xref: /sqlite-3.40.0/src/vdbeaux.c (revision dedd51ae)
1 /*
2 ** 2003 September 6
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 ** This file contains code used for creating, destroying, and populating
13 ** a VDBE (or an "sqlite3_stmt" as it is known to the outside world.)
14 */
15 #include "sqliteInt.h"
16 #include "vdbeInt.h"
17 
18 /* Forward references */
19 static void freeEphemeralFunction(sqlite3 *db, FuncDef *pDef);
20 static void vdbeFreeOpArray(sqlite3 *, Op *, int);
21 
22 /*
23 ** Create a new virtual database engine.
24 */
25 Vdbe *sqlite3VdbeCreate(Parse *pParse){
26   sqlite3 *db = pParse->db;
27   Vdbe *p;
28   p = sqlite3DbMallocRawNN(db, sizeof(Vdbe) );
29   if( p==0 ) return 0;
30   memset(&p->aOp, 0, sizeof(Vdbe)-offsetof(Vdbe,aOp));
31   p->db = db;
32   if( db->pVdbe ){
33     db->pVdbe->pPrev = p;
34   }
35   p->pNext = db->pVdbe;
36   p->pPrev = 0;
37   db->pVdbe = p;
38   p->iVdbeMagic = VDBE_MAGIC_INIT;
39   p->pParse = pParse;
40   pParse->pVdbe = p;
41   assert( pParse->aLabel==0 );
42   assert( pParse->nLabel==0 );
43   assert( p->nOpAlloc==0 );
44   assert( pParse->szOpAlloc==0 );
45   sqlite3VdbeAddOp2(p, OP_Init, 0, 1);
46   return p;
47 }
48 
49 /*
50 ** Return the Parse object that owns a Vdbe object.
51 */
52 Parse *sqlite3VdbeParser(Vdbe *p){
53   return p->pParse;
54 }
55 
56 /*
57 ** Change the error string stored in Vdbe.zErrMsg
58 */
59 void sqlite3VdbeError(Vdbe *p, const char *zFormat, ...){
60   va_list ap;
61   sqlite3DbFree(p->db, p->zErrMsg);
62   va_start(ap, zFormat);
63   p->zErrMsg = sqlite3VMPrintf(p->db, zFormat, ap);
64   va_end(ap);
65 }
66 
67 /*
68 ** Remember the SQL string for a prepared statement.
69 */
70 void sqlite3VdbeSetSql(Vdbe *p, const char *z, int n, u8 prepFlags){
71   if( p==0 ) return;
72   p->prepFlags = prepFlags;
73   if( (prepFlags & SQLITE_PREPARE_SAVESQL)==0 ){
74     p->expmask = 0;
75   }
76   assert( p->zSql==0 );
77   p->zSql = sqlite3DbStrNDup(p->db, z, n);
78 }
79 
80 #ifdef SQLITE_ENABLE_NORMALIZE
81 /*
82 ** Add a new element to the Vdbe->pDblStr list.
83 */
84 void sqlite3VdbeAddDblquoteStr(sqlite3 *db, Vdbe *p, const char *z){
85   if( p ){
86     int n = sqlite3Strlen30(z);
87     DblquoteStr *pStr = sqlite3DbMallocRawNN(db,
88                             sizeof(*pStr)+n+1-sizeof(pStr->z));
89     if( pStr ){
90       pStr->pNextStr = p->pDblStr;
91       p->pDblStr = pStr;
92       memcpy(pStr->z, z, n+1);
93     }
94   }
95 }
96 #endif
97 
98 #ifdef SQLITE_ENABLE_NORMALIZE
99 /*
100 ** zId of length nId is a double-quoted identifier.  Check to see if
101 ** that identifier is really used as a string literal.
102 */
103 int sqlite3VdbeUsesDoubleQuotedString(
104   Vdbe *pVdbe,            /* The prepared statement */
105   const char *zId         /* The double-quoted identifier, already dequoted */
106 ){
107   DblquoteStr *pStr;
108   assert( zId!=0 );
109   if( pVdbe->pDblStr==0 ) return 0;
110   for(pStr=pVdbe->pDblStr; pStr; pStr=pStr->pNextStr){
111     if( strcmp(zId, pStr->z)==0 ) return 1;
112   }
113   return 0;
114 }
115 #endif
116 
117 /*
118 ** Swap all content between two VDBE structures.
119 */
120 void sqlite3VdbeSwap(Vdbe *pA, Vdbe *pB){
121   Vdbe tmp, *pTmp;
122   char *zTmp;
123   assert( pA->db==pB->db );
124   tmp = *pA;
125   *pA = *pB;
126   *pB = tmp;
127   pTmp = pA->pNext;
128   pA->pNext = pB->pNext;
129   pB->pNext = pTmp;
130   pTmp = pA->pPrev;
131   pA->pPrev = pB->pPrev;
132   pB->pPrev = pTmp;
133   zTmp = pA->zSql;
134   pA->zSql = pB->zSql;
135   pB->zSql = zTmp;
136 #ifdef SQLITE_ENABLE_NORMALIZE
137   zTmp = pA->zNormSql;
138   pA->zNormSql = pB->zNormSql;
139   pB->zNormSql = zTmp;
140 #endif
141   pB->expmask = pA->expmask;
142   pB->prepFlags = pA->prepFlags;
143   memcpy(pB->aCounter, pA->aCounter, sizeof(pB->aCounter));
144   pB->aCounter[SQLITE_STMTSTATUS_REPREPARE]++;
145 }
146 
147 /*
148 ** Resize the Vdbe.aOp array so that it is at least nOp elements larger
149 ** than its current size. nOp is guaranteed to be less than or equal
150 ** to 1024/sizeof(Op).
151 **
152 ** If an out-of-memory error occurs while resizing the array, return
153 ** SQLITE_NOMEM. In this case Vdbe.aOp and Vdbe.nOpAlloc remain
154 ** unchanged (this is so that any opcodes already allocated can be
155 ** correctly deallocated along with the rest of the Vdbe).
156 */
157 static int growOpArray(Vdbe *v, int nOp){
158   VdbeOp *pNew;
159   Parse *p = v->pParse;
160 
161   /* The SQLITE_TEST_REALLOC_STRESS compile-time option is designed to force
162   ** more frequent reallocs and hence provide more opportunities for
163   ** simulated OOM faults.  SQLITE_TEST_REALLOC_STRESS is generally used
164   ** during testing only.  With SQLITE_TEST_REALLOC_STRESS grow the op array
165   ** by the minimum* amount required until the size reaches 512.  Normal
166   ** operation (without SQLITE_TEST_REALLOC_STRESS) is to double the current
167   ** size of the op array or add 1KB of space, whichever is smaller. */
168 #ifdef SQLITE_TEST_REALLOC_STRESS
169   sqlite3_int64 nNew = (v->nOpAlloc>=512 ? 2*(sqlite3_int64)v->nOpAlloc
170                         : (sqlite3_int64)v->nOpAlloc+nOp);
171 #else
172   sqlite3_int64 nNew = (v->nOpAlloc ? 2*(sqlite3_int64)v->nOpAlloc
173                         : (sqlite3_int64)(1024/sizeof(Op)));
174   UNUSED_PARAMETER(nOp);
175 #endif
176 
177   /* Ensure that the size of a VDBE does not grow too large */
178   if( nNew > p->db->aLimit[SQLITE_LIMIT_VDBE_OP] ){
179     sqlite3OomFault(p->db);
180     return SQLITE_NOMEM;
181   }
182 
183   assert( nOp<=(1024/sizeof(Op)) );
184   assert( nNew>=(v->nOpAlloc+nOp) );
185   pNew = sqlite3DbRealloc(p->db, v->aOp, nNew*sizeof(Op));
186   if( pNew ){
187     p->szOpAlloc = sqlite3DbMallocSize(p->db, pNew);
188     v->nOpAlloc = p->szOpAlloc/sizeof(Op);
189     v->aOp = pNew;
190   }
191   return (pNew ? SQLITE_OK : SQLITE_NOMEM_BKPT);
192 }
193 
194 #ifdef SQLITE_DEBUG
195 /* This routine is just a convenient place to set a breakpoint that will
196 ** fire after each opcode is inserted and displayed using
197 ** "PRAGMA vdbe_addoptrace=on".  Parameters "pc" (program counter) and
198 ** pOp are available to make the breakpoint conditional.
199 **
200 ** Other useful labels for breakpoints include:
201 **   test_trace_breakpoint(pc,pOp)
202 **   sqlite3CorruptError(lineno)
203 **   sqlite3MisuseError(lineno)
204 **   sqlite3CantopenError(lineno)
205 */
206 static void test_addop_breakpoint(int pc, Op *pOp){
207   static int n = 0;
208   n++;
209 }
210 #endif
211 
212 /*
213 ** Add a new instruction to the list of instructions current in the
214 ** VDBE.  Return the address of the new instruction.
215 **
216 ** Parameters:
217 **
218 **    p               Pointer to the VDBE
219 **
220 **    op              The opcode for this instruction
221 **
222 **    p1, p2, p3      Operands
223 **
224 ** Use the sqlite3VdbeResolveLabel() function to fix an address and
225 ** the sqlite3VdbeChangeP4() function to change the value of the P4
226 ** operand.
227 */
228 static SQLITE_NOINLINE int growOp3(Vdbe *p, int op, int p1, int p2, int p3){
229   assert( p->nOpAlloc<=p->nOp );
230   if( growOpArray(p, 1) ) return 1;
231   assert( p->nOpAlloc>p->nOp );
232   return sqlite3VdbeAddOp3(p, op, p1, p2, p3);
233 }
234 int sqlite3VdbeAddOp3(Vdbe *p, int op, int p1, int p2, int p3){
235   int i;
236   VdbeOp *pOp;
237 
238   i = p->nOp;
239   assert( p->iVdbeMagic==VDBE_MAGIC_INIT );
240   assert( op>=0 && op<0xff );
241   if( p->nOpAlloc<=i ){
242     return growOp3(p, op, p1, p2, p3);
243   }
244   assert( p->aOp!=0 );
245   p->nOp++;
246   pOp = &p->aOp[i];
247   assert( pOp!=0 );
248   pOp->opcode = (u8)op;
249   pOp->p5 = 0;
250   pOp->p1 = p1;
251   pOp->p2 = p2;
252   pOp->p3 = p3;
253   pOp->p4.p = 0;
254   pOp->p4type = P4_NOTUSED;
255 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
256   pOp->zComment = 0;
257 #endif
258 #ifdef SQLITE_DEBUG
259   if( p->db->flags & SQLITE_VdbeAddopTrace ){
260     sqlite3VdbePrintOp(0, i, &p->aOp[i]);
261     test_addop_breakpoint(i, &p->aOp[i]);
262   }
263 #endif
264 #ifdef VDBE_PROFILE
265   pOp->cycles = 0;
266   pOp->cnt = 0;
267 #endif
268 #ifdef SQLITE_VDBE_COVERAGE
269   pOp->iSrcLine = 0;
270 #endif
271   return i;
272 }
273 int sqlite3VdbeAddOp0(Vdbe *p, int op){
274   return sqlite3VdbeAddOp3(p, op, 0, 0, 0);
275 }
276 int sqlite3VdbeAddOp1(Vdbe *p, int op, int p1){
277   return sqlite3VdbeAddOp3(p, op, p1, 0, 0);
278 }
279 int sqlite3VdbeAddOp2(Vdbe *p, int op, int p1, int p2){
280   return sqlite3VdbeAddOp3(p, op, p1, p2, 0);
281 }
282 
283 /* Generate code for an unconditional jump to instruction iDest
284 */
285 int sqlite3VdbeGoto(Vdbe *p, int iDest){
286   return sqlite3VdbeAddOp3(p, OP_Goto, 0, iDest, 0);
287 }
288 
289 /* Generate code to cause the string zStr to be loaded into
290 ** register iDest
291 */
292 int sqlite3VdbeLoadString(Vdbe *p, int iDest, const char *zStr){
293   return sqlite3VdbeAddOp4(p, OP_String8, 0, iDest, 0, zStr, 0);
294 }
295 
296 /*
297 ** Generate code that initializes multiple registers to string or integer
298 ** constants.  The registers begin with iDest and increase consecutively.
299 ** One register is initialized for each characgter in zTypes[].  For each
300 ** "s" character in zTypes[], the register is a string if the argument is
301 ** not NULL, or OP_Null if the value is a null pointer.  For each "i" character
302 ** in zTypes[], the register is initialized to an integer.
303 **
304 ** If the input string does not end with "X" then an OP_ResultRow instruction
305 ** is generated for the values inserted.
306 */
307 void sqlite3VdbeMultiLoad(Vdbe *p, int iDest, const char *zTypes, ...){
308   va_list ap;
309   int i;
310   char c;
311   va_start(ap, zTypes);
312   for(i=0; (c = zTypes[i])!=0; i++){
313     if( c=='s' ){
314       const char *z = va_arg(ap, const char*);
315       sqlite3VdbeAddOp4(p, z==0 ? OP_Null : OP_String8, 0, iDest+i, 0, z, 0);
316     }else if( c=='i' ){
317       sqlite3VdbeAddOp2(p, OP_Integer, va_arg(ap, int), iDest+i);
318     }else{
319       goto skip_op_resultrow;
320     }
321   }
322   sqlite3VdbeAddOp2(p, OP_ResultRow, iDest, i);
323 skip_op_resultrow:
324   va_end(ap);
325 }
326 
327 /*
328 ** Add an opcode that includes the p4 value as a pointer.
329 */
330 int sqlite3VdbeAddOp4(
331   Vdbe *p,            /* Add the opcode to this VM */
332   int op,             /* The new opcode */
333   int p1,             /* The P1 operand */
334   int p2,             /* The P2 operand */
335   int p3,             /* The P3 operand */
336   const char *zP4,    /* The P4 operand */
337   int p4type          /* P4 operand type */
338 ){
339   int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
340   sqlite3VdbeChangeP4(p, addr, zP4, p4type);
341   return addr;
342 }
343 
344 /*
345 ** Add an OP_Function or OP_PureFunc opcode.
346 **
347 ** The eCallCtx argument is information (typically taken from Expr.op2)
348 ** that describes the calling context of the function.  0 means a general
349 ** function call.  NC_IsCheck means called by a check constraint,
350 ** NC_IdxExpr means called as part of an index expression.  NC_PartIdx
351 ** means in the WHERE clause of a partial index.  NC_GenCol means called
352 ** while computing a generated column value.  0 is the usual case.
353 */
354 int sqlite3VdbeAddFunctionCall(
355   Parse *pParse,        /* Parsing context */
356   int p1,               /* Constant argument mask */
357   int p2,               /* First argument register */
358   int p3,               /* Register into which results are written */
359   int nArg,             /* Number of argument */
360   const FuncDef *pFunc, /* The function to be invoked */
361   int eCallCtx          /* Calling context */
362 ){
363   Vdbe *v = pParse->pVdbe;
364   int nByte;
365   int addr;
366   sqlite3_context *pCtx;
367   assert( v );
368   nByte = sizeof(*pCtx) + (nArg-1)*sizeof(sqlite3_value*);
369   pCtx = sqlite3DbMallocRawNN(pParse->db, nByte);
370   if( pCtx==0 ){
371     assert( pParse->db->mallocFailed );
372     freeEphemeralFunction(pParse->db, (FuncDef*)pFunc);
373     return 0;
374   }
375   pCtx->pOut = 0;
376   pCtx->pFunc = (FuncDef*)pFunc;
377   pCtx->pVdbe = 0;
378   pCtx->isError = 0;
379   pCtx->argc = nArg;
380   pCtx->iOp = sqlite3VdbeCurrentAddr(v);
381   addr = sqlite3VdbeAddOp4(v, eCallCtx ? OP_PureFunc : OP_Function,
382                            p1, p2, p3, (char*)pCtx, P4_FUNCCTX);
383   sqlite3VdbeChangeP5(v, eCallCtx & NC_SelfRef);
384   return addr;
385 }
386 
387 /*
388 ** Add an opcode that includes the p4 value with a P4_INT64 or
389 ** P4_REAL type.
390 */
391 int sqlite3VdbeAddOp4Dup8(
392   Vdbe *p,            /* Add the opcode to this VM */
393   int op,             /* The new opcode */
394   int p1,             /* The P1 operand */
395   int p2,             /* The P2 operand */
396   int p3,             /* The P3 operand */
397   const u8 *zP4,      /* The P4 operand */
398   int p4type          /* P4 operand type */
399 ){
400   char *p4copy = sqlite3DbMallocRawNN(sqlite3VdbeDb(p), 8);
401   if( p4copy ) memcpy(p4copy, zP4, 8);
402   return sqlite3VdbeAddOp4(p, op, p1, p2, p3, p4copy, p4type);
403 }
404 
405 #ifndef SQLITE_OMIT_EXPLAIN
406 /*
407 ** Return the address of the current EXPLAIN QUERY PLAN baseline.
408 ** 0 means "none".
409 */
410 int sqlite3VdbeExplainParent(Parse *pParse){
411   VdbeOp *pOp;
412   if( pParse->addrExplain==0 ) return 0;
413   pOp = sqlite3VdbeGetOp(pParse->pVdbe, pParse->addrExplain);
414   return pOp->p2;
415 }
416 
417 /*
418 ** Set a debugger breakpoint on the following routine in order to
419 ** monitor the EXPLAIN QUERY PLAN code generation.
420 */
421 #if defined(SQLITE_DEBUG)
422 void sqlite3ExplainBreakpoint(const char *z1, const char *z2){
423   (void)z1;
424   (void)z2;
425 }
426 #endif
427 
428 /*
429 ** Add a new OP_Explain opcode.
430 **
431 ** If the bPush flag is true, then make this opcode the parent for
432 ** subsequent Explains until sqlite3VdbeExplainPop() is called.
433 */
434 void sqlite3VdbeExplain(Parse *pParse, u8 bPush, const char *zFmt, ...){
435 #ifndef SQLITE_DEBUG
436   /* Always include the OP_Explain opcodes if SQLITE_DEBUG is defined.
437   ** But omit them (for performance) during production builds */
438   if( pParse->explain==2 )
439 #endif
440   {
441     char *zMsg;
442     Vdbe *v;
443     va_list ap;
444     int iThis;
445     va_start(ap, zFmt);
446     zMsg = sqlite3VMPrintf(pParse->db, zFmt, ap);
447     va_end(ap);
448     v = pParse->pVdbe;
449     iThis = v->nOp;
450     sqlite3VdbeAddOp4(v, OP_Explain, iThis, pParse->addrExplain, 0,
451                       zMsg, P4_DYNAMIC);
452     sqlite3ExplainBreakpoint(bPush?"PUSH":"", sqlite3VdbeGetOp(v,-1)->p4.z);
453     if( bPush){
454       pParse->addrExplain = iThis;
455     }
456   }
457 }
458 
459 /*
460 ** Pop the EXPLAIN QUERY PLAN stack one level.
461 */
462 void sqlite3VdbeExplainPop(Parse *pParse){
463   sqlite3ExplainBreakpoint("POP", 0);
464   pParse->addrExplain = sqlite3VdbeExplainParent(pParse);
465 }
466 #endif /* SQLITE_OMIT_EXPLAIN */
467 
468 /*
469 ** Add an OP_ParseSchema opcode.  This routine is broken out from
470 ** sqlite3VdbeAddOp4() since it needs to also needs to mark all btrees
471 ** as having been used.
472 **
473 ** The zWhere string must have been obtained from sqlite3_malloc().
474 ** This routine will take ownership of the allocated memory.
475 */
476 void sqlite3VdbeAddParseSchemaOp(Vdbe *p, int iDb, char *zWhere, u16 p5){
477   int j;
478   sqlite3VdbeAddOp4(p, OP_ParseSchema, iDb, 0, 0, zWhere, P4_DYNAMIC);
479   sqlite3VdbeChangeP5(p, p5);
480   for(j=0; j<p->db->nDb; j++) sqlite3VdbeUsesBtree(p, j);
481   sqlite3MayAbort(p->pParse);
482 }
483 
484 /*
485 ** Add an opcode that includes the p4 value as an integer.
486 */
487 int sqlite3VdbeAddOp4Int(
488   Vdbe *p,            /* Add the opcode to this VM */
489   int op,             /* The new opcode */
490   int p1,             /* The P1 operand */
491   int p2,             /* The P2 operand */
492   int p3,             /* The P3 operand */
493   int p4              /* The P4 operand as an integer */
494 ){
495   int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
496   if( p->db->mallocFailed==0 ){
497     VdbeOp *pOp = &p->aOp[addr];
498     pOp->p4type = P4_INT32;
499     pOp->p4.i = p4;
500   }
501   return addr;
502 }
503 
504 /* Insert the end of a co-routine
505 */
506 void sqlite3VdbeEndCoroutine(Vdbe *v, int regYield){
507   sqlite3VdbeAddOp1(v, OP_EndCoroutine, regYield);
508 
509   /* Clear the temporary register cache, thereby ensuring that each
510   ** co-routine has its own independent set of registers, because co-routines
511   ** might expect their registers to be preserved across an OP_Yield, and
512   ** that could cause problems if two or more co-routines are using the same
513   ** temporary register.
514   */
515   v->pParse->nTempReg = 0;
516   v->pParse->nRangeReg = 0;
517 }
518 
519 /*
520 ** Create a new symbolic label for an instruction that has yet to be
521 ** coded.  The symbolic label is really just a negative number.  The
522 ** label can be used as the P2 value of an operation.  Later, when
523 ** the label is resolved to a specific address, the VDBE will scan
524 ** through its operation list and change all values of P2 which match
525 ** the label into the resolved address.
526 **
527 ** The VDBE knows that a P2 value is a label because labels are
528 ** always negative and P2 values are suppose to be non-negative.
529 ** Hence, a negative P2 value is a label that has yet to be resolved.
530 ** (Later:) This is only true for opcodes that have the OPFLG_JUMP
531 ** property.
532 **
533 ** Variable usage notes:
534 **
535 **     Parse.aLabel[x]     Stores the address that the x-th label resolves
536 **                         into.  For testing (SQLITE_DEBUG), unresolved
537 **                         labels stores -1, but that is not required.
538 **     Parse.nLabelAlloc   Number of slots allocated to Parse.aLabel[]
539 **     Parse.nLabel        The *negative* of the number of labels that have
540 **                         been issued.  The negative is stored because
541 **                         that gives a performance improvement over storing
542 **                         the equivalent positive value.
543 */
544 int sqlite3VdbeMakeLabel(Parse *pParse){
545   return --pParse->nLabel;
546 }
547 
548 /*
549 ** Resolve label "x" to be the address of the next instruction to
550 ** be inserted.  The parameter "x" must have been obtained from
551 ** a prior call to sqlite3VdbeMakeLabel().
552 */
553 static SQLITE_NOINLINE void resizeResolveLabel(Parse *p, Vdbe *v, int j){
554   int nNewSize = 10 - p->nLabel;
555   p->aLabel = sqlite3DbReallocOrFree(p->db, p->aLabel,
556                      nNewSize*sizeof(p->aLabel[0]));
557   if( p->aLabel==0 ){
558     p->nLabelAlloc = 0;
559   }else{
560 #ifdef SQLITE_DEBUG
561     int i;
562     for(i=p->nLabelAlloc; i<nNewSize; i++) p->aLabel[i] = -1;
563 #endif
564     p->nLabelAlloc = nNewSize;
565     p->aLabel[j] = v->nOp;
566   }
567 }
568 void sqlite3VdbeResolveLabel(Vdbe *v, int x){
569   Parse *p = v->pParse;
570   int j = ADDR(x);
571   assert( v->iVdbeMagic==VDBE_MAGIC_INIT );
572   assert( j<-p->nLabel );
573   assert( j>=0 );
574 #ifdef SQLITE_DEBUG
575   if( p->db->flags & SQLITE_VdbeAddopTrace ){
576     printf("RESOLVE LABEL %d to %d\n", x, v->nOp);
577   }
578 #endif
579   if( p->nLabelAlloc + p->nLabel < 0 ){
580     resizeResolveLabel(p,v,j);
581   }else{
582     assert( p->aLabel[j]==(-1) ); /* Labels may only be resolved once */
583     p->aLabel[j] = v->nOp;
584   }
585 }
586 
587 /*
588 ** Mark the VDBE as one that can only be run one time.
589 */
590 void sqlite3VdbeRunOnlyOnce(Vdbe *p){
591   p->runOnlyOnce = 1;
592 }
593 
594 /*
595 ** Mark the VDBE as one that can only be run multiple times.
596 */
597 void sqlite3VdbeReusable(Vdbe *p){
598   p->runOnlyOnce = 0;
599 }
600 
601 #ifdef SQLITE_DEBUG /* sqlite3AssertMayAbort() logic */
602 
603 /*
604 ** The following type and function are used to iterate through all opcodes
605 ** in a Vdbe main program and each of the sub-programs (triggers) it may
606 ** invoke directly or indirectly. It should be used as follows:
607 **
608 **   Op *pOp;
609 **   VdbeOpIter sIter;
610 **
611 **   memset(&sIter, 0, sizeof(sIter));
612 **   sIter.v = v;                            // v is of type Vdbe*
613 **   while( (pOp = opIterNext(&sIter)) ){
614 **     // Do something with pOp
615 **   }
616 **   sqlite3DbFree(v->db, sIter.apSub);
617 **
618 */
619 typedef struct VdbeOpIter VdbeOpIter;
620 struct VdbeOpIter {
621   Vdbe *v;                   /* Vdbe to iterate through the opcodes of */
622   SubProgram **apSub;        /* Array of subprograms */
623   int nSub;                  /* Number of entries in apSub */
624   int iAddr;                 /* Address of next instruction to return */
625   int iSub;                  /* 0 = main program, 1 = first sub-program etc. */
626 };
627 static Op *opIterNext(VdbeOpIter *p){
628   Vdbe *v = p->v;
629   Op *pRet = 0;
630   Op *aOp;
631   int nOp;
632 
633   if( p->iSub<=p->nSub ){
634 
635     if( p->iSub==0 ){
636       aOp = v->aOp;
637       nOp = v->nOp;
638     }else{
639       aOp = p->apSub[p->iSub-1]->aOp;
640       nOp = p->apSub[p->iSub-1]->nOp;
641     }
642     assert( p->iAddr<nOp );
643 
644     pRet = &aOp[p->iAddr];
645     p->iAddr++;
646     if( p->iAddr==nOp ){
647       p->iSub++;
648       p->iAddr = 0;
649     }
650 
651     if( pRet->p4type==P4_SUBPROGRAM ){
652       int nByte = (p->nSub+1)*sizeof(SubProgram*);
653       int j;
654       for(j=0; j<p->nSub; j++){
655         if( p->apSub[j]==pRet->p4.pProgram ) break;
656       }
657       if( j==p->nSub ){
658         p->apSub = sqlite3DbReallocOrFree(v->db, p->apSub, nByte);
659         if( !p->apSub ){
660           pRet = 0;
661         }else{
662           p->apSub[p->nSub++] = pRet->p4.pProgram;
663         }
664       }
665     }
666   }
667 
668   return pRet;
669 }
670 
671 /*
672 ** Check if the program stored in the VM associated with pParse may
673 ** throw an ABORT exception (causing the statement, but not entire transaction
674 ** to be rolled back). This condition is true if the main program or any
675 ** sub-programs contains any of the following:
676 **
677 **   *  OP_Halt with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
678 **   *  OP_HaltIfNull with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
679 **   *  OP_Destroy
680 **   *  OP_VUpdate
681 **   *  OP_VCreate
682 **   *  OP_VRename
683 **   *  OP_FkCounter with P2==0 (immediate foreign key constraint)
684 **   *  OP_CreateBtree/BTREE_INTKEY and OP_InitCoroutine
685 **      (for CREATE TABLE AS SELECT ...)
