xref: /sqlite-3.40.0/src/vdbemem.c (revision e89feee5)
1 /*
2 ** 2004 May 26
3 **
4 ** The author disclaims copyright to this source code.  In place of
5 ** a legal notice, here is a blessing:
6 **
7 **    May you do good and not evil.
8 **    May you find forgiveness for yourself and forgive others.
9 **    May you share freely, never taking more than you give.
10 **
11 *************************************************************************
12 **
13 ** This file contains code use to manipulate "Mem" structure.  A "Mem"
14 ** stores a single value in the VDBE.  Mem is an opaque structure visible
15 ** only within the VDBE.  Interface routines refer to a Mem using the
16 ** name sqlite_value
17 */
18 #include "sqliteInt.h"
19 #include "vdbeInt.h"
20 
21 #ifdef SQLITE_DEBUG
22 /*
23 ** Check invariants on a Mem object.
24 **
25 ** This routine is intended for use inside of assert() statements, like
26 ** this:    assert( sqlite3VdbeCheckMemInvariants(pMem) );
27 */
28 int sqlite3VdbeCheckMemInvariants(Mem *p){
29   /* If MEM_Dyn is set then Mem.xDel!=0.
30   ** Mem.xDel might not be initialized if MEM_Dyn is clear.
31   */
32   assert( (p->flags & MEM_Dyn)==0 || p->xDel!=0 );
33 
34   /* MEM_Dyn may only be set if Mem.szMalloc==0.  In this way we
35   ** ensure that if Mem.szMalloc>0 then it is safe to do
36   ** Mem.z = Mem.zMalloc without having to check Mem.flags&MEM_Dyn.
37   ** That saves a few cycles in inner loops. */
38   assert( (p->flags & MEM_Dyn)==0 || p->szMalloc==0 );
39 
40   /* Cannot be both MEM_Int and MEM_Real at the same time */
41   assert( (p->flags & (MEM_Int|MEM_Real))!=(MEM_Int|MEM_Real) );
42 
43   if( p->flags & MEM_Null ){
44     /* Cannot be both MEM_Null and some other type */
45     assert( (p->flags & (MEM_Int|MEM_Real|MEM_Str|MEM_Blob|MEM_Agg))==0 );
46 
47     /* If MEM_Null is set, then either the value is a pure NULL (the usual
48     ** case) or it is a pointer set using sqlite3_bind_pointer() or
49     ** sqlite3_result_pointer().  If a pointer, then MEM_Term must also be
50     ** set.
51     */
52     if( (p->flags & (MEM_Term|MEM_Subtype))==(MEM_Term|MEM_Subtype) ){
53       /* This is a pointer type.  There may be a flag to indicate what to
54       ** do with the pointer. */
55       assert( ((p->flags&MEM_Dyn)!=0 ? 1 : 0) +
56               ((p->flags&MEM_Ephem)!=0 ? 1 : 0) +
57               ((p->flags&MEM_Static)!=0 ? 1 : 0) <= 1 );
58 
59       /* No other bits set */
60       assert( (p->flags & ~(MEM_Null|MEM_Term|MEM_Subtype
61                            |MEM_Dyn|MEM_Ephem|MEM_Static))==0 );
62     }else{
63       /* A pure NULL might have other flags, such as MEM_Static, MEM_Dyn,
64       ** MEM_Ephem, MEM_Cleared, or MEM_Subtype */
65     }
66   }else{
67     /* The MEM_Cleared bit is only allowed on NULLs */
68     assert( (p->flags & MEM_Cleared)==0 );
69   }
70 
71   /* The szMalloc field holds the correct memory allocation size */
72   assert( p->szMalloc==0
73        || p->szMalloc==sqlite3DbMallocSize(p->db,p->zMalloc) );
74 
75   /* If p holds a string or blob, the Mem.z must point to exactly
76   ** one of the following:
77   **
78   **   (1) Memory in Mem.zMalloc and managed by the Mem object
79   **   (2) Memory to be freed using Mem.xDel
80   **   (3) An ephemeral string or blob
81   **   (4) A static string or blob
82   */
83   if( (p->flags & (MEM_Str|MEM_Blob)) && p->n>0 ){
84     assert(
85       ((p->szMalloc>0 && p->z==p->zMalloc)? 1 : 0) +
86       ((p->flags&MEM_Dyn)!=0 ? 1 : 0) +
87       ((p->flags&MEM_Ephem)!=0 ? 1 : 0) +
88       ((p->flags&MEM_Static)!=0 ? 1 : 0) == 1
89     );
90   }
91   return 1;
92 }
93 #endif
94 
95 #ifdef SQLITE_DEBUG
96 /*
97 ** Check that string value of pMem agrees with its integer or real value.
98 **
99 ** A single int or real value always converts to the same strings.  But
100 ** many different strings can be converted into the same int or real.
101 ** If a table contains a numeric value and an index is based on the
102 ** corresponding string value, then it is important that the string be
103 ** derived from the numeric value, not the other way around, to ensure
104 ** that the index and table are consistent.  See ticket
105 ** https://www.sqlite.org/src/info/343634942dd54ab (2018-01-31) for
106 ** an example.
107 **
108 ** This routine looks at pMem to verify that if it has both a numeric
109 ** representation and a string representation then the string rep has
110 ** been derived from the numeric and not the other way around.  It returns
111 ** true if everything is ok and false if there is a problem.
112 **
113 ** This routine is for use inside of assert() statements only.
114 */
115 int sqlite3VdbeMemConsistentDualRep(Mem *p){
116   char zBuf[100];
117   char *z;
118   int i, j, incr;
119   if( (p->flags & MEM_Str)==0 ) return 1;
120   if( (p->flags & (MEM_Int|MEM_Real))==0 ) return 1;
121   if( p->flags & MEM_Int ){
122     sqlite3_snprintf(sizeof(zBuf),zBuf,"%lld",p->u.i);
123   }else{
124     sqlite3_snprintf(sizeof(zBuf),zBuf,"%!.15g",p->u.r);
125   }
126   z = p->z;
127   i = j = 0;
128   incr = 1;
129   if( p->enc!=SQLITE_UTF8 ){
130     incr = 2;
131     if( p->enc==SQLITE_UTF16BE ) z++;
132   }
133   while( zBuf[j] ){
134     if( zBuf[j++]!=z[i] ) return 0;
135     i += incr;
136   }
137   return 1;
138 }
139 #endif /* SQLITE_DEBUG */
140 
141 /*
142 ** If pMem is an object with a valid string representation, this routine
143 ** ensures the internal encoding for the string representation is
144 ** 'desiredEnc', one of SQLITE_UTF8, SQLITE_UTF16LE or SQLITE_UTF16BE.
145 **
146 ** If pMem is not a string object, or the encoding of the string
147 ** representation is already stored using the requested encoding, then this
148 ** routine is a no-op.
149 **
150 ** SQLITE_OK is returned if the conversion is successful (or not required).
151 ** SQLITE_NOMEM may be returned if a malloc() fails during conversion
152 ** between formats.
153 */
154 int sqlite3VdbeChangeEncoding(Mem *pMem, int desiredEnc){
155 #ifndef SQLITE_OMIT_UTF16
156   int rc;
157 #endif
158   assert( !sqlite3VdbeMemIsRowSet(pMem) );
159   assert( desiredEnc==SQLITE_UTF8 || desiredEnc==SQLITE_UTF16LE
160            || desiredEnc==SQLITE_UTF16BE );
161   if( !(pMem->flags&MEM_Str) || pMem->enc==desiredEnc ){
162     return SQLITE_OK;
163   }
164   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
165 #ifdef SQLITE_OMIT_UTF16
166   return SQLITE_ERROR;
167 #else
168 
169   /* MemTranslate() may return SQLITE_OK or SQLITE_NOMEM. If NOMEM is returned,
170   ** then the encoding of the value may not have changed.
171   */
172   rc = sqlite3VdbeMemTranslate(pMem, (u8)desiredEnc);
173   assert(rc==SQLITE_OK    || rc==SQLITE_NOMEM);
174   assert(rc==SQLITE_OK    || pMem->enc!=desiredEnc);
175   assert(rc==SQLITE_NOMEM || pMem->enc==desiredEnc);
176   return rc;
177 #endif
178 }
179 
180 /*
181 ** Make sure pMem->z points to a writable allocation of at least
182 ** min(n,32) bytes.
183 **
184 ** If the bPreserve argument is true, then copy of the content of
185 ** pMem->z into the new allocation.  pMem must be either a string or
186 ** blob if bPreserve is true.  If bPreserve is false, any prior content
187 ** in pMem->z is discarded.
188 */
189 SQLITE_NOINLINE int sqlite3VdbeMemGrow(Mem *pMem, int n, int bPreserve){
190   assert( sqlite3VdbeCheckMemInvariants(pMem) );
191   assert( !sqlite3VdbeMemIsRowSet(pMem) );
192   testcase( pMem->db==0 );
193 
194   /* If the bPreserve flag is set to true, then the memory cell must already
195   ** contain a valid string or blob value.  */
196   assert( bPreserve==0 || pMem->flags&(MEM_Blob|MEM_Str) );
197   testcase( bPreserve && pMem->z==0 );
198 
199   assert( pMem->szMalloc==0
200        || pMem->szMalloc==sqlite3DbMallocSize(pMem->db, pMem->zMalloc) );
201   if( n<32 ) n = 32;
202   if( pMem->szMalloc>0 && bPreserve && pMem->z==pMem->zMalloc ){
203     pMem->z = pMem->zMalloc = sqlite3DbReallocOrFree(pMem->db, pMem->z, n);
204     bPreserve = 0;
205   }else{
206     if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
207     pMem->zMalloc = sqlite3DbMallocRaw(pMem->db, n);
208   }
209   if( pMem->zMalloc==0 ){
210     sqlite3VdbeMemSetNull(pMem);
211     pMem->z = 0;
212     pMem->szMalloc = 0;
213     return SQLITE_NOMEM_BKPT;
214   }else{
215     pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
216   }
217 
218   if( bPreserve && pMem->z ){
219     assert( pMem->z!=pMem->zMalloc );
220     memcpy(pMem->zMalloc, pMem->z, pMem->n);
221   }
222   if( (pMem->flags&MEM_Dyn)!=0 ){
223     assert( pMem->xDel!=0 && pMem->xDel!=SQLITE_DYNAMIC );
224     pMem->xDel((void *)(pMem->z));
225   }
226 
227   pMem->z = pMem->zMalloc;
228   pMem->flags &= ~(MEM_Dyn|MEM_Ephem|MEM_Static);
229   return SQLITE_OK;
230 }
231 
232 /*
233 ** Change the pMem->zMalloc allocation to be at least szNew bytes.
