xref: /sqlite-3.40.0/src/vdbeaux.c (revision 88f769f9)
1 /*
2 ** 2003 September 6
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 ** This file contains code used for creating, destroying, and populating
13 ** a VDBE (or an "sqlite3_stmt" as it is known to the outside world.)
14 */
15 #include "sqliteInt.h"
16 #include "vdbeInt.h"
17 
18 /*
19 ** Create a new virtual database engine.
20 */
21 Vdbe *sqlite3VdbeCreate(Parse *pParse){
22   sqlite3 *db = pParse->db;
23   Vdbe *p;
24   p = sqlite3DbMallocRawNN(db, sizeof(Vdbe) );
25   if( p==0 ) return 0;
26   memset(&p->aOp, 0, sizeof(Vdbe)-offsetof(Vdbe,aOp));
27   p->db = db;
28   if( db->pVdbe ){
29     db->pVdbe->pPrev = p;
30   }
31   p->pNext = db->pVdbe;
32   p->pPrev = 0;
33   db->pVdbe = p;
34   p->magic = VDBE_MAGIC_INIT;
35   p->pParse = pParse;
36   assert( pParse->aLabel==0 );
37   assert( pParse->nLabel==0 );
38   assert( pParse->nOpAlloc==0 );
39   assert( pParse->szOpAlloc==0 );
40   return p;
41 }
42 
43 /*
44 ** Change the error string stored in Vdbe.zErrMsg
45 */
46 void sqlite3VdbeError(Vdbe *p, const char *zFormat, ...){
47   va_list ap;
48   sqlite3DbFree(p->db, p->zErrMsg);
49   va_start(ap, zFormat);
50   p->zErrMsg = sqlite3VMPrintf(p->db, zFormat, ap);
51   va_end(ap);
52 }
53 
54 /*
55 ** Remember the SQL string for a prepared statement.
56 */
57 void sqlite3VdbeSetSql(Vdbe *p, const char *z, int n, u8 prepFlags){
58   if( p==0 ) return;
59   p->prepFlags = prepFlags;
60   if( (prepFlags & SQLITE_PREPARE_SAVESQL)==0 ){
61     p->expmask = 0;
62   }
63   assert( p->zSql==0 );
64   p->zSql = sqlite3DbStrNDup(p->db, z, n);
65 }
66 
67 /*
68 ** Swap all content between two VDBE structures.
69 */
70 void sqlite3VdbeSwap(Vdbe *pA, Vdbe *pB){
71   Vdbe tmp, *pTmp;
72   char *zTmp;
73   assert( pA->db==pB->db );
74   tmp = *pA;
75   *pA = *pB;
76   *pB = tmp;
77   pTmp = pA->pNext;
78   pA->pNext = pB->pNext;
79   pB->pNext = pTmp;
80   pTmp = pA->pPrev;
81   pA->pPrev = pB->pPrev;
82   pB->pPrev = pTmp;
83   zTmp = pA->zSql;
84   pA->zSql = pB->zSql;
85   pB->zSql = zTmp;
86   pB->expmask = pA->expmask;
87   pB->prepFlags = pA->prepFlags;
88   memcpy(pB->aCounter, pA->aCounter, sizeof(pB->aCounter));
89   pB->aCounter[SQLITE_STMTSTATUS_REPREPARE]++;
90 }
91 
92 /*
93 ** Resize the Vdbe.aOp array so that it is at least nOp elements larger
94 ** than its current size. nOp is guaranteed to be less than or equal
95 ** to 1024/sizeof(Op).
96 **
97 ** If an out-of-memory error occurs while resizing the array, return
98 ** SQLITE_NOMEM. In this case Vdbe.aOp and Parse.nOpAlloc remain
99 ** unchanged (this is so that any opcodes already allocated can be
100 ** correctly deallocated along with the rest of the Vdbe).
101 */
102 static int growOpArray(Vdbe *v, int nOp){
103   VdbeOp *pNew;
104   Parse *p = v->pParse;
105 
106   /* The SQLITE_TEST_REALLOC_STRESS compile-time option is designed to force
107   ** more frequent reallocs and hence provide more opportunities for
108   ** simulated OOM faults.  SQLITE_TEST_REALLOC_STRESS is generally used
109   ** during testing only.  With SQLITE_TEST_REALLOC_STRESS grow the op array
110   ** by the minimum* amount required until the size reaches 512.  Normal
111   ** operation (without SQLITE_TEST_REALLOC_STRESS) is to double the current
112   ** size of the op array or add 1KB of space, whichever is smaller. */
113 #ifdef SQLITE_TEST_REALLOC_STRESS
114   int nNew = (p->nOpAlloc>=512 ? p->nOpAlloc*2 : p->nOpAlloc+nOp);
115 #else
116   int nNew = (p->nOpAlloc ? p->nOpAlloc*2 : (int)(1024/sizeof(Op)));
117   UNUSED_PARAMETER(nOp);
118 #endif
119 
120   /* Ensure that the size of a VDBE does not grow too large */
121   if( nNew > p->db->aLimit[SQLITE_LIMIT_VDBE_OP] ){
122     sqlite3OomFault(p->db);
123     return SQLITE_NOMEM;
124   }
125 
126   assert( nOp<=(1024/sizeof(Op)) );
127   assert( nNew>=(p->nOpAlloc+nOp) );
128   pNew = sqlite3DbRealloc(p->db, v->aOp, nNew*sizeof(Op));
129   if( pNew ){
130     p->szOpAlloc = sqlite3DbMallocSize(p->db, pNew);
131     p->nOpAlloc = p->szOpAlloc/sizeof(Op);
132     v->aOp = pNew;
133   }
134   return (pNew ? SQLITE_OK : SQLITE_NOMEM_BKPT);
135 }
136 
137 #ifdef SQLITE_DEBUG
138 /* This routine is just a convenient place to set a breakpoint that will
139 ** fire after each opcode is inserted and displayed using
140 ** "PRAGMA vdbe_addoptrace=on".
141 */
142 static void test_addop_breakpoint(void){
143   static int n = 0;
144   n++;
145 }
146 #endif
147 
148 /*
149 ** Add a new instruction to the list of instructions current in the
150 ** VDBE.  Return the address of the new instruction.
151 **
152 ** Parameters:
153 **
154 **    p               Pointer to the VDBE
155 **
156 **    op              The opcode for this instruction
157 **
158 **    p1, p2, p3      Operands
159 **
160 ** Use the sqlite3VdbeResolveLabel() function to fix an address and
161 ** the sqlite3VdbeChangeP4() function to change the value of the P4
162 ** operand.
163 */
164 static SQLITE_NOINLINE int growOp3(Vdbe *p, int op, int p1, int p2, int p3){
165   assert( p->pParse->nOpAlloc<=p->nOp );
166   if( growOpArray(p, 1) ) return 1;
167   assert( p->pParse->nOpAlloc>p->nOp );
168   return sqlite3VdbeAddOp3(p, op, p1, p2, p3);
169 }
170 int sqlite3VdbeAddOp3(Vdbe *p, int op, int p1, int p2, int p3){
171   int i;
172   VdbeOp *pOp;
173 
174   i = p->nOp;
175   assert( p->magic==VDBE_MAGIC_INIT );
176   assert( op>=0 && op<0xff );
177   if( p->pParse->nOpAlloc<=i ){
178     return growOp3(p, op, p1, p2, p3);
179   }
180   p->nOp++;
181   pOp = &p->aOp[i];
182   pOp->opcode = (u8)op;
183   pOp->p5 = 0;
184   pOp->p1 = p1;
185   pOp->p2 = p2;
186   pOp->p3 = p3;
187   pOp->p4.p = 0;
188   pOp->p4type = P4_NOTUSED;
189 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
190   pOp->zComment = 0;
191 #endif
192 #ifdef SQLITE_DEBUG
193   if( p->db->flags & SQLITE_VdbeAddopTrace ){
194     int jj, kk;
195     Parse *pParse = p->pParse;
196     for(jj=kk=0; jj<pParse->nColCache; jj++){
197       struct yColCache *x = pParse->aColCache + jj;
198       printf(" r[%d]={%d:%d}", x->iReg, x->iTable, x->iColumn);
199       kk++;
200     }
201     if( kk ) printf("\n");
202     sqlite3VdbePrintOp(0, i, &p->aOp[i]);
203     test_addop_breakpoint();
204   }
205 #endif
206 #ifdef VDBE_PROFILE
207   pOp->cycles = 0;
208   pOp->cnt = 0;
209 #endif
210 #ifdef SQLITE_VDBE_COVERAGE
211   pOp->iSrcLine = 0;
212 #endif
213   return i;
214 }
215 int sqlite3VdbeAddOp0(Vdbe *p, int op){
216   return sqlite3VdbeAddOp3(p, op, 0, 0, 0);
217 }
218 int sqlite3VdbeAddOp1(Vdbe *p, int op, int p1){
219   return sqlite3VdbeAddOp3(p, op, p1, 0, 0);
220 }
221 int sqlite3VdbeAddOp2(Vdbe *p, int op, int p1, int p2){
222   return sqlite3VdbeAddOp3(p, op, p1, p2, 0);
223 }
224 
225 /* Generate code for an unconditional jump to instruction iDest
226 */
227 int sqlite3VdbeGoto(Vdbe *p, int iDest){
228   return sqlite3VdbeAddOp3(p, OP_Goto, 0, iDest, 0);
229 }
230 
231 /* Generate code to cause the string zStr to be loaded into
232 ** register iDest
233 */
234 int sqlite3VdbeLoadString(Vdbe *p, int iDest, const char *zStr){
235   return sqlite3VdbeAddOp4(p, OP_String8, 0, iDest, 0, zStr, 0);
236 }
237 
238 /*
239 ** Generate code that initializes multiple registers to string or integer
240 ** constants.  The registers begin with iDest and increase consecutively.
241 ** One register is initialized for each characgter in zTypes[].  For each
242 ** "s" character in zTypes[], the register is a string if the argument is
243 ** not NULL, or OP_Null if the value is a null pointer.  For each "i" character
244 ** in zTypes[], the register is initialized to an integer.
245 */
246 void sqlite3VdbeMultiLoad(Vdbe *p, int iDest, const char *zTypes, ...){
247   va_list ap;
248   int i;
249   char c;
250   va_start(ap, zTypes);
251   for(i=0; (c = zTypes[i])!=0; i++){
252     if( c=='s' ){
253       const char *z = va_arg(ap, const char*);
254       sqlite3VdbeAddOp4(p, z==0 ? OP_Null : OP_String8, 0, iDest++, 0, z, 0);
255     }else{
256       assert( c=='i' );
257       sqlite3VdbeAddOp2(p, OP_Integer, va_arg(ap, int), iDest++);
258     }
259   }
260   va_end(ap);
261 }
262 
263 /*
264 ** Add an opcode that includes the p4 value as a pointer.
265 */
266 int sqlite3VdbeAddOp4(
267   Vdbe *p,            /* Add the opcode to this VM */
268   int op,             /* The new opcode */
269   int p1,             /* The P1 operand */
270   int p2,             /* The P2 operand */
271   int p3,             /* The P3 operand */
272   const char *zP4,    /* The P4 operand */
273   int p4type          /* P4 operand type */
274 ){
275   int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
276   sqlite3VdbeChangeP4(p, addr, zP4, p4type);
277   return addr;
278 }
279 
280 /*
281 ** Add an opcode that includes the p4 value with a P4_INT64 or
282 ** P4_REAL type.
283 */
284 int sqlite3VdbeAddOp4Dup8(
285   Vdbe *p,            /* Add the opcode to this VM */
286   int op,             /* The new opcode */
287   int p1,             /* The P1 operand */
288   int p2,             /* The P2 operand */
289   int p3,             /* The P3 operand */
290   const u8 *zP4,      /* The P4 operand */
291   int p4type          /* P4 operand type */
292 ){
293   char *p4copy = sqlite3DbMallocRawNN(sqlite3VdbeDb(p), 8);
294   if( p4copy ) memcpy(p4copy, zP4, 8);
295   return sqlite3VdbeAddOp4(p, op, p1, p2, p3, p4copy, p4type);
296 }
297 
298 /*
299 ** Add an OP_ParseSchema opcode.  This routine is broken out from
300 ** sqlite3VdbeAddOp4() since it needs to also needs to mark all btrees
301 ** as having been used.
302 **
303 ** The zWhere string must have been obtained from sqlite3_malloc().
304 ** This routine will take ownership of the allocated memory.
305 */
306 void sqlite3VdbeAddParseSchemaOp(Vdbe *p, int iDb, char *zWhere){
307   int j;
308   sqlite3VdbeAddOp4(p, OP_ParseSchema, iDb, 0, 0, zWhere, P4_DYNAMIC);
309   for(j=0; j<p->db->nDb; j++) sqlite3VdbeUsesBtree(p, j);
310 }
311 
312 /*
313 ** Add an opcode that includes the p4 value as an integer.
314 */
315 int sqlite3VdbeAddOp4Int(
316   Vdbe *p,            /* Add the opcode to this VM */
317   int op,             /* The new opcode */
318   int p1,             /* The P1 operand */
319   int p2,             /* The P2 operand */
320   int p3,             /* The P3 operand */
321   int p4              /* The P4 operand as an integer */
322 ){
323   int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
324   if( p->db->mallocFailed==0 ){
325     VdbeOp *pOp = &p->aOp[addr];
326     pOp->p4type = P4_INT32;
327     pOp->p4.i = p4;
328   }
329   return addr;
330 }
331 
332 /* Insert the end of a co-routine
333 */
334 void sqlite3VdbeEndCoroutine(Vdbe *v, int regYield){
335   sqlite3VdbeAddOp1(v, OP_EndCoroutine, regYield);
336 
337   /* Clear the temporary register cache, thereby ensuring that each
338   ** co-routine has its own independent set of registers, because co-routines
339   ** might expect their registers to be preserved across an OP_Yield, and
340   ** that could cause problems if two or more co-routines are using the same
341   ** temporary register.
342   */
343   v->pParse->nTempReg = 0;
344   v->pParse->nRangeReg = 0;
345 }
346 
347 /*
348 ** Create a new symbolic label for an instruction that has yet to be
349 ** coded.  The symbolic label is really just a negative number.  The
350 ** label can be used as the P2 value of an operation.  Later, when
351 ** the label is resolved to a specific address, the VDBE will scan
352 ** through its operation list and change all values of P2 which match
353 ** the label into the resolved address.
354 **
355 ** The VDBE knows that a P2 value is a label because labels are
356 ** always negative and P2 values are suppose to be non-negative.
357 ** Hence, a negative P2 value is a label that has yet to be resolved.
358 **
359 ** Zero is returned if a malloc() fails.
360 */
361 int sqlite3VdbeMakeLabel(Vdbe *v){
362   Parse *p = v->pParse;
363   int i = p->nLabel++;
364   assert( v->magic==VDBE_MAGIC_INIT );
365   if( (i & (i-1))==0 ){
366     p->aLabel = sqlite3DbReallocOrFree(p->db, p->aLabel,
367                                        (i*2+1)*sizeof(p->aLabel[0]));
368   }
369   if( p->aLabel ){
370     p->aLabel[i] = -1;
371   }
372   return ADDR(i);
373 }
374 
375 /*
376 ** Resolve label "x" to be the address of the next instruction to
377 ** be inserted.  The parameter "x" must have been obtained from
378 ** a prior call to sqlite3VdbeMakeLabel().
379 */
380 void sqlite3VdbeResolveLabel(Vdbe *v, int x){
381   Parse *p = v->pParse;
382   int j = ADDR(x);
383   assert( v->magic==VDBE_MAGIC_INIT );
384   assert( j<p->nLabel );
385   assert( j>=0 );
386   if( p->aLabel ){
387     p->aLabel[j] = v->nOp;
388   }
389 }
390 
391 /*
392 ** Mark the VDBE as one that can only be run one time.
393 */
394 void sqlite3VdbeRunOnlyOnce(Vdbe *p){
395   p->runOnlyOnce = 1;
396 }
397 
398 /*
399 ** Mark the VDBE as one that can only be run multiple times.
400 */
401 void sqlite3VdbeReusable(Vdbe *p){
402   p->runOnlyOnce = 0;
403 }
404 
405 #ifdef SQLITE_DEBUG /* sqlite3AssertMayAbort() logic */
406 
407 /*
408 ** The following type and function are used to iterate through all opcodes
409 ** in a Vdbe main program and each of the sub-programs (triggers) it may
410 ** invoke directly or indirectly. It should be used as follows:
411 **
412 **   Op *pOp;
413 **   VdbeOpIter sIter;
414 **
415 **   memset(&sIter, 0, sizeof(sIter));
416 **   sIter.v = v;                            // v is of type Vdbe*
417 **   while( (pOp = opIterNext(&sIter)) ){
418 **     // Do something with pOp
419 **   }
420 **   sqlite3DbFree(v->db, sIter.apSub);
421 **
422 */
423 typedef struct VdbeOpIter VdbeOpIter;
424 struct VdbeOpIter {
425   Vdbe *v;                   /* Vdbe to iterate through the opcodes of */
426   SubProgram **apSub;        /* Array of subprograms */
427   int nSub;                  /* Number of entries in apSub */
428   int iAddr;                 /* Address of next instruction to return */
429   int iSub;                  /* 0 = main program, 1 = first sub-program etc. */
430 };
431 static Op *opIterNext(VdbeOpIter *p){
432   Vdbe *v = p->v;
433   Op *pRet = 0;
434   Op *aOp;
435   int nOp;
436 
437   if( p->iSub<=p->nSub ){
438 
439     if( p->iSub==0 ){
440       aOp = v->aOp;
441       nOp = v->nOp;
442     }else{
443       aOp = p->apSub[p->iSub-1]->aOp;
444       nOp = p->apSub[p->iSub-1]->nOp;
445     }
446     assert( p->iAddr<nOp );
447 
448     pRet = &aOp[p->iAddr];
449     p->iAddr++;
450     if( p->iAddr==nOp ){
451       p->iSub++;
452       p->iAddr = 0;
453     }
454 
455     if( pRet->p4type==P4_SUBPROGRAM ){
456       int nByte = (p->nSub+1)*sizeof(SubProgram*);
457       int j;
458       for(j=0; j<p->nSub; j++){
459         if( p->apSub[j]==pRet->p4.pProgram ) break;
460       }
461       if( j==p->nSub ){
462         p->apSub = sqlite3DbReallocOrFree(v->db, p->apSub, nByte);
463         if( !p->apSub ){
464           pRet = 0;
465         }else{
466           p->apSub[p->nSub++] = pRet->p4.pProgram;
467         }
468       }
469     }
470   }
471 
472   return pRet;
473 }
474 
475 /*
476 ** Check if the program stored in the VM associated with pParse may
477 ** throw an ABORT exception (causing the statement, but not entire transaction
478 ** to be rolled back). This condition is true if the main program or any
479 ** sub-programs contains any of the following:
480 **
481 **   *  OP_Halt with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
482 **   *  OP_HaltIfNull with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
483 **   *  OP_Destroy
484 **   *  OP_VUpdate
485 **   *  OP_VRename
486 **   *  OP_FkCounter with P2==0 (immediate foreign key constraint)
487 **   *  OP_CreateTable and OP_InitCoroutine (for CREATE TABLE AS SELECT ...)
488 **
489 ** Then check that the value of Parse.mayAbort is true if an
490 ** ABORT may be thrown, or false otherwise. Return true if it does
491 ** match, or false otherwise. This function is intended to be used as
492 ** part of an assert statement in the compiler. Similar to:
493 **
494 **   assert( sqlite3VdbeAssertMayAbort(pParse->pVdbe, pParse->mayAbort) );
495 */
496 int sqlite3VdbeAssertMayAbort(Vdbe *v, int mayAbort){
497   int hasAbort = 0;
498   int hasFkCounter = 0;
499   int hasCreateTable = 0;
500   int hasInitCoroutine = 0;
501   Op *pOp;
502   VdbeOpIter sIter;
503   memset(&sIter, 0, sizeof(sIter));
504   sIter.v = v;
505 
506   while( (pOp = opIterNext(&sIter))!=0 ){
507     int opcode = pOp->opcode;
508     if( opcode==OP_Destroy || opcode==OP_VUpdate || opcode==OP_VRename
509      || ((opcode==OP_Halt || opcode==OP_HaltIfNull)
510       && ((pOp->p1&0xff)==SQLITE_CONSTRAINT && pOp->p2==OE_Abort))
511     ){
512       hasAbort = 1;
513       break;
514     }
515     if( opcode==OP_CreateTable ) hasCreateTable = 1;
516     if( opcode==OP_InitCoroutine ) hasInitCoroutine = 1;
517 #ifndef SQLITE_OMIT_FOREIGN_KEY
518     if( opcode==OP_FkCounter && pOp->p1==0 && pOp->p2==1 ){
519       hasFkCounter = 1;
520     }
521 #endif
522   }
523   sqlite3DbFree(v->db, sIter.apSub);
524 
525   /* Return true if hasAbort==mayAbort. Or if a malloc failure occurred.
526   ** If malloc failed, then the while() loop above may not have iterated
527   ** through all opcodes and hasAbort may be set incorrectly. Return
528   ** true for this case to prevent the assert() in the callers frame
529   ** from failing.  */
530   return ( v->db->mallocFailed || hasAbort==mayAbort || hasFkCounter
531               || (hasCreateTable && hasInitCoroutine) );
532 }
533 #endif /* SQLITE_DEBUG - the sqlite3AssertMayAbort() function */
534 
535 /*
536 ** This routine is called after all opcodes have been inserted.  It loops
537 ** through all the opcodes and fixes up some details.
538 **
539 ** (1) For each jump instruction with a negative P2 value (a label)
540 **     resolve the P2 value to an actual address.
541 **
542 ** (2) Compute the maximum number of arguments used by any SQL function
543 **     and store that value in *pMaxFuncArgs.
544 **
545 ** (3) Update the Vdbe.readOnly and Vdbe.bIsReader flags to accurately
546 **     indicate what the prepared statement actually does.
547 **
548 ** (4) Initialize the p4.xAdvance pointer on opcodes that use it.
549 **
550 ** (5) Reclaim the memory allocated for storing labels.
551 **
552 ** This routine will only function correctly if the mkopcodeh.tcl generator
553 ** script numbers the opcodes correctly.  Changes to this routine must be
554 ** coordinated with changes to mkopcodeh.tcl.
555 */
556 static void resolveP2Values(Vdbe *p, int *pMaxFuncArgs){
557   int nMaxArgs = *pMaxFuncArgs;
558   Op *pOp;
559   Parse *pParse = p->pParse;
560   int *aLabel = pParse->aLabel;
561   p->readOnly = 1;
562   p->bIsReader = 0;
563   pOp = &p->aOp[p->nOp-1];
564   while(1){
565 
566     /* Only JUMP opcodes and the short list of special opcodes in the switch
567     ** below need to be considered.  The mkopcodeh.tcl generator script groups
568     ** all these opcodes together near the front of the opcode list.  Skip
569     ** any opcode that does not need processing by virtual of the fact that
570     ** it is larger than SQLITE_MX_JUMP_OPCODE, as a performance optimization.
571     */
572     if( pOp->opcode<=SQLITE_MX_JUMP_OPCODE ){
573       /* NOTE: Be sure to update mkopcodeh.tcl when adding or removing
574       ** cases from this switch! */
575       switch( pOp->opcode ){
576         case OP_Transaction: {
577           if( pOp->p2!=0 ) p->readOnly = 0;
578           /* fall thru */
579         }
580         case OP_AutoCommit:
581         case OP_Savepoint: {
582           p->bIsReader = 1;
583           break;
584         }
585 #ifndef SQLITE_OMIT_WAL
586         case OP_Checkpoint:
587 #endif
588         case OP_Vacuum:
589         case OP_JournalMode: {
590           p->readOnly = 0;
591           p->bIsReader = 1;
592           break;
593         }
594 #ifndef SQLITE_OMIT_VIRTUALTABLE
595         case OP_VUpdate: {
596           if( pOp->p2>nMaxArgs ) nMaxArgs = pOp->p2;
597           break;
598         }
599         case OP_VFilter: {
600           int n;
601           assert( (pOp - p->aOp) >= 3 );
602           assert( pOp[-1].opcode==OP_Integer );
603           n = pOp[-1].p1;
604           if( n>nMaxArgs ) nMaxArgs = n;
605           break;
606         }
607 #endif
608         case OP_Next:
609         case OP_NextIfOpen:
610         case OP_SorterNext: {
611           pOp->p4.xAdvance = sqlite3BtreeNext;
612           pOp->p4type = P4_ADVANCE;
613           break;
614         }
615         case OP_Prev:
616         case OP_PrevIfOpen: {
617           pOp->p4.xAdvance = sqlite3BtreePrevious;
618           pOp->p4type = P4_ADVANCE;
619           break;
620         }
621       }
622       if( (sqlite3OpcodeProperty[pOp->opcode] & OPFLG_JUMP)!=0 && pOp->p2<0 ){
623         assert( ADDR(pOp->p2)<pParse->nLabel );
624         pOp->p2 = aLabel[ADDR(pOp->p2)];
625       }
626     }
627     if( pOp==p->aOp ) break;
628     pOp--;
629   }
630   sqlite3DbFree(p->db, pParse->aLabel);
631   pParse->aLabel = 0;
632   pParse->nLabel = 0;
633   *pMaxFuncArgs = nMaxArgs;
634   assert( p->bIsReader!=0 || DbMaskAllZero(p->btreeMask) );
635 }
636 
637 /*
638 ** Return the address of the next instruction to be inserted.
