xref: /sqlite-3.40.0/src/vdbeaux.c (revision e89feee5)
1 /*
2 ** 2003 September 6
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 ** This file contains code used for creating, destroying, and populating
13 ** a VDBE (or an "sqlite3_stmt" as it is known to the outside world.)
14 */
15 #include "sqliteInt.h"
16 #include "vdbeInt.h"
17 
18 /*
19 ** Create a new virtual database engine.
20 */
21 Vdbe *sqlite3VdbeCreate(Parse *pParse){
22   sqlite3 *db = pParse->db;
23   Vdbe *p;
24   p = sqlite3DbMallocRawNN(db, sizeof(Vdbe) );
25   if( p==0 ) return 0;
26   memset(&p->aOp, 0, sizeof(Vdbe)-offsetof(Vdbe,aOp));
27   p->db = db;
28   if( db->pVdbe ){
29     db->pVdbe->pPrev = p;
30   }
31   p->pNext = db->pVdbe;
32   p->pPrev = 0;
33   db->pVdbe = p;
34   p->magic = VDBE_MAGIC_INIT;
35   p->pParse = pParse;
36   pParse->pVdbe = p;
37   assert( pParse->aLabel==0 );
38   assert( pParse->nLabel==0 );
39   assert( pParse->nOpAlloc==0 );
40   assert( pParse->szOpAlloc==0 );
41   sqlite3VdbeAddOp2(p, OP_Init, 0, 1);
42   return p;
43 }
44 
45 /*
46 ** Change the error string stored in Vdbe.zErrMsg
47 */
48 void sqlite3VdbeError(Vdbe *p, const char *zFormat, ...){
49   va_list ap;
50   sqlite3DbFree(p->db, p->zErrMsg);
51   va_start(ap, zFormat);
52   p->zErrMsg = sqlite3VMPrintf(p->db, zFormat, ap);
53   va_end(ap);
54 }
55 
56 /*
57 ** Remember the SQL string for a prepared statement.
58 */
59 void sqlite3VdbeSetSql(Vdbe *p, const char *z, int n, u8 prepFlags){
60   if( p==0 ) return;
61   p->prepFlags = prepFlags;
62   if( (prepFlags & SQLITE_PREPARE_SAVESQL)==0 ){
63     p->expmask = 0;
64   }
65   assert( p->zSql==0 );
66   p->zSql = sqlite3DbStrNDup(p->db, z, n);
67 #ifdef SQLITE_ENABLE_NORMALIZE
68   assert( p->zNormSql==0 );
69   if( p->zSql && (prepFlags & SQLITE_PREPARE_NORMALIZE)!=0 ){
70     sqlite3Normalize(p, p->zSql, n, prepFlags);
71     assert( p->zNormSql!=0 || p->db->mallocFailed );
72   }
73 #endif
74 }
75 
76 /*
77 ** Swap all content between two VDBE structures.
78 */
79 void sqlite3VdbeSwap(Vdbe *pA, Vdbe *pB){
80   Vdbe tmp, *pTmp;
81   char *zTmp;
82   assert( pA->db==pB->db );
83   tmp = *pA;
84   *pA = *pB;
85   *pB = tmp;
86   pTmp = pA->pNext;
87   pA->pNext = pB->pNext;
88   pB->pNext = pTmp;
89   pTmp = pA->pPrev;
90   pA->pPrev = pB->pPrev;
91   pB->pPrev = pTmp;
92   zTmp = pA->zSql;
93   pA->zSql = pB->zSql;
94   pB->zSql = zTmp;
95 #ifdef SQLITE_ENABLE_NORMALIZE
96   zTmp = pA->zNormSql;
97   pA->zNormSql = pB->zNormSql;
98   pB->zNormSql = zTmp;
99 #endif
100   pB->expmask = pA->expmask;
101   pB->prepFlags = pA->prepFlags;
102   memcpy(pB->aCounter, pA->aCounter, sizeof(pB->aCounter));
103   pB->aCounter[SQLITE_STMTSTATUS_REPREPARE]++;
104 }
105 
106 /*
107 ** Resize the Vdbe.aOp array so that it is at least nOp elements larger
108 ** than its current size. nOp is guaranteed to be less than or equal
109 ** to 1024/sizeof(Op).
110 **
111 ** If an out-of-memory error occurs while resizing the array, return
112 ** SQLITE_NOMEM. In this case Vdbe.aOp and Parse.nOpAlloc remain
113 ** unchanged (this is so that any opcodes already allocated can be
114 ** correctly deallocated along with the rest of the Vdbe).
115 */
116 static int growOpArray(Vdbe *v, int nOp){
117   VdbeOp *pNew;
118   Parse *p = v->pParse;
119 
120   /* The SQLITE_TEST_REALLOC_STRESS compile-time option is designed to force
121   ** more frequent reallocs and hence provide more opportunities for
122   ** simulated OOM faults.  SQLITE_TEST_REALLOC_STRESS is generally used
123   ** during testing only.  With SQLITE_TEST_REALLOC_STRESS grow the op array
124   ** by the minimum* amount required until the size reaches 512.  Normal
125   ** operation (without SQLITE_TEST_REALLOC_STRESS) is to double the current
126   ** size of the op array or add 1KB of space, whichever is smaller. */
127 #ifdef SQLITE_TEST_REALLOC_STRESS
128   int nNew = (p->nOpAlloc>=512 ? p->nOpAlloc*2 : p->nOpAlloc+nOp);
129 #else
130   int nNew = (p->nOpAlloc ? p->nOpAlloc*2 : (int)(1024/sizeof(Op)));
131   UNUSED_PARAMETER(nOp);
132 #endif
133 
134   /* Ensure that the size of a VDBE does not grow too large */
135   if( nNew > p->db->aLimit[SQLITE_LIMIT_VDBE_OP] ){
136     sqlite3OomFault(p->db);
137     return SQLITE_NOMEM;
138   }
139 
140   assert( nOp<=(1024/sizeof(Op)) );
141   assert( nNew>=(p->nOpAlloc+nOp) );
142   pNew = sqlite3DbRealloc(p->db, v->aOp, nNew*sizeof(Op));
143   if( pNew ){
144     p->szOpAlloc = sqlite3DbMallocSize(p->db, pNew);
145     p->nOpAlloc = p->szOpAlloc/sizeof(Op);
146     v->aOp = pNew;
147   }
148   return (pNew ? SQLITE_OK : SQLITE_NOMEM_BKPT);
149 }
150 
151 #ifdef SQLITE_DEBUG
152 /* This routine is just a convenient place to set a breakpoint that will
153 ** fire after each opcode is inserted and displayed using
154 ** "PRAGMA vdbe_addoptrace=on".
155 */
156 static void test_addop_breakpoint(void){
157   static int n = 0;
158   n++;
159 }
160 #endif
161 
162 /*
163 ** Add a new instruction to the list of instructions current in the
164 ** VDBE.  Return the address of the new instruction.
165 **
166 ** Parameters:
167 **
168 **    p               Pointer to the VDBE
169 **
170 **    op              The opcode for this instruction
171 **
172 **    p1, p2, p3      Operands
173 **
174 ** Use the sqlite3VdbeResolveLabel() function to fix an address and
175 ** the sqlite3VdbeChangeP4() function to change the value of the P4
176 ** operand.
177 */
178 static SQLITE_NOINLINE int growOp3(Vdbe *p, int op, int p1, int p2, int p3){
179   assert( p->pParse->nOpAlloc<=p->nOp );
180   if( growOpArray(p, 1) ) return 1;
181   assert( p->pParse->nOpAlloc>p->nOp );
182   return sqlite3VdbeAddOp3(p, op, p1, p2, p3);
183 }
184 int sqlite3VdbeAddOp3(Vdbe *p, int op, int p1, int p2, int p3){
185   int i;
186   VdbeOp *pOp;
187 
188   i = p->nOp;
189   assert( p->magic==VDBE_MAGIC_INIT );
190   assert( op>=0 && op<0xff );
191   if( p->pParse->nOpAlloc<=i ){
192     return growOp3(p, op, p1, p2, p3);
193   }
194   p->nOp++;
195   pOp = &p->aOp[i];
196   pOp->opcode = (u8)op;
197   pOp->p5 = 0;
198   pOp->p1 = p1;
199   pOp->p2 = p2;
200   pOp->p3 = p3;
201   pOp->p4.p = 0;
202   pOp->p4type = P4_NOTUSED;
203 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
204   pOp->zComment = 0;
205 #endif
206 #ifdef SQLITE_DEBUG
207   if( p->db->flags & SQLITE_VdbeAddopTrace ){
208     sqlite3VdbePrintOp(0, i, &p->aOp[i]);
209     test_addop_breakpoint();
210   }
211 #endif
212 #ifdef VDBE_PROFILE
213   pOp->cycles = 0;
214   pOp->cnt = 0;
215 #endif
216 #ifdef SQLITE_VDBE_COVERAGE
217   pOp->iSrcLine = 0;
218 #endif
219   return i;
220 }
221 int sqlite3VdbeAddOp0(Vdbe *p, int op){
222   return sqlite3VdbeAddOp3(p, op, 0, 0, 0);
223 }
224 int sqlite3VdbeAddOp1(Vdbe *p, int op, int p1){
225   return sqlite3VdbeAddOp3(p, op, p1, 0, 0);
226 }
227 int sqlite3VdbeAddOp2(Vdbe *p, int op, int p1, int p2){
228   return sqlite3VdbeAddOp3(p, op, p1, p2, 0);
229 }
230 
231 /* Generate code for an unconditional jump to instruction iDest
232 */
233 int sqlite3VdbeGoto(Vdbe *p, int iDest){
234   return sqlite3VdbeAddOp3(p, OP_Goto, 0, iDest, 0);
235 }
236 
237 /* Generate code to cause the string zStr to be loaded into
238 ** register iDest
239 */
240 int sqlite3VdbeLoadString(Vdbe *p, int iDest, const char *zStr){
241   return sqlite3VdbeAddOp4(p, OP_String8, 0, iDest, 0, zStr, 0);
242 }
243 
244 /*
245 ** Generate code that initializes multiple registers to string or integer
246 ** constants.  The registers begin with iDest and increase consecutively.
247 ** One register is initialized for each characgter in zTypes[].  For each
248 ** "s" character in zTypes[], the register is a string if the argument is
249 ** not NULL, or OP_Null if the value is a null pointer.  For each "i" character
250 ** in zTypes[], the register is initialized to an integer.
251 **
252 ** If the input string does not end with "X" then an OP_ResultRow instruction
253 ** is generated for the values inserted.
254 */
255 void sqlite3VdbeMultiLoad(Vdbe *p, int iDest, const char *zTypes, ...){
256   va_list ap;
257   int i;
258   char c;
259   va_start(ap, zTypes);
260   for(i=0; (c = zTypes[i])!=0; i++){
261     if( c=='s' ){
262       const char *z = va_arg(ap, const char*);
263       sqlite3VdbeAddOp4(p, z==0 ? OP_Null : OP_String8, 0, iDest+i, 0, z, 0);
264     }else if( c=='i' ){
265       sqlite3VdbeAddOp2(p, OP_Integer, va_arg(ap, int), iDest+i);
266     }else{
267       goto skip_op_resultrow;
268     }
269   }
270   sqlite3VdbeAddOp2(p, OP_ResultRow, iDest, i);
271 skip_op_resultrow:
272   va_end(ap);
273 }
274 
275 /*
276 ** Add an opcode that includes the p4 value as a pointer.
277 */
278 int sqlite3VdbeAddOp4(
279   Vdbe *p,            /* Add the opcode to this VM */
280   int op,             /* The new opcode */
281   int p1,             /* The P1 operand */
282   int p2,             /* The P2 operand */
283   int p3,             /* The P3 operand */
284   const char *zP4,    /* The P4 operand */
285   int p4type          /* P4 operand type */
286 ){
287   int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
288   sqlite3VdbeChangeP4(p, addr, zP4, p4type);
289   return addr;
290 }
291 
292 /*
293 ** Add an opcode that includes the p4 value with a P4_INT64 or
294 ** P4_REAL type.
295 */
296 int sqlite3VdbeAddOp4Dup8(
297   Vdbe *p,            /* Add the opcode to this VM */
298   int op,             /* The new opcode */
299   int p1,             /* The P1 operand */
300   int p2,             /* The P2 operand */
301   int p3,             /* The P3 operand */
302   const u8 *zP4,      /* The P4 operand */
303   int p4type          /* P4 operand type */
304 ){
305   char *p4copy = sqlite3DbMallocRawNN(sqlite3VdbeDb(p), 8);
306   if( p4copy ) memcpy(p4copy, zP4, 8);
307   return sqlite3VdbeAddOp4(p, op, p1, p2, p3, p4copy, p4type);
308 }
309 
310 #ifndef SQLITE_OMIT_EXPLAIN
311 /*
312 ** Return the address of the current EXPLAIN QUERY PLAN baseline.
313 ** 0 means "none".
314 */
315 int sqlite3VdbeExplainParent(Parse *pParse){
316   VdbeOp *pOp;
317   if( pParse->addrExplain==0 ) return 0;
318   pOp = sqlite3VdbeGetOp(pParse->pVdbe, pParse->addrExplain);
319   return pOp->p2;
320 }
321 
322 /*
323 ** Add a new OP_Explain opcode.
324 **
325 ** If the bPush flag is true, then make this opcode the parent for
326 ** subsequent Explains until sqlite3VdbeExplainPop() is called.
327 */
328 void sqlite3VdbeExplain(Parse *pParse, u8 bPush, const char *zFmt, ...){
329   if( pParse->explain==2 ){
330     char *zMsg;
331     Vdbe *v;
332     va_list ap;
333     int iThis;
334     va_start(ap, zFmt);
335     zMsg = sqlite3VMPrintf(pParse->db, zFmt, ap);
336     va_end(ap);
337     v = pParse->pVdbe;
338     iThis = v->nOp;
339     sqlite3VdbeAddOp4(v, OP_Explain, iThis, pParse->addrExplain, 0,
340                       zMsg, P4_DYNAMIC);
341     if( bPush) pParse->addrExplain = iThis;
342   }
343 }
344 
345 /*
346 ** Pop the EXPLAIN QUERY PLAN stack one level.
347 */
348 void sqlite3VdbeExplainPop(Parse *pParse){
349   pParse->addrExplain = sqlite3VdbeExplainParent(pParse);
350 }
351 #endif /* SQLITE_OMIT_EXPLAIN */
352 
353 /*
354 ** Add an OP_ParseSchema opcode.  This routine is broken out from
355 ** sqlite3VdbeAddOp4() since it needs to also needs to mark all btrees
356 ** as having been used.
357 **
358 ** The zWhere string must have been obtained from sqlite3_malloc().
359 ** This routine will take ownership of the allocated memory.
360 */
361 void sqlite3VdbeAddParseSchemaOp(Vdbe *p, int iDb, char *zWhere){
362   int j;
363   sqlite3VdbeAddOp4(p, OP_ParseSchema, iDb, 0, 0, zWhere, P4_DYNAMIC);
364   for(j=0; j<p->db->nDb; j++) sqlite3VdbeUsesBtree(p, j);
365 }
366 
367 /*
368 ** Add an opcode that includes the p4 value as an integer.
369 */
370 int sqlite3VdbeAddOp4Int(
371   Vdbe *p,            /* Add the opcode to this VM */
372   int op,             /* The new opcode */
373   int p1,             /* The P1 operand */
374   int p2,             /* The P2 operand */
375   int p3,             /* The P3 operand */
376   int p4              /* The P4 operand as an integer */
377 ){
378   int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
379   if( p->db->mallocFailed==0 ){
380     VdbeOp *pOp = &p->aOp[addr];
381     pOp->p4type = P4_INT32;
382     pOp->p4.i = p4;
383   }
384   return addr;
385 }
386 
387 /* Insert the end of a co-routine
388 */
389 void sqlite3VdbeEndCoroutine(Vdbe *v, int regYield){
390   sqlite3VdbeAddOp1(v, OP_EndCoroutine, regYield);
391 
392   /* Clear the temporary register cache, thereby ensuring that each
393   ** co-routine has its own independent set of registers, because co-routines
394   ** might expect their registers to be preserved across an OP_Yield, and
395   ** that could cause problems if two or more co-routines are using the same
396   ** temporary register.
397   */
398   v->pParse->nTempReg = 0;
399   v->pParse->nRangeReg = 0;
400 }
401 
402 /*
403 ** Create a new symbolic label for an instruction that has yet to be
404 ** coded.  The symbolic label is really just a negative number.  The
405 ** label can be used as the P2 value of an operation.  Later, when
406 ** the label is resolved to a specific address, the VDBE will scan
407 ** through its operation list and change all values of P2 which match
408 ** the label into the resolved address.
409 **
410 ** The VDBE knows that a P2 value is a label because labels are
411 ** always negative and P2 values are suppose to be non-negative.
412 ** Hence, a negative P2 value is a label that has yet to be resolved.
413 **
414 ** Zero is returned if a malloc() fails.
415 */
416 int sqlite3VdbeMakeLabel(Vdbe *v){
417   Parse *p = v->pParse;
418   int i = p->nLabel++;
419   assert( v->magic==VDBE_MAGIC_INIT );
420   if( (i & (i-1))==0 ){
421     p->aLabel = sqlite3DbReallocOrFree(p->db, p->aLabel,
422                                        (i*2+1)*sizeof(p->aLabel[0]));
423   }
424   if( p->aLabel ){
425     p->aLabel[i] = -1;
426   }
427   return ADDR(i);
428 }
429 
430 /*
431 ** Resolve label "x" to be the address of the next instruction to
432 ** be inserted.  The parameter "x" must have been obtained from
433 ** a prior call to sqlite3VdbeMakeLabel().
434 */
435 void sqlite3VdbeResolveLabel(Vdbe *v, int x){
436   Parse *p = v->pParse;
437   int j = ADDR(x);
438   assert( v->magic==VDBE_MAGIC_INIT );
439   assert( j<p->nLabel );
440   assert( j>=0 );
441   if( p->aLabel ){
442 #ifdef SQLITE_DEBUG
443     if( p->db->flags & SQLITE_VdbeAddopTrace ){
444       printf("RESOLVE LABEL %d to %d\n", x, v->nOp);
445     }
446 #endif
447     assert( p->aLabel[j]==(-1) ); /* Labels may only be resolved once */
448     p->aLabel[j] = v->nOp;
449   }
450 }
451 
452 /*
453 ** Mark the VDBE as one that can only be run one time.
454 */
455 void sqlite3VdbeRunOnlyOnce(Vdbe *p){
456   p->runOnlyOnce = 1;
457 }
458 
459 /*
460 ** Mark the VDBE as one that can only be run multiple times.
461 */
462 void sqlite3VdbeReusable(Vdbe *p){
463   p->runOnlyOnce = 0;
464 }
465 
466 #ifdef SQLITE_DEBUG /* sqlite3AssertMayAbort() logic */
467 
468 /*
469 ** The following type and function are used to iterate through all opcodes
470 ** in a Vdbe main program and each of the sub-programs (triggers) it may
471 ** invoke directly or indirectly. It should be used as follows:
472 **
473 **   Op *pOp;
474 **   VdbeOpIter sIter;
475 **
476 **   memset(&sIter, 0, sizeof(sIter));
477 **   sIter.v = v;                            // v is of type Vdbe*
478 **   while( (pOp = opIterNext(&sIter)) ){
479 **     // Do something with pOp
480 **   }
481 **   sqlite3DbFree(v->db, sIter.apSub);
482 **
483 */
484 typedef struct VdbeOpIter VdbeOpIter;
485 struct VdbeOpIter {
486   Vdbe *v;                   /* Vdbe to iterate through the opcodes of */
487   SubProgram **apSub;        /* Array of subprograms */
488   int nSub;                  /* Number of entries in apSub */
489   int iAddr;                 /* Address of next instruction to return */
490   int iSub;                  /* 0 = main program, 1 = first sub-program etc. */
491 };
492 static Op *opIterNext(VdbeOpIter *p){
493   Vdbe *v = p->v;
494   Op *pRet = 0;
495   Op *aOp;
496   int nOp;
497 
498   if( p->iSub<=p->nSub ){
499 
500     if( p->iSub==0 ){
501       aOp = v->aOp;
502       nOp = v->nOp;
503     }else{
504       aOp = p->apSub[p->iSub-1]->aOp;
505       nOp = p->apSub[p->iSub-1]->nOp;
506     }
507     assert( p->iAddr<nOp );
508 
509     pRet = &aOp[p->iAddr];
510     p->iAddr++;
511     if( p->iAddr==nOp ){
512       p->iSub++;
513       p->iAddr = 0;
514     }
515 
516     if( pRet->p4type==P4_SUBPROGRAM ){
517       int nByte = (p->nSub+1)*sizeof(SubProgram*);
518       int j;
519       for(j=0; j<p->nSub; j++){
520         if( p->apSub[j]==pRet->p4.pProgram ) break;
521       }
522       if( j==p->nSub ){
523         p->apSub = sqlite3DbReallocOrFree(v->db, p->apSub, nByte);
524         if( !p->apSub ){
525           pRet = 0;
526         }else{
527           p->apSub[p->nSub++] = pRet->p4.pProgram;
528         }
529       }
530     }
531   }
532 
533   return pRet;
534 }
535 
536 /*
537 ** Check if the program stored in the VM associated with pParse may
538 ** throw an ABORT exception (causing the statement, but not entire transaction
539 ** to be rolled back). This condition is true if the main program or any
540 ** sub-programs contains any of the following:
541 **
542 **   *  OP_Halt with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
543 **   *  OP_HaltIfNull with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
544 **   *  OP_Destroy
545 **   *  OP_VUpdate
546 **   *  OP_VRename
547 **   *  OP_FkCounter with P2==0 (immediate foreign key constraint)
548 **   *  OP_CreateBtree/BTREE_INTKEY and OP_InitCoroutine
549 **      (for CREATE TABLE AS SELECT ...)
550 **
551 ** Then check that the value of Parse.mayAbort is true if an
552 ** ABORT may be thrown, or false otherwise. Return true if it does
553 ** match, or false otherwise. This function is intended to be used as
554 ** part of an assert statement in the compiler. Similar to:
555 **
556 **   assert( sqlite3VdbeAssertMayAbort(pParse->pVdbe, pParse->mayAbort) );
557 */
558 int sqlite3VdbeAssertMayAbort(Vdbe *v, int mayAbort){
559   int hasAbort = 0;
560   int hasFkCounter = 0;
561   int hasCreateTable = 0;
562   int hasInitCoroutine = 0;
563   Op *pOp;
564   VdbeOpIter sIter;
565   memset(&sIter, 0, sizeof(sIter));
566   sIter.v = v;
567 
568   while( (pOp = opIterNext(&sIter))!=0 ){
569     int opcode = pOp->opcode;
570     if( opcode==OP_Destroy || opcode==OP_VUpdate || opcode==OP_VRename
571      || ((opcode==OP_Halt || opcode==OP_HaltIfNull)
572       && ((pOp->p1&0xff)==SQLITE_CONSTRAINT && pOp->p2==OE_Abort))
573     ){
574       hasAbort = 1;
575       break;
576     }
577     if( opcode==OP_CreateBtree && pOp->p3==BTREE_INTKEY ) hasCreateTable = 1;
578     if( opcode==OP_InitCoroutine ) hasInitCoroutine = 1;
579 #ifndef SQLITE_OMIT_FOREIGN_KEY
580     if( opcode==OP_FkCounter && pOp->p1==0 && pOp->p2==1 ){
581       hasFkCounter = 1;
582     }
583 #endif
584   }
585   sqlite3DbFree(v->db, sIter.apSub);
586 
587   /* Return true if hasAbort==mayAbort. Or if a malloc failure occurred.
588   ** If malloc failed, then the while() loop above may not have iterated
589   ** through all opcodes and hasAbort may be set incorrectly. Return
590   ** true for this case to prevent the assert() in the callers frame
591   ** from failing.  */
592   return ( v->db->mallocFailed || hasAbort==mayAbort || hasFkCounter
593               || (hasCreateTable && hasInitCoroutine) );
594 }
595 #endif /* SQLITE_DEBUG - the sqlite3AssertMayAbort() function */
596 
597 #ifdef SQLITE_DEBUG
598 /*
599 ** Increment the nWrite counter in the VDBE if the cursor is not an
600 ** ephemeral cursor, or if the cursor argument is NULL.
601 */
602 void sqlite3VdbeIncrWriteCounter(Vdbe *p, VdbeCursor *pC){
603   if( pC==0
604    || (pC->eCurType!=CURTYPE_SORTER
605        && pC->eCurType!=CURTYPE_PSEUDO
606        && !pC->isEphemeral)
607   ){
608     p->nWrite++;
609   }
610 }
611 #endif
612 
613 #ifdef SQLITE_DEBUG
614 /*
615 ** Assert if an Abort at this point in time might result in a corrupt
616 ** database.
617 */
618 void sqlite3VdbeAssertAbortable(Vdbe *p){
619   assert( p->nWrite==0 || p->usesStmtJournal );
620 }
621 #endif
622 
623 /*
624 ** This routine is called after all opcodes have been inserted.  It loops
625 ** through all the opcodes and fixes up some details.
626 **
627 ** (1) For each jump instruction with a negative P2 value (a label)
628 **     resolve the P2 value to an actual address.
629 **
630 ** (2) Compute the maximum number of arguments used by any SQL function
631 **     and store that value in *pMaxFuncArgs.
632 **
633 ** (3) Update the Vdbe.readOnly and Vdbe.bIsReader flags to accurately
634 **     indicate what the prepared statement actually does.
635 **
636 ** (4) Initialize the p4.xAdvance pointer on opcodes that use it.
637 **
638 ** (5) Reclaim the memory allocated for storing labels.
639 **
640 ** This routine will only function correctly if the mkopcodeh.tcl generator
641 ** script numbers the opcodes correctly.  Changes to this routine must be
642 ** coordinated with changes to mkopcodeh.tcl.