234 ** If pMem->zMalloc already meets or exceeds the requested size, this
235 ** routine is a no-op.
236 **
237 ** Any prior string or blob content in the pMem object may be discarded.
238 ** The pMem->xDel destructor is called, if it exists.  Though MEM_Str
239 ** and MEM_Blob values may be discarded, MEM_Int, MEM_Real, and MEM_Null
240 ** values are preserved.
241 **
242 ** Return SQLITE_OK on success or an error code (probably SQLITE_NOMEM)
243 ** if unable to complete the resizing.
244 */
245 int sqlite3VdbeMemClearAndResize(Mem *pMem, int szNew){
246   assert( szNew>0 );
247   assert( (pMem->flags & MEM_Dyn)==0 || pMem->szMalloc==0 );
248   if( pMem->szMalloc<szNew ){
249     return sqlite3VdbeMemGrow(pMem, szNew, 0);
250   }
251   assert( (pMem->flags & MEM_Dyn)==0 );
252   pMem->z = pMem->zMalloc;
253   pMem->flags &= (MEM_Null|MEM_Int|MEM_Real);
254   return SQLITE_OK;
255 }
256 
257 /*
258 ** It is already known that pMem contains an unterminated string.
259 ** Add the zero terminator.
260 */
261 static SQLITE_NOINLINE int vdbeMemAddTerminator(Mem *pMem){
262   if( sqlite3VdbeMemGrow(pMem, pMem->n+2, 1) ){
263     return SQLITE_NOMEM_BKPT;
264   }
265   pMem->z[pMem->n] = 0;
266   pMem->z[pMem->n+1] = 0;
267   pMem->flags |= MEM_Term;
268   return SQLITE_OK;
269 }
270 
271 /*
272 ** Change pMem so that its MEM_Str or MEM_Blob value is stored in
273 ** MEM.zMalloc, where it can be safely written.
274 **
275 ** Return SQLITE_OK on success or SQLITE_NOMEM if malloc fails.
276 */
277 int sqlite3VdbeMemMakeWriteable(Mem *pMem){
278   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
279   assert( !sqlite3VdbeMemIsRowSet(pMem) );
280   if( (pMem->flags & (MEM_Str|MEM_Blob))!=0 ){
281     if( ExpandBlob(pMem) ) return SQLITE_NOMEM;
282     if( pMem->szMalloc==0 || pMem->z!=pMem->zMalloc ){
283       int rc = vdbeMemAddTerminator(pMem);
284       if( rc ) return rc;
285     }
286   }
287   pMem->flags &= ~MEM_Ephem;
288 #ifdef SQLITE_DEBUG
289   pMem->pScopyFrom = 0;
290 #endif
291 
292   return SQLITE_OK;
293 }
294 
295 /*
296 ** If the given Mem* has a zero-filled tail, turn it into an ordinary
297 ** blob stored in dynamically allocated space.
298 */
299 #ifndef SQLITE_OMIT_INCRBLOB
300 int sqlite3VdbeMemExpandBlob(Mem *pMem){
301   int nByte;
302   assert( pMem->flags & MEM_Zero );
303   assert( pMem->flags&MEM_Blob );
304   assert( !sqlite3VdbeMemIsRowSet(pMem) );
305   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
306 
307   /* Set nByte to the number of bytes required to store the expanded blob. */
308   nByte = pMem->n + pMem->u.nZero;
309   if( nByte<=0 ){
310     nByte = 1;
311   }
312   if( sqlite3VdbeMemGrow(pMem, nByte, 1) ){
313     return SQLITE_NOMEM_BKPT;
314   }
315 
316   memset(&pMem->z[pMem->n], 0, pMem->u.nZero);
317   pMem->n += pMem->u.nZero;
318   pMem->flags &= ~(MEM_Zero|MEM_Term);
319   return SQLITE_OK;
320 }
321 #endif
322 
323 /*
324 ** Make sure the given Mem is \u0000 terminated.
325 */
326 int sqlite3VdbeMemNulTerminate(Mem *pMem){
327   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
328   testcase( (pMem->flags & (MEM_Term|MEM_Str))==(MEM_Term|MEM_Str) );
329   testcase( (pMem->flags & (MEM_Term|MEM_Str))==0 );
330   if( (pMem->flags & (MEM_Term|MEM_Str))!=MEM_Str ){
331     return SQLITE_OK;   /* Nothing to do */
332   }else{
333     return vdbeMemAddTerminator(pMem);
334   }
335 }
336 
337 /*
338 ** Add MEM_Str to the set of representations for the given Mem.  Numbers
339 ** are converted using sqlite3_snprintf().  Converting a BLOB to a string
340 ** is a no-op.
341 **
342 ** Existing representations MEM_Int and MEM_Real are invalidated if
343 ** bForce is true but are retained if bForce is false.
344 **
345 ** A MEM_Null value will never be passed to this function. This function is
346 ** used for converting values to text for returning to the user (i.e. via
347 ** sqlite3_value_text()), or for ensuring that values to be used as btree
348 ** keys are strings. In the former case a NULL pointer is returned the
349 ** user and the latter is an internal programming error.
350 */
351 int sqlite3VdbeMemStringify(Mem *pMem, u8 enc, u8 bForce){
352   int fg = pMem->flags;
353   const int nByte = 32;
354 
355   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
356   assert( !(fg&MEM_Zero) );
357   assert( !(fg&(MEM_Str|MEM_Blob)) );
358   assert( fg&(MEM_Int|MEM_Real) );
359   assert( !sqlite3VdbeMemIsRowSet(pMem) );
360   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
361 
362 
363   if( sqlite3VdbeMemClearAndResize(pMem, nByte) ){
364     pMem->enc = 0;
365     return SQLITE_NOMEM_BKPT;
366   }
367 
368   /* For a Real or Integer, use sqlite3_snprintf() to produce the UTF-8
369   ** string representation of the value. Then, if the required encoding
370   ** is UTF-16le or UTF-16be do a translation.
371   **
372   ** FIX ME: It would be better if sqlite3_snprintf() could do UTF-16.
373   */
374   if( fg & MEM_Int ){
375     sqlite3_snprintf(nByte, pMem->z, "%lld", pMem->u.i);
376   }else{
377     assert( fg & MEM_Real );
378     sqlite3_snprintf(nByte, pMem->z, "%!.15g", pMem->u.r);
379   }
380   assert( pMem->z!=0 );
381   pMem->n = sqlite3Strlen30NN(pMem->z);
382   pMem->enc = SQLITE_UTF8;
383   pMem->flags |= MEM_Str|MEM_Term;
384   if( bForce ) pMem->flags &= ~(MEM_Int|MEM_Real);
385   sqlite3VdbeChangeEncoding(pMem, enc);
386   return SQLITE_OK;
387 }
388 
389 /*
390 ** Memory cell pMem contains the context of an aggregate function.
391 ** This routine calls the finalize method for that function.  The
392 ** result of the aggregate is stored back into pMem.
393 **
394 ** Return SQLITE_ERROR if the finalizer reports an error.  SQLITE_OK
395 ** otherwise.
396 */
397 int sqlite3VdbeMemFinalize(Mem *pMem, FuncDef *pFunc){
398   sqlite3_context ctx;
399   Mem t;
400   assert( pFunc!=0 );
401   assert( pFunc->xFinalize!=0 );
402   assert( (pMem->flags & MEM_Null)!=0 || pFunc==pMem->u.pDef );
403   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
404   memset(&ctx, 0, sizeof(ctx));
405   memset(&t, 0, sizeof(t));
406   t.flags = MEM_Null;
407   t.db = pMem->db;
408   ctx.pOut = &t;
409   ctx.pMem = pMem;
410   ctx.pFunc = pFunc;
411   pFunc->xFinalize(&ctx); /* IMP: R-24505-23230 */
412   assert( (pMem->flags & MEM_Dyn)==0 );
413   if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
414   memcpy(pMem, &t, sizeof(t));
415   return ctx.isError;
416 }
417 
418 /*
419 ** Memory cell pAccum contains the context of an aggregate function.
420 ** This routine calls the xValue method for that function and stores
421 ** the results in memory cell pMem.
422 **
423 ** SQLITE_ERROR is returned if xValue() reports an error. SQLITE_OK
424 ** otherwise.
425 */
426 #ifndef SQLITE_OMIT_WINDOWFUNC
427 int sqlite3VdbeMemAggValue(Mem *pAccum, Mem *pOut, FuncDef *pFunc){
428   sqlite3_context ctx;
429   Mem t;
430   assert( pFunc!=0 );
431   assert( pFunc->xValue!=0 );
432   assert( (pAccum->flags & MEM_Null)!=0 || pFunc==pAccum->u.pDef );
433   assert( pAccum->db==0 || sqlite3_mutex_held(pAccum->db->mutex) );
434   memset(&ctx, 0, sizeof(ctx));
435   memset(&t, 0, sizeof(t));
436   t.flags = MEM_Null;
437   t.db = pAccum->db;
438   sqlite3VdbeMemSetNull(pOut);
439   ctx.pOut = pOut;
440   ctx.pMem = pAccum;
441   ctx.pFunc = pFunc;
442   pFunc->xValue(&ctx);
443   return ctx.isError;
444 }
445 #endif /* SQLITE_OMIT_WINDOWFUNC */
446 
447 /*
448 ** If the memory cell contains a value that must be freed by
449 ** invoking the external callback in Mem.xDel, then this routine
450 ** will free that value.  It also sets Mem.flags to MEM_Null.
451 **
452 ** This is a helper routine for sqlite3VdbeMemSetNull() and
453 ** for sqlite3VdbeMemRelease().  Use those other routines as the
454 ** entry point for releasing Mem resources.
455 */
456 static SQLITE_NOINLINE void vdbeMemClearExternAndSetNull(Mem *p){
457   assert( p->db==0 || sqlite3_mutex_held(p->db->mutex) );
458   assert( VdbeMemDynamic(p) );
459   if( p->flags&MEM_Agg ){
460     sqlite3VdbeMemFinalize(p, p->u.pDef);
461     assert( (p->flags & MEM_Agg)==0 );
462     testcase( p->flags & MEM_Dyn );
463   }
464   if( p->flags&MEM_Dyn ){
465     assert( p->xDel!=SQLITE_DYNAMIC && p->xDel!=0 );
466     p->xDel((void *)p->z);
467   }
468   p->flags = MEM_Null;
469 }
470 
471 /*
472 ** Release memory held by the Mem p, both external memory cleared
473 ** by p->xDel and memory in p->zMalloc.