639 */
640 int sqlite3VdbeCurrentAddr(Vdbe *p){
641   assert( p->magic==VDBE_MAGIC_INIT );
642   return p->nOp;
643 }
644 
645 /*
646 ** Verify that at least N opcode slots are available in p without
647 ** having to malloc for more space (except when compiled using
648 ** SQLITE_TEST_REALLOC_STRESS).  This interface is used during testing
649 ** to verify that certain calls to sqlite3VdbeAddOpList() can never
650 ** fail due to a OOM fault and hence that the return value from
651 ** sqlite3VdbeAddOpList() will always be non-NULL.
652 */
653 #if defined(SQLITE_DEBUG) && !defined(SQLITE_TEST_REALLOC_STRESS)
654 void sqlite3VdbeVerifyNoMallocRequired(Vdbe *p, int N){
655   assert( p->nOp + N <= p->pParse->nOpAlloc );
656 }
657 #endif
658 
659 /*
660 ** Verify that the VM passed as the only argument does not contain
661 ** an OP_ResultRow opcode. Fail an assert() if it does. This is used
662 ** by code in pragma.c to ensure that the implementation of certain
663 ** pragmas comports with the flags specified in the mkpragmatab.tcl
664 ** script.
665 */
666 #if defined(SQLITE_DEBUG) && !defined(SQLITE_TEST_REALLOC_STRESS)
667 void sqlite3VdbeVerifyNoResultRow(Vdbe *p){
668   int i;
669   for(i=0; i<p->nOp; i++){
670     assert( p->aOp[i].opcode!=OP_ResultRow );
671   }
672 }
673 #endif
674 
675 /*
676 ** This function returns a pointer to the array of opcodes associated with
677 ** the Vdbe passed as the first argument. It is the callers responsibility
678 ** to arrange for the returned array to be eventually freed using the
679 ** vdbeFreeOpArray() function.
680 **
681 ** Before returning, *pnOp is set to the number of entries in the returned
682 ** array. Also, *pnMaxArg is set to the larger of its current value and
683 ** the number of entries in the Vdbe.apArg[] array required to execute the
684 ** returned program.
685 */
686 VdbeOp *sqlite3VdbeTakeOpArray(Vdbe *p, int *pnOp, int *pnMaxArg){
687   VdbeOp *aOp = p->aOp;
688   assert( aOp && !p->db->mallocFailed );
689 
690   /* Check that sqlite3VdbeUsesBtree() was not called on this VM */
691   assert( DbMaskAllZero(p->btreeMask) );
692 
693   resolveP2Values(p, pnMaxArg);
694   *pnOp = p->nOp;
695   p->aOp = 0;
696   return aOp;
697 }
698 
699 /*
700 ** Add a whole list of operations to the operation stack.  Return a
701 ** pointer to the first operation inserted.
702 **
703 ** Non-zero P2 arguments to jump instructions are automatically adjusted
704 ** so that the jump target is relative to the first operation inserted.
705 */
706 VdbeOp *sqlite3VdbeAddOpList(
707   Vdbe *p,                     /* Add opcodes to the prepared statement */
708   int nOp,                     /* Number of opcodes to add */
709   VdbeOpList const *aOp,       /* The opcodes to be added */
710   int iLineno                  /* Source-file line number of first opcode */
711 ){
712   int i;
713   VdbeOp *pOut, *pFirst;
714   assert( nOp>0 );
715   assert( p->magic==VDBE_MAGIC_INIT );
716   if( p->nOp + nOp > p->pParse->nOpAlloc && growOpArray(p, nOp) ){
717     return 0;
718   }
719   pFirst = pOut = &p->aOp[p->nOp];
720   for(i=0; i<nOp; i++, aOp++, pOut++){
721     pOut->opcode = aOp->opcode;
722     pOut->p1 = aOp->p1;
723     pOut->p2 = aOp->p2;
724     assert( aOp->p2>=0 );
725     if( (sqlite3OpcodeProperty[aOp->opcode] & OPFLG_JUMP)!=0 && aOp->p2>0 ){
726       pOut->p2 += p->nOp;
727     }
728     pOut->p3 = aOp->p3;
729     pOut->p4type = P4_NOTUSED;
730     pOut->p4.p = 0;
731     pOut->p5 = 0;
732 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
733     pOut->zComment = 0;
734 #endif
735 #ifdef SQLITE_VDBE_COVERAGE
736     pOut->iSrcLine = iLineno+i;
737 #else
738     (void)iLineno;
739 #endif
740 #ifdef SQLITE_DEBUG
741     if( p->db->flags & SQLITE_VdbeAddopTrace ){
742       sqlite3VdbePrintOp(0, i+p->nOp, &p->aOp[i+p->nOp]);
743     }
744 #endif
745   }
746   p->nOp += nOp;
747   return pFirst;
748 }
749 
750 #if defined(SQLITE_ENABLE_STMT_SCANSTATUS)
751 /*
752 ** Add an entry to the array of counters managed by sqlite3_stmt_scanstatus().
753 */
754 void sqlite3VdbeScanStatus(
755   Vdbe *p,                        /* VM to add scanstatus() to */
756   int addrExplain,                /* Address of OP_Explain (or 0) */
757   int addrLoop,                   /* Address of loop counter */
758   int addrVisit,                  /* Address of rows visited counter */
759   LogEst nEst,                    /* Estimated number of output rows */
760   const char *zName               /* Name of table or index being scanned */
761 ){
762   int nByte = (p->nScan+1) * sizeof(ScanStatus);
763   ScanStatus *aNew;
764   aNew = (ScanStatus*)sqlite3DbRealloc(p->db, p->aScan, nByte);
765   if( aNew ){
766     ScanStatus *pNew = &aNew[p->nScan++];
767     pNew->addrExplain = addrExplain;
768     pNew->addrLoop = addrLoop;
769     pNew->addrVisit = addrVisit;
770     pNew->nEst = nEst;
771     pNew->zName = sqlite3DbStrDup(p->db, zName);
772     p->aScan = aNew;
773   }
774 }
775 #endif
776 
777 
778 /*
779 ** Change the value of the opcode, or P1, P2, P3, or P5 operands
780 ** for a specific instruction.
781 */
782 void sqlite3VdbeChangeOpcode(Vdbe *p, u32 addr, u8 iNewOpcode){
783   sqlite3VdbeGetOp(p,addr)->opcode = iNewOpcode;
784 }
785 void sqlite3VdbeChangeP1(Vdbe *p, u32 addr, int val){
786   sqlite3VdbeGetOp(p,addr)->p1 = val;
787 }
788 void sqlite3VdbeChangeP2(Vdbe *p, u32 addr, int val){
789   sqlite3VdbeGetOp(p,addr)->p2 = val;
790 }
791 void sqlite3VdbeChangeP3(Vdbe *p, u32 addr, int val){
792   sqlite3VdbeGetOp(p,addr)->p3 = val;
793 }
794 void sqlite3VdbeChangeP5(Vdbe *p, u16 p5){
795   assert( p->nOp>0 || p->db->mallocFailed );
796   if( p->nOp>0 ) p->aOp[p->nOp-1].p5 = p5;
797 }
798 
799 /*
800 ** Change the P2 operand of instruction addr so that it points to
801 ** the address of the next instruction to be coded.
802 */
803 void sqlite3VdbeJumpHere(Vdbe *p, int addr){
804   sqlite3VdbeChangeP2(p, addr, p->nOp);
805 }
806 
807 
808 /*
809 ** If the input FuncDef structure is ephemeral, then free it.  If
810 ** the FuncDef is not ephermal, then do nothing.
811 */
812 static void freeEphemeralFunction(sqlite3 *db, FuncDef *pDef){
813   if( (pDef->funcFlags & SQLITE_FUNC_EPHEM)!=0 ){
814     sqlite3DbFreeNN(db, pDef);
815   }
816 }
817 
818 static void vdbeFreeOpArray(sqlite3 *, Op *, int);
819 
820 /*
821 ** Delete a P4 value if necessary.
822 */
823 static SQLITE_NOINLINE void freeP4Mem(sqlite3 *db, Mem *p){
824   if( p->szMalloc ) sqlite3DbFree(db, p->zMalloc);
825   sqlite3DbFreeNN(db, p);
826 }
827 static SQLITE_NOINLINE void freeP4FuncCtx(sqlite3 *db, sqlite3_context *p){
828   freeEphemeralFunction(db, p->pFunc);
829  sqlite3DbFreeNN(db, p);
830 }
831 static void freeP4(sqlite3 *db, int p4type, void *p4){
832   assert( db );
833   switch( p4type ){
834     case P4_FUNCCTX: {
835       freeP4FuncCtx(db, (sqlite3_context*)p4);
836       break;
837     }
838     case P4_REAL:
839     case P4_INT64:
840     case P4_DYNAMIC:
841     case P4_INTARRAY: {
842       sqlite3DbFree(db, p4);
843       break;
844     }
845     case P4_KEYINFO: {
846       if( db->pnBytesFreed==0 ) sqlite3KeyInfoUnref((KeyInfo*)p4);
847       break;
848     }
849 #ifdef SQLITE_ENABLE_CURSOR_HINTS
850     case P4_EXPR: {
851       sqlite3ExprDelete(db, (Expr*)p4);
852       break;
853     }
854 #endif
855     case P4_FUNCDEF: {
856       freeEphemeralFunction(db, (FuncDef*)p4);
857       break;
858     }
859     case P4_MEM: {
860       if( db->pnBytesFreed==0 ){
861         sqlite3ValueFree((sqlite3_value*)p4);
862       }else{
863         freeP4Mem(db, (Mem*)p4);
864       }
865       break;
866     }
867     case P4_VTAB : {
868       if( db->pnBytesFreed==0 ) sqlite3VtabUnlock((VTable *)p4);
869       break;
870     }
871   }
872 }
873 
874 /*
875 ** Free the space allocated for aOp and any p4 values allocated for the
876 ** opcodes contained within. If aOp is not NULL it is assumed to contain
877 ** nOp entries.
878 */
879 static void vdbeFreeOpArray(sqlite3 *db, Op *aOp, int nOp){
880   if( aOp ){
881     Op *pOp;
882     for(pOp=&aOp[nOp-1]; pOp>=aOp; pOp--){
883       if( pOp->p4type ) freeP4(db, pOp->p4type, pOp->p4.p);
884 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
885       sqlite3DbFree(db, pOp->zComment);
886 #endif
887     }
888     sqlite3DbFreeNN(db, aOp);
889   }
890 }
891 
892 /*
893 ** Link the SubProgram object passed as the second argument into the linked
894 ** list at Vdbe.pSubProgram. This list is used to delete all sub-program
895 ** objects when the VM is no longer required.
896 */
897 void sqlite3VdbeLinkSubProgram(Vdbe *pVdbe, SubProgram *p){
898   p->pNext = pVdbe->pProgram;
899   pVdbe->pProgram = p;
900 }
901 
902 /*
903 ** Change the opcode at addr into OP_Noop
904 */
905 int sqlite3VdbeChangeToNoop(Vdbe *p, int addr){
906   VdbeOp *pOp;
907   if( p->db->mallocFailed ) return 0;
908   assert( addr>=0 && addr<p->nOp );
909   pOp = &p->aOp[addr];
910   freeP4(p->db, pOp->p4type, pOp->p4.p);
911   pOp->p4type = P4_NOTUSED;
912   pOp->p4.z = 0;
913   pOp->opcode = OP_Noop;
914   return 1;
915 }
916 
917 /*
918 ** If the last opcode is "op" and it is not a jump destination,
919 ** then remove it.  Return true if and only if an opcode was removed.
920 */
921 int sqlite3VdbeDeletePriorOpcode(Vdbe *p, u8 op){
922   if( p->nOp>0 && p->aOp[p->nOp-1].opcode==op ){
923     return sqlite3VdbeChangeToNoop(p, p->nOp-1);
924   }else{
925     return 0;
926   }
927 }
928 
929 /*
930 ** Change the value of the P4 operand for a specific instruction.
931 ** This routine is useful when a large program is loaded from a
932 ** static array using sqlite3VdbeAddOpList but we want to make a
933 ** few minor changes to the program.
934 **
935 ** If n>=0 then the P4 operand is dynamic, meaning that a copy of
936 ** the string is made into memory obtained from sqlite3_malloc().
937 ** A value of n==0 means copy bytes of zP4 up to and including the
938 ** first null byte.  If n>0 then copy n+1 bytes of zP4.
939 **
940 ** Other values of n (P4_STATIC, P4_COLLSEQ etc.) indicate that zP4 points
941 ** to a string or structure that is guaranteed to exist for the lifetime of
942 ** the Vdbe. In these cases we can just copy the pointer.
943 **
944 ** If addr<0 then change P4 on the most recently inserted instruction.
945 */
946 static void SQLITE_NOINLINE vdbeChangeP4Full(
947   Vdbe *p,
948   Op *pOp,
949   const char *zP4,
950   int n
951 ){
952   if( pOp->p4type ){
953     freeP4(p->db, pOp->p4type, pOp->p4.p);
954     pOp->p4type = 0;
955     pOp->p4.p = 0;
956   }
957   if( n<0 ){
958     sqlite3VdbeChangeP4(p, (int)(pOp - p->aOp), zP4, n);
959   }else{
960     if( n==0 ) n = sqlite3Strlen30(zP4);
961     pOp->p4.z = sqlite3DbStrNDup(p->db, zP4, n);
962     pOp->p4type = P4_DYNAMIC;
963   }
964 }
965 void sqlite3VdbeChangeP4(Vdbe *p, int addr, const char *zP4, int n){
966   Op *pOp;
967   sqlite3 *db;
968   assert( p!=0 );
969   db = p->db;
970   assert( p->magic==VDBE_MAGIC_INIT );
971   assert( p->aOp!=0 || db->mallocFailed );
972   if( db->mallocFailed ){
973     if( n!=P4_VTAB ) freeP4(db, n, (void*)*(char**)&zP4);
974     return;
975   }
976   assert( p->nOp>0 );
977   assert( addr<p->nOp );
978   if( addr<0 ){
979     addr = p->nOp - 1;
980   }
981   pOp = &p->aOp[addr];
982   if( n>=0 || pOp->p4type ){
983     vdbeChangeP4Full(p, pOp, zP4, n);
984     return;
985   }
986   if( n==P4_INT32 ){
987     /* Note: this cast is safe, because the origin data point was an int
988     ** that was cast to a (const char *). */
989     pOp->p4.i = SQLITE_PTR_TO_INT(zP4);
990     pOp->p4type = P4_INT32;
991   }else if( zP4!=0 ){
992     assert( n<0 );
993     pOp->p4.p = (void*)zP4;
994     pOp->p4type = (signed char)n;
995     if( n==P4_VTAB ) sqlite3VtabLock((VTable*)zP4);
996   }
997 }
998 
999 /*
1000 ** Change the P4 operand of the most recently coded instruction
1001 ** to the value defined by the arguments.  This is a high-speed
1002 ** version of sqlite3VdbeChangeP4().
1003 **
1004 ** The P4 operand must not have been previously defined.  And the new
1005 ** P4 must not be P4_INT32.  Use sqlite3VdbeChangeP4() in either of
1006 ** those cases.
1007 */
1008 void sqlite3VdbeAppendP4(Vdbe *p, void *pP4, int n){
1009   VdbeOp *pOp;
1010   assert( n!=P4_INT32 && n!=P4_VTAB );
1011   assert( n<=0 );
1012   if( p->db->mallocFailed ){
1013     freeP4(p->db, n, pP4);
1014   }else{
1015     assert( pP4!=0 );
1016     assert( p->nOp>0 );
1017     pOp = &p->aOp[p->nOp-1];
1018     assert( pOp->p4type==P4_NOTUSED );
1019     pOp->p4type = n;
1020     pOp->p4.p = pP4;
1021   }
1022 }
1023 
1024 /*
1025 ** Set the P4 on the most recently added opcode to the KeyInfo for the
1026 ** index given.
1027 */
1028 void sqlite3VdbeSetP4KeyInfo(Parse *pParse, Index *pIdx){
1029   Vdbe *v = pParse->pVdbe;
1030   KeyInfo *pKeyInfo;
1031   assert( v!=0 );
1032   assert( pIdx!=0 );
1033   pKeyInfo = sqlite3KeyInfoOfIndex(pParse, pIdx);
1034   if( pKeyInfo ) sqlite3VdbeAppendP4(v, pKeyInfo, P4_KEYINFO);
1035 }
1036 
1037 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1038 /*
1039 ** Change the comment on the most recently coded instruction.  Or
1040 ** insert a No-op and add the comment to that new instruction.  This
1041 ** makes the code easier to read during debugging.  None of this happens
1042 ** in a production build.
1043 */
1044 static void vdbeVComment(Vdbe *p, const char *zFormat, va_list ap){
1045   assert( p->nOp>0 || p->aOp==0 );
1046   assert( p->aOp==0 || p->aOp[p->nOp-1].zComment==0 || p->db->mallocFailed );
1047   if( p->nOp ){
1048     assert( p->aOp );
1049     sqlite3DbFree(p->db, p->aOp[p->nOp-1].zComment);
1050     p->aOp[p->nOp-1].zComment = sqlite3VMPrintf(p->db, zFormat, ap);
1051   }
1052 }
1053 void sqlite3VdbeComment(Vdbe *p, const char *zFormat, ...){
1054   va_list ap;
1055   if( p ){
1056     va_start(ap, zFormat);
1057     vdbeVComment(p, zFormat, ap);
1058     va_end(ap);
1059   }
1060 }
1061 void sqlite3VdbeNoopComment(Vdbe *p, const char *zFormat, ...){
1062   va_list ap;
1063   if( p ){
1064     sqlite3VdbeAddOp0(p, OP_Noop);
1065     va_start(ap, zFormat);
1066     vdbeVComment(p, zFormat, ap);
1067     va_end(ap);
1068   }
1069 }
1070 #endif  /* NDEBUG */
1071 
1072 #ifdef SQLITE_VDBE_COVERAGE
1073 /*
1074 ** Set the value if the iSrcLine field for the previously coded instruction.
1075 */
1076 void sqlite3VdbeSetLineNumber(Vdbe *v, int iLine){
1077   sqlite3VdbeGetOp(v,-1)->iSrcLine = iLine;
1078 }
1079 #endif /* SQLITE_VDBE_COVERAGE */
1080 
1081 /*
1082 ** Return the opcode for a given address.  If the address is -1, then
1083 ** return the most recently inserted opcode.
1084 **
1085 ** If a memory allocation error has occurred prior to the calling of this
1086 ** routine, then a pointer to a dummy VdbeOp will be returned.  That opcode
1087 ** is readable but not writable, though it is cast to a writable value.
1088 ** The return of a dummy opcode allows the call to continue functioning
1089 ** after an OOM fault without having to check to see if the return from
1090 ** this routine is a valid pointer.  But because the dummy.opcode is 0,
1091 ** dummy will never be written to.  This is verified by code inspection and
1092 ** by running with Valgrind.
1093 */
1094 VdbeOp *sqlite3VdbeGetOp(Vdbe *p, int addr){
1095   /* C89 specifies that the constant "dummy" will be initialized to all
1096   ** zeros, which is correct.  MSVC generates a warning, nevertheless. */
1097   static VdbeOp dummy;  /* Ignore the MSVC warning about no initializer */
1098   assert( p->magic==VDBE_MAGIC_INIT );
1099   if( addr<0 ){
1100     addr = p->nOp - 1;
1101   }
1102   assert( (addr>=0 && addr<p->nOp) || p->db->mallocFailed );
1103   if( p->db->mallocFailed ){
1104     return (VdbeOp*)&dummy;
1105   }else{
1106     return &p->aOp[addr];
1107   }
1108 }
1109 
1110 #if defined(SQLITE_ENABLE_EXPLAIN_COMMENTS)
1111 /*
1112 ** Return an integer value for one of the parameters to the opcode pOp
1113 ** determined by character c.
1114 */
1115 static int translateP(char c, const Op *pOp){
1116   if( c=='1' ) return pOp->p1;
1117   if( c=='2' ) return pOp->p2;
1118   if( c=='3' ) return pOp->p3;
1119   if( c=='4' ) return pOp->p4.i;
1120   return pOp->p5;
1121 }
1122 
1123 /*
1124 ** Compute a string for the "comment" field of a VDBE opcode listing.
1125 **
1126 ** The Synopsis: field in comments in the vdbe.c source file gets converted
1127 ** to an extra string that is appended to the sqlite3OpcodeName().  In the
1128 ** absence of other comments, this synopsis becomes the comment on the opcode.
1129 ** Some translation occurs:
1130 **
1131 **       "PX"      ->  "r[X]"
1132 **       "PX@PY"   ->  "r[X..X+Y-1]"  or "r[x]" if y is 0 or 1
1133 **       "PX@PY+1" ->  "r[X..X+Y]"    or "r[x]" if y is 0
1134 **       "PY..PY"  ->  "r[X..Y]"      or "r[x]" if y<=x
1135 */
1136 static int displayComment(
1137   const Op *pOp,     /* The opcode to be commented */
1138   const char *zP4,   /* Previously obtained value for P4 */
1139   char *zTemp,       /* Write result here */
1140   int nTemp          /* Space available in zTemp[] */
1141 ){
1142   const char *zOpName;
1143   const char *zSynopsis;
1144   int nOpName;
1145   int ii, jj;
1146   char zAlt[50];
1147   zOpName = sqlite3OpcodeName(pOp->opcode);
1148   nOpName = sqlite3Strlen30(zOpName);
1149   if( zOpName[nOpName+1] ){
1150     int seenCom = 0;
1151     char c;
1152     zSynopsis = zOpName += nOpName + 1;
1153     if( strncmp(zSynopsis,"IF ",3)==0 ){
1154       if( pOp->p5 & SQLITE_STOREP2 ){
1155         sqlite3_snprintf(sizeof(zAlt), zAlt, "r[P2] = (%s)", zSynopsis+3);
1156       }else{
1157         sqlite3_snprintf(sizeof(zAlt), zAlt, "if %s goto P2", zSynopsis+3);
1158       }
1159       zSynopsis = zAlt;
1160     }
1161     for(ii=jj=0; jj<nTemp-1 && (c = zSynopsis[ii])!=0; ii++){
1162       if( c=='P' ){
1163         c = zSynopsis[++ii];
1164         if( c=='4' ){
1165           sqlite3_snprintf(nTemp-jj, zTemp+jj, "%s", zP4);
1166         }else if( c=='X' ){
1167           sqlite3_snprintf(nTemp-jj, zTemp+jj, "%s", pOp->zComment);
1168           seenCom = 1;
1169         }else{
1170           int v1 = translateP(c, pOp);
1171           int v2;
1172           sqlite3_snprintf(nTemp-jj, zTemp+jj, "%d", v1);
1173           if( strncmp(zSynopsis+ii+1, "@P", 2)==0 ){
1174             ii += 3;
1175             jj += sqlite3Strlen30(zTemp+jj);
1176             v2 = translateP(zSynopsis[ii], pOp);
1177             if( strncmp(zSynopsis+ii+1,"+1",2)==0 ){
1178               ii += 2;
1179               v2++;
1180             }
1181             if( v2>1 ){
1182               sqlite3_snprintf(nTemp-jj, zTemp+jj, "..%d", v1+v2-1);
1183             }
1184           }else if( strncmp(zSynopsis+ii+1, "..P3", 4)==0 && pOp->p3==0 ){
1185             ii += 4;
1186           }
1187         }
1188         jj += sqlite3Strlen30(zTemp+jj);
1189       }else{
1190         zTemp[jj++] = c;
1191       }
1192     }
1193     if( !seenCom && jj<nTemp-5 && pOp->zComment ){
1194       sqlite3_snprintf(nTemp-jj, zTemp+jj, "; %s", pOp->zComment);
1195       jj += sqlite3Strlen30(zTemp+jj);
1196     }
1197     if( jj<nTemp ) zTemp[jj] = 0;
1198   }else if( pOp->zComment ){
1199     sqlite3_snprintf(nTemp, zTemp, "%s", pOp->zComment);
1200     jj = sqlite3Strlen30(zTemp);
1201   }else{
1202     zTemp[0] = 0;
1203     jj = 0;
1204   }
1205   return jj;
1206 }
1207 #endif /* SQLITE_DEBUG */
1208 
1209 #if VDBE_DISPLAY_P4 && defined(SQLITE_ENABLE_CURSOR_HINTS)
1210 /*
1211 ** Translate the P4.pExpr value for an OP_CursorHint opcode into text
1212 ** that can be displayed in the P4 column of EXPLAIN output.