686 **
687 ** Then check that the value of Parse.mayAbort is true if an
688 ** ABORT may be thrown, or false otherwise. Return true if it does
689 ** match, or false otherwise. This function is intended to be used as
690 ** part of an assert statement in the compiler. Similar to:
691 **
692 **   assert( sqlite3VdbeAssertMayAbort(pParse->pVdbe, pParse->mayAbort) );
693 */
694 int sqlite3VdbeAssertMayAbort(Vdbe *v, int mayAbort){
695   int hasAbort = 0;
696   int hasFkCounter = 0;
697   int hasCreateTable = 0;
698   int hasCreateIndex = 0;
699   int hasInitCoroutine = 0;
700   Op *pOp;
701   VdbeOpIter sIter;
702   memset(&sIter, 0, sizeof(sIter));
703   sIter.v = v;
704 
705   while( (pOp = opIterNext(&sIter))!=0 ){
706     int opcode = pOp->opcode;
707     if( opcode==OP_Destroy || opcode==OP_VUpdate || opcode==OP_VRename
708      || opcode==OP_VDestroy
709      || opcode==OP_VCreate
710      || opcode==OP_ParseSchema
711      || ((opcode==OP_Halt || opcode==OP_HaltIfNull)
712       && ((pOp->p1)!=SQLITE_OK && pOp->p2==OE_Abort))
713     ){
714       hasAbort = 1;
715       break;
716     }
717     if( opcode==OP_CreateBtree && pOp->p3==BTREE_INTKEY ) hasCreateTable = 1;
718     if( mayAbort ){
719       /* hasCreateIndex may also be set for some DELETE statements that use
720       ** OP_Clear. So this routine may end up returning true in the case
721       ** where a "DELETE FROM tbl" has a statement-journal but does not
722       ** require one. This is not so bad - it is an inefficiency, not a bug. */
723       if( opcode==OP_CreateBtree && pOp->p3==BTREE_BLOBKEY ) hasCreateIndex = 1;
724       if( opcode==OP_Clear ) hasCreateIndex = 1;
725     }
726     if( opcode==OP_InitCoroutine ) hasInitCoroutine = 1;
727 #ifndef SQLITE_OMIT_FOREIGN_KEY
728     if( opcode==OP_FkCounter && pOp->p1==0 && pOp->p2==1 ){
729       hasFkCounter = 1;
730     }
731 #endif
732   }
733   sqlite3DbFree(v->db, sIter.apSub);
734 
735   /* Return true if hasAbort==mayAbort. Or if a malloc failure occurred.
736   ** If malloc failed, then the while() loop above may not have iterated
737   ** through all opcodes and hasAbort may be set incorrectly. Return
738   ** true for this case to prevent the assert() in the callers frame
739   ** from failing.  */
740   return ( v->db->mallocFailed || hasAbort==mayAbort || hasFkCounter
741         || (hasCreateTable && hasInitCoroutine) || hasCreateIndex
742   );
743 }
744 #endif /* SQLITE_DEBUG - the sqlite3AssertMayAbort() function */
745 
746 #ifdef SQLITE_DEBUG
747 /*
748 ** Increment the nWrite counter in the VDBE if the cursor is not an
749 ** ephemeral cursor, or if the cursor argument is NULL.
750 */
751 void sqlite3VdbeIncrWriteCounter(Vdbe *p, VdbeCursor *pC){
752   if( pC==0
753    || (pC->eCurType!=CURTYPE_SORTER
754        && pC->eCurType!=CURTYPE_PSEUDO
755        && !pC->isEphemeral)
756   ){
757     p->nWrite++;
758   }
759 }
760 #endif
761 
762 #ifdef SQLITE_DEBUG
763 /*
764 ** Assert if an Abort at this point in time might result in a corrupt
765 ** database.
766 */
767 void sqlite3VdbeAssertAbortable(Vdbe *p){
768   assert( p->nWrite==0 || p->usesStmtJournal );
769 }
770 #endif
771 
772 /*
773 ** This routine is called after all opcodes have been inserted.  It loops
774 ** through all the opcodes and fixes up some details.
775 **
776 ** (1) For each jump instruction with a negative P2 value (a label)
777 **     resolve the P2 value to an actual address.
778 **
779 ** (2) Compute the maximum number of arguments used by any SQL function
780 **     and store that value in *pMaxFuncArgs.
781 **
782 ** (3) Update the Vdbe.readOnly and Vdbe.bIsReader flags to accurately
783 **     indicate what the prepared statement actually does.
784 **
785 ** (4) Initialize the p4.xAdvance pointer on opcodes that use it.
786 **
787 ** (5) Reclaim the memory allocated for storing labels.
788 **
789 ** This routine will only function correctly if the mkopcodeh.tcl generator
790 ** script numbers the opcodes correctly.  Changes to this routine must be
791 ** coordinated with changes to mkopcodeh.tcl.
792 */
793 static void resolveP2Values(Vdbe *p, int *pMaxFuncArgs){
794   int nMaxArgs = *pMaxFuncArgs;
795   Op *pOp;
796   Parse *pParse = p->pParse;
797   int *aLabel = pParse->aLabel;
798   p->readOnly = 1;
799   p->bIsReader = 0;
800   pOp = &p->aOp[p->nOp-1];
801   while(1){
802 
803     /* Only JUMP opcodes and the short list of special opcodes in the switch
804     ** below need to be considered.  The mkopcodeh.tcl generator script groups
805     ** all these opcodes together near the front of the opcode list.  Skip
806     ** any opcode that does not need processing by virtual of the fact that
807     ** it is larger than SQLITE_MX_JUMP_OPCODE, as a performance optimization.
808     */
809     if( pOp->opcode<=SQLITE_MX_JUMP_OPCODE ){
810       /* NOTE: Be sure to update mkopcodeh.tcl when adding or removing
811       ** cases from this switch! */
812       switch( pOp->opcode ){
813         case OP_Transaction: {
814           if( pOp->p2!=0 ) p->readOnly = 0;
815           /* no break */ deliberate_fall_through
816         }
817         case OP_AutoCommit:
818         case OP_Savepoint: {
819           p->bIsReader = 1;
820           break;
821         }
822 #ifndef SQLITE_OMIT_WAL
823         case OP_Checkpoint:
824 #endif
825         case OP_Vacuum:
826         case OP_JournalMode: {
827           p->readOnly = 0;
828           p->bIsReader = 1;
829           break;
830         }
831         case OP_Next:
832         case OP_SorterNext: {
833           pOp->p4.xAdvance = sqlite3BtreeNext;
834           pOp->p4type = P4_ADVANCE;
835           /* The code generator never codes any of these opcodes as a jump
836           ** to a label.  They are always coded as a jump backwards to a
837           ** known address */
838           assert( pOp->p2>=0 );
839           break;
840         }
841         case OP_Prev: {
842           pOp->p4.xAdvance = sqlite3BtreePrevious;
843           pOp->p4type = P4_ADVANCE;
844           /* The code generator never codes any of these opcodes as a jump
845           ** to a label.  They are always coded as a jump backwards to a
846           ** known address */
847           assert( pOp->p2>=0 );
848           break;
849         }
850 #ifndef SQLITE_OMIT_VIRTUALTABLE
851         case OP_VUpdate: {
852           if( pOp->p2>nMaxArgs ) nMaxArgs = pOp->p2;
853           break;
854         }
855         case OP_VFilter: {
856           int n;
857           assert( (pOp - p->aOp) >= 3 );
858           assert( pOp[-1].opcode==OP_Integer );
859           n = pOp[-1].p1;
860           if( n>nMaxArgs ) nMaxArgs = n;
861           /* Fall through into the default case */
862           /* no break */ deliberate_fall_through
863         }
864 #endif
865         default: {
866           if( pOp->p2<0 ){
867             /* The mkopcodeh.tcl script has so arranged things that the only
868             ** non-jump opcodes less than SQLITE_MX_JUMP_CODE are guaranteed to
869             ** have non-negative values for P2. */
870             assert( (sqlite3OpcodeProperty[pOp->opcode] & OPFLG_JUMP)!=0 );
871             assert( ADDR(pOp->p2)<-pParse->nLabel );
872             pOp->p2 = aLabel[ADDR(pOp->p2)];
873           }
874           break;
875         }
876       }
877       /* The mkopcodeh.tcl script has so arranged things that the only
878       ** non-jump opcodes less than SQLITE_MX_JUMP_CODE are guaranteed to
879       ** have non-negative values for P2. */
880       assert( (sqlite3OpcodeProperty[pOp->opcode]&OPFLG_JUMP)==0 || pOp->p2>=0);
881     }
882     if( pOp==p->aOp ) break;
883     pOp--;
884   }
885   sqlite3DbFree(p->db, pParse->aLabel);
886   pParse->aLabel = 0;
887   pParse->nLabel = 0;
888   *pMaxFuncArgs = nMaxArgs;
889   assert( p->bIsReader!=0 || DbMaskAllZero(p->btreeMask) );
890 }
891 
892 /*
893 ** Return the address of the next instruction to be inserted.
894 */
895 int sqlite3VdbeCurrentAddr(Vdbe *p){
896   assert( p->iVdbeMagic==VDBE_MAGIC_INIT );
897   return p->nOp;
898 }
899 
900 /*
901 ** Verify that at least N opcode slots are available in p without
902 ** having to malloc for more space (except when compiled using
903 ** SQLITE_TEST_REALLOC_STRESS).  This interface is used during testing
904 ** to verify that certain calls to sqlite3VdbeAddOpList() can never
905 ** fail due to a OOM fault and hence that the return value from
906 ** sqlite3VdbeAddOpList() will always be non-NULL.
907 */
908 #if defined(SQLITE_DEBUG) && !defined(SQLITE_TEST_REALLOC_STRESS)
909 void sqlite3VdbeVerifyNoMallocRequired(Vdbe *p, int N){
910   assert( p->nOp + N <= p->nOpAlloc );
911 }
912 #endif
913 
914 /*
915 ** Verify that the VM passed as the only argument does not contain
916 ** an OP_ResultRow opcode. Fail an assert() if it does. This is used
917 ** by code in pragma.c to ensure that the implementation of certain
918 ** pragmas comports with the flags specified in the mkpragmatab.tcl
919 ** script.
920 */
921 #if defined(SQLITE_DEBUG) && !defined(SQLITE_TEST_REALLOC_STRESS)
922 void sqlite3VdbeVerifyNoResultRow(Vdbe *p){
923   int i;
924   for(i=0; i<p->nOp; i++){
925     assert( p->aOp[i].opcode!=OP_ResultRow );
926   }
927 }
928 #endif
929 
930 /*
931 ** Generate code (a single OP_Abortable opcode) that will
932 ** verify that the VDBE program can safely call Abort in the current
933 ** context.
934 */
935 #if defined(SQLITE_DEBUG)
936 void sqlite3VdbeVerifyAbortable(Vdbe *p, int onError){
937   if( onError==OE_Abort ) sqlite3VdbeAddOp0(p, OP_Abortable);
938 }
939 #endif
940 
941 /*
942 ** This function returns a pointer to the array of opcodes associated with
943 ** the Vdbe passed as the first argument. It is the callers responsibility
944 ** to arrange for the returned array to be eventually freed using the
945 ** vdbeFreeOpArray() function.
946 **
947 ** Before returning, *pnOp is set to the number of entries in the returned
948 ** array. Also, *pnMaxArg is set to the larger of its current value and
949 ** the number of entries in the Vdbe.apArg[] array required to execute the
950 ** returned program.
951 */
952 VdbeOp *sqlite3VdbeTakeOpArray(Vdbe *p, int *pnOp, int *pnMaxArg){
953   VdbeOp *aOp = p->aOp;
954   assert( aOp && !p->db->mallocFailed );
955 
956   /* Check that sqlite3VdbeUsesBtree() was not called on this VM */
957   assert( DbMaskAllZero(p->btreeMask) );
958 
959   resolveP2Values(p, pnMaxArg);
960   *pnOp = p->nOp;
961   p->aOp = 0;
962   return aOp;
963 }
964 
965 /*
966 ** Add a whole list of operations to the operation stack.  Return a
967 ** pointer to the first operation inserted.
968 **
969 ** Non-zero P2 arguments to jump instructions are automatically adjusted
970 ** so that the jump target is relative to the first operation inserted.
971 */
972 VdbeOp *sqlite3VdbeAddOpList(
973   Vdbe *p,                     /* Add opcodes to the prepared statement */
974   int nOp,                     /* Number of opcodes to add */
975   VdbeOpList const *aOp,       /* The opcodes to be added */
976   int iLineno                  /* Source-file line number of first opcode */
977 ){
978   int i;
979   VdbeOp *pOut, *pFirst;
980   assert( nOp>0 );
981   assert( p->iVdbeMagic==VDBE_MAGIC_INIT );
982   if( p->nOp + nOp > p->nOpAlloc && growOpArray(p, nOp) ){
983     return 0;
984   }
985   pFirst = pOut = &p->aOp[p->nOp];
986   for(i=0; i<nOp; i++, aOp++, pOut++){
987     pOut->opcode = aOp->opcode;
988     pOut->p1 = aOp->p1;
989     pOut->p2 = aOp->p2;
990     assert( aOp->p2>=0 );
991     if( (sqlite3OpcodeProperty[aOp->opcode] & OPFLG_JUMP)!=0 && aOp->p2>0 ){
992       pOut->p2 += p->nOp;
993     }
994     pOut->p3 = aOp->p3;
995     pOut->p4type = P4_NOTUSED;
996     pOut->p4.p = 0;
997     pOut->p5 = 0;
998 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
999     pOut->zComment = 0;
1000 #endif
1001 #ifdef SQLITE_VDBE_COVERAGE
1002     pOut->iSrcLine = iLineno+i;
1003 #else
1004     (void)iLineno;
1005 #endif
1006 #ifdef SQLITE_DEBUG
1007     if( p->db->flags & SQLITE_VdbeAddopTrace ){
1008       sqlite3VdbePrintOp(0, i+p->nOp, &p->aOp[i+p->nOp]);
1009     }
1010 #endif
1011   }
1012   p->nOp += nOp;
1013   return pFirst;
1014 }
1015 
1016 #if defined(SQLITE_ENABLE_STMT_SCANSTATUS)
1017 /*
1018 ** Add an entry to the array of counters managed by sqlite3_stmt_scanstatus().
1019 */
1020 void sqlite3VdbeScanStatus(
1021   Vdbe *p,                        /* VM to add scanstatus() to */
1022   int addrExplain,                /* Address of OP_Explain (or 0) */
1023   int addrLoop,                   /* Address of loop counter */
1024   int addrVisit,                  /* Address of rows visited counter */
1025   LogEst nEst,                    /* Estimated number of output rows */
1026   const char *zName               /* Name of table or index being scanned */
1027 ){
1028   sqlite3_int64 nByte = (p->nScan+1) * sizeof(ScanStatus);
1029   ScanStatus *aNew;
1030   aNew = (ScanStatus*)sqlite3DbRealloc(p->db, p->aScan, nByte);
1031   if( aNew ){
1032     ScanStatus *pNew = &aNew[p->nScan++];
1033     pNew->addrExplain = addrExplain;
1034     pNew->addrLoop = addrLoop;
1035     pNew->addrVisit = addrVisit;
1036     pNew->nEst = nEst;
1037     pNew->zName = sqlite3DbStrDup(p->db, zName);
1038     p->aScan = aNew;
1039   }
1040 }
1041 #endif
1042 
1043 
1044 /*
1045 ** Change the value of the opcode, or P1, P2, P3, or P5 operands
1046 ** for a specific instruction.
1047 */
1048 void sqlite3VdbeChangeOpcode(Vdbe *p, int addr, u8 iNewOpcode){
1049   sqlite3VdbeGetOp(p,addr)->opcode = iNewOpcode;
1050 }
1051 void sqlite3VdbeChangeP1(Vdbe *p, int addr, int val){
1052   sqlite3VdbeGetOp(p,addr)->p1 = val;
1053 }
1054 void sqlite3VdbeChangeP2(Vdbe *p, int addr, int val){
1055   sqlite3VdbeGetOp(p,addr)->p2 = val;
1056 }
1057 void sqlite3VdbeChangeP3(Vdbe *p, int addr, int val){
1058   sqlite3VdbeGetOp(p,addr)->p3 = val;
1059 }
1060 void sqlite3VdbeChangeP5(Vdbe *p, u16 p5){
1061   assert( p->nOp>0 || p->db->mallocFailed );
1062   if( p->nOp>0 ) p->aOp[p->nOp-1].p5 = p5;
1063 }
1064 
1065 /*
1066 ** Change the P2 operand of instruction addr so that it points to
1067 ** the address of the next instruction to be coded.
1068 */
1069 void sqlite3VdbeJumpHere(Vdbe *p, int addr){
1070   sqlite3VdbeChangeP2(p, addr, p->nOp);
1071 }
1072 
1073 /*
1074 ** Change the P2 operand of the jump instruction at addr so that
1075 ** the jump lands on the next opcode.  Or if the jump instruction was
1076 ** the previous opcode (and is thus a no-op) then simply back up
1077 ** the next instruction counter by one slot so that the jump is
1078 ** overwritten by the next inserted opcode.
1079 **
1080 ** This routine is an optimization of sqlite3VdbeJumpHere() that
1081 ** strives to omit useless byte-code like this:
1082 **
1083 **        7   Once 0 8 0
1084 **        8   ...
1085 */
1086 void sqlite3VdbeJumpHereOrPopInst(Vdbe *p, int addr){
1087   if( addr==p->nOp-1 ){
1088     assert( p->aOp[addr].opcode==OP_Once
1089          || p->aOp[addr].opcode==OP_If
1090          || p->aOp[addr].opcode==OP_FkIfZero );
1091     assert( p->aOp[addr].p4type==0 );
1092 #ifdef SQLITE_VDBE_COVERAGE
1093     sqlite3VdbeGetOp(p,-1)->iSrcLine = 0;  /* Erase VdbeCoverage() macros */
1094 #endif
1095     p->nOp--;
1096   }else{
1097     sqlite3VdbeChangeP2(p, addr, p->nOp);
1098   }
1099 }
1100 
1101 
1102 /*
1103 ** If the input FuncDef structure is ephemeral, then free it.  If
1104 ** the FuncDef is not ephermal, then do nothing.
1105 */
1106 static void freeEphemeralFunction(sqlite3 *db, FuncDef *pDef){
1107   if( (pDef->funcFlags & SQLITE_FUNC_EPHEM)!=0 ){
1108     sqlite3DbFreeNN(db, pDef);
1109   }
1110 }
1111 
1112 /*
1113 ** Delete a P4 value if necessary.
1114 */
1115 static SQLITE_NOINLINE void freeP4Mem(sqlite3 *db, Mem *p){
1116   if( p->szMalloc ) sqlite3DbFree(db, p->zMalloc);
1117   sqlite3DbFreeNN(db, p);
1118 }
1119 static SQLITE_NOINLINE void freeP4FuncCtx(sqlite3 *db, sqlite3_context *p){
1120   freeEphemeralFunction(db, p->pFunc);
1121   sqlite3DbFreeNN(db, p);
1122 }
1123 static void freeP4(sqlite3 *db, int p4type, void *p4){
1124   assert( db );
1125   switch( p4type ){
1126     case P4_FUNCCTX: {
1127       freeP4FuncCtx(db, (sqlite3_context*)p4);
1128       break;
1129     }
1130     case P4_REAL:
1131     case P4_INT64:
1132     case P4_DYNAMIC:
1133     case P4_DYNBLOB:
1134     case P4_INTARRAY: {
1135       sqlite3DbFree(db, p4);
1136       break;
1137     }
1138     case P4_KEYINFO: {
1139       if( db->pnBytesFreed==0 ) sqlite3KeyInfoUnref((KeyInfo*)p4);
1140       break;
1141     }
1142 #ifdef SQLITE_ENABLE_CURSOR_HINTS
1143     case P4_EXPR: {
1144       sqlite3ExprDelete(db, (Expr*)p4);
1145       break;
1146     }
1147 #endif
1148     case P4_FUNCDEF: {
1149       freeEphemeralFunction(db, (FuncDef*)p4);
1150       break;
1151     }
1152     case P4_MEM: {
1153       if( db->pnBytesFreed==0 ){
1154         sqlite3ValueFree((sqlite3_value*)p4);
1155       }else{
1156         freeP4Mem(db, (Mem*)p4);
1157       }
1158       break;
1159     }
1160     case P4_VTAB : {
1161       if( db->pnBytesFreed==0 ) sqlite3VtabUnlock((VTable *)p4);
1162       break;
1163     }
1164   }
1165 }
1166 
1167 /*
1168 ** Free the space allocated for aOp and any p4 values allocated for the
1169 ** opcodes contained within. If aOp is not NULL it is assumed to contain
1170 ** nOp entries.
1171 */
1172 static void vdbeFreeOpArray(sqlite3 *db, Op *aOp, int nOp){
1173   if( aOp ){
1174     Op *pOp;
1175     for(pOp=&aOp[nOp-1]; pOp>=aOp; pOp--){
1176       if( pOp->p4type <= P4_FREE_IF_LE ) freeP4(db, pOp->p4type, pOp->p4.p);
1177 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1178       sqlite3DbFree(db, pOp->zComment);
1179 #endif
1180     }
1181     sqlite3DbFreeNN(db, aOp);
1182   }
1183 }
1184 
1185 /*
1186 ** Link the SubProgram object passed as the second argument into the linked
1187 ** list at Vdbe.pSubProgram. This list is used to delete all sub-program
1188 ** objects when the VM is no longer required.
1189 */
1190 void sqlite3VdbeLinkSubProgram(Vdbe *pVdbe, SubProgram *p){
1191   p->pNext = pVdbe->pProgram;
1192   pVdbe->pProgram = p;
1193 }
1194 
1195 /*
1196 ** Return true if the given Vdbe has any SubPrograms.
1197 */
1198 int sqlite3VdbeHasSubProgram(Vdbe *pVdbe){
1199   return pVdbe->pProgram!=0;
1200 }
1201 
1202 /*
1203 ** Change the opcode at addr into OP_Noop
1204 */
1205 int sqlite3VdbeChangeToNoop(Vdbe *p, int addr){
1206   VdbeOp *pOp;
1207   if( p->db->mallocFailed ) return 0;
1208   assert( addr>=0 && addr<p->nOp );
1209   pOp = &p->aOp[addr];
1210   freeP4(p->db, pOp->p4type, pOp->p4.p);
1211   pOp->p4type = P4_NOTUSED;
1212   pOp->p4.z = 0;
1213   pOp->opcode = OP_Noop;
1214   return 1;
1215 }
1216 
1217 /*
1218 ** If the last opcode is "op" and it is not a jump destination,
1219 ** then remove it.  Return true if and only if an opcode was removed.
1220 */
1221 int sqlite3VdbeDeletePriorOpcode(Vdbe *p, u8 op){
1222   if( p->nOp>0 && p->aOp[p->nOp-1].opcode==op ){
1223     return sqlite3VdbeChangeToNoop(p, p->nOp-1);
1224   }else{
1225     return 0;
1226   }
1227 }
1228 
1229 #ifdef SQLITE_DEBUG
1230 /*
1231 ** Generate an OP_ReleaseReg opcode to indicate that a range of
1232 ** registers, except any identified by mask, are no longer in use.
1233 */
1234 void sqlite3VdbeReleaseRegisters(
1235   Parse *pParse,       /* Parsing context */
1236   int iFirst,          /* Index of first register to be released */
1237   int N,               /* Number of registers to release */
1238   u32 mask,            /* Mask of registers to NOT release */
1239   int bUndefine        /* If true, mark registers as undefined */
1240 ){
1241   if( N==0 ) return;
1242   assert( pParse->pVdbe );
1243   assert( iFirst>=1 );
1244   assert( iFirst+N-1<=pParse->nMem );
1245   if( N<=31 && mask!=0 ){
1246     while( N>0 && (mask&1)!=0 ){
1247       mask >>= 1;
1248       iFirst++;
1249       N--;
1250     }
1251     while( N>0 && N<=32 && (mask & MASKBIT32(N-1))!=0 ){
1252       mask &= ~MASKBIT32(N-1);
1253       N--;
1254     }
1255   }
1256   if( N>0 ){
1257     sqlite3VdbeAddOp3(pParse->pVdbe, OP_ReleaseReg, iFirst, N, *(int*)&mask);
1258     if( bUndefine ) sqlite3VdbeChangeP5(pParse->pVdbe, 1);
1259   }
1260 }
1261 #endif /* SQLITE_DEBUG */
1262 
1263 
1264 /*
1265 ** Change the value of the P4 operand for a specific instruction.
1266 ** This routine is useful when a large program is loaded from a
1267 ** static array using sqlite3VdbeAddOpList but we want to make a
1268 ** few minor changes to the program.
1269 **
1270 ** If n>=0 then the P4 operand is dynamic, meaning that a copy of
1271 ** the string is made into memory obtained from sqlite3_malloc().
1272 ** A value of n==0 means copy bytes of zP4 up to and including the
1273 ** first null byte.  If n>0 then copy n+1 bytes of zP4.
1274 **
1275 ** Other values of n (P4_STATIC, P4_COLLSEQ etc.) indicate that zP4 points
1276 ** to a string or structure that is guaranteed to exist for the lifetime of
1277 ** the Vdbe. In these cases we can just copy the pointer.
1278 **
1279 ** If addr<0 then change P4 on the most recently inserted instruction.
1280 */
1281 static void SQLITE_NOINLINE vdbeChangeP4Full(
1282   Vdbe *p,
1283   Op *pOp,
1284   const char *zP4,
1285   int n
1286 ){
1287   if( pOp->p4type ){
1288     freeP4(p->db, pOp->p4type, pOp->p4.p);
1289     pOp->p4type = 0;
1290     pOp->p4.p = 0;
1291   }
1292   if( n<0 ){
1293     sqlite3VdbeChangeP4(p, (int)(pOp - p->aOp), zP4, n);
1294   }else{
1295     if( n==0 ) n = sqlite3Strlen30(zP4);
1296     pOp->p4.z = sqlite3DbStrNDup(p->db, zP4, n);
1297     pOp->p4type = P4_DYNAMIC;
1298   }
1299 }
1300 void sqlite3VdbeChangeP4(Vdbe *p, int addr, const char *zP4, int n){
1301   Op *pOp;
1302   sqlite3 *db;
1303   assert( p!=0 );
1304   db = p->db;
1305   assert( p->iVdbeMagic==VDBE_MAGIC_INIT );
1306   assert( p->aOp!=0 || db->mallocFailed );
1307   if( db->mallocFailed ){
1308     if( n!=P4_VTAB ) freeP4(db, n, (void*)*(char**)&zP4);
1309     return;
1310   }
1311   assert( p->nOp>0 );
1312   assert( addr<p->nOp );
1313   if( addr<0 ){
1314     addr = p->nOp - 1;
1315   }
1316   pOp = &p->aOp[addr];
1317   if( n>=0 || pOp->p4type ){
1318     vdbeChangeP4Full(p, pOp, zP4, n);
1319     return;
1320   }
1321   if( n==P4_INT32 ){
1322     /* Note: this cast is safe, because the origin data point was an int
1323     ** that was cast to a (const char *). */
1324     pOp->p4.i = SQLITE_PTR_TO_INT(zP4);
1325     pOp->p4type = P4_INT32;
1326   }else if( zP4!=0 ){
1327     assert( n<0 );
1328     pOp->p4.p = (void*)zP4;
1329     pOp->p4type = (signed char)n;
1330     if( n==P4_VTAB ) sqlite3VtabLock((VTable*)zP4);
1331   }
1332 }
1333 
1334 /*
1335 ** Change the P4 operand of the most recently coded instruction
1336 ** to the value defined by the arguments.  This is a high-speed
1337 ** version of sqlite3VdbeChangeP4().
1338 **
1339 ** The P4 operand must not have been previously defined.  And the new
1340 ** P4 must not be P4_INT32.  Use sqlite3VdbeChangeP4() in either of
1341 ** those cases.
1342 */
1343 void sqlite3VdbeAppendP4(Vdbe *p, void *pP4, int n){
1344   VdbeOp *pOp;
1345   assert( n!=P4_INT32 && n!=P4_VTAB );
1346   assert( n<=0 );
1347   if( p->db->mallocFailed ){
1348     freeP4(p->db, n, pP4);
1349   }else{
1350     assert( pP4!=0 );
1351     assert( p->nOp>0 );
1352     pOp = &p->aOp[p->nOp-1];
1353     assert( pOp->p4type==P4_NOTUSED );
1354     pOp->p4type = n;
1355     pOp->p4.p = pP4;
1356   }
1357 }
1358 
1359 /*
1360 ** Set the P4 on the most recently added opcode to the KeyInfo for the
1361 ** index given.
1362 */
1363 void sqlite3VdbeSetP4KeyInfo(Parse *pParse, Index *pIdx){
1364   Vdbe *v = pParse->pVdbe;
1365   KeyInfo *pKeyInfo;
1366   assert( v!=0 );
1367   assert( pIdx!=0 );
1368   pKeyInfo = sqlite3KeyInfoOfIndex(pParse, pIdx);
1369   if( pKeyInfo ) sqlite3VdbeAppendP4(v, pKeyInfo, P4_KEYINFO);
1370 }
1371 
1372 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1373 /*
1374 ** Change the comment on the most recently coded instruction.  Or
1375 ** insert a No-op and add the comment to that new instruction.  This
1376 ** makes the code easier to read during debugging.  None of this happens
1377 ** in a production build.
