000001  /*
000002  ** 2003 September 6
000003  **
000004  ** The author disclaims copyright to this source code.  In place of
000005  ** a legal notice, here is a blessing:
000006  **
000007  **    May you do good and not evil.
000008  **    May you find forgiveness for yourself and forgive others.
000009  **    May you share freely, never taking more than you give.
000010  **
000011  *************************************************************************
000012  ** This file contains code used for creating, destroying, and populating
000013  ** a VDBE (or an "sqlite3_stmt" as it is known to the outside world.)
000014  */
000015  #include "sqliteInt.h"
000016  #include "vdbeInt.h"
000017  
000018  /* Forward references */
000019  static void freeEphemeralFunction(sqlite3 *db, FuncDef *pDef);
000020  static void vdbeFreeOpArray(sqlite3 *, Op *, int);
000021  
000022  /*
000023  ** Create a new virtual database engine.
000024  */
000025  Vdbe *sqlite3VdbeCreate(Parse *pParse){
000026    sqlite3 *db = pParse->db;
000027    Vdbe *p;
000028    p = sqlite3DbMallocRawNN(db, sizeof(Vdbe) );
000029    if( p==0 ) return 0;
000030    memset(&p->aOp, 0, sizeof(Vdbe)-offsetof(Vdbe,aOp));
000031    p->db = db;
000032    if( db->pVdbe ){
000033      db->pVdbe->ppVPrev = &p->pVNext;
000034    }
000035    p->pVNext = db->pVdbe;
000036    p->ppVPrev = &db->pVdbe;
000037    db->pVdbe = p;
000038    assert( p->eVdbeState==VDBE_INIT_STATE );
000039    p->pParse = pParse;
000040    pParse->pVdbe = p;
000041    assert( pParse->aLabel==0 );
000042    assert( pParse->nLabel==0 );
000043    assert( p->nOpAlloc==0 );
000044    assert( pParse->szOpAlloc==0 );
000045    sqlite3VdbeAddOp2(p, OP_Init, 0, 1);
000046    return p;
000047  }
000048  
000049  /*
000050  ** Return the Parse object that owns a Vdbe object.
000051  */
000052  Parse *sqlite3VdbeParser(Vdbe *p){
000053    return p->pParse;
000054  }
000055  
000056  /*
000057  ** Change the error string stored in Vdbe.zErrMsg
000058  */
000059  void sqlite3VdbeError(Vdbe *p, const char *zFormat, ...){
000060    va_list ap;
000061    sqlite3DbFree(p->db, p->zErrMsg);
000062    va_start(ap, zFormat);
000063    p->zErrMsg = sqlite3VMPrintf(p->db, zFormat, ap);
000064    va_end(ap);
000065  }
000066  
000067  /*
000068  ** Remember the SQL string for a prepared statement.
000069  */
000070  void sqlite3VdbeSetSql(Vdbe *p, const char *z, int n, u8 prepFlags){
000071    if( p==0 ) return;
000072    p->prepFlags = prepFlags;
000073    if( (prepFlags & SQLITE_PREPARE_SAVESQL)==0 ){
000074      p->expmask = 0;
000075    }
000076    assert( p->zSql==0 );
000077    p->zSql = sqlite3DbStrNDup(p->db, z, n);
000078  }
000079  
000080  #ifdef SQLITE_ENABLE_NORMALIZE
000081  /*
000082  ** Add a new element to the Vdbe->pDblStr list.
000083  */
000084  void sqlite3VdbeAddDblquoteStr(sqlite3 *db, Vdbe *p, const char *z){
000085    if( p ){
000086      int n = sqlite3Strlen30(z);
000087      DblquoteStr *pStr = sqlite3DbMallocRawNN(db,
000088                              sizeof(*pStr)+n+1-sizeof(pStr->z));
000089      if( pStr ){
000090        pStr->pNextStr = p->pDblStr;
000091        p->pDblStr = pStr;
000092        memcpy(pStr->z, z, n+1);
000093      }
000094    }
000095  }
000096  #endif
000097  
000098  #ifdef SQLITE_ENABLE_NORMALIZE
000099  /*
000100  ** zId of length nId is a double-quoted identifier.  Check to see if
000101  ** that identifier is really used as a string literal.
000102  */
000103  int sqlite3VdbeUsesDoubleQuotedString(
000104    Vdbe *pVdbe,            /* The prepared statement */
000105    const char *zId         /* The double-quoted identifier, already dequoted */
000106  ){
000107    DblquoteStr *pStr;
000108    assert( zId!=0 );
000109    if( pVdbe->pDblStr==0 ) return 0;
000110    for(pStr=pVdbe->pDblStr; pStr; pStr=pStr->pNextStr){
000111      if( strcmp(zId, pStr->z)==0 ) return 1;
000112    }
000113    return 0;
000114  }
000115  #endif
000116  
000117  /*
000118  ** Swap byte-code between two VDBE structures.
000119  **
000120  ** This happens after pB was previously run and returned
000121  ** SQLITE_SCHEMA.  The statement was then reprepared in pA.
000122  ** This routine transfers the new bytecode in pA over to pB
000123  ** so that pB can be run again.  The old pB byte code is
000124  ** moved back to pA so that it will be cleaned up when pA is
000125  ** finalized.
000126  */
000127  void sqlite3VdbeSwap(Vdbe *pA, Vdbe *pB){
000128    Vdbe tmp, *pTmp, **ppTmp;
000129    char *zTmp;
000130    assert( pA->db==pB->db );
000131    tmp = *pA;
000132    *pA = *pB;
000133    *pB = tmp;
000134    pTmp = pA->pVNext;
000135    pA->pVNext = pB->pVNext;
000136    pB->pVNext = pTmp;
000137    ppTmp = pA->ppVPrev;
000138    pA->ppVPrev = pB->ppVPrev;
000139    pB->ppVPrev = ppTmp;
000140    zTmp = pA->zSql;
000141    pA->zSql = pB->zSql;
000142    pB->zSql = zTmp;
000143  #ifdef SQLITE_ENABLE_NORMALIZE
000144    zTmp = pA->zNormSql;
000145    pA->zNormSql = pB->zNormSql;
000146    pB->zNormSql = zTmp;
000147  #endif
000148    pB->expmask = pA->expmask;
000149    pB->prepFlags = pA->prepFlags;
000150    memcpy(pB->aCounter, pA->aCounter, sizeof(pB->aCounter));
000151    pB->aCounter[SQLITE_STMTSTATUS_REPREPARE]++;
000152  }
000153  
000154  /*
000155  ** Resize the Vdbe.aOp array so that it is at least nOp elements larger
000156  ** than its current size. nOp is guaranteed to be less than or equal
000157  ** to 1024/sizeof(Op).
000158  **
000159  ** If an out-of-memory error occurs while resizing the array, return
000160  ** SQLITE_NOMEM. In this case Vdbe.aOp and Vdbe.nOpAlloc remain
000161  ** unchanged (this is so that any opcodes already allocated can be
000162  ** correctly deallocated along with the rest of the Vdbe).
000163  */
000164  static int growOpArray(Vdbe *v, int nOp){
000165    VdbeOp *pNew;
000166    Parse *p = v->pParse;
000167  
000168    /* The SQLITE_TEST_REALLOC_STRESS compile-time option is designed to force
000169    ** more frequent reallocs and hence provide more opportunities for
000170    ** simulated OOM faults.  SQLITE_TEST_REALLOC_STRESS is generally used
000171    ** during testing only.  With SQLITE_TEST_REALLOC_STRESS grow the op array
000172    ** by the minimum* amount required until the size reaches 512.  Normal
000173    ** operation (without SQLITE_TEST_REALLOC_STRESS) is to double the current
000174    ** size of the op array or add 1KB of space, whichever is smaller. */
000175  #ifdef SQLITE_TEST_REALLOC_STRESS
000176    sqlite3_int64 nNew = (v->nOpAlloc>=512 ? 2*(sqlite3_int64)v->nOpAlloc
000177                          : (sqlite3_int64)v->nOpAlloc+nOp);
000178  #else
000179    sqlite3_int64 nNew = (v->nOpAlloc ? 2*(sqlite3_int64)v->nOpAlloc
000180                          : (sqlite3_int64)(1024/sizeof(Op)));
000181    UNUSED_PARAMETER(nOp);
000182  #endif
000183  
000184    /* Ensure that the size of a VDBE does not grow too large */
000185    if( nNew > p->db->aLimit[SQLITE_LIMIT_VDBE_OP] ){
000186      sqlite3OomFault(p->db);
000187      return SQLITE_NOMEM;
000188    }
000189  
000190    assert( nOp<=(int)(1024/sizeof(Op)) );
000191    assert( nNew>=(v->nOpAlloc+nOp) );
000192    pNew = sqlite3DbRealloc(p->db, v->aOp, nNew*sizeof(Op));
000193    if( pNew ){
000194      p->szOpAlloc = sqlite3DbMallocSize(p->db, pNew);
000195      v->nOpAlloc = p->szOpAlloc/sizeof(Op);
000196      v->aOp = pNew;
000197    }
000198    return (pNew ? SQLITE_OK : SQLITE_NOMEM_BKPT);
000199  }
000200  
000201  #ifdef SQLITE_DEBUG
000202  /* This routine is just a convenient place to set a breakpoint that will
000203  ** fire after each opcode is inserted and displayed using
000204  ** "PRAGMA vdbe_addoptrace=on".  Parameters "pc" (program counter) and
000205  ** pOp are available to make the breakpoint conditional.
000206  **
000207  ** Other useful labels for breakpoints include:
000208  **   test_trace_breakpoint(pc,pOp)
000209  **   sqlite3CorruptError(lineno)
000210  **   sqlite3MisuseError(lineno)
000211  **   sqlite3CantopenError(lineno)
000212  */
000213  static void test_addop_breakpoint(int pc, Op *pOp){
000214    static u64 n = 0;
000215    (void)pc;
000216    (void)pOp;
000217    n++;
000218    if( n==LARGEST_UINT64 ) abort(); /* so that n is used, preventing a warning */
000219  }
000220  #endif
000221  
000222  /*
000223  ** Slow paths for sqlite3VdbeAddOp3() and sqlite3VdbeAddOp4Int() for the
000224  ** unusual case when we need to increase the size of the Vdbe.aOp[] array
000225  ** before adding the new opcode.
000226  */
000227  static SQLITE_NOINLINE int growOp3(Vdbe *p, int op, int p1, int p2, int p3){
000228    assert( p->nOpAlloc<=p->nOp );
000229    if( growOpArray(p, 1) ) return 1;
000230    assert( p->nOpAlloc>p->nOp );
000231    return sqlite3VdbeAddOp3(p, op, p1, p2, p3);
000232  }
000233  static SQLITE_NOINLINE int addOp4IntSlow(
000234    Vdbe *p,            /* Add the opcode to this VM */
000235    int op,             /* The new opcode */
000236    int p1,             /* The P1 operand */
000237    int p2,             /* The P2 operand */
000238    int p3,             /* The P3 operand */
000239    int p4              /* The P4 operand as an integer */
000240  ){
000241    int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
000242    if( p->db->mallocFailed==0 ){
000243      VdbeOp *pOp = &p->aOp[addr];
000244      pOp->p4type = P4_INT32;
000245      pOp->p4.i = p4;
000246    }
000247    return addr;
000248  }
000249  
000250  
000251  /*
000252  ** Add a new instruction to the list of instructions current in the
000253  ** VDBE.  Return the address of the new instruction.
000254  **
000255  ** Parameters:
000256  **
000257  **    p               Pointer to the VDBE
000258  **
000259  **    op              The opcode for this instruction
000260  **
000261  **    p1, p2, p3, p4  Operands
000262  */
000263  int sqlite3VdbeAddOp0(Vdbe *p, int op){
000264    return sqlite3VdbeAddOp3(p, op, 0, 0, 0);
000265  }
000266  int sqlite3VdbeAddOp1(Vdbe *p, int op, int p1){
000267    return sqlite3VdbeAddOp3(p, op, p1, 0, 0);
000268  }
000269  int sqlite3VdbeAddOp2(Vdbe *p, int op, int p1, int p2){
000270    return sqlite3VdbeAddOp3(p, op, p1, p2, 0);
000271  }
000272  int sqlite3VdbeAddOp3(Vdbe *p, int op, int p1, int p2, int p3){
000273    int i;
000274    VdbeOp *pOp;
000275  
000276    i = p->nOp;
000277    assert( p->eVdbeState==VDBE_INIT_STATE );
000278    assert( op>=0 && op<0xff );
000279    if( p->nOpAlloc<=i ){
000280      return growOp3(p, op, p1, p2, p3);
000281    }
000282    assert( p->aOp!=0 );
000283    p->nOp++;
000284    pOp = &p->aOp[i];
000285    assert( pOp!=0 );
000286    pOp->opcode = (u8)op;
000287    pOp->p5 = 0;
000288    pOp->p1 = p1;
000289    pOp->p2 = p2;
000290    pOp->p3 = p3;
000291    pOp->p4.p = 0;
000292    pOp->p4type = P4_NOTUSED;
000293  
000294    /* Replicate this logic in sqlite3VdbeAddOp4Int()
000295    ** vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv   */
000296  #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
000297    pOp->zComment = 0;
000298  #endif
000299  #if defined(SQLITE_ENABLE_STMT_SCANSTATUS) || defined(VDBE_PROFILE)
000300    pOp->nExec = 0;
000301    pOp->nCycle = 0;
000302  #endif
000303  #ifdef SQLITE_DEBUG
000304    if( p->db->flags & SQLITE_VdbeAddopTrace ){
000305      sqlite3VdbePrintOp(0, i, &p->aOp[i]);
000306      test_addop_breakpoint(i, &p->aOp[i]);
000307    }
000308  #endif
000309  #ifdef SQLITE_VDBE_COVERAGE
000310    pOp->iSrcLine = 0;
000311  #endif
000312    /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
000313    ** Replicate in sqlite3VdbeAddOp4Int() */
000314  
000315    return i;
000316  }
000317  int sqlite3VdbeAddOp4Int(
000318    Vdbe *p,            /* Add the opcode to this VM */
000319    int op,             /* The new opcode */
000320    int p1,             /* The P1 operand */
000321    int p2,             /* The P2 operand */
000322    int p3,             /* The P3 operand */
000323    int p4              /* The P4 operand as an integer */
000324  ){
000325    int i;
000326    VdbeOp *pOp;
000327  
000328    i = p->nOp;
000329    if( p->nOpAlloc<=i ){
000330      return addOp4IntSlow(p, op, p1, p2, p3, p4);
000331    }
000332    p->nOp++;
000333    pOp = &p->aOp[i];
000334    assert( pOp!=0 );
000335    pOp->opcode = (u8)op;
000336    pOp->p5 = 0;
000337    pOp->p1 = p1;
000338    pOp->p2 = p2;
000339    pOp->p3 = p3;
000340    pOp->p4.i = p4;
000341    pOp->p4type = P4_INT32;
000342  
000343    /* Replicate this logic in sqlite3VdbeAddOp3()
000344    ** vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv   */
000345  #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
000346    pOp->zComment = 0;
000347  #endif
000348  #if defined(SQLITE_ENABLE_STMT_SCANSTATUS) || defined(VDBE_PROFILE)
000349    pOp->nExec = 0;
000350    pOp->nCycle = 0;
000351  #endif
000352  #ifdef SQLITE_DEBUG
000353    if( p->db->flags & SQLITE_VdbeAddopTrace ){
000354      sqlite3VdbePrintOp(0, i, &p->aOp[i]);
000355      test_addop_breakpoint(i, &p->aOp[i]);
000356    }
000357  #endif
000358  #ifdef SQLITE_VDBE_COVERAGE
000359    pOp->iSrcLine = 0;
000360  #endif
000361    /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
000362    ** Replicate in sqlite3VdbeAddOp3() */
000363  
000364    return i;
000365  }
000366  
000367  /* Generate code for an unconditional jump to instruction iDest
000368  */
000369  int sqlite3VdbeGoto(Vdbe *p, int iDest){
000370    return sqlite3VdbeAddOp3(p, OP_Goto, 0, iDest, 0);
000371  }
000372  
000373  /* Generate code to cause the string zStr to be loaded into
000374  ** register iDest
000375  */
000376  int sqlite3VdbeLoadString(Vdbe *p, int iDest, const char *zStr){
000377    return sqlite3VdbeAddOp4(p, OP_String8, 0, iDest, 0, zStr, 0);
000378  }
000379  
000380  /*
000381  ** Generate code that initializes multiple registers to string or integer
000382  ** constants.  The registers begin with iDest and increase consecutively.
000383  ** One register is initialized for each characgter in zTypes[].  For each
000384  ** "s" character in zTypes[], the register is a string if the argument is
000385  ** not NULL, or OP_Null if the value is a null pointer.  For each "i" character
000386  ** in zTypes[], the register is initialized to an integer.
000387  **
000388  ** If the input string does not end with "X" then an OP_ResultRow instruction
000389  ** is generated for the values inserted.
000390  */
000391  void sqlite3VdbeMultiLoad(Vdbe *p, int iDest, const char *zTypes, ...){
000392    va_list ap;
000393    int i;
000394    char c;
000395    va_start(ap, zTypes);
000396    for(i=0; (c = zTypes[i])!=0; i++){
000397      if( c=='s' ){
000398        const char *z = va_arg(ap, const char*);
000399        sqlite3VdbeAddOp4(p, z==0 ? OP_Null : OP_String8, 0, iDest+i, 0, z, 0);
000400      }else if( c=='i' ){
000401        sqlite3VdbeAddOp2(p, OP_Integer, va_arg(ap, int), iDest+i);
000402      }else{
000403        goto skip_op_resultrow;
000404      }
000405    }
000406    sqlite3VdbeAddOp2(p, OP_ResultRow, iDest, i);
000407  skip_op_resultrow:
000408    va_end(ap);
000409  }
000410  
000411  /*
000412  ** Add an opcode that includes the p4 value as a pointer.
000413  */
000414  int sqlite3VdbeAddOp4(
000415    Vdbe *p,            /* Add the opcode to this VM */
000416    int op,             /* The new opcode */
000417    int p1,             /* The P1 operand */
000418    int p2,             /* The P2 operand */
000419    int p3,             /* The P3 operand */
000420    const char *zP4,    /* The P4 operand */
000421    int p4type          /* P4 operand type */
000422  ){
000423    int addr = sqlite3VdbeAddOp3(p, op, p1, p2, p3);
000424    sqlite3VdbeChangeP4(p, addr, zP4, p4type);
000425    return addr;
000426  }
000427  
000428  /*
000429  ** Add an OP_Function or OP_PureFunc opcode.
000430  **
000431  ** The eCallCtx argument is information (typically taken from Expr.op2)
000432  ** that describes the calling context of the function.  0 means a general
000433  ** function call.  NC_IsCheck means called by a check constraint,
000434  ** NC_IdxExpr means called as part of an index expression.  NC_PartIdx
000435  ** means in the WHERE clause of a partial index.  NC_GenCol means called
000436  ** while computing a generated column value.  0 is the usual case.
000437  */
000438  int sqlite3VdbeAddFunctionCall(
000439    Parse *pParse,        /* Parsing context */
000440    int p1,               /* Constant argument mask */
000441    int p2,               /* First argument register */
000442    int p3,               /* Register into which results are written */
000443    int nArg,             /* Number of argument */
000444    const FuncDef *pFunc, /* The function to be invoked */
000445    int eCallCtx          /* Calling context */
000446  ){
000447    Vdbe *v = pParse->pVdbe;
000448    int nByte;
000449    int addr;
000450    sqlite3_context *pCtx;
000451    assert( v );
000452    nByte = sizeof(*pCtx) + (nArg-1)*sizeof(sqlite3_value*);
000453    pCtx = sqlite3DbMallocRawNN(pParse->db, nByte);
000454    if( pCtx==0 ){
000455      assert( pParse->db->mallocFailed );
000456      freeEphemeralFunction(pParse->db, (FuncDef*)pFunc);
000457      return 0;
000458    }
000459    pCtx->pOut = 0;
000460    pCtx->pFunc = (FuncDef*)pFunc;
000461    pCtx->pVdbe = 0;
000462    pCtx->isError = 0;
000463    pCtx->argc = nArg;
000464    pCtx->iOp = sqlite3VdbeCurrentAddr(v);
000465    addr = sqlite3VdbeAddOp4(v, eCallCtx ? OP_PureFunc : OP_Function,
000466                             p1, p2, p3, (char*)pCtx, P4_FUNCCTX);
000467    sqlite3VdbeChangeP5(v, eCallCtx & NC_SelfRef);
000468    sqlite3MayAbort(pParse);
000469    return addr;
000470  }
000471  
000472  /*
000473  ** Add an opcode that includes the p4 value with a P4_INT64 or
000474  ** P4_REAL type.
000475  */
000476  int sqlite3VdbeAddOp4Dup8(
000477    Vdbe *p,            /* Add the opcode to this VM */
000478    int op,             /* The new opcode */
000479    int p1,             /* The P1 operand */
000480    int p2,             /* The P2 operand */
000481    int p3,             /* The P3 operand */
000482    const u8 *zP4,      /* The P4 operand */
000483    int p4type          /* P4 operand type */
000484  ){
000485    char *p4copy = sqlite3DbMallocRawNN(sqlite3VdbeDb(p), 8);
000486    if( p4copy ) memcpy(p4copy, zP4, 8);
000487    return sqlite3VdbeAddOp4(p, op, p1, p2, p3, p4copy, p4type);
000488  }
000489  
000490  #ifndef SQLITE_OMIT_EXPLAIN
000491  /*
000492  ** Return the address of the current EXPLAIN QUERY PLAN baseline.
000493  ** 0 means "none".
000494  */
000495  int sqlite3VdbeExplainParent(Parse *pParse){
000496    VdbeOp *pOp;
000497    if( pParse->addrExplain==0 ) return 0;
000498    pOp = sqlite3VdbeGetOp(pParse->pVdbe, pParse->addrExplain);
000499    return pOp->p2;
000500  }
000501  
000502  /*
000503  ** Set a debugger breakpoint on the following routine in order to
000504  ** monitor the EXPLAIN QUERY PLAN code generation.
000505  */
000506  #if defined(SQLITE_DEBUG)
000507  void sqlite3ExplainBreakpoint(const char *z1, const char *z2){
000508    (void)z1;
000509    (void)z2;
000510  }
000511  #endif
000512  
000513  /*
000514  ** Add a new OP_Explain opcode.
000515  **
000516  ** If the bPush flag is true, then make this opcode the parent for
000517  ** subsequent Explains until sqlite3VdbeExplainPop() is called.
000518  */
000519  int sqlite3VdbeExplain(Parse *pParse, u8 bPush, const char *zFmt, ...){
000520    int addr = 0;
000521  #if !defined(SQLITE_DEBUG)
000522    /* Always include the OP_Explain opcodes if SQLITE_DEBUG is defined.
000523    ** But omit them (for performance) during production builds */
000524    if( pParse->explain==2 || IS_STMT_SCANSTATUS(pParse->db) )
000525  #endif
000526    {
000527      char *zMsg;
000528      Vdbe *v;
000529      va_list ap;
000530      int iThis;
000531      va_start(ap, zFmt);
000532      zMsg = sqlite3VMPrintf(pParse->db, zFmt, ap);
000533      va_end(ap);
000534      v = pParse->pVdbe;
000535      iThis = v->nOp;
000536      addr = sqlite3VdbeAddOp4(v, OP_Explain, iThis, pParse->addrExplain, 0,
000537                        zMsg, P4_DYNAMIC);
000538      sqlite3ExplainBreakpoint(bPush?"PUSH":"", sqlite3VdbeGetLastOp(v)->p4.z);
000539      if( bPush){
000540        pParse->addrExplain = iThis;
000541      }
000542      sqlite3VdbeScanStatus(v, iThis, -1, -1, 0, 0);
000543    }
000544    return addr;
000545  }
000546  
000547  /*
000548  ** Pop the EXPLAIN QUERY PLAN stack one level.
000549  */
000550  void sqlite3VdbeExplainPop(Parse *pParse){
000551    sqlite3ExplainBreakpoint("POP", 0);
000552    pParse->addrExplain = sqlite3VdbeExplainParent(pParse);
000553  }
000554  #endif /* SQLITE_OMIT_EXPLAIN */
000555  
000556  /*
000557  ** Add an OP_ParseSchema opcode.  This routine is broken out from
000558  ** sqlite3VdbeAddOp4() since it needs to also needs to mark all btrees
000559  ** as having been used.
000560  **
000561  ** The zWhere string must have been obtained from sqlite3_malloc().
000562  ** This routine will take ownership of the allocated memory.
000563  */
000564  void sqlite3VdbeAddParseSchemaOp(Vdbe *p, int iDb, char *zWhere, u16 p5){
000565    int j;
000566    sqlite3VdbeAddOp4(p, OP_ParseSchema, iDb, 0, 0, zWhere, P4_DYNAMIC);
000567    sqlite3VdbeChangeP5(p, p5);
000568    for(j=0; j<p->db->nDb; j++) sqlite3VdbeUsesBtree(p, j);
000569    sqlite3MayAbort(p->pParse);
000570  }
000571  
000572  /* Insert the end of a co-routine
000573  */
000574  void sqlite3VdbeEndCoroutine(Vdbe *v, int regYield){
000575    sqlite3VdbeAddOp1(v, OP_EndCoroutine, regYield);
000576  
000577    /* Clear the temporary register cache, thereby ensuring that each
000578    ** co-routine has its own independent set of registers, because co-routines
000579    ** might expect their registers to be preserved across an OP_Yield, and
000580    ** that could cause problems if two or more co-routines are using the same
000581    ** temporary register.
000582    */
000583    v->pParse->nTempReg = 0;
000584    v->pParse->nRangeReg = 0;
000585  }
000586  
000587  /*
000588  ** Create a new symbolic label for an instruction that has yet to be
000589  ** coded.  The symbolic label is really just a negative number.  The
000590  ** label can be used as the P2 value of an operation.  Later, when
000591  ** the label is resolved to a specific address, the VDBE will scan
000592  ** through its operation list and change all values of P2 which match
000593  ** the label into the resolved address.
000594  **
000595  ** The VDBE knows that a P2 value is a label because labels are
000596  ** always negative and P2 values are suppose to be non-negative.
000597  ** Hence, a negative P2 value is a label that has yet to be resolved.
000598  ** (Later:) This is only true for opcodes that have the OPFLG_JUMP
000599  ** property.
000600  **
000601  ** Variable usage notes:
000602  **
000603  **     Parse.aLabel[x]     Stores the address that the x-th label resolves
000604  **                         into.  For testing (SQLITE_DEBUG), unresolved
000605  **                         labels stores -1, but that is not required.
000606  **     Parse.nLabelAlloc   Number of slots allocated to Parse.aLabel[]
000607  **     Parse.nLabel        The *negative* of the number of labels that have
000608  **                         been issued.  The negative is stored because
000609  **                         that gives a performance improvement over storing
000610  **                         the equivalent positive value.
000611  */
000612  int sqlite3VdbeMakeLabel(Parse *pParse){
000613    return --pParse->nLabel;
000614  }
000615  
000616  /*
000617  ** Resolve label "x" to be the address of the next instruction to
000618  ** be inserted.  The parameter "x" must have been obtained from
000619  ** a prior call to sqlite3VdbeMakeLabel().
000620  */
000621  static SQLITE_NOINLINE void resizeResolveLabel(Parse *p, Vdbe *v, int j){
000622    int nNewSize = 10 - p->nLabel;
000623    p->aLabel = sqlite3DbReallocOrFree(p->db, p->aLabel,
000624                       nNewSize*sizeof(p->aLabel[0]));
000625    if( p->aLabel==0 ){
000626      p->nLabelAlloc = 0;
000627    }else{
000628  #ifdef SQLITE_DEBUG
000629      int i;
000630      for(i=p->nLabelAlloc; i<nNewSize; i++) p->aLabel[i] = -1;
000631  #endif
000632      if( nNewSize>=100 && (nNewSize/100)>(p->nLabelAlloc/100) ){
000633        sqlite3ProgressCheck(p);
000634      }
000635      p->nLabelAlloc = nNewSize;
000636      p->aLabel[j] = v->nOp;
000637    }
000638  }
000639  void sqlite3VdbeResolveLabel(Vdbe *v, int x){
000640    Parse *p = v->pParse;
000641    int j = ADDR(x);
000642    assert( v->eVdbeState==VDBE_INIT_STATE );
000643    assert( j<-p->nLabel );
000644    assert( j>=0 );
000645  #ifdef SQLITE_DEBUG
000646    if( p->db->flags & SQLITE_VdbeAddopTrace ){
000647      printf("RESOLVE LABEL %d to %d\n", x, v->nOp);
000648    }
000649  #endif
000650    if( p->nLabelAlloc + p->nLabel < 0 ){
000651      resizeResolveLabel(p,v,j);
000652    }else{
000653      assert( p->aLabel[j]==(-1) ); /* Labels may only be resolved once */
000654      p->aLabel[j] = v->nOp;
000655    }
000656  }
000657  
000658  /*
000659  ** Mark the VDBE as one that can only be run one time.
000660  */
000661  void sqlite3VdbeRunOnlyOnce(Vdbe *p){
000662    sqlite3VdbeAddOp2(p, OP_Expire, 1, 1);
000663  }
000664  
000665  /*
000666  ** Mark the VDBE as one that can be run multiple times.
