ADDED   ext/rbu/rbufault3.test
Index: ext/rbu/rbufault3.test
==================================================================
--- ext/rbu/rbufault3.test
+++ ext/rbu/rbufault3.test
@@ -0,0 +1,98 @@
+# 2016 April 20
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# This file contains fault injection tests for RBU vacuum operations.
+#
+
+source [file join [file dirname [info script]] rbu_common.tcl]
+source $testdir/malloc_common.tcl
+set ::testprefix rbufault3
+
+foreach {fault errlist} {
+  oom-* {
+    {1 SQLITE_NOMEM}
+    {1 SQLITE_IOERR_NOMEM}
+    {1 {SQLITE_NOMEM - out of memory}}
+  }
+
+  ioerr-* {
+    {1 {SQLITE_IOERR - disk I/O error}}
+    {1 SQLITE_IOERR} 
+    {1 SQLITE_IOERR_WRITE} 
+    {1 SQLITE_IOERR_FSYNC} 
+    {1 SQLITE_IOERR_READ} 
+    {1 {SQLITE_IOERR - unable to open database: test.db2}} 
+    {1 {SQLITE_ERROR - unable to open database: test.db2}} 
+    {1 {SQLITE_ERROR - SQL logic error or missing database}}
+  }
+
+  cantopen* {
+    {1 {SQLITE_CANTOPEN - unable to open database: test.db2}}  
+    {1 {SQLITE_CANTOPEN - unable to open database: test.db2}}  
+    {1 {SQLITE_CANTOPEN - unable to open database file}}  
+    {1 SQLITE_CANTOPEN} 
+  }
+
+} {
+
+  reset_db
+  do_execsql_test 0 {
+    CREATE TABLE target(x UNIQUE, y, z, PRIMARY KEY(y));
+    INSERT INTO target VALUES(1, 2, 3);
+    INSERT INTO target VALUES(4, 5, 6);
+    INSERT INTO target VALUES(7, 8, 9);
+    CREATE INDEX i1 ON target(z);
+  }
+  faultsim_save_and_close
+
+  do_faultsim_test 1 -faults $fault -prep {
+    faultsim_restore_and_reopen
+    forcedelete test.db2
+  } -body {
+    sqlite3rbu_vacuum rbu test.db test.db2
+    while {[rbu step]=="SQLITE_OK"} {}
+    rbu close
+  } -test {
+    eval [list faultsim_test_result {0 SQLITE_DONE} {*}$::errlist]
+  }
+
+  do_faultsim_test 2 -faults $fault -prep {
+    faultsim_restore_and_reopen
+    forcedelete test.db2
+  } -body {
+    sqlite3rbu_vacuum rbu test.db test.db2
+    rbu step
+    rbu close
+  } -test {
+    eval [list faultsim_test_result {0 SQLITE_OK} {*}$::errlist]
+  }
+
+  forcedelete test.db2
+  sqlite3rbu_vacuum rbu test.db test.db2
+  rbu step
+  rbu close
+  faultsim_save_and_close
+
+  do_faultsim_test 3 -faults $fault -prep {
+    faultsim_restore_and_reopen
+    forcedelete test.db2
+  } -body {
+    sqlite3rbu_vacuum rbu test.db test.db2
+    rbu step
+    rbu close
+  } -test {
+    eval [list faultsim_test_result {0 SQLITE_OK} {*}$::errlist]
+  }
+
+}
+
+finish_test
+

Index: ext/rbu/sqlite3rbu.c
==================================================================
--- ext/rbu/sqlite3rbu.c
+++ ext/rbu/sqlite3rbu.c
@@ -2337,11 +2337,11 @@
   assert( rbuIsVacuum(p) || p->zTarget!=0 );
 
   /* Open the RBU database */
   p->dbRbu = rbuOpenDbhandle(p, p->zRbu, 1);
 
