xref: /sqlite-3.40.0/src/vdbeaux.c (revision 181d75ef)
1 /*
2 ** 2003 September 6
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 ** This file contains code used for creating, destroying, and populating
13 ** a VDBE (or an "sqlite3_stmt" as it is known to the outside world.)
14 */
15 #include "sqliteInt.h"
16 #include "vdbeInt.h"
17 
18 /* Forward references */
19 static void freeEphemeralFunction(sqlite3 *db, FuncDef *pDef);
20 static void vdbeFreeOpArray(sqlite3 *, Op *, int);
21 
22 /*
23 ** Create a new virtual database engine.
24 */
25 Vdbe *sqlite3VdbeCreate(Parse *pParse){
26   sqlite3 *db = pParse->db;
27   Vdbe *p;
28   p = sqlite3DbMallocRawNN(db, sizeof(Vdbe) );
29   if( p==0 ) return 0;
30   memset(&p->aOp, 0, sizeof(Vdbe)-offsetof(Vdbe,aOp));
31   p->db = db;
32   if( db->pVdbe ){
33     db->pVdbe->pPrev = p;
34   }
35   p->pNext = db->pVdbe;
36   p->pPrev = 0;
37   db->pVdbe = p;
38   assert( p->eVdbeState==VDBE_INIT_STATE );
39   p->pParse = pParse;
40   pParse->pVdbe = p;
41   assert( pParse->aLabel==0 );
42   assert( pParse->nLabel==0 );
43   assert( p->nOpAlloc==0 );
44   assert( pParse->szOpAlloc==0 );
45   sqlite3VdbeAddOp2(p, OP_Init, 0, 1);
46   return p;
47 }
48 
49 /*
50 ** Return the Parse object that owns a Vdbe object.
51 */
52 Parse *sqlite3VdbeParser(Vdbe *p){
53   return p->pParse;
54 }
55 
56 /*
57 ** Change the error string stored in Vdbe.zErrMsg
58 */
59 void sqlite3VdbeError(Vdbe *p, const char *zFormat, ...){
60   va_list ap;
61   sqlite3DbFree(p->db, p->zErrMsg);
62   va_start(ap, zFormat);
63   p->zErrMsg = sqlite3VMPrintf(p->db, zFormat, ap);
64   va_end(ap);
65 }
66 
67 /*
68 ** Remember the SQL string for a prepared statement.
69 */
70 void sqlite3VdbeSetSql(Vdbe *p, const char *z, int n, u8 prepFlags){
71   if( p==0 ) return;
72   p->prepFlags = prepFlags;
73   if( (prepFlags & SQLITE_PREPARE_SAVESQL)==0 ){
74     p->expmask = 0;
75   }
76   assert( p->zSql==0 );
77   p->zSql = sqlite3DbStrNDup(p->db, z, n);
78 }
79 
80 #ifdef SQLITE_ENABLE_NORMALIZE
81 /*
82 ** Add a new element to the Vdbe->pDblStr list.
83 */
84 void sqlite3VdbeAddDblquoteStr(sqlite3 *db, Vdbe *p, const char *z){
85   if( p ){
86     int n = sqlite3Strlen30(z);
87     DblquoteStr *pStr = sqlite3DbMallocRawNN(db,
88                             sizeof(*pStr)+n+1-sizeof(pStr->z));
89     if( pStr ){
90       pStr->pNextStr = p->pDblStr;
91       p->pDblStr = pStr;
92       memcpy(pStr->z, z, n+1);
93     }
94   }
95 }
96 #endif
97 
98 #ifdef SQLITE_ENABLE_NORMALIZE
99 /*
100 ** zId of length nId is a double-quoted identifier.  Check to see if
101 ** that identifier is really used as a string literal.
102 */
103 int sqlite3VdbeUsesDoubleQuotedString(
104   Vdbe *pVdbe,            /* The prepared statement */
105   const char *zId         /* The double-quoted identifier, already dequoted */
106 ){
107   DblquoteStr *pStr;
108   assert( zId!=0 );
109   if( pVdbe->pDblStr==0 ) return 0;
110   for(pStr=pVdbe->pDblStr; pStr; pStr=pStr->pNextStr){
111     if( strcmp(zId, pStr->z)==0 ) return 1;
112   }
113   return 0;
114 }
115 #endif
116 
117 /*
118 ** Swap all content between two VDBE structures.
119 */
120 void sqlite3VdbeSwap(Vdbe *pA, Vdbe *pB){
121   Vdbe tmp, *pTmp;
122   char *zTmp;
123   assert( pA->db==pB->db );
124   tmp = *pA;
125   *pA = *pB;
126   *pB = tmp;
127   pTmp = pA->pNext;
128   pA->pNext = pB->pNext;
129   pB->pNext = pTmp;
130   pTmp = pA->pPrev;
131   pA->pPrev = pB->pPrev;
132   pB->pPrev = pTmp;
133   zTmp = pA->zSql;
134   pA->zSql = pB->zSql;
135   pB->zSql = zTmp;
136 #ifdef SQLITE_ENABLE_NORMALIZE
137   zTmp = pA->zNormSql;
138   pA->zNormSql = pB->zNormSql;
139   pB->zNormSql = zTmp;
140 #endif
141   pB->expmask = pA->expmask;
142   pB->prepFlags = pA->prepFlags;
143   memcpy(pB->aCounter, pA->aCounter, sizeof(pB->aCounter));
144   pB->aCounter[SQLITE_STMTSTATUS_REPREPARE]++;
145 }
146 
147 /*
148 ** Resize the Vdbe.aOp array so that it is at least nOp elements larger
149 ** than its current size. nOp is guaranteed to be less than or equal
150 ** to 1024/sizeof(Op).
151 **
152 ** If an out-of-memory error occurs while resizing the array, return
153 ** SQLITE_NOMEM. In this case Vdbe.aOp and Vdbe.nOpAlloc remain
154 ** unchanged (this is so that any opcodes already allocated can be
155 ** correctly deallocated along with the rest of the Vdbe).
156 */
157 static int growOpArray(Vdbe *v, int nOp){
158   VdbeOp *pNew;
159   Parse *p = v->pParse;
160 
161   /* The SQLITE_TEST_REALLOC_STRESS compile-time option is designed to force
162   ** more frequent reallocs and hence provide more opportunities for
163   ** simulated OOM faults.  SQLITE_TEST_REALLOC_STRESS is generally used
164   ** during testing only.  With SQLITE_TEST_REALLOC_STRESS grow the op array
165   ** by the minimum* amount required until the size reaches 512.  Normal
166   ** operation (without SQLITE_TEST_REALLOC_STRESS) is to double the current
167   ** size of the op array or add 1KB of space, whichever is smaller. */
168 #ifdef SQLITE_TEST_REALLOC_STRESS
169   sqlite3_int64 nNew = (v->nOpAlloc>=512 ? 2*(sqlite3_int64)v->nOpAlloc
170                         : (sqlite3_int64)v->nOpAlloc+nOp);
171 #else
172   sqlite3_int64 nNew = (v->nOpAlloc ? 2*(sqlite3_int64)v->nOpAlloc
173                         : (sqlite3_int64)(1024/sizeof(Op)));
174   UNUSED_PARAMETER(nOp);
175 #endif
176 
177   /* Ensure that the size of a VDBE does not grow too large */
178   if( nNew > p->db->aLimit[SQLITE_LIMIT_VDBE_OP] ){
179     sqlite3OomFault(p->db);
180     return SQLITE_NOMEM;
181   }
182 
183   assert( nOp<=(int)(1024/sizeof(Op)) );
184   assert( nNew>=(v->nOpAlloc+nOp) );
185   pNew = sqlite3DbRealloc(p->db, v->aOp, nNew*sizeof(Op));
186   if( pNew ){
187     p->szOpAlloc = sqlite3DbMallocSize(p->db, pNew);
188     v->nOpAlloc = p->szOpAlloc/sizeof(Op);
189     v->aOp = pNew;
190   }
191   return (pNew ? SQLITE_OK : SQLITE_NOMEM_BKPT);
192 }
193 
194 #ifdef SQLITE_DEBUG
195 /* This routine is just a convenient place to set a breakpoint that will
196 ** fire after each opcode is inserted and displayed using
197 ** "PRAGMA vdbe_addoptrace=on".  Parameters "pc" (program counter) and
198 ** pOp are available to make the breakpoint conditional.
199 **
200 ** Other useful labels for breakpoints include:
201 **   test_trace_breakpoint(pc,pOp)
202 **   sqlite3CorruptError(lineno)
203 **   sqlite3MisuseError(lineno)
204 **   sqlite3CantopenError(lineno)
205 */
206 static void test_addop_breakpoint(int pc, Op *pOp){
207   static int n = 0;
208   n++;
209 }
210 #endif
211 
212 /*
213 ** Add a new instruction to the list of instructions current in the
214 ** VDBE.  Return the address of the new instruction.
215 **
216 ** Parameters:
217 **
218 **    p               Pointer to the VDBE
219 **
220 **    op              The opcode for this instruction
221 **
222 **    p1, p2, p3      Operands
223 **
224 ** Use the sqlite3VdbeResolveLabel() function to fix an address and
225 ** the sqlite3VdbeChangeP4() function to change the value of the P4
226 ** operand.
227 */
228 static SQLITE_NOINLINE int growOp3(Vdbe *p, int op, int p1, int p2, int p3){
229   assert( p->nOpAlloc<=p->nOp );
230   if( growOpArray(p, 1) ) return 1;
231   assert( p->nOpAlloc>p->nOp );
232   return sqlite3VdbeAddOp3(p, op, p1, p2, p3);
233 }
234 int sqlite3VdbeAddOp3(Vdbe *p, int op, int p1, int p2, int p3){
235   int i;
236   VdbeOp *pOp;
237 
238   i = p->nOp;
239   assert( p->eVdbeState==VDBE_INIT_STATE );
240   assert( op>=0 && op<0xff );
241   if( p->nOpAlloc<=i ){
242     return growOp3(p, op, p1, p2, p3);
243   }
244   assert( p->aOp!=0 );
245   p->nOp++;
246   pOp = &p->aOp[i];
247   assert( pOp!=0 );
248   pOp->opcode = (u8)op;
249   pOp->p5 = 0;
250   pOp->p1 = p1;
251   pOp->p2 = p2;
252   pOp->p3 = p3;
253   pOp->p4.p = 0;
254   pOp->p4type = P4_NOTUSED;
255 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
256   pOp->zComment = 0;
257 #endif
258 #ifdef SQLITE_DEBUG
259   if( p->db->flags & SQLITE_VdbeAddopTrace ){
260     sqlite3VdbePrintOp(0, i, &p->aOp[i]);
261     test_addop_breakpoint(i, &p->aOp[i]);
262   }
263 #endif
264 #ifdef VDBE_PROFILE
265   pOp->cycles = 0;
266   pOp->cnt = 0;
267 #endif
268 #ifdef SQLITE_VDBE_COVERAGE
269   pOp->iSrcLine = 0;
270 #endif
271   return i;
272 }
273 int sqlite3VdbeAddOp0(Vdbe *p, int op){
274   return sqlite3VdbeAddOp3(p, op, 0, 0, 0);
275 }
276 int sqlite3VdbeAddOp1(Vdbe *p, int op, int p1){
277   return sqlite3VdbeAddOp3(p, op, p1, 0, 0);
278 }
279 int sqlite3VdbeAddOp2(Vdbe *p, int op, int p1, int p2){
280   return sqlite3VdbeAddOp3(p, op, p1, p2, 0);
281 }
282 
283 /* Generate code for an unconditional jump to instruction iDest
284 */
285 int sqlite3VdbeGoto(Vdbe *p, int iDest){
286   return sqlite3VdbeAddOp3(p, OP_Goto, 0, iDest, 0);
287 }
288 
289 /* Generate code to cause the string zStr to be loaded into
290 ** register iDest
291 */
292 int sqlite3VdbeLoadString(Vdbe *p, int iDest, const char *zStr){
293   return sqlite3VdbeAddOp4(p, OP_String8, 0, iDest, 0, zStr, 0);
294 }
295 
296 /*
297 ** Generate code that initializes multiple registers to string or integer
298 ** constants.  The registers begin with iDest and increase consecutively.
299 ** One register is initialized for each characgter in zTypes[].  For each
300 ** "s" character in zTypes[], the register is a string if the argument is
301 ** not NULL, or OP_Null if the value is a null pointer.  For each "i" character
302 ** in zTypes[], the register is initialized to an integer.
303 **
304 ** If the input string does not end with "X" then an OP_ResultRow instruction
305 ** is generated for the values inserted.
306 */
307 void sqlite3VdbeMultiLoad(Vdbe *p, int iDest, const char *zTypes, ...){
308   va_list ap;
309   int i;
310   char c;
311   va_start(ap, zTypes);
312   for(i=0; (c = zTypes[i])!=0; i++){
313     if( c=='s' ){
314       const char *z = va_arg(ap, const char*);
315       sqlite3VdbeAddOp4(p, z==0 ? OP_Null : OP_String8, 0, iDest+i, 0, z, 0);
316     }else if( c=='i' ){
317       sqlite3VdbeAddOp2(p, OP_Integer, va_arg(ap, int), iDest+i);
318     }else{
319       goto skip_op_resultrow;
320     }
321   }
322   sqlite3VdbeAddOp2(p, OP_ResultRow, iDest, i);
323 skip_op_resultrow:
324   va_end(ap);
325 }
326 
327 /*
328 ** Add an opcode that includes the p4 value as a pointer.
329 */
330 int sqlite3VdbeAddOp4(
331   Vdbe *p,            /* Add the opcode to this VM */
332   int op,             /* The new opcode */
333   int p1,             /* The P1 operand */
334   int p2,             /* The P2 operand */
335   int p3,             /* The P3 operand */
336   const char *zP4,    /* The P4 operand */
337   int p4type          /* P4 operand type */
338 ){
339   int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
340   sqlite3VdbeChangeP4(p, addr, zP4, p4type);
341   return addr;
342 }
343 
344 /*
345 ** Add an OP_Function or OP_PureFunc opcode.
346 **
347 ** The eCallCtx argument is information (typically taken from Expr.op2)
348 ** that describes the calling context of the function.  0 means a general
349 ** function call.  NC_IsCheck means called by a check constraint,
350 ** NC_IdxExpr means called as part of an index expression.  NC_PartIdx
351 ** means in the WHERE clause of a partial index.  NC_GenCol means called
352 ** while computing a generated column value.  0 is the usual case.
353 */
354 int sqlite3VdbeAddFunctionCall(
355   Parse *pParse,        /* Parsing context */
356   int p1,               /* Constant argument mask */
357   int p2,               /* First argument register */
358   int p3,               /* Register into which results are written */
359   int nArg,             /* Number of argument */
360   const FuncDef *pFunc, /* The function to be invoked */
361   int eCallCtx          /* Calling context */
362 ){
363   Vdbe *v = pParse->pVdbe;
364   int nByte;
365   int addr;
366   sqlite3_context *pCtx;
367   assert( v );
368   nByte = sizeof(*pCtx) + (nArg-1)*sizeof(sqlite3_value*);
369   pCtx = sqlite3DbMallocRawNN(pParse->db, nByte);
370   if( pCtx==0 ){
371     assert( pParse->db->mallocFailed );
372     freeEphemeralFunction(pParse->db, (FuncDef*)pFunc);
373     return 0;
374   }
375   pCtx->pOut = 0;
376   pCtx->pFunc = (FuncDef*)pFunc;
377   pCtx->pVdbe = 0;
378   pCtx->isError = 0;
379   pCtx->argc = nArg;
380   pCtx->iOp = sqlite3VdbeCurrentAddr(v);
381   addr = sqlite3VdbeAddOp4(v, eCallCtx ? OP_PureFunc : OP_Function,
382                            p1, p2, p3, (char*)pCtx, P4_FUNCCTX);
383   sqlite3VdbeChangeP5(v, eCallCtx & NC_SelfRef);
384   return addr;
385 }
386 
387 /*
388 ** Add an opcode that includes the p4 value with a P4_INT64 or
389 ** P4_REAL type.
390 */
391 int sqlite3VdbeAddOp4Dup8(
392   Vdbe *p,            /* Add the opcode to this VM */
393   int op,             /* The new opcode */
394   int p1,             /* The P1 operand */
395   int p2,             /* The P2 operand */
396   int p3,             /* The P3 operand */
397   const u8 *zP4,      /* The P4 operand */
398   int p4type          /* P4 operand type */
399 ){
400   char *p4copy = sqlite3DbMallocRawNN(sqlite3VdbeDb(p), 8);
401   if( p4copy ) memcpy(p4copy, zP4, 8);
402   return sqlite3VdbeAddOp4(p, op, p1, p2, p3, p4copy, p4type);
403 }
404 
405 #ifndef SQLITE_OMIT_EXPLAIN
406 /*
407 ** Return the address of the current EXPLAIN QUERY PLAN baseline.
408 ** 0 means "none".
409 */
410 int sqlite3VdbeExplainParent(Parse *pParse){
411   VdbeOp *pOp;
412   if( pParse->addrExplain==0 ) return 0;
413   pOp = sqlite3VdbeGetOp(pParse->pVdbe, pParse->addrExplain);
414   return pOp->p2;
415 }
416 
417 /*
418 ** Set a debugger breakpoint on the following routine in order to
419 ** monitor the EXPLAIN QUERY PLAN code generation.
420 */
421 #if defined(SQLITE_DEBUG)
422 void sqlite3ExplainBreakpoint(const char *z1, const char *z2){
423   (void)z1;
424   (void)z2;
425 }
426 #endif
427 
428 /*
429 ** Add a new OP_Explain opcode.
430 **
431 ** If the bPush flag is true, then make this opcode the parent for
432 ** subsequent Explains until sqlite3VdbeExplainPop() is called.
433 */
434 void sqlite3VdbeExplain(Parse *pParse, u8 bPush, const char *zFmt, ...){
435 #ifndef SQLITE_DEBUG
436   /* Always include the OP_Explain opcodes if SQLITE_DEBUG is defined.
437   ** But omit them (for performance) during production builds */
438   if( pParse->explain==2 )
439 #endif
440   {
441     char *zMsg;
442     Vdbe *v;
443     va_list ap;
444     int iThis;
445     va_start(ap, zFmt);
446     zMsg = sqlite3VMPrintf(pParse->db, zFmt, ap);
447     va_end(ap);
448     v = pParse->pVdbe;
449     iThis = v->nOp;
450     sqlite3VdbeAddOp4(v, OP_Explain, iThis, pParse->addrExplain, 0,
451                       zMsg, P4_DYNAMIC);
452     sqlite3ExplainBreakpoint(bPush?"PUSH":"", sqlite3VdbeGetOp(v,-1)->p4.z);
453     if( bPush){
454       pParse->addrExplain = iThis;
455     }
456   }
457 }
458 
459 /*
460 ** Pop the EXPLAIN QUERY PLAN stack one level.
461 */
462 void sqlite3VdbeExplainPop(Parse *pParse){
463   sqlite3ExplainBreakpoint("POP", 0);
464   pParse->addrExplain = sqlite3VdbeExplainParent(pParse);
465 }
466 #endif /* SQLITE_OMIT_EXPLAIN */
467 
468 /*
469 ** Add an OP_ParseSchema opcode.  This routine is broken out from
470 ** sqlite3VdbeAddOp4() since it needs to also needs to mark all btrees
471 ** as having been used.
472 **
473 ** The zWhere string must have been obtained from sqlite3_malloc().
474 ** This routine will take ownership of the allocated memory.
475 */
476 void sqlite3VdbeAddParseSchemaOp(Vdbe *p, int iDb, char *zWhere, u16 p5){
477   int j;
478   sqlite3VdbeAddOp4(p, OP_ParseSchema, iDb, 0, 0, zWhere, P4_DYNAMIC);
479   sqlite3VdbeChangeP5(p, p5);
480   for(j=0; j<p->db->nDb; j++) sqlite3VdbeUsesBtree(p, j);
481   sqlite3MayAbort(p->pParse);
482 }
483 
484 /*
485 ** Add an opcode that includes the p4 value as an integer.
486 */
487 int sqlite3VdbeAddOp4Int(
488   Vdbe *p,            /* Add the opcode to this VM */
489   int op,             /* The new opcode */
490   int p1,             /* The P1 operand */
491   int p2,             /* The P2 operand */
492   int p3,             /* The P3 operand */
493   int p4              /* The P4 operand as an integer */
494 ){
495   int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
496   if( p->db->mallocFailed==0 ){
497     VdbeOp *pOp = &p->aOp[addr];
498     pOp->p4type = P4_INT32;
499     pOp->p4.i = p4;
500   }
501   return addr;
502 }
503 
504 /* Insert the end of a co-routine
505 */
506 void sqlite3VdbeEndCoroutine(Vdbe *v, int regYield){
507   sqlite3VdbeAddOp1(v, OP_EndCoroutine, regYield);
508 
509   /* Clear the temporary register cache, thereby ensuring that each
510   ** co-routine has its own independent set of registers, because co-routines
511   ** might expect their registers to be preserved across an OP_Yield, and
512   ** that could cause problems if two or more co-routines are using the same
513   ** temporary register.
514   */
515   v->pParse->nTempReg = 0;
516   v->pParse->nRangeReg = 0;
517 }
518 
519 /*
520 ** Create a new symbolic label for an instruction that has yet to be
521 ** coded.  The symbolic label is really just a negative number.  The
522 ** label can be used as the P2 value of an operation.  Later, when
523 ** the label is resolved to a specific address, the VDBE will scan
524 ** through its operation list and change all values of P2 which match
525 ** the label into the resolved address.
526 **
527 ** The VDBE knows that a P2 value is a label because labels are
528 ** always negative and P2 values are suppose to be non-negative.
529 ** Hence, a negative P2 value is a label that has yet to be resolved.
530 ** (Later:) This is only true for opcodes that have the OPFLG_JUMP
531 ** property.
532 **
533 ** Variable usage notes:
534 **
535 **     Parse.aLabel[x]     Stores the address that the x-th label resolves
536 **                         into.  For testing (SQLITE_DEBUG), unresolved
537 **                         labels stores -1, but that is not required.
538 **     Parse.nLabelAlloc   Number of slots allocated to Parse.aLabel[]
539 **     Parse.nLabel        The *negative* of the number of labels that have
540 **                         been issued.  The negative is stored because
541 **                         that gives a performance improvement over storing
542 **                         the equivalent positive value.
543 */
544 int sqlite3VdbeMakeLabel(Parse *pParse){
545   return --pParse->nLabel;
546 }
547 
548 /*
549 ** Resolve label "x" to be the address of the next instruction to
550 ** be inserted.  The parameter "x" must have been obtained from
551 ** a prior call to sqlite3VdbeMakeLabel().
552 */
553 static SQLITE_NOINLINE void resizeResolveLabel(Parse *p, Vdbe *v, int j){
554   int nNewSize = 10 - p->nLabel;
555   p->aLabel = sqlite3DbReallocOrFree(p->db, p->aLabel,
556                      nNewSize*sizeof(p->aLabel[0]));
557   if( p->aLabel==0 ){
558     p->nLabelAlloc = 0;
559   }else{
560 #ifdef SQLITE_DEBUG
561     int i;
562     for(i=p->nLabelAlloc; i<nNewSize; i++) p->aLabel[i] = -1;
563 #endif
564     p->nLabelAlloc = nNewSize;
565     p->aLabel[j] = v->nOp;
566   }
567 }
568 void sqlite3VdbeResolveLabel(Vdbe *v, int x){
569   Parse *p = v->pParse;
570   int j = ADDR(x);
571   assert( v->eVdbeState==VDBE_INIT_STATE );
572   assert( j<-p->nLabel );
573   assert( j>=0 );
574 #ifdef SQLITE_DEBUG
575   if( p->db->flags & SQLITE_VdbeAddopTrace ){
576     printf("RESOLVE LABEL %d to %d\n", x, v->nOp);
577   }
578 #endif
579   if( p->nLabelAlloc + p->nLabel < 0 ){
580     resizeResolveLabel(p,v,j);
581   }else{
582     assert( p->aLabel[j]==(-1) ); /* Labels may only be resolved once */
583     p->aLabel[j] = v->nOp;
584   }
585 }
586 
587 /*
588 ** Mark the VDBE as one that can only be run one time.
589 */
590 void sqlite3VdbeRunOnlyOnce(Vdbe *p){
591   sqlite3VdbeAddOp2(p, OP_Expire, 1, 1);
592 }
593 
594 /*
595 ** Mark the VDBE as one that can only be run multiple times.
596 */
597 void sqlite3VdbeReusable(Vdbe *p){
598   int i;
599   for(i=1; ALWAYS(i<p->nOp); i++){
600     if( ALWAYS(p->aOp[i].opcode==OP_Expire) ){
601       p->aOp[1].opcode = OP_Noop;
602       break;
603     }
604   }
605 }
606 
607 #ifdef SQLITE_DEBUG /* sqlite3AssertMayAbort() logic */
608 
609 /*
610 ** The following type and function are used to iterate through all opcodes
611 ** in a Vdbe main program and each of the sub-programs (triggers) it may
612 ** invoke directly or indirectly. It should be used as follows:
613 **
614 **   Op *pOp;
615 **   VdbeOpIter sIter;
616 **
617 **   memset(&sIter, 0, sizeof(sIter));
618 **   sIter.v = v;                            // v is of type Vdbe*
619 **   while( (pOp = opIterNext(&sIter)) ){
620 **     // Do something with pOp
621 **   }
622 **   sqlite3DbFree(v->db, sIter.apSub);
623 **
624 */
625 typedef struct VdbeOpIter VdbeOpIter;
626 struct VdbeOpIter {
627   Vdbe *v;                   /* Vdbe to iterate through the opcodes of */
628   SubProgram **apSub;        /* Array of subprograms */
629   int nSub;                  /* Number of entries in apSub */
630   int iAddr;                 /* Address of next instruction to return */
631   int iSub;                  /* 0 = main program, 1 = first sub-program etc. */
632 };
633 static Op *opIterNext(VdbeOpIter *p){
634   Vdbe *v = p->v;
635   Op *pRet = 0;
636   Op *aOp;
637   int nOp;
638 
639   if( p->iSub<=p->nSub ){
640 
641     if( p->iSub==0 ){
642       aOp = v->aOp;
643       nOp = v->nOp;
644     }else{
645       aOp = p->apSub[p->iSub-1]->aOp;
646       nOp = p->apSub[p->iSub-1]->nOp;
647     }
648     assert( p->iAddr<nOp );
649 
650     pRet = &aOp[p->iAddr];
651     p->iAddr++;
652     if( p->iAddr==nOp ){
653       p->iSub++;
654       p->iAddr = 0;
655     }
656 
657     if( pRet->p4type==P4_SUBPROGRAM ){
658       int nByte = (p->nSub+1)*sizeof(SubProgram*);
659       int j;
660       for(j=0; j<p->nSub; j++){
661         if( p->apSub[j]==pRet->p4.pProgram ) break;
662       }
663       if( j==p->nSub ){
664         p->apSub = sqlite3DbReallocOrFree(v->db, p->apSub, nByte);
665         if( !p->apSub ){
666           pRet = 0;
667         }else{
668           p->apSub[p->nSub++] = pRet->p4.pProgram;
669         }
670       }
671     }
672   }
673 
674   return pRet;
675 }
676 
677 /*
678 ** Check if the program stored in the VM associated with pParse may
679 ** throw an ABORT exception (causing the statement, but not entire transaction
680 ** to be rolled back). This condition is true if the main program or any
681 ** sub-programs contains any of the following:
682 **
683 **   *  OP_Halt with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
684 **   *  OP_HaltIfNull with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
685 **   *  OP_Destroy
686 **   *  OP_VUpdate
687 **   *  OP_VCreate
688 **   *  OP_VRename
689 **   *  OP_FkCounter with P2==0 (immediate foreign key constraint)
690 **   *  OP_CreateBtree/BTREE_INTKEY and OP_InitCoroutine
691 **      (for CREATE TABLE AS SELECT ...)
