1 P2 *
4662 **
4663 ** Do an analysis of the currently open database.  Push onto the
4664 ** stack the text of an error message describing any problems.
4665 ** If there are no errors, push a "ok" onto the stack.
4666 **
4667 ** P1 is the index of a set that contains the root page numbers
4668 ** for all tables and indices in the main database file.  The set
4669 ** is cleared by this opcode.  In other words, after this opcode
4670 ** has executed, the set will be empty.
4671 **
4672 ** If P2 is not zero, the check is done on the auxiliary database
4673 ** file, not the main database file.
4674 **
4675 ** This opcode is used for testing purposes only.
4676 */
4677 case OP_IntegrityCk: {
4678   int nRoot;
4679   int *aRoot;
4680   int tos = ++p->tos;
4681   int iSet = pOp->p1;
4682   Set *pSet;
4683   int j;
4684   HashElem *i;
4685   char *z;
4686 
4687   VERIFY( if( iSet<0 || iSet>=p->nSet ) goto bad_instruction; )
4688   pSet = &p->aSet[iSet];
4689   nRoot = sqliteHashCount(&pSet->hash);
4690   aRoot = sqliteMallocRaw( sizeof(int)*(nRoot+1) );
4691   if( aRoot==0 ) goto no_mem;
4692   for(j=0, i=sqliteHashFirst(&pSet->hash); i; i=sqliteHashNext(i), j++){
4693     toInt((char*)sqliteHashKey(i), &aRoot[j]);
4694   }
4695   aRoot[j] = 0;
4696   sqliteHashClear(&pSet->hash);
4697   pSet->prev = 0;
4698   z = sqliteBtreeIntegrityCheck(db->aDb[pOp->p2].pBt, aRoot, nRoot);
4699   if( z==0 || z[0]==0 ){
4700     if( z ) sqliteFree(z);
4701     zStack[tos] = "ok";
4702     aStack[tos].n = 3;
4703     aStack[tos].flags = STK_Str | STK_Static;
4704   }else{
4705     zStack[tos] = z;
4706     aStack[tos].n = strlen(z) + 1;
4707     aStack[tos].flags = STK_Str | STK_Dyn;
4708   }
4709   sqliteFree(aRoot);
4710   break;
4711 }
4712 
4713 /* Opcode: ListWrite * * *
4714 **
4715 ** Write the integer on the top of the stack
4716 ** into the temporary storage list.
4717 */
4718 case OP_ListWrite: {
4719   Keylist *pKeylist;
4720   VERIFY( if( p->tos<0 ) goto not_enough_stack; )
4721   pKeylist = p->pList;
4722   if( pKeylist==0 || pKeylist->nUsed>=pKeylist->nKey ){
4723     pKeylist = sqliteMallocRaw( sizeof(Keylist)+999*sizeof(pKeylist->aKey[0]) );
4724     if( pKeylist==0 ) goto no_mem;
4725     pKeylist->nKey = 1000;
4726     pKeylist->nRead = 0;
4727     pKeylist->nUsed = 0;
4728     pKeylist->pNext = p->pList;
4729     p->pList = pKeylist;
4730   }
4731   Integerify(p, p->tos);
4732   pKeylist->aKey[pKeylist->nUsed++] = aStack[p->tos].i;
4733   POPSTACK;
4734   break;
4735 }
4736 
4737 /* Opcode: ListRewind * * *
4738 **
4739 ** Rewind the temporary buffer back to the beginning.  This is
4740 ** now a no-op.
4741 */
4742 case OP_ListRewind: {
4743   /* This is now a no-op */
4744   break;
4745 }
4746 
4747 /* Opcode: ListRead * P2 *
4748 **
4749 ** Attempt to read an integer from the temporary storage buffer
4750 ** and push it onto the stack.  If the storage buffer is empty,
4751 ** push nothing but instead jump to P2.
4752 */
4753 case OP_ListRead: {
4754   Keylist *pKeylist;
4755   CHECK_FOR_INTERRUPT;
4756   pKeylist = p->pList;
4757   if( pKeylist!=0 ){
4758     VERIFY(
4759       if( pKeylist->nRead<0
4760         || pKeylist->nRead>=pKeylist->nUsed
4761         || pKeylist->nRead>=pKeylist->nKey ) goto bad_instruction;
4762     )
4763     p->tos++;
4764     aStack[p->tos].i = pKeylist->aKey[pKeylist->nRead++];
4765     aStack[p->tos].flags = STK_Int;
4766     zStack[p->tos] = 0;
4767     if( pKeylist->nRead>=pKeylist->nUsed ){
4768       p->pList = pKeylist->pNext;
4769       sqliteFree(pKeylist);
4770     }
4771   }else{
4772     pc = pOp->p2 - 1;
4773   }
4774   break;
4775 }
4776 
4777 /* Opcode: ListReset * * *
4778 **
4779 ** Reset the temporary storage buffer so that it holds nothing.
4780 */
4781 case OP_ListReset: {
4782   if( p->pList ){
4783     KeylistFree(p->pList);
4784     p->pList = 0;
4785   }
4786   break;
4787 }
4788 
4789 /* Opcode: ListPush * * *
4790 **
4791 ** Save the current Vdbe list such that it can be restored by a ListPop
4792 ** opcode. The list is empty after this is executed.
4793 */
4794 case OP_ListPush: {
4795   p->keylistStackDepth++;
4796   assert(p->keylistStackDepth > 0);
4797   p->keylistStack = sqliteRealloc(p->keylistStack,
4798           sizeof(Keylist *) * p->keylistStackDepth);
4799   if( p->keylistStack==0 ) goto no_mem;
4800   p->keylistStack[p->keylistStackDepth - 1] = p->pList;
4801   p->pList = 0;
4802   break;
4803 }
4804 
4805 /* Opcode: ListPop * * *
4806 **
4807 ** Restore the Vdbe list to the state it was in when ListPush was last
4808 ** executed.
4809 */
4810 case OP_ListPop: {
4811   assert(p->keylistStackDepth > 0);
4812   p->keylistStackDepth--;
4813   KeylistFree(p->pList);
4814   p->pList = p->keylistStack[p->keylistStackDepth];
4815   p->keylistStack[p->keylistStackDepth] = 0;
4816   if( p->keylistStackDepth == 0 ){
4817     sqliteFree(p->keylistStack);
4818     p->keylistStack = 0;
4819   }
4820   break;
4821 }
4822 
4823 /* Opcode: SortPut * * *
4824 **
4825 ** The TOS is the key and the NOS is the data.  Pop both from the stack
4826 ** and put them on the sorter.  The key and data should have been
4827 ** made using SortMakeKey and SortMakeRec, respectively.
