000001  /*
000002  ** 2001 September 15
000003  **
000004  ** The author disclaims copyright to this source code.  In place of
000005  ** a legal notice, here is a blessing:
000006  **
000007  **    May you do good and not evil.
000008  **    May you find forgiveness for yourself and forgive others.
000009  **    May you share freely, never taking more than you give.
000010  **
000011  *************************************************************************
000012  ** This file contains routines used for analyzing expressions and
000013  ** for generating VDBE code that evaluates expressions in SQLite.
000014  */
000015  #include "sqliteInt.h"
000016  
000017  /* Forward declarations */
000018  static void exprCodeBetween(Parse*,Expr*,int,void(*)(Parse*,Expr*,int,int),int);
000019  static int exprCodeVector(Parse *pParse, Expr *p, int *piToFree);
000020  
000021  /*
000022  ** Return the affinity character for a single column of a table.
000023  */
000024  char sqlite3TableColumnAffinity(const Table *pTab, int iCol){
000025    if( iCol<0 || NEVER(iCol>=pTab->nCol) ) return SQLITE_AFF_INTEGER;
000026    return pTab->aCol[iCol].affinity;
000027  }
000028  
000029  /*
000030  ** Return the 'affinity' of the expression pExpr if any.
000031  **
000032  ** If pExpr is a column, a reference to a column via an 'AS' alias,
000033  ** or a sub-select with a column as the return value, then the
000034  ** affinity of that column is returned. Otherwise, 0x00 is returned,
000035  ** indicating no affinity for the expression.
000036  **
000037  ** i.e. the WHERE clause expressions in the following statements all
000038  ** have an affinity:
000039  **
000040  ** CREATE TABLE t1(a);
000041  ** SELECT * FROM t1 WHERE a;
000042  ** SELECT a AS b FROM t1 WHERE b;
000043  ** SELECT * FROM t1 WHERE (select a from t1);
000044  */
000045  char sqlite3ExprAffinity(const Expr *pExpr){
000046    int op;
000047    op = pExpr->op;
000048    while( 1 /* exit-by-break */ ){
000049      if( op==TK_COLUMN || (op==TK_AGG_COLUMN && pExpr->y.pTab!=0) ){
000050        assert( ExprUseYTab(pExpr) );
000051        assert( pExpr->y.pTab!=0 );
000052        return sqlite3TableColumnAffinity(pExpr->y.pTab, pExpr->iColumn);
000053      }
000054      if( op==TK_SELECT ){
000055        assert( ExprUseXSelect(pExpr) );
000056        assert( pExpr->x.pSelect!=0 );
000057        assert( pExpr->x.pSelect->pEList!=0 );
000058        assert( pExpr->x.pSelect->pEList->a[0].pExpr!=0 );
000059        return sqlite3ExprAffinity(pExpr->x.pSelect->pEList->a[0].pExpr);
000060      }
000061  #ifndef SQLITE_OMIT_CAST
000062      if( op==TK_CAST ){
000063        assert( !ExprHasProperty(pExpr, EP_IntValue) );
000064        return sqlite3AffinityType(pExpr->u.zToken, 0);
000065      }
000066  #endif
000067      if( op==TK_SELECT_COLUMN ){
000068        assert( pExpr->pLeft!=0 && ExprUseXSelect(pExpr->pLeft) );
000069        assert( pExpr->iColumn < pExpr->iTable );
000070        assert( pExpr->iColumn >= 0 );
000071        assert( pExpr->iTable==pExpr->pLeft->x.pSelect->pEList->nExpr );
000072        return sqlite3ExprAffinity(
000073            pExpr->pLeft->x.pSelect->pEList->a[pExpr->iColumn].pExpr
000074        );
000075      }
000076      if( op==TK_VECTOR ){
000077        assert( ExprUseXList(pExpr) );
000078        return sqlite3ExprAffinity(pExpr->x.pList->a[0].pExpr);
000079      }
000080      if( ExprHasProperty(pExpr, EP_Skip|EP_IfNullRow) ){
000081        assert( pExpr->op==TK_COLLATE
000082             || pExpr->op==TK_IF_NULL_ROW
000083             || (pExpr->op==TK_REGISTER && pExpr->op2==TK_IF_NULL_ROW) );
000084        pExpr = pExpr->pLeft;
000085        op = pExpr->op;
000086        continue;
000087      }
000088      if( op!=TK_REGISTER || (op = pExpr->op2)==TK_REGISTER ) break;
000089    }
000090    return pExpr->affExpr;
000091  }
000092  
000093  /*
000094  ** Make a guess at all the possible datatypes of the result that could
000095  ** be returned by an expression.  Return a bitmask indicating the answer:
000096  **
000097  **     0x01         Numeric
000098  **     0x02         Text
000099  **     0x04         Blob
000100  **
000101  ** If the expression must return NULL, then 0x00 is returned.
000102  */
000103  int sqlite3ExprDataType(const Expr *pExpr){
000104    while( pExpr ){
000105      switch( pExpr->op ){
000106        case TK_COLLATE:
000107        case TK_IF_NULL_ROW:
000108        case TK_UPLUS:  {
000109          pExpr = pExpr->pLeft;
000110          break;
000111        }
000112        case TK_NULL: {
000113          pExpr = 0;
000114          break;
000115        }
000116        case TK_STRING: {
000117          return 0x02;
000118        }
000119        case TK_BLOB: {
000120          return 0x04;
000121        }
000122        case TK_CONCAT: {
000123          return 0x06;
000124        }
000125        case TK_VARIABLE:
000126        case TK_AGG_FUNCTION:
000127        case TK_FUNCTION: {
000128          return 0x07;
000129        }
000130        case TK_COLUMN:
000131        case TK_AGG_COLUMN:
000132        case TK_SELECT:
000133        case TK_CAST:
000134        case TK_SELECT_COLUMN:
000135        case TK_VECTOR:  {
000136          int aff = sqlite3ExprAffinity(pExpr);
000137          if( aff>=SQLITE_AFF_NUMERIC ) return 0x05;
000138          if( aff==SQLITE_AFF_TEXT )    return 0x06;
000139          return 0x07;
000140        }
000141        case TK_CASE: {
000142          int res = 0;
000143          int ii;
000144          ExprList *pList = pExpr->x.pList;
000145          assert( ExprUseXList(pExpr) && pList!=0 );
000146          assert( pList->nExpr > 0);
000147          for(ii=1; ii<pList->nExpr; ii+=2){
000148            res |= sqlite3ExprDataType(pList->a[ii].pExpr);
000149          }
000150          if( pList->nExpr % 2 ){
000151            res |= sqlite3ExprDataType(pList->a[pList->nExpr-1].pExpr);
000152          }
000153          return res;
000154        }
000155        default: {
000156          return 0x01;
000157        }
000158      } /* End of switch(op) */
000159    } /* End of while(pExpr) */
000160    return 0x00;
000161  }
000162  
000163  /*
000164  ** Set the collating sequence for expression pExpr to be the collating
000165  ** sequence named by pToken.   Return a pointer to a new Expr node that
000166  ** implements the COLLATE operator.
000167  **
000168  ** If a memory allocation error occurs, that fact is recorded in pParse->db
000169  ** and the pExpr parameter is returned unchanged.
000170  */
000171  Expr *sqlite3ExprAddCollateToken(
000172    const Parse *pParse,     /* Parsing context */
000173    Expr *pExpr,             /* Add the "COLLATE" clause to this expression */
000174    const Token *pCollName,  /* Name of collating sequence */
000175    int dequote              /* True to dequote pCollName */
000176  ){
000177    if( pCollName->n>0 ){
000178      Expr *pNew = sqlite3ExprAlloc(pParse->db, TK_COLLATE, pCollName, dequote);
000179      if( pNew ){
000180        pNew->pLeft = pExpr;
000181        pNew->flags |= EP_Collate|EP_Skip;
000182        pExpr = pNew;
000183      }
000184    }
000185    return pExpr;
000186  }
000187  Expr *sqlite3ExprAddCollateString(
000188    const Parse *pParse,  /* Parsing context */
000189    Expr *pExpr,          /* Add the "COLLATE" clause to this expression */
000190    const char *zC        /* The collating sequence name */
000191  ){
000192    Token s;
000193    assert( zC!=0 );
000194    sqlite3TokenInit(&s, (char*)zC);
000195    return sqlite3ExprAddCollateToken(pParse, pExpr, &s, 0);
000196  }
000197  
000198  /*
000199  ** Skip over any TK_COLLATE operators.
000200  */
000201  Expr *sqlite3ExprSkipCollate(Expr *pExpr){
000202    while( pExpr && ExprHasProperty(pExpr, EP_Skip) ){
000203      assert( pExpr->op==TK_COLLATE );
000204      pExpr = pExpr->pLeft;
000205    }  
000206    return pExpr;
000207  }
000208  
000209  /*
000210  ** Skip over any TK_COLLATE operators and/or any unlikely()
000211  ** or likelihood() or likely() functions at the root of an
000212  ** expression.
000213  */
000214  Expr *sqlite3ExprSkipCollateAndLikely(Expr *pExpr){
000215    while( pExpr && ExprHasProperty(pExpr, EP_Skip|EP_Unlikely) ){
000216      if( ExprHasProperty(pExpr, EP_Unlikely) ){
000217        assert( ExprUseXList(pExpr) );
000218        assert( pExpr->x.pList->nExpr>0 );
000219        assert( pExpr->op==TK_FUNCTION );
000220        pExpr = pExpr->x.pList->a[0].pExpr;
000221      }else if( pExpr->op==TK_COLLATE ){
000222        pExpr = pExpr->pLeft;
000223      }else{
000224        break;
000225      }
000226    }  
000227    return pExpr;
000228  }
000229  
000230  /*
000231  ** Return the collation sequence for the expression pExpr. If
000232  ** there is no defined collating sequence, return NULL.
000233  **
000234  ** See also: sqlite3ExprNNCollSeq()
000235  **
000236  ** The sqlite3ExprNNCollSeq() works the same exact that it returns the
000237  ** default collation if pExpr has no defined collation.
000238  **
000239  ** The collating sequence might be determined by a COLLATE operator
000240  ** or by the presence of a column with a defined collating sequence.
000241  ** COLLATE operators take first precedence.  Left operands take
000242  ** precedence over right operands.
000243  */
000244  CollSeq *sqlite3ExprCollSeq(Parse *pParse, const Expr *pExpr){
000245    sqlite3 *db = pParse->db;
000246    CollSeq *pColl = 0;
000247    const Expr *p = pExpr;
000248    while( p ){
000249      int op = p->op;
000250      if( op==TK_REGISTER ) op = p->op2;
000251      if( (op==TK_AGG_COLUMN && p->y.pTab!=0)
000252       || op==TK_COLUMN || op==TK_TRIGGER
000253      ){
000254        int j;
000255        assert( ExprUseYTab(p) );
000256        assert( p->y.pTab!=0 );
000257        if( (j = p->iColumn)>=0 ){
000258          const char *zColl = sqlite3ColumnColl(&p->y.pTab->aCol[j]);
000259          pColl = sqlite3FindCollSeq(db, ENC(db), zColl, 0);
000260        }
000261        break;
000262      }
000263      if( op==TK_CAST || op==TK_UPLUS ){
000264        p = p->pLeft;
000265        continue;
000266      }
000267      if( op==TK_VECTOR ){
000268        assert( ExprUseXList(p) );
000269        p = p->x.pList->a[0].pExpr;
000270        continue;
000271      }
000272      if( op==TK_COLLATE ){
000273        assert( !ExprHasProperty(p, EP_IntValue) );
000274        pColl = sqlite3GetCollSeq(pParse, ENC(db), 0, p->u.zToken);
000275        break;
000276      }
000277      if( p->flags & EP_Collate ){
000278        if( p->pLeft && (p->pLeft->flags & EP_Collate)!=0 ){
000279          p = p->pLeft;
000280        }else{
000281          Expr *pNext  = p->pRight;
000282          /* The Expr.x union is never used at the same time as Expr.pRight */
000283          assert( !ExprUseXList(p) || p->x.pList==0 || p->pRight==0 );
000284          if( ExprUseXList(p) && p->x.pList!=0 && !db->mallocFailed ){
000285            int i;
000286            for(i=0; i<p->x.pList->nExpr; i++){
000287              if( ExprHasProperty(p->x.pList->a[i].pExpr, EP_Collate) ){
000288                pNext = p->x.pList->a[i].pExpr;
000289                break;
000290              }
000291            }
000292          }
000293          p = pNext;
000294        }
000295      }else{
000296        break;
000297      }
000298    }
000299    if( sqlite3CheckCollSeq(pParse, pColl) ){
000300      pColl = 0;
000301    }
000302    return pColl;
000303  }
000304  
000305  /*
000306  ** Return the collation sequence for the expression pExpr. If
000307  ** there is no defined collating sequence, return a pointer to the
000308  ** default collation sequence.
000309  **
000310  ** See also: sqlite3ExprCollSeq()
000311  **
000312  ** The sqlite3ExprCollSeq() routine works the same except that it
000313  ** returns NULL if there is no defined collation.
000314  */
000315  CollSeq *sqlite3ExprNNCollSeq(Parse *pParse, const Expr *pExpr){
000316    CollSeq *p = sqlite3ExprCollSeq(pParse, pExpr);
000317    if( p==0 ) p = pParse->db->pDfltColl;
000318    assert( p!=0 );
000319    return p;
000320  }
000321  
000322  /*
000323  ** Return TRUE if the two expressions have equivalent collating sequences.
000324  */
000325  int sqlite3ExprCollSeqMatch(Parse *pParse, const Expr *pE1, const Expr *pE2){
000326    CollSeq *pColl1 = sqlite3ExprNNCollSeq(pParse, pE1);
000327    CollSeq *pColl2 = sqlite3ExprNNCollSeq(pParse, pE2);
000328    return sqlite3StrICmp(pColl1->zName, pColl2->zName)==0;
000329  }
000330  
000331  /*
000332  ** pExpr is an operand of a comparison operator.  aff2 is the
000333  ** type affinity of the other operand.  This routine returns the
000334  ** type affinity that should be used for the comparison operator.
000335  */
000336  char sqlite3CompareAffinity(const Expr *pExpr, char aff2){
000337    char aff1 = sqlite3ExprAffinity(pExpr);
000338    if( aff1>SQLITE_AFF_NONE && aff2>SQLITE_AFF_NONE ){
000339      /* Both sides of the comparison are columns. If one has numeric
000340      ** affinity, use that. Otherwise use no affinity.
000341      */
000342      if( sqlite3IsNumericAffinity(aff1) || sqlite3IsNumericAffinity(aff2) ){
000343        return SQLITE_AFF_NUMERIC;
000344      }else{
000345        return SQLITE_AFF_BLOB;
000346      }
000347    }else{
000348      /* One side is a column, the other is not. Use the columns affinity. */
000349      assert( aff1<=SQLITE_AFF_NONE || aff2<=SQLITE_AFF_NONE );
000350      return (aff1<=SQLITE_AFF_NONE ? aff2 : aff1) | SQLITE_AFF_NONE;
000351    }
000352  }
000353  
000354  /*
000355  ** pExpr is a comparison operator.  Return the type affinity that should
000356  ** be applied to both operands prior to doing the comparison.
000357  */
000358  static char comparisonAffinity(const Expr *pExpr){
000359    char aff;
000360    assert( pExpr->op==TK_EQ || pExpr->op==TK_IN || pExpr->op==TK_LT ||
000361            pExpr->op==TK_GT || pExpr->op==TK_GE || pExpr->op==TK_LE ||
000362            pExpr->op==TK_NE || pExpr->op==TK_IS || pExpr->op==TK_ISNOT );
000363    assert( pExpr->pLeft );
000364    aff = sqlite3ExprAffinity(pExpr->pLeft);
000365    if( pExpr->pRight ){
000366      aff = sqlite3CompareAffinity(pExpr->pRight, aff);
000367    }else if( ExprUseXSelect(pExpr) ){
000368      aff = sqlite3CompareAffinity(pExpr->x.pSelect->pEList->a[0].pExpr, aff);
000369    }else if( aff==0 ){
000370      aff = SQLITE_AFF_BLOB;
000371    }
000372    return aff;
000373  }
000374  
000375  /*
000376  ** pExpr is a comparison expression, eg. '=', '<', IN(...) etc.
000377  ** idx_affinity is the affinity of an indexed column. Return true
000378  ** if the index with affinity idx_affinity may be used to implement
000379  ** the comparison in pExpr.
000380  */
000381  int sqlite3IndexAffinityOk(const Expr *pExpr, char idx_affinity){
000382    char aff = comparisonAffinity(pExpr);
000383    if( aff<SQLITE_AFF_TEXT ){
000384      return 1;
000385    }
000386    if( aff==SQLITE_AFF_TEXT ){
000387      return idx_affinity==SQLITE_AFF_TEXT;
000388    }
000389    return sqlite3IsNumericAffinity(idx_affinity);
000390  }
000391  
000392  /*
000393  ** Return the P5 value that should be used for a binary comparison
000394  ** opcode (OP_Eq, OP_Ge etc.) used to compare pExpr1 and pExpr2.
000395  */
000396  static u8 binaryCompareP5(
000397    const Expr *pExpr1,   /* Left operand */
000398    const Expr *pExpr2,   /* Right operand */
000399    int jumpIfNull        /* Extra flags added to P5 */
000400  ){
000401    u8 aff = (char)sqlite3ExprAffinity(pExpr2);
000402    aff = (u8)sqlite3CompareAffinity(pExpr1, aff) | (u8)jumpIfNull;
000403    return aff;
000404  }
000405  
000406  /*
000407  ** Return a pointer to the collation sequence that should be used by
000408  ** a binary comparison operator comparing pLeft and pRight.
000409  **
000410  ** If the left hand expression has a collating sequence type, then it is
000411  ** used. Otherwise the collation sequence for the right hand expression
000412  ** is used, or the default (BINARY) if neither expression has a collating
000413  ** type.
000414  **
000415  ** Argument pRight (but not pLeft) may be a null pointer. In this case,
000416  ** it is not considered.
000417  */
000418  CollSeq *sqlite3BinaryCompareCollSeq(
000419    Parse *pParse,
000420    const Expr *pLeft,
000421    const Expr *pRight
000422  ){
000423    CollSeq *pColl;
000424    assert( pLeft );
000425    if( pLeft->flags & EP_Collate ){
000426      pColl = sqlite3ExprCollSeq(pParse, pLeft);
000427    }else if( pRight && (pRight->flags & EP_Collate)!=0 ){
000428      pColl = sqlite3ExprCollSeq(pParse, pRight);
000429    }else{
000430      pColl = sqlite3ExprCollSeq(pParse, pLeft);
000431      if( !pColl ){
000432        pColl = sqlite3ExprCollSeq(pParse, pRight);
000433      }
000434    }
000435    return pColl;
000436  }
000437  
000438  /* Expression p is a comparison operator.  Return a collation sequence
000439  ** appropriate for the comparison operator.
000440  **
000441  ** This is normally just a wrapper around sqlite3BinaryCompareCollSeq().
000442  ** However, if the OP_Commuted flag is set, then the order of the operands
000443  ** is reversed in the sqlite3BinaryCompareCollSeq() call so that the
000444  ** correct collating sequence is found.
000445  */
000446  CollSeq *sqlite3ExprCompareCollSeq(Parse *pParse, const Expr *p){
000447    if( ExprHasProperty(p, EP_Commuted) ){
000448      return sqlite3BinaryCompareCollSeq(pParse, p->pRight, p->pLeft);
000449    }else{
000450      return sqlite3BinaryCompareCollSeq(pParse, p->pLeft, p->pRight);
000451    }
000452  }
000453  
000454  /*
000455  ** Generate code for a comparison operator.
000456  */
000457  static int codeCompare(
000458    Parse *pParse,    /* The parsing (and code generating) context */
000459    Expr *pLeft,      /* The left operand */
000460    Expr *pRight,     /* The right operand */
000461    int opcode,       /* The comparison opcode */
000462    int in1, int in2, /* Register holding operands */
000463    int dest,         /* Jump here if true.  */
000464    int jumpIfNull,   /* If true, jump if either operand is NULL */
000465    int isCommuted    /* The comparison has been commuted */
000466  ){
000467    int p5;
000468    int addr;
000469    CollSeq *p4;
000470  
000471    if( pParse->nErr ) return 0;
000472    if( isCommuted ){
000473      p4 = sqlite3BinaryCompareCollSeq(pParse, pRight, pLeft);
000474    }else{
000475      p4 = sqlite3BinaryCompareCollSeq(pParse, pLeft, pRight);
000476    }
000477    p5 = binaryCompareP5(pLeft, pRight, jumpIfNull);
000478    addr = sqlite3VdbeAddOp4(pParse->pVdbe, opcode, in2, dest, in1,
000479                             (void*)p4, P4_COLLSEQ);
000480    sqlite3VdbeChangeP5(pParse->pVdbe, (u8)p5);
000481    return addr;
000482  }
000483  
000484  /*
000485  ** Return true if expression pExpr is a vector, or false otherwise.
000486  **
000487  ** A vector is defined as any expression that results in two or more
000488  ** columns of result.  Every TK_VECTOR node is an vector because the
000489  ** parser will not generate a TK_VECTOR with fewer than two entries.
000490  ** But a TK_SELECT might be either a vector or a scalar. It is only
000491  ** considered a vector if it has two or more result columns.
000492  */
000493  int sqlite3ExprIsVector(const Expr *pExpr){
000494    return sqlite3ExprVectorSize(pExpr)>1;
000495  }
000496  
000497  /*
000498  ** If the expression passed as the only argument is of type TK_VECTOR
000499  ** return the number of expressions in the vector. Or, if the expression
000500  ** is a sub-select, return the number of columns in the sub-select. For
000501  ** any other type of expression, return 1.
000502  */
000503  int sqlite3ExprVectorSize(const Expr *pExpr){
000504    u8 op = pExpr->op;
000505    if( op==TK_REGISTER ) op = pExpr->op2;
000506    if( op==TK_VECTOR ){
000507      assert( ExprUseXList(pExpr) );
000508      return pExpr->x.pList->nExpr;
000509    }else if( op==TK_SELECT ){
000510      assert( ExprUseXSelect(pExpr) );
000511      return pExpr->x.pSelect->pEList->nExpr;
000512    }else{
000513      return 1;
000514    }
000515  }
000516  
000517  /*
000518  ** Return a pointer to a subexpression of pVector that is the i-th
000519  ** column of the vector (numbered starting with 0).  The caller must
000520  ** ensure that i is within range.
000521  **
000522  ** If pVector is really a scalar (and "scalar" here includes subqueries
000523  ** that return a single column!) then return pVector unmodified.
000524  **
000525  ** pVector retains ownership of the returned subexpression.
000526  **
000527  ** If the vector is a (SELECT ...) then the expression returned is
000528  ** just the expression for the i-th term of the result set, and may
000529  ** not be ready for evaluation because the table cursor has not yet
000530  ** been positioned.
000531  */
000532  Expr *sqlite3VectorFieldSubexpr(Expr *pVector, int i){
000533    assert( i<sqlite3ExprVectorSize(pVector) || pVector->op==TK_ERROR );
000534    if( sqlite3ExprIsVector(pVector) ){
000535      assert( pVector->op2==0 || pVector->op==TK_REGISTER );
000536      if( pVector->op==TK_SELECT || pVector->op2==TK_SELECT ){
000537        assert( ExprUseXSelect(pVector) );
000538        return pVector->x.pSelect->pEList->a[i].pExpr;
000539      }else{
000540        assert( ExprUseXList(pVector) );
000541        return pVector->x.pList->a[i].pExpr;
000542      }
000543    }
000544    return pVector;
000545  }
000546  
000547  /*
000548  ** Compute and return a new Expr object which when passed to
000549  ** sqlite3ExprCode() will generate all necessary code to compute
000550  ** the iField-th column of the vector expression pVector.
000551  **
000552  ** It is ok for pVector to be a scalar (as long as iField==0). 
000553  ** In that case, this routine works like sqlite3ExprDup().
000554  **
000555  ** The caller owns the returned Expr object and is responsible for
000556  ** ensuring that the returned value eventually gets freed.
000557  **
000558  ** The caller retains ownership of pVector.  If pVector is a TK_SELECT,
000559  ** then the returned object will reference pVector and so pVector must remain
000560  ** valid for the life of the returned object.  If pVector is a TK_VECTOR
000561  ** or a scalar expression, then it can be deleted as soon as this routine
000562  ** returns.
000563  **
000564  ** A trick to cause a TK_SELECT pVector to be deleted together with
000565  ** the returned Expr object is to attach the pVector to the pRight field
000566  ** of the returned TK_SELECT_COLUMN Expr object.
000567  */
000568  Expr *sqlite3ExprForVectorField(
000569    Parse *pParse,       /* Parsing context */
000570    Expr *pVector,       /* The vector.  List of expressions or a sub-SELECT */
000571    int iField,          /* Which column of the vector to return */
000572    int nField           /* Total number of columns in the vector */
000573  ){
000574    Expr *pRet;
000575    if( pVector->op==TK_SELECT ){
000576      assert( ExprUseXSelect(pVector) );
000577      /* The TK_SELECT_COLUMN Expr node:
000578      **
000579      ** pLeft:           pVector containing TK_SELECT.  Not deleted.
000580      ** pRight:          not used.  But recursively deleted.
000581      ** iColumn:         Index of a column in pVector
000582      ** iTable:          0 or the number of columns on the LHS of an assignment
000583      ** pLeft->iTable:   First in an array of register holding result, or 0
000584      **                  if the result is not yet computed.
000585      **
000586      ** sqlite3ExprDelete() specifically skips the recursive delete of
000587      ** pLeft on TK_SELECT_COLUMN nodes.  But pRight is followed, so pVector
000588      ** can be attached to pRight to cause this node to take ownership of
000589      ** pVector.  Typically there will be multiple TK_SELECT_COLUMN nodes
000590      ** with the same pLeft pointer to the pVector, but only one of them
000591      ** will own the pVector.
000592      */
000593      pRet = sqlite3PExpr(pParse, TK_SELECT_COLUMN, 0, 0);
000594      if( pRet ){
000595        ExprSetProperty(pRet, EP_FullSize);
000596        pRet->iTable = nField;
000597        pRet->iColumn = iField;
000598        pRet->pLeft = pVector;
000599      }
000600    }else{
000601      if( pVector->op==TK_VECTOR ){
000602        Expr **ppVector;
000603        assert( ExprUseXList(pVector) );
000604        ppVector = &pVector->x.pList->a[iField].pExpr;
000605        pVector = *ppVector;
000606        if( IN_RENAME_OBJECT ){
000607          /* This must be a vector UPDATE inside a trigger */
000608          *ppVector = 0;
000609          return pVector;
000610        }
000611      }
000612      pRet = sqlite3ExprDup(pParse->db, pVector, 0);
000613    }
000614    return pRet;
000615  }
000616  
000617  /*
000618  ** If expression pExpr is of type TK_SELECT, generate code to evaluate
000619  ** it. Return the register in which the result is stored (or, if the
000620  ** sub-select returns more than one column, the first in an array
000621  ** of registers in which the result is stored).
000622  **
000623  ** If pExpr is not a TK_SELECT expression, return 0.
000624  */
000625  static int exprCodeSubselect(Parse *pParse, Expr *pExpr){
000626    int reg = 0;
000627  #ifndef SQLITE_OMIT_SUBQUERY
000628    if( pExpr->op==TK_SELECT ){
000629      reg = sqlite3CodeSubselect(pParse, pExpr);
000630    }
000631  #endif
000632    return reg;
000633  }
000634  
000635  /*
000636  ** Argument pVector points to a vector expression - either a TK_VECTOR
000637  ** or TK_SELECT that returns more than one column. This function returns
000638  ** the register number of a register that contains the value of
000639  ** element iField of the vector.
000640  **
000641  ** If pVector is a TK_SELECT expression, then code for it must have
000642  ** already been generated using the exprCodeSubselect() routine. In this
000643  ** case parameter regSelect should be the first in an array of registers
000644  ** containing the results of the sub-select.
000645  **
000646  ** If pVector is of type TK_VECTOR, then code for the requested field
000647  ** is generated. In this case (*pRegFree) may be set to the number of
000648  ** a temporary register to be freed by the caller before returning.
000649  **
000650  ** Before returning, output parameter (*ppExpr) is set to point to the
000651  ** Expr object corresponding to element iElem of the vector.
000652  */
000653  static int exprVectorRegister(
000654    Parse *pParse,                  /* Parse context */
000655    Expr *pVector,                  /* Vector to extract element from */
000656    int iField,                     /* Field to extract from pVector */
000657    int regSelect,                  /* First in array of registers */
000658    Expr **ppExpr,                  /* OUT: Expression element */
000659    int *pRegFree                   /* OUT: Temp register to free */
000660  ){
000661    u8 op = pVector->op;
000662    assert( op==TK_VECTOR || op==TK_REGISTER || op==TK_SELECT || op==TK_ERROR );
000663    if( op==TK_REGISTER ){
000664      *ppExpr = sqlite3VectorFieldSubexpr(pVector, iField);
000665      return pVector->iTable+iField;
000666    }
000667    if( op==TK_SELECT ){
000668      assert( ExprUseXSelect(pVector) );
000669      *ppExpr = pVector->x.pSelect->pEList->a[iField].pExpr;
000670       return regSelect+iField;
000671    }
000672    if( op==TK_VECTOR ){
000673      assert( ExprUseXList(pVector) );
000674      *ppExpr = pVector->x.pList->a[iField].pExpr;
000675      return sqlite3ExprCodeTemp(pParse, *ppExpr, pRegFree);
000676    }
000677    return 0;
000678  }
000679  
000680  /*
000681  ** Expression pExpr is a comparison between two vector values. Compute
000682  ** the result of the comparison (1, 0, or NULL) and write that
000683  ** result into register dest.
000684  **
000685  ** The caller must satisfy the following preconditions:
000686  **
000687  **    if pExpr->op==TK_IS:      op==TK_EQ and p5==SQLITE_NULLEQ
000688  **    if pExpr->op==TK_ISNOT:   op==TK_NE and p5==SQLITE_NULLEQ
000689  **    otherwise:                op==pExpr->op and p5==0
000690  */
000691  static void codeVectorCompare(
000692    Parse *pParse,        /* Code generator context */
000693    Expr *pExpr,          /* The comparison operation */
000694    int dest,             /* Write results into this register */
000695    u8 op,                /* Comparison operator */
000696    u8 p5                 /* SQLITE_NULLEQ or zero */
000697  ){
000698    Vdbe *v = pParse->pVdbe;
000699    Expr *pLeft = pExpr->pLeft;
000700    Expr *pRight = pExpr->pRight;
000701    int nLeft = sqlite3ExprVectorSize(pLeft);
000702    int i;
000703    int regLeft = 0;
000704    int regRight = 0;
000705    u8 opx = op;
000706    int addrCmp = 0;
000707    int addrDone = sqlite3VdbeMakeLabel(pParse);
000708    int isCommuted = ExprHasProperty(pExpr,EP_Commuted);
000709  
000710    assert( !ExprHasVVAProperty(pExpr,EP_Immutable) );
000711    if( pParse->nErr ) return;
000712    if( nLeft!=sqlite3ExprVectorSize(pRight) ){
000713      sqlite3ErrorMsg(pParse, "row value misused");
000714      return;
000715    }
000716    assert( pExpr->op==TK_EQ || pExpr->op==TK_NE
000717         || pExpr->op==TK_IS || pExpr->op==TK_ISNOT
000718         || pExpr->op==TK_LT || pExpr->op==TK_GT
000719         || pExpr->op==TK_LE || pExpr->op==TK_GE
000720    );
000721    assert( pExpr->op==op || (pExpr->op==TK_IS && op==TK_EQ)
000722              || (pExpr->op==TK_ISNOT && op==TK_NE) );
000723    assert( p5==0 || pExpr->op!=op );
000724    assert( p5==SQLITE_NULLEQ || pExpr->op==op );
000725  
000726    if( op==TK_LE ) opx = TK_LT;
000727    if( op==TK_GE ) opx = TK_GT;
000728    if( op==TK_NE ) opx = TK_EQ;
000729  
000730    regLeft = exprCodeSubselect(pParse, pLeft);
000731    regRight = exprCodeSubselect(pParse, pRight);
000732  
000733    sqlite3VdbeAddOp2(v, OP_Integer, 1, dest);
000734    for(i=0; 1 /*Loop exits by "break"*/; i++){
000735      int regFree1 = 0, regFree2 = 0;
000736      Expr *pL = 0, *pR = 0;
000737      int r1, r2;
000738      assert( i>=0 && i<nLeft );
000739      if( addrCmp ) sqlite3VdbeJumpHere(v, addrCmp);
000740      r1 = exprVectorRegister(pParse, pLeft, i, regLeft, &pL, &regFree1);
000741      r2 = exprVectorRegister(pParse, pRight, i, regRight, &pR, &regFree2);
000742      addrCmp = sqlite3VdbeCurrentAddr(v);
000743      codeCompare(pParse, pL, pR, opx, r1, r2, addrDone, p5, isCommuted);
000744      testcase(op==OP_Lt); VdbeCoverageIf(v,op==OP_Lt);
000745      testcase(op==OP_Le); VdbeCoverageIf(v,op==OP_Le);
000746      testcase(op==OP_Gt); VdbeCoverageIf(v,op==OP_Gt);
000747      testcase(op==OP_Ge); VdbeCoverageIf(v,op==OP_Ge);
000748      testcase(op==OP_Eq); VdbeCoverageIf(v,op==OP_Eq);
000749      testcase(op==OP_Ne); VdbeCoverageIf(v,op==OP_Ne);
000750      sqlite3ReleaseTempReg(pParse, regFree1);
000751      sqlite3ReleaseTempReg(pParse, regFree2);
000752      if( (opx==TK_LT || opx==TK_GT) && i<nLeft-1 ){
000753        addrCmp = sqlite3VdbeAddOp0(v, OP_ElseEq);
000754        testcase(opx==TK_LT); VdbeCoverageIf(v,opx==TK_LT);
000755        testcase(opx==TK_GT); VdbeCoverageIf(v,opx==TK_GT);
000756      }
000757      if( p5==SQLITE_NULLEQ ){
000758        sqlite3VdbeAddOp2(v, OP_Integer, 0, dest);
000759      }else{
000760        sqlite3VdbeAddOp3(v, OP_ZeroOrNull, r1, dest, r2);
000761      }
000762      if( i==nLeft-1 ){
000763        break;
000764      }
000765      if( opx==TK_EQ ){
000766        sqlite3VdbeAddOp2(v, OP_NotNull, dest, addrDone); VdbeCoverage(v);
000767      }else{
000768        assert( op==TK_LT || op==TK_GT || op==TK_LE || op==TK_GE );
000769        sqlite3VdbeAddOp2(v, OP_Goto, 0, addrDone);
000770        if( i==nLeft-2 ) opx = op;
000771      }
000772    }
000773    sqlite3VdbeJumpHere(v, addrCmp);
000774    sqlite3VdbeResolveLabel(v, addrDone);
000775    if( op==TK_NE ){
000776      sqlite3VdbeAddOp2(v, OP_Not, dest, dest);
000777    }
000778  }
000779  
000780  #if SQLITE_MAX_EXPR_DEPTH>0
000781  /*
000782  ** Check that argument nHeight is less than or equal to the maximum
000783  ** expression depth allowed. If it is not, leave an error message in
000784  ** pParse.
000785  */
000786  int sqlite3ExprCheckHeight(Parse *pParse, int nHeight){
000787    int rc = SQLITE_OK;
000788    int mxHeight = pParse->db->aLimit[SQLITE_LIMIT_EXPR_DEPTH];
000789    if( nHeight>mxHeight ){
000790      sqlite3ErrorMsg(pParse,
000791         "Expression tree is too large (maximum depth %d)", mxHeight
000792      );
000793      rc = SQLITE_ERROR;
000794    }
000795    return rc;
000796  }
000797  
000798  /* The following three functions, heightOfExpr(), heightOfExprList()
000799  ** and heightOfSelect(), are used to determine the maximum height
000800  ** of any expression tree referenced by the structure passed as the
000801  ** first argument.
000802  **
000803  ** If this maximum height is greater than the current value pointed
000804  ** to by pnHeight, the second parameter, then set *pnHeight to that
000805  ** value.
000806  */
000807  static void heightOfExpr(const Expr *p, int *pnHeight){
000808    if( p ){
000809      if( p->nHeight>*pnHeight ){
000810        *pnHeight = p->nHeight;
000811      }
000812    }
000813  }
000814  static void heightOfExprList(const ExprList *p, int *pnHeight){
000815    if( p ){
000816      int i;
000817      for(i=0; i<p->nExpr; i++){
000818        heightOfExpr(p->a[i].pExpr, pnHeight);
000819      }
000820    }
000821  }
000822  static void heightOfSelect(const Select *pSelect, int *pnHeight){
000823    const Select *p;
000824    for(p=pSelect; p; p=p->pPrior){
000825      heightOfExpr(p->pWhere, pnHeight);
000826      heightOfExpr(p->pHaving, pnHeight);
000827      heightOfExpr(p->pLimit, pnHeight);
000828      heightOfExprList(p->pEList, pnHeight);
000829      heightOfExprList(p->pGroupBy, pnHeight);
000830      heightOfExprList(p->pOrderBy, pnHeight);
000831    }
000832  }
000833  
000834  /*
000835  ** Set the Expr.nHeight variable in the structure passed as an
000836  ** argument. An expression with no children, Expr.pList or
000837  ** Expr.pSelect member has a height of 1. Any other expression
000838  ** has a height equal to the maximum height of any other
000839  ** referenced Expr plus one.
000840  **
000841  ** Also propagate EP_Propagate flags up from Expr.x.pList to Expr.flags,
000842  ** if appropriate.
000843  */
000844  static void exprSetHeight(Expr *p){
000845    int nHeight = p->pLeft ? p->pLeft->nHeight : 0;
000846    if( NEVER(p->pRight) && p->pRight->nHeight>nHeight ){
000847      nHeight = p->pRight->nHeight;
000848    }
000849    if( ExprUseXSelect(p) ){
000850      heightOfSelect(p->x.pSelect, &nHeight);
000851    }else if( p->x.pList ){
000852      heightOfExprList(p->x.pList, &nHeight);
000853      p->flags |= EP_Propagate & sqlite3ExprListFlags(p->x.pList);
000854    }
000855    p->nHeight = nHeight + 1;
000856  }
000857  
000858  /*
000859  ** Set the Expr.nHeight variable using the exprSetHeight() function. If
000860  ** the height is greater than the maximum allowed expression depth,
000861  ** leave an error in pParse.
000862  **
000863  ** Also propagate all EP_Propagate flags from the Expr.x.pList into
000864  ** Expr.flags.
000865  */
000866  void sqlite3ExprSetHeightAndFlags(Parse *pParse, Expr *p){
000867    if( pParse->nErr ) return;
000868    exprSetHeight(p);
000869    sqlite3ExprCheckHeight(pParse, p->nHeight);
000870  }
000871  
000872  /*
000873  ** Return the maximum height of any expression tree referenced
000874  ** by the select statement passed as an argument.
000875  */
000876  int sqlite3SelectExprHeight(const Select *p){
000877    int nHeight = 0;
000878    heightOfSelect(p, &nHeight);
000879    return nHeight;
000880  }
000881  #else /* ABOVE:  Height enforcement enabled.  BELOW: Height enforcement off */
000882  /*
000883  ** Propagate all EP_Propagate flags from the Expr.x.pList into
000884  ** Expr.flags.
000885  */
000886  void sqlite3ExprSetHeightAndFlags(Parse *pParse, Expr *p){
000887    if( pParse->nErr ) return;
000888    if( p && ExprUseXList(p) && p->x.pList ){
000889      p->flags |= EP_Propagate & sqlite3ExprListFlags(p->x.pList);
000890    }
000891  }
000892  #define exprSetHeight(y)
000893  #endif /* SQLITE_MAX_EXPR_DEPTH>0 */
000894  
000895  /*
000896  ** Set the error offset for an Expr node, if possible.
000897  */
000898  void sqlite3ExprSetErrorOffset(Expr *pExpr, int iOfst){
000899    if( pExpr==0 ) return;
000900    if( NEVER(ExprUseWJoin(pExpr)) ) return;
000901    pExpr->w.iOfst = iOfst;
000902  }
000903  
000904  /*
000905  ** This routine is the core allocator for Expr nodes.
000906  **
000907  ** Construct a new expression node and return a pointer to it.  Memory
000908  ** for this node and for the pToken argument is a single allocation
000909  ** obtained from sqlite3DbMalloc().  The calling function
000910  ** is responsible for making sure the node eventually gets freed.
000911  **
000912  ** If dequote is true, then the token (if it exists) is dequoted.
000913  ** If dequote is false, no dequoting is performed.  The deQuote
000914  ** parameter is ignored if pToken is NULL or if the token does not
000915  ** appear to be quoted.  If the quotes were of the form "..." (double-quotes)
000916  ** then the EP_DblQuoted flag is set on the expression node.
000917  **
000918  ** Special case (tag-20240227-a):  If op==TK_INTEGER and pToken points to
000919  ** a string that can be translated into a 32-bit integer, then the token is
000920  ** not stored in u.zToken.  Instead, the integer values is written
000921  ** into u.iValue and the EP_IntValue flag is set. No extra storage
000922  ** is allocated to hold the integer text and the dequote flag is ignored.
000923  ** See also tag-20240227-b.
