Index: src/attach.c
==================================================================
--- src/attach.c
+++ src/attach.c
@@ -602,10 +602,22 @@
       return 1;
     }
     if( sqlite3FixExprList(pFix, pStep->pExprList) ){
       return 1;
     }
+#ifndef SQLITE_OMIT_UPSERT
+    if( pStep->pUpsert ){
+      Upsert *pUp = pStep->pUpsert;
+      if( sqlite3FixExprList(pFix, pUp->pUpsertTarget)
+       || sqlite3FixExpr(pFix, pUp->pUpsertTargetWhere)
+       || sqlite3FixExprList(pFix, pUp->pUpsertSet)
+       || sqlite3FixExpr(pFix, pUp->pUpsertWhere)
+      ){
+        return 1;
+      }
+    }
+#endif
     pStep = pStep->pNext;
   }
   return 0;
 }
 #endif

Index: src/sqliteInt.h
==================================================================
--- src/sqliteInt.h
+++ src/sqliteInt.h
@@ -2738,17 +2738,17 @@
 ** WHERE clause is omitted.
 */
 struct Upsert {
   ExprList *pUpsertTarget;  /* Optional description of conflicting index */
   Expr *pUpsertTargetWhere; /* WHERE clause for partial index targets */
-  Index *pUpsertIdx;        /* Constraint that pUpsertTarget identifies */
   ExprList *pUpsertSet;     /* The SET clause from an ON CONFLICT UPDATE */
   Expr *pUpsertWhere;       /* WHERE clause for the ON CONFLICT UPDATE */
   /* The fields above comprise the parse tree for the upsert clause.
   ** The fields below are used to transfer information from the INSERT
   ** processing down into the UPDATE processing while generating code.
   ** Upsert owns the memory allocated above, but not the memory below. */
+  Index *pUpsertIdx;        /* Constraint that pUpsertTarget identifies */
   SrcList *pUpsertSrc;      /* Table to be updated */
   int regData;              /* First register holding array of VALUES */
   int iDataCur;             /* Index of the data cursor */
   int iIdxCur;              /* Index of the first index cursor */
 };