Index: src/wherecode.c
==================================================================
--- src/wherecode.c
+++ src/wherecode.c
@@ -444,10 +444,11 @@
     if( (pX->flags & EP_xIsSelect)==0 || pX->x.pSelect->pEList->nExpr==1 ){
       eType = sqlite3FindInIndex(pParse, pX, IN_INDEX_LOOP, 0, 0);
     }else{
       Select *pSelect = pX->x.pSelect;
       sqlite3 *db = pParse->db;
+      u16 savedDbOptFlags = db->dbOptFlags;
       ExprList *pOrigRhs = pSelect->pEList;
       ExprList *pOrigLhs = pX->pLeft->x.pList;
       ExprList *pRhs = 0;         /* New Select.pEList for RHS */
       ExprList *pLhs = 0;         /* New pX->pLeft vector */
 
@@ -487,11 +488,13 @@
           pLeft->x.pList = pLhs;
           aiMap = (int*)sqlite3DbMallocZero(pParse->db, sizeof(int) * nEq);
           testcase( aiMap==0 );
         }
         pSelect->pEList = pRhs;
+        db->dbOptFlags |= SQLITE_QueryFlattener;
         eType = sqlite3FindInIndex(pParse, pX, IN_INDEX_LOOP, 0, aiMap);
+        db->dbOptFlags = savedDbOptFlags;
         testcase( aiMap!=0 && aiMap[0]!=0 );
         pSelect->pEList = pOrigRhs;
         pLeft->x.pList = pOrigLhs;
         pX->pLeft = pLeft;
       }

Index: test/rowvalue3.test
==================================================================
--- test/rowvalue3.test
+++ test/rowvalue3.test
@@ -199,8 +199,22 @@
     " $res
   }
 }
 
 #-------------------------------------------------------------------------
+
+# 2016-11-17.  Query flattening in a vector SELECT on the RHS of an IN
+# operator.  Ticket https://www.sqlite.org/src/info/da7841375186386c
+#
+do_execsql_test 5.0 {
+  DROP TABLE IF EXISTS t1;
+  DROP TABLE IF EXISTS t2;
+  CREATE TABLE T1(a TEXT);
+  INSERT INTO T1(a) VALUES ('aaa');
+  CREATE TABLE T2(a TEXT PRIMARY KEY,n INT);
+  INSERT INTO T2(a, n) VALUES('aaa',0);
+  SELECT * FROM T2
+  WHERE (a,n) IN (SELECT T1.a, V.n FROM T1, (SELECT * FROM (SELECT 0 n)) V);
+} {aaa 0}
 
 
 finish_test