474 **
475 ** This is a helper routine invoked by sqlite3VdbeMemRelease() in
476 ** the unusual case where there really is memory in p that needs
477 ** to be freed.
478 */
479 static SQLITE_NOINLINE void vdbeMemClear(Mem *p){
480   if( VdbeMemDynamic(p) ){
481     vdbeMemClearExternAndSetNull(p);
482   }
483   if( p->szMalloc ){
484     sqlite3DbFreeNN(p->db, p->zMalloc);
485     p->szMalloc = 0;
486   }
487   p->z = 0;
488 }
489 
490 /*
491 ** Release any memory resources held by the Mem.  Both the memory that is
492 ** free by Mem.xDel and the Mem.zMalloc allocation are freed.
493 **
494 ** Use this routine prior to clean up prior to abandoning a Mem, or to
495 ** reset a Mem back to its minimum memory utilization.
496 **
497 ** Use sqlite3VdbeMemSetNull() to release just the Mem.xDel space
498 ** prior to inserting new content into the Mem.
499 */
500 void sqlite3VdbeMemRelease(Mem *p){
501   assert( sqlite3VdbeCheckMemInvariants(p) );
502   if( VdbeMemDynamic(p) || p->szMalloc ){
503     vdbeMemClear(p);
504   }
505 }
506 
507 /*
508 ** Convert a 64-bit IEEE double into a 64-bit signed integer.
509 ** If the double is out of range of a 64-bit signed integer then
510 ** return the closest available 64-bit signed integer.
511 */
512 static SQLITE_NOINLINE i64 doubleToInt64(double r){
513 #ifdef SQLITE_OMIT_FLOATING_POINT
514   /* When floating-point is omitted, double and int64 are the same thing */
515   return r;
516 #else
517   /*
518   ** Many compilers we encounter do not define constants for the
519   ** minimum and maximum 64-bit integers, or they define them
520   ** inconsistently.  And many do not understand the "LL" notation.
521   ** So we define our own static constants here using nothing
522   ** larger than a 32-bit integer constant.
523   */
524   static const i64 maxInt = LARGEST_INT64;
525   static const i64 minInt = SMALLEST_INT64;
526 
527   if( r<=(double)minInt ){
528     return minInt;
529   }else if( r>=(double)maxInt ){
530     return maxInt;
531   }else{
532     return (i64)r;
533   }
534 #endif
535 }
536 
537 /*
538 ** Return some kind of integer value which is the best we can do
539 ** at representing the value that *pMem describes as an integer.
540 ** If pMem is an integer, then the value is exact.  If pMem is
541 ** a floating-point then the value returned is the integer part.
542 ** If pMem is a string or blob, then we make an attempt to convert
543 ** it into an integer and return that.  If pMem represents an
544 ** an SQL-NULL value, return 0.
545 **
546 ** If pMem represents a string value, its encoding might be changed.
547 */
548 static SQLITE_NOINLINE i64 memIntValue(Mem *pMem){
549   i64 value = 0;
550   sqlite3Atoi64(pMem->z, &value, pMem->n, pMem->enc);
551   return value;
552 }
553 i64 sqlite3VdbeIntValue(Mem *pMem){
554   int flags;
555   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
556   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
557   flags = pMem->flags;
558   if( flags & MEM_Int ){
559     return pMem->u.i;
560   }else if( flags & MEM_Real ){
561     return doubleToInt64(pMem->u.r);
562   }else if( flags & (MEM_Str|MEM_Blob) ){
563     assert( pMem->z || pMem->n==0 );
564     return memIntValue(pMem);
565   }else{
566     return 0;
567   }
568 }
569 
570 /*
571 ** Return the best representation of pMem that we can get into a
572 ** double.  If pMem is already a double or an integer, return its
573 ** value.  If it is a string or blob, try to convert it to a double.
574 ** If it is a NULL, return 0.0.
575 */
576 static SQLITE_NOINLINE double memRealValue(Mem *pMem){
577   /* (double)0 In case of SQLITE_OMIT_FLOATING_POINT... */
578   double val = (double)0;
579   sqlite3AtoF(pMem->z, &val, pMem->n, pMem->enc);
580   return val;
581 }
582 double sqlite3VdbeRealValue(Mem *pMem){
583   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
584   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
585   if( pMem->flags & MEM_Real ){
586     return pMem->u.r;
587   }else if( pMem->flags & MEM_Int ){
588     return (double)pMem->u.i;
589   }else if( pMem->flags & (MEM_Str|MEM_Blob) ){
590     return memRealValue(pMem);
591   }else{
592     /* (double)0 In case of SQLITE_OMIT_FLOATING_POINT... */
593     return (double)0;
594   }
595 }
596 
597 /*
598 ** Return 1 if pMem represents true, and return 0 if pMem represents false.
599 ** Return the value ifNull if pMem is NULL.
600 */
601 int sqlite3VdbeBooleanValue(Mem *pMem, int ifNull){
602   if( pMem->flags & MEM_Int ) return pMem->u.i!=0;
603   if( pMem->flags & MEM_Null ) return ifNull;
604   return sqlite3VdbeRealValue(pMem)!=0.0;
605 }
606 
607 /*
608 ** The MEM structure is already a MEM_Real.  Try to also make it a
609 ** MEM_Int if we can.
610 */
611 void sqlite3VdbeIntegerAffinity(Mem *pMem){
612   i64 ix;
613   assert( pMem->flags & MEM_Real );
614   assert( !sqlite3VdbeMemIsRowSet(pMem) );
615   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
616   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
617 
618   ix = doubleToInt64(pMem->u.r);
619 
620   /* Only mark the value as an integer if
621   **
622   **    (1) the round-trip conversion real->int->real is a no-op, and
623   **    (2) The integer is neither the largest nor the smallest
624   **        possible integer (ticket #3922)
625   **
626   ** The second and third terms in the following conditional enforces
627   ** the second condition under the assumption that addition overflow causes
628   ** values to wrap around.
629   */
630   if( pMem->u.r==ix && ix>SMALLEST_INT64 && ix<LARGEST_INT64 ){
631     pMem->u.i = ix;
632     MemSetTypeFlag(pMem, MEM_Int);
633   }
634 }
635 
636 /*
637 ** Convert pMem to type integer.  Invalidate any prior representations.
638 */
639 int sqlite3VdbeMemIntegerify(Mem *pMem){
640   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
641   assert( !sqlite3VdbeMemIsRowSet(pMem) );
642   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
643 
644   pMem->u.i = sqlite3VdbeIntValue(pMem);
645   MemSetTypeFlag(pMem, MEM_Int);
646   return SQLITE_OK;
647 }
648 
649 /*
650 ** Convert pMem so that it is of type MEM_Real.
651 ** Invalidate any prior representations.
652 */
653 int sqlite3VdbeMemRealify(Mem *pMem){
654   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
655   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
656 
657   pMem->u.r = sqlite3VdbeRealValue(pMem);
658   MemSetTypeFlag(pMem, MEM_Real);
659   return SQLITE_OK;
660 }
661 
662 /* Compare a floating point value to an integer.  Return true if the two
663 ** values are the same within the precision of the floating point value.
664 **
665 ** For some versions of GCC on 32-bit machines, if you do the more obvious
666 ** comparison of "r1==(double)i" you sometimes get an answer of false even
667 ** though the r1 and (double)i values are bit-for-bit the same.
668 */
669 static int sqlite3RealSameAsInt(double r1, sqlite3_int64 i){
670   double r2 = (double)i;
671   return memcmp(&r1, &r2, sizeof(r1))==0;
672 }
673 
674 /*
675 ** Convert pMem so that it has types MEM_Real or MEM_Int or both.
676 ** Invalidate any prior representations.
677 **
678 ** Every effort is made to force the conversion, even if the input
679 ** is a string that does not look completely like a number.  Convert
680 ** as much of the string as we can and ignore the rest.
681 */
682 int sqlite3VdbeMemNumerify(Mem *pMem){
683   if( (pMem->flags & (MEM_Int|MEM_Real|MEM_Null))==0 ){
684     int rc;
685     assert( (pMem->flags & (MEM_Blob|MEM_Str))!=0 );
686     assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
687     rc = sqlite3Atoi64(pMem->z, &pMem->u.i, pMem->n, pMem->enc);
688     if( rc==0 ){
689       MemSetTypeFlag(pMem, MEM_Int);
690     }else{
691       i64 i = pMem->u.i;
692       sqlite3AtoF(pMem->z, &pMem->u.r, pMem->n, pMem->enc);
693       if( rc==1 && sqlite3RealSameAsInt(pMem->u.r, i) ){
694         pMem->u.i = i;
695         MemSetTypeFlag(pMem, MEM_Int);
696       }else{
697         MemSetTypeFlag(pMem, MEM_Real);
698       }
699     }
700   }
701   assert( (pMem->flags & (MEM_Int|MEM_Real|MEM_Null))!=0 );
702   pMem->flags &= ~(MEM_Str|MEM_Blob|MEM_Zero);
703   return SQLITE_OK;
704 }
705 
706 /*
707 ** Cast the datatype of the value in pMem according to the affinity
708 ** "aff".  Casting is different from applying affinity in that a cast
709 ** is forced.  In other words, the value is converted into the desired
710 ** affinity even if that results in loss of data.  This routine is
711 ** used (for example) to implement the SQL "cast()" operator.
712 */
713 void sqlite3VdbeMemCast(Mem *pMem, u8 aff, u8 encoding){
714   if( pMem->flags & MEM_Null ) return;
715   switch( aff ){
716     case SQLITE_AFF_BLOB: {   /* Really a cast to BLOB */
717       if( (pMem->flags & MEM_Blob)==0 ){
718         sqlite3ValueApplyAffinity(pMem, SQLITE_AFF_TEXT, encoding);
719         assert( pMem->flags & MEM_Str || pMem->db->mallocFailed );
720         if( pMem->flags & MEM_Str ) MemSetTypeFlag(pMem, MEM_Blob);
721       }else{
722         pMem->flags &= ~(MEM_TypeMask&~MEM_Blob);
723       }
724       break;
725     }
726     case SQLITE_AFF_NUMERIC: {
727       sqlite3VdbeMemNumerify(pMem);
728       break;
729     }
730     case SQLITE_AFF_INTEGER: {
731       sqlite3VdbeMemIntegerify(pMem);
732       break;
733     }
734     case SQLITE_AFF_REAL: {
735       sqlite3VdbeMemRealify(pMem);
736       break;
737     }
738     default: {
739       assert( aff==SQLITE_AFF_TEXT );
740       assert( MEM_Str==(MEM_Blob>>3) );
741       pMem->flags |= (pMem->flags&MEM_Blob)>>3;
742       sqlite3ValueApplyAffinity(pMem, SQLITE_AFF_TEXT, encoding);
743       assert( pMem->flags & MEM_Str || pMem->db->mallocFailed );
744       pMem->flags &= ~(MEM_Int|MEM_Real|MEM_Blob|MEM_Zero);
745       break;
746     }
747   }
748 }
749 
750 /*
751 ** Initialize bulk memory to be a consistent Mem object.