692 **
693 ** Then check that the value of Parse.mayAbort is true if an
694 ** ABORT may be thrown, or false otherwise. Return true if it does
695 ** match, or false otherwise. This function is intended to be used as
696 ** part of an assert statement in the compiler. Similar to:
697 **
698 **   assert( sqlite3VdbeAssertMayAbort(pParse->pVdbe, pParse->mayAbort) );
699 */
700 int sqlite3VdbeAssertMayAbort(Vdbe *v, int mayAbort){
701   int hasAbort = 0;
702   int hasFkCounter = 0;
703   int hasCreateTable = 0;
704   int hasCreateIndex = 0;
705   int hasInitCoroutine = 0;
706   Op *pOp;
707   VdbeOpIter sIter;
708 
709   if( v==0 ) return 0;
710   memset(&sIter, 0, sizeof(sIter));
711   sIter.v = v;
712 
713   while( (pOp = opIterNext(&sIter))!=0 ){
714     int opcode = pOp->opcode;
715     if( opcode==OP_Destroy || opcode==OP_VUpdate || opcode==OP_VRename
716      || opcode==OP_VDestroy
717      || opcode==OP_VCreate
718      || opcode==OP_ParseSchema
719      || ((opcode==OP_Halt || opcode==OP_HaltIfNull)
720       && ((pOp->p1)!=SQLITE_OK && pOp->p2==OE_Abort))
721     ){
722       hasAbort = 1;
723       break;
724     }
725     if( opcode==OP_CreateBtree && pOp->p3==BTREE_INTKEY ) hasCreateTable = 1;
726     if( mayAbort ){
727       /* hasCreateIndex may also be set for some DELETE statements that use
728       ** OP_Clear. So this routine may end up returning true in the case
729       ** where a "DELETE FROM tbl" has a statement-journal but does not
730       ** require one. This is not so bad - it is an inefficiency, not a bug. */
731       if( opcode==OP_CreateBtree && pOp->p3==BTREE_BLOBKEY ) hasCreateIndex = 1;
732       if( opcode==OP_Clear ) hasCreateIndex = 1;
733     }
734     if( opcode==OP_InitCoroutine ) hasInitCoroutine = 1;
735 #ifndef SQLITE_OMIT_FOREIGN_KEY
736     if( opcode==OP_FkCounter && pOp->p1==0 && pOp->p2==1 ){
737       hasFkCounter = 1;
738     }
739 #endif
740   }
741   sqlite3DbFree(v->db, sIter.apSub);
742 
743   /* Return true if hasAbort==mayAbort. Or if a malloc failure occurred.
744   ** If malloc failed, then the while() loop above may not have iterated
745   ** through all opcodes and hasAbort may be set incorrectly. Return
746   ** true for this case to prevent the assert() in the callers frame
747   ** from failing.  */
748   return ( v->db->mallocFailed || hasAbort==mayAbort || hasFkCounter
749         || (hasCreateTable && hasInitCoroutine) || hasCreateIndex
750   );
751 }
752 #endif /* SQLITE_DEBUG - the sqlite3AssertMayAbort() function */
753 
754 #ifdef SQLITE_DEBUG
755 /*
756 ** Increment the nWrite counter in the VDBE if the cursor is not an
757 ** ephemeral cursor, or if the cursor argument is NULL.
758 */
759 void sqlite3VdbeIncrWriteCounter(Vdbe *p, VdbeCursor *pC){
760   if( pC==0
761    || (pC->eCurType!=CURTYPE_SORTER
762        && pC->eCurType!=CURTYPE_PSEUDO
763        && !pC->isEphemeral)
764   ){
765     p->nWrite++;
766   }
767 }
768 #endif
769 
770 #ifdef SQLITE_DEBUG
771 /*
772 ** Assert if an Abort at this point in time might result in a corrupt
773 ** database.
774 */
775 void sqlite3VdbeAssertAbortable(Vdbe *p){
776   assert( p->nWrite==0 || p->usesStmtJournal );
777 }
778 #endif
779 
780 /*
781 ** This routine is called after all opcodes have been inserted.  It loops
782 ** through all the opcodes and fixes up some details.
783 **
784 ** (1) For each jump instruction with a negative P2 value (a label)
785 **     resolve the P2 value to an actual address.
786 **
787 ** (2) Compute the maximum number of arguments used by any SQL function
788 **     and store that value in *pMaxFuncArgs.
789 **
790 ** (3) Update the Vdbe.readOnly and Vdbe.bIsReader flags to accurately
791 **     indicate what the prepared statement actually does.
792 **
793 ** (4) (discontinued)
794 **
795 ** (5) Reclaim the memory allocated for storing labels.
796 **
797 ** This routine will only function correctly if the mkopcodeh.tcl generator
798 ** script numbers the opcodes correctly.  Changes to this routine must be
799 ** coordinated with changes to mkopcodeh.tcl.
800 */
801 static void resolveP2Values(Vdbe *p, int *pMaxFuncArgs){
802   int nMaxArgs = *pMaxFuncArgs;
803   Op *pOp;
804   Parse *pParse = p->pParse;
805   int *aLabel = pParse->aLabel;
806   p->readOnly = 1;
807   p->bIsReader = 0;
808   pOp = &p->aOp[p->nOp-1];
809   while(1){
810 
811     /* Only JUMP opcodes and the short list of special opcodes in the switch
812     ** below need to be considered.  The mkopcodeh.tcl generator script groups
813     ** all these opcodes together near the front of the opcode list.  Skip
814     ** any opcode that does not need processing by virtual of the fact that
815     ** it is larger than SQLITE_MX_JUMP_OPCODE, as a performance optimization.
816     */
817     if( pOp->opcode<=SQLITE_MX_JUMP_OPCODE ){
818       /* NOTE: Be sure to update mkopcodeh.tcl when adding or removing
819       ** cases from this switch! */
820       switch( pOp->opcode ){
821         case OP_Transaction: {
822           if( pOp->p2!=0 ) p->readOnly = 0;
823           /* no break */ deliberate_fall_through
824         }
825         case OP_AutoCommit:
826         case OP_Savepoint: {
827           p->bIsReader = 1;
828           break;
829         }
830 #ifndef SQLITE_OMIT_WAL
831         case OP_Checkpoint:
832 #endif
833         case OP_Vacuum:
834         case OP_JournalMode: {
835           p->readOnly = 0;
836           p->bIsReader = 1;
837           break;
838         }
839 #ifndef SQLITE_OMIT_VIRTUALTABLE
840         case OP_VUpdate: {
841           if( pOp->p2>nMaxArgs ) nMaxArgs = pOp->p2;
842           break;
843         }
844         case OP_VFilter: {
845           int n;
846           assert( (pOp - p->aOp) >= 3 );
847           assert( pOp[-1].opcode==OP_Integer );
848           n = pOp[-1].p1;
849           if( n>nMaxArgs ) nMaxArgs = n;
850           /* Fall through into the default case */
851           /* no break */ deliberate_fall_through
852         }
853 #endif
854         default: {
855           if( pOp->p2<0 ){
856             /* The mkopcodeh.tcl script has so arranged things that the only
857             ** non-jump opcodes less than SQLITE_MX_JUMP_CODE are guaranteed to
858             ** have non-negative values for P2. */
859             assert( (sqlite3OpcodeProperty[pOp->opcode] & OPFLG_JUMP)!=0 );
860             assert( ADDR(pOp->p2)<-pParse->nLabel );
861             pOp->p2 = aLabel[ADDR(pOp->p2)];
862           }
863           break;
864         }
865       }
866       /* The mkopcodeh.tcl script has so arranged things that the only
867       ** non-jump opcodes less than SQLITE_MX_JUMP_CODE are guaranteed to
868       ** have non-negative values for P2. */
869       assert( (sqlite3OpcodeProperty[pOp->opcode]&OPFLG_JUMP)==0 || pOp->p2>=0);
870     }
871     if( pOp==p->aOp ) break;
872     pOp--;
873   }
874   if( aLabel ){
875     sqlite3DbFreeNN(p->db, pParse->aLabel);
876     pParse->aLabel = 0;
877   }
878   pParse->nLabel = 0;
879   *pMaxFuncArgs = nMaxArgs;
880   assert( p->bIsReader!=0 || DbMaskAllZero(p->btreeMask) );
881 }
882 
883 #ifdef SQLITE_DEBUG
884 /*
885 ** Check to see if a subroutine contains a jump to a location outside of
886 ** the subroutine.  If a jump outside the subroutine is detected, add code
887 ** that will cause the program to halt with an error message.
888 **
889 ** The subroutine consists of opcodes between iFirst and iLast.  Jumps to
890 ** locations within the subroutine are acceptable.  iRetReg is a register
891 ** that contains the return address.  Jumps to outside the range of iFirst
892 ** through iLast are also acceptable as long as the jump destination is
893 ** an OP_Return to iReturnAddr.
894 **
895 ** A jump to an unresolved label means that the jump destination will be
896 ** beyond the current address.  That is normally a jump to an early
897 ** termination and is consider acceptable.
898 **
899 ** This routine only runs during debug builds.  The purpose is (of course)
900 ** to detect invalid escapes out of a subroutine.  The OP_Halt opcode
901 ** is generated rather than an assert() or other error, so that ".eqp full"
902 ** will still work to show the original bytecode, to aid in debugging.
903 */
904 void sqlite3VdbeNoJumpsOutsideSubrtn(
905   Vdbe *v,          /* The byte-code program under construction */
906   int iFirst,       /* First opcode of the subroutine */
907   int iLast,        /* Last opcode of the subroutine */
908   int iRetReg       /* Subroutine return address register */
909 ){
910   VdbeOp *pOp;
911   Parse *pParse;
912   int i;
913   sqlite3_str *pErr = 0;
914   assert( v!=0 );
915   pParse = v->pParse;
916   assert( pParse!=0 );
917   if( pParse->nErr ) return;
918   assert( iLast>=iFirst );
919   assert( iLast<v->nOp );
920   pOp = &v->aOp[iFirst];
921   for(i=iFirst; i<=iLast; i++, pOp++){
922     if( (sqlite3OpcodeProperty[pOp->opcode] & OPFLG_JUMP)!=0 ){
923       int iDest = pOp->p2;   /* Jump destination */
924       if( iDest==0 ) continue;
925       if( pOp->opcode==OP_Gosub ) continue;
926       if( iDest<0 ){
927         int j = ADDR(iDest);
928         assert( j>=0 );
929         if( j>=-pParse->nLabel || pParse->aLabel[j]<0 ){
930           continue;
931         }
932         iDest = pParse->aLabel[j];
933       }
934       if( iDest<iFirst || iDest>iLast ){
935         int j = iDest;
936         for(; j<v->nOp; j++){
937           VdbeOp *pX = &v->aOp[j];
938           if( pX->opcode==OP_Return ){
939             if( pX->p1==iRetReg ) break;
940             continue;
941           }
942           if( pX->opcode==OP_Noop ) continue;
943           if( pX->opcode==OP_Explain ) continue;
944           if( pErr==0 ){
945             pErr = sqlite3_str_new(0);
946           }else{
947             sqlite3_str_appendchar(pErr, 1, '\n');
948           }
949           sqlite3_str_appendf(pErr,
950               "Opcode at %d jumps to %d which is outside the "
951               "subroutine at %d..%d",
952               i, iDest, iFirst, iLast);
953           break;
954         }
955       }
956     }
957   }
958   if( pErr ){
959     char *zErr = sqlite3_str_finish(pErr);
960     sqlite3VdbeAddOp4(v, OP_Halt, SQLITE_INTERNAL, OE_Abort, 0, zErr, 0);
961     sqlite3_free(zErr);
962     sqlite3MayAbort(pParse);
963   }
964 }
965 #endif /* SQLITE_DEBUG */
966 
967 /*
968 ** Return the address of the next instruction to be inserted.
969 */
970 int sqlite3VdbeCurrentAddr(Vdbe *p){
971   assert( p->eVdbeState==VDBE_INIT_STATE );
972   return p->nOp;
973 }
974 
975 /*
976 ** Verify that at least N opcode slots are available in p without
977 ** having to malloc for more space (except when compiled using
978 ** SQLITE_TEST_REALLOC_STRESS).  This interface is used during testing
979 ** to verify that certain calls to sqlite3VdbeAddOpList() can never
980 ** fail due to a OOM fault and hence that the return value from
981 ** sqlite3VdbeAddOpList() will always be non-NULL.
982 */
983 #if defined(SQLITE_DEBUG) && !defined(SQLITE_TEST_REALLOC_STRESS)
984 void sqlite3VdbeVerifyNoMallocRequired(Vdbe *p, int N){
985   assert( p->nOp + N <= p->nOpAlloc );
986 }
987 #endif
988 
989 /*
990 ** Verify that the VM passed as the only argument does not contain
991 ** an OP_ResultRow opcode. Fail an assert() if it does. This is used
992 ** by code in pragma.c to ensure that the implementation of certain
993 ** pragmas comports with the flags specified in the mkpragmatab.tcl
994 ** script.
995 */
996 #if defined(SQLITE_DEBUG) && !defined(SQLITE_TEST_REALLOC_STRESS)
997 void sqlite3VdbeVerifyNoResultRow(Vdbe *p){
998   int i;
999   for(i=0; i<p->nOp; i++){
1000     assert( p->aOp[i].opcode!=OP_ResultRow );
1001   }
1002 }
1003 #endif
1004 
1005 /*
1006 ** Generate code (a single OP_Abortable opcode) that will
1007 ** verify that the VDBE program can safely call Abort in the current
1008 ** context.
1009 */
1010 #if defined(SQLITE_DEBUG)
1011 void sqlite3VdbeVerifyAbortable(Vdbe *p, int onError){
1012   if( onError==OE_Abort ) sqlite3VdbeAddOp0(p, OP_Abortable);
1013 }
1014 #endif
1015 
1016 /*
1017 ** This function returns a pointer to the array of opcodes associated with
1018 ** the Vdbe passed as the first argument. It is the callers responsibility
1019 ** to arrange for the returned array to be eventually freed using the
1020 ** vdbeFreeOpArray() function.
1021 **
1022 ** Before returning, *pnOp is set to the number of entries in the returned
1023 ** array. Also, *pnMaxArg is set to the larger of its current value and
1024 ** the number of entries in the Vdbe.apArg[] array required to execute the
1025 ** returned program.
1026 */
1027 VdbeOp *sqlite3VdbeTakeOpArray(Vdbe *p, int *pnOp, int *pnMaxArg){
1028   VdbeOp *aOp = p->aOp;
1029   assert( aOp && !p->db->mallocFailed );
1030 
1031   /* Check that sqlite3VdbeUsesBtree() was not called on this VM */
1032   assert( DbMaskAllZero(p->btreeMask) );
1033 
1034   resolveP2Values(p, pnMaxArg);
1035   *pnOp = p->nOp;
1036   p->aOp = 0;
1037   return aOp;
1038 }
1039 
1040 /*
1041 ** Add a whole list of operations to the operation stack.  Return a
1042 ** pointer to the first operation inserted.
1043 **
1044 ** Non-zero P2 arguments to jump instructions are automatically adjusted
1045 ** so that the jump target is relative to the first operation inserted.
1046 */
1047 VdbeOp *sqlite3VdbeAddOpList(
1048   Vdbe *p,                     /* Add opcodes to the prepared statement */
1049   int nOp,                     /* Number of opcodes to add */
1050   VdbeOpList const *aOp,       /* The opcodes to be added */
1051   int iLineno                  /* Source-file line number of first opcode */
1052 ){
1053   int i;
1054   VdbeOp *pOut, *pFirst;
1055   assert( nOp>0 );
1056   assert( p->eVdbeState==VDBE_INIT_STATE );
1057   if( p->nOp + nOp > p->nOpAlloc && growOpArray(p, nOp) ){
1058     return 0;
1059   }
1060   pFirst = pOut = &p->aOp[p->nOp];
1061   for(i=0; i<nOp; i++, aOp++, pOut++){
1062     pOut->opcode = aOp->opcode;
1063     pOut->p1 = aOp->p1;
1064     pOut->p2 = aOp->p2;
1065     assert( aOp->p2>=0 );
1066     if( (sqlite3OpcodeProperty[aOp->opcode] & OPFLG_JUMP)!=0 && aOp->p2>0 ){
1067       pOut->p2 += p->nOp;
1068     }
1069     pOut->p3 = aOp->p3;
1070     pOut->p4type = P4_NOTUSED;
1071     pOut->p4.p = 0;
1072     pOut->p5 = 0;
1073 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1074     pOut->zComment = 0;
1075 #endif
1076 #ifdef SQLITE_VDBE_COVERAGE
1077     pOut->iSrcLine = iLineno+i;
1078 #else
1079     (void)iLineno;
1080 #endif
1081 #ifdef SQLITE_DEBUG
1082     if( p->db->flags & SQLITE_VdbeAddopTrace ){
1083       sqlite3VdbePrintOp(0, i+p->nOp, &p->aOp[i+p->nOp]);
1084     }
1085 #endif
1086   }
1087   p->nOp += nOp;
1088   return pFirst;
1089 }
1090 
1091 #if defined(SQLITE_ENABLE_STMT_SCANSTATUS)
1092 /*
1093 ** Add an entry to the array of counters managed by sqlite3_stmt_scanstatus().
1094 */
1095 void sqlite3VdbeScanStatus(
1096   Vdbe *p,                        /* VM to add scanstatus() to */
1097   int addrExplain,                /* Address of OP_Explain (or 0) */
1098   int addrLoop,                   /* Address of loop counter */
1099   int addrVisit,                  /* Address of rows visited counter */
1100   LogEst nEst,                    /* Estimated number of output rows */
1101   const char *zName               /* Name of table or index being scanned */
1102 ){
1103   sqlite3_int64 nByte = (p->nScan+1) * sizeof(ScanStatus);
1104   ScanStatus *aNew;
1105   aNew = (ScanStatus*)sqlite3DbRealloc(p->db, p->aScan, nByte);
1106   if( aNew ){
1107     ScanStatus *pNew = &aNew[p->nScan++];
1108     pNew->addrExplain = addrExplain;
1109     pNew->addrLoop = addrLoop;
1110     pNew->addrVisit = addrVisit;
1111     pNew->nEst = nEst;
1112     pNew->zName = sqlite3DbStrDup(p->db, zName);
1113     p->aScan = aNew;
1114   }
1115 }
1116 #endif
1117 
1118 
1119 /*
1120 ** Change the value of the opcode, or P1, P2, P3, or P5 operands
1121 ** for a specific instruction.
1122 */
1123 void sqlite3VdbeChangeOpcode(Vdbe *p, int addr, u8 iNewOpcode){
1124   sqlite3VdbeGetOp(p,addr)->opcode = iNewOpcode;
1125 }
1126 void sqlite3VdbeChangeP1(Vdbe *p, int addr, int val){
1127   sqlite3VdbeGetOp(p,addr)->p1 = val;
1128 }
1129 void sqlite3VdbeChangeP2(Vdbe *p, int addr, int val){
1130   sqlite3VdbeGetOp(p,addr)->p2 = val;
1131 }
1132 void sqlite3VdbeChangeP3(Vdbe *p, int addr, int val){
1133   sqlite3VdbeGetOp(p,addr)->p3 = val;
1134 }
1135 void sqlite3VdbeChangeP5(Vdbe *p, u16 p5){
1136   assert( p->nOp>0 || p->db->mallocFailed );
1137   if( p->nOp>0 ) p->aOp[p->nOp-1].p5 = p5;
1138 }
1139 
1140 /*
1141 ** Change the P2 operand of instruction addr so that it points to
1142 ** the address of the next instruction to be coded.
1143 */
1144 void sqlite3VdbeJumpHere(Vdbe *p, int addr){
1145   sqlite3VdbeChangeP2(p, addr, p->nOp);
1146 }
1147 
1148 /*
1149 ** Change the P2 operand of the jump instruction at addr so that
1150 ** the jump lands on the next opcode.  Or if the jump instruction was
1151 ** the previous opcode (and is thus a no-op) then simply back up
1152 ** the next instruction counter by one slot so that the jump is
1153 ** overwritten by the next inserted opcode.
1154 **
1155 ** This routine is an optimization of sqlite3VdbeJumpHere() that
1156 ** strives to omit useless byte-code like this:
1157 **
1158 **        7   Once 0 8 0
1159 **        8   ...
1160 */
1161 void sqlite3VdbeJumpHereOrPopInst(Vdbe *p, int addr){
1162   if( addr==p->nOp-1 ){
1163     assert( p->aOp[addr].opcode==OP_Once
1164          || p->aOp[addr].opcode==OP_If
1165          || p->aOp[addr].opcode==OP_FkIfZero );
1166     assert( p->aOp[addr].p4type==0 );
1167 #ifdef SQLITE_VDBE_COVERAGE
1168     sqlite3VdbeGetOp(p,-1)->iSrcLine = 0;  /* Erase VdbeCoverage() macros */
1169 #endif
1170     p->nOp--;
1171   }else{
1172     sqlite3VdbeChangeP2(p, addr, p->nOp);
1173   }
1174 }
1175 
1176 
1177 /*
1178 ** If the input FuncDef structure is ephemeral, then free it.  If
1179 ** the FuncDef is not ephermal, then do nothing.
1180 */
1181 static void freeEphemeralFunction(sqlite3 *db, FuncDef *pDef){
1182   if( (pDef->funcFlags & SQLITE_FUNC_EPHEM)!=0 ){
1183     sqlite3DbFreeNN(db, pDef);
1184   }
1185 }
1186 
1187 /*
1188 ** Delete a P4 value if necessary.
1189 */
1190 static SQLITE_NOINLINE void freeP4Mem(sqlite3 *db, Mem *p){
1191   if( p->szMalloc ) sqlite3DbFree(db, p->zMalloc);
1192   sqlite3DbFreeNN(db, p);
1193 }
1194 static SQLITE_NOINLINE void freeP4FuncCtx(sqlite3 *db, sqlite3_context *p){
1195   freeEphemeralFunction(db, p->pFunc);
1196   sqlite3DbFreeNN(db, p);
1197 }
1198 static void freeP4(sqlite3 *db, int p4type, void *p4){
1199   assert( db );
1200   switch( p4type ){
1201     case P4_FUNCCTX: {
1202       freeP4FuncCtx(db, (sqlite3_context*)p4);
1203       break;
1204     }
1205     case P4_REAL:
1206     case P4_INT64:
1207     case P4_DYNAMIC:
1208     case P4_INTARRAY: {
1209       sqlite3DbFree(db, p4);
1210       break;
1211     }
1212     case P4_KEYINFO: {
1213       if( db->pnBytesFreed==0 ) sqlite3KeyInfoUnref((KeyInfo*)p4);
1214       break;
1215     }
1216 #ifdef SQLITE_ENABLE_CURSOR_HINTS
1217     case P4_EXPR: {
1218       sqlite3ExprDelete(db, (Expr*)p4);
1219       break;
1220     }
1221 #endif
1222     case P4_FUNCDEF: {
1223       freeEphemeralFunction(db, (FuncDef*)p4);
1224       break;
1225     }
1226     case P4_MEM: {
1227       if( db->pnBytesFreed==0 ){
1228         sqlite3ValueFree((sqlite3_value*)p4);
1229       }else{
1230         freeP4Mem(db, (Mem*)p4);
1231       }
1232       break;
1233     }
1234     case P4_VTAB : {
1235       if( db->pnBytesFreed==0 ) sqlite3VtabUnlock((VTable *)p4);
1236       break;
1237     }
1238   }
1239 }
1240 
1241 /*
1242 ** Free the space allocated for aOp and any p4 values allocated for the
1243 ** opcodes contained within. If aOp is not NULL it is assumed to contain
1244 ** nOp entries.
1245 */
1246 static void vdbeFreeOpArray(sqlite3 *db, Op *aOp, int nOp){
1247   assert( nOp>=0 );
1248   if( aOp ){
1249     Op *pOp = &aOp[nOp-1];
1250     while(1){  /* Exit via break */
1251       if( pOp->p4type <= P4_FREE_IF_LE ) freeP4(db, pOp->p4type, pOp->p4.p);
1252 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1253       sqlite3DbFree(db, pOp->zComment);
1254 #endif
1255       if( pOp==aOp ) break;
1256       pOp--;
1257     }
1258     sqlite3DbFreeNN(db, aOp);
1259   }
1260 }
1261 
1262 /*
1263 ** Link the SubProgram object passed as the second argument into the linked
1264 ** list at Vdbe.pSubProgram. This list is used to delete all sub-program
1265 ** objects when the VM is no longer required.
1266 */
1267 void sqlite3VdbeLinkSubProgram(Vdbe *pVdbe, SubProgram *p){
1268   p->pNext = pVdbe->pProgram;
1269   pVdbe->pProgram = p;
1270 }
1271 
1272 /*
1273 ** Return true if the given Vdbe has any SubPrograms.
1274 */
1275 int sqlite3VdbeHasSubProgram(Vdbe *pVdbe){
1276   return pVdbe->pProgram!=0;
1277 }
1278 
1279 /*
1280 ** Change the opcode at addr into OP_Noop
1281 */
1282 int sqlite3VdbeChangeToNoop(Vdbe *p, int addr){
1283   VdbeOp *pOp;
1284   if( p->db->mallocFailed ) return 0;
1285   assert( addr>=0 && addr<p->nOp );
1286   pOp = &p->aOp[addr];
1287   freeP4(p->db, pOp->p4type, pOp->p4.p);
1288   pOp->p4type = P4_NOTUSED;
1289   pOp->p4.z = 0;
1290   pOp->opcode = OP_Noop;
1291   return 1;
1292 }
1293 
1294 /*
1295 ** If the last opcode is "op" and it is not a jump destination,
1296 ** then remove it.  Return true if and only if an opcode was removed.
1297 */
1298 int sqlite3VdbeDeletePriorOpcode(Vdbe *p, u8 op){
1299   if( p->nOp>0 && p->aOp[p->nOp-1].opcode==op ){
1300     return sqlite3VdbeChangeToNoop(p, p->nOp-1);
1301   }else{
1302     return 0;
1303   }
1304 }
1305 
1306 #ifdef SQLITE_DEBUG
1307 /*
1308 ** Generate an OP_ReleaseReg opcode to indicate that a range of
1309 ** registers, except any identified by mask, are no longer in use.
1310 */
1311 void sqlite3VdbeReleaseRegisters(
1312   Parse *pParse,       /* Parsing context */
1313   int iFirst,          /* Index of first register to be released */
1314   int N,               /* Number of registers to release */
1315   u32 mask,            /* Mask of registers to NOT release */
1316   int bUndefine        /* If true, mark registers as undefined */
1317 ){
1318   if( N==0 || OptimizationDisabled(pParse->db, SQLITE_ReleaseReg) ) return;
1319   assert( pParse->pVdbe );
1320   assert( iFirst>=1 );
1321   assert( iFirst+N-1<=pParse->nMem );
1322   if( N<=31 && mask!=0 ){
1323     while( N>0 && (mask&1)!=0 ){
1324       mask >>= 1;
1325       iFirst++;
1326       N--;
1327     }
1328     while( N>0 && N<=32 && (mask & MASKBIT32(N-1))!=0 ){
1329       mask &= ~MASKBIT32(N-1);
1330       N--;
1331     }
1332   }
1333   if( N>0 ){
1334     sqlite3VdbeAddOp3(pParse->pVdbe, OP_ReleaseReg, iFirst, N, *(int*)&mask);
1335     if( bUndefine ) sqlite3VdbeChangeP5(pParse->pVdbe, 1);
1336   }
1337 }
1338 #endif /* SQLITE_DEBUG */
1339 
1340 
1341 /*
1342 ** Change the value of the P4 operand for a specific instruction.
1343 ** This routine is useful when a large program is loaded from a
1344 ** static array using sqlite3VdbeAddOpList but we want to make a
1345 ** few minor changes to the program.
1346 **
1347 ** If n>=0 then the P4 operand is dynamic, meaning that a copy of
1348 ** the string is made into memory obtained from sqlite3_malloc().
1349 ** A value of n==0 means copy bytes of zP4 up to and including the
1350 ** first null byte.  If n>0 then copy n+1 bytes of zP4.
1351 **
1352 ** Other values of n (P4_STATIC, P4_COLLSEQ etc.) indicate that zP4 points
1353 ** to a string or structure that is guaranteed to exist for the lifetime of
1354 ** the Vdbe. In these cases we can just copy the pointer.
1355 **
1356 ** If addr<0 then change P4 on the most recently inserted instruction.
