Index: Makefile.in
==================================================================
--- Makefile.in
+++ Makefile.in
@@ -1310,21 +1310,27 @@
 testrunner:	testfixture$(TEXE)
 	./testfixture$(TEXE) $(TOP)/test/testrunner.tcl
 
 # Runs both fuzztest and testrunner, consecutively.
 #
-devtest:	testfixture$(TEXE) fuzztest testrunner
+devtest:	srctree-check testfixture$(TEXE) fuzztest testrunner
 
-mdevtest:
+mdevtest: srctree-check
 	$(TCLSH_CMD) $(TOP)/test/testrunner.tcl mdevtest
 
 sdevtest:
 	$(TCLSH_CMD) $(TOP)/test/testrunner.tcl sdevtest
 
+# Validate that various generated files in the source tree
+# are up-to-date.
+#
+srctree-check:	$(TOP)/tool/srctree-check.tcl
+	$(TCLSH_CMD) $(TOP)/tool/srctree-check.tcl
+
 # Testing for a release
 #
-releasetest: testfixture$(TEXE)
+releasetest: srctree-check testfixture$(TEXE)
 	./testfixture$(TEXE) $(TOP)/test/testrunner.tcl release
 
 # Minimal testing that runs in less than 3 minutes
 #
 quicktest:	./testfixture$(TEXE)
@@ -1331,11 +1337,11 @@
 	./testfixture$(TEXE) $(TOP)/test/extraquick.test $(TESTOPTS)
 
 # This is the common case.  Run many tests that do not take too long,
 # including fuzzcheck, sqlite3_analyzer, and sqldiff tests.
 #
-test:	fuzztest sourcetest $(TESTPROGS) tcltest
+test:	srctree-check fuzztest sourcetest $(TESTPROGS) tcltest
 
 # Run a test using valgrind.  This can take a really long time
 # because valgrind is so much slower than a native machine.
 #
 valgrindtest:	$(TESTPROGS) valgrindfuzz

Index: VERSION
==================================================================
--- VERSION
+++ VERSION
@@ -1,1 +1,1 @@
-3.43.0
+3.43.2

Index: autoconf/tea/configure.ac
==================================================================
--- autoconf/tea/configure.ac
+++ autoconf/tea/configure.ac
@@ -17,11 +17,11 @@
 # so you can encode the package version directly into the source files.
 # This will also define a special symbol for Windows (BUILD_<PACKAGE_NAME>
 # so that we create the export library with the dll.
 #-----------------------------------------------------------------------
 
-AC_INIT([sqlite],[3.43.0])
+AC_INIT([sqlite],[3.43.2])
 
 #--------------------------------------------------------------------
 # Call TEA_INIT as the first TEA_ macro to set up initial vars.
 # This will define a ${TEA_PLATFORM} variable == "unix" or "windows"
 # as well as PKG_LIB_FILE and PKG_STUB_LIB_FILE.

Index: configure
==================================================================
--- configure
+++ configure
@@ -1,8 +1,8 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for sqlite 3.43.0.
+# Generated by GNU Autoconf 2.69 for sqlite 3.43.2.
 #
 #
 # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
 #
 #
@@ -724,12 +724,12 @@
 MAKEFLAGS=
 
 # Identity of this package.
 PACKAGE_NAME='sqlite'
 PACKAGE_TARNAME='sqlite'
-PACKAGE_VERSION='3.43.0'
-PACKAGE_STRING='sqlite 3.43.0'
+PACKAGE_VERSION='3.43.2'
+PACKAGE_STRING='sqlite 3.43.2'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''
 
 # Factoring default headers for most tests.
 ac_includes_default="\
@@ -1468,11 +1468,11 @@
 #
 if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures sqlite 3.43.0 to adapt to many kinds of systems.
+\`configure' configures sqlite 3.43.2 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
 To assign environment variables (e.g., CC, CFLAGS...), specify them as
 VAR=VALUE.  See below for descriptions of some of the useful variables.
@@ -1533,11 +1533,11 @@
 _ACEOF
 fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of sqlite 3.43.0:";;
+     short | recursive ) echo "Configuration of sqlite 3.43.2:";;
    esac
   cat <<\_ACEOF
 
 Optional Features:
   --disable-option-checking  ignore unrecognized --enable/--with options
@@ -1663,11 +1663,11 @@
 fi
 
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-sqlite configure 3.43.0
+sqlite configure 3.43.2
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
 This configure script is free software; the Free Software Foundation
 gives unlimited permission to copy, distribute and modify it.
@@ -2082,11 +2082,11 @@
 } # ac_fn_c_check_header_mongrel
 cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by sqlite $as_me 3.43.0, which was
+It was created by sqlite $as_me 3.43.2, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
 
 _ACEOF
@@ -12455,11 +12455,11 @@
 cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # Save the log message, to keep $0 and so on meaningful, and to
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by sqlite $as_me 3.43.0, which was
+This file was extended by sqlite $as_me 3.43.2, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
   CONFIG_HEADERS  = $CONFIG_HEADERS
   CONFIG_LINKS    = $CONFIG_LINKS
@@ -12521,11 +12521,11 @@
 
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-sqlite config.status 3.43.0
+sqlite config.status 3.43.2
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
 Copyright (C) 2012 Free Software Foundation, Inc.
 This config.status script is free software; the Free Software Foundation

Index: ext/fts3/fts3_write.c
==================================================================
--- ext/fts3/fts3_write.c
+++ ext/fts3/fts3_write.c
@@ -5216,11 +5216,11 @@
   Fts3SegFilter filter;
   Fts3MultiSegReader csr;
   int rc;
   u64 cksum = 0;
 
-  assert( *pRc==SQLITE_OK );
+  if( *pRc ) return 0;
 
   memset(&filter, 0, sizeof(filter));
   memset(&csr, 0, sizeof(csr));
   filter.flags =  FTS3_SEGMENT_REQUIRE_POS|FTS3_SEGMENT_IGNORE_EMPTY;
   filter.flags |= FTS3_SEGMENT_SCAN;

Index: ext/fts5/fts5_index.c
==================================================================
--- ext/fts5/fts5_index.c
+++ ext/fts5/fts5_index.c
@@ -1526,13 +1526,13 @@
     for(iOff=pLvl->iOff; iOff<pData->nn; iOff++){
       if( pData->p[iOff] ) break; 
     }
 
     if( iOff<pData->nn ){
-      i64 iVal;
+      u64 iVal;
       pLvl->iLeafPgno += (iOff - pLvl->iOff) + 1;
-      iOff += fts5GetVarint(&pData->p[iOff], (u64*)&iVal);
+      iOff += fts5GetVarint(&pData->p[iOff], &iVal);
       pLvl->iRowid += iVal;
       pLvl->iOff = iOff;
     }else{
       pLvl->bEof = 1;
     }
@@ -4208,11 +4208,11 @@
     }else{
       bDone = 1;
     }
 
     if( pDlidx->bPrevValid ){
-      iVal = iRowid - pDlidx->iPrev;
+      iVal = (u64)iRowid - (u64)pDlidx->iPrev;
     }else{
       i64 iPgno = (i==0 ? pWriter->writer.pgno : pDlidx[-1].pgno);
       assert( pDlidx->buf.n==0 );
       sqlite3Fts5BufferAppendVarint(&p->rc, &pDlidx->buf, !bDone);
       sqlite3Fts5BufferAppendVarint(&p->rc, &pDlidx->buf, iPgno);
@@ -5055,11 +5055,10 @@
   u8 *aIdx = 0;
   int bLastInDoclist = 0;
   int iIdx = 0;
   int iStart = 0;
   int iKeyOff = 0;
-  int iPrevKeyOff = 0;
   int iDelKeyOff = 0;       /* Offset of deleted key, if any */
 