752 **
753 ** The minimum amount of initialization feasible is performed.
754 */
755 void sqlite3VdbeMemInit(Mem *pMem, sqlite3 *db, u16 flags){
756   assert( (flags & ~MEM_TypeMask)==0 );
757   pMem->flags = flags;
758   pMem->db = db;
759   pMem->szMalloc = 0;
760 }
761 
762 
763 /*
764 ** Delete any previous value and set the value stored in *pMem to NULL.
765 **
766 ** This routine calls the Mem.xDel destructor to dispose of values that
767 ** require the destructor.  But it preserves the Mem.zMalloc memory allocation.
768 ** To free all resources, use sqlite3VdbeMemRelease(), which both calls this
769 ** routine to invoke the destructor and deallocates Mem.zMalloc.
770 **
771 ** Use this routine to reset the Mem prior to insert a new value.
772 **
773 ** Use sqlite3VdbeMemRelease() to complete erase the Mem prior to abandoning it.
774 */
775 void sqlite3VdbeMemSetNull(Mem *pMem){
776   if( VdbeMemDynamic(pMem) ){
777     vdbeMemClearExternAndSetNull(pMem);
778   }else{
779     pMem->flags = MEM_Null;
780   }
781 }
782 void sqlite3ValueSetNull(sqlite3_value *p){
783   sqlite3VdbeMemSetNull((Mem*)p);
784 }
785 
786 /*
787 ** Delete any previous value and set the value to be a BLOB of length
788 ** n containing all zeros.
789 */
790 void sqlite3VdbeMemSetZeroBlob(Mem *pMem, int n){
791   sqlite3VdbeMemRelease(pMem);
792   pMem->flags = MEM_Blob|MEM_Zero;
793   pMem->n = 0;
794   if( n<0 ) n = 0;
795   pMem->u.nZero = n;
796   pMem->enc = SQLITE_UTF8;
797   pMem->z = 0;
798 }
799 
800 /*
801 ** The pMem is known to contain content that needs to be destroyed prior
802 ** to a value change.  So invoke the destructor, then set the value to
803 ** a 64-bit integer.
804 */
805 static SQLITE_NOINLINE void vdbeReleaseAndSetInt64(Mem *pMem, i64 val){
806   sqlite3VdbeMemSetNull(pMem);
807   pMem->u.i = val;
808   pMem->flags = MEM_Int;
809 }
810 
811 /*
812 ** Delete any previous value and set the value stored in *pMem to val,
813 ** manifest type INTEGER.
814 */
815 void sqlite3VdbeMemSetInt64(Mem *pMem, i64 val){
816   if( VdbeMemDynamic(pMem) ){
817     vdbeReleaseAndSetInt64(pMem, val);
818   }else{
819     pMem->u.i = val;
820     pMem->flags = MEM_Int;
821   }
822 }
823 
824 /* A no-op destructor */
825 void sqlite3NoopDestructor(void *p){ UNUSED_PARAMETER(p); }
826 
827 /*
828 ** Set the value stored in *pMem should already be a NULL.
829 ** Also store a pointer to go with it.
830 */
831 void sqlite3VdbeMemSetPointer(
832   Mem *pMem,
833   void *pPtr,
834   const char *zPType,
835   void (*xDestructor)(void*)
836 ){
837   assert( pMem->flags==MEM_Null );
838   pMem->u.zPType = zPType ? zPType : "";
839   pMem->z = pPtr;
840   pMem->flags = MEM_Null|MEM_Dyn|MEM_Subtype|MEM_Term;
841   pMem->eSubtype = 'p';
842   pMem->xDel = xDestructor ? xDestructor : sqlite3NoopDestructor;
843 }
844 
845 #ifndef SQLITE_OMIT_FLOATING_POINT
846 /*
847 ** Delete any previous value and set the value stored in *pMem to val,
848 ** manifest type REAL.
849 */
850 void sqlite3VdbeMemSetDouble(Mem *pMem, double val){
851   sqlite3VdbeMemSetNull(pMem);
852   if( !sqlite3IsNaN(val) ){
853     pMem->u.r = val;
854     pMem->flags = MEM_Real;
855   }
856 }
857 #endif
858 
859 #ifdef SQLITE_DEBUG
860 /*
861 ** Return true if the Mem holds a RowSet object.  This routine is intended
862 ** for use inside of assert() statements.
863 */
864 int sqlite3VdbeMemIsRowSet(const Mem *pMem){
865   return (pMem->flags&(MEM_Blob|MEM_Dyn))==(MEM_Blob|MEM_Dyn)
866          && pMem->xDel==sqlite3RowSetDelete;
867 }
868 #endif
869 
870 /*
871 ** Delete any previous value and set the value of pMem to be an
872 ** empty boolean index.
873 **
874 ** Return SQLITE_OK on success and SQLITE_NOMEM if a memory allocation
875 ** error occurs.
876 */
877 int sqlite3VdbeMemSetRowSet(Mem *pMem){
878   sqlite3 *db = pMem->db;
879   RowSet *p;
880   assert( db!=0 );
881   assert( !sqlite3VdbeMemIsRowSet(pMem) );
882   sqlite3VdbeMemRelease(pMem);
883   p = sqlite3RowSetInit(db);
884   if( p==0 ) return SQLITE_NOMEM;
885   pMem->z = (char*)p;
886   pMem->flags = MEM_Blob|MEM_Dyn;
887   pMem->xDel = sqlite3RowSetDelete;
888   return SQLITE_OK;
889 }
890 
891 /*
892 ** Return true if the Mem object contains a TEXT or BLOB that is
893 ** too large - whose size exceeds SQLITE_MAX_LENGTH.
894 */
895 int sqlite3VdbeMemTooBig(Mem *p){
896   assert( p->db!=0 );
897   if( p->flags & (MEM_Str|MEM_Blob) ){
898     int n = p->n;
899     if( p->flags & MEM_Zero ){
900       n += p->u.nZero;
901     }
902     return n>p->db->aLimit[SQLITE_LIMIT_LENGTH];
903   }
904   return 0;
905 }
906 
907 #ifdef SQLITE_DEBUG
908 /*
909 ** This routine prepares a memory cell for modification by breaking
910 ** its link to a shallow copy and by marking any current shallow
911 ** copies of this cell as invalid.
912 **
913 ** This is used for testing and debugging only - to make sure shallow
914 ** copies are not misused.
915 */
916 void sqlite3VdbeMemAboutToChange(Vdbe *pVdbe, Mem *pMem){
917   int i;
918   Mem *pX;
919   for(i=0, pX=pVdbe->aMem; i<pVdbe->nMem; i++, pX++){
920     if( pX->pScopyFrom==pMem ){
921       /* If pX is marked as a shallow copy of pMem, then verify that
922       ** no significant changes have been made to pX since the OP_SCopy.
923       ** A significant change would indicated a missed call to this
924       ** function for pX.  Minor changes, such as adding or removing a
925       ** dual type, are allowed, as long as the underlying value is the
926       ** same. */
927       u16 mFlags = pMem->flags & pX->flags & pX->mScopyFlags;
928       assert( (mFlags&MEM_Int)==0 || pMem->u.i==pX->u.i );
929       assert( (mFlags&MEM_Real)==0 || pMem->u.r==pX->u.r );
930       assert( (mFlags&MEM_Str)==0  || (pMem->n==pX->n && pMem->z==pX->z) );
931       assert( (mFlags&MEM_Blob)==0  || sqlite3BlobCompare(pMem,pX)==0 );
932 
933       /* pMem is the register that is changing.  But also mark pX as
934       ** undefined so that we can quickly detect the shallow-copy error */
935       pX->flags = MEM_Undefined;
936       pX->pScopyFrom = 0;
937     }
938   }
939   pMem->pScopyFrom = 0;
940 }
941 #endif /* SQLITE_DEBUG */
942 
943 
944 /*
945 ** Make an shallow copy of pFrom into pTo.  Prior contents of
946 ** pTo are freed.  The pFrom->z field is not duplicated.  If
947 ** pFrom->z is used, then pTo->z points to the same thing as pFrom->z
948 ** and flags gets srcType (either MEM_Ephem or MEM_Static).
949 */
950 static SQLITE_NOINLINE void vdbeClrCopy(Mem *pTo, const Mem *pFrom, int eType){
951   vdbeMemClearExternAndSetNull(pTo);
952   assert( !VdbeMemDynamic(pTo) );
953   sqlite3VdbeMemShallowCopy(pTo, pFrom, eType);
954 }
955 void sqlite3VdbeMemShallowCopy(Mem *pTo, const Mem *pFrom, int srcType){
956   assert( !sqlite3VdbeMemIsRowSet(pFrom) );
957   assert( pTo->db==pFrom->db );
958   if( VdbeMemDynamic(pTo) ){ vdbeClrCopy(pTo,pFrom,srcType); return; }
959   memcpy(pTo, pFrom, MEMCELLSIZE);
960   if( (pFrom->flags&MEM_Static)==0 ){
961     pTo->flags &= ~(MEM_Dyn|MEM_Static|MEM_Ephem);
962     assert( srcType==MEM_Ephem || srcType==MEM_Static );
963     pTo->flags |= srcType;
964   }
965 }
966 
967 /*
968 ** Make a full copy of pFrom into pTo.  Prior contents of pTo are
969 ** freed before the copy is made.
970 */
971 int sqlite3VdbeMemCopy(Mem *pTo, const Mem *pFrom){
972   int rc = SQLITE_OK;
973 
974   assert( !sqlite3VdbeMemIsRowSet(pFrom) );
975   if( VdbeMemDynamic(pTo) ) vdbeMemClearExternAndSetNull(pTo);
976   memcpy(pTo, pFrom, MEMCELLSIZE);
977   pTo->flags &= ~MEM_Dyn;
978   if( pTo->flags&(MEM_Str|MEM_Blob) ){
979     if( 0==(pFrom->flags&MEM_Static) ){
980       pTo->flags |= MEM_Ephem;
981       rc = sqlite3VdbeMemMakeWriteable(pTo);
982     }
983   }
984 
985   return rc;
986 }
987 
988 /*
989 ** Transfer the contents of pFrom to pTo. Any existing value in pTo is
990 ** freed. If pFrom contains ephemeral data, a copy is made.