1357 */
1358 static void SQLITE_NOINLINE vdbeChangeP4Full(
1359   Vdbe *p,
1360   Op *pOp,
1361   const char *zP4,
1362   int n
1363 ){
1364   if( pOp->p4type ){
1365     freeP4(p->db, pOp->p4type, pOp->p4.p);
1366     pOp->p4type = 0;
1367     pOp->p4.p = 0;
1368   }
1369   if( n<0 ){
1370     sqlite3VdbeChangeP4(p, (int)(pOp - p->aOp), zP4, n);
1371   }else{
1372     if( n==0 ) n = sqlite3Strlen30(zP4);
1373     pOp->p4.z = sqlite3DbStrNDup(p->db, zP4, n);
1374     pOp->p4type = P4_DYNAMIC;
1375   }
1376 }
1377 void sqlite3VdbeChangeP4(Vdbe *p, int addr, const char *zP4, int n){
1378   Op *pOp;
1379   sqlite3 *db;
1380   assert( p!=0 );
1381   db = p->db;
1382   assert( p->eVdbeState==VDBE_INIT_STATE );
1383   assert( p->aOp!=0 || db->mallocFailed );
1384   if( db->mallocFailed ){
1385     if( n!=P4_VTAB ) freeP4(db, n, (void*)*(char**)&zP4);
1386     return;
1387   }
1388   assert( p->nOp>0 );
1389   assert( addr<p->nOp );
1390   if( addr<0 ){
1391     addr = p->nOp - 1;
1392   }
1393   pOp = &p->aOp[addr];
1394   if( n>=0 || pOp->p4type ){
1395     vdbeChangeP4Full(p, pOp, zP4, n);
1396     return;
1397   }
1398   if( n==P4_INT32 ){
1399     /* Note: this cast is safe, because the origin data point was an int
1400     ** that was cast to a (const char *). */
1401     pOp->p4.i = SQLITE_PTR_TO_INT(zP4);
1402     pOp->p4type = P4_INT32;
1403   }else if( zP4!=0 ){
1404     assert( n<0 );
1405     pOp->p4.p = (void*)zP4;
1406     pOp->p4type = (signed char)n;
1407     if( n==P4_VTAB ) sqlite3VtabLock((VTable*)zP4);
1408   }
1409 }
1410 
1411 /*
1412 ** Change the P4 operand of the most recently coded instruction
1413 ** to the value defined by the arguments.  This is a high-speed
1414 ** version of sqlite3VdbeChangeP4().
1415 **
1416 ** The P4 operand must not have been previously defined.  And the new
1417 ** P4 must not be P4_INT32.  Use sqlite3VdbeChangeP4() in either of
1418 ** those cases.
1419 */
1420 void sqlite3VdbeAppendP4(Vdbe *p, void *pP4, int n){
1421   VdbeOp *pOp;
1422   assert( n!=P4_INT32 && n!=P4_VTAB );
1423   assert( n<=0 );
1424   if( p->db->mallocFailed ){
1425     freeP4(p->db, n, pP4);
1426   }else{
1427     assert( pP4!=0 );
1428     assert( p->nOp>0 );
1429     pOp = &p->aOp[p->nOp-1];
1430     assert( pOp->p4type==P4_NOTUSED );
1431     pOp->p4type = n;
1432     pOp->p4.p = pP4;
1433   }
1434 }
1435 
1436 /*
1437 ** Set the P4 on the most recently added opcode to the KeyInfo for the
1438 ** index given.
1439 */
1440 void sqlite3VdbeSetP4KeyInfo(Parse *pParse, Index *pIdx){
1441   Vdbe *v = pParse->pVdbe;
1442   KeyInfo *pKeyInfo;
1443   assert( v!=0 );
1444   assert( pIdx!=0 );
1445   pKeyInfo = sqlite3KeyInfoOfIndex(pParse, pIdx);
1446   if( pKeyInfo ) sqlite3VdbeAppendP4(v, pKeyInfo, P4_KEYINFO);
1447 }
1448 
1449 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1450 /*
1451 ** Change the comment on the most recently coded instruction.  Or
1452 ** insert a No-op and add the comment to that new instruction.  This
1453 ** makes the code easier to read during debugging.  None of this happens
1454 ** in a production build.
1455 */
1456 static void vdbeVComment(Vdbe *p, const char *zFormat, va_list ap){
1457   assert( p->nOp>0 || p->aOp==0 );
1458   assert( p->aOp==0 || p->aOp[p->nOp-1].zComment==0 || p->pParse->nErr>0 );
1459   if( p->nOp ){
1460     assert( p->aOp );
1461     sqlite3DbFree(p->db, p->aOp[p->nOp-1].zComment);
1462     p->aOp[p->nOp-1].zComment = sqlite3VMPrintf(p->db, zFormat, ap);
1463   }
1464 }
1465 void sqlite3VdbeComment(Vdbe *p, const char *zFormat, ...){
1466   va_list ap;
1467   if( p ){
1468     va_start(ap, zFormat);
1469     vdbeVComment(p, zFormat, ap);
1470     va_end(ap);
1471   }
1472 }
1473 void sqlite3VdbeNoopComment(Vdbe *p, const char *zFormat, ...){
1474   va_list ap;
1475   if( p ){
1476     sqlite3VdbeAddOp0(p, OP_Noop);
1477     va_start(ap, zFormat);
1478     vdbeVComment(p, zFormat, ap);
1479     va_end(ap);
1480   }
1481 }
1482 #endif  /* NDEBUG */
1483 
1484 #ifdef SQLITE_VDBE_COVERAGE
1485 /*
1486 ** Set the value if the iSrcLine field for the previously coded instruction.
1487 */
1488 void sqlite3VdbeSetLineNumber(Vdbe *v, int iLine){
1489   sqlite3VdbeGetOp(v,-1)->iSrcLine = iLine;
1490 }
1491 #endif /* SQLITE_VDBE_COVERAGE */
1492 
1493 /*
1494 ** Return the opcode for a given address.  If the address is -1, then
1495 ** return the most recently inserted opcode.
1496 **
1497 ** If a memory allocation error has occurred prior to the calling of this
1498 ** routine, then a pointer to a dummy VdbeOp will be returned.  That opcode
1499 ** is readable but not writable, though it is cast to a writable value.
1500 ** The return of a dummy opcode allows the call to continue functioning
1501 ** after an OOM fault without having to check to see if the return from
1502 ** this routine is a valid pointer.  But because the dummy.opcode is 0,
1503 ** dummy will never be written to.  This is verified by code inspection and
1504 ** by running with Valgrind.
1505 */
1506 VdbeOp *sqlite3VdbeGetOp(Vdbe *p, int addr){
1507   /* C89 specifies that the constant "dummy" will be initialized to all
1508   ** zeros, which is correct.  MSVC generates a warning, nevertheless. */
1509   static VdbeOp dummy;  /* Ignore the MSVC warning about no initializer */
1510   assert( p->eVdbeState==VDBE_INIT_STATE );
1511   if( addr<0 ){
1512     addr = p->nOp - 1;
1513   }
1514   assert( (addr>=0 && addr<p->nOp) || p->db->mallocFailed );
1515   if( p->db->mallocFailed ){
1516     return (VdbeOp*)&dummy;
1517   }else{
1518     return &p->aOp[addr];
1519   }
1520 }
1521 
1522 #if defined(SQLITE_ENABLE_EXPLAIN_COMMENTS)
1523 /*
1524 ** Return an integer value for one of the parameters to the opcode pOp
1525 ** determined by character c.
1526 */
1527 static int translateP(char c, const Op *pOp){
1528   if( c=='1' ) return pOp->p1;
1529   if( c=='2' ) return pOp->p2;
1530   if( c=='3' ) return pOp->p3;
1531   if( c=='4' ) return pOp->p4.i;
1532   return pOp->p5;
1533 }
1534 
1535 /*
1536 ** Compute a string for the "comment" field of a VDBE opcode listing.
1537 **
1538 ** The Synopsis: field in comments in the vdbe.c source file gets converted
1539 ** to an extra string that is appended to the sqlite3OpcodeName().  In the
1540 ** absence of other comments, this synopsis becomes the comment on the opcode.
1541 ** Some translation occurs:
1542 **
1543 **       "PX"      ->  "r[X]"
1544 **       "PX@PY"   ->  "r[X..X+Y-1]"  or "r[x]" if y is 0 or 1
1545 **       "PX@PY+1" ->  "r[X..X+Y]"    or "r[x]" if y is 0
1546 **       "PY..PY"  ->  "r[X..Y]"      or "r[x]" if y<=x
1547 */
1548 char *sqlite3VdbeDisplayComment(
1549   sqlite3 *db,       /* Optional - Oom error reporting only */
1550   const Op *pOp,     /* The opcode to be commented */
1551   const char *zP4    /* Previously obtained value for P4 */
1552 ){
1553   const char *zOpName;
1554   const char *zSynopsis;
1555   int nOpName;
1556   int ii;
1557   char zAlt[50];
1558   StrAccum x;
1559 
1560   sqlite3StrAccumInit(&x, 0, 0, 0, SQLITE_MAX_LENGTH);
1561   zOpName = sqlite3OpcodeName(pOp->opcode);
1562   nOpName = sqlite3Strlen30(zOpName);
1563   if( zOpName[nOpName+1] ){
1564     int seenCom = 0;
1565     char c;
1566     zSynopsis = zOpName + nOpName + 1;
1567     if( strncmp(zSynopsis,"IF ",3)==0 ){
1568       sqlite3_snprintf(sizeof(zAlt), zAlt, "if %s goto P2", zSynopsis+3);
1569       zSynopsis = zAlt;
1570     }
1571     for(ii=0; (c = zSynopsis[ii])!=0; ii++){
1572       if( c=='P' ){
1573         c = zSynopsis[++ii];
1574         if( c=='4' ){
1575           sqlite3_str_appendall(&x, zP4);
1576         }else if( c=='X' ){
1577           if( pOp->zComment && pOp->zComment[0] ){
1578             sqlite3_str_appendall(&x, pOp->zComment);
1579             seenCom = 1;
1580             break;
1581           }
1582         }else{
1583           int v1 = translateP(c, pOp);
1584           int v2;
1585           if( strncmp(zSynopsis+ii+1, "@P", 2)==0 ){
1586             ii += 3;
1587             v2 = translateP(zSynopsis[ii], pOp);
1588             if( strncmp(zSynopsis+ii+1,"+1",2)==0 ){
1589               ii += 2;
1590               v2++;
1591             }
1592             if( v2<2 ){
1593               sqlite3_str_appendf(&x, "%d", v1);
1594             }else{
1595               sqlite3_str_appendf(&x, "%d..%d", v1, v1+v2-1);
1596             }
1597           }else if( strncmp(zSynopsis+ii+1, "@NP", 3)==0 ){
1598             sqlite3_context *pCtx = pOp->p4.pCtx;
1599             if( pOp->p4type!=P4_FUNCCTX || pCtx->argc==1 ){
1600               sqlite3_str_appendf(&x, "%d", v1);
1601             }else if( pCtx->argc>1 ){
1602               sqlite3_str_appendf(&x, "%d..%d", v1, v1+pCtx->argc-1);
1603             }else if( x.accError==0 ){
1604               assert( x.nChar>2 );
1605               x.nChar -= 2;
1606               ii++;
1607             }
1608             ii += 3;
1609           }else{
1610             sqlite3_str_appendf(&x, "%d", v1);
1611             if( strncmp(zSynopsis+ii+1, "..P3", 4)==0 && pOp->p3==0 ){
1612               ii += 4;
1613             }
1614           }
1615         }
1616       }else{
1617         sqlite3_str_appendchar(&x, 1, c);
1618       }
1619     }
1620     if( !seenCom && pOp->zComment ){
1621       sqlite3_str_appendf(&x, "; %s", pOp->zComment);
1622     }
1623   }else if( pOp->zComment ){
1624     sqlite3_str_appendall(&x, pOp->zComment);
1625   }
1626   if( (x.accError & SQLITE_NOMEM)!=0 && db!=0 ){
1627     sqlite3OomFault(db);
1628   }
1629   return sqlite3StrAccumFinish(&x);
1630 }
1631 #endif /* SQLITE_ENABLE_EXPLAIN_COMMENTS */
1632 
1633 #if VDBE_DISPLAY_P4 && defined(SQLITE_ENABLE_CURSOR_HINTS)
1634 /*
1635 ** Translate the P4.pExpr value for an OP_CursorHint opcode into text
1636 ** that can be displayed in the P4 column of EXPLAIN output.
1637 */
1638 static void displayP4Expr(StrAccum *p, Expr *pExpr){
1639   const char *zOp = 0;
1640   switch( pExpr->op ){
1641     case TK_STRING:
1642       assert( !ExprHasProperty(pExpr, EP_IntValue) );
1643       sqlite3_str_appendf(p, "%Q", pExpr->u.zToken);
1644       break;
1645     case TK_INTEGER:
1646       sqlite3_str_appendf(p, "%d", pExpr->u.iValue);
1647       break;
1648     case TK_NULL:
1649       sqlite3_str_appendf(p, "NULL");
1650       break;
1651     case TK_REGISTER: {
1652       sqlite3_str_appendf(p, "r[%d]", pExpr->iTable);
1653       break;
1654     }
1655     case TK_COLUMN: {
1656       if( pExpr->iColumn<0 ){
1657         sqlite3_str_appendf(p, "rowid");
1658       }else{
1659         sqlite3_str_appendf(p, "c%d", (int)pExpr->iColumn);
1660       }
1661       break;
1662     }
1663     case TK_LT:      zOp = "LT";      break;
1664     case TK_LE:      zOp = "LE";      break;
1665     case TK_GT:      zOp = "GT";      break;
1666     case TK_GE:      zOp = "GE";      break;
1667     case TK_NE:      zOp = "NE";      break;
1668     case TK_EQ:      zOp = "EQ";      break;
1669     case TK_IS:      zOp = "IS";      break;
1670     case TK_ISNOT:   zOp = "ISNOT";   break;
1671     case TK_AND:     zOp = "AND";     break;
1672     case TK_OR:      zOp = "OR";      break;
1673     case TK_PLUS:    zOp = "ADD";     break;
1674     case TK_STAR:    zOp = "MUL";     break;
1675     case TK_MINUS:   zOp = "SUB";     break;
1676     case TK_REM:     zOp = "REM";     break;
1677     case TK_BITAND:  zOp = "BITAND";  break;
1678     case TK_BITOR:   zOp = "BITOR";   break;
1679     case TK_SLASH:   zOp = "DIV";     break;
1680     case TK_LSHIFT:  zOp = "LSHIFT";  break;
1681     case TK_RSHIFT:  zOp = "RSHIFT";  break;
1682     case TK_CONCAT:  zOp = "CONCAT";  break;
1683     case TK_UMINUS:  zOp = "MINUS";   break;
1684     case TK_UPLUS:   zOp = "PLUS";    break;
1685     case TK_BITNOT:  zOp = "BITNOT";  break;
1686     case TK_NOT:     zOp = "NOT";     break;
1687     case TK_ISNULL:  zOp = "ISNULL";  break;
1688     case TK_NOTNULL: zOp = "NOTNULL"; break;
1689 
1690     default:
1691       sqlite3_str_appendf(p, "%s", "expr");
1692       break;
1693   }
1694 
1695   if( zOp ){
1696     sqlite3_str_appendf(p, "%s(", zOp);
1697     displayP4Expr(p, pExpr->pLeft);
1698     if( pExpr->pRight ){
1699       sqlite3_str_append(p, ",", 1);
1700       displayP4Expr(p, pExpr->pRight);
1701     }
1702     sqlite3_str_append(p, ")", 1);
1703   }
1704 }
1705 #endif /* VDBE_DISPLAY_P4 && defined(SQLITE_ENABLE_CURSOR_HINTS) */
1706 
1707 
1708 #if VDBE_DISPLAY_P4
1709 /*
1710 ** Compute a string that describes the P4 parameter for an opcode.
1711 ** Use zTemp for any required temporary buffer space.
1712 */
1713 char *sqlite3VdbeDisplayP4(sqlite3 *db, Op *pOp){
1714   char *zP4 = 0;
1715   StrAccum x;
1716 
1717   sqlite3StrAccumInit(&x, 0, 0, 0, SQLITE_MAX_LENGTH);
1718   switch( pOp->p4type ){
1719     case P4_KEYINFO: {
1720       int j;
1721       KeyInfo *pKeyInfo = pOp->p4.pKeyInfo;
1722       assert( pKeyInfo->aSortFlags!=0 );
1723       sqlite3_str_appendf(&x, "k(%d", pKeyInfo->nKeyField);
1724       for(j=0; j<pKeyInfo->nKeyField; j++){
1725         CollSeq *pColl = pKeyInfo->aColl[j];
1726         const char *zColl = pColl ? pColl->zName : "";
1727         if( strcmp(zColl, "BINARY")==0 ) zColl = "B";
1728         sqlite3_str_appendf(&x, ",%s%s%s",
1729                (pKeyInfo->aSortFlags[j] & KEYINFO_ORDER_DESC) ? "-" : "",
1730                (pKeyInfo->aSortFlags[j] & KEYINFO_ORDER_BIGNULL)? "N." : "",
1731                zColl);
1732       }
1733       sqlite3_str_append(&x, ")", 1);
1734       break;
1735     }
1736 #ifdef SQLITE_ENABLE_CURSOR_HINTS
1737     case P4_EXPR: {
1738       displayP4Expr(&x, pOp->p4.pExpr);
1739       break;
1740     }
1741 #endif
1742     case P4_COLLSEQ: {
1743       static const char *const encnames[] = {"?", "8", "16LE", "16BE"};
1744       CollSeq *pColl = pOp->p4.pColl;
1745       assert( pColl->enc<4 );
1746       sqlite3_str_appendf(&x, "%.18s-%s", pColl->zName,
1747                           encnames[pColl->enc]);
1748       break;
1749     }
1750     case P4_FUNCDEF: {
1751       FuncDef *pDef = pOp->p4.pFunc;
1752       sqlite3_str_appendf(&x, "%s(%d)", pDef->zName, pDef->nArg);
1753       break;
1754     }
1755     case P4_FUNCCTX: {
1756       FuncDef *pDef = pOp->p4.pCtx->pFunc;
1757       sqlite3_str_appendf(&x, "%s(%d)", pDef->zName, pDef->nArg);
1758       break;
1759     }
1760     case P4_INT64: {
1761       sqlite3_str_appendf(&x, "%lld", *pOp->p4.pI64);
1762       break;
1763     }
1764     case P4_INT32: {
1765       sqlite3_str_appendf(&x, "%d", pOp->p4.i);
1766       break;
1767     }
1768     case P4_REAL: {
1769       sqlite3_str_appendf(&x, "%.16g", *pOp->p4.pReal);
1770       break;
1771     }
1772     case P4_MEM: {
1773       Mem *pMem = pOp->p4.pMem;
1774       if( pMem->flags & MEM_Str ){
1775         zP4 = pMem->z;
1776       }else if( pMem->flags & (MEM_Int|MEM_IntReal) ){
1777         sqlite3_str_appendf(&x, "%lld", pMem->u.i);
1778       }else if( pMem->flags & MEM_Real ){
1779         sqlite3_str_appendf(&x, "%.16g", pMem->u.r);
1780       }else if( pMem->flags & MEM_Null ){
1781         zP4 = "NULL";
1782       }else{
1783         assert( pMem->flags & MEM_Blob );
1784         zP4 = "(blob)";
1785       }
1786       break;
1787     }
1788 #ifndef SQLITE_OMIT_VIRTUALTABLE
1789     case P4_VTAB: {
1790       sqlite3_vtab *pVtab = pOp->p4.pVtab->pVtab;
1791       sqlite3_str_appendf(&x, "vtab:%p", pVtab);
1792       break;
1793     }
1794 #endif
1795     case P4_INTARRAY: {
1796       u32 i;
1797       u32 *ai = pOp->p4.ai;
1798       u32 n = ai[0];   /* The first element of an INTARRAY is always the
1799                        ** count of the number of elements to follow */
1800       for(i=1; i<=n; i++){
1801         sqlite3_str_appendf(&x, "%c%u", (i==1 ? '[' : ','), ai[i]);
1802       }
1803       sqlite3_str_append(&x, "]", 1);
1804       break;
1805     }
1806     case P4_SUBPROGRAM: {
1807       zP4 = "program";
1808       break;
1809     }
1810     case P4_TABLE: {
1811       zP4 = pOp->p4.pTab->zName;
1812       break;
1813     }
1814     default: {
1815       zP4 = pOp->p4.z;
1816     }
1817   }
1818   if( zP4 ) sqlite3_str_appendall(&x, zP4);
1819   if( (x.accError & SQLITE_NOMEM)!=0 ){
1820     sqlite3OomFault(db);
1821   }
1822   return sqlite3StrAccumFinish(&x);
1823 }
1824 #endif /* VDBE_DISPLAY_P4 */
1825 
1826 /*
1827 ** Declare to the Vdbe that the BTree object at db->aDb[i] is used.
1828 **
1829 ** The prepared statements need to know in advance the complete set of
1830 ** attached databases that will be use.  A mask of these databases
1831 ** is maintained in p->btreeMask.  The p->lockMask value is the subset of
1832 ** p->btreeMask of databases that will require a lock.
1833 */
1834 void sqlite3VdbeUsesBtree(Vdbe *p, int i){
1835   assert( i>=0 && i<p->db->nDb && i<(int)sizeof(yDbMask)*8 );
1836   assert( i<(int)sizeof(p->btreeMask)*8 );
1837   DbMaskSet(p->btreeMask, i);
1838   if( i!=1 && sqlite3BtreeSharable(p->db->aDb[i].pBt) ){
1839     DbMaskSet(p->lockMask, i);
1840   }
1841 }
1842 
1843 #if !defined(SQLITE_OMIT_SHARED_CACHE)
1844 /*
1845 ** If SQLite is compiled to support shared-cache mode and to be threadsafe,
1846 ** this routine obtains the mutex associated with each BtShared structure
1847 ** that may be accessed by the VM passed as an argument. In doing so it also
1848 ** sets the BtShared.db member of each of the BtShared structures, ensuring
1849 ** that the correct busy-handler callback is invoked if required.
1850 **
1851 ** If SQLite is not threadsafe but does support shared-cache mode, then
1852 ** sqlite3BtreeEnter() is invoked to set the BtShared.db variables
1853 ** of all of BtShared structures accessible via the database handle
1854 ** associated with the VM.
1855 **
1856 ** If SQLite is not threadsafe and does not support shared-cache mode, this
1857 ** function is a no-op.
1858 **
1859 ** The p->btreeMask field is a bitmask of all btrees that the prepared
1860 ** statement p will ever use.  Let N be the number of bits in p->btreeMask
1861 ** corresponding to btrees that use shared cache.  Then the runtime of
1862 ** this routine is N*N.  But as N is rarely more than 1, this should not
1863 ** be a problem.
1864 */
1865 void sqlite3VdbeEnter(Vdbe *p){
1866   int i;
1867   sqlite3 *db;
1868   Db *aDb;
1869   int nDb;
1870   if( DbMaskAllZero(p->lockMask) ) return;  /* The common case */
1871   db = p->db;
1872   aDb = db->aDb;
1873   nDb = db->nDb;
1874   for(i=0; i<nDb; i++){
1875     if( i!=1 && DbMaskTest(p->lockMask,i) && ALWAYS(aDb[i].pBt!=0) ){
1876       sqlite3BtreeEnter(aDb[i].pBt);
1877     }
1878   }
1879 }
1880 #endif
1881 
1882 #if !defined(SQLITE_OMIT_SHARED_CACHE) && SQLITE_THREADSAFE>0
1883 /*
1884 ** Unlock all of the btrees previously locked by a call to sqlite3VdbeEnter().
1885 */
1886 static SQLITE_NOINLINE void vdbeLeave(Vdbe *p){
1887   int i;
1888   sqlite3 *db;
1889   Db *aDb;
1890   int nDb;
1891   db = p->db;
1892   aDb = db->aDb;
1893   nDb = db->nDb;
1894   for(i=0; i<nDb; i++){
1895     if( i!=1 && DbMaskTest(p->lockMask,i) && ALWAYS(aDb[i].pBt!=0) ){
1896       sqlite3BtreeLeave(aDb[i].pBt);
1897     }
1898   }
1899 }
1900 void sqlite3VdbeLeave(Vdbe *p){
1901   if( DbMaskAllZero(p->lockMask) ) return;  /* The common case */
1902   vdbeLeave(p);
1903 }
1904 #endif
1905 
1906 #if defined(VDBE_PROFILE) || defined(SQLITE_DEBUG)
1907 /*
1908 ** Print a single opcode.  This routine is used for debugging only.
1909 */
1910 void sqlite3VdbePrintOp(FILE *pOut, int pc, VdbeOp *pOp){
1911   char *zP4;
1912   char *zCom;
1913   sqlite3 dummyDb;
1914   static const char *zFormat1 = "%4d %-13s %4d %4d %4d %-13s %.2X %s\n";
1915   if( pOut==0 ) pOut = stdout;
1916   sqlite3BeginBenignMalloc();
1917   dummyDb.mallocFailed = 1;
1918   zP4 = sqlite3VdbeDisplayP4(&dummyDb, pOp);
1919 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1920   zCom = sqlite3VdbeDisplayComment(0, pOp, zP4);
1921 #else
1922   zCom = 0;
1923 #endif
1924   /* NB:  The sqlite3OpcodeName() function is implemented by code created
1925   ** by the mkopcodeh.awk and mkopcodec.awk scripts which extract the
1926   ** information from the vdbe.c source text */
1927   fprintf(pOut, zFormat1, pc,
1928       sqlite3OpcodeName(pOp->opcode), pOp->p1, pOp->p2, pOp->p3,
1929       zP4 ? zP4 : "", pOp->p5,
1930       zCom ? zCom : ""
1931   );
1932   fflush(pOut);
1933   sqlite3_free(zP4);
1934   sqlite3_free(zCom);
1935   sqlite3EndBenignMalloc();
1936 }
1937 #endif
1938 
1939 /*
1940 ** Initialize an array of N Mem element.
1941 **
1942 ** This is a high-runner, so only those fields that really do need to
1943 ** be initialized are set.  The Mem structure is organized so that
1944 ** the fields that get initialized are nearby and hopefully on the same
1945 ** cache line.
1946 **
1947 **    Mem.flags = flags
1948 **    Mem.db = db
1949 **    Mem.szMalloc = 0
1950 **
1951 ** All other fields of Mem can safely remain uninitialized for now.  They
1952 ** will be initialized before use.
1953 */
1954 static void initMemArray(Mem *p, int N, sqlite3 *db, u16 flags){
1955   if( N>0 ){
1956     do{
1957       p->flags = flags;
1958       p->db = db;
1959       p->szMalloc = 0;
1960 #ifdef SQLITE_DEBUG
1961       p->pScopyFrom = 0;
1962 #endif
1963       p++;
1964     }while( (--N)>0 );
1965   }
1966 }
1967 
1968 /*
1969 ** Release auxiliary memory held in an array of N Mem elements.
1970 **
1971 ** After this routine returns, all Mem elements in the array will still
1972 ** be valid.  Those Mem elements that were not holding auxiliary resources
1973 ** will be unchanged.  Mem elements which had something freed will be
1974 ** set to MEM_Undefined.
1975 */
1976 static void releaseMemArray(Mem *p, int N){
1977   if( p && N ){
1978     Mem *pEnd = &p[N];
1979     sqlite3 *db = p->db;
1980     if( db->pnBytesFreed ){
1981       do{
1982         if( p->szMalloc ) sqlite3DbFree(db, p->zMalloc);
1983       }while( (++p)<pEnd );
1984       return;
1985     }
1986     do{
1987       assert( (&p[1])==pEnd || p[0].db==p[1].db );
1988       assert( sqlite3VdbeCheckMemInvariants(p) );
1989 
1990       /* This block is really an inlined version of sqlite3VdbeMemRelease()
1991       ** that takes advantage of the fact that the memory cell value is
1992       ** being set to NULL after releasing any dynamic resources.
1993       **
1994       ** The justification for duplicating code is that according to
1995       ** callgrind, this causes a certain test case to hit the CPU 4.7
1996       ** percent less (x86 linux, gcc version 4.1.2, -O6) than if
1997       ** sqlite3MemRelease() were called from here. With -O2, this jumps
1998       ** to 6.6 percent. The test case is inserting 1000 rows into a table
1999       ** with no indexes using a single prepared INSERT statement, bind()
2000       ** and reset(). Inserts are grouped into a transaction.
2001       */
2002       testcase( p->flags & MEM_Agg );
2003       testcase( p->flags & MEM_Dyn );
2004       if( p->flags&(MEM_Agg|MEM_Dyn) ){
2005         testcase( (p->flags & MEM_Dyn)!=0 && p->xDel==sqlite3VdbeFrameMemDel );
2006         sqlite3VdbeMemRelease(p);
2007         p->flags = MEM_Undefined;
2008       }else if( p->szMalloc ){
2009         sqlite3DbFreeNN(db, p->zMalloc);
2010         p->szMalloc = 0;
2011         p->flags = MEM_Undefined;
2012       }
2013 #ifdef SQLITE_DEBUG
2014       else{
2015         p->flags = MEM_Undefined;
2016       }
2017 #endif
2018     }while( (++p)<pEnd );
2019   }
2020 }
2021 
2022 #ifdef SQLITE_DEBUG
2023 /*
2024 ** Verify that pFrame is a valid VdbeFrame pointer.  Return true if it is
2025 ** and false if something is wrong.
2026 **
2027 ** This routine is intended for use inside of assert() statements only.
2028 */
2029 int sqlite3VdbeFrameIsValid(VdbeFrame *pFrame){
2030   if( pFrame->iFrameMagic!=SQLITE_FRAME_MAGIC ) return 0;
2031   return 1;
2032 }
2033 #endif
2034 
2035 
2036 /*
2037 ** This is a destructor on a Mem object (which is really an sqlite3_value)
2038 ** that deletes the Frame object that is attached to it as a blob.