   nIdx = nPg-iPgIdx;
   aIdx = sqlite3Fts5MallocZero(&p->rc, nIdx+16);
   if( p->rc ) return;
@@ -5196,84 +5195,83 @@
         iOff += nSuffix2;
         iNextOff += nSuffix2;
       }
     }
   }else if( iStart==4 ){
-      int iPgno;
-
-      assert_nc( pSeg->iLeafPgno>pSeg->iTermLeafPgno );
-      /* The entry being removed may be the only position list in
-      ** its doclist. */
-      for(iPgno=pSeg->iLeafPgno-1; iPgno>pSeg->iTermLeafPgno; iPgno-- ){
-        Fts5Data *pPg = fts5DataRead(p, FTS5_SEGMENT_ROWID(iSegid, iPgno));
-        int bEmpty = (pPg && pPg->nn==4);
-        fts5DataRelease(pPg);
-        if( bEmpty==0 ) break;
-      }
-
-      if( iPgno==pSeg->iTermLeafPgno ){
-        i64 iId = FTS5_SEGMENT_ROWID(iSegid, pSeg->iTermLeafPgno);
-        Fts5Data *pTerm = fts5DataRead(p, iId);
-        if( pTerm && pTerm->szLeaf==pSeg->iTermLeafOffset ){
-          u8 *aTermIdx = &pTerm->p[pTerm->szLeaf];
-          int nTermIdx = pTerm->nn - pTerm->szLeaf;
-          int iTermIdx = 0;
-          int iTermOff = 0;
-
-          while( 1 ){
-            u32 iVal = 0;
-            int nByte = fts5GetVarint32(&aTermIdx[iTermIdx], iVal);
-            iTermOff += iVal;
-            if( (iTermIdx+nByte)>=nTermIdx ) break;
-            iTermIdx += nByte;
-          }
-          nTermIdx = iTermIdx;
-
-          memmove(&pTerm->p[iTermOff], &pTerm->p[pTerm->szLeaf], nTermIdx);
-          fts5PutU16(&pTerm->p[2], iTermOff);
-
-          fts5DataWrite(p, iId, pTerm->p, iTermOff+nTermIdx);
-          if( nTermIdx==0 ){
-            fts5SecureDeleteIdxEntry(p, iSegid, pSeg->iTermLeafPgno);
-          }
-        }
-        fts5DataRelease(pTerm);
-      }
-    }
-
-    if( p->rc==SQLITE_OK ){
-      const int nMove = nPg - iNextOff;
-      int nShift = 0;
-
-      memmove(&aPg[iOff], &aPg[iNextOff], nMove);
-      iPgIdx -= (iNextOff - iOff);
-      nPg = iPgIdx;
-      fts5PutU16(&aPg[2], iPgIdx);
-
-      nShift = iNextOff - iOff;
-      for(iIdx=0, iKeyOff=0, iPrevKeyOff=0; iIdx<nIdx; /* no-op */){
-        u32 iVal = 0;
-        iIdx += fts5GetVarint32(&aIdx[iIdx], iVal);
-        iKeyOff += iVal;
-        if( iKeyOff!=iDelKeyOff ){
-          if( iKeyOff>iOff ){
-            iKeyOff -= nShift;
-            nShift = 0;
-          }
-          nPg += sqlite3Fts5PutVarint(&aPg[nPg], iKeyOff - iPrevKeyOff);
-          iPrevKeyOff = iKeyOff;
-        }
-      }
-
-      if( iPgIdx==nPg && nIdx>0 && pSeg->iLeafPgno!=1 ){
-        fts5SecureDeleteIdxEntry(p, iSegid, pSeg->iLeafPgno);
-      }
-
-      assert_nc( nPg>4 || fts5GetU16(aPg)==0 );
-      fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg,nPg);
-    }
-    sqlite3_free(aIdx);
+    int iPgno;
+
+    assert_nc( pSeg->iLeafPgno>pSeg->iTermLeafPgno );
+    /* The entry being removed may be the only position list in
+    ** its doclist. */
+    for(iPgno=pSeg->iLeafPgno-1; iPgno>pSeg->iTermLeafPgno; iPgno-- ){
+      Fts5Data *pPg = fts5DataRead(p, FTS5_SEGMENT_ROWID(iSegid, iPgno));
+      int bEmpty = (pPg && pPg->nn==4);
+      fts5DataRelease(pPg);
+      if( bEmpty==0 ) break;
+    }
+
+    if( iPgno==pSeg->iTermLeafPgno ){
+      i64 iId = FTS5_SEGMENT_ROWID(iSegid, pSeg->iTermLeafPgno);
+      Fts5Data *pTerm = fts5DataRead(p, iId);
+      if( pTerm && pTerm->szLeaf==pSeg->iTermLeafOffset ){
+        u8 *aTermIdx = &pTerm->p[pTerm->szLeaf];
+        int nTermIdx = pTerm->nn - pTerm->szLeaf;
+        int iTermIdx = 0;
+        int iTermOff = 0;
+
+        while( 1 ){
+          u32 iVal = 0;
+          int nByte = fts5GetVarint32(&aTermIdx[iTermIdx], iVal);
+          iTermOff += iVal;
+          if( (iTermIdx+nByte)>=nTermIdx ) break;
+          iTermIdx += nByte;
+        }
+        nTermIdx = iTermIdx;
+
+        memmove(&pTerm->p[iTermOff], &pTerm->p[pTerm->szLeaf], nTermIdx);
+        fts5PutU16(&pTerm->p[2], iTermOff);
+
+        fts5DataWrite(p, iId, pTerm->p, iTermOff+nTermIdx);
+        if( nTermIdx==0 ){
+          fts5SecureDeleteIdxEntry(p, iSegid, pSeg->iTermLeafPgno);
+        }
+      }
+      fts5DataRelease(pTerm);
+    }
+  }
+
+  if( p->rc==SQLITE_OK ){
+    const int nMove = nPg - iNextOff;     /* Number of bytes to move */
+    int nShift = iNextOff - iOff;         /* Distance to move them */
+
+    int iPrevKeyOut = 0;
+    int iKeyIn = 0;
+
+    memmove(&aPg[iOff], &aPg[iNextOff], nMove);
+    iPgIdx -= nShift;
+    nPg = iPgIdx;
+    fts5PutU16(&aPg[2], iPgIdx);
+
+    for(iIdx=0; iIdx<nIdx; /* no-op */){
+      u32 iVal = 0;
+      iIdx += fts5GetVarint32(&aIdx[iIdx], iVal);
+      iKeyIn += iVal;
+      if( iKeyIn!=iDelKeyOff ){
+        int iKeyOut = (iKeyIn - (iKeyIn>iOff ? nShift : 0));
+        nPg += sqlite3Fts5PutVarint(&aPg[nPg], iKeyOut - iPrevKeyOut);
+        iPrevKeyOut = iKeyOut;
+      }
+    }
+
+    if( iPgIdx==nPg && nIdx>0 && pSeg->iLeafPgno!=1 ){
+      fts5SecureDeleteIdxEntry(p, iSegid, pSeg->iLeafPgno);
+    }
+
+    assert_nc( nPg>4 || fts5GetU16(aPg)==0 );
+    fts5DataWrite(p, FTS5_SEGMENT_ROWID(iSegid,pSeg->iLeafPgno), aPg, nPg);
+  }
+  sqlite3_free(aIdx);
 }
 
 /*
 ** This is called as part of flushing a delete to disk in 'secure-delete'
 ** mode. It edits the segments within the database described by argument

Index: ext/fts5/fts5_main.c
==================================================================
--- ext/fts5/fts5_main.c
+++ ext/fts5/fts5_main.c
@@ -1327,10 +1327,13 @@
   }else{
     pCsr->iLastRowid = fts5GetRowidLimit(pRowidLe, LARGEST_INT64);
     pCsr->iFirstRowid = fts5GetRowidLimit(pRowidGe, SMALLEST_INT64);
   }
 