991 **
992 ** pFrom contains an SQL NULL when this routine returns.
993 */
994 void sqlite3VdbeMemMove(Mem *pTo, Mem *pFrom){
995   assert( pFrom->db==0 || sqlite3_mutex_held(pFrom->db->mutex) );
996   assert( pTo->db==0 || sqlite3_mutex_held(pTo->db->mutex) );
997   assert( pFrom->db==0 || pTo->db==0 || pFrom->db==pTo->db );
998 
999   sqlite3VdbeMemRelease(pTo);
1000   memcpy(pTo, pFrom, sizeof(Mem));
1001   pFrom->flags = MEM_Null;
1002   pFrom->szMalloc = 0;
1003 }
1004 
1005 /*
1006 ** Change the value of a Mem to be a string or a BLOB.
1007 **
1008 ** The memory management strategy depends on the value of the xDel
1009 ** parameter. If the value passed is SQLITE_TRANSIENT, then the
1010 ** string is copied into a (possibly existing) buffer managed by the
1011 ** Mem structure. Otherwise, any existing buffer is freed and the
1012 ** pointer copied.
1013 **
1014 ** If the string is too large (if it exceeds the SQLITE_LIMIT_LENGTH
1015 ** size limit) then no memory allocation occurs.  If the string can be
1016 ** stored without allocating memory, then it is.  If a memory allocation
1017 ** is required to store the string, then value of pMem is unchanged.  In
1018 ** either case, SQLITE_TOOBIG is returned.
1019 */
1020 int sqlite3VdbeMemSetStr(
1021   Mem *pMem,          /* Memory cell to set to string value */
1022   const char *z,      /* String pointer */
1023   int n,              /* Bytes in string, or negative */
1024   u8 enc,             /* Encoding of z.  0 for BLOBs */
1025   void (*xDel)(void*) /* Destructor function */
1026 ){
1027   int nByte = n;      /* New value for pMem->n */
1028   int iLimit;         /* Maximum allowed string or blob size */
1029   u16 flags = 0;      /* New value for pMem->flags */
1030 
1031   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
1032   assert( !sqlite3VdbeMemIsRowSet(pMem) );
1033 
1034   /* If z is a NULL pointer, set pMem to contain an SQL NULL. */
1035   if( !z ){
1036     sqlite3VdbeMemSetNull(pMem);
1037     return SQLITE_OK;
1038   }
1039 
1040   if( pMem->db ){
1041     iLimit = pMem->db->aLimit[SQLITE_LIMIT_LENGTH];
1042   }else{
1043     iLimit = SQLITE_MAX_LENGTH;
1044   }
1045   flags = (enc==0?MEM_Blob:MEM_Str);
1046   if( nByte<0 ){
1047     assert( enc!=0 );
1048     if( enc==SQLITE_UTF8 ){
1049       nByte = 0x7fffffff & (int)strlen(z);
1050       if( nByte>iLimit ) nByte = iLimit+1;
1051     }else{
1052       for(nByte=0; nByte<=iLimit && (z[nByte] | z[nByte+1]); nByte+=2){}
1053     }
1054     flags |= MEM_Term;
1055   }
1056 
1057   /* The following block sets the new values of Mem.z and Mem.xDel. It
1058   ** also sets a flag in local variable "flags" to indicate the memory
1059   ** management (one of MEM_Dyn or MEM_Static).
1060   */
1061   if( xDel==SQLITE_TRANSIENT ){
1062     int nAlloc = nByte;
1063     if( flags&MEM_Term ){
1064       nAlloc += (enc==SQLITE_UTF8?1:2);
1065     }
1066     if( nByte>iLimit ){
1067       return SQLITE_TOOBIG;
1068     }
1069     testcase( nAlloc==0 );
1070     testcase( nAlloc==31 );
1071     testcase( nAlloc==32 );
1072     if( sqlite3VdbeMemClearAndResize(pMem, MAX(nAlloc,32)) ){
1073       return SQLITE_NOMEM_BKPT;
1074     }
1075     memcpy(pMem->z, z, nAlloc);
1076   }else if( xDel==SQLITE_DYNAMIC ){
1077     sqlite3VdbeMemRelease(pMem);
1078     pMem->zMalloc = pMem->z = (char *)z;
1079     pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
1080   }else{
1081     sqlite3VdbeMemRelease(pMem);
1082     pMem->z = (char *)z;
1083     pMem->xDel = xDel;
1084     flags |= ((xDel==SQLITE_STATIC)?MEM_Static:MEM_Dyn);
1085   }
1086 
1087   pMem->n = nByte;
1088   pMem->flags = flags;
1089   pMem->enc = (enc==0 ? SQLITE_UTF8 : enc);
1090 
1091 #ifndef SQLITE_OMIT_UTF16
1092   if( pMem->enc!=SQLITE_UTF8 && sqlite3VdbeMemHandleBom(pMem) ){
1093     return SQLITE_NOMEM_BKPT;
1094   }
1095 #endif
1096 
1097   if( nByte>iLimit ){
1098     return SQLITE_TOOBIG;
1099   }
1100 
1101   return SQLITE_OK;
1102 }
1103 
1104 /*
1105 ** Move data out of a btree key or data field and into a Mem structure.
1106 ** The data is payload from the entry that pCur is currently pointing
1107 ** to.  offset and amt determine what portion of the data or key to retrieve.
1108 ** The result is written into the pMem element.
1109 **
1110 ** The pMem object must have been initialized.  This routine will use
1111 ** pMem->zMalloc to hold the content from the btree, if possible.  New
1112 ** pMem->zMalloc space will be allocated if necessary.  The calling routine
1113 ** is responsible for making sure that the pMem object is eventually
1114 ** destroyed.
1115 **
1116 ** If this routine fails for any reason (malloc returns NULL or unable
1117 ** to read from the disk) then the pMem is left in an inconsistent state.
1118 */
1119 static SQLITE_NOINLINE int vdbeMemFromBtreeResize(
1120   BtCursor *pCur,   /* Cursor pointing at record to retrieve. */
1121   u32 offset,       /* Offset from the start of data to return bytes from. */
1122   u32 amt,          /* Number of bytes to return. */
1123   Mem *pMem         /* OUT: Return data in this Mem structure. */
1124 ){
1125   int rc;
1126   pMem->flags = MEM_Null;
1127   if( SQLITE_OK==(rc = sqlite3VdbeMemClearAndResize(pMem, amt+1)) ){
1128     rc = sqlite3BtreePayload(pCur, offset, amt, pMem->z);
1129     if( rc==SQLITE_OK ){
1130       pMem->z[amt] = 0;   /* Overrun area used when reading malformed records */
1131       pMem->flags = MEM_Blob;
1132       pMem->n = (int)amt;
1133     }else{
1134       sqlite3VdbeMemRelease(pMem);
1135     }
1136   }
1137   return rc;
1138 }
1139 int sqlite3VdbeMemFromBtree(
1140   BtCursor *pCur,   /* Cursor pointing at record to retrieve. */
1141   u32 offset,       /* Offset from the start of data to return bytes from. */
1142   u32 amt,          /* Number of bytes to return. */
1143   Mem *pMem         /* OUT: Return data in this Mem structure. */
1144 ){
1145   char *zData;        /* Data from the btree layer */
1146   u32 available = 0;  /* Number of bytes available on the local btree page */
1147   int rc = SQLITE_OK; /* Return code */
1148 
1149   assert( sqlite3BtreeCursorIsValid(pCur) );
1150   assert( !VdbeMemDynamic(pMem) );
1151 
1152   /* Note: the calls to BtreeKeyFetch() and DataFetch() below assert()
1153   ** that both the BtShared and database handle mutexes are held. */
1154   assert( !sqlite3VdbeMemIsRowSet(pMem) );
1155   zData = (char *)sqlite3BtreePayloadFetch(pCur, &available);
1156   assert( zData!=0 );
1157 
1158   if( offset+amt<=available ){
1159     pMem->z = &zData[offset];
1160     pMem->flags = MEM_Blob|MEM_Ephem;
1161     pMem->n = (int)amt;
1162   }else{
1163     rc = vdbeMemFromBtreeResize(pCur, offset, amt, pMem);
1164   }
1165 
1166   return rc;
1167 }
1168 
1169 /*
1170 ** The pVal argument is known to be a value other than NULL.
1171 ** Convert it into a string with encoding enc and return a pointer
1172 ** to a zero-terminated version of that string.
1173 */
1174 static SQLITE_NOINLINE const void *valueToText(sqlite3_value* pVal, u8 enc){
1175   assert( pVal!=0 );
1176   assert( pVal->db==0 || sqlite3_mutex_held(pVal->db->mutex) );
1177   assert( (enc&3)==(enc&~SQLITE_UTF16_ALIGNED) );
1178   assert( !sqlite3VdbeMemIsRowSet(pVal) );
1179   assert( (pVal->flags & (MEM_Null))==0 );
1180   if( pVal->flags & (MEM_Blob|MEM_Str) ){
1181     if( ExpandBlob(pVal) ) return 0;
1182     pVal->flags |= MEM_Str;
1183     if( pVal->enc != (enc & ~SQLITE_UTF16_ALIGNED) ){
1184       sqlite3VdbeChangeEncoding(pVal, enc & ~SQLITE_UTF16_ALIGNED);
1185     }
1186     if( (enc & SQLITE_UTF16_ALIGNED)!=0 && 1==(1&SQLITE_PTR_TO_INT(pVal->z)) ){
1187       assert( (pVal->flags & (MEM_Ephem|MEM_Static))!=0 );
1188       if( sqlite3VdbeMemMakeWriteable(pVal)!=SQLITE_OK ){
1189         return 0;
1190       }
1191     }
1192     sqlite3VdbeMemNulTerminate(pVal); /* IMP: R-31275-44060 */
1193   }else{
1194     sqlite3VdbeMemStringify(pVal, enc, 0);
1195     assert( 0==(1&SQLITE_PTR_TO_INT(pVal->z)) );
1196   }
1197   assert(pVal->enc==(enc & ~SQLITE_UTF16_ALIGNED) || pVal->db==0
1198               || pVal->db->mallocFailed );
1199   if( pVal->enc==(enc & ~SQLITE_UTF16_ALIGNED) ){
1200     assert( sqlite3VdbeMemConsistentDualRep(pVal) );
1201     return pVal->z;
1202   }else{
1203     return 0;
1204   }
1205 }
1206 
1207 /* This function is only available internally, it is not part of the
1208 ** external API. It works in a similar way to sqlite3_value_text(),
1209 ** except the data returned is in the encoding specified by the second
1210 ** parameter, which must be one of SQLITE_UTF16BE, SQLITE_UTF16LE or
1211 ** SQLITE_UTF8.