2039 **
2040 ** This routine does not delete the Frame right away.  It merely adds the
2041 ** frame to a list of frames to be deleted when the Vdbe halts.
2042 */
2043 void sqlite3VdbeFrameMemDel(void *pArg){
2044   VdbeFrame *pFrame = (VdbeFrame*)pArg;
2045   assert( sqlite3VdbeFrameIsValid(pFrame) );
2046   pFrame->pParent = pFrame->v->pDelFrame;
2047   pFrame->v->pDelFrame = pFrame;
2048 }
2049 
2050 #if defined(SQLITE_ENABLE_BYTECODE_VTAB) || !defined(SQLITE_OMIT_EXPLAIN)
2051 /*
2052 ** Locate the next opcode to be displayed in EXPLAIN or EXPLAIN
2053 ** QUERY PLAN output.
2054 **
2055 ** Return SQLITE_ROW on success.  Return SQLITE_DONE if there are no
2056 ** more opcodes to be displayed.
2057 */
2058 int sqlite3VdbeNextOpcode(
2059   Vdbe *p,         /* The statement being explained */
2060   Mem *pSub,       /* Storage for keeping track of subprogram nesting */
2061   int eMode,       /* 0: normal.  1: EQP.  2:  TablesUsed */
2062   int *piPc,       /* IN/OUT: Current rowid.  Overwritten with next rowid */
2063   int *piAddr,     /* OUT: Write index into (*paOp)[] here */
2064   Op **paOp        /* OUT: Write the opcode array here */
2065 ){
2066   int nRow;                            /* Stop when row count reaches this */
2067   int nSub = 0;                        /* Number of sub-vdbes seen so far */
2068   SubProgram **apSub = 0;              /* Array of sub-vdbes */
2069   int i;                               /* Next instruction address */
2070   int rc = SQLITE_OK;                  /* Result code */
2071   Op *aOp = 0;                         /* Opcode array */
2072   int iPc;                             /* Rowid.  Copy of value in *piPc */
2073 
2074   /* When the number of output rows reaches nRow, that means the
2075   ** listing has finished and sqlite3_step() should return SQLITE_DONE.
2076   ** nRow is the sum of the number of rows in the main program, plus
2077   ** the sum of the number of rows in all trigger subprograms encountered
2078   ** so far.  The nRow value will increase as new trigger subprograms are
2079   ** encountered, but p->pc will eventually catch up to nRow.
2080   */
2081   nRow = p->nOp;
2082   if( pSub!=0 ){
2083     if( pSub->flags&MEM_Blob ){
2084       /* pSub is initiallly NULL.  It is initialized to a BLOB by
2085       ** the P4_SUBPROGRAM processing logic below */
2086       nSub = pSub->n/sizeof(Vdbe*);
2087       apSub = (SubProgram **)pSub->z;
2088     }
2089     for(i=0; i<nSub; i++){
2090       nRow += apSub[i]->nOp;
2091     }
2092   }
2093   iPc = *piPc;
2094   while(1){  /* Loop exits via break */
2095     i = iPc++;
2096     if( i>=nRow ){
2097       p->rc = SQLITE_OK;
2098       rc = SQLITE_DONE;
2099       break;
2100     }
2101     if( i<p->nOp ){
2102       /* The rowid is small enough that we are still in the
2103       ** main program. */
2104       aOp = p->aOp;
2105     }else{
2106       /* We are currently listing subprograms.  Figure out which one and
2107       ** pick up the appropriate opcode. */
2108       int j;
2109       i -= p->nOp;
2110       assert( apSub!=0 );
2111       assert( nSub>0 );
2112       for(j=0; i>=apSub[j]->nOp; j++){
2113         i -= apSub[j]->nOp;
2114         assert( i<apSub[j]->nOp || j+1<nSub );
2115       }
2116       aOp = apSub[j]->aOp;
2117     }
2118 
2119     /* When an OP_Program opcode is encounter (the only opcode that has
2120     ** a P4_SUBPROGRAM argument), expand the size of the array of subprograms
2121     ** kept in p->aMem[9].z to hold the new program - assuming this subprogram
2122     ** has not already been seen.
2123     */
2124     if( pSub!=0 && aOp[i].p4type==P4_SUBPROGRAM ){
2125       int nByte = (nSub+1)*sizeof(SubProgram*);
2126       int j;
2127       for(j=0; j<nSub; j++){
2128         if( apSub[j]==aOp[i].p4.pProgram ) break;
2129       }
2130       if( j==nSub ){
2131         p->rc = sqlite3VdbeMemGrow(pSub, nByte, nSub!=0);
2132         if( p->rc!=SQLITE_OK ){
2133           rc = SQLITE_ERROR;
2134           break;
2135         }
2136         apSub = (SubProgram **)pSub->z;
2137         apSub[nSub++] = aOp[i].p4.pProgram;
2138         MemSetTypeFlag(pSub, MEM_Blob);
2139         pSub->n = nSub*sizeof(SubProgram*);
2140         nRow += aOp[i].p4.pProgram->nOp;
2141       }
2142     }
2143     if( eMode==0 ) break;
2144 #ifdef SQLITE_ENABLE_BYTECODE_VTAB
2145     if( eMode==2 ){
2146       Op *pOp = aOp + i;
2147       if( pOp->opcode==OP_OpenRead ) break;
2148       if( pOp->opcode==OP_OpenWrite && (pOp->p5 & OPFLAG_P2ISREG)==0 ) break;
2149       if( pOp->opcode==OP_ReopenIdx ) break;
2150     }else
2151 #endif
2152     {
2153       assert( eMode==1 );
2154       if( aOp[i].opcode==OP_Explain ) break;
2155       if( aOp[i].opcode==OP_Init && iPc>1 ) break;
2156     }
2157   }
2158   *piPc = iPc;
2159   *piAddr = i;
2160   *paOp = aOp;
2161   return rc;
2162 }
2163 #endif /* SQLITE_ENABLE_BYTECODE_VTAB || !SQLITE_OMIT_EXPLAIN */
2164 
2165 
2166 /*
2167 ** Delete a VdbeFrame object and its contents. VdbeFrame objects are
2168 ** allocated by the OP_Program opcode in sqlite3VdbeExec().
2169 */
2170 void sqlite3VdbeFrameDelete(VdbeFrame *p){
2171   int i;
2172   Mem *aMem = VdbeFrameMem(p);
2173   VdbeCursor **apCsr = (VdbeCursor **)&aMem[p->nChildMem];
2174   assert( sqlite3VdbeFrameIsValid(p) );
2175   for(i=0; i<p->nChildCsr; i++){
2176     if( apCsr[i] ) sqlite3VdbeFreeCursorNN(p->v, apCsr[i]);
2177   }
2178   releaseMemArray(aMem, p->nChildMem);
2179   sqlite3VdbeDeleteAuxData(p->v->db, &p->pAuxData, -1, 0);
2180   sqlite3DbFree(p->v->db, p);
2181 }
2182 
2183 #ifndef SQLITE_OMIT_EXPLAIN
2184 /*
2185 ** Give a listing of the program in the virtual machine.
2186 **
2187 ** The interface is the same as sqlite3VdbeExec().  But instead of
2188 ** running the code, it invokes the callback once for each instruction.
2189 ** This feature is used to implement "EXPLAIN".
2190 **
2191 ** When p->explain==1, each instruction is listed.  When
2192 ** p->explain==2, only OP_Explain instructions are listed and these
2193 ** are shown in a different format.  p->explain==2 is used to implement
2194 ** EXPLAIN QUERY PLAN.
2195 ** 2018-04-24:  In p->explain==2 mode, the OP_Init opcodes of triggers
2196 ** are also shown, so that the boundaries between the main program and
2197 ** each trigger are clear.
2198 **
2199 ** When p->explain==1, first the main program is listed, then each of
2200 ** the trigger subprograms are listed one by one.
2201 */
2202 int sqlite3VdbeList(
2203   Vdbe *p                   /* The VDBE */
2204 ){
2205   Mem *pSub = 0;                       /* Memory cell hold array of subprogs */
2206   sqlite3 *db = p->db;                 /* The database connection */
2207   int i;                               /* Loop counter */
2208   int rc = SQLITE_OK;                  /* Return code */
2209   Mem *pMem = &p->aMem[1];             /* First Mem of result set */
2210   int bListSubprogs = (p->explain==1 || (db->flags & SQLITE_TriggerEQP)!=0);
2211   Op *aOp;                             /* Array of opcodes */
2212   Op *pOp;                             /* Current opcode */
2213 
2214   assert( p->explain );
2215   assert( p->eVdbeState==VDBE_RUN_STATE );
2216   assert( p->rc==SQLITE_OK || p->rc==SQLITE_BUSY || p->rc==SQLITE_NOMEM );
2217 
2218   /* Even though this opcode does not use dynamic strings for
2219   ** the result, result columns may become dynamic if the user calls
2220   ** sqlite3_column_text16(), causing a translation to UTF-16 encoding.
2221   */
2222   releaseMemArray(pMem, 8);
2223   p->pResultSet = 0;
2224 
2225   if( p->rc==SQLITE_NOMEM ){
2226     /* This happens if a malloc() inside a call to sqlite3_column_text() or
2227     ** sqlite3_column_text16() failed.  */
2228     sqlite3OomFault(db);
2229     return SQLITE_ERROR;
2230   }
2231 
2232   if( bListSubprogs ){
2233     /* The first 8 memory cells are used for the result set.  So we will
2234     ** commandeer the 9th cell to use as storage for an array of pointers
2235     ** to trigger subprograms.  The VDBE is guaranteed to have at least 9
2236     ** cells.  */
2237     assert( p->nMem>9 );
2238     pSub = &p->aMem[9];
2239   }else{
2240     pSub = 0;
2241   }
2242 
2243   /* Figure out which opcode is next to display */
2244   rc = sqlite3VdbeNextOpcode(p, pSub, p->explain==2, &p->pc, &i, &aOp);
2245 
2246   if( rc==SQLITE_OK ){
2247     pOp = aOp + i;
2248     if( AtomicLoad(&db->u1.isInterrupted) ){
2249       p->rc = SQLITE_INTERRUPT;
2250       rc = SQLITE_ERROR;
2251       sqlite3VdbeError(p, sqlite3ErrStr(p->rc));
2252     }else{
2253       char *zP4 = sqlite3VdbeDisplayP4(db, pOp);
2254       if( p->explain==2 ){
2255         sqlite3VdbeMemSetInt64(pMem, pOp->p1);
2256         sqlite3VdbeMemSetInt64(pMem+1, pOp->p2);
2257         sqlite3VdbeMemSetInt64(pMem+2, pOp->p3);
2258         sqlite3VdbeMemSetStr(pMem+3, zP4, -1, SQLITE_UTF8, sqlite3_free);
2259         p->nResColumn = 4;
2260       }else{
2261         sqlite3VdbeMemSetInt64(pMem+0, i);
2262         sqlite3VdbeMemSetStr(pMem+1, (char*)sqlite3OpcodeName(pOp->opcode),
2263                              -1, SQLITE_UTF8, SQLITE_STATIC);
2264         sqlite3VdbeMemSetInt64(pMem+2, pOp->p1);
2265         sqlite3VdbeMemSetInt64(pMem+3, pOp->p2);
2266         sqlite3VdbeMemSetInt64(pMem+4, pOp->p3);
2267         /* pMem+5 for p4 is done last */
2268         sqlite3VdbeMemSetInt64(pMem+6, pOp->p5);
2269 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
2270         {
2271           char *zCom = sqlite3VdbeDisplayComment(db, pOp, zP4);
2272           sqlite3VdbeMemSetStr(pMem+7, zCom, -1, SQLITE_UTF8, sqlite3_free);
2273         }
2274 #else
2275         sqlite3VdbeMemSetNull(pMem+7);
2276 #endif
2277         sqlite3VdbeMemSetStr(pMem+5, zP4, -1, SQLITE_UTF8, sqlite3_free);
2278         p->nResColumn = 8;
2279       }
2280       p->pResultSet = pMem;
2281       if( db->mallocFailed ){
2282         p->rc = SQLITE_NOMEM;
2283         rc = SQLITE_ERROR;
2284       }else{
2285         p->rc = SQLITE_OK;
2286         rc = SQLITE_ROW;
2287       }
2288     }
2289   }
2290   return rc;
2291 }
2292 #endif /* SQLITE_OMIT_EXPLAIN */
2293 
2294 #ifdef SQLITE_DEBUG
2295 /*
2296 ** Print the SQL that was used to generate a VDBE program.
2297 */
2298 void sqlite3VdbePrintSql(Vdbe *p){
2299   const char *z = 0;
2300   if( p->zSql ){
2301     z = p->zSql;
2302   }else if( p->nOp>=1 ){
2303     const VdbeOp *pOp = &p->aOp[0];
2304     if( pOp->opcode==OP_Init && pOp->p4.z!=0 ){
2305       z = pOp->p4.z;
2306       while( sqlite3Isspace(*z) ) z++;
2307     }
2308   }
2309   if( z ) printf("SQL: [%s]\n", z);
2310 }
2311 #endif
2312 
2313 #if !defined(SQLITE_OMIT_TRACE) && defined(SQLITE_ENABLE_IOTRACE)
2314 /*
2315 ** Print an IOTRACE message showing SQL content.
2316 */
2317 void sqlite3VdbeIOTraceSql(Vdbe *p){
2318   int nOp = p->nOp;
2319   VdbeOp *pOp;
2320   if( sqlite3IoTrace==0 ) return;
2321   if( nOp<1 ) return;
2322   pOp = &p->aOp[0];
2323   if( pOp->opcode==OP_Init && pOp->p4.z!=0 ){
2324     int i, j;
2325     char z[1000];
2326     sqlite3_snprintf(sizeof(z), z, "%s", pOp->p4.z);
2327     for(i=0; sqlite3Isspace(z[i]); i++){}
2328     for(j=0; z[i]; i++){
2329       if( sqlite3Isspace(z[i]) ){
2330         if( z[i-1]!=' ' ){
2331           z[j++] = ' ';
2332         }
2333       }else{
2334         z[j++] = z[i];
2335       }
2336     }
2337     z[j] = 0;
2338     sqlite3IoTrace("SQL %s\n", z);
2339   }
2340 }
2341 #endif /* !SQLITE_OMIT_TRACE && SQLITE_ENABLE_IOTRACE */
2342 
2343 /* An instance of this object describes bulk memory available for use
2344 ** by subcomponents of a prepared statement.  Space is allocated out
2345 ** of a ReusableSpace object by the allocSpace() routine below.
2346 */
2347 struct ReusableSpace {
2348   u8 *pSpace;            /* Available memory */
2349   sqlite3_int64 nFree;   /* Bytes of available memory */
2350   sqlite3_int64 nNeeded; /* Total bytes that could not be allocated */
2351 };
2352 
2353 /* Try to allocate nByte bytes of 8-byte aligned bulk memory for pBuf
2354 ** from the ReusableSpace object.  Return a pointer to the allocated
2355 ** memory on success.  If insufficient memory is available in the
2356 ** ReusableSpace object, increase the ReusableSpace.nNeeded
2357 ** value by the amount needed and return NULL.
2358 **
2359 ** If pBuf is not initially NULL, that means that the memory has already
2360 ** been allocated by a prior call to this routine, so just return a copy
2361 ** of pBuf and leave ReusableSpace unchanged.
2362 **
2363 ** This allocator is employed to repurpose unused slots at the end of the
2364 ** opcode array of prepared state for other memory needs of the prepared
2365 ** statement.
2366 */
2367 static void *allocSpace(
2368   struct ReusableSpace *p,  /* Bulk memory available for allocation */
2369   void *pBuf,               /* Pointer to a prior allocation */
2370   sqlite3_int64 nByte       /* Bytes of memory needed. */
2371 ){
2372   assert( EIGHT_BYTE_ALIGNMENT(p->pSpace) );
2373   if( pBuf==0 ){
2374     nByte = ROUND8P(nByte);
2375     if( nByte <= p->nFree ){
2376       p->nFree -= nByte;
2377       pBuf = &p->pSpace[p->nFree];
2378     }else{
2379       p->nNeeded += nByte;
2380     }
2381   }
2382   assert( EIGHT_BYTE_ALIGNMENT(pBuf) );
2383   return pBuf;
2384 }
2385 
2386 /*
2387 ** Rewind the VDBE back to the beginning in preparation for
2388 ** running it.
2389 */
2390 void sqlite3VdbeRewind(Vdbe *p){
2391 #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
2392   int i;
2393 #endif
2394   assert( p!=0 );
2395   assert( p->eVdbeState==VDBE_INIT_STATE
2396        || p->eVdbeState==VDBE_READY_STATE
2397        || p->eVdbeState==VDBE_HALT_STATE );
2398 
2399   /* There should be at least one opcode.
2400   */
2401   assert( p->nOp>0 );
2402 
2403   p->eVdbeState = VDBE_READY_STATE;
2404 
2405 #ifdef SQLITE_DEBUG
2406   for(i=0; i<p->nMem; i++){
2407     assert( p->aMem[i].db==p->db );
2408   }
2409 #endif
2410   p->pc = -1;
2411   p->rc = SQLITE_OK;
2412   p->errorAction = OE_Abort;
2413   p->nChange = 0;
2414   p->cacheCtr = 1;
2415   p->minWriteFileFormat = 255;
2416   p->iStatement = 0;
2417   p->nFkConstraint = 0;
2418 #ifdef VDBE_PROFILE
2419   for(i=0; i<p->nOp; i++){
2420     p->aOp[i].cnt = 0;
2421     p->aOp[i].cycles = 0;
2422   }
2423 #endif
2424 }
2425 
2426 /*
2427 ** Prepare a virtual machine for execution for the first time after
2428 ** creating the virtual machine.  This involves things such
2429 ** as allocating registers and initializing the program counter.
2430 ** After the VDBE has be prepped, it can be executed by one or more
2431 ** calls to sqlite3VdbeExec().
2432 **
2433 ** This function may be called exactly once on each virtual machine.
2434 ** After this routine is called the VM has been "packaged" and is ready
2435 ** to run.  After this routine is called, further calls to
2436 ** sqlite3VdbeAddOp() functions are prohibited.  This routine disconnects
2437 ** the Vdbe from the Parse object that helped generate it so that the
2438 ** the Vdbe becomes an independent entity and the Parse object can be
2439 ** destroyed.
2440 **
2441 ** Use the sqlite3VdbeRewind() procedure to restore a virtual machine back
2442 ** to its initial state after it has been run.
2443 */
2444 void sqlite3VdbeMakeReady(
2445   Vdbe *p,                       /* The VDBE */
2446   Parse *pParse                  /* Parsing context */
2447 ){
2448   sqlite3 *db;                   /* The database connection */
2449   int nVar;                      /* Number of parameters */
2450   int nMem;                      /* Number of VM memory registers */
2451   int nCursor;                   /* Number of cursors required */
2452   int nArg;                      /* Number of arguments in subprograms */
2453   int n;                         /* Loop counter */
2454   struct ReusableSpace x;        /* Reusable bulk memory */
2455 
2456   assert( p!=0 );
2457   assert( p->nOp>0 );
2458   assert( pParse!=0 );
2459   assert( p->eVdbeState==VDBE_INIT_STATE );
2460   assert( pParse==p->pParse );
2461   p->pVList = pParse->pVList;
2462   pParse->pVList =  0;
2463   db = p->db;
2464   assert( db->mallocFailed==0 );
2465   nVar = pParse->nVar;
2466   nMem = pParse->nMem;
2467   nCursor = pParse->nTab;
2468   nArg = pParse->nMaxArg;
2469 
2470   /* Each cursor uses a memory cell.  The first cursor (cursor 0) can
2471   ** use aMem[0] which is not otherwise used by the VDBE program.  Allocate
2472   ** space at the end of aMem[] for cursors 1 and greater.
2473   ** See also: allocateCursor().
2474   */
2475   nMem += nCursor;
2476   if( nCursor==0 && nMem>0 ) nMem++;  /* Space for aMem[0] even if not used */
2477 
2478   /* Figure out how much reusable memory is available at the end of the
2479   ** opcode array.  This extra memory will be reallocated for other elements
2480   ** of the prepared statement.
2481   */
2482   n = ROUND8P(sizeof(Op)*p->nOp);             /* Bytes of opcode memory used */
2483   x.pSpace = &((u8*)p->aOp)[n];               /* Unused opcode memory */
2484   assert( EIGHT_BYTE_ALIGNMENT(x.pSpace) );
2485   x.nFree = ROUNDDOWN8(pParse->szOpAlloc - n);  /* Bytes of unused memory */
2486   assert( x.nFree>=0 );
2487   assert( EIGHT_BYTE_ALIGNMENT(&x.pSpace[x.nFree]) );
2488 
2489   resolveP2Values(p, &nArg);
2490   p->usesStmtJournal = (u8)(pParse->isMultiWrite && pParse->mayAbort);
2491   if( pParse->explain ){
2492     static const char * const azColName[] = {
2493        "addr", "opcode", "p1", "p2", "p3", "p4", "p5", "comment",
2494        "id", "parent", "notused", "detail"
2495     };
2496     int iFirst, mx, i;
2497     if( nMem<10 ) nMem = 10;
2498     p->explain = pParse->explain;
2499     if( pParse->explain==2 ){
2500       sqlite3VdbeSetNumCols(p, 4);
2501       iFirst = 8;
2502       mx = 12;
2503     }else{
2504       sqlite3VdbeSetNumCols(p, 8);
2505       iFirst = 0;
2506       mx = 8;
2507     }
2508     for(i=iFirst; i<mx; i++){
2509       sqlite3VdbeSetColName(p, i-iFirst, COLNAME_NAME,
2510                             azColName[i], SQLITE_STATIC);
2511     }
2512   }
2513   p->expired = 0;
2514 
2515   /* Memory for registers, parameters, cursor, etc, is allocated in one or two
2516   ** passes.  On the first pass, we try to reuse unused memory at the
2517   ** end of the opcode array.  If we are unable to satisfy all memory
2518   ** requirements by reusing the opcode array tail, then the second
2519   ** pass will fill in the remainder using a fresh memory allocation.
2520   **
2521   ** This two-pass approach that reuses as much memory as possible from
2522   ** the leftover memory at the end of the opcode array.  This can significantly
2523   ** reduce the amount of memory held by a prepared statement.
2524   */
2525   x.nNeeded = 0;
2526   p->aMem = allocSpace(&x, 0, nMem*sizeof(Mem));
2527   p->aVar = allocSpace(&x, 0, nVar*sizeof(Mem));
2528   p->apArg = allocSpace(&x, 0, nArg*sizeof(Mem*));
2529   p->apCsr = allocSpace(&x, 0, nCursor*sizeof(VdbeCursor*));
2530 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2531   p->anExec = allocSpace(&x, 0, p->nOp*sizeof(i64));
2532 #endif
2533   if( x.nNeeded ){
2534     x.pSpace = p->pFree = sqlite3DbMallocRawNN(db, x.nNeeded);
2535     x.nFree = x.nNeeded;
2536     if( !db->mallocFailed ){
2537       p->aMem = allocSpace(&x, p->aMem, nMem*sizeof(Mem));
2538       p->aVar = allocSpace(&x, p->aVar, nVar*sizeof(Mem));
2539       p->apArg = allocSpace(&x, p->apArg, nArg*sizeof(Mem*));
2540       p->apCsr = allocSpace(&x, p->apCsr, nCursor*sizeof(VdbeCursor*));
2541 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2542       p->anExec = allocSpace(&x, p->anExec, p->nOp*sizeof(i64));
2543 #endif
2544     }
2545   }
2546 
2547   if( db->mallocFailed ){
2548     p->nVar = 0;
2549     p->nCursor = 0;
2550     p->nMem = 0;
2551   }else{
2552     p->nCursor = nCursor;
2553     p->nVar = (ynVar)nVar;
2554     initMemArray(p->aVar, nVar, db, MEM_Null);
2555     p->nMem = nMem;
2556     initMemArray(p->aMem, nMem, db, MEM_Undefined);
2557     memset(p->apCsr, 0, nCursor*sizeof(VdbeCursor*));
2558 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2559     memset(p->anExec, 0, p->nOp*sizeof(i64));
2560 #endif
2561   }
2562   sqlite3VdbeRewind(p);
2563 }
2564 
2565 /*
2566 ** Close a VDBE cursor and release all the resources that cursor
2567 ** happens to hold.
2568 */
2569 void sqlite3VdbeFreeCursor(Vdbe *p, VdbeCursor *pCx){
2570   if( pCx ) sqlite3VdbeFreeCursorNN(p,pCx);
2571 }
2572 void sqlite3VdbeFreeCursorNN(Vdbe *p, VdbeCursor *pCx){
2573   switch( pCx->eCurType ){
2574     case CURTYPE_SORTER: {
2575       sqlite3VdbeSorterClose(p->db, pCx);
2576       break;
2577     }
2578     case CURTYPE_BTREE: {
2579       assert( pCx->uc.pCursor!=0 );
2580       sqlite3BtreeCloseCursor(pCx->uc.pCursor);
2581       break;
2582     }
2583 #ifndef SQLITE_OMIT_VIRTUALTABLE
2584     case CURTYPE_VTAB: {
2585       sqlite3_vtab_cursor *pVCur = pCx->uc.pVCur;
2586       const sqlite3_module *pModule = pVCur->pVtab->pModule;
2587       assert( pVCur->pVtab->nRef>0 );
2588       pVCur->pVtab->nRef--;
2589       pModule->xClose(pVCur);
2590       break;
2591     }
2592 #endif
2593   }
2594 }
2595 
2596 /*
2597 ** Close all cursors in the current frame.
2598 */
2599 static void closeCursorsInFrame(Vdbe *p){
2600   int i;
2601   for(i=0; i<p->nCursor; i++){
2602     VdbeCursor *pC = p->apCsr[i];
2603     if( pC ){
2604       sqlite3VdbeFreeCursorNN(p, pC);
2605       p->apCsr[i] = 0;
2606     }
2607   }
2608 }
2609 
2610 /*
2611 ** Copy the values stored in the VdbeFrame structure to its Vdbe. This
2612 ** is used, for example, when a trigger sub-program is halted to restore
2613 ** control to the main program.
2614 */
2615 int sqlite3VdbeFrameRestore(VdbeFrame *pFrame){
2616   Vdbe *v = pFrame->v;
2617   closeCursorsInFrame(v);
2618 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2619   v->anExec = pFrame->anExec;
2620 #endif
2621   v->aOp = pFrame->aOp;
2622   v->nOp = pFrame->nOp;
2623   v->aMem = pFrame->aMem;
2624   v->nMem = pFrame->nMem;
2625   v->apCsr = pFrame->apCsr;
2626   v->nCursor = pFrame->nCursor;
2627   v->db->lastRowid = pFrame->lastRowid;
2628   v->nChange = pFrame->nChange;
2629   v->db->nChange = pFrame->nDbChange;
2630   sqlite3VdbeDeleteAuxData(v->db, &v->pAuxData, -1, 0);
2631   v->pAuxData = pFrame->pAuxData;
2632   pFrame->pAuxData = 0;
2633   return pFrame->pc;
2634 }
2635 
2636 /*
2637 ** Close all cursors.
2638 **
2639 ** Also release any dynamic memory held by the VM in the Vdbe.aMem memory
2640 ** cell array. This is necessary as the memory cell array may contain
2641 ** pointers to VdbeFrame objects, which may in turn contain pointers to
2642 ** open cursors.
2643 */
2644 static void closeAllCursors(Vdbe *p){
2645   if( p->pFrame ){
2646     VdbeFrame *pFrame;
2647     for(pFrame=p->pFrame; pFrame->pParent; pFrame=pFrame->pParent);
2648     sqlite3VdbeFrameRestore(pFrame);
2649     p->pFrame = 0;
2650     p->nFrame = 0;
2651   }
2652   assert( p->nFrame==0 );
2653   closeCursorsInFrame(p);
2654   releaseMemArray(p->aMem, p->nMem);
2655   while( p->pDelFrame ){
2656     VdbeFrame *pDel = p->pDelFrame;
2657     p->pDelFrame = pDel->pParent;
2658     sqlite3VdbeFrameDelete(pDel);
2659   }
2660 
2661   /* Delete any auxdata allocations made by the VM */
2662   if( p->pAuxData ) sqlite3VdbeDeleteAuxData(p->db, &p->pAuxData, -1, 0);
2663   assert( p->pAuxData==0 );
2664 }
2665 
2666 /*
2667 ** Set the number of result columns that will be returned by this SQL
2668 ** statement. This is now set at compile time, rather than during
2669 ** execution of the vdbe program so that sqlite3_column_count() can
2670 ** be called on an SQL statement before sqlite3_step().
