/ Artifact Content
Login

Artifact 18a53540aa35dbdf77f715ea928422a4ed9011dc16ea7b50f803fd1617fcc4f5:


     1  /*
     2  ** 2004 April 6
     3  **
     4  ** The author disclaims copyright to this source code.  In place of
     5  ** a legal notice, here is a blessing:
     6  **
     7  **    May you do good and not evil.
     8  **    May you find forgiveness for yourself and forgive others.
     9  **    May you share freely, never taking more than you give.
    10  **
    11  *************************************************************************
    12  ** This file implements an external (disk-based) database using BTrees.
    13  ** See the header comment on "btreeInt.h" for additional information.
    14  ** Including a description of file format and an overview of operation.
    15  */
    16  #include "btreeInt.h"
    17  
    18  /*
    19  ** The header string that appears at the beginning of every
    20  ** SQLite database.
    21  */
    22  static const char zMagicHeader[] = SQLITE_FILE_HEADER;
    23  
    24  /*
    25  ** Set this global variable to 1 to enable tracing using the TRACE
    26  ** macro.
    27  */
    28  #if 0
    29  int sqlite3BtreeTrace=1;  /* True to enable tracing */
    30  # define TRACE(X)  if(sqlite3BtreeTrace){printf X;fflush(stdout);}
    31  #else
    32  # define TRACE(X)
    33  #endif
    34  
    35  /*
    36  ** Extract a 2-byte big-endian integer from an array of unsigned bytes.
    37  ** But if the value is zero, make it 65536.
    38  **
    39  ** This routine is used to extract the "offset to cell content area" value
    40  ** from the header of a btree page.  If the page size is 65536 and the page
    41  ** is empty, the offset should be 65536, but the 2-byte value stores zero.
    42  ** This routine makes the necessary adjustment to 65536.
    43  */
    44  #define get2byteNotZero(X)  (((((int)get2byte(X))-1)&0xffff)+1)
    45  
    46  /*
    47  ** Values passed as the 5th argument to allocateBtreePage()
    48  */
    49  #define BTALLOC_ANY   0           /* Allocate any page */
    50  #define BTALLOC_EXACT 1           /* Allocate exact page if possible */
    51  #define BTALLOC_LE    2           /* Allocate any page <= the parameter */
    52  
    53  /*
    54  ** Macro IfNotOmitAV(x) returns (x) if SQLITE_OMIT_AUTOVACUUM is not 
    55  ** defined, or 0 if it is. For example:
    56  **
    57  **   bIncrVacuum = IfNotOmitAV(pBtShared->incrVacuum);
    58  */
    59  #ifndef SQLITE_OMIT_AUTOVACUUM
    60  #define IfNotOmitAV(expr) (expr)
    61  #else
    62  #define IfNotOmitAV(expr) 0
    63  #endif
    64  
    65  #ifndef SQLITE_OMIT_SHARED_CACHE
    66  /*
    67  ** A list of BtShared objects that are eligible for participation
    68  ** in shared cache.  This variable has file scope during normal builds,
    69  ** but the test harness needs to access it so we make it global for 
    70  ** test builds.
    71  **
    72  ** Access to this variable is protected by SQLITE_MUTEX_STATIC_MASTER.
    73  */
    74  #ifdef SQLITE_TEST
    75  BtShared *SQLITE_WSD sqlite3SharedCacheList = 0;
    76  #else
    77  static BtShared *SQLITE_WSD sqlite3SharedCacheList = 0;
    78  #endif
    79  #endif /* SQLITE_OMIT_SHARED_CACHE */
    80  
    81  #ifndef SQLITE_OMIT_SHARED_CACHE
    82  /*
    83  ** Enable or disable the shared pager and schema features.
    84  **
    85  ** This routine has no effect on existing database connections.
    86  ** The shared cache setting effects only future calls to
    87  ** sqlite3_open(), sqlite3_open16(), or sqlite3_open_v2().
    88  */
    89  int sqlite3_enable_shared_cache(int enable){
    90    sqlite3GlobalConfig.sharedCacheEnabled = enable;
    91    return SQLITE_OK;
    92  }
    93  #endif
    94  
    95  
    96  
    97  #ifdef SQLITE_OMIT_SHARED_CACHE
    98    /*
    99    ** The functions querySharedCacheTableLock(), setSharedCacheTableLock(),
   100    ** and clearAllSharedCacheTableLocks()
   101    ** manipulate entries in the BtShared.pLock linked list used to store
   102    ** shared-cache table level locks. If the library is compiled with the
   103    ** shared-cache feature disabled, then there is only ever one user
   104    ** of each BtShared structure and so this locking is not necessary. 
   105    ** So define the lock related functions as no-ops.
   106    */
   107    #define querySharedCacheTableLock(a,b,c) SQLITE_OK
   108    #define setSharedCacheTableLock(a,b,c) SQLITE_OK
   109    #define clearAllSharedCacheTableLocks(a)
   110    #define downgradeAllSharedCacheTableLocks(a)
   111    #define hasSharedCacheTableLock(a,b,c,d) 1
   112    #define hasReadConflicts(a, b) 0
   113  #endif
   114  
   115  /*
   116  ** Implementation of the SQLITE_CORRUPT_PAGE() macro. Takes a single
   117  ** (MemPage*) as an argument. The (MemPage*) must not be NULL.
   118  **
   119  ** If SQLITE_DEBUG is not defined, then this macro is equivalent to
   120  ** SQLITE_CORRUPT_BKPT. Or, if SQLITE_DEBUG is set, then the log message
   121  ** normally produced as a side-effect of SQLITE_CORRUPT_BKPT is augmented
   122  ** with the page number and filename associated with the (MemPage*).
   123  */
   124  #ifdef SQLITE_DEBUG
   125  int corruptPageError(int lineno, MemPage *p){
   126    char *zMsg;
   127    sqlite3BeginBenignMalloc();
   128    zMsg = sqlite3_mprintf("database corruption page %d of %s",
   129        (int)p->pgno, sqlite3PagerFilename(p->pBt->pPager, 0)
   130    );
   131    sqlite3EndBenignMalloc();
   132    if( zMsg ){
   133      sqlite3ReportError(SQLITE_CORRUPT, lineno, zMsg);
   134    }
   135    sqlite3_free(zMsg);
   136    return SQLITE_CORRUPT_BKPT;
   137  }
   138  # define SQLITE_CORRUPT_PAGE(pMemPage) corruptPageError(__LINE__, pMemPage)
   139  #else
   140  # define SQLITE_CORRUPT_PAGE(pMemPage) SQLITE_CORRUPT_PGNO(pMemPage->pgno)
   141  #endif
   142  
   143  #ifndef SQLITE_OMIT_SHARED_CACHE
   144  
   145  #ifdef SQLITE_DEBUG
   146  /*
   147  **** This function is only used as part of an assert() statement. ***
   148  **
   149  ** Check to see if pBtree holds the required locks to read or write to the 
   150  ** table with root page iRoot.   Return 1 if it does and 0 if not.
   151  **
   152  ** For example, when writing to a table with root-page iRoot via 
   153  ** Btree connection pBtree:
   154  **
   155  **    assert( hasSharedCacheTableLock(pBtree, iRoot, 0, WRITE_LOCK) );
   156  **
   157  ** When writing to an index that resides in a sharable database, the 
   158  ** caller should have first obtained a lock specifying the root page of
   159  ** the corresponding table. This makes things a bit more complicated,
   160  ** as this module treats each table as a separate structure. To determine
   161  ** the table corresponding to the index being written, this
   162  ** function has to search through the database schema.
   163  **
   164  ** Instead of a lock on the table/index rooted at page iRoot, the caller may
   165  ** hold a write-lock on the schema table (root page 1). This is also
   166  ** acceptable.
   167  */
   168  static int hasSharedCacheTableLock(
   169    Btree *pBtree,         /* Handle that must hold lock */
   170    Pgno iRoot,            /* Root page of b-tree */
   171    int isIndex,           /* True if iRoot is the root of an index b-tree */
   172    int eLockType          /* Required lock type (READ_LOCK or WRITE_LOCK) */
   173  ){
   174    Schema *pSchema = (Schema *)pBtree->pBt->pSchema;
   175    Pgno iTab = 0;
   176    BtLock *pLock;
   177  
   178    /* If this database is not shareable, or if the client is reading
   179    ** and has the read-uncommitted flag set, then no lock is required. 
   180    ** Return true immediately.
   181    */
   182    if( (pBtree->sharable==0)
   183     || (eLockType==READ_LOCK && (pBtree->db->flags & SQLITE_ReadUncommit))
   184    ){
   185      return 1;
   186    }
   187  
   188    /* If the client is reading  or writing an index and the schema is
   189    ** not loaded, then it is too difficult to actually check to see if
   190    ** the correct locks are held.  So do not bother - just return true.
   191    ** This case does not come up very often anyhow.
   192    */
   193    if( isIndex && (!pSchema || (pSchema->schemaFlags&DB_SchemaLoaded)==0) ){
   194      return 1;
   195    }
   196  
   197    /* Figure out the root-page that the lock should be held on. For table
   198    ** b-trees, this is just the root page of the b-tree being read or
   199    ** written. For index b-trees, it is the root page of the associated
   200    ** table.  */
   201    if( isIndex ){
   202      HashElem *p;
   203      for(p=sqliteHashFirst(&pSchema->idxHash); p; p=sqliteHashNext(p)){
   204        Index *pIdx = (Index *)sqliteHashData(p);
   205        if( pIdx->tnum==(int)iRoot ){
   206          if( iTab ){
   207            /* Two or more indexes share the same root page.  There must
   208            ** be imposter tables.  So just return true.  The assert is not
   209            ** useful in that case. */
   210            return 1;
   211          }
   212          iTab = pIdx->pTable->tnum;
   213        }
   214      }
   215    }else{
   216      iTab = iRoot;
   217    }
   218  
   219    /* Search for the required lock. Either a write-lock on root-page iTab, a 
   220    ** write-lock on the schema table, or (if the client is reading) a
   221    ** read-lock on iTab will suffice. Return 1 if any of these are found.  */
   222    for(pLock=pBtree->pBt->pLock; pLock; pLock=pLock->pNext){
   223      if( pLock->pBtree==pBtree 
   224       && (pLock->iTable==iTab || (pLock->eLock==WRITE_LOCK && pLock->iTable==1))
   225       && pLock->eLock>=eLockType 
   226      ){
   227        return 1;
   228      }
   229    }
   230  
   231    /* Failed to find the required lock. */
   232    return 0;
   233  }
   234  #endif /* SQLITE_DEBUG */
   235  
   236  #ifdef SQLITE_DEBUG
   237  /*
   238  **** This function may be used as part of assert() statements only. ****
   239  **
   240  ** Return true if it would be illegal for pBtree to write into the
   241  ** table or index rooted at iRoot because other shared connections are
   242  ** simultaneously reading that same table or index.
   243  **
   244  ** It is illegal for pBtree to write if some other Btree object that
   245  ** shares the same BtShared object is currently reading or writing
   246  ** the iRoot table.  Except, if the other Btree object has the
   247  ** read-uncommitted flag set, then it is OK for the other object to
   248  ** have a read cursor.
   249  **
   250  ** For example, before writing to any part of the table or index
   251  ** rooted at page iRoot, one should call:
   252  **
   253  **    assert( !hasReadConflicts(pBtree, iRoot) );
   254  */
   255  static int hasReadConflicts(Btree *pBtree, Pgno iRoot){
   256    BtCursor *p;
   257    for(p=pBtree->pBt->pCursor; p; p=p->pNext){
   258      if( p->pgnoRoot==iRoot 
   259       && p->pBtree!=pBtree
   260       && 0==(p->pBtree->db->flags & SQLITE_ReadUncommit)
   261      ){
   262        return 1;
   263      }
   264    }
   265    return 0;
   266  }
   267  #endif    /* #ifdef SQLITE_DEBUG */
   268  
   269  /*
   270  ** Query to see if Btree handle p may obtain a lock of type eLock 
   271  ** (READ_LOCK or WRITE_LOCK) on the table with root-page iTab. Return
   272  ** SQLITE_OK if the lock may be obtained (by calling
   273  ** setSharedCacheTableLock()), or SQLITE_LOCKED if not.
   274  */
   275  static int querySharedCacheTableLock(Btree *p, Pgno iTab, u8 eLock){
   276    BtShared *pBt = p->pBt;
   277    BtLock *pIter;
   278  
   279    assert( sqlite3BtreeHoldsMutex(p) );
   280    assert( eLock==READ_LOCK || eLock==WRITE_LOCK );
   281    assert( p->db!=0 );
   282    assert( !(p->db->flags&SQLITE_ReadUncommit)||eLock==WRITE_LOCK||iTab==1 );
   283    
   284    /* If requesting a write-lock, then the Btree must have an open write
   285    ** transaction on this file. And, obviously, for this to be so there 
   286    ** must be an open write transaction on the file itself.
   287    */
   288    assert( eLock==READ_LOCK || (p==pBt->pWriter && p->inTrans==TRANS_WRITE) );
   289    assert( eLock==READ_LOCK || pBt->inTransaction==TRANS_WRITE );
   290    
   291    /* This routine is a no-op if the shared-cache is not enabled */
   292    if( !p->sharable ){
   293      return SQLITE_OK;
   294    }
   295  
   296    /* If some other connection is holding an exclusive lock, the
   297    ** requested lock may not be obtained.
   298    */
   299    if( pBt->pWriter!=p && (pBt->btsFlags & BTS_EXCLUSIVE)!=0 ){
   300      sqlite3ConnectionBlocked(p->db, pBt->pWriter->db);
   301      return SQLITE_LOCKED_SHAREDCACHE;
   302    }
   303  
   304    for(pIter=pBt->pLock; pIter; pIter=pIter->pNext){
   305      /* The condition (pIter->eLock!=eLock) in the following if(...) 
   306      ** statement is a simplification of:
   307      **
   308      **   (eLock==WRITE_LOCK || pIter->eLock==WRITE_LOCK)
   309      **
   310      ** since we know that if eLock==WRITE_LOCK, then no other connection
   311      ** may hold a WRITE_LOCK on any table in this file (since there can
   312      ** only be a single writer).
   313      */
   314      assert( pIter->eLock==READ_LOCK || pIter->eLock==WRITE_LOCK );
   315      assert( eLock==READ_LOCK || pIter->pBtree==p || pIter->eLock==READ_LOCK);
   316      if( pIter->pBtree!=p && pIter->iTable==iTab && pIter->eLock!=eLock ){
   317        sqlite3ConnectionBlocked(p->db, pIter->pBtree->db);
   318        if( eLock==WRITE_LOCK ){
   319          assert( p==pBt->pWriter );
   320          pBt->btsFlags |= BTS_PENDING;
   321        }
   322        return SQLITE_LOCKED_SHAREDCACHE;
   323      }
   324    }
   325    return SQLITE_OK;
   326  }
   327  #endif /* !SQLITE_OMIT_SHARED_CACHE */
   328  
   329  #ifndef SQLITE_OMIT_SHARED_CACHE
   330  /*
   331  ** Add a lock on the table with root-page iTable to the shared-btree used
   332  ** by Btree handle p. Parameter eLock must be either READ_LOCK or 
   333  ** WRITE_LOCK.
   334  **
   335  ** This function assumes the following:
   336  **
   337  **   (a) The specified Btree object p is connected to a sharable
   338  **       database (one with the BtShared.sharable flag set), and
   339  **
   340  **   (b) No other Btree objects hold a lock that conflicts
   341  **       with the requested lock (i.e. querySharedCacheTableLock() has
   342  **       already been called and returned SQLITE_OK).
   343  **
   344  ** SQLITE_OK is returned if the lock is added successfully. SQLITE_NOMEM 
   345  ** is returned if a malloc attempt fails.
   346  */
   347  static int setSharedCacheTableLock(Btree *p, Pgno iTable, u8 eLock){
   348    BtShared *pBt = p->pBt;
   349    BtLock *pLock = 0;
   350    BtLock *pIter;
   351  
   352    assert( sqlite3BtreeHoldsMutex(p) );
   353    assert( eLock==READ_LOCK || eLock==WRITE_LOCK );
   354    assert( p->db!=0 );
   355  
   356    /* A connection with the read-uncommitted flag set will never try to
   357    ** obtain a read-lock using this function. The only read-lock obtained
   358    ** by a connection in read-uncommitted mode is on the sqlite_master 
   359    ** table, and that lock is obtained in BtreeBeginTrans().  */
   360    assert( 0==(p->db->flags&SQLITE_ReadUncommit) || eLock==WRITE_LOCK );
   361  
   362    /* This function should only be called on a sharable b-tree after it 
   363    ** has been determined that no other b-tree holds a conflicting lock.  */
   364    assert( p->sharable );
   365    assert( SQLITE_OK==querySharedCacheTableLock(p, iTable, eLock) );
   366  
   367    /* First search the list for an existing lock on this table. */
   368    for(pIter=pBt->pLock; pIter; pIter=pIter->pNext){
   369      if( pIter->iTable==iTable && pIter->pBtree==p ){
   370        pLock = pIter;
   371        break;
   372      }
   373    }
   374  
   375    /* If the above search did not find a BtLock struct associating Btree p
   376    ** with table iTable, allocate one and link it into the list.
   377    */
   378    if( !pLock ){
   379      pLock = (BtLock *)sqlite3MallocZero(sizeof(BtLock));
   380      if( !pLock ){
   381        return SQLITE_NOMEM_BKPT;
   382      }
   383      pLock->iTable = iTable;
   384      pLock->pBtree = p;
   385      pLock->pNext = pBt->pLock;
   386      pBt->pLock = pLock;
   387    }
   388  
   389    /* Set the BtLock.eLock variable to the maximum of the current lock
   390    ** and the requested lock. This means if a write-lock was already held
   391    ** and a read-lock requested, we don't incorrectly downgrade the lock.
   392    */
   393    assert( WRITE_LOCK>READ_LOCK );
   394    if( eLock>pLock->eLock ){
   395      pLock->eLock = eLock;
   396    }
   397  
   398    return SQLITE_OK;
   399  }
   400  #endif /* !SQLITE_OMIT_SHARED_CACHE */
   401  
   402  #ifndef SQLITE_OMIT_SHARED_CACHE
   403  /*
   404  ** Release all the table locks (locks obtained via calls to
   405  ** the setSharedCacheTableLock() procedure) held by Btree object p.
   406  **
   407  ** This function assumes that Btree p has an open read or write 
   408  ** transaction. If it does not, then the BTS_PENDING flag
   409  ** may be incorrectly cleared.
   410  */
   411  static void clearAllSharedCacheTableLocks(Btree *p){
   412    BtShared *pBt = p->pBt;
   413    BtLock **ppIter = &pBt->pLock;
   414  
   415    assert( sqlite3BtreeHoldsMutex(p) );
   416    assert( p->sharable || 0==*ppIter );
   417    assert( p->inTrans>0 );
   418  
   419    while( *ppIter ){
   420      BtLock *pLock = *ppIter;
   421      assert( (pBt->btsFlags & BTS_EXCLUSIVE)==0 || pBt->pWriter==pLock->pBtree );
   422      assert( pLock->pBtree->inTrans>=pLock->eLock );
   423      if( pLock->pBtree==p ){
   424        *ppIter = pLock->pNext;
   425        assert( pLock->iTable!=1 || pLock==&p->lock );
   426        if( pLock->iTable!=1 ){
   427          sqlite3_free(pLock);
   428        }
   429      }else{
   430        ppIter = &pLock->pNext;
   431      }
   432    }
   433  
   434    assert( (pBt->btsFlags & BTS_PENDING)==0 || pBt->pWriter );
   435    if( pBt->pWriter==p ){
   436      pBt->pWriter = 0;
   437      pBt->btsFlags &= ~(BTS_EXCLUSIVE|BTS_PENDING);
   438    }else if( pBt->nTransaction==2 ){
   439      /* This function is called when Btree p is concluding its 
   440      ** transaction. If there currently exists a writer, and p is not
   441      ** that writer, then the number of locks held by connections other
   442      ** than the writer must be about to drop to zero. In this case
   443      ** set the BTS_PENDING flag to 0.
   444      **
   445      ** If there is not currently a writer, then BTS_PENDING must
   446      ** be zero already. So this next line is harmless in that case.
   447      */
   448      pBt->btsFlags &= ~BTS_PENDING;
   449    }
   450  }
   451  
   452  /*
   453  ** This function changes all write-locks held by Btree p into read-locks.
   454  */
   455  static void downgradeAllSharedCacheTableLocks(Btree *p){
   456    BtShared *pBt = p->pBt;
   457    if( pBt->pWriter==p ){
   458      BtLock *pLock;
   459      pBt->pWriter = 0;
   460      pBt->btsFlags &= ~(BTS_EXCLUSIVE|BTS_PENDING);
   461      for(pLock=pBt->pLock; pLock; pLock=pLock->pNext){
   462        assert( pLock->eLock==READ_LOCK || pLock->pBtree==p );
   463        pLock->eLock = READ_LOCK;
   464      }
   465    }
   466  }
   467  
   468  #endif /* SQLITE_OMIT_SHARED_CACHE */
   469  
   470  static void releasePage(MemPage *pPage);         /* Forward reference */
   471  static void releasePageOne(MemPage *pPage);      /* Forward reference */
   472  static void releasePageNotNull(MemPage *pPage);  /* Forward reference */
   473  
   474  /*
   475  ***** This routine is used inside of assert() only ****
   476  **
   477  ** Verify that the cursor holds the mutex on its BtShared
   478  */
   479  #ifdef SQLITE_DEBUG
   480  static int cursorHoldsMutex(BtCursor *p){
   481    return sqlite3_mutex_held(p->pBt->mutex);
   482  }
   483  
   484  /* Verify that the cursor and the BtShared agree about what is the current
   485  ** database connetion. This is important in shared-cache mode. If the database 
   486  ** connection pointers get out-of-sync, it is possible for routines like
   487  ** btreeInitPage() to reference an stale connection pointer that references a
   488  ** a connection that has already closed.  This routine is used inside assert()
   489  ** statements only and for the purpose of double-checking that the btree code
   490  ** does keep the database connection pointers up-to-date.
   491  */
   492  static int cursorOwnsBtShared(BtCursor *p){
   493    assert( cursorHoldsMutex(p) );
   494    return (p->pBtree->db==p->pBt->db);
   495  }
   496  #endif
   497  
   498  /*
   499  ** Invalidate the overflow cache of the cursor passed as the first argument.
   500  ** on the shared btree structure pBt.
   501  */
   502  #define invalidateOverflowCache(pCur) (pCur->curFlags &= ~BTCF_ValidOvfl)
   503  
   504  /*
   505  ** Invalidate the overflow page-list cache for all cursors opened
   506  ** on the shared btree structure pBt.
   507  */
   508  static void invalidateAllOverflowCache(BtShared *pBt){
   509    BtCursor *p;
   510    assert( sqlite3_mutex_held(pBt->mutex) );
   511    for(p=pBt->pCursor; p; p=p->pNext){
   512      invalidateOverflowCache(p);
   513    }
   514  }
   515  
   516  #ifndef SQLITE_OMIT_INCRBLOB
   517  /*
   518  ** This function is called before modifying the contents of a table
   519  ** to invalidate any incrblob cursors that are open on the
   520  ** row or one of the rows being modified.
   521  **
   522  ** If argument isClearTable is true, then the entire contents of the
   523  ** table is about to be deleted. In this case invalidate all incrblob
   524  ** cursors open on any row within the table with root-page pgnoRoot.
   525  **
   526  ** Otherwise, if argument isClearTable is false, then the row with
   527  ** rowid iRow is being replaced or deleted. In this case invalidate
   528  ** only those incrblob cursors open on that specific row.
   529  */
   530  static void invalidateIncrblobCursors(
   531    Btree *pBtree,          /* The database file to check */
   532    Pgno pgnoRoot,          /* The table that might be changing */
   533    i64 iRow,               /* The rowid that might be changing */
   534    int isClearTable        /* True if all rows are being deleted */
   535  ){
   536    BtCursor *p;
   537    if( pBtree->hasIncrblobCur==0 ) return;
   538    assert( sqlite3BtreeHoldsMutex(pBtree) );
   539    pBtree->hasIncrblobCur = 0;
   540    for(p=pBtree->pBt->pCursor; p; p=p->pNext){
   541      if( (p->curFlags & BTCF_Incrblob)!=0 ){
   542        pBtree->hasIncrblobCur = 1;
   543        if( p->pgnoRoot==pgnoRoot && (isClearTable || p->info.nKey==iRow) ){
   544          p->eState = CURSOR_INVALID;
   545        }
   546      }
   547    }
   548  }
   549  
   550  #else
   551    /* Stub function when INCRBLOB is omitted */
   552    #define invalidateIncrblobCursors(w,x,y,z)
   553  #endif /* SQLITE_OMIT_INCRBLOB */
   554  
   555  /*
   556  ** Set bit pgno of the BtShared.pHasContent bitvec. This is called 
   557  ** when a page that previously contained data becomes a free-list leaf 
   558  ** page.
   559  **
   560  ** The BtShared.pHasContent bitvec exists to work around an obscure
   561  ** bug caused by the interaction of two useful IO optimizations surrounding
   562  ** free-list leaf pages:
   563  **
   564  **   1) When all data is deleted from a page and the page becomes
   565  **      a free-list leaf page, the page is not written to the database
   566  **      (as free-list leaf pages contain no meaningful data). Sometimes
   567  **      such a page is not even journalled (as it will not be modified,
   568  **      why bother journalling it?).
   569  **
   570  **   2) When a free-list leaf page is reused, its content is not read
   571  **      from the database or written to the journal file (why should it
   572  **      be, if it is not at all meaningful?).
   573  **
   574  ** By themselves, these optimizations work fine and provide a handy
   575  ** performance boost to bulk delete or insert operations. However, if
   576  ** a page is moved to the free-list and then reused within the same
   577  ** transaction, a problem comes up. If the page is not journalled when
   578  ** it is moved to the free-list and it is also not journalled when it
   579  ** is extracted from the free-list and reused, then the original data
   580  ** may be lost. In the event of a rollback, it may not be possible
   581  ** to restore the database to its original configuration.
   582  **
   583  ** The solution is the BtShared.pHasContent bitvec. Whenever a page is 
   584  ** moved to become a free-list leaf page, the corresponding bit is
   585  ** set in the bitvec. Whenever a leaf page is extracted from the free-list,
   586  ** optimization 2 above is omitted if the corresponding bit is already
   587  ** set in BtShared.pHasContent. The contents of the bitvec are cleared
   588  ** at the end of every transaction.
   589  */
   590  static int btreeSetHasContent(BtShared *pBt, Pgno pgno){
   591    int rc = SQLITE_OK;
   592    if( !pBt->pHasContent ){
   593      assert( pgno<=pBt->nPage );
   594      pBt->pHasContent = sqlite3BitvecCreate(pBt->nPage);
   595      if( !pBt->pHasContent ){
   596        rc = SQLITE_NOMEM_BKPT;
   597      }
   598    }
   599    if( rc==SQLITE_OK && pgno<=sqlite3BitvecSize(pBt->pHasContent) ){
   600      rc = sqlite3BitvecSet(pBt->pHasContent, pgno);
   601    }
   602    return rc;
   603  }
   604  
   605  /*
   606  ** Query the BtShared.pHasContent vector.
   607  **
   608  ** This function is called when a free-list leaf page is removed from the
   609  ** free-list for reuse. It returns false if it is safe to retrieve the
   610  ** page from the pager layer with the 'no-content' flag set. True otherwise.
   611  */
   612  static int btreeGetHasContent(BtShared *pBt, Pgno pgno){
   613    Bitvec *p = pBt->pHasContent;
   614    return (p && (pgno>sqlite3BitvecSize(p) || sqlite3BitvecTest(p, pgno)));
   615  }
   616  
   617  /*
   618  ** Clear (destroy) the BtShared.pHasContent bitvec. This should be
   619  ** invoked at the conclusion of each write-transaction.
   620  */
   621  static void btreeClearHasContent(BtShared *pBt){
   622    sqlite3BitvecDestroy(pBt->pHasContent);
   623    pBt->pHasContent = 0;
   624  }
   625  
   626  /*
   627  ** Release all of the apPage[] pages for a cursor.
   628  */
   629  static void btreeReleaseAllCursorPages(BtCursor *pCur){
   630    int i;
   631    if( pCur->iPage>=0 ){
   632      for(i=0; i<pCur->iPage; i++){
   633        releasePageNotNull(pCur->apPage[i]);
   634      }
   635      releasePageNotNull(pCur->pPage);
   636      pCur->iPage = -1;
   637    }
   638  }
   639  
   640  /*
   641  ** The cursor passed as the only argument must point to a valid entry
   642  ** when this function is called (i.e. have eState==CURSOR_VALID). This
   643  ** function saves the current cursor key in variables pCur->nKey and
   644  ** pCur->pKey. SQLITE_OK is returned if successful or an SQLite error 
   645  ** code otherwise.
   646  **
   647  ** If the cursor is open on an intkey table, then the integer key
   648  ** (the rowid) is stored in pCur->nKey and pCur->pKey is left set to
   649  ** NULL. If the cursor is open on a non-intkey table, then pCur->pKey is 
   650  ** set to point to a malloced buffer pCur->nKey bytes in size containing 
   651  ** the key.
   652  */
   653  static int saveCursorKey(BtCursor *pCur){
   654    int rc = SQLITE_OK;
   655    assert( CURSOR_VALID==pCur->eState );
   656    assert( 0==pCur->pKey );
   657    assert( cursorHoldsMutex(pCur) );
   658  
   659    if( pCur->curIntKey ){
   660      /* Only the rowid is required for a table btree */
   661      pCur->nKey = sqlite3BtreeIntegerKey(pCur);
   662    }else{
   663      /* For an index btree, save the complete key content */
   664      void *pKey;
   665      pCur->nKey = sqlite3BtreePayloadSize(pCur);
   666      pKey = sqlite3Malloc( pCur->nKey );
   667      if( pKey ){
   668        rc = sqlite3BtreePayload(pCur, 0, (int)pCur->nKey, pKey);
   669        if( rc==SQLITE_OK ){
   670          pCur->pKey = pKey;
   671        }else{
   672          sqlite3_free(pKey);
   673        }
   674      }else{
   675        rc = SQLITE_NOMEM_BKPT;
   676      }
   677    }
   678    assert( !pCur->curIntKey || !pCur->pKey );
   679    return rc;
   680  }
   681  
   682  /*
   683  ** Save the current cursor position in the variables BtCursor.nKey 
   684  ** and BtCursor.pKey. The cursor's state is set to CURSOR_REQUIRESEEK.
   685  **
   686  ** The caller must ensure that the cursor is valid (has eState==CURSOR_VALID)
   687  ** prior to calling this routine.  
   688  */
   689  static int saveCursorPosition(BtCursor *pCur){
   690    int rc;
   691  
   692    assert( CURSOR_VALID==pCur->eState || CURSOR_SKIPNEXT==pCur->eState );
   693    assert( 0==pCur->pKey );
   694    assert( cursorHoldsMutex(pCur) );
   695  
   696    if( pCur->eState==CURSOR_SKIPNEXT ){
   697      pCur->eState = CURSOR_VALID;
   698    }else{
   699      pCur->skipNext = 0;
   700    }
   701  
   702    rc = saveCursorKey(pCur);
   703    if( rc==SQLITE_OK ){
   704      btreeReleaseAllCursorPages(pCur);
   705      pCur->eState = CURSOR_REQUIRESEEK;
   706    }
   707  
   708    pCur->curFlags &= ~(BTCF_ValidNKey|BTCF_ValidOvfl|BTCF_AtLast);
   709    return rc;
   710  }
   711  
   712  /* Forward reference */
   713  static int SQLITE_NOINLINE saveCursorsOnList(BtCursor*,Pgno,BtCursor*);
   714  
   715  /*
   716  ** Save the positions of all cursors (except pExcept) that are open on
   717  ** the table with root-page iRoot.  "Saving the cursor position" means that
   718  ** the location in the btree is remembered in such a way that it can be
   719  ** moved back to the same spot after the btree has been modified.  This
   720  ** routine is called just before cursor pExcept is used to modify the
   721  ** table, for example in BtreeDelete() or BtreeInsert().
   722  **
   723  ** If there are two or more cursors on the same btree, then all such 
   724  ** cursors should have their BTCF_Multiple flag set.  The btreeCursor()
   725  ** routine enforces that rule.  This routine only needs to be called in
   726  ** the uncommon case when pExpect has the BTCF_Multiple flag set.
   727  **
   728  ** If pExpect!=NULL and if no other cursors are found on the same root-page,
   729  ** then the BTCF_Multiple flag on pExpect is cleared, to avoid another
   730  ** pointless call to this routine.
   731  **
   732  ** Implementation note:  This routine merely checks to see if any cursors
   733  ** need to be saved.  It calls out to saveCursorsOnList() in the (unusual)
   734  ** event that cursors are in need to being saved.
   735  */
   736  static int saveAllCursors(BtShared *pBt, Pgno iRoot, BtCursor *pExcept){
   737    BtCursor *p;
   738    assert( sqlite3_mutex_held(pBt->mutex) );
   739    assert( pExcept==0 || pExcept->pBt==pBt );
   740    for(p=pBt->pCursor; p; p=p->pNext){
   741      if( p!=pExcept && (0==iRoot || p->pgnoRoot==iRoot) ) break;
   742    }
   743    if( p ) return saveCursorsOnList(p, iRoot, pExcept);
   744    if( pExcept ) pExcept->curFlags &= ~BTCF_Multiple;
   745    return SQLITE_OK;
   746  }
   747  
   748  /* This helper routine to saveAllCursors does the actual work of saving
   749  ** the cursors if and when a cursor is found that actually requires saving.
   750  ** The common case is that no cursors need to be saved, so this routine is
   751  ** broken out from its caller to avoid unnecessary stack pointer movement.
   752  */
   753  static int SQLITE_NOINLINE saveCursorsOnList(
   754    BtCursor *p,         /* The first cursor that needs saving */
   755    Pgno iRoot,          /* Only save cursor with this iRoot. Save all if zero */
   756    BtCursor *pExcept    /* Do not save this cursor */
   757  ){
   758    do{
   759      if( p!=pExcept && (0==iRoot || p->pgnoRoot==iRoot) ){
   760        if( p->eState==CURSOR_VALID || p->eState==CURSOR_SKIPNEXT ){
   761          int rc = saveCursorPosition(p);
   762          if( SQLITE_OK!=rc ){
   763            return rc;
   764          }
   765        }else{
   766          testcase( p->iPage>=0 );
   767          btreeReleaseAllCursorPages(p);
   768        }
   769      }
   770      p = p->pNext;
   771    }while( p );
   772    return SQLITE_OK;
   773  }
   774  
   775  /*
   776  ** Clear the current cursor position.
   777  */
   778  void sqlite3BtreeClearCursor(BtCursor *pCur){
   779    assert( cursorHoldsMutex(pCur) );
   780    sqlite3_free(pCur->pKey);
   781    pCur->pKey = 0;
   782    pCur->eState = CURSOR_INVALID;
   783  }
   784  
   785  /*
   786  ** In this version of BtreeMoveto, pKey is a packed index record
   787  ** such as is generated by the OP_MakeRecord opcode.  Unpack the
   788  ** record and then call BtreeMovetoUnpacked() to do the work.
   789  */
   790  static int btreeMoveto(
   791    BtCursor *pCur,     /* Cursor open on the btree to be searched */
   792    const void *pKey,   /* Packed key if the btree is an index */
   793    i64 nKey,           /* Integer key for tables.  Size of pKey for indices */
   794    int bias,           /* Bias search to the high end */
   795    int *pRes           /* Write search results here */
   796  ){
   797    int rc;                    /* Status code */
   798    UnpackedRecord *pIdxKey;   /* Unpacked index key */
   799  
   800    if( pKey ){
   801      assert( nKey==(i64)(int)nKey );
   802      pIdxKey = sqlite3VdbeAllocUnpackedRecord(pCur->pKeyInfo);
   803      if( pIdxKey==0 ) return SQLITE_NOMEM_BKPT;
   804      sqlite3VdbeRecordUnpack(pCur->pKeyInfo, (int)nKey, pKey, pIdxKey);
   805      if( pIdxKey->nField==0 ){
   806        rc = SQLITE_CORRUPT_BKPT;
   807        goto moveto_done;
   808      }
   809    }else{
   810      pIdxKey = 0;
   811    }
   812    rc = sqlite3BtreeMovetoUnpacked(pCur, pIdxKey, nKey, bias, pRes);
   813  moveto_done:
   814    if( pIdxKey ){
   815      sqlite3DbFree(pCur->pKeyInfo->db, pIdxKey);
   816    }
   817    return rc;
   818  }
   819  
   820  /*
   821  ** Restore the cursor to the position it was in (or as close to as possible)
   822  ** when saveCursorPosition() was called. Note that this call deletes the 
   823  ** saved position info stored by saveCursorPosition(), so there can be
   824  ** at most one effective restoreCursorPosition() call after each 
   825  ** saveCursorPosition().
   826  */
   827  static int btreeRestoreCursorPosition(BtCursor *pCur){
   828    int rc;
   829    int skipNext;
   830    assert( cursorOwnsBtShared(pCur) );
   831    assert( pCur->eState>=CURSOR_REQUIRESEEK );
   832    if( pCur->eState==CURSOR_FAULT ){
   833      return pCur->skipNext;
   834    }
   835    pCur->eState = CURSOR_INVALID;
   836    rc = btreeMoveto(pCur, pCur->pKey, pCur->nKey, 0, &skipNext);
   837    if( rc==SQLITE_OK ){
   838      sqlite3_free(pCur->pKey);
   839      pCur->pKey = 0;
   840      assert( pCur->eState==CURSOR_VALID || pCur->eState==CURSOR_INVALID );
   841      pCur->skipNext |= skipNext;
   842      if( pCur->skipNext && pCur->eState==CURSOR_VALID ){
   843        pCur->eState = CURSOR_SKIPNEXT;
   844      }
   845    }
   846    return rc;
   847  }
   848  
   849  #define restoreCursorPosition(p) \
   850    (p->eState>=CURSOR_REQUIRESEEK ? \
   851           btreeRestoreCursorPosition(p) : \
   852           SQLITE_OK)
   853  
   854  /*
   855  ** Determine whether or not a cursor has moved from the position where
   856  ** it was last placed, or has been invalidated for any other reason.
   857  ** Cursors can move when the row they are pointing at is deleted out
   858  ** from under them, for example.  Cursor might also move if a btree
   859  ** is rebalanced.
   860  **
   861  ** Calling this routine with a NULL cursor pointer returns false.
   862  **
   863  ** Use the separate sqlite3BtreeCursorRestore() routine to restore a cursor
   864  ** back to where it ought to be if this routine returns true.
   865  */
   866  int sqlite3BtreeCursorHasMoved(BtCursor *pCur){
   867    return pCur->eState!=CURSOR_VALID;
   868  }
   869  
   870  /*
   871  ** Return a pointer to a fake BtCursor object that will always answer
   872  ** false to the sqlite3BtreeCursorHasMoved() routine above.  The fake
   873  ** cursor returned must not be used with any other Btree interface.
   874  */
   875  BtCursor *sqlite3BtreeFakeValidCursor(void){
   876    static u8 fakeCursor = CURSOR_VALID;
   877    assert( offsetof(BtCursor, eState)==0 );
   878    return (BtCursor*)&fakeCursor;
   879  }
   880  
   881  /*
   882  ** This routine restores a cursor back to its original position after it
   883  ** has been moved by some outside activity (such as a btree rebalance or
   884  ** a row having been deleted out from under the cursor).  
   885  **
   886  ** On success, the *pDifferentRow parameter is false if the cursor is left
   887  ** pointing at exactly the same row.  *pDifferntRow is the row the cursor
   888  ** was pointing to has been deleted, forcing the cursor to point to some
   889  ** nearby row.
   890  **
   891  ** This routine should only be called for a cursor that just returned
   892  ** TRUE from sqlite3BtreeCursorHasMoved().
   893  */
   894  int sqlite3BtreeCursorRestore(BtCursor *pCur, int *pDifferentRow){
   895    int rc;
   896  
   897    assert( pCur!=0 );
   898    assert( pCur->eState!=CURSOR_VALID );
   899    rc = restoreCursorPosition(pCur);
   900    if( rc ){
   901      *pDifferentRow = 1;
   902      return rc;
   903    }
   904    if( pCur->eState!=CURSOR_VALID ){
   905      *pDifferentRow = 1;
   906    }else{
   907      assert( pCur->skipNext==0 );
   908      *pDifferentRow = 0;
   909    }
   910    return SQLITE_OK;
   911  }
   912  
   913  #ifdef SQLITE_ENABLE_CURSOR_HINTS
   914  /*
   915  ** Provide hints to the cursor.  The particular hint given (and the type
   916  ** and number of the varargs parameters) is determined by the eHintType
   917  ** parameter.  See the definitions of the BTREE_HINT_* macros for details.
   918  */
   919  void sqlite3BtreeCursorHint(BtCursor *pCur, int eHintType, ...){
   920    /* Used only by system that substitute their own storage engine */
   921  }
   922  #endif
   923  
   924  /*
   925  ** Provide flag hints to the cursor.
   926  */
   927  void sqlite3BtreeCursorHintFlags(BtCursor *pCur, unsigned x){
   928    assert( x==BTREE_SEEK_EQ || x==BTREE_BULKLOAD || x==0 );
   929    pCur->hints = x;
   930  }
   931  
   932  
   933  #ifndef SQLITE_OMIT_AUTOVACUUM
   934  /*
   935  ** Given a page number of a regular database page, return the page
   936  ** number for the pointer-map page that contains the entry for the
   937  ** input page number.
   938  **
   939  ** Return 0 (not a valid page) for pgno==1 since there is
   940  ** no pointer map associated with page 1.  The integrity_check logic
   941  ** requires that ptrmapPageno(*,1)!=1.
   942  */
   943  static Pgno ptrmapPageno(BtShared *pBt, Pgno pgno){
   944    int nPagesPerMapPage;
   945    Pgno iPtrMap, ret;
   946    assert( sqlite3_mutex_held(pBt->mutex) );
   947    if( pgno<2 ) return 0;
   948    nPagesPerMapPage = (pBt->usableSize/5)+1;
   949    iPtrMap = (pgno-2)/nPagesPerMapPage;
   950    ret = (iPtrMap*nPagesPerMapPage) + 2; 
   951    if( ret==PENDING_BYTE_PAGE(pBt) ){
   952      ret++;
   953    }
   954    return ret;
   955  }
   956  
   957  /*
   958  ** Write an entry into the pointer map.
   959  **
   960  ** This routine updates the pointer map entry for page number 'key'
   961  ** so that it maps to type 'eType' and parent page number 'pgno'.
   962  **
   963  ** If *pRC is initially non-zero (non-SQLITE_OK) then this routine is
   964  ** a no-op.  If an error occurs, the appropriate error code is written
   965  ** into *pRC.
   966  */
   967  static void ptrmapPut(BtShared *pBt, Pgno key, u8 eType, Pgno parent, int *pRC){
   968    DbPage *pDbPage;  /* The pointer map page */
   969    u8 *pPtrmap;      /* The pointer map data */
   970    Pgno iPtrmap;     /* The pointer map page number */
   971    int offset;       /* Offset in pointer map page */
   972    int rc;           /* Return code from subfunctions */
   973  
   974    if( *pRC ) return;
   975  
   976    assert( sqlite3_mutex_held(pBt->mutex) );
   977    /* The master-journal page number must never be used as a pointer map page */
   978    assert( 0==PTRMAP_ISPAGE(pBt, PENDING_BYTE_PAGE(pBt)) );
   979  
   980    assert( pBt->autoVacuum );
   981    if( key==0 ){
   982      *pRC = SQLITE_CORRUPT_BKPT;
   983      return;
   984    }
   985    iPtrmap = PTRMAP_PAGENO(pBt, key);
   986    rc = sqlite3PagerGet(pBt->pPager, iPtrmap, &pDbPage, 0);
   987    if( rc!=SQLITE_OK ){
   988      *pRC = rc;
   989      return;
   990    }
   991    offset = PTRMAP_PTROFFSET(iPtrmap, key);
   992    if( offset<0 ){
   993      *pRC = SQLITE_CORRUPT_BKPT;
   994      goto ptrmap_exit;
   995    }
   996    assert( offset <= (int)pBt->usableSize-5 );
   997    pPtrmap = (u8 *)sqlite3PagerGetData(pDbPage);
   998  
   999    if( eType!=pPtrmap[offset] || get4byte(&pPtrmap[offset+1])!=parent ){
  1000      TRACE(("PTRMAP_UPDATE: %d->(%d,%d)\n", key, eType, parent));
  1001      *pRC= rc = sqlite3PagerWrite(pDbPage);
  1002      if( rc==SQLITE_OK ){
  1003        pPtrmap[offset] = eType;
  1004        put4byte(&pPtrmap[offset+1], parent);
  1005      }
  1006    }
  1007  
  1008  ptrmap_exit:
  1009    sqlite3PagerUnref(pDbPage);
  1010  }
  1011  
  1012  /*
  1013  ** Read an entry from the pointer map.
  1014  **
  1015  ** This routine retrieves the pointer map entry for page 'key', writing
  1016  ** the type and parent page number to *pEType and *pPgno respectively.
  1017  ** An error code is returned if something goes wrong, otherwise SQLITE_OK.
  1018  */
  1019  static int ptrmapGet(BtShared *pBt, Pgno key, u8 *pEType, Pgno *pPgno){
  1020    DbPage *pDbPage;   /* The pointer map page */
  1021    int iPtrmap;       /* Pointer map page index */
  1022    u8 *pPtrmap;       /* Pointer map page data */
  1023    int offset;        /* Offset of entry in pointer map */
  1024    int rc;
  1025  
  1026    assert( sqlite3_mutex_held(pBt->mutex) );
  1027  
  1028    iPtrmap = PTRMAP_PAGENO(pBt, key);
  1029    rc = sqlite3PagerGet(pBt->pPager, iPtrmap, &pDbPage, 0);
  1030    if( rc!=0 ){
  1031      return rc;
  1032    }
  1033    pPtrmap = (u8 *)sqlite3PagerGetData(pDbPage);
  1034  
  1035    offset = PTRMAP_PTROFFSET(iPtrmap, key);
  1036    if( offset<0 ){
  1037      sqlite3PagerUnref(pDbPage);
  1038      return SQLITE_CORRUPT_BKPT;
  1039    }
  1040    assert( offset <= (int)pBt->usableSize-5 );
  1041    assert( pEType!=0 );
  1042    *pEType = pPtrmap[offset];
  1043    if( pPgno ) *pPgno = get4byte(&pPtrmap[offset+1]);
  1044  
  1045    sqlite3PagerUnref(pDbPage);
  1046    if( *pEType<1 || *pEType>5 ) return SQLITE_CORRUPT_PGNO(iPtrmap);
  1047    return SQLITE_OK;
  1048  }
  1049  
  1050  #else /* if defined SQLITE_OMIT_AUTOVACUUM */
  1051    #define ptrmapPut(w,x,y,z,rc)
  1052    #define ptrmapGet(w,x,y,z) SQLITE_OK
  1053    #define ptrmapPutOvflPtr(x, y, rc)
  1054  #endif
  1055  
  1056  /*
  1057  ** Given a btree page and a cell index (0 means the first cell on
  1058  ** the page, 1 means the second cell, and so forth) return a pointer
  1059  ** to the cell content.
  1060  **
  1061  ** findCellPastPtr() does the same except it skips past the initial
  1062  ** 4-byte child pointer found on interior pages, if there is one.
  1063  **
  1064  ** This routine works only for pages that do not contain overflow cells.
  1065  */
  1066  #define findCell(P,I) \
  1067    ((P)->aData + ((P)->maskPage & get2byteAligned(&(P)->aCellIdx[2*(I)])))
  1068  #define findCellPastPtr(P,I) \
  1069    ((P)->aDataOfst + ((P)->maskPage & get2byteAligned(&(P)->aCellIdx[2*(I)])))
  1070  
  1071  
  1072  /*
  1073  ** This is common tail processing for btreeParseCellPtr() and
  1074  ** btreeParseCellPtrIndex() for the case when the cell does not fit entirely
  1075  ** on a single B-tree page.  Make necessary adjustments to the CellInfo
  1076  ** structure.
  1077  */
  1078  static SQLITE_NOINLINE void btreeParseCellAdjustSizeForOverflow(
  1079    MemPage *pPage,         /* Page containing the cell */
  1080    u8 *pCell,              /* Pointer to the cell text. */
  1081    CellInfo *pInfo         /* Fill in this structure */
  1082  ){
  1083    /* If the payload will not fit completely on the local page, we have
  1084    ** to decide how much to store locally and how much to spill onto
  1085    ** overflow pages.  The strategy is to minimize the amount of unused
  1086    ** space on overflow pages while keeping the amount of local storage
  1087    ** in between minLocal and maxLocal.
  1088    **
  1089    ** Warning:  changing the way overflow payload is distributed in any
  1090    ** way will result in an incompatible file format.
  1091    */
  1092    int minLocal;  /* Minimum amount of payload held locally */
  1093    int maxLocal;  /* Maximum amount of payload held locally */
  1094    int surplus;   /* Overflow payload available for local storage */
  1095  
  1096    minLocal = pPage->minLocal;
  1097    maxLocal = pPage->maxLocal;
  1098    surplus = minLocal + (pInfo->nPayload - minLocal)%(pPage->pBt->usableSize-4);
  1099    testcase( surplus==maxLocal );
  1100    testcase( surplus==maxLocal+1 );
  1101    if( surplus <= maxLocal ){
  1102      pInfo->nLocal = (u16)surplus;
  1103    }else{
  1104      pInfo->nLocal = (u16)minLocal;
  1105    }
  1106    pInfo->nSize = (u16)(&pInfo->pPayload[pInfo->nLocal] - pCell) + 4;
  1107  }
  1108  
  1109  /*
  1110  ** The following routines are implementations of the MemPage.xParseCell()
  1111  ** method.
  1112  **
  1113  ** Parse a cell content block and fill in the CellInfo structure.
  1114  **
  1115  ** btreeParseCellPtr()        =>   table btree leaf nodes
  1116  ** btreeParseCellNoPayload()  =>   table btree internal nodes
  1117  ** btreeParseCellPtrIndex()   =>   index btree nodes
  1118  **
  1119  ** There is also a wrapper function btreeParseCell() that works for
  1120  ** all MemPage types and that references the cell by index rather than
  1121  ** by pointer.
  1122  */
  1123  static void btreeParseCellPtrNoPayload(
  1124    MemPage *pPage,         /* Page containing the cell */
  1125    u8 *pCell,              /* Pointer to the cell text. */
  1126    CellInfo *pInfo         /* Fill in this structure */
  1127  ){
  1128    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  1129    assert( pPage->leaf==0 );
  1130    assert( pPage->childPtrSize==4 );
  1131  #ifndef SQLITE_DEBUG
  1132    UNUSED_PARAMETER(pPage);
  1133  #endif
  1134    pInfo->nSize = 4 + getVarint(&pCell[4], (u64*)&pInfo->nKey);
  1135    pInfo->nPayload = 0;
  1136    pInfo->nLocal = 0;
  1137    pInfo->pPayload = 0;
  1138    return;
  1139  }
  1140  static void btreeParseCellPtr(
  1141    MemPage *pPage,         /* Page containing the cell */
  1142    u8 *pCell,              /* Pointer to the cell text. */
  1143    CellInfo *pInfo         /* Fill in this structure */
  1144  ){
  1145    u8 *pIter;              /* For scanning through pCell */
  1146    u32 nPayload;           /* Number of bytes of cell payload */
  1147    u64 iKey;               /* Extracted Key value */
  1148  
  1149    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  1150    assert( pPage->leaf==0 || pPage->leaf==1 );
  1151    assert( pPage->intKeyLeaf );
  1152    assert( pPage->childPtrSize==0 );
  1153    pIter = pCell;
  1154  
  1155    /* The next block of code is equivalent to:
  1156    **
  1157    **     pIter += getVarint32(pIter, nPayload);
  1158    **
  1159    ** The code is inlined to avoid a function call.
  1160    */
  1161    nPayload = *pIter;
  1162    if( nPayload>=0x80 ){
  1163      u8 *pEnd = &pIter[8];
  1164      nPayload &= 0x7f;
  1165      do{
  1166        nPayload = (nPayload<<7) | (*++pIter & 0x7f);
  1167      }while( (*pIter)>=0x80 && pIter<pEnd );
  1168    }
  1169    pIter++;
  1170  
  1171    /* The next block of code is equivalent to:
  1172    **
  1173    **     pIter += getVarint(pIter, (u64*)&pInfo->nKey);
  1174    **
  1175    ** The code is inlined to avoid a function call.
  1176    */
  1177    iKey = *pIter;
  1178    if( iKey>=0x80 ){
  1179      u8 *pEnd = &pIter[7];
  1180      iKey &= 0x7f;
  1181      while(1){
  1182        iKey = (iKey<<7) | (*++pIter & 0x7f);
  1183        if( (*pIter)<0x80 ) break;
  1184        if( pIter>=pEnd ){
  1185          iKey = (iKey<<8) | *++pIter;
  1186          break;
  1187        }
  1188      }
  1189    }
  1190    pIter++;
  1191  
  1192    pInfo->nKey = *(i64*)&iKey;
  1193    pInfo->nPayload = nPayload;
  1194    pInfo->pPayload = pIter;
  1195    testcase( nPayload==pPage->maxLocal );
  1196    testcase( nPayload==pPage->maxLocal+1 );
  1197    if( nPayload<=pPage->maxLocal ){
  1198      /* This is the (easy) common case where the entire payload fits
  1199      ** on the local page.  No overflow is required.
  1200      */
  1201      pInfo->nSize = nPayload + (u16)(pIter - pCell);
  1202      if( pInfo->nSize<4 ) pInfo->nSize = 4;
  1203      pInfo->nLocal = (u16)nPayload;
  1204    }else{
  1205      btreeParseCellAdjustSizeForOverflow(pPage, pCell, pInfo);
  1206    }
  1207  }
  1208  static void btreeParseCellPtrIndex(
  1209    MemPage *pPage,         /* Page containing the cell */
  1210    u8 *pCell,              /* Pointer to the cell text. */
  1211    CellInfo *pInfo         /* Fill in this structure */
  1212  ){
  1213    u8 *pIter;              /* For scanning through pCell */
  1214    u32 nPayload;           /* Number of bytes of cell payload */
  1215  
  1216    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  1217    assert( pPage->leaf==0 || pPage->leaf==1 );
  1218    assert( pPage->intKeyLeaf==0 );
  1219    pIter = pCell + pPage->childPtrSize;
  1220    nPayload = *pIter;
  1221    if( nPayload>=0x80 ){
  1222      u8 *pEnd = &pIter[8];
  1223      nPayload &= 0x7f;
  1224      do{
  1225        nPayload = (nPayload<<7) | (*++pIter & 0x7f);
  1226      }while( *(pIter)>=0x80 && pIter<pEnd );
  1227    }
  1228    pIter++;
  1229    pInfo->nKey = nPayload;
  1230    pInfo->nPayload = nPayload;
  1231    pInfo->pPayload = pIter;
  1232    testcase( nPayload==pPage->maxLocal );
  1233    testcase( nPayload==pPage->maxLocal+1 );
  1234    if( nPayload<=pPage->maxLocal ){
  1235      /* This is the (easy) common case where the entire payload fits
  1236      ** on the local page.  No overflow is required.
  1237      */
  1238      pInfo->nSize = nPayload + (u16)(pIter - pCell);
  1239      if( pInfo->nSize<4 ) pInfo->nSize = 4;
  1240      pInfo->nLocal = (u16)nPayload;
  1241    }else{
  1242      btreeParseCellAdjustSizeForOverflow(pPage, pCell, pInfo);
  1243    }
  1244  }
  1245  static void btreeParseCell(
  1246    MemPage *pPage,         /* Page containing the cell */
  1247    int iCell,              /* The cell index.  First cell is 0 */
  1248    CellInfo *pInfo         /* Fill in this structure */
  1249  ){
  1250    pPage->xParseCell(pPage, findCell(pPage, iCell), pInfo);
  1251  }
  1252  
  1253  /*
  1254  ** The following routines are implementations of the MemPage.xCellSize
  1255  ** method.
  1256  **
  1257  ** Compute the total number of bytes that a Cell needs in the cell
  1258  ** data area of the btree-page.  The return number includes the cell
  1259  ** data header and the local payload, but not any overflow page or
  1260  ** the space used by the cell pointer.
  1261  **
  1262  ** cellSizePtrNoPayload()    =>   table internal nodes
  1263  ** cellSizePtr()             =>   all index nodes & table leaf nodes
  1264  */
  1265  static u16 cellSizePtr(MemPage *pPage, u8 *pCell){
  1266    u8 *pIter = pCell + pPage->childPtrSize; /* For looping over bytes of pCell */
  1267    u8 *pEnd;                                /* End mark for a varint */
  1268    u32 nSize;                               /* Size value to return */
  1269  
  1270  #ifdef SQLITE_DEBUG
  1271    /* The value returned by this function should always be the same as
  1272    ** the (CellInfo.nSize) value found by doing a full parse of the
  1273    ** cell. If SQLITE_DEBUG is defined, an assert() at the bottom of
  1274    ** this function verifies that this invariant is not violated. */
  1275    CellInfo debuginfo;
  1276    pPage->xParseCell(pPage, pCell, &debuginfo);
  1277  #endif
  1278  
  1279    nSize = *pIter;
  1280    if( nSize>=0x80 ){
  1281      pEnd = &pIter[8];
  1282      nSize &= 0x7f;
  1283      do{
  1284        nSize = (nSize<<7) | (*++pIter & 0x7f);
  1285      }while( *(pIter)>=0x80 && pIter<pEnd );
  1286    }
  1287    pIter++;
  1288    if( pPage->intKey ){
  1289      /* pIter now points at the 64-bit integer key value, a variable length 
  1290      ** integer. The following block moves pIter to point at the first byte
  1291      ** past the end of the key value. */
  1292      pEnd = &pIter[9];
  1293      while( (*pIter++)&0x80 && pIter<pEnd );
  1294    }
  1295    testcase( nSize==pPage->maxLocal );
  1296    testcase( nSize==pPage->maxLocal+1 );
  1297    if( nSize<=pPage->maxLocal ){
  1298      nSize += (u32)(pIter - pCell);
  1299      if( nSize<4 ) nSize = 4;
  1300    }else{
  1301      int minLocal = pPage->minLocal;
  1302      nSize = minLocal + (nSize - minLocal) % (pPage->pBt->usableSize - 4);
  1303      testcase( nSize==pPage->maxLocal );
  1304      testcase( nSize==pPage->maxLocal+1 );
  1305      if( nSize>pPage->maxLocal ){
  1306        nSize = minLocal;
  1307      }
  1308      nSize += 4 + (u16)(pIter - pCell);
  1309    }
  1310    assert( nSize==debuginfo.nSize || CORRUPT_DB );
  1311    return (u16)nSize;
  1312  }
  1313  static u16 cellSizePtrNoPayload(MemPage *pPage, u8 *pCell){
  1314    u8 *pIter = pCell + 4; /* For looping over bytes of pCell */
  1315    u8 *pEnd;              /* End mark for a varint */
  1316  
  1317  #ifdef SQLITE_DEBUG
  1318    /* The value returned by this function should always be the same as
  1319    ** the (CellInfo.nSize) value found by doing a full parse of the
  1320    ** cell. If SQLITE_DEBUG is defined, an assert() at the bottom of
  1321    ** this function verifies that this invariant is not violated. */
  1322    CellInfo debuginfo;
  1323    pPage->xParseCell(pPage, pCell, &debuginfo);
  1324  #else
  1325    UNUSED_PARAMETER(pPage);
  1326  #endif
  1327  
  1328    assert( pPage->childPtrSize==4 );
  1329    pEnd = pIter + 9;
  1330    while( (*pIter++)&0x80 && pIter<pEnd );
  1331    assert( debuginfo.nSize==(u16)(pIter - pCell) || CORRUPT_DB );
  1332    return (u16)(pIter - pCell);
  1333  }
  1334  
  1335  
  1336  #ifdef SQLITE_DEBUG
  1337  /* This variation on cellSizePtr() is used inside of assert() statements
  1338  ** only. */
  1339  static u16 cellSize(MemPage *pPage, int iCell){
  1340    return pPage->xCellSize(pPage, findCell(pPage, iCell));
  1341  }
  1342  #endif
  1343  
  1344  #ifndef SQLITE_OMIT_AUTOVACUUM
  1345  /*
  1346  ** If the cell pCell, part of page pPage contains a pointer
  1347  ** to an overflow page, insert an entry into the pointer-map
  1348  ** for the overflow page.
  1349  */
  1350  static void ptrmapPutOvflPtr(MemPage *pPage, u8 *pCell, int *pRC){
  1351    CellInfo info;
  1352    if( *pRC ) return;
  1353    assert( pCell!=0 );
  1354    pPage->xParseCell(pPage, pCell, &info);
  1355    if( info.nLocal<info.nPayload ){
  1356      Pgno ovfl = get4byte(&pCell[info.nSize-4]);
  1357      ptrmapPut(pPage->pBt, ovfl, PTRMAP_OVERFLOW1, pPage->pgno, pRC);
  1358    }
  1359  }
  1360  #endif
  1361  
  1362  
  1363  /*
  1364  ** Defragment the page given. This routine reorganizes cells within the
  1365  ** page so that there are no free-blocks on the free-block list.
  1366  **
  1367  ** Parameter nMaxFrag is the maximum amount of fragmented space that may be
  1368  ** present in the page after this routine returns.
  1369  **
  1370  ** EVIDENCE-OF: R-44582-60138 SQLite may from time to time reorganize a
  1371  ** b-tree page so that there are no freeblocks or fragment bytes, all
  1372  ** unused bytes are contained in the unallocated space region, and all
  1373  ** cells are packed tightly at the end of the page.
  1374  */
  1375  static int defragmentPage(MemPage *pPage, int nMaxFrag){
  1376    int i;                     /* Loop counter */
  1377    int pc;                    /* Address of the i-th cell */
  1378    int hdr;                   /* Offset to the page header */
  1379    int size;                  /* Size of a cell */
  1380    int usableSize;            /* Number of usable bytes on a page */
  1381    int cellOffset;            /* Offset to the cell pointer array */
  1382    int cbrk;                  /* Offset to the cell content area */
  1383    int nCell;                 /* Number of cells on the page */
  1384    unsigned char *data;       /* The page data */
  1385    unsigned char *temp;       /* Temp area for cell content */
  1386    unsigned char *src;        /* Source of content */
  1387    int iCellFirst;            /* First allowable cell index */
  1388    int iCellLast;             /* Last possible cell index */
  1389  
  1390    assert( sqlite3PagerIswriteable(pPage->pDbPage) );
  1391    assert( pPage->pBt!=0 );
  1392    assert( pPage->pBt->usableSize <= SQLITE_MAX_PAGE_SIZE );
  1393    assert( pPage->nOverflow==0 );
  1394    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  1395    temp = 0;
  1396    src = data = pPage->aData;
  1397    hdr = pPage->hdrOffset;
  1398    cellOffset = pPage->cellOffset;
  1399    nCell = pPage->nCell;
  1400    assert( nCell==get2byte(&data[hdr+3]) );
  1401    iCellFirst = cellOffset + 2*nCell;
  1402    usableSize = pPage->pBt->usableSize;
  1403  
  1404    /* This block handles pages with two or fewer free blocks and nMaxFrag
  1405    ** or fewer fragmented bytes. In this case it is faster to move the
  1406    ** two (or one) blocks of cells using memmove() and add the required
  1407    ** offsets to each pointer in the cell-pointer array than it is to 
  1408    ** reconstruct the entire page.  */
  1409    if( (int)data[hdr+7]<=nMaxFrag ){
  1410      int iFree = get2byte(&data[hdr+1]);
  1411      if( iFree ){
  1412        int iFree2 = get2byte(&data[iFree]);
  1413  
  1414        /* pageFindSlot() has already verified that free blocks are sorted
  1415        ** in order of offset within the page, and that no block extends
  1416        ** past the end of the page. Provided the two free slots do not 
  1417        ** overlap, this guarantees that the memmove() calls below will not
  1418        ** overwrite the usableSize byte buffer, even if the database page
  1419        ** is corrupt.  */
  1420        assert( iFree2==0 || iFree2>iFree );
  1421        assert( iFree+get2byte(&data[iFree+2]) <= usableSize );
  1422        assert( iFree2==0 || iFree2+get2byte(&data[iFree2+2]) <= usableSize );
  1423  
  1424        if( 0==iFree2 || (data[iFree2]==0 && data[iFree2+1]==0) ){
  1425          u8 *pEnd = &data[cellOffset + nCell*2];
  1426          u8 *pAddr;
  1427          int sz2 = 0;
  1428          int sz = get2byte(&data[iFree+2]);
  1429          int top = get2byte(&data[hdr+5]);
  1430          if( top>=iFree ){
  1431            return SQLITE_CORRUPT_PAGE(pPage);
  1432          }
  1433          if( iFree2 ){
  1434            assert( iFree+sz<=iFree2 ); /* Verified by pageFindSlot() */
  1435            sz2 = get2byte(&data[iFree2+2]);
  1436            assert( iFree+sz+sz2+iFree2-(iFree+sz) <= usableSize );
  1437            memmove(&data[iFree+sz+sz2], &data[iFree+sz], iFree2-(iFree+sz));
  1438            sz += sz2;
  1439          }
  1440          cbrk = top+sz;
  1441          assert( cbrk+(iFree-top) <= usableSize );
  1442          memmove(&data[cbrk], &data[top], iFree-top);
  1443          for(pAddr=&data[cellOffset]; pAddr<pEnd; pAddr+=2){
  1444            pc = get2byte(pAddr);
  1445            if( pc<iFree ){ put2byte(pAddr, pc+sz); }
  1446            else if( pc<iFree2 ){ put2byte(pAddr, pc+sz2); }
  1447          }
  1448          goto defragment_out;
  1449        }
  1450      }
  1451    }
  1452  
  1453    cbrk = usableSize;
  1454    iCellLast = usableSize - 4;
  1455    for(i=0; i<nCell; i++){
  1456      u8 *pAddr;     /* The i-th cell pointer */
  1457      pAddr = &data[cellOffset + i*2];
  1458      pc = get2byte(pAddr);
  1459      testcase( pc==iCellFirst );
  1460      testcase( pc==iCellLast );
  1461      /* These conditions have already been verified in btreeInitPage()
  1462      ** if PRAGMA cell_size_check=ON.
  1463      */
  1464      if( pc<iCellFirst || pc>iCellLast ){
  1465        return SQLITE_CORRUPT_PAGE(pPage);
  1466      }
  1467      assert( pc>=iCellFirst && pc<=iCellLast );
  1468      size = pPage->xCellSize(pPage, &src[pc]);
  1469      cbrk -= size;
  1470      if( cbrk<iCellFirst || pc+size>usableSize ){
  1471        return SQLITE_CORRUPT_PAGE(pPage);
  1472      }
  1473      assert( cbrk+size<=usableSize && cbrk>=iCellFirst );
  1474      testcase( cbrk+size==usableSize );
  1475      testcase( pc+size==usableSize );
  1476      put2byte(pAddr, cbrk);
  1477      if( temp==0 ){
  1478        int x;
  1479        if( cbrk==pc ) continue;
  1480        temp = sqlite3PagerTempSpace(pPage->pBt->pPager);
  1481        x = get2byte(&data[hdr+5]);
  1482        memcpy(&temp[x], &data[x], (cbrk+size) - x);
  1483        src = temp;
  1484      }
  1485      memcpy(&data[cbrk], &src[pc], size);
  1486    }
  1487    data[hdr+7] = 0;
  1488  
  1489   defragment_out:
  1490    if( data[hdr+7]+cbrk-iCellFirst!=pPage->nFree ){
  1491      return SQLITE_CORRUPT_PAGE(pPage);
  1492    }
  1493    assert( cbrk>=iCellFirst );
  1494    put2byte(&data[hdr+5], cbrk);
  1495    data[hdr+1] = 0;
  1496    data[hdr+2] = 0;
  1497    memset(&data[iCellFirst], 0, cbrk-iCellFirst);
  1498    assert( sqlite3PagerIswriteable(pPage->pDbPage) );
  1499    return SQLITE_OK;
  1500  }
  1501  
  1502  /*
  1503  ** Search the free-list on page pPg for space to store a cell nByte bytes in
  1504  ** size. If one can be found, return a pointer to the space and remove it
  1505  ** from the free-list.
  1506  **
  1507  ** If no suitable space can be found on the free-list, return NULL.
  1508  **
  1509  ** This function may detect corruption within pPg.  If corruption is
  1510  ** detected then *pRc is set to SQLITE_CORRUPT and NULL is returned.
  1511  **
  1512  ** Slots on the free list that are between 1 and 3 bytes larger than nByte
  1513  ** will be ignored if adding the extra space to the fragmentation count
  1514  ** causes the fragmentation count to exceed 60.
  1515  */
  1516  static u8 *pageFindSlot(MemPage *pPg, int nByte, int *pRc){
  1517    const int hdr = pPg->hdrOffset;
  1518    u8 * const aData = pPg->aData;
  1519    int iAddr = hdr + 1;
  1520    int pc = get2byte(&aData[iAddr]);
  1521    int x;
  1522    int usableSize = pPg->pBt->usableSize;
  1523    int size;            /* Size of the free slot */
  1524  
  1525    assert( pc>0 );
  1526    while( pc<=usableSize-4 ){
  1527      /* EVIDENCE-OF: R-22710-53328 The third and fourth bytes of each
  1528      ** freeblock form a big-endian integer which is the size of the freeblock
  1529      ** in bytes, including the 4-byte header. */
  1530      size = get2byte(&aData[pc+2]);
  1531      if( (x = size - nByte)>=0 ){
  1532        testcase( x==4 );
  1533        testcase( x==3 );
  1534        if( size+pc > usableSize ){
  1535          *pRc = SQLITE_CORRUPT_PAGE(pPg);
  1536          return 0;
  1537        }else if( x<4 ){
  1538          /* EVIDENCE-OF: R-11498-58022 In a well-formed b-tree page, the total
  1539          ** number of bytes in fragments may not exceed 60. */
  1540          if( aData[hdr+7]>57 ) return 0;
  1541  
  1542          /* Remove the slot from the free-list. Update the number of
  1543          ** fragmented bytes within the page. */
  1544          memcpy(&aData[iAddr], &aData[pc], 2);
  1545          aData[hdr+7] += (u8)x;
  1546        }else{
  1547          /* The slot remains on the free-list. Reduce its size to account
  1548           ** for the portion used by the new allocation. */
  1549          put2byte(&aData[pc+2], x);
  1550        }
  1551        return &aData[pc + x];
  1552      }
  1553      iAddr = pc;
  1554      pc = get2byte(&aData[pc]);
  1555      if( pc<iAddr+size ) break;
  1556    }
  1557    if( pc ){
  1558      *pRc = SQLITE_CORRUPT_PAGE(pPg);
  1559    }
  1560  
  1561    return 0;
  1562  }
  1563  
  1564  /*
  1565  ** Allocate nByte bytes of space from within the B-Tree page passed
  1566  ** as the first argument. Write into *pIdx the index into pPage->aData[]
  1567  ** of the first byte of allocated space. Return either SQLITE_OK or
  1568  ** an error code (usually SQLITE_CORRUPT).
  1569  **
  1570  ** The caller guarantees that there is sufficient space to make the
  1571  ** allocation.  This routine might need to defragment in order to bring
  1572  ** all the space together, however.  This routine will avoid using
  1573  ** the first two bytes past the cell pointer area since presumably this
  1574  ** allocation is being made in order to insert a new cell, so we will
  1575  ** also end up needing a new cell pointer.
  1576  */
  1577  static int allocateSpace(MemPage *pPage, int nByte, int *pIdx){
  1578    const int hdr = pPage->hdrOffset;    /* Local cache of pPage->hdrOffset */
  1579    u8 * const data = pPage->aData;      /* Local cache of pPage->aData */
  1580    int top;                             /* First byte of cell content area */
  1581    int rc = SQLITE_OK;                  /* Integer return code */
  1582    int gap;        /* First byte of gap between cell pointers and cell content */
  1583    
  1584    assert( sqlite3PagerIswriteable(pPage->pDbPage) );
  1585    assert( pPage->pBt );
  1586    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  1587    assert( nByte>=0 );  /* Minimum cell size is 4 */
  1588    assert( pPage->nFree>=nByte );
  1589    assert( pPage->nOverflow==0 );
  1590    assert( nByte < (int)(pPage->pBt->usableSize-8) );
  1591  
  1592    assert( pPage->cellOffset == hdr + 12 - 4*pPage->leaf );
  1593    gap = pPage->cellOffset + 2*pPage->nCell;
  1594    assert( gap<=65536 );
  1595    /* EVIDENCE-OF: R-29356-02391 If the database uses a 65536-byte page size
  1596    ** and the reserved space is zero (the usual value for reserved space)
  1597    ** then the cell content offset of an empty page wants to be 65536.
  1598    ** However, that integer is too large to be stored in a 2-byte unsigned
  1599    ** integer, so a value of 0 is used in its place. */
  1600    top = get2byte(&data[hdr+5]);
  1601    assert( top<=(int)pPage->pBt->usableSize ); /* Prevent by getAndInitPage() */
  1602    if( gap>top ){
  1603      if( top==0 && pPage->pBt->usableSize==65536 ){
  1604        top = 65536;
  1605      }else{
  1606        return SQLITE_CORRUPT_PAGE(pPage);
  1607      }
  1608    }
  1609  
  1610    /* If there is enough space between gap and top for one more cell pointer
  1611    ** array entry offset, and if the freelist is not empty, then search the
  1612    ** freelist looking for a free slot big enough to satisfy the request.
  1613    */
  1614    testcase( gap+2==top );
  1615    testcase( gap+1==top );
  1616    testcase( gap==top );
  1617    if( (data[hdr+2] || data[hdr+1]) && gap+2<=top ){
  1618      u8 *pSpace = pageFindSlot(pPage, nByte, &rc);
  1619      if( pSpace ){
  1620        assert( pSpace>=data && (pSpace - data)<65536 );
  1621        *pIdx = (int)(pSpace - data);
  1622        return SQLITE_OK;
  1623      }else if( rc ){
  1624        return rc;
  1625      }
  1626    }
  1627  
  1628    /* The request could not be fulfilled using a freelist slot.  Check
  1629    ** to see if defragmentation is necessary.
  1630    */
  1631    testcase( gap+2+nByte==top );
  1632    if( gap+2+nByte>top ){
  1633      assert( pPage->nCell>0 || CORRUPT_DB );
  1634      rc = defragmentPage(pPage, MIN(4, pPage->nFree - (2+nByte)));
  1635      if( rc ) return rc;
  1636      top = get2byteNotZero(&data[hdr+5]);
  1637      assert( gap+2+nByte<=top );
  1638    }
  1639  
  1640  
  1641    /* Allocate memory from the gap in between the cell pointer array
  1642    ** and the cell content area.  The btreeInitPage() call has already
  1643    ** validated the freelist.  Given that the freelist is valid, there
  1644    ** is no way that the allocation can extend off the end of the page.
  1645    ** The assert() below verifies the previous sentence.
  1646    */
  1647    top -= nByte;
  1648    put2byte(&data[hdr+5], top);
  1649    assert( top+nByte <= (int)pPage->pBt->usableSize );
  1650    *pIdx = top;
  1651    return SQLITE_OK;
  1652  }
  1653  
  1654  /*
  1655  ** Return a section of the pPage->aData to the freelist.
  1656  ** The first byte of the new free block is pPage->aData[iStart]
  1657  ** and the size of the block is iSize bytes.
  1658  **
  1659  ** Adjacent freeblocks are coalesced.
  1660  **
  1661  ** Note that even though the freeblock list was checked by btreeInitPage(),
  1662  ** that routine will not detect overlap between cells or freeblocks.  Nor
  1663  ** does it detect cells or freeblocks that encrouch into the reserved bytes
  1664  ** at the end of the page.  So do additional corruption checks inside this
  1665  ** routine and return SQLITE_CORRUPT if any problems are found.
  1666  */
  1667  static int freeSpace(MemPage *pPage, u16 iStart, u16 iSize){
  1668    u16 iPtr;                             /* Address of ptr to next freeblock */
  1669    u16 iFreeBlk;                         /* Address of the next freeblock */
  1670    u8 hdr;                               /* Page header size.  0 or 100 */
  1671    u8 nFrag = 0;                         /* Reduction in fragmentation */
  1672    u16 iOrigSize = iSize;                /* Original value of iSize */
  1673    u16 x;                                /* Offset to cell content area */
  1674    u32 iEnd = iStart + iSize;            /* First byte past the iStart buffer */
  1675    unsigned char *data = pPage->aData;   /* Page content */
  1676  
  1677    assert( pPage->pBt!=0 );
  1678    assert( sqlite3PagerIswriteable(pPage->pDbPage) );
1679 assert( CORRUPT_DB || iStart>=pPage->hdrOffset+6+pPage->childPtrSize ); 1680 assert( CORRUPT_DB || iEnd <= pPage->pBt->usableSize );
1681 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 1682 assert( iSize>=4 ); /* Minimum cell size is 4 */ 1683 assert( iStart<=pPage->pBt->usableSize-4 ); 1684 1685 /* The list of freeblocks must be in ascending order. Find the 1686 ** spot on the list where iStart should be inserted. 1687 */ 1688 hdr = pPage->hdrOffset; 1689 iPtr = hdr + 1; 1690 if( data[iPtr+1]==0 && data[iPtr]==0 ){ 1691 iFreeBlk = 0; /* Shortcut for the case when the freelist is empty */ 1692 }else{ 1693 while( (iFreeBlk = get2byte(&data[iPtr]))<iStart ){ 1694 if( iFreeBlk<iPtr+4 ){ 1695 if( iFreeBlk==0 ) break; 1696 return SQLITE_CORRUPT_PAGE(pPage); 1697 } 1698 iPtr = iFreeBlk; 1699 } 1700 if( iFreeBlk>pPage->pBt->usableSize-4 ){ 1701 return SQLITE_CORRUPT_PAGE(pPage); 1702 } 1703 assert( iFreeBlk>iPtr || iFreeBlk==0 ); 1704 1705 /* At this point: 1706 ** iFreeBlk: First freeblock after iStart, or zero if none 1707 ** iPtr: The address of a pointer to iFreeBlk 1708 ** 1709 ** Check to see if iFreeBlk should be coalesced onto the end of iStart. 1710 */ 1711 if( iFreeBlk && iEnd+3>=iFreeBlk ){ 1712 nFrag = iFreeBlk - iEnd; 1713 if( iEnd>iFreeBlk ) return SQLITE_CORRUPT_PAGE(pPage); 1714 iEnd = iFreeBlk + get2byte(&data[iFreeBlk+2]); 1715 if( iEnd > pPage->pBt->usableSize ){ 1716 return SQLITE_CORRUPT_PAGE(pPage); 1717 } 1718 iSize = iEnd - iStart; 1719 iFreeBlk = get2byte(&data[iFreeBlk]); 1720 } 1721 1722 /* If iPtr is another freeblock (that is, if iPtr is not the freelist 1723 ** pointer in the page header) then check to see if iStart should be 1724 ** coalesced onto the end of iPtr. 1725 */ 1726 if( iPtr>hdr+1 ){ 1727 int iPtrEnd = iPtr + get2byte(&data[iPtr+2]); 1728 if( iPtrEnd+3>=iStart ){ 1729 if( iPtrEnd>iStart ) return SQLITE_CORRUPT_PAGE(pPage); 1730 nFrag += iStart - iPtrEnd; 1731 iSize = iEnd - iPtr; 1732 iStart = iPtr; 1733 } 1734 } 1735 if( nFrag>data[hdr+7] ) return SQLITE_CORRUPT_PAGE(pPage); 1736 data[hdr+7] -= nFrag; 1737 } 1738 x = get2byte(&data[hdr+5]); 1739 if( iStart<=x ){ 1740 /* The new freeblock is at the beginning of the cell content area, 1741 ** so just extend the cell content area rather than create another 1742 ** freelist entry */ 1743 if( iStart<x || iPtr!=hdr+1 ) return SQLITE_CORRUPT_PAGE(pPage); 1744 put2byte(&data[hdr+1], iFreeBlk); 1745 put2byte(&data[hdr+5], iEnd); 1746 }else{ 1747 /* Insert the new freeblock into the freelist */ 1748 put2byte(&data[iPtr], iStart); 1749 } 1750 if( pPage->pBt->btsFlags & BTS_FAST_SECURE ){ 1751 /* Overwrite deleted information with zeros when the secure_delete 1752 ** option is enabled */ 1753 memset(&data[iStart], 0, iSize); 1754 } 1755 put2byte(&data[iStart], iFreeBlk); 1756 put2byte(&data[iStart+2], iSize); 1757 pPage->nFree += iOrigSize; 1758 return SQLITE_OK; 1759 } 1760 1761 /* 1762 ** Decode the flags byte (the first byte of the header) for a page 1763 ** and initialize fields of the MemPage structure accordingly. 1764 ** 1765 ** Only the following combinations are supported. Anything different 1766 ** indicates a corrupt database files: 1767 ** 1768 ** PTF_ZERODATA 1769 ** PTF_ZERODATA | PTF_LEAF 1770 ** PTF_LEAFDATA | PTF_INTKEY 1771 ** PTF_LEAFDATA | PTF_INTKEY | PTF_LEAF 1772 */ 1773 static int decodeFlags(MemPage *pPage, int flagByte){ 1774 BtShared *pBt; /* A copy of pPage->pBt */ 1775 1776 assert( pPage->hdrOffset==(pPage->pgno==1 ? 100 : 0) ); 1777 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 1778 pPage->leaf = (u8)(flagByte>>3); assert( PTF_LEAF == 1<<3 ); 1779 flagByte &= ~PTF_LEAF; 1780 pPage->childPtrSize = 4-4*pPage->leaf; 1781 pPage->xCellSize = cellSizePtr; 1782 pBt = pPage->pBt; 1783 if( flagByte==(PTF_LEAFDATA | PTF_INTKEY) ){ 1784 /* EVIDENCE-OF: R-07291-35328 A value of 5 (0x05) means the page is an 1785 ** interior table b-tree page. */ 1786 assert( (PTF_LEAFDATA|PTF_INTKEY)==5 ); 1787 /* EVIDENCE-OF: R-26900-09176 A value of 13 (0x0d) means the page is a 1788 ** leaf table b-tree page. */ 1789 assert( (PTF_LEAFDATA|PTF_INTKEY|PTF_LEAF)==13 ); 1790 pPage->intKey = 1; 1791 if( pPage->leaf ){ 1792 pPage->intKeyLeaf = 1; 1793 pPage->xParseCell = btreeParseCellPtr; 1794 }else{ 1795 pPage->intKeyLeaf = 0; 1796 pPage->xCellSize = cellSizePtrNoPayload; 1797 pPage->xParseCell = btreeParseCellPtrNoPayload; 1798 } 1799 pPage->maxLocal = pBt->maxLeaf; 1800 pPage->minLocal = pBt->minLeaf; 1801 }else if( flagByte==PTF_ZERODATA ){ 1802 /* EVIDENCE-OF: R-43316-37308 A value of 2 (0x02) means the page is an 1803 ** interior index b-tree page. */ 1804 assert( (PTF_ZERODATA)==2 ); 1805 /* EVIDENCE-OF: R-59615-42828 A value of 10 (0x0a) means the page is a 1806 ** leaf index b-tree page. */ 1807 assert( (PTF_ZERODATA|PTF_LEAF)==10 ); 1808 pPage->intKey = 0; 1809 pPage->intKeyLeaf = 0; 1810 pPage->xParseCell = btreeParseCellPtrIndex; 1811 pPage->maxLocal = pBt->maxLocal; 1812 pPage->minLocal = pBt->minLocal; 1813 }else{ 1814 /* EVIDENCE-OF: R-47608-56469 Any other value for the b-tree page type is 1815 ** an error. */ 1816 return SQLITE_CORRUPT_PAGE(pPage); 1817 } 1818 pPage->max1bytePayload = pBt->max1bytePayload; 1819 return SQLITE_OK; 1820 } 1821 1822 /* 1823 ** Initialize the auxiliary information for a disk block. 1824 ** 1825 ** Return SQLITE_OK on success. If we see that the page does 1826 ** not contain a well-formed database page, then return 1827 ** SQLITE_CORRUPT. Note that a return of SQLITE_OK does not 1828 ** guarantee that the page is well-formed. It only shows that 1829 ** we failed to detect any corruption. 1830 */ 1831 static int btreeInitPage(MemPage *pPage){ 1832 int pc; /* Address of a freeblock within pPage->aData[] */ 1833 u8 hdr; /* Offset to beginning of page header */ 1834 u8 *data; /* Equal to pPage->aData */ 1835 BtShared *pBt; /* The main btree structure */ 1836 int usableSize; /* Amount of usable space on each page */ 1837 u16 cellOffset; /* Offset from start of page to first cell pointer */ 1838 int nFree; /* Number of unused bytes on the page */ 1839 int top; /* First byte of the cell content area */ 1840 int iCellFirst; /* First allowable cell or freeblock offset */ 1841 int iCellLast; /* Last possible cell or freeblock offset */ 1842 1843 assert( pPage->pBt!=0 ); 1844 assert( pPage->pBt->db!=0 ); 1845 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 1846 assert( pPage->pgno==sqlite3PagerPagenumber(pPage->pDbPage) ); 1847 assert( pPage == sqlite3PagerGetExtra(pPage->pDbPage) ); 1848 assert( pPage->aData == sqlite3PagerGetData(pPage->pDbPage) ); 1849 assert( pPage->isInit==0 ); 1850 1851 pBt = pPage->pBt; 1852 hdr = pPage->hdrOffset; 1853 data = pPage->aData; 1854 /* EVIDENCE-OF: R-28594-02890 The one-byte flag at offset 0 indicating 1855 ** the b-tree page type. */ 1856 if( decodeFlags(pPage, data[hdr]) ){ 1857 return SQLITE_CORRUPT_PAGE(pPage); 1858 } 1859 assert( pBt->pageSize>=512 && pBt->pageSize<=65536 ); 1860 pPage->maskPage = (u16)(pBt->pageSize - 1); 1861 pPage->nOverflow = 0; 1862 usableSize = pBt->usableSize; 1863 pPage->cellOffset = cellOffset = hdr + 8 + pPage->childPtrSize; 1864 pPage->aDataEnd = &data[usableSize]; 1865 pPage->aCellIdx = &data[cellOffset]; 1866 pPage->aDataOfst = &data[pPage->childPtrSize]; 1867 /* EVIDENCE-OF: R-58015-48175 The two-byte integer at offset 5 designates 1868 ** the start of the cell content area. A zero value for this integer is 1869 ** interpreted as 65536. */ 1870 top = get2byteNotZero(&data[hdr+5]); 1871 /* EVIDENCE-OF: R-37002-32774 The two-byte integer at offset 3 gives the 1872 ** number of cells on the page. */ 1873 pPage->nCell = get2byte(&data[hdr+3]); 1874 if( pPage->nCell>MX_CELL(pBt) ){ 1875 /* To many cells for a single page. The page must be corrupt */ 1876 return SQLITE_CORRUPT_PAGE(pPage); 1877 } 1878 testcase( pPage->nCell==MX_CELL(pBt) ); 1879 /* EVIDENCE-OF: R-24089-57979 If a page contains no cells (which is only 1880 ** possible for a root page of a table that contains no rows) then the 1881 ** offset to the cell content area will equal the page size minus the 1882 ** bytes of reserved space. */ 1883 assert( pPage->nCell>0 || top==usableSize || CORRUPT_DB ); 1884 1885 /* A malformed database page might cause us to read past the end 1886 ** of page when parsing a cell. 1887 ** 1888 ** The following block of code checks early to see if a cell extends 1889 ** past the end of a page boundary and causes SQLITE_CORRUPT to be 1890 ** returned if it does. 1891 */ 1892 iCellFirst = cellOffset + 2*pPage->nCell; 1893 iCellLast = usableSize - 4; 1894 if( pBt->db->flags & SQLITE_CellSizeCk ){ 1895 int i; /* Index into the cell pointer array */ 1896 int sz; /* Size of a cell */ 1897 1898 if( !pPage->leaf ) iCellLast--; 1899 for(i=0; i<pPage->nCell; i++){ 1900 pc = get2byteAligned(&data[cellOffset+i*2]); 1901 testcase( pc==iCellFirst ); 1902 testcase( pc==iCellLast ); 1903 if( pc<iCellFirst || pc>iCellLast ){ 1904 return SQLITE_CORRUPT_PAGE(pPage); 1905 } 1906 sz = pPage->xCellSize(pPage, &data[pc]); 1907 testcase( pc+sz==usableSize ); 1908 if( pc+sz>usableSize ){ 1909 return SQLITE_CORRUPT_PAGE(pPage); 1910 } 1911 } 1912 if( !pPage->leaf ) iCellLast++; 1913 } 1914 1915 /* Compute the total free space on the page 1916 ** EVIDENCE-OF: R-23588-34450 The two-byte integer at offset 1 gives the 1917 ** start of the first freeblock on the page, or is zero if there are no 1918 ** freeblocks. */ 1919 pc = get2byte(&data[hdr+1]); 1920 nFree = data[hdr+7] + top; /* Init nFree to non-freeblock free space */ 1921 if( pc>0 ){ 1922 u32 next, size; 1923 if( pc<iCellFirst ){ 1924 /* EVIDENCE-OF: R-55530-52930 In a well-formed b-tree page, there will 1925 ** always be at least one cell before the first freeblock. 1926 */ 1927 return SQLITE_CORRUPT_PAGE(pPage); 1928 } 1929 while( 1 ){ 1930 if( pc>iCellLast ){ 1931 /* Freeblock off the end of the page */ 1932 return SQLITE_CORRUPT_PAGE(pPage); 1933 } 1934 next = get2byte(&data[pc]); 1935 size = get2byte(&data[pc+2]); 1936 nFree = nFree + size; 1937 if( next<=pc+size+3 ) break; 1938 pc = next; 1939 } 1940 if( next>0 ){ 1941 /* Freeblock not in ascending order */ 1942 return SQLITE_CORRUPT_PAGE(pPage); 1943 } 1944 if( pc+size>(unsigned int)usableSize ){ 1945 /* Last freeblock extends past page end */ 1946 return SQLITE_CORRUPT_PAGE(pPage); 1947 } 1948 } 1949 1950 /* At this point, nFree contains the sum of the offset to the start 1951 ** of the cell-content area plus the number of free bytes within 1952 ** the cell-content area. If this is greater than the usable-size 1953 ** of the page, then the page must be corrupted. This check also 1954 ** serves to verify that the offset to the start of the cell-content 1955 ** area, according to the page header, lies within the page. 1956 */ 1957 if( nFree>usableSize ){ 1958 return SQLITE_CORRUPT_PAGE(pPage); 1959 } 1960 pPage->nFree = (u16)(nFree - iCellFirst); 1961 pPage->isInit = 1; 1962 return SQLITE_OK; 1963 } 1964 1965 /* 1966 ** Set up a raw page so that it looks like a database page holding 1967 ** no entries. 1968 */ 1969 static void zeroPage(MemPage *pPage, int flags){ 1970 unsigned char *data = pPage->aData; 1971 BtShared *pBt = pPage->pBt; 1972 u8 hdr = pPage->hdrOffset; 1973 u16 first; 1974 1975 assert( sqlite3PagerPagenumber(pPage->pDbPage)==pPage->pgno ); 1976 assert( sqlite3PagerGetExtra(pPage->pDbPage) == (void*)pPage ); 1977 assert( sqlite3PagerGetData(pPage->pDbPage) == data ); 1978 assert( sqlite3PagerIswriteable(pPage->pDbPage) ); 1979 assert( sqlite3_mutex_held(pBt->mutex) ); 1980 if( pBt->btsFlags & BTS_FAST_SECURE ){ 1981 memset(&data[hdr], 0, pBt->usableSize - hdr); 1982 } 1983 data[hdr] = (char)flags; 1984 first = hdr + ((flags&PTF_LEAF)==0 ? 12 : 8); 1985 memset(&data[hdr+1], 0, 4); 1986 data[hdr+7] = 0; 1987 put2byte(&data[hdr+5], pBt->usableSize); 1988 pPage->nFree = (u16)(pBt->usableSize - first); 1989 decodeFlags(pPage, flags); 1990 pPage->cellOffset = first; 1991 pPage->aDataEnd = &data[pBt->usableSize]; 1992 pPage->aCellIdx = &data[first]; 1993 pPage->aDataOfst = &data[pPage->childPtrSize]; 1994 pPage->nOverflow = 0; 1995 assert( pBt->pageSize>=512 && pBt->pageSize<=65536 ); 1996 pPage->maskPage = (u16)(pBt->pageSize - 1); 1997 pPage->nCell = 0; 1998 pPage->isInit = 1; 1999 } 2000 2001 2002 /* 2003 ** Convert a DbPage obtained from the pager into a MemPage used by 2004 ** the btree layer. 2005 */ 2006 static MemPage *btreePageFromDbPage(DbPage *pDbPage, Pgno pgno, BtShared *pBt){ 2007 MemPage *pPage = (MemPage*)sqlite3PagerGetExtra(pDbPage); 2008 if( pgno!=pPage->pgno ){ 2009 pPage->aData = sqlite3PagerGetData(pDbPage); 2010 pPage->pDbPage = pDbPage; 2011 pPage->pBt = pBt; 2012 pPage->pgno = pgno; 2013 pPage->hdrOffset = pgno==1 ? 100 : 0; 2014 } 2015 assert( pPage->aData==sqlite3PagerGetData(pDbPage) ); 2016 return pPage; 2017 } 2018 2019 /* 2020 ** Get a page from the pager. Initialize the MemPage.pBt and 2021 ** MemPage.aData elements if needed. See also: btreeGetUnusedPage(). 2022 ** 2023 ** If the PAGER_GET_NOCONTENT flag is set, it means that we do not care 2024 ** about the content of the page at this time. So do not go to the disk 2025 ** to fetch the content. Just fill in the content with zeros for now. 2026 ** If in the future we call sqlite3PagerWrite() on this page, that 2027 ** means we have started to be concerned about content and the disk 2028 ** read should occur at that point. 2029 */ 2030 static int btreeGetPage( 2031 BtShared *pBt, /* The btree */ 2032 Pgno pgno, /* Number of the page to fetch */ 2033 MemPage **ppPage, /* Return the page in this parameter */ 2034 int flags /* PAGER_GET_NOCONTENT or PAGER_GET_READONLY */ 2035 ){ 2036 int rc; 2037 DbPage *pDbPage; 2038 2039 assert( flags==0 || flags==PAGER_GET_NOCONTENT || flags==PAGER_GET_READONLY ); 2040 assert( sqlite3_mutex_held(pBt->mutex) ); 2041 rc = sqlite3PagerGet(pBt->pPager, pgno, (DbPage**)&pDbPage, flags); 2042 if( rc ) return rc; 2043 *ppPage = btreePageFromDbPage(pDbPage, pgno, pBt); 2044 return SQLITE_OK; 2045 } 2046 2047 /* 2048 ** Retrieve a page from the pager cache. If the requested page is not 2049 ** already in the pager cache return NULL. Initialize the MemPage.pBt and 2050 ** MemPage.aData elements if needed. 2051 */ 2052 static MemPage *btreePageLookup(BtShared *pBt, Pgno pgno){ 2053 DbPage *pDbPage; 2054 assert( sqlite3_mutex_held(pBt->mutex) ); 2055 pDbPage = sqlite3PagerLookup(pBt->pPager, pgno); 2056 if( pDbPage ){ 2057 return btreePageFromDbPage(pDbPage, pgno, pBt); 2058 } 2059 return 0; 2060 } 2061 2062 /* 2063 ** Return the size of the database file in pages. If there is any kind of 2064 ** error, return ((unsigned int)-1). 2065 */ 2066 static Pgno btreePagecount(BtShared *pBt){ 2067 return pBt->nPage; 2068 } 2069 u32 sqlite3BtreeLastPage(Btree *p){ 2070 assert( sqlite3BtreeHoldsMutex(p) ); 2071 assert( ((p->pBt->nPage)&0x80000000)==0 ); 2072 return btreePagecount(p->pBt); 2073 } 2074 2075 /* 2076 ** Get a page from the pager and initialize it. 2077 ** 2078 ** If pCur!=0 then the page is being fetched as part of a moveToChild() 2079 ** call. Do additional sanity checking on the page in this case. 2080 ** And if the fetch fails, this routine must decrement pCur->iPage. 2081 ** 2082 ** The page is fetched as read-write unless pCur is not NULL and is 2083 ** a read-only cursor. 2084 ** 2085 ** If an error occurs, then *ppPage is undefined. It 2086 ** may remain unchanged, or it may be set to an invalid value. 2087 */ 2088 static int getAndInitPage( 2089 BtShared *pBt, /* The database file */ 2090 Pgno pgno, /* Number of the page to get */ 2091 MemPage **ppPage, /* Write the page pointer here */ 2092 BtCursor *pCur, /* Cursor to receive the page, or NULL */ 2093 int bReadOnly /* True for a read-only page */ 2094 ){ 2095 int rc; 2096 DbPage *pDbPage; 2097 assert( sqlite3_mutex_held(pBt->mutex) ); 2098 assert( pCur==0 || ppPage==&pCur->pPage ); 2099 assert( pCur==0 || bReadOnly==pCur->curPagerFlags ); 2100 assert( pCur==0 || pCur->iPage>0 ); 2101 2102 if( pgno>btreePagecount(pBt) ){ 2103 rc = SQLITE_CORRUPT_BKPT; 2104 goto getAndInitPage_error; 2105 } 2106 rc = sqlite3PagerGet(pBt->pPager, pgno, (DbPage**)&pDbPage, bReadOnly); 2107 if( rc ){ 2108 goto getAndInitPage_error; 2109 } 2110 *ppPage = (MemPage*)sqlite3PagerGetExtra(pDbPage); 2111 if( (*ppPage)->isInit==0 ){ 2112 btreePageFromDbPage(pDbPage, pgno, pBt); 2113 rc = btreeInitPage(*ppPage); 2114 if( rc!=SQLITE_OK ){ 2115 releasePage(*ppPage); 2116 goto getAndInitPage_error; 2117 } 2118 } 2119 assert( (*ppPage)->pgno==pgno ); 2120 assert( (*ppPage)->aData==sqlite3PagerGetData(pDbPage) ); 2121 2122 /* If obtaining a child page for a cursor, we must verify that the page is 2123 ** compatible with the root page. */ 2124 if( pCur && ((*ppPage)->nCell<1 || (*ppPage)->intKey!=pCur->curIntKey) ){ 2125 rc = SQLITE_CORRUPT_PGNO(pgno); 2126 releasePage(*ppPage); 2127 goto getAndInitPage_error; 2128 } 2129 return SQLITE_OK; 2130 2131 getAndInitPage_error: 2132 if( pCur ){ 2133 pCur->iPage--; 2134 pCur->pPage = pCur->apPage[pCur->iPage]; 2135 } 2136 testcase( pgno==0 ); 2137 assert( pgno!=0 || rc==SQLITE_CORRUPT ); 2138 return rc; 2139 } 2140 2141 /* 2142 ** Release a MemPage. This should be called once for each prior 2143 ** call to btreeGetPage. 2144 ** 2145 ** Page1 is a special case and must be released using releasePageOne(). 2146 */ 2147 static void releasePageNotNull(MemPage *pPage){ 2148 assert( pPage->aData ); 2149 assert( pPage->pBt ); 2150 assert( pPage->pDbPage!=0 ); 2151 assert( sqlite3PagerGetExtra(pPage->pDbPage) == (void*)pPage ); 2152 assert( sqlite3PagerGetData(pPage->pDbPage)==pPage->aData ); 2153 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 2154 sqlite3PagerUnrefNotNull(pPage->pDbPage); 2155 } 2156 static void releasePage(MemPage *pPage){ 2157 if( pPage ) releasePageNotNull(pPage); 2158 } 2159 static void releasePageOne(MemPage *pPage){ 2160 assert( pPage!=0 ); 2161 assert( pPage->aData ); 2162 assert( pPage->pBt ); 2163 assert( pPage->pDbPage!=0 ); 2164 assert( sqlite3PagerGetExtra(pPage->pDbPage) == (void*)pPage ); 2165 assert( sqlite3PagerGetData(pPage->pDbPage)==pPage->aData ); 2166 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 2167 sqlite3PagerUnrefPageOne(pPage->pDbPage); 2168 } 2169 2170 /* 2171 ** Get an unused page. 2172 ** 2173 ** This works just like btreeGetPage() with the addition: 2174 ** 2175 ** * If the page is already in use for some other purpose, immediately 2176 ** release it and return an SQLITE_CURRUPT error. 2177 ** * Make sure the isInit flag is clear 2178 */ 2179 static int btreeGetUnusedPage( 2180 BtShared *pBt, /* The btree */ 2181 Pgno pgno, /* Number of the page to fetch */ 2182 MemPage **ppPage, /* Return the page in this parameter */ 2183 int flags /* PAGER_GET_NOCONTENT or PAGER_GET_READONLY */ 2184 ){ 2185 int rc = btreeGetPage(pBt, pgno, ppPage, flags); 2186 if( rc==SQLITE_OK ){ 2187 if( sqlite3PagerPageRefcount((*ppPage)->pDbPage)>1 ){ 2188 releasePage(*ppPage); 2189 *ppPage = 0; 2190 return SQLITE_CORRUPT_BKPT; 2191 } 2192 (*ppPage)->isInit = 0; 2193 }else{ 2194 *ppPage = 0; 2195 } 2196 return rc; 2197 } 2198 2199 2200 /* 2201 ** During a rollback, when the pager reloads information into the cache 2202 ** so that the cache is restored to its original state at the start of 2203 ** the transaction, for each page restored this routine is called. 2204 ** 2205 ** This routine needs to reset the extra data section at the end of the 2206 ** page to agree with the restored data. 2207 */ 2208 static void pageReinit(DbPage *pData){ 2209 MemPage *pPage; 2210 pPage = (MemPage *)sqlite3PagerGetExtra(pData); 2211 assert( sqlite3PagerPageRefcount(pData)>0 ); 2212 if( pPage->isInit ){ 2213 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 2214 pPage->isInit = 0; 2215 if( sqlite3PagerPageRefcount(pData)>1 ){ 2216 /* pPage might not be a btree page; it might be an overflow page 2217 ** or ptrmap page or a free page. In those cases, the following 2218 ** call to btreeInitPage() will likely return SQLITE_CORRUPT. 2219 ** But no harm is done by this. And it is very important that 2220 ** btreeInitPage() be called on every btree page so we make 2221 ** the call for every page that comes in for re-initing. */ 2222 btreeInitPage(pPage); 2223 } 2224 } 2225 } 2226 2227 /* 2228 ** Invoke the busy handler for a btree. 2229 */ 2230 static int btreeInvokeBusyHandler(void *pArg){ 2231 BtShared *pBt = (BtShared*)pArg; 2232 assert( pBt->db ); 2233 assert( sqlite3_mutex_held(pBt->db->mutex) ); 2234 return sqlite3InvokeBusyHandler(&pBt->db->busyHandler); 2235 } 2236 2237 /* 2238 ** Open a database file. 2239 ** 2240 ** zFilename is the name of the database file. If zFilename is NULL 2241 ** then an ephemeral database is created. The ephemeral database might 2242 ** be exclusively in memory, or it might use a disk-based memory cache. 2243 ** Either way, the ephemeral database will be automatically deleted 2244 ** when sqlite3BtreeClose() is called. 2245 ** 2246 ** If zFilename is ":memory:" then an in-memory database is created 2247 ** that is automatically destroyed when it is closed. 2248 ** 2249 ** The "flags" parameter is a bitmask that might contain bits like 2250 ** BTREE_OMIT_JOURNAL and/or BTREE_MEMORY. 2251 ** 2252 ** If the database is already opened in the same database connection 2253 ** and we are in shared cache mode, then the open will fail with an 2254 ** SQLITE_CONSTRAINT error. We cannot allow two or more BtShared 2255 ** objects in the same database connection since doing so will lead 2256 ** to problems with locking. 2257 */ 2258 int sqlite3BtreeOpen( 2259 sqlite3_vfs *pVfs, /* VFS to use for this b-tree */ 2260 const char *zFilename, /* Name of the file containing the BTree database */ 2261 sqlite3 *db, /* Associated database handle */ 2262 Btree **ppBtree, /* Pointer to new Btree object written here */ 2263 int flags, /* Options */ 2264 int vfsFlags /* Flags passed through to sqlite3_vfs.xOpen() */ 2265 ){ 2266 BtShared *pBt = 0; /* Shared part of btree structure */ 2267 Btree *p; /* Handle to return */ 2268 sqlite3_mutex *mutexOpen = 0; /* Prevents a race condition. Ticket #3537 */ 2269 int rc = SQLITE_OK; /* Result code from this function */ 2270 u8 nReserve; /* Byte of unused space on each page */ 2271 unsigned char zDbHeader[100]; /* Database header content */ 2272 2273 /* True if opening an ephemeral, temporary database */ 2274 const int isTempDb = zFilename==0 || zFilename[0]==0; 2275 2276 /* Set the variable isMemdb to true for an in-memory database, or 2277 ** false for a file-based database. 2278 */ 2279 #ifdef SQLITE_OMIT_MEMORYDB 2280 const int isMemdb = 0; 2281 #else 2282 const int isMemdb = (zFilename && strcmp(zFilename, ":memory:")==0) 2283 || (isTempDb && sqlite3TempInMemory(db)) 2284 || (vfsFlags & SQLITE_OPEN_MEMORY)!=0; 2285 #endif 2286 2287 assert( db!=0 ); 2288 assert( pVfs!=0 ); 2289 assert( sqlite3_mutex_held(db->mutex) ); 2290 assert( (flags&0xff)==flags ); /* flags fit in 8 bits */ 2291 2292 /* Only a BTREE_SINGLE database can be BTREE_UNORDERED */ 2293 assert( (flags & BTREE_UNORDERED)==0 || (flags & BTREE_SINGLE)!=0 ); 2294 2295 /* A BTREE_SINGLE database is always a temporary and/or ephemeral */ 2296 assert( (flags & BTREE_SINGLE)==0 || isTempDb ); 2297 2298 if( isMemdb ){ 2299 flags |= BTREE_MEMORY; 2300 } 2301 if( (vfsFlags & SQLITE_OPEN_MAIN_DB)!=0 && (isMemdb || isTempDb) ){ 2302 vfsFlags = (vfsFlags & ~SQLITE_OPEN_MAIN_DB) | SQLITE_OPEN_TEMP_DB; 2303 } 2304 p = sqlite3MallocZero(sizeof(Btree)); 2305 if( !p ){ 2306 return SQLITE_NOMEM_BKPT; 2307 } 2308 p->inTrans = TRANS_NONE; 2309 p->db = db; 2310 #ifndef SQLITE_OMIT_SHARED_CACHE 2311 p->lock.pBtree = p; 2312 p->lock.iTable = 1; 2313 #endif 2314 2315 #if !defined(SQLITE_OMIT_SHARED_CACHE) && !defined(SQLITE_OMIT_DISKIO) 2316 /* 2317 ** If this Btree is a candidate for shared cache, try to find an 2318 ** existing BtShared object that we can share with 2319 */ 2320 if( isTempDb==0 && (isMemdb==0 || (vfsFlags&SQLITE_OPEN_URI)!=0) ){ 2321 if( vfsFlags & SQLITE_OPEN_SHAREDCACHE ){ 2322 int nFilename = sqlite3Strlen30(zFilename)+1; 2323 int nFullPathname = pVfs->mxPathname+1; 2324 char *zFullPathname = sqlite3Malloc(MAX(nFullPathname,nFilename)); 2325 MUTEX_LOGIC( sqlite3_mutex *mutexShared; ) 2326 2327 p->sharable = 1; 2328 if( !zFullPathname ){ 2329 sqlite3_free(p); 2330 return SQLITE_NOMEM_BKPT; 2331 } 2332 if( isMemdb ){ 2333 memcpy(zFullPathname, zFilename, nFilename); 2334 }else{ 2335 rc = sqlite3OsFullPathname(pVfs, zFilename, 2336 nFullPathname, zFullPathname); 2337 if( rc ){ 2338 sqlite3_free(zFullPathname); 2339 sqlite3_free(p); 2340 return rc; 2341 } 2342 } 2343 #if SQLITE_THREADSAFE 2344 mutexOpen = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_OPEN); 2345 sqlite3_mutex_enter(mutexOpen); 2346 mutexShared = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER); 2347 sqlite3_mutex_enter(mutexShared); 2348 #endif 2349 for(pBt=GLOBAL(BtShared*,sqlite3SharedCacheList); pBt; pBt=pBt->pNext){ 2350 assert( pBt->nRef>0 ); 2351 if( 0==strcmp(zFullPathname, sqlite3PagerFilename(pBt->pPager, 0)) 2352 && sqlite3PagerVfs(pBt->pPager)==pVfs ){ 2353 int iDb; 2354 for(iDb=db->nDb-1; iDb>=0; iDb--){ 2355 Btree *pExisting = db->aDb[iDb].pBt; 2356 if( pExisting && pExisting->pBt==pBt ){ 2357 sqlite3_mutex_leave(mutexShared); 2358 sqlite3_mutex_leave(mutexOpen); 2359 sqlite3_free(zFullPathname); 2360 sqlite3_free(p); 2361 return SQLITE_CONSTRAINT; 2362 } 2363 } 2364 p->pBt = pBt; 2365 pBt->nRef++; 2366 break; 2367 } 2368 } 2369 sqlite3_mutex_leave(mutexShared); 2370 sqlite3_free(zFullPathname); 2371 } 2372 #ifdef SQLITE_DEBUG 2373 else{ 2374 /* In debug mode, we mark all persistent databases as sharable 2375 ** even when they are not. This exercises the locking code and 2376 ** gives more opportunity for asserts(sqlite3_mutex_held()) 2377 ** statements to find locking problems. 2378 */ 2379 p->sharable = 1; 2380 } 2381 #endif 2382 } 2383 #endif 2384 if( pBt==0 ){ 2385 /* 2386 ** The following asserts make sure that structures used by the btree are 2387 ** the right size. This is to guard against size changes that result 2388 ** when compiling on a different architecture. 2389 */ 2390 assert( sizeof(i64)==8 ); 2391 assert( sizeof(u64)==8 ); 2392 assert( sizeof(u32)==4 ); 2393 assert( sizeof(u16)==2 ); 2394 assert( sizeof(Pgno)==4 ); 2395 2396 pBt = sqlite3MallocZero( sizeof(*pBt) ); 2397 if( pBt==0 ){ 2398 rc = SQLITE_NOMEM_BKPT; 2399 goto btree_open_out; 2400 } 2401 rc = sqlite3PagerOpen(pVfs, &pBt->pPager, zFilename, 2402 sizeof(MemPage), flags, vfsFlags, pageReinit); 2403 if( rc==SQLITE_OK ){ 2404 sqlite3PagerSetMmapLimit(pBt->pPager, db->szMmap); 2405 rc = sqlite3PagerReadFileheader(pBt->pPager,sizeof(zDbHeader),zDbHeader); 2406 } 2407 if( rc!=SQLITE_OK ){ 2408 goto btree_open_out; 2409 } 2410 pBt->openFlags = (u8)flags; 2411 pBt->db = db; 2412 sqlite3PagerSetBusyhandler(pBt->pPager, btreeInvokeBusyHandler, pBt); 2413 p->pBt = pBt; 2414 2415 pBt->pCursor = 0; 2416 pBt->pPage1 = 0; 2417 if( sqlite3PagerIsreadonly(pBt->pPager) ) pBt->btsFlags |= BTS_READ_ONLY; 2418 #if defined(SQLITE_SECURE_DELETE) 2419 pBt->btsFlags |= BTS_SECURE_DELETE; 2420 #elif defined(SQLITE_FAST_SECURE_DELETE) 2421 pBt->btsFlags |= BTS_OVERWRITE; 2422 #endif 2423 /* EVIDENCE-OF: R-51873-39618 The page size for a database file is 2424 ** determined by the 2-byte integer located at an offset of 16 bytes from 2425 ** the beginning of the database file. */ 2426 pBt->pageSize = (zDbHeader[16]<<8) | (zDbHeader[17]<<16); 2427 if( pBt->pageSize<512 || pBt->pageSize>SQLITE_MAX_PAGE_SIZE 2428 || ((pBt->pageSize-1)&pBt->pageSize)!=0 ){ 2429 pBt->pageSize = 0; 2430 #ifndef SQLITE_OMIT_AUTOVACUUM 2431 /* If the magic name ":memory:" will create an in-memory database, then 2432 ** leave the autoVacuum mode at 0 (do not auto-vacuum), even if 2433 ** SQLITE_DEFAULT_AUTOVACUUM is true. On the other hand, if 2434 ** SQLITE_OMIT_MEMORYDB has been defined, then ":memory:" is just a 2435 ** regular file-name. In this case the auto-vacuum applies as per normal. 2436 */ 2437 if( zFilename && !isMemdb ){ 2438 pBt->autoVacuum = (SQLITE_DEFAULT_AUTOVACUUM ? 1 : 0); 2439 pBt->incrVacuum = (SQLITE_DEFAULT_AUTOVACUUM==2 ? 1 : 0); 2440 } 2441 #endif 2442 nReserve = 0; 2443 }else{ 2444 /* EVIDENCE-OF: R-37497-42412 The size of the reserved region is 2445 ** determined by the one-byte unsigned integer found at an offset of 20 2446 ** into the database file header. */ 2447 nReserve = zDbHeader[20]; 2448 pBt->btsFlags |= BTS_PAGESIZE_FIXED; 2449 #ifndef SQLITE_OMIT_AUTOVACUUM 2450 pBt->autoVacuum = (get4byte(&zDbHeader[36 + 4*4])?1:0); 2451 pBt->incrVacuum = (get4byte(&zDbHeader[36 + 7*4])?1:0); 2452 #endif 2453 } 2454 rc = sqlite3PagerSetPagesize(pBt->pPager, &pBt->pageSize, nReserve); 2455 if( rc ) goto btree_open_out; 2456 pBt->usableSize = pBt->pageSize - nReserve; 2457 assert( (pBt->pageSize & 7)==0 ); /* 8-byte alignment of pageSize */ 2458 2459 #if !defined(SQLITE_OMIT_SHARED_CACHE) && !defined(SQLITE_OMIT_DISKIO) 2460 /* Add the new BtShared object to the linked list sharable BtShareds. 2461 */ 2462 pBt->nRef = 1; 2463 if( p->sharable ){ 2464 MUTEX_LOGIC( sqlite3_mutex *mutexShared; ) 2465 MUTEX_LOGIC( mutexShared = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER);) 2466 if( SQLITE_THREADSAFE && sqlite3GlobalConfig.bCoreMutex ){ 2467 pBt->mutex = sqlite3MutexAlloc(SQLITE_MUTEX_FAST); 2468 if( pBt->mutex==0 ){ 2469 rc = SQLITE_NOMEM_BKPT; 2470 goto btree_open_out; 2471 } 2472 } 2473 sqlite3_mutex_enter(mutexShared); 2474 pBt->pNext = GLOBAL(BtShared*,sqlite3SharedCacheList); 2475 GLOBAL(BtShared*,sqlite3SharedCacheList) = pBt; 2476 sqlite3_mutex_leave(mutexShared); 2477 } 2478 #endif 2479 } 2480 2481 #if !defined(SQLITE_OMIT_SHARED_CACHE) && !defined(SQLITE_OMIT_DISKIO) 2482 /* If the new Btree uses a sharable pBtShared, then link the new 2483 ** Btree into the list of all sharable Btrees for the same connection. 2484 ** The list is kept in ascending order by pBt address. 2485 */ 2486 if( p->sharable ){ 2487 int i; 2488 Btree *pSib; 2489 for(i=0; i<db->nDb; i++){ 2490 if( (pSib = db->aDb[i].pBt)!=0 && pSib->sharable ){ 2491 while( pSib->pPrev ){ pSib = pSib->pPrev; } 2492 if( (uptr)p->pBt<(uptr)pSib->pBt ){ 2493 p->pNext = pSib; 2494 p->pPrev = 0; 2495 pSib->pPrev = p; 2496 }else{ 2497 while( pSib->pNext && (uptr)pSib->pNext->pBt<(uptr)p->pBt ){ 2498 pSib = pSib->pNext; 2499 } 2500 p->pNext = pSib->pNext; 2501 p->pPrev = pSib; 2502 if( p->pNext ){ 2503 p->pNext->pPrev = p; 2504 } 2505 pSib->pNext = p; 2506 } 2507 break; 2508 } 2509 } 2510 } 2511 #endif 2512 *ppBtree = p; 2513 2514 btree_open_out: 2515 if( rc!=SQLITE_OK ){ 2516 if( pBt && pBt->pPager ){ 2517 sqlite3PagerClose(pBt->pPager, 0); 2518 } 2519 sqlite3_free(pBt); 2520 sqlite3_free(p); 2521 *ppBtree = 0; 2522 }else{ 2523 sqlite3_file *pFile; 2524 2525 /* If the B-Tree was successfully opened, set the pager-cache size to the 2526 ** default value. Except, when opening on an existing shared pager-cache, 2527 ** do not change the pager-cache size. 2528 */ 2529 if( sqlite3BtreeSchema(p, 0, 0)==0 ){ 2530 sqlite3PagerSetCachesize(p->pBt->pPager, SQLITE_DEFAULT_CACHE_SIZE); 2531 } 2532 2533 pFile = sqlite3PagerFile(pBt->pPager); 2534 if( pFile->pMethods ){ 2535 sqlite3OsFileControlHint(pFile, SQLITE_FCNTL_PDB, (void*)&pBt->db); 2536 } 2537 } 2538 if( mutexOpen ){ 2539 assert( sqlite3_mutex_held(mutexOpen) ); 2540 sqlite3_mutex_leave(mutexOpen); 2541 } 2542 assert( rc!=SQLITE_OK || sqlite3BtreeConnectionCount(*ppBtree)>0 ); 2543 return rc; 2544 } 2545 2546 /* 2547 ** Decrement the BtShared.nRef counter. When it reaches zero, 2548 ** remove the BtShared structure from the sharing list. Return 2549 ** true if the BtShared.nRef counter reaches zero and return 2550 ** false if it is still positive. 2551 */ 2552 static int removeFromSharingList(BtShared *pBt){ 2553 #ifndef SQLITE_OMIT_SHARED_CACHE 2554 MUTEX_LOGIC( sqlite3_mutex *pMaster; ) 2555 BtShared *pList; 2556 int removed = 0; 2557 2558 assert( sqlite3_mutex_notheld(pBt->mutex) ); 2559 MUTEX_LOGIC( pMaster = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER); ) 2560 sqlite3_mutex_enter(pMaster); 2561 pBt->nRef--; 2562 if( pBt->nRef<=0 ){ 2563 if( GLOBAL(BtShared*,sqlite3SharedCacheList)==pBt ){ 2564 GLOBAL(BtShared*,sqlite3SharedCacheList) = pBt->pNext; 2565 }else{ 2566 pList = GLOBAL(BtShared*,sqlite3SharedCacheList); 2567 while( ALWAYS(pList) && pList->pNext!=pBt ){ 2568 pList=pList->pNext; 2569 } 2570 if( ALWAYS(pList) ){ 2571 pList->pNext = pBt->pNext; 2572 } 2573 } 2574 if( SQLITE_THREADSAFE ){ 2575 sqlite3_mutex_free(pBt->mutex); 2576 } 2577 removed = 1; 2578 } 2579 sqlite3_mutex_leave(pMaster); 2580 return removed; 2581 #else 2582 return 1; 2583 #endif 2584 } 2585 2586 /* 2587 ** Make sure pBt->pTmpSpace points to an allocation of 2588 ** MX_CELL_SIZE(pBt) bytes with a 4-byte prefix for a left-child 2589 ** pointer. 2590 */ 2591 static void allocateTempSpace(BtShared *pBt){ 2592 if( !pBt->pTmpSpace ){ 2593 pBt->pTmpSpace = sqlite3PageMalloc( pBt->pageSize ); 2594 2595 /* One of the uses of pBt->pTmpSpace is to format cells before 2596 ** inserting them into a leaf page (function fillInCell()). If 2597 ** a cell is less than 4 bytes in size, it is rounded up to 4 bytes 2598 ** by the various routines that manipulate binary cells. Which 2599 ** can mean that fillInCell() only initializes the first 2 or 3 2600 ** bytes of pTmpSpace, but that the first 4 bytes are copied from 2601 ** it into a database page. This is not actually a problem, but it 2602 ** does cause a valgrind error when the 1 or 2 bytes of unitialized 2603 ** data is passed to system call write(). So to avoid this error, 2604 ** zero the first 4 bytes of temp space here. 2605 ** 2606 ** Also: Provide four bytes of initialized space before the 2607 ** beginning of pTmpSpace as an area available to prepend the 2608 ** left-child pointer to the beginning of a cell. 2609 */ 2610 if( pBt->pTmpSpace ){ 2611 memset(pBt->pTmpSpace, 0, 8); 2612 pBt->pTmpSpace += 4; 2613 } 2614 } 2615 } 2616 2617 /* 2618 ** Free the pBt->pTmpSpace allocation 2619 */ 2620 static void freeTempSpace(BtShared *pBt){ 2621 if( pBt->pTmpSpace ){ 2622 pBt->pTmpSpace -= 4; 2623 sqlite3PageFree(pBt->pTmpSpace); 2624 pBt->pTmpSpace = 0; 2625 } 2626 } 2627 2628 /* 2629 ** Close an open database and invalidate all cursors. 2630 */ 2631 int sqlite3BtreeClose(Btree *p){ 2632 BtShared *pBt = p->pBt; 2633 BtCursor *pCur; 2634 2635 /* Close all cursors opened via this handle. */ 2636 assert( sqlite3_mutex_held(p->db->mutex) ); 2637 sqlite3BtreeEnter(p); 2638 pCur = pBt->pCursor; 2639 while( pCur ){ 2640 BtCursor *pTmp = pCur; 2641 pCur = pCur->pNext; 2642 if( pTmp->pBtree==p ){ 2643 sqlite3BtreeCloseCursor(pTmp); 2644 } 2645 } 2646 2647 /* Rollback any active transaction and free the handle structure. 2648 ** The call to sqlite3BtreeRollback() drops any table-locks held by 2649 ** this handle. 2650 */ 2651 sqlite3BtreeRollback(p, SQLITE_OK, 0); 2652 sqlite3BtreeLeave(p); 2653 2654 /* If there are still other outstanding references to the shared-btree 2655 ** structure, return now. The remainder of this procedure cleans 2656 ** up the shared-btree. 2657 */ 2658 assert( p->wantToLock==0 && p->locked==0 ); 2659 if( !p->sharable || removeFromSharingList(pBt) ){ 2660 /* The pBt is no longer on the sharing list, so we can access 2661 ** it without having to hold the mutex. 2662 ** 2663 ** Clean out and delete the BtShared object. 2664 */ 2665 assert( !pBt->pCursor ); 2666 sqlite3PagerClose(pBt->pPager, p->db); 2667 if( pBt->xFreeSchema && pBt->pSchema ){ 2668 pBt->xFreeSchema(pBt->pSchema); 2669 } 2670 sqlite3DbFree(0, pBt->pSchema); 2671 freeTempSpace(pBt); 2672 sqlite3_free(pBt); 2673 } 2674 2675 #ifndef SQLITE_OMIT_SHARED_CACHE 2676 assert( p->wantToLock==0 ); 2677 assert( p->locked==0 ); 2678 if( p->pPrev ) p->pPrev->pNext = p->pNext; 2679 if( p->pNext ) p->pNext->pPrev = p->pPrev; 2680 #endif 2681 2682 sqlite3_free(p); 2683 return SQLITE_OK; 2684 } 2685 2686 /* 2687 ** Change the "soft" limit on the number of pages in the cache. 2688 ** Unused and unmodified pages will be recycled when the number of 2689 ** pages in the cache exceeds this soft limit. But the size of the 2690 ** cache is allowed to grow larger than this limit if it contains 2691 ** dirty pages or pages still in active use. 2692 */ 2693 int sqlite3BtreeSetCacheSize(Btree *p, int mxPage){ 2694 BtShared *pBt = p->pBt; 2695 assert( sqlite3_mutex_held(p->db->mutex) ); 2696 sqlite3BtreeEnter(p); 2697 sqlite3PagerSetCachesize(pBt->pPager, mxPage); 2698 sqlite3BtreeLeave(p); 2699 return SQLITE_OK; 2700 } 2701 2702 /* 2703 ** Change the "spill" limit on the number of pages in the cache. 2704 ** If the number of pages exceeds this limit during a write transaction, 2705 ** the pager might attempt to "spill" pages to the journal early in 2706 ** order to free up memory. 2707 ** 2708 ** The value returned is the current spill size. If zero is passed 2709 ** as an argument, no changes are made to the spill size setting, so 2710 ** using mxPage of 0 is a way to query the current spill size. 2711 */ 2712 int sqlite3BtreeSetSpillSize(Btree *p, int mxPage){ 2713 BtShared *pBt = p->pBt; 2714 int res; 2715 assert( sqlite3_mutex_held(p->db->mutex) ); 2716 sqlite3BtreeEnter(p); 2717 res = sqlite3PagerSetSpillsize(pBt->pPager, mxPage); 2718 sqlite3BtreeLeave(p); 2719 return res; 2720 } 2721 2722 #if SQLITE_MAX_MMAP_SIZE>0 2723 /* 2724 ** Change the limit on the amount of the database file that may be 2725 ** memory mapped. 2726 */ 2727 int sqlite3BtreeSetMmapLimit(Btree *p, sqlite3_int64 szMmap){ 2728 BtShared *pBt = p->pBt; 2729 assert( sqlite3_mutex_held(p->db->mutex) ); 2730 sqlite3BtreeEnter(p); 2731 sqlite3PagerSetMmapLimit(pBt->pPager, szMmap); 2732 sqlite3BtreeLeave(p); 2733 return SQLITE_OK; 2734 } 2735 #endif /* SQLITE_MAX_MMAP_SIZE>0 */ 2736 2737 /* 2738 ** Change the way data is synced to disk in order to increase or decrease 2739 ** how well the database resists damage due to OS crashes and power 2740 ** failures. Level 1 is the same as asynchronous (no syncs() occur and 2741 ** there is a high probability of damage) Level 2 is the default. There 2742 ** is a very low but non-zero probability of damage. Level 3 reduces the 2743 ** probability of damage to near zero but with a write performance reduction. 2744 */ 2745 #ifndef SQLITE_OMIT_PAGER_PRAGMAS 2746 int sqlite3BtreeSetPagerFlags( 2747 Btree *p, /* The btree to set the safety level on */ 2748 unsigned pgFlags /* Various PAGER_* flags */ 2749 ){ 2750 BtShared *pBt = p->pBt; 2751 assert( sqlite3_mutex_held(p->db->mutex) ); 2752 sqlite3BtreeEnter(p); 2753 sqlite3PagerSetFlags(pBt->pPager, pgFlags); 2754 sqlite3BtreeLeave(p); 2755 return SQLITE_OK; 2756 } 2757 #endif 2758 2759 /* 2760 ** Change the default pages size and the number of reserved bytes per page. 2761 ** Or, if the page size has already been fixed, return SQLITE_READONLY 2762 ** without changing anything. 2763 ** 2764 ** The page size must be a power of 2 between 512 and 65536. If the page 2765 ** size supplied does not meet this constraint then the page size is not 2766 ** changed. 2767 ** 2768 ** Page sizes are constrained to be a power of two so that the region 2769 ** of the database file used for locking (beginning at PENDING_BYTE, 2770 ** the first byte past the 1GB boundary, 0x40000000) needs to occur 2771 ** at the beginning of a page. 2772 ** 2773 ** If parameter nReserve is less than zero, then the number of reserved 2774 ** bytes per page is left unchanged. 2775 ** 2776 ** If the iFix!=0 then the BTS_PAGESIZE_FIXED flag is set so that the page size 2777 ** and autovacuum mode can no longer be changed. 2778 */ 2779 int sqlite3BtreeSetPageSize(Btree *p, int pageSize, int nReserve, int iFix){ 2780 int rc = SQLITE_OK; 2781 BtShared *pBt = p->pBt; 2782 assert( nReserve>=-1 && nReserve<=255 ); 2783 sqlite3BtreeEnter(p); 2784 #if SQLITE_HAS_CODEC 2785 if( nReserve>pBt->optimalReserve ) pBt->optimalReserve = (u8)nReserve; 2786 #endif 2787 if( pBt->btsFlags & BTS_PAGESIZE_FIXED ){ 2788 sqlite3BtreeLeave(p); 2789 return SQLITE_READONLY; 2790 } 2791 if( nReserve<0 ){ 2792 nReserve = pBt->pageSize - pBt->usableSize; 2793 } 2794 assert( nReserve>=0 && nReserve<=255 ); 2795 if( pageSize>=512 && pageSize<=SQLITE_MAX_PAGE_SIZE && 2796 ((pageSize-1)&pageSize)==0 ){ 2797 assert( (pageSize & 7)==0 ); 2798 assert( !pBt->pCursor ); 2799 pBt->pageSize = (u32)pageSize; 2800 freeTempSpace(pBt); 2801 } 2802 rc = sqlite3PagerSetPagesize(pBt->pPager, &pBt->pageSize, nReserve); 2803 pBt->usableSize = pBt->pageSize - (u16)nReserve; 2804 if( iFix ) pBt->btsFlags |= BTS_PAGESIZE_FIXED; 2805 sqlite3BtreeLeave(p); 2806 return rc; 2807 } 2808 2809 /* 2810 ** Return the currently defined page size 2811 */ 2812 int sqlite3BtreeGetPageSize(Btree *p){ 2813 return p->pBt->pageSize; 2814 } 2815 2816 /* 2817 ** This function is similar to sqlite3BtreeGetReserve(), except that it 2818 ** may only be called if it is guaranteed that the b-tree mutex is already 2819 ** held. 2820 ** 2821 ** This is useful in one special case in the backup API code where it is 2822 ** known that the shared b-tree mutex is held, but the mutex on the 2823 ** database handle that owns *p is not. In this case if sqlite3BtreeEnter() 2824 ** were to be called, it might collide with some other operation on the 2825 ** database handle that owns *p, causing undefined behavior. 2826 */ 2827 int sqlite3BtreeGetReserveNoMutex(Btree *p){ 2828 int n; 2829 assert( sqlite3_mutex_held(p->pBt->mutex) ); 2830 n = p->pBt->pageSize - p->pBt->usableSize; 2831 return n; 2832 } 2833 2834 /* 2835 ** Return the number of bytes of space at the end of every page that 2836 ** are intentually left unused. This is the "reserved" space that is 2837 ** sometimes used by extensions. 2838 ** 2839 ** If SQLITE_HAS_MUTEX is defined then the number returned is the 2840 ** greater of the current reserved space and the maximum requested 2841 ** reserve space. 2842 */ 2843 int sqlite3BtreeGetOptimalReserve(Btree *p){ 2844 int n; 2845 sqlite3BtreeEnter(p); 2846 n = sqlite3BtreeGetReserveNoMutex(p); 2847 #ifdef SQLITE_HAS_CODEC 2848 if( n<p->pBt->optimalReserve ) n = p->pBt->optimalReserve; 2849 #endif 2850 sqlite3BtreeLeave(p); 2851 return n; 2852 } 2853 2854 2855 /* 2856 ** Set the maximum page count for a database if mxPage is positive. 2857 ** No changes are made if mxPage is 0 or negative. 2858 ** Regardless of the value of mxPage, return the maximum page count. 2859 */ 2860 int sqlite3BtreeMaxPageCount(Btree *p, int mxPage){ 2861 int n; 2862 sqlite3BtreeEnter(p); 2863 n = sqlite3PagerMaxPageCount(p->pBt->pPager, mxPage); 2864 sqlite3BtreeLeave(p); 2865 return n; 2866 } 2867 2868 /* 2869 ** Change the values for the BTS_SECURE_DELETE and BTS_OVERWRITE flags: 2870 ** 2871 ** newFlag==0 Both BTS_SECURE_DELETE and BTS_OVERWRITE are cleared 2872 ** newFlag==1 BTS_SECURE_DELETE set and BTS_OVERWRITE is cleared 2873 ** newFlag==2 BTS_SECURE_DELETE cleared and BTS_OVERWRITE is set 2874 ** newFlag==(-1) No changes 2875 ** 2876 ** This routine acts as a query if newFlag is less than zero 2877 ** 2878 ** With BTS_OVERWRITE set, deleted content is overwritten by zeros, but 2879 ** freelist leaf pages are not written back to the database. Thus in-page 2880 ** deleted content is cleared, but freelist deleted content is not. 2881 ** 2882 ** With BTS_SECURE_DELETE, operation is like BTS_OVERWRITE with the addition 2883 ** that freelist leaf pages are written back into the database, increasing 2884 ** the amount of disk I/O. 2885 */ 2886 int sqlite3BtreeSecureDelete(Btree *p, int newFlag){ 2887 int b; 2888 if( p==0 ) return 0; 2889 sqlite3BtreeEnter(p); 2890 assert( BTS_OVERWRITE==BTS_SECURE_DELETE*2 ); 2891 assert( BTS_FAST_SECURE==(BTS_OVERWRITE|BTS_SECURE_DELETE) ); 2892 if( newFlag>=0 ){ 2893 p->pBt->btsFlags &= ~BTS_FAST_SECURE; 2894 p->pBt->btsFlags |= BTS_SECURE_DELETE*newFlag; 2895 } 2896 b = (p->pBt->btsFlags & BTS_FAST_SECURE)/BTS_SECURE_DELETE; 2897 sqlite3BtreeLeave(p); 2898 return b; 2899 } 2900 2901 /* 2902 ** Change the 'auto-vacuum' property of the database. If the 'autoVacuum' 2903 ** parameter is non-zero, then auto-vacuum mode is enabled. If zero, it 2904 ** is disabled. The default value for the auto-vacuum property is 2905 ** determined by the SQLITE_DEFAULT_AUTOVACUUM macro. 2906 */ 2907 int sqlite3BtreeSetAutoVacuum(Btree *p, int autoVacuum){ 2908 #ifdef SQLITE_OMIT_AUTOVACUUM 2909 return SQLITE_READONLY; 2910 #else 2911 BtShared *pBt = p->pBt; 2912 int rc = SQLITE_OK; 2913 u8 av = (u8)autoVacuum; 2914 2915 sqlite3BtreeEnter(p); 2916 if( (pBt->btsFlags & BTS_PAGESIZE_FIXED)!=0 && (av ?1:0)!=pBt->autoVacuum ){ 2917 rc = SQLITE_READONLY; 2918 }else{ 2919 pBt->autoVacuum = av ?1:0; 2920 pBt->incrVacuum = av==2 ?1:0; 2921 } 2922 sqlite3BtreeLeave(p); 2923 return rc; 2924 #endif 2925 } 2926 2927 /* 2928 ** Return the value of the 'auto-vacuum' property. If auto-vacuum is 2929 ** enabled 1 is returned. Otherwise 0. 2930 */ 2931 int sqlite3BtreeGetAutoVacuum(Btree *p){ 2932 #ifdef SQLITE_OMIT_AUTOVACUUM 2933 return BTREE_AUTOVACUUM_NONE; 2934 #else 2935 int rc; 2936 sqlite3BtreeEnter(p); 2937 rc = ( 2938 (!p->pBt->autoVacuum)?BTREE_AUTOVACUUM_NONE: 2939 (!p->pBt->incrVacuum)?BTREE_AUTOVACUUM_FULL: 2940 BTREE_AUTOVACUUM_INCR 2941 ); 2942 sqlite3BtreeLeave(p); 2943 return rc; 2944 #endif 2945 } 2946 2947 /* 2948 ** If the user has not set the safety-level for this database connection 2949 ** using "PRAGMA synchronous", and if the safety-level is not already 2950 ** set to the value passed to this function as the second parameter, 2951 ** set it so. 2952 */ 2953 #if SQLITE_DEFAULT_SYNCHRONOUS!=SQLITE_DEFAULT_WAL_SYNCHRONOUS \ 2954 && !defined(SQLITE_OMIT_WAL) 2955 static void setDefaultSyncFlag(BtShared *pBt, u8 safety_level){ 2956 sqlite3 *db; 2957 Db *pDb; 2958 if( (db=pBt->db)!=0 && (pDb=db->aDb)!=0 ){ 2959 while( pDb->pBt==0 || pDb->pBt->pBt!=pBt ){ pDb++; } 2960 if( pDb->bSyncSet==0 2961 && pDb->safety_level!=safety_level 2962 && pDb!=&db->aDb[1] 2963 ){ 2964 pDb->safety_level = safety_level; 2965 sqlite3PagerSetFlags(pBt->pPager, 2966 pDb->safety_level | (db->flags & PAGER_FLAGS_MASK)); 2967 } 2968 } 2969 } 2970 #else 2971 # define setDefaultSyncFlag(pBt,safety_level) 2972 #endif 2973 2974 /* 2975 ** Get a reference to pPage1 of the database file. This will 2976 ** also acquire a readlock on that file. 2977 ** 2978 ** SQLITE_OK is returned on success. If the file is not a 2979 ** well-formed database file, then SQLITE_CORRUPT is returned. 2980 ** SQLITE_BUSY is returned if the database is locked. SQLITE_NOMEM 2981 ** is returned if we run out of memory. 2982 */ 2983 static int lockBtree(BtShared *pBt){ 2984 int rc; /* Result code from subfunctions */ 2985 MemPage *pPage1; /* Page 1 of the database file */ 2986 int nPage; /* Number of pages in the database */ 2987 int nPageFile = 0; /* Number of pages in the database file */ 2988 int nPageHeader; /* Number of pages in the database according to hdr */ 2989 2990 assert( sqlite3_mutex_held(pBt->mutex) ); 2991 assert( pBt->pPage1==0 ); 2992 rc = sqlite3PagerSharedLock(pBt->pPager); 2993 if( rc!=SQLITE_OK ) return rc; 2994 rc = btreeGetPage(pBt, 1, &pPage1, 0); 2995 if( rc!=SQLITE_OK ) return rc; 2996 2997 /* Do some checking to help insure the file we opened really is 2998 ** a valid database file. 2999 */ 3000 nPage = nPageHeader = get4byte(28+(u8*)pPage1->aData); 3001 sqlite3PagerPagecount(pBt->pPager, &nPageFile); 3002 if( nPage==0 || memcmp(24+(u8*)pPage1->aData, 92+(u8*)pPage1->aData,4)!=0 ){ 3003 nPage = nPageFile; 3004 } 3005 if( nPage>0 ){ 3006 u32 pageSize; 3007 u32 usableSize; 3008 u8 *page1 = pPage1->aData; 3009 rc = SQLITE_NOTADB; 3010 /* EVIDENCE-OF: R-43737-39999 Every valid SQLite database file begins 3011 ** with the following 16 bytes (in hex): 53 51 4c 69 74 65 20 66 6f 72 6d 3012 ** 61 74 20 33 00. */ 3013 if( memcmp(page1, zMagicHeader, 16)!=0 ){ 3014 goto page1_init_failed; 3015 } 3016 3017 #ifdef SQLITE_OMIT_WAL 3018 if( page1[18]>1 ){ 3019 pBt->btsFlags |= BTS_READ_ONLY; 3020 } 3021 if( page1[19]>1 ){ 3022 goto page1_init_failed; 3023 } 3024 #else 3025 if( page1[18]>2 ){ 3026 pBt->btsFlags |= BTS_READ_ONLY; 3027 } 3028 if( page1[19]>2 ){ 3029 goto page1_init_failed; 3030 } 3031 3032 /* If the write version is set to 2, this database should be accessed 3033 ** in WAL mode. If the log is not already open, open it now. Then 3034 ** return SQLITE_OK and return without populating BtShared.pPage1. 3035 ** The caller detects this and calls this function again. This is 3036 ** required as the version of page 1 currently in the page1 buffer 3037 ** may not be the latest version - there may be a newer one in the log 3038 ** file. 3039 */ 3040 if( page1[19]==2 && (pBt->btsFlags & BTS_NO_WAL)==0 ){ 3041 int isOpen = 0; 3042 rc = sqlite3PagerOpenWal(pBt->pPager, &isOpen); 3043 if( rc!=SQLITE_OK ){ 3044 goto page1_init_failed; 3045 }else{ 3046 setDefaultSyncFlag(pBt, SQLITE_DEFAULT_WAL_SYNCHRONOUS+1); 3047 if( isOpen==0 ){ 3048 releasePageOne(pPage1); 3049 return SQLITE_OK; 3050 } 3051 } 3052 rc = SQLITE_NOTADB; 3053 }else{ 3054 setDefaultSyncFlag(pBt, SQLITE_DEFAULT_SYNCHRONOUS+1); 3055 } 3056 #endif 3057 3058 /* EVIDENCE-OF: R-15465-20813 The maximum and minimum embedded payload 3059 ** fractions and the leaf payload fraction values must be 64, 32, and 32. 3060 ** 3061 ** The original design allowed these amounts to vary, but as of 3062 ** version 3.6.0, we require them to be fixed. 3063 */ 3064 if( memcmp(&page1[21], "\100\040\040",3)!=0 ){ 3065 goto page1_init_failed; 3066 } 3067 /* EVIDENCE-OF: R-51873-39618 The page size for a database file is 3068 ** determined by the 2-byte integer located at an offset of 16 bytes from 3069 ** the beginning of the database file. */ 3070 pageSize = (page1[16]<<8) | (page1[17]<<16); 3071 /* EVIDENCE-OF: R-25008-21688 The size of a page is a power of two 3072 ** between 512 and 65536 inclusive. */ 3073 if( ((pageSize-1)&pageSize)!=0 3074 || pageSize>SQLITE_MAX_PAGE_SIZE 3075 || pageSize<=256 3076 ){ 3077 goto page1_init_failed; 3078 } 3079 assert( (pageSize & 7)==0 ); 3080 /* EVIDENCE-OF: R-59310-51205 The "reserved space" size in the 1-byte 3081 ** integer at offset 20 is the number of bytes of space at the end of 3082 ** each page to reserve for extensions. 3083 ** 3084 ** EVIDENCE-OF: R-37497-42412 The size of the reserved region is 3085 ** determined by the one-byte unsigned integer found at an offset of 20 3086 ** into the database file header. */ 3087 usableSize = pageSize - page1[20]; 3088 if( (u32)pageSize!=pBt->pageSize ){ 3089 /* After reading the first page of the database assuming a page size 3090 ** of BtShared.pageSize, we have discovered that the page-size is 3091 ** actually pageSize. Unlock the database, leave pBt->pPage1 at 3092 ** zero and return SQLITE_OK. The caller will call this function 3093 ** again with the correct page-size. 3094 */ 3095 releasePageOne(pPage1); 3096 pBt->usableSize = usableSize; 3097 pBt->pageSize = pageSize; 3098 freeTempSpace(pBt); 3099 rc = sqlite3PagerSetPagesize(pBt->pPager, &pBt->pageSize, 3100 pageSize-usableSize); 3101 return rc; 3102 } 3103 if( (pBt->db->flags & SQLITE_WriteSchema)==0 && nPage>nPageFile ){ 3104 rc = SQLITE_CORRUPT_BKPT; 3105 goto page1_init_failed; 3106 } 3107 /* EVIDENCE-OF: R-28312-64704 However, the usable size is not allowed to 3108 ** be less than 480. In other words, if the page size is 512, then the 3109 ** reserved space size cannot exceed 32. */ 3110 if( usableSize<480 ){ 3111 goto page1_init_failed; 3112 } 3113 pBt->pageSize = pageSize; 3114 pBt->usableSize = usableSize; 3115 #ifndef SQLITE_OMIT_AUTOVACUUM 3116 pBt->autoVacuum = (get4byte(&page1[36 + 4*4])?1:0); 3117 pBt->incrVacuum = (get4byte(&page1[36 + 7*4])?1:0); 3118 #endif 3119 } 3120 3121 /* maxLocal is the maximum amount of payload to store locally for 3122 ** a cell. Make sure it is small enough so that at least minFanout 3123 ** cells can will fit on one page. We assume a 10-byte page header. 3124 ** Besides the payload, the cell must store: 3125 ** 2-byte pointer to the cell 3126 ** 4-byte child pointer 3127 ** 9-byte nKey value 3128 ** 4-byte nData value 3129 ** 4-byte overflow page pointer 3130 ** So a cell consists of a 2-byte pointer, a header which is as much as 3131 ** 17 bytes long, 0 to N bytes of payload, and an optional 4 byte overflow 3132 ** page pointer. 3133 */ 3134 pBt->maxLocal = (u16)((pBt->usableSize-12)*64/255 - 23); 3135 pBt->minLocal = (u16)((pBt->usableSize-12)*32/255 - 23); 3136 pBt->maxLeaf = (u16)(pBt->usableSize - 35); 3137 pBt->minLeaf = (u16)((pBt->usableSize-12)*32/255 - 23); 3138 if( pBt->maxLocal>127 ){ 3139 pBt->max1bytePayload = 127; 3140 }else{ 3141 pBt->max1bytePayload = (u8)pBt->maxLocal; 3142 } 3143 assert( pBt->maxLeaf + 23 <= MX_CELL_SIZE(pBt) ); 3144 pBt->pPage1 = pPage1; 3145 pBt->nPage = nPage; 3146 return SQLITE_OK; 3147 3148 page1_init_failed: 3149 releasePageOne(pPage1); 3150 pBt->pPage1 = 0; 3151 return rc; 3152 } 3153 3154 #ifndef NDEBUG 3155 /* 3156 ** Return the number of cursors open on pBt. This is for use 3157 ** in assert() expressions, so it is only compiled if NDEBUG is not 3158 ** defined. 3159 ** 3160 ** Only write cursors are counted if wrOnly is true. If wrOnly is 3161 ** false then all cursors are counted. 3162 ** 3163 ** For the purposes of this routine, a cursor is any cursor that 3164 ** is capable of reading or writing to the database. Cursors that 3165 ** have been tripped into the CURSOR_FAULT state are not counted. 3166 */ 3167 static int countValidCursors(BtShared *pBt, int wrOnly){ 3168 BtCursor *pCur; 3169 int r = 0; 3170 for(pCur=pBt->pCursor; pCur; pCur=pCur->pNext){ 3171 if( (wrOnly==0 || (pCur->curFlags & BTCF_WriteFlag)!=0) 3172 && pCur->eState!=CURSOR_FAULT ) r++; 3173 } 3174 return r; 3175 } 3176 #endif 3177 3178 /* 3179 ** If there are no outstanding cursors and we are not in the middle 3180 ** of a transaction but there is a read lock on the database, then 3181 ** this routine unrefs the first page of the database file which 3182 ** has the effect of releasing the read lock. 3183 ** 3184 ** If there is a transaction in progress, this routine is a no-op. 3185 */ 3186 static void unlockBtreeIfUnused(BtShared *pBt){ 3187 assert( sqlite3_mutex_held(pBt->mutex) ); 3188 assert( countValidCursors(pBt,0)==0 || pBt->inTransaction>TRANS_NONE ); 3189 if( pBt->inTransaction==TRANS_NONE && pBt->pPage1!=0 ){ 3190 MemPage *pPage1 = pBt->pPage1; 3191 assert( pPage1->aData ); 3192 assert( sqlite3PagerRefcount(pBt->pPager)==1 ); 3193 pBt->pPage1 = 0; 3194 releasePageOne(pPage1); 3195 } 3196 } 3197 3198 /* 3199 ** If pBt points to an empty file then convert that empty file 3200 ** into a new empty database by initializing the first page of 3201 ** the database. 3202 */ 3203 static int newDatabase(BtShared *pBt){ 3204 MemPage *pP1; 3205 unsigned char *data; 3206 int rc; 3207 3208 assert( sqlite3_mutex_held(pBt->mutex) ); 3209 if( pBt->nPage>0 ){ 3210 return SQLITE_OK; 3211 } 3212 pP1 = pBt->pPage1; 3213 assert( pP1!=0 ); 3214 data = pP1->aData; 3215 rc = sqlite3PagerWrite(pP1->pDbPage); 3216 if( rc ) return rc; 3217 memcpy(data, zMagicHeader, sizeof(zMagicHeader)); 3218 assert( sizeof(zMagicHeader)==16 ); 3219 data[16] = (u8)((pBt->pageSize>>8)&0xff); 3220 data[17] = (u8)((pBt->pageSize>>16)&0xff); 3221 data[18] = 1; 3222 data[19] = 1; 3223 assert( pBt->usableSize<=pBt->pageSize && pBt->usableSize+255>=pBt->pageSize); 3224 data[20] = (u8)(pBt->pageSize - pBt->usableSize); 3225 data[21] = 64; 3226 data[22] = 32; 3227 data[23] = 32; 3228 memset(&data[24], 0, 100-24); 3229 zeroPage(pP1, PTF_INTKEY|PTF_LEAF|PTF_LEAFDATA ); 3230 pBt->btsFlags |= BTS_PAGESIZE_FIXED; 3231 #ifndef SQLITE_OMIT_AUTOVACUUM 3232 assert( pBt->autoVacuum==1 || pBt->autoVacuum==0 ); 3233 assert( pBt->incrVacuum==1 || pBt->incrVacuum==0 ); 3234 put4byte(&data[36 + 4*4], pBt->autoVacuum); 3235 put4byte(&data[36 + 7*4], pBt->incrVacuum); 3236 #endif 3237 pBt->nPage = 1; 3238 data[31] = 1; 3239 return SQLITE_OK; 3240 } 3241 3242 /* 3243 ** Initialize the first page of the database file (creating a database 3244 ** consisting of a single page and no schema objects). Return SQLITE_OK 3245 ** if successful, or an SQLite error code otherwise. 3246 */ 3247 int sqlite3BtreeNewDb(Btree *p){ 3248 int rc; 3249 sqlite3BtreeEnter(p); 3250 p->pBt->nPage = 0; 3251 rc = newDatabase(p->pBt); 3252 sqlite3BtreeLeave(p); 3253 return rc; 3254 } 3255 3256 /* 3257 ** Attempt to start a new transaction. A write-transaction 3258 ** is started if the second argument is nonzero, otherwise a read- 3259 ** transaction. If the second argument is 2 or more and exclusive 3260 ** transaction is started, meaning that no other process is allowed 3261 ** to access the database. A preexisting transaction may not be 3262 ** upgraded to exclusive by calling this routine a second time - the 3263 ** exclusivity flag only works for a new transaction. 3264 ** 3265 ** A write-transaction must be started before attempting any 3266 ** changes to the database. None of the following routines 3267 ** will work unless a transaction is started first: 3268 ** 3269 ** sqlite3BtreeCreateTable() 3270 ** sqlite3BtreeCreateIndex() 3271 ** sqlite3BtreeClearTable() 3272 ** sqlite3BtreeDropTable() 3273 ** sqlite3BtreeInsert() 3274 ** sqlite3BtreeDelete() 3275 ** sqlite3BtreeUpdateMeta() 3276 ** 3277 ** If an initial attempt to acquire the lock fails because of lock contention 3278 ** and the database was previously unlocked, then invoke the busy handler 3279 ** if there is one. But if there was previously a read-lock, do not 3280 ** invoke the busy handler - just return SQLITE_BUSY. SQLITE_BUSY is 3281 ** returned when there is already a read-lock in order to avoid a deadlock. 3282 ** 3283 ** Suppose there are two processes A and B. A has a read lock and B has 3284 ** a reserved lock. B tries to promote to exclusive but is blocked because 3285 ** of A's read lock. A tries to promote to reserved but is blocked by B. 3286 ** One or the other of the two processes must give way or there can be 3287 ** no progress. By returning SQLITE_BUSY and not invoking the busy callback 3288 ** when A already has a read lock, we encourage A to give up and let B 3289 ** proceed. 3290 */ 3291 int sqlite3BtreeBeginTrans(Btree *p, int wrflag){ 3292 BtShared *pBt = p->pBt; 3293 int rc = SQLITE_OK; 3294 3295 sqlite3BtreeEnter(p); 3296 btreeIntegrity(p); 3297 3298 /* If the btree is already in a write-transaction, or it 3299 ** is already in a read-transaction and a read-transaction 3300 ** is requested, this is a no-op. 3301 */ 3302 if( p->inTrans==TRANS_WRITE || (p->inTrans==TRANS_READ && !wrflag) ){ 3303 goto trans_begun; 3304 } 3305 assert( pBt->inTransaction==TRANS_WRITE || IfNotOmitAV(pBt->bDoTruncate)==0 ); 3306 3307 /* Write transactions are not possible on a read-only database */ 3308 if( (pBt->btsFlags & BTS_READ_ONLY)!=0 && wrflag ){ 3309 rc = SQLITE_READONLY; 3310 goto trans_begun; 3311 } 3312 3313 #ifndef SQLITE_OMIT_SHARED_CACHE 3314 { 3315 sqlite3 *pBlock = 0; 3316 /* If another database handle has already opened a write transaction 3317 ** on this shared-btree structure and a second write transaction is 3318 ** requested, return SQLITE_LOCKED. 3319 */ 3320 if( (wrflag && pBt->inTransaction==TRANS_WRITE) 3321 || (pBt->btsFlags & BTS_PENDING)!=0 3322 ){ 3323 pBlock = pBt->pWriter->db; 3324 }else if( wrflag>1 ){ 3325 BtLock *pIter; 3326 for(pIter=pBt->pLock; pIter; pIter=pIter->pNext){ 3327 if( pIter->pBtree!=p ){ 3328 pBlock = pIter->pBtree->db; 3329 break; 3330 } 3331 } 3332 } 3333 if( pBlock ){ 3334 sqlite3ConnectionBlocked(p->db, pBlock); 3335 rc = SQLITE_LOCKED_SHAREDCACHE; 3336 goto trans_begun; 3337 } 3338 } 3339 #endif 3340 3341 /* Any read-only or read-write transaction implies a read-lock on 3342 ** page 1. So if some other shared-cache client already has a write-lock 3343 ** on page 1, the transaction cannot be opened. */ 3344 rc = querySharedCacheTableLock(p, MASTER_ROOT, READ_LOCK); 3345 if( SQLITE_OK!=rc ) goto trans_begun; 3346 3347 pBt->btsFlags &= ~BTS_INITIALLY_EMPTY; 3348 if( pBt->nPage==0 ) pBt->btsFlags |= BTS_INITIALLY_EMPTY; 3349 do { 3350 /* Call lockBtree() until either pBt->pPage1 is populated or 3351 ** lockBtree() returns something other than SQLITE_OK. lockBtree() 3352 ** may return SQLITE_OK but leave pBt->pPage1 set to 0 if after 3353 ** reading page 1 it discovers that the page-size of the database 3354 ** file is not pBt->pageSize. In this case lockBtree() will update 3355 ** pBt->pageSize to the page-size of the file on disk. 3356 */ 3357 while( pBt->pPage1==0 && SQLITE_OK==(rc = lockBtree(pBt)) ); 3358 3359 if( rc==SQLITE_OK && wrflag ){ 3360 if( (pBt->btsFlags & BTS_READ_ONLY)!=0 ){ 3361 rc = SQLITE_READONLY; 3362 }else{ 3363 rc = sqlite3PagerBegin(pBt->pPager,wrflag>1,sqlite3TempInMemory(p->db)); 3364 if( rc==SQLITE_OK ){ 3365 rc = newDatabase(pBt); 3366 } 3367 } 3368 } 3369 3370 if( rc!=SQLITE_OK ){ 3371 unlockBtreeIfUnused(pBt); 3372 } 3373 }while( (rc&0xFF)==SQLITE_BUSY && pBt->inTransaction==TRANS_NONE && 3374 btreeInvokeBusyHandler(pBt) ); 3375 3376 if( rc==SQLITE_OK ){ 3377 if( p->inTrans==TRANS_NONE ){ 3378 pBt->nTransaction++; 3379 #ifndef SQLITE_OMIT_SHARED_CACHE 3380 if( p->sharable ){ 3381 assert( p->lock.pBtree==p && p->lock.iTable==1 ); 3382 p->lock.eLock = READ_LOCK; 3383 p->lock.pNext = pBt->pLock; 3384 pBt->pLock = &p->lock; 3385 } 3386 #endif 3387 } 3388 p->inTrans = (wrflag?TRANS_WRITE:TRANS_READ); 3389 if( p->inTrans>pBt->inTransaction ){ 3390 pBt->inTransaction = p->inTrans; 3391 } 3392 if( wrflag ){ 3393 MemPage *pPage1 = pBt->pPage1; 3394 #ifndef SQLITE_OMIT_SHARED_CACHE 3395 assert( !pBt->pWriter ); 3396 pBt->pWriter = p; 3397 pBt->btsFlags &= ~BTS_EXCLUSIVE; 3398 if( wrflag>1 ) pBt->btsFlags |= BTS_EXCLUSIVE; 3399 #endif 3400 3401 /* If the db-size header field is incorrect (as it may be if an old 3402 ** client has been writing the database file), update it now. Doing 3403 ** this sooner rather than later means the database size can safely 3404 ** re-read the database size from page 1 if a savepoint or transaction 3405 ** rollback occurs within the transaction. 3406 */ 3407 if( pBt->nPage!=get4byte(&pPage1->aData[28]) ){ 3408 rc = sqlite3PagerWrite(pPage1->pDbPage); 3409 if( rc==SQLITE_OK ){ 3410 put4byte(&pPage1->aData[28], pBt->nPage); 3411 } 3412 } 3413 } 3414 } 3415 3416 3417 trans_begun: 3418 if( rc==SQLITE_OK && wrflag ){ 3419 /* This call makes sure that the pager has the correct number of 3420 ** open savepoints. If the second parameter is greater than 0 and 3421 ** the sub-journal is not already open, then it will be opened here. 3422 */ 3423 rc = sqlite3PagerOpenSavepoint(pBt->pPager, p->db->nSavepoint); 3424 } 3425 3426 btreeIntegrity(p); 3427 sqlite3BtreeLeave(p); 3428 return rc; 3429 } 3430 3431 #ifndef SQLITE_OMIT_AUTOVACUUM 3432 3433 /* 3434 ** Set the pointer-map entries for all children of page pPage. Also, if 3435 ** pPage contains cells that point to overflow pages, set the pointer 3436 ** map entries for the overflow pages as well. 3437 */ 3438 static int setChildPtrmaps(MemPage *pPage){ 3439 int i; /* Counter variable */ 3440 int nCell; /* Number of cells in page pPage */ 3441 int rc; /* Return code */ 3442 BtShared *pBt = pPage->pBt; 3443 Pgno pgno = pPage->pgno; 3444 3445 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 3446 rc = pPage->isInit ? SQLITE_OK : btreeInitPage(pPage); 3447 if( rc!=SQLITE_OK ) return rc; 3448 nCell = pPage->nCell; 3449 3450 for(i=0; i<nCell; i++){ 3451 u8 *pCell = findCell(pPage, i); 3452 3453 ptrmapPutOvflPtr(pPage, pCell, &rc); 3454 3455 if( !pPage->leaf ){ 3456 Pgno childPgno = get4byte(pCell); 3457 ptrmapPut(pBt, childPgno, PTRMAP_BTREE, pgno, &rc); 3458 } 3459 } 3460 3461 if( !pPage->leaf ){ 3462 Pgno childPgno = get4byte(&pPage->aData[pPage->hdrOffset+8]); 3463 ptrmapPut(pBt, childPgno, PTRMAP_BTREE, pgno, &rc); 3464 } 3465 3466 return rc; 3467 } 3468 3469 /* 3470 ** Somewhere on pPage is a pointer to page iFrom. Modify this pointer so 3471 ** that it points to iTo. Parameter eType describes the type of pointer to 3472 ** be modified, as follows: 3473 ** 3474 ** PTRMAP_BTREE: pPage is a btree-page. The pointer points at a child 3475 ** page of pPage. 3476 ** 3477 ** PTRMAP_OVERFLOW1: pPage is a btree-page. The pointer points at an overflow 3478 ** page pointed to by one of the cells on pPage. 3479 ** 3480 ** PTRMAP_OVERFLOW2: pPage is an overflow-page. The pointer points at the next 3481 ** overflow page in the list. 3482 */ 3483 static int modifyPagePointer(MemPage *pPage, Pgno iFrom, Pgno iTo, u8 eType){ 3484 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 3485 assert( sqlite3PagerIswriteable(pPage->pDbPage) ); 3486 if( eType==PTRMAP_OVERFLOW2 ){ 3487 /* The pointer is always the first 4 bytes of the page in this case. */ 3488 if( get4byte(pPage->aData)!=iFrom ){ 3489 return SQLITE_CORRUPT_PAGE(pPage); 3490 } 3491 put4byte(pPage->aData, iTo); 3492 }else{ 3493 int i; 3494 int nCell; 3495 int rc; 3496 3497 rc = pPage->isInit ? SQLITE_OK : btreeInitPage(pPage); 3498 if( rc ) return rc; 3499 nCell = pPage->nCell; 3500 3501 for(i=0; i<nCell; i++){ 3502 u8 *pCell = findCell(pPage, i); 3503 if( eType==PTRMAP_OVERFLOW1 ){ 3504 CellInfo info; 3505 pPage->xParseCell(pPage, pCell, &info); 3506 if( info.nLocal<info.nPayload ){ 3507 if( pCell+info.nSize > pPage->aData+pPage->pBt->usableSize ){ 3508 return SQLITE_CORRUPT_PAGE(pPage); 3509 } 3510 if( iFrom==get4byte(pCell+info.nSize-4) ){ 3511 put4byte(pCell+info.nSize-4, iTo); 3512 break; 3513 } 3514 } 3515 }else{ 3516 if( get4byte(pCell)==iFrom ){ 3517 put4byte(pCell, iTo); 3518 break; 3519 } 3520 } 3521 } 3522 3523 if( i==nCell ){ 3524 if( eType!=PTRMAP_BTREE || 3525 get4byte(&pPage->aData[pPage->hdrOffset+8])!=iFrom ){ 3526 return SQLITE_CORRUPT_PAGE(pPage); 3527 } 3528 put4byte(&pPage->aData[pPage->hdrOffset+8], iTo); 3529 } 3530 } 3531 return SQLITE_OK; 3532 } 3533 3534 3535 /* 3536 ** Move the open database page pDbPage to location iFreePage in the 3537 ** database. The pDbPage reference remains valid. 3538 ** 3539 ** The isCommit flag indicates that there is no need to remember that 3540 ** the journal needs to be sync()ed before database page pDbPage->pgno 3541 ** can be written to. The caller has already promised not to write to that 3542 ** page. 3543 */ 3544 static int relocatePage( 3545 BtShared *pBt, /* Btree */ 3546 MemPage *pDbPage, /* Open page to move */ 3547 u8 eType, /* Pointer map 'type' entry for pDbPage */ 3548 Pgno iPtrPage, /* Pointer map 'page-no' entry for pDbPage */ 3549 Pgno iFreePage, /* The location to move pDbPage to */ 3550 int isCommit /* isCommit flag passed to sqlite3PagerMovepage */ 3551 ){ 3552 MemPage *pPtrPage; /* The page that contains a pointer to pDbPage */ 3553 Pgno iDbPage = pDbPage->pgno; 3554 Pager *pPager = pBt->pPager; 3555 int rc; 3556 3557 assert( eType==PTRMAP_OVERFLOW2 || eType==PTRMAP_OVERFLOW1 || 3558 eType==PTRMAP_BTREE || eType==PTRMAP_ROOTPAGE ); 3559 assert( sqlite3_mutex_held(pBt->mutex) ); 3560 assert( pDbPage->pBt==pBt ); 3561 3562 /* Move page iDbPage from its current location to page number iFreePage */ 3563 TRACE(("AUTOVACUUM: Moving %d to free page %d (ptr page %d type %d)\n", 3564 iDbPage, iFreePage, iPtrPage, eType)); 3565 rc = sqlite3PagerMovepage(pPager, pDbPage->pDbPage, iFreePage, isCommit); 3566 if( rc!=SQLITE_OK ){ 3567 return rc; 3568 } 3569 pDbPage->pgno = iFreePage; 3570 3571 /* If pDbPage was a btree-page, then it may have child pages and/or cells 3572 ** that point to overflow pages. The pointer map entries for all these 3573 ** pages need to be changed. 3574 ** 3575 ** If pDbPage is an overflow page, then the first 4 bytes may store a 3576 ** pointer to a subsequent overflow page. If this is the case, then 3577 ** the pointer map needs to be updated for the subsequent overflow page. 3578 */ 3579 if( eType==PTRMAP_BTREE || eType==PTRMAP_ROOTPAGE ){ 3580 rc = setChildPtrmaps(pDbPage); 3581 if( rc!=SQLITE_OK ){ 3582 return rc; 3583 } 3584 }else{ 3585 Pgno nextOvfl = get4byte(pDbPage->aData); 3586 if( nextOvfl!=0 ){ 3587 ptrmapPut(pBt, nextOvfl, PTRMAP_OVERFLOW2, iFreePage, &rc); 3588 if( rc!=SQLITE_OK ){ 3589 return rc; 3590 } 3591 } 3592 } 3593 3594 /* Fix the database pointer on page iPtrPage that pointed at iDbPage so 3595 ** that it points at iFreePage. Also fix the pointer map entry for 3596 ** iPtrPage. 3597 */ 3598 if( eType!=PTRMAP_ROOTPAGE ){ 3599 rc = btreeGetPage(pBt, iPtrPage, &pPtrPage, 0); 3600 if( rc!=SQLITE_OK ){ 3601 return rc; 3602 } 3603 rc = sqlite3PagerWrite(pPtrPage->pDbPage); 3604 if( rc!=SQLITE_OK ){ 3605 releasePage(pPtrPage); 3606 return rc; 3607 } 3608 rc = modifyPagePointer(pPtrPage, iDbPage, iFreePage, eType); 3609 releasePage(pPtrPage); 3610 if( rc==SQLITE_OK ){ 3611 ptrmapPut(pBt, iFreePage, eType, iPtrPage, &rc); 3612 } 3613 } 3614 return rc; 3615 } 3616 3617 /* Forward declaration required by incrVacuumStep(). */ 3618 static int allocateBtreePage(BtShared *, MemPage **, Pgno *, Pgno, u8); 3619 3620 /* 3621 ** Perform a single step of an incremental-vacuum. If successful, return 3622 ** SQLITE_OK. If there is no work to do (and therefore no point in 3623 ** calling this function again), return SQLITE_DONE. Or, if an error 3624 ** occurs, return some other error code. 3625 ** 3626 ** More specifically, this function attempts to re-organize the database so 3627 ** that the last page of the file currently in use is no longer in use. 3628 ** 3629 ** Parameter nFin is the number of pages that this database would contain 3630 ** were this function called until it returns SQLITE_DONE. 3631 ** 3632 ** If the bCommit parameter is non-zero, this function assumes that the 3633 ** caller will keep calling incrVacuumStep() until it returns SQLITE_DONE 3634 ** or an error. bCommit is passed true for an auto-vacuum-on-commit 3635 ** operation, or false for an incremental vacuum. 3636 */ 3637 static int incrVacuumStep(BtShared *pBt, Pgno nFin, Pgno iLastPg, int bCommit){ 3638 Pgno nFreeList; /* Number of pages still on the free-list */ 3639 int rc; 3640 3641 assert( sqlite3_mutex_held(pBt->mutex) ); 3642 assert( iLastPg>nFin ); 3643 3644 if( !PTRMAP_ISPAGE(pBt, iLastPg) && iLastPg!=PENDING_BYTE_PAGE(pBt) ){ 3645 u8 eType; 3646 Pgno iPtrPage; 3647 3648 nFreeList = get4byte(&pBt->pPage1->aData[36]); 3649 if( nFreeList==0 ){ 3650 return SQLITE_DONE; 3651 } 3652 3653 rc = ptrmapGet(pBt, iLastPg, &eType, &iPtrPage); 3654 if( rc!=SQLITE_OK ){ 3655 return rc; 3656 } 3657 if( eType==PTRMAP_ROOTPAGE ){ 3658 return SQLITE_CORRUPT_BKPT; 3659 } 3660 3661 if( eType==PTRMAP_FREEPAGE ){ 3662 if( bCommit==0 ){ 3663 /* Remove the page from the files free-list. This is not required 3664 ** if bCommit is non-zero. In that case, the free-list will be 3665 ** truncated to zero after this function returns, so it doesn't 3666 ** matter if it still contains some garbage entries. 3667 */ 3668 Pgno iFreePg; 3669 MemPage *pFreePg; 3670 rc = allocateBtreePage(pBt, &pFreePg, &iFreePg, iLastPg, BTALLOC_EXACT); 3671 if( rc!=SQLITE_OK ){ 3672 return rc; 3673 } 3674 assert( iFreePg==iLastPg ); 3675 releasePage(pFreePg); 3676 } 3677 } else { 3678 Pgno iFreePg; /* Index of free page to move pLastPg to */ 3679 MemPage *pLastPg; 3680 u8 eMode = BTALLOC_ANY; /* Mode parameter for allocateBtreePage() */ 3681 Pgno iNear = 0; /* nearby parameter for allocateBtreePage() */ 3682 3683 rc = btreeGetPage(pBt, iLastPg, &pLastPg, 0); 3684 if( rc!=SQLITE_OK ){ 3685 return rc; 3686 } 3687 3688 /* If bCommit is zero, this loop runs exactly once and page pLastPg 3689 ** is swapped with the first free page pulled off the free list. 3690 ** 3691 ** On the other hand, if bCommit is greater than zero, then keep 3692 ** looping until a free-page located within the first nFin pages 3693 ** of the file is found. 3694 */ 3695 if( bCommit==0 ){ 3696 eMode = BTALLOC_LE; 3697 iNear = nFin; 3698 } 3699 do { 3700 MemPage *pFreePg; 3701 rc = allocateBtreePage(pBt, &pFreePg, &iFreePg, iNear, eMode); 3702 if( rc!=SQLITE_OK ){ 3703 releasePage(pLastPg); 3704 return rc; 3705 } 3706 releasePage(pFreePg); 3707 }while( bCommit && iFreePg>nFin ); 3708 assert( iFreePg<iLastPg ); 3709 3710 rc = relocatePage(pBt, pLastPg, eType, iPtrPage, iFreePg, bCommit); 3711 releasePage(pLastPg); 3712 if( rc!=SQLITE_OK ){ 3713 return rc; 3714 } 3715 } 3716 } 3717 3718 if( bCommit==0 ){ 3719 do { 3720 iLastPg--; 3721 }while( iLastPg==PENDING_BYTE_PAGE(pBt) || PTRMAP_ISPAGE(pBt, iLastPg) ); 3722 pBt->bDoTruncate = 1; 3723 pBt->nPage = iLastPg; 3724 } 3725 return SQLITE_OK; 3726 } 3727 3728 /* 3729 ** The database opened by the first argument is an auto-vacuum database 3730 ** nOrig pages in size containing nFree free pages. Return the expected 3731 ** size of the database in pages following an auto-vacuum operation. 3732 */ 3733 static Pgno finalDbSize(BtShared *pBt, Pgno nOrig, Pgno nFree){ 3734 int nEntry; /* Number of entries on one ptrmap page */ 3735 Pgno nPtrmap; /* Number of PtrMap pages to be freed */ 3736 Pgno nFin; /* Return value */ 3737 3738 nEntry = pBt->usableSize/5; 3739 nPtrmap = (nFree-nOrig+PTRMAP_PAGENO(pBt, nOrig)+nEntry)/nEntry; 3740 nFin = nOrig - nFree - nPtrmap; 3741 if( nOrig>PENDING_BYTE_PAGE(pBt) && nFin<PENDING_BYTE_PAGE(pBt) ){ 3742 nFin--; 3743 } 3744 while( PTRMAP_ISPAGE(pBt, nFin) || nFin==PENDING_BYTE_PAGE(pBt) ){ 3745 nFin--; 3746 } 3747 3748 return nFin; 3749 } 3750 3751 /* 3752 ** A write-transaction must be opened before calling this function. 3753 ** It performs a single unit of work towards an incremental vacuum. 3754 ** 3755 ** If the incremental vacuum is finished after this function has run, 3756 ** SQLITE_DONE is returned. If it is not finished, but no error occurred, 3757 ** SQLITE_OK is returned. Otherwise an SQLite error code. 3758 */ 3759 int sqlite3BtreeIncrVacuum(Btree *p){ 3760 int rc; 3761 BtShared *pBt = p->pBt; 3762 3763 sqlite3BtreeEnter(p); 3764 assert( pBt->inTransaction==TRANS_WRITE && p->inTrans==TRANS_WRITE ); 3765 if( !pBt->autoVacuum ){ 3766 rc = SQLITE_DONE; 3767 }else{ 3768 Pgno nOrig = btreePagecount(pBt); 3769 Pgno nFree = get4byte(&pBt->pPage1->aData[36]); 3770 Pgno nFin = finalDbSize(pBt, nOrig, nFree); 3771 3772 if( nOrig<nFin ){ 3773 rc = SQLITE_CORRUPT_BKPT; 3774 }else if( nFree>0 ){ 3775 rc = saveAllCursors(pBt, 0, 0); 3776 if( rc==SQLITE_OK ){ 3777 invalidateAllOverflowCache(pBt); 3778 rc = incrVacuumStep(pBt, nFin, nOrig, 0); 3779 } 3780 if( rc==SQLITE_OK ){ 3781 rc = sqlite3PagerWrite(pBt->pPage1->pDbPage); 3782 put4byte(&pBt->pPage1->aData[28], pBt->nPage); 3783 } 3784 }else{ 3785 rc = SQLITE_DONE; 3786 } 3787 } 3788 sqlite3BtreeLeave(p); 3789 return rc; 3790 } 3791 3792 /* 3793 ** This routine is called prior to sqlite3PagerCommit when a transaction 3794 ** is committed for an auto-vacuum database. 3795 ** 3796 ** If SQLITE_OK is returned, then *pnTrunc is set to the number of pages 3797 ** the database file should be truncated to during the commit process. 3798 ** i.e. the database has been reorganized so that only the first *pnTrunc 3799 ** pages are in use. 3800 */ 3801 static int autoVacuumCommit(BtShared *pBt){ 3802 int rc = SQLITE_OK; 3803 Pager *pPager = pBt->pPager; 3804 VVA_ONLY( int nRef = sqlite3PagerRefcount(pPager); ) 3805 3806 assert( sqlite3_mutex_held(pBt->mutex) ); 3807 invalidateAllOverflowCache(pBt); 3808 assert(pBt->autoVacuum); 3809 if( !pBt->incrVacuum ){ 3810 Pgno nFin; /* Number of pages in database after autovacuuming */ 3811 Pgno nFree; /* Number of pages on the freelist initially */ 3812 Pgno iFree; /* The next page to be freed */ 3813 Pgno nOrig; /* Database size before freeing */ 3814 3815 nOrig = btreePagecount(pBt); 3816 if( PTRMAP_ISPAGE(pBt, nOrig) || nOrig==PENDING_BYTE_PAGE(pBt) ){ 3817 /* It is not possible to create a database for which the final page 3818 ** is either a pointer-map page or the pending-byte page. If one 3819 ** is encountered, this indicates corruption. 3820 */ 3821 return SQLITE_CORRUPT_BKPT; 3822 } 3823 3824 nFree = get4byte(&pBt->pPage1->aData[36]); 3825 nFin = finalDbSize(pBt, nOrig, nFree); 3826 if( nFin>nOrig ) return SQLITE_CORRUPT_BKPT; 3827 if( nFin<nOrig ){ 3828 rc = saveAllCursors(pBt, 0, 0); 3829 } 3830 for(iFree=nOrig; iFree>nFin && rc==SQLITE_OK; iFree--){ 3831 rc = incrVacuumStep(pBt, nFin, iFree, 1); 3832 } 3833 if( (rc==SQLITE_DONE || rc==SQLITE_OK) && nFree>0 ){ 3834 rc = sqlite3PagerWrite(pBt->pPage1->pDbPage); 3835 put4byte(&pBt->pPage1->aData[32], 0); 3836 put4byte(&pBt->pPage1->aData[36], 0); 3837 put4byte(&pBt->pPage1->aData[28], nFin); 3838 pBt->bDoTruncate = 1; 3839 pBt->nPage = nFin; 3840 } 3841 if( rc!=SQLITE_OK ){ 3842 sqlite3PagerRollback(pPager); 3843 } 3844 } 3845 3846 assert( nRef>=sqlite3PagerRefcount(pPager) ); 3847 return rc; 3848 } 3849 3850 #else /* ifndef SQLITE_OMIT_AUTOVACUUM */ 3851 # define setChildPtrmaps(x) SQLITE_OK 3852 #endif 3853 3854 /* 3855 ** This routine does the first phase of a two-phase commit. This routine 3856 ** causes a rollback journal to be created (if it does not already exist) 3857 ** and populated with enough information so that if a power loss occurs 3858 ** the database can be restored to its original state by playing back 3859 ** the journal. Then the contents of the journal are flushed out to 3860 ** the disk. After the journal is safely on oxide, the changes to the 3861 ** database are written into the database file and flushed to oxide. 3862 ** At the end of this call, the rollback journal still exists on the 3863 ** disk and we are still holding all locks, so the transaction has not 3864 ** committed. See sqlite3BtreeCommitPhaseTwo() for the second phase of the 3865 ** commit process. 3866 ** 3867 ** This call is a no-op if no write-transaction is currently active on pBt. 3868 ** 3869 ** Otherwise, sync the database file for the btree pBt. zMaster points to 3870 ** the name of a master journal file that should be written into the 3871 ** individual journal file, or is NULL, indicating no master journal file 3872 ** (single database transaction). 3873 ** 3874 ** When this is called, the master journal should already have been 3875 ** created, populated with this journal pointer and synced to disk. 3876 ** 3877 ** Once this is routine has returned, the only thing required to commit 3878 ** the write-transaction for this database file is to delete the journal. 3879 */ 3880 int sqlite3BtreeCommitPhaseOne(Btree *p, const char *zMaster){ 3881 int rc = SQLITE_OK; 3882 if( p->inTrans==TRANS_WRITE ){ 3883 BtShared *pBt = p->pBt; 3884 sqlite3BtreeEnter(p); 3885 #ifndef SQLITE_OMIT_AUTOVACUUM 3886 if( pBt->autoVacuum ){ 3887 rc = autoVacuumCommit(pBt); 3888 if( rc!=SQLITE_OK ){ 3889 sqlite3BtreeLeave(p); 3890 return rc; 3891 } 3892 } 3893 if( pBt->bDoTruncate ){ 3894 sqlite3PagerTruncateImage(pBt->pPager, pBt->nPage); 3895 } 3896 #endif 3897 rc = sqlite3PagerCommitPhaseOne(pBt->pPager, zMaster, 0); 3898 sqlite3BtreeLeave(p); 3899 } 3900 return rc; 3901 } 3902 3903 /* 3904 ** This function is called from both BtreeCommitPhaseTwo() and BtreeRollback() 3905 ** at the conclusion of a transaction. 3906 */ 3907 static void btreeEndTransaction(Btree *p){ 3908 BtShared *pBt = p->pBt; 3909 sqlite3 *db = p->db; 3910 assert( sqlite3BtreeHoldsMutex(p) ); 3911 3912 #ifndef SQLITE_OMIT_AUTOVACUUM 3913 pBt->bDoTruncate = 0; 3914 #endif 3915 if( p->inTrans>TRANS_NONE && db->nVdbeRead>1 ){ 3916 /* If there are other active statements that belong to this database 3917 ** handle, downgrade to a read-only transaction. The other statements 3918 ** may still be reading from the database. */ 3919 downgradeAllSharedCacheTableLocks(p); 3920 p->inTrans = TRANS_READ; 3921 }else{ 3922 /* If the handle had any kind of transaction open, decrement the 3923 ** transaction count of the shared btree. If the transaction count 3924 ** reaches 0, set the shared state to TRANS_NONE. The unlockBtreeIfUnused() 3925 ** call below will unlock the pager. */ 3926 if( p->inTrans!=TRANS_NONE ){ 3927 clearAllSharedCacheTableLocks(p); 3928 pBt->nTransaction--; 3929 if( 0==pBt->nTransaction ){ 3930 pBt->inTransaction = TRANS_NONE; 3931 } 3932 } 3933 3934 /* Set the current transaction state to TRANS_NONE and unlock the 3935 ** pager if this call closed the only read or write transaction. */ 3936 p->inTrans = TRANS_NONE; 3937 unlockBtreeIfUnused(pBt); 3938 } 3939 3940 btreeIntegrity(p); 3941 } 3942 3943 /* 3944 ** Commit the transaction currently in progress. 3945 ** 3946 ** This routine implements the second phase of a 2-phase commit. The 3947 ** sqlite3BtreeCommitPhaseOne() routine does the first phase and should 3948 ** be invoked prior to calling this routine. The sqlite3BtreeCommitPhaseOne() 3949 ** routine did all the work of writing information out to disk and flushing the 3950 ** contents so that they are written onto the disk platter. All this 3951 ** routine has to do is delete or truncate or zero the header in the 3952 ** the rollback journal (which causes the transaction to commit) and 3953 ** drop locks. 3954 ** 3955 ** Normally, if an error occurs while the pager layer is attempting to 3956 ** finalize the underlying journal file, this function returns an error and 3957 ** the upper layer will attempt a rollback. However, if the second argument 3958 ** is non-zero then this b-tree transaction is part of a multi-file 3959 ** transaction. In this case, the transaction has already been committed 3960 ** (by deleting a master journal file) and the caller will ignore this 3961 ** functions return code. So, even if an error occurs in the pager layer, 3962 ** reset the b-tree objects internal state to indicate that the write 3963 ** transaction has been closed. This is quite safe, as the pager will have 3964 ** transitioned to the error state. 3965 ** 3966 ** This will release the write lock on the database file. If there 3967 ** are no active cursors, it also releases the read lock. 3968 */ 3969 int sqlite3BtreeCommitPhaseTwo(Btree *p, int bCleanup){ 3970 3971 if( p->inTrans==TRANS_NONE ) return SQLITE_OK; 3972 sqlite3BtreeEnter(p); 3973 btreeIntegrity(p); 3974 3975 /* If the handle has a write-transaction open, commit the shared-btrees 3976 ** transaction and set the shared state to TRANS_READ. 3977 */ 3978 if( p->inTrans==TRANS_WRITE ){ 3979 int rc; 3980 BtShared *pBt = p->pBt; 3981 assert( pBt->inTransaction==TRANS_WRITE ); 3982 assert( pBt->nTransaction>0 ); 3983 rc = sqlite3PagerCommitPhaseTwo(pBt->pPager); 3984 if( rc!=SQLITE_OK && bCleanup==0 ){ 3985 sqlite3BtreeLeave(p); 3986 return rc; 3987 } 3988 p->iDataVersion--; /* Compensate for pPager->iDataVersion++; */ 3989 pBt->inTransaction = TRANS_READ; 3990 btreeClearHasContent(pBt); 3991 } 3992 3993 btreeEndTransaction(p); 3994 sqlite3BtreeLeave(p); 3995 return SQLITE_OK; 3996 } 3997 3998 /* 3999 ** Do both phases of a commit. 4000 */ 4001 int sqlite3BtreeCommit(Btree *p){ 4002 int rc; 4003 sqlite3BtreeEnter(p); 4004 rc = sqlite3BtreeCommitPhaseOne(p, 0); 4005 if( rc==SQLITE_OK ){ 4006 rc = sqlite3BtreeCommitPhaseTwo(p, 0); 4007 } 4008 sqlite3BtreeLeave(p); 4009 return rc; 4010 } 4011 4012 /* 4013 ** This routine sets the state to CURSOR_FAULT and the error 4014 ** code to errCode for every cursor on any BtShared that pBtree 4015 ** references. Or if the writeOnly flag is set to 1, then only 4016 ** trip write cursors and leave read cursors unchanged. 4017 ** 4018 ** Every cursor is a candidate to be tripped, including cursors 4019 ** that belong to other database connections that happen to be 4020 ** sharing the cache with pBtree. 4021 ** 4022 ** This routine gets called when a rollback occurs. If the writeOnly 4023 ** flag is true, then only write-cursors need be tripped - read-only 4024 ** cursors save their current positions so that they may continue 4025 ** following the rollback. Or, if writeOnly is false, all cursors are 4026 ** tripped. In general, writeOnly is false if the transaction being 4027 ** rolled back modified the database schema. In this case b-tree root 4028 ** pages may be moved or deleted from the database altogether, making 4029 ** it unsafe for read cursors to continue. 4030 ** 4031 ** If the writeOnly flag is true and an error is encountered while 4032 ** saving the current position of a read-only cursor, all cursors, 4033 ** including all read-cursors are tripped. 4034 ** 4035 ** SQLITE_OK is returned if successful, or if an error occurs while 4036 ** saving a cursor position, an SQLite error code. 4037 */ 4038 int sqlite3BtreeTripAllCursors(Btree *pBtree, int errCode, int writeOnly){ 4039 BtCursor *p; 4040 int rc = SQLITE_OK; 4041 4042 assert( (writeOnly==0 || writeOnly==1) && BTCF_WriteFlag==1 ); 4043 if( pBtree ){ 4044 sqlite3BtreeEnter(pBtree); 4045 for(p=pBtree->pBt->pCursor; p; p=p->pNext){ 4046 if( writeOnly && (p->curFlags & BTCF_WriteFlag)==0 ){ 4047 if( p->eState==CURSOR_VALID || p->eState==CURSOR_SKIPNEXT ){ 4048 rc = saveCursorPosition(p); 4049 if( rc!=SQLITE_OK ){ 4050 (void)sqlite3BtreeTripAllCursors(pBtree, rc, 0); 4051 break; 4052 } 4053 } 4054 }else{ 4055 sqlite3BtreeClearCursor(p); 4056 p->eState = CURSOR_FAULT; 4057 p->skipNext = errCode; 4058 } 4059 btreeReleaseAllCursorPages(p); 4060 } 4061 sqlite3BtreeLeave(pBtree); 4062 } 4063 return rc; 4064 } 4065 4066 /* 4067 ** Rollback the transaction in progress. 4068 ** 4069 ** If tripCode is not SQLITE_OK then cursors will be invalidated (tripped). 4070 ** Only write cursors are tripped if writeOnly is true but all cursors are 4071 ** tripped if writeOnly is false. Any attempt to use 4072 ** a tripped cursor will result in an error. 4073 ** 4074 ** This will release the write lock on the database file. If there 4075 ** are no active cursors, it also releases the read lock. 4076 */ 4077 int sqlite3BtreeRollback(Btree *p, int tripCode, int writeOnly){ 4078 int rc; 4079 BtShared *pBt = p->pBt; 4080 MemPage *pPage1; 4081 4082 assert( writeOnly==1 || writeOnly==0 ); 4083 assert( tripCode==SQLITE_ABORT_ROLLBACK || tripCode==SQLITE_OK ); 4084 sqlite3BtreeEnter(p); 4085 if( tripCode==SQLITE_OK ){ 4086 rc = tripCode = saveAllCursors(pBt, 0, 0); 4087 if( rc ) writeOnly = 0; 4088 }else{ 4089 rc = SQLITE_OK; 4090 } 4091 if( tripCode ){ 4092 int rc2 = sqlite3BtreeTripAllCursors(p, tripCode, writeOnly); 4093 assert( rc==SQLITE_OK || (writeOnly==0 && rc2==SQLITE_OK) ); 4094 if( rc2!=SQLITE_OK ) rc = rc2; 4095 } 4096 btreeIntegrity(p); 4097 4098 if( p->inTrans==TRANS_WRITE ){ 4099 int rc2; 4100 4101 assert( TRANS_WRITE==pBt->inTransaction ); 4102 rc2 = sqlite3PagerRollback(pBt->pPager); 4103 if( rc2!=SQLITE_OK ){ 4104 rc = rc2; 4105 } 4106 4107 /* The rollback may have destroyed the pPage1->aData value. So 4108 ** call btreeGetPage() on page 1 again to make 4109 ** sure pPage1->aData is set correctly. */ 4110 if( btreeGetPage(pBt, 1, &pPage1, 0)==SQLITE_OK ){ 4111 int nPage = get4byte(28+(u8*)pPage1->aData); 4112 testcase( nPage==0 ); 4113 if( nPage==0 ) sqlite3PagerPagecount(pBt->pPager, &nPage); 4114 testcase( pBt->nPage!=nPage ); 4115 pBt->nPage = nPage; 4116 releasePageOne(pPage1); 4117 } 4118 assert( countValidCursors(pBt, 1)==0 ); 4119 pBt->inTransaction = TRANS_READ; 4120 btreeClearHasContent(pBt); 4121 } 4122 4123 btreeEndTransaction(p); 4124 sqlite3BtreeLeave(p); 4125 return rc; 4126 } 4127 4128 /* 4129 ** Start a statement subtransaction. The subtransaction can be rolled 4130 ** back independently of the main transaction. You must start a transaction 4131 ** before starting a subtransaction. The subtransaction is ended automatically 4132 ** if the main transaction commits or rolls back. 4133 ** 4134 ** Statement subtransactions are used around individual SQL statements 4135 ** that are contained within a BEGIN...COMMIT block. If a constraint 4136 ** error occurs within the statement, the effect of that one statement 4137 ** can be rolled back without having to rollback the entire transaction. 4138 ** 4139 ** A statement sub-transaction is implemented as an anonymous savepoint. The 4140 ** value passed as the second parameter is the total number of savepoints, 4141 ** including the new anonymous savepoint, open on the B-Tree. i.e. if there 4142 ** are no active savepoints and no other statement-transactions open, 4143 ** iStatement is 1. This anonymous savepoint can be released or rolled back 4144 ** using the sqlite3BtreeSavepoint() function. 4145 */ 4146 int sqlite3BtreeBeginStmt(Btree *p, int iStatement){ 4147 int rc; 4148 BtShared *pBt = p->pBt; 4149 sqlite3BtreeEnter(p); 4150 assert( p->inTrans==TRANS_WRITE ); 4151 assert( (pBt->btsFlags & BTS_READ_ONLY)==0 ); 4152 assert( iStatement>0 ); 4153 assert( iStatement>p->db->nSavepoint ); 4154 assert( pBt->inTransaction==TRANS_WRITE ); 4155 /* At the pager level, a statement transaction is a savepoint with 4156 ** an index greater than all savepoints created explicitly using 4157 ** SQL statements. It is illegal to open, release or rollback any 4158 ** such savepoints while the statement transaction savepoint is active. 4159 */ 4160 rc = sqlite3PagerOpenSavepoint(pBt->pPager, iStatement); 4161 sqlite3BtreeLeave(p); 4162 return rc; 4163 } 4164 4165 /* 4166 ** The second argument to this function, op, is always SAVEPOINT_ROLLBACK 4167 ** or SAVEPOINT_RELEASE. This function either releases or rolls back the 4168 ** savepoint identified by parameter iSavepoint, depending on the value 4169 ** of op. 4170 ** 4171 ** Normally, iSavepoint is greater than or equal to zero. However, if op is 4172 ** SAVEPOINT_ROLLBACK, then iSavepoint may also be -1. In this case the 4173 ** contents of the entire transaction are rolled back. This is different 4174 ** from a normal transaction rollback, as no locks are released and the 4175 ** transaction remains open. 4176 */ 4177 int sqlite3BtreeSavepoint(Btree *p, int op, int iSavepoint){ 4178 int rc = SQLITE_OK; 4179 if( p && p->inTrans==TRANS_WRITE ){ 4180 BtShared *pBt = p->pBt; 4181 assert( op==SAVEPOINT_RELEASE || op==SAVEPOINT_ROLLBACK ); 4182 assert( iSavepoint>=0 || (iSavepoint==-1 && op==SAVEPOINT_ROLLBACK) ); 4183 sqlite3BtreeEnter(p); 4184 if( op==SAVEPOINT_ROLLBACK ){ 4185 rc = saveAllCursors(pBt, 0, 0); 4186 } 4187 if( rc==SQLITE_OK ){ 4188 rc = sqlite3PagerSavepoint(pBt->pPager, op, iSavepoint); 4189 } 4190 if( rc==SQLITE_OK ){ 4191 if( iSavepoint<0 && (pBt->btsFlags & BTS_INITIALLY_EMPTY)!=0 ){ 4192 pBt->nPage = 0; 4193 } 4194 rc = newDatabase(pBt); 4195 pBt->nPage = get4byte(28 + pBt->pPage1->aData); 4196 4197 /* The database size was written into the offset 28 of the header 4198 ** when the transaction started, so we know that the value at offset 4199 ** 28 is nonzero. */ 4200 assert( pBt->nPage>0 ); 4201 } 4202 sqlite3BtreeLeave(p); 4203 } 4204 return rc; 4205 } 4206 4207 /* 4208 ** Create a new cursor for the BTree whose root is on the page 4209 ** iTable. If a read-only cursor is requested, it is assumed that 4210 ** the caller already has at least a read-only transaction open 4211 ** on the database already. If a write-cursor is requested, then 4212 ** the caller is assumed to have an open write transaction. 4213 ** 4214 ** If the BTREE_WRCSR bit of wrFlag is clear, then the cursor can only 4215 ** be used for reading. If the BTREE_WRCSR bit is set, then the cursor 4216 ** can be used for reading or for writing if other conditions for writing 4217 ** are also met. These are the conditions that must be met in order 4218 ** for writing to be allowed: 4219 ** 4220 ** 1: The cursor must have been opened with wrFlag containing BTREE_WRCSR 4221 ** 4222 ** 2: Other database connections that share the same pager cache 4223 ** but which are not in the READ_UNCOMMITTED state may not have 4224 ** cursors open with wrFlag==0 on the same table. Otherwise 4225 ** the changes made by this write cursor would be visible to 4226 ** the read cursors in the other database connection. 4227 ** 4228 ** 3: The database must be writable (not on read-only media) 4229 ** 4230 ** 4: There must be an active transaction. 4231 ** 4232 ** The BTREE_FORDELETE bit of wrFlag may optionally be set if BTREE_WRCSR 4233 ** is set. If FORDELETE is set, that is a hint to the implementation that 4234 ** this cursor will only be used to seek to and delete entries of an index 4235 ** as part of a larger DELETE statement. The FORDELETE hint is not used by 4236 ** this implementation. But in a hypothetical alternative storage engine 4237 ** in which index entries are automatically deleted when corresponding table 4238 ** rows are deleted, the FORDELETE flag is a hint that all SEEK and DELETE 4239 ** operations on this cursor can be no-ops and all READ operations can 4240 ** return a null row (2-bytes: 0x01 0x00). 4241 ** 4242 ** No checking is done to make sure that page iTable really is the 4243 ** root page of a b-tree. If it is not, then the cursor acquired 4244 ** will not work correctly. 4245 ** 4246 ** It is assumed that the sqlite3BtreeCursorZero() has been called 4247 ** on pCur to initialize the memory space prior to invoking this routine. 4248 */ 4249 static int btreeCursor( 4250 Btree *p, /* The btree */ 4251 int iTable, /* Root page of table to open */ 4252 int wrFlag, /* 1 to write. 0 read-only */ 4253 struct KeyInfo *pKeyInfo, /* First arg to comparison function */ 4254 BtCursor *pCur /* Space for new cursor */ 4255 ){ 4256 BtShared *pBt = p->pBt; /* Shared b-tree handle */ 4257 BtCursor *pX; /* Looping over other all cursors */ 4258 4259 assert( sqlite3BtreeHoldsMutex(p) ); 4260 assert( wrFlag==0 4261 || wrFlag==BTREE_WRCSR 4262 || wrFlag==(BTREE_WRCSR|BTREE_FORDELETE) 4263 ); 4264 4265 /* The following assert statements verify that if this is a sharable 4266 ** b-tree database, the connection is holding the required table locks, 4267 ** and that no other connection has any open cursor that conflicts with 4268 ** this lock. */ 4269 assert( hasSharedCacheTableLock(p, iTable, pKeyInfo!=0, (wrFlag?2:1)) ); 4270 assert( wrFlag==0 || !hasReadConflicts(p, iTable) ); 4271 4272 /* Assert that the caller has opened the required transaction. */ 4273 assert( p->inTrans>TRANS_NONE ); 4274 assert( wrFlag==0 || p->inTrans==TRANS_WRITE ); 4275 assert( pBt->pPage1 && pBt->pPage1->aData ); 4276 assert( wrFlag==0 || (pBt->btsFlags & BTS_READ_ONLY)==0 ); 4277 4278 if( wrFlag ){ 4279 allocateTempSpace(pBt); 4280 if( pBt->pTmpSpace==0 ) return SQLITE_NOMEM_BKPT; 4281 } 4282 if( iTable==1 && btreePagecount(pBt)==0 ){ 4283 assert( wrFlag==0 ); 4284 iTable = 0; 4285 } 4286 4287 /* Now that no other errors can occur, finish filling in the BtCursor 4288 ** variables and link the cursor into the BtShared list. */ 4289 pCur->pgnoRoot = (Pgno)iTable; 4290 pCur->iPage = -1; 4291 pCur->pKeyInfo = pKeyInfo; 4292 pCur->pBtree = p; 4293 pCur->pBt = pBt; 4294 pCur->curFlags = wrFlag ? BTCF_WriteFlag : 0; 4295 pCur->curPagerFlags = wrFlag ? 0 : PAGER_GET_READONLY; 4296 /* If there are two or more cursors on the same btree, then all such 4297 ** cursors *must* have the BTCF_Multiple flag set. */ 4298 for(pX=pBt->pCursor; pX; pX=pX->pNext){ 4299 if( pX->pgnoRoot==(Pgno)iTable ){ 4300 pX->curFlags |= BTCF_Multiple; 4301 pCur->curFlags |= BTCF_Multiple; 4302 } 4303 } 4304 pCur->pNext = pBt->pCursor; 4305 pBt->pCursor = pCur; 4306 pCur->eState = CURSOR_INVALID; 4307 return SQLITE_OK; 4308 } 4309 int sqlite3BtreeCursor( 4310 Btree *p, /* The btree */ 4311 int iTable, /* Root page of table to open */ 4312 int wrFlag, /* 1 to write. 0 read-only */ 4313 struct KeyInfo *pKeyInfo, /* First arg to xCompare() */ 4314 BtCursor *pCur /* Write new cursor here */ 4315 ){ 4316 int rc; 4317 if( iTable<1 ){ 4318 rc = SQLITE_CORRUPT_BKPT; 4319 }else{ 4320 sqlite3BtreeEnter(p); 4321 rc = btreeCursor(p, iTable, wrFlag, pKeyInfo, pCur); 4322 sqlite3BtreeLeave(p); 4323 } 4324 return rc; 4325 } 4326 4327 /* 4328 ** Return the size of a BtCursor object in bytes. 4329 ** 4330 ** This interfaces is needed so that users of cursors can preallocate 4331 ** sufficient storage to hold a cursor. The BtCursor object is opaque 4332 ** to users so they cannot do the sizeof() themselves - they must call 4333 ** this routine. 4334 */ 4335 int sqlite3BtreeCursorSize(void){ 4336 return ROUND8(sizeof(BtCursor)); 4337 } 4338 4339 /* 4340 ** Initialize memory that will be converted into a BtCursor object. 4341 ** 4342 ** The simple approach here would be to memset() the entire object 4343 ** to zero. But it turns out that the apPage[] and aiIdx[] arrays 4344 ** do not need to be zeroed and they are large, so we can save a lot 4345 ** of run-time by skipping the initialization of those elements. 4346 */ 4347 void sqlite3BtreeCursorZero(BtCursor *p){ 4348 memset(p, 0, offsetof(BtCursor, BTCURSOR_FIRST_UNINIT)); 4349 } 4350 4351 /* 4352 ** Close a cursor. The read lock on the database file is released 4353 ** when the last cursor is closed. 4354 */ 4355 int sqlite3BtreeCloseCursor(BtCursor *pCur){ 4356 Btree *pBtree = pCur->pBtree; 4357 if( pBtree ){ 4358 BtShared *pBt = pCur->pBt; 4359 sqlite3BtreeEnter(pBtree); 4360 assert( pBt->pCursor!=0 ); 4361 if( pBt->pCursor==pCur ){ 4362 pBt->pCursor = pCur->pNext; 4363 }else{ 4364 BtCursor *pPrev = pBt->pCursor; 4365 do{ 4366 if( pPrev->pNext==pCur ){ 4367 pPrev->pNext = pCur->pNext; 4368 break; 4369 } 4370 pPrev = pPrev->pNext; 4371 }while( ALWAYS(pPrev) ); 4372 } 4373 btreeReleaseAllCursorPages(pCur); 4374 unlockBtreeIfUnused(pBt); 4375 sqlite3_free(pCur->aOverflow); 4376 sqlite3_free(pCur->pKey); 4377 sqlite3BtreeLeave(pBtree); 4378 } 4379 return SQLITE_OK; 4380 } 4381 4382 /* 4383 ** Make sure the BtCursor* given in the argument has a valid 4384 ** BtCursor.info structure. If it is not already valid, call 4385 ** btreeParseCell() to fill it in. 4386 ** 4387 ** BtCursor.info is a cache of the information in the current cell. 4388 ** Using this cache reduces the number of calls to btreeParseCell(). 4389 */ 4390 #ifndef NDEBUG 4391 static int cellInfoEqual(CellInfo *a, CellInfo *b){ 4392 if( a->nKey!=b->nKey ) return 0; 4393 if( a->pPayload!=b->pPayload ) return 0; 4394 if( a->nPayload!=b->nPayload ) return 0; 4395 if( a->nLocal!=b->nLocal ) return 0; 4396 if( a->nSize!=b->nSize ) return 0; 4397 return 1; 4398 } 4399 static void assertCellInfo(BtCursor *pCur){ 4400 CellInfo info; 4401 memset(&info, 0, sizeof(info)); 4402 btreeParseCell(pCur->pPage, pCur->ix, &info); 4403 assert( CORRUPT_DB || cellInfoEqual(&info, &pCur->info) ); 4404 } 4405 #else 4406 #define assertCellInfo(x) 4407 #endif 4408 static SQLITE_NOINLINE void getCellInfo(BtCursor *pCur){ 4409 if( pCur->info.nSize==0 ){ 4410 pCur->curFlags |= BTCF_ValidNKey; 4411 btreeParseCell(pCur->pPage,pCur->ix,&pCur->info); 4412 }else{ 4413 assertCellInfo(pCur); 4414 } 4415 } 4416 4417 #ifndef NDEBUG /* The next routine used only within assert() statements */ 4418 /* 4419 ** Return true if the given BtCursor is valid. A valid cursor is one 4420 ** that is currently pointing to a row in a (non-empty) table. 4421 ** This is a verification routine is used only within assert() statements. 4422 */ 4423 int sqlite3BtreeCursorIsValid(BtCursor *pCur){ 4424 return pCur && pCur->eState==CURSOR_VALID; 4425 } 4426 #endif /* NDEBUG */ 4427 int sqlite3BtreeCursorIsValidNN(BtCursor *pCur){ 4428 assert( pCur!=0 ); 4429 return pCur->eState==CURSOR_VALID; 4430 } 4431 4432 /* 4433 ** Return the value of the integer key or "rowid" for a table btree. 4434 ** This routine is only valid for a cursor that is pointing into a 4435 ** ordinary table btree. If the cursor points to an index btree or 4436 ** is invalid, the result of this routine is undefined. 4437 */ 4438 i64 sqlite3BtreeIntegerKey(BtCursor *pCur){ 4439 assert( cursorHoldsMutex(pCur) ); 4440 assert( pCur->eState==CURSOR_VALID ); 4441 assert( pCur->curIntKey ); 4442 getCellInfo(pCur); 4443 return pCur->info.nKey; 4444 } 4445 4446 #ifdef SQLITE_ENABLE_OFFSET_SQL_FUNC 4447 /* 4448 ** Return the offset into the database file for the start of the 4449 ** payload to which the cursor is pointing. 4450 */ 4451 i64 sqlite3BtreeOffset(BtCursor *pCur){ 4452 assert( cursorHoldsMutex(pCur) ); 4453 assert( pCur->eState==CURSOR_VALID ); 4454 getCellInfo(pCur); 4455 return (i64)pCur->pBt->pageSize*((i64)pCur->pPage->pgno - 1) + 4456 (i64)(pCur->info.pPayload - pCur->pPage->aData); 4457 } 4458 #endif /* SQLITE_ENABLE_OFFSET_SQL_FUNC */ 4459 4460 /* 4461 ** Return the number of bytes of payload for the entry that pCur is 4462 ** currently pointing to. For table btrees, this will be the amount 4463 ** of data. For index btrees, this will be the size of the key. 4464 ** 4465 ** The caller must guarantee that the cursor is pointing to a non-NULL 4466 ** valid entry. In other words, the calling procedure must guarantee 4467 ** that the cursor has Cursor.eState==CURSOR_VALID. 4468 */ 4469 u32 sqlite3BtreePayloadSize(BtCursor *pCur){ 4470 assert( cursorHoldsMutex(pCur) ); 4471 assert( pCur->eState==CURSOR_VALID ); 4472 getCellInfo(pCur); 4473 return pCur->info.nPayload; 4474 } 4475 4476 /* 4477 ** Given the page number of an overflow page in the database (parameter 4478 ** ovfl), this function finds the page number of the next page in the 4479 ** linked list of overflow pages. If possible, it uses the auto-vacuum 4480 ** pointer-map data instead of reading the content of page ovfl to do so. 4481 ** 4482 ** If an error occurs an SQLite error code is returned. Otherwise: 4483 ** 4484 ** The page number of the next overflow page in the linked list is 4485 ** written to *pPgnoNext. If page ovfl is the last page in its linked 4486 ** list, *pPgnoNext is set to zero. 4487 ** 4488 ** If ppPage is not NULL, and a reference to the MemPage object corresponding 4489 ** to page number pOvfl was obtained, then *ppPage is set to point to that 4490 ** reference. It is the responsibility of the caller to call releasePage() 4491 ** on *ppPage to free the reference. In no reference was obtained (because 4492 ** the pointer-map was used to obtain the value for *pPgnoNext), then 4493 ** *ppPage is set to zero. 4494 */ 4495 static int getOverflowPage( 4496 BtShared *pBt, /* The database file */ 4497 Pgno ovfl, /* Current overflow page number */ 4498 MemPage **ppPage, /* OUT: MemPage handle (may be NULL) */ 4499 Pgno *pPgnoNext /* OUT: Next overflow page number */ 4500 ){ 4501 Pgno next = 0; 4502 MemPage *pPage = 0; 4503 int rc = SQLITE_OK; 4504 4505 assert( sqlite3_mutex_held(pBt->mutex) ); 4506 assert(pPgnoNext); 4507 4508 #ifndef SQLITE_OMIT_AUTOVACUUM 4509 /* Try to find the next page in the overflow list using the 4510 ** autovacuum pointer-map pages. Guess that the next page in 4511 ** the overflow list is page number (ovfl+1). If that guess turns 4512 ** out to be wrong, fall back to loading the data of page 4513 ** number ovfl to determine the next page number. 4514 */ 4515 if( pBt->autoVacuum ){ 4516 Pgno pgno; 4517 Pgno iGuess = ovfl+1; 4518 u8 eType; 4519 4520 while( PTRMAP_ISPAGE(pBt, iGuess) || iGuess==PENDING_BYTE_PAGE(pBt) ){ 4521 iGuess++; 4522 } 4523 4524 if( iGuess<=btreePagecount(pBt) ){ 4525 rc = ptrmapGet(pBt, iGuess, &eType, &pgno); 4526 if( rc==SQLITE_OK && eType==PTRMAP_OVERFLOW2 && pgno==ovfl ){ 4527 next = iGuess; 4528 rc = SQLITE_DONE; 4529 } 4530 } 4531 } 4532 #endif 4533 4534 assert( next==0 || rc==SQLITE_DONE ); 4535 if( rc==SQLITE_OK ){ 4536 rc = btreeGetPage(pBt, ovfl, &pPage, (ppPage==0) ? PAGER_GET_READONLY : 0); 4537 assert( rc==SQLITE_OK || pPage==0 ); 4538 if( rc==SQLITE_OK ){ 4539 next = get4byte(pPage->aData); 4540 } 4541 } 4542 4543 *pPgnoNext = next; 4544 if( ppPage ){ 4545 *ppPage = pPage; 4546 }else{ 4547 releasePage(pPage); 4548 } 4549 return (rc==SQLITE_DONE ? SQLITE_OK : rc); 4550 } 4551 4552 /* 4553 ** Copy data from a buffer to a page, or from a page to a buffer. 4554 ** 4555 ** pPayload is a pointer to data stored on database page pDbPage. 4556 ** If argument eOp is false, then nByte bytes of data are copied 4557 ** from pPayload to the buffer pointed at by pBuf. If eOp is true, 4558 ** then sqlite3PagerWrite() is called on pDbPage and nByte bytes 4559 ** of data are copied from the buffer pBuf to pPayload. 4560 ** 4561 ** SQLITE_OK is returned on success, otherwise an error code. 4562 */ 4563 static int copyPayload( 4564 void *pPayload, /* Pointer to page data */ 4565 void *pBuf, /* Pointer to buffer */ 4566 int nByte, /* Number of bytes to copy */ 4567 int eOp, /* 0 -> copy from page, 1 -> copy to page */ 4568 DbPage *pDbPage /* Page containing pPayload */ 4569 ){ 4570 if( eOp ){ 4571 /* Copy data from buffer to page (a write operation) */ 4572 int rc = sqlite3PagerWrite(pDbPage); 4573 if( rc!=SQLITE_OK ){ 4574 return rc; 4575 } 4576 memcpy(pPayload, pBuf, nByte); 4577 }else{ 4578 /* Copy data from page to buffer (a read operation) */ 4579 memcpy(pBuf, pPayload, nByte); 4580 } 4581 return SQLITE_OK; 4582 } 4583 4584 /* 4585 ** This function is used to read or overwrite payload information 4586 ** for the entry that the pCur cursor is pointing to. The eOp 4587 ** argument is interpreted as follows: 4588 ** 4589 ** 0: The operation is a read. Populate the overflow cache. 4590 ** 1: The operation is a write. Populate the overflow cache. 4591 ** 4592 ** A total of "amt" bytes are read or written beginning at "offset". 4593 ** Data is read to or from the buffer pBuf. 4594 ** 4595 ** The content being read or written might appear on the main page 4596 ** or be scattered out on multiple overflow pages. 4597 ** 4598 ** If the current cursor entry uses one or more overflow pages 4599 ** this function may allocate space for and lazily populate 4600 ** the overflow page-list cache array (BtCursor.aOverflow). 4601 ** Subsequent calls use this cache to make seeking to the supplied offset 4602 ** more efficient. 4603 ** 4604 ** Once an overflow page-list cache has been allocated, it must be 4605 ** invalidated if some other cursor writes to the same table, or if 4606 ** the cursor is moved to a different row. Additionally, in auto-vacuum 4607 ** mode, the following events may invalidate an overflow page-list cache. 4608 ** 4609 ** * An incremental vacuum, 4610 ** * A commit in auto_vacuum="full" mode, 4611 ** * Creating a table (may require moving an overflow page). 4612 */ 4613 static int accessPayload( 4614 BtCursor *pCur, /* Cursor pointing to entry to read from */ 4615 u32 offset, /* Begin reading this far into payload */ 4616 u32 amt, /* Read this many bytes */ 4617 unsigned char *pBuf, /* Write the bytes into this buffer */ 4618 int eOp /* zero to read. non-zero to write. */ 4619 ){ 4620 unsigned char *aPayload; 4621 int rc = SQLITE_OK; 4622 int iIdx = 0; 4623 MemPage *pPage = pCur->pPage; /* Btree page of current entry */ 4624 BtShared *pBt = pCur->pBt; /* Btree this cursor belongs to */ 4625 #ifdef SQLITE_DIRECT_OVERFLOW_READ 4626 unsigned char * const pBufStart = pBuf; /* Start of original out buffer */ 4627 #endif 4628 4629 assert( pPage ); 4630 assert( eOp==0 || eOp==1 ); 4631 assert( pCur->eState==CURSOR_VALID ); 4632 assert( pCur->ix<pPage->nCell ); 4633 assert( cursorHoldsMutex(pCur) ); 4634 4635 getCellInfo(pCur); 4636 aPayload = pCur->info.pPayload; 4637 assert( offset+amt <= pCur->info.nPayload ); 4638 4639 assert( aPayload > pPage->aData ); 4640 if( (uptr)(aPayload - pPage->aData) > (pBt->usableSize - pCur->info.nLocal) ){ 4641 /* Trying to read or write past the end of the data is an error. The 4642 ** conditional above is really: 4643 ** &aPayload[pCur->info.nLocal] > &pPage->aData[pBt->usableSize] 4644 ** but is recast into its current form to avoid integer overflow problems 4645 */ 4646 return SQLITE_CORRUPT_PAGE(pPage); 4647 } 4648 4649 /* Check if data must be read/written to/from the btree page itself. */ 4650 if( offset<pCur->info.nLocal ){ 4651 int a = amt; 4652 if( a+offset>pCur->info.nLocal ){ 4653 a = pCur->info.nLocal - offset; 4654 } 4655 rc = copyPayload(&aPayload[offset], pBuf, a, eOp, pPage->pDbPage); 4656 offset = 0; 4657 pBuf += a; 4658 amt -= a; 4659 }else{ 4660 offset -= pCur->info.nLocal; 4661 } 4662 4663 4664 if( rc==SQLITE_OK && amt>0 ){ 4665 const u32 ovflSize = pBt->usableSize - 4; /* Bytes content per ovfl page */ 4666 Pgno nextPage; 4667 4668 nextPage = get4byte(&aPayload[pCur->info.nLocal]); 4669 4670 /* If the BtCursor.aOverflow[] has not been allocated, allocate it now. 4671 ** 4672 ** The aOverflow[] array is sized at one entry for each overflow page 4673 ** in the overflow chain. The page number of the first overflow page is 4674 ** stored in aOverflow[0], etc. A value of 0 in the aOverflow[] array 4675 ** means "not yet known" (the cache is lazily populated). 4676 */ 4677 if( (pCur->curFlags & BTCF_ValidOvfl)==0 ){ 4678 int nOvfl = (pCur->info.nPayload-pCur->info.nLocal+ovflSize-1)/ovflSize; 4679 if( pCur->aOverflow==0 4680 || nOvfl*(int)sizeof(Pgno) > sqlite3MallocSize(pCur->aOverflow) 4681 ){ 4682 Pgno *aNew = (Pgno*)sqlite3Realloc( 4683 pCur->aOverflow, nOvfl*2*sizeof(Pgno) 4684 ); 4685 if( aNew==0 ){ 4686 return SQLITE_NOMEM_BKPT; 4687 }else{ 4688 pCur->aOverflow = aNew; 4689 } 4690 } 4691 memset(pCur->aOverflow, 0, nOvfl*sizeof(Pgno)); 4692 pCur->curFlags |= BTCF_ValidOvfl; 4693 }else{ 4694 /* If the overflow page-list cache has been allocated and the 4695 ** entry for the first required overflow page is valid, skip 4696 ** directly to it. 4697 */ 4698 if( pCur->aOverflow[offset/ovflSize] ){ 4699 iIdx = (offset/ovflSize); 4700 nextPage = pCur->aOverflow[iIdx]; 4701 offset = (offset%ovflSize); 4702 } 4703 } 4704 4705 assert( rc==SQLITE_OK && amt>0 ); 4706 while( nextPage ){ 4707 /* If required, populate the overflow page-list cache. */ 4708 assert( pCur->aOverflow[iIdx]==0 4709 || pCur->aOverflow[iIdx]==nextPage 4710 || CORRUPT_DB ); 4711 pCur->aOverflow[iIdx] = nextPage; 4712 4713 if( offset>=ovflSize ){ 4714 /* The only reason to read this page is to obtain the page 4715 ** number for the next page in the overflow chain. The page 4716 ** data is not required. So first try to lookup the overflow 4717 ** page-list cache, if any, then fall back to the getOverflowPage() 4718 ** function. 4719 */ 4720 assert( pCur->curFlags & BTCF_ValidOvfl ); 4721 assert( pCur->pBtree->db==pBt->db ); 4722 if( pCur->aOverflow[iIdx+1] ){ 4723 nextPage = pCur->aOverflow[iIdx+1]; 4724 }else{ 4725 rc = getOverflowPage(pBt, nextPage, 0, &nextPage); 4726 } 4727 offset -= ovflSize; 4728 }else{ 4729 /* Need to read this page properly. It contains some of the 4730 ** range of data that is being read (eOp==0) or written (eOp!=0). 4731 */ 4732 #ifdef SQLITE_DIRECT_OVERFLOW_READ 4733 sqlite3_file *fd; /* File from which to do direct overflow read */ 4734 #endif 4735 int a = amt; 4736 if( a + offset > ovflSize ){ 4737 a = ovflSize - offset; 4738 } 4739 4740 #ifdef SQLITE_DIRECT_OVERFLOW_READ 4741 /* If all the following are true: 4742 ** 4743 ** 1) this is a read operation, and 4744 ** 2) data is required from the start of this overflow page, and 4745 ** 3) there is no open write-transaction, and 4746 ** 4) the database is file-backed, and 4747 ** 5) the page is not in the WAL file 4748 ** 6) at least 4 bytes have already been read into the output buffer 4749 ** 4750 ** then data can be read directly from the database file into the 4751 ** output buffer, bypassing the page-cache altogether. This speeds 4752 ** up loading large records that span many overflow pages. 4753 */ 4754 if( eOp==0 /* (1) */ 4755 && offset==0 /* (2) */ 4756 && pBt->inTransaction==TRANS_READ /* (3) */ 4757 && (fd = sqlite3PagerFile(pBt->pPager))->pMethods /* (4) */ 4758 && 0==sqlite3PagerUseWal(pBt->pPager, nextPage) /* (5) */ 4759 && &pBuf[-4]>=pBufStart /* (6) */ 4760 ){ 4761 u8 aSave[4]; 4762 u8 *aWrite = &pBuf[-4]; 4763 assert( aWrite>=pBufStart ); /* due to (6) */ 4764 memcpy(aSave, aWrite, 4); 4765 rc = sqlite3OsRead(fd, aWrite, a+4, (i64)pBt->pageSize*(nextPage-1)); 4766 nextPage = get4byte(aWrite); 4767 memcpy(aWrite, aSave, 4); 4768 }else 4769 #endif 4770 4771 { 4772 DbPage *pDbPage; 4773 rc = sqlite3PagerGet(pBt->pPager, nextPage, &pDbPage, 4774 (eOp==0 ? PAGER_GET_READONLY : 0) 4775 ); 4776 if( rc==SQLITE_OK ){ 4777 aPayload = sqlite3PagerGetData(pDbPage); 4778 nextPage = get4byte(aPayload); 4779 rc = copyPayload(&aPayload[offset+4], pBuf, a, eOp, pDbPage); 4780 sqlite3PagerUnref(pDbPage); 4781 offset = 0; 4782 } 4783 } 4784 amt -= a; 4785 if( amt==0 ) return rc; 4786 pBuf += a; 4787 } 4788 if( rc ) break; 4789 iIdx++; 4790 } 4791 } 4792 4793 if( rc==SQLITE_OK && amt>0 ){ 4794 /* Overflow chain ends prematurely */ 4795 return SQLITE_CORRUPT_PAGE(pPage); 4796 } 4797 return rc; 4798 } 4799 4800 /* 4801 ** Read part of the payload for the row at which that cursor pCur is currently 4802 ** pointing. "amt" bytes will be transferred into pBuf[]. The transfer 4803 ** begins at "offset". 4804 ** 4805 ** pCur can be pointing to either a table or an index b-tree. 4806 ** If pointing to a table btree, then the content section is read. If 4807 ** pCur is pointing to an index b-tree then the key section is read. 4808 ** 4809 ** For sqlite3BtreePayload(), the caller must ensure that pCur is pointing 4810 ** to a valid row in the table. For sqlite3BtreePayloadChecked(), the 4811 ** cursor might be invalid or might need to be restored before being read. 4812 ** 4813 ** Return SQLITE_OK on success or an error code if anything goes 4814 ** wrong. An error is returned if "offset+amt" is larger than 4815 ** the available payload. 4816 */ 4817 int sqlite3BtreePayload(BtCursor *pCur, u32 offset, u32 amt, void *pBuf){ 4818 assert( cursorHoldsMutex(pCur) ); 4819 assert( pCur->eState==CURSOR_VALID ); 4820 assert( pCur->iPage>=0 && pCur->pPage ); 4821 assert( pCur->ix<pCur->pPage->nCell ); 4822 return accessPayload(pCur, offset, amt, (unsigned char*)pBuf, 0); 4823 } 4824 4825 /* 4826 ** This variant of sqlite3BtreePayload() works even if the cursor has not 4827 ** in the CURSOR_VALID state. It is only used by the sqlite3_blob_read() 4828 ** interface. 4829 */ 4830 #ifndef SQLITE_OMIT_INCRBLOB 4831 static SQLITE_NOINLINE int accessPayloadChecked( 4832 BtCursor *pCur, 4833 u32 offset, 4834 u32 amt, 4835 void *pBuf 4836 ){ 4837 int rc; 4838 if ( pCur->eState==CURSOR_INVALID ){ 4839 return SQLITE_ABORT; 4840 } 4841 assert( cursorOwnsBtShared(pCur) ); 4842 rc = btreeRestoreCursorPosition(pCur); 4843 return rc ? rc : accessPayload(pCur, offset, amt, pBuf, 0); 4844 } 4845 int sqlite3BtreePayloadChecked(BtCursor *pCur, u32 offset, u32 amt, void *pBuf){ 4846 if( pCur->eState==CURSOR_VALID ){ 4847 assert( cursorOwnsBtShared(pCur) ); 4848 return accessPayload(pCur, offset, amt, pBuf, 0); 4849 }else{ 4850 return accessPayloadChecked(pCur, offset, amt, pBuf); 4851 } 4852 } 4853 #endif /* SQLITE_OMIT_INCRBLOB */ 4854 4855 /* 4856 ** Return a pointer to payload information from the entry that the 4857 ** pCur cursor is pointing to. The pointer is to the beginning of 4858 ** the key if index btrees (pPage->intKey==0) and is the data for 4859 ** table btrees (pPage->intKey==1). The number of bytes of available 4860 ** key/data is written into *pAmt. If *pAmt==0, then the value 4861 ** returned will not be a valid pointer. 4862 ** 4863 ** This routine is an optimization. It is common for the entire key 4864 ** and data to fit on the local page and for there to be no overflow 4865 ** pages. When that is so, this routine can be used to access the 4866 ** key and data without making a copy. If the key and/or data spills 4867 ** onto overflow pages, then accessPayload() must be used to reassemble 4868 ** the key/data and copy it into a preallocated buffer. 4869 ** 4870 ** The pointer returned by this routine looks directly into the cached 4871 ** page of the database. The data might change or move the next time 4872 ** any btree routine is called. 4873 */ 4874 static const void *fetchPayload( 4875 BtCursor *pCur, /* Cursor pointing to entry to read from */ 4876 u32 *pAmt /* Write the number of available bytes here */ 4877 ){ 4878 int amt; 4879 assert( pCur!=0 && pCur->iPage>=0 && pCur->pPage); 4880 assert( pCur->eState==CURSOR_VALID ); 4881 assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) ); 4882 assert( cursorOwnsBtShared(pCur) ); 4883 assert( pCur->ix<pCur->pPage->nCell ); 4884 assert( pCur->info.nSize>0 ); 4885 assert( pCur->info.pPayload>pCur->pPage->aData || CORRUPT_DB ); 4886 assert( pCur->info.pPayload<pCur->pPage->aDataEnd ||CORRUPT_DB); 4887 amt = pCur->info.nLocal; 4888 if( amt>(int)(pCur->pPage->aDataEnd - pCur->info.pPayload) ){ 4889 /* There is too little space on the page for the expected amount 4890 ** of local content. Database must be corrupt. */ 4891 assert( CORRUPT_DB ); 4892 amt = MAX(0, (int)(pCur->pPage->aDataEnd - pCur->info.pPayload)); 4893 } 4894 *pAmt = (u32)amt; 4895 return (void*)pCur->info.pPayload; 4896 } 4897 4898 4899 /* 4900 ** For the entry that cursor pCur is point to, return as 4901 ** many bytes of the key or data as are available on the local 4902 ** b-tree page. Write the number of available bytes into *pAmt. 4903 ** 4904 ** The pointer returned is ephemeral. The key/data may move 4905 ** or be destroyed on the next call to any Btree routine, 4906 ** including calls from other threads against the same cache. 4907 ** Hence, a mutex on the BtShared should be held prior to calling 4908 ** this routine. 4909 ** 4910 ** These routines is used to get quick access to key and data 4911 ** in the common case where no overflow pages are used. 4912 */ 4913 const void *sqlite3BtreePayloadFetch(BtCursor *pCur, u32 *pAmt){ 4914 return fetchPayload(pCur, pAmt); 4915 } 4916 4917 4918 /* 4919 ** Move the cursor down to a new child page. The newPgno argument is the 4920 ** page number of the child page to move to. 4921 ** 4922 ** This function returns SQLITE_CORRUPT if the page-header flags field of 4923 ** the new child page does not match the flags field of the parent (i.e. 4924 ** if an intkey page appears to be the parent of a non-intkey page, or 4925 ** vice-versa). 4926 */ 4927 static int moveToChild(BtCursor *pCur, u32 newPgno){ 4928 BtShared *pBt = pCur->pBt; 4929 4930 assert( cursorOwnsBtShared(pCur) ); 4931 assert( pCur->eState==CURSOR_VALID ); 4932 assert( pCur->iPage<BTCURSOR_MAX_DEPTH ); 4933 assert( pCur->iPage>=0 ); 4934 if( pCur->iPage>=(BTCURSOR_MAX_DEPTH-1) ){ 4935 return SQLITE_CORRUPT_BKPT; 4936 } 4937 pCur->info.nSize = 0; 4938 pCur->curFlags &= ~(BTCF_ValidNKey|BTCF_ValidOvfl); 4939 pCur->aiIdx[pCur->iPage] = pCur->ix; 4940 pCur->apPage[pCur->iPage] = pCur->pPage; 4941 pCur->ix = 0; 4942 pCur->iPage++; 4943 return getAndInitPage(pBt, newPgno, &pCur->pPage, pCur, pCur->curPagerFlags); 4944 } 4945 4946 #ifdef SQLITE_DEBUG 4947 /* 4948 ** Page pParent is an internal (non-leaf) tree page. This function 4949 ** asserts that page number iChild is the left-child if the iIdx'th 4950 ** cell in page pParent. Or, if iIdx is equal to the total number of 4951 ** cells in pParent, that page number iChild is the right-child of 4952 ** the page. 4953 */ 4954 static void assertParentIndex(MemPage *pParent, int iIdx, Pgno iChild){ 4955 if( CORRUPT_DB ) return; /* The conditions tested below might not be true 4956 ** in a corrupt database */ 4957 assert( iIdx<=pParent->nCell ); 4958 if( iIdx==pParent->nCell ){ 4959 assert( get4byte(&pParent->aData[pParent->hdrOffset+8])==iChild ); 4960 }else{ 4961 assert( get4byte(findCell(pParent, iIdx))==iChild ); 4962 } 4963 } 4964 #else 4965 # define assertParentIndex(x,y,z) 4966 #endif 4967 4968 /* 4969 ** Move the cursor up to the parent page. 4970 ** 4971 ** pCur->idx is set to the cell index that contains the pointer 4972 ** to the page we are coming from. If we are coming from the 4973 ** right-most child page then pCur->idx is set to one more than 4974 ** the largest cell index. 4975 */ 4976 static void moveToParent(BtCursor *pCur){ 4977 MemPage *pLeaf; 4978 assert( cursorOwnsBtShared(pCur) ); 4979 assert( pCur->eState==CURSOR_VALID ); 4980 assert( pCur->iPage>0 ); 4981 assert( pCur->pPage ); 4982 assertParentIndex( 4983 pCur->apPage[pCur->iPage-1], 4984 pCur->aiIdx[pCur->iPage-1], 4985 pCur->pPage->pgno 4986 ); 4987 testcase( pCur->aiIdx[pCur->iPage-1] > pCur->apPage[pCur->iPage-1]->nCell ); 4988 pCur->info.nSize = 0; 4989 pCur->curFlags &= ~(BTCF_ValidNKey|BTCF_ValidOvfl); 4990 pCur->ix = pCur->aiIdx[pCur->iPage-1]; 4991 pLeaf = pCur->pPage; 4992 pCur->pPage = pCur->apPage[--pCur->iPage]; 4993 releasePageNotNull(pLeaf); 4994 } 4995 4996 /* 4997 ** Move the cursor to point to the root page of its b-tree structure. 4998 ** 4999 ** If the table has a virtual root page, then the cursor is moved to point 5000 ** to the virtual root page instead of the actual root page. A table has a 5001 ** virtual root page when the actual root page contains no cells and a 5002 ** single child page. This can only happen with the table rooted at page 1. 5003 ** 5004 ** If the b-tree structure is empty, the cursor state is set to 5005 ** CURSOR_INVALID and this routine returns SQLITE_EMPTY. Otherwise, 5006 ** the cursor is set to point to the first cell located on the root 5007 ** (or virtual root) page and the cursor state is set to CURSOR_VALID. 5008 ** 5009 ** If this function returns successfully, it may be assumed that the 5010 ** page-header flags indicate that the [virtual] root-page is the expected 5011 ** kind of b-tree page (i.e. if when opening the cursor the caller did not 5012 ** specify a KeyInfo structure the flags byte is set to 0x05 or 0x0D, 5013 ** indicating a table b-tree, or if the caller did specify a KeyInfo 5014 ** structure the flags byte is set to 0x02 or 0x0A, indicating an index 5015 ** b-tree). 5016 */ 5017 static int moveToRoot(BtCursor *pCur){ 5018 MemPage *pRoot; 5019 int rc = SQLITE_OK; 5020 5021 assert( cursorOwnsBtShared(pCur) ); 5022 assert( CURSOR_INVALID < CURSOR_REQUIRESEEK ); 5023 assert( CURSOR_VALID < CURSOR_REQUIRESEEK ); 5024 assert( CURSOR_FAULT > CURSOR_REQUIRESEEK ); 5025 assert( pCur->eState < CURSOR_REQUIRESEEK || pCur->iPage<0 ); 5026 assert( pCur->pgnoRoot>0 || pCur->iPage<0 ); 5027 5028 if( pCur->iPage>=0 ){ 5029 if( pCur->iPage ){ 5030 releasePageNotNull(pCur->pPage); 5031 while( --pCur->iPage ){ 5032 releasePageNotNull(pCur->apPage[pCur->iPage]); 5033 } 5034 pCur->pPage = pCur->apPage[0]; 5035 goto skip_init; 5036 } 5037 }else if( pCur->pgnoRoot==0 ){ 5038 pCur->eState = CURSOR_INVALID; 5039 return SQLITE_EMPTY; 5040 }else{ 5041 assert( pCur->iPage==(-1) ); 5042 if( pCur->eState>=CURSOR_REQUIRESEEK ){ 5043 if( pCur->eState==CURSOR_FAULT ){ 5044 assert( pCur->skipNext!=SQLITE_OK ); 5045 return pCur->skipNext; 5046 } 5047 sqlite3BtreeClearCursor(pCur); 5048 } 5049 rc = getAndInitPage(pCur->pBtree->pBt, pCur->pgnoRoot, &pCur->pPage, 5050 0, pCur->curPagerFlags); 5051 if( rc!=SQLITE_OK ){ 5052 pCur->eState = CURSOR_INVALID; 5053 return rc; 5054 } 5055 pCur->iPage = 0; 5056 pCur->curIntKey = pCur->pPage->intKey; 5057 } 5058 pRoot = pCur->pPage; 5059 assert( pRoot->pgno==pCur->pgnoRoot ); 5060 5061 /* If pCur->pKeyInfo is not NULL, then the caller that opened this cursor 5062 ** expected to open it on an index b-tree. Otherwise, if pKeyInfo is 5063 ** NULL, the caller expects a table b-tree. If this is not the case, 5064 ** return an SQLITE_CORRUPT error. 5065 ** 5066 ** Earlier versions of SQLite assumed that this test could not fail 5067 ** if the root page was already loaded when this function was called (i.e. 5068 ** if pCur->iPage>=0). But this is not so if the database is corrupted 5069 ** in such a way that page pRoot is linked into a second b-tree table 5070 ** (or the freelist). */ 5071 assert( pRoot->intKey==1 || pRoot->intKey==0 ); 5072 if( pRoot->isInit==0 || (pCur->pKeyInfo==0)!=pRoot->intKey ){ 5073 return SQLITE_CORRUPT_PAGE(pCur->pPage); 5074 } 5075 5076 skip_init: 5077 pCur->ix = 0; 5078 pCur->info.nSize = 0; 5079 pCur->curFlags &= ~(BTCF_AtLast|BTCF_ValidNKey|BTCF_ValidOvfl); 5080 5081 pRoot = pCur->pPage; 5082 if( pRoot->nCell>0 ){ 5083 pCur->eState = CURSOR_VALID; 5084 }else if( !pRoot->leaf ){ 5085 Pgno subpage; 5086 if( pRoot->pgno!=1 ) return SQLITE_CORRUPT_BKPT; 5087 subpage = get4byte(&pRoot->aData[pRoot->hdrOffset+8]); 5088 pCur->eState = CURSOR_VALID; 5089 rc = moveToChild(pCur, subpage); 5090 }else{ 5091 pCur->eState = CURSOR_INVALID; 5092 rc = SQLITE_EMPTY; 5093 } 5094 return rc; 5095 } 5096 5097 /* 5098 ** Move the cursor down to the left-most leaf entry beneath the 5099 ** entry to which it is currently pointing. 5100 ** 5101 ** The left-most leaf is the one with the smallest key - the first 5102 ** in ascending order. 5103 */ 5104 static int moveToLeftmost(BtCursor *pCur){ 5105 Pgno pgno; 5106 int rc = SQLITE_OK; 5107 MemPage *pPage; 5108 5109 assert( cursorOwnsBtShared(pCur) ); 5110 assert( pCur->eState==CURSOR_VALID ); 5111 while( rc==SQLITE_OK && !(pPage = pCur->pPage)->leaf ){ 5112 assert( pCur->ix<pPage->nCell ); 5113 pgno = get4byte(findCell(pPage, pCur->ix)); 5114 rc = moveToChild(pCur, pgno); 5115 } 5116 return rc; 5117 } 5118 5119 /* 5120 ** Move the cursor down to the right-most leaf entry beneath the 5121 ** page to which it is currently pointing. Notice the difference 5122 ** between moveToLeftmost() and moveToRightmost(). moveToLeftmost() 5123 ** finds the left-most entry beneath the *entry* whereas moveToRightmost() 5124 ** finds the right-most entry beneath the *page*. 5125 ** 5126 ** The right-most entry is the one with the largest key - the last 5127 ** key in ascending order. 5128 */ 5129 static int moveToRightmost(BtCursor *pCur){ 5130 Pgno pgno; 5131 int rc = SQLITE_OK; 5132 MemPage *pPage = 0; 5133 5134 assert( cursorOwnsBtShared(pCur) ); 5135 assert( pCur->eState==CURSOR_VALID ); 5136 while( !(pPage = pCur->pPage)->leaf ){ 5137 pgno = get4byte(&pPage->aData[pPage->hdrOffset+8]); 5138 pCur->ix = pPage->nCell; 5139 rc = moveToChild(pCur, pgno); 5140 if( rc ) return rc; 5141 } 5142 pCur->ix = pPage->nCell-1; 5143 assert( pCur->info.nSize==0 ); 5144 assert( (pCur->curFlags & BTCF_ValidNKey)==0 ); 5145 return SQLITE_OK; 5146 } 5147 5148 /* Move the cursor to the first entry in the table. Return SQLITE_OK 5149 ** on success. Set *pRes to 0 if the cursor actually points to something 5150 ** or set *pRes to 1 if the table is empty. 5151 */ 5152 int sqlite3BtreeFirst(BtCursor *pCur, int *pRes){ 5153 int rc; 5154 5155 assert( cursorOwnsBtShared(pCur) ); 5156 assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) ); 5157 rc = moveToRoot(pCur); 5158 if( rc==SQLITE_OK ){ 5159 assert( pCur->pPage->nCell>0 ); 5160 *pRes = 0; 5161 rc = moveToLeftmost(pCur); 5162 }else if( rc==SQLITE_EMPTY ){ 5163 assert( pCur->pgnoRoot==0 || pCur->pPage->nCell==0 ); 5164 *pRes = 1; 5165 rc = SQLITE_OK; 5166 } 5167 return rc; 5168 } 5169 5170 /* Move the cursor to the last entry in the table. Return SQLITE_OK 5171 ** on success. Set *pRes to 0 if the cursor actually points to something 5172 ** or set *pRes to 1 if the table is empty. 5173 */ 5174 int sqlite3BtreeLast(BtCursor *pCur, int *pRes){ 5175 int rc; 5176 5177 assert( cursorOwnsBtShared(pCur) ); 5178 assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) ); 5179 5180 /* If the cursor already points to the last entry, this is a no-op. */ 5181 if( CURSOR_VALID==pCur->eState && (pCur->curFlags & BTCF_AtLast)!=0 ){ 5182 #ifdef SQLITE_DEBUG 5183 /* This block serves to assert() that the cursor really does point 5184 ** to the last entry in the b-tree. */ 5185 int ii; 5186 for(ii=0; ii<pCur->iPage; ii++){ 5187 assert( pCur->aiIdx[ii]==pCur->apPage[ii]->nCell ); 5188 } 5189 assert( pCur->ix==pCur->pPage->nCell-1 ); 5190 assert( pCur->pPage->leaf ); 5191 #endif 5192 return SQLITE_OK; 5193 } 5194 5195 rc = moveToRoot(pCur); 5196 if( rc==SQLITE_OK ){ 5197 assert( pCur->eState==CURSOR_VALID ); 5198 *pRes = 0; 5199 rc = moveToRightmost(pCur); 5200 if( rc==SQLITE_OK ){ 5201 pCur->curFlags |= BTCF_AtLast; 5202 }else{ 5203 pCur->curFlags &= ~BTCF_AtLast; 5204 } 5205 }else if( rc==SQLITE_EMPTY ){ 5206 assert( pCur->pgnoRoot==0 || pCur->pPage->nCell==0 ); 5207 *pRes = 1; 5208 rc = SQLITE_OK; 5209 } 5210 return rc; 5211 } 5212 5213 /* Move the cursor so that it points to an entry near the key 5214 ** specified by pIdxKey or intKey. Return a success code. 5215 ** 5216 ** For INTKEY tables, the intKey parameter is used. pIdxKey 5217 ** must be NULL. For index tables, pIdxKey is used and intKey 5218 ** is ignored. 5219 ** 5220 ** If an exact match is not found, then the cursor is always 5221 ** left pointing at a leaf page which would hold the entry if it 5222 ** were present. The cursor might point to an entry that comes 5223 ** before or after the key. 5224 ** 5225 ** An integer is written into *pRes which is the result of 5226 ** comparing the key with the entry to which the cursor is 5227 ** pointing. The meaning of the integer written into 5228 ** *pRes is as follows: 5229 ** 5230 ** *pRes<0 The cursor is left pointing at an entry that 5231 ** is smaller than intKey/pIdxKey or if the table is empty 5232 ** and the cursor is therefore left point to nothing. 5233 ** 5234 ** *pRes==0 The cursor is left pointing at an entry that 5235 ** exactly matches intKey/pIdxKey. 5236 ** 5237 ** *pRes>0 The cursor is left pointing at an entry that 5238 ** is larger than intKey/pIdxKey. 5239 ** 5240 ** For index tables, the pIdxKey->eqSeen field is set to 1 if there 5241 ** exists an entry in the table that exactly matches pIdxKey. 5242 */ 5243 int sqlite3BtreeMovetoUnpacked( 5244 BtCursor *pCur, /* The cursor to be moved */ 5245 UnpackedRecord *pIdxKey, /* Unpacked index key */ 5246 i64 intKey, /* The table key */ 5247 int biasRight, /* If true, bias the search to the high end */ 5248 int *pRes /* Write search results here */ 5249 ){ 5250 int rc; 5251 RecordCompare xRecordCompare; 5252 5253 assert( cursorOwnsBtShared(pCur) ); 5254 assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) ); 5255 assert( pRes ); 5256 assert( (pIdxKey==0)==(pCur->pKeyInfo==0) ); 5257 assert( pCur->eState!=CURSOR_VALID || (pIdxKey==0)==(pCur->curIntKey!=0) ); 5258 5259 /* If the cursor is already positioned at the point we are trying 5260 ** to move to, then just return without doing any work */ 5261 if( pIdxKey==0 5262 && pCur->eState==CURSOR_VALID && (pCur->curFlags & BTCF_ValidNKey)!=0 5263 ){ 5264 if( pCur->info.nKey==intKey ){ 5265 *pRes = 0; 5266 return SQLITE_OK; 5267 } 5268 if( pCur->info.nKey<intKey ){ 5269 if( (pCur->curFlags & BTCF_AtLast)!=0 ){ 5270 *pRes = -1; 5271 return SQLITE_OK; 5272 } 5273 /* If the requested key is one more than the previous key, then 5274 ** try to get there using sqlite3BtreeNext() rather than a full 5275 ** binary search. This is an optimization only. The correct answer 5276 ** is still obtained without this case, only a little more slowely */ 5277 if( pCur->info.nKey+1==intKey && !pCur->skipNext ){ 5278 *pRes = 0; 5279 rc = sqlite3BtreeNext(pCur, 0); 5280 if( rc==SQLITE_OK ){ 5281 getCellInfo(pCur); 5282 if( pCur->info.nKey==intKey ){ 5283 return SQLITE_OK; 5284 } 5285 }else if( rc==SQLITE_DONE ){ 5286 rc = SQLITE_OK; 5287 }else{ 5288 return rc; 5289 } 5290 } 5291 } 5292 } 5293 5294 if( pIdxKey ){ 5295 xRecordCompare = sqlite3VdbeFindCompare(pIdxKey); 5296 pIdxKey->errCode = 0; 5297 assert( pIdxKey->default_rc==1 5298 || pIdxKey->default_rc==0 5299 || pIdxKey->default_rc==-1 5300 ); 5301 }else{ 5302 xRecordCompare = 0; /* All keys are integers */ 5303 } 5304 5305 rc = moveToRoot(pCur); 5306 if( rc ){ 5307 if( rc==SQLITE_EMPTY ){ 5308 assert( pCur->pgnoRoot==0 || pCur->pPage->nCell==0 ); 5309 *pRes = -1; 5310 return SQLITE_OK; 5311 } 5312 return rc; 5313 } 5314 assert( pCur->pPage ); 5315 assert( pCur->pPage->isInit ); 5316 assert( pCur->eState==CURSOR_VALID ); 5317 assert( pCur->pPage->nCell > 0 ); 5318 assert( pCur->iPage==0 || pCur->apPage[0]->intKey==pCur->curIntKey ); 5319 assert( pCur->curIntKey || pIdxKey ); 5320 for(;;){ 5321 int lwr, upr, idx, c; 5322 Pgno chldPg; 5323 MemPage *pPage = pCur->pPage; 5324 u8 *pCell; /* Pointer to current cell in pPage */ 5325 5326 /* pPage->nCell must be greater than zero. If this is the root-page 5327 ** the cursor would have been INVALID above and this for(;;) loop 5328 ** not run. If this is not the root-page, then the moveToChild() routine 5329 ** would have already detected db corruption. Similarly, pPage must 5330 ** be the right kind (index or table) of b-tree page. Otherwise 5331 ** a moveToChild() or moveToRoot() call would have detected corruption. */ 5332 assert( pPage->nCell>0 ); 5333 assert( pPage->intKey==(pIdxKey==0) ); 5334 lwr = 0; 5335 upr = pPage->nCell-1; 5336 assert( biasRight==0 || biasRight==1 ); 5337 idx = upr>>(1-biasRight); /* idx = biasRight ? upr : (lwr+upr)/2; */ 5338 pCur->ix = (u16)idx; 5339 if( xRecordCompare==0 ){ 5340 for(;;){ 5341 i64 nCellKey; 5342 pCell = findCellPastPtr(pPage, idx); 5343 if( pPage->intKeyLeaf ){ 5344 while( 0x80 <= *(pCell++) ){ 5345 if( pCell>=pPage->aDataEnd ){ 5346 return SQLITE_CORRUPT_PAGE(pPage); 5347 } 5348 } 5349 } 5350 getVarint(pCell, (u64*)&nCellKey); 5351 if( nCellKey<intKey ){ 5352 lwr = idx+1; 5353 if( lwr>upr ){ c = -1; break; } 5354 }else if( nCellKey>intKey ){ 5355 upr = idx-1; 5356 if( lwr>upr ){ c = +1; break; } 5357 }else{ 5358 assert( nCellKey==intKey ); 5359 pCur->ix = (u16)idx; 5360 if( !pPage->leaf ){ 5361 lwr = idx; 5362 goto moveto_next_layer; 5363 }else{ 5364 pCur->curFlags |= BTCF_ValidNKey; 5365 pCur->info.nKey = nCellKey; 5366 pCur->info.nSize = 0; 5367 *pRes = 0; 5368 return SQLITE_OK; 5369 } 5370 } 5371 assert( lwr+upr>=0 ); 5372 idx = (lwr+upr)>>1; /* idx = (lwr+upr)/2; */ 5373 } 5374 }else{ 5375 for(;;){ 5376 int nCell; /* Size of the pCell cell in bytes */ 5377 pCell = findCellPastPtr(pPage, idx); 5378 5379 /* The maximum supported page-size is 65536 bytes. This means that 5380 ** the maximum number of record bytes stored on an index B-Tree 5381 ** page is less than 16384 bytes and may be stored as a 2-byte 5382 ** varint. This information is used to attempt to avoid parsing 5383 ** the entire cell by checking for the cases where the record is 5384 ** stored entirely within the b-tree page by inspecting the first 5385 ** 2 bytes of the cell. 5386 */ 5387 nCell = pCell[0]; 5388 if( nCell<=pPage->max1bytePayload ){ 5389 /* This branch runs if the record-size field of the cell is a 5390 ** single byte varint and the record fits entirely on the main 5391 ** b-tree page. */ 5392 testcase( pCell+nCell+1==pPage->aDataEnd ); 5393 c = xRecordCompare(nCell, (void*)&pCell[1], pIdxKey); 5394 }else if( !(pCell[1] & 0x80) 5395 && (nCell = ((nCell&0x7f)<<7) + pCell[1])<=pPage->maxLocal 5396 ){ 5397 /* The record-size field is a 2 byte varint and the record 5398 ** fits entirely on the main b-tree page. */ 5399 testcase( pCell+nCell+2==pPage->aDataEnd ); 5400 c = xRecordCompare(nCell, (void*)&pCell[2], pIdxKey); 5401 }else{ 5402 /* The record flows over onto one or more overflow pages. In 5403 ** this case the whole cell needs to be parsed, a buffer allocated 5404 ** and accessPayload() used to retrieve the record into the 5405 ** buffer before VdbeRecordCompare() can be called. 5406 ** 5407 ** If the record is corrupt, the xRecordCompare routine may read 5408 ** up to two varints past the end of the buffer. An extra 18 5409 ** bytes of padding is allocated at the end of the buffer in 5410 ** case this happens. */ 5411 void *pCellKey; 5412 u8 * const pCellBody = pCell - pPage->childPtrSize; 5413 pPage->xParseCell(pPage, pCellBody, &pCur->info); 5414 nCell = (int)pCur->info.nKey; 5415 testcase( nCell<0 ); /* True if key size is 2^32 or more */ 5416 testcase( nCell==0 ); /* Invalid key size: 0x80 0x80 0x00 */ 5417 testcase( nCell==1 ); /* Invalid key size: 0x80 0x80 0x01 */ 5418 testcase( nCell==2 ); /* Minimum legal index key size */ 5419 if( nCell<2 ){ 5420 rc = SQLITE_CORRUPT_PAGE(pPage); 5421 goto moveto_finish; 5422 } 5423 pCellKey = sqlite3Malloc( nCell+18 ); 5424 if( pCellKey==0 ){ 5425 rc = SQLITE_NOMEM_BKPT; 5426 goto moveto_finish; 5427 } 5428 pCur->ix = (u16)idx; 5429 rc = accessPayload(pCur, 0, nCell, (unsigned char*)pCellKey, 0); 5430 pCur->curFlags &= ~BTCF_ValidOvfl; 5431 if( rc ){ 5432 sqlite3_free(pCellKey); 5433 goto moveto_finish; 5434 } 5435 c = xRecordCompare(nCell, pCellKey, pIdxKey); 5436 sqlite3_free(pCellKey); 5437 } 5438 assert( 5439 (pIdxKey->errCode!=SQLITE_CORRUPT || c==0) 5440 && (pIdxKey->errCode!=SQLITE_NOMEM || pCur->pBtree->db->mallocFailed) 5441 ); 5442 if( c<0 ){ 5443 lwr = idx+1; 5444 }else if( c>0 ){ 5445 upr = idx-1; 5446 }else{ 5447 assert( c==0 ); 5448 *pRes = 0; 5449 rc = SQLITE_OK; 5450 pCur->ix = (u16)idx; 5451 if( pIdxKey->errCode ) rc = SQLITE_CORRUPT_BKPT; 5452 goto moveto_finish; 5453 } 5454 if( lwr>upr ) break; 5455 assert( lwr+upr>=0 ); 5456 idx = (lwr+upr)>>1; /* idx = (lwr+upr)/2 */ 5457 } 5458 } 5459 assert( lwr==upr+1 || (pPage->intKey && !pPage->leaf) ); 5460 assert( pPage->isInit ); 5461 if( pPage->leaf ){ 5462 assert( pCur->ix<pCur->pPage->nCell ); 5463 pCur->ix = (u16)idx; 5464 *pRes = c; 5465 rc = SQLITE_OK; 5466 goto moveto_finish; 5467 } 5468 moveto_next_layer: 5469 if( lwr>=pPage->nCell ){ 5470 chldPg = get4byte(&pPage->aData[pPage->hdrOffset+8]); 5471 }else{ 5472 chldPg = get4byte(findCell(pPage, lwr)); 5473 } 5474 pCur->ix = (u16)lwr; 5475 rc = moveToChild(pCur, chldPg); 5476 if( rc ) break; 5477 } 5478 moveto_finish: 5479 pCur->info.nSize = 0; 5480 assert( (pCur->curFlags & BTCF_ValidOvfl)==0 ); 5481 return rc; 5482 } 5483 5484 5485 /* 5486 ** Return TRUE if the cursor is not pointing at an entry of the table. 5487 ** 5488 ** TRUE will be returned after a call to sqlite3BtreeNext() moves 5489 ** past the last entry in the table or sqlite3BtreePrev() moves past 5490 ** the first entry. TRUE is also returned if the table is empty. 5491 */ 5492 int sqlite3BtreeEof(BtCursor *pCur){ 5493 /* TODO: What if the cursor is in CURSOR_REQUIRESEEK but all table entries 5494 ** have been deleted? This API will need to change to return an error code 5495 ** as well as the boolean result value. 5496 */ 5497 return (CURSOR_VALID!=pCur->eState); 5498 } 5499 5500 /* 5501 ** Return an estimate for the number of rows in the table that pCur is 5502 ** pointing to. Return a negative number if no estimate is currently 5503 ** available. 5504 */ 5505 i64 sqlite3BtreeRowCountEst(BtCursor *pCur){ 5506 i64 n; 5507 u8 i; 5508 5509 assert( cursorOwnsBtShared(pCur) ); 5510 assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) ); 5511 5512 /* Currently this interface is only called by the OP_IfSmaller 5513 ** opcode, and it that case the cursor will always be valid and 5514 ** will always point to a leaf node. */ 5515 if( NEVER(pCur->eState!=CURSOR_VALID) ) return -1; 5516 if( NEVER(pCur->pPage->leaf==0) ) return -1; 5517 5518 n = pCur->pPage->nCell; 5519 for(i=0; i<pCur->iPage; i++){ 5520 n *= pCur->apPage[i]->nCell; 5521 } 5522 return n; 5523 } 5524 5525 /* 5526 ** Advance the cursor to the next entry in the database. 5527 ** Return value: 5528 ** 5529 ** SQLITE_OK success 5530 ** SQLITE_DONE cursor is already pointing at the last element 5531 ** otherwise some kind of error occurred 5532 ** 5533 ** The main entry point is sqlite3BtreeNext(). That routine is optimized 5534 ** for the common case of merely incrementing the cell counter BtCursor.aiIdx 5535 ** to the next cell on the current page. The (slower) btreeNext() helper 5536 ** routine is called when it is necessary to move to a different page or 5537 ** to restore the cursor. 5538 ** 5539 ** If bit 0x01 of the F argument in sqlite3BtreeNext(C,F) is 1, then the 5540 ** cursor corresponds to an SQL index and this routine could have been 5541 ** skipped if the SQL index had been a unique index. The F argument 5542 ** is a hint to the implement. SQLite btree implementation does not use 5543 ** this hint, but COMDB2 does. 5544 */ 5545 static SQLITE_NOINLINE int btreeNext(BtCursor *pCur){ 5546 int rc; 5547 int idx; 5548 MemPage *pPage; 5549 5550 assert( cursorOwnsBtShared(pCur) ); 5551 assert( pCur->skipNext==0 || pCur->eState!=CURSOR_VALID ); 5552 if( pCur->eState!=CURSOR_VALID ){ 5553 assert( (pCur->curFlags & BTCF_ValidOvfl)==0 ); 5554 rc = restoreCursorPosition(pCur); 5555 if( rc!=SQLITE_OK ){ 5556 return rc; 5557 } 5558 if( CURSOR_INVALID==pCur->eState ){ 5559 return SQLITE_DONE; 5560 } 5561 if( pCur->skipNext ){ 5562 assert( pCur->eState==CURSOR_VALID || pCur->eState==CURSOR_SKIPNEXT ); 5563 pCur->eState = CURSOR_VALID; 5564 if( pCur->skipNext>0 ){ 5565 pCur->skipNext = 0; 5566 return SQLITE_OK; 5567 } 5568 pCur->skipNext = 0; 5569 } 5570 } 5571 5572 pPage = pCur->pPage; 5573 idx = ++pCur->ix; 5574 assert( pPage->isInit ); 5575 5576 /* If the database file is corrupt, it is possible for the value of idx 5577 ** to be invalid here. This can only occur if a second cursor modifies 5578 ** the page while cursor pCur is holding a reference to it. Which can 5579 ** only happen if the database is corrupt in such a way as to link the 5580 ** page into more than one b-tree structure. */ 5581 testcase( idx>pPage->nCell ); 5582 5583 if( idx>=pPage->nCell ){ 5584 if( !pPage->leaf ){ 5585 rc = moveToChild(pCur, get4byte(&pPage->aData[pPage->hdrOffset+8])); 5586 if( rc ) return rc; 5587 return moveToLeftmost(pCur); 5588 } 5589 do{ 5590 if( pCur->iPage==0 ){ 5591 pCur->eState = CURSOR_INVALID; 5592 return SQLITE_DONE; 5593 } 5594 moveToParent(pCur); 5595 pPage = pCur->pPage; 5596 }while( pCur->ix>=pPage->nCell ); 5597 if( pPage->intKey ){ 5598 return sqlite3BtreeNext(pCur, 0); 5599 }else{ 5600 return SQLITE_OK; 5601 } 5602 } 5603 if( pPage->leaf ){ 5604 return SQLITE_OK; 5605 }else{ 5606 return moveToLeftmost(pCur); 5607 } 5608 } 5609 int sqlite3BtreeNext(BtCursor *pCur, int flags){ 5610 MemPage *pPage; 5611 UNUSED_PARAMETER( flags ); /* Used in COMDB2 but not native SQLite */ 5612 assert( cursorOwnsBtShared(pCur) ); 5613 assert( flags==0 || flags==1 ); 5614 assert( pCur->skipNext==0 || pCur->eState!=CURSOR_VALID ); 5615 pCur->info.nSize = 0; 5616 pCur->curFlags &= ~(BTCF_ValidNKey|BTCF_ValidOvfl); 5617 if( pCur->eState!=CURSOR_VALID ) return btreeNext(pCur); 5618 pPage = pCur->pPage; 5619 if( (++pCur->ix)>=pPage->nCell ){ 5620 pCur->ix--; 5621 return btreeNext(pCur); 5622 } 5623 if( pPage->leaf ){ 5624 return SQLITE_OK; 5625 }else{ 5626 return moveToLeftmost(pCur); 5627 } 5628 } 5629 5630 /* 5631 ** Step the cursor to the back to the previous entry in the database. 5632 ** Return values: 5633 ** 5634 ** SQLITE_OK success 5635 ** SQLITE_DONE the cursor is already on the first element of the table 5636 ** otherwise some kind of error occurred 5637 ** 5638 ** The main entry point is sqlite3BtreePrevious(). That routine is optimized 5639 ** for the common case of merely decrementing the cell counter BtCursor.aiIdx 5640 ** to the previous cell on the current page. The (slower) btreePrevious() 5641 ** helper routine is called when it is necessary to move to a different page 5642 ** or to restore the cursor. 5643 ** 5644 ** If bit 0x01 of the F argument to sqlite3BtreePrevious(C,F) is 1, then 5645 ** the cursor corresponds to an SQL index and this routine could have been 5646 ** skipped if the SQL index had been a unique index. The F argument is a 5647 ** hint to the implement. The native SQLite btree implementation does not 5648 ** use this hint, but COMDB2 does. 5649 */ 5650 static SQLITE_NOINLINE int btreePrevious(BtCursor *pCur){ 5651 int rc; 5652 MemPage *pPage; 5653 5654 assert( cursorOwnsBtShared(pCur) ); 5655 assert( pCur->skipNext==0 || pCur->eState!=CURSOR_VALID ); 5656 assert( (pCur->curFlags & (BTCF_AtLast|BTCF_ValidOvfl|BTCF_ValidNKey))==0 ); 5657 assert( pCur->info.nSize==0 ); 5658 if( pCur->eState!=CURSOR_VALID ){ 5659 rc = restoreCursorPosition(pCur); 5660 if( rc!=SQLITE_OK ){ 5661 return rc; 5662 } 5663 if( CURSOR_INVALID==pCur->eState ){ 5664 return SQLITE_DONE; 5665 } 5666 if( pCur->skipNext ){ 5667 assert( pCur->eState==CURSOR_VALID || pCur->eState==CURSOR_SKIPNEXT ); 5668 pCur->eState = CURSOR_VALID; 5669 if( pCur->skipNext<0 ){ 5670 pCur->skipNext = 0; 5671 return SQLITE_OK; 5672 } 5673 pCur->skipNext = 0; 5674 } 5675 } 5676 5677 pPage = pCur->pPage; 5678 assert( pPage->isInit ); 5679 if( !pPage->leaf ){ 5680 int idx = pCur->ix; 5681 rc = moveToChild(pCur, get4byte(findCell(pPage, idx))); 5682 if( rc ) return rc; 5683 rc = moveToRightmost(pCur); 5684 }else{ 5685 while( pCur->ix==0 ){ 5686 if( pCur->iPage==0 ){ 5687 pCur->eState = CURSOR_INVALID; 5688 return SQLITE_DONE; 5689 } 5690 moveToParent(pCur); 5691 } 5692 assert( pCur->info.nSize==0 ); 5693 assert( (pCur->curFlags & (BTCF_ValidOvfl))==0 ); 5694 5695 pCur->ix--; 5696 pPage = pCur->pPage; 5697 if( pPage->intKey && !pPage->leaf ){ 5698 rc = sqlite3BtreePrevious(pCur, 0); 5699 }else{ 5700 rc = SQLITE_OK; 5701 } 5702 } 5703 return rc; 5704 } 5705 int sqlite3BtreePrevious(BtCursor *pCur, int flags){ 5706 assert( cursorOwnsBtShared(pCur) ); 5707 assert( flags==0 || flags==1 ); 5708 assert( pCur->skipNext==0 || pCur->eState!=CURSOR_VALID ); 5709 UNUSED_PARAMETER( flags ); /* Used in COMDB2 but not native SQLite */ 5710 pCur->curFlags &= ~(BTCF_AtLast|BTCF_ValidOvfl|BTCF_ValidNKey); 5711 pCur->info.nSize = 0; 5712 if( pCur->eState!=CURSOR_VALID 5713 || pCur->ix==0 5714 || pCur->pPage->leaf==0 5715 ){ 5716 return btreePrevious(pCur); 5717 } 5718 pCur->ix--; 5719 return SQLITE_OK; 5720 } 5721 5722 /* 5723 ** Allocate a new page from the database file. 5724 ** 5725 ** The new page is marked as dirty. (In other words, sqlite3PagerWrite() 5726 ** has already been called on the new page.) The new page has also 5727 ** been referenced and the calling routine is responsible for calling 5728 ** sqlite3PagerUnref() on the new page when it is done. 5729 ** 5730 ** SQLITE_OK is returned on success. Any other return value indicates 5731 ** an error. *ppPage is set to NULL in the event of an error. 5732 ** 5733 ** If the "nearby" parameter is not 0, then an effort is made to 5734 ** locate a page close to the page number "nearby". This can be used in an 5735 ** attempt to keep related pages close to each other in the database file, 5736 ** which in turn can make database access faster. 5737 ** 5738 ** If the eMode parameter is BTALLOC_EXACT and the nearby page exists 5739 ** anywhere on the free-list, then it is guaranteed to be returned. If 5740 ** eMode is BTALLOC_LT then the page returned will be less than or equal 5741 ** to nearby if any such page exists. If eMode is BTALLOC_ANY then there 5742 ** are no restrictions on which page is returned. 5743 */ 5744 static int allocateBtreePage( 5745 BtShared *pBt, /* The btree */ 5746 MemPage **ppPage, /* Store pointer to the allocated page here */ 5747 Pgno *pPgno, /* Store the page number here */ 5748 Pgno nearby, /* Search for a page near this one */ 5749 u8 eMode /* BTALLOC_EXACT, BTALLOC_LT, or BTALLOC_ANY */ 5750 ){ 5751 MemPage *pPage1; 5752 int rc; 5753 u32 n; /* Number of pages on the freelist */ 5754 u32 k; /* Number of leaves on the trunk of the freelist */ 5755 MemPage *pTrunk = 0; 5756 MemPage *pPrevTrunk = 0; 5757 Pgno mxPage; /* Total size of the database file */ 5758 5759 assert( sqlite3_mutex_held(pBt->mutex) ); 5760 assert( eMode==BTALLOC_ANY || (nearby>0 && IfNotOmitAV(pBt->autoVacuum)) ); 5761 pPage1 = pBt->pPage1; 5762 mxPage = btreePagecount(pBt); 5763 /* EVIDENCE-OF: R-05119-02637 The 4-byte big-endian integer at offset 36 5764 ** stores stores the total number of pages on the freelist. */ 5765 n = get4byte(&pPage1->aData[36]); 5766 testcase( n==mxPage-1 ); 5767 if( n>=mxPage ){ 5768 return SQLITE_CORRUPT_BKPT; 5769 } 5770 if( n>0 ){ 5771 /* There are pages on the freelist. Reuse one of those pages. */ 5772 Pgno iTrunk; 5773 u8 searchList = 0; /* If the free-list must be searched for 'nearby' */ 5774 u32 nSearch = 0; /* Count of the number of search attempts */ 5775 5776 /* If eMode==BTALLOC_EXACT and a query of the pointer-map 5777 ** shows that the page 'nearby' is somewhere on the free-list, then 5778 ** the entire-list will be searched for that page. 5779 */ 5780 #ifndef SQLITE_OMIT_AUTOVACUUM 5781 if( eMode==BTALLOC_EXACT ){ 5782 if( nearby<=mxPage ){ 5783 u8 eType; 5784 assert( nearby>0 ); 5785 assert( pBt->autoVacuum ); 5786 rc = ptrmapGet(pBt, nearby, &eType, 0); 5787 if( rc ) return rc; 5788 if( eType==PTRMAP_FREEPAGE ){ 5789 searchList = 1; 5790 } 5791 } 5792 }else if( eMode==BTALLOC_LE ){ 5793 searchList = 1; 5794 } 5795 #endif 5796 5797 /* Decrement the free-list count by 1. Set iTrunk to the index of the 5798 ** first free-list trunk page. iPrevTrunk is initially 1. 5799 */ 5800 rc = sqlite3PagerWrite(pPage1->pDbPage); 5801 if( rc ) return rc; 5802 put4byte(&pPage1->aData[36], n-1); 5803 5804 /* The code within this loop is run only once if the 'searchList' variable 5805 ** is not true. Otherwise, it runs once for each trunk-page on the 5806 ** free-list until the page 'nearby' is located (eMode==BTALLOC_EXACT) 5807 ** or until a page less than 'nearby' is located (eMode==BTALLOC_LT) 5808 */ 5809 do { 5810 pPrevTrunk = pTrunk; 5811 if( pPrevTrunk ){ 5812 /* EVIDENCE-OF: R-01506-11053 The first integer on a freelist trunk page 5813 ** is the page number of the next freelist trunk page in the list or 5814 ** zero if this is the last freelist trunk page. */ 5815 iTrunk = get4byte(&pPrevTrunk->aData[0]); 5816 }else{ 5817 /* EVIDENCE-OF: R-59841-13798 The 4-byte big-endian integer at offset 32 5818 ** stores the page number of the first page of the freelist, or zero if 5819 ** the freelist is empty. */ 5820 iTrunk = get4byte(&pPage1->aData[32]); 5821 } 5822 testcase( iTrunk==mxPage ); 5823 if( iTrunk>mxPage || nSearch++ > n ){ 5824 rc = SQLITE_CORRUPT_PGNO(pPrevTrunk ? pPrevTrunk->pgno : 1); 5825 }else{ 5826 rc = btreeGetUnusedPage(pBt, iTrunk, &pTrunk, 0); 5827 } 5828 if( rc ){ 5829 pTrunk = 0; 5830 goto end_allocate_page; 5831 } 5832 assert( pTrunk!=0 ); 5833 assert( pTrunk->aData!=0 ); 5834 /* EVIDENCE-OF: R-13523-04394 The second integer on a freelist trunk page 5835 ** is the number of leaf page pointers to follow. */ 5836 k = get4byte(&pTrunk->aData[4]); 5837 if( k==0 && !searchList ){ 5838 /* The trunk has no leaves and the list is not being searched. 5839 ** So extract the trunk page itself and use it as the newly 5840 ** allocated page */ 5841 assert( pPrevTrunk==0 ); 5842 rc = sqlite3PagerWrite(pTrunk->pDbPage); 5843 if( rc ){ 5844 goto end_allocate_page; 5845 } 5846 *pPgno = iTrunk; 5847 memcpy(&pPage1->aData[32], &pTrunk->aData[0], 4); 5848 *ppPage = pTrunk; 5849 pTrunk = 0; 5850 TRACE(("ALLOCATE: %d trunk - %d free pages left\n", *pPgno, n-1)); 5851 }else if( k>(u32)(pBt->usableSize/4 - 2) ){ 5852 /* Value of k is out of range. Database corruption */ 5853 rc = SQLITE_CORRUPT_PGNO(iTrunk); 5854 goto end_allocate_page; 5855 #ifndef SQLITE_OMIT_AUTOVACUUM 5856 }else if( searchList 5857 && (nearby==iTrunk || (iTrunk<nearby && eMode==BTALLOC_LE)) 5858 ){ 5859 /* The list is being searched and this trunk page is the page 5860 ** to allocate, regardless of whether it has leaves. 5861 */ 5862 *pPgno = iTrunk; 5863 *ppPage = pTrunk; 5864 searchList = 0; 5865 rc = sqlite3PagerWrite(pTrunk->pDbPage); 5866 if( rc ){ 5867 goto end_allocate_page; 5868 } 5869 if( k==0 ){ 5870 if( !pPrevTrunk ){ 5871 memcpy(&pPage1->aData[32], &pTrunk->aData[0], 4); 5872 }else{ 5873 rc = sqlite3PagerWrite(pPrevTrunk->pDbPage); 5874 if( rc!=SQLITE_OK ){ 5875 goto end_allocate_page; 5876 } 5877 memcpy(&pPrevTrunk->aData[0], &pTrunk->aData[0], 4); 5878 } 5879 }else{ 5880 /* The trunk page is required by the caller but it contains 5881 ** pointers to free-list leaves. The first leaf becomes a trunk 5882 ** page in this case. 5883 */ 5884 MemPage *pNewTrunk; 5885 Pgno iNewTrunk = get4byte(&pTrunk->aData[8]); 5886 if( iNewTrunk>mxPage ){ 5887 rc = SQLITE_CORRUPT_PGNO(iTrunk); 5888 goto end_allocate_page; 5889 } 5890 testcase( iNewTrunk==mxPage ); 5891 rc = btreeGetUnusedPage(pBt, iNewTrunk, &pNewTrunk, 0); 5892 if( rc!=SQLITE_OK ){ 5893 goto end_allocate_page; 5894 } 5895 rc = sqlite3PagerWrite(pNewTrunk->pDbPage); 5896 if( rc!=SQLITE_OK ){ 5897 releasePage(pNewTrunk); 5898 goto end_allocate_page; 5899 } 5900 memcpy(&pNewTrunk->aData[0], &pTrunk->aData[0], 4); 5901 put4byte(&pNewTrunk->aData[4], k-1); 5902 memcpy(&pNewTrunk->aData[8], &pTrunk->aData[12], (k-1)*4); 5903 releasePage(pNewTrunk); 5904 if( !pPrevTrunk ){ 5905 assert( sqlite3PagerIswriteable(pPage1->pDbPage) ); 5906 put4byte(&pPage1->aData[32], iNewTrunk); 5907 }else{ 5908 rc = sqlite3PagerWrite(pPrevTrunk->pDbPage); 5909 if( rc ){ 5910 goto end_allocate_page; 5911 } 5912 put4byte(&pPrevTrunk->aData[0], iNewTrunk); 5913 } 5914 } 5915 pTrunk = 0; 5916 TRACE(("ALLOCATE: %d trunk - %d free pages left\n", *pPgno, n-1)); 5917 #endif 5918 }else if( k>0 ){ 5919 /* Extract a leaf from the trunk */ 5920 u32 closest; 5921 Pgno iPage; 5922 unsigned char *aData = pTrunk->aData; 5923 if( nearby>0 ){ 5924 u32 i; 5925 closest = 0; 5926 if( eMode==BTALLOC_LE ){ 5927 for(i=0; i<k; i++){ 5928 iPage = get4byte(&aData[8+i*4]); 5929 if( iPage<=nearby ){ 5930 closest = i; 5931 break; 5932 } 5933 } 5934 }else{ 5935 int dist; 5936 dist = sqlite3AbsInt32(get4byte(&aData[8]) - nearby); 5937 for(i=1; i<k; i++){ 5938 int d2 = sqlite3AbsInt32(get4byte(&aData[8+i*4]) - nearby); 5939 if( d2<dist ){ 5940 closest = i; 5941 dist = d2; 5942 } 5943 } 5944 } 5945 }else{ 5946 closest = 0; 5947 } 5948 5949 iPage = get4byte(&aData[8+closest*4]); 5950 testcase( iPage==mxPage ); 5951 if( iPage>mxPage ){ 5952 rc = SQLITE_CORRUPT_PGNO(iTrunk); 5953 goto end_allocate_page; 5954 } 5955 testcase( iPage==mxPage ); 5956 if( !searchList 5957 || (iPage==nearby || (iPage<nearby && eMode==BTALLOC_LE)) 5958 ){ 5959 int noContent; 5960 *pPgno = iPage; 5961 TRACE(("ALLOCATE: %d was leaf %d of %d on trunk %d" 5962 ": %d more free pages\n", 5963 *pPgno, closest+1, k, pTrunk->pgno, n-1)); 5964 rc = sqlite3PagerWrite(pTrunk->pDbPage); 5965 if( rc ) goto end_allocate_page; 5966 if( closest<k-1 ){ 5967 memcpy(&aData[8+closest*4], &aData[4+k*4], 4); 5968 } 5969 put4byte(&aData[4], k-1); 5970 noContent = !btreeGetHasContent(pBt, *pPgno)? PAGER_GET_NOCONTENT : 0; 5971 rc = btreeGetUnusedPage(pBt, *pPgno, ppPage, noContent); 5972 if( rc==SQLITE_OK ){ 5973 rc = sqlite3PagerWrite((*ppPage)->pDbPage); 5974 if( rc!=SQLITE_OK ){ 5975 releasePage(*ppPage); 5976 *ppPage = 0; 5977 } 5978 } 5979 searchList = 0; 5980 } 5981 } 5982 releasePage(pPrevTrunk); 5983 pPrevTrunk = 0; 5984 }while( searchList ); 5985 }else{ 5986 /* There are no pages on the freelist, so append a new page to the 5987 ** database image. 5988 ** 5989 ** Normally, new pages allocated by this block can be requested from the 5990 ** pager layer with the 'no-content' flag set. This prevents the pager 5991 ** from trying to read the pages content from disk. However, if the 5992 ** current transaction has already run one or more incremental-vacuum 5993 ** steps, then the page we are about to allocate may contain content 5994 ** that is required in the event of a rollback. In this case, do 5995 ** not set the no-content flag. This causes the pager to load and journal 5996 ** the current page content before overwriting it. 5997 ** 5998 ** Note that the pager will not actually attempt to load or journal 5999 ** content for any page that really does lie past the end of the database 6000 ** file on disk. So the effects of disabling the no-content optimization 6001 ** here are confined to those pages that lie between the end of the 6002 ** database image and the end of the database file. 6003 */ 6004 int bNoContent = (0==IfNotOmitAV(pBt->bDoTruncate))? PAGER_GET_NOCONTENT:0; 6005 6006 rc = sqlite3PagerWrite(pBt->pPage1->pDbPage); 6007 if( rc ) return rc; 6008 pBt->nPage++; 6009 if( pBt->nPage==PENDING_BYTE_PAGE(pBt) ) pBt->nPage++; 6010 6011 #ifndef SQLITE_OMIT_AUTOVACUUM 6012 if( pBt->autoVacuum && PTRMAP_ISPAGE(pBt, pBt->nPage) ){ 6013 /* If *pPgno refers to a pointer-map page, allocate two new pages 6014 ** at the end of the file instead of one. The first allocated page 6015 ** becomes a new pointer-map page, the second is used by the caller. 6016 */ 6017 MemPage *pPg = 0; 6018 TRACE(("ALLOCATE: %d from end of file (pointer-map page)\n", pBt->nPage)); 6019 assert( pBt->nPage!=PENDING_BYTE_PAGE(pBt) ); 6020 rc = btreeGetUnusedPage(pBt, pBt->nPage, &pPg, bNoContent); 6021 if( rc==SQLITE_OK ){ 6022 rc = sqlite3PagerWrite(pPg->pDbPage); 6023 releasePage(pPg); 6024 } 6025 if( rc ) return rc; 6026 pBt->nPage++; 6027 if( pBt->nPage==PENDING_BYTE_PAGE(pBt) ){ pBt->nPage++; } 6028 } 6029 #endif 6030 put4byte(28 + (u8*)pBt->pPage1->aData, pBt->nPage); 6031 *pPgno = pBt->nPage; 6032 6033 assert( *pPgno!=PENDING_BYTE_PAGE(pBt) ); 6034 rc = btreeGetUnusedPage(pBt, *pPgno, ppPage, bNoContent); 6035 if( rc ) return rc; 6036 rc = sqlite3PagerWrite((*ppPage)->pDbPage); 6037 if( rc!=SQLITE_OK ){ 6038 releasePage(*ppPage); 6039 *ppPage = 0; 6040 } 6041 TRACE(("ALLOCATE: %d from end of file\n", *pPgno)); 6042 } 6043 6044 assert( *pPgno!=PENDING_BYTE_PAGE(pBt) ); 6045 6046 end_allocate_page: 6047 releasePage(pTrunk); 6048 releasePage(pPrevTrunk); 6049 assert( rc!=SQLITE_OK || sqlite3PagerPageRefcount((*ppPage)->pDbPage)<=1 ); 6050 assert( rc!=SQLITE_OK || (*ppPage)->isInit==0 ); 6051 return rc; 6052 } 6053 6054 /* 6055 ** This function is used to add page iPage to the database file free-list. 6056 ** It is assumed that the page is not already a part of the free-list. 6057 ** 6058 ** The value passed as the second argument to this function is optional. 6059 ** If the caller happens to have a pointer to the MemPage object 6060 ** corresponding to page iPage handy, it may pass it as the second value. 6061 ** Otherwise, it may pass NULL. 6062 ** 6063 ** If a pointer to a MemPage object is passed as the second argument, 6064 ** its reference count is not altered by this function. 6065 */ 6066 static int freePage2(BtShared *pBt, MemPage *pMemPage, Pgno iPage){ 6067 MemPage *pTrunk = 0; /* Free-list trunk page */ 6068 Pgno iTrunk = 0; /* Page number of free-list trunk page */ 6069 MemPage *pPage1 = pBt->pPage1; /* Local reference to page 1 */ 6070 MemPage *pPage; /* Page being freed. May be NULL. */ 6071 int rc; /* Return Code */ 6072 int nFree; /* Initial number of pages on free-list */ 6073 6074 assert( sqlite3_mutex_held(pBt->mutex) ); 6075 assert( CORRUPT_DB || iPage>1 ); 6076 assert( !pMemPage || pMemPage->pgno==iPage ); 6077 6078 if( iPage<2 ) return SQLITE_CORRUPT_BKPT; 6079 if( pMemPage ){ 6080 pPage = pMemPage; 6081 sqlite3PagerRef(pPage->pDbPage); 6082 }else{ 6083 pPage = btreePageLookup(pBt, iPage); 6084 } 6085 6086 /* Increment the free page count on pPage1 */ 6087 rc = sqlite3PagerWrite(pPage1->pDbPage); 6088 if( rc ) goto freepage_out; 6089 nFree = get4byte(&pPage1->aData[36]); 6090 put4byte(&pPage1->aData[36], nFree+1); 6091 6092 if( pBt->btsFlags & BTS_SECURE_DELETE ){ 6093 /* If the secure_delete option is enabled, then 6094 ** always fully overwrite deleted information with zeros. 6095 */ 6096 if( (!pPage && ((rc = btreeGetPage(pBt, iPage, &pPage, 0))!=0) ) 6097 || ((rc = sqlite3PagerWrite(pPage->pDbPage))!=0) 6098 ){ 6099 goto freepage_out; 6100 } 6101 memset(pPage->aData, 0, pPage->pBt->pageSize); 6102 } 6103 6104 /* If the database supports auto-vacuum, write an entry in the pointer-map 6105 ** to indicate that the page is free. 6106 */ 6107 if( ISAUTOVACUUM ){ 6108 ptrmapPut(pBt, iPage, PTRMAP_FREEPAGE, 0, &rc); 6109 if( rc ) goto freepage_out; 6110 } 6111 6112 /* Now manipulate the actual database free-list structure. There are two 6113 ** possibilities. If the free-list is currently empty, or if the first 6114 ** trunk page in the free-list is full, then this page will become a 6115 ** new free-list trunk page. Otherwise, it will become a leaf of the 6116 ** first trunk page in the current free-list. This block tests if it 6117 ** is possible to add the page as a new free-list leaf. 6118 */ 6119 if( nFree!=0 ){ 6120 u32 nLeaf; /* Initial number of leaf cells on trunk page */ 6121 6122 iTrunk = get4byte(&pPage1->aData[32]); 6123 rc = btreeGetPage(pBt, iTrunk, &pTrunk, 0); 6124 if( rc!=SQLITE_OK ){ 6125 goto freepage_out; 6126 } 6127 6128 nLeaf = get4byte(&pTrunk->aData[4]); 6129 assert( pBt->usableSize>32 ); 6130 if( nLeaf > (u32)pBt->usableSize/4 - 2 ){ 6131 rc = SQLITE_CORRUPT_BKPT; 6132 goto freepage_out; 6133 } 6134 if( nLeaf < (u32)pBt->usableSize/4 - 8 ){ 6135 /* In this case there is room on the trunk page to insert the page 6136 ** being freed as a new leaf. 6137 ** 6138 ** Note that the trunk page is not really full until it contains 6139 ** usableSize/4 - 2 entries, not usableSize/4 - 8 entries as we have 6140 ** coded. But due to a coding error in versions of SQLite prior to 6141 ** 3.6.0, databases with freelist trunk pages holding more than 6142 ** usableSize/4 - 8 entries will be reported as corrupt. In order 6143 ** to maintain backwards compatibility with older versions of SQLite, 6144 ** we will continue to restrict the number of entries to usableSize/4 - 8 6145 ** for now. At some point in the future (once everyone has upgraded 6146 ** to 3.6.0 or later) we should consider fixing the conditional above 6147 ** to read "usableSize/4-2" instead of "usableSize/4-8". 6148 ** 6149 ** EVIDENCE-OF: R-19920-11576 However, newer versions of SQLite still 6150 ** avoid using the last six entries in the freelist trunk page array in 6151 ** order that database files created by newer versions of SQLite can be 6152 ** read by older versions of SQLite. 6153 */ 6154 rc = sqlite3PagerWrite(pTrunk->pDbPage); 6155 if( rc==SQLITE_OK ){ 6156 put4byte(&pTrunk->aData[4], nLeaf+1); 6157 put4byte(&pTrunk->aData[8+nLeaf*4], iPage); 6158 if( pPage && (pBt->btsFlags & BTS_SECURE_DELETE)==0 ){ 6159 sqlite3PagerDontWrite(pPage->pDbPage); 6160 } 6161 rc = btreeSetHasContent(pBt, iPage); 6162 } 6163 TRACE(("FREE-PAGE: %d leaf on trunk page %d\n",pPage->pgno,pTrunk->pgno)); 6164 goto freepage_out; 6165 } 6166 } 6167 6168 /* If control flows to this point, then it was not possible to add the 6169 ** the page being freed as a leaf page of the first trunk in the free-list. 6170 ** Possibly because the free-list is empty, or possibly because the 6171 ** first trunk in the free-list is full. Either way, the page being freed 6172 ** will become the new first trunk page in the free-list. 6173 */ 6174 if( pPage==0 && SQLITE_OK!=(rc = btreeGetPage(pBt, iPage, &pPage, 0)) ){ 6175 goto freepage_out; 6176 } 6177 rc = sqlite3PagerWrite(pPage->pDbPage); 6178 if( rc!=SQLITE_OK ){ 6179 goto freepage_out; 6180 } 6181 put4byte(pPage->aData, iTrunk); 6182 put4byte(&pPage->aData[4], 0); 6183 put4byte(&pPage1->aData[32], iPage); 6184 TRACE(("FREE-PAGE: %d new trunk page replacing %d\n", pPage->pgno, iTrunk)); 6185 6186 freepage_out: 6187 if( pPage ){ 6188 pPage->isInit = 0; 6189 } 6190 releasePage(pPage); 6191 releasePage(pTrunk); 6192 return rc; 6193 } 6194 static void freePage(MemPage *pPage, int *pRC){ 6195 if( (*pRC)==SQLITE_OK ){ 6196 *pRC = freePage2(pPage->pBt, pPage, pPage->pgno); 6197 } 6198 } 6199 6200 /* 6201 ** Free any overflow pages associated with the given Cell. Store 6202 ** size information about the cell in pInfo. 6203 */ 6204 static int clearCell( 6205 MemPage *pPage, /* The page that contains the Cell */ 6206 unsigned char *pCell, /* First byte of the Cell */ 6207 CellInfo *pInfo /* Size information about the cell */ 6208 ){ 6209 BtShared *pBt; 6210 Pgno ovflPgno; 6211 int rc; 6212 int nOvfl; 6213 u32 ovflPageSize; 6214 6215 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 6216 pPage->xParseCell(pPage, pCell, pInfo); 6217 if( pInfo->nLocal==pInfo->nPayload ){ 6218 return SQLITE_OK; /* No overflow pages. Return without doing anything */ 6219 } 6220 if( pCell+pInfo->nSize-1 > pPage->aData+pPage->maskPage ){ 6221 /* Cell extends past end of page */ 6222 return SQLITE_CORRUPT_PAGE(pPage); 6223 } 6224 ovflPgno = get4byte(pCell + pInfo->nSize - 4); 6225 pBt = pPage->pBt; 6226 assert( pBt->usableSize > 4 ); 6227 ovflPageSize = pBt->usableSize - 4; 6228 nOvfl = (pInfo->nPayload - pInfo->nLocal + ovflPageSize - 1)/ovflPageSize; 6229 assert( nOvfl>0 || 6230 (CORRUPT_DB && (pInfo->nPayload + ovflPageSize)<ovflPageSize) 6231 ); 6232 while( nOvfl-- ){ 6233 Pgno iNext = 0; 6234 MemPage *pOvfl = 0; 6235 if( ovflPgno<2 || ovflPgno>btreePagecount(pBt) ){ 6236 /* 0 is not a legal page number and page 1 cannot be an 6237 ** overflow page. Therefore if ovflPgno<2 or past the end of the 6238 ** file the database must be corrupt. */ 6239 return SQLITE_CORRUPT_BKPT; 6240 } 6241 if( nOvfl ){ 6242 rc = getOverflowPage(pBt, ovflPgno, &pOvfl, &iNext); 6243 if( rc ) return rc; 6244 } 6245 6246 if( ( pOvfl || ((pOvfl = btreePageLookup(pBt, ovflPgno))!=0) ) 6247 && sqlite3PagerPageRefcount(pOvfl->pDbPage)!=1 6248 ){ 6249 /* There is no reason any cursor should have an outstanding reference 6250 ** to an overflow page belonging to a cell that is being deleted/updated. 6251 ** So if there exists more than one reference to this page, then it 6252 ** must not really be an overflow page and the database must be corrupt. 6253 ** It is helpful to detect this before calling freePage2(), as 6254 ** freePage2() may zero the page contents if secure-delete mode is 6255 ** enabled. If this 'overflow' page happens to be a page that the 6256 ** caller is iterating through or using in some other way, this 6257 ** can be problematic. 6258 */ 6259 rc = SQLITE_CORRUPT_BKPT; 6260 }else{ 6261 rc = freePage2(pBt, pOvfl, ovflPgno); 6262 } 6263 6264 if( pOvfl ){ 6265 sqlite3PagerUnref(pOvfl->pDbPage); 6266 } 6267 if( rc ) return rc; 6268 ovflPgno = iNext; 6269 } 6270 return SQLITE_OK; 6271 } 6272 6273 /* 6274 ** Create the byte sequence used to represent a cell on page pPage 6275 ** and write that byte sequence into pCell[]. Overflow pages are 6276 ** allocated and filled in as necessary. The calling procedure 6277 ** is responsible for making sure sufficient space has been allocated 6278 ** for pCell[]. 6279 ** 6280 ** Note that pCell does not necessary need to point to the pPage->aData 6281 ** area. pCell might point to some temporary storage. The cell will 6282 ** be constructed in this temporary area then copied into pPage->aData 6283 ** later. 6284 */ 6285 static int fillInCell( 6286 MemPage *pPage, /* The page that contains the cell */ 6287 unsigned char *pCell, /* Complete text of the cell */ 6288 const BtreePayload *pX, /* Payload with which to construct the cell */ 6289 int *pnSize /* Write cell size here */ 6290 ){ 6291 int nPayload; 6292 const u8 *pSrc; 6293 int nSrc, n, rc, mn; 6294 int spaceLeft; 6295 MemPage *pToRelease; 6296 unsigned char *pPrior; 6297 unsigned char *pPayload; 6298 BtShared *pBt; 6299 Pgno pgnoOvfl; 6300 int nHeader; 6301 6302 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 6303 6304 /* pPage is not necessarily writeable since pCell might be auxiliary 6305 ** buffer space that is separate from the pPage buffer area */ 6306 assert( pCell<pPage->aData || pCell>=&pPage->aData[pPage->pBt->pageSize] 6307 || sqlite3PagerIswriteable(pPage->pDbPage) ); 6308 6309 /* Fill in the header. */ 6310 nHeader = pPage->childPtrSize; 6311 if( pPage->intKey ){ 6312 nPayload = pX->nData + pX->nZero; 6313 pSrc = pX->pData; 6314 nSrc = pX->nData; 6315 assert( pPage->intKeyLeaf ); /* fillInCell() only called for leaves */ 6316 nHeader += putVarint32(&pCell[nHeader], nPayload); 6317 nHeader += putVarint(&pCell[nHeader], *(u64*)&pX->nKey); 6318 }else{ 6319 assert( pX->nKey<=0x7fffffff && pX->pKey!=0 ); 6320 nSrc = nPayload = (int)pX->nKey; 6321 pSrc = pX->pKey; 6322 nHeader += putVarint32(&pCell[nHeader], nPayload); 6323 } 6324 6325 /* Fill in the payload */ 6326 pPayload = &pCell[nHeader]; 6327 if( nPayload<=pPage->maxLocal ){ 6328 /* This is the common case where everything fits on the btree page 6329 ** and no overflow pages are required. */ 6330 n = nHeader + nPayload; 6331 testcase( n==3 ); 6332 testcase( n==4 ); 6333 if( n<4 ) n = 4; 6334 *pnSize = n; 6335 assert( nSrc<=nPayload ); 6336 testcase( nSrc<nPayload ); 6337 memcpy(pPayload, pSrc, nSrc); 6338 memset(pPayload+nSrc, 0, nPayload-nSrc); 6339 return SQLITE_OK; 6340 } 6341 6342 /* If we reach this point, it means that some of the content will need 6343 ** to spill onto overflow pages. 6344 */ 6345 mn = pPage->minLocal; 6346 n = mn + (nPayload - mn) % (pPage->pBt->usableSize - 4); 6347 testcase( n==pPage->maxLocal ); 6348 testcase( n==pPage->maxLocal+1 ); 6349 if( n > pPage->maxLocal ) n = mn; 6350 spaceLeft = n; 6351 *pnSize = n + nHeader + 4; 6352 pPrior = &pCell[nHeader+n]; 6353 pToRelease = 0; 6354 pgnoOvfl = 0; 6355 pBt = pPage->pBt; 6356 6357 /* At this point variables should be set as follows: 6358 ** 6359 ** nPayload Total payload size in bytes 6360 ** pPayload Begin writing payload here 6361 ** spaceLeft Space available at pPayload. If nPayload>spaceLeft, 6362 ** that means content must spill into overflow pages. 6363 ** *pnSize Size of the local cell (not counting overflow pages) 6364 ** pPrior Where to write the pgno of the first overflow page 6365 ** 6366 ** Use a call to btreeParseCellPtr() to verify that the values above 6367 ** were computed correctly. 6368 */ 6369 #ifdef SQLITE_DEBUG 6370 { 6371 CellInfo info; 6372 pPage->xParseCell(pPage, pCell, &info); 6373 assert( nHeader==(int)(info.pPayload - pCell) ); 6374 assert( info.nKey==pX->nKey ); 6375 assert( *pnSize == info.nSize ); 6376 assert( spaceLeft == info.nLocal ); 6377 } 6378 #endif 6379 6380 /* Write the payload into the local Cell and any extra into overflow pages */ 6381 while( 1 ){ 6382 n = nPayload; 6383 if( n>spaceLeft ) n = spaceLeft; 6384 6385 /* If pToRelease is not zero than pPayload points into the data area 6386 ** of pToRelease. Make sure pToRelease is still writeable. */ 6387 assert( pToRelease==0 || sqlite3PagerIswriteable(pToRelease->pDbPage) ); 6388 6389 /* If pPayload is part of the data area of pPage, then make sure pPage 6390 ** is still writeable */ 6391 assert( pPayload<pPage->aData || pPayload>=&pPage->aData[pBt->pageSize] 6392 || sqlite3PagerIswriteable(pPage->pDbPage) ); 6393 6394 if( nSrc>=n ){ 6395 memcpy(pPayload, pSrc, n); 6396 }else if( nSrc>0 ){ 6397 n = nSrc; 6398 memcpy(pPayload, pSrc, n); 6399 }else{ 6400 memset(pPayload, 0, n); 6401 } 6402 nPayload -= n; 6403 if( nPayload<=0 ) break; 6404 pPayload += n; 6405 pSrc += n; 6406 nSrc -= n; 6407 spaceLeft -= n; 6408 if( spaceLeft==0 ){ 6409 MemPage *pOvfl = 0; 6410 #ifndef SQLITE_OMIT_AUTOVACUUM 6411 Pgno pgnoPtrmap = pgnoOvfl; /* Overflow page pointer-map entry page */ 6412 if( pBt->autoVacuum ){ 6413 do{ 6414 pgnoOvfl++; 6415 } while( 6416 PTRMAP_ISPAGE(pBt, pgnoOvfl) || pgnoOvfl==PENDING_BYTE_PAGE(pBt) 6417 ); 6418 } 6419 #endif 6420 rc = allocateBtreePage(pBt, &pOvfl, &pgnoOvfl, pgnoOvfl, 0); 6421 #ifndef SQLITE_OMIT_AUTOVACUUM 6422 /* If the database supports auto-vacuum, and the second or subsequent 6423 ** overflow page is being allocated, add an entry to the pointer-map 6424 ** for that page now. 6425 ** 6426 ** If this is the first overflow page, then write a partial entry 6427 ** to the pointer-map. If we write nothing to this pointer-map slot, 6428 ** then the optimistic overflow chain processing in clearCell() 6429 ** may misinterpret the uninitialized values and delete the 6430 ** wrong pages from the database. 6431 */ 6432 if( pBt->autoVacuum && rc==SQLITE_OK ){ 6433 u8 eType = (pgnoPtrmap?PTRMAP_OVERFLOW2:PTRMAP_OVERFLOW1); 6434 ptrmapPut(pBt, pgnoOvfl, eType, pgnoPtrmap, &rc); 6435 if( rc ){ 6436 releasePage(pOvfl); 6437 } 6438 } 6439 #endif 6440 if( rc ){ 6441 releasePage(pToRelease); 6442 return rc; 6443 } 6444 6445 /* If pToRelease is not zero than pPrior points into the data area 6446 ** of pToRelease. Make sure pToRelease is still writeable. */ 6447 assert( pToRelease==0 || sqlite3PagerIswriteable(pToRelease->pDbPage) ); 6448 6449 /* If pPrior is part of the data area of pPage, then make sure pPage 6450 ** is still writeable */ 6451 assert( pPrior<pPage->aData || pPrior>=&pPage->aData[pBt->pageSize] 6452 || sqlite3PagerIswriteable(pPage->pDbPage) ); 6453 6454 put4byte(pPrior, pgnoOvfl); 6455 releasePage(pToRelease); 6456 pToRelease = pOvfl; 6457 pPrior = pOvfl->aData; 6458 put4byte(pPrior, 0); 6459 pPayload = &pOvfl->aData[4]; 6460 spaceLeft = pBt->usableSize - 4; 6461 } 6462 } 6463 releasePage(pToRelease); 6464 return SQLITE_OK; 6465 } 6466 6467 /* 6468 ** Remove the i-th cell from pPage. This routine effects pPage only. 6469 ** The cell content is not freed or deallocated. It is assumed that 6470 ** the cell content has been copied someplace else. This routine just 6471 ** removes the reference to the cell from pPage. 6472 ** 6473 ** "sz" must be the number of bytes in the cell. 6474 */ 6475 static void dropCell(MemPage *pPage, int idx, int sz, int *pRC){ 6476 u32 pc; /* Offset to cell content of cell being deleted */ 6477 u8 *data; /* pPage->aData */ 6478 u8 *ptr; /* Used to move bytes around within data[] */ 6479 int rc; /* The return code */ 6480 int hdr; /* Beginning of the header. 0 most pages. 100 page 1 */ 6481 6482 if( *pRC ) return; 6483 assert( idx>=0 && idx<pPage->nCell ); 6484 assert( CORRUPT_DB || sz==cellSize(pPage, idx) ); 6485 assert( sqlite3PagerIswriteable(pPage->pDbPage) ); 6486 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 6487 data = pPage->aData; 6488 ptr = &pPage->aCellIdx[2*idx]; 6489 pc = get2byte(ptr); 6490 hdr = pPage->hdrOffset; 6491 testcase( pc==get2byte(&data[hdr+5]) ); 6492 testcase( pc+sz==pPage->pBt->usableSize ); 6493 if( pc+sz > pPage->pBt->usableSize ){ 6494 *pRC = SQLITE_CORRUPT_BKPT; 6495 return; 6496 } 6497 rc = freeSpace(pPage, pc, sz); 6498 if( rc ){ 6499 *pRC = rc; 6500 return; 6501 } 6502 pPage->nCell--; 6503 if( pPage->nCell==0 ){ 6504 memset(&data[hdr+1], 0, 4); 6505 data[hdr+7] = 0; 6506 put2byte(&data[hdr+5], pPage->pBt->usableSize); 6507 pPage->nFree = pPage->pBt->usableSize - pPage->hdrOffset 6508 - pPage->childPtrSize - 8; 6509 }else{ 6510 memmove(ptr, ptr+2, 2*(pPage->nCell - idx)); 6511 put2byte(&data[hdr+3], pPage->nCell); 6512 pPage->nFree += 2; 6513 } 6514 } 6515 6516 /* 6517 ** Insert a new cell on pPage at cell index "i". pCell points to the 6518 ** content of the cell. 6519 ** 6520 ** If the cell content will fit on the page, then put it there. If it 6521 ** will not fit, then make a copy of the cell content into pTemp if 6522 ** pTemp is not null. Regardless of pTemp, allocate a new entry 6523 ** in pPage->apOvfl[] and make it point to the cell content (either 6524 ** in pTemp or the original pCell) and also record its index. 6525 ** Allocating a new entry in pPage->aCell[] implies that 6526 ** pPage->nOverflow is incremented. 6527 ** 6528 ** *pRC must be SQLITE_OK when this routine is called. 6529 */ 6530 static void insertCell( 6531 MemPage *pPage, /* Page into which we are copying */ 6532 int i, /* New cell becomes the i-th cell of the page */ 6533 u8 *pCell, /* Content of the new cell */ 6534 int sz, /* Bytes of content in pCell */ 6535 u8 *pTemp, /* Temp storage space for pCell, if needed */ 6536 Pgno iChild, /* If non-zero, replace first 4 bytes with this value */ 6537 int *pRC /* Read and write return code from here */ 6538 ){ 6539 int idx = 0; /* Where to write new cell content in data[] */ 6540 int j; /* Loop counter */ 6541 u8 *data; /* The content of the whole page */ 6542 u8 *pIns; /* The point in pPage->aCellIdx[] where no cell inserted */ 6543 6544 assert( *pRC==SQLITE_OK ); 6545 assert( i>=0 && i<=pPage->nCell+pPage->nOverflow ); 6546 assert( MX_CELL(pPage->pBt)<=10921 ); 6547 assert( pPage->nCell<=MX_CELL(pPage->pBt) || CORRUPT_DB ); 6548 assert( pPage->nOverflow<=ArraySize(pPage->apOvfl) ); 6549 assert( ArraySize(pPage->apOvfl)==ArraySize(pPage->aiOvfl) ); 6550 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 6551 /* The cell should normally be sized correctly. However, when moving a 6552 ** malformed cell from a leaf page to an interior page, if the cell size 6553 ** wanted to be less than 4 but got rounded up to 4 on the leaf, then size 6554 ** might be less than 8 (leaf-size + pointer) on the interior node. Hence 6555 ** the term after the || in the following assert(). */ 6556 assert( sz==pPage->xCellSize(pPage, pCell) || (sz==8 && iChild>0) ); 6557 if( pPage->nOverflow || sz+2>pPage->nFree ){ 6558 if( pTemp ){ 6559 memcpy(pTemp, pCell, sz); 6560 pCell = pTemp; 6561 } 6562 if( iChild ){ 6563 put4byte(pCell, iChild); 6564 } 6565 j = pPage->nOverflow++; 6566 /* Comparison against ArraySize-1 since we hold back one extra slot 6567 ** as a contingency. In other words, never need more than 3 overflow 6568 ** slots but 4 are allocated, just to be safe. */ 6569 assert( j < ArraySize(pPage->apOvfl)-1 ); 6570 pPage->apOvfl[j] = pCell; 6571 pPage->aiOvfl[j] = (u16)i; 6572 6573 /* When multiple overflows occur, they are always sequential and in 6574 ** sorted order. This invariants arise because multiple overflows can 6575 ** only occur when inserting divider cells into the parent page during 6576 ** balancing, and the dividers are adjacent and sorted. 6577 */ 6578 assert( j==0 || pPage->aiOvfl[j-1]<(u16)i ); /* Overflows in sorted order */ 6579 assert( j==0 || i==pPage->aiOvfl[j-1]+1 ); /* Overflows are sequential */ 6580 }else{ 6581 int rc = sqlite3PagerWrite(pPage->pDbPage); 6582 if( rc!=SQLITE_OK ){ 6583 *pRC = rc; 6584 return; 6585 } 6586 assert( sqlite3PagerIswriteable(pPage->pDbPage) ); 6587 data = pPage->aData; 6588 assert( &data[pPage->cellOffset]==pPage->aCellIdx ); 6589 rc = allocateSpace(pPage, sz, &idx); 6590 if( rc ){ *pRC = rc; return; } 6591 /* The allocateSpace() routine guarantees the following properties 6592 ** if it returns successfully */ 6593 assert( idx >= 0 ); 6594 assert( idx >= pPage->cellOffset+2*pPage->nCell+2 || CORRUPT_DB ); 6595 assert( idx+sz <= (int)pPage->pBt->usableSize ); 6596 pPage->nFree -= (u16)(2 + sz); 6597 memcpy(&data[idx], pCell, sz); 6598 if( iChild ){ 6599 put4byte(&data[idx], iChild); 6600 } 6601 pIns = pPage->aCellIdx + i*2; 6602 memmove(pIns+2, pIns, 2*(pPage->nCell - i)); 6603 put2byte(pIns, idx); 6604 pPage->nCell++; 6605 /* increment the cell count */ 6606 if( (++data[pPage->hdrOffset+4])==0 ) data[pPage->hdrOffset+3]++; 6607 assert( get2byte(&data[pPage->hdrOffset+3])==pPage->nCell ); 6608 #ifndef SQLITE_OMIT_AUTOVACUUM 6609 if( pPage->pBt->autoVacuum ){ 6610 /* The cell may contain a pointer to an overflow page. If so, write 6611 ** the entry for the overflow page into the pointer map. 6612 */ 6613 ptrmapPutOvflPtr(pPage, pCell, pRC); 6614 } 6615 #endif 6616 } 6617 } 6618 6619 /* 6620 ** A CellArray object contains a cache of pointers and sizes for a 6621 ** consecutive sequence of cells that might be held on multiple pages. 6622 */ 6623 typedef struct CellArray CellArray; 6624 struct CellArray { 6625 int nCell; /* Number of cells in apCell[] */ 6626 MemPage *pRef; /* Reference page */ 6627 u8 **apCell; /* All cells begin balanced */ 6628 u16 *szCell; /* Local size of all cells in apCell[] */ 6629 }; 6630 6631 /* 6632 ** Make sure the cell sizes at idx, idx+1, ..., idx+N-1 have been 6633 ** computed. 6634 */ 6635 static void populateCellCache(CellArray *p, int idx, int N){ 6636 assert( idx>=0 && idx+N<=p->nCell ); 6637 while( N>0 ){ 6638 assert( p->apCell[idx]!=0 ); 6639 if( p->szCell[idx]==0 ){ 6640 p->szCell[idx] = p->pRef->xCellSize(p->pRef, p->apCell[idx]); 6641 }else{ 6642 assert( CORRUPT_DB || 6643 p->szCell[idx]==p->pRef->xCellSize(p->pRef, p->apCell[idx]) ); 6644 } 6645 idx++; 6646 N--; 6647 } 6648 } 6649 6650 /* 6651 ** Return the size of the Nth element of the cell array 6652 */ 6653 static SQLITE_NOINLINE u16 computeCellSize(CellArray *p, int N){ 6654 assert( N>=0 && N<p->nCell ); 6655 assert( p->szCell[N]==0 ); 6656 p->szCell[N] = p->pRef->xCellSize(p->pRef, p->apCell[N]); 6657 return p->szCell[N]; 6658 } 6659 static u16 cachedCellSize(CellArray *p, int N){ 6660 assert( N>=0 && N<p->nCell ); 6661 if( p->szCell[N] ) return p->szCell[N]; 6662 return computeCellSize(p, N); 6663 } 6664 6665 /* 6666 ** Array apCell[] contains pointers to nCell b-tree page cells. The 6667 ** szCell[] array contains the size in bytes of each cell. This function 6668 ** replaces the current contents of page pPg with the contents of the cell 6669 ** array. 6670 ** 6671 ** Some of the cells in apCell[] may currently be stored in pPg. This 6672 ** function works around problems caused by this by making a copy of any 6673 ** such cells before overwriting the page data. 6674 ** 6675 ** The MemPage.nFree field is invalidated by this function. It is the 6676 ** responsibility of the caller to set it correctly. 6677 */ 6678 static int rebuildPage( 6679 MemPage *pPg, /* Edit this page */ 6680 int nCell, /* Final number of cells on page */ 6681 u8 **apCell, /* Array of cells */ 6682 u16 *szCell /* Array of cell sizes */ 6683 ){ 6684 const int hdr = pPg->hdrOffset; /* Offset of header on pPg */ 6685 u8 * const aData = pPg->aData; /* Pointer to data for pPg */ 6686 const int usableSize = pPg->pBt->usableSize; 6687 u8 * const pEnd = &aData[usableSize]; 6688 int i; 6689 u8 *pCellptr = pPg->aCellIdx; 6690 u8 *pTmp = sqlite3PagerTempSpace(pPg->pBt->pPager); 6691 u8 *pData; 6692 6693 i = get2byte(&aData[hdr+5]); 6694 memcpy(&pTmp[i], &aData[i], usableSize - i); 6695 6696 pData = pEnd; 6697 for(i=0; i<nCell; i++){ 6698 u8 *pCell = apCell[i]; 6699 if( SQLITE_WITHIN(pCell,aData,pEnd) ){ 6700 pCell = &pTmp[pCell - aData]; 6701 } 6702 pData -= szCell[i]; 6703 put2byte(pCellptr, (pData - aData)); 6704 pCellptr += 2; 6705 if( pData < pCellptr ) return SQLITE_CORRUPT_BKPT; 6706 memcpy(pData, pCell, szCell[i]); 6707 assert( szCell[i]==pPg->xCellSize(pPg, pCell) || CORRUPT_DB ); 6708 testcase( szCell[i]!=pPg->xCellSize(pPg,pCell) ); 6709 } 6710 6711 /* The pPg->nFree field is now set incorrectly. The caller will fix it. */ 6712 pPg->nCell = nCell; 6713 pPg->nOverflow = 0; 6714 6715 put2byte(&aData[hdr+1], 0); 6716 put2byte(&aData[hdr+3], pPg->nCell); 6717 put2byte(&aData[hdr+5], pData - aData); 6718 aData[hdr+7] = 0x00; 6719 return SQLITE_OK; 6720 } 6721 6722 /* 6723 ** Array apCell[] contains nCell pointers to b-tree cells. Array szCell 6724 ** contains the size in bytes of each such cell. This function attempts to 6725 ** add the cells stored in the array to page pPg. If it cannot (because 6726 ** the page needs to be defragmented before the cells will fit), non-zero 6727 ** is returned. Otherwise, if the cells are added successfully, zero is 6728 ** returned. 6729 ** 6730 ** Argument pCellptr points to the first entry in the cell-pointer array 6731 ** (part of page pPg) to populate. After cell apCell[0] is written to the 6732 ** page body, a 16-bit offset is written to pCellptr. And so on, for each 6733 ** cell in the array. It is the responsibility of the caller to ensure 6734 ** that it is safe to overwrite this part of the cell-pointer array. 6735 ** 6736 ** When this function is called, *ppData points to the start of the 6737 ** content area on page pPg. If the size of the content area is extended, 6738 ** *ppData is updated to point to the new start of the content area 6739 ** before returning. 6740 ** 6741 ** Finally, argument pBegin points to the byte immediately following the 6742 ** end of the space required by this page for the cell-pointer area (for 6743 ** all cells - not just those inserted by the current call). If the content 6744 ** area must be extended to before this point in order to accomodate all 6745 ** cells in apCell[], then the cells do not fit and non-zero is returned. 6746 */ 6747 static int pageInsertArray( 6748 MemPage *pPg, /* Page to add cells to */ 6749 u8 *pBegin, /* End of cell-pointer array */ 6750 u8 **ppData, /* IN/OUT: Page content -area pointer */ 6751 u8 *pCellptr, /* Pointer to cell-pointer area */ 6752 int iFirst, /* Index of first cell to add */ 6753 int nCell, /* Number of cells to add to pPg */ 6754 CellArray *pCArray /* Array of cells */ 6755 ){ 6756 int i; 6757 u8 *aData = pPg->aData; 6758 u8 *pData = *ppData; 6759 int iEnd = iFirst + nCell; 6760 assert( CORRUPT_DB || pPg->hdrOffset==0 ); /* Never called on page 1 */ 6761 for(i=iFirst; i<iEnd; i++){ 6762 int sz, rc; 6763 u8 *pSlot; 6764 sz = cachedCellSize(pCArray, i); 6765 if( (aData[1]==0 && aData[2]==0) || (pSlot = pageFindSlot(pPg,sz,&rc))==0 ){ 6766 if( (pData - pBegin)<sz ) return 1; 6767 pData -= sz; 6768 pSlot = pData; 6769 } 6770 /* pSlot and pCArray->apCell[i] will never overlap on a well-formed 6771 ** database. But they might for a corrupt database. Hence use memmove() 6772 ** since memcpy() sends SIGABORT with overlapping buffers on OpenBSD */ 6773 assert( (pSlot+sz)<=pCArray->apCell[i] 6774 || pSlot>=(pCArray->apCell[i]+sz) 6775 || CORRUPT_DB ); 6776 memmove(pSlot, pCArray->apCell[i], sz); 6777 put2byte(pCellptr, (pSlot - aData)); 6778 pCellptr += 2; 6779 } 6780 *ppData = pData; 6781 return 0; 6782 } 6783 6784 /* 6785 ** Array apCell[] contains nCell pointers to b-tree cells. Array szCell 6786 ** contains the size in bytes of each such cell. This function adds the 6787 ** space associated with each cell in the array that is currently stored 6788 ** within the body of pPg to the pPg free-list. The cell-pointers and other 6789 ** fields of the page are not updated. 6790 ** 6791 ** This function returns the total number of cells added to the free-list. 6792 */ 6793 static int pageFreeArray( 6794 MemPage *pPg, /* Page to edit */ 6795 int iFirst, /* First cell to delete */ 6796 int nCell, /* Cells to delete */ 6797 CellArray *pCArray /* Array of cells */ 6798 ){ 6799 u8 * const aData = pPg->aData; 6800 u8 * const pEnd = &aData[pPg->pBt->usableSize]; 6801 u8 * const pStart = &aData[pPg->hdrOffset + 8 + pPg->childPtrSize]; 6802 int nRet = 0; 6803 int i; 6804 int iEnd = iFirst + nCell; 6805 u8 *pFree = 0; 6806 int szFree = 0; 6807 6808 for(i=iFirst; i<iEnd; i++){ 6809 u8 *pCell = pCArray->apCell[i]; 6810 if( SQLITE_WITHIN(pCell, pStart, pEnd) ){ 6811 int sz; 6812 /* No need to use cachedCellSize() here. The sizes of all cells that 6813 ** are to be freed have already been computing while deciding which 6814 ** cells need freeing */ 6815 sz = pCArray->szCell[i]; assert( sz>0 ); 6816 if( pFree!=(pCell + sz) ){ 6817 if( pFree ){ 6818 assert( pFree>aData && (pFree - aData)<65536 ); 6819 freeSpace(pPg, (u16)(pFree - aData), szFree); 6820 } 6821 pFree = pCell; 6822 szFree = sz; 6823 if( pFree+sz>pEnd ) return 0; 6824 }else{ 6825 pFree = pCell; 6826 szFree += sz; 6827 } 6828 nRet++; 6829 } 6830 } 6831 if( pFree ){ 6832 assert( pFree>aData && (pFree - aData)<65536 ); 6833 freeSpace(pPg, (u16)(pFree - aData), szFree); 6834 } 6835 return nRet; 6836 } 6837 6838 /* 6839 ** apCell[] and szCell[] contains pointers to and sizes of all cells in the 6840 ** pages being balanced. The current page, pPg, has pPg->nCell cells starting 6841 ** with apCell[iOld]. After balancing, this page should hold nNew cells 6842 ** starting at apCell[iNew]. 6843 ** 6844 ** This routine makes the necessary adjustments to pPg so that it contains 6845 ** the correct cells after being balanced. 6846 ** 6847 ** The pPg->nFree field is invalid when this function returns. It is the 6848 ** responsibility of the caller to set it correctly. 6849 */ 6850 static int editPage( 6851 MemPage *pPg, /* Edit this page */ 6852 int iOld, /* Index of first cell currently on page */ 6853 int iNew, /* Index of new first cell on page */ 6854 int nNew, /* Final number of cells on page */ 6855 CellArray *pCArray /* Array of cells and sizes */ 6856 ){ 6857 u8 * const aData = pPg->aData; 6858 const int hdr = pPg->hdrOffset; 6859 u8 *pBegin = &pPg->aCellIdx[nNew * 2]; 6860 int nCell = pPg->nCell; /* Cells stored on pPg */ 6861 u8 *pData; 6862 u8 *pCellptr; 6863 int i; 6864 int iOldEnd = iOld + pPg->nCell + pPg->nOverflow; 6865 int iNewEnd = iNew + nNew; 6866 6867 #ifdef SQLITE_DEBUG 6868 u8 *pTmp = sqlite3PagerTempSpace(pPg->pBt->pPager); 6869 memcpy(pTmp, aData, pPg->pBt->usableSize); 6870 #endif 6871 6872 /* Remove cells from the start and end of the page */ 6873 if( iOld<iNew ){ 6874 int nShift = pageFreeArray(pPg, iOld, iNew-iOld, pCArray); 6875 memmove(pPg->aCellIdx, &pPg->aCellIdx[nShift*2], nCell*2); 6876 nCell -= nShift; 6877 } 6878 if( iNewEnd < iOldEnd ){ 6879 nCell -= pageFreeArray(pPg, iNewEnd, iOldEnd - iNewEnd, pCArray); 6880 } 6881 6882 pData = &aData[get2byteNotZero(&aData[hdr+5])]; 6883 if( pData<pBegin ) goto editpage_fail; 6884 6885 /* Add cells to the start of the page */ 6886 if( iNew<iOld ){ 6887 int nAdd = MIN(nNew,iOld-iNew); 6888 assert( (iOld-iNew)<nNew || nCell==0 || CORRUPT_DB ); 6889 pCellptr = pPg->aCellIdx; 6890 memmove(&pCellptr[nAdd*2], pCellptr, nCell*2); 6891 if( pageInsertArray( 6892 pPg, pBegin, &pData, pCellptr, 6893 iNew, nAdd, pCArray 6894 ) ) goto editpage_fail; 6895 nCell += nAdd; 6896 } 6897 6898 /* Add any overflow cells */ 6899 for(i=0; i<pPg->nOverflow; i++){ 6900 int iCell = (iOld + pPg->aiOvfl[i]) - iNew; 6901 if( iCell>=0 && iCell<nNew ){ 6902 pCellptr = &pPg->aCellIdx[iCell * 2]; 6903 memmove(&pCellptr[2], pCellptr, (nCell - iCell) * 2); 6904 nCell++; 6905 if( pageInsertArray( 6906 pPg, pBegin, &pData, pCellptr, 6907 iCell+iNew, 1, pCArray 6908 ) ) goto editpage_fail; 6909 } 6910 } 6911 6912 /* Append cells to the end of the page */ 6913 pCellptr = &pPg->aCellIdx[nCell*2]; 6914 if( pageInsertArray( 6915 pPg, pBegin, &pData, pCellptr, 6916 iNew+nCell, nNew-nCell, pCArray 6917 ) ) goto editpage_fail; 6918 6919 pPg->nCell = nNew; 6920 pPg->nOverflow = 0; 6921 6922 put2byte(&aData[hdr+3], pPg->nCell); 6923 put2byte(&aData[hdr+5], pData - aData); 6924 6925 #ifdef SQLITE_DEBUG 6926 for(i=0; i<nNew && !CORRUPT_DB; i++){ 6927 u8 *pCell = pCArray->apCell[i+iNew]; 6928 int iOff = get2byteAligned(&pPg->aCellIdx[i*2]); 6929 if( SQLITE_WITHIN(pCell, aData, &aData[pPg->pBt->usableSize]) ){ 6930 pCell = &pTmp[pCell - aData]; 6931 } 6932 assert( 0==memcmp(pCell, &aData[iOff], 6933 pCArray->pRef->xCellSize(pCArray->pRef, pCArray->apCell[i+iNew])) ); 6934 } 6935 #endif 6936 6937 return SQLITE_OK; 6938 editpage_fail: 6939 /* Unable to edit this page. Rebuild it from scratch instead. */ 6940 populateCellCache(pCArray, iNew, nNew); 6941 return rebuildPage(pPg, nNew, &pCArray->apCell[iNew], &pCArray->szCell[iNew]); 6942 } 6943 6944 /* 6945 ** The following parameters determine how many adjacent pages get involved 6946 ** in a balancing operation. NN is the number of neighbors on either side 6947 ** of the page that participate in the balancing operation. NB is the 6948 ** total number of pages that participate, including the target page and 6949 ** NN neighbors on either side. 6950 ** 6951 ** The minimum value of NN is 1 (of course). Increasing NN above 1 6952 ** (to 2 or 3) gives a modest improvement in SELECT and DELETE performance 6953 ** in exchange for a larger degradation in INSERT and UPDATE performance. 6954 ** The value of NN appears to give the best results overall. 6955 */ 6956 #define NN 1 /* Number of neighbors on either side of pPage */ 6957 #define NB (NN*2+1) /* Total pages involved in the balance */ 6958 6959 6960 #ifndef SQLITE_OMIT_QUICKBALANCE 6961 /* 6962 ** This version of balance() handles the common special case where 6963 ** a new entry is being inserted on the extreme right-end of the 6964 ** tree, in other words, when the new entry will become the largest 6965 ** entry in the tree. 6966 ** 6967 ** Instead of trying to balance the 3 right-most leaf pages, just add 6968 ** a new page to the right-hand side and put the one new entry in 6969 ** that page. This leaves the right side of the tree somewhat 6970 ** unbalanced. But odds are that we will be inserting new entries 6971 ** at the end soon afterwards so the nearly empty page will quickly 6972 ** fill up. On average. 6973 ** 6974 ** pPage is the leaf page which is the right-most page in the tree. 6975 ** pParent is its parent. pPage must have a single overflow entry 6976 ** which is also the right-most entry on the page. 6977 ** 6978 ** The pSpace buffer is used to store a temporary copy of the divider 6979 ** cell that will be inserted into pParent. Such a cell consists of a 4 6980 ** byte page number followed by a variable length integer. In other 6981 ** words, at most 13 bytes. Hence the pSpace buffer must be at 6982 ** least 13 bytes in size. 6983 */ 6984 static int balance_quick(MemPage *pParent, MemPage *pPage, u8 *pSpace){ 6985 BtShared *const pBt = pPage->pBt; /* B-Tree Database */ 6986 MemPage *pNew; /* Newly allocated page */ 6987 int rc; /* Return Code */ 6988 Pgno pgnoNew; /* Page number of pNew */ 6989 6990 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 6991 assert( sqlite3PagerIswriteable(pParent->pDbPage) ); 6992 assert( pPage->nOverflow==1 ); 6993 6994 /* This error condition is now caught prior to reaching this function */ 6995 if( NEVER(pPage->nCell==0) ) return SQLITE_CORRUPT_BKPT; 6996 6997 /* Allocate a new page. This page will become the right-sibling of 6998 ** pPage. Make the parent page writable, so that the new divider cell 6999 ** may be inserted. If both these operations are successful, proceed. 7000 */ 7001 rc = allocateBtreePage(pBt, &pNew, &pgnoNew, 0, 0); 7002 7003 if( rc==SQLITE_OK ){ 7004 7005 u8 *pOut = &pSpace[4]; 7006 u8 *pCell = pPage->apOvfl[0]; 7007 u16 szCell = pPage->xCellSize(pPage, pCell); 7008 u8 *pStop; 7009 7010 assert( sqlite3PagerIswriteable(pNew->pDbPage) ); 7011 assert( pPage->aData[0]==(PTF_INTKEY|PTF_LEAFDATA|PTF_LEAF) ); 7012 zeroPage(pNew, PTF_INTKEY|PTF_LEAFDATA|PTF_LEAF); 7013 rc = rebuildPage(pNew, 1, &pCell, &szCell); 7014 if( NEVER(rc) ) return rc; 7015 pNew->nFree = pBt->usableSize - pNew->cellOffset - 2 - szCell; 7016 7017 /* If this is an auto-vacuum database, update the pointer map 7018 ** with entries for the new page, and any pointer from the 7019 ** cell on the page to an overflow page. If either of these 7020 ** operations fails, the return code is set, but the contents 7021 ** of the parent page are still manipulated by thh code below. 7022 ** That is Ok, at this point the parent page is guaranteed to 7023 ** be marked as dirty. Returning an error code will cause a 7024 ** rollback, undoing any changes made to the parent page. 7025 */ 7026 if( ISAUTOVACUUM ){ 7027 ptrmapPut(pBt, pgnoNew, PTRMAP_BTREE, pParent->pgno, &rc); 7028 if( szCell>pNew->minLocal ){ 7029 ptrmapPutOvflPtr(pNew, pCell, &rc); 7030 } 7031 } 7032 7033 /* Create a divider cell to insert into pParent. The divider cell 7034 ** consists of a 4-byte page number (the page number of pPage) and 7035 ** a variable length key value (which must be the same value as the 7036 ** largest key on pPage). 7037 ** 7038 ** To find the largest key value on pPage, first find the right-most 7039 ** cell on pPage. The first two fields of this cell are the 7040 ** record-length (a variable length integer at most 32-bits in size) 7041 ** and the key value (a variable length integer, may have any value). 7042 ** The first of the while(...) loops below skips over the record-length 7043 ** field. The second while(...) loop copies the key value from the 7044 ** cell on pPage into the pSpace buffer. 7045 */ 7046 pCell = findCell(pPage, pPage->nCell-1); 7047 pStop = &pCell[9]; 7048 while( (*(pCell++)&0x80) && pCell<pStop ); 7049 pStop = &pCell[9]; 7050 while( ((*(pOut++) = *(pCell++))&0x80) && pCell<pStop ); 7051 7052 /* Insert the new divider cell into pParent. */ 7053 if( rc==SQLITE_OK ){ 7054 insertCell(pParent, pParent->nCell, pSpace, (int)(pOut-pSpace), 7055 0, pPage->pgno, &rc); 7056 } 7057 7058 /* Set the right-child pointer of pParent to point to the new page. */ 7059 put4byte(&pParent->aData[pParent->hdrOffset+8], pgnoNew); 7060 7061 /* Release the reference to the new page. */ 7062 releasePage(pNew); 7063 } 7064 7065 return rc; 7066 } 7067 #endif /* SQLITE_OMIT_QUICKBALANCE */ 7068 7069 #if 0 7070 /* 7071 ** This function does not contribute anything to the operation of SQLite. 7072 ** it is sometimes activated temporarily while debugging code responsible 7073 ** for setting pointer-map entries. 7074 */ 7075 static int ptrmapCheckPages(MemPage **apPage, int nPage){ 7076 int i, j; 7077 for(i=0; i<nPage; i++){ 7078 Pgno n; 7079 u8 e; 7080 MemPage *pPage = apPage[i]; 7081 BtShared *pBt = pPage->pBt; 7082 assert( pPage->isInit ); 7083 7084 for(j=0; j<pPage->nCell; j++){ 7085 CellInfo info; 7086 u8 *z; 7087 7088 z = findCell(pPage, j); 7089 pPage->xParseCell(pPage, z, &info); 7090 if( info.nLocal<info.nPayload ){ 7091 Pgno ovfl = get4byte(&z[info.nSize-4]); 7092 ptrmapGet(pBt, ovfl, &e, &n); 7093 assert( n==pPage->pgno && e==PTRMAP_OVERFLOW1 ); 7094 } 7095 if( !pPage->leaf ){ 7096 Pgno child = get4byte(z); 7097 ptrmapGet(pBt, child, &e, &n); 7098 assert( n==pPage->pgno && e==PTRMAP_BTREE ); 7099 } 7100 } 7101 if( !pPage->leaf ){ 7102 Pgno child = get4byte(&pPage->aData[pPage->hdrOffset+8]); 7103 ptrmapGet(pBt, child, &e, &n); 7104 assert( n==pPage->pgno && e==PTRMAP_BTREE ); 7105 } 7106 } 7107 return 1; 7108 } 7109 #endif 7110 7111 /* 7112 ** This function is used to copy the contents of the b-tree node stored 7113 ** on page pFrom to page pTo. If page pFrom was not a leaf page, then 7114 ** the pointer-map entries for each child page are updated so that the 7115 ** parent page stored in the pointer map is page pTo. If pFrom contained 7116 ** any cells with overflow page pointers, then the corresponding pointer 7117 ** map entries are also updated so that the parent page is page pTo. 7118 ** 7119 ** If pFrom is currently carrying any overflow cells (entries in the 7120 ** MemPage.apOvfl[] array), they are not copied to pTo. 7121 ** 7122 ** Before returning, page pTo is reinitialized using btreeInitPage(). 7123 ** 7124 ** The performance of this function is not critical. It is only used by 7125 ** the balance_shallower() and balance_deeper() procedures, neither of 7126 ** which are called often under normal circumstances. 7127 */ 7128 static void copyNodeContent(MemPage *pFrom, MemPage *pTo, int *pRC){ 7129 if( (*pRC)==SQLITE_OK ){ 7130 BtShared * const pBt = pFrom->pBt; 7131 u8 * const aFrom = pFrom->aData; 7132 u8 * const aTo = pTo->aData; 7133 int const iFromHdr = pFrom->hdrOffset; 7134 int const iToHdr = ((pTo->pgno==1) ? 100 : 0); 7135 int rc; 7136 int iData; 7137 7138 7139 assert( pFrom->isInit ); 7140 assert( pFrom->nFree>=iToHdr ); 7141 assert( get2byte(&aFrom[iFromHdr+5]) <= (int)pBt->usableSize ); 7142 7143 /* Copy the b-tree node content from page pFrom to page pTo. */ 7144 iData = get2byte(&aFrom[iFromHdr+5]); 7145 memcpy(&aTo[iData], &aFrom[iData], pBt->usableSize-iData); 7146 memcpy(&aTo[iToHdr], &aFrom[iFromHdr], pFrom->cellOffset + 2*pFrom->nCell); 7147 7148 /* Reinitialize page pTo so that the contents of the MemPage structure 7149 ** match the new data. The initialization of pTo can actually fail under 7150 ** fairly obscure circumstances, even though it is a copy of initialized 7151 ** page pFrom. 7152 */ 7153 pTo->isInit = 0; 7154 rc = btreeInitPage(pTo); 7155 if( rc!=SQLITE_OK ){ 7156 *pRC = rc; 7157 return; 7158 } 7159 7160 /* If this is an auto-vacuum database, update the pointer-map entries 7161 ** for any b-tree or overflow pages that pTo now contains the pointers to. 7162 */ 7163 if( ISAUTOVACUUM ){ 7164 *pRC = setChildPtrmaps(pTo); 7165 } 7166 } 7167 } 7168 7169 /* 7170 ** This routine redistributes cells on the iParentIdx'th child of pParent 7171 ** (hereafter "the page") and up to 2 siblings so that all pages have about the 7172 ** same amount of free space. Usually a single sibling on either side of the 7173 ** page are used in the balancing, though both siblings might come from one 7174 ** side if the page is the first or last child of its parent. If the page 7175 ** has fewer than 2 siblings (something which can only happen if the page 7176 ** is a root page or a child of a root page) then all available siblings 7177 ** participate in the balancing. 7178 ** 7179 ** The number of siblings of the page might be increased or decreased by 7180 ** one or two in an effort to keep pages nearly full but not over full. 7181 ** 7182 ** Note that when this routine is called, some of the cells on the page 7183 ** might not actually be stored in MemPage.aData[]. This can happen 7184 ** if the page is overfull. This routine ensures that all cells allocated 7185 ** to the page and its siblings fit into MemPage.aData[] before returning. 7186 ** 7187 ** In the course of balancing the page and its siblings, cells may be 7188 ** inserted into or removed from the parent page (pParent). Doing so 7189 ** may cause the parent page to become overfull or underfull. If this 7190 ** happens, it is the responsibility of the caller to invoke the correct 7191 ** balancing routine to fix this problem (see the balance() routine). 7192 ** 7193 ** If this routine fails for any reason, it might leave the database 7194 ** in a corrupted state. So if this routine fails, the database should 7195 ** be rolled back. 7196 ** 7197 ** The third argument to this function, aOvflSpace, is a pointer to a 7198 ** buffer big enough to hold one page. If while inserting cells into the parent 7199 ** page (pParent) the parent page becomes overfull, this buffer is 7200 ** used to store the parent's overflow cells. Because this function inserts 7201 ** a maximum of four divider cells into the parent page, and the maximum 7202 ** size of a cell stored within an internal node is always less than 1/4 7203 ** of the page-size, the aOvflSpace[] buffer is guaranteed to be large 7204 ** enough for all overflow cells. 7205 ** 7206 ** If aOvflSpace is set to a null pointer, this function returns 7207 ** SQLITE_NOMEM. 7208 */ 7209 static int balance_nonroot( 7210 MemPage *pParent, /* Parent page of siblings being balanced */ 7211 int iParentIdx, /* Index of "the page" in pParent */ 7212 u8 *aOvflSpace, /* page-size bytes of space for parent ovfl */ 7213 int isRoot, /* True if pParent is a root-page */ 7214 int bBulk /* True if this call is part of a bulk load */ 7215 ){ 7216 BtShared *pBt; /* The whole database */ 7217 int nMaxCells = 0; /* Allocated size of apCell, szCell, aFrom. */ 7218 int nNew = 0; /* Number of pages in apNew[] */ 7219 int nOld; /* Number of pages in apOld[] */ 7220 int i, j, k; /* Loop counters */ 7221 int nxDiv; /* Next divider slot in pParent->aCell[] */ 7222 int rc = SQLITE_OK; /* The return code */ 7223 u16 leafCorrection; /* 4 if pPage is a leaf. 0 if not */ 7224 int leafData; /* True if pPage is a leaf of a LEAFDATA tree */ 7225 int usableSpace; /* Bytes in pPage beyond the header */ 7226 int pageFlags; /* Value of pPage->aData[0] */ 7227 int iSpace1 = 0; /* First unused byte of aSpace1[] */ 7228 int iOvflSpace = 0; /* First unused byte of aOvflSpace[] */ 7229 int szScratch; /* Size of scratch memory requested */ 7230 MemPage *apOld[NB]; /* pPage and up to two siblings */ 7231 MemPage *apNew[NB+2]; /* pPage and up to NB siblings after balancing */ 7232 u8 *pRight; /* Location in parent of right-sibling pointer */ 7233 u8 *apDiv[NB-1]; /* Divider cells in pParent */ 7234 int cntNew[NB+2]; /* Index in b.paCell[] of cell after i-th page */ 7235 int cntOld[NB+2]; /* Old index in b.apCell[] */ 7236 int szNew[NB+2]; /* Combined size of cells placed on i-th page */ 7237 u8 *aSpace1; /* Space for copies of dividers cells */ 7238 Pgno pgno; /* Temp var to store a page number in */ 7239 u8 abDone[NB+2]; /* True after i'th new page is populated */ 7240 Pgno aPgno[NB+2]; /* Page numbers of new pages before shuffling */ 7241 Pgno aPgOrder[NB+2]; /* Copy of aPgno[] used for sorting pages */ 7242 u16 aPgFlags[NB+2]; /* flags field of new pages before shuffling */ 7243 CellArray b; /* Parsed information on cells being balanced */ 7244 7245 memset(abDone, 0, sizeof(abDone)); 7246 b.nCell = 0; 7247 b.apCell = 0; 7248 pBt = pParent->pBt; 7249 assert( sqlite3_mutex_held(pBt->mutex) ); 7250 assert( sqlite3PagerIswriteable(pParent->pDbPage) ); 7251 7252 #if 0 7253 TRACE(("BALANCE: begin page %d child of %d\n", pPage->pgno, pParent->pgno)); 7254 #endif 7255 7256 /* At this point pParent may have at most one overflow cell. And if 7257 ** this overflow cell is present, it must be the cell with 7258 ** index iParentIdx. This scenario comes about when this function 7259 ** is called (indirectly) from sqlite3BtreeDelete(). 7260 */ 7261 assert( pParent->nOverflow==0 || pParent->nOverflow==1 ); 7262 assert( pParent->nOverflow==0 || pParent->aiOvfl[0]==iParentIdx ); 7263 7264 if( !aOvflSpace ){ 7265 return SQLITE_NOMEM_BKPT; 7266 } 7267 7268 /* Find the sibling pages to balance. Also locate the cells in pParent 7269 ** that divide the siblings. An attempt is made to find NN siblings on 7270 ** either side of pPage. More siblings are taken from one side, however, 7271 ** if there are fewer than NN siblings on the other side. If pParent 7272 ** has NB or fewer children then all children of pParent are taken. 7273 ** 7274 ** This loop also drops the divider cells from the parent page. This 7275 ** way, the remainder of the function does not have to deal with any 7276 ** overflow cells in the parent page, since if any existed they will 7277 ** have already been removed. 7278 */ 7279 i = pParent->nOverflow + pParent->nCell; 7280 if( i<2 ){ 7281 nxDiv = 0; 7282 }else{ 7283 assert( bBulk==0 || bBulk==1 ); 7284 if( iParentIdx==0 ){ 7285 nxDiv = 0; 7286 }else if( iParentIdx==i ){ 7287 nxDiv = i-2+bBulk; 7288 }else{ 7289 nxDiv = iParentIdx-1; 7290 } 7291 i = 2-bBulk; 7292 } 7293 nOld = i+1; 7294 if( (i+nxDiv-pParent->nOverflow)==pParent->nCell ){ 7295 pRight = &pParent->aData[pParent->hdrOffset+8]; 7296 }else{ 7297 pRight = findCell(pParent, i+nxDiv-pParent->nOverflow); 7298 } 7299 pgno = get4byte(pRight); 7300 while( 1 ){ 7301 rc = getAndInitPage(pBt, pgno, &apOld[i], 0, 0); 7302 if( rc ){ 7303 memset(apOld, 0, (i+1)*sizeof(MemPage*)); 7304 goto balance_cleanup; 7305 } 7306 nMaxCells += 1+apOld[i]->nCell+apOld[i]->nOverflow; 7307 if( (i--)==0 ) break; 7308 7309 if( pParent->nOverflow && i+nxDiv==pParent->aiOvfl[0] ){ 7310 apDiv[i] = pParent->apOvfl[0]; 7311 pgno = get4byte(apDiv[i]); 7312 szNew[i] = pParent->xCellSize(pParent, apDiv[i]); 7313 pParent->nOverflow = 0; 7314 }else{ 7315 apDiv[i] = findCell(pParent, i+nxDiv-pParent->nOverflow); 7316 pgno = get4byte(apDiv[i]); 7317 szNew[i] = pParent->xCellSize(pParent, apDiv[i]); 7318 7319 /* Drop the cell from the parent page. apDiv[i] still points to 7320 ** the cell within the parent, even though it has been dropped. 7321 ** This is safe because dropping a cell only overwrites the first 7322 ** four bytes of it, and this function does not need the first 7323 ** four bytes of the divider cell. So the pointer is safe to use 7324 ** later on. 7325 ** 7326 ** But not if we are in secure-delete mode. In secure-delete mode, 7327 ** the dropCell() routine will overwrite the entire cell with zeroes. 7328 ** In this case, temporarily copy the cell into the aOvflSpace[] 7329 ** buffer. It will be copied out again as soon as the aSpace[] buffer 7330 ** is allocated. */ 7331 if( pBt->btsFlags & BTS_FAST_SECURE ){ 7332 int iOff; 7333 7334 iOff = SQLITE_PTR_TO_INT(apDiv[i]) - SQLITE_PTR_TO_INT(pParent->aData); 7335 if( (iOff+szNew[i])>(int)pBt->usableSize ){ 7336 rc = SQLITE_CORRUPT_BKPT; 7337 memset(apOld, 0, (i+1)*sizeof(MemPage*)); 7338 goto balance_cleanup; 7339 }else{ 7340 memcpy(&aOvflSpace[iOff], apDiv[i], szNew[i]); 7341 apDiv[i] = &aOvflSpace[apDiv[i]-pParent->aData]; 7342 } 7343 } 7344 dropCell(pParent, i+nxDiv-pParent->nOverflow, szNew[i], &rc); 7345 } 7346 } 7347 7348 /* Make nMaxCells a multiple of 4 in order to preserve 8-byte 7349 ** alignment */ 7350 nMaxCells = (nMaxCells + 3)&~3; 7351 7352 /* 7353 ** Allocate space for memory structures 7354 */ 7355 szScratch = 7356 nMaxCells*sizeof(u8*) /* b.apCell */ 7357 + nMaxCells*sizeof(u16) /* b.szCell */ 7358 + pBt->pageSize; /* aSpace1 */ 7359 7360 assert( szScratch<=6*(int)pBt->pageSize ); 7361 b.apCell = sqlite3StackAllocRaw(0, szScratch ); 7362 if( b.apCell==0 ){ 7363 rc = SQLITE_NOMEM_BKPT; 7364 goto balance_cleanup; 7365 } 7366 b.szCell = (u16*)&b.apCell[nMaxCells]; 7367 aSpace1 = (u8*)&b.szCell[nMaxCells]; 7368 assert( EIGHT_BYTE_ALIGNMENT(aSpace1) ); 7369 7370 /* 7371 ** Load pointers to all cells on sibling pages and the divider cells 7372 ** into the local b.apCell[] array. Make copies of the divider cells 7373 ** into space obtained from aSpace1[]. The divider cells have already 7374 ** been removed from pParent. 7375 ** 7376 ** If the siblings are on leaf pages, then the child pointers of the 7377 ** divider cells are stripped from the cells before they are copied 7378 ** into aSpace1[]. In this way, all cells in b.apCell[] are without 7379 ** child pointers. If siblings are not leaves, then all cell in 7380 ** b.apCell[] include child pointers. Either way, all cells in b.apCell[] 7381 ** are alike. 7382 ** 7383 ** leafCorrection: 4 if pPage is a leaf. 0 if pPage is not a leaf. 7384 ** leafData: 1 if pPage holds key+data and pParent holds only keys. 7385 */ 7386 b.pRef = apOld[0]; 7387 leafCorrection = b.pRef->leaf*4; 7388 leafData = b.pRef->intKeyLeaf; 7389 for(i=0; i<nOld; i++){ 7390 MemPage *pOld = apOld[i]; 7391 int limit = pOld->nCell; 7392 u8 *aData = pOld->aData; 7393 u16 maskPage = pOld->maskPage; 7394 u8 *piCell = aData + pOld->cellOffset; 7395 u8 *piEnd; 7396 7397 /* Verify that all sibling pages are of the same "type" (table-leaf, 7398 ** table-interior, index-leaf, or index-interior). 7399 */ 7400 if( pOld->aData[0]!=apOld[0]->aData[0] ){ 7401 rc = SQLITE_CORRUPT_BKPT; 7402 goto balance_cleanup; 7403 } 7404 7405 /* Load b.apCell[] with pointers to all cells in pOld. If pOld 7406 ** contains overflow cells, include them in the b.apCell[] array 7407 ** in the correct spot. 7408 ** 7409 ** Note that when there are multiple overflow cells, it is always the 7410 ** case that they are sequential and adjacent. This invariant arises 7411 ** because multiple overflows can only occurs when inserting divider 7412 ** cells into a parent on a prior balance, and divider cells are always 7413 ** adjacent and are inserted in order. There is an assert() tagged 7414 ** with "NOTE 1" in the overflow cell insertion loop to prove this 7415 ** invariant. 7416 ** 7417 ** This must be done in advance. Once the balance starts, the cell 7418 ** offset section of the btree page will be overwritten and we will no 7419 ** long be able to find the cells if a pointer to each cell is not saved 7420 ** first. 7421 */ 7422 memset(&b.szCell[b.nCell], 0, sizeof(b.szCell[0])*(limit+pOld->nOverflow)); 7423 if( pOld->nOverflow>0 ){ 7424 limit = pOld->aiOvfl[0]; 7425 for(j=0; j<limit; j++){ 7426 b.apCell[b.nCell] = aData + (maskPage & get2byteAligned(piCell)); 7427 piCell += 2; 7428 b.nCell++; 7429 } 7430 for(k=0; k<pOld->nOverflow; k++){ 7431 assert( k==0 || pOld->aiOvfl[k-1]+1==pOld->aiOvfl[k] );/* NOTE 1 */ 7432 b.apCell[b.nCell] = pOld->apOvfl[k]; 7433 b.nCell++; 7434 } 7435 } 7436 piEnd = aData + pOld->cellOffset + 2*pOld->nCell; 7437 while( piCell<piEnd ){ 7438 assert( b.nCell<nMaxCells ); 7439 b.apCell[b.nCell] = aData + (maskPage & get2byteAligned(piCell)); 7440 piCell += 2; 7441 b.nCell++; 7442 } 7443 7444 cntOld[i] = b.nCell; 7445 if( i<nOld-1 && !leafData){ 7446 u16 sz = (u16)szNew[i]; 7447 u8 *pTemp; 7448 assert( b.nCell<nMaxCells ); 7449 b.szCell[b.nCell] = sz; 7450 pTemp = &aSpace1[iSpace1]; 7451 iSpace1 += sz; 7452 assert( sz<=pBt->maxLocal+23 ); 7453 assert( iSpace1 <= (int)pBt->pageSize ); 7454 memcpy(pTemp, apDiv[i], sz); 7455 b.apCell[b.nCell] = pTemp+leafCorrection; 7456 assert( leafCorrection==0 || leafCorrection==4 ); 7457 b.szCell[b.nCell] = b.szCell[b.nCell] - leafCorrection; 7458 if( !pOld->leaf ){ 7459 assert( leafCorrection==0 ); 7460 assert( pOld->hdrOffset==0 ); 7461 /* The right pointer of the child page pOld becomes the left 7462 ** pointer of the divider cell */ 7463 memcpy(b.apCell[b.nCell], &pOld->aData[8], 4); 7464 }else{ 7465 assert( leafCorrection==4 ); 7466 while( b.szCell[b.nCell]<4 ){ 7467 /* Do not allow any cells smaller than 4 bytes. If a smaller cell 7468 ** does exist, pad it with 0x00 bytes. */ 7469 assert( b.szCell[b.nCell]==3 || CORRUPT_DB ); 7470 assert( b.apCell[b.nCell]==&aSpace1[iSpace1-3] || CORRUPT_DB ); 7471 aSpace1[iSpace1++] = 0x00; 7472 b.szCell[b.nCell]++; 7473 } 7474 } 7475 b.nCell++; 7476 } 7477 } 7478 7479 /* 7480 ** Figure out the number of pages needed to hold all b.nCell cells. 7481 ** Store this number in "k". Also compute szNew[] which is the total 7482 ** size of all cells on the i-th page and cntNew[] which is the index 7483 ** in b.apCell[] of the cell that divides page i from page i+1. 7484 ** cntNew[k] should equal b.nCell. 7485 ** 7486 ** Values computed by this block: 7487 ** 7488 ** k: The total number of sibling pages 7489 ** szNew[i]: Spaced used on the i-th sibling page. 7490 ** cntNew[i]: Index in b.apCell[] and b.szCell[] for the first cell to 7491 ** the right of the i-th sibling page. 7492 ** usableSpace: Number of bytes of space available on each sibling. 7493 ** 7494 */ 7495 usableSpace = pBt->usableSize - 12 + leafCorrection; 7496 for(i=0; i<nOld; i++){ 7497 MemPage *p = apOld[i]; 7498 szNew[i] = usableSpace - p->nFree; 7499 for(j=0; j<p->nOverflow; j++){ 7500 szNew[i] += 2 + p->xCellSize(p, p->apOvfl[j]); 7501 } 7502 cntNew[i] = cntOld[i]; 7503 } 7504 k = nOld; 7505 for(i=0; i<k; i++){ 7506 int sz; 7507 while( szNew[i]>usableSpace ){ 7508 if( i+1>=k ){ 7509 k = i+2; 7510 if( k>NB+2 ){ rc = SQLITE_CORRUPT_BKPT; goto balance_cleanup; } 7511 szNew[k-1] = 0; 7512 cntNew[k-1] = b.nCell; 7513 } 7514 sz = 2 + cachedCellSize(&b, cntNew[i]-1); 7515 szNew[i] -= sz; 7516 if( !leafData ){ 7517 if( cntNew[i]<b.nCell ){ 7518 sz = 2 + cachedCellSize(&b, cntNew[i]); 7519 }else{ 7520 sz = 0; 7521 } 7522 } 7523 szNew[i+1] += sz; 7524 cntNew[i]--; 7525 } 7526 while( cntNew[i]<b.nCell ){ 7527 sz = 2 + cachedCellSize(&b, cntNew[i]); 7528 if( szNew[i]+sz>usableSpace ) break; 7529 szNew[i] += sz; 7530 cntNew[i]++; 7531 if( !leafData ){ 7532 if( cntNew[i]<b.nCell ){ 7533 sz = 2 + cachedCellSize(&b, cntNew[i]); 7534 }else{ 7535 sz = 0; 7536 } 7537 } 7538 szNew[i+1] -= sz; 7539 } 7540 if( cntNew[i]>=b.nCell ){ 7541 k = i+1; 7542 }else if( cntNew[i] <= (i>0 ? cntNew[i-1] : 0) ){ 7543 rc = SQLITE_CORRUPT_BKPT; 7544 goto balance_cleanup; 7545 } 7546 } 7547 7548 /* 7549 ** The packing computed by the previous block is biased toward the siblings 7550 ** on the left side (siblings with smaller keys). The left siblings are 7551 ** always nearly full, while the right-most sibling might be nearly empty. 7552 ** The next block of code attempts to adjust the packing of siblings to 7553 ** get a better balance. 7554 ** 7555 ** This adjustment is more than an optimization. The packing above might 7556 ** be so out of balance as to be illegal. For example, the right-most 7557 ** sibling might be completely empty. This adjustment is not optional. 7558 */ 7559 for(i=k-1; i>0; i--){ 7560 int szRight = szNew[i]; /* Size of sibling on the right */ 7561 int szLeft = szNew[i-1]; /* Size of sibling on the left */ 7562 int r; /* Index of right-most cell in left sibling */ 7563 int d; /* Index of first cell to the left of right sibling */ 7564 7565 r = cntNew[i-1] - 1; 7566 d = r + 1 - leafData; 7567 (void)cachedCellSize(&b, d); 7568 do{ 7569 assert( d<nMaxCells ); 7570 assert( r<nMaxCells ); 7571 (void)cachedCellSize(&b, r); 7572 if( szRight!=0 7573 && (bBulk || szRight+b.szCell[d]+2 > szLeft-(b.szCell[r]+(i==k-1?0:2)))){ 7574 break; 7575 } 7576 szRight += b.szCell[d] + 2; 7577 szLeft -= b.szCell[r] + 2; 7578 cntNew[i-1] = r; 7579 r--; 7580 d--; 7581 }while( r>=0 ); 7582 szNew[i] = szRight; 7583 szNew[i-1] = szLeft; 7584 if( cntNew[i-1] <= (i>1 ? cntNew[i-2] : 0) ){ 7585 rc = SQLITE_CORRUPT_BKPT; 7586 goto balance_cleanup; 7587 } 7588 } 7589 7590 /* Sanity check: For a non-corrupt database file one of the follwing 7591 ** must be true: 7592 ** (1) We found one or more cells (cntNew[0])>0), or 7593 ** (2) pPage is a virtual root page. A virtual root page is when 7594 ** the real root page is page 1 and we are the only child of 7595 ** that page. 7596 */ 7597 assert( cntNew[0]>0 || (pParent->pgno==1 && pParent->nCell==0) || CORRUPT_DB); 7598 TRACE(("BALANCE: old: %d(nc=%d) %d(nc=%d) %d(nc=%d)\n", 7599 apOld[0]->pgno, apOld[0]->nCell, 7600 nOld>=2 ? apOld[1]->pgno : 0, nOld>=2 ? apOld[1]->nCell : 0, 7601 nOld>=3 ? apOld[2]->pgno : 0, nOld>=3 ? apOld[2]->nCell : 0 7602 )); 7603 7604 /* 7605 ** Allocate k new pages. Reuse old pages where possible. 7606 */ 7607 pageFlags = apOld[0]->aData[0]; 7608 for(i=0; i<k; i++){ 7609 MemPage *pNew; 7610 if( i<nOld ){ 7611 pNew = apNew[i] = apOld[i]; 7612 apOld[i] = 0; 7613 rc = sqlite3PagerWrite(pNew->pDbPage); 7614 nNew++; 7615 if( rc ) goto balance_cleanup; 7616 }else{ 7617 assert( i>0 ); 7618 rc = allocateBtreePage(pBt, &pNew, &pgno, (bBulk ? 1 : pgno), 0); 7619 if( rc ) goto balance_cleanup; 7620 zeroPage(pNew, pageFlags); 7621 apNew[i] = pNew; 7622 nNew++; 7623 cntOld[i] = b.nCell; 7624 7625 /* Set the pointer-map entry for the new sibling page. */ 7626 if( ISAUTOVACUUM ){ 7627 ptrmapPut(pBt, pNew->pgno, PTRMAP_BTREE, pParent->pgno, &rc); 7628 if( rc!=SQLITE_OK ){ 7629 goto balance_cleanup; 7630 } 7631 } 7632 } 7633 } 7634 7635 /* 7636 ** Reassign page numbers so that the new pages are in ascending order. 7637 ** This helps to keep entries in the disk file in order so that a scan 7638 ** of the table is closer to a linear scan through the file. That in turn 7639 ** helps the operating system to deliver pages from the disk more rapidly. 7640 ** 7641 ** An O(n^2) insertion sort algorithm is used, but since n is never more 7642 ** than (NB+2) (a small constant), that should not be a problem. 7643 ** 7644 ** When NB==3, this one optimization makes the database about 25% faster 7645 ** for large insertions and deletions. 7646 */ 7647 for(i=0; i<nNew; i++){ 7648 aPgOrder[i] = aPgno[i] = apNew[i]->pgno; 7649 aPgFlags[i] = apNew[i]->pDbPage->flags; 7650 for(j=0; j<i; j++){ 7651 if( aPgno[j]==aPgno[i] ){ 7652 /* This branch is taken if the set of sibling pages somehow contains 7653 ** duplicate entries. This can happen if the database is corrupt. 7654 ** It would be simpler to detect this as part of the loop below, but 7655 ** we do the detection here in order to avoid populating the pager 7656 ** cache with two separate objects associated with the same 7657 ** page number. */ 7658 assert( CORRUPT_DB ); 7659 rc = SQLITE_CORRUPT_BKPT; 7660 goto balance_cleanup; 7661 } 7662 } 7663 } 7664 for(i=0; i<nNew; i++){ 7665 int iBest = 0; /* aPgno[] index of page number to use */ 7666 for(j=1; j<nNew; j++){ 7667 if( aPgOrder[j]<aPgOrder[iBest] ) iBest = j; 7668 } 7669 pgno = aPgOrder[iBest]; 7670 aPgOrder[iBest] = 0xffffffff; 7671 if( iBest!=i ){ 7672 if( iBest>i ){ 7673 sqlite3PagerRekey(apNew[iBest]->pDbPage, pBt->nPage+iBest+1, 0); 7674 } 7675 sqlite3PagerRekey(apNew[i]->pDbPage, pgno, aPgFlags[iBest]); 7676 apNew[i]->pgno = pgno; 7677 } 7678 } 7679 7680 TRACE(("BALANCE: new: %d(%d nc=%d) %d(%d nc=%d) %d(%d nc=%d) " 7681 "%d(%d nc=%d) %d(%d nc=%d)\n", 7682 apNew[0]->pgno, szNew[0], cntNew[0], 7683 nNew>=2 ? apNew[1]->pgno : 0, nNew>=2 ? szNew[1] : 0, 7684 nNew>=2 ? cntNew[1] - cntNew[0] - !leafData : 0, 7685 nNew>=3 ? apNew[2]->pgno : 0, nNew>=3 ? szNew[2] : 0, 7686 nNew>=3 ? cntNew[2] - cntNew[1] - !leafData : 0, 7687 nNew>=4 ? apNew[3]->pgno : 0, nNew>=4 ? szNew[3] : 0, 7688 nNew>=4 ? cntNew[3] - cntNew[2] - !leafData : 0, 7689 nNew>=5 ? apNew[4]->pgno : 0, nNew>=5 ? szNew[4] : 0, 7690 nNew>=5 ? cntNew[4] - cntNew[3] - !leafData : 0 7691 )); 7692 7693 assert( sqlite3PagerIswriteable(pParent->pDbPage) ); 7694 put4byte(pRight, apNew[nNew-1]->pgno); 7695 7696 /* If the sibling pages are not leaves, ensure that the right-child pointer 7697 ** of the right-most new sibling page is set to the value that was 7698 ** originally in the same field of the right-most old sibling page. */ 7699 if( (pageFlags & PTF_LEAF)==0 && nOld!=nNew ){ 7700 MemPage *pOld = (nNew>nOld ? apNew : apOld)[nOld-1]; 7701 memcpy(&apNew[nNew-1]->aData[8], &pOld->aData[8], 4); 7702 } 7703 7704 /* Make any required updates to pointer map entries associated with 7705 ** cells stored on sibling pages following the balance operation. Pointer 7706 ** map entries associated with divider cells are set by the insertCell() 7707 ** routine. The associated pointer map entries are: 7708 ** 7709 ** a) if the cell contains a reference to an overflow chain, the 7710 ** entry associated with the first page in the overflow chain, and 7711 ** 7712 ** b) if the sibling pages are not leaves, the child page associated 7713 ** with the cell. 7714 ** 7715 ** If the sibling pages are not leaves, then the pointer map entry 7716 ** associated with the right-child of each sibling may also need to be 7717 ** updated. This happens below, after the sibling pages have been 7718 ** populated, not here. 7719 */ 7720 if( ISAUTOVACUUM ){ 7721 MemPage *pNew = apNew[0]; 7722 u8 *aOld = pNew->aData; 7723 int cntOldNext = pNew->nCell + pNew->nOverflow; 7724 int usableSize = pBt->usableSize; 7725 int iNew = 0; 7726 int iOld = 0; 7727 7728 for(i=0; i<b.nCell; i++){ 7729 u8 *pCell = b.apCell[i]; 7730 if( i==cntOldNext ){ 7731 MemPage *pOld = (++iOld)<nNew ? apNew[iOld] : apOld[iOld]; 7732 cntOldNext += pOld->nCell + pOld->nOverflow + !leafData; 7733 aOld = pOld->aData; 7734 } 7735 if( i==cntNew[iNew] ){ 7736 pNew = apNew[++iNew]; 7737 if( !leafData ) continue; 7738 } 7739 7740 /* Cell pCell is destined for new sibling page pNew. Originally, it 7741 ** was either part of sibling page iOld (possibly an overflow cell), 7742 ** or else the divider cell to the left of sibling page iOld. So, 7743 ** if sibling page iOld had the same page number as pNew, and if 7744 ** pCell really was a part of sibling page iOld (not a divider or 7745 ** overflow cell), we can skip updating the pointer map entries. */ 7746 if( iOld>=nNew 7747 || pNew->pgno!=aPgno[iOld] 7748 || !SQLITE_WITHIN(pCell,aOld,&aOld[usableSize]) 7749 ){ 7750 if( !leafCorrection ){ 7751 ptrmapPut(pBt, get4byte(pCell), PTRMAP_BTREE, pNew->pgno, &rc); 7752 } 7753 if( cachedCellSize(&b,i)>pNew->minLocal ){ 7754 ptrmapPutOvflPtr(pNew, pCell, &rc); 7755 } 7756 if( rc ) goto balance_cleanup; 7757 } 7758 } 7759 } 7760 7761 /* Insert new divider cells into pParent. */ 7762 for(i=0; i<nNew-1; i++){ 7763 u8 *pCell; 7764 u8 *pTemp; 7765 int sz; 7766 MemPage *pNew = apNew[i]; 7767 j = cntNew[i]; 7768 7769 assert( j<nMaxCells ); 7770 assert( b.apCell[j]!=0 ); 7771 pCell = b.apCell[j]; 7772 sz = b.szCell[j] + leafCorrection; 7773 pTemp = &aOvflSpace[iOvflSpace]; 7774 if( !pNew->leaf ){ 7775 memcpy(&pNew->aData[8], pCell, 4); 7776 }else if( leafData ){ 7777 /* If the tree is a leaf-data tree, and the siblings are leaves, 7778 ** then there is no divider cell in b.apCell[]. Instead, the divider 7779 ** cell consists of the integer key for the right-most cell of 7780 ** the sibling-page assembled above only. 7781 */ 7782 CellInfo info; 7783 j--; 7784 pNew->xParseCell(pNew, b.apCell[j], &info); 7785 pCell = pTemp; 7786 sz = 4 + putVarint(&pCell[4], info.nKey); 7787 pTemp = 0; 7788 }else{ 7789 pCell -= 4; 7790 /* Obscure case for non-leaf-data trees: If the cell at pCell was 7791 ** previously stored on a leaf node, and its reported size was 4 7792 ** bytes, then it may actually be smaller than this 7793 ** (see btreeParseCellPtr(), 4 bytes is the minimum size of 7794 ** any cell). But it is important to pass the correct size to 7795 ** insertCell(), so reparse the cell now. 7796 ** 7797 ** This can only happen for b-trees used to evaluate "IN (SELECT ...)" 7798 ** and WITHOUT ROWID tables with exactly one column which is the 7799 ** primary key. 7800 */ 7801 if( b.szCell[j]==4 ){ 7802 assert(leafCorrection==4); 7803 sz = pParent->xCellSize(pParent, pCell); 7804 } 7805 } 7806 iOvflSpace += sz; 7807 assert( sz<=pBt->maxLocal+23 ); 7808 assert( iOvflSpace <= (int)pBt->pageSize ); 7809 insertCell(pParent, nxDiv+i, pCell, sz, pTemp, pNew->pgno, &rc); 7810 if( rc!=SQLITE_OK ) goto balance_cleanup; 7811 assert( sqlite3PagerIswriteable(pParent->pDbPage) ); 7812 } 7813 7814 /* Now update the actual sibling pages. The order in which they are updated 7815 ** is important, as this code needs to avoid disrupting any page from which 7816 ** cells may still to be read. In practice, this means: 7817 ** 7818 ** (1) If cells are moving left (from apNew[iPg] to apNew[iPg-1]) 7819 ** then it is not safe to update page apNew[iPg] until after 7820 ** the left-hand sibling apNew[iPg-1] has been updated. 7821 ** 7822 ** (2) If cells are moving right (from apNew[iPg] to apNew[iPg+1]) 7823 ** then it is not safe to update page apNew[iPg] until after 7824 ** the right-hand sibling apNew[iPg+1] has been updated. 7825 ** 7826 ** If neither of the above apply, the page is safe to update. 7827 ** 7828 ** The iPg value in the following loop starts at nNew-1 goes down 7829 ** to 0, then back up to nNew-1 again, thus making two passes over 7830 ** the pages. On the initial downward pass, only condition (1) above 7831 ** needs to be tested because (2) will always be true from the previous 7832 ** step. On the upward pass, both conditions are always true, so the 7833 ** upwards pass simply processes pages that were missed on the downward 7834 ** pass. 7835 */ 7836 for(i=1-nNew; i<nNew; i++){ 7837 int iPg = i<0 ? -i : i; 7838 assert( iPg>=0 && iPg<nNew ); 7839 if( abDone[iPg] ) continue; /* Skip pages already processed */ 7840 if( i>=0 /* On the upwards pass, or... */ 7841 || cntOld[iPg-1]>=cntNew[iPg-1] /* Condition (1) is true */ 7842 ){ 7843 int iNew; 7844 int iOld; 7845 int nNewCell; 7846 7847 /* Verify condition (1): If cells are moving left, update iPg 7848 ** only after iPg-1 has already been updated. */ 7849 assert( iPg==0 || cntOld[iPg-1]>=cntNew[iPg-1] || abDone[iPg-1] ); 7850 7851 /* Verify condition (2): If cells are moving right, update iPg 7852 ** only after iPg+1 has already been updated. */ 7853 assert( cntNew[iPg]>=cntOld[iPg] || abDone[iPg+1] ); 7854 7855 if( iPg==0 ){ 7856 iNew = iOld = 0; 7857 nNewCell = cntNew[0]; 7858 }else{ 7859 iOld = iPg<nOld ? (cntOld[iPg-1] + !leafData) : b.nCell; 7860 iNew = cntNew[iPg-1] + !leafData; 7861 nNewCell = cntNew[iPg] - iNew; 7862 } 7863 7864 rc = editPage(apNew[iPg], iOld, iNew, nNewCell, &b); 7865 if( rc ) goto balance_cleanup; 7866 abDone[iPg]++; 7867 apNew[iPg]->nFree = usableSpace-szNew[iPg]; 7868 assert( apNew[iPg]->nOverflow==0 ); 7869 assert( apNew[iPg]->nCell==nNewCell ); 7870 } 7871 } 7872 7873 /* All pages have been processed exactly once */ 7874 assert( memcmp(abDone, "\01\01\01\01\01", nNew)==0 ); 7875 7876 assert( nOld>0 ); 7877 assert( nNew>0 ); 7878 7879 if( isRoot && pParent->nCell==0 && pParent->hdrOffset<=apNew[0]->nFree ){ 7880 /* The root page of the b-tree now contains no cells. The only sibling 7881 ** page is the right-child of the parent. Copy the contents of the 7882 ** child page into the parent, decreasing the overall height of the 7883 ** b-tree structure by one. This is described as the "balance-shallower" 7884 ** sub-algorithm in some documentation. 7885 ** 7886 ** If this is an auto-vacuum database, the call to copyNodeContent() 7887 ** sets all pointer-map entries corresponding to database image pages 7888 ** for which the pointer is stored within the content being copied. 7889 ** 7890 ** It is critical that the child page be defragmented before being 7891 ** copied into the parent, because if the parent is page 1 then it will 7892 ** by smaller than the child due to the database header, and so all the 7893 ** free space needs to be up front. 7894 */ 7895 assert( nNew==1 || CORRUPT_DB ); 7896 rc = defragmentPage(apNew[0], -1); 7897 testcase( rc!=SQLITE_OK ); 7898 assert( apNew[0]->nFree == 7899 (get2byte(&apNew[0]->aData[5])-apNew[0]->cellOffset-apNew[0]->nCell*2) 7900 || rc!=SQLITE_OK 7901 ); 7902 copyNodeContent(apNew[0], pParent, &rc); 7903 freePage(apNew[0], &rc); 7904 }else if( ISAUTOVACUUM && !leafCorrection ){ 7905 /* Fix the pointer map entries associated with the right-child of each 7906 ** sibling page. All other pointer map entries have already been taken 7907 ** care of. */ 7908 for(i=0; i<nNew; i++){ 7909 u32 key = get4byte(&apNew[i]->aData[8]); 7910 ptrmapPut(pBt, key, PTRMAP_BTREE, apNew[i]->pgno, &rc); 7911 } 7912 } 7913 7914 assert( pParent->isInit ); 7915 TRACE(("BALANCE: finished: old=%d new=%d cells=%d\n", 7916 nOld, nNew, b.nCell)); 7917 7918 /* Free any old pages that were not reused as new pages. 7919 */ 7920 for(i=nNew; i<nOld; i++){ 7921 freePage(apOld[i], &rc); 7922 } 7923 7924 #if 0 7925 if( ISAUTOVACUUM && rc==SQLITE_OK && apNew[0]->isInit ){ 7926 /* The ptrmapCheckPages() contains assert() statements that verify that 7927 ** all pointer map pages are set correctly. This is helpful while 7928 ** debugging. This is usually disabled because a corrupt database may 7929 ** cause an assert() statement to fail. */ 7930 ptrmapCheckPages(apNew, nNew); 7931 ptrmapCheckPages(&pParent, 1); 7932 } 7933 #endif 7934 7935 /* 7936 ** Cleanup before returning. 7937 */ 7938 balance_cleanup: 7939 sqlite3StackFree(0, b.apCell); 7940 for(i=0; i<nOld; i++){ 7941 releasePage(apOld[i]); 7942 } 7943 for(i=0; i<nNew; i++){ 7944 releasePage(apNew[i]); 7945 } 7946 7947 return rc; 7948 } 7949 7950 7951 /* 7952 ** This function is called when the root page of a b-tree structure is 7953 ** overfull (has one or more overflow pages). 7954 ** 7955 ** A new child page is allocated and the contents of the current root 7956 ** page, including overflow cells, are copied into the child. The root 7957 ** page is then overwritten to make it an empty page with the right-child 7958 ** pointer pointing to the new page. 7959 ** 7960 ** Before returning, all pointer-map entries corresponding to pages 7961 ** that the new child-page now contains pointers to are updated. The 7962 ** entry corresponding to the new right-child pointer of the root 7963 ** page is also updated. 7964 ** 7965 ** If successful, *ppChild is set to contain a reference to the child 7966 ** page and SQLITE_OK is returned. In this case the caller is required 7967 ** to call releasePage() on *ppChild exactly once. If an error occurs, 7968 ** an error code is returned and *ppChild is set to 0. 7969 */ 7970 static int balance_deeper(MemPage *pRoot, MemPage **ppChild){ 7971 int rc; /* Return value from subprocedures */ 7972 MemPage *pChild = 0; /* Pointer to a new child page */ 7973 Pgno pgnoChild = 0; /* Page number of the new child page */ 7974 BtShared *pBt = pRoot->pBt; /* The BTree */ 7975 7976 assert( pRoot->nOverflow>0 ); 7977 assert( sqlite3_mutex_held(pBt->mutex) ); 7978 7979 /* Make pRoot, the root page of the b-tree, writable. Allocate a new 7980 ** page that will become the new right-child of pPage. Copy the contents 7981 ** of the node stored on pRoot into the new child page. 7982 */ 7983 rc = sqlite3PagerWrite(pRoot->pDbPage); 7984 if( rc==SQLITE_OK ){ 7985 rc = allocateBtreePage(pBt,&pChild,&pgnoChild,pRoot->pgno,0); 7986 copyNodeContent(pRoot, pChild, &rc); 7987 if( ISAUTOVACUUM ){ 7988 ptrmapPut(pBt, pgnoChild, PTRMAP_BTREE, pRoot->pgno, &rc); 7989 } 7990 } 7991 if( rc ){ 7992 *ppChild = 0; 7993 releasePage(pChild); 7994 return rc; 7995 } 7996 assert( sqlite3PagerIswriteable(pChild->pDbPage) ); 7997 assert( sqlite3PagerIswriteable(pRoot->pDbPage) ); 7998 assert( pChild->nCell==pRoot->nCell ); 7999 8000 TRACE(("BALANCE: copy root %d into %d\n", pRoot->pgno, pChild->pgno)); 8001 8002 /* Copy the overflow cells from pRoot to pChild */ 8003 memcpy(pChild->aiOvfl, pRoot->aiOvfl, 8004 pRoot->nOverflow*sizeof(pRoot->aiOvfl[0])); 8005 memcpy(pChild->apOvfl, pRoot->apOvfl, 8006 pRoot->nOverflow*sizeof(pRoot->apOvfl[0])); 8007 pChild->nOverflow = pRoot->nOverflow; 8008 8009 /* Zero the contents of pRoot. Then install pChild as the right-child. */ 8010 zeroPage(pRoot, pChild->aData[0] & ~PTF_LEAF); 8011 put4byte(&pRoot->aData[pRoot->hdrOffset+8], pgnoChild); 8012 8013 *ppChild = pChild; 8014 return SQLITE_OK; 8015 } 8016 8017 /* 8018 ** The page that pCur currently points to has just been modified in 8019 ** some way. This function figures out if this modification means the 8020 ** tree needs to be balanced, and if so calls the appropriate balancing 8021 ** routine. Balancing routines are: 8022 ** 8023 ** balance_quick() 8024 ** balance_deeper() 8025 ** balance_nonroot() 8026 */ 8027 static int balance(BtCursor *pCur){ 8028 int rc = SQLITE_OK; 8029 const int nMin = pCur->pBt->usableSize * 2 / 3; 8030 u8 aBalanceQuickSpace[13]; 8031 u8 *pFree = 0; 8032 8033 VVA_ONLY( int balance_quick_called = 0 ); 8034 VVA_ONLY( int balance_deeper_called = 0 ); 8035 8036 do { 8037 int iPage = pCur->iPage; 8038 MemPage *pPage = pCur->pPage; 8039 8040 if( iPage==0 ){ 8041 if( pPage->nOverflow ){ 8042 /* The root page of the b-tree is overfull. In this case call the 8043 ** balance_deeper() function to create a new child for the root-page 8044 ** and copy the current contents of the root-page to it. The 8045 ** next iteration of the do-loop will balance the child page. 8046 */ 8047 assert( balance_deeper_called==0 ); 8048 VVA_ONLY( balance_deeper_called++ ); 8049 rc = balance_deeper(pPage, &pCur->apPage[1]); 8050 if( rc==SQLITE_OK ){ 8051 pCur->iPage = 1; 8052 pCur->ix = 0; 8053 pCur->aiIdx[0] = 0; 8054 pCur->apPage[0] = pPage; 8055 pCur->pPage = pCur->apPage[1]; 8056 assert( pCur->pPage->nOverflow ); 8057 } 8058 }else{ 8059 break; 8060 } 8061 }else if( pPage->nOverflow==0 && pPage->nFree<=nMin ){ 8062 break; 8063 }else{ 8064 MemPage * const pParent = pCur->apPage[iPage-1]; 8065 int const iIdx = pCur->aiIdx[iPage-1]; 8066 8067 rc = sqlite3PagerWrite(pParent->pDbPage); 8068 if( rc==SQLITE_OK ){ 8069 #ifndef SQLITE_OMIT_QUICKBALANCE 8070 if( pPage->intKeyLeaf 8071 && pPage->nOverflow==1 8072 && pPage->aiOvfl[0]==pPage->nCell 8073 && pParent->pgno!=1 8074 && pParent->nCell==iIdx 8075 ){ 8076 /* Call balance_quick() to create a new sibling of pPage on which 8077 ** to store the overflow cell. balance_quick() inserts a new cell 8078 ** into pParent, which may cause pParent overflow. If this 8079 ** happens, the next iteration of the do-loop will balance pParent 8080 ** use either balance_nonroot() or balance_deeper(). Until this 8081 ** happens, the overflow cell is stored in the aBalanceQuickSpace[] 8082 ** buffer. 8083 ** 8084 ** The purpose of the following assert() is to check that only a 8085 ** single call to balance_quick() is made for each call to this 8086 ** function. If this were not verified, a subtle bug involving reuse 8087 ** of the aBalanceQuickSpace[] might sneak in. 8088 */ 8089 assert( balance_quick_called==0 ); 8090 VVA_ONLY( balance_quick_called++ ); 8091 rc = balance_quick(pParent, pPage, aBalanceQuickSpace); 8092 }else 8093 #endif 8094 { 8095 /* In this case, call balance_nonroot() to redistribute cells 8096 ** between pPage and up to 2 of its sibling pages. This involves 8097 ** modifying the contents of pParent, which may cause pParent to 8098 ** become overfull or underfull. The next iteration of the do-loop 8099 ** will balance the parent page to correct this. 8100 ** 8101 ** If the parent page becomes overfull, the overflow cell or cells 8102 ** are stored in the pSpace buffer allocated immediately below. 8103 ** A subsequent iteration of the do-loop will deal with this by 8104 ** calling balance_nonroot() (balance_deeper() may be called first, 8105 ** but it doesn't deal with overflow cells - just moves them to a 8106 ** different page). Once this subsequent call to balance_nonroot() 8107 ** has completed, it is safe to release the pSpace buffer used by 8108 ** the previous call, as the overflow cell data will have been 8109 ** copied either into the body of a database page or into the new 8110 ** pSpace buffer passed to the latter call to balance_nonroot(). 8111 */ 8112 u8 *pSpace = sqlite3PageMalloc(pCur->pBt->pageSize); 8113 rc = balance_nonroot(pParent, iIdx, pSpace, iPage==1, 8114 pCur->hints&BTREE_BULKLOAD); 8115 if( pFree ){ 8116 /* If pFree is not NULL, it points to the pSpace buffer used 8117 ** by a previous call to balance_nonroot(). Its contents are 8118 ** now stored either on real database pages or within the 8119 ** new pSpace buffer, so it may be safely freed here. */ 8120 sqlite3PageFree(pFree); 8121 } 8122 8123 /* The pSpace buffer will be freed after the next call to 8124 ** balance_nonroot(), or just before this function returns, whichever 8125 ** comes first. */ 8126 pFree = pSpace; 8127 } 8128 } 8129 8130 pPage->nOverflow = 0; 8131 8132 /* The next iteration of the do-loop balances the parent page. */ 8133 releasePage(pPage); 8134 pCur->iPage--; 8135 assert( pCur->iPage>=0 ); 8136 pCur->pPage = pCur->apPage[pCur->iPage]; 8137 } 8138 }while( rc==SQLITE_OK ); 8139 8140 if( pFree ){ 8141 sqlite3PageFree(pFree); 8142 } 8143 return rc; 8144 } 8145 8146 8147 /* 8148 ** Insert a new record into the BTree. The content of the new record 8149 ** is described by the pX object. The pCur cursor is used only to 8150 ** define what table the record should be inserted into, and is left 8151 ** pointing at a random location. 8152 ** 8153 ** For a table btree (used for rowid tables), only the pX.nKey value of 8154 ** the key is used. The pX.pKey value must be NULL. The pX.nKey is the 8155 ** rowid or INTEGER PRIMARY KEY of the row. The pX.nData,pData,nZero fields 8156 ** hold the content of the row. 8157 ** 8158 ** For an index btree (used for indexes and WITHOUT ROWID tables), the 8159 ** key is an arbitrary byte sequence stored in pX.pKey,nKey. The 8160 ** pX.pData,nData,nZero fields must be zero. 8161 ** 8162 ** If the seekResult parameter is non-zero, then a successful call to 8163 ** MovetoUnpacked() to seek cursor pCur to (pKey,nKey) has already 8164 ** been performed. In other words, if seekResult!=0 then the cursor 8165 ** is currently pointing to a cell that will be adjacent to the cell 8166 ** to be inserted. If seekResult<0 then pCur points to a cell that is 8167 ** smaller then (pKey,nKey). If seekResult>0 then pCur points to a cell 8168 ** that is larger than (pKey,nKey). 8169 ** 8170 ** If seekResult==0, that means pCur is pointing at some unknown location. 8171 ** In that case, this routine must seek the cursor to the correct insertion 8172 ** point for (pKey,nKey) before doing the insertion. For index btrees, 8173 ** if pX->nMem is non-zero, then pX->aMem contains pointers to the unpacked 8174 ** key values and pX->aMem can be used instead of pX->pKey to avoid having 8175 ** to decode the key. 8176 */ 8177 int sqlite3BtreeInsert( 8178 BtCursor *pCur, /* Insert data into the table of this cursor */ 8179 const BtreePayload *pX, /* Content of the row to be inserted */ 8180 int flags, /* True if this is likely an append */ 8181 int seekResult /* Result of prior MovetoUnpacked() call */ 8182 ){ 8183 int rc; 8184 int loc = seekResult; /* -1: before desired location +1: after */ 8185 int szNew = 0; 8186 int idx; 8187 MemPage *pPage; 8188 Btree *p = pCur->pBtree; 8189 BtShared *pBt = p->pBt; 8190 unsigned char *oldCell; 8191 unsigned char *newCell = 0; 8192 8193 assert( (flags & (BTREE_SAVEPOSITION|BTREE_APPEND))==flags ); 8194 8195 if( pCur->eState==CURSOR_FAULT ){ 8196 assert( pCur->skipNext!=SQLITE_OK ); 8197 return pCur->skipNext; 8198 } 8199 8200 assert( cursorOwnsBtShared(pCur) ); 8201 assert( (pCur->curFlags & BTCF_WriteFlag)!=0 8202 && pBt->inTransaction==TRANS_WRITE 8203 && (pBt->btsFlags & BTS_READ_ONLY)==0 ); 8204 assert( hasSharedCacheTableLock(p, pCur->pgnoRoot, pCur->pKeyInfo!=0, 2) ); 8205 8206 /* Assert that the caller has been consistent. If this cursor was opened 8207 ** expecting an index b-tree, then the caller should be inserting blob 8208 ** keys with no associated data. If the cursor was opened expecting an 8209 ** intkey table, the caller should be inserting integer keys with a 8210 ** blob of associated data. */ 8211 assert( (pX->pKey==0)==(pCur->pKeyInfo==0) ); 8212 8213 /* Save the positions of any other cursors open on this table. 8214 ** 8215 ** In some cases, the call to btreeMoveto() below is a no-op. For 8216 ** example, when inserting data into a table with auto-generated integer 8217 ** keys, the VDBE layer invokes sqlite3BtreeLast() to figure out the 8218 ** integer key to use. It then calls this function to actually insert the 8219 ** data into the intkey B-Tree. In this case btreeMoveto() recognizes 8220 ** that the cursor is already where it needs to be and returns without 8221 ** doing any work. To avoid thwarting these optimizations, it is important 8222 ** not to clear the cursor here. 8223 */ 8224 if( pCur->curFlags & BTCF_Multiple ){ 8225 rc = saveAllCursors(pBt, pCur->pgnoRoot, pCur); 8226 if( rc ) return rc; 8227 } 8228 8229 if( pCur->pKeyInfo==0 ){ 8230 assert( pX->pKey==0 ); 8231 /* If this is an insert into a table b-tree, invalidate any incrblob 8232 ** cursors open on the row being replaced */ 8233 invalidateIncrblobCursors(p, pCur->pgnoRoot, pX->nKey, 0); 8234 8235 /* If BTREE_SAVEPOSITION is set, the cursor must already be pointing 8236 ** to a row with the same key as the new entry being inserted. */ 8237 assert( (flags & BTREE_SAVEPOSITION)==0 || 8238 ((pCur->curFlags&BTCF_ValidNKey)!=0 && pX->nKey==pCur->info.nKey) ); 8239 8240 /* If the cursor is currently on the last row and we are appending a 8241 ** new row onto the end, set the "loc" to avoid an unnecessary 8242 ** btreeMoveto() call */ 8243 if( (pCur->curFlags&BTCF_ValidNKey)!=0 && pX->nKey==pCur->info.nKey ){ 8244 loc = 0; 8245 }else if( loc==0 ){ 8246 rc = sqlite3BtreeMovetoUnpacked(pCur, 0, pX->nKey, flags!=0, &loc); 8247 if( rc ) return rc; 8248 } 8249 }else if( loc==0 && (flags & BTREE_SAVEPOSITION)==0 ){ 8250 if( pX->nMem ){ 8251 UnpackedRecord r; 8252 r.pKeyInfo = pCur->pKeyInfo; 8253 r.aMem = pX->aMem; 8254 r.nField = pX->nMem; 8255 r.default_rc = 0; 8256 r.errCode = 0; 8257 r.r1 = 0; 8258 r.r2 = 0; 8259 r.eqSeen = 0; 8260 rc = sqlite3BtreeMovetoUnpacked(pCur, &r, 0, flags!=0, &loc); 8261 }else{ 8262 rc = btreeMoveto(pCur, pX->pKey, pX->nKey, flags!=0, &loc); 8263 } 8264 if( rc ) return rc; 8265 } 8266 assert( pCur->eState==CURSOR_VALID || (pCur->eState==CURSOR_INVALID && loc) ); 8267 8268 pPage = pCur->pPage; 8269 assert( pPage->intKey || pX->nKey>=0 ); 8270 assert( pPage->leaf || !pPage->intKey ); 8271 8272 TRACE(("INSERT: table=%d nkey=%lld ndata=%d page=%d %s\n", 8273 pCur->pgnoRoot, pX->nKey, pX->nData, pPage->pgno, 8274 loc==0 ? "overwrite" : "new entry")); 8275 assert( pPage->isInit ); 8276 newCell = pBt->pTmpSpace; 8277 assert( newCell!=0 ); 8278 rc = fillInCell(pPage, newCell, pX, &szNew); 8279 if( rc ) goto end_insert; 8280 assert( szNew==pPage->xCellSize(pPage, newCell) ); 8281 assert( szNew <= MX_CELL_SIZE(pBt) ); 8282 idx = pCur->ix; 8283 if( loc==0 ){ 8284 CellInfo info; 8285 assert( idx<pPage->nCell ); 8286 rc = sqlite3PagerWrite(pPage->pDbPage); 8287 if( rc ){ 8288 goto end_insert; 8289 } 8290 oldCell = findCell(pPage, idx); 8291 if( !pPage->leaf ){ 8292 memcpy(newCell, oldCell, 4); 8293 } 8294 rc = clearCell(pPage, oldCell, &info); 8295 if( info.nSize==szNew && info.nLocal==info.nPayload 8296 && (!ISAUTOVACUUM || szNew<pPage->minLocal) 8297 ){ 8298 /* Overwrite the old cell with the new if they are the same size. 8299 ** We could also try to do this if the old cell is smaller, then add 8300 ** the leftover space to the free list. But experiments show that 8301 ** doing that is no faster then skipping this optimization and just 8302 ** calling dropCell() and insertCell(). 8303 ** 8304 ** This optimization cannot be used on an autovacuum database if the 8305 ** new entry uses overflow pages, as the insertCell() call below is 8306 ** necessary to add the PTRMAP_OVERFLOW1 pointer-map entry. */ 8307 assert( rc==SQLITE_OK ); /* clearCell never fails when nLocal==nPayload */ 8308 if( oldCell+szNew > pPage->aDataEnd ) return SQLITE_CORRUPT_BKPT; 8309 memcpy(oldCell, newCell, szNew); 8310 return SQLITE_OK; 8311 } 8312 dropCell(pPage, idx, info.nSize, &rc); 8313 if( rc ) goto end_insert; 8314 }else if( loc<0 && pPage->nCell>0 ){ 8315 assert( pPage->leaf ); 8316 idx = ++pCur->ix; 8317 pCur->curFlags &= ~BTCF_ValidNKey; 8318 }else{ 8319 assert( pPage->leaf ); 8320 } 8321 insertCell(pPage, idx, newCell, szNew, 0, 0, &rc); 8322 assert( pPage->nOverflow==0 || rc==SQLITE_OK ); 8323 assert( rc!=SQLITE_OK || pPage->nCell>0 || pPage->nOverflow>0 ); 8324 8325 /* If no error has occurred and pPage has an overflow cell, call balance() 8326 ** to redistribute the cells within the tree. Since balance() may move 8327 ** the cursor, zero the BtCursor.info.nSize and BTCF_ValidNKey 8328 ** variables. 8329 ** 8330 ** Previous versions of SQLite called moveToRoot() to move the cursor 8331 ** back to the root page as balance() used to invalidate the contents 8332 ** of BtCursor.apPage[] and BtCursor.aiIdx[]. Instead of doing that, 8333 ** set the cursor state to "invalid". This makes common insert operations 8334 ** slightly faster. 8335 ** 8336 ** There is a subtle but important optimization here too. When inserting 8337 ** multiple records into an intkey b-tree using a single cursor (as can 8338 ** happen while processing an "INSERT INTO ... SELECT" statement), it 8339 ** is advantageous to leave the cursor pointing to the last entry in 8340 ** the b-tree if possible. If the cursor is left pointing to the last 8341 ** entry in the table, and the next row inserted has an integer key 8342 ** larger than the largest existing key, it is possible to insert the 8343 ** row without seeking the cursor. This can be a big performance boost. 8344 */ 8345 pCur->info.nSize = 0; 8346 if( pPage->nOverflow ){ 8347 assert( rc==SQLITE_OK ); 8348 pCur->curFlags &= ~(BTCF_ValidNKey); 8349 rc = balance(pCur); 8350 8351 /* Must make sure nOverflow is reset to zero even if the balance() 8352 ** fails. Internal data structure corruption will result otherwise. 8353 ** Also, set the cursor state to invalid. This stops saveCursorPosition() 8354 ** from trying to save the current position of the cursor. */ 8355 pCur->pPage->nOverflow = 0; 8356 pCur->eState = CURSOR_INVALID; 8357 if( (flags & BTREE_SAVEPOSITION) && rc==SQLITE_OK ){ 8358 btreeReleaseAllCursorPages(pCur); 8359 if( pCur->pKeyInfo ){ 8360 assert( pCur->pKey==0 ); 8361 pCur->pKey = sqlite3Malloc( pX->nKey ); 8362 if( pCur->pKey==0 ){ 8363 rc = SQLITE_NOMEM; 8364 }else{ 8365 memcpy(pCur->pKey, pX->pKey, pX->nKey); 8366 } 8367 } 8368 pCur->eState = CURSOR_REQUIRESEEK; 8369 pCur->nKey = pX->nKey; 8370 } 8371 } 8372 assert( pCur->iPage<0 || pCur->pPage->nOverflow==0 ); 8373 8374 end_insert: 8375 return rc; 8376 } 8377 8378 /* 8379 ** Delete the entry that the cursor is pointing to. 8380 ** 8381 ** If the BTREE_SAVEPOSITION bit of the flags parameter is zero, then 8382 ** the cursor is left pointing at an arbitrary location after the delete. 8383 ** But if that bit is set, then the cursor is left in a state such that 8384 ** the next call to BtreeNext() or BtreePrev() moves it to the same row 8385 ** as it would have been on if the call to BtreeDelete() had been omitted. 8386 ** 8387 ** The BTREE_AUXDELETE bit of flags indicates that is one of several deletes 8388 ** associated with a single table entry and its indexes. Only one of those 8389 ** deletes is considered the "primary" delete. The primary delete occurs 8390 ** on a cursor that is not a BTREE_FORDELETE cursor. All but one delete 8391 ** operation on non-FORDELETE cursors is tagged with the AUXDELETE flag. 8392 ** The BTREE_AUXDELETE bit is a hint that is not used by this implementation, 8393 ** but which might be used by alternative storage engines. 8394 */ 8395 int sqlite3BtreeDelete(BtCursor *pCur, u8 flags){ 8396 Btree *p = pCur->pBtree; 8397 BtShared *pBt = p->pBt; 8398 int rc; /* Return code */ 8399 MemPage *pPage; /* Page to delete cell from */ 8400 unsigned char *pCell; /* Pointer to cell to delete */ 8401 int iCellIdx; /* Index of cell to delete */ 8402 int iCellDepth; /* Depth of node containing pCell */ 8403 CellInfo info; /* Size of the cell being deleted */ 8404 int bSkipnext = 0; /* Leaf cursor in SKIPNEXT state */ 8405 u8 bPreserve = flags & BTREE_SAVEPOSITION; /* Keep cursor valid */ 8406 8407 assert( cursorOwnsBtShared(pCur) ); 8408 assert( pBt->inTransaction==TRANS_WRITE ); 8409 assert( (pBt->btsFlags & BTS_READ_ONLY)==0 ); 8410 assert( pCur->curFlags & BTCF_WriteFlag ); 8411 assert( hasSharedCacheTableLock(p, pCur->pgnoRoot, pCur->pKeyInfo!=0, 2) ); 8412 assert( !hasReadConflicts(p, pCur->pgnoRoot) ); 8413 assert( pCur->ix<pCur->pPage->nCell ); 8414 assert( pCur->eState==CURSOR_VALID ); 8415 assert( (flags & ~(BTREE_SAVEPOSITION | BTREE_AUXDELETE))==0 ); 8416 8417 iCellDepth = pCur->iPage; 8418 iCellIdx = pCur->ix; 8419 pPage = pCur->pPage; 8420 pCell = findCell(pPage, iCellIdx); 8421 8422 /* If the bPreserve flag is set to true, then the cursor position must 8423 ** be preserved following this delete operation. If the current delete 8424 ** will cause a b-tree rebalance, then this is done by saving the cursor 8425 ** key and leaving the cursor in CURSOR_REQUIRESEEK state before 8426 ** returning. 8427 ** 8428 ** Or, if the current delete will not cause a rebalance, then the cursor 8429 ** will be left in CURSOR_SKIPNEXT state pointing to the entry immediately 8430 ** before or after the deleted entry. In this case set bSkipnext to true. */ 8431 if( bPreserve ){ 8432 if( !pPage->leaf 8433 || (pPage->nFree+cellSizePtr(pPage,pCell)+2)>(int)(pBt->usableSize*2/3) 8434 ){ 8435 /* A b-tree rebalance will be required after deleting this entry. 8436 ** Save the cursor key. */ 8437 rc = saveCursorKey(pCur); 8438 if( rc ) return rc; 8439 }else{ 8440 bSkipnext = 1; 8441 } 8442 } 8443 8444 /* If the page containing the entry to delete is not a leaf page, move 8445 ** the cursor to the largest entry in the tree that is smaller than 8446 ** the entry being deleted. This cell will replace the cell being deleted 8447 ** from the internal node. The 'previous' entry is used for this instead 8448 ** of the 'next' entry, as the previous entry is always a part of the 8449 ** sub-tree headed by the child page of the cell being deleted. This makes 8450 ** balancing the tree following the delete operation easier. */ 8451 if( !pPage->leaf ){ 8452 rc = sqlite3BtreePrevious(pCur, 0); 8453 assert( rc!=SQLITE_DONE ); 8454 if( rc ) return rc; 8455 } 8456 8457 /* Save the positions of any other cursors open on this table before 8458 ** making any modifications. */ 8459 if( pCur->curFlags & BTCF_Multiple ){ 8460 rc = saveAllCursors(pBt, pCur->pgnoRoot, pCur); 8461 if( rc ) return rc; 8462 } 8463 8464 /* If this is a delete operation to remove a row from a table b-tree, 8465 ** invalidate any incrblob cursors open on the row being deleted. */ 8466 if( pCur->pKeyInfo==0 ){ 8467 invalidateIncrblobCursors(p, pCur->pgnoRoot, pCur->info.nKey, 0); 8468 } 8469 8470 /* Make the page containing the entry to be deleted writable. Then free any 8471 ** overflow pages associated with the entry and finally remove the cell 8472 ** itself from within the page. */ 8473 rc = sqlite3PagerWrite(pPage->pDbPage); 8474 if( rc ) return rc; 8475 rc = clearCell(pPage, pCell, &info); 8476 dropCell(pPage, iCellIdx, info.nSize, &rc); 8477 if( rc ) return rc; 8478 8479 /* If the cell deleted was not located on a leaf page, then the cursor 8480 ** is currently pointing to the largest entry in the sub-tree headed 8481 ** by the child-page of the cell that was just deleted from an internal 8482 ** node. The cell from the leaf node needs to be moved to the internal 8483 ** node to replace the deleted cell. */ 8484 if( !pPage->leaf ){ 8485 MemPage *pLeaf = pCur->pPage; 8486 int nCell; 8487 Pgno n; 8488 unsigned char *pTmp; 8489 8490 if( iCellDepth<pCur->iPage-1 ){ 8491 n = pCur->apPage[iCellDepth+1]->pgno; 8492 }else{ 8493 n = pCur->pPage->pgno; 8494 } 8495 pCell = findCell(pLeaf, pLeaf->nCell-1); 8496 if( pCell<&pLeaf->aData[4] ) return SQLITE_CORRUPT_BKPT; 8497 nCell = pLeaf->xCellSize(pLeaf, pCell); 8498 assert( MX_CELL_SIZE(pBt) >= nCell ); 8499 pTmp = pBt->pTmpSpace; 8500 assert( pTmp!=0 ); 8501 rc = sqlite3PagerWrite(pLeaf->pDbPage); 8502 if( rc==SQLITE_OK ){ 8503 insertCell(pPage, iCellIdx, pCell-4, nCell+4, pTmp, n, &rc); 8504 } 8505 dropCell(pLeaf, pLeaf->nCell-1, nCell, &rc); 8506 if( rc ) return rc; 8507 } 8508 8509 /* Balance the tree. If the entry deleted was located on a leaf page, 8510 ** then the cursor still points to that page. In this case the first 8511 ** call to balance() repairs the tree, and the if(...) condition is 8512 ** never true. 8513 ** 8514 ** Otherwise, if the entry deleted was on an internal node page, then 8515 ** pCur is pointing to the leaf page from which a cell was removed to 8516 ** replace the cell deleted from the internal node. This is slightly 8517 ** tricky as the leaf node may be underfull, and the internal node may 8518 ** be either under or overfull. In this case run the balancing algorithm 8519 ** on the leaf node first. If the balance proceeds far enough up the 8520 ** tree that we can be sure that any problem in the internal node has 8521 ** been corrected, so be it. Otherwise, after balancing the leaf node, 8522 ** walk the cursor up the tree to the internal node and balance it as 8523 ** well. */ 8524 rc = balance(pCur); 8525 if( rc==SQLITE_OK && pCur->iPage>iCellDepth ){ 8526 releasePageNotNull(pCur->pPage); 8527 pCur->iPage--; 8528 while( pCur->iPage>iCellDepth ){ 8529 releasePage(pCur->apPage[pCur->iPage--]); 8530 } 8531 pCur->pPage = pCur->apPage[pCur->iPage]; 8532 rc = balance(pCur); 8533 } 8534 8535 if( rc==SQLITE_OK ){ 8536 if( bSkipnext ){ 8537 assert( bPreserve && (pCur->iPage==iCellDepth || CORRUPT_DB) ); 8538 assert( pPage==pCur->pPage || CORRUPT_DB ); 8539 assert( (pPage->nCell>0 || CORRUPT_DB) && iCellIdx<=pPage->nCell ); 8540 pCur->eState = CURSOR_SKIPNEXT; 8541 if( iCellIdx>=pPage->nCell ){ 8542 pCur->skipNext = -1; 8543 pCur->ix = pPage->nCell-1; 8544 }else{ 8545 pCur->skipNext = 1; 8546 } 8547 }else{ 8548 rc = moveToRoot(pCur); 8549 if( bPreserve ){ 8550 btreeReleaseAllCursorPages(pCur); 8551 pCur->eState = CURSOR_REQUIRESEEK; 8552 } 8553 if( rc==SQLITE_EMPTY ) rc = SQLITE_OK; 8554 } 8555 } 8556 return rc; 8557 } 8558 8559 /* 8560 ** Create a new BTree table. Write into *piTable the page 8561 ** number for the root page of the new table. 8562 ** 8563 ** The type of type is determined by the flags parameter. Only the 8564 ** following values of flags are currently in use. Other values for 8565 ** flags might not work: 8566 ** 8567 ** BTREE_INTKEY|BTREE_LEAFDATA Used for SQL tables with rowid keys 8568 ** BTREE_ZERODATA Used for SQL indices 8569 */ 8570 static int btreeCreateTable(Btree *p, int *piTable, int createTabFlags){ 8571 BtShared *pBt = p->pBt; 8572 MemPage *pRoot; 8573 Pgno pgnoRoot; 8574 int rc; 8575 int ptfFlags; /* Page-type flage for the root page of new table */ 8576 8577 assert( sqlite3BtreeHoldsMutex(p) ); 8578 assert( pBt->inTransaction==TRANS_WRITE ); 8579 assert( (pBt->btsFlags & BTS_READ_ONLY)==0 ); 8580 8581 #ifdef SQLITE_OMIT_AUTOVACUUM 8582 rc = allocateBtreePage(pBt, &pRoot, &pgnoRoot, 1, 0); 8583 if( rc ){ 8584 return rc; 8585 } 8586 #else 8587 if( pBt->autoVacuum ){ 8588 Pgno pgnoMove; /* Move a page here to make room for the root-page */ 8589 MemPage *pPageMove; /* The page to move to. */ 8590 8591 /* Creating a new table may probably require moving an existing database 8592 ** to make room for the new tables root page. In case this page turns 8593 ** out to be an overflow page, delete all overflow page-map caches 8594 ** held by open cursors. 8595 */ 8596 invalidateAllOverflowCache(pBt); 8597 8598 /* Read the value of meta[3] from the database to determine where the 8599 ** root page of the new table should go. meta[3] is the largest root-page 8600 ** created so far, so the new root-page is (meta[3]+1). 8601 */ 8602 sqlite3BtreeGetMeta(p, BTREE_LARGEST_ROOT_PAGE, &pgnoRoot); 8603 pgnoRoot++; 8604 8605 /* The new root-page may not be allocated on a pointer-map page, or the 8606 ** PENDING_BYTE page. 8607 */ 8608 while( pgnoRoot==PTRMAP_PAGENO(pBt, pgnoRoot) || 8609 pgnoRoot==PENDING_BYTE_PAGE(pBt) ){ 8610 pgnoRoot++; 8611 } 8612 assert( pgnoRoot>=3 || CORRUPT_DB ); 8613 testcase( pgnoRoot<3 ); 8614 8615 /* Allocate a page. The page that currently resides at pgnoRoot will 8616 ** be moved to the allocated page (unless the allocated page happens 8617 ** to reside at pgnoRoot). 8618 */ 8619 rc = allocateBtreePage(pBt, &pPageMove, &pgnoMove, pgnoRoot, BTALLOC_EXACT); 8620 if( rc!=SQLITE_OK ){ 8621 return rc; 8622 } 8623 8624 if( pgnoMove!=pgnoRoot ){ 8625 /* pgnoRoot is the page that will be used for the root-page of 8626 ** the new table (assuming an error did not occur). But we were 8627 ** allocated pgnoMove. If required (i.e. if it was not allocated 8628 ** by extending the file), the current page at position pgnoMove 8629 ** is already journaled. 8630 */ 8631 u8 eType = 0; 8632 Pgno iPtrPage = 0; 8633 8634 /* Save the positions of any open cursors. This is required in 8635 ** case they are holding a reference to an xFetch reference 8636 ** corresponding to page pgnoRoot. */ 8637 rc = saveAllCursors(pBt, 0, 0); 8638 releasePage(pPageMove); 8639 if( rc!=SQLITE_OK ){ 8640 return rc; 8641 } 8642 8643 /* Move the page currently at pgnoRoot to pgnoMove. */ 8644 rc = btreeGetPage(pBt, pgnoRoot, &pRoot, 0); 8645 if( rc!=SQLITE_OK ){ 8646 return rc; 8647 } 8648 rc = ptrmapGet(pBt, pgnoRoot, &eType, &iPtrPage); 8649 if( eType==PTRMAP_ROOTPAGE || eType==PTRMAP_FREEPAGE ){ 8650 rc = SQLITE_CORRUPT_BKPT; 8651 } 8652 if( rc!=SQLITE_OK ){ 8653 releasePage(pRoot); 8654 return rc; 8655 } 8656 assert( eType!=PTRMAP_ROOTPAGE ); 8657 assert( eType!=PTRMAP_FREEPAGE ); 8658 rc = relocatePage(pBt, pRoot, eType, iPtrPage, pgnoMove, 0); 8659 releasePage(pRoot); 8660 8661 /* Obtain the page at pgnoRoot */ 8662 if( rc!=SQLITE_OK ){ 8663 return rc; 8664 } 8665 rc = btreeGetPage(pBt, pgnoRoot, &pRoot, 0); 8666 if( rc!=SQLITE_OK ){ 8667 return rc; 8668 } 8669 rc = sqlite3PagerWrite(pRoot->pDbPage); 8670 if( rc!=SQLITE_OK ){ 8671 releasePage(pRoot); 8672 return rc; 8673 } 8674 }else{ 8675 pRoot = pPageMove; 8676 } 8677 8678 /* Update the pointer-map and meta-data with the new root-page number. */ 8679 ptrmapPut(pBt, pgnoRoot, PTRMAP_ROOTPAGE, 0, &rc); 8680 if( rc ){ 8681 releasePage(pRoot); 8682 return rc; 8683 } 8684 8685 /* When the new root page was allocated, page 1 was made writable in 8686 ** order either to increase the database filesize, or to decrement the 8687 ** freelist count. Hence, the sqlite3BtreeUpdateMeta() call cannot fail. 8688 */ 8689 assert( sqlite3PagerIswriteable(pBt->pPage1->pDbPage) ); 8690 rc = sqlite3BtreeUpdateMeta(p, 4, pgnoRoot); 8691 if( NEVER(rc) ){ 8692 releasePage(pRoot); 8693 return rc; 8694 } 8695 8696 }else{ 8697 rc = allocateBtreePage(pBt, &pRoot, &pgnoRoot, 1, 0); 8698 if( rc ) return rc; 8699 } 8700 #endif 8701 assert( sqlite3PagerIswriteable(pRoot->pDbPage) ); 8702 if( createTabFlags & BTREE_INTKEY ){ 8703 ptfFlags = PTF_INTKEY | PTF_LEAFDATA | PTF_LEAF; 8704 }else{ 8705 ptfFlags = PTF_ZERODATA | PTF_LEAF; 8706 } 8707 zeroPage(pRoot, ptfFlags); 8708 sqlite3PagerUnref(pRoot->pDbPage); 8709 assert( (pBt->openFlags & BTREE_SINGLE)==0 || pgnoRoot==2 ); 8710 *piTable = (int)pgnoRoot; 8711 return SQLITE_OK; 8712 } 8713 int sqlite3BtreeCreateTable(Btree *p, int *piTable, int flags){ 8714 int rc; 8715 sqlite3BtreeEnter(p); 8716 rc = btreeCreateTable(p, piTable, flags); 8717 sqlite3BtreeLeave(p); 8718 return rc; 8719 } 8720 8721 /* 8722 ** Erase the given database page and all its children. Return 8723 ** the page to the freelist. 8724 */ 8725 static int clearDatabasePage( 8726 BtShared *pBt, /* The BTree that contains the table */ 8727 Pgno pgno, /* Page number to clear */ 8728 int freePageFlag, /* Deallocate page if true */ 8729 int *pnChange /* Add number of Cells freed to this counter */ 8730 ){ 8731 MemPage *pPage; 8732 int rc; 8733 unsigned char *pCell; 8734 int i; 8735 int hdr; 8736 CellInfo info; 8737 8738 assert( sqlite3_mutex_held(pBt->mutex) ); 8739 if( pgno>btreePagecount(pBt) ){ 8740 return SQLITE_CORRUPT_BKPT; 8741 } 8742 rc = getAndInitPage(pBt, pgno, &pPage, 0, 0); 8743 if( rc ) return rc; 8744 if( pPage->bBusy ){ 8745 rc = SQLITE_CORRUPT_BKPT; 8746 goto cleardatabasepage_out; 8747 } 8748 pPage->bBusy = 1; 8749 hdr = pPage->hdrOffset; 8750 for(i=0; i<pPage->nCell; i++){ 8751 pCell = findCell(pPage, i); 8752 if( !pPage->leaf ){ 8753 rc = clearDatabasePage(pBt, get4byte(pCell), 1, pnChange); 8754 if( rc ) goto cleardatabasepage_out; 8755 } 8756 rc = clearCell(pPage, pCell, &info); 8757 if( rc ) goto cleardatabasepage_out; 8758 } 8759 if( !pPage->leaf ){ 8760 rc = clearDatabasePage(pBt, get4byte(&pPage->aData[hdr+8]), 1, pnChange); 8761 if( rc ) goto cleardatabasepage_out; 8762 }else if( pnChange ){ 8763 assert( pPage->intKey || CORRUPT_DB ); 8764 testcase( !pPage->intKey ); 8765 *pnChange += pPage->nCell; 8766 } 8767 if( freePageFlag ){ 8768 freePage(pPage, &rc); 8769 }else if( (rc = sqlite3PagerWrite(pPage->pDbPage))==0 ){ 8770 zeroPage(pPage, pPage->aData[hdr] | PTF_LEAF); 8771 } 8772 8773 cleardatabasepage_out: 8774 pPage->bBusy = 0; 8775 releasePage(pPage); 8776 return rc; 8777 } 8778 8779 /* 8780 ** Delete all information from a single table in the database. iTable is 8781 ** the page number of the root of the table. After this routine returns, 8782 ** the root page is empty, but still exists. 8783 ** 8784 ** This routine will fail with SQLITE_LOCKED if there are any open 8785 ** read cursors on the table. Open write cursors are moved to the 8786 ** root of the table. 8787 ** 8788 ** If pnChange is not NULL, then table iTable must be an intkey table. The 8789 ** integer value pointed to by pnChange is incremented by the number of 8790 ** entries in the table. 8791 */ 8792 int sqlite3BtreeClearTable(Btree *p, int iTable, int *pnChange){ 8793 int rc; 8794 BtShared *pBt = p->pBt; 8795 sqlite3BtreeEnter(p); 8796 assert( p->inTrans==TRANS_WRITE ); 8797 8798 rc = saveAllCursors(pBt, (Pgno)iTable, 0); 8799 8800 if( SQLITE_OK==rc ){ 8801 /* Invalidate all incrblob cursors open on table iTable (assuming iTable 8802 ** is the root of a table b-tree - if it is not, the following call is 8803 ** a no-op). */ 8804 invalidateIncrblobCursors(p, (Pgno)iTable, 0, 1); 8805 rc = clearDatabasePage(pBt, (Pgno)iTable, 0, pnChange); 8806 } 8807 sqlite3BtreeLeave(p); 8808 return rc; 8809 } 8810 8811 /* 8812 ** Delete all information from the single table that pCur is open on. 8813 ** 8814 ** This routine only work for pCur on an ephemeral table. 8815 */ 8816 int sqlite3BtreeClearTableOfCursor(BtCursor *pCur){ 8817 return sqlite3BtreeClearTable(pCur->pBtree, pCur->pgnoRoot, 0); 8818 } 8819 8820 /* 8821 ** Erase all information in a table and add the root of the table to 8822 ** the freelist. Except, the root of the principle table (the one on 8823 ** page 1) is never added to the freelist. 8824 ** 8825 ** This routine will fail with SQLITE_LOCKED if there are any open 8826 ** cursors on the table. 8827 ** 8828 ** If AUTOVACUUM is enabled and the page at iTable is not the last 8829 ** root page in the database file, then the last root page 8830 ** in the database file is moved into the slot formerly occupied by 8831 ** iTable and that last slot formerly occupied by the last root page 8832 ** is added to the freelist instead of iTable. In this say, all 8833 ** root pages are kept at the beginning of the database file, which 8834 ** is necessary for AUTOVACUUM to work right. *piMoved is set to the 8835 ** page number that used to be the last root page in the file before 8836 ** the move. If no page gets moved, *piMoved is set to 0. 8837 ** The last root page is recorded in meta[3] and the value of 8838 ** meta[3] is updated by this procedure. 8839 */ 8840 static int btreeDropTable(Btree *p, Pgno iTable, int *piMoved){ 8841 int rc; 8842 MemPage *pPage = 0; 8843 BtShared *pBt = p->pBt; 8844 8845 assert( sqlite3BtreeHoldsMutex(p) ); 8846 assert( p->inTrans==TRANS_WRITE ); 8847 assert( iTable>=2 ); 8848 8849 rc = btreeGetPage(pBt, (Pgno)iTable, &pPage, 0); 8850 if( rc ) return rc; 8851 rc = sqlite3BtreeClearTable(p, iTable, 0); 8852 if( rc ){ 8853 releasePage(pPage); 8854 return rc; 8855 } 8856 8857 *piMoved = 0; 8858 8859 #ifdef SQLITE_OMIT_AUTOVACUUM 8860 freePage(pPage, &rc); 8861 releasePage(pPage); 8862 #else 8863 if( pBt->autoVacuum ){ 8864 Pgno maxRootPgno; 8865 sqlite3BtreeGetMeta(p, BTREE_LARGEST_ROOT_PAGE, &maxRootPgno); 8866 8867 if( iTable==maxRootPgno ){ 8868 /* If the table being dropped is the table with the largest root-page 8869 ** number in the database, put the root page on the free list. 8870 */ 8871 freePage(pPage, &rc); 8872 releasePage(pPage); 8873 if( rc!=SQLITE_OK ){ 8874 return rc; 8875 } 8876 }else{ 8877 /* The table being dropped does not have the largest root-page 8878 ** number in the database. So move the page that does into the 8879 ** gap left by the deleted root-page. 8880 */ 8881 MemPage *pMove; 8882 releasePage(pPage); 8883 rc = btreeGetPage(pBt, maxRootPgno, &pMove, 0); 8884 if( rc!=SQLITE_OK ){ 8885 return rc; 8886 } 8887 rc = relocatePage(pBt, pMove, PTRMAP_ROOTPAGE, 0, iTable, 0); 8888 releasePage(pMove); 8889 if( rc!=SQLITE_OK ){ 8890 return rc; 8891 } 8892 pMove = 0; 8893 rc = btreeGetPage(pBt, maxRootPgno, &pMove, 0); 8894 freePage(pMove, &rc); 8895 releasePage(pMove); 8896 if( rc!=SQLITE_OK ){ 8897 return rc; 8898 } 8899 *piMoved = maxRootPgno; 8900 } 8901 8902 /* Set the new 'max-root-page' value in the database header. This 8903 ** is the old value less one, less one more if that happens to 8904 ** be a root-page number, less one again if that is the 8905 ** PENDING_BYTE_PAGE. 8906 */ 8907 maxRootPgno--; 8908 while( maxRootPgno==PENDING_BYTE_PAGE(pBt) 8909 || PTRMAP_ISPAGE(pBt, maxRootPgno) ){ 8910 maxRootPgno--; 8911 } 8912 assert( maxRootPgno!=PENDING_BYTE_PAGE(pBt) ); 8913 8914 rc = sqlite3BtreeUpdateMeta(p, 4, maxRootPgno); 8915 }else{ 8916 freePage(pPage, &rc); 8917 releasePage(pPage); 8918 } 8919 #endif 8920 return rc; 8921 } 8922 int sqlite3BtreeDropTable(Btree *p, int iTable, int *piMoved){ 8923 int rc; 8924 sqlite3BtreeEnter(p); 8925 rc = btreeDropTable(p, iTable, piMoved); 8926 sqlite3BtreeLeave(p); 8927 return rc; 8928 } 8929 8930 8931 /* 8932 ** This function may only be called if the b-tree connection already 8933 ** has a read or write transaction open on the database. 8934 ** 8935 ** Read the meta-information out of a database file. Meta[0] 8936 ** is the number of free pages currently in the database. Meta[1] 8937 ** through meta[15] are available for use by higher layers. Meta[0] 8938 ** is read-only, the others are read/write. 8939 ** 8940 ** The schema layer numbers meta values differently. At the schema 8941 ** layer (and the SetCookie and ReadCookie opcodes) the number of 8942 ** free pages is not visible. So Cookie[0] is the same as Meta[1]. 8943 ** 8944 ** This routine treats Meta[BTREE_DATA_VERSION] as a special case. Instead 8945 ** of reading the value out of the header, it instead loads the "DataVersion" 8946 ** from the pager. The BTREE_DATA_VERSION value is not actually stored in the 8947 ** database file. It is a number computed by the pager. But its access 8948 ** pattern is the same as header meta values, and so it is convenient to 8949 ** read it from this routine. 8950 */ 8951 void sqlite3BtreeGetMeta(Btree *p, int idx, u32 *pMeta){ 8952 BtShared *pBt = p->pBt; 8953 8954 sqlite3BtreeEnter(p); 8955 assert( p->inTrans>TRANS_NONE ); 8956 assert( SQLITE_OK==querySharedCacheTableLock(p, MASTER_ROOT, READ_LOCK) ); 8957 assert( pBt->pPage1 ); 8958 assert( idx>=0 && idx<=15 ); 8959 8960 if( idx==BTREE_DATA_VERSION ){ 8961 *pMeta = sqlite3PagerDataVersion(pBt->pPager) + p->iDataVersion; 8962 }else{ 8963 *pMeta = get4byte(&pBt->pPage1->aData[36 + idx*4]); 8964 } 8965 8966 /* If auto-vacuum is disabled in this build and this is an auto-vacuum 8967 ** database, mark the database as read-only. */ 8968 #ifdef SQLITE_OMIT_AUTOVACUUM 8969 if( idx==BTREE_LARGEST_ROOT_PAGE && *pMeta>0 ){ 8970 pBt->btsFlags |= BTS_READ_ONLY; 8971 } 8972 #endif 8973 8974 sqlite3BtreeLeave(p); 8975 } 8976 8977 /* 8978 ** Write meta-information back into the database. Meta[0] is 8979 ** read-only and may not be written. 8980 */ 8981 int sqlite3BtreeUpdateMeta(Btree *p, int idx, u32 iMeta){ 8982 BtShared *pBt = p->pBt; 8983 unsigned char *pP1; 8984 int rc; 8985 assert( idx>=1 && idx<=15 ); 8986 sqlite3BtreeEnter(p); 8987 assert( p->inTrans==TRANS_WRITE ); 8988 assert( pBt->pPage1!=0 ); 8989 pP1 = pBt->pPage1->aData; 8990 rc = sqlite3PagerWrite(pBt->pPage1->pDbPage); 8991 if( rc==SQLITE_OK ){ 8992 put4byte(&pP1[36 + idx*4], iMeta); 8993 #ifndef SQLITE_OMIT_AUTOVACUUM 8994 if( idx==BTREE_INCR_VACUUM ){ 8995 assert( pBt->autoVacuum || iMeta==0 ); 8996 assert( iMeta==0 || iMeta==1 ); 8997 pBt->incrVacuum = (u8)iMeta; 8998 } 8999 #endif 9000 } 9001 sqlite3BtreeLeave(p); 9002 return rc; 9003 } 9004 9005 #ifndef SQLITE_OMIT_BTREECOUNT 9006 /* 9007 ** The first argument, pCur, is a cursor opened on some b-tree. Count the 9008 ** number of entries in the b-tree and write the result to *pnEntry. 9009 ** 9010 ** SQLITE_OK is returned if the operation is successfully executed. 9011 ** Otherwise, if an error is encountered (i.e. an IO error or database 9012 ** corruption) an SQLite error code is returned. 9013 */ 9014 int sqlite3BtreeCount(BtCursor *pCur, i64 *pnEntry){ 9015 i64 nEntry = 0; /* Value to return in *pnEntry */ 9016 int rc; /* Return code */ 9017 9018 rc = moveToRoot(pCur); 9019 if( rc==SQLITE_EMPTY ){ 9020 *pnEntry = 0; 9021 return SQLITE_OK; 9022 } 9023 9024 /* Unless an error occurs, the following loop runs one iteration for each 9025 ** page in the B-Tree structure (not including overflow pages). 9026 */ 9027 while( rc==SQLITE_OK ){ 9028 int iIdx; /* Index of child node in parent */ 9029 MemPage *pPage; /* Current page of the b-tree */ 9030 9031 /* If this is a leaf page or the tree is not an int-key tree, then 9032 ** this page contains countable entries. Increment the entry counter 9033 ** accordingly. 9034 */ 9035 pPage = pCur->pPage; 9036 if( pPage->leaf || !pPage->intKey ){ 9037 nEntry += pPage->nCell; 9038 } 9039 9040 /* pPage is a leaf node. This loop navigates the cursor so that it 9041 ** points to the first interior cell that it points to the parent of 9042 ** the next page in the tree that has not yet been visited. The 9043 ** pCur->aiIdx[pCur->iPage] value is set to the index of the parent cell 9044 ** of the page, or to the number of cells in the page if the next page 9045 ** to visit is the right-child of its parent. 9046 ** 9047 ** If all pages in the tree have been visited, return SQLITE_OK to the 9048 ** caller. 9049 */ 9050 if( pPage->leaf ){ 9051 do { 9052 if( pCur->iPage==0 ){ 9053 /* All pages of the b-tree have been visited. Return successfully. */ 9054 *pnEntry = nEntry; 9055 return moveToRoot(pCur); 9056 } 9057 moveToParent(pCur); 9058 }while ( pCur->ix>=pCur->pPage->nCell ); 9059 9060 pCur->ix++; 9061 pPage = pCur->pPage; 9062 } 9063 9064 /* Descend to the child node of the cell that the cursor currently 9065 ** points at. This is the right-child if (iIdx==pPage->nCell). 9066 */ 9067 iIdx = pCur->ix; 9068 if( iIdx==pPage->nCell ){ 9069 rc = moveToChild(pCur, get4byte(&pPage->aData[pPage->hdrOffset+8])); 9070 }else{ 9071 rc = moveToChild(pCur, get4byte(findCell(pPage, iIdx))); 9072 } 9073 } 9074 9075 /* An error has occurred. Return an error code. */ 9076 return rc; 9077 } 9078 #endif 9079 9080 /* 9081 ** Return the pager associated with a BTree. This routine is used for 9082 ** testing and debugging only. 9083 */ 9084 Pager *sqlite3BtreePager(Btree *p){ 9085 return p->pBt->pPager; 9086 } 9087 9088 #ifndef SQLITE_OMIT_INTEGRITY_CHECK 9089 /* 9090 ** Append a message to the error message string. 9091 */ 9092 static void checkAppendMsg( 9093 IntegrityCk *pCheck, 9094 const char *zFormat, 9095 ... 9096 ){ 9097 va_list ap; 9098 if( !pCheck->mxErr ) return; 9099 pCheck->mxErr--; 9100 pCheck->nErr++; 9101 va_start(ap, zFormat); 9102 if( pCheck->errMsg.nChar ){ 9103 sqlite3StrAccumAppend(&pCheck->errMsg, "\n", 1); 9104 } 9105 if( pCheck->zPfx ){ 9106 sqlite3XPrintf(&pCheck->errMsg, pCheck->zPfx, pCheck->v1, pCheck->v2); 9107 } 9108 sqlite3VXPrintf(&pCheck->errMsg, zFormat, ap); 9109 va_end(ap); 9110 if( pCheck->errMsg.accError==STRACCUM_NOMEM ){ 9111 pCheck->mallocFailed = 1; 9112 } 9113 } 9114 #endif /* SQLITE_OMIT_INTEGRITY_CHECK */ 9115 9116 #ifndef SQLITE_OMIT_INTEGRITY_CHECK 9117 9118 /* 9119 ** Return non-zero if the bit in the IntegrityCk.aPgRef[] array that 9120 ** corresponds to page iPg is already set. 9121 */ 9122 static int getPageReferenced(IntegrityCk *pCheck, Pgno iPg){ 9123 assert( iPg<=pCheck->nPage && sizeof(pCheck->aPgRef[0])==1 ); 9124 return (pCheck->aPgRef[iPg/8] & (1 << (iPg & 0x07))); 9125 } 9126 9127 /* 9128 ** Set the bit in the IntegrityCk.aPgRef[] array that corresponds to page iPg. 9129 */ 9130 static void setPageReferenced(IntegrityCk *pCheck, Pgno iPg){ 9131 assert( iPg<=pCheck->nPage && sizeof(pCheck->aPgRef[0])==1 ); 9132 pCheck->aPgRef[iPg/8] |= (1 << (iPg & 0x07)); 9133 } 9134 9135 9136 /* 9137 ** Add 1 to the reference count for page iPage. If this is the second 9138 ** reference to the page, add an error message to pCheck->zErrMsg. 9139 ** Return 1 if there are 2 or more references to the page and 0 if 9140 ** if this is the first reference to the page. 9141 ** 9142 ** Also check that the page number is in bounds. 9143 */ 9144 static int checkRef(IntegrityCk *pCheck, Pgno iPage){ 9145 if( iPage==0 ) return 1; 9146 if( iPage>pCheck->nPage ){ 9147 checkAppendMsg(pCheck, "invalid page number %d", iPage); 9148 return 1; 9149 } 9150 if( getPageReferenced(pCheck, iPage) ){ 9151 checkAppendMsg(pCheck, "2nd reference to page %d", iPage); 9152 return 1; 9153 } 9154 setPageReferenced(pCheck, iPage); 9155 return 0; 9156 } 9157 9158 #ifndef SQLITE_OMIT_AUTOVACUUM 9159 /* 9160 ** Check that the entry in the pointer-map for page iChild maps to 9161 ** page iParent, pointer type ptrType. If not, append an error message 9162 ** to pCheck. 9163 */ 9164 static void checkPtrmap( 9165 IntegrityCk *pCheck, /* Integrity check context */ 9166 Pgno iChild, /* Child page number */ 9167 u8 eType, /* Expected pointer map type */ 9168 Pgno iParent /* Expected pointer map parent page number */ 9169 ){ 9170 int rc; 9171 u8 ePtrmapType; 9172 Pgno iPtrmapParent; 9173 9174 rc = ptrmapGet(pCheck->pBt, iChild, &ePtrmapType, &iPtrmapParent); 9175 if( rc!=SQLITE_OK ){ 9176 if( rc==SQLITE_NOMEM || rc==SQLITE_IOERR_NOMEM ) pCheck->mallocFailed = 1; 9177 checkAppendMsg(pCheck, "Failed to read ptrmap key=%d", iChild); 9178 return; 9179 } 9180 9181 if( ePtrmapType!=eType || iPtrmapParent!=iParent ){ 9182 checkAppendMsg(pCheck, 9183 "Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)", 9184 iChild, eType, iParent, ePtrmapType, iPtrmapParent); 9185 } 9186 } 9187 #endif 9188 9189 /* 9190 ** Check the integrity of the freelist or of an overflow page list. 9191 ** Verify that the number of pages on the list is N. 9192 */ 9193 static void checkList( 9194 IntegrityCk *pCheck, /* Integrity checking context */ 9195 int isFreeList, /* True for a freelist. False for overflow page list */ 9196 int iPage, /* Page number for first page in the list */ 9197 int N /* Expected number of pages in the list */ 9198 ){ 9199 int i; 9200 int expected = N; 9201 int iFirst = iPage; 9202 while( N-- > 0 && pCheck->mxErr ){ 9203 DbPage *pOvflPage; 9204 unsigned char *pOvflData; 9205 if( iPage<1 ){ 9206 checkAppendMsg(pCheck, 9207 "%d of %d pages missing from overflow list starting at %d", 9208 N+1, expected, iFirst); 9209 break; 9210 } 9211 if( checkRef(pCheck, iPage) ) break; 9212 if( sqlite3PagerGet(pCheck->pPager, (Pgno)iPage, &pOvflPage, 0) ){ 9213 checkAppendMsg(pCheck, "failed to get page %d", iPage); 9214 break; 9215 } 9216 pOvflData = (unsigned char *)sqlite3PagerGetData(pOvflPage); 9217 if( isFreeList ){ 9218 int n = get4byte(&pOvflData[4]); 9219 #ifndef SQLITE_OMIT_AUTOVACUUM 9220 if( pCheck->pBt->autoVacuum ){ 9221 checkPtrmap(pCheck, iPage, PTRMAP_FREEPAGE, 0); 9222 } 9223 #endif 9224 if( n>(int)pCheck->pBt->usableSize/4-2 ){ 9225 checkAppendMsg(pCheck, 9226 "freelist leaf count too big on page %d", iPage); 9227 N--; 9228 }else{ 9229 for(i=0; i<n; i++){ 9230 Pgno iFreePage = get4byte(&pOvflData[8+i*4]); 9231 #ifndef SQLITE_OMIT_AUTOVACUUM 9232 if( pCheck->pBt->autoVacuum ){ 9233 checkPtrmap(pCheck, iFreePage, PTRMAP_FREEPAGE, 0); 9234 } 9235 #endif 9236 checkRef(pCheck, iFreePage); 9237 } 9238 N -= n; 9239 } 9240 } 9241 #ifndef SQLITE_OMIT_AUTOVACUUM 9242 else{ 9243 /* If this database supports auto-vacuum and iPage is not the last 9244 ** page in this overflow list, check that the pointer-map entry for 9245 ** the following page matches iPage. 9246 */ 9247 if( pCheck->pBt->autoVacuum && N>0 ){ 9248 i = get4byte(pOvflData); 9249 checkPtrmap(pCheck, i, PTRMAP_OVERFLOW2, iPage); 9250 } 9251 } 9252 #endif 9253 iPage = get4byte(pOvflData); 9254 sqlite3PagerUnref(pOvflPage); 9255 9256 if( isFreeList && N<(iPage!=0) ){ 9257 checkAppendMsg(pCheck, "free-page count in header is too small"); 9258 } 9259 } 9260 } 9261 #endif /* SQLITE_OMIT_INTEGRITY_CHECK */ 9262 9263 /* 9264 ** An implementation of a min-heap. 9265 ** 9266 ** aHeap[0] is the number of elements on the heap. aHeap[1] is the 9267 ** root element. The daughter nodes of aHeap[N] are aHeap[N*2] 9268 ** and aHeap[N*2+1]. 9269 ** 9270 ** The heap property is this: Every node is less than or equal to both 9271 ** of its daughter nodes. A consequence of the heap property is that the 9272 ** root node aHeap[1] is always the minimum value currently in the heap. 9273 ** 9274 ** The btreeHeapInsert() routine inserts an unsigned 32-bit number onto 9275 ** the heap, preserving the heap property. The btreeHeapPull() routine 9276 ** removes the root element from the heap (the minimum value in the heap) 9277 ** and then moves other nodes around as necessary to preserve the heap 9278 ** property. 9279 ** 9280 ** This heap is used for cell overlap and coverage testing. Each u32 9281 ** entry represents the span of a cell or freeblock on a btree page. 9282 ** The upper 16 bits are the index of the first byte of a range and the 9283 ** lower 16 bits are the index of the last byte of that range. 9284 */ 9285 static void btreeHeapInsert(u32 *aHeap, u32 x){ 9286 u32 j, i = ++aHeap[0]; 9287 aHeap[i] = x; 9288 while( (j = i/2)>0 && aHeap[j]>aHeap[i] ){ 9289 x = aHeap[j]; 9290 aHeap[j] = aHeap[i]; 9291 aHeap[i] = x; 9292 i = j; 9293 } 9294 } 9295 static int btreeHeapPull(u32 *aHeap, u32 *pOut){ 9296 u32 j, i, x; 9297 if( (x = aHeap[0])==0 ) return 0; 9298 *pOut = aHeap[1]; 9299 aHeap[1] = aHeap[x]; 9300 aHeap[x] = 0xffffffff; 9301 aHeap[0]--; 9302 i = 1; 9303 while( (j = i*2)<=aHeap[0] ){ 9304 if( aHeap[j]>aHeap[j+1] ) j++; 9305 if( aHeap[i]<aHeap[j] ) break; 9306 x = aHeap[i]; 9307 aHeap[i] = aHeap[j]; 9308 aHeap[j] = x; 9309 i = j; 9310 } 9311 return 1; 9312 } 9313 9314 #ifndef SQLITE_OMIT_INTEGRITY_CHECK 9315 /* 9316 ** Do various sanity checks on a single page of a tree. Return 9317 ** the tree depth. Root pages return 0. Parents of root pages 9318 ** return 1, and so forth. 9319 ** 9320 ** These checks are done: 9321 ** 9322 ** 1. Make sure that cells and freeblocks do not overlap 9323 ** but combine to completely cover the page. 9324 ** 2. Make sure integer cell keys are in order. 9325 ** 3. Check the integrity of overflow pages. 9326 ** 4. Recursively call checkTreePage on all children. 9327 ** 5. Verify that the depth of all children is the same. 9328 */ 9329 static int checkTreePage( 9330 IntegrityCk *pCheck, /* Context for the sanity check */ 9331 int iPage, /* Page number of the page to check */ 9332 i64 *piMinKey, /* Write minimum integer primary key here */ 9333 i64 maxKey /* Error if integer primary key greater than this */ 9334 ){ 9335 MemPage *pPage = 0; /* The page being analyzed */ 9336 int i; /* Loop counter */ 9337 int rc; /* Result code from subroutine call */ 9338 int depth = -1, d2; /* Depth of a subtree */ 9339 int pgno; /* Page number */ 9340 int nFrag; /* Number of fragmented bytes on the page */ 9341 int hdr; /* Offset to the page header */ 9342 int cellStart; /* Offset to the start of the cell pointer array */ 9343 int nCell; /* Number of cells */ 9344 int doCoverageCheck = 1; /* True if cell coverage checking should be done */ 9345 int keyCanBeEqual = 1; /* True if IPK can be equal to maxKey 9346 ** False if IPK must be strictly less than maxKey */ 9347 u8 *data; /* Page content */ 9348 u8 *pCell; /* Cell content */ 9349 u8 *pCellIdx; /* Next element of the cell pointer array */ 9350 BtShared *pBt; /* The BtShared object that owns pPage */ 9351 u32 pc; /* Address of a cell */ 9352 u32 usableSize; /* Usable size of the page */ 9353 u32 contentOffset; /* Offset to the start of the cell content area */ 9354 u32 *heap = 0; /* Min-heap used for checking cell coverage */ 9355 u32 x, prev = 0; /* Next and previous entry on the min-heap */ 9356 const char *saved_zPfx = pCheck->zPfx; 9357 int saved_v1 = pCheck->v1; 9358 int saved_v2 = pCheck->v2; 9359 u8 savedIsInit = 0; 9360 9361 /* Check that the page exists 9362 */ 9363 pBt = pCheck->pBt; 9364 usableSize = pBt->usableSize; 9365 if( iPage==0 ) return 0; 9366 if( checkRef(pCheck, iPage) ) return 0; 9367 pCheck->zPfx = "Page %d: "; 9368 pCheck->v1 = iPage; 9369 if( (rc = btreeGetPage(pBt, (Pgno)iPage, &pPage, 0))!=0 ){ 9370 checkAppendMsg(pCheck, 9371 "unable to get the page. error code=%d", rc); 9372 goto end_of_check; 9373 } 9374 9375 /* Clear MemPage.isInit to make sure the corruption detection code in 9376 ** btreeInitPage() is executed. */ 9377 savedIsInit = pPage->isInit; 9378 pPage->isInit = 0; 9379 if( (rc = btreeInitPage(pPage))!=0 ){ 9380 assert( rc==SQLITE_CORRUPT ); /* The only possible error from InitPage */ 9381 checkAppendMsg(pCheck, 9382 "btreeInitPage() returns error code %d", rc); 9383 goto end_of_check; 9384 } 9385 data = pPage->aData; 9386 hdr = pPage->hdrOffset; 9387 9388 /* Set up for cell analysis */ 9389 pCheck->zPfx = "On tree page %d cell %d: "; 9390 contentOffset = get2byteNotZero(&data[hdr+5]); 9391 assert( contentOffset<=usableSize ); /* Enforced by btreeInitPage() */ 9392 9393 /* EVIDENCE-OF: R-37002-32774 The two-byte integer at offset 3 gives the 9394 ** number of cells on the page. */ 9395 nCell = get2byte(&data[hdr+3]); 9396 assert( pPage->nCell==nCell ); 9397 9398 /* EVIDENCE-OF: R-23882-45353 The cell pointer array of a b-tree page 9399 ** immediately follows the b-tree page header. */ 9400 cellStart = hdr + 12 - 4*pPage->leaf; 9401 assert( pPage->aCellIdx==&data[cellStart] ); 9402 pCellIdx = &data[cellStart + 2*(nCell-1)]; 9403 9404 if( !pPage->leaf ){ 9405 /* Analyze the right-child page of internal pages */ 9406 pgno = get4byte(&data[hdr+8]); 9407 #ifndef SQLITE_OMIT_AUTOVACUUM 9408 if( pBt->autoVacuum ){ 9409 pCheck->zPfx = "On page %d at right child: "; 9410 checkPtrmap(pCheck, pgno, PTRMAP_BTREE, iPage); 9411 } 9412 #endif 9413 depth = checkTreePage(pCheck, pgno, &maxKey, maxKey); 9414 keyCanBeEqual = 0; 9415 }else{ 9416 /* For leaf pages, the coverage check will occur in the same loop 9417 ** as the other cell checks, so initialize the heap. */ 9418 heap = pCheck->heap; 9419 heap[0] = 0; 9420 } 9421 9422 /* EVIDENCE-OF: R-02776-14802 The cell pointer array consists of K 2-byte 9423 ** integer offsets to the cell contents. */ 9424 for(i=nCell-1; i>=0 && pCheck->mxErr; i--){ 9425 CellInfo info; 9426 9427 /* Check cell size */ 9428 pCheck->v2 = i; 9429 assert( pCellIdx==&data[cellStart + i*2] ); 9430 pc = get2byteAligned(pCellIdx); 9431 pCellIdx -= 2; 9432 if( pc<contentOffset || pc>usableSize-4 ){ 9433 checkAppendMsg(pCheck, "Offset %d out of range %d..%d", 9434 pc, contentOffset, usableSize-4); 9435 doCoverageCheck = 0; 9436 continue; 9437 } 9438 pCell = &data[pc]; 9439 pPage->xParseCell(pPage, pCell, &info); 9440 if( pc+info.nSize>usableSize ){ 9441 checkAppendMsg(pCheck, "Extends off end of page"); 9442 doCoverageCheck = 0; 9443 continue; 9444 } 9445 9446 /* Check for integer primary key out of range */ 9447 if( pPage->intKey ){ 9448 if( keyCanBeEqual ? (info.nKey > maxKey) : (info.nKey >= maxKey) ){ 9449 checkAppendMsg(pCheck, "Rowid %lld out of order", info.nKey); 9450 } 9451 maxKey = info.nKey; 9452 keyCanBeEqual = 0; /* Only the first key on the page may ==maxKey */ 9453 } 9454 9455 /* Check the content overflow list */ 9456 if( info.nPayload>info.nLocal ){ 9457 int nPage; /* Number of pages on the overflow chain */ 9458 Pgno pgnoOvfl; /* First page of the overflow chain */ 9459 assert( pc + info.nSize - 4 <= usableSize ); 9460 nPage = (info.nPayload - info.nLocal + usableSize - 5)/(usableSize - 4); 9461 pgnoOvfl = get4byte(&pCell[info.nSize - 4]); 9462 #ifndef SQLITE_OMIT_AUTOVACUUM 9463 if( pBt->autoVacuum ){ 9464 checkPtrmap(pCheck, pgnoOvfl, PTRMAP_OVERFLOW1, iPage); 9465 } 9466 #endif 9467 checkList(pCheck, 0, pgnoOvfl, nPage); 9468 } 9469 9470 if( !pPage->leaf ){ 9471 /* Check sanity of left child page for internal pages */ 9472 pgno = get4byte(pCell); 9473 #ifndef SQLITE_OMIT_AUTOVACUUM 9474 if( pBt->autoVacuum ){ 9475 checkPtrmap(pCheck, pgno, PTRMAP_BTREE, iPage); 9476 } 9477 #endif 9478 d2 = checkTreePage(pCheck, pgno, &maxKey, maxKey); 9479 keyCanBeEqual = 0; 9480 if( d2!=depth ){ 9481 checkAppendMsg(pCheck, "Child page depth differs"); 9482 depth = d2; 9483 } 9484 }else{ 9485 /* Populate the coverage-checking heap for leaf pages */ 9486 btreeHeapInsert(heap, (pc<<16)|(pc+info.nSize-1)); 9487 } 9488 } 9489 *piMinKey = maxKey; 9490 9491 /* Check for complete coverage of the page 9492 */ 9493 pCheck->zPfx = 0; 9494 if( doCoverageCheck && pCheck->mxErr>0 ){ 9495 /* For leaf pages, the min-heap has already been initialized and the 9496 ** cells have already been inserted. But for internal pages, that has 9497 ** not yet been done, so do it now */ 9498 if( !pPage->leaf ){ 9499 heap = pCheck->heap; 9500 heap[0] = 0; 9501 for(i=nCell-1; i>=0; i--){ 9502 u32 size; 9503 pc = get2byteAligned(&data[cellStart+i*2]); 9504 size = pPage->xCellSize(pPage, &data[pc]); 9505 btreeHeapInsert(heap, (pc<<16)|(pc+size-1)); 9506 } 9507 } 9508 /* Add the freeblocks to the min-heap 9509 ** 9510 ** EVIDENCE-OF: R-20690-50594 The second field of the b-tree page header 9511 ** is the offset of the first freeblock, or zero if there are no 9512 ** freeblocks on the page. 9513 */ 9514 i = get2byte(&data[hdr+1]); 9515 while( i>0 ){ 9516 int size, j; 9517 assert( (u32)i<=usableSize-4 ); /* Enforced by btreeInitPage() */ 9518 size = get2byte(&data[i+2]); 9519 assert( (u32)(i+size)<=usableSize ); /* Enforced by btreeInitPage() */ 9520 btreeHeapInsert(heap, (((u32)i)<<16)|(i+size-1)); 9521 /* EVIDENCE-OF: R-58208-19414 The first 2 bytes of a freeblock are a 9522 ** big-endian integer which is the offset in the b-tree page of the next 9523 ** freeblock in the chain, or zero if the freeblock is the last on the 9524 ** chain. */ 9525 j = get2byte(&data[i]); 9526 /* EVIDENCE-OF: R-06866-39125 Freeblocks are always connected in order of 9527 ** increasing offset. */ 9528 assert( j==0 || j>i+size ); /* Enforced by btreeInitPage() */ 9529 assert( (u32)j<=usableSize-4 ); /* Enforced by btreeInitPage() */ 9530 i = j; 9531 } 9532 /* Analyze the min-heap looking for overlap between cells and/or 9533 ** freeblocks, and counting the number of untracked bytes in nFrag. 9534 ** 9535 ** Each min-heap entry is of the form: (start_address<<16)|end_address. 9536 ** There is an implied first entry the covers the page header, the cell 9537 ** pointer index, and the gap between the cell pointer index and the start 9538 ** of cell content. 9539 ** 9540 ** The loop below pulls entries from the min-heap in order and compares 9541 ** the start_address against the previous end_address. If there is an 9542 ** overlap, that means bytes are used multiple times. If there is a gap, 9543 ** that gap is added to the fragmentation count. 9544 */ 9545 nFrag = 0; 9546 prev = contentOffset - 1; /* Implied first min-heap entry */ 9547 while( btreeHeapPull(heap,&x) ){ 9548 if( (prev&0xffff)>=(x>>16) ){ 9549 checkAppendMsg(pCheck, 9550 "Multiple uses for byte %u of page %d", x>>16, iPage); 9551 break; 9552 }else{ 9553 nFrag += (x>>16) - (prev&0xffff) - 1; 9554 prev = x; 9555 } 9556 } 9557 nFrag += usableSize - (prev&0xffff) - 1; 9558 /* EVIDENCE-OF: R-43263-13491 The total number of bytes in all fragments 9559 ** is stored in the fifth field of the b-tree page header. 9560 ** EVIDENCE-OF: R-07161-27322 The one-byte integer at offset 7 gives the 9561 ** number of fragmented free bytes within the cell content area. 9562 */ 9563 if( heap[0]==0 && nFrag!=data[hdr+7] ){ 9564 checkAppendMsg(pCheck, 9565 "Fragmentation of %d bytes reported as %d on page %d", 9566 nFrag, data[hdr+7], iPage); 9567 } 9568 } 9569 9570 end_of_check: 9571 if( !doCoverageCheck ) pPage->isInit = savedIsInit; 9572 releasePage(pPage); 9573 pCheck->zPfx = saved_zPfx; 9574 pCheck->v1 = saved_v1; 9575 pCheck->v2 = saved_v2; 9576 return depth+1; 9577 } 9578 #endif /* SQLITE_OMIT_INTEGRITY_CHECK */ 9579 9580 #ifndef SQLITE_OMIT_INTEGRITY_CHECK 9581 /* 9582 ** This routine does a complete check of the given BTree file. aRoot[] is 9583 ** an array of pages numbers were each page number is the root page of 9584 ** a table. nRoot is the number of entries in aRoot. 9585 ** 9586 ** A read-only or read-write transaction must be opened before calling 9587 ** this function. 9588 ** 9589 ** Write the number of error seen in *pnErr. Except for some memory 9590 ** allocation errors, an error message held in memory obtained from 9591 ** malloc is returned if *pnErr is non-zero. If *pnErr==0 then NULL is 9592 ** returned. If a memory allocation error occurs, NULL is returned. 9593 */ 9594 char *sqlite3BtreeIntegrityCheck( 9595 Btree *p, /* The btree to be checked */ 9596 int *aRoot, /* An array of root pages numbers for individual trees */ 9597 int nRoot, /* Number of entries in aRoot[] */ 9598 int mxErr, /* Stop reporting errors after this many */ 9599 int *pnErr /* Write number of errors seen to this variable */ 9600 ){ 9601 Pgno i; 9602 IntegrityCk sCheck; 9603 BtShared *pBt = p->pBt; 9604 int savedDbFlags = pBt->db->flags; 9605 char zErr[100]; 9606 VVA_ONLY( int nRef ); 9607 9608 sqlite3BtreeEnter(p); 9609 assert( p->inTrans>TRANS_NONE && pBt->inTransaction>TRANS_NONE ); 9610 VVA_ONLY( nRef = sqlite3PagerRefcount(pBt->pPager) ); 9611 assert( nRef>=0 ); 9612 sCheck.pBt = pBt; 9613 sCheck.pPager = pBt->pPager; 9614 sCheck.nPage = btreePagecount(sCheck.pBt); 9615 sCheck.mxErr = mxErr; 9616 sCheck.nErr = 0; 9617 sCheck.mallocFailed = 0; 9618 sCheck.zPfx = 0; 9619 sCheck.v1 = 0; 9620 sCheck.v2 = 0; 9621 sCheck.aPgRef = 0; 9622 sCheck.heap = 0; 9623 sqlite3StrAccumInit(&sCheck.errMsg, 0, zErr, sizeof(zErr), SQLITE_MAX_LENGTH); 9624 sCheck.errMsg.printfFlags = SQLITE_PRINTF_INTERNAL; 9625 if( sCheck.nPage==0 ){ 9626 goto integrity_ck_cleanup; 9627 } 9628 9629 sCheck.aPgRef = sqlite3MallocZero((sCheck.nPage / 8)+ 1); 9630 if( !sCheck.aPgRef ){ 9631 sCheck.mallocFailed = 1; 9632 goto integrity_ck_cleanup; 9633 } 9634 sCheck.heap = (u32*)sqlite3PageMalloc( pBt->pageSize ); 9635 if( sCheck.heap==0 ){ 9636 sCheck.mallocFailed = 1; 9637 goto integrity_ck_cleanup; 9638 } 9639 9640 i = PENDING_BYTE_PAGE(pBt); 9641 if( i<=sCheck.nPage ) setPageReferenced(&sCheck, i); 9642 9643 /* Check the integrity of the freelist 9644 */ 9645 sCheck.zPfx = "Main freelist: "; 9646 checkList(&sCheck, 1, get4byte(&pBt->pPage1->aData[32]), 9647 get4byte(&pBt->pPage1->aData[36])); 9648 sCheck.zPfx = 0; 9649 9650 /* Check all the tables. 9651 */ 9652 testcase( pBt->db->flags & SQLITE_CellSizeCk ); 9653 pBt->db->flags &= ~SQLITE_CellSizeCk; 9654 for(i=0; (int)i<nRoot && sCheck.mxErr; i++){ 9655 i64 notUsed; 9656 if( aRoot[i]==0 ) continue; 9657 #ifndef SQLITE_OMIT_AUTOVACUUM 9658 if( pBt->autoVacuum && aRoot[i]>1 ){ 9659 checkPtrmap(&sCheck, aRoot[i], PTRMAP_ROOTPAGE, 0); 9660 } 9661 #endif 9662 checkTreePage(&sCheck, aRoot[i], &notUsed, LARGEST_INT64); 9663 } 9664 pBt->db->flags = savedDbFlags; 9665 9666 /* Make sure every page in the file is referenced 9667 */ 9668 for(i=1; i<=sCheck.nPage && sCheck.mxErr; i++){ 9669 #ifdef SQLITE_OMIT_AUTOVACUUM 9670 if( getPageReferenced(&sCheck, i)==0 ){ 9671 checkAppendMsg(&sCheck, "Page %d is never used", i); 9672 } 9673 #else 9674 /* If the database supports auto-vacuum, make sure no tables contain 9675 ** references to pointer-map pages. 9676 */ 9677 if( getPageReferenced(&sCheck, i)==0 && 9678 (PTRMAP_PAGENO(pBt, i)!=i || !pBt->autoVacuum) ){ 9679 checkAppendMsg(&sCheck, "Page %d is never used", i); 9680 } 9681 if( getPageReferenced(&sCheck, i)!=0 && 9682 (PTRMAP_PAGENO(pBt, i)==i && pBt->autoVacuum) ){ 9683 checkAppendMsg(&sCheck, "Pointer map page %d is referenced", i); 9684 } 9685 #endif 9686 } 9687 9688 /* Clean up and report errors. 9689 */ 9690 integrity_ck_cleanup: 9691 sqlite3PageFree(sCheck.heap); 9692 sqlite3_free(sCheck.aPgRef); 9693 if( sCheck.mallocFailed ){ 9694 sqlite3StrAccumReset(&sCheck.errMsg); 9695 sCheck.nErr++; 9696 } 9697 *pnErr = sCheck.nErr; 9698 if( sCheck.nErr==0 ) sqlite3StrAccumReset(&sCheck.errMsg); 9699 /* Make sure this analysis did not leave any unref() pages. */ 9700 assert( nRef==sqlite3PagerRefcount(pBt->pPager) ); 9701 sqlite3BtreeLeave(p); 9702 return sqlite3StrAccumFinish(&sCheck.errMsg); 9703 } 9704 #endif /* SQLITE_OMIT_INTEGRITY_CHECK */ 9705 9706 /* 9707 ** Return the full pathname of the underlying database file. Return 9708 ** an empty string if the database is in-memory or a TEMP database. 9709 ** 9710 ** The pager filename is invariant as long as the pager is 9711 ** open so it is safe to access without the BtShared mutex. 9712 */ 9713 const char *sqlite3BtreeGetFilename(Btree *p){ 9714 assert( p->pBt->pPager!=0 ); 9715 return sqlite3PagerFilename(p->pBt->pPager, 1); 9716 } 9717 9718 /* 9719 ** Return the pathname of the journal file for this database. The return 9720 ** value of this routine is the same regardless of whether the journal file 9721 ** has been created or not. 9722 ** 9723 ** The pager journal filename is invariant as long as the pager is 9724 ** open so it is safe to access without the BtShared mutex. 9725 */ 9726 const char *sqlite3BtreeGetJournalname(Btree *p){ 9727 assert( p->pBt->pPager!=0 ); 9728 return sqlite3PagerJournalname(p->pBt->pPager); 9729 } 9730 9731 /* 9732 ** Return non-zero if a transaction is active. 9733 */ 9734 int sqlite3BtreeIsInTrans(Btree *p){ 9735 assert( p==0 || sqlite3_mutex_held(p->db->mutex) ); 9736 return (p && (p->inTrans==TRANS_WRITE)); 9737 } 9738 9739 #ifndef SQLITE_OMIT_WAL 9740 /* 9741 ** Run a checkpoint on the Btree passed as the first argument. 9742 ** 9743 ** Return SQLITE_LOCKED if this or any other connection has an open 9744 ** transaction on the shared-cache the argument Btree is connected to. 9745 ** 9746 ** Parameter eMode is one of SQLITE_CHECKPOINT_PASSIVE, FULL or RESTART. 9747 */ 9748 int sqlite3BtreeCheckpoint(Btree *p, int eMode, int *pnLog, int *pnCkpt){ 9749 int rc = SQLITE_OK; 9750 if( p ){ 9751 BtShared *pBt = p->pBt; 9752 sqlite3BtreeEnter(p); 9753 if( pBt->inTransaction!=TRANS_NONE ){ 9754 rc = SQLITE_LOCKED; 9755 }else{ 9756 rc = sqlite3PagerCheckpoint(pBt->pPager, p->db, eMode, pnLog, pnCkpt); 9757 } 9758 sqlite3BtreeLeave(p); 9759 } 9760 return rc; 9761 } 9762 #endif 9763 9764 /* 9765 ** Return non-zero if a read (or write) transaction is active. 9766 */ 9767 int sqlite3BtreeIsInReadTrans(Btree *p){ 9768 assert( p ); 9769 assert( sqlite3_mutex_held(p->db->mutex) ); 9770 return p->inTrans!=TRANS_NONE; 9771 } 9772 9773 int sqlite3BtreeIsInBackup(Btree *p){ 9774 assert( p ); 9775 assert( sqlite3_mutex_held(p->db->mutex) ); 9776 return p->nBackup!=0; 9777 } 9778 9779 /* 9780 ** This function returns a pointer to a blob of memory associated with 9781 ** a single shared-btree. The memory is used by client code for its own 9782 ** purposes (for example, to store a high-level schema associated with 9783 ** the shared-btree). The btree layer manages reference counting issues. 9784 ** 9785 ** The first time this is called on a shared-btree, nBytes bytes of memory 9786 ** are allocated, zeroed, and returned to the caller. For each subsequent 9787 ** call the nBytes parameter is ignored and a pointer to the same blob 9788 ** of memory returned. 9789 ** 9790 ** If the nBytes parameter is 0 and the blob of memory has not yet been 9791 ** allocated, a null pointer is returned. If the blob has already been 9792 ** allocated, it is returned as normal. 9793 ** 9794 ** Just before the shared-btree is closed, the function passed as the 9795 ** xFree argument when the memory allocation was made is invoked on the 9796 ** blob of allocated memory. The xFree function should not call sqlite3_free() 9797 ** on the memory, the btree layer does that. 9798 */ 9799 void *sqlite3BtreeSchema(Btree *p, int nBytes, void(*xFree)(void *)){ 9800 BtShared *pBt = p->pBt; 9801 sqlite3BtreeEnter(p); 9802 if( !pBt->pSchema && nBytes ){ 9803 pBt->pSchema = sqlite3DbMallocZero(0, nBytes); 9804 pBt->xFreeSchema = xFree; 9805 } 9806 sqlite3BtreeLeave(p); 9807 return pBt->pSchema; 9808 } 9809 9810 /* 9811 ** Return SQLITE_LOCKED_SHAREDCACHE if another user of the same shared 9812 ** btree as the argument handle holds an exclusive lock on the 9813 ** sqlite_master table. Otherwise SQLITE_OK. 9814 */ 9815 int sqlite3BtreeSchemaLocked(Btree *p){ 9816 int rc; 9817 assert( sqlite3_mutex_held(p->db->mutex) ); 9818 sqlite3BtreeEnter(p); 9819 rc = querySharedCacheTableLock(p, MASTER_ROOT, READ_LOCK); 9820 assert( rc==SQLITE_OK || rc==SQLITE_LOCKED_SHAREDCACHE ); 9821 sqlite3BtreeLeave(p); 9822 return rc; 9823 } 9824 9825 9826 #ifndef SQLITE_OMIT_SHARED_CACHE 9827 /* 9828 ** Obtain a lock on the table whose root page is iTab. The 9829 ** lock is a write lock if isWritelock is true or a read lock 9830 ** if it is false. 9831 */ 9832 int sqlite3BtreeLockTable(Btree *p, int iTab, u8 isWriteLock){ 9833 int rc = SQLITE_OK; 9834 assert( p->inTrans!=TRANS_NONE ); 9835 if( p->sharable ){ 9836 u8 lockType = READ_LOCK + isWriteLock; 9837 assert( READ_LOCK+1==WRITE_LOCK ); 9838 assert( isWriteLock==0 || isWriteLock==1 ); 9839 9840 sqlite3BtreeEnter(p); 9841 rc = querySharedCacheTableLock(p, iTab, lockType); 9842 if( rc==SQLITE_OK ){ 9843 rc = setSharedCacheTableLock(p, iTab, lockType); 9844 } 9845 sqlite3BtreeLeave(p); 9846 } 9847 return rc; 9848 } 9849 #endif 9850 9851 #ifndef SQLITE_OMIT_INCRBLOB 9852 /* 9853 ** Argument pCsr must be a cursor opened for writing on an 9854 ** INTKEY table currently pointing at a valid table entry. 9855 ** This function modifies the data stored as part of that entry. 9856 ** 9857 ** Only the data content may only be modified, it is not possible to 9858 ** change the length of the data stored. If this function is called with 9859 ** parameters that attempt to write past the end of the existing data, 9860 ** no modifications are made and SQLITE_CORRUPT is returned. 9861 */ 9862 int sqlite3BtreePutData(BtCursor *pCsr, u32 offset, u32 amt, void *z){ 9863 int rc; 9864 assert( cursorOwnsBtShared(pCsr) ); 9865 assert( sqlite3_mutex_held(pCsr->pBtree->db->mutex) ); 9866 assert( pCsr->curFlags & BTCF_Incrblob ); 9867 9868 rc = restoreCursorPosition(pCsr); 9869 if( rc!=SQLITE_OK ){ 9870 return rc; 9871 } 9872 assert( pCsr->eState!=CURSOR_REQUIRESEEK ); 9873 if( pCsr->eState!=CURSOR_VALID ){ 9874 return SQLITE_ABORT; 9875 } 9876 9877 /* Save the positions of all other cursors open on this table. This is 9878 ** required in case any of them are holding references to an xFetch 9879 ** version of the b-tree page modified by the accessPayload call below. 9880 ** 9881 ** Note that pCsr must be open on a INTKEY table and saveCursorPosition() 9882 ** and hence saveAllCursors() cannot fail on a BTREE_INTKEY table, hence 9883 ** saveAllCursors can only return SQLITE_OK. 9884 */ 9885 VVA_ONLY(rc =) saveAllCursors(pCsr->pBt, pCsr->pgnoRoot, pCsr); 9886 assert( rc==SQLITE_OK ); 9887 9888 /* Check some assumptions: 9889 ** (a) the cursor is open for writing, 9890 ** (b) there is a read/write transaction open, 9891 ** (c) the connection holds a write-lock on the table (if required), 9892 ** (d) there are no conflicting read-locks, and 9893 ** (e) the cursor points at a valid row of an intKey table. 9894 */ 9895 if( (pCsr->curFlags & BTCF_WriteFlag)==0 ){ 9896 return SQLITE_READONLY; 9897 } 9898 assert( (pCsr->pBt->btsFlags & BTS_READ_ONLY)==0 9899 && pCsr->pBt->inTransaction==TRANS_WRITE ); 9900 assert( hasSharedCacheTableLock(pCsr->pBtree, pCsr->pgnoRoot, 0, 2) ); 9901 assert( !hasReadConflicts(pCsr->pBtree, pCsr->pgnoRoot) ); 9902 assert( pCsr->pPage->intKey ); 9903 9904 return accessPayload(pCsr, offset, amt, (unsigned char *)z, 1); 9905 } 9906 9907 /* 9908 ** Mark this cursor as an incremental blob cursor. 9909 */ 9910 void sqlite3BtreeIncrblobCursor(BtCursor *pCur){ 9911 pCur->curFlags |= BTCF_Incrblob; 9912 pCur->pBtree->hasIncrblobCur = 1; 9913 } 9914 #endif 9915 9916 /* 9917 ** Set both the "read version" (single byte at byte offset 18) and 9918 ** "write version" (single byte at byte offset 19) fields in the database 9919 ** header to iVersion. 9920 */ 9921 int sqlite3BtreeSetVersion(Btree *pBtree, int iVersion){ 9922 BtShared *pBt = pBtree->pBt; 9923 int rc; /* Return code */ 9924 9925 assert( iVersion==1 || iVersion==2 ); 9926 9927 /* If setting the version fields to 1, do not automatically open the 9928 ** WAL connection, even if the version fields are currently set to 2. 9929 */ 9930 pBt->btsFlags &= ~BTS_NO_WAL; 9931 if( iVersion==1 ) pBt->btsFlags |= BTS_NO_WAL; 9932 9933 rc = sqlite3BtreeBeginTrans(pBtree, 0); 9934 if( rc==SQLITE_OK ){ 9935 u8 *aData = pBt->pPage1->aData; 9936 if( aData[18]!=(u8)iVersion || aData[19]!=(u8)iVersion ){ 9937 rc = sqlite3BtreeBeginTrans(pBtree, 2); 9938 if( rc==SQLITE_OK ){ 9939 rc = sqlite3PagerWrite(pBt->pPage1->pDbPage); 9940 if( rc==SQLITE_OK ){ 9941 aData[18] = (u8)iVersion; 9942 aData[19] = (u8)iVersion; 9943 } 9944 } 9945 } 9946 } 9947 9948 pBt->btsFlags &= ~BTS_NO_WAL; 9949 return rc; 9950 } 9951 9952 /* 9953 ** Return true if the cursor has a hint specified. This routine is 9954 ** only used from within assert() statements 9955 */ 9956 int sqlite3BtreeCursorHasHint(BtCursor *pCsr, unsigned int mask){ 9957 return (pCsr->hints & mask)!=0; 9958 } 9959 9960 /* 9961 ** Return true if the given Btree is read-only. 9962 */ 9963 int sqlite3BtreeIsReadonly(Btree *p){ 9964 return (p->pBt->btsFlags & BTS_READ_ONLY)!=0; 9965 } 9966 9967 /* 9968 ** Return the size of the header added to each page by this module. 9969 */ 9970 int sqlite3HeaderSizeBtree(void){ return ROUND8(sizeof(MemPage)); } 9971 9972 #if !defined(SQLITE_OMIT_SHARED_CACHE) 9973 /* 9974 ** Return true if the Btree passed as the only argument is sharable. 9975 */ 9976 int sqlite3BtreeSharable(Btree *p){ 9977 return p->sharable; 9978 } 9979 9980 /* 9981 ** Return the number of connections to the BtShared object accessed by 9982 ** the Btree handle passed as the only argument. For private caches 9983 ** this is always 1. For shared caches it may be 1 or greater. 9984 */ 9985 int sqlite3BtreeConnectionCount(Btree *p){ 9986 testcase( p->sharable ); 9987 return p->pBt->nRef; 9988 } 9989 #endif