xref: /sqlite-3.40.0/src/vdbeaux.c (revision 2ca62cb1)
1 /*
2 ** 2003 September 6
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 ** This file contains code used for creating, destroying, and populating
13 ** a VDBE (or an "sqlite3_stmt" as it is known to the outside world.)
14 */
15 #include "sqliteInt.h"
16 #include "vdbeInt.h"
17 
18 /*
19 ** Create a new virtual database engine.
20 */
21 Vdbe *sqlite3VdbeCreate(Parse *pParse){
22   sqlite3 *db = pParse->db;
23   Vdbe *p;
24   p = sqlite3DbMallocRawNN(db, sizeof(Vdbe) );
25   if( p==0 ) return 0;
26   memset(&p->aOp, 0, sizeof(Vdbe)-offsetof(Vdbe,aOp));
27   p->db = db;
28   if( db->pVdbe ){
29     db->pVdbe->pPrev = p;
30   }
31   p->pNext = db->pVdbe;
32   p->pPrev = 0;
33   db->pVdbe = p;
34   p->magic = VDBE_MAGIC_INIT;
35   p->pParse = pParse;
36   assert( pParse->aLabel==0 );
37   assert( pParse->nLabel==0 );
38   assert( pParse->nOpAlloc==0 );
39   assert( pParse->szOpAlloc==0 );
40   return p;
41 }
42 
43 /*
44 ** Change the error string stored in Vdbe.zErrMsg
45 */
46 void sqlite3VdbeError(Vdbe *p, const char *zFormat, ...){
47   va_list ap;
48   sqlite3DbFree(p->db, p->zErrMsg);
49   va_start(ap, zFormat);
50   p->zErrMsg = sqlite3VMPrintf(p->db, zFormat, ap);
51   va_end(ap);
52 }
53 
54 /*
55 ** Remember the SQL string for a prepared statement.
56 */
57 void sqlite3VdbeSetSql(Vdbe *p, const char *z, int n, int isPrepareV2){
58   assert( isPrepareV2==1 || isPrepareV2==0 );
59   if( p==0 ) return;
60   if( !isPrepareV2 ) p->expmask = 0;
61 #if defined(SQLITE_OMIT_TRACE) && !defined(SQLITE_ENABLE_SQLLOG)
62   if( !isPrepareV2 ) return;
63 #endif
64   assert( p->zSql==0 );
65   p->zSql = sqlite3DbStrNDup(p->db, z, n);
66   p->isPrepareV2 = (u8)isPrepareV2;
67 }
68 
69 /*
70 ** Swap all content between two VDBE structures.
71 */
72 void sqlite3VdbeSwap(Vdbe *pA, Vdbe *pB){
73   Vdbe tmp, *pTmp;
74   char *zTmp;
75   assert( pA->db==pB->db );
76   tmp = *pA;
77   *pA = *pB;
78   *pB = tmp;
79   pTmp = pA->pNext;
80   pA->pNext = pB->pNext;
81   pB->pNext = pTmp;
82   pTmp = pA->pPrev;
83   pA->pPrev = pB->pPrev;
84   pB->pPrev = pTmp;
85   zTmp = pA->zSql;
86   pA->zSql = pB->zSql;
87   pB->zSql = zTmp;
88   pB->isPrepareV2 = pA->isPrepareV2;
89   pB->expmask = pA->expmask;
90   memcpy(pB->aCounter, pA->aCounter, sizeof(pB->aCounter));
91   pB->aCounter[SQLITE_STMTSTATUS_REPREPARE]++;
92 
93 }
94 
95 /*
96 ** Resize the Vdbe.aOp array so that it is at least nOp elements larger
97 ** than its current size. nOp is guaranteed to be less than or equal
98 ** to 1024/sizeof(Op).
99 **
100 ** If an out-of-memory error occurs while resizing the array, return
101 ** SQLITE_NOMEM. In this case Vdbe.aOp and Parse.nOpAlloc remain
102 ** unchanged (this is so that any opcodes already allocated can be
103 ** correctly deallocated along with the rest of the Vdbe).
104 */
105 static int growOpArray(Vdbe *v, int nOp){
106   VdbeOp *pNew;
107   Parse *p = v->pParse;
108 
109   /* The SQLITE_TEST_REALLOC_STRESS compile-time option is designed to force
110   ** more frequent reallocs and hence provide more opportunities for
111   ** simulated OOM faults.  SQLITE_TEST_REALLOC_STRESS is generally used
112   ** during testing only.  With SQLITE_TEST_REALLOC_STRESS grow the op array
113   ** by the minimum* amount required until the size reaches 512.  Normal
114   ** operation (without SQLITE_TEST_REALLOC_STRESS) is to double the current
115   ** size of the op array or add 1KB of space, whichever is smaller. */
116 #ifdef SQLITE_TEST_REALLOC_STRESS
117   int nNew = (p->nOpAlloc>=512 ? p->nOpAlloc*2 : p->nOpAlloc+nOp);
118 #else
119   int nNew = (p->nOpAlloc ? p->nOpAlloc*2 : (int)(1024/sizeof(Op)));
120   UNUSED_PARAMETER(nOp);
121 #endif
122 
123   /* Ensure that the size of a VDBE does not grow too large */
124   if( nNew > p->db->aLimit[SQLITE_LIMIT_VDBE_OP] ){
125     sqlite3OomFault(p->db);
126     return SQLITE_NOMEM;
127   }
128 
129   assert( nOp<=(1024/sizeof(Op)) );
130   assert( nNew>=(p->nOpAlloc+nOp) );
131   pNew = sqlite3DbRealloc(p->db, v->aOp, nNew*sizeof(Op));
132   if( pNew ){
133     p->szOpAlloc = sqlite3DbMallocSize(p->db, pNew);
134     p->nOpAlloc = p->szOpAlloc/sizeof(Op);
135     v->aOp = pNew;
136   }
137   return (pNew ? SQLITE_OK : SQLITE_NOMEM_BKPT);
138 }
139 
140 #ifdef SQLITE_DEBUG
141 /* This routine is just a convenient place to set a breakpoint that will
142 ** fire after each opcode is inserted and displayed using
143 ** "PRAGMA vdbe_addoptrace=on".
144 */
145 static void test_addop_breakpoint(void){
146   static int n = 0;
147   n++;
148 }
149 #endif
150 
151 /*
152 ** Add a new instruction to the list of instructions current in the
153 ** VDBE.  Return the address of the new instruction.
154 **
155 ** Parameters:
156 **
157 **    p               Pointer to the VDBE
158 **
159 **    op              The opcode for this instruction
160 **
161 **    p1, p2, p3      Operands
162 **
163 ** Use the sqlite3VdbeResolveLabel() function to fix an address and
164 ** the sqlite3VdbeChangeP4() function to change the value of the P4
165 ** operand.
166 */
167 static SQLITE_NOINLINE int growOp3(Vdbe *p, int op, int p1, int p2, int p3){
168   assert( p->pParse->nOpAlloc<=p->nOp );
169   if( growOpArray(p, 1) ) return 1;
170   assert( p->pParse->nOpAlloc>p->nOp );
171   return sqlite3VdbeAddOp3(p, op, p1, p2, p3);
172 }
173 int sqlite3VdbeAddOp3(Vdbe *p, int op, int p1, int p2, int p3){
174   int i;
175   VdbeOp *pOp;
176 
177   i = p->nOp;
178   assert( p->magic==VDBE_MAGIC_INIT );
179   assert( op>=0 && op<0xff );
180   if( p->pParse->nOpAlloc<=i ){
181     return growOp3(p, op, p1, p2, p3);
182   }
183   p->nOp++;
184   pOp = &p->aOp[i];
185   pOp->opcode = (u8)op;
186   pOp->p5 = 0;
187   pOp->p1 = p1;
188   pOp->p2 = p2;
189   pOp->p3 = p3;
190   pOp->p4.p = 0;
191   pOp->p4type = P4_NOTUSED;
192 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
193   pOp->zComment = 0;
194 #endif
195 #ifdef SQLITE_DEBUG
196   if( p->db->flags & SQLITE_VdbeAddopTrace ){
197     int jj, kk;
198     Parse *pParse = p->pParse;
199     for(jj=kk=0; jj<pParse->nColCache; jj++){
200       struct yColCache *x = pParse->aColCache + jj;
201       printf(" r[%d]={%d:%d}", x->iReg, x->iTable, x->iColumn);
202       kk++;
203     }
204     if( kk ) printf("\n");
205     sqlite3VdbePrintOp(0, i, &p->aOp[i]);
206     test_addop_breakpoint();
207   }
208 #endif
209 #ifdef VDBE_PROFILE
210   pOp->cycles = 0;
211   pOp->cnt = 0;
212 #endif
213 #ifdef SQLITE_VDBE_COVERAGE
214   pOp->iSrcLine = 0;
215 #endif
216   return i;
217 }
218 int sqlite3VdbeAddOp0(Vdbe *p, int op){
219   return sqlite3VdbeAddOp3(p, op, 0, 0, 0);
220 }
221 int sqlite3VdbeAddOp1(Vdbe *p, int op, int p1){
222   return sqlite3VdbeAddOp3(p, op, p1, 0, 0);
223 }
224 int sqlite3VdbeAddOp2(Vdbe *p, int op, int p1, int p2){
225   return sqlite3VdbeAddOp3(p, op, p1, p2, 0);
226 }
227 
228 /* Generate code for an unconditional jump to instruction iDest
229 */
230 int sqlite3VdbeGoto(Vdbe *p, int iDest){
231   return sqlite3VdbeAddOp3(p, OP_Goto, 0, iDest, 0);
232 }
233 
234 /* Generate code to cause the string zStr to be loaded into
235 ** register iDest
236 */
237 int sqlite3VdbeLoadString(Vdbe *p, int iDest, const char *zStr){
238   return sqlite3VdbeAddOp4(p, OP_String8, 0, iDest, 0, zStr, 0);
239 }
240 
241 /*
242 ** Generate code that initializes multiple registers to string or integer
243 ** constants.  The registers begin with iDest and increase consecutively.
244 ** One register is initialized for each characgter in zTypes[].  For each
245 ** "s" character in zTypes[], the register is a string if the argument is
246 ** not NULL, or OP_Null if the value is a null pointer.  For each "i" character
247 ** in zTypes[], the register is initialized to an integer.
248 */
249 void sqlite3VdbeMultiLoad(Vdbe *p, int iDest, const char *zTypes, ...){
250   va_list ap;
251   int i;
252   char c;
253   va_start(ap, zTypes);
254   for(i=0; (c = zTypes[i])!=0; i++){
255     if( c=='s' ){
256       const char *z = va_arg(ap, const char*);
257       sqlite3VdbeAddOp4(p, z==0 ? OP_Null : OP_String8, 0, iDest++, 0, z, 0);
258     }else{
259       assert( c=='i' );
260       sqlite3VdbeAddOp2(p, OP_Integer, va_arg(ap, int), iDest++);
261     }
262   }
263   va_end(ap);
264 }
265 
266 /*
267 ** Add an opcode that includes the p4 value as a pointer.
268 */
269 int sqlite3VdbeAddOp4(
270   Vdbe *p,            /* Add the opcode to this VM */
271   int op,             /* The new opcode */
272   int p1,             /* The P1 operand */
273   int p2,             /* The P2 operand */
274   int p3,             /* The P3 operand */
275   const char *zP4,    /* The P4 operand */
276   int p4type          /* P4 operand type */
277 ){
278   int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
279   sqlite3VdbeChangeP4(p, addr, zP4, p4type);
280   return addr;
281 }
282 
283 /*
284 ** Add an opcode that includes the p4 value with a P4_INT64 or
285 ** P4_REAL type.
286 */
287 int sqlite3VdbeAddOp4Dup8(
288   Vdbe *p,            /* Add the opcode to this VM */
289   int op,             /* The new opcode */
290   int p1,             /* The P1 operand */
291   int p2,             /* The P2 operand */
292   int p3,             /* The P3 operand */
293   const u8 *zP4,      /* The P4 operand */
294   int p4type          /* P4 operand type */
295 ){
296   char *p4copy = sqlite3DbMallocRawNN(sqlite3VdbeDb(p), 8);
297   if( p4copy ) memcpy(p4copy, zP4, 8);
298   return sqlite3VdbeAddOp4(p, op, p1, p2, p3, p4copy, p4type);
299 }
300 
301 /*
302 ** Add an OP_ParseSchema opcode.  This routine is broken out from
303 ** sqlite3VdbeAddOp4() since it needs to also needs to mark all btrees
304 ** as having been used.
305 **
306 ** The zWhere string must have been obtained from sqlite3_malloc().
307 ** This routine will take ownership of the allocated memory.
308 */
309 void sqlite3VdbeAddParseSchemaOp(Vdbe *p, int iDb, char *zWhere){
310   int j;
311   sqlite3VdbeAddOp4(p, OP_ParseSchema, iDb, 0, 0, zWhere, P4_DYNAMIC);
312   for(j=0; j<p->db->nDb; j++) sqlite3VdbeUsesBtree(p, j);
313 }
314 
315 /*
316 ** Add an opcode that includes the p4 value as an integer.
317 */
318 int sqlite3VdbeAddOp4Int(
319   Vdbe *p,            /* Add the opcode to this VM */
320   int op,             /* The new opcode */
321   int p1,             /* The P1 operand */
322   int p2,             /* The P2 operand */
323   int p3,             /* The P3 operand */
324   int p4              /* The P4 operand as an integer */
325 ){
326   int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
327   if( p->db->mallocFailed==0 ){
328     VdbeOp *pOp = &p->aOp[addr];
329     pOp->p4type = P4_INT32;
330     pOp->p4.i = p4;
331   }
332   return addr;
333 }
334 
335 /* Insert the end of a co-routine
336 */
337 void sqlite3VdbeEndCoroutine(Vdbe *v, int regYield){
338   sqlite3VdbeAddOp1(v, OP_EndCoroutine, regYield);
339 
340   /* Clear the temporary register cache, thereby ensuring that each
341   ** co-routine has its own independent set of registers, because co-routines
342   ** might expect their registers to be preserved across an OP_Yield, and
343   ** that could cause problems if two or more co-routines are using the same
344   ** temporary register.
345   */
346   v->pParse->nTempReg = 0;
347   v->pParse->nRangeReg = 0;
348 }
349 
350 /*
351 ** Create a new symbolic label for an instruction that has yet to be
352 ** coded.  The symbolic label is really just a negative number.  The
353 ** label can be used as the P2 value of an operation.  Later, when
354 ** the label is resolved to a specific address, the VDBE will scan
355 ** through its operation list and change all values of P2 which match
356 ** the label into the resolved address.
357 **
358 ** The VDBE knows that a P2 value is a label because labels are
359 ** always negative and P2 values are suppose to be non-negative.
360 ** Hence, a negative P2 value is a label that has yet to be resolved.
361 **
362 ** Zero is returned if a malloc() fails.
363 */
364 int sqlite3VdbeMakeLabel(Vdbe *v){
365   Parse *p = v->pParse;
366   int i = p->nLabel++;
367   assert( v->magic==VDBE_MAGIC_INIT );
368   if( (i & (i-1))==0 ){
369     p->aLabel = sqlite3DbReallocOrFree(p->db, p->aLabel,
370                                        (i*2+1)*sizeof(p->aLabel[0]));
371   }
372   if( p->aLabel ){
373     p->aLabel[i] = -1;
374   }
375   return ADDR(i);
376 }
377 
378 /*
379 ** Resolve label "x" to be the address of the next instruction to
380 ** be inserted.  The parameter "x" must have been obtained from
381 ** a prior call to sqlite3VdbeMakeLabel().
382 */
383 void sqlite3VdbeResolveLabel(Vdbe *v, int x){
384   Parse *p = v->pParse;
385   int j = ADDR(x);
386   assert( v->magic==VDBE_MAGIC_INIT );
387   assert( j<p->nLabel );
388   assert( j>=0 );
389   if( p->aLabel ){
390     p->aLabel[j] = v->nOp;
391   }
392 }
393 
394 /*
395 ** Mark the VDBE as one that can only be run one time.
396 */
397 void sqlite3VdbeRunOnlyOnce(Vdbe *p){
398   p->runOnlyOnce = 1;
399 }
400 
401 /*
402 ** Mark the VDBE as one that can only be run multiple times.
403 */
404 void sqlite3VdbeReusable(Vdbe *p){
405   p->runOnlyOnce = 0;
406 }
407 
408 #ifdef SQLITE_DEBUG /* sqlite3AssertMayAbort() logic */
409 
410 /*
411 ** The following type and function are used to iterate through all opcodes
412 ** in a Vdbe main program and each of the sub-programs (triggers) it may
413 ** invoke directly or indirectly. It should be used as follows:
414 **
415 **   Op *pOp;
416 **   VdbeOpIter sIter;
417 **
418 **   memset(&sIter, 0, sizeof(sIter));
419 **   sIter.v = v;                            // v is of type Vdbe*
420 **   while( (pOp = opIterNext(&sIter)) ){
421 **     // Do something with pOp
422 **   }
423 **   sqlite3DbFree(v->db, sIter.apSub);
424 **
425 */
426 typedef struct VdbeOpIter VdbeOpIter;
427 struct VdbeOpIter {
428   Vdbe *v;                   /* Vdbe to iterate through the opcodes of */
429   SubProgram **apSub;        /* Array of subprograms */
430   int nSub;                  /* Number of entries in apSub */
431   int iAddr;                 /* Address of next instruction to return */
432   int iSub;                  /* 0 = main program, 1 = first sub-program etc. */
433 };
434 static Op *opIterNext(VdbeOpIter *p){
435   Vdbe *v = p->v;
436   Op *pRet = 0;
437   Op *aOp;
438   int nOp;
439 
440   if( p->iSub<=p->nSub ){
441 
442     if( p->iSub==0 ){
443       aOp = v->aOp;
444       nOp = v->nOp;
445     }else{
446       aOp = p->apSub[p->iSub-1]->aOp;
447       nOp = p->apSub[p->iSub-1]->nOp;
448     }
449     assert( p->iAddr<nOp );
450 
451     pRet = &aOp[p->iAddr];
452     p->iAddr++;
453     if( p->iAddr==nOp ){
454       p->iSub++;
455       p->iAddr = 0;
456     }
457 
458     if( pRet->p4type==P4_SUBPROGRAM ){
459       int nByte = (p->nSub+1)*sizeof(SubProgram*);
460       int j;
461       for(j=0; j<p->nSub; j++){
462         if( p->apSub[j]==pRet->p4.pProgram ) break;
463       }
464       if( j==p->nSub ){
465         p->apSub = sqlite3DbReallocOrFree(v->db, p->apSub, nByte);
466         if( !p->apSub ){
467           pRet = 0;
468         }else{
469           p->apSub[p->nSub++] = pRet->p4.pProgram;
470         }
471       }
472     }
473   }
474 
475   return pRet;
476 }
477 
478 /*
479 ** Check if the program stored in the VM associated with pParse may
480 ** throw an ABORT exception (causing the statement, but not entire transaction
481 ** to be rolled back). This condition is true if the main program or any
482 ** sub-programs contains any of the following:
483 **
484 **   *  OP_Halt with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
485 **   *  OP_HaltIfNull with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
486 **   *  OP_Destroy
487 **   *  OP_VUpdate
488 **   *  OP_VRename
489 **   *  OP_FkCounter with P2==0 (immediate foreign key constraint)
490 **   *  OP_CreateTable and OP_InitCoroutine (for CREATE TABLE AS SELECT ...)
491 **
492 ** Then check that the value of Parse.mayAbort is true if an
493 ** ABORT may be thrown, or false otherwise. Return true if it does
494 ** match, or false otherwise. This function is intended to be used as
495 ** part of an assert statement in the compiler. Similar to:
496 **
497 **   assert( sqlite3VdbeAssertMayAbort(pParse->pVdbe, pParse->mayAbort) );
498 */
499 int sqlite3VdbeAssertMayAbort(Vdbe *v, int mayAbort){
500   int hasAbort = 0;
501   int hasFkCounter = 0;
502   int hasCreateTable = 0;
503   int hasInitCoroutine = 0;
504   Op *pOp;
505   VdbeOpIter sIter;
506   memset(&sIter, 0, sizeof(sIter));
507   sIter.v = v;
508 
509   while( (pOp = opIterNext(&sIter))!=0 ){
510     int opcode = pOp->opcode;
511     if( opcode==OP_Destroy || opcode==OP_VUpdate || opcode==OP_VRename
512      || ((opcode==OP_Halt || opcode==OP_HaltIfNull)
513       && ((pOp->p1&0xff)==SQLITE_CONSTRAINT && pOp->p2==OE_Abort))
514     ){
515       hasAbort = 1;
516       break;
517     }
518     if( opcode==OP_CreateTable ) hasCreateTable = 1;
519     if( opcode==OP_InitCoroutine ) hasInitCoroutine = 1;
520 #ifndef SQLITE_OMIT_FOREIGN_KEY
521     if( opcode==OP_FkCounter && pOp->p1==0 && pOp->p2==1 ){
522       hasFkCounter = 1;
523     }
524 #endif
525   }
526   sqlite3DbFree(v->db, sIter.apSub);
527 
528   /* Return true if hasAbort==mayAbort. Or if a malloc failure occurred.
529   ** If malloc failed, then the while() loop above may not have iterated
530   ** through all opcodes and hasAbort may be set incorrectly. Return
531   ** true for this case to prevent the assert() in the callers frame
532   ** from failing.  */
533   return ( v->db->mallocFailed || hasAbort==mayAbort || hasFkCounter
534               || (hasCreateTable && hasInitCoroutine) );
535 }
536 #endif /* SQLITE_DEBUG - the sqlite3AssertMayAbort() function */
537 
538 /*
539 ** This routine is called after all opcodes have been inserted.  It loops
540 ** through all the opcodes and fixes up some details.
541 **
542 ** (1) For each jump instruction with a negative P2 value (a label)
543 **     resolve the P2 value to an actual address.
544 **
545 ** (2) Compute the maximum number of arguments used by any SQL function
546 **     and store that value in *pMaxFuncArgs.
547 **
548 ** (3) Update the Vdbe.readOnly and Vdbe.bIsReader flags to accurately
549 **     indicate what the prepared statement actually does.
550 **
551 ** (4) Initialize the p4.xAdvance pointer on opcodes that use it.
552 **
553 ** (5) Reclaim the memory allocated for storing labels.
554 **
555 ** This routine will only function correctly if the mkopcodeh.tcl generator
556 ** script numbers the opcodes correctly.  Changes to this routine must be
557 ** coordinated with changes to mkopcodeh.tcl.
558 */
559 static void resolveP2Values(Vdbe *p, int *pMaxFuncArgs){
560   int nMaxArgs = *pMaxFuncArgs;
561   Op *pOp;
562   Parse *pParse = p->pParse;
563   int *aLabel = pParse->aLabel;
564   p->readOnly = 1;
565   p->bIsReader = 0;
566   pOp = &p->aOp[p->nOp-1];
567   while(1){
568 
569     /* Only JUMP opcodes and the short list of special opcodes in the switch
570     ** below need to be considered.  The mkopcodeh.tcl generator script groups
571     ** all these opcodes together near the front of the opcode list.  Skip
572     ** any opcode that does not need processing by virtual of the fact that
573     ** it is larger than SQLITE_MX_JUMP_OPCODE, as a performance optimization.
574     */
575     if( pOp->opcode<=SQLITE_MX_JUMP_OPCODE ){
576       /* NOTE: Be sure to update mkopcodeh.tcl when adding or removing
577       ** cases from this switch! */
578       switch( pOp->opcode ){
579         case OP_Transaction: {
580           if( pOp->p2!=0 ) p->readOnly = 0;
581           /* fall thru */
582         }
583         case OP_AutoCommit:
584         case OP_Savepoint: {
585           p->bIsReader = 1;
586           break;
587         }
588 #ifndef SQLITE_OMIT_WAL
589         case OP_Checkpoint:
590 #endif
591         case OP_Vacuum:
592         case OP_JournalMode: {
593           p->readOnly = 0;
594           p->bIsReader = 1;
595           break;
596         }
597 #ifndef SQLITE_OMIT_VIRTUALTABLE
598         case OP_VUpdate: {
599           if( pOp->p2>nMaxArgs ) nMaxArgs = pOp->p2;
600           break;
601         }
602         case OP_VFilter: {
603           int n;
604           assert( (pOp - p->aOp) >= 3 );
605           assert( pOp[-1].opcode==OP_Integer );
606           n = pOp[-1].p1;
607           if( n>nMaxArgs ) nMaxArgs = n;
608           break;
609         }
610 #endif
611         case OP_Next:
612         case OP_NextIfOpen:
613         case OP_SorterNext: {
614           pOp->p4.xAdvance = sqlite3BtreeNext;
615           pOp->p4type = P4_ADVANCE;
616           break;
617         }
618         case OP_Prev:
619         case OP_PrevIfOpen: {
620           pOp->p4.xAdvance = sqlite3BtreePrevious;
621           pOp->p4type = P4_ADVANCE;
622           break;
623         }
624       }
625       if( (sqlite3OpcodeProperty[pOp->opcode] & OPFLG_JUMP)!=0 && pOp->p2<0 ){
626         assert( ADDR(pOp->p2)<pParse->nLabel );
627         pOp->p2 = aLabel[ADDR(pOp->p2)];
628       }
629     }
630     if( pOp==p->aOp ) break;
631     pOp--;
632   }
633   sqlite3DbFree(p->db, pParse->aLabel);
634   pParse->aLabel = 0;
635   pParse->nLabel = 0;
636   *pMaxFuncArgs = nMaxArgs;
637   assert( p->bIsReader!=0 || DbMaskAllZero(p->btreeMask) );
638 }
639 
640 /*
641 ** Return the address of the next instruction to be inserted.