000667  */
000668  void sqlite3VdbeReusable(Vdbe *p){
000669    int i;
000670    for(i=1; ALWAYS(i<p->nOp); i++){
000671      if( ALWAYS(p->aOp[i].opcode==OP_Expire) ){
000672        p->aOp[1].opcode = OP_Noop;
000673        break;
000674      }
000675    }
000676  }
000677  
000678  #ifdef SQLITE_DEBUG /* sqlite3AssertMayAbort() logic */
000679  
000680  /*
000681  ** The following type and function are used to iterate through all opcodes
000682  ** in a Vdbe main program and each of the sub-programs (triggers) it may
000683  ** invoke directly or indirectly. It should be used as follows:
000684  **
000685  **   Op *pOp;
000686  **   VdbeOpIter sIter;
000687  **
000688  **   memset(&sIter, 0, sizeof(sIter));
000689  **   sIter.v = v;                            // v is of type Vdbe*
000690  **   while( (pOp = opIterNext(&sIter)) ){
000691  **     // Do something with pOp
000692  **   }
000693  **   sqlite3DbFree(v->db, sIter.apSub);
000694  **
000695  */
000696  typedef struct VdbeOpIter VdbeOpIter;
000697  struct VdbeOpIter {
000698    Vdbe *v;                   /* Vdbe to iterate through the opcodes of */
000699    SubProgram **apSub;        /* Array of subprograms */
000700    int nSub;                  /* Number of entries in apSub */
000701    int iAddr;                 /* Address of next instruction to return */
000702    int iSub;                  /* 0 = main program, 1 = first sub-program etc. */
000703  };
000704  static Op *opIterNext(VdbeOpIter *p){
000705    Vdbe *v = p->v;
000706    Op *pRet = 0;
000707    Op *aOp;
000708    int nOp;
000709  
000710    if( p->iSub<=p->nSub ){
000711  
000712      if( p->iSub==0 ){
000713        aOp = v->aOp;
000714        nOp = v->nOp;
000715      }else{
000716        aOp = p->apSub[p->iSub-1]->aOp;
000717        nOp = p->apSub[p->iSub-1]->nOp;
000718      }
000719      assert( p->iAddr<nOp );
000720  
000721      pRet = &aOp[p->iAddr];
000722      p->iAddr++;
000723      if( p->iAddr==nOp ){
000724        p->iSub++;
000725        p->iAddr = 0;
000726      }
000727   
000728      if( pRet->p4type==P4_SUBPROGRAM ){
000729        int nByte = (p->nSub+1)*sizeof(SubProgram*);
000730        int j;
000731        for(j=0; j<p->nSub; j++){
000732          if( p->apSub[j]==pRet->p4.pProgram ) break;
000733        }
000734        if( j==p->nSub ){
000735          p->apSub = sqlite3DbReallocOrFree(v->db, p->apSub, nByte);
000736          if( !p->apSub ){
000737            pRet = 0;
000738          }else{
000739            p->apSub[p->nSub++] = pRet->p4.pProgram;
000740          }
000741        }
000742      }
000743    }
000744  
000745    return pRet;
000746  }
000747  
000748  /*
000749  ** Check if the program stored in the VM associated with pParse may
000750  ** throw an ABORT exception (causing the statement, but not entire transaction
000751  ** to be rolled back). This condition is true if the main program or any
000752  ** sub-programs contains any of the following:
000753  **
000754  **   *  OP_Halt with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
000755  **   *  OP_HaltIfNull with P1=SQLITE_CONSTRAINT and P2=OE_Abort.
000756  **   *  OP_Destroy
000757  **   *  OP_VUpdate
000758  **   *  OP_VCreate
000759  **   *  OP_VRename
000760  **   *  OP_FkCounter with P2==0 (immediate foreign key constraint)
000761  **   *  OP_CreateBtree/BTREE_INTKEY and OP_InitCoroutine
000762  **      (for CREATE TABLE AS SELECT ...)
000763  **
000764  ** Then check that the value of Parse.mayAbort is true if an
000765  ** ABORT may be thrown, or false otherwise. Return true if it does
000766  ** match, or false otherwise. This function is intended to be used as
000767  ** part of an assert statement in the compiler. Similar to:
000768  **
000769  **   assert( sqlite3VdbeAssertMayAbort(pParse->pVdbe, pParse->mayAbort) );
000770  */
000771  int sqlite3VdbeAssertMayAbort(Vdbe *v, int mayAbort){
000772    int hasAbort = 0;
000773    int hasFkCounter = 0;
000774    int hasCreateTable = 0;
000775    int hasCreateIndex = 0;
000776    int hasInitCoroutine = 0;
000777    Op *pOp;
000778    VdbeOpIter sIter;
000779  
000780    if( v==0 ) return 0;
000781    memset(&sIter, 0, sizeof(sIter));
000782    sIter.v = v;
000783  
000784    while( (pOp = opIterNext(&sIter))!=0 ){
000785      int opcode = pOp->opcode;
000786      if( opcode==OP_Destroy || opcode==OP_VUpdate || opcode==OP_VRename
000787       || opcode==OP_VDestroy
000788       || opcode==OP_VCreate
000789       || opcode==OP_ParseSchema
000790       || opcode==OP_Function || opcode==OP_PureFunc
000791       || ((opcode==OP_Halt || opcode==OP_HaltIfNull)
000792        && ((pOp->p1)!=SQLITE_OK && pOp->p2==OE_Abort))
000793      ){
000794        hasAbort = 1;
000795        break;
000796      }
000797      if( opcode==OP_CreateBtree && pOp->p3==BTREE_INTKEY ) hasCreateTable = 1;
000798      if( mayAbort ){
000799        /* hasCreateIndex may also be set for some DELETE statements that use
000800        ** OP_Clear. So this routine may end up returning true in the case
000801        ** where a "DELETE FROM tbl" has a statement-journal but does not
000802        ** require one. This is not so bad - it is an inefficiency, not a bug. */
000803        if( opcode==OP_CreateBtree && pOp->p3==BTREE_BLOBKEY ) hasCreateIndex = 1;
000804        if( opcode==OP_Clear ) hasCreateIndex = 1;
000805      }
000806      if( opcode==OP_InitCoroutine ) hasInitCoroutine = 1;
000807  #ifndef SQLITE_OMIT_FOREIGN_KEY
000808      if( opcode==OP_FkCounter && pOp->p1==0 && pOp->p2==1 ){
000809        hasFkCounter = 1;
000810      }
000811  #endif
000812    }
000813    sqlite3DbFree(v->db, sIter.apSub);
000814  
000815    /* Return true if hasAbort==mayAbort. Or if a malloc failure occurred.
000816    ** If malloc failed, then the while() loop above may not have iterated
000817    ** through all opcodes and hasAbort may be set incorrectly. Return
000818    ** true for this case to prevent the assert() in the callers frame
000819    ** from failing.  */
000820    return ( v->db->mallocFailed || hasAbort==mayAbort || hasFkCounter
000821          || (hasCreateTable && hasInitCoroutine) || hasCreateIndex
000822    );
000823  }
000824  #endif /* SQLITE_DEBUG - the sqlite3AssertMayAbort() function */
000825  
000826  #ifdef SQLITE_DEBUG
000827  /*
000828  ** Increment the nWrite counter in the VDBE if the cursor is not an
000829  ** ephemeral cursor, or if the cursor argument is NULL.
000830  */
000831  void sqlite3VdbeIncrWriteCounter(Vdbe *p, VdbeCursor *pC){
000832    if( pC==0
000833     || (pC->eCurType!=CURTYPE_SORTER
000834         && pC->eCurType!=CURTYPE_PSEUDO
000835         && !pC->isEphemeral)
000836    ){
000837      p->nWrite++;
000838    }
000839  }
000840  #endif
000841  
000842  #ifdef SQLITE_DEBUG
000843  /*
000844  ** Assert if an Abort at this point in time might result in a corrupt
000845  ** database.
000846  */
000847  void sqlite3VdbeAssertAbortable(Vdbe *p){
000848    assert( p->nWrite==0 || p->usesStmtJournal );
000849  }
000850  #endif
000851  
000852  /*
000853  ** This routine is called after all opcodes have been inserted.  It loops
000854  ** through all the opcodes and fixes up some details.
000855  **
000856  ** (1) For each jump instruction with a negative P2 value (a label)
000857  **     resolve the P2 value to an actual address.
000858  **
000859  ** (2) Compute the maximum number of arguments used by any SQL function
000860  **     and store that value in *pMaxFuncArgs.
000861  **
000862  ** (3) Update the Vdbe.readOnly and Vdbe.bIsReader flags to accurately
000863  **     indicate what the prepared statement actually does.
000864  **
000865  ** (4) (discontinued)
000866  **
000867  ** (5) Reclaim the memory allocated for storing labels.
000868  **
000869  ** This routine will only function correctly if the mkopcodeh.tcl generator
000870  ** script numbers the opcodes correctly.  Changes to this routine must be
000871  ** coordinated with changes to mkopcodeh.tcl.
000872  */
000873  static void resolveP2Values(Vdbe *p, int *pMaxFuncArgs){
000874    int nMaxArgs = *pMaxFuncArgs;
000875    Op *pOp;
000876    Parse *pParse = p->pParse;
000877    int *aLabel = pParse->aLabel;
000878  
000879    assert( pParse->db->mallocFailed==0 ); /* tag-20230419-1 */
000880    p->readOnly = 1;
000881    p->bIsReader = 0;
000882    pOp = &p->aOp[p->nOp-1];
000883    assert( p->aOp[0].opcode==OP_Init );
000884    while( 1 /* Loop terminates when it reaches the OP_Init opcode */ ){
000885      /* Only JUMP opcodes and the short list of special opcodes in the switch
000886      ** below need to be considered.  The mkopcodeh.tcl generator script groups
000887      ** all these opcodes together near the front of the opcode list.  Skip
000888      ** any opcode that does not need processing by virtual of the fact that
000889      ** it is larger than SQLITE_MX_JUMP_OPCODE, as a performance optimization.
000890      */
000891      if( pOp->opcode<=SQLITE_MX_JUMP_OPCODE ){
000892        /* NOTE: Be sure to update mkopcodeh.tcl when adding or removing
000893        ** cases from this switch! */
000894        switch( pOp->opcode ){
000895          case OP_Transaction: {
000896            if( pOp->p2!=0 ) p->readOnly = 0;
000897            /* no break */ deliberate_fall_through
000898          }
000899          case OP_AutoCommit:
000900          case OP_Savepoint: {
000901            p->bIsReader = 1;
000902            break;
000903          }
000904  #ifndef SQLITE_OMIT_WAL
000905          case OP_Checkpoint:
000906  #endif
000907          case OP_Vacuum:
000908          case OP_JournalMode: {
000909            p->readOnly = 0;
000910            p->bIsReader = 1;
000911            break;
000912          }
000913          case OP_Init: {
000914            assert( pOp->p2>=0 );
000915            goto resolve_p2_values_loop_exit;
000916          }
000917  #ifndef SQLITE_OMIT_VIRTUALTABLE
000918          case OP_VUpdate: {
000919            if( pOp->p2>nMaxArgs ) nMaxArgs = pOp->p2;
000920            break;
000921          }
000922          case OP_VFilter: {
000923            int n;
000924            assert( (pOp - p->aOp) >= 3 );
000925            assert( pOp[-1].opcode==OP_Integer );
000926            n = pOp[-1].p1;
000927            if( n>nMaxArgs ) nMaxArgs = n;
000928            /* Fall through into the default case */
000929            /* no break */ deliberate_fall_through
000930          }
000931  #endif
000932          default: {
000933            if( pOp->p2<0 ){
000934              /* The mkopcodeh.tcl script has so arranged things that the only
000935              ** non-jump opcodes less than SQLITE_MX_JUMP_CODE are guaranteed to
000936              ** have non-negative values for P2. */
000937              assert( (sqlite3OpcodeProperty[pOp->opcode] & OPFLG_JUMP)!=0 );
000938              assert( ADDR(pOp->p2)<-pParse->nLabel );
000939              assert( aLabel!=0 );  /* True because of tag-20230419-1 */
000940              pOp->p2 = aLabel[ADDR(pOp->p2)];
000941            }
000942            break;
000943          }
000944        }
000945        /* The mkopcodeh.tcl script has so arranged things that the only
000946        ** non-jump opcodes less than SQLITE_MX_JUMP_CODE are guaranteed to
000947        ** have non-negative values for P2. */
000948        assert( (sqlite3OpcodeProperty[pOp->opcode]&OPFLG_JUMP)==0 || pOp->p2>=0);
000949      }
000950      assert( pOp>p->aOp );   
000951      pOp--;
000952    }
000953  resolve_p2_values_loop_exit:
000954    if( aLabel ){
000955      sqlite3DbNNFreeNN(p->db, pParse->aLabel);
000956      pParse->aLabel = 0;
000957    }
000958    pParse->nLabel = 0;
000959    *pMaxFuncArgs = nMaxArgs;
000960    assert( p->bIsReader!=0 || DbMaskAllZero(p->btreeMask) );
000961  }
000962  
000963  #ifdef SQLITE_DEBUG
000964  /*
000965  ** Check to see if a subroutine contains a jump to a location outside of
000966  ** the subroutine.  If a jump outside the subroutine is detected, add code
000967  ** that will cause the program to halt with an error message.
000968  **
000969  ** The subroutine consists of opcodes between iFirst and iLast.  Jumps to
000970  ** locations within the subroutine are acceptable.  iRetReg is a register
000971  ** that contains the return address.  Jumps to outside the range of iFirst
000972  ** through iLast are also acceptable as long as the jump destination is
000973  ** an OP_Return to iReturnAddr.
000974  **
000975  ** A jump to an unresolved label means that the jump destination will be
000976  ** beyond the current address.  That is normally a jump to an early
000977  ** termination and is consider acceptable.
000978  **
000979  ** This routine only runs during debug builds.  The purpose is (of course)
000980  ** to detect invalid escapes out of a subroutine.  The OP_Halt opcode
000981  ** is generated rather than an assert() or other error, so that ".eqp full"
000982  ** will still work to show the original bytecode, to aid in debugging.
000983  */
000984  void sqlite3VdbeNoJumpsOutsideSubrtn(
000985    Vdbe *v,          /* The byte-code program under construction */
000986    int iFirst,       /* First opcode of the subroutine */
000987    int iLast,        /* Last opcode of the subroutine */
000988    int iRetReg       /* Subroutine return address register */
000989  ){
000990    VdbeOp *pOp;
000991    Parse *pParse;
000992    int i;
000993    sqlite3_str *pErr = 0;
000994    assert( v!=0 );
000995    pParse = v->pParse;
000996    assert( pParse!=0 );
000997    if( pParse->nErr ) return;
000998    assert( iLast>=iFirst );
000999    assert( iLast<v->nOp );
001000    pOp = &v->aOp[iFirst];
001001    for(i=iFirst; i<=iLast; i++, pOp++){
001002      if( (sqlite3OpcodeProperty[pOp->opcode] & OPFLG_JUMP)!=0 ){
001003        int iDest = pOp->p2;   /* Jump destination */
001004        if( iDest==0 ) continue;
001005        if( pOp->opcode==OP_Gosub ) continue;
001006        if( pOp->p3==20230325 && pOp->opcode==OP_NotNull ){
001007          /* This is a deliberately taken illegal branch.  tag-20230325-2 */
001008          continue;
001009        }
001010        if( iDest<0 ){
001011          int j = ADDR(iDest);
001012          assert( j>=0 );
001013          if( j>=-pParse->nLabel || pParse->aLabel[j]<0 ){
001014            continue;
001015          }
001016          iDest = pParse->aLabel[j];
001017        }
001018        if( iDest<iFirst || iDest>iLast ){
001019          int j = iDest;
001020          for(; j<v->nOp; j++){
001021            VdbeOp *pX = &v->aOp[j];
001022            if( pX->opcode==OP_Return ){
001023              if( pX->p1==iRetReg ) break;
001024              continue;
001025            }
001026            if( pX->opcode==OP_Noop ) continue;
001027            if( pX->opcode==OP_Explain ) continue;
001028            if( pErr==0 ){
001029              pErr = sqlite3_str_new(0);
001030            }else{
001031              sqlite3_str_appendchar(pErr, 1, '\n');
001032            }
001033            sqlite3_str_appendf(pErr,
001034                "Opcode at %d jumps to %d which is outside the "
001035                "subroutine at %d..%d",
001036                i, iDest, iFirst, iLast);
001037            break;
001038          }
001039        }
001040      }
001041    }
001042    if( pErr ){
001043      char *zErr = sqlite3_str_finish(pErr);
001044      sqlite3VdbeAddOp4(v, OP_Halt, SQLITE_INTERNAL, OE_Abort, 0, zErr, 0);
001045      sqlite3_free(zErr);
001046      sqlite3MayAbort(pParse);
001047    }
001048  }
001049  #endif /* SQLITE_DEBUG */
001050  
001051  /*
001052  ** Return the address of the next instruction to be inserted.
001053  */
001054  int sqlite3VdbeCurrentAddr(Vdbe *p){
001055    assert( p->eVdbeState==VDBE_INIT_STATE );
001056    return p->nOp;
001057  }
001058  
001059  /*
001060  ** Verify that at least N opcode slots are available in p without
001061  ** having to malloc for more space (except when compiled using
001062  ** SQLITE_TEST_REALLOC_STRESS).  This interface is used during testing
001063  ** to verify that certain calls to sqlite3VdbeAddOpList() can never
001064  ** fail due to a OOM fault and hence that the return value from
001065  ** sqlite3VdbeAddOpList() will always be non-NULL.
001066  */
001067  #if defined(SQLITE_DEBUG) && !defined(SQLITE_TEST_REALLOC_STRESS)
001068  void sqlite3VdbeVerifyNoMallocRequired(Vdbe *p, int N){
001069    assert( p->nOp + N <= p->nOpAlloc );
001070  }
001071  #endif
001072  
001073  /*
001074  ** Verify that the VM passed as the only argument does not contain
001075  ** an OP_ResultRow opcode. Fail an assert() if it does. This is used
001076  ** by code in pragma.c to ensure that the implementation of certain
001077  ** pragmas comports with the flags specified in the mkpragmatab.tcl
001078  ** script.
001079  */
001080  #if defined(SQLITE_DEBUG) && !defined(SQLITE_TEST_REALLOC_STRESS)
001081  void sqlite3VdbeVerifyNoResultRow(Vdbe *p){
001082    int i;
001083    for(i=0; i<p->nOp; i++){
001084      assert( p->aOp[i].opcode!=OP_ResultRow );
001085    }
001086  }
001087  #endif
001088  
001089  /*
001090  ** Generate code (a single OP_Abortable opcode) that will
001091  ** verify that the VDBE program can safely call Abort in the current
001092  ** context.
001093  */
001094  #if defined(SQLITE_DEBUG)
001095  void sqlite3VdbeVerifyAbortable(Vdbe *p, int onError){
001096    if( onError==OE_Abort ) sqlite3VdbeAddOp0(p, OP_Abortable);
001097  }
001098  #endif
001099  
001100  /*
001101  ** This function returns a pointer to the array of opcodes associated with
001102  ** the Vdbe passed as the first argument. It is the callers responsibility
001103  ** to arrange for the returned array to be eventually freed using the
001104  ** vdbeFreeOpArray() function.
001105  **
001106  ** Before returning, *pnOp is set to the number of entries in the returned
001107  ** array. Also, *pnMaxArg is set to the larger of its current value and
001108  ** the number of entries in the Vdbe.apArg[] array required to execute the
001109  ** returned program.
001110  */
001111  VdbeOp *sqlite3VdbeTakeOpArray(Vdbe *p, int *pnOp, int *pnMaxArg){
001112    VdbeOp *aOp = p->aOp;
001113    assert( aOp && !p->db->mallocFailed );
001114  
001115    /* Check that sqlite3VdbeUsesBtree() was not called on this VM */
001116    assert( DbMaskAllZero(p->btreeMask) );
001117  
001118    resolveP2Values(p, pnMaxArg);
001119    *pnOp = p->nOp;
001120    p->aOp = 0;
001121    return aOp;
001122  }
001123  
001124  /*
001125  ** Add a whole list of operations to the operation stack.  Return a
001126  ** pointer to the first operation inserted.
001127  **
001128  ** Non-zero P2 arguments to jump instructions are automatically adjusted
001129  ** so that the jump target is relative to the first operation inserted.
001130  */
001131  VdbeOp *sqlite3VdbeAddOpList(
001132    Vdbe *p,                     /* Add opcodes to the prepared statement */
001133    int nOp,                     /* Number of opcodes to add */
001134    VdbeOpList const *aOp,       /* The opcodes to be added */
001135    int iLineno                  /* Source-file line number of first opcode */
001136  ){
001137    int i;
001138    VdbeOp *pOut, *pFirst;
001139    assert( nOp>0 );
001140    assert( p->eVdbeState==VDBE_INIT_STATE );
001141    if( p->nOp + nOp > p->nOpAlloc && growOpArray(p, nOp) ){
001142      return 0;
001143    }
001144    pFirst = pOut = &p->aOp[p->nOp];
001145    for(i=0; i<nOp; i++, aOp++, pOut++){
001146      pOut->opcode = aOp->opcode;
001147      pOut->p1 = aOp->p1;
001148      pOut->p2 = aOp->p2;
001149      assert( aOp->p2>=0 );
001150      if( (sqlite3OpcodeProperty[aOp->opcode] & OPFLG_JUMP)!=0 && aOp->p2>0 ){
001151        pOut->p2 += p->nOp;
001152      }
001153      pOut->p3 = aOp->p3;
001154      pOut->p4type = P4_NOTUSED;
001155      pOut->p4.p = 0;
001156      pOut->p5 = 0;
001157  #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
001158      pOut->zComment = 0;
001159  #endif
001160  #ifdef SQLITE_VDBE_COVERAGE
001161      pOut->iSrcLine = iLineno+i;
001162  #else
001163      (void)iLineno;
001164  #endif
001165  #ifdef SQLITE_DEBUG
001166      if( p->db->flags & SQLITE_VdbeAddopTrace ){
001167        sqlite3VdbePrintOp(0, i+p->nOp, &p->aOp[i+p->nOp]);
001168      }
001169  #endif
001170    }
001171    p->nOp += nOp;
001172    return pFirst;
001173  }
001174  
001175  #if defined(SQLITE_ENABLE_STMT_SCANSTATUS)
001176  /*
001177  ** Add an entry to the array of counters managed by sqlite3_stmt_scanstatus().
001178  */
001179  void sqlite3VdbeScanStatus(
001180    Vdbe *p,                        /* VM to add scanstatus() to */
001181    int addrExplain,                /* Address of OP_Explain (or 0) */
001182    int addrLoop,                   /* Address of loop counter */
001183    int addrVisit,                  /* Address of rows visited counter */
001184    LogEst nEst,                    /* Estimated number of output rows */
001185    const char *zName               /* Name of table or index being scanned */
001186  ){
001187    if( IS_STMT_SCANSTATUS(p->db) ){
001188      sqlite3_int64 nByte = (p->nScan+1) * sizeof(ScanStatus);
001189      ScanStatus *aNew;
001190      aNew = (ScanStatus*)sqlite3DbRealloc(p->db, p->aScan, nByte);
001191      if( aNew ){
001192        ScanStatus *pNew = &aNew[p->nScan++];
001193        memset(pNew, 0, sizeof(ScanStatus));
001194        pNew->addrExplain = addrExplain;
001195        pNew->addrLoop = addrLoop;
001196        pNew->addrVisit = addrVisit;
001197        pNew->nEst = nEst;
001198        pNew->zName = sqlite3DbStrDup(p->db, zName);
001199        p->aScan = aNew;
001200      }
001201    }
001202  }
001203  
001204  /*
001205  ** Add the range of instructions from addrStart to addrEnd (inclusive) to
001206  ** the set of those corresponding to the sqlite3_stmt_scanstatus() counters
001207  ** associated with the OP_Explain instruction at addrExplain. The
001208  ** sum of the sqlite3Hwtime() values for each of these instructions
001209  ** will be returned for SQLITE_SCANSTAT_NCYCLE requests.
001210  */
001211  void sqlite3VdbeScanStatusRange(
001212    Vdbe *p,
001213    int addrExplain,
001214    int addrStart,
001215    int addrEnd
001216  ){
001217    if( IS_STMT_SCANSTATUS(p->db) ){
001218      ScanStatus *pScan = 0;
001219      int ii;
001220      for(ii=p->nScan-1; ii>=0; ii--){
001221        pScan = &p->aScan[ii];
001222        if( pScan->addrExplain==addrExplain ) break;
001223        pScan = 0;
001224      }
001225      if( pScan ){
001226        if( addrEnd<0 ) addrEnd = sqlite3VdbeCurrentAddr(p)-1;
001227        for(ii=0; ii<ArraySize(pScan->aAddrRange); ii+=2){
001228          if( pScan->aAddrRange[ii]==0 ){
001229            pScan->aAddrRange[ii] = addrStart;
001230            pScan->aAddrRange[ii+1] = addrEnd;
001231            break;
001232          }
001233        }
001234      }
001235    }
001236  }
001237  
001238  /*
001239  ** Set the addresses for the SQLITE_SCANSTAT_NLOOP and SQLITE_SCANSTAT_NROW
001240  ** counters for the query element associated with the OP_Explain at
001241  ** addrExplain.
001242  */
001243  void sqlite3VdbeScanStatusCounters(
001244    Vdbe *p,
001245    int addrExplain,
001246    int addrLoop,
001247    int addrVisit
001248  ){
001249    if( IS_STMT_SCANSTATUS(p->db) ){
001250      ScanStatus *pScan = 0;
001251      int ii;
001252      for(ii=p->nScan-1; ii>=0; ii--){
001253        pScan = &p->aScan[ii];
001254        if( pScan->addrExplain==addrExplain ) break;
001255        pScan = 0;
001256      }
001257      if( pScan ){
001258        if( addrLoop>0 ) pScan->addrLoop = addrLoop;
001259        if( addrVisit>0 ) pScan->addrVisit = addrVisit;
001260      }
001261    }
001262  }
001263  #endif /* defined(SQLITE_ENABLE_STMT_SCANSTATUS) */
001264  
001265  
001266  /*
001267  ** Change the value of the opcode, or P1, P2, P3, or P5 operands
001268  ** for a specific instruction.
001269  */
001270  void sqlite3VdbeChangeOpcode(Vdbe *p, int addr, u8 iNewOpcode){
001271    assert( addr>=0 );
001272    sqlite3VdbeGetOp(p,addr)->opcode = iNewOpcode;
001273  }
001274  void sqlite3VdbeChangeP1(Vdbe *p, int addr, int val){
001275    assert( addr>=0 );
001276    sqlite3VdbeGetOp(p,addr)->p1 = val;
001277  }
001278  void sqlite3VdbeChangeP2(Vdbe *p, int addr, int val){
001279    assert( addr>=0 || p->db->mallocFailed );
001280    sqlite3VdbeGetOp(p,addr)->p2 = val;
001281  }
001282  void sqlite3VdbeChangeP3(Vdbe *p, int addr, int val){
001283    assert( addr>=0 );
001284    sqlite3VdbeGetOp(p,addr)->p3 = val;
001285  }
001286  void sqlite3VdbeChangeP5(Vdbe *p, u16 p5){
001287    assert( p->nOp>0 || p->db->mallocFailed );
001288    if( p->nOp>0 ) p->aOp[p->nOp-1].p5 = p5;
001289  }
001290  
001291  /*
001292  ** If the previous opcode is an OP_Column that delivers results
001293  ** into register iDest, then add the OPFLAG_TYPEOFARG flag to that
001294  ** opcode.
001295  */
001296  void sqlite3VdbeTypeofColumn(Vdbe *p, int iDest){
001297    VdbeOp *pOp = sqlite3VdbeGetLastOp(p);
001298    if( pOp->p3==iDest && pOp->opcode==OP_Column ){
001299      pOp->p5 |= OPFLAG_TYPEOFARG;
001300    }
001301  }
001302  
001303  /*
001304  ** Change the P2 operand of instruction addr so that it points to
001305  ** the address of the next instruction to be coded.
001306  */
001307  void sqlite3VdbeJumpHere(Vdbe *p, int addr){
001308    sqlite3VdbeChangeP2(p, addr, p->nOp);
001309  }
001310  
001311  /*
001312  ** Change the P2 operand of the jump instruction at addr so that
001313  ** the jump lands on the next opcode.  Or if the jump instruction was
001314  ** the previous opcode (and is thus a no-op) then simply back up
001315  ** the next instruction counter by one slot so that the jump is
001316  ** overwritten by the next inserted opcode.
001317  **
001318  ** This routine is an optimization of sqlite3VdbeJumpHere() that
001319  ** strives to omit useless byte-code like this:
001320  **
001321  **        7   Once 0 8 0
001322  **        8   ...
001323  */
001324  void sqlite3VdbeJumpHereOrPopInst(Vdbe *p, int addr){
001325    if( addr==p->nOp-1 ){
001326      assert( p->aOp[addr].opcode==OP_Once
001327           || p->aOp[addr].opcode==OP_If
001328           || p->aOp[addr].opcode==OP_FkIfZero );
001329      assert( p->aOp[addr].p4type==0 );
001330  #ifdef SQLITE_VDBE_COVERAGE
001331      sqlite3VdbeGetLastOp(p)->iSrcLine = 0;  /* Erase VdbeCoverage() macros */
001332  #endif
001333      p->nOp--;
001334    }else{
001335      sqlite3VdbeChangeP2(p, addr, p->nOp);
001336    }
001337  }
001338  
001339  
001340  /*
001341  ** If the input FuncDef structure is ephemeral, then free it.  If
001342  ** the FuncDef is not ephemeral, then do nothing.
001343  */
001344  static void freeEphemeralFunction(sqlite3 *db, FuncDef *pDef){
001345    assert( db!=0 );
001346    if( (pDef->funcFlags & SQLITE_FUNC_EPHEM)!=0 ){
001347      sqlite3DbNNFreeNN(db, pDef);
001348    }
001349  }
001350  
001351  /*
001352  ** Delete a P4 value if necessary.
001353  */
001354  static SQLITE_NOINLINE void freeP4Mem(sqlite3 *db, Mem *p){
001355    if( p->szMalloc ) sqlite3DbFree(db, p->zMalloc);
001356    sqlite3DbNNFreeNN(db, p);
001357  }
001358  static SQLITE_NOINLINE void freeP4FuncCtx(sqlite3 *db, sqlite3_context *p){
001359    assert( db!=0 );
001360    freeEphemeralFunction(db, p->pFunc);
001361    sqlite3DbNNFreeNN(db, p);
001362  }
001363  static void freeP4(sqlite3 *db, int p4type, void *p4){
001364    assert( db );
001365    switch( p4type ){
001366      case P4_FUNCCTX: {
001367        freeP4FuncCtx(db, (sqlite3_context*)p4);
001368        break;
001369      }
001370      case P4_REAL:
001371      case P4_INT64:
001372      case P4_DYNAMIC:
001373      case P4_INTARRAY: {
001374        if( p4 ) sqlite3DbNNFreeNN(db, p4);
001375        break;
001376      }
001377      case P4_KEYINFO: {
001378        if( db->pnBytesFreed==0 ) sqlite3KeyInfoUnref((KeyInfo*)p4);
001379        break;
001380      }
001381  #ifdef SQLITE_ENABLE_CURSOR_HINTS
001382      case P4_EXPR: {
001383        sqlite3ExprDelete(db, (Expr*)p4);
001384        break;
001385      }
001386  #endif
001387      case P4_FUNCDEF: {
001388        freeEphemeralFunction(db, (FuncDef*)p4);
001389        break;
001390      }
001391      case P4_MEM: {
001392        if( db->pnBytesFreed==0 ){
001393          sqlite3ValueFree((sqlite3_value*)p4);
001394        }else{
001395          freeP4Mem(db, (Mem*)p4);
001396        }
001397        break;
001398      }
001399      case P4_VTAB : {
001400        if( db->pnBytesFreed==0 ) sqlite3VtabUnlock((VTable *)p4);
001401        break;
001402      }
001403      case P4_TABLEREF: {
001404        if( db->pnBytesFreed==0 ) sqlite3DeleteTable(db, (Table*)p4);
001405        break;
001406      }
001407    }
001408  }
001409  
001410  /*
001411  ** Free the space allocated for aOp and any p4 values allocated for the
001412  ** opcodes contained within. If aOp is not NULL it is assumed to contain
001413  ** nOp entries.