000924  */
000925  Expr *sqlite3ExprAlloc(
000926    sqlite3 *db,            /* Handle for sqlite3DbMallocRawNN() */
000927    int op,                 /* Expression opcode */
000928    const Token *pToken,    /* Token argument.  Might be NULL */
000929    int dequote             /* True to dequote */
000930  ){
000931    Expr *pNew;
000932    int nExtra = 0;
000933    int iValue = 0;
000934  
000935    assert( db!=0 );
000936    if( pToken ){
000937      if( op!=TK_INTEGER || pToken->z==0
000938            || sqlite3GetInt32(pToken->z, &iValue)==0 ){
000939        nExtra = pToken->n+1;  /* tag-20240227-a */
000940        assert( iValue>=0 );
000941      }
000942    }
000943    pNew = sqlite3DbMallocRawNN(db, sizeof(Expr)+nExtra);
000944    if( pNew ){
000945      memset(pNew, 0, sizeof(Expr));
000946      pNew->op = (u8)op;
000947      pNew->iAgg = -1;
000948      if( pToken ){
000949        if( nExtra==0 ){
000950          pNew->flags |= EP_IntValue|EP_Leaf|(iValue?EP_IsTrue:EP_IsFalse);
000951          pNew->u.iValue = iValue;
000952        }else{
000953          pNew->u.zToken = (char*)&pNew[1];
000954          assert( pToken->z!=0 || pToken->n==0 );
000955          if( pToken->n ) memcpy(pNew->u.zToken, pToken->z, pToken->n);
000956          pNew->u.zToken[pToken->n] = 0;
000957          if( dequote && sqlite3Isquote(pNew->u.zToken[0]) ){
000958            sqlite3DequoteExpr(pNew);
000959          }
000960        }
000961      }
000962  #if SQLITE_MAX_EXPR_DEPTH>0
000963      pNew->nHeight = 1;
000964  #endif 
000965    }
000966    return pNew;
000967  }
000968  
000969  /*
000970  ** Allocate a new expression node from a zero-terminated token that has
000971  ** already been dequoted.
000972  */
000973  Expr *sqlite3Expr(
000974    sqlite3 *db,            /* Handle for sqlite3DbMallocZero() (may be null) */
000975    int op,                 /* Expression opcode */
000976    const char *zToken      /* Token argument.  Might be NULL */
000977  ){
000978    Token x;
000979    x.z = zToken;
000980    x.n = sqlite3Strlen30(zToken);
000981    return sqlite3ExprAlloc(db, op, &x, 0);
000982  }
000983  
000984  /*
000985  ** Attach subtrees pLeft and pRight to the Expr node pRoot.
000986  **
000987  ** If pRoot==NULL that means that a memory allocation error has occurred.
000988  ** In that case, delete the subtrees pLeft and pRight.
000989  */
000990  void sqlite3ExprAttachSubtrees(
000991    sqlite3 *db,
000992    Expr *pRoot,
000993    Expr *pLeft,
000994    Expr *pRight
000995  ){
000996    if( pRoot==0 ){
000997      assert( db->mallocFailed );
000998      sqlite3ExprDelete(db, pLeft);
000999      sqlite3ExprDelete(db, pRight);
001000    }else{
001001      assert( ExprUseXList(pRoot) );
001002      assert( pRoot->x.pSelect==0 );
001003      if( pRight ){
001004        pRoot->pRight = pRight;
001005        pRoot->flags |= EP_Propagate & pRight->flags;
001006  #if SQLITE_MAX_EXPR_DEPTH>0
001007        pRoot->nHeight = pRight->nHeight+1;
001008      }else{
001009        pRoot->nHeight = 1;
001010  #endif
001011      }
001012      if( pLeft ){
001013        pRoot->pLeft = pLeft;
001014        pRoot->flags |= EP_Propagate & pLeft->flags;
001015  #if SQLITE_MAX_EXPR_DEPTH>0
001016        if( pLeft->nHeight>=pRoot->nHeight ){
001017          pRoot->nHeight = pLeft->nHeight+1;
001018        }
001019  #endif
001020      }
001021    }
001022  }
001023  
001024  /*
001025  ** Allocate an Expr node which joins as many as two subtrees.
001026  **
001027  ** One or both of the subtrees can be NULL.  Return a pointer to the new
001028  ** Expr node.  Or, if an OOM error occurs, set pParse->db->mallocFailed,
001029  ** free the subtrees and return NULL.
001030  */
001031  Expr *sqlite3PExpr(
001032    Parse *pParse,          /* Parsing context */
001033    int op,                 /* Expression opcode */
001034    Expr *pLeft,            /* Left operand */
001035    Expr *pRight            /* Right operand */
001036  ){
001037    Expr *p;
001038    p = sqlite3DbMallocRawNN(pParse->db, sizeof(Expr));
001039    if( p ){
001040      memset(p, 0, sizeof(Expr));
001041      p->op = op & 0xff;
001042      p->iAgg = -1;
001043      sqlite3ExprAttachSubtrees(pParse->db, p, pLeft, pRight);
001044      sqlite3ExprCheckHeight(pParse, p->nHeight);
001045    }else{
001046      sqlite3ExprDelete(pParse->db, pLeft);
001047      sqlite3ExprDelete(pParse->db, pRight);
001048    }
001049    return p;
001050  }
001051  
001052  /*
001053  ** Add pSelect to the Expr.x.pSelect field.  Or, if pExpr is NULL (due
001054  ** do a memory allocation failure) then delete the pSelect object.
001055  */
001056  void sqlite3PExprAddSelect(Parse *pParse, Expr *pExpr, Select *pSelect){
001057    if( pExpr ){
001058      pExpr->x.pSelect = pSelect;
001059      ExprSetProperty(pExpr, EP_xIsSelect|EP_Subquery);
001060      sqlite3ExprSetHeightAndFlags(pParse, pExpr);
001061    }else{
001062      assert( pParse->db->mallocFailed );
001063      sqlite3SelectDelete(pParse->db, pSelect);
001064    }
001065  }
001066  
001067  /*
001068  ** Expression list pEList is a list of vector values. This function
001069  ** converts the contents of pEList to a VALUES(...) Select statement
001070  ** returning 1 row for each element of the list. For example, the
001071  ** expression list:
001072  **
001073  **   ( (1,2), (3,4) (5,6) )
001074  **
001075  ** is translated to the equivalent of:
001076  **
001077  **   VALUES(1,2), (3,4), (5,6)
001078  **
001079  ** Each of the vector values in pEList must contain exactly nElem terms.
001080  ** If a list element that is not a vector or does not contain nElem terms,
001081  ** an error message is left in pParse.
001082  **
001083  ** This is used as part of processing IN(...) expressions with a list
001084  ** of vectors on the RHS. e.g. "... IN ((1,2), (3,4), (5,6))".
001085  */
001086  Select *sqlite3ExprListToValues(Parse *pParse, int nElem, ExprList *pEList){
001087    int ii;
001088    Select *pRet = 0;
001089    assert( nElem>1 );
001090    for(ii=0; ii<pEList->nExpr; ii++){
001091      Select *pSel;
001092      Expr *pExpr = pEList->a[ii].pExpr;
001093      int nExprElem;
001094      if( pExpr->op==TK_VECTOR ){
001095        assert( ExprUseXList(pExpr) );
001096        nExprElem = pExpr->x.pList->nExpr;
001097      }else{
001098        nExprElem = 1;
001099      }
001100      if( nExprElem!=nElem ){
001101        sqlite3ErrorMsg(pParse, "IN(...) element has %d term%s - expected %d",
001102            nExprElem, nExprElem>1?"s":"", nElem
001103        );
001104        break;
001105      }
001106      assert( ExprUseXList(pExpr) );
001107      pSel = sqlite3SelectNew(pParse, pExpr->x.pList, 0, 0, 0, 0, 0, SF_Values,0);
001108      pExpr->x.pList = 0;
001109      if( pSel ){
001110        if( pRet ){
001111          pSel->op = TK_ALL;
001112          pSel->pPrior = pRet;
001113        }
001114        pRet = pSel;
001115      }
001116    }
001117  
001118    if( pRet && pRet->pPrior ){
001119      pRet->selFlags |= SF_MultiValue;
001120    }
001121    sqlite3ExprListDelete(pParse->db, pEList);
001122    return pRet;
001123  }
001124  
001125  /*
001126  ** Join two expressions using an AND operator.  If either expression is
001127  ** NULL, then just return the other expression.
001128  **
001129  ** If one side or the other of the AND is known to be false, and neither side
001130  ** is part of an ON clause, then instead of returning an AND expression,
001131  ** just return a constant expression with a value of false.
001132  */
001133  Expr *sqlite3ExprAnd(Parse *pParse, Expr *pLeft, Expr *pRight){
001134    sqlite3 *db = pParse->db;
001135    if( pLeft==0  ){
001136      return pRight;
001137    }else if( pRight==0 ){
001138      return pLeft;
001139    }else{
001140      u32 f = pLeft->flags | pRight->flags;
001141      if( (f&(EP_OuterON|EP_InnerON|EP_IsFalse))==EP_IsFalse
001142       && !IN_RENAME_OBJECT
001143      ){
001144        sqlite3ExprDeferredDelete(pParse, pLeft);
001145        sqlite3ExprDeferredDelete(pParse, pRight);
001146        return sqlite3Expr(db, TK_INTEGER, "0");
001147      }else{
001148        return sqlite3PExpr(pParse, TK_AND, pLeft, pRight);
001149      }
001150    }
001151  }
001152  
001153  /*
001154  ** Construct a new expression node for a function with multiple
001155  ** arguments.
001156  */
001157  Expr *sqlite3ExprFunction(
001158    Parse *pParse,        /* Parsing context */
001159    ExprList *pList,      /* Argument list */
001160    const Token *pToken,  /* Name of the function */
001161    int eDistinct         /* SF_Distinct or SF_ALL or 0 */
001162  ){
001163    Expr *pNew;
001164    sqlite3 *db = pParse->db;
001165    assert( pToken );
001166    pNew = sqlite3ExprAlloc(db, TK_FUNCTION, pToken, 1);
001167    if( pNew==0 ){
001168      sqlite3ExprListDelete(db, pList); /* Avoid memory leak when malloc fails */
001169      return 0;
001170    }
001171    assert( !ExprHasProperty(pNew, EP_InnerON|EP_OuterON) );
001172    pNew->w.iOfst = (int)(pToken->z - pParse->zTail);
001173    if( pList
001174     && pList->nExpr > pParse->db->aLimit[SQLITE_LIMIT_FUNCTION_ARG]
001175     && !pParse->nested
001176    ){
001177      sqlite3ErrorMsg(pParse, "too many arguments on function %T", pToken);
001178    }
001179    pNew->x.pList = pList;
001180    ExprSetProperty(pNew, EP_HasFunc);
001181    assert( ExprUseXList(pNew) );
001182    sqlite3ExprSetHeightAndFlags(pParse, pNew);
001183    if( eDistinct==SF_Distinct ) ExprSetProperty(pNew, EP_Distinct);
001184    return pNew;
001185  }
001186  
001187  /*
001188  ** Report an error when attempting to use an ORDER BY clause within
001189  ** the arguments of a non-aggregate function.
001190  */
001191  void sqlite3ExprOrderByAggregateError(Parse *pParse, Expr *p){
001192    sqlite3ErrorMsg(pParse,
001193       "ORDER BY may not be used with non-aggregate %#T()", p
001194    );
001195  }
001196  
001197  /*
001198  ** Attach an ORDER BY clause to a function call.
001199  **
001200  **     functionname( arguments ORDER BY sortlist )
001201  **     \_____________________/          \______/
001202  **             pExpr                    pOrderBy
001203  **
001204  ** The ORDER BY clause is inserted into a new Expr node of type TK_ORDER
001205  ** and added to the Expr.pLeft field of the parent TK_FUNCTION node.
001206  */
001207  void sqlite3ExprAddFunctionOrderBy(
001208    Parse *pParse,        /* Parsing context */
001209    Expr *pExpr,          /* The function call to which ORDER BY is to be added */
001210    ExprList *pOrderBy    /* The ORDER BY clause to add */
001211  ){
001212    Expr *pOB;
001213    sqlite3 *db = pParse->db;
001214    if( NEVER(pOrderBy==0) ){
001215      assert( db->mallocFailed );
001216      return;
001217    }
001218    if( pExpr==0 ){
001219      assert( db->mallocFailed );
001220      sqlite3ExprListDelete(db, pOrderBy);
001221      return;
001222    }
001223    assert( pExpr->op==TK_FUNCTION );
001224    assert( pExpr->pLeft==0 );
001225    assert( ExprUseXList(pExpr) );
001226    if( pExpr->x.pList==0 || NEVER(pExpr->x.pList->nExpr==0) ){
001227      /* Ignore ORDER BY on zero-argument aggregates */
001228      sqlite3ParserAddCleanup(pParse, sqlite3ExprListDeleteGeneric, pOrderBy);
001229      return;
001230    }
001231    if( IsWindowFunc(pExpr) ){
001232      sqlite3ExprOrderByAggregateError(pParse, pExpr);
001233      sqlite3ExprListDelete(db, pOrderBy);
001234      return;
001235    }
001236  
001237    pOB = sqlite3ExprAlloc(db, TK_ORDER, 0, 0);
001238    if( pOB==0 ){
001239      sqlite3ExprListDelete(db, pOrderBy);
001240      return;
001241    }
001242    pOB->x.pList = pOrderBy;
001243    assert( ExprUseXList(pOB) );
001244    pExpr->pLeft = pOB;
001245    ExprSetProperty(pOB, EP_FullSize);
001246  }
001247  
001248  /*
001249  ** Check to see if a function is usable according to current access
001250  ** rules:
001251  **
001252  **    SQLITE_FUNC_DIRECT    -     Only usable from top-level SQL
001253  **
001254  **    SQLITE_FUNC_UNSAFE    -     Usable if TRUSTED_SCHEMA or from
001255  **                                top-level SQL
001256  **
001257  ** If the function is not usable, create an error.
001258  */
001259  void sqlite3ExprFunctionUsable(
001260    Parse *pParse,         /* Parsing and code generating context */
001261    const Expr *pExpr,     /* The function invocation */
001262    const FuncDef *pDef    /* The function being invoked */
001263  ){
001264    assert( !IN_RENAME_OBJECT );
001265    assert( (pDef->funcFlags & (SQLITE_FUNC_DIRECT|SQLITE_FUNC_UNSAFE))!=0 );
001266    if( ExprHasProperty(pExpr, EP_FromDDL) ){
001267      if( (pDef->funcFlags & SQLITE_FUNC_DIRECT)!=0
001268       || (pParse->db->flags & SQLITE_TrustedSchema)==0
001269      ){
001270        /* Functions prohibited in triggers and views if:
001271        **     (1) tagged with SQLITE_DIRECTONLY
001272        **     (2) not tagged with SQLITE_INNOCUOUS (which means it
001273        **         is tagged with SQLITE_FUNC_UNSAFE) and
001274        **         SQLITE_DBCONFIG_TRUSTED_SCHEMA is off (meaning
001275        **         that the schema is possibly tainted).
001276        */
001277        sqlite3ErrorMsg(pParse, "unsafe use of %#T()", pExpr);
001278      }
001279    }
001280  }
001281  
001282  /*
001283  ** Assign a variable number to an expression that encodes a wildcard
001284  ** in the original SQL statement. 
001285  **
001286  ** Wildcards consisting of a single "?" are assigned the next sequential
001287  ** variable number.
001288  **
001289  ** Wildcards of the form "?nnn" are assigned the number "nnn".  We make
001290  ** sure "nnn" is not too big to avoid a denial of service attack when
001291  ** the SQL statement comes from an external source.
001292  **
001293  ** Wildcards of the form ":aaa", "@aaa", or "$aaa" are assigned the same number
001294  ** as the previous instance of the same wildcard.  Or if this is the first
001295  ** instance of the wildcard, the next sequential variable number is
001296  ** assigned.
001297  */
001298  void sqlite3ExprAssignVarNumber(Parse *pParse, Expr *pExpr, u32 n){
001299    sqlite3 *db = pParse->db;
001300    const char *z;
001301    ynVar x;
001302  
001303    if( pExpr==0 ) return;
001304    assert( !ExprHasProperty(pExpr, EP_IntValue|EP_Reduced|EP_TokenOnly) );
001305    z = pExpr->u.zToken;
001306    assert( z!=0 );
001307    assert( z[0]!=0 );
001308    assert( n==(u32)sqlite3Strlen30(z) );
001309    if( z[1]==0 ){
001310      /* Wildcard of the form "?".  Assign the next variable number */
001311      assert( z[0]=='?' );
001312      x = (ynVar)(++pParse->nVar);
001313    }else{
001314      int doAdd = 0;
001315      if( z[0]=='?' ){
001316        /* Wildcard of the form "?nnn".  Convert "nnn" to an integer and
001317        ** use it as the variable number */
001318        i64 i;
001319        int bOk;
001320        if( n==2 ){ /*OPTIMIZATION-IF-TRUE*/
001321          i = z[1]-'0';  /* The common case of ?N for a single digit N */
001322          bOk = 1;
001323        }else{
001324          bOk = 0==sqlite3Atoi64(&z[1], &i, n-1, SQLITE_UTF8);
001325        }
001326        testcase( i==0 );
001327        testcase( i==1 );
001328        testcase( i==db->aLimit[SQLITE_LIMIT_VARIABLE_NUMBER]-1 );
001329        testcase( i==db->aLimit[SQLITE_LIMIT_VARIABLE_NUMBER] );
001330        if( bOk==0 || i<1 || i>db->aLimit[SQLITE_LIMIT_VARIABLE_NUMBER] ){
001331          sqlite3ErrorMsg(pParse, "variable number must be between ?1 and ?%d",
001332              db->aLimit[SQLITE_LIMIT_VARIABLE_NUMBER]);
001333          sqlite3RecordErrorOffsetOfExpr(pParse->db, pExpr);
001334          return;
001335        }
001336        x = (ynVar)i;
001337        if( x>pParse->nVar ){
001338          pParse->nVar = (int)x;
001339          doAdd = 1;
001340        }else if( sqlite3VListNumToName(pParse->pVList, x)==0 ){
001341          doAdd = 1;
001342        }
001343      }else{
001344        /* Wildcards like ":aaa", "$aaa" or "@aaa".  Reuse the same variable
001345        ** number as the prior appearance of the same name, or if the name
001346        ** has never appeared before, reuse the same variable number
001347        */
001348        x = (ynVar)sqlite3VListNameToNum(pParse->pVList, z, n);
001349        if( x==0 ){
001350          x = (ynVar)(++pParse->nVar);
001351          doAdd = 1;
001352        }
001353      }
001354      if( doAdd ){
001355        pParse->pVList = sqlite3VListAdd(db, pParse->pVList, z, n, x);
001356      }
001357    }
001358    pExpr->iColumn = x;
001359    if( x>db->aLimit[SQLITE_LIMIT_VARIABLE_NUMBER] ){
001360      sqlite3ErrorMsg(pParse, "too many SQL variables");
001361      sqlite3RecordErrorOffsetOfExpr(pParse->db, pExpr);
001362    }
001363  }
001364  
001365  /*
001366  ** Recursively delete an expression tree.
001367  */
001368  static SQLITE_NOINLINE void sqlite3ExprDeleteNN(sqlite3 *db, Expr *p){
001369    assert( p!=0 );
001370    assert( db!=0 );
001371  exprDeleteRestart:
001372    assert( !ExprUseUValue(p) || p->u.iValue>=0 );
001373    assert( !ExprUseYWin(p) || !ExprUseYSub(p) );
001374    assert( !ExprUseYWin(p) || p->y.pWin!=0 || db->mallocFailed );
001375    assert( p->op!=TK_FUNCTION || !ExprUseYSub(p) );
001376  #ifdef SQLITE_DEBUG
001377    if( ExprHasProperty(p, EP_Leaf) && !ExprHasProperty(p, EP_TokenOnly) ){
001378      assert( p->pLeft==0 );
001379      assert( p->pRight==0 );
001380      assert( !ExprUseXSelect(p) || p->x.pSelect==0 );
001381      assert( !ExprUseXList(p) || p->x.pList==0 );
001382    }
001383  #endif
001384    if( !ExprHasProperty(p, (EP_TokenOnly|EP_Leaf)) ){
001385      /* The Expr.x union is never used at the same time as Expr.pRight */
001386      assert( (ExprUseXList(p) && p->x.pList==0) || p->pRight==0 );
001387      if( p->pRight ){
001388        assert( !ExprHasProperty(p, EP_WinFunc) );
001389        sqlite3ExprDeleteNN(db, p->pRight);
001390      }else if( ExprUseXSelect(p) ){
001391        assert( !ExprHasProperty(p, EP_WinFunc) );
001392        sqlite3SelectDelete(db, p->x.pSelect);
001393      }else{
001394        sqlite3ExprListDelete(db, p->x.pList);
001395  #ifndef SQLITE_OMIT_WINDOWFUNC
001396        if( ExprHasProperty(p, EP_WinFunc) ){
001397          sqlite3WindowDelete(db, p->y.pWin);
001398        }
001399  #endif
001400      }
001401      if( p->pLeft && p->op!=TK_SELECT_COLUMN ){
001402        Expr *pLeft = p->pLeft;
001403        if( !ExprHasProperty(p, EP_Static)
001404         && !ExprHasProperty(pLeft, EP_Static)
001405        ){
001406          /* Avoid unnecessary recursion on unary operators */
001407          sqlite3DbNNFreeNN(db, p);
001408          p = pLeft;
001409          goto exprDeleteRestart;
001410        }else{
001411          sqlite3ExprDeleteNN(db, pLeft);
001412        }
001413      }
001414    }
001415    if( !ExprHasProperty(p, EP_Static) ){
001416      sqlite3DbNNFreeNN(db, p);
001417    }
001418  }
001419  void sqlite3ExprDelete(sqlite3 *db, Expr *p){
001420    if( p ) sqlite3ExprDeleteNN(db, p);
001421  }
001422  void sqlite3ExprDeleteGeneric(sqlite3 *db, void *p){
001423    if( ALWAYS(p) ) sqlite3ExprDeleteNN(db, (Expr*)p);
001424  }
001425  
001426  /*
001427  ** Clear both elements of an OnOrUsing object
001428  */
001429  void sqlite3ClearOnOrUsing(sqlite3 *db, OnOrUsing *p){
001430    if( p==0 ){
001431      /* Nothing to clear */
001432    }else if( p->pOn ){
001433      sqlite3ExprDeleteNN(db, p->pOn);
001434    }else if( p->pUsing ){
001435      sqlite3IdListDelete(db, p->pUsing);
001436    }
001437  }
001438  
001439  /*
001440  ** Arrange to cause pExpr to be deleted when the pParse is deleted.
001441  ** This is similar to sqlite3ExprDelete() except that the delete is
001442  ** deferred until the pParse is deleted.
001443  **
001444  ** The pExpr might be deleted immediately on an OOM error.
001445  **
001446  ** Return 0 if the delete was successfully deferred.  Return non-zero
001447  ** if the delete happened immediately because of an OOM.
001448  */
001449  int sqlite3ExprDeferredDelete(Parse *pParse, Expr *pExpr){
001450    return 0==sqlite3ParserAddCleanup(pParse, sqlite3ExprDeleteGeneric, pExpr);
001451  }
001452  
001453  /* Invoke sqlite3RenameExprUnmap() and sqlite3ExprDelete() on the
001454  ** expression.
001455  */
001456  void sqlite3ExprUnmapAndDelete(Parse *pParse, Expr *p){
001457    if( p ){
001458      if( IN_RENAME_OBJECT ){
001459        sqlite3RenameExprUnmap(pParse, p);
001460      }
001461      sqlite3ExprDeleteNN(pParse->db, p);
001462    }
001463  }
001464  
001465  /*
001466  ** Return the number of bytes allocated for the expression structure
001467  ** passed as the first argument. This is always one of EXPR_FULLSIZE,
001468  ** EXPR_REDUCEDSIZE or EXPR_TOKENONLYSIZE.
001469  */
001470  static int exprStructSize(const Expr *p){
001471    if( ExprHasProperty(p, EP_TokenOnly) ) return EXPR_TOKENONLYSIZE;
001472    if( ExprHasProperty(p, EP_Reduced) ) return EXPR_REDUCEDSIZE;
001473    return EXPR_FULLSIZE;
001474  }
001475  
001476  /*
001477  ** The dupedExpr*Size() routines each return the number of bytes required
001478  ** to store a copy of an expression or expression tree.  They differ in
001479  ** how much of the tree is measured.
001480  **
001481  **     dupedExprStructSize()     Size of only the Expr structure
001482  **     dupedExprNodeSize()       Size of Expr + space for token
001483  **     dupedExprSize()           Expr + token + subtree components
001484  **
001485  ***************************************************************************
001486  **
001487  ** The dupedExprStructSize() function returns two values OR-ed together: 
001488  ** (1) the space required for a copy of the Expr structure only and
001489  ** (2) the EP_xxx flags that indicate what the structure size should be.
001490  ** The return values is always one of:
001491  **
001492  **      EXPR_FULLSIZE
001493  **      EXPR_REDUCEDSIZE   | EP_Reduced
001494  **      EXPR_TOKENONLYSIZE | EP_TokenOnly
001495  **
001496  ** The size of the structure can be found by masking the return value
001497  ** of this routine with 0xfff.  The flags can be found by masking the
001498  ** return value with EP_Reduced|EP_TokenOnly.
001499  **
001500  ** Note that with flags==EXPRDUP_REDUCE, this routines works on full-size
001501  ** (unreduced) Expr objects as they or originally constructed by the parser.
001502  ** During expression analysis, extra information is computed and moved into
001503  ** later parts of the Expr object and that extra information might get chopped
001504  ** off if the expression is reduced.  Note also that it does not work to
001505  ** make an EXPRDUP_REDUCE copy of a reduced expression.  It is only legal
001506  ** to reduce a pristine expression tree from the parser.  The implementation
001507  ** of dupedExprStructSize() contain multiple assert() statements that attempt
001508  ** to enforce this constraint.
001509  */
001510  static int dupedExprStructSize(const Expr *p, int flags){
001511    int nSize;
001512    assert( flags==EXPRDUP_REDUCE || flags==0 ); /* Only one flag value allowed */
001513    assert( EXPR_FULLSIZE<=0xfff );
001514    assert( (0xfff & (EP_Reduced|EP_TokenOnly))==0 );
001515    if( 0==flags || ExprHasProperty(p, EP_FullSize) ){
001516      nSize = EXPR_FULLSIZE;
001517    }else{
001518      assert( !ExprHasProperty(p, EP_TokenOnly|EP_Reduced) );
001519      assert( !ExprHasProperty(p, EP_OuterON) );
001520      assert( !ExprHasVVAProperty(p, EP_NoReduce) );
001521      if( p->pLeft || p->x.pList ){
001522        nSize = EXPR_REDUCEDSIZE | EP_Reduced;
001523      }else{
001524        assert( p->pRight==0 );
001525        nSize = EXPR_TOKENONLYSIZE | EP_TokenOnly;
001526      }
001527    }
001528    return nSize;
001529  }
001530  
001531  /*
001532  ** This function returns the space in bytes required to store the copy
001533  ** of the Expr structure and a copy of the Expr.u.zToken string (if that
001534  ** string is defined.)
001535  */
001536  static int dupedExprNodeSize(const Expr *p, int flags){
001537    int nByte = dupedExprStructSize(p, flags) & 0xfff;
001538    if( !ExprHasProperty(p, EP_IntValue) && p->u.zToken ){
001539      nByte += sqlite3Strlen30NN(p->u.zToken)+1;
001540    }
001541    return ROUND8(nByte);
001542  }
001543  
001544  /*
001545  ** Return the number of bytes required to create a duplicate of the
001546  ** expression passed as the first argument.
001547  **
001548  ** The value returned includes space to create a copy of the Expr struct
001549  ** itself and the buffer referred to by Expr.u.zToken, if any.
001550  **
001551  ** The return value includes space to duplicate all Expr nodes in the
001552  ** tree formed by Expr.pLeft and Expr.pRight, but not any other
001553  ** substructure such as Expr.x.pList, Expr.x.pSelect, and Expr.y.pWin.
001554  */
001555  static int dupedExprSize(const Expr *p){
001556    int nByte;
001557    assert( p!=0 );
001558    nByte = dupedExprNodeSize(p, EXPRDUP_REDUCE);
001559    if( p->pLeft ) nByte += dupedExprSize(p->pLeft);
001560    if( p->pRight ) nByte += dupedExprSize(p->pRight);
001561    assert( nByte==ROUND8(nByte) );
001562    return nByte;
001563  }
001564  
001565  /*
001566  ** An EdupBuf is a memory allocation used to stored multiple Expr objects
001567  ** together with their Expr.zToken content.  This is used to help implement
001568  ** compression while doing sqlite3ExprDup().  The top-level Expr does the
001569  ** allocation for itself and many of its decendents, then passes an instance
001570  ** of the structure down into exprDup() so that they decendents can have
001571  ** access to that memory.
001572  */
001573  typedef struct EdupBuf EdupBuf;
001574  struct EdupBuf {
001575    u8 *zAlloc;          /* Memory space available for storage */
001576  #ifdef SQLITE_DEBUG
001577    u8 *zEnd;            /* First byte past the end of memory */
001578  #endif
001579  };
001580  
001581  /*
001582  ** This function is similar to sqlite3ExprDup(), except that if pEdupBuf
001583  ** is not NULL then it points to memory that can be used to store a copy
001584  ** of the input Expr p together with its p->u.zToken (if any).  pEdupBuf
001585  ** is updated with the new buffer tail prior to returning.
001586  */
001587  static Expr *exprDup(
001588    sqlite3 *db,          /* Database connection (for memory allocation) */
001589    const Expr *p,        /* Expr tree to be duplicated */
001590    int dupFlags,         /* EXPRDUP_REDUCE for compression.  0 if not */
001591    EdupBuf *pEdupBuf     /* Preallocated storage space, or NULL */
001592  ){
001593    Expr *pNew;           /* Value to return */
001594    EdupBuf sEdupBuf;     /* Memory space from which to build Expr object */
001595    u32 staticFlag;       /* EP_Static if space not obtained from malloc */
001596    int nToken = -1;       /* Space needed for p->u.zToken.  -1 means unknown */
001597  
001598    assert( db!=0 );
001599    assert( p );
001600    assert( dupFlags==0 || dupFlags==EXPRDUP_REDUCE );
001601    assert( pEdupBuf==0 || dupFlags==EXPRDUP_REDUCE );
001602  
001603    /* Figure out where to write the new Expr structure. */
001604    if( pEdupBuf ){
001605      sEdupBuf.zAlloc = pEdupBuf->zAlloc;
001606  #ifdef SQLITE_DEBUG
001607      sEdupBuf.zEnd = pEdupBuf->zEnd;
001608  #endif
001609      staticFlag = EP_Static;
001610      assert( sEdupBuf.zAlloc!=0 );
001611      assert( dupFlags==EXPRDUP_REDUCE );
001612    }else{
001613      int nAlloc;
001614      if( dupFlags ){
001615        nAlloc = dupedExprSize(p);
001616      }else if( !ExprHasProperty(p, EP_IntValue) && p->u.zToken ){
001617        nToken = sqlite3Strlen30NN(p->u.zToken)+1;
001618        nAlloc = ROUND8(EXPR_FULLSIZE + nToken);
001619      }else{
001620        nToken = 0;
001621        nAlloc = ROUND8(EXPR_FULLSIZE);
001622      }
001623      assert( nAlloc==ROUND8(nAlloc) );
001624      sEdupBuf.zAlloc = sqlite3DbMallocRawNN(db, nAlloc);
001625  #ifdef SQLITE_DEBUG
001626      sEdupBuf.zEnd = sEdupBuf.zAlloc ? sEdupBuf.zAlloc+nAlloc : 0;
001627  #endif
001628      
001629      staticFlag = 0;
001630    }
001631    pNew = (Expr *)sEdupBuf.zAlloc;
001632    assert( EIGHT_BYTE_ALIGNMENT(pNew) );
001633  
001634    if( pNew ){
001635      /* Set nNewSize to the size allocated for the structure pointed to
001636      ** by pNew. This is either EXPR_FULLSIZE, EXPR_REDUCEDSIZE or
001637      ** EXPR_TOKENONLYSIZE. nToken is set to the number of bytes consumed
001638      ** by the copy of the p->u.zToken string (if any).
001639      */
001640      const unsigned nStructSize = dupedExprStructSize(p, dupFlags);
001641      int nNewSize = nStructSize & 0xfff;
001642      if( nToken<0 ){
001643        if( !ExprHasProperty(p, EP_IntValue) && p->u.zToken ){
001644          nToken = sqlite3Strlen30(p->u.zToken) + 1;
001645        }else{
001646          nToken = 0;
001647        }
001648      }
001649      if( dupFlags ){
001650        assert( (int)(sEdupBuf.zEnd - sEdupBuf.zAlloc) >= nNewSize+nToken );
001651        assert( ExprHasProperty(p, EP_Reduced)==0 );
001652        memcpy(sEdupBuf.zAlloc, p, nNewSize);
001653      }else{
001654        u32 nSize = (u32)exprStructSize(p);
001655        assert( (int)(sEdupBuf.zEnd - sEdupBuf.zAlloc) >=
001656                                                     (int)EXPR_FULLSIZE+nToken );
001657        memcpy(sEdupBuf.zAlloc, p, nSize);
001658        if( nSize<EXPR_FULLSIZE ){
001659          memset(&sEdupBuf.zAlloc[nSize], 0, EXPR_FULLSIZE-nSize);
001660        }
001661        nNewSize = EXPR_FULLSIZE;
001662      }
001663  
001664      /* Set the EP_Reduced, EP_TokenOnly, and EP_Static flags appropriately. */
001665      pNew->flags &= ~(EP_Reduced|EP_TokenOnly|EP_Static);
001666      pNew->flags |= nStructSize & (EP_Reduced|EP_TokenOnly);
001667      pNew->flags |= staticFlag;
001668      ExprClearVVAProperties(pNew);
001669      if( dupFlags ){
001670        ExprSetVVAProperty(pNew, EP_Immutable);
001671      }
001672  
001673      /* Copy the p->u.zToken string, if any. */
001674      assert( nToken>=0 );
001675      if( nToken>0 ){
001676        char *zToken = pNew->u.zToken = (char*)&sEdupBuf.zAlloc[nNewSize];
001677        memcpy(zToken, p->u.zToken, nToken);
001678        nNewSize += nToken;
001679      }
001680      sEdupBuf.zAlloc += ROUND8(nNewSize);
001681  
001682      if( ((p->flags|pNew->flags)&(EP_TokenOnly|EP_Leaf))==0 ){
001683  
001684        /* Fill in the pNew->x.pSelect or pNew->x.pList member. */
001685        if( ExprUseXSelect(p) ){
001686          pNew->x.pSelect = sqlite3SelectDup(db, p->x.pSelect, dupFlags);
001687        }else{
001688          pNew->x.pList = sqlite3ExprListDup(db, p->x.pList,
001689                             p->op!=TK_ORDER ? dupFlags : 0);
001690        }
001691  
001692  #ifndef SQLITE_OMIT_WINDOWFUNC
001693        if( ExprHasProperty(p, EP_WinFunc) ){
001694          pNew->y.pWin = sqlite3WindowDup(db, pNew, p->y.pWin);
001695          assert( ExprHasProperty(pNew, EP_WinFunc) );
001696        }
001697  #endif /* SQLITE_OMIT_WINDOWFUNC */
001698  
001699        /* Fill in pNew->pLeft and pNew->pRight. */
001700        if( dupFlags ){
001701          if( p->op==TK_SELECT_COLUMN ){
001702            pNew->pLeft = p->pLeft;
001703            assert( p->pRight==0 
001704                 || p->pRight==p->pLeft
001705                 || ExprHasProperty(p->pLeft, EP_Subquery) );
001706          }else{
001707            pNew->pLeft = p->pLeft ?
001708                        exprDup(db, p->pLeft, EXPRDUP_REDUCE, &sEdupBuf) : 0;
001709          }
001710          pNew->pRight = p->pRight ?
001711                         exprDup(db, p->pRight, EXPRDUP_REDUCE, &sEdupBuf) : 0;
001712        }else{
001713          if( p->op==TK_SELECT_COLUMN ){
001714            pNew->pLeft = p->pLeft;
001715            assert( p->pRight==0 
001716                 || p->pRight==p->pLeft
001717                 || ExprHasProperty(p->pLeft, EP_Subquery) );
001718          }else{
001719            pNew->pLeft = sqlite3ExprDup(db, p->pLeft, 0);
001720          }
001721          pNew->pRight = sqlite3ExprDup(db, p->pRight, 0);
001722        }
001723      }
001724    }
001725    if( pEdupBuf ) memcpy(pEdupBuf, &sEdupBuf, sizeof(sEdupBuf));
001726    assert( sEdupBuf.zAlloc <= sEdupBuf.zEnd );
001727    return pNew;
001728  }
001729  
001730  /*
001731  ** Create and return a deep copy of the object passed as the second
001732  ** argument. If an OOM condition is encountered, NULL is returned
001733  ** and the db->mallocFailed flag set.
001734  */
001735  #ifndef SQLITE_OMIT_CTE
001736  With *sqlite3WithDup(sqlite3 *db, With *p){
001737    With *pRet = 0;
001738    if( p ){
001739      sqlite3_int64 nByte = sizeof(*p) + sizeof(p->a[0]) * (p->nCte-1);
001740      pRet = sqlite3DbMallocZero(db, nByte);
001741      if( pRet ){
001742        int i;
001743        pRet->nCte = p->nCte;
001744        for(i=0; i<p->nCte; i++){
001745          pRet->a[i].pSelect = sqlite3SelectDup(db, p->a[i].pSelect, 0);
001746          pRet->a[i].pCols = sqlite3ExprListDup(db, p->a[i].pCols, 0);
001747          pRet->a[i].zName = sqlite3DbStrDup(db, p->a[i].zName);
001748          pRet->a[i].eM10d = p->a[i].eM10d;
001749        }
001750      }
001751    }
001752    return pRet;
001753  }
001754  #else
001755  # define sqlite3WithDup(x,y) 0
001756  #endif
001757  
001758  #ifndef SQLITE_OMIT_WINDOWFUNC
001759  /*
001760  ** The gatherSelectWindows() procedure and its helper routine
001761  ** gatherSelectWindowsCallback() are used to scan all the expressions
001762  ** an a newly duplicated SELECT statement and gather all of the Window
001763  ** objects found there, assembling them onto the linked list at Select->pWin.
001764  */
001765  static int gatherSelectWindowsCallback(Walker *pWalker, Expr *pExpr){
001766    if( pExpr->op==TK_FUNCTION && ExprHasProperty(pExpr, EP_WinFunc) ){
001767      Select *pSelect = pWalker->u.pSelect;
001768      Window *pWin = pExpr->y.pWin;
001769      assert( pWin );
001770      assert( IsWindowFunc(pExpr) );
001771      assert( pWin->ppThis==0 );
001772      sqlite3WindowLink(pSelect, pWin);
001773    }
001774    return WRC_Continue;
001775  }
001776  static int gatherSelectWindowsSelectCallback(Walker *pWalker, Select *p){
001777    return p==pWalker->u.pSelect ? WRC_Continue : WRC_Prune;
001778  }
001779  static void gatherSelectWindows(Select *p){
001780    Walker w;
001781    w.xExprCallback = gatherSelectWindowsCallback;
001782    w.xSelectCallback = gatherSelectWindowsSelectCallback;
001783    w.xSelectCallback2 = 0;
001784    w.pParse = 0;
001785    w.u.pSelect = p;
001786    sqlite3WalkSelect(&w, p);
001787  }
001788  #endif
001789  
001790  
001791  /*
001792  ** The following group of routines make deep copies of expressions,
001793  ** expression lists, ID lists, and select statements.  The copies can
001794  ** be deleted (by being passed to their respective ...Delete() routines)
001795  ** without effecting the originals.
001796  **
001797  ** The expression list, ID, and source lists return by sqlite3ExprListDup(),
001798  ** sqlite3IdListDup(), and sqlite3SrcListDup() can not be further expanded
001799  ** by subsequent calls to sqlite*ListAppend() routines.
001800  **
001801  ** Any tables that the SrcList might point to are not duplicated.
001802  **
001803  ** The flags parameter contains a combination of the EXPRDUP_XXX flags.
001804  ** If the EXPRDUP_REDUCE flag is set, then the structure returned is a
001805  ** truncated version of the usual Expr structure that will be stored as
001806  ** part of the in-memory representation of the database schema.
001807  */
001808  Expr *sqlite3ExprDup(sqlite3 *db, const Expr *p, int flags){
001809    assert( flags==0 || flags==EXPRDUP_REDUCE );
001810    return p ? exprDup(db, p, flags, 0) : 0;
001811  }
001812  ExprList *sqlite3ExprListDup(sqlite3 *db, const ExprList *p, int flags){
001813    ExprList *pNew;
001814    struct ExprList_item *pItem;
001815    const struct ExprList_item *pOldItem;
001816    int i;
001817    Expr *pPriorSelectColOld = 0;
001818    Expr *pPriorSelectColNew = 0;
001819    assert( db!=0 );
001820    if( p==0 ) return 0;
001821    pNew = sqlite3DbMallocRawNN(db, sqlite3DbMallocSize(db, p));
001822    if( pNew==0 ) return 0;
001823    pNew->nExpr = p->nExpr;
001824    pNew->nAlloc = p->nAlloc;
001825    pItem = pNew->a;
001826    pOldItem = p->a;
001827    for(i=0; i<p->nExpr; i++, pItem++, pOldItem++){
001828      Expr *pOldExpr = pOldItem->pExpr;
001829      Expr *pNewExpr;
001830      pItem->pExpr = sqlite3ExprDup(db, pOldExpr, flags);
001831      if( pOldExpr
001832       && pOldExpr->op==TK_SELECT_COLUMN
001833       && (pNewExpr = pItem->pExpr)!=0
001834      ){
001835        if( pNewExpr->pRight ){
001836          pPriorSelectColOld = pOldExpr->pRight;
001837          pPriorSelectColNew = pNewExpr->pRight;
001838          pNewExpr->pLeft = pNewExpr->pRight;
001839        }else{
001840          if( pOldExpr->pLeft!=pPriorSelectColOld ){
001841            pPriorSelectColOld = pOldExpr->pLeft;
001842            pPriorSelectColNew = sqlite3ExprDup(db, pPriorSelectColOld, flags);
001843            pNewExpr->pRight = pPriorSelectColNew;
001844          }
001845          pNewExpr->pLeft = pPriorSelectColNew;
001846        }
001847      }
001848      pItem->zEName = sqlite3DbStrDup(db, pOldItem->zEName);
001849      pItem->fg = pOldItem->fg;
001850      pItem->fg.done = 0;
001851      pItem->u = pOldItem->u;
001852    }
001853    return pNew;
001854  }
001855  
001856  /*
001857  ** If cursors, triggers, views and subqueries are all omitted from
001858  ** the build, then none of the following routines, except for
001859  ** sqlite3SelectDup(), can be called. sqlite3SelectDup() is sometimes
001860  ** called with a NULL argument.