1378 */
1379 static void vdbeVComment(Vdbe *p, const char *zFormat, va_list ap){
1380   assert( p->nOp>0 || p->aOp==0 );
1381   assert( p->aOp==0 || p->aOp[p->nOp-1].zComment==0 || p->pParse->nErr>0 );
1382   if( p->nOp ){
1383     assert( p->aOp );
1384     sqlite3DbFree(p->db, p->aOp[p->nOp-1].zComment);
1385     p->aOp[p->nOp-1].zComment = sqlite3VMPrintf(p->db, zFormat, ap);
1386   }
1387 }
1388 void sqlite3VdbeComment(Vdbe *p, const char *zFormat, ...){
1389   va_list ap;
1390   if( p ){
1391     va_start(ap, zFormat);
1392     vdbeVComment(p, zFormat, ap);
1393     va_end(ap);
1394   }
1395 }
1396 void sqlite3VdbeNoopComment(Vdbe *p, const char *zFormat, ...){
1397   va_list ap;
1398   if( p ){
1399     sqlite3VdbeAddOp0(p, OP_Noop);
1400     va_start(ap, zFormat);
1401     vdbeVComment(p, zFormat, ap);
1402     va_end(ap);
1403   }
1404 }
1405 #endif  /* NDEBUG */
1406 
1407 #ifdef SQLITE_VDBE_COVERAGE
1408 /*
1409 ** Set the value if the iSrcLine field for the previously coded instruction.
1410 */
1411 void sqlite3VdbeSetLineNumber(Vdbe *v, int iLine){
1412   sqlite3VdbeGetOp(v,-1)->iSrcLine = iLine;
1413 }
1414 #endif /* SQLITE_VDBE_COVERAGE */
1415 
1416 /*
1417 ** Return the opcode for a given address.  If the address is -1, then
1418 ** return the most recently inserted opcode.
1419 **
1420 ** If a memory allocation error has occurred prior to the calling of this
1421 ** routine, then a pointer to a dummy VdbeOp will be returned.  That opcode
1422 ** is readable but not writable, though it is cast to a writable value.
1423 ** The return of a dummy opcode allows the call to continue functioning
1424 ** after an OOM fault without having to check to see if the return from
1425 ** this routine is a valid pointer.  But because the dummy.opcode is 0,
1426 ** dummy will never be written to.  This is verified by code inspection and
1427 ** by running with Valgrind.
1428 */
1429 VdbeOp *sqlite3VdbeGetOp(Vdbe *p, int addr){
1430   /* C89 specifies that the constant "dummy" will be initialized to all
1431   ** zeros, which is correct.  MSVC generates a warning, nevertheless. */
1432   static VdbeOp dummy;  /* Ignore the MSVC warning about no initializer */
1433   assert( p->iVdbeMagic==VDBE_MAGIC_INIT );
1434   if( addr<0 ){
1435     addr = p->nOp - 1;
1436   }
1437   assert( (addr>=0 && addr<p->nOp) || p->db->mallocFailed );
1438   if( p->db->mallocFailed ){
1439     return (VdbeOp*)&dummy;
1440   }else{
1441     return &p->aOp[addr];
1442   }
1443 }
1444 
1445 #if defined(SQLITE_ENABLE_EXPLAIN_COMMENTS)
1446 /*
1447 ** Return an integer value for one of the parameters to the opcode pOp
1448 ** determined by character c.
1449 */
1450 static int translateP(char c, const Op *pOp){
1451   if( c=='1' ) return pOp->p1;
1452   if( c=='2' ) return pOp->p2;
1453   if( c=='3' ) return pOp->p3;
1454   if( c=='4' ) return pOp->p4.i;
1455   return pOp->p5;
1456 }
1457 
1458 /*
1459 ** Compute a string for the "comment" field of a VDBE opcode listing.
1460 **
1461 ** The Synopsis: field in comments in the vdbe.c source file gets converted
1462 ** to an extra string that is appended to the sqlite3OpcodeName().  In the
1463 ** absence of other comments, this synopsis becomes the comment on the opcode.
1464 ** Some translation occurs:
1465 **
1466 **       "PX"      ->  "r[X]"
1467 **       "PX@PY"   ->  "r[X..X+Y-1]"  or "r[x]" if y is 0 or 1
1468 **       "PX@PY+1" ->  "r[X..X+Y]"    or "r[x]" if y is 0
1469 **       "PY..PY"  ->  "r[X..Y]"      or "r[x]" if y<=x
1470 */
1471 char *sqlite3VdbeDisplayComment(
1472   sqlite3 *db,       /* Optional - Oom error reporting only */
1473   const Op *pOp,     /* The opcode to be commented */
1474   const char *zP4    /* Previously obtained value for P4 */
1475 ){
1476   const char *zOpName;
1477   const char *zSynopsis;
1478   int nOpName;
1479   int ii;
1480   char zAlt[50];
1481   StrAccum x;
1482 
1483   sqlite3StrAccumInit(&x, 0, 0, 0, SQLITE_MAX_LENGTH);
1484   zOpName = sqlite3OpcodeName(pOp->opcode);
1485   nOpName = sqlite3Strlen30(zOpName);
1486   if( zOpName[nOpName+1] ){
1487     int seenCom = 0;
1488     char c;
1489     zSynopsis = zOpName + nOpName + 1;
1490     if( strncmp(zSynopsis,"IF ",3)==0 ){
1491       sqlite3_snprintf(sizeof(zAlt), zAlt, "if %s goto P2", zSynopsis+3);
1492       zSynopsis = zAlt;
1493     }
1494     for(ii=0; (c = zSynopsis[ii])!=0; ii++){
1495       if( c=='P' ){
1496         c = zSynopsis[++ii];
1497         if( c=='4' ){
1498           sqlite3_str_appendall(&x, zP4);
1499         }else if( c=='X' ){
1500           sqlite3_str_appendall(&x, pOp->zComment);
1501           seenCom = 1;
1502         }else{
1503           int v1 = translateP(c, pOp);
1504           int v2;
1505           if( strncmp(zSynopsis+ii+1, "@P", 2)==0 ){
1506             ii += 3;
1507             v2 = translateP(zSynopsis[ii], pOp);
1508             if( strncmp(zSynopsis+ii+1,"+1",2)==0 ){
1509               ii += 2;
1510               v2++;
1511             }
1512             if( v2<2 ){
1513               sqlite3_str_appendf(&x, "%d", v1);
1514             }else{
1515               sqlite3_str_appendf(&x, "%d..%d", v1, v1+v2-1);
1516             }
1517           }else if( strncmp(zSynopsis+ii+1, "@NP", 3)==0 ){
1518             sqlite3_context *pCtx = pOp->p4.pCtx;
1519             if( pOp->p4type!=P4_FUNCCTX || pCtx->argc==1 ){
1520               sqlite3_str_appendf(&x, "%d", v1);
1521             }else if( pCtx->argc>1 ){
1522               sqlite3_str_appendf(&x, "%d..%d", v1, v1+pCtx->argc-1);
1523             }else if( x.accError==0 ){
1524               assert( x.nChar>2 );
1525               x.nChar -= 2;
1526               ii++;
1527             }
1528             ii += 3;
1529           }else{
1530             sqlite3_str_appendf(&x, "%d", v1);
1531             if( strncmp(zSynopsis+ii+1, "..P3", 4)==0 && pOp->p3==0 ){
1532               ii += 4;
1533             }
1534           }
1535         }
1536       }else{
1537         sqlite3_str_appendchar(&x, 1, c);
1538       }
1539     }
1540     if( !seenCom && pOp->zComment ){
1541       sqlite3_str_appendf(&x, "; %s", pOp->zComment);
1542     }
1543   }else if( pOp->zComment ){
1544     sqlite3_str_appendall(&x, pOp->zComment);
1545   }
1546   if( (x.accError & SQLITE_NOMEM)!=0 && db!=0 ){
1547     sqlite3OomFault(db);
1548   }
1549   return sqlite3StrAccumFinish(&x);
1550 }
1551 #endif /* SQLITE_ENABLE_EXPLAIN_COMMENTS */
1552 
1553 #if VDBE_DISPLAY_P4 && defined(SQLITE_ENABLE_CURSOR_HINTS)
1554 /*
1555 ** Translate the P4.pExpr value for an OP_CursorHint opcode into text
1556 ** that can be displayed in the P4 column of EXPLAIN output.
1557 */
1558 static void displayP4Expr(StrAccum *p, Expr *pExpr){
1559   const char *zOp = 0;
1560   switch( pExpr->op ){
1561     case TK_STRING:
1562       assert( !ExprHasProperty(pExpr, EP_IntValue) );
1563       sqlite3_str_appendf(p, "%Q", pExpr->u.zToken);
1564       break;
1565     case TK_INTEGER:
1566       sqlite3_str_appendf(p, "%d", pExpr->u.iValue);
1567       break;
1568     case TK_NULL:
1569       sqlite3_str_appendf(p, "NULL");
1570       break;
1571     case TK_REGISTER: {
1572       sqlite3_str_appendf(p, "r[%d]", pExpr->iTable);
1573       break;
1574     }
1575     case TK_COLUMN: {
1576       if( pExpr->iColumn<0 ){
1577         sqlite3_str_appendf(p, "rowid");
1578       }else{
1579         sqlite3_str_appendf(p, "c%d", (int)pExpr->iColumn);
1580       }
1581       break;
1582     }
1583     case TK_LT:      zOp = "LT";      break;
1584     case TK_LE:      zOp = "LE";      break;
1585     case TK_GT:      zOp = "GT";      break;
1586     case TK_GE:      zOp = "GE";      break;
1587     case TK_NE:      zOp = "NE";      break;
1588     case TK_EQ:      zOp = "EQ";      break;
1589     case TK_IS:      zOp = "IS";      break;
1590     case TK_ISNOT:   zOp = "ISNOT";   break;
1591     case TK_AND:     zOp = "AND";     break;
1592     case TK_OR:      zOp = "OR";      break;
1593     case TK_PLUS:    zOp = "ADD";     break;
1594     case TK_STAR:    zOp = "MUL";     break;
1595     case TK_MINUS:   zOp = "SUB";     break;
1596     case TK_REM:     zOp = "REM";     break;
1597     case TK_BITAND:  zOp = "BITAND";  break;
1598     case TK_BITOR:   zOp = "BITOR";   break;
1599     case TK_SLASH:   zOp = "DIV";     break;
1600     case TK_LSHIFT:  zOp = "LSHIFT";  break;
1601     case TK_RSHIFT:  zOp = "RSHIFT";  break;
1602     case TK_CONCAT:  zOp = "CONCAT";  break;
1603     case TK_UMINUS:  zOp = "MINUS";   break;
1604     case TK_UPLUS:   zOp = "PLUS";    break;
1605     case TK_BITNOT:  zOp = "BITNOT";  break;
1606     case TK_NOT:     zOp = "NOT";     break;
1607     case TK_ISNULL:  zOp = "ISNULL";  break;
1608     case TK_NOTNULL: zOp = "NOTNULL"; break;
1609 
1610     default:
1611       sqlite3_str_appendf(p, "%s", "expr");
1612       break;
1613   }
1614 
1615   if( zOp ){
1616     sqlite3_str_appendf(p, "%s(", zOp);
1617     displayP4Expr(p, pExpr->pLeft);
1618     if( pExpr->pRight ){
1619       sqlite3_str_append(p, ",", 1);
1620       displayP4Expr(p, pExpr->pRight);
1621     }
1622     sqlite3_str_append(p, ")", 1);
1623   }
1624 }
1625 #endif /* VDBE_DISPLAY_P4 && defined(SQLITE_ENABLE_CURSOR_HINTS) */
1626 
1627 
1628 #if VDBE_DISPLAY_P4
1629 /*
1630 ** Compute a string that describes the P4 parameter for an opcode.
1631 ** Use zTemp for any required temporary buffer space.
1632 */
1633 char *sqlite3VdbeDisplayP4(sqlite3 *db, Op *pOp){
1634   char *zP4 = 0;
1635   StrAccum x;
1636 
1637   sqlite3StrAccumInit(&x, 0, 0, 0, SQLITE_MAX_LENGTH);
1638   switch( pOp->p4type ){
1639     case P4_KEYINFO: {
1640       int j;
1641       KeyInfo *pKeyInfo = pOp->p4.pKeyInfo;
1642       assert( pKeyInfo->aSortFlags!=0 );
1643       sqlite3_str_appendf(&x, "k(%d", pKeyInfo->nKeyField);
1644       for(j=0; j<pKeyInfo->nKeyField; j++){
1645         CollSeq *pColl = pKeyInfo->aColl[j];
1646         const char *zColl = pColl ? pColl->zName : "";
1647         if( strcmp(zColl, "BINARY")==0 ) zColl = "B";
1648         sqlite3_str_appendf(&x, ",%s%s%s",
1649                (pKeyInfo->aSortFlags[j] & KEYINFO_ORDER_DESC) ? "-" : "",
1650                (pKeyInfo->aSortFlags[j] & KEYINFO_ORDER_BIGNULL)? "N." : "",
1651                zColl);
1652       }
1653       sqlite3_str_append(&x, ")", 1);
1654       break;
1655     }
1656 #ifdef SQLITE_ENABLE_CURSOR_HINTS
1657     case P4_EXPR: {
1658       displayP4Expr(&x, pOp->p4.pExpr);
1659       break;
1660     }
1661 #endif
1662     case P4_COLLSEQ: {
1663       static const char *const encnames[] = {"?", "8", "16LE", "16BE"};
1664       CollSeq *pColl = pOp->p4.pColl;
1665       assert( pColl->enc<4 );
1666       sqlite3_str_appendf(&x, "%.18s-%s", pColl->zName,
1667                           encnames[pColl->enc]);
1668       break;
1669     }
1670     case P4_FUNCDEF: {
1671       FuncDef *pDef = pOp->p4.pFunc;
1672       sqlite3_str_appendf(&x, "%s(%d)", pDef->zName, pDef->nArg);
1673       break;
1674     }
1675     case P4_FUNCCTX: {
1676       FuncDef *pDef = pOp->p4.pCtx->pFunc;
1677       sqlite3_str_appendf(&x, "%s(%d)", pDef->zName, pDef->nArg);
1678       break;
1679     }
1680     case P4_INT64: {
1681       sqlite3_str_appendf(&x, "%lld", *pOp->p4.pI64);
1682       break;
1683     }
1684     case P4_INT32: {
1685       sqlite3_str_appendf(&x, "%d", pOp->p4.i);
1686       break;
1687     }
1688     case P4_REAL: {
1689       sqlite3_str_appendf(&x, "%.16g", *pOp->p4.pReal);
1690       break;
1691     }
1692     case P4_MEM: {
1693       Mem *pMem = pOp->p4.pMem;
1694       if( pMem->flags & MEM_Str ){
1695         zP4 = pMem->z;
1696       }else if( pMem->flags & (MEM_Int|MEM_IntReal) ){
1697         sqlite3_str_appendf(&x, "%lld", pMem->u.i);
1698       }else if( pMem->flags & MEM_Real ){
1699         sqlite3_str_appendf(&x, "%.16g", pMem->u.r);
1700       }else if( pMem->flags & MEM_Null ){
1701         zP4 = "NULL";
1702       }else{
1703         assert( pMem->flags & MEM_Blob );
1704         zP4 = "(blob)";
1705       }
1706       break;
1707     }
1708 #ifndef SQLITE_OMIT_VIRTUALTABLE
1709     case P4_VTAB: {
1710       sqlite3_vtab *pVtab = pOp->p4.pVtab->pVtab;
1711       sqlite3_str_appendf(&x, "vtab:%p", pVtab);
1712       break;
1713     }
1714 #endif
1715     case P4_INTARRAY: {
1716       u32 i;
1717       u32 *ai = pOp->p4.ai;
1718       u32 n = ai[0];   /* The first element of an INTARRAY is always the
1719                        ** count of the number of elements to follow */
1720       for(i=1; i<=n; i++){
1721         sqlite3_str_appendf(&x, "%c%u", (i==1 ? '[' : ','), ai[i]);
1722       }
1723       sqlite3_str_append(&x, "]", 1);
1724       break;
1725     }
1726     case P4_SUBPROGRAM: {
1727       zP4 = "program";
1728       break;
1729     }
1730     case P4_DYNBLOB:
1731     case P4_ADVANCE: {
1732       break;
1733     }
1734     case P4_TABLE: {
1735       zP4 = pOp->p4.pTab->zName;
1736       break;
1737     }
1738     default: {
1739       zP4 = pOp->p4.z;
1740     }
1741   }
1742   if( zP4 ) sqlite3_str_appendall(&x, zP4);
1743   if( (x.accError & SQLITE_NOMEM)!=0 ){
1744     sqlite3OomFault(db);
1745   }
1746   return sqlite3StrAccumFinish(&x);
1747 }
1748 #endif /* VDBE_DISPLAY_P4 */
1749 
1750 /*
1751 ** Declare to the Vdbe that the BTree object at db->aDb[i] is used.
1752 **
1753 ** The prepared statements need to know in advance the complete set of
1754 ** attached databases that will be use.  A mask of these databases
1755 ** is maintained in p->btreeMask.  The p->lockMask value is the subset of
1756 ** p->btreeMask of databases that will require a lock.
1757 */
1758 void sqlite3VdbeUsesBtree(Vdbe *p, int i){
1759   assert( i>=0 && i<p->db->nDb && i<(int)sizeof(yDbMask)*8 );
1760   assert( i<(int)sizeof(p->btreeMask)*8 );
1761   DbMaskSet(p->btreeMask, i);
1762   if( i!=1 && sqlite3BtreeSharable(p->db->aDb[i].pBt) ){
1763     DbMaskSet(p->lockMask, i);
1764   }
1765 }
1766 
1767 #if !defined(SQLITE_OMIT_SHARED_CACHE)
1768 /*
1769 ** If SQLite is compiled to support shared-cache mode and to be threadsafe,
1770 ** this routine obtains the mutex associated with each BtShared structure
1771 ** that may be accessed by the VM passed as an argument. In doing so it also
1772 ** sets the BtShared.db member of each of the BtShared structures, ensuring
1773 ** that the correct busy-handler callback is invoked if required.
1774 **
1775 ** If SQLite is not threadsafe but does support shared-cache mode, then
1776 ** sqlite3BtreeEnter() is invoked to set the BtShared.db variables
1777 ** of all of BtShared structures accessible via the database handle
1778 ** associated with the VM.
1779 **
1780 ** If SQLite is not threadsafe and does not support shared-cache mode, this
1781 ** function is a no-op.
1782 **
1783 ** The p->btreeMask field is a bitmask of all btrees that the prepared
1784 ** statement p will ever use.  Let N be the number of bits in p->btreeMask
1785 ** corresponding to btrees that use shared cache.  Then the runtime of
1786 ** this routine is N*N.  But as N is rarely more than 1, this should not
1787 ** be a problem.
1788 */
1789 void sqlite3VdbeEnter(Vdbe *p){
1790   int i;
1791   sqlite3 *db;
1792   Db *aDb;
1793   int nDb;
1794   if( DbMaskAllZero(p->lockMask) ) return;  /* The common case */
1795   db = p->db;
1796   aDb = db->aDb;
1797   nDb = db->nDb;
1798   for(i=0; i<nDb; i++){
1799     if( i!=1 && DbMaskTest(p->lockMask,i) && ALWAYS(aDb[i].pBt!=0) ){
1800       sqlite3BtreeEnter(aDb[i].pBt);
1801     }
1802   }
1803 }
1804 #endif
1805 
1806 #if !defined(SQLITE_OMIT_SHARED_CACHE) && SQLITE_THREADSAFE>0
1807 /*
1808 ** Unlock all of the btrees previously locked by a call to sqlite3VdbeEnter().
1809 */
1810 static SQLITE_NOINLINE void vdbeLeave(Vdbe *p){
1811   int i;
1812   sqlite3 *db;
1813   Db *aDb;
1814   int nDb;
1815   db = p->db;
1816   aDb = db->aDb;
1817   nDb = db->nDb;
1818   for(i=0; i<nDb; i++){
1819     if( i!=1 && DbMaskTest(p->lockMask,i) && ALWAYS(aDb[i].pBt!=0) ){
1820       sqlite3BtreeLeave(aDb[i].pBt);
1821     }
1822   }
1823 }
1824 void sqlite3VdbeLeave(Vdbe *p){
1825   if( DbMaskAllZero(p->lockMask) ) return;  /* The common case */
1826   vdbeLeave(p);
1827 }
1828 #endif
1829 
1830 #if defined(VDBE_PROFILE) || defined(SQLITE_DEBUG)
1831 /*
1832 ** Print a single opcode.  This routine is used for debugging only.
1833 */
1834 void sqlite3VdbePrintOp(FILE *pOut, int pc, VdbeOp *pOp){
1835   char *zP4;
1836   char *zCom;
1837   sqlite3 dummyDb;
1838   static const char *zFormat1 = "%4d %-13s %4d %4d %4d %-13s %.2X %s\n";
1839   if( pOut==0 ) pOut = stdout;
1840   sqlite3BeginBenignMalloc();
1841   dummyDb.mallocFailed = 1;
1842   zP4 = sqlite3VdbeDisplayP4(&dummyDb, pOp);
1843 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1844   zCom = sqlite3VdbeDisplayComment(0, pOp, zP4);
1845 #else
1846   zCom = 0;
1847 #endif
1848   /* NB:  The sqlite3OpcodeName() function is implemented by code created
1849   ** by the mkopcodeh.awk and mkopcodec.awk scripts which extract the
1850   ** information from the vdbe.c source text */
1851   fprintf(pOut, zFormat1, pc,
1852       sqlite3OpcodeName(pOp->opcode), pOp->p1, pOp->p2, pOp->p3,
1853       zP4 ? zP4 : "", pOp->p5,
1854       zCom ? zCom : ""
1855   );
1856   fflush(pOut);
1857   sqlite3_free(zP4);
1858   sqlite3_free(zCom);
1859   sqlite3EndBenignMalloc();
1860 }
1861 #endif
1862 
1863 /*
1864 ** Initialize an array of N Mem element.
1865 */
1866 static void initMemArray(Mem *p, int N, sqlite3 *db, u16 flags){
1867   while( (N--)>0 ){
1868     p->db = db;
1869     p->flags = flags;
1870     p->szMalloc = 0;
1871 #ifdef SQLITE_DEBUG
1872     p->pScopyFrom = 0;
1873 #endif
1874     p++;
1875   }
1876 }
1877 
1878 /*
1879 ** Release an array of N Mem elements
1880 */
1881 static void releaseMemArray(Mem *p, int N){
1882   if( p && N ){
1883     Mem *pEnd = &p[N];
1884     sqlite3 *db = p->db;
1885     if( db->pnBytesFreed ){
1886       do{
1887         if( p->szMalloc ) sqlite3DbFree(db, p->zMalloc);
1888       }while( (++p)<pEnd );
1889       return;
1890     }
1891     do{
1892       assert( (&p[1])==pEnd || p[0].db==p[1].db );
1893       assert( sqlite3VdbeCheckMemInvariants(p) );
1894 
1895       /* This block is really an inlined version of sqlite3VdbeMemRelease()
1896       ** that takes advantage of the fact that the memory cell value is
1897       ** being set to NULL after releasing any dynamic resources.
1898       **
1899       ** The justification for duplicating code is that according to
1900       ** callgrind, this causes a certain test case to hit the CPU 4.7
1901       ** percent less (x86 linux, gcc version 4.1.2, -O6) than if
1902       ** sqlite3MemRelease() were called from here. With -O2, this jumps
1903       ** to 6.6 percent. The test case is inserting 1000 rows into a table
1904       ** with no indexes using a single prepared INSERT statement, bind()
1905       ** and reset(). Inserts are grouped into a transaction.
1906       */
1907       testcase( p->flags & MEM_Agg );
1908       testcase( p->flags & MEM_Dyn );
1909       if( p->flags&(MEM_Agg|MEM_Dyn) ){
1910         testcase( (p->flags & MEM_Dyn)!=0 && p->xDel==sqlite3VdbeFrameMemDel );
1911         sqlite3VdbeMemRelease(p);
1912       }else if( p->szMalloc ){
1913         sqlite3DbFreeNN(db, p->zMalloc);
1914         p->szMalloc = 0;
1915       }
1916 
1917       p->flags = MEM_Undefined;
1918     }while( (++p)<pEnd );
1919   }
1920 }
1921 
1922 #ifdef SQLITE_DEBUG
1923 /*
1924 ** Verify that pFrame is a valid VdbeFrame pointer.  Return true if it is
1925 ** and false if something is wrong.
1926 **
1927 ** This routine is intended for use inside of assert() statements only.
1928 */
1929 int sqlite3VdbeFrameIsValid(VdbeFrame *pFrame){
1930   if( pFrame->iFrameMagic!=SQLITE_FRAME_MAGIC ) return 0;
1931   return 1;
1932 }
1933 #endif
1934 
1935 
1936 /*
1937 ** This is a destructor on a Mem object (which is really an sqlite3_value)
1938 ** that deletes the Frame object that is attached to it as a blob.
1939 **
1940 ** This routine does not delete the Frame right away.  It merely adds the
1941 ** frame to a list of frames to be deleted when the Vdbe halts.
1942 */
1943 void sqlite3VdbeFrameMemDel(void *pArg){
1944   VdbeFrame *pFrame = (VdbeFrame*)pArg;
1945   assert( sqlite3VdbeFrameIsValid(pFrame) );
1946   pFrame->pParent = pFrame->v->pDelFrame;
1947   pFrame->v->pDelFrame = pFrame;
1948 }
1949 
1950 #if defined(SQLITE_ENABLE_BYTECODE_VTAB) || !defined(SQLITE_OMIT_EXPLAIN)
1951 /*
1952 ** Locate the next opcode to be displayed in EXPLAIN or EXPLAIN
1953 ** QUERY PLAN output.
1954 **
1955 ** Return SQLITE_ROW on success.  Return SQLITE_DONE if there are no
1956 ** more opcodes to be displayed.
1957 */
1958 int sqlite3VdbeNextOpcode(
1959   Vdbe *p,         /* The statement being explained */
1960   Mem *pSub,       /* Storage for keeping track of subprogram nesting */
1961   int eMode,       /* 0: normal.  1: EQP.  2:  TablesUsed */
1962   int *piPc,       /* IN/OUT: Current rowid.  Overwritten with next rowid */
1963   int *piAddr,     /* OUT: Write index into (*paOp)[] here */
1964   Op **paOp        /* OUT: Write the opcode array here */
1965 ){
1966   int nRow;                            /* Stop when row count reaches this */
1967   int nSub = 0;                        /* Number of sub-vdbes seen so far */
1968   SubProgram **apSub = 0;              /* Array of sub-vdbes */
1969   int i;                               /* Next instruction address */
1970   int rc = SQLITE_OK;                  /* Result code */
1971   Op *aOp = 0;                         /* Opcode array */
1972   int iPc;                             /* Rowid.  Copy of value in *piPc */
1973 
1974   /* When the number of output rows reaches nRow, that means the
1975   ** listing has finished and sqlite3_step() should return SQLITE_DONE.
1976   ** nRow is the sum of the number of rows in the main program, plus
1977   ** the sum of the number of rows in all trigger subprograms encountered
1978   ** so far.  The nRow value will increase as new trigger subprograms are
1979   ** encountered, but p->pc will eventually catch up to nRow.
1980   */
1981   nRow = p->nOp;
1982   if( pSub!=0 ){
1983     if( pSub->flags&MEM_Blob ){
1984       /* pSub is initiallly NULL.  It is initialized to a BLOB by
1985       ** the P4_SUBPROGRAM processing logic below */
1986       nSub = pSub->n/sizeof(Vdbe*);
1987       apSub = (SubProgram **)pSub->z;
1988     }
1989     for(i=0; i<nSub; i++){
1990       nRow += apSub[i]->nOp;
1991     }
1992   }
1993   iPc = *piPc;
1994   while(1){  /* Loop exits via break */
1995     i = iPc++;
1996     if( i>=nRow ){
1997       p->rc = SQLITE_OK;
1998       rc = SQLITE_DONE;
1999       break;
2000     }
2001     if( i<p->nOp ){
2002       /* The rowid is small enough that we are still in the
2003       ** main program. */
2004       aOp = p->aOp;
2005     }else{
2006       /* We are currently listing subprograms.  Figure out which one and
2007       ** pick up the appropriate opcode. */
2008       int j;
2009       i -= p->nOp;
2010       assert( apSub!=0 );
2011       assert( nSub>0 );
2012       for(j=0; i>=apSub[j]->nOp; j++){
2013         i -= apSub[j]->nOp;
2014         assert( i<apSub[j]->nOp || j+1<nSub );
2015       }
2016       aOp = apSub[j]->aOp;
2017     }
2018 
2019     /* When an OP_Program opcode is encounter (the only opcode that has
2020     ** a P4_SUBPROGRAM argument), expand the size of the array of subprograms
2021     ** kept in p->aMem[9].z to hold the new program - assuming this subprogram
2022     ** has not already been seen.