1213 */
1214 static void displayP4Expr(StrAccum *p, Expr *pExpr){
1215   const char *zOp = 0;
1216   switch( pExpr->op ){
1217     case TK_STRING:
1218       sqlite3XPrintf(p, "%Q", pExpr->u.zToken);
1219       break;
1220     case TK_INTEGER:
1221       sqlite3XPrintf(p, "%d", pExpr->u.iValue);
1222       break;
1223     case TK_NULL:
1224       sqlite3XPrintf(p, "NULL");
1225       break;
1226     case TK_REGISTER: {
1227       sqlite3XPrintf(p, "r[%d]", pExpr->iTable);
1228       break;
1229     }
1230     case TK_COLUMN: {
1231       if( pExpr->iColumn<0 ){
1232         sqlite3XPrintf(p, "rowid");
1233       }else{
1234         sqlite3XPrintf(p, "c%d", (int)pExpr->iColumn);
1235       }
1236       break;
1237     }
1238     case TK_LT:      zOp = "LT";      break;
1239     case TK_LE:      zOp = "LE";      break;
1240     case TK_GT:      zOp = "GT";      break;
1241     case TK_GE:      zOp = "GE";      break;
1242     case TK_NE:      zOp = "NE";      break;
1243     case TK_EQ:      zOp = "EQ";      break;
1244     case TK_IS:      zOp = "IS";      break;
1245     case TK_ISNOT:   zOp = "ISNOT";   break;
1246     case TK_AND:     zOp = "AND";     break;
1247     case TK_OR:      zOp = "OR";      break;
1248     case TK_PLUS:    zOp = "ADD";     break;
1249     case TK_STAR:    zOp = "MUL";     break;
1250     case TK_MINUS:   zOp = "SUB";     break;
1251     case TK_REM:     zOp = "REM";     break;
1252     case TK_BITAND:  zOp = "BITAND";  break;
1253     case TK_BITOR:   zOp = "BITOR";   break;
1254     case TK_SLASH:   zOp = "DIV";     break;
1255     case TK_LSHIFT:  zOp = "LSHIFT";  break;
1256     case TK_RSHIFT:  zOp = "RSHIFT";  break;
1257     case TK_CONCAT:  zOp = "CONCAT";  break;
1258     case TK_UMINUS:  zOp = "MINUS";   break;
1259     case TK_UPLUS:   zOp = "PLUS";    break;
1260     case TK_BITNOT:  zOp = "BITNOT";  break;
1261     case TK_NOT:     zOp = "NOT";     break;
1262     case TK_ISNULL:  zOp = "ISNULL";  break;
1263     case TK_NOTNULL: zOp = "NOTNULL"; break;
1264 
1265     default:
1266       sqlite3XPrintf(p, "%s", "expr");
1267       break;
1268   }
1269 
1270   if( zOp ){
1271     sqlite3XPrintf(p, "%s(", zOp);
1272     displayP4Expr(p, pExpr->pLeft);
1273     if( pExpr->pRight ){
1274       sqlite3StrAccumAppend(p, ",", 1);
1275       displayP4Expr(p, pExpr->pRight);
1276     }
1277     sqlite3StrAccumAppend(p, ")", 1);
1278   }
1279 }
1280 #endif /* VDBE_DISPLAY_P4 && defined(SQLITE_ENABLE_CURSOR_HINTS) */
1281 
1282 
1283 #if VDBE_DISPLAY_P4
1284 /*
1285 ** Compute a string that describes the P4 parameter for an opcode.
1286 ** Use zTemp for any required temporary buffer space.
1287 */
1288 static char *displayP4(Op *pOp, char *zTemp, int nTemp){
1289   char *zP4 = zTemp;
1290   StrAccum x;
1291   assert( nTemp>=20 );
1292   sqlite3StrAccumInit(&x, 0, zTemp, nTemp, 0);
1293   switch( pOp->p4type ){
1294     case P4_KEYINFO: {
1295       int j;
1296       KeyInfo *pKeyInfo = pOp->p4.pKeyInfo;
1297       assert( pKeyInfo->aSortOrder!=0 );
1298       sqlite3XPrintf(&x, "k(%d", pKeyInfo->nField);
1299       for(j=0; j<pKeyInfo->nField; j++){
1300         CollSeq *pColl = pKeyInfo->aColl[j];
1301         const char *zColl = pColl ? pColl->zName : "";
1302         if( strcmp(zColl, "BINARY")==0 ) zColl = "B";
1303         sqlite3XPrintf(&x, ",%s%s", pKeyInfo->aSortOrder[j] ? "-" : "", zColl);
1304       }
1305       sqlite3StrAccumAppend(&x, ")", 1);
1306       break;
1307     }
1308 #ifdef SQLITE_ENABLE_CURSOR_HINTS
1309     case P4_EXPR: {
1310       displayP4Expr(&x, pOp->p4.pExpr);
1311       break;
1312     }
1313 #endif
1314     case P4_COLLSEQ: {
1315       CollSeq *pColl = pOp->p4.pColl;
1316       sqlite3XPrintf(&x, "(%.20s)", pColl->zName);
1317       break;
1318     }
1319     case P4_FUNCDEF: {
1320       FuncDef *pDef = pOp->p4.pFunc;
1321       sqlite3XPrintf(&x, "%s(%d)", pDef->zName, pDef->nArg);
1322       break;
1323     }
1324 #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
1325     case P4_FUNCCTX: {
1326       FuncDef *pDef = pOp->p4.pCtx->pFunc;
1327       sqlite3XPrintf(&x, "%s(%d)", pDef->zName, pDef->nArg);
1328       break;
1329     }
1330 #endif
1331     case P4_INT64: {
1332       sqlite3XPrintf(&x, "%lld", *pOp->p4.pI64);
1333       break;
1334     }
1335     case P4_INT32: {
1336       sqlite3XPrintf(&x, "%d", pOp->p4.i);
1337       break;
1338     }
1339     case P4_REAL: {
1340       sqlite3XPrintf(&x, "%.16g", *pOp->p4.pReal);
1341       break;
1342     }
1343     case P4_MEM: {
1344       Mem *pMem = pOp->p4.pMem;
1345       if( pMem->flags & MEM_Str ){
1346         zP4 = pMem->z;
1347       }else if( pMem->flags & MEM_Int ){
1348         sqlite3XPrintf(&x, "%lld", pMem->u.i);
1349       }else if( pMem->flags & MEM_Real ){
1350         sqlite3XPrintf(&x, "%.16g", pMem->u.r);
1351       }else if( pMem->flags & MEM_Null ){
1352         zP4 = "NULL";
1353       }else{
1354         assert( pMem->flags & MEM_Blob );
1355         zP4 = "(blob)";
1356       }
1357       break;
1358     }
1359 #ifndef SQLITE_OMIT_VIRTUALTABLE
1360     case P4_VTAB: {
1361       sqlite3_vtab *pVtab = pOp->p4.pVtab->pVtab;
1362       sqlite3XPrintf(&x, "vtab:%p", pVtab);
1363       break;
1364     }
1365 #endif
1366     case P4_INTARRAY: {
1367       int i;
1368       int *ai = pOp->p4.ai;
1369       int n = ai[0];   /* The first element of an INTARRAY is always the
1370                        ** count of the number of elements to follow */
1371       for(i=1; i<n; i++){
1372         sqlite3XPrintf(&x, ",%d", ai[i]);
1373       }
1374       zTemp[0] = '[';
1375       sqlite3StrAccumAppend(&x, "]", 1);
1376       break;
1377     }
1378     case P4_SUBPROGRAM: {
1379       sqlite3XPrintf(&x, "program");
1380       break;
1381     }
1382     case P4_ADVANCE: {
1383       zTemp[0] = 0;
1384       break;
1385     }
1386     case P4_TABLE: {
1387       sqlite3XPrintf(&x, "%s", pOp->p4.pTab->zName);
1388       break;
1389     }
1390     default: {
1391       zP4 = pOp->p4.z;
1392       if( zP4==0 ){
1393         zP4 = zTemp;
1394         zTemp[0] = 0;
1395       }
1396     }
1397   }
1398   sqlite3StrAccumFinish(&x);
1399   assert( zP4!=0 );
1400   return zP4;
1401 }
1402 #endif /* VDBE_DISPLAY_P4 */
1403 
1404 /*
1405 ** Declare to the Vdbe that the BTree object at db->aDb[i] is used.
1406 **
1407 ** The prepared statements need to know in advance the complete set of
1408 ** attached databases that will be use.  A mask of these databases
1409 ** is maintained in p->btreeMask.  The p->lockMask value is the subset of
1410 ** p->btreeMask of databases that will require a lock.
1411 */
1412 void sqlite3VdbeUsesBtree(Vdbe *p, int i){
1413   assert( i>=0 && i<p->db->nDb && i<(int)sizeof(yDbMask)*8 );
1414   assert( i<(int)sizeof(p->btreeMask)*8 );
1415   DbMaskSet(p->btreeMask, i);
1416   if( i!=1 && sqlite3BtreeSharable(p->db->aDb[i].pBt) ){
1417     DbMaskSet(p->lockMask, i);
1418   }
1419 }
1420 
1421 #if !defined(SQLITE_OMIT_SHARED_CACHE)
1422 /*
1423 ** If SQLite is compiled to support shared-cache mode and to be threadsafe,
1424 ** this routine obtains the mutex associated with each BtShared structure
1425 ** that may be accessed by the VM passed as an argument. In doing so it also
1426 ** sets the BtShared.db member of each of the BtShared structures, ensuring
1427 ** that the correct busy-handler callback is invoked if required.
1428 **
1429 ** If SQLite is not threadsafe but does support shared-cache mode, then
1430 ** sqlite3BtreeEnter() is invoked to set the BtShared.db variables
1431 ** of all of BtShared structures accessible via the database handle
1432 ** associated with the VM.
1433 **
1434 ** If SQLite is not threadsafe and does not support shared-cache mode, this
1435 ** function is a no-op.
1436 **
1437 ** The p->btreeMask field is a bitmask of all btrees that the prepared
1438 ** statement p will ever use.  Let N be the number of bits in p->btreeMask
1439 ** corresponding to btrees that use shared cache.  Then the runtime of
1440 ** this routine is N*N.  But as N is rarely more than 1, this should not
1441 ** be a problem.
1442 */
1443 void sqlite3VdbeEnter(Vdbe *p){
1444   int i;
1445   sqlite3 *db;
1446   Db *aDb;
1447   int nDb;
1448   if( DbMaskAllZero(p->lockMask) ) return;  /* The common case */
1449   db = p->db;
1450   aDb = db->aDb;
1451   nDb = db->nDb;
1452   for(i=0; i<nDb; i++){
1453     if( i!=1 && DbMaskTest(p->lockMask,i) && ALWAYS(aDb[i].pBt!=0) ){
1454       sqlite3BtreeEnter(aDb[i].pBt);
1455     }
1456   }
1457 }
1458 #endif
1459 
1460 #if !defined(SQLITE_OMIT_SHARED_CACHE) && SQLITE_THREADSAFE>0
1461 /*
1462 ** Unlock all of the btrees previously locked by a call to sqlite3VdbeEnter().
1463 */
1464 static SQLITE_NOINLINE void vdbeLeave(Vdbe *p){
1465   int i;
1466   sqlite3 *db;
1467   Db *aDb;
1468   int nDb;
1469   db = p->db;
1470   aDb = db->aDb;
1471   nDb = db->nDb;
1472   for(i=0; i<nDb; i++){
1473     if( i!=1 && DbMaskTest(p->lockMask,i) && ALWAYS(aDb[i].pBt!=0) ){
1474       sqlite3BtreeLeave(aDb[i].pBt);
1475     }
1476   }
1477 }
1478 void sqlite3VdbeLeave(Vdbe *p){
1479   if( DbMaskAllZero(p->lockMask) ) return;  /* The common case */
1480   vdbeLeave(p);
1481 }
1482 #endif
1483 
1484 #if defined(VDBE_PROFILE) || defined(SQLITE_DEBUG)
1485 /*
1486 ** Print a single opcode.  This routine is used for debugging only.
1487 */
1488 void sqlite3VdbePrintOp(FILE *pOut, int pc, Op *pOp){
1489   char *zP4;
1490   char zPtr[50];
1491   char zCom[100];
1492   static const char *zFormat1 = "%4d %-13s %4d %4d %4d %-13s %.2X %s\n";
1493   if( pOut==0 ) pOut = stdout;
1494   zP4 = displayP4(pOp, zPtr, sizeof(zPtr));
1495 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1496   displayComment(pOp, zP4, zCom, sizeof(zCom));
1497 #else
1498   zCom[0] = 0;
1499 #endif
1500   /* NB:  The sqlite3OpcodeName() function is implemented by code created
1501   ** by the mkopcodeh.awk and mkopcodec.awk scripts which extract the
1502   ** information from the vdbe.c source text */
1503   fprintf(pOut, zFormat1, pc,
1504       sqlite3OpcodeName(pOp->opcode), pOp->p1, pOp->p2, pOp->p3, zP4, pOp->p5,
1505       zCom
1506   );
1507   fflush(pOut);
1508 }
1509 #endif
1510 
1511 /*
1512 ** Initialize an array of N Mem element.
1513 */
1514 static void initMemArray(Mem *p, int N, sqlite3 *db, u16 flags){
1515   while( (N--)>0 ){
1516     p->db = db;
1517     p->flags = flags;
1518     p->szMalloc = 0;
1519 #ifdef SQLITE_DEBUG
1520     p->pScopyFrom = 0;
1521 #endif
1522     p++;
1523   }
1524 }
1525 
1526 /*
1527 ** Release an array of N Mem elements
1528 */
1529 static void releaseMemArray(Mem *p, int N){
1530   if( p && N ){
1531     Mem *pEnd = &p[N];
1532     sqlite3 *db = p->db;
1533     if( db->pnBytesFreed ){
1534       do{
1535         if( p->szMalloc ) sqlite3DbFree(db, p->zMalloc);
1536       }while( (++p)<pEnd );
1537       return;
1538     }
1539     do{
1540       assert( (&p[1])==pEnd || p[0].db==p[1].db );
1541       assert( sqlite3VdbeCheckMemInvariants(p) );
1542 
1543       /* This block is really an inlined version of sqlite3VdbeMemRelease()
1544       ** that takes advantage of the fact that the memory cell value is
1545       ** being set to NULL after releasing any dynamic resources.
1546       **
1547       ** The justification for duplicating code is that according to
1548       ** callgrind, this causes a certain test case to hit the CPU 4.7
1549       ** percent less (x86 linux, gcc version 4.1.2, -O6) than if
1550       ** sqlite3MemRelease() were called from here. With -O2, this jumps
1551       ** to 6.6 percent. The test case is inserting 1000 rows into a table
1552       ** with no indexes using a single prepared INSERT statement, bind()
1553       ** and reset(). Inserts are grouped into a transaction.
1554       */
1555       testcase( p->flags & MEM_Agg );
1556       testcase( p->flags & MEM_Dyn );
1557       testcase( p->flags & MEM_Frame );
1558       testcase( p->flags & MEM_RowSet );
1559       if( p->flags&(MEM_Agg|MEM_Dyn|MEM_Frame|MEM_RowSet) ){
1560         sqlite3VdbeMemRelease(p);
1561       }else if( p->szMalloc ){
1562         sqlite3DbFreeNN(db, p->zMalloc);
1563         p->szMalloc = 0;
1564       }
1565 
1566       p->flags = MEM_Undefined;
1567     }while( (++p)<pEnd );
1568   }
1569 }
1570 
1571 /*
1572 ** Delete a VdbeFrame object and its contents. VdbeFrame objects are
1573 ** allocated by the OP_Program opcode in sqlite3VdbeExec().
1574 */
1575 void sqlite3VdbeFrameDelete(VdbeFrame *p){
1576   int i;
1577   Mem *aMem = VdbeFrameMem(p);
1578   VdbeCursor **apCsr = (VdbeCursor **)&aMem[p->nChildMem];
1579   for(i=0; i<p->nChildCsr; i++){
1580     sqlite3VdbeFreeCursor(p->v, apCsr[i]);
1581   }
1582   releaseMemArray(aMem, p->nChildMem);
1583   sqlite3VdbeDeleteAuxData(p->v->db, &p->pAuxData, -1, 0);
1584   sqlite3DbFree(p->v->db, p);
1585 }
1586 
1587 #ifndef SQLITE_OMIT_EXPLAIN
1588 /*
1589 ** Give a listing of the program in the virtual machine.
1590 **
1591 ** The interface is the same as sqlite3VdbeExec().  But instead of
1592 ** running the code, it invokes the callback once for each instruction.
1593 ** This feature is used to implement "EXPLAIN".
1594 **
1595 ** When p->explain==1, each instruction is listed.  When
1596 ** p->explain==2, only OP_Explain instructions are listed and these
1597 ** are shown in a different format.  p->explain==2 is used to implement
1598 ** EXPLAIN QUERY PLAN.
1599 **
1600 ** When p->explain==1, first the main program is listed, then each of
1601 ** the trigger subprograms are listed one by one.
1602 */
1603 int sqlite3VdbeList(
1604   Vdbe *p                   /* The VDBE */
1605 ){
1606   int nRow;                            /* Stop when row count reaches this */
1607   int nSub = 0;                        /* Number of sub-vdbes seen so far */
1608   SubProgram **apSub = 0;              /* Array of sub-vdbes */
1609   Mem *pSub = 0;                       /* Memory cell hold array of subprogs */
1610   sqlite3 *db = p->db;                 /* The database connection */
1611   int i;                               /* Loop counter */
1612   int rc = SQLITE_OK;                  /* Return code */
1613   Mem *pMem = &p->aMem[1];             /* First Mem of result set */
1614 
1615   assert( p->explain );
1616   assert( p->magic==VDBE_MAGIC_RUN );
1617   assert( p->rc==SQLITE_OK || p->rc==SQLITE_BUSY || p->rc==SQLITE_NOMEM );
1618 
1619   /* Even though this opcode does not use dynamic strings for
1620   ** the result, result columns may become dynamic if the user calls
1621   ** sqlite3_column_text16(), causing a translation to UTF-16 encoding.
1622   */
1623   releaseMemArray(pMem, 8);
1624   p->pResultSet = 0;
1625 
1626   if( p->rc==SQLITE_NOMEM_BKPT ){
1627     /* This happens if a malloc() inside a call to sqlite3_column_text() or
1628     ** sqlite3_column_text16() failed.  */
1629     sqlite3OomFault(db);
1630     return SQLITE_ERROR;
1631   }
1632 
1633   /* When the number of output rows reaches nRow, that means the
1634   ** listing has finished and sqlite3_step() should return SQLITE_DONE.
1635   ** nRow is the sum of the number of rows in the main program, plus
1636   ** the sum of the number of rows in all trigger subprograms encountered
1637   ** so far.  The nRow value will increase as new trigger subprograms are
1638   ** encountered, but p->pc will eventually catch up to nRow.
1639   */
1640   nRow = p->nOp;
1641   if( p->explain==1 ){
1642     /* The first 8 memory cells are used for the result set.  So we will
1643     ** commandeer the 9th cell to use as storage for an array of pointers
1644     ** to trigger subprograms.  The VDBE is guaranteed to have at least 9
1645     ** cells.  */
1646     assert( p->nMem>9 );
1647     pSub = &p->aMem[9];
1648     if( pSub->flags&MEM_Blob ){
1649       /* On the first call to sqlite3_step(), pSub will hold a NULL.  It is
1650       ** initialized to a BLOB by the P4_SUBPROGRAM processing logic below */
1651       nSub = pSub->n/sizeof(Vdbe*);
1652       apSub = (SubProgram **)pSub->z;
1653     }
1654     for(i=0; i<nSub; i++){
1655       nRow += apSub[i]->nOp;
1656     }
1657   }
1658 
1659   do{
1660     i = p->pc++;
1661   }while( i<nRow && p->explain==2 && p->aOp[i].opcode!=OP_Explain );
1662   if( i>=nRow ){
1663     p->rc = SQLITE_OK;
1664     rc = SQLITE_DONE;
1665   }else if( db->u1.isInterrupted ){
1666     p->rc = SQLITE_INTERRUPT;
1667     rc = SQLITE_ERROR;
1668     sqlite3VdbeError(p, sqlite3ErrStr(p->rc));
1669   }else{
1670     char *zP4;
1671     Op *pOp;
1672     if( i<p->nOp ){
1673       /* The output line number is small enough that we are still in the
1674       ** main program. */
1675       pOp = &p->aOp[i];
1676     }else{
1677       /* We are currently listing subprograms.  Figure out which one and
1678       ** pick up the appropriate opcode. */
1679       int j;
1680       i -= p->nOp;
1681       for(j=0; i>=apSub[j]->nOp; j++){
1682         i -= apSub[j]->nOp;
1683       }
1684       pOp = &apSub[j]->aOp[i];
1685     }
1686     if( p->explain==1 ){
1687       pMem->flags = MEM_Int;
1688       pMem->u.i = i;                                /* Program counter */
1689       pMem++;
1690 
1691       pMem->flags = MEM_Static|MEM_Str|MEM_Term;
1692       pMem->z = (char*)sqlite3OpcodeName(pOp->opcode); /* Opcode */
1693       assert( pMem->z!=0 );
1694       pMem->n = sqlite3Strlen30(pMem->z);
1695       pMem->enc = SQLITE_UTF8;
1696       pMem++;
1697 
1698       /* When an OP_Program opcode is encounter (the only opcode that has
1699       ** a P4_SUBPROGRAM argument), expand the size of the array of subprograms
1700       ** kept in p->aMem[9].z to hold the new program - assuming this subprogram
1701       ** has not already been seen.
1702       */
1703       if( pOp->p4type==P4_SUBPROGRAM ){
1704         int nByte = (nSub+1)*sizeof(SubProgram*);
1705         int j;
1706         for(j=0; j<nSub; j++){
1707           if( apSub[j]==pOp->p4.pProgram ) break;
1708         }
1709         if( j==nSub && SQLITE_OK==sqlite3VdbeMemGrow(pSub, nByte, nSub!=0) ){
1710           apSub = (SubProgram **)pSub->z;
1711           apSub[nSub++] = pOp->p4.pProgram;
1712           pSub->flags |= MEM_Blob;
1713           pSub->n = nSub*sizeof(SubProgram*);
1714         }
1715       }
1716     }
1717 
1718     pMem->flags = MEM_Int;
1719     pMem->u.i = pOp->p1;                          /* P1 */
1720     pMem++;
1721 
1722     pMem->flags = MEM_Int;
1723     pMem->u.i = pOp->p2;                          /* P2 */
1724     pMem++;
1725 
1726     pMem->flags = MEM_Int;
1727     pMem->u.i = pOp->p3;                          /* P3 */
1728     pMem++;
1729 
1730     if( sqlite3VdbeMemClearAndResize(pMem, 100) ){ /* P4 */
1731       assert( p->db->mallocFailed );
1732       return SQLITE_ERROR;
1733     }
1734     pMem->flags = MEM_Str|MEM_Term;
1735     zP4 = displayP4(pOp, pMem->z, pMem->szMalloc);
1736     if( zP4!=pMem->z ){
1737       pMem->n = 0;
1738       sqlite3VdbeMemSetStr(pMem, zP4, -1, SQLITE_UTF8, 0);
1739     }else{
1740       assert( pMem->z!=0 );
1741       pMem->n = sqlite3Strlen30(pMem->z);
1742       pMem->enc = SQLITE_UTF8;
1743     }
1744     pMem++;
1745 
1746     if( p->explain==1 ){
1747       if( sqlite3VdbeMemClearAndResize(pMem, 4) ){
1748         assert( p->db->mallocFailed );
1749         return SQLITE_ERROR;
1750       }
1751       pMem->flags = MEM_Str|MEM_Term;
1752       pMem->n = 2;
1753       sqlite3_snprintf(3, pMem->z, "%.2x", pOp->p5);   /* P5 */
1754       pMem->enc = SQLITE_UTF8;
1755       pMem++;
1756 
1757 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1758       if( sqlite3VdbeMemClearAndResize(pMem, 500) ){
1759         assert( p->db->mallocFailed );
1760         return SQLITE_ERROR;
1761       }
1762       pMem->flags = MEM_Str|MEM_Term;
1763       pMem->n = displayComment(pOp, zP4, pMem->z, 500);
1764       pMem->enc = SQLITE_UTF8;
1765 #else
1766       pMem->flags = MEM_Null;                       /* Comment */
1767 #endif
1768     }
1769 
1770     p->nResColumn = 8 - 4*(p->explain-1);
1771     p->pResultSet = &p->aMem[1];
1772     p->rc = SQLITE_OK;
1773     rc = SQLITE_ROW;
1774   }
1775   return rc;
1776 }
1777 #endif /* SQLITE_OMIT_EXPLAIN */
1778 
1779 #ifdef SQLITE_DEBUG
1780 /*
1781 ** Print the SQL that was used to generate a VDBE program.
1782 */
1783 void sqlite3VdbePrintSql(Vdbe *p){
1784   const char *z = 0;
1785   if( p->zSql ){
1786     z = p->zSql;
1787   }else if( p->nOp>=1 ){
1788     const VdbeOp *pOp = &p->aOp[0];
1789     if( pOp->opcode==OP_Init && pOp->p4.z!=0 ){
1790       z = pOp->p4.z;
1791       while( sqlite3Isspace(*z) ) z++;
1792     }
1793   }
1794   if( z ) printf("SQL: [%s]\n", z);
1795 }
1796 #endif
1797 
1798 #if !defined(SQLITE_OMIT_TRACE) && defined(SQLITE_ENABLE_IOTRACE)
1799 /*
1800 ** Print an IOTRACE message showing SQL content.
