xref: /sqlite-3.40.0/src/vdbeaux.c (revision 4e8ad3bc)
1 /*
2 ** 2003 September 6
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 ** This file contains code used for creating, destroying, and populating
13 ** a VDBE (or an "sqlite3_stmt" as it is known to the outside world.)
14 */
15 #include "sqliteInt.h"
16 #include "vdbeInt.h"
17 
18 /*
19 ** Create a new virtual database engine.
20 */
21 Vdbe *sqlite3VdbeCreate(Parse *pParse){
22   sqlite3 *db = pParse->db;
23   Vdbe *p;
24   p = sqlite3DbMallocRawNN(db, sizeof(Vdbe) );
25   if( p==0 ) return 0;
26   memset(&p->aOp, 0, sizeof(Vdbe)-offsetof(Vdbe,aOp));
27   p->db = db;
28   if( db->pVdbe ){
29     db->pVdbe->pPrev = p;
30   }
31   p->pNext = db->pVdbe;
32   p->pPrev = 0;
33   db->pVdbe = p;
34   p->magic = VDBE_MAGIC_INIT;
35   p->pParse = pParse;
36   pParse->pVdbe = p;
37   assert( pParse->aLabel==0 );
38   assert( pParse->nLabel==0 );
39   assert( pParse->nOpAlloc==0 );
40   assert( pParse->szOpAlloc==0 );
41   sqlite3VdbeAddOp2(p, OP_Init, 0, 1);
42   return p;
43 }
44 
45 /*
46 ** Change the error string stored in Vdbe.zErrMsg
47 */
48 void sqlite3VdbeError(Vdbe *p, const char *zFormat, ...){
49   va_list ap;
50   sqlite3DbFree(p->db, p->zErrMsg);
51   va_start(ap, zFormat);
52   p->zErrMsg = sqlite3VMPrintf(p->db, zFormat, ap);
53   va_end(ap);
54 }
55 
56 /*
57 ** Remember the SQL string for a prepared statement.
58 */
59 void sqlite3VdbeSetSql(Vdbe *p, const char *z, int n, u8 prepFlags){
60   if( p==0 ) return;
61   p->prepFlags = prepFlags;
62   if( (prepFlags & SQLITE_PREPARE_SAVESQL)==0 ){
63     p->expmask = 0;
64   }
65   assert( p->zSql==0 );
66   p->zSql = sqlite3DbStrNDup(p->db, z, n);
67 }
68 
69 /*
70 ** Swap all content between two VDBE structures.
71 */
72 void sqlite3VdbeSwap(Vdbe *pA, Vdbe *pB){
73   Vdbe tmp, *pTmp;
74   char *zTmp;
75   assert( pA->db==pB->db );
76   tmp = *pA;
77   *pA = *pB;
78   *pB = tmp;
79   pTmp = pA->pNext;
80   pA->pNext = pB->pNext;
81   pB->pNext = pTmp;
82   pTmp = pA->pPrev;
83   pA->pPrev = pB->pPrev;
84   pB->pPrev = pTmp;
85   zTmp = pA->zSql;
86   pA->zSql = pB->zSql;
87   pB->zSql = zTmp;
88   pB->expmask = pA->expmask;
89   pB->prepFlags = pA->prepFlags;
90   memcpy(pB->aCounter, pA->aCounter, sizeof(pB->aCounter));
91   pB->aCounter[SQLITE_STMTSTATUS_REPREPARE]++;
92 }
93 
94 /*
95 ** Resize the Vdbe.aOp array so that it is at least nOp elements larger
96 ** than its current size. nOp is guaranteed to be less than or equal
97 ** to 1024/sizeof(Op).
98 **
99 ** If an out-of-memory error occurs while resizing the array, return
100 ** SQLITE_NOMEM. In this case Vdbe.aOp and Parse.nOpAlloc remain
101 ** unchanged (this is so that any opcodes already allocated can be
102 ** correctly deallocated along with the rest of the Vdbe).
103 */
104 static int growOpArray(Vdbe *v, int nOp){
105   VdbeOp *pNew;
106   Parse *p = v->pParse;
107 
108   /* The SQLITE_TEST_REALLOC_STRESS compile-time option is designed to force
109   ** more frequent reallocs and hence provide more opportunities for
110   ** simulated OOM faults.  SQLITE_TEST_REALLOC_STRESS is generally used
111   ** during testing only.  With SQLITE_TEST_REALLOC_STRESS grow the op array
112   ** by the minimum* amount required until the size reaches 512.  Normal
113   ** operation (without SQLITE_TEST_REALLOC_STRESS) is to double the current
114   ** size of the op array or add 1KB of space, whichever is smaller. */
115 #ifdef SQLITE_TEST_REALLOC_STRESS
116   int nNew = (p->nOpAlloc>=512 ? p->nOpAlloc*2 : p->nOpAlloc+nOp);
117 #else
118   int nNew = (p->nOpAlloc ? p->nOpAlloc*2 : (int)(1024/sizeof(Op)));
119   UNUSED_PARAMETER(nOp);
120 #endif
121 
122   /* Ensure that the size of a VDBE does not grow too large */
123   if( nNew > p->db->aLimit[SQLITE_LIMIT_VDBE_OP] ){
124     sqlite3OomFault(p->db);
125     return SQLITE_NOMEM;
126   }
127 
128   assert( nOp<=(1024/sizeof(Op)) );
129   assert( nNew>=(p->nOpAlloc+nOp) );
130   pNew = sqlite3DbRealloc(p->db, v->aOp, nNew*sizeof(Op));
131   if( pNew ){
132     p->szOpAlloc = sqlite3DbMallocSize(p->db, pNew);
133     p->nOpAlloc = p->szOpAlloc/sizeof(Op);
134     v->aOp = pNew;
135   }
136   return (pNew ? SQLITE_OK : SQLITE_NOMEM_BKPT);
137 }
138 
139 #ifdef SQLITE_DEBUG
140 /* This routine is just a convenient place to set a breakpoint that will
141 ** fire after each opcode is inserted and displayed using
142 ** "PRAGMA vdbe_addoptrace=on".
143 */
144 static void test_addop_breakpoint(void){
145   static int n = 0;
146   n++;
147 }
148 #endif
149 
150 /*
151 ** Add a new instruction to the list of instructions current in the
152 ** VDBE.  Return the address of the new instruction.
153 **
154 ** Parameters:
155 **
156 **    p               Pointer to the VDBE
157 **
158 **    op              The opcode for this instruction
159 **
160 **    p1, p2, p3      Operands
161 **
162 ** Use the sqlite3VdbeResolveLabel() function to fix an address and
163 ** the sqlite3VdbeChangeP4() function to change the value of the P4
164 ** operand.
165 */
166 static SQLITE_NOINLINE int growOp3(Vdbe *p, int op, int p1, int p2, int p3){
167   assert( p->pParse->nOpAlloc<=p->nOp );
168   if( growOpArray(p, 1) ) return 1;
169   assert( p->pParse->nOpAlloc>p->nOp );
170   return sqlite3VdbeAddOp3(p, op, p1, p2, p3);
171 }
172 int sqlite3VdbeAddOp3(Vdbe *p, int op, int p1, int p2, int p3){
173   int i;
174   VdbeOp *pOp;
175 
176   i = p->nOp;
177   assert( p->magic==VDBE_MAGIC_INIT );
178   assert( op>=0 && op<0xff );
179   if( p->pParse->nOpAlloc<=i ){
180     return growOp3(p, op, p1, p2, p3);
181   }
182   p->nOp++;
183   pOp = &p->aOp[i];
184   pOp->opcode = (u8)op;
185   pOp->p5 = 0;
186   pOp->p1 = p1;
187   pOp->p2 = p2;
188   pOp->p3 = p3;
189   pOp->p4.p = 0;
190   pOp->p4type = P4_NOTUSED;
191 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
192   pOp->zComment = 0;
193 #endif
194 #ifdef SQLITE_DEBUG
195   if( p->db->flags & SQLITE_VdbeAddopTrace ){
196     int jj, kk;
197     Parse *pParse = p->pParse;
198     for(jj=kk=0; jj<pParse->nColCache; jj++){
199       struct yColCache *x = pParse->aColCache + jj;
200       printf(" r[%d]={%d:%d}", x->iReg, x->iTable, x->iColumn);
201       kk++;
202     }
203     if( kk ) printf("\n");
204     sqlite3VdbePrintOp(0, i, &p->aOp[i]);
205     test_addop_breakpoint();
206   }
207 #endif
208 #ifdef VDBE_PROFILE
209   pOp->cycles = 0;
210   pOp->cnt = 0;
211 #endif
212 #ifdef SQLITE_VDBE_COVERAGE
213   pOp->iSrcLine = 0;
214 #endif
215   return i;
216 }
217 int sqlite3VdbeAddOp0(Vdbe *p, int op){
218   return sqlite3VdbeAddOp3(p, op, 0, 0, 0);
219 }
220 int sqlite3VdbeAddOp1(Vdbe *p, int op, int p1){
221   return sqlite3VdbeAddOp3(p, op, p1, 0, 0);
222 }
223 int sqlite3VdbeAddOp2(Vdbe *p, int op, int p1, int p2){
224   return sqlite3VdbeAddOp3(p, op, p1, p2, 0);
225 }
226 
227 /* Generate code for an unconditional jump to instruction iDest
228 */
229 int sqlite3VdbeGoto(Vdbe *p, int iDest){
230   return sqlite3VdbeAddOp3(p, OP_Goto, 0, iDest, 0);
231 }
232 
233 /* Generate code to cause the string zStr to be loaded into
234 ** register iDest
235 */
236 int sqlite3VdbeLoadString(Vdbe *p, int iDest, const char *zStr){
237   return sqlite3VdbeAddOp4(p, OP_String8, 0, iDest, 0, zStr, 0);
238 }
239 
240 /*
241 ** Generate code that initializes multiple registers to string or integer
242 ** constants.  The registers begin with iDest and increase consecutively.
243 ** One register is initialized for each characgter in zTypes[].  For each
244 ** "s" character in zTypes[], the register is a string if the argument is
245 ** not NULL, or OP_Null if the value is a null pointer.  For each "i" character
246 ** in zTypes[], the register is initialized to an integer.
247 **
248 ** If the input string does not end with "X" then an OP_ResultRow instruction
249 ** is generated for the values inserted.
250 */
251 void sqlite3VdbeMultiLoad(Vdbe *p, int iDest, const char *zTypes, ...){
252   va_list ap;
253   int i;
254   char c;
255   va_start(ap, zTypes);
256   for(i=0; (c = zTypes[i])!=0; i++){
257     if( c=='s' ){
258       const char *z = va_arg(ap, const char*);
259       sqlite3VdbeAddOp4(p, z==0 ? OP_Null : OP_String8, 0, iDest+i, 0, z, 0);
260     }else if( c=='i' ){
261       sqlite3VdbeAddOp2(p, OP_Integer, va_arg(ap, int), iDest+i);
262     }else{
263       goto skip_op_resultrow;
264     }
265   }
266   sqlite3VdbeAddOp2(p, OP_ResultRow, iDest, i);
267 skip_op_resultrow:
268   va_end(ap);
269 }
270 
271 /*
272 ** Add an opcode that includes the p4 value as a pointer.
273 */
274 int sqlite3VdbeAddOp4(
275   Vdbe *p,            /* Add the opcode to this VM */
276   int op,             /* The new opcode */
277   int p1,             /* The P1 operand */
278   int p2,             /* The P2 operand */
279   int p3,             /* The P3 operand */
280   const char *zP4,    /* The P4 operand */
281   int p4type          /* P4 operand type */
282 ){
283   int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
284   sqlite3VdbeChangeP4(p, addr, zP4, p4type);
285   return addr;
286 }
287 
288 /*
289 ** Add an opcode that includes the p4 value with a P4_INT64 or
290 ** P4_REAL type.
291 */
292 int sqlite3VdbeAddOp4Dup8(
293   Vdbe *p,            /* Add the opcode to this VM */
294   int op,             /* The new opcode */
295   int p1,             /* The P1 operand */
296   int p2,             /* The P2 operand */
297   int p3,             /* The P3 operand */
298   const u8 *zP4,      /* The P4 operand */
299   int p4type          /* P4 operand type */
300 ){
301   char *p4copy = sqlite3DbMallocRawNN(sqlite3VdbeDb(p), 8);
302   if( p4copy ) memcpy(p4copy, zP4, 8);
303   return sqlite3VdbeAddOp4(p, op, p1, p2, p3, p4copy, p4type);
304 }
305 
306 /*
307 ** Add an OP_ParseSchema opcode.  This routine is broken out from
308 ** sqlite3VdbeAddOp4() since it needs to also needs to mark all btrees
309 ** as having been used.
310 **
311 ** The zWhere string must have been obtained from sqlite3_malloc().
312 ** This routine will take ownership of the allocated memory.
313 */
314 void sqlite3VdbeAddParseSchemaOp(Vdbe *p, int iDb, char *zWhere){
315   int j;
316   sqlite3VdbeAddOp4(p, OP_ParseSchema, iDb, 0, 0, zWhere, P4_DYNAMIC);
317   for(j=0; j<p->db->nDb; j++) sqlite3VdbeUsesBtree(p, j);
318 }
319 
320 /*
321 ** Add an opcode that includes the p4 value as an integer.
322 */
323 int sqlite3VdbeAddOp4Int(
324   Vdbe *p,            /* Add the opcode to this VM */
325   int op,             /* The new opcode */
326   int p1,             /* The P1 operand */
327   int p2,             /* The P2 operand */
328   int p3,             /* The P3 operand */
329   int p4              /* The P4 operand as an integer */
330 ){
331   int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
332   if( p->db->mallocFailed==0 ){
333     VdbeOp *pOp = &p->aOp[addr];
334     pOp->p4type = P4_INT32;
335     pOp->p4.i = p4;
336   }
337   return addr;
338 }
339 
340 /* Insert the end of a co-routine
341 */
342 void sqlite3VdbeEndCoroutine(Vdbe *v, int regYield){
343   sqlite3VdbeAddOp1(v, OP_EndCoroutine, regYield);
344 
345   /* Clear the temporary register cache, thereby ensuring that each
346   ** co-routine has its own independent set of registers, because co-routines
347   ** might expect their registers to be preserved across an OP_Yield, and
348   ** that could cause problems if two or more co-routines are using the same
349   ** temporary register.
350   */
351   v->pParse->nTempReg = 0;
352   v->pParse->nRangeReg = 0;
353 }
354 
355 /*
356 ** Create a new symbolic label for an instruction that has yet to be
357 ** coded.  The symbolic label is really just a negative number.  The
358 ** label can be used as the P2 value of an operation.  Later, when
359 ** the label is resolved to a specific address, the VDBE will scan
360 ** through its operation list and change all values of P2 which match
361 ** the label into the resolved address.
362 **
363 ** The VDBE knows that a P2 value is a label because labels are
364 ** always negative and P2 values are suppose to be non-negative.
365 ** Hence, a negative P2 value is a label that has yet to be resolved.
366 **
367 ** Zero is returned if a malloc() fails.
368 */
369 int sqlite3VdbeMakeLabel(Vdbe *v){
370   Parse *p = v->pParse;
371   int i = p->nLabel++;
372   assert( v->magic==VDBE_MAGIC_INIT );
373   if( (i & (i-1))==0 ){
374     p->aLabel = sqlite3DbReallocOrFree(p->db, p->aLabel,
375                                        (i*2+1)*sizeof(p->aLabel[0]));
376   }
377   if( p->aLabel ){
378     p->aLabel[i] = -1;
379   }
380   return ADDR(i);
381 }
382 
383 /*
384 ** Resolve label "x" to be the address of the next instruction to
385 ** be inserted.  The parameter "x" must have been obtained from
386 ** a prior call to sqlite3VdbeMakeLabel().
387 */
388 void sqlite3VdbeResolveLabel(Vdbe *v, int x){
389   Parse *p = v->pParse;
390   int j = ADDR(x);
391   assert( v->magic==VDBE_MAGIC_INIT );
392   assert( j<p->nLabel );
393   assert( j>=0 );
394   if( p->aLabel ){
395     p->aLabel[j] = v->nOp;
396   }
397 }
398 
399 /*
400 ** Mark the VDBE as one that can only be run one time.
401 */
402 void sqlite3VdbeRunOnlyOnce(Vdbe *p){
403   p->runOnlyOnce = 1;
404 }
405 
406 /*
407 ** Mark the VDBE as one that can only be run multiple times.
408 */
409 void sqlite3VdbeReusable(Vdbe *p){
410   p->runOnlyOnce = 0;
411 }
412 
413 #ifdef SQLITE_DEBUG /* sqlite3AssertMayAbort() logic */
414 
415 /*
416 ** The following type and function are used to iterate through all opcodes
417 ** in a Vdbe main program and each of the sub-programs (triggers) it may
418 ** invoke directly or indirectly. It should be used as follows:
419 **
420 **   Op *pOp;
421 **   VdbeOpIter sIter;
422 **
423 **   memset(&sIter, 0, sizeof(sIter));
424 **   sIter.v = v;                            // v is of type Vdbe*
425 **   while( (pOp = opIterNext(&sIter)) ){
426 **     // Do something with pOp
427 **   }
428 **   sqlite3DbFree(v->db, sIter.apSub);
429 **
430 */
431 typedef struct VdbeOpIter VdbeOpIter;
432 struct VdbeOpIter {
433   Vdbe *v;                   /* Vdbe to iterate through the opcodes of */
434   SubProgram **apSub;        /* Array of subprograms */
435   int nSub;                  /* Number of entries in apSub */
436   int iAddr;                 /* Address of next instruction to return */
437   int iSub;                  /* 0 = main program, 1 = first sub-program etc. */
438 };
439 static Op *opIterNext(VdbeOpIter *p){
440   Vdbe *v = p->v;
441   Op *pRet = 0;
442   Op *aOp;
443   int nOp;
444 
445   if( p->iSub<=p->nSub ){
446 
447     if( p->iSub==0 ){
448       aOp = v->aOp;
449       nOp = v->nOp;
450     }else{
451       aOp = p->apSub[p->iSub-1]->aOp;
452       nOp = p->apSub[p->iSub-1]->nOp;
453     }
454     assert( p->iAddr<nOp );
455 
456     pRet = &aOp[p->iAddr];
457     p->iAddr++;
458     if( p->iAddr==nOp ){
459       p->iSub++;
460       p->iAddr = 0;
461     }
462 
463     if( pRet->p4type==P4_SUBPROGRAM ){
464       int nByte = (p->nSub+1)*sizeof(SubProgram*);
465       int j;
466       for(j=0; j<p->nSub; j++){
467         if( p->apSub[j]==pRet->p4.pProgram ) break;
468       }
469       if( j==p->nSub ){
470         p->apSub = sqlite3DbReallocOrFree(v->db, p->apSub, nByte);
471         if( !p->apSub ){
472           pRet = 0;
473         }else{
474           p->apSub[p->nSub++] = pRet->p4.pProgram;
475         }
476       }
477     }
478   }
479 
480   return pRet;
481 }
482 
483 /*
484 ** Check if the program stored in the VM associated with pParse may
485 ** throw an ABORT exception (causing the statement, but not entire transaction
486 ** to be rolled back). This condition is true if the main program or any
487 ** sub-programs contains any of the following:
488 **
489 **   *  OP_Halt with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
490 **   *  OP_HaltIfNull with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
491 **   *  OP_Destroy
492 **   *  OP_VUpdate
493 **   *  OP_VRename
494 **   *  OP_FkCounter with P2==0 (immediate foreign key constraint)
495 **   *  OP_CreateBtree/BTREE_INTKEY and OP_InitCoroutine
496 **      (for CREATE TABLE AS SELECT ...)
497 **
498 ** Then check that the value of Parse.mayAbort is true if an
499 ** ABORT may be thrown, or false otherwise. Return true if it does
500 ** match, or false otherwise. This function is intended to be used as
501 ** part of an assert statement in the compiler. Similar to:
502 **
503 **   assert( sqlite3VdbeAssertMayAbort(pParse->pVdbe, pParse->mayAbort) );
504 */
505 int sqlite3VdbeAssertMayAbort(Vdbe *v, int mayAbort){
506   int hasAbort = 0;
507   int hasFkCounter = 0;
508   int hasCreateTable = 0;
509   int hasInitCoroutine = 0;
510   Op *pOp;
511   VdbeOpIter sIter;
512   memset(&sIter, 0, sizeof(sIter));
513   sIter.v = v;
514 
515   while( (pOp = opIterNext(&sIter))!=0 ){
516     int opcode = pOp->opcode;
517     if( opcode==OP_Destroy || opcode==OP_VUpdate || opcode==OP_VRename
518      || ((opcode==OP_Halt || opcode==OP_HaltIfNull)
519       && ((pOp->p1&0xff)==SQLITE_CONSTRAINT && pOp->p2==OE_Abort))
520     ){
521       hasAbort = 1;
522       break;
523     }
524     if( opcode==OP_CreateBtree && pOp->p3==BTREE_INTKEY ) hasCreateTable = 1;
525     if( opcode==OP_InitCoroutine ) hasInitCoroutine = 1;
526 #ifndef SQLITE_OMIT_FOREIGN_KEY
527     if( opcode==OP_FkCounter && pOp->p1==0 && pOp->p2==1 ){
528       hasFkCounter = 1;
529     }
530 #endif
531   }
532   sqlite3DbFree(v->db, sIter.apSub);
533 
534   /* Return true if hasAbort==mayAbort. Or if a malloc failure occurred.
535   ** If malloc failed, then the while() loop above may not have iterated
536   ** through all opcodes and hasAbort may be set incorrectly. Return
537   ** true for this case to prevent the assert() in the callers frame
538   ** from failing.  */
539   return ( v->db->mallocFailed || hasAbort==mayAbort || hasFkCounter
540               || (hasCreateTable && hasInitCoroutine) );
541 }
542 #endif /* SQLITE_DEBUG - the sqlite3AssertMayAbort() function */
543 
544 /*
545 ** This routine is called after all opcodes have been inserted.  It loops
546 ** through all the opcodes and fixes up some details.
547 **
548 ** (1) For each jump instruction with a negative P2 value (a label)
549 **     resolve the P2 value to an actual address.
550 **
551 ** (2) Compute the maximum number of arguments used by any SQL function
552 **     and store that value in *pMaxFuncArgs.
553 **
554 ** (3) Update the Vdbe.readOnly and Vdbe.bIsReader flags to accurately
555 **     indicate what the prepared statement actually does.
556 **
557 ** (4) Initialize the p4.xAdvance pointer on opcodes that use it.
558 **
559 ** (5) Reclaim the memory allocated for storing labels.
560 **
561 ** This routine will only function correctly if the mkopcodeh.tcl generator
562 ** script numbers the opcodes correctly.  Changes to this routine must be
563 ** coordinated with changes to mkopcodeh.tcl.
564 */
565 static void resolveP2Values(Vdbe *p, int *pMaxFuncArgs){
566   int nMaxArgs = *pMaxFuncArgs;
567   Op *pOp;
568   Parse *pParse = p->pParse;
569   int *aLabel = pParse->aLabel;
570   p->readOnly = 1;
571   p->bIsReader = 0;
572   pOp = &p->aOp[p->nOp-1];
573   while(1){
574 
575     /* Only JUMP opcodes and the short list of special opcodes in the switch
576     ** below need to be considered.  The mkopcodeh.tcl generator script groups
577     ** all these opcodes together near the front of the opcode list.  Skip
578     ** any opcode that does not need processing by virtual of the fact that
579     ** it is larger than SQLITE_MX_JUMP_OPCODE, as a performance optimization.
580     */
581     if( pOp->opcode<=SQLITE_MX_JUMP_OPCODE ){
582       /* NOTE: Be sure to update mkopcodeh.tcl when adding or removing
583       ** cases from this switch! */
584       switch( pOp->opcode ){
585         case OP_Transaction: {
586           if( pOp->p2!=0 ) p->readOnly = 0;
587           /* fall thru */
588         }
589         case OP_AutoCommit:
590         case OP_Savepoint: {
591           p->bIsReader = 1;
592           break;
593         }
594 #ifndef SQLITE_OMIT_WAL
595         case OP_Checkpoint:
596 #endif
597         case OP_Vacuum:
598         case OP_JournalMode: {
599           p->readOnly = 0;
600           p->bIsReader = 1;
601           break;
602         }
603         case OP_Next:
604         case OP_NextIfOpen:
605         case OP_SorterNext: {
606           pOp->p4.xAdvance = sqlite3BtreeNext;
607           pOp->p4type = P4_ADVANCE;
608           /* The code generator never codes any of these opcodes as a jump
609           ** to a label.  They are always coded as a jump backwards to a
610           ** known address */
611           assert( pOp->p2>=0 );
612           break;
613         }
614         case OP_Prev:
615         case OP_PrevIfOpen: {
616           pOp->p4.xAdvance = sqlite3BtreePrevious;
617           pOp->p4type = P4_ADVANCE;
618           /* The code generator never codes any of these opcodes as a jump
619           ** to a label.  They are always coded as a jump backwards to a
620           ** known address */
621           assert( pOp->p2>=0 );
622           break;
623         }
624 #ifndef SQLITE_OMIT_VIRTUALTABLE
625         case OP_VUpdate: {
626           if( pOp->p2>nMaxArgs ) nMaxArgs = pOp->p2;
627           break;
628         }
629         case OP_VFilter: {
630           int n;
631           assert( (pOp - p->aOp) >= 3 );
632           assert( pOp[-1].opcode==OP_Integer );
633           n = pOp[-1].p1;
634           if( n>nMaxArgs ) nMaxArgs = n;
635           /* Fall through into the default case */
636         }
637 #endif
638         default: {
639           if( pOp->p2<0 ){
640             /* The mkopcodeh.tcl script has so arranged things that the only
641             ** non-jump opcodes less than SQLITE_MX_JUMP_CODE are guaranteed to
642             ** have non-negative values for P2. */
643             assert( (sqlite3OpcodeProperty[pOp->opcode] & OPFLG_JUMP)!=0 );
644             assert( ADDR(pOp->p2)<pParse->nLabel );
645             pOp->p2 = aLabel[ADDR(pOp->p2)];
646           }
647           break;
648         }
649       }
650       /* The mkopcodeh.tcl script has so arranged things that the only
651       ** non-jump opcodes less than SQLITE_MX_JUMP_CODE are guaranteed to
652       ** have non-negative values for P2. */
653       assert( (sqlite3OpcodeProperty[pOp->opcode]&OPFLG_JUMP)==0 || pOp->p2>=0);
654     }
655     if( pOp==p->aOp ) break;
656     pOp--;
657   }
658   sqlite3DbFree(p->db, pParse->aLabel);
659   pParse->aLabel = 0;
660   pParse->nLabel = 0;
661   *pMaxFuncArgs = nMaxArgs;
662   assert( p->bIsReader!=0 || DbMaskAllZero(p->btreeMask) );
663 }
664 
665 /*
666 ** Return the address of the next instruction to be inserted.