2023     */
2024     if( pSub!=0 && aOp[i].p4type==P4_SUBPROGRAM ){
2025       int nByte = (nSub+1)*sizeof(SubProgram*);
2026       int j;
2027       for(j=0; j<nSub; j++){
2028         if( apSub[j]==aOp[i].p4.pProgram ) break;
2029       }
2030       if( j==nSub ){
2031         p->rc = sqlite3VdbeMemGrow(pSub, nByte, nSub!=0);
2032         if( p->rc!=SQLITE_OK ){
2033           rc = SQLITE_ERROR;
2034           break;
2035         }
2036         apSub = (SubProgram **)pSub->z;
2037         apSub[nSub++] = aOp[i].p4.pProgram;
2038         MemSetTypeFlag(pSub, MEM_Blob);
2039         pSub->n = nSub*sizeof(SubProgram*);
2040         nRow += aOp[i].p4.pProgram->nOp;
2041       }
2042     }
2043     if( eMode==0 ) break;
2044 #ifdef SQLITE_ENABLE_BYTECODE_VTAB
2045     if( eMode==2 ){
2046       Op *pOp = aOp + i;
2047       if( pOp->opcode==OP_OpenRead ) break;
2048       if( pOp->opcode==OP_OpenWrite && (pOp->p5 & OPFLAG_P2ISREG)==0 ) break;
2049       if( pOp->opcode==OP_ReopenIdx ) break;
2050     }else
2051 #endif
2052     {
2053       assert( eMode==1 );
2054       if( aOp[i].opcode==OP_Explain ) break;
2055       if( aOp[i].opcode==OP_Init && iPc>1 ) break;
2056     }
2057   }
2058   *piPc = iPc;
2059   *piAddr = i;
2060   *paOp = aOp;
2061   return rc;
2062 }
2063 #endif /* SQLITE_ENABLE_BYTECODE_VTAB || !SQLITE_OMIT_EXPLAIN */
2064 
2065 
2066 /*
2067 ** Delete a VdbeFrame object and its contents. VdbeFrame objects are
2068 ** allocated by the OP_Program opcode in sqlite3VdbeExec().
2069 */
2070 void sqlite3VdbeFrameDelete(VdbeFrame *p){
2071   int i;
2072   Mem *aMem = VdbeFrameMem(p);
2073   VdbeCursor **apCsr = (VdbeCursor **)&aMem[p->nChildMem];
2074   assert( sqlite3VdbeFrameIsValid(p) );
2075   for(i=0; i<p->nChildCsr; i++){
2076     sqlite3VdbeFreeCursor(p->v, apCsr[i]);
2077   }
2078   releaseMemArray(aMem, p->nChildMem);
2079   sqlite3VdbeDeleteAuxData(p->v->db, &p->pAuxData, -1, 0);
2080   sqlite3DbFree(p->v->db, p);
2081 }
2082 
2083 #ifndef SQLITE_OMIT_EXPLAIN
2084 /*
2085 ** Give a listing of the program in the virtual machine.
2086 **
2087 ** The interface is the same as sqlite3VdbeExec().  But instead of
2088 ** running the code, it invokes the callback once for each instruction.
2089 ** This feature is used to implement "EXPLAIN".
2090 **
2091 ** When p->explain==1, each instruction is listed.  When
2092 ** p->explain==2, only OP_Explain instructions are listed and these
2093 ** are shown in a different format.  p->explain==2 is used to implement
2094 ** EXPLAIN QUERY PLAN.
2095 ** 2018-04-24:  In p->explain==2 mode, the OP_Init opcodes of triggers
2096 ** are also shown, so that the boundaries between the main program and
2097 ** each trigger are clear.
2098 **
2099 ** When p->explain==1, first the main program is listed, then each of
2100 ** the trigger subprograms are listed one by one.
2101 */
2102 int sqlite3VdbeList(
2103   Vdbe *p                   /* The VDBE */
2104 ){
2105   Mem *pSub = 0;                       /* Memory cell hold array of subprogs */
2106   sqlite3 *db = p->db;                 /* The database connection */
2107   int i;                               /* Loop counter */
2108   int rc = SQLITE_OK;                  /* Return code */
2109   Mem *pMem = &p->aMem[1];             /* First Mem of result set */
2110   int bListSubprogs = (p->explain==1 || (db->flags & SQLITE_TriggerEQP)!=0);
2111   Op *aOp;                             /* Array of opcodes */
2112   Op *pOp;                             /* Current opcode */
2113 
2114   assert( p->explain );
2115   assert( p->iVdbeMagic==VDBE_MAGIC_RUN );
2116   assert( p->rc==SQLITE_OK || p->rc==SQLITE_BUSY || p->rc==SQLITE_NOMEM );
2117 
2118   /* Even though this opcode does not use dynamic strings for
2119   ** the result, result columns may become dynamic if the user calls
2120   ** sqlite3_column_text16(), causing a translation to UTF-16 encoding.
2121   */
2122   releaseMemArray(pMem, 8);
2123   p->pResultSet = 0;
2124 
2125   if( p->rc==SQLITE_NOMEM ){
2126     /* This happens if a malloc() inside a call to sqlite3_column_text() or
2127     ** sqlite3_column_text16() failed.  */
2128     sqlite3OomFault(db);
2129     return SQLITE_ERROR;
2130   }
2131 
2132   if( bListSubprogs ){
2133     /* The first 8 memory cells are used for the result set.  So we will
2134     ** commandeer the 9th cell to use as storage for an array of pointers
2135     ** to trigger subprograms.  The VDBE is guaranteed to have at least 9
2136     ** cells.  */
2137     assert( p->nMem>9 );
2138     pSub = &p->aMem[9];
2139   }else{
2140     pSub = 0;
2141   }
2142 
2143   /* Figure out which opcode is next to display */
2144   rc = sqlite3VdbeNextOpcode(p, pSub, p->explain==2, &p->pc, &i, &aOp);
2145 
2146   if( rc==SQLITE_OK ){
2147     pOp = aOp + i;
2148     if( AtomicLoad(&db->u1.isInterrupted) ){
2149       p->rc = SQLITE_INTERRUPT;
2150       rc = SQLITE_ERROR;
2151       sqlite3VdbeError(p, sqlite3ErrStr(p->rc));
2152     }else{
2153       char *zP4 = sqlite3VdbeDisplayP4(db, pOp);
2154       if( p->explain==2 ){
2155         sqlite3VdbeMemSetInt64(pMem, pOp->p1);
2156         sqlite3VdbeMemSetInt64(pMem+1, pOp->p2);
2157         sqlite3VdbeMemSetInt64(pMem+2, pOp->p3);
2158         sqlite3VdbeMemSetStr(pMem+3, zP4, -1, SQLITE_UTF8, sqlite3_free);
2159         p->nResColumn = 4;
2160       }else{
2161         sqlite3VdbeMemSetInt64(pMem+0, i);
2162         sqlite3VdbeMemSetStr(pMem+1, (char*)sqlite3OpcodeName(pOp->opcode),
2163                              -1, SQLITE_UTF8, SQLITE_STATIC);
2164         sqlite3VdbeMemSetInt64(pMem+2, pOp->p1);
2165         sqlite3VdbeMemSetInt64(pMem+3, pOp->p2);
2166         sqlite3VdbeMemSetInt64(pMem+4, pOp->p3);
2167         /* pMem+5 for p4 is done last */
2168         sqlite3VdbeMemSetInt64(pMem+6, pOp->p5);
2169 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
2170         {
2171           char *zCom = sqlite3VdbeDisplayComment(db, pOp, zP4);
2172           sqlite3VdbeMemSetStr(pMem+7, zCom, -1, SQLITE_UTF8, sqlite3_free);
2173         }
2174 #else
2175         sqlite3VdbeMemSetNull(pMem+7);
2176 #endif
2177         sqlite3VdbeMemSetStr(pMem+5, zP4, -1, SQLITE_UTF8, sqlite3_free);
2178         p->nResColumn = 8;
2179       }
2180       p->pResultSet = pMem;
2181       if( db->mallocFailed ){
2182         p->rc = SQLITE_NOMEM;
2183         rc = SQLITE_ERROR;
2184       }else{
2185         p->rc = SQLITE_OK;
2186         rc = SQLITE_ROW;
2187       }
2188     }
2189   }
2190   return rc;
2191 }
2192 #endif /* SQLITE_OMIT_EXPLAIN */
2193 
2194 #ifdef SQLITE_DEBUG
2195 /*
2196 ** Print the SQL that was used to generate a VDBE program.
2197 */
2198 void sqlite3VdbePrintSql(Vdbe *p){
2199   const char *z = 0;
2200   if( p->zSql ){
2201     z = p->zSql;
2202   }else if( p->nOp>=1 ){
2203     const VdbeOp *pOp = &p->aOp[0];
2204     if( pOp->opcode==OP_Init && pOp->p4.z!=0 ){
2205       z = pOp->p4.z;
2206       while( sqlite3Isspace(*z) ) z++;
2207     }
2208   }
2209   if( z ) printf("SQL: [%s]\n", z);
2210 }
2211 #endif
2212 
2213 #if !defined(SQLITE_OMIT_TRACE) && defined(SQLITE_ENABLE_IOTRACE)
2214 /*
2215 ** Print an IOTRACE message showing SQL content.
2216 */
2217 void sqlite3VdbeIOTraceSql(Vdbe *p){
2218   int nOp = p->nOp;
2219   VdbeOp *pOp;
2220   if( sqlite3IoTrace==0 ) return;
2221   if( nOp<1 ) return;
2222   pOp = &p->aOp[0];
2223   if( pOp->opcode==OP_Init && pOp->p4.z!=0 ){
2224     int i, j;
2225     char z[1000];
2226     sqlite3_snprintf(sizeof(z), z, "%s", pOp->p4.z);
2227     for(i=0; sqlite3Isspace(z[i]); i++){}
2228     for(j=0; z[i]; i++){
2229       if( sqlite3Isspace(z[i]) ){
2230         if( z[i-1]!=' ' ){
2231           z[j++] = ' ';
2232         }
2233       }else{
2234         z[j++] = z[i];
2235       }
2236     }
2237     z[j] = 0;
2238     sqlite3IoTrace("SQL %s\n", z);
2239   }
2240 }
2241 #endif /* !SQLITE_OMIT_TRACE && SQLITE_ENABLE_IOTRACE */
2242 
2243 /* An instance of this object describes bulk memory available for use
2244 ** by subcomponents of a prepared statement.  Space is allocated out
2245 ** of a ReusableSpace object by the allocSpace() routine below.
2246 */
2247 struct ReusableSpace {
2248   u8 *pSpace;            /* Available memory */
2249   sqlite3_int64 nFree;   /* Bytes of available memory */
2250   sqlite3_int64 nNeeded; /* Total bytes that could not be allocated */
2251 };
2252 
2253 /* Try to allocate nByte bytes of 8-byte aligned bulk memory for pBuf
2254 ** from the ReusableSpace object.  Return a pointer to the allocated
2255 ** memory on success.  If insufficient memory is available in the
2256 ** ReusableSpace object, increase the ReusableSpace.nNeeded
2257 ** value by the amount needed and return NULL.
2258 **
2259 ** If pBuf is not initially NULL, that means that the memory has already
2260 ** been allocated by a prior call to this routine, so just return a copy
2261 ** of pBuf and leave ReusableSpace unchanged.
2262 **
2263 ** This allocator is employed to repurpose unused slots at the end of the
2264 ** opcode array of prepared state for other memory needs of the prepared
2265 ** statement.
2266 */
2267 static void *allocSpace(
2268   struct ReusableSpace *p,  /* Bulk memory available for allocation */
2269   void *pBuf,               /* Pointer to a prior allocation */
2270   sqlite3_int64 nByte       /* Bytes of memory needed */
2271 ){
2272   assert( EIGHT_BYTE_ALIGNMENT(p->pSpace) );
2273   if( pBuf==0 ){
2274     nByte = ROUND8(nByte);
2275     if( nByte <= p->nFree ){
2276       p->nFree -= nByte;
2277       pBuf = &p->pSpace[p->nFree];
2278     }else{
2279       p->nNeeded += nByte;
2280     }
2281   }
2282   assert( EIGHT_BYTE_ALIGNMENT(pBuf) );
2283   return pBuf;
2284 }
2285 
2286 /*
2287 ** Rewind the VDBE back to the beginning in preparation for
2288 ** running it.
2289 */
2290 void sqlite3VdbeRewind(Vdbe *p){
2291 #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
2292   int i;
2293 #endif
2294   assert( p!=0 );
2295   assert( p->iVdbeMagic==VDBE_MAGIC_INIT || p->iVdbeMagic==VDBE_MAGIC_RESET );
2296 
2297   /* There should be at least one opcode.
2298   */
2299   assert( p->nOp>0 );
2300 
2301   /* Set the magic to VDBE_MAGIC_RUN sooner rather than later. */
2302   p->iVdbeMagic = VDBE_MAGIC_RUN;
2303 
2304 #ifdef SQLITE_DEBUG
2305   for(i=0; i<p->nMem; i++){
2306     assert( p->aMem[i].db==p->db );
2307   }
2308 #endif
2309   p->pc = -1;
2310   p->rc = SQLITE_OK;
2311   p->errorAction = OE_Abort;
2312   p->nChange = 0;
2313   p->cacheCtr = 1;
2314   p->minWriteFileFormat = 255;
2315   p->iStatement = 0;
2316   p->nFkConstraint = 0;
2317 #ifdef VDBE_PROFILE
2318   for(i=0; i<p->nOp; i++){
2319     p->aOp[i].cnt = 0;
2320     p->aOp[i].cycles = 0;
2321   }
2322 #endif
2323 }
2324 
2325 /*
2326 ** Prepare a virtual machine for execution for the first time after
2327 ** creating the virtual machine.  This involves things such
2328 ** as allocating registers and initializing the program counter.
2329 ** After the VDBE has be prepped, it can be executed by one or more
2330 ** calls to sqlite3VdbeExec().
2331 **
2332 ** This function may be called exactly once on each virtual machine.
2333 ** After this routine is called the VM has been "packaged" and is ready
2334 ** to run.  After this routine is called, further calls to
2335 ** sqlite3VdbeAddOp() functions are prohibited.  This routine disconnects
2336 ** the Vdbe from the Parse object that helped generate it so that the
2337 ** the Vdbe becomes an independent entity and the Parse object can be
2338 ** destroyed.
2339 **
2340 ** Use the sqlite3VdbeRewind() procedure to restore a virtual machine back
2341 ** to its initial state after it has been run.
2342 */
2343 void sqlite3VdbeMakeReady(
2344   Vdbe *p,                       /* The VDBE */
2345   Parse *pParse                  /* Parsing context */
2346 ){
2347   sqlite3 *db;                   /* The database connection */
2348   int nVar;                      /* Number of parameters */
2349   int nMem;                      /* Number of VM memory registers */
2350   int nCursor;                   /* Number of cursors required */
2351   int nArg;                      /* Number of arguments in subprograms */
2352   int n;                         /* Loop counter */
2353   struct ReusableSpace x;        /* Reusable bulk memory */
2354 
2355   assert( p!=0 );
2356   assert( p->nOp>0 );
2357   assert( pParse!=0 );
2358   assert( p->iVdbeMagic==VDBE_MAGIC_INIT );
2359   assert( pParse==p->pParse );
2360   p->pVList = pParse->pVList;
2361   pParse->pVList =  0;
2362   db = p->db;
2363   assert( db->mallocFailed==0 );
2364   nVar = pParse->nVar;
2365   nMem = pParse->nMem;
2366   nCursor = pParse->nTab;
2367   nArg = pParse->nMaxArg;
2368 
2369   /* Each cursor uses a memory cell.  The first cursor (cursor 0) can
2370   ** use aMem[0] which is not otherwise used by the VDBE program.  Allocate
2371   ** space at the end of aMem[] for cursors 1 and greater.
2372   ** See also: allocateCursor().
2373   */
2374   nMem += nCursor;
2375   if( nCursor==0 && nMem>0 ) nMem++;  /* Space for aMem[0] even if not used */
2376 
2377   /* Figure out how much reusable memory is available at the end of the
2378   ** opcode array.  This extra memory will be reallocated for other elements
2379   ** of the prepared statement.
2380   */
2381   n = ROUND8(sizeof(Op)*p->nOp);              /* Bytes of opcode memory used */
2382   x.pSpace = &((u8*)p->aOp)[n];               /* Unused opcode memory */
2383   assert( EIGHT_BYTE_ALIGNMENT(x.pSpace) );
2384   x.nFree = ROUNDDOWN8(pParse->szOpAlloc - n);  /* Bytes of unused memory */
2385   assert( x.nFree>=0 );
2386   assert( EIGHT_BYTE_ALIGNMENT(&x.pSpace[x.nFree]) );
2387 
2388   resolveP2Values(p, &nArg);
2389   p->usesStmtJournal = (u8)(pParse->isMultiWrite && pParse->mayAbort);
2390   if( pParse->explain ){
2391     static const char * const azColName[] = {
2392        "addr", "opcode", "p1", "p2", "p3", "p4", "p5", "comment",
2393        "id", "parent", "notused", "detail"
2394     };
2395     int iFirst, mx, i;
2396     if( nMem<10 ) nMem = 10;
2397     p->explain = pParse->explain;
2398     if( pParse->explain==2 ){
2399       sqlite3VdbeSetNumCols(p, 4);
2400       iFirst = 8;
2401       mx = 12;
2402     }else{
2403       sqlite3VdbeSetNumCols(p, 8);
2404       iFirst = 0;
2405       mx = 8;
2406     }
2407     for(i=iFirst; i<mx; i++){
2408       sqlite3VdbeSetColName(p, i-iFirst, COLNAME_NAME,
2409                             azColName[i], SQLITE_STATIC);
2410     }
2411   }
2412   p->expired = 0;
2413 
2414   /* Memory for registers, parameters, cursor, etc, is allocated in one or two
2415   ** passes.  On the first pass, we try to reuse unused memory at the
2416   ** end of the opcode array.  If we are unable to satisfy all memory
2417   ** requirements by reusing the opcode array tail, then the second
2418   ** pass will fill in the remainder using a fresh memory allocation.
2419   **
2420   ** This two-pass approach that reuses as much memory as possible from
2421   ** the leftover memory at the end of the opcode array.  This can significantly
2422   ** reduce the amount of memory held by a prepared statement.
2423   */
2424   x.nNeeded = 0;
2425   p->aMem = allocSpace(&x, 0, nMem*sizeof(Mem));
2426   p->aVar = allocSpace(&x, 0, nVar*sizeof(Mem));
2427   p->apArg = allocSpace(&x, 0, nArg*sizeof(Mem*));
2428   p->apCsr = allocSpace(&x, 0, nCursor*sizeof(VdbeCursor*));
2429 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2430   p->anExec = allocSpace(&x, 0, p->nOp*sizeof(i64));
2431 #endif
2432   if( x.nNeeded ){
2433     x.pSpace = p->pFree = sqlite3DbMallocRawNN(db, x.nNeeded);
2434     x.nFree = x.nNeeded;
2435     if( !db->mallocFailed ){
2436       p->aMem = allocSpace(&x, p->aMem, nMem*sizeof(Mem));
2437       p->aVar = allocSpace(&x, p->aVar, nVar*sizeof(Mem));
2438       p->apArg = allocSpace(&x, p->apArg, nArg*sizeof(Mem*));
2439       p->apCsr = allocSpace(&x, p->apCsr, nCursor*sizeof(VdbeCursor*));
2440 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2441       p->anExec = allocSpace(&x, p->anExec, p->nOp*sizeof(i64));
2442 #endif
2443     }
2444   }
2445 
2446   if( db->mallocFailed ){
2447     p->nVar = 0;
2448     p->nCursor = 0;
2449     p->nMem = 0;
2450   }else{
2451     p->nCursor = nCursor;
2452     p->nVar = (ynVar)nVar;
2453     initMemArray(p->aVar, nVar, db, MEM_Null);
2454     p->nMem = nMem;
2455     initMemArray(p->aMem, nMem, db, MEM_Undefined);
2456     memset(p->apCsr, 0, nCursor*sizeof(VdbeCursor*));
2457 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2458     memset(p->anExec, 0, p->nOp*sizeof(i64));
2459 #endif
2460   }
2461   sqlite3VdbeRewind(p);
2462 }
2463 
2464 /*
2465 ** Close a VDBE cursor and release all the resources that cursor
2466 ** happens to hold.
2467 */
2468 void sqlite3VdbeFreeCursor(Vdbe *p, VdbeCursor *pCx){
2469   if( pCx==0 ){
2470     return;
2471   }
2472   switch( pCx->eCurType ){
2473     case CURTYPE_SORTER: {
2474       sqlite3VdbeSorterClose(p->db, pCx);
2475       break;
2476     }
2477     case CURTYPE_BTREE: {
2478       assert( pCx->uc.pCursor!=0 );
2479       sqlite3BtreeCloseCursor(pCx->uc.pCursor);
2480       break;
2481     }
2482 #ifndef SQLITE_OMIT_VIRTUALTABLE
2483     case CURTYPE_VTAB: {
2484       sqlite3_vtab_cursor *pVCur = pCx->uc.pVCur;
2485       const sqlite3_module *pModule = pVCur->pVtab->pModule;
2486       assert( pVCur->pVtab->nRef>0 );
2487       pVCur->pVtab->nRef--;
2488       pModule->xClose(pVCur);
2489       break;
2490     }
2491 #endif
2492   }
2493 }
2494 
2495 /*
2496 ** Close all cursors in the current frame.
2497 */
2498 static void closeCursorsInFrame(Vdbe *p){
2499   if( p->apCsr ){
2500     int i;
2501     for(i=0; i<p->nCursor; i++){
2502       VdbeCursor *pC = p->apCsr[i];
2503       if( pC ){
2504         sqlite3VdbeFreeCursor(p, pC);
2505         p->apCsr[i] = 0;
2506       }
2507     }
2508   }
2509 }
2510 
2511 /*
2512 ** Copy the values stored in the VdbeFrame structure to its Vdbe. This
2513 ** is used, for example, when a trigger sub-program is halted to restore
2514 ** control to the main program.
2515 */
2516 int sqlite3VdbeFrameRestore(VdbeFrame *pFrame){
2517   Vdbe *v = pFrame->v;
2518   closeCursorsInFrame(v);
2519 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2520   v->anExec = pFrame->anExec;
2521 #endif
2522   v->aOp = pFrame->aOp;
2523   v->nOp = pFrame->nOp;
2524   v->aMem = pFrame->aMem;
2525   v->nMem = pFrame->nMem;
2526   v->apCsr = pFrame->apCsr;
2527   v->nCursor = pFrame->nCursor;
2528   v->db->lastRowid = pFrame->lastRowid;
2529   v->nChange = pFrame->nChange;
2530   v->db->nChange = pFrame->nDbChange;
2531   sqlite3VdbeDeleteAuxData(v->db, &v->pAuxData, -1, 0);
2532   v->pAuxData = pFrame->pAuxData;
2533   pFrame->pAuxData = 0;
2534   return pFrame->pc;
2535 }
2536 
2537 /*
2538 ** Close all cursors.
2539 **
2540 ** Also release any dynamic memory held by the VM in the Vdbe.aMem memory
2541 ** cell array. This is necessary as the memory cell array may contain
2542 ** pointers to VdbeFrame objects, which may in turn contain pointers to
2543 ** open cursors.
2544 */
2545 static void closeAllCursors(Vdbe *p){
2546   if( p->pFrame ){
2547     VdbeFrame *pFrame;
2548     for(pFrame=p->pFrame; pFrame->pParent; pFrame=pFrame->pParent);
2549     sqlite3VdbeFrameRestore(pFrame);
2550     p->pFrame = 0;
2551     p->nFrame = 0;
2552   }
2553   assert( p->nFrame==0 );
2554   closeCursorsInFrame(p);
2555   if( p->aMem ){
2556     releaseMemArray(p->aMem, p->nMem);
2557   }
2558   while( p->pDelFrame ){
2559     VdbeFrame *pDel = p->pDelFrame;
2560     p->pDelFrame = pDel->pParent;
2561     sqlite3VdbeFrameDelete(pDel);
2562   }
2563 
2564   /* Delete any auxdata allocations made by the VM */
2565   if( p->pAuxData ) sqlite3VdbeDeleteAuxData(p->db, &p->pAuxData, -1, 0);
2566   assert( p->pAuxData==0 );
2567 }
2568 
2569 /*
2570 ** Set the number of result columns that will be returned by this SQL
2571 ** statement. This is now set at compile time, rather than during
2572 ** execution of the vdbe program so that sqlite3_column_count() can
2573 ** be called on an SQL statement before sqlite3_step().
2574 */
2575 void sqlite3VdbeSetNumCols(Vdbe *p, int nResColumn){
2576   int n;
2577   sqlite3 *db = p->db;
2578 
2579   if( p->nResColumn ){
2580     releaseMemArray(p->aColName, p->nResColumn*COLNAME_N);
2581     sqlite3DbFree(db, p->aColName);
2582   }
2583   n = nResColumn*COLNAME_N;
2584   p->nResColumn = (u16)nResColumn;
2585   p->aColName = (Mem*)sqlite3DbMallocRawNN(db, sizeof(Mem)*n );
2586   if( p->aColName==0 ) return;
2587   initMemArray(p->aColName, n, db, MEM_Null);
2588 }
2589 
2590 /*
2591 ** Set the name of the idx'th column to be returned by the SQL statement.
2592 ** zName must be a pointer to a nul terminated string.
2593 **
2594 ** This call must be made after a call to sqlite3VdbeSetNumCols().
2595 **
2596 ** The final parameter, xDel, must be one of SQLITE_DYNAMIC, SQLITE_STATIC
2597 ** or SQLITE_TRANSIENT. If it is SQLITE_DYNAMIC, then the buffer pointed
2598 ** to by zName will be freed by sqlite3DbFree() when the vdbe is destroyed.
2599 */
2600 int sqlite3VdbeSetColName(
2601   Vdbe *p,                         /* Vdbe being configured */
2602   int idx,                         /* Index of column zName applies to */
2603   int var,                         /* One of the COLNAME_* constants */
2604   const char *zName,               /* Pointer to buffer containing name */
2605   void (*xDel)(void*)              /* Memory management strategy for zName */
2606 ){
2607   int rc;
2608   Mem *pColName;
2609   assert( idx<p->nResColumn );
2610   assert( var<COLNAME_N );
2611   if( p->db->mallocFailed ){
2612     assert( !zName || xDel!=SQLITE_DYNAMIC );
2613     return SQLITE_NOMEM_BKPT;
2614   }
2615   assert( p->aColName!=0 );
2616   pColName = &(p->aColName[idx+var*p->nResColumn]);
2617   rc = sqlite3VdbeMemSetStr(pColName, zName, -1, SQLITE_UTF8, xDel);
2618   assert( rc!=0 || !zName || (pColName->flags&MEM_Term)!=0 );
2619   return rc;
2620 }
2621 
2622 /*
2623 ** A read or write transaction may or may not be active on database handle
2624 ** db. If a transaction is active, commit it. If there is a
2625 ** write-transaction spanning more than one database file, this routine
2626 ** takes care of the super-journal trickery.
2627 */
2628 static int vdbeCommit(sqlite3 *db, Vdbe *p){
2629   int i;
2630   int nTrans = 0;  /* Number of databases with an active write-transaction
2631                    ** that are candidates for a two-phase commit using a
2632                    ** super-journal */
2633   int rc = SQLITE_OK;
2634   int needXcommit = 0;
2635 
2636 #ifdef SQLITE_OMIT_VIRTUALTABLE
2637   /* With this option, sqlite3VtabSync() is defined to be simply
2638   ** SQLITE_OK so p is not used.
2639   */
2640   UNUSED_PARAMETER(p);
2641 #endif
2642 
2643   /* Before doing anything else, call the xSync() callback for any
2644   ** virtual module tables written in this transaction. This has to
2645   ** be done before determining whether a super-journal file is
2646   ** required, as an xSync() callback may add an attached database
2647   ** to the transaction.
2648   */
2649   rc = sqlite3VtabSync(db, p);
2650 
2651   /* This loop determines (a) if the commit hook should be invoked and
2652   ** (b) how many database files have open write transactions, not
2653   ** including the temp database. (b) is important because if more than
2654   ** one database file has an open write transaction, a super-journal
2655   ** file is required for an atomic commit.