-  if( rbuIsVacuum(p) ){
+  if( p->rc==SQLITE_OK && rbuIsVacuum(p) ){
     sqlite3_file_control(p->dbRbu, "main", SQLITE_FCNTL_RBUCNT, (void*)p);
   }
 
   /* If using separate RBU and state databases, attach the state database to
   ** the RBU db handle now.  */
@@ -2353,15 +2353,17 @@
   }
 
   /* If it has not already been created, create the rbu_state table */
   rbuMPrintfExec(p, p->dbRbu, RBU_CREATE_STATE, p->zStateDb);
 
-  if( rbuIsVacuum(p) ){
+  if( p->rc==SQLITE_OK && rbuIsVacuum(p) ){
     int bOpen = 0;
+    int rc;
     p->nRbu = 0;
     p->pRbuFd = 0;
-    sqlite3_file_control(p->dbRbu, "main", SQLITE_FCNTL_RBUCNT, (void*)p);
+    rc = sqlite3_file_control(p->dbRbu, "main", SQLITE_FCNTL_RBUCNT, (void*)p);
+    if( rc!=SQLITE_NOTFOUND ) p->rc = rc;
     if( p->eStage>=RBU_STAGE_MOVE ){
       bOpen = 1;
     }else{
       RbuState *pState = rbuLoadState(p);
       if( pState ){
@@ -3409,10 +3411,13 @@
       sqlite3_bind_value(pInsert, i+1, sqlite3_column_value(pSql, i));
     }
     sqlite3_step(pInsert);
     p->rc = sqlite3_reset(pInsert);
   }
+  if( p->rc==SQLITE_OK ){
+    p->rc = sqlite3_exec(p->dbMain, "PRAGMA writable_schema=0",0,0,&p->zErrmsg);
+  }
 
   rbuFinalize(p, pSql);
   rbuFinalize(p, pInsert);
 }
 
@@ -3509,11 +3514,13 @@
           rbuCopyPragma(p, "auto_vacuum");
         }
 
         /* Open transactions both databases. The *-oal file is opened or
         ** created at this point. */
-        p->rc = sqlite3_exec(db, "BEGIN IMMEDIATE", 0, 0, &p->zErrmsg);
+        if( p->rc==SQLITE_OK ){
+          p->rc = sqlite3_exec(db, "BEGIN IMMEDIATE", 0, 0, &p->zErrmsg);
+        }
         if( p->rc==SQLITE_OK ){
           p->rc = sqlite3_exec(p->dbRbu, "BEGIN", 0, 0, &p->zErrmsg);
         }
 
         /* Check if the main database is a zipvfs db. If it is, set the upper
@@ -3526,11 +3533,11 @@
           }
         }
 
         /* If this is an RBU vacuum operation and the state table was empty
         ** when this handle was opened, create the target database schema. */
-        if( pState->eStage==0 && rbuIsVacuum(p) ){
+        if( p->rc==SQLITE_OK && pState->eStage==0 && rbuIsVacuum(p) ){
           rbuCreateTargetSchema(p);
           rbuCopyPragma(p, "user_version");
           rbuCopyPragma(p, "application_id");
         }
 
@@ -3893,11 +3900,11 @@
       ** contents of the first page if it does not yet exist. Otherwise,
       ** SQLite will not check for a *-wal file.  */
       if( pRbu && rbuIsVacuum(pRbu) 
           && rc==SQLITE_IOERR_SHORT_READ && iOfst==0
           && (p->openFlags & SQLITE_OPEN_MAIN_DB)
-          && pRbu->pRbuFd->base.pMethods
+          && pRbu->rc==SQLITE_OK
       ){
         sqlite3_file *pFd = (sqlite3_file*)pRbu->pRbuFd;
         rc = pFd->pMethods->xRead(pFd, zBuf, iAmt, iOfst);
         if( rc==SQLITE_OK ){
           u8 *aBuf = (u8*)zBuf;