667 */
668 int sqlite3VdbeCurrentAddr(Vdbe *p){
669   assert( p->magic==VDBE_MAGIC_INIT );
670   return p->nOp;
671 }
672 
673 /*
674 ** Verify that at least N opcode slots are available in p without
675 ** having to malloc for more space (except when compiled using
676 ** SQLITE_TEST_REALLOC_STRESS).  This interface is used during testing
677 ** to verify that certain calls to sqlite3VdbeAddOpList() can never
678 ** fail due to a OOM fault and hence that the return value from
679 ** sqlite3VdbeAddOpList() will always be non-NULL.
680 */
681 #if defined(SQLITE_DEBUG) && !defined(SQLITE_TEST_REALLOC_STRESS)
682 void sqlite3VdbeVerifyNoMallocRequired(Vdbe *p, int N){
683   assert( p->nOp + N <= p->pParse->nOpAlloc );
684 }
685 #endif
686 
687 /*
688 ** Verify that the VM passed as the only argument does not contain
689 ** an OP_ResultRow opcode. Fail an assert() if it does. This is used
690 ** by code in pragma.c to ensure that the implementation of certain
691 ** pragmas comports with the flags specified in the mkpragmatab.tcl
692 ** script.
693 */
694 #if defined(SQLITE_DEBUG) && !defined(SQLITE_TEST_REALLOC_STRESS)
695 void sqlite3VdbeVerifyNoResultRow(Vdbe *p){
696   int i;
697   for(i=0; i<p->nOp; i++){
698     assert( p->aOp[i].opcode!=OP_ResultRow );
699   }
700 }
701 #endif
702 
703 /*
704 ** This function returns a pointer to the array of opcodes associated with
705 ** the Vdbe passed as the first argument. It is the callers responsibility
706 ** to arrange for the returned array to be eventually freed using the
707 ** vdbeFreeOpArray() function.
708 **
709 ** Before returning, *pnOp is set to the number of entries in the returned
710 ** array. Also, *pnMaxArg is set to the larger of its current value and
711 ** the number of entries in the Vdbe.apArg[] array required to execute the
712 ** returned program.
713 */
714 VdbeOp *sqlite3VdbeTakeOpArray(Vdbe *p, int *pnOp, int *pnMaxArg){
715   VdbeOp *aOp = p->aOp;
716   assert( aOp && !p->db->mallocFailed );
717 
718   /* Check that sqlite3VdbeUsesBtree() was not called on this VM */
719   assert( DbMaskAllZero(p->btreeMask) );
720 
721   resolveP2Values(p, pnMaxArg);
722   *pnOp = p->nOp;
723   p->aOp = 0;
724   return aOp;
725 }
726 
727 /*
728 ** Add a whole list of operations to the operation stack.  Return a
729 ** pointer to the first operation inserted.
730 **
731 ** Non-zero P2 arguments to jump instructions are automatically adjusted
732 ** so that the jump target is relative to the first operation inserted.
733 */
734 VdbeOp *sqlite3VdbeAddOpList(
735   Vdbe *p,                     /* Add opcodes to the prepared statement */
736   int nOp,                     /* Number of opcodes to add */
737   VdbeOpList const *aOp,       /* The opcodes to be added */
738   int iLineno                  /* Source-file line number of first opcode */
739 ){
740   int i;
741   VdbeOp *pOut, *pFirst;
742   assert( nOp>0 );
743   assert( p->magic==VDBE_MAGIC_INIT );
744   if( p->nOp + nOp > p->pParse->nOpAlloc && growOpArray(p, nOp) ){
745     return 0;
746   }
747   pFirst = pOut = &p->aOp[p->nOp];
748   for(i=0; i<nOp; i++, aOp++, pOut++){
749     pOut->opcode = aOp->opcode;
750     pOut->p1 = aOp->p1;
751     pOut->p2 = aOp->p2;
752     assert( aOp->p2>=0 );
753     if( (sqlite3OpcodeProperty[aOp->opcode] & OPFLG_JUMP)!=0 && aOp->p2>0 ){
754       pOut->p2 += p->nOp;
755     }
756     pOut->p3 = aOp->p3;
757     pOut->p4type = P4_NOTUSED;
758     pOut->p4.p = 0;
759     pOut->p5 = 0;
760 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
761     pOut->zComment = 0;
762 #endif
763 #ifdef SQLITE_VDBE_COVERAGE
764     pOut->iSrcLine = iLineno+i;
765 #else
766     (void)iLineno;
767 #endif
768 #ifdef SQLITE_DEBUG
769     if( p->db->flags & SQLITE_VdbeAddopTrace ){
770       sqlite3VdbePrintOp(0, i+p->nOp, &p->aOp[i+p->nOp]);
771     }
772 #endif
773   }
774   p->nOp += nOp;
775   return pFirst;
776 }
777 
778 #if defined(SQLITE_ENABLE_STMT_SCANSTATUS)
779 /*
780 ** Add an entry to the array of counters managed by sqlite3_stmt_scanstatus().
781 */
782 void sqlite3VdbeScanStatus(
783   Vdbe *p,                        /* VM to add scanstatus() to */
784   int addrExplain,                /* Address of OP_Explain (or 0) */
785   int addrLoop,                   /* Address of loop counter */
786   int addrVisit,                  /* Address of rows visited counter */
787   LogEst nEst,                    /* Estimated number of output rows */
788   const char *zName               /* Name of table or index being scanned */
789 ){
790   int nByte = (p->nScan+1) * sizeof(ScanStatus);
791   ScanStatus *aNew;
792   aNew = (ScanStatus*)sqlite3DbRealloc(p->db, p->aScan, nByte);
793   if( aNew ){
794     ScanStatus *pNew = &aNew[p->nScan++];
795     pNew->addrExplain = addrExplain;
796     pNew->addrLoop = addrLoop;
797     pNew->addrVisit = addrVisit;
798     pNew->nEst = nEst;
799     pNew->zName = sqlite3DbStrDup(p->db, zName);
800     p->aScan = aNew;
801   }
802 }
803 #endif
804 
805 
806 /*
807 ** Change the value of the opcode, or P1, P2, P3, or P5 operands
808 ** for a specific instruction.
809 */
810 void sqlite3VdbeChangeOpcode(Vdbe *p, u32 addr, u8 iNewOpcode){
811   sqlite3VdbeGetOp(p,addr)->opcode = iNewOpcode;
812 }
813 void sqlite3VdbeChangeP1(Vdbe *p, u32 addr, int val){
814   sqlite3VdbeGetOp(p,addr)->p1 = val;
815 }
816 void sqlite3VdbeChangeP2(Vdbe *p, u32 addr, int val){
817   sqlite3VdbeGetOp(p,addr)->p2 = val;
818 }
819 void sqlite3VdbeChangeP3(Vdbe *p, u32 addr, int val){
820   sqlite3VdbeGetOp(p,addr)->p3 = val;
821 }
822 void sqlite3VdbeChangeP5(Vdbe *p, u16 p5){
823   assert( p->nOp>0 || p->db->mallocFailed );
824   if( p->nOp>0 ) p->aOp[p->nOp-1].p5 = p5;
825 }
826 
827 /*
828 ** Change the P2 operand of instruction addr so that it points to
829 ** the address of the next instruction to be coded.
830 */
831 void sqlite3VdbeJumpHere(Vdbe *p, int addr){
832   sqlite3VdbeChangeP2(p, addr, p->nOp);
833 }
834 
835 
836 /*
837 ** If the input FuncDef structure is ephemeral, then free it.  If
838 ** the FuncDef is not ephermal, then do nothing.
839 */
840 static void freeEphemeralFunction(sqlite3 *db, FuncDef *pDef){
841   if( (pDef->funcFlags & SQLITE_FUNC_EPHEM)!=0 ){
842     sqlite3DbFreeNN(db, pDef);
843   }
844 }
845 
846 static void vdbeFreeOpArray(sqlite3 *, Op *, int);
847 
848 /*
849 ** Delete a P4 value if necessary.
850 */
851 static SQLITE_NOINLINE void freeP4Mem(sqlite3 *db, Mem *p){
852   if( p->szMalloc ) sqlite3DbFree(db, p->zMalloc);
853   sqlite3DbFreeNN(db, p);
854 }
855 static SQLITE_NOINLINE void freeP4FuncCtx(sqlite3 *db, sqlite3_context *p){
856   freeEphemeralFunction(db, p->pFunc);
857  sqlite3DbFreeNN(db, p);
858 }
859 static void freeP4(sqlite3 *db, int p4type, void *p4){
860   assert( db );
861   switch( p4type ){
862     case P4_FUNCCTX: {
863       freeP4FuncCtx(db, (sqlite3_context*)p4);
864       break;
865     }
866     case P4_REAL:
867     case P4_INT64:
868     case P4_DYNAMIC:
869     case P4_INTARRAY: {
870       sqlite3DbFree(db, p4);
871       break;
872     }
873     case P4_KEYINFO: {
874       if( db->pnBytesFreed==0 ) sqlite3KeyInfoUnref((KeyInfo*)p4);
875       break;
876     }
877 #ifdef SQLITE_ENABLE_CURSOR_HINTS
878     case P4_EXPR: {
879       sqlite3ExprDelete(db, (Expr*)p4);
880       break;
881     }
882 #endif
883     case P4_FUNCDEF: {
884       freeEphemeralFunction(db, (FuncDef*)p4);
885       break;
886     }
887     case P4_MEM: {
888       if( db->pnBytesFreed==0 ){
889         sqlite3ValueFree((sqlite3_value*)p4);
890       }else{
891         freeP4Mem(db, (Mem*)p4);
892       }
893       break;
894     }
895     case P4_VTAB : {
896       if( db->pnBytesFreed==0 ) sqlite3VtabUnlock((VTable *)p4);
897       break;
898     }
899   }
900 }
901 
902 /*
903 ** Free the space allocated for aOp and any p4 values allocated for the
904 ** opcodes contained within. If aOp is not NULL it is assumed to contain
905 ** nOp entries.
906 */
907 static void vdbeFreeOpArray(sqlite3 *db, Op *aOp, int nOp){
908   if( aOp ){
909     Op *pOp;
910     for(pOp=&aOp[nOp-1]; pOp>=aOp; pOp--){
911       if( pOp->p4type <= P4_FREE_IF_LE ) freeP4(db, pOp->p4type, pOp->p4.p);
912 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
913       sqlite3DbFree(db, pOp->zComment);
914 #endif
915     }
916     sqlite3DbFreeNN(db, aOp);
917   }
918 }
919 
920 /*
921 ** Link the SubProgram object passed as the second argument into the linked
922 ** list at Vdbe.pSubProgram. This list is used to delete all sub-program
923 ** objects when the VM is no longer required.
924 */
925 void sqlite3VdbeLinkSubProgram(Vdbe *pVdbe, SubProgram *p){
926   p->pNext = pVdbe->pProgram;
927   pVdbe->pProgram = p;
928 }
929 
930 /*
931 ** Change the opcode at addr into OP_Noop
932 */
933 int sqlite3VdbeChangeToNoop(Vdbe *p, int addr){
934   VdbeOp *pOp;
935   if( p->db->mallocFailed ) return 0;
936   assert( addr>=0 && addr<p->nOp );
937   pOp = &p->aOp[addr];
938   freeP4(p->db, pOp->p4type, pOp->p4.p);
939   pOp->p4type = P4_NOTUSED;
940   pOp->p4.z = 0;
941   pOp->opcode = OP_Noop;
942   return 1;
943 }
944 
945 /*
946 ** If the last opcode is "op" and it is not a jump destination,
947 ** then remove it.  Return true if and only if an opcode was removed.
948 */
949 int sqlite3VdbeDeletePriorOpcode(Vdbe *p, u8 op){
950   if( p->nOp>0 && p->aOp[p->nOp-1].opcode==op ){
951     return sqlite3VdbeChangeToNoop(p, p->nOp-1);
952   }else{
953     return 0;
954   }
955 }
956 
957 /*
958 ** Change the value of the P4 operand for a specific instruction.
959 ** This routine is useful when a large program is loaded from a
960 ** static array using sqlite3VdbeAddOpList but we want to make a
961 ** few minor changes to the program.
962 **
963 ** If n>=0 then the P4 operand is dynamic, meaning that a copy of
964 ** the string is made into memory obtained from sqlite3_malloc().
965 ** A value of n==0 means copy bytes of zP4 up to and including the
966 ** first null byte.  If n>0 then copy n+1 bytes of zP4.
967 **
968 ** Other values of n (P4_STATIC, P4_COLLSEQ etc.) indicate that zP4 points
969 ** to a string or structure that is guaranteed to exist for the lifetime of
970 ** the Vdbe. In these cases we can just copy the pointer.
971 **
972 ** If addr<0 then change P4 on the most recently inserted instruction.
973 */
974 static void SQLITE_NOINLINE vdbeChangeP4Full(
975   Vdbe *p,
976   Op *pOp,
977   const char *zP4,
978   int n
979 ){
980   if( pOp->p4type ){
981     freeP4(p->db, pOp->p4type, pOp->p4.p);
982     pOp->p4type = 0;
983     pOp->p4.p = 0;
984   }
985   if( n<0 ){
986     sqlite3VdbeChangeP4(p, (int)(pOp - p->aOp), zP4, n);
987   }else{
988     if( n==0 ) n = sqlite3Strlen30(zP4);
989     pOp->p4.z = sqlite3DbStrNDup(p->db, zP4, n);
990     pOp->p4type = P4_DYNAMIC;
991   }
992 }
993 void sqlite3VdbeChangeP4(Vdbe *p, int addr, const char *zP4, int n){
994   Op *pOp;
995   sqlite3 *db;
996   assert( p!=0 );
997   db = p->db;
998   assert( p->magic==VDBE_MAGIC_INIT );
999   assert( p->aOp!=0 || db->mallocFailed );
1000   if( db->mallocFailed ){
1001     if( n!=P4_VTAB ) freeP4(db, n, (void*)*(char**)&zP4);
1002     return;
1003   }
1004   assert( p->nOp>0 );
1005   assert( addr<p->nOp );
1006   if( addr<0 ){
1007     addr = p->nOp - 1;
1008   }
1009   pOp = &p->aOp[addr];
1010   if( n>=0 || pOp->p4type ){
1011     vdbeChangeP4Full(p, pOp, zP4, n);
1012     return;
1013   }
1014   if( n==P4_INT32 ){
1015     /* Note: this cast is safe, because the origin data point was an int
1016     ** that was cast to a (const char *). */
1017     pOp->p4.i = SQLITE_PTR_TO_INT(zP4);
1018     pOp->p4type = P4_INT32;
1019   }else if( zP4!=0 ){
1020     assert( n<0 );
1021     pOp->p4.p = (void*)zP4;
1022     pOp->p4type = (signed char)n;
1023     if( n==P4_VTAB ) sqlite3VtabLock((VTable*)zP4);
1024   }
1025 }
1026 
1027 /*
1028 ** Change the P4 operand of the most recently coded instruction
1029 ** to the value defined by the arguments.  This is a high-speed
1030 ** version of sqlite3VdbeChangeP4().
1031 **
1032 ** The P4 operand must not have been previously defined.  And the new
1033 ** P4 must not be P4_INT32.  Use sqlite3VdbeChangeP4() in either of
1034 ** those cases.
1035 */
1036 void sqlite3VdbeAppendP4(Vdbe *p, void *pP4, int n){
1037   VdbeOp *pOp;
1038   assert( n!=P4_INT32 && n!=P4_VTAB );
1039   assert( n<=0 );
1040   if( p->db->mallocFailed ){
1041     freeP4(p->db, n, pP4);
1042   }else{
1043     assert( pP4!=0 );
1044     assert( p->nOp>0 );
1045     pOp = &p->aOp[p->nOp-1];
1046     assert( pOp->p4type==P4_NOTUSED );
1047     pOp->p4type = n;
1048     pOp->p4.p = pP4;
1049   }
1050 }
1051 
1052 /*
1053 ** Set the P4 on the most recently added opcode to the KeyInfo for the
1054 ** index given.
1055 */
1056 void sqlite3VdbeSetP4KeyInfo(Parse *pParse, Index *pIdx){
1057   Vdbe *v = pParse->pVdbe;
1058   KeyInfo *pKeyInfo;
1059   assert( v!=0 );
1060   assert( pIdx!=0 );
1061   pKeyInfo = sqlite3KeyInfoOfIndex(pParse, pIdx);
1062   if( pKeyInfo ) sqlite3VdbeAppendP4(v, pKeyInfo, P4_KEYINFO);
1063 }
1064 
1065 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1066 /*
1067 ** Change the comment on the most recently coded instruction.  Or
1068 ** insert a No-op and add the comment to that new instruction.  This
1069 ** makes the code easier to read during debugging.  None of this happens
1070 ** in a production build.
1071 */
1072 static void vdbeVComment(Vdbe *p, const char *zFormat, va_list ap){
1073   assert( p->nOp>0 || p->aOp==0 );
1074   assert( p->aOp==0 || p->aOp[p->nOp-1].zComment==0 || p->db->mallocFailed );
1075   if( p->nOp ){
1076     assert( p->aOp );
1077     sqlite3DbFree(p->db, p->aOp[p->nOp-1].zComment);
1078     p->aOp[p->nOp-1].zComment = sqlite3VMPrintf(p->db, zFormat, ap);
1079   }
1080 }
1081 void sqlite3VdbeComment(Vdbe *p, const char *zFormat, ...){
1082   va_list ap;
1083   if( p ){
1084     va_start(ap, zFormat);
1085     vdbeVComment(p, zFormat, ap);
1086     va_end(ap);
1087   }
1088 }
1089 void sqlite3VdbeNoopComment(Vdbe *p, const char *zFormat, ...){
1090   va_list ap;
1091   if( p ){
1092     sqlite3VdbeAddOp0(p, OP_Noop);
1093     va_start(ap, zFormat);
1094     vdbeVComment(p, zFormat, ap);
1095     va_end(ap);
1096   }
1097 }
1098 #endif  /* NDEBUG */
1099 
1100 #ifdef SQLITE_VDBE_COVERAGE
1101 /*
1102 ** Set the value if the iSrcLine field for the previously coded instruction.
1103 */
1104 void sqlite3VdbeSetLineNumber(Vdbe *v, int iLine){
1105   sqlite3VdbeGetOp(v,-1)->iSrcLine = iLine;
1106 }
1107 #endif /* SQLITE_VDBE_COVERAGE */
1108 
1109 /*
1110 ** Return the opcode for a given address.  If the address is -1, then
1111 ** return the most recently inserted opcode.
1112 **
1113 ** If a memory allocation error has occurred prior to the calling of this
1114 ** routine, then a pointer to a dummy VdbeOp will be returned.  That opcode
1115 ** is readable but not writable, though it is cast to a writable value.
1116 ** The return of a dummy opcode allows the call to continue functioning
1117 ** after an OOM fault without having to check to see if the return from
1118 ** this routine is a valid pointer.  But because the dummy.opcode is 0,
1119 ** dummy will never be written to.  This is verified by code inspection and
1120 ** by running with Valgrind.
1121 */
1122 VdbeOp *sqlite3VdbeGetOp(Vdbe *p, int addr){
1123   /* C89 specifies that the constant "dummy" will be initialized to all
1124   ** zeros, which is correct.  MSVC generates a warning, nevertheless. */
1125   static VdbeOp dummy;  /* Ignore the MSVC warning about no initializer */
1126   assert( p->magic==VDBE_MAGIC_INIT );
1127   if( addr<0 ){
1128     addr = p->nOp - 1;
1129   }
1130   assert( (addr>=0 && addr<p->nOp) || p->db->mallocFailed );
1131   if( p->db->mallocFailed ){
1132     return (VdbeOp*)&dummy;
1133   }else{
1134     return &p->aOp[addr];
1135   }
1136 }
1137 
1138 #if defined(SQLITE_ENABLE_EXPLAIN_COMMENTS)
1139 /*
1140 ** Return an integer value for one of the parameters to the opcode pOp
1141 ** determined by character c.
1142 */
1143 static int translateP(char c, const Op *pOp){
1144   if( c=='1' ) return pOp->p1;
1145   if( c=='2' ) return pOp->p2;
1146   if( c=='3' ) return pOp->p3;
1147   if( c=='4' ) return pOp->p4.i;
1148   return pOp->p5;
1149 }
1150 
1151 /*
1152 ** Compute a string for the "comment" field of a VDBE opcode listing.
1153 **
1154 ** The Synopsis: field in comments in the vdbe.c source file gets converted
1155 ** to an extra string that is appended to the sqlite3OpcodeName().  In the
1156 ** absence of other comments, this synopsis becomes the comment on the opcode.
1157 ** Some translation occurs:
1158 **
1159 **       "PX"      ->  "r[X]"
1160 **       "PX@PY"   ->  "r[X..X+Y-1]"  or "r[x]" if y is 0 or 1
1161 **       "PX@PY+1" ->  "r[X..X+Y]"    or "r[x]" if y is 0
1162 **       "PY..PY"  ->  "r[X..Y]"      or "r[x]" if y<=x
1163 */
1164 static int displayComment(
1165   const Op *pOp,     /* The opcode to be commented */
1166   const char *zP4,   /* Previously obtained value for P4 */
1167   char *zTemp,       /* Write result here */
1168   int nTemp          /* Space available in zTemp[] */
1169 ){
1170   const char *zOpName;
1171   const char *zSynopsis;
1172   int nOpName;
1173   int ii, jj;
1174   char zAlt[50];
1175   zOpName = sqlite3OpcodeName(pOp->opcode);
1176   nOpName = sqlite3Strlen30(zOpName);
1177   if( zOpName[nOpName+1] ){
1178     int seenCom = 0;
1179     char c;
1180     zSynopsis = zOpName += nOpName + 1;
1181     if( strncmp(zSynopsis,"IF ",3)==0 ){
1182       if( pOp->p5 & SQLITE_STOREP2 ){
1183         sqlite3_snprintf(sizeof(zAlt), zAlt, "r[P2] = (%s)", zSynopsis+3);
1184       }else{
1185         sqlite3_snprintf(sizeof(zAlt), zAlt, "if %s goto P2", zSynopsis+3);
1186       }
1187       zSynopsis = zAlt;
1188     }
1189     for(ii=jj=0; jj<nTemp-1 && (c = zSynopsis[ii])!=0; ii++){
1190       if( c=='P' ){
1191         c = zSynopsis[++ii];
1192         if( c=='4' ){
1193           sqlite3_snprintf(nTemp-jj, zTemp+jj, "%s", zP4);
1194         }else if( c=='X' ){
1195           sqlite3_snprintf(nTemp-jj, zTemp+jj, "%s", pOp->zComment);
1196           seenCom = 1;
1197         }else{
1198           int v1 = translateP(c, pOp);
1199           int v2;
1200           sqlite3_snprintf(nTemp-jj, zTemp+jj, "%d", v1);
1201           if( strncmp(zSynopsis+ii+1, "@P", 2)==0 ){
1202             ii += 3;
1203             jj += sqlite3Strlen30(zTemp+jj);
1204             v2 = translateP(zSynopsis[ii], pOp);
1205             if( strncmp(zSynopsis+ii+1,"+1",2)==0 ){
1206               ii += 2;
1207               v2++;
1208             }
1209             if( v2>1 ){
1210               sqlite3_snprintf(nTemp-jj, zTemp+jj, "..%d", v1+v2-1);
1211             }
1212           }else if( strncmp(zSynopsis+ii+1, "..P3", 4)==0 && pOp->p3==0 ){
1213             ii += 4;
1214           }
1215         }
1216         jj += sqlite3Strlen30(zTemp+jj);
1217       }else{
1218         zTemp[jj++] = c;
1219       }
1220     }
1221     if( !seenCom && jj<nTemp-5 && pOp->zComment ){
1222       sqlite3_snprintf(nTemp-jj, zTemp+jj, "; %s", pOp->zComment);
1223       jj += sqlite3Strlen30(zTemp+jj);
1224     }
1225     if( jj<nTemp ) zTemp[jj] = 0;
1226   }else if( pOp->zComment ){
1227     sqlite3_snprintf(nTemp, zTemp, "%s", pOp->zComment);
1228     jj = sqlite3Strlen30(zTemp);
1229   }else{
1230     zTemp[0] = 0;
1231     jj = 0;
1232   }
1233   return jj;
1234 }
1235 #endif /* SQLITE_DEBUG */
1236 
1237 #if VDBE_DISPLAY_P4 && defined(SQLITE_ENABLE_CURSOR_HINTS)
1238 /*
1239 ** Translate the P4.pExpr value for an OP_CursorHint opcode into text
1240 ** that can be displayed in the P4 column of EXPLAIN output.