001414  */
001415  static void vdbeFreeOpArray(sqlite3 *db, Op *aOp, int nOp){
001416    assert( nOp>=0 );
001417    assert( db!=0 );
001418    if( aOp ){
001419      Op *pOp = &aOp[nOp-1];
001420      while(1){  /* Exit via break */
001421        if( pOp->p4type <= P4_FREE_IF_LE ) freeP4(db, pOp->p4type, pOp->p4.p);
001422  #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
001423        sqlite3DbFree(db, pOp->zComment);
001424  #endif    
001425        if( pOp==aOp ) break;
001426        pOp--;
001427      }
001428      sqlite3DbNNFreeNN(db, aOp);
001429    }
001430  }
001431  
001432  /*
001433  ** Link the SubProgram object passed as the second argument into the linked
001434  ** list at Vdbe.pSubProgram. This list is used to delete all sub-program
001435  ** objects when the VM is no longer required.
001436  */
001437  void sqlite3VdbeLinkSubProgram(Vdbe *pVdbe, SubProgram *p){
001438    p->pNext = pVdbe->pProgram;
001439    pVdbe->pProgram = p;
001440  }
001441  
001442  /*
001443  ** Return true if the given Vdbe has any SubPrograms.
001444  */
001445  int sqlite3VdbeHasSubProgram(Vdbe *pVdbe){
001446    return pVdbe->pProgram!=0;
001447  }
001448  
001449  /*
001450  ** Change the opcode at addr into OP_Noop
001451  */
001452  int sqlite3VdbeChangeToNoop(Vdbe *p, int addr){
001453    VdbeOp *pOp;
001454    if( p->db->mallocFailed ) return 0;
001455    assert( addr>=0 && addr<p->nOp );
001456    pOp = &p->aOp[addr];
001457    freeP4(p->db, pOp->p4type, pOp->p4.p);
001458    pOp->p4type = P4_NOTUSED;
001459    pOp->p4.z = 0;
001460    pOp->opcode = OP_Noop;
001461    return 1;
001462  }
001463  
001464  /*
001465  ** If the last opcode is "op" and it is not a jump destination,
001466  ** then remove it.  Return true if and only if an opcode was removed.
001467  */
001468  int sqlite3VdbeDeletePriorOpcode(Vdbe *p, u8 op){
001469    if( p->nOp>0 && p->aOp[p->nOp-1].opcode==op ){
001470      return sqlite3VdbeChangeToNoop(p, p->nOp-1);
001471    }else{
001472      return 0;
001473    }
001474  }
001475  
001476  #ifdef SQLITE_DEBUG
001477  /*
001478  ** Generate an OP_ReleaseReg opcode to indicate that a range of
001479  ** registers, except any identified by mask, are no longer in use.
001480  */
001481  void sqlite3VdbeReleaseRegisters(
001482    Parse *pParse,       /* Parsing context */
001483    int iFirst,          /* Index of first register to be released */
001484    int N,               /* Number of registers to release */
001485    u32 mask,            /* Mask of registers to NOT release */
001486    int bUndefine        /* If true, mark registers as undefined */
001487  ){
001488    if( N==0 || OptimizationDisabled(pParse->db, SQLITE_ReleaseReg) ) return;
001489    assert( pParse->pVdbe );
001490    assert( iFirst>=1 );
001491    assert( iFirst+N-1<=pParse->nMem );
001492    if( N<=31 && mask!=0 ){
001493      while( N>0 && (mask&1)!=0 ){
001494        mask >>= 1;
001495        iFirst++;
001496        N--;
001497      }
001498      while( N>0 && N<=32 && (mask & MASKBIT32(N-1))!=0 ){
001499        mask &= ~MASKBIT32(N-1);
001500        N--;
001501      }
001502    }
001503    if( N>0 ){
001504      sqlite3VdbeAddOp3(pParse->pVdbe, OP_ReleaseReg, iFirst, N, *(int*)&mask);
001505      if( bUndefine ) sqlite3VdbeChangeP5(pParse->pVdbe, 1);
001506    }
001507  }
001508  #endif /* SQLITE_DEBUG */
001509  
001510  /*
001511  ** Change the value of the P4 operand for a specific instruction.
001512  ** This routine is useful when a large program is loaded from a
001513  ** static array using sqlite3VdbeAddOpList but we want to make a
001514  ** few minor changes to the program.
001515  **
001516  ** If n>=0 then the P4 operand is dynamic, meaning that a copy of
001517  ** the string is made into memory obtained from sqlite3_malloc().
001518  ** A value of n==0 means copy bytes of zP4 up to and including the
001519  ** first null byte.  If n>0 then copy n+1 bytes of zP4.
001520  **
001521  ** Other values of n (P4_STATIC, P4_COLLSEQ etc.) indicate that zP4 points
001522  ** to a string or structure that is guaranteed to exist for the lifetime of
001523  ** the Vdbe. In these cases we can just copy the pointer.
001524  **
001525  ** If addr<0 then change P4 on the most recently inserted instruction.
001526  */
001527  static void SQLITE_NOINLINE vdbeChangeP4Full(
001528    Vdbe *p,
001529    Op *pOp,
001530    const char *zP4,
001531    int n
001532  ){
001533    if( pOp->p4type ){
001534      assert( pOp->p4type > P4_FREE_IF_LE );
001535      pOp->p4type = 0;
001536      pOp->p4.p = 0;
001537    }
001538    if( n<0 ){
001539      sqlite3VdbeChangeP4(p, (int)(pOp - p->aOp), zP4, n);
001540    }else{
001541      if( n==0 ) n = sqlite3Strlen30(zP4);
001542      pOp->p4.z = sqlite3DbStrNDup(p->db, zP4, n);
001543      pOp->p4type = P4_DYNAMIC;
001544    }
001545  }
001546  void sqlite3VdbeChangeP4(Vdbe *p, int addr, const char *zP4, int n){
001547    Op *pOp;
001548    sqlite3 *db;
001549    assert( p!=0 );
001550    db = p->db;
001551    assert( p->eVdbeState==VDBE_INIT_STATE );
001552    assert( p->aOp!=0 || db->mallocFailed );
001553    if( db->mallocFailed ){
001554      if( n!=P4_VTAB ) freeP4(db, n, (void*)*(char**)&zP4);
001555      return;
001556    }
001557    assert( p->nOp>0 );
001558    assert( addr<p->nOp );
001559    if( addr<0 ){
001560      addr = p->nOp - 1;
001561    }
001562    pOp = &p->aOp[addr];
001563    if( n>=0 || pOp->p4type ){
001564      vdbeChangeP4Full(p, pOp, zP4, n);
001565      return;
001566    }
001567    if( n==P4_INT32 ){
001568      /* Note: this cast is safe, because the origin data point was an int
001569      ** that was cast to a (const char *). */
001570      pOp->p4.i = SQLITE_PTR_TO_INT(zP4);
001571      pOp->p4type = P4_INT32;
001572    }else if( zP4!=0 ){
001573      assert( n<0 );
001574      pOp->p4.p = (void*)zP4;
001575      pOp->p4type = (signed char)n;
001576      if( n==P4_VTAB ) sqlite3VtabLock((VTable*)zP4);
001577    }
001578  }
001579  
001580  /*
001581  ** Change the P4 operand of the most recently coded instruction
001582  ** to the value defined by the arguments.  This is a high-speed
001583  ** version of sqlite3VdbeChangeP4().
001584  **
001585  ** The P4 operand must not have been previously defined.  And the new
001586  ** P4 must not be P4_INT32.  Use sqlite3VdbeChangeP4() in either of
001587  ** those cases.
001588  */
001589  void sqlite3VdbeAppendP4(Vdbe *p, void *pP4, int n){
001590    VdbeOp *pOp;
001591    assert( n!=P4_INT32 && n!=P4_VTAB );
001592    assert( n<=0 );
001593    if( p->db->mallocFailed ){
001594      freeP4(p->db, n, pP4);
001595    }else{
001596      assert( pP4!=0 || n==P4_DYNAMIC );
001597      assert( p->nOp>0 );
001598      pOp = &p->aOp[p->nOp-1];
001599      assert( pOp->p4type==P4_NOTUSED );
001600      pOp->p4type = n;
001601      pOp->p4.p = pP4;
001602    }
001603  }
001604  
001605  /*
001606  ** Set the P4 on the most recently added opcode to the KeyInfo for the
001607  ** index given.
001608  */
001609  void sqlite3VdbeSetP4KeyInfo(Parse *pParse, Index *pIdx){
001610    Vdbe *v = pParse->pVdbe;
001611    KeyInfo *pKeyInfo;
001612    assert( v!=0 );
001613    assert( pIdx!=0 );
001614    pKeyInfo = sqlite3KeyInfoOfIndex(pParse, pIdx);
001615    if( pKeyInfo ) sqlite3VdbeAppendP4(v, pKeyInfo, P4_KEYINFO);
001616  }
001617  
001618  #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
001619  /*
001620  ** Change the comment on the most recently coded instruction.  Or
001621  ** insert a No-op and add the comment to that new instruction.  This
001622  ** makes the code easier to read during debugging.  None of this happens
001623  ** in a production build.
001624  */
001625  static void vdbeVComment(Vdbe *p, const char *zFormat, va_list ap){
001626    assert( p->nOp>0 || p->aOp==0 );
001627    assert( p->aOp==0 || p->aOp[p->nOp-1].zComment==0 || p->pParse->nErr>0 );
001628    if( p->nOp ){
001629      assert( p->aOp );
001630      sqlite3DbFree(p->db, p->aOp[p->nOp-1].zComment);
001631      p->aOp[p->nOp-1].zComment = sqlite3VMPrintf(p->db, zFormat, ap);
001632    }
001633  }
001634  void sqlite3VdbeComment(Vdbe *p, const char *zFormat, ...){
001635    va_list ap;
001636    if( p ){
001637      va_start(ap, zFormat);
001638      vdbeVComment(p, zFormat, ap);
001639      va_end(ap);
001640    }
001641  }
001642  void sqlite3VdbeNoopComment(Vdbe *p, const char *zFormat, ...){
001643    va_list ap;
001644    if( p ){
001645      sqlite3VdbeAddOp0(p, OP_Noop);
001646      va_start(ap, zFormat);
001647      vdbeVComment(p, zFormat, ap);
001648      va_end(ap);
001649    }
001650  }
001651  #endif  /* NDEBUG */
001652  
001653  #ifdef SQLITE_VDBE_COVERAGE
001654  /*
001655  ** Set the value if the iSrcLine field for the previously coded instruction.
001656  */
001657  void sqlite3VdbeSetLineNumber(Vdbe *v, int iLine){
001658    sqlite3VdbeGetLastOp(v)->iSrcLine = iLine;
001659  }
001660  #endif /* SQLITE_VDBE_COVERAGE */
001661  
001662  /*
001663  ** Return the opcode for a given address.  The address must be non-negative.
001664  ** See sqlite3VdbeGetLastOp() to get the most recently added opcode.
001665  **
001666  ** If a memory allocation error has occurred prior to the calling of this
001667  ** routine, then a pointer to a dummy VdbeOp will be returned.  That opcode
001668  ** is readable but not writable, though it is cast to a writable value.
001669  ** The return of a dummy opcode allows the call to continue functioning
001670  ** after an OOM fault without having to check to see if the return from
001671  ** this routine is a valid pointer.  But because the dummy.opcode is 0,
001672  ** dummy will never be written to.  This is verified by code inspection and
001673  ** by running with Valgrind.
001674  */
001675  VdbeOp *sqlite3VdbeGetOp(Vdbe *p, int addr){
001676    /* C89 specifies that the constant "dummy" will be initialized to all
001677    ** zeros, which is correct.  MSVC generates a warning, nevertheless. */
001678    static VdbeOp dummy;  /* Ignore the MSVC warning about no initializer */
001679    assert( p->eVdbeState==VDBE_INIT_STATE );
001680    assert( (addr>=0 && addr<p->nOp) || p->db->mallocFailed );
001681    if( p->db->mallocFailed ){
001682      return (VdbeOp*)&dummy;
001683    }else{
001684      return &p->aOp[addr];
001685    }
001686  }
001687  
001688  /* Return the most recently added opcode
001689  */
001690  VdbeOp *sqlite3VdbeGetLastOp(Vdbe *p){
001691    return sqlite3VdbeGetOp(p, p->nOp - 1);
001692  }
001693  
001694  #if defined(SQLITE_ENABLE_EXPLAIN_COMMENTS)
001695  /*
001696  ** Return an integer value for one of the parameters to the opcode pOp
001697  ** determined by character c.
001698  */
001699  static int translateP(char c, const Op *pOp){
001700    if( c=='1' ) return pOp->p1;
001701    if( c=='2' ) return pOp->p2;
001702    if( c=='3' ) return pOp->p3;
001703    if( c=='4' ) return pOp->p4.i;
001704    return pOp->p5;
001705  }
001706  
001707  /*
001708  ** Compute a string for the "comment" field of a VDBE opcode listing.
001709  **
001710  ** The Synopsis: field in comments in the vdbe.c source file gets converted
001711  ** to an extra string that is appended to the sqlite3OpcodeName().  In the
001712  ** absence of other comments, this synopsis becomes the comment on the opcode.
001713  ** Some translation occurs:
001714  **
001715  **       "PX"      ->  "r[X]"
001716  **       "PX@PY"   ->  "r[X..X+Y-1]"  or "r[x]" if y is 0 or 1
001717  **       "PX@PY+1" ->  "r[X..X+Y]"    or "r[x]" if y is 0
001718  **       "PY..PY"  ->  "r[X..Y]"      or "r[x]" if y<=x
001719  */
001720  char *sqlite3VdbeDisplayComment(
001721    sqlite3 *db,       /* Optional - Oom error reporting only */
001722    const Op *pOp,     /* The opcode to be commented */
001723    const char *zP4    /* Previously obtained value for P4 */
001724  ){
001725    const char *zOpName;
001726    const char *zSynopsis;
001727    int nOpName;
001728    int ii;
001729    char zAlt[50];
001730    StrAccum x;
001731  
001732    sqlite3StrAccumInit(&x, 0, 0, 0, SQLITE_MAX_LENGTH);
001733    zOpName = sqlite3OpcodeName(pOp->opcode);
001734    nOpName = sqlite3Strlen30(zOpName);
001735    if( zOpName[nOpName+1] ){
001736      int seenCom = 0;
001737      char c;
001738      zSynopsis = zOpName + nOpName + 1;
001739      if( strncmp(zSynopsis,"IF ",3)==0 ){
001740        sqlite3_snprintf(sizeof(zAlt), zAlt, "if %s goto P2", zSynopsis+3);
001741        zSynopsis = zAlt;
001742      }
001743      for(ii=0; (c = zSynopsis[ii])!=0; ii++){
001744        if( c=='P' ){
001745          c = zSynopsis[++ii];
001746          if( c=='4' ){
001747            sqlite3_str_appendall(&x, zP4);
001748          }else if( c=='X' ){
001749            if( pOp->zComment && pOp->zComment[0] ){
001750              sqlite3_str_appendall(&x, pOp->zComment);
001751              seenCom = 1;
001752              break;
001753            }
001754          }else{
001755            int v1 = translateP(c, pOp);
001756            int v2;
001757            if( strncmp(zSynopsis+ii+1, "@P", 2)==0 ){
001758              ii += 3;
001759              v2 = translateP(zSynopsis[ii], pOp);
001760              if( strncmp(zSynopsis+ii+1,"+1",2)==0 ){
001761                ii += 2;
001762                v2++;
001763              }
001764              if( v2<2 ){
001765                sqlite3_str_appendf(&x, "%d", v1);
001766              }else{
001767                sqlite3_str_appendf(&x, "%d..%d", v1, v1+v2-1);
001768              }
001769            }else if( strncmp(zSynopsis+ii+1, "@NP", 3)==0 ){
001770              sqlite3_context *pCtx = pOp->p4.pCtx;
001771              if( pOp->p4type!=P4_FUNCCTX || pCtx->argc==1 ){
001772                sqlite3_str_appendf(&x, "%d", v1);
001773              }else if( pCtx->argc>1 ){
001774                sqlite3_str_appendf(&x, "%d..%d", v1, v1+pCtx->argc-1);
001775              }else if( x.accError==0 ){
001776                assert( x.nChar>2 );
001777                x.nChar -= 2;
001778                ii++;
001779              }
001780              ii += 3;
001781            }else{
001782              sqlite3_str_appendf(&x, "%d", v1);
001783              if( strncmp(zSynopsis+ii+1, "..P3", 4)==0 && pOp->p3==0 ){
001784                ii += 4;
001785              }
001786            }
001787          }
001788        }else{
001789          sqlite3_str_appendchar(&x, 1, c);
001790        }
001791      }
001792      if( !seenCom && pOp->zComment ){
001793        sqlite3_str_appendf(&x, "; %s", pOp->zComment);
001794      }
001795    }else if( pOp->zComment ){
001796      sqlite3_str_appendall(&x, pOp->zComment);
001797    }
001798    if( (x.accError & SQLITE_NOMEM)!=0 && db!=0 ){
001799      sqlite3OomFault(db);
001800    }
001801    return sqlite3StrAccumFinish(&x);
001802  }
001803  #endif /* SQLITE_ENABLE_EXPLAIN_COMMENTS */
001804  
001805  #if VDBE_DISPLAY_P4 && defined(SQLITE_ENABLE_CURSOR_HINTS)
001806  /*
001807  ** Translate the P4.pExpr value for an OP_CursorHint opcode into text
001808  ** that can be displayed in the P4 column of EXPLAIN output.
001809  */
001810  static void displayP4Expr(StrAccum *p, Expr *pExpr){
001811    const char *zOp = 0;
001812    switch( pExpr->op ){
001813      case TK_STRING:
001814        assert( !ExprHasProperty(pExpr, EP_IntValue) );
001815        sqlite3_str_appendf(p, "%Q", pExpr->u.zToken);
001816        break;
001817      case TK_INTEGER:
001818        sqlite3_str_appendf(p, "%d", pExpr->u.iValue);
001819        break;
001820      case TK_NULL:
001821        sqlite3_str_appendf(p, "NULL");
001822        break;
001823      case TK_REGISTER: {
001824        sqlite3_str_appendf(p, "r[%d]", pExpr->iTable);
001825        break;
001826      }
001827      case TK_COLUMN: {
001828        if( pExpr->iColumn<0 ){
001829          sqlite3_str_appendf(p, "rowid");
001830        }else{
001831          sqlite3_str_appendf(p, "c%d", (int)pExpr->iColumn);
001832        }
001833        break;
001834      }
001835      case TK_LT:      zOp = "LT";      break;
001836      case TK_LE:      zOp = "LE";      break;
001837      case TK_GT:      zOp = "GT";      break;
001838      case TK_GE:      zOp = "GE";      break;
001839      case TK_NE:      zOp = "NE";      break;
001840      case TK_EQ:      zOp = "EQ";      break;
001841      case TK_IS:      zOp = "IS";      break;
001842      case TK_ISNOT:   zOp = "ISNOT";   break;
001843      case TK_AND:     zOp = "AND";     break;
001844      case TK_OR:      zOp = "OR";      break;
001845      case TK_PLUS:    zOp = "ADD";     break;
001846      case TK_STAR:    zOp = "MUL";     break;
001847      case TK_MINUS:   zOp = "SUB";     break;
001848      case TK_REM:     zOp = "REM";     break;
001849      case TK_BITAND:  zOp = "BITAND";  break;
001850      case TK_BITOR:   zOp = "BITOR";   break;
001851      case TK_SLASH:   zOp = "DIV";     break;
001852      case TK_LSHIFT:  zOp = "LSHIFT";  break;
001853      case TK_RSHIFT:  zOp = "RSHIFT";  break;
001854      case TK_CONCAT:  zOp = "CONCAT";  break;
001855      case TK_UMINUS:  zOp = "MINUS";   break;
001856      case TK_UPLUS:   zOp = "PLUS";    break;
001857      case TK_BITNOT:  zOp = "BITNOT";  break;
001858      case TK_NOT:     zOp = "NOT";     break;
001859      case TK_ISNULL:  zOp = "ISNULL";  break;
001860      case TK_NOTNULL: zOp = "NOTNULL"; break;
001861  
001862      default:
001863        sqlite3_str_appendf(p, "%s", "expr");
001864        break;
001865    }
001866  
001867    if( zOp ){
001868      sqlite3_str_appendf(p, "%s(", zOp);
001869      displayP4Expr(p, pExpr->pLeft);
001870      if( pExpr->pRight ){
001871        sqlite3_str_append(p, ",", 1);
001872        displayP4Expr(p, pExpr->pRight);
001873      }
001874      sqlite3_str_append(p, ")", 1);
001875    }
001876  }
001877  #endif /* VDBE_DISPLAY_P4 && defined(SQLITE_ENABLE_CURSOR_HINTS) */
001878  
001879  
001880  #if VDBE_DISPLAY_P4
001881  /*
001882  ** Compute a string that describes the P4 parameter for an opcode.
001883  ** Use zTemp for any required temporary buffer space.
001884  */
001885  char *sqlite3VdbeDisplayP4(sqlite3 *db, Op *pOp){
001886    char *zP4 = 0;
001887    StrAccum x;
001888  
001889    sqlite3StrAccumInit(&x, 0, 0, 0, SQLITE_MAX_LENGTH);
001890    switch( pOp->p4type ){
001891      case P4_KEYINFO: {
001892        int j;
001893        KeyInfo *pKeyInfo = pOp->p4.pKeyInfo;
001894        assert( pKeyInfo->aSortFlags!=0 );
001895        sqlite3_str_appendf(&x, "k(%d", pKeyInfo->nKeyField);
001896        for(j=0; j<pKeyInfo->nKeyField; j++){
001897          CollSeq *pColl = pKeyInfo->aColl[j];
001898          const char *zColl = pColl ? pColl->zName : "";
001899          if( strcmp(zColl, "BINARY")==0 ) zColl = "B";
001900          sqlite3_str_appendf(&x, ",%s%s%s",
001901                 (pKeyInfo->aSortFlags[j] & KEYINFO_ORDER_DESC) ? "-" : "",
001902                 (pKeyInfo->aSortFlags[j] & KEYINFO_ORDER_BIGNULL)? "N." : "",
001903                 zColl);
001904        }
001905        sqlite3_str_append(&x, ")", 1);
001906        break;
001907      }
001908  #ifdef SQLITE_ENABLE_CURSOR_HINTS
001909      case P4_EXPR: {
001910        displayP4Expr(&x, pOp->p4.pExpr);
001911        break;
001912      }
001913  #endif
001914      case P4_COLLSEQ: {
001915        static const char *const encnames[] = {"?", "8", "16LE", "16BE"};
001916        CollSeq *pColl = pOp->p4.pColl;
001917        assert( pColl->enc<4 );
001918        sqlite3_str_appendf(&x, "%.18s-%s", pColl->zName,
001919                            encnames[pColl->enc]);
001920        break;
001921      }
001922      case P4_FUNCDEF: {
001923        FuncDef *pDef = pOp->p4.pFunc;
001924        sqlite3_str_appendf(&x, "%s(%d)", pDef->zName, pDef->nArg);
001925        break;
001926      }
001927      case P4_FUNCCTX: {
001928        FuncDef *pDef = pOp->p4.pCtx->pFunc;
001929        sqlite3_str_appendf(&x, "%s(%d)", pDef->zName, pDef->nArg);
001930        break;
001931      }
001932      case P4_INT64: {
001933        sqlite3_str_appendf(&x, "%lld", *pOp->p4.pI64);
001934        break;
001935      }
001936      case P4_INT32: {
001937        sqlite3_str_appendf(&x, "%d", pOp->p4.i);
001938        break;
001939      }
001940      case P4_REAL: {
001941        sqlite3_str_appendf(&x, "%.16g", *pOp->p4.pReal);
001942        break;
001943      }
001944      case P4_MEM: {
001945        Mem *pMem = pOp->p4.pMem;
001946        if( pMem->flags & MEM_Str ){
001947          zP4 = pMem->z;
001948        }else if( pMem->flags & (MEM_Int|MEM_IntReal) ){
001949          sqlite3_str_appendf(&x, "%lld", pMem->u.i);
001950        }else if( pMem->flags & MEM_Real ){
001951          sqlite3_str_appendf(&x, "%.16g", pMem->u.r);
001952        }else if( pMem->flags & MEM_Null ){
001953          zP4 = "NULL";
001954        }else{
001955          assert( pMem->flags & MEM_Blob );
001956          zP4 = "(blob)";
001957        }
001958        break;
001959      }
001960  #ifndef SQLITE_OMIT_VIRTUALTABLE
001961      case P4_VTAB: {
001962        sqlite3_vtab *pVtab = pOp->p4.pVtab->pVtab;
001963        sqlite3_str_appendf(&x, "vtab:%p", pVtab);
001964        break;
001965      }
001966  #endif
001967      case P4_INTARRAY: {
001968        u32 i;
001969        u32 *ai = pOp->p4.ai;
001970        u32 n = ai[0];   /* The first element of an INTARRAY is always the
001971                         ** count of the number of elements to follow */
001972        for(i=1; i<=n; i++){
001973          sqlite3_str_appendf(&x, "%c%u", (i==1 ? '[' : ','), ai[i]);
001974        }
001975        sqlite3_str_append(&x, "]", 1);
001976        break;
001977      }
001978      case P4_SUBPROGRAM: {
001979        zP4 = "program";
001980        break;
001981      }
001982      case P4_TABLE: {
001983        zP4 = pOp->p4.pTab->zName;
001984        break;
001985      }
001986      default: {
001987        zP4 = pOp->p4.z;
001988      }
001989    }
001990    if( zP4 ) sqlite3_str_appendall(&x, zP4);
001991    if( (x.accError & SQLITE_NOMEM)!=0 ){
001992      sqlite3OomFault(db);
001993    }
001994    return sqlite3StrAccumFinish(&x);
001995  }
001996  #endif /* VDBE_DISPLAY_P4 */
001997  
001998  /*
001999  ** Declare to the Vdbe that the BTree object at db->aDb[i] is used.
002000  **
002001  ** The prepared statements need to know in advance the complete set of
002002  ** attached databases that will be use.  A mask of these databases
002003  ** is maintained in p->btreeMask.  The p->lockMask value is the subset of
002004  ** p->btreeMask of databases that will require a lock.
002005  */
002006  void sqlite3VdbeUsesBtree(Vdbe *p, int i){
002007    assert( i>=0 && i<p->db->nDb && i<(int)sizeof(yDbMask)*8 );
002008    assert( i<(int)sizeof(p->btreeMask)*8 );
002009    DbMaskSet(p->btreeMask, i);
002010    if( i!=1 && sqlite3BtreeSharable(p->db->aDb[i].pBt) ){
002011      DbMaskSet(p->lockMask, i);
002012    }
002013  }
002014  
002015  #if !defined(SQLITE_OMIT_SHARED_CACHE)
002016  /*
002017  ** If SQLite is compiled to support shared-cache mode and to be threadsafe,
002018  ** this routine obtains the mutex associated with each BtShared structure
002019  ** that may be accessed by the VM passed as an argument. In doing so it also
002020  ** sets the BtShared.db member of each of the BtShared structures, ensuring
002021  ** that the correct busy-handler callback is invoked if required.
002022  **
002023  ** If SQLite is not threadsafe but does support shared-cache mode, then
002024  ** sqlite3BtreeEnter() is invoked to set the BtShared.db variables
002025  ** of all of BtShared structures accessible via the database handle
002026  ** associated with the VM.
002027  **
002028  ** If SQLite is not threadsafe and does not support shared-cache mode, this
002029  ** function is a no-op.
002030  **
002031  ** The p->btreeMask field is a bitmask of all btrees that the prepared
002032  ** statement p will ever use.  Let N be the number of bits in p->btreeMask
002033  ** corresponding to btrees that use shared cache.  Then the runtime of
002034  ** this routine is N*N.  But as N is rarely more than 1, this should not
002035  ** be a problem.
002036  */
002037  void sqlite3VdbeEnter(Vdbe *p){
002038    int i;
002039    sqlite3 *db;
002040    Db *aDb;
002041    int nDb;
002042    if( DbMaskAllZero(p->lockMask) ) return;  /* The common case */
002043    db = p->db;
002044    aDb = db->aDb;
002045    nDb = db->nDb;
002046    for(i=0; i<nDb; i++){
002047      if( i!=1 && DbMaskTest(p->lockMask,i) && ALWAYS(aDb[i].pBt!=0) ){
002048        sqlite3BtreeEnter(aDb[i].pBt);
002049      }
002050    }
002051  }
002052  #endif
002053  
002054  #if !defined(SQLITE_OMIT_SHARED_CACHE) && SQLITE_THREADSAFE>0
002055  /*
002056  ** Unlock all of the btrees previously locked by a call to sqlite3VdbeEnter().
002057  */
002058  static SQLITE_NOINLINE void vdbeLeave(Vdbe *p){
002059    int i;
002060    sqlite3 *db;
002061    Db *aDb;
002062    int nDb;
002063    db = p->db;
002064    aDb = db->aDb;
002065    nDb = db->nDb;
002066    for(i=0; i<nDb; i++){
002067      if( i!=1 && DbMaskTest(p->lockMask,i) && ALWAYS(aDb[i].pBt!=0) ){
002068        sqlite3BtreeLeave(aDb[i].pBt);
002069      }
002070    }
002071  }
002072  void sqlite3VdbeLeave(Vdbe *p){
002073    if( DbMaskAllZero(p->lockMask) ) return;  /* The common case */
002074    vdbeLeave(p);
002075  }
002076  #endif
002077  
002078  #if defined(VDBE_PROFILE) || defined(SQLITE_DEBUG)
002079  /*
002080  ** Print a single opcode.  This routine is used for debugging only.