2671 */
2672 void sqlite3VdbeSetNumCols(Vdbe *p, int nResColumn){
2673   int n;
2674   sqlite3 *db = p->db;
2675 
2676   if( p->nResColumn ){
2677     releaseMemArray(p->aColName, p->nResColumn*COLNAME_N);
2678     sqlite3DbFree(db, p->aColName);
2679   }
2680   n = nResColumn*COLNAME_N;
2681   p->nResColumn = (u16)nResColumn;
2682   p->aColName = (Mem*)sqlite3DbMallocRawNN(db, sizeof(Mem)*n );
2683   if( p->aColName==0 ) return;
2684   initMemArray(p->aColName, n, db, MEM_Null);
2685 }
2686 
2687 /*
2688 ** Set the name of the idx'th column to be returned by the SQL statement.
2689 ** zName must be a pointer to a nul terminated string.
2690 **
2691 ** This call must be made after a call to sqlite3VdbeSetNumCols().
2692 **
2693 ** The final parameter, xDel, must be one of SQLITE_DYNAMIC, SQLITE_STATIC
2694 ** or SQLITE_TRANSIENT. If it is SQLITE_DYNAMIC, then the buffer pointed
2695 ** to by zName will be freed by sqlite3DbFree() when the vdbe is destroyed.
2696 */
2697 int sqlite3VdbeSetColName(
2698   Vdbe *p,                         /* Vdbe being configured */
2699   int idx,                         /* Index of column zName applies to */
2700   int var,                         /* One of the COLNAME_* constants */
2701   const char *zName,               /* Pointer to buffer containing name */
2702   void (*xDel)(void*)              /* Memory management strategy for zName */
2703 ){
2704   int rc;
2705   Mem *pColName;
2706   assert( idx<p->nResColumn );
2707   assert( var<COLNAME_N );
2708   if( p->db->mallocFailed ){
2709     assert( !zName || xDel!=SQLITE_DYNAMIC );
2710     return SQLITE_NOMEM_BKPT;
2711   }
2712   assert( p->aColName!=0 );
2713   pColName = &(p->aColName[idx+var*p->nResColumn]);
2714   rc = sqlite3VdbeMemSetStr(pColName, zName, -1, SQLITE_UTF8, xDel);
2715   assert( rc!=0 || !zName || (pColName->flags&MEM_Term)!=0 );
2716   return rc;
2717 }
2718 
2719 /*
2720 ** A read or write transaction may or may not be active on database handle
2721 ** db. If a transaction is active, commit it. If there is a
2722 ** write-transaction spanning more than one database file, this routine
2723 ** takes care of the super-journal trickery.
2724 */
2725 static int vdbeCommit(sqlite3 *db, Vdbe *p){
2726   int i;
2727   int nTrans = 0;  /* Number of databases with an active write-transaction
2728                    ** that are candidates for a two-phase commit using a
2729                    ** super-journal */
2730   int rc = SQLITE_OK;
2731   int needXcommit = 0;
2732 
2733 #ifdef SQLITE_OMIT_VIRTUALTABLE
2734   /* With this option, sqlite3VtabSync() is defined to be simply
2735   ** SQLITE_OK so p is not used.
2736   */
2737   UNUSED_PARAMETER(p);
2738 #endif
2739 
2740   /* Before doing anything else, call the xSync() callback for any
2741   ** virtual module tables written in this transaction. This has to
2742   ** be done before determining whether a super-journal file is
2743   ** required, as an xSync() callback may add an attached database
2744   ** to the transaction.
2745   */
2746   rc = sqlite3VtabSync(db, p);
2747 
2748   /* This loop determines (a) if the commit hook should be invoked and
2749   ** (b) how many database files have open write transactions, not
2750   ** including the temp database. (b) is important because if more than
2751   ** one database file has an open write transaction, a super-journal
2752   ** file is required for an atomic commit.
2753   */
2754   for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2755     Btree *pBt = db->aDb[i].pBt;
2756     if( sqlite3BtreeTxnState(pBt)==SQLITE_TXN_WRITE ){
2757       /* Whether or not a database might need a super-journal depends upon
2758       ** its journal mode (among other things).  This matrix determines which
2759       ** journal modes use a super-journal and which do not */
2760       static const u8 aMJNeeded[] = {
2761         /* DELETE   */  1,
2762         /* PERSIST   */ 1,
2763         /* OFF       */ 0,
2764         /* TRUNCATE  */ 1,
2765         /* MEMORY    */ 0,
2766         /* WAL       */ 0
2767       };
2768       Pager *pPager;   /* Pager associated with pBt */
2769       needXcommit = 1;
2770       sqlite3BtreeEnter(pBt);
2771       pPager = sqlite3BtreePager(pBt);
2772       if( db->aDb[i].safety_level!=PAGER_SYNCHRONOUS_OFF
2773        && aMJNeeded[sqlite3PagerGetJournalMode(pPager)]
2774        && sqlite3PagerIsMemdb(pPager)==0
2775       ){
2776         assert( i!=1 );
2777         nTrans++;
2778       }
2779       rc = sqlite3PagerExclusiveLock(pPager);
2780       sqlite3BtreeLeave(pBt);
2781     }
2782   }
2783   if( rc!=SQLITE_OK ){
2784     return rc;
2785   }
2786 
2787   /* If there are any write-transactions at all, invoke the commit hook */
2788   if( needXcommit && db->xCommitCallback ){
2789     rc = db->xCommitCallback(db->pCommitArg);
2790     if( rc ){
2791       return SQLITE_CONSTRAINT_COMMITHOOK;
2792     }
2793   }
2794 
2795   /* The simple case - no more than one database file (not counting the
2796   ** TEMP database) has a transaction active.   There is no need for the
2797   ** super-journal.
2798   **
2799   ** If the return value of sqlite3BtreeGetFilename() is a zero length
2800   ** string, it means the main database is :memory: or a temp file.  In
2801   ** that case we do not support atomic multi-file commits, so use the
2802   ** simple case then too.
2803   */
2804   if( 0==sqlite3Strlen30(sqlite3BtreeGetFilename(db->aDb[0].pBt))
2805    || nTrans<=1
2806   ){
2807     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2808       Btree *pBt = db->aDb[i].pBt;
2809       if( pBt ){
2810         rc = sqlite3BtreeCommitPhaseOne(pBt, 0);
2811       }
2812     }
2813 
2814     /* Do the commit only if all databases successfully complete phase 1.
2815     ** If one of the BtreeCommitPhaseOne() calls fails, this indicates an
2816     ** IO error while deleting or truncating a journal file. It is unlikely,
2817     ** but could happen. In this case abandon processing and return the error.
2818     */
2819     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2820       Btree *pBt = db->aDb[i].pBt;
2821       if( pBt ){
2822         rc = sqlite3BtreeCommitPhaseTwo(pBt, 0);
2823       }
2824     }
2825     if( rc==SQLITE_OK ){
2826       sqlite3VtabCommit(db);
2827     }
2828   }
2829 
2830   /* The complex case - There is a multi-file write-transaction active.
2831   ** This requires a super-journal file to ensure the transaction is
2832   ** committed atomically.
2833   */
2834 #ifndef SQLITE_OMIT_DISKIO
2835   else{
2836     sqlite3_vfs *pVfs = db->pVfs;
2837     char *zSuper = 0;   /* File-name for the super-journal */
2838     char const *zMainFile = sqlite3BtreeGetFilename(db->aDb[0].pBt);
2839     sqlite3_file *pSuperJrnl = 0;
2840     i64 offset = 0;
2841     int res;
2842     int retryCount = 0;
2843     int nMainFile;
2844 
2845     /* Select a super-journal file name */
2846     nMainFile = sqlite3Strlen30(zMainFile);
2847     zSuper = sqlite3MPrintf(db, "%.4c%s%.16c", 0,zMainFile,0);
2848     if( zSuper==0 ) return SQLITE_NOMEM_BKPT;
2849     zSuper += 4;
2850     do {
2851       u32 iRandom;
2852       if( retryCount ){
2853         if( retryCount>100 ){
2854           sqlite3_log(SQLITE_FULL, "MJ delete: %s", zSuper);
2855           sqlite3OsDelete(pVfs, zSuper, 0);
2856           break;
2857         }else if( retryCount==1 ){
2858           sqlite3_log(SQLITE_FULL, "MJ collide: %s", zSuper);
2859         }
2860       }
2861       retryCount++;
2862       sqlite3_randomness(sizeof(iRandom), &iRandom);
2863       sqlite3_snprintf(13, &zSuper[nMainFile], "-mj%06X9%02X",
2864                                (iRandom>>8)&0xffffff, iRandom&0xff);
2865       /* The antipenultimate character of the super-journal name must
2866       ** be "9" to avoid name collisions when using 8+3 filenames. */
2867       assert( zSuper[sqlite3Strlen30(zSuper)-3]=='9' );
2868       sqlite3FileSuffix3(zMainFile, zSuper);
2869       rc = sqlite3OsAccess(pVfs, zSuper, SQLITE_ACCESS_EXISTS, &res);
2870     }while( rc==SQLITE_OK && res );
2871     if( rc==SQLITE_OK ){
2872       /* Open the super-journal. */
2873       rc = sqlite3OsOpenMalloc(pVfs, zSuper, &pSuperJrnl,
2874           SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE|
2875           SQLITE_OPEN_EXCLUSIVE|SQLITE_OPEN_SUPER_JOURNAL, 0
2876       );
2877     }
2878     if( rc!=SQLITE_OK ){
2879       sqlite3DbFree(db, zSuper-4);
2880       return rc;
2881     }
2882 
2883     /* Write the name of each database file in the transaction into the new
2884     ** super-journal file. If an error occurs at this point close
2885     ** and delete the super-journal file. All the individual journal files
2886     ** still have 'null' as the super-journal pointer, so they will roll
2887     ** back independently if a failure occurs.
2888     */
2889     for(i=0; i<db->nDb; i++){
2890       Btree *pBt = db->aDb[i].pBt;
2891       if( sqlite3BtreeTxnState(pBt)==SQLITE_TXN_WRITE ){
2892         char const *zFile = sqlite3BtreeGetJournalname(pBt);
2893         if( zFile==0 ){
2894           continue;  /* Ignore TEMP and :memory: databases */
2895         }
2896         assert( zFile[0]!=0 );
2897         rc = sqlite3OsWrite(pSuperJrnl, zFile, sqlite3Strlen30(zFile)+1,offset);
2898         offset += sqlite3Strlen30(zFile)+1;
2899         if( rc!=SQLITE_OK ){
2900           sqlite3OsCloseFree(pSuperJrnl);
2901           sqlite3OsDelete(pVfs, zSuper, 0);
2902           sqlite3DbFree(db, zSuper-4);
2903           return rc;
2904         }
2905       }
2906     }
2907 
2908     /* Sync the super-journal file. If the IOCAP_SEQUENTIAL device
2909     ** flag is set this is not required.
2910     */
2911     if( 0==(sqlite3OsDeviceCharacteristics(pSuperJrnl)&SQLITE_IOCAP_SEQUENTIAL)
2912      && SQLITE_OK!=(rc = sqlite3OsSync(pSuperJrnl, SQLITE_SYNC_NORMAL))
2913     ){
2914       sqlite3OsCloseFree(pSuperJrnl);
2915       sqlite3OsDelete(pVfs, zSuper, 0);
2916       sqlite3DbFree(db, zSuper-4);
2917       return rc;
2918     }
2919 
2920     /* Sync all the db files involved in the transaction. The same call
2921     ** sets the super-journal pointer in each individual journal. If
2922     ** an error occurs here, do not delete the super-journal file.
2923     **
2924     ** If the error occurs during the first call to
2925     ** sqlite3BtreeCommitPhaseOne(), then there is a chance that the
2926     ** super-journal file will be orphaned. But we cannot delete it,
2927     ** in case the super-journal file name was written into the journal
2928     ** file before the failure occurred.
2929     */
2930     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2931       Btree *pBt = db->aDb[i].pBt;
2932       if( pBt ){
2933         rc = sqlite3BtreeCommitPhaseOne(pBt, zSuper);
2934       }
2935     }
2936     sqlite3OsCloseFree(pSuperJrnl);
2937     assert( rc!=SQLITE_BUSY );
2938     if( rc!=SQLITE_OK ){
2939       sqlite3DbFree(db, zSuper-4);
2940       return rc;
2941     }
2942 
2943     /* Delete the super-journal file. This commits the transaction. After
2944     ** doing this the directory is synced again before any individual
2945     ** transaction files are deleted.
2946     */
2947     rc = sqlite3OsDelete(pVfs, zSuper, 1);
2948     sqlite3DbFree(db, zSuper-4);
2949     zSuper = 0;
2950     if( rc ){
2951       return rc;
2952     }
2953 
2954     /* All files and directories have already been synced, so the following
2955     ** calls to sqlite3BtreeCommitPhaseTwo() are only closing files and
2956     ** deleting or truncating journals. If something goes wrong while
2957     ** this is happening we don't really care. The integrity of the
2958     ** transaction is already guaranteed, but some stray 'cold' journals
2959     ** may be lying around. Returning an error code won't help matters.
2960     */
2961     disable_simulated_io_errors();
2962     sqlite3BeginBenignMalloc();
2963     for(i=0; i<db->nDb; i++){
2964       Btree *pBt = db->aDb[i].pBt;
2965       if( pBt ){
2966         sqlite3BtreeCommitPhaseTwo(pBt, 1);
2967       }
2968     }
2969     sqlite3EndBenignMalloc();
2970     enable_simulated_io_errors();
2971 
2972     sqlite3VtabCommit(db);
2973   }
2974 #endif
2975 
2976   return rc;
2977 }
2978 
2979 /*
2980 ** This routine checks that the sqlite3.nVdbeActive count variable
2981 ** matches the number of vdbe's in the list sqlite3.pVdbe that are
2982 ** currently active. An assertion fails if the two counts do not match.
2983 ** This is an internal self-check only - it is not an essential processing
2984 ** step.
2985 **
2986 ** This is a no-op if NDEBUG is defined.
2987 */
2988 #ifndef NDEBUG
2989 static void checkActiveVdbeCnt(sqlite3 *db){
2990   Vdbe *p;
2991   int cnt = 0;
2992   int nWrite = 0;
2993   int nRead = 0;
2994   p = db->pVdbe;
2995   while( p ){
2996     if( sqlite3_stmt_busy((sqlite3_stmt*)p) ){
2997       cnt++;
2998       if( p->readOnly==0 ) nWrite++;
2999       if( p->bIsReader ) nRead++;
3000     }
3001     p = p->pNext;
3002   }
3003   assert( cnt==db->nVdbeActive );
3004   assert( nWrite==db->nVdbeWrite );
3005   assert( nRead==db->nVdbeRead );
3006 }
3007 #else
3008 #define checkActiveVdbeCnt(x)
3009 #endif
3010 
3011 /*
3012 ** If the Vdbe passed as the first argument opened a statement-transaction,
3013 ** close it now. Argument eOp must be either SAVEPOINT_ROLLBACK or
3014 ** SAVEPOINT_RELEASE. If it is SAVEPOINT_ROLLBACK, then the statement
3015 ** transaction is rolled back. If eOp is SAVEPOINT_RELEASE, then the
3016 ** statement transaction is committed.
3017 **
3018 ** If an IO error occurs, an SQLITE_IOERR_XXX error code is returned.
3019 ** Otherwise SQLITE_OK.
3020 */
3021 static SQLITE_NOINLINE int vdbeCloseStatement(Vdbe *p, int eOp){
3022   sqlite3 *const db = p->db;
3023   int rc = SQLITE_OK;
3024   int i;
3025   const int iSavepoint = p->iStatement-1;
3026 
3027   assert( eOp==SAVEPOINT_ROLLBACK || eOp==SAVEPOINT_RELEASE);
3028   assert( db->nStatement>0 );
3029   assert( p->iStatement==(db->nStatement+db->nSavepoint) );
3030 
3031   for(i=0; i<db->nDb; i++){
3032     int rc2 = SQLITE_OK;
3033     Btree *pBt = db->aDb[i].pBt;
3034     if( pBt ){
3035       if( eOp==SAVEPOINT_ROLLBACK ){
3036         rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_ROLLBACK, iSavepoint);
3037       }
3038       if( rc2==SQLITE_OK ){
3039         rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_RELEASE, iSavepoint);
3040       }
3041       if( rc==SQLITE_OK ){
3042         rc = rc2;
3043       }
3044     }
3045   }
3046   db->nStatement--;
3047   p->iStatement = 0;
3048 
3049   if( rc==SQLITE_OK ){
3050     if( eOp==SAVEPOINT_ROLLBACK ){
3051       rc = sqlite3VtabSavepoint(db, SAVEPOINT_ROLLBACK, iSavepoint);
3052     }
3053     if( rc==SQLITE_OK ){
3054       rc = sqlite3VtabSavepoint(db, SAVEPOINT_RELEASE, iSavepoint);
3055     }
3056   }
3057 
3058   /* If the statement transaction is being rolled back, also restore the
3059   ** database handles deferred constraint counter to the value it had when
3060   ** the statement transaction was opened.  */
3061   if( eOp==SAVEPOINT_ROLLBACK ){
3062     db->nDeferredCons = p->nStmtDefCons;
3063     db->nDeferredImmCons = p->nStmtDefImmCons;
3064   }
3065   return rc;
3066 }
3067 int sqlite3VdbeCloseStatement(Vdbe *p, int eOp){
3068   if( p->db->nStatement && p->iStatement ){
3069     return vdbeCloseStatement(p, eOp);
3070   }
3071   return SQLITE_OK;
3072 }
3073 
3074 
3075 /*
3076 ** This function is called when a transaction opened by the database
3077 ** handle associated with the VM passed as an argument is about to be
3078 ** committed. If there are outstanding deferred foreign key constraint
3079 ** violations, return SQLITE_ERROR. Otherwise, SQLITE_OK.
3080 **
3081 ** If there are outstanding FK violations and this function returns
3082 ** SQLITE_ERROR, set the result of the VM to SQLITE_CONSTRAINT_FOREIGNKEY
3083 ** and write an error message to it. Then return SQLITE_ERROR.
3084 */
3085 #ifndef SQLITE_OMIT_FOREIGN_KEY
3086 int sqlite3VdbeCheckFk(Vdbe *p, int deferred){
3087   sqlite3 *db = p->db;
3088   if( (deferred && (db->nDeferredCons+db->nDeferredImmCons)>0)
3089    || (!deferred && p->nFkConstraint>0)
3090   ){
3091     p->rc = SQLITE_CONSTRAINT_FOREIGNKEY;
3092     p->errorAction = OE_Abort;
3093     sqlite3VdbeError(p, "FOREIGN KEY constraint failed");
3094     if( (p->prepFlags & SQLITE_PREPARE_SAVESQL)==0 ) return SQLITE_ERROR;
3095     return SQLITE_CONSTRAINT_FOREIGNKEY;
3096   }
3097   return SQLITE_OK;
3098 }
3099 #endif
3100 
3101 /*
3102 ** This routine is called the when a VDBE tries to halt.  If the VDBE
3103 ** has made changes and is in autocommit mode, then commit those
3104 ** changes.  If a rollback is needed, then do the rollback.
3105 **
3106 ** This routine is the only way to move the sqlite3eOpenState of a VM from
3107 ** SQLITE_STATE_RUN to SQLITE_STATE_HALT.  It is harmless to
3108 ** call this on a VM that is in the SQLITE_STATE_HALT state.
3109 **
3110 ** Return an error code.  If the commit could not complete because of
3111 ** lock contention, return SQLITE_BUSY.  If SQLITE_BUSY is returned, it
3112 ** means the close did not happen and needs to be repeated.
3113 */
3114 int sqlite3VdbeHalt(Vdbe *p){
3115   int rc;                         /* Used to store transient return codes */
3116   sqlite3 *db = p->db;
3117 
3118   /* This function contains the logic that determines if a statement or
3119   ** transaction will be committed or rolled back as a result of the
3120   ** execution of this virtual machine.
3121   **
3122   ** If any of the following errors occur:
3123   **
3124   **     SQLITE_NOMEM
3125   **     SQLITE_IOERR
3126   **     SQLITE_FULL
3127   **     SQLITE_INTERRUPT
3128   **
3129   ** Then the internal cache might have been left in an inconsistent
3130   ** state.  We need to rollback the statement transaction, if there is
3131   ** one, or the complete transaction if there is no statement transaction.
3132   */
3133 
3134   assert( p->eVdbeState==VDBE_RUN_STATE );
3135   if( db->mallocFailed ){
3136     p->rc = SQLITE_NOMEM_BKPT;
3137   }
3138   closeAllCursors(p);
3139   checkActiveVdbeCnt(db);
3140 
3141   /* No commit or rollback needed if the program never started or if the
3142   ** SQL statement does not read or write a database file.  */
3143   if( p->bIsReader ){
3144     int mrc;   /* Primary error code from p->rc */
3145     int eStatementOp = 0;
3146     int isSpecialError;            /* Set to true if a 'special' error */
3147 
3148     /* Lock all btrees used by the statement */
3149     sqlite3VdbeEnter(p);
3150 
3151     /* Check for one of the special errors */
3152     if( p->rc ){
3153       mrc = p->rc & 0xff;
3154       isSpecialError = mrc==SQLITE_NOMEM
3155                     || mrc==SQLITE_IOERR
3156                     || mrc==SQLITE_INTERRUPT
3157                     || mrc==SQLITE_FULL;
3158     }else{
3159       mrc = isSpecialError = 0;
3160     }
3161     if( isSpecialError ){
3162       /* If the query was read-only and the error code is SQLITE_INTERRUPT,
3163       ** no rollback is necessary. Otherwise, at least a savepoint
3164       ** transaction must be rolled back to restore the database to a
3165       ** consistent state.
3166       **
3167       ** Even if the statement is read-only, it is important to perform
3168       ** a statement or transaction rollback operation. If the error
3169       ** occurred while writing to the journal, sub-journal or database
3170       ** file as part of an effort to free up cache space (see function
3171       ** pagerStress() in pager.c), the rollback is required to restore
3172       ** the pager to a consistent state.
3173       */
3174       if( !p->readOnly || mrc!=SQLITE_INTERRUPT ){
3175         if( (mrc==SQLITE_NOMEM || mrc==SQLITE_FULL) && p->usesStmtJournal ){
3176           eStatementOp = SAVEPOINT_ROLLBACK;
3177         }else{
3178           /* We are forced to roll back the active transaction. Before doing
3179           ** so, abort any other statements this handle currently has active.
3180           */
3181           sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
3182           sqlite3CloseSavepoints(db);
3183           db->autoCommit = 1;
3184           p->nChange = 0;
3185         }
3186       }
3187     }
3188 
3189     /* Check for immediate foreign key violations. */
3190     if( p->rc==SQLITE_OK || (p->errorAction==OE_Fail && !isSpecialError) ){
3191       sqlite3VdbeCheckFk(p, 0);
3192     }
3193 
3194     /* If the auto-commit flag is set and this is the only active writer
3195     ** VM, then we do either a commit or rollback of the current transaction.
3196     **
3197     ** Note: This block also runs if one of the special errors handled
3198     ** above has occurred.
3199     */
3200     if( !sqlite3VtabInSync(db)
3201      && db->autoCommit
3202      && db->nVdbeWrite==(p->readOnly==0)
3203     ){
3204       if( p->rc==SQLITE_OK || (p->errorAction==OE_Fail && !isSpecialError) ){
3205         rc = sqlite3VdbeCheckFk(p, 1);
3206         if( rc!=SQLITE_OK ){
3207           if( NEVER(p->readOnly) ){
3208             sqlite3VdbeLeave(p);
3209             return SQLITE_ERROR;
3210           }
3211           rc = SQLITE_CONSTRAINT_FOREIGNKEY;
3212         }else if( db->flags & SQLITE_CorruptRdOnly ){
3213           rc = SQLITE_CORRUPT;
3214           db->flags &= ~SQLITE_CorruptRdOnly;
3215         }else{
3216           /* The auto-commit flag is true, the vdbe program was successful
3217           ** or hit an 'OR FAIL' constraint and there are no deferred foreign
3218           ** key constraints to hold up the transaction. This means a commit
3219           ** is required. */
3220           rc = vdbeCommit(db, p);
3221         }
3222         if( rc==SQLITE_BUSY && p->readOnly ){
3223           sqlite3VdbeLeave(p);
3224           return SQLITE_BUSY;
3225         }else if( rc!=SQLITE_OK ){
3226           p->rc = rc;
3227           sqlite3RollbackAll(db, SQLITE_OK);
3228           p->nChange = 0;
3229         }else{
3230           db->nDeferredCons = 0;
3231           db->nDeferredImmCons = 0;
3232           db->flags &= ~(u64)SQLITE_DeferFKs;
3233           sqlite3CommitInternalChanges(db);
3234         }
3235       }else{
3236         sqlite3RollbackAll(db, SQLITE_OK);
3237         p->nChange = 0;
3238       }
3239       db->nStatement = 0;
3240     }else if( eStatementOp==0 ){
3241       if( p->rc==SQLITE_OK || p->errorAction==OE_Fail ){
3242         eStatementOp = SAVEPOINT_RELEASE;
3243       }else if( p->errorAction==OE_Abort ){
3244         eStatementOp = SAVEPOINT_ROLLBACK;
3245       }else{
3246         sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
3247         sqlite3CloseSavepoints(db);
3248         db->autoCommit = 1;
3249         p->nChange = 0;
3250       }
3251     }
3252 
3253     /* If eStatementOp is non-zero, then a statement transaction needs to
3254     ** be committed or rolled back. Call sqlite3VdbeCloseStatement() to
3255     ** do so. If this operation returns an error, and the current statement
3256     ** error code is SQLITE_OK or SQLITE_CONSTRAINT, then promote the
3257     ** current statement error code.
3258     */
3259     if( eStatementOp ){
3260       rc = sqlite3VdbeCloseStatement(p, eStatementOp);
3261       if( rc ){
3262         if( p->rc==SQLITE_OK || (p->rc&0xff)==SQLITE_CONSTRAINT ){
3263           p->rc = rc;
3264           sqlite3DbFree(db, p->zErrMsg);
3265           p->zErrMsg = 0;
3266         }
3267         sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
3268         sqlite3CloseSavepoints(db);
3269         db->autoCommit = 1;
3270         p->nChange = 0;
3271       }
3272     }
3273 
3274     /* If this was an INSERT, UPDATE or DELETE and no statement transaction
3275     ** has been rolled back, update the database connection change-counter.
3276     */
3277     if( p->changeCntOn ){
3278       if( eStatementOp!=SAVEPOINT_ROLLBACK ){
3279         sqlite3VdbeSetChanges(db, p->nChange);
3280       }else{
3281         sqlite3VdbeSetChanges(db, 0);
3282       }
3283       p->nChange = 0;
3284     }
3285 
3286     /* Release the locks */
3287     sqlite3VdbeLeave(p);
3288   }
3289 
3290   /* We have successfully halted and closed the VM.  Record this fact. */
3291   db->nVdbeActive--;
3292   if( !p->readOnly ) db->nVdbeWrite--;
3293   if( p->bIsReader ) db->nVdbeRead--;
3294   assert( db->nVdbeActive>=db->nVdbeRead );
3295   assert( db->nVdbeRead>=db->nVdbeWrite );
3296   assert( db->nVdbeWrite>=0 );
3297   p->eVdbeState = VDBE_HALT_STATE;
3298   checkActiveVdbeCnt(db);
3299   if( db->mallocFailed ){
3300     p->rc = SQLITE_NOMEM_BKPT;
3301   }
3302 
3303   /* If the auto-commit flag is set to true, then any locks that were held
3304   ** by connection db have now been released. Call sqlite3ConnectionUnlocked()
3305   ** to invoke any required unlock-notify callbacks.
3306   */
3307   if( db->autoCommit ){
3308     sqlite3ConnectionUnlocked(db);
3309   }
3310 
3311   assert( db->nVdbeActive>0 || db->autoCommit==0 || db->nStatement==0 );
3312   return (p->rc==SQLITE_BUSY ? SQLITE_BUSY : SQLITE_OK);
3313 }
3314 
3315 
3316 /*
3317 ** Each VDBE holds the result of the most recent sqlite3_step() call
3318 ** in p->rc.  This routine sets that result back to SQLITE_OK.
3319 */
3320 void sqlite3VdbeResetStepResult(Vdbe *p){
3321   p->rc = SQLITE_OK;
3322 }
3323 
3324 /*
3325 ** Copy the error code and error message belonging to the VDBE passed
3326 ** as the first argument to its database handle (so that they will be
3327 ** returned by calls to sqlite3_errcode() and sqlite3_errmsg()).
3328 **
3329 ** This function does not clear the VDBE error code or message, just
3330 ** copies them to the database handle.