001861  */
001862  #if !defined(SQLITE_OMIT_VIEW) || !defined(SQLITE_OMIT_TRIGGER) \
001863   || !defined(SQLITE_OMIT_SUBQUERY)
001864  SrcList *sqlite3SrcListDup(sqlite3 *db, const SrcList *p, int flags){
001865    SrcList *pNew;
001866    int i;
001867    int nByte;
001868    assert( db!=0 );
001869    if( p==0 ) return 0;
001870    nByte = sizeof(*p) + (p->nSrc>0 ? sizeof(p->a[0]) * (p->nSrc-1) : 0);
001871    pNew = sqlite3DbMallocRawNN(db, nByte );
001872    if( pNew==0 ) return 0;
001873    pNew->nSrc = pNew->nAlloc = p->nSrc;
001874    for(i=0; i<p->nSrc; i++){
001875      SrcItem *pNewItem = &pNew->a[i];
001876      const SrcItem *pOldItem = &p->a[i];
001877      Table *pTab;
001878      pNewItem->pSchema = pOldItem->pSchema;
001879      pNewItem->zDatabase = sqlite3DbStrDup(db, pOldItem->zDatabase);
001880      pNewItem->zName = sqlite3DbStrDup(db, pOldItem->zName);
001881      pNewItem->zAlias = sqlite3DbStrDup(db, pOldItem->zAlias);
001882      pNewItem->fg = pOldItem->fg;
001883      pNewItem->iCursor = pOldItem->iCursor;
001884      pNewItem->addrFillSub = pOldItem->addrFillSub;
001885      pNewItem->regReturn = pOldItem->regReturn;
001886      pNewItem->regResult = pOldItem->regResult;
001887      if( pNewItem->fg.isIndexedBy ){
001888        pNewItem->u1.zIndexedBy = sqlite3DbStrDup(db, pOldItem->u1.zIndexedBy);
001889      }else if( pNewItem->fg.isTabFunc ){
001890        pNewItem->u1.pFuncArg =
001891            sqlite3ExprListDup(db, pOldItem->u1.pFuncArg, flags);
001892      }else{
001893        pNewItem->u1.nRow = pOldItem->u1.nRow;
001894      }
001895      pNewItem->u2 = pOldItem->u2;
001896      if( pNewItem->fg.isCte ){
001897        pNewItem->u2.pCteUse->nUse++;
001898      }
001899      pTab = pNewItem->pTab = pOldItem->pTab;
001900      if( pTab ){
001901        pTab->nTabRef++;
001902      }
001903      pNewItem->pSelect = sqlite3SelectDup(db, pOldItem->pSelect, flags);
001904      if( pOldItem->fg.isUsing ){
001905        assert( pNewItem->fg.isUsing );
001906        pNewItem->u3.pUsing = sqlite3IdListDup(db, pOldItem->u3.pUsing);
001907      }else{
001908        pNewItem->u3.pOn = sqlite3ExprDup(db, pOldItem->u3.pOn, flags);
001909      }
001910      pNewItem->colUsed = pOldItem->colUsed;
001911    }
001912    return pNew;
001913  }
001914  IdList *sqlite3IdListDup(sqlite3 *db, const IdList *p){
001915    IdList *pNew;
001916    int i;
001917    assert( db!=0 );
001918    if( p==0 ) return 0;
001919    assert( p->eU4!=EU4_EXPR );
001920    pNew = sqlite3DbMallocRawNN(db, sizeof(*pNew)+(p->nId-1)*sizeof(p->a[0]) );
001921    if( pNew==0 ) return 0;
001922    pNew->nId = p->nId;
001923    pNew->eU4 = p->eU4;
001924    for(i=0; i<p->nId; i++){
001925      struct IdList_item *pNewItem = &pNew->a[i];
001926      const struct IdList_item *pOldItem = &p->a[i];
001927      pNewItem->zName = sqlite3DbStrDup(db, pOldItem->zName);
001928      pNewItem->u4 = pOldItem->u4;
001929    }
001930    return pNew;
001931  }
001932  Select *sqlite3SelectDup(sqlite3 *db, const Select *pDup, int flags){
001933    Select *pRet = 0;
001934    Select *pNext = 0;
001935    Select **pp = &pRet;
001936    const Select *p;
001937  
001938    assert( db!=0 );
001939    for(p=pDup; p; p=p->pPrior){
001940      Select *pNew = sqlite3DbMallocRawNN(db, sizeof(*p) );
001941      if( pNew==0 ) break;
001942      pNew->pEList = sqlite3ExprListDup(db, p->pEList, flags);
001943      pNew->pSrc = sqlite3SrcListDup(db, p->pSrc, flags);
001944      pNew->pWhere = sqlite3ExprDup(db, p->pWhere, flags);
001945      pNew->pGroupBy = sqlite3ExprListDup(db, p->pGroupBy, flags);
001946      pNew->pHaving = sqlite3ExprDup(db, p->pHaving, flags);
001947      pNew->pOrderBy = sqlite3ExprListDup(db, p->pOrderBy, flags);
001948      pNew->op = p->op;
001949      pNew->pNext = pNext;
001950      pNew->pPrior = 0;
001951      pNew->pLimit = sqlite3ExprDup(db, p->pLimit, flags);
001952      pNew->iLimit = 0;
001953      pNew->iOffset = 0;
001954      pNew->selFlags = p->selFlags & ~SF_UsesEphemeral;
001955      pNew->addrOpenEphm[0] = -1;
001956      pNew->addrOpenEphm[1] = -1;
001957      pNew->nSelectRow = p->nSelectRow;
001958      pNew->pWith = sqlite3WithDup(db, p->pWith);
001959  #ifndef SQLITE_OMIT_WINDOWFUNC
001960      pNew->pWin = 0;
001961      pNew->pWinDefn = sqlite3WindowListDup(db, p->pWinDefn);
001962      if( p->pWin && db->mallocFailed==0 ) gatherSelectWindows(pNew);
001963  #endif
001964      pNew->selId = p->selId;
001965      if( db->mallocFailed ){
001966        /* Any prior OOM might have left the Select object incomplete.
001967        ** Delete the whole thing rather than allow an incomplete Select
001968        ** to be used by the code generator. */
001969        pNew->pNext = 0;
001970        sqlite3SelectDelete(db, pNew);
001971        break;
001972      }
001973      *pp = pNew;
001974      pp = &pNew->pPrior;
001975      pNext = pNew;
001976    }
001977  
001978    return pRet;
001979  }
001980  #else
001981  Select *sqlite3SelectDup(sqlite3 *db, const Select *p, int flags){
001982    assert( p==0 );
001983    return 0;
001984  }
001985  #endif
001986  
001987  
001988  /*
001989  ** Add a new element to the end of an expression list.  If pList is
001990  ** initially NULL, then create a new expression list.
001991  **
001992  ** The pList argument must be either NULL or a pointer to an ExprList
001993  ** obtained from a prior call to sqlite3ExprListAppend().
001994  **
001995  ** If a memory allocation error occurs, the entire list is freed and
001996  ** NULL is returned.  If non-NULL is returned, then it is guaranteed
001997  ** that the new entry was successfully appended.
001998  */
001999  static const struct ExprList_item zeroItem = {0};
002000  SQLITE_NOINLINE ExprList *sqlite3ExprListAppendNew(
002001    sqlite3 *db,            /* Database handle.  Used for memory allocation */
002002    Expr *pExpr             /* Expression to be appended. Might be NULL */
002003  ){
002004    struct ExprList_item *pItem;
002005    ExprList *pList;
002006  
002007    pList = sqlite3DbMallocRawNN(db, sizeof(ExprList)+sizeof(pList->a[0])*4 );
002008    if( pList==0 ){
002009      sqlite3ExprDelete(db, pExpr);
002010      return 0;
002011    }
002012    pList->nAlloc = 4;
002013    pList->nExpr = 1;
002014    pItem = &pList->a[0];
002015    *pItem = zeroItem;
002016    pItem->pExpr = pExpr;
002017    return pList;
002018  }
002019  SQLITE_NOINLINE ExprList *sqlite3ExprListAppendGrow(
002020    sqlite3 *db,            /* Database handle.  Used for memory allocation */
002021    ExprList *pList,        /* List to which to append. Might be NULL */
002022    Expr *pExpr             /* Expression to be appended. Might be NULL */
002023  ){
002024    struct ExprList_item *pItem;
002025    ExprList *pNew;
002026    pList->nAlloc *= 2;
002027    pNew = sqlite3DbRealloc(db, pList,
002028         sizeof(*pList)+(pList->nAlloc-1)*sizeof(pList->a[0]));
002029    if( pNew==0 ){
002030      sqlite3ExprListDelete(db, pList);
002031      sqlite3ExprDelete(db, pExpr);
002032      return 0;
002033    }else{
002034      pList = pNew;
002035    }
002036    pItem = &pList->a[pList->nExpr++];
002037    *pItem = zeroItem;
002038    pItem->pExpr = pExpr;
002039    return pList;
002040  }
002041  ExprList *sqlite3ExprListAppend(
002042    Parse *pParse,          /* Parsing context */
002043    ExprList *pList,        /* List to which to append. Might be NULL */
002044    Expr *pExpr             /* Expression to be appended. Might be NULL */
002045  ){
002046    struct ExprList_item *pItem;
002047    if( pList==0 ){
002048      return sqlite3ExprListAppendNew(pParse->db,pExpr);
002049    }
002050    if( pList->nAlloc<pList->nExpr+1 ){
002051      return sqlite3ExprListAppendGrow(pParse->db,pList,pExpr);
002052    }
002053    pItem = &pList->a[pList->nExpr++];
002054    *pItem = zeroItem;
002055    pItem->pExpr = pExpr;
002056    return pList;
002057  }
002058  
002059  /*
002060  ** pColumns and pExpr form a vector assignment which is part of the SET
002061  ** clause of an UPDATE statement.  Like this:
002062  **
002063  **        (a,b,c) = (expr1,expr2,expr3)
002064  ** Or:    (a,b,c) = (SELECT x,y,z FROM ....)
002065  **
002066  ** For each term of the vector assignment, append new entries to the
002067  ** expression list pList.  In the case of a subquery on the RHS, append
002068  ** TK_SELECT_COLUMN expressions.
002069  */
002070  ExprList *sqlite3ExprListAppendVector(
002071    Parse *pParse,         /* Parsing context */
002072    ExprList *pList,       /* List to which to append. Might be NULL */
002073    IdList *pColumns,      /* List of names of LHS of the assignment */
002074    Expr *pExpr            /* Vector expression to be appended. Might be NULL */
002075  ){
002076    sqlite3 *db = pParse->db;
002077    int n;
002078    int i;
002079    int iFirst = pList ? pList->nExpr : 0;
002080    /* pColumns can only be NULL due to an OOM but an OOM will cause an
002081    ** exit prior to this routine being invoked */
002082    if( NEVER(pColumns==0) ) goto vector_append_error;
002083    if( pExpr==0 ) goto vector_append_error;
002084  
002085    /* If the RHS is a vector, then we can immediately check to see that
002086    ** the size of the RHS and LHS match.  But if the RHS is a SELECT,
002087    ** wildcards ("*") in the result set of the SELECT must be expanded before
002088    ** we can do the size check, so defer the size check until code generation.
002089    */
002090    if( pExpr->op!=TK_SELECT && pColumns->nId!=(n=sqlite3ExprVectorSize(pExpr)) ){
002091      sqlite3ErrorMsg(pParse, "%d columns assigned %d values",
002092                      pColumns->nId, n);
002093      goto vector_append_error;
002094    }
002095  
002096    for(i=0; i<pColumns->nId; i++){
002097      Expr *pSubExpr = sqlite3ExprForVectorField(pParse, pExpr, i, pColumns->nId);
002098      assert( pSubExpr!=0 || db->mallocFailed );
002099      if( pSubExpr==0 ) continue;
002100      pList = sqlite3ExprListAppend(pParse, pList, pSubExpr);
002101      if( pList ){
002102        assert( pList->nExpr==iFirst+i+1 );
002103        pList->a[pList->nExpr-1].zEName = pColumns->a[i].zName;
002104        pColumns->a[i].zName = 0;
002105      }
002106    }
002107  
002108    if( !db->mallocFailed && pExpr->op==TK_SELECT && ALWAYS(pList!=0) ){
002109      Expr *pFirst = pList->a[iFirst].pExpr;
002110      assert( pFirst!=0 );
002111      assert( pFirst->op==TK_SELECT_COLUMN );
002112      
002113      /* Store the SELECT statement in pRight so it will be deleted when
002114      ** sqlite3ExprListDelete() is called */
002115      pFirst->pRight = pExpr;
002116      pExpr = 0;
002117  
002118      /* Remember the size of the LHS in iTable so that we can check that
002119      ** the RHS and LHS sizes match during code generation. */
002120      pFirst->iTable = pColumns->nId;
002121    }
002122  
002123  vector_append_error:
002124    sqlite3ExprUnmapAndDelete(pParse, pExpr);
002125    sqlite3IdListDelete(db, pColumns);
002126    return pList;
002127  }
002128  
002129  /*
002130  ** Set the sort order for the last element on the given ExprList.
002131  */
002132  void sqlite3ExprListSetSortOrder(ExprList *p, int iSortOrder, int eNulls){
002133    struct ExprList_item *pItem;
002134    if( p==0 ) return;
002135    assert( p->nExpr>0 );
002136  
002137    assert( SQLITE_SO_UNDEFINED<0 && SQLITE_SO_ASC==0 && SQLITE_SO_DESC>0 );
002138    assert( iSortOrder==SQLITE_SO_UNDEFINED
002139         || iSortOrder==SQLITE_SO_ASC
002140         || iSortOrder==SQLITE_SO_DESC
002141    );
002142    assert( eNulls==SQLITE_SO_UNDEFINED
002143         || eNulls==SQLITE_SO_ASC
002144         || eNulls==SQLITE_SO_DESC
002145    );
002146  
002147    pItem = &p->a[p->nExpr-1];
002148    assert( pItem->fg.bNulls==0 );
002149    if( iSortOrder==SQLITE_SO_UNDEFINED ){
002150      iSortOrder = SQLITE_SO_ASC;
002151    }
002152    pItem->fg.sortFlags = (u8)iSortOrder;
002153  
002154    if( eNulls!=SQLITE_SO_UNDEFINED ){
002155      pItem->fg.bNulls = 1;
002156      if( iSortOrder!=eNulls ){
002157        pItem->fg.sortFlags |= KEYINFO_ORDER_BIGNULL;
002158      }
002159    }
002160  }
002161  
002162  /*
002163  ** Set the ExprList.a[].zEName element of the most recently added item
002164  ** on the expression list.
002165  **
002166  ** pList might be NULL following an OOM error.  But pName should never be
002167  ** NULL.  If a memory allocation fails, the pParse->db->mallocFailed flag
002168  ** is set.
002169  */
002170  void sqlite3ExprListSetName(
002171    Parse *pParse,          /* Parsing context */
002172    ExprList *pList,        /* List to which to add the span. */
002173    const Token *pName,     /* Name to be added */
002174    int dequote             /* True to cause the name to be dequoted */
002175  ){
002176    assert( pList!=0 || pParse->db->mallocFailed!=0 );
002177    assert( pParse->eParseMode!=PARSE_MODE_UNMAP || dequote==0 );
002178    if( pList ){
002179      struct ExprList_item *pItem;
002180      assert( pList->nExpr>0 );
002181      pItem = &pList->a[pList->nExpr-1];
002182      assert( pItem->zEName==0 );
002183      assert( pItem->fg.eEName==ENAME_NAME );
002184      pItem->zEName = sqlite3DbStrNDup(pParse->db, pName->z, pName->n);
002185      if( dequote ){
002186        /* If dequote==0, then pName->z does not point to part of a DDL
002187        ** statement handled by the parser. And so no token need be added
002188        ** to the token-map.  */
002189        sqlite3Dequote(pItem->zEName);
002190        if( IN_RENAME_OBJECT ){
002191          sqlite3RenameTokenMap(pParse, (const void*)pItem->zEName, pName);
002192        }
002193      }
002194    }
002195  }
002196  
002197  /*
002198  ** Set the ExprList.a[].zSpan element of the most recently added item
002199  ** on the expression list.
002200  **
002201  ** pList might be NULL following an OOM error.  But pSpan should never be
002202  ** NULL.  If a memory allocation fails, the pParse->db->mallocFailed flag
002203  ** is set.
002204  */
002205  void sqlite3ExprListSetSpan(
002206    Parse *pParse,          /* Parsing context */
002207    ExprList *pList,        /* List to which to add the span. */
002208    const char *zStart,     /* Start of the span */
002209    const char *zEnd        /* End of the span */
002210  ){
002211    sqlite3 *db = pParse->db;
002212    assert( pList!=0 || db->mallocFailed!=0 );
002213    if( pList ){
002214      struct ExprList_item *pItem = &pList->a[pList->nExpr-1];
002215      assert( pList->nExpr>0 );
002216      if( pItem->zEName==0 ){
002217        pItem->zEName = sqlite3DbSpanDup(db, zStart, zEnd);
002218        pItem->fg.eEName = ENAME_SPAN;
002219      }
002220    }
002221  }
002222  
002223  /*
002224  ** If the expression list pEList contains more than iLimit elements,
002225  ** leave an error message in pParse.
002226  */
002227  void sqlite3ExprListCheckLength(
002228    Parse *pParse,
002229    ExprList *pEList,
002230    const char *zObject
002231  ){
002232    int mx = pParse->db->aLimit[SQLITE_LIMIT_COLUMN];
002233    testcase( pEList && pEList->nExpr==mx );
002234    testcase( pEList && pEList->nExpr==mx+1 );
002235    if( pEList && pEList->nExpr>mx ){
002236      sqlite3ErrorMsg(pParse, "too many columns in %s", zObject);
002237    }
002238  }
002239  
002240  /*
002241  ** Delete an entire expression list.
002242  */
002243  static SQLITE_NOINLINE void exprListDeleteNN(sqlite3 *db, ExprList *pList){
002244    int i = pList->nExpr;
002245    struct ExprList_item *pItem =  pList->a;
002246    assert( pList->nExpr>0 );
002247    assert( db!=0 );
002248    do{
002249      sqlite3ExprDelete(db, pItem->pExpr);
002250      if( pItem->zEName ) sqlite3DbNNFreeNN(db, pItem->zEName);
002251      pItem++;
002252    }while( --i>0 );
002253    sqlite3DbNNFreeNN(db, pList);
002254  }
002255  void sqlite3ExprListDelete(sqlite3 *db, ExprList *pList){
002256    if( pList ) exprListDeleteNN(db, pList);
002257  }
002258  void sqlite3ExprListDeleteGeneric(sqlite3 *db, void *pList){
002259    if( ALWAYS(pList) ) exprListDeleteNN(db, (ExprList*)pList);
002260  }
002261  
002262  /*
002263  ** Return the bitwise-OR of all Expr.flags fields in the given
002264  ** ExprList.
002265  */
002266  u32 sqlite3ExprListFlags(const ExprList *pList){
002267    int i;
002268    u32 m = 0;
002269    assert( pList!=0 );
002270    for(i=0; i<pList->nExpr; i++){
002271       Expr *pExpr = pList->a[i].pExpr;
002272       assert( pExpr!=0 );
002273       m |= pExpr->flags;
002274    }
002275    return m;
002276  }
002277  
002278  /*
002279  ** This is a SELECT-node callback for the expression walker that
002280  ** always "fails".  By "fail" in this case, we mean set
002281  ** pWalker->eCode to zero and abort.
002282  **
002283  ** This callback is used by multiple expression walkers.
002284  */
002285  int sqlite3SelectWalkFail(Walker *pWalker, Select *NotUsed){
002286    UNUSED_PARAMETER(NotUsed);
002287    pWalker->eCode = 0;
002288    return WRC_Abort;
002289  }
002290  
002291  /*
002292  ** Check the input string to see if it is "true" or "false" (in any case).
002293  **
002294  **       If the string is....           Return
002295  **         "true"                         EP_IsTrue
002296  **         "false"                        EP_IsFalse
002297  **         anything else                  0
002298  */
002299  u32 sqlite3IsTrueOrFalse(const char *zIn){
002300    if( sqlite3StrICmp(zIn, "true")==0  ) return EP_IsTrue;
002301    if( sqlite3StrICmp(zIn, "false")==0 ) return EP_IsFalse;
002302    return 0;
002303  }
002304  
002305  
002306  /*
002307  ** If the input expression is an ID with the name "true" or "false"
002308  ** then convert it into an TK_TRUEFALSE term.  Return non-zero if
002309  ** the conversion happened, and zero if the expression is unaltered.
002310  */
002311  int sqlite3ExprIdToTrueFalse(Expr *pExpr){
002312    u32 v;
002313    assert( pExpr->op==TK_ID || pExpr->op==TK_STRING );
002314    if( !ExprHasProperty(pExpr, EP_Quoted|EP_IntValue)
002315     && (v = sqlite3IsTrueOrFalse(pExpr->u.zToken))!=0
002316    ){
002317      pExpr->op = TK_TRUEFALSE;
002318      ExprSetProperty(pExpr, v);
002319      return 1;
002320    }
002321    return 0;
002322  }
002323  
002324  /*
002325  ** The argument must be a TK_TRUEFALSE Expr node.  Return 1 if it is TRUE
002326  ** and 0 if it is FALSE.
002327  */
002328  int sqlite3ExprTruthValue(const Expr *pExpr){
002329    pExpr = sqlite3ExprSkipCollateAndLikely((Expr*)pExpr);
002330    assert( pExpr->op==TK_TRUEFALSE );
002331    assert( !ExprHasProperty(pExpr, EP_IntValue) );
002332    assert( sqlite3StrICmp(pExpr->u.zToken,"true")==0
002333         || sqlite3StrICmp(pExpr->u.zToken,"false")==0 );
002334    return pExpr->u.zToken[4]==0;
002335  }
002336  
002337  /*
002338  ** If pExpr is an AND or OR expression, try to simplify it by eliminating
002339  ** terms that are always true or false.  Return the simplified expression.
002340  ** Or return the original expression if no simplification is possible.
002341  **
002342  ** Examples:
002343  **
002344  **     (x<10) AND true                =>   (x<10)
002345  **     (x<10) AND false               =>   false
002346  **     (x<10) AND (y=22 OR false)     =>   (x<10) AND (y=22)
002347  **     (x<10) AND (y=22 OR true)      =>   (x<10)
002348  **     (y=22) OR true                 =>   true
002349  */
002350  Expr *sqlite3ExprSimplifiedAndOr(Expr *pExpr){
002351    assert( pExpr!=0 );
002352    if( pExpr->op==TK_AND || pExpr->op==TK_OR ){
002353      Expr *pRight = sqlite3ExprSimplifiedAndOr(pExpr->pRight);
002354      Expr *pLeft = sqlite3ExprSimplifiedAndOr(pExpr->pLeft);
002355      if( ExprAlwaysTrue(pLeft) || ExprAlwaysFalse(pRight) ){
002356        pExpr = pExpr->op==TK_AND ? pRight : pLeft;
002357      }else if( ExprAlwaysTrue(pRight) || ExprAlwaysFalse(pLeft) ){
002358        pExpr = pExpr->op==TK_AND ? pLeft : pRight;
002359      }
002360    }
002361    return pExpr;
002362  }
002363  
002364  /*
002365  ** pExpr is a TK_FUNCTION node.  Try to determine whether or not the
002366  ** function is a constant function.  A function is constant if all of
002367  ** the following are true:
002368  **
002369  **    (1)  It is a scalar function (not an aggregate or window function)
002370  **    (2)  It has either the SQLITE_FUNC_CONSTANT or SQLITE_FUNC_SLOCHNG
002371  **         property.
002372  **    (3)  All of its arguments are constants
002373  **
002374  ** This routine sets pWalker->eCode to 0 if pExpr is not a constant.
002375  ** It makes no changes to pWalker->eCode if pExpr is constant.  In
002376  ** every case, it returns WRC_Abort.
002377  **
002378  ** Called as a service subroutine from exprNodeIsConstant().
002379  */
002380  static SQLITE_NOINLINE int exprNodeIsConstantFunction(
002381    Walker *pWalker,
002382    Expr *pExpr
002383  ){
002384    int n;             /* Number of arguments */
002385    ExprList *pList;   /* List of arguments */
002386    FuncDef *pDef;     /* The function */
002387    sqlite3 *db;       /* The database */
002388  
002389    assert( pExpr->op==TK_FUNCTION );
002390    if( ExprHasProperty(pExpr, EP_TokenOnly)
002391     || (pList = pExpr->x.pList)==0
002392    ){;
002393      n = 0;
002394    }else{
002395      n = pList->nExpr;
002396      sqlite3WalkExprList(pWalker, pList);
002397      if( pWalker->eCode==0 ) return WRC_Abort;
002398    }
002399    db = pWalker->pParse->db;
002400    pDef = sqlite3FindFunction(db, pExpr->u.zToken, n, ENC(db), 0);
002401    if( pDef==0
002402     || pDef->xFinalize!=0
002403     || (pDef->funcFlags & (SQLITE_FUNC_CONSTANT|SQLITE_FUNC_SLOCHNG))==0
002404     || ExprHasProperty(pExpr, EP_WinFunc)
002405    ){
002406      pWalker->eCode = 0;
002407      return WRC_Abort;
002408    }
002409    return WRC_Prune;
002410  }
002411  
002412  
002413  /*
002414  ** These routines are Walker callbacks used to check expressions to
002415  ** see if they are "constant" for some definition of constant.  The
002416  ** Walker.eCode value determines the type of "constant" we are looking
002417  ** for.
002418  **
002419  ** These callback routines are used to implement the following:
002420  **
002421  **     sqlite3ExprIsConstant()                  pWalker->eCode==1
002422  **     sqlite3ExprIsConstantNotJoin()           pWalker->eCode==2
002423  **     sqlite3ExprIsTableConstant()             pWalker->eCode==3
002424  **     sqlite3ExprIsConstantOrFunction()        pWalker->eCode==4 or 5
002425  **
002426  ** In all cases, the callbacks set Walker.eCode=0 and abort if the expression
002427  ** is found to not be a constant.
002428  **
002429  ** The sqlite3ExprIsConstantOrFunction() is used for evaluating DEFAULT
002430  ** expressions in a CREATE TABLE statement.  The Walker.eCode value is 5
002431  ** when parsing an existing schema out of the sqlite_schema table and 4
002432  ** when processing a new CREATE TABLE statement.  A bound parameter raises
002433  ** an error for new statements, but is silently converted
002434  ** to NULL for existing schemas.  This allows sqlite_schema tables that
002435  ** contain a bound parameter because they were generated by older versions
002436  ** of SQLite to be parsed by newer versions of SQLite without raising a
002437  ** malformed schema error.
002438  */
002439  static int exprNodeIsConstant(Walker *pWalker, Expr *pExpr){
002440    assert( pWalker->eCode>0 );
002441  
002442    /* If pWalker->eCode is 2 then any term of the expression that comes from
002443    ** the ON or USING clauses of an outer join disqualifies the expression
002444    ** from being considered constant. */
002445    if( pWalker->eCode==2 && ExprHasProperty(pExpr, EP_OuterON) ){
002446      pWalker->eCode = 0;
002447      return WRC_Abort;
002448    }
002449  
002450    switch( pExpr->op ){
002451      /* Consider functions to be constant if all their arguments are constant
002452      ** and either pWalker->eCode==4 or 5 or the function has the
002453      ** SQLITE_FUNC_CONST flag. */
002454      case TK_FUNCTION:
002455        if( (pWalker->eCode>=4 || ExprHasProperty(pExpr,EP_ConstFunc))
002456         && !ExprHasProperty(pExpr, EP_WinFunc)
002457        ){
002458          if( pWalker->eCode==5 ) ExprSetProperty(pExpr, EP_FromDDL);
002459          return WRC_Continue;
002460        }else if( pWalker->pParse ){
002461          return exprNodeIsConstantFunction(pWalker, pExpr);
002462        }else{
002463          pWalker->eCode = 0;
002464          return WRC_Abort;
002465        }
002466      case TK_ID:
002467        /* Convert "true" or "false" in a DEFAULT clause into the
002468        ** appropriate TK_TRUEFALSE operator */
002469        if( sqlite3ExprIdToTrueFalse(pExpr) ){
002470          return WRC_Prune;
002471        }
002472        /* no break */ deliberate_fall_through
002473      case TK_COLUMN:
002474      case TK_AGG_FUNCTION:
002475      case TK_AGG_COLUMN:
002476        testcase( pExpr->op==TK_ID );
002477        testcase( pExpr->op==TK_COLUMN );
002478        testcase( pExpr->op==TK_AGG_FUNCTION );
002479        testcase( pExpr->op==TK_AGG_COLUMN );
002480        if( ExprHasProperty(pExpr, EP_FixedCol) && pWalker->eCode!=2 ){
002481          return WRC_Continue;
002482        }
002483        if( pWalker->eCode==3 && pExpr->iTable==pWalker->u.iCur ){
002484          return WRC_Continue;
002485        }
002486        /* no break */ deliberate_fall_through
002487      case TK_IF_NULL_ROW:
002488      case TK_REGISTER:
002489      case TK_DOT:
002490      case TK_RAISE:
002491        testcase( pExpr->op==TK_REGISTER );
002492        testcase( pExpr->op==TK_IF_NULL_ROW );
002493        testcase( pExpr->op==TK_DOT );
002494        testcase( pExpr->op==TK_RAISE );
002495        pWalker->eCode = 0;
002496        return WRC_Abort;
002497      case TK_VARIABLE:
002498        if( pWalker->eCode==5 ){
002499          /* Silently convert bound parameters that appear inside of CREATE
002500          ** statements into a NULL when parsing the CREATE statement text out
002501          ** of the sqlite_schema table */
002502          pExpr->op = TK_NULL;
002503        }else if( pWalker->eCode==4 ){
002504          /* A bound parameter in a CREATE statement that originates from
002505          ** sqlite3_prepare() causes an error */
002506          pWalker->eCode = 0;
002507          return WRC_Abort;
002508        }
002509        /* no break */ deliberate_fall_through
002510      default:
002511        testcase( pExpr->op==TK_SELECT ); /* sqlite3SelectWalkFail() disallows */
002512        testcase( pExpr->op==TK_EXISTS ); /* sqlite3SelectWalkFail() disallows */
002513        return WRC_Continue;
002514    }
002515  }
002516  static int exprIsConst(Parse *pParse, Expr *p, int initFlag){
002517    Walker w;
002518    w.eCode = initFlag;
002519    w.pParse = pParse;
002520    w.xExprCallback = exprNodeIsConstant;
002521    w.xSelectCallback = sqlite3SelectWalkFail;
002522  #ifdef SQLITE_DEBUG
002523    w.xSelectCallback2 = sqlite3SelectWalkAssert2;
002524  #endif
002525    sqlite3WalkExpr(&w, p);
002526    return w.eCode;
002527  }
002528  
002529  /*
002530  ** Walk an expression tree.  Return non-zero if the expression is constant
002531  ** and 0 if it involves variables or function calls.
002532  **
002533  ** For the purposes of this function, a double-quoted string (ex: "abc")
002534  ** is considered a variable but a single-quoted string (ex: 'abc') is
002535  ** a constant.
002536  **
002537  ** The pParse parameter may be NULL.  But if it is NULL, there is no way
002538  ** to determine if function calls are constant or not, and hence all
002539  ** function calls will be considered to be non-constant.  If pParse is
002540  ** not NULL, then a function call might be constant, depending on the
002541  ** function and on its parameters.
002542  */
002543  int sqlite3ExprIsConstant(Parse *pParse, Expr *p){
002544    return exprIsConst(pParse, p, 1);
002545  }
002546  
002547  /*
002548  ** Walk an expression tree.  Return non-zero if
002549  **
002550  **   (1) the expression is constant, and
002551  **   (2) the expression does originate in the ON or USING clause
002552  **       of a LEFT JOIN, and
002553  **   (3) the expression does not contain any EP_FixedCol TK_COLUMN
002554  **       operands created by the constant propagation optimization.
002555  **
002556  ** When this routine returns true, it indicates that the expression
002557  ** can be added to the pParse->pConstExpr list and evaluated once when
002558  ** the prepared statement starts up.  See sqlite3ExprCodeRunJustOnce().
002559  */
002560  static int sqlite3ExprIsConstantNotJoin(Parse *pParse, Expr *p){
002561    return exprIsConst(pParse, p, 2);
002562  }
002563  
002564  /*
002565  ** This routine examines sub-SELECT statements as an expression is being
002566  ** walked as part of sqlite3ExprIsTableConstant().  Sub-SELECTs are considered
002567  ** constant as long as they are uncorrelated - meaning that they do not
002568  ** contain any terms from outer contexts.
002569  */
002570  static int exprSelectWalkTableConstant(Walker *pWalker, Select *pSelect){
002571    assert( pSelect!=0 );
002572    assert( pWalker->eCode==3 || pWalker->eCode==0 );
002573    if( (pSelect->selFlags & SF_Correlated)!=0 ){
002574      pWalker->eCode = 0;
002575      return WRC_Abort;
002576    }
002577    return WRC_Prune;
002578  }
002579  
002580  /*
002581  ** Walk an expression tree.  Return non-zero if the expression is constant
002582  ** for any single row of the table with cursor iCur.  In other words, the
002583  ** expression must not refer to any non-deterministic function nor any
002584  ** table other than iCur.
002585  **
002586  ** Consider uncorrelated subqueries to be constants if the bAllowSubq
002587  ** parameter is true.
002588  */
002589  static int sqlite3ExprIsTableConstant(Expr *p, int iCur, int bAllowSubq){
002590    Walker w;
002591    w.eCode = 3;
002592    w.pParse = 0;
002593    w.xExprCallback = exprNodeIsConstant;
002594    if( bAllowSubq ){
002595      w.xSelectCallback = exprSelectWalkTableConstant;
002596    }else{
002597      w.xSelectCallback = sqlite3SelectWalkFail;
002598  #ifdef SQLITE_DEBUG
002599      w.xSelectCallback2 = sqlite3SelectWalkAssert2;
002600  #endif
002601    }
002602    w.u.iCur = iCur;
002603    sqlite3WalkExpr(&w, p);
002604    return w.eCode;
002605  }
002606  
002607  /*
002608  ** Check pExpr to see if it is an constraint on the single data source
002609  ** pSrc = &pSrcList->a[iSrc].  In other words, check to see if pExpr
002610  ** constrains pSrc but does not depend on any other tables or data
002611  ** sources anywhere else in the query.  Return true (non-zero) if pExpr
002612  ** is a constraint on pSrc only.
002613  **
002614  ** This is an optimization.  False negatives will perhaps cause slower
002615  ** queries, but false positives will yield incorrect answers.  So when in
002616  ** doubt, return 0.
002617  **
002618  ** To be an single-source constraint, the following must be true:
002619  **
002620  **   (1)  pExpr cannot refer to any table other than pSrc->iCursor.
002621  **
002622  **   (2a) pExpr cannot use subqueries unless the bAllowSubq parameter is
002623  **        true and the subquery is non-correlated
002624  **
002625  **   (2b) pExpr cannot use non-deterministic functions.
002626  **
002627  **   (3)  pSrc cannot be part of the left operand for a RIGHT JOIN.
002628  **        (Is there some way to relax this constraint?)
002629  **
002630  **   (4)  If pSrc is the right operand of a LEFT JOIN, then...
002631  **         (4a)  pExpr must come from an ON clause..
002632  **         (4b)  and specifically the ON clause associated with the LEFT JOIN.
002633  **
002634  **   (5)  If pSrc is not the right operand of a LEFT JOIN or the left
002635  **        operand of a RIGHT JOIN, then pExpr must be from the WHERE
002636  **        clause, not an ON clause.
002637  **
002638  **   (6) Either:
002639  **
002640  **       (6a) pExpr does not originate in an ON or USING clause, or
002641  **
002642  **       (6b) The ON or USING clause from which pExpr is derived is
002643  **            not to the left of a RIGHT JOIN (or FULL JOIN).
002644  **
002645  **       Without this restriction, accepting pExpr as a single-table
002646  **       constraint might move the the ON/USING filter expression
002647  **       from the left side of a RIGHT JOIN over to the right side,
002648  **       which leads to incorrect answers.  See also restriction (9)
002649  **       on push-down.
002650  */
002651  int sqlite3ExprIsSingleTableConstraint(
002652    Expr *pExpr,                 /* The constraint */
002653    const SrcList *pSrcList,     /* Complete FROM clause */
002654    int iSrc,                    /* Which element of pSrcList to use */
002655    int bAllowSubq               /* Allow non-correlated subqueries */
002656  ){
002657    const SrcItem *pSrc = &pSrcList->a[iSrc];
002658    if( pSrc->fg.jointype & JT_LTORJ ){
002659      return 0;  /* rule (3) */
002660    }
002661    if( pSrc->fg.jointype & JT_LEFT ){
002662      if( !ExprHasProperty(pExpr, EP_OuterON) ) return 0;   /* rule (4a) */
002663      if( pExpr->w.iJoin!=pSrc->iCursor ) return 0;         /* rule (4b) */
002664    }else{
002665      if( ExprHasProperty(pExpr, EP_OuterON) ) return 0;    /* rule (5) */
002666    }
002667    if( ExprHasProperty(pExpr, EP_OuterON|EP_InnerON)  /* (6a) */
002668     && (pSrcList->a[0].fg.jointype & JT_LTORJ)!=0     /* Fast pre-test of (6b) */
002669    ){
002670      int jj;
002671      for(jj=0; jj<iSrc; jj++){
002672        if( pExpr->w.iJoin==pSrcList->a[jj].iCursor ){
002673          if( (pSrcList->a[jj].fg.jointype & JT_LTORJ)!=0 ){
002674            return 0;  /* restriction (6) */
002675          }
002676          break;
002677        }
002678      }
002679    }
002680    /* Rules (1), (2a), and (2b) handled by the following: */
002681    return sqlite3ExprIsTableConstant(pExpr, pSrc->iCursor, bAllowSubq);
002682  }
002683  
002684  
002685  /*
002686  ** sqlite3WalkExpr() callback used by sqlite3ExprIsConstantOrGroupBy().
002687  */
002688  static int exprNodeIsConstantOrGroupBy(Walker *pWalker, Expr *pExpr){
002689    ExprList *pGroupBy = pWalker->u.pGroupBy;
002690    int i;
002691  
002692    /* Check if pExpr is identical to any GROUP BY term. If so, consider
002693    ** it constant.  */
002694    for(i=0; i<pGroupBy->nExpr; i++){
002695      Expr *p = pGroupBy->a[i].pExpr;
002696      if( sqlite3ExprCompare(0, pExpr, p, -1)<2 ){
002697        CollSeq *pColl = sqlite3ExprNNCollSeq(pWalker->pParse, p);
002698        if( sqlite3IsBinary(pColl) ){
002699          return WRC_Prune;
002700        }
002701      }
002702    }
002703  
002704    /* Check if pExpr is a sub-select. If so, consider it variable. */
002705    if( ExprUseXSelect(pExpr) ){
002706      pWalker->eCode = 0;
002707      return WRC_Abort;
002708    }
002709  
002710    return exprNodeIsConstant(pWalker, pExpr);
002711  }
002712  
002713  /*
002714  ** Walk the expression tree passed as the first argument. Return non-zero
002715  ** if the expression consists entirely of constants or copies of terms
002716  ** in pGroupBy that sort with the BINARY collation sequence.
002717  **
002718  ** This routine is used to determine if a term of the HAVING clause can
002719  ** be promoted into the WHERE clause.  In order for such a promotion to work,
002720  ** the value of the HAVING clause term must be the same for all members of
002721  ** a "group".  The requirement that the GROUP BY term must be BINARY
002722  ** assumes that no other collating sequence will have a finer-grained
002723  ** grouping than binary.  In other words (A=B COLLATE binary) implies
002724  ** A=B in every other collating sequence.  The requirement that the
002725  ** GROUP BY be BINARY is stricter than necessary.  It would also work
002726  ** to promote HAVING clauses that use the same alternative collating
002727  ** sequence as the GROUP BY term, but that is much harder to check,
002728  ** alternative collating sequences are uncommon, and this is only an
002729  ** optimization, so we take the easy way out and simply require the
002730  ** GROUP BY to use the BINARY collating sequence.
002731  */
002732  int sqlite3ExprIsConstantOrGroupBy(Parse *pParse, Expr *p, ExprList *pGroupBy){
002733    Walker w;
002734    w.eCode = 1;
002735    w.xExprCallback = exprNodeIsConstantOrGroupBy;
002736    w.xSelectCallback = 0;
002737    w.u.pGroupBy = pGroupBy;
002738    w.pParse = pParse;
002739    sqlite3WalkExpr(&w, p);
002740    return w.eCode;
002741  }
002742  
002743  /*
002744  ** Walk an expression tree for the DEFAULT field of a column definition
002745  ** in a CREATE TABLE statement.  Return non-zero if the expression is
002746  ** acceptable for use as a DEFAULT.  That is to say, return non-zero if
002747  ** the expression is constant or a function call with constant arguments.
002748  ** Return and 0 if there are any variables.
002749  **
002750  ** isInit is true when parsing from sqlite_schema.  isInit is false when
002751  ** processing a new CREATE TABLE statement.  When isInit is true, parameters
002752  ** (such as ? or $abc) in the expression are converted into NULL.  When
002753  ** isInit is false, parameters raise an error.  Parameters should not be
002754  ** allowed in a CREATE TABLE statement, but some legacy versions of SQLite
002755  ** allowed it, so we need to support it when reading sqlite_schema for
002756  ** backwards compatibility.
002757  **
002758  ** If isInit is true, set EP_FromDDL on every TK_FUNCTION node.
002759  **
002760  ** For the purposes of this function, a double-quoted string (ex: "abc")
002761  ** is considered a variable but a single-quoted string (ex: 'abc') is
002762  ** a constant.