1241 */
1242 static void displayP4Expr(StrAccum *p, Expr *pExpr){
1243   const char *zOp = 0;
1244   switch( pExpr->op ){
1245     case TK_STRING:
1246       sqlite3XPrintf(p, "%Q", pExpr->u.zToken);
1247       break;
1248     case TK_INTEGER:
1249       sqlite3XPrintf(p, "%d", pExpr->u.iValue);
1250       break;
1251     case TK_NULL:
1252       sqlite3XPrintf(p, "NULL");
1253       break;
1254     case TK_REGISTER: {
1255       sqlite3XPrintf(p, "r[%d]", pExpr->iTable);
1256       break;
1257     }
1258     case TK_COLUMN: {
1259       if( pExpr->iColumn<0 ){
1260         sqlite3XPrintf(p, "rowid");
1261       }else{
1262         sqlite3XPrintf(p, "c%d", (int)pExpr->iColumn);
1263       }
1264       break;
1265     }
1266     case TK_LT:      zOp = "LT";      break;
1267     case TK_LE:      zOp = "LE";      break;
1268     case TK_GT:      zOp = "GT";      break;
1269     case TK_GE:      zOp = "GE";      break;
1270     case TK_NE:      zOp = "NE";      break;
1271     case TK_EQ:      zOp = "EQ";      break;
1272     case TK_IS:      zOp = "IS";      break;
1273     case TK_ISNOT:   zOp = "ISNOT";   break;
1274     case TK_AND:     zOp = "AND";     break;
1275     case TK_OR:      zOp = "OR";      break;
1276     case TK_PLUS:    zOp = "ADD";     break;
1277     case TK_STAR:    zOp = "MUL";     break;
1278     case TK_MINUS:   zOp = "SUB";     break;
1279     case TK_REM:     zOp = "REM";     break;
1280     case TK_BITAND:  zOp = "BITAND";  break;
1281     case TK_BITOR:   zOp = "BITOR";   break;
1282     case TK_SLASH:   zOp = "DIV";     break;
1283     case TK_LSHIFT:  zOp = "LSHIFT";  break;
1284     case TK_RSHIFT:  zOp = "RSHIFT";  break;
1285     case TK_CONCAT:  zOp = "CONCAT";  break;
1286     case TK_UMINUS:  zOp = "MINUS";   break;
1287     case TK_UPLUS:   zOp = "PLUS";    break;
1288     case TK_BITNOT:  zOp = "BITNOT";  break;
1289     case TK_NOT:     zOp = "NOT";     break;
1290     case TK_ISNULL:  zOp = "ISNULL";  break;
1291     case TK_NOTNULL: zOp = "NOTNULL"; break;
1292 
1293     default:
1294       sqlite3XPrintf(p, "%s", "expr");
1295       break;
1296   }
1297 
1298   if( zOp ){
1299     sqlite3XPrintf(p, "%s(", zOp);
1300     displayP4Expr(p, pExpr->pLeft);
1301     if( pExpr->pRight ){
1302       sqlite3StrAccumAppend(p, ",", 1);
1303       displayP4Expr(p, pExpr->pRight);
1304     }
1305     sqlite3StrAccumAppend(p, ")", 1);
1306   }
1307 }
1308 #endif /* VDBE_DISPLAY_P4 && defined(SQLITE_ENABLE_CURSOR_HINTS) */
1309 
1310 
1311 #if VDBE_DISPLAY_P4
1312 /*
1313 ** Compute a string that describes the P4 parameter for an opcode.
1314 ** Use zTemp for any required temporary buffer space.
1315 */
1316 static char *displayP4(Op *pOp, char *zTemp, int nTemp){
1317   char *zP4 = zTemp;
1318   StrAccum x;
1319   assert( nTemp>=20 );
1320   sqlite3StrAccumInit(&x, 0, zTemp, nTemp, 0);
1321   switch( pOp->p4type ){
1322     case P4_KEYINFO: {
1323       int j;
1324       KeyInfo *pKeyInfo = pOp->p4.pKeyInfo;
1325       assert( pKeyInfo->aSortOrder!=0 );
1326       sqlite3XPrintf(&x, "k(%d", pKeyInfo->nKeyField);
1327       for(j=0; j<pKeyInfo->nKeyField; j++){
1328         CollSeq *pColl = pKeyInfo->aColl[j];
1329         const char *zColl = pColl ? pColl->zName : "";
1330         if( strcmp(zColl, "BINARY")==0 ) zColl = "B";
1331         sqlite3XPrintf(&x, ",%s%s", pKeyInfo->aSortOrder[j] ? "-" : "", zColl);
1332       }
1333       sqlite3StrAccumAppend(&x, ")", 1);
1334       break;
1335     }
1336 #ifdef SQLITE_ENABLE_CURSOR_HINTS
1337     case P4_EXPR: {
1338       displayP4Expr(&x, pOp->p4.pExpr);
1339       break;
1340     }
1341 #endif
1342     case P4_COLLSEQ: {
1343       CollSeq *pColl = pOp->p4.pColl;
1344       sqlite3XPrintf(&x, "(%.20s)", pColl->zName);
1345       break;
1346     }
1347     case P4_FUNCDEF: {
1348       FuncDef *pDef = pOp->p4.pFunc;
1349       sqlite3XPrintf(&x, "%s(%d)", pDef->zName, pDef->nArg);
1350       break;
1351     }
1352 #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
1353     case P4_FUNCCTX: {
1354       FuncDef *pDef = pOp->p4.pCtx->pFunc;
1355       sqlite3XPrintf(&x, "%s(%d)", pDef->zName, pDef->nArg);
1356       break;
1357     }
1358 #endif
1359     case P4_INT64: {
1360       sqlite3XPrintf(&x, "%lld", *pOp->p4.pI64);
1361       break;
1362     }
1363     case P4_INT32: {
1364       sqlite3XPrintf(&x, "%d", pOp->p4.i);
1365       break;
1366     }
1367     case P4_REAL: {
1368       sqlite3XPrintf(&x, "%.16g", *pOp->p4.pReal);
1369       break;
1370     }
1371     case P4_MEM: {
1372       Mem *pMem = pOp->p4.pMem;
1373       if( pMem->flags & MEM_Str ){
1374         zP4 = pMem->z;
1375       }else if( pMem->flags & MEM_Int ){
1376         sqlite3XPrintf(&x, "%lld", pMem->u.i);
1377       }else if( pMem->flags & MEM_Real ){
1378         sqlite3XPrintf(&x, "%.16g", pMem->u.r);
1379       }else if( pMem->flags & MEM_Null ){
1380         zP4 = "NULL";
1381       }else{
1382         assert( pMem->flags & MEM_Blob );
1383         zP4 = "(blob)";
1384       }
1385       break;
1386     }
1387 #ifndef SQLITE_OMIT_VIRTUALTABLE
1388     case P4_VTAB: {
1389       sqlite3_vtab *pVtab = pOp->p4.pVtab->pVtab;
1390       sqlite3XPrintf(&x, "vtab:%p", pVtab);
1391       break;
1392     }
1393 #endif
1394     case P4_INTARRAY: {
1395       int i;
1396       int *ai = pOp->p4.ai;
1397       int n = ai[0];   /* The first element of an INTARRAY is always the
1398                        ** count of the number of elements to follow */
1399       for(i=1; i<=n; i++){
1400         sqlite3XPrintf(&x, ",%d", ai[i]);
1401       }
1402       zTemp[0] = '[';
1403       sqlite3StrAccumAppend(&x, "]", 1);
1404       break;
1405     }
1406     case P4_SUBPROGRAM: {
1407       sqlite3XPrintf(&x, "program");
1408       break;
1409     }
1410     case P4_ADVANCE: {
1411       zTemp[0] = 0;
1412       break;
1413     }
1414     case P4_TABLE: {
1415       sqlite3XPrintf(&x, "%s", pOp->p4.pTab->zName);
1416       break;
1417     }
1418     default: {
1419       zP4 = pOp->p4.z;
1420       if( zP4==0 ){
1421         zP4 = zTemp;
1422         zTemp[0] = 0;
1423       }
1424     }
1425   }
1426   sqlite3StrAccumFinish(&x);
1427   assert( zP4!=0 );
1428   return zP4;
1429 }
1430 #endif /* VDBE_DISPLAY_P4 */
1431 
1432 /*
1433 ** Declare to the Vdbe that the BTree object at db->aDb[i] is used.
1434 **
1435 ** The prepared statements need to know in advance the complete set of
1436 ** attached databases that will be use.  A mask of these databases
1437 ** is maintained in p->btreeMask.  The p->lockMask value is the subset of
1438 ** p->btreeMask of databases that will require a lock.
1439 */
1440 void sqlite3VdbeUsesBtree(Vdbe *p, int i){
1441   assert( i>=0 && i<p->db->nDb && i<(int)sizeof(yDbMask)*8 );
1442   assert( i<(int)sizeof(p->btreeMask)*8 );
1443   DbMaskSet(p->btreeMask, i);
1444   if( i!=1 && sqlite3BtreeSharable(p->db->aDb[i].pBt) ){
1445     DbMaskSet(p->lockMask, i);
1446   }
1447 }
1448 
1449 #if !defined(SQLITE_OMIT_SHARED_CACHE)
1450 /*
1451 ** If SQLite is compiled to support shared-cache mode and to be threadsafe,
1452 ** this routine obtains the mutex associated with each BtShared structure
1453 ** that may be accessed by the VM passed as an argument. In doing so it also
1454 ** sets the BtShared.db member of each of the BtShared structures, ensuring
1455 ** that the correct busy-handler callback is invoked if required.
1456 **
1457 ** If SQLite is not threadsafe but does support shared-cache mode, then
1458 ** sqlite3BtreeEnter() is invoked to set the BtShared.db variables
1459 ** of all of BtShared structures accessible via the database handle
1460 ** associated with the VM.
1461 **
1462 ** If SQLite is not threadsafe and does not support shared-cache mode, this
1463 ** function is a no-op.
1464 **
1465 ** The p->btreeMask field is a bitmask of all btrees that the prepared
1466 ** statement p will ever use.  Let N be the number of bits in p->btreeMask
1467 ** corresponding to btrees that use shared cache.  Then the runtime of
1468 ** this routine is N*N.  But as N is rarely more than 1, this should not
1469 ** be a problem.
1470 */
1471 void sqlite3VdbeEnter(Vdbe *p){
1472   int i;
1473   sqlite3 *db;
1474   Db *aDb;
1475   int nDb;
1476   if( DbMaskAllZero(p->lockMask) ) return;  /* The common case */
1477   db = p->db;
1478   aDb = db->aDb;
1479   nDb = db->nDb;
1480   for(i=0; i<nDb; i++){
1481     if( i!=1 && DbMaskTest(p->lockMask,i) && ALWAYS(aDb[i].pBt!=0) ){
1482       sqlite3BtreeEnter(aDb[i].pBt);
1483     }
1484   }
1485 }
1486 #endif
1487 
1488 #if !defined(SQLITE_OMIT_SHARED_CACHE) && SQLITE_THREADSAFE>0
1489 /*
1490 ** Unlock all of the btrees previously locked by a call to sqlite3VdbeEnter().
1491 */
1492 static SQLITE_NOINLINE void vdbeLeave(Vdbe *p){
1493   int i;
1494   sqlite3 *db;
1495   Db *aDb;
1496   int nDb;
1497   db = p->db;
1498   aDb = db->aDb;
1499   nDb = db->nDb;
1500   for(i=0; i<nDb; i++){
1501     if( i!=1 && DbMaskTest(p->lockMask,i) && ALWAYS(aDb[i].pBt!=0) ){
1502       sqlite3BtreeLeave(aDb[i].pBt);
1503     }
1504   }
1505 }
1506 void sqlite3VdbeLeave(Vdbe *p){
1507   if( DbMaskAllZero(p->lockMask) ) return;  /* The common case */
1508   vdbeLeave(p);
1509 }
1510 #endif
1511 
1512 #if defined(VDBE_PROFILE) || defined(SQLITE_DEBUG)
1513 /*
1514 ** Print a single opcode.  This routine is used for debugging only.
1515 */
1516 void sqlite3VdbePrintOp(FILE *pOut, int pc, Op *pOp){
1517   char *zP4;
1518   char zPtr[50];
1519   char zCom[100];
1520   static const char *zFormat1 = "%4d %-13s %4d %4d %4d %-13s %.2X %s\n";
1521   if( pOut==0 ) pOut = stdout;
1522   zP4 = displayP4(pOp, zPtr, sizeof(zPtr));
1523 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1524   displayComment(pOp, zP4, zCom, sizeof(zCom));
1525 #else
1526   zCom[0] = 0;
1527 #endif
1528   /* NB:  The sqlite3OpcodeName() function is implemented by code created
1529   ** by the mkopcodeh.awk and mkopcodec.awk scripts which extract the
1530   ** information from the vdbe.c source text */
1531   fprintf(pOut, zFormat1, pc,
1532       sqlite3OpcodeName(pOp->opcode), pOp->p1, pOp->p2, pOp->p3, zP4, pOp->p5,
1533       zCom
1534   );
1535   fflush(pOut);
1536 }
1537 #endif
1538 
1539 /*
1540 ** Initialize an array of N Mem element.
1541 */
1542 static void initMemArray(Mem *p, int N, sqlite3 *db, u16 flags){
1543   while( (N--)>0 ){
1544     p->db = db;
1545     p->flags = flags;
1546     p->szMalloc = 0;
1547 #ifdef SQLITE_DEBUG
1548     p->pScopyFrom = 0;
1549 #endif
1550     p++;
1551   }
1552 }
1553 
1554 /*
1555 ** Release an array of N Mem elements
1556 */
1557 static void releaseMemArray(Mem *p, int N){
1558   if( p && N ){
1559     Mem *pEnd = &p[N];
1560     sqlite3 *db = p->db;
1561     if( db->pnBytesFreed ){
1562       do{
1563         if( p->szMalloc ) sqlite3DbFree(db, p->zMalloc);
1564       }while( (++p)<pEnd );
1565       return;
1566     }
1567     do{
1568       assert( (&p[1])==pEnd || p[0].db==p[1].db );
1569       assert( sqlite3VdbeCheckMemInvariants(p) );
1570 
1571       /* This block is really an inlined version of sqlite3VdbeMemRelease()
1572       ** that takes advantage of the fact that the memory cell value is
1573       ** being set to NULL after releasing any dynamic resources.
1574       **
1575       ** The justification for duplicating code is that according to
1576       ** callgrind, this causes a certain test case to hit the CPU 4.7
1577       ** percent less (x86 linux, gcc version 4.1.2, -O6) than if
1578       ** sqlite3MemRelease() were called from here. With -O2, this jumps
1579       ** to 6.6 percent. The test case is inserting 1000 rows into a table
1580       ** with no indexes using a single prepared INSERT statement, bind()
1581       ** and reset(). Inserts are grouped into a transaction.
1582       */
1583       testcase( p->flags & MEM_Agg );
1584       testcase( p->flags & MEM_Dyn );
1585       testcase( p->flags & MEM_Frame );
1586       testcase( p->flags & MEM_RowSet );
1587       if( p->flags&(MEM_Agg|MEM_Dyn|MEM_Frame|MEM_RowSet) ){
1588         sqlite3VdbeMemRelease(p);
1589       }else if( p->szMalloc ){
1590         sqlite3DbFreeNN(db, p->zMalloc);
1591         p->szMalloc = 0;
1592       }
1593 
1594       p->flags = MEM_Undefined;
1595     }while( (++p)<pEnd );
1596   }
1597 }
1598 
1599 /*
1600 ** Delete a VdbeFrame object and its contents. VdbeFrame objects are
1601 ** allocated by the OP_Program opcode in sqlite3VdbeExec().
1602 */
1603 void sqlite3VdbeFrameDelete(VdbeFrame *p){
1604   int i;
1605   Mem *aMem = VdbeFrameMem(p);
1606   VdbeCursor **apCsr = (VdbeCursor **)&aMem[p->nChildMem];
1607   for(i=0; i<p->nChildCsr; i++){
1608     sqlite3VdbeFreeCursor(p->v, apCsr[i]);
1609   }
1610   releaseMemArray(aMem, p->nChildMem);
1611   sqlite3VdbeDeleteAuxData(p->v->db, &p->pAuxData, -1, 0);
1612   sqlite3DbFree(p->v->db, p);
1613 }
1614 
1615 #ifndef SQLITE_OMIT_EXPLAIN
1616 /*
1617 ** Give a listing of the program in the virtual machine.
1618 **
1619 ** The interface is the same as sqlite3VdbeExec().  But instead of
1620 ** running the code, it invokes the callback once for each instruction.
1621 ** This feature is used to implement "EXPLAIN".
1622 **
1623 ** When p->explain==1, each instruction is listed.  When
1624 ** p->explain==2, only OP_Explain instructions are listed and these
1625 ** are shown in a different format.  p->explain==2 is used to implement
1626 ** EXPLAIN QUERY PLAN.
1627 **
1628 ** When p->explain==1, first the main program is listed, then each of
1629 ** the trigger subprograms are listed one by one.
1630 */
1631 int sqlite3VdbeList(
1632   Vdbe *p                   /* The VDBE */
1633 ){
1634   int nRow;                            /* Stop when row count reaches this */
1635   int nSub = 0;                        /* Number of sub-vdbes seen so far */
1636   SubProgram **apSub = 0;              /* Array of sub-vdbes */
1637   Mem *pSub = 0;                       /* Memory cell hold array of subprogs */
1638   sqlite3 *db = p->db;                 /* The database connection */
1639   int i;                               /* Loop counter */
1640   int rc = SQLITE_OK;                  /* Return code */
1641   Mem *pMem = &p->aMem[1];             /* First Mem of result set */
1642 
1643   assert( p->explain );
1644   assert( p->magic==VDBE_MAGIC_RUN );
1645   assert( p->rc==SQLITE_OK || p->rc==SQLITE_BUSY || p->rc==SQLITE_NOMEM );
1646 
1647   /* Even though this opcode does not use dynamic strings for
1648   ** the result, result columns may become dynamic if the user calls
1649   ** sqlite3_column_text16(), causing a translation to UTF-16 encoding.
1650   */
1651   releaseMemArray(pMem, 8);
1652   p->pResultSet = 0;
1653 
1654   if( p->rc==SQLITE_NOMEM_BKPT ){
1655     /* This happens if a malloc() inside a call to sqlite3_column_text() or
1656     ** sqlite3_column_text16() failed.  */
1657     sqlite3OomFault(db);
1658     return SQLITE_ERROR;
1659   }
1660 
1661   /* When the number of output rows reaches nRow, that means the
1662   ** listing has finished and sqlite3_step() should return SQLITE_DONE.
1663   ** nRow is the sum of the number of rows in the main program, plus
1664   ** the sum of the number of rows in all trigger subprograms encountered
1665   ** so far.  The nRow value will increase as new trigger subprograms are
1666   ** encountered, but p->pc will eventually catch up to nRow.
1667   */
1668   nRow = p->nOp;
1669   if( p->explain==1 ){
1670     /* The first 8 memory cells are used for the result set.  So we will
1671     ** commandeer the 9th cell to use as storage for an array of pointers
1672     ** to trigger subprograms.  The VDBE is guaranteed to have at least 9
1673     ** cells.  */
1674     assert( p->nMem>9 );
1675     pSub = &p->aMem[9];
1676     if( pSub->flags&MEM_Blob ){
1677       /* On the first call to sqlite3_step(), pSub will hold a NULL.  It is
1678       ** initialized to a BLOB by the P4_SUBPROGRAM processing logic below */
1679       nSub = pSub->n/sizeof(Vdbe*);
1680       apSub = (SubProgram **)pSub->z;
1681     }
1682     for(i=0; i<nSub; i++){
1683       nRow += apSub[i]->nOp;
1684     }
1685   }
1686 
1687   do{
1688     i = p->pc++;
1689   }while( i<nRow && p->explain==2 && p->aOp[i].opcode!=OP_Explain );
1690   if( i>=nRow ){
1691     p->rc = SQLITE_OK;
1692     rc = SQLITE_DONE;
1693   }else if( db->u1.isInterrupted ){
1694     p->rc = SQLITE_INTERRUPT;
1695     rc = SQLITE_ERROR;
1696     sqlite3VdbeError(p, sqlite3ErrStr(p->rc));
1697   }else{
1698     char *zP4;
1699     Op *pOp;
1700     if( i<p->nOp ){
1701       /* The output line number is small enough that we are still in the
1702       ** main program. */
1703       pOp = &p->aOp[i];
1704     }else{
1705       /* We are currently listing subprograms.  Figure out which one and
1706       ** pick up the appropriate opcode. */
1707       int j;
1708       i -= p->nOp;
1709       for(j=0; i>=apSub[j]->nOp; j++){
1710         i -= apSub[j]->nOp;
1711       }
1712       pOp = &apSub[j]->aOp[i];
1713     }
1714     if( p->explain==1 ){
1715       pMem->flags = MEM_Int;
1716       pMem->u.i = i;                                /* Program counter */
1717       pMem++;
1718 
1719       pMem->flags = MEM_Static|MEM_Str|MEM_Term;
1720       pMem->z = (char*)sqlite3OpcodeName(pOp->opcode); /* Opcode */
1721       assert( pMem->z!=0 );
1722       pMem->n = sqlite3Strlen30(pMem->z);
1723       pMem->enc = SQLITE_UTF8;
1724       pMem++;
1725 
1726       /* When an OP_Program opcode is encounter (the only opcode that has
1727       ** a P4_SUBPROGRAM argument), expand the size of the array of subprograms
1728       ** kept in p->aMem[9].z to hold the new program - assuming this subprogram
1729       ** has not already been seen.
1730       */
1731       if( pOp->p4type==P4_SUBPROGRAM ){
1732         int nByte = (nSub+1)*sizeof(SubProgram*);
1733         int j;
1734         for(j=0; j<nSub; j++){
1735           if( apSub[j]==pOp->p4.pProgram ) break;
1736         }
1737         if( j==nSub && SQLITE_OK==sqlite3VdbeMemGrow(pSub, nByte, nSub!=0) ){
1738           apSub = (SubProgram **)pSub->z;
1739           apSub[nSub++] = pOp->p4.pProgram;
1740           pSub->flags |= MEM_Blob;
1741           pSub->n = nSub*sizeof(SubProgram*);
1742         }
1743       }
1744     }
1745 
1746     pMem->flags = MEM_Int;
1747     pMem->u.i = pOp->p1;                          /* P1 */
1748     pMem++;
1749 
1750     pMem->flags = MEM_Int;
1751     pMem->u.i = pOp->p2;                          /* P2 */
1752     pMem++;
1753 
1754     pMem->flags = MEM_Int;
1755     pMem->u.i = pOp->p3;                          /* P3 */
1756     pMem++;
1757 
1758     if( sqlite3VdbeMemClearAndResize(pMem, 100) ){ /* P4 */
1759       assert( p->db->mallocFailed );
1760       return SQLITE_ERROR;
1761     }
1762     pMem->flags = MEM_Str|MEM_Term;
1763     zP4 = displayP4(pOp, pMem->z, pMem->szMalloc);
1764     if( zP4!=pMem->z ){
1765       pMem->n = 0;
1766       sqlite3VdbeMemSetStr(pMem, zP4, -1, SQLITE_UTF8, 0);
1767     }else{
1768       assert( pMem->z!=0 );
1769       pMem->n = sqlite3Strlen30(pMem->z);
1770       pMem->enc = SQLITE_UTF8;
1771     }
1772     pMem++;
1773 
1774     if( p->explain==1 ){
1775       if( sqlite3VdbeMemClearAndResize(pMem, 4) ){
1776         assert( p->db->mallocFailed );
1777         return SQLITE_ERROR;
1778       }
1779       pMem->flags = MEM_Str|MEM_Term;
1780       pMem->n = 2;
1781       sqlite3_snprintf(3, pMem->z, "%.2x", pOp->p5);   /* P5 */
1782       pMem->enc = SQLITE_UTF8;
1783       pMem++;
1784 
1785 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1786       if( sqlite3VdbeMemClearAndResize(pMem, 500) ){
1787         assert( p->db->mallocFailed );
1788         return SQLITE_ERROR;
1789       }
1790       pMem->flags = MEM_Str|MEM_Term;
1791       pMem->n = displayComment(pOp, zP4, pMem->z, 500);
1792       pMem->enc = SQLITE_UTF8;
1793 #else
1794       pMem->flags = MEM_Null;                       /* Comment */
1795 #endif
1796     }
1797 
1798     p->nResColumn = 8 - 4*(p->explain-1);
1799     p->pResultSet = &p->aMem[1];
1800     p->rc = SQLITE_OK;
1801     rc = SQLITE_ROW;
1802   }
1803   return rc;
1804 }
1805 #endif /* SQLITE_OMIT_EXPLAIN */
1806 
1807 #ifdef SQLITE_DEBUG
1808 /*
1809 ** Print the SQL that was used to generate a VDBE program.