4828 */
4829 case OP_SortPut: {
4830   int tos = p->tos;
4831   int nos = tos - 1;
4832   Sorter *pSorter;
4833   VERIFY( if( tos<1 ) goto not_enough_stack; )
4834   if( Dynamicify(p, tos) || Dynamicify(p, nos) ) goto no_mem;
4835   pSorter = sqliteMallocRaw( sizeof(Sorter) );
4836   if( pSorter==0 ) goto no_mem;
4837   pSorter->pNext = p->pSort;
4838   p->pSort = pSorter;
4839   assert( aStack[tos].flags & STK_Dyn );
4840   pSorter->nKey = aStack[tos].n;
4841   pSorter->zKey = zStack[tos];
4842   pSorter->nData = aStack[nos].n;
4843   if( aStack[nos].flags & STK_Dyn ){
4844     pSorter->pData = zStack[nos];
4845   }else{
4846     pSorter->pData = sqliteStrDup(zStack[nos]);
4847   }
4848   aStack[tos].flags = 0;
4849   aStack[nos].flags = 0;
4850   zStack[tos] = 0;
4851   zStack[nos] = 0;
4852   p->tos -= 2;
4853   break;
4854 }
4855 
4856 /* Opcode: SortMakeRec P1 * *
4857 **
4858 ** The top P1 elements are the arguments to a callback.  Form these
4859 ** elements into a single data entry that can be stored on a sorter
4860 ** using SortPut and later fed to a callback using SortCallback.
4861 */
4862 case OP_SortMakeRec: {
4863   char *z;
4864   char **azArg;
4865   int nByte;
4866   int nField;
4867   int i, j;
4868 
4869   nField = pOp->p1;
4870   VERIFY( if( p->tos+1<nField ) goto not_enough_stack; )
4871   nByte = 0;
4872   for(i=p->tos-nField+1; i<=p->tos; i++){
4873     if( (aStack[i].flags & STK_Null)==0 ){
4874       Stringify(p, i);
4875       nByte += aStack[i].n;
4876     }
4877   }
4878   nByte += sizeof(char*)*(nField+1);
4879   azArg = sqliteMallocRaw( nByte );
4880   if( azArg==0 ) goto no_mem;
4881   z = (char*)&azArg[nField+1];
4882   for(j=0, i=p->tos-nField+1; i<=p->tos; i++, j++){
4883     if( aStack[i].flags & STK_Null ){
4884       azArg[j] = 0;
4885     }else{
4886       azArg[j] = z;
4887       strcpy(z, zStack[i]);
4888       z += aStack[i].n;
4889     }
4890   }
4891   PopStack(p, nField);
4892   p->tos++;
4893   aStack[p->tos].n = nByte;
4894   zStack[p->tos] = (char*)azArg;
4895   aStack[p->tos].flags = STK_Str|STK_Dyn;
4896   break;
4897 }
4898 
4899 /* Opcode: SortMakeKey * * P3
4900 **
4901 ** Convert the top few entries of the stack into a sort key.  The
4902 ** number of stack entries consumed is the number of characters in
4903 ** the string P3.  One character from P3 is prepended to each entry.
4904 ** The first character of P3 is prepended to the element lowest in
4905 ** the stack and the last character of P3 is prepended to the top of
4906 ** the stack.  All stack entries are separated by a \000 character
4907 ** in the result.  The whole key is terminated by two \000 characters
4908 ** in a row.
4909 **
4910 ** "N" is substituted in place of the P3 character for NULL values.
4911 **
4912 ** See also the MakeKey and MakeIdxKey opcodes.
4913 */
4914 case OP_SortMakeKey: {
4915   char *zNewKey;
4916   int nByte;
4917   int nField;
4918   int i, j, k;
4919 
4920   nField = strlen(pOp->p3);
4921   VERIFY( if( p->tos+1<nField ) goto not_enough_stack; )
4922   nByte = 1;
4923   for(i=p->tos-nField+1; i<=p->tos; i++){
4924     if( (aStack[i].flags & STK_Null)!=0 ){
4925       nByte += 2;
4926     }else{
4927       Stringify(p, i);
4928       nByte += aStack[i].n+2;
4929     }
4930   }
4931   zNewKey = sqliteMallocRaw( nByte );
4932   if( zNewKey==0 ) goto no_mem;
4933   j = 0;
4934   k = 0;
4935   for(i=p->tos-nField+1; i<=p->tos; i++){
4936     if( (aStack[i].flags & STK_Null)!=0 ){
4937       zNewKey[j++] = 'N';
4938       zNewKey[j++] = 0;
4939       k++;
4940     }else{
4941       zNewKey[j++] = pOp->p3[k++];
4942       memcpy(&zNewKey[j], zStack[i], aStack[i].n-1);
4943       j += aStack[i].n-1;
4944       zNewKey[j++] = 0;
4945     }
4946   }
4947   zNewKey[j] = 0;
4948   assert( j<nByte );
4949   PopStack(p, nField);
4950   p->tos++;
4951   aStack[p->tos].n = nByte;
4952   aStack[p->tos].flags = STK_Str|STK_Dyn;
4953   zStack[p->tos] = zNewKey;
4954   break;
4955 }
4956 
4957 /* Opcode: Sort * * *
4958 **
4959 ** Sort all elements on the sorter.  The algorithm is a
4960 ** mergesort.
4961 */
4962 case OP_Sort: {
4963   int i;
4964   Sorter *pElem;
4965   Sorter *apSorter[NSORT];
4966   for(i=0; i<NSORT; i++){
4967     apSorter[i] = 0;
4968   }
4969   while( p->pSort ){
4970     pElem = p->pSort;
4971     p->pSort = pElem->pNext;
4972     pElem->pNext = 0;
4973     for(i=0; i<NSORT-1; i++){
4974     if( apSorter[i]==0 ){
4975         apSorter[i] = pElem;
4976         break;
4977       }else{
4978         pElem = Merge(apSorter[i], pElem);
4979         apSorter[i] = 0;
4980       }
4981     }
4982     if( i>=NSORT-1 ){
4983       apSorter[NSORT-1] = Merge(apSorter[NSORT-1],pElem);
4984     }
4985   }
4986   pElem = 0;
4987   for(i=0; i<NSORT; i++){
4988     pElem = Merge(apSorter[i], pElem);
4989   }
4990   p->pSort = pElem;
4991   break;
4992 }
4993 
4994 /* Opcode: SortNext * P2 *
4995 **
4996 ** Push the data for the topmost element in the sorter onto the
4997 ** stack, then remove the element from the sorter.  If the sorter
4998 ** is empty, push nothing on the stack and instead jump immediately
4999 ** to instruction P2.
