src/vdbemem.c

   1 /*
   2 ** 2004 May 26
   3 **
   4 ** The author disclaims copyright to this source code.  In place of
   5 ** a legal notice, here is a blessing:
   6 **
   7 **    May you do good and not evil.
   8 **    May you find forgiveness for yourself and forgive others.
   9 **    May you share freely, never taking more than you give.
  10 **
  11 *************************************************************************
  12 **
  13 ** This file contains code use to manipulate "Mem" structure.  A "Mem"
  14 ** stores a single value in the VDBE.  Mem is an opaque structure visible
  15 ** only within the VDBE.  Interface routines refer to a Mem using the
  16 ** name sqlite_value
  17 */
  18 #include "sqliteInt.h"
  19 #include "vdbeInt.h"
  20
  21 /* True if X is a power of two.  0 is considered a power of two here.
  22 ** In other words, return true if X has at most one bit set.
  23 */
  24 #define ISPOWEROF2(X)  (((X)&((X)-1))==0)
  25
  26 #ifdef SQLITE_DEBUG
  27 /*
  28 ** Check invariants on a Mem object.
  29 **
  30 ** This routine is intended for use inside of assert() statements, like
  31 ** this:    assert( sqlite3VdbeCheckMemInvariants(pMem) );
  32 */
  33 int sqlite3VdbeCheckMemInvariants(Mem *p){
  34   /* If MEM_Dyn is set then Mem.xDel!=0.
  35   ** Mem.xDel might not be initialized if MEM_Dyn is clear.
  36   */
  37   assert( (p->flags & MEM_Dyn)==0 || p->xDel!=0 );
  38
  39   /* MEM_Dyn may only be set if Mem.szMalloc==0.  In this way we
  40   ** ensure that if Mem.szMalloc>0 then it is safe to do
  41   ** Mem.z = Mem.zMalloc without having to check Mem.flags&MEM_Dyn.
  42   ** That saves a few cycles in inner loops. */
  43   assert( (p->flags & MEM_Dyn)==0 || p->szMalloc==0 );
  44
  45   /* Cannot have more than one of MEM_Int, MEM_Real, or MEM_IntReal */
  46   assert( ISPOWEROF2(p->flags & (MEM_Int|MEM_Real|MEM_IntReal)) );
  47
  48   if( p->flags & MEM_Null ){
  49     /* Cannot be both MEM_Null and some other type */
  50     assert( (p->flags & (MEM_Int|MEM_Real|MEM_Str|MEM_Blob|MEM_Agg))==0 );
  51
  52     /* If MEM_Null is set, then either the value is a pure NULL (the usual
  53     ** case) or it is a pointer set using sqlite3_bind_pointer() or
  54     ** sqlite3_result_pointer().  If a pointer, then MEM_Term must also be
  55     ** set.
  56     */
  57     if( (p->flags & (MEM_Term|MEM_Subtype))==(MEM_Term|MEM_Subtype) ){
  58       /* This is a pointer type.  There may be a flag to indicate what to
  59       ** do with the pointer. */
  60       assert( ((p->flags&MEM_Dyn)!=0 ? 1 : 0) +
  61               ((p->flags&MEM_Ephem)!=0 ? 1 : 0) +
  62               ((p->flags&MEM_Static)!=0 ? 1 : 0) <= 1 );
  63
  64       /* No other bits set */
  65       assert( (p->flags & ~(MEM_Null|MEM_Term|MEM_Subtype|MEM_FromBind
  66                            |MEM_Dyn|MEM_Ephem|MEM_Static))==0 );
  67     }else{
  68       /* A pure NULL might have other flags, such as MEM_Static, MEM_Dyn,
  69       ** MEM_Ephem, MEM_Cleared, or MEM_Subtype */
  70     }
  71   }else{
  72     /* The MEM_Cleared bit is only allowed on NULLs */
  73     assert( (p->flags & MEM_Cleared)==0 );
  74   }
  75
  76   /* The szMalloc field holds the correct memory allocation size */
  77   assert( p->szMalloc==0
  78        || p->szMalloc==sqlite3DbMallocSize(p->db,p->zMalloc) );
  79
  80   /* If p holds a string or blob, the Mem.z must point to exactly
  81   ** one of the following:
  82   **
  83   **   (1) Memory in Mem.zMalloc and managed by the Mem object
  84   **   (2) Memory to be freed using Mem.xDel
  85   **   (3) An ephemeral string or blob
  86   **   (4) A static string or blob
  87   */
  88   if( (p->flags & (MEM_Str|MEM_Blob)) && p->n>0 ){
  89     assert(
  90       ((p->szMalloc>0 && p->z==p->zMalloc)? 1 : 0) +
  91       ((p->flags&MEM_Dyn)!=0 ? 1 : 0) +
  92       ((p->flags&MEM_Ephem)!=0 ? 1 : 0) +
  93       ((p->flags&MEM_Static)!=0 ? 1 : 0) == 1
  94     );
  95   }
  96   return 1;
  97 }
  98 #endif
  99
 100 /*
 101 ** Render a Mem object which is one of MEM_Int, MEM_Real, or MEM_IntReal
 102 ** into a buffer.
 103 */
 104 static void vdbeMemRenderNum(int sz, char *zBuf, Mem *p){
 105   StrAccum acc;
 106   assert( p->flags & (MEM_Int|MEM_Real|MEM_IntReal) );
 107   sqlite3StrAccumInit(&acc, 0, zBuf, sz, 0);
 108   if( p->flags & MEM_Int ){
 109     sqlite3_str_appendf(&acc, "%lld", p->u.i);
 110   }else if( p->flags & MEM_IntReal ){
 111     sqlite3_str_appendf(&acc, "%!.15g", (double)p->u.i);
 112   }else{
 113     sqlite3_str_appendf(&acc, "%!.15g", p->u.r);
 114   }
 115   assert( acc.zText==zBuf && acc.mxAlloc<=0 );
 116   zBuf[acc.nChar] = 0; /* Fast version of sqlite3StrAccumFinish(&acc) */
 117 }
 118
 119 #ifdef SQLITE_DEBUG
 120 /*
 121 ** Validity checks on pMem.  pMem holds a string.
 122 **
 123 ** (1) Check that string value of pMem agrees with its integer or real value.
 124 ** (2) Check that the string is correctly zero terminated
 125 **
 126 ** A single int or real value always converts to the same strings.  But
 127 ** many different strings can be converted into the same int or real.