1810 */
1811 void sqlite3VdbePrintSql(Vdbe *p){
1812   const char *z = 0;
1813   if( p->zSql ){
1814     z = p->zSql;
1815   }else if( p->nOp>=1 ){
1816     const VdbeOp *pOp = &p->aOp[0];
1817     if( pOp->opcode==OP_Init && pOp->p4.z!=0 ){
1818       z = pOp->p4.z;
1819       while( sqlite3Isspace(*z) ) z++;
1820     }
1821   }
1822   if( z ) printf("SQL: [%s]\n", z);
1823 }
1824 #endif
1825 
1826 #if !defined(SQLITE_OMIT_TRACE) && defined(SQLITE_ENABLE_IOTRACE)
1827 /*
1828 ** Print an IOTRACE message showing SQL content.
1829 */
1830 void sqlite3VdbeIOTraceSql(Vdbe *p){
1831   int nOp = p->nOp;
1832   VdbeOp *pOp;
1833   if( sqlite3IoTrace==0 ) return;
1834   if( nOp<1 ) return;
1835   pOp = &p->aOp[0];
1836   if( pOp->opcode==OP_Init && pOp->p4.z!=0 ){
1837     int i, j;
1838     char z[1000];
1839     sqlite3_snprintf(sizeof(z), z, "%s", pOp->p4.z);
1840     for(i=0; sqlite3Isspace(z[i]); i++){}
1841     for(j=0; z[i]; i++){
1842       if( sqlite3Isspace(z[i]) ){
1843         if( z[i-1]!=' ' ){
1844           z[j++] = ' ';
1845         }
1846       }else{
1847         z[j++] = z[i];
1848       }
1849     }
1850     z[j] = 0;
1851     sqlite3IoTrace("SQL %s\n", z);
1852   }
1853 }
1854 #endif /* !SQLITE_OMIT_TRACE && SQLITE_ENABLE_IOTRACE */
1855 
1856 /* An instance of this object describes bulk memory available for use
1857 ** by subcomponents of a prepared statement.  Space is allocated out
1858 ** of a ReusableSpace object by the allocSpace() routine below.
1859 */
1860 struct ReusableSpace {
1861   u8 *pSpace;          /* Available memory */
1862   int nFree;           /* Bytes of available memory */
1863   int nNeeded;         /* Total bytes that could not be allocated */
1864 };
1865 
1866 /* Try to allocate nByte bytes of 8-byte aligned bulk memory for pBuf
1867 ** from the ReusableSpace object.  Return a pointer to the allocated
1868 ** memory on success.  If insufficient memory is available in the
1869 ** ReusableSpace object, increase the ReusableSpace.nNeeded
1870 ** value by the amount needed and return NULL.
1871 **
1872 ** If pBuf is not initially NULL, that means that the memory has already
1873 ** been allocated by a prior call to this routine, so just return a copy
1874 ** of pBuf and leave ReusableSpace unchanged.
1875 **
1876 ** This allocator is employed to repurpose unused slots at the end of the
1877 ** opcode array of prepared state for other memory needs of the prepared
1878 ** statement.
1879 */
1880 static void *allocSpace(
1881   struct ReusableSpace *p,  /* Bulk memory available for allocation */
1882   void *pBuf,               /* Pointer to a prior allocation */
1883   int nByte                 /* Bytes of memory needed */
1884 ){
1885   assert( EIGHT_BYTE_ALIGNMENT(p->pSpace) );
1886   if( pBuf==0 ){
1887     nByte = ROUND8(nByte);
1888     if( nByte <= p->nFree ){
1889       p->nFree -= nByte;
1890       pBuf = &p->pSpace[p->nFree];
1891     }else{
1892       p->nNeeded += nByte;
1893     }
1894   }
1895   assert( EIGHT_BYTE_ALIGNMENT(pBuf) );
1896   return pBuf;
1897 }
1898 
1899 /*
1900 ** Rewind the VDBE back to the beginning in preparation for
1901 ** running it.
1902 */
1903 void sqlite3VdbeRewind(Vdbe *p){
1904 #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
1905   int i;
1906 #endif
1907   assert( p!=0 );
1908   assert( p->magic==VDBE_MAGIC_INIT || p->magic==VDBE_MAGIC_RESET );
1909 
1910   /* There should be at least one opcode.
1911   */
1912   assert( p->nOp>0 );
1913 
1914   /* Set the magic to VDBE_MAGIC_RUN sooner rather than later. */
1915   p->magic = VDBE_MAGIC_RUN;
1916 
1917 #ifdef SQLITE_DEBUG
1918   for(i=0; i<p->nMem; i++){
1919     assert( p->aMem[i].db==p->db );
1920   }
1921 #endif
1922   p->pc = -1;
1923   p->rc = SQLITE_OK;
1924   p->errorAction = OE_Abort;
1925   p->nChange = 0;
1926   p->cacheCtr = 1;
1927   p->minWriteFileFormat = 255;
1928   p->iStatement = 0;
1929   p->nFkConstraint = 0;
1930 #ifdef VDBE_PROFILE
1931   for(i=0; i<p->nOp; i++){
1932     p->aOp[i].cnt = 0;
1933     p->aOp[i].cycles = 0;
1934   }
1935 #endif
1936 }
1937 
1938 /*
1939 ** Prepare a virtual machine for execution for the first time after
1940 ** creating the virtual machine.  This involves things such
1941 ** as allocating registers and initializing the program counter.
1942 ** After the VDBE has be prepped, it can be executed by one or more
1943 ** calls to sqlite3VdbeExec().
1944 **
1945 ** This function may be called exactly once on each virtual machine.
1946 ** After this routine is called the VM has been "packaged" and is ready
1947 ** to run.  After this routine is called, further calls to
1948 ** sqlite3VdbeAddOp() functions are prohibited.  This routine disconnects
1949 ** the Vdbe from the Parse object that helped generate it so that the
1950 ** the Vdbe becomes an independent entity and the Parse object can be
1951 ** destroyed.
1952 **
1953 ** Use the sqlite3VdbeRewind() procedure to restore a virtual machine back
1954 ** to its initial state after it has been run.
1955 */
1956 void sqlite3VdbeMakeReady(
1957   Vdbe *p,                       /* The VDBE */
1958   Parse *pParse                  /* Parsing context */
1959 ){
1960   sqlite3 *db;                   /* The database connection */
1961   int nVar;                      /* Number of parameters */
1962   int nMem;                      /* Number of VM memory registers */
1963   int nCursor;                   /* Number of cursors required */
1964   int nArg;                      /* Number of arguments in subprograms */
1965   int n;                         /* Loop counter */
1966   struct ReusableSpace x;        /* Reusable bulk memory */
1967 
1968   assert( p!=0 );
1969   assert( p->nOp>0 );
1970   assert( pParse!=0 );
1971   assert( p->magic==VDBE_MAGIC_INIT );
1972   assert( pParse==p->pParse );
1973   db = p->db;
1974   assert( db->mallocFailed==0 );
1975   nVar = pParse->nVar;
1976   nMem = pParse->nMem;
1977   nCursor = pParse->nTab;
1978   nArg = pParse->nMaxArg;
1979 
1980   /* Each cursor uses a memory cell.  The first cursor (cursor 0) can
1981   ** use aMem[0] which is not otherwise used by the VDBE program.  Allocate
1982   ** space at the end of aMem[] for cursors 1 and greater.
1983   ** See also: allocateCursor().
1984   */
1985   nMem += nCursor;
1986   if( nCursor==0 && nMem>0 ) nMem++;  /* Space for aMem[0] even if not used */
1987 
1988   /* Figure out how much reusable memory is available at the end of the
1989   ** opcode array.  This extra memory will be reallocated for other elements
1990   ** of the prepared statement.
1991   */
1992   n = ROUND8(sizeof(Op)*p->nOp);              /* Bytes of opcode memory used */
1993   x.pSpace = &((u8*)p->aOp)[n];               /* Unused opcode memory */
1994   assert( EIGHT_BYTE_ALIGNMENT(x.pSpace) );
1995   x.nFree = ROUNDDOWN8(pParse->szOpAlloc - n);  /* Bytes of unused memory */
1996   assert( x.nFree>=0 );
1997   assert( EIGHT_BYTE_ALIGNMENT(&x.pSpace[x.nFree]) );
1998 
1999   resolveP2Values(p, &nArg);
2000   p->usesStmtJournal = (u8)(pParse->isMultiWrite && pParse->mayAbort);
2001   if( pParse->explain && nMem<10 ){
2002     nMem = 10;
2003   }
2004   p->expired = 0;
2005 
2006   /* Memory for registers, parameters, cursor, etc, is allocated in one or two
2007   ** passes.  On the first pass, we try to reuse unused memory at the
2008   ** end of the opcode array.  If we are unable to satisfy all memory
2009   ** requirements by reusing the opcode array tail, then the second
2010   ** pass will fill in the remainder using a fresh memory allocation.
2011   **
2012   ** This two-pass approach that reuses as much memory as possible from
2013   ** the leftover memory at the end of the opcode array.  This can significantly
2014   ** reduce the amount of memory held by a prepared statement.
2015   */
2016   do {
2017     x.nNeeded = 0;
2018     p->aMem = allocSpace(&x, p->aMem, nMem*sizeof(Mem));
2019     p->aVar = allocSpace(&x, p->aVar, nVar*sizeof(Mem));
2020     p->apArg = allocSpace(&x, p->apArg, nArg*sizeof(Mem*));
2021     p->apCsr = allocSpace(&x, p->apCsr, nCursor*sizeof(VdbeCursor*));
2022 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2023     p->anExec = allocSpace(&x, p->anExec, p->nOp*sizeof(i64));
2024 #endif
2025     if( x.nNeeded==0 ) break;
2026     x.pSpace = p->pFree = sqlite3DbMallocRawNN(db, x.nNeeded);
2027     x.nFree = x.nNeeded;
2028   }while( !db->mallocFailed );
2029 
2030   p->pVList = pParse->pVList;
2031   pParse->pVList =  0;
2032   p->explain = pParse->explain;
2033   if( db->mallocFailed ){
2034     p->nVar = 0;
2035     p->nCursor = 0;
2036     p->nMem = 0;
2037   }else{
2038     p->nCursor = nCursor;
2039     p->nVar = (ynVar)nVar;
2040     initMemArray(p->aVar, nVar, db, MEM_Null);
2041     p->nMem = nMem;
2042     initMemArray(p->aMem, nMem, db, MEM_Undefined);
2043     memset(p->apCsr, 0, nCursor*sizeof(VdbeCursor*));
2044 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2045     memset(p->anExec, 0, p->nOp*sizeof(i64));
2046 #endif
2047   }
2048   sqlite3VdbeRewind(p);
2049 }
2050 
2051 /*
2052 ** Close a VDBE cursor and release all the resources that cursor
2053 ** happens to hold.
2054 */
2055 void sqlite3VdbeFreeCursor(Vdbe *p, VdbeCursor *pCx){
2056   if( pCx==0 ){
2057     return;
2058   }
2059   assert( pCx->pBtx==0 || pCx->eCurType==CURTYPE_BTREE );
2060   switch( pCx->eCurType ){
2061     case CURTYPE_SORTER: {
2062       sqlite3VdbeSorterClose(p->db, pCx);
2063       break;
2064     }
2065     case CURTYPE_BTREE: {
2066       if( pCx->isEphemeral ){
2067         if( pCx->pBtx ) sqlite3BtreeClose(pCx->pBtx);
2068         /* The pCx->pCursor will be close automatically, if it exists, by
2069         ** the call above. */
2070       }else{
2071         assert( pCx->uc.pCursor!=0 );
2072         sqlite3BtreeCloseCursor(pCx->uc.pCursor);
2073       }
2074       break;
2075     }
2076 #ifndef SQLITE_OMIT_VIRTUALTABLE
2077     case CURTYPE_VTAB: {
2078       sqlite3_vtab_cursor *pVCur = pCx->uc.pVCur;
2079       const sqlite3_module *pModule = pVCur->pVtab->pModule;
2080       assert( pVCur->pVtab->nRef>0 );
2081       pVCur->pVtab->nRef--;
2082       pModule->xClose(pVCur);
2083       break;
2084     }
2085 #endif
2086   }
2087 }
2088 
2089 /*
2090 ** Close all cursors in the current frame.
2091 */
2092 static void closeCursorsInFrame(Vdbe *p){
2093   if( p->apCsr ){
2094     int i;
2095     for(i=0; i<p->nCursor; i++){
2096       VdbeCursor *pC = p->apCsr[i];
2097       if( pC ){
2098         sqlite3VdbeFreeCursor(p, pC);
2099         p->apCsr[i] = 0;
2100       }
2101     }
2102   }
2103 }
2104 
2105 /*
2106 ** Copy the values stored in the VdbeFrame structure to its Vdbe. This
2107 ** is used, for example, when a trigger sub-program is halted to restore
2108 ** control to the main program.
2109 */
2110 int sqlite3VdbeFrameRestore(VdbeFrame *pFrame){
2111   Vdbe *v = pFrame->v;
2112   closeCursorsInFrame(v);
2113 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2114   v->anExec = pFrame->anExec;
2115 #endif
2116   v->aOp = pFrame->aOp;
2117   v->nOp = pFrame->nOp;
2118   v->aMem = pFrame->aMem;
2119   v->nMem = pFrame->nMem;
2120   v->apCsr = pFrame->apCsr;
2121   v->nCursor = pFrame->nCursor;
2122   v->db->lastRowid = pFrame->lastRowid;
2123   v->nChange = pFrame->nChange;
2124   v->db->nChange = pFrame->nDbChange;
2125   sqlite3VdbeDeleteAuxData(v->db, &v->pAuxData, -1, 0);
2126   v->pAuxData = pFrame->pAuxData;
2127   pFrame->pAuxData = 0;
2128   return pFrame->pc;
2129 }
2130 
2131 /*
2132 ** Close all cursors.
2133 **
2134 ** Also release any dynamic memory held by the VM in the Vdbe.aMem memory
2135 ** cell array. This is necessary as the memory cell array may contain
2136 ** pointers to VdbeFrame objects, which may in turn contain pointers to
2137 ** open cursors.
2138 */
2139 static void closeAllCursors(Vdbe *p){
2140   if( p->pFrame ){
2141     VdbeFrame *pFrame;
2142     for(pFrame=p->pFrame; pFrame->pParent; pFrame=pFrame->pParent);
2143     sqlite3VdbeFrameRestore(pFrame);
2144     p->pFrame = 0;
2145     p->nFrame = 0;
2146   }
2147   assert( p->nFrame==0 );
2148   closeCursorsInFrame(p);
2149   if( p->aMem ){
2150     releaseMemArray(p->aMem, p->nMem);
2151   }
2152   while( p->pDelFrame ){
2153     VdbeFrame *pDel = p->pDelFrame;
2154     p->pDelFrame = pDel->pParent;
2155     sqlite3VdbeFrameDelete(pDel);
2156   }
2157 
2158   /* Delete any auxdata allocations made by the VM */
2159   if( p->pAuxData ) sqlite3VdbeDeleteAuxData(p->db, &p->pAuxData, -1, 0);
2160   assert( p->pAuxData==0 );
2161 }
2162 
2163 /*
2164 ** Set the number of result columns that will be returned by this SQL
2165 ** statement. This is now set at compile time, rather than during
2166 ** execution of the vdbe program so that sqlite3_column_count() can
2167 ** be called on an SQL statement before sqlite3_step().
2168 */
2169 void sqlite3VdbeSetNumCols(Vdbe *p, int nResColumn){
2170   int n;
2171   sqlite3 *db = p->db;
2172 
2173   if( p->nResColumn ){
2174     releaseMemArray(p->aColName, p->nResColumn*COLNAME_N);
2175     sqlite3DbFree(db, p->aColName);
2176   }
2177   n = nResColumn*COLNAME_N;
2178   p->nResColumn = (u16)nResColumn;
2179   p->aColName = (Mem*)sqlite3DbMallocRawNN(db, sizeof(Mem)*n );
2180   if( p->aColName==0 ) return;
2181   initMemArray(p->aColName, n, db, MEM_Null);
2182 }
2183 
2184 /*
2185 ** Set the name of the idx'th column to be returned by the SQL statement.
2186 ** zName must be a pointer to a nul terminated string.
2187 **
2188 ** This call must be made after a call to sqlite3VdbeSetNumCols().
2189 **
2190 ** The final parameter, xDel, must be one of SQLITE_DYNAMIC, SQLITE_STATIC
2191 ** or SQLITE_TRANSIENT. If it is SQLITE_DYNAMIC, then the buffer pointed
2192 ** to by zName will be freed by sqlite3DbFree() when the vdbe is destroyed.
2193 */
2194 int sqlite3VdbeSetColName(
2195   Vdbe *p,                         /* Vdbe being configured */
2196   int idx,                         /* Index of column zName applies to */
2197   int var,                         /* One of the COLNAME_* constants */
2198   const char *zName,               /* Pointer to buffer containing name */
2199   void (*xDel)(void*)              /* Memory management strategy for zName */
2200 ){
2201   int rc;
2202   Mem *pColName;
2203   assert( idx<p->nResColumn );
2204   assert( var<COLNAME_N );
2205   if( p->db->mallocFailed ){
2206     assert( !zName || xDel!=SQLITE_DYNAMIC );
2207     return SQLITE_NOMEM_BKPT;
2208   }
2209   assert( p->aColName!=0 );
2210   pColName = &(p->aColName[idx+var*p->nResColumn]);
2211   rc = sqlite3VdbeMemSetStr(pColName, zName, -1, SQLITE_UTF8, xDel);
2212   assert( rc!=0 || !zName || (pColName->flags&MEM_Term)!=0 );
2213   return rc;
2214 }
2215 
2216 /*
2217 ** A read or write transaction may or may not be active on database handle
2218 ** db. If a transaction is active, commit it. If there is a
2219 ** write-transaction spanning more than one database file, this routine
2220 ** takes care of the master journal trickery.
2221 */
2222 static int vdbeCommit(sqlite3 *db, Vdbe *p){
2223   int i;
2224   int nTrans = 0;  /* Number of databases with an active write-transaction
2225                    ** that are candidates for a two-phase commit using a
2226                    ** master-journal */
2227   int rc = SQLITE_OK;
2228   int needXcommit = 0;
2229 
2230 #ifdef SQLITE_OMIT_VIRTUALTABLE
2231   /* With this option, sqlite3VtabSync() is defined to be simply
2232   ** SQLITE_OK so p is not used.
2233   */
2234   UNUSED_PARAMETER(p);
2235 #endif
2236 
2237   /* Before doing anything else, call the xSync() callback for any
2238   ** virtual module tables written in this transaction. This has to
2239   ** be done before determining whether a master journal file is
2240   ** required, as an xSync() callback may add an attached database
2241   ** to the transaction.
2242   */
2243   rc = sqlite3VtabSync(db, p);
2244 
2245   /* This loop determines (a) if the commit hook should be invoked and
2246   ** (b) how many database files have open write transactions, not
2247   ** including the temp database. (b) is important because if more than
2248   ** one database file has an open write transaction, a master journal
2249   ** file is required for an atomic commit.
2250   */
2251   for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2252     Btree *pBt = db->aDb[i].pBt;
2253     if( sqlite3BtreeIsInTrans(pBt) ){
2254       /* Whether or not a database might need a master journal depends upon
2255       ** its journal mode (among other things).  This matrix determines which
2256       ** journal modes use a master journal and which do not */
2257       static const u8 aMJNeeded[] = {
2258         /* DELETE   */  1,
2259         /* PERSIST   */ 1,
2260         /* OFF       */ 0,
2261         /* TRUNCATE  */ 1,
2262         /* MEMORY    */ 0,
2263         /* WAL       */ 0
2264       };
2265       Pager *pPager;   /* Pager associated with pBt */
2266       needXcommit = 1;
2267       sqlite3BtreeEnter(pBt);
2268       pPager = sqlite3BtreePager(pBt);
2269       if( db->aDb[i].safety_level!=PAGER_SYNCHRONOUS_OFF
2270        && aMJNeeded[sqlite3PagerGetJournalMode(pPager)]
2271       ){
2272         assert( i!=1 );
2273         nTrans++;
2274       }
2275       rc = sqlite3PagerExclusiveLock(pPager);
2276       sqlite3BtreeLeave(pBt);
2277     }
2278   }
2279   if( rc!=SQLITE_OK ){
2280     return rc;
2281   }
2282 
2283   /* If there are any write-transactions at all, invoke the commit hook */
2284   if( needXcommit && db->xCommitCallback ){
2285     rc = db->xCommitCallback(db->pCommitArg);
2286     if( rc ){
2287       return SQLITE_CONSTRAINT_COMMITHOOK;
2288     }
2289   }
2290 
2291   /* The simple case - no more than one database file (not counting the
2292   ** TEMP database) has a transaction active.   There is no need for the
2293   ** master-journal.
2294   **
2295   ** If the return value of sqlite3BtreeGetFilename() is a zero length
2296   ** string, it means the main database is :memory: or a temp file.  In
2297   ** that case we do not support atomic multi-file commits, so use the
2298   ** simple case then too.
2299   */
2300   if( 0==sqlite3Strlen30(sqlite3BtreeGetFilename(db->aDb[0].pBt))
2301    || nTrans<=1
2302   ){
2303     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2304       Btree *pBt = db->aDb[i].pBt;
2305       if( pBt ){
2306         rc = sqlite3BtreeCommitPhaseOne(pBt, 0);
2307       }
2308     }
2309 
2310     /* Do the commit only if all databases successfully complete phase 1.
2311     ** If one of the BtreeCommitPhaseOne() calls fails, this indicates an
2312     ** IO error while deleting or truncating a journal file. It is unlikely,
2313     ** but could happen. In this case abandon processing and return the error.
2314     */
2315     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2316       Btree *pBt = db->aDb[i].pBt;
2317       if( pBt ){
2318         rc = sqlite3BtreeCommitPhaseTwo(pBt, 0);
2319       }
2320     }
2321     if( rc==SQLITE_OK ){
2322       sqlite3VtabCommit(db);
2323     }
2324   }
2325 
2326   /* The complex case - There is a multi-file write-transaction active.
2327   ** This requires a master journal file to ensure the transaction is
2328   ** committed atomically.
2329   */
2330 #ifndef SQLITE_OMIT_DISKIO
2331   else{
2332     sqlite3_vfs *pVfs = db->pVfs;
2333     char *zMaster = 0;   /* File-name for the master journal */
2334     char const *zMainFile = sqlite3BtreeGetFilename(db->aDb[0].pBt);
2335     sqlite3_file *pMaster = 0;
2336     i64 offset = 0;
2337     int res;
2338     int retryCount = 0;
2339     int nMainFile;
2340 
2341     /* Select a master journal file name */
2342     nMainFile = sqlite3Strlen30(zMainFile);
2343     zMaster = sqlite3MPrintf(db, "%s-mjXXXXXX9XXz", zMainFile);
2344     if( zMaster==0 ) return SQLITE_NOMEM_BKPT;
2345     do {
2346       u32 iRandom;
2347       if( retryCount ){
2348         if( retryCount>100 ){
2349           sqlite3_log(SQLITE_FULL, "MJ delete: %s", zMaster);
2350           sqlite3OsDelete(pVfs, zMaster, 0);
2351           break;
2352         }else if( retryCount==1 ){
2353           sqlite3_log(SQLITE_FULL, "MJ collide: %s", zMaster);
2354         }
2355       }
2356       retryCount++;
2357       sqlite3_randomness(sizeof(iRandom), &iRandom);
2358       sqlite3_snprintf(13, &zMaster[nMainFile], "-mj%06X9%02X",
2359                                (iRandom>>8)&0xffffff, iRandom&0xff);
2360       /* The antipenultimate character of the master journal name must
2361       ** be "9" to avoid name collisions when using 8+3 filenames. */
2362       assert( zMaster[sqlite3Strlen30(zMaster)-3]=='9' );
2363       sqlite3FileSuffix3(zMainFile, zMaster);
2364       rc = sqlite3OsAccess(pVfs, zMaster, SQLITE_ACCESS_EXISTS, &res);
2365     }while( rc==SQLITE_OK && res );
2366     if( rc==SQLITE_OK ){
2367       /* Open the master journal. */
2368       rc = sqlite3OsOpenMalloc(pVfs, zMaster, &pMaster,
2369           SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE|
2370           SQLITE_OPEN_EXCLUSIVE|SQLITE_OPEN_MASTER_JOURNAL, 0
2371       );
2372     }
2373     if( rc!=SQLITE_OK ){
2374       sqlite3DbFree(db, zMaster);
2375       return rc;
2376     }
2377 
2378     /* Write the name of each database file in the transaction into the new
2379     ** master journal file. If an error occurs at this point close
2380     ** and delete the master journal file. All the individual journal files
2381     ** still have 'null' as the master journal pointer, so they will roll
2382     ** back independently if a failure occurs.