5000 */
5001 case OP_SortNext: {
5002   Sorter *pSorter = p->pSort;
5003   CHECK_FOR_INTERRUPT;
5004   if( pSorter!=0 ){
5005     p->pSort = pSorter->pNext;
5006     p->tos++;
5007     zStack[p->tos] = pSorter->pData;
5008     aStack[p->tos].n = pSorter->nData;
5009     aStack[p->tos].flags = STK_Str|STK_Dyn;
5010     sqliteFree(pSorter->zKey);
5011     sqliteFree(pSorter);
5012   }else{
5013     pc = pOp->p2 - 1;
5014   }
5015   break;
5016 }
5017 
5018 /* Opcode: SortCallback P1 * *
5019 **
5020 ** The top of the stack contains a callback record built using
5021 ** the SortMakeRec operation with the same P1 value as this
5022 ** instruction.  Pop this record from the stack and invoke the
5023 ** callback on it.
5024 */
5025 case OP_SortCallback: {
5026   int i = p->tos;
5027   VERIFY( if( i<0 ) goto not_enough_stack; )
5028   if( p->xCallback==0 ){
5029     p->pc = pc+1;
5030     p->azResColumn = (char**)zStack[i];
5031     p->nResColumn = pOp->p1;
5032     p->popStack = 1;
5033     return SQLITE_ROW;
5034   }else{
5035     if( sqliteSafetyOff(db) ) goto abort_due_to_misuse;
5036     if( p->xCallback(p->pCbArg, pOp->p1, (char**)zStack[i], p->azColName)!=0 ){
5037       rc = SQLITE_ABORT;
5038     }
5039     if( sqliteSafetyOn(db) ) goto abort_due_to_misuse;
5040     p->nCallback++;
5041   }
5042   POPSTACK;
5043   if( sqlite_malloc_failed ) goto no_mem;
5044   break;
5045 }
5046 
5047 /* Opcode: SortReset * * *
5048 **
5049 ** Remove any elements that remain on the sorter.
5050 */
5051 case OP_SortReset: {
5052   SorterReset(p);
5053   break;
5054 }
5055 
5056 /* Opcode: FileOpen * * P3
5057 **
5058 ** Open the file named by P3 for reading using the FileRead opcode.
5059 ** If P3 is "stdin" then open standard input for reading.
5060 */
5061 case OP_FileOpen: {
5062   VERIFY( if( pOp->p3==0 ) goto bad_instruction; )
5063   if( p->pFile ){
5064     if( p->pFile!=stdin ) fclose(p->pFile);
5065     p->pFile = 0;
5066   }
5067   if( sqliteStrICmp(pOp->p3,"stdin")==0 ){
5068     p->pFile = stdin;
5069   }else{
5070     p->pFile = fopen(pOp->p3, "r");
5071   }
5072   if( p->pFile==0 ){
5073     sqliteSetString(&p->zErrMsg,"unable to open file: ", pOp->p3, 0);
5074     rc = SQLITE_ERROR;
5075   }
5076   break;
5077 }
5078 
5079 /* Opcode: FileRead P1 P2 P3
5080 **
5081 ** Read a single line of input from the open file (the file opened using
5082 ** FileOpen).  If we reach end-of-file, jump immediately to P2.  If
5083 ** we are able to get another line, split the line apart using P3 as
5084 ** a delimiter.  There should be P1 fields.  If the input line contains
5085 ** more than P1 fields, ignore the excess.  If the input line contains
5086 ** fewer than P1 fields, assume the remaining fields contain NULLs.
5087 **
5088 ** Input ends if a line consists of just "\.".  A field containing only
5089 ** "\N" is a null field.  The backslash \ character can be used be used
5090 ** to escape newlines or the delimiter.
5091 */
5092 case OP_FileRead: {
5093   int n, eol, nField, i, c, nDelim;
5094   char *zDelim, *z;
5095   CHECK_FOR_INTERRUPT;
5096   if( p->pFile==0 ) goto fileread_jump;
5097   nField = pOp->p1;
5098   if( nField<=0 ) goto fileread_jump;
5099   if( nField!=p->nField || p->azField==0 ){
5100     char **azField = sqliteRealloc(p->azField, sizeof(char*)*nField+1);
5101     if( azField==0 ){ goto no_mem; }
5102     p->azField = azField;
5103     p->nField = nField;
5104   }
5105   n = 0;
5106   eol = 0;
5107   while( eol==0 ){
5108     if( p->zLine==0 || n+200>p->nLineAlloc ){
5109       char *zLine;
5110       p->nLineAlloc = p->nLineAlloc*2 + 300;
5111       zLine = sqliteRealloc(p->zLine, p->nLineAlloc);
5112       if( zLine==0 ){
5113         p->nLineAlloc = 0;
5114         sqliteFree(p->zLine);
5115         p->zLine = 0;
5116         goto no_mem;
5117       }
5118       p->zLine = zLine;
5119     }
5120     if( vdbe_fgets(&p->zLine[n], p->nLineAlloc-n, p->pFile)==0 ){
5121       eol = 1;
5122       p->zLine[n] = 0;
5123     }else{
5124       int c;
5125       while( (c = p->zLine[n])!=0 ){
5126         if( c=='\\' ){
5127           if( p->zLine[n+1]==0 ) break;
5128           n += 2;
5129         }else if( c=='\n' ){
5130           p->zLine[n] = 0;
5131           eol = 1;
5132           break;
5133         }else{
5134           n++;
5135         }
5136       }
5137     }
5138   }
5139   if( n==0 ) goto fileread_jump;
5140   z = p->zLine;
5141   if( z[0]=='\\' && z[1]=='.' && z[2]==0 ){
5142     goto fileread_jump;
5143   }
5144   zDelim = pOp->p3;
5145   if( zDelim==0 ) zDelim = "\t";
5146   c = zDelim[0];
5147   nDelim = strlen(zDelim);
5148   p->azField[0] = z;
5149   for(i=1; *z!=0 && i<=nField; i++){
5150     int from, to;
5151     from = to = 0;
5152     if( z[0]=='\\' && z[1]=='N'
5153        && (z[2]==0 || strncmp(&z[2],zDelim,nDelim)==0) ){
5154       if( i<=nField ) p->azField[i-1] = 0;
5155       z += 2 + nDelim;
5156       if( i<nField ) p->azField[i] = z;
5157       continue;
5158     }
5159     while( z[from] ){
5160       if( z[from]=='\\' && z[from+1]!=0 ){
5161         z[to++] = z[from+1];
5162         from += 2;
5163         continue;
5164       }
5165       if( z[from]==c && strncmp(&z[from],zDelim,nDelim)==0 ) break;
5166       z[to++] = z[from++];
5167     }
5168     if( z[from] ){
5169       z[to] = 0;
5170       z += from + nDelim;
5171       if( i<nField ) p->azField[i] = z;
5172     }else{
5173       z[to] = 0;
5174       z = "";
5175     }
5176   }
5177   while( i<nField ){
5178     p->azField[i++] = 0;
5179   }
5180   break;
5181 
5182   /* If we reach end-of-file, or if anything goes wrong, jump here.