 128 ** If a table contains a numeric value and an index is based on the
 129 ** corresponding string value, then it is important that the string be
 130 ** derived from the numeric value, not the other way around, to ensure
 131 ** that the index and table are consistent.  See ticket
 132 ** https://www.sqlite.org/src/info/343634942dd54ab (2018-01-31) for
 133 ** an example.
 134 **
 135 ** This routine looks at pMem to verify that if it has both a numeric
 136 ** representation and a string representation then the string rep has
 137 ** been derived from the numeric and not the other way around.  It returns
 138 ** true if everything is ok and false if there is a problem.
 139 **
 140 ** This routine is for use inside of assert() statements only.
 141 */
 142 int sqlite3VdbeMemValidStrRep(Mem *p){
 143   char zBuf[100];
 144   char *z;
 145   int i, j, incr;
 146   if( (p->flags & MEM_Str)==0 ) return 1;
 147   if( p->flags & MEM_Term ){
 148     /* Insure that the string is properly zero-terminated.  Pay particular
 149     ** attention to the case where p->n is odd */
 150     if( p->szMalloc>0 && p->z==p->zMalloc ){
 151       assert( p->enc==SQLITE_UTF8 || p->szMalloc >= ((p->n+1)&~1)+2 );
 152       assert( p->enc!=SQLITE_UTF8 || p->szMalloc >= p->n+1 );
 153     }
 154     assert( p->z[p->n]==0 );
 155     assert( p->enc==SQLITE_UTF8 || p->z[(p->n+1)&~1]==0 );
 156     assert( p->enc==SQLITE_UTF8 || p->z[((p->n+1)&~1)+1]==0 );
 157   }
 158   if( (p->flags & (MEM_Int|MEM_Real|MEM_IntReal))==0 ) return 1;
 159   vdbeMemRenderNum(sizeof(zBuf), zBuf, p);
 160   z = p->z;
 161   i = j = 0;
 162   incr = 1;
 163   if( p->enc!=SQLITE_UTF8 ){
 164     incr = 2;
 165     if( p->enc==SQLITE_UTF16BE ) z++;
 166   }
 167   while( zBuf[j] ){
 168     if( zBuf[j++]!=z[i] ) return 0;
 169     i += incr;
 170   }
 171   return 1;
 172 }
 173 #endif /* SQLITE_DEBUG */
 174
 175 /*
 176 ** If pMem is an object with a valid string representation, this routine
 177 ** ensures the internal encoding for the string representation is
 178 ** 'desiredEnc', one of SQLITE_UTF8, SQLITE_UTF16LE or SQLITE_UTF16BE.
 179 **
 180 ** If pMem is not a string object, or the encoding of the string
 181 ** representation is already stored using the requested encoding, then this
 182 ** routine is a no-op.
 183 **
 184 ** SQLITE_OK is returned if the conversion is successful (or not required).
 185 ** SQLITE_NOMEM may be returned if a malloc() fails during conversion
 186 ** between formats.
 187 */
 188 int sqlite3VdbeChangeEncoding(Mem *pMem, int desiredEnc){
 189 #ifndef SQLITE_OMIT_UTF16
 190   int rc;
 191 #endif
 192   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 193   assert( desiredEnc==SQLITE_UTF8 || desiredEnc==SQLITE_UTF16LE
 194            || desiredEnc==SQLITE_UTF16BE );
 195   if( !(pMem->flags&MEM_Str) || pMem->enc==desiredEnc ){
 196     return SQLITE_OK;
 197   }
 198   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 199 #ifdef SQLITE_OMIT_UTF16
 200   return SQLITE_ERROR;
 201 #else
 202
 203   /* MemTranslate() may return SQLITE_OK or SQLITE_NOMEM. If NOMEM is returned,
 204   ** then the encoding of the value may not have changed.
 205   */
 206   rc = sqlite3VdbeMemTranslate(pMem, (u8)desiredEnc);
 207   assert(rc==SQLITE_OK    || rc==SQLITE_NOMEM);
 208   assert(rc==SQLITE_OK    || pMem->enc!=desiredEnc);
 209   assert(rc==SQLITE_NOMEM || pMem->enc==desiredEnc);
 210   return rc;
 211 #endif
 212 }
 213
 214 /*
 215 ** Make sure pMem->z points to a writable allocation of at least n bytes.
 216 **
 217 ** If the bPreserve argument is true, then copy of the content of
 218 ** pMem->z into the new allocation.  pMem must be either a string or
 219 ** blob if bPreserve is true.  If bPreserve is false, any prior content
 220 ** in pMem->z is discarded.
 221 */
 222 SQLITE_NOINLINE int sqlite3VdbeMemGrow(Mem *pMem, int n, int bPreserve){
 223   assert( sqlite3VdbeCheckMemInvariants(pMem) );
 224   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 225   testcase( pMem->db==0 );
 226
 227   /* If the bPreserve flag is set to true, then the memory cell must already
 228   ** contain a valid string or blob value.  */
 229   assert( bPreserve==0 || pMem->flags&(MEM_Blob|MEM_Str) );
 230   testcase( bPreserve && pMem->z==0 );
 231
 232   assert( pMem->szMalloc==0
 233        || pMem->szMalloc==sqlite3DbMallocSize(pMem->db, pMem->zMalloc) );
 234   if( pMem->szMalloc>0 && bPreserve && pMem->z==pMem->zMalloc ){
 235     pMem->z = pMem->zMalloc = sqlite3DbReallocOrFree(pMem->db, pMem->z, n);
 236     bPreserve = 0;
 237   }else{
 238     if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
 239     pMem->zMalloc = sqlite3DbMallocRaw(pMem->db, n);
 240   }
 241   if( pMem->zMalloc==0 ){
 242     sqlite3VdbeMemSetNull(pMem);
 243     pMem->z = 0;
 244     pMem->szMalloc = 0;
 245     return SQLITE_NOMEM_BKPT;
 246   }else{
 247     pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
 248   }
 249
 250   if( bPreserve && pMem->z ){
 251     assert( pMem->z!=pMem->zMalloc );
 252     memcpy(pMem->zMalloc, pMem->z, pMem->n);
 253   }
 254   if( (pMem->flags&MEM_Dyn)!=0 ){
 255     assert( pMem->xDel!=0 && pMem->xDel!=SQLITE_DYNAMIC );
 256     pMem->xDel((void *)(pMem->z));
 257   }
 258
 259   pMem->z = pMem->zMalloc;
 260   pMem->flags &= ~(MEM_Dyn|MEM_Ephem|MEM_Static);
 261   return SQLITE_OK;
 262 }
 263
 264 /*
 265 ** Change the pMem->zMalloc allocation to be at least szNew bytes.
