xref: /sqlite-3.40.0/src/vdbeaux.c (revision a3fdec71)
1 /*
2 ** 2003 September 6
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 ** This file contains code used for creating, destroying, and populating
13 ** a VDBE (or an "sqlite3_stmt" as it is known to the outside world.)  Prior
14 ** to version 2.8.7, all this code was combined into the vdbe.c source file.
15 ** But that file was getting too big so this subroutines were split out.
16 */
17 #include "sqliteInt.h"
18 #include "vdbeInt.h"
19 
20 /*
21 ** Create a new virtual database engine.
22 */
23 Vdbe *sqlite3VdbeCreate(Parse *pParse){
24   sqlite3 *db = pParse->db;
25   Vdbe *p;
26   p = sqlite3DbMallocZero(db, sizeof(Vdbe) );
27   if( p==0 ) return 0;
28   p->db = db;
29   if( db->pVdbe ){
30     db->pVdbe->pPrev = p;
31   }
32   p->pNext = db->pVdbe;
33   p->pPrev = 0;
34   db->pVdbe = p;
35   p->magic = VDBE_MAGIC_INIT;
36   p->pParse = pParse;
37   assert( pParse->aLabel==0 );
38   assert( pParse->nLabel==0 );
39   assert( pParse->nOpAlloc==0 );
40   return p;
41 }
42 
43 /*
44 ** Remember the SQL string for a prepared statement.
45 */
46 void sqlite3VdbeSetSql(Vdbe *p, const char *z, int n, int isPrepareV2){
47   assert( isPrepareV2==1 || isPrepareV2==0 );
48   if( p==0 ) return;
49 #if defined(SQLITE_OMIT_TRACE) && !defined(SQLITE_ENABLE_SQLLOG)
50   if( !isPrepareV2 ) return;
51 #endif
52   assert( p->zSql==0 );
53   p->zSql = sqlite3DbStrNDup(p->db, z, n);
54   p->isPrepareV2 = (u8)isPrepareV2;
55 }
56 
57 /*
58 ** Return the SQL associated with a prepared statement
59 */
60 const char *sqlite3_sql(sqlite3_stmt *pStmt){
61   Vdbe *p = (Vdbe *)pStmt;
62   return (p && p->isPrepareV2) ? p->zSql : 0;
63 }
64 
65 /*
66 ** Swap all content between two VDBE structures.
67 */
68 void sqlite3VdbeSwap(Vdbe *pA, Vdbe *pB){
69   Vdbe tmp, *pTmp;
70   char *zTmp;
71   tmp = *pA;
72   *pA = *pB;
73   *pB = tmp;
74   pTmp = pA->pNext;
75   pA->pNext = pB->pNext;
76   pB->pNext = pTmp;
77   pTmp = pA->pPrev;
78   pA->pPrev = pB->pPrev;
79   pB->pPrev = pTmp;
80   zTmp = pA->zSql;
81   pA->zSql = pB->zSql;
82   pB->zSql = zTmp;
83   pB->isPrepareV2 = pA->isPrepareV2;
84 }
85 
86 /*
87 ** Resize the Vdbe.aOp array so that it is at least one op larger than
88 ** it was.
89 **
90 ** If an out-of-memory error occurs while resizing the array, return
91 ** SQLITE_NOMEM. In this case Vdbe.aOp and Vdbe.nOpAlloc remain
92 ** unchanged (this is so that any opcodes already allocated can be
93 ** correctly deallocated along with the rest of the Vdbe).
94 */
95 static int growOpArray(Vdbe *v){
96   VdbeOp *pNew;
97   Parse *p = v->pParse;
98   int nNew = (p->nOpAlloc ? p->nOpAlloc*2 : (int)(1024/sizeof(Op)));
99   pNew = sqlite3DbRealloc(p->db, v->aOp, nNew*sizeof(Op));
100   if( pNew ){
101     p->nOpAlloc = sqlite3DbMallocSize(p->db, pNew)/sizeof(Op);
102     v->aOp = pNew;
103   }
104   return (pNew ? SQLITE_OK : SQLITE_NOMEM);
105 }
106 
107 #ifdef SQLITE_DEBUG
108 /* This routine is just a convenient place to set a breakpoint that will
109 ** fire after each opcode is inserted and displayed using
110 ** "PRAGMA vdbe_addoptrace=on".
111 */
112 static void test_addop_breakpoint(void){
113   static int n = 0;
114   n++;
115 }
116 #endif
117 
118 /*
119 ** Add a new instruction to the list of instructions current in the
120 ** VDBE.  Return the address of the new instruction.
121 **
122 ** Parameters:
123 **
124 **    p               Pointer to the VDBE
125 **
126 **    op              The opcode for this instruction
127 **
128 **    p1, p2, p3      Operands
129 **
130 ** Use the sqlite3VdbeResolveLabel() function to fix an address and
131 ** the sqlite3VdbeChangeP4() function to change the value of the P4
132 ** operand.
133 */
134 int sqlite3VdbeAddOp3(Vdbe *p, int op, int p1, int p2, int p3){
135   int i;
136   VdbeOp *pOp;
137 
138   i = p->nOp;
139   assert( p->magic==VDBE_MAGIC_INIT );
140   assert( op>0 && op<0xff );
141   if( p->pParse->nOpAlloc<=i ){
142     if( growOpArray(p) ){
143       return 1;
144     }
145   }
146   p->nOp++;
147   pOp = &p->aOp[i];
148   pOp->opcode = (u8)op;
149   pOp->p5 = 0;
150   pOp->p1 = p1;
151   pOp->p2 = p2;
152   pOp->p3 = p3;
153   pOp->p4.p = 0;
154   pOp->p4type = P4_NOTUSED;
155 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
156   pOp->zComment = 0;
157 #endif
158 #ifdef SQLITE_DEBUG
159   if( p->db->flags & SQLITE_VdbeAddopTrace ){
160     int jj, kk;
161     Parse *pParse = p->pParse;
162     for(jj=kk=0; jj<SQLITE_N_COLCACHE; jj++){
163       struct yColCache *x = pParse->aColCache + jj;
164       if( x->iLevel>pParse->iCacheLevel || x->iReg==0 ) continue;
165       printf(" r[%d]={%d:%d}", x->iReg, x->iTable, x->iColumn);
166       kk++;
167     }
168     if( kk ) printf("\n");
169     sqlite3VdbePrintOp(0, i, &p->aOp[i]);
170     test_addop_breakpoint();
171   }
172 #endif
173 #ifdef VDBE_PROFILE
174   pOp->cycles = 0;
175   pOp->cnt = 0;
176 #endif
177   return i;
178 }
179 int sqlite3VdbeAddOp0(Vdbe *p, int op){
180   return sqlite3VdbeAddOp3(p, op, 0, 0, 0);
181 }
182 int sqlite3VdbeAddOp1(Vdbe *p, int op, int p1){
183   return sqlite3VdbeAddOp3(p, op, p1, 0, 0);
184 }
185 int sqlite3VdbeAddOp2(Vdbe *p, int op, int p1, int p2){
186   return sqlite3VdbeAddOp3(p, op, p1, p2, 0);
187 }
188 
189 
190 /*
191 ** Add an opcode that includes the p4 value as a pointer.
192 */
193 int sqlite3VdbeAddOp4(
194   Vdbe *p,            /* Add the opcode to this VM */
195   int op,             /* The new opcode */
196   int p1,             /* The P1 operand */
197   int p2,             /* The P2 operand */
198   int p3,             /* The P3 operand */
199   const char *zP4,    /* The P4 operand */
200   int p4type          /* P4 operand type */
201 ){
202   int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
203   sqlite3VdbeChangeP4(p, addr, zP4, p4type);
204   return addr;
205 }
206 
207 /*
208 ** Add an OP_ParseSchema opcode.  This routine is broken out from
209 ** sqlite3VdbeAddOp4() since it needs to also needs to mark all btrees
210 ** as having been used.
211 **
212 ** The zWhere string must have been obtained from sqlite3_malloc().
213 ** This routine will take ownership of the allocated memory.
214 */
215 void sqlite3VdbeAddParseSchemaOp(Vdbe *p, int iDb, char *zWhere){
216   int j;
217   int addr = sqlite3VdbeAddOp3(p, OP_ParseSchema, iDb, 0, 0);
218   sqlite3VdbeChangeP4(p, addr, zWhere, P4_DYNAMIC);
219   for(j=0; j<p->db->nDb; j++) sqlite3VdbeUsesBtree(p, j);
220 }
221 
222 /*
223 ** Add an opcode that includes the p4 value as an integer.
224 */
225 int sqlite3VdbeAddOp4Int(
226   Vdbe *p,            /* Add the opcode to this VM */
227   int op,             /* The new opcode */
228   int p1,             /* The P1 operand */
229   int p2,             /* The P2 operand */
230   int p3,             /* The P3 operand */
231   int p4              /* The P4 operand as an integer */
232 ){
233   int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
234   sqlite3VdbeChangeP4(p, addr, SQLITE_INT_TO_PTR(p4), P4_INT32);
235   return addr;
236 }
237 
238 /*
239 ** Create a new symbolic label for an instruction that has yet to be
240 ** coded.  The symbolic label is really just a negative number.  The
241 ** label can be used as the P2 value of an operation.  Later, when
242 ** the label is resolved to a specific address, the VDBE will scan
243 ** through its operation list and change all values of P2 which match
244 ** the label into the resolved address.
245 **
246 ** The VDBE knows that a P2 value is a label because labels are
247 ** always negative and P2 values are suppose to be non-negative.
248 ** Hence, a negative P2 value is a label that has yet to be resolved.
249 **
250 ** Zero is returned if a malloc() fails.
251 */
252 int sqlite3VdbeMakeLabel(Vdbe *v){
253   Parse *p = v->pParse;
254   int i = p->nLabel++;
255   assert( v->magic==VDBE_MAGIC_INIT );
256   if( (i & (i-1))==0 ){
257     p->aLabel = sqlite3DbReallocOrFree(p->db, p->aLabel,
258                                        (i*2+1)*sizeof(p->aLabel[0]));
259   }
260   if( p->aLabel ){
261     p->aLabel[i] = -1;
262   }
263   return -1-i;
264 }
265 
266 /*
267 ** Resolve label "x" to be the address of the next instruction to
268 ** be inserted.  The parameter "x" must have been obtained from
269 ** a prior call to sqlite3VdbeMakeLabel().
270 */
271 void sqlite3VdbeResolveLabel(Vdbe *v, int x){
272   Parse *p = v->pParse;
273   int j = -1-x;
274   assert( v->magic==VDBE_MAGIC_INIT );
275   assert( j<p->nLabel );
276   if( j>=0 && p->aLabel ){
277     p->aLabel[j] = v->nOp;
278   }
279   p->iFixedOp = v->nOp - 1;
280 }
281 
282 /*
283 ** Mark the VDBE as one that can only be run one time.
284 */
285 void sqlite3VdbeRunOnlyOnce(Vdbe *p){
286   p->runOnlyOnce = 1;
287 }
288 
289 #ifdef SQLITE_DEBUG /* sqlite3AssertMayAbort() logic */
290 
291 /*
292 ** The following type and function are used to iterate through all opcodes
293 ** in a Vdbe main program and each of the sub-programs (triggers) it may
294 ** invoke directly or indirectly. It should be used as follows:
295 **
296 **   Op *pOp;
297 **   VdbeOpIter sIter;
298 **
299 **   memset(&sIter, 0, sizeof(sIter));
300 **   sIter.v = v;                            // v is of type Vdbe*
301 **   while( (pOp = opIterNext(&sIter)) ){
302 **     // Do something with pOp
303 **   }
304 **   sqlite3DbFree(v->db, sIter.apSub);
305 **
306 */
307 typedef struct VdbeOpIter VdbeOpIter;
308 struct VdbeOpIter {
309   Vdbe *v;                   /* Vdbe to iterate through the opcodes of */
310   SubProgram **apSub;        /* Array of subprograms */
311   int nSub;                  /* Number of entries in apSub */
312   int iAddr;                 /* Address of next instruction to return */
313   int iSub;                  /* 0 = main program, 1 = first sub-program etc. */
314 };
315 static Op *opIterNext(VdbeOpIter *p){
316   Vdbe *v = p->v;
317   Op *pRet = 0;
318   Op *aOp;
319   int nOp;
320 
321   if( p->iSub<=p->nSub ){
322 
323     if( p->iSub==0 ){
324       aOp = v->aOp;
325       nOp = v->nOp;
326     }else{
327       aOp = p->apSub[p->iSub-1]->aOp;
328       nOp = p->apSub[p->iSub-1]->nOp;
329     }
330     assert( p->iAddr<nOp );
331 
332     pRet = &aOp[p->iAddr];
333     p->iAddr++;
334     if( p->iAddr==nOp ){
335       p->iSub++;
336       p->iAddr = 0;
337     }
338 
339     if( pRet->p4type==P4_SUBPROGRAM ){
340       int nByte = (p->nSub+1)*sizeof(SubProgram*);
341       int j;
342       for(j=0; j<p->nSub; j++){
343         if( p->apSub[j]==pRet->p4.pProgram ) break;
344       }
345       if( j==p->nSub ){
346         p->apSub = sqlite3DbReallocOrFree(v->db, p->apSub, nByte);
347         if( !p->apSub ){
348           pRet = 0;
349         }else{
350           p->apSub[p->nSub++] = pRet->p4.pProgram;
351         }
352       }
353     }
354   }
355 
356   return pRet;
357 }
358 
359 /*
360 ** Check if the program stored in the VM associated with pParse may
361 ** throw an ABORT exception (causing the statement, but not entire transaction
362 ** to be rolled back). This condition is true if the main program or any
363 ** sub-programs contains any of the following:
364 **
365 **   *  OP_Halt with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
366 **   *  OP_HaltIfNull with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
367 **   *  OP_Destroy
368 **   *  OP_VUpdate
369 **   *  OP_VRename
370 **   *  OP_FkCounter with P2==0 (immediate foreign key constraint)
371 **
372 ** Then check that the value of Parse.mayAbort is true if an
373 ** ABORT may be thrown, or false otherwise. Return true if it does
374 ** match, or false otherwise. This function is intended to be used as
375 ** part of an assert statement in the compiler. Similar to:
376 **
377 **   assert( sqlite3VdbeAssertMayAbort(pParse->pVdbe, pParse->mayAbort) );
378 */
379 int sqlite3VdbeAssertMayAbort(Vdbe *v, int mayAbort){
380   int hasAbort = 0;
381   Op *pOp;
382   VdbeOpIter sIter;
383   memset(&sIter, 0, sizeof(sIter));
384   sIter.v = v;
385 
386   while( (pOp = opIterNext(&sIter))!=0 ){
387     int opcode = pOp->opcode;
388     if( opcode==OP_Destroy || opcode==OP_VUpdate || opcode==OP_VRename
389 #ifndef SQLITE_OMIT_FOREIGN_KEY
390      || (opcode==OP_FkCounter && pOp->p1==0 && pOp->p2==1)
391 #endif
392      || ((opcode==OP_Halt || opcode==OP_HaltIfNull)
393       && ((pOp->p1&0xff)==SQLITE_CONSTRAINT && pOp->p2==OE_Abort))
394     ){
395       hasAbort = 1;
396       break;
397     }
398   }
399   sqlite3DbFree(v->db, sIter.apSub);
400 
401   /* Return true if hasAbort==mayAbort. Or if a malloc failure occurred.
402   ** If malloc failed, then the while() loop above may not have iterated
403   ** through all opcodes and hasAbort may be set incorrectly. Return
404   ** true for this case to prevent the assert() in the callers frame
405   ** from failing.  */
406   return ( v->db->mallocFailed || hasAbort==mayAbort );
407 }
408 #endif /* SQLITE_DEBUG - the sqlite3AssertMayAbort() function */
409 
410 /*
411 ** Loop through the program looking for P2 values that are negative
412 ** on jump instructions.  Each such value is a label.  Resolve the
413 ** label by setting the P2 value to its correct non-zero value.
414 **
415 ** This routine is called once after all opcodes have been inserted.
416 **
417 ** Variable *pMaxFuncArgs is set to the maximum value of any P2 argument
418 ** to an OP_Function, OP_AggStep or OP_VFilter opcode. This is used by
419 ** sqlite3VdbeMakeReady() to size the Vdbe.apArg[] array.
420 **
421 ** The Op.opflags field is set on all opcodes.
422 */
423 static void resolveP2Values(Vdbe *p, int *pMaxFuncArgs){
424   int i;
425   int nMaxArgs = *pMaxFuncArgs;
426   Op *pOp;
427   Parse *pParse = p->pParse;
428   int *aLabel = pParse->aLabel;
429   p->readOnly = 1;
430   p->bIsReader = 0;
431   for(pOp=p->aOp, i=p->nOp-1; i>=0; i--, pOp++){
432     u8 opcode = pOp->opcode;
433 
434     /* NOTE: Be sure to update mkopcodeh.awk when adding or removing
435     ** cases from this switch! */
436     switch( opcode ){
437       case OP_Function:
438       case OP_AggStep: {
439         if( pOp->p5>nMaxArgs ) nMaxArgs = pOp->p5;
440         break;
441       }
442       case OP_Transaction: {
443         if( pOp->p2!=0 ) p->readOnly = 0;
444         /* fall thru */
445       }
446       case OP_AutoCommit:
447       case OP_Savepoint: {
448         p->bIsReader = 1;
449         break;
450       }
451 #ifndef SQLITE_OMIT_WAL
452       case OP_Checkpoint:
453 #endif
454       case OP_Vacuum:
455       case OP_JournalMode: {
456         p->readOnly = 0;
457         p->bIsReader = 1;
458         break;
459       }
460 #ifndef SQLITE_OMIT_VIRTUALTABLE
461       case OP_VUpdate: {
462         if( pOp->p2>nMaxArgs ) nMaxArgs = pOp->p2;
463         break;
464       }
465       case OP_VFilter: {
466         int n;
467         assert( p->nOp - i >= 3 );
468         assert( pOp[-1].opcode==OP_Integer );
469         n = pOp[-1].p1;
470         if( n>nMaxArgs ) nMaxArgs = n;
471         break;
472       }
473 #endif
474       case OP_Next:
475       case OP_NextIfOpen:
476       case OP_SorterNext: {
477         pOp->p4.xAdvance = sqlite3BtreeNext;
478         pOp->p4type = P4_ADVANCE;
479         break;
480       }
481       case OP_Prev:
482       case OP_PrevIfOpen: {
483         pOp->p4.xAdvance = sqlite3BtreePrevious;
484         pOp->p4type = P4_ADVANCE;
485         break;
486       }
487     }
488 
489     pOp->opflags = sqlite3OpcodeProperty[opcode];
490     if( (pOp->opflags & OPFLG_JUMP)!=0 && pOp->p2<0 ){
491       assert( -1-pOp->p2<pParse->nLabel );
492       pOp->p2 = aLabel[-1-pOp->p2];
493     }
494   }
495   sqlite3DbFree(p->db, pParse->aLabel);
496   pParse->aLabel = 0;
497   pParse->nLabel = 0;
498   *pMaxFuncArgs = nMaxArgs;
499   assert( p->bIsReader!=0 || p->btreeMask==0 );
500 }
501 
502 /*
503 ** Return the address of the next instruction to be inserted.