5183   ** This code will cause a jump to P2 */
5184 fileread_jump:
5185   pc = pOp->p2 - 1;
5186   break;
5187 }
5188 
5189 /* Opcode: FileColumn P1 * *
5190 **
5191 ** Push onto the stack the P1-th column of the most recently read line
5192 ** from the input file.
5193 */
5194 case OP_FileColumn: {
5195   int i = pOp->p1;
5196   char *z;
5197   if( VERIFY( i>=0 && i<p->nField && ) p->azField ){
5198     z = p->azField[i];
5199   }else{
5200     z = 0;
5201   }
5202   p->tos++;
5203   if( z ){
5204     aStack[p->tos].n = strlen(z) + 1;
5205     zStack[p->tos] = z;
5206     aStack[p->tos].flags = STK_Str;
5207   }else{
5208     aStack[p->tos].n = 0;
5209     zStack[p->tos] = 0;
5210     aStack[p->tos].flags = STK_Null;
5211   }
5212   break;
5213 }
5214 
5215 /* Opcode: MemStore P1 P2 *
5216 **
5217 ** Write the top of the stack into memory location P1.
5218 ** P1 should be a small integer since space is allocated
5219 ** for all memory locations between 0 and P1 inclusive.
5220 **
5221 ** After the data is stored in the memory location, the
5222 ** stack is popped once if P2 is 1.  If P2 is zero, then
5223 ** the original data remains on the stack.
5224 */
5225 case OP_MemStore: {
5226   int i = pOp->p1;
5227   int tos = p->tos;
5228   char *zOld;
5229   Mem *pMem;
5230   int flags;
5231   VERIFY( if( tos<0 ) goto not_enough_stack; )
5232   if( i>=p->nMem ){
5233     int nOld = p->nMem;
5234     Mem *aMem;
5235     p->nMem = i + 5;
5236     aMem = sqliteRealloc(p->aMem, p->nMem*sizeof(p->aMem[0]));
5237     if( aMem==0 ) goto no_mem;
5238     if( aMem!=p->aMem ){
5239       int j;
5240       for(j=0; j<nOld; j++){
5241         if( aMem[j].z==p->aMem[j].s.z ){
5242           aMem[j].z = aMem[j].s.z;
5243         }
5244       }
5245     }
5246     p->aMem = aMem;
5247     if( nOld<p->nMem ){
5248       memset(&p->aMem[nOld], 0, sizeof(p->aMem[0])*(p->nMem-nOld));
5249     }
5250   }
5251   pMem = &p->aMem[i];
5252   flags = pMem->s.flags;
5253   if( flags & STK_Dyn ){
5254     zOld = pMem->z;
5255   }else{
5256     zOld = 0;
5257   }
5258   pMem->s = aStack[tos];
5259   flags = pMem->s.flags;
5260   if( flags & (STK_Static|STK_Dyn|STK_Ephem) ){
5261     if( (flags & STK_Static)!=0 || (pOp->p2 && (flags & STK_Dyn)!=0) ){
5262       pMem->z = zStack[tos];
5263     }else if( flags & STK_Str ){
5264       pMem->z = sqliteMallocRaw( pMem->s.n );
5265       if( pMem->z==0 ) goto no_mem;
5266       memcpy(pMem->z, zStack[tos], pMem->s.n);
5267       pMem->s.flags |= STK_Dyn;
5268       pMem->s.flags &= ~(STK_Static|STK_Ephem);
5269     }
5270   }else{
5271     pMem->z = pMem->s.z;
5272   }
5273   if( zOld ) sqliteFree(zOld);
5274   if( pOp->p2 ){
5275     zStack[tos] = 0;
5276     aStack[tos].flags = 0;
5277     POPSTACK;
5278   }
5279   break;
5280 }
5281 
5282 /* Opcode: MemLoad P1 * *
5283 **
5284 ** Push a copy of the value in memory location P1 onto the stack.
5285 **
5286 ** If the value is a string, then the value pushed is a pointer to
5287 ** the string that is stored in the memory location.  If the memory
5288 ** location is subsequently changed (using OP_MemStore) then the
5289 ** value pushed onto the stack will change too.
5290 */
5291 case OP_MemLoad: {
5292   int tos = ++p->tos;
5293   int i = pOp->p1;
5294   VERIFY( if( i<0 || i>=p->nMem ) goto bad_instruction; )
5295   memcpy(&aStack[tos], &p->aMem[i].s, sizeof(aStack[tos])-NBFS);;
5296   if( aStack[tos].flags & STK_Str ){
5297     zStack[tos] = p->aMem[i].z;
5298     aStack[tos].flags |= STK_Ephem;
5299     aStack[tos].flags &= ~(STK_Dyn|STK_Static);
5300   }
5301   break;
5302 }
5303 
5304 /* Opcode: MemIncr P1 P2 *
5305 **
5306 ** Increment the integer valued memory cell P1 by 1.  If P2 is not zero
5307 ** and the result after the increment is greater than zero, then jump
5308 ** to P2.
5309 **
5310 ** This instruction throws an error if the memory cell is not initially
5311 ** an integer.