1801 */
1802 void sqlite3VdbeIOTraceSql(Vdbe *p){
1803   int nOp = p->nOp;
1804   VdbeOp *pOp;
1805   if( sqlite3IoTrace==0 ) return;
1806   if( nOp<1 ) return;
1807   pOp = &p->aOp[0];
1808   if( pOp->opcode==OP_Init && pOp->p4.z!=0 ){
1809     int i, j;
1810     char z[1000];
1811     sqlite3_snprintf(sizeof(z), z, "%s", pOp->p4.z);
1812     for(i=0; sqlite3Isspace(z[i]); i++){}
1813     for(j=0; z[i]; i++){
1814       if( sqlite3Isspace(z[i]) ){
1815         if( z[i-1]!=' ' ){
1816           z[j++] = ' ';
1817         }
1818       }else{
1819         z[j++] = z[i];
1820       }
1821     }
1822     z[j] = 0;
1823     sqlite3IoTrace("SQL %s\n", z);
1824   }
1825 }
1826 #endif /* !SQLITE_OMIT_TRACE && SQLITE_ENABLE_IOTRACE */
1827 
1828 /* An instance of this object describes bulk memory available for use
1829 ** by subcomponents of a prepared statement.  Space is allocated out
1830 ** of a ReusableSpace object by the allocSpace() routine below.
1831 */
1832 struct ReusableSpace {
1833   u8 *pSpace;          /* Available memory */
1834   int nFree;           /* Bytes of available memory */
1835   int nNeeded;         /* Total bytes that could not be allocated */
1836 };
1837 
1838 /* Try to allocate nByte bytes of 8-byte aligned bulk memory for pBuf
1839 ** from the ReusableSpace object.  Return a pointer to the allocated
1840 ** memory on success.  If insufficient memory is available in the
1841 ** ReusableSpace object, increase the ReusableSpace.nNeeded
1842 ** value by the amount needed and return NULL.
1843 **
1844 ** If pBuf is not initially NULL, that means that the memory has already
1845 ** been allocated by a prior call to this routine, so just return a copy
1846 ** of pBuf and leave ReusableSpace unchanged.
1847 **
1848 ** This allocator is employed to repurpose unused slots at the end of the
1849 ** opcode array of prepared state for other memory needs of the prepared
1850 ** statement.
1851 */
1852 static void *allocSpace(
1853   struct ReusableSpace *p,  /* Bulk memory available for allocation */
1854   void *pBuf,               /* Pointer to a prior allocation */
1855   int nByte                 /* Bytes of memory needed */
1856 ){
1857   assert( EIGHT_BYTE_ALIGNMENT(p->pSpace) );
1858   if( pBuf==0 ){
1859     nByte = ROUND8(nByte);
1860     if( nByte <= p->nFree ){
1861       p->nFree -= nByte;
1862       pBuf = &p->pSpace[p->nFree];
1863     }else{
1864       p->nNeeded += nByte;
1865     }
1866   }
1867   assert( EIGHT_BYTE_ALIGNMENT(pBuf) );
1868   return pBuf;
1869 }
1870 
1871 /*
1872 ** Rewind the VDBE back to the beginning in preparation for
1873 ** running it.
1874 */
1875 void sqlite3VdbeRewind(Vdbe *p){
1876 #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
1877   int i;
1878 #endif
1879   assert( p!=0 );
1880   assert( p->magic==VDBE_MAGIC_INIT || p->magic==VDBE_MAGIC_RESET );
1881 
1882   /* There should be at least one opcode.
1883   */
1884   assert( p->nOp>0 );
1885 
1886   /* Set the magic to VDBE_MAGIC_RUN sooner rather than later. */
1887   p->magic = VDBE_MAGIC_RUN;
1888 
1889 #ifdef SQLITE_DEBUG
1890   for(i=0; i<p->nMem; i++){
1891     assert( p->aMem[i].db==p->db );
1892   }
1893 #endif
1894   p->pc = -1;
1895   p->rc = SQLITE_OK;
1896   p->errorAction = OE_Abort;
1897   p->nChange = 0;
1898   p->cacheCtr = 1;
1899   p->minWriteFileFormat = 255;
1900   p->iStatement = 0;
1901   p->nFkConstraint = 0;
1902 #ifdef VDBE_PROFILE
1903   for(i=0; i<p->nOp; i++){
1904     p->aOp[i].cnt = 0;
1905     p->aOp[i].cycles = 0;
1906   }
1907 #endif
1908 }
1909 
1910 /*
1911 ** Prepare a virtual machine for execution for the first time after
1912 ** creating the virtual machine.  This involves things such
1913 ** as allocating registers and initializing the program counter.
1914 ** After the VDBE has be prepped, it can be executed by one or more
1915 ** calls to sqlite3VdbeExec().
1916 **
1917 ** This function may be called exactly once on each virtual machine.
1918 ** After this routine is called the VM has been "packaged" and is ready
1919 ** to run.  After this routine is called, further calls to
1920 ** sqlite3VdbeAddOp() functions are prohibited.  This routine disconnects
1921 ** the Vdbe from the Parse object that helped generate it so that the
1922 ** the Vdbe becomes an independent entity and the Parse object can be
1923 ** destroyed.
1924 **
1925 ** Use the sqlite3VdbeRewind() procedure to restore a virtual machine back
1926 ** to its initial state after it has been run.
1927 */
1928 void sqlite3VdbeMakeReady(
1929   Vdbe *p,                       /* The VDBE */
1930   Parse *pParse                  /* Parsing context */
1931 ){
1932   sqlite3 *db;                   /* The database connection */
1933   int nVar;                      /* Number of parameters */
1934   int nMem;                      /* Number of VM memory registers */
1935   int nCursor;                   /* Number of cursors required */
1936   int nArg;                      /* Number of arguments in subprograms */
1937   int n;                         /* Loop counter */
1938   struct ReusableSpace x;        /* Reusable bulk memory */
1939 
1940   assert( p!=0 );
1941   assert( p->nOp>0 );
1942   assert( pParse!=0 );
1943   assert( p->magic==VDBE_MAGIC_INIT );
1944   assert( pParse==p->pParse );
1945   db = p->db;
1946   assert( db->mallocFailed==0 );
1947   nVar = pParse->nVar;
1948   nMem = pParse->nMem;
1949   nCursor = pParse->nTab;
1950   nArg = pParse->nMaxArg;
1951 
1952   /* Each cursor uses a memory cell.  The first cursor (cursor 0) can
1953   ** use aMem[0] which is not otherwise used by the VDBE program.  Allocate
1954   ** space at the end of aMem[] for cursors 1 and greater.
1955   ** See also: allocateCursor().
1956   */
1957   nMem += nCursor;
1958   if( nCursor==0 && nMem>0 ) nMem++;  /* Space for aMem[0] even if not used */
1959 
1960   /* Figure out how much reusable memory is available at the end of the
1961   ** opcode array.  This extra memory will be reallocated for other elements
1962   ** of the prepared statement.
1963   */
1964   n = ROUND8(sizeof(Op)*p->nOp);              /* Bytes of opcode memory used */
1965   x.pSpace = &((u8*)p->aOp)[n];               /* Unused opcode memory */
1966   assert( EIGHT_BYTE_ALIGNMENT(x.pSpace) );
1967   x.nFree = ROUNDDOWN8(pParse->szOpAlloc - n);  /* Bytes of unused memory */
1968   assert( x.nFree>=0 );
1969   assert( EIGHT_BYTE_ALIGNMENT(&x.pSpace[x.nFree]) );
1970 
1971   resolveP2Values(p, &nArg);
1972   p->usesStmtJournal = (u8)(pParse->isMultiWrite && pParse->mayAbort);
1973   if( pParse->explain && nMem<10 ){
1974     nMem = 10;
1975   }
1976   p->expired = 0;
1977 
1978   /* Memory for registers, parameters, cursor, etc, is allocated in one or two
1979   ** passes.  On the first pass, we try to reuse unused memory at the
1980   ** end of the opcode array.  If we are unable to satisfy all memory
1981   ** requirements by reusing the opcode array tail, then the second
1982   ** pass will fill in the remainder using a fresh memory allocation.
1983   **
1984   ** This two-pass approach that reuses as much memory as possible from
1985   ** the leftover memory at the end of the opcode array.  This can significantly
1986   ** reduce the amount of memory held by a prepared statement.
1987   */
1988   do {
1989     x.nNeeded = 0;
1990     p->aMem = allocSpace(&x, p->aMem, nMem*sizeof(Mem));
1991     p->aVar = allocSpace(&x, p->aVar, nVar*sizeof(Mem));
1992     p->apArg = allocSpace(&x, p->apArg, nArg*sizeof(Mem*));
1993     p->apCsr = allocSpace(&x, p->apCsr, nCursor*sizeof(VdbeCursor*));
1994 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
1995     p->anExec = allocSpace(&x, p->anExec, p->nOp*sizeof(i64));
1996 #endif
1997     if( x.nNeeded==0 ) break;
1998     x.pSpace = p->pFree = sqlite3DbMallocRawNN(db, x.nNeeded);
1999     x.nFree = x.nNeeded;
2000   }while( !db->mallocFailed );
2001 
2002   p->pVList = pParse->pVList;
2003   pParse->pVList =  0;
2004   p->explain = pParse->explain;
2005   if( db->mallocFailed ){
2006     p->nVar = 0;
2007     p->nCursor = 0;
2008     p->nMem = 0;
2009   }else{
2010     p->nCursor = nCursor;
2011     p->nVar = (ynVar)nVar;
2012     initMemArray(p->aVar, nVar, db, MEM_Null);
2013     p->nMem = nMem;
2014     initMemArray(p->aMem, nMem, db, MEM_Undefined);
2015     memset(p->apCsr, 0, nCursor*sizeof(VdbeCursor*));
2016 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2017     memset(p->anExec, 0, p->nOp*sizeof(i64));
2018 #endif
2019   }
2020   sqlite3VdbeRewind(p);
2021 }
2022 
2023 /*
2024 ** Close a VDBE cursor and release all the resources that cursor
2025 ** happens to hold.
2026 */
2027 void sqlite3VdbeFreeCursor(Vdbe *p, VdbeCursor *pCx){
2028   if( pCx==0 ){
2029     return;
2030   }
2031   assert( pCx->pBtx==0 || pCx->eCurType==CURTYPE_BTREE );
2032   switch( pCx->eCurType ){
2033     case CURTYPE_SORTER: {
2034       sqlite3VdbeSorterClose(p->db, pCx);
2035       break;
2036     }
2037     case CURTYPE_BTREE: {
2038       if( pCx->isEphemeral ){
2039         if( pCx->pBtx ) sqlite3BtreeClose(pCx->pBtx);
2040         /* The pCx->pCursor will be close automatically, if it exists, by
2041         ** the call above. */
2042       }else{
2043         assert( pCx->uc.pCursor!=0 );
2044         sqlite3BtreeCloseCursor(pCx->uc.pCursor);
2045       }
2046       break;
2047     }
2048 #ifndef SQLITE_OMIT_VIRTUALTABLE
2049     case CURTYPE_VTAB: {
2050       sqlite3_vtab_cursor *pVCur = pCx->uc.pVCur;
2051       const sqlite3_module *pModule = pVCur->pVtab->pModule;
2052       assert( pVCur->pVtab->nRef>0 );
2053       pVCur->pVtab->nRef--;
2054       pModule->xClose(pVCur);
2055       break;
2056     }
2057 #endif
2058   }
2059 }
2060 
2061 /*
2062 ** Close all cursors in the current frame.
2063 */
2064 static void closeCursorsInFrame(Vdbe *p){
2065   if( p->apCsr ){
2066     int i;
2067     for(i=0; i<p->nCursor; i++){
2068       VdbeCursor *pC = p->apCsr[i];
2069       if( pC ){
2070         sqlite3VdbeFreeCursor(p, pC);
2071         p->apCsr[i] = 0;
2072       }
2073     }
2074   }
2075 }
2076 
2077 /*
2078 ** Copy the values stored in the VdbeFrame structure to its Vdbe. This
2079 ** is used, for example, when a trigger sub-program is halted to restore
2080 ** control to the main program.
2081 */
2082 int sqlite3VdbeFrameRestore(VdbeFrame *pFrame){
2083   Vdbe *v = pFrame->v;
2084   closeCursorsInFrame(v);
2085 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2086   v->anExec = pFrame->anExec;
2087 #endif
2088   v->aOp = pFrame->aOp;
2089   v->nOp = pFrame->nOp;
2090   v->aMem = pFrame->aMem;
2091   v->nMem = pFrame->nMem;
2092   v->apCsr = pFrame->apCsr;
2093   v->nCursor = pFrame->nCursor;
2094   v->db->lastRowid = pFrame->lastRowid;
2095   v->nChange = pFrame->nChange;
2096   v->db->nChange = pFrame->nDbChange;
2097   sqlite3VdbeDeleteAuxData(v->db, &v->pAuxData, -1, 0);
2098   v->pAuxData = pFrame->pAuxData;
2099   pFrame->pAuxData = 0;
2100   return pFrame->pc;
2101 }
2102 
2103 /*
2104 ** Close all cursors.
2105 **
2106 ** Also release any dynamic memory held by the VM in the Vdbe.aMem memory
2107 ** cell array. This is necessary as the memory cell array may contain
2108 ** pointers to VdbeFrame objects, which may in turn contain pointers to
2109 ** open cursors.
2110 */
2111 static void closeAllCursors(Vdbe *p){
2112   if( p->pFrame ){
2113     VdbeFrame *pFrame;
2114     for(pFrame=p->pFrame; pFrame->pParent; pFrame=pFrame->pParent);
2115     sqlite3VdbeFrameRestore(pFrame);
2116     p->pFrame = 0;
2117     p->nFrame = 0;
2118   }
2119   assert( p->nFrame==0 );
2120   closeCursorsInFrame(p);
2121   if( p->aMem ){
2122     releaseMemArray(p->aMem, p->nMem);
2123   }
2124   while( p->pDelFrame ){
2125     VdbeFrame *pDel = p->pDelFrame;
2126     p->pDelFrame = pDel->pParent;
2127     sqlite3VdbeFrameDelete(pDel);
2128   }
2129 
2130   /* Delete any auxdata allocations made by the VM */
2131   if( p->pAuxData ) sqlite3VdbeDeleteAuxData(p->db, &p->pAuxData, -1, 0);
2132   assert( p->pAuxData==0 );
2133 }
2134 
2135 /*
2136 ** Clean up the VM after a single run.
2137 */
2138 static void Cleanup(Vdbe *p){
2139   sqlite3 *db = p->db;
2140 
2141 #ifdef SQLITE_DEBUG
2142   /* Execute assert() statements to ensure that the Vdbe.apCsr[] and
2143   ** Vdbe.aMem[] arrays have already been cleaned up.  */
2144   int i;
2145   if( p->apCsr ) for(i=0; i<p->nCursor; i++) assert( p->apCsr[i]==0 );
2146   if( p->aMem ){
2147     for(i=0; i<p->nMem; i++) assert( p->aMem[i].flags==MEM_Undefined );
2148   }
2149 #endif
2150 
2151   sqlite3DbFree(db, p->zErrMsg);
2152   p->zErrMsg = 0;
2153   p->pResultSet = 0;
2154 }
2155 
2156 /*
2157 ** Set the number of result columns that will be returned by this SQL
2158 ** statement. This is now set at compile time, rather than during
2159 ** execution of the vdbe program so that sqlite3_column_count() can
2160 ** be called on an SQL statement before sqlite3_step().
2161 */
2162 void sqlite3VdbeSetNumCols(Vdbe *p, int nResColumn){
2163   int n;
2164   sqlite3 *db = p->db;
2165 
2166   if( p->nResColumn ){
2167     releaseMemArray(p->aColName, p->nResColumn*COLNAME_N);
2168     sqlite3DbFree(db, p->aColName);
2169   }
2170   n = nResColumn*COLNAME_N;
2171   p->nResColumn = (u16)nResColumn;
2172   p->aColName = (Mem*)sqlite3DbMallocRawNN(db, sizeof(Mem)*n );
2173   if( p->aColName==0 ) return;
2174   initMemArray(p->aColName, n, db, MEM_Null);
2175 }
2176 
2177 /*
2178 ** Set the name of the idx'th column to be returned by the SQL statement.
2179 ** zName must be a pointer to a nul terminated string.
2180 **
2181 ** This call must be made after a call to sqlite3VdbeSetNumCols().
2182 **
2183 ** The final parameter, xDel, must be one of SQLITE_DYNAMIC, SQLITE_STATIC
2184 ** or SQLITE_TRANSIENT. If it is SQLITE_DYNAMIC, then the buffer pointed
2185 ** to by zName will be freed by sqlite3DbFree() when the vdbe is destroyed.
2186 */
2187 int sqlite3VdbeSetColName(
2188   Vdbe *p,                         /* Vdbe being configured */
2189   int idx,                         /* Index of column zName applies to */
2190   int var,                         /* One of the COLNAME_* constants */
2191   const char *zName,               /* Pointer to buffer containing name */
2192   void (*xDel)(void*)              /* Memory management strategy for zName */
2193 ){
2194   int rc;
2195   Mem *pColName;
2196   assert( idx<p->nResColumn );
2197   assert( var<COLNAME_N );
2198   if( p->db->mallocFailed ){
2199     assert( !zName || xDel!=SQLITE_DYNAMIC );
2200     return SQLITE_NOMEM_BKPT;
2201   }
2202   assert( p->aColName!=0 );
2203   pColName = &(p->aColName[idx+var*p->nResColumn]);
2204   rc = sqlite3VdbeMemSetStr(pColName, zName, -1, SQLITE_UTF8, xDel);
2205   assert( rc!=0 || !zName || (pColName->flags&MEM_Term)!=0 );
2206   return rc;
2207 }
2208 
2209 /*
2210 ** A read or write transaction may or may not be active on database handle
2211 ** db. If a transaction is active, commit it. If there is a
2212 ** write-transaction spanning more than one database file, this routine
2213 ** takes care of the master journal trickery.
2214 */
2215 static int vdbeCommit(sqlite3 *db, Vdbe *p){
2216   int i;
2217   int nTrans = 0;  /* Number of databases with an active write-transaction
2218                    ** that are candidates for a two-phase commit using a
2219                    ** master-journal */
2220   int rc = SQLITE_OK;
2221   int needXcommit = 0;
2222 
2223 #ifdef SQLITE_OMIT_VIRTUALTABLE
2224   /* With this option, sqlite3VtabSync() is defined to be simply
2225   ** SQLITE_OK so p is not used.
2226   */
2227   UNUSED_PARAMETER(p);
2228 #endif
2229 
2230   /* Before doing anything else, call the xSync() callback for any
2231   ** virtual module tables written in this transaction. This has to
2232   ** be done before determining whether a master journal file is
2233   ** required, as an xSync() callback may add an attached database
2234   ** to the transaction.
2235   */
2236   rc = sqlite3VtabSync(db, p);
2237 
2238   /* This loop determines (a) if the commit hook should be invoked and
2239   ** (b) how many database files have open write transactions, not
2240   ** including the temp database. (b) is important because if more than
2241   ** one database file has an open write transaction, a master journal
2242   ** file is required for an atomic commit.
2243   */
2244   for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2245     Btree *pBt = db->aDb[i].pBt;
2246     if( sqlite3BtreeIsInTrans(pBt) ){
2247       /* Whether or not a database might need a master journal depends upon
2248       ** its journal mode (among other things).  This matrix determines which
2249       ** journal modes use a master journal and which do not */
2250       static const u8 aMJNeeded[] = {
2251         /* DELETE   */  1,
2252         /* PERSIST   */ 1,
2253         /* OFF       */ 0,
2254         /* TRUNCATE  */ 1,
2255         /* MEMORY    */ 0,
2256         /* WAL       */ 0
2257       };
2258       Pager *pPager;   /* Pager associated with pBt */
2259       needXcommit = 1;
2260       sqlite3BtreeEnter(pBt);
2261       pPager = sqlite3BtreePager(pBt);
2262       if( db->aDb[i].safety_level!=PAGER_SYNCHRONOUS_OFF
2263        && aMJNeeded[sqlite3PagerGetJournalMode(pPager)]
2264       ){
2265         assert( i!=1 );
2266         nTrans++;
2267       }
2268       rc = sqlite3PagerExclusiveLock(pPager);
2269       sqlite3BtreeLeave(pBt);
2270     }
2271   }
2272   if( rc!=SQLITE_OK ){
2273     return rc;
2274   }
2275 
2276   /* If there are any write-transactions at all, invoke the commit hook */
2277   if( needXcommit && db->xCommitCallback ){
2278     rc = db->xCommitCallback(db->pCommitArg);
2279     if( rc ){
2280       return SQLITE_CONSTRAINT_COMMITHOOK;
2281     }
2282   }
2283 
2284   /* The simple case - no more than one database file (not counting the
2285   ** TEMP database) has a transaction active.   There is no need for the
2286   ** master-journal.
2287   **
2288   ** If the return value of sqlite3BtreeGetFilename() is a zero length
2289   ** string, it means the main database is :memory: or a temp file.  In
2290   ** that case we do not support atomic multi-file commits, so use the
2291   ** simple case then too.
2292   */
2293   if( 0==sqlite3Strlen30(sqlite3BtreeGetFilename(db->aDb[0].pBt))
2294    || nTrans<=1
2295   ){
2296     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2297       Btree *pBt = db->aDb[i].pBt;
2298       if( pBt ){
2299         rc = sqlite3BtreeCommitPhaseOne(pBt, 0);
2300       }
2301     }
2302 
2303     /* Do the commit only if all databases successfully complete phase 1.
2304     ** If one of the BtreeCommitPhaseOne() calls fails, this indicates an
2305     ** IO error while deleting or truncating a journal file. It is unlikely,
2306     ** but could happen. In this case abandon processing and return the error.
2307     */
2308     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2309       Btree *pBt = db->aDb[i].pBt;
2310       if( pBt ){
2311         rc = sqlite3BtreeCommitPhaseTwo(pBt, 0);
2312       }
2313     }
2314     if( rc==SQLITE_OK ){
2315       sqlite3VtabCommit(db);
2316     }
2317   }
2318 
2319   /* The complex case - There is a multi-file write-transaction active.
2320   ** This requires a master journal file to ensure the transaction is
2321   ** committed atomically.
2322   */
2323 #ifndef SQLITE_OMIT_DISKIO
2324   else{
2325     sqlite3_vfs *pVfs = db->pVfs;
2326     char *zMaster = 0;   /* File-name for the master journal */
2327     char const *zMainFile = sqlite3BtreeGetFilename(db->aDb[0].pBt);
2328     sqlite3_file *pMaster = 0;
2329     i64 offset = 0;
2330     int res;
2331     int retryCount = 0;
2332     int nMainFile;
2333 
2334     /* Select a master journal file name */
2335     nMainFile = sqlite3Strlen30(zMainFile);
2336     zMaster = sqlite3MPrintf(db, "%s-mjXXXXXX9XXz", zMainFile);
2337     if( zMaster==0 ) return SQLITE_NOMEM_BKPT;
2338     do {
2339       u32 iRandom;
2340       if( retryCount ){
2341         if( retryCount>100 ){
2342           sqlite3_log(SQLITE_FULL, "MJ delete: %s", zMaster);
2343           sqlite3OsDelete(pVfs, zMaster, 0);
2344           break;
2345         }else if( retryCount==1 ){
2346           sqlite3_log(SQLITE_FULL, "MJ collide: %s", zMaster);
2347         }
2348       }
2349       retryCount++;
2350       sqlite3_randomness(sizeof(iRandom), &iRandom);
2351       sqlite3_snprintf(13, &zMaster[nMainFile], "-mj%06X9%02X",
2352                                (iRandom>>8)&0xffffff, iRandom&0xff);
2353       /* The antipenultimate character of the master journal name must
2354       ** be "9" to avoid name collisions when using 8+3 filenames. */
2355       assert( zMaster[sqlite3Strlen30(zMaster)-3]=='9' );
2356       sqlite3FileSuffix3(zMainFile, zMaster);
2357       rc = sqlite3OsAccess(pVfs, zMaster, SQLITE_ACCESS_EXISTS, &res);
2358     }while( rc==SQLITE_OK && res );
2359     if( rc==SQLITE_OK ){
2360       /* Open the master journal. */
2361       rc = sqlite3OsOpenMalloc(pVfs, zMaster, &pMaster,
2362           SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE|
2363           SQLITE_OPEN_EXCLUSIVE|SQLITE_OPEN_MASTER_JOURNAL, 0
2364       );
2365     }
2366     if( rc!=SQLITE_OK ){
2367       sqlite3DbFree(db, zMaster);
2368       return rc;
2369     }
2370 
2371     /* Write the name of each database file in the transaction into the new
2372     ** master journal file. If an error occurs at this point close
2373     ** and delete the master journal file. All the individual journal files
2374     ** still have 'null' as the master journal pointer, so they will roll
2375     ** back independently if a failure occurs.