643 */
644 static void resolveP2Values(Vdbe *p, int *pMaxFuncArgs){
645   int nMaxArgs = *pMaxFuncArgs;
646   Op *pOp;
647   Parse *pParse = p->pParse;
648   int *aLabel = pParse->aLabel;
649   p->readOnly = 1;
650   p->bIsReader = 0;
651   pOp = &p->aOp[p->nOp-1];
652   while(1){
653 
654     /* Only JUMP opcodes and the short list of special opcodes in the switch
655     ** below need to be considered.  The mkopcodeh.tcl generator script groups
656     ** all these opcodes together near the front of the opcode list.  Skip
657     ** any opcode that does not need processing by virtual of the fact that
658     ** it is larger than SQLITE_MX_JUMP_OPCODE, as a performance optimization.
659     */
660     if( pOp->opcode<=SQLITE_MX_JUMP_OPCODE ){
661       /* NOTE: Be sure to update mkopcodeh.tcl when adding or removing
662       ** cases from this switch! */
663       switch( pOp->opcode ){
664         case OP_Transaction: {
665           if( pOp->p2!=0 ) p->readOnly = 0;
666           /* fall thru */
667         }
668         case OP_AutoCommit:
669         case OP_Savepoint: {
670           p->bIsReader = 1;
671           break;
672         }
673 #ifndef SQLITE_OMIT_WAL
674         case OP_Checkpoint:
675 #endif
676         case OP_Vacuum:
677         case OP_JournalMode: {
678           p->readOnly = 0;
679           p->bIsReader = 1;
680           break;
681         }
682         case OP_Next:
683         case OP_SorterNext: {
684           pOp->p4.xAdvance = sqlite3BtreeNext;
685           pOp->p4type = P4_ADVANCE;
686           /* The code generator never codes any of these opcodes as a jump
687           ** to a label.  They are always coded as a jump backwards to a
688           ** known address */
689           assert( pOp->p2>=0 );
690           break;
691         }
692         case OP_Prev: {
693           pOp->p4.xAdvance = sqlite3BtreePrevious;
694           pOp->p4type = P4_ADVANCE;
695           /* The code generator never codes any of these opcodes as a jump
696           ** to a label.  They are always coded as a jump backwards to a
697           ** known address */
698           assert( pOp->p2>=0 );
699           break;
700         }
701 #ifndef SQLITE_OMIT_VIRTUALTABLE
702         case OP_VUpdate: {
703           if( pOp->p2>nMaxArgs ) nMaxArgs = pOp->p2;
704           break;
705         }
706         case OP_VFilter: {
707           int n;
708           assert( (pOp - p->aOp) >= 3 );
709           assert( pOp[-1].opcode==OP_Integer );
710           n = pOp[-1].p1;
711           if( n>nMaxArgs ) nMaxArgs = n;
712           /* Fall through into the default case */
713         }
714 #endif
715         default: {
716           if( pOp->p2<0 ){
717             /* The mkopcodeh.tcl script has so arranged things that the only
718             ** non-jump opcodes less than SQLITE_MX_JUMP_CODE are guaranteed to
719             ** have non-negative values for P2. */
720             assert( (sqlite3OpcodeProperty[pOp->opcode] & OPFLG_JUMP)!=0 );
721             assert( ADDR(pOp->p2)<pParse->nLabel );
722             pOp->p2 = aLabel[ADDR(pOp->p2)];
723           }
724           break;
725         }
726       }
727       /* The mkopcodeh.tcl script has so arranged things that the only
728       ** non-jump opcodes less than SQLITE_MX_JUMP_CODE are guaranteed to
729       ** have non-negative values for P2. */
730       assert( (sqlite3OpcodeProperty[pOp->opcode]&OPFLG_JUMP)==0 || pOp->p2>=0);
731     }
732     if( pOp==p->aOp ) break;
733     pOp--;
734   }
735   sqlite3DbFree(p->db, pParse->aLabel);
736   pParse->aLabel = 0;
737   pParse->nLabel = 0;
738   *pMaxFuncArgs = nMaxArgs;
739   assert( p->bIsReader!=0 || DbMaskAllZero(p->btreeMask) );
740 }
741 
742 /*
743 ** Return the address of the next instruction to be inserted.
744 */
745 int sqlite3VdbeCurrentAddr(Vdbe *p){
746   assert( p->magic==VDBE_MAGIC_INIT );
747   return p->nOp;
748 }
749 
750 /*
751 ** Verify that at least N opcode slots are available in p without
752 ** having to malloc for more space (except when compiled using
753 ** SQLITE_TEST_REALLOC_STRESS).  This interface is used during testing
754 ** to verify that certain calls to sqlite3VdbeAddOpList() can never
755 ** fail due to a OOM fault and hence that the return value from
756 ** sqlite3VdbeAddOpList() will always be non-NULL.
757 */
758 #if defined(SQLITE_DEBUG) && !defined(SQLITE_TEST_REALLOC_STRESS)
759 void sqlite3VdbeVerifyNoMallocRequired(Vdbe *p, int N){
760   assert( p->nOp + N <= p->pParse->nOpAlloc );
761 }
762 #endif
763 
764 /*
765 ** Verify that the VM passed as the only argument does not contain
766 ** an OP_ResultRow opcode. Fail an assert() if it does. This is used
767 ** by code in pragma.c to ensure that the implementation of certain
768 ** pragmas comports with the flags specified in the mkpragmatab.tcl
769 ** script.
770 */
771 #if defined(SQLITE_DEBUG) && !defined(SQLITE_TEST_REALLOC_STRESS)
772 void sqlite3VdbeVerifyNoResultRow(Vdbe *p){
773   int i;
774   for(i=0; i<p->nOp; i++){
775     assert( p->aOp[i].opcode!=OP_ResultRow );
776   }
777 }
778 #endif
779 
780 /*
781 ** Generate code (a single OP_Abortable opcode) that will
782 ** verify that the VDBE program can safely call Abort in the current
783 ** context.
784 */
785 #if defined(SQLITE_DEBUG)
786 void sqlite3VdbeVerifyAbortable(Vdbe *p, int onError){
787   if( onError==OE_Abort ) sqlite3VdbeAddOp0(p, OP_Abortable);
788 }
789 #endif
790 
791 /*
792 ** This function returns a pointer to the array of opcodes associated with
793 ** the Vdbe passed as the first argument. It is the callers responsibility
794 ** to arrange for the returned array to be eventually freed using the
795 ** vdbeFreeOpArray() function.
796 **
797 ** Before returning, *pnOp is set to the number of entries in the returned
798 ** array. Also, *pnMaxArg is set to the larger of its current value and
799 ** the number of entries in the Vdbe.apArg[] array required to execute the
800 ** returned program.
801 */
802 VdbeOp *sqlite3VdbeTakeOpArray(Vdbe *p, int *pnOp, int *pnMaxArg){
803   VdbeOp *aOp = p->aOp;
804   assert( aOp && !p->db->mallocFailed );
805 
806   /* Check that sqlite3VdbeUsesBtree() was not called on this VM */
807   assert( DbMaskAllZero(p->btreeMask) );
808 
809   resolveP2Values(p, pnMaxArg);
810   *pnOp = p->nOp;
811   p->aOp = 0;
812   return aOp;
813 }
814 
815 /*
816 ** Add a whole list of operations to the operation stack.  Return a
817 ** pointer to the first operation inserted.
818 **
819 ** Non-zero P2 arguments to jump instructions are automatically adjusted
820 ** so that the jump target is relative to the first operation inserted.
821 */
822 VdbeOp *sqlite3VdbeAddOpList(
823   Vdbe *p,                     /* Add opcodes to the prepared statement */
824   int nOp,                     /* Number of opcodes to add */
825   VdbeOpList const *aOp,       /* The opcodes to be added */
826   int iLineno                  /* Source-file line number of first opcode */
827 ){
828   int i;
829   VdbeOp *pOut, *pFirst;
830   assert( nOp>0 );
831   assert( p->magic==VDBE_MAGIC_INIT );
832   if( p->nOp + nOp > p->pParse->nOpAlloc && growOpArray(p, nOp) ){
833     return 0;
834   }
835   pFirst = pOut = &p->aOp[p->nOp];
836   for(i=0; i<nOp; i++, aOp++, pOut++){
837     pOut->opcode = aOp->opcode;
838     pOut->p1 = aOp->p1;
839     pOut->p2 = aOp->p2;
840     assert( aOp->p2>=0 );
841     if( (sqlite3OpcodeProperty[aOp->opcode] & OPFLG_JUMP)!=0 && aOp->p2>0 ){
842       pOut->p2 += p->nOp;
843     }
844     pOut->p3 = aOp->p3;
845     pOut->p4type = P4_NOTUSED;
846     pOut->p4.p = 0;
847     pOut->p5 = 0;
848 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
849     pOut->zComment = 0;
850 #endif
851 #ifdef SQLITE_VDBE_COVERAGE
852     pOut->iSrcLine = iLineno+i;
853 #else
854     (void)iLineno;
855 #endif
856 #ifdef SQLITE_DEBUG
857     if( p->db->flags & SQLITE_VdbeAddopTrace ){
858       sqlite3VdbePrintOp(0, i+p->nOp, &p->aOp[i+p->nOp]);
859     }
860 #endif
861   }
862   p->nOp += nOp;
863   return pFirst;
864 }
865 
866 #if defined(SQLITE_ENABLE_STMT_SCANSTATUS)
867 /*
868 ** Add an entry to the array of counters managed by sqlite3_stmt_scanstatus().
869 */
870 void sqlite3VdbeScanStatus(
871   Vdbe *p,                        /* VM to add scanstatus() to */
872   int addrExplain,                /* Address of OP_Explain (or 0) */
873   int addrLoop,                   /* Address of loop counter */
874   int addrVisit,                  /* Address of rows visited counter */
875   LogEst nEst,                    /* Estimated number of output rows */
876   const char *zName               /* Name of table or index being scanned */
877 ){
878   int nByte = (p->nScan+1) * sizeof(ScanStatus);
879   ScanStatus *aNew;
880   aNew = (ScanStatus*)sqlite3DbRealloc(p->db, p->aScan, nByte);
881   if( aNew ){
882     ScanStatus *pNew = &aNew[p->nScan++];
883     pNew->addrExplain = addrExplain;
884     pNew->addrLoop = addrLoop;
885     pNew->addrVisit = addrVisit;
886     pNew->nEst = nEst;
887     pNew->zName = sqlite3DbStrDup(p->db, zName);
888     p->aScan = aNew;
889   }
890 }
891 #endif
892 
893 
894 /*
895 ** Change the value of the opcode, or P1, P2, P3, or P5 operands
896 ** for a specific instruction.
897 */
898 void sqlite3VdbeChangeOpcode(Vdbe *p, u32 addr, u8 iNewOpcode){
899   sqlite3VdbeGetOp(p,addr)->opcode = iNewOpcode;
900 }
901 void sqlite3VdbeChangeP1(Vdbe *p, u32 addr, int val){
902   sqlite3VdbeGetOp(p,addr)->p1 = val;
903 }
904 void sqlite3VdbeChangeP2(Vdbe *p, u32 addr, int val){
905   sqlite3VdbeGetOp(p,addr)->p2 = val;
906 }
907 void sqlite3VdbeChangeP3(Vdbe *p, u32 addr, int val){
908   sqlite3VdbeGetOp(p,addr)->p3 = val;
909 }
910 void sqlite3VdbeChangeP5(Vdbe *p, u16 p5){
911   assert( p->nOp>0 || p->db->mallocFailed );
912   if( p->nOp>0 ) p->aOp[p->nOp-1].p5 = p5;
913 }
914 
915 /*
916 ** Change the P2 operand of instruction addr so that it points to
917 ** the address of the next instruction to be coded.
918 */
919 void sqlite3VdbeJumpHere(Vdbe *p, int addr){
920   sqlite3VdbeChangeP2(p, addr, p->nOp);
921 }
922 
923 
924 /*
925 ** If the input FuncDef structure is ephemeral, then free it.  If
926 ** the FuncDef is not ephermal, then do nothing.
927 */
928 static void freeEphemeralFunction(sqlite3 *db, FuncDef *pDef){
929   if( (pDef->funcFlags & SQLITE_FUNC_EPHEM)!=0 ){
930     sqlite3DbFreeNN(db, pDef);
931   }
932 }
933 
934 static void vdbeFreeOpArray(sqlite3 *, Op *, int);
935 
936 /*
937 ** Delete a P4 value if necessary.
938 */
939 static SQLITE_NOINLINE void freeP4Mem(sqlite3 *db, Mem *p){
940   if( p->szMalloc ) sqlite3DbFree(db, p->zMalloc);
941   sqlite3DbFreeNN(db, p);
942 }
943 static SQLITE_NOINLINE void freeP4FuncCtx(sqlite3 *db, sqlite3_context *p){
944   freeEphemeralFunction(db, p->pFunc);
945  sqlite3DbFreeNN(db, p);
946 }
947 static void freeP4(sqlite3 *db, int p4type, void *p4){
948   assert( db );
949   switch( p4type ){
950     case P4_FUNCCTX: {
951       freeP4FuncCtx(db, (sqlite3_context*)p4);
952       break;
953     }
954     case P4_REAL:
955     case P4_INT64:
956     case P4_DYNAMIC:
957     case P4_DYNBLOB:
958     case P4_INTARRAY: {
959       sqlite3DbFree(db, p4);
960       break;
961     }
962     case P4_KEYINFO: {
963       if( db->pnBytesFreed==0 ) sqlite3KeyInfoUnref((KeyInfo*)p4);
964       break;
965     }
966 #ifdef SQLITE_ENABLE_CURSOR_HINTS
967     case P4_EXPR: {
968       sqlite3ExprDelete(db, (Expr*)p4);
969       break;
970     }
971 #endif
972     case P4_FUNCDEF: {
973       freeEphemeralFunction(db, (FuncDef*)p4);
974       break;
975     }
976     case P4_MEM: {
977       if( db->pnBytesFreed==0 ){
978         sqlite3ValueFree((sqlite3_value*)p4);
979       }else{
980         freeP4Mem(db, (Mem*)p4);
981       }
982       break;
983     }
984     case P4_VTAB : {
985       if( db->pnBytesFreed==0 ) sqlite3VtabUnlock((VTable *)p4);
986       break;
987     }
988   }
989 }
990 
991 /*
992 ** Free the space allocated for aOp and any p4 values allocated for the
993 ** opcodes contained within. If aOp is not NULL it is assumed to contain
994 ** nOp entries.
995 */
996 static void vdbeFreeOpArray(sqlite3 *db, Op *aOp, int nOp){
997   if( aOp ){
998     Op *pOp;
999     for(pOp=&aOp[nOp-1]; pOp>=aOp; pOp--){
1000       if( pOp->p4type <= P4_FREE_IF_LE ) freeP4(db, pOp->p4type, pOp->p4.p);
1001 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1002       sqlite3DbFree(db, pOp->zComment);
1003 #endif
1004     }
1005     sqlite3DbFreeNN(db, aOp);
1006   }
1007 }
1008 
1009 /*
1010 ** Link the SubProgram object passed as the second argument into the linked
1011 ** list at Vdbe.pSubProgram. This list is used to delete all sub-program
1012 ** objects when the VM is no longer required.
1013 */
1014 void sqlite3VdbeLinkSubProgram(Vdbe *pVdbe, SubProgram *p){
1015   p->pNext = pVdbe->pProgram;
1016   pVdbe->pProgram = p;
1017 }
1018 
1019 /*
1020 ** Change the opcode at addr into OP_Noop
1021 */
1022 int sqlite3VdbeChangeToNoop(Vdbe *p, int addr){
1023   VdbeOp *pOp;
1024   if( p->db->mallocFailed ) return 0;
1025   assert( addr>=0 && addr<p->nOp );
1026   pOp = &p->aOp[addr];
1027   freeP4(p->db, pOp->p4type, pOp->p4.p);
1028   pOp->p4type = P4_NOTUSED;
1029   pOp->p4.z = 0;
1030   pOp->opcode = OP_Noop;
1031   return 1;
1032 }
1033 
1034 /*
1035 ** If the last opcode is "op" and it is not a jump destination,
1036 ** then remove it.  Return true if and only if an opcode was removed.
1037 */
1038 int sqlite3VdbeDeletePriorOpcode(Vdbe *p, u8 op){
1039   if( p->nOp>0 && p->aOp[p->nOp-1].opcode==op ){
1040     return sqlite3VdbeChangeToNoop(p, p->nOp-1);
1041   }else{
1042     return 0;
1043   }
1044 }
1045 
1046 /*
1047 ** Change the value of the P4 operand for a specific instruction.
1048 ** This routine is useful when a large program is loaded from a
1049 ** static array using sqlite3VdbeAddOpList but we want to make a
1050 ** few minor changes to the program.
1051 **
1052 ** If n>=0 then the P4 operand is dynamic, meaning that a copy of
1053 ** the string is made into memory obtained from sqlite3_malloc().
1054 ** A value of n==0 means copy bytes of zP4 up to and including the
1055 ** first null byte.  If n>0 then copy n+1 bytes of zP4.
1056 **
1057 ** Other values of n (P4_STATIC, P4_COLLSEQ etc.) indicate that zP4 points
1058 ** to a string or structure that is guaranteed to exist for the lifetime of
1059 ** the Vdbe. In these cases we can just copy the pointer.
1060 **
1061 ** If addr<0 then change P4 on the most recently inserted instruction.
1062 */
1063 static void SQLITE_NOINLINE vdbeChangeP4Full(
1064   Vdbe *p,
1065   Op *pOp,
1066   const char *zP4,
1067   int n
1068 ){
1069   if( pOp->p4type ){
1070     freeP4(p->db, pOp->p4type, pOp->p4.p);
1071     pOp->p4type = 0;
1072     pOp->p4.p = 0;
1073   }
1074   if( n<0 ){
1075     sqlite3VdbeChangeP4(p, (int)(pOp - p->aOp), zP4, n);
1076   }else{
1077     if( n==0 ) n = sqlite3Strlen30(zP4);
1078     pOp->p4.z = sqlite3DbStrNDup(p->db, zP4, n);
1079     pOp->p4type = P4_DYNAMIC;
1080   }
1081 }
1082 void sqlite3VdbeChangeP4(Vdbe *p, int addr, const char *zP4, int n){
1083   Op *pOp;
1084   sqlite3 *db;
1085   assert( p!=0 );
1086   db = p->db;
1087   assert( p->magic==VDBE_MAGIC_INIT );
1088   assert( p->aOp!=0 || db->mallocFailed );
1089   if( db->mallocFailed ){
1090     if( n!=P4_VTAB ) freeP4(db, n, (void*)*(char**)&zP4);
1091     return;
1092   }
1093   assert( p->nOp>0 );
1094   assert( addr<p->nOp );
1095   if( addr<0 ){
1096     addr = p->nOp - 1;
1097   }
1098   pOp = &p->aOp[addr];
1099   if( n>=0 || pOp->p4type ){
1100     vdbeChangeP4Full(p, pOp, zP4, n);
1101     return;
1102   }
1103   if( n==P4_INT32 ){
1104     /* Note: this cast is safe, because the origin data point was an int
1105     ** that was cast to a (const char *). */
1106     pOp->p4.i = SQLITE_PTR_TO_INT(zP4);
1107     pOp->p4type = P4_INT32;
1108   }else if( zP4!=0 ){
1109     assert( n<0 );
1110     pOp->p4.p = (void*)zP4;
1111     pOp->p4type = (signed char)n;
1112     if( n==P4_VTAB ) sqlite3VtabLock((VTable*)zP4);
1113   }
1114 }
1115 
1116 /*
1117 ** Change the P4 operand of the most recently coded instruction
1118 ** to the value defined by the arguments.  This is a high-speed
1119 ** version of sqlite3VdbeChangeP4().
1120 **
1121 ** The P4 operand must not have been previously defined.  And the new
1122 ** P4 must not be P4_INT32.  Use sqlite3VdbeChangeP4() in either of
1123 ** those cases.
1124 */
1125 void sqlite3VdbeAppendP4(Vdbe *p, void *pP4, int n){
1126   VdbeOp *pOp;
1127   assert( n!=P4_INT32 && n!=P4_VTAB );
1128   assert( n<=0 );
1129   if( p->db->mallocFailed ){
1130     freeP4(p->db, n, pP4);
1131   }else{
1132     assert( pP4!=0 );
1133     assert( p->nOp>0 );
1134     pOp = &p->aOp[p->nOp-1];
1135     assert( pOp->p4type==P4_NOTUSED );
1136     pOp->p4type = n;
1137     pOp->p4.p = pP4;
1138   }
1139 }
1140 
1141 /*
1142 ** Set the P4 on the most recently added opcode to the KeyInfo for the
1143 ** index given.
1144 */
1145 void sqlite3VdbeSetP4KeyInfo(Parse *pParse, Index *pIdx){
1146   Vdbe *v = pParse->pVdbe;
1147   KeyInfo *pKeyInfo;
1148   assert( v!=0 );
1149   assert( pIdx!=0 );
1150   pKeyInfo = sqlite3KeyInfoOfIndex(pParse, pIdx);
1151   if( pKeyInfo ) sqlite3VdbeAppendP4(v, pKeyInfo, P4_KEYINFO);
1152 }
1153 
1154 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1155 /*
1156 ** Change the comment on the most recently coded instruction.  Or
1157 ** insert a No-op and add the comment to that new instruction.  This
1158 ** makes the code easier to read during debugging.  None of this happens
1159 ** in a production build.
1160 */
1161 static void vdbeVComment(Vdbe *p, const char *zFormat, va_list ap){
1162   assert( p->nOp>0 || p->aOp==0 );
1163   assert( p->aOp==0 || p->aOp[p->nOp-1].zComment==0 || p->db->mallocFailed );
1164   if( p->nOp ){
1165     assert( p->aOp );
1166     sqlite3DbFree(p->db, p->aOp[p->nOp-1].zComment);
1167     p->aOp[p->nOp-1].zComment = sqlite3VMPrintf(p->db, zFormat, ap);
1168   }
1169 }
1170 void sqlite3VdbeComment(Vdbe *p, const char *zFormat, ...){
1171   va_list ap;
1172   if( p ){
1173     va_start(ap, zFormat);
1174     vdbeVComment(p, zFormat, ap);
1175     va_end(ap);
1176   }
1177 }
1178 void sqlite3VdbeNoopComment(Vdbe *p, const char *zFormat, ...){
1179   va_list ap;
1180   if( p ){
1181     sqlite3VdbeAddOp0(p, OP_Noop);
1182     va_start(ap, zFormat);
1183     vdbeVComment(p, zFormat, ap);
1184     va_end(ap);
1185   }
1186 }
1187 #endif  /* NDEBUG */
1188 
1189 #ifdef SQLITE_VDBE_COVERAGE
1190 /*
1191 ** Set the value if the iSrcLine field for the previously coded instruction.
1192 */
1193 void sqlite3VdbeSetLineNumber(Vdbe *v, int iLine){
1194   sqlite3VdbeGetOp(v,-1)->iSrcLine = iLine;
1195 }
1196 #endif /* SQLITE_VDBE_COVERAGE */
1197 
1198 /*
1199 ** Return the opcode for a given address.  If the address is -1, then
1200 ** return the most recently inserted opcode.
1201 **
1202 ** If a memory allocation error has occurred prior to the calling of this
1203 ** routine, then a pointer to a dummy VdbeOp will be returned.  That opcode
1204 ** is readable but not writable, though it is cast to a writable value.
1205 ** The return of a dummy opcode allows the call to continue functioning
1206 ** after an OOM fault without having to check to see if the return from
1207 ** this routine is a valid pointer.  But because the dummy.opcode is 0,
1208 ** dummy will never be written to.  This is verified by code inspection and
1209 ** by running with Valgrind.
1210 */
1211 VdbeOp *sqlite3VdbeGetOp(Vdbe *p, int addr){
1212   /* C89 specifies that the constant "dummy" will be initialized to all
1213   ** zeros, which is correct.  MSVC generates a warning, nevertheless. */
1214   static VdbeOp dummy;  /* Ignore the MSVC warning about no initializer */
1215   assert( p->magic==VDBE_MAGIC_INIT );
1216   if( addr<0 ){
1217     addr = p->nOp - 1;
1218   }
1219   assert( (addr>=0 && addr<p->nOp) || p->db->mallocFailed );
1220   if( p->db->mallocFailed ){
1221     return (VdbeOp*)&dummy;
1222   }else{
1223     return &p->aOp[addr];
1224   }
1225 }
1226 
1227 #if defined(SQLITE_ENABLE_EXPLAIN_COMMENTS)
1228 /*
1229 ** Return an integer value for one of the parameters to the opcode pOp
1230 ** determined by character c.
1231 */
1232 static int translateP(char c, const Op *pOp){
1233   if( c=='1' ) return pOp->p1;
1234   if( c=='2' ) return pOp->p2;
1235   if( c=='3' ) return pOp->p3;
1236   if( c=='4' ) return pOp->p4.i;
1237   return pOp->p5;
1238 }
1239 
1240 /*
1241 ** Compute a string for the "comment" field of a VDBE opcode listing.
1242 **
1243 ** The Synopsis: field in comments in the vdbe.c source file gets converted
1244 ** to an extra string that is appended to the sqlite3OpcodeName().  In the
1245 ** absence of other comments, this synopsis becomes the comment on the opcode.