504 */
505 int sqlite3VdbeCurrentAddr(Vdbe *p){
506   assert( p->magic==VDBE_MAGIC_INIT );
507   return p->nOp;
508 }
509 
510 /*
511 ** This function returns a pointer to the array of opcodes associated with
512 ** the Vdbe passed as the first argument. It is the callers responsibility
513 ** to arrange for the returned array to be eventually freed using the
514 ** vdbeFreeOpArray() function.
515 **
516 ** Before returning, *pnOp is set to the number of entries in the returned
517 ** array. Also, *pnMaxArg is set to the larger of its current value and
518 ** the number of entries in the Vdbe.apArg[] array required to execute the
519 ** returned program.
520 */
521 VdbeOp *sqlite3VdbeTakeOpArray(Vdbe *p, int *pnOp, int *pnMaxArg){
522   VdbeOp *aOp = p->aOp;
523   assert( aOp && !p->db->mallocFailed );
524 
525   /* Check that sqlite3VdbeUsesBtree() was not called on this VM */
526   assert( p->btreeMask==0 );
527 
528   resolveP2Values(p, pnMaxArg);
529   *pnOp = p->nOp;
530   p->aOp = 0;
531   return aOp;
532 }
533 
534 /*
535 ** Add a whole list of operations to the operation stack.  Return the
536 ** address of the first operation added.
537 */
538 int sqlite3VdbeAddOpList(Vdbe *p, int nOp, VdbeOpList const *aOp){
539   int addr;
540   assert( p->magic==VDBE_MAGIC_INIT );
541   if( p->nOp + nOp > p->pParse->nOpAlloc && growOpArray(p) ){
542     return 0;
543   }
544   addr = p->nOp;
545   if( ALWAYS(nOp>0) ){
546     int i;
547     VdbeOpList const *pIn = aOp;
548     for(i=0; i<nOp; i++, pIn++){
549       int p2 = pIn->p2;
550       VdbeOp *pOut = &p->aOp[i+addr];
551       pOut->opcode = pIn->opcode;
552       pOut->p1 = pIn->p1;
553       if( p2<0 ){
554         assert( sqlite3OpcodeProperty[pOut->opcode] & OPFLG_JUMP );
555         pOut->p2 = addr + ADDR(p2);
556       }else{
557         pOut->p2 = p2;
558       }
559       pOut->p3 = pIn->p3;
560       pOut->p4type = P4_NOTUSED;
561       pOut->p4.p = 0;
562       pOut->p5 = 0;
563 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
564       pOut->zComment = 0;
565 #endif
566 #ifdef SQLITE_DEBUG
567       if( p->db->flags & SQLITE_VdbeAddopTrace ){
568         sqlite3VdbePrintOp(0, i+addr, &p->aOp[i+addr]);
569       }
570 #endif
571     }
572     p->nOp += nOp;
573   }
574   return addr;
575 }
576 
577 /*
578 ** Change the value of the P1 operand for a specific instruction.
579 ** This routine is useful when a large program is loaded from a
580 ** static array using sqlite3VdbeAddOpList but we want to make a
581 ** few minor changes to the program.
582 */
583 void sqlite3VdbeChangeP1(Vdbe *p, u32 addr, int val){
584   assert( p!=0 );
585   if( ((u32)p->nOp)>addr ){
586     p->aOp[addr].p1 = val;
587   }
588 }
589 
590 /*
591 ** Change the value of the P2 operand for a specific instruction.
592 ** This routine is useful for setting a jump destination.
593 */
594 void sqlite3VdbeChangeP2(Vdbe *p, u32 addr, int val){
595   assert( p!=0 );
596   if( ((u32)p->nOp)>addr ){
597     p->aOp[addr].p2 = val;
598   }
599 }
600 
601 /*
602 ** Change the value of the P3 operand for a specific instruction.
603 */
604 void sqlite3VdbeChangeP3(Vdbe *p, u32 addr, int val){
605   assert( p!=0 );
606   if( ((u32)p->nOp)>addr ){
607     p->aOp[addr].p3 = val;
608   }
609 }
610 
611 /*
612 ** Change the value of the P5 operand for the most recently
613 ** added operation.
614 */
615 void sqlite3VdbeChangeP5(Vdbe *p, u8 val){
616   assert( p!=0 );
617   if( p->aOp ){
618     assert( p->nOp>0 );
619     p->aOp[p->nOp-1].p5 = val;
620   }
621 }
622 
623 /*
624 ** Change the P2 operand of instruction addr so that it points to
625 ** the address of the next instruction to be coded.
626 */
627 void sqlite3VdbeJumpHere(Vdbe *p, int addr){
628   sqlite3VdbeChangeP2(p, addr, p->nOp);
629   p->pParse->iFixedOp = p->nOp - 1;
630 }
631 
632 
633 /*
634 ** If the input FuncDef structure is ephemeral, then free it.  If
635 ** the FuncDef is not ephermal, then do nothing.
636 */
637 static void freeEphemeralFunction(sqlite3 *db, FuncDef *pDef){
638   if( ALWAYS(pDef) && (pDef->funcFlags & SQLITE_FUNC_EPHEM)!=0 ){
639     sqlite3DbFree(db, pDef);
640   }
641 }
642 
643 static void vdbeFreeOpArray(sqlite3 *, Op *, int);
644 
645 /*
646 ** Delete a P4 value if necessary.
647 */
648 static void freeP4(sqlite3 *db, int p4type, void *p4){
649   if( p4 ){
650     assert( db );
651     switch( p4type ){
652       case P4_REAL:
653       case P4_INT64:
654       case P4_DYNAMIC:
655       case P4_INTARRAY: {
656         sqlite3DbFree(db, p4);
657         break;
658       }
659       case P4_KEYINFO: {
660         if( db->pnBytesFreed==0 ) sqlite3KeyInfoUnref((KeyInfo*)p4);
661         break;
662       }
663       case P4_MPRINTF: {
664         if( db->pnBytesFreed==0 ) sqlite3_free(p4);
665         break;
666       }
667       case P4_FUNCDEF: {
668         freeEphemeralFunction(db, (FuncDef*)p4);
669         break;
670       }
671       case P4_MEM: {
672         if( db->pnBytesFreed==0 ){
673           sqlite3ValueFree((sqlite3_value*)p4);
674         }else{
675           Mem *p = (Mem*)p4;
676           sqlite3DbFree(db, p->zMalloc);
677           sqlite3DbFree(db, p);
678         }
679         break;
680       }
681       case P4_VTAB : {
682         if( db->pnBytesFreed==0 ) sqlite3VtabUnlock((VTable *)p4);
683         break;
684       }
685     }
686   }
687 }
688 
689 /*
690 ** Free the space allocated for aOp and any p4 values allocated for the
691 ** opcodes contained within. If aOp is not NULL it is assumed to contain
692 ** nOp entries.
693 */
694 static void vdbeFreeOpArray(sqlite3 *db, Op *aOp, int nOp){
695   if( aOp ){
696     Op *pOp;
697     for(pOp=aOp; pOp<&aOp[nOp]; pOp++){
698       freeP4(db, pOp->p4type, pOp->p4.p);
699 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
700       sqlite3DbFree(db, pOp->zComment);
701 #endif
702     }
703   }
704   sqlite3DbFree(db, aOp);
705 }
706 
707 /*
708 ** Link the SubProgram object passed as the second argument into the linked
709 ** list at Vdbe.pSubProgram. This list is used to delete all sub-program
710 ** objects when the VM is no longer required.
711 */
712 void sqlite3VdbeLinkSubProgram(Vdbe *pVdbe, SubProgram *p){
713   p->pNext = pVdbe->pProgram;
714   pVdbe->pProgram = p;
715 }
716 
717 /*
718 ** Change the opcode at addr into OP_Noop
719 */
720 void sqlite3VdbeChangeToNoop(Vdbe *p, int addr){
721   if( p->aOp ){
722     VdbeOp *pOp = &p->aOp[addr];
723     sqlite3 *db = p->db;
724     freeP4(db, pOp->p4type, pOp->p4.p);
725     memset(pOp, 0, sizeof(pOp[0]));
726     pOp->opcode = OP_Noop;
727     if( addr==p->nOp-1 ) p->nOp--;
728   }
729 }
730 
731 /*
732 ** Remove the last opcode inserted
733 */
734 int sqlite3VdbeDeletePriorOpcode(Vdbe *p, u8 op){
735   if( (p->nOp-1)>(p->pParse->iFixedOp) && p->aOp[p->nOp-1].opcode==op ){
736     sqlite3VdbeChangeToNoop(p, p->nOp-1);
737     return 1;
738   }else{
739     return 0;
740   }
741 }
742 
743 /*
744 ** Change the value of the P4 operand for a specific instruction.
745 ** This routine is useful when a large program is loaded from a
746 ** static array using sqlite3VdbeAddOpList but we want to make a
747 ** few minor changes to the program.
748 **
749 ** If n>=0 then the P4 operand is dynamic, meaning that a copy of
750 ** the string is made into memory obtained from sqlite3_malloc().
751 ** A value of n==0 means copy bytes of zP4 up to and including the
752 ** first null byte.  If n>0 then copy n+1 bytes of zP4.
753 **
754 ** Other values of n (P4_STATIC, P4_COLLSEQ etc.) indicate that zP4 points
755 ** to a string or structure that is guaranteed to exist for the lifetime of
756 ** the Vdbe. In these cases we can just copy the pointer.
757 **
758 ** If addr<0 then change P4 on the most recently inserted instruction.
759 */
760 void sqlite3VdbeChangeP4(Vdbe *p, int addr, const char *zP4, int n){
761   Op *pOp;
762   sqlite3 *db;
763   assert( p!=0 );
764   db = p->db;
765   assert( p->magic==VDBE_MAGIC_INIT );
766   if( p->aOp==0 || db->mallocFailed ){
767     if( n!=P4_VTAB ){
768       freeP4(db, n, (void*)*(char**)&zP4);
769     }
770     return;
771   }
772   assert( p->nOp>0 );
773   assert( addr<p->nOp );
774   if( addr<0 ){
775     addr = p->nOp - 1;
776   }
777   pOp = &p->aOp[addr];
778   assert( pOp->p4type==P4_NOTUSED || pOp->p4type==P4_INT32 );
779   freeP4(db, pOp->p4type, pOp->p4.p);
780   pOp->p4.p = 0;
781   if( n==P4_INT32 ){
782     /* Note: this cast is safe, because the origin data point was an int
783     ** that was cast to a (const char *). */
784     pOp->p4.i = SQLITE_PTR_TO_INT(zP4);
785     pOp->p4type = P4_INT32;
786   }else if( zP4==0 ){
787     pOp->p4.p = 0;
788     pOp->p4type = P4_NOTUSED;
789   }else if( n==P4_KEYINFO ){
790     pOp->p4.p = (void*)zP4;
791     pOp->p4type = P4_KEYINFO;
792   }else if( n==P4_VTAB ){
793     pOp->p4.p = (void*)zP4;
794     pOp->p4type = P4_VTAB;
795     sqlite3VtabLock((VTable *)zP4);
796     assert( ((VTable *)zP4)->db==p->db );
797   }else if( n<0 ){
798     pOp->p4.p = (void*)zP4;
799     pOp->p4type = (signed char)n;
800   }else{
801     if( n==0 ) n = sqlite3Strlen30(zP4);
802     pOp->p4.z = sqlite3DbStrNDup(p->db, zP4, n);
803     pOp->p4type = P4_DYNAMIC;
804   }
805 }
806 
807 /*
808 ** Set the P4 on the most recently added opcode to the KeyInfo for the
809 ** index given.
810 */
811 void sqlite3VdbeSetP4KeyInfo(Parse *pParse, Index *pIdx){
812   Vdbe *v = pParse->pVdbe;
813   assert( v!=0 );
814   assert( pIdx!=0 );
815   sqlite3VdbeChangeP4(v, -1, (char*)sqlite3KeyInfoOfIndex(pParse, pIdx),
816                       P4_KEYINFO);
817 }
818 
819 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
820 /*
821 ** Change the comment on the most recently coded instruction.  Or
822 ** insert a No-op and add the comment to that new instruction.  This
823 ** makes the code easier to read during debugging.  None of this happens
824 ** in a production build.
825 */
826 static void vdbeVComment(Vdbe *p, const char *zFormat, va_list ap){
827   assert( p->nOp>0 || p->aOp==0 );
828   assert( p->aOp==0 || p->aOp[p->nOp-1].zComment==0 || p->db->mallocFailed );
829   if( p->nOp ){
830     assert( p->aOp );
831     sqlite3DbFree(p->db, p->aOp[p->nOp-1].zComment);
832     p->aOp[p->nOp-1].zComment = sqlite3VMPrintf(p->db, zFormat, ap);
833   }
834 }
835 void sqlite3VdbeComment(Vdbe *p, const char *zFormat, ...){
836   va_list ap;
837   if( p ){
838     va_start(ap, zFormat);
839     vdbeVComment(p, zFormat, ap);
840     va_end(ap);
841   }
842 }
843 void sqlite3VdbeNoopComment(Vdbe *p, const char *zFormat, ...){
844   va_list ap;
845   if( p ){
846     sqlite3VdbeAddOp0(p, OP_Noop);
847     va_start(ap, zFormat);
848     vdbeVComment(p, zFormat, ap);
849     va_end(ap);
850   }
851 }
852 #endif  /* NDEBUG */
853 
854 /*
855 ** Return the opcode for a given address.  If the address is -1, then
856 ** return the most recently inserted opcode.
857 **
858 ** If a memory allocation error has occurred prior to the calling of this
859 ** routine, then a pointer to a dummy VdbeOp will be returned.  That opcode
860 ** is readable but not writable, though it is cast to a writable value.
861 ** The return of a dummy opcode allows the call to continue functioning
862 ** after a OOM fault without having to check to see if the return from
863 ** this routine is a valid pointer.  But because the dummy.opcode is 0,
864 ** dummy will never be written to.  This is verified by code inspection and
865 ** by running with Valgrind.
866 **
867 ** About the #ifdef SQLITE_OMIT_TRACE:  Normally, this routine is never called
868 ** unless p->nOp>0.  This is because in the absense of SQLITE_OMIT_TRACE,
869 ** an OP_Trace instruction is always inserted by sqlite3VdbeGet() as soon as
870 ** a new VDBE is created.  So we are free to set addr to p->nOp-1 without
871 ** having to double-check to make sure that the result is non-negative. But
872 ** if SQLITE_OMIT_TRACE is defined, the OP_Trace is omitted and we do need to
873 ** check the value of p->nOp-1 before continuing.
874 */
875 VdbeOp *sqlite3VdbeGetOp(Vdbe *p, int addr){
876   /* C89 specifies that the constant "dummy" will be initialized to all
877   ** zeros, which is correct.  MSVC generates a warning, nevertheless. */
878   static VdbeOp dummy;  /* Ignore the MSVC warning about no initializer */
879   assert( p->magic==VDBE_MAGIC_INIT );
880   if( addr<0 ){
881 #ifdef SQLITE_OMIT_TRACE
882     if( p->nOp==0 ) return (VdbeOp*)&dummy;
883 #endif
884     addr = p->nOp - 1;
885   }
886   assert( (addr>=0 && addr<p->nOp) || p->db->mallocFailed );
887   if( p->db->mallocFailed ){
888     return (VdbeOp*)&dummy;
889   }else{
890     return &p->aOp[addr];
891   }
892 }
893 
894 #if defined(SQLITE_ENABLE_EXPLAIN_COMMENTS)
895 /*
896 ** Return an integer value for one of the parameters to the opcode pOp
897 ** determined by character c.
898 */
899 static int translateP(char c, const Op *pOp){
900   if( c=='1' ) return pOp->p1;
901   if( c=='2' ) return pOp->p2;
902   if( c=='3' ) return pOp->p3;
903   if( c=='4' ) return pOp->p4.i;
904   return pOp->p5;
905 }
906 
907 /*
908 ** Compute a string for the "comment" field of a VDBE opcode listing.
909 **
910 ** The Synopsis: field in comments in the vdbe.c source file gets converted
911 ** to an extra string that is appended to the sqlite3OpcodeName().  In the
912 ** absence of other comments, this synopsis becomes the comment on the opcode.