642 */
643 int sqlite3VdbeCurrentAddr(Vdbe *p){
644   assert( p->magic==VDBE_MAGIC_INIT );
645   return p->nOp;
646 }
647 
648 /*
649 ** Verify that at least N opcode slots are available in p without
650 ** having to malloc for more space (except when compiled using
651 ** SQLITE_TEST_REALLOC_STRESS).  This interface is used during testing
652 ** to verify that certain calls to sqlite3VdbeAddOpList() can never
653 ** fail due to a OOM fault and hence that the return value from
654 ** sqlite3VdbeAddOpList() will always be non-NULL.
655 */
656 #if defined(SQLITE_DEBUG) && !defined(SQLITE_TEST_REALLOC_STRESS)
657 void sqlite3VdbeVerifyNoMallocRequired(Vdbe *p, int N){
658   assert( p->nOp + N <= p->pParse->nOpAlloc );
659 }
660 #endif
661 
662 /*
663 ** Verify that the VM passed as the only argument does not contain
664 ** an OP_ResultRow opcode. Fail an assert() if it does. This is used
665 ** by code in pragma.c to ensure that the implementation of certain
666 ** pragmas comports with the flags specified in the mkpragmatab.tcl
667 ** script.
668 */
669 #if defined(SQLITE_DEBUG) && !defined(SQLITE_TEST_REALLOC_STRESS)
670 void sqlite3VdbeVerifyNoResultRow(Vdbe *p){
671   int i;
672   for(i=0; i<p->nOp; i++){
673     assert( p->aOp[i].opcode!=OP_ResultRow );
674   }
675 }
676 #endif
677 
678 /*
679 ** This function returns a pointer to the array of opcodes associated with
680 ** the Vdbe passed as the first argument. It is the callers responsibility
681 ** to arrange for the returned array to be eventually freed using the
682 ** vdbeFreeOpArray() function.
683 **
684 ** Before returning, *pnOp is set to the number of entries in the returned
685 ** array. Also, *pnMaxArg is set to the larger of its current value and
686 ** the number of entries in the Vdbe.apArg[] array required to execute the
687 ** returned program.
688 */
689 VdbeOp *sqlite3VdbeTakeOpArray(Vdbe *p, int *pnOp, int *pnMaxArg){
690   VdbeOp *aOp = p->aOp;
691   assert( aOp && !p->db->mallocFailed );
692 
693   /* Check that sqlite3VdbeUsesBtree() was not called on this VM */
694   assert( DbMaskAllZero(p->btreeMask) );
695 
696   resolveP2Values(p, pnMaxArg);
697   *pnOp = p->nOp;
698   p->aOp = 0;
699   return aOp;
700 }
701 
702 /*
703 ** Add a whole list of operations to the operation stack.  Return a
704 ** pointer to the first operation inserted.
705 **
706 ** Non-zero P2 arguments to jump instructions are automatically adjusted
707 ** so that the jump target is relative to the first operation inserted.
708 */
709 VdbeOp *sqlite3VdbeAddOpList(
710   Vdbe *p,                     /* Add opcodes to the prepared statement */
711   int nOp,                     /* Number of opcodes to add */
712   VdbeOpList const *aOp,       /* The opcodes to be added */
713   int iLineno                  /* Source-file line number of first opcode */
714 ){
715   int i;
716   VdbeOp *pOut, *pFirst;
717   assert( nOp>0 );
718   assert( p->magic==VDBE_MAGIC_INIT );
719   if( p->nOp + nOp > p->pParse->nOpAlloc && growOpArray(p, nOp) ){
720     return 0;
721   }
722   pFirst = pOut = &p->aOp[p->nOp];
723   for(i=0; i<nOp; i++, aOp++, pOut++){
724     pOut->opcode = aOp->opcode;
725     pOut->p1 = aOp->p1;
726     pOut->p2 = aOp->p2;
727     assert( aOp->p2>=0 );
728     if( (sqlite3OpcodeProperty[aOp->opcode] & OPFLG_JUMP)!=0 && aOp->p2>0 ){
729       pOut->p2 += p->nOp;
730     }
731     pOut->p3 = aOp->p3;
732     pOut->p4type = P4_NOTUSED;
733     pOut->p4.p = 0;
734     pOut->p5 = 0;
735 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
736     pOut->zComment = 0;
737 #endif
738 #ifdef SQLITE_VDBE_COVERAGE
739     pOut->iSrcLine = iLineno+i;
740 #else
741     (void)iLineno;
742 #endif
743 #ifdef SQLITE_DEBUG
744     if( p->db->flags & SQLITE_VdbeAddopTrace ){
745       sqlite3VdbePrintOp(0, i+p->nOp, &p->aOp[i+p->nOp]);
746     }
747 #endif
748   }
749   p->nOp += nOp;
750   return pFirst;
751 }
752 
753 #if defined(SQLITE_ENABLE_STMT_SCANSTATUS)
754 /*
755 ** Add an entry to the array of counters managed by sqlite3_stmt_scanstatus().
756 */
757 void sqlite3VdbeScanStatus(
758   Vdbe *p,                        /* VM to add scanstatus() to */
759   int addrExplain,                /* Address of OP_Explain (or 0) */
760   int addrLoop,                   /* Address of loop counter */
761   int addrVisit,                  /* Address of rows visited counter */
762   LogEst nEst,                    /* Estimated number of output rows */
763   const char *zName               /* Name of table or index being scanned */
764 ){
765   int nByte = (p->nScan+1) * sizeof(ScanStatus);
766   ScanStatus *aNew;
767   aNew = (ScanStatus*)sqlite3DbRealloc(p->db, p->aScan, nByte);
768   if( aNew ){
769     ScanStatus *pNew = &aNew[p->nScan++];
770     pNew->addrExplain = addrExplain;
771     pNew->addrLoop = addrLoop;
772     pNew->addrVisit = addrVisit;
773     pNew->nEst = nEst;
774     pNew->zName = sqlite3DbStrDup(p->db, zName);
775     p->aScan = aNew;
776   }
777 }
778 #endif
779 
780 
781 /*
782 ** Change the value of the opcode, or P1, P2, P3, or P5 operands
783 ** for a specific instruction.
784 */
785 void sqlite3VdbeChangeOpcode(Vdbe *p, u32 addr, u8 iNewOpcode){
786   sqlite3VdbeGetOp(p,addr)->opcode = iNewOpcode;
787 }
788 void sqlite3VdbeChangeP1(Vdbe *p, u32 addr, int val){
789   sqlite3VdbeGetOp(p,addr)->p1 = val;
790 }
791 void sqlite3VdbeChangeP2(Vdbe *p, u32 addr, int val){
792   sqlite3VdbeGetOp(p,addr)->p2 = val;
793 }
794 void sqlite3VdbeChangeP3(Vdbe *p, u32 addr, int val){
795   sqlite3VdbeGetOp(p,addr)->p3 = val;
796 }
797 void sqlite3VdbeChangeP5(Vdbe *p, u16 p5){
798   assert( p->nOp>0 || p->db->mallocFailed );
799   if( p->nOp>0 ) p->aOp[p->nOp-1].p5 = p5;
800 }
801 
802 /*
803 ** Change the P2 operand of instruction addr so that it points to
804 ** the address of the next instruction to be coded.
805 */
806 void sqlite3VdbeJumpHere(Vdbe *p, int addr){
807   sqlite3VdbeChangeP2(p, addr, p->nOp);
808 }
809 
810 
811 /*
812 ** If the input FuncDef structure is ephemeral, then free it.  If
813 ** the FuncDef is not ephermal, then do nothing.
814 */
815 static void freeEphemeralFunction(sqlite3 *db, FuncDef *pDef){
816   if( (pDef->funcFlags & SQLITE_FUNC_EPHEM)!=0 ){
817     sqlite3DbFreeNN(db, pDef);
818   }
819 }
820 
821 static void vdbeFreeOpArray(sqlite3 *, Op *, int);
822 
823 /*
824 ** Delete a P4 value if necessary.
825 */
826 static SQLITE_NOINLINE void freeP4Mem(sqlite3 *db, Mem *p){
827   if( p->szMalloc ) sqlite3DbFree(db, p->zMalloc);
828   sqlite3DbFreeNN(db, p);
829 }
830 static SQLITE_NOINLINE void freeP4FuncCtx(sqlite3 *db, sqlite3_context *p){
831   freeEphemeralFunction(db, p->pFunc);
832  sqlite3DbFreeNN(db, p);
833 }
834 static void freeP4(sqlite3 *db, int p4type, void *p4){
835   assert( db );
836   switch( p4type ){
837     case P4_FUNCCTX: {
838       freeP4FuncCtx(db, (sqlite3_context*)p4);
839       break;
840     }
841     case P4_REAL:
842     case P4_INT64:
843     case P4_DYNAMIC:
844     case P4_INTARRAY: {
845       sqlite3DbFree(db, p4);
846       break;
847     }
848     case P4_KEYINFO: {
849       if( db->pnBytesFreed==0 ) sqlite3KeyInfoUnref((KeyInfo*)p4);
850       break;
851     }
852 #ifdef SQLITE_ENABLE_CURSOR_HINTS
853     case P4_EXPR: {
854       sqlite3ExprDelete(db, (Expr*)p4);
855       break;
856     }
857 #endif
858     case P4_FUNCDEF: {
859       freeEphemeralFunction(db, (FuncDef*)p4);
860       break;
861     }
862     case P4_MEM: {
863       if( db->pnBytesFreed==0 ){
864         sqlite3ValueFree((sqlite3_value*)p4);
865       }else{
866         freeP4Mem(db, (Mem*)p4);
867       }
868       break;
869     }
870     case P4_VTAB : {
871       if( db->pnBytesFreed==0 ) sqlite3VtabUnlock((VTable *)p4);
872       break;
873     }
874   }
875 }
876 
877 /*
878 ** Free the space allocated for aOp and any p4 values allocated for the
879 ** opcodes contained within. If aOp is not NULL it is assumed to contain
880 ** nOp entries.
881 */
882 static void vdbeFreeOpArray(sqlite3 *db, Op *aOp, int nOp){
883   if( aOp ){
884     Op *pOp;
885     for(pOp=&aOp[nOp-1]; pOp>=aOp; pOp--){
886       if( pOp->p4type ) freeP4(db, pOp->p4type, pOp->p4.p);
887 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
888       sqlite3DbFree(db, pOp->zComment);
889 #endif
890     }
891     sqlite3DbFreeNN(db, aOp);
892   }
893 }
894 
895 /*
896 ** Link the SubProgram object passed as the second argument into the linked
897 ** list at Vdbe.pSubProgram. This list is used to delete all sub-program
898 ** objects when the VM is no longer required.
899 */
900 void sqlite3VdbeLinkSubProgram(Vdbe *pVdbe, SubProgram *p){
901   p->pNext = pVdbe->pProgram;
902   pVdbe->pProgram = p;
903 }
904 
905 /*
906 ** Change the opcode at addr into OP_Noop
907 */
908 int sqlite3VdbeChangeToNoop(Vdbe *p, int addr){
909   VdbeOp *pOp;
910   if( p->db->mallocFailed ) return 0;
911   assert( addr>=0 && addr<p->nOp );
912   pOp = &p->aOp[addr];
913   freeP4(p->db, pOp->p4type, pOp->p4.p);
914   pOp->p4type = P4_NOTUSED;
915   pOp->p4.z = 0;
916   pOp->opcode = OP_Noop;
917   return 1;
918 }
919 
920 /*
921 ** If the last opcode is "op" and it is not a jump destination,
922 ** then remove it.  Return true if and only if an opcode was removed.
923 */
924 int sqlite3VdbeDeletePriorOpcode(Vdbe *p, u8 op){
925   if( p->nOp>0 && p->aOp[p->nOp-1].opcode==op ){
926     return sqlite3VdbeChangeToNoop(p, p->nOp-1);
927   }else{
928     return 0;
929   }
930 }
931 
932 /*
933 ** Change the value of the P4 operand for a specific instruction.
934 ** This routine is useful when a large program is loaded from a
935 ** static array using sqlite3VdbeAddOpList but we want to make a
936 ** few minor changes to the program.
937 **
938 ** If n>=0 then the P4 operand is dynamic, meaning that a copy of
939 ** the string is made into memory obtained from sqlite3_malloc().
940 ** A value of n==0 means copy bytes of zP4 up to and including the
941 ** first null byte.  If n>0 then copy n+1 bytes of zP4.
942 **
943 ** Other values of n (P4_STATIC, P4_COLLSEQ etc.) indicate that zP4 points
944 ** to a string or structure that is guaranteed to exist for the lifetime of
945 ** the Vdbe. In these cases we can just copy the pointer.
946 **
947 ** If addr<0 then change P4 on the most recently inserted instruction.
948 */
949 static void SQLITE_NOINLINE vdbeChangeP4Full(
950   Vdbe *p,
951   Op *pOp,
952   const char *zP4,
953   int n
954 ){
955   if( pOp->p4type ){
956     freeP4(p->db, pOp->p4type, pOp->p4.p);
957     pOp->p4type = 0;
958     pOp->p4.p = 0;
959   }
960   if( n<0 ){
961     sqlite3VdbeChangeP4(p, (int)(pOp - p->aOp), zP4, n);
962   }else{
963     if( n==0 ) n = sqlite3Strlen30(zP4);
964     pOp->p4.z = sqlite3DbStrNDup(p->db, zP4, n);
965     pOp->p4type = P4_DYNAMIC;
966   }
967 }
968 void sqlite3VdbeChangeP4(Vdbe *p, int addr, const char *zP4, int n){
969   Op *pOp;
970   sqlite3 *db;
971   assert( p!=0 );
972   db = p->db;
973   assert( p->magic==VDBE_MAGIC_INIT );
974   assert( p->aOp!=0 || db->mallocFailed );
975   if( db->mallocFailed ){
976     if( n!=P4_VTAB ) freeP4(db, n, (void*)*(char**)&zP4);
977     return;
978   }
979   assert( p->nOp>0 );
980   assert( addr<p->nOp );
981   if( addr<0 ){
982     addr = p->nOp - 1;
983   }
984   pOp = &p->aOp[addr];
985   if( n>=0 || pOp->p4type ){
986     vdbeChangeP4Full(p, pOp, zP4, n);
987     return;
988   }
989   if( n==P4_INT32 ){
990     /* Note: this cast is safe, because the origin data point was an int
991     ** that was cast to a (const char *). */
992     pOp->p4.i = SQLITE_PTR_TO_INT(zP4);
993     pOp->p4type = P4_INT32;
994   }else if( zP4!=0 ){
995     assert( n<0 );
996     pOp->p4.p = (void*)zP4;
997     pOp->p4type = (signed char)n;
998     if( n==P4_VTAB ) sqlite3VtabLock((VTable*)zP4);
999   }
1000 }
1001 
1002 /*
1003 ** Change the P4 operand of the most recently coded instruction
1004 ** to the value defined by the arguments.  This is a high-speed
1005 ** version of sqlite3VdbeChangeP4().
1006 **
1007 ** The P4 operand must not have been previously defined.  And the new
1008 ** P4 must not be P4_INT32.  Use sqlite3VdbeChangeP4() in either of
1009 ** those cases.
1010 */
1011 void sqlite3VdbeAppendP4(Vdbe *p, void *pP4, int n){
1012   VdbeOp *pOp;
1013   assert( n!=P4_INT32 && n!=P4_VTAB );
1014   assert( n<=0 );
1015   if( p->db->mallocFailed ){
1016     freeP4(p->db, n, pP4);
1017   }else{
1018     assert( pP4!=0 );
1019     assert( p->nOp>0 );
1020     pOp = &p->aOp[p->nOp-1];
1021     assert( pOp->p4type==P4_NOTUSED );
1022     pOp->p4type = n;
1023     pOp->p4.p = pP4;
1024   }
1025 }
1026 
1027 /*
1028 ** Set the P4 on the most recently added opcode to the KeyInfo for the
1029 ** index given.
1030 */
1031 void sqlite3VdbeSetP4KeyInfo(Parse *pParse, Index *pIdx){
1032   Vdbe *v = pParse->pVdbe;
1033   KeyInfo *pKeyInfo;
1034   assert( v!=0 );
1035   assert( pIdx!=0 );
1036   pKeyInfo = sqlite3KeyInfoOfIndex(pParse, pIdx);
1037   if( pKeyInfo ) sqlite3VdbeAppendP4(v, pKeyInfo, P4_KEYINFO);
1038 }
1039 
1040 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1041 /*
1042 ** Change the comment on the most recently coded instruction.  Or
1043 ** insert a No-op and add the comment to that new instruction.  This
1044 ** makes the code easier to read during debugging.  None of this happens
1045 ** in a production build.
1046 */
1047 static void vdbeVComment(Vdbe *p, const char *zFormat, va_list ap){
1048   assert( p->nOp>0 || p->aOp==0 );
1049   assert( p->aOp==0 || p->aOp[p->nOp-1].zComment==0 || p->db->mallocFailed );
1050   if( p->nOp ){
1051     assert( p->aOp );
1052     sqlite3DbFree(p->db, p->aOp[p->nOp-1].zComment);
1053     p->aOp[p->nOp-1].zComment = sqlite3VMPrintf(p->db, zFormat, ap);
1054   }
1055 }
1056 void sqlite3VdbeComment(Vdbe *p, const char *zFormat, ...){
1057   va_list ap;
1058   if( p ){
1059     va_start(ap, zFormat);
1060     vdbeVComment(p, zFormat, ap);
1061     va_end(ap);
1062   }
1063 }
1064 void sqlite3VdbeNoopComment(Vdbe *p, const char *zFormat, ...){
1065   va_list ap;
1066   if( p ){
1067     sqlite3VdbeAddOp0(p, OP_Noop);
1068     va_start(ap, zFormat);
1069     vdbeVComment(p, zFormat, ap);
1070     va_end(ap);
1071   }
1072 }
1073 #endif  /* NDEBUG */
1074 
1075 #ifdef SQLITE_VDBE_COVERAGE
1076 /*
1077 ** Set the value if the iSrcLine field for the previously coded instruction.
1078 */
1079 void sqlite3VdbeSetLineNumber(Vdbe *v, int iLine){
1080   sqlite3VdbeGetOp(v,-1)->iSrcLine = iLine;
1081 }
1082 #endif /* SQLITE_VDBE_COVERAGE */
1083 
1084 /*
1085 ** Return the opcode for a given address.  If the address is -1, then
1086 ** return the most recently inserted opcode.
1087 **
1088 ** If a memory allocation error has occurred prior to the calling of this
1089 ** routine, then a pointer to a dummy VdbeOp will be returned.  That opcode
1090 ** is readable but not writable, though it is cast to a writable value.
1091 ** The return of a dummy opcode allows the call to continue functioning
1092 ** after an OOM fault without having to check to see if the return from
1093 ** this routine is a valid pointer.  But because the dummy.opcode is 0,
1094 ** dummy will never be written to.  This is verified by code inspection and
1095 ** by running with Valgrind.
1096 */
1097 VdbeOp *sqlite3VdbeGetOp(Vdbe *p, int addr){
1098   /* C89 specifies that the constant "dummy" will be initialized to all
1099   ** zeros, which is correct.  MSVC generates a warning, nevertheless. */
1100   static VdbeOp dummy;  /* Ignore the MSVC warning about no initializer */
1101   assert( p->magic==VDBE_MAGIC_INIT );
1102   if( addr<0 ){
1103     addr = p->nOp - 1;
1104   }
1105   assert( (addr>=0 && addr<p->nOp) || p->db->mallocFailed );
1106   if( p->db->mallocFailed ){
1107     return (VdbeOp*)&dummy;
1108   }else{
1109     return &p->aOp[addr];
1110   }
1111 }
1112 
1113 #if defined(SQLITE_ENABLE_EXPLAIN_COMMENTS)
1114 /*
1115 ** Return an integer value for one of the parameters to the opcode pOp
1116 ** determined by character c.
1117 */
1118 static int translateP(char c, const Op *pOp){
1119   if( c=='1' ) return pOp->p1;
1120   if( c=='2' ) return pOp->p2;
1121   if( c=='3' ) return pOp->p3;
1122   if( c=='4' ) return pOp->p4.i;
1123   return pOp->p5;
1124 }
1125 
1126 /*
1127 ** Compute a string for the "comment" field of a VDBE opcode listing.
1128 **
1129 ** The Synopsis: field in comments in the vdbe.c source file gets converted
1130 ** to an extra string that is appended to the sqlite3OpcodeName().  In the
1131 ** absence of other comments, this synopsis becomes the comment on the opcode.
1132 ** Some translation occurs:
1133 **
1134 **       "PX"      ->  "r[X]"
1135 **       "PX@PY"   ->  "r[X..X+Y-1]"  or "r[x]" if y is 0 or 1
1136 **       "PX@PY+1" ->  "r[X..X+Y]"    or "r[x]" if y is 0
1137 **       "PY..PY"  ->  "r[X..Y]"      or "r[x]" if y<=x
1138 */
1139 static int displayComment(
1140   const Op *pOp,     /* The opcode to be commented */
1141   const char *zP4,   /* Previously obtained value for P4 */
1142   char *zTemp,       /* Write result here */
1143   int nTemp          /* Space available in zTemp[] */
1144 ){
1145   const char *zOpName;
1146   const char *zSynopsis;
1147   int nOpName;
1148   int ii, jj;
1149   char zAlt[50];
1150   zOpName = sqlite3OpcodeName(pOp->opcode);
1151   nOpName = sqlite3Strlen30(zOpName);
1152   if( zOpName[nOpName+1] ){
1153     int seenCom = 0;
1154     char c;
1155     zSynopsis = zOpName += nOpName + 1;
1156     if( strncmp(zSynopsis,"IF ",3)==0 ){
1157       if( pOp->p5 & SQLITE_STOREP2 ){
1158         sqlite3_snprintf(sizeof(zAlt), zAlt, "r[P2] = (%s)", zSynopsis+3);
1159       }else{
1160         sqlite3_snprintf(sizeof(zAlt), zAlt, "if %s goto P2", zSynopsis+3);
1161       }
1162       zSynopsis = zAlt;
1163     }
1164     for(ii=jj=0; jj<nTemp-1 && (c = zSynopsis[ii])!=0; ii++){
1165       if( c=='P' ){
1166         c = zSynopsis[++ii];
1167         if( c=='4' ){
1168           sqlite3_snprintf(nTemp-jj, zTemp+jj, "%s", zP4);
1169         }else if( c=='X' ){
1170           sqlite3_snprintf(nTemp-jj, zTemp+jj, "%s", pOp->zComment);
1171           seenCom = 1;
1172         }else{
1173           int v1 = translateP(c, pOp);
1174           int v2;
1175           sqlite3_snprintf(nTemp-jj, zTemp+jj, "%d", v1);
1176           if( strncmp(zSynopsis+ii+1, "@P", 2)==0 ){
1177             ii += 3;
1178             jj += sqlite3Strlen30(zTemp+jj);
1179             v2 = translateP(zSynopsis[ii], pOp);
1180             if( strncmp(zSynopsis+ii+1,"+1",2)==0 ){
1181               ii += 2;
1182               v2++;
1183             }
1184             if( v2>1 ){
1185               sqlite3_snprintf(nTemp-jj, zTemp+jj, "..%d", v1+v2-1);
1186             }
1187           }else if( strncmp(zSynopsis+ii+1, "..P3", 4)==0 && pOp->p3==0 ){
1188             ii += 4;
1189           }
1190         }
1191         jj += sqlite3Strlen30(zTemp+jj);
1192       }else{
1193         zTemp[jj++] = c;
1194       }
1195     }
1196     if( !seenCom && jj<nTemp-5 && pOp->zComment ){
1197       sqlite3_snprintf(nTemp-jj, zTemp+jj, "; %s", pOp->zComment);
1198       jj += sqlite3Strlen30(zTemp+jj);
1199     }
1200     if( jj<nTemp ) zTemp[jj] = 0;
1201   }else if( pOp->zComment ){
1202     sqlite3_snprintf(nTemp, zTemp, "%s", pOp->zComment);
1203     jj = sqlite3Strlen30(zTemp);
1204   }else{
1205     zTemp[0] = 0;
1206     jj = 0;
1207   }
1208   return jj;
1209 }
1210 #endif /* SQLITE_DEBUG */
1211 
1212 #if VDBE_DISPLAY_P4 && defined(SQLITE_ENABLE_CURSOR_HINTS)
1213 /*
1214 ** Translate the P4.pExpr value for an OP_CursorHint opcode into text
1215 ** that can be displayed in the P4 column of EXPLAIN output.