1212 **
1213 ** (2006-02-16:)  The enc value can be or-ed with SQLITE_UTF16_ALIGNED.
1214 ** If that is the case, then the result must be aligned on an even byte
1215 ** boundary.
1216 */
1217 const void *sqlite3ValueText(sqlite3_value* pVal, u8 enc){
1218   if( !pVal ) return 0;
1219   assert( pVal->db==0 || sqlite3_mutex_held(pVal->db->mutex) );
1220   assert( (enc&3)==(enc&~SQLITE_UTF16_ALIGNED) );
1221   assert( !sqlite3VdbeMemIsRowSet(pVal) );
1222   if( (pVal->flags&(MEM_Str|MEM_Term))==(MEM_Str|MEM_Term) && pVal->enc==enc ){
1223     assert( sqlite3VdbeMemConsistentDualRep(pVal) );
1224     return pVal->z;
1225   }
1226   if( pVal->flags&MEM_Null ){
1227     return 0;
1228   }
1229   return valueToText(pVal, enc);
1230 }
1231 
1232 /*
1233 ** Create a new sqlite3_value object.
1234 */
1235 sqlite3_value *sqlite3ValueNew(sqlite3 *db){
1236   Mem *p = sqlite3DbMallocZero(db, sizeof(*p));
1237   if( p ){
1238     p->flags = MEM_Null;
1239     p->db = db;
1240   }
1241   return p;
1242 }
1243 
1244 /*
1245 ** Context object passed by sqlite3Stat4ProbeSetValue() through to
1246 ** valueNew(). See comments above valueNew() for details.
1247 */
1248 struct ValueNewStat4Ctx {
1249   Parse *pParse;
1250   Index *pIdx;
1251   UnpackedRecord **ppRec;
1252   int iVal;
1253 };
1254 
1255 /*
1256 ** Allocate and return a pointer to a new sqlite3_value object. If
1257 ** the second argument to this function is NULL, the object is allocated
1258 ** by calling sqlite3ValueNew().
1259 **
1260 ** Otherwise, if the second argument is non-zero, then this function is
1261 ** being called indirectly by sqlite3Stat4ProbeSetValue(). If it has not
1262 ** already been allocated, allocate the UnpackedRecord structure that
1263 ** that function will return to its caller here. Then return a pointer to
1264 ** an sqlite3_value within the UnpackedRecord.a[] array.
1265 */
1266 static sqlite3_value *valueNew(sqlite3 *db, struct ValueNewStat4Ctx *p){
1267 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1268   if( p ){
1269     UnpackedRecord *pRec = p->ppRec[0];
1270 
1271     if( pRec==0 ){
1272       Index *pIdx = p->pIdx;      /* Index being probed */
1273       int nByte;                  /* Bytes of space to allocate */
1274       int i;                      /* Counter variable */
1275       int nCol = pIdx->nColumn;   /* Number of index columns including rowid */
1276 
1277       nByte = sizeof(Mem) * nCol + ROUND8(sizeof(UnpackedRecord));
1278       pRec = (UnpackedRecord*)sqlite3DbMallocZero(db, nByte);
1279       if( pRec ){
1280         pRec->pKeyInfo = sqlite3KeyInfoOfIndex(p->pParse, pIdx);
1281         if( pRec->pKeyInfo ){
1282           assert( pRec->pKeyInfo->nAllField==nCol );
1283           assert( pRec->pKeyInfo->enc==ENC(db) );
1284           pRec->aMem = (Mem *)((u8*)pRec + ROUND8(sizeof(UnpackedRecord)));
1285           for(i=0; i<nCol; i++){
1286             pRec->aMem[i].flags = MEM_Null;
1287             pRec->aMem[i].db = db;
1288           }
1289         }else{
1290           sqlite3DbFreeNN(db, pRec);
1291           pRec = 0;
1292         }
1293       }
1294       if( pRec==0 ) return 0;
1295       p->ppRec[0] = pRec;
1296     }
1297 
1298     pRec->nField = p->iVal+1;
1299     return &pRec->aMem[p->iVal];
1300   }
1301 #else
1302   UNUSED_PARAMETER(p);
1303 #endif /* defined(SQLITE_ENABLE_STAT3_OR_STAT4) */
1304   return sqlite3ValueNew(db);
1305 }
1306 
1307 /*
1308 ** The expression object indicated by the second argument is guaranteed
1309 ** to be a scalar SQL function. If
1310 **
1311 **   * all function arguments are SQL literals,
1312 **   * one of the SQLITE_FUNC_CONSTANT or _SLOCHNG function flags is set, and
1313 **   * the SQLITE_FUNC_NEEDCOLL function flag is not set,
1314 **
1315 ** then this routine attempts to invoke the SQL function. Assuming no
1316 ** error occurs, output parameter (*ppVal) is set to point to a value
1317 ** object containing the result before returning SQLITE_OK.
1318 **
1319 ** Affinity aff is applied to the result of the function before returning.
1320 ** If the result is a text value, the sqlite3_value object uses encoding
1321 ** enc.
1322 **
1323 ** If the conditions above are not met, this function returns SQLITE_OK
1324 ** and sets (*ppVal) to NULL. Or, if an error occurs, (*ppVal) is set to
1325 ** NULL and an SQLite error code returned.
1326 */
1327 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1328 static int valueFromFunction(
1329   sqlite3 *db,                    /* The database connection */
1330   Expr *p,                        /* The expression to evaluate */
1331   u8 enc,                         /* Encoding to use */
1332   u8 aff,                         /* Affinity to use */
1333   sqlite3_value **ppVal,          /* Write the new value here */
1334   struct ValueNewStat4Ctx *pCtx   /* Second argument for valueNew() */
1335 ){
1336   sqlite3_context ctx;            /* Context object for function invocation */
1337   sqlite3_value **apVal = 0;      /* Function arguments */
1338   int nVal = 0;                   /* Size of apVal[] array */
1339   FuncDef *pFunc = 0;             /* Function definition */
1340   sqlite3_value *pVal = 0;        /* New value */
1341   int rc = SQLITE_OK;             /* Return code */
1342   ExprList *pList = 0;            /* Function arguments */
1343   int i;                          /* Iterator variable */
1344 
1345   assert( pCtx!=0 );
1346   assert( (p->flags & EP_TokenOnly)==0 );
1347   pList = p->x.pList;
1348   if( pList ) nVal = pList->nExpr;
1349   pFunc = sqlite3FindFunction(db, p->u.zToken, nVal, enc, 0);
1350   assert( pFunc );
1351   if( (pFunc->funcFlags & (SQLITE_FUNC_CONSTANT|SQLITE_FUNC_SLOCHNG))==0
1352    || (pFunc->funcFlags & SQLITE_FUNC_NEEDCOLL)
1353   ){
1354     return SQLITE_OK;
1355   }
1356 
1357   if( pList ){
1358     apVal = (sqlite3_value**)sqlite3DbMallocZero(db, sizeof(apVal[0]) * nVal);
1359     if( apVal==0 ){
1360       rc = SQLITE_NOMEM_BKPT;
1361       goto value_from_function_out;
1362     }
1363     for(i=0; i<nVal; i++){
1364       rc = sqlite3ValueFromExpr(db, pList->a[i].pExpr, enc, aff, &apVal[i]);
1365       if( apVal[i]==0 || rc!=SQLITE_OK ) goto value_from_function_out;
1366     }
1367   }
1368 
1369   pVal = valueNew(db, pCtx);
1370   if( pVal==0 ){
1371     rc = SQLITE_NOMEM_BKPT;
1372     goto value_from_function_out;
1373   }
1374 
1375   assert( pCtx->pParse->rc==SQLITE_OK );
1376   memset(&ctx, 0, sizeof(ctx));
1377   ctx.pOut = pVal;
1378   ctx.pFunc = pFunc;
1379   pFunc->xSFunc(&ctx, nVal, apVal);
1380   if( ctx.isError ){
1381     rc = ctx.isError;
1382     sqlite3ErrorMsg(pCtx->pParse, "%s", sqlite3_value_text(pVal));
1383   }else{
1384     sqlite3ValueApplyAffinity(pVal, aff, SQLITE_UTF8);
1385     assert( rc==SQLITE_OK );
1386     rc = sqlite3VdbeChangeEncoding(pVal, enc);
1387     if( rc==SQLITE_OK && sqlite3VdbeMemTooBig(pVal) ){
1388       rc = SQLITE_TOOBIG;
1389       pCtx->pParse->nErr++;
1390     }
1391   }
1392   pCtx->pParse->rc = rc;
1393 
1394  value_from_function_out:
1395   if( rc!=SQLITE_OK ){
1396     pVal = 0;
1397   }
1398   if( apVal ){
1399     for(i=0; i<nVal; i++){
1400       sqlite3ValueFree(apVal[i]);
1401     }
1402     sqlite3DbFreeNN(db, apVal);
1403   }
1404 
1405   *ppVal = pVal;
1406   return rc;
1407 }
1408 #else
1409 # define valueFromFunction(a,b,c,d,e,f) SQLITE_OK
1410 #endif /* defined(SQLITE_ENABLE_STAT3_OR_STAT4) */
1411 
1412 /*
1413 ** Extract a value from the supplied expression in the manner described
1414 ** above sqlite3ValueFromExpr(). Allocate the sqlite3_value object
1415 ** using valueNew().
1416 **
1417 ** If pCtx is NULL and an error occurs after the sqlite3_value object
1418 ** has been allocated, it is freed before returning. Or, if pCtx is not
1419 ** NULL, it is assumed that the caller will free any allocated object
1420 ** in all cases.