913 ** Some translation occurs:
914 **
915 **       "PX"      ->  "r[X]"
916 **       "PX@PY"   ->  "r[X..X+Y-1]"  or "r[x]" if y is 0 or 1
917 **       "PX@PY+1" ->  "r[X..X+Y]"    or "r[x]" if y is 0
918 **       "PY..PY"  ->  "r[X..Y]"      or "r[x]" if y<=x
919 */
920 static int displayComment(
921   const Op *pOp,     /* The opcode to be commented */
922   const char *zP4,   /* Previously obtained value for P4 */
923   char *zTemp,       /* Write result here */
924   int nTemp          /* Space available in zTemp[] */
925 ){
926   const char *zOpName;
927   const char *zSynopsis;
928   int nOpName;
929   int ii, jj;
930   zOpName = sqlite3OpcodeName(pOp->opcode);
931   nOpName = sqlite3Strlen30(zOpName);
932   if( zOpName[nOpName+1] ){
933     int seenCom = 0;
934     char c;
935     zSynopsis = zOpName += nOpName + 1;
936     for(ii=jj=0; jj<nTemp-1 && (c = zSynopsis[ii])!=0; ii++){
937       if( c=='P' ){
938         c = zSynopsis[++ii];
939         if( c=='4' ){
940           sqlite3_snprintf(nTemp-jj, zTemp+jj, "%s", zP4);
941         }else if( c=='X' ){
942           sqlite3_snprintf(nTemp-jj, zTemp+jj, "%s", pOp->zComment);
943           seenCom = 1;
944         }else{
945           int v1 = translateP(c, pOp);
946           int v2;
947           sqlite3_snprintf(nTemp-jj, zTemp+jj, "%d", v1);
948           if( strncmp(zSynopsis+ii+1, "@P", 2)==0 ){
949             ii += 3;
950             jj += sqlite3Strlen30(zTemp+jj);
951             v2 = translateP(zSynopsis[ii], pOp);
952             if( strncmp(zSynopsis+ii+1,"+1",2)==0 ){
953               ii += 2;
954               v2++;
955             }
956             if( v2>1 ){
957               sqlite3_snprintf(nTemp-jj, zTemp+jj, "..%d", v1+v2-1);
958             }
959           }else if( strncmp(zSynopsis+ii+1, "..P3", 4)==0 && pOp->p3==0 ){
960             ii += 4;
961           }
962         }
963         jj += sqlite3Strlen30(zTemp+jj);
964       }else{
965         zTemp[jj++] = c;
966       }
967     }
968     if( !seenCom && jj<nTemp-5 && pOp->zComment ){
969       sqlite3_snprintf(nTemp-jj, zTemp+jj, "; %s", pOp->zComment);
970       jj += sqlite3Strlen30(zTemp+jj);
971     }
972     if( jj<nTemp ) zTemp[jj] = 0;
973   }else if( pOp->zComment ){
974     sqlite3_snprintf(nTemp, zTemp, "%s", pOp->zComment);
975     jj = sqlite3Strlen30(zTemp);
976   }else{
977     zTemp[0] = 0;
978     jj = 0;
979   }
980   return jj;
981 }
982 #endif /* SQLITE_DEBUG */
983 
984 
985 #if !defined(SQLITE_OMIT_EXPLAIN) || !defined(NDEBUG) \
986      || defined(VDBE_PROFILE) || defined(SQLITE_DEBUG)
987 /*
988 ** Compute a string that describes the P4 parameter for an opcode.
989 ** Use zTemp for any required temporary buffer space.
990 */
991 static char *displayP4(Op *pOp, char *zTemp, int nTemp){
992   char *zP4 = zTemp;
993   assert( nTemp>=20 );
994   switch( pOp->p4type ){
995     case P4_KEYINFO: {
996       int i, j;
997       KeyInfo *pKeyInfo = pOp->p4.pKeyInfo;
998       assert( pKeyInfo->aSortOrder!=0 );
999       sqlite3_snprintf(nTemp, zTemp, "k(%d", pKeyInfo->nField);
1000       i = sqlite3Strlen30(zTemp);
1001       for(j=0; j<pKeyInfo->nField; j++){
1002         CollSeq *pColl = pKeyInfo->aColl[j];
1003         const char *zColl = pColl ? pColl->zName : "nil";
1004         int n = sqlite3Strlen30(zColl);
1005         if( n==6 && memcmp(zColl,"BINARY",6)==0 ){
1006           zColl = "B";
1007           n = 1;
1008         }
1009         if( i+n>nTemp-6 ){
1010           memcpy(&zTemp[i],",...",4);
1011           break;
1012         }
1013         zTemp[i++] = ',';
1014         if( pKeyInfo->aSortOrder[j] ){
1015           zTemp[i++] = '-';
1016         }
1017         memcpy(&zTemp[i], zColl, n+1);
1018         i += n;
1019       }
1020       zTemp[i++] = ')';
1021       zTemp[i] = 0;
1022       assert( i<nTemp );
1023       break;
1024     }
1025     case P4_COLLSEQ: {
1026       CollSeq *pColl = pOp->p4.pColl;
1027       sqlite3_snprintf(nTemp, zTemp, "(%.20s)", pColl->zName);
1028       break;
1029     }
1030     case P4_FUNCDEF: {
1031       FuncDef *pDef = pOp->p4.pFunc;
1032       sqlite3_snprintf(nTemp, zTemp, "%s(%d)", pDef->zName, pDef->nArg);
1033       break;
1034     }
1035     case P4_INT64: {
1036       sqlite3_snprintf(nTemp, zTemp, "%lld", *pOp->p4.pI64);
1037       break;
1038     }
1039     case P4_INT32: {
1040       sqlite3_snprintf(nTemp, zTemp, "%d", pOp->p4.i);
1041       break;
1042     }
1043     case P4_REAL: {
1044       sqlite3_snprintf(nTemp, zTemp, "%.16g", *pOp->p4.pReal);
1045       break;
1046     }
1047     case P4_MEM: {
1048       Mem *pMem = pOp->p4.pMem;
1049       if( pMem->flags & MEM_Str ){
1050         zP4 = pMem->z;
1051       }else if( pMem->flags & MEM_Int ){
1052         sqlite3_snprintf(nTemp, zTemp, "%lld", pMem->u.i);
1053       }else if( pMem->flags & MEM_Real ){
1054         sqlite3_snprintf(nTemp, zTemp, "%.16g", pMem->r);
1055       }else if( pMem->flags & MEM_Null ){
1056         sqlite3_snprintf(nTemp, zTemp, "NULL");
1057       }else{
1058         assert( pMem->flags & MEM_Blob );
1059         zP4 = "(blob)";
1060       }
1061       break;
1062     }
1063 #ifndef SQLITE_OMIT_VIRTUALTABLE
1064     case P4_VTAB: {
1065       sqlite3_vtab *pVtab = pOp->p4.pVtab->pVtab;
1066       sqlite3_snprintf(nTemp, zTemp, "vtab:%p:%p", pVtab, pVtab->pModule);
1067       break;
1068     }
1069 #endif
1070     case P4_INTARRAY: {
1071       sqlite3_snprintf(nTemp, zTemp, "intarray");
1072       break;
1073     }
1074     case P4_SUBPROGRAM: {
1075       sqlite3_snprintf(nTemp, zTemp, "program");
1076       break;
1077     }
1078     case P4_ADVANCE: {
1079       zTemp[0] = 0;
1080       break;
1081     }
1082     default: {
1083       zP4 = pOp->p4.z;
1084       if( zP4==0 ){
1085         zP4 = zTemp;
1086         zTemp[0] = 0;
1087       }
1088     }
1089   }
1090   assert( zP4!=0 );
1091   return zP4;
1092 }
1093 #endif
1094 
1095 /*
1096 ** Declare to the Vdbe that the BTree object at db->aDb[i] is used.
1097 **
1098 ** The prepared statements need to know in advance the complete set of
1099 ** attached databases that will be use.  A mask of these databases
1100 ** is maintained in p->btreeMask.  The p->lockMask value is the subset of
1101 ** p->btreeMask of databases that will require a lock.
1102 */
1103 void sqlite3VdbeUsesBtree(Vdbe *p, int i){
1104   assert( i>=0 && i<p->db->nDb && i<(int)sizeof(yDbMask)*8 );
1105   assert( i<(int)sizeof(p->btreeMask)*8 );
1106   p->btreeMask |= ((yDbMask)1)<<i;
1107   if( i!=1 && sqlite3BtreeSharable(p->db->aDb[i].pBt) ){
1108     p->lockMask |= ((yDbMask)1)<<i;
1109   }
1110 }
1111 
1112 #if !defined(SQLITE_OMIT_SHARED_CACHE) && SQLITE_THREADSAFE>0
1113 /*
1114 ** If SQLite is compiled to support shared-cache mode and to be threadsafe,
1115 ** this routine obtains the mutex associated with each BtShared structure
1116 ** that may be accessed by the VM passed as an argument. In doing so it also
1117 ** sets the BtShared.db member of each of the BtShared structures, ensuring
1118 ** that the correct busy-handler callback is invoked if required.
1119 **
1120 ** If SQLite is not threadsafe but does support shared-cache mode, then
1121 ** sqlite3BtreeEnter() is invoked to set the BtShared.db variables
1122 ** of all of BtShared structures accessible via the database handle
1123 ** associated with the VM.
1124 **
1125 ** If SQLite is not threadsafe and does not support shared-cache mode, this
1126 ** function is a no-op.
1127 **
1128 ** The p->btreeMask field is a bitmask of all btrees that the prepared
1129 ** statement p will ever use.  Let N be the number of bits in p->btreeMask
1130 ** corresponding to btrees that use shared cache.  Then the runtime of
1131 ** this routine is N*N.  But as N is rarely more than 1, this should not
1132 ** be a problem.
1133 */
1134 void sqlite3VdbeEnter(Vdbe *p){
1135   int i;
1136   yDbMask mask;
1137   sqlite3 *db;
1138   Db *aDb;
1139   int nDb;
1140   if( p->lockMask==0 ) return;  /* The common case */
1141   db = p->db;
1142   aDb = db->aDb;
1143   nDb = db->nDb;
1144   for(i=0, mask=1; i<nDb; i++, mask += mask){
1145     if( i!=1 && (mask & p->lockMask)!=0 && ALWAYS(aDb[i].pBt!=0) ){
1146       sqlite3BtreeEnter(aDb[i].pBt);
1147     }
1148   }
1149 }
1150 #endif
1151 
1152 #if !defined(SQLITE_OMIT_SHARED_CACHE) && SQLITE_THREADSAFE>0
1153 /*
1154 ** Unlock all of the btrees previously locked by a call to sqlite3VdbeEnter().
1155 */
1156 void sqlite3VdbeLeave(Vdbe *p){
1157   int i;
1158   yDbMask mask;
1159   sqlite3 *db;
1160   Db *aDb;
1161   int nDb;
1162   if( p->lockMask==0 ) return;  /* The common case */
1163   db = p->db;
1164   aDb = db->aDb;
1165   nDb = db->nDb;
1166   for(i=0, mask=1; i<nDb; i++, mask += mask){
1167     if( i!=1 && (mask & p->lockMask)!=0 && ALWAYS(aDb[i].pBt!=0) ){
1168       sqlite3BtreeLeave(aDb[i].pBt);
1169     }
1170   }
1171 }
1172 #endif
1173 
1174 #if defined(VDBE_PROFILE) || defined(SQLITE_DEBUG)
1175 /*
1176 ** Print a single opcode.  This routine is used for debugging only.
1177 */
1178 void sqlite3VdbePrintOp(FILE *pOut, int pc, Op *pOp){
1179   char *zP4;
1180   char zPtr[50];
1181   char zCom[100];
1182   static const char *zFormat1 = "%4d %-13s %4d %4d %4d %-13s %.2X %s\n";
1183   if( pOut==0 ) pOut = stdout;
1184   zP4 = displayP4(pOp, zPtr, sizeof(zPtr));
1185 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1186   displayComment(pOp, zP4, zCom, sizeof(zCom));
1187 #else
1188   zCom[0] = 0
1189 #endif
1190   /* NB:  The sqlite3OpcodeName() function is implemented by code created
1191   ** by the mkopcodeh.awk and mkopcodec.awk scripts which extract the
1192   ** information from the vdbe.c source text */
1193   fprintf(pOut, zFormat1, pc,
1194       sqlite3OpcodeName(pOp->opcode), pOp->p1, pOp->p2, pOp->p3, zP4, pOp->p5,
1195       zCom
1196   );
1197   fflush(pOut);
1198 }
1199 #endif
1200 
1201 /*
1202 ** Release an array of N Mem elements
1203 */
1204 static void releaseMemArray(Mem *p, int N){
1205   if( p && N ){
1206     Mem *pEnd;
1207     sqlite3 *db = p->db;
1208     u8 malloc_failed = db->mallocFailed;
1209     if( db->pnBytesFreed ){
1210       for(pEnd=&p[N]; p<pEnd; p++){
1211         sqlite3DbFree(db, p->zMalloc);
1212       }
1213       return;
1214     }
1215     for(pEnd=&p[N]; p<pEnd; p++){
1216       assert( (&p[1])==pEnd || p[0].db==p[1].db );
1217 
1218       /* This block is really an inlined version of sqlite3VdbeMemRelease()
1219       ** that takes advantage of the fact that the memory cell value is
1220       ** being set to NULL after releasing any dynamic resources.
1221       **
1222       ** The justification for duplicating code is that according to
1223       ** callgrind, this causes a certain test case to hit the CPU 4.7
1224       ** percent less (x86 linux, gcc version 4.1.2, -O6) than if
1225       ** sqlite3MemRelease() were called from here. With -O2, this jumps
1226       ** to 6.6 percent. The test case is inserting 1000 rows into a table
1227       ** with no indexes using a single prepared INSERT statement, bind()
1228       ** and reset(). Inserts are grouped into a transaction.
1229       */
1230       if( p->flags&(MEM_Agg|MEM_Dyn|MEM_Frame|MEM_RowSet) ){
1231         sqlite3VdbeMemRelease(p);
1232       }else if( p->zMalloc ){
1233         sqlite3DbFree(db, p->zMalloc);
1234         p->zMalloc = 0;
1235       }
1236 
1237       p->flags = MEM_Invalid;
1238     }
1239     db->mallocFailed = malloc_failed;
1240   }
1241 }
1242 
1243 /*
1244 ** Delete a VdbeFrame object and its contents. VdbeFrame objects are
1245 ** allocated by the OP_Program opcode in sqlite3VdbeExec().
1246 */
1247 void sqlite3VdbeFrameDelete(VdbeFrame *p){
1248   int i;
1249   Mem *aMem = VdbeFrameMem(p);
1250   VdbeCursor **apCsr = (VdbeCursor **)&aMem[p->nChildMem];
1251   for(i=0; i<p->nChildCsr; i++){
1252     sqlite3VdbeFreeCursor(p->v, apCsr[i]);
1253   }
1254   releaseMemArray(aMem, p->nChildMem);
1255   sqlite3DbFree(p->v->db, p);
1256 }
1257 
1258 #ifndef SQLITE_OMIT_EXPLAIN
1259 /*
1260 ** Give a listing of the program in the virtual machine.
1261 **
1262 ** The interface is the same as sqlite3VdbeExec().  But instead of
1263 ** running the code, it invokes the callback once for each instruction.
1264 ** This feature is used to implement "EXPLAIN".
1265 **
1266 ** When p->explain==1, each instruction is listed.  When
1267 ** p->explain==2, only OP_Explain instructions are listed and these
1268 ** are shown in a different format.  p->explain==2 is used to implement
1269 ** EXPLAIN QUERY PLAN.
1270 **
1271 ** When p->explain==1, first the main program is listed, then each of
1272 ** the trigger subprograms are listed one by one.
1273 */
1274 int sqlite3VdbeList(
1275   Vdbe *p                   /* The VDBE */
1276 ){
1277   int nRow;                            /* Stop when row count reaches this */
1278   int nSub = 0;                        /* Number of sub-vdbes seen so far */
1279   SubProgram **apSub = 0;              /* Array of sub-vdbes */
1280   Mem *pSub = 0;                       /* Memory cell hold array of subprogs */
1281   sqlite3 *db = p->db;                 /* The database connection */
1282   int i;                               /* Loop counter */
1283   int rc = SQLITE_OK;                  /* Return code */
1284   Mem *pMem = &p->aMem[1];             /* First Mem of result set */
1285 
1286   assert( p->explain );
1287   assert( p->magic==VDBE_MAGIC_RUN );
1288   assert( p->rc==SQLITE_OK || p->rc==SQLITE_BUSY || p->rc==SQLITE_NOMEM );
1289 
1290   /* Even though this opcode does not use dynamic strings for
1291   ** the result, result columns may become dynamic if the user calls
1292   ** sqlite3_column_text16(), causing a translation to UTF-16 encoding.
1293   */
1294   releaseMemArray(pMem, 8);
1295   p->pResultSet = 0;
1296 
1297   if( p->rc==SQLITE_NOMEM ){
1298     /* This happens if a malloc() inside a call to sqlite3_column_text() or
1299     ** sqlite3_column_text16() failed.  */
1300     db->mallocFailed = 1;
1301     return SQLITE_ERROR;
1302   }
1303 
1304   /* When the number of output rows reaches nRow, that means the
1305   ** listing has finished and sqlite3_step() should return SQLITE_DONE.
1306   ** nRow is the sum of the number of rows in the main program, plus
1307   ** the sum of the number of rows in all trigger subprograms encountered
1308   ** so far.  The nRow value will increase as new trigger subprograms are
1309   ** encountered, but p->pc will eventually catch up to nRow.
1310   */
1311   nRow = p->nOp;
1312   if( p->explain==1 ){
1313     /* The first 8 memory cells are used for the result set.  So we will
1314     ** commandeer the 9th cell to use as storage for an array of pointers
1315     ** to trigger subprograms.  The VDBE is guaranteed to have at least 9
1316     ** cells.  */
1317     assert( p->nMem>9 );
1318     pSub = &p->aMem[9];
1319     if( pSub->flags&MEM_Blob ){
1320       /* On the first call to sqlite3_step(), pSub will hold a NULL.  It is
1321       ** initialized to a BLOB by the P4_SUBPROGRAM processing logic below */
1322       nSub = pSub->n/sizeof(Vdbe*);
1323       apSub = (SubProgram **)pSub->z;
1324     }
1325     for(i=0; i<nSub; i++){
1326       nRow += apSub[i]->nOp;
1327     }
1328   }
1329 
1330   do{
1331     i = p->pc++;
1332   }while( i<nRow && p->explain==2 && p->aOp[i].opcode!=OP_Explain );
1333   if( i>=nRow ){
1334     p->rc = SQLITE_OK;
1335     rc = SQLITE_DONE;
1336   }else if( db->u1.isInterrupted ){
1337     p->rc = SQLITE_INTERRUPT;
1338     rc = SQLITE_ERROR;
1339     sqlite3SetString(&p->zErrMsg, db, "%s", sqlite3ErrStr(p->rc));
1340   }else{
1341     char *zP4;
1342     Op *pOp;
1343     if( i<p->nOp ){
1344       /* The output line number is small enough that we are still in the
1345       ** main program. */
1346       pOp = &p->aOp[i];
1347     }else{
1348       /* We are currently listing subprograms.  Figure out which one and
1349       ** pick up the appropriate opcode. */
1350       int j;
1351       i -= p->nOp;
1352       for(j=0; i>=apSub[j]->nOp; j++){
1353         i -= apSub[j]->nOp;
1354       }
1355       pOp = &apSub[j]->aOp[i];
1356     }
1357     if( p->explain==1 ){
1358       pMem->flags = MEM_Int;
1359       pMem->type = SQLITE_INTEGER;
1360       pMem->u.i = i;                                /* Program counter */
1361       pMem++;
1362 
1363       pMem->flags = MEM_Static|MEM_Str|MEM_Term;
1364       pMem->z = (char*)sqlite3OpcodeName(pOp->opcode); /* Opcode */
1365       assert( pMem->z!=0 );
1366       pMem->n = sqlite3Strlen30(pMem->z);
1367       pMem->type = SQLITE_TEXT;
1368       pMem->enc = SQLITE_UTF8;
1369       pMem++;
1370 
1371       /* When an OP_Program opcode is encounter (the only opcode that has
1372       ** a P4_SUBPROGRAM argument), expand the size of the array of subprograms
1373       ** kept in p->aMem[9].z to hold the new program - assuming this subprogram
1374       ** has not already been seen.