002081  */
002082  void sqlite3VdbePrintOp(FILE *pOut, int pc, VdbeOp *pOp){
002083    char *zP4;
002084    char *zCom;
002085    sqlite3 dummyDb;
002086    static const char *zFormat1 = "%4d %-13s %4d %4d %4d %-13s %.2X %s\n";
002087    if( pOut==0 ) pOut = stdout;
002088    sqlite3BeginBenignMalloc();
002089    dummyDb.mallocFailed = 1;
002090    zP4 = sqlite3VdbeDisplayP4(&dummyDb, pOp);
002091  #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
002092    zCom = sqlite3VdbeDisplayComment(0, pOp, zP4);
002093  #else
002094    zCom = 0;
002095  #endif
002096    /* NB:  The sqlite3OpcodeName() function is implemented by code created
002097    ** by the mkopcodeh.awk and mkopcodec.awk scripts which extract the
002098    ** information from the vdbe.c source text */
002099    fprintf(pOut, zFormat1, pc,
002100        sqlite3OpcodeName(pOp->opcode), pOp->p1, pOp->p2, pOp->p3,
002101        zP4 ? zP4 : "", pOp->p5,
002102        zCom ? zCom : ""
002103    );
002104    fflush(pOut);
002105    sqlite3_free(zP4);
002106    sqlite3_free(zCom);
002107    sqlite3EndBenignMalloc();
002108  }
002109  #endif
002110  
002111  /*
002112  ** Initialize an array of N Mem element.
002113  **
002114  ** This is a high-runner, so only those fields that really do need to
002115  ** be initialized are set.  The Mem structure is organized so that
002116  ** the fields that get initialized are nearby and hopefully on the same
002117  ** cache line.
002118  **
002119  **    Mem.flags = flags
002120  **    Mem.db = db
002121  **    Mem.szMalloc = 0
002122  **
002123  ** All other fields of Mem can safely remain uninitialized for now.  They
002124  ** will be initialized before use.
002125  */
002126  static void initMemArray(Mem *p, int N, sqlite3 *db, u16 flags){
002127    if( N>0 ){
002128      do{
002129        p->flags = flags;
002130        p->db = db;
002131        p->szMalloc = 0;
002132  #ifdef SQLITE_DEBUG
002133        p->pScopyFrom = 0;
002134  #endif
002135        p++;
002136      }while( (--N)>0 );
002137    }
002138  }
002139  
002140  /*
002141  ** Release auxiliary memory held in an array of N Mem elements.
002142  **
002143  ** After this routine returns, all Mem elements in the array will still
002144  ** be valid.  Those Mem elements that were not holding auxiliary resources
002145  ** will be unchanged.  Mem elements which had something freed will be
002146  ** set to MEM_Undefined.
002147  */
002148  static void releaseMemArray(Mem *p, int N){
002149    if( p && N ){
002150      Mem *pEnd = &p[N];
002151      sqlite3 *db = p->db;
002152      if( db->pnBytesFreed ){
002153        do{
002154          if( p->szMalloc ) sqlite3DbFree(db, p->zMalloc);
002155        }while( (++p)<pEnd );
002156        return;
002157      }
002158      do{
002159        assert( (&p[1])==pEnd || p[0].db==p[1].db );
002160        assert( sqlite3VdbeCheckMemInvariants(p) );
002161  
002162        /* This block is really an inlined version of sqlite3VdbeMemRelease()
002163        ** that takes advantage of the fact that the memory cell value is
002164        ** being set to NULL after releasing any dynamic resources.
002165        **
002166        ** The justification for duplicating code is that according to
002167        ** callgrind, this causes a certain test case to hit the CPU 4.7
002168        ** percent less (x86 linux, gcc version 4.1.2, -O6) than if
002169        ** sqlite3MemRelease() were called from here. With -O2, this jumps
002170        ** to 6.6 percent. The test case is inserting 1000 rows into a table
002171        ** with no indexes using a single prepared INSERT statement, bind()
002172        ** and reset(). Inserts are grouped into a transaction.
002173        */
002174        testcase( p->flags & MEM_Agg );
002175        testcase( p->flags & MEM_Dyn );
002176        if( p->flags&(MEM_Agg|MEM_Dyn) ){
002177          testcase( (p->flags & MEM_Dyn)!=0 && p->xDel==sqlite3VdbeFrameMemDel );
002178          sqlite3VdbeMemRelease(p);
002179          p->flags = MEM_Undefined;
002180        }else if( p->szMalloc ){
002181          sqlite3DbNNFreeNN(db, p->zMalloc);
002182          p->szMalloc = 0;
002183          p->flags = MEM_Undefined;
002184        }
002185  #ifdef SQLITE_DEBUG
002186        else{
002187          p->flags = MEM_Undefined;
002188        }
002189  #endif
002190      }while( (++p)<pEnd );
002191    }
002192  }
002193  
002194  #ifdef SQLITE_DEBUG
002195  /*
002196  ** Verify that pFrame is a valid VdbeFrame pointer.  Return true if it is
002197  ** and false if something is wrong.
002198  **
002199  ** This routine is intended for use inside of assert() statements only.
002200  */
002201  int sqlite3VdbeFrameIsValid(VdbeFrame *pFrame){
002202    if( pFrame->iFrameMagic!=SQLITE_FRAME_MAGIC ) return 0;
002203    return 1;
002204  }
002205  #endif
002206  
002207  
002208  /*
002209  ** This is a destructor on a Mem object (which is really an sqlite3_value)
002210  ** that deletes the Frame object that is attached to it as a blob.
002211  **
002212  ** This routine does not delete the Frame right away.  It merely adds the
002213  ** frame to a list of frames to be deleted when the Vdbe halts.
002214  */
002215  void sqlite3VdbeFrameMemDel(void *pArg){
002216    VdbeFrame *pFrame = (VdbeFrame*)pArg;
002217    assert( sqlite3VdbeFrameIsValid(pFrame) );
002218    pFrame->pParent = pFrame->v->pDelFrame;
002219    pFrame->v->pDelFrame = pFrame;
002220  }
002221  
002222  #if defined(SQLITE_ENABLE_BYTECODE_VTAB) || !defined(SQLITE_OMIT_EXPLAIN)
002223  /*
002224  ** Locate the next opcode to be displayed in EXPLAIN or EXPLAIN
002225  ** QUERY PLAN output.
002226  **
002227  ** Return SQLITE_ROW on success.  Return SQLITE_DONE if there are no
002228  ** more opcodes to be displayed.
002229  */
002230  int sqlite3VdbeNextOpcode(
002231    Vdbe *p,         /* The statement being explained */
002232    Mem *pSub,       /* Storage for keeping track of subprogram nesting */
002233    int eMode,       /* 0: normal.  1: EQP.  2:  TablesUsed */
002234    int *piPc,       /* IN/OUT: Current rowid.  Overwritten with next rowid */
002235    int *piAddr,     /* OUT: Write index into (*paOp)[] here */
002236    Op **paOp        /* OUT: Write the opcode array here */
002237  ){
002238    int nRow;                            /* Stop when row count reaches this */
002239    int nSub = 0;                        /* Number of sub-vdbes seen so far */
002240    SubProgram **apSub = 0;              /* Array of sub-vdbes */
002241    int i;                               /* Next instruction address */
002242    int rc = SQLITE_OK;                  /* Result code */
002243    Op *aOp = 0;                         /* Opcode array */
002244    int iPc;                             /* Rowid.  Copy of value in *piPc */
002245  
002246    /* When the number of output rows reaches nRow, that means the
002247    ** listing has finished and sqlite3_step() should return SQLITE_DONE.
002248    ** nRow is the sum of the number of rows in the main program, plus
002249    ** the sum of the number of rows in all trigger subprograms encountered
002250    ** so far.  The nRow value will increase as new trigger subprograms are
002251    ** encountered, but p->pc will eventually catch up to nRow.
002252    */
002253    nRow = p->nOp;
002254    if( pSub!=0 ){
002255      if( pSub->flags&MEM_Blob ){
002256        /* pSub is initiallly NULL.  It is initialized to a BLOB by
002257        ** the P4_SUBPROGRAM processing logic below */
002258        nSub = pSub->n/sizeof(Vdbe*);
002259        apSub = (SubProgram **)pSub->z;
002260      }
002261      for(i=0; i<nSub; i++){
002262        nRow += apSub[i]->nOp;
002263      }
002264    }
002265    iPc = *piPc;
002266    while(1){  /* Loop exits via break */
002267      i = iPc++;
002268      if( i>=nRow ){
002269        p->rc = SQLITE_OK;
002270        rc = SQLITE_DONE;
002271        break;
002272      }
002273      if( i<p->nOp ){
002274        /* The rowid is small enough that we are still in the
002275        ** main program. */
002276        aOp = p->aOp;
002277      }else{
002278        /* We are currently listing subprograms.  Figure out which one and
002279        ** pick up the appropriate opcode. */
002280        int j;
002281        i -= p->nOp;
002282        assert( apSub!=0 );
002283        assert( nSub>0 );
002284        for(j=0; i>=apSub[j]->nOp; j++){
002285          i -= apSub[j]->nOp;
002286          assert( i<apSub[j]->nOp || j+1<nSub );
002287        }
002288        aOp = apSub[j]->aOp;
002289      }
002290  
002291      /* When an OP_Program opcode is encounter (the only opcode that has
002292      ** a P4_SUBPROGRAM argument), expand the size of the array of subprograms
002293      ** kept in p->aMem[9].z to hold the new program - assuming this subprogram
002294      ** has not already been seen.
002295      */
002296      if( pSub!=0 && aOp[i].p4type==P4_SUBPROGRAM ){
002297        int nByte = (nSub+1)*sizeof(SubProgram*);
002298        int j;
002299        for(j=0; j<nSub; j++){
002300          if( apSub[j]==aOp[i].p4.pProgram ) break;
002301        }
002302        if( j==nSub ){
002303          p->rc = sqlite3VdbeMemGrow(pSub, nByte, nSub!=0);
002304          if( p->rc!=SQLITE_OK ){
002305            rc = SQLITE_ERROR;
002306            break;
002307          }
002308          apSub = (SubProgram **)pSub->z;
002309          apSub[nSub++] = aOp[i].p4.pProgram;
002310          MemSetTypeFlag(pSub, MEM_Blob);
002311          pSub->n = nSub*sizeof(SubProgram*);
002312          nRow += aOp[i].p4.pProgram->nOp;
002313        }
002314      }
002315      if( eMode==0 ) break;
002316  #ifdef SQLITE_ENABLE_BYTECODE_VTAB
002317      if( eMode==2 ){
002318        Op *pOp = aOp + i;
002319        if( pOp->opcode==OP_OpenRead ) break;
002320        if( pOp->opcode==OP_OpenWrite && (pOp->p5 & OPFLAG_P2ISREG)==0 ) break;
002321        if( pOp->opcode==OP_ReopenIdx ) break;     
002322      }else
002323  #endif
002324      {
002325        assert( eMode==1 );
002326        if( aOp[i].opcode==OP_Explain ) break;
002327        if( aOp[i].opcode==OP_Init && iPc>1 ) break;
002328      }
002329    }
002330    *piPc = iPc;
002331    *piAddr = i;
002332    *paOp = aOp;
002333    return rc;
002334  }
002335  #endif /* SQLITE_ENABLE_BYTECODE_VTAB || !SQLITE_OMIT_EXPLAIN */
002336  
002337  
002338  /*
002339  ** Delete a VdbeFrame object and its contents. VdbeFrame objects are
002340  ** allocated by the OP_Program opcode in sqlite3VdbeExec().
002341  */
002342  void sqlite3VdbeFrameDelete(VdbeFrame *p){
002343    int i;
002344    Mem *aMem = VdbeFrameMem(p);
002345    VdbeCursor **apCsr = (VdbeCursor **)&aMem[p->nChildMem];
002346    assert( sqlite3VdbeFrameIsValid(p) );
002347    for(i=0; i<p->nChildCsr; i++){
002348      if( apCsr[i] ) sqlite3VdbeFreeCursorNN(p->v, apCsr[i]);
002349    }
002350    releaseMemArray(aMem, p->nChildMem);
002351    sqlite3VdbeDeleteAuxData(p->v->db, &p->pAuxData, -1, 0);
002352    sqlite3DbFree(p->v->db, p);
002353  }
002354  
002355  #ifndef SQLITE_OMIT_EXPLAIN
002356  /*
002357  ** Give a listing of the program in the virtual machine.
002358  **
002359  ** The interface is the same as sqlite3VdbeExec().  But instead of
002360  ** running the code, it invokes the callback once for each instruction.
002361  ** This feature is used to implement "EXPLAIN".
002362  **
002363  ** When p->explain==1, each instruction is listed.  When
002364  ** p->explain==2, only OP_Explain instructions are listed and these
002365  ** are shown in a different format.  p->explain==2 is used to implement
002366  ** EXPLAIN QUERY PLAN.
002367  ** 2018-04-24:  In p->explain==2 mode, the OP_Init opcodes of triggers
002368  ** are also shown, so that the boundaries between the main program and
002369  ** each trigger are clear.
002370  **
002371  ** When p->explain==1, first the main program is listed, then each of
002372  ** the trigger subprograms are listed one by one.
002373  */
002374  int sqlite3VdbeList(
002375    Vdbe *p                   /* The VDBE */
002376  ){
002377    Mem *pSub = 0;                       /* Memory cell hold array of subprogs */
002378    sqlite3 *db = p->db;                 /* The database connection */
002379    int i;                               /* Loop counter */
002380    int rc = SQLITE_OK;                  /* Return code */
002381    Mem *pMem = &p->aMem[1];             /* First Mem of result set */
002382    int bListSubprogs = (p->explain==1 || (db->flags & SQLITE_TriggerEQP)!=0);
002383    Op *aOp;                             /* Array of opcodes */
002384    Op *pOp;                             /* Current opcode */
002385  
002386    assert( p->explain );
002387    assert( p->eVdbeState==VDBE_RUN_STATE );
002388    assert( p->rc==SQLITE_OK || p->rc==SQLITE_BUSY || p->rc==SQLITE_NOMEM );
002389  
002390    /* Even though this opcode does not use dynamic strings for
002391    ** the result, result columns may become dynamic if the user calls
002392    ** sqlite3_column_text16(), causing a translation to UTF-16 encoding.
002393    */
002394    releaseMemArray(pMem, 8);
002395  
002396    if( p->rc==SQLITE_NOMEM ){
002397      /* This happens if a malloc() inside a call to sqlite3_column_text() or
002398      ** sqlite3_column_text16() failed.  */
002399      sqlite3OomFault(db);
002400      return SQLITE_ERROR;
002401    }
002402  
002403    if( bListSubprogs ){
002404      /* The first 8 memory cells are used for the result set.  So we will
002405      ** commandeer the 9th cell to use as storage for an array of pointers
002406      ** to trigger subprograms.  The VDBE is guaranteed to have at least 9
002407      ** cells.  */
002408      assert( p->nMem>9 );
002409      pSub = &p->aMem[9];
002410    }else{
002411      pSub = 0;
002412    }
002413  
002414    /* Figure out which opcode is next to display */
002415    rc = sqlite3VdbeNextOpcode(p, pSub, p->explain==2, &p->pc, &i, &aOp);
002416  
002417    if( rc==SQLITE_OK ){
002418      pOp = aOp + i;
002419      if( AtomicLoad(&db->u1.isInterrupted) ){
002420        p->rc = SQLITE_INTERRUPT;
002421        rc = SQLITE_ERROR;
002422        sqlite3VdbeError(p, sqlite3ErrStr(p->rc));
002423      }else{
002424        char *zP4 = sqlite3VdbeDisplayP4(db, pOp);
002425        if( p->explain==2 ){
002426          sqlite3VdbeMemSetInt64(pMem, pOp->p1);
002427          sqlite3VdbeMemSetInt64(pMem+1, pOp->p2);
002428          sqlite3VdbeMemSetInt64(pMem+2, pOp->p3);
002429          sqlite3VdbeMemSetStr(pMem+3, zP4, -1, SQLITE_UTF8, sqlite3_free);
002430          assert( p->nResColumn==4 );
002431        }else{
002432          sqlite3VdbeMemSetInt64(pMem+0, i);
002433          sqlite3VdbeMemSetStr(pMem+1, (char*)sqlite3OpcodeName(pOp->opcode),
002434                               -1, SQLITE_UTF8, SQLITE_STATIC);
002435          sqlite3VdbeMemSetInt64(pMem+2, pOp->p1);
002436          sqlite3VdbeMemSetInt64(pMem+3, pOp->p2);
002437          sqlite3VdbeMemSetInt64(pMem+4, pOp->p3);
002438          /* pMem+5 for p4 is done last */
002439          sqlite3VdbeMemSetInt64(pMem+6, pOp->p5);
002440  #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
002441          {
002442            char *zCom = sqlite3VdbeDisplayComment(db, pOp, zP4);
002443            sqlite3VdbeMemSetStr(pMem+7, zCom, -1, SQLITE_UTF8, sqlite3_free);
002444          }
002445  #else
002446          sqlite3VdbeMemSetNull(pMem+7);
002447  #endif
002448          sqlite3VdbeMemSetStr(pMem+5, zP4, -1, SQLITE_UTF8, sqlite3_free);
002449          assert( p->nResColumn==8 );
002450        }
002451        p->pResultRow = pMem;
002452        if( db->mallocFailed ){
002453          p->rc = SQLITE_NOMEM;
002454          rc = SQLITE_ERROR;
002455        }else{
002456          p->rc = SQLITE_OK;
002457          rc = SQLITE_ROW;
002458        }
002459      }
002460    }
002461    return rc;
002462  }
002463  #endif /* SQLITE_OMIT_EXPLAIN */
002464  
002465  #ifdef SQLITE_DEBUG
002466  /*
002467  ** Print the SQL that was used to generate a VDBE program.
002468  */
002469  void sqlite3VdbePrintSql(Vdbe *p){
002470    const char *z = 0;
002471    if( p->zSql ){
002472      z = p->zSql;
002473    }else if( p->nOp>=1 ){
002474      const VdbeOp *pOp = &p->aOp[0];
002475      if( pOp->opcode==OP_Init && pOp->p4.z!=0 ){
002476        z = pOp->p4.z;
002477        while( sqlite3Isspace(*z) ) z++;
002478      }
002479    }
002480    if( z ) printf("SQL: [%s]\n", z);
002481  }
002482  #endif
002483  
002484  #if !defined(SQLITE_OMIT_TRACE) && defined(SQLITE_ENABLE_IOTRACE)
002485  /*
002486  ** Print an IOTRACE message showing SQL content.
002487  */
002488  void sqlite3VdbeIOTraceSql(Vdbe *p){
002489    int nOp = p->nOp;
002490    VdbeOp *pOp;
002491    if( sqlite3IoTrace==0 ) return;
002492    if( nOp<1 ) return;
002493    pOp = &p->aOp[0];
002494    if( pOp->opcode==OP_Init && pOp->p4.z!=0 ){
002495      int i, j;
002496      char z[1000];
002497      sqlite3_snprintf(sizeof(z), z, "%s", pOp->p4.z);
002498      for(i=0; sqlite3Isspace(z[i]); i++){}
002499      for(j=0; z[i]; i++){
002500        if( sqlite3Isspace(z[i]) ){
002501          if( z[i-1]!=' ' ){
002502            z[j++] = ' ';
002503          }
002504        }else{
002505          z[j++] = z[i];
002506        }
002507      }
002508      z[j] = 0;
002509      sqlite3IoTrace("SQL %s\n", z);
002510    }
002511  }
002512  #endif /* !SQLITE_OMIT_TRACE && SQLITE_ENABLE_IOTRACE */
002513  
002514  /* An instance of this object describes bulk memory available for use
002515  ** by subcomponents of a prepared statement.  Space is allocated out
002516  ** of a ReusableSpace object by the allocSpace() routine below.
002517  */
002518  struct ReusableSpace {
002519    u8 *pSpace;            /* Available memory */
002520    sqlite3_int64 nFree;   /* Bytes of available memory */
002521    sqlite3_int64 nNeeded; /* Total bytes that could not be allocated */
002522  };
002523  
002524  /* Try to allocate nByte bytes of 8-byte aligned bulk memory for pBuf
002525  ** from the ReusableSpace object.  Return a pointer to the allocated
002526  ** memory on success.  If insufficient memory is available in the
002527  ** ReusableSpace object, increase the ReusableSpace.nNeeded
002528  ** value by the amount needed and return NULL.
002529  **
002530  ** If pBuf is not initially NULL, that means that the memory has already
002531  ** been allocated by a prior call to this routine, so just return a copy
002532  ** of pBuf and leave ReusableSpace unchanged.
002533  **
002534  ** This allocator is employed to repurpose unused slots at the end of the
002535  ** opcode array of prepared state for other memory needs of the prepared
002536  ** statement.
002537  */
002538  static void *allocSpace(
002539    struct ReusableSpace *p,  /* Bulk memory available for allocation */
002540    void *pBuf,               /* Pointer to a prior allocation */
002541    sqlite3_int64 nByte       /* Bytes of memory needed. */
002542  ){
002543    assert( EIGHT_BYTE_ALIGNMENT(p->pSpace) );
002544    if( pBuf==0 ){
002545      nByte = ROUND8P(nByte);
002546      if( nByte <= p->nFree ){
002547        p->nFree -= nByte;
002548        pBuf = &p->pSpace[p->nFree];
002549      }else{
002550        p->nNeeded += nByte;
002551      }
002552    }
002553    assert( EIGHT_BYTE_ALIGNMENT(pBuf) );
002554    return pBuf;
002555  }
002556  
002557  /*
002558  ** Rewind the VDBE back to the beginning in preparation for
002559  ** running it.
002560  */
002561  void sqlite3VdbeRewind(Vdbe *p){
002562  #if defined(SQLITE_DEBUG)
002563    int i;
002564  #endif
002565    assert( p!=0 );
002566    assert( p->eVdbeState==VDBE_INIT_STATE
002567         || p->eVdbeState==VDBE_READY_STATE
002568         || p->eVdbeState==VDBE_HALT_STATE );
002569  
002570    /* There should be at least one opcode.
002571    */
002572    assert( p->nOp>0 );
002573  
002574    p->eVdbeState = VDBE_READY_STATE;
002575  
002576  #ifdef SQLITE_DEBUG
002577    for(i=0; i<p->nMem; i++){
002578      assert( p->aMem[i].db==p->db );
002579    }
002580  #endif
002581    p->pc = -1;
002582    p->rc = SQLITE_OK;
002583    p->errorAction = OE_Abort;
002584    p->nChange = 0;
002585    p->cacheCtr = 1;
002586    p->minWriteFileFormat = 255;
002587    p->iStatement = 0;
002588    p->nFkConstraint = 0;
002589  #ifdef VDBE_PROFILE
002590    for(i=0; i<p->nOp; i++){
002591      p->aOp[i].nExec = 0;
002592      p->aOp[i].nCycle = 0;
002593    }
002594  #endif
002595  }
002596  
002597  /*
002598  ** Prepare a virtual machine for execution for the first time after
002599  ** creating the virtual machine.  This involves things such
002600  ** as allocating registers and initializing the program counter.
002601  ** After the VDBE has be prepped, it can be executed by one or more
002602  ** calls to sqlite3VdbeExec(). 
002603  **
002604  ** This function may be called exactly once on each virtual machine.
002605  ** After this routine is called the VM has been "packaged" and is ready
002606  ** to run.  After this routine is called, further calls to
002607  ** sqlite3VdbeAddOp() functions are prohibited.  This routine disconnects
002608  ** the Vdbe from the Parse object that helped generate it so that the
002609  ** the Vdbe becomes an independent entity and the Parse object can be
002610  ** destroyed.
002611  **
002612  ** Use the sqlite3VdbeRewind() procedure to restore a virtual machine back
002613  ** to its initial state after it has been run.
002614  */
002615  void sqlite3VdbeMakeReady(
002616    Vdbe *p,                       /* The VDBE */
002617    Parse *pParse                  /* Parsing context */
002618  ){
002619    sqlite3 *db;                   /* The database connection */
002620    int nVar;                      /* Number of parameters */
002621    int nMem;                      /* Number of VM memory registers */
002622    int nCursor;                   /* Number of cursors required */
002623    int nArg;                      /* Number of arguments in subprograms */
002624    int n;                         /* Loop counter */
002625    struct ReusableSpace x;        /* Reusable bulk memory */
002626  
002627    assert( p!=0 );
002628    assert( p->nOp>0 );
002629    assert( pParse!=0 );
002630    assert( p->eVdbeState==VDBE_INIT_STATE );
002631    assert( pParse==p->pParse );
002632    p->pVList = pParse->pVList;
002633    pParse->pVList =  0;
002634    db = p->db;
002635    assert( db->mallocFailed==0 );
002636    nVar = pParse->nVar;
002637    nMem = pParse->nMem;
002638    nCursor = pParse->nTab;
002639    nArg = pParse->nMaxArg;
002640   
002641    /* Each cursor uses a memory cell.  The first cursor (cursor 0) can
002642    ** use aMem[0] which is not otherwise used by the VDBE program.  Allocate
002643    ** space at the end of aMem[] for cursors 1 and greater.
002644    ** See also: allocateCursor().
002645    */
002646    nMem += nCursor;
002647    if( nCursor==0 && nMem>0 ) nMem++;  /* Space for aMem[0] even if not used */
002648  
002649    /* Figure out how much reusable memory is available at the end of the
002650    ** opcode array.  This extra memory will be reallocated for other elements
002651    ** of the prepared statement.
002652    */
002653    n = ROUND8P(sizeof(Op)*p->nOp);             /* Bytes of opcode memory used */
002654    x.pSpace = &((u8*)p->aOp)[n];               /* Unused opcode memory */
002655    assert( EIGHT_BYTE_ALIGNMENT(x.pSpace) );
002656    x.nFree = ROUNDDOWN8(pParse->szOpAlloc - n);  /* Bytes of unused memory */
002657    assert( x.nFree>=0 );
002658    assert( EIGHT_BYTE_ALIGNMENT(&x.pSpace[x.nFree]) );
002659  
002660    resolveP2Values(p, &nArg);
002661    p->usesStmtJournal = (u8)(pParse->isMultiWrite && pParse->mayAbort);
002662    if( pParse->explain ){
002663      if( nMem<10 ) nMem = 10;
002664      p->explain = pParse->explain;
002665      p->nResColumn = 12 - 4*p->explain;
002666    }
002667    p->expired = 0;
002668  
002669    /* Memory for registers, parameters, cursor, etc, is allocated in one or two
002670    ** passes.  On the first pass, we try to reuse unused memory at the
002671    ** end of the opcode array.  If we are unable to satisfy all memory
002672    ** requirements by reusing the opcode array tail, then the second
002673    ** pass will fill in the remainder using a fresh memory allocation. 
002674    **
002675    ** This two-pass approach that reuses as much memory as possible from
002676    ** the leftover memory at the end of the opcode array.  This can significantly
002677    ** reduce the amount of memory held by a prepared statement.
002678    */
002679    x.nNeeded = 0;
002680    p->aMem = allocSpace(&x, 0, nMem*sizeof(Mem));
002681    p->aVar = allocSpace(&x, 0, nVar*sizeof(Mem));
002682    p->apArg = allocSpace(&x, 0, nArg*sizeof(Mem*));
002683    p->apCsr = allocSpace(&x, 0, nCursor*sizeof(VdbeCursor*));
002684    if( x.nNeeded ){
002685      x.pSpace = p->pFree = sqlite3DbMallocRawNN(db, x.nNeeded);
002686      x.nFree = x.nNeeded;
002687      if( !db->mallocFailed ){
002688        p->aMem = allocSpace(&x, p->aMem, nMem*sizeof(Mem));
002689        p->aVar = allocSpace(&x, p->aVar, nVar*sizeof(Mem));
002690        p->apArg = allocSpace(&x, p->apArg, nArg*sizeof(Mem*));
002691        p->apCsr = allocSpace(&x, p->apCsr, nCursor*sizeof(VdbeCursor*));
002692      }
002693    }
002694  
002695    if( db->mallocFailed ){
002696      p->nVar = 0;
002697      p->nCursor = 0;
002698      p->nMem = 0;
002699    }else{
002700      p->nCursor = nCursor;
002701      p->nVar = (ynVar)nVar;
002702      initMemArray(p->aVar, nVar, db, MEM_Null);
002703      p->nMem = nMem;
002704      initMemArray(p->aMem, nMem, db, MEM_Undefined);
002705      memset(p->apCsr, 0, nCursor*sizeof(VdbeCursor*));
002706    }
002707    sqlite3VdbeRewind(p);
002708  }
002709  
002710  /*
002711  ** Close a VDBE cursor and release all the resources that cursor
002712  ** happens to hold.
002713  */
002714  void sqlite3VdbeFreeCursor(Vdbe *p, VdbeCursor *pCx){
002715    if( pCx ) sqlite3VdbeFreeCursorNN(p,pCx);
002716  }
002717  static SQLITE_NOINLINE void freeCursorWithCache(Vdbe *p, VdbeCursor *pCx){
002718    VdbeTxtBlbCache *pCache = pCx->pCache;
002719    assert( pCx->colCache );
002720    pCx->colCache = 0;
002721    pCx->pCache = 0;
002722    if( pCache->pCValue ){
002723      sqlite3RCStrUnref(pCache->pCValue);
002724      pCache->pCValue = 0;
002725    }
002726    sqlite3DbFree(p->db, pCache);
002727    sqlite3VdbeFreeCursorNN(p, pCx);
002728  }
002729  void sqlite3VdbeFreeCursorNN(Vdbe *p, VdbeCursor *pCx){
002730    if( pCx->colCache ){
002731      freeCursorWithCache(p, pCx);
002732      return;
002733    }
002734    switch( pCx->eCurType ){
002735      case CURTYPE_SORTER: {
002736        sqlite3VdbeSorterClose(p->db, pCx);
002737        break;
002738      }
002739      case CURTYPE_BTREE: {
002740        assert( pCx->uc.pCursor!=0 );
002741        sqlite3BtreeCloseCursor(pCx->uc.pCursor);
002742        break;
002743      }
002744  #ifndef SQLITE_OMIT_VIRTUALTABLE
002745      case CURTYPE_VTAB: {
002746        sqlite3_vtab_cursor *pVCur = pCx->uc.pVCur;
002747        const sqlite3_module *pModule = pVCur->pVtab->pModule;
002748        assert( pVCur->pVtab->nRef>0 );
002749        pVCur->pVtab->nRef--;
002750        pModule->xClose(pVCur);
002751        break;
002752      }
002753  #endif
002754    }
002755  }
002756  
002757  /*
002758  ** Close all cursors in the current frame.