1421 */
1422 static int valueFromExpr(
1423   sqlite3 *db,                    /* The database connection */
1424   Expr *pExpr,                    /* The expression to evaluate */
1425   u8 enc,                         /* Encoding to use */
1426   u8 affinity,                    /* Affinity to use */
1427   sqlite3_value **ppVal,          /* Write the new value here */
1428   struct ValueNewStat4Ctx *pCtx   /* Second argument for valueNew() */
1429 ){
1430   int op;
1431   char *zVal = 0;
1432   sqlite3_value *pVal = 0;
1433   int negInt = 1;
1434   const char *zNeg = "";
1435   int rc = SQLITE_OK;
1436 
1437   assert( pExpr!=0 );
1438   while( (op = pExpr->op)==TK_UPLUS || op==TK_SPAN ) pExpr = pExpr->pLeft;
1439 #if defined(SQLITE_ENABLE_STAT3_OR_STAT4)
1440   if( op==TK_REGISTER ) op = pExpr->op2;
1441 #else
1442   if( NEVER(op==TK_REGISTER) ) op = pExpr->op2;
1443 #endif
1444 
1445   /* Compressed expressions only appear when parsing the DEFAULT clause
1446   ** on a table column definition, and hence only when pCtx==0.  This
1447   ** check ensures that an EP_TokenOnly expression is never passed down
1448   ** into valueFromFunction(). */
1449   assert( (pExpr->flags & EP_TokenOnly)==0 || pCtx==0 );
1450 
1451   if( op==TK_CAST ){
1452     u8 aff = sqlite3AffinityType(pExpr->u.zToken,0);
1453     rc = valueFromExpr(db, pExpr->pLeft, enc, aff, ppVal, pCtx);
1454     testcase( rc!=SQLITE_OK );
1455     if( *ppVal ){
1456       sqlite3VdbeMemCast(*ppVal, aff, SQLITE_UTF8);
1457       sqlite3ValueApplyAffinity(*ppVal, affinity, SQLITE_UTF8);
1458     }
1459     return rc;
1460   }
1461 
1462   /* Handle negative integers in a single step.  This is needed in the
1463   ** case when the value is -9223372036854775808.
1464   */
1465   if( op==TK_UMINUS
1466    && (pExpr->pLeft->op==TK_INTEGER || pExpr->pLeft->op==TK_FLOAT) ){
1467     pExpr = pExpr->pLeft;
1468     op = pExpr->op;
1469     negInt = -1;
1470     zNeg = "-";
1471   }
1472 
1473   if( op==TK_STRING || op==TK_FLOAT || op==TK_INTEGER ){
1474     pVal = valueNew(db, pCtx);
1475     if( pVal==0 ) goto no_mem;
1476     if( ExprHasProperty(pExpr, EP_IntValue) ){
1477       sqlite3VdbeMemSetInt64(pVal, (i64)pExpr->u.iValue*negInt);
1478     }else{
1479       zVal = sqlite3MPrintf(db, "%s%s", zNeg, pExpr->u.zToken);
1480       if( zVal==0 ) goto no_mem;
1481       sqlite3ValueSetStr(pVal, -1, zVal, SQLITE_UTF8, SQLITE_DYNAMIC);
1482     }
1483     if( (op==TK_INTEGER || op==TK_FLOAT ) && affinity==SQLITE_AFF_BLOB ){
1484       sqlite3ValueApplyAffinity(pVal, SQLITE_AFF_NUMERIC, SQLITE_UTF8);
1485     }else{
1486       sqlite3ValueApplyAffinity(pVal, affinity, SQLITE_UTF8);
1487     }
1488     if( pVal->flags & (MEM_Int|MEM_Real) ) pVal->flags &= ~MEM_Str;
1489     if( enc!=SQLITE_UTF8 ){
1490       rc = sqlite3VdbeChangeEncoding(pVal, enc);
1491     }
1492   }else if( op==TK_UMINUS ) {
1493     /* This branch happens for multiple negative signs.  Ex: -(-5) */
1494     if( SQLITE_OK==valueFromExpr(db,pExpr->pLeft,enc,affinity,&pVal,pCtx)
1495      && pVal!=0
1496     ){
1497       sqlite3VdbeMemNumerify(pVal);
1498       if( pVal->flags & MEM_Real ){
1499         pVal->u.r = -pVal->u.r;
1500       }else if( pVal->u.i==SMALLEST_INT64 ){
1501         pVal->u.r = -(double)SMALLEST_INT64;
1502         MemSetTypeFlag(pVal, MEM_Real);
1503       }else{
1504         pVal->u.i = -pVal->u.i;
1505       }
1506       sqlite3ValueApplyAffinity(pVal, affinity, enc);
1507     }
1508   }else if( op==TK_NULL ){
1509     pVal = valueNew(db, pCtx);
1510     if( pVal==0 ) goto no_mem;
1511     sqlite3VdbeMemNumerify(pVal);
1512   }
1513 #ifndef SQLITE_OMIT_BLOB_LITERAL
1514   else if( op==TK_BLOB ){
1515     int nVal;
1516     assert( pExpr->u.zToken[0]=='x' || pExpr->u.zToken[0]=='X' );
1517     assert( pExpr->u.zToken[1]=='\'' );
1518     pVal = valueNew(db, pCtx);
1519     if( !pVal ) goto no_mem;
1520     zVal = &pExpr->u.zToken[2];
1521     nVal = sqlite3Strlen30(zVal)-1;
1522     assert( zVal[nVal]=='\'' );
1523     sqlite3VdbeMemSetStr(pVal, sqlite3HexToBlob(db, zVal, nVal), nVal/2,
1524                          0, SQLITE_DYNAMIC);
1525   }
1526 #endif
1527 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1528   else if( op==TK_FUNCTION && pCtx!=0 ){
1529     rc = valueFromFunction(db, pExpr, enc, affinity, &pVal, pCtx);
1530   }
1531 #endif
1532   else if( op==TK_TRUEFALSE ){
1533      pVal = valueNew(db, pCtx);
1534      pVal->flags = MEM_Int;
1535      pVal->u.i = pExpr->u.zToken[4]==0;
1536   }
1537 
1538   *ppVal = pVal;
1539   return rc;
1540 
1541 no_mem:
1542 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1543   if( pCtx==0 || pCtx->pParse->nErr==0 )
1544 #endif
1545     sqlite3OomFault(db);
1546   sqlite3DbFree(db, zVal);
1547   assert( *ppVal==0 );
1548 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1549   if( pCtx==0 ) sqlite3ValueFree(pVal);
1550 #else
1551   assert( pCtx==0 ); sqlite3ValueFree(pVal);
1552 #endif
1553   return SQLITE_NOMEM_BKPT;
1554 }
1555 
1556 /*
1557 ** Create a new sqlite3_value object, containing the value of pExpr.
1558 **
1559 ** This only works for very simple expressions that consist of one constant
1560 ** token (i.e. "5", "5.1", "'a string'"). If the expression can
1561 ** be converted directly into a value, then the value is allocated and
1562 ** a pointer written to *ppVal. The caller is responsible for deallocating
1563 ** the value by passing it to sqlite3ValueFree() later on. If the expression
1564 ** cannot be converted to a value, then *ppVal is set to NULL.
1565 */
1566 int sqlite3ValueFromExpr(
1567   sqlite3 *db,              /* The database connection */
1568   Expr *pExpr,              /* The expression to evaluate */
1569   u8 enc,                   /* Encoding to use */
1570   u8 affinity,              /* Affinity to use */
1571   sqlite3_value **ppVal     /* Write the new value here */
1572 ){
1573   return pExpr ? valueFromExpr(db, pExpr, enc, affinity, ppVal, 0) : 0;
1574 }
1575 
1576 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1577 /*
1578 ** The implementation of the sqlite_record() function. This function accepts
1579 ** a single argument of any type. The return value is a formatted database
1580 ** record (a blob) containing the argument value.
1581 **
1582 ** This is used to convert the value stored in the 'sample' column of the
1583 ** sqlite_stat3 table to the record format SQLite uses internally.
1584 */
1585 static void recordFunc(
1586   sqlite3_context *context,
1587   int argc,
1588   sqlite3_value **argv
1589 ){
1590   const int file_format = 1;
1591   u32 iSerial;                    /* Serial type */
1592   int nSerial;                    /* Bytes of space for iSerial as varint */
1593   u32 nVal;                       /* Bytes of space required for argv[0] */
1594   int nRet;
1595   sqlite3 *db;
1596   u8 *aRet;
1597 
1598   UNUSED_PARAMETER( argc );
1599   iSerial = sqlite3VdbeSerialType(argv[0], file_format, &nVal);
1600   nSerial = sqlite3VarintLen(iSerial);
1601   db = sqlite3_context_db_handle(context);
1602 
1603   nRet = 1 + nSerial + nVal;
1604   aRet = sqlite3DbMallocRawNN(db, nRet);
1605   if( aRet==0 ){
1606     sqlite3_result_error_nomem(context);
1607   }else{
1608     aRet[0] = nSerial+1;
1609     putVarint32(&aRet[1], iSerial);
1610     sqlite3VdbeSerialPut(&aRet[1+nSerial], argv[0], iSerial);
1611     sqlite3_result_blob(context, aRet, nRet, SQLITE_TRANSIENT);
1612     sqlite3DbFreeNN(db, aRet);
1613   }
1614 }
1615 
1616 /*
1617 ** Register built-in functions used to help read ANALYZE data.
1618 */
1619 void sqlite3AnalyzeFunctions(void){
1620   static FuncDef aAnalyzeTableFuncs[] = {
1621     FUNCTION(sqlite_record,   1, 0, 0, recordFunc),
1622   };
1623   sqlite3InsertBuiltinFuncs(aAnalyzeTableFuncs, ArraySize(aAnalyzeTableFuncs));
1624 }
1625 
1626 /*
1627 ** Attempt to extract a value from pExpr and use it to construct *ppVal.
1628 **
1629 ** If pAlloc is not NULL, then an UnpackedRecord object is created for
1630 ** pAlloc if one does not exist and the new value is added to the
1631 ** UnpackedRecord object.
1632 **
1633 ** A value is extracted in the following cases:
1634 **
1635 **  * (pExpr==0). In this case the value is assumed to be an SQL NULL,
1636 **
1637 **  * The expression is a bound variable, and this is a reprepare, or
1638 **
1639 **  * The expression is a literal value.
1640 **
1641 ** On success, *ppVal is made to point to the extracted value.  The caller
1642 ** is responsible for ensuring that the value is eventually freed.
