Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
Comment: | Do not allow the subtype of a value to cross a subquery boundary. This fixes the problem identified by forum post 3d9caa45cbe38c78. |
---|---|
Downloads: | Tarball | ZIP archive | SQL archive |
Timelines: | family | ancestors | descendants | both | trunk |
Files: | files | file ages | folders |
SHA3-256: |
bbaf1f2eb1e1637b356ed7ab1d1cf5bb |
User & Date: | drh 2022-06-09 20:26:06 |
References
2023-03-01
| ||
15:21 | Follow-up to [bbaf1f2eb1e1637b]: Make sure subtypes do not cross a subquery boundary even if the function that returned the value with a subtype is buried down inside a larger expression. This fixes a problem identified by forum post 37dd14a538. (check-in: e72661eb user: drh tags: trunk) | |
Context
2022-06-10
| ||
09:31 | fiddle: modernized the UI based on related code in fossil's /pikchrshow. Changed the color scheme to match sqlite.org. (check-in: c4523ffc user: stephan tags: trunk) | |
2022-06-09
| ||
20:26 | Do not allow the subtype of a value to cross a subquery boundary. This fixes the problem identified by forum post 3d9caa45cbe38c78. (check-in: bbaf1f2e user: drh tags: trunk) | |
17:17 | Prevent subtype values from slipping across a subquery boundry when the subquery is implemented as a co-routine. (Closed-Leaf check-in: 9e51a6c0 user: drh tags: subtype-subquery) | |
2022-06-08
| ||
18:29 | Move an #ifdef in shell.c to avoid a harmless "unused function" compiler warning. (check-in: 5abb5ef5 user: drh tags: trunk) | |
Changes
Changes to src/expr.c.
︙ | ︙ | |||
4572 4573 4574 4575 4576 4577 4578 4579 | ** X is stored in pExpr->pLeft. ** Y is stored in pExpr->pList->a[0].pExpr. ** Z is stored in pExpr->pList->a[1].pExpr. */ case TK_BETWEEN: { exprCodeBetween(pParse, pExpr, target, 0, 0); return target; } | | > > > > > > > > > > > > > > > > | | 4572 4573 4574 4575 4576 4577 4578 4579 4580 4581 4582 4583 4584 4585 4586 4587 4588 4589 4590 4591 4592 4593 4594 4595 4596 4597 4598 4599 4600 4601 4602 4603 4604 | ** X is stored in pExpr->pLeft. ** Y is stored in pExpr->pList->a[0].pExpr. ** Z is stored in pExpr->pList->a[1].pExpr. */ case TK_BETWEEN: { exprCodeBetween(pParse, pExpr, target, 0, 0); return target; } case TK_COLLATE: { if( !ExprHasProperty(pExpr, EP_Collate) && ALWAYS(pExpr->pLeft) && pExpr->pLeft->op==TK_FUNCTION ){ inReg = sqlite3ExprCodeTarget(pParse, pExpr->pLeft, target); if( inReg!=target ){ sqlite3VdbeAddOp2(v, OP_SCopy, inReg, target); inReg = target; } sqlite3VdbeAddOp1(v, OP_ClrSubtype, inReg); return inReg; }else{ pExpr = pExpr->pLeft; goto expr_code_doover; /* 2018-04-28: Prevent deep recursion. */ } } case TK_SPAN: case TK_UPLUS: { pExpr = pExpr->pLeft; goto expr_code_doover; /* 2018-04-28: Prevent deep recursion. OSSFuzz. */ } case TK_TRIGGER: { /* If the opcode is TK_TRIGGER, then the expression is a reference |
︙ | ︙ |
Changes to src/vdbe.c.