+  rc = sqlite3Fts5IndexLoadConfig(pTab->p.pIndex);
+  if( rc!=SQLITE_OK ) goto filter_out;
+
   if( pTab->pSortCsr ){
     /* If pSortCsr is non-NULL, then this call is being made as part of 
     ** processing for a "... MATCH <expr> ORDER BY rank" query (ePlan is
     ** set to FTS5_PLAN_SORTED_MATCH). pSortCsr is the cursor that will
     ** return results to the user for this query. The current cursor 
@@ -1349,11 +1352,13 @@
     }
     pCsr->ePlan = FTS5_PLAN_SOURCE;
     pCsr->pExpr = pTab->pSortCsr->pExpr;
     rc = fts5CursorFirst(pTab, pCsr, bDesc);
   }else if( pCsr->pExpr ){
-    rc = fts5CursorParseRank(pConfig, pCsr, pRank);
+    if( rc==SQLITE_OK ){
+      rc = fts5CursorParseRank(pConfig, pCsr, pRank);
+    }
     if( rc==SQLITE_OK ){
       if( bOrderByRank ){
         pCsr->ePlan = FTS5_PLAN_SORTED_MATCH;
         rc = fts5CursorFirstSorted(pTab, pCsr, bDesc);
       }else{

Index: ext/fts5/test/fts5misc.test
==================================================================
--- ext/fts5/test/fts5misc.test
+++ ext/fts5/test/fts5misc.test
@@ -42,16 +42,16 @@
     WHERE rank = (SELECT highlight(t1, 4, '<b>', '</b>') FROM t1('*id'));
 } {0 {}}
 
 do_catchsql_test 1.3.1 { 
   SELECT highlight(t1, 4, '<b>', '</b>') FROM t1('*reads'); 
-} {1 {no such cursor: 1}}
+} {1 {no such cursor: 2}}
 
 do_catchsql_test 1.3.2 {
   SELECT a FROM t1
     WHERE rank = (SELECT highlight(t1, 4, '<b>', '</b>') FROM t1('*reads'));
-} {1 {no such cursor: 1}}
+} {1 {no such cursor: 2}}
 
 db close
 sqlite3 db test.db
 
 do_catchsql_test 1.3.3 {

Index: ext/fts5/test/fts5rank.test
==================================================================
--- ext/fts5/test/fts5rank.test
+++ ext/fts5/test/fts5rank.test
@@ -178,6 +178,30 @@
   SELECT * FROM "My.Table" WHERE Text MATCH 'table' ORDER BY rank;
 } {
   {table table table} {the table names.} {rank on an fts5 table}
 }
 
+
+#-------------------------------------------------------------------------
+# forum post: https://sqlite.org/forum/forumpost/a2dd636330
+#
+reset_db
+do_execsql_test 1.0 {
+  CREATE VIRTUAL TABLE t USING fts5 (a, b);  
+  INSERT INTO t (a, b) VALUES ('data1', 'sentence1'), ('data2', 'sentence2'); 
+  INSERT INTO t(t, rank) VALUES ('rank', 'bm25(10.0,1.0)');
+}
+
+sqlite3 db2 test.db 
+do_execsql_test -db db2 1.1 {
+  SELECT *, rank<0.0 FROM t('data*') ORDER BY RANK;
+} {data1 sentence1 1 data2 sentence2 1}
+
+do_execsql_test 1.2 {
+  INSERT INTO t(t, rank) VALUES ('rank', 'bm25(10.0,1.0)');
+}
+do_execsql_test -db db2 1.3 {
+  SELECT *, rank<0.0 FROM t('data*') ORDER BY RANK;
+} {data1 sentence1 1 data2 sentence2 1}
+db2 close
+
 finish_test

Index: ext/fts5/test/fts5secure.test
==================================================================
--- ext/fts5/test/fts5secure.test
+++ ext/fts5/test/fts5secure.test
@@ -270,9 +270,22 @@
   INSERT INTO t1(t1) VALUES('integrity-check');
 }
 
 do_execsql_test 5.4 { SELECT rowid FROM t1('abc'); } 2
 do_execsql_test 5.5 { SELECT rowid FROM t1('aa'); } 2
+
+#-------------------------------------------------------------------------
+reset_db
+
+do_execsql_test 6.0 {
+  CREATE VIRTUAL TABLE fts USING fts5(content);
+  INSERT INTO fts(fts, rank) VALUES ('secure-delete', 1);
+  INSERT INTO fts(rowid, content) VALUES
+    (3407, 'profile profile profile profile profile profile profile profile pull pulling pulling really');
+  DELETE FROM fts WHERE rowid IS 3407;
+  INSERT INTO fts(fts) VALUES ('integrity-check');
+}
+
 
 
 finish_test
 

Index: ext/fts5/test/fts5secure3.test
==================================================================
--- ext/fts5/test/fts5secure3.test
+++ ext/fts5/test/fts5secure3.test
@@ -84,75 +84,80 @@
 
 #-------------------------------------------------------------------------
 # Tests with large/small rowid values.
 #
 
-reset_db
-
-expr srand(0)
-
-set vocab {
-  Popper Poppins Popsicle Porfirio Porrima Porsche
-  Porter Portia Portland Portsmouth Portugal Portuguese
-  Poseidon Post PostgreSQL Potemkin Potomac Potsdam
-  Pottawatomie Potter Potts Pound Poussin Powell
-  PowerPC PowerPoint Powers Powhatan Poznan Prada
-  Prado Praetorian Prague Praia Prakrit Pratchett
-  Pratt Pravda Praxiteles Preakness Precambrian Preminger
-  Premyslid Prensa Prentice Pres Presbyterian Presbyterianism
-}
-proc newdoc {} {
-  for {set i 0} {$i<8} {incr i} {
-    lappend ret [lindex $::vocab [expr int(abs(rand()) * [llength $::vocab])]]
-  }
-  set ret
-}
-db func newdoc newdoc
-
-do_execsql_test 3.0 {
-  CREATE VIRTUAL TABLE fff USING fts5(y);
-  INSERT INTO fff(fff, rank) VALUES('pgsz', 64);
-
-  WITH s(x) AS ( VALUES(1) UNION ALL SELECT x+1 FROM s WHERE x<1000 )
-  INSERT INTO fff(rowid, y) SELECT random() , newdoc() FROM s;
-
-  WITH s(x) AS ( VALUES(1) UNION ALL SELECT x+1 FROM s WHERE x<1000 )
-  INSERT INTO fff(rowid, y) SELECT random() , newdoc() FROM s;
-
-  WITH s(x) AS ( VALUES(1) UNION ALL SELECT x+1 FROM s WHERE x<1000 )
-  INSERT INTO fff(rowid, y) SELECT random() , newdoc() FROM s;
-
-  INSERT INTO fff(fff, rank) VALUES('secure-delete', 1);
-}
-
-proc lshuffle {in} {
-  set out [list]
-  while {[llength $in]>0} {
-    set idx [expr int(abs(rand()) * [llength $in])]
-    lappend out [lindex $in $idx]
-    set in [lreplace $in $idx $idx]
-  }
-  set out
-}
-
-#dump fff
-
-set iTest 1
-foreach ii [lshuffle [db eval {SELECT rowid FROM fff}]] {
-  #if {$iTest==1} { dump fff }
-  #if {$iTest==1} { breakpoint }
-  do_execsql_test 3.1.$iTest.$ii {
-    DELETE FROM fff WHERE rowid=$ii;
-  }
-  #if {$iTest==1} { dump fff }
-  if {($iTest % 20)==0} {
-    do_execsql_test 3.1.$iTest.$ii.ic {
-      INSERT INTO fff(fff) VALUES('integrity-check');
-    }
-  }
-  #if {$iTest==1} { break }
-  incr iTest
+foreach {tn cfg} {
+  1 ""
+  2 "INSERT INTO fff(fff, rank) VALUES('secure-delete', 1)"
+} {
+  reset_db
+  
+  expr srand(0)
+  
+  set vocab {
+    Popper Poppins Popsicle Porfirio Porrima Porsche
+    Porter Portia Portland Portsmouth Portugal Portuguese
+    Poseidon Post PostgreSQL Potemkin Potomac Potsdam
+    Pottawatomie Potter Potts Pound Poussin Powell
+    PowerPC PowerPoint Powers Powhatan Poznan Prada
+    Prado Praetorian Prague Praia Prakrit Pratchett
+    Pratt Pravda Praxiteles Preakness Precambrian Preminger
+    Premyslid Prensa Prentice Pres Presbyterian Presbyterianism
+  }
+  proc newdoc {} {
+    for {set i 0} {$i<8} {incr i} {
+      lappend ret [lindex $::vocab [expr int(abs(rand()) * [llength $::vocab])]]
+    }
+    set ret
+  }
+  db func newdoc newdoc
+  
+  do_execsql_test 3.$tn.0 {
+    CREATE VIRTUAL TABLE fff USING fts5(y);
+    INSERT INTO fff(fff, rank) VALUES('pgsz', 64);
+  
+    WITH s(x) AS ( VALUES(1) UNION ALL SELECT x+1 FROM s WHERE x<1000 )
+    INSERT INTO fff(rowid, y) SELECT random() , newdoc() FROM s;
+  
+    WITH s(x) AS ( VALUES(1) UNION ALL SELECT x+1 FROM s WHERE x<1000 )
+    INSERT INTO fff(rowid, y) SELECT random() , newdoc() FROM s;
+  
+    WITH s(x) AS ( VALUES(1) UNION ALL SELECT x+1 FROM s WHERE x<1000 )
+    INSERT INTO fff(rowid, y) SELECT random() , newdoc() FROM s;
+  }
+
+  execsql $cfg
+  
+  proc lshuffle {in} {
+    set out [list]
+    while {[llength $in]>0} {
+      set idx [expr int(abs(rand()) * [llength $in])]
+      lappend out [lindex $in $idx]
+      set in [lreplace $in $idx $idx]
+    }
+    set out
+  }
+  
+  #dump fff
+  
+  set iTest 1
+  foreach ii [lshuffle [db eval {SELECT rowid FROM fff}]] {
+    #if {$iTest==1} { dump fff }
+    #if {$iTest==1} { breakpoint }
+    do_execsql_test 3.$tn.1.$iTest.$ii {
+      DELETE FROM fff WHERE rowid=$ii;
+    }
+    #if {$iTest==1} { dump fff }
+    if {($iTest % 20)==0} {
+      do_execsql_test 3.$tn.1.$iTest.$ii.ic {
+        INSERT INTO fff(fff) VALUES('integrity-check');
+      }
+    }
+    #if {$iTest==1} { break }
+    incr iTest
+  }
 }
 