2383     */
2384     for(i=0; i<db->nDb; i++){
2385       Btree *pBt = db->aDb[i].pBt;
2386       if( sqlite3BtreeIsInTrans(pBt) ){
2387         char const *zFile = sqlite3BtreeGetJournalname(pBt);
2388         if( zFile==0 ){
2389           continue;  /* Ignore TEMP and :memory: databases */
2390         }
2391         assert( zFile[0]!=0 );
2392         rc = sqlite3OsWrite(pMaster, zFile, sqlite3Strlen30(zFile)+1, offset);
2393         offset += sqlite3Strlen30(zFile)+1;
2394         if( rc!=SQLITE_OK ){
2395           sqlite3OsCloseFree(pMaster);
2396           sqlite3OsDelete(pVfs, zMaster, 0);
2397           sqlite3DbFree(db, zMaster);
2398           return rc;
2399         }
2400       }
2401     }
2402 
2403     /* Sync the master journal file. If the IOCAP_SEQUENTIAL device
2404     ** flag is set this is not required.
2405     */
2406     if( 0==(sqlite3OsDeviceCharacteristics(pMaster)&SQLITE_IOCAP_SEQUENTIAL)
2407      && SQLITE_OK!=(rc = sqlite3OsSync(pMaster, SQLITE_SYNC_NORMAL))
2408     ){
2409       sqlite3OsCloseFree(pMaster);
2410       sqlite3OsDelete(pVfs, zMaster, 0);
2411       sqlite3DbFree(db, zMaster);
2412       return rc;
2413     }
2414 
2415     /* Sync all the db files involved in the transaction. The same call
2416     ** sets the master journal pointer in each individual journal. If
2417     ** an error occurs here, do not delete the master journal file.
2418     **
2419     ** If the error occurs during the first call to
2420     ** sqlite3BtreeCommitPhaseOne(), then there is a chance that the
2421     ** master journal file will be orphaned. But we cannot delete it,
2422     ** in case the master journal file name was written into the journal
2423     ** file before the failure occurred.
2424     */
2425     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2426       Btree *pBt = db->aDb[i].pBt;
2427       if( pBt ){
2428         rc = sqlite3BtreeCommitPhaseOne(pBt, zMaster);
2429       }
2430     }
2431     sqlite3OsCloseFree(pMaster);
2432     assert( rc!=SQLITE_BUSY );
2433     if( rc!=SQLITE_OK ){
2434       sqlite3DbFree(db, zMaster);
2435       return rc;
2436     }
2437 
2438     /* Delete the master journal file. This commits the transaction. After
2439     ** doing this the directory is synced again before any individual
2440     ** transaction files are deleted.
2441     */
2442     rc = sqlite3OsDelete(pVfs, zMaster, 1);
2443     sqlite3DbFree(db, zMaster);
2444     zMaster = 0;
2445     if( rc ){
2446       return rc;
2447     }
2448 
2449     /* All files and directories have already been synced, so the following
2450     ** calls to sqlite3BtreeCommitPhaseTwo() are only closing files and
2451     ** deleting or truncating journals. If something goes wrong while
2452     ** this is happening we don't really care. The integrity of the
2453     ** transaction is already guaranteed, but some stray 'cold' journals
2454     ** may be lying around. Returning an error code won't help matters.
2455     */
2456     disable_simulated_io_errors();
2457     sqlite3BeginBenignMalloc();
2458     for(i=0; i<db->nDb; i++){
2459       Btree *pBt = db->aDb[i].pBt;
2460       if( pBt ){
2461         sqlite3BtreeCommitPhaseTwo(pBt, 1);
2462       }
2463     }
2464     sqlite3EndBenignMalloc();
2465     enable_simulated_io_errors();
2466 
2467     sqlite3VtabCommit(db);
2468   }
2469 #endif
2470 
2471   return rc;
2472 }
2473 
2474 /*
2475 ** This routine checks that the sqlite3.nVdbeActive count variable
2476 ** matches the number of vdbe's in the list sqlite3.pVdbe that are
2477 ** currently active. An assertion fails if the two counts do not match.
2478 ** This is an internal self-check only - it is not an essential processing
2479 ** step.
2480 **
2481 ** This is a no-op if NDEBUG is defined.
2482 */
2483 #ifndef NDEBUG
2484 static void checkActiveVdbeCnt(sqlite3 *db){
2485   Vdbe *p;
2486   int cnt = 0;
2487   int nWrite = 0;
2488   int nRead = 0;
2489   p = db->pVdbe;
2490   while( p ){
2491     if( sqlite3_stmt_busy((sqlite3_stmt*)p) ){
2492       cnt++;
2493       if( p->readOnly==0 ) nWrite++;
2494       if( p->bIsReader ) nRead++;
2495     }
2496     p = p->pNext;
2497   }
2498   assert( cnt==db->nVdbeActive );
2499   assert( nWrite==db->nVdbeWrite );
2500   assert( nRead==db->nVdbeRead );
2501 }
2502 #else
2503 #define checkActiveVdbeCnt(x)
2504 #endif
2505 
2506 /*
2507 ** If the Vdbe passed as the first argument opened a statement-transaction,
2508 ** close it now. Argument eOp must be either SAVEPOINT_ROLLBACK or
2509 ** SAVEPOINT_RELEASE. If it is SAVEPOINT_ROLLBACK, then the statement
2510 ** transaction is rolled back. If eOp is SAVEPOINT_RELEASE, then the
2511 ** statement transaction is committed.
2512 **
2513 ** If an IO error occurs, an SQLITE_IOERR_XXX error code is returned.
2514 ** Otherwise SQLITE_OK.
2515 */
2516 static SQLITE_NOINLINE int vdbeCloseStatement(Vdbe *p, int eOp){
2517   sqlite3 *const db = p->db;
2518   int rc = SQLITE_OK;
2519   int i;
2520   const int iSavepoint = p->iStatement-1;
2521 
2522   assert( eOp==SAVEPOINT_ROLLBACK || eOp==SAVEPOINT_RELEASE);
2523   assert( db->nStatement>0 );
2524   assert( p->iStatement==(db->nStatement+db->nSavepoint) );
2525 
2526   for(i=0; i<db->nDb; i++){
2527     int rc2 = SQLITE_OK;
2528     Btree *pBt = db->aDb[i].pBt;
2529     if( pBt ){
2530       if( eOp==SAVEPOINT_ROLLBACK ){
2531         rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_ROLLBACK, iSavepoint);
2532       }
2533       if( rc2==SQLITE_OK ){
2534         rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_RELEASE, iSavepoint);
2535       }
2536       if( rc==SQLITE_OK ){
2537         rc = rc2;
2538       }
2539     }
2540   }
2541   db->nStatement--;
2542   p->iStatement = 0;
2543 
2544   if( rc==SQLITE_OK ){
2545     if( eOp==SAVEPOINT_ROLLBACK ){
2546       rc = sqlite3VtabSavepoint(db, SAVEPOINT_ROLLBACK, iSavepoint);
2547     }
2548     if( rc==SQLITE_OK ){
2549       rc = sqlite3VtabSavepoint(db, SAVEPOINT_RELEASE, iSavepoint);
2550     }
2551   }
2552 
2553   /* If the statement transaction is being rolled back, also restore the
2554   ** database handles deferred constraint counter to the value it had when
2555   ** the statement transaction was opened.  */
2556   if( eOp==SAVEPOINT_ROLLBACK ){
2557     db->nDeferredCons = p->nStmtDefCons;
2558     db->nDeferredImmCons = p->nStmtDefImmCons;
2559   }
2560   return rc;
2561 }
2562 int sqlite3VdbeCloseStatement(Vdbe *p, int eOp){
2563   if( p->db->nStatement && p->iStatement ){
2564     return vdbeCloseStatement(p, eOp);
2565   }
2566   return SQLITE_OK;
2567 }
2568 
2569 
2570 /*
2571 ** This function is called when a transaction opened by the database
2572 ** handle associated with the VM passed as an argument is about to be
2573 ** committed. If there are outstanding deferred foreign key constraint
2574 ** violations, return SQLITE_ERROR. Otherwise, SQLITE_OK.
2575 **
2576 ** If there are outstanding FK violations and this function returns
2577 ** SQLITE_ERROR, set the result of the VM to SQLITE_CONSTRAINT_FOREIGNKEY
2578 ** and write an error message to it. Then return SQLITE_ERROR.
2579 */
2580 #ifndef SQLITE_OMIT_FOREIGN_KEY
2581 int sqlite3VdbeCheckFk(Vdbe *p, int deferred){
2582   sqlite3 *db = p->db;
2583   if( (deferred && (db->nDeferredCons+db->nDeferredImmCons)>0)
2584    || (!deferred && p->nFkConstraint>0)
2585   ){
2586     p->rc = SQLITE_CONSTRAINT_FOREIGNKEY;
2587     p->errorAction = OE_Abort;
2588     sqlite3VdbeError(p, "FOREIGN KEY constraint failed");
2589     return SQLITE_ERROR;
2590   }
2591   return SQLITE_OK;
2592 }
2593 #endif
2594 
2595 /*
2596 ** This routine is called the when a VDBE tries to halt.  If the VDBE
2597 ** has made changes and is in autocommit mode, then commit those
2598 ** changes.  If a rollback is needed, then do the rollback.
2599 **
2600 ** This routine is the only way to move the state of a VM from
2601 ** SQLITE_MAGIC_RUN to SQLITE_MAGIC_HALT.  It is harmless to
2602 ** call this on a VM that is in the SQLITE_MAGIC_HALT state.
2603 **
2604 ** Return an error code.  If the commit could not complete because of
2605 ** lock contention, return SQLITE_BUSY.  If SQLITE_BUSY is returned, it
2606 ** means the close did not happen and needs to be repeated.
2607 */
2608 int sqlite3VdbeHalt(Vdbe *p){
2609   int rc;                         /* Used to store transient return codes */
2610   sqlite3 *db = p->db;
2611 
2612   /* This function contains the logic that determines if a statement or
2613   ** transaction will be committed or rolled back as a result of the
2614   ** execution of this virtual machine.
2615   **
2616   ** If any of the following errors occur:
2617   **
2618   **     SQLITE_NOMEM
2619   **     SQLITE_IOERR
2620   **     SQLITE_FULL
2621   **     SQLITE_INTERRUPT
2622   **
2623   ** Then the internal cache might have been left in an inconsistent
2624   ** state.  We need to rollback the statement transaction, if there is
2625   ** one, or the complete transaction if there is no statement transaction.
2626   */
2627 
2628   if( p->magic!=VDBE_MAGIC_RUN ){
2629     return SQLITE_OK;
2630   }
2631   if( db->mallocFailed ){
2632     p->rc = SQLITE_NOMEM_BKPT;
2633   }
2634   closeAllCursors(p);
2635   checkActiveVdbeCnt(db);
2636 
2637   /* No commit or rollback needed if the program never started or if the
2638   ** SQL statement does not read or write a database file.  */
2639   if( p->pc>=0 && p->bIsReader ){
2640     int mrc;   /* Primary error code from p->rc */
2641     int eStatementOp = 0;
2642     int isSpecialError;            /* Set to true if a 'special' error */
2643 
2644     /* Lock all btrees used by the statement */
2645     sqlite3VdbeEnter(p);
2646 
2647     /* Check for one of the special errors */
2648     mrc = p->rc & 0xff;
2649     isSpecialError = mrc==SQLITE_NOMEM || mrc==SQLITE_IOERR
2650                      || mrc==SQLITE_INTERRUPT || mrc==SQLITE_FULL;
2651     if( isSpecialError ){
2652       /* If the query was read-only and the error code is SQLITE_INTERRUPT,
2653       ** no rollback is necessary. Otherwise, at least a savepoint
2654       ** transaction must be rolled back to restore the database to a
2655       ** consistent state.
2656       **
2657       ** Even if the statement is read-only, it is important to perform
2658       ** a statement or transaction rollback operation. If the error
2659       ** occurred while writing to the journal, sub-journal or database
2660       ** file as part of an effort to free up cache space (see function
2661       ** pagerStress() in pager.c), the rollback is required to restore
2662       ** the pager to a consistent state.
2663       */
2664       if( !p->readOnly || mrc!=SQLITE_INTERRUPT ){
2665         if( (mrc==SQLITE_NOMEM || mrc==SQLITE_FULL) && p->usesStmtJournal ){
2666           eStatementOp = SAVEPOINT_ROLLBACK;
2667         }else{
2668           /* We are forced to roll back the active transaction. Before doing
2669           ** so, abort any other statements this handle currently has active.
2670           */
2671           sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
2672           sqlite3CloseSavepoints(db);
2673           db->autoCommit = 1;
2674           p->nChange = 0;
2675         }
2676       }
2677     }
2678 
2679     /* Check for immediate foreign key violations. */
2680     if( p->rc==SQLITE_OK ){
2681       sqlite3VdbeCheckFk(p, 0);
2682     }
2683 
2684     /* If the auto-commit flag is set and this is the only active writer
2685     ** VM, then we do either a commit or rollback of the current transaction.
2686     **
2687     ** Note: This block also runs if one of the special errors handled
2688     ** above has occurred.
2689     */
2690     if( !sqlite3VtabInSync(db)
2691      && db->autoCommit
2692      && db->nVdbeWrite==(p->readOnly==0)
2693     ){
2694       if( p->rc==SQLITE_OK || (p->errorAction==OE_Fail && !isSpecialError) ){
2695         rc = sqlite3VdbeCheckFk(p, 1);
2696         if( rc!=SQLITE_OK ){
2697           if( NEVER(p->readOnly) ){
2698             sqlite3VdbeLeave(p);
2699             return SQLITE_ERROR;
2700           }
2701           rc = SQLITE_CONSTRAINT_FOREIGNKEY;
2702         }else{
2703           /* The auto-commit flag is true, the vdbe program was successful
2704           ** or hit an 'OR FAIL' constraint and there are no deferred foreign
2705           ** key constraints to hold up the transaction. This means a commit
2706           ** is required. */
2707           rc = vdbeCommit(db, p);
2708         }
2709         if( rc==SQLITE_BUSY && p->readOnly ){
2710           sqlite3VdbeLeave(p);
2711           return SQLITE_BUSY;
2712         }else if( rc!=SQLITE_OK ){
2713           p->rc = rc;
2714           sqlite3RollbackAll(db, SQLITE_OK);
2715           p->nChange = 0;
2716         }else{
2717           db->nDeferredCons = 0;
2718           db->nDeferredImmCons = 0;
2719           db->flags &= ~SQLITE_DeferFKs;
2720           sqlite3CommitInternalChanges(db);
2721         }
2722       }else{
2723         sqlite3RollbackAll(db, SQLITE_OK);
2724         p->nChange = 0;
2725       }
2726       db->nStatement = 0;
2727     }else if( eStatementOp==0 ){
2728       if( p->rc==SQLITE_OK || p->errorAction==OE_Fail ){
2729         eStatementOp = SAVEPOINT_RELEASE;
2730       }else if( p->errorAction==OE_Abort ){
2731         eStatementOp = SAVEPOINT_ROLLBACK;
2732       }else{
2733         sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
2734         sqlite3CloseSavepoints(db);
2735         db->autoCommit = 1;
2736         p->nChange = 0;
2737       }
2738     }
2739 
2740     /* If eStatementOp is non-zero, then a statement transaction needs to
2741     ** be committed or rolled back. Call sqlite3VdbeCloseStatement() to
2742     ** do so. If this operation returns an error, and the current statement
2743     ** error code is SQLITE_OK or SQLITE_CONSTRAINT, then promote the
2744     ** current statement error code.
2745     */
2746     if( eStatementOp ){
2747       rc = sqlite3VdbeCloseStatement(p, eStatementOp);
2748       if( rc ){
2749         if( p->rc==SQLITE_OK || (p->rc&0xff)==SQLITE_CONSTRAINT ){
2750           p->rc = rc;
2751           sqlite3DbFree(db, p->zErrMsg);
2752           p->zErrMsg = 0;
2753         }
2754         sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
2755         sqlite3CloseSavepoints(db);
2756         db->autoCommit = 1;
2757         p->nChange = 0;
2758       }
2759     }
2760 
2761     /* If this was an INSERT, UPDATE or DELETE and no statement transaction
2762     ** has been rolled back, update the database connection change-counter.
2763     */
2764     if( p->changeCntOn ){
2765       if( eStatementOp!=SAVEPOINT_ROLLBACK ){
2766         sqlite3VdbeSetChanges(db, p->nChange);
2767       }else{
2768         sqlite3VdbeSetChanges(db, 0);
2769       }
2770       p->nChange = 0;
2771     }
2772 
2773     /* Release the locks */
2774     sqlite3VdbeLeave(p);
2775   }
2776 
2777   /* We have successfully halted and closed the VM.  Record this fact. */
2778   if( p->pc>=0 ){
2779     db->nVdbeActive--;
2780     if( !p->readOnly ) db->nVdbeWrite--;
2781     if( p->bIsReader ) db->nVdbeRead--;
2782     assert( db->nVdbeActive>=db->nVdbeRead );
2783     assert( db->nVdbeRead>=db->nVdbeWrite );
2784     assert( db->nVdbeWrite>=0 );
2785   }
2786   p->magic = VDBE_MAGIC_HALT;
2787   checkActiveVdbeCnt(db);
2788   if( db->mallocFailed ){
2789     p->rc = SQLITE_NOMEM_BKPT;
2790   }
2791 
2792   /* If the auto-commit flag is set to true, then any locks that were held
2793   ** by connection db have now been released. Call sqlite3ConnectionUnlocked()
2794   ** to invoke any required unlock-notify callbacks.
2795   */
2796   if( db->autoCommit ){
2797     sqlite3ConnectionUnlocked(db);
2798   }
2799 
2800   assert( db->nVdbeActive>0 || db->autoCommit==0 || db->nStatement==0 );
2801   return (p->rc==SQLITE_BUSY ? SQLITE_BUSY : SQLITE_OK);
2802 }
2803 
2804 
2805 /*
2806 ** Each VDBE holds the result of the most recent sqlite3_step() call
2807 ** in p->rc.  This routine sets that result back to SQLITE_OK.
2808 */
2809 void sqlite3VdbeResetStepResult(Vdbe *p){
2810   p->rc = SQLITE_OK;
2811 }
2812 
2813 /*
2814 ** Copy the error code and error message belonging to the VDBE passed
2815 ** as the first argument to its database handle (so that they will be
2816 ** returned by calls to sqlite3_errcode() and sqlite3_errmsg()).
2817 **
2818 ** This function does not clear the VDBE error code or message, just
2819 ** copies them to the database handle.
2820 */
2821 int sqlite3VdbeTransferError(Vdbe *p){
2822   sqlite3 *db = p->db;
2823   int rc = p->rc;
2824   if( p->zErrMsg ){
2825     db->bBenignMalloc++;
2826     sqlite3BeginBenignMalloc();
2827     if( db->pErr==0 ) db->pErr = sqlite3ValueNew(db);
2828     sqlite3ValueSetStr(db->pErr, -1, p->zErrMsg, SQLITE_UTF8, SQLITE_TRANSIENT);
2829     sqlite3EndBenignMalloc();
2830     db->bBenignMalloc--;
2831   }else if( db->pErr ){
2832     sqlite3ValueSetNull(db->pErr);
2833   }
2834   db->errCode = rc;
2835   return rc;
2836 }
2837 
2838 #ifdef SQLITE_ENABLE_SQLLOG
2839 /*
2840 ** If an SQLITE_CONFIG_SQLLOG hook is registered and the VM has been run,
2841 ** invoke it.
2842 */
2843 static void vdbeInvokeSqllog(Vdbe *v){
2844   if( sqlite3GlobalConfig.xSqllog && v->rc==SQLITE_OK && v->zSql && v->pc>=0 ){
2845     char *zExpanded = sqlite3VdbeExpandSql(v, v->zSql);
2846     assert( v->db->init.busy==0 );
2847     if( zExpanded ){
2848       sqlite3GlobalConfig.xSqllog(
2849           sqlite3GlobalConfig.pSqllogArg, v->db, zExpanded, 1
2850       );
2851       sqlite3DbFree(v->db, zExpanded);
2852     }
2853   }
2854 }
2855 #else
2856 # define vdbeInvokeSqllog(x)
2857 #endif
2858 
2859 /*
2860 ** Clean up a VDBE after execution but do not delete the VDBE just yet.
2861 ** Write any error messages into *pzErrMsg.  Return the result code.
2862 **
2863 ** After this routine is run, the VDBE should be ready to be executed
2864 ** again.
2865 **
2866 ** To look at it another way, this routine resets the state of the
2867 ** virtual machine from VDBE_MAGIC_RUN or VDBE_MAGIC_HALT back to
2868 ** VDBE_MAGIC_INIT.
2869 */
2870 int sqlite3VdbeReset(Vdbe *p){
2871 #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
2872   int i;
2873 #endif
2874 
2875   sqlite3 *db;
2876   db = p->db;
2877 
2878   /* If the VM did not run to completion or if it encountered an
2879   ** error, then it might not have been halted properly.  So halt
2880   ** it now.
2881   */
2882   sqlite3VdbeHalt(p);
2883 
2884   /* If the VDBE has be run even partially, then transfer the error code
2885   ** and error message from the VDBE into the main database structure.  But
2886   ** if the VDBE has just been set to run but has not actually executed any
2887   ** instructions yet, leave the main database error information unchanged.
2888   */
2889   if( p->pc>=0 ){
2890     vdbeInvokeSqllog(p);
2891     sqlite3VdbeTransferError(p);
2892     if( p->runOnlyOnce ) p->expired = 1;
2893   }else if( p->rc && p->expired ){
2894     /* The expired flag was set on the VDBE before the first call
2895     ** to sqlite3_step(). For consistency (since sqlite3_step() was
2896     ** called), set the database error in this case as well.
2897     */
2898     sqlite3ErrorWithMsg(db, p->rc, p->zErrMsg ? "%s" : 0, p->zErrMsg);
2899   }
2900 
2901   /* Reset register contents and reclaim error message memory.
2902   */
2903 #ifdef SQLITE_DEBUG
2904   /* Execute assert() statements to ensure that the Vdbe.apCsr[] and
2905   ** Vdbe.aMem[] arrays have already been cleaned up.  */
2906   if( p->apCsr ) for(i=0; i<p->nCursor; i++) assert( p->apCsr[i]==0 );
2907   if( p->aMem ){
2908     for(i=0; i<p->nMem; i++) assert( p->aMem[i].flags==MEM_Undefined );
2909   }
2910 #endif
2911   sqlite3DbFree(db, p->zErrMsg);
2912   p->zErrMsg = 0;
2913   p->pResultSet = 0;
2914 
2915   /* Save profiling information from this VDBE run.
2916   */
2917 #ifdef VDBE_PROFILE
2918   {
2919     FILE *out = fopen("vdbe_profile.out", "a");
2920     if( out ){
2921       fprintf(out, "---- ");
2922       for(i=0; i<p->nOp; i++){
2923         fprintf(out, "%02x", p->aOp[i].opcode);
2924       }
2925       fprintf(out, "\n");
2926       if( p->zSql ){
2927         char c, pc = 0;
2928         fprintf(out, "-- ");
2929         for(i=0; (c = p->zSql[i])!=0; i++){
2930           if( pc=='\n' ) fprintf(out, "-- ");
2931           putc(c, out);
2932           pc = c;
2933         }
2934         if( pc!='\n' ) fprintf(out, "\n");
2935       }
2936       for(i=0; i<p->nOp; i++){
2937         char zHdr[100];
2938         sqlite3_snprintf(sizeof(zHdr), zHdr, "%6u %12llu %8llu ",
2939            p->aOp[i].cnt,
2940            p->aOp[i].cycles,
2941            p->aOp[i].cnt>0 ? p->aOp[i].cycles/p->aOp[i].cnt : 0
2942         );
2943         fprintf(out, "%s", zHdr);
2944         sqlite3VdbePrintOp(out, i, &p->aOp[i]);
2945       }
2946       fclose(out);
2947     }
2948   }
2949 #endif
2950   p->magic = VDBE_MAGIC_RESET;
2951   return p->rc & db->errMask;
2952 }
2953 
2954 /*
2955 ** Clean up and delete a VDBE after execution.  Return an integer which is
2956 ** the result code.  Write any error message text into *pzErrMsg.
2957 */
2958 int sqlite3VdbeFinalize(Vdbe *p){
2959   int rc = SQLITE_OK;
2960   if( p->magic==VDBE_MAGIC_RUN || p->magic==VDBE_MAGIC_HALT ){
2961     rc = sqlite3VdbeReset(p);
2962     assert( (rc & p->db->errMask)==rc );
2963   }
2964   sqlite3VdbeDelete(p);
2965   return rc;
2966 }
2967 
2968 /*
2969 ** If parameter iOp is less than zero, then invoke the destructor for
2970 ** all auxiliary data pointers currently cached by the VM passed as
2971 ** the first argument.
2972 **
2973 ** Or, if iOp is greater than or equal to zero, then the destructor is
2974 ** only invoked for those auxiliary data pointers created by the user
2975 ** function invoked by the OP_Function opcode at instruction iOp of
2976 ** VM pVdbe, and only then if:
2977 **
2978 **    * the associated function parameter is the 32nd or later (counting
2979 **      from left to right), or
2980 **
2981 **    * the corresponding bit in argument mask is clear (where the first
2982 **      function parameter corresponds to bit 0 etc.).