1246 ** Some translation occurs:
1247 **
1248 **       "PX"      ->  "r[X]"
1249 **       "PX@PY"   ->  "r[X..X+Y-1]"  or "r[x]" if y is 0 or 1
1250 **       "PX@PY+1" ->  "r[X..X+Y]"    or "r[x]" if y is 0
1251 **       "PY..PY"  ->  "r[X..Y]"      or "r[x]" if y<=x
1252 */
1253 static int displayComment(
1254   const Op *pOp,     /* The opcode to be commented */
1255   const char *zP4,   /* Previously obtained value for P4 */
1256   char *zTemp,       /* Write result here */
1257   int nTemp          /* Space available in zTemp[] */
1258 ){
1259   const char *zOpName;
1260   const char *zSynopsis;
1261   int nOpName;
1262   int ii, jj;
1263   char zAlt[50];
1264   zOpName = sqlite3OpcodeName(pOp->opcode);
1265   nOpName = sqlite3Strlen30(zOpName);
1266   if( zOpName[nOpName+1] ){
1267     int seenCom = 0;
1268     char c;
1269     zSynopsis = zOpName += nOpName + 1;
1270     if( strncmp(zSynopsis,"IF ",3)==0 ){
1271       if( pOp->p5 & SQLITE_STOREP2 ){
1272         sqlite3_snprintf(sizeof(zAlt), zAlt, "r[P2] = (%s)", zSynopsis+3);
1273       }else{
1274         sqlite3_snprintf(sizeof(zAlt), zAlt, "if %s goto P2", zSynopsis+3);
1275       }
1276       zSynopsis = zAlt;
1277     }
1278     for(ii=jj=0; jj<nTemp-1 && (c = zSynopsis[ii])!=0; ii++){
1279       if( c=='P' ){
1280         c = zSynopsis[++ii];
1281         if( c=='4' ){
1282           sqlite3_snprintf(nTemp-jj, zTemp+jj, "%s", zP4);
1283         }else if( c=='X' ){
1284           sqlite3_snprintf(nTemp-jj, zTemp+jj, "%s", pOp->zComment);
1285           seenCom = 1;
1286         }else{
1287           int v1 = translateP(c, pOp);
1288           int v2;
1289           sqlite3_snprintf(nTemp-jj, zTemp+jj, "%d", v1);
1290           if( strncmp(zSynopsis+ii+1, "@P", 2)==0 ){
1291             ii += 3;
1292             jj += sqlite3Strlen30(zTemp+jj);
1293             v2 = translateP(zSynopsis[ii], pOp);
1294             if( strncmp(zSynopsis+ii+1,"+1",2)==0 ){
1295               ii += 2;
1296               v2++;
1297             }
1298             if( v2>1 ){
1299               sqlite3_snprintf(nTemp-jj, zTemp+jj, "..%d", v1+v2-1);
1300             }
1301           }else if( strncmp(zSynopsis+ii+1, "..P3", 4)==0 && pOp->p3==0 ){
1302             ii += 4;
1303           }
1304         }
1305         jj += sqlite3Strlen30(zTemp+jj);
1306       }else{
1307         zTemp[jj++] = c;
1308       }
1309     }
1310     if( !seenCom && jj<nTemp-5 && pOp->zComment ){
1311       sqlite3_snprintf(nTemp-jj, zTemp+jj, "; %s", pOp->zComment);
1312       jj += sqlite3Strlen30(zTemp+jj);
1313     }
1314     if( jj<nTemp ) zTemp[jj] = 0;
1315   }else if( pOp->zComment ){
1316     sqlite3_snprintf(nTemp, zTemp, "%s", pOp->zComment);
1317     jj = sqlite3Strlen30(zTemp);
1318   }else{
1319     zTemp[0] = 0;
1320     jj = 0;
1321   }
1322   return jj;
1323 }
1324 #endif /* SQLITE_DEBUG */
1325 
1326 #if VDBE_DISPLAY_P4 && defined(SQLITE_ENABLE_CURSOR_HINTS)
1327 /*
1328 ** Translate the P4.pExpr value for an OP_CursorHint opcode into text
1329 ** that can be displayed in the P4 column of EXPLAIN output.
1330 */
1331 static void displayP4Expr(StrAccum *p, Expr *pExpr){
1332   const char *zOp = 0;
1333   switch( pExpr->op ){
1334     case TK_STRING:
1335       sqlite3_str_appendf(p, "%Q", pExpr->u.zToken);
1336       break;
1337     case TK_INTEGER:
1338       sqlite3_str_appendf(p, "%d", pExpr->u.iValue);
1339       break;
1340     case TK_NULL:
1341       sqlite3_str_appendf(p, "NULL");
1342       break;
1343     case TK_REGISTER: {
1344       sqlite3_str_appendf(p, "r[%d]", pExpr->iTable);
1345       break;
1346     }
1347     case TK_COLUMN: {
1348       if( pExpr->iColumn<0 ){
1349         sqlite3_str_appendf(p, "rowid");
1350       }else{
1351         sqlite3_str_appendf(p, "c%d", (int)pExpr->iColumn);
1352       }
1353       break;
1354     }
1355     case TK_LT:      zOp = "LT";      break;
1356     case TK_LE:      zOp = "LE";      break;
1357     case TK_GT:      zOp = "GT";      break;
1358     case TK_GE:      zOp = "GE";      break;
1359     case TK_NE:      zOp = "NE";      break;
1360     case TK_EQ:      zOp = "EQ";      break;
1361     case TK_IS:      zOp = "IS";      break;
1362     case TK_ISNOT:   zOp = "ISNOT";   break;
1363     case TK_AND:     zOp = "AND";     break;
1364     case TK_OR:      zOp = "OR";      break;
1365     case TK_PLUS:    zOp = "ADD";     break;
1366     case TK_STAR:    zOp = "MUL";     break;
1367     case TK_MINUS:   zOp = "SUB";     break;
1368     case TK_REM:     zOp = "REM";     break;
1369     case TK_BITAND:  zOp = "BITAND";  break;
1370     case TK_BITOR:   zOp = "BITOR";   break;
1371     case TK_SLASH:   zOp = "DIV";     break;
1372     case TK_LSHIFT:  zOp = "LSHIFT";  break;
1373     case TK_RSHIFT:  zOp = "RSHIFT";  break;
1374     case TK_CONCAT:  zOp = "CONCAT";  break;
1375     case TK_UMINUS:  zOp = "MINUS";   break;
1376     case TK_UPLUS:   zOp = "PLUS";    break;
1377     case TK_BITNOT:  zOp = "BITNOT";  break;
1378     case TK_NOT:     zOp = "NOT";     break;
1379     case TK_ISNULL:  zOp = "ISNULL";  break;
1380     case TK_NOTNULL: zOp = "NOTNULL"; break;
1381 
1382     default:
1383       sqlite3_str_appendf(p, "%s", "expr");
1384       break;
1385   }
1386 
1387   if( zOp ){
1388     sqlite3_str_appendf(p, "%s(", zOp);
1389     displayP4Expr(p, pExpr->pLeft);
1390     if( pExpr->pRight ){
1391       sqlite3_str_append(p, ",", 1);
1392       displayP4Expr(p, pExpr->pRight);
1393     }
1394     sqlite3_str_append(p, ")", 1);
1395   }
1396 }
1397 #endif /* VDBE_DISPLAY_P4 && defined(SQLITE_ENABLE_CURSOR_HINTS) */
1398 
1399 
1400 #if VDBE_DISPLAY_P4
1401 /*
1402 ** Compute a string that describes the P4 parameter for an opcode.
1403 ** Use zTemp for any required temporary buffer space.
1404 */
1405 static char *displayP4(Op *pOp, char *zTemp, int nTemp){
1406   char *zP4 = zTemp;
1407   StrAccum x;
1408   assert( nTemp>=20 );
1409   sqlite3StrAccumInit(&x, 0, zTemp, nTemp, 0);
1410   switch( pOp->p4type ){
1411     case P4_KEYINFO: {
1412       int j;
1413       KeyInfo *pKeyInfo = pOp->p4.pKeyInfo;
1414       assert( pKeyInfo->aSortOrder!=0 );
1415       sqlite3_str_appendf(&x, "k(%d", pKeyInfo->nKeyField);
1416       for(j=0; j<pKeyInfo->nKeyField; j++){
1417         CollSeq *pColl = pKeyInfo->aColl[j];
1418         const char *zColl = pColl ? pColl->zName : "";
1419         if( strcmp(zColl, "BINARY")==0 ) zColl = "B";
1420         sqlite3_str_appendf(&x, ",%s%s",
1421                pKeyInfo->aSortOrder[j] ? "-" : "", zColl);
1422       }
1423       sqlite3_str_append(&x, ")", 1);
1424       break;
1425     }
1426 #ifdef SQLITE_ENABLE_CURSOR_HINTS
1427     case P4_EXPR: {
1428       displayP4Expr(&x, pOp->p4.pExpr);
1429       break;
1430     }
1431 #endif
1432     case P4_COLLSEQ: {
1433       CollSeq *pColl = pOp->p4.pColl;
1434       sqlite3_str_appendf(&x, "(%.20s)", pColl->zName);
1435       break;
1436     }
1437     case P4_FUNCDEF: {
1438       FuncDef *pDef = pOp->p4.pFunc;
1439       sqlite3_str_appendf(&x, "%s(%d)", pDef->zName, pDef->nArg);
1440       break;
1441     }
1442 #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
1443     case P4_FUNCCTX: {
1444       FuncDef *pDef = pOp->p4.pCtx->pFunc;
1445       sqlite3_str_appendf(&x, "%s(%d)", pDef->zName, pDef->nArg);
1446       break;
1447     }
1448 #endif
1449     case P4_INT64: {
1450       sqlite3_str_appendf(&x, "%lld", *pOp->p4.pI64);
1451       break;
1452     }
1453     case P4_INT32: {
1454       sqlite3_str_appendf(&x, "%d", pOp->p4.i);
1455       break;
1456     }
1457     case P4_REAL: {
1458       sqlite3_str_appendf(&x, "%.16g", *pOp->p4.pReal);
1459       break;
1460     }
1461     case P4_MEM: {
1462       Mem *pMem = pOp->p4.pMem;
1463       if( pMem->flags & MEM_Str ){
1464         zP4 = pMem->z;
1465       }else if( pMem->flags & MEM_Int ){
1466         sqlite3_str_appendf(&x, "%lld", pMem->u.i);
1467       }else if( pMem->flags & MEM_Real ){
1468         sqlite3_str_appendf(&x, "%.16g", pMem->u.r);
1469       }else if( pMem->flags & MEM_Null ){
1470         zP4 = "NULL";
1471       }else{
1472         assert( pMem->flags & MEM_Blob );
1473         zP4 = "(blob)";
1474       }
1475       break;
1476     }
1477 #ifndef SQLITE_OMIT_VIRTUALTABLE
1478     case P4_VTAB: {
1479       sqlite3_vtab *pVtab = pOp->p4.pVtab->pVtab;
1480       sqlite3_str_appendf(&x, "vtab:%p", pVtab);
1481       break;
1482     }
1483 #endif
1484     case P4_INTARRAY: {
1485       int i;
1486       int *ai = pOp->p4.ai;
1487       int n = ai[0];   /* The first element of an INTARRAY is always the
1488                        ** count of the number of elements to follow */
1489       for(i=1; i<=n; i++){
1490         sqlite3_str_appendf(&x, ",%d", ai[i]);
1491       }
1492       zTemp[0] = '[';
1493       sqlite3_str_append(&x, "]", 1);
1494       break;
1495     }
1496     case P4_SUBPROGRAM: {
1497       sqlite3_str_appendf(&x, "program");
1498       break;
1499     }
1500     case P4_DYNBLOB:
1501     case P4_ADVANCE: {
1502       zTemp[0] = 0;
1503       break;
1504     }
1505     case P4_TABLE: {
1506       sqlite3_str_appendf(&x, "%s", pOp->p4.pTab->zName);
1507       break;
1508     }
1509     default: {
1510       zP4 = pOp->p4.z;
1511       if( zP4==0 ){
1512         zP4 = zTemp;
1513         zTemp[0] = 0;
1514       }
1515     }
1516   }
1517   sqlite3StrAccumFinish(&x);
1518   assert( zP4!=0 );
1519   return zP4;
1520 }
1521 #endif /* VDBE_DISPLAY_P4 */
1522 
1523 /*
1524 ** Declare to the Vdbe that the BTree object at db->aDb[i] is used.
1525 **
1526 ** The prepared statements need to know in advance the complete set of
1527 ** attached databases that will be use.  A mask of these databases
1528 ** is maintained in p->btreeMask.  The p->lockMask value is the subset of
1529 ** p->btreeMask of databases that will require a lock.
1530 */
1531 void sqlite3VdbeUsesBtree(Vdbe *p, int i){
1532   assert( i>=0 && i<p->db->nDb && i<(int)sizeof(yDbMask)*8 );
1533   assert( i<(int)sizeof(p->btreeMask)*8 );
1534   DbMaskSet(p->btreeMask, i);
1535   if( i!=1 && sqlite3BtreeSharable(p->db->aDb[i].pBt) ){
1536     DbMaskSet(p->lockMask, i);
1537   }
1538 }
1539 
1540 #if !defined(SQLITE_OMIT_SHARED_CACHE)
1541 /*
1542 ** If SQLite is compiled to support shared-cache mode and to be threadsafe,
1543 ** this routine obtains the mutex associated with each BtShared structure
1544 ** that may be accessed by the VM passed as an argument. In doing so it also
1545 ** sets the BtShared.db member of each of the BtShared structures, ensuring
1546 ** that the correct busy-handler callback is invoked if required.
1547 **
1548 ** If SQLite is not threadsafe but does support shared-cache mode, then
1549 ** sqlite3BtreeEnter() is invoked to set the BtShared.db variables
1550 ** of all of BtShared structures accessible via the database handle
1551 ** associated with the VM.
1552 **
1553 ** If SQLite is not threadsafe and does not support shared-cache mode, this
1554 ** function is a no-op.
1555 **
1556 ** The p->btreeMask field is a bitmask of all btrees that the prepared
1557 ** statement p will ever use.  Let N be the number of bits in p->btreeMask
1558 ** corresponding to btrees that use shared cache.  Then the runtime of
1559 ** this routine is N*N.  But as N is rarely more than 1, this should not
1560 ** be a problem.
1561 */
1562 void sqlite3VdbeEnter(Vdbe *p){
1563   int i;
1564   sqlite3 *db;
1565   Db *aDb;
1566   int nDb;
1567   if( DbMaskAllZero(p->lockMask) ) return;  /* The common case */
1568   db = p->db;
1569   aDb = db->aDb;
1570   nDb = db->nDb;
1571   for(i=0; i<nDb; i++){
1572     if( i!=1 && DbMaskTest(p->lockMask,i) && ALWAYS(aDb[i].pBt!=0) ){
1573       sqlite3BtreeEnter(aDb[i].pBt);
1574     }
1575   }
1576 }
1577 #endif
1578 
1579 #if !defined(SQLITE_OMIT_SHARED_CACHE) && SQLITE_THREADSAFE>0
1580 /*
1581 ** Unlock all of the btrees previously locked by a call to sqlite3VdbeEnter().
1582 */
1583 static SQLITE_NOINLINE void vdbeLeave(Vdbe *p){
1584   int i;
1585   sqlite3 *db;
1586   Db *aDb;
1587   int nDb;
1588   db = p->db;
1589   aDb = db->aDb;
1590   nDb = db->nDb;
1591   for(i=0; i<nDb; i++){
1592     if( i!=1 && DbMaskTest(p->lockMask,i) && ALWAYS(aDb[i].pBt!=0) ){
1593       sqlite3BtreeLeave(aDb[i].pBt);
1594     }
1595   }
1596 }
1597 void sqlite3VdbeLeave(Vdbe *p){
1598   if( DbMaskAllZero(p->lockMask) ) return;  /* The common case */
1599   vdbeLeave(p);
1600 }
1601 #endif
1602 
1603 #if defined(VDBE_PROFILE) || defined(SQLITE_DEBUG)
1604 /*
1605 ** Print a single opcode.  This routine is used for debugging only.
1606 */
1607 void sqlite3VdbePrintOp(FILE *pOut, int pc, VdbeOp *pOp){
1608   char *zP4;
1609   char zPtr[50];
1610   char zCom[100];
1611   static const char *zFormat1 = "%4d %-13s %4d %4d %4d %-13s %.2X %s\n";
1612   if( pOut==0 ) pOut = stdout;
1613   zP4 = displayP4(pOp, zPtr, sizeof(zPtr));
1614 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1615   displayComment(pOp, zP4, zCom, sizeof(zCom));
1616 #else
1617   zCom[0] = 0;
1618 #endif
1619   /* NB:  The sqlite3OpcodeName() function is implemented by code created
1620   ** by the mkopcodeh.awk and mkopcodec.awk scripts which extract the
1621   ** information from the vdbe.c source text */
1622   fprintf(pOut, zFormat1, pc,
1623       sqlite3OpcodeName(pOp->opcode), pOp->p1, pOp->p2, pOp->p3, zP4, pOp->p5,
1624       zCom
1625   );
1626   fflush(pOut);
1627 }
1628 #endif
1629 
1630 /*
1631 ** Initialize an array of N Mem element.
1632 */
1633 static void initMemArray(Mem *p, int N, sqlite3 *db, u16 flags){
1634   while( (N--)>0 ){
1635     p->db = db;
1636     p->flags = flags;
1637     p->szMalloc = 0;
1638 #ifdef SQLITE_DEBUG
1639     p->pScopyFrom = 0;
1640 #endif
1641     p++;
1642   }
1643 }
1644 
1645 /*
1646 ** Release an array of N Mem elements
1647 */
1648 static void releaseMemArray(Mem *p, int N){
1649   if( p && N ){
1650     Mem *pEnd = &p[N];
1651     sqlite3 *db = p->db;
1652     if( db->pnBytesFreed ){
1653       do{
1654         if( p->szMalloc ) sqlite3DbFree(db, p->zMalloc);
1655       }while( (++p)<pEnd );
1656       return;
1657     }
1658     do{
1659       assert( (&p[1])==pEnd || p[0].db==p[1].db );
1660       assert( sqlite3VdbeCheckMemInvariants(p) );
1661 
1662       /* This block is really an inlined version of sqlite3VdbeMemRelease()
1663       ** that takes advantage of the fact that the memory cell value is
1664       ** being set to NULL after releasing any dynamic resources.
1665       **
1666       ** The justification for duplicating code is that according to
1667       ** callgrind, this causes a certain test case to hit the CPU 4.7
1668       ** percent less (x86 linux, gcc version 4.1.2, -O6) than if
1669       ** sqlite3MemRelease() were called from here. With -O2, this jumps
1670       ** to 6.6 percent. The test case is inserting 1000 rows into a table
1671       ** with no indexes using a single prepared INSERT statement, bind()
1672       ** and reset(). Inserts are grouped into a transaction.
1673       */
1674       testcase( p->flags & MEM_Agg );
1675       testcase( p->flags & MEM_Dyn );
1676       testcase( p->xDel==sqlite3VdbeFrameMemDel );
1677       if( p->flags&(MEM_Agg|MEM_Dyn) ){
1678         sqlite3VdbeMemRelease(p);
1679       }else if( p->szMalloc ){
1680         sqlite3DbFreeNN(db, p->zMalloc);
1681         p->szMalloc = 0;
1682       }
1683 
1684       p->flags = MEM_Undefined;
1685     }while( (++p)<pEnd );
1686   }
1687 }
1688 
1689 #ifdef SQLITE_DEBUG
1690 /*
1691 ** Verify that pFrame is a valid VdbeFrame pointer.  Return true if it is
1692 ** and false if something is wrong.
1693 **
1694 ** This routine is intended for use inside of assert() statements only.
1695 */
1696 int sqlite3VdbeFrameIsValid(VdbeFrame *pFrame){
1697   if( pFrame->iFrameMagic!=SQLITE_FRAME_MAGIC ) return 0;
1698   return 1;
1699 }
1700 #endif
1701 
1702 
1703 /*
1704 ** This is a destructor on a Mem object (which is really an sqlite3_value)
1705 ** that deletes the Frame object that is attached to it as a blob.
1706 **
1707 ** This routine does not delete the Frame right away.  It merely adds the
1708 ** frame to a list of frames to be deleted when the Vdbe halts.
1709 */
1710 void sqlite3VdbeFrameMemDel(void *pArg){
1711   VdbeFrame *pFrame = (VdbeFrame*)pArg;
1712   assert( sqlite3VdbeFrameIsValid(pFrame) );
1713   pFrame->pParent = pFrame->v->pDelFrame;
1714   pFrame->v->pDelFrame = pFrame;
1715 }
1716 
1717 
1718 /*
1719 ** Delete a VdbeFrame object and its contents. VdbeFrame objects are
1720 ** allocated by the OP_Program opcode in sqlite3VdbeExec().
1721 */
1722 void sqlite3VdbeFrameDelete(VdbeFrame *p){
1723   int i;
1724   Mem *aMem = VdbeFrameMem(p);
1725   VdbeCursor **apCsr = (VdbeCursor **)&aMem[p->nChildMem];
1726   assert( sqlite3VdbeFrameIsValid(p) );
1727   for(i=0; i<p->nChildCsr; i++){
1728     sqlite3VdbeFreeCursor(p->v, apCsr[i]);
1729   }
1730   releaseMemArray(aMem, p->nChildMem);
1731   sqlite3VdbeDeleteAuxData(p->v->db, &p->pAuxData, -1, 0);
1732   sqlite3DbFree(p->v->db, p);
1733 }
1734 
1735 #ifndef SQLITE_OMIT_EXPLAIN
1736 /*
1737 ** Give a listing of the program in the virtual machine.
1738 **
1739 ** The interface is the same as sqlite3VdbeExec().  But instead of
1740 ** running the code, it invokes the callback once for each instruction.
1741 ** This feature is used to implement "EXPLAIN".
1742 **
1743 ** When p->explain==1, each instruction is listed.  When
1744 ** p->explain==2, only OP_Explain instructions are listed and these
1745 ** are shown in a different format.  p->explain==2 is used to implement
1746 ** EXPLAIN QUERY PLAN.
1747 ** 2018-04-24:  In p->explain==2 mode, the OP_Init opcodes of triggers
1748 ** are also shown, so that the boundaries between the main program and
1749 ** each trigger are clear.
1750 **
1751 ** When p->explain==1, first the main program is listed, then each of
1752 ** the trigger subprograms are listed one by one.
1753 */
1754 int sqlite3VdbeList(
1755   Vdbe *p                   /* The VDBE */
1756 ){
1757   int nRow;                            /* Stop when row count reaches this */
1758   int nSub = 0;                        /* Number of sub-vdbes seen so far */
1759   SubProgram **apSub = 0;              /* Array of sub-vdbes */
1760   Mem *pSub = 0;                       /* Memory cell hold array of subprogs */
1761   sqlite3 *db = p->db;                 /* The database connection */
1762   int i;                               /* Loop counter */
1763   int rc = SQLITE_OK;                  /* Return code */
1764   Mem *pMem = &p->aMem[1];             /* First Mem of result set */
1765   int bListSubprogs = (p->explain==1 || (db->flags & SQLITE_TriggerEQP)!=0);
1766   Op *pOp = 0;
1767 
1768   assert( p->explain );
1769   assert( p->magic==VDBE_MAGIC_RUN );
1770   assert( p->rc==SQLITE_OK || p->rc==SQLITE_BUSY || p->rc==SQLITE_NOMEM );
1771 
1772   /* Even though this opcode does not use dynamic strings for
1773   ** the result, result columns may become dynamic if the user calls
1774   ** sqlite3_column_text16(), causing a translation to UTF-16 encoding.
1775   */
1776   releaseMemArray(pMem, 8);
1777   p->pResultSet = 0;
1778 
1779   if( p->rc==SQLITE_NOMEM ){
1780     /* This happens if a malloc() inside a call to sqlite3_column_text() or
1781     ** sqlite3_column_text16() failed.  */
1782     sqlite3OomFault(db);
1783     return SQLITE_ERROR;
1784   }
1785 
1786   /* When the number of output rows reaches nRow, that means the
1787   ** listing has finished and sqlite3_step() should return SQLITE_DONE.
1788   ** nRow is the sum of the number of rows in the main program, plus
1789   ** the sum of the number of rows in all trigger subprograms encountered
1790   ** so far.  The nRow value will increase as new trigger subprograms are
1791   ** encountered, but p->pc will eventually catch up to nRow.
1792   */
1793   nRow = p->nOp;
1794   if( bListSubprogs ){
1795     /* The first 8 memory cells are used for the result set.  So we will
1796     ** commandeer the 9th cell to use as storage for an array of pointers
1797     ** to trigger subprograms.  The VDBE is guaranteed to have at least 9
1798     ** cells.  */
1799     assert( p->nMem>9 );
1800     pSub = &p->aMem[9];
1801     if( pSub->flags&MEM_Blob ){
1802       /* On the first call to sqlite3_step(), pSub will hold a NULL.  It is
1803       ** initialized to a BLOB by the P4_SUBPROGRAM processing logic below */
1804       nSub = pSub->n/sizeof(Vdbe*);
1805       apSub = (SubProgram **)pSub->z;
1806     }
1807     for(i=0; i<nSub; i++){
1808       nRow += apSub[i]->nOp;
1809     }
1810   }
1811 
1812   while(1){  /* Loop exits via break */
1813     i = p->pc++;
1814     if( i>=nRow ){
1815       p->rc = SQLITE_OK;
1816       rc = SQLITE_DONE;
1817       break;
1818     }
1819     if( i<p->nOp ){
1820       /* The output line number is small enough that we are still in the
1821       ** main program. */
1822       pOp = &p->aOp[i];
1823     }else{
1824       /* We are currently listing subprograms.  Figure out which one and
1825       ** pick up the appropriate opcode. */
1826       int j;
1827       i -= p->nOp;
1828       for(j=0; i>=apSub[j]->nOp; j++){
1829         i -= apSub[j]->nOp;
1830       }
1831       pOp = &apSub[j]->aOp[i];
1832     }
1833 
1834     /* When an OP_Program opcode is encounter (the only opcode that has
1835     ** a P4_SUBPROGRAM argument), expand the size of the array of subprograms
1836     ** kept in p->aMem[9].z to hold the new program - assuming this subprogram
1837     ** has not already been seen.