 266 ** If pMem->zMalloc already meets or exceeds the requested size, this
 267 ** routine is a no-op.
 268 **
 269 ** Any prior string or blob content in the pMem object may be discarded.
 270 ** The pMem->xDel destructor is called, if it exists.  Though MEM_Str
 271 ** and MEM_Blob values may be discarded, MEM_Int, MEM_Real, MEM_IntReal,
 272 ** and MEM_Null values are preserved.
 273 **
 274 ** Return SQLITE_OK on success or an error code (probably SQLITE_NOMEM)
 275 ** if unable to complete the resizing.
 276 */
 277 int sqlite3VdbeMemClearAndResize(Mem *pMem, int szNew){
 278   assert( CORRUPT_DB || szNew>0 );
 279   assert( (pMem->flags & MEM_Dyn)==0 || pMem->szMalloc==0 );
 280   if( pMem->szMalloc<szNew ){
 281     return sqlite3VdbeMemGrow(pMem, szNew, 0);
 282   }
 283   assert( (pMem->flags & MEM_Dyn)==0 );
 284   pMem->z = pMem->zMalloc;
 285   pMem->flags &= (MEM_Null|MEM_Int|MEM_Real|MEM_IntReal);
 286   return SQLITE_OK;
 287 }
 288
 289 /*
 290 ** It is already known that pMem contains an unterminated string.
 291 ** Add the zero terminator.
 292 **
 293 ** Three bytes of zero are added.  In this way, there is guaranteed
 294 ** to be a double-zero byte at an even byte boundary in order to
 295 ** terminate a UTF16 string, even if the initial size of the buffer
 296 ** is an odd number of bytes.
 297 */
 298 static SQLITE_NOINLINE int vdbeMemAddTerminator(Mem *pMem){
 299   if( sqlite3VdbeMemGrow(pMem, pMem->n+3, 1) ){
 300     return SQLITE_NOMEM_BKPT;
 301   }
 302   pMem->z[pMem->n] = 0;
 303   pMem->z[pMem->n+1] = 0;
 304   pMem->z[pMem->n+2] = 0;
 305   pMem->flags |= MEM_Term;
 306   return SQLITE_OK;
 307 }
 308
 309 /*
 310 ** Change pMem so that its MEM_Str or MEM_Blob value is stored in
 311 ** MEM.zMalloc, where it can be safely written.
 312 **
 313 ** Return SQLITE_OK on success or SQLITE_NOMEM if malloc fails.
 314 */
 315 int sqlite3VdbeMemMakeWriteable(Mem *pMem){
 316   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 317   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 318   if( (pMem->flags & (MEM_Str|MEM_Blob))!=0 ){
 319     if( ExpandBlob(pMem) ) return SQLITE_NOMEM;
 320     if( pMem->szMalloc==0 || pMem->z!=pMem->zMalloc ){
 321       int rc = vdbeMemAddTerminator(pMem);
 322       if( rc ) return rc;
 323     }
 324   }
 325   pMem->flags &= ~MEM_Ephem;
 326 #ifdef SQLITE_DEBUG
 327   pMem->pScopyFrom = 0;
 328 #endif
 329
 330   return SQLITE_OK;
 331 }
 332
 333 /*
 334 ** If the given Mem* has a zero-filled tail, turn it into an ordinary
 335 ** blob stored in dynamically allocated space.
 336 */
 337 #ifndef SQLITE_OMIT_INCRBLOB
 338 int sqlite3VdbeMemExpandBlob(Mem *pMem){
 339   int nByte;
 340   assert( pMem->flags & MEM_Zero );
 341   assert( (pMem->flags&MEM_Blob)!=0 || MemNullNochng(pMem) );
 342   testcase( sqlite3_value_nochange(pMem) );
 343   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 344   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 345
 346   /* Set nByte to the number of bytes required to store the expanded blob. */
 347   nByte = pMem->n + pMem->u.nZero;
 348   if( nByte<=0 ){
 349     if( (pMem->flags & MEM_Blob)==0 ) return SQLITE_OK;
 350     nByte = 1;
 351   }
 352   if( sqlite3VdbeMemGrow(pMem, nByte, 1) ){
 353     return SQLITE_NOMEM_BKPT;
 354   }
 355
 356   memset(&pMem->z[pMem->n], 0, pMem->u.nZero);
 357   pMem->n += pMem->u.nZero;
 358   pMem->flags &= ~(MEM_Zero|MEM_Term);
 359   return SQLITE_OK;
 360 }
 361 #endif
 362
 363 /*
 364 ** Make sure the given Mem is \u0000 terminated.
 365 */
 366 int sqlite3VdbeMemNulTerminate(Mem *pMem){
 367   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 368   testcase( (pMem->flags & (MEM_Term|MEM_Str))==(MEM_Term|MEM_Str) );
 369   testcase( (pMem->flags & (MEM_Term|MEM_Str))==0 );
 370   if( (pMem->flags & (MEM_Term|MEM_Str))!=MEM_Str ){
 371     return SQLITE_OK;   /* Nothing to do */
 372   }else{
 373     return vdbeMemAddTerminator(pMem);
 374   }
 375 }
 376
 377 /*
 378 ** Add MEM_Str to the set of representations for the given Mem.  This
 379 ** routine is only called if pMem is a number of some kind, not a NULL
 380 ** or a BLOB.
 381 **
 382 ** Existing representations MEM_Int, MEM_Real, or MEM_IntReal are invalidated
 383 ** if bForce is true but are retained if bForce is false.
 384 **
 385 ** A MEM_Null value will never be passed to this function. This function is
 386 ** used for converting values to text for returning to the user (i.e. via
 387 ** sqlite3_value_text()), or for ensuring that values to be used as btree
 388 ** keys are strings. In the former case a NULL pointer is returned the
 389 ** user and the latter is an internal programming error.