2376     */
2377     for(i=0; i<db->nDb; i++){
2378       Btree *pBt = db->aDb[i].pBt;
2379       if( sqlite3BtreeIsInTrans(pBt) ){
2380         char const *zFile = sqlite3BtreeGetJournalname(pBt);
2381         if( zFile==0 ){
2382           continue;  /* Ignore TEMP and :memory: databases */
2383         }
2384         assert( zFile[0]!=0 );
2385         rc = sqlite3OsWrite(pMaster, zFile, sqlite3Strlen30(zFile)+1, offset);
2386         offset += sqlite3Strlen30(zFile)+1;
2387         if( rc!=SQLITE_OK ){
2388           sqlite3OsCloseFree(pMaster);
2389           sqlite3OsDelete(pVfs, zMaster, 0);
2390           sqlite3DbFree(db, zMaster);
2391           return rc;
2392         }
2393       }
2394     }
2395 
2396     /* Sync the master journal file. If the IOCAP_SEQUENTIAL device
2397     ** flag is set this is not required.
2398     */
2399     if( 0==(sqlite3OsDeviceCharacteristics(pMaster)&SQLITE_IOCAP_SEQUENTIAL)
2400      && SQLITE_OK!=(rc = sqlite3OsSync(pMaster, SQLITE_SYNC_NORMAL))
2401     ){
2402       sqlite3OsCloseFree(pMaster);
2403       sqlite3OsDelete(pVfs, zMaster, 0);
2404       sqlite3DbFree(db, zMaster);
2405       return rc;
2406     }
2407 
2408     /* Sync all the db files involved in the transaction. The same call
2409     ** sets the master journal pointer in each individual journal. If
2410     ** an error occurs here, do not delete the master journal file.
2411     **
2412     ** If the error occurs during the first call to
2413     ** sqlite3BtreeCommitPhaseOne(), then there is a chance that the
2414     ** master journal file will be orphaned. But we cannot delete it,
2415     ** in case the master journal file name was written into the journal
2416     ** file before the failure occurred.
2417     */
2418     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2419       Btree *pBt = db->aDb[i].pBt;
2420       if( pBt ){
2421         rc = sqlite3BtreeCommitPhaseOne(pBt, zMaster);
2422       }
2423     }
2424     sqlite3OsCloseFree(pMaster);
2425     assert( rc!=SQLITE_BUSY );
2426     if( rc!=SQLITE_OK ){
2427       sqlite3DbFree(db, zMaster);
2428       return rc;
2429     }
2430 
2431     /* Delete the master journal file. This commits the transaction. After
2432     ** doing this the directory is synced again before any individual
2433     ** transaction files are deleted.
2434     */
2435     rc = sqlite3OsDelete(pVfs, zMaster, 1);
2436     sqlite3DbFree(db, zMaster);
2437     zMaster = 0;
2438     if( rc ){
2439       return rc;
2440     }
2441 
2442     /* All files and directories have already been synced, so the following
2443     ** calls to sqlite3BtreeCommitPhaseTwo() are only closing files and
2444     ** deleting or truncating journals. If something goes wrong while
2445     ** this is happening we don't really care. The integrity of the
2446     ** transaction is already guaranteed, but some stray 'cold' journals
2447     ** may be lying around. Returning an error code won't help matters.
2448     */
2449     disable_simulated_io_errors();
2450     sqlite3BeginBenignMalloc();
2451     for(i=0; i<db->nDb; i++){
2452       Btree *pBt = db->aDb[i].pBt;
2453       if( pBt ){
2454         sqlite3BtreeCommitPhaseTwo(pBt, 1);
2455       }
2456     }
2457     sqlite3EndBenignMalloc();
2458     enable_simulated_io_errors();
2459 
2460     sqlite3VtabCommit(db);
2461   }
2462 #endif
2463 
2464   return rc;
2465 }
2466 
2467 /*
2468 ** This routine checks that the sqlite3.nVdbeActive count variable
2469 ** matches the number of vdbe's in the list sqlite3.pVdbe that are
2470 ** currently active. An assertion fails if the two counts do not match.
2471 ** This is an internal self-check only - it is not an essential processing
2472 ** step.
2473 **
2474 ** This is a no-op if NDEBUG is defined.
2475 */
2476 #ifndef NDEBUG
2477 static void checkActiveVdbeCnt(sqlite3 *db){
2478   Vdbe *p;
2479   int cnt = 0;
2480   int nWrite = 0;
2481   int nRead = 0;
2482   p = db->pVdbe;
2483   while( p ){
2484     if( sqlite3_stmt_busy((sqlite3_stmt*)p) ){
2485       cnt++;
2486       if( p->readOnly==0 ) nWrite++;
2487       if( p->bIsReader ) nRead++;
2488     }
2489     p = p->pNext;
2490   }
2491   assert( cnt==db->nVdbeActive );
2492   assert( nWrite==db->nVdbeWrite );
2493   assert( nRead==db->nVdbeRead );
2494 }
2495 #else
2496 #define checkActiveVdbeCnt(x)
2497 #endif
2498 
2499 /*
2500 ** If the Vdbe passed as the first argument opened a statement-transaction,
2501 ** close it now. Argument eOp must be either SAVEPOINT_ROLLBACK or
2502 ** SAVEPOINT_RELEASE. If it is SAVEPOINT_ROLLBACK, then the statement
2503 ** transaction is rolled back. If eOp is SAVEPOINT_RELEASE, then the
2504 ** statement transaction is committed.
2505 **
2506 ** If an IO error occurs, an SQLITE_IOERR_XXX error code is returned.
2507 ** Otherwise SQLITE_OK.
2508 */
2509 static SQLITE_NOINLINE int vdbeCloseStatement(Vdbe *p, int eOp){
2510   sqlite3 *const db = p->db;
2511   int rc = SQLITE_OK;
2512   int i;
2513   const int iSavepoint = p->iStatement-1;
2514 
2515   assert( eOp==SAVEPOINT_ROLLBACK || eOp==SAVEPOINT_RELEASE);
2516   assert( db->nStatement>0 );
2517   assert( p->iStatement==(db->nStatement+db->nSavepoint) );
2518 
2519   for(i=0; i<db->nDb; i++){
2520     int rc2 = SQLITE_OK;
2521     Btree *pBt = db->aDb[i].pBt;
2522     if( pBt ){
2523       if( eOp==SAVEPOINT_ROLLBACK ){
2524         rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_ROLLBACK, iSavepoint);
2525       }
2526       if( rc2==SQLITE_OK ){
2527         rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_RELEASE, iSavepoint);
2528       }
2529       if( rc==SQLITE_OK ){
2530         rc = rc2;
2531       }
2532     }
2533   }
2534   db->nStatement--;
2535   p->iStatement = 0;
2536 
2537   if( rc==SQLITE_OK ){
2538     if( eOp==SAVEPOINT_ROLLBACK ){
2539       rc = sqlite3VtabSavepoint(db, SAVEPOINT_ROLLBACK, iSavepoint);
2540     }
2541     if( rc==SQLITE_OK ){
2542       rc = sqlite3VtabSavepoint(db, SAVEPOINT_RELEASE, iSavepoint);
2543     }
2544   }
2545 
2546   /* If the statement transaction is being rolled back, also restore the
2547   ** database handles deferred constraint counter to the value it had when
2548   ** the statement transaction was opened.  */
2549   if( eOp==SAVEPOINT_ROLLBACK ){
2550     db->nDeferredCons = p->nStmtDefCons;
2551     db->nDeferredImmCons = p->nStmtDefImmCons;
2552   }
2553   return rc;
2554 }
2555 int sqlite3VdbeCloseStatement(Vdbe *p, int eOp){
2556   if( p->db->nStatement && p->iStatement ){
2557     return vdbeCloseStatement(p, eOp);
2558   }
2559   return SQLITE_OK;
2560 }
2561 
2562 
2563 /*
2564 ** This function is called when a transaction opened by the database
2565 ** handle associated with the VM passed as an argument is about to be
2566 ** committed. If there are outstanding deferred foreign key constraint
2567 ** violations, return SQLITE_ERROR. Otherwise, SQLITE_OK.
2568 **
2569 ** If there are outstanding FK violations and this function returns
2570 ** SQLITE_ERROR, set the result of the VM to SQLITE_CONSTRAINT_FOREIGNKEY
2571 ** and write an error message to it. Then return SQLITE_ERROR.
2572 */
2573 #ifndef SQLITE_OMIT_FOREIGN_KEY
2574 int sqlite3VdbeCheckFk(Vdbe *p, int deferred){
2575   sqlite3 *db = p->db;
2576   if( (deferred && (db->nDeferredCons+db->nDeferredImmCons)>0)
2577    || (!deferred && p->nFkConstraint>0)
2578   ){
2579     p->rc = SQLITE_CONSTRAINT_FOREIGNKEY;
2580     p->errorAction = OE_Abort;
2581     sqlite3VdbeError(p, "FOREIGN KEY constraint failed");
2582     return SQLITE_ERROR;
2583   }
2584   return SQLITE_OK;
2585 }
2586 #endif
2587 
2588 /*
2589 ** This routine is called the when a VDBE tries to halt.  If the VDBE
2590 ** has made changes and is in autocommit mode, then commit those
2591 ** changes.  If a rollback is needed, then do the rollback.
2592 **
2593 ** This routine is the only way to move the state of a VM from
2594 ** SQLITE_MAGIC_RUN to SQLITE_MAGIC_HALT.  It is harmless to
2595 ** call this on a VM that is in the SQLITE_MAGIC_HALT state.
2596 **
2597 ** Return an error code.  If the commit could not complete because of
2598 ** lock contention, return SQLITE_BUSY.  If SQLITE_BUSY is returned, it
2599 ** means the close did not happen and needs to be repeated.
2600 */
2601 int sqlite3VdbeHalt(Vdbe *p){
2602   int rc;                         /* Used to store transient return codes */
2603   sqlite3 *db = p->db;
2604 
2605   /* This function contains the logic that determines if a statement or
2606   ** transaction will be committed or rolled back as a result of the
2607   ** execution of this virtual machine.
2608   **
2609   ** If any of the following errors occur:
2610   **
2611   **     SQLITE_NOMEM
2612   **     SQLITE_IOERR
2613   **     SQLITE_FULL
2614   **     SQLITE_INTERRUPT
2615   **
2616   ** Then the internal cache might have been left in an inconsistent
2617   ** state.  We need to rollback the statement transaction, if there is
2618   ** one, or the complete transaction if there is no statement transaction.
2619   */
2620 
2621   if( p->magic!=VDBE_MAGIC_RUN ){
2622     return SQLITE_OK;
2623   }
2624   if( db->mallocFailed ){
2625     p->rc = SQLITE_NOMEM_BKPT;
2626   }
2627   closeAllCursors(p);
2628   checkActiveVdbeCnt(db);
2629 
2630   /* No commit or rollback needed if the program never started or if the
2631   ** SQL statement does not read or write a database file.  */
2632   if( p->pc>=0 && p->bIsReader ){
2633     int mrc;   /* Primary error code from p->rc */
2634     int eStatementOp = 0;
2635     int isSpecialError;            /* Set to true if a 'special' error */
2636 
2637     /* Lock all btrees used by the statement */
2638     sqlite3VdbeEnter(p);
2639 
2640     /* Check for one of the special errors */
2641     mrc = p->rc & 0xff;
2642     isSpecialError = mrc==SQLITE_NOMEM || mrc==SQLITE_IOERR
2643                      || mrc==SQLITE_INTERRUPT || mrc==SQLITE_FULL;
2644     if( isSpecialError ){
2645       /* If the query was read-only and the error code is SQLITE_INTERRUPT,
2646       ** no rollback is necessary. Otherwise, at least a savepoint
2647       ** transaction must be rolled back to restore the database to a
2648       ** consistent state.
2649       **
2650       ** Even if the statement is read-only, it is important to perform
2651       ** a statement or transaction rollback operation. If the error
2652       ** occurred while writing to the journal, sub-journal or database
2653       ** file as part of an effort to free up cache space (see function
2654       ** pagerStress() in pager.c), the rollback is required to restore
2655       ** the pager to a consistent state.
2656       */
2657       if( !p->readOnly || mrc!=SQLITE_INTERRUPT ){
2658         if( (mrc==SQLITE_NOMEM || mrc==SQLITE_FULL) && p->usesStmtJournal ){
2659           eStatementOp = SAVEPOINT_ROLLBACK;
2660         }else{
2661           /* We are forced to roll back the active transaction. Before doing
2662           ** so, abort any other statements this handle currently has active.
2663           */
2664           sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
2665           sqlite3CloseSavepoints(db);
2666           db->autoCommit = 1;
2667           p->nChange = 0;
2668         }
2669       }
2670     }
2671 
2672     /* Check for immediate foreign key violations. */
2673     if( p->rc==SQLITE_OK ){
2674       sqlite3VdbeCheckFk(p, 0);
2675     }
2676 
2677     /* If the auto-commit flag is set and this is the only active writer
2678     ** VM, then we do either a commit or rollback of the current transaction.
2679     **
2680     ** Note: This block also runs if one of the special errors handled
2681     ** above has occurred.
2682     */
2683     if( !sqlite3VtabInSync(db)
2684      && db->autoCommit
2685      && db->nVdbeWrite==(p->readOnly==0)
2686     ){
2687       if( p->rc==SQLITE_OK || (p->errorAction==OE_Fail && !isSpecialError) ){
2688         rc = sqlite3VdbeCheckFk(p, 1);
2689         if( rc!=SQLITE_OK ){
2690           if( NEVER(p->readOnly) ){
2691             sqlite3VdbeLeave(p);
2692             return SQLITE_ERROR;
2693           }
2694           rc = SQLITE_CONSTRAINT_FOREIGNKEY;
2695         }else{
2696           /* The auto-commit flag is true, the vdbe program was successful
2697           ** or hit an 'OR FAIL' constraint and there are no deferred foreign
2698           ** key constraints to hold up the transaction. This means a commit
2699           ** is required. */
2700           rc = vdbeCommit(db, p);
2701         }
2702         if( rc==SQLITE_BUSY && p->readOnly ){
2703           sqlite3VdbeLeave(p);
2704           return SQLITE_BUSY;
2705         }else if( rc!=SQLITE_OK ){
2706           p->rc = rc;
2707           sqlite3RollbackAll(db, SQLITE_OK);
2708           p->nChange = 0;
2709         }else{
2710           db->nDeferredCons = 0;
2711           db->nDeferredImmCons = 0;
2712           db->flags &= ~SQLITE_DeferFKs;
2713           sqlite3CommitInternalChanges(db);
2714         }
2715       }else{
2716         sqlite3RollbackAll(db, SQLITE_OK);
2717         p->nChange = 0;
2718       }
2719       db->nStatement = 0;
2720     }else if( eStatementOp==0 ){
2721       if( p->rc==SQLITE_OK || p->errorAction==OE_Fail ){
2722         eStatementOp = SAVEPOINT_RELEASE;
2723       }else if( p->errorAction==OE_Abort ){
2724         eStatementOp = SAVEPOINT_ROLLBACK;
2725       }else{
2726         sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
2727         sqlite3CloseSavepoints(db);
2728         db->autoCommit = 1;
2729         p->nChange = 0;
2730       }
2731     }
2732 
2733     /* If eStatementOp is non-zero, then a statement transaction needs to
2734     ** be committed or rolled back. Call sqlite3VdbeCloseStatement() to
2735     ** do so. If this operation returns an error, and the current statement
2736     ** error code is SQLITE_OK or SQLITE_CONSTRAINT, then promote the
2737     ** current statement error code.
2738     */
2739     if( eStatementOp ){
2740       rc = sqlite3VdbeCloseStatement(p, eStatementOp);
2741       if( rc ){
2742         if( p->rc==SQLITE_OK || (p->rc&0xff)==SQLITE_CONSTRAINT ){
2743           p->rc = rc;
2744           sqlite3DbFree(db, p->zErrMsg);
2745           p->zErrMsg = 0;
2746         }
2747         sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
2748         sqlite3CloseSavepoints(db);
2749         db->autoCommit = 1;
2750         p->nChange = 0;
2751       }
2752     }
2753 
2754     /* If this was an INSERT, UPDATE or DELETE and no statement transaction
2755     ** has been rolled back, update the database connection change-counter.
2756     */
2757     if( p->changeCntOn ){
2758       if( eStatementOp!=SAVEPOINT_ROLLBACK ){
2759         sqlite3VdbeSetChanges(db, p->nChange);
2760       }else{
2761         sqlite3VdbeSetChanges(db, 0);
2762       }
2763       p->nChange = 0;
2764     }
2765 
2766     /* Release the locks */
2767     sqlite3VdbeLeave(p);
2768   }
2769 
2770   /* We have successfully halted and closed the VM.  Record this fact. */
2771   if( p->pc>=0 ){
2772     db->nVdbeActive--;
2773     if( !p->readOnly ) db->nVdbeWrite--;
2774     if( p->bIsReader ) db->nVdbeRead--;
2775     assert( db->nVdbeActive>=db->nVdbeRead );
2776     assert( db->nVdbeRead>=db->nVdbeWrite );
2777     assert( db->nVdbeWrite>=0 );
2778   }
2779   p->magic = VDBE_MAGIC_HALT;
2780   checkActiveVdbeCnt(db);
2781   if( db->mallocFailed ){
2782     p->rc = SQLITE_NOMEM_BKPT;
2783   }
2784 
2785   /* If the auto-commit flag is set to true, then any locks that were held
2786   ** by connection db have now been released. Call sqlite3ConnectionUnlocked()
2787   ** to invoke any required unlock-notify callbacks.
2788   */
2789   if( db->autoCommit ){
2790     sqlite3ConnectionUnlocked(db);
2791   }
2792 
2793   assert( db->nVdbeActive>0 || db->autoCommit==0 || db->nStatement==0 );
2794   return (p->rc==SQLITE_BUSY ? SQLITE_BUSY : SQLITE_OK);
2795 }
2796 
2797 
2798 /*
2799 ** Each VDBE holds the result of the most recent sqlite3_step() call
2800 ** in p->rc.  This routine sets that result back to SQLITE_OK.
2801 */
2802 void sqlite3VdbeResetStepResult(Vdbe *p){
2803   p->rc = SQLITE_OK;
2804 }
2805 
2806 /*
2807 ** Copy the error code and error message belonging to the VDBE passed
2808 ** as the first argument to its database handle (so that they will be
2809 ** returned by calls to sqlite3_errcode() and sqlite3_errmsg()).
2810 **
2811 ** This function does not clear the VDBE error code or message, just
2812 ** copies them to the database handle.
2813 */
2814 int sqlite3VdbeTransferError(Vdbe *p){
2815   sqlite3 *db = p->db;
2816   int rc = p->rc;
2817   if( p->zErrMsg ){
2818     db->bBenignMalloc++;
2819     sqlite3BeginBenignMalloc();
2820     if( db->pErr==0 ) db->pErr = sqlite3ValueNew(db);
2821     sqlite3ValueSetStr(db->pErr, -1, p->zErrMsg, SQLITE_UTF8, SQLITE_TRANSIENT);
2822     sqlite3EndBenignMalloc();
2823     db->bBenignMalloc--;
2824   }else if( db->pErr ){
2825     sqlite3ValueSetNull(db->pErr);
2826   }
2827   db->errCode = rc;
2828   return rc;
2829 }
2830 
2831 #ifdef SQLITE_ENABLE_SQLLOG
2832 /*
2833 ** If an SQLITE_CONFIG_SQLLOG hook is registered and the VM has been run,
2834 ** invoke it.
2835 */
2836 static void vdbeInvokeSqllog(Vdbe *v){
2837   if( sqlite3GlobalConfig.xSqllog && v->rc==SQLITE_OK && v->zSql && v->pc>=0 ){
2838     char *zExpanded = sqlite3VdbeExpandSql(v, v->zSql);
2839     assert( v->db->init.busy==0 );
2840     if( zExpanded ){
2841       sqlite3GlobalConfig.xSqllog(
2842           sqlite3GlobalConfig.pSqllogArg, v->db, zExpanded, 1
2843       );
2844       sqlite3DbFree(v->db, zExpanded);
2845     }
2846   }
2847 }
2848 #else
2849 # define vdbeInvokeSqllog(x)
2850 #endif
2851 
2852 /*
2853 ** Clean up a VDBE after execution but do not delete the VDBE just yet.
2854 ** Write any error messages into *pzErrMsg.  Return the result code.
2855 **
2856 ** After this routine is run, the VDBE should be ready to be executed
2857 ** again.
2858 **
2859 ** To look at it another way, this routine resets the state of the
2860 ** virtual machine from VDBE_MAGIC_RUN or VDBE_MAGIC_HALT back to
2861 ** VDBE_MAGIC_INIT.
2862 */
2863 int sqlite3VdbeReset(Vdbe *p){
2864   sqlite3 *db;
2865   db = p->db;
2866 
2867   /* If the VM did not run to completion or if it encountered an
2868   ** error, then it might not have been halted properly.  So halt
2869   ** it now.
2870   */
2871   sqlite3VdbeHalt(p);
2872 
2873   /* If the VDBE has be run even partially, then transfer the error code
2874   ** and error message from the VDBE into the main database structure.  But
2875   ** if the VDBE has just been set to run but has not actually executed any
2876   ** instructions yet, leave the main database error information unchanged.
2877   */
2878   if( p->pc>=0 ){
2879     vdbeInvokeSqllog(p);
2880     sqlite3VdbeTransferError(p);
2881     sqlite3DbFree(db, p->zErrMsg);
2882     p->zErrMsg = 0;
2883     if( p->runOnlyOnce ) p->expired = 1;
2884   }else if( p->rc && p->expired ){
2885     /* The expired flag was set on the VDBE before the first call
2886     ** to sqlite3_step(). For consistency (since sqlite3_step() was
2887     ** called), set the database error in this case as well.
2888     */
2889     sqlite3ErrorWithMsg(db, p->rc, p->zErrMsg ? "%s" : 0, p->zErrMsg);
2890     sqlite3DbFree(db, p->zErrMsg);
2891     p->zErrMsg = 0;
2892   }
2893 
2894   /* Reclaim all memory used by the VDBE
2895   */
2896   Cleanup(p);
2897 
2898   /* Save profiling information from this VDBE run.
2899   */
2900 #ifdef VDBE_PROFILE
2901   {
2902     FILE *out = fopen("vdbe_profile.out", "a");
2903     if( out ){
2904       int i;
2905       fprintf(out, "---- ");
2906       for(i=0; i<p->nOp; i++){
2907         fprintf(out, "%02x", p->aOp[i].opcode);
2908       }
2909       fprintf(out, "\n");
2910       if( p->zSql ){
2911         char c, pc = 0;
2912         fprintf(out, "-- ");
2913         for(i=0; (c = p->zSql[i])!=0; i++){
2914           if( pc=='\n' ) fprintf(out, "-- ");
2915           putc(c, out);
2916           pc = c;
2917         }
2918         if( pc!='\n' ) fprintf(out, "\n");
2919       }
2920       for(i=0; i<p->nOp; i++){
2921         char zHdr[100];
2922         sqlite3_snprintf(sizeof(zHdr), zHdr, "%6u %12llu %8llu ",
2923            p->aOp[i].cnt,
2924            p->aOp[i].cycles,
2925            p->aOp[i].cnt>0 ? p->aOp[i].cycles/p->aOp[i].cnt : 0
2926         );
2927         fprintf(out, "%s", zHdr);
2928         sqlite3VdbePrintOp(out, i, &p->aOp[i]);
2929       }
2930       fclose(out);
2931     }
2932   }
2933 #endif
2934   p->magic = VDBE_MAGIC_RESET;
2935   return p->rc & db->errMask;
2936 }
2937 
2938 /*
2939 ** Clean up and delete a VDBE after execution.  Return an integer which is
2940 ** the result code.  Write any error message text into *pzErrMsg.
2941 */
2942 int sqlite3VdbeFinalize(Vdbe *p){
2943   int rc = SQLITE_OK;
2944   if( p->magic==VDBE_MAGIC_RUN || p->magic==VDBE_MAGIC_HALT ){
2945     rc = sqlite3VdbeReset(p);
2946     assert( (rc & p->db->errMask)==rc );
2947   }
2948   sqlite3VdbeDelete(p);
2949   return rc;
2950 }
2951 
2952 /*
2953 ** If parameter iOp is less than zero, then invoke the destructor for
2954 ** all auxiliary data pointers currently cached by the VM passed as
2955 ** the first argument.
2956 **
2957 ** Or, if iOp is greater than or equal to zero, then the destructor is
2958 ** only invoked for those auxiliary data pointers created by the user
2959 ** function invoked by the OP_Function opcode at instruction iOp of
2960 ** VM pVdbe, and only then if:
2961 **
2962 **    * the associated function parameter is the 32nd or later (counting
2963 **      from left to right), or
2964 **
2965 **    * the corresponding bit in argument mask is clear (where the first
2966 **      function parameter corresponds to bit 0 etc.).