5312 */
5313 case OP_MemIncr: {
5314   int i = pOp->p1;
5315   Mem *pMem;
5316   VERIFY( if( i<0 || i>=p->nMem ) goto bad_instruction; )
5317   pMem = &p->aMem[i];
5318   VERIFY( if( pMem->s.flags != STK_Int ) goto bad_instruction; )
5319   pMem->s.i++;
5320   if( pOp->p2>0 && pMem->s.i>0 ){
5321      pc = pOp->p2 - 1;
5322   }
5323   break;
5324 }
5325 
5326 /* Opcode: AggReset * P2 *
5327 **
5328 ** Reset the aggregator so that it no longer contains any data.
5329 ** Future aggregator elements will contain P2 values each.
5330 */
5331 case OP_AggReset: {
5332   AggReset(&p->agg);
5333   p->agg.nMem = pOp->p2;
5334   p->agg.apFunc = sqliteMalloc( p->agg.nMem*sizeof(p->agg.apFunc[0]) );
5335   if( p->agg.apFunc==0 ) goto no_mem;
5336   break;
5337 }
5338 
5339 /* Opcode: AggInit * P2 P3
5340 **
5341 ** Initialize the function parameters for an aggregate function.
5342 ** The aggregate will operate out of aggregate column P2.
5343 ** P3 is a pointer to the FuncDef structure for the function.
5344 */
5345 case OP_AggInit: {
5346   int i = pOp->p2;
5347   VERIFY( if( i<0 || i>=p->agg.nMem ) goto bad_instruction; )
5348   p->agg.apFunc[i] = (FuncDef*)pOp->p3;
5349   break;
5350 }
5351 
5352 /* Opcode: AggFunc * P2 P3
5353 **
5354 ** Execute the step function for an aggregate.  The
5355 ** function has P2 arguments.  P3 is a pointer to the FuncDef
5356 ** structure that specifies the function.
5357 **
5358 ** The top of the stack must be an integer which is the index of
5359 ** the aggregate column that corresponds to this aggregate function.
5360 ** Ideally, this index would be another parameter, but there are
5361 ** no free parameters left.  The integer is popped from the stack.
5362 */
5363 case OP_AggFunc: {
5364   int n = pOp->p2;
5365   int i;
5366   Mem *pMem;
5367   sqlite_func ctx;
5368 
5369   VERIFY( if( n<0 ) goto bad_instruction; )
5370   VERIFY( if( p->tos+1<n ) goto not_enough_stack; )
5371   VERIFY( if( aStack[p->tos].flags!=STK_Int ) goto bad_instruction; )
5372   for(i=p->tos-n; i<p->tos; i++){
5373     if( aStack[i].flags & STK_Null ){
5374       zStack[i] = 0;
5375     }else{
5376       Stringify(p, i);
5377     }
5378   }
5379   i = aStack[p->tos].i;
5380   VERIFY( if( i<0 || i>=p->agg.nMem ) goto bad_instruction; )
5381   ctx.pFunc = (FuncDef*)pOp->p3;
5382   pMem = &p->agg.pCurrent->aMem[i];
5383   ctx.z = pMem->s.z;
5384   ctx.pAgg = pMem->z;
5385   ctx.cnt = ++pMem->s.i;
5386   ctx.isError = 0;
5387   ctx.isStep = 1;
5388   (ctx.pFunc->xStep)(&ctx, n, (const char**)&zStack[p->tos-n]);
5389   pMem->z = ctx.pAgg;
5390   pMem->s.flags = STK_AggCtx;
5391   PopStack(p, n+1);
5392   if( ctx.isError ){
5393     rc = SQLITE_ERROR;
5394   }
5395   break;
5396 }
5397 
5398 /* Opcode: AggFocus * P2 *
5399 **
5400 ** Pop the top of the stack and use that as an aggregator key.  If
5401 ** an aggregator with that same key already exists, then make the
5402 ** aggregator the current aggregator and jump to P2.  If no aggregator
5403 ** with the given key exists, create one and make it current but
5404 ** do not jump.
5405 **
5406 ** The order of aggregator opcodes is important.  The order is:
5407 ** AggReset AggFocus AggNext.  In other words, you must execute
5408 ** AggReset first, then zero or more AggFocus operations, then
5409 ** zero or more AggNext operations.  You must not execute an AggFocus
5410 ** in between an AggNext and an AggReset.
5411 */
5412 case OP_AggFocus: {
5413   int tos = p->tos;
5414   AggElem *pElem;
5415   char *zKey;
5416   int nKey;
5417 
5418   VERIFY( if( tos<0 ) goto not_enough_stack; )
5419   Stringify(p, tos);
5420   zKey = zStack[tos];
5421   nKey = aStack[tos].n;
5422   pElem = sqliteHashFind(&p->agg.hash, zKey, nKey);
5423   if( pElem ){
5424     p->agg.pCurrent = pElem;
5425     pc = pOp->p2 - 1;
5426   }else{
5427     AggInsert(&p->agg, zKey, nKey);
5428     if( sqlite_malloc_failed ) goto no_mem;
5429   }
5430   POPSTACK;
5431   break;
5432 }
5433 
5434 /* Opcode: AggSet * P2 *
5435 **
5436 ** Move the top of the stack into the P2-th field of the current
5437 ** aggregate.  String values are duplicated into new memory.
5438 */
5439 case OP_AggSet: {
5440   AggElem *pFocus = AggInFocus(p->agg);
5441   int i = pOp->p2;
5442   int tos = p->tos;
5443   VERIFY( if( tos<0 ) goto not_enough_stack; )
5444   if( pFocus==0 ) goto no_mem;
5445   if( VERIFY( i>=0 && ) i<p->agg.nMem ){
5446     Mem *pMem = &pFocus->aMem[i];
5447     char *zOld;
5448     if( pMem->s.flags & STK_Dyn ){
5449       zOld = pMem->z;
5450     }else{
5451       zOld = 0;
5452     }
5453     Deephemeralize(p, tos);
5454     pMem->s = aStack[tos];
5455     if( pMem->s.flags & STK_Dyn ){
5456       pMem->z = zStack[tos];
5457       zStack[tos] = 0;
5458       aStack[tos].flags = 0;
5459     }else if( pMem->s.flags & (STK_Static|STK_AggCtx) ){
5460       pMem->z = zStack[tos];
5461     }else if( pMem->s.flags & STK_Str ){
5462       pMem->z = pMem->s.z;
5463     }
5464     if( zOld ) sqliteFree(zOld);
5465   }
5466   POPSTACK;
5467   break;
5468 }
5469 
5470 /* Opcode: AggGet * P2 *
5471 **
5472 ** Push a new entry onto the stack which is a copy of the P2-th field
5473 ** of the current aggregate.  Strings are not duplicated so
5474 ** string values will be ephemeral.