1838     */
1839     if( bListSubprogs && pOp->p4type==P4_SUBPROGRAM ){
1840       int nByte = (nSub+1)*sizeof(SubProgram*);
1841       int j;
1842       for(j=0; j<nSub; j++){
1843         if( apSub[j]==pOp->p4.pProgram ) break;
1844       }
1845       if( j==nSub ){
1846         p->rc = sqlite3VdbeMemGrow(pSub, nByte, nSub!=0);
1847         if( p->rc!=SQLITE_OK ){
1848           rc = SQLITE_ERROR;
1849           break;
1850         }
1851         apSub = (SubProgram **)pSub->z;
1852         apSub[nSub++] = pOp->p4.pProgram;
1853         pSub->flags |= MEM_Blob;
1854         pSub->n = nSub*sizeof(SubProgram*);
1855         nRow += pOp->p4.pProgram->nOp;
1856       }
1857     }
1858     if( p->explain<2 ) break;
1859     if( pOp->opcode==OP_Explain ) break;
1860     if( pOp->opcode==OP_Init && p->pc>1 ) break;
1861   }
1862 
1863   if( rc==SQLITE_OK ){
1864     if( db->u1.isInterrupted ){
1865       p->rc = SQLITE_INTERRUPT;
1866       rc = SQLITE_ERROR;
1867       sqlite3VdbeError(p, sqlite3ErrStr(p->rc));
1868     }else{
1869       char *zP4;
1870       if( p->explain==1 ){
1871         pMem->flags = MEM_Int;
1872         pMem->u.i = i;                                /* Program counter */
1873         pMem++;
1874 
1875         pMem->flags = MEM_Static|MEM_Str|MEM_Term;
1876         pMem->z = (char*)sqlite3OpcodeName(pOp->opcode); /* Opcode */
1877         assert( pMem->z!=0 );
1878         pMem->n = sqlite3Strlen30(pMem->z);
1879         pMem->enc = SQLITE_UTF8;
1880         pMem++;
1881       }
1882 
1883       pMem->flags = MEM_Int;
1884       pMem->u.i = pOp->p1;                          /* P1 */
1885       pMem++;
1886 
1887       pMem->flags = MEM_Int;
1888       pMem->u.i = pOp->p2;                          /* P2 */
1889       pMem++;
1890 
1891       pMem->flags = MEM_Int;
1892       pMem->u.i = pOp->p3;                          /* P3 */
1893       pMem++;
1894 
1895       if( sqlite3VdbeMemClearAndResize(pMem, 100) ){ /* P4 */
1896         assert( p->db->mallocFailed );
1897         return SQLITE_ERROR;
1898       }
1899       pMem->flags = MEM_Str|MEM_Term;
1900       zP4 = displayP4(pOp, pMem->z, pMem->szMalloc);
1901       if( zP4!=pMem->z ){
1902         pMem->n = 0;
1903         sqlite3VdbeMemSetStr(pMem, zP4, -1, SQLITE_UTF8, 0);
1904       }else{
1905         assert( pMem->z!=0 );
1906         pMem->n = sqlite3Strlen30(pMem->z);
1907         pMem->enc = SQLITE_UTF8;
1908       }
1909       pMem++;
1910 
1911       if( p->explain==1 ){
1912         if( sqlite3VdbeMemClearAndResize(pMem, 4) ){
1913           assert( p->db->mallocFailed );
1914           return SQLITE_ERROR;
1915         }
1916         pMem->flags = MEM_Str|MEM_Term;
1917         pMem->n = 2;
1918         sqlite3_snprintf(3, pMem->z, "%.2x", pOp->p5);   /* P5 */
1919         pMem->enc = SQLITE_UTF8;
1920         pMem++;
1921 
1922 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
1923         if( sqlite3VdbeMemClearAndResize(pMem, 500) ){
1924           assert( p->db->mallocFailed );
1925           return SQLITE_ERROR;
1926         }
1927         pMem->flags = MEM_Str|MEM_Term;
1928         pMem->n = displayComment(pOp, zP4, pMem->z, 500);
1929         pMem->enc = SQLITE_UTF8;
1930 #else
1931         pMem->flags = MEM_Null;                       /* Comment */
1932 #endif
1933       }
1934 
1935       p->nResColumn = 8 - 4*(p->explain-1);
1936       p->pResultSet = &p->aMem[1];
1937       p->rc = SQLITE_OK;
1938       rc = SQLITE_ROW;
1939     }
1940   }
1941   return rc;
1942 }
1943 #endif /* SQLITE_OMIT_EXPLAIN */
1944 
1945 #ifdef SQLITE_DEBUG
1946 /*
1947 ** Print the SQL that was used to generate a VDBE program.
1948 */
1949 void sqlite3VdbePrintSql(Vdbe *p){
1950   const char *z = 0;
1951   if( p->zSql ){
1952     z = p->zSql;
1953   }else if( p->nOp>=1 ){
1954     const VdbeOp *pOp = &p->aOp[0];
1955     if( pOp->opcode==OP_Init && pOp->p4.z!=0 ){
1956       z = pOp->p4.z;
1957       while( sqlite3Isspace(*z) ) z++;
1958     }
1959   }
1960   if( z ) printf("SQL: [%s]\n", z);
1961 }
1962 #endif
1963 
1964 #if !defined(SQLITE_OMIT_TRACE) && defined(SQLITE_ENABLE_IOTRACE)
1965 /*
1966 ** Print an IOTRACE message showing SQL content.
1967 */
1968 void sqlite3VdbeIOTraceSql(Vdbe *p){
1969   int nOp = p->nOp;
1970   VdbeOp *pOp;
1971   if( sqlite3IoTrace==0 ) return;
1972   if( nOp<1 ) return;
1973   pOp = &p->aOp[0];
1974   if( pOp->opcode==OP_Init && pOp->p4.z!=0 ){
1975     int i, j;
1976     char z[1000];
1977     sqlite3_snprintf(sizeof(z), z, "%s", pOp->p4.z);
1978     for(i=0; sqlite3Isspace(z[i]); i++){}
1979     for(j=0; z[i]; i++){
1980       if( sqlite3Isspace(z[i]) ){
1981         if( z[i-1]!=' ' ){
1982           z[j++] = ' ';
1983         }
1984       }else{
1985         z[j++] = z[i];
1986       }
1987     }
1988     z[j] = 0;
1989     sqlite3IoTrace("SQL %s\n", z);
1990   }
1991 }
1992 #endif /* !SQLITE_OMIT_TRACE && SQLITE_ENABLE_IOTRACE */
1993 
1994 /* An instance of this object describes bulk memory available for use
1995 ** by subcomponents of a prepared statement.  Space is allocated out
1996 ** of a ReusableSpace object by the allocSpace() routine below.
1997 */
1998 struct ReusableSpace {
1999   u8 *pSpace;          /* Available memory */
2000   int nFree;           /* Bytes of available memory */
2001   int nNeeded;         /* Total bytes that could not be allocated */
2002 };
2003 
2004 /* Try to allocate nByte bytes of 8-byte aligned bulk memory for pBuf
2005 ** from the ReusableSpace object.  Return a pointer to the allocated
2006 ** memory on success.  If insufficient memory is available in the
2007 ** ReusableSpace object, increase the ReusableSpace.nNeeded
2008 ** value by the amount needed and return NULL.
2009 **
2010 ** If pBuf is not initially NULL, that means that the memory has already
2011 ** been allocated by a prior call to this routine, so just return a copy
2012 ** of pBuf and leave ReusableSpace unchanged.
2013 **
2014 ** This allocator is employed to repurpose unused slots at the end of the
2015 ** opcode array of prepared state for other memory needs of the prepared
2016 ** statement.
2017 */
2018 static void *allocSpace(
2019   struct ReusableSpace *p,  /* Bulk memory available for allocation */
2020   void *pBuf,               /* Pointer to a prior allocation */
2021   int nByte                 /* Bytes of memory needed */
2022 ){
2023   assert( EIGHT_BYTE_ALIGNMENT(p->pSpace) );
2024   if( pBuf==0 ){
2025     nByte = ROUND8(nByte);
2026     if( nByte <= p->nFree ){
2027       p->nFree -= nByte;
2028       pBuf = &p->pSpace[p->nFree];
2029     }else{
2030       p->nNeeded += nByte;
2031     }
2032   }
2033   assert( EIGHT_BYTE_ALIGNMENT(pBuf) );
2034   return pBuf;
2035 }
2036 
2037 /*
2038 ** Rewind the VDBE back to the beginning in preparation for
2039 ** running it.
2040 */
2041 void sqlite3VdbeRewind(Vdbe *p){
2042 #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
2043   int i;
2044 #endif
2045   assert( p!=0 );
2046   assert( p->magic==VDBE_MAGIC_INIT || p->magic==VDBE_MAGIC_RESET );
2047 
2048   /* There should be at least one opcode.
2049   */
2050   assert( p->nOp>0 );
2051 
2052   /* Set the magic to VDBE_MAGIC_RUN sooner rather than later. */
2053   p->magic = VDBE_MAGIC_RUN;
2054 
2055 #ifdef SQLITE_DEBUG
2056   for(i=0; i<p->nMem; i++){
2057     assert( p->aMem[i].db==p->db );
2058   }
2059 #endif
2060   p->pc = -1;
2061   p->rc = SQLITE_OK;
2062   p->errorAction = OE_Abort;
2063   p->nChange = 0;
2064   p->cacheCtr = 1;
2065   p->minWriteFileFormat = 255;
2066   p->iStatement = 0;
2067   p->nFkConstraint = 0;
2068 #ifdef VDBE_PROFILE
2069   for(i=0; i<p->nOp; i++){
2070     p->aOp[i].cnt = 0;
2071     p->aOp[i].cycles = 0;
2072   }
2073 #endif
2074 }
2075 
2076 /*
2077 ** Prepare a virtual machine for execution for the first time after
2078 ** creating the virtual machine.  This involves things such
2079 ** as allocating registers and initializing the program counter.
2080 ** After the VDBE has be prepped, it can be executed by one or more
2081 ** calls to sqlite3VdbeExec().
2082 **
2083 ** This function may be called exactly once on each virtual machine.
2084 ** After this routine is called the VM has been "packaged" and is ready
2085 ** to run.  After this routine is called, further calls to
2086 ** sqlite3VdbeAddOp() functions are prohibited.  This routine disconnects
2087 ** the Vdbe from the Parse object that helped generate it so that the
2088 ** the Vdbe becomes an independent entity and the Parse object can be
2089 ** destroyed.
2090 **
2091 ** Use the sqlite3VdbeRewind() procedure to restore a virtual machine back
2092 ** to its initial state after it has been run.
2093 */
2094 void sqlite3VdbeMakeReady(
2095   Vdbe *p,                       /* The VDBE */
2096   Parse *pParse                  /* Parsing context */
2097 ){
2098   sqlite3 *db;                   /* The database connection */
2099   int nVar;                      /* Number of parameters */
2100   int nMem;                      /* Number of VM memory registers */
2101   int nCursor;                   /* Number of cursors required */
2102   int nArg;                      /* Number of arguments in subprograms */
2103   int n;                         /* Loop counter */
2104   struct ReusableSpace x;        /* Reusable bulk memory */
2105 
2106   assert( p!=0 );
2107   assert( p->nOp>0 );
2108   assert( pParse!=0 );
2109   assert( p->magic==VDBE_MAGIC_INIT );
2110   assert( pParse==p->pParse );
2111   db = p->db;
2112   assert( db->mallocFailed==0 );
2113   nVar = pParse->nVar;
2114   nMem = pParse->nMem;
2115   nCursor = pParse->nTab;
2116   nArg = pParse->nMaxArg;
2117 
2118   /* Each cursor uses a memory cell.  The first cursor (cursor 0) can
2119   ** use aMem[0] which is not otherwise used by the VDBE program.  Allocate
2120   ** space at the end of aMem[] for cursors 1 and greater.
2121   ** See also: allocateCursor().
2122   */
2123   nMem += nCursor;
2124   if( nCursor==0 && nMem>0 ) nMem++;  /* Space for aMem[0] even if not used */
2125 
2126   /* Figure out how much reusable memory is available at the end of the
2127   ** opcode array.  This extra memory will be reallocated for other elements
2128   ** of the prepared statement.
2129   */
2130   n = ROUND8(sizeof(Op)*p->nOp);              /* Bytes of opcode memory used */
2131   x.pSpace = &((u8*)p->aOp)[n];               /* Unused opcode memory */
2132   assert( EIGHT_BYTE_ALIGNMENT(x.pSpace) );
2133   x.nFree = ROUNDDOWN8(pParse->szOpAlloc - n);  /* Bytes of unused memory */
2134   assert( x.nFree>=0 );
2135   assert( EIGHT_BYTE_ALIGNMENT(&x.pSpace[x.nFree]) );
2136 
2137   resolveP2Values(p, &nArg);
2138   p->usesStmtJournal = (u8)(pParse->isMultiWrite && pParse->mayAbort);
2139   if( pParse->explain && nMem<10 ){
2140     nMem = 10;
2141   }
2142   p->expired = 0;
2143 
2144   /* Memory for registers, parameters, cursor, etc, is allocated in one or two
2145   ** passes.  On the first pass, we try to reuse unused memory at the
2146   ** end of the opcode array.  If we are unable to satisfy all memory
2147   ** requirements by reusing the opcode array tail, then the second
2148   ** pass will fill in the remainder using a fresh memory allocation.
2149   **
2150   ** This two-pass approach that reuses as much memory as possible from
2151   ** the leftover memory at the end of the opcode array.  This can significantly
2152   ** reduce the amount of memory held by a prepared statement.
2153   */
2154   do {
2155     x.nNeeded = 0;
2156     p->aMem = allocSpace(&x, p->aMem, nMem*sizeof(Mem));
2157     p->aVar = allocSpace(&x, p->aVar, nVar*sizeof(Mem));
2158     p->apArg = allocSpace(&x, p->apArg, nArg*sizeof(Mem*));
2159     p->apCsr = allocSpace(&x, p->apCsr, nCursor*sizeof(VdbeCursor*));
2160 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2161     p->anExec = allocSpace(&x, p->anExec, p->nOp*sizeof(i64));
2162 #endif
2163     if( x.nNeeded==0 ) break;
2164     x.pSpace = p->pFree = sqlite3DbMallocRawNN(db, x.nNeeded);
2165     x.nFree = x.nNeeded;
2166   }while( !db->mallocFailed );
2167 
2168   p->pVList = pParse->pVList;
2169   pParse->pVList =  0;
2170   p->explain = pParse->explain;
2171   if( db->mallocFailed ){
2172     p->nVar = 0;
2173     p->nCursor = 0;
2174     p->nMem = 0;
2175   }else{
2176     p->nCursor = nCursor;
2177     p->nVar = (ynVar)nVar;
2178     initMemArray(p->aVar, nVar, db, MEM_Null);
2179     p->nMem = nMem;
2180     initMemArray(p->aMem, nMem, db, MEM_Undefined);
2181     memset(p->apCsr, 0, nCursor*sizeof(VdbeCursor*));
2182 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2183     memset(p->anExec, 0, p->nOp*sizeof(i64));
2184 #endif
2185   }
2186   sqlite3VdbeRewind(p);
2187 }
2188 
2189 /*
2190 ** Close a VDBE cursor and release all the resources that cursor
2191 ** happens to hold.
2192 */
2193 void sqlite3VdbeFreeCursor(Vdbe *p, VdbeCursor *pCx){
2194   if( pCx==0 ){
2195     return;
2196   }
2197   assert( pCx->pBtx==0 || pCx->eCurType==CURTYPE_BTREE );
2198   switch( pCx->eCurType ){
2199     case CURTYPE_SORTER: {
2200       sqlite3VdbeSorterClose(p->db, pCx);
2201       break;
2202     }
2203     case CURTYPE_BTREE: {
2204       if( pCx->isEphemeral ){
2205         if( pCx->pBtx ) sqlite3BtreeClose(pCx->pBtx);
2206         /* The pCx->pCursor will be close automatically, if it exists, by
2207         ** the call above. */
2208       }else{
2209         assert( pCx->uc.pCursor!=0 );
2210         sqlite3BtreeCloseCursor(pCx->uc.pCursor);
2211       }
2212       break;
2213     }
2214 #ifndef SQLITE_OMIT_VIRTUALTABLE
2215     case CURTYPE_VTAB: {
2216       sqlite3_vtab_cursor *pVCur = pCx->uc.pVCur;
2217       const sqlite3_module *pModule = pVCur->pVtab->pModule;
2218       assert( pVCur->pVtab->nRef>0 );
2219       pVCur->pVtab->nRef--;
2220       pModule->xClose(pVCur);
2221       break;
2222     }
2223 #endif
2224   }
2225 }
2226 
2227 /*
2228 ** Close all cursors in the current frame.
2229 */
2230 static void closeCursorsInFrame(Vdbe *p){
2231   if( p->apCsr ){
2232     int i;
2233     for(i=0; i<p->nCursor; i++){
2234       VdbeCursor *pC = p->apCsr[i];
2235       if( pC ){
2236         sqlite3VdbeFreeCursor(p, pC);
2237         p->apCsr[i] = 0;
2238       }
2239     }
2240   }
2241 }
2242 
2243 /*
2244 ** Copy the values stored in the VdbeFrame structure to its Vdbe. This
2245 ** is used, for example, when a trigger sub-program is halted to restore
2246 ** control to the main program.
2247 */
2248 int sqlite3VdbeFrameRestore(VdbeFrame *pFrame){
2249   Vdbe *v = pFrame->v;
2250   closeCursorsInFrame(v);
2251 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
2252   v->anExec = pFrame->anExec;
2253 #endif
2254   v->aOp = pFrame->aOp;
2255   v->nOp = pFrame->nOp;
2256   v->aMem = pFrame->aMem;
2257   v->nMem = pFrame->nMem;
2258   v->apCsr = pFrame->apCsr;
2259   v->nCursor = pFrame->nCursor;
2260   v->db->lastRowid = pFrame->lastRowid;
2261   v->nChange = pFrame->nChange;
2262   v->db->nChange = pFrame->nDbChange;
2263   sqlite3VdbeDeleteAuxData(v->db, &v->pAuxData, -1, 0);
2264   v->pAuxData = pFrame->pAuxData;
2265   pFrame->pAuxData = 0;
2266   return pFrame->pc;
2267 }
2268 
2269 /*
2270 ** Close all cursors.
2271 **
2272 ** Also release any dynamic memory held by the VM in the Vdbe.aMem memory
2273 ** cell array. This is necessary as the memory cell array may contain
2274 ** pointers to VdbeFrame objects, which may in turn contain pointers to
2275 ** open cursors.
2276 */
2277 static void closeAllCursors(Vdbe *p){
2278   if( p->pFrame ){
2279     VdbeFrame *pFrame;
2280     for(pFrame=p->pFrame; pFrame->pParent; pFrame=pFrame->pParent);
2281     sqlite3VdbeFrameRestore(pFrame);
2282     p->pFrame = 0;
2283     p->nFrame = 0;
2284   }
2285   assert( p->nFrame==0 );
2286   closeCursorsInFrame(p);
2287   if( p->aMem ){
2288     releaseMemArray(p->aMem, p->nMem);
2289   }
2290   while( p->pDelFrame ){
2291     VdbeFrame *pDel = p->pDelFrame;
2292     p->pDelFrame = pDel->pParent;
2293     sqlite3VdbeFrameDelete(pDel);
2294   }
2295 
2296   /* Delete any auxdata allocations made by the VM */
2297   if( p->pAuxData ) sqlite3VdbeDeleteAuxData(p->db, &p->pAuxData, -1, 0);
2298   assert( p->pAuxData==0 );
2299 }
2300 
2301 /*
2302 ** Set the number of result columns that will be returned by this SQL
2303 ** statement. This is now set at compile time, rather than during
2304 ** execution of the vdbe program so that sqlite3_column_count() can
2305 ** be called on an SQL statement before sqlite3_step().
2306 */
2307 void sqlite3VdbeSetNumCols(Vdbe *p, int nResColumn){
2308   int n;
2309   sqlite3 *db = p->db;
2310 
2311   if( p->nResColumn ){
2312     releaseMemArray(p->aColName, p->nResColumn*COLNAME_N);
2313     sqlite3DbFree(db, p->aColName);
2314   }
2315   n = nResColumn*COLNAME_N;
2316   p->nResColumn = (u16)nResColumn;
2317   p->aColName = (Mem*)sqlite3DbMallocRawNN(db, sizeof(Mem)*n );
2318   if( p->aColName==0 ) return;
2319   initMemArray(p->aColName, n, db, MEM_Null);
2320 }
2321 
2322 /*
2323 ** Set the name of the idx'th column to be returned by the SQL statement.
2324 ** zName must be a pointer to a nul terminated string.
2325 **
2326 ** This call must be made after a call to sqlite3VdbeSetNumCols().
2327 **
2328 ** The final parameter, xDel, must be one of SQLITE_DYNAMIC, SQLITE_STATIC
2329 ** or SQLITE_TRANSIENT. If it is SQLITE_DYNAMIC, then the buffer pointed
2330 ** to by zName will be freed by sqlite3DbFree() when the vdbe is destroyed.
2331 */
2332 int sqlite3VdbeSetColName(
2333   Vdbe *p,                         /* Vdbe being configured */
2334   int idx,                         /* Index of column zName applies to */
2335   int var,                         /* One of the COLNAME_* constants */
2336   const char *zName,               /* Pointer to buffer containing name */
2337   void (*xDel)(void*)              /* Memory management strategy for zName */
2338 ){
2339   int rc;
2340   Mem *pColName;
2341   assert( idx<p->nResColumn );
2342   assert( var<COLNAME_N );
2343   if( p->db->mallocFailed ){
2344     assert( !zName || xDel!=SQLITE_DYNAMIC );
2345     return SQLITE_NOMEM_BKPT;
2346   }
2347   assert( p->aColName!=0 );
2348   pColName = &(p->aColName[idx+var*p->nResColumn]);
2349   rc = sqlite3VdbeMemSetStr(pColName, zName, -1, SQLITE_UTF8, xDel);
2350   assert( rc!=0 || !zName || (pColName->flags&MEM_Term)!=0 );
2351   return rc;
2352 }
2353 
2354 /*
2355 ** A read or write transaction may or may not be active on database handle
2356 ** db. If a transaction is active, commit it. If there is a
2357 ** write-transaction spanning more than one database file, this routine
2358 ** takes care of the master journal trickery.
2359 */
2360 static int vdbeCommit(sqlite3 *db, Vdbe *p){
2361   int i;
2362   int nTrans = 0;  /* Number of databases with an active write-transaction
2363                    ** that are candidates for a two-phase commit using a
2364                    ** master-journal */
2365   int rc = SQLITE_OK;
2366   int needXcommit = 0;
2367 
2368 #ifdef SQLITE_OMIT_VIRTUALTABLE
2369   /* With this option, sqlite3VtabSync() is defined to be simply
2370   ** SQLITE_OK so p is not used.
2371   */
2372   UNUSED_PARAMETER(p);
2373 #endif
2374 
2375   /* Before doing anything else, call the xSync() callback for any
2376   ** virtual module tables written in this transaction. This has to
2377   ** be done before determining whether a master journal file is
2378   ** required, as an xSync() callback may add an attached database
2379   ** to the transaction.
2380   */
2381   rc = sqlite3VtabSync(db, p);
2382 
2383   /* This loop determines (a) if the commit hook should be invoked and
2384   ** (b) how many database files have open write transactions, not
2385   ** including the temp database. (b) is important because if more than
2386   ** one database file has an open write transaction, a master journal
2387   ** file is required for an atomic commit.
2388   */
2389   for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2390     Btree *pBt = db->aDb[i].pBt;
2391     if( sqlite3BtreeIsInTrans(pBt) ){
2392       /* Whether or not a database might need a master journal depends upon
2393       ** its journal mode (among other things).  This matrix determines which
2394       ** journal modes use a master journal and which do not */
2395       static const u8 aMJNeeded[] = {
2396         /* DELETE   */  1,
2397         /* PERSIST   */ 1,
2398         /* OFF       */ 0,
2399         /* TRUNCATE  */ 1,
2400         /* MEMORY    */ 0,
2401         /* WAL       */ 0
2402       };
2403       Pager *pPager;   /* Pager associated with pBt */
2404       needXcommit = 1;
2405       sqlite3BtreeEnter(pBt);
2406       pPager = sqlite3BtreePager(pBt);
2407       if( db->aDb[i].safety_level!=PAGER_SYNCHRONOUS_OFF
2408        && aMJNeeded[sqlite3PagerGetJournalMode(pPager)]
2409        && sqlite3PagerIsMemdb(pPager)==0
2410       ){
2411         assert( i!=1 );
2412         nTrans++;
2413       }
2414       rc = sqlite3PagerExclusiveLock(pPager);
2415       sqlite3BtreeLeave(pBt);
2416     }
2417   }
2418   if( rc!=SQLITE_OK ){
2419     return rc;
2420   }
2421 
2422   /* If there are any write-transactions at all, invoke the commit hook */
2423   if( needXcommit && db->xCommitCallback ){
2424     rc = db->xCommitCallback(db->pCommitArg);
2425     if( rc ){
2426       return SQLITE_CONSTRAINT_COMMITHOOK;
2427     }
2428   }
2429 
2430   /* The simple case - no more than one database file (not counting the
2431   ** TEMP database) has a transaction active.   There is no need for the
2432   ** master-journal.
2433   **
2434   ** If the return value of sqlite3BtreeGetFilename() is a zero length
2435   ** string, it means the main database is :memory: or a temp file.  In
2436   ** that case we do not support atomic multi-file commits, so use the
2437   ** simple case then too.
2438   */
2439   if( 0==sqlite3Strlen30(sqlite3BtreeGetFilename(db->aDb[0].pBt))
2440    || nTrans<=1
2441   ){
2442     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2443       Btree *pBt = db->aDb[i].pBt;
2444       if( pBt ){
2445         rc = sqlite3BtreeCommitPhaseOne(pBt, 0);
2446       }
2447     }
2448 
2449     /* Do the commit only if all databases successfully complete phase 1.
2450     ** If one of the BtreeCommitPhaseOne() calls fails, this indicates an
2451     ** IO error while deleting or truncating a journal file. It is unlikely,
2452     ** but could happen. In this case abandon processing and return the error.
2453     */
2454     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2455       Btree *pBt = db->aDb[i].pBt;
2456       if( pBt ){
2457         rc = sqlite3BtreeCommitPhaseTwo(pBt, 0);
2458       }
2459     }
2460     if( rc==SQLITE_OK ){
2461       sqlite3VtabCommit(db);
2462     }
2463   }
2464 
2465   /* The complex case - There is a multi-file write-transaction active.
2466   ** This requires a master journal file to ensure the transaction is
2467   ** committed atomically.