 390 */
 391 int sqlite3VdbeMemStringify(Mem *pMem, u8 enc, u8 bForce){
 392   const int nByte = 32;
 393
 394   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 395   assert( !(pMem->flags&MEM_Zero) );
 396   assert( !(pMem->flags&(MEM_Str|MEM_Blob)) );
 397   assert( pMem->flags&(MEM_Int|MEM_Real|MEM_IntReal) );
 398   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 399   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 400
 401
 402   if( sqlite3VdbeMemClearAndResize(pMem, nByte) ){
 403     pMem->enc = 0;
 404     return SQLITE_NOMEM_BKPT;
 405   }
 406
 407   vdbeMemRenderNum(nByte, pMem->z, pMem);
 408   assert( pMem->z!=0 );
 409   pMem->n = sqlite3Strlen30NN(pMem->z);
 410   pMem->enc = SQLITE_UTF8;
 411   pMem->flags |= MEM_Str|MEM_Term;
 412   if( bForce ) pMem->flags &= ~(MEM_Int|MEM_Real|MEM_IntReal);
 413   sqlite3VdbeChangeEncoding(pMem, enc);
 414   return SQLITE_OK;
 415 }
 416
 417 /*
 418 ** Memory cell pMem contains the context of an aggregate function.
 419 ** This routine calls the finalize method for that function.  The
 420 ** result of the aggregate is stored back into pMem.
 421 **
 422 ** Return SQLITE_ERROR if the finalizer reports an error.  SQLITE_OK
 423 ** otherwise.
 424 */
 425 int sqlite3VdbeMemFinalize(Mem *pMem, FuncDef *pFunc){
 426   sqlite3_context ctx;
 427   Mem t;
 428   assert( pFunc!=0 );
 429   assert( pFunc->xFinalize!=0 );
 430   assert( (pMem->flags & MEM_Null)!=0 || pFunc==pMem->u.pDef );
 431   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 432   memset(&ctx, 0, sizeof(ctx));
 433   memset(&t, 0, sizeof(t));
 434   t.flags = MEM_Null;
 435   t.db = pMem->db;
 436   ctx.pOut = &t;
 437   ctx.pMem = pMem;
 438   ctx.pFunc = pFunc;
 439   pFunc->xFinalize(&ctx); /* IMP: R-24505-23230 */
 440   assert( (pMem->flags & MEM_Dyn)==0 );
 441   if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
 442   memcpy(pMem, &t, sizeof(t));
 443   return ctx.isError;
 444 }
 445
 446 /*
 447 ** Memory cell pAccum contains the context of an aggregate function.
 448 ** This routine calls the xValue method for that function and stores
 449 ** the results in memory cell pMem.
 450 **
 451 ** SQLITE_ERROR is returned if xValue() reports an error. SQLITE_OK
 452 ** otherwise.
 453 */
 454 #ifndef SQLITE_OMIT_WINDOWFUNC
 455 int sqlite3VdbeMemAggValue(Mem *pAccum, Mem *pOut, FuncDef *pFunc){
 456   sqlite3_context ctx;
 457   Mem t;
 458   assert( pFunc!=0 );
 459   assert( pFunc->xValue!=0 );
 460   assert( (pAccum->flags & MEM_Null)!=0 || pFunc==pAccum->u.pDef );
 461   assert( pAccum->db==0 || sqlite3_mutex_held(pAccum->db->mutex) );
 462   memset(&ctx, 0, sizeof(ctx));
 463   memset(&t, 0, sizeof(t));
 464   t.flags = MEM_Null;
 465   t.db = pAccum->db;
 466   sqlite3VdbeMemSetNull(pOut);
 467   ctx.pOut = pOut;
 468   ctx.pMem = pAccum;
 469   ctx.pFunc = pFunc;
 470   pFunc->xValue(&ctx);
 471   return ctx.isError;
 472 }
 473 #endif /* SQLITE_OMIT_WINDOWFUNC */
 474
 475 /*
 476 ** If the memory cell contains a value that must be freed by
 477 ** invoking the external callback in Mem.xDel, then this routine
 478 ** will free that value.  It also sets Mem.flags to MEM_Null.
 479 **
 480 ** This is a helper routine for sqlite3VdbeMemSetNull() and
 481 ** for sqlite3VdbeMemRelease().  Use those other routines as the
 482 ** entry point for releasing Mem resources.
 483 */
 484 static SQLITE_NOINLINE void vdbeMemClearExternAndSetNull(Mem *p){
 485   assert( p->db==0 || sqlite3_mutex_held(p->db->mutex) );
 486   assert( VdbeMemDynamic(p) );
 487   if( p->flags&MEM_Agg ){
 488     sqlite3VdbeMemFinalize(p, p->u.pDef);
 489     assert( (p->flags & MEM_Agg)==0 );
 490     testcase( p->flags & MEM_Dyn );
 491   }
 492   if( p->flags&MEM_Dyn ){
 493     assert( p->xDel!=SQLITE_DYNAMIC && p->xDel!=0 );
 494     p->xDel((void *)p->z);
 495   }
 496   p->flags = MEM_Null;
 497 }
 498
 499 /*
 500 ** Release memory held by the Mem p, both external memory cleared
 501 ** by p->xDel and memory in p->zMalloc.
 502 **
 503 ** This is a helper routine invoked by sqlite3VdbeMemRelease() in
 504 ** the unusual case where there really is memory in p that needs
 505 ** to be freed.
 506 */
 507 static SQLITE_NOINLINE void vdbeMemClear(Mem *p){
 508   if( VdbeMemDynamic(p) ){
 509     vdbeMemClearExternAndSetNull(p);
 510   }
 511   if( p->szMalloc ){
 512     sqlite3DbFreeNN(p->db, p->zMalloc);
 513     p->szMalloc = 0;
 514   }
 515   p->z = 0;
 516 }
 517
 518 /*
 519 ** Release any memory resources held by the Mem.  Both the memory that is
 520 ** free by Mem.xDel and the Mem.zMalloc allocation are freed.
 521 **
 522 ** Use this routine prior to clean up prior to abandoning a Mem, or to
 523 ** reset a Mem back to its minimum memory utilization.
 524 **
 525 ** Use sqlite3VdbeMemSetNull() to release just the Mem.xDel space
 526 ** prior to inserting new content into the Mem.
 527 */
 528 void sqlite3VdbeMemRelease(Mem *p){
 529   assert( sqlite3VdbeCheckMemInvariants(p) );
 530   if( VdbeMemDynamic(p) || p->szMalloc ){
 531     vdbeMemClear(p);
 532   }
 533 }
 534
 535 /*
 536 ** Convert a 64-bit IEEE double into a 64-bit signed integer.