2983 */
2984 void sqlite3VdbeDeleteAuxData(sqlite3 *db, AuxData **pp, int iOp, int mask){
2985   while( *pp ){
2986     AuxData *pAux = *pp;
2987     if( (iOp<0)
2988      || (pAux->iAuxOp==iOp
2989           && pAux->iAuxArg>=0
2990           && (pAux->iAuxArg>31 || !(mask & MASKBIT32(pAux->iAuxArg))))
2991     ){
2992       testcase( pAux->iAuxArg==31 );
2993       if( pAux->xDeleteAux ){
2994         pAux->xDeleteAux(pAux->pAux);
2995       }
2996       *pp = pAux->pNextAux;
2997       sqlite3DbFree(db, pAux);
2998     }else{
2999       pp= &pAux->pNextAux;
3000     }
3001   }
3002 }
3003 
3004 /*
3005 ** Free all memory associated with the Vdbe passed as the second argument,
3006 ** except for object itself, which is preserved.
3007 **
3008 ** The difference between this function and sqlite3VdbeDelete() is that
3009 ** VdbeDelete() also unlinks the Vdbe from the list of VMs associated with
3010 ** the database connection and frees the object itself.
3011 */
3012 void sqlite3VdbeClearObject(sqlite3 *db, Vdbe *p){
3013   SubProgram *pSub, *pNext;
3014   assert( p->db==0 || p->db==db );
3015   releaseMemArray(p->aColName, p->nResColumn*COLNAME_N);
3016   for(pSub=p->pProgram; pSub; pSub=pNext){
3017     pNext = pSub->pNext;
3018     vdbeFreeOpArray(db, pSub->aOp, pSub->nOp);
3019     sqlite3DbFree(db, pSub);
3020   }
3021   if( p->magic!=VDBE_MAGIC_INIT ){
3022     releaseMemArray(p->aVar, p->nVar);
3023     sqlite3DbFree(db, p->pVList);
3024     sqlite3DbFree(db, p->pFree);
3025   }
3026   vdbeFreeOpArray(db, p->aOp, p->nOp);
3027   sqlite3DbFree(db, p->aColName);
3028   sqlite3DbFree(db, p->zSql);
3029 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
3030   {
3031     int i;
3032     for(i=0; i<p->nScan; i++){
3033       sqlite3DbFree(db, p->aScan[i].zName);
3034     }
3035     sqlite3DbFree(db, p->aScan);
3036   }
3037 #endif
3038 }
3039 
3040 /*
3041 ** Delete an entire VDBE.
3042 */
3043 void sqlite3VdbeDelete(Vdbe *p){
3044   sqlite3 *db;
3045 
3046   assert( p!=0 );
3047   db = p->db;
3048   assert( sqlite3_mutex_held(db->mutex) );
3049   sqlite3VdbeClearObject(db, p);
3050   if( p->pPrev ){
3051     p->pPrev->pNext = p->pNext;
3052   }else{
3053     assert( db->pVdbe==p );
3054     db->pVdbe = p->pNext;
3055   }
3056   if( p->pNext ){
3057     p->pNext->pPrev = p->pPrev;
3058   }
3059   p->magic = VDBE_MAGIC_DEAD;
3060   p->db = 0;
3061   sqlite3DbFreeNN(db, p);
3062 }
3063 
3064 /*
3065 ** The cursor "p" has a pending seek operation that has not yet been
3066 ** carried out.  Seek the cursor now.  If an error occurs, return
3067 ** the appropriate error code.
3068 */
3069 static int SQLITE_NOINLINE handleDeferredMoveto(VdbeCursor *p){
3070   int res, rc;
3071 #ifdef SQLITE_TEST
3072   extern int sqlite3_search_count;
3073 #endif
3074   assert( p->deferredMoveto );
3075   assert( p->isTable );
3076   assert( p->eCurType==CURTYPE_BTREE );
3077   rc = sqlite3BtreeMovetoUnpacked(p->uc.pCursor, 0, p->movetoTarget, 0, &res);
3078   if( rc ) return rc;
3079   if( res!=0 ) return SQLITE_CORRUPT_BKPT;
3080 #ifdef SQLITE_TEST
3081   sqlite3_search_count++;
3082 #endif
3083   p->deferredMoveto = 0;
3084   p->cacheStatus = CACHE_STALE;
3085   return SQLITE_OK;
3086 }
3087 
3088 /*
3089 ** Something has moved cursor "p" out of place.  Maybe the row it was
3090 ** pointed to was deleted out from under it.  Or maybe the btree was
3091 ** rebalanced.  Whatever the cause, try to restore "p" to the place it
3092 ** is supposed to be pointing.  If the row was deleted out from under the
3093 ** cursor, set the cursor to point to a NULL row.
3094 */
3095 static int SQLITE_NOINLINE handleMovedCursor(VdbeCursor *p){
3096   int isDifferentRow, rc;
3097   assert( p->eCurType==CURTYPE_BTREE );
3098   assert( p->uc.pCursor!=0 );
3099   assert( sqlite3BtreeCursorHasMoved(p->uc.pCursor) );
3100   rc = sqlite3BtreeCursorRestore(p->uc.pCursor, &isDifferentRow);
3101   p->cacheStatus = CACHE_STALE;
3102   if( isDifferentRow ) p->nullRow = 1;
3103   return rc;
3104 }
3105 
3106 /*
3107 ** Check to ensure that the cursor is valid.  Restore the cursor
3108 ** if need be.  Return any I/O error from the restore operation.
3109 */
3110 int sqlite3VdbeCursorRestore(VdbeCursor *p){
3111   assert( p->eCurType==CURTYPE_BTREE );
3112   if( sqlite3BtreeCursorHasMoved(p->uc.pCursor) ){
3113     return handleMovedCursor(p);
3114   }
3115   return SQLITE_OK;
3116 }
3117 
3118 /*
3119 ** Make sure the cursor p is ready to read or write the row to which it
3120 ** was last positioned.  Return an error code if an OOM fault or I/O error
3121 ** prevents us from positioning the cursor to its correct position.
3122 **
3123 ** If a MoveTo operation is pending on the given cursor, then do that
3124 ** MoveTo now.  If no move is pending, check to see if the row has been
3125 ** deleted out from under the cursor and if it has, mark the row as
3126 ** a NULL row.
3127 **
3128 ** If the cursor is already pointing to the correct row and that row has
3129 ** not been deleted out from under the cursor, then this routine is a no-op.
3130 */
3131 int sqlite3VdbeCursorMoveto(VdbeCursor **pp, int *piCol){
3132   VdbeCursor *p = *pp;
3133   assert( p->eCurType==CURTYPE_BTREE || p->eCurType==CURTYPE_PSEUDO );
3134   if( p->deferredMoveto ){
3135     int iMap;
3136     if( p->aAltMap && (iMap = p->aAltMap[1+*piCol])>0 ){
3137       *pp = p->pAltCursor;
3138       *piCol = iMap - 1;
3139       return SQLITE_OK;
3140     }
3141     return handleDeferredMoveto(p);
3142   }
3143   if( sqlite3BtreeCursorHasMoved(p->uc.pCursor) ){
3144     return handleMovedCursor(p);
3145   }
3146   return SQLITE_OK;
3147 }
3148 
3149 /*
3150 ** The following functions:
3151 **
3152 ** sqlite3VdbeSerialType()
3153 ** sqlite3VdbeSerialTypeLen()
3154 ** sqlite3VdbeSerialLen()
3155 ** sqlite3VdbeSerialPut()
3156 ** sqlite3VdbeSerialGet()
3157 **
3158 ** encapsulate the code that serializes values for storage in SQLite
3159 ** data and index records. Each serialized value consists of a
3160 ** 'serial-type' and a blob of data. The serial type is an 8-byte unsigned
3161 ** integer, stored as a varint.
3162 **
3163 ** In an SQLite index record, the serial type is stored directly before
3164 ** the blob of data that it corresponds to. In a table record, all serial
3165 ** types are stored at the start of the record, and the blobs of data at
3166 ** the end. Hence these functions allow the caller to handle the
3167 ** serial-type and data blob separately.
3168 **
3169 ** The following table describes the various storage classes for data:
3170 **
3171 **   serial type        bytes of data      type
3172 **   --------------     ---------------    ---------------
3173 **      0                     0            NULL
3174 **      1                     1            signed integer
3175 **      2                     2            signed integer
3176 **      3                     3            signed integer
3177 **      4                     4            signed integer
3178 **      5                     6            signed integer
3179 **      6                     8            signed integer
3180 **      7                     8            IEEE float
3181 **      8                     0            Integer constant 0
3182 **      9                     0            Integer constant 1
3183 **     10,11                               reserved for expansion
3184 **    N>=12 and even       (N-12)/2        BLOB
3185 **    N>=13 and odd        (N-13)/2        text
3186 **
3187 ** The 8 and 9 types were added in 3.3.0, file format 4.  Prior versions
3188 ** of SQLite will not understand those serial types.
3189 */
3190 
3191 /*
3192 ** Return the serial-type for the value stored in pMem.
3193 */
3194 u32 sqlite3VdbeSerialType(Mem *pMem, int file_format, u32 *pLen){
3195   int flags = pMem->flags;
3196   u32 n;
3197 
3198   assert( pLen!=0 );
3199   if( flags&MEM_Null ){
3200     *pLen = 0;
3201     return 0;
3202   }
3203   if( flags&MEM_Int ){
3204     /* Figure out whether to use 1, 2, 4, 6 or 8 bytes. */
3205 #   define MAX_6BYTE ((((i64)0x00008000)<<32)-1)
3206     i64 i = pMem->u.i;
3207     u64 u;
3208     if( i<0 ){
3209       u = ~i;
3210     }else{
3211       u = i;
3212     }
3213     if( u<=127 ){
3214       if( (i&1)==i && file_format>=4 ){
3215         *pLen = 0;
3216         return 8+(u32)u;
3217       }else{
3218         *pLen = 1;
3219         return 1;
3220       }
3221     }
3222     if( u<=32767 ){ *pLen = 2; return 2; }
3223     if( u<=8388607 ){ *pLen = 3; return 3; }
3224     if( u<=2147483647 ){ *pLen = 4; return 4; }
3225     if( u<=MAX_6BYTE ){ *pLen = 6; return 5; }
3226     *pLen = 8;
3227     return 6;
3228   }
3229   if( flags&MEM_Real ){
3230     *pLen = 8;
3231     return 7;
3232   }
3233   assert( pMem->db->mallocFailed || flags&(MEM_Str|MEM_Blob) );
3234   assert( pMem->n>=0 );
3235   n = (u32)pMem->n;
3236   if( flags & MEM_Zero ){
3237     n += pMem->u.nZero;
3238   }
3239   *pLen = n;
3240   return ((n*2) + 12 + ((flags&MEM_Str)!=0));
3241 }
3242 
3243 /*
3244 ** The sizes for serial types less than 128
3245 */
3246 static const u8 sqlite3SmallTypeSizes[] = {
3247         /*  0   1   2   3   4   5   6   7   8   9 */
3248 /*   0 */   0,  1,  2,  3,  4,  6,  8,  8,  0,  0,
3249 /*  10 */   0,  0,  0,  0,  1,  1,  2,  2,  3,  3,
3250 /*  20 */   4,  4,  5,  5,  6,  6,  7,  7,  8,  8,
3251 /*  30 */   9,  9, 10, 10, 11, 11, 12, 12, 13, 13,
3252 /*  40 */  14, 14, 15, 15, 16, 16, 17, 17, 18, 18,
3253 /*  50 */  19, 19, 20, 20, 21, 21, 22, 22, 23, 23,
3254 /*  60 */  24, 24, 25, 25, 26, 26, 27, 27, 28, 28,
3255 /*  70 */  29, 29, 30, 30, 31, 31, 32, 32, 33, 33,
3256 /*  80 */  34, 34, 35, 35, 36, 36, 37, 37, 38, 38,
3257 /*  90 */  39, 39, 40, 40, 41, 41, 42, 42, 43, 43,
3258 /* 100 */  44, 44, 45, 45, 46, 46, 47, 47, 48, 48,
3259 /* 110 */  49, 49, 50, 50, 51, 51, 52, 52, 53, 53,
3260 /* 120 */  54, 54, 55, 55, 56, 56, 57, 57
3261 };
3262 
3263 /*
3264 ** Return the length of the data corresponding to the supplied serial-type.
3265 */
3266 u32 sqlite3VdbeSerialTypeLen(u32 serial_type){
3267   if( serial_type>=128 ){
3268     return (serial_type-12)/2;
3269   }else{
3270     assert( serial_type<12
3271             || sqlite3SmallTypeSizes[serial_type]==(serial_type - 12)/2 );
3272     return sqlite3SmallTypeSizes[serial_type];
3273   }
3274 }
3275 u8 sqlite3VdbeOneByteSerialTypeLen(u8 serial_type){
3276   assert( serial_type<128 );
3277   return sqlite3SmallTypeSizes[serial_type];
3278 }
3279 
3280 /*
3281 ** If we are on an architecture with mixed-endian floating
3282 ** points (ex: ARM7) then swap the lower 4 bytes with the
3283 ** upper 4 bytes.  Return the result.
3284 **
3285 ** For most architectures, this is a no-op.
3286 **
3287 ** (later):  It is reported to me that the mixed-endian problem
3288 ** on ARM7 is an issue with GCC, not with the ARM7 chip.  It seems
3289 ** that early versions of GCC stored the two words of a 64-bit
3290 ** float in the wrong order.  And that error has been propagated
3291 ** ever since.  The blame is not necessarily with GCC, though.
3292 ** GCC might have just copying the problem from a prior compiler.
3293 ** I am also told that newer versions of GCC that follow a different
3294 ** ABI get the byte order right.
3295 **
3296 ** Developers using SQLite on an ARM7 should compile and run their
3297 ** application using -DSQLITE_DEBUG=1 at least once.  With DEBUG
3298 ** enabled, some asserts below will ensure that the byte order of
3299 ** floating point values is correct.
3300 **
3301 ** (2007-08-30)  Frank van Vugt has studied this problem closely
3302 ** and has send his findings to the SQLite developers.  Frank
3303 ** writes that some Linux kernels offer floating point hardware
3304 ** emulation that uses only 32-bit mantissas instead of a full
3305 ** 48-bits as required by the IEEE standard.  (This is the
3306 ** CONFIG_FPE_FASTFPE option.)  On such systems, floating point
3307 ** byte swapping becomes very complicated.  To avoid problems,
3308 ** the necessary byte swapping is carried out using a 64-bit integer
3309 ** rather than a 64-bit float.  Frank assures us that the code here
3310 ** works for him.  We, the developers, have no way to independently
3311 ** verify this, but Frank seems to know what he is talking about
3312 ** so we trust him.
3313 */
3314 #ifdef SQLITE_MIXED_ENDIAN_64BIT_FLOAT
3315 static u64 floatSwap(u64 in){
3316   union {
3317     u64 r;
3318     u32 i[2];
3319   } u;
3320   u32 t;
3321 
3322   u.r = in;
3323   t = u.i[0];
3324   u.i[0] = u.i[1];
3325   u.i[1] = t;
3326   return u.r;
3327 }
3328 # define swapMixedEndianFloat(X)  X = floatSwap(X)
3329 #else
3330 # define swapMixedEndianFloat(X)
3331 #endif
3332 
3333 /*
3334 ** Write the serialized data blob for the value stored in pMem into
3335 ** buf. It is assumed that the caller has allocated sufficient space.
3336 ** Return the number of bytes written.
3337 **
3338 ** nBuf is the amount of space left in buf[].  The caller is responsible
3339 ** for allocating enough space to buf[] to hold the entire field, exclusive
3340 ** of the pMem->u.nZero bytes for a MEM_Zero value.
3341 **
3342 ** Return the number of bytes actually written into buf[].  The number
3343 ** of bytes in the zero-filled tail is included in the return value only
3344 ** if those bytes were zeroed in buf[].
3345 */
3346 u32 sqlite3VdbeSerialPut(u8 *buf, Mem *pMem, u32 serial_type){
3347   u32 len;
3348 
3349   /* Integer and Real */
3350   if( serial_type<=7 && serial_type>0 ){
3351     u64 v;
3352     u32 i;
3353     if( serial_type==7 ){
3354       assert( sizeof(v)==sizeof(pMem->u.r) );
3355       memcpy(&v, &pMem->u.r, sizeof(v));
3356       swapMixedEndianFloat(v);
3357     }else{
3358       v = pMem->u.i;
3359     }
3360     len = i = sqlite3SmallTypeSizes[serial_type];
3361     assert( i>0 );
3362     do{
3363       buf[--i] = (u8)(v&0xFF);
3364       v >>= 8;
3365     }while( i );
3366     return len;
3367   }
3368 
3369   /* String or blob */
3370   if( serial_type>=12 ){
3371     assert( pMem->n + ((pMem->flags & MEM_Zero)?pMem->u.nZero:0)
3372              == (int)sqlite3VdbeSerialTypeLen(serial_type) );
3373     len = pMem->n;
3374     if( len>0 ) memcpy(buf, pMem->z, len);
3375     return len;
3376   }
3377 
3378   /* NULL or constants 0 or 1 */
3379   return 0;
3380 }
3381 
3382 /* Input "x" is a sequence of unsigned characters that represent a
3383 ** big-endian integer.  Return the equivalent native integer
3384 */
3385 #define ONE_BYTE_INT(x)    ((i8)(x)[0])
3386 #define TWO_BYTE_INT(x)    (256*(i8)((x)[0])|(x)[1])
3387 #define THREE_BYTE_INT(x)  (65536*(i8)((x)[0])|((x)[1]<<8)|(x)[2])
3388 #define FOUR_BYTE_UINT(x)  (((u32)(x)[0]<<24)|((x)[1]<<16)|((x)[2]<<8)|(x)[3])
3389 #define FOUR_BYTE_INT(x) (16777216*(i8)((x)[0])|((x)[1]<<16)|((x)[2]<<8)|(x)[3])
3390 
3391 /*
3392 ** Deserialize the data blob pointed to by buf as serial type serial_type
3393 ** and store the result in pMem.  Return the number of bytes read.
3394 **
3395 ** This function is implemented as two separate routines for performance.
3396 ** The few cases that require local variables are broken out into a separate
3397 ** routine so that in most cases the overhead of moving the stack pointer
3398 ** is avoided.
3399 */
3400 static u32 SQLITE_NOINLINE serialGet(
3401   const unsigned char *buf,     /* Buffer to deserialize from */
3402   u32 serial_type,              /* Serial type to deserialize */
3403   Mem *pMem                     /* Memory cell to write value into */
3404 ){
3405   u64 x = FOUR_BYTE_UINT(buf);
3406   u32 y = FOUR_BYTE_UINT(buf+4);
3407   x = (x<<32) + y;
3408   if( serial_type==6 ){
3409     /* EVIDENCE-OF: R-29851-52272 Value is a big-endian 64-bit
3410     ** twos-complement integer. */
3411     pMem->u.i = *(i64*)&x;
3412     pMem->flags = MEM_Int;
3413     testcase( pMem->u.i<0 );
3414   }else{
3415     /* EVIDENCE-OF: R-57343-49114 Value is a big-endian IEEE 754-2008 64-bit
3416     ** floating point number. */
3417 #if !defined(NDEBUG) && !defined(SQLITE_OMIT_FLOATING_POINT)
3418     /* Verify that integers and floating point values use the same
3419     ** byte order.  Or, that if SQLITE_MIXED_ENDIAN_64BIT_FLOAT is
3420     ** defined that 64-bit floating point values really are mixed
3421     ** endian.
3422     */
3423     static const u64 t1 = ((u64)0x3ff00000)<<32;
3424     static const double r1 = 1.0;
3425     u64 t2 = t1;
3426     swapMixedEndianFloat(t2);
3427     assert( sizeof(r1)==sizeof(t2) && memcmp(&r1, &t2, sizeof(r1))==0 );
3428 #endif
3429     assert( sizeof(x)==8 && sizeof(pMem->u.r)==8 );
3430     swapMixedEndianFloat(x);
3431     memcpy(&pMem->u.r, &x, sizeof(x));
3432     pMem->flags = sqlite3IsNaN(pMem->u.r) ? MEM_Null : MEM_Real;
3433   }
3434   return 8;
3435 }
3436 u32 sqlite3VdbeSerialGet(
3437   const unsigned char *buf,     /* Buffer to deserialize from */
3438   u32 serial_type,              /* Serial type to deserialize */
3439   Mem *pMem                     /* Memory cell to write value into */
3440 ){
3441   switch( serial_type ){
3442     case 10:   /* Reserved for future use */
3443     case 11:   /* Reserved for future use */
3444     case 0: {  /* Null */
3445       /* EVIDENCE-OF: R-24078-09375 Value is a NULL. */
3446       pMem->flags = MEM_Null;
3447       break;
3448     }
3449     case 1: {
3450       /* EVIDENCE-OF: R-44885-25196 Value is an 8-bit twos-complement
3451       ** integer. */
3452       pMem->u.i = ONE_BYTE_INT(buf);
3453       pMem->flags = MEM_Int;
3454       testcase( pMem->u.i<0 );
3455       return 1;
3456     }
3457     case 2: { /* 2-byte signed integer */
3458       /* EVIDENCE-OF: R-49794-35026 Value is a big-endian 16-bit
3459       ** twos-complement integer. */
3460       pMem->u.i = TWO_BYTE_INT(buf);
3461       pMem->flags = MEM_Int;
3462       testcase( pMem->u.i<0 );
3463       return 2;
3464     }
3465     case 3: { /* 3-byte signed integer */
3466       /* EVIDENCE-OF: R-37839-54301 Value is a big-endian 24-bit
3467       ** twos-complement integer. */
3468       pMem->u.i = THREE_BYTE_INT(buf);
3469       pMem->flags = MEM_Int;
3470       testcase( pMem->u.i<0 );
3471       return 3;
3472     }
3473     case 4: { /* 4-byte signed integer */
3474       /* EVIDENCE-OF: R-01849-26079 Value is a big-endian 32-bit
3475       ** twos-complement integer. */
3476       pMem->u.i = FOUR_BYTE_INT(buf);
3477 #ifdef __HP_cc
3478       /* Work around a sign-extension bug in the HP compiler for HP/UX */
3479       if( buf[0]&0x80 ) pMem->u.i |= 0xffffffff80000000LL;
3480 #endif
3481       pMem->flags = MEM_Int;
3482       testcase( pMem->u.i<0 );
3483       return 4;
3484     }
3485     case 5: { /* 6-byte signed integer */
3486       /* EVIDENCE-OF: R-50385-09674 Value is a big-endian 48-bit
3487       ** twos-complement integer. */
3488       pMem->u.i = FOUR_BYTE_UINT(buf+2) + (((i64)1)<<32)*TWO_BYTE_INT(buf);
3489       pMem->flags = MEM_Int;
3490       testcase( pMem->u.i<0 );
3491       return 6;
3492     }
3493     case 6:   /* 8-byte signed integer */
3494     case 7: { /* IEEE floating point */
3495       /* These use local variables, so do them in a separate routine
3496       ** to avoid having to move the frame pointer in the common case */
3497       return serialGet(buf,serial_type,pMem);
3498     }
3499     case 8:    /* Integer 0 */
3500     case 9: {  /* Integer 1 */
3501       /* EVIDENCE-OF: R-12976-22893 Value is the integer 0. */
3502       /* EVIDENCE-OF: R-18143-12121 Value is the integer 1. */
3503       pMem->u.i = serial_type-8;
3504       pMem->flags = MEM_Int;
3505       return 0;
3506     }
3507     default: {
3508       /* EVIDENCE-OF: R-14606-31564 Value is a BLOB that is (N-12)/2 bytes in
3509       ** length.
3510       ** EVIDENCE-OF: R-28401-00140 Value is a string in the text encoding and
3511       ** (N-13)/2 bytes in length. */
3512       static const u16 aFlag[] = { MEM_Blob|MEM_Ephem, MEM_Str|MEM_Ephem };
3513       pMem->z = (char *)buf;
3514       pMem->n = (serial_type-12)/2;
3515       pMem->flags = aFlag[serial_type&1];
3516       return pMem->n;
3517     }
3518   }
3519   return 0;
3520 }
3521 /*
3522 ** This routine is used to allocate sufficient space for an UnpackedRecord
3523 ** structure large enough to be used with sqlite3VdbeRecordUnpack() if
3524 ** the first argument is a pointer to KeyInfo structure pKeyInfo.
3525 **
3526 ** The space is either allocated using sqlite3DbMallocRaw() or from within
3527 ** the unaligned buffer passed via the second and third arguments (presumably
3528 ** stack space). If the former, then *ppFree is set to a pointer that should
3529 ** be eventually freed by the caller using sqlite3DbFree(). Or, if the
3530 ** allocation comes from the pSpace/szSpace buffer, *ppFree is set to NULL
3531 ** before returning.
3532 **
3533 ** If an OOM error occurs, NULL is returned.
3534 */
3535 UnpackedRecord *sqlite3VdbeAllocUnpackedRecord(
3536   KeyInfo *pKeyInfo               /* Description of the record */
3537 ){
3538   UnpackedRecord *p;              /* Unpacked record to return */
3539   int nByte;                      /* Number of bytes required for *p */
3540   nByte = ROUND8(sizeof(UnpackedRecord)) + sizeof(Mem)*(pKeyInfo->nKeyField+1);
3541   p = (UnpackedRecord *)sqlite3DbMallocRaw(pKeyInfo->db, nByte);
3542   if( !p ) return 0;
3543   p->aMem = (Mem*)&((char*)p)[ROUND8(sizeof(UnpackedRecord))];
3544   assert( pKeyInfo->aSortOrder!=0 );
3545   p->pKeyInfo = pKeyInfo;
3546   p->nField = pKeyInfo->nKeyField + 1;
3547   return p;
3548 }
3549 
3550 /*
3551 ** Given the nKey-byte encoding of a record in pKey[], populate the
3552 ** UnpackedRecord structure indicated by the fourth argument with the
3553 ** contents of the decoded record.