5475 */
5476 case OP_AggGet: {
5477   AggElem *pFocus = AggInFocus(p->agg);
5478   int i = pOp->p2;
5479   int tos = ++p->tos;
5480   if( pFocus==0 ) goto no_mem;
5481   if( VERIFY( i>=0 && ) i<p->agg.nMem ){
5482     Mem *pMem = &pFocus->aMem[i];
5483     aStack[tos] = pMem->s;
5484     zStack[tos] = pMem->z;
5485     aStack[tos].flags &= ~STK_Dyn;
5486     aStack[tos].flags |= STK_Ephem;
5487   }
5488   break;
5489 }
5490 
5491 /* Opcode: AggNext * P2 *
5492 **
5493 ** Make the next aggregate value the current aggregate.  The prior
5494 ** aggregate is deleted.  If all aggregate values have been consumed,
5495 ** jump to P2.
5496 **
5497 ** The order of aggregator opcodes is important.  The order is:
5498 ** AggReset AggFocus AggNext.  In other words, you must execute
5499 ** AggReset first, then zero or more AggFocus operations, then
5500 ** zero or more AggNext operations.  You must not execute an AggFocus
5501 ** in between an AggNext and an AggReset.
5502 */
5503 case OP_AggNext: {
5504   CHECK_FOR_INTERRUPT;
5505   if( p->agg.pSearch==0 ){
5506     p->agg.pSearch = sqliteHashFirst(&p->agg.hash);
5507   }else{
5508     p->agg.pSearch = sqliteHashNext(p->agg.pSearch);
5509   }
5510   if( p->agg.pSearch==0 ){
5511     pc = pOp->p2 - 1;
5512   } else {
5513     int i;
5514     sqlite_func ctx;
5515     Mem *aMem;
5516     p->agg.pCurrent = sqliteHashData(p->agg.pSearch);
5517     aMem = p->agg.pCurrent->aMem;
5518     for(i=0; i<p->agg.nMem; i++){
5519       int freeCtx;
5520       if( p->agg.apFunc[i]==0 ) continue;
5521       if( p->agg.apFunc[i]->xFinalize==0 ) continue;
5522       ctx.s.flags = STK_Null;
5523       ctx.z = 0;
5524       ctx.pAgg = (void*)aMem[i].z;
5525       freeCtx = aMem[i].z && aMem[i].z!=aMem[i].s.z;
5526       ctx.cnt = aMem[i].s.i;
5527       ctx.isStep = 0;
5528       ctx.pFunc = p->agg.apFunc[i];
5529       (*p->agg.apFunc[i]->xFinalize)(&ctx);
5530       if( freeCtx ){
5531         sqliteFree( aMem[i].z );
5532       }
5533       aMem[i].s = ctx.s;
5534       aMem[i].z = ctx.z;
5535       if( (aMem[i].s.flags & STK_Str) &&
5536               (aMem[i].s.flags & (STK_Dyn|STK_Static|STK_Ephem))==0 ){
5537         aMem[i].z = aMem[i].s.z;
5538       }
5539     }
5540   }
5541   break;
5542 }
5543 
5544 /* Opcode: SetInsert P1 * P3
5545 **
5546 ** If Set P1 does not exist then create it.  Then insert value
5547 ** P3 into that set.  If P3 is NULL, then insert the top of the
5548 ** stack into the set.
5549 */
5550 case OP_SetInsert: {
5551   int i = pOp->p1;
5552   if( p->nSet<=i ){
5553     int k;
5554     Set *aSet = sqliteRealloc(p->aSet, (i+1)*sizeof(p->aSet[0]) );
5555     if( aSet==0 ) goto no_mem;
5556     p->aSet = aSet;
5557     for(k=p->nSet; k<=i; k++){
5558       sqliteHashInit(&p->aSet[k].hash, SQLITE_HASH_BINARY, 1);
5559     }
5560     p->nSet = i+1;
5561   }
5562   if( pOp->p3 ){
5563     sqliteHashInsert(&p->aSet[i].hash, pOp->p3, strlen(pOp->p3)+1, p);
5564   }else{
5565     int tos = p->tos;
5566     if( tos<0 ) goto not_enough_stack;
5567     Stringify(p, tos);
5568     sqliteHashInsert(&p->aSet[i].hash, zStack[tos], aStack[tos].n, p);
5569     POPSTACK;
5570   }
5571   if( sqlite_malloc_failed ) goto no_mem;
5572   break;
5573 }
5574 
5575 /* Opcode: SetFound P1 P2 *
5576 **
5577 ** Pop the stack once and compare the value popped off with the
5578 ** contents of set P1.  If the element popped exists in set P1,
5579 ** then jump to P2.  Otherwise fall through.
5580 */
5581 case OP_SetFound: {
5582   int i = pOp->p1;
5583   int tos = p->tos;
5584   VERIFY( if( tos<0 ) goto not_enough_stack; )
5585   Stringify(p, tos);
5586   if( i>=0 && i<p->nSet &&
5587        sqliteHashFind(&p->aSet[i].hash, zStack[tos], aStack[tos].n)){
5588     pc = pOp->p2 - 1;
5589   }
5590   POPSTACK;
5591   break;
5592 }
5593 
5594 /* Opcode: SetNotFound P1 P2 *
5595 **
5596 ** Pop the stack once and compare the value popped off with the
5597 ** contents of set P1.  If the element popped does not exists in
5598 ** set P1, then jump to P2.  Otherwise fall through.
5599 */
5600 case OP_SetNotFound: {
5601   int i = pOp->p1;
5602   int tos = p->tos;
5603   VERIFY( if( tos<0 ) goto not_enough_stack; )
5604   Stringify(p, tos);
5605   if( i<0 || i>=p->nSet ||
5606        sqliteHashFind(&p->aSet[i].hash, zStack[tos], aStack[tos].n)==0 ){
5607     pc = pOp->p2 - 1;
5608   }
5609   POPSTACK;
5610   break;
5611 }
5612 
5613 /* Opcode: SetFirst P1 P2 *
5614 **
5615 ** Read the first element from set P1 and push it onto the stack.  If the
5616 ** set is empty, push nothing and jump immediately to P2.  This opcode is
5617 ** used in combination with OP_SetNext to loop over all elements of a set.