 537 ** If the double is out of range of a 64-bit signed integer then
 538 ** return the closest available 64-bit signed integer.
 539 */
 540 static SQLITE_NOINLINE i64 doubleToInt64(double r){
 541 #ifdef SQLITE_OMIT_FLOATING_POINT
 542   /* When floating-point is omitted, double and int64 are the same thing */
 543   return r;
 544 #else
 545   /*
 546   ** Many compilers we encounter do not define constants for the
 547   ** minimum and maximum 64-bit integers, or they define them
 548   ** inconsistently.  And many do not understand the "LL" notation.
 549   ** So we define our own static constants here using nothing
 550   ** larger than a 32-bit integer constant.
 551   */
 552   static const i64 maxInt = LARGEST_INT64;
 553   static const i64 minInt = SMALLEST_INT64;
 554
 555   if( r<=(double)minInt ){
 556     return minInt;
 557   }else if( r>=(double)maxInt ){
 558     return maxInt;
 559   }else{
 560     return (i64)r;
 561   }
 562 #endif
 563 }
 564
 565 /*
 566 ** Return some kind of integer value which is the best we can do
 567 ** at representing the value that *pMem describes as an integer.
 568 ** If pMem is an integer, then the value is exact.  If pMem is
 569 ** a floating-point then the value returned is the integer part.
 570 ** If pMem is a string or blob, then we make an attempt to convert
 571 ** it into an integer and return that.  If pMem represents an
 572 ** an SQL-NULL value, return 0.
 573 **
 574 ** If pMem represents a string value, its encoding might be changed.
 575 */
 576 static SQLITE_NOINLINE i64 memIntValue(Mem *pMem){
 577   i64 value = 0;
 578   sqlite3Atoi64(pMem->z, &value, pMem->n, pMem->enc);
 579   return value;
 580 }
 581 i64 sqlite3VdbeIntValue(Mem *pMem){
 582   int flags;
 583   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 584   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 585   flags = pMem->flags;
 586   if( flags & (MEM_Int|MEM_IntReal) ){
 587     testcase( flags & MEM_IntReal );
 588     return pMem->u.i;
 589   }else if( flags & MEM_Real ){
 590     return doubleToInt64(pMem->u.r);
 591   }else if( flags & (MEM_Str|MEM_Blob) ){
 592     assert( pMem->z || pMem->n==0 );
 593     return memIntValue(pMem);
 594   }else{
 595     return 0;
 596   }
 597 }
 598
 599 /*
 600 ** Return the best representation of pMem that we can get into a
 601 ** double.  If pMem is already a double or an integer, return its
 602 ** value.  If it is a string or blob, try to convert it to a double.
 603 ** If it is a NULL, return 0.0.
 604 */
 605 static SQLITE_NOINLINE double memRealValue(Mem *pMem){
 606   /* (double)0 In case of SQLITE_OMIT_FLOATING_POINT... */
 607   double val = (double)0;
 608   sqlite3AtoF(pMem->z, &val, pMem->n, pMem->enc);
 609   return val;
 610 }
 611 double sqlite3VdbeRealValue(Mem *pMem){
 612   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 613   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 614   if( pMem->flags & MEM_Real ){
 615     return pMem->u.r;
 616   }else if( pMem->flags & (MEM_Int|MEM_IntReal) ){
 617     testcase( pMem->flags & MEM_IntReal );
 618     return (double)pMem->u.i;
 619   }else if( pMem->flags & (MEM_Str|MEM_Blob) ){
 620     return memRealValue(pMem);
 621   }else{
 622     /* (double)0 In case of SQLITE_OMIT_FLOATING_POINT... */
 623     return (double)0;
 624   }
 625 }
 626
 627 /*
 628 ** Return 1 if pMem represents true, and return 0 if pMem represents false.
 629 ** Return the value ifNull if pMem is NULL.
 630 */
 631 int sqlite3VdbeBooleanValue(Mem *pMem, int ifNull){
 632   testcase( pMem->flags & MEM_IntReal );
 633   if( pMem->flags & (MEM_Int|MEM_IntReal) ) return pMem->u.i!=0;
 634   if( pMem->flags & MEM_Null ) return ifNull;
 635   return sqlite3VdbeRealValue(pMem)!=0.0;
 636 }
 637
 638 /*
 639 ** The MEM structure is already a MEM_Real.  Try to also make it a
 640 ** MEM_Int if we can.
 641 */
 642 void sqlite3VdbeIntegerAffinity(Mem *pMem){
 643   i64 ix;
 644   assert( pMem->flags & MEM_Real );
 645   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 646   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 647   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 648
 649   ix = doubleToInt64(pMem->u.r);
 650
 651   /* Only mark the value as an integer if
 652   **
 653   **    (1) the round-trip conversion real->int->real is a no-op, and
 654   **    (2) The integer is neither the largest nor the smallest
 655   **        possible integer (ticket #3922)
 656   **
 657   ** The second and third terms in the following conditional enforces
 658   ** the second condition under the assumption that addition overflow causes
 659   ** values to wrap around.
 660   */
 661   if( pMem->u.r==ix && ix>SMALLEST_INT64 && ix<LARGEST_INT64 ){
 662     pMem->u.i = ix;
 663     MemSetTypeFlag(pMem, MEM_Int);
 664   }
 665 }
 666
 667 /*
 668 ** Convert pMem to type integer.  Invalidate any prior representations.
 669 */
 670 int sqlite3VdbeMemIntegerify(Mem *pMem){
 671   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 672   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 673   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 674
 675   pMem->u.i = sqlite3VdbeIntValue(pMem);
 676   MemSetTypeFlag(pMem, MEM_Int);
 677   return SQLITE_OK;
 678 }
 679
 680 /*
 681 ** Convert pMem so that it is of type MEM_Real.
 682 ** Invalidate any prior representations.
 683 */
 684 int sqlite3VdbeMemRealify(Mem *pMem){
 685   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 686   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 687
 688   pMem->u.r = sqlite3VdbeRealValue(pMem);
 689   MemSetTypeFlag(pMem, MEM_Real);
 690   return SQLITE_OK;
 691 }
 692
 693 /* Compare a floating point value to an integer.  Return true if the two
 694 ** values are the same within the precision of the floating point value.
 695 **
 696 ** This function assumes that i was obtained by assignment from r1.