1216 */
1217 static void displayP4Expr(StrAccum *p, Expr *pExpr){
1218   const char *zOp = 0;
1219   switch( pExpr->op ){
1220     case TK_STRING:
1221       sqlite3XPrintf(p, "%Q", pExpr->u.zToken);
1222       break;
1223     case TK_INTEGER:
1224       sqlite3XPrintf(p, "%d", pExpr->u.iValue);
1225       break;
1226     case TK_NULL:
1227       sqlite3XPrintf(p, "NULL");
1228       break;
1229     case TK_REGISTER: {
1230       sqlite3XPrintf(p, "r[%d]", pExpr->iTable);
1231       break;
1232     }
1233     case TK_COLUMN: {
1234       if( pExpr->iColumn<0 ){
1235         sqlite3XPrintf(p, "rowid");
1236       }else{
1237         sqlite3XPrintf(p, "c%d", (int)pExpr->iColumn);
1238       }
1239       break;
1240     }
1241     case TK_LT:      zOp = "LT";      break;
1242     case TK_LE:      zOp = "LE";      break;
1243     case TK_GT:      zOp = "GT";      break;
1244     case TK_GE:      zOp = "GE";      break;
1245     case TK_NE:      zOp = "NE";      break;
1246     case TK_EQ:      zOp = "EQ";      break;
1247     case TK_IS:      zOp = "IS";      break;
1248     case TK_ISNOT:   zOp = "ISNOT";   break;
1249     case TK_AND:     zOp = "AND";     break;
1250     case TK_OR:      zOp = "OR";      break;
1251     case TK_PLUS:    zOp = "ADD";     break;
1252     case TK_STAR:    zOp = "MUL";     break;
1253     case TK_MINUS:   zOp = "SUB";     break;
1254     case TK_REM:     zOp = "REM";     break;
1255     case TK_BITAND:  zOp = "BITAND";  break;
1256     case TK_BITOR:   zOp = "BITOR";   break;
1257     case TK_SLASH:   zOp = "DIV";     break;
1258     case TK_LSHIFT:  zOp = "LSHIFT";  break;
1259     case TK_RSHIFT:  zOp = "RSHIFT";  break;
1260     case TK_CONCAT:  zOp = "CONCAT";  break;
1261     case TK_UMINUS:  zOp = "MINUS";   break;
1262     case TK_UPLUS:   zOp = "PLUS";    break;
1263     case TK_BITNOT:  zOp = "BITNOT";  break;
1264     case TK_NOT:     zOp = "NOT";     break;
1265     case TK_ISNULL:  zOp = "ISNULL";  break;
1266     case TK_NOTNULL: zOp = "NOTNULL"; break;
1267 
1268     default:
1269       sqlite3XPrintf(p, "%s", "expr");
1270       break;
1271   }
1272 
1273   if( zOp ){
1274     sqlite3XPrintf(p, "%s(", zOp);
1275     displayP4Expr(p, pExpr->pLeft);
1276     if( pExpr->pRight ){
1277       sqlite3StrAccumAppend(p, ",", 1);
1278       displayP4Expr(p, pExpr->pRight);
1279     }
1280     sqlite3StrAccumAppend(p, ")", 1);
1281   }
1282 }
1283 #endif /* VDBE_DISPLAY_P4 && defined(SQLITE_ENABLE_CURSOR_HINTS) */
1284 
1285 
1286 #if VDBE_DISPLAY_P4
1287 /*
1288 ** Compute a string that describes the P4 parameter for an opcode.
1289 ** Use zTemp for any required temporary buffer space.
1290 */
1291 static char *displayP4(Op *pOp, char *zTemp, int nTemp){
1292   char *zP4 = zTemp;
1293   StrAccum x;
1294   assert( nTemp>=20 );
1295   sqlite3StrAccumInit(&x, 0, zTemp, nTemp, 0);
1296   switch( pOp->p4type ){
1297     case P4_KEYINFO: {
1298       int j;
1299       KeyInfo *pKeyInfo = pOp->p4.pKeyInfo;
1300       assert( pKeyInfo->aSortOrder!=0 );
1301       sqlite3XPrintf(&x, "k(%d", pKeyInfo->nField);
1302       for(j=0; j<pKeyInfo->nField; j++){
1303         CollSeq *pColl = pKeyInfo->aColl[j];
1304         const char *zColl = pColl ? pColl->zName : "";
1305         if( strcmp(zColl, "BINARY")==0 ) zColl = "B";
1306         sqlite3XPrintf(&x, ",%s%s", pKeyInfo->aSortOrder[j] ? "-" : "", zColl);
1307       }
1308       sqlite3StrAccumAppend(&x, ")", 1);
1309       break;
1310     }
1311 #ifdef SQLITE_ENABLE_CURSOR_HINTS
1312     case P4_EXPR: {
1313       displayP4Expr(&x, pOp->p4.pExpr);
1314       break;
1315     }
1316 #endif
1317     case P4_COLLSEQ: {
1318       CollSeq *pColl = pOp->p4.pColl;
1319       sqlite3XPrintf(&x, "(%.20s)", pColl->zName);
1320       break;
1321     }
1322     case P4_FUNCDEF: {
1323       FuncDef *pDef = pOp->p4.pFunc;
1324       sqlite3XPrintf(&x, "%s(%d)", pDef->zName, pDef->nArg);
1325       break;
1326     }
1327 #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
1328     case P4_FUNCCTX: {
1329       FuncDef *pDef = pOp->p4.pCtx->pFunc;
1330       sqlite3XPrintf(&x, "%s(%d)", pDef->zName, pDef->nArg);
1331       break;
1332     }
1333 #endif
1334     case P4_INT64: {
1335       sqlite3XPrintf(&x, "%lld", *pOp->p4.pI64);
1336       break;
1337     }
1338     case P4_INT32: {
1339       sqlite3XPrintf(&x, "%d", pOp->p4.i);
1340       break;
1341     }
1342     case P4_REAL: {
1343       sqlite3XPrintf(&x, "%.16g", *pOp->p4.pReal);
1344       break;
1345     }
1346     case P4_MEM: {
1347       Mem *pMem = pOp->p4.pMem;
1348       if( pMem->flags & MEM_Str ){
1349         zP4 = pMem->z;
1350       }else if( pMem->flags & MEM_Int ){
1351         sqlite3XPrintf(&x, "%lld", pMem->u.i);
1352       }else if( pMem->flags & MEM_Real ){
1353         sqlite3XPrintf(&x, "%.16g", pMem->u.r);
1354       }else if( pMem->flags & MEM_Null ){
1355         zP4 = "NULL";
1356       }else{
1357         assert( pMem->flags & MEM_Blob );
1358         zP4 = "(blob)";
1359       }
1360       break;
1361     }
1362 #ifndef SQLITE_OMIT_VIRTUALTABLE
1363     case P4_VTAB: {
1364       sqlite3_vtab *pVtab = pOp->p4.pVtab->pVtab;
1365       sqlite3XPrintf(&x, "vtab:%p", pVtab);
1366       break;
1367     }
1368 #endif
1369     case P4_INTARRAY: {
1370       int i;
1371       int *ai = pOp->p4.ai;
1372       int n = ai[0];   /* The first element of an INTARRAY is always the
1373                        ** count of the number of elements to follow */
1374       for(i=1; i<n; i++){
1375         sqlite3XPrintf(&x, ",%d", ai[i]);
1376       }
1377       zTemp[0] = '[';
1378       sqlite3StrAccumAppend(&x, "]", 1);
1379       break;
1380     }
1381     case P4_SUBPROGRAM: {
1382       sqlite3XPrintf(&x, "program");
1383       break;
1384     }
1385     case P4_ADVANCE: {
1386       zTemp[0] = 0;
1387       break;
1388     }
1389     case P4_TABLE: {
1390       sqlite3XPrintf(&x, "%s", pOp->p4.pTab->zName);
1391       break;
1392     }
1393     default: {
1394       zP4 = pOp->p4.z;
1395       if( zP4==0 ){
1396         zP4 = zTemp;
1397         zTemp[0] = 0;
1398       }
1399     }
1400   }
1401   sqlite3StrAccumFinish(&x);
1402   assert( zP4!=0 );
1403   return zP4;
1404 }
1405 #endif /* VDBE_DISPLAY_P4 */
1406 
1407 /*
1408 ** Declare to the Vdbe that the BTree object at db->aDb[i] is used.
1409 **
1410 ** The prepared statements need to know in advance the complete set of
1411 ** attached databases that will be use.  A mask of these databases
1412 ** is maintained in p->btreeMask.  The p->lockMask value is the subset of
1413 ** p->btreeMask of databases that will require a lock.
1414 */
1415 void sqlite3VdbeUsesBtree(Vdbe *p, int i){
1416   assert( i>=0 && i<p->db->nDb && i<(int)sizeof(yDbMask)*8 );
1417   assert( i<(int)sizeof(p->btreeMask)*8 );
1418   DbMaskSet(p->btreeMask, i);
1419   if( i!=1 && sqlite3BtreeSharable(p->db->aDb[i].pBt) ){
1420     DbMaskSet(p->lockMask, i);
1421   }
1422 }
1423 
1424 #if !defined(SQLITE_OMIT_SHARED_CACHE)
1425 /*
1426 ** If SQLite is compiled to support shared-cache mode and to be threadsafe,
1427 ** this routine obtains the mutex associated with each BtShared structure
1428 ** that may be accessed by the VM passed as an argument. In doing so it also
1429 ** sets the BtShared.db member of each of the BtShared structures, ensuring
1430 ** that the correct busy-handler callback is invoked if required.
1431 **
1432 ** If SQLite is not threadsafe but does support shared-cache mode, then
1433 ** sqlite3BtreeEnter() is invoked to set the BtShared.db variables
1434 ** of all of BtShared structures accessible via the database handle
1435 ** associated with the VM.
1436 **
1437 ** If SQLite is not threadsafe and does not support shared-cache mode, this
1438 ** function is a no-op.
1439 **
1440 ** The p->btreeMask field is a bitmask of all btrees that the prepared
1441 ** statement p will ever use.  Let N be the number of bits in p->btreeMask
1442 ** corresponding to btrees that use shared cache.  Then the runtime of
1443 ** this routine is N*N.  But as N is rarely more than 1, this should not
1444 ** be a problem.
1445 */
1446 void sqlite3VdbeEnter(Vdbe *p){
1447   int i;
1448   sqlite3 *db;
1449   Db *aDb;
1450   int nDb;
1451   if( DbMaskAllZero(p->lockMask) ) return;  /* The common case */
1452   db = p->db;
1453   aDb = db->aDb;
1454   nDb = db->nDb;
1455   for(i=0; i<nDb; i++){
1456     if( i!=1 && DbMaskTest(p->lockMask,i) && ALWAYS(aDb[i].pBt!=0) ){
1457       sqlite3BtreeEnter(aDb[i].pBt);
1458     }
1459   }
1460 }
1461 #endif
1462 
1463 #if !defined(SQLITE_OMIT_SHARED_CACHE) && SQLITE_THREADSAFE>0
1464 /*
1465 ** Unlock all of the btrees previously locked by a call to sqlite3VdbeEnter().
1466 */
1467 static SQLITE_NOINLINE void vdbeLeave(Vdbe *p){
1468   int i;
1469   sqlite3 *db;
1470   Db *aDb;
1471   int nDb;
1472   db = p->db;
1473   aDb = db->aDb;
1474   nDb = db->nDb;
1475   for(i=0; i<nDb; i++){
1476     if( i!=1 && DbMaskTest(p->lockMask,i) && ALWAYS(aDb[i].pBt!=0) ){
1477       sqlite3BtreeLeave(aDb[i].pBt);
1478     }
1479   }
1480 }
1481 void sqlite3VdbeLeave(Vdbe *p){
1482   if( DbMaskAllZero(p->lockMask) ) return;  /* The common case */
1483   vdbeLeave(p);
1484 }
1485 #endif
1486 
1487 #if defined(VDBE_PROFILE) || defined(SQLITE_DEBUG)
1488 /*
1489 ** Print a single opcode.  This routine is used for debugging only.
1490 */
1491 void sqlite3VdbePrintOp(FILE *pOut, int pc, Op *pOp){
1492   char *zP4;
1493   char zPtr[50];
1494   char zCom[100];
1495   static const char *zFormat1 = "%4d %-13s %4d %4d %4d %-13s %.2X %s\n";
1496   if( pOut==0 ) pOut = stdout;
1497   zP4 = displayP4(pOp, zPtr, sizeof(zPtr));
1498 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1499   displayComment(pOp, zP4, zCom, sizeof(zCom));
1500 #else
1501   zCom[0] = 0;
1502 #endif
1503   /* NB:  The sqlite3OpcodeName() function is implemented by code created
1504   ** by the mkopcodeh.awk and mkopcodec.awk scripts which extract the
1505   ** information from the vdbe.c source text */
1506   fprintf(pOut, zFormat1, pc,
1507       sqlite3OpcodeName(pOp->opcode), pOp->p1, pOp->p2, pOp->p3, zP4, pOp->p5,
1508       zCom
1509   );
1510   fflush(pOut);
1511 }
1512 #endif
1513 
1514 /*
1515 ** Initialize an array of N Mem element.
1516 */
1517 static void initMemArray(Mem *p, int N, sqlite3 *db, u16 flags){
1518   while( (N--)>0 ){
1519     p->db = db;
1520     p->flags = flags;
1521     p->szMalloc = 0;
1522 #ifdef SQLITE_DEBUG
1523     p->pScopyFrom = 0;
1524 #endif
1525     p++;
1526   }
1527 }
1528 
1529 /*
1530 ** Release an array of N Mem elements
1531 */
1532 static void releaseMemArray(Mem *p, int N){
1533   if( p && N ){
1534     Mem *pEnd = &p[N];
1535     sqlite3 *db = p->db;
1536     if( db->pnBytesFreed ){
1537       do{
1538         if( p->szMalloc ) sqlite3DbFree(db, p->zMalloc);
1539       }while( (++p)<pEnd );
1540       return;
1541     }
1542     do{
1543       assert( (&p[1])==pEnd || p[0].db==p[1].db );
1544       assert( sqlite3VdbeCheckMemInvariants(p) );
1545 
1546       /* This block is really an inlined version of sqlite3VdbeMemRelease()
1547       ** that takes advantage of the fact that the memory cell value is
1548       ** being set to NULL after releasing any dynamic resources.
1549       **
1550       ** The justification for duplicating code is that according to
1551       ** callgrind, this causes a certain test case to hit the CPU 4.7
1552       ** percent less (x86 linux, gcc version 4.1.2, -O6) than if
1553       ** sqlite3MemRelease() were called from here. With -O2, this jumps
1554       ** to 6.6 percent. The test case is inserting 1000 rows into a table
1555       ** with no indexes using a single prepared INSERT statement, bind()
1556       ** and reset(). Inserts are grouped into a transaction.
1557       */
1558       testcase( p->flags & MEM_Agg );
1559       testcase( p->flags & MEM_Dyn );
1560       testcase( p->flags & MEM_Frame );
1561       testcase( p->flags & MEM_RowSet );
1562       if( p->flags&(MEM_Agg|MEM_Dyn|MEM_Frame|MEM_RowSet) ){
1563         sqlite3VdbeMemRelease(p);
1564       }else if( p->szMalloc ){
1565         sqlite3DbFreeNN(db, p->zMalloc);
1566         p->szMalloc = 0;
1567       }
1568 
1569       p->flags = MEM_Undefined;
1570     }while( (++p)<pEnd );
1571   }
1572 }
1573 
1574 /*
1575 ** Delete a VdbeFrame object and its contents. VdbeFrame objects are
1576 ** allocated by the OP_Program opcode in sqlite3VdbeExec().
1577 */
1578 void sqlite3VdbeFrameDelete(VdbeFrame *p){
1579   int i;
1580   Mem *aMem = VdbeFrameMem(p);
1581   VdbeCursor **apCsr = (VdbeCursor **)&aMem[p->nChildMem];
1582   for(i=0; i<p->nChildCsr; i++){
1583     sqlite3VdbeFreeCursor(p->v, apCsr[i]);
1584   }
1585   releaseMemArray(aMem, p->nChildMem);
1586   sqlite3VdbeDeleteAuxData(p->v->db, &p->pAuxData, -1, 0);
1587   sqlite3DbFree(p->v->db, p);
1588 }
1589 
1590 #ifndef SQLITE_OMIT_EXPLAIN
1591 /*
1592 ** Give a listing of the program in the virtual machine.
1593 **
1594 ** The interface is the same as sqlite3VdbeExec().  But instead of
1595 ** running the code, it invokes the callback once for each instruction.
1596 ** This feature is used to implement "EXPLAIN".
1597 **
1598 ** When p->explain==1, each instruction is listed.  When
1599 ** p->explain==2, only OP_Explain instructions are listed and these
1600 ** are shown in a different format.  p->explain==2 is used to implement
1601 ** EXPLAIN QUERY PLAN.
1602 **
1603 ** When p->explain==1, first the main program is listed, then each of
1604 ** the trigger subprograms are listed one by one.
1605 */
1606 int sqlite3VdbeList(
1607   Vdbe *p                   /* The VDBE */
1608 ){
1609   int nRow;                            /* Stop when row count reaches this */
1610   int nSub = 0;                        /* Number of sub-vdbes seen so far */
1611   SubProgram **apSub = 0;              /* Array of sub-vdbes */
1612   Mem *pSub = 0;                       /* Memory cell hold array of subprogs */
1613   sqlite3 *db = p->db;                 /* The database connection */
1614   int i;                               /* Loop counter */
1615   int rc = SQLITE_OK;                  /* Return code */
1616   Mem *pMem = &p->aMem[1];             /* First Mem of result set */
1617 
1618   assert( p->explain );
1619   assert( p->magic==VDBE_MAGIC_RUN );
1620   assert( p->rc==SQLITE_OK || p->rc==SQLITE_BUSY || p->rc==SQLITE_NOMEM );
1621 
1622   /* Even though this opcode does not use dynamic strings for
1623   ** the result, result columns may become dynamic if the user calls
1624   ** sqlite3_column_text16(), causing a translation to UTF-16 encoding.
1625   */
1626   releaseMemArray(pMem, 8);
1627   p->pResultSet = 0;
1628 
1629   if( p->rc==SQLITE_NOMEM_BKPT ){
1630     /* This happens if a malloc() inside a call to sqlite3_column_text() or
1631     ** sqlite3_column_text16() failed.  */
1632     sqlite3OomFault(db);
1633     return SQLITE_ERROR;
1634   }
1635 
1636   /* When the number of output rows reaches nRow, that means the
1637   ** listing has finished and sqlite3_step() should return SQLITE_DONE.
1638   ** nRow is the sum of the number of rows in the main program, plus
1639   ** the sum of the number of rows in all trigger subprograms encountered
1640   ** so far.  The nRow value will increase as new trigger subprograms are
1641   ** encountered, but p->pc will eventually catch up to nRow.
1642   */
1643   nRow = p->nOp;
1644   if( p->explain==1 ){
1645     /* The first 8 memory cells are used for the result set.  So we will
1646     ** commandeer the 9th cell to use as storage for an array of pointers
1647     ** to trigger subprograms.  The VDBE is guaranteed to have at least 9
1648     ** cells.  */
1649     assert( p->nMem>9 );
1650     pSub = &p->aMem[9];
1651     if( pSub->flags&MEM_Blob ){
1652       /* On the first call to sqlite3_step(), pSub will hold a NULL.  It is
1653       ** initialized to a BLOB by the P4_SUBPROGRAM processing logic below */
1654       nSub = pSub->n/sizeof(Vdbe*);
1655       apSub = (SubProgram **)pSub->z;
1656     }
1657     for(i=0; i<nSub; i++){
1658       nRow += apSub[i]->nOp;
1659     }
1660   }
1661 
1662   do{
1663     i = p->pc++;
1664   }while( i<nRow && p->explain==2 && p->aOp[i].opcode!=OP_Explain );
1665   if( i>=nRow ){
1666     p->rc = SQLITE_OK;
1667     rc = SQLITE_DONE;
1668   }else if( db->u1.isInterrupted ){
1669     p->rc = SQLITE_INTERRUPT;
1670     rc = SQLITE_ERROR;
1671     sqlite3VdbeError(p, sqlite3ErrStr(p->rc));
1672   }else{
1673     char *zP4;
1674     Op *pOp;
1675     if( i<p->nOp ){
1676       /* The output line number is small enough that we are still in the
1677       ** main program. */
1678       pOp = &p->aOp[i];
1679     }else{
1680       /* We are currently listing subprograms.  Figure out which one and
1681       ** pick up the appropriate opcode. */
1682       int j;
1683       i -= p->nOp;
1684       for(j=0; i>=apSub[j]->nOp; j++){
1685         i -= apSub[j]->nOp;
1686       }
1687       pOp = &apSub[j]->aOp[i];
1688     }
1689     if( p->explain==1 ){
1690       pMem->flags = MEM_Int;
1691       pMem->u.i = i;                                /* Program counter */
1692       pMem++;
1693 
1694       pMem->flags = MEM_Static|MEM_Str|MEM_Term;
1695       pMem->z = (char*)sqlite3OpcodeName(pOp->opcode); /* Opcode */
1696       assert( pMem->z!=0 );
1697       pMem->n = sqlite3Strlen30(pMem->z);
1698       pMem->enc = SQLITE_UTF8;
1699       pMem++;
1700 
1701       /* When an OP_Program opcode is encounter (the only opcode that has
1702       ** a P4_SUBPROGRAM argument), expand the size of the array of subprograms
1703       ** kept in p->aMem[9].z to hold the new program - assuming this subprogram
1704       ** has not already been seen.
1705       */
1706       if( pOp->p4type==P4_SUBPROGRAM ){
1707         int nByte = (nSub+1)*sizeof(SubProgram*);
1708         int j;
1709         for(j=0; j<nSub; j++){
1710           if( apSub[j]==pOp->p4.pProgram ) break;
1711         }
1712         if( j==nSub && SQLITE_OK==sqlite3VdbeMemGrow(pSub, nByte, nSub!=0) ){
1713           apSub = (SubProgram **)pSub->z;
1714           apSub[nSub++] = pOp->p4.pProgram;
1715           pSub->flags |= MEM_Blob;
1716           pSub->n = nSub*sizeof(SubProgram*);
1717         }
1718       }
1719     }
1720 
1721     pMem->flags = MEM_Int;
1722     pMem->u.i = pOp->p1;                          /* P1 */
1723     pMem++;
1724 
1725     pMem->flags = MEM_Int;
1726     pMem->u.i = pOp->p2;                          /* P2 */
1727     pMem++;
1728 
1729     pMem->flags = MEM_Int;
1730     pMem->u.i = pOp->p3;                          /* P3 */
1731     pMem++;
1732 
1733     if( sqlite3VdbeMemClearAndResize(pMem, 100) ){ /* P4 */
1734       assert( p->db->mallocFailed );
1735       return SQLITE_ERROR;
1736     }
1737     pMem->flags = MEM_Str|MEM_Term;
1738     zP4 = displayP4(pOp, pMem->z, pMem->szMalloc);
1739     if( zP4!=pMem->z ){
1740       pMem->n = 0;
1741       sqlite3VdbeMemSetStr(pMem, zP4, -1, SQLITE_UTF8, 0);
1742     }else{
1743       assert( pMem->z!=0 );
1744       pMem->n = sqlite3Strlen30(pMem->z);
1745       pMem->enc = SQLITE_UTF8;
1746     }
1747     pMem++;
1748 
1749     if( p->explain==1 ){
1750       if( sqlite3VdbeMemClearAndResize(pMem, 4) ){
1751         assert( p->db->mallocFailed );
1752         return SQLITE_ERROR;
1753       }
1754       pMem->flags = MEM_Str|MEM_Term;
1755       pMem->n = 2;
1756       sqlite3_snprintf(3, pMem->z, "%.2x", pOp->p5);   /* P5 */
1757       pMem->enc = SQLITE_UTF8;
1758       pMem++;
1759 
1760 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1761       if( sqlite3VdbeMemClearAndResize(pMem, 500) ){
1762         assert( p->db->mallocFailed );
1763         return SQLITE_ERROR;
1764       }
1765       pMem->flags = MEM_Str|MEM_Term;
1766       pMem->n = displayComment(pOp, zP4, pMem->z, 500);
1767       pMem->enc = SQLITE_UTF8;
1768 #else
1769       pMem->flags = MEM_Null;                       /* Comment */
1770 #endif
1771     }
1772 
1773     p->nResColumn = 8 - 4*(p->explain-1);
1774     p->pResultSet = &p->aMem[1];
1775     p->rc = SQLITE_OK;
1776     rc = SQLITE_ROW;
1777   }
1778   return rc;
1779 }
1780 #endif /* SQLITE_OMIT_EXPLAIN */
1781 
1782 #ifdef SQLITE_DEBUG
1783 /*
1784 ** Print the SQL that was used to generate a VDBE program.