3331 */
3332 int sqlite3VdbeTransferError(Vdbe *p){
3333   sqlite3 *db = p->db;
3334   int rc = p->rc;
3335   if( p->zErrMsg ){
3336     db->bBenignMalloc++;
3337     sqlite3BeginBenignMalloc();
3338     if( db->pErr==0 ) db->pErr = sqlite3ValueNew(db);
3339     sqlite3ValueSetStr(db->pErr, -1, p->zErrMsg, SQLITE_UTF8, SQLITE_TRANSIENT);
3340     sqlite3EndBenignMalloc();
3341     db->bBenignMalloc--;
3342   }else if( db->pErr ){
3343     sqlite3ValueSetNull(db->pErr);
3344   }
3345   db->errCode = rc;
3346   db->errByteOffset = -1;
3347   return rc;
3348 }
3349 
3350 #ifdef SQLITE_ENABLE_SQLLOG
3351 /*
3352 ** If an SQLITE_CONFIG_SQLLOG hook is registered and the VM has been run,
3353 ** invoke it.
3354 */
3355 static void vdbeInvokeSqllog(Vdbe *v){
3356   if( sqlite3GlobalConfig.xSqllog && v->rc==SQLITE_OK && v->zSql && v->pc>=0 ){
3357     char *zExpanded = sqlite3VdbeExpandSql(v, v->zSql);
3358     assert( v->db->init.busy==0 );
3359     if( zExpanded ){
3360       sqlite3GlobalConfig.xSqllog(
3361           sqlite3GlobalConfig.pSqllogArg, v->db, zExpanded, 1
3362       );
3363       sqlite3DbFree(v->db, zExpanded);
3364     }
3365   }
3366 }
3367 #else
3368 # define vdbeInvokeSqllog(x)
3369 #endif
3370 
3371 /*
3372 ** Clean up a VDBE after execution but do not delete the VDBE just yet.
3373 ** Write any error messages into *pzErrMsg.  Return the result code.
3374 **
3375 ** After this routine is run, the VDBE should be ready to be executed
3376 ** again.
3377 **
3378 ** To look at it another way, this routine resets the state of the
3379 ** virtual machine from VDBE_RUN_STATE or VDBE_HALT_STATE back to
3380 ** VDBE_READY_STATE.
3381 */
3382 int sqlite3VdbeReset(Vdbe *p){
3383 #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
3384   int i;
3385 #endif
3386 
3387   sqlite3 *db;
3388   db = p->db;
3389 
3390   /* If the VM did not run to completion or if it encountered an
3391   ** error, then it might not have been halted properly.  So halt
3392   ** it now.
3393   */
3394   if( p->eVdbeState==VDBE_RUN_STATE ) sqlite3VdbeHalt(p);
3395 
3396   /* If the VDBE has been run even partially, then transfer the error code
3397   ** and error message from the VDBE into the main database structure.  But
3398   ** if the VDBE has just been set to run but has not actually executed any
3399   ** instructions yet, leave the main database error information unchanged.
3400   */
3401   if( p->pc>=0 ){
3402     vdbeInvokeSqllog(p);
3403     if( db->pErr || p->zErrMsg ){
3404       sqlite3VdbeTransferError(p);
3405     }else{
3406       db->errCode = p->rc;
3407     }
3408   }
3409 
3410   /* Reset register contents and reclaim error message memory.
3411   */
3412 #ifdef SQLITE_DEBUG
3413   /* Execute assert() statements to ensure that the Vdbe.apCsr[] and
3414   ** Vdbe.aMem[] arrays have already been cleaned up.  */
3415   if( p->apCsr ) for(i=0; i<p->nCursor; i++) assert( p->apCsr[i]==0 );
3416   if( p->aMem ){
3417     for(i=0; i<p->nMem; i++) assert( p->aMem[i].flags==MEM_Undefined );
3418   }
3419 #endif
3420   if( p->zErrMsg ){
3421     sqlite3DbFree(db, p->zErrMsg);
3422     p->zErrMsg = 0;
3423   }
3424   p->pResultSet = 0;
3425 #ifdef SQLITE_DEBUG
3426   p->nWrite = 0;
3427 #endif
3428 
3429   /* Save profiling information from this VDBE run.
3430   */
3431 #ifdef VDBE_PROFILE
3432   {
3433     FILE *out = fopen("vdbe_profile.out", "a");
3434     if( out ){
3435       fprintf(out, "---- ");
3436       for(i=0; i<p->nOp; i++){
3437         fprintf(out, "%02x", p->aOp[i].opcode);
3438       }
3439       fprintf(out, "\n");
3440       if( p->zSql ){
3441         char c, pc = 0;
3442         fprintf(out, "-- ");
3443         for(i=0; (c = p->zSql[i])!=0; i++){
3444           if( pc=='\n' ) fprintf(out, "-- ");
3445           putc(c, out);
3446           pc = c;
3447         }
3448         if( pc!='\n' ) fprintf(out, "\n");
3449       }
3450       for(i=0; i<p->nOp; i++){
3451         char zHdr[100];
3452         sqlite3_snprintf(sizeof(zHdr), zHdr, "%6u %12llu %8llu ",
3453            p->aOp[i].cnt,
3454            p->aOp[i].cycles,
3455            p->aOp[i].cnt>0 ? p->aOp[i].cycles/p->aOp[i].cnt : 0
3456         );
3457         fprintf(out, "%s", zHdr);
3458         sqlite3VdbePrintOp(out, i, &p->aOp[i]);
3459       }
3460       fclose(out);
3461     }
3462   }
3463 #endif
3464   return p->rc & db->errMask;
3465 }
3466 
3467 /*
3468 ** Clean up and delete a VDBE after execution.  Return an integer which is
3469 ** the result code.  Write any error message text into *pzErrMsg.
3470 */
3471 int sqlite3VdbeFinalize(Vdbe *p){
3472   int rc = SQLITE_OK;
3473   assert( VDBE_RUN_STATE>VDBE_READY_STATE );
3474   assert( VDBE_HALT_STATE>VDBE_READY_STATE );
3475   assert( VDBE_INIT_STATE<VDBE_READY_STATE );
3476   if( p->eVdbeState>=VDBE_READY_STATE ){
3477     rc = sqlite3VdbeReset(p);
3478     assert( (rc & p->db->errMask)==rc );
3479   }
3480   sqlite3VdbeDelete(p);
3481   return rc;
3482 }
3483 
3484 /*
3485 ** If parameter iOp is less than zero, then invoke the destructor for
3486 ** all auxiliary data pointers currently cached by the VM passed as
3487 ** the first argument.
3488 **
3489 ** Or, if iOp is greater than or equal to zero, then the destructor is
3490 ** only invoked for those auxiliary data pointers created by the user
3491 ** function invoked by the OP_Function opcode at instruction iOp of
3492 ** VM pVdbe, and only then if:
3493 **
3494 **    * the associated function parameter is the 32nd or later (counting
3495 **      from left to right), or
3496 **
3497 **    * the corresponding bit in argument mask is clear (where the first
3498 **      function parameter corresponds to bit 0 etc.).
3499 */
3500 void sqlite3VdbeDeleteAuxData(sqlite3 *db, AuxData **pp, int iOp, int mask){
3501   while( *pp ){
3502     AuxData *pAux = *pp;
3503     if( (iOp<0)
3504      || (pAux->iAuxOp==iOp
3505           && pAux->iAuxArg>=0
3506           && (pAux->iAuxArg>31 || !(mask & MASKBIT32(pAux->iAuxArg))))
3507     ){
3508       testcase( pAux->iAuxArg==31 );
3509       if( pAux->xDeleteAux ){
3510         pAux->xDeleteAux(pAux->pAux);
3511       }
3512       *pp = pAux->pNextAux;
3513       sqlite3DbFree(db, pAux);
3514     }else{
3515       pp= &pAux->pNextAux;
3516     }
3517   }
3518 }
3519 
3520 /*
3521 ** Free all memory associated with the Vdbe passed as the second argument,
3522 ** except for object itself, which is preserved.
3523 **
3524 ** The difference between this function and sqlite3VdbeDelete() is that
3525 ** VdbeDelete() also unlinks the Vdbe from the list of VMs associated with
3526 ** the database connection and frees the object itself.
3527 */
3528 static void sqlite3VdbeClearObject(sqlite3 *db, Vdbe *p){
3529   SubProgram *pSub, *pNext;
3530   assert( p->db==0 || p->db==db );
3531   if( p->aColName ){
3532     releaseMemArray(p->aColName, p->nResColumn*COLNAME_N);
3533     sqlite3DbFreeNN(db, p->aColName);
3534   }
3535   for(pSub=p->pProgram; pSub; pSub=pNext){
3536     pNext = pSub->pNext;
3537     vdbeFreeOpArray(db, pSub->aOp, pSub->nOp);
3538     sqlite3DbFree(db, pSub);
3539   }
3540   if( p->eVdbeState!=VDBE_INIT_STATE ){
3541     releaseMemArray(p->aVar, p->nVar);
3542     if( p->pVList ) sqlite3DbFreeNN(db, p->pVList);
3543     if( p->pFree ) sqlite3DbFreeNN(db, p->pFree);
3544   }
3545   vdbeFreeOpArray(db, p->aOp, p->nOp);
3546   sqlite3DbFree(db, p->zSql);
3547 #ifdef SQLITE_ENABLE_NORMALIZE
3548   sqlite3DbFree(db, p->zNormSql);
3549   {
3550     DblquoteStr *pThis, *pNext;
3551     for(pThis=p->pDblStr; pThis; pThis=pNext){
3552       pNext = pThis->pNextStr;
3553       sqlite3DbFree(db, pThis);
3554     }
3555   }
3556 #endif
3557 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
3558   {
3559     int i;
3560     for(i=0; i<p->nScan; i++){
3561       sqlite3DbFree(db, p->aScan[i].zName);
3562     }
3563     sqlite3DbFree(db, p->aScan);
3564   }
3565 #endif
3566 }
3567 
3568 /*
3569 ** Delete an entire VDBE.
3570 */
3571 void sqlite3VdbeDelete(Vdbe *p){
3572   sqlite3 *db;
3573 
3574   assert( p!=0 );
3575   db = p->db;
3576   assert( sqlite3_mutex_held(db->mutex) );
3577   sqlite3VdbeClearObject(db, p);
3578   if( db->pnBytesFreed==0 ){
3579     if( p->pPrev ){
3580       p->pPrev->pNext = p->pNext;
3581     }else{
3582       assert( db->pVdbe==p );
3583       db->pVdbe = p->pNext;
3584     }
3585     if( p->pNext ){
3586       p->pNext->pPrev = p->pPrev;
3587     }
3588   }
3589   sqlite3DbFreeNN(db, p);
3590 }
3591 
3592 /*
3593 ** The cursor "p" has a pending seek operation that has not yet been
3594 ** carried out.  Seek the cursor now.  If an error occurs, return
3595 ** the appropriate error code.
3596 */
3597 int SQLITE_NOINLINE sqlite3VdbeFinishMoveto(VdbeCursor *p){
3598   int res, rc;
3599 #ifdef SQLITE_TEST
3600   extern int sqlite3_search_count;
3601 #endif
3602   assert( p->deferredMoveto );
3603   assert( p->isTable );
3604   assert( p->eCurType==CURTYPE_BTREE );
3605   rc = sqlite3BtreeTableMoveto(p->uc.pCursor, p->movetoTarget, 0, &res);
3606   if( rc ) return rc;
3607   if( res!=0 ) return SQLITE_CORRUPT_BKPT;
3608 #ifdef SQLITE_TEST
3609   sqlite3_search_count++;
3610 #endif
3611   p->deferredMoveto = 0;
3612   p->cacheStatus = CACHE_STALE;
3613   return SQLITE_OK;
3614 }
3615 
3616 /*
3617 ** Something has moved cursor "p" out of place.  Maybe the row it was
3618 ** pointed to was deleted out from under it.  Or maybe the btree was
3619 ** rebalanced.  Whatever the cause, try to restore "p" to the place it
3620 ** is supposed to be pointing.  If the row was deleted out from under the
3621 ** cursor, set the cursor to point to a NULL row.
3622 */
3623 int SQLITE_NOINLINE sqlite3VdbeHandleMovedCursor(VdbeCursor *p){
3624   int isDifferentRow, rc;
3625   assert( p->eCurType==CURTYPE_BTREE );
3626   assert( p->uc.pCursor!=0 );
3627   assert( sqlite3BtreeCursorHasMoved(p->uc.pCursor) );
3628   rc = sqlite3BtreeCursorRestore(p->uc.pCursor, &isDifferentRow);
3629   p->cacheStatus = CACHE_STALE;
3630   if( isDifferentRow ) p->nullRow = 1;
3631   return rc;
3632 }
3633 
3634 /*
3635 ** Check to ensure that the cursor is valid.  Restore the cursor
3636 ** if need be.  Return any I/O error from the restore operation.
3637 */
3638 int sqlite3VdbeCursorRestore(VdbeCursor *p){
3639   assert( p->eCurType==CURTYPE_BTREE || IsNullCursor(p) );
3640   if( sqlite3BtreeCursorHasMoved(p->uc.pCursor) ){
3641     return sqlite3VdbeHandleMovedCursor(p);
3642   }
3643   return SQLITE_OK;
3644 }
3645 
3646 /*
3647 ** The following functions:
3648 **
3649 ** sqlite3VdbeSerialType()
3650 ** sqlite3VdbeSerialTypeLen()
3651 ** sqlite3VdbeSerialLen()
3652 ** sqlite3VdbeSerialPut()  <--- in-lined into OP_MakeRecord as of 2022-04-02
3653 ** sqlite3VdbeSerialGet()
3654 **
3655 ** encapsulate the code that serializes values for storage in SQLite
3656 ** data and index records. Each serialized value consists of a
3657 ** 'serial-type' and a blob of data. The serial type is an 8-byte unsigned
3658 ** integer, stored as a varint.
3659 **
3660 ** In an SQLite index record, the serial type is stored directly before
3661 ** the blob of data that it corresponds to. In a table record, all serial
3662 ** types are stored at the start of the record, and the blobs of data at
3663 ** the end. Hence these functions allow the caller to handle the
3664 ** serial-type and data blob separately.
3665 **
3666 ** The following table describes the various storage classes for data:
3667 **
3668 **   serial type        bytes of data      type
3669 **   --------------     ---------------    ---------------
3670 **      0                     0            NULL
3671 **      1                     1            signed integer
3672 **      2                     2            signed integer
3673 **      3                     3            signed integer
3674 **      4                     4            signed integer
3675 **      5                     6            signed integer
3676 **      6                     8            signed integer
3677 **      7                     8            IEEE float
3678 **      8                     0            Integer constant 0
3679 **      9                     0            Integer constant 1
3680 **     10,11                               reserved for expansion
3681 **    N>=12 and even       (N-12)/2        BLOB
3682 **    N>=13 and odd        (N-13)/2        text
3683 **
3684 ** The 8 and 9 types were added in 3.3.0, file format 4.  Prior versions
3685 ** of SQLite will not understand those serial types.
3686 */
3687 
3688 #if 0 /* Inlined into the OP_MakeRecord opcode */
3689 /*
3690 ** Return the serial-type for the value stored in pMem.
3691 **
3692 ** This routine might convert a large MEM_IntReal value into MEM_Real.
3693 **
3694 ** 2019-07-11:  The primary user of this subroutine was the OP_MakeRecord
3695 ** opcode in the byte-code engine.  But by moving this routine in-line, we
3696 ** can omit some redundant tests and make that opcode a lot faster.  So
3697 ** this routine is now only used by the STAT3 logic and STAT3 support has
3698 ** ended.  The code is kept here for historical reference only.
3699 */
3700 u32 sqlite3VdbeSerialType(Mem *pMem, int file_format, u32 *pLen){
3701   int flags = pMem->flags;
3702   u32 n;
3703 
3704   assert( pLen!=0 );
3705   if( flags&MEM_Null ){
3706     *pLen = 0;
3707     return 0;
3708   }
3709   if( flags&(MEM_Int|MEM_IntReal) ){
3710     /* Figure out whether to use 1, 2, 4, 6 or 8 bytes. */
3711 #   define MAX_6BYTE ((((i64)0x00008000)<<32)-1)
3712     i64 i = pMem->u.i;
3713     u64 u;
3714     testcase( flags & MEM_Int );
3715     testcase( flags & MEM_IntReal );
3716     if( i<0 ){
3717       u = ~i;
3718     }else{
3719       u = i;
3720     }
3721     if( u<=127 ){
3722       if( (i&1)==i && file_format>=4 ){
3723         *pLen = 0;
3724         return 8+(u32)u;
3725       }else{
3726         *pLen = 1;
3727         return 1;
3728       }
3729     }
3730     if( u<=32767 ){ *pLen = 2; return 2; }
3731     if( u<=8388607 ){ *pLen = 3; return 3; }
3732     if( u<=2147483647 ){ *pLen = 4; return 4; }
3733     if( u<=MAX_6BYTE ){ *pLen = 6; return 5; }
3734     *pLen = 8;
3735     if( flags&MEM_IntReal ){
3736       /* If the value is IntReal and is going to take up 8 bytes to store
3737       ** as an integer, then we might as well make it an 8-byte floating
3738       ** point value */
3739       pMem->u.r = (double)pMem->u.i;
3740       pMem->flags &= ~MEM_IntReal;
3741       pMem->flags |= MEM_Real;
3742       return 7;
3743     }
3744     return 6;
3745   }
3746   if( flags&MEM_Real ){
3747     *pLen = 8;
3748     return 7;
3749   }
3750   assert( pMem->db->mallocFailed || flags&(MEM_Str|MEM_Blob) );
3751   assert( pMem->n>=0 );
3752   n = (u32)pMem->n;
3753   if( flags & MEM_Zero ){
3754     n += pMem->u.nZero;
3755   }
3756   *pLen = n;
3757   return ((n*2) + 12 + ((flags&MEM_Str)!=0));
3758 }
3759 #endif /* inlined into OP_MakeRecord */
3760 
3761 /*
3762 ** The sizes for serial types less than 128
3763 */
3764 const u8 sqlite3SmallTypeSizes[128] = {
3765         /*  0   1   2   3   4   5   6   7   8   9 */
3766 /*   0 */   0,  1,  2,  3,  4,  6,  8,  8,  0,  0,
3767 /*  10 */   0,  0,  0,  0,  1,  1,  2,  2,  3,  3,
3768 /*  20 */   4,  4,  5,  5,  6,  6,  7,  7,  8,  8,
3769 /*  30 */   9,  9, 10, 10, 11, 11, 12, 12, 13, 13,
3770 /*  40 */  14, 14, 15, 15, 16, 16, 17, 17, 18, 18,
3771 /*  50 */  19, 19, 20, 20, 21, 21, 22, 22, 23, 23,
3772 /*  60 */  24, 24, 25, 25, 26, 26, 27, 27, 28, 28,
3773 /*  70 */  29, 29, 30, 30, 31, 31, 32, 32, 33, 33,
3774 /*  80 */  34, 34, 35, 35, 36, 36, 37, 37, 38, 38,
3775 /*  90 */  39, 39, 40, 40, 41, 41, 42, 42, 43, 43,
3776 /* 100 */  44, 44, 45, 45, 46, 46, 47, 47, 48, 48,
3777 /* 110 */  49, 49, 50, 50, 51, 51, 52, 52, 53, 53,
3778 /* 120 */  54, 54, 55, 55, 56, 56, 57, 57
3779 };
3780 
3781 /*
3782 ** Return the length of the data corresponding to the supplied serial-type.
3783 */
3784 u32 sqlite3VdbeSerialTypeLen(u32 serial_type){
3785   if( serial_type>=128 ){
3786     return (serial_type-12)/2;
3787   }else{
3788     assert( serial_type<12
3789             || sqlite3SmallTypeSizes[serial_type]==(serial_type - 12)/2 );
3790     return sqlite3SmallTypeSizes[serial_type];
3791   }
3792 }
3793 u8 sqlite3VdbeOneByteSerialTypeLen(u8 serial_type){
3794   assert( serial_type<128 );
3795   return sqlite3SmallTypeSizes[serial_type];
3796 }
3797 
3798 /*
3799 ** If we are on an architecture with mixed-endian floating
3800 ** points (ex: ARM7) then swap the lower 4 bytes with the
3801 ** upper 4 bytes.  Return the result.
3802 **
3803 ** For most architectures, this is a no-op.
3804 **
3805 ** (later):  It is reported to me that the mixed-endian problem
3806 ** on ARM7 is an issue with GCC, not with the ARM7 chip.  It seems
3807 ** that early versions of GCC stored the two words of a 64-bit
3808 ** float in the wrong order.  And that error has been propagated
3809 ** ever since.  The blame is not necessarily with GCC, though.
3810 ** GCC might have just copying the problem from a prior compiler.
3811 ** I am also told that newer versions of GCC that follow a different
3812 ** ABI get the byte order right.
3813 **
3814 ** Developers using SQLite on an ARM7 should compile and run their
3815 ** application using -DSQLITE_DEBUG=1 at least once.  With DEBUG
3816 ** enabled, some asserts below will ensure that the byte order of
3817 ** floating point values is correct.
3818 **
3819 ** (2007-08-30)  Frank van Vugt has studied this problem closely
3820 ** and has send his findings to the SQLite developers.  Frank
3821 ** writes that some Linux kernels offer floating point hardware
3822 ** emulation that uses only 32-bit mantissas instead of a full
3823 ** 48-bits as required by the IEEE standard.  (This is the
3824 ** CONFIG_FPE_FASTFPE option.)  On such systems, floating point
3825 ** byte swapping becomes very complicated.  To avoid problems,
3826 ** the necessary byte swapping is carried out using a 64-bit integer
3827 ** rather than a 64-bit float.  Frank assures us that the code here
3828 ** works for him.  We, the developers, have no way to independently
3829 ** verify this, but Frank seems to know what he is talking about
3830 ** so we trust him.
3831 */
3832 #ifdef SQLITE_MIXED_ENDIAN_64BIT_FLOAT
3833 u64 sqlite3FloatSwap(u64 in){
3834   union {
3835     u64 r;
3836     u32 i[2];
3837   } u;
3838   u32 t;
3839 
3840   u.r = in;
3841   t = u.i[0];
3842   u.i[0] = u.i[1];
3843   u.i[1] = t;
3844   return u.r;
3845 }
3846 #endif /* SQLITE_MIXED_ENDIAN_64BIT_FLOAT */
3847 
3848 
3849 /* Input "x" is a sequence of unsigned characters that represent a
3850 ** big-endian integer.  Return the equivalent native integer
3851 */
3852 #define ONE_BYTE_INT(x)    ((i8)(x)[0])
3853 #define TWO_BYTE_INT(x)    (256*(i8)((x)[0])|(x)[1])
3854 #define THREE_BYTE_INT(x)  (65536*(i8)((x)[0])|((x)[1]<<8)|(x)[2])
3855 #define FOUR_BYTE_UINT(x)  (((u32)(x)[0]<<24)|((x)[1]<<16)|((x)[2]<<8)|(x)[3])
3856 #define FOUR_BYTE_INT(x) (16777216*(i8)((x)[0])|((x)[1]<<16)|((x)[2]<<8)|(x)[3])
3857 
3858 /*
3859 ** Deserialize the data blob pointed to by buf as serial type serial_type
3860 ** and store the result in pMem.
3861 **
3862 ** This function is implemented as two separate routines for performance.
3863 ** The few cases that require local variables are broken out into a separate
3864 ** routine so that in most cases the overhead of moving the stack pointer
3865 ** is avoided.
3866 */
3867 static void serialGet(
3868   const unsigned char *buf,     /* Buffer to deserialize from */
3869   u32 serial_type,              /* Serial type to deserialize */
3870   Mem *pMem                     /* Memory cell to write value into */
3871 ){
3872   u64 x = FOUR_BYTE_UINT(buf);
3873   u32 y = FOUR_BYTE_UINT(buf+4);
3874   x = (x<<32) + y;
3875   if( serial_type==6 ){
3876     /* EVIDENCE-OF: R-29851-52272 Value is a big-endian 64-bit
3877     ** twos-complement integer. */
3878     pMem->u.i = *(i64*)&x;
3879     pMem->flags = MEM_Int;
3880     testcase( pMem->u.i<0 );
3881   }else{
3882     /* EVIDENCE-OF: R-57343-49114 Value is a big-endian IEEE 754-2008 64-bit
3883     ** floating point number. */
3884 #if !defined(NDEBUG) && !defined(SQLITE_OMIT_FLOATING_POINT)
3885     /* Verify that integers and floating point values use the same
3886     ** byte order.  Or, that if SQLITE_MIXED_ENDIAN_64BIT_FLOAT is
3887     ** defined that 64-bit floating point values really are mixed
3888     ** endian.
3889     */
3890     static const u64 t1 = ((u64)0x3ff00000)<<32;
3891     static const double r1 = 1.0;
3892     u64 t2 = t1;
3893     swapMixedEndianFloat(t2);
3894     assert( sizeof(r1)==sizeof(t2) && memcmp(&r1, &t2, sizeof(r1))==0 );
3895 #endif
3896     assert( sizeof(x)==8 && sizeof(pMem->u.r)==8 );
3897     swapMixedEndianFloat(x);
3898     memcpy(&pMem->u.r, &x, sizeof(x));
3899     pMem->flags = IsNaN(x) ? MEM_Null : MEM_Real;
3900   }
3901 }
3902 void sqlite3VdbeSerialGet(
3903   const unsigned char *buf,     /* Buffer to deserialize from */
3904   u32 serial_type,              /* Serial type to deserialize */
3905   Mem *pMem                     /* Memory cell to write value into */
3906 ){
3907   switch( serial_type ){
3908     case 10: { /* Internal use only: NULL with virtual table
3909                ** UPDATE no-change flag set */
3910       pMem->flags = MEM_Null|MEM_Zero;
3911       pMem->n = 0;
3912       pMem->u.nZero = 0;
3913       return;
3914     }
3915     case 11:   /* Reserved for future use */
3916     case 0: {  /* Null */
3917       /* EVIDENCE-OF: R-24078-09375 Value is a NULL. */
3918       pMem->flags = MEM_Null;
3919       return;
3920     }
3921     case 1: {
3922       /* EVIDENCE-OF: R-44885-25196 Value is an 8-bit twos-complement
3923       ** integer. */
3924       pMem->u.i = ONE_BYTE_INT(buf);
3925       pMem->flags = MEM_Int;
3926       testcase( pMem->u.i<0 );
3927       return;
3928     }
3929     case 2: { /* 2-byte signed integer */
3930       /* EVIDENCE-OF: R-49794-35026 Value is a big-endian 16-bit
3931       ** twos-complement integer. */
3932       pMem->u.i = TWO_BYTE_INT(buf);
3933       pMem->flags = MEM_Int;
3934       testcase( pMem->u.i<0 );
3935       return;
3936     }
3937     case 3: { /* 3-byte signed integer */
3938       /* EVIDENCE-OF: R-37839-54301 Value is a big-endian 24-bit
3939       ** twos-complement integer. */
3940       pMem->u.i = THREE_BYTE_INT(buf);
3941       pMem->flags = MEM_Int;
3942       testcase( pMem->u.i<0 );
3943       return;
3944     }
3945     case 4: { /* 4-byte signed integer */
3946       /* EVIDENCE-OF: R-01849-26079 Value is a big-endian 32-bit
3947       ** twos-complement integer. */
3948       pMem->u.i = FOUR_BYTE_INT(buf);
3949 #ifdef __HP_cc
3950       /* Work around a sign-extension bug in the HP compiler for HP/UX */
3951       if( buf[0]&0x80 ) pMem->u.i |= 0xffffffff80000000LL;
3952 #endif
3953       pMem->flags = MEM_Int;
3954       testcase( pMem->u.i<0 );
3955       return;
3956     }
3957     case 5: { /* 6-byte signed integer */
3958       /* EVIDENCE-OF: R-50385-09674 Value is a big-endian 48-bit
3959       ** twos-complement integer. */
3960       pMem->u.i = FOUR_BYTE_UINT(buf+2) + (((i64)1)<<32)*TWO_BYTE_INT(buf);
3961       pMem->flags = MEM_Int;
3962       testcase( pMem->u.i<0 );
3963       return;
3964     }
3965     case 6:   /* 8-byte signed integer */
3966     case 7: { /* IEEE floating point */
3967       /* These use local variables, so do them in a separate routine
3968       ** to avoid having to move the frame pointer in the common case */
3969       serialGet(buf,serial_type,pMem);
3970       return;
3971     }
3972     case 8:    /* Integer 0 */
3973     case 9: {  /* Integer 1 */
3974       /* EVIDENCE-OF: R-12976-22893 Value is the integer 0. */
3975       /* EVIDENCE-OF: R-18143-12121 Value is the integer 1. */
3976       pMem->u.i = serial_type-8;
3977       pMem->flags = MEM_Int;
3978       return;
3979     }
3980     default: {
3981       /* EVIDENCE-OF: R-14606-31564 Value is a BLOB that is (N-12)/2 bytes in
3982       ** length.