 697 **
 698 ** For some versions of GCC on 32-bit machines, if you do the more obvious
 699 ** comparison of "r1==(double)i" you sometimes get an answer of false even
 700 ** though the r1 and (double)i values are bit-for-bit the same.
 701 */
 702 int sqlite3RealSameAsInt(double r1, sqlite3_int64 i){
 703   double r2 = (double)i;
 704   return r1==0.0
 705       || (memcmp(&r1, &r2, sizeof(r1))==0
 706           && i >= -2251799813685248LL && i < 2251799813685248LL);
 707 }
 708
 709 /*
 710 ** Convert pMem so that it has type MEM_Real or MEM_Int.
 711 ** Invalidate any prior representations.
 712 **
 713 ** Every effort is made to force the conversion, even if the input
 714 ** is a string that does not look completely like a number.  Convert
 715 ** as much of the string as we can and ignore the rest.
 716 */
 717 int sqlite3VdbeMemNumerify(Mem *pMem){
 718   testcase( pMem->flags & MEM_Int );
 719   testcase( pMem->flags & MEM_Real );
 720   testcase( pMem->flags & MEM_IntReal );
 721   testcase( pMem->flags & MEM_Null );
 722   if( (pMem->flags & (MEM_Int|MEM_Real|MEM_IntReal|MEM_Null))==0 ){
 723     int rc;
 724     sqlite3_int64 ix;
 725     assert( (pMem->flags & (MEM_Blob|MEM_Str))!=0 );
 726     assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 727     rc = sqlite3AtoF(pMem->z, &pMem->u.r, pMem->n, pMem->enc);
 728     if( ((rc==0 || rc==1) && sqlite3Atoi64(pMem->z, &ix, pMem->n, pMem->enc)<=1)
 729      || sqlite3RealSameAsInt(pMem->u.r, (ix = (i64)pMem->u.r))
 730     ){
 731       pMem->u.i = ix;
 732       MemSetTypeFlag(pMem, MEM_Int);
 733     }else{
 734       MemSetTypeFlag(pMem, MEM_Real);
 735     }
 736   }
 737   assert( (pMem->flags & (MEM_Int|MEM_Real|MEM_IntReal|MEM_Null))!=0 );
 738   pMem->flags &= ~(MEM_Str|MEM_Blob|MEM_Zero);
 739   return SQLITE_OK;
 740 }
 741
 742 /*
 743 ** Cast the datatype of the value in pMem according to the affinity
 744 ** "aff".  Casting is different from applying affinity in that a cast
 745 ** is forced.  In other words, the value is converted into the desired
 746 ** affinity even if that results in loss of data.  This routine is
 747 ** used (for example) to implement the SQL "cast()" operator.
 748 */
 749 void sqlite3VdbeMemCast(Mem *pMem, u8 aff, u8 encoding){
 750   if( pMem->flags & MEM_Null ) return;
 751   switch( aff ){
 752     case SQLITE_AFF_BLOB: {   /* Really a cast to BLOB */
 753       if( (pMem->flags & MEM_Blob)==0 ){
 754         sqlite3ValueApplyAffinity(pMem, SQLITE_AFF_TEXT, encoding);
 755         assert( pMem->flags & MEM_Str || pMem->db->mallocFailed );
 756         if( pMem->flags & MEM_Str ) MemSetTypeFlag(pMem, MEM_Blob);
 757       }else{
 758         pMem->flags &= ~(MEM_TypeMask&~MEM_Blob);
 759       }
 760       break;
 761     }
 762     case SQLITE_AFF_NUMERIC: {
 763       sqlite3VdbeMemNumerify(pMem);
 764       break;
 765     }
 766     case SQLITE_AFF_INTEGER: {
 767       sqlite3VdbeMemIntegerify(pMem);
 768       break;
 769     }
 770     case SQLITE_AFF_REAL: {
 771       sqlite3VdbeMemRealify(pMem);
 772       break;
 773     }
 774     default: {
 775       assert( aff==SQLITE_AFF_TEXT );
 776       assert( MEM_Str==(MEM_Blob>>3) );
 777       pMem->flags |= (pMem->flags&MEM_Blob)>>3;
 778       sqlite3ValueApplyAffinity(pMem, SQLITE_AFF_TEXT, encoding);
 779       assert( pMem->flags & MEM_Str || pMem->db->mallocFailed );
 780       pMem->flags &= ~(MEM_Int|MEM_Real|MEM_IntReal|MEM_Blob|MEM_Zero);
 781       break;
 782     }
 783   }
 784 }
 785
 786 /*
 787 ** Initialize bulk memory to be a consistent Mem object.
 788 **
 789 ** The minimum amount of initialization feasible is performed.
 790 */
 791 void sqlite3VdbeMemInit(Mem *pMem, sqlite3 *db, u16 flags){
 792   assert( (flags & ~MEM_TypeMask)==0 );
 793   pMem->flags = flags;
 794   pMem->db = db;
 795   pMem->szMalloc = 0;
 796 }
 797
 798
 799 /*
 800 ** Delete any previous value and set the value stored in *pMem to NULL.
 801 **
 802 ** This routine calls the Mem.xDel destructor to dispose of values that
 803 ** require the destructor.  But it preserves the Mem.zMalloc memory allocation.
 804 ** To free all resources, use sqlite3VdbeMemRelease(), which both calls this
 805 ** routine to invoke the destructor and deallocates Mem.zMalloc.
 806 **
 807 ** Use this routine to reset the Mem prior to insert a new value.
 808 **
 809 ** Use sqlite3VdbeMemRelease() to complete erase the Mem prior to abandoning it.
 810 */
 811 void sqlite3VdbeMemSetNull(Mem *pMem){
 812   if( VdbeMemDynamic(pMem) ){
 813     vdbeMemClearExternAndSetNull(pMem);
 814   }else{
 815     pMem->flags = MEM_Null;
 816   }
 817 }
 818 void sqlite3ValueSetNull(sqlite3_value *p){
 819   sqlite3VdbeMemSetNull((Mem*)p);
 820 }
 821
 822 /*
 823 ** Delete any previous value and set the value to be a BLOB of length
 824 ** n containing all zeros.