1785 */
1786 void sqlite3VdbePrintSql(Vdbe *p){
1787   const char *z = 0;
1788   if( p->zSql ){
1789     z = p->zSql;
1790   }else if( p->nOp>=1 ){
1791     const VdbeOp *pOp = &p->aOp[0];
1792     if( pOp->opcode==OP_Init && pOp->p4.z!=0 ){
1793       z = pOp->p4.z;
1794       while( sqlite3Isspace(*z) ) z++;
1795     }
1796   }
1797   if( z ) printf("SQL: [%s]\n", z);
1798 }
1799 #endif
1800 
1801 #if !defined(SQLITE_OMIT_TRACE) && defined(SQLITE_ENABLE_IOTRACE)
1802 /*
1803 ** Print an IOTRACE message showing SQL content.
1804 */
1805 void sqlite3VdbeIOTraceSql(Vdbe *p){
1806   int nOp = p->nOp;
1807   VdbeOp *pOp;
1808   if( sqlite3IoTrace==0 ) return;
1809   if( nOp<1 ) return;
1810   pOp = &p->aOp[0];
1811   if( pOp->opcode==OP_Init && pOp->p4.z!=0 ){
1812     int i, j;
1813     char z[1000];
1814     sqlite3_snprintf(sizeof(z), z, "%s", pOp->p4.z);
1815     for(i=0; sqlite3Isspace(z[i]); i++){}
1816     for(j=0; z[i]; i++){
1817       if( sqlite3Isspace(z[i]) ){
1818         if( z[i-1]!=' ' ){
1819           z[j++] = ' ';
1820         }
1821       }else{
1822         z[j++] = z[i];
1823       }
1824     }
1825     z[j] = 0;
1826     sqlite3IoTrace("SQL %s\n", z);
1827   }
1828 }
1829 #endif /* !SQLITE_OMIT_TRACE && SQLITE_ENABLE_IOTRACE */
1830 
1831 /* An instance of this object describes bulk memory available for use
1832 ** by subcomponents of a prepared statement.  Space is allocated out
1833 ** of a ReusableSpace object by the allocSpace() routine below.
1834 */
1835 struct ReusableSpace {
1836   u8 *pSpace;          /* Available memory */
1837   int nFree;           /* Bytes of available memory */
1838   int nNeeded;         /* Total bytes that could not be allocated */
1839 };
1840 
1841 /* Try to allocate nByte bytes of 8-byte aligned bulk memory for pBuf
1842 ** from the ReusableSpace object.  Return a pointer to the allocated
1843 ** memory on success.  If insufficient memory is available in the
1844 ** ReusableSpace object, increase the ReusableSpace.nNeeded
1845 ** value by the amount needed and return NULL.
1846 **
1847 ** If pBuf is not initially NULL, that means that the memory has already
1848 ** been allocated by a prior call to this routine, so just return a copy
1849 ** of pBuf and leave ReusableSpace unchanged.
1850 **
1851 ** This allocator is employed to repurpose unused slots at the end of the
1852 ** opcode array of prepared state for other memory needs of the prepared
1853 ** statement.
1854 */
1855 static void *allocSpace(
1856   struct ReusableSpace *p,  /* Bulk memory available for allocation */
1857   void *pBuf,               /* Pointer to a prior allocation */
1858   int nByte                 /* Bytes of memory needed */
1859 ){
1860   assert( EIGHT_BYTE_ALIGNMENT(p->pSpace) );
1861   if( pBuf==0 ){
1862     nByte = ROUND8(nByte);
1863     if( nByte <= p->nFree ){
1864       p->nFree -= nByte;
1865       pBuf = &p->pSpace[p->nFree];
1866     }else{
1867       p->nNeeded += nByte;
1868     }
1869   }
1870   assert( EIGHT_BYTE_ALIGNMENT(pBuf) );
1871   return pBuf;
1872 }
1873 
1874 /*
1875 ** Rewind the VDBE back to the beginning in preparation for
1876 ** running it.
1877 */
1878 void sqlite3VdbeRewind(Vdbe *p){
1879 #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
1880   int i;
1881 #endif
1882   assert( p!=0 );
1883   assert( p->magic==VDBE_MAGIC_INIT || p->magic==VDBE_MAGIC_RESET );
1884 
1885   /* There should be at least one opcode.
1886   */
1887   assert( p->nOp>0 );
1888 
1889   /* Set the magic to VDBE_MAGIC_RUN sooner rather than later. */
1890   p->magic = VDBE_MAGIC_RUN;
1891 
1892 #ifdef SQLITE_DEBUG
1893   for(i=0; i<p->nMem; i++){
1894     assert( p->aMem[i].db==p->db );
1895   }
1896 #endif
1897   p->pc = -1;
1898   p->rc = SQLITE_OK;
1899   p->errorAction = OE_Abort;
1900   p->nChange = 0;
1901   p->cacheCtr = 1;
1902   p->minWriteFileFormat = 255;
1903   p->iStatement = 0;
1904   p->nFkConstraint = 0;
1905 #ifdef VDBE_PROFILE
1906   for(i=0; i<p->nOp; i++){
1907     p->aOp[i].cnt = 0;
1908     p->aOp[i].cycles = 0;
1909   }
1910 #endif
1911 }
1912 
1913 /*
1914 ** Prepare a virtual machine for execution for the first time after
1915 ** creating the virtual machine.  This involves things such
1916 ** as allocating registers and initializing the program counter.
1917 ** After the VDBE has be prepped, it can be executed by one or more
1918 ** calls to sqlite3VdbeExec().
1919 **
1920 ** This function may be called exactly once on each virtual machine.
1921 ** After this routine is called the VM has been "packaged" and is ready
1922 ** to run.  After this routine is called, further calls to
1923 ** sqlite3VdbeAddOp() functions are prohibited.  This routine disconnects
1924 ** the Vdbe from the Parse object that helped generate it so that the
1925 ** the Vdbe becomes an independent entity and the Parse object can be
1926 ** destroyed.
1927 **
1928 ** Use the sqlite3VdbeRewind() procedure to restore a virtual machine back
1929 ** to its initial state after it has been run.
1930 */
1931 void sqlite3VdbeMakeReady(
1932   Vdbe *p,                       /* The VDBE */
1933   Parse *pParse                  /* Parsing context */
1934 ){
1935   sqlite3 *db;                   /* The database connection */
1936   int nVar;                      /* Number of parameters */
1937   int nMem;                      /* Number of VM memory registers */
1938   int nCursor;                   /* Number of cursors required */
1939   int nArg;                      /* Number of arguments in subprograms */
1940   int n;                         /* Loop counter */
1941   struct ReusableSpace x;        /* Reusable bulk memory */
1942 
1943   assert( p!=0 );
1944   assert( p->nOp>0 );
1945   assert( pParse!=0 );
1946   assert( p->magic==VDBE_MAGIC_INIT );
1947   assert( pParse==p->pParse );
1948   db = p->db;
1949   assert( db->mallocFailed==0 );
1950   nVar = pParse->nVar;
1951   nMem = pParse->nMem;
1952   nCursor = pParse->nTab;
1953   nArg = pParse->nMaxArg;
1954 
1955   /* Each cursor uses a memory cell.  The first cursor (cursor 0) can
1956   ** use aMem[0] which is not otherwise used by the VDBE program.  Allocate
1957   ** space at the end of aMem[] for cursors 1 and greater.
1958   ** See also: allocateCursor().
1959   */
1960   nMem += nCursor;
1961   if( nCursor==0 && nMem>0 ) nMem++;  /* Space for aMem[0] even if not used */
1962 
1963   /* Figure out how much reusable memory is available at the end of the
1964   ** opcode array.  This extra memory will be reallocated for other elements
1965   ** of the prepared statement.
1966   */
1967   n = ROUND8(sizeof(Op)*p->nOp);              /* Bytes of opcode memory used */
1968   x.pSpace = &((u8*)p->aOp)[n];               /* Unused opcode memory */
1969   assert( EIGHT_BYTE_ALIGNMENT(x.pSpace) );
1970   x.nFree = ROUNDDOWN8(pParse->szOpAlloc - n);  /* Bytes of unused memory */
1971   assert( x.nFree>=0 );
1972   assert( EIGHT_BYTE_ALIGNMENT(&x.pSpace[x.nFree]) );
1973 
1974   resolveP2Values(p, &nArg);
1975   p->usesStmtJournal = (u8)(pParse->isMultiWrite && pParse->mayAbort);
1976   if( pParse->explain && nMem<10 ){
1977     nMem = 10;
1978   }
1979   p->expired = 0;
1980 
1981   /* Memory for registers, parameters, cursor, etc, is allocated in one or two
1982   ** passes.  On the first pass, we try to reuse unused memory at the
1983   ** end of the opcode array.  If we are unable to satisfy all memory
1984   ** requirements by reusing the opcode array tail, then the second
1985   ** pass will fill in the remainder using a fresh memory allocation.
1986   **
1987   ** This two-pass approach that reuses as much memory as possible from
1988   ** the leftover memory at the end of the opcode array.  This can significantly
1989   ** reduce the amount of memory held by a prepared statement.
1990   */
1991   do {
1992     x.nNeeded = 0;
1993     p->aMem = allocSpace(&x, p->aMem, nMem*sizeof(Mem));
1994     p->aVar = allocSpace(&x, p->aVar, nVar*sizeof(Mem));
1995     p->apArg = allocSpace(&x, p->apArg, nArg*sizeof(Mem*));
1996     p->apCsr = allocSpace(&x, p->apCsr, nCursor*sizeof(VdbeCursor*));
1997 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
1998     p->anExec = allocSpace(&x, p->anExec, p->nOp*sizeof(i64));
1999 #endif
2000     if( x.nNeeded==0 ) break;
2001     x.pSpace = p->pFree = sqlite3DbMallocRawNN(db, x.nNeeded);
2002     x.nFree = x.nNeeded;
2003   }while( !db->mallocFailed );
2004 
2005   p->pVList = pParse->pVList;
2006   pParse->pVList =  0;
2007   p->explain = pParse->explain;
2008   if( db->mallocFailed ){
2009     p->nVar = 0;
2010     p->nCursor = 0;
2011     p->nMem = 0;
2012   }else{
2013     p->nCursor = nCursor;
2014     p->nVar = (ynVar)nVar;
2015     initMemArray(p->aVar, nVar, db, MEM_Null);
2016     p->nMem = nMem;
2017     initMemArray(p->aMem, nMem, db, MEM_Undefined);
2018     memset(p->apCsr, 0, nCursor*sizeof(VdbeCursor*));
2019 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2020     memset(p->anExec, 0, p->nOp*sizeof(i64));
2021 #endif
2022   }
2023   sqlite3VdbeRewind(p);
2024 }
2025 
2026 /*
2027 ** Close a VDBE cursor and release all the resources that cursor
2028 ** happens to hold.
2029 */
2030 void sqlite3VdbeFreeCursor(Vdbe *p, VdbeCursor *pCx){
2031   if( pCx==0 ){
2032     return;
2033   }
2034   assert( pCx->pBtx==0 || pCx->eCurType==CURTYPE_BTREE );
2035   switch( pCx->eCurType ){
2036     case CURTYPE_SORTER: {
2037       sqlite3VdbeSorterClose(p->db, pCx);
2038       break;
2039     }
2040     case CURTYPE_BTREE: {
2041       if( pCx->isEphemeral ){
2042         if( pCx->pBtx ) sqlite3BtreeClose(pCx->pBtx);
2043         /* The pCx->pCursor will be close automatically, if it exists, by
2044         ** the call above. */
2045       }else{
2046         assert( pCx->uc.pCursor!=0 );
2047         sqlite3BtreeCloseCursor(pCx->uc.pCursor);
2048       }
2049       break;
2050     }
2051 #ifndef SQLITE_OMIT_VIRTUALTABLE
2052     case CURTYPE_VTAB: {
2053       sqlite3_vtab_cursor *pVCur = pCx->uc.pVCur;
2054       const sqlite3_module *pModule = pVCur->pVtab->pModule;
2055       assert( pVCur->pVtab->nRef>0 );
2056       pVCur->pVtab->nRef--;
2057       pModule->xClose(pVCur);
2058       break;
2059     }
2060 #endif
2061   }
2062 }
2063 
2064 /*
2065 ** Close all cursors in the current frame.
2066 */
2067 static void closeCursorsInFrame(Vdbe *p){
2068   if( p->apCsr ){
2069     int i;
2070     for(i=0; i<p->nCursor; i++){
2071       VdbeCursor *pC = p->apCsr[i];
2072       if( pC ){
2073         sqlite3VdbeFreeCursor(p, pC);
2074         p->apCsr[i] = 0;
2075       }
2076     }
2077   }
2078 }
2079 
2080 /*
2081 ** Copy the values stored in the VdbeFrame structure to its Vdbe. This
2082 ** is used, for example, when a trigger sub-program is halted to restore
2083 ** control to the main program.
2084 */
2085 int sqlite3VdbeFrameRestore(VdbeFrame *pFrame){
2086   Vdbe *v = pFrame->v;
2087   closeCursorsInFrame(v);
2088 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2089   v->anExec = pFrame->anExec;
2090 #endif
2091   v->aOp = pFrame->aOp;
2092   v->nOp = pFrame->nOp;
2093   v->aMem = pFrame->aMem;
2094   v->nMem = pFrame->nMem;
2095   v->apCsr = pFrame->apCsr;
2096   v->nCursor = pFrame->nCursor;
2097   v->db->lastRowid = pFrame->lastRowid;
2098   v->nChange = pFrame->nChange;
2099   v->db->nChange = pFrame->nDbChange;
2100   sqlite3VdbeDeleteAuxData(v->db, &v->pAuxData, -1, 0);
2101   v->pAuxData = pFrame->pAuxData;
2102   pFrame->pAuxData = 0;
2103   return pFrame->pc;
2104 }
2105 
2106 /*
2107 ** Close all cursors.
2108 **
2109 ** Also release any dynamic memory held by the VM in the Vdbe.aMem memory
2110 ** cell array. This is necessary as the memory cell array may contain
2111 ** pointers to VdbeFrame objects, which may in turn contain pointers to
2112 ** open cursors.
2113 */
2114 static void closeAllCursors(Vdbe *p){
2115   if( p->pFrame ){
2116     VdbeFrame *pFrame;
2117     for(pFrame=p->pFrame; pFrame->pParent; pFrame=pFrame->pParent);
2118     sqlite3VdbeFrameRestore(pFrame);
2119     p->pFrame = 0;
2120     p->nFrame = 0;
2121   }
2122   assert( p->nFrame==0 );
2123   closeCursorsInFrame(p);
2124   if( p->aMem ){
2125     releaseMemArray(p->aMem, p->nMem);
2126   }
2127   while( p->pDelFrame ){
2128     VdbeFrame *pDel = p->pDelFrame;
2129     p->pDelFrame = pDel->pParent;
2130     sqlite3VdbeFrameDelete(pDel);
2131   }
2132 
2133   /* Delete any auxdata allocations made by the VM */
2134   if( p->pAuxData ) sqlite3VdbeDeleteAuxData(p->db, &p->pAuxData, -1, 0);
2135   assert( p->pAuxData==0 );
2136 }
2137 
2138 /*
2139 ** Clean up the VM after a single run.
2140 */
2141 static void Cleanup(Vdbe *p){
2142   sqlite3 *db = p->db;
2143 
2144 #ifdef SQLITE_DEBUG
2145   /* Execute assert() statements to ensure that the Vdbe.apCsr[] and
2146   ** Vdbe.aMem[] arrays have already been cleaned up.  */
2147   int i;
2148   if( p->apCsr ) for(i=0; i<p->nCursor; i++) assert( p->apCsr[i]==0 );
2149   if( p->aMem ){
2150     for(i=0; i<p->nMem; i++) assert( p->aMem[i].flags==MEM_Undefined );
2151   }
2152 #endif
2153 
2154   sqlite3DbFree(db, p->zErrMsg);
2155   p->zErrMsg = 0;
2156   p->pResultSet = 0;
2157 }
2158 
2159 /*
2160 ** Set the number of result columns that will be returned by this SQL
2161 ** statement. This is now set at compile time, rather than during
2162 ** execution of the vdbe program so that sqlite3_column_count() can
2163 ** be called on an SQL statement before sqlite3_step().
2164 */
2165 void sqlite3VdbeSetNumCols(Vdbe *p, int nResColumn){
2166   int n;
2167   sqlite3 *db = p->db;
2168 
2169   if( p->nResColumn ){
2170     releaseMemArray(p->aColName, p->nResColumn*COLNAME_N);
2171     sqlite3DbFree(db, p->aColName);
2172   }
2173   n = nResColumn*COLNAME_N;
2174   p->nResColumn = (u16)nResColumn;
2175   p->aColName = (Mem*)sqlite3DbMallocRawNN(db, sizeof(Mem)*n );
2176   if( p->aColName==0 ) return;
2177   initMemArray(p->aColName, n, db, MEM_Null);
2178 }
2179 
2180 /*
2181 ** Set the name of the idx'th column to be returned by the SQL statement.
2182 ** zName must be a pointer to a nul terminated string.
2183 **
2184 ** This call must be made after a call to sqlite3VdbeSetNumCols().
2185 **
2186 ** The final parameter, xDel, must be one of SQLITE_DYNAMIC, SQLITE_STATIC
2187 ** or SQLITE_TRANSIENT. If it is SQLITE_DYNAMIC, then the buffer pointed
2188 ** to by zName will be freed by sqlite3DbFree() when the vdbe is destroyed.
2189 */
2190 int sqlite3VdbeSetColName(
2191   Vdbe *p,                         /* Vdbe being configured */
2192   int idx,                         /* Index of column zName applies to */
2193   int var,                         /* One of the COLNAME_* constants */
2194   const char *zName,               /* Pointer to buffer containing name */
2195   void (*xDel)(void*)              /* Memory management strategy for zName */
2196 ){
2197   int rc;
2198   Mem *pColName;
2199   assert( idx<p->nResColumn );
2200   assert( var<COLNAME_N );
2201   if( p->db->mallocFailed ){
2202     assert( !zName || xDel!=SQLITE_DYNAMIC );
2203     return SQLITE_NOMEM_BKPT;
2204   }
2205   assert( p->aColName!=0 );
2206   pColName = &(p->aColName[idx+var*p->nResColumn]);
2207   rc = sqlite3VdbeMemSetStr(pColName, zName, -1, SQLITE_UTF8, xDel);
2208   assert( rc!=0 || !zName || (pColName->flags&MEM_Term)!=0 );
2209   return rc;
2210 }
2211 
2212 /*
2213 ** A read or write transaction may or may not be active on database handle
2214 ** db. If a transaction is active, commit it. If there is a
2215 ** write-transaction spanning more than one database file, this routine
2216 ** takes care of the master journal trickery.
2217 */
2218 static int vdbeCommit(sqlite3 *db, Vdbe *p){
2219   int i;
2220   int nTrans = 0;  /* Number of databases with an active write-transaction
2221                    ** that are candidates for a two-phase commit using a
2222                    ** master-journal */
2223   int rc = SQLITE_OK;
2224   int needXcommit = 0;
2225 
2226 #ifdef SQLITE_OMIT_VIRTUALTABLE
2227   /* With this option, sqlite3VtabSync() is defined to be simply
2228   ** SQLITE_OK so p is not used.
2229   */
2230   UNUSED_PARAMETER(p);
2231 #endif
2232 
2233   /* Before doing anything else, call the xSync() callback for any
2234   ** virtual module tables written in this transaction. This has to
2235   ** be done before determining whether a master journal file is
2236   ** required, as an xSync() callback may add an attached database
2237   ** to the transaction.
2238   */
2239   rc = sqlite3VtabSync(db, p);
2240 
2241   /* This loop determines (a) if the commit hook should be invoked and
2242   ** (b) how many database files have open write transactions, not
2243   ** including the temp database. (b) is important because if more than
2244   ** one database file has an open write transaction, a master journal
2245   ** file is required for an atomic commit.
2246   */
2247   for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2248     Btree *pBt = db->aDb[i].pBt;
2249     if( sqlite3BtreeIsInTrans(pBt) ){
2250       /* Whether or not a database might need a master journal depends upon
2251       ** its journal mode (among other things).  This matrix determines which
2252       ** journal modes use a master journal and which do not */
2253       static const u8 aMJNeeded[] = {
2254         /* DELETE   */  1,
2255         /* PERSIST   */ 1,
2256         /* OFF       */ 0,
2257         /* TRUNCATE  */ 1,
2258         /* MEMORY    */ 0,
2259         /* WAL       */ 0
2260       };
2261       Pager *pPager;   /* Pager associated with pBt */
2262       needXcommit = 1;
2263       sqlite3BtreeEnter(pBt);
2264       pPager = sqlite3BtreePager(pBt);
2265       if( db->aDb[i].safety_level!=PAGER_SYNCHRONOUS_OFF
2266        && aMJNeeded[sqlite3PagerGetJournalMode(pPager)]
2267       ){
2268         assert( i!=1 );
2269         nTrans++;
2270       }
2271       rc = sqlite3PagerExclusiveLock(pPager);
2272       sqlite3BtreeLeave(pBt);
2273     }
2274   }
2275   if( rc!=SQLITE_OK ){
2276     return rc;
2277   }
2278 
2279   /* If there are any write-transactions at all, invoke the commit hook */
2280   if( needXcommit && db->xCommitCallback ){
2281     rc = db->xCommitCallback(db->pCommitArg);
2282     if( rc ){
2283       return SQLITE_CONSTRAINT_COMMITHOOK;
2284     }
2285   }
2286 
2287   /* The simple case - no more than one database file (not counting the
2288   ** TEMP database) has a transaction active.   There is no need for the
2289   ** master-journal.
2290   **
2291   ** If the return value of sqlite3BtreeGetFilename() is a zero length
2292   ** string, it means the main database is :memory: or a temp file.  In
2293   ** that case we do not support atomic multi-file commits, so use the
2294   ** simple case then too.
2295   */
2296   if( 0==sqlite3Strlen30(sqlite3BtreeGetFilename(db->aDb[0].pBt))
2297    || nTrans<=1
2298   ){
2299     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2300       Btree *pBt = db->aDb[i].pBt;
2301       if( pBt ){
2302         rc = sqlite3BtreeCommitPhaseOne(pBt, 0);
2303       }
2304     }
2305 
2306     /* Do the commit only if all databases successfully complete phase 1.
2307     ** If one of the BtreeCommitPhaseOne() calls fails, this indicates an
2308     ** IO error while deleting or truncating a journal file. It is unlikely,
2309     ** but could happen. In this case abandon processing and return the error.
2310     */
2311     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2312       Btree *pBt = db->aDb[i].pBt;
2313       if( pBt ){
2314         rc = sqlite3BtreeCommitPhaseTwo(pBt, 0);
2315       }
2316     }
2317     if( rc==SQLITE_OK ){
2318       sqlite3VtabCommit(db);
2319     }
2320   }
2321 
2322   /* The complex case - There is a multi-file write-transaction active.
2323   ** This requires a master journal file to ensure the transaction is
2324   ** committed atomically.
2325   */
2326 #ifndef SQLITE_OMIT_DISKIO
2327   else{
2328     sqlite3_vfs *pVfs = db->pVfs;
2329     char *zMaster = 0;   /* File-name for the master journal */
2330     char const *zMainFile = sqlite3BtreeGetFilename(db->aDb[0].pBt);
2331     sqlite3_file *pMaster = 0;
2332     i64 offset = 0;
2333     int res;
2334     int retryCount = 0;
2335     int nMainFile;
2336 
2337     /* Select a master journal file name */
2338     nMainFile = sqlite3Strlen30(zMainFile);
2339     zMaster = sqlite3MPrintf(db, "%s-mjXXXXXX9XXz", zMainFile);
2340     if( zMaster==0 ) return SQLITE_NOMEM_BKPT;
2341     do {
2342       u32 iRandom;
2343       if( retryCount ){
2344         if( retryCount>100 ){
2345           sqlite3_log(SQLITE_FULL, "MJ delete: %s", zMaster);
2346           sqlite3OsDelete(pVfs, zMaster, 0);
2347           break;
2348         }else if( retryCount==1 ){
2349           sqlite3_log(SQLITE_FULL, "MJ collide: %s", zMaster);
2350         }
2351       }
2352       retryCount++;
2353       sqlite3_randomness(sizeof(iRandom), &iRandom);
2354       sqlite3_snprintf(13, &zMaster[nMainFile], "-mj%06X9%02X",
2355                                (iRandom>>8)&0xffffff, iRandom&0xff);
2356       /* The antipenultimate character of the master journal name must
2357       ** be "9" to avoid name collisions when using 8+3 filenames. */
2358       assert( zMaster[sqlite3Strlen30(zMaster)-3]=='9' );
2359       sqlite3FileSuffix3(zMainFile, zMaster);
2360       rc = sqlite3OsAccess(pVfs, zMaster, SQLITE_ACCESS_EXISTS, &res);
2361     }while( rc==SQLITE_OK && res );
2362     if( rc==SQLITE_OK ){
2363       /* Open the master journal. */
2364       rc = sqlite3OsOpenMalloc(pVfs, zMaster, &pMaster,
2365           SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE|
2366           SQLITE_OPEN_EXCLUSIVE|SQLITE_OPEN_MASTER_JOURNAL, 0
2367       );
2368     }
2369     if( rc!=SQLITE_OK ){
2370       sqlite3DbFree(db, zMaster);
2371       return rc;
2372     }
2373 
2374     /* Write the name of each database file in the transaction into the new
2375     ** master journal file. If an error occurs at this point close
2376     ** and delete the master journal file. All the individual journal files
2377     ** still have 'null' as the master journal pointer, so they will roll
2378     ** back independently if a failure occurs.