002763  */
002764  int sqlite3ExprIsConstantOrFunction(Expr *p, u8 isInit){
002765    assert( isInit==0 || isInit==1 );
002766    return exprIsConst(0, p, 4+isInit);
002767  }
002768  
002769  #ifdef SQLITE_ENABLE_CURSOR_HINTS
002770  /*
002771  ** Walk an expression tree.  Return 1 if the expression contains a
002772  ** subquery of some kind.  Return 0 if there are no subqueries.
002773  */
002774  int sqlite3ExprContainsSubquery(Expr *p){
002775    Walker w;
002776    w.eCode = 1;
002777    w.xExprCallback = sqlite3ExprWalkNoop;
002778    w.xSelectCallback = sqlite3SelectWalkFail;
002779  #ifdef SQLITE_DEBUG
002780    w.xSelectCallback2 = sqlite3SelectWalkAssert2;
002781  #endif
002782    sqlite3WalkExpr(&w, p);
002783    return w.eCode==0;
002784  }
002785  #endif
002786  
002787  /*
002788  ** If the expression p codes a constant integer that is small enough
002789  ** to fit in a 32-bit integer, return 1 and put the value of the integer
002790  ** in *pValue.  If the expression is not an integer or if it is too big
002791  ** to fit in a signed 32-bit integer, return 0 and leave *pValue unchanged.
002792  */
002793  int sqlite3ExprIsInteger(const Expr *p, int *pValue){
002794    int rc = 0;
002795    if( NEVER(p==0) ) return 0;  /* Used to only happen following on OOM */
002796  
002797    /* If an expression is an integer literal that fits in a signed 32-bit
002798    ** integer, then the EP_IntValue flag will have already been set */
002799    assert( p->op!=TK_INTEGER || (p->flags & EP_IntValue)!=0
002800             || sqlite3GetInt32(p->u.zToken, &rc)==0 );
002801  
002802    if( p->flags & EP_IntValue ){
002803      *pValue = p->u.iValue;
002804      return 1;
002805    }
002806    switch( p->op ){
002807      case TK_UPLUS: {
002808        rc = sqlite3ExprIsInteger(p->pLeft, pValue);
002809        break;
002810      }
002811      case TK_UMINUS: {
002812        int v = 0;
002813        if( sqlite3ExprIsInteger(p->pLeft, &v) ){
002814          assert( ((unsigned int)v)!=0x80000000 );
002815          *pValue = -v;
002816          rc = 1;
002817        }
002818        break;
002819      }
002820      default: break;
002821    }
002822    return rc;
002823  }
002824  
002825  /*
002826  ** Return FALSE if there is no chance that the expression can be NULL.
002827  **
002828  ** If the expression might be NULL or if the expression is too complex
002829  ** to tell return TRUE. 
002830  **
002831  ** This routine is used as an optimization, to skip OP_IsNull opcodes
002832  ** when we know that a value cannot be NULL.  Hence, a false positive
002833  ** (returning TRUE when in fact the expression can never be NULL) might
002834  ** be a small performance hit but is otherwise harmless.  On the other
002835  ** hand, a false negative (returning FALSE when the result could be NULL)
002836  ** will likely result in an incorrect answer.  So when in doubt, return
002837  ** TRUE.
002838  */
002839  int sqlite3ExprCanBeNull(const Expr *p){
002840    u8 op;
002841    assert( p!=0 );
002842    while( p->op==TK_UPLUS || p->op==TK_UMINUS ){
002843      p = p->pLeft;
002844      assert( p!=0 );
002845    }
002846    op = p->op;
002847    if( op==TK_REGISTER ) op = p->op2;
002848    switch( op ){
002849      case TK_INTEGER:
002850      case TK_STRING:
002851      case TK_FLOAT:
002852      case TK_BLOB:
002853        return 0;
002854      case TK_COLUMN:
002855        assert( ExprUseYTab(p) );
002856        return ExprHasProperty(p, EP_CanBeNull)
002857            || NEVER(p->y.pTab==0) /* Reference to column of index on expr */
002858  #ifdef SQLITE_ALLOW_ROWID_IN_VIEW
002859            || (p->iColumn==XN_ROWID && IsView(p->y.pTab))
002860  #endif
002861            || (p->iColumn>=0
002862                && p->y.pTab->aCol!=0 /* Possible due to prior error */
002863                && ALWAYS(p->iColumn<p->y.pTab->nCol)
002864                && p->y.pTab->aCol[p->iColumn].notNull==0);
002865      default:
002866        return 1;
002867    }
002868  }
002869  
002870  /*
002871  ** Return TRUE if the given expression is a constant which would be
002872  ** unchanged by OP_Affinity with the affinity given in the second
002873  ** argument.
002874  **
002875  ** This routine is used to determine if the OP_Affinity operation
002876  ** can be omitted.  When in doubt return FALSE.  A false negative
002877  ** is harmless.  A false positive, however, can result in the wrong
002878  ** answer.
002879  */
002880  int sqlite3ExprNeedsNoAffinityChange(const Expr *p, char aff){
002881    u8 op;
002882    int unaryMinus = 0;
002883    if( aff==SQLITE_AFF_BLOB ) return 1;
002884    while( p->op==TK_UPLUS || p->op==TK_UMINUS ){
002885      if( p->op==TK_UMINUS ) unaryMinus = 1;
002886      p = p->pLeft;
002887    }
002888    op = p->op;
002889    if( op==TK_REGISTER ) op = p->op2;
002890    switch( op ){
002891      case TK_INTEGER: {
002892        return aff>=SQLITE_AFF_NUMERIC;
002893      }
002894      case TK_FLOAT: {
002895        return aff>=SQLITE_AFF_NUMERIC;
002896      }
002897      case TK_STRING: {
002898        return !unaryMinus && aff==SQLITE_AFF_TEXT;
002899      }
002900      case TK_BLOB: {
002901        return !unaryMinus;
002902      }
002903      case TK_COLUMN: {
002904        assert( p->iTable>=0 );  /* p cannot be part of a CHECK constraint */
002905        return aff>=SQLITE_AFF_NUMERIC && p->iColumn<0;
002906      }
002907      default: {
002908        return 0;
002909      }
002910    }
002911  }
002912  
002913  /*
002914  ** Return TRUE if the given string is a row-id column name.
002915  */
002916  int sqlite3IsRowid(const char *z){
002917    if( sqlite3StrICmp(z, "_ROWID_")==0 ) return 1;
002918    if( sqlite3StrICmp(z, "ROWID")==0 ) return 1;
002919    if( sqlite3StrICmp(z, "OID")==0 ) return 1;
002920    return 0;
002921  }
002922  
002923  /*
002924  ** Return a pointer to a buffer containing a usable rowid alias for table
002925  ** pTab. An alias is usable if there is not an explicit user-defined column 
002926  ** of the same name.
002927  */
002928  const char *sqlite3RowidAlias(Table *pTab){
002929    const char *azOpt[] = {"_ROWID_", "ROWID", "OID"};
002930    int ii;
002931    assert( VisibleRowid(pTab) );
002932    for(ii=0; ii<ArraySize(azOpt); ii++){
002933      int iCol;
002934      for(iCol=0; iCol<pTab->nCol; iCol++){
002935        if( sqlite3_stricmp(azOpt[ii], pTab->aCol[iCol].zCnName)==0 ) break;
002936      }
002937      if( iCol==pTab->nCol ){
002938        return azOpt[ii];
002939      }
002940    }
002941    return 0;
002942  }
002943  
002944  /*
002945  ** pX is the RHS of an IN operator.  If pX is a SELECT statement
002946  ** that can be simplified to a direct table access, then return
002947  ** a pointer to the SELECT statement.  If pX is not a SELECT statement,
002948  ** or if the SELECT statement needs to be materialized into a transient
002949  ** table, then return NULL.
002950  */
002951  #ifndef SQLITE_OMIT_SUBQUERY
002952  static Select *isCandidateForInOpt(const Expr *pX){
002953    Select *p;
002954    SrcList *pSrc;
002955    ExprList *pEList;
002956    Table *pTab;
002957    int i;
002958    if( !ExprUseXSelect(pX) ) return 0;                 /* Not a subquery */
002959    if( ExprHasProperty(pX, EP_VarSelect)  ) return 0;  /* Correlated subq */
002960    p = pX->x.pSelect;
002961    if( p->pPrior ) return 0;              /* Not a compound SELECT */
002962    if( p->selFlags & (SF_Distinct|SF_Aggregate) ){
002963      testcase( (p->selFlags & (SF_Distinct|SF_Aggregate))==SF_Distinct );
002964      testcase( (p->selFlags & (SF_Distinct|SF_Aggregate))==SF_Aggregate );
002965      return 0; /* No DISTINCT keyword and no aggregate functions */
002966    }
002967    assert( p->pGroupBy==0 );              /* Has no GROUP BY clause */
002968    if( p->pLimit ) return 0;              /* Has no LIMIT clause */
002969    if( p->pWhere ) return 0;              /* Has no WHERE clause */
002970    pSrc = p->pSrc;
002971    assert( pSrc!=0 );
002972    if( pSrc->nSrc!=1 ) return 0;          /* Single term in FROM clause */
002973    if( pSrc->a[0].pSelect ) return 0;     /* FROM is not a subquery or view */
002974    pTab = pSrc->a[0].pTab;
002975    assert( pTab!=0 );
002976    assert( !IsView(pTab)  );              /* FROM clause is not a view */
002977    if( IsVirtual(pTab) ) return 0;        /* FROM clause not a virtual table */
002978    pEList = p->pEList;
002979    assert( pEList!=0 );
002980    /* All SELECT results must be columns. */
002981    for(i=0; i<pEList->nExpr; i++){
002982      Expr *pRes = pEList->a[i].pExpr;
002983      if( pRes->op!=TK_COLUMN ) return 0;
002984      assert( pRes->iTable==pSrc->a[0].iCursor );  /* Not a correlated subquery */
002985    }
002986    return p;
002987  }
002988  #endif /* SQLITE_OMIT_SUBQUERY */
002989  
002990  #ifndef SQLITE_OMIT_SUBQUERY
002991  /*
002992  ** Generate code that checks the left-most column of index table iCur to see if
002993  ** it contains any NULL entries.  Cause the register at regHasNull to be set
002994  ** to a non-NULL value if iCur contains no NULLs.  Cause register regHasNull
002995  ** to be set to NULL if iCur contains one or more NULL values.
002996  */
002997  static void sqlite3SetHasNullFlag(Vdbe *v, int iCur, int regHasNull){
002998    int addr1;
002999    sqlite3VdbeAddOp2(v, OP_Integer, 0, regHasNull);
003000    addr1 = sqlite3VdbeAddOp1(v, OP_Rewind, iCur); VdbeCoverage(v);
003001    sqlite3VdbeAddOp3(v, OP_Column, iCur, 0, regHasNull);
003002    sqlite3VdbeChangeP5(v, OPFLAG_TYPEOFARG);
003003    VdbeComment((v, "first_entry_in(%d)", iCur));
003004    sqlite3VdbeJumpHere(v, addr1);
003005  }
003006  #endif
003007  
003008  
003009  #ifndef SQLITE_OMIT_SUBQUERY
003010  /*
003011  ** The argument is an IN operator with a list (not a subquery) on the
003012  ** right-hand side.  Return TRUE if that list is constant.
003013  */
003014  static int sqlite3InRhsIsConstant(Parse *pParse, Expr *pIn){
003015    Expr *pLHS;
003016    int res;
003017    assert( !ExprHasProperty(pIn, EP_xIsSelect) );
003018    pLHS = pIn->pLeft;
003019    pIn->pLeft = 0;
003020    res = sqlite3ExprIsConstant(pParse, pIn);
003021    pIn->pLeft = pLHS;
003022    return res;
003023  }
003024  #endif
003025  
003026  /*
003027  ** This function is used by the implementation of the IN (...) operator.
003028  ** The pX parameter is the expression on the RHS of the IN operator, which
003029  ** might be either a list of expressions or a subquery.
003030  **
003031  ** The job of this routine is to find or create a b-tree object that can
003032  ** be used either to test for membership in the RHS set or to iterate through
003033  ** all members of the RHS set, skipping duplicates.
003034  **
003035  ** A cursor is opened on the b-tree object that is the RHS of the IN operator
003036  ** and the *piTab parameter is set to the index of that cursor.
003037  **
003038  ** The returned value of this function indicates the b-tree type, as follows:
003039  **
003040  **   IN_INDEX_ROWID      - The cursor was opened on a database table.
003041  **   IN_INDEX_INDEX_ASC  - The cursor was opened on an ascending index.
003042  **   IN_INDEX_INDEX_DESC - The cursor was opened on a descending index.
003043  **   IN_INDEX_EPH        - The cursor was opened on a specially created and
003044  **                         populated ephemeral table.
003045  **   IN_INDEX_NOOP       - No cursor was allocated.  The IN operator must be
003046  **                         implemented as a sequence of comparisons.
003047  **
003048  ** An existing b-tree might be used if the RHS expression pX is a simple
003049  ** subquery such as:
003050  **
003051  **     SELECT <column1>, <column2>... FROM <table>
003052  **
003053  ** If the RHS of the IN operator is a list or a more complex subquery, then
003054  ** an ephemeral table might need to be generated from the RHS and then
003055  ** pX->iTable made to point to the ephemeral table instead of an
003056  ** existing table.  In this case, the creation and initialization of the
003057  ** ephemeral table might be put inside of a subroutine, the EP_Subrtn flag
003058  ** will be set on pX and the pX->y.sub fields will be set to show where
003059  ** the subroutine is coded.
003060  **
003061  ** The inFlags parameter must contain, at a minimum, one of the bits
003062  ** IN_INDEX_MEMBERSHIP or IN_INDEX_LOOP but not both.  If inFlags contains
003063  ** IN_INDEX_MEMBERSHIP, then the generated table will be used for a fast
003064  ** membership test.  When the IN_INDEX_LOOP bit is set, the IN index will
003065  ** be used to loop over all values of the RHS of the IN operator.
003066  **
003067  ** When IN_INDEX_LOOP is used (and the b-tree will be used to iterate
003068  ** through the set members) then the b-tree must not contain duplicates.
003069  ** An ephemeral table will be created unless the selected columns are guaranteed
003070  ** to be unique - either because it is an INTEGER PRIMARY KEY or due to
003071  ** a UNIQUE constraint or index.
003072  **
003073  ** When IN_INDEX_MEMBERSHIP is used (and the b-tree will be used
003074  ** for fast set membership tests) then an ephemeral table must
003075  ** be used unless <columns> is a single INTEGER PRIMARY KEY column or an
003076  ** index can be found with the specified <columns> as its left-most.
003077  **
003078  ** If the IN_INDEX_NOOP_OK and IN_INDEX_MEMBERSHIP are both set and
003079  ** if the RHS of the IN operator is a list (not a subquery) then this
003080  ** routine might decide that creating an ephemeral b-tree for membership
003081  ** testing is too expensive and return IN_INDEX_NOOP.  In that case, the
003082  ** calling routine should implement the IN operator using a sequence
003083  ** of Eq or Ne comparison operations.
003084  **
003085  ** When the b-tree is being used for membership tests, the calling function
003086  ** might need to know whether or not the RHS side of the IN operator
003087  ** contains a NULL.  If prRhsHasNull is not a NULL pointer and
003088  ** if there is any chance that the (...) might contain a NULL value at
003089  ** runtime, then a register is allocated and the register number written
003090  ** to *prRhsHasNull. If there is no chance that the (...) contains a
003091  ** NULL value, then *prRhsHasNull is left unchanged.
003092  **
003093  ** If a register is allocated and its location stored in *prRhsHasNull, then
003094  ** the value in that register will be NULL if the b-tree contains one or more
003095  ** NULL values, and it will be some non-NULL value if the b-tree contains no
003096  ** NULL values.
003097  **
003098  ** If the aiMap parameter is not NULL, it must point to an array containing
003099  ** one element for each column returned by the SELECT statement on the RHS
003100  ** of the IN(...) operator. The i'th entry of the array is populated with the
003101  ** offset of the index column that matches the i'th column returned by the
003102  ** SELECT. For example, if the expression and selected index are:
003103  **
003104  **   (?,?,?) IN (SELECT a, b, c FROM t1)
003105  **   CREATE INDEX i1 ON t1(b, c, a);
003106  **
003107  ** then aiMap[] is populated with {2, 0, 1}.
003108  */
003109  #ifndef SQLITE_OMIT_SUBQUERY
003110  int sqlite3FindInIndex(
003111    Parse *pParse,             /* Parsing context */
003112    Expr *pX,                  /* The IN expression */
003113    u32 inFlags,               /* IN_INDEX_LOOP, _MEMBERSHIP, and/or _NOOP_OK */
003114    int *prRhsHasNull,         /* Register holding NULL status.  See notes */
003115    int *aiMap,                /* Mapping from Index fields to RHS fields */
003116    int *piTab                 /* OUT: index to use */
003117  ){
003118    Select *p;                            /* SELECT to the right of IN operator */
003119    int eType = 0;                        /* Type of RHS table. IN_INDEX_* */
003120    int iTab;                             /* Cursor of the RHS table */
003121    int mustBeUnique;                     /* True if RHS must be unique */
003122    Vdbe *v = sqlite3GetVdbe(pParse);     /* Virtual machine being coded */
003123  
003124    assert( pX->op==TK_IN );
003125    mustBeUnique = (inFlags & IN_INDEX_LOOP)!=0;
003126    iTab = pParse->nTab++;
003127  
003128    /* If the RHS of this IN(...) operator is a SELECT, and if it matters
003129    ** whether or not the SELECT result contains NULL values, check whether
003130    ** or not NULL is actually possible (it may not be, for example, due
003131    ** to NOT NULL constraints in the schema). If no NULL values are possible,
003132    ** set prRhsHasNull to 0 before continuing.  */
003133    if( prRhsHasNull && ExprUseXSelect(pX) ){
003134      int i;
003135      ExprList *pEList = pX->x.pSelect->pEList;
003136      for(i=0; i<pEList->nExpr; i++){
003137        if( sqlite3ExprCanBeNull(pEList->a[i].pExpr) ) break;
003138      }
003139      if( i==pEList->nExpr ){
003140        prRhsHasNull = 0;
003141      }
003142    }
003143  
003144    /* Check to see if an existing table or index can be used to
003145    ** satisfy the query.  This is preferable to generating a new
003146    ** ephemeral table.  */
003147    if( pParse->nErr==0 && (p = isCandidateForInOpt(pX))!=0 ){
003148      sqlite3 *db = pParse->db;              /* Database connection */
003149      Table *pTab;                           /* Table <table>. */
003150      int iDb;                               /* Database idx for pTab */
003151      ExprList *pEList = p->pEList;
003152      int nExpr = pEList->nExpr;
003153  
003154      assert( p->pEList!=0 );             /* Because of isCandidateForInOpt(p) */
003155      assert( p->pEList->a[0].pExpr!=0 ); /* Because of isCandidateForInOpt(p) */
003156      assert( p->pSrc!=0 );               /* Because of isCandidateForInOpt(p) */
003157      pTab = p->pSrc->a[0].pTab;
003158  
003159      /* Code an OP_Transaction and OP_TableLock for <table>. */
003160      iDb = sqlite3SchemaToIndex(db, pTab->pSchema);
003161      assert( iDb>=0 && iDb<SQLITE_MAX_DB );
003162      sqlite3CodeVerifySchema(pParse, iDb);
003163      sqlite3TableLock(pParse, iDb, pTab->tnum, 0, pTab->zName);
003164  
003165      assert(v);  /* sqlite3GetVdbe() has always been previously called */
003166      if( nExpr==1 && pEList->a[0].pExpr->iColumn<0 ){
003167        /* The "x IN (SELECT rowid FROM table)" case */
003168        int iAddr = sqlite3VdbeAddOp0(v, OP_Once);
003169        VdbeCoverage(v);
003170  
003171        sqlite3OpenTable(pParse, iTab, iDb, pTab, OP_OpenRead);
003172        eType = IN_INDEX_ROWID;
003173        ExplainQueryPlan((pParse, 0,
003174              "USING ROWID SEARCH ON TABLE %s FOR IN-OPERATOR",pTab->zName));
003175        sqlite3VdbeJumpHere(v, iAddr);
003176      }else{
003177        Index *pIdx;                         /* Iterator variable */
003178        int affinity_ok = 1;
003179        int i;
003180  
003181        /* Check that the affinity that will be used to perform each
003182        ** comparison is the same as the affinity of each column in table
003183        ** on the RHS of the IN operator.  If it not, it is not possible to
003184        ** use any index of the RHS table.  */
003185        for(i=0; i<nExpr && affinity_ok; i++){
003186          Expr *pLhs = sqlite3VectorFieldSubexpr(pX->pLeft, i);
003187          int iCol = pEList->a[i].pExpr->iColumn;
003188          char idxaff = sqlite3TableColumnAffinity(pTab,iCol); /* RHS table */
003189          char cmpaff = sqlite3CompareAffinity(pLhs, idxaff);
003190          testcase( cmpaff==SQLITE_AFF_BLOB );
003191          testcase( cmpaff==SQLITE_AFF_TEXT );
003192          switch( cmpaff ){
003193            case SQLITE_AFF_BLOB:
003194              break;
003195            case SQLITE_AFF_TEXT:
003196              /* sqlite3CompareAffinity() only returns TEXT if one side or the
003197              ** other has no affinity and the other side is TEXT.  Hence,
003198              ** the only way for cmpaff to be TEXT is for idxaff to be TEXT
003199              ** and for the term on the LHS of the IN to have no affinity. */
003200              assert( idxaff==SQLITE_AFF_TEXT );
003201              break;
003202            default:
003203              affinity_ok = sqlite3IsNumericAffinity(idxaff);
003204          }
003205        }
003206  
003207        if( affinity_ok ){
003208          /* Search for an existing index that will work for this IN operator */
003209          for(pIdx=pTab->pIndex; pIdx && eType==0; pIdx=pIdx->pNext){
003210            Bitmask colUsed;      /* Columns of the index used */
003211            Bitmask mCol;         /* Mask for the current column */
003212            if( pIdx->nColumn<nExpr ) continue;
003213            if( pIdx->pPartIdxWhere!=0 ) continue;
003214            /* Maximum nColumn is BMS-2, not BMS-1, so that we can compute
003215            ** BITMASK(nExpr) without overflowing */
003216            testcase( pIdx->nColumn==BMS-2 );
003217            testcase( pIdx->nColumn==BMS-1 );
003218            if( pIdx->nColumn>=BMS-1 ) continue;
003219            if( mustBeUnique ){
003220              if( pIdx->nKeyCol>nExpr
003221               ||(pIdx->nColumn>nExpr && !IsUniqueIndex(pIdx))
003222              ){
003223                continue;  /* This index is not unique over the IN RHS columns */
003224              }
003225            }
003226   
003227            colUsed = 0;   /* Columns of index used so far */
003228            for(i=0; i<nExpr; i++){
003229              Expr *pLhs = sqlite3VectorFieldSubexpr(pX->pLeft, i);
003230              Expr *pRhs = pEList->a[i].pExpr;
003231              CollSeq *pReq = sqlite3BinaryCompareCollSeq(pParse, pLhs, pRhs);
003232              int j;
003233   
003234              for(j=0; j<nExpr; j++){
003235                if( pIdx->aiColumn[j]!=pRhs->iColumn ) continue;
003236                assert( pIdx->azColl[j] );
003237                if( pReq!=0 && sqlite3StrICmp(pReq->zName, pIdx->azColl[j])!=0 ){
003238                  continue;
003239                }
003240                break;
003241              }
003242              if( j==nExpr ) break;
003243              mCol = MASKBIT(j);
003244              if( mCol & colUsed ) break; /* Each column used only once */
003245              colUsed |= mCol;
003246              if( aiMap ) aiMap[i] = j;
003247            }
003248   
003249            assert( i==nExpr || colUsed!=(MASKBIT(nExpr)-1) );
003250            if( colUsed==(MASKBIT(nExpr)-1) ){
003251              /* If we reach this point, that means the index pIdx is usable */
003252              int iAddr = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
003253              ExplainQueryPlan((pParse, 0,
003254                                "USING INDEX %s FOR IN-OPERATOR",pIdx->zName));
003255              sqlite3VdbeAddOp3(v, OP_OpenRead, iTab, pIdx->tnum, iDb);
003256              sqlite3VdbeSetP4KeyInfo(pParse, pIdx);
003257              VdbeComment((v, "%s", pIdx->zName));
003258              assert( IN_INDEX_INDEX_DESC == IN_INDEX_INDEX_ASC+1 );
003259              eType = IN_INDEX_INDEX_ASC + pIdx->aSortOrder[0];
003260   
003261              if( prRhsHasNull ){
003262  #ifdef SQLITE_ENABLE_COLUMN_USED_MASK
003263                i64 mask = (1<<nExpr)-1;
003264                sqlite3VdbeAddOp4Dup8(v, OP_ColumnsUsed,
003265                    iTab, 0, 0, (u8*)&mask, P4_INT64);
003266  #endif
003267                *prRhsHasNull = ++pParse->nMem;
003268                if( nExpr==1 ){
003269                  sqlite3SetHasNullFlag(v, iTab, *prRhsHasNull);
003270                }
003271              }
003272              sqlite3VdbeJumpHere(v, iAddr);
003273            }
003274          } /* End loop over indexes */
003275        } /* End if( affinity_ok ) */
003276      } /* End if not an rowid index */
003277    } /* End attempt to optimize using an index */
003278  
003279    /* If no preexisting index is available for the IN clause
003280    ** and IN_INDEX_NOOP is an allowed reply
003281    ** and the RHS of the IN operator is a list, not a subquery
003282    ** and the RHS is not constant or has two or fewer terms,
003283    ** then it is not worth creating an ephemeral table to evaluate
003284    ** the IN operator so return IN_INDEX_NOOP.
003285    */
003286    if( eType==0
003287     && (inFlags & IN_INDEX_NOOP_OK)
003288     && ExprUseXList(pX)
003289     && (!sqlite3InRhsIsConstant(pParse,pX) || pX->x.pList->nExpr<=2)
003290    ){
003291      pParse->nTab--;  /* Back out the allocation of the unused cursor */
003292      iTab = -1;       /* Cursor is not allocated */
003293      eType = IN_INDEX_NOOP;
003294    }
003295  
003296    if( eType==0 ){
003297      /* Could not find an existing table or index to use as the RHS b-tree.
003298      ** We will have to generate an ephemeral table to do the job.
003299      */
003300      u32 savedNQueryLoop = pParse->nQueryLoop;
003301      int rMayHaveNull = 0;
003302      eType = IN_INDEX_EPH;
003303      if( inFlags & IN_INDEX_LOOP ){
003304        pParse->nQueryLoop = 0;
003305      }else if( prRhsHasNull ){
003306        *prRhsHasNull = rMayHaveNull = ++pParse->nMem;
003307      }
003308      assert( pX->op==TK_IN );
003309      sqlite3CodeRhsOfIN(pParse, pX, iTab);
003310      if( rMayHaveNull ){
003311        sqlite3SetHasNullFlag(v, iTab, rMayHaveNull);
003312      }
003313      pParse->nQueryLoop = savedNQueryLoop;
003314    }
003315  
003316    if( aiMap && eType!=IN_INDEX_INDEX_ASC && eType!=IN_INDEX_INDEX_DESC ){
003317      int i, n;
003318      n = sqlite3ExprVectorSize(pX->pLeft);
003319      for(i=0; i<n; i++) aiMap[i] = i;
003320    }
003321    *piTab = iTab;
003322    return eType;
003323  }
003324  #endif
003325  
003326  #ifndef SQLITE_OMIT_SUBQUERY
003327  /*
003328  ** Argument pExpr is an (?, ?...) IN(...) expression. This
003329  ** function allocates and returns a nul-terminated string containing
003330  ** the affinities to be used for each column of the comparison.
003331  **
003332  ** It is the responsibility of the caller to ensure that the returned
003333  ** string is eventually freed using sqlite3DbFree().
003334  */
003335  static char *exprINAffinity(Parse *pParse, const Expr *pExpr){
003336    Expr *pLeft = pExpr->pLeft;
003337    int nVal = sqlite3ExprVectorSize(pLeft);
003338    Select *pSelect = ExprUseXSelect(pExpr) ? pExpr->x.pSelect : 0;
003339    char *zRet;
003340  
003341    assert( pExpr->op==TK_IN );
003342    zRet = sqlite3DbMallocRaw(pParse->db, nVal+1);
003343    if( zRet ){
003344      int i;
003345      for(i=0; i<nVal; i++){
003346        Expr *pA = sqlite3VectorFieldSubexpr(pLeft, i);
003347        char a = sqlite3ExprAffinity(pA);
003348        if( pSelect ){
003349          zRet[i] = sqlite3CompareAffinity(pSelect->pEList->a[i].pExpr, a);
003350        }else{
003351          zRet[i] = a;
003352        }
003353      }
003354      zRet[nVal] = '\0';
003355    }
003356    return zRet;
003357  }
003358  #endif
003359  
003360  #ifndef SQLITE_OMIT_SUBQUERY
003361  /*
003362  ** Load the Parse object passed as the first argument with an error
003363  ** message of the form:
003364  **
003365  **   "sub-select returns N columns - expected M"
003366  */  
003367  void sqlite3SubselectError(Parse *pParse, int nActual, int nExpect){
003368    if( pParse->nErr==0 ){
003369      const char *zFmt = "sub-select returns %d columns - expected %d";
003370      sqlite3ErrorMsg(pParse, zFmt, nActual, nExpect);
003371    }
003372  }
003373  #endif
003374  
003375  /*
003376  ** Expression pExpr is a vector that has been used in a context where
003377  ** it is not permitted. If pExpr is a sub-select vector, this routine
003378  ** loads the Parse object with a message of the form:
003379  **
003380  **   "sub-select returns N columns - expected 1"
003381  **
003382  ** Or, if it is a regular scalar vector:
003383  **
003384  **   "row value misused"
003385  */  
003386  void sqlite3VectorErrorMsg(Parse *pParse, Expr *pExpr){
003387  #ifndef SQLITE_OMIT_SUBQUERY
003388    if( ExprUseXSelect(pExpr) ){
003389      sqlite3SubselectError(pParse, pExpr->x.pSelect->pEList->nExpr, 1);
003390    }else
003391  #endif
003392    {
003393      sqlite3ErrorMsg(pParse, "row value misused");
003394    }
003395  }
003396  
003397  #ifndef SQLITE_OMIT_SUBQUERY
003398  /*
003399  ** Generate code that will construct an ephemeral table containing all terms
003400  ** in the RHS of an IN operator.  The IN operator can be in either of two
003401  ** forms:
003402  **
003403  **     x IN (4,5,11)              -- IN operator with list on right-hand side
003404  **     x IN (SELECT a FROM b)     -- IN operator with subquery on the right
003405  **
003406  ** The pExpr parameter is the IN operator.  The cursor number for the
003407  ** constructed ephemeral table is returned.  The first time the ephemeral
003408  ** table is computed, the cursor number is also stored in pExpr->iTable,
003409  ** however the cursor number returned might not be the same, as it might
003410  ** have been duplicated using OP_OpenDup.
003411  **
003412  ** If the LHS expression ("x" in the examples) is a column value, or
003413  ** the SELECT statement returns a column value, then the affinity of that
003414  ** column is used to build the index keys. If both 'x' and the
003415  ** SELECT... statement are columns, then numeric affinity is used
003416  ** if either column has NUMERIC or INTEGER affinity. If neither
003417  ** 'x' nor the SELECT... statement are columns, then numeric affinity
003418  ** is used.
003419  */
003420  void sqlite3CodeRhsOfIN(
003421    Parse *pParse,          /* Parsing context */
003422    Expr *pExpr,            /* The IN operator */
003423    int iTab                /* Use this cursor number */
003424  ){
003425    int addrOnce = 0;           /* Address of the OP_Once instruction at top */
003426    int addr;                   /* Address of OP_OpenEphemeral instruction */
003427    Expr *pLeft;                /* the LHS of the IN operator */
003428    KeyInfo *pKeyInfo = 0;      /* Key information */
003429    int nVal;                   /* Size of vector pLeft */
003430    Vdbe *v;                    /* The prepared statement under construction */
003431  
003432    v = pParse->pVdbe;
003433    assert( v!=0 );
003434  
003435    /* The evaluation of the IN must be repeated every time it
003436    ** is encountered if any of the following is true:
003437    **
003438    **    *  The right-hand side is a correlated subquery
003439    **    *  The right-hand side is an expression list containing variables
003440    **    *  We are inside a trigger
003441    **
003442    ** If all of the above are false, then we can compute the RHS just once
003443    ** and reuse it many names.
003444    */
003445    if( !ExprHasProperty(pExpr, EP_VarSelect) && pParse->iSelfTab==0 ){
003446      /* Reuse of the RHS is allowed */
003447      /* If this routine has already been coded, but the previous code
003448      ** might not have been invoked yet, so invoke it now as a subroutine.
003449      */
003450      if( ExprHasProperty(pExpr, EP_Subrtn) ){
003451        addrOnce = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
003452        if( ExprUseXSelect(pExpr) ){
003453          ExplainQueryPlan((pParse, 0, "REUSE LIST SUBQUERY %d",
003454                pExpr->x.pSelect->selId));
003455        }
003456        assert( ExprUseYSub(pExpr) );
003457        sqlite3VdbeAddOp2(v, OP_Gosub, pExpr->y.sub.regReturn,
003458                          pExpr->y.sub.iAddr);
003459        assert( iTab!=pExpr->iTable );
003460        sqlite3VdbeAddOp2(v, OP_OpenDup, iTab, pExpr->iTable);
003461        sqlite3VdbeJumpHere(v, addrOnce);
003462        return;
003463      }
003464  
003465      /* Begin coding the subroutine */
003466      assert( !ExprUseYWin(pExpr) );
003467      ExprSetProperty(pExpr, EP_Subrtn);
003468      assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
003469      pExpr->y.sub.regReturn = ++pParse->nMem;
003470      pExpr->y.sub.iAddr =
003471        sqlite3VdbeAddOp2(v, OP_BeginSubrtn, 0, pExpr->y.sub.regReturn) + 1;
003472  
003473      addrOnce = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
003474    }
003475  
003476    /* Check to see if this is a vector IN operator */
003477    pLeft = pExpr->pLeft;
003478    nVal = sqlite3ExprVectorSize(pLeft);
003479  
003480    /* Construct the ephemeral table that will contain the content of
003481    ** RHS of the IN operator.
003482    */
003483    pExpr->iTable = iTab;
003484    addr = sqlite3VdbeAddOp2(v, OP_OpenEphemeral, pExpr->iTable, nVal);
003485  #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
003486    if( ExprUseXSelect(pExpr) ){
003487      VdbeComment((v, "Result of SELECT %u", pExpr->x.pSelect->selId));
003488    }else{
003489      VdbeComment((v, "RHS of IN operator"));
003490    }
003491  #endif
003492    pKeyInfo = sqlite3KeyInfoAlloc(pParse->db, nVal, 1);
003493  
003494    if( ExprUseXSelect(pExpr) ){
003495      /* Case 1:     expr IN (SELECT ...)
003496      **
003497      ** Generate code to write the results of the select into the temporary
003498      ** table allocated and opened above.
003499      */
003500      Select *pSelect = pExpr->x.pSelect;
003501      ExprList *pEList = pSelect->pEList;
003502  
003503      ExplainQueryPlan((pParse, 1, "%sLIST SUBQUERY %d",
003504          addrOnce?"":"CORRELATED ", pSelect->selId
003505      ));
003506      /* If the LHS and RHS of the IN operator do not match, that
003507      ** error will have been caught long before we reach this point. */
003508      if( ALWAYS(pEList->nExpr==nVal) ){
003509        Select *pCopy;
003510        SelectDest dest;
003511        int i;
003512        int rc;
003513        sqlite3SelectDestInit(&dest, SRT_Set, iTab);
003514        dest.zAffSdst = exprINAffinity(pParse, pExpr);
003515        pSelect->iLimit = 0;
003516        testcase( pSelect->selFlags & SF_Distinct );
003517        testcase( pKeyInfo==0 ); /* Caused by OOM in sqlite3KeyInfoAlloc() */
003518        pCopy = sqlite3SelectDup(pParse->db, pSelect, 0);
003519        rc = pParse->db->mallocFailed ? 1 :sqlite3Select(pParse, pCopy, &dest);
003520        sqlite3SelectDelete(pParse->db, pCopy);
003521        sqlite3DbFree(pParse->db, dest.zAffSdst);
003522        if( rc ){
003523          sqlite3KeyInfoUnref(pKeyInfo);
003524          return;
003525        }     
003526        assert( pKeyInfo!=0 ); /* OOM will cause exit after sqlite3Select() */
003527        assert( pEList!=0 );
003528        assert( pEList->nExpr>0 );
003529        assert( sqlite3KeyInfoIsWriteable(pKeyInfo) );
003530        for(i=0; i<nVal; i++){
003531          Expr *p = sqlite3VectorFieldSubexpr(pLeft, i);
003532          pKeyInfo->aColl[i] = sqlite3BinaryCompareCollSeq(
003533              pParse, p, pEList->a[i].pExpr
003534          );
003535        }
003536      }
003537    }else if( ALWAYS(pExpr->x.pList!=0) ){
003538      /* Case 2:     expr IN (exprlist)
003539      **
003540      ** For each expression, build an index key from the evaluation and
003541      ** store it in the temporary table. If <expr> is a column, then use
003542      ** that columns affinity when building index keys. If <expr> is not
003543      ** a column, use numeric affinity.
003544      */
003545      char affinity;            /* Affinity of the LHS of the IN */
003546      int i;
003547      ExprList *pList = pExpr->x.pList;
003548      struct ExprList_item *pItem;
003549      int r1, r2;
003550      affinity = sqlite3ExprAffinity(pLeft);
003551      if( affinity<=SQLITE_AFF_NONE ){
003552        affinity = SQLITE_AFF_BLOB;
003553      }else if( affinity==SQLITE_AFF_REAL ){
003554        affinity = SQLITE_AFF_NUMERIC;
003555      }
003556      if( pKeyInfo ){
003557        assert( sqlite3KeyInfoIsWriteable(pKeyInfo) );
003558        pKeyInfo->aColl[0] = sqlite3ExprCollSeq(pParse, pExpr->pLeft);
003559      }
003560  
003561      /* Loop through each expression in <exprlist>. */
003562      r1 = sqlite3GetTempReg(pParse);
003563      r2 = sqlite3GetTempReg(pParse);
003564      for(i=pList->nExpr, pItem=pList->a; i>0; i--, pItem++){
003565        Expr *pE2 = pItem->pExpr;
003566  
003567        /* If the expression is not constant then we will need to
003568        ** disable the test that was generated above that makes sure
003569        ** this code only executes once.  Because for a non-constant
003570        ** expression we need to rerun this code each time.
003571        */
003572        if( addrOnce && !sqlite3ExprIsConstant(pParse, pE2) ){
003573          sqlite3VdbeChangeToNoop(v, addrOnce-1);
003574          sqlite3VdbeChangeToNoop(v, addrOnce);
003575          ExprClearProperty(pExpr, EP_Subrtn);
003576          addrOnce = 0;
003577        }
003578  
003579        /* Evaluate the expression and insert it into the temp table */
003580        sqlite3ExprCode(pParse, pE2, r1);
003581        sqlite3VdbeAddOp4(v, OP_MakeRecord, r1, 1, r2, &affinity, 1);
003582        sqlite3VdbeAddOp4Int(v, OP_IdxInsert, iTab, r2, r1, 1);
003583      }
003584      sqlite3ReleaseTempReg(pParse, r1);
003585      sqlite3ReleaseTempReg(pParse, r2);
003586    }
003587    if( pKeyInfo ){
003588      sqlite3VdbeChangeP4(v, addr, (void *)pKeyInfo, P4_KEYINFO);
003589    }
003590    if( addrOnce ){
003591      sqlite3VdbeAddOp1(v, OP_NullRow, iTab);
003592      sqlite3VdbeJumpHere(v, addrOnce);
003593      /* Subroutine return */
003594      assert( ExprUseYSub(pExpr) );
003595      assert( sqlite3VdbeGetOp(v,pExpr->y.sub.iAddr-1)->opcode==OP_BeginSubrtn
003596              || pParse->nErr );
003597      sqlite3VdbeAddOp3(v, OP_Return, pExpr->y.sub.regReturn,
003598                        pExpr->y.sub.iAddr, 1);
003599      VdbeCoverage(v);
003600      sqlite3ClearTempRegCache(pParse);
003601    }
003602  }
003603  #endif /* SQLITE_OMIT_SUBQUERY */
003604  
003605  /*
003606  ** Generate code for scalar subqueries used as a subquery expression
003607  ** or EXISTS operator:
003608  **
003609  **     (SELECT a FROM b)          -- subquery
003610  **     EXISTS (SELECT a FROM b)   -- EXISTS subquery
003611  **
003612  ** The pExpr parameter is the SELECT or EXISTS operator to be coded.
003613  **
003614  ** Return the register that holds the result.  For a multi-column SELECT,
003615  ** the result is stored in a contiguous array of registers and the
003616  ** return value is the register of the left-most result column.
003617  ** Return 0 if an error occurs.