1375       */
1376       if( pOp->p4type==P4_SUBPROGRAM ){
1377         int nByte = (nSub+1)*sizeof(SubProgram*);
1378         int j;
1379         for(j=0; j<nSub; j++){
1380           if( apSub[j]==pOp->p4.pProgram ) break;
1381         }
1382         if( j==nSub && SQLITE_OK==sqlite3VdbeMemGrow(pSub, nByte, nSub!=0) ){
1383           apSub = (SubProgram **)pSub->z;
1384           apSub[nSub++] = pOp->p4.pProgram;
1385           pSub->flags |= MEM_Blob;
1386           pSub->n = nSub*sizeof(SubProgram*);
1387         }
1388       }
1389     }
1390 
1391     pMem->flags = MEM_Int;
1392     pMem->u.i = pOp->p1;                          /* P1 */
1393     pMem->type = SQLITE_INTEGER;
1394     pMem++;
1395 
1396     pMem->flags = MEM_Int;
1397     pMem->u.i = pOp->p2;                          /* P2 */
1398     pMem->type = SQLITE_INTEGER;
1399     pMem++;
1400 
1401     pMem->flags = MEM_Int;
1402     pMem->u.i = pOp->p3;                          /* P3 */
1403     pMem->type = SQLITE_INTEGER;
1404     pMem++;
1405 
1406     if( sqlite3VdbeMemGrow(pMem, 32, 0) ){            /* P4 */
1407       assert( p->db->mallocFailed );
1408       return SQLITE_ERROR;
1409     }
1410     pMem->flags = MEM_Dyn|MEM_Str|MEM_Term;
1411     zP4 = displayP4(pOp, pMem->z, 32);
1412     if( zP4!=pMem->z ){
1413       sqlite3VdbeMemSetStr(pMem, zP4, -1, SQLITE_UTF8, 0);
1414     }else{
1415       assert( pMem->z!=0 );
1416       pMem->n = sqlite3Strlen30(pMem->z);
1417       pMem->enc = SQLITE_UTF8;
1418     }
1419     pMem->type = SQLITE_TEXT;
1420     pMem++;
1421 
1422     if( p->explain==1 ){
1423       if( sqlite3VdbeMemGrow(pMem, 4, 0) ){
1424         assert( p->db->mallocFailed );
1425         return SQLITE_ERROR;
1426       }
1427       pMem->flags = MEM_Dyn|MEM_Str|MEM_Term;
1428       pMem->n = 2;
1429       sqlite3_snprintf(3, pMem->z, "%.2x", pOp->p5);   /* P5 */
1430       pMem->type = SQLITE_TEXT;
1431       pMem->enc = SQLITE_UTF8;
1432       pMem++;
1433 
1434 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1435       if( sqlite3VdbeMemGrow(pMem, 500, 0) ){
1436         assert( p->db->mallocFailed );
1437         return SQLITE_ERROR;
1438       }
1439       pMem->flags = MEM_Dyn|MEM_Str|MEM_Term;
1440       pMem->n = displayComment(pOp, zP4, pMem->z, 500);
1441       pMem->type = SQLITE_TEXT;
1442       pMem->enc = SQLITE_UTF8;
1443 #else
1444       pMem->flags = MEM_Null;                       /* Comment */
1445       pMem->type = SQLITE_NULL;
1446 #endif
1447     }
1448 
1449     p->nResColumn = 8 - 4*(p->explain-1);
1450     p->pResultSet = &p->aMem[1];
1451     p->rc = SQLITE_OK;
1452     rc = SQLITE_ROW;
1453   }
1454   return rc;
1455 }
1456 #endif /* SQLITE_OMIT_EXPLAIN */
1457 
1458 #ifdef SQLITE_DEBUG
1459 /*
1460 ** Print the SQL that was used to generate a VDBE program.
1461 */
1462 void sqlite3VdbePrintSql(Vdbe *p){
1463   const char *z = 0;
1464   if( p->zSql ){
1465     z = p->zSql;
1466   }else if( p->nOp>=1 ){
1467     const VdbeOp *pOp = &p->aOp[0];
1468     if( pOp->opcode==OP_Trace && pOp->p4.z!=0 ){
1469       z = pOp->p4.z;
1470       while( sqlite3Isspace(*z) ) z++;
1471     }
1472   }
1473   if( z ) printf("SQL: [%s]\n", z);
1474 }
1475 #endif
1476 
1477 #if !defined(SQLITE_OMIT_TRACE) && defined(SQLITE_ENABLE_IOTRACE)
1478 /*
1479 ** Print an IOTRACE message showing SQL content.
1480 */
1481 void sqlite3VdbeIOTraceSql(Vdbe *p){
1482   int nOp = p->nOp;
1483   VdbeOp *pOp;
1484   if( sqlite3IoTrace==0 ) return;
1485   if( nOp<1 ) return;
1486   pOp = &p->aOp[0];
1487   if( pOp->opcode==OP_Trace && pOp->p4.z!=0 ){
1488     int i, j;
1489     char z[1000];
1490     sqlite3_snprintf(sizeof(z), z, "%s", pOp->p4.z);
1491     for(i=0; sqlite3Isspace(z[i]); i++){}
1492     for(j=0; z[i]; i++){
1493       if( sqlite3Isspace(z[i]) ){
1494         if( z[i-1]!=' ' ){
1495           z[j++] = ' ';
1496         }
1497       }else{
1498         z[j++] = z[i];
1499       }
1500     }
1501     z[j] = 0;
1502     sqlite3IoTrace("SQL %s\n", z);
1503   }
1504 }
1505 #endif /* !SQLITE_OMIT_TRACE && SQLITE_ENABLE_IOTRACE */
1506 
1507 /*
1508 ** Allocate space from a fixed size buffer and return a pointer to
1509 ** that space.  If insufficient space is available, return NULL.
1510 **
1511 ** The pBuf parameter is the initial value of a pointer which will
1512 ** receive the new memory.  pBuf is normally NULL.  If pBuf is not
1513 ** NULL, it means that memory space has already been allocated and that
1514 ** this routine should not allocate any new memory.  When pBuf is not
1515 ** NULL simply return pBuf.  Only allocate new memory space when pBuf
1516 ** is NULL.
1517 **
1518 ** nByte is the number of bytes of space needed.
1519 **
1520 ** *ppFrom points to available space and pEnd points to the end of the
1521 ** available space.  When space is allocated, *ppFrom is advanced past
1522 ** the end of the allocated space.
1523 **
1524 ** *pnByte is a counter of the number of bytes of space that have failed
1525 ** to allocate.  If there is insufficient space in *ppFrom to satisfy the
1526 ** request, then increment *pnByte by the amount of the request.
1527 */
1528 static void *allocSpace(
1529   void *pBuf,          /* Where return pointer will be stored */
1530   int nByte,           /* Number of bytes to allocate */
1531   u8 **ppFrom,         /* IN/OUT: Allocate from *ppFrom */
1532   u8 *pEnd,            /* Pointer to 1 byte past the end of *ppFrom buffer */
1533   int *pnByte          /* If allocation cannot be made, increment *pnByte */
1534 ){
1535   assert( EIGHT_BYTE_ALIGNMENT(*ppFrom) );
1536   if( pBuf ) return pBuf;
1537   nByte = ROUND8(nByte);
1538   if( &(*ppFrom)[nByte] <= pEnd ){
1539     pBuf = (void*)*ppFrom;
1540     *ppFrom += nByte;
1541   }else{
1542     *pnByte += nByte;
1543   }
1544   return pBuf;
1545 }
1546 
1547 /*
1548 ** Rewind the VDBE back to the beginning in preparation for
1549 ** running it.
1550 */
1551 void sqlite3VdbeRewind(Vdbe *p){
1552 #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
1553   int i;
1554 #endif
1555   assert( p!=0 );
1556   assert( p->magic==VDBE_MAGIC_INIT );
1557 
1558   /* There should be at least one opcode.
1559   */
1560   assert( p->nOp>0 );
1561 
1562   /* Set the magic to VDBE_MAGIC_RUN sooner rather than later. */
1563   p->magic = VDBE_MAGIC_RUN;
1564 
1565 #ifdef SQLITE_DEBUG
1566   for(i=1; i<p->nMem; i++){
1567     assert( p->aMem[i].db==p->db );
1568   }
1569 #endif
1570   p->pc = -1;
1571   p->rc = SQLITE_OK;
1572   p->errorAction = OE_Abort;
1573   p->magic = VDBE_MAGIC_RUN;
1574   p->nChange = 0;
1575   p->cacheCtr = 1;
1576   p->minWriteFileFormat = 255;
1577   p->iStatement = 0;
1578   p->nFkConstraint = 0;
1579 #ifdef VDBE_PROFILE
1580   for(i=0; i<p->nOp; i++){
1581     p->aOp[i].cnt = 0;
1582     p->aOp[i].cycles = 0;
1583   }
1584 #endif
1585 }
1586 
1587 /*
1588 ** Prepare a virtual machine for execution for the first time after
1589 ** creating the virtual machine.  This involves things such
1590 ** as allocating stack space and initializing the program counter.
1591 ** After the VDBE has be prepped, it can be executed by one or more
1592 ** calls to sqlite3VdbeExec().
1593 **
1594 ** This function may be called exact once on a each virtual machine.
1595 ** After this routine is called the VM has been "packaged" and is ready
1596 ** to run.  After this routine is called, futher calls to
1597 ** sqlite3VdbeAddOp() functions are prohibited.  This routine disconnects
1598 ** the Vdbe from the Parse object that helped generate it so that the
1599 ** the Vdbe becomes an independent entity and the Parse object can be
1600 ** destroyed.
1601 **
1602 ** Use the sqlite3VdbeRewind() procedure to restore a virtual machine back
1603 ** to its initial state after it has been run.
1604 */
1605 void sqlite3VdbeMakeReady(
1606   Vdbe *p,                       /* The VDBE */
1607   Parse *pParse                  /* Parsing context */
1608 ){
1609   sqlite3 *db;                   /* The database connection */
1610   int nVar;                      /* Number of parameters */
1611   int nMem;                      /* Number of VM memory registers */
1612   int nCursor;                   /* Number of cursors required */
1613   int nArg;                      /* Number of arguments in subprograms */
1614   int nOnce;                     /* Number of OP_Once instructions */
1615   int n;                         /* Loop counter */
1616   u8 *zCsr;                      /* Memory available for allocation */
1617   u8 *zEnd;                      /* First byte past allocated memory */
1618   int nByte;                     /* How much extra memory is needed */
1619 
1620   assert( p!=0 );
1621   assert( p->nOp>0 );
1622   assert( pParse!=0 );
1623   assert( p->magic==VDBE_MAGIC_INIT );
1624   assert( pParse==p->pParse );
1625   db = p->db;
1626   assert( db->mallocFailed==0 );
1627   nVar = pParse->nVar;
1628   nMem = pParse->nMem;
1629   nCursor = pParse->nTab;
1630   nArg = pParse->nMaxArg;
1631   nOnce = pParse->nOnce;
1632   if( nOnce==0 ) nOnce = 1; /* Ensure at least one byte in p->aOnceFlag[] */
1633 
1634   /* For each cursor required, also allocate a memory cell. Memory
1635   ** cells (nMem+1-nCursor)..nMem, inclusive, will never be used by
1636   ** the vdbe program. Instead they are used to allocate space for
1637   ** VdbeCursor/BtCursor structures. The blob of memory associated with
1638   ** cursor 0 is stored in memory cell nMem. Memory cell (nMem-1)
1639   ** stores the blob of memory associated with cursor 1, etc.
1640   **
1641   ** See also: allocateCursor().
1642   */
1643   nMem += nCursor;
1644 
1645   /* Allocate space for memory registers, SQL variables, VDBE cursors and
1646   ** an array to marshal SQL function arguments in.
1647   */
1648   zCsr = (u8*)&p->aOp[p->nOp];            /* Memory avaliable for allocation */
1649   zEnd = (u8*)&p->aOp[pParse->nOpAlloc];  /* First byte past end of zCsr[] */
1650 
1651   resolveP2Values(p, &nArg);
1652   p->usesStmtJournal = (u8)(pParse->isMultiWrite && pParse->mayAbort);
1653   if( pParse->explain && nMem<10 ){
1654     nMem = 10;
1655   }
1656   memset(zCsr, 0, zEnd-zCsr);
1657   zCsr += (zCsr - (u8*)0)&7;
1658   assert( EIGHT_BYTE_ALIGNMENT(zCsr) );
1659   p->expired = 0;
1660 
1661   /* Memory for registers, parameters, cursor, etc, is allocated in two
1662   ** passes.  On the first pass, we try to reuse unused space at the
1663   ** end of the opcode array.  If we are unable to satisfy all memory
1664   ** requirements by reusing the opcode array tail, then the second
1665   ** pass will fill in the rest using a fresh allocation.
1666   **
1667   ** This two-pass approach that reuses as much memory as possible from
1668   ** the leftover space at the end of the opcode array can significantly
1669   ** reduce the amount of memory held by a prepared statement.
1670   */
1671   do {
1672     nByte = 0;
1673     p->aMem = allocSpace(p->aMem, nMem*sizeof(Mem), &zCsr, zEnd, &nByte);
1674     p->aVar = allocSpace(p->aVar, nVar*sizeof(Mem), &zCsr, zEnd, &nByte);
1675     p->apArg = allocSpace(p->apArg, nArg*sizeof(Mem*), &zCsr, zEnd, &nByte);
1676     p->azVar = allocSpace(p->azVar, nVar*sizeof(char*), &zCsr, zEnd, &nByte);
1677     p->apCsr = allocSpace(p->apCsr, nCursor*sizeof(VdbeCursor*),
1678                           &zCsr, zEnd, &nByte);
1679     p->aOnceFlag = allocSpace(p->aOnceFlag, nOnce, &zCsr, zEnd, &nByte);
1680     if( nByte ){
1681       p->pFree = sqlite3DbMallocZero(db, nByte);
1682     }
1683     zCsr = p->pFree;
1684     zEnd = &zCsr[nByte];
1685   }while( nByte && !db->mallocFailed );
1686 
1687   p->nCursor = nCursor;
1688   p->nOnceFlag = nOnce;
1689   if( p->aVar ){
1690     p->nVar = (ynVar)nVar;
1691     for(n=0; n<nVar; n++){
1692       p->aVar[n].flags = MEM_Null;
1693       p->aVar[n].db = db;
1694     }
1695   }
1696   if( p->azVar ){
1697     p->nzVar = pParse->nzVar;
1698     memcpy(p->azVar, pParse->azVar, p->nzVar*sizeof(p->azVar[0]));
1699     memset(pParse->azVar, 0, pParse->nzVar*sizeof(pParse->azVar[0]));
1700   }
1701   if( p->aMem ){
1702     p->aMem--;                      /* aMem[] goes from 1..nMem */
1703     p->nMem = nMem;                 /*       not from 0..nMem-1 */
1704     for(n=1; n<=nMem; n++){
1705       p->aMem[n].flags = MEM_Invalid;
1706       p->aMem[n].db = db;
1707     }
1708   }
1709   p->explain = pParse->explain;
1710   sqlite3VdbeRewind(p);
1711 }
1712 
1713 /*
1714 ** Close a VDBE cursor and release all the resources that cursor
1715 ** happens to hold.
1716 */
1717 void sqlite3VdbeFreeCursor(Vdbe *p, VdbeCursor *pCx){
1718   if( pCx==0 ){
1719     return;
1720   }
1721   sqlite3VdbeSorterClose(p->db, pCx);
1722   if( pCx->pBt ){
1723     sqlite3BtreeClose(pCx->pBt);
1724     /* The pCx->pCursor will be close automatically, if it exists, by
1725     ** the call above. */
1726   }else if( pCx->pCursor ){
1727     sqlite3BtreeCloseCursor(pCx->pCursor);
1728   }
1729 #ifndef SQLITE_OMIT_VIRTUALTABLE
1730   if( pCx->pVtabCursor ){
1731     sqlite3_vtab_cursor *pVtabCursor = pCx->pVtabCursor;
1732     const sqlite3_module *pModule = pVtabCursor->pVtab->pModule;
1733     p->inVtabMethod = 1;
1734     pModule->xClose(pVtabCursor);
1735     p->inVtabMethod = 0;
1736   }
1737 #endif
1738 }
1739 
1740 /*
1741 ** Copy the values stored in the VdbeFrame structure to its Vdbe. This
1742 ** is used, for example, when a trigger sub-program is halted to restore
1743 ** control to the main program.
1744 */
1745 int sqlite3VdbeFrameRestore(VdbeFrame *pFrame){
1746   Vdbe *v = pFrame->v;
1747   v->aOnceFlag = pFrame->aOnceFlag;
1748   v->nOnceFlag = pFrame->nOnceFlag;
1749   v->aOp = pFrame->aOp;
1750   v->nOp = pFrame->nOp;
1751   v->aMem = pFrame->aMem;
1752   v->nMem = pFrame->nMem;
1753   v->apCsr = pFrame->apCsr;
1754   v->nCursor = pFrame->nCursor;
1755   v->db->lastRowid = pFrame->lastRowid;
1756   v->nChange = pFrame->nChange;
1757   return pFrame->pc;
1758 }
1759 
1760 /*
1761 ** Close all cursors.