2468   */
2469 #ifndef SQLITE_OMIT_DISKIO
2470   else{
2471     sqlite3_vfs *pVfs = db->pVfs;
2472     char *zMaster = 0;   /* File-name for the master journal */
2473     char const *zMainFile = sqlite3BtreeGetFilename(db->aDb[0].pBt);
2474     sqlite3_file *pMaster = 0;
2475     i64 offset = 0;
2476     int res;
2477     int retryCount = 0;
2478     int nMainFile;
2479 
2480     /* Select a master journal file name */
2481     nMainFile = sqlite3Strlen30(zMainFile);
2482     zMaster = sqlite3MPrintf(db, "%s-mjXXXXXX9XXz", zMainFile);
2483     if( zMaster==0 ) return SQLITE_NOMEM_BKPT;
2484     do {
2485       u32 iRandom;
2486       if( retryCount ){
2487         if( retryCount>100 ){
2488           sqlite3_log(SQLITE_FULL, "MJ delete: %s", zMaster);
2489           sqlite3OsDelete(pVfs, zMaster, 0);
2490           break;
2491         }else if( retryCount==1 ){
2492           sqlite3_log(SQLITE_FULL, "MJ collide: %s", zMaster);
2493         }
2494       }
2495       retryCount++;
2496       sqlite3_randomness(sizeof(iRandom), &iRandom);
2497       sqlite3_snprintf(13, &zMaster[nMainFile], "-mj%06X9%02X",
2498                                (iRandom>>8)&0xffffff, iRandom&0xff);
2499       /* The antipenultimate character of the master journal name must
2500       ** be "9" to avoid name collisions when using 8+3 filenames. */
2501       assert( zMaster[sqlite3Strlen30(zMaster)-3]=='9' );
2502       sqlite3FileSuffix3(zMainFile, zMaster);
2503       rc = sqlite3OsAccess(pVfs, zMaster, SQLITE_ACCESS_EXISTS, &res);
2504     }while( rc==SQLITE_OK && res );
2505     if( rc==SQLITE_OK ){
2506       /* Open the master journal. */
2507       rc = sqlite3OsOpenMalloc(pVfs, zMaster, &pMaster,
2508           SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE|
2509           SQLITE_OPEN_EXCLUSIVE|SQLITE_OPEN_MASTER_JOURNAL, 0
2510       );
2511     }
2512     if( rc!=SQLITE_OK ){
2513       sqlite3DbFree(db, zMaster);
2514       return rc;
2515     }
2516 
2517     /* Write the name of each database file in the transaction into the new
2518     ** master journal file. If an error occurs at this point close
2519     ** and delete the master journal file. All the individual journal files
2520     ** still have 'null' as the master journal pointer, so they will roll
2521     ** back independently if a failure occurs.
2522     */
2523     for(i=0; i<db->nDb; i++){
2524       Btree *pBt = db->aDb[i].pBt;
2525       if( sqlite3BtreeIsInTrans(pBt) ){
2526         char const *zFile = sqlite3BtreeGetJournalname(pBt);
2527         if( zFile==0 ){
2528           continue;  /* Ignore TEMP and :memory: databases */
2529         }
2530         assert( zFile[0]!=0 );
2531         rc = sqlite3OsWrite(pMaster, zFile, sqlite3Strlen30(zFile)+1, offset);
2532         offset += sqlite3Strlen30(zFile)+1;
2533         if( rc!=SQLITE_OK ){
2534           sqlite3OsCloseFree(pMaster);
2535           sqlite3OsDelete(pVfs, zMaster, 0);
2536           sqlite3DbFree(db, zMaster);
2537           return rc;
2538         }
2539       }
2540     }
2541 
2542     /* Sync the master journal file. If the IOCAP_SEQUENTIAL device
2543     ** flag is set this is not required.
2544     */
2545     if( 0==(sqlite3OsDeviceCharacteristics(pMaster)&SQLITE_IOCAP_SEQUENTIAL)
2546      && SQLITE_OK!=(rc = sqlite3OsSync(pMaster, SQLITE_SYNC_NORMAL))
2547     ){
2548       sqlite3OsCloseFree(pMaster);
2549       sqlite3OsDelete(pVfs, zMaster, 0);
2550       sqlite3DbFree(db, zMaster);
2551       return rc;
2552     }
2553 
2554     /* Sync all the db files involved in the transaction. The same call
2555     ** sets the master journal pointer in each individual journal. If
2556     ** an error occurs here, do not delete the master journal file.
2557     **
2558     ** If the error occurs during the first call to
2559     ** sqlite3BtreeCommitPhaseOne(), then there is a chance that the
2560     ** master journal file will be orphaned. But we cannot delete it,
2561     ** in case the master journal file name was written into the journal
2562     ** file before the failure occurred.
2563     */
2564     for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2565       Btree *pBt = db->aDb[i].pBt;
2566       if( pBt ){
2567         rc = sqlite3BtreeCommitPhaseOne(pBt, zMaster);
2568       }
2569     }
2570     sqlite3OsCloseFree(pMaster);
2571     assert( rc!=SQLITE_BUSY );
2572     if( rc!=SQLITE_OK ){
2573       sqlite3DbFree(db, zMaster);
2574       return rc;
2575     }
2576 
2577     /* Delete the master journal file. This commits the transaction. After
2578     ** doing this the directory is synced again before any individual
2579     ** transaction files are deleted.
2580     */
2581     rc = sqlite3OsDelete(pVfs, zMaster, 1);
2582     sqlite3DbFree(db, zMaster);
2583     zMaster = 0;
2584     if( rc ){
2585       return rc;
2586     }
2587 
2588     /* All files and directories have already been synced, so the following
2589     ** calls to sqlite3BtreeCommitPhaseTwo() are only closing files and
2590     ** deleting or truncating journals. If something goes wrong while
2591     ** this is happening we don't really care. The integrity of the
2592     ** transaction is already guaranteed, but some stray 'cold' journals
2593     ** may be lying around. Returning an error code won't help matters.
2594     */
2595     disable_simulated_io_errors();
2596     sqlite3BeginBenignMalloc();
2597     for(i=0; i<db->nDb; i++){
2598       Btree *pBt = db->aDb[i].pBt;
2599       if( pBt ){
2600         sqlite3BtreeCommitPhaseTwo(pBt, 1);
2601       }
2602     }
2603     sqlite3EndBenignMalloc();
2604     enable_simulated_io_errors();
2605 
2606     sqlite3VtabCommit(db);
2607   }
2608 #endif
2609 
2610   return rc;
2611 }
2612 
2613 /*
2614 ** This routine checks that the sqlite3.nVdbeActive count variable
2615 ** matches the number of vdbe's in the list sqlite3.pVdbe that are
2616 ** currently active. An assertion fails if the two counts do not match.
2617 ** This is an internal self-check only - it is not an essential processing
2618 ** step.
2619 **
2620 ** This is a no-op if NDEBUG is defined.
2621 */
2622 #ifndef NDEBUG
2623 static void checkActiveVdbeCnt(sqlite3 *db){
2624   Vdbe *p;
2625   int cnt = 0;
2626   int nWrite = 0;
2627   int nRead = 0;
2628   p = db->pVdbe;
2629   while( p ){
2630     if( sqlite3_stmt_busy((sqlite3_stmt*)p) ){
2631       cnt++;
2632       if( p->readOnly==0 ) nWrite++;
2633       if( p->bIsReader ) nRead++;
2634     }
2635     p = p->pNext;
2636   }
2637   assert( cnt==db->nVdbeActive );
2638   assert( nWrite==db->nVdbeWrite );
2639   assert( nRead==db->nVdbeRead );
2640 }
2641 #else
2642 #define checkActiveVdbeCnt(x)
2643 #endif
2644 
2645 /*
2646 ** If the Vdbe passed as the first argument opened a statement-transaction,
2647 ** close it now. Argument eOp must be either SAVEPOINT_ROLLBACK or
2648 ** SAVEPOINT_RELEASE. If it is SAVEPOINT_ROLLBACK, then the statement
2649 ** transaction is rolled back. If eOp is SAVEPOINT_RELEASE, then the
2650 ** statement transaction is committed.
2651 **
2652 ** If an IO error occurs, an SQLITE_IOERR_XXX error code is returned.
2653 ** Otherwise SQLITE_OK.
2654 */
2655 static SQLITE_NOINLINE int vdbeCloseStatement(Vdbe *p, int eOp){
2656   sqlite3 *const db = p->db;
2657   int rc = SQLITE_OK;
2658   int i;
2659   const int iSavepoint = p->iStatement-1;
2660 
2661   assert( eOp==SAVEPOINT_ROLLBACK || eOp==SAVEPOINT_RELEASE);
2662   assert( db->nStatement>0 );
2663   assert( p->iStatement==(db->nStatement+db->nSavepoint) );
2664 
2665   for(i=0; i<db->nDb; i++){
2666     int rc2 = SQLITE_OK;
2667     Btree *pBt = db->aDb[i].pBt;
2668     if( pBt ){
2669       if( eOp==SAVEPOINT_ROLLBACK ){
2670         rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_ROLLBACK, iSavepoint);
2671       }
2672       if( rc2==SQLITE_OK ){
2673         rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_RELEASE, iSavepoint);
2674       }
2675       if( rc==SQLITE_OK ){
2676         rc = rc2;
2677       }
2678     }
2679   }
2680   db->nStatement--;
2681   p->iStatement = 0;
2682 
2683   if( rc==SQLITE_OK ){
2684     if( eOp==SAVEPOINT_ROLLBACK ){
2685       rc = sqlite3VtabSavepoint(db, SAVEPOINT_ROLLBACK, iSavepoint);
2686     }
2687     if( rc==SQLITE_OK ){
2688       rc = sqlite3VtabSavepoint(db, SAVEPOINT_RELEASE, iSavepoint);
2689     }
2690   }
2691 
2692   /* If the statement transaction is being rolled back, also restore the
2693   ** database handles deferred constraint counter to the value it had when
2694   ** the statement transaction was opened.  */
2695   if( eOp==SAVEPOINT_ROLLBACK ){
2696     db->nDeferredCons = p->nStmtDefCons;
2697     db->nDeferredImmCons = p->nStmtDefImmCons;
2698   }
2699   return rc;
2700 }
2701 int sqlite3VdbeCloseStatement(Vdbe *p, int eOp){
2702   if( p->db->nStatement && p->iStatement ){
2703     return vdbeCloseStatement(p, eOp);
2704   }
2705   return SQLITE_OK;
2706 }
2707 
2708 
2709 /*
2710 ** This function is called when a transaction opened by the database
2711 ** handle associated with the VM passed as an argument is about to be
2712 ** committed. If there are outstanding deferred foreign key constraint
2713 ** violations, return SQLITE_ERROR. Otherwise, SQLITE_OK.
2714 **
2715 ** If there are outstanding FK violations and this function returns
2716 ** SQLITE_ERROR, set the result of the VM to SQLITE_CONSTRAINT_FOREIGNKEY
2717 ** and write an error message to it. Then return SQLITE_ERROR.
2718 */
2719 #ifndef SQLITE_OMIT_FOREIGN_KEY
2720 int sqlite3VdbeCheckFk(Vdbe *p, int deferred){
2721   sqlite3 *db = p->db;
2722   if( (deferred && (db->nDeferredCons+db->nDeferredImmCons)>0)
2723    || (!deferred && p->nFkConstraint>0)
2724   ){
2725     p->rc = SQLITE_CONSTRAINT_FOREIGNKEY;
2726     p->errorAction = OE_Abort;
2727     sqlite3VdbeError(p, "FOREIGN KEY constraint failed");
2728     return SQLITE_ERROR;
2729   }
2730   return SQLITE_OK;
2731 }
2732 #endif
2733 
2734 /*
2735 ** This routine is called the when a VDBE tries to halt.  If the VDBE
2736 ** has made changes and is in autocommit mode, then commit those
2737 ** changes.  If a rollback is needed, then do the rollback.
2738 **
2739 ** This routine is the only way to move the state of a VM from
2740 ** SQLITE_MAGIC_RUN to SQLITE_MAGIC_HALT.  It is harmless to
2741 ** call this on a VM that is in the SQLITE_MAGIC_HALT state.
2742 **
2743 ** Return an error code.  If the commit could not complete because of
2744 ** lock contention, return SQLITE_BUSY.  If SQLITE_BUSY is returned, it
2745 ** means the close did not happen and needs to be repeated.
2746 */
2747 int sqlite3VdbeHalt(Vdbe *p){
2748   int rc;                         /* Used to store transient return codes */
2749   sqlite3 *db = p->db;
2750 
2751   /* This function contains the logic that determines if a statement or
2752   ** transaction will be committed or rolled back as a result of the
2753   ** execution of this virtual machine.
2754   **
2755   ** If any of the following errors occur:
2756   **
2757   **     SQLITE_NOMEM
2758   **     SQLITE_IOERR
2759   **     SQLITE_FULL
2760   **     SQLITE_INTERRUPT
2761   **
2762   ** Then the internal cache might have been left in an inconsistent
2763   ** state.  We need to rollback the statement transaction, if there is
2764   ** one, or the complete transaction if there is no statement transaction.
2765   */
2766 
2767   if( p->magic!=VDBE_MAGIC_RUN ){
2768     return SQLITE_OK;
2769   }
2770   if( db->mallocFailed ){
2771     p->rc = SQLITE_NOMEM_BKPT;
2772   }
2773   closeAllCursors(p);
2774   checkActiveVdbeCnt(db);
2775 
2776   /* No commit or rollback needed if the program never started or if the
2777   ** SQL statement does not read or write a database file.  */
2778   if( p->pc>=0 && p->bIsReader ){
2779     int mrc;   /* Primary error code from p->rc */
2780     int eStatementOp = 0;
2781     int isSpecialError;            /* Set to true if a 'special' error */
2782 
2783     /* Lock all btrees used by the statement */
2784     sqlite3VdbeEnter(p);
2785 
2786     /* Check for one of the special errors */
2787     mrc = p->rc & 0xff;
2788     isSpecialError = mrc==SQLITE_NOMEM || mrc==SQLITE_IOERR
2789                      || mrc==SQLITE_INTERRUPT || mrc==SQLITE_FULL;
2790     if( isSpecialError ){
2791       /* If the query was read-only and the error code is SQLITE_INTERRUPT,
2792       ** no rollback is necessary. Otherwise, at least a savepoint
2793       ** transaction must be rolled back to restore the database to a
2794       ** consistent state.
2795       **
2796       ** Even if the statement is read-only, it is important to perform
2797       ** a statement or transaction rollback operation. If the error
2798       ** occurred while writing to the journal, sub-journal or database
2799       ** file as part of an effort to free up cache space (see function
2800       ** pagerStress() in pager.c), the rollback is required to restore
2801       ** the pager to a consistent state.
2802       */
2803       if( !p->readOnly || mrc!=SQLITE_INTERRUPT ){
2804         if( (mrc==SQLITE_NOMEM || mrc==SQLITE_FULL) && p->usesStmtJournal ){
2805           eStatementOp = SAVEPOINT_ROLLBACK;
2806         }else{
2807           /* We are forced to roll back the active transaction. Before doing
2808           ** so, abort any other statements this handle currently has active.
2809           */
2810           sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
2811           sqlite3CloseSavepoints(db);
2812           db->autoCommit = 1;
2813           p->nChange = 0;
2814         }
2815       }
2816     }
2817 
2818     /* Check for immediate foreign key violations. */
2819     if( p->rc==SQLITE_OK ){
2820       sqlite3VdbeCheckFk(p, 0);
2821     }
2822 
2823     /* If the auto-commit flag is set and this is the only active writer
2824     ** VM, then we do either a commit or rollback of the current transaction.
2825     **
2826     ** Note: This block also runs if one of the special errors handled
2827     ** above has occurred.
2828     */
2829     if( !sqlite3VtabInSync(db)
2830      && db->autoCommit
2831      && db->nVdbeWrite==(p->readOnly==0)
2832     ){
2833       if( p->rc==SQLITE_OK || (p->errorAction==OE_Fail && !isSpecialError) ){
2834         rc = sqlite3VdbeCheckFk(p, 1);
2835         if( rc!=SQLITE_OK ){
2836           if( NEVER(p->readOnly) ){
2837             sqlite3VdbeLeave(p);
2838             return SQLITE_ERROR;
2839           }
2840           rc = SQLITE_CONSTRAINT_FOREIGNKEY;
2841         }else{
2842           /* The auto-commit flag is true, the vdbe program was successful
2843           ** or hit an 'OR FAIL' constraint and there are no deferred foreign
2844           ** key constraints to hold up the transaction. This means a commit
2845           ** is required. */
2846           rc = vdbeCommit(db, p);
2847         }
2848         if( rc==SQLITE_BUSY && p->readOnly ){
2849           sqlite3VdbeLeave(p);
2850           return SQLITE_BUSY;
2851         }else if( rc!=SQLITE_OK ){
2852           p->rc = rc;
2853           sqlite3RollbackAll(db, SQLITE_OK);
2854           p->nChange = 0;
2855         }else{
2856           db->nDeferredCons = 0;
2857           db->nDeferredImmCons = 0;
2858           db->flags &= ~SQLITE_DeferFKs;
2859           sqlite3CommitInternalChanges(db);
2860         }
2861       }else{
2862         sqlite3RollbackAll(db, SQLITE_OK);
2863         p->nChange = 0;
2864       }
2865       db->nStatement = 0;
2866     }else if( eStatementOp==0 ){
2867       if( p->rc==SQLITE_OK || p->errorAction==OE_Fail ){
2868         eStatementOp = SAVEPOINT_RELEASE;
2869       }else if( p->errorAction==OE_Abort ){
2870         eStatementOp = SAVEPOINT_ROLLBACK;
2871       }else{
2872         sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
2873         sqlite3CloseSavepoints(db);
2874         db->autoCommit = 1;
2875         p->nChange = 0;
2876       }
2877     }
2878 
2879     /* If eStatementOp is non-zero, then a statement transaction needs to
2880     ** be committed or rolled back. Call sqlite3VdbeCloseStatement() to
2881     ** do so. If this operation returns an error, and the current statement
2882     ** error code is SQLITE_OK or SQLITE_CONSTRAINT, then promote the
2883     ** current statement error code.
2884     */
2885     if( eStatementOp ){
2886       rc = sqlite3VdbeCloseStatement(p, eStatementOp);
2887       if( rc ){
2888         if( p->rc==SQLITE_OK || (p->rc&0xff)==SQLITE_CONSTRAINT ){
2889           p->rc = rc;
2890           sqlite3DbFree(db, p->zErrMsg);
2891           p->zErrMsg = 0;
2892         }
2893         sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
2894         sqlite3CloseSavepoints(db);
2895         db->autoCommit = 1;
2896         p->nChange = 0;
2897       }
2898     }
2899 
2900     /* If this was an INSERT, UPDATE or DELETE and no statement transaction
2901     ** has been rolled back, update the database connection change-counter.
2902     */
2903     if( p->changeCntOn ){
2904       if( eStatementOp!=SAVEPOINT_ROLLBACK ){
2905         sqlite3VdbeSetChanges(db, p->nChange);
2906       }else{
2907         sqlite3VdbeSetChanges(db, 0);
2908       }
2909       p->nChange = 0;
2910     }
2911 
2912     /* Release the locks */
2913     sqlite3VdbeLeave(p);
2914   }
2915 
2916   /* We have successfully halted and closed the VM.  Record this fact. */
2917   if( p->pc>=0 ){
2918     db->nVdbeActive--;
2919     if( !p->readOnly ) db->nVdbeWrite--;
2920     if( p->bIsReader ) db->nVdbeRead--;
2921     assert( db->nVdbeActive>=db->nVdbeRead );
2922     assert( db->nVdbeRead>=db->nVdbeWrite );
2923     assert( db->nVdbeWrite>=0 );
2924   }
2925   p->magic = VDBE_MAGIC_HALT;
2926   checkActiveVdbeCnt(db);
2927   if( db->mallocFailed ){
2928     p->rc = SQLITE_NOMEM_BKPT;
2929   }
2930 
2931   /* If the auto-commit flag is set to true, then any locks that were held
2932   ** by connection db have now been released. Call sqlite3ConnectionUnlocked()
2933   ** to invoke any required unlock-notify callbacks.
2934   */
2935   if( db->autoCommit ){
2936     sqlite3ConnectionUnlocked(db);
2937   }
2938 
2939   assert( db->nVdbeActive>0 || db->autoCommit==0 || db->nStatement==0 );
2940   return (p->rc==SQLITE_BUSY ? SQLITE_BUSY : SQLITE_OK);
2941 }
2942 
2943 
2944 /*
2945 ** Each VDBE holds the result of the most recent sqlite3_step() call
2946 ** in p->rc.  This routine sets that result back to SQLITE_OK.
2947 */
2948 void sqlite3VdbeResetStepResult(Vdbe *p){
2949   p->rc = SQLITE_OK;
2950 }
2951 
2952 /*
2953 ** Copy the error code and error message belonging to the VDBE passed
2954 ** as the first argument to its database handle (so that they will be
2955 ** returned by calls to sqlite3_errcode() and sqlite3_errmsg()).
2956 **
2957 ** This function does not clear the VDBE error code or message, just
2958 ** copies them to the database handle.
2959 */
2960 int sqlite3VdbeTransferError(Vdbe *p){
2961   sqlite3 *db = p->db;
2962   int rc = p->rc;
2963   if( p->zErrMsg ){
2964     db->bBenignMalloc++;
2965     sqlite3BeginBenignMalloc();
2966     if( db->pErr==0 ) db->pErr = sqlite3ValueNew(db);
2967     sqlite3ValueSetStr(db->pErr, -1, p->zErrMsg, SQLITE_UTF8, SQLITE_TRANSIENT);
2968     sqlite3EndBenignMalloc();
2969     db->bBenignMalloc--;
2970   }else if( db->pErr ){
2971     sqlite3ValueSetNull(db->pErr);
2972   }
2973   db->errCode = rc;
2974   return rc;
2975 }
2976 
2977 #ifdef SQLITE_ENABLE_SQLLOG
2978 /*
2979 ** If an SQLITE_CONFIG_SQLLOG hook is registered and the VM has been run,
2980 ** invoke it.
2981 */
2982 static void vdbeInvokeSqllog(Vdbe *v){
2983   if( sqlite3GlobalConfig.xSqllog && v->rc==SQLITE_OK && v->zSql && v->pc>=0 ){
2984     char *zExpanded = sqlite3VdbeExpandSql(v, v->zSql);
2985     assert( v->db->init.busy==0 );
2986     if( zExpanded ){
2987       sqlite3GlobalConfig.xSqllog(
2988           sqlite3GlobalConfig.pSqllogArg, v->db, zExpanded, 1
2989       );
2990       sqlite3DbFree(v->db, zExpanded);
2991     }
2992   }
2993 }
2994 #else
2995 # define vdbeInvokeSqllog(x)
2996 #endif
2997 
2998 /*
2999 ** Clean up a VDBE after execution but do not delete the VDBE just yet.
3000 ** Write any error messages into *pzErrMsg.  Return the result code.
3001 **
3002 ** After this routine is run, the VDBE should be ready to be executed
3003 ** again.
3004 **
3005 ** To look at it another way, this routine resets the state of the
3006 ** virtual machine from VDBE_MAGIC_RUN or VDBE_MAGIC_HALT back to
3007 ** VDBE_MAGIC_INIT.
3008 */
3009 int sqlite3VdbeReset(Vdbe *p){
3010 #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
3011   int i;
3012 #endif
3013 
3014   sqlite3 *db;
3015   db = p->db;
3016 
3017   /* If the VM did not run to completion or if it encountered an
3018   ** error, then it might not have been halted properly.  So halt
3019   ** it now.
3020   */
3021   sqlite3VdbeHalt(p);
3022 
3023   /* If the VDBE has been run even partially, then transfer the error code
3024   ** and error message from the VDBE into the main database structure.  But
3025   ** if the VDBE has just been set to run but has not actually executed any
3026   ** instructions yet, leave the main database error information unchanged.
3027   */
3028   if( p->pc>=0 ){
3029     vdbeInvokeSqllog(p);
3030     sqlite3VdbeTransferError(p);
3031     if( p->runOnlyOnce ) p->expired = 1;
3032   }else if( p->rc && p->expired ){
3033     /* The expired flag was set on the VDBE before the first call
3034     ** to sqlite3_step(). For consistency (since sqlite3_step() was
3035     ** called), set the database error in this case as well.
3036     */
3037     sqlite3ErrorWithMsg(db, p->rc, p->zErrMsg ? "%s" : 0, p->zErrMsg);
3038   }
3039 
3040   /* Reset register contents and reclaim error message memory.
3041   */
3042 #ifdef SQLITE_DEBUG
3043   /* Execute assert() statements to ensure that the Vdbe.apCsr[] and
3044   ** Vdbe.aMem[] arrays have already been cleaned up.  */
3045   if( p->apCsr ) for(i=0; i<p->nCursor; i++) assert( p->apCsr[i]==0 );
3046   if( p->aMem ){
3047     for(i=0; i<p->nMem; i++) assert( p->aMem[i].flags==MEM_Undefined );
3048   }
3049 #endif
3050   sqlite3DbFree(db, p->zErrMsg);
3051   p->zErrMsg = 0;
3052   p->pResultSet = 0;
3053 #ifdef SQLITE_DEBUG
3054   p->nWrite = 0;
3055 #endif
3056 
3057   /* Save profiling information from this VDBE run.
3058   */
3059 #ifdef VDBE_PROFILE
3060   {
3061     FILE *out = fopen("vdbe_profile.out", "a");
3062     if( out ){
3063       fprintf(out, "---- ");
3064       for(i=0; i<p->nOp; i++){
3065         fprintf(out, "%02x", p->aOp[i].opcode);
3066       }
3067       fprintf(out, "\n");
3068       if( p->zSql ){
3069         char c, pc = 0;
3070         fprintf(out, "-- ");
3071         for(i=0; (c = p->zSql[i])!=0; i++){
3072           if( pc=='\n' ) fprintf(out, "-- ");
3073           putc(c, out);
3074           pc = c;
3075         }
3076         if( pc!='\n' ) fprintf(out, "\n");
3077       }
3078       for(i=0; i<p->nOp; i++){
3079         char zHdr[100];
3080         sqlite3_snprintf(sizeof(zHdr), zHdr, "%6u %12llu %8llu ",
3081            p->aOp[i].cnt,
3082            p->aOp[i].cycles,
3083            p->aOp[i].cnt>0 ? p->aOp[i].cycles/p->aOp[i].cnt : 0
3084         );
3085         fprintf(out, "%s", zHdr);
3086         sqlite3VdbePrintOp(out, i, &p->aOp[i]);
3087       }
3088       fclose(out);
3089     }
3090   }
3091 #endif
3092   p->magic = VDBE_MAGIC_RESET;
3093   return p->rc & db->errMask;
3094 }
3095 
3096 /*
3097 ** Clean up and delete a VDBE after execution.  Return an integer which is
3098 ** the result code.  Write any error message text into *pzErrMsg.