 825 */
 826 void sqlite3VdbeMemSetZeroBlob(Mem *pMem, int n){
 827   sqlite3VdbeMemRelease(pMem);
 828   pMem->flags = MEM_Blob|MEM_Zero;
 829   pMem->n = 0;
 830   if( n<0 ) n = 0;
 831   pMem->u.nZero = n;
 832   pMem->enc = SQLITE_UTF8;
 833   pMem->z = 0;
 834 }
 835
 836 /*
 837 ** The pMem is known to contain content that needs to be destroyed prior
 838 ** to a value change.  So invoke the destructor, then set the value to
 839 ** a 64-bit integer.
 840 */
 841 static SQLITE_NOINLINE void vdbeReleaseAndSetInt64(Mem *pMem, i64 val){
 842   sqlite3VdbeMemSetNull(pMem);
 843   pMem->u.i = val;
 844   pMem->flags = MEM_Int;
 845 }
 846
 847 /*
 848 ** Delete any previous value and set the value stored in *pMem to val,
 849 ** manifest type INTEGER.
 850 */
 851 void sqlite3VdbeMemSetInt64(Mem *pMem, i64 val){
 852   if( VdbeMemDynamic(pMem) ){
 853     vdbeReleaseAndSetInt64(pMem, val);
 854   }else{
 855     pMem->u.i = val;
 856     pMem->flags = MEM_Int;
 857   }
 858 }
 859
 860 /* A no-op destructor */
 861 void sqlite3NoopDestructor(void *p){ UNUSED_PARAMETER(p); }
 862
 863 /*
 864 ** Set the value stored in *pMem should already be a NULL.
 865 ** Also store a pointer to go with it.
 866 */
 867 void sqlite3VdbeMemSetPointer(
 868   Mem *pMem,
 869   void *pPtr,
 870   const char *zPType,
 871   void (*xDestructor)(void*)
 872 ){
 873   assert( pMem->flags==MEM_Null );
 874   pMem->u.zPType = zPType ? zPType : "";
 875   pMem->z = pPtr;
 876   pMem->flags = MEM_Null|MEM_Dyn|MEM_Subtype|MEM_Term;
 877   pMem->eSubtype = 'p';
 878   pMem->xDel = xDestructor ? xDestructor : sqlite3NoopDestructor;
 879 }
 880
 881 #ifndef SQLITE_OMIT_FLOATING_POINT
 882 /*
 883 ** Delete any previous value and set the value stored in *pMem to val,
 884 ** manifest type REAL.
 885 */
 886 void sqlite3VdbeMemSetDouble(Mem *pMem, double val){
 887   sqlite3VdbeMemSetNull(pMem);
 888   if( !sqlite3IsNaN(val) ){
 889     pMem->u.r = val;
 890     pMem->flags = MEM_Real;
 891   }
 892 }
 893 #endif
 894
 895 #ifdef SQLITE_DEBUG
 896 /*
 897 ** Return true if the Mem holds a RowSet object.  This routine is intended
 898 ** for use inside of assert() statements.
 899 */
 900 int sqlite3VdbeMemIsRowSet(const Mem *pMem){
 901   return (pMem->flags&(MEM_Blob|MEM_Dyn))==(MEM_Blob|MEM_Dyn)
 902          && pMem->xDel==sqlite3RowSetDelete;
 903 }
 904 #endif
 905
 906 /*
 907 ** Delete any previous value and set the value of pMem to be an
 908 ** empty boolean index.
 909 **
 910 ** Return SQLITE_OK on success and SQLITE_NOMEM if a memory allocation
 911 ** error occurs.
 912 */
 913 int sqlite3VdbeMemSetRowSet(Mem *pMem){
 914   sqlite3 *db = pMem->db;
 915   RowSet *p;
 916   assert( db!=0 );
 917   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 918   sqlite3VdbeMemRelease(pMem);
 919   p = sqlite3RowSetInit(db);
 920   if( p==0 ) return SQLITE_NOMEM;
 921   pMem->z = (char*)p;
 922   pMem->flags = MEM_Blob|MEM_Dyn;
 923   pMem->xDel = sqlite3RowSetDelete;
 924   return SQLITE_OK;
 925 }
 926
 927 /*
 928 ** Return true if the Mem object contains a TEXT or BLOB that is
 929 ** too large - whose size exceeds SQLITE_MAX_LENGTH.
 930 */
 931 int sqlite3VdbeMemTooBig(Mem *p){
 932   assert( p->db!=0 );
 933   if( p->flags & (MEM_Str|MEM_Blob) ){
 934     int n = p->n;
 935     if( p->flags & MEM_Zero ){
 936       n += p->u.nZero;
 937     }
 938     return n>p->db->aLimit[SQLITE_LIMIT_LENGTH];
 939   }
 940   return 0;
 941 }
 942
 943 #ifdef SQLITE_DEBUG
 944 /*
 945 ** This routine prepares a memory cell for modification by breaking
 946 ** its link to a shallow copy and by marking any current shallow
 947 ** copies of this cell as invalid.
 948 **
 949 ** This is used for testing and debugging only - to make sure shallow
 950 ** copies are not misused.
 951 */
 952 void sqlite3VdbeMemAboutToChange(Vdbe *pVdbe, Mem *pMem){
 953   int i;
 954   Mem *pX;
 955   for(i=0, pX=pVdbe->aMem; i<pVdbe->nMem; i++, pX++){
 956     if( pX->pScopyFrom==pMem ){
 957       /* If pX is marked as a shallow copy of pMem, then verify that
 958       ** no significant changes have been made to pX since the OP_SCopy.
 959       ** A significant change would indicated a missed call to this
 960       ** function for pX.  Minor changes, such as adding or removing a
 961       ** dual type, are allowed, as long as the underlying value is the
 962       ** same. */
 963       u16 mFlags = pMem->flags & pX->flags & pX->mScopyFlags;
 964       assert( (mFlags&(MEM_Int|MEM_IntReal))==0 || pMem->u.i==pX->u.i );
 965       assert( (mFlags&MEM_Real)==0 || pMem->u.r==pX->u.r );
 966       assert( (mFlags&MEM_Str)==0  || (pMem->n==pX->n && pMem->z==pX->z) );
 967       assert( (mFlags&MEM_Blob)==0  || sqlite3BlobCompare(pMem,pX)==0 );
 968
 969       /* pMem is the register that is changing.  But also mark pX as
 970       ** undefined so that we can quickly detect the shallow-copy error */
 971       pX->flags = MEM_Undefined;
 972       pX->pScopyFrom = 0;
 973     }
 974   }
 975   pMem->pScopyFrom = 0;
 976 }
 977 #endif /* SQLITE_DEBUG */
 978
 979
 980 /*
 981 ** Make an shallow copy of pFrom into pTo.  Prior contents of
 982 ** pTo are freed.  The pFrom->z field is not duplicated.  If
 983 ** pFrom->z is used, then pTo->z points to the same thing as pFrom->z
 984 ** and flags gets srcType (either MEM_Ephem or MEM_Static).