1762 **
1763 ** Also release any dynamic memory held by the VM in the Vdbe.aMem memory
1764 ** cell array. This is necessary as the memory cell array may contain
1765 ** pointers to VdbeFrame objects, which may in turn contain pointers to
1766 ** open cursors.
1767 */
1768 static void closeAllCursors(Vdbe *p){
1769   if( p->pFrame ){
1770     VdbeFrame *pFrame;
1771     for(pFrame=p->pFrame; pFrame->pParent; pFrame=pFrame->pParent);
1772     sqlite3VdbeFrameRestore(pFrame);
1773   }
1774   p->pFrame = 0;
1775   p->nFrame = 0;
1776 
1777   if( p->apCsr ){
1778     int i;
1779     for(i=0; i<p->nCursor; i++){
1780       VdbeCursor *pC = p->apCsr[i];
1781       if( pC ){
1782         sqlite3VdbeFreeCursor(p, pC);
1783         p->apCsr[i] = 0;
1784       }
1785     }
1786   }
1787   if( p->aMem ){
1788     releaseMemArray(&p->aMem[1], p->nMem);
1789   }
1790   while( p->pDelFrame ){
1791     VdbeFrame *pDel = p->pDelFrame;
1792     p->pDelFrame = pDel->pParent;
1793     sqlite3VdbeFrameDelete(pDel);
1794   }
1795 
1796   /* Delete any auxdata allocations made by the VM */
1797   sqlite3VdbeDeleteAuxData(p, -1, 0);
1798   assert( p->pAuxData==0 );
1799 }
1800 
1801 /*
1802 ** Clean up the VM after execution.
1803 **
1804 ** This routine will automatically close any cursors, lists, and/or
1805 ** sorters that were left open.  It also deletes the values of
1806 ** variables in the aVar[] array.
1807 */
1808 static void Cleanup(Vdbe *p){
1809   sqlite3 *db = p->db;
1810 
1811 #ifdef SQLITE_DEBUG
1812   /* Execute assert() statements to ensure that the Vdbe.apCsr[] and
1813   ** Vdbe.aMem[] arrays have already been cleaned up.  */
1814   int i;
1815   if( p->apCsr ) for(i=0; i<p->nCursor; i++) assert( p->apCsr[i]==0 );
1816   if( p->aMem ){
1817     for(i=1; i<=p->nMem; i++) assert( p->aMem[i].flags==MEM_Invalid );
1818   }
1819 #endif
1820 
1821   sqlite3DbFree(db, p->zErrMsg);
1822   p->zErrMsg = 0;
1823   p->pResultSet = 0;
1824 }
1825 
1826 /*
1827 ** Set the number of result columns that will be returned by this SQL
1828 ** statement. This is now set at compile time, rather than during
1829 ** execution of the vdbe program so that sqlite3_column_count() can
1830 ** be called on an SQL statement before sqlite3_step().
1831 */
1832 void sqlite3VdbeSetNumCols(Vdbe *p, int nResColumn){
1833   Mem *pColName;
1834   int n;
1835   sqlite3 *db = p->db;
1836 
1837   releaseMemArray(p->aColName, p->nResColumn*COLNAME_N);
1838   sqlite3DbFree(db, p->aColName);
1839   n = nResColumn*COLNAME_N;
1840   p->nResColumn = (u16)nResColumn;
1841   p->aColName = pColName = (Mem*)sqlite3DbMallocZero(db, sizeof(Mem)*n );
1842   if( p->aColName==0 ) return;
1843   while( n-- > 0 ){
1844     pColName->flags = MEM_Null;
1845     pColName->db = p->db;
1846     pColName++;
1847   }
1848 }
1849 
1850 /*
1851 ** Set the name of the idx'th column to be returned by the SQL statement.
1852 ** zName must be a pointer to a nul terminated string.
1853 **
1854 ** This call must be made after a call to sqlite3VdbeSetNumCols().
1855 **
1856 ** The final parameter, xDel, must be one of SQLITE_DYNAMIC, SQLITE_STATIC
1857 ** or SQLITE_TRANSIENT. If it is SQLITE_DYNAMIC, then the buffer pointed
1858 ** to by zName will be freed by sqlite3DbFree() when the vdbe is destroyed.
1859 */
1860 int sqlite3VdbeSetColName(
1861   Vdbe *p,                         /* Vdbe being configured */
1862   int idx,                         /* Index of column zName applies to */
1863   int var,                         /* One of the COLNAME_* constants */
1864   const char *zName,               /* Pointer to buffer containing name */
1865   void (*xDel)(void*)              /* Memory management strategy for zName */
1866 ){
1867   int rc;
1868   Mem *pColName;
1869   assert( idx<p->nResColumn );
1870   assert( var<COLNAME_N );
1871   if( p->db->mallocFailed ){
1872     assert( !zName || xDel!=SQLITE_DYNAMIC );
1873     return SQLITE_NOMEM;
1874   }
1875   assert( p->aColName!=0 );
1876   pColName = &(p->aColName[idx+var*p->nResColumn]);
1877   rc = sqlite3VdbeMemSetStr(pColName, zName, -1, SQLITE_UTF8, xDel);
1878   assert( rc!=0 || !zName || (pColName->flags&MEM_Term)!=0 );
1879   return rc;
1880 }
1881 
1882 /*
1883 ** A read or write transaction may or may not be active on database handle
1884 ** db. If a transaction is active, commit it. If there is a
1885 ** write-transaction spanning more than one database file, this routine
1886 ** takes care of the master journal trickery.
1887 */
1888 static int vdbeCommit(sqlite3 *db, Vdbe *p){
1889   int i;
1890   int nTrans = 0;  /* Number of databases with an active write-transaction */
1891   int rc = SQLITE_OK;
1892   int needXcommit = 0;
1893 
1894 #ifdef SQLITE_OMIT_VIRTUALTABLE
1895   /* With this option, sqlite3VtabSync() is defined to be simply
1896   ** SQLITE_OK so p is not used.
1897   */
1898   UNUSED_PARAMETER(p);
1899 #endif
1900 
1901   /* Before doing anything else, call the xSync() callback for any
1902   ** virtual module tables written in this transaction. This has to
1903   ** be done before determining whether a master journal file is
1904   ** required, as an xSync() callback may add an attached database
1905   ** to the transaction.
1906   */
1907   rc = sqlite3VtabSync(db, p);
1908 
1909   /* This loop determines (a) if the commit hook should be invoked and
1910   ** (b) how many database files have open write transactions, not
1911   ** including the temp database. (b) is important because if more than
1912   ** one database file has an open write transaction, a master journal
1913   ** file is required for an atomic commit.
1914   */
1915   for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
1916     Btree *pBt = db->aDb[i].pBt;
1917     if( sqlite3BtreeIsInTrans(pBt) ){
1918       needXcommit = 1;
1919       if( i!=1 ) nTrans++;
1920       sqlite3BtreeEnter(pBt);
1921       rc = sqlite3PagerExclusiveLock(sqlite3BtreePager(pBt));
1922       sqlite3BtreeLeave(pBt);
1923     }
1924   }
1925   if( rc!=SQLITE_OK ){
1926     return rc;
1927   }
1928 
1929   /* If there are any write-transactions at all, invoke the commit hook */
1930   if( needXcommit && db->xCommitCallback ){
1931     rc = db->xCommitCallback(db->pCommitArg);
1932     if( rc ){
1933       return SQLITE_CONSTRAINT_COMMITHOOK;
1934     }
1935   }
1936 
1937   /* The simple case - no more than one database file (not counting the
1938   ** TEMP database) has a transaction active.   There is no need for the
1939   ** master-journal.
1940   **
1941   ** If the return value of sqlite3BtreeGetFilename() is a zero length
1942   ** string, it means the main database is :memory: or a temp file.  In
1943   ** that case we do not support atomic multi-file commits, so use the
1944   ** simple case then too.
1945   */
1946   if( 0==sqlite3Strlen30(sqlite3BtreeGetFilename(db->aDb[0].pBt))
1947    || nTrans<=1
1948   ){
1949     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
1950       Btree *pBt = db->aDb[i].pBt;
1951       if( pBt ){
1952         rc = sqlite3BtreeCommitPhaseOne(pBt, 0);
1953       }
1954     }
1955 
1956     /* Do the commit only if all databases successfully complete phase 1.
1957     ** If one of the BtreeCommitPhaseOne() calls fails, this indicates an
1958     ** IO error while deleting or truncating a journal file. It is unlikely,
1959     ** but could happen. In this case abandon processing and return the error.
1960     */
1961     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
1962       Btree *pBt = db->aDb[i].pBt;
1963       if( pBt ){
1964         rc = sqlite3BtreeCommitPhaseTwo(pBt, 0);
1965       }
1966     }
1967     if( rc==SQLITE_OK ){
1968       sqlite3VtabCommit(db);
1969     }
1970   }
1971 
1972   /* The complex case - There is a multi-file write-transaction active.
1973   ** This requires a master journal file to ensure the transaction is
1974   ** committed atomicly.
1975   */
1976 #ifndef SQLITE_OMIT_DISKIO
1977   else{
1978     sqlite3_vfs *pVfs = db->pVfs;
1979     int needSync = 0;
1980     char *zMaster = 0;   /* File-name for the master journal */
1981     char const *zMainFile = sqlite3BtreeGetFilename(db->aDb[0].pBt);
1982     sqlite3_file *pMaster = 0;
1983     i64 offset = 0;
1984     int res;
1985     int retryCount = 0;
1986     int nMainFile;
1987 
1988     /* Select a master journal file name */
1989     nMainFile = sqlite3Strlen30(zMainFile);
1990     zMaster = sqlite3MPrintf(db, "%s-mjXXXXXX9XXz", zMainFile);
1991     if( zMaster==0 ) return SQLITE_NOMEM;
1992     do {
1993       u32 iRandom;
1994       if( retryCount ){
1995         if( retryCount>100 ){
1996           sqlite3_log(SQLITE_FULL, "MJ delete: %s", zMaster);
1997           sqlite3OsDelete(pVfs, zMaster, 0);
1998           break;
1999         }else if( retryCount==1 ){
2000           sqlite3_log(SQLITE_FULL, "MJ collide: %s", zMaster);
2001         }
2002       }
2003       retryCount++;
2004       sqlite3_randomness(sizeof(iRandom), &iRandom);
2005       sqlite3_snprintf(13, &zMaster[nMainFile], "-mj%06X9%02X",
2006                                (iRandom>>8)&0xffffff, iRandom&0xff);
2007       /* The antipenultimate character of the master journal name must
2008       ** be "9" to avoid name collisions when using 8+3 filenames. */
2009       assert( zMaster[sqlite3Strlen30(zMaster)-3]=='9' );
2010       sqlite3FileSuffix3(zMainFile, zMaster);
2011       rc = sqlite3OsAccess(pVfs, zMaster, SQLITE_ACCESS_EXISTS, &res);
2012     }while( rc==SQLITE_OK && res );
2013     if( rc==SQLITE_OK ){
2014       /* Open the master journal. */
2015       rc = sqlite3OsOpenMalloc(pVfs, zMaster, &pMaster,
2016           SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE|
2017           SQLITE_OPEN_EXCLUSIVE|SQLITE_OPEN_MASTER_JOURNAL, 0
2018       );
2019     }
2020     if( rc!=SQLITE_OK ){
2021       sqlite3DbFree(db, zMaster);
2022       return rc;
2023     }
2024 
2025     /* Write the name of each database file in the transaction into the new
2026     ** master journal file. If an error occurs at this point close
2027     ** and delete the master journal file. All the individual journal files
2028     ** still have 'null' as the master journal pointer, so they will roll
2029     ** back independently if a failure occurs.
2030     */
2031     for(i=0; i<db->nDb; i++){
2032       Btree *pBt = db->aDb[i].pBt;
2033       if( sqlite3BtreeIsInTrans(pBt) ){
2034         char const *zFile = sqlite3BtreeGetJournalname(pBt);
2035         if( zFile==0 ){
2036           continue;  /* Ignore TEMP and :memory: databases */
2037         }
2038         assert( zFile[0]!=0 );
2039         if( !needSync && !sqlite3BtreeSyncDisabled(pBt) ){
2040           needSync = 1;
2041         }
2042         rc = sqlite3OsWrite(pMaster, zFile, sqlite3Strlen30(zFile)+1, offset);
2043         offset += sqlite3Strlen30(zFile)+1;
2044         if( rc!=SQLITE_OK ){
2045           sqlite3OsCloseFree(pMaster);
2046           sqlite3OsDelete(pVfs, zMaster, 0);
2047           sqlite3DbFree(db, zMaster);
2048           return rc;
2049         }
2050       }
2051     }
2052 
2053     /* Sync the master journal file. If the IOCAP_SEQUENTIAL device
2054     ** flag is set this is not required.
2055     */
2056     if( needSync
2057      && 0==(sqlite3OsDeviceCharacteristics(pMaster)&SQLITE_IOCAP_SEQUENTIAL)
2058      && SQLITE_OK!=(rc = sqlite3OsSync(pMaster, SQLITE_SYNC_NORMAL))
2059     ){
2060       sqlite3OsCloseFree(pMaster);
2061       sqlite3OsDelete(pVfs, zMaster, 0);
2062       sqlite3DbFree(db, zMaster);
2063       return rc;
2064     }
2065 
2066     /* Sync all the db files involved in the transaction. The same call
2067     ** sets the master journal pointer in each individual journal. If
2068     ** an error occurs here, do not delete the master journal file.
2069     **
2070     ** If the error occurs during the first call to
2071     ** sqlite3BtreeCommitPhaseOne(), then there is a chance that the
2072     ** master journal file will be orphaned. But we cannot delete it,
2073     ** in case the master journal file name was written into the journal
2074     ** file before the failure occurred.
2075     */
2076     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2077       Btree *pBt = db->aDb[i].pBt;
2078       if( pBt ){
2079         rc = sqlite3BtreeCommitPhaseOne(pBt, zMaster);
2080       }
2081     }
2082     sqlite3OsCloseFree(pMaster);
2083     assert( rc!=SQLITE_BUSY );
2084     if( rc!=SQLITE_OK ){
2085       sqlite3DbFree(db, zMaster);
2086       return rc;
2087     }
2088 
2089     /* Delete the master journal file. This commits the transaction. After
2090     ** doing this the directory is synced again before any individual
2091     ** transaction files are deleted.
2092     */
2093     rc = sqlite3OsDelete(pVfs, zMaster, 1);
2094     sqlite3DbFree(db, zMaster);
2095     zMaster = 0;
2096     if( rc ){
2097       return rc;
2098     }
2099 
2100     /* All files and directories have already been synced, so the following
2101     ** calls to sqlite3BtreeCommitPhaseTwo() are only closing files and
2102     ** deleting or truncating journals. If something goes wrong while
2103     ** this is happening we don't really care. The integrity of the
2104     ** transaction is already guaranteed, but some stray 'cold' journals
2105     ** may be lying around. Returning an error code won't help matters.
2106     */
2107     disable_simulated_io_errors();
2108     sqlite3BeginBenignMalloc();
2109     for(i=0; i<db->nDb; i++){
2110       Btree *pBt = db->aDb[i].pBt;
2111       if( pBt ){
2112         sqlite3BtreeCommitPhaseTwo(pBt, 1);
2113       }
2114     }
2115     sqlite3EndBenignMalloc();
2116     enable_simulated_io_errors();
2117 
2118     sqlite3VtabCommit(db);
2119   }
2120 #endif
2121 
2122   return rc;
2123 }
2124 
2125 /*
2126 ** This routine checks that the sqlite3.nVdbeActive count variable
2127 ** matches the number of vdbe's in the list sqlite3.pVdbe that are
2128 ** currently active. An assertion fails if the two counts do not match.
2129 ** This is an internal self-check only - it is not an essential processing
2130 ** step.
2131 **
2132 ** This is a no-op if NDEBUG is defined.
2133 */
2134 #ifndef NDEBUG
2135 static void checkActiveVdbeCnt(sqlite3 *db){
2136   Vdbe *p;
2137   int cnt = 0;
2138   int nWrite = 0;
2139   int nRead = 0;
2140   p = db->pVdbe;
2141   while( p ){
2142     if( p->magic==VDBE_MAGIC_RUN && p->pc>=0 ){
2143       cnt++;
2144       if( p->readOnly==0 ) nWrite++;
2145       if( p->bIsReader ) nRead++;
2146     }
2147     p = p->pNext;
2148   }
2149   assert( cnt==db->nVdbeActive );
2150   assert( nWrite==db->nVdbeWrite );
2151   assert( nRead==db->nVdbeRead );
2152 }
2153 #else
2154 #define checkActiveVdbeCnt(x)
2155 #endif
2156 
2157 /*
2158 ** If the Vdbe passed as the first argument opened a statement-transaction,
2159 ** close it now. Argument eOp must be either SAVEPOINT_ROLLBACK or
2160 ** SAVEPOINT_RELEASE. If it is SAVEPOINT_ROLLBACK, then the statement
2161 ** transaction is rolled back. If eOp is SAVEPOINT_RELEASE, then the
2162 ** statement transaction is committed.
2163 **
2164 ** If an IO error occurs, an SQLITE_IOERR_XXX error code is returned.
2165 ** Otherwise SQLITE_OK.
2166 */
2167 int sqlite3VdbeCloseStatement(Vdbe *p, int eOp){
2168   sqlite3 *const db = p->db;
2169   int rc = SQLITE_OK;
2170 
2171   /* If p->iStatement is greater than zero, then this Vdbe opened a
2172   ** statement transaction that should be closed here. The only exception
2173   ** is that an IO error may have occurred, causing an emergency rollback.
2174   ** In this case (db->nStatement==0), and there is nothing to do.