 #execsql_pp { SELECT rowid FROM fff('post') ORDER BY rowid ASC }
 #breakpoint
 #execsql_pp { 

Index: ext/session/sqlite3session.c
==================================================================
--- ext/session/sqlite3session.c
+++ ext/session/sqlite3session.c
@@ -3234,19 +3234,23 @@
             pIn->iNext += nByte;
           }
         }
       }
       if( eType==SQLITE_INTEGER || eType==SQLITE_FLOAT ){
-        sqlite3_int64 v = sessionGetI64(aVal);
-        if( eType==SQLITE_INTEGER ){
-          sqlite3VdbeMemSetInt64(apOut[i], v);
+        if( (pIn->nData-pIn->iNext)<8 ){
+          rc = SQLITE_CORRUPT_BKPT;
         }else{
-          double d;
-          memcpy(&d, &v, 8);
-          sqlite3VdbeMemSetDouble(apOut[i], d);
+          sqlite3_int64 v = sessionGetI64(aVal);
+          if( eType==SQLITE_INTEGER ){
+            sqlite3VdbeMemSetInt64(apOut[i], v);
+          }else{
+            double d;
+            memcpy(&d, &v, 8);
+            sqlite3VdbeMemSetDouble(apOut[i], d);
+          }
+          pIn->iNext += 8;
         }
-        pIn->iNext += 8;
       }
     }
   }
 
   return rc;

Index: ext/wasm/GNUmakefile
==================================================================
--- ext/wasm/GNUmakefile
+++ ext/wasm/GNUmakefile
@@ -843,15 +843,15 @@
 sqlite3-worker1-promiser.js := $(dir.dout)/sqlite3-worker1-promiser.js
 sqlite3-worker1-bundler-friendly.js := $(dir.dout)/sqlite3-worker1-bundler-friendly.mjs
 sqlite3-worker1-promiser-bundler-friendly.js := $(dir.dout)/sqlite3-worker1-promiser-bundler-friendly.js
 $(eval $(call C-PP.FILTER,$(sqlite3-worker1.js.in),$(sqlite3-worker1.js)))
 $(eval $(call C-PP.FILTER,$(sqlite3-worker1.js.in),$(sqlite3-worker1-bundler-friendly.js),\
-    $(c-pp.D.bundler-friendly)))
+    $(c-pp.D.sqlite3-bundler-friendly)))
 $(eval $(call C-PP.FILTER,$(sqlite3-worker1-promiser.js.in),$(sqlite3-worker1-promiser.js)))
 $(eval $(call C-PP.FILTER,$(sqlite3-worker1-promiser.js.in),\
     $(sqlite3-worker1-promiser-bundler-friendly.js),\
-    $(c-pp.D.bundler-friendly)))
+    $(c-pp.D.sqlite3-bundler-friendly)))
 $(sqlite3-bundler-friendly.mjs): $(sqlite3-worker1-bundler-friendly.js) \
     $(sqlite3-worker1-promiser-bundler-friendly.js)
 $(sqlite3.js) $(sqlite3.mjs): $(sqlite3-worker1.js) $(sqlite3-worker1-promiser.js)
 
 ########################################################################

Index: ext/wasm/api/sqlite3-api-glue.js
==================================================================
--- ext/wasm/api/sqlite3-api-glue.js
+++ ext/wasm/api/sqlite3-api-glue.js
@@ -886,13 +886,13 @@
      Internal helper to assist in validating call argument counts in
      the hand-written sqlite3_xyz() wrappers. We do this only for
      consistency with non-special-case wrappings.
   */
   const __dbArgcMismatch = (pDb,f,n)=>{
-    return sqlite3.util.sqlite3_wasm_db_error(pDb, capi.SQLITE_MISUSE,
-                                              f+"() requires "+n+" argument"+
-                                              (1===n?"":'s')+".");
+    return util.sqlite3_wasm_db_error(pDb, capi.SQLITE_MISUSE,
+                                      f+"() requires "+n+" argument"+
+                                      (1===n?"":'s')+".");
   };
 
   /** Code duplication reducer for functions which take an encoding
       argument and require SQLITE_UTF8.  Sets the db error code to
       SQLITE_FORMAT and returns that code. */

Index: ext/wasm/api/sqlite3-vfs-opfs-sahpool.c-pp.js
==================================================================
--- ext/wasm/api/sqlite3-vfs-opfs-sahpool.c-pp.js
+++ ext/wasm/api/sqlite3-vfs-opfs-sahpool.c-pp.js
@@ -888,10 +888,12 @@
       const nWrote = sah.write(bytes, {at: HEADER_OFFSET_DATA});
       if(nWrote != n){
         this.setAssociatedPath(sah, '', 0);
         toss("Expected to write "+n+" bytes but wrote "+nWrote+".");
       }else{
+        sah.write(new Uint8Array([1,1]), {at: HEADER_OFFSET_DATA+18}
+                  /* force db out of WAL mode */);
         this.setAssociatedPath(sah, name, capi.SQLITE_OPEN_MAIN_DB);
       }
     }
 
   }/*class OpfsSAHPool*/;