2656   */
2657   for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2658     Btree *pBt = db->aDb[i].pBt;
2659     if( sqlite3BtreeTxnState(pBt)==SQLITE_TXN_WRITE ){
2660       /* Whether or not a database might need a super-journal depends upon
2661       ** its journal mode (among other things).  This matrix determines which
2662       ** journal modes use a super-journal and which do not */
2663       static const u8 aMJNeeded[] = {
2664         /* DELETE   */  1,
2665         /* PERSIST   */ 1,
2666         /* OFF       */ 0,
2667         /* TRUNCATE  */ 1,
2668         /* MEMORY    */ 0,
2669         /* WAL       */ 0
2670       };
2671       Pager *pPager;   /* Pager associated with pBt */
2672       needXcommit = 1;
2673       sqlite3BtreeEnter(pBt);
2674       pPager = sqlite3BtreePager(pBt);
2675       if( db->aDb[i].safety_level!=PAGER_SYNCHRONOUS_OFF
2676        && aMJNeeded[sqlite3PagerGetJournalMode(pPager)]
2677        && sqlite3PagerIsMemdb(pPager)==0
2678       ){
2679         assert( i!=1 );
2680         nTrans++;
2681       }
2682       rc = sqlite3PagerExclusiveLock(pPager);
2683       sqlite3BtreeLeave(pBt);
2684     }
2685   }
2686   if( rc!=SQLITE_OK ){
2687     return rc;
2688   }
2689 
2690   /* If there are any write-transactions at all, invoke the commit hook */
2691   if( needXcommit && db->xCommitCallback ){
2692     rc = db->xCommitCallback(db->pCommitArg);
2693     if( rc ){
2694       return SQLITE_CONSTRAINT_COMMITHOOK;
2695     }
2696   }
2697 
2698   /* The simple case - no more than one database file (not counting the
2699   ** TEMP database) has a transaction active.   There is no need for the
2700   ** super-journal.
2701   **
2702   ** If the return value of sqlite3BtreeGetFilename() is a zero length
2703   ** string, it means the main database is :memory: or a temp file.  In
2704   ** that case we do not support atomic multi-file commits, so use the
2705   ** simple case then too.
2706   */
2707   if( 0==sqlite3Strlen30(sqlite3BtreeGetFilename(db->aDb[0].pBt))
2708    || nTrans<=1
2709   ){
2710     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2711       Btree *pBt = db->aDb[i].pBt;
2712       if( pBt ){
2713         rc = sqlite3BtreeCommitPhaseOne(pBt, 0);
2714       }
2715     }
2716 
2717     /* Do the commit only if all databases successfully complete phase 1.
2718     ** If one of the BtreeCommitPhaseOne() calls fails, this indicates an
2719     ** IO error while deleting or truncating a journal file. It is unlikely,
2720     ** but could happen. In this case abandon processing and return the error.
2721     */
2722     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2723       Btree *pBt = db->aDb[i].pBt;
2724       if( pBt ){
2725         rc = sqlite3BtreeCommitPhaseTwo(pBt, 0);
2726       }
2727     }
2728     if( rc==SQLITE_OK ){
2729       sqlite3VtabCommit(db);
2730     }
2731   }
2732 
2733   /* The complex case - There is a multi-file write-transaction active.
2734   ** This requires a super-journal file to ensure the transaction is
2735   ** committed atomically.
2736   */
2737 #ifndef SQLITE_OMIT_DISKIO
2738   else{
2739     sqlite3_vfs *pVfs = db->pVfs;
2740     char *zSuper = 0;   /* File-name for the super-journal */
2741     char const *zMainFile = sqlite3BtreeGetFilename(db->aDb[0].pBt);
2742     sqlite3_file *pSuperJrnl = 0;
2743     i64 offset = 0;
2744     int res;
2745     int retryCount = 0;
2746     int nMainFile;
2747 
2748     /* Select a super-journal file name */
2749     nMainFile = sqlite3Strlen30(zMainFile);
2750     zSuper = sqlite3MPrintf(db, "%.4c%s%.16c", 0,zMainFile,0);
2751     if( zSuper==0 ) return SQLITE_NOMEM_BKPT;
2752     zSuper += 4;
2753     do {
2754       u32 iRandom;
2755       if( retryCount ){
2756         if( retryCount>100 ){
2757           sqlite3_log(SQLITE_FULL, "MJ delete: %s", zSuper);
2758           sqlite3OsDelete(pVfs, zSuper, 0);
2759           break;
2760         }else if( retryCount==1 ){
2761           sqlite3_log(SQLITE_FULL, "MJ collide: %s", zSuper);
2762         }
2763       }
2764       retryCount++;
2765       sqlite3_randomness(sizeof(iRandom), &iRandom);
2766       sqlite3_snprintf(13, &zSuper[nMainFile], "-mj%06X9%02X",
2767                                (iRandom>>8)&0xffffff, iRandom&0xff);
2768       /* The antipenultimate character of the super-journal name must
2769       ** be "9" to avoid name collisions when using 8+3 filenames. */
2770       assert( zSuper[sqlite3Strlen30(zSuper)-3]=='9' );
2771       sqlite3FileSuffix3(zMainFile, zSuper);
2772       rc = sqlite3OsAccess(pVfs, zSuper, SQLITE_ACCESS_EXISTS, &res);
2773     }while( rc==SQLITE_OK && res );
2774     if( rc==SQLITE_OK ){
2775       /* Open the super-journal. */
2776       rc = sqlite3OsOpenMalloc(pVfs, zSuper, &pSuperJrnl,
2777           SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE|
2778           SQLITE_OPEN_EXCLUSIVE|SQLITE_OPEN_SUPER_JOURNAL, 0
2779       );
2780     }
2781     if( rc!=SQLITE_OK ){
2782       sqlite3DbFree(db, zSuper-4);
2783       return rc;
2784     }
2785 
2786     /* Write the name of each database file in the transaction into the new
2787     ** super-journal file. If an error occurs at this point close
2788     ** and delete the super-journal file. All the individual journal files
2789     ** still have 'null' as the super-journal pointer, so they will roll
2790     ** back independently if a failure occurs.
2791     */
2792     for(i=0; i<db->nDb; i++){
2793       Btree *pBt = db->aDb[i].pBt;
2794       if( sqlite3BtreeTxnState(pBt)==SQLITE_TXN_WRITE ){
2795         char const *zFile = sqlite3BtreeGetJournalname(pBt);
2796         if( zFile==0 ){
2797           continue;  /* Ignore TEMP and :memory: databases */
2798         }
2799         assert( zFile[0]!=0 );
2800         rc = sqlite3OsWrite(pSuperJrnl, zFile, sqlite3Strlen30(zFile)+1,offset);
2801         offset += sqlite3Strlen30(zFile)+1;
2802         if( rc!=SQLITE_OK ){
2803           sqlite3OsCloseFree(pSuperJrnl);
2804           sqlite3OsDelete(pVfs, zSuper, 0);
2805           sqlite3DbFree(db, zSuper-4);
2806           return rc;
2807         }
2808       }
2809     }
2810 
2811     /* Sync the super-journal file. If the IOCAP_SEQUENTIAL device
2812     ** flag is set this is not required.
2813     */
2814     if( 0==(sqlite3OsDeviceCharacteristics(pSuperJrnl)&SQLITE_IOCAP_SEQUENTIAL)
2815      && SQLITE_OK!=(rc = sqlite3OsSync(pSuperJrnl, SQLITE_SYNC_NORMAL))
2816     ){
2817       sqlite3OsCloseFree(pSuperJrnl);
2818       sqlite3OsDelete(pVfs, zSuper, 0);
2819       sqlite3DbFree(db, zSuper-4);
2820       return rc;
2821     }
2822 
2823     /* Sync all the db files involved in the transaction. The same call
2824     ** sets the super-journal pointer in each individual journal. If
2825     ** an error occurs here, do not delete the super-journal file.
2826     **
2827     ** If the error occurs during the first call to
2828     ** sqlite3BtreeCommitPhaseOne(), then there is a chance that the
2829     ** super-journal file will be orphaned. But we cannot delete it,
2830     ** in case the super-journal file name was written into the journal
2831     ** file before the failure occurred.
2832     */
2833     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2834       Btree *pBt = db->aDb[i].pBt;
2835       if( pBt ){
2836         rc = sqlite3BtreeCommitPhaseOne(pBt, zSuper);
2837       }
2838     }
2839     sqlite3OsCloseFree(pSuperJrnl);
2840     assert( rc!=SQLITE_BUSY );
2841     if( rc!=SQLITE_OK ){
2842       sqlite3DbFree(db, zSuper-4);
2843       return rc;
2844     }
2845 
2846     /* Delete the super-journal file. This commits the transaction. After
2847     ** doing this the directory is synced again before any individual
2848     ** transaction files are deleted.
2849     */
2850     rc = sqlite3OsDelete(pVfs, zSuper, 1);
2851     sqlite3DbFree(db, zSuper-4);
2852     zSuper = 0;
2853     if( rc ){
2854       return rc;
2855     }
2856 
2857     /* All files and directories have already been synced, so the following
2858     ** calls to sqlite3BtreeCommitPhaseTwo() are only closing files and
2859     ** deleting or truncating journals. If something goes wrong while
2860     ** this is happening we don't really care. The integrity of the
2861     ** transaction is already guaranteed, but some stray 'cold' journals
2862     ** may be lying around. Returning an error code won't help matters.
2863     */
2864     disable_simulated_io_errors();
2865     sqlite3BeginBenignMalloc();
2866     for(i=0; i<db->nDb; i++){
2867       Btree *pBt = db->aDb[i].pBt;
2868       if( pBt ){
2869         sqlite3BtreeCommitPhaseTwo(pBt, 1);
2870       }
2871     }
2872     sqlite3EndBenignMalloc();
2873     enable_simulated_io_errors();
2874 
2875     sqlite3VtabCommit(db);
2876   }
2877 #endif
2878 
2879   return rc;
2880 }
2881 
2882 /*
2883 ** This routine checks that the sqlite3.nVdbeActive count variable
2884 ** matches the number of vdbe's in the list sqlite3.pVdbe that are
2885 ** currently active. An assertion fails if the two counts do not match.
2886 ** This is an internal self-check only - it is not an essential processing
2887 ** step.
2888 **
2889 ** This is a no-op if NDEBUG is defined.
2890 */
2891 #ifndef NDEBUG
2892 static void checkActiveVdbeCnt(sqlite3 *db){
2893   Vdbe *p;
2894   int cnt = 0;
2895   int nWrite = 0;
2896   int nRead = 0;
2897   p = db->pVdbe;
2898   while( p ){
2899     if( sqlite3_stmt_busy((sqlite3_stmt*)p) ){
2900       cnt++;
2901       if( p->readOnly==0 ) nWrite++;
2902       if( p->bIsReader ) nRead++;
2903     }
2904     p = p->pNext;
2905   }
2906   assert( cnt==db->nVdbeActive );
2907   assert( nWrite==db->nVdbeWrite );
2908   assert( nRead==db->nVdbeRead );
2909 }
2910 #else
2911 #define checkActiveVdbeCnt(x)
2912 #endif
2913 
2914 /*
2915 ** If the Vdbe passed as the first argument opened a statement-transaction,
2916 ** close it now. Argument eOp must be either SAVEPOINT_ROLLBACK or
2917 ** SAVEPOINT_RELEASE. If it is SAVEPOINT_ROLLBACK, then the statement
2918 ** transaction is rolled back. If eOp is SAVEPOINT_RELEASE, then the
2919 ** statement transaction is committed.
2920 **
2921 ** If an IO error occurs, an SQLITE_IOERR_XXX error code is returned.
2922 ** Otherwise SQLITE_OK.
2923 */
2924 static SQLITE_NOINLINE int vdbeCloseStatement(Vdbe *p, int eOp){
2925   sqlite3 *const db = p->db;
2926   int rc = SQLITE_OK;
2927   int i;
2928   const int iSavepoint = p->iStatement-1;
2929 
2930   assert( eOp==SAVEPOINT_ROLLBACK || eOp==SAVEPOINT_RELEASE);
2931   assert( db->nStatement>0 );
2932   assert( p->iStatement==(db->nStatement+db->nSavepoint) );
2933 
2934   for(i=0; i<db->nDb; i++){
2935     int rc2 = SQLITE_OK;
2936     Btree *pBt = db->aDb[i].pBt;
2937     if( pBt ){
2938       if( eOp==SAVEPOINT_ROLLBACK ){
2939         rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_ROLLBACK, iSavepoint);
2940       }
2941       if( rc2==SQLITE_OK ){
2942         rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_RELEASE, iSavepoint);
2943       }
2944       if( rc==SQLITE_OK ){
2945         rc = rc2;
2946       }
2947     }
2948   }
2949   db->nStatement--;
2950   p->iStatement = 0;
2951 
2952   if( rc==SQLITE_OK ){
2953     if( eOp==SAVEPOINT_ROLLBACK ){
2954       rc = sqlite3VtabSavepoint(db, SAVEPOINT_ROLLBACK, iSavepoint);
2955     }
2956     if( rc==SQLITE_OK ){
2957       rc = sqlite3VtabSavepoint(db, SAVEPOINT_RELEASE, iSavepoint);
2958     }
2959   }
2960 
2961   /* If the statement transaction is being rolled back, also restore the
2962   ** database handles deferred constraint counter to the value it had when
2963   ** the statement transaction was opened.  */
2964   if( eOp==SAVEPOINT_ROLLBACK ){
2965     db->nDeferredCons = p->nStmtDefCons;
2966     db->nDeferredImmCons = p->nStmtDefImmCons;
2967   }
2968   return rc;
2969 }
2970 int sqlite3VdbeCloseStatement(Vdbe *p, int eOp){
2971   if( p->db->nStatement && p->iStatement ){
2972     return vdbeCloseStatement(p, eOp);
2973   }
2974   return SQLITE_OK;
2975 }
2976 
2977 
2978 /*
2979 ** This function is called when a transaction opened by the database
2980 ** handle associated with the VM passed as an argument is about to be
2981 ** committed. If there are outstanding deferred foreign key constraint
2982 ** violations, return SQLITE_ERROR. Otherwise, SQLITE_OK.
2983 **
2984 ** If there are outstanding FK violations and this function returns
2985 ** SQLITE_ERROR, set the result of the VM to SQLITE_CONSTRAINT_FOREIGNKEY
2986 ** and write an error message to it. Then return SQLITE_ERROR.
2987 */
2988 #ifndef SQLITE_OMIT_FOREIGN_KEY
2989 int sqlite3VdbeCheckFk(Vdbe *p, int deferred){
2990   sqlite3 *db = p->db;
2991   if( (deferred && (db->nDeferredCons+db->nDeferredImmCons)>0)
2992    || (!deferred && p->nFkConstraint>0)
2993   ){
2994     p->rc = SQLITE_CONSTRAINT_FOREIGNKEY;
2995     p->errorAction = OE_Abort;
2996     sqlite3VdbeError(p, "FOREIGN KEY constraint failed");
2997     return SQLITE_ERROR;
2998   }
2999   return SQLITE_OK;
3000 }
3001 #endif
3002 
3003 /*
3004 ** This routine is called the when a VDBE tries to halt.  If the VDBE
3005 ** has made changes and is in autocommit mode, then commit those
3006 ** changes.  If a rollback is needed, then do the rollback.
3007 **
3008 ** This routine is the only way to move the sqlite3eOpenState of a VM from
3009 ** SQLITE_STATE_RUN to SQLITE_STATE_HALT.  It is harmless to
3010 ** call this on a VM that is in the SQLITE_STATE_HALT state.
3011 **
3012 ** Return an error code.  If the commit could not complete because of
3013 ** lock contention, return SQLITE_BUSY.  If SQLITE_BUSY is returned, it
3014 ** means the close did not happen and needs to be repeated.
3015 */
3016 int sqlite3VdbeHalt(Vdbe *p){
3017   int rc;                         /* Used to store transient return codes */
3018   sqlite3 *db = p->db;
3019 
3020   /* This function contains the logic that determines if a statement or
3021   ** transaction will be committed or rolled back as a result of the
3022   ** execution of this virtual machine.
3023   **
3024   ** If any of the following errors occur:
3025   **
3026   **     SQLITE_NOMEM
3027   **     SQLITE_IOERR
3028   **     SQLITE_FULL
3029   **     SQLITE_INTERRUPT
3030   **
3031   ** Then the internal cache might have been left in an inconsistent
3032   ** state.  We need to rollback the statement transaction, if there is
3033   ** one, or the complete transaction if there is no statement transaction.
3034   */
3035 
3036   if( p->iVdbeMagic!=VDBE_MAGIC_RUN ){
3037     return SQLITE_OK;
3038   }
3039   if( db->mallocFailed ){
3040     p->rc = SQLITE_NOMEM_BKPT;
3041   }
3042   closeAllCursors(p);
3043   checkActiveVdbeCnt(db);
3044 
3045   /* No commit or rollback needed if the program never started or if the
3046   ** SQL statement does not read or write a database file.  */
3047   if( p->pc>=0 && p->bIsReader ){
3048     int mrc;   /* Primary error code from p->rc */
3049     int eStatementOp = 0;
3050     int isSpecialError;            /* Set to true if a 'special' error */
3051 
3052     /* Lock all btrees used by the statement */
3053     sqlite3VdbeEnter(p);
3054 
3055     /* Check for one of the special errors */
3056     if( p->rc ){
3057       mrc = p->rc & 0xff;
3058       isSpecialError = mrc==SQLITE_NOMEM
3059                     || mrc==SQLITE_IOERR
3060                     || mrc==SQLITE_INTERRUPT
3061                     || mrc==SQLITE_FULL;
3062     }else{
3063       mrc = isSpecialError = 0;
3064     }
3065     if( isSpecialError ){
3066       /* If the query was read-only and the error code is SQLITE_INTERRUPT,
3067       ** no rollback is necessary. Otherwise, at least a savepoint
3068       ** transaction must be rolled back to restore the database to a
3069       ** consistent state.
3070       **
3071       ** Even if the statement is read-only, it is important to perform
3072       ** a statement or transaction rollback operation. If the error
3073       ** occurred while writing to the journal, sub-journal or database
3074       ** file as part of an effort to free up cache space (see function
3075       ** pagerStress() in pager.c), the rollback is required to restore
3076       ** the pager to a consistent state.
3077       */
3078       if( !p->readOnly || mrc!=SQLITE_INTERRUPT ){
3079         if( (mrc==SQLITE_NOMEM || mrc==SQLITE_FULL) && p->usesStmtJournal ){
3080           eStatementOp = SAVEPOINT_ROLLBACK;
3081         }else{
3082           /* We are forced to roll back the active transaction. Before doing
3083           ** so, abort any other statements this handle currently has active.
3084           */
3085           sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
3086           sqlite3CloseSavepoints(db);
3087           db->autoCommit = 1;
3088           p->nChange = 0;
3089         }
3090       }
3091     }
3092 
3093     /* Check for immediate foreign key violations. */
3094     if( p->rc==SQLITE_OK || (p->errorAction==OE_Fail && !isSpecialError) ){
3095       sqlite3VdbeCheckFk(p, 0);
3096     }
3097 
3098     /* If the auto-commit flag is set and this is the only active writer
3099     ** VM, then we do either a commit or rollback of the current transaction.
3100     **
3101     ** Note: This block also runs if one of the special errors handled
3102     ** above has occurred.
3103     */
3104     if( !sqlite3VtabInSync(db)
3105      && db->autoCommit
3106      && db->nVdbeWrite==(p->readOnly==0)
3107     ){
3108       if( p->rc==SQLITE_OK || (p->errorAction==OE_Fail && !isSpecialError) ){
3109         rc = sqlite3VdbeCheckFk(p, 1);
3110         if( rc!=SQLITE_OK ){
3111           if( NEVER(p->readOnly) ){
3112             sqlite3VdbeLeave(p);
3113             return SQLITE_ERROR;
3114           }
3115           rc = SQLITE_CONSTRAINT_FOREIGNKEY;
3116         }else if( db->flags & SQLITE_CorruptRdOnly ){
3117           rc = SQLITE_CORRUPT;
3118           db->flags &= ~SQLITE_CorruptRdOnly;
3119         }else{
3120           /* The auto-commit flag is true, the vdbe program was successful
3121           ** or hit an 'OR FAIL' constraint and there are no deferred foreign
3122           ** key constraints to hold up the transaction. This means a commit
3123           ** is required. */
3124           rc = vdbeCommit(db, p);
3125         }
3126         if( rc==SQLITE_BUSY && p->readOnly ){
3127           sqlite3VdbeLeave(p);
3128           return SQLITE_BUSY;
3129         }else if( rc!=SQLITE_OK ){
3130           p->rc = rc;
3131           sqlite3RollbackAll(db, SQLITE_OK);
3132           p->nChange = 0;
3133         }else{
3134           db->nDeferredCons = 0;
3135           db->nDeferredImmCons = 0;
3136           db->flags &= ~(u64)SQLITE_DeferFKs;
3137           sqlite3CommitInternalChanges(db);
3138         }
3139       }else{
3140         sqlite3RollbackAll(db, SQLITE_OK);
3141         p->nChange = 0;
3142       }
3143       db->nStatement = 0;
3144     }else if( eStatementOp==0 ){
3145       if( p->rc==SQLITE_OK || p->errorAction==OE_Fail ){
3146         eStatementOp = SAVEPOINT_RELEASE;
3147       }else if( p->errorAction==OE_Abort ){
3148         eStatementOp = SAVEPOINT_ROLLBACK;
3149       }else{
3150         sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
3151         sqlite3CloseSavepoints(db);
3152         db->autoCommit = 1;
3153         p->nChange = 0;
3154       }
3155     }
3156 
3157     /* If eStatementOp is non-zero, then a statement transaction needs to
3158     ** be committed or rolled back. Call sqlite3VdbeCloseStatement() to
3159     ** do so. If this operation returns an error, and the current statement
3160     ** error code is SQLITE_OK or SQLITE_CONSTRAINT, then promote the
3161     ** current statement error code.
3162     */
3163     if( eStatementOp ){
3164       rc = sqlite3VdbeCloseStatement(p, eStatementOp);
3165       if( rc ){
3166         if( p->rc==SQLITE_OK || (p->rc&0xff)==SQLITE_CONSTRAINT ){
3167           p->rc = rc;
3168           sqlite3DbFree(db, p->zErrMsg);
3169           p->zErrMsg = 0;
3170         }
3171         sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
3172         sqlite3CloseSavepoints(db);
3173         db->autoCommit = 1;
3174         p->nChange = 0;
3175       }
3176     }
3177 
3178     /* If this was an INSERT, UPDATE or DELETE and no statement transaction
3179     ** has been rolled back, update the database connection change-counter.
3180     */
3181     if( p->changeCntOn ){
3182       if( eStatementOp!=SAVEPOINT_ROLLBACK ){
3183         sqlite3VdbeSetChanges(db, p->nChange);
3184       }else{
3185         sqlite3VdbeSetChanges(db, 0);
3186       }
3187       p->nChange = 0;
3188     }
3189 
3190     /* Release the locks */
3191     sqlite3VdbeLeave(p);
3192   }
3193 
3194   /* We have successfully halted and closed the VM.  Record this fact. */
3195   if( p->pc>=0 ){
3196     db->nVdbeActive--;
3197     if( !p->readOnly ) db->nVdbeWrite--;
3198     if( p->bIsReader ) db->nVdbeRead--;
3199     assert( db->nVdbeActive>=db->nVdbeRead );
3200     assert( db->nVdbeRead>=db->nVdbeWrite );
3201     assert( db->nVdbeWrite>=0 );
3202   }
3203   p->iVdbeMagic = VDBE_MAGIC_HALT;
3204   checkActiveVdbeCnt(db);
3205   if( db->mallocFailed ){
3206     p->rc = SQLITE_NOMEM_BKPT;
3207   }
3208 
3209   /* If the auto-commit flag is set to true, then any locks that were held
3210   ** by connection db have now been released. Call sqlite3ConnectionUnlocked()
3211   ** to invoke any required unlock-notify callbacks.
3212   */
3213   if( db->autoCommit ){
3214     sqlite3ConnectionUnlocked(db);
3215   }
3216 
3217   assert( db->nVdbeActive>0 || db->autoCommit==0 || db->nStatement==0 );
3218   return (p->rc==SQLITE_BUSY ? SQLITE_BUSY : SQLITE_OK);
3219 }
3220 
3221 
3222 /*
3223 ** Each VDBE holds the result of the most recent sqlite3_step() call
3224 ** in p->rc.  This routine sets that result back to SQLITE_OK.
3225 */
3226 void sqlite3VdbeResetStepResult(Vdbe *p){
3227   p->rc = SQLITE_OK;
3228 }
3229 
3230 /*
3231 ** Copy the error code and error message belonging to the VDBE passed
3232 ** as the first argument to its database handle (so that they will be
3233 ** returned by calls to sqlite3_errcode() and sqlite3_errmsg()).
3234 **
3235 ** This function does not clear the VDBE error code or message, just
3236 ** copies them to the database handle.
3237 */
3238 int sqlite3VdbeTransferError(Vdbe *p){
3239   sqlite3 *db = p->db;
3240   int rc = p->rc;
3241   if( p->zErrMsg ){
3242     db->bBenignMalloc++;
3243     sqlite3BeginBenignMalloc();
3244     if( db->pErr==0 ) db->pErr = sqlite3ValueNew(db);
3245     sqlite3ValueSetStr(db->pErr, -1, p->zErrMsg, SQLITE_UTF8, SQLITE_TRANSIENT);
3246     sqlite3EndBenignMalloc();
3247     db->bBenignMalloc--;
3248   }else if( db->pErr ){
3249     sqlite3ValueSetNull(db->pErr);
3250   }
3251   db->errCode = rc;
3252   db->errByteOffset = -1;
3253   return rc;
3254 }
3255 
3256 #ifdef SQLITE_ENABLE_SQLLOG
3257 /*
3258 ** If an SQLITE_CONFIG_SQLLOG hook is registered and the VM has been run,
3259 ** invoke it.
3260 */
3261 static void vdbeInvokeSqllog(Vdbe *v){
3262   if( sqlite3GlobalConfig.xSqllog && v->rc==SQLITE_OK && v->zSql && v->pc>=0 ){
3263     char *zExpanded = sqlite3VdbeExpandSql(v, v->zSql);
3264     assert( v->db->init.busy==0 );
3265     if( zExpanded ){
3266       sqlite3GlobalConfig.xSqllog(
3267           sqlite3GlobalConfig.pSqllogArg, v->db, zExpanded, 1
3268       );
3269       sqlite3DbFree(v->db, zExpanded);
3270     }
3271   }
3272 }
3273 #else
3274 # define vdbeInvokeSqllog(x)
3275 #endif
3276 
3277 /*
3278 ** Clean up a VDBE after execution but do not delete the VDBE just yet.
3279 ** Write any error messages into *pzErrMsg.  Return the result code.
3280 **
3281 ** After this routine is run, the VDBE should be ready to be executed
3282 ** again.
3283 **
3284 ** To look at it another way, this routine resets the state of the
3285 ** virtual machine from VDBE_MAGIC_RUN or VDBE_MAGIC_HALT back to
3286 ** VDBE_MAGIC_INIT.
3287 */
3288 int sqlite3VdbeReset(Vdbe *p){
3289 #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
3290   int i;
3291 #endif
3292 
3293   sqlite3 *db;
3294   db = p->db;
3295 
3296   /* If the VM did not run to completion or if it encountered an
3297   ** error, then it might not have been halted properly.  So halt
3298   ** it now.
3299   */
3300   sqlite3VdbeHalt(p);
3301 
3302   /* If the VDBE has been run even partially, then transfer the error code
3303   ** and error message from the VDBE into the main database structure.  But
3304   ** if the VDBE has just been set to run but has not actually executed any
3305   ** instructions yet, leave the main database error information unchanged.
3306   */
3307   if( p->pc>=0 ){
3308     vdbeInvokeSqllog(p);
3309     if( db->pErr || p->zErrMsg ){
3310       sqlite3VdbeTransferError(p);
3311     }else{
3312       db->errCode = p->rc;
3313     }
3314     if( p->runOnlyOnce ) p->expired = 1;
3315   }else if( p->rc && p->expired ){
3316     /* The expired flag was set on the VDBE before the first call
3317     ** to sqlite3_step(). For consistency (since sqlite3_step() was
3318     ** called), set the database error in this case as well.