002759  */
002760  static void closeCursorsInFrame(Vdbe *p){
002761    int i;
002762    for(i=0; i<p->nCursor; i++){
002763      VdbeCursor *pC = p->apCsr[i];
002764      if( pC ){
002765        sqlite3VdbeFreeCursorNN(p, pC);
002766        p->apCsr[i] = 0;
002767      }
002768    }
002769  }
002770  
002771  /*
002772  ** Copy the values stored in the VdbeFrame structure to its Vdbe. This
002773  ** is used, for example, when a trigger sub-program is halted to restore
002774  ** control to the main program.
002775  */
002776  int sqlite3VdbeFrameRestore(VdbeFrame *pFrame){
002777    Vdbe *v = pFrame->v;
002778    closeCursorsInFrame(v);
002779    v->aOp = pFrame->aOp;
002780    v->nOp = pFrame->nOp;
002781    v->aMem = pFrame->aMem;
002782    v->nMem = pFrame->nMem;
002783    v->apCsr = pFrame->apCsr;
002784    v->nCursor = pFrame->nCursor;
002785    v->db->lastRowid = pFrame->lastRowid;
002786    v->nChange = pFrame->nChange;
002787    v->db->nChange = pFrame->nDbChange;
002788    sqlite3VdbeDeleteAuxData(v->db, &v->pAuxData, -1, 0);
002789    v->pAuxData = pFrame->pAuxData;
002790    pFrame->pAuxData = 0;
002791    return pFrame->pc;
002792  }
002793  
002794  /*
002795  ** Close all cursors.
002796  **
002797  ** Also release any dynamic memory held by the VM in the Vdbe.aMem memory
002798  ** cell array. This is necessary as the memory cell array may contain
002799  ** pointers to VdbeFrame objects, which may in turn contain pointers to
002800  ** open cursors.
002801  */
002802  static void closeAllCursors(Vdbe *p){
002803    if( p->pFrame ){
002804      VdbeFrame *pFrame;
002805      for(pFrame=p->pFrame; pFrame->pParent; pFrame=pFrame->pParent);
002806      sqlite3VdbeFrameRestore(pFrame);
002807      p->pFrame = 0;
002808      p->nFrame = 0;
002809    }
002810    assert( p->nFrame==0 );
002811    closeCursorsInFrame(p);
002812    releaseMemArray(p->aMem, p->nMem);
002813    while( p->pDelFrame ){
002814      VdbeFrame *pDel = p->pDelFrame;
002815      p->pDelFrame = pDel->pParent;
002816      sqlite3VdbeFrameDelete(pDel);
002817    }
002818  
002819    /* Delete any auxdata allocations made by the VM */
002820    if( p->pAuxData ) sqlite3VdbeDeleteAuxData(p->db, &p->pAuxData, -1, 0);
002821    assert( p->pAuxData==0 );
002822  }
002823  
002824  /*
002825  ** Set the number of result columns that will be returned by this SQL
002826  ** statement. This is now set at compile time, rather than during
002827  ** execution of the vdbe program so that sqlite3_column_count() can
002828  ** be called on an SQL statement before sqlite3_step().
002829  */
002830  void sqlite3VdbeSetNumCols(Vdbe *p, int nResColumn){
002831    int n;
002832    sqlite3 *db = p->db;
002833  
002834    if( p->nResAlloc ){
002835      releaseMemArray(p->aColName, p->nResAlloc*COLNAME_N);
002836      sqlite3DbFree(db, p->aColName);
002837    }
002838    n = nResColumn*COLNAME_N;
002839    p->nResColumn = p->nResAlloc = (u16)nResColumn;
002840    p->aColName = (Mem*)sqlite3DbMallocRawNN(db, sizeof(Mem)*n );
002841    if( p->aColName==0 ) return;
002842    initMemArray(p->aColName, n, db, MEM_Null);
002843  }
002844  
002845  /*
002846  ** Set the name of the idx'th column to be returned by the SQL statement.
002847  ** zName must be a pointer to a nul terminated string.
002848  **
002849  ** This call must be made after a call to sqlite3VdbeSetNumCols().
002850  **
002851  ** The final parameter, xDel, must be one of SQLITE_DYNAMIC, SQLITE_STATIC
002852  ** or SQLITE_TRANSIENT. If it is SQLITE_DYNAMIC, then the buffer pointed
002853  ** to by zName will be freed by sqlite3DbFree() when the vdbe is destroyed.
002854  */
002855  int sqlite3VdbeSetColName(
002856    Vdbe *p,                         /* Vdbe being configured */
002857    int idx,                         /* Index of column zName applies to */
002858    int var,                         /* One of the COLNAME_* constants */
002859    const char *zName,               /* Pointer to buffer containing name */
002860    void (*xDel)(void*)              /* Memory management strategy for zName */
002861  ){
002862    int rc;
002863    Mem *pColName;
002864    assert( idx<p->nResAlloc );
002865    assert( var<COLNAME_N );
002866    if( p->db->mallocFailed ){
002867      assert( !zName || xDel!=SQLITE_DYNAMIC );
002868      return SQLITE_NOMEM_BKPT;
002869    }
002870    assert( p->aColName!=0 );
002871    pColName = &(p->aColName[idx+var*p->nResAlloc]);
002872    rc = sqlite3VdbeMemSetStr(pColName, zName, -1, SQLITE_UTF8, xDel);
002873    assert( rc!=0 || !zName || (pColName->flags&MEM_Term)!=0 );
002874    return rc;
002875  }
002876  
002877  /*
002878  ** A read or write transaction may or may not be active on database handle
002879  ** db. If a transaction is active, commit it. If there is a
002880  ** write-transaction spanning more than one database file, this routine
002881  ** takes care of the super-journal trickery.
002882  */
002883  static int vdbeCommit(sqlite3 *db, Vdbe *p){
002884    int i;
002885    int nTrans = 0;  /* Number of databases with an active write-transaction
002886                     ** that are candidates for a two-phase commit using a
002887                     ** super-journal */
002888    int rc = SQLITE_OK;
002889    int needXcommit = 0;
002890  
002891  #ifdef SQLITE_OMIT_VIRTUALTABLE
002892    /* With this option, sqlite3VtabSync() is defined to be simply
002893    ** SQLITE_OK so p is not used.
002894    */
002895    UNUSED_PARAMETER(p);
002896  #endif
002897  
002898    /* Before doing anything else, call the xSync() callback for any
002899    ** virtual module tables written in this transaction. This has to
002900    ** be done before determining whether a super-journal file is
002901    ** required, as an xSync() callback may add an attached database
002902    ** to the transaction.
002903    */
002904    rc = sqlite3VtabSync(db, p);
002905  
002906    /* This loop determines (a) if the commit hook should be invoked and
002907    ** (b) how many database files have open write transactions, not
002908    ** including the temp database. (b) is important because if more than
002909    ** one database file has an open write transaction, a super-journal
002910    ** file is required for an atomic commit.
002911    */
002912    for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
002913      Btree *pBt = db->aDb[i].pBt;
002914      if( sqlite3BtreeTxnState(pBt)==SQLITE_TXN_WRITE ){
002915        /* Whether or not a database might need a super-journal depends upon
002916        ** its journal mode (among other things).  This matrix determines which
002917        ** journal modes use a super-journal and which do not */
002918        static const u8 aMJNeeded[] = {
002919          /* DELETE   */  1,
002920          /* PERSIST   */ 1,
002921          /* OFF       */ 0,
002922          /* TRUNCATE  */ 1,
002923          /* MEMORY    */ 0,
002924          /* WAL       */ 0
002925        };
002926        Pager *pPager;   /* Pager associated with pBt */
002927        needXcommit = 1;
002928        sqlite3BtreeEnter(pBt);
002929        pPager = sqlite3BtreePager(pBt);
002930        if( db->aDb[i].safety_level!=PAGER_SYNCHRONOUS_OFF
002931         && aMJNeeded[sqlite3PagerGetJournalMode(pPager)]
002932         && sqlite3PagerIsMemdb(pPager)==0
002933        ){
002934          assert( i!=1 );
002935          nTrans++;
002936        }
002937        rc = sqlite3PagerExclusiveLock(pPager);
002938        sqlite3BtreeLeave(pBt);
002939      }
002940    }
002941    if( rc!=SQLITE_OK ){
002942      return rc;
002943    }
002944  
002945    /* If there are any write-transactions at all, invoke the commit hook */
002946    if( needXcommit && db->xCommitCallback ){
002947      rc = db->xCommitCallback(db->pCommitArg);
002948      if( rc ){
002949        return SQLITE_CONSTRAINT_COMMITHOOK;
002950      }
002951    }
002952  
002953    /* The simple case - no more than one database file (not counting the
002954    ** TEMP database) has a transaction active.   There is no need for the
002955    ** super-journal.
002956    **
002957    ** If the return value of sqlite3BtreeGetFilename() is a zero length
002958    ** string, it means the main database is :memory: or a temp file.  In
002959    ** that case we do not support atomic multi-file commits, so use the
002960    ** simple case then too.
002961    */
002962    if( 0==sqlite3Strlen30(sqlite3BtreeGetFilename(db->aDb[0].pBt))
002963     || nTrans<=1
002964    ){
002965      for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
002966        Btree *pBt = db->aDb[i].pBt;
002967        if( pBt ){
002968          rc = sqlite3BtreeCommitPhaseOne(pBt, 0);
002969        }
002970      }
002971  
002972      /* Do the commit only if all databases successfully complete phase 1.
002973      ** If one of the BtreeCommitPhaseOne() calls fails, this indicates an
002974      ** IO error while deleting or truncating a journal file. It is unlikely,
002975      ** but could happen. In this case abandon processing and return the error.
002976      */
002977      for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
002978        Btree *pBt = db->aDb[i].pBt;
002979        if( pBt ){
002980          rc = sqlite3BtreeCommitPhaseTwo(pBt, 0);
002981        }
002982      }
002983      if( rc==SQLITE_OK ){
002984        sqlite3VtabCommit(db);
002985      }
002986    }
002987  
002988    /* The complex case - There is a multi-file write-transaction active.
002989    ** This requires a super-journal file to ensure the transaction is
002990    ** committed atomically.
002991    */
002992  #ifndef SQLITE_OMIT_DISKIO
002993    else{
002994      sqlite3_vfs *pVfs = db->pVfs;
002995      char *zSuper = 0;   /* File-name for the super-journal */
002996      char const *zMainFile = sqlite3BtreeGetFilename(db->aDb[0].pBt);
002997      sqlite3_file *pSuperJrnl = 0;
002998      i64 offset = 0;
002999      int res;
003000      int retryCount = 0;
003001      int nMainFile;
003002  
003003      /* Select a super-journal file name */
003004      nMainFile = sqlite3Strlen30(zMainFile);
003005      zSuper = sqlite3MPrintf(db, "%.4c%s%.16c", 0,zMainFile,0);
003006      if( zSuper==0 ) return SQLITE_NOMEM_BKPT;
003007      zSuper += 4;
003008      do {
003009        u32 iRandom;
003010        if( retryCount ){
003011          if( retryCount>100 ){
003012            sqlite3_log(SQLITE_FULL, "MJ delete: %s", zSuper);
003013            sqlite3OsDelete(pVfs, zSuper, 0);
003014            break;
003015          }else if( retryCount==1 ){
003016            sqlite3_log(SQLITE_FULL, "MJ collide: %s", zSuper);
003017          }
003018        }
003019        retryCount++;
003020        sqlite3_randomness(sizeof(iRandom), &iRandom);
003021        sqlite3_snprintf(13, &zSuper[nMainFile], "-mj%06X9%02X",
003022                                 (iRandom>>8)&0xffffff, iRandom&0xff);
003023        /* The antipenultimate character of the super-journal name must
003024        ** be "9" to avoid name collisions when using 8+3 filenames. */
003025        assert( zSuper[sqlite3Strlen30(zSuper)-3]=='9' );
003026        sqlite3FileSuffix3(zMainFile, zSuper);
003027        rc = sqlite3OsAccess(pVfs, zSuper, SQLITE_ACCESS_EXISTS, &res);
003028      }while( rc==SQLITE_OK && res );
003029      if( rc==SQLITE_OK ){
003030        /* Open the super-journal. */
003031        rc = sqlite3OsOpenMalloc(pVfs, zSuper, &pSuperJrnl,
003032            SQLITE_OPEN_READWRITE|SQLITE_OPEN_CREATE|
003033            SQLITE_OPEN_EXCLUSIVE|SQLITE_OPEN_SUPER_JOURNAL, 0
003034        );
003035      }
003036      if( rc!=SQLITE_OK ){
003037        sqlite3DbFree(db, zSuper-4);
003038        return rc;
003039      }
003040  
003041      /* Write the name of each database file in the transaction into the new
003042      ** super-journal file. If an error occurs at this point close
003043      ** and delete the super-journal file. All the individual journal files
003044      ** still have 'null' as the super-journal pointer, so they will roll
003045      ** back independently if a failure occurs.
003046      */
003047      for(i=0; i<db->nDb; i++){
003048        Btree *pBt = db->aDb[i].pBt;
003049        if( sqlite3BtreeTxnState(pBt)==SQLITE_TXN_WRITE ){
003050          char const *zFile = sqlite3BtreeGetJournalname(pBt);
003051          if( zFile==0 ){
003052            continue;  /* Ignore TEMP and :memory: databases */
003053          }
003054          assert( zFile[0]!=0 );
003055          rc = sqlite3OsWrite(pSuperJrnl, zFile, sqlite3Strlen30(zFile)+1,offset);
003056          offset += sqlite3Strlen30(zFile)+1;
003057          if( rc!=SQLITE_OK ){
003058            sqlite3OsCloseFree(pSuperJrnl);
003059            sqlite3OsDelete(pVfs, zSuper, 0);
003060            sqlite3DbFree(db, zSuper-4);
003061            return rc;
003062          }
003063        }
003064      }
003065  
003066      /* Sync the super-journal file. If the IOCAP_SEQUENTIAL device
003067      ** flag is set this is not required.
003068      */
003069      if( 0==(sqlite3OsDeviceCharacteristics(pSuperJrnl)&SQLITE_IOCAP_SEQUENTIAL)
003070       && SQLITE_OK!=(rc = sqlite3OsSync(pSuperJrnl, SQLITE_SYNC_NORMAL))
003071      ){
003072        sqlite3OsCloseFree(pSuperJrnl);
003073        sqlite3OsDelete(pVfs, zSuper, 0);
003074        sqlite3DbFree(db, zSuper-4);
003075        return rc;
003076      }
003077  
003078      /* Sync all the db files involved in the transaction. The same call
003079      ** sets the super-journal pointer in each individual journal. If
003080      ** an error occurs here, do not delete the super-journal file.
003081      **
003082      ** If the error occurs during the first call to
003083      ** sqlite3BtreeCommitPhaseOne(), then there is a chance that the
003084      ** super-journal file will be orphaned. But we cannot delete it,
003085      ** in case the super-journal file name was written into the journal
003086      ** file before the failure occurred.
003087      */
003088      for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
003089        Btree *pBt = db->aDb[i].pBt;
003090        if( pBt ){
003091          rc = sqlite3BtreeCommitPhaseOne(pBt, zSuper);
003092        }
003093      }
003094      sqlite3OsCloseFree(pSuperJrnl);
003095      assert( rc!=SQLITE_BUSY );
003096      if( rc!=SQLITE_OK ){
003097        sqlite3DbFree(db, zSuper-4);
003098        return rc;
003099      }
003100  
003101      /* Delete the super-journal file. This commits the transaction. After
003102      ** doing this the directory is synced again before any individual
003103      ** transaction files are deleted.
003104      */
003105      rc = sqlite3OsDelete(pVfs, zSuper, 1);
003106      sqlite3DbFree(db, zSuper-4);
003107      zSuper = 0;
003108      if( rc ){
003109        return rc;
003110      }
003111  
003112      /* All files and directories have already been synced, so the following
003113      ** calls to sqlite3BtreeCommitPhaseTwo() are only closing files and
003114      ** deleting or truncating journals. If something goes wrong while
003115      ** this is happening we don't really care. The integrity of the
003116      ** transaction is already guaranteed, but some stray 'cold' journals
003117      ** may be lying around. Returning an error code won't help matters.
003118      */
003119      disable_simulated_io_errors();
003120      sqlite3BeginBenignMalloc();
003121      for(i=0; i<db->nDb; i++){
003122        Btree *pBt = db->aDb[i].pBt;
003123        if( pBt ){
003124          sqlite3BtreeCommitPhaseTwo(pBt, 1);
003125        }
003126      }
003127      sqlite3EndBenignMalloc();
003128      enable_simulated_io_errors();
003129  
003130      sqlite3VtabCommit(db);
003131    }
003132  #endif
003133  
003134    return rc;
003135  }
003136  
003137  /*
003138  ** This routine checks that the sqlite3.nVdbeActive count variable
003139  ** matches the number of vdbe's in the list sqlite3.pVdbe that are
003140  ** currently active. An assertion fails if the two counts do not match.
003141  ** This is an internal self-check only - it is not an essential processing
003142  ** step.
003143  **
003144  ** This is a no-op if NDEBUG is defined.
003145  */
003146  #ifndef NDEBUG
003147  static void checkActiveVdbeCnt(sqlite3 *db){
003148    Vdbe *p;
003149    int cnt = 0;
003150    int nWrite = 0;
003151    int nRead = 0;
003152    p = db->pVdbe;
003153    while( p ){
003154      if( sqlite3_stmt_busy((sqlite3_stmt*)p) ){
003155        cnt++;
003156        if( p->readOnly==0 ) nWrite++;
003157        if( p->bIsReader ) nRead++;
003158      }
003159      p = p->pVNext;
003160    }
003161    assert( cnt==db->nVdbeActive );
003162    assert( nWrite==db->nVdbeWrite );
003163    assert( nRead==db->nVdbeRead );
003164  }
003165  #else
003166  #define checkActiveVdbeCnt(x)
003167  #endif
003168  
003169  /*
003170  ** If the Vdbe passed as the first argument opened a statement-transaction,
003171  ** close it now. Argument eOp must be either SAVEPOINT_ROLLBACK or
003172  ** SAVEPOINT_RELEASE. If it is SAVEPOINT_ROLLBACK, then the statement
003173  ** transaction is rolled back. If eOp is SAVEPOINT_RELEASE, then the
003174  ** statement transaction is committed.
003175  **
003176  ** If an IO error occurs, an SQLITE_IOERR_XXX error code is returned.
003177  ** Otherwise SQLITE_OK.
003178  */
003179  static SQLITE_NOINLINE int vdbeCloseStatement(Vdbe *p, int eOp){
003180    sqlite3 *const db = p->db;
003181    int rc = SQLITE_OK;
003182    int i;
003183    const int iSavepoint = p->iStatement-1;
003184  
003185    assert( eOp==SAVEPOINT_ROLLBACK || eOp==SAVEPOINT_RELEASE);
003186    assert( db->nStatement>0 );
003187    assert( p->iStatement==(db->nStatement+db->nSavepoint) );
003188  
003189    for(i=0; i<db->nDb; i++){
003190      int rc2 = SQLITE_OK;
003191      Btree *pBt = db->aDb[i].pBt;
003192      if( pBt ){
003193        if( eOp==SAVEPOINT_ROLLBACK ){
003194          rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_ROLLBACK, iSavepoint);
003195        }
003196        if( rc2==SQLITE_OK ){
003197          rc2 = sqlite3BtreeSavepoint(pBt, SAVEPOINT_RELEASE, iSavepoint);
003198        }
003199        if( rc==SQLITE_OK ){
003200          rc = rc2;
003201        }
003202      }
003203    }
003204    db->nStatement--;
003205    p->iStatement = 0;
003206  
003207    if( rc==SQLITE_OK ){
003208      if( eOp==SAVEPOINT_ROLLBACK ){
003209        rc = sqlite3VtabSavepoint(db, SAVEPOINT_ROLLBACK, iSavepoint);
003210      }
003211      if( rc==SQLITE_OK ){
003212        rc = sqlite3VtabSavepoint(db, SAVEPOINT_RELEASE, iSavepoint);
003213      }
003214    }
003215  
003216    /* If the statement transaction is being rolled back, also restore the
003217    ** database handles deferred constraint counter to the value it had when
003218    ** the statement transaction was opened.  */
003219    if( eOp==SAVEPOINT_ROLLBACK ){
003220      db->nDeferredCons = p->nStmtDefCons;
003221      db->nDeferredImmCons = p->nStmtDefImmCons;
003222    }
003223    return rc;
003224  }
003225  int sqlite3VdbeCloseStatement(Vdbe *p, int eOp){
003226    if( p->db->nStatement && p->iStatement ){
003227      return vdbeCloseStatement(p, eOp);
003228    }
003229    return SQLITE_OK;
003230  }
003231  
003232  
003233  /*
003234  ** This function is called when a transaction opened by the database
003235  ** handle associated with the VM passed as an argument is about to be
003236  ** committed. If there are outstanding deferred foreign key constraint
003237  ** violations, return SQLITE_ERROR. Otherwise, SQLITE_OK.
003238  **
003239  ** If there are outstanding FK violations and this function returns
003240  ** SQLITE_ERROR, set the result of the VM to SQLITE_CONSTRAINT_FOREIGNKEY
003241  ** and write an error message to it. Then return SQLITE_ERROR.
003242  */
003243  #ifndef SQLITE_OMIT_FOREIGN_KEY
003244  int sqlite3VdbeCheckFk(Vdbe *p, int deferred){
003245    sqlite3 *db = p->db;
003246    if( (deferred && (db->nDeferredCons+db->nDeferredImmCons)>0)
003247     || (!deferred && p->nFkConstraint>0)
003248    ){
003249      p->rc = SQLITE_CONSTRAINT_FOREIGNKEY;
003250      p->errorAction = OE_Abort;
003251      sqlite3VdbeError(p, "FOREIGN KEY constraint failed");
003252      if( (p->prepFlags & SQLITE_PREPARE_SAVESQL)==0 ) return SQLITE_ERROR;
003253      return SQLITE_CONSTRAINT_FOREIGNKEY;
003254    }
003255    return SQLITE_OK;
003256  }
003257  #endif
003258  
003259  /*
003260  ** This routine is called the when a VDBE tries to halt.  If the VDBE
003261  ** has made changes and is in autocommit mode, then commit those
003262  ** changes.  If a rollback is needed, then do the rollback.
003263  **
003264  ** This routine is the only way to move the sqlite3eOpenState of a VM from
003265  ** SQLITE_STATE_RUN to SQLITE_STATE_HALT.  It is harmless to
003266  ** call this on a VM that is in the SQLITE_STATE_HALT state.
003267  **
003268  ** Return an error code.  If the commit could not complete because of
003269  ** lock contention, return SQLITE_BUSY.  If SQLITE_BUSY is returned, it
003270  ** means the close did not happen and needs to be repeated.
003271  */
003272  int sqlite3VdbeHalt(Vdbe *p){
003273    int rc;                         /* Used to store transient return codes */
003274    sqlite3 *db = p->db;
003275  
003276    /* This function contains the logic that determines if a statement or
003277    ** transaction will be committed or rolled back as a result of the
003278    ** execution of this virtual machine.
003279    **
003280    ** If any of the following errors occur:
003281    **
003282    **     SQLITE_NOMEM
003283    **     SQLITE_IOERR
003284    **     SQLITE_FULL
003285    **     SQLITE_INTERRUPT
003286    **
003287    ** Then the internal cache might have been left in an inconsistent
003288    ** state.  We need to rollback the statement transaction, if there is
003289    ** one, or the complete transaction if there is no statement transaction.
003290    */
003291  
003292    assert( p->eVdbeState==VDBE_RUN_STATE );
003293    if( db->mallocFailed ){
003294      p->rc = SQLITE_NOMEM_BKPT;
003295    }
003296    closeAllCursors(p);
003297    checkActiveVdbeCnt(db);
003298  
003299    /* No commit or rollback needed if the program never started or if the
003300    ** SQL statement does not read or write a database file.  */
003301    if( p->bIsReader ){
003302      int mrc;   /* Primary error code from p->rc */
003303      int eStatementOp = 0;
003304      int isSpecialError;            /* Set to true if a 'special' error */
003305  
003306      /* Lock all btrees used by the statement */
003307      sqlite3VdbeEnter(p);
003308  
003309      /* Check for one of the special errors */
003310      if( p->rc ){
003311        mrc = p->rc & 0xff;
003312        isSpecialError = mrc==SQLITE_NOMEM
003313                      || mrc==SQLITE_IOERR
003314                      || mrc==SQLITE_INTERRUPT
003315                      || mrc==SQLITE_FULL;
003316      }else{
003317        mrc = isSpecialError = 0;
003318      }
003319      if( isSpecialError ){
003320        /* If the query was read-only and the error code is SQLITE_INTERRUPT,
003321        ** no rollback is necessary. Otherwise, at least a savepoint
003322        ** transaction must be rolled back to restore the database to a
003323        ** consistent state.
003324        **
003325        ** Even if the statement is read-only, it is important to perform
003326        ** a statement or transaction rollback operation. If the error
003327        ** occurred while writing to the journal, sub-journal or database
003328        ** file as part of an effort to free up cache space (see function
003329        ** pagerStress() in pager.c), the rollback is required to restore
003330        ** the pager to a consistent state.
003331        */
003332        if( !p->readOnly || mrc!=SQLITE_INTERRUPT ){
003333          if( (mrc==SQLITE_NOMEM || mrc==SQLITE_FULL) && p->usesStmtJournal ){
003334            eStatementOp = SAVEPOINT_ROLLBACK;
003335          }else{
003336            /* We are forced to roll back the active transaction. Before doing
003337            ** so, abort any other statements this handle currently has active.
003338            */
003339            sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
003340            sqlite3CloseSavepoints(db);
003341            db->autoCommit = 1;
003342            p->nChange = 0;
003343          }
003344        }
003345      }
003346  
003347      /* Check for immediate foreign key violations. */
003348      if( p->rc==SQLITE_OK || (p->errorAction==OE_Fail && !isSpecialError) ){
003349        sqlite3VdbeCheckFk(p, 0);
003350      }
003351   
003352      /* If the auto-commit flag is set and this is the only active writer
003353      ** VM, then we do either a commit or rollback of the current transaction.
003354      **
003355      ** Note: This block also runs if one of the special errors handled
003356      ** above has occurred.
003357      */
003358      if( !sqlite3VtabInSync(db)
003359       && db->autoCommit
003360       && db->nVdbeWrite==(p->readOnly==0)
003361      ){
003362        if( p->rc==SQLITE_OK || (p->errorAction==OE_Fail && !isSpecialError) ){
003363          rc = sqlite3VdbeCheckFk(p, 1);
003364          if( rc!=SQLITE_OK ){
003365            if( NEVER(p->readOnly) ){
003366              sqlite3VdbeLeave(p);
003367              return SQLITE_ERROR;
003368            }
003369            rc = SQLITE_CONSTRAINT_FOREIGNKEY;
003370          }else if( db->flags & SQLITE_CorruptRdOnly ){
003371            rc = SQLITE_CORRUPT;
003372            db->flags &= ~SQLITE_CorruptRdOnly;
003373          }else{
003374            /* The auto-commit flag is true, the vdbe program was successful
003375            ** or hit an 'OR FAIL' constraint and there are no deferred foreign
003376            ** key constraints to hold up the transaction. This means a commit
003377            ** is required. */
003378            rc = vdbeCommit(db, p);
003379          }
003380          if( rc==SQLITE_BUSY && p->readOnly ){
003381            sqlite3VdbeLeave(p);
003382            return SQLITE_BUSY;
003383          }else if( rc!=SQLITE_OK ){
003384            sqlite3SystemError(db, rc);
003385            p->rc = rc;
003386            sqlite3RollbackAll(db, SQLITE_OK);
003387            p->nChange = 0;
003388          }else{
003389            db->nDeferredCons = 0;
003390            db->nDeferredImmCons = 0;
003391            db->flags &= ~(u64)SQLITE_DeferFKs;
003392            sqlite3CommitInternalChanges(db);
003393          }
003394        }else if( p->rc==SQLITE_SCHEMA && db->nVdbeActive>1 ){
003395          p->nChange = 0;
003396        }else{
003397          sqlite3RollbackAll(db, SQLITE_OK);
003398          p->nChange = 0;
003399        }
003400        db->nStatement = 0;
003401      }else if( eStatementOp==0 ){
003402        if( p->rc==SQLITE_OK || p->errorAction==OE_Fail ){
003403          eStatementOp = SAVEPOINT_RELEASE;
003404        }else if( p->errorAction==OE_Abort ){
003405          eStatementOp = SAVEPOINT_ROLLBACK;
003406        }else{
003407          sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
003408          sqlite3CloseSavepoints(db);
003409          db->autoCommit = 1;
003410          p->nChange = 0;
003411        }
003412      }
003413   
003414      /* If eStatementOp is non-zero, then a statement transaction needs to
003415      ** be committed or rolled back. Call sqlite3VdbeCloseStatement() to
003416      ** do so. If this operation returns an error, and the current statement
003417      ** error code is SQLITE_OK or SQLITE_CONSTRAINT, then promote the
003418      ** current statement error code.
003419      */
003420      if( eStatementOp ){
003421        rc = sqlite3VdbeCloseStatement(p, eStatementOp);
003422        if( rc ){
003423          if( p->rc==SQLITE_OK || (p->rc&0xff)==SQLITE_CONSTRAINT ){
003424            p->rc = rc;
003425            sqlite3DbFree(db, p->zErrMsg);
003426            p->zErrMsg = 0;
003427          }
003428          sqlite3RollbackAll(db, SQLITE_ABORT_ROLLBACK);
003429          sqlite3CloseSavepoints(db);
003430          db->autoCommit = 1;
003431          p->nChange = 0;
003432        }
003433      }
003434   
003435      /* If this was an INSERT, UPDATE or DELETE and no statement transaction
003436      ** has been rolled back, update the database connection change-counter.
003437      */
003438      if( p->changeCntOn ){
003439        if( eStatementOp!=SAVEPOINT_ROLLBACK ){
003440          sqlite3VdbeSetChanges(db, p->nChange);
003441        }else{
003442          sqlite3VdbeSetChanges(db, 0);
003443        }
003444        p->nChange = 0;
003445      }
003446  
003447      /* Release the locks */
003448      sqlite3VdbeLeave(p);
003449    }
003450  
003451    /* We have successfully halted and closed the VM.  Record this fact. */
003452    db->nVdbeActive--;
003453    if( !p->readOnly ) db->nVdbeWrite--;
003454    if( p->bIsReader ) db->nVdbeRead--;
003455    assert( db->nVdbeActive>=db->nVdbeRead );
003456    assert( db->nVdbeRead>=db->nVdbeWrite );
003457    assert( db->nVdbeWrite>=0 );
003458    p->eVdbeState = VDBE_HALT_STATE;
003459    checkActiveVdbeCnt(db);
003460    if( db->mallocFailed ){
003461      p->rc = SQLITE_NOMEM_BKPT;
003462    }
003463  
003464    /* If the auto-commit flag is set to true, then any locks that were held
003465    ** by connection db have now been released. Call sqlite3ConnectionUnlocked()
003466    ** to invoke any required unlock-notify callbacks.