003618  */
003619  #ifndef SQLITE_OMIT_SUBQUERY
003620  int sqlite3CodeSubselect(Parse *pParse, Expr *pExpr){
003621    int addrOnce = 0;           /* Address of OP_Once at top of subroutine */
003622    int rReg = 0;               /* Register storing resulting */
003623    Select *pSel;               /* SELECT statement to encode */
003624    SelectDest dest;            /* How to deal with SELECT result */
003625    int nReg;                   /* Registers to allocate */
003626    Expr *pLimit;               /* New limit expression */
003627  #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
003628    int addrExplain;            /* Address of OP_Explain instruction */
003629  #endif
003630  
003631    Vdbe *v = pParse->pVdbe;
003632    assert( v!=0 );
003633    if( pParse->nErr ) return 0;
003634    testcase( pExpr->op==TK_EXISTS );
003635    testcase( pExpr->op==TK_SELECT );
003636    assert( pExpr->op==TK_EXISTS || pExpr->op==TK_SELECT );
003637    assert( ExprUseXSelect(pExpr) );
003638    pSel = pExpr->x.pSelect;
003639  
003640    /* If this routine has already been coded, then invoke it as a
003641    ** subroutine. */
003642    if( ExprHasProperty(pExpr, EP_Subrtn) ){
003643      ExplainQueryPlan((pParse, 0, "REUSE SUBQUERY %d", pSel->selId));
003644      assert( ExprUseYSub(pExpr) );
003645      sqlite3VdbeAddOp2(v, OP_Gosub, pExpr->y.sub.regReturn,
003646                        pExpr->y.sub.iAddr);
003647      return pExpr->iTable;
003648    }
003649  
003650    /* Begin coding the subroutine */
003651    assert( !ExprUseYWin(pExpr) );
003652    assert( !ExprHasProperty(pExpr, EP_Reduced|EP_TokenOnly) );
003653    ExprSetProperty(pExpr, EP_Subrtn);
003654    pExpr->y.sub.regReturn = ++pParse->nMem;
003655    pExpr->y.sub.iAddr =
003656      sqlite3VdbeAddOp2(v, OP_BeginSubrtn, 0, pExpr->y.sub.regReturn) + 1;
003657  
003658    /* The evaluation of the EXISTS/SELECT must be repeated every time it
003659    ** is encountered if any of the following is true:
003660    **
003661    **    *  The right-hand side is a correlated subquery
003662    **    *  The right-hand side is an expression list containing variables
003663    **    *  We are inside a trigger
003664    **
003665    ** If all of the above are false, then we can run this code just once
003666    ** save the results, and reuse the same result on subsequent invocations.
003667    */
003668    if( !ExprHasProperty(pExpr, EP_VarSelect) ){
003669      addrOnce = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
003670    }
003671   
003672    /* For a SELECT, generate code to put the values for all columns of
003673    ** the first row into an array of registers and return the index of
003674    ** the first register.
003675    **
003676    ** If this is an EXISTS, write an integer 0 (not exists) or 1 (exists)
003677    ** into a register and return that register number.
003678    **
003679    ** In both cases, the query is augmented with "LIMIT 1".  Any
003680    ** preexisting limit is discarded in place of the new LIMIT 1.
003681    */
003682    ExplainQueryPlan2(addrExplain, (pParse, 1, "%sSCALAR SUBQUERY %d",
003683          addrOnce?"":"CORRELATED ", pSel->selId));
003684    sqlite3VdbeScanStatusCounters(v, addrExplain, addrExplain, -1);
003685    nReg = pExpr->op==TK_SELECT ? pSel->pEList->nExpr : 1;
003686    sqlite3SelectDestInit(&dest, 0, pParse->nMem+1);
003687    pParse->nMem += nReg;
003688    if( pExpr->op==TK_SELECT ){
003689      dest.eDest = SRT_Mem;
003690      dest.iSdst = dest.iSDParm;
003691      dest.nSdst = nReg;
003692      sqlite3VdbeAddOp3(v, OP_Null, 0, dest.iSDParm, dest.iSDParm+nReg-1);
003693      VdbeComment((v, "Init subquery result"));
003694    }else{
003695      dest.eDest = SRT_Exists;
003696      sqlite3VdbeAddOp2(v, OP_Integer, 0, dest.iSDParm);
003697      VdbeComment((v, "Init EXISTS result"));
003698    }
003699    if( pSel->pLimit ){
003700      /* The subquery already has a limit.  If the pre-existing limit is X
003701      ** then make the new limit X<>0 so that the new limit is either 1 or 0 */
003702      sqlite3 *db = pParse->db;
003703      pLimit = sqlite3Expr(db, TK_INTEGER, "0");
003704      if( pLimit ){
003705        pLimit->affExpr = SQLITE_AFF_NUMERIC;
003706        pLimit = sqlite3PExpr(pParse, TK_NE,
003707                              sqlite3ExprDup(db, pSel->pLimit->pLeft, 0), pLimit);
003708      }
003709      sqlite3ExprDeferredDelete(pParse, pSel->pLimit->pLeft);
003710      pSel->pLimit->pLeft = pLimit;
003711    }else{
003712      /* If there is no pre-existing limit add a limit of 1 */
003713      pLimit = sqlite3Expr(pParse->db, TK_INTEGER, "1");
003714      pSel->pLimit = sqlite3PExpr(pParse, TK_LIMIT, pLimit, 0);
003715    }
003716    pSel->iLimit = 0;
003717    if( sqlite3Select(pParse, pSel, &dest) ){
003718      pExpr->op2 = pExpr->op;
003719      pExpr->op = TK_ERROR;
003720      return 0;
003721    }
003722    pExpr->iTable = rReg = dest.iSDParm;
003723    ExprSetVVAProperty(pExpr, EP_NoReduce);
003724    if( addrOnce ){
003725      sqlite3VdbeJumpHere(v, addrOnce);
003726    }
003727    sqlite3VdbeScanStatusRange(v, addrExplain, addrExplain, -1);
003728  
003729    /* Subroutine return */
003730    assert( ExprUseYSub(pExpr) );
003731    assert( sqlite3VdbeGetOp(v,pExpr->y.sub.iAddr-1)->opcode==OP_BeginSubrtn
003732            || pParse->nErr );
003733    sqlite3VdbeAddOp3(v, OP_Return, pExpr->y.sub.regReturn,
003734                      pExpr->y.sub.iAddr, 1);
003735    VdbeCoverage(v);
003736    sqlite3ClearTempRegCache(pParse);
003737    return rReg;
003738  }
003739  #endif /* SQLITE_OMIT_SUBQUERY */
003740  
003741  #ifndef SQLITE_OMIT_SUBQUERY
003742  /*
003743  ** Expr pIn is an IN(...) expression. This function checks that the
003744  ** sub-select on the RHS of the IN() operator has the same number of
003745  ** columns as the vector on the LHS. Or, if the RHS of the IN() is not
003746  ** a sub-query, that the LHS is a vector of size 1.
003747  */
003748  int sqlite3ExprCheckIN(Parse *pParse, Expr *pIn){
003749    int nVector = sqlite3ExprVectorSize(pIn->pLeft);
003750    if( ExprUseXSelect(pIn) && !pParse->db->mallocFailed ){
003751      if( nVector!=pIn->x.pSelect->pEList->nExpr ){
003752        sqlite3SubselectError(pParse, pIn->x.pSelect->pEList->nExpr, nVector);
003753        return 1;
003754      }
003755    }else if( nVector!=1 ){
003756      sqlite3VectorErrorMsg(pParse, pIn->pLeft);
003757      return 1;
003758    }
003759    return 0;
003760  }
003761  #endif
003762  
003763  #ifndef SQLITE_OMIT_SUBQUERY
003764  /*
003765  ** Generate code for an IN expression.
003766  **
003767  **      x IN (SELECT ...)
003768  **      x IN (value, value, ...)
003769  **
003770  ** The left-hand side (LHS) is a scalar or vector expression.  The
003771  ** right-hand side (RHS) is an array of zero or more scalar values, or a
003772  ** subquery.  If the RHS is a subquery, the number of result columns must
003773  ** match the number of columns in the vector on the LHS.  If the RHS is
003774  ** a list of values, the LHS must be a scalar.
003775  **
003776  ** The IN operator is true if the LHS value is contained within the RHS.
003777  ** The result is false if the LHS is definitely not in the RHS.  The
003778  ** result is NULL if the presence of the LHS in the RHS cannot be
003779  ** determined due to NULLs.
003780  **
003781  ** This routine generates code that jumps to destIfFalse if the LHS is not
003782  ** contained within the RHS.  If due to NULLs we cannot determine if the LHS
003783  ** is contained in the RHS then jump to destIfNull.  If the LHS is contained
003784  ** within the RHS then fall through.
003785  **
003786  ** See the separate in-operator.md documentation file in the canonical
003787  ** SQLite source tree for additional information.
003788  */
003789  static void sqlite3ExprCodeIN(
003790    Parse *pParse,        /* Parsing and code generating context */
003791    Expr *pExpr,          /* The IN expression */
003792    int destIfFalse,      /* Jump here if LHS is not contained in the RHS */
003793    int destIfNull        /* Jump here if the results are unknown due to NULLs */
003794  ){
003795    int rRhsHasNull = 0;  /* Register that is true if RHS contains NULL values */
003796    int eType;            /* Type of the RHS */
003797    int rLhs;             /* Register(s) holding the LHS values */
003798    int rLhsOrig;         /* LHS values prior to reordering by aiMap[] */
003799    Vdbe *v;              /* Statement under construction */
003800    int *aiMap = 0;       /* Map from vector field to index column */
003801    char *zAff = 0;       /* Affinity string for comparisons */
003802    int nVector;          /* Size of vectors for this IN operator */
003803    int iDummy;           /* Dummy parameter to exprCodeVector() */
003804    Expr *pLeft;          /* The LHS of the IN operator */
003805    int i;                /* loop counter */
003806    int destStep2;        /* Where to jump when NULLs seen in step 2 */
003807    int destStep6 = 0;    /* Start of code for Step 6 */
003808    int addrTruthOp;      /* Address of opcode that determines the IN is true */
003809    int destNotNull;      /* Jump here if a comparison is not true in step 6 */
003810    int addrTop;          /* Top of the step-6 loop */
003811    int iTab = 0;         /* Index to use */
003812    u8 okConstFactor = pParse->okConstFactor;
003813  
003814    assert( !ExprHasVVAProperty(pExpr,EP_Immutable) );
003815    pLeft = pExpr->pLeft;
003816    if( sqlite3ExprCheckIN(pParse, pExpr) ) return;
003817    zAff = exprINAffinity(pParse, pExpr);
003818    nVector = sqlite3ExprVectorSize(pExpr->pLeft);
003819    aiMap = (int*)sqlite3DbMallocZero(
003820        pParse->db, nVector*(sizeof(int) + sizeof(char)) + 1
003821    );
003822    if( pParse->db->mallocFailed ) goto sqlite3ExprCodeIN_oom_error;
003823  
003824    /* Attempt to compute the RHS. After this step, if anything other than
003825    ** IN_INDEX_NOOP is returned, the table opened with cursor iTab
003826    ** contains the values that make up the RHS. If IN_INDEX_NOOP is returned,
003827    ** the RHS has not yet been coded.  */
003828    v = pParse->pVdbe;
003829    assert( v!=0 );       /* OOM detected prior to this routine */
003830    VdbeNoopComment((v, "begin IN expr"));
003831    eType = sqlite3FindInIndex(pParse, pExpr,
003832                               IN_INDEX_MEMBERSHIP | IN_INDEX_NOOP_OK,
003833                               destIfFalse==destIfNull ? 0 : &rRhsHasNull,
003834                               aiMap, &iTab);
003835  
003836    assert( pParse->nErr || nVector==1 || eType==IN_INDEX_EPH
003837         || eType==IN_INDEX_INDEX_ASC || eType==IN_INDEX_INDEX_DESC
003838    );
003839  #ifdef SQLITE_DEBUG
003840    /* Confirm that aiMap[] contains nVector integer values between 0 and
003841    ** nVector-1. */
003842    for(i=0; i<nVector; i++){
003843      int j, cnt;
003844      for(cnt=j=0; j<nVector; j++) if( aiMap[j]==i ) cnt++;
003845      assert( cnt==1 );
003846    }
003847  #endif
003848  
003849    /* Code the LHS, the <expr> from "<expr> IN (...)". If the LHS is a
003850    ** vector, then it is stored in an array of nVector registers starting
003851    ** at r1.
003852    **
003853    ** sqlite3FindInIndex() might have reordered the fields of the LHS vector
003854    ** so that the fields are in the same order as an existing index.   The
003855    ** aiMap[] array contains a mapping from the original LHS field order to
003856    ** the field order that matches the RHS index.
003857    **
003858    ** Avoid factoring the LHS of the IN(...) expression out of the loop,
003859    ** even if it is constant, as OP_Affinity may be used on the register
003860    ** by code generated below.  */
003861    assert( pParse->okConstFactor==okConstFactor );
003862    pParse->okConstFactor = 0;
003863    rLhsOrig = exprCodeVector(pParse, pLeft, &iDummy);
003864    pParse->okConstFactor = okConstFactor;
003865    for(i=0; i<nVector && aiMap[i]==i; i++){} /* Are LHS fields reordered? */
003866    if( i==nVector ){
003867      /* LHS fields are not reordered */
003868      rLhs = rLhsOrig;
003869    }else{
003870      /* Need to reorder the LHS fields according to aiMap */
003871      rLhs = sqlite3GetTempRange(pParse, nVector);
003872      for(i=0; i<nVector; i++){
003873        sqlite3VdbeAddOp3(v, OP_Copy, rLhsOrig+i, rLhs+aiMap[i], 0);
003874      }
003875    }
003876  
003877    /* If sqlite3FindInIndex() did not find or create an index that is
003878    ** suitable for evaluating the IN operator, then evaluate using a
003879    ** sequence of comparisons.
003880    **
003881    ** This is step (1) in the in-operator.md optimized algorithm.
003882    */
003883    if( eType==IN_INDEX_NOOP ){
003884      ExprList *pList;
003885      CollSeq *pColl;
003886      int labelOk = sqlite3VdbeMakeLabel(pParse);
003887      int r2, regToFree;
003888      int regCkNull = 0;
003889      int ii;
003890      assert( ExprUseXList(pExpr) );
003891      pList = pExpr->x.pList;
003892      pColl = sqlite3ExprCollSeq(pParse, pExpr->pLeft);
003893      if( destIfNull!=destIfFalse ){
003894        regCkNull = sqlite3GetTempReg(pParse);
003895        sqlite3VdbeAddOp3(v, OP_BitAnd, rLhs, rLhs, regCkNull);
003896      }
003897      for(ii=0; ii<pList->nExpr; ii++){
003898        r2 = sqlite3ExprCodeTemp(pParse, pList->a[ii].pExpr, &regToFree);
003899        if( regCkNull && sqlite3ExprCanBeNull(pList->a[ii].pExpr) ){
003900          sqlite3VdbeAddOp3(v, OP_BitAnd, regCkNull, r2, regCkNull);
003901        }
003902        sqlite3ReleaseTempReg(pParse, regToFree);
003903        if( ii<pList->nExpr-1 || destIfNull!=destIfFalse ){
003904          int op = rLhs!=r2 ? OP_Eq : OP_NotNull;
003905          sqlite3VdbeAddOp4(v, op, rLhs, labelOk, r2,
003906                            (void*)pColl, P4_COLLSEQ);
003907          VdbeCoverageIf(v, ii<pList->nExpr-1 && op==OP_Eq);
003908          VdbeCoverageIf(v, ii==pList->nExpr-1 && op==OP_Eq);
003909          VdbeCoverageIf(v, ii<pList->nExpr-1 && op==OP_NotNull);
003910          VdbeCoverageIf(v, ii==pList->nExpr-1 && op==OP_NotNull);
003911          sqlite3VdbeChangeP5(v, zAff[0]);
003912        }else{
003913          int op = rLhs!=r2 ? OP_Ne : OP_IsNull;
003914          assert( destIfNull==destIfFalse );
003915          sqlite3VdbeAddOp4(v, op, rLhs, destIfFalse, r2,
003916                            (void*)pColl, P4_COLLSEQ);
003917          VdbeCoverageIf(v, op==OP_Ne);
003918          VdbeCoverageIf(v, op==OP_IsNull);
003919          sqlite3VdbeChangeP5(v, zAff[0] | SQLITE_JUMPIFNULL);
003920        }
003921      }
003922      if( regCkNull ){
003923        sqlite3VdbeAddOp2(v, OP_IsNull, regCkNull, destIfNull); VdbeCoverage(v);
003924        sqlite3VdbeGoto(v, destIfFalse);
003925      }
003926      sqlite3VdbeResolveLabel(v, labelOk);
003927      sqlite3ReleaseTempReg(pParse, regCkNull);
003928      goto sqlite3ExprCodeIN_finished;
003929    }
003930  
003931    /* Step 2: Check to see if the LHS contains any NULL columns.  If the
003932    ** LHS does contain NULLs then the result must be either FALSE or NULL.
003933    ** We will then skip the binary search of the RHS.
003934    */
003935    if( destIfNull==destIfFalse ){
003936      destStep2 = destIfFalse;
003937    }else{
003938      destStep2 = destStep6 = sqlite3VdbeMakeLabel(pParse);
003939    }
003940    for(i=0; i<nVector; i++){
003941      Expr *p = sqlite3VectorFieldSubexpr(pExpr->pLeft, i);
003942      if( pParse->nErr ) goto sqlite3ExprCodeIN_oom_error;
003943      if( sqlite3ExprCanBeNull(p) ){
003944        sqlite3VdbeAddOp2(v, OP_IsNull, rLhs+i, destStep2);
003945        VdbeCoverage(v);
003946      }
003947    }
003948  
003949    /* Step 3.  The LHS is now known to be non-NULL.  Do the binary search
003950    ** of the RHS using the LHS as a probe.  If found, the result is
003951    ** true.
003952    */
003953    if( eType==IN_INDEX_ROWID ){
003954      /* In this case, the RHS is the ROWID of table b-tree and so we also
003955      ** know that the RHS is non-NULL.  Hence, we combine steps 3 and 4
003956      ** into a single opcode. */
003957      sqlite3VdbeAddOp3(v, OP_SeekRowid, iTab, destIfFalse, rLhs);
003958      VdbeCoverage(v);
003959      addrTruthOp = sqlite3VdbeAddOp0(v, OP_Goto);  /* Return True */
003960    }else{
003961      sqlite3VdbeAddOp4(v, OP_Affinity, rLhs, nVector, 0, zAff, nVector);
003962      if( destIfFalse==destIfNull ){
003963        /* Combine Step 3 and Step 5 into a single opcode */
003964        sqlite3VdbeAddOp4Int(v, OP_NotFound, iTab, destIfFalse,
003965                             rLhs, nVector); VdbeCoverage(v);
003966        goto sqlite3ExprCodeIN_finished;
003967      }
003968      /* Ordinary Step 3, for the case where FALSE and NULL are distinct */
003969      addrTruthOp = sqlite3VdbeAddOp4Int(v, OP_Found, iTab, 0,
003970                                        rLhs, nVector); VdbeCoverage(v);
003971    }
003972  
003973    /* Step 4.  If the RHS is known to be non-NULL and we did not find
003974    ** an match on the search above, then the result must be FALSE.
003975    */
003976    if( rRhsHasNull && nVector==1 ){
003977      sqlite3VdbeAddOp2(v, OP_NotNull, rRhsHasNull, destIfFalse);
003978      VdbeCoverage(v);
003979    }
003980  
003981    /* Step 5.  If we do not care about the difference between NULL and
003982    ** FALSE, then just return false.
003983    */
003984    if( destIfFalse==destIfNull ) sqlite3VdbeGoto(v, destIfFalse);
003985  
003986    /* Step 6: Loop through rows of the RHS.  Compare each row to the LHS.
003987    ** If any comparison is NULL, then the result is NULL.  If all
003988    ** comparisons are FALSE then the final result is FALSE.
003989    **
003990    ** For a scalar LHS, it is sufficient to check just the first row
003991    ** of the RHS.
003992    */
003993    if( destStep6 ) sqlite3VdbeResolveLabel(v, destStep6);
003994    addrTop = sqlite3VdbeAddOp2(v, OP_Rewind, iTab, destIfFalse);
003995    VdbeCoverage(v);
003996    if( nVector>1 ){
003997      destNotNull = sqlite3VdbeMakeLabel(pParse);
003998    }else{
003999      /* For nVector==1, combine steps 6 and 7 by immediately returning
004000      ** FALSE if the first comparison is not NULL */
004001      destNotNull = destIfFalse;
004002    }
004003    for(i=0; i<nVector; i++){
004004      Expr *p;
004005      CollSeq *pColl;
004006      int r3 = sqlite3GetTempReg(pParse);
004007      p = sqlite3VectorFieldSubexpr(pLeft, i);
004008      pColl = sqlite3ExprCollSeq(pParse, p);
004009      sqlite3VdbeAddOp3(v, OP_Column, iTab, i, r3);
004010      sqlite3VdbeAddOp4(v, OP_Ne, rLhs+i, destNotNull, r3,
004011                        (void*)pColl, P4_COLLSEQ);
004012      VdbeCoverage(v);
004013      sqlite3ReleaseTempReg(pParse, r3);
004014    }
004015    sqlite3VdbeAddOp2(v, OP_Goto, 0, destIfNull);
004016    if( nVector>1 ){
004017      sqlite3VdbeResolveLabel(v, destNotNull);
004018      sqlite3VdbeAddOp2(v, OP_Next, iTab, addrTop+1);
004019      VdbeCoverage(v);
004020  
004021      /* Step 7:  If we reach this point, we know that the result must
004022      ** be false. */
004023      sqlite3VdbeAddOp2(v, OP_Goto, 0, destIfFalse);
004024    }
004025  
004026    /* Jumps here in order to return true. */
004027    sqlite3VdbeJumpHere(v, addrTruthOp);
004028  
004029  sqlite3ExprCodeIN_finished:
004030    if( rLhs!=rLhsOrig ) sqlite3ReleaseTempReg(pParse, rLhs);
004031    VdbeComment((v, "end IN expr"));
004032  sqlite3ExprCodeIN_oom_error:
004033    sqlite3DbFree(pParse->db, aiMap);
004034    sqlite3DbFree(pParse->db, zAff);
004035  }
004036  #endif /* SQLITE_OMIT_SUBQUERY */
004037  
004038  #ifndef SQLITE_OMIT_FLOATING_POINT
004039  /*
004040  ** Generate an instruction that will put the floating point
004041  ** value described by z[0..n-1] into register iMem.
004042  **
004043  ** The z[] string will probably not be zero-terminated.  But the
004044  ** z[n] character is guaranteed to be something that does not look
004045  ** like the continuation of the number.
004046  */
004047  static void codeReal(Vdbe *v, const char *z, int negateFlag, int iMem){
004048    if( ALWAYS(z!=0) ){
004049      double value;
004050      sqlite3AtoF(z, &value, sqlite3Strlen30(z), SQLITE_UTF8);
004051      assert( !sqlite3IsNaN(value) ); /* The new AtoF never returns NaN */
004052      if( negateFlag ) value = -value;
004053      sqlite3VdbeAddOp4Dup8(v, OP_Real, 0, iMem, 0, (u8*)&value, P4_REAL);
004054    }
004055  }
004056  #endif
004057  
004058  
004059  /*
004060  ** Generate an instruction that will put the integer describe by
004061  ** text z[0..n-1] into register iMem.
004062  **
004063  ** Expr.u.zToken is always UTF8 and zero-terminated.
004064  */
004065  static void codeInteger(Parse *pParse, Expr *pExpr, int negFlag, int iMem){
004066    Vdbe *v = pParse->pVdbe;
004067    if( pExpr->flags & EP_IntValue ){
004068      int i = pExpr->u.iValue;
004069      assert( i>=0 );
004070      if( negFlag ) i = -i;
004071      sqlite3VdbeAddOp2(v, OP_Integer, i, iMem);
004072    }else{
004073      int c;
004074      i64 value;
004075      const char *z = pExpr->u.zToken;
004076      assert( z!=0 );
004077      c = sqlite3DecOrHexToI64(z, &value);
004078      if( (c==3 && !negFlag) || (c==2) || (negFlag && value==SMALLEST_INT64)){
004079  #ifdef SQLITE_OMIT_FLOATING_POINT
004080        sqlite3ErrorMsg(pParse, "oversized integer: %s%#T", negFlag?"-":"",pExpr);
004081  #else
004082  #ifndef SQLITE_OMIT_HEX_INTEGER
004083        if( sqlite3_strnicmp(z,"0x",2)==0 ){
004084          sqlite3ErrorMsg(pParse, "hex literal too big: %s%#T",
004085                          negFlag?"-":"",pExpr);
004086        }else
004087  #endif
004088        {
004089          codeReal(v, z, negFlag, iMem);
004090        }
004091  #endif
004092      }else{
004093        if( negFlag ){ value = c==3 ? SMALLEST_INT64 : -value; }
004094        sqlite3VdbeAddOp4Dup8(v, OP_Int64, 0, iMem, 0, (u8*)&value, P4_INT64);
004095      }
004096    }
004097  }
004098  
004099  
004100  /* Generate code that will load into register regOut a value that is
004101  ** appropriate for the iIdxCol-th column of index pIdx.
004102  */
004103  void sqlite3ExprCodeLoadIndexColumn(
004104    Parse *pParse,  /* The parsing context */
004105    Index *pIdx,    /* The index whose column is to be loaded */
004106    int iTabCur,    /* Cursor pointing to a table row */
004107    int iIdxCol,    /* The column of the index to be loaded */
004108    int regOut      /* Store the index column value in this register */
004109  ){
004110    i16 iTabCol = pIdx->aiColumn[iIdxCol];
004111    if( iTabCol==XN_EXPR ){
004112      assert( pIdx->aColExpr );
004113      assert( pIdx->aColExpr->nExpr>iIdxCol );
004114      pParse->iSelfTab = iTabCur + 1;
004115      sqlite3ExprCodeCopy(pParse, pIdx->aColExpr->a[iIdxCol].pExpr, regOut);
004116      pParse->iSelfTab = 0;
004117    }else{
004118      sqlite3ExprCodeGetColumnOfTable(pParse->pVdbe, pIdx->pTable, iTabCur,
004119                                      iTabCol, regOut);
004120    }
004121  }
004122  
004123  #ifndef SQLITE_OMIT_GENERATED_COLUMNS
004124  /*
004125  ** Generate code that will compute the value of generated column pCol
004126  ** and store the result in register regOut
004127  */
004128  void sqlite3ExprCodeGeneratedColumn(
004129    Parse *pParse,     /* Parsing context */
004130    Table *pTab,       /* Table containing the generated column */
004131    Column *pCol,      /* The generated column */
004132    int regOut         /* Put the result in this register */
004133  ){
004134    int iAddr;
004135    Vdbe *v = pParse->pVdbe;
004136    int nErr = pParse->nErr;
004137    assert( v!=0 );
004138    assert( pParse->iSelfTab!=0 );
004139    if( pParse->iSelfTab>0 ){
004140      iAddr = sqlite3VdbeAddOp3(v, OP_IfNullRow, pParse->iSelfTab-1, 0, regOut);
004141    }else{
004142      iAddr = 0;
004143    }
004144    sqlite3ExprCodeCopy(pParse, sqlite3ColumnExpr(pTab,pCol), regOut);
004145    if( pCol->affinity>=SQLITE_AFF_TEXT ){
004146      sqlite3VdbeAddOp4(v, OP_Affinity, regOut, 1, 0, &pCol->affinity, 1);
004147    }
004148    if( iAddr ) sqlite3VdbeJumpHere(v, iAddr);
004149    if( pParse->nErr>nErr ) pParse->db->errByteOffset = -1;
004150  }
004151  #endif /* SQLITE_OMIT_GENERATED_COLUMNS */
004152  
004153  /*
004154  ** Generate code to extract the value of the iCol-th column of a table.
004155  */
004156  void sqlite3ExprCodeGetColumnOfTable(
004157    Vdbe *v,        /* Parsing context */
004158    Table *pTab,    /* The table containing the value */
004159    int iTabCur,    /* The table cursor.  Or the PK cursor for WITHOUT ROWID */
004160    int iCol,       /* Index of the column to extract */
004161    int regOut      /* Extract the value into this register */
004162  ){
004163    Column *pCol;
004164    assert( v!=0 );
004165    assert( pTab!=0 );
004166    assert( iCol!=XN_EXPR );
004167    if( iCol<0 || iCol==pTab->iPKey ){
004168      sqlite3VdbeAddOp2(v, OP_Rowid, iTabCur, regOut);
004169      VdbeComment((v, "%s.rowid", pTab->zName));
004170    }else{
004171      int op;
004172      int x;
004173      if( IsVirtual(pTab) ){
004174        op = OP_VColumn;
004175        x = iCol;
004176  #ifndef SQLITE_OMIT_GENERATED_COLUMNS
004177      }else if( (pCol = &pTab->aCol[iCol])->colFlags & COLFLAG_VIRTUAL ){
004178        Parse *pParse = sqlite3VdbeParser(v);
004179        if( pCol->colFlags & COLFLAG_BUSY ){
004180          sqlite3ErrorMsg(pParse, "generated column loop on \"%s\"",
004181                          pCol->zCnName);
004182        }else{
004183          int savedSelfTab = pParse->iSelfTab;
004184          pCol->colFlags |= COLFLAG_BUSY;
004185          pParse->iSelfTab = iTabCur+1;
004186          sqlite3ExprCodeGeneratedColumn(pParse, pTab, pCol, regOut);
004187          pParse->iSelfTab = savedSelfTab;
004188          pCol->colFlags &= ~COLFLAG_BUSY;
004189        }
004190        return;
004191  #endif
004192      }else if( !HasRowid(pTab) ){
004193        testcase( iCol!=sqlite3TableColumnToStorage(pTab, iCol) );
004194        x = sqlite3TableColumnToIndex(sqlite3PrimaryKeyIndex(pTab), iCol);
004195        op = OP_Column;
004196      }else{
004197        x = sqlite3TableColumnToStorage(pTab,iCol);
004198        testcase( x!=iCol );
004199        op = OP_Column;
004200      }
004201      sqlite3VdbeAddOp3(v, op, iTabCur, x, regOut);
004202      sqlite3ColumnDefault(v, pTab, iCol, regOut);
004203    }
004204  }
004205  
004206  /*
004207  ** Generate code that will extract the iColumn-th column from
004208  ** table pTab and store the column value in register iReg.
004209  **
004210  ** There must be an open cursor to pTab in iTable when this routine
004211  ** is called.  If iColumn<0 then code is generated that extracts the rowid.
004212  */
004213  int sqlite3ExprCodeGetColumn(
004214    Parse *pParse,   /* Parsing and code generating context */
004215    Table *pTab,     /* Description of the table we are reading from */
004216    int iColumn,     /* Index of the table column */
004217    int iTable,      /* The cursor pointing to the table */
004218    int iReg,        /* Store results here */
004219    u8 p5            /* P5 value for OP_Column + FLAGS */
004220  ){
004221    assert( pParse->pVdbe!=0 );
004222    assert( (p5 & (OPFLAG_NOCHNG|OPFLAG_TYPEOFARG|OPFLAG_LENGTHARG))==p5 );
004223    assert( IsVirtual(pTab) || (p5 & OPFLAG_NOCHNG)==0 );
004224    sqlite3ExprCodeGetColumnOfTable(pParse->pVdbe, pTab, iTable, iColumn, iReg);
004225    if( p5 ){
004226      VdbeOp *pOp = sqlite3VdbeGetLastOp(pParse->pVdbe);
004227      if( pOp->opcode==OP_Column ) pOp->p5 = p5;
004228      if( pOp->opcode==OP_VColumn ) pOp->p5 = (p5 & OPFLAG_NOCHNG);
004229    }
004230    return iReg;
004231  }
004232  
004233  /*
004234  ** Generate code to move content from registers iFrom...iFrom+nReg-1
004235  ** over to iTo..iTo+nReg-1.
004236  */
004237  void sqlite3ExprCodeMove(Parse *pParse, int iFrom, int iTo, int nReg){
004238    sqlite3VdbeAddOp3(pParse->pVdbe, OP_Move, iFrom, iTo, nReg);
004239  }
004240  
004241  /*
004242  ** Convert a scalar expression node to a TK_REGISTER referencing
004243  ** register iReg.  The caller must ensure that iReg already contains
004244  ** the correct value for the expression.
004245  */
004246  static void exprToRegister(Expr *pExpr, int iReg){
004247    Expr *p = sqlite3ExprSkipCollateAndLikely(pExpr);
004248    if( NEVER(p==0) ) return;
004249    p->op2 = p->op;
004250    p->op = TK_REGISTER;
004251    p->iTable = iReg;
004252    ExprClearProperty(p, EP_Skip);
004253  }
004254  
004255  /*
004256  ** Evaluate an expression (either a vector or a scalar expression) and store
004257  ** the result in contiguous temporary registers.  Return the index of
004258  ** the first register used to store the result.
004259  **
004260  ** If the returned result register is a temporary scalar, then also write
004261  ** that register number into *piFreeable.  If the returned result register
004262  ** is not a temporary or if the expression is a vector set *piFreeable
004263  ** to 0.
004264  */
004265  static int exprCodeVector(Parse *pParse, Expr *p, int *piFreeable){
004266    int iResult;
004267    int nResult = sqlite3ExprVectorSize(p);
004268    if( nResult==1 ){
004269      iResult = sqlite3ExprCodeTemp(pParse, p, piFreeable);
004270    }else{
004271      *piFreeable = 0;
004272      if( p->op==TK_SELECT ){
004273  #if SQLITE_OMIT_SUBQUERY
004274        iResult = 0;
004275  #else
004276        iResult = sqlite3CodeSubselect(pParse, p);
004277  #endif
004278      }else{
004279        int i;
004280        iResult = pParse->nMem+1;
004281        pParse->nMem += nResult;
004282        assert( ExprUseXList(p) );
004283        for(i=0; i<nResult; i++){
004284          sqlite3ExprCodeFactorable(pParse, p->x.pList->a[i].pExpr, i+iResult);
004285        }
004286      }
004287    }
004288    return iResult;
004289  }
004290  
004291  /*
004292  ** If the last opcode is a OP_Copy, then set the do-not-merge flag (p5)
004293  ** so that a subsequent copy will not be merged into this one.
004294  */
004295  static void setDoNotMergeFlagOnCopy(Vdbe *v){
004296    if( sqlite3VdbeGetLastOp(v)->opcode==OP_Copy ){
004297      sqlite3VdbeChangeP5(v, 1);  /* Tag trailing OP_Copy as not mergeable */
004298    }
004299  }
004300  
004301  /*
004302  ** Generate code to implement special SQL functions that are implemented
004303  ** in-line rather than by using the usual callbacks.
004304  */
004305  static int exprCodeInlineFunction(
004306    Parse *pParse,        /* Parsing context */
004307    ExprList *pFarg,      /* List of function arguments */
004308    int iFuncId,          /* Function ID.  One of the INTFUNC_... values */
004309    int target            /* Store function result in this register */
004310  ){
004311    int nFarg;
004312    Vdbe *v = pParse->pVdbe;
004313    assert( v!=0 );
004314    assert( pFarg!=0 );
004315    nFarg = pFarg->nExpr;
004316    assert( nFarg>0 );  /* All in-line functions have at least one argument */
004317    switch( iFuncId ){
004318      case INLINEFUNC_coalesce: {
004319        /* Attempt a direct implementation of the built-in COALESCE() and
004320        ** IFNULL() functions.  This avoids unnecessary evaluation of
004321        ** arguments past the first non-NULL argument.
004322        */
004323        int endCoalesce = sqlite3VdbeMakeLabel(pParse);
004324        int i;
004325        assert( nFarg>=2 );
004326        sqlite3ExprCode(pParse, pFarg->a[0].pExpr, target);
004327        for(i=1; i<nFarg; i++){
004328          sqlite3VdbeAddOp2(v, OP_NotNull, target, endCoalesce);
004329          VdbeCoverage(v);
004330          sqlite3ExprCode(pParse, pFarg->a[i].pExpr, target);
004331        }
004332        setDoNotMergeFlagOnCopy(v);
004333        sqlite3VdbeResolveLabel(v, endCoalesce);
004334        break;
004335      }
004336      case INLINEFUNC_iif: {
004337        Expr caseExpr;
004338        memset(&caseExpr, 0, sizeof(caseExpr));
004339        caseExpr.op = TK_CASE;
004340        caseExpr.x.pList = pFarg;
004341        return sqlite3ExprCodeTarget(pParse, &caseExpr, target);
004342      }
004343  #ifdef SQLITE_ENABLE_OFFSET_SQL_FUNC
004344      case INLINEFUNC_sqlite_offset: {
004345        Expr *pArg = pFarg->a[0].pExpr;
004346        if( pArg->op==TK_COLUMN && pArg->iTable>=0 ){
004347          sqlite3VdbeAddOp3(v, OP_Offset, pArg->iTable, pArg->iColumn, target);
004348        }else{
004349          sqlite3VdbeAddOp2(v, OP_Null, 0, target);
004350        }
004351        break;
004352      }
004353  #endif
004354      default: {  
004355        /* The UNLIKELY() function is a no-op.  The result is the value
004356        ** of the first argument.
004357        */
004358        assert( nFarg==1 || nFarg==2 );
004359        target = sqlite3ExprCodeTarget(pParse, pFarg->a[0].pExpr, target);
004360        break;
004361      }
004362  
004363    /***********************************************************************
004364    ** Test-only SQL functions that are only usable if enabled
004365    ** via SQLITE_TESTCTRL_INTERNAL_FUNCTIONS
004366    */
004367  #if !defined(SQLITE_UNTESTABLE)
004368      case INLINEFUNC_expr_compare: {
004369        /* Compare two expressions using sqlite3ExprCompare() */
004370        assert( nFarg==2 );
004371        sqlite3VdbeAddOp2(v, OP_Integer,
004372           sqlite3ExprCompare(0,pFarg->a[0].pExpr, pFarg->a[1].pExpr,-1),
004373           target);
004374        break;
004375      }
004376  
004377      case INLINEFUNC_expr_implies_expr: {
004378        /* Compare two expressions using sqlite3ExprImpliesExpr() */
004379        assert( nFarg==2 );
004380        sqlite3VdbeAddOp2(v, OP_Integer,
004381           sqlite3ExprImpliesExpr(pParse,pFarg->a[0].pExpr, pFarg->a[1].pExpr,-1),
004382           target);
004383        break;
004384      }
004385  
004386      case INLINEFUNC_implies_nonnull_row: {
004387        /* Result of sqlite3ExprImpliesNonNullRow() */
004388        Expr *pA1;
004389        assert( nFarg==2 );
004390        pA1 = pFarg->a[1].pExpr;
004391        if( pA1->op==TK_COLUMN ){
004392          sqlite3VdbeAddOp2(v, OP_Integer,
004393             sqlite3ExprImpliesNonNullRow(pFarg->a[0].pExpr,pA1->iTable,1),
004394             target);
004395        }else{
004396          sqlite3VdbeAddOp2(v, OP_Null, 0, target);
004397        }
004398        break;
004399      }
004400  
004401      case INLINEFUNC_affinity: {
004402        /* The AFFINITY() function evaluates to a string that describes
004403        ** the type affinity of the argument.  This is used for testing of
004404        ** the SQLite type logic.
004405        */
004406        const char *azAff[] = { "blob", "text", "numeric", "integer",
004407                                "real", "flexnum" };
004408        char aff;
004409        assert( nFarg==1 );
004410        aff = sqlite3ExprAffinity(pFarg->a[0].pExpr);
004411        assert( aff<=SQLITE_AFF_NONE
004412             || (aff>=SQLITE_AFF_BLOB && aff<=SQLITE_AFF_FLEXNUM) );
004413        sqlite3VdbeLoadString(v, target,
004414                (aff<=SQLITE_AFF_NONE) ? "none" : azAff[aff-SQLITE_AFF_BLOB]);
004415        break;
004416      }
004417  #endif /* !defined(SQLITE_UNTESTABLE) */
004418    }
004419    return target;
004420  }
004421  
004422  /*
004423  ** Check to see if pExpr is one of the indexed expressions on pParse->pIdxEpr.
004424  ** If it is, then resolve the expression by reading from the index and
004425  ** return the register into which the value has been read.  If pExpr is
004426  ** not an indexed expression, then return negative.
004427  */
004428  static SQLITE_NOINLINE int sqlite3IndexedExprLookup(
004429    Parse *pParse,   /* The parsing context */
004430    Expr *pExpr,     /* The expression to potentially bypass */
004431    int target       /* Where to store the result of the expression */
004432  ){
004433    IndexedExpr *p;
004434    Vdbe *v;
004435    for(p=pParse->pIdxEpr; p; p=p->pIENext){
004436      u8 exprAff;
004437      int iDataCur = p->iDataCur;
004438      if( iDataCur<0 ) continue;
004439      if( pParse->iSelfTab ){
004440        if( p->iDataCur!=pParse->iSelfTab-1 ) continue;
004441        iDataCur = -1;
004442      }
004443      if( sqlite3ExprCompare(0, pExpr, p->pExpr, iDataCur)!=0 ) continue;
004444      assert( p->aff>=SQLITE_AFF_BLOB && p->aff<=SQLITE_AFF_NUMERIC );
004445      exprAff = sqlite3ExprAffinity(pExpr);
004446      if( (exprAff<=SQLITE_AFF_BLOB && p->aff!=SQLITE_AFF_BLOB)
004447       || (exprAff==SQLITE_AFF_TEXT && p->aff!=SQLITE_AFF_TEXT)
004448       || (exprAff>=SQLITE_AFF_NUMERIC && p->aff!=SQLITE_AFF_NUMERIC)
004449      ){
004450        /* Affinity mismatch on a generated column */
004451        continue;
004452      }
004453  
004454      v = pParse->pVdbe;
004455      assert( v!=0 );
004456      if( p->bMaybeNullRow ){
004457        /* If the index is on a NULL row due to an outer join, then we
004458        ** cannot extract the value from the index.  The value must be
004459        ** computed using the original expression. */
004460        int addr = sqlite3VdbeCurrentAddr(v);
004461        sqlite3VdbeAddOp3(v, OP_IfNullRow, p->iIdxCur, addr+3, target);
004462        VdbeCoverage(v);
004463        sqlite3VdbeAddOp3(v, OP_Column, p->iIdxCur, p->iIdxCol, target);
004464        VdbeComment((v, "%s expr-column %d", p->zIdxName, p->iIdxCol));
004465        sqlite3VdbeGoto(v, 0);
004466        p = pParse->pIdxEpr;
004467        pParse->pIdxEpr = 0;
004468        sqlite3ExprCode(pParse, pExpr, target);
004469        pParse->pIdxEpr = p;
004470        sqlite3VdbeJumpHere(v, addr+2);
004471      }else{
004472        sqlite3VdbeAddOp3(v, OP_Column, p->iIdxCur, p->iIdxCol, target);
004473        VdbeComment((v, "%s expr-column %d", p->zIdxName, p->iIdxCol));
004474      }
004475      return target;
004476    }
004477    return -1;  /* Not found */
004478  }
004479  
004480  
004481  /*
004482  ** Expresion pExpr is guaranteed to be a TK_COLUMN or equivalent. This
004483  ** function checks the Parse.pIdxPartExpr list to see if this column
004484  ** can be replaced with a constant value. If so, it generates code to
004485  ** put the constant value in a register (ideally, but not necessarily, 
004486  ** register iTarget) and returns the register number.