1643 */
1644 static int stat4ValueFromExpr(
1645   Parse *pParse,                  /* Parse context */
1646   Expr *pExpr,                    /* The expression to extract a value from */
1647   u8 affinity,                    /* Affinity to use */
1648   struct ValueNewStat4Ctx *pAlloc,/* How to allocate space.  Or NULL */
1649   sqlite3_value **ppVal           /* OUT: New value object (or NULL) */
1650 ){
1651   int rc = SQLITE_OK;
1652   sqlite3_value *pVal = 0;
1653   sqlite3 *db = pParse->db;
1654 
1655   /* Skip over any TK_COLLATE nodes */
1656   pExpr = sqlite3ExprSkipCollate(pExpr);
1657 
1658   assert( pExpr==0 || pExpr->op!=TK_REGISTER || pExpr->op2!=TK_VARIABLE );
1659   if( !pExpr ){
1660     pVal = valueNew(db, pAlloc);
1661     if( pVal ){
1662       sqlite3VdbeMemSetNull((Mem*)pVal);
1663     }
1664   }else if( pExpr->op==TK_VARIABLE && (db->flags & SQLITE_EnableQPSG)==0 ){
1665     Vdbe *v;
1666     int iBindVar = pExpr->iColumn;
1667     sqlite3VdbeSetVarmask(pParse->pVdbe, iBindVar);
1668     if( (v = pParse->pReprepare)!=0 ){
1669       pVal = valueNew(db, pAlloc);
1670       if( pVal ){
1671         rc = sqlite3VdbeMemCopy((Mem*)pVal, &v->aVar[iBindVar-1]);
1672         sqlite3ValueApplyAffinity(pVal, affinity, ENC(db));
1673         pVal->db = pParse->db;
1674       }
1675     }
1676   }else{
1677     rc = valueFromExpr(db, pExpr, ENC(db), affinity, &pVal, pAlloc);
1678   }
1679 
1680   assert( pVal==0 || pVal->db==db );
1681   *ppVal = pVal;
1682   return rc;
1683 }
1684 
1685 /*
1686 ** This function is used to allocate and populate UnpackedRecord
1687 ** structures intended to be compared against sample index keys stored
1688 ** in the sqlite_stat4 table.
1689 **
1690 ** A single call to this function populates zero or more fields of the
1691 ** record starting with field iVal (fields are numbered from left to
1692 ** right starting with 0). A single field is populated if:
1693 **
1694 **  * (pExpr==0). In this case the value is assumed to be an SQL NULL,
1695 **
1696 **  * The expression is a bound variable, and this is a reprepare, or
1697 **
1698 **  * The sqlite3ValueFromExpr() function is able to extract a value
1699 **    from the expression (i.e. the expression is a literal value).
1700 **
1701 ** Or, if pExpr is a TK_VECTOR, one field is populated for each of the
1702 ** vector components that match either of the two latter criteria listed
1703 ** above.
1704 **
1705 ** Before any value is appended to the record, the affinity of the
1706 ** corresponding column within index pIdx is applied to it. Before
1707 ** this function returns, output parameter *pnExtract is set to the
1708 ** number of values appended to the record.
1709 **
1710 ** When this function is called, *ppRec must either point to an object
1711 ** allocated by an earlier call to this function, or must be NULL. If it
1712 ** is NULL and a value can be successfully extracted, a new UnpackedRecord
1713 ** is allocated (and *ppRec set to point to it) before returning.
1714 **
1715 ** Unless an error is encountered, SQLITE_OK is returned. It is not an
1716 ** error if a value cannot be extracted from pExpr. If an error does
1717 ** occur, an SQLite error code is returned.
1718 */
1719 int sqlite3Stat4ProbeSetValue(
1720   Parse *pParse,                  /* Parse context */
1721   Index *pIdx,                    /* Index being probed */
1722   UnpackedRecord **ppRec,         /* IN/OUT: Probe record */
1723   Expr *pExpr,                    /* The expression to extract a value from */
1724   int nElem,                      /* Maximum number of values to append */
1725   int iVal,                       /* Array element to populate */
1726   int *pnExtract                  /* OUT: Values appended to the record */
1727 ){
1728   int rc = SQLITE_OK;
1729   int nExtract = 0;
1730 
1731   if( pExpr==0 || pExpr->op!=TK_SELECT ){
1732     int i;
1733     struct ValueNewStat4Ctx alloc;
1734 
1735     alloc.pParse = pParse;
1736     alloc.pIdx = pIdx;
1737     alloc.ppRec = ppRec;
1738 
1739     for(i=0; i<nElem; i++){
1740       sqlite3_value *pVal = 0;
1741       Expr *pElem = (pExpr ? sqlite3VectorFieldSubexpr(pExpr, i) : 0);
1742       u8 aff = sqlite3IndexColumnAffinity(pParse->db, pIdx, iVal+i);
1743       alloc.iVal = iVal+i;
1744       rc = stat4ValueFromExpr(pParse, pElem, aff, &alloc, &pVal);
1745       if( !pVal ) break;
1746       nExtract++;
1747     }
1748   }
1749 
1750   *pnExtract = nExtract;
1751   return rc;
1752 }
1753 
1754 /*
1755 ** Attempt to extract a value from expression pExpr using the methods
1756 ** as described for sqlite3Stat4ProbeSetValue() above.
1757 **
1758 ** If successful, set *ppVal to point to a new value object and return
1759 ** SQLITE_OK. If no value can be extracted, but no other error occurs
1760 ** (e.g. OOM), return SQLITE_OK and set *ppVal to NULL. Or, if an error
1761 ** does occur, return an SQLite error code. The final value of *ppVal
1762 ** is undefined in this case.
1763 */
1764 int sqlite3Stat4ValueFromExpr(
1765   Parse *pParse,                  /* Parse context */
1766   Expr *pExpr,                    /* The expression to extract a value from */
1767   u8 affinity,                    /* Affinity to use */
1768   sqlite3_value **ppVal           /* OUT: New value object (or NULL) */
1769 ){
1770   return stat4ValueFromExpr(pParse, pExpr, affinity, 0, ppVal);
1771 }
1772 
1773 /*
1774 ** Extract the iCol-th column from the nRec-byte record in pRec.  Write
1775 ** the column value into *ppVal.  If *ppVal is initially NULL then a new
1776 ** sqlite3_value object is allocated.
1777 **
1778 ** If *ppVal is initially NULL then the caller is responsible for
1779 ** ensuring that the value written into *ppVal is eventually freed.
1780 */
1781 int sqlite3Stat4Column(
1782   sqlite3 *db,                    /* Database handle */
1783   const void *pRec,               /* Pointer to buffer containing record */
1784   int nRec,                       /* Size of buffer pRec in bytes */
1785   int iCol,                       /* Column to extract */
1786   sqlite3_value **ppVal           /* OUT: Extracted value */
1787 ){
1788   u32 t = 0;                      /* a column type code */
1789   int nHdr;                       /* Size of the header in the record */
1790   int iHdr;                       /* Next unread header byte */
1791   int iField;                     /* Next unread data byte */
1792   int szField = 0;                /* Size of the current data field */
1793   int i;                          /* Column index */
1794   u8 *a = (u8*)pRec;              /* Typecast byte array */
1795   Mem *pMem = *ppVal;             /* Write result into this Mem object */
1796 
1797   assert( iCol>0 );
1798   iHdr = getVarint32(a, nHdr);
1799   if( nHdr>nRec || iHdr>=nHdr ) return SQLITE_CORRUPT_BKPT;
1800   iField = nHdr;
1801   for(i=0; i<=iCol; i++){
1802     iHdr += getVarint32(&a[iHdr], t);
1803     testcase( iHdr==nHdr );
1804     testcase( iHdr==nHdr+1 );
1805     if( iHdr>nHdr ) return SQLITE_CORRUPT_BKPT;
1806     szField = sqlite3VdbeSerialTypeLen(t);
1807     iField += szField;
1808   }
1809   testcase( iField==nRec );
1810   testcase( iField==nRec+1 );
1811   if( iField>nRec ) return SQLITE_CORRUPT_BKPT;
1812   if( pMem==0 ){
1813     pMem = *ppVal = sqlite3ValueNew(db);
1814     if( pMem==0 ) return SQLITE_NOMEM_BKPT;
1815   }
1816   sqlite3VdbeSerialGet(&a[iField-szField], t, pMem);
1817   pMem->enc = ENC(db);
1818   return SQLITE_OK;
1819 }
1820 
1821 /*
1822 ** Unless it is NULL, the argument must be an UnpackedRecord object returned
1823 ** by an earlier call to sqlite3Stat4ProbeSetValue(). This call deletes
1824 ** the object.
1825 */
1826 void sqlite3Stat4ProbeFree(UnpackedRecord *pRec){
1827   if( pRec ){
1828     int i;
1829     int nCol = pRec->pKeyInfo->nAllField;
1830     Mem *aMem = pRec->aMem;
1831     sqlite3 *db = aMem[0].db;
1832     for(i=0; i<nCol; i++){
1833       sqlite3VdbeMemRelease(&aMem[i]);
1834     }
1835     sqlite3KeyInfoUnref(pRec->pKeyInfo);
1836     sqlite3DbFreeNN(db, pRec);
1837   }
1838 }
1839 #endif /* ifdef SQLITE_ENABLE_STAT4 */
1840 
1841 /*
1842 ** Change the string value of an sqlite3_value object
1843 */
1844 void sqlite3ValueSetStr(
1845   sqlite3_value *v,     /* Value to be set */
1846   int n,                /* Length of string z */
1847   const void *z,        /* Text of the new string */
1848   u8 enc,               /* Encoding to use */
1849   void (*xDel)(void*)   /* Destructor for the string */
1850 ){
1851   if( v ) sqlite3VdbeMemSetStr((Mem *)v, z, n, enc, xDel);
1852 }
1853 
1854 /*
1855 ** Free an sqlite3_value object
1856 */
1857 void sqlite3ValueFree(sqlite3_value *v){
1858   if( !v ) return;
1859   sqlite3VdbeMemRelease((Mem *)v);
1860   sqlite3DbFreeNN(((Mem*)v)->db, v);
1861 }
1862 
1863 /*
1864 ** The sqlite3ValueBytes() routine returns the number of bytes in the
1865 ** sqlite3_value object assuming that it uses the encoding "enc".
1866 ** The valueBytes() routine is a helper function.
1867 */
1868 static SQLITE_NOINLINE int valueBytes(sqlite3_value *pVal, u8 enc){
1869   return valueToText(pVal, enc)!=0 ? pVal->n : 0;
1870 }
1871 int sqlite3ValueBytes(sqlite3_value *pVal, u8 enc){
1872   Mem *p = (Mem*)pVal;
1873   assert( (p->flags & MEM_Null)==0 || (p->flags & (MEM_Str|MEM_Blob))==0 );
1874   if( (p->flags & MEM_Str)!=0 && pVal->enc==enc ){
1875     return p->n;
1876   }
1877   if( (p->flags & MEM_Blob)!=0 ){
1878     if( p->flags & MEM_Zero ){
1879       return p->n + p->u.nZero;
1880     }else{
1881       return p->n;
1882     }
1883   }
1884   if( p->flags & MEM_Null ) return 0;
1885   return valueBytes(pVal, enc);
1886 }
1887