2379     */
2380     for(i=0; i<db->nDb; i++){
2381       Btree *pBt = db->aDb[i].pBt;
2382       if( sqlite3BtreeIsInTrans(pBt) ){
2383         char const *zFile = sqlite3BtreeGetJournalname(pBt);
2384         if( zFile==0 ){
2385           continue;  /* Ignore TEMP and :memory: databases */
2386         }
2387         assert( zFile[0]!=0 );
2388         rc = sqlite3OsWrite(pMaster, zFile, sqlite3Strlen30(zFile)+1, offset);
2389         offset += sqlite3Strlen30(zFile)+1;
2390         if( rc!=SQLITE_OK ){
2391           sqlite3OsCloseFree(pMaster);
2392           sqlite3OsDelete(pVfs, zMaster, 0);
2393           sqlite3DbFree(db, zMaster);
2394           return rc;
2395         }
2396       }
2397     }
2398 
2399     /* Sync the master journal file. If the IOCAP_SEQUENTIAL device
2400     ** flag is set this is not required.
2401     */
2402     if( 0==(sqlite3OsDeviceCharacteristics(pMaster)&SQLITE_IOCAP_SEQUENTIAL)
2403      && SQLITE_OK!=(rc = sqlite3OsSync(pMaster, SQLITE_SYNC_NORMAL))
2404     ){
2405       sqlite3OsCloseFree(pMaster);
2406       sqlite3OsDelete(pVfs, zMaster, 0);
2407       sqlite3DbFree(db, zMaster);
2408       return rc;
2409     }
2410 
2411     /* Sync all the db files involved in the transaction. The same call
2412     ** sets the master journal pointer in each individual journal. If
2413     ** an error occurs here, do not delete the master journal file.
2414     **
2415     ** If the error occurs during the first call to
2416     ** sqlite3BtreeCommitPhaseOne(), then there is a chance that the
2417     ** master journal file will be orphaned. But we cannot delete it,
2418     ** in case the master journal file name was written into the journal
2419     ** file before the failure occurred.
2420     */
2421     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2422       Btree *pBt = db->aDb[i].pBt;
2423       if( pBt ){
2424         rc = sqlite3BtreeCommitPhaseOne(pBt, zMaster);
2425       }
2426     }
2427     sqlite3OsCloseFree(pMaster);
2428     assert( rc!=SQLITE_BUSY );
2429     if( rc!=SQLITE_OK ){
2430       sqlite3DbFree(db, zMaster);
2431       return rc;
2432     }
2433 
2434     /* Delete the master journal file. This commits the transaction. After
2435     ** doing this the directory is synced again before any individual
2436     ** transaction files are deleted.
2437     */
2438     rc = sqlite3OsDelete(pVfs, zMaster, 1);
2439     sqlite3DbFree(db, zMaster);
2440     zMaster = 0;
2441     if( rc ){
2442       return rc;
2443     }
2444 
2445     /* All files and directories have already been synced, so the following
2446     ** calls to sqlite3BtreeCommitPhaseTwo() are only closing files and
2447     ** deleting or truncating journals. If something goes wrong while
2448     ** this is happening we don't really care. The integrity of the
2449     ** transaction is already guaranteed, but some stray 'cold' journals
2450     ** may be lying around. Returning an error code won't help matters.
2451     */
2452     disable_simulated_io_errors();
2453     sqlite3BeginBenignMalloc();
2454     for(i=0; i<db->nDb; i++){
2455       Btree *pBt = db->aDb[i].pBt;
2456       if( pBt ){
2457         sqlite3BtreeCommitPhaseTwo(pBt, 1);
2458       }
2459     }
2460     sqlite3EndBenignMalloc();
2461     enable_simulated_io_errors();
2462 
2463     sqlite3VtabCommit(db);
2464   }
2465 #endif
2466 
2467   return rc;
2468 }
2469 
2470 /*
2471 ** This routine checks that the sqlite3.nVdbeActive count variable
2472 ** matches the number of vdbe's in the list sqlite3.pVdbe that are
2473 ** currently active. An assertion fails if the two counts do not match.
2474 ** This is an internal self-check only - it is not an essential processing
2475 ** step.
2476 **
2477 ** This is a no-op if NDEBUG is defined.
2478 */
2479 #ifndef NDEBUG
2480 static void checkActiveVdbeCnt(sqlite3 *db){
2481   Vdbe *p;
2482   int cnt = 0;
2483   int nWrite = 0;
2484   int nRead = 0;
2485   p = db->pVdbe;
2486   while( p ){
2487     if( sqlite3_stmt_busy((sqlite3_stmt*)p) ){
2488       cnt++;
2489       if( p->readOnly==0 ) nWrite++;
2490       if( p->bIsReader ) nRead++;
2491     }
2492     p = p->pNext;
2493   }
2494   assert( cnt==db->nVdbeActive );
2495   assert( nWrite==db->nVdbeWrite );
2496   assert( nRead==db->nVdbeRead );
2497 }
2498 #else
2499 #define checkActiveVdbeCnt(x)
2500 #endif
2501 
2502 /*
2503 ** If the Vdbe passed as the first argument opened a statement-transaction,
2504 ** close it now. Argument eOp must be either SAVEPOINT_ROLLBACK or
2505 ** SAVEPOINT_RELEASE. If it is SAVEPOINT_ROLLBACK, then the statement
2506 ** transaction is rolled back. If eOp is SAVEPOINT_RELEASE, then the
2507 ** statement transaction is committed.
2508 **
2509 ** If an IO error occurs, an SQLITE_IOERR_XXX error code is returned.
2510 ** Otherwise SQLITE_OK.
2511 */
2512 static SQLITE_NOINLINE int vdbeCloseStatement(Vdbe *p, int eOp){
2513   sqlite3 *const db = p->db;
2514   int rc = SQLITE_OK;
2515   int i;
2516   const int iSavepoint = p->iStatement-1;
2517 
2518   assert( eOp==SAVEPOINT_ROLLBACK || eOp==SAVEPOINT_RELEASE);
2519   assert( db->nStatement>0 );
2520   assert( p->iStatement==(db->nStatement+db->nSavepoint) );
2521 
2522   for(i=0; i<db->nDb; i++){
2523     int rc2 = SQLITE_OK;
2524     Btree *pBt = db->aDb[i].pBt;
2525     if( pBt ){
2526       if( eOp==SAVEPOINT_ROLLBACK ){
2527         rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_ROLLBACK, iSavepoint);
2528       }
2529       if( rc2==SQLITE_OK ){
2530         rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_RELEASE, iSavepoint);
2531       }
2532       if( rc==SQLITE_OK ){
2533         rc = rc2;
2534       }
2535     }
2536   }
2537   db->nStatement--;
2538   p->iStatement = 0;
2539 
2540   if( rc==SQLITE_OK ){
2541     if( eOp==SAVEPOINT_ROLLBACK ){
2542       rc = sqlite3VtabSavepoint(db, SAVEPOINT_ROLLBACK, iSavepoint);
2543     }
2544     if( rc==SQLITE_OK ){
2545       rc = sqlite3VtabSavepoint(db, SAVEPOINT_RELEASE, iSavepoint);
2546     }
2547   }
2548 
2549   /* If the statement transaction is being rolled back, also restore the
2550   ** database handles deferred constraint counter to the value it had when
2551   ** the statement transaction was opened.  */
2552   if( eOp==SAVEPOINT_ROLLBACK ){
2553     db->nDeferredCons = p->nStmtDefCons;
2554     db->nDeferredImmCons = p->nStmtDefImmCons;
2555   }
2556   return rc;
2557 }
2558 int sqlite3VdbeCloseStatement(Vdbe *p, int eOp){
2559   if( p->db->nStatement && p->iStatement ){
2560     return vdbeCloseStatement(p, eOp);
2561   }
2562   return SQLITE_OK;
2563 }
2564 
2565 
2566 /*
2567 ** This function is called when a transaction opened by the database
2568 ** handle associated with the VM passed as an argument is about to be
2569 ** committed. If there are outstanding deferred foreign key constraint
2570 ** violations, return SQLITE_ERROR. Otherwise, SQLITE_OK.
2571 **
2572 ** If there are outstanding FK violations and this function returns
2573 ** SQLITE_ERROR, set the result of the VM to SQLITE_CONSTRAINT_FOREIGNKEY
2574 ** and write an error message to it. Then return SQLITE_ERROR.
2575 */
2576 #ifndef SQLITE_OMIT_FOREIGN_KEY
2577 int sqlite3VdbeCheckFk(Vdbe *p, int deferred){
2578   sqlite3 *db = p->db;
2579   if( (deferred && (db->nDeferredCons+db->nDeferredImmCons)>0)
2580    || (!deferred && p->nFkConstraint>0)
2581   ){
2582     p->rc = SQLITE_CONSTRAINT_FOREIGNKEY;
2583     p->errorAction = OE_Abort;
2584     sqlite3VdbeError(p, "FOREIGN KEY constraint failed");
2585     return SQLITE_ERROR;
2586   }
2587   return SQLITE_OK;
2588 }
2589 #endif
2590 
2591 /*
2592 ** This routine is called the when a VDBE tries to halt.  If the VDBE
2593 ** has made changes and is in autocommit mode, then commit those
2594 ** changes.  If a rollback is needed, then do the rollback.
2595 **
2596 ** This routine is the only way to move the state of a VM from
2597 ** SQLITE_MAGIC_RUN to SQLITE_MAGIC_HALT.  It is harmless to
2598 ** call this on a VM that is in the SQLITE_MAGIC_HALT state.
2599 **
2600 ** Return an error code.  If the commit could not complete because of
2601 ** lock contention, return SQLITE_BUSY.  If SQLITE_BUSY is returned, it
2602 ** means the close did not happen and needs to be repeated.
2603 */
2604 int sqlite3VdbeHalt(Vdbe *p){
2605   int rc;                         /* Used to store transient return codes */
2606   sqlite3 *db = p->db;
2607 
2608   /* This function contains the logic that determines if a statement or
2609   ** transaction will be committed or rolled back as a result of the
2610   ** execution of this virtual machine.
2611   **
2612   ** If any of the following errors occur:
2613   **
2614   **     SQLITE_NOMEM
2615   **     SQLITE_IOERR
2616   **     SQLITE_FULL
2617   **     SQLITE_INTERRUPT
2618   **
2619   ** Then the internal cache might have been left in an inconsistent
2620   ** state.  We need to rollback the statement transaction, if there is
2621   ** one, or the complete transaction if there is no statement transaction.
2622   */
2623 
2624   if( p->magic!=VDBE_MAGIC_RUN ){
2625     return SQLITE_OK;
2626   }
2627   if( db->mallocFailed ){
2628     p->rc = SQLITE_NOMEM_BKPT;
2629   }
2630   closeAllCursors(p);
2631   checkActiveVdbeCnt(db);
2632 
2633   /* No commit or rollback needed if the program never started or if the
2634   ** SQL statement does not read or write a database file.  */
2635   if( p->pc>=0 && p->bIsReader ){
2636     int mrc;   /* Primary error code from p->rc */
2637     int eStatementOp = 0;
2638     int isSpecialError;            /* Set to true if a 'special' error */
2639 
2640     /* Lock all btrees used by the statement */
2641     sqlite3VdbeEnter(p);
2642 
2643     /* Check for one of the special errors */
2644     mrc = p->rc & 0xff;
2645     isSpecialError = mrc==SQLITE_NOMEM || mrc==SQLITE_IOERR
2646                      || mrc==SQLITE_INTERRUPT || mrc==SQLITE_FULL;
2647     if( isSpecialError ){
2648       /* If the query was read-only and the error code is SQLITE_INTERRUPT,
2649       ** no rollback is necessary. Otherwise, at least a savepoint
2650       ** transaction must be rolled back to restore the database to a
2651       ** consistent state.
2652       **
2653       ** Even if the statement is read-only, it is important to perform
2654       ** a statement or transaction rollback operation. If the error
2655       ** occurred while writing to the journal, sub-journal or database
2656       ** file as part of an effort to free up cache space (see function
2657       ** pagerStress() in pager.c), the rollback is required to restore
2658       ** the pager to a consistent state.
2659       */
2660       if( !p->readOnly || mrc!=SQLITE_INTERRUPT ){
2661         if( (mrc==SQLITE_NOMEM || mrc==SQLITE_FULL) && p->usesStmtJournal ){
2662           eStatementOp = SAVEPOINT_ROLLBACK;
2663         }else{
2664           /* We are forced to roll back the active transaction. Before doing
2665           ** so, abort any other statements this handle currently has active.
2666           */
2667           sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
2668           sqlite3CloseSavepoints(db);
2669           db->autoCommit = 1;
2670           p->nChange = 0;
2671         }
2672       }
2673     }
2674 
2675     /* Check for immediate foreign key violations. */
2676     if( p->rc==SQLITE_OK ){
2677       sqlite3VdbeCheckFk(p, 0);
2678     }
2679 
2680     /* If the auto-commit flag is set and this is the only active writer
2681     ** VM, then we do either a commit or rollback of the current transaction.
2682     **
2683     ** Note: This block also runs if one of the special errors handled
2684     ** above has occurred.
2685     */
2686     if( !sqlite3VtabInSync(db)
2687      && db->autoCommit
2688      && db->nVdbeWrite==(p->readOnly==0)
2689     ){
2690       if( p->rc==SQLITE_OK || (p->errorAction==OE_Fail && !isSpecialError) ){
2691         rc = sqlite3VdbeCheckFk(p, 1);
2692         if( rc!=SQLITE_OK ){
2693           if( NEVER(p->readOnly) ){
2694             sqlite3VdbeLeave(p);
2695             return SQLITE_ERROR;
2696           }
2697           rc = SQLITE_CONSTRAINT_FOREIGNKEY;
2698         }else{
2699           /* The auto-commit flag is true, the vdbe program was successful
2700           ** or hit an 'OR FAIL' constraint and there are no deferred foreign
2701           ** key constraints to hold up the transaction. This means a commit
2702           ** is required. */
2703           rc = vdbeCommit(db, p);
2704         }
2705         if( rc==SQLITE_BUSY && p->readOnly ){
2706           sqlite3VdbeLeave(p);
2707           return SQLITE_BUSY;
2708         }else if( rc!=SQLITE_OK ){
2709           p->rc = rc;
2710           sqlite3RollbackAll(db, SQLITE_OK);
2711           p->nChange = 0;
2712         }else{
2713           db->nDeferredCons = 0;
2714           db->nDeferredImmCons = 0;
2715           db->flags &= ~SQLITE_DeferFKs;
2716           sqlite3CommitInternalChanges(db);
2717         }
2718       }else{
2719         sqlite3RollbackAll(db, SQLITE_OK);
2720         p->nChange = 0;
2721       }
2722       db->nStatement = 0;
2723     }else if( eStatementOp==0 ){
2724       if( p->rc==SQLITE_OK || p->errorAction==OE_Fail ){
2725         eStatementOp = SAVEPOINT_RELEASE;
2726       }else if( p->errorAction==OE_Abort ){
2727         eStatementOp = SAVEPOINT_ROLLBACK;
2728       }else{
2729         sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
2730         sqlite3CloseSavepoints(db);
2731         db->autoCommit = 1;
2732         p->nChange = 0;
2733       }
2734     }
2735 
2736     /* If eStatementOp is non-zero, then a statement transaction needs to
2737     ** be committed or rolled back. Call sqlite3VdbeCloseStatement() to
2738     ** do so. If this operation returns an error, and the current statement
2739     ** error code is SQLITE_OK or SQLITE_CONSTRAINT, then promote the
2740     ** current statement error code.
2741     */
2742     if( eStatementOp ){
2743       rc = sqlite3VdbeCloseStatement(p, eStatementOp);
2744       if( rc ){
2745         if( p->rc==SQLITE_OK || (p->rc&0xff)==SQLITE_CONSTRAINT ){
2746           p->rc = rc;
2747           sqlite3DbFree(db, p->zErrMsg);
2748           p->zErrMsg = 0;
2749         }
2750         sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
2751         sqlite3CloseSavepoints(db);
2752         db->autoCommit = 1;
2753         p->nChange = 0;
2754       }
2755     }
2756 
2757     /* If this was an INSERT, UPDATE or DELETE and no statement transaction
2758     ** has been rolled back, update the database connection change-counter.
2759     */
2760     if( p->changeCntOn ){
2761       if( eStatementOp!=SAVEPOINT_ROLLBACK ){
2762         sqlite3VdbeSetChanges(db, p->nChange);
2763       }else{
2764         sqlite3VdbeSetChanges(db, 0);
2765       }
2766       p->nChange = 0;
2767     }
2768 
2769     /* Release the locks */
2770     sqlite3VdbeLeave(p);
2771   }
2772 
2773   /* We have successfully halted and closed the VM.  Record this fact. */
2774   if( p->pc>=0 ){
2775     db->nVdbeActive--;
2776     if( !p->readOnly ) db->nVdbeWrite--;
2777     if( p->bIsReader ) db->nVdbeRead--;
2778     assert( db->nVdbeActive>=db->nVdbeRead );
2779     assert( db->nVdbeRead>=db->nVdbeWrite );
2780     assert( db->nVdbeWrite>=0 );
2781   }
2782   p->magic = VDBE_MAGIC_HALT;
2783   checkActiveVdbeCnt(db);
2784   if( db->mallocFailed ){
2785     p->rc = SQLITE_NOMEM_BKPT;
2786   }
2787 
2788   /* If the auto-commit flag is set to true, then any locks that were held
2789   ** by connection db have now been released. Call sqlite3ConnectionUnlocked()
2790   ** to invoke any required unlock-notify callbacks.
2791   */
2792   if( db->autoCommit ){
2793     sqlite3ConnectionUnlocked(db);
2794   }
2795 
2796   assert( db->nVdbeActive>0 || db->autoCommit==0 || db->nStatement==0 );
2797   return (p->rc==SQLITE_BUSY ? SQLITE_BUSY : SQLITE_OK);
2798 }
2799 
2800 
2801 /*
2802 ** Each VDBE holds the result of the most recent sqlite3_step() call
2803 ** in p->rc.  This routine sets that result back to SQLITE_OK.
2804 */
2805 void sqlite3VdbeResetStepResult(Vdbe *p){
2806   p->rc = SQLITE_OK;
2807 }
2808 
2809 /*
2810 ** Copy the error code and error message belonging to the VDBE passed
2811 ** as the first argument to its database handle (so that they will be
2812 ** returned by calls to sqlite3_errcode() and sqlite3_errmsg()).
2813 **
2814 ** This function does not clear the VDBE error code or message, just
2815 ** copies them to the database handle.
2816 */
2817 int sqlite3VdbeTransferError(Vdbe *p){
2818   sqlite3 *db = p->db;
2819   int rc = p->rc;
2820   if( p->zErrMsg ){
2821     db->bBenignMalloc++;
2822     sqlite3BeginBenignMalloc();
2823     if( db->pErr==0 ) db->pErr = sqlite3ValueNew(db);
2824     sqlite3ValueSetStr(db->pErr, -1, p->zErrMsg, SQLITE_UTF8, SQLITE_TRANSIENT);
2825     sqlite3EndBenignMalloc();
2826     db->bBenignMalloc--;
2827   }else if( db->pErr ){
2828     sqlite3ValueSetNull(db->pErr);
2829   }
2830   db->errCode = rc;
2831   return rc;
2832 }
2833 
2834 #ifdef SQLITE_ENABLE_SQLLOG
2835 /*
2836 ** If an SQLITE_CONFIG_SQLLOG hook is registered and the VM has been run,
2837 ** invoke it.
2838 */
2839 static void vdbeInvokeSqllog(Vdbe *v){
2840   if( sqlite3GlobalConfig.xSqllog && v->rc==SQLITE_OK && v->zSql && v->pc>=0 ){
2841     char *zExpanded = sqlite3VdbeExpandSql(v, v->zSql);
2842     assert( v->db->init.busy==0 );
2843     if( zExpanded ){
2844       sqlite3GlobalConfig.xSqllog(
2845           sqlite3GlobalConfig.pSqllogArg, v->db, zExpanded, 1
2846       );
2847       sqlite3DbFree(v->db, zExpanded);
2848     }
2849   }
2850 }
2851 #else
2852 # define vdbeInvokeSqllog(x)
2853 #endif
2854 
2855 /*
2856 ** Clean up a VDBE after execution but do not delete the VDBE just yet.
2857 ** Write any error messages into *pzErrMsg.  Return the result code.
2858 **
2859 ** After this routine is run, the VDBE should be ready to be executed
2860 ** again.
2861 **
2862 ** To look at it another way, this routine resets the state of the
2863 ** virtual machine from VDBE_MAGIC_RUN or VDBE_MAGIC_HALT back to
2864 ** VDBE_MAGIC_INIT.
2865 */
2866 int sqlite3VdbeReset(Vdbe *p){
2867   sqlite3 *db;
2868   db = p->db;
2869 
2870   /* If the VM did not run to completion or if it encountered an
2871   ** error, then it might not have been halted properly.  So halt
2872   ** it now.
2873   */
2874   sqlite3VdbeHalt(p);
2875 
2876   /* If the VDBE has be run even partially, then transfer the error code
2877   ** and error message from the VDBE into the main database structure.  But
2878   ** if the VDBE has just been set to run but has not actually executed any
2879   ** instructions yet, leave the main database error information unchanged.
2880   */
2881   if( p->pc>=0 ){
2882     vdbeInvokeSqllog(p);
2883     sqlite3VdbeTransferError(p);
2884     sqlite3DbFree(db, p->zErrMsg);
2885     p->zErrMsg = 0;
2886     if( p->runOnlyOnce ) p->expired = 1;
2887   }else if( p->rc && p->expired ){
2888     /* The expired flag was set on the VDBE before the first call
2889     ** to sqlite3_step(). For consistency (since sqlite3_step() was
2890     ** called), set the database error in this case as well.
2891     */
2892     sqlite3ErrorWithMsg(db, p->rc, p->zErrMsg ? "%s" : 0, p->zErrMsg);
2893     sqlite3DbFree(db, p->zErrMsg);
2894     p->zErrMsg = 0;
2895   }
2896 
2897   /* Reclaim all memory used by the VDBE
2898   */
2899   Cleanup(p);
2900 
2901   /* Save profiling information from this VDBE run.
2902   */
2903 #ifdef VDBE_PROFILE
2904   {
2905     FILE *out = fopen("vdbe_profile.out", "a");
2906     if( out ){
2907       int i;
2908       fprintf(out, "---- ");
2909       for(i=0; i<p->nOp; i++){
2910         fprintf(out, "%02x", p->aOp[i].opcode);
2911       }
2912       fprintf(out, "\n");
2913       if( p->zSql ){
2914         char c, pc = 0;
2915         fprintf(out, "-- ");
2916         for(i=0; (c = p->zSql[i])!=0; i++){
2917           if( pc=='\n' ) fprintf(out, "-- ");
2918           putc(c, out);
2919           pc = c;
2920         }
2921         if( pc!='\n' ) fprintf(out, "\n");
2922       }
2923       for(i=0; i<p->nOp; i++){
2924         char zHdr[100];
2925         sqlite3_snprintf(sizeof(zHdr), zHdr, "%6u %12llu %8llu ",
2926            p->aOp[i].cnt,
2927            p->aOp[i].cycles,
2928            p->aOp[i].cnt>0 ? p->aOp[i].cycles/p->aOp[i].cnt : 0
2929         );
2930         fprintf(out, "%s", zHdr);
2931         sqlite3VdbePrintOp(out, i, &p->aOp[i]);
2932       }
2933       fclose(out);
2934     }
2935   }
2936 #endif
2937   p->magic = VDBE_MAGIC_RESET;
2938   return p->rc & db->errMask;
2939 }
2940 
2941 /*
2942 ** Clean up and delete a VDBE after execution.  Return an integer which is
2943 ** the result code.  Write any error message text into *pzErrMsg.
2944 */
2945 int sqlite3VdbeFinalize(Vdbe *p){
2946   int rc = SQLITE_OK;
2947   if( p->magic==VDBE_MAGIC_RUN || p->magic==VDBE_MAGIC_HALT ){
2948     rc = sqlite3VdbeReset(p);
2949     assert( (rc & p->db->errMask)==rc );
2950   }
2951   sqlite3VdbeDelete(p);
2952   return rc;
2953 }
2954 
2955 /*
2956 ** If parameter iOp is less than zero, then invoke the destructor for
2957 ** all auxiliary data pointers currently cached by the VM passed as
2958 ** the first argument.
2959 **
2960 ** Or, if iOp is greater than or equal to zero, then the destructor is
2961 ** only invoked for those auxiliary data pointers created by the user
2962 ** function invoked by the OP_Function opcode at instruction iOp of
2963 ** VM pVdbe, and only then if:
2964 **
2965 **    * the associated function parameter is the 32nd or later (counting
2966 **      from left to right), or
2967 **
2968 **    * the corresponding bit in argument mask is clear (where the first
2969 **      function parameter corresponds to bit 0 etc.).
