Index: Makefile.msc
==================================================================
--- Makefile.msc
+++ Makefile.msc
@@ -56,10 +56,16 @@
 # Set this non-0 to dynamically link to the MSVC runtime library.
 #
 !IFNDEF USE_CRT_DLL
 USE_CRT_DLL = 0
 !ENDIF
+
+# Set this non-0 to link to the RPCRT4 library.
+#
+!IFNDEF USE_RPCRT4_LIB
+USE_RPCRT4_LIB = 0
+!ENDIF
 
 # Set this non-0 to generate assembly code listings for the source code
 # files.
 #
 !IFNDEF USE_LISTINGS
@@ -498,10 +504,16 @@
 
 # These are the required SQLite compilation options used when compiling for
 # the Windows platform.
 #
 REQ_FEATURE_FLAGS = $(REQ_FEATURE_FLAGS) -DSQLITE_MAX_TRIGGER_DEPTH=100
+
+# If we are linking to the RPCRT4 library, enable features that need it.
+#
+!IF $(USE_RPCRT4_LIB)!=0
+REQ_FEATURE_FLAGS = $(REQ_FEATURE_FLAGS) -DSQLITE_WIN32_USE_UUID=1
+!ENDIF
 
 # Add the required and optional SQLite compilation options into the command
 # lines used to invoke the MSVC code and resource compilers.
 #
 TCC = $(TCC) $(REQ_FEATURE_FLAGS) $(OPT_FEATURE_FLAGS)
@@ -561,10 +573,16 @@
 #
 LTCOMPILE = $(TCC) -Fo$@
 LTRCOMPILE = $(RCC) -r
 LTLIB = lib.exe
 LTLINK = $(TCC) -Fe$@
+
+# If requested, link to the RPCRT4 library.
+#
+!IF $(USE_RPCRT4_LIB)!=0
+LTLINK = $(LTLINK) rpcrt4.lib
+!ENDIF
 
 # If a platform was set, force the linker to target that.
 # Note that the vcvars*.bat family of batch files typically
 # set this for you.  Otherwise, the linker will attempt
 # to deduce the binary type based on the object files.

Index: src/expr.c
==================================================================
--- src/expr.c
+++ src/expr.c
@@ -2254,11 +2254,12 @@
   int i;
   int minLru;
   int idxLru;
   struct yColCache *p;
 
-  assert( iReg>0 );  /* Register numbers are always positive */
+  /* Unless an error has occurred, register numbers are always positive. */
+  assert( iReg>0 || pParse->nErr || pParse->db->mallocFailed );
   assert( iCol>=-1 && iCol<32768 );  /* Finite column numbers */
 
   /* The SQLITE_ColumnCache flag disables the column cache.  This is used
   ** for testing only - to verify that SQLite always gets the same answer
   ** with and without the column cache.

Index: src/os_win.c
==================================================================
--- src/os_win.c
+++ src/os_win.c
@@ -1064,10 +1064,27 @@
 
 #define osInterlockedCompareExchange ((LONG(WINAPI*)(LONG \
         SQLITE_WIN32_VOLATILE*, LONG,LONG))aSyscall[76].pCurrent)
 #endif /* defined(InterlockedCompareExchange) */
 
+#if !SQLITE_OS_WINCE && !SQLITE_OS_WINRT && SQLITE_WIN32_USE_UUID
+  { "UuidCreate",               (SYSCALL)UuidCreate,             0 },
+#else
+  { "UuidCreate",               (SYSCALL)0,                      0 },
+#endif
+
+#define osUuidCreate ((RPC_STATUS(RPC_ENTRY*)(UUID*))aSyscall[77].pCurrent)
+
+#if !SQLITE_OS_WINCE && !SQLITE_OS_WINRT && SQLITE_WIN32_USE_UUID
+  { "UuidCreateSequential",     (SYSCALL)UuidCreateSequential,   0 },
+#else
+  { "UuidCreateSequential",     (SYSCALL)0,                      0 },
+#endif
+
+#define osUuidCreateSequential \
+        ((RPC_STATUS(RPC_ENTRY*)(UUID*))aSyscall[78].pCurrent)
+
 }; /* End of the overrideable system calls */
 
 /*
 ** This is the xSetSystemCall() method of sqlite3_vfs for all of the
 ** "win32" VFSes.  Return SQLITE_OK opon successfully updating the
@@ -5342,10 +5359,26 @@
     LARGE_INTEGER i;
     osQueryPerformanceCounter(&i);
     memcpy(&zBuf[n], &i, sizeof(i));
     n += sizeof(i);
   }
+#endif
+#if !SQLITE_OS_WINCE && !SQLITE_OS_WINRT && SQLITE_WIN32_USE_UUID
+  if( sizeof(UUID)<=nBuf-n ){
+    UUID id;
+    memset(&id, 0, sizeof(UUID));
+    osUuidCreate(&id);
+    memcpy(zBuf, &id, sizeof(UUID));
+    n += sizeof(UUID);
+  }
+  if( sizeof(UUID)<=nBuf-n ){
+    UUID id;
+    memset(&id, 0, sizeof(UUID));
+    osUuidCreateSequential(&id);
+    memcpy(zBuf, &id, sizeof(UUID));
+    n += sizeof(UUID);
+  }
 #endif
   return n;
 }
 
 
@@ -5520,11 +5553,11 @@
   };
 #endif
 
   /* Double-check that the aSyscall[] array has been constructed
   ** correctly.  See ticket [bb3a86e890c8e96ab] */
-  assert( ArraySize(aSyscall)==77 );
+  assert( ArraySize(aSyscall)==79 );
 
   /* get memory map allocation granularity */
   memset(&winSysInfo, 0, sizeof(SYSTEM_INFO));
 #if SQLITE_OS_WINRT
   osGetNativeSystemInfo(&winSysInfo);

Index: src/vdbeaux.c
==================================================================
--- src/vdbeaux.c
+++ src/vdbeaux.c
@@ -3371,11 +3371,12 @@
   u32 notUsed;
   const unsigned char *aKey = (const unsigned char*)pKey;
 
   if( CORRUPT_DB ) return;
   idx = getVarint32(aKey, szHdr);
-  assert( szHdr<=nKey );
+  assert( nKey>=0 );
+  assert( szHdr<=(u32)nKey );
   while( idx<szHdr ){
     idx += getVarint32(aKey+idx, notUsed);
     nField++;
   }
   assert( nField <= pKeyInfo->nField+pKeyInfo->nXField );

Index: test/mallocK.test
==================================================================
--- test/mallocK.test
+++ test/mallocK.test
@@ -131,8 +131,18 @@
   db cache flush
   db eval { SELECT DISTINCT c FROM t3 WHERE b BETWEEN '.xx..' AND '.xxxx' }
 } -test {
   faultsim_test_result {0 {12 13 14 15}} 
 }
+
+do_execsql_test 7.1 {
+  CREATE TABLE x1(a INTEGER PRIMARY KEY, b);
+}
+do_faultsim_test 7.2 -faults oom* -body {
+  execsql { SELECT * FROM x1 WHERE a = (SELECT 1) }
+} -test {
+  faultsim_test_result [list 0 {}]
+}
+
 
 finish_test