3099 */
3100 int sqlite3VdbeFinalize(Vdbe *p){
3101   int rc = SQLITE_OK;
3102   if( p->magic==VDBE_MAGIC_RUN || p->magic==VDBE_MAGIC_HALT ){
3103     rc = sqlite3VdbeReset(p);
3104     assert( (rc & p->db->errMask)==rc );
3105   }
3106   sqlite3VdbeDelete(p);
3107   return rc;
3108 }
3109 
3110 /*
3111 ** If parameter iOp is less than zero, then invoke the destructor for
3112 ** all auxiliary data pointers currently cached by the VM passed as
3113 ** the first argument.
3114 **
3115 ** Or, if iOp is greater than or equal to zero, then the destructor is
3116 ** only invoked for those auxiliary data pointers created by the user
3117 ** function invoked by the OP_Function opcode at instruction iOp of
3118 ** VM pVdbe, and only then if:
3119 **
3120 **    * the associated function parameter is the 32nd or later (counting
3121 **      from left to right), or
3122 **
3123 **    * the corresponding bit in argument mask is clear (where the first
3124 **      function parameter corresponds to bit 0 etc.).
3125 */
3126 void sqlite3VdbeDeleteAuxData(sqlite3 *db, AuxData **pp, int iOp, int mask){
3127   while( *pp ){
3128     AuxData *pAux = *pp;
3129     if( (iOp<0)
3130      || (pAux->iAuxOp==iOp
3131           && pAux->iAuxArg>=0
3132           && (pAux->iAuxArg>31 || !(mask & MASKBIT32(pAux->iAuxArg))))
3133     ){
3134       testcase( pAux->iAuxArg==31 );
3135       if( pAux->xDeleteAux ){
3136         pAux->xDeleteAux(pAux->pAux);
3137       }
3138       *pp = pAux->pNextAux;
3139       sqlite3DbFree(db, pAux);
3140     }else{
3141       pp= &pAux->pNextAux;
3142     }
3143   }
3144 }
3145 
3146 /*
3147 ** Free all memory associated with the Vdbe passed as the second argument,
3148 ** except for object itself, which is preserved.
3149 **
3150 ** The difference between this function and sqlite3VdbeDelete() is that
3151 ** VdbeDelete() also unlinks the Vdbe from the list of VMs associated with
3152 ** the database connection and frees the object itself.
3153 */
3154 void sqlite3VdbeClearObject(sqlite3 *db, Vdbe *p){
3155   SubProgram *pSub, *pNext;
3156   assert( p->db==0 || p->db==db );
3157   releaseMemArray(p->aColName, p->nResColumn*COLNAME_N);
3158   for(pSub=p->pProgram; pSub; pSub=pNext){
3159     pNext = pSub->pNext;
3160     vdbeFreeOpArray(db, pSub->aOp, pSub->nOp);
3161     sqlite3DbFree(db, pSub);
3162   }
3163   if( p->magic!=VDBE_MAGIC_INIT ){
3164     releaseMemArray(p->aVar, p->nVar);
3165     sqlite3DbFree(db, p->pVList);
3166     sqlite3DbFree(db, p->pFree);
3167   }
3168   vdbeFreeOpArray(db, p->aOp, p->nOp);
3169   sqlite3DbFree(db, p->aColName);
3170   sqlite3DbFree(db, p->zSql);
3171 #ifdef SQLITE_ENABLE_NORMALIZE
3172   sqlite3DbFree(db, p->zNormSql);
3173 #endif
3174 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
3175   {
3176     int i;
3177     for(i=0; i<p->nScan; i++){
3178       sqlite3DbFree(db, p->aScan[i].zName);
3179     }
3180     sqlite3DbFree(db, p->aScan);
3181   }
3182 #endif
3183 }
3184 
3185 /*
3186 ** Delete an entire VDBE.
3187 */
3188 void sqlite3VdbeDelete(Vdbe *p){
3189   sqlite3 *db;
3190 
3191   assert( p!=0 );
3192   db = p->db;
3193   assert( sqlite3_mutex_held(db->mutex) );
3194   sqlite3VdbeClearObject(db, p);
3195   if( p->pPrev ){
3196     p->pPrev->pNext = p->pNext;
3197   }else{
3198     assert( db->pVdbe==p );
3199     db->pVdbe = p->pNext;
3200   }
3201   if( p->pNext ){
3202     p->pNext->pPrev = p->pPrev;
3203   }
3204   p->magic = VDBE_MAGIC_DEAD;
3205   p->db = 0;
3206   sqlite3DbFreeNN(db, p);
3207 }
3208 
3209 /*
3210 ** The cursor "p" has a pending seek operation that has not yet been
3211 ** carried out.  Seek the cursor now.  If an error occurs, return
3212 ** the appropriate error code.
3213 */
3214 static int SQLITE_NOINLINE handleDeferredMoveto(VdbeCursor *p){
3215   int res, rc;
3216 #ifdef SQLITE_TEST
3217   extern int sqlite3_search_count;
3218 #endif
3219   assert( p->deferredMoveto );
3220   assert( p->isTable );
3221   assert( p->eCurType==CURTYPE_BTREE );
3222   rc = sqlite3BtreeMovetoUnpacked(p->uc.pCursor, 0, p->movetoTarget, 0, &res);
3223   if( rc ) return rc;
3224   if( res!=0 ) return SQLITE_CORRUPT_BKPT;
3225 #ifdef SQLITE_TEST
3226   sqlite3_search_count++;
3227 #endif
3228   p->deferredMoveto = 0;
3229   p->cacheStatus = CACHE_STALE;
3230   return SQLITE_OK;
3231 }
3232 
3233 /*
3234 ** Something has moved cursor "p" out of place.  Maybe the row it was
3235 ** pointed to was deleted out from under it.  Or maybe the btree was
3236 ** rebalanced.  Whatever the cause, try to restore "p" to the place it
3237 ** is supposed to be pointing.  If the row was deleted out from under the
3238 ** cursor, set the cursor to point to a NULL row.
3239 */
3240 static int SQLITE_NOINLINE handleMovedCursor(VdbeCursor *p){
3241   int isDifferentRow, rc;
3242   assert( p->eCurType==CURTYPE_BTREE );
3243   assert( p->uc.pCursor!=0 );
3244   assert( sqlite3BtreeCursorHasMoved(p->uc.pCursor) );
3245   rc = sqlite3BtreeCursorRestore(p->uc.pCursor, &isDifferentRow);
3246   p->cacheStatus = CACHE_STALE;
3247   if( isDifferentRow ) p->nullRow = 1;
3248   return rc;
3249 }
3250 
3251 /*
3252 ** Check to ensure that the cursor is valid.  Restore the cursor
3253 ** if need be.  Return any I/O error from the restore operation.
3254 */
3255 int sqlite3VdbeCursorRestore(VdbeCursor *p){
3256   assert( p->eCurType==CURTYPE_BTREE );
3257   if( sqlite3BtreeCursorHasMoved(p->uc.pCursor) ){
3258     return handleMovedCursor(p);
3259   }
3260   return SQLITE_OK;
3261 }
3262 
3263 /*
3264 ** Make sure the cursor p is ready to read or write the row to which it
3265 ** was last positioned.  Return an error code if an OOM fault or I/O error
3266 ** prevents us from positioning the cursor to its correct position.
3267 **
3268 ** If a MoveTo operation is pending on the given cursor, then do that
3269 ** MoveTo now.  If no move is pending, check to see if the row has been
3270 ** deleted out from under the cursor and if it has, mark the row as
3271 ** a NULL row.
3272 **
3273 ** If the cursor is already pointing to the correct row and that row has
3274 ** not been deleted out from under the cursor, then this routine is a no-op.
3275 */
3276 int sqlite3VdbeCursorMoveto(VdbeCursor **pp, int *piCol){
3277   VdbeCursor *p = *pp;
3278   assert( p->eCurType==CURTYPE_BTREE || p->eCurType==CURTYPE_PSEUDO );
3279   if( p->deferredMoveto ){
3280     int iMap;
3281     if( p->aAltMap && (iMap = p->aAltMap[1+*piCol])>0 ){
3282       *pp = p->pAltCursor;
3283       *piCol = iMap - 1;
3284       return SQLITE_OK;
3285     }
3286     return handleDeferredMoveto(p);
3287   }
3288   if( sqlite3BtreeCursorHasMoved(p->uc.pCursor) ){
3289     return handleMovedCursor(p);
3290   }
3291   return SQLITE_OK;
3292 }
3293 
3294 /*
3295 ** The following functions:
3296 **
3297 ** sqlite3VdbeSerialType()
3298 ** sqlite3VdbeSerialTypeLen()
3299 ** sqlite3VdbeSerialLen()
3300 ** sqlite3VdbeSerialPut()
3301 ** sqlite3VdbeSerialGet()
3302 **
3303 ** encapsulate the code that serializes values for storage in SQLite
3304 ** data and index records. Each serialized value consists of a
3305 ** 'serial-type' and a blob of data. The serial type is an 8-byte unsigned
3306 ** integer, stored as a varint.
3307 **
3308 ** In an SQLite index record, the serial type is stored directly before
3309 ** the blob of data that it corresponds to. In a table record, all serial
3310 ** types are stored at the start of the record, and the blobs of data at
3311 ** the end. Hence these functions allow the caller to handle the
3312 ** serial-type and data blob separately.
3313 **
3314 ** The following table describes the various storage classes for data:
3315 **
3316 **   serial type        bytes of data      type
3317 **   --------------     ---------------    ---------------
3318 **      0                     0            NULL
3319 **      1                     1            signed integer
3320 **      2                     2            signed integer
3321 **      3                     3            signed integer
3322 **      4                     4            signed integer
3323 **      5                     6            signed integer
3324 **      6                     8            signed integer
3325 **      7                     8            IEEE float
3326 **      8                     0            Integer constant 0
3327 **      9                     0            Integer constant 1
3328 **     10,11                               reserved for expansion
3329 **    N>=12 and even       (N-12)/2        BLOB
3330 **    N>=13 and odd        (N-13)/2        text
3331 **
3332 ** The 8 and 9 types were added in 3.3.0, file format 4.  Prior versions
3333 ** of SQLite will not understand those serial types.
3334 */
3335 
3336 /*
3337 ** Return the serial-type for the value stored in pMem.
3338 */
3339 u32 sqlite3VdbeSerialType(Mem *pMem, int file_format, u32 *pLen){
3340   int flags = pMem->flags;
3341   u32 n;
3342 
3343   assert( pLen!=0 );
3344   if( flags&MEM_Null ){
3345     *pLen = 0;
3346     return 0;
3347   }
3348   if( flags&MEM_Int ){
3349     /* Figure out whether to use 1, 2, 4, 6 or 8 bytes. */
3350 #   define MAX_6BYTE ((((i64)0x00008000)<<32)-1)
3351     i64 i = pMem->u.i;
3352     u64 u;
3353     if( i<0 ){
3354       u = ~i;
3355     }else{
3356       u = i;
3357     }
3358     if( u<=127 ){
3359       if( (i&1)==i && file_format>=4 ){
3360         *pLen = 0;
3361         return 8+(u32)u;
3362       }else{
3363         *pLen = 1;
3364         return 1;
3365       }
3366     }
3367     if( u<=32767 ){ *pLen = 2; return 2; }
3368     if( u<=8388607 ){ *pLen = 3; return 3; }
3369     if( u<=2147483647 ){ *pLen = 4; return 4; }
3370     if( u<=MAX_6BYTE ){ *pLen = 6; return 5; }
3371     *pLen = 8;
3372     return 6;
3373   }
3374   if( flags&MEM_Real ){
3375     *pLen = 8;
3376     return 7;
3377   }
3378   assert( pMem->db->mallocFailed || flags&(MEM_Str|MEM_Blob) );
3379   assert( pMem->n>=0 );
3380   n = (u32)pMem->n;
3381   if( flags & MEM_Zero ){
3382     n += pMem->u.nZero;
3383   }
3384   *pLen = n;
3385   return ((n*2) + 12 + ((flags&MEM_Str)!=0));
3386 }
3387 
3388 /*
3389 ** The sizes for serial types less than 128
3390 */
3391 static const u8 sqlite3SmallTypeSizes[] = {
3392         /*  0   1   2   3   4   5   6   7   8   9 */
3393 /*   0 */   0,  1,  2,  3,  4,  6,  8,  8,  0,  0,
3394 /*  10 */   0,  0,  0,  0,  1,  1,  2,  2,  3,  3,
3395 /*  20 */   4,  4,  5,  5,  6,  6,  7,  7,  8,  8,
3396 /*  30 */   9,  9, 10, 10, 11, 11, 12, 12, 13, 13,
3397 /*  40 */  14, 14, 15, 15, 16, 16, 17, 17, 18, 18,
3398 /*  50 */  19, 19, 20, 20, 21, 21, 22, 22, 23, 23,
3399 /*  60 */  24, 24, 25, 25, 26, 26, 27, 27, 28, 28,
3400 /*  70 */  29, 29, 30, 30, 31, 31, 32, 32, 33, 33,
3401 /*  80 */  34, 34, 35, 35, 36, 36, 37, 37, 38, 38,
3402 /*  90 */  39, 39, 40, 40, 41, 41, 42, 42, 43, 43,
3403 /* 100 */  44, 44, 45, 45, 46, 46, 47, 47, 48, 48,
3404 /* 110 */  49, 49, 50, 50, 51, 51, 52, 52, 53, 53,
3405 /* 120 */  54, 54, 55, 55, 56, 56, 57, 57
3406 };
3407 
3408 /*
3409 ** Return the length of the data corresponding to the supplied serial-type.
3410 */
3411 u32 sqlite3VdbeSerialTypeLen(u32 serial_type){
3412   if( serial_type>=128 ){
3413     return (serial_type-12)/2;
3414   }else{
3415     assert( serial_type<12
3416             || sqlite3SmallTypeSizes[serial_type]==(serial_type - 12)/2 );
3417     return sqlite3SmallTypeSizes[serial_type];
3418   }
3419 }
3420 u8 sqlite3VdbeOneByteSerialTypeLen(u8 serial_type){
3421   assert( serial_type<128 );
3422   return sqlite3SmallTypeSizes[serial_type];
3423 }
3424 
3425 /*
3426 ** If we are on an architecture with mixed-endian floating
3427 ** points (ex: ARM7) then swap the lower 4 bytes with the
3428 ** upper 4 bytes.  Return the result.
3429 **
3430 ** For most architectures, this is a no-op.
3431 **
3432 ** (later):  It is reported to me that the mixed-endian problem
3433 ** on ARM7 is an issue with GCC, not with the ARM7 chip.  It seems
3434 ** that early versions of GCC stored the two words of a 64-bit
3435 ** float in the wrong order.  And that error has been propagated
3436 ** ever since.  The blame is not necessarily with GCC, though.
3437 ** GCC might have just copying the problem from a prior compiler.
3438 ** I am also told that newer versions of GCC that follow a different
3439 ** ABI get the byte order right.
3440 **
3441 ** Developers using SQLite on an ARM7 should compile and run their
3442 ** application using -DSQLITE_DEBUG=1 at least once.  With DEBUG
3443 ** enabled, some asserts below will ensure that the byte order of
3444 ** floating point values is correct.
3445 **
3446 ** (2007-08-30)  Frank van Vugt has studied this problem closely
3447 ** and has send his findings to the SQLite developers.  Frank
3448 ** writes that some Linux kernels offer floating point hardware
3449 ** emulation that uses only 32-bit mantissas instead of a full
3450 ** 48-bits as required by the IEEE standard.  (This is the
3451 ** CONFIG_FPE_FASTFPE option.)  On such systems, floating point
3452 ** byte swapping becomes very complicated.  To avoid problems,
3453 ** the necessary byte swapping is carried out using a 64-bit integer
3454 ** rather than a 64-bit float.  Frank assures us that the code here
3455 ** works for him.  We, the developers, have no way to independently
3456 ** verify this, but Frank seems to know what he is talking about
3457 ** so we trust him.
3458 */
3459 #ifdef SQLITE_MIXED_ENDIAN_64BIT_FLOAT
3460 static u64 floatSwap(u64 in){
3461   union {
3462     u64 r;
3463     u32 i[2];
3464   } u;
3465   u32 t;
3466 
3467   u.r = in;
3468   t = u.i[0];
3469   u.i[0] = u.i[1];
3470   u.i[1] = t;
3471   return u.r;
3472 }
3473 # define swapMixedEndianFloat(X)  X = floatSwap(X)
3474 #else
3475 # define swapMixedEndianFloat(X)
3476 #endif
3477 
3478 /*
3479 ** Write the serialized data blob for the value stored in pMem into
3480 ** buf. It is assumed that the caller has allocated sufficient space.
3481 ** Return the number of bytes written.
3482 **
3483 ** nBuf is the amount of space left in buf[].  The caller is responsible
3484 ** for allocating enough space to buf[] to hold the entire field, exclusive
3485 ** of the pMem->u.nZero bytes for a MEM_Zero value.
3486 **
3487 ** Return the number of bytes actually written into buf[].  The number
3488 ** of bytes in the zero-filled tail is included in the return value only
3489 ** if those bytes were zeroed in buf[].
3490 */
3491 u32 sqlite3VdbeSerialPut(u8 *buf, Mem *pMem, u32 serial_type){
3492   u32 len;
3493 
3494   /* Integer and Real */
3495   if( serial_type<=7 && serial_type>0 ){
3496     u64 v;
3497     u32 i;
3498     if( serial_type==7 ){
3499       assert( sizeof(v)==sizeof(pMem->u.r) );
3500       memcpy(&v, &pMem->u.r, sizeof(v));
3501       swapMixedEndianFloat(v);
3502     }else{
3503       v = pMem->u.i;
3504     }
3505     len = i = sqlite3SmallTypeSizes[serial_type];
3506     assert( i>0 );
3507     do{
3508       buf[--i] = (u8)(v&0xFF);
3509       v >>= 8;
3510     }while( i );
3511     return len;
3512   }
3513 
3514   /* String or blob */
3515   if( serial_type>=12 ){
3516     assert( pMem->n + ((pMem->flags & MEM_Zero)?pMem->u.nZero:0)
3517              == (int)sqlite3VdbeSerialTypeLen(serial_type) );
3518     len = pMem->n;
3519     if( len>0 ) memcpy(buf, pMem->z, len);
3520     return len;
3521   }
3522 
3523   /* NULL or constants 0 or 1 */
3524   return 0;
3525 }
3526 
3527 /* Input "x" is a sequence of unsigned characters that represent a
3528 ** big-endian integer.  Return the equivalent native integer
3529 */
3530 #define ONE_BYTE_INT(x)    ((i8)(x)[0])
3531 #define TWO_BYTE_INT(x)    (256*(i8)((x)[0])|(x)[1])
3532 #define THREE_BYTE_INT(x)  (65536*(i8)((x)[0])|((x)[1]<<8)|(x)[2])
3533 #define FOUR_BYTE_UINT(x)  (((u32)(x)[0]<<24)|((x)[1]<<16)|((x)[2]<<8)|(x)[3])
3534 #define FOUR_BYTE_INT(x) (16777216*(i8)((x)[0])|((x)[1]<<16)|((x)[2]<<8)|(x)[3])
3535 
3536 /*
3537 ** Deserialize the data blob pointed to by buf as serial type serial_type
3538 ** and store the result in pMem.  Return the number of bytes read.
3539 **
3540 ** This function is implemented as two separate routines for performance.
3541 ** The few cases that require local variables are broken out into a separate
3542 ** routine so that in most cases the overhead of moving the stack pointer
3543 ** is avoided.
3544 */
3545 static u32 SQLITE_NOINLINE serialGet(
3546   const unsigned char *buf,     /* Buffer to deserialize from */
3547   u32 serial_type,              /* Serial type to deserialize */
3548   Mem *pMem                     /* Memory cell to write value into */
3549 ){
3550   u64 x = FOUR_BYTE_UINT(buf);
3551   u32 y = FOUR_BYTE_UINT(buf+4);
3552   x = (x<<32) + y;
3553   if( serial_type==6 ){
3554     /* EVIDENCE-OF: R-29851-52272 Value is a big-endian 64-bit
3555     ** twos-complement integer. */
3556     pMem->u.i = *(i64*)&x;
3557     pMem->flags = MEM_Int;
3558     testcase( pMem->u.i<0 );
3559   }else{
3560     /* EVIDENCE-OF: R-57343-49114 Value is a big-endian IEEE 754-2008 64-bit
3561     ** floating point number. */
3562 #if !defined(NDEBUG) && !defined(SQLITE_OMIT_FLOATING_POINT)
3563     /* Verify that integers and floating point values use the same
3564     ** byte order.  Or, that if SQLITE_MIXED_ENDIAN_64BIT_FLOAT is
3565     ** defined that 64-bit floating point values really are mixed
3566     ** endian.
3567     */
3568     static const u64 t1 = ((u64)0x3ff00000)<<32;
3569     static const double r1 = 1.0;
3570     u64 t2 = t1;
3571     swapMixedEndianFloat(t2);
3572     assert( sizeof(r1)==sizeof(t2) && memcmp(&r1, &t2, sizeof(r1))==0 );
3573 #endif
3574     assert( sizeof(x)==8 && sizeof(pMem->u.r)==8 );
3575     swapMixedEndianFloat(x);
3576     memcpy(&pMem->u.r, &x, sizeof(x));
3577     pMem->flags = sqlite3IsNaN(pMem->u.r) ? MEM_Null : MEM_Real;
3578   }
3579   return 8;
3580 }
3581 u32 sqlite3VdbeSerialGet(
3582   const unsigned char *buf,     /* Buffer to deserialize from */
3583   u32 serial_type,              /* Serial type to deserialize */
3584   Mem *pMem                     /* Memory cell to write value into */
3585 ){
3586   switch( serial_type ){
3587     case 10: { /* Internal use only: NULL with virtual table
3588                ** UPDATE no-change flag set */
3589       pMem->flags = MEM_Null|MEM_Zero;
3590       pMem->n = 0;
3591       pMem->u.nZero = 0;
3592       break;
3593     }
3594     case 11:   /* Reserved for future use */
3595     case 0: {  /* Null */
3596       /* EVIDENCE-OF: R-24078-09375 Value is a NULL. */
3597       pMem->flags = MEM_Null;
3598       break;
3599     }
3600     case 1: {
3601       /* EVIDENCE-OF: R-44885-25196 Value is an 8-bit twos-complement
3602       ** integer. */
3603       pMem->u.i = ONE_BYTE_INT(buf);
3604       pMem->flags = MEM_Int;
3605       testcase( pMem->u.i<0 );
3606       return 1;
3607     }
3608     case 2: { /* 2-byte signed integer */
3609       /* EVIDENCE-OF: R-49794-35026 Value is a big-endian 16-bit
3610       ** twos-complement integer. */
3611       pMem->u.i = TWO_BYTE_INT(buf);
3612       pMem->flags = MEM_Int;
3613       testcase( pMem->u.i<0 );
3614       return 2;
3615     }
3616     case 3: { /* 3-byte signed integer */
3617       /* EVIDENCE-OF: R-37839-54301 Value is a big-endian 24-bit
3618       ** twos-complement integer. */
3619       pMem->u.i = THREE_BYTE_INT(buf);
3620       pMem->flags = MEM_Int;
3621       testcase( pMem->u.i<0 );
3622       return 3;
3623     }
3624     case 4: { /* 4-byte signed integer */
3625       /* EVIDENCE-OF: R-01849-26079 Value is a big-endian 32-bit
3626       ** twos-complement integer. */
3627       pMem->u.i = FOUR_BYTE_INT(buf);
3628 #ifdef __HP_cc
3629       /* Work around a sign-extension bug in the HP compiler for HP/UX */
3630       if( buf[0]&0x80 ) pMem->u.i |= 0xffffffff80000000LL;
3631 #endif
3632       pMem->flags = MEM_Int;
3633       testcase( pMem->u.i<0 );
3634       return 4;
3635     }
3636     case 5: { /* 6-byte signed integer */
3637       /* EVIDENCE-OF: R-50385-09674 Value is a big-endian 48-bit
3638       ** twos-complement integer. */
3639       pMem->u.i = FOUR_BYTE_UINT(buf+2) + (((i64)1)<<32)*TWO_BYTE_INT(buf);
3640       pMem->flags = MEM_Int;
3641       testcase( pMem->u.i<0 );
3642       return 6;
3643     }
3644     case 6:   /* 8-byte signed integer */
3645     case 7: { /* IEEE floating point */
3646       /* These use local variables, so do them in a separate routine
3647       ** to avoid having to move the frame pointer in the common case */
3648       return serialGet(buf,serial_type,pMem);
3649     }
3650     case 8:    /* Integer 0 */
3651     case 9: {  /* Integer 1 */
3652       /* EVIDENCE-OF: R-12976-22893 Value is the integer 0. */
3653       /* EVIDENCE-OF: R-18143-12121 Value is the integer 1. */
3654       pMem->u.i = serial_type-8;
3655       pMem->flags = MEM_Int;
3656       return 0;
3657     }
3658     default: {
3659       /* EVIDENCE-OF: R-14606-31564 Value is a BLOB that is (N-12)/2 bytes in
3660       ** length.
3661       ** EVIDENCE-OF: R-28401-00140 Value is a string in the text encoding and
3662       ** (N-13)/2 bytes in length. */
3663       static const u16 aFlag[] = { MEM_Blob|MEM_Ephem, MEM_Str|MEM_Ephem };
3664       pMem->z = (char *)buf;
3665       pMem->n = (serial_type-12)/2;
3666       pMem->flags = aFlag[serial_type&1];
3667       return pMem->n;
3668     }
3669   }
3670   return 0;
3671 }
3672 /*
3673 ** This routine is used to allocate sufficient space for an UnpackedRecord
3674 ** structure large enough to be used with sqlite3VdbeRecordUnpack() if
3675 ** the first argument is a pointer to KeyInfo structure pKeyInfo.