2970 */
2971 void sqlite3VdbeDeleteAuxData(sqlite3 *db, AuxData **pp, int iOp, int mask){
2972   while( *pp ){
2973     AuxData *pAux = *pp;
2974     if( (iOp<0)
2975      || (pAux->iAuxOp==iOp
2976           && pAux->iAuxArg>=0
2977           && (pAux->iAuxArg>31 || !(mask & MASKBIT32(pAux->iAuxArg))))
2978     ){
2979       testcase( pAux->iAuxArg==31 );
2980       if( pAux->xDeleteAux ){
2981         pAux->xDeleteAux(pAux->pAux);
2982       }
2983       *pp = pAux->pNextAux;
2984       sqlite3DbFree(db, pAux);
2985     }else{
2986       pp= &pAux->pNextAux;
2987     }
2988   }
2989 }
2990 
2991 /*
2992 ** Free all memory associated with the Vdbe passed as the second argument,
2993 ** except for object itself, which is preserved.
2994 **
2995 ** The difference between this function and sqlite3VdbeDelete() is that
2996 ** VdbeDelete() also unlinks the Vdbe from the list of VMs associated with
2997 ** the database connection and frees the object itself.
2998 */
2999 void sqlite3VdbeClearObject(sqlite3 *db, Vdbe *p){
3000   SubProgram *pSub, *pNext;
3001   assert( p->db==0 || p->db==db );
3002   releaseMemArray(p->aColName, p->nResColumn*COLNAME_N);
3003   for(pSub=p->pProgram; pSub; pSub=pNext){
3004     pNext = pSub->pNext;
3005     vdbeFreeOpArray(db, pSub->aOp, pSub->nOp);
3006     sqlite3DbFree(db, pSub);
3007   }
3008   if( p->magic!=VDBE_MAGIC_INIT ){
3009     releaseMemArray(p->aVar, p->nVar);
3010     sqlite3DbFree(db, p->pVList);
3011     sqlite3DbFree(db, p->pFree);
3012   }
3013   vdbeFreeOpArray(db, p->aOp, p->nOp);
3014   sqlite3DbFree(db, p->aColName);
3015   sqlite3DbFree(db, p->zSql);
3016 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
3017   {
3018     int i;
3019     for(i=0; i<p->nScan; i++){
3020       sqlite3DbFree(db, p->aScan[i].zName);
3021     }
3022     sqlite3DbFree(db, p->aScan);
3023   }
3024 #endif
3025 }
3026 
3027 /*
3028 ** Delete an entire VDBE.
3029 */
3030 void sqlite3VdbeDelete(Vdbe *p){
3031   sqlite3 *db;
3032 
3033   if( NEVER(p==0) ) return;
3034   db = p->db;
3035   assert( sqlite3_mutex_held(db->mutex) );
3036   sqlite3VdbeClearObject(db, p);
3037   if( p->pPrev ){
3038     p->pPrev->pNext = p->pNext;
3039   }else{
3040     assert( db->pVdbe==p );
3041     db->pVdbe = p->pNext;
3042   }
3043   if( p->pNext ){
3044     p->pNext->pPrev = p->pPrev;
3045   }
3046   p->magic = VDBE_MAGIC_DEAD;
3047   p->db = 0;
3048   sqlite3DbFreeNN(db, p);
3049 }
3050 
3051 /*
3052 ** The cursor "p" has a pending seek operation that has not yet been
3053 ** carried out.  Seek the cursor now.  If an error occurs, return
3054 ** the appropriate error code.
3055 */
3056 static int SQLITE_NOINLINE handleDeferredMoveto(VdbeCursor *p){
3057   int res, rc;
3058 #ifdef SQLITE_TEST
3059   extern int sqlite3_search_count;
3060 #endif
3061   assert( p->deferredMoveto );
3062   assert( p->isTable );
3063   assert( p->eCurType==CURTYPE_BTREE );
3064   rc = sqlite3BtreeMovetoUnpacked(p->uc.pCursor, 0, p->movetoTarget, 0, &res);
3065   if( rc ) return rc;
3066   if( res!=0 ) return SQLITE_CORRUPT_BKPT;
3067 #ifdef SQLITE_TEST
3068   sqlite3_search_count++;
3069 #endif
3070   p->deferredMoveto = 0;
3071   p->cacheStatus = CACHE_STALE;
3072   return SQLITE_OK;
3073 }
3074 
3075 /*
3076 ** Something has moved cursor "p" out of place.  Maybe the row it was
3077 ** pointed to was deleted out from under it.  Or maybe the btree was
3078 ** rebalanced.  Whatever the cause, try to restore "p" to the place it
3079 ** is supposed to be pointing.  If the row was deleted out from under the
3080 ** cursor, set the cursor to point to a NULL row.
3081 */
3082 static int SQLITE_NOINLINE handleMovedCursor(VdbeCursor *p){
3083   int isDifferentRow, rc;
3084   assert( p->eCurType==CURTYPE_BTREE );
3085   assert( p->uc.pCursor!=0 );
3086   assert( sqlite3BtreeCursorHasMoved(p->uc.pCursor) );
3087   rc = sqlite3BtreeCursorRestore(p->uc.pCursor, &isDifferentRow);
3088   p->cacheStatus = CACHE_STALE;
3089   if( isDifferentRow ) p->nullRow = 1;
3090   return rc;
3091 }
3092 
3093 /*
3094 ** Check to ensure that the cursor is valid.  Restore the cursor
3095 ** if need be.  Return any I/O error from the restore operation.
3096 */
3097 int sqlite3VdbeCursorRestore(VdbeCursor *p){
3098   assert( p->eCurType==CURTYPE_BTREE );
3099   if( sqlite3BtreeCursorHasMoved(p->uc.pCursor) ){
3100     return handleMovedCursor(p);
3101   }
3102   return SQLITE_OK;
3103 }
3104 
3105 /*
3106 ** Make sure the cursor p is ready to read or write the row to which it
3107 ** was last positioned.  Return an error code if an OOM fault or I/O error
3108 ** prevents us from positioning the cursor to its correct position.
3109 **
3110 ** If a MoveTo operation is pending on the given cursor, then do that
3111 ** MoveTo now.  If no move is pending, check to see if the row has been
3112 ** deleted out from under the cursor and if it has, mark the row as
3113 ** a NULL row.
3114 **
3115 ** If the cursor is already pointing to the correct row and that row has
3116 ** not been deleted out from under the cursor, then this routine is a no-op.
3117 */
3118 int sqlite3VdbeCursorMoveto(VdbeCursor **pp, int *piCol){
3119   VdbeCursor *p = *pp;
3120   if( p->eCurType==CURTYPE_BTREE ){
3121     if( p->deferredMoveto ){
3122       int iMap;
3123       if( p->aAltMap && (iMap = p->aAltMap[1+*piCol])>0 ){
3124         *pp = p->pAltCursor;
3125         *piCol = iMap - 1;
3126         return SQLITE_OK;
3127       }
3128       return handleDeferredMoveto(p);
3129     }
3130     if( sqlite3BtreeCursorHasMoved(p->uc.pCursor) ){
3131       return handleMovedCursor(p);
3132     }
3133   }
3134   return SQLITE_OK;
3135 }
3136 
3137 /*
3138 ** The following functions:
3139 **
3140 ** sqlite3VdbeSerialType()
3141 ** sqlite3VdbeSerialTypeLen()
3142 ** sqlite3VdbeSerialLen()
3143 ** sqlite3VdbeSerialPut()
3144 ** sqlite3VdbeSerialGet()
3145 **
3146 ** encapsulate the code that serializes values for storage in SQLite
3147 ** data and index records. Each serialized value consists of a
3148 ** 'serial-type' and a blob of data. The serial type is an 8-byte unsigned
3149 ** integer, stored as a varint.
3150 **
3151 ** In an SQLite index record, the serial type is stored directly before
3152 ** the blob of data that it corresponds to. In a table record, all serial
3153 ** types are stored at the start of the record, and the blobs of data at
3154 ** the end. Hence these functions allow the caller to handle the
3155 ** serial-type and data blob separately.
3156 **
3157 ** The following table describes the various storage classes for data:
3158 **
3159 **   serial type        bytes of data      type
3160 **   --------------     ---------------    ---------------
3161 **      0                     0            NULL
3162 **      1                     1            signed integer
3163 **      2                     2            signed integer
3164 **      3                     3            signed integer
3165 **      4                     4            signed integer
3166 **      5                     6            signed integer
3167 **      6                     8            signed integer
3168 **      7                     8            IEEE float
3169 **      8                     0            Integer constant 0
3170 **      9                     0            Integer constant 1
3171 **     10,11                               reserved for expansion
3172 **    N>=12 and even       (N-12)/2        BLOB
3173 **    N>=13 and odd        (N-13)/2        text
3174 **
3175 ** The 8 and 9 types were added in 3.3.0, file format 4.  Prior versions
3176 ** of SQLite will not understand those serial types.
3177 */
3178 
3179 /*
3180 ** Return the serial-type for the value stored in pMem.
3181 */
3182 u32 sqlite3VdbeSerialType(Mem *pMem, int file_format, u32 *pLen){
3183   int flags = pMem->flags;
3184   u32 n;
3185 
3186   assert( pLen!=0 );
3187   if( flags&MEM_Null ){
3188     *pLen = 0;
3189     return 0;
3190   }
3191   if( flags&MEM_Int ){
3192     /* Figure out whether to use 1, 2, 4, 6 or 8 bytes. */
3193 #   define MAX_6BYTE ((((i64)0x00008000)<<32)-1)
3194     i64 i = pMem->u.i;
3195     u64 u;
3196     if( i<0 ){
3197       u = ~i;
3198     }else{
3199       u = i;
3200     }
3201     if( u<=127 ){
3202       if( (i&1)==i && file_format>=4 ){
3203         *pLen = 0;
3204         return 8+(u32)u;
3205       }else{
3206         *pLen = 1;
3207         return 1;
3208       }
3209     }
3210     if( u<=32767 ){ *pLen = 2; return 2; }
3211     if( u<=8388607 ){ *pLen = 3; return 3; }
3212     if( u<=2147483647 ){ *pLen = 4; return 4; }
3213     if( u<=MAX_6BYTE ){ *pLen = 6; return 5; }
3214     *pLen = 8;
3215     return 6;
3216   }
3217   if( flags&MEM_Real ){
3218     *pLen = 8;
3219     return 7;
3220   }
3221   assert( pMem->db->mallocFailed || flags&(MEM_Str|MEM_Blob) );
3222   assert( pMem->n>=0 );
3223   n = (u32)pMem->n;
3224   if( flags & MEM_Zero ){
3225     n += pMem->u.nZero;
3226   }
3227   *pLen = n;
3228   return ((n*2) + 12 + ((flags&MEM_Str)!=0));
3229 }
3230 
3231 /*
3232 ** The sizes for serial types less than 128
3233 */
3234 static const u8 sqlite3SmallTypeSizes[] = {
3235         /*  0   1   2   3   4   5   6   7   8   9 */
3236 /*   0 */   0,  1,  2,  3,  4,  6,  8,  8,  0,  0,
3237 /*  10 */   0,  0,  0,  0,  1,  1,  2,  2,  3,  3,
3238 /*  20 */   4,  4,  5,  5,  6,  6,  7,  7,  8,  8,
3239 /*  30 */   9,  9, 10, 10, 11, 11, 12, 12, 13, 13,
3240 /*  40 */  14, 14, 15, 15, 16, 16, 17, 17, 18, 18,
3241 /*  50 */  19, 19, 20, 20, 21, 21, 22, 22, 23, 23,
3242 /*  60 */  24, 24, 25, 25, 26, 26, 27, 27, 28, 28,
3243 /*  70 */  29, 29, 30, 30, 31, 31, 32, 32, 33, 33,
3244 /*  80 */  34, 34, 35, 35, 36, 36, 37, 37, 38, 38,
3245 /*  90 */  39, 39, 40, 40, 41, 41, 42, 42, 43, 43,
3246 /* 100 */  44, 44, 45, 45, 46, 46, 47, 47, 48, 48,
3247 /* 110 */  49, 49, 50, 50, 51, 51, 52, 52, 53, 53,
3248 /* 120 */  54, 54, 55, 55, 56, 56, 57, 57
3249 };
3250 
3251 /*
3252 ** Return the length of the data corresponding to the supplied serial-type.
3253 */
3254 u32 sqlite3VdbeSerialTypeLen(u32 serial_type){
3255   if( serial_type>=128 ){
3256     return (serial_type-12)/2;
3257   }else{
3258     assert( serial_type<12
3259             || sqlite3SmallTypeSizes[serial_type]==(serial_type - 12)/2 );
3260     return sqlite3SmallTypeSizes[serial_type];
3261   }
3262 }
3263 u8 sqlite3VdbeOneByteSerialTypeLen(u8 serial_type){
3264   assert( serial_type<128 );
3265   return sqlite3SmallTypeSizes[serial_type];
3266 }
3267 
3268 /*
3269 ** If we are on an architecture with mixed-endian floating
3270 ** points (ex: ARM7) then swap the lower 4 bytes with the
3271 ** upper 4 bytes.  Return the result.
3272 **
3273 ** For most architectures, this is a no-op.
3274 **
3275 ** (later):  It is reported to me that the mixed-endian problem
3276 ** on ARM7 is an issue with GCC, not with the ARM7 chip.  It seems
3277 ** that early versions of GCC stored the two words of a 64-bit
3278 ** float in the wrong order.  And that error has been propagated
3279 ** ever since.  The blame is not necessarily with GCC, though.
3280 ** GCC might have just copying the problem from a prior compiler.
3281 ** I am also told that newer versions of GCC that follow a different
3282 ** ABI get the byte order right.
3283 **
3284 ** Developers using SQLite on an ARM7 should compile and run their
3285 ** application using -DSQLITE_DEBUG=1 at least once.  With DEBUG
3286 ** enabled, some asserts below will ensure that the byte order of
3287 ** floating point values is correct.
3288 **
3289 ** (2007-08-30)  Frank van Vugt has studied this problem closely
3290 ** and has send his findings to the SQLite developers.  Frank
3291 ** writes that some Linux kernels offer floating point hardware
3292 ** emulation that uses only 32-bit mantissas instead of a full
3293 ** 48-bits as required by the IEEE standard.  (This is the
3294 ** CONFIG_FPE_FASTFPE option.)  On such systems, floating point
3295 ** byte swapping becomes very complicated.  To avoid problems,
3296 ** the necessary byte swapping is carried out using a 64-bit integer
3297 ** rather than a 64-bit float.  Frank assures us that the code here
3298 ** works for him.  We, the developers, have no way to independently
3299 ** verify this, but Frank seems to know what he is talking about
3300 ** so we trust him.
3301 */
3302 #ifdef SQLITE_MIXED_ENDIAN_64BIT_FLOAT
3303 static u64 floatSwap(u64 in){
3304   union {
3305     u64 r;
3306     u32 i[2];
3307   } u;
3308   u32 t;
3309 
3310   u.r = in;
3311   t = u.i[0];
3312   u.i[0] = u.i[1];
3313   u.i[1] = t;
3314   return u.r;
3315 }
3316 # define swapMixedEndianFloat(X)  X = floatSwap(X)
3317 #else
3318 # define swapMixedEndianFloat(X)
3319 #endif
3320 
3321 /*
3322 ** Write the serialized data blob for the value stored in pMem into
3323 ** buf. It is assumed that the caller has allocated sufficient space.
3324 ** Return the number of bytes written.
3325 **
3326 ** nBuf is the amount of space left in buf[].  The caller is responsible
3327 ** for allocating enough space to buf[] to hold the entire field, exclusive
3328 ** of the pMem->u.nZero bytes for a MEM_Zero value.
3329 **
3330 ** Return the number of bytes actually written into buf[].  The number
3331 ** of bytes in the zero-filled tail is included in the return value only
3332 ** if those bytes were zeroed in buf[].
3333 */
3334 u32 sqlite3VdbeSerialPut(u8 *buf, Mem *pMem, u32 serial_type){
3335   u32 len;
3336 
3337   /* Integer and Real */
3338   if( serial_type<=7 && serial_type>0 ){
3339     u64 v;
3340     u32 i;
3341     if( serial_type==7 ){
3342       assert( sizeof(v)==sizeof(pMem->u.r) );
3343       memcpy(&v, &pMem->u.r, sizeof(v));
3344       swapMixedEndianFloat(v);
3345     }else{
3346       v = pMem->u.i;
3347     }
3348     len = i = sqlite3SmallTypeSizes[serial_type];
3349     assert( i>0 );
3350     do{
3351       buf[--i] = (u8)(v&0xFF);
3352       v >>= 8;
3353     }while( i );
3354     return len;
3355   }
3356 
3357   /* String or blob */
3358   if( serial_type>=12 ){
3359     assert( pMem->n + ((pMem->flags & MEM_Zero)?pMem->u.nZero:0)
3360              == (int)sqlite3VdbeSerialTypeLen(serial_type) );
3361     len = pMem->n;
3362     if( len>0 ) memcpy(buf, pMem->z, len);
3363     return len;
3364   }
3365 
3366   /* NULL or constants 0 or 1 */
3367   return 0;
3368 }
3369 
3370 /* Input "x" is a sequence of unsigned characters that represent a
3371 ** big-endian integer.  Return the equivalent native integer
3372 */
3373 #define ONE_BYTE_INT(x)    ((i8)(x)[0])
3374 #define TWO_BYTE_INT(x)    (256*(i8)((x)[0])|(x)[1])
3375 #define THREE_BYTE_INT(x)  (65536*(i8)((x)[0])|((x)[1]<<8)|(x)[2])
3376 #define FOUR_BYTE_UINT(x)  (((u32)(x)[0]<<24)|((x)[1]<<16)|((x)[2]<<8)|(x)[3])
3377 #define FOUR_BYTE_INT(x) (16777216*(i8)((x)[0])|((x)[1]<<16)|((x)[2]<<8)|(x)[3])
3378 
3379 /*
3380 ** Deserialize the data blob pointed to by buf as serial type serial_type
3381 ** and store the result in pMem.  Return the number of bytes read.
3382 **
3383 ** This function is implemented as two separate routines for performance.
3384 ** The few cases that require local variables are broken out into a separate
3385 ** routine so that in most cases the overhead of moving the stack pointer
3386 ** is avoided.
3387 */
3388 static u32 SQLITE_NOINLINE serialGet(
3389   const unsigned char *buf,     /* Buffer to deserialize from */
3390   u32 serial_type,              /* Serial type to deserialize */
3391   Mem *pMem                     /* Memory cell to write value into */
3392 ){
3393   u64 x = FOUR_BYTE_UINT(buf);
3394   u32 y = FOUR_BYTE_UINT(buf+4);
3395   x = (x<<32) + y;
3396   if( serial_type==6 ){
3397     /* EVIDENCE-OF: R-29851-52272 Value is a big-endian 64-bit
3398     ** twos-complement integer. */
3399     pMem->u.i = *(i64*)&x;
3400     pMem->flags = MEM_Int;
3401     testcase( pMem->u.i<0 );
3402   }else{
3403     /* EVIDENCE-OF: R-57343-49114 Value is a big-endian IEEE 754-2008 64-bit
3404     ** floating point number. */
3405 #if !defined(NDEBUG) && !defined(SQLITE_OMIT_FLOATING_POINT)
3406     /* Verify that integers and floating point values use the same
3407     ** byte order.  Or, that if SQLITE_MIXED_ENDIAN_64BIT_FLOAT is
3408     ** defined that 64-bit floating point values really are mixed
3409     ** endian.
3410     */
3411     static const u64 t1 = ((u64)0x3ff00000)<<32;
3412     static const double r1 = 1.0;
3413     u64 t2 = t1;
3414     swapMixedEndianFloat(t2);
3415     assert( sizeof(r1)==sizeof(t2) && memcmp(&r1, &t2, sizeof(r1))==0 );
3416 #endif
3417     assert( sizeof(x)==8 && sizeof(pMem->u.r)==8 );
3418     swapMixedEndianFloat(x);
3419     memcpy(&pMem->u.r, &x, sizeof(x));
3420     pMem->flags = sqlite3IsNaN(pMem->u.r) ? MEM_Null : MEM_Real;
3421   }
3422   return 8;
3423 }
3424 u32 sqlite3VdbeSerialGet(
3425   const unsigned char *buf,     /* Buffer to deserialize from */
3426   u32 serial_type,              /* Serial type to deserialize */
3427   Mem *pMem                     /* Memory cell to write value into */
3428 ){
3429   switch( serial_type ){
3430     case 10:   /* Reserved for future use */
3431     case 11:   /* Reserved for future use */
3432     case 0: {  /* Null */
3433       /* EVIDENCE-OF: R-24078-09375 Value is a NULL. */
3434       pMem->flags = MEM_Null;
3435       break;
3436     }
3437     case 1: {
3438       /* EVIDENCE-OF: R-44885-25196 Value is an 8-bit twos-complement
3439       ** integer. */
3440       pMem->u.i = ONE_BYTE_INT(buf);
3441       pMem->flags = MEM_Int;
3442       testcase( pMem->u.i<0 );
3443       return 1;
3444     }
3445     case 2: { /* 2-byte signed integer */
3446       /* EVIDENCE-OF: R-49794-35026 Value is a big-endian 16-bit
3447       ** twos-complement integer. */
3448       pMem->u.i = TWO_BYTE_INT(buf);
3449       pMem->flags = MEM_Int;
3450       testcase( pMem->u.i<0 );
3451       return 2;
3452     }
3453     case 3: { /* 3-byte signed integer */
3454       /* EVIDENCE-OF: R-37839-54301 Value is a big-endian 24-bit
3455       ** twos-complement integer. */
3456       pMem->u.i = THREE_BYTE_INT(buf);
3457       pMem->flags = MEM_Int;
3458       testcase( pMem->u.i<0 );
3459       return 3;
3460     }
3461     case 4: { /* 4-byte signed integer */
3462       /* EVIDENCE-OF: R-01849-26079 Value is a big-endian 32-bit
3463       ** twos-complement integer. */
3464       pMem->u.i = FOUR_BYTE_INT(buf);
3465 #ifdef __HP_cc
3466       /* Work around a sign-extension bug in the HP compiler for HP/UX */
3467       if( buf[0]&0x80 ) pMem->u.i |= 0xffffffff80000000LL;
3468 #endif
3469       pMem->flags = MEM_Int;
3470       testcase( pMem->u.i<0 );
3471       return 4;
3472     }
3473     case 5: { /* 6-byte signed integer */
3474       /* EVIDENCE-OF: R-50385-09674 Value is a big-endian 48-bit
3475       ** twos-complement integer. */
3476       pMem->u.i = FOUR_BYTE_UINT(buf+2) + (((i64)1)<<32)*TWO_BYTE_INT(buf);
3477       pMem->flags = MEM_Int;
3478       testcase( pMem->u.i<0 );
3479       return 6;
3480     }
3481     case 6:   /* 8-byte signed integer */
3482     case 7: { /* IEEE floating point */
3483       /* These use local variables, so do them in a separate routine
3484       ** to avoid having to move the frame pointer in the common case */
3485       return serialGet(buf,serial_type,pMem);
3486     }
3487     case 8:    /* Integer 0 */
3488     case 9: {  /* Integer 1 */
3489       /* EVIDENCE-OF: R-12976-22893 Value is the integer 0. */
3490       /* EVIDENCE-OF: R-18143-12121 Value is the integer 1. */
3491       pMem->u.i = serial_type-8;
3492       pMem->flags = MEM_Int;
3493       return 0;
3494     }
3495     default: {
3496       /* EVIDENCE-OF: R-14606-31564 Value is a BLOB that is (N-12)/2 bytes in
3497       ** length.
3498       ** EVIDENCE-OF: R-28401-00140 Value is a string in the text encoding and
3499       ** (N-13)/2 bytes in length. */
3500       static const u16 aFlag[] = { MEM_Blob|MEM_Ephem, MEM_Str|MEM_Ephem };
3501       pMem->z = (char *)buf;
3502       pMem->n = (serial_type-12)/2;
3503       pMem->flags = aFlag[serial_type&1];
3504       return pMem->n;
3505     }
3506   }
3507   return 0;
3508 }
3509 /*
3510 ** This routine is used to allocate sufficient space for an UnpackedRecord
3511 ** structure large enough to be used with sqlite3VdbeRecordUnpack() if
3512 ** the first argument is a pointer to KeyInfo structure pKeyInfo.
3513 **
3514 ** The space is either allocated using sqlite3DbMallocRaw() or from within
3515 ** the unaligned buffer passed via the second and third arguments (presumably
3516 ** stack space). If the former, then *ppFree is set to a pointer that should
3517 ** be eventually freed by the caller using sqlite3DbFree(). Or, if the
3518 ** allocation comes from the pSpace/szSpace buffer, *ppFree is set to NULL
3519 ** before returning.
3520 **
3521 ** If an OOM error occurs, NULL is returned.