3554 */
3555 void sqlite3VdbeRecordUnpack(
3556   KeyInfo *pKeyInfo,     /* Information about the record format */
3557   int nKey,              /* Size of the binary record */
3558   const void *pKey,      /* The binary record */
3559   UnpackedRecord *p      /* Populate this structure before returning. */
3560 ){
3561   const unsigned char *aKey = (const unsigned char *)pKey;
3562   int d;
3563   u32 idx;                        /* Offset in aKey[] to read from */
3564   u16 u;                          /* Unsigned loop counter */
3565   u32 szHdr;
3566   Mem *pMem = p->aMem;
3567 
3568   p->default_rc = 0;
3569   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
3570   idx = getVarint32(aKey, szHdr);
3571   d = szHdr;
3572   u = 0;
3573   while( idx<szHdr && d<=nKey ){
3574     u32 serial_type;
3575 
3576     idx += getVarint32(&aKey[idx], serial_type);
3577     pMem->enc = pKeyInfo->enc;
3578     pMem->db = pKeyInfo->db;
3579     /* pMem->flags = 0; // sqlite3VdbeSerialGet() will set this for us */
3580     pMem->szMalloc = 0;
3581     pMem->z = 0;
3582     d += sqlite3VdbeSerialGet(&aKey[d], serial_type, pMem);
3583     pMem++;
3584     if( (++u)>=p->nField ) break;
3585   }
3586   assert( u<=pKeyInfo->nKeyField + 1 );
3587   p->nField = u;
3588 }
3589 
3590 #ifdef SQLITE_DEBUG
3591 /*
3592 ** This function compares two index or table record keys in the same way
3593 ** as the sqlite3VdbeRecordCompare() routine. Unlike VdbeRecordCompare(),
3594 ** this function deserializes and compares values using the
3595 ** sqlite3VdbeSerialGet() and sqlite3MemCompare() functions. It is used
3596 ** in assert() statements to ensure that the optimized code in
3597 ** sqlite3VdbeRecordCompare() returns results with these two primitives.
3598 **
3599 ** Return true if the result of comparison is equivalent to desiredResult.
3600 ** Return false if there is a disagreement.
3601 */
3602 static int vdbeRecordCompareDebug(
3603   int nKey1, const void *pKey1, /* Left key */
3604   const UnpackedRecord *pPKey2, /* Right key */
3605   int desiredResult             /* Correct answer */
3606 ){
3607   u32 d1;            /* Offset into aKey[] of next data element */
3608   u32 idx1;          /* Offset into aKey[] of next header element */
3609   u32 szHdr1;        /* Number of bytes in header */
3610   int i = 0;
3611   int rc = 0;
3612   const unsigned char *aKey1 = (const unsigned char *)pKey1;
3613   KeyInfo *pKeyInfo;
3614   Mem mem1;
3615 
3616   pKeyInfo = pPKey2->pKeyInfo;
3617   if( pKeyInfo->db==0 ) return 1;
3618   mem1.enc = pKeyInfo->enc;
3619   mem1.db = pKeyInfo->db;
3620   /* mem1.flags = 0;  // Will be initialized by sqlite3VdbeSerialGet() */
3621   VVA_ONLY( mem1.szMalloc = 0; ) /* Only needed by assert() statements */
3622 
3623   /* Compilers may complain that mem1.u.i is potentially uninitialized.
3624   ** We could initialize it, as shown here, to silence those complaints.
3625   ** But in fact, mem1.u.i will never actually be used uninitialized, and doing
3626   ** the unnecessary initialization has a measurable negative performance
3627   ** impact, since this routine is a very high runner.  And so, we choose
3628   ** to ignore the compiler warnings and leave this variable uninitialized.
3629   */
3630   /*  mem1.u.i = 0;  // not needed, here to silence compiler warning */
3631 
3632   idx1 = getVarint32(aKey1, szHdr1);
3633   if( szHdr1>98307 ) return SQLITE_CORRUPT;
3634   d1 = szHdr1;
3635   assert( pKeyInfo->nAllField>=pPKey2->nField || CORRUPT_DB );
3636   assert( pKeyInfo->aSortOrder!=0 );
3637   assert( pKeyInfo->nKeyField>0 );
3638   assert( idx1<=szHdr1 || CORRUPT_DB );
3639   do{
3640     u32 serial_type1;
3641 
3642     /* Read the serial types for the next element in each key. */
3643     idx1 += getVarint32( aKey1+idx1, serial_type1 );
3644 
3645     /* Verify that there is enough key space remaining to avoid
3646     ** a buffer overread.  The "d1+serial_type1+2" subexpression will
3647     ** always be greater than or equal to the amount of required key space.
3648     ** Use that approximation to avoid the more expensive call to
3649     ** sqlite3VdbeSerialTypeLen() in the common case.
3650     */
3651     if( d1+serial_type1+2>(u32)nKey1
3652      && d1+sqlite3VdbeSerialTypeLen(serial_type1)>(u32)nKey1
3653     ){
3654       break;
3655     }
3656 
3657     /* Extract the values to be compared.
3658     */
3659     d1 += sqlite3VdbeSerialGet(&aKey1[d1], serial_type1, &mem1);
3660 
3661     /* Do the comparison
3662     */
3663     rc = sqlite3MemCompare(&mem1, &pPKey2->aMem[i], pKeyInfo->aColl[i]);
3664     if( rc!=0 ){
3665       assert( mem1.szMalloc==0 );  /* See comment below */
3666       if( pKeyInfo->aSortOrder[i] ){
3667         rc = -rc;  /* Invert the result for DESC sort order. */
3668       }
3669       goto debugCompareEnd;
3670     }
3671     i++;
3672   }while( idx1<szHdr1 && i<pPKey2->nField );
3673 
3674   /* No memory allocation is ever used on mem1.  Prove this using
3675   ** the following assert().  If the assert() fails, it indicates a
3676   ** memory leak and a need to call sqlite3VdbeMemRelease(&mem1).
3677   */
3678   assert( mem1.szMalloc==0 );
3679 
3680   /* rc==0 here means that one of the keys ran out of fields and
3681   ** all the fields up to that point were equal. Return the default_rc
3682   ** value.  */
3683   rc = pPKey2->default_rc;
3684 
3685 debugCompareEnd:
3686   if( desiredResult==0 && rc==0 ) return 1;
3687   if( desiredResult<0 && rc<0 ) return 1;
3688   if( desiredResult>0 && rc>0 ) return 1;
3689   if( CORRUPT_DB ) return 1;
3690   if( pKeyInfo->db->mallocFailed ) return 1;
3691   return 0;
3692 }
3693 #endif
3694 
3695 #ifdef SQLITE_DEBUG
3696 /*
3697 ** Count the number of fields (a.k.a. columns) in the record given by
3698 ** pKey,nKey.  The verify that this count is less than or equal to the
3699 ** limit given by pKeyInfo->nAllField.
3700 **
3701 ** If this constraint is not satisfied, it means that the high-speed
3702 ** vdbeRecordCompareInt() and vdbeRecordCompareString() routines will
3703 ** not work correctly.  If this assert() ever fires, it probably means
3704 ** that the KeyInfo.nKeyField or KeyInfo.nAllField values were computed
3705 ** incorrectly.
3706 */
3707 static void vdbeAssertFieldCountWithinLimits(
3708   int nKey, const void *pKey,   /* The record to verify */
3709   const KeyInfo *pKeyInfo       /* Compare size with this KeyInfo */
3710 ){
3711   int nField = 0;
3712   u32 szHdr;
3713   u32 idx;
3714   u32 notUsed;
3715   const unsigned char *aKey = (const unsigned char*)pKey;
3716 
3717   if( CORRUPT_DB ) return;
3718   idx = getVarint32(aKey, szHdr);
3719   assert( nKey>=0 );
3720   assert( szHdr<=(u32)nKey );
3721   while( idx<szHdr ){
3722     idx += getVarint32(aKey+idx, notUsed);
3723     nField++;
3724   }
3725   assert( nField <= pKeyInfo->nAllField );
3726 }
3727 #else
3728 # define vdbeAssertFieldCountWithinLimits(A,B,C)
3729 #endif
3730 
3731 /*
3732 ** Both *pMem1 and *pMem2 contain string values. Compare the two values
3733 ** using the collation sequence pColl. As usual, return a negative , zero
3734 ** or positive value if *pMem1 is less than, equal to or greater than
3735 ** *pMem2, respectively. Similar in spirit to "rc = (*pMem1) - (*pMem2);".
3736 */
3737 static int vdbeCompareMemString(
3738   const Mem *pMem1,
3739   const Mem *pMem2,
3740   const CollSeq *pColl,
3741   u8 *prcErr                      /* If an OOM occurs, set to SQLITE_NOMEM */
3742 ){
3743   if( pMem1->enc==pColl->enc ){
3744     /* The strings are already in the correct encoding.  Call the
3745      ** comparison function directly */
3746     return pColl->xCmp(pColl->pUser,pMem1->n,pMem1->z,pMem2->n,pMem2->z);
3747   }else{
3748     int rc;
3749     const void *v1, *v2;
3750     Mem c1;
3751     Mem c2;
3752     sqlite3VdbeMemInit(&c1, pMem1->db, MEM_Null);
3753     sqlite3VdbeMemInit(&c2, pMem1->db, MEM_Null);
3754     sqlite3VdbeMemShallowCopy(&c1, pMem1, MEM_Ephem);
3755     sqlite3VdbeMemShallowCopy(&c2, pMem2, MEM_Ephem);
3756     v1 = sqlite3ValueText((sqlite3_value*)&c1, pColl->enc);
3757     v2 = sqlite3ValueText((sqlite3_value*)&c2, pColl->enc);
3758     if( (v1==0 || v2==0) ){
3759       if( prcErr ) *prcErr = SQLITE_NOMEM_BKPT;
3760       rc = 0;
3761     }else{
3762       rc = pColl->xCmp(pColl->pUser, c1.n, v1, c2.n, v2);
3763     }
3764     sqlite3VdbeMemRelease(&c1);
3765     sqlite3VdbeMemRelease(&c2);
3766     return rc;
3767   }
3768 }
3769 
3770 /*
3771 ** The input pBlob is guaranteed to be a Blob that is not marked
3772 ** with MEM_Zero.  Return true if it could be a zero-blob.
3773 */
3774 static int isAllZero(const char *z, int n){
3775   int i;
3776   for(i=0; i<n; i++){
3777     if( z[i] ) return 0;
3778   }
3779   return 1;
3780 }
3781 
3782 /*
3783 ** Compare two blobs.  Return negative, zero, or positive if the first
3784 ** is less than, equal to, or greater than the second, respectively.
3785 ** If one blob is a prefix of the other, then the shorter is the lessor.
3786 */
3787 static SQLITE_NOINLINE int sqlite3BlobCompare(const Mem *pB1, const Mem *pB2){
3788   int c;
3789   int n1 = pB1->n;
3790   int n2 = pB2->n;
3791 
3792   /* It is possible to have a Blob value that has some non-zero content
3793   ** followed by zero content.  But that only comes up for Blobs formed
3794   ** by the OP_MakeRecord opcode, and such Blobs never get passed into
3795   ** sqlite3MemCompare(). */
3796   assert( (pB1->flags & MEM_Zero)==0 || n1==0 );
3797   assert( (pB2->flags & MEM_Zero)==0 || n2==0 );
3798 
3799   if( (pB1->flags|pB2->flags) & MEM_Zero ){
3800     if( pB1->flags & pB2->flags & MEM_Zero ){
3801       return pB1->u.nZero - pB2->u.nZero;
3802     }else if( pB1->flags & MEM_Zero ){
3803       if( !isAllZero(pB2->z, pB2->n) ) return -1;
3804       return pB1->u.nZero - n2;
3805     }else{
3806       if( !isAllZero(pB1->z, pB1->n) ) return +1;
3807       return n1 - pB2->u.nZero;
3808     }
3809   }
3810   c = memcmp(pB1->z, pB2->z, n1>n2 ? n2 : n1);
3811   if( c ) return c;
3812   return n1 - n2;
3813 }
3814 
3815 /*
3816 ** Do a comparison between a 64-bit signed integer and a 64-bit floating-point
3817 ** number.  Return negative, zero, or positive if the first (i64) is less than,
3818 ** equal to, or greater than the second (double).
3819 */
3820 static int sqlite3IntFloatCompare(i64 i, double r){
3821   if( sizeof(LONGDOUBLE_TYPE)>8 ){
3822     LONGDOUBLE_TYPE x = (LONGDOUBLE_TYPE)i;
3823     if( x<r ) return -1;
3824     if( x>r ) return +1;
3825     return 0;
3826   }else{
3827     i64 y;
3828     double s;
3829     if( r<-9223372036854775808.0 ) return +1;
3830     if( r>9223372036854775807.0 ) return -1;
3831     y = (i64)r;
3832     if( i<y ) return -1;
3833     if( i>y ){
3834       if( y==SMALLEST_INT64 && r>0.0 ) return -1;
3835       return +1;
3836     }
3837     s = (double)i;
3838     if( s<r ) return -1;
3839     if( s>r ) return +1;
3840     return 0;
3841   }
3842 }
3843 
3844 /*
3845 ** Compare the values contained by the two memory cells, returning
3846 ** negative, zero or positive if pMem1 is less than, equal to, or greater
3847 ** than pMem2. Sorting order is NULL's first, followed by numbers (integers
3848 ** and reals) sorted numerically, followed by text ordered by the collating
3849 ** sequence pColl and finally blob's ordered by memcmp().
3850 **
3851 ** Two NULL values are considered equal by this function.
3852 */
3853 int sqlite3MemCompare(const Mem *pMem1, const Mem *pMem2, const CollSeq *pColl){
3854   int f1, f2;
3855   int combined_flags;
3856 
3857   f1 = pMem1->flags;
3858   f2 = pMem2->flags;
3859   combined_flags = f1|f2;
3860   assert( (combined_flags & MEM_RowSet)==0 );
3861 
3862   /* If one value is NULL, it is less than the other. If both values
3863   ** are NULL, return 0.
3864   */
3865   if( combined_flags&MEM_Null ){
3866     return (f2&MEM_Null) - (f1&MEM_Null);
3867   }
3868 
3869   /* At least one of the two values is a number
3870   */
3871   if( combined_flags&(MEM_Int|MEM_Real) ){
3872     if( (f1 & f2 & MEM_Int)!=0 ){
3873       if( pMem1->u.i < pMem2->u.i ) return -1;
3874       if( pMem1->u.i > pMem2->u.i ) return +1;
3875       return 0;
3876     }
3877     if( (f1 & f2 & MEM_Real)!=0 ){
3878       if( pMem1->u.r < pMem2->u.r ) return -1;
3879       if( pMem1->u.r > pMem2->u.r ) return +1;
3880       return 0;
3881     }
3882     if( (f1&MEM_Int)!=0 ){
3883       if( (f2&MEM_Real)!=0 ){
3884         return sqlite3IntFloatCompare(pMem1->u.i, pMem2->u.r);
3885       }else{
3886         return -1;
3887       }
3888     }
3889     if( (f1&MEM_Real)!=0 ){
3890       if( (f2&MEM_Int)!=0 ){
3891         return -sqlite3IntFloatCompare(pMem2->u.i, pMem1->u.r);
3892       }else{
3893         return -1;
3894       }
3895     }
3896     return +1;
3897   }
3898 
3899   /* If one value is a string and the other is a blob, the string is less.
3900   ** If both are strings, compare using the collating functions.
3901   */
3902   if( combined_flags&MEM_Str ){
3903     if( (f1 & MEM_Str)==0 ){
3904       return 1;
3905     }
3906     if( (f2 & MEM_Str)==0 ){
3907       return -1;
3908     }
3909 
3910     assert( pMem1->enc==pMem2->enc || pMem1->db->mallocFailed );
3911     assert( pMem1->enc==SQLITE_UTF8 ||
3912             pMem1->enc==SQLITE_UTF16LE || pMem1->enc==SQLITE_UTF16BE );
3913 
3914     /* The collation sequence must be defined at this point, even if
3915     ** the user deletes the collation sequence after the vdbe program is
3916     ** compiled (this was not always the case).
3917     */
3918     assert( !pColl || pColl->xCmp );
3919 
3920     if( pColl ){
3921       return vdbeCompareMemString(pMem1, pMem2, pColl, 0);
3922     }
3923     /* If a NULL pointer was passed as the collate function, fall through
3924     ** to the blob case and use memcmp().  */
3925   }
3926 
3927   /* Both values must be blobs.  Compare using memcmp().  */
3928   return sqlite3BlobCompare(pMem1, pMem2);
3929 }
3930 
3931 
3932 /*
3933 ** The first argument passed to this function is a serial-type that
3934 ** corresponds to an integer - all values between 1 and 9 inclusive
3935 ** except 7. The second points to a buffer containing an integer value
3936 ** serialized according to serial_type. This function deserializes
3937 ** and returns the value.
3938 */
3939 static i64 vdbeRecordDecodeInt(u32 serial_type, const u8 *aKey){
3940   u32 y;
3941   assert( CORRUPT_DB || (serial_type>=1 && serial_type<=9 && serial_type!=7) );
3942   switch( serial_type ){
3943     case 0:
3944     case 1:
3945       testcase( aKey[0]&0x80 );
3946       return ONE_BYTE_INT(aKey);
3947     case 2:
3948       testcase( aKey[0]&0x80 );
3949       return TWO_BYTE_INT(aKey);
3950     case 3:
3951       testcase( aKey[0]&0x80 );
3952       return THREE_BYTE_INT(aKey);
3953     case 4: {
3954       testcase( aKey[0]&0x80 );
3955       y = FOUR_BYTE_UINT(aKey);
3956       return (i64)*(int*)&y;
3957     }
3958     case 5: {
3959       testcase( aKey[0]&0x80 );
3960       return FOUR_BYTE_UINT(aKey+2) + (((i64)1)<<32)*TWO_BYTE_INT(aKey);
3961     }
3962     case 6: {
3963       u64 x = FOUR_BYTE_UINT(aKey);
3964       testcase( aKey[0]&0x80 );
3965       x = (x<<32) | FOUR_BYTE_UINT(aKey+4);
3966       return (i64)*(i64*)&x;
3967     }
3968   }
3969 
3970   return (serial_type - 8);
3971 }
3972 
3973 /*
3974 ** This function compares the two table rows or index records
3975 ** specified by {nKey1, pKey1} and pPKey2.  It returns a negative, zero
3976 ** or positive integer if key1 is less than, equal to or
3977 ** greater than key2.  The {nKey1, pKey1} key must be a blob
3978 ** created by the OP_MakeRecord opcode of the VDBE.  The pPKey2
3979 ** key must be a parsed key such as obtained from
3980 ** sqlite3VdbeParseRecord.
3981 **
3982 ** If argument bSkip is non-zero, it is assumed that the caller has already
3983 ** determined that the first fields of the keys are equal.
3984 **
3985 ** Key1 and Key2 do not have to contain the same number of fields. If all
3986 ** fields that appear in both keys are equal, then pPKey2->default_rc is
3987 ** returned.
3988 **
3989 ** If database corruption is discovered, set pPKey2->errCode to
3990 ** SQLITE_CORRUPT and return 0. If an OOM error is encountered,
3991 ** pPKey2->errCode is set to SQLITE_NOMEM and, if it is not NULL, the
3992 ** malloc-failed flag set on database handle (pPKey2->pKeyInfo->db).
3993 */
3994 int sqlite3VdbeRecordCompareWithSkip(
3995   int nKey1, const void *pKey1,   /* Left key */
3996   UnpackedRecord *pPKey2,         /* Right key */
3997   int bSkip                       /* If true, skip the first field */
3998 ){
3999   u32 d1;                         /* Offset into aKey[] of next data element */
4000   int i;                          /* Index of next field to compare */
4001   u32 szHdr1;                     /* Size of record header in bytes */
4002   u32 idx1;                       /* Offset of first type in header */
4003   int rc = 0;                     /* Return value */
4004   Mem *pRhs = pPKey2->aMem;       /* Next field of pPKey2 to compare */
4005   KeyInfo *pKeyInfo = pPKey2->pKeyInfo;
4006   const unsigned char *aKey1 = (const unsigned char *)pKey1;
4007   Mem mem1;
4008 
4009   /* If bSkip is true, then the caller has already determined that the first
4010   ** two elements in the keys are equal. Fix the various stack variables so
4011   ** that this routine begins comparing at the second field. */
4012   if( bSkip ){
4013     u32 s1;
4014     idx1 = 1 + getVarint32(&aKey1[1], s1);
4015     szHdr1 = aKey1[0];
4016     d1 = szHdr1 + sqlite3VdbeSerialTypeLen(s1);
4017     i = 1;
4018     pRhs++;
4019   }else{
4020     idx1 = getVarint32(aKey1, szHdr1);
4021     d1 = szHdr1;
4022     if( d1>(unsigned)nKey1 ){
4023       pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4024       return 0;  /* Corruption */
4025     }
4026     i = 0;
4027   }
4028 
4029   VVA_ONLY( mem1.szMalloc = 0; ) /* Only needed by assert() statements */
4030   assert( pPKey2->pKeyInfo->nAllField>=pPKey2->nField
4031        || CORRUPT_DB );
4032   assert( pPKey2->pKeyInfo->aSortOrder!=0 );
4033   assert( pPKey2->pKeyInfo->nKeyField>0 );
4034   assert( idx1<=szHdr1 || CORRUPT_DB );
4035   do{
4036     u32 serial_type;
4037 
4038     /* RHS is an integer */
4039     if( pRhs->flags & MEM_Int ){
4040       serial_type = aKey1[idx1];
4041       testcase( serial_type==12 );
4042       if( serial_type>=10 ){
4043         rc = +1;
4044       }else if( serial_type==0 ){
4045         rc = -1;
4046       }else if( serial_type==7 ){
4047         sqlite3VdbeSerialGet(&aKey1[d1], serial_type, &mem1);
4048         rc = -sqlite3IntFloatCompare(pRhs->u.i, mem1.u.r);
4049       }else{
4050         i64 lhs = vdbeRecordDecodeInt(serial_type, &aKey1[d1]);
4051         i64 rhs = pRhs->u.i;
4052         if( lhs<rhs ){
4053           rc = -1;
4054         }else if( lhs>rhs ){
4055           rc = +1;
4056         }
4057       }
4058     }
4059 
4060     /* RHS is real */
4061     else if( pRhs->flags & MEM_Real ){
4062       serial_type = aKey1[idx1];
4063       if( serial_type>=10 ){
4064         /* Serial types 12 or greater are strings and blobs (greater than
4065         ** numbers). Types 10 and 11 are currently "reserved for future
4066         ** use", so it doesn't really matter what the results of comparing
4067         ** them to numberic values are.  */
4068         rc = +1;
4069       }else if( serial_type==0 ){
4070         rc = -1;
4071       }else{
4072         sqlite3VdbeSerialGet(&aKey1[d1], serial_type, &mem1);
4073         if( serial_type==7 ){
4074           if( mem1.u.r<pRhs->u.r ){
4075             rc = -1;
4076           }else if( mem1.u.r>pRhs->u.r ){
4077             rc = +1;
4078           }
4079         }else{
4080           rc = sqlite3IntFloatCompare(mem1.u.i, pRhs->u.r);
4081         }
4082       }
4083     }
4084 
4085     /* RHS is a string */
4086     else if( pRhs->flags & MEM_Str ){
4087       getVarint32(&aKey1[idx1], serial_type);
4088       testcase( serial_type==12 );
4089       if( serial_type<12 ){
4090         rc = -1;
4091       }else if( !(serial_type & 0x01) ){
4092         rc = +1;
4093       }else{
4094         mem1.n = (serial_type - 12) / 2;
4095         testcase( (d1+mem1.n)==(unsigned)nKey1 );
4096         testcase( (d1+mem1.n+1)==(unsigned)nKey1 );
4097         if( (d1+mem1.n) > (unsigned)nKey1 ){
4098           pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4099           return 0;                /* Corruption */
4100         }else if( pKeyInfo->aColl[i] ){
4101           mem1.enc = pKeyInfo->enc;
4102           mem1.db = pKeyInfo->db;
4103           mem1.flags = MEM_Str;
4104           mem1.z = (char*)&aKey1[d1];
4105           rc = vdbeCompareMemString(
4106               &mem1, pRhs, pKeyInfo->aColl[i], &pPKey2->errCode
4107           );
4108         }else{
4109           int nCmp = MIN(mem1.n, pRhs->n);
4110           rc = memcmp(&aKey1[d1], pRhs->z, nCmp);
4111           if( rc==0 ) rc = mem1.n - pRhs->n;
4112         }
4113       }
4114     }
4115 
4116     /* RHS is a blob */
4117     else if( pRhs->flags & MEM_Blob ){
4118       assert( (pRhs->flags & MEM_Zero)==0 || pRhs->n==0 );
4119       getVarint32(&aKey1[idx1], serial_type);
4120       testcase( serial_type==12 );
4121       if( serial_type<12 || (serial_type & 0x01) ){
4122         rc = -1;
4123       }else{
4124         int nStr = (serial_type - 12) / 2;
4125         testcase( (d1+nStr)==(unsigned)nKey1 );
4126         testcase( (d1+nStr+1)==(unsigned)nKey1 );
4127         if( (d1+nStr) > (unsigned)nKey1 ){
4128           pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4129           return 0;                /* Corruption */
4130         }else if( pRhs->flags & MEM_Zero ){
4131           if( !isAllZero((const char*)&aKey1[d1],nStr) ){
4132             rc = 1;
4133           }else{
4134             rc = nStr - pRhs->u.nZero;
4135           }
4136         }else{
4137           int nCmp = MIN(nStr, pRhs->n);
4138           rc = memcmp(&aKey1[d1], pRhs->z, nCmp);
4139           if( rc==0 ) rc = nStr - pRhs->n;
4140         }
4141       }
4142     }
4143 
4144     /* RHS is null */
4145     else{
4146       serial_type = aKey1[idx1];
4147       rc = (serial_type!=0);
4148     }
4149 
4150     if( rc!=0 ){
4151       if( pKeyInfo->aSortOrder[i] ){
4152         rc = -rc;
4153       }
4154       assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, rc) );
4155       assert( mem1.szMalloc==0 );  /* See comment below */
4156       return rc;
4157     }
4158 
4159     i++;
4160     pRhs++;
4161     d1 += sqlite3VdbeSerialTypeLen(serial_type);
4162     idx1 += sqlite3VarintLen(serial_type);
4163   }while( idx1<(unsigned)szHdr1 && i<pPKey2->nField && d1<=(unsigned)nKey1 );
4164 
4165   /* No memory allocation is ever used on mem1.  Prove this using
4166   ** the following assert().  If the assert() fails, it indicates a
4167   ** memory leak and a need to call sqlite3VdbeMemRelease(&mem1).  */
4168   assert( mem1.szMalloc==0 );
4169 
4170   /* rc==0 here means that one or both of the keys ran out of fields and
4171   ** all the fields up to that point were equal. Return the default_rc
4172   ** value.  */
4173   assert( CORRUPT_DB
4174        || vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, pPKey2->default_rc)
4175        || pKeyInfo->db->mallocFailed
4176   );
4177   pPKey2->eqSeen = 1;
4178   return pPKey2->default_rc;
4179 }
4180 int sqlite3VdbeRecordCompare(
4181   int nKey1, const void *pKey1,   /* Left key */
4182   UnpackedRecord *pPKey2          /* Right key */
4183 ){
4184   return sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 0);
4185 }
4186 
4187 
4188 /*
4189 ** This function is an optimized version of sqlite3VdbeRecordCompare()
4190 ** that (a) the first field of pPKey2 is an integer, and (b) the
4191 ** size-of-header varint at the start of (pKey1/nKey1) fits in a single
4192 ** byte (i.e. is less than 128).