Index: ext/wasm/api/sqlite3-vfs-opfs.c-pp.js
==================================================================
--- ext/wasm/api/sqlite3-vfs-opfs.c-pp.js
+++ ext/wasm/api/sqlite3-vfs-opfs.c-pp.js
@@ -1190,20 +1190,29 @@
       for(let i = 0; i < header.length; ++i){
         if( header.charCodeAt(i) !== bytes[i] ){
           toss("Input does not contain an SQLite database header.");
         }
       }
+      let sah;
       const [hDir, fnamePart] = await opfsUtil.getDirForFilename(filename, true);
-      const hFile = await hDir.getFileHandle(fnamePart, {create:true});
-      const sah = await hFile.createSyncAccessHandle();
-      sah.truncate(0);
-      const nWrote = sah.write(bytes, {at: 0});
-      sah.close();
-      if(nWrote != n){
-        toss("Expected to write "+n+" bytes but wrote "+nWrote+".");
-      }
-      return nWrote;
+      try {
+        const hFile = await hDir.getFileHandle(fnamePart, {create:true});
+        sah = await hFile.createSyncAccessHandle();
+        sah.truncate(0);
+        const nWrote = sah.write(bytes, {at: 0});
+        if(nWrote != n){
+          toss("Expected to write "+n+" bytes but wrote "+nWrote+".");
+        }
+        sah.write(new Uint8Array([1,1]), {at: 18}) /* force db out of WAL mode */;
+        return nWrote;
+      }catch(e){
+        if( sah ){ await sah.close(); sah = undefined; }
+        await hDir.removeEntry( fnamePart ).catch(()=>{});
+        throw e;
+      }finally{
+        if( sah ) await sah.close();
+      }
     };
 
     if(sqlite3.oo1){
       const OpfsDb = function(...args){
         const opt = sqlite3.oo1.DB.dbCtorHelper.normalizeArgs(...args);

Index: ext/wasm/api/sqlite3-wasm.c
==================================================================
--- ext/wasm/api/sqlite3-wasm.c
+++ ext/wasm/api/sqlite3-wasm.c
@@ -119,16 +119,10 @@
 #endif
 #ifndef SQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
 #  define SQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
 #endif
 
-/**********************************************************************/
-/* SQLITE_M... */
-#ifndef SQLITE_MAX_ALLOCATION_SIZE
-# define SQLITE_MAX_ALLOCATION_SIZE 0x1fffffff
-#endif
-
 /**********************************************************************/
 /* SQLITE_O... */
 #ifndef SQLITE_OMIT_DEPRECATED
 # define SQLITE_OMIT_DEPRECATED 1
 #endif

Index: src/btree.c
==================================================================
--- src/btree.c
+++ src/btree.c
@@ -7491,10 +7491,11 @@
   u8 *pTmp = sqlite3PagerTempSpace(pPg->pBt->pPager);
   u8 *pData;
   int k;                          /* Current slot in pCArray->apEnd[] */
   u8 *pSrcEnd;                    /* Current pCArray->apEnd[k] value */
 
+  assert( nCell>0 );
   assert( i<iEnd );
   j = get2byte(&aData[hdr+5]);
   if( NEVER(j>(u32)usableSize) ){ j = 0; }
   memcpy(&pTmp[j], &aData[j], usableSize - j);
 
@@ -7797,10 +7798,11 @@
 #endif
 
   return SQLITE_OK;
  editpage_fail:
   /* Unable to edit this page. Rebuild it from scratch instead. */
+  if( nNew<1 ) return SQLITE_CORRUPT_BKPT;
   populateCellCache(pCArray, iNew, nNew);
   return rebuildPage(pCArray, iNew, nNew, pPg);
 }
 
 

Index: src/func.c
==================================================================
--- src/func.c
+++ src/func.c
@@ -1814,12 +1814,14 @@
   p = sqlite3_aggregate_context(context, 0);
   if( p && p->cnt>0 ){
     if( p->approx ){
       if( p->ovrfl ){
         sqlite3_result_error(context,"integer overflow",-1);
-      }else{
+      }else if( !sqlite3IsNaN(p->rErr) ){
         sqlite3_result_double(context, p->rSum+p->rErr);
+      }else{
+        sqlite3_result_double(context, p->rSum);
       }
     }else{
       sqlite3_result_int64(context, p->iSum);
     }
   }
@@ -1828,11 +1830,12 @@
   SumCtx *p;
   p = sqlite3_aggregate_context(context, 0);
   if( p && p->cnt>0 ){
     double r;
     if( p->approx ){
-      r = p->rSum+p->rErr;
+      r = p->rSum;
+      if( !sqlite3IsNaN(p->rErr) ) r += p->rErr;
     }else{
       r = (double)(p->iSum);
     }
     sqlite3_result_double(context, r/(double)p->cnt);
   }
@@ -1841,11 +1844,12 @@
   SumCtx *p;
   double r = 0.0;
   p = sqlite3_aggregate_context(context, 0);
   if( p ){
     if( p->approx ){
-      r = p->rSum+p->rErr;
+      r = p->rSum;
+      if( !sqlite3IsNaN(p->rErr) ) r += p->rErr;
     }else{
       r = (double)(p->iSum);
     }
   }
   sqlite3_result_double(context, r);

Index: src/json.c
==================================================================
--- src/json.c
+++ src/json.c
@@ -2154,10 +2154,11 @@
          && (i>0 || ((pRoot[j].jnFlags & JNODE_REMOVE)!=0 && pParse->useMod))
       ){
         if( (pRoot[j].jnFlags & JNODE_REMOVE)==0 || pParse->useMod==0 ) i--;
         j += jsonNodeSize(&pRoot[j]);
       }
+      if( i==0 && j<=pRoot->n ) break;
       if( (pRoot->jnFlags & JNODE_APPEND)==0 ) break;
       if( pParse->useMod==0 ) break;
       assert( pRoot->eU==2 );
       iRoot = pRoot->u.iAppend;
       pRoot = &pParse->aNode[iRoot];
@@ -2482,11 +2483,13 @@
   if( pNode==0 ){
     return;
   }
   if( pNode->eType==JSON_ARRAY ){
     while( 1 /*exit-by-break*/ ){
-      for(i=1; i<=pNode->n; n++){
+      i = 1;
+      while( i<=pNode->n ){
+        if( (pNode[i].jnFlags & JNODE_REMOVE)==0 ) n++;
         i += jsonNodeSize(&pNode[i]);
       }
       if( (pNode->jnFlags & JNODE_APPEND)==0 ) break;
       if( p->useMod==0 ) break;
       assert( pNode->eU==2 );
@@ -2839,15 +2842,17 @@
       if( z==0 ){
          p->oom = 1;
          break;
       }
       if( sqlite3_value_subtype(pValue)!=JSON_SUBTYPE ){
-        char *zCopy = sqlite3DbStrDup(0, z);
+        char *zCopy = sqlite3_malloc64( n+1 );
         int k;
         if( zCopy ){
+          memcpy(zCopy, z, n);
+          zCopy[n] = 0;
           jsonParseAddCleanup(p, sqlite3_free, zCopy);
-       }else{
+        }else{
           p->oom = 1;
           sqlite3_result_error_nomem(pCtx);
         }
         k = jsonParseAddNode(p, JSON_STRING, n, zCopy);
         assert( k>0 || p->oom );
@@ -2898,10 +2903,11 @@
     jsonWrongNumArgs(ctx, "replace");
     return;
   }
   pParse = jsonParseCached(ctx, argv[0], ctx, argc>1);
   if( pParse==0 ) return;
+  pParse->nJPRef++;
   for(i=1; i<(u32)argc; i+=2){
     zPath = (const char*)sqlite3_value_text(argv[i]);
     pParse->useMod = 1;
     pNode = jsonLookup(pParse, zPath, 0, ctx);
     if( pParse->nErr ) goto replace_err;
@@ -2910,10 +2916,11 @@
     }
   }
   jsonReturnJson(pParse, pParse->aNode, ctx, 1);
 replace_err:
   jsonDebugPrintParse(pParse);
+  jsonParseFree(pParse);
 }
 