3983       ** EVIDENCE-OF: R-28401-00140 Value is a string in the text encoding and
3984       ** (N-13)/2 bytes in length. */
3985       static const u16 aFlag[] = { MEM_Blob|MEM_Ephem, MEM_Str|MEM_Ephem };
3986       pMem->z = (char *)buf;
3987       pMem->n = (serial_type-12)/2;
3988       pMem->flags = aFlag[serial_type&1];
3989       return;
3990     }
3991   }
3992   return;
3993 }
3994 /*
3995 ** This routine is used to allocate sufficient space for an UnpackedRecord
3996 ** structure large enough to be used with sqlite3VdbeRecordUnpack() if
3997 ** the first argument is a pointer to KeyInfo structure pKeyInfo.
3998 **
3999 ** The space is either allocated using sqlite3DbMallocRaw() or from within
4000 ** the unaligned buffer passed via the second and third arguments (presumably
4001 ** stack space). If the former, then *ppFree is set to a pointer that should
4002 ** be eventually freed by the caller using sqlite3DbFree(). Or, if the
4003 ** allocation comes from the pSpace/szSpace buffer, *ppFree is set to NULL
4004 ** before returning.
4005 **
4006 ** If an OOM error occurs, NULL is returned.
4007 */
4008 UnpackedRecord *sqlite3VdbeAllocUnpackedRecord(
4009   KeyInfo *pKeyInfo               /* Description of the record */
4010 ){
4011   UnpackedRecord *p;              /* Unpacked record to return */
4012   int nByte;                      /* Number of bytes required for *p */
4013   nByte = ROUND8P(sizeof(UnpackedRecord)) + sizeof(Mem)*(pKeyInfo->nKeyField+1);
4014   p = (UnpackedRecord *)sqlite3DbMallocRaw(pKeyInfo->db, nByte);
4015   if( !p ) return 0;
4016   p->aMem = (Mem*)&((char*)p)[ROUND8P(sizeof(UnpackedRecord))];
4017   assert( pKeyInfo->aSortFlags!=0 );
4018   p->pKeyInfo = pKeyInfo;
4019   p->nField = pKeyInfo->nKeyField + 1;
4020   return p;
4021 }
4022 
4023 /*
4024 ** Given the nKey-byte encoding of a record in pKey[], populate the
4025 ** UnpackedRecord structure indicated by the fourth argument with the
4026 ** contents of the decoded record.
4027 */
4028 void sqlite3VdbeRecordUnpack(
4029   KeyInfo *pKeyInfo,     /* Information about the record format */
4030   int nKey,              /* Size of the binary record */
4031   const void *pKey,      /* The binary record */
4032   UnpackedRecord *p      /* Populate this structure before returning. */
4033 ){
4034   const unsigned char *aKey = (const unsigned char *)pKey;
4035   u32 d;
4036   u32 idx;                        /* Offset in aKey[] to read from */
4037   u16 u;                          /* Unsigned loop counter */
4038   u32 szHdr;
4039   Mem *pMem = p->aMem;
4040 
4041   p->default_rc = 0;
4042   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
4043   idx = getVarint32(aKey, szHdr);
4044   d = szHdr;
4045   u = 0;
4046   while( idx<szHdr && d<=(u32)nKey ){
4047     u32 serial_type;
4048 
4049     idx += getVarint32(&aKey[idx], serial_type);
4050     pMem->enc = pKeyInfo->enc;
4051     pMem->db = pKeyInfo->db;
4052     /* pMem->flags = 0; // sqlite3VdbeSerialGet() will set this for us */
4053     pMem->szMalloc = 0;
4054     pMem->z = 0;
4055     sqlite3VdbeSerialGet(&aKey[d], serial_type, pMem);
4056     d += sqlite3VdbeSerialTypeLen(serial_type);
4057     pMem++;
4058     if( (++u)>=p->nField ) break;
4059   }
4060   if( d>(u32)nKey && u ){
4061     assert( CORRUPT_DB );
4062     /* In a corrupt record entry, the last pMem might have been set up using
4063     ** uninitialized memory. Overwrite its value with NULL, to prevent
4064     ** warnings from MSAN. */
4065     sqlite3VdbeMemSetNull(pMem-1);
4066   }
4067   assert( u<=pKeyInfo->nKeyField + 1 );
4068   p->nField = u;
4069 }
4070 
4071 #ifdef SQLITE_DEBUG
4072 /*
4073 ** This function compares two index or table record keys in the same way
4074 ** as the sqlite3VdbeRecordCompare() routine. Unlike VdbeRecordCompare(),
4075 ** this function deserializes and compares values using the
4076 ** sqlite3VdbeSerialGet() and sqlite3MemCompare() functions. It is used
4077 ** in assert() statements to ensure that the optimized code in
4078 ** sqlite3VdbeRecordCompare() returns results with these two primitives.
4079 **
4080 ** Return true if the result of comparison is equivalent to desiredResult.
4081 ** Return false if there is a disagreement.
4082 */
4083 static int vdbeRecordCompareDebug(
4084   int nKey1, const void *pKey1, /* Left key */
4085   const UnpackedRecord *pPKey2, /* Right key */
4086   int desiredResult             /* Correct answer */
4087 ){
4088   u32 d1;            /* Offset into aKey[] of next data element */
4089   u32 idx1;          /* Offset into aKey[] of next header element */
4090   u32 szHdr1;        /* Number of bytes in header */
4091   int i = 0;
4092   int rc = 0;
4093   const unsigned char *aKey1 = (const unsigned char *)pKey1;
4094   KeyInfo *pKeyInfo;
4095   Mem mem1;
4096 
4097   pKeyInfo = pPKey2->pKeyInfo;
4098   if( pKeyInfo->db==0 ) return 1;
4099   mem1.enc = pKeyInfo->enc;
4100   mem1.db = pKeyInfo->db;
4101   /* mem1.flags = 0;  // Will be initialized by sqlite3VdbeSerialGet() */
4102   VVA_ONLY( mem1.szMalloc = 0; ) /* Only needed by assert() statements */
4103 
4104   /* Compilers may complain that mem1.u.i is potentially uninitialized.
4105   ** We could initialize it, as shown here, to silence those complaints.
4106   ** But in fact, mem1.u.i will never actually be used uninitialized, and doing
4107   ** the unnecessary initialization has a measurable negative performance
4108   ** impact, since this routine is a very high runner.  And so, we choose
4109   ** to ignore the compiler warnings and leave this variable uninitialized.
4110   */
4111   /*  mem1.u.i = 0;  // not needed, here to silence compiler warning */
4112 
4113   idx1 = getVarint32(aKey1, szHdr1);
4114   if( szHdr1>98307 ) return SQLITE_CORRUPT;
4115   d1 = szHdr1;
4116   assert( pKeyInfo->nAllField>=pPKey2->nField || CORRUPT_DB );
4117   assert( pKeyInfo->aSortFlags!=0 );
4118   assert( pKeyInfo->nKeyField>0 );
4119   assert( idx1<=szHdr1 || CORRUPT_DB );
4120   do{
4121     u32 serial_type1;
4122 
4123     /* Read the serial types for the next element in each key. */
4124     idx1 += getVarint32( aKey1+idx1, serial_type1 );
4125 
4126     /* Verify that there is enough key space remaining to avoid
4127     ** a buffer overread.  The "d1+serial_type1+2" subexpression will
4128     ** always be greater than or equal to the amount of required key space.
4129     ** Use that approximation to avoid the more expensive call to
4130     ** sqlite3VdbeSerialTypeLen() in the common case.
4131     */
4132     if( d1+(u64)serial_type1+2>(u64)nKey1
4133      && d1+(u64)sqlite3VdbeSerialTypeLen(serial_type1)>(u64)nKey1
4134     ){
4135       break;
4136     }
4137 
4138     /* Extract the values to be compared.
4139     */
4140     sqlite3VdbeSerialGet(&aKey1[d1], serial_type1, &mem1);
4141     d1 += sqlite3VdbeSerialTypeLen(serial_type1);
4142 
4143     /* Do the comparison
4144     */
4145     rc = sqlite3MemCompare(&mem1, &pPKey2->aMem[i],
4146                            pKeyInfo->nAllField>i ? pKeyInfo->aColl[i] : 0);
4147     if( rc!=0 ){
4148       assert( mem1.szMalloc==0 );  /* See comment below */
4149       if( (pKeyInfo->aSortFlags[i] & KEYINFO_ORDER_BIGNULL)
4150        && ((mem1.flags & MEM_Null) || (pPKey2->aMem[i].flags & MEM_Null))
4151       ){
4152         rc = -rc;
4153       }
4154       if( pKeyInfo->aSortFlags[i] & KEYINFO_ORDER_DESC ){
4155         rc = -rc;  /* Invert the result for DESC sort order. */
4156       }
4157       goto debugCompareEnd;
4158     }
4159     i++;
4160   }while( idx1<szHdr1 && i<pPKey2->nField );
4161 
4162   /* No memory allocation is ever used on mem1.  Prove this using
4163   ** the following assert().  If the assert() fails, it indicates a
4164   ** memory leak and a need to call sqlite3VdbeMemRelease(&mem1).
4165   */
4166   assert( mem1.szMalloc==0 );
4167 
4168   /* rc==0 here means that one of the keys ran out of fields and
4169   ** all the fields up to that point were equal. Return the default_rc
4170   ** value.  */
4171   rc = pPKey2->default_rc;
4172 
4173 debugCompareEnd:
4174   if( desiredResult==0 && rc==0 ) return 1;
4175   if( desiredResult<0 && rc<0 ) return 1;
4176   if( desiredResult>0 && rc>0 ) return 1;
4177   if( CORRUPT_DB ) return 1;
4178   if( pKeyInfo->db->mallocFailed ) return 1;
4179   return 0;
4180 }
4181 #endif
4182 
4183 #ifdef SQLITE_DEBUG
4184 /*
4185 ** Count the number of fields (a.k.a. columns) in the record given by
4186 ** pKey,nKey.  The verify that this count is less than or equal to the
4187 ** limit given by pKeyInfo->nAllField.
4188 **
4189 ** If this constraint is not satisfied, it means that the high-speed
4190 ** vdbeRecordCompareInt() and vdbeRecordCompareString() routines will
4191 ** not work correctly.  If this assert() ever fires, it probably means
4192 ** that the KeyInfo.nKeyField or KeyInfo.nAllField values were computed
4193 ** incorrectly.
4194 */
4195 static void vdbeAssertFieldCountWithinLimits(
4196   int nKey, const void *pKey,   /* The record to verify */
4197   const KeyInfo *pKeyInfo       /* Compare size with this KeyInfo */
4198 ){
4199   int nField = 0;
4200   u32 szHdr;
4201   u32 idx;
4202   u32 notUsed;
4203   const unsigned char *aKey = (const unsigned char*)pKey;
4204 
4205   if( CORRUPT_DB ) return;
4206   idx = getVarint32(aKey, szHdr);
4207   assert( nKey>=0 );
4208   assert( szHdr<=(u32)nKey );
4209   while( idx<szHdr ){
4210     idx += getVarint32(aKey+idx, notUsed);
4211     nField++;
4212   }
4213   assert( nField <= pKeyInfo->nAllField );
4214 }
4215 #else
4216 # define vdbeAssertFieldCountWithinLimits(A,B,C)
4217 #endif
4218 
4219 /*
4220 ** Both *pMem1 and *pMem2 contain string values. Compare the two values
4221 ** using the collation sequence pColl. As usual, return a negative , zero
4222 ** or positive value if *pMem1 is less than, equal to or greater than
4223 ** *pMem2, respectively. Similar in spirit to "rc = (*pMem1) - (*pMem2);".
4224 */
4225 static int vdbeCompareMemString(
4226   const Mem *pMem1,
4227   const Mem *pMem2,
4228   const CollSeq *pColl,
4229   u8 *prcErr                      /* If an OOM occurs, set to SQLITE_NOMEM */
4230 ){
4231   if( pMem1->enc==pColl->enc ){
4232     /* The strings are already in the correct encoding.  Call the
4233      ** comparison function directly */
4234     return pColl->xCmp(pColl->pUser,pMem1->n,pMem1->z,pMem2->n,pMem2->z);
4235   }else{
4236     int rc;
4237     const void *v1, *v2;
4238     Mem c1;
4239     Mem c2;
4240     sqlite3VdbeMemInit(&c1, pMem1->db, MEM_Null);
4241     sqlite3VdbeMemInit(&c2, pMem1->db, MEM_Null);
4242     sqlite3VdbeMemShallowCopy(&c1, pMem1, MEM_Ephem);
4243     sqlite3VdbeMemShallowCopy(&c2, pMem2, MEM_Ephem);
4244     v1 = sqlite3ValueText((sqlite3_value*)&c1, pColl->enc);
4245     v2 = sqlite3ValueText((sqlite3_value*)&c2, pColl->enc);
4246     if( (v1==0 || v2==0) ){
4247       if( prcErr ) *prcErr = SQLITE_NOMEM_BKPT;
4248       rc = 0;
4249     }else{
4250       rc = pColl->xCmp(pColl->pUser, c1.n, v1, c2.n, v2);
4251     }
4252     sqlite3VdbeMemReleaseMalloc(&c1);
4253     sqlite3VdbeMemReleaseMalloc(&c2);
4254     return rc;
4255   }
4256 }
4257 
4258 /*
4259 ** The input pBlob is guaranteed to be a Blob that is not marked
4260 ** with MEM_Zero.  Return true if it could be a zero-blob.
4261 */
4262 static int isAllZero(const char *z, int n){
4263   int i;
4264   for(i=0; i<n; i++){
4265     if( z[i] ) return 0;
4266   }
4267   return 1;
4268 }
4269 
4270 /*
4271 ** Compare two blobs.  Return negative, zero, or positive if the first
4272 ** is less than, equal to, or greater than the second, respectively.
4273 ** If one blob is a prefix of the other, then the shorter is the lessor.
4274 */
4275 SQLITE_NOINLINE int sqlite3BlobCompare(const Mem *pB1, const Mem *pB2){
4276   int c;
4277   int n1 = pB1->n;
4278   int n2 = pB2->n;
4279 
4280   /* It is possible to have a Blob value that has some non-zero content
4281   ** followed by zero content.  But that only comes up for Blobs formed
4282   ** by the OP_MakeRecord opcode, and such Blobs never get passed into
4283   ** sqlite3MemCompare(). */
4284   assert( (pB1->flags & MEM_Zero)==0 || n1==0 );
4285   assert( (pB2->flags & MEM_Zero)==0 || n2==0 );
4286 
4287   if( (pB1->flags|pB2->flags) & MEM_Zero ){
4288     if( pB1->flags & pB2->flags & MEM_Zero ){
4289       return pB1->u.nZero - pB2->u.nZero;
4290     }else if( pB1->flags & MEM_Zero ){
4291       if( !isAllZero(pB2->z, pB2->n) ) return -1;
4292       return pB1->u.nZero - n2;
4293     }else{
4294       if( !isAllZero(pB1->z, pB1->n) ) return +1;
4295       return n1 - pB2->u.nZero;
4296     }
4297   }
4298   c = memcmp(pB1->z, pB2->z, n1>n2 ? n2 : n1);
4299   if( c ) return c;
4300   return n1 - n2;
4301 }
4302 
4303 /*
4304 ** Do a comparison between a 64-bit signed integer and a 64-bit floating-point
4305 ** number.  Return negative, zero, or positive if the first (i64) is less than,
4306 ** equal to, or greater than the second (double).
4307 */
4308 int sqlite3IntFloatCompare(i64 i, double r){
4309   if( sizeof(LONGDOUBLE_TYPE)>8 ){
4310     LONGDOUBLE_TYPE x = (LONGDOUBLE_TYPE)i;
4311     testcase( x<r );
4312     testcase( x>r );
4313     testcase( x==r );
4314     if( x<r ) return -1;
4315     if( x>r ) return +1;  /*NO_TEST*/ /* work around bugs in gcov */
4316     return 0;             /*NO_TEST*/ /* work around bugs in gcov */
4317   }else{
4318     i64 y;
4319     double s;
4320     if( r<-9223372036854775808.0 ) return +1;
4321     if( r>=9223372036854775808.0 ) return -1;
4322     y = (i64)r;
4323     if( i<y ) return -1;
4324     if( i>y ) return +1;
4325     s = (double)i;
4326     if( s<r ) return -1;
4327     if( s>r ) return +1;
4328     return 0;
4329   }
4330 }
4331 
4332 /*
4333 ** Compare the values contained by the two memory cells, returning
4334 ** negative, zero or positive if pMem1 is less than, equal to, or greater
4335 ** than pMem2. Sorting order is NULL's first, followed by numbers (integers
4336 ** and reals) sorted numerically, followed by text ordered by the collating
4337 ** sequence pColl and finally blob's ordered by memcmp().
4338 **
4339 ** Two NULL values are considered equal by this function.
4340 */
4341 int sqlite3MemCompare(const Mem *pMem1, const Mem *pMem2, const CollSeq *pColl){
4342   int f1, f2;
4343   int combined_flags;
4344 
4345   f1 = pMem1->flags;
4346   f2 = pMem2->flags;
4347   combined_flags = f1|f2;
4348   assert( !sqlite3VdbeMemIsRowSet(pMem1) && !sqlite3VdbeMemIsRowSet(pMem2) );
4349 
4350   /* If one value is NULL, it is less than the other. If both values
4351   ** are NULL, return 0.
4352   */
4353   if( combined_flags&MEM_Null ){
4354     return (f2&MEM_Null) - (f1&MEM_Null);
4355   }
4356 
4357   /* At least one of the two values is a number
4358   */
4359   if( combined_flags&(MEM_Int|MEM_Real|MEM_IntReal) ){
4360     testcase( combined_flags & MEM_Int );
4361     testcase( combined_flags & MEM_Real );
4362     testcase( combined_flags & MEM_IntReal );
4363     if( (f1 & f2 & (MEM_Int|MEM_IntReal))!=0 ){
4364       testcase( f1 & f2 & MEM_Int );
4365       testcase( f1 & f2 & MEM_IntReal );
4366       if( pMem1->u.i < pMem2->u.i ) return -1;
4367       if( pMem1->u.i > pMem2->u.i ) return +1;
4368       return 0;
4369     }
4370     if( (f1 & f2 & MEM_Real)!=0 ){
4371       if( pMem1->u.r < pMem2->u.r ) return -1;
4372       if( pMem1->u.r > pMem2->u.r ) return +1;
4373       return 0;
4374     }
4375     if( (f1&(MEM_Int|MEM_IntReal))!=0 ){
4376       testcase( f1 & MEM_Int );
4377       testcase( f1 & MEM_IntReal );
4378       if( (f2&MEM_Real)!=0 ){
4379         return sqlite3IntFloatCompare(pMem1->u.i, pMem2->u.r);
4380       }else if( (f2&(MEM_Int|MEM_IntReal))!=0 ){
4381         if( pMem1->u.i < pMem2->u.i ) return -1;
4382         if( pMem1->u.i > pMem2->u.i ) return +1;
4383         return 0;
4384       }else{
4385         return -1;
4386       }
4387     }
4388     if( (f1&MEM_Real)!=0 ){
4389       if( (f2&(MEM_Int|MEM_IntReal))!=0 ){
4390         testcase( f2 & MEM_Int );
4391         testcase( f2 & MEM_IntReal );
4392         return -sqlite3IntFloatCompare(pMem2->u.i, pMem1->u.r);
4393       }else{
4394         return -1;
4395       }
4396     }
4397     return +1;
4398   }
4399 
4400   /* If one value is a string and the other is a blob, the string is less.
4401   ** If both are strings, compare using the collating functions.
4402   */
4403   if( combined_flags&MEM_Str ){
4404     if( (f1 & MEM_Str)==0 ){
4405       return 1;
4406     }
4407     if( (f2 & MEM_Str)==0 ){
4408       return -1;
4409     }
4410 
4411     assert( pMem1->enc==pMem2->enc || pMem1->db->mallocFailed );
4412     assert( pMem1->enc==SQLITE_UTF8 ||
4413             pMem1->enc==SQLITE_UTF16LE || pMem1->enc==SQLITE_UTF16BE );
4414 
4415     /* The collation sequence must be defined at this point, even if
4416     ** the user deletes the collation sequence after the vdbe program is
4417     ** compiled (this was not always the case).
4418     */
4419     assert( !pColl || pColl->xCmp );
4420 
4421     if( pColl ){
4422       return vdbeCompareMemString(pMem1, pMem2, pColl, 0);
4423     }
4424     /* If a NULL pointer was passed as the collate function, fall through
4425     ** to the blob case and use memcmp().  */
4426   }
4427 
4428   /* Both values must be blobs.  Compare using memcmp().  */
4429   return sqlite3BlobCompare(pMem1, pMem2);
4430 }
4431 
4432 
4433 /*
4434 ** The first argument passed to this function is a serial-type that
4435 ** corresponds to an integer - all values between 1 and 9 inclusive
4436 ** except 7. The second points to a buffer containing an integer value
4437 ** serialized according to serial_type. This function deserializes
4438 ** and returns the value.
4439 */
4440 static i64 vdbeRecordDecodeInt(u32 serial_type, const u8 *aKey){
4441   u32 y;
4442   assert( CORRUPT_DB || (serial_type>=1 && serial_type<=9 && serial_type!=7) );
4443   switch( serial_type ){
4444     case 0:
4445     case 1:
4446       testcase( aKey[0]&0x80 );
4447       return ONE_BYTE_INT(aKey);
4448     case 2:
4449       testcase( aKey[0]&0x80 );
4450       return TWO_BYTE_INT(aKey);
4451     case 3:
4452       testcase( aKey[0]&0x80 );
4453       return THREE_BYTE_INT(aKey);
4454     case 4: {
4455       testcase( aKey[0]&0x80 );
4456       y = FOUR_BYTE_UINT(aKey);
4457       return (i64)*(int*)&y;
4458     }
4459     case 5: {
4460       testcase( aKey[0]&0x80 );
4461       return FOUR_BYTE_UINT(aKey+2) + (((i64)1)<<32)*TWO_BYTE_INT(aKey);
4462     }
4463     case 6: {
4464       u64 x = FOUR_BYTE_UINT(aKey);
4465       testcase( aKey[0]&0x80 );
4466       x = (x<<32) | FOUR_BYTE_UINT(aKey+4);
4467       return (i64)*(i64*)&x;
4468     }
4469   }
4470 
4471   return (serial_type - 8);
4472 }
4473 
4474 /*
4475 ** This function compares the two table rows or index records
4476 ** specified by {nKey1, pKey1} and pPKey2.  It returns a negative, zero
4477 ** or positive integer if key1 is less than, equal to or
4478 ** greater than key2.  The {nKey1, pKey1} key must be a blob
4479 ** created by the OP_MakeRecord opcode of the VDBE.  The pPKey2
4480 ** key must be a parsed key such as obtained from
4481 ** sqlite3VdbeParseRecord.
4482 **
4483 ** If argument bSkip is non-zero, it is assumed that the caller has already
4484 ** determined that the first fields of the keys are equal.
4485 **
4486 ** Key1 and Key2 do not have to contain the same number of fields. If all
4487 ** fields that appear in both keys are equal, then pPKey2->default_rc is
4488 ** returned.
4489 **
4490 ** If database corruption is discovered, set pPKey2->errCode to
4491 ** SQLITE_CORRUPT and return 0. If an OOM error is encountered,
4492 ** pPKey2->errCode is set to SQLITE_NOMEM and, if it is not NULL, the
4493 ** malloc-failed flag set on database handle (pPKey2->pKeyInfo->db).
4494 */
4495 int sqlite3VdbeRecordCompareWithSkip(
4496   int nKey1, const void *pKey1,   /* Left key */
4497   UnpackedRecord *pPKey2,         /* Right key */
4498   int bSkip                       /* If true, skip the first field */
4499 ){
4500   u32 d1;                         /* Offset into aKey[] of next data element */
4501   int i;                          /* Index of next field to compare */
4502   u32 szHdr1;                     /* Size of record header in bytes */
4503   u32 idx1;                       /* Offset of first type in header */
4504   int rc = 0;                     /* Return value */
4505   Mem *pRhs = pPKey2->aMem;       /* Next field of pPKey2 to compare */
4506   KeyInfo *pKeyInfo;
4507   const unsigned char *aKey1 = (const unsigned char *)pKey1;
4508   Mem mem1;
4509 
4510   /* If bSkip is true, then the caller has already determined that the first
4511   ** two elements in the keys are equal. Fix the various stack variables so
4512   ** that this routine begins comparing at the second field. */
4513   if( bSkip ){
4514     u32 s1 = aKey1[1];
4515     if( s1<0x80 ){
4516       idx1 = 2;
4517     }else{
4518       idx1 = 1 + sqlite3GetVarint32(&aKey1[1], &s1);
4519     }
4520     szHdr1 = aKey1[0];
4521     d1 = szHdr1 + sqlite3VdbeSerialTypeLen(s1);
4522     i = 1;
4523     pRhs++;
4524   }else{
4525     if( (szHdr1 = aKey1[0])<0x80 ){
4526       idx1 = 1;
4527     }else{
4528       idx1 = sqlite3GetVarint32(aKey1, &szHdr1);
4529     }
4530     d1 = szHdr1;
4531     i = 0;
4532   }
4533   if( d1>(unsigned)nKey1 ){
4534     pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4535     return 0;  /* Corruption */
4536   }
4537 
4538   VVA_ONLY( mem1.szMalloc = 0; ) /* Only needed by assert() statements */
4539   assert( pPKey2->pKeyInfo->nAllField>=pPKey2->nField
4540        || CORRUPT_DB );
4541   assert( pPKey2->pKeyInfo->aSortFlags!=0 );
4542   assert( pPKey2->pKeyInfo->nKeyField>0 );
4543   assert( idx1<=szHdr1 || CORRUPT_DB );
4544   do{
4545     u32 serial_type;
4546 
4547     /* RHS is an integer */
4548     if( pRhs->flags & (MEM_Int|MEM_IntReal) ){
4549       testcase( pRhs->flags & MEM_Int );
4550       testcase( pRhs->flags & MEM_IntReal );
4551       serial_type = aKey1[idx1];
4552       testcase( serial_type==12 );
4553       if( serial_type>=10 ){
4554         rc = +1;
4555       }else if( serial_type==0 ){
4556         rc = -1;
4557       }else if( serial_type==7 ){
4558         sqlite3VdbeSerialGet(&aKey1[d1], serial_type, &mem1);
4559         rc = -sqlite3IntFloatCompare(pRhs->u.i, mem1.u.r);
4560       }else{
4561         i64 lhs = vdbeRecordDecodeInt(serial_type, &aKey1[d1]);
4562         i64 rhs = pRhs->u.i;
4563         if( lhs<rhs ){
4564           rc = -1;
4565         }else if( lhs>rhs ){
4566           rc = +1;
4567         }
4568       }
4569     }
4570 
4571     /* RHS is real */
4572     else if( pRhs->flags & MEM_Real ){
4573       serial_type = aKey1[idx1];
4574       if( serial_type>=10 ){
4575         /* Serial types 12 or greater are strings and blobs (greater than
4576         ** numbers). Types 10 and 11 are currently "reserved for future
4577         ** use", so it doesn't really matter what the results of comparing
4578         ** them to numberic values are.  */
4579         rc = +1;
4580       }else if( serial_type==0 ){
4581         rc = -1;
4582       }else{
4583         sqlite3VdbeSerialGet(&aKey1[d1], serial_type, &mem1);
4584         if( serial_type==7 ){
4585           if( mem1.u.r<pRhs->u.r ){
4586             rc = -1;
4587           }else if( mem1.u.r>pRhs->u.r ){
4588             rc = +1;
4589           }
4590         }else{
4591           rc = sqlite3IntFloatCompare(mem1.u.i, pRhs->u.r);
4592         }
4593       }
4594     }
4595 
4596     /* RHS is a string */
4597     else if( pRhs->flags & MEM_Str ){
4598       getVarint32NR(&aKey1[idx1], serial_type);
4599       testcase( serial_type==12 );
4600       if( serial_type<12 ){
4601         rc = -1;
4602       }else if( !(serial_type & 0x01) ){
4603         rc = +1;
4604       }else{
4605         mem1.n = (serial_type - 12) / 2;
4606         testcase( (d1+mem1.n)==(unsigned)nKey1 );
4607         testcase( (d1+mem1.n+1)==(unsigned)nKey1 );
4608         if( (d1+mem1.n) > (unsigned)nKey1
4609          || (pKeyInfo = pPKey2->pKeyInfo)->nAllField<=i
4610         ){
4611           pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4612           return 0;                /* Corruption */
4613         }else if( pKeyInfo->aColl[i] ){
4614           mem1.enc = pKeyInfo->enc;
4615           mem1.db = pKeyInfo->db;
4616           mem1.flags = MEM_Str;
4617           mem1.z = (char*)&aKey1[d1];
4618           rc = vdbeCompareMemString(
4619               &mem1, pRhs, pKeyInfo->aColl[i], &pPKey2->errCode
4620           );
4621         }else{
4622           int nCmp = MIN(mem1.n, pRhs->n);
4623           rc = memcmp(&aKey1[d1], pRhs->z, nCmp);
4624           if( rc==0 ) rc = mem1.n - pRhs->n;
4625         }
4626       }
4627     }
4628 
4629     /* RHS is a blob */
4630     else if( pRhs->flags & MEM_Blob ){
4631       assert( (pRhs->flags & MEM_Zero)==0 || pRhs->n==0 );
4632       getVarint32NR(&aKey1[idx1], serial_type);
4633       testcase( serial_type==12 );
4634       if( serial_type<12 || (serial_type & 0x01) ){
4635         rc = -1;
4636       }else{
4637         int nStr = (serial_type - 12) / 2;
4638         testcase( (d1+nStr)==(unsigned)nKey1 );
4639         testcase( (d1+nStr+1)==(unsigned)nKey1 );
4640         if( (d1+nStr) > (unsigned)nKey1 ){
4641           pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4642           return 0;                /* Corruption */
4643         }else if( pRhs->flags & MEM_Zero ){
4644           if( !isAllZero((const char*)&aKey1[d1],nStr) ){
4645             rc = 1;
4646           }else{
4647             rc = nStr - pRhs->u.nZero;
4648           }
4649         }else{
4650           int nCmp = MIN(nStr, pRhs->n);
4651           rc = memcmp(&aKey1[d1], pRhs->z, nCmp);
4652           if( rc==0 ) rc = nStr - pRhs->n;
4653         }
4654       }
4655     }
4656 
4657     /* RHS is null */
4658     else{
4659       serial_type = aKey1[idx1];
4660       rc = (serial_type!=0);
4661     }
4662 
4663     if( rc!=0 ){
4664       int sortFlags = pPKey2->pKeyInfo->aSortFlags[i];
4665       if( sortFlags ){
4666         if( (sortFlags & KEYINFO_ORDER_BIGNULL)==0
4667          || ((sortFlags & KEYINFO_ORDER_DESC)
4668            !=(serial_type==0 || (pRhs->flags&MEM_Null)))
4669         ){
4670           rc = -rc;
4671         }
4672       }
4673       assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, rc) );
4674       assert( mem1.szMalloc==0 );  /* See comment below */
4675       return rc;
4676     }
4677 
4678     i++;
4679     if( i==pPKey2->nField ) break;
4680     pRhs++;
4681     d1 += sqlite3VdbeSerialTypeLen(serial_type);
4682     idx1 += sqlite3VarintLen(serial_type);
4683   }while( idx1<(unsigned)szHdr1 && d1<=(unsigned)nKey1 );
4684 
4685   /* No memory allocation is ever used on mem1.  Prove this using
4686   ** the following assert().  If the assert() fails, it indicates a
4687   ** memory leak and a need to call sqlite3VdbeMemRelease(&mem1).  */
4688   assert( mem1.szMalloc==0 );
4689 
4690   /* rc==0 here means that one or both of the keys ran out of fields and
4691   ** all the fields up to that point were equal. Return the default_rc
4692   ** value.  */
4693   assert( CORRUPT_DB
4694        || vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, pPKey2->default_rc)
4695        || pPKey2->pKeyInfo->db->mallocFailed
4696   );
4697   pPKey2->eqSeen = 1;
4698   return pPKey2->default_rc;
4699 }
4700 int sqlite3VdbeRecordCompare(
4701   int nKey1, const void *pKey1,   /* Left key */
4702   UnpackedRecord *pPKey2          /* Right key */
4703 ){
4704   return sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 0);
4705 }
4706 
4707 
4708 /*
4709 ** This function is an optimized version of sqlite3VdbeRecordCompare()
4710 ** that (a) the first field of pPKey2 is an integer, and (b) the
4711 ** size-of-header varint at the start of (pKey1/nKey1) fits in a single
4712 ** byte (i.e. is less than 128).