3522 */
3523 UnpackedRecord *sqlite3VdbeAllocUnpackedRecord(
3524   KeyInfo *pKeyInfo               /* Description of the record */
3525 ){
3526   UnpackedRecord *p;              /* Unpacked record to return */
3527   int nByte;                      /* Number of bytes required for *p */
3528   nByte = ROUND8(sizeof(UnpackedRecord)) + sizeof(Mem)*(pKeyInfo->nField+1);
3529   p = (UnpackedRecord *)sqlite3DbMallocRaw(pKeyInfo->db, nByte);
3530   if( !p ) return 0;
3531   p->aMem = (Mem*)&((char*)p)[ROUND8(sizeof(UnpackedRecord))];
3532   assert( pKeyInfo->aSortOrder!=0 );
3533   p->pKeyInfo = pKeyInfo;
3534   p->nField = pKeyInfo->nField + 1;
3535   return p;
3536 }
3537 
3538 /*
3539 ** Given the nKey-byte encoding of a record in pKey[], populate the
3540 ** UnpackedRecord structure indicated by the fourth argument with the
3541 ** contents of the decoded record.
3542 */
3543 void sqlite3VdbeRecordUnpack(
3544   KeyInfo *pKeyInfo,     /* Information about the record format */
3545   int nKey,              /* Size of the binary record */
3546   const void *pKey,      /* The binary record */
3547   UnpackedRecord *p      /* Populate this structure before returning. */
3548 ){
3549   const unsigned char *aKey = (const unsigned char *)pKey;
3550   int d;
3551   u32 idx;                        /* Offset in aKey[] to read from */
3552   u16 u;                          /* Unsigned loop counter */
3553   u32 szHdr;
3554   Mem *pMem = p->aMem;
3555 
3556   p->default_rc = 0;
3557   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
3558   idx = getVarint32(aKey, szHdr);
3559   d = szHdr;
3560   u = 0;
3561   while( idx<szHdr && d<=nKey ){
3562     u32 serial_type;
3563 
3564     idx += getVarint32(&aKey[idx], serial_type);
3565     pMem->enc = pKeyInfo->enc;
3566     pMem->db = pKeyInfo->db;
3567     /* pMem->flags = 0; // sqlite3VdbeSerialGet() will set this for us */
3568     pMem->szMalloc = 0;
3569     pMem->z = 0;
3570     d += sqlite3VdbeSerialGet(&aKey[d], serial_type, pMem);
3571     pMem++;
3572     if( (++u)>=p->nField ) break;
3573   }
3574   assert( u<=pKeyInfo->nField + 1 );
3575   p->nField = u;
3576 }
3577 
3578 #ifdef SQLITE_DEBUG
3579 /*
3580 ** This function compares two index or table record keys in the same way
3581 ** as the sqlite3VdbeRecordCompare() routine. Unlike VdbeRecordCompare(),
3582 ** this function deserializes and compares values using the
3583 ** sqlite3VdbeSerialGet() and sqlite3MemCompare() functions. It is used
3584 ** in assert() statements to ensure that the optimized code in
3585 ** sqlite3VdbeRecordCompare() returns results with these two primitives.
3586 **
3587 ** Return true if the result of comparison is equivalent to desiredResult.
3588 ** Return false if there is a disagreement.
3589 */
3590 static int vdbeRecordCompareDebug(
3591   int nKey1, const void *pKey1, /* Left key */
3592   const UnpackedRecord *pPKey2, /* Right key */
3593   int desiredResult             /* Correct answer */
3594 ){
3595   u32 d1;            /* Offset into aKey[] of next data element */
3596   u32 idx1;          /* Offset into aKey[] of next header element */
3597   u32 szHdr1;        /* Number of bytes in header */
3598   int i = 0;
3599   int rc = 0;
3600   const unsigned char *aKey1 = (const unsigned char *)pKey1;
3601   KeyInfo *pKeyInfo;
3602   Mem mem1;
3603 
3604   pKeyInfo = pPKey2->pKeyInfo;
3605   if( pKeyInfo->db==0 ) return 1;
3606   mem1.enc = pKeyInfo->enc;
3607   mem1.db = pKeyInfo->db;
3608   /* mem1.flags = 0;  // Will be initialized by sqlite3VdbeSerialGet() */
3609   VVA_ONLY( mem1.szMalloc = 0; ) /* Only needed by assert() statements */
3610 
3611   /* Compilers may complain that mem1.u.i is potentially uninitialized.
3612   ** We could initialize it, as shown here, to silence those complaints.
3613   ** But in fact, mem1.u.i will never actually be used uninitialized, and doing
3614   ** the unnecessary initialization has a measurable negative performance
3615   ** impact, since this routine is a very high runner.  And so, we choose
3616   ** to ignore the compiler warnings and leave this variable uninitialized.
3617   */
3618   /*  mem1.u.i = 0;  // not needed, here to silence compiler warning */
3619 
3620   idx1 = getVarint32(aKey1, szHdr1);
3621   if( szHdr1>98307 ) return SQLITE_CORRUPT;
3622   d1 = szHdr1;
3623   assert( pKeyInfo->nField+pKeyInfo->nXField>=pPKey2->nField || CORRUPT_DB );
3624   assert( pKeyInfo->aSortOrder!=0 );
3625   assert( pKeyInfo->nField>0 );
3626   assert( idx1<=szHdr1 || CORRUPT_DB );
3627   do{
3628     u32 serial_type1;
3629 
3630     /* Read the serial types for the next element in each key. */
3631     idx1 += getVarint32( aKey1+idx1, serial_type1 );
3632 
3633     /* Verify that there is enough key space remaining to avoid
3634     ** a buffer overread.  The "d1+serial_type1+2" subexpression will
3635     ** always be greater than or equal to the amount of required key space.
3636     ** Use that approximation to avoid the more expensive call to
3637     ** sqlite3VdbeSerialTypeLen() in the common case.
3638     */
3639     if( d1+serial_type1+2>(u32)nKey1
3640      && d1+sqlite3VdbeSerialTypeLen(serial_type1)>(u32)nKey1
3641     ){
3642       break;
3643     }
3644 
3645     /* Extract the values to be compared.
3646     */
3647     d1 += sqlite3VdbeSerialGet(&aKey1[d1], serial_type1, &mem1);
3648 
3649     /* Do the comparison
3650     */
3651     rc = sqlite3MemCompare(&mem1, &pPKey2->aMem[i], pKeyInfo->aColl[i]);
3652     if( rc!=0 ){
3653       assert( mem1.szMalloc==0 );  /* See comment below */
3654       if( pKeyInfo->aSortOrder[i] ){
3655         rc = -rc;  /* Invert the result for DESC sort order. */
3656       }
3657       goto debugCompareEnd;
3658     }
3659     i++;
3660   }while( idx1<szHdr1 && i<pPKey2->nField );
3661 
3662   /* No memory allocation is ever used on mem1.  Prove this using
3663   ** the following assert().  If the assert() fails, it indicates a
3664   ** memory leak and a need to call sqlite3VdbeMemRelease(&mem1).
3665   */
3666   assert( mem1.szMalloc==0 );
3667 
3668   /* rc==0 here means that one of the keys ran out of fields and
3669   ** all the fields up to that point were equal. Return the default_rc
3670   ** value.  */
3671   rc = pPKey2->default_rc;
3672 
3673 debugCompareEnd:
3674   if( desiredResult==0 && rc==0 ) return 1;
3675   if( desiredResult<0 && rc<0 ) return 1;
3676   if( desiredResult>0 && rc>0 ) return 1;
3677   if( CORRUPT_DB ) return 1;
3678   if( pKeyInfo->db->mallocFailed ) return 1;
3679   return 0;
3680 }
3681 #endif
3682 
3683 #ifdef SQLITE_DEBUG
3684 /*
3685 ** Count the number of fields (a.k.a. columns) in the record given by
3686 ** pKey,nKey.  The verify that this count is less than or equal to the
3687 ** limit given by pKeyInfo->nField + pKeyInfo->nXField.
3688 **
3689 ** If this constraint is not satisfied, it means that the high-speed
3690 ** vdbeRecordCompareInt() and vdbeRecordCompareString() routines will
3691 ** not work correctly.  If this assert() ever fires, it probably means
3692 ** that the KeyInfo.nField or KeyInfo.nXField values were computed
3693 ** incorrectly.
3694 */
3695 static void vdbeAssertFieldCountWithinLimits(
3696   int nKey, const void *pKey,   /* The record to verify */
3697   const KeyInfo *pKeyInfo       /* Compare size with this KeyInfo */
3698 ){
3699   int nField = 0;
3700   u32 szHdr;
3701   u32 idx;
3702   u32 notUsed;
3703   const unsigned char *aKey = (const unsigned char*)pKey;
3704 
3705   if( CORRUPT_DB ) return;
3706   idx = getVarint32(aKey, szHdr);
3707   assert( nKey>=0 );
3708   assert( szHdr<=(u32)nKey );
3709   while( idx<szHdr ){
3710     idx += getVarint32(aKey+idx, notUsed);
3711     nField++;
3712   }
3713   assert( nField <= pKeyInfo->nField+pKeyInfo->nXField );
3714 }
3715 #else
3716 # define vdbeAssertFieldCountWithinLimits(A,B,C)
3717 #endif
3718 
3719 /*
3720 ** Both *pMem1 and *pMem2 contain string values. Compare the two values
3721 ** using the collation sequence pColl. As usual, return a negative , zero
3722 ** or positive value if *pMem1 is less than, equal to or greater than
3723 ** *pMem2, respectively. Similar in spirit to "rc = (*pMem1) - (*pMem2);".
3724 */
3725 static int vdbeCompareMemString(
3726   const Mem *pMem1,
3727   const Mem *pMem2,
3728   const CollSeq *pColl,
3729   u8 *prcErr                      /* If an OOM occurs, set to SQLITE_NOMEM */
3730 ){
3731   if( pMem1->enc==pColl->enc ){
3732     /* The strings are already in the correct encoding.  Call the
3733      ** comparison function directly */
3734     return pColl->xCmp(pColl->pUser,pMem1->n,pMem1->z,pMem2->n,pMem2->z);
3735   }else{
3736     int rc;
3737     const void *v1, *v2;
3738     Mem c1;
3739     Mem c2;
3740     sqlite3VdbeMemInit(&c1, pMem1->db, MEM_Null);
3741     sqlite3VdbeMemInit(&c2, pMem1->db, MEM_Null);
3742     sqlite3VdbeMemShallowCopy(&c1, pMem1, MEM_Ephem);
3743     sqlite3VdbeMemShallowCopy(&c2, pMem2, MEM_Ephem);
3744     v1 = sqlite3ValueText((sqlite3_value*)&c1, pColl->enc);
3745     v2 = sqlite3ValueText((sqlite3_value*)&c2, pColl->enc);
3746     if( (v1==0 || v2==0) ){
3747       if( prcErr ) *prcErr = SQLITE_NOMEM_BKPT;
3748       rc = 0;
3749     }else{
3750       rc = pColl->xCmp(pColl->pUser, c1.n, v1, c2.n, v2);
3751     }
3752     sqlite3VdbeMemRelease(&c1);
3753     sqlite3VdbeMemRelease(&c2);
3754     return rc;
3755   }
3756 }
3757 
3758 /*
3759 ** The input pBlob is guaranteed to be a Blob that is not marked
3760 ** with MEM_Zero.  Return true if it could be a zero-blob.
3761 */
3762 static int isAllZero(const char *z, int n){
3763   int i;
3764   for(i=0; i<n; i++){
3765     if( z[i] ) return 0;
3766   }
3767   return 1;
3768 }
3769 
3770 /*
3771 ** Compare two blobs.  Return negative, zero, or positive if the first
3772 ** is less than, equal to, or greater than the second, respectively.
3773 ** If one blob is a prefix of the other, then the shorter is the lessor.
3774 */
3775 static SQLITE_NOINLINE int sqlite3BlobCompare(const Mem *pB1, const Mem *pB2){
3776   int c;
3777   int n1 = pB1->n;
3778   int n2 = pB2->n;
3779 
3780   /* It is possible to have a Blob value that has some non-zero content
3781   ** followed by zero content.  But that only comes up for Blobs formed
3782   ** by the OP_MakeRecord opcode, and such Blobs never get passed into
3783   ** sqlite3MemCompare(). */
3784   assert( (pB1->flags & MEM_Zero)==0 || n1==0 );
3785   assert( (pB2->flags & MEM_Zero)==0 || n2==0 );
3786 
3787   if( (pB1->flags|pB2->flags) & MEM_Zero ){
3788     if( pB1->flags & pB2->flags & MEM_Zero ){
3789       return pB1->u.nZero - pB2->u.nZero;
3790     }else if( pB1->flags & MEM_Zero ){
3791       if( !isAllZero(pB2->z, pB2->n) ) return -1;
3792       return pB1->u.nZero - n2;
3793     }else{
3794       if( !isAllZero(pB1->z, pB1->n) ) return +1;
3795       return n1 - pB2->u.nZero;
3796     }
3797   }
3798   c = memcmp(pB1->z, pB2->z, n1>n2 ? n2 : n1);
3799   if( c ) return c;
3800   return n1 - n2;
3801 }
3802 
3803 /*
3804 ** Do a comparison between a 64-bit signed integer and a 64-bit floating-point
3805 ** number.  Return negative, zero, or positive if the first (i64) is less than,
3806 ** equal to, or greater than the second (double).
3807 */
3808 static int sqlite3IntFloatCompare(i64 i, double r){
3809   if( sizeof(LONGDOUBLE_TYPE)>8 ){
3810     LONGDOUBLE_TYPE x = (LONGDOUBLE_TYPE)i;
3811     if( x<r ) return -1;
3812     if( x>r ) return +1;
3813     return 0;
3814   }else{
3815     i64 y;
3816     double s;
3817     if( r<-9223372036854775808.0 ) return +1;
3818     if( r>9223372036854775807.0 ) return -1;
3819     y = (i64)r;
3820     if( i<y ) return -1;
3821     if( i>y ){
3822       if( y==SMALLEST_INT64 && r>0.0 ) return -1;
3823       return +1;
3824     }
3825     s = (double)i;
3826     if( s<r ) return -1;
3827     if( s>r ) return +1;
3828     return 0;
3829   }
3830 }
3831 
3832 /*
3833 ** Compare the values contained by the two memory cells, returning
3834 ** negative, zero or positive if pMem1 is less than, equal to, or greater
3835 ** than pMem2. Sorting order is NULL's first, followed by numbers (integers
3836 ** and reals) sorted numerically, followed by text ordered by the collating
3837 ** sequence pColl and finally blob's ordered by memcmp().
3838 **
3839 ** Two NULL values are considered equal by this function.
3840 */
3841 int sqlite3MemCompare(const Mem *pMem1, const Mem *pMem2, const CollSeq *pColl){
3842   int f1, f2;
3843   int combined_flags;
3844 
3845   f1 = pMem1->flags;
3846   f2 = pMem2->flags;
3847   combined_flags = f1|f2;
3848   assert( (combined_flags & MEM_RowSet)==0 );
3849 
3850   /* If one value is NULL, it is less than the other. If both values
3851   ** are NULL, return 0.
3852   */
3853   if( combined_flags&MEM_Null ){
3854     return (f2&MEM_Null) - (f1&MEM_Null);
3855   }
3856 
3857   /* At least one of the two values is a number
3858   */
3859   if( combined_flags&(MEM_Int|MEM_Real) ){
3860     if( (f1 & f2 & MEM_Int)!=0 ){
3861       if( pMem1->u.i < pMem2->u.i ) return -1;
3862       if( pMem1->u.i > pMem2->u.i ) return +1;
3863       return 0;
3864     }
3865     if( (f1 & f2 & MEM_Real)!=0 ){
3866       if( pMem1->u.r < pMem2->u.r ) return -1;
3867       if( pMem1->u.r > pMem2->u.r ) return +1;
3868       return 0;
3869     }
3870     if( (f1&MEM_Int)!=0 ){
3871       if( (f2&MEM_Real)!=0 ){
3872         return sqlite3IntFloatCompare(pMem1->u.i, pMem2->u.r);
3873       }else{
3874         return -1;
3875       }
3876     }
3877     if( (f1&MEM_Real)!=0 ){
3878       if( (f2&MEM_Int)!=0 ){
3879         return -sqlite3IntFloatCompare(pMem2->u.i, pMem1->u.r);
3880       }else{
3881         return -1;
3882       }
3883     }
3884     return +1;
3885   }
3886 
3887   /* If one value is a string and the other is a blob, the string is less.
3888   ** If both are strings, compare using the collating functions.
3889   */
3890   if( combined_flags&MEM_Str ){
3891     if( (f1 & MEM_Str)==0 ){
3892       return 1;
3893     }
3894     if( (f2 & MEM_Str)==0 ){
3895       return -1;
3896     }
3897 
3898     assert( pMem1->enc==pMem2->enc || pMem1->db->mallocFailed );
3899     assert( pMem1->enc==SQLITE_UTF8 ||
3900             pMem1->enc==SQLITE_UTF16LE || pMem1->enc==SQLITE_UTF16BE );
3901 
3902     /* The collation sequence must be defined at this point, even if
3903     ** the user deletes the collation sequence after the vdbe program is
3904     ** compiled (this was not always the case).
3905     */
3906     assert( !pColl || pColl->xCmp );
3907 
3908     if( pColl ){
3909       return vdbeCompareMemString(pMem1, pMem2, pColl, 0);
3910     }
3911     /* If a NULL pointer was passed as the collate function, fall through
3912     ** to the blob case and use memcmp().  */
3913   }
3914 
3915   /* Both values must be blobs.  Compare using memcmp().  */
3916   return sqlite3BlobCompare(pMem1, pMem2);
3917 }
3918 
3919 
3920 /*
3921 ** The first argument passed to this function is a serial-type that
3922 ** corresponds to an integer - all values between 1 and 9 inclusive
3923 ** except 7. The second points to a buffer containing an integer value
3924 ** serialized according to serial_type. This function deserializes
3925 ** and returns the value.
3926 */
3927 static i64 vdbeRecordDecodeInt(u32 serial_type, const u8 *aKey){
3928   u32 y;
3929   assert( CORRUPT_DB || (serial_type>=1 && serial_type<=9 && serial_type!=7) );
3930   switch( serial_type ){
3931     case 0:
3932     case 1:
3933       testcase( aKey[0]&0x80 );
3934       return ONE_BYTE_INT(aKey);
3935     case 2:
3936       testcase( aKey[0]&0x80 );
3937       return TWO_BYTE_INT(aKey);
3938     case 3:
3939       testcase( aKey[0]&0x80 );
3940       return THREE_BYTE_INT(aKey);
3941     case 4: {
3942       testcase( aKey[0]&0x80 );
3943       y = FOUR_BYTE_UINT(aKey);
3944       return (i64)*(int*)&y;
3945     }
3946     case 5: {
3947       testcase( aKey[0]&0x80 );
3948       return FOUR_BYTE_UINT(aKey+2) + (((i64)1)<<32)*TWO_BYTE_INT(aKey);
3949     }
3950     case 6: {
3951       u64 x = FOUR_BYTE_UINT(aKey);
3952       testcase( aKey[0]&0x80 );
3953       x = (x<<32) | FOUR_BYTE_UINT(aKey+4);
3954       return (i64)*(i64*)&x;
3955     }
3956   }
3957 
3958   return (serial_type - 8);
3959 }
3960 
3961 /*
3962 ** This function compares the two table rows or index records
3963 ** specified by {nKey1, pKey1} and pPKey2.  It returns a negative, zero
3964 ** or positive integer if key1 is less than, equal to or
3965 ** greater than key2.  The {nKey1, pKey1} key must be a blob
3966 ** created by the OP_MakeRecord opcode of the VDBE.  The pPKey2
3967 ** key must be a parsed key such as obtained from
3968 ** sqlite3VdbeParseRecord.
3969 **
3970 ** If argument bSkip is non-zero, it is assumed that the caller has already
3971 ** determined that the first fields of the keys are equal.
3972 **
3973 ** Key1 and Key2 do not have to contain the same number of fields. If all
3974 ** fields that appear in both keys are equal, then pPKey2->default_rc is
3975 ** returned.
3976 **
3977 ** If database corruption is discovered, set pPKey2->errCode to
3978 ** SQLITE_CORRUPT and return 0. If an OOM error is encountered,
3979 ** pPKey2->errCode is set to SQLITE_NOMEM and, if it is not NULL, the
3980 ** malloc-failed flag set on database handle (pPKey2->pKeyInfo->db).
3981 */
3982 int sqlite3VdbeRecordCompareWithSkip(
3983   int nKey1, const void *pKey1,   /* Left key */
3984   UnpackedRecord *pPKey2,         /* Right key */
3985   int bSkip                       /* If true, skip the first field */
3986 ){
3987   u32 d1;                         /* Offset into aKey[] of next data element */
3988   int i;                          /* Index of next field to compare */
3989   u32 szHdr1;                     /* Size of record header in bytes */
3990   u32 idx1;                       /* Offset of first type in header */
3991   int rc = 0;                     /* Return value */
3992   Mem *pRhs = pPKey2->aMem;       /* Next field of pPKey2 to compare */
3993   KeyInfo *pKeyInfo = pPKey2->pKeyInfo;
3994   const unsigned char *aKey1 = (const unsigned char *)pKey1;
3995   Mem mem1;
3996 
3997   /* If bSkip is true, then the caller has already determined that the first
3998   ** two elements in the keys are equal. Fix the various stack variables so
3999   ** that this routine begins comparing at the second field. */
4000   if( bSkip ){
4001     u32 s1;
4002     idx1 = 1 + getVarint32(&aKey1[1], s1);
4003     szHdr1 = aKey1[0];
4004     d1 = szHdr1 + sqlite3VdbeSerialTypeLen(s1);
4005     i = 1;
4006     pRhs++;
4007   }else{
4008     idx1 = getVarint32(aKey1, szHdr1);
4009     d1 = szHdr1;
4010     if( d1>(unsigned)nKey1 ){
4011       pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4012       return 0;  /* Corruption */
4013     }
4014     i = 0;
4015   }
4016 
4017   VVA_ONLY( mem1.szMalloc = 0; ) /* Only needed by assert() statements */
4018   assert( pPKey2->pKeyInfo->nField+pPKey2->pKeyInfo->nXField>=pPKey2->nField
4019        || CORRUPT_DB );
4020   assert( pPKey2->pKeyInfo->aSortOrder!=0 );
4021   assert( pPKey2->pKeyInfo->nField>0 );
4022   assert( idx1<=szHdr1 || CORRUPT_DB );
4023   do{
4024     u32 serial_type;
4025 
4026     /* RHS is an integer */
4027     if( pRhs->flags & MEM_Int ){
4028       serial_type = aKey1[idx1];
4029       testcase( serial_type==12 );
4030       if( serial_type>=10 ){
4031         rc = +1;
4032       }else if( serial_type==0 ){
4033         rc = -1;
4034       }else if( serial_type==7 ){
4035         sqlite3VdbeSerialGet(&aKey1[d1], serial_type, &mem1);
4036         rc = -sqlite3IntFloatCompare(pRhs->u.i, mem1.u.r);
4037       }else{
4038         i64 lhs = vdbeRecordDecodeInt(serial_type, &aKey1[d1]);
4039         i64 rhs = pRhs->u.i;
4040         if( lhs<rhs ){
4041           rc = -1;
4042         }else if( lhs>rhs ){
4043           rc = +1;
4044         }
4045       }
4046     }
4047 
4048     /* RHS is real */
4049     else if( pRhs->flags & MEM_Real ){
4050       serial_type = aKey1[idx1];
4051       if( serial_type>=10 ){
4052         /* Serial types 12 or greater are strings and blobs (greater than
4053         ** numbers). Types 10 and 11 are currently "reserved for future
4054         ** use", so it doesn't really matter what the results of comparing
4055         ** them to numberic values are.  */
4056         rc = +1;
4057       }else if( serial_type==0 ){
4058         rc = -1;
4059       }else{
4060         sqlite3VdbeSerialGet(&aKey1[d1], serial_type, &mem1);
4061         if( serial_type==7 ){
4062           if( mem1.u.r<pRhs->u.r ){
4063             rc = -1;
4064           }else if( mem1.u.r>pRhs->u.r ){
4065             rc = +1;
4066           }
4067         }else{
4068           rc = sqlite3IntFloatCompare(mem1.u.i, pRhs->u.r);
4069         }
4070       }
4071     }
4072 
4073     /* RHS is a string */
4074     else if( pRhs->flags & MEM_Str ){
4075       getVarint32(&aKey1[idx1], serial_type);
4076       testcase( serial_type==12 );
4077       if( serial_type<12 ){
4078         rc = -1;
4079       }else if( !(serial_type & 0x01) ){
4080         rc = +1;
4081       }else{
4082         mem1.n = (serial_type - 12) / 2;
4083         testcase( (d1+mem1.n)==(unsigned)nKey1 );
4084         testcase( (d1+mem1.n+1)==(unsigned)nKey1 );
4085         if( (d1+mem1.n) > (unsigned)nKey1 ){
4086           pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4087           return 0;                /* Corruption */
4088         }else if( pKeyInfo->aColl[i] ){
4089           mem1.enc = pKeyInfo->enc;
4090           mem1.db = pKeyInfo->db;
4091           mem1.flags = MEM_Str;
4092           mem1.z = (char*)&aKey1[d1];
4093           rc = vdbeCompareMemString(
4094               &mem1, pRhs, pKeyInfo->aColl[i], &pPKey2->errCode
4095           );
4096         }else{
4097           int nCmp = MIN(mem1.n, pRhs->n);
4098           rc = memcmp(&aKey1[d1], pRhs->z, nCmp);
4099           if( rc==0 ) rc = mem1.n - pRhs->n;
4100         }
4101       }
4102     }
4103 
4104     /* RHS is a blob */
4105     else if( pRhs->flags & MEM_Blob ){
4106       assert( (pRhs->flags & MEM_Zero)==0 || pRhs->n==0 );
4107       getVarint32(&aKey1[idx1], serial_type);
4108       testcase( serial_type==12 );
4109       if( serial_type<12 || (serial_type & 0x01) ){
4110         rc = -1;
4111       }else{
4112         int nStr = (serial_type - 12) / 2;
4113         testcase( (d1+nStr)==(unsigned)nKey1 );
4114         testcase( (d1+nStr+1)==(unsigned)nKey1 );
4115         if( (d1+nStr) > (unsigned)nKey1 ){
4116           pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4117           return 0;                /* Corruption */
4118         }else if( pRhs->flags & MEM_Zero ){
4119           if( !isAllZero((const char*)&aKey1[d1],nStr) ){
4120             rc = 1;
4121           }else{
4122             rc = nStr - pRhs->u.nZero;
4123           }
4124         }else{
4125           int nCmp = MIN(nStr, pRhs->n);
4126           rc = memcmp(&aKey1[d1], pRhs->z, nCmp);
4127           if( rc==0 ) rc = nStr - pRhs->n;
4128         }
4129       }
4130     }
4131 
4132     /* RHS is null */
4133     else{
4134       serial_type = aKey1[idx1];
4135       rc = (serial_type!=0);
4136     }
4137 
4138     if( rc!=0 ){
4139       if( pKeyInfo->aSortOrder[i] ){
4140         rc = -rc;
4141       }
4142       assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, rc) );
4143       assert( mem1.szMalloc==0 );  /* See comment below */
4144       return rc;
4145     }
4146 
4147     i++;
4148     pRhs++;
4149     d1 += sqlite3VdbeSerialTypeLen(serial_type);
4150     idx1 += sqlite3VarintLen(serial_type);
4151   }while( idx1<(unsigned)szHdr1 && i<pPKey2->nField && d1<=(unsigned)nKey1 );
4152 
4153   /* No memory allocation is ever used on mem1.  Prove this using
4154   ** the following assert().  If the assert() fails, it indicates a
4155   ** memory leak and a need to call sqlite3VdbeMemRelease(&mem1).  */
4156   assert( mem1.szMalloc==0 );
4157 
4158   /* rc==0 here means that one or both of the keys ran out of fields and
4159   ** all the fields up to that point were equal. Return the default_rc
4160   ** value.  */
4161   assert( CORRUPT_DB
4162        || vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, pPKey2->default_rc)
4163        || pKeyInfo->db->mallocFailed
4164   );
4165   pPKey2->eqSeen = 1;
4166   return pPKey2->default_rc;
4167 }
4168 int sqlite3VdbeRecordCompare(
4169   int nKey1, const void *pKey1,   /* Left key */
4170   UnpackedRecord *pPKey2          /* Right key */
4171 ){
4172   return sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 0);
4173 }
4174 
4175 
4176 /*
4177 ** This function is an optimized version of sqlite3VdbeRecordCompare()
4178 ** that (a) the first field of pPKey2 is an integer, and (b) the
4179 ** size-of-header varint at the start of (pKey1/nKey1) fits in a single
4180 ** byte (i.e. is less than 128).