 
 /*
 ** json_set(JSON, PATH, VALUE, ...)
@@ -2944,10 +2951,11 @@
     jsonWrongNumArgs(ctx, bIsSet ? "set" : "insert");
     return;
   }
   pParse = jsonParseCached(ctx, argv[0], ctx, argc>1);
   if( pParse==0 ) return;
+  pParse->nJPRef++;
   for(i=1; i<(u32)argc; i+=2){
     zPath = (const char*)sqlite3_value_text(argv[i]);
     bApnd = 0;
     pParse->useMod = 1;
     pNode = jsonLookup(pParse, zPath, &bApnd, ctx);
@@ -2960,13 +2968,12 @@
       jsonReplaceNode(ctx, pParse, (u32)(pNode - pParse->aNode), argv[i+1]);
     }
   }
   jsonDebugPrintParse(pParse);
   jsonReturnJson(pParse, pParse->aNode, ctx, 1);
-
 jsonSetDone:
-  /* no cleanup required */;
+  jsonParseFree(pParse);
 }
 
 /*
 ** json_type(JSON)
 ** json_type(JSON, PATH)

Index: src/resolve.c
==================================================================
--- src/resolve.c
+++ src/resolve.c
@@ -1210,15 +1210,16 @@
 #endif
           pNC2 = pNC;
           while( pNC2
               && sqlite3ReferencesSrcList(pParse, pExpr, pNC2->pSrcList)==0
           ){
-            pExpr->op2++;
+            pExpr->op2 += (1 + pNC2->nNestedSelect);
             pNC2 = pNC2->pNext;
           }
           assert( pDef!=0 || IN_RENAME_OBJECT );
           if( pNC2 && pDef ){
+            pExpr->op2 += pNC2->nNestedSelect;
             assert( SQLITE_FUNC_MINMAX==NC_MinMaxAgg );
             assert( SQLITE_FUNC_ANYORDER==NC_OrderAgg );
             testcase( (pDef->funcFlags & SQLITE_FUNC_MINMAX)!=0 );
             testcase( (pDef->funcFlags & SQLITE_FUNC_ANYORDER)!=0 );
             pNC2->ncFlags |= NC_HasAgg
@@ -1775,10 +1776,11 @@
       p->pOrderBy = 0;
     }
  
     /* Recursively resolve names in all subqueries in the FROM clause
     */
+    if( pOuterNC ) pOuterNC->nNestedSelect++;
     for(i=0; i<p->pSrc->nSrc; i++){
       SrcItem *pItem = &p->pSrc->a[i];
       if( pItem->pSelect && (pItem->pSelect->selFlags & SF_Resolved)==0 ){
         int nRef = pOuterNC ? pOuterNC->nRef : 0;
         const char *zSavedContext = pParse->zAuthContext;
@@ -1799,10 +1801,11 @@
           assert( pItem->fg.isCorrelated==0 && pOuterNC->nRef>=nRef );
           pItem->fg.isCorrelated = (pOuterNC->nRef>nRef);
         }
       }
     }
+    if( pOuterNC ) pOuterNC->nNestedSelect--;
  
     /* Set up the local name-context to pass to sqlite3ResolveExprNames() to
     ** resolve the result-set expression list.
     */
     sNC.ncFlags = NC_AllowAgg|NC_AllowWin;

Index: src/select.c
==================================================================
--- src/select.c
+++ src/select.c
@@ -5299,16 +5299,16 @@
   assert( pItem->pTab!=0 );
   pTab = pItem->pTab;
   assert( pItem->pSelect!=0 );
   pSub = pItem->pSelect;
   assert( pSub->pEList->nExpr==pTab->nCol );
-  if( (pSub->selFlags & (SF_Distinct|SF_Aggregate))!=0 ){
-    testcase( pSub->selFlags & SF_Distinct );
-    testcase( pSub->selFlags & SF_Aggregate );
-    return 0;
-  }
   for(pX=pSub; pX; pX=pX->pPrior){
+    if( (pX->selFlags & (SF_Distinct|SF_Aggregate))!=0 ){
+      testcase( pX->selFlags & SF_Distinct );
+      testcase( pX->selFlags & SF_Aggregate );
+      return 0;
+    }
     if( pX->pPrior && pX->op!=TK_ALL ){
       /* This optimization does not work for compound subqueries that
       ** use UNION, INTERSECT, or EXCEPT.  Only UNION ALL is allowed. */
       return 0;
     }

Index: src/shell.c.in
==================================================================
--- src/shell.c.in
+++ src/shell.c.in
@@ -1240,11 +1240,11 @@
   double r = sqlite3_value_double(apVal[0]);
   int n = nVal>=2 ? sqlite3_value_int(apVal[1]) : 26;
   char z[400];
   if( n<1 ) n = 1;
   if( n>350 ) n = 350;
-  sprintf(z, "%#+.*e", n, r);
+  snprintf(z, sizeof(z)-1, "%#+.*e", n, r);
   sqlite3_result_text(pCtx, z, -1, SQLITE_TRANSIENT);
 }
 
 
 /*

Index: src/sqliteInt.h
==================================================================
--- src/sqliteInt.h
+++ src/sqliteInt.h
@@ -3360,10 +3360,11 @@
   } uNC;
   NameContext *pNext;  /* Next outer name context.  NULL for outermost */
   int nRef;            /* Number of names resolved by this context */
   int nNcErr;          /* Number of errors encountered while resolving names */
   int ncFlags;         /* Zero or more NC_* flags defined below */
+  int nNestedSelect;   /* Number of nested selects using this NC */
   Select *pWinSelect;  /* SELECT statement for any window functions */
 };
 
 /*
 ** Allowed values for the NameContext, ncFlags field.

Index: src/util.c
==================================================================
--- src/util.c
+++ src/util.c
@@ -1023,33 +1023,33 @@
     **   SELECT decimal_exp(decimal_sub('1.0e+100',decimal(1.0e+100)));
     */
     double rr[2];
     rr[0] = r;
     rr[1] = 0.0;
-    if( rr[0]>1.84e+19 ){
-      while( rr[0]>1.84e+119 ){
+    if( rr[0]>9.223372036854774784e+18 ){
+      while( rr[0]>9.223372036854774784e+118 ){
         exp += 100;
         dekkerMul2(rr, 1.0e-100, -1.99918998026028836196e-117);
       }
-      while( rr[0]>1.84e+29 ){
+      while( rr[0]>9.223372036854774784e+28 ){
         exp += 10;
         dekkerMul2(rr, 1.0e-10, -3.6432197315497741579e-27);
       }
-      while( rr[0]>1.84e+19 ){
+      while( rr[0]>9.223372036854774784e+18 ){
         exp += 1;
         dekkerMul2(rr, 1.0e-01, -5.5511151231257827021e-18);
       }
     }else{
-      while( rr[0]<1.84e-82  ){
+      while( rr[0]<9.223372036854774784e-83  ){
         exp -= 100;
         dekkerMul2(rr, 1.0e+100, -1.5902891109759918046e+83);
       }
-      while( rr[0]<1.84e+08  ){
+      while( rr[0]<9.223372036854774784e+07  ){
         exp -= 10;
         dekkerMul2(rr, 1.0e+10, 0.0);
       }
-      while( rr[0]<1.84e+18  ){
+      while( rr[0]<9.22337203685477478e+17  ){
         exp -= 1;
         dekkerMul2(rr, 1.0e+01, 0.0);
       }
     }
     v = rr[1]<0.0 ? (u64)rr[0]-(u64)(-rr[1]) : (u64)rr[0]+(u64)rr[1];

Index: src/vdbeblob.c
==================================================================
--- src/vdbeblob.c
+++ src/vdbeblob.c
@@ -57,12 +57,11 @@
   Vdbe *v = (Vdbe *)p->pStmt;
 
   /* Set the value of register r[1] in the SQL statement to integer iRow. 
   ** This is done directly as a performance optimization
   */
-  v->aMem[1].flags = MEM_Int;
-  v->aMem[1].u.i = iRow;
+  sqlite3VdbeMemSetInt64(&v->aMem[1], iRow);
 
   /* If the statement has been run before (and is paused at the OP_ResultRow)
   ** then back it up to the point where it does the OP_NotExists.  This could
   ** have been down with an extra OP_Goto, but simply setting the program
   ** counter is faster. */