4193 **
4194 ** To avoid concerns about buffer overreads, this routine is only used
4195 ** on schemas where the maximum valid header size is 63 bytes or less.
4196 */
4197 static int vdbeRecordCompareInt(
4198   int nKey1, const void *pKey1, /* Left key */
4199   UnpackedRecord *pPKey2        /* Right key */
4200 ){
4201   const u8 *aKey = &((const u8*)pKey1)[*(const u8*)pKey1 & 0x3F];
4202   int serial_type = ((const u8*)pKey1)[1];
4203   int res;
4204   u32 y;
4205   u64 x;
4206   i64 v;
4207   i64 lhs;
4208 
4209   vdbeAssertFieldCountWithinLimits(nKey1, pKey1, pPKey2->pKeyInfo);
4210   assert( (*(u8*)pKey1)<=0x3F || CORRUPT_DB );
4211   switch( serial_type ){
4212     case 1: { /* 1-byte signed integer */
4213       lhs = ONE_BYTE_INT(aKey);
4214       testcase( lhs<0 );
4215       break;
4216     }
4217     case 2: { /* 2-byte signed integer */
4218       lhs = TWO_BYTE_INT(aKey);
4219       testcase( lhs<0 );
4220       break;
4221     }
4222     case 3: { /* 3-byte signed integer */
4223       lhs = THREE_BYTE_INT(aKey);
4224       testcase( lhs<0 );
4225       break;
4226     }
4227     case 4: { /* 4-byte signed integer */
4228       y = FOUR_BYTE_UINT(aKey);
4229       lhs = (i64)*(int*)&y;
4230       testcase( lhs<0 );
4231       break;
4232     }
4233     case 5: { /* 6-byte signed integer */
4234       lhs = FOUR_BYTE_UINT(aKey+2) + (((i64)1)<<32)*TWO_BYTE_INT(aKey);
4235       testcase( lhs<0 );
4236       break;
4237     }
4238     case 6: { /* 8-byte signed integer */
4239       x = FOUR_BYTE_UINT(aKey);
4240       x = (x<<32) | FOUR_BYTE_UINT(aKey+4);
4241       lhs = *(i64*)&x;
4242       testcase( lhs<0 );
4243       break;
4244     }
4245     case 8:
4246       lhs = 0;
4247       break;
4248     case 9:
4249       lhs = 1;
4250       break;
4251 
4252     /* This case could be removed without changing the results of running
4253     ** this code. Including it causes gcc to generate a faster switch
4254     ** statement (since the range of switch targets now starts at zero and
4255     ** is contiguous) but does not cause any duplicate code to be generated
4256     ** (as gcc is clever enough to combine the two like cases). Other
4257     ** compilers might be similar.  */
4258     case 0: case 7:
4259       return sqlite3VdbeRecordCompare(nKey1, pKey1, pPKey2);
4260 
4261     default:
4262       return sqlite3VdbeRecordCompare(nKey1, pKey1, pPKey2);
4263   }
4264 
4265   v = pPKey2->aMem[0].u.i;
4266   if( v>lhs ){
4267     res = pPKey2->r1;
4268   }else if( v<lhs ){
4269     res = pPKey2->r2;
4270   }else if( pPKey2->nField>1 ){
4271     /* The first fields of the two keys are equal. Compare the trailing
4272     ** fields.  */
4273     res = sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 1);
4274   }else{
4275     /* The first fields of the two keys are equal and there are no trailing
4276     ** fields. Return pPKey2->default_rc in this case. */
4277     res = pPKey2->default_rc;
4278     pPKey2->eqSeen = 1;
4279   }
4280 
4281   assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, res) );
4282   return res;
4283 }
4284 
4285 /*
4286 ** This function is an optimized version of sqlite3VdbeRecordCompare()
4287 ** that (a) the first field of pPKey2 is a string, that (b) the first field
4288 ** uses the collation sequence BINARY and (c) that the size-of-header varint
4289 ** at the start of (pKey1/nKey1) fits in a single byte.
4290 */
4291 static int vdbeRecordCompareString(
4292   int nKey1, const void *pKey1, /* Left key */
4293   UnpackedRecord *pPKey2        /* Right key */
4294 ){
4295   const u8 *aKey1 = (const u8*)pKey1;
4296   int serial_type;
4297   int res;
4298 
4299   assert( pPKey2->aMem[0].flags & MEM_Str );
4300   vdbeAssertFieldCountWithinLimits(nKey1, pKey1, pPKey2->pKeyInfo);
4301   getVarint32(&aKey1[1], serial_type);
4302   if( serial_type<12 ){
4303     res = pPKey2->r1;      /* (pKey1/nKey1) is a number or a null */
4304   }else if( !(serial_type & 0x01) ){
4305     res = pPKey2->r2;      /* (pKey1/nKey1) is a blob */
4306   }else{
4307     int nCmp;
4308     int nStr;
4309     int szHdr = aKey1[0];
4310 
4311     nStr = (serial_type-12) / 2;
4312     if( (szHdr + nStr) > nKey1 ){
4313       pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4314       return 0;    /* Corruption */
4315     }
4316     nCmp = MIN( pPKey2->aMem[0].n, nStr );
4317     res = memcmp(&aKey1[szHdr], pPKey2->aMem[0].z, nCmp);
4318 
4319     if( res==0 ){
4320       res = nStr - pPKey2->aMem[0].n;
4321       if( res==0 ){
4322         if( pPKey2->nField>1 ){
4323           res = sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 1);
4324         }else{
4325           res = pPKey2->default_rc;
4326           pPKey2->eqSeen = 1;
4327         }
4328       }else if( res>0 ){
4329         res = pPKey2->r2;
4330       }else{
4331         res = pPKey2->r1;
4332       }
4333     }else if( res>0 ){
4334       res = pPKey2->r2;
4335     }else{
4336       res = pPKey2->r1;
4337     }
4338   }
4339 
4340   assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, res)
4341        || CORRUPT_DB
4342        || pPKey2->pKeyInfo->db->mallocFailed
4343   );
4344   return res;
4345 }
4346 
4347 /*
4348 ** Return a pointer to an sqlite3VdbeRecordCompare() compatible function
4349 ** suitable for comparing serialized records to the unpacked record passed
4350 ** as the only argument.
4351 */
4352 RecordCompare sqlite3VdbeFindCompare(UnpackedRecord *p){
4353   /* varintRecordCompareInt() and varintRecordCompareString() both assume
4354   ** that the size-of-header varint that occurs at the start of each record
4355   ** fits in a single byte (i.e. is 127 or less). varintRecordCompareInt()
4356   ** also assumes that it is safe to overread a buffer by at least the
4357   ** maximum possible legal header size plus 8 bytes. Because there is
4358   ** guaranteed to be at least 74 (but not 136) bytes of padding following each
4359   ** buffer passed to varintRecordCompareInt() this makes it convenient to
4360   ** limit the size of the header to 64 bytes in cases where the first field
4361   ** is an integer.
4362   **
4363   ** The easiest way to enforce this limit is to consider only records with
4364   ** 13 fields or less. If the first field is an integer, the maximum legal
4365   ** header size is (12*5 + 1 + 1) bytes.  */
4366   if( p->pKeyInfo->nAllField<=13 ){
4367     int flags = p->aMem[0].flags;
4368     if( p->pKeyInfo->aSortOrder[0] ){
4369       p->r1 = 1;
4370       p->r2 = -1;
4371     }else{
4372       p->r1 = -1;
4373       p->r2 = 1;
4374     }
4375     if( (flags & MEM_Int) ){
4376       return vdbeRecordCompareInt;
4377     }
4378     testcase( flags & MEM_Real );
4379     testcase( flags & MEM_Null );
4380     testcase( flags & MEM_Blob );
4381     if( (flags & (MEM_Real|MEM_Null|MEM_Blob))==0 && p->pKeyInfo->aColl[0]==0 ){
4382       assert( flags & MEM_Str );
4383       return vdbeRecordCompareString;
4384     }
4385   }
4386 
4387   return sqlite3VdbeRecordCompare;
4388 }
4389 
4390 /*
4391 ** pCur points at an index entry created using the OP_MakeRecord opcode.
4392 ** Read the rowid (the last field in the record) and store it in *rowid.
4393 ** Return SQLITE_OK if everything works, or an error code otherwise.
4394 **
4395 ** pCur might be pointing to text obtained from a corrupt database file.
4396 ** So the content cannot be trusted.  Do appropriate checks on the content.
4397 */
4398 int sqlite3VdbeIdxRowid(sqlite3 *db, BtCursor *pCur, i64 *rowid){
4399   i64 nCellKey = 0;
4400   int rc;
4401   u32 szHdr;        /* Size of the header */
4402   u32 typeRowid;    /* Serial type of the rowid */
4403   u32 lenRowid;     /* Size of the rowid */
4404   Mem m, v;
4405 
4406   /* Get the size of the index entry.  Only indices entries of less
4407   ** than 2GiB are support - anything large must be database corruption.
4408   ** Any corruption is detected in sqlite3BtreeParseCellPtr(), though, so
4409   ** this code can safely assume that nCellKey is 32-bits
4410   */
4411   assert( sqlite3BtreeCursorIsValid(pCur) );
4412   nCellKey = sqlite3BtreePayloadSize(pCur);
4413   assert( (nCellKey & SQLITE_MAX_U32)==(u64)nCellKey );
4414 
4415   /* Read in the complete content of the index entry */
4416   sqlite3VdbeMemInit(&m, db, 0);
4417   rc = sqlite3VdbeMemFromBtree(pCur, 0, (u32)nCellKey, &m);
4418   if( rc ){
4419     return rc;
4420   }
4421 
4422   /* The index entry must begin with a header size */
4423   (void)getVarint32((u8*)m.z, szHdr);
4424   testcase( szHdr==3 );
4425   testcase( szHdr==m.n );
4426   if( unlikely(szHdr<3 || (int)szHdr>m.n) ){
4427     goto idx_rowid_corruption;
4428   }
4429 
4430   /* The last field of the index should be an integer - the ROWID.
4431   ** Verify that the last entry really is an integer. */
4432   (void)getVarint32((u8*)&m.z[szHdr-1], typeRowid);
4433   testcase( typeRowid==1 );
4434   testcase( typeRowid==2 );
4435   testcase( typeRowid==3 );
4436   testcase( typeRowid==4 );
4437   testcase( typeRowid==5 );
4438   testcase( typeRowid==6 );
4439   testcase( typeRowid==8 );
4440   testcase( typeRowid==9 );
4441   if( unlikely(typeRowid<1 || typeRowid>9 || typeRowid==7) ){
4442     goto idx_rowid_corruption;
4443   }
4444   lenRowid = sqlite3SmallTypeSizes[typeRowid];
4445   testcase( (u32)m.n==szHdr+lenRowid );
4446   if( unlikely((u32)m.n<szHdr+lenRowid) ){
4447     goto idx_rowid_corruption;
4448   }
4449 
4450   /* Fetch the integer off the end of the index record */
4451   sqlite3VdbeSerialGet((u8*)&m.z[m.n-lenRowid], typeRowid, &v);
4452   *rowid = v.u.i;
4453   sqlite3VdbeMemRelease(&m);
4454   return SQLITE_OK;
4455 
4456   /* Jump here if database corruption is detected after m has been
4457   ** allocated.  Free the m object and return SQLITE_CORRUPT. */
4458 idx_rowid_corruption:
4459   testcase( m.szMalloc!=0 );
4460   sqlite3VdbeMemRelease(&m);
4461   return SQLITE_CORRUPT_BKPT;
4462 }
4463 
4464 /*
4465 ** Compare the key of the index entry that cursor pC is pointing to against
4466 ** the key string in pUnpacked.  Write into *pRes a number
4467 ** that is negative, zero, or positive if pC is less than, equal to,
4468 ** or greater than pUnpacked.  Return SQLITE_OK on success.
4469 **
4470 ** pUnpacked is either created without a rowid or is truncated so that it
4471 ** omits the rowid at the end.  The rowid at the end of the index entry
4472 ** is ignored as well.  Hence, this routine only compares the prefixes
4473 ** of the keys prior to the final rowid, not the entire key.
4474 */
4475 int sqlite3VdbeIdxKeyCompare(
4476   sqlite3 *db,                     /* Database connection */
4477   VdbeCursor *pC,                  /* The cursor to compare against */
4478   UnpackedRecord *pUnpacked,       /* Unpacked version of key */
4479   int *res                         /* Write the comparison result here */
4480 ){
4481   i64 nCellKey = 0;
4482   int rc;
4483   BtCursor *pCur;
4484   Mem m;
4485 
4486   assert( pC->eCurType==CURTYPE_BTREE );
4487   pCur = pC->uc.pCursor;
4488   assert( sqlite3BtreeCursorIsValid(pCur) );
4489   nCellKey = sqlite3BtreePayloadSize(pCur);
4490   /* nCellKey will always be between 0 and 0xffffffff because of the way
4491   ** that btreeParseCellPtr() and sqlite3GetVarint32() are implemented */
4492   if( nCellKey<=0 || nCellKey>0x7fffffff ){
4493     *res = 0;
4494     return SQLITE_CORRUPT_BKPT;
4495   }
4496   sqlite3VdbeMemInit(&m, db, 0);
4497   rc = sqlite3VdbeMemFromBtree(pCur, 0, (u32)nCellKey, &m);
4498   if( rc ){
4499     return rc;
4500   }
4501   *res = sqlite3VdbeRecordCompare(m.n, m.z, pUnpacked);
4502   sqlite3VdbeMemRelease(&m);
4503   return SQLITE_OK;
4504 }
4505 
4506 /*
4507 ** This routine sets the value to be returned by subsequent calls to
4508 ** sqlite3_changes() on the database handle 'db'.
4509 */
4510 void sqlite3VdbeSetChanges(sqlite3 *db, int nChange){
4511   assert( sqlite3_mutex_held(db->mutex) );
4512   db->nChange = nChange;
4513   db->nTotalChange += nChange;
4514 }
4515 
4516 /*
4517 ** Set a flag in the vdbe to update the change counter when it is finalised
4518 ** or reset.
4519 */
4520 void sqlite3VdbeCountChanges(Vdbe *v){
4521   v->changeCntOn = 1;
4522 }
4523 
4524 /*
4525 ** Mark every prepared statement associated with a database connection
4526 ** as expired.
4527 **
4528 ** An expired statement means that recompilation of the statement is
4529 ** recommend.  Statements expire when things happen that make their
4530 ** programs obsolete.  Removing user-defined functions or collating
4531 ** sequences, or changing an authorization function are the types of
4532 ** things that make prepared statements obsolete.
4533 */
4534 void sqlite3ExpirePreparedStatements(sqlite3 *db){
4535   Vdbe *p;
4536   for(p = db->pVdbe; p; p=p->pNext){
4537     p->expired = 1;
4538   }
4539 }
4540 
4541 /*
4542 ** Return the database associated with the Vdbe.
4543 */
4544 sqlite3 *sqlite3VdbeDb(Vdbe *v){
4545   return v->db;
4546 }
4547 
4548 /*
4549 ** Return the SQLITE_PREPARE flags for a Vdbe.
4550 */
4551 u8 sqlite3VdbePrepareFlags(Vdbe *v){
4552   return v->prepFlags;
4553 }
4554 
4555 /*
4556 ** Return a pointer to an sqlite3_value structure containing the value bound
4557 ** parameter iVar of VM v. Except, if the value is an SQL NULL, return
4558 ** 0 instead. Unless it is NULL, apply affinity aff (one of the SQLITE_AFF_*
4559 ** constants) to the value before returning it.
4560 **
4561 ** The returned value must be freed by the caller using sqlite3ValueFree().
4562 */
4563 sqlite3_value *sqlite3VdbeGetBoundValue(Vdbe *v, int iVar, u8 aff){
4564   assert( iVar>0 );
4565   if( v ){
4566     Mem *pMem = &v->aVar[iVar-1];
4567     assert( (v->db->flags & SQLITE_EnableQPSG)==0 );
4568     if( 0==(pMem->flags & MEM_Null) ){
4569       sqlite3_value *pRet = sqlite3ValueNew(v->db);
4570       if( pRet ){
4571         sqlite3VdbeMemCopy((Mem *)pRet, pMem);
4572         sqlite3ValueApplyAffinity(pRet, aff, SQLITE_UTF8);
4573       }
4574       return pRet;
4575     }
4576   }
4577   return 0;
4578 }
4579 
4580 /*
4581 ** Configure SQL variable iVar so that binding a new value to it signals
4582 ** to sqlite3_reoptimize() that re-preparing the statement may result
4583 ** in a better query plan.
4584 */
4585 void sqlite3VdbeSetVarmask(Vdbe *v, int iVar){
4586   assert( iVar>0 );
4587   assert( (v->db->flags & SQLITE_EnableQPSG)==0 );
4588   if( iVar>=32 ){
4589     v->expmask |= 0x80000000;
4590   }else{
4591     v->expmask |= ((u32)1 << (iVar-1));
4592   }
4593 }
4594 
4595 /*
4596 ** Cause a function to throw an error if it was call from OP_PureFunc
4597 ** rather than OP_Function.
4598 **
4599 ** OP_PureFunc means that the function must be deterministic, and should
4600 ** throw an error if it is given inputs that would make it non-deterministic.
4601 ** This routine is invoked by date/time functions that use non-deterministic
4602 ** features such as 'now'.
4603 */
4604 int sqlite3NotPureFunc(sqlite3_context *pCtx){
4605 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
4606   if( pCtx->pVdbe==0 ) return 1;
4607 #endif
4608   if( pCtx->pVdbe->aOp[pCtx->iOp].opcode==OP_PureFunc ){
4609     sqlite3_result_error(pCtx,
4610        "non-deterministic function in index expression or CHECK constraint",
4611        -1);
4612     return 0;
4613   }
4614   return 1;
4615 }
4616 
4617 #ifndef SQLITE_OMIT_VIRTUALTABLE
4618 /*
4619 ** Transfer error message text from an sqlite3_vtab.zErrMsg (text stored
4620 ** in memory obtained from sqlite3_malloc) into a Vdbe.zErrMsg (text stored
4621 ** in memory obtained from sqlite3DbMalloc).
4622 */
4623 void sqlite3VtabImportErrmsg(Vdbe *p, sqlite3_vtab *pVtab){
4624   if( pVtab->zErrMsg ){
4625     sqlite3 *db = p->db;
4626     sqlite3DbFree(db, p->zErrMsg);
4627     p->zErrMsg = sqlite3DbStrDup(db, pVtab->zErrMsg);
4628     sqlite3_free(pVtab->zErrMsg);
4629     pVtab->zErrMsg = 0;
4630   }
4631 }
4632 #endif /* SQLITE_OMIT_VIRTUALTABLE */
4633 
4634 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
4635 
4636 /*
4637 ** If the second argument is not NULL, release any allocations associated
4638 ** with the memory cells in the p->aMem[] array. Also free the UnpackedRecord
4639 ** structure itself, using sqlite3DbFree().
4640 **
4641 ** This function is used to free UnpackedRecord structures allocated by
4642 ** the vdbeUnpackRecord() function found in vdbeapi.c.
4643 */
4644 static void vdbeFreeUnpacked(sqlite3 *db, int nField, UnpackedRecord *p){
4645   if( p ){
4646     int i;
4647     for(i=0; i<nField; i++){
4648       Mem *pMem = &p->aMem[i];
4649       if( pMem->zMalloc ) sqlite3VdbeMemRelease(pMem);
4650     }
4651     sqlite3DbFreeNN(db, p);
4652   }
4653 }
4654 #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
4655 
4656 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
4657 /*
4658 ** Invoke the pre-update hook. If this is an UPDATE or DELETE pre-update call,
4659 ** then cursor passed as the second argument should point to the row about
4660 ** to be update or deleted. If the application calls sqlite3_preupdate_old(),
4661 ** the required value will be read from the row the cursor points to.
4662 */
4663 void sqlite3VdbePreUpdateHook(
4664   Vdbe *v,                        /* Vdbe pre-update hook is invoked by */
4665   VdbeCursor *pCsr,               /* Cursor to grab old.* values from */
4666   int op,                         /* SQLITE_INSERT, UPDATE or DELETE */
4667   const char *zDb,                /* Database name */
4668   Table *pTab,                    /* Modified table */
4669   i64 iKey1,                      /* Initial key value */
4670   int iReg                        /* Register for new.* record */
4671 ){
4672   sqlite3 *db = v->db;
4673   i64 iKey2;
4674   PreUpdate preupdate;
4675   const char *zTbl = pTab->zName;
4676   static const u8 fakeSortOrder = 0;
4677 
4678   assert( db->pPreUpdate==0 );
4679   memset(&preupdate, 0, sizeof(PreUpdate));
4680   if( HasRowid(pTab)==0 ){
4681     iKey1 = iKey2 = 0;
4682     preupdate.pPk = sqlite3PrimaryKeyIndex(pTab);
4683   }else{
4684     if( op==SQLITE_UPDATE ){
4685       iKey2 = v->aMem[iReg].u.i;
4686     }else{
4687       iKey2 = iKey1;
4688     }
4689   }
4690 
4691   assert( pCsr->nField==pTab->nCol
4692        || (pCsr->nField==pTab->nCol+1 && op==SQLITE_DELETE && iReg==-1)
4693   );
4694 
4695   preupdate.v = v;
4696   preupdate.pCsr = pCsr;
4697   preupdate.op = op;
4698   preupdate.iNewReg = iReg;
4699   preupdate.keyinfo.db = db;
4700   preupdate.keyinfo.enc = ENC(db);
4701   preupdate.keyinfo.nKeyField = pTab->nCol;
4702   preupdate.keyinfo.aSortOrder = (u8*)&fakeSortOrder;
4703   preupdate.iKey1 = iKey1;
4704   preupdate.iKey2 = iKey2;
4705   preupdate.pTab = pTab;
4706 
4707   db->pPreUpdate = &preupdate;
4708   db->xPreUpdateCallback(db->pPreUpdateArg, db, op, zDb, zTbl, iKey1, iKey2);
4709   db->pPreUpdate = 0;
4710   sqlite3DbFree(db, preupdate.aRecord);
4711   vdbeFreeUnpacked(db, preupdate.keyinfo.nKeyField+1, preupdate.pUnpacked);
4712   vdbeFreeUnpacked(db, preupdate.keyinfo.nKeyField+1, preupdate.pNewUnpacked);
4713   if( preupdate.aNew ){
4714     int i;
4715     for(i=0; i<pCsr->nField; i++){
4716       sqlite3VdbeMemRelease(&preupdate.aNew[i]);
4717     }
4718     sqlite3DbFreeNN(db, preupdate.aNew);
4719   }
4720 }
4721 #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
4722