4181 **
4182 ** To avoid concerns about buffer overreads, this routine is only used
4183 ** on schemas where the maximum valid header size is 63 bytes or less.
4184 */
4185 static int vdbeRecordCompareInt(
4186   int nKey1, const void *pKey1, /* Left key */
4187   UnpackedRecord *pPKey2        /* Right key */
4188 ){
4189   const u8 *aKey = &((const u8*)pKey1)[*(const u8*)pKey1 & 0x3F];
4190   int serial_type = ((const u8*)pKey1)[1];
4191   int res;
4192   u32 y;
4193   u64 x;
4194   i64 v;
4195   i64 lhs;
4196 
4197   vdbeAssertFieldCountWithinLimits(nKey1, pKey1, pPKey2->pKeyInfo);
4198   assert( (*(u8*)pKey1)<=0x3F || CORRUPT_DB );
4199   switch( serial_type ){
4200     case 1: { /* 1-byte signed integer */
4201       lhs = ONE_BYTE_INT(aKey);
4202       testcase( lhs<0 );
4203       break;
4204     }
4205     case 2: { /* 2-byte signed integer */
4206       lhs = TWO_BYTE_INT(aKey);
4207       testcase( lhs<0 );
4208       break;
4209     }
4210     case 3: { /* 3-byte signed integer */
4211       lhs = THREE_BYTE_INT(aKey);
4212       testcase( lhs<0 );
4213       break;
4214     }
4215     case 4: { /* 4-byte signed integer */
4216       y = FOUR_BYTE_UINT(aKey);
4217       lhs = (i64)*(int*)&y;
4218       testcase( lhs<0 );
4219       break;
4220     }
4221     case 5: { /* 6-byte signed integer */
4222       lhs = FOUR_BYTE_UINT(aKey+2) + (((i64)1)<<32)*TWO_BYTE_INT(aKey);
4223       testcase( lhs<0 );
4224       break;
4225     }
4226     case 6: { /* 8-byte signed integer */
4227       x = FOUR_BYTE_UINT(aKey);
4228       x = (x<<32) | FOUR_BYTE_UINT(aKey+4);
4229       lhs = *(i64*)&x;
4230       testcase( lhs<0 );
4231       break;
4232     }
4233     case 8:
4234       lhs = 0;
4235       break;
4236     case 9:
4237       lhs = 1;
4238       break;
4239 
4240     /* This case could be removed without changing the results of running
4241     ** this code. Including it causes gcc to generate a faster switch
4242     ** statement (since the range of switch targets now starts at zero and
4243     ** is contiguous) but does not cause any duplicate code to be generated
4244     ** (as gcc is clever enough to combine the two like cases). Other
4245     ** compilers might be similar.  */
4246     case 0: case 7:
4247       return sqlite3VdbeRecordCompare(nKey1, pKey1, pPKey2);
4248 
4249     default:
4250       return sqlite3VdbeRecordCompare(nKey1, pKey1, pPKey2);
4251   }
4252 
4253   v = pPKey2->aMem[0].u.i;
4254   if( v>lhs ){
4255     res = pPKey2->r1;
4256   }else if( v<lhs ){
4257     res = pPKey2->r2;
4258   }else if( pPKey2->nField>1 ){
4259     /* The first fields of the two keys are equal. Compare the trailing
4260     ** fields.  */
4261     res = sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 1);
4262   }else{
4263     /* The first fields of the two keys are equal and there are no trailing
4264     ** fields. Return pPKey2->default_rc in this case. */
4265     res = pPKey2->default_rc;
4266     pPKey2->eqSeen = 1;
4267   }
4268 
4269   assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, res) );
4270   return res;
4271 }
4272 
4273 /*
4274 ** This function is an optimized version of sqlite3VdbeRecordCompare()
4275 ** that (a) the first field of pPKey2 is a string, that (b) the first field
4276 ** uses the collation sequence BINARY and (c) that the size-of-header varint
4277 ** at the start of (pKey1/nKey1) fits in a single byte.
4278 */
4279 static int vdbeRecordCompareString(
4280   int nKey1, const void *pKey1, /* Left key */
4281   UnpackedRecord *pPKey2        /* Right key */
4282 ){
4283   const u8 *aKey1 = (const u8*)pKey1;
4284   int serial_type;
4285   int res;
4286 
4287   assert( pPKey2->aMem[0].flags & MEM_Str );
4288   vdbeAssertFieldCountWithinLimits(nKey1, pKey1, pPKey2->pKeyInfo);
4289   getVarint32(&aKey1[1], serial_type);
4290   if( serial_type<12 ){
4291     res = pPKey2->r1;      /* (pKey1/nKey1) is a number or a null */
4292   }else if( !(serial_type & 0x01) ){
4293     res = pPKey2->r2;      /* (pKey1/nKey1) is a blob */
4294   }else{
4295     int nCmp;
4296     int nStr;
4297     int szHdr = aKey1[0];
4298 
4299     nStr = (serial_type-12) / 2;
4300     if( (szHdr + nStr) > nKey1 ){
4301       pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4302       return 0;    /* Corruption */
4303     }
4304     nCmp = MIN( pPKey2->aMem[0].n, nStr );
4305     res = memcmp(&aKey1[szHdr], pPKey2->aMem[0].z, nCmp);
4306 
4307     if( res==0 ){
4308       res = nStr - pPKey2->aMem[0].n;
4309       if( res==0 ){
4310         if( pPKey2->nField>1 ){
4311           res = sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 1);
4312         }else{
4313           res = pPKey2->default_rc;
4314           pPKey2->eqSeen = 1;
4315         }
4316       }else if( res>0 ){
4317         res = pPKey2->r2;
4318       }else{
4319         res = pPKey2->r1;
4320       }
4321     }else if( res>0 ){
4322       res = pPKey2->r2;
4323     }else{
4324       res = pPKey2->r1;
4325     }
4326   }
4327 
4328   assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, res)
4329        || CORRUPT_DB
4330        || pPKey2->pKeyInfo->db->mallocFailed
4331   );
4332   return res;
4333 }
4334 
4335 /*
4336 ** Return a pointer to an sqlite3VdbeRecordCompare() compatible function
4337 ** suitable for comparing serialized records to the unpacked record passed
4338 ** as the only argument.
4339 */
4340 RecordCompare sqlite3VdbeFindCompare(UnpackedRecord *p){
4341   /* varintRecordCompareInt() and varintRecordCompareString() both assume
4342   ** that the size-of-header varint that occurs at the start of each record
4343   ** fits in a single byte (i.e. is 127 or less). varintRecordCompareInt()
4344   ** also assumes that it is safe to overread a buffer by at least the
4345   ** maximum possible legal header size plus 8 bytes. Because there is
4346   ** guaranteed to be at least 74 (but not 136) bytes of padding following each
4347   ** buffer passed to varintRecordCompareInt() this makes it convenient to
4348   ** limit the size of the header to 64 bytes in cases where the first field
4349   ** is an integer.
4350   **
4351   ** The easiest way to enforce this limit is to consider only records with
4352   ** 13 fields or less. If the first field is an integer, the maximum legal
4353   ** header size is (12*5 + 1 + 1) bytes.  */
4354   if( (p->pKeyInfo->nField + p->pKeyInfo->nXField)<=13 ){
4355     int flags = p->aMem[0].flags;
4356     if( p->pKeyInfo->aSortOrder[0] ){
4357       p->r1 = 1;
4358       p->r2 = -1;
4359     }else{
4360       p->r1 = -1;
4361       p->r2 = 1;
4362     }
4363     if( (flags & MEM_Int) ){
4364       return vdbeRecordCompareInt;
4365     }
4366     testcase( flags & MEM_Real );
4367     testcase( flags & MEM_Null );
4368     testcase( flags & MEM_Blob );
4369     if( (flags & (MEM_Real|MEM_Null|MEM_Blob))==0 && p->pKeyInfo->aColl[0]==0 ){
4370       assert( flags & MEM_Str );
4371       return vdbeRecordCompareString;
4372     }
4373   }
4374 
4375   return sqlite3VdbeRecordCompare;
4376 }
4377 
4378 /*
4379 ** pCur points at an index entry created using the OP_MakeRecord opcode.
4380 ** Read the rowid (the last field in the record) and store it in *rowid.
4381 ** Return SQLITE_OK if everything works, or an error code otherwise.
4382 **
4383 ** pCur might be pointing to text obtained from a corrupt database file.
4384 ** So the content cannot be trusted.  Do appropriate checks on the content.
4385 */
4386 int sqlite3VdbeIdxRowid(sqlite3 *db, BtCursor *pCur, i64 *rowid){
4387   i64 nCellKey = 0;
4388   int rc;
4389   u32 szHdr;        /* Size of the header */
4390   u32 typeRowid;    /* Serial type of the rowid */
4391   u32 lenRowid;     /* Size of the rowid */
4392   Mem m, v;
4393 
4394   /* Get the size of the index entry.  Only indices entries of less
4395   ** than 2GiB are support - anything large must be database corruption.
4396   ** Any corruption is detected in sqlite3BtreeParseCellPtr(), though, so
4397   ** this code can safely assume that nCellKey is 32-bits
4398   */
4399   assert( sqlite3BtreeCursorIsValid(pCur) );
4400   nCellKey = sqlite3BtreePayloadSize(pCur);
4401   assert( (nCellKey & SQLITE_MAX_U32)==(u64)nCellKey );
4402 
4403   /* Read in the complete content of the index entry */
4404   sqlite3VdbeMemInit(&m, db, 0);
4405   rc = sqlite3VdbeMemFromBtree(pCur, 0, (u32)nCellKey, &m);
4406   if( rc ){
4407     return rc;
4408   }
4409 
4410   /* The index entry must begin with a header size */
4411   (void)getVarint32((u8*)m.z, szHdr);
4412   testcase( szHdr==3 );
4413   testcase( szHdr==m.n );
4414   if( unlikely(szHdr<3 || (int)szHdr>m.n) ){
4415     goto idx_rowid_corruption;
4416   }
4417 
4418   /* The last field of the index should be an integer - the ROWID.
4419   ** Verify that the last entry really is an integer. */
4420   (void)getVarint32((u8*)&m.z[szHdr-1], typeRowid);
4421   testcase( typeRowid==1 );
4422   testcase( typeRowid==2 );
4423   testcase( typeRowid==3 );
4424   testcase( typeRowid==4 );
4425   testcase( typeRowid==5 );
4426   testcase( typeRowid==6 );
4427   testcase( typeRowid==8 );
4428   testcase( typeRowid==9 );
4429   if( unlikely(typeRowid<1 || typeRowid>9 || typeRowid==7) ){
4430     goto idx_rowid_corruption;
4431   }
4432   lenRowid = sqlite3SmallTypeSizes[typeRowid];
4433   testcase( (u32)m.n==szHdr+lenRowid );
4434   if( unlikely((u32)m.n<szHdr+lenRowid) ){
4435     goto idx_rowid_corruption;
4436   }
4437 
4438   /* Fetch the integer off the end of the index record */
4439   sqlite3VdbeSerialGet((u8*)&m.z[m.n-lenRowid], typeRowid, &v);
4440   *rowid = v.u.i;
4441   sqlite3VdbeMemRelease(&m);
4442   return SQLITE_OK;
4443 
4444   /* Jump here if database corruption is detected after m has been
4445   ** allocated.  Free the m object and return SQLITE_CORRUPT. */
4446 idx_rowid_corruption:
4447   testcase( m.szMalloc!=0 );
4448   sqlite3VdbeMemRelease(&m);
4449   return SQLITE_CORRUPT_BKPT;
4450 }
4451 
4452 /*
4453 ** Compare the key of the index entry that cursor pC is pointing to against
4454 ** the key string in pUnpacked.  Write into *pRes a number
4455 ** that is negative, zero, or positive if pC is less than, equal to,
4456 ** or greater than pUnpacked.  Return SQLITE_OK on success.
4457 **
4458 ** pUnpacked is either created without a rowid or is truncated so that it
4459 ** omits the rowid at the end.  The rowid at the end of the index entry
4460 ** is ignored as well.  Hence, this routine only compares the prefixes
4461 ** of the keys prior to the final rowid, not the entire key.
4462 */
4463 int sqlite3VdbeIdxKeyCompare(
4464   sqlite3 *db,                     /* Database connection */
4465   VdbeCursor *pC,                  /* The cursor to compare against */
4466   UnpackedRecord *pUnpacked,       /* Unpacked version of key */
4467   int *res                         /* Write the comparison result here */
4468 ){
4469   i64 nCellKey = 0;
4470   int rc;
4471   BtCursor *pCur;
4472   Mem m;
4473 
4474   assert( pC->eCurType==CURTYPE_BTREE );
4475   pCur = pC->uc.pCursor;
4476   assert( sqlite3BtreeCursorIsValid(pCur) );
4477   nCellKey = sqlite3BtreePayloadSize(pCur);
4478   /* nCellKey will always be between 0 and 0xffffffff because of the way
4479   ** that btreeParseCellPtr() and sqlite3GetVarint32() are implemented */
4480   if( nCellKey<=0 || nCellKey>0x7fffffff ){
4481     *res = 0;
4482     return SQLITE_CORRUPT_BKPT;
4483   }
4484   sqlite3VdbeMemInit(&m, db, 0);
4485   rc = sqlite3VdbeMemFromBtree(pCur, 0, (u32)nCellKey, &m);
4486   if( rc ){
4487     return rc;
4488   }
4489   *res = sqlite3VdbeRecordCompare(m.n, m.z, pUnpacked);
4490   sqlite3VdbeMemRelease(&m);
4491   return SQLITE_OK;
4492 }
4493 
4494 /*
4495 ** This routine sets the value to be returned by subsequent calls to
4496 ** sqlite3_changes() on the database handle 'db'.
4497 */
4498 void sqlite3VdbeSetChanges(sqlite3 *db, int nChange){
4499   assert( sqlite3_mutex_held(db->mutex) );
4500   db->nChange = nChange;
4501   db->nTotalChange += nChange;
4502 }
4503 
4504 /*
4505 ** Set a flag in the vdbe to update the change counter when it is finalised
4506 ** or reset.
4507 */
4508 void sqlite3VdbeCountChanges(Vdbe *v){
4509   v->changeCntOn = 1;
4510 }
4511 
4512 /*
4513 ** Mark every prepared statement associated with a database connection
4514 ** as expired.
4515 **
4516 ** An expired statement means that recompilation of the statement is
4517 ** recommend.  Statements expire when things happen that make their
4518 ** programs obsolete.  Removing user-defined functions or collating
4519 ** sequences, or changing an authorization function are the types of
4520 ** things that make prepared statements obsolete.
4521 */
4522 void sqlite3ExpirePreparedStatements(sqlite3 *db){
4523   Vdbe *p;
4524   for(p = db->pVdbe; p; p=p->pNext){
4525     p->expired = 1;
4526   }
4527 }
4528 
4529 /*
4530 ** Return the database associated with the Vdbe.
4531 */
4532 sqlite3 *sqlite3VdbeDb(Vdbe *v){
4533   return v->db;
4534 }
4535 
4536 /*
4537 ** Return a pointer to an sqlite3_value structure containing the value bound
4538 ** parameter iVar of VM v. Except, if the value is an SQL NULL, return
4539 ** 0 instead. Unless it is NULL, apply affinity aff (one of the SQLITE_AFF_*
4540 ** constants) to the value before returning it.
4541 **
4542 ** The returned value must be freed by the caller using sqlite3ValueFree().
4543 */
4544 sqlite3_value *sqlite3VdbeGetBoundValue(Vdbe *v, int iVar, u8 aff){
4545   assert( iVar>0 );
4546   if( v ){
4547     Mem *pMem = &v->aVar[iVar-1];
4548     assert( (v->db->flags & SQLITE_EnableQPSG)==0 );
4549     if( 0==(pMem->flags & MEM_Null) ){
4550       sqlite3_value *pRet = sqlite3ValueNew(v->db);
4551       if( pRet ){
4552         sqlite3VdbeMemCopy((Mem *)pRet, pMem);
4553         sqlite3ValueApplyAffinity(pRet, aff, SQLITE_UTF8);
4554       }
4555       return pRet;
4556     }
4557   }
4558   return 0;
4559 }
4560 
4561 /*
4562 ** Configure SQL variable iVar so that binding a new value to it signals
4563 ** to sqlite3_reoptimize() that re-preparing the statement may result
4564 ** in a better query plan.
4565 */
4566 void sqlite3VdbeSetVarmask(Vdbe *v, int iVar){
4567   assert( iVar>0 );
4568   assert( (v->db->flags & SQLITE_EnableQPSG)==0 );
4569   if( iVar>=32 ){
4570     v->expmask |= 0x80000000;
4571   }else{
4572     v->expmask |= ((u32)1 << (iVar-1));
4573   }
4574 }
4575 
4576 #ifndef SQLITE_OMIT_VIRTUALTABLE
4577 /*
4578 ** Transfer error message text from an sqlite3_vtab.zErrMsg (text stored
4579 ** in memory obtained from sqlite3_malloc) into a Vdbe.zErrMsg (text stored
4580 ** in memory obtained from sqlite3DbMalloc).
4581 */
4582 void sqlite3VtabImportErrmsg(Vdbe *p, sqlite3_vtab *pVtab){
4583   if( pVtab->zErrMsg ){
4584     sqlite3 *db = p->db;
4585     sqlite3DbFree(db, p->zErrMsg);
4586     p->zErrMsg = sqlite3DbStrDup(db, pVtab->zErrMsg);
4587     sqlite3_free(pVtab->zErrMsg);
4588     pVtab->zErrMsg = 0;
4589   }
4590 }
4591 #endif /* SQLITE_OMIT_VIRTUALTABLE */
4592 
4593 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
4594 
4595 /*
4596 ** If the second argument is not NULL, release any allocations associated
4597 ** with the memory cells in the p->aMem[] array. Also free the UnpackedRecord
4598 ** structure itself, using sqlite3DbFree().
4599 **
4600 ** This function is used to free UnpackedRecord structures allocated by
4601 ** the vdbeUnpackRecord() function found in vdbeapi.c.
4602 */
4603 static void vdbeFreeUnpacked(sqlite3 *db, int nField, UnpackedRecord *p){
4604   if( p ){
4605     int i;
4606     for(i=0; i<nField; i++){
4607       Mem *pMem = &p->aMem[i];
4608       if( pMem->zMalloc ) sqlite3VdbeMemRelease(pMem);
4609     }
4610     sqlite3DbFreeNN(db, p);
4611   }
4612 }
4613 #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
4614 
4615 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
4616 /*
4617 ** Invoke the pre-update hook. If this is an UPDATE or DELETE pre-update call,
4618 ** then cursor passed as the second argument should point to the row about
4619 ** to be update or deleted. If the application calls sqlite3_preupdate_old(),
4620 ** the required value will be read from the row the cursor points to.
4621 */
4622 void sqlite3VdbePreUpdateHook(
4623   Vdbe *v,                        /* Vdbe pre-update hook is invoked by */
4624   VdbeCursor *pCsr,               /* Cursor to grab old.* values from */
4625   int op,                         /* SQLITE_INSERT, UPDATE or DELETE */
4626   const char *zDb,                /* Database name */
4627   Table *pTab,                    /* Modified table */
4628   i64 iKey1,                      /* Initial key value */
4629   int iReg                        /* Register for new.* record */
4630 ){
4631   sqlite3 *db = v->db;
4632   i64 iKey2;
4633   PreUpdate preupdate;
4634   const char *zTbl = pTab->zName;
4635   static const u8 fakeSortOrder = 0;
4636 
4637   assert( db->pPreUpdate==0 );
4638   memset(&preupdate, 0, sizeof(PreUpdate));
4639   if( HasRowid(pTab)==0 ){
4640     iKey1 = iKey2 = 0;
4641     preupdate.pPk = sqlite3PrimaryKeyIndex(pTab);
4642   }else{
4643     if( op==SQLITE_UPDATE ){
4644       iKey2 = v->aMem[iReg].u.i;
4645     }else{
4646       iKey2 = iKey1;
4647     }
4648   }
4649 
4650   assert( pCsr->nField==pTab->nCol
4651        || (pCsr->nField==pTab->nCol+1 && op==SQLITE_DELETE && iReg==-1)
4652   );
4653 
4654   preupdate.v = v;
4655   preupdate.pCsr = pCsr;
4656   preupdate.op = op;
4657   preupdate.iNewReg = iReg;
4658   preupdate.keyinfo.db = db;
4659   preupdate.keyinfo.enc = ENC(db);
4660   preupdate.keyinfo.nField = pTab->nCol;
4661   preupdate.keyinfo.aSortOrder = (u8*)&fakeSortOrder;
4662   preupdate.iKey1 = iKey1;
4663   preupdate.iKey2 = iKey2;
4664   preupdate.pTab = pTab;
4665 
4666   db->pPreUpdate = &preupdate;
4667   db->xPreUpdateCallback(db->pPreUpdateArg, db, op, zDb, zTbl, iKey1, iKey2);
4668   db->pPreUpdate = 0;
4669   sqlite3DbFree(db, preupdate.aRecord);
4670   vdbeFreeUnpacked(db, preupdate.keyinfo.nField+1, preupdate.pUnpacked);
4671   vdbeFreeUnpacked(db, preupdate.keyinfo.nField+1, preupdate.pNewUnpacked);
4672   if( preupdate.aNew ){
4673     int i;
4674     for(i=0; i<pCsr->nField; i++){
4675       sqlite3VdbeMemRelease(&preupdate.aNew[i]);
4676     }
4677     sqlite3DbFreeNN(db, preupdate.aNew);
4678   }
4679 }
4680 #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
4681