4713 **
4714 ** To avoid concerns about buffer overreads, this routine is only used
4715 ** on schemas where the maximum valid header size is 63 bytes or less.
4716 */
4717 static int vdbeRecordCompareInt(
4718   int nKey1, const void *pKey1, /* Left key */
4719   UnpackedRecord *pPKey2        /* Right key */
4720 ){
4721   const u8 *aKey = &((const u8*)pKey1)[*(const u8*)pKey1 & 0x3F];
4722   int serial_type = ((const u8*)pKey1)[1];
4723   int res;
4724   u32 y;
4725   u64 x;
4726   i64 v;
4727   i64 lhs;
4728 
4729   vdbeAssertFieldCountWithinLimits(nKey1, pKey1, pPKey2->pKeyInfo);
4730   assert( (*(u8*)pKey1)<=0x3F || CORRUPT_DB );
4731   switch( serial_type ){
4732     case 1: { /* 1-byte signed integer */
4733       lhs = ONE_BYTE_INT(aKey);
4734       testcase( lhs<0 );
4735       break;
4736     }
4737     case 2: { /* 2-byte signed integer */
4738       lhs = TWO_BYTE_INT(aKey);
4739       testcase( lhs<0 );
4740       break;
4741     }
4742     case 3: { /* 3-byte signed integer */
4743       lhs = THREE_BYTE_INT(aKey);
4744       testcase( lhs<0 );
4745       break;
4746     }
4747     case 4: { /* 4-byte signed integer */
4748       y = FOUR_BYTE_UINT(aKey);
4749       lhs = (i64)*(int*)&y;
4750       testcase( lhs<0 );
4751       break;
4752     }
4753     case 5: { /* 6-byte signed integer */
4754       lhs = FOUR_BYTE_UINT(aKey+2) + (((i64)1)<<32)*TWO_BYTE_INT(aKey);
4755       testcase( lhs<0 );
4756       break;
4757     }
4758     case 6: { /* 8-byte signed integer */
4759       x = FOUR_BYTE_UINT(aKey);
4760       x = (x<<32) | FOUR_BYTE_UINT(aKey+4);
4761       lhs = *(i64*)&x;
4762       testcase( lhs<0 );
4763       break;
4764     }
4765     case 8:
4766       lhs = 0;
4767       break;
4768     case 9:
4769       lhs = 1;
4770       break;
4771 
4772     /* This case could be removed without changing the results of running
4773     ** this code. Including it causes gcc to generate a faster switch
4774     ** statement (since the range of switch targets now starts at zero and
4775     ** is contiguous) but does not cause any duplicate code to be generated
4776     ** (as gcc is clever enough to combine the two like cases). Other
4777     ** compilers might be similar.  */
4778     case 0: case 7:
4779       return sqlite3VdbeRecordCompare(nKey1, pKey1, pPKey2);
4780 
4781     default:
4782       return sqlite3VdbeRecordCompare(nKey1, pKey1, pPKey2);
4783   }
4784 
4785   assert( pPKey2->u.i == pPKey2->aMem[0].u.i );
4786   v = pPKey2->u.i;
4787   if( v>lhs ){
4788     res = pPKey2->r1;
4789   }else if( v<lhs ){
4790     res = pPKey2->r2;
4791   }else if( pPKey2->nField>1 ){
4792     /* The first fields of the two keys are equal. Compare the trailing
4793     ** fields.  */
4794     res = sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 1);
4795   }else{
4796     /* The first fields of the two keys are equal and there are no trailing
4797     ** fields. Return pPKey2->default_rc in this case. */
4798     res = pPKey2->default_rc;
4799     pPKey2->eqSeen = 1;
4800   }
4801 
4802   assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, res) );
4803   return res;
4804 }
4805 
4806 /*
4807 ** This function is an optimized version of sqlite3VdbeRecordCompare()
4808 ** that (a) the first field of pPKey2 is a string, that (b) the first field
4809 ** uses the collation sequence BINARY and (c) that the size-of-header varint
4810 ** at the start of (pKey1/nKey1) fits in a single byte.
4811 */
4812 static int vdbeRecordCompareString(
4813   int nKey1, const void *pKey1, /* Left key */
4814   UnpackedRecord *pPKey2        /* Right key */
4815 ){
4816   const u8 *aKey1 = (const u8*)pKey1;
4817   int serial_type;
4818   int res;
4819 
4820   assert( pPKey2->aMem[0].flags & MEM_Str );
4821   assert( pPKey2->aMem[0].n == pPKey2->n );
4822   assert( pPKey2->aMem[0].z == pPKey2->u.z );
4823   vdbeAssertFieldCountWithinLimits(nKey1, pKey1, pPKey2->pKeyInfo);
4824   serial_type = (signed char)(aKey1[1]);
4825 
4826 vrcs_restart:
4827   if( serial_type<12 ){
4828     if( serial_type<0 ){
4829       sqlite3GetVarint32(&aKey1[1], (u32*)&serial_type);
4830       if( serial_type>=12 ) goto vrcs_restart;
4831       assert( CORRUPT_DB );
4832     }
4833     res = pPKey2->r1;      /* (pKey1/nKey1) is a number or a null */
4834   }else if( !(serial_type & 0x01) ){
4835     res = pPKey2->r2;      /* (pKey1/nKey1) is a blob */
4836   }else{
4837     int nCmp;
4838     int nStr;
4839     int szHdr = aKey1[0];
4840 
4841     nStr = (serial_type-12) / 2;
4842     if( (szHdr + nStr) > nKey1 ){
4843       pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4844       return 0;    /* Corruption */
4845     }
4846     nCmp = MIN( pPKey2->n, nStr );
4847     res = memcmp(&aKey1[szHdr], pPKey2->u.z, nCmp);
4848 
4849     if( res>0 ){
4850       res = pPKey2->r2;
4851     }else if( res<0 ){
4852       res = pPKey2->r1;
4853     }else{
4854       res = nStr - pPKey2->n;
4855       if( res==0 ){
4856         if( pPKey2->nField>1 ){
4857           res = sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 1);
4858         }else{
4859           res = pPKey2->default_rc;
4860           pPKey2->eqSeen = 1;
4861         }
4862       }else if( res>0 ){
4863         res = pPKey2->r2;
4864       }else{
4865         res = pPKey2->r1;
4866       }
4867     }
4868   }
4869 
4870   assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, res)
4871        || CORRUPT_DB
4872        || pPKey2->pKeyInfo->db->mallocFailed
4873   );
4874   return res;
4875 }
4876 
4877 /*
4878 ** Return a pointer to an sqlite3VdbeRecordCompare() compatible function
4879 ** suitable for comparing serialized records to the unpacked record passed
4880 ** as the only argument.
4881 */
4882 RecordCompare sqlite3VdbeFindCompare(UnpackedRecord *p){
4883   /* varintRecordCompareInt() and varintRecordCompareString() both assume
4884   ** that the size-of-header varint that occurs at the start of each record
4885   ** fits in a single byte (i.e. is 127 or less). varintRecordCompareInt()
4886   ** also assumes that it is safe to overread a buffer by at least the
4887   ** maximum possible legal header size plus 8 bytes. Because there is
4888   ** guaranteed to be at least 74 (but not 136) bytes of padding following each
4889   ** buffer passed to varintRecordCompareInt() this makes it convenient to
4890   ** limit the size of the header to 64 bytes in cases where the first field
4891   ** is an integer.
4892   **
4893   ** The easiest way to enforce this limit is to consider only records with
4894   ** 13 fields or less. If the first field is an integer, the maximum legal
4895   ** header size is (12*5 + 1 + 1) bytes.  */
4896   if( p->pKeyInfo->nAllField<=13 ){
4897     int flags = p->aMem[0].flags;
4898     if( p->pKeyInfo->aSortFlags[0] ){
4899       if( p->pKeyInfo->aSortFlags[0] & KEYINFO_ORDER_BIGNULL ){
4900         return sqlite3VdbeRecordCompare;
4901       }
4902       p->r1 = 1;
4903       p->r2 = -1;
4904     }else{
4905       p->r1 = -1;
4906       p->r2 = 1;
4907     }
4908     if( (flags & MEM_Int) ){
4909       p->u.i = p->aMem[0].u.i;
4910       return vdbeRecordCompareInt;
4911     }
4912     testcase( flags & MEM_Real );
4913     testcase( flags & MEM_Null );
4914     testcase( flags & MEM_Blob );
4915     if( (flags & (MEM_Real|MEM_IntReal|MEM_Null|MEM_Blob))==0
4916      && p->pKeyInfo->aColl[0]==0
4917     ){
4918       assert( flags & MEM_Str );
4919       p->u.z = p->aMem[0].z;
4920       p->n = p->aMem[0].n;
4921       return vdbeRecordCompareString;
4922     }
4923   }
4924 
4925   return sqlite3VdbeRecordCompare;
4926 }
4927 
4928 /*
4929 ** pCur points at an index entry created using the OP_MakeRecord opcode.
4930 ** Read the rowid (the last field in the record) and store it in *rowid.
4931 ** Return SQLITE_OK if everything works, or an error code otherwise.
4932 **
4933 ** pCur might be pointing to text obtained from a corrupt database file.
4934 ** So the content cannot be trusted.  Do appropriate checks on the content.
4935 */
4936 int sqlite3VdbeIdxRowid(sqlite3 *db, BtCursor *pCur, i64 *rowid){
4937   i64 nCellKey = 0;
4938   int rc;
4939   u32 szHdr;        /* Size of the header */
4940   u32 typeRowid;    /* Serial type of the rowid */
4941   u32 lenRowid;     /* Size of the rowid */
4942   Mem m, v;
4943 
4944   /* Get the size of the index entry.  Only indices entries of less
4945   ** than 2GiB are support - anything large must be database corruption.
4946   ** Any corruption is detected in sqlite3BtreeParseCellPtr(), though, so
4947   ** this code can safely assume that nCellKey is 32-bits
4948   */
4949   assert( sqlite3BtreeCursorIsValid(pCur) );
4950   nCellKey = sqlite3BtreePayloadSize(pCur);
4951   assert( (nCellKey & SQLITE_MAX_U32)==(u64)nCellKey );
4952 
4953   /* Read in the complete content of the index entry */
4954   sqlite3VdbeMemInit(&m, db, 0);
4955   rc = sqlite3VdbeMemFromBtreeZeroOffset(pCur, (u32)nCellKey, &m);
4956   if( rc ){
4957     return rc;
4958   }
4959 
4960   /* The index entry must begin with a header size */
4961   getVarint32NR((u8*)m.z, szHdr);
4962   testcase( szHdr==3 );
4963   testcase( szHdr==(u32)m.n );
4964   testcase( szHdr>0x7fffffff );
4965   assert( m.n>=0 );
4966   if( unlikely(szHdr<3 || szHdr>(unsigned)m.n) ){
4967     goto idx_rowid_corruption;
4968   }
4969 
4970   /* The last field of the index should be an integer - the ROWID.
4971   ** Verify that the last entry really is an integer. */
4972   getVarint32NR((u8*)&m.z[szHdr-1], typeRowid);
4973   testcase( typeRowid==1 );
4974   testcase( typeRowid==2 );
4975   testcase( typeRowid==3 );
4976   testcase( typeRowid==4 );
4977   testcase( typeRowid==5 );
4978   testcase( typeRowid==6 );
4979   testcase( typeRowid==8 );
4980   testcase( typeRowid==9 );
4981   if( unlikely(typeRowid<1 || typeRowid>9 || typeRowid==7) ){
4982     goto idx_rowid_corruption;
4983   }
4984   lenRowid = sqlite3SmallTypeSizes[typeRowid];
4985   testcase( (u32)m.n==szHdr+lenRowid );
4986   if( unlikely((u32)m.n<szHdr+lenRowid) ){
4987     goto idx_rowid_corruption;
4988   }
4989 
4990   /* Fetch the integer off the end of the index record */
4991   sqlite3VdbeSerialGet((u8*)&m.z[m.n-lenRowid], typeRowid, &v);
4992   *rowid = v.u.i;
4993   sqlite3VdbeMemReleaseMalloc(&m);
4994   return SQLITE_OK;
4995 
4996   /* Jump here if database corruption is detected after m has been
4997   ** allocated.  Free the m object and return SQLITE_CORRUPT. */
4998 idx_rowid_corruption:
4999   testcase( m.szMalloc!=0 );
5000   sqlite3VdbeMemReleaseMalloc(&m);
5001   return SQLITE_CORRUPT_BKPT;
5002 }
5003 
5004 /*
5005 ** Compare the key of the index entry that cursor pC is pointing to against
5006 ** the key string in pUnpacked.  Write into *pRes a number
5007 ** that is negative, zero, or positive if pC is less than, equal to,
5008 ** or greater than pUnpacked.  Return SQLITE_OK on success.
5009 **
5010 ** pUnpacked is either created without a rowid or is truncated so that it
5011 ** omits the rowid at the end.  The rowid at the end of the index entry
5012 ** is ignored as well.  Hence, this routine only compares the prefixes
5013 ** of the keys prior to the final rowid, not the entire key.
5014 */
5015 int sqlite3VdbeIdxKeyCompare(
5016   sqlite3 *db,                     /* Database connection */
5017   VdbeCursor *pC,                  /* The cursor to compare against */
5018   UnpackedRecord *pUnpacked,       /* Unpacked version of key */
5019   int *res                         /* Write the comparison result here */
5020 ){
5021   i64 nCellKey = 0;
5022   int rc;
5023   BtCursor *pCur;
5024   Mem m;
5025 
5026   assert( pC->eCurType==CURTYPE_BTREE );
5027   pCur = pC->uc.pCursor;
5028   assert( sqlite3BtreeCursorIsValid(pCur) );
5029   nCellKey = sqlite3BtreePayloadSize(pCur);
5030   /* nCellKey will always be between 0 and 0xffffffff because of the way
5031   ** that btreeParseCellPtr() and sqlite3GetVarint32() are implemented */
5032   if( nCellKey<=0 || nCellKey>0x7fffffff ){
5033     *res = 0;
5034     return SQLITE_CORRUPT_BKPT;
5035   }
5036   sqlite3VdbeMemInit(&m, db, 0);
5037   rc = sqlite3VdbeMemFromBtreeZeroOffset(pCur, (u32)nCellKey, &m);
5038   if( rc ){
5039     return rc;
5040   }
5041   *res = sqlite3VdbeRecordCompareWithSkip(m.n, m.z, pUnpacked, 0);
5042   sqlite3VdbeMemReleaseMalloc(&m);
5043   return SQLITE_OK;
5044 }
5045 
5046 /*
5047 ** This routine sets the value to be returned by subsequent calls to
5048 ** sqlite3_changes() on the database handle 'db'.
5049 */
5050 void sqlite3VdbeSetChanges(sqlite3 *db, i64 nChange){
5051   assert( sqlite3_mutex_held(db->mutex) );
5052   db->nChange = nChange;
5053   db->nTotalChange += nChange;
5054 }
5055 
5056 /*
5057 ** Set a flag in the vdbe to update the change counter when it is finalised
5058 ** or reset.
5059 */
5060 void sqlite3VdbeCountChanges(Vdbe *v){
5061   v->changeCntOn = 1;
5062 }
5063 
5064 /*
5065 ** Mark every prepared statement associated with a database connection
5066 ** as expired.
5067 **
5068 ** An expired statement means that recompilation of the statement is
5069 ** recommend.  Statements expire when things happen that make their
5070 ** programs obsolete.  Removing user-defined functions or collating
5071 ** sequences, or changing an authorization function are the types of
5072 ** things that make prepared statements obsolete.
5073 **
5074 ** If iCode is 1, then expiration is advisory.  The statement should
5075 ** be reprepared before being restarted, but if it is already running
5076 ** it is allowed to run to completion.
5077 **
5078 ** Internally, this function just sets the Vdbe.expired flag on all
5079 ** prepared statements.  The flag is set to 1 for an immediate expiration
5080 ** and set to 2 for an advisory expiration.
5081 */
5082 void sqlite3ExpirePreparedStatements(sqlite3 *db, int iCode){
5083   Vdbe *p;
5084   for(p = db->pVdbe; p; p=p->pNext){
5085     p->expired = iCode+1;
5086   }
5087 }
5088 
5089 /*
5090 ** Return the database associated with the Vdbe.
5091 */
5092 sqlite3 *sqlite3VdbeDb(Vdbe *v){
5093   return v->db;
5094 }
5095 
5096 /*
5097 ** Return the SQLITE_PREPARE flags for a Vdbe.
5098 */
5099 u8 sqlite3VdbePrepareFlags(Vdbe *v){
5100   return v->prepFlags;
5101 }
5102 
5103 /*
5104 ** Return a pointer to an sqlite3_value structure containing the value bound
5105 ** parameter iVar of VM v. Except, if the value is an SQL NULL, return
5106 ** 0 instead. Unless it is NULL, apply affinity aff (one of the SQLITE_AFF_*
5107 ** constants) to the value before returning it.
5108 **
5109 ** The returned value must be freed by the caller using sqlite3ValueFree().
5110 */
5111 sqlite3_value *sqlite3VdbeGetBoundValue(Vdbe *v, int iVar, u8 aff){
5112   assert( iVar>0 );
5113   if( v ){
5114     Mem *pMem = &v->aVar[iVar-1];
5115     assert( (v->db->flags & SQLITE_EnableQPSG)==0 );
5116     if( 0==(pMem->flags & MEM_Null) ){
5117       sqlite3_value *pRet = sqlite3ValueNew(v->db);
5118       if( pRet ){
5119         sqlite3VdbeMemCopy((Mem *)pRet, pMem);
5120         sqlite3ValueApplyAffinity(pRet, aff, SQLITE_UTF8);
5121       }
5122       return pRet;
5123     }
5124   }
5125   return 0;
5126 }
5127 
5128 /*
5129 ** Configure SQL variable iVar so that binding a new value to it signals
5130 ** to sqlite3_reoptimize() that re-preparing the statement may result
5131 ** in a better query plan.
5132 */
5133 void sqlite3VdbeSetVarmask(Vdbe *v, int iVar){
5134   assert( iVar>0 );
5135   assert( (v->db->flags & SQLITE_EnableQPSG)==0 );
5136   if( iVar>=32 ){
5137     v->expmask |= 0x80000000;
5138   }else{
5139     v->expmask |= ((u32)1 << (iVar-1));
5140   }
5141 }
5142 
5143 /*
5144 ** Cause a function to throw an error if it was call from OP_PureFunc
5145 ** rather than OP_Function.
5146 **
5147 ** OP_PureFunc means that the function must be deterministic, and should
5148 ** throw an error if it is given inputs that would make it non-deterministic.
5149 ** This routine is invoked by date/time functions that use non-deterministic
5150 ** features such as 'now'.
5151 */
5152 int sqlite3NotPureFunc(sqlite3_context *pCtx){
5153   const VdbeOp *pOp;
5154 #ifdef SQLITE_ENABLE_STAT4
5155   if( pCtx->pVdbe==0 ) return 1;
5156 #endif
5157   pOp = pCtx->pVdbe->aOp + pCtx->iOp;
5158   if( pOp->opcode==OP_PureFunc ){
5159     const char *zContext;
5160     char *zMsg;
5161     if( pOp->p5 & NC_IsCheck ){
5162       zContext = "a CHECK constraint";
5163     }else if( pOp->p5 & NC_GenCol ){
5164       zContext = "a generated column";
5165     }else{
5166       zContext = "an index";
5167     }
5168     zMsg = sqlite3_mprintf("non-deterministic use of %s() in %s",
5169                            pCtx->pFunc->zName, zContext);
5170     sqlite3_result_error(pCtx, zMsg, -1);
5171     sqlite3_free(zMsg);
5172     return 0;
5173   }
5174   return 1;
5175 }
5176 
5177 #ifndef SQLITE_OMIT_VIRTUALTABLE
5178 /*
5179 ** Transfer error message text from an sqlite3_vtab.zErrMsg (text stored
5180 ** in memory obtained from sqlite3_malloc) into a Vdbe.zErrMsg (text stored
5181 ** in memory obtained from sqlite3DbMalloc).
5182 */
5183 void sqlite3VtabImportErrmsg(Vdbe *p, sqlite3_vtab *pVtab){
5184   if( pVtab->zErrMsg ){
5185     sqlite3 *db = p->db;
5186     sqlite3DbFree(db, p->zErrMsg);
5187     p->zErrMsg = sqlite3DbStrDup(db, pVtab->zErrMsg);
5188     sqlite3_free(pVtab->zErrMsg);
5189     pVtab->zErrMsg = 0;
5190   }
5191 }
5192 #endif /* SQLITE_OMIT_VIRTUALTABLE */
5193 
5194 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
5195 
5196 /*
5197 ** If the second argument is not NULL, release any allocations associated
5198 ** with the memory cells in the p->aMem[] array. Also free the UnpackedRecord
5199 ** structure itself, using sqlite3DbFree().
5200 **
5201 ** This function is used to free UnpackedRecord structures allocated by
5202 ** the vdbeUnpackRecord() function found in vdbeapi.c.
5203 */
5204 static void vdbeFreeUnpacked(sqlite3 *db, int nField, UnpackedRecord *p){
5205   if( p ){
5206     int i;
5207     for(i=0; i<nField; i++){
5208       Mem *pMem = &p->aMem[i];
5209       if( pMem->zMalloc ) sqlite3VdbeMemReleaseMalloc(pMem);
5210     }
5211     sqlite3DbFreeNN(db, p);
5212   }
5213 }
5214 #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
5215 
5216 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
5217 /*
5218 ** Invoke the pre-update hook. If this is an UPDATE or DELETE pre-update call,
5219 ** then cursor passed as the second argument should point to the row about
5220 ** to be update or deleted. If the application calls sqlite3_preupdate_old(),
5221 ** the required value will be read from the row the cursor points to.
5222 */
5223 void sqlite3VdbePreUpdateHook(
5224   Vdbe *v,                        /* Vdbe pre-update hook is invoked by */
5225   VdbeCursor *pCsr,               /* Cursor to grab old.* values from */
5226   int op,                         /* SQLITE_INSERT, UPDATE or DELETE */
5227   const char *zDb,                /* Database name */
5228   Table *pTab,                    /* Modified table */
5229   i64 iKey1,                      /* Initial key value */
5230   int iReg,                       /* Register for new.* record */
5231   int iBlobWrite
5232 ){
5233   sqlite3 *db = v->db;
5234   i64 iKey2;
5235   PreUpdate preupdate;
5236   const char *zTbl = pTab->zName;
5237   static const u8 fakeSortOrder = 0;
5238 
5239   assert( db->pPreUpdate==0 );
5240   memset(&preupdate, 0, sizeof(PreUpdate));
5241   if( HasRowid(pTab)==0 ){
5242     iKey1 = iKey2 = 0;
5243     preupdate.pPk = sqlite3PrimaryKeyIndex(pTab);
5244   }else{
5245     if( op==SQLITE_UPDATE ){
5246       iKey2 = v->aMem[iReg].u.i;
5247     }else{
5248       iKey2 = iKey1;
5249     }
5250   }
5251 
5252   assert( pCsr!=0 );
5253   assert( pCsr->eCurType==CURTYPE_BTREE );
5254   assert( pCsr->nField==pTab->nCol
5255        || (pCsr->nField==pTab->nCol+1 && op==SQLITE_DELETE && iReg==-1)
5256   );
5257 
5258   preupdate.v = v;
5259   preupdate.pCsr = pCsr;
5260   preupdate.op = op;
5261   preupdate.iNewReg = iReg;
5262   preupdate.keyinfo.db = db;
5263   preupdate.keyinfo.enc = ENC(db);
5264   preupdate.keyinfo.nKeyField = pTab->nCol;
5265   preupdate.keyinfo.aSortFlags = (u8*)&fakeSortOrder;
5266   preupdate.iKey1 = iKey1;
5267   preupdate.iKey2 = iKey2;
5268   preupdate.pTab = pTab;
5269   preupdate.iBlobWrite = iBlobWrite;
5270 
5271   db->pPreUpdate = &preupdate;
5272   db->xPreUpdateCallback(db->pPreUpdateArg, db, op, zDb, zTbl, iKey1, iKey2);
5273   db->pPreUpdate = 0;
5274   sqlite3DbFree(db, preupdate.aRecord);
5275   vdbeFreeUnpacked(db, preupdate.keyinfo.nKeyField+1, preupdate.pUnpacked);
5276   vdbeFreeUnpacked(db, preupdate.keyinfo.nKeyField+1, preupdate.pNewUnpacked);
5277   if( preupdate.aNew ){
5278     int i;
5279     for(i=0; i<pCsr->nField; i++){
5280       sqlite3VdbeMemRelease(&preupdate.aNew[i]);
5281     }
5282     sqlite3DbFreeNN(db, preupdate.aNew);
5283   }
5284 }
5285 #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
5286