5618 */
5619 /* Opcode: SetNext P1 P2 *
5620 **
5621 ** Read the next element from set P1 and push it onto the stack.  If there
5622 ** are no more elements in the set, do not do the push and fall through.
5623 ** Otherwise, jump to P2 after pushing the next set element.
5624 */
5625 case OP_SetFirst:
5626 case OP_SetNext: {
5627   Set *pSet;
5628   int tos;
5629   CHECK_FOR_INTERRUPT;
5630   if( pOp->p1<0 || pOp->p1>=p->nSet ){
5631     if( pOp->opcode==OP_SetFirst ) pc = pOp->p2 - 1;
5632     break;
5633   }
5634   pSet = &p->aSet[pOp->p1];
5635   if( pOp->opcode==OP_SetFirst ){
5636     pSet->prev = sqliteHashFirst(&pSet->hash);
5637     if( pSet->prev==0 ){
5638       pc = pOp->p2 - 1;
5639       break;
5640     }
5641   }else{
5642     VERIFY( if( pSet->prev==0 ) goto bad_instruction; )
5643     pSet->prev = sqliteHashNext(pSet->prev);
5644     if( pSet->prev==0 ){
5645       break;
5646     }else{
5647       pc = pOp->p2 - 1;
5648     }
5649   }
5650   tos = ++p->tos;
5651   zStack[tos] = sqliteHashKey(pSet->prev);
5652   aStack[tos].n = sqliteHashKeysize(pSet->prev);
5653   aStack[tos].flags = STK_Str | STK_Ephem;
5654   break;
5655 }
5656 
5657 /* An other opcode is illegal...
5658 */
5659 default: {
5660   sprintf(zBuf,"%d",pOp->opcode);
5661   sqliteSetString(&p->zErrMsg, "unknown opcode ", zBuf, 0);
5662   rc = SQLITE_INTERNAL;
5663   break;
5664 }
5665 
5666 /*****************************************************************************
5667 ** The cases of the switch statement above this line should all be indented
5668 ** by 6 spaces.  But the left-most 6 spaces have been removed to improve the
5669 ** readability.  From this point on down, the normal indentation rules are
5670 ** restored.
5671 *****************************************************************************/
5672     }
5673 
5674 #ifdef VDBE_PROFILE
5675     {
5676       long long elapse = hwtime() - start;
5677       pOp->cycles += elapse;
5678       pOp->cnt++;
5679 #if 0
5680         fprintf(stdout, "%10lld ", elapse);
5681         vdbePrintOp(stdout, origPc, &p->aOp[origPc]);
5682 #endif
5683     }
5684 #endif
5685 
5686     /* The following code adds nothing to the actual functionality
5687     ** of the program.  It is only here for testing and debugging.
5688     ** On the other hand, it does burn CPU cycles every time through
5689     ** the evaluator loop.  So we can leave it out when NDEBUG is defined.
5690     */
5691 #ifndef NDEBUG
5692     if( pc<-1 || pc>=p->nOp ){
5693       sqliteSetString(&p->zErrMsg, "jump destination out of range", 0);
5694       rc = SQLITE_INTERNAL;
5695     }
5696     if( p->trace && p->tos>=0 ){
5697       int i;
5698       fprintf(p->trace, "Stack:");
5699       for(i=p->tos; i>=0 && i>p->tos-5; i--){
5700         if( aStack[i].flags & STK_Null ){
5701           fprintf(p->trace, " NULL");
5702         }else if( (aStack[i].flags & (STK_Int|STK_Str))==(STK_Int|STK_Str) ){
5703           fprintf(p->trace, " si:%d", aStack[i].i);
5704         }else if( aStack[i].flags & STK_Int ){
5705           fprintf(p->trace, " i:%d", aStack[i].i);
5706         }else if( aStack[i].flags & STK_Real ){
5707           fprintf(p->trace, " r:%g", aStack[i].r);
5708         }else if( aStack[i].flags & STK_Str ){
5709           int j, k;
5710           char zBuf[100];
5711           zBuf[0] = ' ';
5712           if( aStack[i].flags & STK_Dyn ){
5713             zBuf[1] = 'z';
5714             assert( (aStack[i].flags & (STK_Static|STK_Ephem))==0 );
5715           }else if( aStack[i].flags & STK_Static ){
5716             zBuf[1] = 't';
5717             assert( (aStack[i].flags & (STK_Dyn|STK_Ephem))==0 );
5718           }else if( aStack[i].flags & STK_Ephem ){
5719             zBuf[1] = 'e';
5720             assert( (aStack[i].flags & (STK_Static|STK_Dyn))==0 );
5721           }else{
5722             zBuf[1] = 's';
5723           }
5724           zBuf[2] = '[';
5725           k = 3;
5726           for(j=0; j<20 && j<aStack[i].n; j++){
5727             int c = zStack[i][j];
5728             if( c==0 && j==aStack[i].n-1 ) break;
5729             if( isprint(c) && !isspace(c) ){
5730               zBuf[k++] = c;
5731             }else{
5732               zBuf[k++] = '.';
5733             }
5734           }
5735           zBuf[k++] = ']';
5736           zBuf[k++] = 0;
5737           fprintf(p->trace, "%s", zBuf);
5738         }else{
5739           fprintf(p->trace, " ???");
5740         }
5741       }
5742       if( rc!=0 ) fprintf(p->trace," rc=%d",rc);
5743       fprintf(p->trace,"\n");
5744     }
5745 #endif
5746   }  /* The end of the for(;;) loop the loops through opcodes */
5747 
5748   /* If we reach this point, it means that execution is finished.
5749   */
5750 vdbe_halt:
5751   if( rc ){
5752     p->rc = rc;
5753     rc = SQLITE_ERROR;
5754   }else{
5755     rc = SQLITE_DONE;
5756   }
5757   p->magic = VDBE_MAGIC_HALT;
5758   return rc;
5759 
5760   /* Jump to here if a malloc() fails.  It's hard to get a malloc()
5761   ** to fail on a modern VM computer, so this code is untested.
5762   */
5763 no_mem:
5764   sqliteSetString(&p->zErrMsg, "out of memory", 0);
5765   rc = SQLITE_NOMEM;
5766   goto vdbe_halt;
5767 
5768   /* Jump to here for an SQLITE_MISUSE error.