2967 */
2968 void sqlite3VdbeDeleteAuxData(sqlite3 *db, AuxData **pp, int iOp, int mask){
2969   while( *pp ){
2970     AuxData *pAux = *pp;
2971     if( (iOp<0)
2972      || (pAux->iAuxOp==iOp
2973           && pAux->iAuxArg>=0
2974           && (pAux->iAuxArg>31 || !(mask & MASKBIT32(pAux->iAuxArg))))
2975     ){
2976       testcase( pAux->iAuxArg==31 );
2977       if( pAux->xDeleteAux ){
2978         pAux->xDeleteAux(pAux->pAux);
2979       }
2980       *pp = pAux->pNextAux;
2981       sqlite3DbFree(db, pAux);
2982     }else{
2983       pp= &pAux->pNextAux;
2984     }
2985   }
2986 }
2987 
2988 /*
2989 ** Free all memory associated with the Vdbe passed as the second argument,
2990 ** except for object itself, which is preserved.
2991 **
2992 ** The difference between this function and sqlite3VdbeDelete() is that
2993 ** VdbeDelete() also unlinks the Vdbe from the list of VMs associated with
2994 ** the database connection and frees the object itself.
2995 */
2996 void sqlite3VdbeClearObject(sqlite3 *db, Vdbe *p){
2997   SubProgram *pSub, *pNext;
2998   assert( p->db==0 || p->db==db );
2999   releaseMemArray(p->aColName, p->nResColumn*COLNAME_N);
3000   for(pSub=p->pProgram; pSub; pSub=pNext){
3001     pNext = pSub->pNext;
3002     vdbeFreeOpArray(db, pSub->aOp, pSub->nOp);
3003     sqlite3DbFree(db, pSub);
3004   }
3005   if( p->magic!=VDBE_MAGIC_INIT ){
3006     releaseMemArray(p->aVar, p->nVar);
3007     sqlite3DbFree(db, p->pVList);
3008     sqlite3DbFree(db, p->pFree);
3009   }
3010   vdbeFreeOpArray(db, p->aOp, p->nOp);
3011   sqlite3DbFree(db, p->aColName);
3012   sqlite3DbFree(db, p->zSql);
3013 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
3014   {
3015     int i;
3016     for(i=0; i<p->nScan; i++){
3017       sqlite3DbFree(db, p->aScan[i].zName);
3018     }
3019     sqlite3DbFree(db, p->aScan);
3020   }
3021 #endif
3022 }
3023 
3024 /*
3025 ** Delete an entire VDBE.
3026 */
3027 void sqlite3VdbeDelete(Vdbe *p){
3028   sqlite3 *db;
3029 
3030   if( NEVER(p==0) ) return;
3031   db = p->db;
3032   assert( sqlite3_mutex_held(db->mutex) );
3033   sqlite3VdbeClearObject(db, p);
3034   if( p->pPrev ){
3035     p->pPrev->pNext = p->pNext;
3036   }else{
3037     assert( db->pVdbe==p );
3038     db->pVdbe = p->pNext;
3039   }
3040   if( p->pNext ){
3041     p->pNext->pPrev = p->pPrev;
3042   }
3043   p->magic = VDBE_MAGIC_DEAD;
3044   p->db = 0;
3045   sqlite3DbFreeNN(db, p);
3046 }
3047 
3048 /*
3049 ** The cursor "p" has a pending seek operation that has not yet been
3050 ** carried out.  Seek the cursor now.  If an error occurs, return
3051 ** the appropriate error code.
3052 */
3053 static int SQLITE_NOINLINE handleDeferredMoveto(VdbeCursor *p){
3054   int res, rc;
3055 #ifdef SQLITE_TEST
3056   extern int sqlite3_search_count;
3057 #endif
3058   assert( p->deferredMoveto );
3059   assert( p->isTable );
3060   assert( p->eCurType==CURTYPE_BTREE );
3061   rc = sqlite3BtreeMovetoUnpacked(p->uc.pCursor, 0, p->movetoTarget, 0, &res);
3062   if( rc ) return rc;
3063   if( res!=0 ) return SQLITE_CORRUPT_BKPT;
3064 #ifdef SQLITE_TEST
3065   sqlite3_search_count++;
3066 #endif
3067   p->deferredMoveto = 0;
3068   p->cacheStatus = CACHE_STALE;
3069   return SQLITE_OK;
3070 }
3071 
3072 /*
3073 ** Something has moved cursor "p" out of place.  Maybe the row it was
3074 ** pointed to was deleted out from under it.  Or maybe the btree was
3075 ** rebalanced.  Whatever the cause, try to restore "p" to the place it
3076 ** is supposed to be pointing.  If the row was deleted out from under the
3077 ** cursor, set the cursor to point to a NULL row.
3078 */
3079 static int SQLITE_NOINLINE handleMovedCursor(VdbeCursor *p){
3080   int isDifferentRow, rc;
3081   assert( p->eCurType==CURTYPE_BTREE );
3082   assert( p->uc.pCursor!=0 );
3083   assert( sqlite3BtreeCursorHasMoved(p->uc.pCursor) );
3084   rc = sqlite3BtreeCursorRestore(p->uc.pCursor, &isDifferentRow);
3085   p->cacheStatus = CACHE_STALE;
3086   if( isDifferentRow ) p->nullRow = 1;
3087   return rc;
3088 }
3089 
3090 /*
3091 ** Check to ensure that the cursor is valid.  Restore the cursor
3092 ** if need be.  Return any I/O error from the restore operation.
3093 */
3094 int sqlite3VdbeCursorRestore(VdbeCursor *p){
3095   assert( p->eCurType==CURTYPE_BTREE );
3096   if( sqlite3BtreeCursorHasMoved(p->uc.pCursor) ){
3097     return handleMovedCursor(p);
3098   }
3099   return SQLITE_OK;
3100 }
3101 
3102 /*
3103 ** Make sure the cursor p is ready to read or write the row to which it
3104 ** was last positioned.  Return an error code if an OOM fault or I/O error
3105 ** prevents us from positioning the cursor to its correct position.
3106 **
3107 ** If a MoveTo operation is pending on the given cursor, then do that
3108 ** MoveTo now.  If no move is pending, check to see if the row has been
3109 ** deleted out from under the cursor and if it has, mark the row as
3110 ** a NULL row.
3111 **
3112 ** If the cursor is already pointing to the correct row and that row has
3113 ** not been deleted out from under the cursor, then this routine is a no-op.
3114 */
3115 int sqlite3VdbeCursorMoveto(VdbeCursor **pp, int *piCol){
3116   VdbeCursor *p = *pp;
3117   if( p->eCurType==CURTYPE_BTREE ){
3118     if( p->deferredMoveto ){
3119       int iMap;
3120       if( p->aAltMap && (iMap = p->aAltMap[1+*piCol])>0 ){
3121         *pp = p->pAltCursor;
3122         *piCol = iMap - 1;
3123         return SQLITE_OK;
3124       }
3125       return handleDeferredMoveto(p);
3126     }
3127     if( sqlite3BtreeCursorHasMoved(p->uc.pCursor) ){
3128       return handleMovedCursor(p);
3129     }
3130   }
3131   return SQLITE_OK;
3132 }
3133 
3134 /*
3135 ** The following functions:
3136 **
3137 ** sqlite3VdbeSerialType()
3138 ** sqlite3VdbeSerialTypeLen()
3139 ** sqlite3VdbeSerialLen()
3140 ** sqlite3VdbeSerialPut()
3141 ** sqlite3VdbeSerialGet()
3142 **
3143 ** encapsulate the code that serializes values for storage in SQLite
3144 ** data and index records. Each serialized value consists of a
3145 ** 'serial-type' and a blob of data. The serial type is an 8-byte unsigned
3146 ** integer, stored as a varint.
3147 **
3148 ** In an SQLite index record, the serial type is stored directly before
3149 ** the blob of data that it corresponds to. In a table record, all serial
3150 ** types are stored at the start of the record, and the blobs of data at
3151 ** the end. Hence these functions allow the caller to handle the
3152 ** serial-type and data blob separately.
3153 **
3154 ** The following table describes the various storage classes for data:
3155 **
3156 **   serial type        bytes of data      type
3157 **   --------------     ---------------    ---------------
3158 **      0                     0            NULL
3159 **      1                     1            signed integer
3160 **      2                     2            signed integer
3161 **      3                     3            signed integer
3162 **      4                     4            signed integer
3163 **      5                     6            signed integer
3164 **      6                     8            signed integer
3165 **      7                     8            IEEE float
3166 **      8                     0            Integer constant 0
3167 **      9                     0            Integer constant 1
3168 **     10,11                               reserved for expansion
3169 **    N>=12 and even       (N-12)/2        BLOB
3170 **    N>=13 and odd        (N-13)/2        text
3171 **
3172 ** The 8 and 9 types were added in 3.3.0, file format 4.  Prior versions
3173 ** of SQLite will not understand those serial types.
3174 */
3175 
3176 /*
3177 ** Return the serial-type for the value stored in pMem.
3178 */
3179 u32 sqlite3VdbeSerialType(Mem *pMem, int file_format, u32 *pLen){
3180   int flags = pMem->flags;
3181   u32 n;
3182 
3183   assert( pLen!=0 );
3184   if( flags&MEM_Null ){
3185     *pLen = 0;
3186     return 0;
3187   }
3188   if( flags&MEM_Int ){
3189     /* Figure out whether to use 1, 2, 4, 6 or 8 bytes. */
3190 #   define MAX_6BYTE ((((i64)0x00008000)<<32)-1)
3191     i64 i = pMem->u.i;
3192     u64 u;
3193     if( i<0 ){
3194       u = ~i;
3195     }else{
3196       u = i;
3197     }
3198     if( u<=127 ){
3199       if( (i&1)==i && file_format>=4 ){
3200         *pLen = 0;
3201         return 8+(u32)u;
3202       }else{
3203         *pLen = 1;
3204         return 1;
3205       }
3206     }
3207     if( u<=32767 ){ *pLen = 2; return 2; }
3208     if( u<=8388607 ){ *pLen = 3; return 3; }
3209     if( u<=2147483647 ){ *pLen = 4; return 4; }
3210     if( u<=MAX_6BYTE ){ *pLen = 6; return 5; }
3211     *pLen = 8;
3212     return 6;
3213   }
3214   if( flags&MEM_Real ){
3215     *pLen = 8;
3216     return 7;
3217   }
3218   assert( pMem->db->mallocFailed || flags&(MEM_Str|MEM_Blob) );
3219   assert( pMem->n>=0 );
3220   n = (u32)pMem->n;
3221   if( flags & MEM_Zero ){
3222     n += pMem->u.nZero;
3223   }
3224   *pLen = n;
3225   return ((n*2) + 12 + ((flags&MEM_Str)!=0));
3226 }
3227 
3228 /*
3229 ** The sizes for serial types less than 128
3230 */
3231 static const u8 sqlite3SmallTypeSizes[] = {
3232         /*  0   1   2   3   4   5   6   7   8   9 */
3233 /*   0 */   0,  1,  2,  3,  4,  6,  8,  8,  0,  0,
3234 /*  10 */   0,  0,  0,  0,  1,  1,  2,  2,  3,  3,
3235 /*  20 */   4,  4,  5,  5,  6,  6,  7,  7,  8,  8,
3236 /*  30 */   9,  9, 10, 10, 11, 11, 12, 12, 13, 13,
3237 /*  40 */  14, 14, 15, 15, 16, 16, 17, 17, 18, 18,
3238 /*  50 */  19, 19, 20, 20, 21, 21, 22, 22, 23, 23,
3239 /*  60 */  24, 24, 25, 25, 26, 26, 27, 27, 28, 28,
3240 /*  70 */  29, 29, 30, 30, 31, 31, 32, 32, 33, 33,
3241 /*  80 */  34, 34, 35, 35, 36, 36, 37, 37, 38, 38,
3242 /*  90 */  39, 39, 40, 40, 41, 41, 42, 42, 43, 43,
3243 /* 100 */  44, 44, 45, 45, 46, 46, 47, 47, 48, 48,
3244 /* 110 */  49, 49, 50, 50, 51, 51, 52, 52, 53, 53,
3245 /* 120 */  54, 54, 55, 55, 56, 56, 57, 57
3246 };
3247 
3248 /*
3249 ** Return the length of the data corresponding to the supplied serial-type.
3250 */
3251 u32 sqlite3VdbeSerialTypeLen(u32 serial_type){
3252   if( serial_type>=128 ){
3253     return (serial_type-12)/2;
3254   }else{
3255     assert( serial_type<12
3256             || sqlite3SmallTypeSizes[serial_type]==(serial_type - 12)/2 );
3257     return sqlite3SmallTypeSizes[serial_type];
3258   }
3259 }
3260 u8 sqlite3VdbeOneByteSerialTypeLen(u8 serial_type){
3261   assert( serial_type<128 );
3262   return sqlite3SmallTypeSizes[serial_type];
3263 }
3264 
3265 /*
3266 ** If we are on an architecture with mixed-endian floating
3267 ** points (ex: ARM7) then swap the lower 4 bytes with the
3268 ** upper 4 bytes.  Return the result.
3269 **
3270 ** For most architectures, this is a no-op.
3271 **
3272 ** (later):  It is reported to me that the mixed-endian problem
3273 ** on ARM7 is an issue with GCC, not with the ARM7 chip.  It seems
3274 ** that early versions of GCC stored the two words of a 64-bit
3275 ** float in the wrong order.  And that error has been propagated
3276 ** ever since.  The blame is not necessarily with GCC, though.
3277 ** GCC might have just copying the problem from a prior compiler.
3278 ** I am also told that newer versions of GCC that follow a different
3279 ** ABI get the byte order right.
3280 **
3281 ** Developers using SQLite on an ARM7 should compile and run their
3282 ** application using -DSQLITE_DEBUG=1 at least once.  With DEBUG
3283 ** enabled, some asserts below will ensure that the byte order of
3284 ** floating point values is correct.
3285 **
3286 ** (2007-08-30)  Frank van Vugt has studied this problem closely
3287 ** and has send his findings to the SQLite developers.  Frank
3288 ** writes that some Linux kernels offer floating point hardware
3289 ** emulation that uses only 32-bit mantissas instead of a full
3290 ** 48-bits as required by the IEEE standard.  (This is the
3291 ** CONFIG_FPE_FASTFPE option.)  On such systems, floating point
3292 ** byte swapping becomes very complicated.  To avoid problems,
3293 ** the necessary byte swapping is carried out using a 64-bit integer
3294 ** rather than a 64-bit float.  Frank assures us that the code here
3295 ** works for him.  We, the developers, have no way to independently
3296 ** verify this, but Frank seems to know what he is talking about
3297 ** so we trust him.
3298 */
3299 #ifdef SQLITE_MIXED_ENDIAN_64BIT_FLOAT
3300 static u64 floatSwap(u64 in){
3301   union {
3302     u64 r;
3303     u32 i[2];
3304   } u;
3305   u32 t;
3306 
3307   u.r = in;
3308   t = u.i[0];
3309   u.i[0] = u.i[1];
3310   u.i[1] = t;
3311   return u.r;
3312 }
3313 # define swapMixedEndianFloat(X)  X = floatSwap(X)
3314 #else
3315 # define swapMixedEndianFloat(X)
3316 #endif
3317 
3318 /*
3319 ** Write the serialized data blob for the value stored in pMem into
3320 ** buf. It is assumed that the caller has allocated sufficient space.
3321 ** Return the number of bytes written.
3322 **
3323 ** nBuf is the amount of space left in buf[].  The caller is responsible
3324 ** for allocating enough space to buf[] to hold the entire field, exclusive
3325 ** of the pMem->u.nZero bytes for a MEM_Zero value.
3326 **
3327 ** Return the number of bytes actually written into buf[].  The number
3328 ** of bytes in the zero-filled tail is included in the return value only
3329 ** if those bytes were zeroed in buf[].
3330 */
3331 u32 sqlite3VdbeSerialPut(u8 *buf, Mem *pMem, u32 serial_type){
3332   u32 len;
3333 
3334   /* Integer and Real */
3335   if( serial_type<=7 && serial_type>0 ){
3336     u64 v;
3337     u32 i;
3338     if( serial_type==7 ){
3339       assert( sizeof(v)==sizeof(pMem->u.r) );
3340       memcpy(&v, &pMem->u.r, sizeof(v));
3341       swapMixedEndianFloat(v);
3342     }else{
3343       v = pMem->u.i;
3344     }
3345     len = i = sqlite3SmallTypeSizes[serial_type];
3346     assert( i>0 );
3347     do{
3348       buf[--i] = (u8)(v&0xFF);
3349       v >>= 8;
3350     }while( i );
3351     return len;
3352   }
3353 
3354   /* String or blob */
3355   if( serial_type>=12 ){
3356     assert( pMem->n + ((pMem->flags & MEM_Zero)?pMem->u.nZero:0)
3357              == (int)sqlite3VdbeSerialTypeLen(serial_type) );
3358     len = pMem->n;
3359     if( len>0 ) memcpy(buf, pMem->z, len);
3360     return len;
3361   }
3362 
3363   /* NULL or constants 0 or 1 */
3364   return 0;
3365 }
3366 
3367 /* Input "x" is a sequence of unsigned characters that represent a
3368 ** big-endian integer.  Return the equivalent native integer
3369 */
3370 #define ONE_BYTE_INT(x)    ((i8)(x)[0])
3371 #define TWO_BYTE_INT(x)    (256*(i8)((x)[0])|(x)[1])
3372 #define THREE_BYTE_INT(x)  (65536*(i8)((x)[0])|((x)[1]<<8)|(x)[2])
3373 #define FOUR_BYTE_UINT(x)  (((u32)(x)[0]<<24)|((x)[1]<<16)|((x)[2]<<8)|(x)[3])
3374 #define FOUR_BYTE_INT(x) (16777216*(i8)((x)[0])|((x)[1]<<16)|((x)[2]<<8)|(x)[3])
3375 
3376 /*
3377 ** Deserialize the data blob pointed to by buf as serial type serial_type
3378 ** and store the result in pMem.  Return the number of bytes read.
3379 **
3380 ** This function is implemented as two separate routines for performance.
3381 ** The few cases that require local variables are broken out into a separate
3382 ** routine so that in most cases the overhead of moving the stack pointer
3383 ** is avoided.
3384 */
3385 static u32 SQLITE_NOINLINE serialGet(
3386   const unsigned char *buf,     /* Buffer to deserialize from */
3387   u32 serial_type,              /* Serial type to deserialize */
3388   Mem *pMem                     /* Memory cell to write value into */
3389 ){
3390   u64 x = FOUR_BYTE_UINT(buf);
3391   u32 y = FOUR_BYTE_UINT(buf+4);
3392   x = (x<<32) + y;
3393   if( serial_type==6 ){
3394     /* EVIDENCE-OF: R-29851-52272 Value is a big-endian 64-bit
3395     ** twos-complement integer. */
3396     pMem->u.i = *(i64*)&x;
3397     pMem->flags = MEM_Int;
3398     testcase( pMem->u.i<0 );
3399   }else{
3400     /* EVIDENCE-OF: R-57343-49114 Value is a big-endian IEEE 754-2008 64-bit
3401     ** floating point number. */
3402 #if !defined(NDEBUG) && !defined(SQLITE_OMIT_FLOATING_POINT)
3403     /* Verify that integers and floating point values use the same
3404     ** byte order.  Or, that if SQLITE_MIXED_ENDIAN_64BIT_FLOAT is
3405     ** defined that 64-bit floating point values really are mixed
3406     ** endian.
3407     */
3408     static const u64 t1 = ((u64)0x3ff00000)<<32;
3409     static const double r1 = 1.0;
3410     u64 t2 = t1;
3411     swapMixedEndianFloat(t2);
3412     assert( sizeof(r1)==sizeof(t2) && memcmp(&r1, &t2, sizeof(r1))==0 );
3413 #endif
3414     assert( sizeof(x)==8 && sizeof(pMem->u.r)==8 );
3415     swapMixedEndianFloat(x);
3416     memcpy(&pMem->u.r, &x, sizeof(x));
3417     pMem->flags = sqlite3IsNaN(pMem->u.r) ? MEM_Null : MEM_Real;
3418   }
3419   return 8;
3420 }
3421 u32 sqlite3VdbeSerialGet(
3422   const unsigned char *buf,     /* Buffer to deserialize from */
3423   u32 serial_type,              /* Serial type to deserialize */
3424   Mem *pMem                     /* Memory cell to write value into */
3425 ){
3426   switch( serial_type ){
3427     case 10:   /* Reserved for future use */
3428     case 11:   /* Reserved for future use */
3429     case 0: {  /* Null */
3430       /* EVIDENCE-OF: R-24078-09375 Value is a NULL. */
3431       pMem->flags = MEM_Null;
3432       break;
3433     }
3434     case 1: {
3435       /* EVIDENCE-OF: R-44885-25196 Value is an 8-bit twos-complement
3436       ** integer. */
3437       pMem->u.i = ONE_BYTE_INT(buf);
3438       pMem->flags = MEM_Int;
3439       testcase( pMem->u.i<0 );
3440       return 1;
3441     }
3442     case 2: { /* 2-byte signed integer */
3443       /* EVIDENCE-OF: R-49794-35026 Value is a big-endian 16-bit
3444       ** twos-complement integer. */
3445       pMem->u.i = TWO_BYTE_INT(buf);
3446       pMem->flags = MEM_Int;
3447       testcase( pMem->u.i<0 );
3448       return 2;
3449     }
3450     case 3: { /* 3-byte signed integer */
3451       /* EVIDENCE-OF: R-37839-54301 Value is a big-endian 24-bit
3452       ** twos-complement integer. */
3453       pMem->u.i = THREE_BYTE_INT(buf);
3454       pMem->flags = MEM_Int;
3455       testcase( pMem->u.i<0 );
3456       return 3;
3457     }
3458     case 4: { /* 4-byte signed integer */
3459       /* EVIDENCE-OF: R-01849-26079 Value is a big-endian 32-bit
3460       ** twos-complement integer. */
3461       pMem->u.i = FOUR_BYTE_INT(buf);
3462 #ifdef __HP_cc
3463       /* Work around a sign-extension bug in the HP compiler for HP/UX */
3464       if( buf[0]&0x80 ) pMem->u.i |= 0xffffffff80000000LL;
3465 #endif
3466       pMem->flags = MEM_Int;
3467       testcase( pMem->u.i<0 );
3468       return 4;
3469     }
3470     case 5: { /* 6-byte signed integer */
3471       /* EVIDENCE-OF: R-50385-09674 Value is a big-endian 48-bit
3472       ** twos-complement integer. */
3473       pMem->u.i = FOUR_BYTE_UINT(buf+2) + (((i64)1)<<32)*TWO_BYTE_INT(buf);
3474       pMem->flags = MEM_Int;
3475       testcase( pMem->u.i<0 );
3476       return 6;
3477     }
3478     case 6:   /* 8-byte signed integer */
3479     case 7: { /* IEEE floating point */
3480       /* These use local variables, so do them in a separate routine
3481       ** to avoid having to move the frame pointer in the common case */
3482       return serialGet(buf,serial_type,pMem);
3483     }
3484     case 8:    /* Integer 0 */
3485     case 9: {  /* Integer 1 */
3486       /* EVIDENCE-OF: R-12976-22893 Value is the integer 0. */
3487       /* EVIDENCE-OF: R-18143-12121 Value is the integer 1. */
3488       pMem->u.i = serial_type-8;
3489       pMem->flags = MEM_Int;
3490       return 0;
3491     }
3492     default: {
3493       /* EVIDENCE-OF: R-14606-31564 Value is a BLOB that is (N-12)/2 bytes in
3494       ** length.
3495       ** EVIDENCE-OF: R-28401-00140 Value is a string in the text encoding and
3496       ** (N-13)/2 bytes in length. */
3497       static const u16 aFlag[] = { MEM_Blob|MEM_Ephem, MEM_Str|MEM_Ephem };
3498       pMem->z = (char *)buf;
3499       pMem->n = (serial_type-12)/2;
3500       pMem->flags = aFlag[serial_type&1];
3501       return pMem->n;
3502     }
3503   }
3504   return 0;
3505 }
3506 /*
3507 ** This routine is used to allocate sufficient space for an UnpackedRecord
3508 ** structure large enough to be used with sqlite3VdbeRecordUnpack() if
3509 ** the first argument is a pointer to KeyInfo structure pKeyInfo.
3510 **
3511 ** The space is either allocated using sqlite3DbMallocRaw() or from within
3512 ** the unaligned buffer passed via the second and third arguments (presumably
3513 ** stack space). If the former, then *ppFree is set to a pointer that should
3514 ** be eventually freed by the caller using sqlite3DbFree(). Or, if the
3515 ** allocation comes from the pSpace/szSpace buffer, *ppFree is set to NULL
3516 ** before returning.
3517 **
3518 ** If an OOM error occurs, NULL is returned.