Index: src/vdbesort.c
==================================================================
--- src/vdbesort.c
+++ src/vdbesort.c
@@ -184,11 +184,11 @@
 ** are connected using SorterRecord.u.iNext.
 */
 struct SorterList {
   SorterRecord *pList;            /* Linked list of records */
   u8 *aMemory;                    /* If non-NULL, bulk memory to hold pList */
-  int szPMA;                      /* Size of pList as PMA in bytes */
+  i64 szPMA;                      /* Size of pList as PMA in bytes */
 };
 
 /*
 ** The MergeEngine object is used to combine two or more smaller PMAs into
 ** one big PMA using a merge operation.  Separate PMAs all need to be
@@ -293,14 +293,14 @@
 */
 typedef int (*SorterCompare)(SortSubtask*,int*,const void*,int,const void*,int);
 struct SortSubtask {
   SQLiteThread *pThread;          /* Background thread, if any */
   int bDone;                      /* Set if thread is finished but not joined */
+  int nPMA;                       /* Number of PMAs currently in file */
   VdbeSorter *pSorter;            /* Sorter that owns this sub-task */
   UnpackedRecord *pUnpacked;      /* Space to unpack a record */
   SorterList list;                /* List for thread to write to a PMA */
-  int nPMA;                       /* Number of PMAs currently in file */
   SorterCompare xCompare;         /* Compare function to use */
   SorterFile file;                /* Temp file for level-0 PMAs */
   SorterFile file2;               /* Space for other PMAs */
 };
 
@@ -1770,12 +1770,12 @@
 ){
   VdbeSorter *pSorter;
   int rc = SQLITE_OK;             /* Return Code */
   SorterRecord *pNew;             /* New list element */
   int bFlush;                     /* True to flush contents of memory to PMA */
-  int nReq;                       /* Bytes of memory required */
-  int nPMA;                       /* Bytes of PMA space required */
+  i64 nReq;                       /* Bytes of memory required */
+  i64 nPMA;                       /* Bytes of PMA space required */
   int t;                          /* serial type of first record field */
 
   assert( pCsr->eCurType==CURTYPE_SORTER );
   pSorter = pCsr->uc.pSorter;
   getVarint32NR((const u8*)&pVal->z[1], t);

Index: test/aggnested.test
==================================================================
--- test/aggnested.test
+++ test/aggnested.test
@@ -355,10 +355,64 @@
   SELECT ( 
     SELECT c FROM (SELECT t2.b AS c FROM t1) GROUP BY c HAVING t2.b
   )
   FROM t2 GROUP BY 'constant_string';
 } {{}}
+
+#-------------------------------------------------------------------------
+reset_db
+
+do_execsql_test 7.0 {
+  CREATE TABLE invoice (
+      id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,
+      amount DOUBLE PRECISION DEFAULT NULL,
+      name VARCHAR(100) DEFAULT NULL
+  );
+
+  INSERT INTO invoice (amount, name) VALUES 
+      (4.0, 'Michael'), (15.0, 'Bara'), (4.0, 'Michael'), (6.0, 'John');
+}
+
+do_execsql_test 7.1 {
+  SELECT sum(amount), name
+    from invoice
+  group by name
+  having (select v > 6 from (select sum(amount) v) t)
+} {
+  15.0 Bara
+  8.0 Michael
+}
+
+do_execsql_test 7.2 {
+  SELECT (select 1 from (select sum(amount))) FROM invoice
+} {1}
+
+do_execsql_test 8.0 {
+  CREATE TABLE t1(x INT);
+  INSERT INTO t1 VALUES(100);
+  INSERT INTO t1 VALUES(20);
+  INSERT INTO t1 VALUES(3);
+  SELECT (SELECT y FROM (SELECT sum(x) AS y) AS t2 ) FROM t1;
+} {123}
+
+do_execsql_test 8.1 {
+  SELECT (
+    SELECT y FROM (
+      SELECT z AS y FROM (SELECT sum(x) AS z) AS t2 
+    ) 
+  ) FROM t1;
+} {123}
+
+do_execsql_test 8.2 {
+  SELECT (
+    SELECT a FROM (
+      SELECT y AS a FROM (
+        SELECT z AS y FROM (SELECT sum(x) AS z) AS t2 
+      ) 
+    )
+  ) FROM t1;
+} {123}
 
 
 
  
 

Index: test/func.test
==================================================================
--- test/func.test
+++ test/func.test
@@ -1542,7 +1542,15 @@
 } {1 {integer overflow}}
 do_catchsql_test func-37.120 {
   WITH c(x) AS (VALUES(9223372036854775807),(10000),(-10010))
   SELECT sum(x) FROM c;
 } {1 {integer overflow}}
+
+# 2023-08-28 forum post https://sqlite.org/forum/forumpost/1c06ddcacc86032a
+# Incorrect handling of infinity by SUM().
+#
+do_execsql_test func-38.100 {
+  WITH t1(x) AS (VALUES(9e+999)) SELECT sum(x), avg(x), total(x) FROM t1;
+  WITH t1(x) AS (VALUES(-9e+999)) SELECT sum(x), avg(x), total(x) FROM t1;
+} {Inf Inf Inf -Inf -Inf -Inf}
 
 finish_test

Index: test/json101.test
==================================================================
--- test/json101.test
+++ test/json101.test
@@ -117,10 +117,13 @@
   SELECT x FROM j1 WHERE json_set(x)<>x;
 } {}
 do_execsql_test json101-4.8 {
   SELECT x FROM j1 WHERE json_insert(x)<>x;
 } {}
+do_execsql_test json101-4.9 {
+  SELECT json_insert('{"a":1}','$.b',CAST(x'0000' AS text));
+} {{{"a":1,"b":"\u0000\u0000"}}}
 
 # json_extract(JSON,'$') will return objects and arrays without change.
 #
 do_execsql_test json101-4.10 {
   SELECT count(*) FROM j1 WHERE json_type(x) IN ('object','array');
@@ -1011,10 +1014,46 @@
 do_execsql_test json101-21.27 {
   WITH c(x,y) AS (VALUES('a',1),('b',2.0),('c',NULL),(NULL,'three'),('e','four'))
   SELECT json_group_object(x,y) FROM c;
 } {{{"a":1,"b":2.0,"c":null,:"three","e":"four"}}}
 
+# 2023-10-09 https://sqlite.org/forum/forumpost/b25edc1d46
+# UAF due to JSON cache overflow
+#
+do_execsql_test json101-22.1 {
+  SELECT json_set(
+    '{}',
+    '$.a', json('1'),
+    '$.a', json('2'),
+    '$.b', json('3'),
+    '$.b', json('4'),
+    '$.c', json('5'),
+    '$.c', json('6')
+  );
+} {{{"a":2,"b":4,"c":6}}}
+do_execsql_test json101-22.2 {
+  SELECT json_replace(
+    '{"a":7,"b":8,"c":9}',
+    '$.a', json('1'),
+    '$.a', json('2'),
+    '$.b', json('3'),
+    '$.b', json('4'),
+    '$.c', json('5'),
+    '$.c', json('6')
+  );
+} {{{"a":2,"b":4,"c":6}}}
 
+# 2023-10-17 https://sqlite.org/forum/forumpost/fc0e3f1e2a
+# Incorrect accesss to '$[0]' in parsed + edited JSON.
+#
+do_execsql_test json101-23.1 {
+  SELECT j, j->>0, j->>1
+    FROM (SELECT json_set(json_set('[]','$[#]',0), '$[#]',1) AS j);
+} {{[0,1]} 0 1}
+do_execsql_test json101-23.2 {
+  SELECT j, j->>0, j->>1
+    FROM (SELECT json_set('[]','$[#]',0,'$[#]',1) AS j);
+} {{[0,1]} 0 1}
 