3319     */
3320     sqlite3ErrorWithMsg(db, p->rc, p->zErrMsg ? "%s" : 0, p->zErrMsg);
3321   }
3322 
3323   /* Reset register contents and reclaim error message memory.
3324   */
3325 #ifdef SQLITE_DEBUG
3326   /* Execute assert() statements to ensure that the Vdbe.apCsr[] and
3327   ** Vdbe.aMem[] arrays have already been cleaned up.  */
3328   if( p->apCsr ) for(i=0; i<p->nCursor; i++) assert( p->apCsr[i]==0 );
3329   if( p->aMem ){
3330     for(i=0; i<p->nMem; i++) assert( p->aMem[i].flags==MEM_Undefined );
3331   }
3332 #endif
3333   if( p->zErrMsg ){
3334     sqlite3DbFree(db, p->zErrMsg);
3335     p->zErrMsg = 0;
3336   }
3337   p->pResultSet = 0;
3338 #ifdef SQLITE_DEBUG
3339   p->nWrite = 0;
3340 #endif
3341 
3342   /* Save profiling information from this VDBE run.
3343   */
3344 #ifdef VDBE_PROFILE
3345   {
3346     FILE *out = fopen("vdbe_profile.out", "a");
3347     if( out ){
3348       fprintf(out, "---- ");
3349       for(i=0; i<p->nOp; i++){
3350         fprintf(out, "%02x", p->aOp[i].opcode);
3351       }
3352       fprintf(out, "\n");
3353       if( p->zSql ){
3354         char c, pc = 0;
3355         fprintf(out, "-- ");
3356         for(i=0; (c = p->zSql[i])!=0; i++){
3357           if( pc=='\n' ) fprintf(out, "-- ");
3358           putc(c, out);
3359           pc = c;
3360         }
3361         if( pc!='\n' ) fprintf(out, "\n");
3362       }
3363       for(i=0; i<p->nOp; i++){
3364         char zHdr[100];
3365         sqlite3_snprintf(sizeof(zHdr), zHdr, "%6u %12llu %8llu ",
3366            p->aOp[i].cnt,
3367            p->aOp[i].cycles,
3368            p->aOp[i].cnt>0 ? p->aOp[i].cycles/p->aOp[i].cnt : 0
3369         );
3370         fprintf(out, "%s", zHdr);
3371         sqlite3VdbePrintOp(out, i, &p->aOp[i]);
3372       }
3373       fclose(out);
3374     }
3375   }
3376 #endif
3377   p->iVdbeMagic = VDBE_MAGIC_RESET;
3378   return p->rc & db->errMask;
3379 }
3380 
3381 /*
3382 ** Clean up and delete a VDBE after execution.  Return an integer which is
3383 ** the result code.  Write any error message text into *pzErrMsg.
3384 */
3385 int sqlite3VdbeFinalize(Vdbe *p){
3386   int rc = SQLITE_OK;
3387   if( p->iVdbeMagic==VDBE_MAGIC_RUN || p->iVdbeMagic==VDBE_MAGIC_HALT ){
3388     rc = sqlite3VdbeReset(p);
3389     assert( (rc & p->db->errMask)==rc );
3390   }
3391   sqlite3VdbeDelete(p);
3392   return rc;
3393 }
3394 
3395 /*
3396 ** If parameter iOp is less than zero, then invoke the destructor for
3397 ** all auxiliary data pointers currently cached by the VM passed as
3398 ** the first argument.
3399 **
3400 ** Or, if iOp is greater than or equal to zero, then the destructor is
3401 ** only invoked for those auxiliary data pointers created by the user
3402 ** function invoked by the OP_Function opcode at instruction iOp of
3403 ** VM pVdbe, and only then if:
3404 **
3405 **    * the associated function parameter is the 32nd or later (counting
3406 **      from left to right), or
3407 **
3408 **    * the corresponding bit in argument mask is clear (where the first
3409 **      function parameter corresponds to bit 0 etc.).
3410 */
3411 void sqlite3VdbeDeleteAuxData(sqlite3 *db, AuxData **pp, int iOp, int mask){
3412   while( *pp ){
3413     AuxData *pAux = *pp;
3414     if( (iOp<0)
3415      || (pAux->iAuxOp==iOp
3416           && pAux->iAuxArg>=0
3417           && (pAux->iAuxArg>31 || !(mask & MASKBIT32(pAux->iAuxArg))))
3418     ){
3419       testcase( pAux->iAuxArg==31 );
3420       if( pAux->xDeleteAux ){
3421         pAux->xDeleteAux(pAux->pAux);
3422       }
3423       *pp = pAux->pNextAux;
3424       sqlite3DbFree(db, pAux);
3425     }else{
3426       pp= &pAux->pNextAux;
3427     }
3428   }
3429 }
3430 
3431 /*
3432 ** Free all memory associated with the Vdbe passed as the second argument,
3433 ** except for object itself, which is preserved.
3434 **
3435 ** The difference between this function and sqlite3VdbeDelete() is that
3436 ** VdbeDelete() also unlinks the Vdbe from the list of VMs associated with
3437 ** the database connection and frees the object itself.
3438 */
3439 void sqlite3VdbeClearObject(sqlite3 *db, Vdbe *p){
3440   SubProgram *pSub, *pNext;
3441   assert( p->db==0 || p->db==db );
3442   releaseMemArray(p->aColName, p->nResColumn*COLNAME_N);
3443   for(pSub=p->pProgram; pSub; pSub=pNext){
3444     pNext = pSub->pNext;
3445     vdbeFreeOpArray(db, pSub->aOp, pSub->nOp);
3446     sqlite3DbFree(db, pSub);
3447   }
3448   if( p->iVdbeMagic!=VDBE_MAGIC_INIT ){
3449     releaseMemArray(p->aVar, p->nVar);
3450     sqlite3DbFree(db, p->pVList);
3451     sqlite3DbFree(db, p->pFree);
3452   }
3453   vdbeFreeOpArray(db, p->aOp, p->nOp);
3454   sqlite3DbFree(db, p->aColName);
3455   sqlite3DbFree(db, p->zSql);
3456 #ifdef SQLITE_ENABLE_NORMALIZE
3457   sqlite3DbFree(db, p->zNormSql);
3458   {
3459     DblquoteStr *pThis, *pNext;
3460     for(pThis=p->pDblStr; pThis; pThis=pNext){
3461       pNext = pThis->pNextStr;
3462       sqlite3DbFree(db, pThis);
3463     }
3464   }
3465 #endif
3466 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
3467   {
3468     int i;
3469     for(i=0; i<p->nScan; i++){
3470       sqlite3DbFree(db, p->aScan[i].zName);
3471     }
3472     sqlite3DbFree(db, p->aScan);
3473   }
3474 #endif
3475 }
3476 
3477 /*
3478 ** Delete an entire VDBE.
3479 */
3480 void sqlite3VdbeDelete(Vdbe *p){
3481   sqlite3 *db;
3482 
3483   assert( p!=0 );
3484   db = p->db;
3485   assert( sqlite3_mutex_held(db->mutex) );
3486   sqlite3VdbeClearObject(db, p);
3487   if( p->pPrev ){
3488     p->pPrev->pNext = p->pNext;
3489   }else{
3490     assert( db->pVdbe==p );
3491     db->pVdbe = p->pNext;
3492   }
3493   if( p->pNext ){
3494     p->pNext->pPrev = p->pPrev;
3495   }
3496   p->iVdbeMagic = VDBE_MAGIC_DEAD;
3497   p->db = 0;
3498   sqlite3DbFreeNN(db, p);
3499 }
3500 
3501 /*
3502 ** The cursor "p" has a pending seek operation that has not yet been
3503 ** carried out.  Seek the cursor now.  If an error occurs, return
3504 ** the appropriate error code.
3505 */
3506 int SQLITE_NOINLINE sqlite3VdbeFinishMoveto(VdbeCursor *p){
3507   int res, rc;
3508 #ifdef SQLITE_TEST
3509   extern int sqlite3_search_count;
3510 #endif
3511   assert( p->deferredMoveto );
3512   assert( p->isTable );
3513   assert( p->eCurType==CURTYPE_BTREE );
3514   rc = sqlite3BtreeTableMoveto(p->uc.pCursor, p->movetoTarget, 0, &res);
3515   if( rc ) return rc;
3516   if( res!=0 ) return SQLITE_CORRUPT_BKPT;
3517 #ifdef SQLITE_TEST
3518   sqlite3_search_count++;
3519 #endif
3520   p->deferredMoveto = 0;
3521   p->cacheStatus = CACHE_STALE;
3522   return SQLITE_OK;
3523 }
3524 
3525 /*
3526 ** Something has moved cursor "p" out of place.  Maybe the row it was
3527 ** pointed to was deleted out from under it.  Or maybe the btree was
3528 ** rebalanced.  Whatever the cause, try to restore "p" to the place it
3529 ** is supposed to be pointing.  If the row was deleted out from under the
3530 ** cursor, set the cursor to point to a NULL row.
3531 */
3532 static int SQLITE_NOINLINE handleMovedCursor(VdbeCursor *p){
3533   int isDifferentRow, rc;
3534   assert( p->eCurType==CURTYPE_BTREE );
3535   assert( p->uc.pCursor!=0 );
3536   assert( sqlite3BtreeCursorHasMoved(p->uc.pCursor) );
3537   rc = sqlite3BtreeCursorRestore(p->uc.pCursor, &isDifferentRow);
3538   p->cacheStatus = CACHE_STALE;
3539   if( isDifferentRow ) p->nullRow = 1;
3540   return rc;
3541 }
3542 
3543 /*
3544 ** Check to ensure that the cursor is valid.  Restore the cursor
3545 ** if need be.  Return any I/O error from the restore operation.
3546 */
3547 int sqlite3VdbeCursorRestore(VdbeCursor *p){
3548   assert( p->eCurType==CURTYPE_BTREE );
3549   if( sqlite3BtreeCursorHasMoved(p->uc.pCursor) ){
3550     return handleMovedCursor(p);
3551   }
3552   return SQLITE_OK;
3553 }
3554 
3555 /*
3556 ** Make sure the cursor p is ready to read or write the row to which it
3557 ** was last positioned.  Return an error code if an OOM fault or I/O error
3558 ** prevents us from positioning the cursor to its correct position.
3559 **
3560 ** If a MoveTo operation is pending on the given cursor, then do that
3561 ** MoveTo now.  If no move is pending, check to see if the row has been
3562 ** deleted out from under the cursor and if it has, mark the row as
3563 ** a NULL row.
3564 **
3565 ** If the cursor is already pointing to the correct row and that row has
3566 ** not been deleted out from under the cursor, then this routine is a no-op.
3567 */
3568 int sqlite3VdbeCursorMoveto(VdbeCursor **pp, u32 *piCol){
3569   VdbeCursor *p = *pp;
3570   assert( p->eCurType==CURTYPE_BTREE || p->eCurType==CURTYPE_PSEUDO );
3571   if( p->deferredMoveto ){
3572     u32 iMap;
3573     assert( !p->isEphemeral );
3574     if( p->ub.aAltMap && (iMap = p->ub.aAltMap[1+*piCol])>0 && !p->nullRow ){
3575       *pp = p->pAltCursor;
3576       *piCol = iMap - 1;
3577       return SQLITE_OK;
3578     }
3579     return sqlite3VdbeFinishMoveto(p);
3580   }
3581   if( sqlite3BtreeCursorHasMoved(p->uc.pCursor) ){
3582     return handleMovedCursor(p);
3583   }
3584   return SQLITE_OK;
3585 }
3586 
3587 /*
3588 ** The following functions:
3589 **
3590 ** sqlite3VdbeSerialType()
3591 ** sqlite3VdbeSerialTypeLen()
3592 ** sqlite3VdbeSerialLen()
3593 ** sqlite3VdbeSerialPut()
3594 ** sqlite3VdbeSerialGet()
3595 **
3596 ** encapsulate the code that serializes values for storage in SQLite
3597 ** data and index records. Each serialized value consists of a
3598 ** 'serial-type' and a blob of data. The serial type is an 8-byte unsigned
3599 ** integer, stored as a varint.
3600 **
3601 ** In an SQLite index record, the serial type is stored directly before
3602 ** the blob of data that it corresponds to. In a table record, all serial
3603 ** types are stored at the start of the record, and the blobs of data at
3604 ** the end. Hence these functions allow the caller to handle the
3605 ** serial-type and data blob separately.
3606 **
3607 ** The following table describes the various storage classes for data:
3608 **
3609 **   serial type        bytes of data      type
3610 **   --------------     ---------------    ---------------
3611 **      0                     0            NULL
3612 **      1                     1            signed integer
3613 **      2                     2            signed integer
3614 **      3                     3            signed integer
3615 **      4                     4            signed integer
3616 **      5                     6            signed integer
3617 **      6                     8            signed integer
3618 **      7                     8            IEEE float
3619 **      8                     0            Integer constant 0
3620 **      9                     0            Integer constant 1
3621 **     10,11                               reserved for expansion
3622 **    N>=12 and even       (N-12)/2        BLOB
3623 **    N>=13 and odd        (N-13)/2        text
3624 **
3625 ** The 8 and 9 types were added in 3.3.0, file format 4.  Prior versions
3626 ** of SQLite will not understand those serial types.
3627 */
3628 
3629 #if 0 /* Inlined into the OP_MakeRecord opcode */
3630 /*
3631 ** Return the serial-type for the value stored in pMem.
3632 **
3633 ** This routine might convert a large MEM_IntReal value into MEM_Real.
3634 **
3635 ** 2019-07-11:  The primary user of this subroutine was the OP_MakeRecord
3636 ** opcode in the byte-code engine.  But by moving this routine in-line, we
3637 ** can omit some redundant tests and make that opcode a lot faster.  So
3638 ** this routine is now only used by the STAT3 logic and STAT3 support has
3639 ** ended.  The code is kept here for historical reference only.
3640 */
3641 u32 sqlite3VdbeSerialType(Mem *pMem, int file_format, u32 *pLen){
3642   int flags = pMem->flags;
3643   u32 n;
3644 
3645   assert( pLen!=0 );
3646   if( flags&MEM_Null ){
3647     *pLen = 0;
3648     return 0;
3649   }
3650   if( flags&(MEM_Int|MEM_IntReal) ){
3651     /* Figure out whether to use 1, 2, 4, 6 or 8 bytes. */
3652 #   define MAX_6BYTE ((((i64)0x00008000)<<32)-1)
3653     i64 i = pMem->u.i;
3654     u64 u;
3655     testcase( flags & MEM_Int );
3656     testcase( flags & MEM_IntReal );
3657     if( i<0 ){
3658       u = ~i;
3659     }else{
3660       u = i;
3661     }
3662     if( u<=127 ){
3663       if( (i&1)==i && file_format>=4 ){
3664         *pLen = 0;
3665         return 8+(u32)u;
3666       }else{
3667         *pLen = 1;
3668         return 1;
3669       }
3670     }
3671     if( u<=32767 ){ *pLen = 2; return 2; }
3672     if( u<=8388607 ){ *pLen = 3; return 3; }
3673     if( u<=2147483647 ){ *pLen = 4; return 4; }
3674     if( u<=MAX_6BYTE ){ *pLen = 6; return 5; }
3675     *pLen = 8;
3676     if( flags&MEM_IntReal ){
3677       /* If the value is IntReal and is going to take up 8 bytes to store
3678       ** as an integer, then we might as well make it an 8-byte floating
3679       ** point value */
3680       pMem->u.r = (double)pMem->u.i;
3681       pMem->flags &= ~MEM_IntReal;
3682       pMem->flags |= MEM_Real;
3683       return 7;
3684     }
3685     return 6;
3686   }
3687   if( flags&MEM_Real ){
3688     *pLen = 8;
3689     return 7;
3690   }
3691   assert( pMem->db->mallocFailed || flags&(MEM_Str|MEM_Blob) );
3692   assert( pMem->n>=0 );
3693   n = (u32)pMem->n;
3694   if( flags & MEM_Zero ){
3695     n += pMem->u.nZero;
3696   }
3697   *pLen = n;
3698   return ((n*2) + 12 + ((flags&MEM_Str)!=0));
3699 }
3700 #endif /* inlined into OP_MakeRecord */
3701 
3702 /*
3703 ** The sizes for serial types less than 128
3704 */
3705 static const u8 sqlite3SmallTypeSizes[] = {
3706         /*  0   1   2   3   4   5   6   7   8   9 */
3707 /*   0 */   0,  1,  2,  3,  4,  6,  8,  8,  0,  0,
3708 /*  10 */   0,  0,  0,  0,  1,  1,  2,  2,  3,  3,
3709 /*  20 */   4,  4,  5,  5,  6,  6,  7,  7,  8,  8,
3710 /*  30 */   9,  9, 10, 10, 11, 11, 12, 12, 13, 13,
3711 /*  40 */  14, 14, 15, 15, 16, 16, 17, 17, 18, 18,
3712 /*  50 */  19, 19, 20, 20, 21, 21, 22, 22, 23, 23,
3713 /*  60 */  24, 24, 25, 25, 26, 26, 27, 27, 28, 28,
3714 /*  70 */  29, 29, 30, 30, 31, 31, 32, 32, 33, 33,
3715 /*  80 */  34, 34, 35, 35, 36, 36, 37, 37, 38, 38,
3716 /*  90 */  39, 39, 40, 40, 41, 41, 42, 42, 43, 43,
3717 /* 100 */  44, 44, 45, 45, 46, 46, 47, 47, 48, 48,
3718 /* 110 */  49, 49, 50, 50, 51, 51, 52, 52, 53, 53,
3719 /* 120 */  54, 54, 55, 55, 56, 56, 57, 57
3720 };
3721 
3722 /*
3723 ** Return the length of the data corresponding to the supplied serial-type.
3724 */
3725 u32 sqlite3VdbeSerialTypeLen(u32 serial_type){
3726   if( serial_type>=128 ){
3727     return (serial_type-12)/2;
3728   }else{
3729     assert( serial_type<12
3730             || sqlite3SmallTypeSizes[serial_type]==(serial_type - 12)/2 );
3731     return sqlite3SmallTypeSizes[serial_type];
3732   }
3733 }
3734 u8 sqlite3VdbeOneByteSerialTypeLen(u8 serial_type){
3735   assert( serial_type<128 );
3736   return sqlite3SmallTypeSizes[serial_type];
3737 }
3738 
3739 /*
3740 ** If we are on an architecture with mixed-endian floating
3741 ** points (ex: ARM7) then swap the lower 4 bytes with the
3742 ** upper 4 bytes.  Return the result.
3743 **
3744 ** For most architectures, this is a no-op.
3745 **
3746 ** (later):  It is reported to me that the mixed-endian problem
3747 ** on ARM7 is an issue with GCC, not with the ARM7 chip.  It seems
3748 ** that early versions of GCC stored the two words of a 64-bit
3749 ** float in the wrong order.  And that error has been propagated
3750 ** ever since.  The blame is not necessarily with GCC, though.
3751 ** GCC might have just copying the problem from a prior compiler.
3752 ** I am also told that newer versions of GCC that follow a different
3753 ** ABI get the byte order right.
3754 **
3755 ** Developers using SQLite on an ARM7 should compile and run their
3756 ** application using -DSQLITE_DEBUG=1 at least once.  With DEBUG
3757 ** enabled, some asserts below will ensure that the byte order of
3758 ** floating point values is correct.
3759 **
3760 ** (2007-08-30)  Frank van Vugt has studied this problem closely
3761 ** and has send his findings to the SQLite developers.  Frank
3762 ** writes that some Linux kernels offer floating point hardware
3763 ** emulation that uses only 32-bit mantissas instead of a full
3764 ** 48-bits as required by the IEEE standard.  (This is the
3765 ** CONFIG_FPE_FASTFPE option.)  On such systems, floating point
3766 ** byte swapping becomes very complicated.  To avoid problems,
3767 ** the necessary byte swapping is carried out using a 64-bit integer
3768 ** rather than a 64-bit float.  Frank assures us that the code here
3769 ** works for him.  We, the developers, have no way to independently
3770 ** verify this, but Frank seems to know what he is talking about
3771 ** so we trust him.
3772 */
3773 #ifdef SQLITE_MIXED_ENDIAN_64BIT_FLOAT
3774 static u64 floatSwap(u64 in){
3775   union {
3776     u64 r;
3777     u32 i[2];
3778   } u;
3779   u32 t;
3780 
3781   u.r = in;
3782   t = u.i[0];
3783   u.i[0] = u.i[1];
3784   u.i[1] = t;
3785   return u.r;
3786 }
3787 # define swapMixedEndianFloat(X)  X = floatSwap(X)
3788 #else
3789 # define swapMixedEndianFloat(X)
3790 #endif
3791 
3792 /*
3793 ** Write the serialized data blob for the value stored in pMem into
3794 ** buf. It is assumed that the caller has allocated sufficient space.
3795 ** Return the number of bytes written.
3796 **
3797 ** nBuf is the amount of space left in buf[].  The caller is responsible
3798 ** for allocating enough space to buf[] to hold the entire field, exclusive
3799 ** of the pMem->u.nZero bytes for a MEM_Zero value.
3800 **
3801 ** Return the number of bytes actually written into buf[].  The number
3802 ** of bytes in the zero-filled tail is included in the return value only
3803 ** if those bytes were zeroed in buf[].
3804 */
3805 u32 sqlite3VdbeSerialPut(u8 *buf, Mem *pMem, u32 serial_type){
3806   u32 len;
3807 
3808   /* Integer and Real */
3809   if( serial_type<=7 && serial_type>0 ){
3810     u64 v;
3811     u32 i;
3812     if( serial_type==7 ){
3813       assert( sizeof(v)==sizeof(pMem->u.r) );
3814       memcpy(&v, &pMem->u.r, sizeof(v));
3815       swapMixedEndianFloat(v);
3816     }else{
3817       v = pMem->u.i;
3818     }
3819     len = i = sqlite3SmallTypeSizes[serial_type];
3820     assert( i>0 );
3821     do{
3822       buf[--i] = (u8)(v&0xFF);
3823       v >>= 8;
3824     }while( i );
3825     return len;
3826   }
3827 
3828   /* String or blob */
3829   if( serial_type>=12 ){
3830     assert( pMem->n + ((pMem->flags & MEM_Zero)?pMem->u.nZero:0)
3831              == (int)sqlite3VdbeSerialTypeLen(serial_type) );
3832     len = pMem->n;
3833     if( len>0 ) memcpy(buf, pMem->z, len);
3834     return len;
3835   }
3836 
3837   /* NULL or constants 0 or 1 */
3838   return 0;
3839 }
3840 
3841 /* Input "x" is a sequence of unsigned characters that represent a
3842 ** big-endian integer.  Return the equivalent native integer
3843 */
3844 #define ONE_BYTE_INT(x)    ((i8)(x)[0])
3845 #define TWO_BYTE_INT(x)    (256*(i8)((x)[0])|(x)[1])
3846 #define THREE_BYTE_INT(x)  (65536*(i8)((x)[0])|((x)[1]<<8)|(x)[2])
3847 #define FOUR_BYTE_UINT(x)  (((u32)(x)[0]<<24)|((x)[1]<<16)|((x)[2]<<8)|(x)[3])
3848 #define FOUR_BYTE_INT(x) (16777216*(i8)((x)[0])|((x)[1]<<16)|((x)[2]<<8)|(x)[3])
3849 
3850 /*
3851 ** Deserialize the data blob pointed to by buf as serial type serial_type
3852 ** and store the result in pMem.
3853 **
3854 ** This function is implemented as two separate routines for performance.
3855 ** The few cases that require local variables are broken out into a separate
3856 ** routine so that in most cases the overhead of moving the stack pointer
3857 ** is avoided.
3858 */
3859 static void serialGet(
3860   const unsigned char *buf,     /* Buffer to deserialize from */
3861   u32 serial_type,              /* Serial type to deserialize */
3862   Mem *pMem                     /* Memory cell to write value into */
3863 ){
3864   u64 x = FOUR_BYTE_UINT(buf);
3865   u32 y = FOUR_BYTE_UINT(buf+4);
3866   x = (x<<32) + y;
3867   if( serial_type==6 ){
3868     /* EVIDENCE-OF: R-29851-52272 Value is a big-endian 64-bit
3869     ** twos-complement integer. */
3870     pMem->u.i = *(i64*)&x;
3871     pMem->flags = MEM_Int;
3872     testcase( pMem->u.i<0 );
3873   }else{
3874     /* EVIDENCE-OF: R-57343-49114 Value is a big-endian IEEE 754-2008 64-bit
3875     ** floating point number. */
3876 #if !defined(NDEBUG) && !defined(SQLITE_OMIT_FLOATING_POINT)
3877     /* Verify that integers and floating point values use the same
3878     ** byte order.  Or, that if SQLITE_MIXED_ENDIAN_64BIT_FLOAT is
3879     ** defined that 64-bit floating point values really are mixed
3880     ** endian.
3881     */
3882     static const u64 t1 = ((u64)0x3ff00000)<<32;
3883     static const double r1 = 1.0;
3884     u64 t2 = t1;
3885     swapMixedEndianFloat(t2);
3886     assert( sizeof(r1)==sizeof(t2) && memcmp(&r1, &t2, sizeof(r1))==0 );
3887 #endif
3888     assert( sizeof(x)==8 && sizeof(pMem->u.r)==8 );
3889     swapMixedEndianFloat(x);
3890     memcpy(&pMem->u.r, &x, sizeof(x));
3891     pMem->flags = IsNaN(x) ? MEM_Null : MEM_Real;
3892   }
3893 }
3894 void sqlite3VdbeSerialGet(
3895   const unsigned char *buf,     /* Buffer to deserialize from */
3896   u32 serial_type,              /* Serial type to deserialize */
3897   Mem *pMem                     /* Memory cell to write value into */
3898 ){
3899   switch( serial_type ){
3900     case 10: { /* Internal use only: NULL with virtual table
3901                ** UPDATE no-change flag set */
3902       pMem->flags = MEM_Null|MEM_Zero;
3903       pMem->n = 0;
3904       pMem->u.nZero = 0;
3905       return;
3906     }
3907     case 11:   /* Reserved for future use */
3908     case 0: {  /* Null */
3909       /* EVIDENCE-OF: R-24078-09375 Value is a NULL. */
3910       pMem->flags = MEM_Null;
3911       return;
3912     }
3913     case 1: {
3914       /* EVIDENCE-OF: R-44885-25196 Value is an 8-bit twos-complement
3915       ** integer. */
3916       pMem->u.i = ONE_BYTE_INT(buf);
3917       pMem->flags = MEM_Int;
3918       testcase( pMem->u.i<0 );
3919       return;
3920     }
3921     case 2: { /* 2-byte signed integer */
3922       /* EVIDENCE-OF: R-49794-35026 Value is a big-endian 16-bit
3923       ** twos-complement integer. */
3924       pMem->u.i = TWO_BYTE_INT(buf);
3925       pMem->flags = MEM_Int;
3926       testcase( pMem->u.i<0 );
3927       return;
3928     }
3929     case 3: { /* 3-byte signed integer */
3930       /* EVIDENCE-OF: R-37839-54301 Value is a big-endian 24-bit
3931       ** twos-complement integer. */
3932       pMem->u.i = THREE_BYTE_INT(buf);
3933       pMem->flags = MEM_Int;
3934       testcase( pMem->u.i<0 );
3935       return;
3936     }
3937     case 4: { /* 4-byte signed integer */
3938       /* EVIDENCE-OF: R-01849-26079 Value is a big-endian 32-bit
3939       ** twos-complement integer. */
3940       pMem->u.i = FOUR_BYTE_INT(buf);
3941 #ifdef __HP_cc
3942       /* Work around a sign-extension bug in the HP compiler for HP/UX */
3943       if( buf[0]&0x80 ) pMem->u.i |= 0xffffffff80000000LL;
3944 #endif
3945       pMem->flags = MEM_Int;
3946       testcase( pMem->u.i<0 );
3947       return;
3948     }
3949     case 5: { /* 6-byte signed integer */
3950       /* EVIDENCE-OF: R-50385-09674 Value is a big-endian 48-bit
3951       ** twos-complement integer. */
3952       pMem->u.i = FOUR_BYTE_UINT(buf+2) + (((i64)1)<<32)*TWO_BYTE_INT(buf);
3953       pMem->flags = MEM_Int;
3954       testcase( pMem->u.i<0 );
3955       return;
3956     }
3957     case 6:   /* 8-byte signed integer */
3958     case 7: { /* IEEE floating point */
3959       /* These use local variables, so do them in a separate routine
3960       ** to avoid having to move the frame pointer in the common case */
3961       serialGet(buf,serial_type,pMem);
3962       return;
3963     }
3964     case 8:    /* Integer 0 */
3965     case 9: {  /* Integer 1 */
3966       /* EVIDENCE-OF: R-12976-22893 Value is the integer 0. */
3967       /* EVIDENCE-OF: R-18143-12121 Value is the integer 1. */
3968       pMem->u.i = serial_type-8;
3969       pMem->flags = MEM_Int;
3970       return;
3971     }
3972     default: {
3973       /* EVIDENCE-OF: R-14606-31564 Value is a BLOB that is (N-12)/2 bytes in
3974       ** length.