3519 */
3520 UnpackedRecord *sqlite3VdbeAllocUnpackedRecord(
3521   KeyInfo *pKeyInfo               /* Description of the record */
3522 ){
3523   UnpackedRecord *p;              /* Unpacked record to return */
3524   int nByte;                      /* Number of bytes required for *p */
3525   nByte = ROUND8(sizeof(UnpackedRecord)) + sizeof(Mem)*(pKeyInfo->nField+1);
3526   p = (UnpackedRecord *)sqlite3DbMallocRaw(pKeyInfo->db, nByte);
3527   if( !p ) return 0;
3528   p->aMem = (Mem*)&((char*)p)[ROUND8(sizeof(UnpackedRecord))];
3529   assert( pKeyInfo->aSortOrder!=0 );
3530   p->pKeyInfo = pKeyInfo;
3531   p->nField = pKeyInfo->nField + 1;
3532   return p;
3533 }
3534 
3535 /*
3536 ** Given the nKey-byte encoding of a record in pKey[], populate the
3537 ** UnpackedRecord structure indicated by the fourth argument with the
3538 ** contents of the decoded record.
3539 */
3540 void sqlite3VdbeRecordUnpack(
3541   KeyInfo *pKeyInfo,     /* Information about the record format */
3542   int nKey,              /* Size of the binary record */
3543   const void *pKey,      /* The binary record */
3544   UnpackedRecord *p      /* Populate this structure before returning. */
3545 ){
3546   const unsigned char *aKey = (const unsigned char *)pKey;
3547   int d;
3548   u32 idx;                        /* Offset in aKey[] to read from */
3549   u16 u;                          /* Unsigned loop counter */
3550   u32 szHdr;
3551   Mem *pMem = p->aMem;
3552 
3553   p->default_rc = 0;
3554   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
3555   idx = getVarint32(aKey, szHdr);
3556   d = szHdr;
3557   u = 0;
3558   while( idx<szHdr && d<=nKey ){
3559     u32 serial_type;
3560 
3561     idx += getVarint32(&aKey[idx], serial_type);
3562     pMem->enc = pKeyInfo->enc;
3563     pMem->db = pKeyInfo->db;
3564     /* pMem->flags = 0; // sqlite3VdbeSerialGet() will set this for us */
3565     pMem->szMalloc = 0;
3566     pMem->z = 0;
3567     d += sqlite3VdbeSerialGet(&aKey[d], serial_type, pMem);
3568     pMem++;
3569     if( (++u)>=p->nField ) break;
3570   }
3571   assert( u<=pKeyInfo->nField + 1 );
3572   p->nField = u;
3573 }
3574 
3575 #ifdef SQLITE_DEBUG
3576 /*
3577 ** This function compares two index or table record keys in the same way
3578 ** as the sqlite3VdbeRecordCompare() routine. Unlike VdbeRecordCompare(),
3579 ** this function deserializes and compares values using the
3580 ** sqlite3VdbeSerialGet() and sqlite3MemCompare() functions. It is used
3581 ** in assert() statements to ensure that the optimized code in
3582 ** sqlite3VdbeRecordCompare() returns results with these two primitives.
3583 **
3584 ** Return true if the result of comparison is equivalent to desiredResult.
3585 ** Return false if there is a disagreement.
3586 */
3587 static int vdbeRecordCompareDebug(
3588   int nKey1, const void *pKey1, /* Left key */
3589   const UnpackedRecord *pPKey2, /* Right key */
3590   int desiredResult             /* Correct answer */
3591 ){
3592   u32 d1;            /* Offset into aKey[] of next data element */
3593   u32 idx1;          /* Offset into aKey[] of next header element */
3594   u32 szHdr1;        /* Number of bytes in header */
3595   int i = 0;
3596   int rc = 0;
3597   const unsigned char *aKey1 = (const unsigned char *)pKey1;
3598   KeyInfo *pKeyInfo;
3599   Mem mem1;
3600 
3601   pKeyInfo = pPKey2->pKeyInfo;
3602   if( pKeyInfo->db==0 ) return 1;
3603   mem1.enc = pKeyInfo->enc;
3604   mem1.db = pKeyInfo->db;
3605   /* mem1.flags = 0;  // Will be initialized by sqlite3VdbeSerialGet() */
3606   VVA_ONLY( mem1.szMalloc = 0; ) /* Only needed by assert() statements */
3607 
3608   /* Compilers may complain that mem1.u.i is potentially uninitialized.
3609   ** We could initialize it, as shown here, to silence those complaints.
3610   ** But in fact, mem1.u.i will never actually be used uninitialized, and doing
3611   ** the unnecessary initialization has a measurable negative performance
3612   ** impact, since this routine is a very high runner.  And so, we choose
3613   ** to ignore the compiler warnings and leave this variable uninitialized.
3614   */
3615   /*  mem1.u.i = 0;  // not needed, here to silence compiler warning */
3616 
3617   idx1 = getVarint32(aKey1, szHdr1);
3618   if( szHdr1>98307 ) return SQLITE_CORRUPT;
3619   d1 = szHdr1;
3620   assert( pKeyInfo->nField+pKeyInfo->nXField>=pPKey2->nField || CORRUPT_DB );
3621   assert( pKeyInfo->aSortOrder!=0 );
3622   assert( pKeyInfo->nField>0 );
3623   assert( idx1<=szHdr1 || CORRUPT_DB );
3624   do{
3625     u32 serial_type1;
3626 
3627     /* Read the serial types for the next element in each key. */
3628     idx1 += getVarint32( aKey1+idx1, serial_type1 );
3629 
3630     /* Verify that there is enough key space remaining to avoid
3631     ** a buffer overread.  The "d1+serial_type1+2" subexpression will
3632     ** always be greater than or equal to the amount of required key space.
3633     ** Use that approximation to avoid the more expensive call to
3634     ** sqlite3VdbeSerialTypeLen() in the common case.
3635     */
3636     if( d1+serial_type1+2>(u32)nKey1
3637      && d1+sqlite3VdbeSerialTypeLen(serial_type1)>(u32)nKey1
3638     ){
3639       break;
3640     }
3641 
3642     /* Extract the values to be compared.
3643     */
3644     d1 += sqlite3VdbeSerialGet(&aKey1[d1], serial_type1, &mem1);
3645 
3646     /* Do the comparison
3647     */
3648     rc = sqlite3MemCompare(&mem1, &pPKey2->aMem[i], pKeyInfo->aColl[i]);
3649     if( rc!=0 ){
3650       assert( mem1.szMalloc==0 );  /* See comment below */
3651       if( pKeyInfo->aSortOrder[i] ){
3652         rc = -rc;  /* Invert the result for DESC sort order. */
3653       }
3654       goto debugCompareEnd;
3655     }
3656     i++;
3657   }while( idx1<szHdr1 && i<pPKey2->nField );
3658 
3659   /* No memory allocation is ever used on mem1.  Prove this using
3660   ** the following assert().  If the assert() fails, it indicates a
3661   ** memory leak and a need to call sqlite3VdbeMemRelease(&mem1).
3662   */
3663   assert( mem1.szMalloc==0 );
3664 
3665   /* rc==0 here means that one of the keys ran out of fields and
3666   ** all the fields up to that point were equal. Return the default_rc
3667   ** value.  */
3668   rc = pPKey2->default_rc;
3669 
3670 debugCompareEnd:
3671   if( desiredResult==0 && rc==0 ) return 1;
3672   if( desiredResult<0 && rc<0 ) return 1;
3673   if( desiredResult>0 && rc>0 ) return 1;
3674   if( CORRUPT_DB ) return 1;
3675   if( pKeyInfo->db->mallocFailed ) return 1;
3676   return 0;
3677 }
3678 #endif
3679 
3680 #ifdef SQLITE_DEBUG
3681 /*
3682 ** Count the number of fields (a.k.a. columns) in the record given by
3683 ** pKey,nKey.  The verify that this count is less than or equal to the
3684 ** limit given by pKeyInfo->nField + pKeyInfo->nXField.
3685 **
3686 ** If this constraint is not satisfied, it means that the high-speed
3687 ** vdbeRecordCompareInt() and vdbeRecordCompareString() routines will
3688 ** not work correctly.  If this assert() ever fires, it probably means
3689 ** that the KeyInfo.nField or KeyInfo.nXField values were computed
3690 ** incorrectly.
3691 */
3692 static void vdbeAssertFieldCountWithinLimits(
3693   int nKey, const void *pKey,   /* The record to verify */
3694   const KeyInfo *pKeyInfo       /* Compare size with this KeyInfo */
3695 ){
3696   int nField = 0;
3697   u32 szHdr;
3698   u32 idx;
3699   u32 notUsed;
3700   const unsigned char *aKey = (const unsigned char*)pKey;
3701 
3702   if( CORRUPT_DB ) return;
3703   idx = getVarint32(aKey, szHdr);
3704   assert( nKey>=0 );
3705   assert( szHdr<=(u32)nKey );
3706   while( idx<szHdr ){
3707     idx += getVarint32(aKey+idx, notUsed);
3708     nField++;
3709   }
3710   assert( nField <= pKeyInfo->nField+pKeyInfo->nXField );
3711 }
3712 #else
3713 # define vdbeAssertFieldCountWithinLimits(A,B,C)
3714 #endif
3715 
3716 /*
3717 ** Both *pMem1 and *pMem2 contain string values. Compare the two values
3718 ** using the collation sequence pColl. As usual, return a negative , zero
3719 ** or positive value if *pMem1 is less than, equal to or greater than
3720 ** *pMem2, respectively. Similar in spirit to "rc = (*pMem1) - (*pMem2);".
3721 */
3722 static int vdbeCompareMemString(
3723   const Mem *pMem1,
3724   const Mem *pMem2,
3725   const CollSeq *pColl,
3726   u8 *prcErr                      /* If an OOM occurs, set to SQLITE_NOMEM */
3727 ){
3728   if( pMem1->enc==pColl->enc ){
3729     /* The strings are already in the correct encoding.  Call the
3730      ** comparison function directly */
3731     return pColl->xCmp(pColl->pUser,pMem1->n,pMem1->z,pMem2->n,pMem2->z);
3732   }else{
3733     int rc;
3734     const void *v1, *v2;
3735     Mem c1;
3736     Mem c2;
3737     sqlite3VdbeMemInit(&c1, pMem1->db, MEM_Null);
3738     sqlite3VdbeMemInit(&c2, pMem1->db, MEM_Null);
3739     sqlite3VdbeMemShallowCopy(&c1, pMem1, MEM_Ephem);
3740     sqlite3VdbeMemShallowCopy(&c2, pMem2, MEM_Ephem);
3741     v1 = sqlite3ValueText((sqlite3_value*)&c1, pColl->enc);
3742     v2 = sqlite3ValueText((sqlite3_value*)&c2, pColl->enc);
3743     if( (v1==0 || v2==0) ){
3744       if( prcErr ) *prcErr = SQLITE_NOMEM_BKPT;
3745       rc = 0;
3746     }else{
3747       rc = pColl->xCmp(pColl->pUser, c1.n, v1, c2.n, v2);
3748     }
3749     sqlite3VdbeMemRelease(&c1);
3750     sqlite3VdbeMemRelease(&c2);
3751     return rc;
3752   }
3753 }
3754 
3755 /*
3756 ** The input pBlob is guaranteed to be a Blob that is not marked
3757 ** with MEM_Zero.  Return true if it could be a zero-blob.
3758 */
3759 static int isAllZero(const char *z, int n){
3760   int i;
3761   for(i=0; i<n; i++){
3762     if( z[i] ) return 0;
3763   }
3764   return 1;
3765 }
3766 
3767 /*
3768 ** Compare two blobs.  Return negative, zero, or positive if the first
3769 ** is less than, equal to, or greater than the second, respectively.
3770 ** If one blob is a prefix of the other, then the shorter is the lessor.
3771 */
3772 static SQLITE_NOINLINE int sqlite3BlobCompare(const Mem *pB1, const Mem *pB2){
3773   int c;
3774   int n1 = pB1->n;
3775   int n2 = pB2->n;
3776 
3777   /* It is possible to have a Blob value that has some non-zero content
3778   ** followed by zero content.  But that only comes up for Blobs formed
3779   ** by the OP_MakeRecord opcode, and such Blobs never get passed into
3780   ** sqlite3MemCompare(). */
3781   assert( (pB1->flags & MEM_Zero)==0 || n1==0 );
3782   assert( (pB2->flags & MEM_Zero)==0 || n2==0 );
3783 
3784   if( (pB1->flags|pB2->flags) & MEM_Zero ){
3785     if( pB1->flags & pB2->flags & MEM_Zero ){
3786       return pB1->u.nZero - pB2->u.nZero;
3787     }else if( pB1->flags & MEM_Zero ){
3788       if( !isAllZero(pB2->z, pB2->n) ) return -1;
3789       return pB1->u.nZero - n2;
3790     }else{
3791       if( !isAllZero(pB1->z, pB1->n) ) return +1;
3792       return n1 - pB2->u.nZero;
3793     }
3794   }
3795   c = memcmp(pB1->z, pB2->z, n1>n2 ? n2 : n1);
3796   if( c ) return c;
3797   return n1 - n2;
3798 }
3799 
3800 /*
3801 ** Do a comparison between a 64-bit signed integer and a 64-bit floating-point
3802 ** number.  Return negative, zero, or positive if the first (i64) is less than,
3803 ** equal to, or greater than the second (double).
3804 */
3805 static int sqlite3IntFloatCompare(i64 i, double r){
3806   if( sizeof(LONGDOUBLE_TYPE)>8 ){
3807     LONGDOUBLE_TYPE x = (LONGDOUBLE_TYPE)i;
3808     if( x<r ) return -1;
3809     if( x>r ) return +1;
3810     return 0;
3811   }else{
3812     i64 y;
3813     double s;
3814     if( r<-9223372036854775808.0 ) return +1;
3815     if( r>9223372036854775807.0 ) return -1;
3816     y = (i64)r;
3817     if( i<y ) return -1;
3818     if( i>y ){
3819       if( y==SMALLEST_INT64 && r>0.0 ) return -1;
3820       return +1;
3821     }
3822     s = (double)i;
3823     if( s<r ) return -1;
3824     if( s>r ) return +1;
3825     return 0;
3826   }
3827 }
3828 
3829 /*
3830 ** Compare the values contained by the two memory cells, returning
3831 ** negative, zero or positive if pMem1 is less than, equal to, or greater
3832 ** than pMem2. Sorting order is NULL's first, followed by numbers (integers
3833 ** and reals) sorted numerically, followed by text ordered by the collating
3834 ** sequence pColl and finally blob's ordered by memcmp().
3835 **
3836 ** Two NULL values are considered equal by this function.
3837 */
3838 int sqlite3MemCompare(const Mem *pMem1, const Mem *pMem2, const CollSeq *pColl){
3839   int f1, f2;
3840   int combined_flags;
3841 
3842   f1 = pMem1->flags;
3843   f2 = pMem2->flags;
3844   combined_flags = f1|f2;
3845   assert( (combined_flags & MEM_RowSet)==0 );
3846 
3847   /* If one value is NULL, it is less than the other. If both values
3848   ** are NULL, return 0.
3849   */
3850   if( combined_flags&MEM_Null ){
3851     return (f2&MEM_Null) - (f1&MEM_Null);
3852   }
3853 
3854   /* At least one of the two values is a number
3855   */
3856   if( combined_flags&(MEM_Int|MEM_Real) ){
3857     if( (f1 & f2 & MEM_Int)!=0 ){
3858       if( pMem1->u.i < pMem2->u.i ) return -1;
3859       if( pMem1->u.i > pMem2->u.i ) return +1;
3860       return 0;
3861     }
3862     if( (f1 & f2 & MEM_Real)!=0 ){
3863       if( pMem1->u.r < pMem2->u.r ) return -1;
3864       if( pMem1->u.r > pMem2->u.r ) return +1;
3865       return 0;
3866     }
3867     if( (f1&MEM_Int)!=0 ){
3868       if( (f2&MEM_Real)!=0 ){
3869         return sqlite3IntFloatCompare(pMem1->u.i, pMem2->u.r);
3870       }else{
3871         return -1;
3872       }
3873     }
3874     if( (f1&MEM_Real)!=0 ){
3875       if( (f2&MEM_Int)!=0 ){
3876         return -sqlite3IntFloatCompare(pMem2->u.i, pMem1->u.r);
3877       }else{
3878         return -1;
3879       }
3880     }
3881     return +1;
3882   }
3883 
3884   /* If one value is a string and the other is a blob, the string is less.
3885   ** If both are strings, compare using the collating functions.
3886   */
3887   if( combined_flags&MEM_Str ){
3888     if( (f1 & MEM_Str)==0 ){
3889       return 1;
3890     }
3891     if( (f2 & MEM_Str)==0 ){
3892       return -1;
3893     }
3894 
3895     assert( pMem1->enc==pMem2->enc || pMem1->db->mallocFailed );
3896     assert( pMem1->enc==SQLITE_UTF8 ||
3897             pMem1->enc==SQLITE_UTF16LE || pMem1->enc==SQLITE_UTF16BE );
3898 
3899     /* The collation sequence must be defined at this point, even if
3900     ** the user deletes the collation sequence after the vdbe program is
3901     ** compiled (this was not always the case).
3902     */
3903     assert( !pColl || pColl->xCmp );
3904 
3905     if( pColl ){
3906       return vdbeCompareMemString(pMem1, pMem2, pColl, 0);
3907     }
3908     /* If a NULL pointer was passed as the collate function, fall through
3909     ** to the blob case and use memcmp().  */
3910   }
3911 
3912   /* Both values must be blobs.  Compare using memcmp().  */
3913   return sqlite3BlobCompare(pMem1, pMem2);
3914 }
3915 
3916 
3917 /*
3918 ** The first argument passed to this function is a serial-type that
3919 ** corresponds to an integer - all values between 1 and 9 inclusive
3920 ** except 7. The second points to a buffer containing an integer value
3921 ** serialized according to serial_type. This function deserializes
3922 ** and returns the value.
3923 */
3924 static i64 vdbeRecordDecodeInt(u32 serial_type, const u8 *aKey){
3925   u32 y;
3926   assert( CORRUPT_DB || (serial_type>=1 && serial_type<=9 && serial_type!=7) );
3927   switch( serial_type ){
3928     case 0:
3929     case 1:
3930       testcase( aKey[0]&0x80 );
3931       return ONE_BYTE_INT(aKey);
3932     case 2:
3933       testcase( aKey[0]&0x80 );
3934       return TWO_BYTE_INT(aKey);
3935     case 3:
3936       testcase( aKey[0]&0x80 );
3937       return THREE_BYTE_INT(aKey);
3938     case 4: {
3939       testcase( aKey[0]&0x80 );
3940       y = FOUR_BYTE_UINT(aKey);
3941       return (i64)*(int*)&y;
3942     }
3943     case 5: {
3944       testcase( aKey[0]&0x80 );
3945       return FOUR_BYTE_UINT(aKey+2) + (((i64)1)<<32)*TWO_BYTE_INT(aKey);
3946     }
3947     case 6: {
3948       u64 x = FOUR_BYTE_UINT(aKey);
3949       testcase( aKey[0]&0x80 );
3950       x = (x<<32) | FOUR_BYTE_UINT(aKey+4);
3951       return (i64)*(i64*)&x;
3952     }
3953   }
3954 
3955   return (serial_type - 8);
3956 }
3957 
3958 /*
3959 ** This function compares the two table rows or index records
3960 ** specified by {nKey1, pKey1} and pPKey2.  It returns a negative, zero
3961 ** or positive integer if key1 is less than, equal to or
3962 ** greater than key2.  The {nKey1, pKey1} key must be a blob
3963 ** created by the OP_MakeRecord opcode of the VDBE.  The pPKey2
3964 ** key must be a parsed key such as obtained from
3965 ** sqlite3VdbeParseRecord.
3966 **
3967 ** If argument bSkip is non-zero, it is assumed that the caller has already
3968 ** determined that the first fields of the keys are equal.
3969 **
3970 ** Key1 and Key2 do not have to contain the same number of fields. If all
3971 ** fields that appear in both keys are equal, then pPKey2->default_rc is
3972 ** returned.
3973 **
3974 ** If database corruption is discovered, set pPKey2->errCode to
3975 ** SQLITE_CORRUPT and return 0. If an OOM error is encountered,
3976 ** pPKey2->errCode is set to SQLITE_NOMEM and, if it is not NULL, the
3977 ** malloc-failed flag set on database handle (pPKey2->pKeyInfo->db).
3978 */
3979 int sqlite3VdbeRecordCompareWithSkip(
3980   int nKey1, const void *pKey1,   /* Left key */
3981   UnpackedRecord *pPKey2,         /* Right key */
3982   int bSkip                       /* If true, skip the first field */
3983 ){
3984   u32 d1;                         /* Offset into aKey[] of next data element */
3985   int i;                          /* Index of next field to compare */
3986   u32 szHdr1;                     /* Size of record header in bytes */
3987   u32 idx1;                       /* Offset of first type in header */
3988   int rc = 0;                     /* Return value */
3989   Mem *pRhs = pPKey2->aMem;       /* Next field of pPKey2 to compare */
3990   KeyInfo *pKeyInfo = pPKey2->pKeyInfo;
3991   const unsigned char *aKey1 = (const unsigned char *)pKey1;
3992   Mem mem1;
3993 
3994   /* If bSkip is true, then the caller has already determined that the first
3995   ** two elements in the keys are equal. Fix the various stack variables so
3996   ** that this routine begins comparing at the second field. */
3997   if( bSkip ){
3998     u32 s1;
3999     idx1 = 1 + getVarint32(&aKey1[1], s1);
4000     szHdr1 = aKey1[0];
4001     d1 = szHdr1 + sqlite3VdbeSerialTypeLen(s1);
4002     i = 1;
4003     pRhs++;
4004   }else{
4005     idx1 = getVarint32(aKey1, szHdr1);
4006     d1 = szHdr1;
4007     if( d1>(unsigned)nKey1 ){
4008       pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4009       return 0;  /* Corruption */
4010     }
4011     i = 0;
4012   }
4013 
4014   VVA_ONLY( mem1.szMalloc = 0; ) /* Only needed by assert() statements */
4015   assert( pPKey2->pKeyInfo->nField+pPKey2->pKeyInfo->nXField>=pPKey2->nField
4016        || CORRUPT_DB );
4017   assert( pPKey2->pKeyInfo->aSortOrder!=0 );
4018   assert( pPKey2->pKeyInfo->nField>0 );
4019   assert( idx1<=szHdr1 || CORRUPT_DB );
4020   do{
4021     u32 serial_type;
4022 
4023     /* RHS is an integer */
4024     if( pRhs->flags & MEM_Int ){
4025       serial_type = aKey1[idx1];
4026       testcase( serial_type==12 );
4027       if( serial_type>=10 ){
4028         rc = +1;
4029       }else if( serial_type==0 ){
4030         rc = -1;
4031       }else if( serial_type==7 ){
4032         sqlite3VdbeSerialGet(&aKey1[d1], serial_type, &mem1);
4033         rc = -sqlite3IntFloatCompare(pRhs->u.i, mem1.u.r);
4034       }else{
4035         i64 lhs = vdbeRecordDecodeInt(serial_type, &aKey1[d1]);
4036         i64 rhs = pRhs->u.i;
4037         if( lhs<rhs ){
4038           rc = -1;
4039         }else if( lhs>rhs ){
4040           rc = +1;
4041         }
4042       }
4043     }
4044 
4045     /* RHS is real */
4046     else if( pRhs->flags & MEM_Real ){
4047       serial_type = aKey1[idx1];
4048       if( serial_type>=10 ){
4049         /* Serial types 12 or greater are strings and blobs (greater than
4050         ** numbers). Types 10 and 11 are currently "reserved for future
4051         ** use", so it doesn't really matter what the results of comparing
4052         ** them to numberic values are.  */
4053         rc = +1;
4054       }else if( serial_type==0 ){
4055         rc = -1;
4056       }else{
4057         sqlite3VdbeSerialGet(&aKey1[d1], serial_type, &mem1);
4058         if( serial_type==7 ){
4059           if( mem1.u.r<pRhs->u.r ){
4060             rc = -1;
4061           }else if( mem1.u.r>pRhs->u.r ){
4062             rc = +1;
4063           }
4064         }else{
4065           rc = sqlite3IntFloatCompare(mem1.u.i, pRhs->u.r);
4066         }
4067       }
4068     }
4069 
4070     /* RHS is a string */
4071     else if( pRhs->flags & MEM_Str ){
4072       getVarint32(&aKey1[idx1], serial_type);
4073       testcase( serial_type==12 );
4074       if( serial_type<12 ){
4075         rc = -1;
4076       }else if( !(serial_type & 0x01) ){
4077         rc = +1;
4078       }else{
4079         mem1.n = (serial_type - 12) / 2;
4080         testcase( (d1+mem1.n)==(unsigned)nKey1 );
4081         testcase( (d1+mem1.n+1)==(unsigned)nKey1 );
4082         if( (d1+mem1.n) > (unsigned)nKey1 ){
4083           pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4084           return 0;                /* Corruption */
4085         }else if( pKeyInfo->aColl[i] ){
4086           mem1.enc = pKeyInfo->enc;
4087           mem1.db = pKeyInfo->db;
4088           mem1.flags = MEM_Str;
4089           mem1.z = (char*)&aKey1[d1];
4090           rc = vdbeCompareMemString(
4091               &mem1, pRhs, pKeyInfo->aColl[i], &pPKey2->errCode
4092           );
4093         }else{
4094           int nCmp = MIN(mem1.n, pRhs->n);
4095           rc = memcmp(&aKey1[d1], pRhs->z, nCmp);
4096           if( rc==0 ) rc = mem1.n - pRhs->n;
4097         }
4098       }
4099     }
4100 
4101     /* RHS is a blob */
4102     else if( pRhs->flags & MEM_Blob ){
4103       assert( (pRhs->flags & MEM_Zero)==0 || pRhs->n==0 );
4104       getVarint32(&aKey1[idx1], serial_type);
4105       testcase( serial_type==12 );
4106       if( serial_type<12 || (serial_type & 0x01) ){
4107         rc = -1;
4108       }else{
4109         int nStr = (serial_type - 12) / 2;
4110         testcase( (d1+nStr)==(unsigned)nKey1 );
4111         testcase( (d1+nStr+1)==(unsigned)nKey1 );
4112         if( (d1+nStr) > (unsigned)nKey1 ){
4113           pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4114           return 0;                /* Corruption */
4115         }else if( pRhs->flags & MEM_Zero ){
4116           if( !isAllZero((const char*)&aKey1[d1],nStr) ){
4117             rc = 1;
4118           }else{
4119             rc = nStr - pRhs->u.nZero;
4120           }
4121         }else{
4122           int nCmp = MIN(nStr, pRhs->n);
4123           rc = memcmp(&aKey1[d1], pRhs->z, nCmp);
4124           if( rc==0 ) rc = nStr - pRhs->n;
4125         }
4126       }
4127     }
4128 
4129     /* RHS is null */
4130     else{
4131       serial_type = aKey1[idx1];
4132       rc = (serial_type!=0);
4133     }
4134 
4135     if( rc!=0 ){
4136       if( pKeyInfo->aSortOrder[i] ){
4137         rc = -rc;
4138       }
4139       assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, rc) );
4140       assert( mem1.szMalloc==0 );  /* See comment below */
4141       return rc;
4142     }
4143 
4144     i++;
4145     pRhs++;
4146     d1 += sqlite3VdbeSerialTypeLen(serial_type);
4147     idx1 += sqlite3VarintLen(serial_type);
4148   }while( idx1<(unsigned)szHdr1 && i<pPKey2->nField && d1<=(unsigned)nKey1 );
4149 
4150   /* No memory allocation is ever used on mem1.  Prove this using
4151   ** the following assert().  If the assert() fails, it indicates a
4152   ** memory leak and a need to call sqlite3VdbeMemRelease(&mem1).  */
4153   assert( mem1.szMalloc==0 );
4154 
4155   /* rc==0 here means that one or both of the keys ran out of fields and
4156   ** all the fields up to that point were equal. Return the default_rc
4157   ** value.  */
4158   assert( CORRUPT_DB
4159        || vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, pPKey2->default_rc)
4160        || pKeyInfo->db->mallocFailed
4161   );
4162   pPKey2->eqSeen = 1;
4163   return pPKey2->default_rc;
4164 }
4165 int sqlite3VdbeRecordCompare(
4166   int nKey1, const void *pKey1,   /* Left key */
4167   UnpackedRecord *pPKey2          /* Right key */
4168 ){
4169   return sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 0);
4170 }
4171 
4172 
4173 /*
4174 ** This function is an optimized version of sqlite3VdbeRecordCompare()
4175 ** that (a) the first field of pPKey2 is an integer, and (b) the
4176 ** size-of-header varint at the start of (pKey1/nKey1) fits in a single
4177 ** byte (i.e. is less than 128).