003467    */
003468    if( db->autoCommit ){
003469      sqlite3ConnectionUnlocked(db);
003470    }
003471  
003472    assert( db->nVdbeActive>0 || db->autoCommit==0 || db->nStatement==0 );
003473    return (p->rc==SQLITE_BUSY ? SQLITE_BUSY : SQLITE_OK);
003474  }
003475  
003476  
003477  /*
003478  ** Each VDBE holds the result of the most recent sqlite3_step() call
003479  ** in p->rc.  This routine sets that result back to SQLITE_OK.
003480  */
003481  void sqlite3VdbeResetStepResult(Vdbe *p){
003482    p->rc = SQLITE_OK;
003483  }
003484  
003485  /*
003486  ** Copy the error code and error message belonging to the VDBE passed
003487  ** as the first argument to its database handle (so that they will be
003488  ** returned by calls to sqlite3_errcode() and sqlite3_errmsg()).
003489  **
003490  ** This function does not clear the VDBE error code or message, just
003491  ** copies them to the database handle.
003492  */
003493  int sqlite3VdbeTransferError(Vdbe *p){
003494    sqlite3 *db = p->db;
003495    int rc = p->rc;
003496    if( p->zErrMsg ){
003497      db->bBenignMalloc++;
003498      sqlite3BeginBenignMalloc();
003499      if( db->pErr==0 ) db->pErr = sqlite3ValueNew(db);
003500      sqlite3ValueSetStr(db->pErr, -1, p->zErrMsg, SQLITE_UTF8, SQLITE_TRANSIENT);
003501      sqlite3EndBenignMalloc();
003502      db->bBenignMalloc--;
003503    }else if( db->pErr ){
003504      sqlite3ValueSetNull(db->pErr);
003505    }
003506    db->errCode = rc;
003507    db->errByteOffset = -1;
003508    return rc;
003509  }
003510  
003511  #ifdef SQLITE_ENABLE_SQLLOG
003512  /*
003513  ** If an SQLITE_CONFIG_SQLLOG hook is registered and the VM has been run,
003514  ** invoke it.
003515  */
003516  static void vdbeInvokeSqllog(Vdbe *v){
003517    if( sqlite3GlobalConfig.xSqllog && v->rc==SQLITE_OK && v->zSql && v->pc>=0 ){
003518      char *zExpanded = sqlite3VdbeExpandSql(v, v->zSql);
003519      assert( v->db->init.busy==0 );
003520      if( zExpanded ){
003521        sqlite3GlobalConfig.xSqllog(
003522            sqlite3GlobalConfig.pSqllogArg, v->db, zExpanded, 1
003523        );
003524        sqlite3DbFree(v->db, zExpanded);
003525      }
003526    }
003527  }
003528  #else
003529  # define vdbeInvokeSqllog(x)
003530  #endif
003531  
003532  /*
003533  ** Clean up a VDBE after execution but do not delete the VDBE just yet.
003534  ** Write any error messages into *pzErrMsg.  Return the result code.
003535  **
003536  ** After this routine is run, the VDBE should be ready to be executed
003537  ** again.
003538  **
003539  ** To look at it another way, this routine resets the state of the
003540  ** virtual machine from VDBE_RUN_STATE or VDBE_HALT_STATE back to
003541  ** VDBE_READY_STATE.
003542  */
003543  int sqlite3VdbeReset(Vdbe *p){
003544  #if defined(SQLITE_DEBUG) || defined(VDBE_PROFILE)
003545    int i;
003546  #endif
003547  
003548    sqlite3 *db;
003549    db = p->db;
003550  
003551    /* If the VM did not run to completion or if it encountered an
003552    ** error, then it might not have been halted properly.  So halt
003553    ** it now.
003554    */
003555    if( p->eVdbeState==VDBE_RUN_STATE ) sqlite3VdbeHalt(p);
003556  
003557    /* If the VDBE has been run even partially, then transfer the error code
003558    ** and error message from the VDBE into the main database structure.  But
003559    ** if the VDBE has just been set to run but has not actually executed any
003560    ** instructions yet, leave the main database error information unchanged.
003561    */
003562    if( p->pc>=0 ){
003563      vdbeInvokeSqllog(p);
003564      if( db->pErr || p->zErrMsg ){
003565        sqlite3VdbeTransferError(p);
003566      }else{
003567        db->errCode = p->rc;
003568      }
003569    }
003570  
003571    /* Reset register contents and reclaim error message memory.
003572    */
003573  #ifdef SQLITE_DEBUG
003574    /* Execute assert() statements to ensure that the Vdbe.apCsr[] and
003575    ** Vdbe.aMem[] arrays have already been cleaned up.  */
003576    if( p->apCsr ) for(i=0; i<p->nCursor; i++) assert( p->apCsr[i]==0 );
003577    if( p->aMem ){
003578      for(i=0; i<p->nMem; i++) assert( p->aMem[i].flags==MEM_Undefined );
003579    }
003580  #endif
003581    if( p->zErrMsg ){
003582      sqlite3DbFree(db, p->zErrMsg);
003583      p->zErrMsg = 0;
003584    }
003585    p->pResultRow = 0;
003586  #ifdef SQLITE_DEBUG
003587    p->nWrite = 0;
003588  #endif
003589  
003590    /* Save profiling information from this VDBE run.
003591    */
003592  #ifdef VDBE_PROFILE
003593    {
003594      FILE *out = fopen("vdbe_profile.out", "a");
003595      if( out ){
003596        fprintf(out, "---- ");
003597        for(i=0; i<p->nOp; i++){
003598          fprintf(out, "%02x", p->aOp[i].opcode);
003599        }
003600        fprintf(out, "\n");
003601        if( p->zSql ){
003602          char c, pc = 0;
003603          fprintf(out, "-- ");
003604          for(i=0; (c = p->zSql[i])!=0; i++){
003605            if( pc=='\n' ) fprintf(out, "-- ");
003606            putc(c, out);
003607            pc = c;
003608          }
003609          if( pc!='\n' ) fprintf(out, "\n");
003610        }
003611        for(i=0; i<p->nOp; i++){
003612          char zHdr[100];
003613          i64 cnt = p->aOp[i].nExec;
003614          i64 cycles = p->aOp[i].nCycle;
003615          sqlite3_snprintf(sizeof(zHdr), zHdr, "%6u %12llu %8llu ",
003616             cnt,
003617             cycles,
003618             cnt>0 ? cycles/cnt : 0
003619          );
003620          fprintf(out, "%s", zHdr);
003621          sqlite3VdbePrintOp(out, i, &p->aOp[i]);
003622        }
003623        fclose(out);
003624      }
003625    }
003626  #endif
003627    return p->rc & db->errMask;
003628  }
003629  
003630  /*
003631  ** Clean up and delete a VDBE after execution.  Return an integer which is
003632  ** the result code.  Write any error message text into *pzErrMsg.
003633  */
003634  int sqlite3VdbeFinalize(Vdbe *p){
003635    int rc = SQLITE_OK;
003636    assert( VDBE_RUN_STATE>VDBE_READY_STATE );
003637    assert( VDBE_HALT_STATE>VDBE_READY_STATE );
003638    assert( VDBE_INIT_STATE<VDBE_READY_STATE );
003639    if( p->eVdbeState>=VDBE_READY_STATE ){
003640      rc = sqlite3VdbeReset(p);
003641      assert( (rc & p->db->errMask)==rc );
003642    }
003643    sqlite3VdbeDelete(p);
003644    return rc;
003645  }
003646  
003647  /*
003648  ** If parameter iOp is less than zero, then invoke the destructor for
003649  ** all auxiliary data pointers currently cached by the VM passed as
003650  ** the first argument.
003651  **
003652  ** Or, if iOp is greater than or equal to zero, then the destructor is
003653  ** only invoked for those auxiliary data pointers created by the user
003654  ** function invoked by the OP_Function opcode at instruction iOp of
003655  ** VM pVdbe, and only then if:
003656  **
003657  **    * the associated function parameter is the 32nd or later (counting
003658  **      from left to right), or
003659  **
003660  **    * the corresponding bit in argument mask is clear (where the first
003661  **      function parameter corresponds to bit 0 etc.).
003662  */
003663  void sqlite3VdbeDeleteAuxData(sqlite3 *db, AuxData **pp, int iOp, int mask){
003664    while( *pp ){
003665      AuxData *pAux = *pp;
003666      if( (iOp<0)
003667       || (pAux->iAuxOp==iOp
003668            && pAux->iAuxArg>=0
003669            && (pAux->iAuxArg>31 || !(mask & MASKBIT32(pAux->iAuxArg))))
003670      ){
003671        testcase( pAux->iAuxArg==31 );
003672        if( pAux->xDeleteAux ){
003673          pAux->xDeleteAux(pAux->pAux);
003674        }
003675        *pp = pAux->pNextAux;
003676        sqlite3DbFree(db, pAux);
003677      }else{
003678        pp= &pAux->pNextAux;
003679      }
003680    }
003681  }
003682  
003683  /*
003684  ** Free all memory associated with the Vdbe passed as the second argument,
003685  ** except for object itself, which is preserved.
003686  **
003687  ** The difference between this function and sqlite3VdbeDelete() is that
003688  ** VdbeDelete() also unlinks the Vdbe from the list of VMs associated with
003689  ** the database connection and frees the object itself.
003690  */
003691  static void sqlite3VdbeClearObject(sqlite3 *db, Vdbe *p){
003692    SubProgram *pSub, *pNext;
003693    assert( db!=0 );
003694    assert( p->db==0 || p->db==db );
003695    if( p->aColName ){
003696      releaseMemArray(p->aColName, p->nResAlloc*COLNAME_N);
003697      sqlite3DbNNFreeNN(db, p->aColName);
003698    }
003699    for(pSub=p->pProgram; pSub; pSub=pNext){
003700      pNext = pSub->pNext;
003701      vdbeFreeOpArray(db, pSub->aOp, pSub->nOp);
003702      sqlite3DbFree(db, pSub);
003703    }
003704    if( p->eVdbeState!=VDBE_INIT_STATE ){
003705      releaseMemArray(p->aVar, p->nVar);
003706      if( p->pVList ) sqlite3DbNNFreeNN(db, p->pVList);
003707      if( p->pFree ) sqlite3DbNNFreeNN(db, p->pFree);
003708    }
003709    vdbeFreeOpArray(db, p->aOp, p->nOp);
003710    if( p->zSql ) sqlite3DbNNFreeNN(db, p->zSql);
003711  #ifdef SQLITE_ENABLE_NORMALIZE
003712    sqlite3DbFree(db, p->zNormSql);
003713    {
003714      DblquoteStr *pThis, *pNxt;
003715      for(pThis=p->pDblStr; pThis; pThis=pNxt){
003716        pNxt = pThis->pNextStr;
003717        sqlite3DbFree(db, pThis);
003718      }
003719    }
003720  #endif
003721  #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
003722    {
003723      int i;
003724      for(i=0; i<p->nScan; i++){
003725        sqlite3DbFree(db, p->aScan[i].zName);
003726      }
003727      sqlite3DbFree(db, p->aScan);
003728    }
003729  #endif
003730  }
003731  
003732  /*
003733  ** Delete an entire VDBE.
003734  */
003735  void sqlite3VdbeDelete(Vdbe *p){
003736    sqlite3 *db;
003737  
003738    assert( p!=0 );
003739    db = p->db;
003740    assert( db!=0 );
003741    assert( sqlite3_mutex_held(db->mutex) );
003742    sqlite3VdbeClearObject(db, p);
003743    if( db->pnBytesFreed==0 ){
003744      assert( p->ppVPrev!=0 );
003745      *p->ppVPrev = p->pVNext;
003746      if( p->pVNext ){
003747        p->pVNext->ppVPrev = p->ppVPrev;
003748      }
003749    }
003750    sqlite3DbNNFreeNN(db, p);
003751  }
003752  
003753  /*
003754  ** The cursor "p" has a pending seek operation that has not yet been
003755  ** carried out.  Seek the cursor now.  If an error occurs, return
003756  ** the appropriate error code.
003757  */
003758  int SQLITE_NOINLINE sqlite3VdbeFinishMoveto(VdbeCursor *p){
003759    int res, rc;
003760  #ifdef SQLITE_TEST
003761    extern int sqlite3_search_count;
003762  #endif
003763    assert( p->deferredMoveto );
003764    assert( p->isTable );
003765    assert( p->eCurType==CURTYPE_BTREE );
003766    rc = sqlite3BtreeTableMoveto(p->uc.pCursor, p->movetoTarget, 0, &res);
003767    if( rc ) return rc;
003768    if( res!=0 ) return SQLITE_CORRUPT_BKPT;
003769  #ifdef SQLITE_TEST
003770    sqlite3_search_count++;
003771  #endif
003772    p->deferredMoveto = 0;
003773    p->cacheStatus = CACHE_STALE;
003774    return SQLITE_OK;
003775  }
003776  
003777  /*
003778  ** Something has moved cursor "p" out of place.  Maybe the row it was
003779  ** pointed to was deleted out from under it.  Or maybe the btree was
003780  ** rebalanced.  Whatever the cause, try to restore "p" to the place it
003781  ** is supposed to be pointing.  If the row was deleted out from under the
003782  ** cursor, set the cursor to point to a NULL row.
003783  */
003784  int SQLITE_NOINLINE sqlite3VdbeHandleMovedCursor(VdbeCursor *p){
003785    int isDifferentRow, rc;
003786    assert( p->eCurType==CURTYPE_BTREE );
003787    assert( p->uc.pCursor!=0 );
003788    assert( sqlite3BtreeCursorHasMoved(p->uc.pCursor) );
003789    rc = sqlite3BtreeCursorRestore(p->uc.pCursor, &isDifferentRow);
003790    p->cacheStatus = CACHE_STALE;
003791    if( isDifferentRow ) p->nullRow = 1;
003792    return rc;
003793  }
003794  
003795  /*
003796  ** Check to ensure that the cursor is valid.  Restore the cursor
003797  ** if need be.  Return any I/O error from the restore operation.
003798  */
003799  int sqlite3VdbeCursorRestore(VdbeCursor *p){
003800    assert( p->eCurType==CURTYPE_BTREE || IsNullCursor(p) );
003801    if( sqlite3BtreeCursorHasMoved(p->uc.pCursor) ){
003802      return sqlite3VdbeHandleMovedCursor(p);
003803    }
003804    return SQLITE_OK;
003805  }
003806  
003807  /*
003808  ** The following functions:
003809  **
003810  ** sqlite3VdbeSerialType()
003811  ** sqlite3VdbeSerialTypeLen()
003812  ** sqlite3VdbeSerialLen()
003813  ** sqlite3VdbeSerialPut()  <--- in-lined into OP_MakeRecord as of 2022-04-02
003814  ** sqlite3VdbeSerialGet()
003815  **
003816  ** encapsulate the code that serializes values for storage in SQLite
003817  ** data and index records. Each serialized value consists of a
003818  ** 'serial-type' and a blob of data. The serial type is an 8-byte unsigned
003819  ** integer, stored as a varint.
003820  **
003821  ** In an SQLite index record, the serial type is stored directly before
003822  ** the blob of data that it corresponds to. In a table record, all serial
003823  ** types are stored at the start of the record, and the blobs of data at
003824  ** the end. Hence these functions allow the caller to handle the
003825  ** serial-type and data blob separately.
003826  **
003827  ** The following table describes the various storage classes for data:
003828  **
003829  **   serial type        bytes of data      type
003830  **   --------------     ---------------    ---------------
003831  **      0                     0            NULL
003832  **      1                     1            signed integer
003833  **      2                     2            signed integer
003834  **      3                     3            signed integer
003835  **      4                     4            signed integer
003836  **      5                     6            signed integer
003837  **      6                     8            signed integer
003838  **      7                     8            IEEE float
003839  **      8                     0            Integer constant 0
003840  **      9                     0            Integer constant 1
003841  **     10,11                               reserved for expansion
003842  **    N>=12 and even       (N-12)/2        BLOB
003843  **    N>=13 and odd        (N-13)/2        text
003844  **
003845  ** The 8 and 9 types were added in 3.3.0, file format 4.  Prior versions
003846  ** of SQLite will not understand those serial types.
003847  */
003848  
003849  #if 0 /* Inlined into the OP_MakeRecord opcode */
003850  /*
003851  ** Return the serial-type for the value stored in pMem.
003852  **
003853  ** This routine might convert a large MEM_IntReal value into MEM_Real.
003854  **
003855  ** 2019-07-11:  The primary user of this subroutine was the OP_MakeRecord
003856  ** opcode in the byte-code engine.  But by moving this routine in-line, we
003857  ** can omit some redundant tests and make that opcode a lot faster.  So
003858  ** this routine is now only used by the STAT3 logic and STAT3 support has
003859  ** ended.  The code is kept here for historical reference only.
003860  */
003861  u32 sqlite3VdbeSerialType(Mem *pMem, int file_format, u32 *pLen){
003862    int flags = pMem->flags;
003863    u32 n;
003864  
003865    assert( pLen!=0 );
003866    if( flags&MEM_Null ){
003867      *pLen = 0;
003868      return 0;
003869    }
003870    if( flags&(MEM_Int|MEM_IntReal) ){
003871      /* Figure out whether to use 1, 2, 4, 6 or 8 bytes. */
003872  #   define MAX_6BYTE ((((i64)0x00008000)<<32)-1)
003873      i64 i = pMem->u.i;
003874      u64 u;
003875      testcase( flags & MEM_Int );
003876      testcase( flags & MEM_IntReal );
003877      if( i<0 ){
003878        u = ~i;
003879      }else{
003880        u = i;
003881      }
003882      if( u<=127 ){
003883        if( (i&1)==i && file_format>=4 ){
003884          *pLen = 0;
003885          return 8+(u32)u;
003886        }else{
003887          *pLen = 1;
003888          return 1;
003889        }
003890      }
003891      if( u<=32767 ){ *pLen = 2; return 2; }
003892      if( u<=8388607 ){ *pLen = 3; return 3; }
003893      if( u<=2147483647 ){ *pLen = 4; return 4; }
003894      if( u<=MAX_6BYTE ){ *pLen = 6; return 5; }
003895      *pLen = 8;
003896      if( flags&MEM_IntReal ){
003897        /* If the value is IntReal and is going to take up 8 bytes to store
003898        ** as an integer, then we might as well make it an 8-byte floating
003899        ** point value */
003900        pMem->u.r = (double)pMem->u.i;
003901        pMem->flags &= ~MEM_IntReal;
003902        pMem->flags |= MEM_Real;
003903        return 7;
003904      }
003905      return 6;
003906    }
003907    if( flags&MEM_Real ){
003908      *pLen = 8;
003909      return 7;
003910    }
003911    assert( pMem->db->mallocFailed || flags&(MEM_Str|MEM_Blob) );
003912    assert( pMem->n>=0 );
003913    n = (u32)pMem->n;
003914    if( flags & MEM_Zero ){
003915      n += pMem->u.nZero;
003916    }
003917    *pLen = n;
003918    return ((n*2) + 12 + ((flags&MEM_Str)!=0));
003919  }
003920  #endif /* inlined into OP_MakeRecord */
003921  
003922  /*
003923  ** The sizes for serial types less than 128
003924  */
003925  const u8 sqlite3SmallTypeSizes[128] = {
003926          /*  0   1   2   3   4   5   6   7   8   9 */  
003927  /*   0 */   0,  1,  2,  3,  4,  6,  8,  8,  0,  0,
003928  /*  10 */   0,  0,  0,  0,  1,  1,  2,  2,  3,  3,
003929  /*  20 */   4,  4,  5,  5,  6,  6,  7,  7,  8,  8,
003930  /*  30 */   9,  9, 10, 10, 11, 11, 12, 12, 13, 13,
003931  /*  40 */  14, 14, 15, 15, 16, 16, 17, 17, 18, 18,
003932  /*  50 */  19, 19, 20, 20, 21, 21, 22, 22, 23, 23,
003933  /*  60 */  24, 24, 25, 25, 26, 26, 27, 27, 28, 28,
003934  /*  70 */  29, 29, 30, 30, 31, 31, 32, 32, 33, 33,
003935  /*  80 */  34, 34, 35, 35, 36, 36, 37, 37, 38, 38,
003936  /*  90 */  39, 39, 40, 40, 41, 41, 42, 42, 43, 43,
003937  /* 100 */  44, 44, 45, 45, 46, 46, 47, 47, 48, 48,
003938  /* 110 */  49, 49, 50, 50, 51, 51, 52, 52, 53, 53,
003939  /* 120 */  54, 54, 55, 55, 56, 56, 57, 57
003940  };
003941  
003942  /*
003943  ** Return the length of the data corresponding to the supplied serial-type.
003944  */
003945  u32 sqlite3VdbeSerialTypeLen(u32 serial_type){
003946    if( serial_type>=128 ){
003947      return (serial_type-12)/2;
003948    }else{
003949      assert( serial_type<12
003950              || sqlite3SmallTypeSizes[serial_type]==(serial_type - 12)/2 );
003951      return sqlite3SmallTypeSizes[serial_type];
003952    }
003953  }
003954  u8 sqlite3VdbeOneByteSerialTypeLen(u8 serial_type){
003955    assert( serial_type<128 );
003956    return sqlite3SmallTypeSizes[serial_type]; 
003957  }
003958  
003959  /*
003960  ** If we are on an architecture with mixed-endian floating
003961  ** points (ex: ARM7) then swap the lower 4 bytes with the
003962  ** upper 4 bytes.  Return the result.
003963  **
003964  ** For most architectures, this is a no-op.
003965  **
003966  ** (later):  It is reported to me that the mixed-endian problem
003967  ** on ARM7 is an issue with GCC, not with the ARM7 chip.  It seems
003968  ** that early versions of GCC stored the two words of a 64-bit
003969  ** float in the wrong order.  And that error has been propagated
003970  ** ever since.  The blame is not necessarily with GCC, though.
003971  ** GCC might have just copying the problem from a prior compiler.
003972  ** I am also told that newer versions of GCC that follow a different
003973  ** ABI get the byte order right.
003974  **
003975  ** Developers using SQLite on an ARM7 should compile and run their
003976  ** application using -DSQLITE_DEBUG=1 at least once.  With DEBUG
003977  ** enabled, some asserts below will ensure that the byte order of
003978  ** floating point values is correct.
003979  **
003980  ** (2007-08-30)  Frank van Vugt has studied this problem closely
003981  ** and has send his findings to the SQLite developers.  Frank
003982  ** writes that some Linux kernels offer floating point hardware
003983  ** emulation that uses only 32-bit mantissas instead of a full
003984  ** 48-bits as required by the IEEE standard.  (This is the
003985  ** CONFIG_FPE_FASTFPE option.)  On such systems, floating point
003986  ** byte swapping becomes very complicated.  To avoid problems,
003987  ** the necessary byte swapping is carried out using a 64-bit integer
003988  ** rather than a 64-bit float.  Frank assures us that the code here
003989  ** works for him.  We, the developers, have no way to independently
003990  ** verify this, but Frank seems to know what he is talking about
003991  ** so we trust him.
003992  */
003993  #ifdef SQLITE_MIXED_ENDIAN_64BIT_FLOAT
003994  u64 sqlite3FloatSwap(u64 in){
003995    union {
003996      u64 r;
003997      u32 i[2];
003998    } u;
003999    u32 t;
004000  
004001    u.r = in;
004002    t = u.i[0];
004003    u.i[0] = u.i[1];
004004    u.i[1] = t;
004005    return u.r;
004006  }
004007  #endif /* SQLITE_MIXED_ENDIAN_64BIT_FLOAT */
004008  
004009  
004010  /* Input "x" is a sequence of unsigned characters that represent a
004011  ** big-endian integer.  Return the equivalent native integer
004012  */
004013  #define ONE_BYTE_INT(x)    ((i8)(x)[0])
004014  #define TWO_BYTE_INT(x)    (256*(i8)((x)[0])|(x)[1])
004015  #define THREE_BYTE_INT(x)  (65536*(i8)((x)[0])|((x)[1]<<8)|(x)[2])
004016  #define FOUR_BYTE_UINT(x)  (((u32)(x)[0]<<24)|((x)[1]<<16)|((x)[2]<<8)|(x)[3])
004017  #define FOUR_BYTE_INT(x) (16777216*(i8)((x)[0])|((x)[1]<<16)|((x)[2]<<8)|(x)[3])
004018  
004019  /*
004020  ** Deserialize the data blob pointed to by buf as serial type serial_type
004021  ** and store the result in pMem.
004022  **
004023  ** This function is implemented as two separate routines for performance.
004024  ** The few cases that require local variables are broken out into a separate
004025  ** routine so that in most cases the overhead of moving the stack pointer
004026  ** is avoided.
004027  */
004028  static void serialGet(
004029    const unsigned char *buf,     /* Buffer to deserialize from */
004030    u32 serial_type,              /* Serial type to deserialize */
004031    Mem *pMem                     /* Memory cell to write value into */
004032  ){
004033    u64 x = FOUR_BYTE_UINT(buf);
004034    u32 y = FOUR_BYTE_UINT(buf+4);
004035    x = (x<<32) + y;
004036    if( serial_type==6 ){
004037      /* EVIDENCE-OF: R-29851-52272 Value is a big-endian 64-bit
004038      ** twos-complement integer. */
004039      pMem->u.i = *(i64*)&x;
004040      pMem->flags = MEM_Int;
004041      testcase( pMem->u.i<0 );
004042    }else{
004043      /* EVIDENCE-OF: R-57343-49114 Value is a big-endian IEEE 754-2008 64-bit
004044      ** floating point number. */
004045  #if !defined(NDEBUG) && !defined(SQLITE_OMIT_FLOATING_POINT)
004046      /* Verify that integers and floating point values use the same
004047      ** byte order.  Or, that if SQLITE_MIXED_ENDIAN_64BIT_FLOAT is
004048      ** defined that 64-bit floating point values really are mixed
004049      ** endian.
004050      */
004051      static const u64 t1 = ((u64)0x3ff00000)<<32;
004052      static const double r1 = 1.0;
004053      u64 t2 = t1;
004054      swapMixedEndianFloat(t2);
004055      assert( sizeof(r1)==sizeof(t2) && memcmp(&r1, &t2, sizeof(r1))==0 );
004056  #endif
004057      assert( sizeof(x)==8 && sizeof(pMem->u.r)==8 );
004058      swapMixedEndianFloat(x);
004059      memcpy(&pMem->u.r, &x, sizeof(x));
004060      pMem->flags = IsNaN(x) ? MEM_Null : MEM_Real;
004061    }
004062  }
004063  static int serialGet7(
004064    const unsigned char *buf,     /* Buffer to deserialize from */
004065    Mem *pMem                     /* Memory cell to write value into */
004066  ){
004067    u64 x = FOUR_BYTE_UINT(buf);
004068    u32 y = FOUR_BYTE_UINT(buf+4);
004069    x = (x<<32) + y;
004070    assert( sizeof(x)==8 && sizeof(pMem->u.r)==8 );
004071    swapMixedEndianFloat(x);
004072    memcpy(&pMem->u.r, &x, sizeof(x));
004073    if( IsNaN(x) ){
004074      pMem->flags = MEM_Null;
004075      return 1;
004076    }
004077    pMem->flags = MEM_Real;
004078    return 0;
004079  }
004080  void sqlite3VdbeSerialGet(
004081    const unsigned char *buf,     /* Buffer to deserialize from */
004082    u32 serial_type,              /* Serial type to deserialize */
004083    Mem *pMem                     /* Memory cell to write value into */
004084  ){
004085    switch( serial_type ){
004086      case 10: { /* Internal use only: NULL with virtual table
004087                 ** UPDATE no-change flag set */
004088        pMem->flags = MEM_Null|MEM_Zero;
004089        pMem->n = 0;
004090        pMem->u.nZero = 0;
004091        return;
004092      }
004093      case 11:   /* Reserved for future use */
004094      case 0: {  /* Null */
004095        /* EVIDENCE-OF: R-24078-09375 Value is a NULL. */
004096        pMem->flags = MEM_Null;
004097        return;
004098      }
004099      case 1: {
004100        /* EVIDENCE-OF: R-44885-25196 Value is an 8-bit twos-complement
004101        ** integer. */
004102        pMem->u.i = ONE_BYTE_INT(buf);
004103        pMem->flags = MEM_Int;
004104        testcase( pMem->u.i<0 );
004105        return;
004106      }
004107      case 2: { /* 2-byte signed integer */
004108        /* EVIDENCE-OF: R-49794-35026 Value is a big-endian 16-bit
004109        ** twos-complement integer. */
004110        pMem->u.i = TWO_BYTE_INT(buf);
004111        pMem->flags = MEM_Int;
004112        testcase( pMem->u.i<0 );
004113        return;
004114      }
004115      case 3: { /* 3-byte signed integer */
004116        /* EVIDENCE-OF: R-37839-54301 Value is a big-endian 24-bit
004117        ** twos-complement integer. */
004118        pMem->u.i = THREE_BYTE_INT(buf);
004119        pMem->flags = MEM_Int;
004120        testcase( pMem->u.i<0 );
004121        return;
004122      }
004123      case 4: { /* 4-byte signed integer */
004124        /* EVIDENCE-OF: R-01849-26079 Value is a big-endian 32-bit
004125        ** twos-complement integer. */
004126        pMem->u.i = FOUR_BYTE_INT(buf);
004127  #ifdef __HP_cc
004128        /* Work around a sign-extension bug in the HP compiler for HP/UX */
004129        if( buf[0]&0x80 ) pMem->u.i |= 0xffffffff80000000LL;
004130  #endif
004131        pMem->flags = MEM_Int;
004132        testcase( pMem->u.i<0 );
004133        return;
004134      }
004135      case 5: { /* 6-byte signed integer */
004136        /* EVIDENCE-OF: R-50385-09674 Value is a big-endian 48-bit
004137        ** twos-complement integer. */
004138        pMem->u.i = FOUR_BYTE_UINT(buf+2) + (((i64)1)<<32)*TWO_BYTE_INT(buf);
004139        pMem->flags = MEM_Int;
004140        testcase( pMem->u.i<0 );
004141        return;
004142      }
004143      case 6:   /* 8-byte signed integer */
004144      case 7: { /* IEEE floating point */
004145        /* These use local variables, so do them in a separate routine
004146        ** to avoid having to move the frame pointer in the common case */
004147        serialGet(buf,serial_type,pMem);
004148        return;
004149      }
004150      case 8:    /* Integer 0 */
004151      case 9: {  /* Integer 1 */
004152        /* EVIDENCE-OF: R-12976-22893 Value is the integer 0. */
004153        /* EVIDENCE-OF: R-18143-12121 Value is the integer 1. */
004154        pMem->u.i = serial_type-8;
004155        pMem->flags = MEM_Int;
004156        return;
004157      }
004158      default: {
004159        /* EVIDENCE-OF: R-14606-31564 Value is a BLOB that is (N-12)/2 bytes in
004160        ** length.