3975       ** EVIDENCE-OF: R-28401-00140 Value is a string in the text encoding and
3976       ** (N-13)/2 bytes in length. */
3977       static const u16 aFlag[] = { MEM_Blob|MEM_Ephem, MEM_Str|MEM_Ephem };
3978       pMem->z = (char *)buf;
3979       pMem->n = (serial_type-12)/2;
3980       pMem->flags = aFlag[serial_type&1];
3981       return;
3982     }
3983   }
3984   return;
3985 }
3986 /*
3987 ** This routine is used to allocate sufficient space for an UnpackedRecord
3988 ** structure large enough to be used with sqlite3VdbeRecordUnpack() if
3989 ** the first argument is a pointer to KeyInfo structure pKeyInfo.
3990 **
3991 ** The space is either allocated using sqlite3DbMallocRaw() or from within
3992 ** the unaligned buffer passed via the second and third arguments (presumably
3993 ** stack space). If the former, then *ppFree is set to a pointer that should
3994 ** be eventually freed by the caller using sqlite3DbFree(). Or, if the
3995 ** allocation comes from the pSpace/szSpace buffer, *ppFree is set to NULL
3996 ** before returning.
3997 **
3998 ** If an OOM error occurs, NULL is returned.
3999 */
4000 UnpackedRecord *sqlite3VdbeAllocUnpackedRecord(
4001   KeyInfo *pKeyInfo               /* Description of the record */
4002 ){
4003   UnpackedRecord *p;              /* Unpacked record to return */
4004   int nByte;                      /* Number of bytes required for *p */
4005   nByte = ROUND8(sizeof(UnpackedRecord)) + sizeof(Mem)*(pKeyInfo->nKeyField+1);
4006   p = (UnpackedRecord *)sqlite3DbMallocRaw(pKeyInfo->db, nByte);
4007   if( !p ) return 0;
4008   p->aMem = (Mem*)&((char*)p)[ROUND8(sizeof(UnpackedRecord))];
4009   assert( pKeyInfo->aSortFlags!=0 );
4010   p->pKeyInfo = pKeyInfo;
4011   p->nField = pKeyInfo->nKeyField + 1;
4012   return p;
4013 }
4014 
4015 /*
4016 ** Given the nKey-byte encoding of a record in pKey[], populate the
4017 ** UnpackedRecord structure indicated by the fourth argument with the
4018 ** contents of the decoded record.
4019 */
4020 void sqlite3VdbeRecordUnpack(
4021   KeyInfo *pKeyInfo,     /* Information about the record format */
4022   int nKey,              /* Size of the binary record */
4023   const void *pKey,      /* The binary record */
4024   UnpackedRecord *p      /* Populate this structure before returning. */
4025 ){
4026   const unsigned char *aKey = (const unsigned char *)pKey;
4027   u32 d;
4028   u32 idx;                        /* Offset in aKey[] to read from */
4029   u16 u;                          /* Unsigned loop counter */
4030   u32 szHdr;
4031   Mem *pMem = p->aMem;
4032 
4033   p->default_rc = 0;
4034   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
4035   idx = getVarint32(aKey, szHdr);
4036   d = szHdr;
4037   u = 0;
4038   while( idx<szHdr && d<=(u32)nKey ){
4039     u32 serial_type;
4040 
4041     idx += getVarint32(&aKey[idx], serial_type);
4042     pMem->enc = pKeyInfo->enc;
4043     pMem->db = pKeyInfo->db;
4044     /* pMem->flags = 0; // sqlite3VdbeSerialGet() will set this for us */
4045     pMem->szMalloc = 0;
4046     pMem->z = 0;
4047     sqlite3VdbeSerialGet(&aKey[d], serial_type, pMem);
4048     d += sqlite3VdbeSerialTypeLen(serial_type);
4049     pMem++;
4050     if( (++u)>=p->nField ) break;
4051   }
4052   if( d>(u32)nKey && u ){
4053     assert( CORRUPT_DB );
4054     /* In a corrupt record entry, the last pMem might have been set up using
4055     ** uninitialized memory. Overwrite its value with NULL, to prevent
4056     ** warnings from MSAN. */
4057     sqlite3VdbeMemSetNull(pMem-1);
4058   }
4059   assert( u<=pKeyInfo->nKeyField + 1 );
4060   p->nField = u;
4061 }
4062 
4063 #ifdef SQLITE_DEBUG
4064 /*
4065 ** This function compares two index or table record keys in the same way
4066 ** as the sqlite3VdbeRecordCompare() routine. Unlike VdbeRecordCompare(),
4067 ** this function deserializes and compares values using the
4068 ** sqlite3VdbeSerialGet() and sqlite3MemCompare() functions. It is used
4069 ** in assert() statements to ensure that the optimized code in
4070 ** sqlite3VdbeRecordCompare() returns results with these two primitives.
4071 **
4072 ** Return true if the result of comparison is equivalent to desiredResult.
4073 ** Return false if there is a disagreement.
4074 */
4075 static int vdbeRecordCompareDebug(
4076   int nKey1, const void *pKey1, /* Left key */
4077   const UnpackedRecord *pPKey2, /* Right key */
4078   int desiredResult             /* Correct answer */
4079 ){
4080   u32 d1;            /* Offset into aKey[] of next data element */
4081   u32 idx1;          /* Offset into aKey[] of next header element */
4082   u32 szHdr1;        /* Number of bytes in header */
4083   int i = 0;
4084   int rc = 0;
4085   const unsigned char *aKey1 = (const unsigned char *)pKey1;
4086   KeyInfo *pKeyInfo;
4087   Mem mem1;
4088 
4089   pKeyInfo = pPKey2->pKeyInfo;
4090   if( pKeyInfo->db==0 ) return 1;
4091   mem1.enc = pKeyInfo->enc;
4092   mem1.db = pKeyInfo->db;
4093   /* mem1.flags = 0;  // Will be initialized by sqlite3VdbeSerialGet() */
4094   VVA_ONLY( mem1.szMalloc = 0; ) /* Only needed by assert() statements */
4095 
4096   /* Compilers may complain that mem1.u.i is potentially uninitialized.
4097   ** We could initialize it, as shown here, to silence those complaints.
4098   ** But in fact, mem1.u.i will never actually be used uninitialized, and doing
4099   ** the unnecessary initialization has a measurable negative performance
4100   ** impact, since this routine is a very high runner.  And so, we choose
4101   ** to ignore the compiler warnings and leave this variable uninitialized.
4102   */
4103   /*  mem1.u.i = 0;  // not needed, here to silence compiler warning */
4104 
4105   idx1 = getVarint32(aKey1, szHdr1);
4106   if( szHdr1>98307 ) return SQLITE_CORRUPT;
4107   d1 = szHdr1;
4108   assert( pKeyInfo->nAllField>=pPKey2->nField || CORRUPT_DB );
4109   assert( pKeyInfo->aSortFlags!=0 );
4110   assert( pKeyInfo->nKeyField>0 );
4111   assert( idx1<=szHdr1 || CORRUPT_DB );
4112   do{
4113     u32 serial_type1;
4114 
4115     /* Read the serial types for the next element in each key. */
4116     idx1 += getVarint32( aKey1+idx1, serial_type1 );
4117 
4118     /* Verify that there is enough key space remaining to avoid
4119     ** a buffer overread.  The "d1+serial_type1+2" subexpression will
4120     ** always be greater than or equal to the amount of required key space.
4121     ** Use that approximation to avoid the more expensive call to
4122     ** sqlite3VdbeSerialTypeLen() in the common case.
4123     */
4124     if( d1+(u64)serial_type1+2>(u64)nKey1
4125      && d1+(u64)sqlite3VdbeSerialTypeLen(serial_type1)>(u64)nKey1
4126     ){
4127       break;
4128     }
4129 
4130     /* Extract the values to be compared.
4131     */
4132     sqlite3VdbeSerialGet(&aKey1[d1], serial_type1, &mem1);
4133     d1 += sqlite3VdbeSerialTypeLen(serial_type1);
4134 
4135     /* Do the comparison
4136     */
4137     rc = sqlite3MemCompare(&mem1, &pPKey2->aMem[i],
4138                            pKeyInfo->nAllField>i ? pKeyInfo->aColl[i] : 0);
4139     if( rc!=0 ){
4140       assert( mem1.szMalloc==0 );  /* See comment below */
4141       if( (pKeyInfo->aSortFlags[i] & KEYINFO_ORDER_BIGNULL)
4142        && ((mem1.flags & MEM_Null) || (pPKey2->aMem[i].flags & MEM_Null))
4143       ){
4144         rc = -rc;
4145       }
4146       if( pKeyInfo->aSortFlags[i] & KEYINFO_ORDER_DESC ){
4147         rc = -rc;  /* Invert the result for DESC sort order. */
4148       }
4149       goto debugCompareEnd;
4150     }
4151     i++;
4152   }while( idx1<szHdr1 && i<pPKey2->nField );
4153 
4154   /* No memory allocation is ever used on mem1.  Prove this using
4155   ** the following assert().  If the assert() fails, it indicates a
4156   ** memory leak and a need to call sqlite3VdbeMemRelease(&mem1).
4157   */
4158   assert( mem1.szMalloc==0 );
4159 
4160   /* rc==0 here means that one of the keys ran out of fields and
4161   ** all the fields up to that point were equal. Return the default_rc
4162   ** value.  */
4163   rc = pPKey2->default_rc;
4164 
4165 debugCompareEnd:
4166   if( desiredResult==0 && rc==0 ) return 1;
4167   if( desiredResult<0 && rc<0 ) return 1;
4168   if( desiredResult>0 && rc>0 ) return 1;
4169   if( CORRUPT_DB ) return 1;
4170   if( pKeyInfo->db->mallocFailed ) return 1;
4171   return 0;
4172 }
4173 #endif
4174 
4175 #ifdef SQLITE_DEBUG
4176 /*
4177 ** Count the number of fields (a.k.a. columns) in the record given by
4178 ** pKey,nKey.  The verify that this count is less than or equal to the
4179 ** limit given by pKeyInfo->nAllField.
4180 **
4181 ** If this constraint is not satisfied, it means that the high-speed
4182 ** vdbeRecordCompareInt() and vdbeRecordCompareString() routines will
4183 ** not work correctly.  If this assert() ever fires, it probably means
4184 ** that the KeyInfo.nKeyField or KeyInfo.nAllField values were computed
4185 ** incorrectly.
4186 */
4187 static void vdbeAssertFieldCountWithinLimits(
4188   int nKey, const void *pKey,   /* The record to verify */
4189   const KeyInfo *pKeyInfo       /* Compare size with this KeyInfo */
4190 ){
4191   int nField = 0;
4192   u32 szHdr;
4193   u32 idx;
4194   u32 notUsed;
4195   const unsigned char *aKey = (const unsigned char*)pKey;
4196 
4197   if( CORRUPT_DB ) return;
4198   idx = getVarint32(aKey, szHdr);
4199   assert( nKey>=0 );
4200   assert( szHdr<=(u32)nKey );
4201   while( idx<szHdr ){
4202     idx += getVarint32(aKey+idx, notUsed);
4203     nField++;
4204   }
4205   assert( nField <= pKeyInfo->nAllField );
4206 }
4207 #else
4208 # define vdbeAssertFieldCountWithinLimits(A,B,C)
4209 #endif
4210 
4211 /*
4212 ** Both *pMem1 and *pMem2 contain string values. Compare the two values
4213 ** using the collation sequence pColl. As usual, return a negative , zero
4214 ** or positive value if *pMem1 is less than, equal to or greater than
4215 ** *pMem2, respectively. Similar in spirit to "rc = (*pMem1) - (*pMem2);".
4216 */
4217 static int vdbeCompareMemString(
4218   const Mem *pMem1,
4219   const Mem *pMem2,
4220   const CollSeq *pColl,
4221   u8 *prcErr                      /* If an OOM occurs, set to SQLITE_NOMEM */
4222 ){
4223   if( pMem1->enc==pColl->enc ){
4224     /* The strings are already in the correct encoding.  Call the
4225      ** comparison function directly */
4226     return pColl->xCmp(pColl->pUser,pMem1->n,pMem1->z,pMem2->n,pMem2->z);
4227   }else{
4228     int rc;
4229     const void *v1, *v2;
4230     Mem c1;
4231     Mem c2;
4232     sqlite3VdbeMemInit(&c1, pMem1->db, MEM_Null);
4233     sqlite3VdbeMemInit(&c2, pMem1->db, MEM_Null);
4234     sqlite3VdbeMemShallowCopy(&c1, pMem1, MEM_Ephem);
4235     sqlite3VdbeMemShallowCopy(&c2, pMem2, MEM_Ephem);
4236     v1 = sqlite3ValueText((sqlite3_value*)&c1, pColl->enc);
4237     v2 = sqlite3ValueText((sqlite3_value*)&c2, pColl->enc);
4238     if( (v1==0 || v2==0) ){
4239       if( prcErr ) *prcErr = SQLITE_NOMEM_BKPT;
4240       rc = 0;
4241     }else{
4242       rc = pColl->xCmp(pColl->pUser, c1.n, v1, c2.n, v2);
4243     }
4244     sqlite3VdbeMemRelease(&c1);
4245     sqlite3VdbeMemRelease(&c2);
4246     return rc;
4247   }
4248 }
4249 
4250 /*
4251 ** The input pBlob is guaranteed to be a Blob that is not marked
4252 ** with MEM_Zero.  Return true if it could be a zero-blob.
4253 */
4254 static int isAllZero(const char *z, int n){
4255   int i;
4256   for(i=0; i<n; i++){
4257     if( z[i] ) return 0;
4258   }
4259   return 1;
4260 }
4261 
4262 /*
4263 ** Compare two blobs.  Return negative, zero, or positive if the first
4264 ** is less than, equal to, or greater than the second, respectively.
4265 ** If one blob is a prefix of the other, then the shorter is the lessor.
4266 */
4267 SQLITE_NOINLINE int sqlite3BlobCompare(const Mem *pB1, const Mem *pB2){
4268   int c;
4269   int n1 = pB1->n;
4270   int n2 = pB2->n;
4271 
4272   /* It is possible to have a Blob value that has some non-zero content
4273   ** followed by zero content.  But that only comes up for Blobs formed
4274   ** by the OP_MakeRecord opcode, and such Blobs never get passed into
4275   ** sqlite3MemCompare(). */
4276   assert( (pB1->flags & MEM_Zero)==0 || n1==0 );
4277   assert( (pB2->flags & MEM_Zero)==0 || n2==0 );
4278 
4279   if( (pB1->flags|pB2->flags) & MEM_Zero ){
4280     if( pB1->flags & pB2->flags & MEM_Zero ){
4281       return pB1->u.nZero - pB2->u.nZero;
4282     }else if( pB1->flags & MEM_Zero ){
4283       if( !isAllZero(pB2->z, pB2->n) ) return -1;
4284       return pB1->u.nZero - n2;
4285     }else{
4286       if( !isAllZero(pB1->z, pB1->n) ) return +1;
4287       return n1 - pB2->u.nZero;
4288     }
4289   }
4290   c = memcmp(pB1->z, pB2->z, n1>n2 ? n2 : n1);
4291   if( c ) return c;
4292   return n1 - n2;
4293 }
4294 
4295 /*
4296 ** Do a comparison between a 64-bit signed integer and a 64-bit floating-point
4297 ** number.  Return negative, zero, or positive if the first (i64) is less than,
4298 ** equal to, or greater than the second (double).
4299 */
4300 int sqlite3IntFloatCompare(i64 i, double r){
4301   if( sizeof(LONGDOUBLE_TYPE)>8 ){
4302     LONGDOUBLE_TYPE x = (LONGDOUBLE_TYPE)i;
4303     testcase( x<r );
4304     testcase( x>r );
4305     testcase( x==r );
4306     if( x<r ) return -1;
4307     if( x>r ) return +1;  /*NO_TEST*/ /* work around bugs in gcov */
4308     return 0;             /*NO_TEST*/ /* work around bugs in gcov */
4309   }else{
4310     i64 y;
4311     double s;
4312     if( r<-9223372036854775808.0 ) return +1;
4313     if( r>=9223372036854775808.0 ) return -1;
4314     y = (i64)r;
4315     if( i<y ) return -1;
4316     if( i>y ) return +1;
4317     s = (double)i;
4318     if( s<r ) return -1;
4319     if( s>r ) return +1;
4320     return 0;
4321   }
4322 }
4323 
4324 /*
4325 ** Compare the values contained by the two memory cells, returning
4326 ** negative, zero or positive if pMem1 is less than, equal to, or greater
4327 ** than pMem2. Sorting order is NULL's first, followed by numbers (integers
4328 ** and reals) sorted numerically, followed by text ordered by the collating
4329 ** sequence pColl and finally blob's ordered by memcmp().
4330 **
4331 ** Two NULL values are considered equal by this function.
4332 */
4333 int sqlite3MemCompare(const Mem *pMem1, const Mem *pMem2, const CollSeq *pColl){
4334   int f1, f2;
4335   int combined_flags;
4336 
4337   f1 = pMem1->flags;
4338   f2 = pMem2->flags;
4339   combined_flags = f1|f2;
4340   assert( !sqlite3VdbeMemIsRowSet(pMem1) && !sqlite3VdbeMemIsRowSet(pMem2) );
4341 
4342   /* If one value is NULL, it is less than the other. If both values
4343   ** are NULL, return 0.
4344   */
4345   if( combined_flags&MEM_Null ){
4346     return (f2&MEM_Null) - (f1&MEM_Null);
4347   }
4348 
4349   /* At least one of the two values is a number
4350   */
4351   if( combined_flags&(MEM_Int|MEM_Real|MEM_IntReal) ){
4352     testcase( combined_flags & MEM_Int );
4353     testcase( combined_flags & MEM_Real );
4354     testcase( combined_flags & MEM_IntReal );
4355     if( (f1 & f2 & (MEM_Int|MEM_IntReal))!=0 ){
4356       testcase( f1 & f2 & MEM_Int );
4357       testcase( f1 & f2 & MEM_IntReal );
4358       if( pMem1->u.i < pMem2->u.i ) return -1;
4359       if( pMem1->u.i > pMem2->u.i ) return +1;
4360       return 0;
4361     }
4362     if( (f1 & f2 & MEM_Real)!=0 ){
4363       if( pMem1->u.r < pMem2->u.r ) return -1;
4364       if( pMem1->u.r > pMem2->u.r ) return +1;
4365       return 0;
4366     }
4367     if( (f1&(MEM_Int|MEM_IntReal))!=0 ){
4368       testcase( f1 & MEM_Int );
4369       testcase( f1 & MEM_IntReal );
4370       if( (f2&MEM_Real)!=0 ){
4371         return sqlite3IntFloatCompare(pMem1->u.i, pMem2->u.r);
4372       }else if( (f2&(MEM_Int|MEM_IntReal))!=0 ){
4373         if( pMem1->u.i < pMem2->u.i ) return -1;
4374         if( pMem1->u.i > pMem2->u.i ) return +1;
4375         return 0;
4376       }else{
4377         return -1;
4378       }
4379     }
4380     if( (f1&MEM_Real)!=0 ){
4381       if( (f2&(MEM_Int|MEM_IntReal))!=0 ){
4382         testcase( f2 & MEM_Int );
4383         testcase( f2 & MEM_IntReal );
4384         return -sqlite3IntFloatCompare(pMem2->u.i, pMem1->u.r);
4385       }else{
4386         return -1;
4387       }
4388     }
4389     return +1;
4390   }
4391 
4392   /* If one value is a string and the other is a blob, the string is less.
4393   ** If both are strings, compare using the collating functions.
4394   */
4395   if( combined_flags&MEM_Str ){
4396     if( (f1 & MEM_Str)==0 ){
4397       return 1;
4398     }
4399     if( (f2 & MEM_Str)==0 ){
4400       return -1;
4401     }
4402 
4403     assert( pMem1->enc==pMem2->enc || pMem1->db->mallocFailed );
4404     assert( pMem1->enc==SQLITE_UTF8 ||
4405             pMem1->enc==SQLITE_UTF16LE || pMem1->enc==SQLITE_UTF16BE );
4406 
4407     /* The collation sequence must be defined at this point, even if
4408     ** the user deletes the collation sequence after the vdbe program is
4409     ** compiled (this was not always the case).
4410     */
4411     assert( !pColl || pColl->xCmp );
4412 
4413     if( pColl ){
4414       return vdbeCompareMemString(pMem1, pMem2, pColl, 0);
4415     }
4416     /* If a NULL pointer was passed as the collate function, fall through
4417     ** to the blob case and use memcmp().  */
4418   }
4419 
4420   /* Both values must be blobs.  Compare using memcmp().  */
4421   return sqlite3BlobCompare(pMem1, pMem2);
4422 }
4423 
4424 
4425 /*
4426 ** The first argument passed to this function is a serial-type that
4427 ** corresponds to an integer - all values between 1 and 9 inclusive
4428 ** except 7. The second points to a buffer containing an integer value
4429 ** serialized according to serial_type. This function deserializes
4430 ** and returns the value.
4431 */
4432 static i64 vdbeRecordDecodeInt(u32 serial_type, const u8 *aKey){
4433   u32 y;
4434   assert( CORRUPT_DB || (serial_type>=1 && serial_type<=9 && serial_type!=7) );
4435   switch( serial_type ){
4436     case 0:
4437     case 1:
4438       testcase( aKey[0]&0x80 );
4439       return ONE_BYTE_INT(aKey);
4440     case 2:
4441       testcase( aKey[0]&0x80 );
4442       return TWO_BYTE_INT(aKey);
4443     case 3:
4444       testcase( aKey[0]&0x80 );
4445       return THREE_BYTE_INT(aKey);
4446     case 4: {
4447       testcase( aKey[0]&0x80 );
4448       y = FOUR_BYTE_UINT(aKey);
4449       return (i64)*(int*)&y;
4450     }
4451     case 5: {
4452       testcase( aKey[0]&0x80 );
4453       return FOUR_BYTE_UINT(aKey+2) + (((i64)1)<<32)*TWO_BYTE_INT(aKey);
4454     }
4455     case 6: {
4456       u64 x = FOUR_BYTE_UINT(aKey);
4457       testcase( aKey[0]&0x80 );
4458       x = (x<<32) | FOUR_BYTE_UINT(aKey+4);
4459       return (i64)*(i64*)&x;
4460     }
4461   }
4462 
4463   return (serial_type - 8);
4464 }
4465 
4466 /*
4467 ** This function compares the two table rows or index records
4468 ** specified by {nKey1, pKey1} and pPKey2.  It returns a negative, zero
4469 ** or positive integer if key1 is less than, equal to or
4470 ** greater than key2.  The {nKey1, pKey1} key must be a blob
4471 ** created by the OP_MakeRecord opcode of the VDBE.  The pPKey2
4472 ** key must be a parsed key such as obtained from
4473 ** sqlite3VdbeParseRecord.
4474 **
4475 ** If argument bSkip is non-zero, it is assumed that the caller has already
4476 ** determined that the first fields of the keys are equal.
4477 **
4478 ** Key1 and Key2 do not have to contain the same number of fields. If all
4479 ** fields that appear in both keys are equal, then pPKey2->default_rc is
4480 ** returned.
4481 **
4482 ** If database corruption is discovered, set pPKey2->errCode to
4483 ** SQLITE_CORRUPT and return 0. If an OOM error is encountered,
4484 ** pPKey2->errCode is set to SQLITE_NOMEM and, if it is not NULL, the
4485 ** malloc-failed flag set on database handle (pPKey2->pKeyInfo->db).
4486 */
4487 int sqlite3VdbeRecordCompareWithSkip(
4488   int nKey1, const void *pKey1,   /* Left key */
4489   UnpackedRecord *pPKey2,         /* Right key */
4490   int bSkip                       /* If true, skip the first field */
4491 ){
4492   u32 d1;                         /* Offset into aKey[] of next data element */
4493   int i;                          /* Index of next field to compare */
4494   u32 szHdr1;                     /* Size of record header in bytes */
4495   u32 idx1;                       /* Offset of first type in header */
4496   int rc = 0;                     /* Return value */
4497   Mem *pRhs = pPKey2->aMem;       /* Next field of pPKey2 to compare */
4498   KeyInfo *pKeyInfo;
4499   const unsigned char *aKey1 = (const unsigned char *)pKey1;
4500   Mem mem1;
4501 
4502   /* If bSkip is true, then the caller has already determined that the first
4503   ** two elements in the keys are equal. Fix the various stack variables so
4504   ** that this routine begins comparing at the second field. */
4505   if( bSkip ){
4506     u32 s1;
4507     idx1 = 1 + getVarint32(&aKey1[1], s1);
4508     szHdr1 = aKey1[0];
4509     d1 = szHdr1 + sqlite3VdbeSerialTypeLen(s1);
4510     i = 1;
4511     pRhs++;
4512   }else{
4513     idx1 = getVarint32(aKey1, szHdr1);
4514     d1 = szHdr1;
4515     i = 0;
4516   }
4517   if( d1>(unsigned)nKey1 ){
4518     pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4519     return 0;  /* Corruption */
4520   }
4521 
4522   VVA_ONLY( mem1.szMalloc = 0; ) /* Only needed by assert() statements */
4523   assert( pPKey2->pKeyInfo->nAllField>=pPKey2->nField
4524        || CORRUPT_DB );
4525   assert( pPKey2->pKeyInfo->aSortFlags!=0 );
4526   assert( pPKey2->pKeyInfo->nKeyField>0 );
4527   assert( idx1<=szHdr1 || CORRUPT_DB );
4528   do{
4529     u32 serial_type;
4530 
4531     /* RHS is an integer */
4532     if( pRhs->flags & (MEM_Int|MEM_IntReal) ){
4533       testcase( pRhs->flags & MEM_Int );
4534       testcase( pRhs->flags & MEM_IntReal );
4535       serial_type = aKey1[idx1];
4536       testcase( serial_type==12 );
4537       if( serial_type>=10 ){
4538         rc = +1;
4539       }else if( serial_type==0 ){
4540         rc = -1;
4541       }else if( serial_type==7 ){
4542         sqlite3VdbeSerialGet(&aKey1[d1], serial_type, &mem1);
4543         rc = -sqlite3IntFloatCompare(pRhs->u.i, mem1.u.r);
4544       }else{
4545         i64 lhs = vdbeRecordDecodeInt(serial_type, &aKey1[d1]);
4546         i64 rhs = pRhs->u.i;
4547         if( lhs<rhs ){
4548           rc = -1;
4549         }else if( lhs>rhs ){
4550           rc = +1;
4551         }
4552       }
4553     }
4554 
4555     /* RHS is real */
4556     else if( pRhs->flags & MEM_Real ){
4557       serial_type = aKey1[idx1];
4558       if( serial_type>=10 ){
4559         /* Serial types 12 or greater are strings and blobs (greater than
4560         ** numbers). Types 10 and 11 are currently "reserved for future
4561         ** use", so it doesn't really matter what the results of comparing
4562         ** them to numberic values are.  */
4563         rc = +1;
4564       }else if( serial_type==0 ){
4565         rc = -1;
4566       }else{
4567         sqlite3VdbeSerialGet(&aKey1[d1], serial_type, &mem1);
4568         if( serial_type==7 ){
4569           if( mem1.u.r<pRhs->u.r ){
4570             rc = -1;
4571           }else if( mem1.u.r>pRhs->u.r ){
4572             rc = +1;
4573           }
4574         }else{
4575           rc = sqlite3IntFloatCompare(mem1.u.i, pRhs->u.r);
4576         }
4577       }
4578     }
4579 
4580     /* RHS is a string */
4581     else if( pRhs->flags & MEM_Str ){
4582       getVarint32NR(&aKey1[idx1], serial_type);
4583       testcase( serial_type==12 );
4584       if( serial_type<12 ){
4585         rc = -1;
4586       }else if( !(serial_type & 0x01) ){
4587         rc = +1;
4588       }else{
4589         mem1.n = (serial_type - 12) / 2;
4590         testcase( (d1+mem1.n)==(unsigned)nKey1 );
4591         testcase( (d1+mem1.n+1)==(unsigned)nKey1 );
4592         if( (d1+mem1.n) > (unsigned)nKey1
4593          || (pKeyInfo = pPKey2->pKeyInfo)->nAllField<=i
4594         ){
4595           pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4596           return 0;                /* Corruption */
4597         }else if( pKeyInfo->aColl[i] ){
4598           mem1.enc = pKeyInfo->enc;
4599           mem1.db = pKeyInfo->db;
4600           mem1.flags = MEM_Str;
4601           mem1.z = (char*)&aKey1[d1];
4602           rc = vdbeCompareMemString(
4603               &mem1, pRhs, pKeyInfo->aColl[i], &pPKey2->errCode
4604           );
4605         }else{
4606           int nCmp = MIN(mem1.n, pRhs->n);
4607           rc = memcmp(&aKey1[d1], pRhs->z, nCmp);
4608           if( rc==0 ) rc = mem1.n - pRhs->n;
4609         }
4610       }
4611     }
4612 
4613     /* RHS is a blob */
4614     else if( pRhs->flags & MEM_Blob ){
4615       assert( (pRhs->flags & MEM_Zero)==0 || pRhs->n==0 );
4616       getVarint32NR(&aKey1[idx1], serial_type);
4617       testcase( serial_type==12 );
4618       if( serial_type<12 || (serial_type & 0x01) ){
4619         rc = -1;
4620       }else{
4621         int nStr = (serial_type - 12) / 2;
4622         testcase( (d1+nStr)==(unsigned)nKey1 );
4623         testcase( (d1+nStr+1)==(unsigned)nKey1 );
4624         if( (d1+nStr) > (unsigned)nKey1 ){
4625           pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4626           return 0;                /* Corruption */
4627         }else if( pRhs->flags & MEM_Zero ){
4628           if( !isAllZero((const char*)&aKey1[d1],nStr) ){
4629             rc = 1;
4630           }else{
4631             rc = nStr - pRhs->u.nZero;
4632           }
4633         }else{
4634           int nCmp = MIN(nStr, pRhs->n);
4635           rc = memcmp(&aKey1[d1], pRhs->z, nCmp);
4636           if( rc==0 ) rc = nStr - pRhs->n;
4637         }
4638       }
4639     }
4640 
4641     /* RHS is null */
4642     else{
4643       serial_type = aKey1[idx1];
4644       rc = (serial_type!=0);
4645     }
4646 
4647     if( rc!=0 ){
4648       int sortFlags = pPKey2->pKeyInfo->aSortFlags[i];
4649       if( sortFlags ){
4650         if( (sortFlags & KEYINFO_ORDER_BIGNULL)==0
4651          || ((sortFlags & KEYINFO_ORDER_DESC)
4652            !=(serial_type==0 || (pRhs->flags&MEM_Null)))
4653         ){
4654           rc = -rc;
4655         }
4656       }
4657       assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, rc) );
4658       assert( mem1.szMalloc==0 );  /* See comment below */
4659       return rc;
4660     }
4661 
4662     i++;
4663     if( i==pPKey2->nField ) break;
4664     pRhs++;
4665     d1 += sqlite3VdbeSerialTypeLen(serial_type);
4666     idx1 += sqlite3VarintLen(serial_type);
4667   }while( idx1<(unsigned)szHdr1 && d1<=(unsigned)nKey1 );
4668 
4669   /* No memory allocation is ever used on mem1.  Prove this using
4670   ** the following assert().  If the assert() fails, it indicates a
4671   ** memory leak and a need to call sqlite3VdbeMemRelease(&mem1).  */
4672   assert( mem1.szMalloc==0 );
4673 
4674   /* rc==0 here means that one or both of the keys ran out of fields and
4675   ** all the fields up to that point were equal. Return the default_rc
4676   ** value.  */
4677   assert( CORRUPT_DB
4678        || vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, pPKey2->default_rc)
4679        || pPKey2->pKeyInfo->db->mallocFailed
4680   );
4681   pPKey2->eqSeen = 1;
4682   return pPKey2->default_rc;
4683 }
4684 int sqlite3VdbeRecordCompare(
4685   int nKey1, const void *pKey1,   /* Left key */
4686   UnpackedRecord *pPKey2          /* Right key */
4687 ){
4688   return sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 0);
4689 }
4690 
4691 
4692 /*
4693 ** This function is an optimized version of sqlite3VdbeRecordCompare()
4694 ** that (a) the first field of pPKey2 is an integer, and (b) the
4695 ** size-of-header varint at the start of (pKey1/nKey1) fits in a single
4696 ** byte (i.e. is less than 128).