4178 **
4179 ** To avoid concerns about buffer overreads, this routine is only used
4180 ** on schemas where the maximum valid header size is 63 bytes or less.
4181 */
4182 static int vdbeRecordCompareInt(
4183   int nKey1, const void *pKey1, /* Left key */
4184   UnpackedRecord *pPKey2        /* Right key */
4185 ){
4186   const u8 *aKey = &((const u8*)pKey1)[*(const u8*)pKey1 & 0x3F];
4187   int serial_type = ((const u8*)pKey1)[1];
4188   int res;
4189   u32 y;
4190   u64 x;
4191   i64 v;
4192   i64 lhs;
4193 
4194   vdbeAssertFieldCountWithinLimits(nKey1, pKey1, pPKey2->pKeyInfo);
4195   assert( (*(u8*)pKey1)<=0x3F || CORRUPT_DB );
4196   switch( serial_type ){
4197     case 1: { /* 1-byte signed integer */
4198       lhs = ONE_BYTE_INT(aKey);
4199       testcase( lhs<0 );
4200       break;
4201     }
4202     case 2: { /* 2-byte signed integer */
4203       lhs = TWO_BYTE_INT(aKey);
4204       testcase( lhs<0 );
4205       break;
4206     }
4207     case 3: { /* 3-byte signed integer */
4208       lhs = THREE_BYTE_INT(aKey);
4209       testcase( lhs<0 );
4210       break;
4211     }
4212     case 4: { /* 4-byte signed integer */
4213       y = FOUR_BYTE_UINT(aKey);
4214       lhs = (i64)*(int*)&y;
4215       testcase( lhs<0 );
4216       break;
4217     }
4218     case 5: { /* 6-byte signed integer */
4219       lhs = FOUR_BYTE_UINT(aKey+2) + (((i64)1)<<32)*TWO_BYTE_INT(aKey);
4220       testcase( lhs<0 );
4221       break;
4222     }
4223     case 6: { /* 8-byte signed integer */
4224       x = FOUR_BYTE_UINT(aKey);
4225       x = (x<<32) | FOUR_BYTE_UINT(aKey+4);
4226       lhs = *(i64*)&x;
4227       testcase( lhs<0 );
4228       break;
4229     }
4230     case 8:
4231       lhs = 0;
4232       break;
4233     case 9:
4234       lhs = 1;
4235       break;
4236 
4237     /* This case could be removed without changing the results of running
4238     ** this code. Including it causes gcc to generate a faster switch
4239     ** statement (since the range of switch targets now starts at zero and
4240     ** is contiguous) but does not cause any duplicate code to be generated
4241     ** (as gcc is clever enough to combine the two like cases). Other
4242     ** compilers might be similar.  */
4243     case 0: case 7:
4244       return sqlite3VdbeRecordCompare(nKey1, pKey1, pPKey2);
4245 
4246     default:
4247       return sqlite3VdbeRecordCompare(nKey1, pKey1, pPKey2);
4248   }
4249 
4250   v = pPKey2->aMem[0].u.i;
4251   if( v>lhs ){
4252     res = pPKey2->r1;
4253   }else if( v<lhs ){
4254     res = pPKey2->r2;
4255   }else if( pPKey2->nField>1 ){
4256     /* The first fields of the two keys are equal. Compare the trailing
4257     ** fields.  */
4258     res = sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 1);
4259   }else{
4260     /* The first fields of the two keys are equal and there are no trailing
4261     ** fields. Return pPKey2->default_rc in this case. */
4262     res = pPKey2->default_rc;
4263     pPKey2->eqSeen = 1;
4264   }
4265 
4266   assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, res) );
4267   return res;
4268 }
4269 
4270 /*
4271 ** This function is an optimized version of sqlite3VdbeRecordCompare()
4272 ** that (a) the first field of pPKey2 is a string, that (b) the first field
4273 ** uses the collation sequence BINARY and (c) that the size-of-header varint
4274 ** at the start of (pKey1/nKey1) fits in a single byte.
4275 */
4276 static int vdbeRecordCompareString(
4277   int nKey1, const void *pKey1, /* Left key */
4278   UnpackedRecord *pPKey2        /* Right key */
4279 ){
4280   const u8 *aKey1 = (const u8*)pKey1;
4281   int serial_type;
4282   int res;
4283 
4284   assert( pPKey2->aMem[0].flags & MEM_Str );
4285   vdbeAssertFieldCountWithinLimits(nKey1, pKey1, pPKey2->pKeyInfo);
4286   getVarint32(&aKey1[1], serial_type);
4287   if( serial_type<12 ){
4288     res = pPKey2->r1;      /* (pKey1/nKey1) is a number or a null */
4289   }else if( !(serial_type & 0x01) ){
4290     res = pPKey2->r2;      /* (pKey1/nKey1) is a blob */
4291   }else{
4292     int nCmp;
4293     int nStr;
4294     int szHdr = aKey1[0];
4295 
4296     nStr = (serial_type-12) / 2;
4297     if( (szHdr + nStr) > nKey1 ){
4298       pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4299       return 0;    /* Corruption */
4300     }
4301     nCmp = MIN( pPKey2->aMem[0].n, nStr );
4302     res = memcmp(&aKey1[szHdr], pPKey2->aMem[0].z, nCmp);
4303 
4304     if( res==0 ){
4305       res = nStr - pPKey2->aMem[0].n;
4306       if( res==0 ){
4307         if( pPKey2->nField>1 ){
4308           res = sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 1);
4309         }else{
4310           res = pPKey2->default_rc;
4311           pPKey2->eqSeen = 1;
4312         }
4313       }else if( res>0 ){
4314         res = pPKey2->r2;
4315       }else{
4316         res = pPKey2->r1;
4317       }
4318     }else if( res>0 ){
4319       res = pPKey2->r2;
4320     }else{
4321       res = pPKey2->r1;
4322     }
4323   }
4324 
4325   assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, res)
4326        || CORRUPT_DB
4327        || pPKey2->pKeyInfo->db->mallocFailed
4328   );
4329   return res;
4330 }
4331 
4332 /*
4333 ** Return a pointer to an sqlite3VdbeRecordCompare() compatible function
4334 ** suitable for comparing serialized records to the unpacked record passed
4335 ** as the only argument.
4336 */
4337 RecordCompare sqlite3VdbeFindCompare(UnpackedRecord *p){
4338   /* varintRecordCompareInt() and varintRecordCompareString() both assume
4339   ** that the size-of-header varint that occurs at the start of each record
4340   ** fits in a single byte (i.e. is 127 or less). varintRecordCompareInt()
4341   ** also assumes that it is safe to overread a buffer by at least the
4342   ** maximum possible legal header size plus 8 bytes. Because there is
4343   ** guaranteed to be at least 74 (but not 136) bytes of padding following each
4344   ** buffer passed to varintRecordCompareInt() this makes it convenient to
4345   ** limit the size of the header to 64 bytes in cases where the first field
4346   ** is an integer.
4347   **
4348   ** The easiest way to enforce this limit is to consider only records with
4349   ** 13 fields or less. If the first field is an integer, the maximum legal
4350   ** header size is (12*5 + 1 + 1) bytes.  */
4351   if( (p->pKeyInfo->nField + p->pKeyInfo->nXField)<=13 ){
4352     int flags = p->aMem[0].flags;
4353     if( p->pKeyInfo->aSortOrder[0] ){
4354       p->r1 = 1;
4355       p->r2 = -1;
4356     }else{
4357       p->r1 = -1;
4358       p->r2 = 1;
4359     }
4360     if( (flags & MEM_Int) ){
4361       return vdbeRecordCompareInt;
4362     }
4363     testcase( flags & MEM_Real );
4364     testcase( flags & MEM_Null );
4365     testcase( flags & MEM_Blob );
4366     if( (flags & (MEM_Real|MEM_Null|MEM_Blob))==0 && p->pKeyInfo->aColl[0]==0 ){
4367       assert( flags & MEM_Str );
4368       return vdbeRecordCompareString;
4369     }
4370   }
4371 
4372   return sqlite3VdbeRecordCompare;
4373 }
4374 
4375 /*
4376 ** pCur points at an index entry created using the OP_MakeRecord opcode.
4377 ** Read the rowid (the last field in the record) and store it in *rowid.
4378 ** Return SQLITE_OK if everything works, or an error code otherwise.
4379 **
4380 ** pCur might be pointing to text obtained from a corrupt database file.
4381 ** So the content cannot be trusted.  Do appropriate checks on the content.
4382 */
4383 int sqlite3VdbeIdxRowid(sqlite3 *db, BtCursor *pCur, i64 *rowid){
4384   i64 nCellKey = 0;
4385   int rc;
4386   u32 szHdr;        /* Size of the header */
4387   u32 typeRowid;    /* Serial type of the rowid */
4388   u32 lenRowid;     /* Size of the rowid */
4389   Mem m, v;
4390 
4391   /* Get the size of the index entry.  Only indices entries of less
4392   ** than 2GiB are support - anything large must be database corruption.
4393   ** Any corruption is detected in sqlite3BtreeParseCellPtr(), though, so
4394   ** this code can safely assume that nCellKey is 32-bits
4395   */
4396   assert( sqlite3BtreeCursorIsValid(pCur) );
4397   nCellKey = sqlite3BtreePayloadSize(pCur);
4398   assert( (nCellKey & SQLITE_MAX_U32)==(u64)nCellKey );
4399 
4400   /* Read in the complete content of the index entry */
4401   sqlite3VdbeMemInit(&m, db, 0);
4402   rc = sqlite3VdbeMemFromBtree(pCur, 0, (u32)nCellKey, &m);
4403   if( rc ){
4404     return rc;
4405   }
4406 
4407   /* The index entry must begin with a header size */
4408   (void)getVarint32((u8*)m.z, szHdr);
4409   testcase( szHdr==3 );
4410   testcase( szHdr==m.n );
4411   if( unlikely(szHdr<3 || (int)szHdr>m.n) ){
4412     goto idx_rowid_corruption;
4413   }
4414 
4415   /* The last field of the index should be an integer - the ROWID.
4416   ** Verify that the last entry really is an integer. */
4417   (void)getVarint32((u8*)&m.z[szHdr-1], typeRowid);
4418   testcase( typeRowid==1 );
4419   testcase( typeRowid==2 );
4420   testcase( typeRowid==3 );
4421   testcase( typeRowid==4 );
4422   testcase( typeRowid==5 );
4423   testcase( typeRowid==6 );
4424   testcase( typeRowid==8 );
4425   testcase( typeRowid==9 );
4426   if( unlikely(typeRowid<1 || typeRowid>9 || typeRowid==7) ){
4427     goto idx_rowid_corruption;
4428   }
4429   lenRowid = sqlite3SmallTypeSizes[typeRowid];
4430   testcase( (u32)m.n==szHdr+lenRowid );
4431   if( unlikely((u32)m.n<szHdr+lenRowid) ){
4432     goto idx_rowid_corruption;
4433   }
4434 
4435   /* Fetch the integer off the end of the index record */
4436   sqlite3VdbeSerialGet((u8*)&m.z[m.n-lenRowid], typeRowid, &v);
4437   *rowid = v.u.i;
4438   sqlite3VdbeMemRelease(&m);
4439   return SQLITE_OK;
4440 
4441   /* Jump here if database corruption is detected after m has been
4442   ** allocated.  Free the m object and return SQLITE_CORRUPT. */
4443 idx_rowid_corruption:
4444   testcase( m.szMalloc!=0 );
4445   sqlite3VdbeMemRelease(&m);
4446   return SQLITE_CORRUPT_BKPT;
4447 }
4448 
4449 /*
4450 ** Compare the key of the index entry that cursor pC is pointing to against
4451 ** the key string in pUnpacked.  Write into *pRes a number
4452 ** that is negative, zero, or positive if pC is less than, equal to,
4453 ** or greater than pUnpacked.  Return SQLITE_OK on success.
4454 **
4455 ** pUnpacked is either created without a rowid or is truncated so that it
4456 ** omits the rowid at the end.  The rowid at the end of the index entry
4457 ** is ignored as well.  Hence, this routine only compares the prefixes
4458 ** of the keys prior to the final rowid, not the entire key.
4459 */
4460 int sqlite3VdbeIdxKeyCompare(
4461   sqlite3 *db,                     /* Database connection */
4462   VdbeCursor *pC,                  /* The cursor to compare against */
4463   UnpackedRecord *pUnpacked,       /* Unpacked version of key */
4464   int *res                         /* Write the comparison result here */
4465 ){
4466   i64 nCellKey = 0;
4467   int rc;
4468   BtCursor *pCur;
4469   Mem m;
4470 
4471   assert( pC->eCurType==CURTYPE_BTREE );
4472   pCur = pC->uc.pCursor;
4473   assert( sqlite3BtreeCursorIsValid(pCur) );
4474   nCellKey = sqlite3BtreePayloadSize(pCur);
4475   /* nCellKey will always be between 0 and 0xffffffff because of the way
4476   ** that btreeParseCellPtr() and sqlite3GetVarint32() are implemented */
4477   if( nCellKey<=0 || nCellKey>0x7fffffff ){
4478     *res = 0;
4479     return SQLITE_CORRUPT_BKPT;
4480   }
4481   sqlite3VdbeMemInit(&m, db, 0);
4482   rc = sqlite3VdbeMemFromBtree(pCur, 0, (u32)nCellKey, &m);
4483   if( rc ){
4484     return rc;
4485   }
4486   *res = sqlite3VdbeRecordCompare(m.n, m.z, pUnpacked);
4487   sqlite3VdbeMemRelease(&m);
4488   return SQLITE_OK;
4489 }
4490 
4491 /*
4492 ** This routine sets the value to be returned by subsequent calls to
4493 ** sqlite3_changes() on the database handle 'db'.
4494 */
4495 void sqlite3VdbeSetChanges(sqlite3 *db, int nChange){
4496   assert( sqlite3_mutex_held(db->mutex) );
4497   db->nChange = nChange;
4498   db->nTotalChange += nChange;
4499 }
4500 
4501 /*
4502 ** Set a flag in the vdbe to update the change counter when it is finalised
4503 ** or reset.
4504 */
4505 void sqlite3VdbeCountChanges(Vdbe *v){
4506   v->changeCntOn = 1;
4507 }
4508 
4509 /*
4510 ** Mark every prepared statement associated with a database connection
4511 ** as expired.
4512 **
4513 ** An expired statement means that recompilation of the statement is
4514 ** recommend.  Statements expire when things happen that make their
4515 ** programs obsolete.  Removing user-defined functions or collating
4516 ** sequences, or changing an authorization function are the types of
4517 ** things that make prepared statements obsolete.
4518 */
4519 void sqlite3ExpirePreparedStatements(sqlite3 *db){
4520   Vdbe *p;
4521   for(p = db->pVdbe; p; p=p->pNext){
4522     p->expired = 1;
4523   }
4524 }
4525 
4526 /*
4527 ** Return the database associated with the Vdbe.
4528 */
4529 sqlite3 *sqlite3VdbeDb(Vdbe *v){
4530   return v->db;
4531 }
4532 
4533 /*
4534 ** Return the SQLITE_PREPARE flags for a Vdbe.
4535 */
4536 u8 sqlite3VdbePrepareFlags(Vdbe *v){
4537   return v->prepFlags;
4538 }
4539 
4540 /*
4541 ** Return a pointer to an sqlite3_value structure containing the value bound
4542 ** parameter iVar of VM v. Except, if the value is an SQL NULL, return
4543 ** 0 instead. Unless it is NULL, apply affinity aff (one of the SQLITE_AFF_*
4544 ** constants) to the value before returning it.
4545 **
4546 ** The returned value must be freed by the caller using sqlite3ValueFree().
4547 */
4548 sqlite3_value *sqlite3VdbeGetBoundValue(Vdbe *v, int iVar, u8 aff){
4549   assert( iVar>0 );
4550   if( v ){
4551     Mem *pMem = &v->aVar[iVar-1];
4552     assert( (v->db->flags & SQLITE_EnableQPSG)==0 );
4553     if( 0==(pMem->flags & MEM_Null) ){
4554       sqlite3_value *pRet = sqlite3ValueNew(v->db);
4555       if( pRet ){
4556         sqlite3VdbeMemCopy((Mem *)pRet, pMem);
4557         sqlite3ValueApplyAffinity(pRet, aff, SQLITE_UTF8);
4558       }
4559       return pRet;
4560     }
4561   }
4562   return 0;
4563 }
4564 
4565 /*
4566 ** Configure SQL variable iVar so that binding a new value to it signals
4567 ** to sqlite3_reoptimize() that re-preparing the statement may result
4568 ** in a better query plan.
4569 */
4570 void sqlite3VdbeSetVarmask(Vdbe *v, int iVar){
4571   assert( iVar>0 );
4572   assert( (v->db->flags & SQLITE_EnableQPSG)==0 );
4573   if( iVar>=32 ){
4574     v->expmask |= 0x80000000;
4575   }else{
4576     v->expmask |= ((u32)1 << (iVar-1));
4577   }
4578 }
4579 
4580 #ifndef SQLITE_OMIT_VIRTUALTABLE
4581 /*
4582 ** Transfer error message text from an sqlite3_vtab.zErrMsg (text stored
4583 ** in memory obtained from sqlite3_malloc) into a Vdbe.zErrMsg (text stored
4584 ** in memory obtained from sqlite3DbMalloc).
4585 */
4586 void sqlite3VtabImportErrmsg(Vdbe *p, sqlite3_vtab *pVtab){
4587   if( pVtab->zErrMsg ){
4588     sqlite3 *db = p->db;
4589     sqlite3DbFree(db, p->zErrMsg);
4590     p->zErrMsg = sqlite3DbStrDup(db, pVtab->zErrMsg);
4591     sqlite3_free(pVtab->zErrMsg);
4592     pVtab->zErrMsg = 0;
4593   }
4594 }
4595 #endif /* SQLITE_OMIT_VIRTUALTABLE */
4596 
4597 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
4598 
4599 /*
4600 ** If the second argument is not NULL, release any allocations associated
4601 ** with the memory cells in the p->aMem[] array. Also free the UnpackedRecord
4602 ** structure itself, using sqlite3DbFree().
4603 **
4604 ** This function is used to free UnpackedRecord structures allocated by
4605 ** the vdbeUnpackRecord() function found in vdbeapi.c.
4606 */
4607 static void vdbeFreeUnpacked(sqlite3 *db, int nField, UnpackedRecord *p){
4608   if( p ){
4609     int i;
4610     for(i=0; i<nField; i++){
4611       Mem *pMem = &p->aMem[i];
4612       if( pMem->zMalloc ) sqlite3VdbeMemRelease(pMem);
4613     }
4614     sqlite3DbFreeNN(db, p);
4615   }
4616 }
4617 #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
4618 
4619 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
4620 /*
4621 ** Invoke the pre-update hook. If this is an UPDATE or DELETE pre-update call,
4622 ** then cursor passed as the second argument should point to the row about
4623 ** to be update or deleted. If the application calls sqlite3_preupdate_old(),
4624 ** the required value will be read from the row the cursor points to.
4625 */
4626 void sqlite3VdbePreUpdateHook(
4627   Vdbe *v,                        /* Vdbe pre-update hook is invoked by */
4628   VdbeCursor *pCsr,               /* Cursor to grab old.* values from */
4629   int op,                         /* SQLITE_INSERT, UPDATE or DELETE */
4630   const char *zDb,                /* Database name */
4631   Table *pTab,                    /* Modified table */
4632   i64 iKey1,                      /* Initial key value */
4633   int iReg                        /* Register for new.* record */
4634 ){
4635   sqlite3 *db = v->db;
4636   i64 iKey2;
4637   PreUpdate preupdate;
4638   const char *zTbl = pTab->zName;
4639   static const u8 fakeSortOrder = 0;
4640 
4641   assert( db->pPreUpdate==0 );
4642   memset(&preupdate, 0, sizeof(PreUpdate));
4643   if( HasRowid(pTab)==0 ){
4644     iKey1 = iKey2 = 0;
4645     preupdate.pPk = sqlite3PrimaryKeyIndex(pTab);
4646   }else{
4647     if( op==SQLITE_UPDATE ){
4648       iKey2 = v->aMem[iReg].u.i;
4649     }else{
4650       iKey2 = iKey1;
4651     }
4652   }
4653 
4654   assert( pCsr->nField==pTab->nCol
4655        || (pCsr->nField==pTab->nCol+1 && op==SQLITE_DELETE && iReg==-1)
4656   );
4657 
4658   preupdate.v = v;
4659   preupdate.pCsr = pCsr;
4660   preupdate.op = op;
4661   preupdate.iNewReg = iReg;
4662   preupdate.keyinfo.db = db;
4663   preupdate.keyinfo.enc = ENC(db);
4664   preupdate.keyinfo.nField = pTab->nCol;
4665   preupdate.keyinfo.aSortOrder = (u8*)&fakeSortOrder;
4666   preupdate.iKey1 = iKey1;
4667   preupdate.iKey2 = iKey2;
4668   preupdate.pTab = pTab;
4669 
4670   db->pPreUpdate = &preupdate;
4671   db->xPreUpdateCallback(db->pPreUpdateArg, db, op, zDb, zTbl, iKey1, iKey2);
4672   db->pPreUpdate = 0;
4673   sqlite3DbFree(db, preupdate.aRecord);
4674   vdbeFreeUnpacked(db, preupdate.keyinfo.nField+1, preupdate.pUnpacked);
4675   vdbeFreeUnpacked(db, preupdate.keyinfo.nField+1, preupdate.pNewUnpacked);
4676   if( preupdate.aNew ){
4677     int i;
4678     for(i=0; i<pCsr->nField; i++){
4679       sqlite3VdbeMemRelease(&preupdate.aNew[i]);
4680     }
4681     sqlite3DbFreeNN(db, preupdate.aNew);
4682   }
4683 }
4684 #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
4685