004161        ** EVIDENCE-OF: R-28401-00140 Value is a string in the text encoding and
004162        ** (N-13)/2 bytes in length. */
004163        static const u16 aFlag[] = { MEM_Blob|MEM_Ephem, MEM_Str|MEM_Ephem };
004164        pMem->z = (char *)buf;
004165        pMem->n = (serial_type-12)/2;
004166        pMem->flags = aFlag[serial_type&1];
004167        return;
004168      }
004169    }
004170    return;
004171  }
004172  /*
004173  ** This routine is used to allocate sufficient space for an UnpackedRecord
004174  ** structure large enough to be used with sqlite3VdbeRecordUnpack() if
004175  ** the first argument is a pointer to KeyInfo structure pKeyInfo.
004176  **
004177  ** The space is either allocated using sqlite3DbMallocRaw() or from within
004178  ** the unaligned buffer passed via the second and third arguments (presumably
004179  ** stack space). If the former, then *ppFree is set to a pointer that should
004180  ** be eventually freed by the caller using sqlite3DbFree(). Or, if the
004181  ** allocation comes from the pSpace/szSpace buffer, *ppFree is set to NULL
004182  ** before returning.
004183  **
004184  ** If an OOM error occurs, NULL is returned.
004185  */
004186  UnpackedRecord *sqlite3VdbeAllocUnpackedRecord(
004187    KeyInfo *pKeyInfo               /* Description of the record */
004188  ){
004189    UnpackedRecord *p;              /* Unpacked record to return */
004190    int nByte;                      /* Number of bytes required for *p */
004191    nByte = ROUND8P(sizeof(UnpackedRecord)) + sizeof(Mem)*(pKeyInfo->nKeyField+1);
004192    p = (UnpackedRecord *)sqlite3DbMallocRaw(pKeyInfo->db, nByte);
004193    if( !p ) return 0;
004194    p->aMem = (Mem*)&((char*)p)[ROUND8P(sizeof(UnpackedRecord))];
004195    assert( pKeyInfo->aSortFlags!=0 );
004196    p->pKeyInfo = pKeyInfo;
004197    p->nField = pKeyInfo->nKeyField + 1;
004198    return p;
004199  }
004200  
004201  /*
004202  ** Given the nKey-byte encoding of a record in pKey[], populate the
004203  ** UnpackedRecord structure indicated by the fourth argument with the
004204  ** contents of the decoded record.
004205  */
004206  void sqlite3VdbeRecordUnpack(
004207    KeyInfo *pKeyInfo,     /* Information about the record format */
004208    int nKey,              /* Size of the binary record */
004209    const void *pKey,      /* The binary record */
004210    UnpackedRecord *p      /* Populate this structure before returning. */
004211  ){
004212    const unsigned char *aKey = (const unsigned char *)pKey;
004213    u32 d;
004214    u32 idx;                        /* Offset in aKey[] to read from */
004215    u16 u;                          /* Unsigned loop counter */
004216    u32 szHdr;
004217    Mem *pMem = p->aMem;
004218  
004219    p->default_rc = 0;
004220    assert( EIGHT_BYTE_ALIGNMENT(pMem) );
004221    idx = getVarint32(aKey, szHdr);
004222    d = szHdr;
004223    u = 0;
004224    while( idx<szHdr && d<=(u32)nKey ){
004225      u32 serial_type;
004226  
004227      idx += getVarint32(&aKey[idx], serial_type);
004228      pMem->enc = pKeyInfo->enc;
004229      pMem->db = pKeyInfo->db;
004230      /* pMem->flags = 0; // sqlite3VdbeSerialGet() will set this for us */
004231      pMem->szMalloc = 0;
004232      pMem->z = 0;
004233      sqlite3VdbeSerialGet(&aKey[d], serial_type, pMem);
004234      d += sqlite3VdbeSerialTypeLen(serial_type);
004235      pMem++;
004236      if( (++u)>=p->nField ) break;
004237    }
004238    if( d>(u32)nKey && u ){
004239      assert( CORRUPT_DB );
004240      /* In a corrupt record entry, the last pMem might have been set up using
004241      ** uninitialized memory. Overwrite its value with NULL, to prevent
004242      ** warnings from MSAN. */
004243      sqlite3VdbeMemSetNull(pMem-1);
004244    }
004245    assert( u<=pKeyInfo->nKeyField + 1 );
004246    p->nField = u;
004247  }
004248  
004249  #ifdef SQLITE_DEBUG
004250  /*
004251  ** This function compares two index or table record keys in the same way
004252  ** as the sqlite3VdbeRecordCompare() routine. Unlike VdbeRecordCompare(),
004253  ** this function deserializes and compares values using the
004254  ** sqlite3VdbeSerialGet() and sqlite3MemCompare() functions. It is used
004255  ** in assert() statements to ensure that the optimized code in
004256  ** sqlite3VdbeRecordCompare() returns results with these two primitives.
004257  **
004258  ** Return true if the result of comparison is equivalent to desiredResult.
004259  ** Return false if there is a disagreement.
004260  */
004261  static int vdbeRecordCompareDebug(
004262    int nKey1, const void *pKey1, /* Left key */
004263    const UnpackedRecord *pPKey2, /* Right key */
004264    int desiredResult             /* Correct answer */
004265  ){
004266    u32 d1;            /* Offset into aKey[] of next data element */
004267    u32 idx1;          /* Offset into aKey[] of next header element */
004268    u32 szHdr1;        /* Number of bytes in header */
004269    int i = 0;
004270    int rc = 0;
004271    const unsigned char *aKey1 = (const unsigned char *)pKey1;
004272    KeyInfo *pKeyInfo;
004273    Mem mem1;
004274  
004275    pKeyInfo = pPKey2->pKeyInfo;
004276    if( pKeyInfo->db==0 ) return 1;
004277    mem1.enc = pKeyInfo->enc;
004278    mem1.db = pKeyInfo->db;
004279    /* mem1.flags = 0;  // Will be initialized by sqlite3VdbeSerialGet() */
004280    VVA_ONLY( mem1.szMalloc = 0; ) /* Only needed by assert() statements */
004281  
004282    /* Compilers may complain that mem1.u.i is potentially uninitialized.
004283    ** We could initialize it, as shown here, to silence those complaints.
004284    ** But in fact, mem1.u.i will never actually be used uninitialized, and doing
004285    ** the unnecessary initialization has a measurable negative performance
004286    ** impact, since this routine is a very high runner.  And so, we choose
004287    ** to ignore the compiler warnings and leave this variable uninitialized.
004288    */
004289    /*  mem1.u.i = 0;  // not needed, here to silence compiler warning */
004290   
004291    idx1 = getVarint32(aKey1, szHdr1);
004292    if( szHdr1>98307 ) return SQLITE_CORRUPT;
004293    d1 = szHdr1;
004294    assert( pKeyInfo->nAllField>=pPKey2->nField || CORRUPT_DB );
004295    assert( pKeyInfo->aSortFlags!=0 );
004296    assert( pKeyInfo->nKeyField>0 );
004297    assert( idx1<=szHdr1 || CORRUPT_DB );
004298    do{
004299      u32 serial_type1;
004300  
004301      /* Read the serial types for the next element in each key. */
004302      idx1 += getVarint32( aKey1+idx1, serial_type1 );
004303  
004304      /* Verify that there is enough key space remaining to avoid
004305      ** a buffer overread.  The "d1+serial_type1+2" subexpression will
004306      ** always be greater than or equal to the amount of required key space.
004307      ** Use that approximation to avoid the more expensive call to
004308      ** sqlite3VdbeSerialTypeLen() in the common case.
004309      */
004310      if( d1+(u64)serial_type1+2>(u64)nKey1
004311       && d1+(u64)sqlite3VdbeSerialTypeLen(serial_type1)>(u64)nKey1
004312      ){
004313        if( serial_type1>=1
004314         && serial_type1<=7
004315         && d1+(u64)sqlite3VdbeSerialTypeLen(serial_type1)<=(u64)nKey1+8
004316         && CORRUPT_DB
004317        ){
004318          return 1;  /* corrupt record not detected by
004319                     ** sqlite3VdbeRecordCompareWithSkip().  Return true
004320                     ** to avoid firing the assert() */
004321        }
004322        break;
004323      }
004324  
004325      /* Extract the values to be compared.
004326      */
004327      sqlite3VdbeSerialGet(&aKey1[d1], serial_type1, &mem1);
004328      d1 += sqlite3VdbeSerialTypeLen(serial_type1);
004329  
004330      /* Do the comparison
004331      */
004332      rc = sqlite3MemCompare(&mem1, &pPKey2->aMem[i],
004333                             pKeyInfo->nAllField>i ? pKeyInfo->aColl[i] : 0);
004334      if( rc!=0 ){
004335        assert( mem1.szMalloc==0 );  /* See comment below */
004336        if( (pKeyInfo->aSortFlags[i] & KEYINFO_ORDER_BIGNULL)
004337         && ((mem1.flags & MEM_Null) || (pPKey2->aMem[i].flags & MEM_Null))
004338        ){
004339          rc = -rc;
004340        }
004341        if( pKeyInfo->aSortFlags[i] & KEYINFO_ORDER_DESC ){
004342          rc = -rc;  /* Invert the result for DESC sort order. */
004343        }
004344        goto debugCompareEnd;
004345      }
004346      i++;
004347    }while( idx1<szHdr1 && i<pPKey2->nField );
004348  
004349    /* No memory allocation is ever used on mem1.  Prove this using
004350    ** the following assert().  If the assert() fails, it indicates a
004351    ** memory leak and a need to call sqlite3VdbeMemRelease(&mem1).
004352    */
004353    assert( mem1.szMalloc==0 );
004354  
004355    /* rc==0 here means that one of the keys ran out of fields and
004356    ** all the fields up to that point were equal. Return the default_rc
004357    ** value.  */
004358    rc = pPKey2->default_rc;
004359  
004360  debugCompareEnd:
004361    if( desiredResult==0 && rc==0 ) return 1;
004362    if( desiredResult<0 && rc<0 ) return 1;
004363    if( desiredResult>0 && rc>0 ) return 1;
004364    if( CORRUPT_DB ) return 1;
004365    if( pKeyInfo->db->mallocFailed ) return 1;
004366    return 0;
004367  }
004368  #endif
004369  
004370  #ifdef SQLITE_DEBUG
004371  /*
004372  ** Count the number of fields (a.k.a. columns) in the record given by
004373  ** pKey,nKey.  The verify that this count is less than or equal to the
004374  ** limit given by pKeyInfo->nAllField.
004375  **
004376  ** If this constraint is not satisfied, it means that the high-speed
004377  ** vdbeRecordCompareInt() and vdbeRecordCompareString() routines will
004378  ** not work correctly.  If this assert() ever fires, it probably means
004379  ** that the KeyInfo.nKeyField or KeyInfo.nAllField values were computed
004380  ** incorrectly.
004381  */
004382  static void vdbeAssertFieldCountWithinLimits(
004383    int nKey, const void *pKey,   /* The record to verify */
004384    const KeyInfo *pKeyInfo       /* Compare size with this KeyInfo */
004385  ){
004386    int nField = 0;
004387    u32 szHdr;
004388    u32 idx;
004389    u32 notUsed;
004390    const unsigned char *aKey = (const unsigned char*)pKey;
004391  
004392    if( CORRUPT_DB ) return;
004393    idx = getVarint32(aKey, szHdr);
004394    assert( nKey>=0 );
004395    assert( szHdr<=(u32)nKey );
004396    while( idx<szHdr ){
004397      idx += getVarint32(aKey+idx, notUsed);
004398      nField++;
004399    }
004400    assert( nField <= pKeyInfo->nAllField );
004401  }
004402  #else
004403  # define vdbeAssertFieldCountWithinLimits(A,B,C)
004404  #endif
004405  
004406  /*
004407  ** Both *pMem1 and *pMem2 contain string values. Compare the two values
004408  ** using the collation sequence pColl. As usual, return a negative , zero
004409  ** or positive value if *pMem1 is less than, equal to or greater than
004410  ** *pMem2, respectively. Similar in spirit to "rc = (*pMem1) - (*pMem2);".
004411  */
004412  static int vdbeCompareMemString(
004413    const Mem *pMem1,
004414    const Mem *pMem2,
004415    const CollSeq *pColl,
004416    u8 *prcErr                      /* If an OOM occurs, set to SQLITE_NOMEM */
004417  ){
004418    if( pMem1->enc==pColl->enc ){
004419      /* The strings are already in the correct encoding.  Call the
004420       ** comparison function directly */
004421      return pColl->xCmp(pColl->pUser,pMem1->n,pMem1->z,pMem2->n,pMem2->z);
004422    }else{
004423      int rc;
004424      const void *v1, *v2;
004425      Mem c1;
004426      Mem c2;
004427      sqlite3VdbeMemInit(&c1, pMem1->db, MEM_Null);
004428      sqlite3VdbeMemInit(&c2, pMem1->db, MEM_Null);
004429      sqlite3VdbeMemShallowCopy(&c1, pMem1, MEM_Ephem);
004430      sqlite3VdbeMemShallowCopy(&c2, pMem2, MEM_Ephem);
004431      v1 = sqlite3ValueText((sqlite3_value*)&c1, pColl->enc);
004432      v2 = sqlite3ValueText((sqlite3_value*)&c2, pColl->enc);
004433      if( (v1==0 || v2==0) ){
004434        if( prcErr ) *prcErr = SQLITE_NOMEM_BKPT;
004435        rc = 0;
004436      }else{
004437        rc = pColl->xCmp(pColl->pUser, c1.n, v1, c2.n, v2);
004438      }
004439      sqlite3VdbeMemReleaseMalloc(&c1);
004440      sqlite3VdbeMemReleaseMalloc(&c2);
004441      return rc;
004442    }
004443  }
004444  
004445  /*
004446  ** The input pBlob is guaranteed to be a Blob that is not marked
004447  ** with MEM_Zero.  Return true if it could be a zero-blob.
004448  */
004449  static int isAllZero(const char *z, int n){
004450    int i;
004451    for(i=0; i<n; i++){
004452      if( z[i] ) return 0;
004453    }
004454    return 1;
004455  }
004456  
004457  /*
004458  ** Compare two blobs.  Return negative, zero, or positive if the first
004459  ** is less than, equal to, or greater than the second, respectively.
004460  ** If one blob is a prefix of the other, then the shorter is the lessor.
004461  */
004462  SQLITE_NOINLINE int sqlite3BlobCompare(const Mem *pB1, const Mem *pB2){
004463    int c;
004464    int n1 = pB1->n;
004465    int n2 = pB2->n;
004466  
004467    /* It is possible to have a Blob value that has some non-zero content
004468    ** followed by zero content.  But that only comes up for Blobs formed
004469    ** by the OP_MakeRecord opcode, and such Blobs never get passed into
004470    ** sqlite3MemCompare(). */
004471    assert( (pB1->flags & MEM_Zero)==0 || n1==0 );
004472    assert( (pB2->flags & MEM_Zero)==0 || n2==0 );
004473  
004474    if( (pB1->flags|pB2->flags) & MEM_Zero ){
004475      if( pB1->flags & pB2->flags & MEM_Zero ){
004476        return pB1->u.nZero - pB2->u.nZero;
004477      }else if( pB1->flags & MEM_Zero ){
004478        if( !isAllZero(pB2->z, pB2->n) ) return -1;
004479        return pB1->u.nZero - n2;
004480      }else{
004481        if( !isAllZero(pB1->z, pB1->n) ) return +1;
004482        return n1 - pB2->u.nZero;
004483      }
004484    }
004485    c = memcmp(pB1->z, pB2->z, n1>n2 ? n2 : n1);
004486    if( c ) return c;
004487    return n1 - n2;
004488  }
004489  
004490  /* The following two functions are used only within testcase() to prove
004491  ** test coverage.  These functions do no exist for production builds.
004492  ** We must use separate SQLITE_NOINLINE functions here, since otherwise
004493  ** optimizer code movement causes gcov to become very confused.
004494  */
004495  #if  defined(SQLITE_COVERAGE_TEST) || defined(SQLITE_DEBUG)
004496  static int SQLITE_NOINLINE doubleLt(double a, double b){ return a<b; }
004497  static int SQLITE_NOINLINE doubleEq(double a, double b){ return a==b; }
004498  #endif
004499  
004500  /*
004501  ** Do a comparison between a 64-bit signed integer and a 64-bit floating-point
004502  ** number.  Return negative, zero, or positive if the first (i64) is less than,
004503  ** equal to, or greater than the second (double).
004504  */
004505  int sqlite3IntFloatCompare(i64 i, double r){
004506    if( sqlite3IsNaN(r) ){
004507      /* SQLite considers NaN to be a NULL. And all integer values are greater
004508      ** than NULL */
004509      return 1;
004510    }
004511    if( sqlite3Config.bUseLongDouble ){
004512      LONGDOUBLE_TYPE x = (LONGDOUBLE_TYPE)i;
004513      testcase( x<r );
004514      testcase( x>r );
004515      testcase( x==r );
004516      return (x<r) ? -1 : (x>r);
004517    }else{
004518      i64 y;
004519      double s;
004520      if( r<-9223372036854775808.0 ) return +1;
004521      if( r>=9223372036854775808.0 ) return -1;
004522      y = (i64)r;
004523      if( i<y ) return -1;
004524      if( i>y ) return +1;
004525      s = (double)i;
004526      testcase( doubleLt(s,r) );
004527      testcase( doubleLt(r,s) );
004528      testcase( doubleEq(r,s) );
004529      return (s<r) ? -1 : (s>r);
004530    }
004531  }
004532  
004533  /*
004534  ** Compare the values contained by the two memory cells, returning
004535  ** negative, zero or positive if pMem1 is less than, equal to, or greater
004536  ** than pMem2. Sorting order is NULL's first, followed by numbers (integers
004537  ** and reals) sorted numerically, followed by text ordered by the collating
004538  ** sequence pColl and finally blob's ordered by memcmp().
004539  **
004540  ** Two NULL values are considered equal by this function.
004541  */
004542  int sqlite3MemCompare(const Mem *pMem1, const Mem *pMem2, const CollSeq *pColl){
004543    int f1, f2;
004544    int combined_flags;
004545  
004546    f1 = pMem1->flags;
004547    f2 = pMem2->flags;
004548    combined_flags = f1|f2;
004549    assert( !sqlite3VdbeMemIsRowSet(pMem1) && !sqlite3VdbeMemIsRowSet(pMem2) );
004550  
004551    /* If one value is NULL, it is less than the other. If both values
004552    ** are NULL, return 0.
004553    */
004554    if( combined_flags&MEM_Null ){
004555      return (f2&MEM_Null) - (f1&MEM_Null);
004556    }
004557  
004558    /* At least one of the two values is a number
004559    */
004560    if( combined_flags&(MEM_Int|MEM_Real|MEM_IntReal) ){
004561      testcase( combined_flags & MEM_Int );
004562      testcase( combined_flags & MEM_Real );
004563      testcase( combined_flags & MEM_IntReal );
004564      if( (f1 & f2 & (MEM_Int|MEM_IntReal))!=0 ){
004565        testcase( f1 & f2 & MEM_Int );
004566        testcase( f1 & f2 & MEM_IntReal );
004567        if( pMem1->u.i < pMem2->u.i ) return -1;
004568        if( pMem1->u.i > pMem2->u.i ) return +1;
004569        return 0;
004570      }
004571      if( (f1 & f2 & MEM_Real)!=0 ){
004572        if( pMem1->u.r < pMem2->u.r ) return -1;
004573        if( pMem1->u.r > pMem2->u.r ) return +1;
004574        return 0;
004575      }
004576      if( (f1&(MEM_Int|MEM_IntReal))!=0 ){
004577        testcase( f1 & MEM_Int );
004578        testcase( f1 & MEM_IntReal );
004579        if( (f2&MEM_Real)!=0 ){
004580          return sqlite3IntFloatCompare(pMem1->u.i, pMem2->u.r);
004581        }else if( (f2&(MEM_Int|MEM_IntReal))!=0 ){
004582          if( pMem1->u.i < pMem2->u.i ) return -1;
004583          if( pMem1->u.i > pMem2->u.i ) return +1;
004584          return 0;
004585        }else{
004586          return -1;
004587        }
004588      }
004589      if( (f1&MEM_Real)!=0 ){
004590        if( (f2&(MEM_Int|MEM_IntReal))!=0 ){
004591          testcase( f2 & MEM_Int );
004592          testcase( f2 & MEM_IntReal );
004593          return -sqlite3IntFloatCompare(pMem2->u.i, pMem1->u.r);
004594        }else{
004595          return -1;
004596        }
004597      }
004598      return +1;
004599    }
004600  
004601    /* If one value is a string and the other is a blob, the string is less.
004602    ** If both are strings, compare using the collating functions.
004603    */
004604    if( combined_flags&MEM_Str ){
004605      if( (f1 & MEM_Str)==0 ){
004606        return 1;
004607      }
004608      if( (f2 & MEM_Str)==0 ){
004609        return -1;
004610      }
004611  
004612      assert( pMem1->enc==pMem2->enc || pMem1->db->mallocFailed );
004613      assert( pMem1->enc==SQLITE_UTF8 ||
004614              pMem1->enc==SQLITE_UTF16LE || pMem1->enc==SQLITE_UTF16BE );
004615  
004616      /* The collation sequence must be defined at this point, even if
004617      ** the user deletes the collation sequence after the vdbe program is
004618      ** compiled (this was not always the case).
004619      */
004620      assert( !pColl || pColl->xCmp );
004621  
004622      if( pColl ){
004623        return vdbeCompareMemString(pMem1, pMem2, pColl, 0);
004624      }
004625      /* If a NULL pointer was passed as the collate function, fall through
004626      ** to the blob case and use memcmp().  */
004627    }
004628  
004629    /* Both values must be blobs.  Compare using memcmp().  */
004630    return sqlite3BlobCompare(pMem1, pMem2);
004631  }
004632  
004633  
004634  /*
004635  ** The first argument passed to this function is a serial-type that
004636  ** corresponds to an integer - all values between 1 and 9 inclusive
004637  ** except 7. The second points to a buffer containing an integer value
004638  ** serialized according to serial_type. This function deserializes
004639  ** and returns the value.
004640  */
004641  static i64 vdbeRecordDecodeInt(u32 serial_type, const u8 *aKey){
004642    u32 y;
004643    assert( CORRUPT_DB || (serial_type>=1 && serial_type<=9 && serial_type!=7) );
004644    switch( serial_type ){
004645      case 0:
004646      case 1:
004647        testcase( aKey[0]&0x80 );
004648        return ONE_BYTE_INT(aKey);
004649      case 2:
004650        testcase( aKey[0]&0x80 );
004651        return TWO_BYTE_INT(aKey);
004652      case 3:
004653        testcase( aKey[0]&0x80 );
004654        return THREE_BYTE_INT(aKey);
004655      case 4: {
004656        testcase( aKey[0]&0x80 );
004657        y = FOUR_BYTE_UINT(aKey);
004658        return (i64)*(int*)&y;
004659      }
004660      case 5: {
004661        testcase( aKey[0]&0x80 );
004662        return FOUR_BYTE_UINT(aKey+2) + (((i64)1)<<32)*TWO_BYTE_INT(aKey);
004663      }
004664      case 6: {
004665        u64 x = FOUR_BYTE_UINT(aKey);
004666        testcase( aKey[0]&0x80 );
004667        x = (x<<32) | FOUR_BYTE_UINT(aKey+4);
004668        return (i64)*(i64*)&x;
004669      }
004670    }
004671  
004672    return (serial_type - 8);
004673  }
004674  
004675  /*
004676  ** This function compares the two table rows or index records
004677  ** specified by {nKey1, pKey1} and pPKey2.  It returns a negative, zero
004678  ** or positive integer if key1 is less than, equal to or
004679  ** greater than key2.  The {nKey1, pKey1} key must be a blob
004680  ** created by the OP_MakeRecord opcode of the VDBE.  The pPKey2
004681  ** key must be a parsed key such as obtained from
004682  ** sqlite3VdbeParseRecord.
004683  **
004684  ** If argument bSkip is non-zero, it is assumed that the caller has already
004685  ** determined that the first fields of the keys are equal.
004686  **
004687  ** Key1 and Key2 do not have to contain the same number of fields. If all
004688  ** fields that appear in both keys are equal, then pPKey2->default_rc is
004689  ** returned.
004690  **
004691  ** If database corruption is discovered, set pPKey2->errCode to
004692  ** SQLITE_CORRUPT and return 0. If an OOM error is encountered,
004693  ** pPKey2->errCode is set to SQLITE_NOMEM and, if it is not NULL, the
004694  ** malloc-failed flag set on database handle (pPKey2->pKeyInfo->db).
004695  */
004696  int sqlite3VdbeRecordCompareWithSkip(
004697    int nKey1, const void *pKey1,   /* Left key */
004698    UnpackedRecord *pPKey2,         /* Right key */
004699    int bSkip                       /* If true, skip the first field */
004700  ){
004701    u32 d1;                         /* Offset into aKey[] of next data element */
004702    int i;                          /* Index of next field to compare */
004703    u32 szHdr1;                     /* Size of record header in bytes */
004704    u32 idx1;                       /* Offset of first type in header */
004705    int rc = 0;                     /* Return value */
004706    Mem *pRhs = pPKey2->aMem;       /* Next field of pPKey2 to compare */
004707    KeyInfo *pKeyInfo;
004708    const unsigned char *aKey1 = (const unsigned char *)pKey1;
004709    Mem mem1;
004710  
004711    /* If bSkip is true, then the caller has already determined that the first
004712    ** two elements in the keys are equal. Fix the various stack variables so
004713    ** that this routine begins comparing at the second field. */
004714    if( bSkip ){
004715      u32 s1 = aKey1[1];
004716      if( s1<0x80 ){
004717        idx1 = 2;
004718      }else{
004719        idx1 = 1 + sqlite3GetVarint32(&aKey1[1], &s1);
004720      }
004721      szHdr1 = aKey1[0];
004722      d1 = szHdr1 + sqlite3VdbeSerialTypeLen(s1);
004723      i = 1;
004724      pRhs++;
004725    }else{
004726      if( (szHdr1 = aKey1[0])<0x80 ){
004727        idx1 = 1;
004728      }else{
004729        idx1 = sqlite3GetVarint32(aKey1, &szHdr1);
004730      }
004731      d1 = szHdr1;
004732      i = 0;
004733    }
004734    if( d1>(unsigned)nKey1 ){
004735      pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
004736      return 0;  /* Corruption */
004737    }
004738  
004739    VVA_ONLY( mem1.szMalloc = 0; ) /* Only needed by assert() statements */
004740    assert( pPKey2->pKeyInfo->nAllField>=pPKey2->nField
004741         || CORRUPT_DB );
004742    assert( pPKey2->pKeyInfo->aSortFlags!=0 );
004743    assert( pPKey2->pKeyInfo->nKeyField>0 );
004744    assert( idx1<=szHdr1 || CORRUPT_DB );
004745    while( 1 /*exit-by-break*/ ){
004746      u32 serial_type;
004747  
004748      /* RHS is an integer */
004749      if( pRhs->flags & (MEM_Int|MEM_IntReal) ){
004750        testcase( pRhs->flags & MEM_Int );
004751        testcase( pRhs->flags & MEM_IntReal );
004752        serial_type = aKey1[idx1];
004753        testcase( serial_type==12 );
004754        if( serial_type>=10 ){
004755          rc = serial_type==10 ? -1 : +1;
004756        }else if( serial_type==0 ){
004757          rc = -1;
004758        }else if( serial_type==7 ){
004759          serialGet7(&aKey1[d1], &mem1);
004760          rc = -sqlite3IntFloatCompare(pRhs->u.i, mem1.u.r);
004761        }else{
004762          i64 lhs = vdbeRecordDecodeInt(serial_type, &aKey1[d1]);
004763          i64 rhs = pRhs->u.i;
004764          if( lhs<rhs ){
004765            rc = -1;
004766          }else if( lhs>rhs ){
004767            rc = +1;
004768          }
004769        }
004770      }
004771  
004772      /* RHS is real */
004773      else if( pRhs->flags & MEM_Real ){
004774        serial_type = aKey1[idx1];
004775        if( serial_type>=10 ){
004776          /* Serial types 12 or greater are strings and blobs (greater than
004777          ** numbers). Types 10 and 11 are currently "reserved for future
004778          ** use", so it doesn't really matter what the results of comparing
004779          ** them to numeric values are.  */
004780          rc = serial_type==10 ? -1 : +1;
004781        }else if( serial_type==0 ){
004782          rc = -1;
004783        }else{
004784          if( serial_type==7 ){
004785            if( serialGet7(&aKey1[d1], &mem1) ){
004786              rc = -1;  /* mem1 is a NaN */
004787            }else if( mem1.u.r<pRhs->u.r ){
004788              rc = -1;
004789            }else if( mem1.u.r>pRhs->u.r ){
004790              rc = +1;
004791            }else{
004792              assert( rc==0 );
004793            }
004794          }else{
004795            sqlite3VdbeSerialGet(&aKey1[d1], serial_type, &mem1);
004796            rc = sqlite3IntFloatCompare(mem1.u.i, pRhs->u.r);
004797          }
004798        }
004799      }
004800  
004801      /* RHS is a string */
004802      else if( pRhs->flags & MEM_Str ){
004803        getVarint32NR(&aKey1[idx1], serial_type);
004804        testcase( serial_type==12 );
004805        if( serial_type<12 ){
004806          rc = -1;
004807        }else if( !(serial_type & 0x01) ){
004808          rc = +1;
004809        }else{
004810          mem1.n = (serial_type - 12) / 2;
004811          testcase( (d1+mem1.n)==(unsigned)nKey1 );
004812          testcase( (d1+mem1.n+1)==(unsigned)nKey1 );
004813          if( (d1+mem1.n) > (unsigned)nKey1
004814           || (pKeyInfo = pPKey2->pKeyInfo)->nAllField<=i
004815          ){
004816            pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
004817            return 0;                /* Corruption */
004818          }else if( pKeyInfo->aColl[i] ){
004819            mem1.enc = pKeyInfo->enc;
004820            mem1.db = pKeyInfo->db;
004821            mem1.flags = MEM_Str;
004822            mem1.z = (char*)&aKey1[d1];
004823            rc = vdbeCompareMemString(
004824                &mem1, pRhs, pKeyInfo->aColl[i], &pPKey2->errCode
004825            );
004826          }else{
004827            int nCmp = MIN(mem1.n, pRhs->n);
004828            rc = memcmp(&aKey1[d1], pRhs->z, nCmp);
004829            if( rc==0 ) rc = mem1.n - pRhs->n;
004830          }
004831        }
004832      }
004833  
004834      /* RHS is a blob */
004835      else if( pRhs->flags & MEM_Blob ){
004836        assert( (pRhs->flags & MEM_Zero)==0 || pRhs->n==0 );
004837        getVarint32NR(&aKey1[idx1], serial_type);
004838        testcase( serial_type==12 );
004839        if( serial_type<12 || (serial_type & 0x01) ){
004840          rc = -1;
004841        }else{
004842          int nStr = (serial_type - 12) / 2;
004843          testcase( (d1+nStr)==(unsigned)nKey1 );
004844          testcase( (d1+nStr+1)==(unsigned)nKey1 );
004845          if( (d1+nStr) > (unsigned)nKey1 ){
004846            pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
004847            return 0;                /* Corruption */
004848          }else if( pRhs->flags & MEM_Zero ){
004849            if( !isAllZero((const char*)&aKey1[d1],nStr) ){
004850              rc = 1;
004851            }else{
004852              rc = nStr - pRhs->u.nZero;
004853            }
004854          }else{
004855            int nCmp = MIN(nStr, pRhs->n);
004856            rc = memcmp(&aKey1[d1], pRhs->z, nCmp);
004857            if( rc==0 ) rc = nStr - pRhs->n;
004858          }
004859        }
004860      }
004861  
004862      /* RHS is null */
004863      else{
004864        serial_type = aKey1[idx1];
004865        if( serial_type==0
004866         || serial_type==10
004867         || (serial_type==7 && serialGet7(&aKey1[d1], &mem1)!=0)
004868        ){
004869          assert( rc==0 );
004870        }else{
004871          rc = 1;
004872        }
004873      }
004874  
004875      if( rc!=0 ){
004876        int sortFlags = pPKey2->pKeyInfo->aSortFlags[i];
004877        if( sortFlags ){
004878          if( (sortFlags & KEYINFO_ORDER_BIGNULL)==0
004879           || ((sortFlags & KEYINFO_ORDER_DESC)
004880             !=(serial_type==0 || (pRhs->flags&MEM_Null)))
004881          ){
004882            rc = -rc;
004883          }
004884        }
004885        assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, rc) );
004886        assert( mem1.szMalloc==0 );  /* See comment below */
004887        return rc;
004888      }
004889  
004890      i++;
004891      if( i==pPKey2->nField ) break;
004892      pRhs++;
004893      d1 += sqlite3VdbeSerialTypeLen(serial_type);
004894      if( d1>(unsigned)nKey1 ) break;
004895      idx1 += sqlite3VarintLen(serial_type);
004896      if( idx1>=(unsigned)szHdr1 ){
004897        pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
004898        return 0;  /* Corrupt index */
004899      }
004900    }
004901  
004902    /* No memory allocation is ever used on mem1.  Prove this using
004903    ** the following assert().  If the assert() fails, it indicates a
004904    ** memory leak and a need to call sqlite3VdbeMemRelease(&mem1).  */
004905    assert( mem1.szMalloc==0 );
004906  
004907    /* rc==0 here means that one or both of the keys ran out of fields and
004908    ** all the fields up to that point were equal. Return the default_rc
004909    ** value.  */
004910    assert( CORRUPT_DB
004911         || vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, pPKey2->default_rc)
004912         || pPKey2->pKeyInfo->db->mallocFailed
004913    );
004914    pPKey2->eqSeen = 1;
004915    return pPKey2->default_rc;
004916  }
004917  int sqlite3VdbeRecordCompare(
004918    int nKey1, const void *pKey1,   /* Left key */
004919    UnpackedRecord *pPKey2          /* Right key */
004920  ){
004921    return sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 0);
004922  }
004923  
004924  
004925  /*
004926  ** This function is an optimized version of sqlite3VdbeRecordCompare()
004927  ** that (a) the first field of pPKey2 is an integer, and (b) the
004928  ** size-of-header varint at the start of (pKey1/nKey1) fits in a single
004929  ** byte (i.e. is less than 128).