4697 **
4698 ** To avoid concerns about buffer overreads, this routine is only used
4699 ** on schemas where the maximum valid header size is 63 bytes or less.
4700 */
4701 static int vdbeRecordCompareInt(
4702   int nKey1, const void *pKey1, /* Left key */
4703   UnpackedRecord *pPKey2        /* Right key */
4704 ){
4705   const u8 *aKey = &((const u8*)pKey1)[*(const u8*)pKey1 & 0x3F];
4706   int serial_type = ((const u8*)pKey1)[1];
4707   int res;
4708   u32 y;
4709   u64 x;
4710   i64 v;
4711   i64 lhs;
4712 
4713   vdbeAssertFieldCountWithinLimits(nKey1, pKey1, pPKey2->pKeyInfo);
4714   assert( (*(u8*)pKey1)<=0x3F || CORRUPT_DB );
4715   switch( serial_type ){
4716     case 1: { /* 1-byte signed integer */
4717       lhs = ONE_BYTE_INT(aKey);
4718       testcase( lhs<0 );
4719       break;
4720     }
4721     case 2: { /* 2-byte signed integer */
4722       lhs = TWO_BYTE_INT(aKey);
4723       testcase( lhs<0 );
4724       break;
4725     }
4726     case 3: { /* 3-byte signed integer */
4727       lhs = THREE_BYTE_INT(aKey);
4728       testcase( lhs<0 );
4729       break;
4730     }
4731     case 4: { /* 4-byte signed integer */
4732       y = FOUR_BYTE_UINT(aKey);
4733       lhs = (i64)*(int*)&y;
4734       testcase( lhs<0 );
4735       break;
4736     }
4737     case 5: { /* 6-byte signed integer */
4738       lhs = FOUR_BYTE_UINT(aKey+2) + (((i64)1)<<32)*TWO_BYTE_INT(aKey);
4739       testcase( lhs<0 );
4740       break;
4741     }
4742     case 6: { /* 8-byte signed integer */
4743       x = FOUR_BYTE_UINT(aKey);
4744       x = (x<<32) | FOUR_BYTE_UINT(aKey+4);
4745       lhs = *(i64*)&x;
4746       testcase( lhs<0 );
4747       break;
4748     }
4749     case 8:
4750       lhs = 0;
4751       break;
4752     case 9:
4753       lhs = 1;
4754       break;
4755 
4756     /* This case could be removed without changing the results of running
4757     ** this code. Including it causes gcc to generate a faster switch
4758     ** statement (since the range of switch targets now starts at zero and
4759     ** is contiguous) but does not cause any duplicate code to be generated
4760     ** (as gcc is clever enough to combine the two like cases). Other
4761     ** compilers might be similar.  */
4762     case 0: case 7:
4763       return sqlite3VdbeRecordCompare(nKey1, pKey1, pPKey2);
4764 
4765     default:
4766       return sqlite3VdbeRecordCompare(nKey1, pKey1, pPKey2);
4767   }
4768 
4769   v = pPKey2->aMem[0].u.i;
4770   if( v>lhs ){
4771     res = pPKey2->r1;
4772   }else if( v<lhs ){
4773     res = pPKey2->r2;
4774   }else if( pPKey2->nField>1 ){
4775     /* The first fields of the two keys are equal. Compare the trailing
4776     ** fields.  */
4777     res = sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 1);
4778   }else{
4779     /* The first fields of the two keys are equal and there are no trailing
4780     ** fields. Return pPKey2->default_rc in this case. */
4781     res = pPKey2->default_rc;
4782     pPKey2->eqSeen = 1;
4783   }
4784 
4785   assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, res) );
4786   return res;
4787 }
4788 
4789 /*
4790 ** This function is an optimized version of sqlite3VdbeRecordCompare()
4791 ** that (a) the first field of pPKey2 is a string, that (b) the first field
4792 ** uses the collation sequence BINARY and (c) that the size-of-header varint
4793 ** at the start of (pKey1/nKey1) fits in a single byte.
4794 */
4795 static int vdbeRecordCompareString(
4796   int nKey1, const void *pKey1, /* Left key */
4797   UnpackedRecord *pPKey2        /* Right key */
4798 ){
4799   const u8 *aKey1 = (const u8*)pKey1;
4800   int serial_type;
4801   int res;
4802 
4803   assert( pPKey2->aMem[0].flags & MEM_Str );
4804   vdbeAssertFieldCountWithinLimits(nKey1, pKey1, pPKey2->pKeyInfo);
4805   serial_type = (u8)(aKey1[1]);
4806   if( serial_type >= 0x80 ){
4807     sqlite3GetVarint32(&aKey1[1], (u32*)&serial_type);
4808   }
4809   if( serial_type<12 ){
4810     res = pPKey2->r1;      /* (pKey1/nKey1) is a number or a null */
4811   }else if( !(serial_type & 0x01) ){
4812     res = pPKey2->r2;      /* (pKey1/nKey1) is a blob */
4813   }else{
4814     int nCmp;
4815     int nStr;
4816     int szHdr = aKey1[0];
4817 
4818     nStr = (serial_type-12) / 2;
4819     if( (szHdr + nStr) > nKey1 ){
4820       pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4821       return 0;    /* Corruption */
4822     }
4823     nCmp = MIN( pPKey2->aMem[0].n, nStr );
4824     res = memcmp(&aKey1[szHdr], pPKey2->aMem[0].z, nCmp);
4825 
4826     if( res>0 ){
4827       res = pPKey2->r2;
4828     }else if( res<0 ){
4829       res = pPKey2->r1;
4830     }else{
4831       res = nStr - pPKey2->aMem[0].n;
4832       if( res==0 ){
4833         if( pPKey2->nField>1 ){
4834           res = sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 1);
4835         }else{
4836           res = pPKey2->default_rc;
4837           pPKey2->eqSeen = 1;
4838         }
4839       }else if( res>0 ){
4840         res = pPKey2->r2;
4841       }else{
4842         res = pPKey2->r1;
4843       }
4844     }
4845   }
4846 
4847   assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, res)
4848        || CORRUPT_DB
4849        || pPKey2->pKeyInfo->db->mallocFailed
4850   );
4851   return res;
4852 }
4853 
4854 /*
4855 ** Return a pointer to an sqlite3VdbeRecordCompare() compatible function
4856 ** suitable for comparing serialized records to the unpacked record passed
4857 ** as the only argument.
4858 */
4859 RecordCompare sqlite3VdbeFindCompare(UnpackedRecord *p){
4860   /* varintRecordCompareInt() and varintRecordCompareString() both assume
4861   ** that the size-of-header varint that occurs at the start of each record
4862   ** fits in a single byte (i.e. is 127 or less). varintRecordCompareInt()
4863   ** also assumes that it is safe to overread a buffer by at least the
4864   ** maximum possible legal header size plus 8 bytes. Because there is
4865   ** guaranteed to be at least 74 (but not 136) bytes of padding following each
4866   ** buffer passed to varintRecordCompareInt() this makes it convenient to
4867   ** limit the size of the header to 64 bytes in cases where the first field
4868   ** is an integer.
4869   **
4870   ** The easiest way to enforce this limit is to consider only records with
4871   ** 13 fields or less. If the first field is an integer, the maximum legal
4872   ** header size is (12*5 + 1 + 1) bytes.  */
4873   if( p->pKeyInfo->nAllField<=13 ){
4874     int flags = p->aMem[0].flags;
4875     if( p->pKeyInfo->aSortFlags[0] ){
4876       if( p->pKeyInfo->aSortFlags[0] & KEYINFO_ORDER_BIGNULL ){
4877         return sqlite3VdbeRecordCompare;
4878       }
4879       p->r1 = 1;
4880       p->r2 = -1;
4881     }else{
4882       p->r1 = -1;
4883       p->r2 = 1;
4884     }
4885     if( (flags & MEM_Int) ){
4886       return vdbeRecordCompareInt;
4887     }
4888     testcase( flags & MEM_Real );
4889     testcase( flags & MEM_Null );
4890     testcase( flags & MEM_Blob );
4891     if( (flags & (MEM_Real|MEM_IntReal|MEM_Null|MEM_Blob))==0
4892      && p->pKeyInfo->aColl[0]==0
4893     ){
4894       assert( flags & MEM_Str );
4895       return vdbeRecordCompareString;
4896     }
4897   }
4898 
4899   return sqlite3VdbeRecordCompare;
4900 }
4901 
4902 /*
4903 ** pCur points at an index entry created using the OP_MakeRecord opcode.
4904 ** Read the rowid (the last field in the record) and store it in *rowid.
4905 ** Return SQLITE_OK if everything works, or an error code otherwise.
4906 **
4907 ** pCur might be pointing to text obtained from a corrupt database file.
4908 ** So the content cannot be trusted.  Do appropriate checks on the content.
4909 */
4910 int sqlite3VdbeIdxRowid(sqlite3 *db, BtCursor *pCur, i64 *rowid){
4911   i64 nCellKey = 0;
4912   int rc;
4913   u32 szHdr;        /* Size of the header */
4914   u32 typeRowid;    /* Serial type of the rowid */
4915   u32 lenRowid;     /* Size of the rowid */
4916   Mem m, v;
4917 
4918   /* Get the size of the index entry.  Only indices entries of less
4919   ** than 2GiB are support - anything large must be database corruption.
4920   ** Any corruption is detected in sqlite3BtreeParseCellPtr(), though, so
4921   ** this code can safely assume that nCellKey is 32-bits
4922   */
4923   assert( sqlite3BtreeCursorIsValid(pCur) );
4924   nCellKey = sqlite3BtreePayloadSize(pCur);
4925   assert( (nCellKey & SQLITE_MAX_U32)==(u64)nCellKey );
4926 
4927   /* Read in the complete content of the index entry */
4928   sqlite3VdbeMemInit(&m, db, 0);
4929   rc = sqlite3VdbeMemFromBtreeZeroOffset(pCur, (u32)nCellKey, &m);
4930   if( rc ){
4931     return rc;
4932   }
4933 
4934   /* The index entry must begin with a header size */
4935   getVarint32NR((u8*)m.z, szHdr);
4936   testcase( szHdr==3 );
4937   testcase( szHdr==(u32)m.n );
4938   testcase( szHdr>0x7fffffff );
4939   assert( m.n>=0 );
4940   if( unlikely(szHdr<3 || szHdr>(unsigned)m.n) ){
4941     goto idx_rowid_corruption;
4942   }
4943 
4944   /* The last field of the index should be an integer - the ROWID.
4945   ** Verify that the last entry really is an integer. */
4946   getVarint32NR((u8*)&m.z[szHdr-1], typeRowid);
4947   testcase( typeRowid==1 );
4948   testcase( typeRowid==2 );
4949   testcase( typeRowid==3 );
4950   testcase( typeRowid==4 );
4951   testcase( typeRowid==5 );
4952   testcase( typeRowid==6 );
4953   testcase( typeRowid==8 );
4954   testcase( typeRowid==9 );
4955   if( unlikely(typeRowid<1 || typeRowid>9 || typeRowid==7) ){
4956     goto idx_rowid_corruption;
4957   }
4958   lenRowid = sqlite3SmallTypeSizes[typeRowid];
4959   testcase( (u32)m.n==szHdr+lenRowid );
4960   if( unlikely((u32)m.n<szHdr+lenRowid) ){
4961     goto idx_rowid_corruption;
4962   }
4963 
4964   /* Fetch the integer off the end of the index record */
4965   sqlite3VdbeSerialGet((u8*)&m.z[m.n-lenRowid], typeRowid, &v);
4966   *rowid = v.u.i;
4967   sqlite3VdbeMemRelease(&m);
4968   return SQLITE_OK;
4969 
4970   /* Jump here if database corruption is detected after m has been
4971   ** allocated.  Free the m object and return SQLITE_CORRUPT. */
4972 idx_rowid_corruption:
4973   testcase( m.szMalloc!=0 );
4974   sqlite3VdbeMemRelease(&m);
4975   return SQLITE_CORRUPT_BKPT;
4976 }
4977 
4978 /*
4979 ** Compare the key of the index entry that cursor pC is pointing to against
4980 ** the key string in pUnpacked.  Write into *pRes a number
4981 ** that is negative, zero, or positive if pC is less than, equal to,
4982 ** or greater than pUnpacked.  Return SQLITE_OK on success.
4983 **
4984 ** pUnpacked is either created without a rowid or is truncated so that it
4985 ** omits the rowid at the end.  The rowid at the end of the index entry
4986 ** is ignored as well.  Hence, this routine only compares the prefixes
4987 ** of the keys prior to the final rowid, not the entire key.
4988 */
4989 int sqlite3VdbeIdxKeyCompare(
4990   sqlite3 *db,                     /* Database connection */
4991   VdbeCursor *pC,                  /* The cursor to compare against */
4992   UnpackedRecord *pUnpacked,       /* Unpacked version of key */
4993   int *res                         /* Write the comparison result here */
4994 ){
4995   i64 nCellKey = 0;
4996   int rc;
4997   BtCursor *pCur;
4998   Mem m;
4999 
5000   assert( pC->eCurType==CURTYPE_BTREE );
5001   pCur = pC->uc.pCursor;
5002   assert( sqlite3BtreeCursorIsValid(pCur) );
5003   nCellKey = sqlite3BtreePayloadSize(pCur);
5004   /* nCellKey will always be between 0 and 0xffffffff because of the way
5005   ** that btreeParseCellPtr() and sqlite3GetVarint32() are implemented */
5006   if( nCellKey<=0 || nCellKey>0x7fffffff ){
5007     *res = 0;
5008     return SQLITE_CORRUPT_BKPT;
5009   }
5010   sqlite3VdbeMemInit(&m, db, 0);
5011   rc = sqlite3VdbeMemFromBtreeZeroOffset(pCur, (u32)nCellKey, &m);
5012   if( rc ){
5013     return rc;
5014   }
5015   *res = sqlite3VdbeRecordCompareWithSkip(m.n, m.z, pUnpacked, 0);
5016   sqlite3VdbeMemRelease(&m);
5017   return SQLITE_OK;
5018 }
5019 
5020 /*
5021 ** This routine sets the value to be returned by subsequent calls to
5022 ** sqlite3_changes() on the database handle 'db'.
5023 */
5024 void sqlite3VdbeSetChanges(sqlite3 *db, i64 nChange){
5025   assert( sqlite3_mutex_held(db->mutex) );
5026   db->nChange = nChange;
5027   db->nTotalChange += nChange;
5028 }
5029 
5030 /*
5031 ** Set a flag in the vdbe to update the change counter when it is finalised
5032 ** or reset.
5033 */
5034 void sqlite3VdbeCountChanges(Vdbe *v){
5035   v->changeCntOn = 1;
5036 }
5037 
5038 /*
5039 ** Mark every prepared statement associated with a database connection
5040 ** as expired.
5041 **
5042 ** An expired statement means that recompilation of the statement is
5043 ** recommend.  Statements expire when things happen that make their
5044 ** programs obsolete.  Removing user-defined functions or collating
5045 ** sequences, or changing an authorization function are the types of
5046 ** things that make prepared statements obsolete.
5047 **
5048 ** If iCode is 1, then expiration is advisory.  The statement should
5049 ** be reprepared before being restarted, but if it is already running
5050 ** it is allowed to run to completion.
5051 **
5052 ** Internally, this function just sets the Vdbe.expired flag on all
5053 ** prepared statements.  The flag is set to 1 for an immediate expiration
5054 ** and set to 2 for an advisory expiration.
5055 */
5056 void sqlite3ExpirePreparedStatements(sqlite3 *db, int iCode){
5057   Vdbe *p;
5058   for(p = db->pVdbe; p; p=p->pNext){
5059     p->expired = iCode+1;
5060   }
5061 }
5062 
5063 /*
5064 ** Return the database associated with the Vdbe.
5065 */
5066 sqlite3 *sqlite3VdbeDb(Vdbe *v){
5067   return v->db;
5068 }
5069 
5070 /*
5071 ** Return the SQLITE_PREPARE flags for a Vdbe.
5072 */
5073 u8 sqlite3VdbePrepareFlags(Vdbe *v){
5074   return v->prepFlags;
5075 }
5076 
5077 /*
5078 ** Return a pointer to an sqlite3_value structure containing the value bound
5079 ** parameter iVar of VM v. Except, if the value is an SQL NULL, return
5080 ** 0 instead. Unless it is NULL, apply affinity aff (one of the SQLITE_AFF_*
5081 ** constants) to the value before returning it.
5082 **
5083 ** The returned value must be freed by the caller using sqlite3ValueFree().
5084 */
5085 sqlite3_value *sqlite3VdbeGetBoundValue(Vdbe *v, int iVar, u8 aff){
5086   assert( iVar>0 );
5087   if( v ){
5088     Mem *pMem = &v->aVar[iVar-1];
5089     assert( (v->db->flags & SQLITE_EnableQPSG)==0 );
5090     if( 0==(pMem->flags & MEM_Null) ){
5091       sqlite3_value *pRet = sqlite3ValueNew(v->db);
5092       if( pRet ){
5093         sqlite3VdbeMemCopy((Mem *)pRet, pMem);
5094         sqlite3ValueApplyAffinity(pRet, aff, SQLITE_UTF8);
5095       }
5096       return pRet;
5097     }
5098   }
5099   return 0;
5100 }
5101 
5102 /*
5103 ** Configure SQL variable iVar so that binding a new value to it signals
5104 ** to sqlite3_reoptimize() that re-preparing the statement may result
5105 ** in a better query plan.
5106 */
5107 void sqlite3VdbeSetVarmask(Vdbe *v, int iVar){
5108   assert( iVar>0 );
5109   assert( (v->db->flags & SQLITE_EnableQPSG)==0 );
5110   if( iVar>=32 ){
5111     v->expmask |= 0x80000000;
5112   }else{
5113     v->expmask |= ((u32)1 << (iVar-1));
5114   }
5115 }
5116 
5117 /*
5118 ** Cause a function to throw an error if it was call from OP_PureFunc
5119 ** rather than OP_Function.
5120 **
5121 ** OP_PureFunc means that the function must be deterministic, and should
5122 ** throw an error if it is given inputs that would make it non-deterministic.
5123 ** This routine is invoked by date/time functions that use non-deterministic
5124 ** features such as 'now'.
5125 */
5126 int sqlite3NotPureFunc(sqlite3_context *pCtx){
5127   const VdbeOp *pOp;
5128 #ifdef SQLITE_ENABLE_STAT4
5129   if( pCtx->pVdbe==0 ) return 1;
5130 #endif
5131   pOp = pCtx->pVdbe->aOp + pCtx->iOp;
5132   if( pOp->opcode==OP_PureFunc ){
5133     const char *zContext;
5134     char *zMsg;
5135     if( pOp->p5 & NC_IsCheck ){
5136       zContext = "a CHECK constraint";
5137     }else if( pOp->p5 & NC_GenCol ){
5138       zContext = "a generated column";
5139     }else{
5140       zContext = "an index";
5141     }
5142     zMsg = sqlite3_mprintf("non-deterministic use of %s() in %s",
5143                            pCtx->pFunc->zName, zContext);
5144     sqlite3_result_error(pCtx, zMsg, -1);
5145     sqlite3_free(zMsg);
5146     return 0;
5147   }
5148   return 1;
5149 }
5150 
5151 #ifndef SQLITE_OMIT_VIRTUALTABLE
5152 /*
5153 ** Transfer error message text from an sqlite3_vtab.zErrMsg (text stored
5154 ** in memory obtained from sqlite3_malloc) into a Vdbe.zErrMsg (text stored
5155 ** in memory obtained from sqlite3DbMalloc).
5156 */
5157 void sqlite3VtabImportErrmsg(Vdbe *p, sqlite3_vtab *pVtab){
5158   if( pVtab->zErrMsg ){
5159     sqlite3 *db = p->db;
5160     sqlite3DbFree(db, p->zErrMsg);
5161     p->zErrMsg = sqlite3DbStrDup(db, pVtab->zErrMsg);
5162     sqlite3_free(pVtab->zErrMsg);
5163     pVtab->zErrMsg = 0;
5164   }
5165 }
5166 #endif /* SQLITE_OMIT_VIRTUALTABLE */
5167 
5168 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
5169 
5170 /*
5171 ** If the second argument is not NULL, release any allocations associated
5172 ** with the memory cells in the p->aMem[] array. Also free the UnpackedRecord
5173 ** structure itself, using sqlite3DbFree().
5174 **
5175 ** This function is used to free UnpackedRecord structures allocated by
5176 ** the vdbeUnpackRecord() function found in vdbeapi.c.
5177 */
5178 static void vdbeFreeUnpacked(sqlite3 *db, int nField, UnpackedRecord *p){
5179   if( p ){
5180     int i;
5181     for(i=0; i<nField; i++){
5182       Mem *pMem = &p->aMem[i];
5183       if( pMem->zMalloc ) sqlite3VdbeMemRelease(pMem);
5184     }
5185     sqlite3DbFreeNN(db, p);
5186   }
5187 }
5188 #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
5189 
5190 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
5191 /*
5192 ** Invoke the pre-update hook. If this is an UPDATE or DELETE pre-update call,
5193 ** then cursor passed as the second argument should point to the row about
5194 ** to be update or deleted. If the application calls sqlite3_preupdate_old(),
5195 ** the required value will be read from the row the cursor points to.
5196 */
5197 void sqlite3VdbePreUpdateHook(
5198   Vdbe *v,                        /* Vdbe pre-update hook is invoked by */
5199   VdbeCursor *pCsr,               /* Cursor to grab old.* values from */
5200   int op,                         /* SQLITE_INSERT, UPDATE or DELETE */
5201   const char *zDb,                /* Database name */
5202   Table *pTab,                    /* Modified table */
5203   i64 iKey1,                      /* Initial key value */
5204   int iReg,                       /* Register for new.* record */
5205   int iBlobWrite
5206 ){
5207   sqlite3 *db = v->db;
5208   i64 iKey2;
5209   PreUpdate preupdate;
5210   const char *zTbl = pTab->zName;
5211   static const u8 fakeSortOrder = 0;
5212 
5213   assert( db->pPreUpdate==0 );
5214   memset(&preupdate, 0, sizeof(PreUpdate));
5215   if( HasRowid(pTab)==0 ){
5216     iKey1 = iKey2 = 0;
5217     preupdate.pPk = sqlite3PrimaryKeyIndex(pTab);
5218   }else{
5219     if( op==SQLITE_UPDATE ){
5220       iKey2 = v->aMem[iReg].u.i;
5221     }else{
5222       iKey2 = iKey1;
5223     }
5224   }
5225 
5226   assert( pCsr!=0 );
5227   assert( pCsr->eCurType==CURTYPE_BTREE );
5228   assert( pCsr->nField==pTab->nCol
5229        || (pCsr->nField==pTab->nCol+1 && op==SQLITE_DELETE && iReg==-1)
5230   );
5231 
5232   preupdate.v = v;
5233   preupdate.pCsr = pCsr;
5234   preupdate.op = op;
5235   preupdate.iNewReg = iReg;
5236   preupdate.keyinfo.db = db;
5237   preupdate.keyinfo.enc = ENC(db);
5238   preupdate.keyinfo.nKeyField = pTab->nCol;
5239   preupdate.keyinfo.aSortFlags = (u8*)&fakeSortOrder;
5240   preupdate.iKey1 = iKey1;
5241   preupdate.iKey2 = iKey2;
5242   preupdate.pTab = pTab;
5243   preupdate.iBlobWrite = iBlobWrite;
5244 
5245   db->pPreUpdate = &preupdate;
5246   db->xPreUpdateCallback(db->pPreUpdateArg, db, op, zDb, zTbl, iKey1, iKey2);
5247   db->pPreUpdate = 0;
5248   sqlite3DbFree(db, preupdate.aRecord);
5249   vdbeFreeUnpacked(db, preupdate.keyinfo.nKeyField+1, preupdate.pUnpacked);
5250   vdbeFreeUnpacked(db, preupdate.keyinfo.nKeyField+1, preupdate.pNewUnpacked);
5251   if( preupdate.aNew ){
5252     int i;
5253     for(i=0; i<pCsr->nField; i++){
5254       sqlite3VdbeMemRelease(&preupdate.aNew[i]);
5255     }
5256     sqlite3DbFreeNN(db, preupdate.aNew);
5257   }
5258 }
5259 #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
5260