004487  **
004488  ** Or, if the TK_COLUMN cannot be replaced by a constant, zero is 
004489  ** returned.
004490  */
004491  static int exprPartidxExprLookup(Parse *pParse, Expr *pExpr, int iTarget){
004492    IndexedExpr *p;
004493    for(p=pParse->pIdxPartExpr; p; p=p->pIENext){
004494      if( pExpr->iColumn==p->iIdxCol && pExpr->iTable==p->iDataCur ){
004495        Vdbe *v = pParse->pVdbe;
004496        int addr = 0;
004497        int ret;
004498  
004499        if( p->bMaybeNullRow ){
004500          addr = sqlite3VdbeAddOp1(v, OP_IfNullRow, p->iIdxCur);
004501        }
004502        ret = sqlite3ExprCodeTarget(pParse, p->pExpr, iTarget);
004503        sqlite3VdbeAddOp4(pParse->pVdbe, OP_Affinity, ret, 1, 0,
004504                          (const char*)&p->aff, 1);
004505        if( addr ){
004506          sqlite3VdbeJumpHere(v, addr);
004507          sqlite3VdbeChangeP3(v, addr, ret);
004508        }
004509        return ret;
004510      }
004511    }
004512    return 0;
004513  }
004514  
004515  
004516  /*
004517  ** Generate code into the current Vdbe to evaluate the given
004518  ** expression.  Attempt to store the results in register "target".
004519  ** Return the register where results are stored.
004520  **
004521  ** With this routine, there is no guarantee that results will
004522  ** be stored in target.  The result might be stored in some other
004523  ** register if it is convenient to do so.  The calling function
004524  ** must check the return code and move the results to the desired
004525  ** register.
004526  */
004527  int sqlite3ExprCodeTarget(Parse *pParse, Expr *pExpr, int target){
004528    Vdbe *v = pParse->pVdbe;  /* The VM under construction */
004529    int op;                   /* The opcode being coded */
004530    int inReg = target;       /* Results stored in register inReg */
004531    int regFree1 = 0;         /* If non-zero free this temporary register */
004532    int regFree2 = 0;         /* If non-zero free this temporary register */
004533    int r1, r2;               /* Various register numbers */
004534    Expr tempX;               /* Temporary expression node */
004535    int p5 = 0;
004536  
004537    assert( target>0 && target<=pParse->nMem );
004538    assert( v!=0 );
004539  
004540  expr_code_doover:
004541    if( pExpr==0 ){
004542      op = TK_NULL;
004543    }else if( pParse->pIdxEpr!=0
004544     && !ExprHasProperty(pExpr, EP_Leaf)
004545     && (r1 = sqlite3IndexedExprLookup(pParse, pExpr, target))>=0
004546    ){
004547      return r1;
004548    }else{
004549      assert( !ExprHasVVAProperty(pExpr,EP_Immutable) );
004550      op = pExpr->op;
004551    }
004552    assert( op!=TK_ORDER );
004553    switch( op ){
004554      case TK_AGG_COLUMN: {
004555        AggInfo *pAggInfo = pExpr->pAggInfo;
004556        struct AggInfo_col *pCol;
004557        assert( pAggInfo!=0 );
004558        assert( pExpr->iAgg>=0 );
004559        if( pExpr->iAgg>=pAggInfo->nColumn ){
004560          /* Happens when the left table of a RIGHT JOIN is null and
004561          ** is using an expression index */
004562          sqlite3VdbeAddOp2(v, OP_Null, 0, target);
004563  #ifdef SQLITE_VDBE_COVERAGE
004564          /* Verify that the OP_Null above is exercised by tests
004565          ** tag-20230325-2 */
004566          sqlite3VdbeAddOp3(v, OP_NotNull, target, 1, 20230325);
004567          VdbeCoverageNeverTaken(v);
004568  #endif
004569          break;
004570        }
004571        pCol = &pAggInfo->aCol[pExpr->iAgg];
004572        if( !pAggInfo->directMode ){
004573          return AggInfoColumnReg(pAggInfo, pExpr->iAgg);
004574        }else if( pAggInfo->useSortingIdx ){
004575          Table *pTab = pCol->pTab;
004576          sqlite3VdbeAddOp3(v, OP_Column, pAggInfo->sortingIdxPTab,
004577                                pCol->iSorterColumn, target);
004578          if( pTab==0 ){
004579            /* No comment added */
004580          }else if( pCol->iColumn<0 ){
004581            VdbeComment((v,"%s.rowid",pTab->zName));
004582          }else{
004583            VdbeComment((v,"%s.%s",
004584                pTab->zName, pTab->aCol[pCol->iColumn].zCnName));
004585            if( pTab->aCol[pCol->iColumn].affinity==SQLITE_AFF_REAL ){
004586              sqlite3VdbeAddOp1(v, OP_RealAffinity, target);
004587            }
004588          }
004589          return target;
004590        }else if( pExpr->y.pTab==0 ){
004591          /* This case happens when the argument to an aggregate function
004592          ** is rewritten by aggregateConvertIndexedExprRefToColumn() */
004593          sqlite3VdbeAddOp3(v, OP_Column, pExpr->iTable, pExpr->iColumn, target);
004594          return target;
004595        }
004596        /* Otherwise, fall thru into the TK_COLUMN case */
004597        /* no break */ deliberate_fall_through
004598      }
004599      case TK_COLUMN: {
004600        int iTab = pExpr->iTable;
004601        int iReg;
004602        if( ExprHasProperty(pExpr, EP_FixedCol) ){
004603          /* This COLUMN expression is really a constant due to WHERE clause
004604          ** constraints, and that constant is coded by the pExpr->pLeft
004605          ** expression.  However, make sure the constant has the correct
004606          ** datatype by applying the Affinity of the table column to the
004607          ** constant.
004608          */
004609          int aff;
004610          iReg = sqlite3ExprCodeTarget(pParse, pExpr->pLeft,target);
004611          assert( ExprUseYTab(pExpr) );
004612          assert( pExpr->y.pTab!=0 );
004613          aff = sqlite3TableColumnAffinity(pExpr->y.pTab, pExpr->iColumn);
004614          if( aff>SQLITE_AFF_BLOB ){
004615            static const char zAff[] = "B\000C\000D\000E\000F";
004616            assert( SQLITE_AFF_BLOB=='A' );
004617            assert( SQLITE_AFF_TEXT=='B' );
004618            sqlite3VdbeAddOp4(v, OP_Affinity, iReg, 1, 0,
004619                              &zAff[(aff-'B')*2], P4_STATIC);
004620          }
004621          return iReg;
004622        }
004623        if( iTab<0 ){
004624          if( pParse->iSelfTab<0 ){
004625            /* Other columns in the same row for CHECK constraints or
004626            ** generated columns or for inserting into partial index.
004627            ** The row is unpacked into registers beginning at
004628            ** 0-(pParse->iSelfTab).  The rowid (if any) is in a register
004629            ** immediately prior to the first column.
004630            */
004631            Column *pCol;
004632            Table *pTab;
004633            int iSrc;
004634            int iCol = pExpr->iColumn;
004635            assert( ExprUseYTab(pExpr) );
004636            pTab = pExpr->y.pTab;
004637            assert( pTab!=0 );
004638            assert( iCol>=XN_ROWID );
004639            assert( iCol<pTab->nCol );
004640            if( iCol<0 ){
004641              return -1-pParse->iSelfTab;
004642            }
004643            pCol = pTab->aCol + iCol;
004644            testcase( iCol!=sqlite3TableColumnToStorage(pTab,iCol) );
004645            iSrc = sqlite3TableColumnToStorage(pTab, iCol) - pParse->iSelfTab;
004646  #ifndef SQLITE_OMIT_GENERATED_COLUMNS
004647            if( pCol->colFlags & COLFLAG_GENERATED ){
004648              if( pCol->colFlags & COLFLAG_BUSY ){
004649                sqlite3ErrorMsg(pParse, "generated column loop on \"%s\"",
004650                                pCol->zCnName);
004651                return 0;
004652              }
004653              pCol->colFlags |= COLFLAG_BUSY;
004654              if( pCol->colFlags & COLFLAG_NOTAVAIL ){
004655                sqlite3ExprCodeGeneratedColumn(pParse, pTab, pCol, iSrc);
004656              }
004657              pCol->colFlags &= ~(COLFLAG_BUSY|COLFLAG_NOTAVAIL);
004658              return iSrc;
004659            }else
004660  #endif /* SQLITE_OMIT_GENERATED_COLUMNS */
004661            if( pCol->affinity==SQLITE_AFF_REAL ){
004662              sqlite3VdbeAddOp2(v, OP_SCopy, iSrc, target);
004663              sqlite3VdbeAddOp1(v, OP_RealAffinity, target);
004664              return target;
004665            }else{
004666              return iSrc;
004667            }
004668          }else{
004669            /* Coding an expression that is part of an index where column names
004670            ** in the index refer to the table to which the index belongs */
004671            iTab = pParse->iSelfTab - 1;
004672          }
004673        }
004674        else if( pParse->pIdxPartExpr 
004675         && 0!=(r1 = exprPartidxExprLookup(pParse, pExpr, target))
004676        ){
004677          return r1;
004678        }
004679        assert( ExprUseYTab(pExpr) );
004680        assert( pExpr->y.pTab!=0 );
004681        iReg = sqlite3ExprCodeGetColumn(pParse, pExpr->y.pTab,
004682                                 pExpr->iColumn, iTab, target,
004683                                 pExpr->op2);
004684        return iReg;
004685      }
004686      case TK_INTEGER: {
004687        codeInteger(pParse, pExpr, 0, target);
004688        return target;
004689      }
004690      case TK_TRUEFALSE: {
004691        sqlite3VdbeAddOp2(v, OP_Integer, sqlite3ExprTruthValue(pExpr), target);
004692        return target;
004693      }
004694  #ifndef SQLITE_OMIT_FLOATING_POINT
004695      case TK_FLOAT: {
004696        assert( !ExprHasProperty(pExpr, EP_IntValue) );
004697        codeReal(v, pExpr->u.zToken, 0, target);
004698        return target;
004699      }
004700  #endif
004701      case TK_STRING: {
004702        assert( !ExprHasProperty(pExpr, EP_IntValue) );
004703        sqlite3VdbeLoadString(v, target, pExpr->u.zToken);
004704        return target;
004705      }
004706      default: {
004707        /* Make NULL the default case so that if a bug causes an illegal
004708        ** Expr node to be passed into this function, it will be handled
004709        ** sanely and not crash.  But keep the assert() to bring the problem
004710        ** to the attention of the developers. */
004711        assert( op==TK_NULL || op==TK_ERROR || pParse->db->mallocFailed );
004712        sqlite3VdbeAddOp2(v, OP_Null, 0, target);
004713        return target;
004714      }
004715  #ifndef SQLITE_OMIT_BLOB_LITERAL
004716      case TK_BLOB: {
004717        int n;
004718        const char *z;
004719        char *zBlob;
004720        assert( !ExprHasProperty(pExpr, EP_IntValue) );
004721        assert( pExpr->u.zToken[0]=='x' || pExpr->u.zToken[0]=='X' );
004722        assert( pExpr->u.zToken[1]=='\'' );
004723        z = &pExpr->u.zToken[2];
004724        n = sqlite3Strlen30(z) - 1;
004725        assert( z[n]=='\'' );
004726        zBlob = sqlite3HexToBlob(sqlite3VdbeDb(v), z, n);
004727        sqlite3VdbeAddOp4(v, OP_Blob, n/2, target, 0, zBlob, P4_DYNAMIC);
004728        return target;
004729      }
004730  #endif
004731      case TK_VARIABLE: {
004732        assert( !ExprHasProperty(pExpr, EP_IntValue) );
004733        assert( pExpr->u.zToken!=0 );
004734        assert( pExpr->u.zToken[0]!=0 );
004735        sqlite3VdbeAddOp2(v, OP_Variable, pExpr->iColumn, target);
004736        return target;
004737      }
004738      case TK_REGISTER: {
004739        return pExpr->iTable;
004740      }
004741  #ifndef SQLITE_OMIT_CAST
004742      case TK_CAST: {
004743        /* Expressions of the form:   CAST(pLeft AS token) */
004744        sqlite3ExprCode(pParse, pExpr->pLeft, target);
004745        assert( inReg==target );
004746        assert( !ExprHasProperty(pExpr, EP_IntValue) );
004747        sqlite3VdbeAddOp2(v, OP_Cast, target,
004748                          sqlite3AffinityType(pExpr->u.zToken, 0));
004749        return inReg;
004750      }
004751  #endif /* SQLITE_OMIT_CAST */
004752      case TK_IS:
004753      case TK_ISNOT:
004754        op = (op==TK_IS) ? TK_EQ : TK_NE;
004755        p5 = SQLITE_NULLEQ;
004756        /* fall-through */
004757      case TK_LT:
004758      case TK_LE:
004759      case TK_GT:
004760      case TK_GE:
004761      case TK_NE:
004762      case TK_EQ: {
004763        Expr *pLeft = pExpr->pLeft;
004764        if( sqlite3ExprIsVector(pLeft) ){
004765          codeVectorCompare(pParse, pExpr, target, op, p5);
004766        }else{
004767          r1 = sqlite3ExprCodeTemp(pParse, pLeft, &regFree1);
004768          r2 = sqlite3ExprCodeTemp(pParse, pExpr->pRight, &regFree2);
004769          sqlite3VdbeAddOp2(v, OP_Integer, 1, inReg);
004770          codeCompare(pParse, pLeft, pExpr->pRight, op, r1, r2,
004771              sqlite3VdbeCurrentAddr(v)+2, p5,
004772              ExprHasProperty(pExpr,EP_Commuted));
004773          assert(TK_LT==OP_Lt); testcase(op==OP_Lt); VdbeCoverageIf(v,op==OP_Lt);
004774          assert(TK_LE==OP_Le); testcase(op==OP_Le); VdbeCoverageIf(v,op==OP_Le);
004775          assert(TK_GT==OP_Gt); testcase(op==OP_Gt); VdbeCoverageIf(v,op==OP_Gt);
004776          assert(TK_GE==OP_Ge); testcase(op==OP_Ge); VdbeCoverageIf(v,op==OP_Ge);
004777          assert(TK_EQ==OP_Eq); testcase(op==OP_Eq); VdbeCoverageIf(v,op==OP_Eq);
004778          assert(TK_NE==OP_Ne); testcase(op==OP_Ne); VdbeCoverageIf(v,op==OP_Ne);
004779          if( p5==SQLITE_NULLEQ ){
004780            sqlite3VdbeAddOp2(v, OP_Integer, 0, inReg);
004781          }else{
004782            sqlite3VdbeAddOp3(v, OP_ZeroOrNull, r1, inReg, r2);
004783          }
004784          testcase( regFree1==0 );
004785          testcase( regFree2==0 );
004786        }
004787        break;
004788      }
004789      case TK_AND:
004790      case TK_OR:
004791      case TK_PLUS:
004792      case TK_STAR:
004793      case TK_MINUS:
004794      case TK_REM:
004795      case TK_BITAND:
004796      case TK_BITOR:
004797      case TK_SLASH:
004798      case TK_LSHIFT:
004799      case TK_RSHIFT:
004800      case TK_CONCAT: {
004801        assert( TK_AND==OP_And );            testcase( op==TK_AND );
004802        assert( TK_OR==OP_Or );              testcase( op==TK_OR );
004803        assert( TK_PLUS==OP_Add );           testcase( op==TK_PLUS );
004804        assert( TK_MINUS==OP_Subtract );     testcase( op==TK_MINUS );
004805        assert( TK_REM==OP_Remainder );      testcase( op==TK_REM );
004806        assert( TK_BITAND==OP_BitAnd );      testcase( op==TK_BITAND );
004807        assert( TK_BITOR==OP_BitOr );        testcase( op==TK_BITOR );
004808        assert( TK_SLASH==OP_Divide );       testcase( op==TK_SLASH );
004809        assert( TK_LSHIFT==OP_ShiftLeft );   testcase( op==TK_LSHIFT );
004810        assert( TK_RSHIFT==OP_ShiftRight );  testcase( op==TK_RSHIFT );
004811        assert( TK_CONCAT==OP_Concat );      testcase( op==TK_CONCAT );
004812        r1 = sqlite3ExprCodeTemp(pParse, pExpr->pLeft, &regFree1);
004813        r2 = sqlite3ExprCodeTemp(pParse, pExpr->pRight, &regFree2);
004814        sqlite3VdbeAddOp3(v, op, r2, r1, target);
004815        testcase( regFree1==0 );
004816        testcase( regFree2==0 );
004817        break;
004818      }
004819      case TK_UMINUS: {
004820        Expr *pLeft = pExpr->pLeft;
004821        assert( pLeft );
004822        if( pLeft->op==TK_INTEGER ){
004823          codeInteger(pParse, pLeft, 1, target);
004824          return target;
004825  #ifndef SQLITE_OMIT_FLOATING_POINT
004826        }else if( pLeft->op==TK_FLOAT ){
004827          assert( !ExprHasProperty(pExpr, EP_IntValue) );
004828          codeReal(v, pLeft->u.zToken, 1, target);
004829          return target;
004830  #endif
004831        }else{
004832          tempX.op = TK_INTEGER;
004833          tempX.flags = EP_IntValue|EP_TokenOnly;
004834          tempX.u.iValue = 0;
004835          ExprClearVVAProperties(&tempX);
004836          r1 = sqlite3ExprCodeTemp(pParse, &tempX, &regFree1);
004837          r2 = sqlite3ExprCodeTemp(pParse, pExpr->pLeft, &regFree2);
004838          sqlite3VdbeAddOp3(v, OP_Subtract, r2, r1, target);
004839          testcase( regFree2==0 );
004840        }
004841        break;
004842      }
004843      case TK_BITNOT:
004844      case TK_NOT: {
004845        assert( TK_BITNOT==OP_BitNot );   testcase( op==TK_BITNOT );
004846        assert( TK_NOT==OP_Not );         testcase( op==TK_NOT );
004847        r1 = sqlite3ExprCodeTemp(pParse, pExpr->pLeft, &regFree1);
004848        testcase( regFree1==0 );
004849        sqlite3VdbeAddOp2(v, op, r1, inReg);
004850        break;
004851      }
004852      case TK_TRUTH: {
004853        int isTrue;    /* IS TRUE or IS NOT TRUE */
004854        int bNormal;   /* IS TRUE or IS FALSE */
004855        r1 = sqlite3ExprCodeTemp(pParse, pExpr->pLeft, &regFree1);
004856        testcase( regFree1==0 );
004857        isTrue = sqlite3ExprTruthValue(pExpr->pRight);
004858        bNormal = pExpr->op2==TK_IS;
004859        testcase( isTrue && bNormal);
004860        testcase( !isTrue && bNormal);
004861        sqlite3VdbeAddOp4Int(v, OP_IsTrue, r1, inReg, !isTrue, isTrue ^ bNormal);
004862        break;
004863      }
004864      case TK_ISNULL:
004865      case TK_NOTNULL: {
004866        int addr;
004867        assert( TK_ISNULL==OP_IsNull );   testcase( op==TK_ISNULL );
004868        assert( TK_NOTNULL==OP_NotNull ); testcase( op==TK_NOTNULL );
004869        sqlite3VdbeAddOp2(v, OP_Integer, 1, target);
004870        r1 = sqlite3ExprCodeTemp(pParse, pExpr->pLeft, &regFree1);
004871        testcase( regFree1==0 );
004872        addr = sqlite3VdbeAddOp1(v, op, r1);
004873        VdbeCoverageIf(v, op==TK_ISNULL);
004874        VdbeCoverageIf(v, op==TK_NOTNULL);
004875        sqlite3VdbeAddOp2(v, OP_Integer, 0, target);
004876        sqlite3VdbeJumpHere(v, addr);
004877        break;
004878      }
004879      case TK_AGG_FUNCTION: {
004880        AggInfo *pInfo = pExpr->pAggInfo;
004881        if( pInfo==0
004882         || NEVER(pExpr->iAgg<0)
004883         || NEVER(pExpr->iAgg>=pInfo->nFunc)
004884        ){
004885          assert( !ExprHasProperty(pExpr, EP_IntValue) );
004886          sqlite3ErrorMsg(pParse, "misuse of aggregate: %#T()", pExpr);
004887        }else{
004888          return AggInfoFuncReg(pInfo, pExpr->iAgg);
004889        }
004890        break;
004891      }
004892      case TK_FUNCTION: {
004893        ExprList *pFarg;       /* List of function arguments */
004894        int nFarg;             /* Number of function arguments */
004895        FuncDef *pDef;         /* The function definition object */
004896        const char *zId;       /* The function name */
004897        u32 constMask = 0;     /* Mask of function arguments that are constant */
004898        int i;                 /* Loop counter */
004899        sqlite3 *db = pParse->db;  /* The database connection */
004900        u8 enc = ENC(db);      /* The text encoding used by this database */
004901        CollSeq *pColl = 0;    /* A collating sequence */
004902  
004903  #ifndef SQLITE_OMIT_WINDOWFUNC
004904        if( ExprHasProperty(pExpr, EP_WinFunc) ){
004905          return pExpr->y.pWin->regResult;
004906        }
004907  #endif
004908  
004909        if( ConstFactorOk(pParse)
004910         && sqlite3ExprIsConstantNotJoin(pParse,pExpr)
004911        ){
004912          /* SQL functions can be expensive. So try to avoid running them
004913          ** multiple times if we know they always give the same result */
004914          return sqlite3ExprCodeRunJustOnce(pParse, pExpr, -1);
004915        }
004916        assert( !ExprHasProperty(pExpr, EP_TokenOnly) );
004917        assert( ExprUseXList(pExpr) );
004918        pFarg = pExpr->x.pList;
004919        nFarg = pFarg ? pFarg->nExpr : 0;
004920        assert( !ExprHasProperty(pExpr, EP_IntValue) );
004921        zId = pExpr->u.zToken;
004922        pDef = sqlite3FindFunction(db, zId, nFarg, enc, 0);
004923  #ifdef SQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
004924        if( pDef==0 && pParse->explain ){
004925          pDef = sqlite3FindFunction(db, "unknown", nFarg, enc, 0);
004926        }
004927  #endif
004928        if( pDef==0 || pDef->xFinalize!=0 ){
004929          sqlite3ErrorMsg(pParse, "unknown function: %#T()", pExpr);
004930          break;
004931        }
004932        if( (pDef->funcFlags & SQLITE_FUNC_INLINE)!=0 && ALWAYS(pFarg!=0) ){
004933          assert( (pDef->funcFlags & SQLITE_FUNC_UNSAFE)==0 );
004934          assert( (pDef->funcFlags & SQLITE_FUNC_DIRECT)==0 );
004935          return exprCodeInlineFunction(pParse, pFarg,
004936               SQLITE_PTR_TO_INT(pDef->pUserData), target);
004937        }else if( pDef->funcFlags & (SQLITE_FUNC_DIRECT|SQLITE_FUNC_UNSAFE) ){
004938          sqlite3ExprFunctionUsable(pParse, pExpr, pDef);
004939        }
004940  
004941        for(i=0; i<nFarg; i++){
004942          if( i<32 && sqlite3ExprIsConstant(pParse, pFarg->a[i].pExpr) ){
004943            testcase( i==31 );
004944            constMask |= MASKBIT32(i);
004945          }
004946          if( (pDef->funcFlags & SQLITE_FUNC_NEEDCOLL)!=0 && !pColl ){
004947            pColl = sqlite3ExprCollSeq(pParse, pFarg->a[i].pExpr);
004948          }
004949        }
004950        if( pFarg ){
004951          if( constMask ){
004952            r1 = pParse->nMem+1;
004953            pParse->nMem += nFarg;
004954          }else{
004955            r1 = sqlite3GetTempRange(pParse, nFarg);
004956          }
004957  
004958          /* For length() and typeof() and octet_length() functions,
004959          ** set the P5 parameter to the OP_Column opcode to OPFLAG_LENGTHARG
004960          ** or OPFLAG_TYPEOFARG or OPFLAG_BYTELENARG respectively, to avoid
004961          ** unnecessary data loading.
004962          */
004963          if( (pDef->funcFlags & (SQLITE_FUNC_LENGTH|SQLITE_FUNC_TYPEOF))!=0 ){
004964            u8 exprOp;
004965            assert( nFarg==1 );
004966            assert( pFarg->a[0].pExpr!=0 );
004967            exprOp = pFarg->a[0].pExpr->op;
004968            if( exprOp==TK_COLUMN || exprOp==TK_AGG_COLUMN ){
004969              assert( SQLITE_FUNC_LENGTH==OPFLAG_LENGTHARG );
004970              assert( SQLITE_FUNC_TYPEOF==OPFLAG_TYPEOFARG );
004971              assert( SQLITE_FUNC_BYTELEN==OPFLAG_BYTELENARG );
004972              assert( (OPFLAG_LENGTHARG|OPFLAG_TYPEOFARG)==OPFLAG_BYTELENARG );
004973              testcase( (pDef->funcFlags & OPFLAG_BYTELENARG)==OPFLAG_LENGTHARG );
004974              testcase( (pDef->funcFlags & OPFLAG_BYTELENARG)==OPFLAG_TYPEOFARG );
004975              testcase( (pDef->funcFlags & OPFLAG_BYTELENARG)==OPFLAG_BYTELENARG);
004976              pFarg->a[0].pExpr->op2 = pDef->funcFlags & OPFLAG_BYTELENARG;
004977            }
004978          }
004979  
004980          sqlite3ExprCodeExprList(pParse, pFarg, r1, 0, SQLITE_ECEL_FACTOR);
004981        }else{
004982          r1 = 0;
004983        }
004984  #ifndef SQLITE_OMIT_VIRTUALTABLE
004985        /* Possibly overload the function if the first argument is
004986        ** a virtual table column.
004987        **
004988        ** For infix functions (LIKE, GLOB, REGEXP, and MATCH) use the
004989        ** second argument, not the first, as the argument to test to
004990        ** see if it is a column in a virtual table.  This is done because
004991        ** the left operand of infix functions (the operand we want to
004992        ** control overloading) ends up as the second argument to the
004993        ** function.  The expression "A glob B" is equivalent to
004994        ** "glob(B,A).  We want to use the A in "A glob B" to test
004995        ** for function overloading.  But we use the B term in "glob(B,A)".
004996        */
004997        if( nFarg>=2 && ExprHasProperty(pExpr, EP_InfixFunc) ){
004998          pDef = sqlite3VtabOverloadFunction(db, pDef, nFarg, pFarg->a[1].pExpr);
004999        }else if( nFarg>0 ){
005000          pDef = sqlite3VtabOverloadFunction(db, pDef, nFarg, pFarg->a[0].pExpr);
005001        }
005002  #endif
005003        if( pDef->funcFlags & SQLITE_FUNC_NEEDCOLL ){
005004          if( !pColl ) pColl = db->pDfltColl;
005005          sqlite3VdbeAddOp4(v, OP_CollSeq, 0, 0, 0, (char *)pColl, P4_COLLSEQ);
005006        }
005007        sqlite3VdbeAddFunctionCall(pParse, constMask, r1, target, nFarg,
005008                                   pDef, pExpr->op2);
005009        if( nFarg ){
005010          if( constMask==0 ){
005011            sqlite3ReleaseTempRange(pParse, r1, nFarg);
005012          }else{
005013            sqlite3VdbeReleaseRegisters(pParse, r1, nFarg, constMask, 1);
005014          }
005015        }
005016        return target;
005017      }
005018  #ifndef SQLITE_OMIT_SUBQUERY
005019      case TK_EXISTS:
005020      case TK_SELECT: {
005021        int nCol;
005022        testcase( op==TK_EXISTS );
005023        testcase( op==TK_SELECT );
005024        if( pParse->db->mallocFailed ){
005025          return 0;
005026        }else if( op==TK_SELECT
005027               && ALWAYS( ExprUseXSelect(pExpr) )
005028               && (nCol = pExpr->x.pSelect->pEList->nExpr)!=1
005029        ){
005030          sqlite3SubselectError(pParse, nCol, 1);
005031        }else{
005032          return sqlite3CodeSubselect(pParse, pExpr);
005033        }
005034        break;
005035      }
005036      case TK_SELECT_COLUMN: {
005037        int n;
005038        Expr *pLeft = pExpr->pLeft;
005039        if( pLeft->iTable==0 || pParse->withinRJSubrtn > pLeft->op2 ){
005040          pLeft->iTable = sqlite3CodeSubselect(pParse, pLeft);
005041          pLeft->op2 = pParse->withinRJSubrtn;
005042        }
005043        assert( pLeft->op==TK_SELECT || pLeft->op==TK_ERROR );
005044        n = sqlite3ExprVectorSize(pLeft);
005045        if( pExpr->iTable!=n ){
005046          sqlite3ErrorMsg(pParse, "%d columns assigned %d values",
005047                                  pExpr->iTable, n);
005048        }
005049        return pLeft->iTable + pExpr->iColumn;
005050      }
005051      case TK_IN: {
005052        int destIfFalse = sqlite3VdbeMakeLabel(pParse);
005053        int destIfNull = sqlite3VdbeMakeLabel(pParse);
005054        sqlite3VdbeAddOp2(v, OP_Null, 0, target);
005055        sqlite3ExprCodeIN(pParse, pExpr, destIfFalse, destIfNull);
005056        sqlite3VdbeAddOp2(v, OP_Integer, 1, target);
005057        sqlite3VdbeResolveLabel(v, destIfFalse);
005058        sqlite3VdbeAddOp2(v, OP_AddImm, target, 0);
005059        sqlite3VdbeResolveLabel(v, destIfNull);
005060        return target;
005061      }
005062  #endif /* SQLITE_OMIT_SUBQUERY */
005063  
005064  
005065      /*
005066      **    x BETWEEN y AND z
005067      **
005068      ** This is equivalent to
005069      **
005070      **    x>=y AND x<=z
005071      **
005072      ** X is stored in pExpr->pLeft.
005073      ** Y is stored in pExpr->pList->a[0].pExpr.
005074      ** Z is stored in pExpr->pList->a[1].pExpr.
005075      */
005076      case TK_BETWEEN: {
005077        exprCodeBetween(pParse, pExpr, target, 0, 0);
005078        return target;
005079      }
005080      case TK_COLLATE: {
005081        if( !ExprHasProperty(pExpr, EP_Collate) ){
005082          /* A TK_COLLATE Expr node without the EP_Collate tag is a so-called
005083          ** "SOFT-COLLATE" that is added to constraints that are pushed down
005084          ** from outer queries into sub-queries by the WHERE-clause push-down
005085          ** optimization. Clear subtypes as subtypes may not cross a subquery
005086          ** boundary.
005087          */
005088          assert( pExpr->pLeft );
005089          sqlite3ExprCode(pParse, pExpr->pLeft, target);
005090          sqlite3VdbeAddOp1(v, OP_ClrSubtype, target);
005091          return target;
005092        }else{
005093          pExpr = pExpr->pLeft;
005094          goto expr_code_doover; /* 2018-04-28: Prevent deep recursion. */
005095        }
005096      }
005097      case TK_SPAN:
005098      case TK_UPLUS: {
005099        pExpr = pExpr->pLeft;
005100        goto expr_code_doover; /* 2018-04-28: Prevent deep recursion. OSSFuzz. */
005101      }
005102  
005103      case TK_TRIGGER: {
005104        /* If the opcode is TK_TRIGGER, then the expression is a reference
005105        ** to a column in the new.* or old.* pseudo-tables available to
005106        ** trigger programs. In this case Expr.iTable is set to 1 for the
005107        ** new.* pseudo-table, or 0 for the old.* pseudo-table. Expr.iColumn
005108        ** is set to the column of the pseudo-table to read, or to -1 to
005109        ** read the rowid field.
005110        **
005111        ** The expression is implemented using an OP_Param opcode. The p1
005112        ** parameter is set to 0 for an old.rowid reference, or to (i+1)
005113        ** to reference another column of the old.* pseudo-table, where
005114        ** i is the index of the column. For a new.rowid reference, p1 is
005115        ** set to (n+1), where n is the number of columns in each pseudo-table.
005116        ** For a reference to any other column in the new.* pseudo-table, p1
005117        ** is set to (n+2+i), where n and i are as defined previously. For
005118        ** example, if the table on which triggers are being fired is
005119        ** declared as:
005120        **
005121        **   CREATE TABLE t1(a, b);
005122        **
005123        ** Then p1 is interpreted as follows:
005124        **
005125        **   p1==0   ->    old.rowid     p1==3   ->    new.rowid
005126        **   p1==1   ->    old.a         p1==4   ->    new.a
005127        **   p1==2   ->    old.b         p1==5   ->    new.b      
005128        */
005129        Table *pTab;
005130        int iCol;
005131        int p1;
005132  
005133        assert( ExprUseYTab(pExpr) );
005134        pTab = pExpr->y.pTab;
005135        iCol = pExpr->iColumn;
005136        p1 = pExpr->iTable * (pTab->nCol+1) + 1
005137                       + sqlite3TableColumnToStorage(pTab, iCol);
005138  
005139        assert( pExpr->iTable==0 || pExpr->iTable==1 );
005140        assert( iCol>=-1 && iCol<pTab->nCol );
005141        assert( pTab->iPKey<0 || iCol!=pTab->iPKey );
005142        assert( p1>=0 && p1<(pTab->nCol*2+2) );
005143  
005144        sqlite3VdbeAddOp2(v, OP_Param, p1, target);
005145        VdbeComment((v, "r[%d]=%s.%s", target,
005146          (pExpr->iTable ? "new" : "old"),
005147          (pExpr->iColumn<0 ? "rowid" : pExpr->y.pTab->aCol[iCol].zCnName)
005148        ));
005149  
005150  #ifndef SQLITE_OMIT_FLOATING_POINT
005151        /* If the column has REAL affinity, it may currently be stored as an
005152        ** integer. Use OP_RealAffinity to make sure it is really real.
005153        **
005154        ** EVIDENCE-OF: R-60985-57662 SQLite will convert the value back to
005155        ** floating point when extracting it from the record.  */
005156        if( iCol>=0 && pTab->aCol[iCol].affinity==SQLITE_AFF_REAL ){
005157          sqlite3VdbeAddOp1(v, OP_RealAffinity, target);
005158        }
005159  #endif
005160        break;
005161      }
005162  
005163      case TK_VECTOR: {
005164        sqlite3ErrorMsg(pParse, "row value misused");
005165        break;
005166      }
005167  
005168      /* TK_IF_NULL_ROW Expr nodes are inserted ahead of expressions
005169      ** that derive from the right-hand table of a LEFT JOIN.  The
005170      ** Expr.iTable value is the table number for the right-hand table.
005171      ** The expression is only evaluated if that table is not currently
005172      ** on a LEFT JOIN NULL row.
005173      */
005174      case TK_IF_NULL_ROW: {
005175        int addrINR;
005176        u8 okConstFactor = pParse->okConstFactor;
005177        AggInfo *pAggInfo = pExpr->pAggInfo;
005178        if( pAggInfo ){
005179          assert( pExpr->iAgg>=0 && pExpr->iAgg<pAggInfo->nColumn );
005180          if( !pAggInfo->directMode ){
005181            inReg = AggInfoColumnReg(pAggInfo, pExpr->iAgg);
005182            break;
005183          }
005184          if( pExpr->pAggInfo->useSortingIdx ){
005185            sqlite3VdbeAddOp3(v, OP_Column, pAggInfo->sortingIdxPTab,
005186                              pAggInfo->aCol[pExpr->iAgg].iSorterColumn,
005187                              target);
005188            inReg = target;
005189            break;
005190          }
005191        }
005192        addrINR = sqlite3VdbeAddOp3(v, OP_IfNullRow, pExpr->iTable, 0, target);
005193        /* The OP_IfNullRow opcode above can overwrite the result register with
005194        ** NULL.  So we have to ensure that the result register is not a value
005195        ** that is suppose to be a constant.  Two defenses are needed:
005196        **   (1)  Temporarily disable factoring of constant expressions
005197        **   (2)  Make sure the computed value really is stored in register
005198        **        "target" and not someplace else.
005199        */
005200        pParse->okConstFactor = 0;   /* note (1) above */
005201        sqlite3ExprCode(pParse, pExpr->pLeft, target);
005202        assert( target==inReg );
005203        pParse->okConstFactor = okConstFactor;
005204        sqlite3VdbeJumpHere(v, addrINR);
005205        break;
005206      }
005207  
005208      /*
005209      ** Form A:
005210      **   CASE x WHEN e1 THEN r1 WHEN e2 THEN r2 ... WHEN eN THEN rN ELSE y END
005211      **
005212      ** Form B:
005213      **   CASE WHEN e1 THEN r1 WHEN e2 THEN r2 ... WHEN eN THEN rN ELSE y END
005214      **
005215      ** Form A is can be transformed into the equivalent form B as follows:
005216      **   CASE WHEN x=e1 THEN r1 WHEN x=e2 THEN r2 ...
005217      **        WHEN x=eN THEN rN ELSE y END
005218      **
005219      ** X (if it exists) is in pExpr->pLeft.
005220      ** Y is in the last element of pExpr->x.pList if pExpr->x.pList->nExpr is
005221      ** odd.  The Y is also optional.  If the number of elements in x.pList
005222      ** is even, then Y is omitted and the "otherwise" result is NULL.
005223      ** Ei is in pExpr->pList->a[i*2] and Ri is pExpr->pList->a[i*2+1].
005224      **
005225      ** The result of the expression is the Ri for the first matching Ei,
005226      ** or if there is no matching Ei, the ELSE term Y, or if there is
005227      ** no ELSE term, NULL.
005228      */
005229      case TK_CASE: {
005230        int endLabel;                     /* GOTO label for end of CASE stmt */
005231        int nextCase;                     /* GOTO label for next WHEN clause */
005232        int nExpr;                        /* 2x number of WHEN terms */
005233        int i;                            /* Loop counter */
005234        ExprList *pEList;                 /* List of WHEN terms */
005235        struct ExprList_item *aListelem;  /* Array of WHEN terms */
005236        Expr opCompare;                   /* The X==Ei expression */
005237        Expr *pX;                         /* The X expression */
005238        Expr *pTest = 0;                  /* X==Ei (form A) or just Ei (form B) */
005239        Expr *pDel = 0;
005240        sqlite3 *db = pParse->db;
005241  
005242        assert( ExprUseXList(pExpr) && pExpr->x.pList!=0 );
005243        assert(pExpr->x.pList->nExpr > 0);
005244        pEList = pExpr->x.pList;
005245        aListelem = pEList->a;
005246        nExpr = pEList->nExpr;
005247        endLabel = sqlite3VdbeMakeLabel(pParse);
005248        if( (pX = pExpr->pLeft)!=0 ){
005249          pDel = sqlite3ExprDup(db, pX, 0);
005250          if( db->mallocFailed ){
005251            sqlite3ExprDelete(db, pDel);
005252            break;
005253          }
005254          testcase( pX->op==TK_COLUMN );
005255          exprToRegister(pDel, exprCodeVector(pParse, pDel, &regFree1));
005256          testcase( regFree1==0 );
005257          memset(&opCompare, 0, sizeof(opCompare));
005258          opCompare.op = TK_EQ;
005259          opCompare.pLeft = pDel;
005260          pTest = &opCompare;
005261          /* Ticket b351d95f9cd5ef17e9d9dbae18f5ca8611190001:
005262          ** The value in regFree1 might get SCopy-ed into the file result.
005263          ** So make sure that the regFree1 register is not reused for other
005264          ** purposes and possibly overwritten.  */
005265          regFree1 = 0;
005266        }
005267        for(i=0; i<nExpr-1; i=i+2){
005268          if( pX ){
005269            assert( pTest!=0 );
005270            opCompare.pRight = aListelem[i].pExpr;
005271          }else{
005272            pTest = aListelem[i].pExpr;
005273          }
005274          nextCase = sqlite3VdbeMakeLabel(pParse);
005275          testcase( pTest->op==TK_COLUMN );
005276          sqlite3ExprIfFalse(pParse, pTest, nextCase, SQLITE_JUMPIFNULL);
005277          testcase( aListelem[i+1].pExpr->op==TK_COLUMN );
005278          sqlite3ExprCode(pParse, aListelem[i+1].pExpr, target);
005279          sqlite3VdbeGoto(v, endLabel);
005280          sqlite3VdbeResolveLabel(v, nextCase);
005281        }
005282        if( (nExpr&1)!=0 ){
005283          sqlite3ExprCode(pParse, pEList->a[nExpr-1].pExpr, target);
005284        }else{
005285          sqlite3VdbeAddOp2(v, OP_Null, 0, target);
005286        }
005287        sqlite3ExprDelete(db, pDel);
005288        setDoNotMergeFlagOnCopy(v);
005289        sqlite3VdbeResolveLabel(v, endLabel);
005290        break;
005291      }
005292  #ifndef SQLITE_OMIT_TRIGGER
005293      case TK_RAISE: {
005294        assert( pExpr->affExpr==OE_Rollback
005295             || pExpr->affExpr==OE_Abort
005296             || pExpr->affExpr==OE_Fail
005297             || pExpr->affExpr==OE_Ignore
005298        );
005299        if( !pParse->pTriggerTab && !pParse->nested ){
005300          sqlite3ErrorMsg(pParse,
005301                         "RAISE() may only be used within a trigger-program");
005302          return 0;
005303        }
005304        if( pExpr->affExpr==OE_Abort ){
005305          sqlite3MayAbort(pParse);
005306        }
005307        assert( !ExprHasProperty(pExpr, EP_IntValue) );
005308        if( pExpr->affExpr==OE_Ignore ){
005309          sqlite3VdbeAddOp4(
005310              v, OP_Halt, SQLITE_OK, OE_Ignore, 0, pExpr->u.zToken,0);
005311          VdbeCoverage(v);
005312        }else{
005313          sqlite3HaltConstraint(pParse,
005314               pParse->pTriggerTab ? SQLITE_CONSTRAINT_TRIGGER : SQLITE_ERROR,
005315               pExpr->affExpr, pExpr->u.zToken, 0, 0);
005316        }
005317  
005318        break;
005319      }
005320  #endif
005321    }
005322    sqlite3ReleaseTempReg(pParse, regFree1);
005323    sqlite3ReleaseTempReg(pParse, regFree2);
005324    return inReg;
005325  }
005326  
005327  /*
005328  ** Generate code that will evaluate expression pExpr just one time
005329  ** per prepared statement execution.