2175   */
2176   if( db->nStatement && p->iStatement ){
2177     int i;
2178     const int iSavepoint = p->iStatement-1;
2179 
2180     assert( eOp==SAVEPOINT_ROLLBACK || eOp==SAVEPOINT_RELEASE);
2181     assert( db->nStatement>0 );
2182     assert( p->iStatement==(db->nStatement+db->nSavepoint) );
2183 
2184     for(i=0; i<db->nDb; i++){
2185       int rc2 = SQLITE_OK;
2186       Btree *pBt = db->aDb[i].pBt;
2187       if( pBt ){
2188         if( eOp==SAVEPOINT_ROLLBACK ){
2189           rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_ROLLBACK, iSavepoint);
2190         }
2191         if( rc2==SQLITE_OK ){
2192           rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_RELEASE, iSavepoint);
2193         }
2194         if( rc==SQLITE_OK ){
2195           rc = rc2;
2196         }
2197       }
2198     }
2199     db->nStatement--;
2200     p->iStatement = 0;
2201 
2202     if( rc==SQLITE_OK ){
2203       if( eOp==SAVEPOINT_ROLLBACK ){
2204         rc = sqlite3VtabSavepoint(db, SAVEPOINT_ROLLBACK, iSavepoint);
2205       }
2206       if( rc==SQLITE_OK ){
2207         rc = sqlite3VtabSavepoint(db, SAVEPOINT_RELEASE, iSavepoint);
2208       }
2209     }
2210 
2211     /* If the statement transaction is being rolled back, also restore the
2212     ** database handles deferred constraint counter to the value it had when
2213     ** the statement transaction was opened.  */
2214     if( eOp==SAVEPOINT_ROLLBACK ){
2215       db->nDeferredCons = p->nStmtDefCons;
2216       db->nDeferredImmCons = p->nStmtDefImmCons;
2217     }
2218   }
2219   return rc;
2220 }
2221 
2222 /*
2223 ** This function is called when a transaction opened by the database
2224 ** handle associated with the VM passed as an argument is about to be
2225 ** committed. If there are outstanding deferred foreign key constraint
2226 ** violations, return SQLITE_ERROR. Otherwise, SQLITE_OK.
2227 **
2228 ** If there are outstanding FK violations and this function returns
2229 ** SQLITE_ERROR, set the result of the VM to SQLITE_CONSTRAINT_FOREIGNKEY
2230 ** and write an error message to it. Then return SQLITE_ERROR.
2231 */
2232 #ifndef SQLITE_OMIT_FOREIGN_KEY
2233 int sqlite3VdbeCheckFk(Vdbe *p, int deferred){
2234   sqlite3 *db = p->db;
2235   if( (deferred && (db->nDeferredCons+db->nDeferredImmCons)>0)
2236    || (!deferred && p->nFkConstraint>0)
2237   ){
2238     p->rc = SQLITE_CONSTRAINT_FOREIGNKEY;
2239     p->errorAction = OE_Abort;
2240     sqlite3SetString(&p->zErrMsg, db, "FOREIGN KEY constraint failed");
2241     return SQLITE_ERROR;
2242   }
2243   return SQLITE_OK;
2244 }
2245 #endif
2246 
2247 /*
2248 ** This routine is called the when a VDBE tries to halt.  If the VDBE
2249 ** has made changes and is in autocommit mode, then commit those
2250 ** changes.  If a rollback is needed, then do the rollback.
2251 **
2252 ** This routine is the only way to move the state of a VM from
2253 ** SQLITE_MAGIC_RUN to SQLITE_MAGIC_HALT.  It is harmless to
2254 ** call this on a VM that is in the SQLITE_MAGIC_HALT state.
2255 **
2256 ** Return an error code.  If the commit could not complete because of
2257 ** lock contention, return SQLITE_BUSY.  If SQLITE_BUSY is returned, it
2258 ** means the close did not happen and needs to be repeated.
2259 */
2260 int sqlite3VdbeHalt(Vdbe *p){
2261   int rc;                         /* Used to store transient return codes */
2262   sqlite3 *db = p->db;
2263 
2264   /* This function contains the logic that determines if a statement or
2265   ** transaction will be committed or rolled back as a result of the
2266   ** execution of this virtual machine.
2267   **
2268   ** If any of the following errors occur:
2269   **
2270   **     SQLITE_NOMEM
2271   **     SQLITE_IOERR
2272   **     SQLITE_FULL
2273   **     SQLITE_INTERRUPT
2274   **
2275   ** Then the internal cache might have been left in an inconsistent
2276   ** state.  We need to rollback the statement transaction, if there is
2277   ** one, or the complete transaction if there is no statement transaction.
2278   */
2279 
2280   if( p->db->mallocFailed ){
2281     p->rc = SQLITE_NOMEM;
2282   }
2283   if( p->aOnceFlag ) memset(p->aOnceFlag, 0, p->nOnceFlag);
2284   closeAllCursors(p);
2285   if( p->magic!=VDBE_MAGIC_RUN ){
2286     return SQLITE_OK;
2287   }
2288   checkActiveVdbeCnt(db);
2289 
2290   /* No commit or rollback needed if the program never started or if the
2291   ** SQL statement does not read or write a database file.  */
2292   if( p->pc>=0 && p->bIsReader ){
2293     int mrc;   /* Primary error code from p->rc */
2294     int eStatementOp = 0;
2295     int isSpecialError;            /* Set to true if a 'special' error */
2296 
2297     /* Lock all btrees used by the statement */
2298     sqlite3VdbeEnter(p);
2299 
2300     /* Check for one of the special errors */
2301     mrc = p->rc & 0xff;
2302     assert( p->rc!=SQLITE_IOERR_BLOCKED );  /* This error no longer exists */
2303     isSpecialError = mrc==SQLITE_NOMEM || mrc==SQLITE_IOERR
2304                      || mrc==SQLITE_INTERRUPT || mrc==SQLITE_FULL;
2305     if( isSpecialError ){
2306       /* If the query was read-only and the error code is SQLITE_INTERRUPT,
2307       ** no rollback is necessary. Otherwise, at least a savepoint
2308       ** transaction must be rolled back to restore the database to a
2309       ** consistent state.
2310       **
2311       ** Even if the statement is read-only, it is important to perform
2312       ** a statement or transaction rollback operation. If the error
2313       ** occurred while writing to the journal, sub-journal or database
2314       ** file as part of an effort to free up cache space (see function
2315       ** pagerStress() in pager.c), the rollback is required to restore
2316       ** the pager to a consistent state.
2317       */
2318       if( !p->readOnly || mrc!=SQLITE_INTERRUPT ){
2319         if( (mrc==SQLITE_NOMEM || mrc==SQLITE_FULL) && p->usesStmtJournal ){
2320           eStatementOp = SAVEPOINT_ROLLBACK;
2321         }else{
2322           /* We are forced to roll back the active transaction. Before doing
2323           ** so, abort any other statements this handle currently has active.
2324           */
2325           sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
2326           sqlite3CloseSavepoints(db);
2327           db->autoCommit = 1;
2328         }
2329       }
2330     }
2331 
2332     /* Check for immediate foreign key violations. */
2333     if( p->rc==SQLITE_OK ){
2334       sqlite3VdbeCheckFk(p, 0);
2335     }
2336 
2337     /* If the auto-commit flag is set and this is the only active writer
2338     ** VM, then we do either a commit or rollback of the current transaction.
2339     **
2340     ** Note: This block also runs if one of the special errors handled
2341     ** above has occurred.
2342     */
2343     if( !sqlite3VtabInSync(db)
2344      && db->autoCommit
2345      && db->nVdbeWrite==(p->readOnly==0)
2346     ){
2347       if( p->rc==SQLITE_OK || (p->errorAction==OE_Fail && !isSpecialError) ){
2348         rc = sqlite3VdbeCheckFk(p, 1);
2349         if( rc!=SQLITE_OK ){
2350           if( NEVER(p->readOnly) ){
2351             sqlite3VdbeLeave(p);
2352             return SQLITE_ERROR;
2353           }
2354           rc = SQLITE_CONSTRAINT_FOREIGNKEY;
2355         }else{
2356           /* The auto-commit flag is true, the vdbe program was successful
2357           ** or hit an 'OR FAIL' constraint and there are no deferred foreign
2358           ** key constraints to hold up the transaction. This means a commit
2359           ** is required. */
2360           rc = vdbeCommit(db, p);
2361         }
2362         if( rc==SQLITE_BUSY && p->readOnly ){
2363           sqlite3VdbeLeave(p);
2364           return SQLITE_BUSY;
2365         }else if( rc!=SQLITE_OK ){
2366           p->rc = rc;
2367           sqlite3RollbackAll(db, SQLITE_OK);
2368         }else{
2369           db->nDeferredCons = 0;
2370           db->nDeferredImmCons = 0;
2371           db->flags &= ~SQLITE_DeferFKs;
2372           sqlite3CommitInternalChanges(db);
2373         }
2374       }else{
2375         sqlite3RollbackAll(db, SQLITE_OK);
2376       }
2377       db->nStatement = 0;
2378     }else if( eStatementOp==0 ){
2379       if( p->rc==SQLITE_OK || p->errorAction==OE_Fail ){
2380         eStatementOp = SAVEPOINT_RELEASE;
2381       }else if( p->errorAction==OE_Abort ){
2382         eStatementOp = SAVEPOINT_ROLLBACK;
2383       }else{
2384         sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
2385         sqlite3CloseSavepoints(db);
2386         db->autoCommit = 1;
2387       }
2388     }
2389 
2390     /* If eStatementOp is non-zero, then a statement transaction needs to
2391     ** be committed or rolled back. Call sqlite3VdbeCloseStatement() to
2392     ** do so. If this operation returns an error, and the current statement
2393     ** error code is SQLITE_OK or SQLITE_CONSTRAINT, then promote the
2394     ** current statement error code.
2395     */
2396     if( eStatementOp ){
2397       rc = sqlite3VdbeCloseStatement(p, eStatementOp);
2398       if( rc ){
2399         if( p->rc==SQLITE_OK || (p->rc&0xff)==SQLITE_CONSTRAINT ){
2400           p->rc = rc;
2401           sqlite3DbFree(db, p->zErrMsg);
2402           p->zErrMsg = 0;
2403         }
2404         sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
2405         sqlite3CloseSavepoints(db);
2406         db->autoCommit = 1;
2407       }
2408     }
2409 
2410     /* If this was an INSERT, UPDATE or DELETE and no statement transaction
2411     ** has been rolled back, update the database connection change-counter.
2412     */
2413     if( p->changeCntOn ){
2414       if( eStatementOp!=SAVEPOINT_ROLLBACK ){
2415         sqlite3VdbeSetChanges(db, p->nChange);
2416       }else{
2417         sqlite3VdbeSetChanges(db, 0);
2418       }
2419       p->nChange = 0;
2420     }
2421 
2422     /* Release the locks */
2423     sqlite3VdbeLeave(p);
2424   }
2425 
2426   /* We have successfully halted and closed the VM.  Record this fact. */
2427   if( p->pc>=0 ){
2428     db->nVdbeActive--;
2429     if( !p->readOnly ) db->nVdbeWrite--;
2430     if( p->bIsReader ) db->nVdbeRead--;
2431     assert( db->nVdbeActive>=db->nVdbeRead );
2432     assert( db->nVdbeRead>=db->nVdbeWrite );
2433     assert( db->nVdbeWrite>=0 );
2434   }
2435   p->magic = VDBE_MAGIC_HALT;
2436   checkActiveVdbeCnt(db);
2437   if( p->db->mallocFailed ){
2438     p->rc = SQLITE_NOMEM;
2439   }
2440 
2441   /* If the auto-commit flag is set to true, then any locks that were held
2442   ** by connection db have now been released. Call sqlite3ConnectionUnlocked()
2443   ** to invoke any required unlock-notify callbacks.
2444   */
2445   if( db->autoCommit ){
2446     sqlite3ConnectionUnlocked(db);
2447   }
2448 
2449   assert( db->nVdbeActive>0 || db->autoCommit==0 || db->nStatement==0 );
2450   return (p->rc==SQLITE_BUSY ? SQLITE_BUSY : SQLITE_OK);
2451 }
2452 
2453 
2454 /*
2455 ** Each VDBE holds the result of the most recent sqlite3_step() call
2456 ** in p->rc.  This routine sets that result back to SQLITE_OK.
2457 */
2458 void sqlite3VdbeResetStepResult(Vdbe *p){
2459   p->rc = SQLITE_OK;
2460 }
2461 
2462 /*
2463 ** Copy the error code and error message belonging to the VDBE passed
2464 ** as the first argument to its database handle (so that they will be
2465 ** returned by calls to sqlite3_errcode() and sqlite3_errmsg()).
2466 **
2467 ** This function does not clear the VDBE error code or message, just
2468 ** copies them to the database handle.
2469 */
2470 int sqlite3VdbeTransferError(Vdbe *p){
2471   sqlite3 *db = p->db;
2472   int rc = p->rc;
2473   if( p->zErrMsg ){
2474     u8 mallocFailed = db->mallocFailed;
2475     sqlite3BeginBenignMalloc();
2476     if( db->pErr==0 ) db->pErr = sqlite3ValueNew(db);
2477     sqlite3ValueSetStr(db->pErr, -1, p->zErrMsg, SQLITE_UTF8, SQLITE_TRANSIENT);
2478     sqlite3EndBenignMalloc();
2479     db->mallocFailed = mallocFailed;
2480     db->errCode = rc;
2481   }else{
2482     sqlite3Error(db, rc, 0);
2483   }
2484   return rc;
2485 }
2486 
2487 #ifdef SQLITE_ENABLE_SQLLOG
2488 /*
2489 ** If an SQLITE_CONFIG_SQLLOG hook is registered and the VM has been run,
2490 ** invoke it.
2491 */
2492 static void vdbeInvokeSqllog(Vdbe *v){
2493   if( sqlite3GlobalConfig.xSqllog && v->rc==SQLITE_OK && v->zSql && v->pc>=0 ){
2494     char *zExpanded = sqlite3VdbeExpandSql(v, v->zSql);
2495     assert( v->db->init.busy==0 );
2496     if( zExpanded ){
2497       sqlite3GlobalConfig.xSqllog(
2498           sqlite3GlobalConfig.pSqllogArg, v->db, zExpanded, 1
2499       );
2500       sqlite3DbFree(v->db, zExpanded);
2501     }
2502   }
2503 }
2504 #else
2505 # define vdbeInvokeSqllog(x)
2506 #endif
2507 
2508 /*
2509 ** Clean up a VDBE after execution but do not delete the VDBE just yet.
2510 ** Write any error messages into *pzErrMsg.  Return the result code.
2511 **
2512 ** After this routine is run, the VDBE should be ready to be executed
2513 ** again.
2514 **
2515 ** To look at it another way, this routine resets the state of the
2516 ** virtual machine from VDBE_MAGIC_RUN or VDBE_MAGIC_HALT back to
2517 ** VDBE_MAGIC_INIT.
2518 */
2519 int sqlite3VdbeReset(Vdbe *p){
2520   sqlite3 *db;
2521   db = p->db;
2522 
2523   /* If the VM did not run to completion or if it encountered an
2524   ** error, then it might not have been halted properly.  So halt
2525   ** it now.
2526   */
2527   sqlite3VdbeHalt(p);
2528 
2529   /* If the VDBE has be run even partially, then transfer the error code
2530   ** and error message from the VDBE into the main database structure.  But
2531   ** if the VDBE has just been set to run but has not actually executed any
2532   ** instructions yet, leave the main database error information unchanged.
2533   */
2534   if( p->pc>=0 ){
2535     vdbeInvokeSqllog(p);
2536     sqlite3VdbeTransferError(p);
2537     sqlite3DbFree(db, p->zErrMsg);
2538     p->zErrMsg = 0;
2539     if( p->runOnlyOnce ) p->expired = 1;
2540   }else if( p->rc && p->expired ){
2541     /* The expired flag was set on the VDBE before the first call
2542     ** to sqlite3_step(). For consistency (since sqlite3_step() was
2543     ** called), set the database error in this case as well.
2544     */
2545     sqlite3Error(db, p->rc, p->zErrMsg ? "%s" : 0, p->zErrMsg);
2546     sqlite3DbFree(db, p->zErrMsg);
2547     p->zErrMsg = 0;
2548   }
2549 
2550   /* Reclaim all memory used by the VDBE
2551   */
2552   Cleanup(p);
2553 
2554   /* Save profiling information from this VDBE run.
2555   */
2556 #ifdef VDBE_PROFILE
2557   {
2558     FILE *out = fopen("vdbe_profile.out", "a");
2559     if( out ){
2560       int i;
2561       fprintf(out, "---- ");
2562       for(i=0; i<p->nOp; i++){
2563         fprintf(out, "%02x", p->aOp[i].opcode);
2564       }
2565       fprintf(out, "\n");
2566       for(i=0; i<p->nOp; i++){
2567         fprintf(out, "%6d %10lld %8lld ",
2568            p->aOp[i].cnt,
2569            p->aOp[i].cycles,
2570            p->aOp[i].cnt>0 ? p->aOp[i].cycles/p->aOp[i].cnt : 0
2571         );
2572         sqlite3VdbePrintOp(out, i, &p->aOp[i]);
2573       }
2574       fclose(out);
2575     }
2576   }
2577 #endif
2578   p->iCurrentTime = 0;
2579   p->magic = VDBE_MAGIC_INIT;
2580   return p->rc & db->errMask;
2581 }
2582 
2583 /*
2584 ** Clean up and delete a VDBE after execution.  Return an integer which is
2585 ** the result code.  Write any error message text into *pzErrMsg.
2586 */
2587 int sqlite3VdbeFinalize(Vdbe *p){
2588   int rc = SQLITE_OK;
2589   if( p->magic==VDBE_MAGIC_RUN || p->magic==VDBE_MAGIC_HALT ){
2590     rc = sqlite3VdbeReset(p);
2591     assert( (rc & p->db->errMask)==rc );
2592   }
2593   sqlite3VdbeDelete(p);
2594   return rc;
2595 }
2596 
2597 /*
2598 ** If parameter iOp is less than zero, then invoke the destructor for
2599 ** all auxiliary data pointers currently cached by the VM passed as
2600 ** the first argument.
2601 **
2602 ** Or, if iOp is greater than or equal to zero, then the destructor is
2603 ** only invoked for those auxiliary data pointers created by the user
2604 ** function invoked by the OP_Function opcode at instruction iOp of
2605 ** VM pVdbe, and only then if:
2606 **
2607 **    * the associated function parameter is the 32nd or later (counting
2608 **      from left to right), or
2609 **
2610 **    * the corresponding bit in argument mask is clear (where the first
2611 **      function parameter corrsponds to bit 0 etc.).