︙ | ︙ | |||
1475 1476 1477 1478 1479 1480 1481 | REGISTER_TRACE(p2++, pOut); pIn1++; pOut++; }while( --n ); break; } | | > > > > > > > > | 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 | REGISTER_TRACE(p2++, pOut); pIn1++; pOut++; }while( --n ); break; } /* Opcode: Copy P1 P2 P3 * P5 ** Synopsis: r[P2@P3+1]=r[P1@P3+1] ** ** Make a copy of registers P1..P1+P3 into registers P2..P2+P3. ** ** If the 0x0002 bit of P5 is set then also clear the MEM_Subtype flag in the ** destination. The 0x0001 bit of P5 indicates that this Copy opcode cannot ** be merged. The 0x0001 bit is used by the query planner and does not ** come into play during query execution. ** ** This instruction makes a deep copy of the value. A duplicate ** is made of any string or blob constant. See also OP_SCopy. */ case OP_Copy: { int n; n = pOp->p3; pIn1 = &aMem[pOp->p1]; pOut = &aMem[pOp->p2]; assert( pOut!=pIn1 ); while( 1 ){ memAboutToChange(p, pOut); sqlite3VdbeMemShallowCopy(pOut, pIn1, MEM_Ephem); Deephemeralize(pOut); if( (pOut->flags & MEM_Subtype)!=0 && (pOp->p5 & 0x0002)!=0 ){ pOut->flags &= ~MEM_Subtype; } #ifdef SQLITE_DEBUG pOut->pScopyFrom = 0; #endif REGISTER_TRACE(pOp->p2+pOp->p3-n, pOut); if( (n--)==0 ) break; pOut++; pIn1++; |
︙ | ︙ | |||
8301 8302 8303 8304 8305 8306 8307 8308 8309 8310 8311 8312 8313 8314 | || db->mallocFailed ); assert( !sqlite3VdbeMemTooBig(pOut) ); REGISTER_TRACE(pOp->p3, pOut); UPDATE_MAX_BLOBSIZE(pOut); break; } /* Opcode: FilterAdd P1 * P3 P4 * ** Synopsis: filter(P1) += key(P3@P4) ** ** Compute a hash on the P4 registers starting with r[P3] and ** add that hash to the bloom filter contained in r[P1]. */ | > > > > > > > > > > > | 8309 8310 8311 8312 8313 8314 8315 8316 8317 8318 8319 8320 8321 8322 8323 8324 8325 8326 8327 8328 8329 8330 8331 8332 8333 | || db->mallocFailed ); assert( !sqlite3VdbeMemTooBig(pOut) ); REGISTER_TRACE(pOp->p3, pOut); UPDATE_MAX_BLOBSIZE(pOut); break; } /* Opcode: ClrSubtype P1 * * * * ** Synopsis: r[P1].subtype = 0 ** ** Clear the subtype from register P1. */ case OP_ClrSubtype: { /* in1 */ pIn1 = &aMem[pOp->p1]; pIn1->flags &= ~MEM_Subtype; break; } /* Opcode: FilterAdd P1 * P3 P4 * ** Synopsis: filter(P1) += key(P3@P4) ** ** Compute a hash on the P4 registers starting with r[P3] and ** add that hash to the bloom filter contained in r[P1]. */ |
︙ | ︙ |
Changes to src/where.c.
︙ | ︙ | |||
678 679 680 681 682 683 684 685 686 687 688 689 690 691 | for(; iStart<iEnd; iStart++, pOp++){ if( pOp->p1!=iTabCur ) continue; if( pOp->opcode==OP_Column ){ pOp->opcode = OP_Copy; pOp->p1 = pOp->p2 + iRegister; pOp->p2 = pOp->p3; pOp->p3 = 0; }else if( pOp->opcode==OP_Rowid ){ pOp->opcode = OP_Sequence; pOp->p1 = iAutoidxCur; #ifdef SQLITE_ALLOW_ROWID_IN_VIEW if( iAutoidxCur==0 ){ pOp->opcode = OP_Null; pOp->p3 = 0; | > | 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 | for(; iStart<iEnd; iStart++, pOp++){ if( pOp->p1!=iTabCur ) continue; if( pOp->opcode==OP_Column ){ pOp->opcode = OP_Copy; pOp->p1 = pOp->p2 + iRegister; pOp->p2 = pOp->p3; pOp->p3 = 0; pOp->p5 = 2; /* Cause the MEM_Subtype flag to be cleared */ }else if( pOp->opcode==OP_Rowid ){ pOp->opcode = OP_Sequence; pOp->p1 = iAutoidxCur; #ifdef SQLITE_ALLOW_ROWID_IN_VIEW if( iAutoidxCur==0 ){ pOp->opcode = OP_Null; pOp->p3 = 0; |
︙ | ︙ |
Changes to test/subtype1.test.
︙ | ︙ | |||
23 24 25 26 27 28 29 30 31 | } {123} do_execsql_test subtype1-120 { SELECT typeof(test_setsubtype('hello',123)); } {text} do_execsql_test subtype1-130 { SELECT test_setsubtype('hello',123); } {hello} finish_test | > > > > > > > > > > > > > > > > > > > > > > > > > > > > | 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 | } {123} do_execsql_test subtype1-120 { SELECT typeof(test_setsubtype('hello',123)); } {text} do_execsql_test subtype1-130 { SELECT test_setsubtype('hello',123); } {hello} # 2022-06-09 # https://sqlite.org/forum/forumpost/3d9caa45cbe38c78 # # Avoid carrying subtypes through into a subquery that has been flattened # or to which the outer WHERE clause has been pushed down. # reset_db do_execsql_test subtype1-200 { CREATE TABLE t1(a); INSERT INTO t1 VALUES ('x'); CREATE VIEW t2(b) AS SELECT json(TRUE); CREATE TABLE t3(b); INSERT INTO t3 VALUES(json(TRUE)); } do_execsql_test subtype1-210 { SELECT * FROM t3, t1 WHERE NOT json_quote(b); } {1 x} do_execsql_test subtype1-220 { SELECT * FROM t2, t1 WHERE NOT json_quote(b); } {1 x} do_execsql_test subtype1-230 { WITH t4(a) AS MATERIALIZED (SELECT json(1)) SELECT subtype(a) FROM t4; } {0} do_execsql_test subtype1-231 { WITH t4(a) AS NOT MATERIALIZED (SELECT json(1)) SELECT subtype(a) FROM t4; } {0} finish_test |