005330  **
005331  ** If the expression uses functions (that might throw an exception) then
005332  ** guard them with an OP_Once opcode to ensure that the code is only executed
005333  ** once. If no functions are involved, then factor the code out and put it at
005334  ** the end of the prepared statement in the initialization section.
005335  **
005336  ** If regDest>0 then the result is always stored in that register and the
005337  ** result is not reusable.  If regDest<0 then this routine is free to
005338  ** store the value wherever it wants.  The register where the expression
005339  ** is stored is returned.  When regDest<0, two identical expressions might
005340  ** code to the same register, if they do not contain function calls and hence
005341  ** are factored out into the initialization section at the end of the
005342  ** prepared statement.
005343  */
005344  int sqlite3ExprCodeRunJustOnce(
005345    Parse *pParse,    /* Parsing context */
005346    Expr *pExpr,      /* The expression to code when the VDBE initializes */
005347    int regDest       /* Store the value in this register */
005348  ){
005349    ExprList *p;
005350    assert( ConstFactorOk(pParse) );
005351    assert( regDest!=0 );
005352    p = pParse->pConstExpr;
005353    if( regDest<0 && p ){
005354      struct ExprList_item *pItem;
005355      int i;
005356      for(pItem=p->a, i=p->nExpr; i>0; pItem++, i--){
005357        if( pItem->fg.reusable
005358         && sqlite3ExprCompare(0,pItem->pExpr,pExpr,-1)==0
005359        ){
005360          return pItem->u.iConstExprReg;
005361        }
005362      }
005363    }
005364    pExpr = sqlite3ExprDup(pParse->db, pExpr, 0);
005365    if( pExpr!=0 && ExprHasProperty(pExpr, EP_HasFunc) ){
005366      Vdbe *v = pParse->pVdbe;
005367      int addr;
005368      assert( v );
005369      addr = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
005370      pParse->okConstFactor = 0;
005371      if( !pParse->db->mallocFailed ){
005372        if( regDest<0 ) regDest = ++pParse->nMem;
005373        sqlite3ExprCode(pParse, pExpr, regDest);
005374      }
005375      pParse->okConstFactor = 1;
005376      sqlite3ExprDelete(pParse->db, pExpr);
005377      sqlite3VdbeJumpHere(v, addr);
005378    }else{
005379      p = sqlite3ExprListAppend(pParse, p, pExpr);
005380      if( p ){
005381         struct ExprList_item *pItem = &p->a[p->nExpr-1];
005382         pItem->fg.reusable = regDest<0;
005383         if( regDest<0 ) regDest = ++pParse->nMem;
005384         pItem->u.iConstExprReg = regDest;
005385      }
005386      pParse->pConstExpr = p;
005387    }
005388    return regDest;
005389  }
005390  
005391  /*
005392  ** Generate code to evaluate an expression and store the results
005393  ** into a register.  Return the register number where the results
005394  ** are stored.
005395  **
005396  ** If the register is a temporary register that can be deallocated,
005397  ** then write its number into *pReg.  If the result register is not
005398  ** a temporary, then set *pReg to zero.
005399  **
005400  ** If pExpr is a constant, then this routine might generate this
005401  ** code to fill the register in the initialization section of the
005402  ** VDBE program, in order to factor it out of the evaluation loop.
005403  */
005404  int sqlite3ExprCodeTemp(Parse *pParse, Expr *pExpr, int *pReg){
005405    int r2;
005406    pExpr = sqlite3ExprSkipCollateAndLikely(pExpr);
005407    if( ConstFactorOk(pParse)
005408     && ALWAYS(pExpr!=0)
005409     && pExpr->op!=TK_REGISTER
005410     && sqlite3ExprIsConstantNotJoin(pParse, pExpr)
005411    ){
005412      *pReg  = 0;
005413      r2 = sqlite3ExprCodeRunJustOnce(pParse, pExpr, -1);
005414    }else{
005415      int r1 = sqlite3GetTempReg(pParse);
005416      r2 = sqlite3ExprCodeTarget(pParse, pExpr, r1);
005417      if( r2==r1 ){
005418        *pReg = r1;
005419      }else{
005420        sqlite3ReleaseTempReg(pParse, r1);
005421        *pReg = 0;
005422      }
005423    }
005424    return r2;
005425  }
005426  
005427  /*
005428  ** Generate code that will evaluate expression pExpr and store the
005429  ** results in register target.  The results are guaranteed to appear
005430  ** in register target.
005431  */
005432  void sqlite3ExprCode(Parse *pParse, Expr *pExpr, int target){
005433    int inReg;
005434  
005435    assert( pExpr==0 || !ExprHasVVAProperty(pExpr,EP_Immutable) );
005436    assert( target>0 && target<=pParse->nMem );
005437    assert( pParse->pVdbe!=0 || pParse->db->mallocFailed );
005438    if( pParse->pVdbe==0 ) return;
005439    inReg = sqlite3ExprCodeTarget(pParse, pExpr, target);
005440    if( inReg!=target ){
005441      u8 op;
005442      Expr *pX = sqlite3ExprSkipCollateAndLikely(pExpr);
005443      testcase( pX!=pExpr );
005444      if( ALWAYS(pX)
005445       && (ExprHasProperty(pX,EP_Subquery) || pX->op==TK_REGISTER)
005446      ){
005447        op = OP_Copy;
005448      }else{
005449        op = OP_SCopy;
005450      }
005451      sqlite3VdbeAddOp2(pParse->pVdbe, op, inReg, target);
005452    }
005453  }
005454  
005455  /*
005456  ** Make a transient copy of expression pExpr and then code it using
005457  ** sqlite3ExprCode().  This routine works just like sqlite3ExprCode()
005458  ** except that the input expression is guaranteed to be unchanged.
005459  */
005460  void sqlite3ExprCodeCopy(Parse *pParse, Expr *pExpr, int target){
005461    sqlite3 *db = pParse->db;
005462    pExpr = sqlite3ExprDup(db, pExpr, 0);
005463    if( !db->mallocFailed ) sqlite3ExprCode(pParse, pExpr, target);
005464    sqlite3ExprDelete(db, pExpr);
005465  }
005466  
005467  /*
005468  ** Generate code that will evaluate expression pExpr and store the
005469  ** results in register target.  The results are guaranteed to appear
005470  ** in register target.  If the expression is constant, then this routine
005471  ** might choose to code the expression at initialization time.
005472  */
005473  void sqlite3ExprCodeFactorable(Parse *pParse, Expr *pExpr, int target){
005474    if( pParse->okConstFactor && sqlite3ExprIsConstantNotJoin(pParse,pExpr) ){
005475      sqlite3ExprCodeRunJustOnce(pParse, pExpr, target);
005476    }else{
005477      sqlite3ExprCodeCopy(pParse, pExpr, target);
005478    }
005479  }
005480  
005481  /*
005482  ** Generate code that pushes the value of every element of the given
005483  ** expression list into a sequence of registers beginning at target.
005484  **
005485  ** Return the number of elements evaluated.  The number returned will
005486  ** usually be pList->nExpr but might be reduced if SQLITE_ECEL_OMITREF
005487  ** is defined.
005488  **
005489  ** The SQLITE_ECEL_DUP flag prevents the arguments from being
005490  ** filled using OP_SCopy.  OP_Copy must be used instead.
005491  **
005492  ** The SQLITE_ECEL_FACTOR argument allows constant arguments to be
005493  ** factored out into initialization code.
005494  **
005495  ** The SQLITE_ECEL_REF flag means that expressions in the list with
005496  ** ExprList.a[].u.x.iOrderByCol>0 have already been evaluated and stored
005497  ** in registers at srcReg, and so the value can be copied from there.
005498  ** If SQLITE_ECEL_OMITREF is also set, then the values with u.x.iOrderByCol>0
005499  ** are simply omitted rather than being copied from srcReg.
005500  */
005501  int sqlite3ExprCodeExprList(
005502    Parse *pParse,     /* Parsing context */
005503    ExprList *pList,   /* The expression list to be coded */
005504    int target,        /* Where to write results */
005505    int srcReg,        /* Source registers if SQLITE_ECEL_REF */
005506    u8 flags           /* SQLITE_ECEL_* flags */
005507  ){
005508    struct ExprList_item *pItem;
005509    int i, j, n;
005510    u8 copyOp = (flags & SQLITE_ECEL_DUP) ? OP_Copy : OP_SCopy;
005511    Vdbe *v = pParse->pVdbe;
005512    assert( pList!=0 );
005513    assert( target>0 );
005514    assert( pParse->pVdbe!=0 );  /* Never gets this far otherwise */
005515    n = pList->nExpr;
005516    if( !ConstFactorOk(pParse) ) flags &= ~SQLITE_ECEL_FACTOR;
005517    for(pItem=pList->a, i=0; i<n; i++, pItem++){
005518      Expr *pExpr = pItem->pExpr;
005519  #ifdef SQLITE_ENABLE_SORTER_REFERENCES
005520      if( pItem->fg.bSorterRef ){
005521        i--;
005522        n--;
005523      }else
005524  #endif
005525      if( (flags & SQLITE_ECEL_REF)!=0 && (j = pItem->u.x.iOrderByCol)>0 ){
005526        if( flags & SQLITE_ECEL_OMITREF ){
005527          i--;
005528          n--;
005529        }else{
005530          sqlite3VdbeAddOp2(v, copyOp, j+srcReg-1, target+i);
005531        }
005532      }else if( (flags & SQLITE_ECEL_FACTOR)!=0
005533             && sqlite3ExprIsConstantNotJoin(pParse,pExpr)
005534      ){
005535        sqlite3ExprCodeRunJustOnce(pParse, pExpr, target+i);
005536      }else{
005537        int inReg = sqlite3ExprCodeTarget(pParse, pExpr, target+i);
005538        if( inReg!=target+i ){
005539          VdbeOp *pOp;
005540          if( copyOp==OP_Copy
005541           && (pOp=sqlite3VdbeGetLastOp(v))->opcode==OP_Copy
005542           && pOp->p1+pOp->p3+1==inReg
005543           && pOp->p2+pOp->p3+1==target+i
005544           && pOp->p5==0  /* The do-not-merge flag must be clear */
005545          ){
005546            pOp->p3++;
005547          }else{
005548            sqlite3VdbeAddOp2(v, copyOp, inReg, target+i);
005549          }
005550        }
005551      }
005552    }
005553    return n;
005554  }
005555  
005556  /*
005557  ** Generate code for a BETWEEN operator.
005558  **
005559  **    x BETWEEN y AND z
005560  **
005561  ** The above is equivalent to
005562  **
005563  **    x>=y AND x<=z
005564  **
005565  ** Code it as such, taking care to do the common subexpression
005566  ** elimination of x.
005567  **
005568  ** The xJumpIf parameter determines details:
005569  **
005570  **    NULL:                   Store the boolean result in reg[dest]
005571  **    sqlite3ExprIfTrue:      Jump to dest if true
005572  **    sqlite3ExprIfFalse:     Jump to dest if false
005573  **
005574  ** The jumpIfNull parameter is ignored if xJumpIf is NULL.
005575  */
005576  static void exprCodeBetween(
005577    Parse *pParse,    /* Parsing and code generating context */
005578    Expr *pExpr,      /* The BETWEEN expression */
005579    int dest,         /* Jump destination or storage location */
005580    void (*xJump)(Parse*,Expr*,int,int), /* Action to take */
005581    int jumpIfNull    /* Take the jump if the BETWEEN is NULL */
005582  ){
005583    Expr exprAnd;     /* The AND operator in  x>=y AND x<=z  */
005584    Expr compLeft;    /* The  x>=y  term */
005585    Expr compRight;   /* The  x<=z  term */
005586    int regFree1 = 0; /* Temporary use register */
005587    Expr *pDel = 0;
005588    sqlite3 *db = pParse->db;
005589  
005590    memset(&compLeft, 0, sizeof(Expr));
005591    memset(&compRight, 0, sizeof(Expr));
005592    memset(&exprAnd, 0, sizeof(Expr));
005593  
005594    assert( ExprUseXList(pExpr) );
005595    pDel = sqlite3ExprDup(db, pExpr->pLeft, 0);
005596    if( db->mallocFailed==0 ){
005597      exprAnd.op = TK_AND;
005598      exprAnd.pLeft = &compLeft;
005599      exprAnd.pRight = &compRight;
005600      compLeft.op = TK_GE;
005601      compLeft.pLeft = pDel;
005602      compLeft.pRight = pExpr->x.pList->a[0].pExpr;
005603      compRight.op = TK_LE;
005604      compRight.pLeft = pDel;
005605      compRight.pRight = pExpr->x.pList->a[1].pExpr;
005606      exprToRegister(pDel, exprCodeVector(pParse, pDel, &regFree1));
005607      if( xJump ){
005608        xJump(pParse, &exprAnd, dest, jumpIfNull);
005609      }else{
005610        /* Mark the expression is being from the ON or USING clause of a join
005611        ** so that the sqlite3ExprCodeTarget() routine will not attempt to move
005612        ** it into the Parse.pConstExpr list.  We should use a new bit for this,
005613        ** for clarity, but we are out of bits in the Expr.flags field so we
005614        ** have to reuse the EP_OuterON bit.  Bummer. */
005615        pDel->flags |= EP_OuterON;
005616        sqlite3ExprCodeTarget(pParse, &exprAnd, dest);
005617      }
005618      sqlite3ReleaseTempReg(pParse, regFree1);
005619    }
005620    sqlite3ExprDelete(db, pDel);
005621  
005622    /* Ensure adequate test coverage */
005623    testcase( xJump==sqlite3ExprIfTrue  && jumpIfNull==0 && regFree1==0 );
005624    testcase( xJump==sqlite3ExprIfTrue  && jumpIfNull==0 && regFree1!=0 );
005625    testcase( xJump==sqlite3ExprIfTrue  && jumpIfNull!=0 && regFree1==0 );
005626    testcase( xJump==sqlite3ExprIfTrue  && jumpIfNull!=0 && regFree1!=0 );
005627    testcase( xJump==sqlite3ExprIfFalse && jumpIfNull==0 && regFree1==0 );
005628    testcase( xJump==sqlite3ExprIfFalse && jumpIfNull==0 && regFree1!=0 );
005629    testcase( xJump==sqlite3ExprIfFalse && jumpIfNull!=0 && regFree1==0 );
005630    testcase( xJump==sqlite3ExprIfFalse && jumpIfNull!=0 && regFree1!=0 );
005631    testcase( xJump==0 );
005632  }
005633  
005634  /*
005635  ** Generate code for a boolean expression such that a jump is made
005636  ** to the label "dest" if the expression is true but execution
005637  ** continues straight thru if the expression is false.
005638  **
005639  ** If the expression evaluates to NULL (neither true nor false), then
005640  ** take the jump if the jumpIfNull flag is SQLITE_JUMPIFNULL.
005641  **
005642  ** This code depends on the fact that certain token values (ex: TK_EQ)
005643  ** are the same as opcode values (ex: OP_Eq) that implement the corresponding
005644  ** operation.  Special comments in vdbe.c and the mkopcodeh.awk script in
005645  ** the make process cause these values to align.  Assert()s in the code
005646  ** below verify that the numbers are aligned correctly.
005647  */
005648  void sqlite3ExprIfTrue(Parse *pParse, Expr *pExpr, int dest, int jumpIfNull){
005649    Vdbe *v = pParse->pVdbe;
005650    int op = 0;
005651    int regFree1 = 0;
005652    int regFree2 = 0;
005653    int r1, r2;
005654  
005655    assert( jumpIfNull==SQLITE_JUMPIFNULL || jumpIfNull==0 );
005656    if( NEVER(v==0) )     return;  /* Existence of VDBE checked by caller */
005657    if( NEVER(pExpr==0) ) return;  /* No way this can happen */
005658    assert( !ExprHasVVAProperty(pExpr, EP_Immutable) );
005659    op = pExpr->op;
005660    switch( op ){
005661      case TK_AND:
005662      case TK_OR: {
005663        Expr *pAlt = sqlite3ExprSimplifiedAndOr(pExpr);
005664        if( pAlt!=pExpr ){
005665          sqlite3ExprIfTrue(pParse, pAlt, dest, jumpIfNull);
005666        }else if( op==TK_AND ){
005667          int d2 = sqlite3VdbeMakeLabel(pParse);
005668          testcase( jumpIfNull==0 );
005669          sqlite3ExprIfFalse(pParse, pExpr->pLeft, d2,
005670                             jumpIfNull^SQLITE_JUMPIFNULL);
005671          sqlite3ExprIfTrue(pParse, pExpr->pRight, dest, jumpIfNull);
005672          sqlite3VdbeResolveLabel(v, d2);
005673        }else{
005674          testcase( jumpIfNull==0 );
005675          sqlite3ExprIfTrue(pParse, pExpr->pLeft, dest, jumpIfNull);
005676          sqlite3ExprIfTrue(pParse, pExpr->pRight, dest, jumpIfNull);
005677        }
005678        break;
005679      }
005680      case TK_NOT: {
005681        testcase( jumpIfNull==0 );
005682        sqlite3ExprIfFalse(pParse, pExpr->pLeft, dest, jumpIfNull);
005683        break;
005684      }
005685      case TK_TRUTH: {
005686        int isNot;      /* IS NOT TRUE or IS NOT FALSE */
005687        int isTrue;     /* IS TRUE or IS NOT TRUE */
005688        testcase( jumpIfNull==0 );
005689        isNot = pExpr->op2==TK_ISNOT;
005690        isTrue = sqlite3ExprTruthValue(pExpr->pRight);
005691        testcase( isTrue && isNot );
005692        testcase( !isTrue && isNot );
005693        if( isTrue ^ isNot ){
005694          sqlite3ExprIfTrue(pParse, pExpr->pLeft, dest,
005695                            isNot ? SQLITE_JUMPIFNULL : 0);
005696        }else{
005697          sqlite3ExprIfFalse(pParse, pExpr->pLeft, dest,
005698                             isNot ? SQLITE_JUMPIFNULL : 0);
005699        }
005700        break;
005701      }
005702      case TK_IS:
005703      case TK_ISNOT:
005704        testcase( op==TK_IS );
005705        testcase( op==TK_ISNOT );
005706        op = (op==TK_IS) ? TK_EQ : TK_NE;
005707        jumpIfNull = SQLITE_NULLEQ;
005708        /* no break */ deliberate_fall_through
005709      case TK_LT:
005710      case TK_LE:
005711      case TK_GT:
005712      case TK_GE:
005713      case TK_NE:
005714      case TK_EQ: {
005715        if( sqlite3ExprIsVector(pExpr->pLeft) ) goto default_expr;
005716        testcase( jumpIfNull==0 );
005717        r1 = sqlite3ExprCodeTemp(pParse, pExpr->pLeft, &regFree1);
005718        r2 = sqlite3ExprCodeTemp(pParse, pExpr->pRight, &regFree2);
005719        codeCompare(pParse, pExpr->pLeft, pExpr->pRight, op,
005720                    r1, r2, dest, jumpIfNull, ExprHasProperty(pExpr,EP_Commuted));
005721        assert(TK_LT==OP_Lt); testcase(op==OP_Lt); VdbeCoverageIf(v,op==OP_Lt);
005722        assert(TK_LE==OP_Le); testcase(op==OP_Le); VdbeCoverageIf(v,op==OP_Le);
005723        assert(TK_GT==OP_Gt); testcase(op==OP_Gt); VdbeCoverageIf(v,op==OP_Gt);
005724        assert(TK_GE==OP_Ge); testcase(op==OP_Ge); VdbeCoverageIf(v,op==OP_Ge);
005725        assert(TK_EQ==OP_Eq); testcase(op==OP_Eq);
005726        VdbeCoverageIf(v, op==OP_Eq && jumpIfNull==SQLITE_NULLEQ);
005727        VdbeCoverageIf(v, op==OP_Eq && jumpIfNull!=SQLITE_NULLEQ);
005728        assert(TK_NE==OP_Ne); testcase(op==OP_Ne);
005729        VdbeCoverageIf(v, op==OP_Ne && jumpIfNull==SQLITE_NULLEQ);
005730        VdbeCoverageIf(v, op==OP_Ne && jumpIfNull!=SQLITE_NULLEQ);
005731        testcase( regFree1==0 );
005732        testcase( regFree2==0 );
005733        break;
005734      }
005735      case TK_ISNULL:
005736      case TK_NOTNULL: {
005737        assert( TK_ISNULL==OP_IsNull );   testcase( op==TK_ISNULL );
005738        assert( TK_NOTNULL==OP_NotNull ); testcase( op==TK_NOTNULL );
005739        r1 = sqlite3ExprCodeTemp(pParse, pExpr->pLeft, &regFree1);
005740        sqlite3VdbeTypeofColumn(v, r1);
005741        sqlite3VdbeAddOp2(v, op, r1, dest);
005742        VdbeCoverageIf(v, op==TK_ISNULL);
005743        VdbeCoverageIf(v, op==TK_NOTNULL);
005744        testcase( regFree1==0 );
005745        break;
005746      }
005747      case TK_BETWEEN: {
005748        testcase( jumpIfNull==0 );
005749        exprCodeBetween(pParse, pExpr, dest, sqlite3ExprIfTrue, jumpIfNull);
005750        break;
005751      }
005752  #ifndef SQLITE_OMIT_SUBQUERY
005753      case TK_IN: {
005754        int destIfFalse = sqlite3VdbeMakeLabel(pParse);
005755        int destIfNull = jumpIfNull ? dest : destIfFalse;
005756        sqlite3ExprCodeIN(pParse, pExpr, destIfFalse, destIfNull);
005757        sqlite3VdbeGoto(v, dest);
005758        sqlite3VdbeResolveLabel(v, destIfFalse);
005759        break;
005760      }
005761  #endif
005762      default: {
005763      default_expr:
005764        if( ExprAlwaysTrue(pExpr) ){
005765          sqlite3VdbeGoto(v, dest);
005766        }else if( ExprAlwaysFalse(pExpr) ){
005767          /* No-op */
005768        }else{
005769          r1 = sqlite3ExprCodeTemp(pParse, pExpr, &regFree1);
005770          sqlite3VdbeAddOp3(v, OP_If, r1, dest, jumpIfNull!=0);
005771          VdbeCoverage(v);
005772          testcase( regFree1==0 );
005773          testcase( jumpIfNull==0 );
005774        }
005775        break;
005776      }
005777    }
005778    sqlite3ReleaseTempReg(pParse, regFree1);
005779    sqlite3ReleaseTempReg(pParse, regFree2); 
005780  }
005781  
005782  /*
005783  ** Generate code for a boolean expression such that a jump is made
005784  ** to the label "dest" if the expression is false but execution
005785  ** continues straight thru if the expression is true.
005786  **
005787  ** If the expression evaluates to NULL (neither true nor false) then
005788  ** jump if jumpIfNull is SQLITE_JUMPIFNULL or fall through if jumpIfNull
005789  ** is 0.
005790  */
005791  void sqlite3ExprIfFalse(Parse *pParse, Expr *pExpr, int dest, int jumpIfNull){
005792    Vdbe *v = pParse->pVdbe;
005793    int op = 0;
005794    int regFree1 = 0;
005795    int regFree2 = 0;
005796    int r1, r2;
005797  
005798    assert( jumpIfNull==SQLITE_JUMPIFNULL || jumpIfNull==0 );
005799    if( NEVER(v==0) ) return; /* Existence of VDBE checked by caller */
005800    if( pExpr==0 )    return;
005801    assert( !ExprHasVVAProperty(pExpr,EP_Immutable) );
005802  
005803    /* The value of pExpr->op and op are related as follows:
005804    **
005805    **       pExpr->op            op
005806    **       ---------          ----------
005807    **       TK_ISNULL          OP_NotNull
005808    **       TK_NOTNULL         OP_IsNull
005809    **       TK_NE              OP_Eq
005810    **       TK_EQ              OP_Ne
005811    **       TK_GT              OP_Le
005812    **       TK_LE              OP_Gt
005813    **       TK_GE              OP_Lt
005814    **       TK_LT              OP_Ge
005815    **
005816    ** For other values of pExpr->op, op is undefined and unused.
005817    ** The value of TK_ and OP_ constants are arranged such that we
005818    ** can compute the mapping above using the following expression.
005819    ** Assert()s verify that the computation is correct.
005820    */
005821    op = ((pExpr->op+(TK_ISNULL&1))^1)-(TK_ISNULL&1);
005822  
005823    /* Verify correct alignment of TK_ and OP_ constants
005824    */
005825    assert( pExpr->op!=TK_ISNULL || op==OP_NotNull );
005826    assert( pExpr->op!=TK_NOTNULL || op==OP_IsNull );
005827    assert( pExpr->op!=TK_NE || op==OP_Eq );
005828    assert( pExpr->op!=TK_EQ || op==OP_Ne );
005829    assert( pExpr->op!=TK_LT || op==OP_Ge );
005830    assert( pExpr->op!=TK_LE || op==OP_Gt );
005831    assert( pExpr->op!=TK_GT || op==OP_Le );
005832    assert( pExpr->op!=TK_GE || op==OP_Lt );
005833  
005834    switch( pExpr->op ){
005835      case TK_AND:
005836      case TK_OR: {
005837        Expr *pAlt = sqlite3ExprSimplifiedAndOr(pExpr);
005838        if( pAlt!=pExpr ){
005839          sqlite3ExprIfFalse(pParse, pAlt, dest, jumpIfNull);
005840        }else if( pExpr->op==TK_AND ){
005841          testcase( jumpIfNull==0 );
005842          sqlite3ExprIfFalse(pParse, pExpr->pLeft, dest, jumpIfNull);
005843          sqlite3ExprIfFalse(pParse, pExpr->pRight, dest, jumpIfNull);
005844        }else{
005845          int d2 = sqlite3VdbeMakeLabel(pParse);
005846          testcase( jumpIfNull==0 );
005847          sqlite3ExprIfTrue(pParse, pExpr->pLeft, d2,
005848                            jumpIfNull^SQLITE_JUMPIFNULL);
005849          sqlite3ExprIfFalse(pParse, pExpr->pRight, dest, jumpIfNull);
005850          sqlite3VdbeResolveLabel(v, d2);
005851        }
005852        break;
005853      }
005854      case TK_NOT: {
005855        testcase( jumpIfNull==0 );
005856        sqlite3ExprIfTrue(pParse, pExpr->pLeft, dest, jumpIfNull);
005857        break;
005858      }
005859      case TK_TRUTH: {
005860        int isNot;   /* IS NOT TRUE or IS NOT FALSE */
005861        int isTrue;  /* IS TRUE or IS NOT TRUE */
005862        testcase( jumpIfNull==0 );
005863        isNot = pExpr->op2==TK_ISNOT;
005864        isTrue = sqlite3ExprTruthValue(pExpr->pRight);
005865        testcase( isTrue && isNot );
005866        testcase( !isTrue && isNot );
005867        if( isTrue ^ isNot ){
005868          /* IS TRUE and IS NOT FALSE */
005869          sqlite3ExprIfFalse(pParse, pExpr->pLeft, dest,
005870                             isNot ? 0 : SQLITE_JUMPIFNULL);
005871  
005872        }else{
005873          /* IS FALSE and IS NOT TRUE */
005874          sqlite3ExprIfTrue(pParse, pExpr->pLeft, dest,
005875                            isNot ? 0 : SQLITE_JUMPIFNULL);
005876        }
005877        break;
005878      }
005879      case TK_IS:
005880      case TK_ISNOT:
005881        testcase( pExpr->op==TK_IS );
005882        testcase( pExpr->op==TK_ISNOT );
005883        op = (pExpr->op==TK_IS) ? TK_NE : TK_EQ;
005884        jumpIfNull = SQLITE_NULLEQ;
005885        /* no break */ deliberate_fall_through
005886      case TK_LT:
005887      case TK_LE:
005888      case TK_GT:
005889      case TK_GE:
005890      case TK_NE:
005891      case TK_EQ: {
005892        if( sqlite3ExprIsVector(pExpr->pLeft) ) goto default_expr;
005893        testcase( jumpIfNull==0 );
005894        r1 = sqlite3ExprCodeTemp(pParse, pExpr->pLeft, &regFree1);
005895        r2 = sqlite3ExprCodeTemp(pParse, pExpr->pRight, &regFree2);
005896        codeCompare(pParse, pExpr->pLeft, pExpr->pRight, op,
005897                    r1, r2, dest, jumpIfNull,ExprHasProperty(pExpr,EP_Commuted));
005898        assert(TK_LT==OP_Lt); testcase(op==OP_Lt); VdbeCoverageIf(v,op==OP_Lt);
005899        assert(TK_LE==OP_Le); testcase(op==OP_Le); VdbeCoverageIf(v,op==OP_Le);
005900        assert(TK_GT==OP_Gt); testcase(op==OP_Gt); VdbeCoverageIf(v,op==OP_Gt);
005901        assert(TK_GE==OP_Ge); testcase(op==OP_Ge); VdbeCoverageIf(v,op==OP_Ge);
005902        assert(TK_EQ==OP_Eq); testcase(op==OP_Eq);
005903        VdbeCoverageIf(v, op==OP_Eq && jumpIfNull!=SQLITE_NULLEQ);
005904        VdbeCoverageIf(v, op==OP_Eq && jumpIfNull==SQLITE_NULLEQ);
005905        assert(TK_NE==OP_Ne); testcase(op==OP_Ne);
005906        VdbeCoverageIf(v, op==OP_Ne && jumpIfNull!=SQLITE_NULLEQ);
005907        VdbeCoverageIf(v, op==OP_Ne && jumpIfNull==SQLITE_NULLEQ);
005908        testcase( regFree1==0 );
005909        testcase( regFree2==0 );
005910        break;
005911      }
005912      case TK_ISNULL:
005913      case TK_NOTNULL: {
005914        r1 = sqlite3ExprCodeTemp(pParse, pExpr->pLeft, &regFree1);
005915        sqlite3VdbeTypeofColumn(v, r1);
005916        sqlite3VdbeAddOp2(v, op, r1, dest);
005917        testcase( op==TK_ISNULL );   VdbeCoverageIf(v, op==TK_ISNULL);
005918        testcase( op==TK_NOTNULL );  VdbeCoverageIf(v, op==TK_NOTNULL);
005919        testcase( regFree1==0 );
005920        break;
005921      }
005922      case TK_BETWEEN: {
005923        testcase( jumpIfNull==0 );
005924        exprCodeBetween(pParse, pExpr, dest, sqlite3ExprIfFalse, jumpIfNull);
005925        break;
005926      }
005927  #ifndef SQLITE_OMIT_SUBQUERY
005928      case TK_IN: {
005929        if( jumpIfNull ){
005930          sqlite3ExprCodeIN(pParse, pExpr, dest, dest);
005931        }else{
005932          int destIfNull = sqlite3VdbeMakeLabel(pParse);
005933          sqlite3ExprCodeIN(pParse, pExpr, dest, destIfNull);
005934          sqlite3VdbeResolveLabel(v, destIfNull);
005935        }
005936        break;
005937      }
005938  #endif
005939      default: {
005940      default_expr:
005941        if( ExprAlwaysFalse(pExpr) ){
005942          sqlite3VdbeGoto(v, dest);
005943        }else if( ExprAlwaysTrue(pExpr) ){
005944          /* no-op */
005945        }else{
005946          r1 = sqlite3ExprCodeTemp(pParse, pExpr, &regFree1);
005947          sqlite3VdbeAddOp3(v, OP_IfNot, r1, dest, jumpIfNull!=0);
005948          VdbeCoverage(v);
005949          testcase( regFree1==0 );
005950          testcase( jumpIfNull==0 );
005951        }
005952        break;
005953      }
005954    }
005955    sqlite3ReleaseTempReg(pParse, regFree1);
005956    sqlite3ReleaseTempReg(pParse, regFree2);
005957  }
005958  
005959  /*
005960  ** Like sqlite3ExprIfFalse() except that a copy is made of pExpr before
005961  ** code generation, and that copy is deleted after code generation. This
005962  ** ensures that the original pExpr is unchanged.
005963  */
005964  void sqlite3ExprIfFalseDup(Parse *pParse, Expr *pExpr, int dest,int jumpIfNull){
005965    sqlite3 *db = pParse->db;
005966    Expr *pCopy = sqlite3ExprDup(db, pExpr, 0);
005967    if( db->mallocFailed==0 ){
005968      sqlite3ExprIfFalse(pParse, pCopy, dest, jumpIfNull);
005969    }
005970    sqlite3ExprDelete(db, pCopy);
005971  }
005972  
005973  /*
005974  ** Expression pVar is guaranteed to be an SQL variable. pExpr may be any
005975  ** type of expression.
005976  **
005977  ** If pExpr is a simple SQL value - an integer, real, string, blob
005978  ** or NULL value - then the VDBE currently being prepared is configured
005979  ** to re-prepare each time a new value is bound to variable pVar.
005980  **
005981  ** Additionally, if pExpr is a simple SQL value and the value is the
005982  ** same as that currently bound to variable pVar, non-zero is returned.
005983  ** Otherwise, if the values are not the same or if pExpr is not a simple
005984  ** SQL value, zero is returned.
005985  */
005986  static int exprCompareVariable(
005987    const Parse *pParse,
005988    const Expr *pVar,
005989    const Expr *pExpr
005990  ){
005991    int res = 0;
005992    int iVar;
005993    sqlite3_value *pL, *pR = 0;
005994   
005995    sqlite3ValueFromExpr(pParse->db, pExpr, SQLITE_UTF8, SQLITE_AFF_BLOB, &pR);
005996    if( pR ){
005997      iVar = pVar->iColumn;
005998      sqlite3VdbeSetVarmask(pParse->pVdbe, iVar);
005999      pL = sqlite3VdbeGetBoundValue(pParse->pReprepare, iVar, SQLITE_AFF_BLOB);
006000      if( pL ){
006001        if( sqlite3_value_type(pL)==SQLITE_TEXT ){
006002          sqlite3_value_text(pL); /* Make sure the encoding is UTF-8 */
006003        }
006004        res =  0==sqlite3MemCompare(pL, pR, 0);
006005      }
006006      sqlite3ValueFree(pR);
006007      sqlite3ValueFree(pL);
006008    }
006009  
006010    return res;
006011  }
006012  
006013  /*
006014  ** Do a deep comparison of two expression trees.  Return 0 if the two
006015  ** expressions are completely identical.  Return 1 if they differ only
006016  ** by a COLLATE operator at the top level.  Return 2 if there are differences
006017  ** other than the top-level COLLATE operator.
006018  **
006019  ** If any subelement of pB has Expr.iTable==(-1) then it is allowed
006020  ** to compare equal to an equivalent element in pA with Expr.iTable==iTab.
006021  **
006022  ** The pA side might be using TK_REGISTER.  If that is the case and pB is
006023  ** not using TK_REGISTER but is otherwise equivalent, then still return 0.
006024  **
006025  ** Sometimes this routine will return 2 even if the two expressions
006026  ** really are equivalent.  If we cannot prove that the expressions are
006027  ** identical, we return 2 just to be safe.  So if this routine
006028  ** returns 2, then you do not really know for certain if the two
006029  ** expressions are the same.  But if you get a 0 or 1 return, then you
006030  ** can be sure the expressions are the same.  In the places where
006031  ** this routine is used, it does not hurt to get an extra 2 - that
006032  ** just might result in some slightly slower code.  But returning
006033  ** an incorrect 0 or 1 could lead to a malfunction.
006034  **
006035  ** If pParse is not NULL then TK_VARIABLE terms in pA with bindings in
006036  ** pParse->pReprepare can be matched against literals in pB.  The
006037  ** pParse->pVdbe->expmask bitmask is updated for each variable referenced.
006038  ** If pParse is NULL (the normal case) then any TK_VARIABLE term in
006039  ** Argument pParse should normally be NULL. If it is not NULL and pA or
006040  ** pB causes a return value of 2.
006041  */
006042  int sqlite3ExprCompare(
006043    const Parse *pParse,
006044    const Expr *pA,
006045    const Expr *pB,
006046    int iTab
006047  ){
006048    u32 combinedFlags;
006049    if( pA==0 || pB==0 ){
006050      return pB==pA ? 0 : 2;
006051    }
006052    if( pParse && pA->op==TK_VARIABLE && exprCompareVariable(pParse, pA, pB) ){
006053      return 0;
006054    }
006055    combinedFlags = pA->flags | pB->flags;
006056    if( combinedFlags & EP_IntValue ){
006057      if( (pA->flags&pB->flags&EP_IntValue)!=0 && pA->u.iValue==pB->u.iValue ){
006058        return 0;
006059      }
006060      return 2;
006061    }
006062    if( pA->op!=pB->op || pA->op==TK_RAISE ){
006063      if( pA->op==TK_COLLATE && sqlite3ExprCompare(pParse, pA->pLeft,pB,iTab)<2 ){
006064        return 1;
006065      }
006066      if( pB->op==TK_COLLATE && sqlite3ExprCompare(pParse, pA,pB->pLeft,iTab)<2 ){
006067        return 1;
006068      }
006069      if( pA->op==TK_AGG_COLUMN && pB->op==TK_COLUMN
006070       && pB->iTable<0 && pA->iTable==iTab
006071      ){
006072        /* fall through */
006073      }else{
006074        return 2;
006075      }
006076    }
006077    assert( !ExprHasProperty(pA, EP_IntValue) );
006078    assert( !ExprHasProperty(pB, EP_IntValue) );
006079    if( pA->u.zToken ){
006080      if( pA->op==TK_FUNCTION || pA->op==TK_AGG_FUNCTION ){
006081        if( sqlite3StrICmp(pA->u.zToken,pB->u.zToken)!=0 ) return 2;
006082  #ifndef SQLITE_OMIT_WINDOWFUNC
006083        assert( pA->op==pB->op );
006084        if( ExprHasProperty(pA,EP_WinFunc)!=ExprHasProperty(pB,EP_WinFunc) ){
006085          return 2;
006086        }
006087        if( ExprHasProperty(pA,EP_WinFunc) ){
006088          if( sqlite3WindowCompare(pParse, pA->y.pWin, pB->y.pWin, 1)!=0 ){
006089            return 2;
006090          }
006091        }
006092  #endif
006093      }else if( pA->op==TK_NULL ){
006094        return 0;
006095      }else if( pA->op==TK_COLLATE ){
006096        if( sqlite3_stricmp(pA->u.zToken,pB->u.zToken)!=0 ) return 2;
006097      }else
006098      if( pB->u.zToken!=0
006099       && pA->op!=TK_COLUMN
006100       && pA->op!=TK_AGG_COLUMN
006101       && strcmp(pA->u.zToken,pB->u.zToken)!=0
006102      ){
006103        return 2;
006104      }
006105    }
006106    if( (pA->flags & (EP_Distinct|EP_Commuted))
006107       != (pB->flags & (EP_Distinct|EP_Commuted)) ) return 2;
006108    if( ALWAYS((combinedFlags & EP_TokenOnly)==0) ){
006109      if( combinedFlags & EP_xIsSelect ) return 2;
006110      if( (combinedFlags & EP_FixedCol)==0
006111       && sqlite3ExprCompare(pParse, pA->pLeft, pB->pLeft, iTab) ) return 2;
006112      if( sqlite3ExprCompare(pParse, pA->pRight, pB->pRight, iTab) ) return 2;
006113      if( sqlite3ExprListCompare(pA->x.pList, pB->x.pList, iTab) ) return 2;
006114      if( pA->op!=TK_STRING
006115       && pA->op!=TK_TRUEFALSE
006116       && ALWAYS((combinedFlags & EP_Reduced)==0)
006117      ){
006118        if( pA->iColumn!=pB->iColumn ) return 2;
006119        if( pA->op2!=pB->op2 && pA->op==TK_TRUTH ) return 2;
006120        if( pA->op!=TK_IN && pA->iTable!=pB->iTable && pA->iTable!=iTab ){
006121          return 2;
006122        }
006123      }
006124    }
006125    return 0;
006126  }
006127  
006128  /*
006129  ** Compare two ExprList objects.  Return 0 if they are identical, 1
006130  ** if they are certainly different, or 2 if it is not possible to
006131  ** determine if they are identical or not.
006132  **
006133  ** If any subelement of pB has Expr.iTable==(-1) then it is allowed
006134  ** to compare equal to an equivalent element in pA with Expr.iTable==iTab.
006135  **
006136  ** This routine might return non-zero for equivalent ExprLists.  The
006137  ** only consequence will be disabled optimizations.  But this routine
006138  ** must never return 0 if the two ExprList objects are different, or
006139  ** a malfunction will result.
006140  **
006141  ** Two NULL pointers are considered to be the same.  But a NULL pointer
006142  ** always differs from a non-NULL pointer.
006143  */
006144  int sqlite3ExprListCompare(const ExprList *pA, const ExprList *pB, int iTab){
006145    int i;
006146    if( pA==0 && pB==0 ) return 0;
006147    if( pA==0 || pB==0 ) return 1;
006148    if( pA->nExpr!=pB->nExpr ) return 1;
006149    for(i=0; i<pA->nExpr; i++){
006150      int res;
006151      Expr *pExprA = pA->a[i].pExpr;
006152      Expr *pExprB = pB->a[i].pExpr;
006153      if( pA->a[i].fg.sortFlags!=pB->a[i].fg.sortFlags ) return 1;
006154      if( (res = sqlite3ExprCompare(0, pExprA, pExprB, iTab)) ) return res;
006155    }
006156    return 0;
006157  }
006158  
006159  /*
006160  ** Like sqlite3ExprCompare() except COLLATE operators at the top-level
006161  ** are ignored.