2612 */
2613 void sqlite3VdbeDeleteAuxData(Vdbe *pVdbe, int iOp, int mask){
2614   AuxData **pp = &pVdbe->pAuxData;
2615   while( *pp ){
2616     AuxData *pAux = *pp;
2617     if( (iOp<0)
2618      || (pAux->iOp==iOp && (pAux->iArg>31 || !(mask & MASKBIT32(pAux->iArg))))
2619     ){
2620       testcase( pAux->iArg==31 );
2621       if( pAux->xDelete ){
2622         pAux->xDelete(pAux->pAux);
2623       }
2624       *pp = pAux->pNext;
2625       sqlite3DbFree(pVdbe->db, pAux);
2626     }else{
2627       pp= &pAux->pNext;
2628     }
2629   }
2630 }
2631 
2632 /*
2633 ** Free all memory associated with the Vdbe passed as the second argument,
2634 ** except for object itself, which is preserved.
2635 **
2636 ** The difference between this function and sqlite3VdbeDelete() is that
2637 ** VdbeDelete() also unlinks the Vdbe from the list of VMs associated with
2638 ** the database connection and frees the object itself.
2639 */
2640 void sqlite3VdbeClearObject(sqlite3 *db, Vdbe *p){
2641   SubProgram *pSub, *pNext;
2642   int i;
2643   assert( p->db==0 || p->db==db );
2644   releaseMemArray(p->aVar, p->nVar);
2645   releaseMemArray(p->aColName, p->nResColumn*COLNAME_N);
2646   for(pSub=p->pProgram; pSub; pSub=pNext){
2647     pNext = pSub->pNext;
2648     vdbeFreeOpArray(db, pSub->aOp, pSub->nOp);
2649     sqlite3DbFree(db, pSub);
2650   }
2651   for(i=p->nzVar-1; i>=0; i--) sqlite3DbFree(db, p->azVar[i]);
2652   vdbeFreeOpArray(db, p->aOp, p->nOp);
2653   sqlite3DbFree(db, p->aColName);
2654   sqlite3DbFree(db, p->zSql);
2655   sqlite3DbFree(db, p->pFree);
2656 #if defined(SQLITE_ENABLE_TREE_EXPLAIN)
2657   sqlite3DbFree(db, p->zExplain);
2658   sqlite3DbFree(db, p->pExplain);
2659 #endif
2660 }
2661 
2662 /*
2663 ** Delete an entire VDBE.
2664 */
2665 void sqlite3VdbeDelete(Vdbe *p){
2666   sqlite3 *db;
2667 
2668   if( NEVER(p==0) ) return;
2669   db = p->db;
2670   assert( sqlite3_mutex_held(db->mutex) );
2671   sqlite3VdbeClearObject(db, p);
2672   if( p->pPrev ){
2673     p->pPrev->pNext = p->pNext;
2674   }else{
2675     assert( db->pVdbe==p );
2676     db->pVdbe = p->pNext;
2677   }
2678   if( p->pNext ){
2679     p->pNext->pPrev = p->pPrev;
2680   }
2681   p->magic = VDBE_MAGIC_DEAD;
2682   p->db = 0;
2683   sqlite3DbFree(db, p);
2684 }
2685 
2686 /*
2687 ** Make sure the cursor p is ready to read or write the row to which it
2688 ** was last positioned.  Return an error code if an OOM fault or I/O error
2689 ** prevents us from positioning the cursor to its correct position.
2690 **
2691 ** If a MoveTo operation is pending on the given cursor, then do that
2692 ** MoveTo now.  If no move is pending, check to see if the row has been
2693 ** deleted out from under the cursor and if it has, mark the row as
2694 ** a NULL row.
2695 **
2696 ** If the cursor is already pointing to the correct row and that row has
2697 ** not been deleted out from under the cursor, then this routine is a no-op.
2698 */
2699 int sqlite3VdbeCursorMoveto(VdbeCursor *p){
2700   if( p->deferredMoveto ){
2701     int res, rc;
2702 #ifdef SQLITE_TEST
2703     extern int sqlite3_search_count;
2704 #endif
2705     assert( p->isTable );
2706     rc = sqlite3BtreeMovetoUnpacked(p->pCursor, 0, p->movetoTarget, 0, &res);
2707     if( rc ) return rc;
2708     p->lastRowid = p->movetoTarget;
2709     if( res!=0 ) return SQLITE_CORRUPT_BKPT;
2710     p->rowidIsValid = 1;
2711 #ifdef SQLITE_TEST
2712     sqlite3_search_count++;
2713 #endif
2714     p->deferredMoveto = 0;
2715     p->cacheStatus = CACHE_STALE;
2716   }else if( p->pCursor ){
2717     int hasMoved;
2718     int rc = sqlite3BtreeCursorHasMoved(p->pCursor, &hasMoved);
2719     if( rc ) return rc;
2720     if( hasMoved ){
2721       p->cacheStatus = CACHE_STALE;
2722       p->nullRow = 1;
2723     }
2724   }
2725   return SQLITE_OK;
2726 }
2727 
2728 /*
2729 ** The following functions:
2730 **
2731 ** sqlite3VdbeSerialType()
2732 ** sqlite3VdbeSerialTypeLen()
2733 ** sqlite3VdbeSerialLen()
2734 ** sqlite3VdbeSerialPut()
2735 ** sqlite3VdbeSerialGet()
2736 **
2737 ** encapsulate the code that serializes values for storage in SQLite
2738 ** data and index records. Each serialized value consists of a
2739 ** 'serial-type' and a blob of data. The serial type is an 8-byte unsigned
2740 ** integer, stored as a varint.
2741 **
2742 ** In an SQLite index record, the serial type is stored directly before
2743 ** the blob of data that it corresponds to. In a table record, all serial
2744 ** types are stored at the start of the record, and the blobs of data at
2745 ** the end. Hence these functions allow the caller to handle the
2746 ** serial-type and data blob separately.
2747 **
2748 ** The following table describes the various storage classes for data:
2749 **
2750 **   serial type        bytes of data      type
2751 **   --------------     ---------------    ---------------
2752 **      0                     0            NULL
2753 **      1                     1            signed integer
2754 **      2                     2            signed integer
2755 **      3                     3            signed integer
2756 **      4                     4            signed integer
2757 **      5                     6            signed integer
2758 **      6                     8            signed integer
2759 **      7                     8            IEEE float
2760 **      8                     0            Integer constant 0
2761 **      9                     0            Integer constant 1
2762 **     10,11                               reserved for expansion
2763 **    N>=12 and even       (N-12)/2        BLOB
2764 **    N>=13 and odd        (N-13)/2        text
2765 **
2766 ** The 8 and 9 types were added in 3.3.0, file format 4.  Prior versions
2767 ** of SQLite will not understand those serial types.
2768 */
2769 
2770 /*
2771 ** Return the serial-type for the value stored in pMem.
2772 */
2773 u32 sqlite3VdbeSerialType(Mem *pMem, int file_format){
2774   int flags = pMem->flags;
2775   int n;
2776 
2777   if( flags&MEM_Null ){
2778     return 0;
2779   }
2780   if( flags&MEM_Int ){
2781     /* Figure out whether to use 1, 2, 4, 6 or 8 bytes. */
2782 #   define MAX_6BYTE ((((i64)0x00008000)<<32)-1)
2783     i64 i = pMem->u.i;
2784     u64 u;
2785     if( i<0 ){
2786       if( i<(-MAX_6BYTE) ) return 6;
2787       /* Previous test prevents:  u = -(-9223372036854775808) */
2788       u = -i;
2789     }else{
2790       u = i;
2791     }
2792     if( u<=127 ){
2793       return ((i&1)==i && file_format>=4) ? 8+(u32)u : 1;
2794     }
2795     if( u<=32767 ) return 2;
2796     if( u<=8388607 ) return 3;
2797     if( u<=2147483647 ) return 4;
2798     if( u<=MAX_6BYTE ) return 5;
2799     return 6;
2800   }
2801   if( flags&MEM_Real ){
2802     return 7;
2803   }
2804   assert( pMem->db->mallocFailed || flags&(MEM_Str|MEM_Blob) );
2805   n = pMem->n;
2806   if( flags & MEM_Zero ){
2807     n += pMem->u.nZero;
2808   }
2809   assert( n>=0 );
2810   return ((n*2) + 12 + ((flags&MEM_Str)!=0));
2811 }
2812 
2813 /*
2814 ** Return the length of the data corresponding to the supplied serial-type.
2815 */
2816 u32 sqlite3VdbeSerialTypeLen(u32 serial_type){
2817   if( serial_type>=12 ){
2818     return (serial_type-12)/2;
2819   }else{
2820     static const u8 aSize[] = { 0, 1, 2, 3, 4, 6, 8, 8, 0, 0, 0, 0 };
2821     return aSize[serial_type];
2822   }
2823 }
2824 
2825 /*
2826 ** If we are on an architecture with mixed-endian floating
2827 ** points (ex: ARM7) then swap the lower 4 bytes with the
2828 ** upper 4 bytes.  Return the result.
2829 **
2830 ** For most architectures, this is a no-op.
2831 **
2832 ** (later):  It is reported to me that the mixed-endian problem
2833 ** on ARM7 is an issue with GCC, not with the ARM7 chip.  It seems
2834 ** that early versions of GCC stored the two words of a 64-bit
2835 ** float in the wrong order.  And that error has been propagated
2836 ** ever since.  The blame is not necessarily with GCC, though.
2837 ** GCC might have just copying the problem from a prior compiler.
2838 ** I am also told that newer versions of GCC that follow a different
2839 ** ABI get the byte order right.
2840 **
2841 ** Developers using SQLite on an ARM7 should compile and run their
2842 ** application using -DSQLITE_DEBUG=1 at least once.  With DEBUG
2843 ** enabled, some asserts below will ensure that the byte order of
2844 ** floating point values is correct.
2845 **
2846 ** (2007-08-30)  Frank van Vugt has studied this problem closely
2847 ** and has send his findings to the SQLite developers.  Frank
2848 ** writes that some Linux kernels offer floating point hardware
2849 ** emulation that uses only 32-bit mantissas instead of a full
2850 ** 48-bits as required by the IEEE standard.  (This is the
2851 ** CONFIG_FPE_FASTFPE option.)  On such systems, floating point
2852 ** byte swapping becomes very complicated.  To avoid problems,
2853 ** the necessary byte swapping is carried out using a 64-bit integer
2854 ** rather than a 64-bit float.  Frank assures us that the code here
2855 ** works for him.  We, the developers, have no way to independently
2856 ** verify this, but Frank seems to know what he is talking about
2857 ** so we trust him.
2858 */
2859 #ifdef SQLITE_MIXED_ENDIAN_64BIT_FLOAT
2860 static u64 floatSwap(u64 in){
2861   union {
2862     u64 r;
2863     u32 i[2];
2864   } u;
2865   u32 t;
2866 
2867   u.r = in;
2868   t = u.i[0];
2869   u.i[0] = u.i[1];
2870   u.i[1] = t;
2871   return u.r;
2872 }
2873 # define swapMixedEndianFloat(X)  X = floatSwap(X)
2874 #else
2875 # define swapMixedEndianFloat(X)
2876 #endif
2877 
2878 /*
2879 ** Write the serialized data blob for the value stored in pMem into
2880 ** buf. It is assumed that the caller has allocated sufficient space.
2881 ** Return the number of bytes written.
2882 **
2883 ** nBuf is the amount of space left in buf[].  The caller is responsible
2884 ** for allocating enough space to buf[] to hold the entire field, exclusive
2885 ** of the pMem->u.nZero bytes for a MEM_Zero value.
2886 **
2887 ** Return the number of bytes actually written into buf[].  The number
2888 ** of bytes in the zero-filled tail is included in the return value only
2889 ** if those bytes were zeroed in buf[].
2890 */
2891 u32 sqlite3VdbeSerialPut(u8 *buf, Mem *pMem, u32 serial_type){
2892   u32 len;
2893 
2894   /* Integer and Real */
2895   if( serial_type<=7 && serial_type>0 ){
2896     u64 v;
2897     u32 i;
2898     if( serial_type==7 ){
2899       assert( sizeof(v)==sizeof(pMem->r) );
2900       memcpy(&v, &pMem->r, sizeof(v));
2901       swapMixedEndianFloat(v);
2902     }else{
2903       v = pMem->u.i;
2904     }
2905     len = i = sqlite3VdbeSerialTypeLen(serial_type);
2906     while( i-- ){
2907       buf[i] = (u8)(v&0xFF);
2908       v >>= 8;
2909     }
2910     return len;
2911   }
2912 
2913   /* String or blob */
2914   if( serial_type>=12 ){
2915     assert( pMem->n + ((pMem->flags & MEM_Zero)?pMem->u.nZero:0)
2916              == (int)sqlite3VdbeSerialTypeLen(serial_type) );
2917     len = pMem->n;
2918     memcpy(buf, pMem->z, len);
2919     return len;
2920   }
2921 
2922   /* NULL or constants 0 or 1 */
2923   return 0;
2924 }
2925 
2926 /*
2927 ** Deserialize the data blob pointed to by buf as serial type serial_type
2928 ** and store the result in pMem.  Return the number of bytes read.
2929 */
2930 u32 sqlite3VdbeSerialGet(
2931   const unsigned char *buf,     /* Buffer to deserialize from */
2932   u32 serial_type,              /* Serial type to deserialize */
2933   Mem *pMem                     /* Memory cell to write value into */
2934 ){
2935   u64 x;
2936   u32 y;
2937   int i;
2938   switch( serial_type ){
2939     case 10:   /* Reserved for future use */
2940     case 11:   /* Reserved for future use */
2941     case 0: {  /* NULL */
2942       pMem->flags = MEM_Null;
2943       break;
2944     }
2945     case 1: { /* 1-byte signed integer */
2946       pMem->u.i = (signed char)buf[0];
2947       pMem->flags = MEM_Int;
2948       return 1;
2949     }
2950     case 2: { /* 2-byte signed integer */
2951       i = 256*(signed char)buf[0] | buf[1];
2952       pMem->u.i = (i64)i;
2953       pMem->flags = MEM_Int;
2954       return 2;
2955     }
2956     case 3: { /* 3-byte signed integer */
2957       i = 65536*(signed char)buf[0] | (buf[1]<<8) | buf[2];
2958       pMem->u.i = (i64)i;
2959       pMem->flags = MEM_Int;
2960       return 3;
2961     }
2962     case 4: { /* 4-byte signed integer */
2963       y = ((unsigned)buf[0]<<24) | (buf[1]<<16) | (buf[2]<<8) | buf[3];
2964       pMem->u.i = (i64)*(int*)&y;
2965       pMem->flags = MEM_Int;
2966       return 4;
2967     }
2968     case 5: { /* 6-byte signed integer */
2969       x = 256*(signed char)buf[0] + buf[1];
2970       y = ((unsigned)buf[2]<<24) | (buf[3]<<16) | (buf[4]<<8) | buf[5];
2971       x = (x<<32) | y;
2972       pMem->u.i = *(i64*)&x;
2973       pMem->flags = MEM_Int;
2974       return 6;
2975     }
2976     case 6:   /* 8-byte signed integer */
2977     case 7: { /* IEEE floating point */
2978 #if !defined(NDEBUG) && !defined(SQLITE_OMIT_FLOATING_POINT)
2979       /* Verify that integers and floating point values use the same
2980       ** byte order.  Or, that if SQLITE_MIXED_ENDIAN_64BIT_FLOAT is
2981       ** defined that 64-bit floating point values really are mixed
2982       ** endian.
2983       */
2984       static const u64 t1 = ((u64)0x3ff00000)<<32;
2985       static const double r1 = 1.0;
2986       u64 t2 = t1;
2987       swapMixedEndianFloat(t2);
2988       assert( sizeof(r1)==sizeof(t2) && memcmp(&r1, &t2, sizeof(r1))==0 );
2989 #endif
2990       x = ((unsigned)buf[0]<<24) | (buf[1]<<16) | (buf[2]<<8) | buf[3];
2991       y = ((unsigned)buf[4]<<24) | (buf[5]<<16) | (buf[6]<<8) | buf[7];
2992       x = (x<<32) | y;
2993       if( serial_type==6 ){
2994         pMem->u.i = *(i64*)&x;
2995         pMem->flags = MEM_Int;
2996       }else{
2997         assert( sizeof(x)==8 && sizeof(pMem->r)==8 );
2998         swapMixedEndianFloat(x);
2999         memcpy(&pMem->r, &x, sizeof(x));
3000         pMem->flags = sqlite3IsNaN(pMem->r) ? MEM_Null : MEM_Real;
3001       }
3002       return 8;
3003     }
3004     case 8:    /* Integer 0 */
3005     case 9: {  /* Integer 1 */
3006       pMem->u.i = serial_type-8;
3007       pMem->flags = MEM_Int;
3008       return 0;
3009     }
3010     default: {
3011       static const u16 aFlag[] = { MEM_Blob|MEM_Ephem, MEM_Str|MEM_Ephem };
3012       u32 len = (serial_type-12)/2;
3013       pMem->z = (char *)buf;
3014       pMem->n = len;
3015       pMem->xDel = 0;
3016       pMem->flags = aFlag[serial_type&1];
3017       return len;
3018     }
3019   }
3020   return 0;
3021 }
3022 
3023 /*
3024 ** This routine is used to allocate sufficient space for an UnpackedRecord
3025 ** structure large enough to be used with sqlite3VdbeRecordUnpack() if
3026 ** the first argument is a pointer to KeyInfo structure pKeyInfo.
3027 **
3028 ** The space is either allocated using sqlite3DbMallocRaw() or from within
3029 ** the unaligned buffer passed via the second and third arguments (presumably
3030 ** stack space). If the former, then *ppFree is set to a pointer that should
3031 ** be eventually freed by the caller using sqlite3DbFree(). Or, if the
3032 ** allocation comes from the pSpace/szSpace buffer, *ppFree is set to NULL
3033 ** before returning.
3034 **
3035 ** If an OOM error occurs, NULL is returned.
3036 */
3037 UnpackedRecord *sqlite3VdbeAllocUnpackedRecord(
3038   KeyInfo *pKeyInfo,              /* Description of the record */
3039   char *pSpace,                   /* Unaligned space available */
3040   int szSpace,                    /* Size of pSpace[] in bytes */
3041   char **ppFree                   /* OUT: Caller should free this pointer */
3042 ){
3043   UnpackedRecord *p;              /* Unpacked record to return */
3044   int nOff;                       /* Increment pSpace by nOff to align it */
3045   int nByte;                      /* Number of bytes required for *p */
3046 
3047   /* We want to shift the pointer pSpace up such that it is 8-byte aligned.