 
 
 finish_test

Index: test/json102.test
==================================================================
--- test/json102.test
+++ test/json102.test
@@ -46,10 +46,13 @@
   SELECT json_array(1,null,'3',json('[4,5]'),json('{"six":7.7}'));
 } {{[1,null,"3",[4,5],{"six":7.7}]}}
 do_execsql_test json102-190 {
   SELECT json_array_length('[1,2,3,4]');
 } {{4}}
+do_execsql_test json102-191 {
+  SELECT json_array_length( json_remove('[1,2,3,4]','$[2]') );
+} {{3}}
 do_execsql_test json102-200 {
   SELECT json_array_length('[1,2,3,4]', '$');
 } {{4}}
 do_execsql_test json102-210 {
   SELECT json_array_length('[1,2,3,4]', '$[2]');

Index: test/selectH.test
==================================================================
--- test/selectH.test
+++ test/selectH.test
@@ -111,8 +111,35 @@
 do_execsql_test 4.1 {
   DROP TABLE IF EXISTS t1;
   CREATE TABLE t1(a INTEGER PRIMARY KEY, b TEXT);
   SELECT 1 FROM (SELECT DISTINCT name COLLATE rtrim FROM sqlite_schema
                  UNION ALL SELECT a FROM t1);
-} 1
+} {1 1}
+
+do_execsql_test 4.2 {
+  SELECT DISTINCT name COLLATE rtrim FROM sqlite_schema 
+    UNION ALL 
+  SELECT a FROM t1
+} {v1 t1}
+
+#-------------------------------------------------------------------------
+# forum post https://sqlite.org/forum/forumpost/b83c7b2168
+#
+reset_db
+do_execsql_test 5.0 {
+  CREATE TABLE t1 (val1);
+  INSERT INTO t1 VALUES(4);
+  INSERT INTO t1 VALUES(5);
+  CREATE TABLE t2 (val2);
+}
+do_execsql_test 5.1 {
+  SELECT DISTINCT val1 FROM t1 UNION ALL SELECT val2 FROM t2;
+} {
+  4 5
+}
+do_execsql_test 5.2 {
+  SELECT count(1234) FROM (
+    SELECT DISTINCT val1 FROM t1 UNION ALL SELECT val2 FROM t2
+  )
+} {2}
 
 finish_test

Index: test/testrunner_data.tcl
==================================================================
--- test/testrunner_data.tcl
+++ test/testrunner_data.tcl
@@ -96,11 +96,14 @@
     --enable-debug --enable-all
   }
   set build(All-O0) {
     -O0 --enable-all
   }
-  set build(All-Sanitize) { --enable-all -fsanitize=address,undefined }
+  set build(All-Sanitize) { 
+    -DSQLITE_OMIT_LOOKASIDE=1
+    --enable-all -fsanitize=address,undefined 
+  }
 
   set build(Sanitize) {
     CC=clang -fsanitize=address,undefined
     -DSQLITE_ENABLE_STAT4
     -DCONFIG_SLOWDOWN_FACTOR=5.0

Index: test/window1.test
==================================================================
--- test/window1.test
+++ test/window1.test
@@ -1879,11 +1879,11 @@
   INSERT INTO t3(y) VALUES(5),(11),(-9);
   SELECT (
     SELECT max(y) OVER( ORDER BY (SELECT x FROM (SELECT sum(y) AS x FROM t1)))
   )
   FROM t3;
-} {1 {misuse of aggregate: sum()}}
+} {0 5}
 
 # 2020-06-06 ticket 1f6f353b684fc708
 reset_db
 do_execsql_test 58.1 {
   CREATE TABLE a(a, b, c);

Index: tool/mkautoconfamal.sh
==================================================================
--- tool/mkautoconfamal.sh
+++ tool/mkautoconfamal.sh
@@ -22,10 +22,18 @@
 
 TMPSPACE=./mkpkg_tmp_dir
 VERSION=`cat $TOP/VERSION`
 HASH=`sed 's/^\(..........\).*/\1/' $TOP/manifest.uuid`
 DATETIME=`grep '^D' $TOP/manifest | sed -e 's/[^0-9]//g' -e 's/\(............\).*/\1/'`
+
+# Verify that the version number in the TEA autoconf file is correct.
+# Fail with an error if not.
+#
+if grep $VERSION $TOP/autoconf/tea/configure.ac
+then echo "TEA version number ok"
+else echo "TEA version number mismatch.  Should be $VERSION"; exit 1
+fi
 
 # If this script is given an argument of --snapshot, then generate a
 # snapshot tarball named for the current checkout SHA1 hash, rather than
 # the version number.
 #

ADDED   tool/srctree-check.tcl
Index: tool/srctree-check.tcl
==================================================================
--- /dev/null
+++ tool/srctree-check.tcl
@@ -0,0 +1,79 @@
+#!/usr/bin/tclsh
+#
+# Run this script from the top of the source tree in order to confirm that
+# various aspects of the source tree are up-to-date.  Items checked include:
+#
+#     *    Makefile.msc and autoconf/Makefile.msc agree
+#     *    src/ctime.tcl is consistent with tool/mkctimec.tcl
+#     *    VERSION agrees with autoconf/tea/configure.ac
+#     *    src/pragma.h agrees with tool/mkpragmatab.tcl
+#
+# Other tests might be added later.  
+#
+# Error messages are printed and the process exists non-zero if problems
+# are found.  If everything is ok, no output is generated and the process
+# exits with 0.
+#
+
+# Read an entire file.
+#
+proc readfile {filename} {
+  set fd [open $filename rb]
+  set txt [read $fd]
+  close $fd
+  return $txt
+}
+
+# Find the root of the tree.
+#
+set ROOT [file dir [file dir [file normalize $argv0]]]
+cd $ROOT
+
+# Name of the TCL interpreter
+#
+set TCLSH [info nameofexe]
+
+######################### autoconf/tea/configure.ac ###########################
+
+set confac [readfile $ROOT/autoconf/tea/configure.ac]
+set vers [readfile $ROOT/VERSION]
+set pattern {AC_INIT([sqlite],[}
+append pattern [string trim $vers]
+append pattern {])}
+if {[string first $pattern $confac]<=0} {
+  puts "ERROR: ./autoconf/tea/configure.ac does not agree with ./VERSION"
+  exit 1
+}
+
+######################### autoconf/Makefile.msc ###############################
+
+set f1 [readfile $ROOT/autoconf/Makefile.msc]
+exec mv $ROOT/autoconf/Makefile.msc $ROOT/autoconf/Makefile.msc.tmp
+exec $TCLSH $ROOT/tool/mkmsvcmin.tcl
+set f2 [readfile $ROOT/autoconf/Makefile.msc]
+exec mv $ROOT/autoconf/Makefile.msc.tmp $ROOT/autoconf/Makefile.msc
+if {$f1 != $f2} {
+  puts "ERROR: ./autoconf/Makefile.msc does not agree with ./Makefile.msc"
+}
+
+######################### src/pragma.h ########################################
+
+set f1 [readfile $ROOT/src/pragma.h]
+exec mv $ROOT/src/pragma.h $ROOT/src/pragma.h.tmp
+exec $TCLSH $ROOT/tool/mkpragmatab.tcl
+set f2 [readfile $ROOT/src/pragma.h]
+exec mv $ROOT/src/pragma.h.tmp $ROOT/src/pragma.h
+if {$f1 != $f2} {
+  puts "ERROR: ./src/pragma.h does not agree with ./tool/mkpragmatab.tcl"
+}
+
+######################### src/ctime.c ########################################
+
+set f1 [readfile $ROOT/src/ctime.c]
+exec mv $ROOT/src/ctime.c $ROOT/src/ctime.c.tmp
+exec $TCLSH $ROOT/tool/mkctimec.tcl
+set f2 [readfile $ROOT/src/ctime.c]
+exec mv $ROOT/src/ctime.c.tmp $ROOT/src/ctime.c
+if {$f1 != $f2} {
+  puts "ERROR: ./src/ctime.c does not agree with ./tool/mkctimec.tcl"
+}