004930  **
004931  ** To avoid concerns about buffer overreads, this routine is only used
004932  ** on schemas where the maximum valid header size is 63 bytes or less.
004933  */
004934  static int vdbeRecordCompareInt(
004935    int nKey1, const void *pKey1, /* Left key */
004936    UnpackedRecord *pPKey2        /* Right key */
004937  ){
004938    const u8 *aKey = &((const u8*)pKey1)[*(const u8*)pKey1 & 0x3F];
004939    int serial_type = ((const u8*)pKey1)[1];
004940    int res;
004941    u32 y;
004942    u64 x;
004943    i64 v;
004944    i64 lhs;
004945  
004946    vdbeAssertFieldCountWithinLimits(nKey1, pKey1, pPKey2->pKeyInfo);
004947    assert( (*(u8*)pKey1)<=0x3F || CORRUPT_DB );
004948    switch( serial_type ){
004949      case 1: { /* 1-byte signed integer */
004950        lhs = ONE_BYTE_INT(aKey);
004951        testcase( lhs<0 );
004952        break;
004953      }
004954      case 2: { /* 2-byte signed integer */
004955        lhs = TWO_BYTE_INT(aKey);
004956        testcase( lhs<0 );
004957        break;
004958      }
004959      case 3: { /* 3-byte signed integer */
004960        lhs = THREE_BYTE_INT(aKey);
004961        testcase( lhs<0 );
004962        break;
004963      }
004964      case 4: { /* 4-byte signed integer */
004965        y = FOUR_BYTE_UINT(aKey);
004966        lhs = (i64)*(int*)&y;
004967        testcase( lhs<0 );
004968        break;
004969      }
004970      case 5: { /* 6-byte signed integer */
004971        lhs = FOUR_BYTE_UINT(aKey+2) + (((i64)1)<<32)*TWO_BYTE_INT(aKey);
004972        testcase( lhs<0 );
004973        break;
004974      }
004975      case 6: { /* 8-byte signed integer */
004976        x = FOUR_BYTE_UINT(aKey);
004977        x = (x<<32) | FOUR_BYTE_UINT(aKey+4);
004978        lhs = *(i64*)&x;
004979        testcase( lhs<0 );
004980        break;
004981      }
004982      case 8:
004983        lhs = 0;
004984        break;
004985      case 9:
004986        lhs = 1;
004987        break;
004988  
004989      /* This case could be removed without changing the results of running
004990      ** this code. Including it causes gcc to generate a faster switch
004991      ** statement (since the range of switch targets now starts at zero and
004992      ** is contiguous) but does not cause any duplicate code to be generated
004993      ** (as gcc is clever enough to combine the two like cases). Other
004994      ** compilers might be similar.  */
004995      case 0: case 7:
004996        return sqlite3VdbeRecordCompare(nKey1, pKey1, pPKey2);
004997  
004998      default:
004999        return sqlite3VdbeRecordCompare(nKey1, pKey1, pPKey2);
005000    }
005001  
005002    assert( pPKey2->u.i == pPKey2->aMem[0].u.i );
005003    v = pPKey2->u.i;
005004    if( v>lhs ){
005005      res = pPKey2->r1;
005006    }else if( v<lhs ){
005007      res = pPKey2->r2;
005008    }else if( pPKey2->nField>1 ){
005009      /* The first fields of the two keys are equal. Compare the trailing
005010      ** fields.  */
005011      res = sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 1);
005012    }else{
005013      /* The first fields of the two keys are equal and there are no trailing
005014      ** fields. Return pPKey2->default_rc in this case. */
005015      res = pPKey2->default_rc;
005016      pPKey2->eqSeen = 1;
005017    }
005018  
005019    assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, res) );
005020    return res;
005021  }
005022  
005023  /*
005024  ** This function is an optimized version of sqlite3VdbeRecordCompare()
005025  ** that (a) the first field of pPKey2 is a string, that (b) the first field
005026  ** uses the collation sequence BINARY and (c) that the size-of-header varint
005027  ** at the start of (pKey1/nKey1) fits in a single byte.
005028  */
005029  static int vdbeRecordCompareString(
005030    int nKey1, const void *pKey1, /* Left key */
005031    UnpackedRecord *pPKey2        /* Right key */
005032  ){
005033    const u8 *aKey1 = (const u8*)pKey1;
005034    int serial_type;
005035    int res;
005036  
005037    assert( pPKey2->aMem[0].flags & MEM_Str );
005038    assert( pPKey2->aMem[0].n == pPKey2->n );
005039    assert( pPKey2->aMem[0].z == pPKey2->u.z );
005040    vdbeAssertFieldCountWithinLimits(nKey1, pKey1, pPKey2->pKeyInfo);
005041    serial_type = (signed char)(aKey1[1]);
005042  
005043  vrcs_restart:
005044    if( serial_type<12 ){
005045      if( serial_type<0 ){
005046        sqlite3GetVarint32(&aKey1[1], (u32*)&serial_type);
005047        if( serial_type>=12 ) goto vrcs_restart;
005048        assert( CORRUPT_DB );
005049      }
005050      res = pPKey2->r1;      /* (pKey1/nKey1) is a number or a null */
005051    }else if( !(serial_type & 0x01) ){
005052      res = pPKey2->r2;      /* (pKey1/nKey1) is a blob */
005053    }else{
005054      int nCmp;
005055      int nStr;
005056      int szHdr = aKey1[0];
005057  
005058      nStr = (serial_type-12) / 2;
005059      if( (szHdr + nStr) > nKey1 ){
005060        pPKey2->errCode = (u8)SQLITE_CORRUPT_BKPT;
005061        return 0;    /* Corruption */
005062      }
005063      nCmp = MIN( pPKey2->n, nStr );
005064      res = memcmp(&aKey1[szHdr], pPKey2->u.z, nCmp);
005065  
005066      if( res>0 ){
005067        res = pPKey2->r2;
005068      }else if( res<0 ){
005069        res = pPKey2->r1;
005070      }else{
005071        res = nStr - pPKey2->n;
005072        if( res==0 ){
005073          if( pPKey2->nField>1 ){
005074            res = sqlite3VdbeRecordCompareWithSkip(nKey1, pKey1, pPKey2, 1);
005075          }else{
005076            res = pPKey2->default_rc;
005077            pPKey2->eqSeen = 1;
005078          }
005079        }else if( res>0 ){
005080          res = pPKey2->r2;
005081        }else{
005082          res = pPKey2->r1;
005083        }
005084      }
005085    }
005086  
005087    assert( vdbeRecordCompareDebug(nKey1, pKey1, pPKey2, res)
005088         || CORRUPT_DB
005089         || pPKey2->pKeyInfo->db->mallocFailed
005090    );
005091    return res;
005092  }
005093  
005094  /*
005095  ** Return a pointer to an sqlite3VdbeRecordCompare() compatible function
005096  ** suitable for comparing serialized records to the unpacked record passed
005097  ** as the only argument.
005098  */
005099  RecordCompare sqlite3VdbeFindCompare(UnpackedRecord *p){
005100    /* varintRecordCompareInt() and varintRecordCompareString() both assume
005101    ** that the size-of-header varint that occurs at the start of each record
005102    ** fits in a single byte (i.e. is 127 or less). varintRecordCompareInt()
005103    ** also assumes that it is safe to overread a buffer by at least the
005104    ** maximum possible legal header size plus 8 bytes. Because there is
005105    ** guaranteed to be at least 74 (but not 136) bytes of padding following each
005106    ** buffer passed to varintRecordCompareInt() this makes it convenient to
005107    ** limit the size of the header to 64 bytes in cases where the first field
005108    ** is an integer.
005109    **
005110    ** The easiest way to enforce this limit is to consider only records with
005111    ** 13 fields or less. If the first field is an integer, the maximum legal
005112    ** header size is (12*5 + 1 + 1) bytes.  */
005113    if( p->pKeyInfo->nAllField<=13 ){
005114      int flags = p->aMem[0].flags;
005115      if( p->pKeyInfo->aSortFlags[0] ){
005116        if( p->pKeyInfo->aSortFlags[0] & KEYINFO_ORDER_BIGNULL ){
005117          return sqlite3VdbeRecordCompare;
005118        }
005119        p->r1 = 1;
005120        p->r2 = -1;
005121      }else{
005122        p->r1 = -1;
005123        p->r2 = 1;
005124      }
005125      if( (flags & MEM_Int) ){
005126        p->u.i = p->aMem[0].u.i;
005127        return vdbeRecordCompareInt;
005128      }
005129      testcase( flags & MEM_Real );
005130      testcase( flags & MEM_Null );
005131      testcase( flags & MEM_Blob );
005132      if( (flags & (MEM_Real|MEM_IntReal|MEM_Null|MEM_Blob))==0
005133       && p->pKeyInfo->aColl[0]==0
005134      ){
005135        assert( flags & MEM_Str );
005136        p->u.z = p->aMem[0].z;
005137        p->n = p->aMem[0].n;
005138        return vdbeRecordCompareString;
005139      }
005140    }
005141  
005142    return sqlite3VdbeRecordCompare;
005143  }
005144  
005145  /*
005146  ** pCur points at an index entry created using the OP_MakeRecord opcode.
005147  ** Read the rowid (the last field in the record) and store it in *rowid.
005148  ** Return SQLITE_OK if everything works, or an error code otherwise.
005149  **
005150  ** pCur might be pointing to text obtained from a corrupt database file.
005151  ** So the content cannot be trusted.  Do appropriate checks on the content.
005152  */
005153  int sqlite3VdbeIdxRowid(sqlite3 *db, BtCursor *pCur, i64 *rowid){
005154    i64 nCellKey = 0;
005155    int rc;
005156    u32 szHdr;        /* Size of the header */
005157    u32 typeRowid;    /* Serial type of the rowid */
005158    u32 lenRowid;     /* Size of the rowid */
005159    Mem m, v;
005160  
005161    /* Get the size of the index entry.  Only indices entries of less
005162    ** than 2GiB are support - anything large must be database corruption.
005163    ** Any corruption is detected in sqlite3BtreeParseCellPtr(), though, so
005164    ** this code can safely assume that nCellKey is 32-bits 
005165    */
005166    assert( sqlite3BtreeCursorIsValid(pCur) );
005167    nCellKey = sqlite3BtreePayloadSize(pCur);
005168    assert( (nCellKey & SQLITE_MAX_U32)==(u64)nCellKey );
005169  
005170    /* Read in the complete content of the index entry */
005171    sqlite3VdbeMemInit(&m, db, 0);
005172    rc = sqlite3VdbeMemFromBtreeZeroOffset(pCur, (u32)nCellKey, &m);
005173    if( rc ){
005174      return rc;
005175    }
005176  
005177    /* The index entry must begin with a header size */
005178    getVarint32NR((u8*)m.z, szHdr);
005179    testcase( szHdr==3 );
005180    testcase( szHdr==(u32)m.n );
005181    testcase( szHdr>0x7fffffff );
005182    assert( m.n>=0 );
005183    if( unlikely(szHdr<3 || szHdr>(unsigned)m.n) ){
005184      goto idx_rowid_corruption;
005185    }
005186  
005187    /* The last field of the index should be an integer - the ROWID.
005188    ** Verify that the last entry really is an integer. */
005189    getVarint32NR((u8*)&m.z[szHdr-1], typeRowid);
005190    testcase( typeRowid==1 );
005191    testcase( typeRowid==2 );
005192    testcase( typeRowid==3 );
005193    testcase( typeRowid==4 );
005194    testcase( typeRowid==5 );
005195    testcase( typeRowid==6 );
005196    testcase( typeRowid==8 );
005197    testcase( typeRowid==9 );
005198    if( unlikely(typeRowid<1 || typeRowid>9 || typeRowid==7) ){
005199      goto idx_rowid_corruption;
005200    }
005201    lenRowid = sqlite3SmallTypeSizes[typeRowid];
005202    testcase( (u32)m.n==szHdr+lenRowid );
005203    if( unlikely((u32)m.n<szHdr+lenRowid) ){
005204      goto idx_rowid_corruption;
005205    }
005206  
005207    /* Fetch the integer off the end of the index record */
005208    sqlite3VdbeSerialGet((u8*)&m.z[m.n-lenRowid], typeRowid, &v);
005209    *rowid = v.u.i;
005210    sqlite3VdbeMemReleaseMalloc(&m);
005211    return SQLITE_OK;
005212  
005213    /* Jump here if database corruption is detected after m has been
005214    ** allocated.  Free the m object and return SQLITE_CORRUPT. */
005215  idx_rowid_corruption:
005216    testcase( m.szMalloc!=0 );
005217    sqlite3VdbeMemReleaseMalloc(&m);
005218    return SQLITE_CORRUPT_BKPT;
005219  }
005220  
005221  /*
005222  ** Compare the key of the index entry that cursor pC is pointing to against
005223  ** the key string in pUnpacked.  Write into *pRes a number
005224  ** that is negative, zero, or positive if pC is less than, equal to,
005225  ** or greater than pUnpacked.  Return SQLITE_OK on success.
005226  **
005227  ** pUnpacked is either created without a rowid or is truncated so that it
005228  ** omits the rowid at the end.  The rowid at the end of the index entry
005229  ** is ignored as well.  Hence, this routine only compares the prefixes
005230  ** of the keys prior to the final rowid, not the entire key.
005231  */
005232  int sqlite3VdbeIdxKeyCompare(
005233    sqlite3 *db,                     /* Database connection */
005234    VdbeCursor *pC,                  /* The cursor to compare against */
005235    UnpackedRecord *pUnpacked,       /* Unpacked version of key */
005236    int *res                         /* Write the comparison result here */
005237  ){
005238    i64 nCellKey = 0;
005239    int rc;
005240    BtCursor *pCur;
005241    Mem m;
005242  
005243    assert( pC->eCurType==CURTYPE_BTREE );
005244    pCur = pC->uc.pCursor;
005245    assert( sqlite3BtreeCursorIsValid(pCur) );
005246    nCellKey = sqlite3BtreePayloadSize(pCur);
005247    /* nCellKey will always be between 0 and 0xffffffff because of the way
005248    ** that btreeParseCellPtr() and sqlite3GetVarint32() are implemented */
005249    if( nCellKey<=0 || nCellKey>0x7fffffff ){
005250      *res = 0;
005251      return SQLITE_CORRUPT_BKPT;
005252    }
005253    sqlite3VdbeMemInit(&m, db, 0);
005254    rc = sqlite3VdbeMemFromBtreeZeroOffset(pCur, (u32)nCellKey, &m);
005255    if( rc ){
005256      return rc;
005257    }
005258    *res = sqlite3VdbeRecordCompareWithSkip(m.n, m.z, pUnpacked, 0);
005259    sqlite3VdbeMemReleaseMalloc(&m);
005260    return SQLITE_OK;
005261  }
005262  
005263  /*
005264  ** This routine sets the value to be returned by subsequent calls to
005265  ** sqlite3_changes() on the database handle 'db'.
005266  */
005267  void sqlite3VdbeSetChanges(sqlite3 *db, i64 nChange){
005268    assert( sqlite3_mutex_held(db->mutex) );
005269    db->nChange = nChange;
005270    db->nTotalChange += nChange;
005271  }
005272  
005273  /*
005274  ** Set a flag in the vdbe to update the change counter when it is finalised
005275  ** or reset.
005276  */
005277  void sqlite3VdbeCountChanges(Vdbe *v){
005278    v->changeCntOn = 1;
005279  }
005280  
005281  /*
005282  ** Mark every prepared statement associated with a database connection
005283  ** as expired.
005284  **
005285  ** An expired statement means that recompilation of the statement is
005286  ** recommend.  Statements expire when things happen that make their
005287  ** programs obsolete.  Removing user-defined functions or collating
005288  ** sequences, or changing an authorization function are the types of
005289  ** things that make prepared statements obsolete.
005290  **
005291  ** If iCode is 1, then expiration is advisory.  The statement should
005292  ** be reprepared before being restarted, but if it is already running
005293  ** it is allowed to run to completion.
005294  **
005295  ** Internally, this function just sets the Vdbe.expired flag on all
005296  ** prepared statements.  The flag is set to 1 for an immediate expiration
005297  ** and set to 2 for an advisory expiration.
005298  */
005299  void sqlite3ExpirePreparedStatements(sqlite3 *db, int iCode){
005300    Vdbe *p;
005301    for(p = db->pVdbe; p; p=p->pVNext){
005302      p->expired = iCode+1;
005303    }
005304  }
005305  
005306  /*
005307  ** Return the database associated with the Vdbe.
005308  */
005309  sqlite3 *sqlite3VdbeDb(Vdbe *v){
005310    return v->db;
005311  }
005312  
005313  /*
005314  ** Return the SQLITE_PREPARE flags for a Vdbe.
005315  */
005316  u8 sqlite3VdbePrepareFlags(Vdbe *v){
005317    return v->prepFlags;
005318  }
005319  
005320  /*
005321  ** Return a pointer to an sqlite3_value structure containing the value bound
005322  ** parameter iVar of VM v. Except, if the value is an SQL NULL, return
005323  ** 0 instead. Unless it is NULL, apply affinity aff (one of the SQLITE_AFF_*
005324  ** constants) to the value before returning it.
005325  **
005326  ** The returned value must be freed by the caller using sqlite3ValueFree().
005327  */
005328  sqlite3_value *sqlite3VdbeGetBoundValue(Vdbe *v, int iVar, u8 aff){
005329    assert( iVar>0 );
005330    if( v ){
005331      Mem *pMem = &v->aVar[iVar-1];
005332      assert( (v->db->flags & SQLITE_EnableQPSG)==0 );
005333      if( 0==(pMem->flags & MEM_Null) ){
005334        sqlite3_value *pRet = sqlite3ValueNew(v->db);
005335        if( pRet ){
005336          sqlite3VdbeMemCopy((Mem *)pRet, pMem);
005337          sqlite3ValueApplyAffinity(pRet, aff, SQLITE_UTF8);
005338        }
005339        return pRet;
005340      }
005341    }
005342    return 0;
005343  }
005344  
005345  /*
005346  ** Configure SQL variable iVar so that binding a new value to it signals
005347  ** to sqlite3_reoptimize() that re-preparing the statement may result
005348  ** in a better query plan.
005349  */
005350  void sqlite3VdbeSetVarmask(Vdbe *v, int iVar){
005351    assert( iVar>0 );
005352    assert( (v->db->flags & SQLITE_EnableQPSG)==0 );
005353    if( iVar>=32 ){
005354      v->expmask |= 0x80000000;
005355    }else{
005356      v->expmask |= ((u32)1 << (iVar-1));
005357    }
005358  }
005359  
005360  /*
005361  ** Cause a function to throw an error if it was call from OP_PureFunc
005362  ** rather than OP_Function.
005363  **
005364  ** OP_PureFunc means that the function must be deterministic, and should
005365  ** throw an error if it is given inputs that would make it non-deterministic.
005366  ** This routine is invoked by date/time functions that use non-deterministic
005367  ** features such as 'now'.
005368  */
005369  int sqlite3NotPureFunc(sqlite3_context *pCtx){
005370    const VdbeOp *pOp;
005371  #ifdef SQLITE_ENABLE_STAT4
005372    if( pCtx->pVdbe==0 ) return 1;
005373  #endif
005374    pOp = pCtx->pVdbe->aOp + pCtx->iOp;
005375    if( pOp->opcode==OP_PureFunc ){
005376      const char *zContext;
005377      char *zMsg;
005378      if( pOp->p5 & NC_IsCheck ){
005379        zContext = "a CHECK constraint";
005380      }else if( pOp->p5 & NC_GenCol ){
005381        zContext = "a generated column";
005382      }else{
005383        zContext = "an index";
005384      }
005385      zMsg = sqlite3_mprintf("non-deterministic use of %s() in %s",
005386                             pCtx->pFunc->zName, zContext);
005387      sqlite3_result_error(pCtx, zMsg, -1);
005388      sqlite3_free(zMsg);
005389      return 0;
005390    }
005391    return 1;
005392  }
005393  
005394  #if defined(SQLITE_ENABLE_CURSOR_HINTS) && defined(SQLITE_DEBUG)
005395  /*
005396  ** This Walker callback is used to help verify that calls to
005397  ** sqlite3BtreeCursorHint() with opcode BTREE_HINT_RANGE have
005398  ** byte-code register values correctly initialized.
005399  */
005400  int sqlite3CursorRangeHintExprCheck(Walker *pWalker, Expr *pExpr){
005401    if( pExpr->op==TK_REGISTER ){
005402      assert( (pWalker->u.aMem[pExpr->iTable].flags & MEM_Undefined)==0 );
005403    }
005404    return WRC_Continue;
005405  }
005406  #endif /* SQLITE_ENABLE_CURSOR_HINTS && SQLITE_DEBUG */
005407  
005408  #ifndef SQLITE_OMIT_VIRTUALTABLE
005409  /*
005410  ** Transfer error message text from an sqlite3_vtab.zErrMsg (text stored
005411  ** in memory obtained from sqlite3_malloc) into a Vdbe.zErrMsg (text stored
005412  ** in memory obtained from sqlite3DbMalloc).
005413  */
005414  void sqlite3VtabImportErrmsg(Vdbe *p, sqlite3_vtab *pVtab){
005415    if( pVtab->zErrMsg ){
005416      sqlite3 *db = p->db;
005417      sqlite3DbFree(db, p->zErrMsg);
005418      p->zErrMsg = sqlite3DbStrDup(db, pVtab->zErrMsg);
005419      sqlite3_free(pVtab->zErrMsg);
005420      pVtab->zErrMsg = 0;
005421    }
005422  }
005423  #endif /* SQLITE_OMIT_VIRTUALTABLE */
005424  
005425  #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
005426  
005427  /*
005428  ** If the second argument is not NULL, release any allocations associated
005429  ** with the memory cells in the p->aMem[] array. Also free the UnpackedRecord
005430  ** structure itself, using sqlite3DbFree().
005431  **
005432  ** This function is used to free UnpackedRecord structures allocated by
005433  ** the vdbeUnpackRecord() function found in vdbeapi.c.
005434  */
005435  static void vdbeFreeUnpacked(sqlite3 *db, int nField, UnpackedRecord *p){
005436    assert( db!=0 );
005437    if( p ){
005438      int i;
005439      for(i=0; i<nField; i++){
005440        Mem *pMem = &p->aMem[i];
005441        if( pMem->zMalloc ) sqlite3VdbeMemReleaseMalloc(pMem);
005442      }
005443      sqlite3DbNNFreeNN(db, p);
005444    }
005445  }
005446  #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
005447  
005448  #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
005449  /*
005450  ** Invoke the pre-update hook. If this is an UPDATE or DELETE pre-update call,
005451  ** then cursor passed as the second argument should point to the row about
005452  ** to be update or deleted. If the application calls sqlite3_preupdate_old(),
005453  ** the required value will be read from the row the cursor points to.
005454  */
005455  void sqlite3VdbePreUpdateHook(
005456    Vdbe *v,                        /* Vdbe pre-update hook is invoked by */
005457    VdbeCursor *pCsr,               /* Cursor to grab old.* values from */
005458    int op,                         /* SQLITE_INSERT, UPDATE or DELETE */
005459    const char *zDb,                /* Database name */
005460    Table *pTab,                    /* Modified table */
005461    i64 iKey1,                      /* Initial key value */
005462    int iReg,                       /* Register for new.* record */
005463    int iBlobWrite
005464  ){
005465    sqlite3 *db = v->db;
005466    i64 iKey2;
005467    PreUpdate preupdate;
005468    const char *zTbl = pTab->zName;
005469    static const u8 fakeSortOrder = 0;
005470  #ifdef SQLITE_DEBUG
005471    int nRealCol;
005472    if( pTab->tabFlags & TF_WithoutRowid ){
005473      nRealCol = sqlite3PrimaryKeyIndex(pTab)->nColumn;
005474    }else if( pTab->tabFlags & TF_HasVirtual ){
005475      nRealCol = pTab->nNVCol;
005476    }else{
005477      nRealCol = pTab->nCol;
005478    }
005479  #endif
005480  
005481    assert( db->pPreUpdate==0 );
005482    memset(&preupdate, 0, sizeof(PreUpdate));
005483    if( HasRowid(pTab)==0 ){
005484      iKey1 = iKey2 = 0;
005485      preupdate.pPk = sqlite3PrimaryKeyIndex(pTab);
005486    }else{
005487      if( op==SQLITE_UPDATE ){
005488        iKey2 = v->aMem[iReg].u.i;
005489      }else{
005490        iKey2 = iKey1;
005491      }
005492    }
005493  
005494    assert( pCsr!=0 );
005495    assert( pCsr->eCurType==CURTYPE_BTREE );
005496    assert( pCsr->nField==nRealCol
005497         || (pCsr->nField==nRealCol+1 && op==SQLITE_DELETE && iReg==-1)
005498    );
005499  
005500    preupdate.v = v;
005501    preupdate.pCsr = pCsr;
005502    preupdate.op = op;
005503    preupdate.iNewReg = iReg;
005504    preupdate.keyinfo.db = db;
005505    preupdate.keyinfo.enc = ENC(db);
005506    preupdate.keyinfo.nKeyField = pTab->nCol;
005507    preupdate.keyinfo.aSortFlags = (u8*)&fakeSortOrder;
005508    preupdate.iKey1 = iKey1;
005509    preupdate.iKey2 = iKey2;
005510    preupdate.pTab = pTab;
005511    preupdate.iBlobWrite = iBlobWrite;
005512  
005513    db->pPreUpdate = &preupdate;
005514    db->xPreUpdateCallback(db->pPreUpdateArg, db, op, zDb, zTbl, iKey1, iKey2);
005515    db->pPreUpdate = 0;
005516    sqlite3DbFree(db, preupdate.aRecord);
005517    vdbeFreeUnpacked(db, preupdate.keyinfo.nKeyField+1, preupdate.pUnpacked);
005518    vdbeFreeUnpacked(db, preupdate.keyinfo.nKeyField+1, preupdate.pNewUnpacked);
005519    if( preupdate.aNew ){
005520      int i;
005521      for(i=0; i<pCsr->nField; i++){
005522        sqlite3VdbeMemRelease(&preupdate.aNew[i]);
005523      }
005524      sqlite3DbNNFreeNN(db, preupdate.aNew);
005525    }
005526  }
005527  #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */