/ Artifact Content
Login

Artifact 18a53540aa35dbdf77f715ea928422a4ed9011dc16ea7b50f803fd1617fcc4f5:


     1  /*
     2  ** 2004 April 6
     3  **
     4  ** The author disclaims copyright to this source code.  In place of
     5  ** a legal notice, here is a blessing:
     6  **
     7  **    May you do good and not evil.
     8  **    May you find forgiveness for yourself and forgive others.
     9  **    May you share freely, never taking more than you give.
    10  **
    11  *************************************************************************
    12  ** This file implements an external (disk-based) database using BTrees.
    13  ** See the header comment on "btreeInt.h" for additional information.
    14  ** Including a description of file format and an overview of operation.
    15  */
    16  #include "btreeInt.h"
    17  
    18  /*
    19  ** The header string that appears at the beginning of every
    20  ** SQLite database.
    21  */
    22  static const char zMagicHeader[] = SQLITE_FILE_HEADER;
    23  
    24  /*
    25  ** Set this global variable to 1 to enable tracing using the TRACE
    26  ** macro.
    27  */
    28  #if 0
    29  int sqlite3BtreeTrace=1;  /* True to enable tracing */
    30  # define TRACE(X)  if(sqlite3BtreeTrace){printf X;fflush(stdout);}
    31  #else
    32  # define TRACE(X)
    33  #endif
    34  
    35  /*
    36  ** Extract a 2-byte big-endian integer from an array of unsigned bytes.
    37  ** But if the value is zero, make it 65536.
    38  **
    39  ** This routine is used to extract the "offset to cell content area" value
    40  ** from the header of a btree page.  If the page size is 65536 and the page
    41  ** is empty, the offset should be 65536, but the 2-byte value stores zero.
    42  ** This routine makes the necessary adjustment to 65536.
    43  */
    44  #define get2byteNotZero(X)  (((((int)get2byte(X))-1)&0xffff)+1)
    45  
    46  /*
    47  ** Values passed as the 5th argument to allocateBtreePage()
    48  */
    49  #define BTALLOC_ANY   0           /* Allocate any page */
    50  #define BTALLOC_EXACT 1           /* Allocate exact page if possible */
    51  #define BTALLOC_LE    2           /* Allocate any page <= the parameter */
    52  
    53  /*
    54  ** Macro IfNotOmitAV(x) returns (x) if SQLITE_OMIT_AUTOVACUUM is not 
    55  ** defined, or 0 if it is. For example:
    56  **
    57  **   bIncrVacuum = IfNotOmitAV(pBtShared->incrVacuum);
    58  */
    59  #ifndef SQLITE_OMIT_AUTOVACUUM
    60  #define IfNotOmitAV(expr) (expr)
    61  #else
    62  #define IfNotOmitAV(expr) 0
    63  #endif
    64  
    65  #ifndef SQLITE_OMIT_SHARED_CACHE
    66  /*
    67  ** A list of BtShared objects that are eligible for participation
    68  ** in shared cache.  This variable has file scope during normal builds,
    69  ** but the test harness needs to access it so we make it global for 
    70  ** test builds.
    71  **
    72  ** Access to this variable is protected by SQLITE_MUTEX_STATIC_MASTER.
    73  */
    74  #ifdef SQLITE_TEST
    75  BtShared *SQLITE_WSD sqlite3SharedCacheList = 0;
    76  #else
    77  static BtShared *SQLITE_WSD sqlite3SharedCacheList = 0;
    78  #endif
    79  #endif /* SQLITE_OMIT_SHARED_CACHE */
    80  
    81  #ifndef SQLITE_OMIT_SHARED_CACHE
    82  /*
    83  ** Enable or disable the shared pager and schema features.
    84  **
    85  ** This routine has no effect on existing database connections.
    86  ** The shared cache setting effects only future calls to
    87  ** sqlite3_open(), sqlite3_open16(), or sqlite3_open_v2().
    88  */
    89  int sqlite3_enable_shared_cache(int enable){
    90    sqlite3GlobalConfig.sharedCacheEnabled = enable;
    91    return SQLITE_OK;
    92  }
    93  #endif
    94  
    95  
    96  
    97  #ifdef SQLITE_OMIT_SHARED_CACHE
    98    /*
    99    ** The functions querySharedCacheTableLock(), setSharedCacheTableLock(),
   100    ** and clearAllSharedCacheTableLocks()
   101    ** manipulate entries in the BtShared.pLock linked list used to store
   102    ** shared-cache table level locks. If the library is compiled with the
   103    ** shared-cache feature disabled, then there is only ever one user
   104    ** of each BtShared structure and so this locking is not necessary. 
   105    ** So define the lock related functions as no-ops.
   106    */
   107    #define querySharedCacheTableLock(a,b,c) SQLITE_OK
   108    #define setSharedCacheTableLock(a,b,c) SQLITE_OK
   109    #define clearAllSharedCacheTableLocks(a)
   110    #define downgradeAllSharedCacheTableLocks(a)
   111    #define hasSharedCacheTableLock(a,b,c,d) 1
   112    #define hasReadConflicts(a, b) 0
   113  #endif
   114  
   115  /*
   116  ** Implementation of the SQLITE_CORRUPT_PAGE() macro. Takes a single
   117  ** (MemPage*) as an argument. The (MemPage*) must not be NULL.
   118  **
   119  ** If SQLITE_DEBUG is not defined, then this macro is equivalent to
   120  ** SQLITE_CORRUPT_BKPT. Or, if SQLITE_DEBUG is set, then the log message
   121  ** normally produced as a side-effect of SQLITE_CORRUPT_BKPT is augmented
   122  ** with the page number and filename associated with the (MemPage*).
   123  */
   124  #ifdef SQLITE_DEBUG
   125  int corruptPageError(int lineno, MemPage *p){
   126    char *zMsg;
   127    sqlite3BeginBenignMalloc();
   128    zMsg = sqlite3_mprintf("database corruption page %d of %s",
   129        (int)p->pgno, sqlite3PagerFilename(p->pBt->pPager, 0)
   130    );
   131    sqlite3EndBenignMalloc();
   132    if( zMsg ){
   133      sqlite3ReportError(SQLITE_CORRUPT, lineno, zMsg);
   134    }
   135    sqlite3_free(zMsg);
   136    return SQLITE_CORRUPT_BKPT;
   137  }
   138  # define SQLITE_CORRUPT_PAGE(pMemPage) corruptPageError(__LINE__, pMemPage)
   139  #else
   140  # define SQLITE_CORRUPT_PAGE(pMemPage) SQLITE_CORRUPT_PGNO(pMemPage->pgno)
   141  #endif
   142  
   143  #ifndef SQLITE_OMIT_SHARED_CACHE
   144  
   145  #ifdef SQLITE_DEBUG
   146  /*
   147  **** This function is only used as part of an assert() statement. ***
   148  **
   149  ** Check to see if pBtree holds the required locks to read or write to the 
   150  ** table with root page iRoot.   Return 1 if it does and 0 if not.
   151  **
   152  ** For example, when writing to a table with root-page iRoot via 
   153  ** Btree connection pBtree:
   154  **
   155  **    assert( hasSharedCacheTableLock(pBtree, iRoot, 0, WRITE_LOCK) );
   156  **
   157  ** When writing to an index that resides in a sharable database, the 
   158  ** caller should have first obtained a lock specifying the root page of
   159  ** the corresponding table. This makes things a bit more complicated,
   160  ** as this module treats each table as a separate structure. To determine
   161  ** the table corresponding to the index being written, this
   162  ** function has to search through the database schema.
   163  **
   164  ** Instead of a lock on the table/index rooted at page iRoot, the caller may
   165  ** hold a write-lock on the schema table (root page 1). This is also
   166  ** acceptable.
   167  */
   168  static int hasSharedCacheTableLock(
   169    Btree *pBtree,         /* Handle that must hold lock */
   170    Pgno iRoot,            /* Root page of b-tree */
   171    int isIndex,           /* True if iRoot is the root of an index b-tree */
   172    int eLockType          /* Required lock type (READ_LOCK or WRITE_LOCK) */
   173  ){
   174    Schema *pSchema = (Schema *)pBtree->pBt->pSchema;
   175    Pgno iTab = 0;
   176    BtLock *pLock;
   177  
   178    /* If this database is not shareable, or if the client is reading
   179    ** and has the read-uncommitted flag set, then no lock is required. 
   180    ** Return true immediately.
   181    */
   182    if( (pBtree->sharable==0)
   183     || (eLockType==READ_LOCK && (pBtree->db->flags & SQLITE_ReadUncommit))
   184    ){
   185      return 1;
   186    }
   187  
   188    /* If the client is reading  or writing an index and the schema is
   189    ** not loaded, then it is too difficult to actually check to see if
   190    ** the correct locks are held.  So do not bother - just return true.
   191    ** This case does not come up very often anyhow.
   192    */
   193    if( isIndex && (!pSchema || (pSchema->schemaFlags&DB_SchemaLoaded)==0) ){
   194      return 1;
   195    }
   196  
   197    /* Figure out the root-page that the lock should be held on. For table
   198    ** b-trees, this is just the root page of the b-tree being read or
   199    ** written. For index b-trees, it is the root page of the associated
   200    ** table.  */
   201    if( isIndex ){
   202      HashElem *p;
   203      for(p=sqliteHashFirst(&pSchema->idxHash); p; p=sqliteHashNext(p)){
   204        Index *pIdx = (Index *)sqliteHashData(p);
   205        if( pIdx->tnum==(int)iRoot ){
   206          if( iTab ){
   207            /* Two or more indexes share the same root page.  There must
   208            ** be imposter tables.  So just return true.  The assert is not
   209            ** useful in that case. */
   210            return 1;
   211          }
   212          iTab = pIdx->pTable->tnum;
   213        }
   214      }
   215    }else{
   216      iTab = iRoot;
   217    }
   218  
   219    /* Search for the required lock. Either a write-lock on root-page iTab, a 
   220    ** write-lock on the schema table, or (if the client is reading) a
   221    ** read-lock on iTab will suffice. Return 1 if any of these are found.  */
   222    for(pLock=pBtree->pBt->pLock; pLock; pLock=pLock->pNext){
   223      if( pLock->pBtree==pBtree 
   224       && (pLock->iTable==iTab || (pLock->eLock==WRITE_LOCK && pLock->iTable==1))
   225       && pLock->eLock>=eLockType 
   226      ){
   227        return 1;
   228      }
   229    }
   230  
   231    /* Failed to find the required lock. */
   232    return 0;
   233  }
   234  #endif /* SQLITE_DEBUG */
   235  
   236  #ifdef SQLITE_DEBUG
   237  /*
   238  **** This function may be used as part of assert() statements only. ****
   239  **
   240  ** Return true if it would be illegal for pBtree to write into the
   241  ** table or index rooted at iRoot because other shared connections are
   242  ** simultaneously reading that same table or index.
   243  **
   244  ** It is illegal for pBtree to write if some other Btree object that
   245  ** shares the same BtShared object is currently reading or writing
   246  ** the iRoot table.  Except, if the other Btree object has the
   247  ** read-uncommitted flag set, then it is OK for the other object to
   248  ** have a read cursor.
   249  **
   250  ** For example, before writing to any part of the table or index
   251  ** rooted at page iRoot, one should call:
   252  **
   253  **    assert( !hasReadConflicts(pBtree, iRoot) );
   254  */
   255  static int hasReadConflicts(Btree *pBtree, Pgno iRoot){
   256    BtCursor *p;
   257    for(p=pBtree->pBt->pCursor; p; p=p->pNext){
   258      if( p->pgnoRoot==iRoot 
   259       && p->pBtree!=pBtree
   260       && 0==(p->pBtree->db->flags & SQLITE_ReadUncommit)
   261      ){
   262        return 1;
   263      }
   264    }
   265    return 0;
   266  }
   267  #endif    /* #ifdef SQLITE_DEBUG */
   268  
   269  /*
   270  ** Query to see if Btree handle p may obtain a lock of type eLock 
   271  ** (READ_LOCK or WRITE_LOCK) on the table with root-page iTab. Return
   272  ** SQLITE_OK if the lock may be obtained (by calling
   273  ** setSharedCacheTableLock()), or SQLITE_LOCKED if not.
   274  */
   275  static int querySharedCacheTableLock(Btree *p, Pgno iTab, u8 eLock){
   276    BtShared *pBt = p->pBt;
   277    BtLock *pIter;
   278  
   279    assert( sqlite3BtreeHoldsMutex(p) );
   280    assert( eLock==READ_LOCK || eLock==WRITE_LOCK );
   281    assert( p->db!=0 );
   282    assert( !(p->db->flags&SQLITE_ReadUncommit)||eLock==WRITE_LOCK||iTab==1 );
   283    
   284    /* If requesting a write-lock, then the Btree must have an open write
   285    ** transaction on this file. And, obviously, for this to be so there 
   286    ** must be an open write transaction on the file itself.
   287    */
   288    assert( eLock==READ_LOCK || (p==pBt->pWriter && p->inTrans==TRANS_WRITE) );
   289    assert( eLock==READ_LOCK || pBt->inTransaction==TRANS_WRITE );
   290    
   291    /* This routine is a no-op if the shared-cache is not enabled */
   292    if( !p->sharable ){
   293      return SQLITE_OK;
   294    }
   295  
   296    /* If some other connection is holding an exclusive lock, the
   297    ** requested lock may not be obtained.
   298    */
   299    if( pBt->pWriter!=p && (pBt->btsFlags & BTS_EXCLUSIVE)!=0 ){
   300      sqlite3ConnectionBlocked(p->db, pBt->pWriter->db);
   301      return SQLITE_LOCKED_SHAREDCACHE;
   302    }
   303  
   304    for(pIter=pBt->pLock; pIter; pIter=pIter->pNext){
   305      /* The condition (pIter->eLock!=eLock) in the following if(...) 
   306      ** statement is a simplification of:
   307      **
   308      **   (eLock==WRITE_LOCK || pIter->eLock==WRITE_LOCK)
   309      **
   310      ** since we know that if eLock==WRITE_LOCK, then no other connection
   311      ** may hold a WRITE_LOCK on any table in this file (since there can
   312      ** only be a single writer).
   313      */
   314      assert( pIter->eLock==READ_LOCK || pIter->eLock==WRITE_LOCK );
   315      assert( eLock==READ_LOCK || pIter->pBtree==p || pIter->eLock==READ_LOCK);
   316      if( pIter->pBtree!=p && pIter->iTable==iTab && pIter->eLock!=eLock ){
   317        sqlite3ConnectionBlocked(p->db, pIter->pBtree->db);
   318        if( eLock==WRITE_LOCK ){
   319          assert( p==pBt->pWriter );
   320          pBt->btsFlags |= BTS_PENDING;
   321        }
   322        return SQLITE_LOCKED_SHAREDCACHE;
   323      }
   324    }
   325    return SQLITE_OK;
   326  }
   327  #endif /* !SQLITE_OMIT_SHARED_CACHE */
   328  
   329  #ifndef SQLITE_OMIT_SHARED_CACHE
   330  /*
   331  ** Add a lock on the table with root-page iTable to the shared-btree used
   332  ** by Btree handle p. Parameter eLock must be either READ_LOCK or 
   333  ** WRITE_LOCK.
   334  **
   335  ** This function assumes the following:
   336  **
   337  **   (a) The specified Btree object p is connected to a sharable
   338  **       database (one with the BtShared.sharable flag set), and
   339  **
   340  **   (b) No other Btree objects hold a lock that conflicts
   341  **       with the requested lock (i.e. querySharedCacheTableLock() has
   342  **       already been called and returned SQLITE_OK).
   343  **
   344  ** SQLITE_OK is returned if the lock is added successfully. SQLITE_NOMEM 
   345  ** is returned if a malloc attempt fails.
   346  */
   347  static int setSharedCacheTableLock(Btree *p, Pgno iTable, u8 eLock){
   348    BtShared *pBt = p->pBt;
   349    BtLock *pLock = 0;
   350    BtLock *pIter;
   351  
   352    assert( sqlite3BtreeHoldsMutex(p) );
   353    assert( eLock==READ_LOCK || eLock==WRITE_LOCK );
   354    assert( p->db!=0 );
   355  
   356    /* A connection with the read-uncommitted flag set will never try to
   357    ** obtain a read-lock using this function. The only read-lock obtained
   358    ** by a connection in read-uncommitted mode is on the sqlite_master 
   359    ** table, and that lock is obtained in BtreeBeginTrans().  */
   360    assert( 0==(p->db->flags&SQLITE_ReadUncommit) || eLock==WRITE_LOCK );
   361  
   362    /* This function should only be called on a sharable b-tree after it 
   363    ** has been determined that no other b-tree holds a conflicting lock.  */
   364    assert( p->sharable );
   365    assert( SQLITE_OK==querySharedCacheTableLock(p, iTable, eLock) );
   366  
   367    /* First search the list for an existing lock on this table. */
   368    for(pIter=pBt->pLock; pIter; pIter=pIter->pNext){
   369      if( pIter->iTable==iTable && pIter->pBtree==p ){
   370        pLock = pIter;
   371        break;
   372      }
   373    }
   374  
   375    /* If the above search did not find a BtLock struct associating Btree p
   376    ** with table iTable, allocate one and link it into the list.
   377    */
   378    if( !pLock ){
   379      pLock = (BtLock *)sqlite3MallocZero(sizeof(BtLock));
   380      if( !pLock ){
   381        return SQLITE_NOMEM_BKPT;
   382      }
   383      pLock->iTable = iTable;
   384      pLock->pBtree = p;
   385      pLock->pNext = pBt->pLock;
   386      pBt->pLock = pLock;
   387    }
   388  
   389    /* Set the BtLock.eLock variable to the maximum of the current lock
   390    ** and the requested lock. This means if a write-lock was already held
   391    ** and a read-lock requested, we don't incorrectly downgrade the lock.
   392    */
   393    assert( WRITE_LOCK>READ_LOCK );
   394    if( eLock>pLock->eLock ){
   395      pLock->eLock = eLock;
   396    }
   397  
   398    return SQLITE_OK;
   399  }
   400  #endif /* !SQLITE_OMIT_SHARED_CACHE */
   401  
   402  #ifndef SQLITE_OMIT_SHARED_CACHE
   403  /*
   404  ** Release all the table locks (locks obtained via calls to
   405  ** the setSharedCacheTableLock() procedure) held by Btree object p.
   406  **
   407  ** This function assumes that Btree p has an open read or write 
   408  ** transaction. If it does not, then the BTS_PENDING flag
   409  ** may be incorrectly cleared.
   410  */
   411  static void clearAllSharedCacheTableLocks(Btree *p){
   412    BtShared *pBt = p->pBt;
   413    BtLock **ppIter = &pBt->pLock;
   414  
   415    assert( sqlite3BtreeHoldsMutex(p) );
   416    assert( p->sharable || 0==*ppIter );
   417    assert( p->inTrans>0 );
   418  
   419    while( *ppIter ){
   420      BtLock *pLock = *ppIter;
   421      assert( (pBt->btsFlags & BTS_EXCLUSIVE)==0 || pBt->pWriter==pLock->pBtree );
   422      assert( pLock->pBtree->inTrans>=pLock->eLock );
   423      if( pLock->pBtree==p ){
   424        *ppIter = pLock->pNext;
   425        assert( pLock->iTable!=1 || pLock==&p->lock );
   426        if( pLock->iTable!=1 ){
   427          sqlite3_free(pLock);
   428        }
   429      }else{
   430        ppIter = &pLock->pNext;
   431      }
   432    }
   433  
   434    assert( (pBt->btsFlags & BTS_PENDING)==0 || pBt->pWriter );
   435    if( pBt->pWriter==p ){
   436      pBt->pWriter = 0;
   437      pBt->btsFlags &= ~(BTS_EXCLUSIVE|BTS_PENDING);
   438    }else if( pBt->nTransaction==2 ){
   439      /* This function is called when Btree p is concluding its 
   440      ** transaction. If there currently exists a writer, and p is not
   441      ** that writer, then the number of locks held by connections other
   442      ** than the writer must be about to drop to zero. In this case
   443      ** set the BTS_PENDING flag to 0.
   444      **
   445      ** If there is not currently a writer, then BTS_PENDING must
   446      ** be zero already. So this next line is harmless in that case.
   447      */
   448      pBt->btsFlags &= ~BTS_PENDING;
   449    }
   450  }
   451  
   452  /*
   453  ** This function changes all write-locks held by Btree p into read-locks.
   454  */
   455  static void downgradeAllSharedCacheTableLocks(Btree *p){
   456    BtShared *pBt = p->pBt;
   457    if( pBt->pWriter==p ){
   458      BtLock *pLock;
   459      pBt->pWriter = 0;
   460      pBt->btsFlags &= ~(BTS_EXCLUSIVE|BTS_PENDING);
   461      for(pLock=pBt->pLock; pLock; pLock=pLock->pNext){
   462        assert( pLock->eLock==READ_LOCK || pLock->pBtree==p );
   463        pLock->eLock = READ_LOCK;
   464      }
   465    }
   466  }
   467  
   468  #endif /* SQLITE_OMIT_SHARED_CACHE */
   469  
   470  static void releasePage(MemPage *pPage);         /* Forward reference */
   471  static void releasePageOne(MemPage *pPage);      /* Forward reference */
   472  static void releasePageNotNull(MemPage *pPage);  /* Forward reference */
   473  
   474  /*
   475  ***** This routine is used inside of assert() only ****
   476  **
   477  ** Verify that the cursor holds the mutex on its BtShared
   478  */
   479  #ifdef SQLITE_DEBUG
   480  static int cursorHoldsMutex(BtCursor *p){
   481    return sqlite3_mutex_held(p->pBt->mutex);
   482  }
   483  
   484  /* Verify that the cursor and the BtShared agree about what is the current
   485  ** database connetion. This is important in shared-cache mode. If the database 
   486  ** connection pointers get out-of-sync, it is possible for routines like
   487  ** btreeInitPage() to reference an stale connection pointer that references a
   488  ** a connection that has already closed.  This routine is used inside assert()
   489  ** statements only and for the purpose of double-checking that the btree code
   490  ** does keep the database connection pointers up-to-date.
   491  */
   492  static int cursorOwnsBtShared(BtCursor *p){
   493    assert( cursorHoldsMutex(p) );
   494    return (p->pBtree->db==p->pBt->db);
   495  }
   496  #endif
   497  
   498  /*
   499  ** Invalidate the overflow cache of the cursor passed as the first argument.
   500  ** on the shared btree structure pBt.
   501  */
   502  #define invalidateOverflowCache(pCur) (pCur->curFlags &= ~BTCF_ValidOvfl)
   503  
   504  /*
   505  ** Invalidate the overflow page-list cache for all cursors opened
   506  ** on the shared btree structure pBt.
   507  */
   508  static void invalidateAllOverflowCache(BtShared *pBt){
   509    BtCursor *p;
   510    assert( sqlite3_mutex_held(pBt->mutex) );
   511    for(p=pBt->pCursor; p; p=p->pNext){
   512      invalidateOverflowCache(p);
   513    }
   514  }
   515  
   516  #ifndef SQLITE_OMIT_INCRBLOB
   517  /*
   518  ** This function is called before modifying the contents of a table
   519  ** to invalidate any incrblob cursors that are open on the
   520  ** row or one of the rows being modified.
   521  **
   522  ** If argument isClearTable is true, then the entire contents of the
   523  ** table is about to be deleted. In this case invalidate all incrblob
   524  ** cursors open on any row within the table with root-page pgnoRoot.
   525  **
   526  ** Otherwise, if argument isClearTable is false, then the row with
   527  ** rowid iRow is being replaced or deleted. In this case invalidate
   528  ** only those incrblob cursors open on that specific row.
   529  */
   530  static void invalidateIncrblobCursors(
   531    Btree *pBtree,          /* The database file to check */
   532    Pgno pgnoRoot,          /* The table that might be changing */
   533    i64 iRow,               /* The rowid that might be changing */
   534    int isClearTable        /* True if all rows are being deleted */
   535  ){
   536    BtCursor *p;
   537    if( pBtree->hasIncrblobCur==0 ) return;
   538    assert( sqlite3BtreeHoldsMutex(pBtree) );
   539    pBtree->hasIncrblobCur = 0;
   540    for(p=pBtree->pBt->pCursor; p; p=p->pNext){
   541      if( (p->curFlags & BTCF_Incrblob)!=0 ){
   542        pBtree->hasIncrblobCur = 1;
   543        if( p->pgnoRoot==pgnoRoot && (isClearTable || p->info.nKey==iRow) ){
   544          p->eState = CURSOR_INVALID;
   545        }
   546      }
   547    }
   548  }
   549  
   550  #else
   551    /* Stub function when INCRBLOB is omitted */
   552    #define invalidateIncrblobCursors(w,x,y,z)
   553  #endif /* SQLITE_OMIT_INCRBLOB */
   554  
   555  /*
   556  ** Set bit pgno of the BtShared.pHasContent bitvec. This is called 
   557  ** when a page that previously contained data becomes a free-list leaf 
   558  ** page.
   559  **
   560  ** The BtShared.pHasContent bitvec exists to work around an obscure
   561  ** bug caused by the interaction of two useful IO optimizations surrounding
   562  ** free-list leaf pages:
   563  **
   564  **   1) When all data is deleted from a page and the page becomes
   565  **      a free-list leaf page, the page is not written to the database
   566  **      (as free-list leaf pages contain no meaningful data). Sometimes
   567  **      such a page is not even journalled (as it will not be modified,
   568  **      why bother journalling it?).
   569  **
   570  **   2) When a free-list leaf page is reused, its content is not read
   571  **      from the database or written to the journal file (why should it
   572  **      be, if it is not at all meaningful?).
   573  **
   574  ** By themselves, these optimizations work fine and provide a handy
   575  ** performance boost to bulk delete or insert operations. However, if
   576  ** a page is moved to the free-list and then reused within the same
   577  ** transaction, a problem comes up. If the page is not journalled when
   578  ** it is moved to the free-list and it is also not journalled when it
   579  ** is extracted from the free-list and reused, then the original data
   580  ** may be lost. In the event of a rollback, it may not be possible
   581  ** to restore the database to its original configuration.
   582  **
   583  ** The solution is the BtShared.pHasContent bitvec. Whenever a page is 
   584  ** moved to become a free-list leaf page, the corresponding bit is
   585  ** set in the bitvec. Whenever a leaf page is extracted from the free-list,
   586  ** optimization 2 above is omitted if the corresponding bit is already
   587  ** set in BtShared.pHasContent. The contents of the bitvec are cleared
   588  ** at the end of every transaction.
   589  */
   590  static int btreeSetHasContent(BtShared *pBt, Pgno pgno){
   591    int rc = SQLITE_OK;
   592    if( !pBt->pHasContent ){
   593      assert( pgno<=pBt->nPage );
   594      pBt->pHasContent = sqlite3BitvecCreate(pBt->nPage);
   595      if( !pBt->pHasContent ){
   596        rc = SQLITE_NOMEM_BKPT;
   597      }
   598    }
   599    if( rc==SQLITE_OK && pgno<=sqlite3BitvecSize(pBt->pHasContent) ){
   600      rc = sqlite3BitvecSet(pBt->pHasContent, pgno);
   601    }
   602    return rc;
   603  }
   604  
   605  /*
   606  ** Query the BtShared.pHasContent vector.
   607  **
   608  ** This function is called when a free-list leaf page is removed from the
   609  ** free-list for reuse. It returns false if it is safe to retrieve the
   610  ** page from the pager layer with the 'no-content' flag set. True otherwise.
   611  */
   612  static int btreeGetHasContent(BtShared *pBt, Pgno pgno){
   613    Bitvec *p = pBt->pHasContent;
   614    return (p && (pgno>sqlite3BitvecSize(p) || sqlite3BitvecTest(p, pgno)));
   615  }
   616  
   617  /*
   618  ** Clear (destroy) the BtShared.pHasContent bitvec. This should be
   619  ** invoked at the conclusion of each write-transaction.
   620  */
   621  static void btreeClearHasContent(BtShared *pBt){
   622    sqlite3BitvecDestroy(pBt->pHasContent);
   623    pBt->pHasContent = 0;
   624  }
   625  
   626  /*
   627  ** Release all of the apPage[] pages for a cursor.
   628  */
   629  static void btreeReleaseAllCursorPages(BtCursor *pCur){
   630    int i;
   631    if( pCur->iPage>=0 ){
   632      for(i=0; i<pCur->iPage; i++){
   633        releasePageNotNull(pCur->apPage[i]);
   634      }
   635      releasePageNotNull(pCur->pPage);
   636      pCur->iPage = -1;
   637    }
   638  }
   639  
   640  /*
   641  ** The cursor passed as the only argument must point to a valid entry
   642  ** when this function is called (i.e. have eState==CURSOR_VALID). This
   643  ** function saves the current cursor key in variables pCur->nKey and
   644  ** pCur->pKey. SQLITE_OK is returned if successful or an SQLite error 
   645  ** code otherwise.
   646  **
   647  ** If the cursor is open on an intkey table, then the integer key
   648  ** (the rowid) is stored in pCur->nKey and pCur->pKey is left set to
   649  ** NULL. If the cursor is open on a non-intkey table, then pCur->pKey is 
   650  ** set to point to a malloced buffer pCur->nKey bytes in size containing 
   651  ** the key.
   652  */
   653  static int saveCursorKey(BtCursor *pCur){
   654    int rc = SQLITE_OK;
   655    assert( CURSOR_VALID==pCur->eState );
   656    assert( 0==pCur->pKey );
   657    assert( cursorHoldsMutex(pCur) );
   658  
   659    if( pCur->curIntKey ){
   660      /* Only the rowid is required for a table btree */
   661      pCur->nKey = sqlite3BtreeIntegerKey(pCur);
   662    }else{
   663      /* For an index btree, save the complete key content */
   664      void *pKey;
   665      pCur->nKey = sqlite3BtreePayloadSize(pCur);
   666      pKey = sqlite3Malloc( pCur->nKey );
   667      if( pKey ){
   668        rc = sqlite3BtreePayload(pCur, 0, (int)pCur->nKey, pKey);
   669        if( rc==SQLITE_OK ){
   670          pCur->pKey = pKey;
   671        }else{
   672          sqlite3_free(pKey);
   673        }
   674      }else{
   675        rc = SQLITE_NOMEM_BKPT;
   676      }
   677    }
   678    assert( !pCur->curIntKey || !pCur->pKey );
   679    return rc;
   680  }
   681  
   682  /*
   683  ** Save the current cursor position in the variables BtCursor.nKey 
   684  ** and BtCursor.pKey. The cursor's state is set to CURSOR_REQUIRESEEK.
   685  **
   686  ** The caller must ensure that the cursor is valid (has eState==CURSOR_VALID)
   687  ** prior to calling this routine.  
   688  */
   689  static int saveCursorPosition(BtCursor *pCur){
   690    int rc;
   691  
   692    assert( CURSOR_VALID==pCur->eState || CURSOR_SKIPNEXT==pCur->eState );
   693    assert( 0==pCur->pKey );
   694    assert( cursorHoldsMutex(pCur) );
   695  
   696    if( pCur->eState==CURSOR_SKIPNEXT ){
   697      pCur->eState = CURSOR_VALID;
   698    }else{
   699      pCur->skipNext = 0;
   700    }
   701  
   702    rc = saveCursorKey(pCur);
   703    if( rc==SQLITE_OK ){
   704      btreeReleaseAllCursorPages(pCur);
   705      pCur->eState = CURSOR_REQUIRESEEK;
   706    }
   707  
   708    pCur->curFlags &= ~(BTCF_ValidNKey|BTCF_ValidOvfl|BTCF_AtLast);
   709    return rc;
   710  }
   711  
   712  /* Forward reference */
   713  static int SQLITE_NOINLINE saveCursorsOnList(BtCursor*,Pgno,BtCursor*);
   714  
   715  /*
   716  ** Save the positions of all cursors (except pExcept) that are open on
   717  ** the table with root-page iRoot.  "Saving the cursor position" means that
   718  ** the location in the btree is remembered in such a way that it can be
   719  ** moved back to the same spot after the btree has been modified.  This
   720  ** routine is called just before cursor pExcept is used to modify the
   721  ** table, for example in BtreeDelete() or BtreeInsert().
   722  **
   723  ** If there are two or more cursors on the same btree, then all such 
   724  ** cursors should have their BTCF_Multiple flag set.  The btreeCursor()
   725  ** routine enforces that rule.  This routine only needs to be called in
   726  ** the uncommon case when pExpect has the BTCF_Multiple flag set.
   727  **
   728  ** If pExpect!=NULL and if no other cursors are found on the same root-page,
   729  ** then the BTCF_Multiple flag on pExpect is cleared, to avoid another
   730  ** pointless call to this routine.
   731  **
   732  ** Implementation note:  This routine merely checks to see if any cursors
   733  ** need to be saved.  It calls out to saveCursorsOnList() in the (unusual)
   734  ** event that cursors are in need to being saved.
   735  */
   736  static int saveAllCursors(BtShared *pBt, Pgno iRoot, BtCursor *pExcept){
   737    BtCursor *p;
   738    assert( sqlite3_mutex_held(pBt->mutex) );
   739    assert( pExcept==0 || pExcept->pBt==pBt );
   740    for(p=pBt->pCursor; p; p=p->pNext){
   741      if( p!=pExcept && (0==iRoot || p->pgnoRoot==iRoot) ) break;
   742    }
   743    if( p ) return saveCursorsOnList(p, iRoot, pExcept);
   744    if( pExcept ) pExcept->curFlags &= ~BTCF_Multiple;
   745    return SQLITE_OK;
   746  }
   747  
   748  /* This helper routine to saveAllCursors does the actual work of saving
   749  ** the cursors if and when a cursor is found that actually requires saving.
   750  ** The common case is that no cursors need to be saved, so this routine is
   751  ** broken out from its caller to avoid unnecessary stack pointer movement.
   752  */
   753  static int SQLITE_NOINLINE saveCursorsOnList(
   754    BtCursor *p,         /* The first cursor that needs saving */
   755    Pgno iRoot,          /* Only save cursor with this iRoot. Save all if zero */
   756    BtCursor *pExcept    /* Do not save this cursor */
   757  ){
   758    do{
   759      if( p!=pExcept && (0==iRoot || p->pgnoRoot==iRoot) ){
   760        if( p->eState==CURSOR_VALID || p->eState==CURSOR_SKIPNEXT ){
   761          int rc = saveCursorPosition(p);
   762          if( SQLITE_OK!=rc ){
   763            return rc;
   764          }
   765        }else{
   766          testcase( p->iPage>=0 );
   767          btreeReleaseAllCursorPages(p);
   768        }
   769      }
   770      p = p->pNext;
   771    }while( p );
   772    return SQLITE_OK;
   773  }
   774  
   775  /*
   776  ** Clear the current cursor position.
   777  */
   778  void sqlite3BtreeClearCursor(BtCursor *pCur){
   779    assert( cursorHoldsMutex(pCur) );
   780    sqlite3_free(pCur->pKey);
   781    pCur->pKey = 0;
   782    pCur->eState = CURSOR_INVALID;
   783  }
   784  
   785  /*
   786  ** In this version of BtreeMoveto, pKey is a packed index record
   787  ** such as is generated by the OP_MakeRecord opcode.  Unpack the
   788  ** record and then call BtreeMovetoUnpacked() to do the work.
   789  */
   790  static int btreeMoveto(
   791    BtCursor *pCur,     /* Cursor open on the btree to be searched */
   792    const void *pKey,   /* Packed key if the btree is an index */
   793    i64 nKey,           /* Integer key for tables.  Size of pKey for indices */
   794    int bias,           /* Bias search to the high end */
   795    int *pRes           /* Write search results here */
   796  ){
   797    int rc;                    /* Status code */
   798    UnpackedRecord *pIdxKey;   /* Unpacked index key */
   799  
   800    if( pKey ){
   801      assert( nKey==(i64)(int)nKey );
   802      pIdxKey = sqlite3VdbeAllocUnpackedRecord(pCur->pKeyInfo);
   803      if( pIdxKey==0 ) return SQLITE_NOMEM_BKPT;
   804      sqlite3VdbeRecordUnpack(pCur->pKeyInfo, (int)nKey, pKey, pIdxKey);
   805      if( pIdxKey->nField==0 ){
   806        rc = SQLITE_CORRUPT_BKPT;
   807        goto moveto_done;
   808      }
   809    }else{
   810      pIdxKey = 0;
   811    }
   812    rc = sqlite3BtreeMovetoUnpacked(pCur, pIdxKey, nKey, bias, pRes);
   813  moveto_done:
   814    if( pIdxKey ){
   815      sqlite3DbFree(pCur->pKeyInfo->db, pIdxKey);
   816    }
   817    return rc;
   818  }
   819  
   820  /*
   821  ** Restore the cursor to the position it was in (or as close to as possible)
   822  ** when saveCursorPosition() was called. Note that this call deletes the 
   823  ** saved position info stored by saveCursorPosition(), so there can be
   824  ** at most one effective restoreCursorPosition() call after each 
   825  ** saveCursorPosition().
   826  */
   827  static int btreeRestoreCursorPosition(BtCursor *pCur){
   828    int rc;
   829    int skipNext;
   830    assert( cursorOwnsBtShared(pCur) );
   831    assert( pCur->eState>=CURSOR_REQUIRESEEK );
   832    if( pCur->eState==CURSOR_FAULT ){
   833      return pCur->skipNext;
   834    }
   835    pCur->eState = CURSOR_INVALID;
   836    rc = btreeMoveto(pCur, pCur->pKey, pCur->nKey, 0, &skipNext);
   837    if( rc==SQLITE_OK ){
   838      sqlite3_free(pCur->pKey);
   839      pCur->pKey = 0;
   840      assert( pCur->eState==CURSOR_VALID || pCur->eState==CURSOR_INVALID );
   841      pCur->skipNext |= skipNext;
   842      if( pCur->skipNext && pCur->eState==CURSOR_VALID ){
   843        pCur->eState = CURSOR_SKIPNEXT;
   844      }
   845    }
   846    return rc;
   847  }
   848  
   849  #define restoreCursorPosition(p) \
   850    (p->eState>=CURSOR_REQUIRESEEK ? \
   851           btreeRestoreCursorPosition(p) : \
   852           SQLITE_OK)
   853  
   854  /*
   855  ** Determine whether or not a cursor has moved from the position where
   856  ** it was last placed, or has been invalidated for any other reason.
   857  ** Cursors can move when the row they are pointing at is deleted out
   858  ** from under them, for example.  Cursor might also move if a btree
   859  ** is rebalanced.
   860  **
   861  ** Calling this routine with a NULL cursor pointer returns false.
   862  **
   863  ** Use the separate sqlite3BtreeCursorRestore() routine to restore a cursor
   864  ** back to where it ought to be if this routine returns true.
   865  */
   866  int sqlite3BtreeCursorHasMoved(BtCursor *pCur){
   867    return pCur->eState!=CURSOR_VALID;
   868  }
   869  
   870  /*
   871  ** Return a pointer to a fake BtCursor object that will always answer
   872  ** false to the sqlite3BtreeCursorHasMoved() routine above.  The fake
   873  ** cursor returned must not be used with any other Btree interface.
   874  */
   875  BtCursor *sqlite3BtreeFakeValidCursor(void){
   876    static u8 fakeCursor = CURSOR_VALID;
   877    assert( offsetof(BtCursor, eState)==0 );
   878    return (BtCursor*)&fakeCursor;
   879  }
   880  
   881  /*
   882  ** This routine restores a cursor back to its original position after it
   883  ** has been moved by some outside activity (such as a btree rebalance or
   884  ** a row having been deleted out from under the cursor).  
   885  **
   886  ** On success, the *pDifferentRow parameter is false if the cursor is left
   887  ** pointing at exactly the same row.  *pDifferntRow is the row the cursor
   888  ** was pointing to has been deleted, forcing the cursor to point to some
   889  ** nearby row.
   890  **
   891  ** This routine should only be called for a cursor that just returned
   892  ** TRUE from sqlite3BtreeCursorHasMoved().
   893  */
   894  int sqlite3BtreeCursorRestore(BtCursor *pCur, int *pDifferentRow){
   895    int rc;
   896  
   897    assert( pCur!=0 );
   898    assert( pCur->eState!=CURSOR_VALID );
   899    rc = restoreCursorPosition(pCur);
   900    if( rc ){
   901      *pDifferentRow = 1;
   902      return rc;
   903    }
   904    if( pCur->eState!=CURSOR_VALID ){
   905      *pDifferentRow = 1;
   906    }else{
   907      assert( pCur->skipNext==0 );
   908      *pDifferentRow = 0;
   909    }
   910    return SQLITE_OK;
   911  }
   912  
   913  #ifdef SQLITE_ENABLE_CURSOR_HINTS
   914  /*
   915  ** Provide hints to the cursor.  The particular hint given (and the type
   916  ** and number of the varargs parameters) is determined by the eHintType
   917  ** parameter.  See the definitions of the BTREE_HINT_* macros for details.
   918  */
   919  void sqlite3BtreeCursorHint(BtCursor *pCur, int eHintType, ...){
   920    /* Used only by system that substitute their own storage engine */
   921  }
   922  #endif
   923  
   924  /*
   925  ** Provide flag hints to the cursor.
   926  */
   927  void sqlite3BtreeCursorHintFlags(BtCursor *pCur, unsigned x){
   928    assert( x==BTREE_SEEK_EQ || x==BTREE_BULKLOAD || x==0 );
   929    pCur->hints = x;
   930  }
   931  
   932  
   933  #ifndef SQLITE_OMIT_AUTOVACUUM
   934  /*
   935  ** Given a page number of a regular database page, return the page
   936  ** number for the pointer-map page that contains the entry for the
   937  ** input page number.
   938  **
   939  ** Return 0 (not a valid page) for pgno==1 since there is
   940  ** no pointer map associated with page 1.  The integrity_check logic
   941  ** requires that ptrmapPageno(*,1)!=1.
   942  */
   943  static Pgno ptrmapPageno(BtShared *pBt, Pgno pgno){
   944    int nPagesPerMapPage;
   945    Pgno iPtrMap, ret;
   946    assert( sqlite3_mutex_held(pBt->mutex) );
   947    if( pgno<2 ) return 0;
   948    nPagesPerMapPage = (pBt->usableSize/5)+1;
   949    iPtrMap = (pgno-2)/nPagesPerMapPage;
   950    ret = (iPtrMap*nPagesPerMapPage) + 2; 
   951    if( ret==PENDING_BYTE_PAGE(pBt) ){
   952      ret++;
   953    }
   954    return ret;
   955  }
   956  
   957  /*
   958  ** Write an entry into the pointer map.
   959  **
   960  ** This routine updates the pointer map entry for page number 'key'
   961  ** so that it maps to type 'eType' and parent page number 'pgno'.
   962  **
   963  ** If *pRC is initially non-zero (non-SQLITE_OK) then this routine is
   964  ** a no-op.  If an error occurs, the appropriate error code is written
   965  ** into *pRC.
   966  */
   967  static void ptrmapPut(BtShared *pBt, Pgno key, u8 eType, Pgno parent, int *pRC){
   968    DbPage *pDbPage;  /* The pointer map page */
   969    u8 *pPtrmap;      /* The pointer map data */
   970    Pgno iPtrmap;     /* The pointer map page number */
   971    int offset;       /* Offset in pointer map page */
   972    int rc;           /* Return code from subfunctions */
   973  
   974    if( *pRC ) return;
   975  
   976    assert( sqlite3_mutex_held(pBt->mutex) );
   977    /* The master-journal page number must never be used as a pointer map page */
   978    assert( 0==PTRMAP_ISPAGE(pBt, PENDING_BYTE_PAGE(pBt)) );
   979  
   980    assert( pBt->autoVacuum );
   981    if( key==0 ){
   982      *pRC = SQLITE_CORRUPT_BKPT;
   983      return;
   984    }
   985    iPtrmap = PTRMAP_PAGENO(pBt, key);
   986    rc = sqlite3PagerGet(pBt->pPager, iPtrmap, &pDbPage, 0);
   987    if( rc!=SQLITE_OK ){
   988      *pRC = rc;
   989      return;
   990    }
   991    offset = PTRMAP_PTROFFSET(iPtrmap, key);
   992    if( offset<0 ){
   993      *pRC = SQLITE_CORRUPT_BKPT;
   994      goto ptrmap_exit;
   995    }
   996    assert( offset <= (int)pBt->usableSize-5 );
   997    pPtrmap = (u8 *)sqlite3PagerGetData(pDbPage);
   998  
   999    if( eType!=pPtrmap[offset] || get4byte(&pPtrmap[offset+1])!=parent ){
  1000      TRACE(("PTRMAP_UPDATE: %d->(%d,%d)\n", key, eType, parent));
  1001      *pRC= rc = sqlite3PagerWrite(pDbPage);
  1002      if( rc==SQLITE_OK ){
  1003        pPtrmap[offset] = eType;
  1004        put4byte(&pPtrmap[offset+1], parent);
  1005      }
  1006    }
  1007  
  1008  ptrmap_exit:
  1009    sqlite3PagerUnref(pDbPage);
  1010  }
  1011  
  1012  /*
  1013  ** Read an entry from the pointer map.
  1014  **
  1015  ** This routine retrieves the pointer map entry for page 'key', writing
  1016  ** the type and parent page number to *pEType and *pPgno respectively.
  1017  ** An error code is returned if something goes wrong, otherwise SQLITE_OK.
  1018  */
  1019  static int ptrmapGet(BtShared *pBt, Pgno key, u8 *pEType, Pgno *pPgno){
  1020    DbPage *pDbPage;   /* The pointer map page */
  1021    int iPtrmap;       /* Pointer map page index */
  1022    u8 *pPtrmap;       /* Pointer map page data */
  1023    int offset;        /* Offset of entry in pointer map */
  1024    int rc;
  1025  
  1026    assert( sqlite3_mutex_held(pBt->mutex) );
  1027  
  1028    iPtrmap = PTRMAP_PAGENO(pBt, key);
  1029    rc = sqlite3PagerGet(pBt->pPager, iPtrmap, &pDbPage, 0);
  1030    if( rc!=0 ){
  1031      return rc;
  1032    }
  1033    pPtrmap = (u8 *)sqlite3PagerGetData(pDbPage);
  1034  
  1035    offset = PTRMAP_PTROFFSET(iPtrmap, key);
  1036    if( offset<0 ){
  1037      sqlite3PagerUnref(pDbPage);
  1038      return SQLITE_CORRUPT_BKPT;
  1039    }
  1040    assert( offset <= (int)pBt->usableSize-5 );
  1041    assert( pEType!=0 );
  1042    *pEType = pPtrmap[offset];
  1043    if( pPgno ) *pPgno = get4byte(&pPtrmap[offset+1]);
  1044  
  1045    sqlite3PagerUnref(pDbPage);
  1046    if( *pEType<1 || *pEType>5 ) return SQLITE_CORRUPT_PGNO(iPtrmap);
  1047    return SQLITE_OK;
  1048  }
  1049  
  1050  #else /* if defined SQLITE_OMIT_AUTOVACUUM */
  1051    #define ptrmapPut(w,x,y,z,rc)
  1052    #define ptrmapGet(w,x,y,z) SQLITE_OK
  1053    #define ptrmapPutOvflPtr(x, y, rc)
  1054  #endif
  1055  
  1056  /*
  1057  ** Given a btree page and a cell index (0 means the first cell on
  1058  ** the page, 1 means the second cell, and so forth) return a pointer
  1059  ** to the cell content.
  1060  **
  1061  ** findCellPastPtr() does the same except it skips past the initial
  1062  ** 4-byte child pointer found on interior pages, if there is one.
  1063  **
  1064  ** This routine works only for pages that do not contain overflow cells.
  1065  */
  1066  #define findCell(P,I) \
  1067    ((P)->aData + ((P)->maskPage & get2byteAligned(&(P)->aCellIdx[2*(I)])))
  1068  #define findCellPastPtr(P,I) \
  1069    ((P)->aDataOfst + ((P)->maskPage & get2byteAligned(&(P)->aCellIdx[2*(I)])))
  1070  
  1071  
  1072  /*
  1073  ** This is common tail processing for btreeParseCellPtr() and
  1074  ** btreeParseCellPtrIndex() for the case when the cell does not fit entirely
  1075  ** on a single B-tree page.  Make necessary adjustments to the CellInfo
  1076  ** structure.
  1077  */
  1078  static SQLITE_NOINLINE void btreeParseCellAdjustSizeForOverflow(
  1079    MemPage *pPage,         /* Page containing the cell */
  1080    u8 *pCell,              /* Pointer to the cell text. */
  1081    CellInfo *pInfo         /* Fill in this structure */
  1082  ){
  1083    /* If the payload will not fit completely on the local page, we have
  1084    ** to decide how much to store locally and how much to spill onto
  1085    ** overflow pages.  The strategy is to minimize the amount of unused
  1086    ** space on overflow pages while keeping the amount of local storage
  1087    ** in between minLocal and maxLocal.
  1088    **
  1089    ** Warning:  changing the way overflow payload is distributed in any
  1090    ** way will result in an incompatible file format.
  1091    */
  1092    int minLocal;  /* Minimum amount of payload held locally */
  1093    int maxLocal;  /* Maximum amount of payload held locally */
  1094    int surplus;   /* Overflow payload available for local storage */
  1095  
  1096    minLocal = pPage->minLocal;
  1097    maxLocal = pPage->maxLocal;
  1098    surplus = minLocal + (pInfo->nPayload - minLocal)%(pPage->pBt->usableSize-4);
  1099    testcase( surplus==maxLocal );
  1100    testcase( surplus==maxLocal+1 );
  1101    if( surplus <= maxLocal ){
  1102      pInfo->nLocal = (u16)surplus;
  1103    }else{
  1104      pInfo->nLocal = (u16)minLocal;
  1105    }
  1106    pInfo->nSize = (u16)(&pInfo->pPayload[pInfo->nLocal] - pCell) + 4;
  1107  }
  1108  
  1109  /*
  1110  ** The following routines are implementations of the MemPage.xParseCell()
  1111  ** method.
  1112  **
  1113  ** Parse a cell content block and fill in the CellInfo structure.
  1114  **
  1115  ** btreeParseCellPtr()        =>   table btree leaf nodes
  1116  ** btreeParseCellNoPayload()  =>   table btree internal nodes
  1117  ** btreeParseCellPtrIndex()   =>   index btree nodes
  1118  **
  1119  ** There is also a wrapper function btreeParseCell() that works for
  1120  ** all MemPage types and that references the cell by index rather than
  1121  ** by pointer.
  1122  */
  1123  static void btreeParseCellPtrNoPayload(
  1124    MemPage *pPage,         /* Page containing the cell */
  1125    u8 *pCell,              /* Pointer to the cell text. */
  1126    CellInfo *pInfo         /* Fill in this structure */
  1127  ){
  1128    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  1129    assert( pPage->leaf==0 );
  1130    assert( pPage->childPtrSize==4 );
  1131  #ifndef SQLITE_DEBUG
  1132    UNUSED_PARAMETER(pPage);
  1133  #endif
  1134    pInfo->nSize = 4 + getVarint(&pCell[4], (u64*)&pInfo->nKey);
  1135    pInfo->nPayload = 0;
  1136    pInfo->nLocal = 0;
  1137    pInfo->pPayload = 0;
  1138    return;
  1139  }
  1140  static void btreeParseCellPtr(
  1141    MemPage *pPage,         /* Page containing the cell */
  1142    u8 *pCell,              /* Pointer to the cell text. */
  1143    CellInfo *pInfo         /* Fill in this structure */
  1144  ){
  1145    u8 *pIter;              /* For scanning through pCell */
  1146    u32 nPayload;           /* Number of bytes of cell payload */
  1147    u64 iKey;               /* Extracted Key value */
  1148  
  1149    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  1150    assert( pPage->leaf==0 || pPage->leaf==1 );
  1151    assert( pPage->intKeyLeaf );
  1152    assert( pPage->childPtrSize==0 );
  1153    pIter = pCell;
  1154  
  1155    /* The next block of code is equivalent to:
  1156    **
  1157    **     pIter += getVarint32(pIter, nPayload);
  1158    **
  1159    ** The code is inlined to avoid a function call.
  1160    */
  1161    nPayload = *pIter;
  1162    if( nPayload>=0x80 ){
  1163      u8 *pEnd = &pIter[8];
  1164      nPayload &= 0x7f;
  1165      do{
  1166        nPayload = (nPayload<<7) | (*++pIter & 0x7f);
  1167      }while( (*pIter)>=0x80 && pIter<pEnd );
  1168    }
  1169    pIter++;
  1170  
  1171    /* The next block of code is equivalent to:
  1172    **
  1173    **     pIter += getVarint(pIter, (u64*)&pInfo->nKey);
  1174    **
  1175    ** The code is inlined to avoid a function call.
  1176    */
  1177    iKey = *pIter;
  1178    if( iKey>=0x80 ){
  1179      u8 *pEnd = &pIter[7];
  1180      iKey &= 0x7f;
  1181      while(1){
  1182        iKey = (iKey<<7) | (*++pIter & 0x7f);
  1183        if( (*pIter)<0x80 ) break;
  1184        if( pIter>=pEnd ){
  1185          iKey = (iKey<<8) | *++pIter;
  1186          break;
  1187        }
  1188      }
  1189    }
  1190    pIter++;
  1191  
  1192    pInfo->nKey = *(i64*)&iKey;
  1193    pInfo->nPayload = nPayload;
  1194    pInfo->pPayload = pIter;
  1195    testcase( nPayload==pPage->maxLocal );
  1196    testcase( nPayload==pPage->maxLocal+1 );
  1197    if( nPayload<=pPage->maxLocal ){
  1198      /* This is the (easy) common case where the entire payload fits
  1199      ** on the local page.  No overflow is required.
  1200      */
  1201      pInfo->nSize = nPayload + (u16)(pIter - pCell);
  1202      if( pInfo->nSize<4 ) pInfo->nSize = 4;
  1203      pInfo->nLocal = (u16)nPayload;
  1204    }else{
  1205      btreeParseCellAdjustSizeForOverflow(pPage, pCell, pInfo);
  1206    }
  1207  }
  1208  static void btreeParseCellPtrIndex(
  1209    MemPage *pPage,         /* Page containing the cell */
  1210    u8 *pCell,              /* Pointer to the cell text. */
  1211    CellInfo *pInfo         /* Fill in this structure */
  1212  ){
  1213    u8 *pIter;              /* For scanning through pCell */
  1214    u32 nPayload;           /* Number of bytes of cell payload */
  1215  
  1216    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  1217    assert( pPage->leaf==0 || pPage->leaf==1 );
  1218    assert( pPage->intKeyLeaf==0 );
  1219    pIter = pCell + pPage->childPtrSize;
  1220    nPayload = *pIter;
  1221    if( nPayload>=0x80 ){
  1222      u8 *pEnd = &pIter[8];
  1223      nPayload &= 0x7f;
  1224      do{
  1225        nPayload = (nPayload<<7) | (*++pIter & 0x7f);
  1226      }while( *(pIter)>=0x80 && pIter<pEnd );
  1227    }
  1228    pIter++;
  1229    pInfo->nKey = nPayload;
  1230    pInfo->nPayload = nPayload;
  1231    pInfo->pPayload = pIter;
  1232    testcase( nPayload==pPage->maxLocal );
  1233    testcase( nPayload==pPage->maxLocal+1 );
  1234    if( nPayload<=pPage->maxLocal ){
  1235      /* This is the (easy) common case where the entire payload fits
  1236      ** on the local page.  No overflow is required.
  1237      */
  1238      pInfo->nSize = nPayload + (u16)(pIter - pCell);
  1239      if( pInfo->nSize<4 ) pInfo->nSize = 4;
  1240      pInfo->nLocal = (u16)nPayload;
  1241    }else{
  1242      btreeParseCellAdjustSizeForOverflow(pPage, pCell, pInfo);
  1243    }
  1244  }
  1245  static void btreeParseCell(
  1246    MemPage *pPage,         /* Page containing the cell */
  1247    int iCell,              /* The cell index.  First cell is 0 */
  1248    CellInfo *pInfo         /* Fill in this structure */
  1249  ){
  1250    pPage->xParseCell(pPage, findCell(pPage, iCell), pInfo);
  1251  }
  1252  
  1253  /*
  1254  ** The following routines are implementations of the MemPage.xCellSize
  1255  ** method.
  1256  **
  1257  ** Compute the total number of bytes that a Cell needs in the cell
  1258  ** data area of the btree-page.  The return number includes the cell
  1259  ** data header and the local payload, but not any overflow page or
  1260  ** the space used by the cell pointer.
  1261  **
  1262  ** cellSizePtrNoPayload()    =>   table internal nodes
  1263  ** cellSizePtr()             =>   all index nodes & table leaf nodes
  1264  */
  1265  static u16 cellSizePtr(MemPage *pPage, u8 *pCell){
  1266    u8 *pIter = pCell + pPage->childPtrSize; /* For looping over bytes of pCell */
  1267    u8 *pEnd;                                /* End mark for a varint */
  1268    u32 nSize;                               /* Size value to return */
  1269  
  1270  #ifdef SQLITE_DEBUG
  1271    /* The value returned by this function should always be the same as
  1272    ** the (CellInfo.nSize) value found by doing a full parse of the
  1273    ** cell. If SQLITE_DEBUG is defined, an assert() at the bottom of
  1274    ** this function verifies that this invariant is not violated. */
  1275    CellInfo debuginfo;
  1276    pPage->xParseCell(pPage, pCell, &debuginfo);
  1277  #endif
  1278  
  1279    nSize = *pIter;
  1280    if( nSize>=0x80 ){
  1281      pEnd = &pIter[8];
  1282      nSize &= 0x7f;
  1283      do{
  1284        nSize = (nSize<<7) | (*++pIter & 0x7f);
  1285      }while( *(pIter)>=0x80 && pIter<pEnd );
  1286    }
  1287    pIter++;
  1288    if( pPage->intKey ){
  1289      /* pIter now points at the 64-bit integer key value, a variable length 
  1290      ** integer. The following block moves pIter to point at the first byte
  1291      ** past the end of the key value. */
  1292      pEnd = &pIter[9];
  1293      while( (*pIter++)&0x80 && pIter<pEnd );
  1294    }
  1295    testcase( nSize==pPage->maxLocal );
  1296    testcase( nSize==pPage->maxLocal+1 );
  1297    if( nSize<=pPage->maxLocal ){
  1298      nSize += (u32)(pIter - pCell);
  1299      if( nSize<4 ) nSize = 4;
  1300    }else{
  1301      int minLocal = pPage->minLocal;
  1302      nSize = minLocal + (nSize - minLocal) % (pPage->pBt->usableSize - 4);
  1303      testcase( nSize==pPage->maxLocal );
  1304      testcase( nSize==pPage->maxLocal+1 );
  1305      if( nSize>pPage->maxLocal ){
  1306        nSize = minLocal;
  1307      }
  1308      nSize += 4 + (u16)(pIter - pCell);
  1309    }
  1310    assert( nSize==debuginfo.nSize || CORRUPT_DB );
  1311    return (u16)nSize;
  1312  }
  1313  static u16 cellSizePtrNoPayload(MemPage *pPage, u8 *pCell){
  1314    u8 *pIter = pCell + 4; /* For looping over bytes of pCell */
  1315    u8 *pEnd;              /* End mark for a varint */
  1316  
  1317  #ifdef SQLITE_DEBUG
  1318    /* The value returned by this function should always be the same as
  1319    ** the (CellInfo.nSize) value found by doing a full parse of the
  1320    ** cell. If SQLITE_DEBUG is defined, an assert() at the bottom of
  1321    ** this function verifies that this invariant is not violated. */
  1322    CellInfo debuginfo;
  1323    pPage->xParseCell(pPage, pCell, &debuginfo);
  1324  #else
  1325    UNUSED_PARAMETER(pPage);
  1326  #endif
  1327  
  1328    assert( pPage->childPtrSize==4 );
  1329    pEnd = pIter + 9;
  1330    while( (*pIter++)&0x80 && pIter<pEnd );
  1331    assert( debuginfo.nSize==(u16)(pIter - pCell) || CORRUPT_DB );
  1332    return (u16)(pIter - pCell);
  1333  }
  1334  
  1335  
  1336  #ifdef SQLITE_DEBUG
  1337  /* This variation on cellSizePtr() is used inside of assert() statements
  1338  ** only. */
  1339  static u16 cellSize(MemPage *pPage, int iCell){
  1340    return pPage->xCellSize(pPage, findCell(pPage, iCell));
  1341  }
  1342  #endif
  1343  
  1344  #ifndef SQLITE_OMIT_AUTOVACUUM
  1345  /*
  1346  ** If the cell pCell, part of page pPage contains a pointer
  1347  ** to an overflow page, insert an entry into the pointer-map
  1348  ** for the overflow page.
  1349  */
  1350  static void ptrmapPutOvflPtr(MemPage *pPage, u8 *pCell, int *pRC){
  1351    CellInfo info;
  1352    if( *pRC ) return;
  1353    assert( pCell!=0 );
  1354    pPage->xParseCell(pPage, pCell, &info);
  1355    if( info.nLocal<info.nPayload ){
  1356      Pgno ovfl = get4byte(&pCell[info.nSize-4]);
  1357      ptrmapPut(pPage->pBt, ovfl, PTRMAP_OVERFLOW1, pPage->pgno, pRC);
  1358    }
  1359  }
  1360  #endif
  1361  
  1362  
  1363  /*
  1364  ** Defragment the page given. This routine reorganizes cells within the
  1365  ** page so that there are no free-blocks on the free-block list.
  1366  **
  1367  ** Parameter nMaxFrag is the maximum amount of fragmented space that may be
  1368  ** present in the page after this routine returns.
  1369  **
  1370  ** EVIDENCE-OF: R-44582-60138 SQLite may from time to time reorganize a
  1371  ** b-tree page so that there are no freeblocks or fragment bytes, all
  1372  ** unused bytes are contained in the unallocated space region, and all
  1373  ** cells are packed tightly at the end of the page.
  1374  */
  1375  static int defragmentPage(MemPage *pPage, int nMaxFrag){
  1376    int i;                     /* Loop counter */
  1377    int pc;                    /* Address of the i-th cell */
  1378    int hdr;                   /* Offset to the page header */
  1379    int size;                  /* Size of a cell */
  1380    int usableSize;            /* Number of usable bytes on a page */
  1381    int cellOffset;            /* Offset to the cell pointer array */
  1382    int cbrk;                  /* Offset to the cell content area */
  1383    int nCell;                 /* Number of cells on the page */
  1384    unsigned char *data;       /* The page data */
  1385    unsigned char *temp;       /* Temp area for cell content */
  1386    unsigned char *src;        /* Source of content */
  1387    int iCellFirst;            /* First allowable cell index */
  1388    int iCellLast;             /* Last possible cell index */
  1389  
  1390    assert( sqlite3PagerIswriteable(pPage->pDbPage) );
  1391    assert( pPage->pBt!=0 );
  1392    assert( pPage->pBt->usableSize <= SQLITE_MAX_PAGE_SIZE );
  1393    assert( pPage->nOverflow==0 );
  1394    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  1395    temp = 0;
  1396    src = data = pPage->aData;
  1397    hdr = pPage->hdrOffset;
  1398    cellOffset = pPage->cellOffset;
  1399    nCell = pPage->nCell;
  1400    assert( nCell==get2byte(&data[hdr+3]) );
  1401    iCellFirst = cellOffset + 2*nCell;
  1402    usableSize = pPage->pBt->usableSize;
  1403  
  1404    /* This block handles pages with two or fewer free blocks and nMaxFrag
  1405    ** or fewer fragmented bytes. In this case it is faster to move the
  1406    ** two (or one) blocks of cells using memmove() and add the required
  1407    ** offsets to each pointer in the cell-pointer array than it is to 
  1408    ** reconstruct the entire page.  */
  1409    if( (int)data[hdr+7]<=nMaxFrag ){
  1410      int iFree = get2byte(&data[hdr+1]);
  1411      if( iFree ){
  1412        int iFree2 = get2byte(&data[iFree]);
  1413  
  1414        /* pageFindSlot() has already verified that free blocks are sorted
  1415        ** in order of offset within the page, and that no block extends
  1416        ** past the end of the page. Provided the two free slots do not 
  1417        ** overlap, this guarantees that the memmove() calls below will not
  1418        ** overwrite the usableSize byte buffer, even if the database page
  1419        ** is corrupt.  */
  1420        assert( iFree2==0 || iFree2>iFree );
  1421        assert( iFree+get2byte(&data[iFree+2]) <= usableSize );
  1422        assert( iFree2==0 || iFree2+get2byte(&data[iFree2+2]) <= usableSize );
  1423  
  1424        if( 0==iFree2 || (data[iFree2]==0 && data[iFree2+1]==0) ){
  1425          u8 *pEnd = &data[cellOffset + nCell*2];
  1426          u8 *pAddr;
  1427          int sz2 = 0;
  1428          int sz = get2byte(&data[iFree+2]);
  1429          int top = get2byte(&data[hdr+5]);
  1430          if( top>=iFree ){
  1431            return SQLITE_CORRUPT_PAGE(pPage);
  1432          }
  1433          if( iFree2 ){
  1434            assert( iFree+sz<=iFree2 ); /* Verified by pageFindSlot() */
  1435            sz2 = get2byte(&data[iFree2+2]);
  1436            assert( iFree+sz+sz2+iFree2-(iFree+sz) <= usableSize );
  1437            memmove(&data[iFree+sz+sz2], &data[iFree+sz], iFree2-(iFree+sz));
  1438            sz += sz2;
  1439          }
  1440          cbrk = top+sz;
  1441          assert( cbrk+(iFree-top) <= usableSize );
  1442          memmove(&data[cbrk], &data[top], iFree-top);
  1443          for(pAddr=&data[cellOffset]; pAddr<pEnd; pAddr+=2){
  1444            pc = get2byte(pAddr);
  1445            if( pc<iFree ){ put2byte(pAddr, pc+sz); }
  1446            else if( pc<iFree2 ){ put2byte(pAddr, pc+sz2); }
  1447          }
  1448          goto defragment_out;
  1449        }
  1450      }
  1451    }
  1452  
  1453    cbrk = usableSize;
  1454    iCellLast = usableSize - 4;
  1455    for(i=0; i<nCell; i++){
  1456      u8 *pAddr;     /* The i-th cell pointer */
  1457      pAddr = &data[cellOffset + i*2];
  1458      pc = get2byte(pAddr);
  1459      testcase( pc==iCellFirst );
  1460      testcase( pc==iCellLast );
  1461      /* These conditions have already been verified in btreeInitPage()
  1462      ** if PRAGMA cell_size_check=ON.
  1463      */
  1464      if( pc<iCellFirst || pc>iCellLast ){
  1465        return SQLITE_CORRUPT_PAGE(pPage);
  1466      }
  1467      assert( pc>=iCellFirst && pc<=iCellLast );
  1468      size = pPage->xCellSize(pPage, &src[pc]);
  1469      cbrk -= size;
  1470      if( cbrk<iCellFirst || pc+size>usableSize ){
  1471        return SQLITE_CORRUPT_PAGE(pPage);
  1472      }
  1473      assert( cbrk+size<=usableSize && cbrk>=iCellFirst );
  1474      testcase( cbrk+size==usableSize );
  1475      testcase( pc+size==usableSize );
  1476      put2byte(pAddr, cbrk);
  1477      if( temp==0 ){
  1478        int x;
  1479        if( cbrk==pc ) continue;
  1480        temp = sqlite3PagerTempSpace(pPage->pBt->pPager);
  1481        x = get2byte(&data[hdr+5]);
  1482        memcpy(&temp[x], &data[x], (cbrk+size) - x);
  1483        src = temp;
  1484      }
  1485      memcpy(&data[cbrk], &src[pc], size);
  1486    }
  1487    data[hdr+7] = 0;
  1488  
  1489   defragment_out:
  1490    if( data[hdr+7]+cbrk-iCellFirst!=pPage->nFree ){
  1491      return SQLITE_CORRUPT_PAGE(pPage);
  1492    }
  1493    assert( cbrk>=iCellFirst );
  1494    put2byte(&data[hdr+5], cbrk);
  1495    data[hdr+1] = 0;
  1496    data[hdr+2] = 0;
  1497    memset(&data[iCellFirst], 0, cbrk-iCellFirst);
  1498    assert( sqlite3PagerIswriteable(pPage->pDbPage) );
  1499    return SQLITE_OK;
  1500  }
  1501  
  1502  /*
  1503  ** Search the free-list on page pPg for space to store a cell nByte bytes in
  1504  ** size. If one can be found, return a pointer to the space and remove it
  1505  ** from the free-list.
  1506  **
  1507  ** If no suitable space can be found on the free-list, return NULL.
  1508  **
  1509  ** This function may detect corruption within pPg.  If corruption is
  1510  ** detected then *pRc is set to SQLITE_CORRUPT and NULL is returned.
  1511  **
  1512  ** Slots on the free list that are between 1 and 3 bytes larger than nByte
  1513  ** will be ignored if adding the extra space to the fragmentation count
  1514  ** causes the fragmentation count to exceed 60.
  1515  */
  1516  static u8 *pageFindSlot(MemPage *pPg, int nByte, int *pRc){
  1517    const int hdr = pPg->hdrOffset;
  1518    u8 * const aData = pPg->aData;
  1519    int iAddr = hdr + 1;
  1520    int pc = get2byte(&aData[iAddr]);
  1521    int x;
  1522    int usableSize = pPg->pBt->usableSize;
  1523    int size;            /* Size of the free slot */
  1524  
  1525    assert( pc>0 );
  1526    while( pc<=usableSize-4 ){
  1527      /* EVIDENCE-OF: R-22710-53328 The third and fourth bytes of each
  1528      ** freeblock form a big-endian integer which is the size of the freeblock
  1529      ** in bytes, including the 4-byte header. */
  1530      size = get2byte(&aData[pc+2]);
  1531      if( (x = size - nByte)>=0 ){
  1532        testcase( x==4 );
  1533        testcase( x==3 );
  1534        if( size+pc > usableSize ){
  1535          *pRc = SQLITE_CORRUPT_PAGE(pPg);
  1536          return 0;
  1537        }else if( x<4 ){
  1538          /* EVIDENCE-OF: R-11498-58022 In a well-formed b-tree page, the total
  1539          ** number of bytes in fragments may not exceed 60. */
  1540          if( aData[hdr+7]>57 ) return 0;
  1541  
  1542          /* Remove the slot from the free-list. Update the number of
  1543          ** fragmented bytes within the page. */
  1544          memcpy(&aData[iAddr], &aData[pc], 2);
  1545          aData[hdr+7] += (u8)x;
  1546        }else{
  1547          /* The slot remains on the free-list. Reduce its size to account
  1548           ** for the portion used by the new allocation. */
  1549          put2byte(&aData[pc+2], x);
  1550        }
  1551        return &aData[pc + x];
  1552      }
  1553      iAddr = pc;
  1554      pc = get2byte(&aData[pc]);
  1555      if( pc<iAddr+size ) break;
  1556    }
  1557    if( pc ){
  1558      *pRc = SQLITE_CORRUPT_PAGE(pPg);
  1559    }
  1560  
  1561    return 0;
  1562  }
  1563  
  1564  /*
  1565  ** Allocate nByte bytes of space from within the B-Tree page passed
  1566  ** as the first argument. Write into *pIdx the index into pPage->aData[]
  1567  ** of the first byte of allocated space. Return either SQLITE_OK or
  1568  ** an error code (usually SQLITE_CORRUPT).
  1569  **
  1570  ** The caller guarantees that there is sufficient space to make the
  1571  ** allocation.  This routine might need to defragment in order to bring
  1572  ** all the space together, however.  This routine will avoid using
  1573  ** the first two bytes past the cell pointer area since presumably this
  1574  ** allocation is being made in order to insert a new cell, so we will
  1575  ** also end up needing a new cell pointer.
  1576  */
  1577  static int allocateSpace(MemPage *pPage, int nByte, int *pIdx){
  1578    const int hdr = pPage->hdrOffset;    /* Local cache of pPage->hdrOffset */
  1579    u8 * const data = pPage->aData;      /* Local cache of pPage->aData */
  1580    int top;                             /* First byte of cell content area */
  1581    int rc = SQLITE_OK;                  /* Integer return code */
  1582    int gap;        /* First byte of gap between cell pointers and cell content */
  1583    
  1584    assert( sqlite3PagerIswriteable(pPage->pDbPage) );
  1585    assert( pPage->pBt );
  1586    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  1587    assert( nByte>=0 );  /* Minimum cell size is 4 */
  1588    assert( pPage->nFree>=nByte );
  1589    assert( pPage->nOverflow==0 );
  1590    assert( nByte < (int)(pPage->pBt->usableSize-8) );
  1591  
  1592    assert( pPage->cellOffset == hdr + 12 - 4*pPage->leaf );
  1593    gap = pPage->cellOffset + 2*pPage->nCell;
  1594    assert( gap<=65536 );
  1595    /* EVIDENCE-OF: R-29356-02391 If the database uses a 65536-byte page size
  1596    ** and the reserved space is zero (the usual value for reserved space)
  1597    ** then the cell content offset of an empty page wants to be 65536.
  1598    ** However, that integer is too large to be stored in a 2-byte unsigned
  1599    ** integer, so a value of 0 is used in its place. */
  1600    top = get2byte(&data[hdr+5]);
  1601    assert( top<=(int)pPage->pBt->usableSize ); /* Prevent by getAndInitPage() */
  1602    if( gap>top ){
  1603      if( top==0 && pPage->pBt->usableSize==65536 ){
  1604        top = 65536;
  1605      }else{
  1606        return SQLITE_CORRUPT_PAGE(pPage);
  1607      }
  1608    }
  1609  
  1610    /* If there is enough space between gap and top for one more cell pointer
  1611    ** array entry offset, and if the freelist is not empty, then search the
  1612    ** freelist looking for a free slot big enough to satisfy the request.
  1613    */
  1614    testcase( gap+2==top );
  1615    testcase( gap+1==top );
  1616    testcase( gap==top );
  1617    if( (data[hdr+2] || data[hdr+1]) && gap+2<=top ){
  1618      u8 *pSpace = pageFindSlot(pPage, nByte, &rc);
  1619      if( pSpace ){
  1620        assert( pSpace>=data && (pSpace - data)<65536 );
  1621        *pIdx = (int)(pSpace - data);
  1622        return SQLITE_OK;
  1623      }else if( rc ){
  1624        return rc;
  1625      }
  1626    }
  1627  
  1628    /* The request could not be fulfilled using a freelist slot.  Check
  1629    ** to see if defragmentation is necessary.
  1630    */
  1631    testcase( gap+2+nByte==top );
  1632    if( gap+2+nByte>top ){
  1633      assert( pPage->nCell>0 || CORRUPT_DB );
  1634      rc = defragmentPage(pPage, MIN(4, pPage->nFree - (2+nByte)));
  1635      if( rc ) return rc;
  1636      top = get2byteNotZero(&data[hdr+5]);
  1637      assert( gap+2+nByte<=top );
  1638    }
  1639  
  1640  
  1641    /* Allocate memory from the gap in between the cell pointer array
  1642    ** and the cell content area.  The btreeInitPage() call has already
  1643    ** validated the freelist.  Given that the freelist is valid, there
  1644    ** is no way that the allocation can extend off the end of the page.
  1645    ** The assert() below verifies the previous sentence.
  1646    */
  1647    top -= nByte;
  1648    put2byte(&data[hdr+5], top);
  1649    assert( top+nByte <= (int)pPage->pBt->usableSize );
  1650    *pIdx = top;
  1651    return SQLITE_OK;
  1652  }
  1653  
  1654  /*
  1655  ** Return a section of the pPage->aData to the freelist.
  1656  ** The first byte of the new free block is pPage->aData[iStart]
  1657  ** and the size of the block is iSize bytes.
  1658  **
  1659  ** Adjacent freeblocks are coalesced.
  1660  **
  1661  ** Note that even though the freeblock list was checked by btreeInitPage(),
  1662  ** that routine will not detect overlap between cells or freeblocks.  Nor
  1663  ** does it detect cells or freeblocks that encrouch into the reserved bytes
  1664  ** at the end of the page.  So do additional corruption checks inside this
  1665  ** routine and return SQLITE_CORRUPT if any problems are found.
  1666  */
  1667  static int freeSpace(MemPage *pPage, u16 iStart, u16 iSize){
  1668    u16 iPtr;                             /* Address of ptr to next freeblock */
  1669    u16 iFreeBlk;                         /* Address of the next freeblock */
  1670    u8 hdr;                               /* Page header size.  0 or 100 */
  1671    u8 nFrag = 0;                         /* Reduction in fragmentation */
  1672    u16 iOrigSize = iSize;                /* Original value of iSize */
  1673    u16 x;                                /* Offset to cell content area */
  1674    u32 iEnd = iStart + iSize;            /* First byte past the iStart buffer */
  1675    unsigned char *data = pPage->aData;   /* Page content */
  1676  
  1677    assert( pPage->pBt!=0 );
  1678    assert( sqlite3PagerIswriteable(pPage->pDbPage) );
  1679    assert( CORRUPT_DB || iStart>=pPage->hdrOffset+6+pPage->childPtrSize );
  1680    assert( CORRUPT_DB || iEnd <= pPage->pBt->usableSize );
  1681    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  1682    assert( iSize>=4 );   /* Minimum cell size is 4 */
  1683    assert( iStart<=pPage->pBt->usableSize-4 );
  1684  
  1685    /* The list of freeblocks must be in ascending order.  Find the 
  1686    ** spot on the list where iStart should be inserted.
  1687    */
  1688    hdr = pPage->hdrOffset;
  1689    iPtr = hdr + 1;
  1690    if( data[iPtr+1]==0 && data[iPtr]==0 ){
  1691      iFreeBlk = 0;  /* Shortcut for the case when the freelist is empty */
  1692    }else{
  1693      while( (iFreeBlk = get2byte(&data[iPtr]))<iStart ){
  1694        if( iFreeBlk<iPtr+4 ){
  1695          if( iFreeBlk==0 ) break;
  1696          return SQLITE_CORRUPT_PAGE(pPage);
  1697        }
  1698        iPtr = iFreeBlk;
  1699      }
  1700      if( iFreeBlk>pPage->pBt->usableSize-4 ){
  1701        return SQLITE_CORRUPT_PAGE(pPage);
  1702      }
  1703      assert( iFreeBlk>iPtr || iFreeBlk==0 );
  1704    
  1705      /* At this point:
  1706      **    iFreeBlk:   First freeblock after iStart, or zero if none
  1707      **    iPtr:       The address of a pointer to iFreeBlk
  1708      **
  1709      ** Check to see if iFreeBlk should be coalesced onto the end of iStart.
  1710      */
  1711      if( iFreeBlk && iEnd+3>=iFreeBlk ){
  1712        nFrag = iFreeBlk - iEnd;
  1713        if( iEnd>iFreeBlk ) return SQLITE_CORRUPT_PAGE(pPage);
  1714        iEnd = iFreeBlk + get2byte(&data[iFreeBlk+2]);
  1715        if( iEnd > pPage->pBt->usableSize ){
  1716          return SQLITE_CORRUPT_PAGE(pPage);
  1717        }
  1718        iSize = iEnd - iStart;
  1719        iFreeBlk = get2byte(&data[iFreeBlk]);
  1720      }
  1721    
  1722      /* If iPtr is another freeblock (that is, if iPtr is not the freelist
  1723      ** pointer in the page header) then check to see if iStart should be
  1724      ** coalesced onto the end of iPtr.
  1725      */
  1726      if( iPtr>hdr+1 ){
  1727        int iPtrEnd = iPtr + get2byte(&data[iPtr+2]);
  1728        if( iPtrEnd+3>=iStart ){
  1729          if( iPtrEnd>iStart ) return SQLITE_CORRUPT_PAGE(pPage);
  1730          nFrag += iStart - iPtrEnd;
  1731          iSize = iEnd - iPtr;
  1732          iStart = iPtr;
  1733        }
  1734      }
  1735      if( nFrag>data[hdr+7] ) return SQLITE_CORRUPT_PAGE(pPage);
  1736      data[hdr+7] -= nFrag;
  1737    }
  1738    x = get2byte(&data[hdr+5]);
  1739    if( iStart<=x ){
  1740      /* The new freeblock is at the beginning of the cell content area,
  1741      ** so just extend the cell content area rather than create another
  1742      ** freelist entry */
  1743      if( iStart<x || iPtr!=hdr+1 ) return SQLITE_CORRUPT_PAGE(pPage);
  1744      put2byte(&data[hdr+1], iFreeBlk);
  1745      put2byte(&data[hdr+5], iEnd);
  1746    }else{
  1747      /* Insert the new freeblock into the freelist */
  1748      put2byte(&data[iPtr], iStart);
  1749    }
  1750    if( pPage->pBt->btsFlags & BTS_FAST_SECURE ){
  1751      /* Overwrite deleted information with zeros when the secure_delete
  1752      ** option is enabled */
  1753      memset(&data[iStart], 0, iSize);
  1754    }
  1755    put2byte(&data[iStart], iFreeBlk);
  1756    put2byte(&data[iStart+2], iSize);
  1757    pPage->nFree += iOrigSize;
  1758    return SQLITE_OK;
  1759  }
  1760  
  1761  /*
  1762  ** Decode the flags byte (the first byte of the header) for a page
  1763  ** and initialize fields of the MemPage structure accordingly.
  1764  **
  1765  ** Only the following combinations are supported.  Anything different
  1766  ** indicates a corrupt database files:
  1767  **
  1768  **         PTF_ZERODATA
  1769  **         PTF_ZERODATA | PTF_LEAF
  1770  **         PTF_LEAFDATA | PTF_INTKEY
  1771  **         PTF_LEAFDATA | PTF_INTKEY | PTF_LEAF
  1772  */
  1773  static int decodeFlags(MemPage *pPage, int flagByte){
  1774    BtShared *pBt;     /* A copy of pPage->pBt */
  1775  
  1776    assert( pPage->hdrOffset==(pPage->pgno==1 ? 100 : 0) );
  1777    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  1778    pPage->leaf = (u8)(flagByte>>3);  assert( PTF_LEAF == 1<<3 );
  1779    flagByte &= ~PTF_LEAF;
  1780    pPage->childPtrSize = 4-4*pPage->leaf;
  1781    pPage->xCellSize = cellSizePtr;
  1782    pBt = pPage->pBt;
  1783    if( flagByte==(PTF_LEAFDATA | PTF_INTKEY) ){
  1784      /* EVIDENCE-OF: R-07291-35328 A value of 5 (0x05) means the page is an
  1785      ** interior table b-tree page. */
  1786      assert( (PTF_LEAFDATA|PTF_INTKEY)==5 );
  1787      /* EVIDENCE-OF: R-26900-09176 A value of 13 (0x0d) means the page is a
  1788      ** leaf table b-tree page. */
  1789      assert( (PTF_LEAFDATA|PTF_INTKEY|PTF_LEAF)==13 );
  1790      pPage->intKey = 1;
  1791      if( pPage->leaf ){
  1792        pPage->intKeyLeaf = 1;
  1793        pPage->xParseCell = btreeParseCellPtr;
  1794      }else{
  1795        pPage->intKeyLeaf = 0;
  1796        pPage->xCellSize = cellSizePtrNoPayload;
  1797        pPage->xParseCell = btreeParseCellPtrNoPayload;
  1798      }
  1799      pPage->maxLocal = pBt->maxLeaf;
  1800      pPage->minLocal = pBt->minLeaf;
  1801    }else if( flagByte==PTF_ZERODATA ){
  1802      /* EVIDENCE-OF: R-43316-37308 A value of 2 (0x02) means the page is an
  1803      ** interior index b-tree page. */
  1804      assert( (PTF_ZERODATA)==2 );
  1805      /* EVIDENCE-OF: R-59615-42828 A value of 10 (0x0a) means the page is a
  1806      ** leaf index b-tree page. */
  1807      assert( (PTF_ZERODATA|PTF_LEAF)==10 );
  1808      pPage->intKey = 0;
  1809      pPage->intKeyLeaf = 0;
  1810      pPage->xParseCell = btreeParseCellPtrIndex;
  1811      pPage->maxLocal = pBt->maxLocal;
  1812      pPage->minLocal = pBt->minLocal;
  1813    }else{
  1814      /* EVIDENCE-OF: R-47608-56469 Any other value for the b-tree page type is
  1815      ** an error. */
  1816      return SQLITE_CORRUPT_PAGE(pPage);
  1817    }
  1818    pPage->max1bytePayload = pBt->max1bytePayload;
  1819    return SQLITE_OK;
  1820  }
  1821  
  1822  /*
  1823  ** Initialize the auxiliary information for a disk block.
  1824  **
  1825  ** Return SQLITE_OK on success.  If we see that the page does
  1826  ** not contain a well-formed database page, then return 
  1827  ** SQLITE_CORRUPT.  Note that a return of SQLITE_OK does not
  1828  ** guarantee that the page is well-formed.  It only shows that
  1829  ** we failed to detect any corruption.
  1830  */
  1831  static int btreeInitPage(MemPage *pPage){
  1832    int pc;            /* Address of a freeblock within pPage->aData[] */
  1833    u8 hdr;            /* Offset to beginning of page header */
  1834    u8 *data;          /* Equal to pPage->aData */
  1835    BtShared *pBt;        /* The main btree structure */
  1836    int usableSize;    /* Amount of usable space on each page */
  1837    u16 cellOffset;    /* Offset from start of page to first cell pointer */
  1838    int nFree;         /* Number of unused bytes on the page */
  1839    int top;           /* First byte of the cell content area */
  1840    int iCellFirst;    /* First allowable cell or freeblock offset */
  1841    int iCellLast;     /* Last possible cell or freeblock offset */
  1842  
  1843    assert( pPage->pBt!=0 );
  1844    assert( pPage->pBt->db!=0 );
  1845    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  1846    assert( pPage->pgno==sqlite3PagerPagenumber(pPage->pDbPage) );
  1847    assert( pPage == sqlite3PagerGetExtra(pPage->pDbPage) );
  1848    assert( pPage->aData == sqlite3PagerGetData(pPage->pDbPage) );
  1849    assert( pPage->isInit==0 );
  1850  
  1851    pBt = pPage->pBt;
  1852    hdr = pPage->hdrOffset;
  1853    data = pPage->aData;
  1854    /* EVIDENCE-OF: R-28594-02890 The one-byte flag at offset 0 indicating
  1855    ** the b-tree page type. */
  1856    if( decodeFlags(pPage, data[hdr]) ){
  1857      return SQLITE_CORRUPT_PAGE(pPage);
  1858    }
  1859    assert( pBt->pageSize>=512 && pBt->pageSize<=65536 );
  1860    pPage->maskPage = (u16)(pBt->pageSize - 1);
  1861    pPage->nOverflow = 0;
  1862    usableSize = pBt->usableSize;
  1863    pPage->cellOffset = cellOffset = hdr + 8 + pPage->childPtrSize;
  1864    pPage->aDataEnd = &data[usableSize];
  1865    pPage->aCellIdx = &data[cellOffset];
  1866    pPage->aDataOfst = &data[pPage->childPtrSize];
  1867    /* EVIDENCE-OF: R-58015-48175 The two-byte integer at offset 5 designates
  1868    ** the start of the cell content area. A zero value for this integer is
  1869    ** interpreted as 65536. */
  1870    top = get2byteNotZero(&data[hdr+5]);
  1871    /* EVIDENCE-OF: R-37002-32774 The two-byte integer at offset 3 gives the
  1872    ** number of cells on the page. */
  1873    pPage->nCell = get2byte(&data[hdr+3]);
  1874    if( pPage->nCell>MX_CELL(pBt) ){
  1875      /* To many cells for a single page.  The page must be corrupt */
  1876      return SQLITE_CORRUPT_PAGE(pPage);
  1877    }
  1878    testcase( pPage->nCell==MX_CELL(pBt) );
  1879    /* EVIDENCE-OF: R-24089-57979 If a page contains no cells (which is only
  1880    ** possible for a root page of a table that contains no rows) then the
  1881    ** offset to the cell content area will equal the page size minus the
  1882    ** bytes of reserved space. */
  1883    assert( pPage->nCell>0 || top==usableSize || CORRUPT_DB );
  1884  
  1885    /* A malformed database page might cause us to read past the end
  1886    ** of page when parsing a cell.  
  1887    **
  1888    ** The following block of code checks early to see if a cell extends
  1889    ** past the end of a page boundary and causes SQLITE_CORRUPT to be 
  1890    ** returned if it does.
  1891    */
  1892    iCellFirst = cellOffset + 2*pPage->nCell;
  1893    iCellLast = usableSize - 4;
  1894    if( pBt->db->flags & SQLITE_CellSizeCk ){
  1895      int i;            /* Index into the cell pointer array */
  1896      int sz;           /* Size of a cell */
  1897  
  1898      if( !pPage->leaf ) iCellLast--;
  1899      for(i=0; i<pPage->nCell; i++){
  1900        pc = get2byteAligned(&data[cellOffset+i*2]);
  1901        testcase( pc==iCellFirst );
  1902        testcase( pc==iCellLast );
  1903        if( pc<iCellFirst || pc>iCellLast ){
  1904          return SQLITE_CORRUPT_PAGE(pPage);
  1905        }
  1906        sz = pPage->xCellSize(pPage, &data[pc]);
  1907        testcase( pc+sz==usableSize );
  1908        if( pc+sz>usableSize ){
  1909          return SQLITE_CORRUPT_PAGE(pPage);
  1910        }
  1911      }
  1912      if( !pPage->leaf ) iCellLast++;
  1913    }  
  1914  
  1915    /* Compute the total free space on the page
  1916    ** EVIDENCE-OF: R-23588-34450 The two-byte integer at offset 1 gives the
  1917    ** start of the first freeblock on the page, or is zero if there are no
  1918    ** freeblocks. */
  1919    pc = get2byte(&data[hdr+1]);
  1920    nFree = data[hdr+7] + top;  /* Init nFree to non-freeblock free space */
  1921    if( pc>0 ){
  1922      u32 next, size;
  1923      if( pc<iCellFirst ){
  1924        /* EVIDENCE-OF: R-55530-52930 In a well-formed b-tree page, there will
  1925        ** always be at least one cell before the first freeblock.
  1926        */
  1927        return SQLITE_CORRUPT_PAGE(pPage); 
  1928      }
  1929      while( 1 ){
  1930        if( pc>iCellLast ){
  1931          /* Freeblock off the end of the page */
  1932          return SQLITE_CORRUPT_PAGE(pPage);
  1933        }
  1934        next = get2byte(&data[pc]);
  1935        size = get2byte(&data[pc+2]);
  1936        nFree = nFree + size;
  1937        if( next<=pc+size+3 ) break;
  1938        pc = next;
  1939      }
  1940      if( next>0 ){
  1941        /* Freeblock not in ascending order */
  1942        return SQLITE_CORRUPT_PAGE(pPage);
  1943      }
  1944      if( pc+size>(unsigned int)usableSize ){
  1945        /* Last freeblock extends past page end */
  1946        return SQLITE_CORRUPT_PAGE(pPage);
  1947      }
  1948    }
  1949  
  1950    /* At this point, nFree contains the sum of the offset to the start
  1951    ** of the cell-content area plus the number of free bytes within
  1952    ** the cell-content area. If this is greater than the usable-size
  1953    ** of the page, then the page must be corrupted. This check also
  1954    ** serves to verify that the offset to the start of the cell-content
  1955    ** area, according to the page header, lies within the page.
  1956    */
  1957    if( nFree>usableSize ){
  1958      return SQLITE_CORRUPT_PAGE(pPage);
  1959    }
  1960    pPage->nFree = (u16)(nFree - iCellFirst);
  1961    pPage->isInit = 1;
  1962    return SQLITE_OK;
  1963  }
  1964  
  1965  /*
  1966  ** Set up a raw page so that it looks like a database page holding
  1967  ** no entries.
  1968  */
  1969  static void zeroPage(MemPage *pPage, int flags){
  1970    unsigned char *data = pPage->aData;
  1971    BtShared *pBt = pPage->pBt;
  1972    u8 hdr = pPage->hdrOffset;
  1973    u16 first;
  1974  
  1975    assert( sqlite3PagerPagenumber(pPage->pDbPage)==pPage->pgno );
  1976    assert( sqlite3PagerGetExtra(pPage->pDbPage) == (void*)pPage );
  1977    assert( sqlite3PagerGetData(pPage->pDbPage) == data );
  1978    assert( sqlite3PagerIswriteable(pPage->pDbPage) );
  1979    assert( sqlite3_mutex_held(pBt->mutex) );
  1980    if( pBt->btsFlags & BTS_FAST_SECURE ){
  1981      memset(&data[hdr], 0, pBt->usableSize - hdr);
  1982    }
  1983    data[hdr] = (char)flags;
  1984    first = hdr + ((flags&PTF_LEAF)==0 ? 12 : 8);
  1985    memset(&data[hdr+1], 0, 4);
  1986    data[hdr+7] = 0;
  1987    put2byte(&data[hdr+5], pBt->usableSize);
  1988    pPage->nFree = (u16)(pBt->usableSize - first);
  1989    decodeFlags(pPage, flags);
  1990    pPage->cellOffset = first;
  1991    pPage->aDataEnd = &data[pBt->usableSize];
  1992    pPage->aCellIdx = &data[first];
  1993    pPage->aDataOfst = &data[pPage->childPtrSize];
  1994    pPage->nOverflow = 0;
  1995    assert( pBt->pageSize>=512 && pBt->pageSize<=65536 );
  1996    pPage->maskPage = (u16)(pBt->pageSize - 1);
  1997    pPage->nCell = 0;
  1998    pPage->isInit = 1;
  1999  }
  2000  
  2001  
  2002  /*
  2003  ** Convert a DbPage obtained from the pager into a MemPage used by
  2004  ** the btree layer.
  2005  */
  2006  static MemPage *btreePageFromDbPage(DbPage *pDbPage, Pgno pgno, BtShared *pBt){
  2007    MemPage *pPage = (MemPage*)sqlite3PagerGetExtra(pDbPage);
  2008    if( pgno!=pPage->pgno ){
  2009      pPage->aData = sqlite3PagerGetData(pDbPage);
  2010      pPage->pDbPage = pDbPage;
  2011      pPage->pBt = pBt;
  2012      pPage->pgno = pgno;
  2013      pPage->hdrOffset = pgno==1 ? 100 : 0;
  2014    }
  2015    assert( pPage->aData==sqlite3PagerGetData(pDbPage) );
  2016    return pPage; 
  2017  }
  2018  
  2019  /*
  2020  ** Get a page from the pager.  Initialize the MemPage.pBt and
  2021  ** MemPage.aData elements if needed.  See also: btreeGetUnusedPage().
  2022  **
  2023  ** If the PAGER_GET_NOCONTENT flag is set, it means that we do not care
  2024  ** about the content of the page at this time.  So do not go to the disk
  2025  ** to fetch the content.  Just fill in the content with zeros for now.
  2026  ** If in the future we call sqlite3PagerWrite() on this page, that
  2027  ** means we have started to be concerned about content and the disk
  2028  ** read should occur at that point.
  2029  */
  2030  static int btreeGetPage(
  2031    BtShared *pBt,       /* The btree */
  2032    Pgno pgno,           /* Number of the page to fetch */
  2033    MemPage **ppPage,    /* Return the page in this parameter */
  2034    int flags            /* PAGER_GET_NOCONTENT or PAGER_GET_READONLY */
  2035  ){
  2036    int rc;
  2037    DbPage *pDbPage;
  2038  
  2039    assert( flags==0 || flags==PAGER_GET_NOCONTENT || flags==PAGER_GET_READONLY );
  2040    assert( sqlite3_mutex_held(pBt->mutex) );
  2041    rc = sqlite3PagerGet(pBt->pPager, pgno, (DbPage**)&pDbPage, flags);
  2042    if( rc ) return rc;
  2043    *ppPage = btreePageFromDbPage(pDbPage, pgno, pBt);
  2044    return SQLITE_OK;
  2045  }
  2046  
  2047  /*
  2048  ** Retrieve a page from the pager cache. If the requested page is not
  2049  ** already in the pager cache return NULL. Initialize the MemPage.pBt and
  2050  ** MemPage.aData elements if needed.
  2051  */
  2052  static MemPage *btreePageLookup(BtShared *pBt, Pgno pgno){
  2053    DbPage *pDbPage;
  2054    assert( sqlite3_mutex_held(pBt->mutex) );
  2055    pDbPage = sqlite3PagerLookup(pBt->pPager, pgno);
  2056    if( pDbPage ){
  2057      return btreePageFromDbPage(pDbPage, pgno, pBt);
  2058    }
  2059    return 0;
  2060  }
  2061  
  2062  /*
  2063  ** Return the size of the database file in pages. If there is any kind of
  2064  ** error, return ((unsigned int)-1).
  2065  */
  2066  static Pgno btreePagecount(BtShared *pBt){
  2067    return pBt->nPage;
  2068  }
  2069  u32 sqlite3BtreeLastPage(Btree *p){
  2070    assert( sqlite3BtreeHoldsMutex(p) );
  2071    assert( ((p->pBt->nPage)&0x80000000)==0 );
  2072    return btreePagecount(p->pBt);
  2073  }
  2074  
  2075  /*
  2076  ** Get a page from the pager and initialize it.
  2077  **
  2078  ** If pCur!=0 then the page is being fetched as part of a moveToChild()
  2079  ** call.  Do additional sanity checking on the page in this case.
  2080  ** And if the fetch fails, this routine must decrement pCur->iPage.
  2081  **
  2082  ** The page is fetched as read-write unless pCur is not NULL and is
  2083  ** a read-only cursor.
  2084  **
  2085  ** If an error occurs, then *ppPage is undefined. It
  2086  ** may remain unchanged, or it may be set to an invalid value.
  2087  */
  2088  static int getAndInitPage(
  2089    BtShared *pBt,                  /* The database file */
  2090    Pgno pgno,                      /* Number of the page to get */
  2091    MemPage **ppPage,               /* Write the page pointer here */
  2092    BtCursor *pCur,                 /* Cursor to receive the page, or NULL */
  2093    int bReadOnly                   /* True for a read-only page */
  2094  ){
  2095    int rc;
  2096    DbPage *pDbPage;
  2097    assert( sqlite3_mutex_held(pBt->mutex) );
  2098    assert( pCur==0 || ppPage==&pCur->pPage );
  2099    assert( pCur==0 || bReadOnly==pCur->curPagerFlags );
  2100    assert( pCur==0 || pCur->iPage>0 );
  2101  
  2102    if( pgno>btreePagecount(pBt) ){
  2103      rc = SQLITE_CORRUPT_BKPT;
  2104      goto getAndInitPage_error;
  2105    }
  2106    rc = sqlite3PagerGet(pBt->pPager, pgno, (DbPage**)&pDbPage, bReadOnly);
  2107    if( rc ){
  2108      goto getAndInitPage_error;
  2109    }
  2110    *ppPage = (MemPage*)sqlite3PagerGetExtra(pDbPage);
  2111    if( (*ppPage)->isInit==0 ){
  2112      btreePageFromDbPage(pDbPage, pgno, pBt);
  2113      rc = btreeInitPage(*ppPage);
  2114      if( rc!=SQLITE_OK ){
  2115        releasePage(*ppPage);
  2116        goto getAndInitPage_error;
  2117      }
  2118    }
  2119    assert( (*ppPage)->pgno==pgno );
  2120    assert( (*ppPage)->aData==sqlite3PagerGetData(pDbPage) );
  2121  
  2122    /* If obtaining a child page for a cursor, we must verify that the page is
  2123    ** compatible with the root page. */
  2124    if( pCur && ((*ppPage)->nCell<1 || (*ppPage)->intKey!=pCur->curIntKey) ){
  2125      rc = SQLITE_CORRUPT_PGNO(pgno);
  2126      releasePage(*ppPage);
  2127      goto getAndInitPage_error;
  2128    }
  2129    return SQLITE_OK;
  2130  
  2131  getAndInitPage_error:
  2132    if( pCur ){
  2133      pCur->iPage--;
  2134      pCur->pPage = pCur->apPage[pCur->iPage];
  2135    }
  2136    testcase( pgno==0 );
  2137    assert( pgno!=0 || rc==SQLITE_CORRUPT );
  2138    return rc;
  2139  }
  2140  
  2141  /*
  2142  ** Release a MemPage.  This should be called once for each prior
  2143  ** call to btreeGetPage.
  2144  **
  2145  ** Page1 is a special case and must be released using releasePageOne().
  2146  */
  2147  static void releasePageNotNull(MemPage *pPage){
  2148    assert( pPage->aData );
  2149    assert( pPage->pBt );
  2150    assert( pPage->pDbPage!=0 );
  2151    assert( sqlite3PagerGetExtra(pPage->pDbPage) == (void*)pPage );
  2152    assert( sqlite3PagerGetData(pPage->pDbPage)==pPage->aData );
  2153    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  2154    sqlite3PagerUnrefNotNull(pPage->pDbPage);
  2155  }
  2156  static void releasePage(MemPage *pPage){
  2157    if( pPage ) releasePageNotNull(pPage);
  2158  }
  2159  static void releasePageOne(MemPage *pPage){
  2160    assert( pPage!=0 );
  2161    assert( pPage->aData );
  2162    assert( pPage->pBt );
  2163    assert( pPage->pDbPage!=0 );
  2164    assert( sqlite3PagerGetExtra(pPage->pDbPage) == (void*)pPage );
  2165    assert( sqlite3PagerGetData(pPage->pDbPage)==pPage->aData );
  2166    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  2167    sqlite3PagerUnrefPageOne(pPage->pDbPage);
  2168  }
  2169  
  2170  /*
  2171  ** Get an unused page.
  2172  **
  2173  ** This works just like btreeGetPage() with the addition:
  2174  **
  2175  **   *  If the page is already in use for some other purpose, immediately
  2176  **      release it and return an SQLITE_CURRUPT error.
  2177  **   *  Make sure the isInit flag is clear
  2178  */
  2179  static int btreeGetUnusedPage(
  2180    BtShared *pBt,       /* The btree */
  2181    Pgno pgno,           /* Number of the page to fetch */
  2182    MemPage **ppPage,    /* Return the page in this parameter */
  2183    int flags            /* PAGER_GET_NOCONTENT or PAGER_GET_READONLY */
  2184  ){
  2185    int rc = btreeGetPage(pBt, pgno, ppPage, flags);
  2186    if( rc==SQLITE_OK ){
  2187      if( sqlite3PagerPageRefcount((*ppPage)->pDbPage)>1 ){
  2188        releasePage(*ppPage);
  2189        *ppPage = 0;
  2190        return SQLITE_CORRUPT_BKPT;
  2191      }
  2192      (*ppPage)->isInit = 0;
  2193    }else{
  2194      *ppPage = 0;
  2195    }
  2196    return rc;
  2197  }
  2198  
  2199  
  2200  /*
  2201  ** During a rollback, when the pager reloads information into the cache
  2202  ** so that the cache is restored to its original state at the start of
  2203  ** the transaction, for each page restored this routine is called.
  2204  **
  2205  ** This routine needs to reset the extra data section at the end of the
  2206  ** page to agree with the restored data.
  2207  */
  2208  static void pageReinit(DbPage *pData){
  2209    MemPage *pPage;
  2210    pPage = (MemPage *)sqlite3PagerGetExtra(pData);
  2211    assert( sqlite3PagerPageRefcount(pData)>0 );
  2212    if( pPage->isInit ){
  2213      assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  2214      pPage->isInit = 0;
  2215      if( sqlite3PagerPageRefcount(pData)>1 ){
  2216        /* pPage might not be a btree page;  it might be an overflow page
  2217        ** or ptrmap page or a free page.  In those cases, the following
  2218        ** call to btreeInitPage() will likely return SQLITE_CORRUPT.
  2219        ** But no harm is done by this.  And it is very important that
  2220        ** btreeInitPage() be called on every btree page so we make
  2221        ** the call for every page that comes in for re-initing. */
  2222        btreeInitPage(pPage);
  2223      }
  2224    }
  2225  }
  2226  
  2227  /*
  2228  ** Invoke the busy handler for a btree.
  2229  */
  2230  static int btreeInvokeBusyHandler(void *pArg){
  2231    BtShared *pBt = (BtShared*)pArg;
  2232    assert( pBt->db );
  2233    assert( sqlite3_mutex_held(pBt->db->mutex) );
  2234    return sqlite3InvokeBusyHandler(&pBt->db->busyHandler);
  2235  }
  2236  
  2237  /*
  2238  ** Open a database file.
  2239  ** 
  2240  ** zFilename is the name of the database file.  If zFilename is NULL
  2241  ** then an ephemeral database is created.  The ephemeral database might
  2242  ** be exclusively in memory, or it might use a disk-based memory cache.
  2243  ** Either way, the ephemeral database will be automatically deleted 
  2244  ** when sqlite3BtreeClose() is called.
  2245  **
  2246  ** If zFilename is ":memory:" then an in-memory database is created
  2247  ** that is automatically destroyed when it is closed.
  2248  **
  2249  ** The "flags" parameter is a bitmask that might contain bits like
  2250  ** BTREE_OMIT_JOURNAL and/or BTREE_MEMORY.
  2251  **
  2252  ** If the database is already opened in the same database connection
  2253  ** and we are in shared cache mode, then the open will fail with an
  2254  ** SQLITE_CONSTRAINT error.  We cannot allow two or more BtShared
  2255  ** objects in the same database connection since doing so will lead
  2256  ** to problems with locking.
  2257  */
  2258  int sqlite3BtreeOpen(
  2259    sqlite3_vfs *pVfs,      /* VFS to use for this b-tree */
  2260    const char *zFilename,  /* Name of the file containing the BTree database */
  2261    sqlite3 *db,            /* Associated database handle */
  2262    Btree **ppBtree,        /* Pointer to new Btree object written here */
  2263    int flags,              /* Options */
  2264    int vfsFlags            /* Flags passed through to sqlite3_vfs.xOpen() */
  2265  ){
  2266    BtShared *pBt = 0;             /* Shared part of btree structure */
  2267    Btree *p;                      /* Handle to return */
  2268    sqlite3_mutex *mutexOpen = 0;  /* Prevents a race condition. Ticket #3537 */
  2269    int rc = SQLITE_OK;            /* Result code from this function */
  2270    u8 nReserve;                   /* Byte of unused space on each page */
  2271    unsigned char zDbHeader[100];  /* Database header content */
  2272  
  2273    /* True if opening an ephemeral, temporary database */
  2274    const int isTempDb = zFilename==0 || zFilename[0]==0;
  2275  
  2276    /* Set the variable isMemdb to true for an in-memory database, or 
  2277    ** false for a file-based database.
  2278    */
  2279  #ifdef SQLITE_OMIT_MEMORYDB
  2280    const int isMemdb = 0;
  2281  #else
  2282    const int isMemdb = (zFilename && strcmp(zFilename, ":memory:")==0)
  2283                         || (isTempDb && sqlite3TempInMemory(db))
  2284                         || (vfsFlags & SQLITE_OPEN_MEMORY)!=0;
  2285  #endif
  2286  
  2287    assert( db!=0 );
  2288    assert( pVfs!=0 );
  2289    assert( sqlite3_mutex_held(db->mutex) );
  2290    assert( (flags&0xff)==flags );   /* flags fit in 8 bits */
  2291  
  2292    /* Only a BTREE_SINGLE database can be BTREE_UNORDERED */
  2293    assert( (flags & BTREE_UNORDERED)==0 || (flags & BTREE_SINGLE)!=0 );
  2294  
  2295    /* A BTREE_SINGLE database is always a temporary and/or ephemeral */
  2296    assert( (flags & BTREE_SINGLE)==0 || isTempDb );
  2297  
  2298    if( isMemdb ){
  2299      flags |= BTREE_MEMORY;
  2300    }
  2301    if( (vfsFlags & SQLITE_OPEN_MAIN_DB)!=0 && (isMemdb || isTempDb) ){
  2302      vfsFlags = (vfsFlags & ~SQLITE_OPEN_MAIN_DB) | SQLITE_OPEN_TEMP_DB;
  2303    }
  2304    p = sqlite3MallocZero(sizeof(Btree));
  2305    if( !p ){
  2306      return SQLITE_NOMEM_BKPT;
  2307    }
  2308    p->inTrans = TRANS_NONE;
  2309    p->db = db;
  2310  #ifndef SQLITE_OMIT_SHARED_CACHE
  2311    p->lock.pBtree = p;
  2312    p->lock.iTable = 1;
  2313  #endif
  2314  
  2315  #if !defined(SQLITE_OMIT_SHARED_CACHE) && !defined(SQLITE_OMIT_DISKIO)
  2316    /*
  2317    ** If this Btree is a candidate for shared cache, try to find an
  2318    ** existing BtShared object that we can share with
  2319    */
  2320    if( isTempDb==0 && (isMemdb==0 || (vfsFlags&SQLITE_OPEN_URI)!=0) ){
  2321      if( vfsFlags & SQLITE_OPEN_SHAREDCACHE ){
  2322        int nFilename = sqlite3Strlen30(zFilename)+1;
  2323        int nFullPathname = pVfs->mxPathname+1;
  2324        char *zFullPathname = sqlite3Malloc(MAX(nFullPathname,nFilename));
  2325        MUTEX_LOGIC( sqlite3_mutex *mutexShared; )
  2326  
  2327        p->sharable = 1;
  2328        if( !zFullPathname ){
  2329          sqlite3_free(p);
  2330          return SQLITE_NOMEM_BKPT;
  2331        }
  2332        if( isMemdb ){
  2333          memcpy(zFullPathname, zFilename, nFilename);
  2334        }else{
  2335          rc = sqlite3OsFullPathname(pVfs, zFilename,
  2336                                     nFullPathname, zFullPathname);
  2337          if( rc ){
  2338            sqlite3_free(zFullPathname);
  2339            sqlite3_free(p);
  2340            return rc;
  2341          }
  2342        }
  2343  #if SQLITE_THREADSAFE
  2344        mutexOpen = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_OPEN);
  2345        sqlite3_mutex_enter(mutexOpen);
  2346        mutexShared = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER);
  2347        sqlite3_mutex_enter(mutexShared);
  2348  #endif
  2349        for(pBt=GLOBAL(BtShared*,sqlite3SharedCacheList); pBt; pBt=pBt->pNext){
  2350          assert( pBt->nRef>0 );
  2351          if( 0==strcmp(zFullPathname, sqlite3PagerFilename(pBt->pPager, 0))
  2352                   && sqlite3PagerVfs(pBt->pPager)==pVfs ){
  2353            int iDb;
  2354            for(iDb=db->nDb-1; iDb>=0; iDb--){
  2355              Btree *pExisting = db->aDb[iDb].pBt;
  2356              if( pExisting && pExisting->pBt==pBt ){
  2357                sqlite3_mutex_leave(mutexShared);
  2358                sqlite3_mutex_leave(mutexOpen);
  2359                sqlite3_free(zFullPathname);
  2360                sqlite3_free(p);
  2361                return SQLITE_CONSTRAINT;
  2362              }
  2363            }
  2364            p->pBt = pBt;
  2365            pBt->nRef++;
  2366            break;
  2367          }
  2368        }
  2369        sqlite3_mutex_leave(mutexShared);
  2370        sqlite3_free(zFullPathname);
  2371      }
  2372  #ifdef SQLITE_DEBUG
  2373      else{
  2374        /* In debug mode, we mark all persistent databases as sharable
  2375        ** even when they are not.  This exercises the locking code and
  2376        ** gives more opportunity for asserts(sqlite3_mutex_held())
  2377        ** statements to find locking problems.
  2378        */
  2379        p->sharable = 1;
  2380      }
  2381  #endif
  2382    }
  2383  #endif
  2384    if( pBt==0 ){
  2385      /*
  2386      ** The following asserts make sure that structures used by the btree are
  2387      ** the right size.  This is to guard against size changes that result
  2388      ** when compiling on a different architecture.
  2389      */
  2390      assert( sizeof(i64)==8 );
  2391      assert( sizeof(u64)==8 );
  2392      assert( sizeof(u32)==4 );
  2393      assert( sizeof(u16)==2 );
  2394      assert( sizeof(Pgno)==4 );
  2395    
  2396      pBt = sqlite3MallocZero( sizeof(*pBt) );
  2397      if( pBt==0 ){
  2398        rc = SQLITE_NOMEM_BKPT;
  2399        goto btree_open_out;
  2400      }
  2401      rc = sqlite3PagerOpen(pVfs, &pBt->pPager, zFilename,
  2402                            sizeof(MemPage), flags, vfsFlags, pageReinit);
  2403      if( rc==SQLITE_OK ){
  2404        sqlite3PagerSetMmapLimit(pBt->pPager, db->szMmap);
  2405        rc = sqlite3PagerReadFileheader(pBt->pPager,sizeof(zDbHeader),zDbHeader);
  2406      }
  2407      if( rc!=SQLITE_OK ){
  2408        goto btree_open_out;
  2409      }
  2410      pBt->openFlags = (u8)flags;
  2411      pBt->db = db;
  2412      sqlite3PagerSetBusyhandler(pBt->pPager, btreeInvokeBusyHandler, pBt);
  2413      p->pBt = pBt;
  2414    
  2415      pBt->pCursor = 0;
  2416      pBt->pPage1 = 0;
  2417      if( sqlite3PagerIsreadonly(pBt->pPager) ) pBt->btsFlags |= BTS_READ_ONLY;
  2418  #if defined(SQLITE_SECURE_DELETE)
  2419      pBt->btsFlags |= BTS_SECURE_DELETE;
  2420  #elif defined(SQLITE_FAST_SECURE_DELETE)
  2421      pBt->btsFlags |= BTS_OVERWRITE;
  2422  #endif
  2423      /* EVIDENCE-OF: R-51873-39618 The page size for a database file is
  2424      ** determined by the 2-byte integer located at an offset of 16 bytes from
  2425      ** the beginning of the database file. */
  2426      pBt->pageSize = (zDbHeader[16]<<8) | (zDbHeader[17]<<16);
  2427      if( pBt->pageSize<512 || pBt->pageSize>SQLITE_MAX_PAGE_SIZE
  2428           || ((pBt->pageSize-1)&pBt->pageSize)!=0 ){
  2429        pBt->pageSize = 0;
  2430  #ifndef SQLITE_OMIT_AUTOVACUUM
  2431        /* If the magic name ":memory:" will create an in-memory database, then
  2432        ** leave the autoVacuum mode at 0 (do not auto-vacuum), even if
  2433        ** SQLITE_DEFAULT_AUTOVACUUM is true. On the other hand, if
  2434        ** SQLITE_OMIT_MEMORYDB has been defined, then ":memory:" is just a
  2435        ** regular file-name. In this case the auto-vacuum applies as per normal.
  2436        */
  2437        if( zFilename && !isMemdb ){
  2438          pBt->autoVacuum = (SQLITE_DEFAULT_AUTOVACUUM ? 1 : 0);
  2439          pBt->incrVacuum = (SQLITE_DEFAULT_AUTOVACUUM==2 ? 1 : 0);
  2440        }
  2441  #endif
  2442        nReserve = 0;
  2443      }else{
  2444        /* EVIDENCE-OF: R-37497-42412 The size of the reserved region is
  2445        ** determined by the one-byte unsigned integer found at an offset of 20
  2446        ** into the database file header. */
  2447        nReserve = zDbHeader[20];
  2448        pBt->btsFlags |= BTS_PAGESIZE_FIXED;
  2449  #ifndef SQLITE_OMIT_AUTOVACUUM
  2450        pBt->autoVacuum = (get4byte(&zDbHeader[36 + 4*4])?1:0);
  2451        pBt->incrVacuum = (get4byte(&zDbHeader[36 + 7*4])?1:0);
  2452  #endif
  2453      }
  2454      rc = sqlite3PagerSetPagesize(pBt->pPager, &pBt->pageSize, nReserve);
  2455      if( rc ) goto btree_open_out;
  2456      pBt->usableSize = pBt->pageSize - nReserve;
  2457      assert( (pBt->pageSize & 7)==0 );  /* 8-byte alignment of pageSize */
  2458     
  2459  #if !defined(SQLITE_OMIT_SHARED_CACHE) && !defined(SQLITE_OMIT_DISKIO)
  2460      /* Add the new BtShared object to the linked list sharable BtShareds.
  2461      */
  2462      pBt->nRef = 1;
  2463      if( p->sharable ){
  2464        MUTEX_LOGIC( sqlite3_mutex *mutexShared; )
  2465        MUTEX_LOGIC( mutexShared = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER);)
  2466        if( SQLITE_THREADSAFE && sqlite3GlobalConfig.bCoreMutex ){
  2467          pBt->mutex = sqlite3MutexAlloc(SQLITE_MUTEX_FAST);
  2468          if( pBt->mutex==0 ){
  2469            rc = SQLITE_NOMEM_BKPT;
  2470            goto btree_open_out;
  2471          }
  2472        }
  2473        sqlite3_mutex_enter(mutexShared);
  2474        pBt->pNext = GLOBAL(BtShared*,sqlite3SharedCacheList);
  2475        GLOBAL(BtShared*,sqlite3SharedCacheList) = pBt;
  2476        sqlite3_mutex_leave(mutexShared);
  2477      }
  2478  #endif
  2479    }
  2480  
  2481  #if !defined(SQLITE_OMIT_SHARED_CACHE) && !defined(SQLITE_OMIT_DISKIO)
  2482    /* If the new Btree uses a sharable pBtShared, then link the new
  2483    ** Btree into the list of all sharable Btrees for the same connection.
  2484    ** The list is kept in ascending order by pBt address.
  2485    */
  2486    if( p->sharable ){
  2487      int i;
  2488      Btree *pSib;
  2489      for(i=0; i<db->nDb; i++){
  2490        if( (pSib = db->aDb[i].pBt)!=0 && pSib->sharable ){
  2491          while( pSib->pPrev ){ pSib = pSib->pPrev; }
  2492          if( (uptr)p->pBt<(uptr)pSib->pBt ){
  2493            p->pNext = pSib;
  2494            p->pPrev = 0;
  2495            pSib->pPrev = p;
  2496          }else{
  2497            while( pSib->pNext && (uptr)pSib->pNext->pBt<(uptr)p->pBt ){
  2498              pSib = pSib->pNext;
  2499            }
  2500            p->pNext = pSib->pNext;
  2501            p->pPrev = pSib;
  2502            if( p->pNext ){
  2503              p->pNext->pPrev = p;
  2504            }
  2505            pSib->pNext = p;
  2506          }
  2507          break;
  2508        }
  2509      }
  2510    }
  2511  #endif
  2512    *ppBtree = p;
  2513  
  2514  btree_open_out:
  2515    if( rc!=SQLITE_OK ){
  2516      if( pBt && pBt->pPager ){
  2517        sqlite3PagerClose(pBt->pPager, 0);
  2518      }
  2519      sqlite3_free(pBt);
  2520      sqlite3_free(p);
  2521      *ppBtree = 0;
  2522    }else{
  2523      sqlite3_file *pFile;
  2524  
  2525      /* If the B-Tree was successfully opened, set the pager-cache size to the
  2526      ** default value. Except, when opening on an existing shared pager-cache,
  2527      ** do not change the pager-cache size.
  2528      */
  2529      if( sqlite3BtreeSchema(p, 0, 0)==0 ){
  2530        sqlite3PagerSetCachesize(p->pBt->pPager, SQLITE_DEFAULT_CACHE_SIZE);
  2531      }
  2532  
  2533      pFile = sqlite3PagerFile(pBt->pPager);
  2534      if( pFile->pMethods ){
  2535        sqlite3OsFileControlHint(pFile, SQLITE_FCNTL_PDB, (void*)&pBt->db);
  2536      }
  2537    }
  2538    if( mutexOpen ){
  2539      assert( sqlite3_mutex_held(mutexOpen) );
  2540      sqlite3_mutex_leave(mutexOpen);
  2541    }
  2542    assert( rc!=SQLITE_OK || sqlite3BtreeConnectionCount(*ppBtree)>0 );
  2543    return rc;
  2544  }
  2545  
  2546  /*
  2547  ** Decrement the BtShared.nRef counter.  When it reaches zero,
  2548  ** remove the BtShared structure from the sharing list.  Return
  2549  ** true if the BtShared.nRef counter reaches zero and return
  2550  ** false if it is still positive.
  2551  */
  2552  static int removeFromSharingList(BtShared *pBt){
  2553  #ifndef SQLITE_OMIT_SHARED_CACHE
  2554    MUTEX_LOGIC( sqlite3_mutex *pMaster; )
  2555    BtShared *pList;
  2556    int removed = 0;
  2557  
  2558    assert( sqlite3_mutex_notheld(pBt->mutex) );
  2559    MUTEX_LOGIC( pMaster = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER); )
  2560    sqlite3_mutex_enter(pMaster);
  2561    pBt->nRef--;
  2562    if( pBt->nRef<=0 ){
  2563      if( GLOBAL(BtShared*,sqlite3SharedCacheList)==pBt ){
  2564        GLOBAL(BtShared*,sqlite3SharedCacheList) = pBt->pNext;
  2565      }else{
  2566        pList = GLOBAL(BtShared*,sqlite3SharedCacheList);
  2567        while( ALWAYS(pList) && pList->pNext!=pBt ){
  2568          pList=pList->pNext;
  2569        }
  2570        if( ALWAYS(pList) ){
  2571          pList->pNext = pBt->pNext;
  2572        }
  2573      }
  2574      if( SQLITE_THREADSAFE ){
  2575        sqlite3_mutex_free(pBt->mutex);
  2576      }
  2577      removed = 1;
  2578    }
  2579    sqlite3_mutex_leave(pMaster);
  2580    return removed;
  2581  #else
  2582    return 1;
  2583  #endif
  2584  }
  2585  
  2586  /*
  2587  ** Make sure pBt->pTmpSpace points to an allocation of 
  2588  ** MX_CELL_SIZE(pBt) bytes with a 4-byte prefix for a left-child
  2589  ** pointer.
  2590  */
  2591  static void allocateTempSpace(BtShared *pBt){
  2592    if( !pBt->pTmpSpace ){
  2593      pBt->pTmpSpace = sqlite3PageMalloc( pBt->pageSize );
  2594  
  2595      /* One of the uses of pBt->pTmpSpace is to format cells before
  2596      ** inserting them into a leaf page (function fillInCell()). If
  2597      ** a cell is less than 4 bytes in size, it is rounded up to 4 bytes
  2598      ** by the various routines that manipulate binary cells. Which
  2599      ** can mean that fillInCell() only initializes the first 2 or 3
  2600      ** bytes of pTmpSpace, but that the first 4 bytes are copied from
  2601      ** it into a database page. This is not actually a problem, but it
  2602      ** does cause a valgrind error when the 1 or 2 bytes of unitialized 
  2603      ** data is passed to system call write(). So to avoid this error,
  2604      ** zero the first 4 bytes of temp space here.
  2605      **
  2606      ** Also:  Provide four bytes of initialized space before the
  2607      ** beginning of pTmpSpace as an area available to prepend the
  2608      ** left-child pointer to the beginning of a cell.
  2609      */
  2610      if( pBt->pTmpSpace ){
  2611        memset(pBt->pTmpSpace, 0, 8);
  2612        pBt->pTmpSpace += 4;
  2613      }
  2614    }
  2615  }
  2616  
  2617  /*
  2618  ** Free the pBt->pTmpSpace allocation
  2619  */
  2620  static void freeTempSpace(BtShared *pBt){
  2621    if( pBt->pTmpSpace ){
  2622      pBt->pTmpSpace -= 4;
  2623      sqlite3PageFree(pBt->pTmpSpace);
  2624      pBt->pTmpSpace = 0;
  2625    }
  2626  }
  2627  
  2628  /*
  2629  ** Close an open database and invalidate all cursors.
  2630  */
  2631  int sqlite3BtreeClose(Btree *p){
  2632    BtShared *pBt = p->pBt;
  2633    BtCursor *pCur;
  2634  
  2635    /* Close all cursors opened via this handle.  */
  2636    assert( sqlite3_mutex_held(p->db->mutex) );
  2637    sqlite3BtreeEnter(p);
  2638    pCur = pBt->pCursor;
  2639    while( pCur ){
  2640      BtCursor *pTmp = pCur;
  2641      pCur = pCur->pNext;
  2642      if( pTmp->pBtree==p ){
  2643        sqlite3BtreeCloseCursor(pTmp);
  2644      }
  2645    }
  2646  
  2647    /* Rollback any active transaction and free the handle structure.
  2648    ** The call to sqlite3BtreeRollback() drops any table-locks held by
  2649    ** this handle.
  2650    */
  2651    sqlite3BtreeRollback(p, SQLITE_OK, 0);
  2652    sqlite3BtreeLeave(p);
  2653  
  2654    /* If there are still other outstanding references to the shared-btree
  2655    ** structure, return now. The remainder of this procedure cleans 
  2656    ** up the shared-btree.
  2657    */
  2658    assert( p->wantToLock==0 && p->locked==0 );
  2659    if( !p->sharable || removeFromSharingList(pBt) ){
  2660      /* The pBt is no longer on the sharing list, so we can access
  2661      ** it without having to hold the mutex.
  2662      **
  2663      ** Clean out and delete the BtShared object.
  2664      */
  2665      assert( !pBt->pCursor );
  2666      sqlite3PagerClose(pBt->pPager, p->db);
  2667      if( pBt->xFreeSchema && pBt->pSchema ){
  2668        pBt->xFreeSchema(pBt->pSchema);
  2669      }
  2670      sqlite3DbFree(0, pBt->pSchema);
  2671      freeTempSpace(pBt);
  2672      sqlite3_free(pBt);
  2673    }
  2674  
  2675  #ifndef SQLITE_OMIT_SHARED_CACHE
  2676    assert( p->wantToLock==0 );
  2677    assert( p->locked==0 );
  2678    if( p->pPrev ) p->pPrev->pNext = p->pNext;
  2679    if( p->pNext ) p->pNext->pPrev = p->pPrev;
  2680  #endif
  2681  
  2682    sqlite3_free(p);
  2683    return SQLITE_OK;
  2684  }
  2685  
  2686  /*
  2687  ** Change the "soft" limit on the number of pages in the cache.
  2688  ** Unused and unmodified pages will be recycled when the number of
  2689  ** pages in the cache exceeds this soft limit.  But the size of the
  2690  ** cache is allowed to grow larger than this limit if it contains
  2691  ** dirty pages or pages still in active use.
  2692  */
  2693  int sqlite3BtreeSetCacheSize(Btree *p, int mxPage){
  2694    BtShared *pBt = p->pBt;
  2695    assert( sqlite3_mutex_held(p->db->mutex) );
  2696    sqlite3BtreeEnter(p);
  2697    sqlite3PagerSetCachesize(pBt->pPager, mxPage);
  2698    sqlite3BtreeLeave(p);
  2699    return SQLITE_OK;
  2700  }
  2701  
  2702  /*
  2703  ** Change the "spill" limit on the number of pages in the cache.
  2704  ** If the number of pages exceeds this limit during a write transaction,
  2705  ** the pager might attempt to "spill" pages to the journal early in
  2706  ** order to free up memory.
  2707  **
  2708  ** The value returned is the current spill size.  If zero is passed
  2709  ** as an argument, no changes are made to the spill size setting, so
  2710  ** using mxPage of 0 is a way to query the current spill size.
  2711  */
  2712  int sqlite3BtreeSetSpillSize(Btree *p, int mxPage){
  2713    BtShared *pBt = p->pBt;
  2714    int res;
  2715    assert( sqlite3_mutex_held(p->db->mutex) );
  2716    sqlite3BtreeEnter(p);
  2717    res = sqlite3PagerSetSpillsize(pBt->pPager, mxPage);
  2718    sqlite3BtreeLeave(p);
  2719    return res;
  2720  }
  2721  
  2722  #if SQLITE_MAX_MMAP_SIZE>0
  2723  /*
  2724  ** Change the limit on the amount of the database file that may be
  2725  ** memory mapped.
  2726  */
  2727  int sqlite3BtreeSetMmapLimit(Btree *p, sqlite3_int64 szMmap){
  2728    BtShared *pBt = p->pBt;
  2729    assert( sqlite3_mutex_held(p->db->mutex) );
  2730    sqlite3BtreeEnter(p);
  2731    sqlite3PagerSetMmapLimit(pBt->pPager, szMmap);
  2732    sqlite3BtreeLeave(p);
  2733    return SQLITE_OK;
  2734  }
  2735  #endif /* SQLITE_MAX_MMAP_SIZE>0 */
  2736  
  2737  /*
  2738  ** Change the way data is synced to disk in order to increase or decrease
  2739  ** how well the database resists damage due to OS crashes and power
  2740  ** failures.  Level 1 is the same as asynchronous (no syncs() occur and
  2741  ** there is a high probability of damage)  Level 2 is the default.  There
  2742  ** is a very low but non-zero probability of damage.  Level 3 reduces the
  2743  ** probability of damage to near zero but with a write performance reduction.
  2744  */
  2745  #ifndef SQLITE_OMIT_PAGER_PRAGMAS
  2746  int sqlite3BtreeSetPagerFlags(
  2747    Btree *p,              /* The btree to set the safety level on */
  2748    unsigned pgFlags       /* Various PAGER_* flags */
  2749  ){
  2750    BtShared *pBt = p->pBt;
  2751    assert( sqlite3_mutex_held(p->db->mutex) );
  2752    sqlite3BtreeEnter(p);
  2753    sqlite3PagerSetFlags(pBt->pPager, pgFlags);
  2754    sqlite3BtreeLeave(p);
  2755    return SQLITE_OK;
  2756  }
  2757  #endif
  2758  
  2759  /*
  2760  ** Change the default pages size and the number of reserved bytes per page.
  2761  ** Or, if the page size has already been fixed, return SQLITE_READONLY 
  2762  ** without changing anything.
  2763  **
  2764  ** The page size must be a power of 2 between 512 and 65536.  If the page
  2765  ** size supplied does not meet this constraint then the page size is not
  2766  ** changed.
  2767  **
  2768  ** Page sizes are constrained to be a power of two so that the region
  2769  ** of the database file used for locking (beginning at PENDING_BYTE,
  2770  ** the first byte past the 1GB boundary, 0x40000000) needs to occur
  2771  ** at the beginning of a page.
  2772  **
  2773  ** If parameter nReserve is less than zero, then the number of reserved
  2774  ** bytes per page is left unchanged.
  2775  **
  2776  ** If the iFix!=0 then the BTS_PAGESIZE_FIXED flag is set so that the page size
  2777  ** and autovacuum mode can no longer be changed.
  2778  */
  2779  int sqlite3BtreeSetPageSize(Btree *p, int pageSize, int nReserve, int iFix){
  2780    int rc = SQLITE_OK;
  2781    BtShared *pBt = p->pBt;
  2782    assert( nReserve>=-1 && nReserve<=255 );
  2783    sqlite3BtreeEnter(p);
  2784  #if SQLITE_HAS_CODEC
  2785    if( nReserve>pBt->optimalReserve ) pBt->optimalReserve = (u8)nReserve;
  2786  #endif
  2787    if( pBt->btsFlags & BTS_PAGESIZE_FIXED ){
  2788      sqlite3BtreeLeave(p);
  2789      return SQLITE_READONLY;
  2790    }
  2791    if( nReserve<0 ){
  2792      nReserve = pBt->pageSize - pBt->usableSize;
  2793    }
  2794    assert( nReserve>=0 && nReserve<=255 );
  2795    if( pageSize>=512 && pageSize<=SQLITE_MAX_PAGE_SIZE &&
  2796          ((pageSize-1)&pageSize)==0 ){
  2797      assert( (pageSize & 7)==0 );
  2798      assert( !pBt->pCursor );
  2799      pBt->pageSize = (u32)pageSize;
  2800      freeTempSpace(pBt);
  2801    }
  2802    rc = sqlite3PagerSetPagesize(pBt->pPager, &pBt->pageSize, nReserve);
  2803    pBt->usableSize = pBt->pageSize - (u16)nReserve;
  2804    if( iFix ) pBt->btsFlags |= BTS_PAGESIZE_FIXED;
  2805    sqlite3BtreeLeave(p);
  2806    return rc;
  2807  }
  2808  
  2809  /*
  2810  ** Return the currently defined page size
  2811  */
  2812  int sqlite3BtreeGetPageSize(Btree *p){
  2813    return p->pBt->pageSize;
  2814  }
  2815  
  2816  /*
  2817  ** This function is similar to sqlite3BtreeGetReserve(), except that it
  2818  ** may only be called if it is guaranteed that the b-tree mutex is already
  2819  ** held.
  2820  **
  2821  ** This is useful in one special case in the backup API code where it is
  2822  ** known that the shared b-tree mutex is held, but the mutex on the 
  2823  ** database handle that owns *p is not. In this case if sqlite3BtreeEnter()
  2824  ** were to be called, it might collide with some other operation on the
  2825  ** database handle that owns *p, causing undefined behavior.
  2826  */
  2827  int sqlite3BtreeGetReserveNoMutex(Btree *p){
  2828    int n;
  2829    assert( sqlite3_mutex_held(p->pBt->mutex) );
  2830    n = p->pBt->pageSize - p->pBt->usableSize;
  2831    return n;
  2832  }
  2833  
  2834  /*
  2835  ** Return the number of bytes of space at the end of every page that
  2836  ** are intentually left unused.  This is the "reserved" space that is
  2837  ** sometimes used by extensions.
  2838  **
  2839  ** If SQLITE_HAS_MUTEX is defined then the number returned is the
  2840  ** greater of the current reserved space and the maximum requested
  2841  ** reserve space.
  2842  */
  2843  int sqlite3BtreeGetOptimalReserve(Btree *p){
  2844    int n;
  2845    sqlite3BtreeEnter(p);
  2846    n = sqlite3BtreeGetReserveNoMutex(p);
  2847  #ifdef SQLITE_HAS_CODEC
  2848    if( n<p->pBt->optimalReserve ) n = p->pBt->optimalReserve;
  2849  #endif
  2850    sqlite3BtreeLeave(p);
  2851    return n;
  2852  }
  2853  
  2854  
  2855  /*
  2856  ** Set the maximum page count for a database if mxPage is positive.
  2857  ** No changes are made if mxPage is 0 or negative.
  2858  ** Regardless of the value of mxPage, return the maximum page count.
  2859  */
  2860  int sqlite3BtreeMaxPageCount(Btree *p, int mxPage){
  2861    int n;
  2862    sqlite3BtreeEnter(p);
  2863    n = sqlite3PagerMaxPageCount(p->pBt->pPager, mxPage);
  2864    sqlite3BtreeLeave(p);
  2865    return n;
  2866  }
  2867  
  2868  /*
  2869  ** Change the values for the BTS_SECURE_DELETE and BTS_OVERWRITE flags:
  2870  **
  2871  **    newFlag==0       Both BTS_SECURE_DELETE and BTS_OVERWRITE are cleared
  2872  **    newFlag==1       BTS_SECURE_DELETE set and BTS_OVERWRITE is cleared
  2873  **    newFlag==2       BTS_SECURE_DELETE cleared and BTS_OVERWRITE is set
  2874  **    newFlag==(-1)    No changes
  2875  **
  2876  ** This routine acts as a query if newFlag is less than zero
  2877  **
  2878  ** With BTS_OVERWRITE set, deleted content is overwritten by zeros, but
  2879  ** freelist leaf pages are not written back to the database.  Thus in-page
  2880  ** deleted content is cleared, but freelist deleted content is not.
  2881  **
  2882  ** With BTS_SECURE_DELETE, operation is like BTS_OVERWRITE with the addition
  2883  ** that freelist leaf pages are written back into the database, increasing
  2884  ** the amount of disk I/O.
  2885  */
  2886  int sqlite3BtreeSecureDelete(Btree *p, int newFlag){
  2887    int b;
  2888    if( p==0 ) return 0;
  2889    sqlite3BtreeEnter(p);
  2890    assert( BTS_OVERWRITE==BTS_SECURE_DELETE*2 );
  2891    assert( BTS_FAST_SECURE==(BTS_OVERWRITE|BTS_SECURE_DELETE) );
  2892    if( newFlag>=0 ){
  2893      p->pBt->btsFlags &= ~BTS_FAST_SECURE;
  2894      p->pBt->btsFlags |= BTS_SECURE_DELETE*newFlag;
  2895    }
  2896    b = (p->pBt->btsFlags & BTS_FAST_SECURE)/BTS_SECURE_DELETE;
  2897    sqlite3BtreeLeave(p);
  2898    return b;
  2899  }
  2900  
  2901  /*
  2902  ** Change the 'auto-vacuum' property of the database. If the 'autoVacuum'
  2903  ** parameter is non-zero, then auto-vacuum mode is enabled. If zero, it
  2904  ** is disabled. The default value for the auto-vacuum property is 
  2905  ** determined by the SQLITE_DEFAULT_AUTOVACUUM macro.
  2906  */
  2907  int sqlite3BtreeSetAutoVacuum(Btree *p, int autoVacuum){
  2908  #ifdef SQLITE_OMIT_AUTOVACUUM
  2909    return SQLITE_READONLY;
  2910  #else
  2911    BtShared *pBt = p->pBt;
  2912    int rc = SQLITE_OK;
  2913    u8 av = (u8)autoVacuum;
  2914  
  2915    sqlite3BtreeEnter(p);
  2916    if( (pBt->btsFlags & BTS_PAGESIZE_FIXED)!=0 && (av ?1:0)!=pBt->autoVacuum ){
  2917      rc = SQLITE_READONLY;
  2918    }else{
  2919      pBt->autoVacuum = av ?1:0;
  2920      pBt->incrVacuum = av==2 ?1:0;
  2921    }
  2922    sqlite3BtreeLeave(p);
  2923    return rc;
  2924  #endif
  2925  }
  2926  
  2927  /*
  2928  ** Return the value of the 'auto-vacuum' property. If auto-vacuum is 
  2929  ** enabled 1 is returned. Otherwise 0.
  2930  */
  2931  int sqlite3BtreeGetAutoVacuum(Btree *p){
  2932  #ifdef SQLITE_OMIT_AUTOVACUUM
  2933    return BTREE_AUTOVACUUM_NONE;
  2934  #else
  2935    int rc;
  2936    sqlite3BtreeEnter(p);
  2937    rc = (
  2938      (!p->pBt->autoVacuum)?BTREE_AUTOVACUUM_NONE:
  2939      (!p->pBt->incrVacuum)?BTREE_AUTOVACUUM_FULL:
  2940      BTREE_AUTOVACUUM_INCR
  2941    );
  2942    sqlite3BtreeLeave(p);
  2943    return rc;
  2944  #endif
  2945  }
  2946  
  2947  /*
  2948  ** If the user has not set the safety-level for this database connection
  2949  ** using "PRAGMA synchronous", and if the safety-level is not already
  2950  ** set to the value passed to this function as the second parameter,
  2951  ** set it so.
  2952  */
  2953  #if SQLITE_DEFAULT_SYNCHRONOUS!=SQLITE_DEFAULT_WAL_SYNCHRONOUS \
  2954      && !defined(SQLITE_OMIT_WAL)
  2955  static void setDefaultSyncFlag(BtShared *pBt, u8 safety_level){
  2956    sqlite3 *db;
  2957    Db *pDb;
  2958    if( (db=pBt->db)!=0 && (pDb=db->aDb)!=0 ){
  2959      while( pDb->pBt==0 || pDb->pBt->pBt!=pBt ){ pDb++; }
  2960      if( pDb->bSyncSet==0 
  2961       && pDb->safety_level!=safety_level 
  2962       && pDb!=&db->aDb[1] 
  2963      ){
  2964        pDb->safety_level = safety_level;
  2965        sqlite3PagerSetFlags(pBt->pPager,
  2966            pDb->safety_level | (db->flags & PAGER_FLAGS_MASK));
  2967      }
  2968    }
  2969  }
  2970  #else
  2971  # define setDefaultSyncFlag(pBt,safety_level)
  2972  #endif
  2973  
  2974  /*
  2975  ** Get a reference to pPage1 of the database file.  This will
  2976  ** also acquire a readlock on that file.
  2977  **
  2978  ** SQLITE_OK is returned on success.  If the file is not a
  2979  ** well-formed database file, then SQLITE_CORRUPT is returned.
  2980  ** SQLITE_BUSY is returned if the database is locked.  SQLITE_NOMEM
  2981  ** is returned if we run out of memory. 
  2982  */
  2983  static int lockBtree(BtShared *pBt){
  2984    int rc;              /* Result code from subfunctions */
  2985    MemPage *pPage1;     /* Page 1 of the database file */
  2986    int nPage;           /* Number of pages in the database */
  2987    int nPageFile = 0;   /* Number of pages in the database file */
  2988    int nPageHeader;     /* Number of pages in the database according to hdr */
  2989  
  2990    assert( sqlite3_mutex_held(pBt->mutex) );
  2991    assert( pBt->pPage1==0 );
  2992    rc = sqlite3PagerSharedLock(pBt->pPager);
  2993    if( rc!=SQLITE_OK ) return rc;
  2994    rc = btreeGetPage(pBt, 1, &pPage1, 0);
  2995    if( rc!=SQLITE_OK ) return rc;
  2996  
  2997    /* Do some checking to help insure the file we opened really is
  2998    ** a valid database file. 
  2999    */
  3000    nPage = nPageHeader = get4byte(28+(u8*)pPage1->aData);
  3001    sqlite3PagerPagecount(pBt->pPager, &nPageFile);
  3002    if( nPage==0 || memcmp(24+(u8*)pPage1->aData, 92+(u8*)pPage1->aData,4)!=0 ){
  3003      nPage = nPageFile;
  3004    }
  3005    if( nPage>0 ){
  3006      u32 pageSize;
  3007      u32 usableSize;
  3008      u8 *page1 = pPage1->aData;
  3009      rc = SQLITE_NOTADB;
  3010      /* EVIDENCE-OF: R-43737-39999 Every valid SQLite database file begins
  3011      ** with the following 16 bytes (in hex): 53 51 4c 69 74 65 20 66 6f 72 6d
  3012      ** 61 74 20 33 00. */
  3013      if( memcmp(page1, zMagicHeader, 16)!=0 ){
  3014        goto page1_init_failed;
  3015      }
  3016  
  3017  #ifdef SQLITE_OMIT_WAL
  3018      if( page1[18]>1 ){
  3019        pBt->btsFlags |= BTS_READ_ONLY;
  3020      }
  3021      if( page1[19]>1 ){
  3022        goto page1_init_failed;
  3023      }
  3024  #else
  3025      if( page1[18]>2 ){
  3026        pBt->btsFlags |= BTS_READ_ONLY;
  3027      }
  3028      if( page1[19]>2 ){
  3029        goto page1_init_failed;
  3030      }
  3031  
  3032      /* If the write version is set to 2, this database should be accessed
  3033      ** in WAL mode. If the log is not already open, open it now. Then 
  3034      ** return SQLITE_OK and return without populating BtShared.pPage1.
  3035      ** The caller detects this and calls this function again. This is
  3036      ** required as the version of page 1 currently in the page1 buffer
  3037      ** may not be the latest version - there may be a newer one in the log
  3038      ** file.
  3039      */
  3040      if( page1[19]==2 && (pBt->btsFlags & BTS_NO_WAL)==0 ){
  3041        int isOpen = 0;
  3042        rc = sqlite3PagerOpenWal(pBt->pPager, &isOpen);
  3043        if( rc!=SQLITE_OK ){
  3044          goto page1_init_failed;
  3045        }else{
  3046          setDefaultSyncFlag(pBt, SQLITE_DEFAULT_WAL_SYNCHRONOUS+1);
  3047          if( isOpen==0 ){
  3048            releasePageOne(pPage1);
  3049            return SQLITE_OK;
  3050          }
  3051        }
  3052        rc = SQLITE_NOTADB;
  3053      }else{
  3054        setDefaultSyncFlag(pBt, SQLITE_DEFAULT_SYNCHRONOUS+1);
  3055      }
  3056  #endif
  3057  
  3058      /* EVIDENCE-OF: R-15465-20813 The maximum and minimum embedded payload
  3059      ** fractions and the leaf payload fraction values must be 64, 32, and 32.
  3060      **
  3061      ** The original design allowed these amounts to vary, but as of
  3062      ** version 3.6.0, we require them to be fixed.
  3063      */
  3064      if( memcmp(&page1[21], "\100\040\040",3)!=0 ){
  3065        goto page1_init_failed;
  3066      }
  3067      /* EVIDENCE-OF: R-51873-39618 The page size for a database file is
  3068      ** determined by the 2-byte integer located at an offset of 16 bytes from
  3069      ** the beginning of the database file. */
  3070      pageSize = (page1[16]<<8) | (page1[17]<<16);
  3071      /* EVIDENCE-OF: R-25008-21688 The size of a page is a power of two
  3072      ** between 512 and 65536 inclusive. */
  3073      if( ((pageSize-1)&pageSize)!=0
  3074       || pageSize>SQLITE_MAX_PAGE_SIZE 
  3075       || pageSize<=256 
  3076      ){
  3077        goto page1_init_failed;
  3078      }
  3079      assert( (pageSize & 7)==0 );
  3080      /* EVIDENCE-OF: R-59310-51205 The "reserved space" size in the 1-byte
  3081      ** integer at offset 20 is the number of bytes of space at the end of
  3082      ** each page to reserve for extensions. 
  3083      **
  3084      ** EVIDENCE-OF: R-37497-42412 The size of the reserved region is
  3085      ** determined by the one-byte unsigned integer found at an offset of 20
  3086      ** into the database file header. */
  3087      usableSize = pageSize - page1[20];
  3088      if( (u32)pageSize!=pBt->pageSize ){
  3089        /* After reading the first page of the database assuming a page size
  3090        ** of BtShared.pageSize, we have discovered that the page-size is
  3091        ** actually pageSize. Unlock the database, leave pBt->pPage1 at
  3092        ** zero and return SQLITE_OK. The caller will call this function
  3093        ** again with the correct page-size.
  3094        */
  3095        releasePageOne(pPage1);
  3096        pBt->usableSize = usableSize;
  3097        pBt->pageSize = pageSize;
  3098        freeTempSpace(pBt);
  3099        rc = sqlite3PagerSetPagesize(pBt->pPager, &pBt->pageSize,
  3100                                     pageSize-usableSize);
  3101        return rc;
  3102      }
  3103      if( (pBt->db->flags & SQLITE_WriteSchema)==0 && nPage>nPageFile ){
  3104        rc = SQLITE_CORRUPT_BKPT;
  3105        goto page1_init_failed;
  3106      }
  3107      /* EVIDENCE-OF: R-28312-64704 However, the usable size is not allowed to
  3108      ** be less than 480. In other words, if the page size is 512, then the
  3109      ** reserved space size cannot exceed 32. */
  3110      if( usableSize<480 ){
  3111        goto page1_init_failed;
  3112      }
  3113      pBt->pageSize = pageSize;
  3114      pBt->usableSize = usableSize;
  3115  #ifndef SQLITE_OMIT_AUTOVACUUM
  3116      pBt->autoVacuum = (get4byte(&page1[36 + 4*4])?1:0);
  3117      pBt->incrVacuum = (get4byte(&page1[36 + 7*4])?1:0);
  3118  #endif
  3119    }
  3120  
  3121    /* maxLocal is the maximum amount of payload to store locally for
  3122    ** a cell.  Make sure it is small enough so that at least minFanout
  3123    ** cells can will fit on one page.  We assume a 10-byte page header.
  3124    ** Besides the payload, the cell must store:
  3125    **     2-byte pointer to the cell
  3126    **     4-byte child pointer
  3127    **     9-byte nKey value
  3128    **     4-byte nData value
  3129    **     4-byte overflow page pointer
  3130    ** So a cell consists of a 2-byte pointer, a header which is as much as
  3131    ** 17 bytes long, 0 to N bytes of payload, and an optional 4 byte overflow
  3132    ** page pointer.
  3133    */
  3134    pBt->maxLocal = (u16)((pBt->usableSize-12)*64/255 - 23);
  3135    pBt->minLocal = (u16)((pBt->usableSize-12)*32/255 - 23);
  3136    pBt->maxLeaf = (u16)(pBt->usableSize - 35);
  3137    pBt->minLeaf = (u16)((pBt->usableSize-12)*32/255 - 23);
  3138    if( pBt->maxLocal>127 ){
  3139      pBt->max1bytePayload = 127;
  3140    }else{
  3141      pBt->max1bytePayload = (u8)pBt->maxLocal;
  3142    }
  3143    assert( pBt->maxLeaf + 23 <= MX_CELL_SIZE(pBt) );
  3144    pBt->pPage1 = pPage1;
  3145    pBt->nPage = nPage;
  3146    return SQLITE_OK;
  3147  
  3148  page1_init_failed:
  3149    releasePageOne(pPage1);
  3150    pBt->pPage1 = 0;
  3151    return rc;
  3152  }
  3153  
  3154  #ifndef NDEBUG
  3155  /*
  3156  ** Return the number of cursors open on pBt. This is for use
  3157  ** in assert() expressions, so it is only compiled if NDEBUG is not
  3158  ** defined.
  3159  **
  3160  ** Only write cursors are counted if wrOnly is true.  If wrOnly is
  3161  ** false then all cursors are counted.
  3162  **
  3163  ** For the purposes of this routine, a cursor is any cursor that
  3164  ** is capable of reading or writing to the database.  Cursors that
  3165  ** have been tripped into the CURSOR_FAULT state are not counted.
  3166  */
  3167  static int countValidCursors(BtShared *pBt, int wrOnly){
  3168    BtCursor *pCur;
  3169    int r = 0;
  3170    for(pCur=pBt->pCursor; pCur; pCur=pCur->pNext){
  3171      if( (wrOnly==0 || (pCur->curFlags & BTCF_WriteFlag)!=0)
  3172       && pCur->eState!=CURSOR_FAULT ) r++; 
  3173    }
  3174    return r;
  3175  }
  3176  #endif
  3177  
  3178  /*
  3179  ** If there are no outstanding cursors and we are not in the middle
  3180  ** of a transaction but there is a read lock on the database, then
  3181  ** this routine unrefs the first page of the database file which 
  3182  ** has the effect of releasing the read lock.
  3183  **
  3184  ** If there is a transaction in progress, this routine is a no-op.
  3185  */
  3186  static void unlockBtreeIfUnused(BtShared *pBt){
  3187    assert( sqlite3_mutex_held(pBt->mutex) );
  3188    assert( countValidCursors(pBt,0)==0 || pBt->inTransaction>TRANS_NONE );
  3189    if( pBt->inTransaction==TRANS_NONE && pBt->pPage1!=0 ){
  3190      MemPage *pPage1 = pBt->pPage1;
  3191      assert( pPage1->aData );
  3192      assert( sqlite3PagerRefcount(pBt->pPager)==1 );
  3193      pBt->pPage1 = 0;
  3194      releasePageOne(pPage1);
  3195    }
  3196  }
  3197  
  3198  /*
  3199  ** If pBt points to an empty file then convert that empty file
  3200  ** into a new empty database by initializing the first page of
  3201  ** the database.
  3202  */
  3203  static int newDatabase(BtShared *pBt){
  3204    MemPage *pP1;
  3205    unsigned char *data;
  3206    int rc;
  3207  
  3208    assert( sqlite3_mutex_held(pBt->mutex) );
  3209    if( pBt->nPage>0 ){
  3210      return SQLITE_OK;
  3211    }
  3212    pP1 = pBt->pPage1;
  3213    assert( pP1!=0 );
  3214    data = pP1->aData;
  3215    rc = sqlite3PagerWrite(pP1->pDbPage);
  3216    if( rc ) return rc;
  3217    memcpy(data, zMagicHeader, sizeof(zMagicHeader));
  3218    assert( sizeof(zMagicHeader)==16 );
  3219    data[16] = (u8)((pBt->pageSize>>8)&0xff);
  3220    data[17] = (u8)((pBt->pageSize>>16)&0xff);
  3221    data[18] = 1;
  3222    data[19] = 1;
  3223    assert( pBt->usableSize<=pBt->pageSize && pBt->usableSize+255>=pBt->pageSize);
  3224    data[20] = (u8)(pBt->pageSize - pBt->usableSize);
  3225    data[21] = 64;
  3226    data[22] = 32;
  3227    data[23] = 32;
  3228    memset(&data[24], 0, 100-24);
  3229    zeroPage(pP1, PTF_INTKEY|PTF_LEAF|PTF_LEAFDATA );
  3230    pBt->btsFlags |= BTS_PAGESIZE_FIXED;
  3231  #ifndef SQLITE_OMIT_AUTOVACUUM
  3232    assert( pBt->autoVacuum==1 || pBt->autoVacuum==0 );
  3233    assert( pBt->incrVacuum==1 || pBt->incrVacuum==0 );
  3234    put4byte(&data[36 + 4*4], pBt->autoVacuum);
  3235    put4byte(&data[36 + 7*4], pBt->incrVacuum);
  3236  #endif
  3237    pBt->nPage = 1;
  3238    data[31] = 1;
  3239    return SQLITE_OK;
  3240  }
  3241  
  3242  /*
  3243  ** Initialize the first page of the database file (creating a database
  3244  ** consisting of a single page and no schema objects). Return SQLITE_OK
  3245  ** if successful, or an SQLite error code otherwise.
  3246  */
  3247  int sqlite3BtreeNewDb(Btree *p){
  3248    int rc;
  3249    sqlite3BtreeEnter(p);
  3250    p->pBt->nPage = 0;
  3251    rc = newDatabase(p->pBt);
  3252    sqlite3BtreeLeave(p);
  3253    return rc;
  3254  }
  3255  
  3256  /*
  3257  ** Attempt to start a new transaction. A write-transaction
  3258  ** is started if the second argument is nonzero, otherwise a read-
  3259  ** transaction.  If the second argument is 2 or more and exclusive
  3260  ** transaction is started, meaning that no other process is allowed
  3261  ** to access the database.  A preexisting transaction may not be
  3262  ** upgraded to exclusive by calling this routine a second time - the
  3263  ** exclusivity flag only works for a new transaction.
  3264  **
  3265  ** A write-transaction must be started before attempting any 
  3266  ** changes to the database.  None of the following routines 
  3267  ** will work unless a transaction is started first:
  3268  **
  3269  **      sqlite3BtreeCreateTable()
  3270  **      sqlite3BtreeCreateIndex()
  3271  **      sqlite3BtreeClearTable()
  3272  **      sqlite3BtreeDropTable()
  3273  **      sqlite3BtreeInsert()
  3274  **      sqlite3BtreeDelete()
  3275  **      sqlite3BtreeUpdateMeta()
  3276  **
  3277  ** If an initial attempt to acquire the lock fails because of lock contention
  3278  ** and the database was previously unlocked, then invoke the busy handler
  3279  ** if there is one.  But if there was previously a read-lock, do not
  3280  ** invoke the busy handler - just return SQLITE_BUSY.  SQLITE_BUSY is 
  3281  ** returned when there is already a read-lock in order to avoid a deadlock.
  3282  **
  3283  ** Suppose there are two processes A and B.  A has a read lock and B has
  3284  ** a reserved lock.  B tries to promote to exclusive but is blocked because
  3285  ** of A's read lock.  A tries to promote to reserved but is blocked by B.
  3286  ** One or the other of the two processes must give way or there can be
  3287  ** no progress.  By returning SQLITE_BUSY and not invoking the busy callback
  3288  ** when A already has a read lock, we encourage A to give up and let B
  3289  ** proceed.
  3290  */
  3291  int sqlite3BtreeBeginTrans(Btree *p, int wrflag){
  3292    BtShared *pBt = p->pBt;
  3293    int rc = SQLITE_OK;
  3294  
  3295    sqlite3BtreeEnter(p);
  3296    btreeIntegrity(p);
  3297  
  3298    /* If the btree is already in a write-transaction, or it
  3299    ** is already in a read-transaction and a read-transaction
  3300    ** is requested, this is a no-op.
  3301    */
  3302    if( p->inTrans==TRANS_WRITE || (p->inTrans==TRANS_READ && !wrflag) ){
  3303      goto trans_begun;
  3304    }
  3305    assert( pBt->inTransaction==TRANS_WRITE || IfNotOmitAV(pBt->bDoTruncate)==0 );
  3306  
  3307    /* Write transactions are not possible on a read-only database */
  3308    if( (pBt->btsFlags & BTS_READ_ONLY)!=0 && wrflag ){
  3309      rc = SQLITE_READONLY;
  3310      goto trans_begun;
  3311    }
  3312  
  3313  #ifndef SQLITE_OMIT_SHARED_CACHE
  3314    {
  3315      sqlite3 *pBlock = 0;
  3316      /* If another database handle has already opened a write transaction 
  3317      ** on this shared-btree structure and a second write transaction is
  3318      ** requested, return SQLITE_LOCKED.
  3319      */
  3320      if( (wrflag && pBt->inTransaction==TRANS_WRITE)
  3321       || (pBt->btsFlags & BTS_PENDING)!=0
  3322      ){
  3323        pBlock = pBt->pWriter->db;
  3324      }else if( wrflag>1 ){
  3325        BtLock *pIter;
  3326        for(pIter=pBt->pLock; pIter; pIter=pIter->pNext){
  3327          if( pIter->pBtree!=p ){
  3328            pBlock = pIter->pBtree->db;
  3329            break;
  3330          }
  3331        }
  3332      }
  3333      if( pBlock ){
  3334        sqlite3ConnectionBlocked(p->db, pBlock);
  3335        rc = SQLITE_LOCKED_SHAREDCACHE;
  3336        goto trans_begun;
  3337      }
  3338    }
  3339  #endif
  3340  
  3341    /* Any read-only or read-write transaction implies a read-lock on 
  3342    ** page 1. So if some other shared-cache client already has a write-lock 
  3343    ** on page 1, the transaction cannot be opened. */
  3344    rc = querySharedCacheTableLock(p, MASTER_ROOT, READ_LOCK);
  3345    if( SQLITE_OK!=rc ) goto trans_begun;
  3346  
  3347    pBt->btsFlags &= ~BTS_INITIALLY_EMPTY;
  3348    if( pBt->nPage==0 ) pBt->btsFlags |= BTS_INITIALLY_EMPTY;
  3349    do {
  3350      /* Call lockBtree() until either pBt->pPage1 is populated or
  3351      ** lockBtree() returns something other than SQLITE_OK. lockBtree()
  3352      ** may return SQLITE_OK but leave pBt->pPage1 set to 0 if after
  3353      ** reading page 1 it discovers that the page-size of the database 
  3354      ** file is not pBt->pageSize. In this case lockBtree() will update
  3355      ** pBt->pageSize to the page-size of the file on disk.
  3356      */
  3357      while( pBt->pPage1==0 && SQLITE_OK==(rc = lockBtree(pBt)) );
  3358  
  3359      if( rc==SQLITE_OK && wrflag ){
  3360        if( (pBt->btsFlags & BTS_READ_ONLY)!=0 ){
  3361          rc = SQLITE_READONLY;
  3362        }else{
  3363          rc = sqlite3PagerBegin(pBt->pPager,wrflag>1,sqlite3TempInMemory(p->db));
  3364          if( rc==SQLITE_OK ){
  3365            rc = newDatabase(pBt);
  3366          }
  3367        }
  3368      }
  3369    
  3370      if( rc!=SQLITE_OK ){
  3371        unlockBtreeIfUnused(pBt);
  3372      }
  3373    }while( (rc&0xFF)==SQLITE_BUSY && pBt->inTransaction==TRANS_NONE &&
  3374            btreeInvokeBusyHandler(pBt) );
  3375  
  3376    if( rc==SQLITE_OK ){
  3377      if( p->inTrans==TRANS_NONE ){
  3378        pBt->nTransaction++;
  3379  #ifndef SQLITE_OMIT_SHARED_CACHE
  3380        if( p->sharable ){
  3381          assert( p->lock.pBtree==p && p->lock.iTable==1 );
  3382          p->lock.eLock = READ_LOCK;
  3383          p->lock.pNext = pBt->pLock;
  3384          pBt->pLock = &p->lock;
  3385        }
  3386  #endif
  3387      }
  3388      p->inTrans = (wrflag?TRANS_WRITE:TRANS_READ);
  3389      if( p->inTrans>pBt->inTransaction ){
  3390        pBt->inTransaction = p->inTrans;
  3391      }
  3392      if( wrflag ){
  3393        MemPage *pPage1 = pBt->pPage1;
  3394  #ifndef SQLITE_OMIT_SHARED_CACHE
  3395        assert( !pBt->pWriter );
  3396        pBt->pWriter = p;
  3397        pBt->btsFlags &= ~BTS_EXCLUSIVE;
  3398        if( wrflag>1 ) pBt->btsFlags |= BTS_EXCLUSIVE;
  3399  #endif
  3400  
  3401        /* If the db-size header field is incorrect (as it may be if an old
  3402        ** client has been writing the database file), update it now. Doing
  3403        ** this sooner rather than later means the database size can safely 
  3404        ** re-read the database size from page 1 if a savepoint or transaction
  3405        ** rollback occurs within the transaction.
  3406        */
  3407        if( pBt->nPage!=get4byte(&pPage1->aData[28]) ){
  3408          rc = sqlite3PagerWrite(pPage1->pDbPage);
  3409          if( rc==SQLITE_OK ){
  3410            put4byte(&pPage1->aData[28], pBt->nPage);
  3411          }
  3412        }
  3413      }
  3414    }
  3415  
  3416  
  3417  trans_begun:
  3418    if( rc==SQLITE_OK && wrflag ){
  3419      /* This call makes sure that the pager has the correct number of
  3420      ** open savepoints. If the second parameter is greater than 0 and
  3421      ** the sub-journal is not already open, then it will be opened here.
  3422      */
  3423      rc = sqlite3PagerOpenSavepoint(pBt->pPager, p->db->nSavepoint);
  3424    }
  3425  
  3426    btreeIntegrity(p);
  3427    sqlite3BtreeLeave(p);
  3428    return rc;
  3429  }
  3430  
  3431  #ifndef SQLITE_OMIT_AUTOVACUUM
  3432  
  3433  /*
  3434  ** Set the pointer-map entries for all children of page pPage. Also, if
  3435  ** pPage contains cells that point to overflow pages, set the pointer
  3436  ** map entries for the overflow pages as well.
  3437  */
  3438  static int setChildPtrmaps(MemPage *pPage){
  3439    int i;                             /* Counter variable */
  3440    int nCell;                         /* Number of cells in page pPage */
  3441    int rc;                            /* Return code */
  3442    BtShared *pBt = pPage->pBt;
  3443    Pgno pgno = pPage->pgno;
  3444  
  3445    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  3446    rc = pPage->isInit ? SQLITE_OK : btreeInitPage(pPage);
  3447    if( rc!=SQLITE_OK ) return rc;
  3448    nCell = pPage->nCell;
  3449  
  3450    for(i=0; i<nCell; i++){
  3451      u8 *pCell = findCell(pPage, i);
  3452  
  3453      ptrmapPutOvflPtr(pPage, pCell, &rc);
  3454  
  3455      if( !pPage->leaf ){
  3456        Pgno childPgno = get4byte(pCell);
  3457        ptrmapPut(pBt, childPgno, PTRMAP_BTREE, pgno, &rc);
  3458      }
  3459    }
  3460  
  3461    if( !pPage->leaf ){
  3462      Pgno childPgno = get4byte(&pPage->aData[pPage->hdrOffset+8]);
  3463      ptrmapPut(pBt, childPgno, PTRMAP_BTREE, pgno, &rc);
  3464    }
  3465  
  3466    return rc;
  3467  }
  3468  
  3469  /*
  3470  ** Somewhere on pPage is a pointer to page iFrom.  Modify this pointer so
  3471  ** that it points to iTo. Parameter eType describes the type of pointer to
  3472  ** be modified, as  follows:
  3473  **
  3474  ** PTRMAP_BTREE:     pPage is a btree-page. The pointer points at a child 
  3475  **                   page of pPage.
  3476  **
  3477  ** PTRMAP_OVERFLOW1: pPage is a btree-page. The pointer points at an overflow
  3478  **                   page pointed to by one of the cells on pPage.
  3479  **
  3480  ** PTRMAP_OVERFLOW2: pPage is an overflow-page. The pointer points at the next
  3481  **                   overflow page in the list.
  3482  */
  3483  static int modifyPagePointer(MemPage *pPage, Pgno iFrom, Pgno iTo, u8 eType){
  3484    assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  3485    assert( sqlite3PagerIswriteable(pPage->pDbPage) );
  3486    if( eType==PTRMAP_OVERFLOW2 ){
  3487      /* The pointer is always the first 4 bytes of the page in this case.  */
  3488      if( get4byte(pPage->aData)!=iFrom ){
  3489        return SQLITE_CORRUPT_PAGE(pPage);
  3490      }
  3491      put4byte(pPage->aData, iTo);
  3492    }else{
  3493      int i;
  3494      int nCell;
  3495      int rc;
  3496  
  3497      rc = pPage->isInit ? SQLITE_OK : btreeInitPage(pPage);
  3498      if( rc ) return rc;
  3499      nCell = pPage->nCell;
  3500  
  3501      for(i=0; i<nCell; i++){
  3502        u8 *pCell = findCell(pPage, i);
  3503        if( eType==PTRMAP_OVERFLOW1 ){
  3504          CellInfo info;
  3505          pPage->xParseCell(pPage, pCell, &info);
  3506          if( info.nLocal<info.nPayload ){
  3507            if( pCell+info.nSize > pPage->aData+pPage->pBt->usableSize ){
  3508              return SQLITE_CORRUPT_PAGE(pPage);
  3509            }
  3510            if( iFrom==get4byte(pCell+info.nSize-4) ){
  3511              put4byte(pCell+info.nSize-4, iTo);
  3512              break;
  3513            }
  3514          }
  3515        }else{
  3516          if( get4byte(pCell)==iFrom ){
  3517            put4byte(pCell, iTo);
  3518            break;
  3519          }
  3520        }
  3521      }
  3522    
  3523      if( i==nCell ){
  3524        if( eType!=PTRMAP_BTREE || 
  3525            get4byte(&pPage->aData[pPage->hdrOffset+8])!=iFrom ){
  3526          return SQLITE_CORRUPT_PAGE(pPage);
  3527        }
  3528        put4byte(&pPage->aData[pPage->hdrOffset+8], iTo);
  3529      }
  3530    }
  3531    return SQLITE_OK;
  3532  }
  3533  
  3534  
  3535  /*
  3536  ** Move the open database page pDbPage to location iFreePage in the 
  3537  ** database. The pDbPage reference remains valid.
  3538  **
  3539  ** The isCommit flag indicates that there is no need to remember that
  3540  ** the journal needs to be sync()ed before database page pDbPage->pgno 
  3541  ** can be written to. The caller has already promised not to write to that
  3542  ** page.
  3543  */
  3544  static int relocatePage(
  3545    BtShared *pBt,           /* Btree */
  3546    MemPage *pDbPage,        /* Open page to move */
  3547    u8 eType,                /* Pointer map 'type' entry for pDbPage */
  3548    Pgno iPtrPage,           /* Pointer map 'page-no' entry for pDbPage */
  3549    Pgno iFreePage,          /* The location to move pDbPage to */
  3550    int isCommit             /* isCommit flag passed to sqlite3PagerMovepage */
  3551  ){
  3552    MemPage *pPtrPage;   /* The page that contains a pointer to pDbPage */
  3553    Pgno iDbPage = pDbPage->pgno;
  3554    Pager *pPager = pBt->pPager;
  3555    int rc;
  3556  
  3557    assert( eType==PTRMAP_OVERFLOW2 || eType==PTRMAP_OVERFLOW1 || 
  3558        eType==PTRMAP_BTREE || eType==PTRMAP_ROOTPAGE );
  3559    assert( sqlite3_mutex_held(pBt->mutex) );
  3560    assert( pDbPage->pBt==pBt );
  3561  
  3562    /* Move page iDbPage from its current location to page number iFreePage */
  3563    TRACE(("AUTOVACUUM: Moving %d to free page %d (ptr page %d type %d)\n", 
  3564        iDbPage, iFreePage, iPtrPage, eType));
  3565    rc = sqlite3PagerMovepage(pPager, pDbPage->pDbPage, iFreePage, isCommit);
  3566    if( rc!=SQLITE_OK ){
  3567      return rc;
  3568    }
  3569    pDbPage->pgno = iFreePage;
  3570  
  3571    /* If pDbPage was a btree-page, then it may have child pages and/or cells
  3572    ** that point to overflow pages. The pointer map entries for all these
  3573    ** pages need to be changed.
  3574    **
  3575    ** If pDbPage is an overflow page, then the first 4 bytes may store a
  3576    ** pointer to a subsequent overflow page. If this is the case, then
  3577    ** the pointer map needs to be updated for the subsequent overflow page.
  3578    */
  3579    if( eType==PTRMAP_BTREE || eType==PTRMAP_ROOTPAGE ){
  3580      rc = setChildPtrmaps(pDbPage);
  3581      if( rc!=SQLITE_OK ){
  3582        return rc;
  3583      }
  3584    }else{
  3585      Pgno nextOvfl = get4byte(pDbPage->aData);
  3586      if( nextOvfl!=0 ){
  3587        ptrmapPut(pBt, nextOvfl, PTRMAP_OVERFLOW2, iFreePage, &rc);
  3588        if( rc!=SQLITE_OK ){
  3589          return rc;
  3590        }
  3591      }
  3592    }
  3593  
  3594    /* Fix the database pointer on page iPtrPage that pointed at iDbPage so
  3595    ** that it points at iFreePage. Also fix the pointer map entry for
  3596    ** iPtrPage.
  3597    */
  3598    if( eType!=PTRMAP_ROOTPAGE ){
  3599      rc = btreeGetPage(pBt, iPtrPage, &pPtrPage, 0);
  3600      if( rc!=SQLITE_OK ){
  3601        return rc;
  3602      }
  3603      rc = sqlite3PagerWrite(pPtrPage->pDbPage);
  3604      if( rc!=SQLITE_OK ){
  3605        releasePage(pPtrPage);
  3606        return rc;
  3607      }
  3608      rc = modifyPagePointer(pPtrPage, iDbPage, iFreePage, eType);
  3609      releasePage(pPtrPage);
  3610      if( rc==SQLITE_OK ){
  3611        ptrmapPut(pBt, iFreePage, eType, iPtrPage, &rc);
  3612      }
  3613    }
  3614    return rc;
  3615  }
  3616  
  3617  /* Forward declaration required by incrVacuumStep(). */
  3618  static int allocateBtreePage(BtShared *, MemPage **, Pgno *, Pgno, u8);
  3619  
  3620  /*
  3621  ** Perform a single step of an incremental-vacuum. If successful, return
  3622  ** SQLITE_OK. If there is no work to do (and therefore no point in 
  3623  ** calling this function again), return SQLITE_DONE. Or, if an error 
  3624  ** occurs, return some other error code.
  3625  **
  3626  ** More specifically, this function attempts to re-organize the database so 
  3627  ** that the last page of the file currently in use is no longer in use.
  3628  **
  3629  ** Parameter nFin is the number of pages that this database would contain
  3630  ** were this function called until it returns SQLITE_DONE.
  3631  **
  3632  ** If the bCommit parameter is non-zero, this function assumes that the 
  3633  ** caller will keep calling incrVacuumStep() until it returns SQLITE_DONE 
  3634  ** or an error. bCommit is passed true for an auto-vacuum-on-commit 
  3635  ** operation, or false for an incremental vacuum.
  3636  */
  3637  static int incrVacuumStep(BtShared *pBt, Pgno nFin, Pgno iLastPg, int bCommit){
  3638    Pgno nFreeList;           /* Number of pages still on the free-list */
  3639    int rc;
  3640  
  3641    assert( sqlite3_mutex_held(pBt->mutex) );
  3642    assert( iLastPg>nFin );
  3643  
  3644    if( !PTRMAP_ISPAGE(pBt, iLastPg) && iLastPg!=PENDING_BYTE_PAGE(pBt) ){
  3645      u8 eType;
  3646      Pgno iPtrPage;
  3647  
  3648      nFreeList = get4byte(&pBt->pPage1->aData[36]);
  3649      if( nFreeList==0 ){
  3650        return SQLITE_DONE;
  3651      }
  3652  
  3653      rc = ptrmapGet(pBt, iLastPg, &eType, &iPtrPage);
  3654      if( rc!=SQLITE_OK ){
  3655        return rc;
  3656      }
  3657      if( eType==PTRMAP_ROOTPAGE ){
  3658        return SQLITE_CORRUPT_BKPT;
  3659      }
  3660  
  3661      if( eType==PTRMAP_FREEPAGE ){
  3662        if( bCommit==0 ){
  3663          /* Remove the page from the files free-list. This is not required
  3664          ** if bCommit is non-zero. In that case, the free-list will be
  3665          ** truncated to zero after this function returns, so it doesn't 
  3666          ** matter if it still contains some garbage entries.
  3667          */
  3668          Pgno iFreePg;
  3669          MemPage *pFreePg;
  3670          rc = allocateBtreePage(pBt, &pFreePg, &iFreePg, iLastPg, BTALLOC_EXACT);
  3671          if( rc!=SQLITE_OK ){
  3672            return rc;
  3673          }
  3674          assert( iFreePg==iLastPg );
  3675          releasePage(pFreePg);
  3676        }
  3677      } else {
  3678        Pgno iFreePg;             /* Index of free page to move pLastPg to */
  3679        MemPage *pLastPg;
  3680        u8 eMode = BTALLOC_ANY;   /* Mode parameter for allocateBtreePage() */
  3681        Pgno iNear = 0;           /* nearby parameter for allocateBtreePage() */
  3682  
  3683        rc = btreeGetPage(pBt, iLastPg, &pLastPg, 0);
  3684        if( rc!=SQLITE_OK ){
  3685          return rc;
  3686        }
  3687  
  3688        /* If bCommit is zero, this loop runs exactly once and page pLastPg
  3689        ** is swapped with the first free page pulled off the free list.
  3690        **
  3691        ** On the other hand, if bCommit is greater than zero, then keep
  3692        ** looping until a free-page located within the first nFin pages
  3693        ** of the file is found.
  3694        */
  3695        if( bCommit==0 ){
  3696          eMode = BTALLOC_LE;
  3697          iNear = nFin;
  3698        }
  3699        do {
  3700          MemPage *pFreePg;
  3701          rc = allocateBtreePage(pBt, &pFreePg, &iFreePg, iNear, eMode);
  3702          if( rc!=SQLITE_OK ){
  3703            releasePage(pLastPg);
  3704            return rc;
  3705          }
  3706          releasePage(pFreePg);
  3707        }while( bCommit && iFreePg>nFin );
  3708        assert( iFreePg<iLastPg );
  3709        
  3710        rc = relocatePage(pBt, pLastPg, eType, iPtrPage, iFreePg, bCommit);
  3711        releasePage(pLastPg);
  3712        if( rc!=SQLITE_OK ){
  3713          return rc;
  3714        }
  3715      }
  3716    }
  3717  
  3718    if( bCommit==0 ){
  3719      do {
  3720        iLastPg--;
  3721      }while( iLastPg==PENDING_BYTE_PAGE(pBt) || PTRMAP_ISPAGE(pBt, iLastPg) );
  3722      pBt->bDoTruncate = 1;
  3723      pBt->nPage = iLastPg;
  3724    }
  3725    return SQLITE_OK;
  3726  }
  3727  
  3728  /*
  3729  ** The database opened by the first argument is an auto-vacuum database
  3730  ** nOrig pages in size containing nFree free pages. Return the expected 
  3731  ** size of the database in pages following an auto-vacuum operation.
  3732  */
  3733  static Pgno finalDbSize(BtShared *pBt, Pgno nOrig, Pgno nFree){
  3734    int nEntry;                     /* Number of entries on one ptrmap page */
  3735    Pgno nPtrmap;                   /* Number of PtrMap pages to be freed */
  3736    Pgno nFin;                      /* Return value */
  3737  
  3738    nEntry = pBt->usableSize/5;
  3739    nPtrmap = (nFree-nOrig+PTRMAP_PAGENO(pBt, nOrig)+nEntry)/nEntry;
  3740    nFin = nOrig - nFree - nPtrmap;
  3741    if( nOrig>PENDING_BYTE_PAGE(pBt) && nFin<PENDING_BYTE_PAGE(pBt) ){
  3742      nFin--;
  3743    }
  3744    while( PTRMAP_ISPAGE(pBt, nFin) || nFin==PENDING_BYTE_PAGE(pBt) ){
  3745      nFin--;
  3746    }
  3747  
  3748    return nFin;
  3749  }
  3750  
  3751  /*
  3752  ** A write-transaction must be opened before calling this function.
  3753  ** It performs a single unit of work towards an incremental vacuum.
  3754  **
  3755  ** If the incremental vacuum is finished after this function has run,
  3756  ** SQLITE_DONE is returned. If it is not finished, but no error occurred,
  3757  ** SQLITE_OK is returned. Otherwise an SQLite error code. 
  3758  */
  3759  int sqlite3BtreeIncrVacuum(Btree *p){
  3760    int rc;
  3761    BtShared *pBt = p->pBt;
  3762  
  3763    sqlite3BtreeEnter(p);
  3764    assert( pBt->inTransaction==TRANS_WRITE && p->inTrans==TRANS_WRITE );
  3765    if( !pBt->autoVacuum ){
  3766      rc = SQLITE_DONE;
  3767    }else{
  3768      Pgno nOrig = btreePagecount(pBt);
  3769      Pgno nFree = get4byte(&pBt->pPage1->aData[36]);
  3770      Pgno nFin = finalDbSize(pBt, nOrig, nFree);
  3771  
  3772      if( nOrig<nFin ){
  3773        rc = SQLITE_CORRUPT_BKPT;
  3774      }else if( nFree>0 ){
  3775        rc = saveAllCursors(pBt, 0, 0);
  3776        if( rc==SQLITE_OK ){
  3777          invalidateAllOverflowCache(pBt);
  3778          rc = incrVacuumStep(pBt, nFin, nOrig, 0);
  3779        }
  3780        if( rc==SQLITE_OK ){
  3781          rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
  3782          put4byte(&pBt->pPage1->aData[28], pBt->nPage);
  3783        }
  3784      }else{
  3785        rc = SQLITE_DONE;
  3786      }
  3787    }
  3788    sqlite3BtreeLeave(p);
  3789    return rc;
  3790  }
  3791  
  3792  /*
  3793  ** This routine is called prior to sqlite3PagerCommit when a transaction
  3794  ** is committed for an auto-vacuum database.
  3795  **
  3796  ** If SQLITE_OK is returned, then *pnTrunc is set to the number of pages
  3797  ** the database file should be truncated to during the commit process. 
  3798  ** i.e. the database has been reorganized so that only the first *pnTrunc
  3799  ** pages are in use.
  3800  */
  3801  static int autoVacuumCommit(BtShared *pBt){
  3802    int rc = SQLITE_OK;
  3803    Pager *pPager = pBt->pPager;
  3804    VVA_ONLY( int nRef = sqlite3PagerRefcount(pPager); )
  3805  
  3806    assert( sqlite3_mutex_held(pBt->mutex) );
  3807    invalidateAllOverflowCache(pBt);
  3808    assert(pBt->autoVacuum);
  3809    if( !pBt->incrVacuum ){
  3810      Pgno nFin;         /* Number of pages in database after autovacuuming */
  3811      Pgno nFree;        /* Number of pages on the freelist initially */
  3812      Pgno iFree;        /* The next page to be freed */
  3813      Pgno nOrig;        /* Database size before freeing */
  3814  
  3815      nOrig = btreePagecount(pBt);
  3816      if( PTRMAP_ISPAGE(pBt, nOrig) || nOrig==PENDING_BYTE_PAGE(pBt) ){
  3817        /* It is not possible to create a database for which the final page
  3818        ** is either a pointer-map page or the pending-byte page. If one
  3819        ** is encountered, this indicates corruption.
  3820        */
  3821        return SQLITE_CORRUPT_BKPT;
  3822      }
  3823  
  3824      nFree = get4byte(&pBt->pPage1->aData[36]);
  3825      nFin = finalDbSize(pBt, nOrig, nFree);
  3826      if( nFin>nOrig ) return SQLITE_CORRUPT_BKPT;
  3827      if( nFin<nOrig ){
  3828        rc = saveAllCursors(pBt, 0, 0);
  3829      }
  3830      for(iFree=nOrig; iFree>nFin && rc==SQLITE_OK; iFree--){
  3831        rc = incrVacuumStep(pBt, nFin, iFree, 1);
  3832      }
  3833      if( (rc==SQLITE_DONE || rc==SQLITE_OK) && nFree>0 ){
  3834        rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
  3835        put4byte(&pBt->pPage1->aData[32], 0);
  3836        put4byte(&pBt->pPage1->aData[36], 0);
  3837        put4byte(&pBt->pPage1->aData[28], nFin);
  3838        pBt->bDoTruncate = 1;
  3839        pBt->nPage = nFin;
  3840      }
  3841      if( rc!=SQLITE_OK ){
  3842        sqlite3PagerRollback(pPager);
  3843      }
  3844    }
  3845  
  3846    assert( nRef>=sqlite3PagerRefcount(pPager) );
  3847    return rc;
  3848  }
  3849  
  3850  #else /* ifndef SQLITE_OMIT_AUTOVACUUM */
  3851  # define setChildPtrmaps(x) SQLITE_OK
  3852  #endif
  3853  
  3854  /*
  3855  ** This routine does the first phase of a two-phase commit.  This routine
  3856  ** causes a rollback journal to be created (if it does not already exist)
  3857  ** and populated with enough information so that if a power loss occurs
  3858  ** the database can be restored to its original state by playing back
  3859  ** the journal.  Then the contents of the journal are flushed out to
  3860  ** the disk.  After the journal is safely on oxide, the changes to the
  3861  ** database are written into the database file and flushed to oxide.
  3862  ** At the end of this call, the rollback journal still exists on the
  3863  ** disk and we are still holding all locks, so the transaction has not
  3864  ** committed.  See sqlite3BtreeCommitPhaseTwo() for the second phase of the
  3865  ** commit process.
  3866  **
  3867  ** This call is a no-op if no write-transaction is currently active on pBt.
  3868  **
  3869  ** Otherwise, sync the database file for the btree pBt. zMaster points to
  3870  ** the name of a master journal file that should be written into the
  3871  ** individual journal file, or is NULL, indicating no master journal file 
  3872  ** (single database transaction).
  3873  **
  3874  ** When this is called, the master journal should already have been
  3875  ** created, populated with this journal pointer and synced to disk.
  3876  **
  3877  ** Once this is routine has returned, the only thing required to commit
  3878  ** the write-transaction for this database file is to delete the journal.
  3879  */
  3880  int sqlite3BtreeCommitPhaseOne(Btree *p, const char *zMaster){
  3881    int rc = SQLITE_OK;
  3882    if( p->inTrans==TRANS_WRITE ){
  3883      BtShared *pBt = p->pBt;
  3884      sqlite3BtreeEnter(p);
  3885  #ifndef SQLITE_OMIT_AUTOVACUUM
  3886      if( pBt->autoVacuum ){
  3887        rc = autoVacuumCommit(pBt);
  3888        if( rc!=SQLITE_OK ){
  3889          sqlite3BtreeLeave(p);
  3890          return rc;
  3891        }
  3892      }
  3893      if( pBt->bDoTruncate ){
  3894        sqlite3PagerTruncateImage(pBt->pPager, pBt->nPage);
  3895      }
  3896  #endif
  3897      rc = sqlite3PagerCommitPhaseOne(pBt->pPager, zMaster, 0);
  3898      sqlite3BtreeLeave(p);
  3899    }
  3900    return rc;
  3901  }
  3902  
  3903  /*
  3904  ** This function is called from both BtreeCommitPhaseTwo() and BtreeRollback()
  3905  ** at the conclusion of a transaction.
  3906  */
  3907  static void btreeEndTransaction(Btree *p){
  3908    BtShared *pBt = p->pBt;
  3909    sqlite3 *db = p->db;
  3910    assert( sqlite3BtreeHoldsMutex(p) );
  3911  
  3912  #ifndef SQLITE_OMIT_AUTOVACUUM
  3913    pBt->bDoTruncate = 0;
  3914  #endif
  3915    if( p->inTrans>TRANS_NONE && db->nVdbeRead>1 ){
  3916      /* If there are other active statements that belong to this database
  3917      ** handle, downgrade to a read-only transaction. The other statements
  3918      ** may still be reading from the database.  */
  3919      downgradeAllSharedCacheTableLocks(p);
  3920      p->inTrans = TRANS_READ;
  3921    }else{
  3922      /* If the handle had any kind of transaction open, decrement the 
  3923      ** transaction count of the shared btree. If the transaction count 
  3924      ** reaches 0, set the shared state to TRANS_NONE. The unlockBtreeIfUnused()
  3925      ** call below will unlock the pager.  */
  3926      if( p->inTrans!=TRANS_NONE ){
  3927        clearAllSharedCacheTableLocks(p);
  3928        pBt->nTransaction--;
  3929        if( 0==pBt->nTransaction ){
  3930          pBt->inTransaction = TRANS_NONE;
  3931        }
  3932      }
  3933  
  3934      /* Set the current transaction state to TRANS_NONE and unlock the 
  3935      ** pager if this call closed the only read or write transaction.  */
  3936      p->inTrans = TRANS_NONE;
  3937      unlockBtreeIfUnused(pBt);
  3938    }
  3939  
  3940    btreeIntegrity(p);
  3941  }
  3942  
  3943  /*
  3944  ** Commit the transaction currently in progress.
  3945  **
  3946  ** This routine implements the second phase of a 2-phase commit.  The
  3947  ** sqlite3BtreeCommitPhaseOne() routine does the first phase and should
  3948  ** be invoked prior to calling this routine.  The sqlite3BtreeCommitPhaseOne()
  3949  ** routine did all the work of writing information out to disk and flushing the
  3950  ** contents so that they are written onto the disk platter.  All this
  3951  ** routine has to do is delete or truncate or zero the header in the
  3952  ** the rollback journal (which causes the transaction to commit) and
  3953  ** drop locks.
  3954  **
  3955  ** Normally, if an error occurs while the pager layer is attempting to 
  3956  ** finalize the underlying journal file, this function returns an error and
  3957  ** the upper layer will attempt a rollback. However, if the second argument
  3958  ** is non-zero then this b-tree transaction is part of a multi-file 
  3959  ** transaction. In this case, the transaction has already been committed 
  3960  ** (by deleting a master journal file) and the caller will ignore this 
  3961  ** functions return code. So, even if an error occurs in the pager layer,
  3962  ** reset the b-tree objects internal state to indicate that the write
  3963  ** transaction has been closed. This is quite safe, as the pager will have
  3964  ** transitioned to the error state.
  3965  **
  3966  ** This will release the write lock on the database file.  If there
  3967  ** are no active cursors, it also releases the read lock.
  3968  */
  3969  int sqlite3BtreeCommitPhaseTwo(Btree *p, int bCleanup){
  3970  
  3971    if( p->inTrans==TRANS_NONE ) return SQLITE_OK;
  3972    sqlite3BtreeEnter(p);
  3973    btreeIntegrity(p);
  3974  
  3975    /* If the handle has a write-transaction open, commit the shared-btrees 
  3976    ** transaction and set the shared state to TRANS_READ.
  3977    */
  3978    if( p->inTrans==TRANS_WRITE ){
  3979      int rc;
  3980      BtShared *pBt = p->pBt;
  3981      assert( pBt->inTransaction==TRANS_WRITE );
  3982      assert( pBt->nTransaction>0 );
  3983      rc = sqlite3PagerCommitPhaseTwo(pBt->pPager);
  3984      if( rc!=SQLITE_OK && bCleanup==0 ){
  3985        sqlite3BtreeLeave(p);
  3986        return rc;
  3987      }
  3988      p->iDataVersion--;  /* Compensate for pPager->iDataVersion++; */
  3989      pBt->inTransaction = TRANS_READ;
  3990      btreeClearHasContent(pBt);
  3991    }
  3992  
  3993    btreeEndTransaction(p);
  3994    sqlite3BtreeLeave(p);
  3995    return SQLITE_OK;
  3996  }
  3997  
  3998  /*
  3999  ** Do both phases of a commit.
  4000  */
  4001  int sqlite3BtreeCommit(Btree *p){
  4002    int rc;
  4003    sqlite3BtreeEnter(p);
  4004    rc = sqlite3BtreeCommitPhaseOne(p, 0);
  4005    if( rc==SQLITE_OK ){
  4006      rc = sqlite3BtreeCommitPhaseTwo(p, 0);
  4007    }
  4008    sqlite3BtreeLeave(p);
  4009    return rc;
  4010  }
  4011  
  4012  /*
  4013  ** This routine sets the state to CURSOR_FAULT and the error
  4014  ** code to errCode for every cursor on any BtShared that pBtree
  4015  ** references.  Or if the writeOnly flag is set to 1, then only
  4016  ** trip write cursors and leave read cursors unchanged.
  4017  **
  4018  ** Every cursor is a candidate to be tripped, including cursors
  4019  ** that belong to other database connections that happen to be
  4020  ** sharing the cache with pBtree.
  4021  **
  4022  ** This routine gets called when a rollback occurs. If the writeOnly
  4023  ** flag is true, then only write-cursors need be tripped - read-only
  4024  ** cursors save their current positions so that they may continue 
  4025  ** following the rollback. Or, if writeOnly is false, all cursors are 
  4026  ** tripped. In general, writeOnly is false if the transaction being
  4027  ** rolled back modified the database schema. In this case b-tree root
  4028  ** pages may be moved or deleted from the database altogether, making
  4029  ** it unsafe for read cursors to continue.
  4030  **
  4031  ** If the writeOnly flag is true and an error is encountered while 
  4032  ** saving the current position of a read-only cursor, all cursors, 
  4033  ** including all read-cursors are tripped.
  4034  **
  4035  ** SQLITE_OK is returned if successful, or if an error occurs while
  4036  ** saving a cursor position, an SQLite error code.
  4037  */
  4038  int sqlite3BtreeTripAllCursors(Btree *pBtree, int errCode, int writeOnly){
  4039    BtCursor *p;
  4040    int rc = SQLITE_OK;
  4041  
  4042    assert( (writeOnly==0 || writeOnly==1) && BTCF_WriteFlag==1 );
  4043    if( pBtree ){
  4044      sqlite3BtreeEnter(pBtree);
  4045      for(p=pBtree->pBt->pCursor; p; p=p->pNext){
  4046        if( writeOnly && (p->curFlags & BTCF_WriteFlag)==0 ){
  4047          if( p->eState==CURSOR_VALID || p->eState==CURSOR_SKIPNEXT ){
  4048            rc = saveCursorPosition(p);
  4049            if( rc!=SQLITE_OK ){
  4050              (void)sqlite3BtreeTripAllCursors(pBtree, rc, 0);
  4051              break;
  4052            }
  4053          }
  4054        }else{
  4055          sqlite3BtreeClearCursor(p);
  4056          p->eState = CURSOR_FAULT;
  4057          p->skipNext = errCode;
  4058        }
  4059        btreeReleaseAllCursorPages(p);
  4060      }
  4061      sqlite3BtreeLeave(pBtree);
  4062    }
  4063    return rc;
  4064  }
  4065  
  4066  /*
  4067  ** Rollback the transaction in progress.
  4068  **
  4069  ** If tripCode is not SQLITE_OK then cursors will be invalidated (tripped).
  4070  ** Only write cursors are tripped if writeOnly is true but all cursors are
  4071  ** tripped if writeOnly is false.  Any attempt to use
  4072  ** a tripped cursor will result in an error.
  4073  **
  4074  ** This will release the write lock on the database file.  If there
  4075  ** are no active cursors, it also releases the read lock.
  4076  */
  4077  int sqlite3BtreeRollback(Btree *p, int tripCode, int writeOnly){
  4078    int rc;
  4079    BtShared *pBt = p->pBt;
  4080    MemPage *pPage1;
  4081  
  4082    assert( writeOnly==1 || writeOnly==0 );
  4083    assert( tripCode==SQLITE_ABORT_ROLLBACK || tripCode==SQLITE_OK );
  4084    sqlite3BtreeEnter(p);
  4085    if( tripCode==SQLITE_OK ){
  4086      rc = tripCode = saveAllCursors(pBt, 0, 0);
  4087      if( rc ) writeOnly = 0;
  4088    }else{
  4089      rc = SQLITE_OK;
  4090    }
  4091    if( tripCode ){
  4092      int rc2 = sqlite3BtreeTripAllCursors(p, tripCode, writeOnly);
  4093      assert( rc==SQLITE_OK || (writeOnly==0 && rc2==SQLITE_OK) );
  4094      if( rc2!=SQLITE_OK ) rc = rc2;
  4095    }
  4096    btreeIntegrity(p);
  4097  
  4098    if( p->inTrans==TRANS_WRITE ){
  4099      int rc2;
  4100  
  4101      assert( TRANS_WRITE==pBt->inTransaction );
  4102      rc2 = sqlite3PagerRollback(pBt->pPager);
  4103      if( rc2!=SQLITE_OK ){
  4104        rc = rc2;
  4105      }
  4106  
  4107      /* The rollback may have destroyed the pPage1->aData value.  So
  4108      ** call btreeGetPage() on page 1 again to make
  4109      ** sure pPage1->aData is set correctly. */
  4110      if( btreeGetPage(pBt, 1, &pPage1, 0)==SQLITE_OK ){
  4111        int nPage = get4byte(28+(u8*)pPage1->aData);
  4112        testcase( nPage==0 );
  4113        if( nPage==0 ) sqlite3PagerPagecount(pBt->pPager, &nPage);
  4114        testcase( pBt->nPage!=nPage );
  4115        pBt->nPage = nPage;
  4116        releasePageOne(pPage1);
  4117      }
  4118      assert( countValidCursors(pBt, 1)==0 );
  4119      pBt->inTransaction = TRANS_READ;
  4120      btreeClearHasContent(pBt);
  4121    }
  4122  
  4123    btreeEndTransaction(p);
  4124    sqlite3BtreeLeave(p);
  4125    return rc;
  4126  }
  4127  
  4128  /*
  4129  ** Start a statement subtransaction. The subtransaction can be rolled
  4130  ** back independently of the main transaction. You must start a transaction 
  4131  ** before starting a subtransaction. The subtransaction is ended automatically 
  4132  ** if the main transaction commits or rolls back.
  4133  **
  4134  ** Statement subtransactions are used around individual SQL statements
  4135  ** that are contained within a BEGIN...COMMIT block.  If a constraint
  4136  ** error occurs within the statement, the effect of that one statement
  4137  ** can be rolled back without having to rollback the entire transaction.
  4138  **
  4139  ** A statement sub-transaction is implemented as an anonymous savepoint. The
  4140  ** value passed as the second parameter is the total number of savepoints,
  4141  ** including the new anonymous savepoint, open on the B-Tree. i.e. if there
  4142  ** are no active savepoints and no other statement-transactions open,
  4143  ** iStatement is 1. This anonymous savepoint can be released or rolled back
  4144  ** using the sqlite3BtreeSavepoint() function.
  4145  */
  4146  int sqlite3BtreeBeginStmt(Btree *p, int iStatement){
  4147    int rc;
  4148    BtShared *pBt = p->pBt;
  4149    sqlite3BtreeEnter(p);
  4150    assert( p->inTrans==TRANS_WRITE );
  4151    assert( (pBt->btsFlags & BTS_READ_ONLY)==0 );
  4152    assert( iStatement>0 );
  4153    assert( iStatement>p->db->nSavepoint );
  4154    assert( pBt->inTransaction==TRANS_WRITE );
  4155    /* At the pager level, a statement transaction is a savepoint with
  4156    ** an index greater than all savepoints created explicitly using
  4157    ** SQL statements. It is illegal to open, release or rollback any
  4158    ** such savepoints while the statement transaction savepoint is active.
  4159    */
  4160    rc = sqlite3PagerOpenSavepoint(pBt->pPager, iStatement);
  4161    sqlite3BtreeLeave(p);
  4162    return rc;
  4163  }
  4164  
  4165  /*
  4166  ** The second argument to this function, op, is always SAVEPOINT_ROLLBACK
  4167  ** or SAVEPOINT_RELEASE. This function either releases or rolls back the
  4168  ** savepoint identified by parameter iSavepoint, depending on the value 
  4169  ** of op.
  4170  **
  4171  ** Normally, iSavepoint is greater than or equal to zero. However, if op is
  4172  ** SAVEPOINT_ROLLBACK, then iSavepoint may also be -1. In this case the 
  4173  ** contents of the entire transaction are rolled back. This is different
  4174  ** from a normal transaction rollback, as no locks are released and the
  4175  ** transaction remains open.
  4176  */
  4177  int sqlite3BtreeSavepoint(Btree *p, int op, int iSavepoint){
  4178    int rc = SQLITE_OK;
  4179    if( p && p->inTrans==TRANS_WRITE ){
  4180      BtShared *pBt = p->pBt;
  4181      assert( op==SAVEPOINT_RELEASE || op==SAVEPOINT_ROLLBACK );
  4182      assert( iSavepoint>=0 || (iSavepoint==-1 && op==SAVEPOINT_ROLLBACK) );
  4183      sqlite3BtreeEnter(p);
  4184      if( op==SAVEPOINT_ROLLBACK ){
  4185        rc = saveAllCursors(pBt, 0, 0);
  4186      }
  4187      if( rc==SQLITE_OK ){
  4188        rc = sqlite3PagerSavepoint(pBt->pPager, op, iSavepoint);
  4189      }
  4190      if( rc==SQLITE_OK ){
  4191        if( iSavepoint<0 && (pBt->btsFlags & BTS_INITIALLY_EMPTY)!=0 ){
  4192          pBt->nPage = 0;
  4193        }
  4194        rc = newDatabase(pBt);
  4195        pBt->nPage = get4byte(28 + pBt->pPage1->aData);
  4196  
  4197        /* The database size was written into the offset 28 of the header
  4198        ** when the transaction started, so we know that the value at offset
  4199        ** 28 is nonzero. */
  4200        assert( pBt->nPage>0 );
  4201      }
  4202      sqlite3BtreeLeave(p);
  4203    }
  4204    return rc;
  4205  }
  4206  
  4207  /*
  4208  ** Create a new cursor for the BTree whose root is on the page
  4209  ** iTable. If a read-only cursor is requested, it is assumed that
  4210  ** the caller already has at least a read-only transaction open
  4211  ** on the database already. If a write-cursor is requested, then
  4212  ** the caller is assumed to have an open write transaction.
  4213  **
  4214  ** If the BTREE_WRCSR bit of wrFlag is clear, then the cursor can only
  4215  ** be used for reading.  If the BTREE_WRCSR bit is set, then the cursor
  4216  ** can be used for reading or for writing if other conditions for writing
  4217  ** are also met.  These are the conditions that must be met in order
  4218  ** for writing to be allowed:
  4219  **
  4220  ** 1:  The cursor must have been opened with wrFlag containing BTREE_WRCSR
  4221  **
  4222  ** 2:  Other database connections that share the same pager cache
  4223  **     but which are not in the READ_UNCOMMITTED state may not have
  4224  **     cursors open with wrFlag==0 on the same table.  Otherwise
  4225  **     the changes made by this write cursor would be visible to
  4226  **     the read cursors in the other database connection.
  4227  **
  4228  ** 3:  The database must be writable (not on read-only media)
  4229  **
  4230  ** 4:  There must be an active transaction.
  4231  **
  4232  ** The BTREE_FORDELETE bit of wrFlag may optionally be set if BTREE_WRCSR
  4233  ** is set.  If FORDELETE is set, that is a hint to the implementation that
  4234  ** this cursor will only be used to seek to and delete entries of an index
  4235  ** as part of a larger DELETE statement.  The FORDELETE hint is not used by
  4236  ** this implementation.  But in a hypothetical alternative storage engine 
  4237  ** in which index entries are automatically deleted when corresponding table
  4238  ** rows are deleted, the FORDELETE flag is a hint that all SEEK and DELETE
  4239  ** operations on this cursor can be no-ops and all READ operations can 
  4240  ** return a null row (2-bytes: 0x01 0x00).
  4241  **
  4242  ** No checking is done to make sure that page iTable really is the
  4243  ** root page of a b-tree.  If it is not, then the cursor acquired
  4244  ** will not work correctly.
  4245  **
  4246  ** It is assumed that the sqlite3BtreeCursorZero() has been called
  4247  ** on pCur to initialize the memory space prior to invoking this routine.
  4248  */
  4249  static int btreeCursor(
  4250    Btree *p,                              /* The btree */
  4251    int iTable,                            /* Root page of table to open */
  4252    int wrFlag,                            /* 1 to write. 0 read-only */
  4253    struct KeyInfo *pKeyInfo,              /* First arg to comparison function */
  4254    BtCursor *pCur                         /* Space for new cursor */
  4255  ){
  4256    BtShared *pBt = p->pBt;                /* Shared b-tree handle */
  4257    BtCursor *pX;                          /* Looping over other all cursors */
  4258  
  4259    assert( sqlite3BtreeHoldsMutex(p) );
  4260    assert( wrFlag==0 
  4261         || wrFlag==BTREE_WRCSR 
  4262         || wrFlag==(BTREE_WRCSR|BTREE_FORDELETE) 
  4263    );
  4264  
  4265    /* The following assert statements verify that if this is a sharable 
  4266    ** b-tree database, the connection is holding the required table locks, 
  4267    ** and that no other connection has any open cursor that conflicts with 
  4268    ** this lock.  */
  4269    assert( hasSharedCacheTableLock(p, iTable, pKeyInfo!=0, (wrFlag?2:1)) );
  4270    assert( wrFlag==0 || !hasReadConflicts(p, iTable) );
  4271  
  4272    /* Assert that the caller has opened the required transaction. */
  4273    assert( p->inTrans>TRANS_NONE );
  4274    assert( wrFlag==0 || p->inTrans==TRANS_WRITE );
  4275    assert( pBt->pPage1 && pBt->pPage1->aData );
  4276    assert( wrFlag==0 || (pBt->btsFlags & BTS_READ_ONLY)==0 );
  4277  
  4278    if( wrFlag ){
  4279      allocateTempSpace(pBt);
  4280      if( pBt->pTmpSpace==0 ) return SQLITE_NOMEM_BKPT;
  4281    }
  4282    if( iTable==1 && btreePagecount(pBt)==0 ){
  4283      assert( wrFlag==0 );
  4284      iTable = 0;
  4285    }
  4286  
  4287    /* Now that no other errors can occur, finish filling in the BtCursor
  4288    ** variables and link the cursor into the BtShared list.  */
  4289    pCur->pgnoRoot = (Pgno)iTable;
  4290    pCur->iPage = -1;
  4291    pCur->pKeyInfo = pKeyInfo;
  4292    pCur->pBtree = p;
  4293    pCur->pBt = pBt;
  4294    pCur->curFlags = wrFlag ? BTCF_WriteFlag : 0;
  4295    pCur->curPagerFlags = wrFlag ? 0 : PAGER_GET_READONLY;
  4296    /* If there are two or more cursors on the same btree, then all such
  4297    ** cursors *must* have the BTCF_Multiple flag set. */
  4298    for(pX=pBt->pCursor; pX; pX=pX->pNext){
  4299      if( pX->pgnoRoot==(Pgno)iTable ){
  4300        pX->curFlags |= BTCF_Multiple;
  4301        pCur->curFlags |= BTCF_Multiple;
  4302      }
  4303    }
  4304    pCur->pNext = pBt->pCursor;
  4305    pBt->pCursor = pCur;
  4306    pCur->eState = CURSOR_INVALID;
  4307    return SQLITE_OK;
  4308  }
  4309  int sqlite3BtreeCursor(
  4310    Btree *p,                                   /* The btree */
  4311    int iTable,                                 /* Root page of table to open */
  4312    int wrFlag,                                 /* 1 to write. 0 read-only */
  4313    struct KeyInfo *pKeyInfo,                   /* First arg to xCompare() */
  4314    BtCursor *pCur                              /* Write new cursor here */
  4315  ){
  4316    int rc;
  4317    if( iTable<1 ){
  4318      rc = SQLITE_CORRUPT_BKPT;
  4319    }else{
  4320      sqlite3BtreeEnter(p);
  4321      rc = btreeCursor(p, iTable, wrFlag, pKeyInfo, pCur);
  4322      sqlite3BtreeLeave(p);
  4323    }
  4324    return rc;
  4325  }
  4326  
  4327  /*
  4328  ** Return the size of a BtCursor object in bytes.
  4329  **
  4330  ** This interfaces is needed so that users of cursors can preallocate
  4331  ** sufficient storage to hold a cursor.  The BtCursor object is opaque
  4332  ** to users so they cannot do the sizeof() themselves - they must call
  4333  ** this routine.
  4334  */
  4335  int sqlite3BtreeCursorSize(void){
  4336    return ROUND8(sizeof(BtCursor));
  4337  }
  4338  
  4339  /*
  4340  ** Initialize memory that will be converted into a BtCursor object.
  4341  **
  4342  ** The simple approach here would be to memset() the entire object
  4343  ** to zero.  But it turns out that the apPage[] and aiIdx[] arrays
  4344  ** do not need to be zeroed and they are large, so we can save a lot
  4345  ** of run-time by skipping the initialization of those elements.
  4346  */
  4347  void sqlite3BtreeCursorZero(BtCursor *p){
  4348    memset(p, 0, offsetof(BtCursor, BTCURSOR_FIRST_UNINIT));
  4349  }
  4350  
  4351  /*
  4352  ** Close a cursor.  The read lock on the database file is released
  4353  ** when the last cursor is closed.
  4354  */
  4355  int sqlite3BtreeCloseCursor(BtCursor *pCur){
  4356    Btree *pBtree = pCur->pBtree;
  4357    if( pBtree ){
  4358      BtShared *pBt = pCur->pBt;
  4359      sqlite3BtreeEnter(pBtree);
  4360      assert( pBt->pCursor!=0 );
  4361      if( pBt->pCursor==pCur ){
  4362        pBt->pCursor = pCur->pNext;
  4363      }else{
  4364        BtCursor *pPrev = pBt->pCursor;
  4365        do{
  4366          if( pPrev->pNext==pCur ){
  4367            pPrev->pNext = pCur->pNext;
  4368            break;
  4369          }
  4370          pPrev = pPrev->pNext;
4371 }while( ALWAYS(pPrev) );
4372 } 4373 btreeReleaseAllCursorPages(pCur); 4374 unlockBtreeIfUnused(pBt); 4375 sqlite3_free(pCur->aOverflow); 4376 sqlite3_free(pCur->pKey); 4377 sqlite3BtreeLeave(pBtree); 4378 } 4379 return SQLITE_OK; 4380 } 4381 4382 /* 4383 ** Make sure the BtCursor* given in the argument has a valid 4384 ** BtCursor.info structure. If it is not already valid, call 4385 ** btreeParseCell() to fill it in. 4386 ** 4387 ** BtCursor.info is a cache of the information in the current cell. 4388 ** Using this cache reduces the number of calls to btreeParseCell(). 4389 */ 4390 #ifndef NDEBUG 4391 static int cellInfoEqual(CellInfo *a, CellInfo *b){ 4392 if( a->nKey!=b->nKey ) return 0; 4393 if( a->pPayload!=b->pPayload ) return 0; 4394 if( a->nPayload!=b->nPayload ) return 0; 4395 if( a->nLocal!=b->nLocal ) return 0; 4396 if( a->nSize!=b->nSize ) return 0; 4397 return 1; 4398 } 4399 static void assertCellInfo(BtCursor *pCur){ 4400 CellInfo info; 4401 memset(&info, 0, sizeof(info)); 4402 btreeParseCell(pCur->pPage, pCur->ix, &info); 4403 assert( CORRUPT_DB || cellInfoEqual(&info, &pCur->info) ); 4404 } 4405 #else 4406 #define assertCellInfo(x) 4407 #endif 4408 static SQLITE_NOINLINE void getCellInfo(BtCursor *pCur){ 4409 if( pCur->info.nSize==0 ){ 4410 pCur->curFlags |= BTCF_ValidNKey; 4411 btreeParseCell(pCur->pPage,pCur->ix,&pCur->info); 4412 }else{ 4413 assertCellInfo(pCur); 4414 } 4415 } 4416 4417 #ifndef NDEBUG /* The next routine used only within assert() statements */ 4418 /* 4419 ** Return true if the given BtCursor is valid. A valid cursor is one 4420 ** that is currently pointing to a row in a (non-empty) table. 4421 ** This is a verification routine is used only within assert() statements. 4422 */ 4423 int sqlite3BtreeCursorIsValid(BtCursor *pCur){ 4424 return pCur && pCur->eState==CURSOR_VALID; 4425 } 4426 #endif /* NDEBUG */ 4427 int sqlite3BtreeCursorIsValidNN(BtCursor *pCur){ 4428 assert( pCur!=0 ); 4429 return pCur->eState==CURSOR_VALID; 4430 } 4431 4432 /* 4433 ** Return the value of the integer key or "rowid" for a table btree. 4434 ** This routine is only valid for a cursor that is pointing into a 4435 ** ordinary table btree. If the cursor points to an index btree or 4436 ** is invalid, the result of this routine is undefined. 4437 */ 4438 i64 sqlite3BtreeIntegerKey(BtCursor *pCur){ 4439 assert( cursorHoldsMutex(pCur) ); 4440 assert( pCur->eState==CURSOR_VALID ); 4441 assert( pCur->curIntKey ); 4442 getCellInfo(pCur); 4443 return pCur->info.nKey; 4444 } 4445 4446 #ifdef SQLITE_ENABLE_OFFSET_SQL_FUNC 4447 /* 4448 ** Return the offset into the database file for the start of the 4449 ** payload to which the cursor is pointing. 4450 */ 4451 i64 sqlite3BtreeOffset(BtCursor *pCur){ 4452 assert( cursorHoldsMutex(pCur) ); 4453 assert( pCur->eState==CURSOR_VALID ); 4454 getCellInfo(pCur); 4455 return (i64)pCur->pBt->pageSize*((i64)pCur->pPage->pgno - 1) + 4456 (i64)(pCur->info.pPayload - pCur->pPage->aData); 4457 } 4458 #endif /* SQLITE_ENABLE_OFFSET_SQL_FUNC */ 4459 4460 /* 4461 ** Return the number of bytes of payload for the entry that pCur is 4462 ** currently pointing to. For table btrees, this will be the amount 4463 ** of data. For index btrees, this will be the size of the key. 4464 ** 4465 ** The caller must guarantee that the cursor is pointing to a non-NULL 4466 ** valid entry. In other words, the calling procedure must guarantee 4467 ** that the cursor has Cursor.eState==CURSOR_VALID. 4468 */ 4469 u32 sqlite3BtreePayloadSize(BtCursor *pCur){ 4470 assert( cursorHoldsMutex(pCur) ); 4471 assert( pCur->eState==CURSOR_VALID ); 4472 getCellInfo(pCur); 4473 return pCur->info.nPayload; 4474 } 4475 4476 /* 4477 ** Given the page number of an overflow page in the database (parameter 4478 ** ovfl), this function finds the page number of the next page in the 4479 ** linked list of overflow pages. If possible, it uses the auto-vacuum 4480 ** pointer-map data instead of reading the content of page ovfl to do so. 4481 ** 4482 ** If an error occurs an SQLite error code is returned. Otherwise: 4483 ** 4484 ** The page number of the next overflow page in the linked list is 4485 ** written to *pPgnoNext. If page ovfl is the last page in its linked 4486 ** list, *pPgnoNext is set to zero. 4487 ** 4488 ** If ppPage is not NULL, and a reference to the MemPage object corresponding 4489 ** to page number pOvfl was obtained, then *ppPage is set to point to that 4490 ** reference. It is the responsibility of the caller to call releasePage() 4491 ** on *ppPage to free the reference. In no reference was obtained (because 4492 ** the pointer-map was used to obtain the value for *pPgnoNext), then 4493 ** *ppPage is set to zero. 4494 */ 4495 static int getOverflowPage( 4496 BtShared *pBt, /* The database file */ 4497 Pgno ovfl, /* Current overflow page number */ 4498 MemPage **ppPage, /* OUT: MemPage handle (may be NULL) */ 4499 Pgno *pPgnoNext /* OUT: Next overflow page number */ 4500 ){ 4501 Pgno next = 0; 4502 MemPage *pPage = 0; 4503 int rc = SQLITE_OK; 4504 4505 assert( sqlite3_mutex_held(pBt->mutex) ); 4506 assert(pPgnoNext); 4507 4508 #ifndef SQLITE_OMIT_AUTOVACUUM 4509 /* Try to find the next page in the overflow list using the 4510 ** autovacuum pointer-map pages. Guess that the next page in 4511 ** the overflow list is page number (ovfl+1). If that guess turns 4512 ** out to be wrong, fall back to loading the data of page 4513 ** number ovfl to determine the next page number. 4514 */ 4515 if( pBt->autoVacuum ){ 4516 Pgno pgno; 4517 Pgno iGuess = ovfl+1; 4518 u8 eType; 4519 4520 while( PTRMAP_ISPAGE(pBt, iGuess) || iGuess==PENDING_BYTE_PAGE(pBt) ){ 4521 iGuess++; 4522 } 4523 4524 if( iGuess<=btreePagecount(pBt) ){ 4525 rc = ptrmapGet(pBt, iGuess, &eType, &pgno); 4526 if( rc==SQLITE_OK && eType==PTRMAP_OVERFLOW2 && pgno==ovfl ){ 4527 next = iGuess; 4528 rc = SQLITE_DONE; 4529 } 4530 } 4531 } 4532 #endif 4533 4534 assert( next==0 || rc==SQLITE_DONE ); 4535 if( rc==SQLITE_OK ){ 4536 rc = btreeGetPage(pBt, ovfl, &pPage, (ppPage==0) ? PAGER_GET_READONLY : 0); 4537 assert( rc==SQLITE_OK || pPage==0 ); 4538 if( rc==SQLITE_OK ){ 4539 next = get4byte(pPage->aData); 4540 } 4541 } 4542 4543 *pPgnoNext = next; 4544 if( ppPage ){ 4545 *ppPage = pPage; 4546 }else{ 4547 releasePage(pPage); 4548 } 4549 return (rc==SQLITE_DONE ? SQLITE_OK : rc); 4550 } 4551 4552 /* 4553 ** Copy data from a buffer to a page, or from a page to a buffer. 4554 ** 4555 ** pPayload is a pointer to data stored on database page pDbPage. 4556 ** If argument eOp is false, then nByte bytes of data are copied 4557 ** from pPayload to the buffer pointed at by pBuf. If eOp is true, 4558 ** then sqlite3PagerWrite() is called on pDbPage and nByte bytes 4559 ** of data are copied from the buffer pBuf to pPayload. 4560 ** 4561 ** SQLITE_OK is returned on success, otherwise an error code. 4562 */ 4563 static int copyPayload( 4564 void *pPayload, /* Pointer to page data */ 4565 void *pBuf, /* Pointer to buffer */ 4566 int nByte, /* Number of bytes to copy */ 4567 int eOp, /* 0 -> copy from page, 1 -> copy to page */ 4568 DbPage *pDbPage /* Page containing pPayload */ 4569 ){ 4570 if( eOp ){ 4571 /* Copy data from buffer to page (a write operation) */ 4572 int rc = sqlite3PagerWrite(pDbPage); 4573 if( rc!=SQLITE_OK ){ 4574 return rc; 4575 } 4576 memcpy(pPayload, pBuf, nByte); 4577 }else{ 4578 /* Copy data from page to buffer (a read operation) */ 4579 memcpy(pBuf, pPayload, nByte); 4580 } 4581 return SQLITE_OK; 4582 } 4583 4584 /* 4585 ** This function is used to read or overwrite payload information 4586 ** for the entry that the pCur cursor is pointing to. The eOp 4587 ** argument is interpreted as follows: 4588 ** 4589 ** 0: The operation is a read. Populate the overflow cache. 4590 ** 1: The operation is a write. Populate the overflow cache. 4591 ** 4592 ** A total of "amt" bytes are read or written beginning at "offset". 4593 ** Data is read to or from the buffer pBuf. 4594 ** 4595 ** The content being read or written might appear on the main page 4596 ** or be scattered out on multiple overflow pages. 4597 ** 4598 ** If the current cursor entry uses one or more overflow pages 4599 ** this function may allocate space for and lazily populate 4600 ** the overflow page-list cache array (BtCursor.aOverflow). 4601 ** Subsequent calls use this cache to make seeking to the supplied offset 4602 ** more efficient. 4603 ** 4604 ** Once an overflow page-list cache has been allocated, it must be 4605 ** invalidated if some other cursor writes to the same table, or if 4606 ** the cursor is moved to a different row. Additionally, in auto-vacuum 4607 ** mode, the following events may invalidate an overflow page-list cache. 4608 ** 4609 ** * An incremental vacuum, 4610 ** * A commit in auto_vacuum="full" mode, 4611 ** * Creating a table (may require moving an overflow page). 4612 */ 4613 static int accessPayload( 4614 BtCursor *pCur, /* Cursor pointing to entry to read from */ 4615 u32 offset, /* Begin reading this far into payload */ 4616 u32 amt, /* Read this many bytes */ 4617 unsigned char *pBuf, /* Write the bytes into this buffer */ 4618 int eOp /* zero to read. non-zero to write. */ 4619 ){ 4620 unsigned char *aPayload; 4621 int rc = SQLITE_OK; 4622 int iIdx = 0; 4623 MemPage *pPage = pCur->pPage; /* Btree page of current entry */ 4624 BtShared *pBt = pCur->pBt; /* Btree this cursor belongs to */ 4625 #ifdef SQLITE_DIRECT_OVERFLOW_READ 4626 unsigned char * const pBufStart = pBuf; /* Start of original out buffer */ 4627 #endif 4628 4629 assert( pPage ); 4630 assert( eOp==0 || eOp==1 ); 4631 assert( pCur->eState==CURSOR_VALID ); 4632 assert( pCur->ix<pPage->nCell ); 4633 assert( cursorHoldsMutex(pCur) ); 4634 4635 getCellInfo(pCur); 4636 aPayload = pCur->info.pPayload; 4637 assert( offset+amt <= pCur->info.nPayload ); 4638 4639 assert( aPayload > pPage->aData ); 4640 if( (uptr)(aPayload - pPage->aData) > (pBt->usableSize - pCur->info.nLocal) ){ 4641 /* Trying to read or write past the end of the data is an error. The 4642 ** conditional above is really: 4643 ** &aPayload[pCur->info.nLocal] > &pPage->aData[pBt->usableSize] 4644 ** but is recast into its current form to avoid integer overflow problems 4645 */ 4646 return SQLITE_CORRUPT_PAGE(pPage); 4647 } 4648 4649 /* Check if data must be read/written to/from the btree page itself. */ 4650 if( offset<pCur->info.nLocal ){ 4651 int a = amt; 4652 if( a+offset>pCur->info.nLocal ){ 4653 a = pCur->info.nLocal - offset; 4654 } 4655 rc = copyPayload(&aPayload[offset], pBuf, a, eOp, pPage->pDbPage); 4656 offset = 0; 4657 pBuf += a; 4658 amt -= a; 4659 }else{ 4660 offset -= pCur->info.nLocal; 4661 } 4662 4663 4664 if( rc==SQLITE_OK && amt>0 ){ 4665 const u32 ovflSize = pBt->usableSize - 4; /* Bytes content per ovfl page */ 4666 Pgno nextPage; 4667 4668 nextPage = get4byte(&aPayload[pCur->info.nLocal]); 4669 4670 /* If the BtCursor.aOverflow[] has not been allocated, allocate it now. 4671 ** 4672 ** The aOverflow[] array is sized at one entry for each overflow page 4673 ** in the overflow chain. The page number of the first overflow page is 4674 ** stored in aOverflow[0], etc. A value of 0 in the aOverflow[] array 4675 ** means "not yet known" (the cache is lazily populated). 4676 */ 4677 if( (pCur->curFlags & BTCF_ValidOvfl)==0 ){ 4678 int nOvfl = (pCur->info.nPayload-pCur->info.nLocal+ovflSize-1)/ovflSize; 4679 if( pCur->aOverflow==0 4680 || nOvfl*(int)sizeof(Pgno) > sqlite3MallocSize(pCur->aOverflow) 4681 ){ 4682 Pgno *aNew = (Pgno*)sqlite3Realloc( 4683 pCur->aOverflow, nOvfl*2*sizeof(Pgno) 4684 ); 4685 if( aNew==0 ){ 4686 return SQLITE_NOMEM_BKPT; 4687 }else{ 4688 pCur->aOverflow = aNew; 4689 } 4690 } 4691 memset(pCur->aOverflow, 0, nOvfl*sizeof(Pgno)); 4692 pCur->curFlags |= BTCF_ValidOvfl; 4693 }else{ 4694 /* If the overflow page-list cache has been allocated and the 4695 ** entry for the first required overflow page is valid, skip 4696 ** directly to it. 4697 */ 4698 if( pCur->aOverflow[offset/ovflSize] ){ 4699 iIdx = (offset/ovflSize); 4700 nextPage = pCur->aOverflow[iIdx]; 4701 offset = (offset%ovflSize); 4702 } 4703 } 4704 4705 assert( rc==SQLITE_OK && amt>0 ); 4706 while( nextPage ){ 4707 /* If required, populate the overflow page-list cache. */ 4708 assert( pCur->aOverflow[iIdx]==0 4709 || pCur->aOverflow[iIdx]==nextPage 4710 || CORRUPT_DB ); 4711 pCur->aOverflow[iIdx] = nextPage; 4712 4713 if( offset>=ovflSize ){ 4714 /* The only reason to read this page is to obtain the page 4715 ** number for the next page in the overflow chain. The page 4716 ** data is not required. So first try to lookup the overflow 4717 ** page-list cache, if any, then fall back to the getOverflowPage() 4718 ** function. 4719 */ 4720 assert( pCur->curFlags & BTCF_ValidOvfl ); 4721 assert( pCur->pBtree->db==pBt->db ); 4722 if( pCur->aOverflow[iIdx+1] ){ 4723 nextPage = pCur->aOverflow[iIdx+1]; 4724 }else{ 4725 rc = getOverflowPage(pBt, nextPage, 0, &nextPage); 4726 } 4727 offset -= ovflSize; 4728 }else{ 4729 /* Need to read this page properly. It contains some of the 4730 ** range of data that is being read (eOp==0) or written (eOp!=0). 4731 */ 4732 #ifdef SQLITE_DIRECT_OVERFLOW_READ 4733 sqlite3_file *fd; /* File from which to do direct overflow read */ 4734 #endif 4735 int a = amt; 4736 if( a + offset > ovflSize ){ 4737 a = ovflSize - offset; 4738 } 4739 4740 #ifdef SQLITE_DIRECT_OVERFLOW_READ 4741 /* If all the following are true: 4742 ** 4743 ** 1) this is a read operation, and 4744 ** 2) data is required from the start of this overflow page, and 4745 ** 3) there is no open write-transaction, and 4746 ** 4) the database is file-backed, and 4747 ** 5) the page is not in the WAL file 4748 ** 6) at least 4 bytes have already been read into the output buffer 4749 ** 4750 ** then data can be read directly from the database file into the 4751 ** output buffer, bypassing the page-cache altogether. This speeds 4752 ** up loading large records that span many overflow pages. 4753 */ 4754 if( eOp==0 /* (1) */ 4755 && offset==0 /* (2) */ 4756 && pBt->inTransaction==TRANS_READ /* (3) */ 4757 && (fd = sqlite3PagerFile(pBt->pPager))->pMethods /* (4) */ 4758 && 0==sqlite3PagerUseWal(pBt->pPager, nextPage) /* (5) */ 4759 && &pBuf[-4]>=pBufStart /* (6) */ 4760 ){ 4761 u8 aSave[4]; 4762 u8 *aWrite = &pBuf[-4]; 4763 assert( aWrite>=pBufStart ); /* due to (6) */ 4764 memcpy(aSave, aWrite, 4); 4765 rc = sqlite3OsRead(fd, aWrite, a+4, (i64)pBt->pageSize*(nextPage-1)); 4766 nextPage = get4byte(aWrite); 4767 memcpy(aWrite, aSave, 4); 4768 }else 4769 #endif 4770 4771 { 4772 DbPage *pDbPage; 4773 rc = sqlite3PagerGet(pBt->pPager, nextPage, &pDbPage, 4774 (eOp==0 ? PAGER_GET_READONLY : 0) 4775 ); 4776 if( rc==SQLITE_OK ){ 4777 aPayload = sqlite3PagerGetData(pDbPage); 4778 nextPage = get4byte(aPayload); 4779 rc = copyPayload(&aPayload[offset+4], pBuf, a, eOp, pDbPage); 4780 sqlite3PagerUnref(pDbPage); 4781 offset = 0; 4782 } 4783 } 4784 amt -= a; 4785 if( amt==0 ) return rc; 4786 pBuf += a; 4787 } 4788 if( rc ) break; 4789 iIdx++; 4790 } 4791 } 4792 4793 if( rc==SQLITE_OK && amt>0 ){ 4794 /* Overflow chain ends prematurely */ 4795 return SQLITE_CORRUPT_PAGE(pPage); 4796 } 4797 return rc; 4798 } 4799 4800 /* 4801 ** Read part of the payload for the row at which that cursor pCur is currently 4802 ** pointing. "amt" bytes will be transferred into pBuf[]. The transfer 4803 ** begins at "offset". 4804 ** 4805 ** pCur can be pointing to either a table or an index b-tree. 4806 ** If pointing to a table btree, then the content section is read. If 4807 ** pCur is pointing to an index b-tree then the key section is read. 4808 ** 4809 ** For sqlite3BtreePayload(), the caller must ensure that pCur is pointing 4810 ** to a valid row in the table. For sqlite3BtreePayloadChecked(), the 4811 ** cursor might be invalid or might need to be restored before being read. 4812 ** 4813 ** Return SQLITE_OK on success or an error code if anything goes 4814 ** wrong. An error is returned if "offset+amt" is larger than 4815 ** the available payload. 4816 */ 4817 int sqlite3BtreePayload(BtCursor *pCur, u32 offset, u32 amt, void *pBuf){ 4818 assert( cursorHoldsMutex(pCur) ); 4819 assert( pCur->eState==CURSOR_VALID ); 4820 assert( pCur->iPage>=0 && pCur->pPage ); 4821 assert( pCur->ix<pCur->pPage->nCell ); 4822 return accessPayload(pCur, offset, amt, (unsigned char*)pBuf, 0); 4823 } 4824 4825 /* 4826 ** This variant of sqlite3BtreePayload() works even if the cursor has not 4827 ** in the CURSOR_VALID state. It is only used by the sqlite3_blob_read() 4828 ** interface. 4829 */ 4830 #ifndef SQLITE_OMIT_INCRBLOB 4831 static SQLITE_NOINLINE int accessPayloadChecked( 4832 BtCursor *pCur, 4833 u32 offset, 4834 u32 amt, 4835 void *pBuf 4836 ){ 4837 int rc; 4838 if ( pCur->eState==CURSOR_INVALID ){ 4839 return SQLITE_ABORT; 4840 } 4841 assert( cursorOwnsBtShared(pCur) ); 4842 rc = btreeRestoreCursorPosition(pCur); 4843 return rc ? rc : accessPayload(pCur, offset, amt, pBuf, 0); 4844 } 4845 int sqlite3BtreePayloadChecked(BtCursor *pCur, u32 offset, u32 amt, void *pBuf){ 4846 if( pCur->eState==CURSOR_VALID ){ 4847 assert( cursorOwnsBtShared(pCur) ); 4848 return accessPayload(pCur, offset, amt, pBuf, 0); 4849 }else{ 4850 return accessPayloadChecked(pCur, offset, amt, pBuf); 4851 } 4852 } 4853 #endif /* SQLITE_OMIT_INCRBLOB */ 4854 4855 /* 4856 ** Return a pointer to payload information from the entry that the 4857 ** pCur cursor is pointing to. The pointer is to the beginning of 4858 ** the key if index btrees (pPage->intKey==0) and is the data for 4859 ** table btrees (pPage->intKey==1). The number of bytes of available 4860 ** key/data is written into *pAmt. If *pAmt==0, then the value 4861 ** returned will not be a valid pointer. 4862 ** 4863 ** This routine is an optimization. It is common for the entire key 4864 ** and data to fit on the local page and for there to be no overflow 4865 ** pages. When that is so, this routine can be used to access the 4866 ** key and data without making a copy. If the key and/or data spills 4867 ** onto overflow pages, then accessPayload() must be used to reassemble 4868 ** the key/data and copy it into a preallocated buffer. 4869 ** 4870 ** The pointer returned by this routine looks directly into the cached 4871 ** page of the database. The data might change or move the next time 4872 ** any btree routine is called. 4873 */ 4874 static const void *fetchPayload( 4875 BtCursor *pCur, /* Cursor pointing to entry to read from */ 4876 u32 *pAmt /* Write the number of available bytes here */ 4877 ){ 4878 int amt; 4879 assert( pCur!=0 && pCur->iPage>=0 && pCur->pPage); 4880 assert( pCur->eState==CURSOR_VALID ); 4881 assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) ); 4882 assert( cursorOwnsBtShared(pCur) ); 4883 assert( pCur->ix<pCur->pPage->nCell ); 4884 assert( pCur->info.nSize>0 ); 4885 assert( pCur->info.pPayload>pCur->pPage->aData || CORRUPT_DB ); 4886 assert( pCur->info.pPayload<pCur->pPage->aDataEnd ||CORRUPT_DB); 4887 amt = pCur->info.nLocal; 4888 if( amt>(int)(pCur->pPage->aDataEnd - pCur->info.pPayload) ){ 4889 /* There is too little space on the page for the expected amount 4890 ** of local content. Database must be corrupt. */ 4891 assert( CORRUPT_DB ); 4892 amt = MAX(0, (int)(pCur->pPage->aDataEnd - pCur->info.pPayload)); 4893 } 4894 *pAmt = (u32)amt; 4895 return (void*)pCur->info.pPayload; 4896 } 4897 4898 4899 /* 4900 ** For the entry that cursor pCur is point to, return as 4901 ** many bytes of the key or data as are available on the local 4902 ** b-tree page. Write the number of available bytes into *pAmt. 4903 ** 4904 ** The pointer returned is ephemeral. The key/data may move 4905 ** or be destroyed on the next call to any Btree routine, 4906 ** including calls from other threads against the same cache. 4907 ** Hence, a mutex on the BtShared should be held prior to calling 4908 ** this routine. 4909 ** 4910 ** These routines is used to get quick access to key and data 4911 ** in the common case where no overflow pages are used. 4912 */ 4913 const void *sqlite3BtreePayloadFetch(BtCursor *pCur, u32 *pAmt){ 4914 return fetchPayload(pCur, pAmt); 4915 } 4916 4917 4918 /* 4919 ** Move the cursor down to a new child page. The newPgno argument is the 4920 ** page number of the child page to move to. 4921 ** 4922 ** This function returns SQLITE_CORRUPT if the page-header flags field of 4923 ** the new child page does not match the flags field of the parent (i.e. 4924 ** if an intkey page appears to be the parent of a non-intkey page, or 4925 ** vice-versa). 4926 */ 4927 static int moveToChild(BtCursor *pCur, u32 newPgno){ 4928 BtShared *pBt = pCur->pBt; 4929 4930 assert( cursorOwnsBtShared(pCur) ); 4931 assert( pCur->eState==CURSOR_VALID ); 4932 assert( pCur->iPage<BTCURSOR_MAX_DEPTH ); 4933 assert( pCur->iPage>=0 ); 4934 if( pCur->iPage>=(BTCURSOR_MAX_DEPTH-1) ){ 4935 return SQLITE_CORRUPT_BKPT; 4936 } 4937 pCur->info.nSize = 0; 4938 pCur->curFlags &= ~(BTCF_ValidNKey|BTCF_ValidOvfl); 4939 pCur->aiIdx[pCur->iPage] = pCur->ix; 4940 pCur->apPage[pCur->iPage] = pCur->pPage; 4941 pCur->ix = 0; 4942 pCur->iPage++; 4943 return getAndInitPage(pBt, newPgno, &pCur->pPage, pCur, pCur->curPagerFlags); 4944 } 4945 4946 #ifdef SQLITE_DEBUG 4947 /* 4948 ** Page pParent is an internal (non-leaf) tree page. This function 4949 ** asserts that page number iChild is the left-child if the iIdx'th 4950 ** cell in page pParent. Or, if iIdx is equal to the total number of 4951 ** cells in pParent, that page number iChild is the right-child of 4952 ** the page. 4953 */ 4954 static void assertParentIndex(MemPage *pParent, int iIdx, Pgno iChild){ 4955 if( CORRUPT_DB ) return; /* The conditions tested below might not be true 4956 ** in a corrupt database */ 4957 assert( iIdx<=pParent->nCell ); 4958 if( iIdx==pParent->nCell ){ 4959 assert( get4byte(&pParent->aData[pParent->hdrOffset+8])==iChild ); 4960 }else{ 4961 assert( get4byte(findCell(pParent, iIdx))==iChild ); 4962 } 4963 } 4964 #else 4965 # define assertParentIndex(x,y,z) 4966 #endif 4967 4968 /* 4969 ** Move the cursor up to the parent page. 4970 ** 4971 ** pCur->idx is set to the cell index that contains the pointer 4972 ** to the page we are coming from. If we are coming from the 4973 ** right-most child page then pCur->idx is set to one more than 4974 ** the largest cell index. 4975 */ 4976 static void moveToParent(BtCursor *pCur){ 4977 MemPage *pLeaf; 4978 assert( cursorOwnsBtShared(pCur) ); 4979 assert( pCur->eState==CURSOR_VALID ); 4980 assert( pCur->iPage>0 ); 4981 assert( pCur->pPage ); 4982 assertParentIndex( 4983 pCur->apPage[pCur->iPage-1], 4984 pCur->aiIdx[pCur->iPage-1], 4985 pCur->pPage->pgno 4986 ); 4987 testcase( pCur->aiIdx[pCur->iPage-1] > pCur->apPage[pCur->iPage-1]->nCell ); 4988 pCur->info.nSize = 0; 4989 pCur->curFlags &= ~(BTCF_ValidNKey|BTCF_ValidOvfl); 4990 pCur->ix = pCur->aiIdx[pCur->iPage-1]; 4991 pLeaf = pCur->pPage; 4992 pCur->pPage = pCur->apPage[--pCur->iPage]; 4993 releasePageNotNull(pLeaf); 4994 } 4995 4996 /* 4997 ** Move the cursor to point to the root page of its b-tree structure. 4998 ** 4999 ** If the table has a virtual root page, then the cursor is moved to point 5000 ** to the virtual root page instead of the actual root page. A table has a 5001 ** virtual root page when the actual root page contains no cells and a 5002 ** single child page. This can only happen with the table rooted at page 1. 5003 ** 5004 ** If the b-tree structure is empty, the cursor state is set to 5005 ** CURSOR_INVALID and this routine returns SQLITE_EMPTY. Otherwise, 5006 ** the cursor is set to point to the first cell located on the root 5007 ** (or virtual root) page and the cursor state is set to CURSOR_VALID. 5008 ** 5009 ** If this function returns successfully, it may be assumed that the 5010 ** page-header flags indicate that the [virtual] root-page is the expected 5011 ** kind of b-tree page (i.e. if when opening the cursor the caller did not 5012 ** specify a KeyInfo structure the flags byte is set to 0x05 or 0x0D, 5013 ** indicating a table b-tree, or if the caller did specify a KeyInfo 5014 ** structure the flags byte is set to 0x02 or 0x0A, indicating an index 5015 ** b-tree). 5016 */ 5017 static int moveToRoot(BtCursor *pCur){ 5018 MemPage *pRoot; 5019 int rc = SQLITE_OK; 5020 5021 assert( cursorOwnsBtShared(pCur) ); 5022 assert( CURSOR_INVALID < CURSOR_REQUIRESEEK ); 5023 assert( CURSOR_VALID < CURSOR_REQUIRESEEK ); 5024 assert( CURSOR_FAULT > CURSOR_REQUIRESEEK ); 5025 assert( pCur->eState < CURSOR_REQUIRESEEK || pCur->iPage<0 ); 5026 assert( pCur->pgnoRoot>0 || pCur->iPage<0 ); 5027 5028 if( pCur->iPage>=0 ){ 5029 if( pCur->iPage ){ 5030 releasePageNotNull(pCur->pPage); 5031 while( --pCur->iPage ){ 5032 releasePageNotNull(pCur->apPage[pCur->iPage]); 5033 } 5034 pCur->pPage = pCur->apPage[0]; 5035 goto skip_init; 5036 } 5037 }else if( pCur->pgnoRoot==0 ){ 5038 pCur->eState = CURSOR_INVALID; 5039 return SQLITE_EMPTY; 5040 }else{ 5041 assert( pCur->iPage==(-1) ); 5042 if( pCur->eState>=CURSOR_REQUIRESEEK ){ 5043 if( pCur->eState==CURSOR_FAULT ){ 5044 assert( pCur->skipNext!=SQLITE_OK ); 5045 return pCur->skipNext; 5046 } 5047 sqlite3BtreeClearCursor(pCur); 5048 } 5049 rc = getAndInitPage(pCur->pBtree->pBt, pCur->pgnoRoot, &pCur->pPage, 5050 0, pCur->curPagerFlags); 5051 if( rc!=SQLITE_OK ){ 5052 pCur->eState = CURSOR_INVALID; 5053 return rc; 5054 } 5055 pCur->iPage = 0; 5056 pCur->curIntKey = pCur->pPage->intKey; 5057 } 5058 pRoot = pCur->pPage; 5059 assert( pRoot->pgno==pCur->pgnoRoot ); 5060 5061 /* If pCur->pKeyInfo is not NULL, then the caller that opened this cursor 5062 ** expected to open it on an index b-tree. Otherwise, if pKeyInfo is 5063 ** NULL, the caller expects a table b-tree. If this is not the case, 5064 ** return an SQLITE_CORRUPT error. 5065 ** 5066 ** Earlier versions of SQLite assumed that this test could not fail 5067 ** if the root page was already loaded when this function was called (i.e. 5068 ** if pCur->iPage>=0). But this is not so if the database is corrupted 5069 ** in such a way that page pRoot is linked into a second b-tree table 5070 ** (or the freelist). */ 5071 assert( pRoot->intKey==1 || pRoot->intKey==0 ); 5072 if( pRoot->isInit==0 || (pCur->pKeyInfo==0)!=pRoot->intKey ){ 5073 return SQLITE_CORRUPT_PAGE(pCur->pPage); 5074 } 5075 5076 skip_init: 5077 pCur->ix = 0; 5078 pCur->info.nSize = 0; 5079 pCur->curFlags &= ~(BTCF_AtLast|BTCF_ValidNKey|BTCF_ValidOvfl); 5080 5081 pRoot = pCur->pPage; 5082 if( pRoot->nCell>0 ){ 5083 pCur->eState = CURSOR_VALID; 5084 }else if( !pRoot->leaf ){ 5085 Pgno subpage; 5086 if( pRoot->pgno!=1 ) return SQLITE_CORRUPT_BKPT; 5087 subpage = get4byte(&pRoot->aData[pRoot->hdrOffset+8]); 5088 pCur->eState = CURSOR_VALID; 5089 rc = moveToChild(pCur, subpage); 5090 }else{ 5091 pCur->eState = CURSOR_INVALID; 5092 rc = SQLITE_EMPTY; 5093 } 5094 return rc; 5095 } 5096 5097 /* 5098 ** Move the cursor down to the left-most leaf entry beneath the 5099 ** entry to which it is currently pointing. 5100 ** 5101 ** The left-most leaf is the one with the smallest key - the first 5102 ** in ascending order. 5103 */ 5104 static int moveToLeftmost(BtCursor *pCur){ 5105 Pgno pgno; 5106 int rc = SQLITE_OK; 5107 MemPage *pPage; 5108 5109 assert( cursorOwnsBtShared(pCur) ); 5110 assert( pCur->eState==CURSOR_VALID ); 5111 while( rc==SQLITE_OK && !(pPage = pCur->pPage)->leaf ){ 5112 assert( pCur->ix<pPage->nCell ); 5113 pgno = get4byte(findCell(pPage, pCur->ix)); 5114 rc = moveToChild(pCur, pgno); 5115 } 5116 return rc; 5117 } 5118 5119 /* 5120 ** Move the cursor down to the right-most leaf entry beneath the 5121 ** page to which it is currently pointing. Notice the difference 5122 ** between moveToLeftmost() and moveToRightmost(). moveToLeftmost() 5123 ** finds the left-most entry beneath the *entry* whereas moveToRightmost() 5124 ** finds the right-most entry beneath the *page*. 5125 ** 5126 ** The right-most entry is the one with the largest key - the last 5127 ** key in ascending order. 5128 */ 5129 static int moveToRightmost(BtCursor *pCur){ 5130 Pgno pgno; 5131 int rc = SQLITE_OK; 5132 MemPage *pPage = 0; 5133 5134 assert( cursorOwnsBtShared(pCur) ); 5135 assert( pCur->eState==CURSOR_VALID ); 5136 while( !(pPage = pCur->pPage)->leaf ){ 5137 pgno = get4byte(&pPage->aData[pPage->hdrOffset+8]); 5138 pCur->ix = pPage->nCell; 5139 rc = moveToChild(pCur, pgno); 5140 if( rc ) return rc; 5141 } 5142 pCur->ix = pPage->nCell-1; 5143 assert( pCur->info.nSize==0 ); 5144 assert( (pCur->curFlags & BTCF_ValidNKey)==0 ); 5145 return SQLITE_OK; 5146 } 5147 5148 /* Move the cursor to the first entry in the table. Return SQLITE_OK 5149 ** on success. Set *pRes to 0 if the cursor actually points to something 5150 ** or set *pRes to 1 if the table is empty. 5151 */ 5152 int sqlite3BtreeFirst(BtCursor *pCur, int *pRes){ 5153 int rc; 5154 5155 assert( cursorOwnsBtShared(pCur) ); 5156 assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) ); 5157 rc = moveToRoot(pCur); 5158 if( rc==SQLITE_OK ){ 5159 assert( pCur->pPage->nCell>0 ); 5160 *pRes = 0; 5161 rc = moveToLeftmost(pCur); 5162 }else if( rc==SQLITE_EMPTY ){ 5163 assert( pCur->pgnoRoot==0 || pCur->pPage->nCell==0 ); 5164 *pRes = 1; 5165 rc = SQLITE_OK; 5166 } 5167 return rc; 5168 } 5169 5170 /* Move the cursor to the last entry in the table. Return SQLITE_OK 5171 ** on success. Set *pRes to 0 if the cursor actually points to something 5172 ** or set *pRes to 1 if the table is empty. 5173 */ 5174 int sqlite3BtreeLast(BtCursor *pCur, int *pRes){ 5175 int rc; 5176 5177 assert( cursorOwnsBtShared(pCur) ); 5178 assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) ); 5179 5180 /* If the cursor already points to the last entry, this is a no-op. */ 5181 if( CURSOR_VALID==pCur->eState && (pCur->curFlags & BTCF_AtLast)!=0 ){ 5182 #ifdef SQLITE_DEBUG 5183 /* This block serves to assert() that the cursor really does point 5184 ** to the last entry in the b-tree. */ 5185 int ii; 5186 for(ii=0; ii<pCur->iPage; ii++){ 5187 assert( pCur->aiIdx[ii]==pCur->apPage[ii]->nCell ); 5188 } 5189 assert( pCur->ix==pCur->pPage->nCell-1 ); 5190 assert( pCur->pPage->leaf ); 5191 #endif 5192 return SQLITE_OK; 5193 } 5194 5195 rc = moveToRoot(pCur); 5196 if( rc==SQLITE_OK ){ 5197 assert( pCur->eState==CURSOR_VALID ); 5198 *pRes = 0; 5199 rc = moveToRightmost(pCur); 5200 if( rc==SQLITE_OK ){ 5201 pCur->curFlags |= BTCF_AtLast; 5202 }else{ 5203 pCur->curFlags &= ~BTCF_AtLast; 5204 } 5205 }else if( rc==SQLITE_EMPTY ){ 5206 assert( pCur->pgnoRoot==0 || pCur->pPage->nCell==0 ); 5207 *pRes = 1; 5208 rc = SQLITE_OK; 5209 } 5210 return rc; 5211 } 5212 5213 /* Move the cursor so that it points to an entry near the key 5214 ** specified by pIdxKey or intKey. Return a success code. 5215 ** 5216 ** For INTKEY tables, the intKey parameter is used. pIdxKey 5217 ** must be NULL. For index tables, pIdxKey is used and intKey 5218 ** is ignored. 5219 ** 5220 ** If an exact match is not found, then the cursor is always 5221 ** left pointing at a leaf page which would hold the entry if it 5222 ** were present. The cursor might point to an entry that comes 5223 ** before or after the key. 5224 ** 5225 ** An integer is written into *pRes which is the result of 5226 ** comparing the key with the entry to which the cursor is 5227 ** pointing. The meaning of the integer written into 5228 ** *pRes is as follows: 5229 ** 5230 ** *pRes<0 The cursor is left pointing at an entry that 5231 ** is smaller than intKey/pIdxKey or if the table is empty 5232 ** and the cursor is therefore left point to nothing. 5233 ** 5234 ** *pRes==0 The cursor is left pointing at an entry that 5235 ** exactly matches intKey/pIdxKey. 5236 ** 5237 ** *pRes>0 The cursor is left pointing at an entry that 5238 ** is larger than intKey/pIdxKey. 5239 ** 5240 ** For index tables, the pIdxKey->eqSeen field is set to 1 if there 5241 ** exists an entry in the table that exactly matches pIdxKey. 5242 */ 5243 int sqlite3BtreeMovetoUnpacked( 5244 BtCursor *pCur, /* The cursor to be moved */ 5245 UnpackedRecord *pIdxKey, /* Unpacked index key */ 5246 i64 intKey, /* The table key */ 5247 int biasRight, /* If true, bias the search to the high end */ 5248 int *pRes /* Write search results here */ 5249 ){ 5250 int rc; 5251 RecordCompare xRecordCompare; 5252 5253 assert( cursorOwnsBtShared(pCur) ); 5254 assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) ); 5255 assert( pRes ); 5256 assert( (pIdxKey==0)==(pCur->pKeyInfo==0) ); 5257 assert( pCur->eState!=CURSOR_VALID || (pIdxKey==0)==(pCur->curIntKey!=0) ); 5258 5259 /* If the cursor is already positioned at the point we are trying 5260 ** to move to, then just return without doing any work */ 5261 if( pIdxKey==0 5262 && pCur->eState==CURSOR_VALID && (pCur->curFlags & BTCF_ValidNKey)!=0 5263 ){ 5264 if( pCur->info.nKey==intKey ){ 5265 *pRes = 0; 5266 return SQLITE_OK; 5267 } 5268 if( pCur->info.nKey<intKey ){ 5269 if( (pCur->curFlags & BTCF_AtLast)!=0 ){ 5270 *pRes = -1; 5271 return SQLITE_OK; 5272 } 5273 /* If the requested key is one more than the previous key, then 5274 ** try to get there using sqlite3BtreeNext() rather than a full 5275 ** binary search. This is an optimization only. The correct answer 5276 ** is still obtained without this case, only a little more slowely */ 5277 if( pCur->info.nKey+1==intKey && !pCur->skipNext ){ 5278 *pRes = 0; 5279 rc = sqlite3BtreeNext(pCur, 0); 5280 if( rc==SQLITE_OK ){ 5281 getCellInfo(pCur); 5282 if( pCur->info.nKey==intKey ){ 5283 return SQLITE_OK; 5284 } 5285 }else if( rc==SQLITE_DONE ){ 5286 rc = SQLITE_OK; 5287 }else{ 5288 return rc; 5289 } 5290 } 5291 } 5292 } 5293 5294 if( pIdxKey ){ 5295 xRecordCompare = sqlite3VdbeFindCompare(pIdxKey); 5296 pIdxKey->errCode = 0; 5297 assert( pIdxKey->default_rc==1 5298 || pIdxKey->default_rc==0 5299 || pIdxKey->default_rc==-1 5300 ); 5301 }else{ 5302 xRecordCompare = 0; /* All keys are integers */ 5303 } 5304 5305 rc = moveToRoot(pCur); 5306 if( rc ){ 5307 if( rc==SQLITE_EMPTY ){ 5308 assert( pCur->pgnoRoot==0 || pCur->pPage->nCell==0 ); 5309 *pRes = -1; 5310 return SQLITE_OK; 5311 } 5312 return rc; 5313 } 5314 assert( pCur->pPage ); 5315 assert( pCur->pPage->isInit ); 5316 assert( pCur->eState==CURSOR_VALID ); 5317 assert( pCur->pPage->nCell > 0 ); 5318 assert( pCur->iPage==0 || pCur->apPage[0]->intKey==pCur->curIntKey ); 5319 assert( pCur->curIntKey || pIdxKey ); 5320 for(;;){ 5321 int lwr, upr, idx, c; 5322 Pgno chldPg; 5323 MemPage *pPage = pCur->pPage; 5324 u8 *pCell; /* Pointer to current cell in pPage */ 5325 5326 /* pPage->nCell must be greater than zero. If this is the root-page 5327 ** the cursor would have been INVALID above and this for(;;) loop 5328 ** not run. If this is not the root-page, then the moveToChild() routine 5329 ** would have already detected db corruption. Similarly, pPage must 5330 ** be the right kind (index or table) of b-tree page. Otherwise 5331 ** a moveToChild() or moveToRoot() call would have detected corruption. */ 5332 assert( pPage->nCell>0 ); 5333 assert( pPage->intKey==(pIdxKey==0) ); 5334 lwr = 0; 5335 upr = pPage->nCell-1; 5336 assert( biasRight==0 || biasRight==1 ); 5337 idx = upr>>(1-biasRight); /* idx = biasRight ? upr : (lwr+upr)/2; */ 5338 pCur->ix = (u16)idx; 5339 if( xRecordCompare==0 ){ 5340 for(;;){ 5341 i64 nCellKey; 5342 pCell = findCellPastPtr(pPage, idx); 5343 if( pPage->intKeyLeaf ){ 5344 while( 0x80 <= *(pCell++) ){ 5345 if( pCell>=pPage->aDataEnd ){ 5346 return SQLITE_CORRUPT_PAGE(pPage); 5347 } 5348 } 5349 } 5350 getVarint(pCell, (u64*)&nCellKey); 5351 if( nCellKey<intKey ){ 5352 lwr = idx+1; 5353 if( lwr>upr ){ c = -1; break; } 5354 }else if( nCellKey>intKey ){ 5355 upr = idx-1; 5356 if( lwr>upr ){ c = +1; break; } 5357 }else{ 5358 assert( nCellKey==intKey ); 5359 pCur->ix = (u16)idx; 5360 if( !pPage->leaf ){ 5361 lwr = idx; 5362 goto moveto_next_layer; 5363 }else{ 5364 pCur->curFlags |= BTCF_ValidNKey; 5365 pCur->info.nKey = nCellKey; 5366 pCur->info.nSize = 0; 5367 *pRes = 0; 5368 return SQLITE_OK; 5369 } 5370 } 5371 assert( lwr+upr>=0 ); 5372 idx = (lwr+upr)>>1; /* idx = (lwr+upr)/2; */ 5373 } 5374 }else{ 5375 for(;;){ 5376 int nCell; /* Size of the pCell cell in bytes */ 5377 pCell = findCellPastPtr(pPage, idx); 5378 5379 /* The maximum supported page-size is 65536 bytes. This means that 5380 ** the maximum number of record bytes stored on an index B-Tree 5381 ** page is less than 16384 bytes and may be stored as a 2-byte 5382 ** varint. This information is used to attempt to avoid parsing 5383 ** the entire cell by checking for the cases where the record is 5384 ** stored entirely within the b-tree page by inspecting the first 5385 ** 2 bytes of the cell. 5386 */ 5387 nCell = pCell[0]; 5388 if( nCell<=pPage->max1bytePayload ){ 5389 /* This branch runs if the record-size field of the cell is a 5390 ** single byte varint and the record fits entirely on the main 5391 ** b-tree page. */ 5392 testcase( pCell+nCell+1==pPage->aDataEnd ); 5393 c = xRecordCompare(nCell, (void*)&pCell[1], pIdxKey); 5394 }else if( !(pCell[1] & 0x80) 5395 && (nCell = ((nCell&0x7f)<<7) + pCell[1])<=pPage->maxLocal 5396 ){ 5397 /* The record-size field is a 2 byte varint and the record 5398 ** fits entirely on the main b-tree page. */ 5399 testcase( pCell+nCell+2==pPage->aDataEnd ); 5400 c = xRecordCompare(nCell, (void*)&pCell[2], pIdxKey); 5401 }else{ 5402 /* The record flows over onto one or more overflow pages. In 5403 ** this case the whole cell needs to be parsed, a buffer allocated 5404 ** and accessPayload() used to retrieve the record into the 5405 ** buffer before VdbeRecordCompare() can be called. 5406 ** 5407 ** If the record is corrupt, the xRecordCompare routine may read 5408 ** up to two varints past the end of the buffer. An extra 18 5409 ** bytes of padding is allocated at the end of the buffer in 5410 ** case this happens. */ 5411 void *pCellKey; 5412 u8 * const pCellBody = pCell - pPage->childPtrSize; 5413 pPage->xParseCell(pPage, pCellBody, &pCur->info); 5414 nCell = (int)pCur->info.nKey; 5415 testcase( nCell<0 ); /* True if key size is 2^32 or more */ 5416 testcase( nCell==0 ); /* Invalid key size: 0x80 0x80 0x00 */ 5417 testcase( nCell==1 ); /* Invalid key size: 0x80 0x80 0x01 */ 5418 testcase( nCell==2 ); /* Minimum legal index key size */ 5419 if( nCell<2 ){ 5420 rc = SQLITE_CORRUPT_PAGE(pPage); 5421 goto moveto_finish; 5422 } 5423 pCellKey = sqlite3Malloc( nCell+18 ); 5424 if( pCellKey==0 ){ 5425 rc = SQLITE_NOMEM_BKPT; 5426 goto moveto_finish; 5427 } 5428 pCur->ix = (u16)idx; 5429 rc = accessPayload(pCur, 0, nCell, (unsigned char*)pCellKey, 0); 5430 pCur->curFlags &= ~BTCF_ValidOvfl; 5431 if( rc ){ 5432 sqlite3_free(pCellKey); 5433 goto moveto_finish; 5434 } 5435 c = xRecordCompare(nCell, pCellKey, pIdxKey); 5436 sqlite3_free(pCellKey); 5437 } 5438 assert( 5439 (pIdxKey->errCode!=SQLITE_CORRUPT || c==0) 5440 && (pIdxKey->errCode!=SQLITE_NOMEM || pCur->pBtree->db->mallocFailed) 5441 ); 5442 if( c<0 ){ 5443 lwr = idx+1; 5444 }else if( c>0 ){ 5445 upr = idx-1; 5446 }else{ 5447 assert( c==0 ); 5448 *pRes = 0; 5449 rc = SQLITE_OK; 5450 pCur->ix = (u16)idx; 5451 if( pIdxKey->errCode ) rc = SQLITE_CORRUPT_BKPT; 5452 goto moveto_finish; 5453 } 5454 if( lwr>upr ) break; 5455 assert( lwr+upr>=0 ); 5456 idx = (lwr+upr)>>1; /* idx = (lwr+upr)/2 */ 5457 } 5458 } 5459 assert( lwr==upr+1 || (pPage->intKey && !pPage->leaf) ); 5460 assert( pPage->isInit ); 5461 if( pPage->leaf ){ 5462 assert( pCur->ix<pCur->pPage->nCell ); 5463 pCur->ix = (u16)idx; 5464 *pRes = c; 5465 rc = SQLITE_OK; 5466 goto moveto_finish; 5467 } 5468 moveto_next_layer: 5469 if( lwr>=pPage->nCell ){ 5470 chldPg = get4byte(&pPage->aData[pPage->hdrOffset+8]); 5471 }else{ 5472 chldPg = get4byte(findCell(pPage, lwr)); 5473 } 5474 pCur->ix = (u16)lwr; 5475 rc = moveToChild(pCur, chldPg); 5476 if( rc ) break; 5477 } 5478 moveto_finish: 5479 pCur->info.nSize = 0; 5480 assert( (pCur->curFlags & BTCF_ValidOvfl)==0 ); 5481 return rc; 5482 } 5483 5484 5485 /* 5486 ** Return TRUE if the cursor is not pointing at an entry of the table. 5487 ** 5488 ** TRUE will be returned after a call to sqlite3BtreeNext() moves 5489 ** past the last entry in the table or sqlite3BtreePrev() moves past 5490 ** the first entry. TRUE is also returned if the table is empty. 5491 */ 5492 int sqlite3BtreeEof(BtCursor *pCur){ 5493 /* TODO: What if the cursor is in CURSOR_REQUIRESEEK but all table entries 5494 ** have been deleted? This API will need to change to return an error code 5495 ** as well as the boolean result value. 5496 */ 5497 return (CURSOR_VALID!=pCur->eState); 5498 } 5499 5500 /* 5501 ** Return an estimate for the number of rows in the table that pCur is 5502 ** pointing to. Return a negative number if no estimate is currently 5503 ** available. 5504 */ 5505 i64 sqlite3BtreeRowCountEst(BtCursor *pCur){ 5506 i64 n; 5507 u8 i; 5508 5509 assert( cursorOwnsBtShared(pCur) ); 5510 assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) ); 5511 5512 /* Currently this interface is only called by the OP_IfSmaller 5513 ** opcode, and it that case the cursor will always be valid and 5514 ** will always point to a leaf node. */ 5515 if( NEVER(pCur->eState!=CURSOR_VALID) ) return -1; 5516 if( NEVER(pCur->pPage->leaf==0) ) return -1; 5517 5518 n = pCur->pPage->nCell; 5519 for(i=0; i<pCur->iPage; i++){ 5520 n *= pCur->apPage[i]->nCell; 5521 } 5522 return n; 5523 } 5524 5525 /* 5526 ** Advance the cursor to the next entry in the database. 5527 ** Return value: 5528 ** 5529 ** SQLITE_OK success 5530 ** SQLITE_DONE cursor is already pointing at the last element 5531 ** otherwise some kind of error occurred 5532 ** 5533 ** The main entry point is sqlite3BtreeNext(). That routine is optimized 5534 ** for the common case of merely incrementing the cell counter BtCursor.aiIdx 5535 ** to the next cell on the current page. The (slower) btreeNext() helper 5536 ** routine is called when it is necessary to move to a different page or 5537 ** to restore the cursor. 5538 ** 5539 ** If bit 0x01 of the F argument in sqlite3BtreeNext(C,F) is 1, then the 5540 ** cursor corresponds to an SQL index and this routine could have been 5541 ** skipped if the SQL index had been a unique index. The F argument 5542 ** is a hint to the implement. SQLite btree implementation does not use 5543 ** this hint, but COMDB2 does. 5544 */ 5545 static SQLITE_NOINLINE int btreeNext(BtCursor *pCur){ 5546 int rc; 5547 int idx; 5548 MemPage *pPage; 5549 5550 assert( cursorOwnsBtShared(pCur) ); 5551 assert( pCur->skipNext==0 || pCur->eState!=CURSOR_VALID ); 5552 if( pCur->eState!=CURSOR_VALID ){ 5553 assert( (pCur->curFlags & BTCF_ValidOvfl)==0 ); 5554 rc = restoreCursorPosition(pCur); 5555 if( rc!=SQLITE_OK ){ 5556 return rc; 5557 } 5558 if( CURSOR_INVALID==pCur->eState ){ 5559 return SQLITE_DONE; 5560 } 5561 if( pCur->skipNext ){ 5562 assert( pCur->eState==CURSOR_VALID || pCur->eState==CURSOR_SKIPNEXT ); 5563 pCur->eState = CURSOR_VALID; 5564 if( pCur->skipNext>0 ){ 5565 pCur->skipNext = 0; 5566 return SQLITE_OK; 5567 } 5568 pCur->skipNext = 0; 5569 } 5570 } 5571 5572 pPage = pCur->pPage; 5573 idx = ++pCur->ix; 5574 assert( pPage->isInit ); 5575 5576 /* If the database file is corrupt, it is possible for the value of idx 5577 ** to be invalid here. This can only occur if a second cursor modifies 5578 ** the page while cursor pCur is holding a reference to it. Which can 5579 ** only happen if the database is corrupt in such a way as to link the 5580 ** page into more than one b-tree structure. */ 5581 testcase( idx>pPage->nCell ); 5582 5583 if( idx>=pPage->nCell ){ 5584 if( !pPage->leaf ){ 5585 rc = moveToChild(pCur, get4byte(&pPage->aData[pPage->hdrOffset+8])); 5586 if( rc ) return rc; 5587 return moveToLeftmost(pCur); 5588 } 5589 do{ 5590 if( pCur->iPage==0 ){ 5591 pCur->eState = CURSOR_INVALID; 5592 return SQLITE_DONE; 5593 } 5594 moveToParent(pCur); 5595 pPage = pCur->pPage; 5596 }while( pCur->ix>=pPage->nCell ); 5597 if( pPage->intKey ){ 5598 return sqlite3BtreeNext(pCur, 0); 5599 }else{ 5600 return SQLITE_OK; 5601 } 5602 } 5603 if( pPage->leaf ){ 5604 return SQLITE_OK; 5605 }else{ 5606 return moveToLeftmost(pCur); 5607 } 5608 } 5609 int sqlite3BtreeNext(BtCursor *pCur, int flags){ 5610 MemPage *pPage; 5611 UNUSED_PARAMETER( flags ); /* Used in COMDB2 but not native SQLite */ 5612 assert( cursorOwnsBtShared(pCur) ); 5613 assert( flags==0 || flags==1 ); 5614 assert( pCur->skipNext==0 || pCur->eState!=CURSOR_VALID ); 5615 pCur->info.nSize = 0; 5616 pCur->curFlags &= ~(BTCF_ValidNKey|BTCF_ValidOvfl); 5617 if( pCur->eState!=CURSOR_VALID ) return btreeNext(pCur); 5618 pPage = pCur->pPage; 5619 if( (++pCur->ix)>=pPage->nCell ){ 5620 pCur->ix--; 5621 return btreeNext(pCur); 5622 } 5623 if( pPage->leaf ){ 5624 return SQLITE_OK; 5625 }else{ 5626 return moveToLeftmost(pCur); 5627 } 5628 } 5629 5630 /* 5631 ** Step the cursor to the back to the previous entry in the database. 5632 ** Return values: 5633 ** 5634 ** SQLITE_OK success 5635 ** SQLITE_DONE the cursor is already on the first element of the table 5636 ** otherwise some kind of error occurred 5637 ** 5638 ** The main entry point is sqlite3BtreePrevious(). That routine is optimized 5639 ** for the common case of merely decrementing the cell counter BtCursor.aiIdx 5640 ** to the previous cell on the current page. The (slower) btreePrevious() 5641 ** helper routine is called when it is necessary to move to a different page 5642 ** or to restore the cursor. 5643 ** 5644 ** If bit 0x01 of the F argument to sqlite3BtreePrevious(C,F) is 1, then 5645 ** the cursor corresponds to an SQL index and this routine could have been 5646 ** skipped if the SQL index had been a unique index. The F argument is a 5647 ** hint to the implement. The native SQLite btree implementation does not 5648 ** use this hint, but COMDB2 does. 5649 */ 5650 static SQLITE_NOINLINE int btreePrevious(BtCursor *pCur){ 5651 int rc; 5652 MemPage *pPage; 5653 5654 assert( cursorOwnsBtShared(pCur) ); 5655 assert( pCur->skipNext==0 || pCur->eState!=CURSOR_VALID ); 5656 assert( (pCur->curFlags & (BTCF_AtLast|BTCF_ValidOvfl|BTCF_ValidNKey))==0 ); 5657 assert( pCur->info.nSize==0 ); 5658 if( pCur->eState!=CURSOR_VALID ){ 5659 rc = restoreCursorPosition(pCur); 5660 if( rc!=SQLITE_OK ){ 5661 return rc; 5662 } 5663 if( CURSOR_INVALID==pCur->eState ){ 5664 return SQLITE_DONE; 5665 } 5666 if( pCur->skipNext ){ 5667 assert( pCur->eState==CURSOR_VALID || pCur->eState==CURSOR_SKIPNEXT ); 5668 pCur->eState = CURSOR_VALID; 5669 if( pCur->skipNext<0 ){ 5670 pCur->skipNext = 0; 5671 return SQLITE_OK; 5672 } 5673 pCur->skipNext = 0; 5674 } 5675 } 5676 5677 pPage = pCur->pPage; 5678 assert( pPage->isInit ); 5679 if( !pPage->leaf ){ 5680 int idx = pCur->ix; 5681 rc = moveToChild(pCur, get4byte(findCell(pPage, idx))); 5682 if( rc ) return rc; 5683 rc = moveToRightmost(pCur); 5684 }else{ 5685 while( pCur->ix==0 ){ 5686 if( pCur->iPage==0 ){ 5687 pCur->eState = CURSOR_INVALID; 5688 return SQLITE_DONE; 5689 } 5690 moveToParent(pCur); 5691 } 5692 assert( pCur->info.nSize==0 ); 5693 assert( (pCur->curFlags & (BTCF_ValidOvfl))==0 ); 5694 5695 pCur->ix--; 5696 pPage = pCur->pPage; 5697 if( pPage->intKey && !pPage->leaf ){ 5698 rc = sqlite3BtreePrevious(pCur, 0); 5699 }else{ 5700 rc = SQLITE_OK; 5701 } 5702 } 5703 return rc; 5704 } 5705 int sqlite3BtreePrevious(BtCursor *pCur, int flags){ 5706 assert( cursorOwnsBtShared(pCur) ); 5707 assert( flags==0 || flags==1 ); 5708 assert( pCur->skipNext==0 || pCur->eState!=CURSOR_VALID ); 5709 UNUSED_PARAMETER( flags ); /* Used in COMDB2 but not native SQLite */ 5710 pCur->curFlags &= ~(BTCF_AtLast|BTCF_ValidOvfl|BTCF_ValidNKey); 5711 pCur->info.nSize = 0; 5712 if( pCur->eState!=CURSOR_VALID 5713 || pCur->ix==0 5714 || pCur->pPage->leaf==0 5715 ){ 5716 return btreePrevious(pCur); 5717 } 5718 pCur->ix--; 5719 return SQLITE_OK; 5720 } 5721 5722 /* 5723 ** Allocate a new page from the database file. 5724 ** 5725 ** The new page is marked as dirty. (In other words, sqlite3PagerWrite() 5726 ** has already been called on the new page.) The new page has also 5727 ** been referenced and the calling routine is responsible for calling 5728 ** sqlite3PagerUnref() on the new page when it is done. 5729 ** 5730 ** SQLITE_OK is returned on success. Any other return value indicates 5731 ** an error. *ppPage is set to NULL in the event of an error. 5732 ** 5733 ** If the "nearby" parameter is not 0, then an effort is made to 5734 ** locate a page close to the page number "nearby". This can be used in an 5735 ** attempt to keep related pages close to each other in the database file, 5736 ** which in turn can make database access faster. 5737 ** 5738 ** If the eMode parameter is BTALLOC_EXACT and the nearby page exists 5739 ** anywhere on the free-list, then it is guaranteed to be returned. If 5740 ** eMode is BTALLOC_LT then the page returned will be less than or equal 5741 ** to nearby if any such page exists. If eMode is BTALLOC_ANY then there 5742 ** are no restrictions on which page is returned. 5743 */ 5744 static int allocateBtreePage( 5745 BtShared *pBt, /* The btree */ 5746 MemPage **ppPage, /* Store pointer to the allocated page here */ 5747 Pgno *pPgno, /* Store the page number here */ 5748 Pgno nearby, /* Search for a page near this one */ 5749 u8 eMode /* BTALLOC_EXACT, BTALLOC_LT, or BTALLOC_ANY */ 5750 ){ 5751 MemPage *pPage1; 5752 int rc; 5753 u32 n; /* Number of pages on the freelist */ 5754 u32 k; /* Number of leaves on the trunk of the freelist */ 5755 MemPage *pTrunk = 0; 5756 MemPage *pPrevTrunk = 0; 5757 Pgno mxPage; /* Total size of the database file */ 5758 5759 assert( sqlite3_mutex_held(pBt->mutex) ); 5760 assert( eMode==BTALLOC_ANY || (nearby>0 && IfNotOmitAV(pBt->autoVacuum)) ); 5761 pPage1 = pBt->pPage1; 5762 mxPage = btreePagecount(pBt); 5763 /* EVIDENCE-OF: R-05119-02637 The 4-byte big-endian integer at offset 36 5764 ** stores stores the total number of pages on the freelist. */ 5765 n = get4byte(&pPage1->aData[36]); 5766 testcase( n==mxPage-1 ); 5767 if( n>=mxPage ){ 5768 return SQLITE_CORRUPT_BKPT; 5769 } 5770 if( n>0 ){ 5771 /* There are pages on the freelist. Reuse one of those pages. */ 5772 Pgno iTrunk; 5773 u8 searchList = 0; /* If the free-list must be searched for 'nearby' */ 5774 u32 nSearch = 0; /* Count of the number of search attempts */ 5775 5776 /* If eMode==BTALLOC_EXACT and a query of the pointer-map 5777 ** shows that the page 'nearby' is somewhere on the free-list, then 5778 ** the entire-list will be searched for that page. 5779 */ 5780 #ifndef SQLITE_OMIT_AUTOVACUUM 5781 if( eMode==BTALLOC_EXACT ){ 5782 if( nearby<=mxPage ){ 5783 u8 eType; 5784 assert( nearby>0 ); 5785 assert( pBt->autoVacuum ); 5786 rc = ptrmapGet(pBt, nearby, &eType, 0); 5787 if( rc ) return rc; 5788 if( eType==PTRMAP_FREEPAGE ){ 5789 searchList = 1; 5790 } 5791 } 5792 }else if( eMode==BTALLOC_LE ){ 5793 searchList = 1; 5794 } 5795 #endif 5796 5797 /* Decrement the free-list count by 1. Set iTrunk to the index of the 5798 ** first free-list trunk page. iPrevTrunk is initially 1. 5799 */ 5800 rc = sqlite3PagerWrite(pPage1->pDbPage); 5801 if( rc ) return rc; 5802 put4byte(&pPage1->aData[36], n-1); 5803 5804 /* The code within this loop is run only once if the 'searchList' variable 5805 ** is not true. Otherwise, it runs once for each trunk-page on the 5806 ** free-list until the page 'nearby' is located (eMode==BTALLOC_EXACT) 5807 ** or until a page less than 'nearby' is located (eMode==BTALLOC_LT) 5808 */ 5809 do { 5810 pPrevTrunk = pTrunk; 5811 if( pPrevTrunk ){ 5812 /* EVIDENCE-OF: R-01506-11053 The first integer on a freelist trunk page 5813 ** is the page number of the next freelist trunk page in the list or 5814 ** zero if this is the last freelist trunk page. */ 5815 iTrunk = get4byte(&pPrevTrunk->aData[0]); 5816 }else{ 5817 /* EVIDENCE-OF: R-59841-13798 The 4-byte big-endian integer at offset 32 5818 ** stores the page number of the first page of the freelist, or zero if 5819 ** the freelist is empty. */ 5820 iTrunk = get4byte(&pPage1->aData[32]); 5821 } 5822 testcase( iTrunk==mxPage ); 5823 if( iTrunk>mxPage || nSearch++ > n ){ 5824 rc = SQLITE_CORRUPT_PGNO(pPrevTrunk ? pPrevTrunk->pgno : 1); 5825 }else{ 5826 rc = btreeGetUnusedPage(pBt, iTrunk, &pTrunk, 0); 5827 } 5828 if( rc ){ 5829 pTrunk = 0; 5830 goto end_allocate_page; 5831 } 5832 assert( pTrunk!=0 ); 5833 assert( pTrunk->aData!=0 ); 5834 /* EVIDENCE-OF: R-13523-04394 The second integer on a freelist trunk page 5835 ** is the number of leaf page pointers to follow. */ 5836 k = get4byte(&pTrunk->aData[4]); 5837 if( k==0 && !searchList ){ 5838 /* The trunk has no leaves and the list is not being searched. 5839 ** So extract the trunk page itself and use it as the newly 5840 ** allocated page */ 5841 assert( pPrevTrunk==0 ); 5842 rc = sqlite3PagerWrite(pTrunk->pDbPage); 5843 if( rc ){ 5844 goto end_allocate_page; 5845 } 5846 *pPgno = iTrunk; 5847 memcpy(&pPage1->aData[32], &pTrunk->aData[0], 4); 5848 *ppPage = pTrunk; 5849 pTrunk = 0; 5850 TRACE(("ALLOCATE: %d trunk - %d free pages left\n", *pPgno, n-1)); 5851 }else if( k>(u32)(pBt->usableSize/4 - 2) ){ 5852 /* Value of k is out of range. Database corruption */ 5853 rc = SQLITE_CORRUPT_PGNO(iTrunk); 5854 goto end_allocate_page; 5855 #ifndef SQLITE_OMIT_AUTOVACUUM 5856 }else if( searchList 5857 && (nearby==iTrunk || (iTrunk<nearby && eMode==BTALLOC_LE)) 5858 ){ 5859 /* The list is being searched and this trunk page is the page 5860 ** to allocate, regardless of whether it has leaves. 5861 */ 5862 *pPgno = iTrunk; 5863 *ppPage = pTrunk; 5864 searchList = 0; 5865 rc = sqlite3PagerWrite(pTrunk->pDbPage); 5866 if( rc ){ 5867 goto end_allocate_page; 5868 } 5869 if( k==0 ){ 5870 if( !pPrevTrunk ){ 5871 memcpy(&pPage1->aData[32], &pTrunk->aData[0], 4); 5872 }else{ 5873 rc = sqlite3PagerWrite(pPrevTrunk->pDbPage); 5874 if( rc!=SQLITE_OK ){ 5875 goto end_allocate_page; 5876 } 5877 memcpy(&pPrevTrunk->aData[0], &pTrunk->aData[0], 4); 5878 } 5879 }else{ 5880 /* The trunk page is required by the caller but it contains 5881 ** pointers to free-list leaves. The first leaf becomes a trunk 5882 ** page in this case. 5883 */ 5884 MemPage *pNewTrunk; 5885 Pgno iNewTrunk = get4byte(&pTrunk->aData[8]); 5886 if( iNewTrunk>mxPage ){ 5887 rc = SQLITE_CORRUPT_PGNO(iTrunk); 5888 goto end_allocate_page; 5889 } 5890 testcase( iNewTrunk==mxPage ); 5891 rc = btreeGetUnusedPage(pBt, iNewTrunk, &pNewTrunk, 0); 5892 if( rc!=SQLITE_OK ){ 5893 goto end_allocate_page; 5894 } 5895 rc = sqlite3PagerWrite(pNewTrunk->pDbPage); 5896 if( rc!=SQLITE_OK ){ 5897 releasePage(pNewTrunk); 5898 goto end_allocate_page; 5899 } 5900 memcpy(&pNewTrunk->aData[0], &pTrunk->aData[0], 4); 5901 put4byte(&pNewTrunk->aData[4], k-1); 5902 memcpy(&pNewTrunk->aData[8], &pTrunk->aData[12], (k-1)*4); 5903 releasePage(pNewTrunk); 5904 if( !pPrevTrunk ){ 5905 assert( sqlite3PagerIswriteable(pPage1->pDbPage) ); 5906 put4byte(&pPage1->aData[32], iNewTrunk); 5907 }else{ 5908 rc = sqlite3PagerWrite(pPrevTrunk->pDbPage); 5909 if( rc ){ 5910 goto end_allocate_page; 5911 } 5912 put4byte(&pPrevTrunk->aData[0], iNewTrunk); 5913 } 5914 } 5915 pTrunk = 0; 5916 TRACE(("ALLOCATE: %d trunk - %d free pages left\n", *pPgno, n-1)); 5917 #endif 5918 }else if( k>0 ){ 5919 /* Extract a leaf from the trunk */ 5920 u32 closest; 5921 Pgno iPage; 5922 unsigned char *aData = pTrunk->aData; 5923 if( nearby>0 ){ 5924 u32 i; 5925 closest = 0; 5926 if( eMode==BTALLOC_LE ){ 5927 for(i=0; i<k; i++){ 5928 iPage = get4byte(&aData[8+i*4]); 5929 if( iPage<=nearby ){ 5930 closest = i; 5931 break; 5932 } 5933 } 5934 }else{ 5935 int dist; 5936 dist = sqlite3AbsInt32(get4byte(&aData[8]) - nearby); 5937 for(i=1; i<k; i++){ 5938 int d2 = sqlite3AbsInt32(get4byte(&aData[8+i*4]) - nearby); 5939 if( d2<dist ){ 5940 closest = i; 5941 dist = d2; 5942 } 5943 } 5944 } 5945 }else{ 5946 closest = 0; 5947 } 5948 5949 iPage = get4byte(&aData[8+closest*4]); 5950 testcase( iPage==mxPage ); 5951 if( iPage>mxPage ){ 5952 rc = SQLITE_CORRUPT_PGNO(iTrunk); 5953 goto end_allocate_page; 5954 } 5955 testcase( iPage==mxPage ); 5956 if( !searchList 5957 || (iPage==nearby || (iPage<nearby && eMode==BTALLOC_LE)) 5958 ){ 5959 int noContent; 5960 *pPgno = iPage; 5961 TRACE(("ALLOCATE: %d was leaf %d of %d on trunk %d" 5962 ": %d more free pages\n", 5963 *pPgno, closest+1, k, pTrunk->pgno, n-1)); 5964 rc = sqlite3PagerWrite(pTrunk->pDbPage); 5965 if( rc ) goto end_allocate_page; 5966 if( closest<k-1 ){ 5967 memcpy(&aData[8+closest*4], &aData[4+k*4], 4); 5968 } 5969 put4byte(&aData[4], k-1); 5970 noContent = !btreeGetHasContent(pBt, *pPgno)? PAGER_GET_NOCONTENT : 0; 5971 rc = btreeGetUnusedPage(pBt, *pPgno, ppPage, noContent); 5972 if( rc==SQLITE_OK ){ 5973 rc = sqlite3PagerWrite((*ppPage)->pDbPage); 5974 if( rc!=SQLITE_OK ){ 5975 releasePage(*ppPage); 5976 *ppPage = 0; 5977 } 5978 } 5979 searchList = 0; 5980 } 5981 } 5982 releasePage(pPrevTrunk); 5983 pPrevTrunk = 0; 5984 }while( searchList ); 5985 }else{ 5986 /* There are no pages on the freelist, so append a new page to the 5987 ** database image. 5988 ** 5989 ** Normally, new pages allocated by this block can be requested from the 5990 ** pager layer with the 'no-content' flag set. This prevents the pager 5991 ** from trying to read the pages content from disk. However, if the 5992 ** current transaction has already run one or more incremental-vacuum 5993 ** steps, then the page we are about to allocate may contain content 5994 ** that is required in the event of a rollback. In this case, do 5995 ** not set the no-content flag. This causes the pager to load and journal 5996 ** the current page content before overwriting it. 5997 ** 5998 ** Note that the pager will not actually attempt to load or journal 5999 ** content for any page that really does lie past the end of the database 6000 ** file on disk. So the effects of disabling the no-content optimization 6001 ** here are confined to those pages that lie between the end of the 6002 ** database image and the end of the database file. 6003 */ 6004 int bNoContent = (0==IfNotOmitAV(pBt->bDoTruncate))? PAGER_GET_NOCONTENT:0; 6005 6006 rc = sqlite3PagerWrite(pBt->pPage1->pDbPage); 6007 if( rc ) return rc; 6008 pBt->nPage++; 6009 if( pBt->nPage==PENDING_BYTE_PAGE(pBt) ) pBt->nPage++; 6010 6011 #ifndef SQLITE_OMIT_AUTOVACUUM 6012 if( pBt->autoVacuum && PTRMAP_ISPAGE(pBt, pBt->nPage) ){ 6013 /* If *pPgno refers to a pointer-map page, allocate two new pages 6014 ** at the end of the file instead of one. The first allocated page 6015 ** becomes a new pointer-map page, the second is used by the caller. 6016 */ 6017 MemPage *pPg = 0; 6018 TRACE(("ALLOCATE: %d from end of file (pointer-map page)\n", pBt->nPage)); 6019 assert( pBt->nPage!=PENDING_BYTE_PAGE(pBt) ); 6020 rc = btreeGetUnusedPage(pBt, pBt->nPage, &pPg, bNoContent); 6021 if( rc==SQLITE_OK ){ 6022 rc = sqlite3PagerWrite(pPg->pDbPage); 6023 releasePage(pPg); 6024 } 6025 if( rc ) return rc; 6026 pBt->nPage++; 6027 if( pBt->nPage==PENDING_BYTE_PAGE(pBt) ){ pBt->nPage++; } 6028 } 6029 #endif 6030 put4byte(28 + (u8*)pBt->pPage1->aData, pBt->nPage); 6031 *pPgno = pBt->nPage; 6032 6033 assert( *pPgno!=PENDING_BYTE_PAGE(pBt) ); 6034 rc = btreeGetUnusedPage(pBt, *pPgno, ppPage, bNoContent); 6035 if( rc ) return rc; 6036 rc = sqlite3PagerWrite((*ppPage)->pDbPage); 6037 if( rc!=SQLITE_OK ){ 6038 releasePage(*ppPage); 6039 *ppPage = 0; 6040 } 6041 TRACE(("ALLOCATE: %d from end of file\n", *pPgno)); 6042 } 6043 6044 assert( *pPgno!=PENDING_BYTE_PAGE(pBt) ); 6045 6046 end_allocate_page: 6047 releasePage(pTrunk); 6048 releasePage(pPrevTrunk); 6049 assert( rc!=SQLITE_OK || sqlite3PagerPageRefcount((*ppPage)->pDbPage)<=1 ); 6050 assert( rc!=SQLITE_OK || (*ppPage)->isInit==0 ); 6051 return rc; 6052 } 6053 6054 /* 6055 ** This function is used to add page iPage to the database file free-list. 6056 ** It is assumed that the page is not already a part of the free-list. 6057 ** 6058 ** The value passed as the second argument to this function is optional. 6059 ** If the caller happens to have a pointer to the MemPage object 6060 ** corresponding to page iPage handy, it may pass it as the second value. 6061 ** Otherwise, it may pass NULL. 6062 ** 6063 ** If a pointer to a MemPage object is passed as the second argument, 6064 ** its reference count is not altered by this function. 6065 */ 6066 static int freePage2(BtShared *pBt, MemPage *pMemPage, Pgno iPage){ 6067 MemPage *pTrunk = 0; /* Free-list trunk page */ 6068 Pgno iTrunk = 0; /* Page number of free-list trunk page */ 6069 MemPage *pPage1 = pBt->pPage1; /* Local reference to page 1 */ 6070 MemPage *pPage; /* Page being freed. May be NULL. */ 6071 int rc; /* Return Code */ 6072 int nFree; /* Initial number of pages on free-list */ 6073 6074 assert( sqlite3_mutex_held(pBt->mutex) ); 6075 assert( CORRUPT_DB || iPage>1 ); 6076 assert( !pMemPage || pMemPage->pgno==iPage ); 6077 6078 if( iPage<2 ) return SQLITE_CORRUPT_BKPT; 6079 if( pMemPage ){ 6080 pPage = pMemPage; 6081 sqlite3PagerRef(pPage->pDbPage); 6082 }else{ 6083 pPage = btreePageLookup(pBt, iPage); 6084 } 6085 6086 /* Increment the free page count on pPage1 */ 6087 rc = sqlite3PagerWrite(pPage1->pDbPage); 6088 if( rc ) goto freepage_out; 6089 nFree = get4byte(&pPage1->aData[36]); 6090 put4byte(&pPage1->aData[36], nFree+1); 6091 6092 if( pBt->btsFlags & BTS_SECURE_DELETE ){ 6093 /* If the secure_delete option is enabled, then 6094 ** always fully overwrite deleted information with zeros. 6095 */ 6096 if( (!pPage && ((rc = btreeGetPage(pBt, iPage, &pPage, 0))!=0) ) 6097 || ((rc = sqlite3PagerWrite(pPage->pDbPage))!=0) 6098 ){ 6099 goto freepage_out; 6100 } 6101 memset(pPage->aData, 0, pPage->pBt->pageSize); 6102 } 6103 6104 /* If the database supports auto-vacuum, write an entry in the pointer-map 6105 ** to indicate that the page is free. 6106 */ 6107 if( ISAUTOVACUUM ){ 6108 ptrmapPut(pBt, iPage, PTRMAP_FREEPAGE, 0, &rc); 6109 if( rc ) goto freepage_out; 6110 } 6111 6112 /* Now manipulate the actual database free-list structure. There are two 6113 ** possibilities. If the free-list is currently empty, or if the first 6114 ** trunk page in the free-list is full, then this page will become a 6115 ** new free-list trunk page. Otherwise, it will become a leaf of the 6116 ** first trunk page in the current free-list. This block tests if it 6117 ** is possible to add the page as a new free-list leaf. 6118 */ 6119 if( nFree!=0 ){ 6120 u32 nLeaf; /* Initial number of leaf cells on trunk page */ 6121 6122 iTrunk = get4byte(&pPage1->aData[32]); 6123 rc = btreeGetPage(pBt, iTrunk, &pTrunk, 0); 6124 if( rc!=SQLITE_OK ){ 6125 goto freepage_out; 6126 } 6127 6128 nLeaf = get4byte(&pTrunk->aData[4]); 6129 assert( pBt->usableSize>32 ); 6130 if( nLeaf > (u32)pBt->usableSize/4 - 2 ){ 6131 rc = SQLITE_CORRUPT_BKPT; 6132 goto freepage_out; 6133 } 6134 if( nLeaf < (u32)pBt->usableSize/4 - 8 ){ 6135 /* In this case there is room on the trunk page to insert the page 6136 ** being freed as a new leaf. 6137 ** 6138 ** Note that the trunk page is not really full until it contains 6139 ** usableSize/4 - 2 entries, not usableSize/4 - 8 entries as we have 6140 ** coded. But due to a coding error in versions of SQLite prior to 6141 ** 3.6.0, databases with freelist trunk pages holding more than 6142 ** usableSize/4 - 8 entries will be reported as corrupt. In order 6143 ** to maintain backwards compatibility with older versions of SQLite, 6144 ** we will continue to restrict the number of entries to usableSize/4 - 8 6145 ** for now. At some point in the future (once everyone has upgraded 6146 ** to 3.6.0 or later) we should consider fixing the conditional above 6147 ** to read "usableSize/4-2" instead of "usableSize/4-8". 6148 ** 6149 ** EVIDENCE-OF: R-19920-11576 However, newer versions of SQLite still 6150 ** avoid using the last six entries in the freelist trunk page array in 6151 ** order that database files created by newer versions of SQLite can be 6152 ** read by older versions of SQLite. 6153 */ 6154 rc = sqlite3PagerWrite(pTrunk->pDbPage); 6155 if( rc==SQLITE_OK ){ 6156 put4byte(&pTrunk->aData[4], nLeaf+1); 6157 put4byte(&pTrunk->aData[8+nLeaf*4], iPage); 6158 if( pPage && (pBt->btsFlags & BTS_SECURE_DELETE)==0 ){ 6159 sqlite3PagerDontWrite(pPage->pDbPage); 6160 } 6161 rc = btreeSetHasContent(pBt, iPage); 6162 } 6163 TRACE(("FREE-PAGE: %d leaf on trunk page %d\n",pPage->pgno,pTrunk->pgno)); 6164 goto freepage_out; 6165 } 6166 } 6167 6168 /* If control flows to this point, then it was not possible to add the 6169 ** the page being freed as a leaf page of the first trunk in the free-list. 6170 ** Possibly because the free-list is empty, or possibly because the 6171 ** first trunk in the free-list is full. Either way, the page being freed 6172 ** will become the new first trunk page in the free-list. 6173 */ 6174 if( pPage==0 && SQLITE_OK!=(rc = btreeGetPage(pBt, iPage, &pPage, 0)) ){ 6175 goto freepage_out; 6176 } 6177 rc = sqlite3PagerWrite(pPage->pDbPage); 6178 if( rc!=SQLITE_OK ){ 6179 goto freepage_out; 6180 } 6181 put4byte(pPage->aData, iTrunk); 6182 put4byte(&pPage->aData[4], 0); 6183 put4byte(&pPage1->aData[32], iPage); 6184 TRACE(("FREE-PAGE: %d new trunk page replacing %d\n", pPage->pgno, iTrunk)); 6185 6186 freepage_out: 6187 if( pPage ){ 6188 pPage->isInit = 0; 6189 } 6190 releasePage(pPage); 6191 releasePage(pTrunk); 6192 return rc; 6193 } 6194 static void freePage(MemPage *pPage, int *pRC){ 6195 if( (*pRC)==SQLITE_OK ){ 6196 *pRC = freePage2(pPage->pBt, pPage, pPage->pgno); 6197 } 6198 } 6199 6200 /* 6201 ** Free any overflow pages associated with the given Cell. Store 6202 ** size information about the cell in pInfo. 6203 */ 6204 static int clearCell( 6205 MemPage *pPage, /* The page that contains the Cell */ 6206 unsigned char *pCell, /* First byte of the Cell */ 6207 CellInfo *pInfo /* Size information about the cell */ 6208 ){ 6209 BtShared *pBt; 6210 Pgno ovflPgno; 6211 int rc; 6212 int nOvfl; 6213 u32 ovflPageSize; 6214 6215 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 6216 pPage->xParseCell(pPage, pCell, pInfo); 6217 if( pInfo->nLocal==pInfo->nPayload ){ 6218 return SQLITE_OK; /* No overflow pages. Return without doing anything */ 6219 } 6220 if( pCell+pInfo->nSize-1 > pPage->aData+pPage->maskPage ){ 6221 /* Cell extends past end of page */ 6222 return SQLITE_CORRUPT_PAGE(pPage); 6223 } 6224 ovflPgno = get4byte(pCell + pInfo->nSize - 4); 6225 pBt = pPage->pBt; 6226 assert( pBt->usableSize > 4 ); 6227 ovflPageSize = pBt->usableSize - 4; 6228 nOvfl = (pInfo->nPayload - pInfo->nLocal + ovflPageSize - 1)/ovflPageSize; 6229 assert( nOvfl>0 || 6230 (CORRUPT_DB && (pInfo->nPayload + ovflPageSize)<ovflPageSize) 6231 ); 6232 while( nOvfl-- ){ 6233 Pgno iNext = 0; 6234 MemPage *pOvfl = 0; 6235 if( ovflPgno<2 || ovflPgno>btreePagecount(pBt) ){ 6236 /* 0 is not a legal page number and page 1 cannot be an 6237 ** overflow page. Therefore if ovflPgno<2 or past the end of the 6238 ** file the database must be corrupt. */ 6239 return SQLITE_CORRUPT_BKPT; 6240 } 6241 if( nOvfl ){ 6242 rc = getOverflowPage(pBt, ovflPgno, &pOvfl, &iNext); 6243 if( rc ) return rc; 6244 } 6245 6246 if( ( pOvfl || ((pOvfl = btreePageLookup(pBt, ovflPgno))!=0) ) 6247 && sqlite3PagerPageRefcount(pOvfl->pDbPage)!=1 6248 ){ 6249 /* There is no reason any cursor should have an outstanding reference 6250 ** to an overflow page belonging to a cell that is being deleted/updated. 6251 ** So if there exists more than one reference to this page, then it 6252 ** must not really be an overflow page and the database must be corrupt. 6253 ** It is helpful to detect this before calling freePage2(), as 6254 ** freePage2() may zero the page contents if secure-delete mode is 6255 ** enabled. If this 'overflow' page happens to be a page that the 6256 ** caller is iterating through or using in some other way, this 6257 ** can be problematic. 6258 */ 6259 rc = SQLITE_CORRUPT_BKPT; 6260 }else{ 6261 rc = freePage2(pBt, pOvfl, ovflPgno); 6262 } 6263 6264 if( pOvfl ){ 6265 sqlite3PagerUnref(pOvfl->pDbPage); 6266 } 6267 if( rc ) return rc; 6268 ovflPgno = iNext; 6269 } 6270 return SQLITE_OK; 6271 } 6272 6273 /* 6274 ** Create the byte sequence used to represent a cell on page pPage 6275 ** and write that byte sequence into pCell[]. Overflow pages are 6276 ** allocated and filled in as necessary. The calling procedure 6277 ** is responsible for making sure sufficient space has been allocated 6278 ** for pCell[]. 6279 ** 6280 ** Note that pCell does not necessary need to point to the pPage->aData 6281 ** area. pCell might point to some temporary storage. The cell will 6282 ** be constructed in this temporary area then copied into pPage->aData 6283 ** later. 6284 */ 6285 static int fillInCell( 6286 MemPage *pPage, /* The page that contains the cell */ 6287 unsigned char *pCell, /* Complete text of the cell */ 6288 const BtreePayload *pX, /* Payload with which to construct the cell */ 6289 int *pnSize /* Write cell size here */ 6290 ){ 6291 int nPayload; 6292 const u8 *pSrc; 6293 int nSrc, n, rc, mn; 6294 int spaceLeft; 6295 MemPage *pToRelease; 6296 unsigned char *pPrior; 6297 unsigned char *pPayload; 6298 BtShared *pBt; 6299 Pgno pgnoOvfl; 6300 int nHeader; 6301 6302 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 6303 6304 /* pPage is not necessarily writeable since pCell might be auxiliary 6305 ** buffer space that is separate from the pPage buffer area */ 6306 assert( pCell<pPage->aData || pCell>=&pPage->aData[pPage->pBt->pageSize] 6307 || sqlite3PagerIswriteable(pPage->pDbPage) ); 6308 6309 /* Fill in the header. */ 6310 nHeader = pPage->childPtrSize; 6311 if( pPage->intKey ){ 6312 nPayload = pX->nData + pX->nZero; 6313 pSrc = pX->pData; 6314 nSrc = pX->nData; 6315 assert( pPage->intKeyLeaf ); /* fillInCell() only called for leaves */ 6316 nHeader += putVarint32(&pCell[nHeader], nPayload); 6317 nHeader += putVarint(&pCell[nHeader], *(u64*)&pX->nKey); 6318 }else{ 6319 assert( pX->nKey<=0x7fffffff && pX->pKey!=0 ); 6320 nSrc = nPayload = (int)pX->nKey; 6321 pSrc = pX->pKey; 6322 nHeader += putVarint32(&pCell[nHeader], nPayload); 6323 } 6324 6325 /* Fill in the payload */ 6326 pPayload = &pCell[nHeader]; 6327 if( nPayload<=pPage->maxLocal ){ 6328 /* This is the common case where everything fits on the btree page 6329 ** and no overflow pages are required. */ 6330 n = nHeader + nPayload; 6331 testcase( n==3 ); 6332 testcase( n==4 ); 6333 if( n<4 ) n = 4; 6334 *pnSize = n; 6335 assert( nSrc<=nPayload ); 6336 testcase( nSrc<nPayload ); 6337 memcpy(pPayload, pSrc, nSrc); 6338 memset(pPayload+nSrc, 0, nPayload-nSrc); 6339 return SQLITE_OK; 6340 } 6341 6342 /* If we reach this point, it means that some of the content will need 6343 ** to spill onto overflow pages. 6344 */ 6345 mn = pPage->minLocal; 6346 n = mn + (nPayload - mn) % (pPage->pBt->usableSize - 4); 6347 testcase( n==pPage->maxLocal ); 6348 testcase( n==pPage->maxLocal+1 ); 6349 if( n > pPage->maxLocal ) n = mn; 6350 spaceLeft = n; 6351 *pnSize = n + nHeader + 4; 6352 pPrior = &pCell[nHeader+n]; 6353 pToRelease = 0; 6354 pgnoOvfl = 0; 6355 pBt = pPage->pBt; 6356 6357 /* At this point variables should be set as follows: 6358 ** 6359 ** nPayload Total payload size in bytes 6360 ** pPayload Begin writing payload here 6361 ** spaceLeft Space available at pPayload. If nPayload>spaceLeft, 6362 ** that means content must spill into overflow pages. 6363 ** *pnSize Size of the local cell (not counting overflow pages) 6364 ** pPrior Where to write the pgno of the first overflow page 6365 ** 6366 ** Use a call to btreeParseCellPtr() to verify that the values above 6367 ** were computed correctly. 6368 */ 6369 #ifdef SQLITE_DEBUG 6370 { 6371 CellInfo info; 6372 pPage->xParseCell(pPage, pCell, &info); 6373 assert( nHeader==(int)(info.pPayload - pCell) ); 6374 assert( info.nKey==pX->nKey ); 6375 assert( *pnSize == info.nSize ); 6376 assert( spaceLeft == info.nLocal ); 6377 } 6378 #endif 6379 6380 /* Write the payload into the local Cell and any extra into overflow pages */ 6381 while( 1 ){ 6382 n = nPayload; 6383 if( n>spaceLeft ) n = spaceLeft; 6384 6385 /* If pToRelease is not zero than pPayload points into the data area 6386 ** of pToRelease. Make sure pToRelease is still writeable. */ 6387 assert( pToRelease==0 || sqlite3PagerIswriteable(pToRelease->pDbPage) ); 6388 6389 /* If pPayload is part of the data area of pPage, then make sure pPage 6390 ** is still writeable */ 6391 assert( pPayload<pPage->aData || pPayload>=&pPage->aData[pBt->pageSize] 6392 || sqlite3PagerIswriteable(pPage->pDbPage) ); 6393 6394 if( nSrc>=n ){ 6395 memcpy(pPayload, pSrc, n); 6396 }else if( nSrc>0 ){ 6397 n = nSrc; 6398 memcpy(pPayload, pSrc, n); 6399 }else{ 6400 memset(pPayload, 0, n); 6401 } 6402 nPayload -= n; 6403 if( nPayload<=0 ) break; 6404 pPayload += n; 6405 pSrc += n; 6406 nSrc -= n; 6407 spaceLeft -= n; 6408 if( spaceLeft==0 ){ 6409 MemPage *pOvfl = 0; 6410 #ifndef SQLITE_OMIT_AUTOVACUUM 6411 Pgno pgnoPtrmap = pgnoOvfl; /* Overflow page pointer-map entry page */ 6412 if( pBt->autoVacuum ){ 6413 do{ 6414 pgnoOvfl++; 6415 } while( 6416 PTRMAP_ISPAGE(pBt, pgnoOvfl) || pgnoOvfl==PENDING_BYTE_PAGE(pBt) 6417 ); 6418 } 6419 #endif 6420 rc = allocateBtreePage(pBt, &pOvfl, &pgnoOvfl, pgnoOvfl, 0); 6421 #ifndef SQLITE_OMIT_AUTOVACUUM 6422 /* If the database supports auto-vacuum, and the second or subsequent 6423 ** overflow page is being allocated, add an entry to the pointer-map 6424 ** for that page now. 6425 ** 6426 ** If this is the first overflow page, then write a partial entry 6427 ** to the pointer-map. If we write nothing to this pointer-map slot, 6428 ** then the optimistic overflow chain processing in clearCell() 6429 ** may misinterpret the uninitialized values and delete the 6430 ** wrong pages from the database. 6431 */ 6432 if( pBt->autoVacuum && rc==SQLITE_OK ){ 6433 u8 eType = (pgnoPtrmap?PTRMAP_OVERFLOW2:PTRMAP_OVERFLOW1); 6434 ptrmapPut(pBt, pgnoOvfl, eType, pgnoPtrmap, &rc); 6435 if( rc ){ 6436 releasePage(pOvfl); 6437 } 6438 } 6439 #endif 6440 if( rc ){ 6441 releasePage(pToRelease); 6442 return rc; 6443 } 6444 6445 /* If pToRelease is not zero than pPrior points into the data area 6446 ** of pToRelease. Make sure pToRelease is still writeable. */ 6447 assert( pToRelease==0 || sqlite3PagerIswriteable(pToRelease->pDbPage) ); 6448 6449 /* If pPrior is part of the data area of pPage, then make sure pPage 6450 ** is still writeable */ 6451 assert( pPrior<pPage->aData || pPrior>=&pPage->aData[pBt->pageSize] 6452 || sqlite3PagerIswriteable(pPage->pDbPage) ); 6453 6454 put4byte(pPrior, pgnoOvfl); 6455 releasePage(pToRelease); 6456 pToRelease = pOvfl; 6457 pPrior = pOvfl->aData; 6458 put4byte(pPrior, 0); 6459 pPayload = &pOvfl->aData[4]; 6460 spaceLeft = pBt->usableSize - 4; 6461 } 6462 } 6463 releasePage(pToRelease); 6464 return SQLITE_OK; 6465 } 6466 6467 /* 6468 ** Remove the i-th cell from pPage. This routine effects pPage only. 6469 ** The cell content is not freed or deallocated. It is assumed that 6470 ** the cell content has been copied someplace else. This routine just 6471 ** removes the reference to the cell from pPage. 6472 ** 6473 ** "sz" must be the number of bytes in the cell. 6474 */ 6475 static void dropCell(MemPage *pPage, int idx, int sz, int *pRC){ 6476 u32 pc; /* Offset to cell content of cell being deleted */ 6477 u8 *data; /* pPage->aData */ 6478 u8 *ptr; /* Used to move bytes around within data[] */ 6479 int rc; /* The return code */ 6480 int hdr; /* Beginning of the header. 0 most pages. 100 page 1 */ 6481 6482 if( *pRC ) return; 6483 assert( idx>=0 && idx<pPage->nCell ); 6484 assert( CORRUPT_DB || sz==cellSize(pPage, idx) ); 6485 assert( sqlite3PagerIswriteable(pPage->pDbPage) ); 6486 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 6487 data = pPage->aData; 6488 ptr = &pPage->aCellIdx[2*idx]; 6489 pc = get2byte(ptr); 6490 hdr = pPage->hdrOffset; 6491 testcase( pc==get2byte(&data[hdr+5]) ); 6492 testcase( pc+sz==pPage->pBt->usableSize ); 6493 if( pc+sz > pPage->pBt->usableSize ){ 6494 *pRC = SQLITE_CORRUPT_BKPT; 6495 return; 6496 } 6497 rc = freeSpace(pPage, pc, sz); 6498 if( rc ){ 6499 *pRC = rc; 6500 return; 6501 } 6502 pPage->nCell--; 6503 if( pPage->nCell==0 ){ 6504 memset(&data[hdr+1], 0, 4); 6505 data[hdr+7] = 0; 6506 put2byte(&data[hdr+5], pPage->pBt->usableSize); 6507 pPage->nFree = pPage->pBt->usableSize - pPage->hdrOffset 6508 - pPage->childPtrSize - 8; 6509 }else{ 6510 memmove(ptr, ptr+2, 2*(pPage->nCell - idx)); 6511 put2byte(&data[hdr+3], pPage->nCell); 6512 pPage->nFree += 2; 6513 } 6514 } 6515 6516 /* 6517 ** Insert a new cell on pPage at cell index "i". pCell points to the 6518 ** content of the cell. 6519 ** 6520 ** If the cell content will fit on the page, then put it there. If it 6521 ** will not fit, then make a copy of the cell content into pTemp if 6522 ** pTemp is not null. Regardless of pTemp, allocate a new entry 6523 ** in pPage->apOvfl[] and make it point to the cell content (either 6524 ** in pTemp or the original pCell) and also record its index. 6525 ** Allocating a new entry in pPage->aCell[] implies that 6526 ** pPage->nOverflow is incremented. 6527 ** 6528 ** *pRC must be SQLITE_OK when this routine is called. 6529 */ 6530 static void insertCell( 6531 MemPage *pPage, /* Page into which we are copying */ 6532 int i, /* New cell becomes the i-th cell of the page */ 6533 u8 *pCell, /* Content of the new cell */ 6534 int sz, /* Bytes of content in pCell */ 6535 u8 *pTemp, /* Temp storage space for pCell, if needed */ 6536 Pgno iChild, /* If non-zero, replace first 4 bytes with this value */ 6537 int *pRC /* Read and write return code from here */ 6538 ){ 6539 int idx = 0; /* Where to write new cell content in data[] */ 6540 int j; /* Loop counter */ 6541 u8 *data; /* The content of the whole page */ 6542 u8 *pIns; /* The point in pPage->aCellIdx[] where no cell inserted */ 6543 6544 assert( *pRC==SQLITE_OK ); 6545 assert( i>=0 && i<=pPage->nCell+pPage->nOverflow ); 6546 assert( MX_CELL(pPage->pBt)<=10921 ); 6547 assert( pPage->nCell<=MX_CELL(pPage->pBt) || CORRUPT_DB ); 6548 assert( pPage->nOverflow<=ArraySize(pPage->apOvfl) ); 6549 assert( ArraySize(pPage->apOvfl)==ArraySize(pPage->aiOvfl) ); 6550 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 6551 /* The cell should normally be sized correctly. However, when moving a 6552 ** malformed cell from a leaf page to an interior page, if the cell size 6553 ** wanted to be less than 4 but got rounded up to 4 on the leaf, then size 6554 ** might be less than 8 (leaf-size + pointer) on the interior node. Hence 6555 ** the term after the || in the following assert(). */ 6556 assert( sz==pPage->xCellSize(pPage, pCell) || (sz==8 && iChild>0) ); 6557 if( pPage->nOverflow || sz+2>pPage->nFree ){ 6558 if( pTemp ){ 6559 memcpy(pTemp, pCell, sz); 6560 pCell = pTemp; 6561 } 6562 if( iChild ){ 6563 put4byte(pCell, iChild); 6564 } 6565 j = pPage->nOverflow++; 6566 /* Comparison against ArraySize-1 since we hold back one extra slot 6567 ** as a contingency. In other words, never need more than 3 overflow 6568 ** slots but 4 are allocated, just to be safe. */ 6569 assert( j < ArraySize(pPage->apOvfl)-1 ); 6570 pPage->apOvfl[j] = pCell; 6571 pPage->aiOvfl[j] = (u16)i; 6572 6573 /* When multiple overflows occur, they are always sequential and in 6574 ** sorted order. This invariants arise because multiple overflows can 6575 ** only occur when inserting divider cells into the parent page during 6576 ** balancing, and the dividers are adjacent and sorted. 6577 */ 6578 assert( j==0 || pPage->aiOvfl[j-1]<(u16)i ); /* Overflows in sorted order */ 6579 assert( j==0 || i==pPage->aiOvfl[j-1]+1 ); /* Overflows are sequential */ 6580 }else{ 6581 int rc = sqlite3PagerWrite(pPage->pDbPage); 6582 if( rc!=SQLITE_OK ){ 6583 *pRC = rc; 6584 return; 6585 } 6586 assert( sqlite3PagerIswriteable(pPage->pDbPage) ); 6587 data = pPage->aData; 6588 assert( &data[pPage->cellOffset]==pPage->aCellIdx ); 6589 rc = allocateSpace(pPage, sz, &idx); 6590 if( rc ){ *pRC = rc; return; } 6591 /* The allocateSpace() routine guarantees the following properties 6592 ** if it returns successfully */ 6593 assert( idx >= 0 ); 6594 assert( idx >= pPage->cellOffset+2*pPage->nCell+2 || CORRUPT_DB ); 6595 assert( idx+sz <= (int)pPage->pBt->usableSize ); 6596 pPage->nFree -= (u16)(2 + sz); 6597 memcpy(&data[idx], pCell, sz); 6598 if( iChild ){ 6599 put4byte(&data[idx], iChild); 6600 } 6601 pIns = pPage->aCellIdx + i*2; 6602 memmove(pIns+2, pIns, 2*(pPage->nCell - i)); 6603 put2byte(pIns, idx); 6604 pPage->nCell++; 6605 /* increment the cell count */ 6606 if( (++data[pPage->hdrOffset+4])==0 ) data[pPage->hdrOffset+3]++; 6607 assert( get2byte(&data[pPage->hdrOffset+3])==pPage->nCell ); 6608 #ifndef SQLITE_OMIT_AUTOVACUUM 6609 if( pPage->pBt->autoVacuum ){ 6610 /* The cell may contain a pointer to an overflow page. If so, write 6611 ** the entry for the overflow page into the pointer map. 6612 */ 6613 ptrmapPutOvflPtr(pPage, pCell, pRC); 6614 } 6615 #endif 6616 } 6617 } 6618 6619 /* 6620 ** A CellArray object contains a cache of pointers and sizes for a 6621 ** consecutive sequence of cells that might be held on multiple pages. 6622 */ 6623 typedef struct CellArray CellArray; 6624 struct CellArray { 6625 int nCell; /* Number of cells in apCell[] */ 6626 MemPage *pRef; /* Reference page */ 6627 u8 **apCell; /* All cells begin balanced */ 6628 u16 *szCell; /* Local size of all cells in apCell[] */ 6629 }; 6630 6631 /* 6632 ** Make sure the cell sizes at idx, idx+1, ..., idx+N-1 have been 6633 ** computed. 6634 */ 6635 static void populateCellCache(CellArray *p, int idx, int N){ 6636 assert( idx>=0 && idx+N<=p->nCell ); 6637 while( N>0 ){ 6638 assert( p->apCell[idx]!=0 ); 6639 if( p->szCell[idx]==0 ){ 6640 p->szCell[idx] = p->pRef->xCellSize(p->pRef, p->apCell[idx]); 6641 }else{ 6642 assert( CORRUPT_DB || 6643 p->szCell[idx]==p->pRef->xCellSize(p->pRef, p->apCell[idx]) ); 6644 } 6645 idx++; 6646 N--; 6647 } 6648 } 6649 6650 /* 6651 ** Return the size of the Nth element of the cell array 6652 */ 6653 static SQLITE_NOINLINE u16 computeCellSize(CellArray *p, int N){ 6654 assert( N>=0 && N<p->nCell ); 6655 assert( p->szCell[N]==0 ); 6656 p->szCell[N] = p->pRef->xCellSize(p->pRef, p->apCell[N]); 6657 return p->szCell[N]; 6658 } 6659 static u16 cachedCellSize(CellArray *p, int N){ 6660 assert( N>=0 && N<p->nCell ); 6661 if( p->szCell[N] ) return p->szCell[N]; 6662 return computeCellSize(p, N); 6663 } 6664 6665 /* 6666 ** Array apCell[] contains pointers to nCell b-tree page cells. The 6667 ** szCell[] array contains the size in bytes of each cell. This function 6668 ** replaces the current contents of page pPg with the contents of the cell 6669 ** array. 6670 ** 6671 ** Some of the cells in apCell[] may currently be stored in pPg. This 6672 ** function works around problems caused by this by making a copy of any 6673 ** such cells before overwriting the page data. 6674 ** 6675 ** The MemPage.nFree field is invalidated by this function. It is the 6676 ** responsibility of the caller to set it correctly. 6677 */ 6678 static int rebuildPage( 6679 MemPage *pPg, /* Edit this page */ 6680 int nCell, /* Final number of cells on page */ 6681 u8 **apCell, /* Array of cells */ 6682 u16 *szCell /* Array of cell sizes */ 6683 ){ 6684 const int hdr = pPg->hdrOffset; /* Offset of header on pPg */ 6685 u8 * const aData = pPg->aData; /* Pointer to data for pPg */ 6686 const int usableSize = pPg->pBt->usableSize; 6687 u8 * const pEnd = &aData[usableSize]; 6688 int i; 6689 u8 *pCellptr = pPg->aCellIdx; 6690 u8 *pTmp = sqlite3PagerTempSpace(pPg->pBt->pPager); 6691 u8 *pData; 6692 6693 i = get2byte(&aData[hdr+5]); 6694 memcpy(&pTmp[i], &aData[i], usableSize - i); 6695 6696 pData = pEnd; 6697 for(i=0; i<nCell; i++){ 6698 u8 *pCell = apCell[i]; 6699 if( SQLITE_WITHIN(pCell,aData,pEnd) ){ 6700 pCell = &pTmp[pCell - aData]; 6701 } 6702 pData -= szCell[i]; 6703 put2byte(pCellptr, (pData - aData)); 6704 pCellptr += 2; 6705 if( pData < pCellptr ) return SQLITE_CORRUPT_BKPT; 6706 memcpy(pData, pCell, szCell[i]); 6707 assert( szCell[i]==pPg->xCellSize(pPg, pCell) || CORRUPT_DB ); 6708 testcase( szCell[i]!=pPg->xCellSize(pPg,pCell) ); 6709 } 6710 6711 /* The pPg->nFree field is now set incorrectly. The caller will fix it. */ 6712 pPg->nCell = nCell; 6713 pPg->nOverflow = 0; 6714 6715 put2byte(&aData[hdr+1], 0); 6716 put2byte(&aData[hdr+3], pPg->nCell); 6717 put2byte(&aData[hdr+5], pData - aData); 6718 aData[hdr+7] = 0x00; 6719 return SQLITE_OK; 6720 } 6721 6722 /* 6723 ** Array apCell[] contains nCell pointers to b-tree cells. Array szCell 6724 ** contains the size in bytes of each such cell. This function attempts to 6725 ** add the cells stored in the array to page pPg. If it cannot (because 6726 ** the page needs to be defragmented before the cells will fit), non-zero 6727 ** is returned. Otherwise, if the cells are added successfully, zero is 6728 ** returned. 6729 ** 6730 ** Argument pCellptr points to the first entry in the cell-pointer array 6731 ** (part of page pPg) to populate. After cell apCell[0] is written to the 6732 ** page body, a 16-bit offset is written to pCellptr. And so on, for each 6733 ** cell in the array. It is the responsibility of the caller to ensure 6734 ** that it is safe to overwrite this part of the cell-pointer array. 6735 ** 6736 ** When this function is called, *ppData points to the start of the 6737 ** content area on page pPg. If the size of the content area is extended, 6738 ** *ppData is updated to point to the new start of the content area 6739 ** before returning. 6740 ** 6741 ** Finally, argument pBegin points to the byte immediately following the 6742 ** end of the space required by this page for the cell-pointer area (for 6743 ** all cells - not just those inserted by the current call). If the content 6744 ** area must be extended to before this point in order to accomodate all 6745 ** cells in apCell[], then the cells do not fit and non-zero is returned. 6746 */ 6747 static int pageInsertArray( 6748 MemPage *pPg, /* Page to add cells to */ 6749 u8 *pBegin, /* End of cell-pointer array */ 6750 u8 **ppData, /* IN/OUT: Page content -area pointer */ 6751 u8 *pCellptr, /* Pointer to cell-pointer area */ 6752 int iFirst, /* Index of first cell to add */ 6753 int nCell, /* Number of cells to add to pPg */ 6754 CellArray *pCArray /* Array of cells */ 6755 ){ 6756 int i; 6757 u8 *aData = pPg->aData; 6758 u8 *pData = *ppData; 6759 int iEnd = iFirst + nCell; 6760 assert( CORRUPT_DB || pPg->hdrOffset==0 ); /* Never called on page 1 */ 6761 for(i=iFirst; i<iEnd; i++){ 6762 int sz, rc; 6763 u8 *pSlot; 6764 sz = cachedCellSize(pCArray, i); 6765 if( (aData[1]==0 && aData[2]==0) || (pSlot = pageFindSlot(pPg,sz,&rc))==0 ){ 6766 if( (pData - pBegin)<sz ) return 1; 6767 pData -= sz; 6768 pSlot = pData; 6769 } 6770 /* pSlot and pCArray->apCell[i] will never overlap on a well-formed 6771 ** database. But they might for a corrupt database. Hence use memmove() 6772 ** since memcpy() sends SIGABORT with overlapping buffers on OpenBSD */ 6773 assert( (pSlot+sz)<=pCArray->apCell[i] 6774 || pSlot>=(pCArray->apCell[i]+sz) 6775 || CORRUPT_DB ); 6776 memmove(pSlot, pCArray->apCell[i], sz); 6777 put2byte(pCellptr, (pSlot - aData)); 6778 pCellptr += 2; 6779 } 6780 *ppData = pData; 6781 return 0; 6782 } 6783 6784 /* 6785 ** Array apCell[] contains nCell pointers to b-tree cells. Array szCell 6786 ** contains the size in bytes of each such cell. This function adds the 6787 ** space associated with each cell in the array that is currently stored 6788 ** within the body of pPg to the pPg free-list. The cell-pointers and other 6789 ** fields of the page are not updated. 6790 ** 6791 ** This function returns the total number of cells added to the free-list. 6792 */ 6793 static int pageFreeArray( 6794 MemPage *pPg, /* Page to edit */ 6795 int iFirst, /* First cell to delete */ 6796 int nCell, /* Cells to delete */ 6797 CellArray *pCArray /* Array of cells */ 6798 ){ 6799 u8 * const aData = pPg->aData; 6800 u8 * const pEnd = &aData[pPg->pBt->usableSize]; 6801 u8 * const pStart = &aData[pPg->hdrOffset + 8 + pPg->childPtrSize]; 6802 int nRet = 0; 6803 int i; 6804 int iEnd = iFirst + nCell; 6805 u8 *pFree = 0; 6806 int szFree = 0; 6807 6808 for(i=iFirst; i<iEnd; i++){ 6809 u8 *pCell = pCArray->apCell[i]; 6810 if( SQLITE_WITHIN(pCell, pStart, pEnd) ){ 6811 int sz; 6812 /* No need to use cachedCellSize() here. The sizes of all cells that 6813 ** are to be freed have already been computing while deciding which 6814 ** cells need freeing */ 6815 sz = pCArray->szCell[i]; assert( sz>0 ); 6816 if( pFree!=(pCell + sz) ){ 6817 if( pFree ){ 6818 assert( pFree>aData && (pFree - aData)<65536 ); 6819 freeSpace(pPg, (u16)(pFree - aData), szFree); 6820 } 6821 pFree = pCell; 6822 szFree = sz; 6823 if( pFree+sz>pEnd ) return 0; 6824 }else{ 6825 pFree = pCell; 6826 szFree += sz; 6827 } 6828 nRet++; 6829 } 6830 } 6831 if( pFree ){ 6832 assert( pFree>aData && (pFree - aData)<65536 ); 6833 freeSpace(pPg, (u16)(pFree - aData), szFree); 6834 } 6835 return nRet; 6836 } 6837 6838 /* 6839 ** apCell[] and szCell[] contains pointers to and sizes of all cells in the 6840 ** pages being balanced. The current page, pPg, has pPg->nCell cells starting 6841 ** with apCell[iOld]. After balancing, this page should hold nNew cells 6842 ** starting at apCell[iNew]. 6843 ** 6844 ** This routine makes the necessary adjustments to pPg so that it contains 6845 ** the correct cells after being balanced. 6846 ** 6847 ** The pPg->nFree field is invalid when this function returns. It is the 6848 ** responsibility of the caller to set it correctly. 6849 */ 6850 static int editPage( 6851 MemPage *pPg, /* Edit this page */ 6852 int iOld, /* Index of first cell currently on page */ 6853 int iNew, /* Index of new first cell on page */ 6854 int nNew, /* Final number of cells on page */ 6855 CellArray *pCArray /* Array of cells and sizes */ 6856 ){ 6857 u8 * const aData = pPg->aData; 6858 const int hdr = pPg->hdrOffset; 6859 u8 *pBegin = &pPg->aCellIdx[nNew * 2]; 6860 int nCell = pPg->nCell; /* Cells stored on pPg */ 6861 u8 *pData; 6862 u8 *pCellptr; 6863 int i; 6864 int iOldEnd = iOld + pPg->nCell + pPg->nOverflow; 6865 int iNewEnd = iNew + nNew; 6866 6867 #ifdef SQLITE_DEBUG 6868 u8 *pTmp = sqlite3PagerTempSpace(pPg->pBt->pPager); 6869 memcpy(pTmp, aData, pPg->pBt->usableSize); 6870 #endif 6871 6872 /* Remove cells from the start and end of the page */ 6873 if( iOld<iNew ){ 6874 int nShift = pageFreeArray(pPg, iOld, iNew-iOld, pCArray); 6875 memmove(pPg->aCellIdx, &pPg->aCellIdx[nShift*2], nCell*2); 6876 nCell -= nShift; 6877 } 6878 if( iNewEnd < iOldEnd ){ 6879 nCell -= pageFreeArray(pPg, iNewEnd, iOldEnd - iNewEnd, pCArray); 6880 } 6881 6882 pData = &aData[get2byteNotZero(&aData[hdr+5])]; 6883 if( pData<pBegin ) goto editpage_fail; 6884 6885 /* Add cells to the start of the page */ 6886 if( iNew<iOld ){ 6887 int nAdd = MIN(nNew,iOld-iNew); 6888 assert( (iOld-iNew)<nNew || nCell==0 || CORRUPT_DB ); 6889 pCellptr = pPg->aCellIdx; 6890 memmove(&pCellptr[nAdd*2], pCellptr, nCell*2); 6891 if( pageInsertArray( 6892 pPg, pBegin, &pData, pCellptr, 6893 iNew, nAdd, pCArray 6894 ) ) goto editpage_fail; 6895 nCell += nAdd; 6896 } 6897 6898 /* Add any overflow cells */ 6899 for(i=0; i<pPg->nOverflow; i++){ 6900 int iCell = (iOld + pPg->aiOvfl[i]) - iNew; 6901 if( iCell>=0 && iCell<nNew ){ 6902 pCellptr = &pPg->aCellIdx[iCell * 2]; 6903 memmove(&pCellptr[2], pCellptr, (nCell - iCell) * 2); 6904 nCell++; 6905 if( pageInsertArray( 6906 pPg, pBegin, &pData, pCellptr, 6907 iCell+iNew, 1, pCArray 6908 ) ) goto editpage_fail; 6909 } 6910 } 6911 6912 /* Append cells to the end of the page */ 6913 pCellptr = &pPg->aCellIdx[nCell*2]; 6914 if( pageInsertArray( 6915 pPg, pBegin, &pData, pCellptr, 6916 iNew+nCell, nNew-nCell, pCArray 6917 ) ) goto editpage_fail; 6918 6919 pPg->nCell = nNew; 6920 pPg->nOverflow = 0; 6921 6922 put2byte(&aData[hdr+3], pPg->nCell); 6923 put2byte(&aData[hdr+5], pData - aData); 6924 6925 #ifdef SQLITE_DEBUG 6926 for(i=0; i<nNew && !CORRUPT_DB; i++){ 6927 u8 *pCell = pCArray->apCell[i+iNew]; 6928 int iOff = get2byteAligned(&pPg->aCellIdx[i*2]); 6929 if( SQLITE_WITHIN(pCell, aData, &aData[pPg->pBt->usableSize]) ){ 6930 pCell = &pTmp[pCell - aData]; 6931 } 6932 assert( 0==memcmp(pCell, &aData[iOff], 6933 pCArray->pRef->xCellSize(pCArray->pRef, pCArray->apCell[i+iNew])) ); 6934 } 6935 #endif 6936 6937 return SQLITE_OK; 6938 editpage_fail: 6939 /* Unable to edit this page. Rebuild it from scratch instead. */ 6940 populateCellCache(pCArray, iNew, nNew); 6941 return rebuildPage(pPg, nNew, &pCArray->apCell[iNew], &pCArray->szCell[iNew]); 6942 } 6943 6944 /* 6945 ** The following parameters determine how many adjacent pages get involved 6946 ** in a balancing operation. NN is the number of neighbors on either side 6947 ** of the page that participate in the balancing operation. NB is the 6948 ** total number of pages that participate, including the target page and 6949 ** NN neighbors on either side. 6950 ** 6951 ** The minimum value of NN is 1 (of course). Increasing NN above 1 6952 ** (to 2 or 3) gives a modest improvement in SELECT and DELETE performance 6953 ** in exchange for a larger degradation in INSERT and UPDATE performance. 6954 ** The value of NN appears to give the best results overall. 6955 */ 6956 #define NN 1 /* Number of neighbors on either side of pPage */ 6957 #define NB (NN*2+1) /* Total pages involved in the balance */ 6958 6959 6960 #ifndef SQLITE_OMIT_QUICKBALANCE 6961 /* 6962 ** This version of balance() handles the common special case where 6963 ** a new entry is being inserted on the extreme right-end of the 6964 ** tree, in other words, when the new entry will become the largest 6965 ** entry in the tree. 6966 ** 6967 ** Instead of trying to balance the 3 right-most leaf pages, just add 6968 ** a new page to the right-hand side and put the one new entry in 6969 ** that page. This leaves the right side of the tree somewhat 6970 ** unbalanced. But odds are that we will be inserting new entries 6971 ** at the end soon afterwards so the nearly empty page will quickly 6972 ** fill up. On average. 6973 ** 6974 ** pPage is the leaf page which is the right-most page in the tree. 6975 ** pParent is its parent. pPage must have a single overflow entry 6976 ** which is also the right-most entry on the page. 6977 ** 6978 ** The pSpace buffer is used to store a temporary copy of the divider 6979 ** cell that will be inserted into pParent. Such a cell consists of a 4 6980 ** byte page number followed by a variable length integer. In other 6981 ** words, at most 13 bytes. Hence the pSpace buffer must be at 6982 ** least 13 bytes in size. 6983 */ 6984 static int balance_quick(MemPage *pParent, MemPage *pPage, u8 *pSpace){ 6985 BtShared *const pBt = pPage->pBt; /* B-Tree Database */ 6986 MemPage *pNew; /* Newly allocated page */ 6987 int rc; /* Return Code */ 6988 Pgno pgnoNew; /* Page number of pNew */ 6989 6990 assert( sqlite3_mutex_held(pPage->pBt->mutex) ); 6991 assert( sqlite3PagerIswriteable(pParent->pDbPage) ); 6992 assert( pPage->nOverflow==1 ); 6993 6994 /* This error condition is now caught prior to reaching this function */ 6995 if( NEVER(pPage->nCell==0) ) return SQLITE_CORRUPT_BKPT; 6996 6997 /* Allocate a new page. This page will become the right-sibling of 6998 ** pPage. Make the parent page writable, so that the new divider cell 6999 ** may be inserted. If both these operations are successful, proceed. 7000 */ 7001 rc = allocateBtreePage(pBt, &pNew, &pgnoNew, 0, 0); 7002 7003 if( rc==SQLITE_OK ){ 7004 7005 u8 *pOut = &pSpace[4]; 7006 u8 *pCell = pPage->apOvfl[0]; 7007 u16 szCell = pPage->xCellSize(pPage, pCell); 7008 u8 *pStop; 7009 7010 assert( sqlite3PagerIswriteable(pNew->pDbPage) ); 7011 assert( pPage->aData[0]==(PTF_INTKEY|PTF_LEAFDATA|PTF_LEAF) ); 7012 zeroPage(pNew, PTF_INTKEY|PTF_LEAFDATA|PTF_LEAF); 7013 rc = rebuildPage(pNew, 1, &pCell, &szCell); 7014 if( NEVER(rc) ) return rc; 7015 pNew->nFree = pBt->usableSize - pNew->cellOffset - 2 - szCell; 7016 7017 /* If this is an auto-vacuum database, update the pointer map 7018 ** with entries for the new page, and any pointer from the 7019 ** cell on the page to an overflow page. If either of these 7020 ** operations fails, the return code is set, but the contents 7021 ** of the parent page are still manipulated by thh code below. 7022 ** That is Ok, at this point the parent page is guaranteed to 7023 ** be marked as dirty. Returning an error code will cause a 7024 ** rollback, undoing any changes made to the parent page. 7025 */ 7026 if( ISAUTOVACUUM ){ 7027 ptrmapPut(pBt, pgnoNew, PTRMAP_BTREE, pParent->pgno, &rc); 7028 if( szCell>pNew->minLocal ){ 7029 ptrmapPutOvflPtr(pNew, pCell, &rc); 7030 } 7031 } 7032 7033 /* Create a divider cell to insert into pParent. The divider cell 7034 ** consists of a 4-byte page number (the page number of pPage) and 7035 ** a variable length key value (which must be the same value as the 7036 ** largest key on pPage). 7037 ** 7038 ** To find the largest key value on pPage, first find the right-most 7039 ** cell on pPage. The first two fields of this cell are the 7040 ** record-length (a variable length integer at most 32-bits in size) 7041 ** and the key value (a variable length integer, may have any value). 7042 ** The first of the while(...) loops below skips over the record-length 7043 ** field. The second while(...) loop copies the key value from the 7044 ** cell on pPage into the pSpace buffer. 7045 */ 7046 pCell = findCell(pPage, pPage->nCell-1); 7047 pStop = &pCell[9]; 7048 while( (*(pCell++)&0x80) && pCell<pStop ); 7049 pStop = &pCell[9]; 7050 while( ((*(pOut++) = *(pCell++))&0x80) && pCell<pStop ); 7051 7052 /* Insert the new divider cell into pParent. */ 7053 if( rc==SQLITE_OK ){ 7054 insertCell(pParent, pParent->nCell, pSpace, (int)(pOut-pSpace), 7055 0, pPage->pgno, &rc); 7056 } 7057 7058 /* Set the right-child pointer of pParent to point to the new page. */ 7059 put4byte(&pParent->aData[pParent->hdrOffset+8], pgnoNew); 7060 7061 /* Release the reference to the new page. */ 7062 releasePage(pNew); 7063 } 7064 7065 return rc; 7066 } 7067 #endif /* SQLITE_OMIT_QUICKBALANCE */ 7068 7069 #if 0 7070 /* 7071 ** This function does not contribute anything to the operation of SQLite. 7072 ** it is sometimes activated temporarily while debugging code responsible 7073 ** for setting pointer-map entries. 7074 */ 7075 static int ptrmapCheckPages(MemPage **apPage, int nPage){ 7076 int i, j; 7077 for(i=0; i<nPage; i++){ 7078 Pgno n; 7079 u8 e; 7080 MemPage *pPage = apPage[i]; 7081 BtShared *pBt = pPage->pBt; 7082 assert( pPage->isInit ); 7083 7084 for(j=0; j<pPage->nCell; j++){ 7085 CellInfo info; 7086 u8 *z; 7087 7088 z = findCell(pPage, j); 7089 pPage->xParseCell(pPage, z, &info); 7090 if( info.nLocal<info.nPayload ){ 7091 Pgno ovfl = get4byte(&z[info.nSize-4]); 7092 ptrmapGet(pBt, ovfl, &e, &n); 7093 assert( n==pPage->pgno && e==PTRMAP_OVERFLOW1 ); 7094 } 7095 if( !pPage->leaf ){ 7096 Pgno child = get4byte(z); 7097 ptrmapGet(pBt, child, &e, &n); 7098 assert( n==pPage->pgno && e==PTRMAP_BTREE ); 7099 } 7100 } 7101 if( !pPage->leaf ){ 7102 Pgno child = get4byte(&pPage->aData[pPage->hdrOffset+8]); 7103 ptrmapGet(pBt, child, &e, &n); 7104 assert( n==pPage->pgno && e==PTRMAP_BTREE ); 7105 } 7106 } 7107 return 1; 7108 } 7109 #endif 7110 7111 /* 7112 ** This function is used to copy the contents of the b-tree node stored 7113 ** on page pFrom to page pTo. If page pFrom was not a leaf page, then 7114 ** the pointer-map entries for each child page are updated so that the 7115 ** parent page stored in the pointer map is page pTo. If pFrom contained 7116 ** any cells with overflow page pointers, then the corresponding pointer 7117 ** map entries are also updated so that the parent page is page pTo. 7118 ** 7119 ** If pFrom is currently carrying any overflow cells (entries in the 7120 ** MemPage.apOvfl[] array), they are not copied to pTo. 7121 ** 7122 ** Before returning, page pTo is reinitialized using btreeInitPage(). 7123 ** 7124 ** The performance of this function is not critical. It is only used by 7125 ** the balance_shallower() and balance_deeper() procedures, neither of 7126 ** which are called often under normal circumstances. 7127 */ 7128 static void copyNodeContent(MemPage *pFrom, MemPage *pTo, int *pRC){ 7129 if( (*pRC)==SQLITE_OK ){ 7130 BtShared * const pBt = pFrom->pBt; 7131 u8 * const aFrom = pFrom->aData; 7132 u8 * const aTo = pTo->aData; 7133 int const iFromHdr = pFrom->hdrOffset; 7134 int const iToHdr = ((pTo->pgno==1) ? 100 : 0); 7135 int rc; 7136 int iData; 7137 7138 7139 assert( pFrom->isInit ); 7140 assert( pFrom->nFree>=iToHdr ); 7141 assert( get2byte(&aFrom[iFromHdr+5]) <= (int)pBt->usableSize ); 7142 7143 /* Copy the b-tree node content from page pFrom to page pTo. */ 7144 iData = get2byte(&aFrom[iFromHdr+5]); 7145 memcpy(&aTo[iData], &aFrom[iData], pBt->usableSize-iData); 7146 memcpy(&aTo[iToHdr], &aFrom[iFromHdr], pFrom->cellOffset + 2*pFrom->nCell); 7147 7148 /* Reinitialize page pTo so that the contents of the MemPage structure 7149 ** match the new data. The initialization of pTo can actually fail under 7150 ** fairly obscure circumstances, even though it is a copy of initialized 7151 ** page pFrom. 7152 */ 7153 pTo->isInit = 0; 7154 rc = btreeInitPage(pTo); 7155 if( rc!=SQLITE_OK ){ 7156 *pRC = rc; 7157 return; 7158 } 7159 7160 /* If this is an auto-vacuum database, update the pointer-map entries 7161 ** for any b-tree or overflow pages that pTo now contains the pointers to. 7162 */ 7163 if( ISAUTOVACUUM ){ 7164 *pRC = setChildPtrmaps(pTo); 7165 } 7166 } 7167 } 7168 7169 /* 7170 ** This routine redistributes cells on the iParentIdx'th child of pParent 7171 ** (hereafter "the page") and up to 2 siblings so that all pages have about the 7172 ** same amount of free space. Usually a single sibling on either side of the 7173 ** page are used in the balancing, though both siblings might come from one 7174 ** side if the page is the first or last child of its parent. If the page 7175 ** has fewer than 2 siblings (something which can only happen if the page 7176 ** is a root page or a child of a root page) then all available siblings 7177 ** participate in the balancing. 7178 ** 7179 ** The number of siblings of the page might be increased or decreased by 7180 ** one or two in an effort to keep pages nearly full but not over full. 7181 ** 7182 ** Note that when this routine is called, some of the cells on the page 7183 ** might not actually be stored in MemPage.aData[]. This can happen 7184 ** if the page is overfull. This routine ensures that all cells allocated 7185 ** to the page and its siblings fit into MemPage.aData[] before returning. 7186 ** 7187 ** In the course of balancing the page and its siblings, cells may be 7188 ** inserted into or removed from the parent page (pParent). Doing so 7189 ** may cause the parent page to become overfull or underfull. If this 7190 ** happens, it is the responsibility of the caller to invoke the correct 7191 ** balancing routine to fix this problem (see the balance() routine). 7192 ** 7193 ** If this routine fails for any reason, it might leave the database 7194 ** in a corrupted state. So if this routine fails, the database should 7195 ** be rolled back. 7196 ** 7197 ** The third argument to this function, aOvflSpace, is a pointer to a 7198 ** buffer big enough to hold one page. If while inserting cells into the parent 7199 ** page (pParent) the parent page becomes overfull, this buffer is 7200 ** used to store the parent's overflow cells. Because this function inserts 7201 ** a maximum of four divider cells into the parent page, and the maximum 7202 ** size of a cell stored within an internal node is always less than 1/4 7203 ** of the page-size, the aOvflSpace[] buffer is guaranteed to be large 7204 ** enough for all overflow cells. 7205 ** 7206 ** If aOvflSpace is set to a null pointer, this function returns 7207 ** SQLITE_NOMEM. 7208 */ 7209 static int balance_nonroot( 7210 MemPage *pParent, /* Parent page of siblings being balanced */ 7211 int iParentIdx, /* Index of "the page" in pParent */ 7212 u8 *aOvflSpace, /* page-size bytes of space for parent ovfl */ 7213 int isRoot, /* True if pParent is a root-page */ 7214 int bBulk /* True if this call is part of a bulk load */ 7215 ){ 7216 BtShared *pBt; /* The whole database */ 7217 int nMaxCells = 0; /* Allocated size of apCell, szCell, aFrom. */ 7218 int nNew = 0; /* Number of pages in apNew[] */ 7219 int nOld; /* Number of pages in apOld[] */ 7220 int i, j, k; /* Loop counters */ 7221 int nxDiv; /* Next divider slot in pParent->aCell[] */ 7222 int rc = SQLITE_OK; /* The return code */ 7223 u16 leafCorrection; /* 4 if pPage is a leaf. 0 if not */ 7224 int leafData; /* True if pPage is a leaf of a LEAFDATA tree */ 7225 int usableSpace; /* Bytes in pPage beyond the header */ 7226 int pageFlags; /* Value of pPage->aData[0] */ 7227 int iSpace1 = 0; /* First unused byte of aSpace1[] */ 7228 int iOvflSpace = 0; /* First unused byte of aOvflSpace[] */ 7229 int szScratch; /* Size of scratch memory requested */ 7230 MemPage *apOld[NB]; /* pPage and up to two siblings */ 7231 MemPage *apNew[NB+2]; /* pPage and up to NB siblings after balancing */ 7232 u8 *pRight; /* Location in parent of right-sibling pointer */ 7233 u8 *apDiv[NB-1]; /* Divider cells in pParent */ 7234 int cntNew[NB+2]; /* Index in b.paCell[] of cell after i-th page */ 7235 int cntOld[NB+2]; /* Old index in b.apCell[] */ 7236 int szNew[NB+2]; /* Combined size of cells placed on i-th page */ 7237 u8 *aSpace1; /* Space for copies of dividers cells */ 7238 Pgno pgno; /* Temp var to store a page number in */ 7239 u8 abDone[NB+2]; /* True after i'th new page is populated */ 7240 Pgno aPgno[NB+2]; /* Page numbers of new pages before shuffling */ 7241 Pgno aPgOrder[NB+2]; /* Copy of aPgno[] used for sorting pages */ 7242 u16 aPgFlags[NB+2]; /* flags field of new pages before shuffling */ 7243 CellArray b; /* Parsed information on cells being balanced */ 7244 7245 memset(abDone, 0, sizeof(abDone)); 7246 b.nCell = 0; 7247 b.apCell = 0; 7248 pBt = pParent->pBt; 7249 assert( sqlite3_mutex_held(pBt->mutex) ); 7250 assert( sqlite3PagerIswriteable(pParent->pDbPage) ); 7251 7252 #if 0 7253 TRACE(("BALANCE: begin page %d child of %d\n", pPage->pgno, pParent->pgno)); 7254 #endif 7255 7256 /* At this point pParent may have at most one overflow cell. And if 7257 ** this overflow cell is present, it must be the cell with 7258 ** index iParentIdx. This scenario comes about when this function 7259 ** is called (indirectly) from sqlite3BtreeDelete(). 7260 */ 7261 assert( pParent->nOverflow==0 || pParent->nOverflow==1 ); 7262 assert( pParent->nOverflow==0 || pParent->aiOvfl[0]==iParentIdx ); 7263 7264 if( !aOvflSpace ){ 7265 return SQLITE_NOMEM_BKPT; 7266 } 7267 7268 /* Find the sibling pages to balance. Also locate the cells in pParent 7269 ** that divide the siblings. An attempt is made to find NN siblings on 7270 ** either side of pPage. More siblings are taken from one side, however, 7271 ** if there are fewer than NN siblings on the other side. If pParent 7272 ** has NB or fewer children then all children of pParent are taken. 7273 ** 7274 ** This loop also drops the divider cells from the parent page. This 7275 ** way, the remainder of the function does not have to deal with any 7276 ** overflow cells in the parent page, since if any existed they will 7277 ** have already been removed. 7278 */ 7279 i = pParent->nOverflow + pParent->nCell; 7280 if( i<2 ){ 7281 nxDiv = 0; 7282 }else{ 7283 assert( bBulk==0 || bBulk==1 ); 7284 if( iParentIdx==0 ){ 7285 nxDiv = 0; 7286 }else if( iParentIdx==i ){ 7287 nxDiv = i-2+bBulk; 7288 }else{ 7289 nxDiv = iParentIdx-1; 7290 } 7291 i = 2-bBulk; 7292 } 7293 nOld = i+1; 7294 if( (i+nxDiv-pParent->nOverflow)==pParent->nCell ){ 7295 pRight = &pParent->aData[pParent->hdrOffset+8]; 7296 }else{ 7297 pRight = findCell(pParent, i+nxDiv-pParent->nOverflow); 7298 } 7299 pgno = get4byte(pRight); 7300 while( 1 ){ 7301 rc = getAndInitPage(pBt, pgno, &apOld[i], 0, 0); 7302 if( rc ){ 7303 memset(apOld, 0, (i+1)*sizeof(MemPage*)); 7304 goto balance_cleanup; 7305 } 7306 nMaxCells += 1+apOld[i]->nCell+apOld[i]->nOverflow; 7307 if( (i--)==0 ) break; 7308 7309 if( pParent->nOverflow && i+nxDiv==pParent->aiOvfl[0] ){ 7310 apDiv[i] = pParent->apOvfl[0]; 7311 pgno = get4byte(apDiv[i]); 7312 szNew[i] = pParent->xCellSize(pParent, apDiv[i]); 7313 pParent->nOverflow = 0; 7314 }else{ 7315 apDiv[i] = findCell(pParent, i+nxDiv-pParent->nOverflow); 7316 pgno = get4byte(apDiv[i]); 7317 szNew[i] = pParent->xCellSize(pParent, apDiv[i]); 7318 7319 /* Drop the cell from the parent page. apDiv[i] still points to 7320 ** the cell within the parent, even though it has been dropped. 7321 ** This is safe because dropping a cell only overwrites the first 7322 ** four bytes of it, and this function does not need the first 7323 ** four bytes of the divider cell. So the pointer is safe to use 7324 ** later on. 7325 ** 7326 ** But not if we are in secure-delete mode. In secure-delete mode, 7327 ** the dropCell() routine will overwrite the entire cell with zeroes. 7328 ** In this case, temporarily copy the cell into the aOvflSpace[] 7329 ** buffer. It will be copied out again as soon as the aSpace[] buffer 7330 ** is allocated. */ 7331 if( pBt->btsFlags & BTS_FAST_SECURE ){ 7332 int iOff; 7333 7334 iOff = SQLITE_PTR_TO_INT(apDiv[i]) - SQLITE_PTR_TO_INT(pParent->aData); 7335 if( (iOff+szNew[i])>(int)pBt->usableSize ){ 7336 rc = SQLITE_CORRUPT_BKPT; 7337 memset(apOld, 0, (i+1)*sizeof(MemPage*)); 7338 goto balance_cleanup; 7339 }else{ 7340 memcpy(&aOvflSpace[iOff], apDiv[i], szNew[i]); 7341 apDiv[i] = &aOvflSpace[apDiv[i]-pParent->aData]; 7342 } 7343 } 7344 dropCell(pParent, i+nxDiv-pParent->nOverflow, szNew[i], &rc); 7345 } 7346 } 7347 7348 /* Make nMaxCells a multiple of 4 in order to preserve 8-byte 7349 ** alignment */ 7350 nMaxCells = (nMaxCells + 3)&~3; 7351 7352 /* 7353 ** Allocate space for memory structures 7354 */ 7355 szScratch = 7356 nMaxCells*sizeof(u8*) /* b.apCell */ 7357 + nMaxCells*sizeof(u16) /* b.szCell */ 7358 + pBt->pageSize; /* aSpace1 */ 7359 7360 assert( szScratch<=6*(int)pBt->pageSize ); 7361 b.apCell = sqlite3StackAllocRaw(0, szScratch ); 7362 if( b.apCell==0 ){ 7363 rc = SQLITE_NOMEM_BKPT; 7364 goto balance_cleanup; 7365 } 7366 b.szCell = (u16*)&b.apCell[nMaxCells]; 7367 aSpace1 = (u8*)&b.szCell[nMaxCells]; 7368 assert( EIGHT_BYTE_ALIGNMENT(aSpace1) ); 7369 7370 /* 7371 ** Load pointers to all cells on sibling pages and the divider cells 7372 ** into the local b.apCell[] array. Make copies of the divider cells 7373 ** into space obtained from aSpace1[]. The divider cells have already 7374 ** been removed from pParent. 7375 ** 7376 ** If the siblings are on leaf pages, then the child pointers of the 7377 ** divider cells are stripped from the cells before they are copied 7378 ** into aSpace1[]. In this way, all cells in b.apCell[] are without 7379 ** child pointers. If siblings are not leaves, then all cell in 7380 ** b.apCell[] include child pointers. Either way, all cells in b.apCell[] 7381 ** are alike. 7382 ** 7383 ** leafCorrection: 4 if pPage is a leaf. 0 if pPage is not a leaf. 7384 ** leafData: 1 if pPage holds key+data and pParent holds only keys. 7385 */ 7386 b.pRef = apOld[0]; 7387 leafCorrection = b.pRef->leaf*4; 7388 leafData = b.pRef->intKeyLeaf; 7389 for(i=0; i<nOld; i++){ 7390 MemPage *pOld = apOld[i]; 7391 int limit = pOld->nCell; 7392 u8 *aData = pOld->aData; 7393 u16 maskPage = pOld->maskPage; 7394 u8 *piCell = aData + pOld->cellOffset; 7395 u8 *piEnd; 7396 7397 /* Verify that all sibling pages are of the same "type" (table-leaf, 7398 ** table-interior, index-leaf, or index-interior). 7399 */ 7400 if( pOld->aData[0]!=apOld[0]->aData[0] ){ 7401 rc = SQLITE_CORRUPT_BKPT; 7402 goto balance_cleanup; 7403 } 7404 7405 /* Load b.apCell[] with pointers to all cells in pOld. If pOld 7406 ** contains overflow cells, include them in the b.apCell[] array 7407 ** in the correct spot. 7408 ** 7409 ** Note that when there are multiple overflow cells, it is always the 7410 ** case that they are sequential and adjacent. This invariant arises 7411 ** because multiple overflows can only occurs when inserting divider 7412 ** cells into a parent on a prior balance, and divider cells are always 7413 ** adjacent and are inserted in order. There is an assert() tagged 7414 ** with "NOTE 1" in the overflow cell insertion loop to prove this 7415 ** invariant. 7416 ** 7417 ** This must be done in advance. Once the balance starts, the cell 7418 ** offset section of the btree page will be overwritten and we will no 7419 ** long be able to find the cells if a pointer to each cell is not saved 7420 ** first. 7421 */ 7422 memset(&b.szCell[b.nCell], 0, sizeof(b.szCell[0])*(limit+pOld->nOverflow)); 7423 if( pOld->nOverflow>0 ){ 7424 limit = pOld->aiOvfl[0]; 7425 for(j=0; j<limit; j++){ 7426 b.apCell[b.nCell] = aData + (maskPage & get2byteAligned(piCell)); 7427 piCell += 2; 7428 b.nCell++; 7429 } 7430 for(k=0; k<pOld->nOverflow; k++){ 7431 assert( k==0 || pOld->aiOvfl[k-1]+1==pOld->aiOvfl[k] );/* NOTE 1 */ 7432 b.apCell[b.nCell] = pOld->apOvfl[k]; 7433 b.nCell++; 7434 } 7435 } 7436 piEnd = aData + pOld->cellOffset + 2*pOld->nCell; 7437 while( piCell<piEnd ){ 7438 assert( b.nCell<nMaxCells ); 7439 b.apCell[b.nCell] = aData + (maskPage & get2byteAligned(piCell)); 7440 piCell += 2; 7441 b.nCell++; 7442 } 7443 7444 cntOld[i] = b.nCell; 7445 if( i<nOld-1 && !leafData){ 7446 u16 sz = (u16)szNew[i]; 7447 u8 *pTemp; 7448 assert( b.nCell<nMaxCells ); 7449 b.szCell[b.nCell] = sz; 7450 pTemp = &aSpace1[iSpace1]; 7451 iSpace1 += sz; 7452 assert( sz<=pBt->maxLocal+23 ); 7453 assert( iSpace1 <= (int)pBt->pageSize ); 7454 memcpy(pTemp, apDiv[i], sz); 7455 b.apCell[b.nCell] = pTemp+leafCorrection; 7456 assert( leafCorrection==0 || leafCorrection==4 ); 7457 b.szCell[b.nCell] = b.szCell[b.nCell] - leafCorrection; 7458 if( !pOld->leaf ){ 7459 assert( leafCorrection==0 ); 7460 assert( pOld->hdrOffset==0 ); 7461 /* The right pointer of the child page pOld becomes the left 7462 ** pointer of the divider cell */ 7463 memcpy(b.apCell[b.nCell], &pOld->aData[8], 4); 7464 }else{ 7465 assert( leafCorrection==4 ); 7466 while( b.szCell[b.nCell]<4 ){ 7467 /* Do not allow any cells smaller than 4 bytes. If a smaller cell 7468 ** does exist, pad it with 0x00 bytes. */ 7469 assert( b.szCell[b.nCell]==3 || CORRUPT_DB ); 7470 assert( b.apCell[b.nCell]==&aSpace1[iSpace1-3] || CORRUPT_DB ); 7471 aSpace1[iSpace1++] = 0x00; 7472 b.szCell[b.nCell]++; 7473 } 7474 } 7475 b.nCell++; 7476 } 7477 } 7478 7479 /* 7480 ** Figure out the number of pages needed to hold all b.nCell cells. 7481 ** Store this number in "k". Also compute szNew[] which is the total 7482 ** size of all cells on the i-th page and cntNew[] which is the index 7483 ** in b.apCell[] of the cell that divides page i from page i+1. 7484 ** cntNew[k] should equal b.nCell. 7485 ** 7486 ** Values computed by this block: 7487 ** 7488 ** k: The total number of sibling pages 7489 ** szNew[i]: Spaced used on the i-th sibling page. 7490 ** cntNew[i]: Index in b.apCell[] and b.szCell[] for the first cell to 7491 ** the right of the i-th sibling page. 7492 ** usableSpace: Number of bytes of space available on each sibling. 7493 ** 7494 */ 7495 usableSpace = pBt->usableSize - 12 + leafCorrection; 7496 for(i=0; i<nOld; i++){ 7497 MemPage *p = apOld[i]; 7498 szNew[i] = usableSpace - p->nFree; 7499 for(j=0; j<p->nOverflow; j++){ 7500 szNew[i] += 2 + p->xCellSize(p, p->apOvfl[j]); 7501 } 7502 cntNew[i] = cntOld[i]; 7503 } 7504 k = nOld; 7505 for(i=0; i<k; i++){ 7506 int sz; 7507 while( szNew[i]>usableSpace ){ 7508 if( i+1>=k ){ 7509 k = i+2; 7510 if( k>NB+2 ){ rc = SQLITE_CORRUPT_BKPT; goto balance_cleanup; } 7511 szNew[k-1] = 0; 7512 cntNew[k-1] = b.nCell; 7513 } 7514 sz = 2 + cachedCellSize(&b, cntNew[i]-1); 7515 szNew[i] -= sz; 7516 if( !leafData ){ 7517 if( cntNew[i]<b.nCell ){ 7518 sz = 2 + cachedCellSize(&b, cntNew[i]); 7519 }else{ 7520 sz = 0; 7521 } 7522 } 7523 szNew[i+1] += sz; 7524 cntNew[i]--; 7525 } 7526 while( cntNew[i]<b.nCell ){ 7527 sz = 2 + cachedCellSize(&b, cntNew[i]); 7528 if( szNew[i]+sz>usableSpace ) break; 7529 szNew[i] += sz; 7530 cntNew[i]++; 7531 if( !leafData ){ 7532 if( cntNew[i]<b.nCell ){ 7533 sz = 2 + cachedCellSize(&b, cntNew[i]); 7534 }else{ 7535 sz = 0; 7536 } 7537 } 7538 szNew[i+1] -= sz; 7539 } 7540 if( cntNew[i]>=b.nCell ){ 7541 k = i+1; 7542 }else if( cntNew[i] <= (i>0 ? cntNew[i-1] : 0) ){ 7543 rc = SQLITE_CORRUPT_BKPT; 7544 goto balance_cleanup; 7545 } 7546 } 7547 7548 /* 7549 ** The packing computed by the previous block is biased toward the siblings 7550 ** on the left side (siblings with smaller keys). The left siblings are 7551 ** always nearly full, while the right-most sibling might be nearly empty. 7552 ** The next block of code attempts to adjust the packing of siblings to 7553 ** get a better balance. 7554 ** 7555 ** This adjustment is more than an optimization. The packing above might 7556 ** be so out of balance as to be illegal. For example, the right-most 7557 ** sibling might be completely empty. This adjustment is not optional. 7558 */ 7559 for(i=k-1; i>0; i--){ 7560 int szRight = szNew[i]; /* Size of sibling on the right */ 7561 int szLeft = szNew[i-1]; /* Size of sibling on the left */ 7562 int r; /* Index of right-most cell in left sibling */ 7563 int d; /* Index of first cell to the left of right sibling */ 7564 7565 r = cntNew[i-1] - 1; 7566 d = r + 1 - leafData; 7567 (void)cachedCellSize(&b, d); 7568 do{ 7569 assert( d<nMaxCells ); 7570 assert( r<nMaxCells ); 7571 (void)cachedCellSize(&b, r); 7572 if( szRight!=0 7573 && (bBulk || szRight+b.szCell[d]+2 > szLeft-(b.szCell[r]+(i==k-1?0:2)))){ 7574 break; 7575 } 7576 szRight += b.szCell[d] + 2; 7577 szLeft -= b.szCell[r] + 2; 7578 cntNew[i-1] = r; 7579 r--; 7580 d--; 7581 }while( r>=0 ); 7582 szNew[i] = szRight; 7583 szNew[i-1] = szLeft; 7584 if( cntNew[i-1] <= (i>1 ? cntNew[i-2] : 0) ){ 7585 rc = SQLITE_CORRUPT_BKPT; 7586 goto balance_cleanup; 7587 } 7588 } 7589 7590 /* Sanity check: For a non-corrupt database file one of the follwing 7591 ** must be true: 7592 ** (1) We found one or more cells (cntNew[0])>0), or 7593 ** (2) pPage is a virtual root page. A virtual root page is when 7594 ** the real root page is page 1 and we are the only child of 7595 ** that page. 7596 */ 7597 assert( cntNew[0]>0 || (pParent->pgno==1 && pParent->nCell==0) || CORRUPT_DB); 7598 TRACE(("BALANCE: old: %d(nc=%d) %d(nc=%d) %d(nc=%d)\n", 7599 apOld[0]->pgno, apOld[0]->nCell, 7600 nOld>=2 ? apOld[1]->pgno : 0, nOld>=2 ? apOld[1]->nCell : 0, 7601 nOld>=3 ? apOld[2]->pgno : 0, nOld>=3 ? apOld[2]->nCell : 0 7602 )); 7603 7604 /* 7605 ** Allocate k new pages. Reuse old pages where possible. 7606 */ 7607 pageFlags = apOld[0]->aData[0]; 7608 for(i=0; i<k; i++){ 7609 MemPage *pNew; 7610 if( i<nOld ){ 7611 pNew = apNew[i] = apOld[i]; 7612 apOld[i] = 0; 7613 rc = sqlite3PagerWrite(pNew->pDbPage); 7614 nNew++; 7615 if( rc ) goto balance_cleanup; 7616 }else{ 7617 assert( i>0 ); 7618 rc = allocateBtreePage(pBt, &pNew, &pgno, (bBulk ? 1 : pgno), 0); 7619 if( rc ) goto balance_cleanup; 7620 zeroPage(pNew, pageFlags); 7621 apNew[i] = pNew; 7622 nNew++; 7623 cntOld[i] = b.nCell; 7624 7625 /* Set the pointer-map entry for the new sibling page. */ 7626 if( ISAUTOVACUUM ){ 7627 ptrmapPut(pBt, pNew->pgno, PTRMAP_BTREE, pParent->pgno, &rc); 7628 if( rc!=SQLITE_OK ){ 7629 goto balance_cleanup; 7630 } 7631 } 7632 } 7633 } 7634 7635 /* 7636 ** Reassign page numbers so that the new pages are in ascending order. 7637 ** This helps to keep entries in the disk file in order so that a scan 7638 ** of the table is closer to a linear scan through the file. That in turn 7639 ** helps the operating system to deliver pages from the disk more rapidly. 7640 ** 7641 ** An O(n^2) insertion sort algorithm is used, but since n is never more 7642 ** than (NB+2) (a small constant), that should not be a problem. 7643 ** 7644 ** When NB==3, this one optimization makes the database about 25% faster 7645 ** for large insertions and deletions. 7646 */ 7647 for(i=0; i<nNew; i++){ 7648 aPgOrder[i] = aPgno[i] = apNew[i]->pgno; 7649 aPgFlags[i] = apNew[i]->pDbPage->flags; 7650 for(j=0; j<i; j++){ 7651 if( aPgno[j]==aPgno[i] ){ 7652 /* This branch is taken if the set of sibling pages somehow contains 7653 ** duplicate entries. This can happen if the database is corrupt. 7654 ** It would be simpler to detect this as part of the loop below, but 7655 ** we do the detection here in order to avoid populating the pager 7656 ** cache with two separate objects associated with the same 7657 ** page number. */ 7658 assert( CORRUPT_DB ); 7659 rc = SQLITE_CORRUPT_BKPT; 7660 goto balance_cleanup; 7661 } 7662 } 7663 } 7664 for(i=0; i<nNew; i++){ 7665 int iBest = 0; /* aPgno[] index of page number to use */ 7666 for(j=1; j<nNew; j++){ 7667 if( aPgOrder[j]<aPgOrder[iBest] ) iBest = j; 7668 } 7669 pgno = aPgOrder[iBest]; 7670 aPgOrder[iBest] = 0xffffffff; 7671 if( iBest!=i ){ 7672 if( iBest>i ){ 7673 sqlite3PagerRekey(apNew[iBest]->pDbPage, pBt->nPage+iBest+1, 0); 7674 } 7675 sqlite3PagerRekey(apNew[i]->pDbPage, pgno, aPgFlags[iBest]); 7676 apNew[i]->pgno = pgno; 7677 } 7678 } 7679 7680 TRACE(("BALANCE: new: %d(%d nc=%d) %d(%d nc=%d) %d(%d nc=%d) " 7681 "%d(%d nc=%d) %d(%d nc=%d)\n", 7682 apNew[0]->pgno, szNew[0], cntNew[0], 7683 nNew>=2 ? apNew[1]->pgno : 0, nNew>=2 ? szNew[1] : 0, 7684 nNew>=2 ? cntNew[1] - cntNew[0] - !leafData : 0, 7685 nNew>=3 ? apNew[2]->pgno : 0, nNew>=3 ? szNew[2] : 0, 7686 nNew>=3 ? cntNew[2] - cntNew[1] - !leafData : 0, 7687 nNew>=4 ? apNew[3]->pgno : 0, nNew>=4 ? szNew[3] : 0, 7688 nNew>=4 ? cntNew[3] - cntNew[2] - !leafData : 0, 7689 nNew>=5 ? apNew[4]->pgno : 0, nNew>=5 ? szNew[4] : 0, 7690 nNew>=5 ? cntNew[4] - cntNew[3] - !leafData : 0 7691 )); 7692 7693 assert( sqlite3PagerIswriteable(pParent->pDbPage) ); 7694 put4byte(pRight, apNew[nNew-1]->pgno); 7695 7696 /* If the sibling pages are not leaves, ensure that the right-child pointer 7697 ** of the right-most new sibling page is set to the value that was 7698 ** originally in the same field of the right-most old sibling page. */ 7699 if( (pageFlags & PTF_LEAF)==0 && nOld!=nNew ){ 7700 MemPage *pOld = (nNew>nOld ? apNew : apOld)[nOld-1]; 7701 memcpy(&apNew[nNew-1]->aData[8], &pOld->aData[8], 4); 7702 } 7703 7704 /* Make any required updates to pointer map entries associated with 7705 ** cells stored on sibling pages following the balance operation. Pointer 7706 ** map entries associated with divider cells are set by the insertCell() 7707 ** routine. The associated pointer map entries are: 7708 ** 7709 ** a) if the cell contains a reference to an overflow chain, the 7710 ** entry associated with the first page in the overflow chain, and 7711 ** 7712 ** b) if the sibling pages are not leaves, the child page associated 7713 ** with the cell. 7714 ** 7715 ** If the sibling pages are not leaves, then the pointer map entry 7716 ** associated with the right-child of each sibling may also need to be 7717 ** updated. This happens below, after the sibling pages have been 7718 ** populated, not here. 7719 */ 7720 if( ISAUTOVACUUM ){ 7721 MemPage *pNew = apNew[0]; 7722 u8 *aOld = pNew->aData; 7723 int cntOldNext = pNew->nCell + pNew->nOverflow; 7724 int usableSize = pBt->usableSize; 7725 int iNew = 0; 7726 int iOld = 0; 7727 7728 for(i=0; i<b.nCell; i++){ 7729 u8 *pCell = b.apCell[i]; 7730 if( i==cntOldNext ){ 7731 MemPage *pOld = (++iOld)<nNew ? apNew[iOld] : apOld[iOld]; 7732 cntOldNext += pOld->nCell + pOld->nOverflow + !leafData; 7733 aOld = pOld->aData; 7734 } 7735 if( i==cntNew[iNew] ){ 7736 pNew = apNew[++iNew]; 7737 if( !leafData ) continue; 7738 } 7739 7740 /* Cell pCell is destined for new sibling page pNew. Originally, it 7741 ** was either part of sibling page iOld (possibly an overflow cell), 7742 ** or else the divider cell to the left of sibling page iOld. So, 7743 ** if sibling page iOld had the same page number as pNew, and if 7744 ** pCell really was a part of sibling page iOld (not a divider or 7745 ** overflow cell), we can skip updating the pointer map entries. */ 7746 if( iOld>=nNew 7747 || pNew->pgno!=aPgno[iOld] 7748 || !SQLITE_WITHIN(pCell,aOld,&aOld[usableSize]) 7749 ){ 7750 if( !leafCorrection ){ 7751 ptrmapPut(pBt, get4byte(pCell), PTRMAP_BTREE, pNew->pgno, &rc); 7752 } 7753 if( cachedCellSize(&b,i)>pNew->minLocal ){ 7754 ptrmapPutOvflPtr(pNew, pCell, &rc); 7755 } 7756 if( rc ) goto balance_cleanup; 7757 } 7758 } 7759 } 7760 7761 /* Insert new divider cells into pParent. */ 7762 for(i=0; i<nNew-1; i++){ 7763 u8 *pCell; 7764 u8 *pTemp; 7765 int sz; 7766 MemPage *pNew = apNew[i]; 7767 j = cntNew[i]; 7768 7769 assert( j<nMaxCells ); 7770 assert( b.apCell[j]!=0 ); 7771 pCell = b.apCell[j]; 7772 sz = b.szCell[j] + leafCorrection; 7773 pTemp = &aOvflSpace[iOvflSpace]; 7774 if( !pNew->leaf ){ 7775 memcpy(&pNew->aData[8], pCell, 4); 7776 }else if( leafData ){ 7777 /* If the tree is a leaf-data tree, and the siblings are leaves, 7778 ** then there is no divider cell in b.apCell[]. Instead, the divider 7779 ** cell consists of the integer key for the right-most cell of 7780 ** the sibling-page assembled above only. 7781 */ 7782 CellInfo info; 7783 j--; 7784 pNew->xParseCell(pNew, b.apCell[j], &info); 7785 pCell = pTemp; 7786 sz = 4 + putVarint(&pCell[4], info.nKey); 7787 pTemp = 0; 7788 }else{ 7789 pCell -= 4; 7790 /* Obscure case for non-leaf-data trees: If the cell at pCell was 7791 ** previously stored on a leaf node, and its reported size was 4 7792 ** bytes, then it may actually be smaller than this 7793 ** (see btreeParseCellPtr(), 4 bytes is the minimum size of 7794 ** any cell). But it is important to pass the correct size to 7795 ** insertCell(), so reparse the cell now. 7796 ** 7797 ** This can only happen for b-trees used to evaluate "IN (SELECT ...)" 7798 ** and WITHOUT ROWID tables with exactly one column which is the 7799 ** primary key. 7800 */ 7801 if( b.szCell[j]==4 ){ 7802 assert(leafCorrection==4); 7803 sz = pParent->xCellSize(pParent, pCell); 7804 } 7805 } 7806 iOvflSpace += sz; 7807 assert( sz<=pBt->maxLocal+23 ); 7808 assert( iOvflSpace <= (int)pBt->pageSize ); 7809 insertCell(pParent, nxDiv+i, pCell, sz, pTemp, pNew->pgno, &rc); 7810 if( rc!=SQLITE_OK ) goto balance_cleanup; 7811 assert( sqlite3PagerIswriteable(pParent->pDbPage) ); 7812 } 7813 7814 /* Now update the actual sibling pages. The order in which they are updated 7815 ** is important, as this code needs to avoid disrupting any page from which 7816 ** cells may still to be read. In practice, this means: 7817 ** 7818 ** (1) If cells are moving left (from apNew[iPg] to apNew[iPg-1]) 7819 ** then it is not safe to update page apNew[iPg] until after 7820 ** the left-hand sibling apNew[iPg-1] has been updated. 7821 ** 7822 ** (2) If cells are moving right (from apNew[iPg] to apNew[iPg+1]) 7823 ** then it is not safe to update page apNew[iPg] until after 7824 ** the right-hand sibling apNew[iPg+1] has been updated. 7825 ** 7826 ** If neither of the above apply, the page is safe to update. 7827 ** 7828 ** The iPg value in the following loop starts at nNew-1 goes down 7829 ** to 0, then back up to nNew-1 again, thus making two passes over 7830 ** the pages. On the initial downward pass, only condition (1) above 7831 ** needs to be tested because (2) will always be true from the previous 7832 ** step. On the upward pass, both conditions are always true, so the 7833 ** upwards pass simply processes pages that were missed on the downward 7834 ** pass. 7835 */ 7836 for(i=1-nNew; i<nNew; i++){ 7837 int iPg = i<0 ? -i : i; 7838 assert( iPg>=0 && iPg<nNew ); 7839 if( abDone[iPg] ) continue; /* Skip pages already processed */ 7840 if( i>=0 /* On the upwards pass, or... */ 7841 || cntOld[iPg-1]>=cntNew[iPg-1] /* Condition (1) is true */ 7842 ){ 7843 int iNew; 7844 int iOld; 7845 int nNewCell; 7846 7847 /* Verify condition (1): If cells are moving left, update iPg 7848 ** only after iPg-1 has already been updated. */ 7849 assert( iPg==0 || cntOld[iPg-1]>=cntNew[iPg-1] || abDone[iPg-1] ); 7850 7851 /* Verify condition (2): If cells are moving right, update iPg 7852 ** only after iPg+1 has already been updated. */ 7853 assert( cntNew[iPg]>=cntOld[iPg] || abDone[iPg+1] ); 7854 7855 if( iPg==0 ){ 7856 iNew = iOld = 0; 7857 nNewCell = cntNew[0]; 7858 }else{ 7859 iOld = iPg<nOld ? (cntOld[iPg-1] + !leafData) : b.nCell; 7860 iNew = cntNew[iPg-1] + !leafData; 7861 nNewCell = cntNew[iPg] - iNew; 7862 } 7863 7864 rc = editPage(apNew[iPg], iOld, iNew, nNewCell, &b); 7865 if( rc ) goto balance_cleanup; 7866 abDone[iPg]++; 7867 apNew[iPg]->nFree = usableSpace-szNew[iPg]; 7868 assert( apNew[iPg]->nOverflow==0 ); 7869 assert( apNew[iPg]->nCell==nNewCell ); 7870 } 7871 } 7872 7873 /* All pages have been processed exactly once */ 7874 assert( memcmp(abDone, "\01\01\01\01\01", nNew)==0 ); 7875 7876 assert( nOld>0 ); 7877 assert( nNew>0 ); 7878 7879 if( isRoot && pParent->nCell==0 && pParent->hdrOffset<=apNew[0]->nFree ){ 7880 /* The root page of the b-tree now contains no cells. The only sibling 7881 ** page is the right-child of the parent. Copy the contents of the 7882 ** child page into the parent, decreasing the overall height of the 7883 ** b-tree structure by one. This is described as the "balance-shallower" 7884 ** sub-algorithm in some documentation. 7885 ** 7886 ** If this is an auto-vacuum database, the call to copyNodeContent() 7887 ** sets all pointer-map entries corresponding to database image pages 7888 ** for which the pointer is stored within the content being copied. 7889 ** 7890 ** It is critical that the child page be defragmented before being 7891 ** copied into the parent, because if the parent is page 1 then it will 7892 ** by smaller than the child due to the database header, and so all the 7893 ** free space needs to be up front. 7894 */ 7895 assert( nNew==1 || CORRUPT_DB ); 7896 rc = defragmentPage(apNew[0], -1); 7897 testcase( rc!=SQLITE_OK ); 7898 assert( apNew[0]->nFree == 7899 (get2byte(&apNew[0]->aData[5])-apNew[0]->cellOffset-apNew[0]->nCell*2) 7900 || rc!=SQLITE_OK 7901 ); 7902 copyNodeContent(apNew[0], pParent, &rc); 7903 freePage(apNew[0], &rc); 7904 }else if( ISAUTOVACUUM && !leafCorrection ){ 7905 /* Fix the pointer map entries associated with the right-child of each 7906 ** sibling page. All other pointer map entries have already been taken 7907 ** care of. */ 7908 for(i=0; i<nNew; i++){ 7909 u32 key = get4byte(&apNew[i]->aData[8]); 7910 ptrmapPut(pBt, key, PTRMAP_BTREE, apNew[i]->pgno, &rc); 7911 } 7912 } 7913 7914 assert( pParent->isInit ); 7915 TRACE(("BALANCE: finished: old=%d new=%d cells=%d\n", 7916 nOld, nNew, b.nCell)); 7917 7918 /* Free any old pages that were not reused as new pages. 7919 */ 7920 for(i=nNew; i<nOld; i++){ 7921 freePage(apOld[i], &rc); 7922 } 7923 7924 #if 0 7925 if( ISAUTOVACUUM && rc==SQLITE_OK && apNew[0]->isInit ){ 7926 /* The ptrmapCheckPages() contains assert() statements that verify that 7927 ** all pointer map pages are set correctly. This is helpful while 7928 ** debugging. This is usually disabled because a corrupt database may 7929 ** cause an assert() statement to fail. */ 7930 ptrmapCheckPages(apNew, nNew); 7931 ptrmapCheckPages(&pParent, 1); 7932 } 7933 #endif 7934 7935 /* 7936 ** Cleanup before returning. 7937 */ 7938 balance_cleanup: 7939 sqlite3StackFree(0, b.apCell); 7940 for(i=0; i<nOld; i++){ 7941 releasePage(apOld[i]); 7942 } 7943 for(i=0; i<nNew; i++){ 7944 releasePage(apNew[i]); 7945 } 7946 7947 return rc; 7948 } 7949 7950 7951 /* 7952 ** This function is called when the root page of a b-tree structure is 7953 ** overfull (has one or more overflow pages). 7954 ** 7955 ** A new child page is allocated and the contents of the current root 7956 ** page, including overflow cells, are copied into the child. The root 7957 ** page is then overwritten to make it an empty page with the right-child 7958 ** pointer pointing to the new page. 7959 ** 7960 ** Before returning, all pointer-map entries corresponding to pages 7961 ** that the new child-page now contains pointers to are updated. The 7962 ** entry corresponding to the new right-child pointer of the root 7963 ** page is also updated. 7964 ** 7965 ** If successful, *ppChild is set to contain a reference to the child 7966 ** page and SQLITE_OK is returned. In this case the caller is required 7967 ** to call releasePage() on *ppChild exactly once. If an error occurs, 7968 ** an error code is returned and *ppChild is set to 0. 7969 */ 7970 static int balance_deeper(MemPage *pRoot, MemPage **ppChild){ 7971 int rc; /* Return value from subprocedures */ 7972 MemPage *pChild = 0; /* Pointer to a new child page */ 7973 Pgno pgnoChild = 0; /* Page number of the new child page */ 7974 BtShared *pBt = pRoot->pBt; /* The BTree */ 7975 7976 assert( pRoot->nOverflow>0 ); 7977 assert( sqlite3_mutex_held(pBt->mutex) ); 7978 7979 /* Make pRoot, the root page of the b-tree, writable. Allocate a new 7980 ** page that will become the new right-child of pPage. Copy the contents 7981 ** of the node stored on pRoot into the new child page. 7982 */ 7983 rc = sqlite3PagerWrite(pRoot->pDbPage); 7984 if( rc==SQLITE_OK ){ 7985 rc = allocateBtreePage(pBt,&pChild,&pgnoChild,pRoot->pgno,0); 7986 copyNodeContent(pRoot, pChild, &rc); 7987 if( ISAUTOVACUUM ){ 7988 ptrmapPut(pBt, pgnoChild, PTRMAP_BTREE, pRoot->pgno, &rc); 7989 } 7990 } 7991 if( rc ){ 7992 *ppChild = 0; 7993 releasePage(pChild); 7994 return rc; 7995 } 7996 assert( sqlite3PagerIswriteable(pChild->pDbPage) ); 7997 assert( sqlite3PagerIswriteable(pRoot->pDbPage) ); 7998 assert( pChild->nCell==pRoot->nCell ); 7999 8000 TRACE(("BALANCE: copy root %d into %d\n", pRoot->pgno, pChild->pgno)); 8001 8002 /* Copy the overflow cells from pRoot to pChild */ 8003 memcpy(pChild->aiOvfl, pRoot->aiOvfl, 8004 pRoot->nOverflow*sizeof(pRoot->aiOvfl[0])); 8005 memcpy(pChild->apOvfl, pRoot->apOvfl, 8006 pRoot->nOverflow*sizeof(pRoot->apOvfl[0])); 8007 pChild->nOverflow = pRoot->nOverflow; 8008 8009 /* Zero the contents of pRoot. Then install pChild as the right-child. */ 8010 zeroPage(pRoot, pChild->aData[0] & ~PTF_LEAF); 8011 put4byte(&pRoot->aData[pRoot->hdrOffset+8], pgnoChild); 8012 8013 *ppChild = pChild; 8014 return SQLITE_OK; 8015 } 8016 8017 /* 8018 ** The page that pCur currently points to has just been modified in 8019 ** some way. This function figures out if this modification means the 8020 ** tree needs to be balanced, and if so calls the appropriate balancing 8021 ** routine. Balancing routines are: 8022 ** 8023 ** balance_quick() 8024 ** balance_deeper() 8025 ** balance_nonroot() 8026 */ 8027 static int balance(BtCursor *pCur){ 8028 int rc = SQLITE_OK; 8029 const int nMin = pCur->pBt->usableSize * 2 / 3; 8030 u8 aBalanceQuickSpace[13]; 8031 u8 *pFree = 0; 8032 8033 VVA_ONLY( int balance_quick_called = 0 ); 8034 VVA_ONLY( int balance_deeper_called = 0 ); 8035 8036 do { 8037 int iPage = pCur->iPage; 8038 MemPage *pPage = pCur->pPage; 8039 8040 if( iPage==0 ){ 8041 if( pPage->nOverflow ){ 8042 /* The root page of the b-tree is overfull. In this case call the 8043 ** balance_deeper() function to create a new child for the root-page 8044 ** and copy the current contents of the root-page to it. The 8045 ** next iteration of the do-loop will balance the child page. 8046 */ 8047 assert( balance_deeper_called==0 ); 8048 VVA_ONLY( balance_deeper_called++ ); 8049 rc = balance_deeper(pPage, &pCur->apPage[1]); 8050 if( rc==SQLITE_OK ){ 8051 pCur->iPage = 1; 8052 pCur->ix = 0; 8053 pCur->aiIdx[0] = 0; 8054 pCur->apPage[0] = pPage; 8055 pCur->pPage = pCur->apPage[1]; 8056 assert( pCur->pPage->nOverflow ); 8057 } 8058 }else{ 8059 break; 8060 } 8061 }else if( pPage->nOverflow==0 && pPage->nFree<=nMin ){ 8062 break; 8063 }else{ 8064 MemPage * const pParent = pCur->apPage[iPage-1]; 8065 int const iIdx = pCur->aiIdx[iPage-1]; 8066 8067 rc = sqlite3PagerWrite(pParent->pDbPage); 8068 if( rc==SQLITE_OK ){ 8069 #ifndef SQLITE_OMIT_QUICKBALANCE 8070 if( pPage->intKeyLeaf 8071 && pPage->nOverflow==1 8072 && pPage->aiOvfl[0]==pPage->nCell 8073 && pParent->pgno!=1 8074 && pParent->nCell==iIdx 8075 ){ 8076 /* Call balance_quick() to create a new sibling of pPage on which 8077 ** to store the overflow cell. balance_quick() inserts a new cell 8078 ** into pParent, which may cause pParent overflow. If this 8079 ** happens, the next iteration of the do-loop will balance pParent 8080 ** use either balance_nonroot() or balance_deeper(). Until this 8081 ** happens, the overflow cell is stored in the aBalanceQuickSpace[] 8082 ** buffer. 8083 ** 8084 ** The purpose of the following assert() is to check that only a 8085 ** single call to balance_quick() is made for each call to this 8086 ** function. If this were not verified, a subtle bug involving reuse 8087 ** of the aBalanceQuickSpace[] might sneak in. 8088 */ 8089 assert( balance_quick_called==0 ); 8090 VVA_ONLY( balance_quick_called++ ); 8091 rc = balance_quick(pParent, pPage, aBalanceQuickSpace); 8092 }else 8093 #endif 8094 { 8095 /* In this case, call balance_nonroot() to redistribute cells 8096 ** between pPage and up to 2 of its sibling pages. This involves 8097 ** modifying the contents of pParent, which may cause pParent to 8098 ** become overfull or underfull. The next iteration of the do-loop 8099 ** will balance the parent page to correct this. 8100 ** 8101 ** If the parent page becomes overfull, the overflow cell or cells 8102 ** are stored in the pSpace buffer allocated immediately below. 8103 ** A subsequent iteration of the do-loop will deal with this by 8104 ** calling balance_nonroot() (balance_deeper() may be called first, 8105 ** but it doesn't deal with overflow cells - just moves them to a 8106 ** different page). Once this subsequent call to balance_nonroot() 8107 ** has completed, it is safe to release the pSpace buffer used by 8108 ** the previous call, as the overflow cell data will have been 8109 ** copied either into the body of a database page or into the new 8110 ** pSpace buffer passed to the latter call to balance_nonroot(). 8111 */ 8112 u8 *pSpace = sqlite3PageMalloc(pCur->pBt->pageSize); 8113 rc = balance_nonroot(pParent, iIdx, pSpace, iPage==1, 8114 pCur->hints&BTREE_BULKLOAD); 8115 if( pFree ){ 8116 /* If pFree is not NULL, it points to the pSpace buffer used 8117 ** by a previous call to balance_nonroot(). Its contents are 8118 ** now stored either on real database pages or within the 8119 ** new pSpace buffer, so it may be safely freed here. */ 8120 sqlite3PageFree(pFree); 8121 } 8122 8123 /* The pSpace buffer will be freed after the next call to 8124 ** balance_nonroot(), or just before this function returns, whichever 8125 ** comes first. */ 8126 pFree = pSpace; 8127 } 8128 } 8129 8130 pPage->nOverflow = 0; 8131 8132 /* The next iteration of the do-loop balances the parent page. */ 8133 releasePage(pPage); 8134 pCur->iPage--; 8135 assert( pCur->iPage>=0 ); 8136 pCur->pPage = pCur->apPage[pCur->iPage]; 8137 } 8138 }while( rc==SQLITE_OK ); 8139 8140 if( pFree ){ 8141 sqlite3PageFree(pFree); 8142 } 8143 return rc; 8144 } 8145 8146 8147 /* 8148 ** Insert a new record into the BTree. The content of the new record 8149 ** is described by the pX object. The pCur cursor is used only to 8150 ** define what table the record should be inserted into, and is left 8151 ** pointing at a random location. 8152 ** 8153 ** For a table btree (used for rowid tables), only the pX.nKey value of 8154 ** the key is used. The pX.pKey value must be NULL. The pX.nKey is the 8155 ** rowid or INTEGER PRIMARY KEY of the row. The pX.nData,pData,nZero fields 8156 ** hold the content of the row. 8157 ** 8158 ** For an index btree (used for indexes and WITHOUT ROWID tables), the 8159 ** key is an arbitrary byte sequence stored in pX.pKey,nKey. The 8160 ** pX.pData,nData,nZero fields must be zero. 8161 ** 8162 ** If the seekResult parameter is non-zero, then a successful call to 8163 ** MovetoUnpacked() to seek cursor pCur to (pKey,nKey) has already 8164 ** been performed. In other words, if seekResult!=0 then the cursor 8165 ** is currently pointing to a cell that will be adjacent to the cell 8166 ** to be inserted. If seekResult<0 then pCur points to a cell that is 8167 ** smaller then (pKey,nKey). If seekResult>0 then pCur points to a cell 8168 ** that is larger than (pKey,nKey). 8169 ** 8170 ** If seekResult==0, that means pCur is pointing at some unknown location. 8171 ** In that case, this routine must seek the cursor to the correct insertion 8172 ** point for (pKey,nKey) before doing the insertion. For index btrees, 8173 ** if pX->nMem is non-zero, then pX->aMem contains pointers to the unpacked 8174 ** key values and pX->aMem can be used instead of pX->pKey to avoid having 8175 ** to decode the key. 8176 */ 8177 int sqlite3BtreeInsert( 8178 BtCursor *pCur, /* Insert data into the table of this cursor */ 8179 const BtreePayload *pX, /* Content of the row to be inserted */ 8180 int flags, /* True if this is likely an append */ 8181 int seekResult /* Result of prior MovetoUnpacked() call */ 8182 ){ 8183 int rc; 8184 int loc = seekResult; /* -1: before desired location +1: after */ 8185 int szNew = 0; 8186 int idx; 8187 MemPage *pPage; 8188 Btree *p = pCur->pBtree; 8189 BtShared *pBt = p->pBt; 8190 unsigned char *oldCell; 8191 unsigned char *newCell = 0; 8192 8193 assert( (flags & (BTREE_SAVEPOSITION|BTREE_APPEND))==flags ); 8194 8195 if( pCur->eState==CURSOR_FAULT ){ 8196 assert( pCur->skipNext!=SQLITE_OK ); 8197 return pCur->skipNext; 8198 } 8199 8200 assert( cursorOwnsBtShared(pCur) ); 8201 assert( (pCur->curFlags & BTCF_WriteFlag)!=0 8202 && pBt->inTransaction==TRANS_WRITE 8203 && (pBt->btsFlags & BTS_READ_ONLY)==0 ); 8204 assert( hasSharedCacheTableLock(p, pCur->pgnoRoot, pCur->pKeyInfo!=0, 2) ); 8205 8206 /* Assert that the caller has been consistent. If this cursor was opened 8207 ** expecting an index b-tree, then the caller should be inserting blob 8208 ** keys with no associated data. If the cursor was opened expecting an 8209 ** intkey table, the caller should be inserting integer keys with a 8210 ** blob of associated data. */ 8211 assert( (pX->pKey==0)==(pCur->pKeyInfo==0) ); 8212 8213 /* Save the positions of any other cursors open on this table. 8214 ** 8215 ** In some cases, the call to btreeMoveto() below is a no-op. For 8216 ** example, when inserting data into a table with auto-generated integer 8217 ** keys, the VDBE layer invokes sqlite3BtreeLast() to figure out the 8218 ** integer key to use. It then calls this function to actually insert the 8219 ** data into the intkey B-Tree. In this case btreeMoveto() recognizes 8220 ** that the cursor is already where it needs to be and returns without 8221 ** doing any work. To avoid thwarting these optimizations, it is important 8222 ** not to clear the cursor here. 8223 */ 8224 if( pCur->curFlags & BTCF_Multiple ){ 8225 rc = saveAllCursors(pBt, pCur->pgnoRoot, pCur); 8226 if( rc ) return rc; 8227 } 8228 8229 if( pCur->pKeyInfo==0 ){ 8230 assert( pX->pKey==0 ); 8231 /* If this is an insert into a table b-tree, invalidate any incrblob 8232 ** cursors open on the row being replaced */ 8233 invalidateIncrblobCursors(p, pCur->pgnoRoot, pX->nKey, 0); 8234 8235 /* If BTREE_SAVEPOSITION is set, the cursor must already be pointing 8236 ** to a row with the same key as the new entry being inserted. */ 8237 assert( (flags & BTREE_SAVEPOSITION)==0 || 8238 ((pCur->curFlags&BTCF_ValidNKey)!=0 && pX->nKey==pCur->info.nKey) ); 8239 8240 /* If the cursor is currently on the last row and we are appending a 8241 ** new row onto the end, set the "loc" to avoid an unnecessary 8242 ** btreeMoveto() call */ 8243 if( (pCur->curFlags&BTCF_ValidNKey)!=0 && pX->nKey==pCur->info.nKey ){ 8244 loc = 0; 8245 }else if( loc==0 ){ 8246 rc = sqlite3BtreeMovetoUnpacked(pCur, 0, pX->nKey, flags!=0, &loc); 8247 if( rc ) return rc; 8248 } 8249 }else if( loc==0 && (flags & BTREE_SAVEPOSITION)==0 ){ 8250 if( pX->nMem ){ 8251 UnpackedRecord r; 8252 r.pKeyInfo = pCur->pKeyInfo; 8253 r.aMem = pX->aMem; 8254 r.nField = pX->nMem; 8255 r.default_rc = 0; 8256 r.errCode = 0; 8257 r.r1 = 0; 8258 r.r2 = 0; 8259 r.eqSeen = 0; 8260 rc = sqlite3BtreeMovetoUnpacked(pCur, &r, 0, flags!=0, &loc); 8261 }else{ 8262 rc = btreeMoveto(pCur, pX->pKey, pX->nKey, flags!=0, &loc); 8263 } 8264 if( rc ) return rc; 8265 } 8266 assert( pCur->eState==CURSOR_VALID || (pCur->eState==CURSOR_INVALID && loc) ); 8267 8268 pPage = pCur->pPage; 8269 assert( pPage->intKey || pX->nKey>=0 ); 8270 assert( pPage->leaf || !pPage->intKey ); 8271 8272 TRACE(("INSERT: table=%d nkey=%lld ndata=%d page=%d %s\n", 8273 pCur->pgnoRoot, pX->nKey, pX->nData, pPage->pgno, 8274 loc==0 ? "overwrite" : "new entry")); 8275 assert( pPage->isInit ); 8276 newCell = pBt->pTmpSpace; 8277 assert( newCell!=0 ); 8278 rc = fillInCell(pPage, newCell, pX, &szNew); 8279 if( rc ) goto end_insert; 8280 assert( szNew==pPage->xCellSize(pPage, newCell) ); 8281 assert( szNew <= MX_CELL_SIZE(pBt) ); 8282 idx = pCur->ix; 8283 if( loc==0 ){ 8284 CellInfo info; 8285 assert( idx<pPage->nCell ); 8286 rc = sqlite3PagerWrite(pPage->pDbPage); 8287 if( rc ){ 8288 goto end_insert; 8289 } 8290 oldCell = findCell(pPage, idx); 8291 if( !pPage->leaf ){ 8292 memcpy(newCell, oldCell, 4); 8293 } 8294 rc = clearCell(pPage, oldCell, &info); 8295 if( info.nSize==szNew && info.nLocal==info.nPayload 8296 && (!ISAUTOVACUUM || szNew<pPage->minLocal) 8297 ){ 8298 /* Overwrite the old cell with the new if they are the same size. 8299 ** We could also try to do this if the old cell is smaller, then add 8300 ** the leftover space to the free list. But experiments show that 8301 ** doing that is no faster then skipping this optimization and just 8302 ** calling dropCell() and insertCell(). 8303 ** 8304 ** This optimization cannot be used on an autovacuum database if the 8305 ** new entry uses overflow pages, as the insertCell() call below is 8306 ** necessary to add the PTRMAP_OVERFLOW1 pointer-map entry. */ 8307 assert( rc==SQLITE_OK ); /* clearCell never fails when nLocal==nPayload */ 8308 if( oldCell+szNew > pPage->aDataEnd ) return SQLITE_CORRUPT_BKPT; 8309 memcpy(oldCell, newCell, szNew); 8310 return SQLITE_OK; 8311 } 8312 dropCell(pPage, idx, info.nSize, &rc); 8313 if( rc ) goto end_insert; 8314 }else if( loc<0 && pPage->nCell>0 ){ 8315 assert( pPage->leaf ); 8316 idx = ++pCur->ix; 8317 pCur->curFlags &= ~BTCF_ValidNKey; 8318 }else{ 8319 assert( pPage->leaf ); 8320 } 8321 insertCell(pPage, idx, newCell, szNew, 0, 0, &rc); 8322 assert( pPage->nOverflow==0 || rc==SQLITE_OK ); 8323 assert( rc!=SQLITE_OK || pPage->nCell>0 || pPage->nOverflow>0 ); 8324 8325 /* If no error has occurred and pPage has an overflow cell, call balance() 8326 ** to redistribute the cells within the tree. Since balance() may move 8327 ** the cursor, zero the BtCursor.info.nSize and BTCF_ValidNKey 8328 ** variables. 8329 ** 8330 ** Previous versions of SQLite called moveToRoot() to move the cursor 8331 ** back to the root page as balance() used to invalidate the contents 8332 ** of BtCursor.apPage[] and BtCursor.aiIdx[]. Instead of doing that, 8333 ** set the cursor state to "invalid". This makes common insert operations 8334 ** slightly faster. 8335 ** 8336 ** There is a subtle but important optimization here too. When inserting 8337 ** multiple records into an intkey b-tree using a single cursor (as can 8338 ** happen while processing an "INSERT INTO ... SELECT" statement), it 8339 ** is advantageous to leave the cursor pointing to the last entry in 8340 ** the b-tree if possible. If the cursor is left pointing to the last 8341 ** entry in the table, and the next row inserted has an integer key 8342 ** larger than the largest existing key, it is possible to insert the 8343 ** row without seeking the cursor. This can be a big performance boost. 8344 */ 8345 pCur->info.nSize = 0; 8346 if( pPage->nOverflow ){ 8347 assert( rc==SQLITE_OK ); 8348 pCur->curFlags &= ~(BTCF_ValidNKey); 8349 rc = balance(pCur); 8350 8351 /* Must make sure nOverflow is reset to zero even if the balance() 8352 ** fails. Internal data structure corruption will result otherwise. 8353 ** Also, set the cursor state to invalid. This stops saveCursorPosition() 8354 ** from trying to save the current position of the cursor. */ 8355 pCur->pPage->nOverflow = 0; 8356 pCur->eState = CURSOR_INVALID; 8357 if( (flags & BTREE_SAVEPOSITION) && rc==SQLITE_OK ){ 8358 btreeReleaseAllCursorPages(pCur); 8359 if( pCur->pKeyInfo ){ 8360 assert( pCur->pKey==0 ); 8361 pCur->pKey = sqlite3Malloc( pX->nKey ); 8362 if( pCur->pKey==0 ){ 8363 rc = SQLITE_NOMEM; 8364 }else{ 8365 memcpy(pCur->pKey, pX->pKey, pX->nKey); 8366 } 8367 } 8368 pCur->eState = CURSOR_REQUIRESEEK; 8369 pCur->nKey = pX->nKey; 8370 } 8371 } 8372 assert( pCur->iPage<0 || pCur->pPage->nOverflow==0 ); 8373 8374 end_insert: 8375 return rc; 8376 } 8377 8378 /* 8379 ** Delete the entry that the cursor is pointing to. 8380 ** 8381 ** If the BTREE_SAVEPOSITION bit of the flags parameter is zero, then 8382 ** the cursor is left pointing at an arbitrary location after the delete. 8383 ** But if that bit is set, then the cursor is left in a state such that 8384 ** the next call to BtreeNext() or BtreePrev() moves it to the same row 8385 ** as it would have been on if the call to BtreeDelete() had been omitted. 8386 ** 8387 ** The BTREE_AUXDELETE bit of flags indicates that is one of several deletes 8388 ** associated with a single table entry and its indexes. Only one of those 8389 ** deletes is considered the "primary" delete. The primary delete occurs 8390 ** on a cursor that is not a BTREE_FORDELETE cursor. All but one delete 8391 ** operation on non-FORDELETE cursors is tagged with the AUXDELETE flag. 8392 ** The BTREE_AUXDELETE bit is a hint that is not used by this implementation, 8393 ** but which might be used by alternative storage engines. 8394 */ 8395 int sqlite3BtreeDelete(BtCursor *pCur, u8 flags){ 8396 Btree *p = pCur->pBtree; 8397 BtShared *pBt = p->pBt; 8398 int rc; /* Return code */ 8399 MemPage *pPage; /* Page to delete cell from */ 8400 unsigned char *pCell; /* Pointer to cell to delete */ 8401 int iCellIdx; /* Index of cell to delete */ 8402 int iCellDepth; /* Depth of node containing pCell */ 8403 CellInfo info; /* Size of the cell being deleted */ 8404 int bSkipnext = 0; /* Leaf cursor in SKIPNEXT state */ 8405 u8 bPreserve = flags & BTREE_SAVEPOSITION; /* Keep cursor valid */ 8406 8407 assert( cursorOwnsBtShared(pCur) ); 8408 assert( pBt->inTransaction==TRANS_WRITE ); 8409 assert( (pBt->btsFlags & BTS_READ_ONLY)==0 ); 8410 assert( pCur->curFlags & BTCF_WriteFlag ); 8411 assert( hasSharedCacheTableLock(p, pCur->pgnoRoot, pCur->pKeyInfo!=0, 2) ); 8412 assert( !hasReadConflicts(p, pCur->pgnoRoot) ); 8413 assert( pCur->ix<pCur->pPage->nCell ); 8414 assert( pCur->eState==CURSOR_VALID ); 8415 assert( (flags & ~(BTREE_SAVEPOSITION | BTREE_AUXDELETE))==0 ); 8416 8417 iCellDepth = pCur->iPage; 8418 iCellIdx = pCur->ix; 8419 pPage = pCur->pPage; 8420 pCell = findCell(pPage, iCellIdx); 8421 8422 /* If the bPreserve flag is set to true, then the cursor position must 8423 ** be preserved following this delete operation. If the current delete 8424 ** will cause a b-tree rebalance, then this is done by saving the cursor 8425 ** key and leaving the cursor in CURSOR_REQUIRESEEK state before 8426 ** returning. 8427 ** 8428 ** Or, if the current delete will not cause a rebalance, then the cursor 8429 ** will be left in CURSOR_SKIPNEXT state pointing to the entry immediately 8430 ** before or after the deleted entry. In this case set bSkipnext to true. */ 8431 if( bPreserve ){ 8432 if( !pPage->leaf 8433 || (pPage->nFree+cellSizePtr(pPage,pCell)+2)>(int)(pBt->usableSize*2/3) 8434 ){ 8435 /* A b-tree rebalance will be required after deleting this entry. 8436 ** Save the cursor key. */ 8437 rc = saveCursorKey(pCur); 8438 if( rc ) return rc; 8439 }else{ 8440 bSkipnext = 1; 8441 } 8442 } 8443 8444 /* If the page containing the entry to delete is not a leaf page, move 8445 ** the cursor to the largest entry in the tree that is smaller than 8446 ** the entry being deleted. This cell will replace the cell being deleted 8447 ** from the internal node. The 'previous' entry is used for this instead 8448 ** of the 'next' entry, as the previous entry is always a part of the 8449 ** sub-tree headed by the child page of the cell being deleted. This makes 8450 ** balancing the tree following the delete operation easier. */ 8451 if( !pPage->leaf ){ 8452 rc = sqlite3BtreePrevious(pCur, 0); 8453 assert( rc!=SQLITE_DONE ); 8454 if( rc ) return rc; 8455 } 8456 8457 /* Save the positions of any other cursors open on this table before 8458 ** making any modifications. */ 8459 if( pCur->curFlags & BTCF_Multiple ){ 8460 rc = saveAllCursors(pBt, pCur->pgnoRoot, pCur); 8461 if( rc ) return rc; 8462 } 8463 8464 /* If this is a delete operation to remove a row from a table b-tree, 8465 ** invalidate any incrblob cursors open on the row being deleted. */ 8466 if( pCur->pKeyInfo==0 ){ 8467 invalidateIncrblobCursors(p, pCur->pgnoRoot, pCur->info.nKey, 0); 8468 } 8469 8470 /* Make the page containing the entry to be deleted writable. Then free any 8471 ** overflow pages associated with the entry and finally remove the cell 8472 ** itself from within the page. */ 8473 rc = sqlite3PagerWrite(pPage->pDbPage); 8474 if( rc ) return rc; 8475 rc = clearCell(pPage, pCell, &info); 8476 dropCell(pPage, iCellIdx, info.nSize, &rc); 8477 if( rc ) return rc; 8478 8479 /* If the cell deleted was not located on a leaf page, then the cursor 8480 ** is currently pointing to the largest entry in the sub-tree headed 8481 ** by the child-page of the cell that was just deleted from an internal 8482 ** node. The cell from the leaf node needs to be moved to the internal 8483 ** node to replace the deleted cell. */ 8484 if( !pPage->leaf ){ 8485 MemPage *pLeaf = pCur->pPage; 8486 int nCell; 8487 Pgno n; 8488 unsigned char *pTmp; 8489 8490 if( iCellDepth<pCur->iPage-1 ){ 8491 n = pCur->apPage[iCellDepth+1]->pgno; 8492 }else{ 8493 n = pCur->pPage->pgno; 8494 } 8495 pCell = findCell(pLeaf, pLeaf->nCell-1); 8496 if( pCell<&pLeaf->aData[4] ) return SQLITE_CORRUPT_BKPT; 8497 nCell = pLeaf->xCellSize(pLeaf, pCell); 8498 assert( MX_CELL_SIZE(pBt) >= nCell ); 8499 pTmp = pBt->pTmpSpace; 8500 assert( pTmp!=0 ); 8501 rc = sqlite3PagerWrite(pLeaf->pDbPage); 8502 if( rc==SQLITE_OK ){ 8503 insertCell(pPage, iCellIdx, pCell-4, nCell+4, pTmp, n, &rc); 8504 } 8505 dropCell(pLeaf, pLeaf->nCell-1, nCell, &rc); 8506 if( rc ) return rc; 8507 } 8508 8509 /* Balance the tree. If the entry deleted was located on a leaf page, 8510 ** then the cursor still points to that page. In this case the first 8511 ** call to balance() repairs the tree, and the if(...) condition is 8512 ** never true. 8513 ** 8514 ** Otherwise, if the entry deleted was on an internal node page, then 8515 ** pCur is pointing to the leaf page from which a cell was removed to 8516 ** replace the cell deleted from the internal node. This is slightly 8517 ** tricky as the leaf node may be underfull, and the internal node may 8518 ** be either under or overfull. In this case run the balancing algorithm 8519 ** on the leaf node first. If the balance proceeds far enough up the 8520 ** tree that we can be sure that any problem in the internal node has 8521 ** been corrected, so be it. Otherwise, after balancing the leaf node, 8522 ** walk the cursor up the tree to the internal node and balance it as 8523 ** well. */ 8524 rc = balance(pCur); 8525 if( rc==SQLITE_OK && pCur->iPage>iCellDepth ){ 8526 releasePageNotNull(pCur->pPage); 8527 pCur->iPage--; 8528 while( pCur->iPage>iCellDepth ){ 8529 releasePage(pCur->apPage[pCur->iPage--]); 8530 } 8531 pCur->pPage = pCur->apPage[pCur->iPage]; 8532 rc = balance(pCur); 8533 } 8534 8535 if( rc==SQLITE_OK ){ 8536 if( bSkipnext ){ 8537 assert( bPreserve && (pCur->iPage==iCellDepth || CORRUPT_DB) ); 8538 assert( pPage==pCur->pPage || CORRUPT_DB ); 8539 assert( (pPage->nCell>0 || CORRUPT_DB) && iCellIdx<=pPage->nCell ); 8540 pCur->eState = CURSOR_SKIPNEXT; 8541 if( iCellIdx>=pPage->nCell ){ 8542 pCur->skipNext = -1; 8543 pCur->ix = pPage->nCell-1; 8544 }else{ 8545 pCur->skipNext = 1; 8546 } 8547 }else{ 8548 rc = moveToRoot(pCur); 8549 if( bPreserve ){ 8550 btreeReleaseAllCursorPages(pCur); 8551 pCur->eState = CURSOR_REQUIRESEEK; 8552 } 8553 if( rc==SQLITE_EMPTY ) rc = SQLITE_OK; 8554 } 8555 } 8556 return rc; 8557 } 8558 8559 /* 8560 ** Create a new BTree table. Write into *piTable the page 8561 ** number for the root page of the new table. 8562 ** 8563 ** The type of type is determined by the flags parameter. Only the 8564 ** following values of flags are currently in use. Other values for 8565 ** flags might not work: 8566 ** 8567 ** BTREE_INTKEY|BTREE_LEAFDATA Used for SQL tables with rowid keys 8568 ** BTREE_ZERODATA Used for SQL indices 8569 */ 8570 static int btreeCreateTable(Btree *p, int *piTable, int createTabFlags){ 8571 BtShared *pBt = p->pBt; 8572 MemPage *pRoot; 8573 Pgno pgnoRoot; 8574 int rc; 8575 int ptfFlags; /* Page-type flage for the root page of new table */ 8576 8577 assert( sqlite3BtreeHoldsMutex(p) ); 8578 assert( pBt->inTransaction==TRANS_WRITE ); 8579 assert( (pBt->btsFlags & BTS_READ_ONLY)==0 ); 8580 8581 #ifdef SQLITE_OMIT_AUTOVACUUM 8582 rc = allocateBtreePage(pBt, &pRoot, &pgnoRoot, 1, 0); 8583 if( rc ){ 8584 return rc; 8585 } 8586 #else 8587 if( pBt->autoVacuum ){ 8588 Pgno pgnoMove; /* Move a page here to make room for the root-page */ 8589 MemPage *pPageMove; /* The page to move to. */ 8590 8591 /* Creating a new table may probably require moving an existing database 8592 ** to make room for the new tables root page. In case this page turns 8593 ** out to be an overflow page, delete all overflow page-map caches 8594 ** held by open cursors. 8595 */ 8596 invalidateAllOverflowCache(pBt); 8597 8598 /* Read the value of meta[3] from the database to determine where the 8599 ** root page of the new table should go. meta[3] is the largest root-page 8600 ** created so far, so the new root-page is (meta[3]+1). 8601 */ 8602 sqlite3BtreeGetMeta(p, BTREE_LARGEST_ROOT_PAGE, &pgnoRoot); 8603 pgnoRoot++; 8604 8605 /* The new root-page may not be allocated on a pointer-map page, or the 8606 ** PENDING_BYTE page. 8607 */ 8608 while( pgnoRoot==PTRMAP_PAGENO(pBt, pgnoRoot) || 8609 pgnoRoot==PENDING_BYTE_PAGE(pBt) ){ 8610 pgnoRoot++; 8611 } 8612 assert( pgnoRoot>=3 || CORRUPT_DB ); 8613 testcase( pgnoRoot<3 ); 8614 8615 /* Allocate a page. The page that currently resides at pgnoRoot will 8616 ** be moved to the allocated page (unless the allocated page happens 8617 ** to reside at pgnoRoot). 8618 */ 8619 rc = allocateBtreePage(pBt, &pPageMove, &pgnoMove, pgnoRoot, BTALLOC_EXACT); 8620 if( rc!=SQLITE_OK ){ 8621 return rc; 8622 } 8623 8624 if( pgnoMove!=pgnoRoot ){ 8625 /* pgnoRoot is the page that will be used for the root-page of 8626 ** the new table (assuming an error did not occur). But we were 8627 ** allocated pgnoMove. If required (i.e. if it was not allocated 8628 ** by extending the file), the current page at position pgnoMove 8629 ** is already journaled. 8630 */ 8631 u8 eType = 0; 8632 Pgno iPtrPage = 0; 8633 8634 /* Save the positions of any open cursors. This is required in 8635 ** case they are holding a reference to an xFetch reference 8636 ** corresponding to page pgnoRoot. */ 8637 rc = saveAllCursors(pBt, 0, 0); 8638 releasePage(pPageMove); 8639 if( rc!=SQLITE_OK ){ 8640 return rc; 8641 } 8642 8643 /* Move the page currently at pgnoRoot to pgnoMove. */ 8644 rc = btreeGetPage(pBt, pgnoRoot, &pRoot, 0); 8645 if( rc!=SQLITE_OK ){ 8646 return rc; 8647 } 8648 rc = ptrmapGet(pBt, pgnoRoot, &eType, &iPtrPage); 8649 if( eType==PTRMAP_ROOTPAGE || eType==PTRMAP_FREEPAGE ){ 8650 rc = SQLITE_CORRUPT_BKPT; 8651 } 8652 if( rc!=SQLITE_OK ){ 8653 releasePage(pRoot); 8654 return rc; 8655 } 8656 assert( eType!=PTRMAP_ROOTPAGE ); 8657 assert( eType!=PTRMAP_FREEPAGE ); 8658 rc = relocatePage(pBt, pRoot, eType, iPtrPage, pgnoMove, 0); 8659 releasePage(pRoot); 8660 8661 /* Obtain the page at pgnoRoot */ 8662 if( rc!=SQLITE_OK ){ 8663 return rc; 8664 } 8665 rc = btreeGetPage(pBt, pgnoRoot, &pRoot, 0); 8666 if( rc!=SQLITE_OK ){ 8667 return rc; 8668 } 8669 rc = sqlite3PagerWrite(pRoot->pDbPage); 8670 if( rc!=SQLITE_OK ){ 8671 releasePage(pRoot); 8672 return rc; 8673 } 8674 }else{ 8675 pRoot = pPageMove; 8676 } 8677 8678 /* Update the pointer-map and meta-data with the new root-page number. */ 8679 ptrmapPut(pBt, pgnoRoot, PTRMAP_ROOTPAGE, 0, &rc); 8680 if( rc ){ 8681 releasePage(pRoot); 8682 return rc; 8683 } 8684 8685 /* When the new root page was allocated, page 1 was made writable in 8686 ** order either to increase the database filesize, or to decrement the 8687 ** freelist count. Hence, the sqlite3BtreeUpdateMeta() call cannot fail. 8688 */ 8689 assert( sqlite3PagerIswriteable(pBt->pPage1->pDbPage) ); 8690 rc = sqlite3BtreeUpdateMeta(p, 4, pgnoRoot); 8691 if( NEVER(rc) ){ 8692 releasePage(pRoot); 8693 return rc; 8694 } 8695 8696 }else{ 8697 rc = allocateBtreePage(pBt, &pRoot, &pgnoRoot, 1, 0); 8698 if( rc ) return rc; 8699 } 8700 #endif 8701 assert( sqlite3PagerIswriteable(pRoot->pDbPage) ); 8702 if( createTabFlags & BTREE_INTKEY ){ 8703 ptfFlags = PTF_INTKEY | PTF_LEAFDATA | PTF_LEAF; 8704 }else{ 8705 ptfFlags = PTF_ZERODATA | PTF_LEAF; 8706 } 8707 zeroPage(pRoot, ptfFlags); 8708 sqlite3PagerUnref(pRoot->pDbPage); 8709 assert( (pBt->openFlags & BTREE_SINGLE)==0 || pgnoRoot==2 ); 8710 *piTable = (int)pgnoRoot; 8711 return SQLITE_OK; 8712 } 8713 int sqlite3BtreeCreateTable(Btree *p, int *piTable, int flags){ 8714 int rc; 8715 sqlite3BtreeEnter(p); 8716 rc = btreeCreateTable(p, piTable, flags); 8717 sqlite3BtreeLeave(p); 8718 return rc; 8719 } 8720 8721 /* 8722 ** Erase the given database page and all its children. Return 8723 ** the page to the freelist. 8724 */ 8725 static int clearDatabasePage( 8726 BtShared *pBt, /* The BTree that contains the table */ 8727 Pgno pgno, /* Page number to clear */ 8728 int freePageFlag, /* Deallocate page if true */ 8729 int *pnChange /* Add number of Cells freed to this counter */ 8730 ){ 8731 MemPage *pPage; 8732 int rc; 8733 unsigned char *pCell; 8734 int i; 8735 int hdr; 8736 CellInfo info; 8737 8738 assert( sqlite3_mutex_held(pBt->mutex) ); 8739 if( pgno>btreePagecount(pBt) ){ 8740 return SQLITE_CORRUPT_BKPT; 8741 } 8742 rc = getAndInitPage(pBt, pgno, &pPage, 0, 0); 8743 if( rc ) return rc; 8744 if( pPage->bBusy ){ 8745 rc = SQLITE_CORRUPT_BKPT; 8746 goto cleardatabasepage_out; 8747 } 8748 pPage->bBusy = 1; 8749 hdr = pPage->hdrOffset; 8750 for(i=0; i<pPage->nCell; i++){ 8751 pCell = findCell(pPage, i); 8752 if( !pPage->leaf ){ 8753 rc = clearDatabasePage(pBt, get4byte(pCell), 1, pnChange); 8754 if( rc ) goto cleardatabasepage_out; 8755 } 8756 rc = clearCell(pPage, pCell, &info); 8757 if( rc ) goto cleardatabasepage_out; 8758 } 8759 if( !pPage->leaf ){ 8760 rc = clearDatabasePage(pBt, get4byte(&pPage->aData[hdr+8]), 1, pnChange); 8761 if( rc ) goto cleardatabasepage_out; 8762 }else if( pnChange ){ 8763 assert( pPage->intKey || CORRUPT_DB ); 8764 testcase( !pPage->intKey ); 8765 *pnChange += pPage->nCell; 8766 } 8767 if( freePageFlag ){ 8768 freePage(pPage, &rc); 8769 }else if( (rc = sqlite3PagerWrite(pPage->pDbPage))==0 ){ 8770 zeroPage(pPage, pPage->aData[hdr] | PTF_LEAF); 8771 } 8772 8773 cleardatabasepage_out: 8774 pPage->bBusy = 0; 8775 releasePage(pPage); 8776 return rc; 8777 } 8778 8779 /* 8780 ** Delete all information from a single table in the database. iTable is 8781 ** the page number of the root of the table. After this routine returns, 8782 ** the root page is empty, but still exists. 8783 ** 8784 ** This routine will fail with SQLITE_LOCKED if there are any open 8785 ** read cursors on the table. Open write cursors are moved to the 8786 ** root of the table. 8787 ** 8788 ** If pnChange is not NULL, then table iTable must be an intkey table. The 8789 ** integer value pointed to by pnChange is incremented by the number of 8790 ** entries in the table. 8791 */ 8792 int sqlite3BtreeClearTable(Btree *p, int iTable, int *pnChange){ 8793 int rc; 8794 BtShared *pBt = p->pBt; 8795 sqlite3BtreeEnter(p); 8796 assert( p->inTrans==TRANS_WRITE ); 8797 8798 rc = saveAllCursors(pBt, (Pgno)iTable, 0); 8799 8800 if( SQLITE_OK==rc ){ 8801 /* Invalidate all incrblob cursors open on table iTable (assuming iTable 8802 ** is the root of a table b-tree - if it is not, the following call is 8803 ** a no-op). */ 8804 invalidateIncrblobCursors(p, (Pgno)iTable, 0, 1); 8805 rc = clearDatabasePage(pBt, (Pgno)iTable, 0, pnChange); 8806 } 8807 sqlite3BtreeLeave(p); 8808 return rc; 8809 } 8810 8811 /* 8812 ** Delete all information from the single table that pCur is open on. 8813 ** 8814 ** This routine only work for pCur on an ephemeral table. 8815 */ 8816 int sqlite3BtreeClearTableOfCursor(BtCursor *pCur){ 8817 return sqlite3BtreeClearTable(pCur->pBtree, pCur->pgnoRoot, 0); 8818 } 8819 8820 /* 8821 ** Erase all information in a table and add the root of the table to 8822 ** the freelist. Except, the root of the principle table (the one on 8823 ** page 1) is never added to the freelist. 8824 ** 8825 ** This routine will fail with SQLITE_LOCKED if there are any open 8826 ** cursors on the table. 8827 ** 8828 ** If AUTOVACUUM is enabled and the page at iTable is not the last 8829 ** root page in the database file, then the last root page 8830 ** in the database file is moved into the slot formerly occupied by 8831 ** iTable and that last slot formerly occupied by the last root page 8832 ** is added to the freelist instead of iTable. In this say, all 8833 ** root pages are kept at the beginning of the database file, which 8834 ** is necessary for AUTOVACUUM to work right. *piMoved is set to the 8835 ** page number that used to be the last root page in the file before 8836 ** the move. If no page gets moved, *piMoved is set to 0. 8837 ** The last root page is recorded in meta[3] and the value of 8838 ** meta[3] is updated by this procedure. 8839 */ 8840 static int btreeDropTable(Btree *p, Pgno iTable, int *piMoved){ 8841 int rc; 8842 MemPage *pPage = 0; 8843 BtShared *pBt = p->pBt; 8844 8845 assert( sqlite3BtreeHoldsMutex(p) ); 8846 assert( p->inTrans==TRANS_WRITE ); 8847 assert( iTable>=2 ); 8848 8849 rc = btreeGetPage(pBt, (Pgno)iTable, &pPage, 0); 8850 if( rc ) return rc; 8851 rc = sqlite3BtreeClearTable(p, iTable, 0); 8852 if( rc ){ 8853 releasePage(pPage); 8854 return rc; 8855 } 8856 8857 *piMoved = 0; 8858 8859 #ifdef SQLITE_OMIT_AUTOVACUUM 8860 freePage(pPage, &rc); 8861 releasePage(pPage); 8862 #else 8863 if( pBt->autoVacuum ){ 8864 Pgno maxRootPgno; 8865 sqlite3BtreeGetMeta(p, BTREE_LARGEST_ROOT_PAGE, &maxRootPgno); 8866 8867 if( iTable==maxRootPgno ){ 8868 /* If the table being dropped is the table with the largest root-page 8869 ** number in the database, put the root page on the free list. 8870 */ 8871 freePage(pPage, &rc); 8872 releasePage(pPage); 8873 if( rc!=SQLITE_OK ){ 8874 return rc; 8875 } 8876 }else{ 8877 /* The table being dropped does not have the largest root-page 8878 ** number in the database. So move the page that does into the 8879 ** gap left by the deleted root-page. 8880 */ 8881 MemPage *pMove; 8882 releasePage(pPage); 8883 rc = btreeGetPage(pBt, maxRootPgno, &pMove, 0); 8884 if( rc!=SQLITE_OK ){ 8885 return rc; 8886 } 8887 rc = relocatePage(pBt, pMove, PTRMAP_ROOTPAGE, 0, iTable, 0); 8888 releasePage(pMove); 8889 if( rc!=SQLITE_OK ){ 8890 return rc; 8891 } 8892 pMove = 0; 8893 rc = btreeGetPage(pBt, maxRootPgno, &pMove, 0); 8894 freePage(pMove, &rc); 8895 releasePage(pMove); 8896 if( rc!=SQLITE_OK ){ 8897 return rc; 8898 } 8899 *piMoved = maxRootPgno; 8900 } 8901 8902 /* Set the new 'max-root-page' value in the database header. This 8903 ** is the old value less one, less one more if that happens to 8904 ** be a root-page number, less one again if that is the 8905 ** PENDING_BYTE_PAGE. 8906 */ 8907 maxRootPgno--; 8908 while( maxRootPgno==PENDING_BYTE_PAGE(pBt) 8909 || PTRMAP_ISPAGE(pBt, maxRootPgno) ){ 8910 maxRootPgno--; 8911 } 8912 assert( maxRootPgno!=PENDING_BYTE_PAGE(pBt) ); 8913 8914 rc = sqlite3BtreeUpdateMeta(p, 4, maxRootPgno); 8915 }else{ 8916 freePage(pPage, &rc); 8917 releasePage(pPage); 8918 } 8919 #endif 8920 return rc; 8921 } 8922 int sqlite3BtreeDropTable(Btree *p, int iTable, int *piMoved){ 8923 int rc; 8924 sqlite3BtreeEnter(p); 8925 rc = btreeDropTable(p, iTable, piMoved); 8926 sqlite3BtreeLeave(p); 8927 return rc; 8928 } 8929 8930 8931 /* 8932 ** This function may only be called if the b-tree connection already 8933 ** has a read or write transaction open on the database. 8934 ** 8935 ** Read the meta-information out of a database file. Meta[0] 8936 ** is the number of free pages currently in the database. Meta[1] 8937 ** through meta[15] are available for use by higher layers. Meta[0] 8938 ** is read-only, the others are read/write. 8939 ** 8940 ** The schema layer numbers meta values differently. At the schema 8941 ** layer (and the SetCookie and ReadCookie opcodes) the number of 8942 ** free pages is not visible. So Cookie[0] is the same as Meta[1]. 8943 ** 8944 ** This routine treats Meta[BTREE_DATA_VERSION] as a special case. Instead 8945 ** of reading the value out of the header, it instead loads the "DataVersion" 8946 ** from the pager. The BTREE_DATA_VERSION value is not actually stored in the 8947 ** database file. It is a number computed by the pager. But its access 8948 ** pattern is the same as header meta values, and so it is convenient to 8949 ** read it from this routine. 8950 */ 8951 void sqlite3BtreeGetMeta(Btree *p, int idx, u32 *pMeta){ 8952 BtShared *pBt = p->pBt; 8953 8954 sqlite3BtreeEnter(p); 8955 assert( p->inTrans>TRANS_NONE ); 8956 assert( SQLITE_OK==querySharedCacheTableLock(p, MASTER_ROOT, READ_LOCK) ); 8957 assert( pBt->pPage1 ); 8958 assert( idx>=0 && idx<=15 ); 8959 8960 if( idx==BTREE_DATA_VERSION ){ 8961 *pMeta = sqlite3PagerDataVersion(pBt->pPager) + p->iDataVersion; 8962 }else{ 8963 *pMeta = get4byte(&pBt->pPage1->aData[36 + idx*4]); 8964 } 8965 8966 /* If auto-vacuum is disabled in this build and this is an auto-vacuum 8967 ** database, mark the database as read-only. */ 8968 #ifdef SQLITE_OMIT_AUTOVACUUM 8969 if( idx==BTREE_LARGEST_ROOT_PAGE && *pMeta>0 ){ 8970 pBt->btsFlags |= BTS_READ_ONLY; 8971 } 8972 #endif 8973 8974 sqlite3BtreeLeave(p); 8975 } 8976 8977 /* 8978 ** Write meta-information back into the database. Meta[0] is 8979 ** read-only and may not be written. 8980 */ 8981 int sqlite3BtreeUpdateMeta(Btree *p, int idx, u32 iMeta){ 8982 BtShared *pBt = p->pBt; 8983 unsigned char *pP1; 8984 int rc; 8985 assert( idx>=1 && idx<=15 ); 8986 sqlite3BtreeEnter(p); 8987 assert( p->inTrans==TRANS_WRITE ); 8988 assert( pBt->pPage1!=0 ); 8989 pP1 = pBt->pPage1->aData; 8990 rc = sqlite3PagerWrite(pBt->pPage1->pDbPage); 8991 if( rc==SQLITE_OK ){ 8992 put4byte(&pP1[36 + idx*4], iMeta); 8993 #ifndef SQLITE_OMIT_AUTOVACUUM 8994 if( idx==BTREE_INCR_VACUUM ){ 8995 assert( pBt->autoVacuum || iMeta==0 ); 8996 assert( iMeta==0 || iMeta==1 ); 8997 pBt->incrVacuum = (u8)iMeta; 8998 } 8999 #endif 9000 } 9001 sqlite3BtreeLeave(p); 9002 return rc; 9003 } 9004 9005 #ifndef SQLITE_OMIT_BTREECOUNT 9006 /* 9007 ** The first argument, pCur, is a cursor opened on some b-tree. Count the 9008 ** number of entries in the b-tree and write the result to *pnEntry. 9009 ** 9010 ** SQLITE_OK is returned if the operation is successfully executed. 9011 ** Otherwise, if an error is encountered (i.e. an IO error or database 9012 ** corruption) an SQLite error code is returned. 9013 */ 9014 int sqlite3BtreeCount(BtCursor *pCur, i64 *pnEntry){ 9015 i64 nEntry = 0; /* Value to return in *pnEntry */ 9016 int rc; /* Return code */ 9017 9018 rc = moveToRoot(pCur); 9019 if( rc==SQLITE_EMPTY ){ 9020 *pnEntry = 0; 9021 return SQLITE_OK; 9022 } 9023 9024 /* Unless an error occurs, the following loop runs one iteration for each 9025 ** page in the B-Tree structure (not including overflow pages). 9026 */ 9027 while( rc==SQLITE_OK ){ 9028 int iIdx; /* Index of child node in parent */ 9029 MemPage *pPage; /* Current page of the b-tree */ 9030 9031 /* If this is a leaf page or the tree is not an int-key tree, then 9032 ** this page contains countable entries. Increment the entry counter 9033 ** accordingly. 9034 */ 9035 pPage = pCur->pPage; 9036 if( pPage->leaf || !pPage->intKey ){ 9037 nEntry += pPage->nCell; 9038 } 9039 9040 /* pPage is a leaf node. This loop navigates the cursor so that it 9041 ** points to the first interior cell that it points to the parent of 9042 ** the next page in the tree that has not yet been visited. The 9043 ** pCur->aiIdx[pCur->iPage] value is set to the index of the parent cell 9044 ** of the page, or to the number of cells in the page if the next page 9045 ** to visit is the right-child of its parent. 9046 ** 9047 ** If all pages in the tree have been visited, return SQLITE_OK to the 9048 ** caller. 9049 */ 9050 if( pPage->leaf ){ 9051 do { 9052 if( pCur->iPage==0 ){ 9053 /* All pages of the b-tree have been visited. Return successfully. */ 9054 *pnEntry = nEntry; 9055 return moveToRoot(pCur); 9056 } 9057 moveToParent(pCur); 9058 }while ( pCur->ix>=pCur->pPage->nCell ); 9059 9060 pCur->ix++; 9061 pPage = pCur->pPage; 9062 } 9063 9064 /* Descend to the child node of the cell that the cursor currently 9065 ** points at. This is the right-child if (iIdx==pPage->nCell). 9066 */ 9067 iIdx = pCur->ix; 9068 if( iIdx==pPage->nCell ){ 9069 rc = moveToChild(pCur, get4byte(&pPage->aData[pPage->hdrOffset+8])); 9070 }else{ 9071 rc = moveToChild(pCur, get4byte(findCell(pPage, iIdx))); 9072 } 9073 } 9074 9075 /* An error has occurred. Return an error code. */ 9076 return rc; 9077 } 9078 #endif 9079 9080 /* 9081 ** Return the pager associated with a BTree. This routine is used for 9082 ** testing and debugging only. 9083 */ 9084 Pager *sqlite3BtreePager(Btree *p){ 9085 return p->pBt->pPager; 9086 } 9087 9088 #ifndef SQLITE_OMIT_INTEGRITY_CHECK 9089 /* 9090 ** Append a message to the error message string. 9091 */ 9092 static void checkAppendMsg( 9093 IntegrityCk *pCheck, 9094 const char *zFormat, 9095 ... 9096 ){ 9097 va_list ap; 9098 if( !pCheck->mxErr ) return; 9099 pCheck->mxErr--; 9100 pCheck->nErr++; 9101 va_start(ap, zFormat); 9102 if( pCheck->errMsg.nChar ){ 9103 sqlite3StrAccumAppend(&pCheck->errMsg, "\n", 1); 9104 } 9105 if( pCheck->zPfx ){ 9106 sqlite3XPrintf(&pCheck->errMsg, pCheck->zPfx, pCheck->v1, pCheck->v2); 9107 } 9108 sqlite3VXPrintf(&pCheck->errMsg, zFormat, ap); 9109 va_end(ap); 9110 if( pCheck->errMsg.accError==STRACCUM_NOMEM ){ 9111 pCheck->mallocFailed = 1; 9112 } 9113 } 9114 #endif /* SQLITE_OMIT_INTEGRITY_CHECK */ 9115 9116 #ifndef SQLITE_OMIT_INTEGRITY_CHECK 9117 9118 /* 9119 ** Return non-zero if the bit in the IntegrityCk.aPgRef[] array that 9120 ** corresponds to page iPg is already set. 9121 */ 9122 static int getPageReferenced(IntegrityCk *pCheck, Pgno iPg){ 9123 assert( iPg<=pCheck->nPage && sizeof(pCheck->aPgRef[0])==1 ); 9124 return (pCheck->aPgRef[iPg/8] & (1 << (iPg & 0x07))); 9125 } 9126 9127 /* 9128 ** Set the bit in the IntegrityCk.aPgRef[] array that corresponds to page iPg. 9129 */ 9130 static void setPageReferenced(IntegrityCk *pCheck, Pgno iPg){ 9131 assert( iPg<=pCheck->nPage && sizeof(pCheck->aPgRef[0])==1 ); 9132 pCheck->aPgRef[iPg/8] |= (1 << (iPg & 0x07)); 9133 } 9134 9135 9136 /* 9137 ** Add 1 to the reference count for page iPage. If this is the second 9138 ** reference to the page, add an error message to pCheck->zErrMsg. 9139 ** Return 1 if there are 2 or more references to the page and 0 if 9140 ** if this is the first reference to the page. 9141 ** 9142 ** Also check that the page number is in bounds. 9143 */ 9144 static int checkRef(IntegrityCk *pCheck, Pgno iPage){ 9145 if( iPage==0 ) return 1; 9146 if( iPage>pCheck->nPage ){ 9147 checkAppendMsg(pCheck, "invalid page number %d", iPage); 9148 return 1; 9149 } 9150 if( getPageReferenced(pCheck, iPage) ){ 9151 checkAppendMsg(pCheck, "2nd reference to page %d", iPage); 9152 return 1; 9153 } 9154 setPageReferenced(pCheck, iPage); 9155 return 0; 9156 } 9157 9158 #ifndef SQLITE_OMIT_AUTOVACUUM 9159 /* 9160 ** Check that the entry in the pointer-map for page iChild maps to 9161 ** page iParent, pointer type ptrType. If not, append an error message 9162 ** to pCheck. 9163 */ 9164 static void checkPtrmap( 9165 IntegrityCk *pCheck, /* Integrity check context */ 9166 Pgno iChild, /* Child page number */ 9167 u8 eType, /* Expected pointer map type */ 9168 Pgno iParent /* Expected pointer map parent page number */ 9169 ){ 9170 int rc; 9171 u8 ePtrmapType; 9172 Pgno iPtrmapParent; 9173 9174 rc = ptrmapGet(pCheck->pBt, iChild, &ePtrmapType, &iPtrmapParent); 9175 if( rc!=SQLITE_OK ){ 9176 if( rc==SQLITE_NOMEM || rc==SQLITE_IOERR_NOMEM ) pCheck->mallocFailed = 1; 9177 checkAppendMsg(pCheck, "Failed to read ptrmap key=%d", iChild); 9178 return; 9179 } 9180 9181 if( ePtrmapType!=eType || iPtrmapParent!=iParent ){ 9182 checkAppendMsg(pCheck, 9183 "Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)", 9184 iChild, eType, iParent, ePtrmapType, iPtrmapParent); 9185 } 9186 } 9187 #endif 9188 9189 /* 9190 ** Check the integrity of the freelist or of an overflow page list. 9191 ** Verify that the number of pages on the list is N. 9192 */ 9193 static void checkList( 9194 IntegrityCk *pCheck, /* Integrity checking context */ 9195 int isFreeList, /* True for a freelist. False for overflow page list */ 9196 int iPage, /* Page number for first page in the list */ 9197 int N /* Expected number of pages in the list */ 9198 ){ 9199 int i; 9200 int expected = N; 9201 int iFirst = iPage; 9202 while( N-- > 0 && pCheck->mxErr ){ 9203 DbPage *pOvflPage; 9204 unsigned char *pOvflData; 9205 if( iPage<1 ){ 9206 checkAppendMsg(pCheck, 9207 "%d of %d pages missing from overflow list starting at %d", 9208 N+1, expected, iFirst); 9209 break; 9210 } 9211 if( checkRef(pCheck, iPage) ) break; 9212 if( sqlite3PagerGet(pCheck->pPager, (Pgno)iPage, &pOvflPage, 0) ){ 9213 checkAppendMsg(pCheck, "failed to get page %d", iPage); 9214 break; 9215 } 9216 pOvflData = (unsigned char *)sqlite3PagerGetData(pOvflPage); 9217 if( isFreeList ){ 9218 int n = get4byte(&pOvflData[4]); 9219 #ifndef SQLITE_OMIT_AUTOVACUUM 9220 if( pCheck->pBt->autoVacuum ){ 9221 checkPtrmap(pCheck, iPage, PTRMAP_FREEPAGE, 0); 9222 } 9223 #endif 9224 if( n>(int)pCheck->pBt->usableSize/4-2 ){ 9225 checkAppendMsg(pCheck, 9226 "freelist leaf count too big on page %d", iPage); 9227 N--; 9228 }else{ 9229 for(i=0; i<n; i++){ 9230 Pgno iFreePage = get4byte(&pOvflData[8+i*4]); 9231 #ifndef SQLITE_OMIT_AUTOVACUUM 9232 if( pCheck->pBt->autoVacuum ){ 9233 checkPtrmap(pCheck, iFreePage, PTRMAP_FREEPAGE, 0); 9234 } 9235 #endif 9236 checkRef(pCheck, iFreePage); 9237 } 9238 N -= n; 9239 } 9240 } 9241 #ifndef SQLITE_OMIT_AUTOVACUUM 9242 else{ 9243 /* If this database supports auto-vacuum and iPage is not the last 9244 ** page in this overflow list, check that the pointer-map entry for 9245 ** the following page matches iPage. 9246 */ 9247 if( pCheck->pBt->autoVacuum && N>0 ){ 9248 i = get4byte(pOvflData); 9249 checkPtrmap(pCheck, i, PTRMAP_OVERFLOW2, iPage); 9250 } 9251 } 9252 #endif 9253 iPage = get4byte(pOvflData); 9254 sqlite3PagerUnref(pOvflPage); 9255 9256 if( isFreeList && N<(iPage!=0) ){ 9257 checkAppendMsg(pCheck, "free-page count in header is too small"); 9258 } 9259 } 9260 } 9261 #endif /* SQLITE_OMIT_INTEGRITY_CHECK */ 9262 9263 /* 9264 ** An implementation of a min-heap. 9265 ** 9266 ** aHeap[0] is the number of elements on the heap. aHeap[1] is the 9267 ** root element. The daughter nodes of aHeap[N] are aHeap[N*2] 9268 ** and aHeap[N*2+1]. 9269 ** 9270 ** The heap property is this: Every node is less than or equal to both 9271 ** of its daughter nodes. A consequence of the heap property is that the 9272 ** root node aHeap[1] is always the minimum value currently in the heap. 9273 ** 9274 ** The btreeHeapInsert() routine inserts an unsigned 32-bit number onto 9275 ** the heap, preserving the heap property. The btreeHeapPull() routine 9276 ** removes the root element from the heap (the minimum value in the heap) 9277 ** and then moves other nodes around as necessary to preserve the heap 9278 ** property. 9279 ** 9280 ** This heap is used for cell overlap and coverage testing. Each u32 9281 ** entry represents the span of a cell or freeblock on a btree page. 9282 ** The upper 16 bits are the index of the first byte of a range and the 9283 ** lower 16 bits are the index of the last byte of that range. 9284 */ 9285 static void btreeHeapInsert(u32 *aHeap, u32 x){ 9286 u32 j, i = ++aHeap[0]; 9287 aHeap[i] = x; 9288 while( (j = i/2)>0 && aHeap[j]>aHeap[i] ){ 9289 x = aHeap[j]; 9290 aHeap[j] = aHeap[i]; 9291 aHeap[i] = x; 9292 i = j; 9293 } 9294 } 9295 static int btreeHeapPull(u32 *aHeap, u32 *pOut){ 9296 u32 j, i, x; 9297 if( (x = aHeap[0])==0 ) return 0; 9298 *pOut = aHeap[1]; 9299 aHeap[1] = aHeap[x]; 9300 aHeap[x] = 0xffffffff; 9301 aHeap[0]--; 9302 i = 1; 9303 while( (j = i*2)<=aHeap[0] ){ 9304 if( aHeap[j]>aHeap[j+1] ) j++; 9305 if( aHeap[i]<aHeap[j] ) break; 9306 x = aHeap[i]; 9307 aHeap[i] = aHeap[j]; 9308 aHeap[j] = x; 9309 i = j; 9310 } 9311 return 1; 9312 } 9313 9314 #ifndef SQLITE_OMIT_INTEGRITY_CHECK 9315 /* 9316 ** Do various sanity checks on a single page of a tree. Return 9317 ** the tree depth. Root pages return 0. Parents of root pages 9318 ** return 1, and so forth. 9319 ** 9320 ** These checks are done: 9321 ** 9322 ** 1. Make sure that cells and freeblocks do not overlap 9323 ** but combine to completely cover the page. 9324 ** 2. Make sure integer cell keys are in order. 9325 ** 3. Check the integrity of overflow pages. 9326 ** 4. Recursively call checkTreePage on all children. 9327 ** 5. Verify that the depth of all children is the same. 9328 */ 9329 static int checkTreePage( 9330 IntegrityCk *pCheck, /* Context for the sanity check */ 9331 int iPage, /* Page number of the page to check */ 9332 i64 *piMinKey, /* Write minimum integer primary key here */ 9333 i64 maxKey /* Error if integer primary key greater than this */ 9334 ){ 9335 MemPage *pPage = 0; /* The page being analyzed */ 9336 int i; /* Loop counter */ 9337 int rc; /* Result code from subroutine call */ 9338 int depth = -1, d2; /* Depth of a subtree */ 9339 int pgno; /* Page number */ 9340 int nFrag; /* Number of fragmented bytes on the page */ 9341 int hdr; /* Offset to the page header */ 9342 int cellStart; /* Offset to the start of the cell pointer array */ 9343 int nCell; /* Number of cells */ 9344 int doCoverageCheck = 1; /* True if cell coverage checking should be done */ 9345 int keyCanBeEqual = 1; /* True if IPK can be equal to maxKey 9346 ** False if IPK must be strictly less than maxKey */ 9347 u8 *data; /* Page content */ 9348 u8 *pCell; /* Cell content */ 9349 u8 *pCellIdx; /* Next element of the cell pointer array */ 9350 BtShared *pBt; /* The BtShared object that owns pPage */ 9351 u32 pc; /* Address of a cell */ 9352 u32 usableSize; /* Usable size of the page */ 9353 u32 contentOffset; /* Offset to the start of the cell content area */ 9354 u32 *heap = 0; /* Min-heap used for checking cell coverage */ 9355 u32 x, prev = 0; /* Next and previous entry on the min-heap */ 9356 const char *saved_zPfx = pCheck->zPfx; 9357 int saved_v1 = pCheck->v1; 9358 int saved_v2 = pCheck->v2; 9359 u8 savedIsInit = 0; 9360 9361 /* Check that the page exists 9362 */ 9363 pBt = pCheck->pBt; 9364 usableSize = pBt->usableSize; 9365 if( iPage==0 ) return 0; 9366 if( checkRef(pCheck, iPage) ) return 0; 9367 pCheck->zPfx = "Page %d: "; 9368 pCheck->v1 = iPage; 9369 if( (rc = btreeGetPage(pBt, (Pgno)iPage, &pPage, 0))!=0 ){ 9370 checkAppendMsg(pCheck, 9371 "unable to get the page. error code=%d", rc); 9372 goto end_of_check; 9373 } 9374 9375 /* Clear MemPage.isInit to make sure the corruption detection code in 9376 ** btreeInitPage() is executed. */ 9377 savedIsInit = pPage->isInit; 9378 pPage->isInit = 0; 9379 if( (rc = btreeInitPage(pPage))!=0 ){ 9380 assert( rc==SQLITE_CORRUPT ); /* The only possible error from InitPage */ 9381 checkAppendMsg(pCheck, 9382 "btreeInitPage() returns error code %d", rc); 9383 goto end_of_check; 9384 } 9385 data = pPage->aData; 9386 hdr = pPage->hdrOffset; 9387 9388 /* Set up for cell analysis */ 9389 pCheck->zPfx = "On tree page %d cell %d: "; 9390 contentOffset = get2byteNotZero(&data[hdr+5]); 9391 assert( contentOffset<=usableSize ); /* Enforced by btreeInitPage() */ 9392 9393 /* EVIDENCE-OF: R-37002-32774 The two-byte integer at offset 3 gives the 9394 ** number of cells on the page. */ 9395 nCell = get2byte(&data[hdr+3]); 9396 assert( pPage->nCell==nCell ); 9397 9398 /* EVIDENCE-OF: R-23882-45353 The cell pointer array of a b-tree page 9399 ** immediately follows the b-tree page header. */ 9400 cellStart = hdr + 12 - 4*pPage->leaf; 9401 assert( pPage->aCellIdx==&data[cellStart] ); 9402 pCellIdx = &data[cellStart + 2*(nCell-1)]; 9403 9404 if( !pPage->leaf ){ 9405 /* Analyze the right-child page of internal pages */ 9406 pgno = get4byte(&data[hdr+8]); 9407 #ifndef SQLITE_OMIT_AUTOVACUUM 9408 if( pBt->autoVacuum ){ 9409 pCheck->zPfx = "On page %d at right child: "; 9410 checkPtrmap(pCheck, pgno, PTRMAP_BTREE, iPage); 9411 } 9412 #endif 9413 depth = checkTreePage(pCheck, pgno, &maxKey, maxKey); 9414 keyCanBeEqual = 0; 9415 }else{ 9416 /* For leaf pages, the coverage check will occur in the same loop 9417 ** as the other cell checks, so initialize the heap. */ 9418 heap = pCheck->heap; 9419 heap[0] = 0; 9420 } 9421 9422 /* EVIDENCE-OF: R-02776-14802 The cell pointer array consists of K 2-byte 9423 ** integer offsets to the cell contents. */ 9424 for(i=nCell-1; i>=0 && pCheck->mxErr; i--){ 9425 CellInfo info; 9426 9427 /* Check cell size */ 9428 pCheck->v2 = i; 9429 assert( pCellIdx==&data[cellStart + i*2] ); 9430 pc = get2byteAligned(pCellIdx); 9431 pCellIdx -= 2; 9432 if( pc<contentOffset || pc>usableSize-4 ){ 9433 checkAppendMsg(pCheck, "Offset %d out of range %d..%d", 9434 pc, contentOffset, usableSize-4); 9435 doCoverageCheck = 0; 9436 continue; 9437 } 9438 pCell = &data[pc]; 9439 pPage->xParseCell(pPage, pCell, &info); 9440 if( pc+info.nSize>usableSize ){ 9441 checkAppendMsg(pCheck, "Extends off end of page"); 9442 doCoverageCheck = 0; 9443 continue; 9444 } 9445 9446 /* Check for integer primary key out of range */ 9447 if( pPage->intKey ){ 9448 if( keyCanBeEqual ? (info.nKey > maxKey) : (info.nKey >= maxKey) ){ 9449 checkAppendMsg(pCheck, "Rowid %lld out of order", info.nKey); 9450 } 9451 maxKey = info.nKey; 9452 keyCanBeEqual = 0; /* Only the first key on the page may ==maxKey */ 9453 } 9454 9455 /* Check the content overflow list */ 9456 if( info.nPayload>info.nLocal ){ 9457 int nPage; /* Number of pages on the overflow chain */ 9458 Pgno pgnoOvfl; /* First page of the overflow chain */ 9459 assert( pc + info.nSize - 4 <= usableSize ); 9460 nPage = (info.nPayload - info.nLocal + usableSize - 5)/(usableSize - 4); 9461 pgnoOvfl = get4byte(&pCell[info.nSize - 4]); 9462 #ifndef SQLITE_OMIT_AUTOVACUUM 9463 if( pBt->autoVacuum ){ 9464 checkPtrmap(pCheck, pgnoOvfl, PTRMAP_OVERFLOW1, iPage); 9465 } 9466 #endif 9467 checkList(pCheck, 0, pgnoOvfl, nPage); 9468 } 9469 9470 if( !pPage->leaf ){ 9471 /* Check sanity of left child page for internal pages */ 9472 pgno = get4byte(pCell); 9473 #ifndef SQLITE_OMIT_AUTOVACUUM 9474 if( pBt->autoVacuum ){ 9475 checkPtrmap(pCheck, pgno, PTRMAP_BTREE, iPage); 9476 } 9477 #endif 9478 d2 = checkTreePage(pCheck, pgno, &maxKey, maxKey); 9479 keyCanBeEqual = 0; 9480 if( d2!=depth ){ 9481 checkAppendMsg(pCheck, "Child page depth differs"); 9482 depth = d2; 9483 } 9484 }else{ 9485 /* Populate the coverage-checking heap for leaf pages */ 9486 btreeHeapInsert(heap, (pc<<16)|(pc+info.nSize-1)); 9487 } 9488 } 9489 *piMinKey = maxKey; 9490 9491 /* Check for complete coverage of the page 9492 */ 9493 pCheck->zPfx = 0; 9494 if( doCoverageCheck && pCheck->mxErr>0 ){ 9495 /* For leaf pages, the min-heap has already been initialized and the 9496 ** cells have already been inserted. But for internal pages, that has 9497 ** not yet been done, so do it now */ 9498 if( !pPage->leaf ){ 9499 heap = pCheck->heap; 9500 heap[0] = 0; 9501 for(i=nCell-1; i>=0; i--){ 9502 u32 size; 9503 pc = get2byteAligned(&data[cellStart+i*2]); 9504 size = pPage->xCellSize(pPage, &data[pc]); 9505 btreeHeapInsert(heap, (pc<<16)|(pc+size-1)); 9506 } 9507 } 9508 /* Add the freeblocks to the min-heap 9509 ** 9510 ** EVIDENCE-OF: R-20690-50594 The second field of the b-tree page header 9511 ** is the offset of the first freeblock, or zero if there are no 9512 ** freeblocks on the page. 9513 */ 9514 i = get2byte(&data[hdr+1]); 9515 while( i>0 ){ 9516 int size, j; 9517 assert( (u32)i<=usableSize-4 ); /* Enforced by btreeInitPage() */ 9518 size = get2byte(&data[i+2]); 9519 assert( (u32)(i+size)<=usableSize ); /* Enforced by btreeInitPage() */ 9520 btreeHeapInsert(heap, (((u32)i)<<16)|(i+size-1)); 9521 /* EVIDENCE-OF: R-58208-19414 The first 2 bytes of a freeblock are a 9522 ** big-endian integer which is the offset in the b-tree page of the next 9523 ** freeblock in the chain, or zero if the freeblock is the last on the 9524 ** chain. */ 9525 j = get2byte(&data[i]); 9526 /* EVIDENCE-OF: R-06866-39125 Freeblocks are always connected in order of 9527 ** increasing offset. */ 9528 assert( j==0 || j>i+size ); /* Enforced by btreeInitPage() */ 9529 assert( (u32)j<=usableSize-4 ); /* Enforced by btreeInitPage() */ 9530 i = j; 9531 } 9532 /* Analyze the min-heap looking for overlap between cells and/or 9533 ** freeblocks, and counting the number of untracked bytes in nFrag. 9534 ** 9535 ** Each min-heap entry is of the form: (start_address<<16)|end_address. 9536 ** There is an implied first entry the covers the page header, the cell 9537 ** pointer index, and the gap between the cell pointer index and the start 9538 ** of cell content. 9539 ** 9540 ** The loop below pulls entries from the min-heap in order and compares 9541 ** the start_address against the previous end_address. If there is an 9542 ** overlap, that means bytes are used multiple times. If there is a gap, 9543 ** that gap is added to the fragmentation count. 9544 */ 9545 nFrag = 0; 9546 prev = contentOffset - 1; /* Implied first min-heap entry */ 9547 while( btreeHeapPull(heap,&x) ){ 9548 if( (prev&0xffff)>=(x>>16) ){ 9549 checkAppendMsg(pCheck, 9550 "Multiple uses for byte %u of page %d", x>>16, iPage); 9551 break; 9552 }else{ 9553 nFrag += (x>>16) - (prev&0xffff) - 1; 9554 prev = x; 9555 } 9556 } 9557 nFrag += usableSize - (prev&0xffff) - 1; 9558 /* EVIDENCE-OF: R-43263-13491 The total number of bytes in all fragments 9559 ** is stored in the fifth field of the b-tree page header. 9560 ** EVIDENCE-OF: R-07161-27322 The one-byte integer at offset 7 gives the 9561 ** number of fragmented free bytes within the cell content area. 9562 */ 9563 if( heap[0]==0 && nFrag!=data[hdr+7] ){ 9564 checkAppendMsg(pCheck, 9565 "Fragmentation of %d bytes reported as %d on page %d", 9566 nFrag, data[hdr+7], iPage); 9567 } 9568 } 9569 9570 end_of_check: 9571 if( !doCoverageCheck ) pPage->isInit = savedIsInit; 9572 releasePage(pPage); 9573 pCheck->zPfx = saved_zPfx; 9574 pCheck->v1 = saved_v1; 9575 pCheck->v2 = saved_v2; 9576 return depth+1; 9577 } 9578 #endif /* SQLITE_OMIT_INTEGRITY_CHECK */ 9579 9580 #ifndef SQLITE_OMIT_INTEGRITY_CHECK 9581 /* 9582 ** This routine does a complete check of the given BTree file. aRoot[] is 9583 ** an array of pages numbers were each page number is the root page of 9584 ** a table. nRoot is the number of entries in aRoot. 9585 ** 9586 ** A read-only or read-write transaction must be opened before calling 9587 ** this function. 9588 ** 9589 ** Write the number of error seen in *pnErr. Except for some memory 9590 ** allocation errors, an error message held in memory obtained from 9591 ** malloc is returned if *pnErr is non-zero. If *pnErr==0 then NULL is 9592 ** returned. If a memory allocation error occurs, NULL is returned. 9593 */ 9594 char *sqlite3BtreeIntegrityCheck( 9595 Btree *p, /* The btree to be checked */ 9596 int *aRoot, /* An array of root pages numbers for individual trees */ 9597 int nRoot, /* Number of entries in aRoot[] */ 9598 int mxErr, /* Stop reporting errors after this many */ 9599 int *pnErr /* Write number of errors seen to this variable */ 9600 ){ 9601 Pgno i; 9602 IntegrityCk sCheck; 9603 BtShared *pBt = p->pBt; 9604 int savedDbFlags = pBt->db->flags; 9605 char zErr[100]; 9606 VVA_ONLY( int nRef ); 9607 9608 sqlite3BtreeEnter(p); 9609 assert( p->inTrans>TRANS_NONE && pBt->inTransaction>TRANS_NONE ); 9610 VVA_ONLY( nRef = sqlite3PagerRefcount(pBt->pPager) ); 9611 assert( nRef>=0 ); 9612 sCheck.pBt = pBt; 9613 sCheck.pPager = pBt->pPager; 9614 sCheck.nPage = btreePagecount(sCheck.pBt); 9615 sCheck.mxErr = mxErr; 9616 sCheck.nErr = 0; 9617 sCheck.mallocFailed = 0; 9618 sCheck.zPfx = 0; 9619 sCheck.v1 = 0; 9620 sCheck.v2 = 0; 9621 sCheck.aPgRef = 0; 9622 sCheck.heap = 0; 9623 sqlite3StrAccumInit(&sCheck.errMsg, 0, zErr, sizeof(zErr), SQLITE_MAX_LENGTH); 9624 sCheck.errMsg.printfFlags = SQLITE_PRINTF_INTERNAL; 9625 if( sCheck.nPage==0 ){ 9626 goto integrity_ck_cleanup; 9627 } 9628 9629 sCheck.aPgRef = sqlite3MallocZero((sCheck.nPage / 8)+ 1); 9630 if( !sCheck.aPgRef ){ 9631 sCheck.mallocFailed = 1; 9632 goto integrity_ck_cleanup; 9633 } 9634 sCheck.heap = (u32*)sqlite3PageMalloc( pBt->pageSize ); 9635 if( sCheck.heap==0 ){ 9636 sCheck.mallocFailed = 1; 9637 goto integrity_ck_cleanup; 9638 } 9639 9640 i = PENDING_BYTE_PAGE(pBt); 9641 if( i<=sCheck.nPage ) setPageReferenced(&sCheck, i); 9642 9643 /* Check the integrity of the freelist 9644 */ 9645 sCheck.zPfx = "Main freelist: "; 9646 checkList(&sCheck, 1, get4byte(&pBt->pPage1->aData[32]), 9647 get4byte(&pBt->pPage1->aData[36])); 9648 sCheck.zPfx = 0; 9649 9650 /* Check all the tables. 9651 */ 9652 testcase( pBt->db->flags & SQLITE_CellSizeCk ); 9653 pBt->db->flags &= ~SQLITE_CellSizeCk; 9654 for(i=0; (int)i<nRoot && sCheck.mxErr; i++){ 9655 i64 notUsed; 9656 if( aRoot[i]==0 ) continue; 9657 #ifndef SQLITE_OMIT_AUTOVACUUM 9658 if( pBt->autoVacuum && aRoot[i]>1 ){ 9659 checkPtrmap(&sCheck, aRoot[i], PTRMAP_ROOTPAGE, 0); 9660 } 9661 #endif 9662 checkTreePage(&sCheck, aRoot[i], &notUsed, LARGEST_INT64); 9663 } 9664 pBt->db->flags = savedDbFlags; 9665 9666 /* Make sure every page in the file is referenced 9667 */ 9668 for(i=1; i<=sCheck.nPage && sCheck.mxErr; i++){ 9669 #ifdef SQLITE_OMIT_AUTOVACUUM 9670 if( getPageReferenced(&sCheck, i)==0 ){ 9671 checkAppendMsg(&sCheck, "Page %d is never used", i); 9672 } 9673 #else 9674 /* If the database supports auto-vacuum, make sure no tables contain 9675 ** references to pointer-map pages. 9676 */ 9677 if( getPageReferenced(&sCheck, i)==0 && 9678 (PTRMAP_PAGENO(pBt, i)!=i || !pBt->autoVacuum) ){ 9679 checkAppendMsg(&sCheck, "Page %d is never used", i); 9680 } 9681 if( getPageReferenced(&sCheck, i)!=0 && 9682 (PTRMAP_PAGENO(pBt, i)==i && pBt->autoVacuum) ){ 9683 checkAppendMsg(&sCheck, "Pointer map page %d is referenced", i); 9684 } 9685 #endif 9686 } 9687 9688 /* Clean up and report errors. 9689 */ 9690 integrity_ck_cleanup: 9691 sqlite3PageFree(sCheck.heap); 9692 sqlite3_free(sCheck.aPgRef); 9693 if( sCheck.mallocFailed ){ 9694 sqlite3StrAccumReset(&sCheck.errMsg); 9695 sCheck.nErr++; 9696 } 9697 *pnErr = sCheck.nErr; 9698 if( sCheck.nErr==0 ) sqlite3StrAccumReset(&sCheck.errMsg); 9699 /* Make sure this analysis did not leave any unref() pages. */ 9700 assert( nRef==sqlite3PagerRefcount(pBt->pPager) ); 9701 sqlite3BtreeLeave(p); 9702 return sqlite3StrAccumFinish(&sCheck.errMsg); 9703 } 9704 #endif /* SQLITE_OMIT_INTEGRITY_CHECK */ 9705 9706 /* 9707 ** Return the full pathname of the underlying database file. Return 9708 ** an empty string if the database is in-memory or a TEMP database. 9709 ** 9710 ** The pager filename is invariant as long as the pager is 9711 ** open so it is safe to access without the BtShared mutex. 9712 */ 9713 const char *sqlite3BtreeGetFilename(Btree *p){ 9714 assert( p->pBt->pPager!=0 ); 9715 return sqlite3PagerFilename(p->pBt->pPager, 1); 9716 } 9717 9718 /* 9719 ** Return the pathname of the journal file for this database. The return 9720 ** value of this routine is the same regardless of whether the journal file 9721 ** has been created or not. 9722 ** 9723 ** The pager journal filename is invariant as long as the pager is 9724 ** open so it is safe to access without the BtShared mutex. 9725 */ 9726 const char *sqlite3BtreeGetJournalname(Btree *p){ 9727 assert( p->pBt->pPager!=0 ); 9728 return sqlite3PagerJournalname(p->pBt->pPager); 9729 } 9730 9731 /* 9732 ** Return non-zero if a transaction is active. 9733 */ 9734 int sqlite3BtreeIsInTrans(Btree *p){ 9735 assert( p==0 || sqlite3_mutex_held(p->db->mutex) ); 9736 return (p && (p->inTrans==TRANS_WRITE)); 9737 } 9738 9739 #ifndef SQLITE_OMIT_WAL 9740 /* 9741 ** Run a checkpoint on the Btree passed as the first argument. 9742 ** 9743 ** Return SQLITE_LOCKED if this or any other connection has an open 9744 ** transaction on the shared-cache the argument Btree is connected to. 9745 ** 9746 ** Parameter eMode is one of SQLITE_CHECKPOINT_PASSIVE, FULL or RESTART. 9747 */ 9748 int sqlite3BtreeCheckpoint(Btree *p, int eMode, int *pnLog, int *pnCkpt){ 9749 int rc = SQLITE_OK; 9750 if( p ){ 9751 BtShared *pBt = p->pBt; 9752 sqlite3BtreeEnter(p); 9753 if( pBt->inTransaction!=TRANS_NONE ){ 9754 rc = SQLITE_LOCKED; 9755 }else{ 9756 rc = sqlite3PagerCheckpoint(pBt->pPager, p->db, eMode, pnLog, pnCkpt); 9757 } 9758 sqlite3BtreeLeave(p); 9759 } 9760 return rc; 9761 } 9762 #endif 9763 9764 /* 9765 ** Return non-zero if a read (or write) transaction is active. 9766 */ 9767 int sqlite3BtreeIsInReadTrans(Btree *p){ 9768 assert( p ); 9769 assert( sqlite3_mutex_held(p->db->mutex) ); 9770 return p->inTrans!=TRANS_NONE; 9771 } 9772 9773 int sqlite3BtreeIsInBackup(Btree *p){ 9774 assert( p ); 9775 assert( sqlite3_mutex_held(p->db->mutex) ); 9776 return p->nBackup!=0; 9777 } 9778 9779 /* 9780 ** This function returns a pointer to a blob of memory associated with 9781 ** a single shared-btree. The memory is used by client code for its own 9782 ** purposes (for example, to store a high-level schema associated with 9783 ** the shared-btree). The btree layer manages reference counting issues. 9784 ** 9785 ** The first time this is called on a shared-btree, nBytes bytes of memory 9786 ** are allocated, zeroed, and returned to the caller. For each subsequent 9787 ** call the nBytes parameter is ignored and a pointer to the same blob 9788 ** of memory returned. 9789 ** 9790 ** If the nBytes parameter is 0 and the blob of memory has not yet been 9791 ** allocated, a null pointer is returned. If the blob has already been 9792 ** allocated, it is returned as normal. 9793 ** 9794 ** Just before the shared-btree is closed, the function passed as the 9795 ** xFree argument when the memory allocation was made is invoked on the 9796 ** blob of allocated memory. The xFree function should not call sqlite3_free() 9797 ** on the memory, the btree layer does that. 9798 */ 9799 void *sqlite3BtreeSchema(Btree *p, int nBytes, void(*xFree)(void *)){ 9800 BtShared *pBt = p->pBt; 9801 sqlite3BtreeEnter(p); 9802 if( !pBt->pSchema && nBytes ){ 9803 pBt->pSchema = sqlite3DbMallocZero(0, nBytes); 9804 pBt->xFreeSchema = xFree; 9805 } 9806 sqlite3BtreeLeave(p); 9807 return pBt->pSchema; 9808 } 9809 9810 /* 9811 ** Return SQLITE_LOCKED_SHAREDCACHE if another user of the same shared 9812 ** btree as the argument handle holds an exclusive lock on the 9813 ** sqlite_master table. Otherwise SQLITE_OK. 9814 */ 9815 int sqlite3BtreeSchemaLocked(Btree *p){ 9816 int rc; 9817 assert( sqlite3_mutex_held(p->db->mutex) ); 9818 sqlite3BtreeEnter(p); 9819 rc = querySharedCacheTableLock(p, MASTER_ROOT, READ_LOCK); 9820 assert( rc==SQLITE_OK || rc==SQLITE_LOCKED_SHAREDCACHE ); 9821 sqlite3BtreeLeave(p); 9822 return rc; 9823 } 9824 9825 9826 #ifndef SQLITE_OMIT_SHARED_CACHE 9827 /* 9828 ** Obtain a lock on the table whose root page is iTab. The 9829 ** lock is a write lock if isWritelock is true or a read lock 9830 ** if it is false. 9831 */ 9832 int sqlite3BtreeLockTable(Btree *p, int iTab, u8 isWriteLock){ 9833 int rc = SQLITE_OK; 9834 assert( p->inTrans!=TRANS_NONE ); 9835 if( p->sharable ){ 9836 u8 lockType = READ_LOCK + isWriteLock; 9837 assert( READ_LOCK+1==WRITE_LOCK ); 9838 assert( isWriteLock==0 || isWriteLock==1 ); 9839 9840 sqlite3BtreeEnter(p); 9841 rc = querySharedCacheTableLock(p, iTab, lockType); 9842 if( rc==SQLITE_OK ){ 9843 rc = setSharedCacheTableLock(p, iTab, lockType); 9844 } 9845 sqlite3BtreeLeave(p); 9846 } 9847 return rc; 9848 } 9849 #endif 9850 9851 #ifndef SQLITE_OMIT_INCRBLOB 9852 /* 9853 ** Argument pCsr must be a cursor opened for writing on an 9854 ** INTKEY table currently pointing at a valid table entry. 9855 ** This function modifies the data stored as part of that entry. 9856 ** 9857 ** Only the data content may only be modified, it is not possible to 9858 ** change the length of the data stored. If this function is called with 9859 ** parameters that attempt to write past the end of the existing data, 9860 ** no modifications are made and SQLITE_CORRUPT is returned. 9861 */ 9862 int sqlite3BtreePutData(BtCursor *pCsr, u32 offset, u32 amt, void *z){ 9863 int rc; 9864 assert( cursorOwnsBtShared(pCsr) ); 9865 assert( sqlite3_mutex_held(pCsr->pBtree->db->mutex) ); 9866 assert( pCsr->curFlags & BTCF_Incrblob ); 9867 9868 rc = restoreCursorPosition(pCsr); 9869 if( rc!=SQLITE_OK ){ 9870 return rc; 9871 } 9872 assert( pCsr->eState!=CURSOR_REQUIRESEEK ); 9873 if( pCsr->eState!=CURSOR_VALID ){ 9874 return SQLITE_ABORT; 9875 } 9876 9877 /* Save the positions of all other cursors open on this table. This is 9878 ** required in case any of them are holding references to an xFetch 9879 ** version of the b-tree page modified by the accessPayload call below. 9880 ** 9881 ** Note that pCsr must be open on a INTKEY table and saveCursorPosition() 9882 ** and hence saveAllCursors() cannot fail on a BTREE_INTKEY table, hence 9883 ** saveAllCursors can only return SQLITE_OK. 9884 */ 9885 VVA_ONLY(rc =) saveAllCursors(pCsr->pBt, pCsr->pgnoRoot, pCsr); 9886 assert( rc==SQLITE_OK ); 9887 9888 /* Check some assumptions: 9889 ** (a) the cursor is open for writing, 9890 ** (b) there is a read/write transaction open, 9891 ** (c) the connection holds a write-lock on the table (if required), 9892 ** (d) there are no conflicting read-locks, and 9893 ** (e) the cursor points at a valid row of an intKey table. 9894 */ 9895 if( (pCsr->curFlags & BTCF_WriteFlag)==0 ){ 9896 return SQLITE_READONLY; 9897 } 9898 assert( (pCsr->pBt->btsFlags & BTS_READ_ONLY)==0 9899 && pCsr->pBt->inTransaction==TRANS_WRITE ); 9900 assert( hasSharedCacheTableLock(pCsr->pBtree, pCsr->pgnoRoot, 0, 2) ); 9901 assert( !hasReadConflicts(pCsr->pBtree, pCsr->pgnoRoot) ); 9902 assert( pCsr->pPage->intKey ); 9903 9904 return accessPayload(pCsr, offset, amt, (unsigned char *)z, 1); 9905 } 9906 9907 /* 9908 ** Mark this cursor as an incremental blob cursor. 9909 */ 9910 void sqlite3BtreeIncrblobCursor(BtCursor *pCur){ 9911 pCur->curFlags |= BTCF_Incrblob; 9912 pCur->pBtree->hasIncrblobCur = 1; 9913 } 9914 #endif 9915 9916 /* 9917 ** Set both the "read version" (single byte at byte offset 18) and 9918 ** "write version" (single byte at byte offset 19) fields in the database 9919 ** header to iVersion. 9920 */ 9921 int sqlite3BtreeSetVersion(Btree *pBtree, int iVersion){ 9922 BtShared *pBt = pBtree->pBt; 9923 int rc; /* Return code */ 9924 9925 assert( iVersion==1 || iVersion==2 ); 9926 9927 /* If setting the version fields to 1, do not automatically open the 9928 ** WAL connection, even if the version fields are currently set to 2. 9929 */ 9930 pBt->btsFlags &= ~BTS_NO_WAL; 9931 if( iVersion==1 ) pBt->btsFlags |= BTS_NO_WAL; 9932 9933 rc = sqlite3BtreeBeginTrans(pBtree, 0); 9934 if( rc==SQLITE_OK ){ 9935 u8 *aData = pBt->pPage1->aData; 9936 if( aData[18]!=(u8)iVersion || aData[19]!=(u8)iVersion ){ 9937 rc = sqlite3BtreeBeginTrans(pBtree, 2); 9938 if( rc==SQLITE_OK ){ 9939 rc = sqlite3PagerWrite(pBt->pPage1->pDbPage); 9940 if( rc==SQLITE_OK ){ 9941 aData[18] = (u8)iVersion; 9942 aData[19] = (u8)iVersion; 9943 } 9944 } 9945 } 9946 } 9947 9948 pBt->btsFlags &= ~BTS_NO_WAL; 9949 return rc; 9950 } 9951 9952 /* 9953 ** Return true if the cursor has a hint specified. This routine is 9954 ** only used from within assert() statements 9955 */ 9956 int sqlite3BtreeCursorHasHint(BtCursor *pCsr, unsigned int mask){ 9957 return (pCsr->hints & mask)!=0; 9958 } 9959 9960 /* 9961 ** Return true if the given Btree is read-only. 9962 */ 9963 int sqlite3BtreeIsReadonly(Btree *p){ 9964 return (p->pBt->btsFlags & BTS_READ_ONLY)!=0; 9965 } 9966 9967 /* 9968 ** Return the size of the header added to each page by this module. 9969 */ 9970 int sqlite3HeaderSizeBtree(void){ return ROUND8(sizeof(MemPage)); } 9971 9972 #if !defined(SQLITE_OMIT_SHARED_CACHE) 9973 /* 9974 ** Return true if the Btree passed as the only argument is sharable. 9975 */ 9976 int sqlite3BtreeSharable(Btree *p){ 9977 return p->sharable; 9978 } 9979 9980 /* 9981 ** Return the number of connections to the BtShared object accessed by 9982 ** the Btree handle passed as the only argument. For private caches 9983 ** this is always 1. For shared caches it may be 1 or greater. 9984 */ 9985 int sqlite3BtreeConnectionCount(Btree *p){ 9986 testcase( p->sharable ); 9987 return p->pBt->nRef; 9988 } 9989 #endif