006162  */
006163  int sqlite3ExprCompareSkip(Expr *pA,Expr *pB, int iTab){
006164    return sqlite3ExprCompare(0,
006165               sqlite3ExprSkipCollate(pA),
006166               sqlite3ExprSkipCollate(pB),
006167               iTab);
006168  }
006169  
006170  /*
006171  ** Return non-zero if Expr p can only be true if pNN is not NULL.
006172  **
006173  ** Or if seenNot is true, return non-zero if Expr p can only be
006174  ** non-NULL if pNN is not NULL
006175  */
006176  static int exprImpliesNotNull(
006177    const Parse *pParse,/* Parsing context */
006178    const Expr *p,      /* The expression to be checked */
006179    const Expr *pNN,    /* The expression that is NOT NULL */
006180    int iTab,           /* Table being evaluated */
006181    int seenNot         /* Return true only if p can be any non-NULL value */
006182  ){
006183    assert( p );
006184    assert( pNN );
006185    if( sqlite3ExprCompare(pParse, p, pNN, iTab)==0 ){
006186      return pNN->op!=TK_NULL;
006187    }
006188    switch( p->op ){
006189      case TK_IN: {
006190        if( seenNot && ExprHasProperty(p, EP_xIsSelect) ) return 0;
006191        assert( ExprUseXSelect(p) || (p->x.pList!=0 && p->x.pList->nExpr>0) );
006192        return exprImpliesNotNull(pParse, p->pLeft, pNN, iTab, 1);
006193      }
006194      case TK_BETWEEN: {
006195        ExprList *pList;
006196        assert( ExprUseXList(p) );
006197        pList = p->x.pList;
006198        assert( pList!=0 );
006199        assert( pList->nExpr==2 );
006200        if( seenNot ) return 0;
006201        if( exprImpliesNotNull(pParse, pList->a[0].pExpr, pNN, iTab, 1)
006202         || exprImpliesNotNull(pParse, pList->a[1].pExpr, pNN, iTab, 1)
006203        ){
006204          return 1;
006205        }
006206        return exprImpliesNotNull(pParse, p->pLeft, pNN, iTab, 1);
006207      }
006208      case TK_EQ:
006209      case TK_NE:
006210      case TK_LT:
006211      case TK_LE:
006212      case TK_GT:
006213      case TK_GE:
006214      case TK_PLUS:
006215      case TK_MINUS:
006216      case TK_BITOR:
006217      case TK_LSHIFT:
006218      case TK_RSHIFT:
006219      case TK_CONCAT:
006220        seenNot = 1;
006221        /* no break */ deliberate_fall_through
006222      case TK_STAR:
006223      case TK_REM:
006224      case TK_BITAND:
006225      case TK_SLASH: {
006226        if( exprImpliesNotNull(pParse, p->pRight, pNN, iTab, seenNot) ) return 1;
006227        /* no break */ deliberate_fall_through
006228      }
006229      case TK_SPAN:
006230      case TK_COLLATE:
006231      case TK_UPLUS:
006232      case TK_UMINUS: {
006233        return exprImpliesNotNull(pParse, p->pLeft, pNN, iTab, seenNot);
006234      }
006235      case TK_TRUTH: {
006236        if( seenNot ) return 0;
006237        if( p->op2!=TK_IS ) return 0;
006238        return exprImpliesNotNull(pParse, p->pLeft, pNN, iTab, 1);
006239      }
006240      case TK_BITNOT:
006241      case TK_NOT: {
006242        return exprImpliesNotNull(pParse, p->pLeft, pNN, iTab, 1);
006243      }
006244    }
006245    return 0;
006246  }
006247  
006248  /*
006249  ** Return true if we can prove the pE2 will always be true if pE1 is
006250  ** true.  Return false if we cannot complete the proof or if pE2 might
006251  ** be false.  Examples:
006252  **
006253  **     pE1: x==5       pE2: x==5             Result: true
006254  **     pE1: x>0        pE2: x==5             Result: false
006255  **     pE1: x=21       pE2: x=21 OR y=43     Result: true
006256  **     pE1: x!=123     pE2: x IS NOT NULL    Result: true
006257  **     pE1: x!=?1      pE2: x IS NOT NULL    Result: true
006258  **     pE1: x IS NULL  pE2: x IS NOT NULL    Result: false
006259  **     pE1: x IS ?2    pE2: x IS NOT NULL    Result: false
006260  **
006261  ** When comparing TK_COLUMN nodes between pE1 and pE2, if pE2 has
006262  ** Expr.iTable<0 then assume a table number given by iTab.
006263  **
006264  ** If pParse is not NULL, then the values of bound variables in pE1 are
006265  ** compared against literal values in pE2 and pParse->pVdbe->expmask is
006266  ** modified to record which bound variables are referenced.  If pParse
006267  ** is NULL, then false will be returned if pE1 contains any bound variables.
006268  **
006269  ** When in doubt, return false.  Returning true might give a performance
006270  ** improvement.  Returning false might cause a performance reduction, but
006271  ** it will always give the correct answer and is hence always safe.
006272  */
006273  int sqlite3ExprImpliesExpr(
006274    const Parse *pParse,
006275    const Expr *pE1,
006276    const Expr *pE2,
006277    int iTab
006278  ){
006279    if( sqlite3ExprCompare(pParse, pE1, pE2, iTab)==0 ){
006280      return 1;
006281    }
006282    if( pE2->op==TK_OR
006283     && (sqlite3ExprImpliesExpr(pParse, pE1, pE2->pLeft, iTab)
006284               || sqlite3ExprImpliesExpr(pParse, pE1, pE2->pRight, iTab) )
006285    ){
006286      return 1;
006287    }
006288    if( pE2->op==TK_NOTNULL
006289     && exprImpliesNotNull(pParse, pE1, pE2->pLeft, iTab, 0)
006290    ){
006291      return 1;
006292    }
006293    return 0;
006294  }
006295  
006296  /* This is a helper function to impliesNotNullRow().  In this routine,
006297  ** set pWalker->eCode to one only if *both* of the input expressions
006298  ** separately have the implies-not-null-row property.
006299  */
006300  static void bothImplyNotNullRow(Walker *pWalker, Expr *pE1, Expr *pE2){
006301    if( pWalker->eCode==0 ){
006302      sqlite3WalkExpr(pWalker, pE1);
006303      if( pWalker->eCode ){
006304        pWalker->eCode = 0;
006305        sqlite3WalkExpr(pWalker, pE2);
006306      }
006307    }
006308  }
006309  
006310  /*
006311  ** This is the Expr node callback for sqlite3ExprImpliesNonNullRow().
006312  ** If the expression node requires that the table at pWalker->iCur
006313  ** have one or more non-NULL column, then set pWalker->eCode to 1 and abort.
006314  **
006315  ** pWalker->mWFlags is non-zero if this inquiry is being undertaking on
006316  ** behalf of a RIGHT JOIN (or FULL JOIN).  That makes a difference when
006317  ** evaluating terms in the ON clause of an inner join.
006318  **
006319  ** This routine controls an optimization.  False positives (setting
006320  ** pWalker->eCode to 1 when it should not be) are deadly, but false-negatives
006321  ** (never setting pWalker->eCode) is a harmless missed optimization.
006322  */
006323  static int impliesNotNullRow(Walker *pWalker, Expr *pExpr){
006324    testcase( pExpr->op==TK_AGG_COLUMN );
006325    testcase( pExpr->op==TK_AGG_FUNCTION );
006326    if( ExprHasProperty(pExpr, EP_OuterON) ) return WRC_Prune;
006327    if( ExprHasProperty(pExpr, EP_InnerON) && pWalker->mWFlags ){
006328      /* If iCur is used in an inner-join ON clause to the left of a
006329      ** RIGHT JOIN, that does *not* mean that the table must be non-null.
006330      ** But it is difficult to check for that condition precisely.
006331      ** To keep things simple, any use of iCur from any inner-join is
006332      ** ignored while attempting to simplify a RIGHT JOIN. */
006333      return WRC_Prune;
006334    }
006335    switch( pExpr->op ){
006336      case TK_ISNOT:
006337      case TK_ISNULL:
006338      case TK_NOTNULL:
006339      case TK_IS:
006340      case TK_VECTOR:
006341      case TK_FUNCTION:
006342      case TK_TRUTH:
006343      case TK_CASE:
006344        testcase( pExpr->op==TK_ISNOT );
006345        testcase( pExpr->op==TK_ISNULL );
006346        testcase( pExpr->op==TK_NOTNULL );
006347        testcase( pExpr->op==TK_IS );
006348        testcase( pExpr->op==TK_VECTOR );
006349        testcase( pExpr->op==TK_FUNCTION );
006350        testcase( pExpr->op==TK_TRUTH );
006351        testcase( pExpr->op==TK_CASE );
006352        return WRC_Prune;
006353  
006354      case TK_COLUMN:
006355        if( pWalker->u.iCur==pExpr->iTable ){
006356          pWalker->eCode = 1;
006357          return WRC_Abort;
006358        }
006359        return WRC_Prune;
006360  
006361      case TK_OR:
006362      case TK_AND:
006363        /* Both sides of an AND or OR must separately imply non-null-row.
006364        ** Consider these cases:
006365        **    1.  NOT (x AND y)
006366        **    2.  x OR y
006367        ** If only one of x or y is non-null-row, then the overall expression
006368        ** can be true if the other arm is false (case 1) or true (case 2).
006369        */
006370        testcase( pExpr->op==TK_OR );
006371        testcase( pExpr->op==TK_AND );
006372        bothImplyNotNullRow(pWalker, pExpr->pLeft, pExpr->pRight);
006373        return WRC_Prune;
006374         
006375      case TK_IN:
006376        /* Beware of "x NOT IN ()" and "x NOT IN (SELECT 1 WHERE false)",
006377        ** both of which can be true.  But apart from these cases, if
006378        ** the left-hand side of the IN is NULL then the IN itself will be
006379        ** NULL. */
006380        if( ExprUseXList(pExpr) && ALWAYS(pExpr->x.pList->nExpr>0) ){
006381          sqlite3WalkExpr(pWalker, pExpr->pLeft);
006382        }
006383        return WRC_Prune;
006384  
006385      case TK_BETWEEN:
006386        /* In "x NOT BETWEEN y AND z" either x must be non-null-row or else
006387        ** both y and z must be non-null row */
006388        assert( ExprUseXList(pExpr) );
006389        assert( pExpr->x.pList->nExpr==2 );
006390        sqlite3WalkExpr(pWalker, pExpr->pLeft);
006391        bothImplyNotNullRow(pWalker, pExpr->x.pList->a[0].pExpr,
006392                                     pExpr->x.pList->a[1].pExpr);
006393        return WRC_Prune;
006394  
006395      /* Virtual tables are allowed to use constraints like x=NULL.  So
006396      ** a term of the form x=y does not prove that y is not null if x
006397      ** is the column of a virtual table */
006398      case TK_EQ:
006399      case TK_NE:
006400      case TK_LT:
006401      case TK_LE:
006402      case TK_GT:
006403      case TK_GE: {
006404        Expr *pLeft = pExpr->pLeft;
006405        Expr *pRight = pExpr->pRight;
006406        testcase( pExpr->op==TK_EQ );
006407        testcase( pExpr->op==TK_NE );
006408        testcase( pExpr->op==TK_LT );
006409        testcase( pExpr->op==TK_LE );
006410        testcase( pExpr->op==TK_GT );
006411        testcase( pExpr->op==TK_GE );
006412        /* The y.pTab=0 assignment in wherecode.c always happens after the
006413        ** impliesNotNullRow() test */
006414        assert( pLeft->op!=TK_COLUMN || ExprUseYTab(pLeft) );
006415        assert( pRight->op!=TK_COLUMN || ExprUseYTab(pRight) );
006416        if( (pLeft->op==TK_COLUMN
006417             && ALWAYS(pLeft->y.pTab!=0)
006418             && IsVirtual(pLeft->y.pTab))
006419         || (pRight->op==TK_COLUMN
006420             && ALWAYS(pRight->y.pTab!=0)
006421             && IsVirtual(pRight->y.pTab))
006422        ){
006423          return WRC_Prune;
006424        }
006425        /* no break */ deliberate_fall_through
006426      }
006427      default:
006428        return WRC_Continue;
006429    }
006430  }
006431  
006432  /*
006433  ** Return true (non-zero) if expression p can only be true if at least
006434  ** one column of table iTab is non-null.  In other words, return true
006435  ** if expression p will always be NULL or false if every column of iTab
006436  ** is NULL.
006437  **
006438  ** False negatives are acceptable.  In other words, it is ok to return
006439  ** zero even if expression p will never be true of every column of iTab
006440  ** is NULL.  A false negative is merely a missed optimization opportunity.
006441  **
006442  ** False positives are not allowed, however.  A false positive may result
006443  ** in an incorrect answer.
006444  **
006445  ** Terms of p that are marked with EP_OuterON (and hence that come from
006446  ** the ON or USING clauses of OUTER JOINS) are excluded from the analysis.
006447  **
006448  ** This routine is used to check if a LEFT JOIN can be converted into
006449  ** an ordinary JOIN.  The p argument is the WHERE clause.  If the WHERE
006450  ** clause requires that some column of the right table of the LEFT JOIN
006451  ** be non-NULL, then the LEFT JOIN can be safely converted into an
006452  ** ordinary join.
006453  */
006454  int sqlite3ExprImpliesNonNullRow(Expr *p, int iTab, int isRJ){
006455    Walker w;
006456    p = sqlite3ExprSkipCollateAndLikely(p);
006457    if( p==0 ) return 0;
006458    if( p->op==TK_NOTNULL ){
006459      p = p->pLeft;
006460    }else{
006461      while( p->op==TK_AND ){
006462        if( sqlite3ExprImpliesNonNullRow(p->pLeft, iTab, isRJ) ) return 1;
006463        p = p->pRight;
006464      }
006465    }
006466    w.xExprCallback = impliesNotNullRow;
006467    w.xSelectCallback = 0;
006468    w.xSelectCallback2 = 0;
006469    w.eCode = 0;
006470    w.mWFlags = isRJ!=0;
006471    w.u.iCur = iTab;
006472    sqlite3WalkExpr(&w, p);
006473    return w.eCode;
006474  }
006475  
006476  /*
006477  ** An instance of the following structure is used by the tree walker
006478  ** to determine if an expression can be evaluated by reference to the
006479  ** index only, without having to do a search for the corresponding
006480  ** table entry.  The IdxCover.pIdx field is the index.  IdxCover.iCur
006481  ** is the cursor for the table.
006482  */
006483  struct IdxCover {
006484    Index *pIdx;     /* The index to be tested for coverage */
006485    int iCur;        /* Cursor number for the table corresponding to the index */
006486  };
006487  
006488  /*
006489  ** Check to see if there are references to columns in table
006490  ** pWalker->u.pIdxCover->iCur can be satisfied using the index
006491  ** pWalker->u.pIdxCover->pIdx.
006492  */
006493  static int exprIdxCover(Walker *pWalker, Expr *pExpr){
006494    if( pExpr->op==TK_COLUMN
006495     && pExpr->iTable==pWalker->u.pIdxCover->iCur
006496     && sqlite3TableColumnToIndex(pWalker->u.pIdxCover->pIdx, pExpr->iColumn)<0
006497    ){
006498      pWalker->eCode = 1;
006499      return WRC_Abort;
006500    }
006501    return WRC_Continue;
006502  }
006503  
006504  /*
006505  ** Determine if an index pIdx on table with cursor iCur contains will
006506  ** the expression pExpr.  Return true if the index does cover the
006507  ** expression and false if the pExpr expression references table columns
006508  ** that are not found in the index pIdx.
006509  **
006510  ** An index covering an expression means that the expression can be
006511  ** evaluated using only the index and without having to lookup the
006512  ** corresponding table entry.
006513  */
006514  int sqlite3ExprCoveredByIndex(
006515    Expr *pExpr,        /* The index to be tested */
006516    int iCur,           /* The cursor number for the corresponding table */
006517    Index *pIdx         /* The index that might be used for coverage */
006518  ){
006519    Walker w;
006520    struct IdxCover xcov;
006521    memset(&w, 0, sizeof(w));
006522    xcov.iCur = iCur;
006523    xcov.pIdx = pIdx;
006524    w.xExprCallback = exprIdxCover;
006525    w.u.pIdxCover = &xcov;
006526    sqlite3WalkExpr(&w, pExpr);
006527    return !w.eCode;
006528  }
006529  
006530  
006531  /* Structure used to pass information throughout the Walker in order to
006532  ** implement sqlite3ReferencesSrcList().
006533  */
006534  struct RefSrcList {
006535    sqlite3 *db;         /* Database connection used for sqlite3DbRealloc() */
006536    SrcList *pRef;       /* Looking for references to these tables */
006537    i64 nExclude;        /* Number of tables to exclude from the search */
006538    int *aiExclude;      /* Cursor IDs for tables to exclude from the search */
006539  };
006540  
006541  /*
006542  ** Walker SELECT callbacks for sqlite3ReferencesSrcList().
006543  **
006544  ** When entering a new subquery on the pExpr argument, add all FROM clause
006545  ** entries for that subquery to the exclude list.
006546  **
006547  ** When leaving the subquery, remove those entries from the exclude list.
006548  */
006549  static int selectRefEnter(Walker *pWalker, Select *pSelect){
006550    struct RefSrcList *p = pWalker->u.pRefSrcList;
006551    SrcList *pSrc = pSelect->pSrc;
006552    i64 i, j;
006553    int *piNew;
006554    if( pSrc->nSrc==0 ) return WRC_Continue;
006555    j = p->nExclude;
006556    p->nExclude += pSrc->nSrc;
006557    piNew = sqlite3DbRealloc(p->db, p->aiExclude, p->nExclude*sizeof(int));
006558    if( piNew==0 ){
006559      p->nExclude = 0;
006560      return WRC_Abort;
006561    }else{
006562      p->aiExclude = piNew;
006563    }
006564    for(i=0; i<pSrc->nSrc; i++, j++){
006565       p->aiExclude[j] = pSrc->a[i].iCursor;
006566    }
006567    return WRC_Continue;
006568  }
006569  static void selectRefLeave(Walker *pWalker, Select *pSelect){
006570    struct RefSrcList *p = pWalker->u.pRefSrcList;
006571    SrcList *pSrc = pSelect->pSrc;
006572    if( p->nExclude ){
006573      assert( p->nExclude>=pSrc->nSrc );
006574      p->nExclude -= pSrc->nSrc;
006575    }
006576  }
006577  
006578  /* This is the Walker EXPR callback for sqlite3ReferencesSrcList().
006579  **
006580  ** Set the 0x01 bit of pWalker->eCode if there is a reference to any
006581  ** of the tables shown in RefSrcList.pRef.
006582  **
006583  ** Set the 0x02 bit of pWalker->eCode if there is a reference to a
006584  ** table is in neither RefSrcList.pRef nor RefSrcList.aiExclude.
006585  */
006586  static int exprRefToSrcList(Walker *pWalker, Expr *pExpr){
006587    if( pExpr->op==TK_COLUMN
006588     || pExpr->op==TK_AGG_COLUMN
006589    ){
006590      int i;
006591      struct RefSrcList *p = pWalker->u.pRefSrcList;
006592      SrcList *pSrc = p->pRef;
006593      int nSrc = pSrc ? pSrc->nSrc : 0;
006594      for(i=0; i<nSrc; i++){
006595        if( pExpr->iTable==pSrc->a[i].iCursor ){
006596          pWalker->eCode |= 1;
006597          return WRC_Continue;
006598        }
006599      }
006600      for(i=0; i<p->nExclude && p->aiExclude[i]!=pExpr->iTable; i++){}
006601      if( i>=p->nExclude ){
006602        pWalker->eCode |= 2;
006603      }
006604    }
006605    return WRC_Continue;
006606  }
006607  
006608  /*
006609  ** Check to see if pExpr references any tables in pSrcList.
006610  ** Possible return values:
006611  **
006612  **    1         pExpr does references a table in pSrcList.
006613  **
006614  **    0         pExpr references some table that is not defined in either
006615  **              pSrcList or in subqueries of pExpr itself.
006616  **
006617  **   -1         pExpr only references no tables at all, or it only
006618  **              references tables defined in subqueries of pExpr itself.
006619  **
006620  ** As currently used, pExpr is always an aggregate function call.  That
006621  ** fact is exploited for efficiency.
006622  */
006623  int sqlite3ReferencesSrcList(Parse *pParse, Expr *pExpr, SrcList *pSrcList){
006624    Walker w;
006625    struct RefSrcList x;
006626    assert( pParse->db!=0 );
006627    memset(&w, 0, sizeof(w));
006628    memset(&x, 0, sizeof(x));
006629    w.xExprCallback = exprRefToSrcList;
006630    w.xSelectCallback = selectRefEnter;
006631    w.xSelectCallback2 = selectRefLeave;
006632    w.u.pRefSrcList = &x;
006633    x.db = pParse->db;
006634    x.pRef = pSrcList;
006635    assert( pExpr->op==TK_AGG_FUNCTION );
006636    assert( ExprUseXList(pExpr) );
006637    sqlite3WalkExprList(&w, pExpr->x.pList);
006638    if( pExpr->pLeft ){
006639      assert( pExpr->pLeft->op==TK_ORDER );
006640      assert( ExprUseXList(pExpr->pLeft) );
006641      assert( pExpr->pLeft->x.pList!=0 );
006642      sqlite3WalkExprList(&w, pExpr->pLeft->x.pList);
006643    }
006644  #ifndef SQLITE_OMIT_WINDOWFUNC
006645    if( ExprHasProperty(pExpr, EP_WinFunc) ){
006646      sqlite3WalkExpr(&w, pExpr->y.pWin->pFilter);
006647    }
006648  #endif
006649    if( x.aiExclude ) sqlite3DbNNFreeNN(pParse->db, x.aiExclude);
006650    if( w.eCode & 0x01 ){
006651      return 1;
006652    }else if( w.eCode ){
006653      return 0;
006654    }else{
006655      return -1;
006656    }
006657  }
006658  
006659  /*
006660  ** This is a Walker expression node callback.
006661  **
006662  ** For Expr nodes that contain pAggInfo pointers, make sure the AggInfo
006663  ** object that is referenced does not refer directly to the Expr.  If
006664  ** it does, make a copy.  This is done because the pExpr argument is
006665  ** subject to change.
006666  **
006667  ** The copy is scheduled for deletion using the sqlite3ExprDeferredDelete()
006668  ** which builds on the sqlite3ParserAddCleanup() mechanism.
006669  */
006670  static int agginfoPersistExprCb(Walker *pWalker, Expr *pExpr){
006671    if( ALWAYS(!ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced))
006672     && pExpr->pAggInfo!=0
006673    ){
006674      AggInfo *pAggInfo = pExpr->pAggInfo;
006675      int iAgg = pExpr->iAgg;
006676      Parse *pParse = pWalker->pParse;
006677      sqlite3 *db = pParse->db;
006678      assert( iAgg>=0 );
006679      if( pExpr->op!=TK_AGG_FUNCTION ){
006680        if( iAgg<pAggInfo->nColumn
006681         && pAggInfo->aCol[iAgg].pCExpr==pExpr
006682        ){
006683          pExpr = sqlite3ExprDup(db, pExpr, 0);
006684          if( pExpr && !sqlite3ExprDeferredDelete(pParse, pExpr) ){
006685            pAggInfo->aCol[iAgg].pCExpr = pExpr;
006686          }
006687        }
006688      }else{
006689        assert( pExpr->op==TK_AGG_FUNCTION );
006690        if( ALWAYS(iAgg<pAggInfo->nFunc)
006691         && pAggInfo->aFunc[iAgg].pFExpr==pExpr
006692        ){
006693          pExpr = sqlite3ExprDup(db, pExpr, 0);
006694          if( pExpr && !sqlite3ExprDeferredDelete(pParse, pExpr) ){
006695            pAggInfo->aFunc[iAgg].pFExpr = pExpr;
006696          }
006697        }
006698      }
006699    }
006700    return WRC_Continue;
006701  }
006702  
006703  /*
006704  ** Initialize a Walker object so that will persist AggInfo entries referenced
006705  ** by the tree that is walked.
006706  */
006707  void sqlite3AggInfoPersistWalkerInit(Walker *pWalker, Parse *pParse){
006708    memset(pWalker, 0, sizeof(*pWalker));
006709    pWalker->pParse = pParse;
006710    pWalker->xExprCallback = agginfoPersistExprCb;
006711    pWalker->xSelectCallback = sqlite3SelectWalkNoop;
006712  }
006713  
006714  /*
006715  ** Add a new element to the pAggInfo->aCol[] array.  Return the index of
006716  ** the new element.  Return a negative number if malloc fails.
006717  */
006718  static int addAggInfoColumn(sqlite3 *db, AggInfo *pInfo){
006719    int i;
006720    pInfo->aCol = sqlite3ArrayAllocate(
006721         db,
006722         pInfo->aCol,
006723         sizeof(pInfo->aCol[0]),
006724         &pInfo->nColumn,
006725         &i
006726    );
006727    return i;
006728  }   
006729  
006730  /*
006731  ** Add a new element to the pAggInfo->aFunc[] array.  Return the index of
006732  ** the new element.  Return a negative number if malloc fails.
006733  */
006734  static int addAggInfoFunc(sqlite3 *db, AggInfo *pInfo){
006735    int i;
006736    pInfo->aFunc = sqlite3ArrayAllocate(
006737         db,
006738         pInfo->aFunc,
006739         sizeof(pInfo->aFunc[0]),
006740         &pInfo->nFunc,
006741         &i
006742    );
006743    return i;
006744  }
006745  
006746  /*
006747  ** Search the AggInfo object for an aCol[] entry that has iTable and iColumn.
006748  ** Return the index in aCol[] of the entry that describes that column.
006749  **
006750  ** If no prior entry is found, create a new one and return -1.  The
006751  ** new column will have an index of pAggInfo->nColumn-1.
006752  */
006753  static void findOrCreateAggInfoColumn(
006754    Parse *pParse,       /* Parsing context */
006755    AggInfo *pAggInfo,   /* The AggInfo object to search and/or modify */
006756    Expr *pExpr          /* Expr describing the column to find or insert */
006757  ){
006758    struct AggInfo_col *pCol;
006759    int k;
006760  
006761    assert( pAggInfo->iFirstReg==0 );
006762    pCol = pAggInfo->aCol;
006763    for(k=0; k<pAggInfo->nColumn; k++, pCol++){
006764      if( pCol->pCExpr==pExpr ) return;
006765      if( pCol->iTable==pExpr->iTable
006766       && pCol->iColumn==pExpr->iColumn
006767       && pExpr->op!=TK_IF_NULL_ROW
006768      ){
006769        goto fix_up_expr;
006770      }
006771    }
006772    k = addAggInfoColumn(pParse->db, pAggInfo);
006773    if( k<0 ){
006774      /* OOM on resize */
006775      assert( pParse->db->mallocFailed );
006776      return;
006777    }
006778    pCol = &pAggInfo->aCol[k];
006779    assert( ExprUseYTab(pExpr) );
006780    pCol->pTab = pExpr->y.pTab;
006781    pCol->iTable = pExpr->iTable;
006782    pCol->iColumn = pExpr->iColumn;
006783    pCol->iSorterColumn = -1;
006784    pCol->pCExpr = pExpr;
006785    if( pAggInfo->pGroupBy && pExpr->op!=TK_IF_NULL_ROW ){
006786      int j, n;
006787      ExprList *pGB = pAggInfo->pGroupBy;
006788      struct ExprList_item *pTerm = pGB->a;
006789      n = pGB->nExpr;
006790      for(j=0; j<n; j++, pTerm++){
006791        Expr *pE = pTerm->pExpr;
006792        if( pE->op==TK_COLUMN
006793         && pE->iTable==pExpr->iTable
006794         && pE->iColumn==pExpr->iColumn
006795        ){
006796          pCol->iSorterColumn = j;
006797          break;
006798        }
006799      }
006800    }
006801    if( pCol->iSorterColumn<0 ){
006802      pCol->iSorterColumn = pAggInfo->nSortingColumn++;
006803    }
006804  fix_up_expr:
006805    ExprSetVVAProperty(pExpr, EP_NoReduce);
006806    assert( pExpr->pAggInfo==0 || pExpr->pAggInfo==pAggInfo );
006807    pExpr->pAggInfo = pAggInfo;
006808    if( pExpr->op==TK_COLUMN ){
006809      pExpr->op = TK_AGG_COLUMN;
006810    }
006811    pExpr->iAgg = (i16)k;
006812  }
006813  
006814  /*
006815  ** This is the xExprCallback for a tree walker.  It is used to
006816  ** implement sqlite3ExprAnalyzeAggregates().  See sqlite3ExprAnalyzeAggregates
006817  ** for additional information.
006818  */
006819  static int analyzeAggregate(Walker *pWalker, Expr *pExpr){
006820    int i;
006821    NameContext *pNC = pWalker->u.pNC;
006822    Parse *pParse = pNC->pParse;
006823    SrcList *pSrcList = pNC->pSrcList;
006824    AggInfo *pAggInfo = pNC->uNC.pAggInfo;
006825  
006826    assert( pNC->ncFlags & NC_UAggInfo );
006827    assert( pAggInfo->iFirstReg==0 );
006828    switch( pExpr->op ){
006829      default: {
006830        IndexedExpr *pIEpr;
006831        Expr tmp;
006832        assert( pParse->iSelfTab==0 );
006833        if( (pNC->ncFlags & NC_InAggFunc)==0 ) break;
006834        if( pParse->pIdxEpr==0 ) break;
006835        for(pIEpr=pParse->pIdxEpr; pIEpr; pIEpr=pIEpr->pIENext){
006836          int iDataCur = pIEpr->iDataCur;
006837          if( iDataCur<0 ) continue;
006838          if( sqlite3ExprCompare(0, pExpr, pIEpr->pExpr, iDataCur)==0 ) break;
006839        }
006840        if( pIEpr==0 ) break;
006841        if( NEVER(!ExprUseYTab(pExpr)) ) break;
006842        for(i=0; i<pSrcList->nSrc; i++){
006843           if( pSrcList->a[0].iCursor==pIEpr->iDataCur ) break;
006844        }
006845        if( i>=pSrcList->nSrc ) break;
006846        if( NEVER(pExpr->pAggInfo!=0) ) break; /* Resolved by outer context */
006847        if( pParse->nErr ){ return WRC_Abort; }
006848  
006849        /* If we reach this point, it means that expression pExpr can be
006850        ** translated into a reference to an index column as described by
006851        ** pIEpr.
006852        */
006853        memset(&tmp, 0, sizeof(tmp));
006854        tmp.op = TK_AGG_COLUMN;
006855        tmp.iTable = pIEpr->iIdxCur;
006856        tmp.iColumn = pIEpr->iIdxCol;
006857        findOrCreateAggInfoColumn(pParse, pAggInfo, &tmp);
006858        if( pParse->nErr ){ return WRC_Abort; }
006859        assert( pAggInfo->aCol!=0 );
006860        assert( tmp.iAgg<pAggInfo->nColumn );
006861        pAggInfo->aCol[tmp.iAgg].pCExpr = pExpr;
006862        pExpr->pAggInfo = pAggInfo;
006863        pExpr->iAgg = tmp.iAgg;
006864        return WRC_Prune;
006865      }
006866      case TK_IF_NULL_ROW:
006867      case TK_AGG_COLUMN:
006868      case TK_COLUMN: {
006869        testcase( pExpr->op==TK_AGG_COLUMN );
006870        testcase( pExpr->op==TK_COLUMN );
006871        testcase( pExpr->op==TK_IF_NULL_ROW );
006872        /* Check to see if the column is in one of the tables in the FROM
006873        ** clause of the aggregate query */
006874        if( ALWAYS(pSrcList!=0) ){
006875          SrcItem *pItem = pSrcList->a;
006876          for(i=0; i<pSrcList->nSrc; i++, pItem++){
006877            assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
006878            if( pExpr->iTable==pItem->iCursor ){
006879              findOrCreateAggInfoColumn(pParse, pAggInfo, pExpr);
006880              break;
006881            } /* endif pExpr->iTable==pItem->iCursor */
006882          } /* end loop over pSrcList */
006883        }
006884        return WRC_Continue;
006885      }
006886      case TK_AGG_FUNCTION: {
006887        if( (pNC->ncFlags & NC_InAggFunc)==0
006888         && pWalker->walkerDepth==pExpr->op2
006889         && pExpr->pAggInfo==0
006890        ){
006891          /* Check to see if pExpr is a duplicate of another aggregate
006892          ** function that is already in the pAggInfo structure
006893          */
006894          struct AggInfo_func *pItem = pAggInfo->aFunc;
006895          for(i=0; i<pAggInfo->nFunc; i++, pItem++){
006896            if( NEVER(pItem->pFExpr==pExpr) ) break;
006897            if( sqlite3ExprCompare(0, pItem->pFExpr, pExpr, -1)==0 ){
006898              break;
006899            }
006900          }
006901          if( i>=pAggInfo->nFunc ){
006902            /* pExpr is original.  Make a new entry in pAggInfo->aFunc[]
006903            */
006904            u8 enc = ENC(pParse->db);
006905            i = addAggInfoFunc(pParse->db, pAggInfo);
006906            if( i>=0 ){
006907              int nArg;
006908              assert( !ExprHasProperty(pExpr, EP_xIsSelect) );
006909              pItem = &pAggInfo->aFunc[i];
006910              pItem->pFExpr = pExpr;
006911              assert( ExprUseUToken(pExpr) );
006912              nArg = pExpr->x.pList ? pExpr->x.pList->nExpr : 0;
006913              pItem->pFunc = sqlite3FindFunction(pParse->db,
006914                                           pExpr->u.zToken, nArg, enc, 0);
006915              assert( pItem->bOBUnique==0 );
006916              if( pExpr->pLeft
006917               && (pItem->pFunc->funcFlags & SQLITE_FUNC_NEEDCOLL)==0
006918              ){
006919                /* The NEEDCOLL test above causes any ORDER BY clause on
006920                ** aggregate min() or max() to be ignored. */
006921                ExprList *pOBList;
006922                assert( nArg>0 );
006923                assert( pExpr->pLeft->op==TK_ORDER );
006924                assert( ExprUseXList(pExpr->pLeft) );
006925                pItem->iOBTab = pParse->nTab++;
006926                pOBList = pExpr->pLeft->x.pList;
006927                assert( pOBList->nExpr>0 );
006928                assert( pItem->bOBUnique==0 );
006929                if( pOBList->nExpr==1
006930                 && nArg==1
006931                 && sqlite3ExprCompare(0,pOBList->a[0].pExpr,
006932                                 pExpr->x.pList->a[0].pExpr,0)==0
006933                ){
006934                  pItem->bOBPayload = 0;
006935                  pItem->bOBUnique = ExprHasProperty(pExpr, EP_Distinct);
006936                }else{
006937                  pItem->bOBPayload = 1;
006938                }
006939                pItem->bUseSubtype =
006940                      (pItem->pFunc->funcFlags & SQLITE_SUBTYPE)!=0;
006941              }else{
006942                pItem->iOBTab = -1;
006943              }
006944              if( ExprHasProperty(pExpr, EP_Distinct) && !pItem->bOBUnique ){
006945                pItem->iDistinct = pParse->nTab++;
006946              }else{
006947                pItem->iDistinct = -1;
006948              }
006949            }
006950          }
006951          /* Make pExpr point to the appropriate pAggInfo->aFunc[] entry
006952          */
006953          assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
006954          ExprSetVVAProperty(pExpr, EP_NoReduce);
006955          pExpr->iAgg = (i16)i;
006956          pExpr->pAggInfo = pAggInfo;
006957          return WRC_Prune;
006958        }else{
006959          return WRC_Continue;
006960        }
006961      }
006962    }
006963    return WRC_Continue;
006964  }
006965  
006966  /*
006967  ** Analyze the pExpr expression looking for aggregate functions and
006968  ** for variables that need to be added to AggInfo object that pNC->pAggInfo
006969  ** points to.  Additional entries are made on the AggInfo object as
006970  ** necessary.
006971  **
006972  ** This routine should only be called after the expression has been
006973  ** analyzed by sqlite3ResolveExprNames().
006974  */
006975  void sqlite3ExprAnalyzeAggregates(NameContext *pNC, Expr *pExpr){
006976    Walker w;
006977    w.xExprCallback = analyzeAggregate;
006978    w.xSelectCallback = sqlite3WalkerDepthIncrease;
006979    w.xSelectCallback2 = sqlite3WalkerDepthDecrease;
006980    w.walkerDepth = 0;
006981    w.u.pNC = pNC;
006982    w.pParse = 0;
006983    assert( pNC->pSrcList!=0 );
006984    sqlite3WalkExpr(&w, pExpr);
006985  }
006986  
006987  /*
006988  ** Call sqlite3ExprAnalyzeAggregates() for every expression in an
006989  ** expression list.  Return the number of errors.
006990  **
006991  ** If an error is found, the analysis is cut short.
006992  */
006993  void sqlite3ExprAnalyzeAggList(NameContext *pNC, ExprList *pList){
006994    struct ExprList_item *pItem;
006995    int i;
006996    if( pList ){
006997      for(pItem=pList->a, i=0; i<pList->nExpr; i++, pItem++){
006998        sqlite3ExprAnalyzeAggregates(pNC, pItem->pExpr);
006999      }
007000    }
007001  }
007002  
007003  /*
007004  ** Allocate a single new register for use to hold some intermediate result.
007005  */
007006  int sqlite3GetTempReg(Parse *pParse){
007007    if( pParse->nTempReg==0 ){
007008      return ++pParse->nMem;
007009    }
007010    return pParse->aTempReg[--pParse->nTempReg];
007011  }
007012  
007013  /*
007014  ** Deallocate a register, making available for reuse for some other
007015  ** purpose.
007016  */
007017  void sqlite3ReleaseTempReg(Parse *pParse, int iReg){
007018    if( iReg ){
007019      sqlite3VdbeReleaseRegisters(pParse, iReg, 1, 0, 0);
007020      if( pParse->nTempReg<ArraySize(pParse->aTempReg) ){
007021        pParse->aTempReg[pParse->nTempReg++] = iReg;
007022      }
007023    }
007024  }
007025  
007026  /*
007027  ** Allocate or deallocate a block of nReg consecutive registers.
007028  */
007029  int sqlite3GetTempRange(Parse *pParse, int nReg){
007030    int i, n;
007031    if( nReg==1 ) return sqlite3GetTempReg(pParse);
007032    i = pParse->iRangeReg;
007033    n = pParse->nRangeReg;
007034    if( nReg<=n ){
007035      pParse->iRangeReg += nReg;
007036      pParse->nRangeReg -= nReg;
007037    }else{
007038      i = pParse->nMem+1;
007039      pParse->nMem += nReg;
007040    }
007041    return i;
007042  }
007043  void sqlite3ReleaseTempRange(Parse *pParse, int iReg, int nReg){
007044    if( nReg==1 ){
007045      sqlite3ReleaseTempReg(pParse, iReg);
007046      return;
007047    }
007048    sqlite3VdbeReleaseRegisters(pParse, iReg, nReg, 0, 0);
007049    if( nReg>pParse->nRangeReg ){
007050      pParse->nRangeReg = nReg;
007051      pParse->iRangeReg = iReg;
007052    }
007053  }
007054  
007055  /*
007056  ** Mark all temporary registers as being unavailable for reuse.
007057  **
007058  ** Always invoke this procedure after coding a subroutine or co-routine
007059  ** that might be invoked from other parts of the code, to ensure that
007060  ** the sub/co-routine does not use registers in common with the code that
007061  ** invokes the sub/co-routine.
007062  */
007063  void sqlite3ClearTempRegCache(Parse *pParse){
007064    pParse->nTempReg = 0;
007065    pParse->nRangeReg = 0;
007066  }
007067  
007068  /*
007069  ** Make sure sufficient registers have been allocated so that
007070  ** iReg is a valid register number.
007071  */
007072  void sqlite3TouchRegister(Parse *pParse, int iReg){
007073    if( pParse->nMem<iReg ) pParse->nMem = iReg;
007074  }
007075  
007076  #if defined(SQLITE_ENABLE_STAT4) || defined(SQLITE_DEBUG)
007077  /*
007078  ** Return the latest reusable register in the set of all registers.
007079  ** The value returned is no less than iMin.  If any register iMin or
007080  ** greater is in permanent use, then return one more than that last
007081  ** permanent register.
007082  */
007083  int sqlite3FirstAvailableRegister(Parse *pParse, int iMin){
007084    const ExprList *pList = pParse->pConstExpr;
007085    if( pList ){
007086      int i;
007087      for(i=0; i<pList->nExpr; i++){
007088        if( pList->a[i].u.iConstExprReg>=iMin ){
007089          iMin = pList->a[i].u.iConstExprReg + 1;
007090        }
007091      }
007092    }
007093    pParse->nTempReg = 0;
007094    pParse->nRangeReg = 0;
007095    return iMin;
007096  }
007097  #endif /* SQLITE_ENABLE_STAT4 || SQLITE_DEBUG */
007098  
007099  /*
007100  ** Validate that no temporary register falls within the range of
007101  ** iFirst..iLast, inclusive.  This routine is only call from within assert()
007102  ** statements.
007103  */
007104  #ifdef SQLITE_DEBUG
007105  int sqlite3NoTempsInRange(Parse *pParse, int iFirst, int iLast){
007106    int i;
007107    if( pParse->nRangeReg>0
007108     && pParse->iRangeReg+pParse->nRangeReg > iFirst
007109     && pParse->iRangeReg <= iLast
007110    ){
007111       return 0;
007112    }
007113    for(i=0; i<pParse->nTempReg; i++){
007114      if( pParse->aTempReg[i]>=iFirst && pParse->aTempReg[i]<=iLast ){
007115        return 0;
007116      }
007117    }
007118    if( pParse->pConstExpr ){
007119      ExprList *pList = pParse->pConstExpr;
007120      for(i=0; i<pList->nExpr; i++){
007121        int iReg = pList->a[i].u.iConstExprReg;
007122        if( iReg==0 ) continue;
007123        if( iReg>=iFirst && iReg<=iLast ) return 0;
007124      }
007125    }
007126    return 1;
007127  }
007128  #endif /* SQLITE_DEBUG */