3676 **
3677 ** The space is either allocated using sqlite3DbMallocRaw() or from within
3678 ** the unaligned buffer passed via the second and third arguments (presumably
3679 ** stack space). If the former, then *ppFree is set to a pointer that should
3680 ** be eventually freed by the caller using sqlite3DbFree(). Or, if the
3681 ** allocation comes from the pSpace/szSpace buffer, *ppFree is set to NULL
3682 ** before returning.
3683 **
3684 ** If an OOM error occurs, NULL is returned.
3685 */
3686 UnpackedRecord *sqlite3VdbeAllocUnpackedRecord(
3687   KeyInfo *pKeyInfo               /* Description of the record */
3688 ){
3689   UnpackedRecord *p;              /* Unpacked record to return */
3690   int nByte;                      /* Number of bytes required for *p */
3691   nByte = ROUND8(sizeof(UnpackedRecord)) + sizeof(Mem)*(pKeyInfo->nKeyField+1);
3692   p = (UnpackedRecord *)sqlite3DbMallocRaw(pKeyInfo->db, nByte);
3693   if( !p ) return 0;
3694   p->aMem = (Mem*)&((char*)p)[ROUND8(sizeof(UnpackedRecord))];
3695   assert( pKeyInfo->aSortOrder!=0 );
3696   p->pKeyInfo = pKeyInfo;
3697   p->nField = pKeyInfo->nKeyField + 1;
3698   return p;
3699 }
3700 
3701 /*
3702 ** Given the nKey-byte encoding of a record in pKey[], populate the
3703 ** UnpackedRecord structure indicated by the fourth argument with the
3704 ** contents of the decoded record.
3705 */
3706 void sqlite3VdbeRecordUnpack(
3707   KeyInfo *pKeyInfo,     /* Information about the record format */
3708   int nKey,              /* Size of the binary record */
3709   const void *pKey,      /* The binary record */
3710   UnpackedRecord *p      /* Populate this structure before returning. */
3711 ){
3712   const unsigned char *aKey = (const unsigned char *)pKey;
3713   int d;
3714   u32 idx;                        /* Offset in aKey[] to read from */
3715   u16 u;                          /* Unsigned loop counter */
3716   u32 szHdr;
3717   Mem *pMem = p->aMem;
3718 
3719   p->default_rc = 0;
3720   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
3721   idx = getVarint32(aKey, szHdr);
3722   d = szHdr;
3723   u = 0;
3724   while( idx<szHdr && d<=nKey ){
3725     u32 serial_type;
3726 
3727     idx += getVarint32(&aKey[idx], serial_type);
3728     pMem->enc = pKeyInfo->enc;
3729     pMem->db = pKeyInfo->db;
3730     /* pMem->flags = 0; // sqlite3VdbeSerialGet() will set this for us */
3731     pMem->szMalloc = 0;
3732     pMem->z = 0;
3733     d += sqlite3VdbeSerialGet(&aKey[d], serial_type, pMem);
3734     pMem++;
3735     if( (++u)>=p->nField ) break;
3736   }
3737   assert( u<=pKeyInfo->nKeyField + 1 );
3738   p->nField = u;
3739 }
3740 
3741 #ifdef SQLITE_DEBUG
3742 /*
3743 ** This function compares two index or table record keys in the same way
3744 ** as the sqlite3VdbeRecordCompare() routine. Unlike VdbeRecordCompare(),
3745 ** this function deserializes and compares values using the
3746 ** sqlite3VdbeSerialGet() and sqlite3MemCompare() functions. It is used
3747 ** in assert() statements to ensure that the optimized code in
3748 ** sqlite3VdbeRecordCompare() returns results with these two primitives.
3749 **
3750 ** Return true if the result of comparison is equivalent to desiredResult.
3751 ** Return false if there is a disagreement.
3752 */
3753 static int vdbeRecordCompareDebug(
3754   int nKey1, const void *pKey1, /* Left key */
3755   const UnpackedRecord *pPKey2, /* Right key */
3756   int desiredResult             /* Correct answer */
3757 ){
3758   u32 d1;            /* Offset into aKey[] of next data element */
3759   u32 idx1;          /* Offset into aKey[] of next header element */
3760   u32 szHdr1;        /* Number of bytes in header */
3761   int i = 0;
3762   int rc = 0;
3763   const unsigned char *aKey1 = (const unsigned char *)pKey1;
3764   KeyInfo *pKeyInfo;
3765   Mem mem1;
3766 
3767   pKeyInfo = pPKey2->pKeyInfo;
3768   if( pKeyInfo->db==0 ) return 1;
3769   mem1.enc = pKeyInfo->enc;
3770   mem1.db = pKeyInfo->db;
3771   /* mem1.flags = 0;  // Will be initialized by sqlite3VdbeSerialGet() */
3772   VVA_ONLY( mem1.szMalloc = 0; ) /* Only needed by assert() statements */
3773 
3774   /* Compilers may complain that mem1.u.i is potentially uninitialized.
3775   ** We could initialize it, as shown here, to silence those complaints.
3776   ** But in fact, mem1.u.i will never actually be used uninitialized, and doing
3777   ** the unnecessary initialization has a measurable negative performance
3778   ** impact, since this routine is a very high runner.  And so, we choose
3779   ** to ignore the compiler warnings and leave this variable uninitialized.
3780   */
3781   /*  mem1.u.i = 0;  // not needed, here to silence compiler warning */
3782 
3783   idx1 = getVarint32(aKey1, szHdr1);
3784   if( szHdr1>98307 ) return SQLITE_CORRUPT;
3785   d1 = szHdr1;
3786   assert( pKeyInfo->nAllField>=pPKey2->nField || CORRUPT_DB );
3787   assert( pKeyInfo->aSortOrder!=0 );
3788   assert( pKeyInfo->nKeyField>0 );
3789   assert( idx1<=szHdr1 || CORRUPT_DB );
3790   do{
3791     u32 serial_type1;
3792 
3793     /* Read the serial types for the next element in each key. */
3794     idx1 += getVarint32( aKey1+idx1, serial_type1 );
3795 
3796     /* Verify that there is enough key space remaining to avoid
3797     ** a buffer overread.  The "d1+serial_type1+2" subexpression will
3798     ** always be greater than or equal to the amount of required key space.
3799     ** Use that approximation to avoid the more expensive call to
3800     ** sqlite3VdbeSerialTypeLen() in the common case.
3801     */
3802     if( d1+serial_type1+2>(u32)nKey1
3803      && d1+sqlite3VdbeSerialTypeLen(serial_type1)>(u32)nKey1
3804     ){
3805       break;
3806     }
3807 
3808     /* Extract the values to be compared.
3809     */
3810     d1 += sqlite3VdbeSerialGet(&aKey1[d1], serial_type1, &mem1);
3811 
3812     /* Do the comparison
3813     */
3814     rc = sqlite3MemCompare(&mem1, &pPKey2->aMem[i], pKeyInfo->aColl[i]);
3815     if( rc!=0 ){
3816       assert( mem1.szMalloc==0 );  /* See comment below */
3817       if( pKeyInfo->aSortOrder[i] ){
3818         rc = -rc;  /* Invert the result for DESC sort order. */
3819       }
3820       goto debugCompareEnd;
3821     }
3822     i++;
3823   }while( idx1<szHdr1 && i<pPKey2->nField );
3824 
3825   /* No memory allocation is ever used on mem1.  Prove this using
3826   ** the following assert().  If the assert() fails, it indicates a
3827   ** memory leak and a need to call sqlite3VdbeMemRelease(&mem1).
3828   */
3829   assert( mem1.szMalloc==0 );
3830 
3831   /* rc==0 here means that one of the keys ran out of fields and
3832   ** all the fields up to that point were equal. Return the default_rc
3833   ** value.  */
3834   rc = pPKey2->default_rc;
3835 
3836 debugCompareEnd:
3837   if( desiredResult==0 && rc==0 ) return 1;
3838   if( desiredResult<0 && rc<0 ) return 1;
3839   if( desiredResult>0 && rc>0 ) return 1;
3840   if( CORRUPT_DB ) return 1;
3841   if( pKeyInfo->db->mallocFailed ) return 1;
3842   return 0;
3843 }
3844 #endif
3845 
3846 #ifdef SQLITE_DEBUG
3847 /*
3848 ** Count the number of fields (a.k.a. columns) in the record given by
3849 ** pKey,nKey.  The verify that this count is less than or equal to the
3850 ** limit given by pKeyInfo->nAllField.
3851 **
3852 ** If this constraint is not satisfied, it means that the high-speed
3853 ** vdbeRecordCompareInt() and vdbeRecordCompareString() routines will
3854 ** not work correctly.  If this assert() ever fires, it probably means
3855 ** that the KeyInfo.nKeyField or KeyInfo.nAllField values were computed
3856 ** incorrectly.
3857 */
3858 static void vdbeAssertFieldCountWithinLimits(
3859   int nKey, const void *pKey,   /* The record to verify */
3860   const KeyInfo *pKeyInfo       /* Compare size with this KeyInfo */
3861 ){
3862   int nField = 0;
3863   u32 szHdr;
3864   u32 idx;
3865   u32 notUsed;
3866   const unsigned char *aKey = (const unsigned char*)pKey;
3867 
3868   if( CORRUPT_DB ) return;
3869   idx = getVarint32(aKey, szHdr);
3870   assert( nKey>=0 );
3871   assert( szHdr<=(u32)nKey );
3872   while( idx<szHdr ){
3873     idx += getVarint32(aKey+idx, notUsed);
3874     nField++;
3875   }
3876   assert( nField <= pKeyInfo->nAllField );
3877 }
3878 #else
3879 # define vdbeAssertFieldCountWithinLimits(A,B,C)
3880 #endif
3881 
3882 /*
3883 ** Both *pMem1 and *pMem2 contain string values. Compare the two values
3884 ** using the collation sequence pColl. As usual, return a negative , zero
3885 ** or positive value if *pMem1 is less than, equal to or greater than
3886 ** *pMem2, respectively. Similar in spirit to "rc = (*pMem1) - (*pMem2);".
3887 */
3888 static int vdbeCompareMemString(
3889   const Mem *pMem1,
3890   const Mem *pMem2,
3891   const CollSeq *pColl,
3892   u8 *prcErr                      /* If an OOM occurs, set to SQLITE_NOMEM */
3893 ){
3894   if( pMem1->enc==pColl->enc ){
3895     /* The strings are already in the correct encoding.  Call the
3896      ** comparison function directly */
3897     return pColl->xCmp(pColl->pUser,pMem1->n,pMem1->z,pMem2->n,pMem2->z);
3898   }else{
3899     int rc;
3900     const void *v1, *v2;
3901     Mem c1;
3902     Mem c2;
3903     sqlite3VdbeMemInit(&c1, pMem1->db, MEM_Null);
3904     sqlite3VdbeMemInit(&c2, pMem1->db, MEM_Null);
3905     sqlite3VdbeMemShallowCopy(&c1, pMem1, MEM_Ephem);
3906     sqlite3VdbeMemShallowCopy(&c2, pMem2, MEM_Ephem);
3907     v1 = sqlite3ValueText((sqlite3_value*)&c1, pColl->enc);
3908     v2 = sqlite3ValueText((sqlite3_value*)&c2, pColl->enc);
3909     if( (v1==0 || v2==0) ){
3910       if( prcErr ) *prcErr = SQLITE_NOMEM_BKPT;
3911       rc = 0;
3912     }else{
3913       rc = pColl->xCmp(pColl->pUser, c1.n, v1, c2.n, v2);
3914     }
3915     sqlite3VdbeMemRelease(&c1);
3916     sqlite3VdbeMemRelease(&c2);
3917     return rc;
3918   }
3919 }
3920 
3921 /*
3922 ** The input pBlob is guaranteed to be a Blob that is not marked
3923 ** with MEM_Zero.  Return true if it could be a zero-blob.
3924 */
3925 static int isAllZero(const char *z, int n){
3926   int i;
3927   for(i=0; i<n; i++){
3928     if( z[i] ) return 0;
3929   }
3930   return 1;
3931 }
3932 
3933 /*
3934 ** Compare two blobs.  Return negative, zero, or positive if the first
3935 ** is less than, equal to, or greater than the second, respectively.
3936 ** If one blob is a prefix of the other, then the shorter is the lessor.
3937 */
3938 SQLITE_NOINLINE int sqlite3BlobCompare(const Mem *pB1, const Mem *pB2){
3939   int c;
3940   int n1 = pB1->n;
3941   int n2 = pB2->n;
3942 
3943   /* It is possible to have a Blob value that has some non-zero content
3944   ** followed by zero content.  But that only comes up for Blobs formed
3945   ** by the OP_MakeRecord opcode, and such Blobs never get passed into
3946   ** sqlite3MemCompare(). */
3947   assert( (pB1->flags & MEM_Zero)==0 || n1==0 );
3948   assert( (pB2->flags & MEM_Zero)==0 || n2==0 );
3949 
3950   if( (pB1->flags|pB2->flags) & MEM_Zero ){
3951     if( pB1->flags & pB2->flags & MEM_Zero ){
3952       return pB1->u.nZero - pB2->u.nZero;
3953     }else if( pB1->flags & MEM_Zero ){
3954       if( !isAllZero(pB2->z, pB2->n) ) return -1;
3955       return pB1->u.nZero - n2;
3956     }else{
3957       if( !isAllZero(pB1->z, pB1->n) ) return +1;
3958       return n1 - pB2->u.nZero;
3959     }
3960   }
3961   c = memcmp(pB1->z, pB2->z, n1>n2 ? n2 : n1);
3962   if( c ) return c;
3963   return n1 - n2;
3964 }
3965 
3966 /*
3967 ** Do a comparison between a 64-bit signed integer and a 64-bit floating-point
3968 ** number.  Return negative, zero, or positive if the first (i64) is less than,
3969 ** equal to, or greater than the second (double).
3970 */
3971 static int sqlite3IntFloatCompare(i64 i, double r){
3972   if( sizeof(LONGDOUBLE_TYPE)>8 ){
3973     LONGDOUBLE_TYPE x = (LONGDOUBLE_TYPE)i;
3974     if( x<r ) return -1;
3975     if( x>r ) return +1;
3976     return 0;
3977   }else{
3978     i64 y;
3979     double s;
3980     if( r<-9223372036854775808.0 ) return +1;
3981     if( r>=9223372036854775808.0 ) return -1;
3982     y = (i64)r;
3983     if( i<y ) return -1;
3984     if( i>y ) return +1;
3985     s = (double)i;
3986     if( s<r ) return -1;
3987     if( s>r ) return +1;
3988     return 0;
3989   }
3990 }
3991 
3992 /*
3993 ** Compare the values contained by the two memory cells, returning
3994 ** negative, zero or positive if pMem1 is less than, equal to, or greater
3995 ** than pMem2. Sorting order is NULL's first, followed by numbers (integers
3996 ** and reals) sorted numerically, followed by text ordered by the collating
3997 ** sequence pColl and finally blob's ordered by memcmp().
3998 **
3999 ** Two NULL values are considered equal by this function.
4000 */
4001 int sqlite3MemCompare(const Mem *pMem1, const Mem *pMem2, const CollSeq *pColl){
4002   int f1, f2;
4003   int combined_flags;
4004 
4005   f1 = pMem1->flags;
4006   f2 = pMem2->flags;
4007   combined_flags = f1|f2;
4008   assert( !sqlite3VdbeMemIsRowSet(pMem1) && !sqlite3VdbeMemIsRowSet(pMem2) );
4009 
4010   /* If one value is NULL, it is less than the other. If both values
4011   ** are NULL, return 0.
4012   */
4013   if( combined_flags&MEM_Null ){
4014     return (f2&MEM_Null) - (f1&MEM_Null);
4015   }
4016 
4017   /* At least one of the two values is a number
4018   */
4019   if( combined_flags&(MEM_Int|MEM_Real) ){
4020     if( (f1 & f2 & MEM_Int)!=0 ){
4021       if( pMem1->u.i < pMem2->u.i ) return -1;
4022       if( pMem1->u.i > pMem2->u.i ) return +1;
4023       return 0;
4024     }
4025     if( (f1 & f2 & MEM_Real)!=0 ){
4026       if( pMem1->u.r < pMem2->u.r ) return -1;
4027       if( pMem1->u.r > pMem2->u.r ) return +1;
4028       return 0;
4029     }
4030     if( (f1&MEM_Int)!=0 ){
4031       if( (f2&MEM_Real)!=0 ){
4032         return sqlite3IntFloatCompare(pMem1->u.i, pMem2->u.r);
4033       }else{
4034         return -1;
4035       }
4036     }
4037     if( (f1&MEM_Real)!=0 ){
4038       if( (f2&MEM_Int)!=0 ){
4039         return -sqlite3IntFloatCompare(pMem2->u.i, pMem1->u.r);
4040       }else{
4041         return -1;
4042       }
4043     }
4044     return +1;
4045   }
4046 
4047   /* If one value is a string and the other is a blob, the string is less.
4048   ** If both are strings, compare using the collating functions.
4049   */
4050   if( combined_flags&MEM_Str ){
4051     if( (f1 & MEM_Str)==0 ){
4052       return 1;
4053     }
4054     if( (f2 & MEM_Str)==0 ){
4055       return -1;
4056     }
4057 
4058     assert( pMem1->enc==pMem2->enc || pMem1->db->mallocFailed );
4059     assert( pMem1->enc==SQLITE_UTF8 ||
4060             pMem1->enc==SQLITE_UTF16LE || pMem1->enc==SQLITE_UTF16BE );
4061 
4062     /* The collation sequence must be defined at this point, even if
4063     ** the user deletes the collation sequence after the vdbe program is
4064     ** compiled (this was not always the case).
4065     */
4066     assert( !pColl || pColl->xCmp );
4067 
4068     if( pColl ){
4069       return vdbeCompareMemString(pMem1, pMem2, pColl, 0);
4070     }
4071     /* If a NULL pointer was passed as the collate function, fall through
4072     ** to the blob case and use memcmp().  */
4073   }
4074 
4075   /* Both values must be blobs.  Compare using memcmp().  */
4076   return sqlite3BlobCompare(pMem1, pMem2);
4077 }
4078 
4079 
4080 /*
4081 ** The first argument passed to this function is a serial-type that
4082 ** corresponds to an integer - all values between 1 and 9 inclusive
4083 ** except 7. The second points to a buffer containing an integer value
4084 ** serialized according to serial_type. This function deserializes
4085 ** and returns the value.
4086 */
4087 static i64 vdbeRecordDecodeInt(u32 serial_type, const u8 *aKey){
4088   u32 y;
4089   assert( CORRUPT_DB || (serial_type>=1 && serial_type<=9 && serial_type!=7) );
4090   switch( serial_type ){
4091     case 0:
4092     case 1:
4093       testcase( aKey[0]&0x80 );
4094       return ONE_BYTE_INT(aKey);
4095     case 2:
4096       testcase( aKey[0]&0x80 );
4097       return TWO_BYTE_INT(aKey);
4098     case 3:
4099       testcase( aKey[0]&0x80 );
4100       return THREE_BYTE_INT(aKey);
4101     case 4: {
4102       testcase( aKey[0]&0x80 );
4103       y = FOUR_BYTE_UINT(aKey);
4104       return (i64)*(int*)&y;
4105     }
4106     case 5: {
4107       testcase( aKey[0]&0x80 );
4108       return FOUR_BYTE_UINT(aKey+2) + (((i64)1)<<32)*TWO_BYTE_INT(aKey);
4109     }
4110     case 6: {
4111       u64 x = FOUR_BYTE_UINT(aKey);
4112       testcase( aKey[0]&0x80 );
4113       x = (x<<32) | FOUR_BYTE_UINT(aKey+4);
4114       return (i64)*(i64*)&x;
4115     }
4116   }
4117 
4118   return (serial_type - 8);
4119 }
4120 
4121 /*
4122 ** This function compares the two table rows or index records
4123 ** specified by {nKey1, pKey1} and pPKey2.  It returns a negative, zero
4124 ** or positive integer if key1 is less than, equal to or
4125 ** greater than key2.  The {nKey1, pKey1} key must be a blob
4126 ** created by the OP_MakeRecord opcode of the VDBE.  The pPKey2
4127 ** key must be a parsed key such as obtained from
4128 ** sqlite3VdbeParseRecord.
4129 **
4130 ** If argument bSkip is non-zero, it is assumed that the caller has already
4131 ** determined that the first fields of the keys are equal.
4132 **
4133 ** Key1 and Key2 do not have to contain the same number of fields. If all
4134 ** fields that appear in both keys are equal, then pPKey2->default_rc is
4135 ** returned.
4136 **
4137 ** If database corruption is discovered, set pPKey2->errCode to
4138 ** SQLITE_CORRUPT and return 0. If an OOM error is encountered,
4139 ** pPKey2->errCode is set to SQLITE_NOMEM and, if it is not NULL, the
4140 ** malloc-failed flag set on database handle (pPKey2->pKeyInfo->db).
4141 */
4142 int sqlite3VdbeRecordCompareWithSkip(
4143   int nKey1, const void *pKey1,   /* Left key */
4144   UnpackedRecord *pPKey2,         /* Right key */
4145   int bSkip                       /* If true, skip the first field */
4146 ){
4147   u32 d1;                         /* Offset into aKey[] of next data element */
4148   int i;                          /* Index of next field to compare */
4149   u32 szHdr1;                     /* Size of record header in bytes */
4150   u32 idx1;                       /* Offset of first type in header */
4151   int rc = 0;                     /* Return value */
4152   Mem *pRhs = pPKey2->aMem;       /* Next field of pPKey2 to compare */
4153   KeyInfo *pKeyInfo;
4154   const unsigned char *aKey1 = (const unsigned char *)pKey1;
4155   Mem mem1;
4156 
4157   /* If bSkip is true, then the caller has already determined that the first
4158   ** two elements in the keys are equal. Fix the various stack variables so
4159   ** that this routine begins comparing at the second field. */
4160   if( bSkip ){
4161     u32 s1;
4162     idx1 = 1 + getVarint32(&aKey1[1], s1);
4163     szHdr1 = aKey1[0];
4164     d1 = szHdr1 + sqlite3VdbeSerialTypeLen(s1);
4165     i = 1;
4166     pRhs++;
4167   }else{
4168     idx1 = getVarint32(aKey1, szHdr1);
4169     d1 = szHdr1;
4170     if( d1>(unsigned)nKey1 ){
4171       pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4172       return 0;  /* Corruption */
4173     }
4174     i = 0;
4175   }
4176 
4177   VVA_ONLY( mem1.szMalloc = 0; ) /* Only needed by assert() statements */
4178   assert( pPKey2->pKeyInfo->nAllField>=pPKey2->nField
4179        || CORRUPT_DB );
4180   assert( pPKey2->pKeyInfo->aSortOrder!=0 );
4181   assert( pPKey2->pKeyInfo->nKeyField>0 );
4182   assert( idx1<=szHdr1 || CORRUPT_DB );
4183   do{
4184     u32 serial_type;
4185 
4186     /* RHS is an integer */
4187     if( pRhs->flags & MEM_Int ){
4188       serial_type = aKey1[idx1];
4189       testcase( serial_type==12 );
4190       if( serial_type>=10 ){
4191         rc = +1;
4192       }else if( serial_type==0 ){
4193         rc = -1;
4194       }else if( serial_type==7 ){
4195         sqlite3VdbeSerialGet(&aKey1[d1], serial_type, &mem1);
4196         rc = -sqlite3IntFloatCompare(pRhs->u.i, mem1.u.r);
4197       }else{
4198         i64 lhs = vdbeRecordDecodeInt(serial_type, &aKey1[d1]);
4199         i64 rhs = pRhs->u.i;
4200         if( lhs<rhs ){
4201           rc = -1;
4202         }else if( lhs>rhs ){
4203           rc = +1;
4204         }
4205       }
4206     }
4207 
4208     /* RHS is real */
4209     else if( pRhs->flags & MEM_Real ){
4210       serial_type = aKey1[idx1];
4211       if( serial_type>=10 ){
4212         /* Serial types 12 or greater are strings and blobs (greater than
4213         ** numbers). Types 10 and 11 are currently "reserved for future
4214         ** use", so it doesn't really matter what the results of comparing
4215         ** them to numberic values are.  */
4216         rc = +1;
4217       }else if( serial_type==0 ){
4218         rc = -1;
4219       }else{
4220         sqlite3VdbeSerialGet(&aKey1[d1], serial_type, &mem1);
4221         if( serial_type==7 ){
4222           if( mem1.u.r<pRhs->u.r ){
4223             rc = -1;
4224           }else if( mem1.u.r>pRhs->u.r ){
4225             rc = +1;
4226           }
4227         }else{
4228           rc = sqlite3IntFloatCompare(mem1.u.i, pRhs->u.r);
4229         }
4230       }
4231     }
4232 
4233     /* RHS is a string */
4234     else if( pRhs->flags & MEM_Str ){
4235       getVarint32(&aKey1[idx1], serial_type);
4236       testcase( serial_type==12 );
4237       if( serial_type<12 ){
4238         rc = -1;
4239       }else if( !(serial_type & 0x01) ){
4240         rc = +1;
4241       }else{
4242         mem1.n = (serial_type - 12) / 2;
4243         testcase( (d1+mem1.n)==(unsigned)nKey1 );
4244         testcase( (d1+mem1.n+1)==(unsigned)nKey1 );
4245         if( (d1+mem1.n) > (unsigned)nKey1 ){
4246           pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4247           return 0;                /* Corruption */
4248         }else if( (pKeyInfo = pPKey2->pKeyInfo)->aColl[i] ){
4249           mem1.enc = pKeyInfo->enc;
4250           mem1.db = pKeyInfo->db;
4251           mem1.flags = MEM_Str;
4252           mem1.z = (char*)&aKey1[d1];
4253           rc = vdbeCompareMemString(
4254               &mem1, pRhs, pKeyInfo->aColl[i], &pPKey2->errCode
4255           );
4256         }else{
4257           int nCmp = MIN(mem1.n, pRhs->n);
4258           rc = memcmp(&aKey1[d1], pRhs->z, nCmp);
4259           if( rc==0 ) rc = mem1.n - pRhs->n;
4260         }
4261       }
4262     }
4263 
4264     /* RHS is a blob */
4265     else if( pRhs->flags & MEM_Blob ){
4266       assert( (pRhs->flags & MEM_Zero)==0 || pRhs->n==0 );
4267       getVarint32(&aKey1[idx1], serial_type);
4268       testcase( serial_type==12 );
4269       if( serial_type<12 || (serial_type & 0x01) ){
4270         rc = -1;
4271       }else{
4272         int nStr = (serial_type - 12) / 2;
4273         testcase( (d1+nStr)==(unsigned)nKey1 );
4274         testcase( (d1+nStr+1)==(unsigned)nKey1 );
4275         if( (d1+nStr) > (unsigned)nKey1 ){
4276           pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4277           return 0;                /* Corruption */
4278         }else if( pRhs->flags & MEM_Zero ){
4279           if( !isAllZero((const char*)&aKey1[d1],nStr) ){
4280             rc = 1;
4281           }else{
4282             rc = nStr - pRhs->u.nZero;
4283           }
4284         }else{
4285           int nCmp = MIN(nStr, pRhs->n);
4286           rc = memcmp(&aKey1[d1], pRhs->z, nCmp);
4287           if( rc==0 ) rc = nStr - pRhs->n;
4288         }
4289       }
4290     }
4291 
4292     /* RHS is null */
4293     else{
4294       serial_type = aKey1[idx1];
4295       rc = (serial_type!=0);
4296     }
4297 
4298     if( rc!=0 ){
4299       if( pPKey2->pKeyInfo->aSortOrder[i] ){
4300         rc = -rc;
4301       }
4302       assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, rc) );
4303       assert( mem1.szMalloc==0 );  /* See comment below */
4304       return rc;
4305     }
4306 
4307     i++;
4308     if( i==pPKey2->nField ) break;
4309     pRhs++;
4310     d1 += sqlite3VdbeSerialTypeLen(serial_type);
4311     idx1 += sqlite3VarintLen(serial_type);
4312   }while( idx1<(unsigned)szHdr1 && d1<=(unsigned)nKey1 );
4313 
4314   /* No memory allocation is ever used on mem1.  Prove this using
4315   ** the following assert().  If the assert() fails, it indicates a
4316   ** memory leak and a need to call sqlite3VdbeMemRelease(&mem1).  */
4317   assert( mem1.szMalloc==0 );
4318 
4319   /* rc==0 here means that one or both of the keys ran out of fields and
4320   ** all the fields up to that point were equal. Return the default_rc
4321   ** value.  */
4322   assert( CORRUPT_DB
4323        || vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, pPKey2->default_rc)
4324        || pPKey2->pKeyInfo->db->mallocFailed
4325   );
4326   pPKey2->eqSeen = 1;
4327   return pPKey2->default_rc;
4328 }
4329 int sqlite3VdbeRecordCompare(
4330   int nKey1, const void *pKey1,   /* Left key */
4331   UnpackedRecord *pPKey2          /* Right key */
4332 ){
4333   return sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 0);
4334 }
4335 
4336 
4337 /*
4338 ** This function is an optimized version of sqlite3VdbeRecordCompare()
4339 ** that (a) the first field of pPKey2 is an integer, and (b) the
4340 ** size-of-header varint at the start of (pKey1/nKey1) fits in a single
4341 ** byte (i.e. is less than 128).