3048   ** Thus, we need to calculate a value, nOff, between 0 and 7, to shift
3049   ** it by.  If pSpace is already 8-byte aligned, nOff should be zero.
3050   */
3051   nOff = (8 - (SQLITE_PTR_TO_INT(pSpace) & 7)) & 7;
3052   nByte = ROUND8(sizeof(UnpackedRecord)) + sizeof(Mem)*(pKeyInfo->nField+1);
3053   if( nByte>szSpace+nOff ){
3054     p = (UnpackedRecord *)sqlite3DbMallocRaw(pKeyInfo->db, nByte);
3055     *ppFree = (char *)p;
3056     if( !p ) return 0;
3057   }else{
3058     p = (UnpackedRecord*)&pSpace[nOff];
3059     *ppFree = 0;
3060   }
3061 
3062   p->aMem = (Mem*)&((char*)p)[ROUND8(sizeof(UnpackedRecord))];
3063   assert( pKeyInfo->aSortOrder!=0 );
3064   p->pKeyInfo = pKeyInfo;
3065   p->nField = pKeyInfo->nField + 1;
3066   return p;
3067 }
3068 
3069 /*
3070 ** Given the nKey-byte encoding of a record in pKey[], populate the
3071 ** UnpackedRecord structure indicated by the fourth argument with the
3072 ** contents of the decoded record.
3073 */
3074 void sqlite3VdbeRecordUnpack(
3075   KeyInfo *pKeyInfo,     /* Information about the record format */
3076   int nKey,              /* Size of the binary record */
3077   const void *pKey,      /* The binary record */
3078   UnpackedRecord *p      /* Populate this structure before returning. */
3079 ){
3080   const unsigned char *aKey = (const unsigned char *)pKey;
3081   int d;
3082   u32 idx;                        /* Offset in aKey[] to read from */
3083   u16 u;                          /* Unsigned loop counter */
3084   u32 szHdr;
3085   Mem *pMem = p->aMem;
3086 
3087   p->flags = 0;
3088   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
3089   idx = getVarint32(aKey, szHdr);
3090   d = szHdr;
3091   u = 0;
3092   while( idx<szHdr && u<p->nField && d<=nKey ){
3093     u32 serial_type;
3094 
3095     idx += getVarint32(&aKey[idx], serial_type);
3096     pMem->enc = pKeyInfo->enc;
3097     pMem->db = pKeyInfo->db;
3098     /* pMem->flags = 0; // sqlite3VdbeSerialGet() will set this for us */
3099     pMem->zMalloc = 0;
3100     d += sqlite3VdbeSerialGet(&aKey[d], serial_type, pMem);
3101     pMem++;
3102     u++;
3103   }
3104   assert( u<=pKeyInfo->nField + 1 );
3105   p->nField = u;
3106 }
3107 
3108 /*
3109 ** This function compares the two table rows or index records
3110 ** specified by {nKey1, pKey1} and pPKey2.  It returns a negative, zero
3111 ** or positive integer if key1 is less than, equal to or
3112 ** greater than key2.  The {nKey1, pKey1} key must be a blob
3113 ** created by th OP_MakeRecord opcode of the VDBE.  The pPKey2
3114 ** key must be a parsed key such as obtained from
3115 ** sqlite3VdbeParseRecord.
3116 **
3117 ** Key1 and Key2 do not have to contain the same number of fields.
3118 ** The key with fewer fields is usually compares less than the
3119 ** longer key.  However if the UNPACKED_INCRKEY flags in pPKey2 is set
3120 ** and the common prefixes are equal, then key1 is less than key2.
3121 ** Or if the UNPACKED_MATCH_PREFIX flag is set and the prefixes are
3122 ** equal, then the keys are considered to be equal and
3123 ** the parts beyond the common prefix are ignored.
3124 */
3125 int sqlite3VdbeRecordCompare(
3126   int nKey1, const void *pKey1, /* Left key */
3127   UnpackedRecord *pPKey2        /* Right key */
3128 ){
3129   u32 d1;            /* Offset into aKey[] of next data element */
3130   u32 idx1;          /* Offset into aKey[] of next header element */
3131   u32 szHdr1;        /* Number of bytes in header */
3132   int i = 0;
3133   int rc = 0;
3134   const unsigned char *aKey1 = (const unsigned char *)pKey1;
3135   KeyInfo *pKeyInfo;
3136   Mem mem1;
3137 
3138   pKeyInfo = pPKey2->pKeyInfo;
3139   mem1.enc = pKeyInfo->enc;
3140   mem1.db = pKeyInfo->db;
3141   /* mem1.flags = 0;  // Will be initialized by sqlite3VdbeSerialGet() */
3142   VVA_ONLY( mem1.zMalloc = 0; ) /* Only needed by assert() statements */
3143 
3144   /* Compilers may complain that mem1.u.i is potentially uninitialized.
3145   ** We could initialize it, as shown here, to silence those complaints.
3146   ** But in fact, mem1.u.i will never actually be used uninitialized, and doing
3147   ** the unnecessary initialization has a measurable negative performance
3148   ** impact, since this routine is a very high runner.  And so, we choose
3149   ** to ignore the compiler warnings and leave this variable uninitialized.
3150   */
3151   /*  mem1.u.i = 0;  // not needed, here to silence compiler warning */
3152 
3153   idx1 = getVarint32(aKey1, szHdr1);
3154   d1 = szHdr1;
3155   assert( pKeyInfo->nField+pKeyInfo->nXField>=pPKey2->nField || CORRUPT_DB );
3156   assert( pKeyInfo->aSortOrder!=0 );
3157   assert( pKeyInfo->nField>0 );
3158   assert( idx1<=szHdr1 || CORRUPT_DB );
3159   do{
3160     u32 serial_type1;
3161 
3162     /* Read the serial types for the next element in each key. */
3163     idx1 += getVarint32( aKey1+idx1, serial_type1 );
3164 
3165     /* Verify that there is enough key space remaining to avoid
3166     ** a buffer overread.  The "d1+serial_type1+2" subexpression will
3167     ** always be greater than or equal to the amount of required key space.
3168     ** Use that approximation to avoid the more expensive call to
3169     ** sqlite3VdbeSerialTypeLen() in the common case.
3170     */
3171     if( d1+serial_type1+2>(u32)nKey1
3172      && d1+sqlite3VdbeSerialTypeLen(serial_type1)>(u32)nKey1
3173     ){
3174       break;
3175     }
3176 
3177     /* Extract the values to be compared.
3178     */
3179     d1 += sqlite3VdbeSerialGet(&aKey1[d1], serial_type1, &mem1);
3180 
3181     /* Do the comparison
3182     */
3183     rc = sqlite3MemCompare(&mem1, &pPKey2->aMem[i], pKeyInfo->aColl[i]);
3184     if( rc!=0 ){
3185       assert( mem1.zMalloc==0 );  /* See comment below */
3186       if( pKeyInfo->aSortOrder[i] ){
3187         rc = -rc;  /* Invert the result for DESC sort order. */
3188       }
3189       return rc;
3190     }
3191     i++;
3192   }while( idx1<szHdr1 && i<pPKey2->nField );
3193 
3194   /* No memory allocation is ever used on mem1.  Prove this using
3195   ** the following assert().  If the assert() fails, it indicates a
3196   ** memory leak and a need to call sqlite3VdbeMemRelease(&mem1).
3197   */
3198   assert( mem1.zMalloc==0 );
3199 
3200   /* rc==0 here means that one of the keys ran out of fields and
3201   ** all the fields up to that point were equal. If the UNPACKED_INCRKEY
3202   ** flag is set, then break the tie by treating key2 as larger.
3203   ** If the UPACKED_PREFIX_MATCH flag is set, then keys with common prefixes
3204   ** are considered to be equal.  Otherwise, the longer key is the
3205   ** larger.  As it happens, the pPKey2 will always be the longer
3206   ** if there is a difference.
3207   */
3208   assert( rc==0 );
3209   if( pPKey2->flags & UNPACKED_INCRKEY ){
3210     rc = -1;
3211   }else if( pPKey2->flags & UNPACKED_PREFIX_MATCH ){
3212     /* Leave rc==0 */
3213   }else if( idx1<szHdr1 ){
3214     rc = 1;
3215   }
3216   return rc;
3217 }
3218 
3219 
3220 /*
3221 ** pCur points at an index entry created using the OP_MakeRecord opcode.
3222 ** Read the rowid (the last field in the record) and store it in *rowid.
3223 ** Return SQLITE_OK if everything works, or an error code otherwise.
3224 **
3225 ** pCur might be pointing to text obtained from a corrupt database file.
3226 ** So the content cannot be trusted.  Do appropriate checks on the content.
3227 */
3228 int sqlite3VdbeIdxRowid(sqlite3 *db, BtCursor *pCur, i64 *rowid){
3229   i64 nCellKey = 0;
3230   int rc;
3231   u32 szHdr;        /* Size of the header */
3232   u32 typeRowid;    /* Serial type of the rowid */
3233   u32 lenRowid;     /* Size of the rowid */
3234   Mem m, v;
3235 
3236   UNUSED_PARAMETER(db);
3237 
3238   /* Get the size of the index entry.  Only indices entries of less
3239   ** than 2GiB are support - anything large must be database corruption.
3240   ** Any corruption is detected in sqlite3BtreeParseCellPtr(), though, so
3241   ** this code can safely assume that nCellKey is 32-bits
3242   */
3243   assert( sqlite3BtreeCursorIsValid(pCur) );
3244   VVA_ONLY(rc =) sqlite3BtreeKeySize(pCur, &nCellKey);
3245   assert( rc==SQLITE_OK );     /* pCur is always valid so KeySize cannot fail */
3246   assert( (nCellKey & SQLITE_MAX_U32)==(u64)nCellKey );
3247 
3248   /* Read in the complete content of the index entry */
3249   memset(&m, 0, sizeof(m));
3250   rc = sqlite3VdbeMemFromBtree(pCur, 0, (u32)nCellKey, 1, &m);
3251   if( rc ){
3252     return rc;
3253   }
3254 
3255   /* The index entry must begin with a header size */
3256   (void)getVarint32((u8*)m.z, szHdr);
3257   testcase( szHdr==3 );
3258   testcase( szHdr==m.n );
3259   if( unlikely(szHdr<3 || (int)szHdr>m.n) ){
3260     goto idx_rowid_corruption;
3261   }
3262 
3263   /* The last field of the index should be an integer - the ROWID.
3264   ** Verify that the last entry really is an integer. */
3265   (void)getVarint32((u8*)&m.z[szHdr-1], typeRowid);
3266   testcase( typeRowid==1 );
3267   testcase( typeRowid==2 );
3268   testcase( typeRowid==3 );
3269   testcase( typeRowid==4 );
3270   testcase( typeRowid==5 );
3271   testcase( typeRowid==6 );
3272   testcase( typeRowid==8 );
3273   testcase( typeRowid==9 );
3274   if( unlikely(typeRowid<1 || typeRowid>9 || typeRowid==7) ){
3275     goto idx_rowid_corruption;
3276   }
3277   lenRowid = sqlite3VdbeSerialTypeLen(typeRowid);
3278   testcase( (u32)m.n==szHdr+lenRowid );
3279   if( unlikely((u32)m.n<szHdr+lenRowid) ){
3280     goto idx_rowid_corruption;
3281   }
3282 
3283   /* Fetch the integer off the end of the index record */
3284   sqlite3VdbeSerialGet((u8*)&m.z[m.n-lenRowid], typeRowid, &v);
3285   *rowid = v.u.i;
3286   sqlite3VdbeMemRelease(&m);
3287   return SQLITE_OK;
3288 
3289   /* Jump here if database corruption is detected after m has been
3290   ** allocated.  Free the m object and return SQLITE_CORRUPT. */
3291 idx_rowid_corruption:
3292   testcase( m.zMalloc!=0 );
3293   sqlite3VdbeMemRelease(&m);
3294   return SQLITE_CORRUPT_BKPT;
3295 }
3296 
3297 /*
3298 ** Compare the key of the index entry that cursor pC is pointing to against
3299 ** the key string in pUnpacked.  Write into *pRes a number
3300 ** that is negative, zero, or positive if pC is less than, equal to,
3301 ** or greater than pUnpacked.  Return SQLITE_OK on success.
3302 **
3303 ** pUnpacked is either created without a rowid or is truncated so that it
3304 ** omits the rowid at the end.  The rowid at the end of the index entry
3305 ** is ignored as well.  Hence, this routine only compares the prefixes
3306 ** of the keys prior to the final rowid, not the entire key.
3307 */
3308 int sqlite3VdbeIdxKeyCompare(
3309   VdbeCursor *pC,             /* The cursor to compare against */
3310   UnpackedRecord *pUnpacked,  /* Unpacked version of key to compare against */
3311   int *res                    /* Write the comparison result here */
3312 ){
3313   i64 nCellKey = 0;
3314   int rc;
3315   BtCursor *pCur = pC->pCursor;
3316   Mem m;
3317 
3318   assert( sqlite3BtreeCursorIsValid(pCur) );
3319   VVA_ONLY(rc =) sqlite3BtreeKeySize(pCur, &nCellKey);
3320   assert( rc==SQLITE_OK );    /* pCur is always valid so KeySize cannot fail */
3321   /* nCellKey will always be between 0 and 0xffffffff because of the say
3322   ** that btreeParseCellPtr() and sqlite3GetVarint32() are implemented */
3323   if( nCellKey<=0 || nCellKey>0x7fffffff ){
3324     *res = 0;
3325     return SQLITE_CORRUPT_BKPT;
3326   }
3327   memset(&m, 0, sizeof(m));
3328   rc = sqlite3VdbeMemFromBtree(pC->pCursor, 0, (u32)nCellKey, 1, &m);
3329   if( rc ){
3330     return rc;
3331   }
3332   assert( pUnpacked->flags & UNPACKED_PREFIX_MATCH );
3333   *res = sqlite3VdbeRecordCompare(m.n, m.z, pUnpacked);
3334   sqlite3VdbeMemRelease(&m);
3335   return SQLITE_OK;
3336 }
3337 
3338 /*
3339 ** This routine sets the value to be returned by subsequent calls to
3340 ** sqlite3_changes() on the database handle 'db'.
3341 */
3342 void sqlite3VdbeSetChanges(sqlite3 *db, int nChange){
3343   assert( sqlite3_mutex_held(db->mutex) );
3344   db->nChange = nChange;
3345   db->nTotalChange += nChange;
3346 }
3347 
3348 /*
3349 ** Set a flag in the vdbe to update the change counter when it is finalised
3350 ** or reset.
3351 */
3352 void sqlite3VdbeCountChanges(Vdbe *v){
3353   v->changeCntOn = 1;
3354 }
3355 
3356 /*
3357 ** Mark every prepared statement associated with a database connection
3358 ** as expired.
3359 **
3360 ** An expired statement means that recompilation of the statement is
3361 ** recommend.  Statements expire when things happen that make their
3362 ** programs obsolete.  Removing user-defined functions or collating
3363 ** sequences, or changing an authorization function are the types of
3364 ** things that make prepared statements obsolete.
3365 */
3366 void sqlite3ExpirePreparedStatements(sqlite3 *db){
3367   Vdbe *p;
3368   for(p = db->pVdbe; p; p=p->pNext){
3369     p->expired = 1;
3370   }
3371 }
3372 
3373 /*
3374 ** Return the database associated with the Vdbe.
3375 */
3376 sqlite3 *sqlite3VdbeDb(Vdbe *v){
3377   return v->db;
3378 }
3379 
3380 /*
3381 ** Return a pointer to an sqlite3_value structure containing the value bound
3382 ** parameter iVar of VM v. Except, if the value is an SQL NULL, return
3383 ** 0 instead. Unless it is NULL, apply affinity aff (one of the SQLITE_AFF_*
3384 ** constants) to the value before returning it.
3385 **
3386 ** The returned value must be freed by the caller using sqlite3ValueFree().
3387 */
3388 sqlite3_value *sqlite3VdbeGetBoundValue(Vdbe *v, int iVar, u8 aff){
3389   assert( iVar>0 );
3390   if( v ){
3391     Mem *pMem = &v->aVar[iVar-1];
3392     if( 0==(pMem->flags & MEM_Null) ){
3393       sqlite3_value *pRet = sqlite3ValueNew(v->db);
3394       if( pRet ){
3395         sqlite3VdbeMemCopy((Mem *)pRet, pMem);
3396         sqlite3ValueApplyAffinity(pRet, aff, SQLITE_UTF8);
3397         sqlite3VdbeMemStoreType((Mem *)pRet);
3398       }
3399       return pRet;
3400     }
3401   }
3402   return 0;
3403 }
3404 
3405 /*
3406 ** Configure SQL variable iVar so that binding a new value to it signals
3407 ** to sqlite3_reoptimize() that re-preparing the statement may result
3408 ** in a better query plan.
3409 */
3410 void sqlite3VdbeSetVarmask(Vdbe *v, int iVar){
3411   assert( iVar>0 );
3412   if( iVar>32 ){
3413     v->expmask = 0xffffffff;
3414   }else{
3415     v->expmask |= ((u32)1 << (iVar-1));
3416   }
3417 }
3418 
3419 #ifndef SQLITE_OMIT_VIRTUALTABLE
3420 /*
3421 ** Transfer error message text from an sqlite3_vtab.zErrMsg (text stored
3422 ** in memory obtained from sqlite3_malloc) into a Vdbe.zErrMsg (text stored
3423 ** in memory obtained from sqlite3DbMalloc).
3424 */
3425 void sqlite3VtabImportErrmsg(Vdbe *p, sqlite3_vtab *pVtab){
3426   sqlite3 *db = p->db;
3427   sqlite3DbFree(db, p->zErrMsg);
3428   p->zErrMsg = sqlite3DbStrDup(db, pVtab->zErrMsg);
3429   sqlite3_free(pVtab->zErrMsg);
3430   pVtab->zErrMsg = 0;
3431 }
3432 #endif /* SQLITE_OMIT_VIRTUALTABLE */
3433