5769   */
5770 abort_due_to_misuse:
5771   rc = SQLITE_MISUSE;
5772   /* Fall thru into abort_due_to_error */
5773 
5774   /* Jump to here for any other kind of fatal error.  The "rc" variable
5775   ** should hold the error number.
5776   */
5777 abort_due_to_error:
5778   if( p->zErrMsg==0 ){
5779     sqliteSetString(&p->zErrMsg, sqlite_error_string(rc), 0);
5780   }
5781   goto vdbe_halt;
5782 
5783   /* Jump to here if the sqlite_interrupt() API sets the interrupt
5784   ** flag.
5785   */
5786 abort_due_to_interrupt:
5787   assert( db->flags & SQLITE_Interrupt );
5788   db->flags &= ~SQLITE_Interrupt;
5789   if( db->magic!=SQLITE_MAGIC_BUSY ){
5790     rc = SQLITE_MISUSE;
5791   }else{
5792     rc = SQLITE_INTERRUPT;
5793   }
5794   sqliteSetString(&p->zErrMsg, sqlite_error_string(rc), 0);
5795   goto vdbe_halt;
5796 
5797   /* Jump to here if a operator is encountered that requires more stack
5798   ** operands than are currently available on the stack.
5799   */
5800 not_enough_stack:
5801   sprintf(zBuf,"%d",pc);
5802   sqliteSetString(&p->zErrMsg, "too few operands on stack at ", zBuf, 0);
5803   rc = SQLITE_INTERNAL;
5804   goto vdbe_halt;
5805 
5806   /* Jump here if an illegal or illformed instruction is executed.
5807   */
5808 VERIFY(
5809 bad_instruction:
5810   sprintf(zBuf,"%d",pc);
5811   sqliteSetString(&p->zErrMsg, "illegal operation at ", zBuf, 0);
5812   rc = SQLITE_INTERNAL;
5813   goto vdbe_halt;
5814 )
5815 }
5816 
5817 
5818 /*
5819 ** Clean up the VDBE after execution.  Return an integer which is the
5820 ** result code.
5821 */
5822 int sqliteVdbeFinalize(Vdbe *p, char **pzErrMsg){
5823   sqlite *db = p->db;
5824   int i, rc;
5825 
5826   if( p->magic!=VDBE_MAGIC_RUN && p->magic!=VDBE_MAGIC_HALT ){
5827     sqliteSetString(pzErrMsg, sqlite_error_string(SQLITE_MISUSE), 0);
5828     return SQLITE_MISUSE;
5829   }
5830   if( p->zErrMsg ){
5831     if( pzErrMsg && *pzErrMsg==0 ){
5832       *pzErrMsg = p->zErrMsg;
5833     }else{
5834       sqliteFree(p->zErrMsg);
5835     }
5836     p->zErrMsg = 0;
5837   }
5838   Cleanup(p);
5839   if( p->rc!=SQLITE_OK ){
5840     switch( p->errorAction ){
5841       case OE_Abort: {
5842         if( !p->undoTransOnError ){
5843           for(i=0; i<db->nDb; i++){
5844             if( db->aDb[i].pBt ){
5845               sqliteBtreeRollbackCkpt(db->aDb[i].pBt);
5846             }
5847           }
5848           break;
5849         }
5850         /* Fall through to ROLLBACK */
5851       }
5852       case OE_Rollback: {
5853         sqliteRollbackAll(db);
5854         db->flags &= ~SQLITE_InTrans;
5855         db->onError = OE_Default;
5856         break;
5857       }
5858       default: {
5859         if( p->undoTransOnError ){
5860           sqliteRollbackAll(db);
5861           db->flags &= ~SQLITE_InTrans;
5862           db->onError = OE_Default;
5863         }
5864         break;
5865       }
5866     }
5867     sqliteRollbackInternalChanges(db);
5868   }
5869   for(i=0; i<db->nDb; i++){
5870     if( db->aDb[i].pBt && db->aDb[i].inTrans==2 ){
5871       sqliteBtreeCommitCkpt(db->aDb[i].pBt);
5872       db->aDb[i].inTrans = 1;
5873     }
5874   }
5875   assert( p->tos<p->pc || sqlite_malloc_failed==1 );
5876 #ifdef VDBE_PROFILE
5877   {
5878     FILE *out = fopen("vdbe_profile.out", "a");
5879     if( out ){
5880       int i;
5881       fprintf(out, "---- ");
5882       for(i=0; i<p->nOp; i++){
5883         fprintf(out, "%02x", p->aOp[i].opcode);
5884       }
5885       fprintf(out, "\n");
5886       for(i=0; i<p->nOp; i++){
5887         fprintf(out, "%6d %10lld %8lld ",
5888            p->aOp[i].cnt,
5889            p->aOp[i].cycles,
5890            p->aOp[i].cnt>0 ? p->aOp[i].cycles/p->aOp[i].cnt : 0
5891         );
5892         vdbePrintOp(out, i, &p->aOp[i]);
5893       }
5894       fclose(out);
5895     }
5896   }
5897 #endif
5898   rc = p->rc;
5899   sqliteVdbeDelete(p);
5900   if( db->want_to_close && db->pVdbe==0 ){
5901     sqlite_close(db);
5902   }
5903   return rc;
5904 }
5905 
5906 /*
5907 ** Create a new Vdbe in *pOut and populate it with the program from p. Then
5908 ** pass p to sqliteVdbeFinalize().
5909 */
5910 int sqliteVdbeReset(Vdbe *p, char ** pErrMsg, Vdbe** pOut)
5911 {
5912   if( pOut && p->rc != SQLITE_SCHEMA ){
5913 
5914     /* Create a new VDBE and populate it with the program used by the old
5915     ** VDBE. Don't copy the last instruction of the program, as this is an
5916     ** OP_Halt coded by sqliteVdbeMakeReady().
5917     */
5918     *pOut = sqliteVdbeCreate( p->db );
5919     (*pOut)->aOp = p->aOp;
5920     (*pOut)->nOp = p->nOp-1;
5921     (*pOut)->nOpAlloc = p->nOpAlloc;
5922     sqliteVdbeMakeReady( *pOut, p->xCallback, p->pCbArg, (int)p->explain );
5923     p->aOp = 0;
5924     p->nOp = 0;
5925     p->nOpAlloc = 0;
5926   }else if( pOut ){
5927     *pOut = NULL;
5928   }
5929   return sqliteVdbeFinalize(p, pErrMsg);
5930 }
5931