4342 **
4343 ** To avoid concerns about buffer overreads, this routine is only used
4344 ** on schemas where the maximum valid header size is 63 bytes or less.
4345 */
4346 static int vdbeRecordCompareInt(
4347   int nKey1, const void *pKey1, /* Left key */
4348   UnpackedRecord *pPKey2        /* Right key */
4349 ){
4350   const u8 *aKey = &((const u8*)pKey1)[*(const u8*)pKey1 & 0x3F];
4351   int serial_type = ((const u8*)pKey1)[1];
4352   int res;
4353   u32 y;
4354   u64 x;
4355   i64 v;
4356   i64 lhs;
4357 
4358   vdbeAssertFieldCountWithinLimits(nKey1, pKey1, pPKey2->pKeyInfo);
4359   assert( (*(u8*)pKey1)<=0x3F || CORRUPT_DB );
4360   switch( serial_type ){
4361     case 1: { /* 1-byte signed integer */
4362       lhs = ONE_BYTE_INT(aKey);
4363       testcase( lhs<0 );
4364       break;
4365     }
4366     case 2: { /* 2-byte signed integer */
4367       lhs = TWO_BYTE_INT(aKey);
4368       testcase( lhs<0 );
4369       break;
4370     }
4371     case 3: { /* 3-byte signed integer */
4372       lhs = THREE_BYTE_INT(aKey);
4373       testcase( lhs<0 );
4374       break;
4375     }
4376     case 4: { /* 4-byte signed integer */
4377       y = FOUR_BYTE_UINT(aKey);
4378       lhs = (i64)*(int*)&y;
4379       testcase( lhs<0 );
4380       break;
4381     }
4382     case 5: { /* 6-byte signed integer */
4383       lhs = FOUR_BYTE_UINT(aKey+2) + (((i64)1)<<32)*TWO_BYTE_INT(aKey);
4384       testcase( lhs<0 );
4385       break;
4386     }
4387     case 6: { /* 8-byte signed integer */
4388       x = FOUR_BYTE_UINT(aKey);
4389       x = (x<<32) | FOUR_BYTE_UINT(aKey+4);
4390       lhs = *(i64*)&x;
4391       testcase( lhs<0 );
4392       break;
4393     }
4394     case 8:
4395       lhs = 0;
4396       break;
4397     case 9:
4398       lhs = 1;
4399       break;
4400 
4401     /* This case could be removed without changing the results of running
4402     ** this code. Including it causes gcc to generate a faster switch
4403     ** statement (since the range of switch targets now starts at zero and
4404     ** is contiguous) but does not cause any duplicate code to be generated
4405     ** (as gcc is clever enough to combine the two like cases). Other
4406     ** compilers might be similar.  */
4407     case 0: case 7:
4408       return sqlite3VdbeRecordCompare(nKey1, pKey1, pPKey2);
4409 
4410     default:
4411       return sqlite3VdbeRecordCompare(nKey1, pKey1, pPKey2);
4412   }
4413 
4414   v = pPKey2->aMem[0].u.i;
4415   if( v>lhs ){
4416     res = pPKey2->r1;
4417   }else if( v<lhs ){
4418     res = pPKey2->r2;
4419   }else if( pPKey2->nField>1 ){
4420     /* The first fields of the two keys are equal. Compare the trailing
4421     ** fields.  */
4422     res = sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 1);
4423   }else{
4424     /* The first fields of the two keys are equal and there are no trailing
4425     ** fields. Return pPKey2->default_rc in this case. */
4426     res = pPKey2->default_rc;
4427     pPKey2->eqSeen = 1;
4428   }
4429 
4430   assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, res) );
4431   return res;
4432 }
4433 
4434 /*
4435 ** This function is an optimized version of sqlite3VdbeRecordCompare()
4436 ** that (a) the first field of pPKey2 is a string, that (b) the first field
4437 ** uses the collation sequence BINARY and (c) that the size-of-header varint
4438 ** at the start of (pKey1/nKey1) fits in a single byte.
4439 */
4440 static int vdbeRecordCompareString(
4441   int nKey1, const void *pKey1, /* Left key */
4442   UnpackedRecord *pPKey2        /* Right key */
4443 ){
4444   const u8 *aKey1 = (const u8*)pKey1;
4445   int serial_type;
4446   int res;
4447 
4448   assert( pPKey2->aMem[0].flags & MEM_Str );
4449   vdbeAssertFieldCountWithinLimits(nKey1, pKey1, pPKey2->pKeyInfo);
4450   getVarint32(&aKey1[1], serial_type);
4451   if( serial_type<12 ){
4452     res = pPKey2->r1;      /* (pKey1/nKey1) is a number or a null */
4453   }else if( !(serial_type & 0x01) ){
4454     res = pPKey2->r2;      /* (pKey1/nKey1) is a blob */
4455   }else{
4456     int nCmp;
4457     int nStr;
4458     int szHdr = aKey1[0];
4459 
4460     nStr = (serial_type-12) / 2;
4461     if( (szHdr + nStr) > nKey1 ){
4462       pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
4463       return 0;    /* Corruption */
4464     }
4465     nCmp = MIN( pPKey2->aMem[0].n, nStr );
4466     res = memcmp(&aKey1[szHdr], pPKey2->aMem[0].z, nCmp);
4467 
4468     if( res==0 ){
4469       res = nStr - pPKey2->aMem[0].n;
4470       if( res==0 ){
4471         if( pPKey2->nField>1 ){
4472           res = sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 1);
4473         }else{
4474           res = pPKey2->default_rc;
4475           pPKey2->eqSeen = 1;
4476         }
4477       }else if( res>0 ){
4478         res = pPKey2->r2;
4479       }else{
4480         res = pPKey2->r1;
4481       }
4482     }else if( res>0 ){
4483       res = pPKey2->r2;
4484     }else{
4485       res = pPKey2->r1;
4486     }
4487   }
4488 
4489   assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, res)
4490        || CORRUPT_DB
4491        || pPKey2->pKeyInfo->db->mallocFailed
4492   );
4493   return res;
4494 }
4495 
4496 /*
4497 ** Return a pointer to an sqlite3VdbeRecordCompare() compatible function
4498 ** suitable for comparing serialized records to the unpacked record passed
4499 ** as the only argument.
4500 */
4501 RecordCompare sqlite3VdbeFindCompare(UnpackedRecord *p){
4502   /* varintRecordCompareInt() and varintRecordCompareString() both assume
4503   ** that the size-of-header varint that occurs at the start of each record
4504   ** fits in a single byte (i.e. is 127 or less). varintRecordCompareInt()
4505   ** also assumes that it is safe to overread a buffer by at least the
4506   ** maximum possible legal header size plus 8 bytes. Because there is
4507   ** guaranteed to be at least 74 (but not 136) bytes of padding following each
4508   ** buffer passed to varintRecordCompareInt() this makes it convenient to
4509   ** limit the size of the header to 64 bytes in cases where the first field
4510   ** is an integer.
4511   **
4512   ** The easiest way to enforce this limit is to consider only records with
4513   ** 13 fields or less. If the first field is an integer, the maximum legal
4514   ** header size is (12*5 + 1 + 1) bytes.  */
4515   if( p->pKeyInfo->nAllField<=13 ){
4516     int flags = p->aMem[0].flags;
4517     if( p->pKeyInfo->aSortOrder[0] ){
4518       p->r1 = 1;
4519       p->r2 = -1;
4520     }else{
4521       p->r1 = -1;
4522       p->r2 = 1;
4523     }
4524     if( (flags & MEM_Int) ){
4525       return vdbeRecordCompareInt;
4526     }
4527     testcase( flags & MEM_Real );
4528     testcase( flags & MEM_Null );
4529     testcase( flags & MEM_Blob );
4530     if( (flags & (MEM_Real|MEM_Null|MEM_Blob))==0 && p->pKeyInfo->aColl[0]==0 ){
4531       assert( flags & MEM_Str );
4532       return vdbeRecordCompareString;
4533     }
4534   }
4535 
4536   return sqlite3VdbeRecordCompare;
4537 }
4538 
4539 /*
4540 ** pCur points at an index entry created using the OP_MakeRecord opcode.
4541 ** Read the rowid (the last field in the record) and store it in *rowid.
4542 ** Return SQLITE_OK if everything works, or an error code otherwise.
4543 **
4544 ** pCur might be pointing to text obtained from a corrupt database file.
4545 ** So the content cannot be trusted.  Do appropriate checks on the content.
4546 */
4547 int sqlite3VdbeIdxRowid(sqlite3 *db, BtCursor *pCur, i64 *rowid){
4548   i64 nCellKey = 0;
4549   int rc;
4550   u32 szHdr;        /* Size of the header */
4551   u32 typeRowid;    /* Serial type of the rowid */
4552   u32 lenRowid;     /* Size of the rowid */
4553   Mem m, v;
4554 
4555   /* Get the size of the index entry.  Only indices entries of less
4556   ** than 2GiB are support - anything large must be database corruption.
4557   ** Any corruption is detected in sqlite3BtreeParseCellPtr(), though, so
4558   ** this code can safely assume that nCellKey is 32-bits
4559   */
4560   assert( sqlite3BtreeCursorIsValid(pCur) );
4561   nCellKey = sqlite3BtreePayloadSize(pCur);
4562   assert( (nCellKey & SQLITE_MAX_U32)==(u64)nCellKey );
4563 
4564   /* Read in the complete content of the index entry */
4565   sqlite3VdbeMemInit(&m, db, 0);
4566   rc = sqlite3VdbeMemFromBtree(pCur, 0, (u32)nCellKey, &m);
4567   if( rc ){
4568     return rc;
4569   }
4570 
4571   /* The index entry must begin with a header size */
4572   (void)getVarint32((u8*)m.z, szHdr);
4573   testcase( szHdr==3 );
4574   testcase( szHdr==m.n );
4575   testcase( szHdr>0x7fffffff );
4576   assert( m.n>=0 );
4577   if( unlikely(szHdr<3 || szHdr>(unsigned)m.n) ){
4578     goto idx_rowid_corruption;
4579   }
4580 
4581   /* The last field of the index should be an integer - the ROWID.
4582   ** Verify that the last entry really is an integer. */
4583   (void)getVarint32((u8*)&m.z[szHdr-1], typeRowid);
4584   testcase( typeRowid==1 );
4585   testcase( typeRowid==2 );
4586   testcase( typeRowid==3 );
4587   testcase( typeRowid==4 );
4588   testcase( typeRowid==5 );
4589   testcase( typeRowid==6 );
4590   testcase( typeRowid==8 );
4591   testcase( typeRowid==9 );
4592   if( unlikely(typeRowid<1 || typeRowid>9 || typeRowid==7) ){
4593     goto idx_rowid_corruption;
4594   }
4595   lenRowid = sqlite3SmallTypeSizes[typeRowid];
4596   testcase( (u32)m.n==szHdr+lenRowid );
4597   if( unlikely((u32)m.n<szHdr+lenRowid) ){
4598     goto idx_rowid_corruption;
4599   }
4600 
4601   /* Fetch the integer off the end of the index record */
4602   sqlite3VdbeSerialGet((u8*)&m.z[m.n-lenRowid], typeRowid, &v);
4603   *rowid = v.u.i;
4604   sqlite3VdbeMemRelease(&m);
4605   return SQLITE_OK;
4606 
4607   /* Jump here if database corruption is detected after m has been
4608   ** allocated.  Free the m object and return SQLITE_CORRUPT. */
4609 idx_rowid_corruption:
4610   testcase( m.szMalloc!=0 );
4611   sqlite3VdbeMemRelease(&m);
4612   return SQLITE_CORRUPT_BKPT;
4613 }
4614 
4615 /*
4616 ** Compare the key of the index entry that cursor pC is pointing to against
4617 ** the key string in pUnpacked.  Write into *pRes a number
4618 ** that is negative, zero, or positive if pC is less than, equal to,
4619 ** or greater than pUnpacked.  Return SQLITE_OK on success.
4620 **
4621 ** pUnpacked is either created without a rowid or is truncated so that it
4622 ** omits the rowid at the end.  The rowid at the end of the index entry
4623 ** is ignored as well.  Hence, this routine only compares the prefixes
4624 ** of the keys prior to the final rowid, not the entire key.
4625 */
4626 int sqlite3VdbeIdxKeyCompare(
4627   sqlite3 *db,                     /* Database connection */
4628   VdbeCursor *pC,                  /* The cursor to compare against */
4629   UnpackedRecord *pUnpacked,       /* Unpacked version of key */
4630   int *res                         /* Write the comparison result here */
4631 ){
4632   i64 nCellKey = 0;
4633   int rc;
4634   BtCursor *pCur;
4635   Mem m;
4636 
4637   assert( pC->eCurType==CURTYPE_BTREE );
4638   pCur = pC->uc.pCursor;
4639   assert( sqlite3BtreeCursorIsValid(pCur) );
4640   nCellKey = sqlite3BtreePayloadSize(pCur);
4641   /* nCellKey will always be between 0 and 0xffffffff because of the way
4642   ** that btreeParseCellPtr() and sqlite3GetVarint32() are implemented */
4643   if( nCellKey<=0 || nCellKey>0x7fffffff ){
4644     *res = 0;
4645     return SQLITE_CORRUPT_BKPT;
4646   }
4647   sqlite3VdbeMemInit(&m, db, 0);
4648   rc = sqlite3VdbeMemFromBtree(pCur, 0, (u32)nCellKey, &m);
4649   if( rc ){
4650     return rc;
4651   }
4652   *res = sqlite3VdbeRecordCompareWithSkip(m.n, m.z, pUnpacked, 0);
4653   sqlite3VdbeMemRelease(&m);
4654   return SQLITE_OK;
4655 }
4656 
4657 /*
4658 ** This routine sets the value to be returned by subsequent calls to
4659 ** sqlite3_changes() on the database handle 'db'.
4660 */
4661 void sqlite3VdbeSetChanges(sqlite3 *db, int nChange){
4662   assert( sqlite3_mutex_held(db->mutex) );
4663   db->nChange = nChange;
4664   db->nTotalChange += nChange;
4665 }
4666 
4667 /*
4668 ** Set a flag in the vdbe to update the change counter when it is finalised
4669 ** or reset.
4670 */
4671 void sqlite3VdbeCountChanges(Vdbe *v){
4672   v->changeCntOn = 1;
4673 }
4674 
4675 /*
4676 ** Mark every prepared statement associated with a database connection
4677 ** as expired.
4678 **
4679 ** An expired statement means that recompilation of the statement is
4680 ** recommend.  Statements expire when things happen that make their
4681 ** programs obsolete.  Removing user-defined functions or collating
4682 ** sequences, or changing an authorization function are the types of
4683 ** things that make prepared statements obsolete.
4684 **
4685 ** If iCode is 1, then expiration is advisory.  The statement should
4686 ** be reprepared before being restarted, but if it is already running
4687 ** it is allowed to run to completion.
4688 **
4689 ** Internally, this function just sets the Vdbe.expired flag on all
4690 ** prepared statements.  The flag is set to 1 for an immediate expiration
4691 ** and set to 2 for an advisory expiration.
4692 */
4693 void sqlite3ExpirePreparedStatements(sqlite3 *db, int iCode){
4694   Vdbe *p;
4695   for(p = db->pVdbe; p; p=p->pNext){
4696     p->expired = iCode+1;
4697   }
4698 }
4699 
4700 /*
4701 ** Return the database associated with the Vdbe.
4702 */
4703 sqlite3 *sqlite3VdbeDb(Vdbe *v){
4704   return v->db;
4705 }
4706 
4707 /*
4708 ** Return the SQLITE_PREPARE flags for a Vdbe.
4709 */
4710 u8 sqlite3VdbePrepareFlags(Vdbe *v){
4711   return v->prepFlags;
4712 }
4713 
4714 /*
4715 ** Return a pointer to an sqlite3_value structure containing the value bound
4716 ** parameter iVar of VM v. Except, if the value is an SQL NULL, return
4717 ** 0 instead. Unless it is NULL, apply affinity aff (one of the SQLITE_AFF_*
4718 ** constants) to the value before returning it.
4719 **
4720 ** The returned value must be freed by the caller using sqlite3ValueFree().
4721 */
4722 sqlite3_value *sqlite3VdbeGetBoundValue(Vdbe *v, int iVar, u8 aff){
4723   assert( iVar>0 );
4724   if( v ){
4725     Mem *pMem = &v->aVar[iVar-1];
4726     assert( (v->db->flags & SQLITE_EnableQPSG)==0 );
4727     if( 0==(pMem->flags & MEM_Null) ){
4728       sqlite3_value *pRet = sqlite3ValueNew(v->db);
4729       if( pRet ){
4730         sqlite3VdbeMemCopy((Mem *)pRet, pMem);
4731         sqlite3ValueApplyAffinity(pRet, aff, SQLITE_UTF8);
4732       }
4733       return pRet;
4734     }
4735   }
4736   return 0;
4737 }
4738 
4739 /*
4740 ** Configure SQL variable iVar so that binding a new value to it signals
4741 ** to sqlite3_reoptimize() that re-preparing the statement may result
4742 ** in a better query plan.
4743 */
4744 void sqlite3VdbeSetVarmask(Vdbe *v, int iVar){
4745   assert( iVar>0 );
4746   assert( (v->db->flags & SQLITE_EnableQPSG)==0 );
4747   if( iVar>=32 ){
4748     v->expmask |= 0x80000000;
4749   }else{
4750     v->expmask |= ((u32)1 << (iVar-1));
4751   }
4752 }
4753 
4754 /*
4755 ** Cause a function to throw an error if it was call from OP_PureFunc
4756 ** rather than OP_Function.
4757 **
4758 ** OP_PureFunc means that the function must be deterministic, and should
4759 ** throw an error if it is given inputs that would make it non-deterministic.
4760 ** This routine is invoked by date/time functions that use non-deterministic
4761 ** features such as 'now'.
4762 */
4763 int sqlite3NotPureFunc(sqlite3_context *pCtx){
4764 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
4765   if( pCtx->pVdbe==0 ) return 1;
4766 #endif
4767   if( pCtx->pVdbe->aOp[pCtx->iOp].opcode==OP_PureFunc ){
4768     sqlite3_result_error(pCtx,
4769        "non-deterministic function in index expression or CHECK constraint",
4770        -1);
4771     return 0;
4772   }
4773   return 1;
4774 }
4775 
4776 #ifndef SQLITE_OMIT_VIRTUALTABLE
4777 /*
4778 ** Transfer error message text from an sqlite3_vtab.zErrMsg (text stored
4779 ** in memory obtained from sqlite3_malloc) into a Vdbe.zErrMsg (text stored
4780 ** in memory obtained from sqlite3DbMalloc).
4781 */
4782 void sqlite3VtabImportErrmsg(Vdbe *p, sqlite3_vtab *pVtab){
4783   if( pVtab->zErrMsg ){
4784     sqlite3 *db = p->db;
4785     sqlite3DbFree(db, p->zErrMsg);
4786     p->zErrMsg = sqlite3DbStrDup(db, pVtab->zErrMsg);
4787     sqlite3_free(pVtab->zErrMsg);
4788     pVtab->zErrMsg = 0;
4789   }
4790 }
4791 #endif /* SQLITE_OMIT_VIRTUALTABLE */
4792 
4793 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
4794 
4795 /*
4796 ** If the second argument is not NULL, release any allocations associated
4797 ** with the memory cells in the p->aMem[] array. Also free the UnpackedRecord
4798 ** structure itself, using sqlite3DbFree().
4799 **
4800 ** This function is used to free UnpackedRecord structures allocated by
4801 ** the vdbeUnpackRecord() function found in vdbeapi.c.
4802 */
4803 static void vdbeFreeUnpacked(sqlite3 *db, int nField, UnpackedRecord *p){
4804   if( p ){
4805     int i;
4806     for(i=0; i<nField; i++){
4807       Mem *pMem = &p->aMem[i];
4808       if( pMem->zMalloc ) sqlite3VdbeMemRelease(pMem);
4809     }
4810     sqlite3DbFreeNN(db, p);
4811   }
4812 }
4813 #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
4814 
4815 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
4816 /*
4817 ** Invoke the pre-update hook. If this is an UPDATE or DELETE pre-update call,
4818 ** then cursor passed as the second argument should point to the row about
4819 ** to be update or deleted. If the application calls sqlite3_preupdate_old(),
4820 ** the required value will be read from the row the cursor points to.
4821 */
4822 void sqlite3VdbePreUpdateHook(
4823   Vdbe *v,                        /* Vdbe pre-update hook is invoked by */
4824   VdbeCursor *pCsr,               /* Cursor to grab old.* values from */
4825   int op,                         /* SQLITE_INSERT, UPDATE or DELETE */
4826   const char *zDb,                /* Database name */
4827   Table *pTab,                    /* Modified table */
4828   i64 iKey1,                      /* Initial key value */
4829   int iReg                        /* Register for new.* record */
4830 ){
4831   sqlite3 *db = v->db;
4832   i64 iKey2;
4833   PreUpdate preupdate;
4834   const char *zTbl = pTab->zName;
4835   static const u8 fakeSortOrder = 0;
4836 
4837   assert( db->pPreUpdate==0 );
4838   memset(&preupdate, 0, sizeof(PreUpdate));
4839   if( HasRowid(pTab)==0 ){
4840     iKey1 = iKey2 = 0;
4841     preupdate.pPk = sqlite3PrimaryKeyIndex(pTab);
4842   }else{
4843     if( op==SQLITE_UPDATE ){
4844       iKey2 = v->aMem[iReg].u.i;
4845     }else{
4846       iKey2 = iKey1;
4847     }
4848   }
4849 
4850   assert( pCsr->nField==pTab->nCol
4851        || (pCsr->nField==pTab->nCol+1 && op==SQLITE_DELETE && iReg==-1)
4852   );
4853 
4854   preupdate.v = v;
4855   preupdate.pCsr = pCsr;
4856   preupdate.op = op;
4857   preupdate.iNewReg = iReg;
4858   preupdate.keyinfo.db = db;
4859   preupdate.keyinfo.enc = ENC(db);
4860   preupdate.keyinfo.nKeyField = pTab->nCol;
4861   preupdate.keyinfo.aSortOrder = (u8*)&fakeSortOrder;
4862   preupdate.iKey1 = iKey1;
4863   preupdate.iKey2 = iKey2;
4864   preupdate.pTab = pTab;
4865 
4866   db->pPreUpdate = &preupdate;
4867   db->xPreUpdateCallback(db->pPreUpdateArg, db, op, zDb, zTbl, iKey1, iKey2);
4868   db->pPreUpdate = 0;
4869   sqlite3DbFree(db, preupdate.aRecord);
4870   vdbeFreeUnpacked(db, preupdate.keyinfo.nKeyField+1, preupdate.pUnpacked);
4871   vdbeFreeUnpacked(db, preupdate.keyinfo.nKeyField+1, preupdate.pNewUnpacked);
4872   if( preupdate.aNew ){
4873     int i;
4874     for(i=0; i<pCsr->nField; i++){
4875       sqlite3VdbeMemRelease(&preupdate.aNew[i]);
4876     }
4877     sqlite3DbFreeNN(db, preupdate.aNew);
4878   }
4879 }
4880 #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
4881