 985 */
 986 static SQLITE_NOINLINE void vdbeClrCopy(Mem *pTo, const Mem *pFrom, int eType){
 987   vdbeMemClearExternAndSetNull(pTo);
 988   assert( !VdbeMemDynamic(pTo) );
 989   sqlite3VdbeMemShallowCopy(pTo, pFrom, eType);
 990 }
 991 void sqlite3VdbeMemShallowCopy(Mem *pTo, const Mem *pFrom, int srcType){
 992   assert( !sqlite3VdbeMemIsRowSet(pFrom) );
 993   assert( pTo->db==pFrom->db );
 994   if( VdbeMemDynamic(pTo) ){ vdbeClrCopy(pTo,pFrom,srcType); return; }
 995   memcpy(pTo, pFrom, MEMCELLSIZE);
 996   if( (pFrom->flags&MEM_Static)==0 ){
 997     pTo->flags &= ~(MEM_Dyn|MEM_Static|MEM_Ephem);
 998     assert( srcType==MEM_Ephem || srcType==MEM_Static );
 999     pTo->flags |= srcType;
1000   }
1001 }
1002
1003 /*
1004 ** Make a full copy of pFrom into pTo.  Prior contents of pTo are
1005 ** freed before the copy is made.
1006 */
1007 int sqlite3VdbeMemCopy(Mem *pTo, const Mem *pFrom){
1008   int rc = SQLITE_OK;
1009
1010   assert( !sqlite3VdbeMemIsRowSet(pFrom) );
1011   if( VdbeMemDynamic(pTo) ) vdbeMemClearExternAndSetNull(pTo);
1012   memcpy(pTo, pFrom, MEMCELLSIZE);
1013   pTo->flags &= ~MEM_Dyn;
1014   if( pTo->flags&(MEM_Str|MEM_Blob) ){
1015     if( 0==(pFrom->flags&MEM_Static) ){
1016       pTo->flags |= MEM_Ephem;
1017       rc = sqlite3VdbeMemMakeWriteable(pTo);
1018     }
1019   }
1020
1021   return rc;
1022 }
1023
1024 /*
1025 ** Transfer the contents of pFrom to pTo. Any existing value in pTo is
1026 ** freed. If pFrom contains ephemeral data, a copy is made.
1027 **
1028 ** pFrom contains an SQL NULL when this routine returns.
1029 */
1030 void sqlite3VdbeMemMove(Mem *pTo, Mem *pFrom){
1031   assert( pFrom->db==0 || sqlite3_mutex_held(pFrom->db->mutex) );
1032   assert( pTo->db==0 || sqlite3_mutex_held(pTo->db->mutex) );
1033   assert( pFrom->db==0 || pTo->db==0 || pFrom->db==pTo->db );
1034
1035   sqlite3VdbeMemRelease(pTo);
1036   memcpy(pTo, pFrom, sizeof(Mem));
1037   pFrom->flags = MEM_Null;
1038   pFrom->szMalloc = 0;
1039 }
1040
1041 /*
1042 ** Change the value of a Mem to be a string or a BLOB.
1043 **
1044 ** The memory management strategy depends on the value of the xDel
1045 ** parameter. If the value passed is SQLITE_TRANSIENT, then the
1046 ** string is copied into a (possibly existing) buffer managed by the
1047 ** Mem structure. Otherwise, any existing buffer is freed and the
1048 ** pointer copied.
1049 **
1050 ** If the string is too large (if it exceeds the SQLITE_LIMIT_LENGTH
1051 ** size limit) then no memory allocation occurs.  If the string can be
1052 ** stored without allocating memory, then it is.  If a memory allocation
1053 ** is required to store the string, then value of pMem is unchanged.  In
1054 ** either case, SQLITE_TOOBIG is returned.
1055 */
1056 int sqlite3VdbeMemSetStr(
1057   Mem *pMem,          /* Memory cell to set to string value */
1058   const char *z,      /* String pointer */
1059   int n,              /* Bytes in string, or negative */
1060   u8 enc,             /* Encoding of z.  0 for BLOBs */
1061   void (*xDel)(void*) /* Destructor function */
1062 ){
1063   int nByte = n;      /* New value for pMem->n */
1064   int iLimit;         /* Maximum allowed string or blob size */
1065   u16 flags = 0;      /* New value for pMem->flags */
1066
1067   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
1068   assert( !sqlite3VdbeMemIsRowSet(pMem) );
1069
1070   /* If z is a NULL pointer, set pMem to contain an SQL NULL. */
1071   if( !z ){
1072     sqlite3VdbeMemSetNull(pMem);
1073     return SQLITE_OK;
1074   }
1075
1076   if( pMem->db ){
1077     iLimit = pMem->db->aLimit[SQLITE_LIMIT_LENGTH];
1078   }else{
1079     iLimit = SQLITE_MAX_LENGTH;
1080   }
1081   flags = (enc==0?MEM_Blob:MEM_Str);
1082   if( nByte<0 ){
1083     assert( enc!=0 );
1084     if( enc==SQLITE_UTF8 ){
1085       nByte = 0x7fffffff & (int)strlen(z);
1086     }else{
1087       for(nByte=0; nByte<=iLimit && (z[nByte] | z[nByte+1]); nByte+=2){}
1088     }
1089     flags |= MEM_Term;
1090   }
1091
1092   /* The following block sets the new values of Mem.z and Mem.xDel. It
1093   ** also sets a flag in local variable "flags" to indicate the memory
1094   ** management (one of MEM_Dyn or MEM_Static).
1095   */
1096   if( xDel==SQLITE_TRANSIENT ){
1097     u32 nAlloc = nByte;
1098     if( flags&MEM_Term ){
1099       nAlloc += (enc==SQLITE_UTF8?1:2);
1100     }
1101     if( nByte>iLimit ){
1102       return sqlite3ErrorToParser(pMem->db, SQLITE_TOOBIG);
1103     }
1104     testcase( nAlloc==0 );
1105     testcase( nAlloc==31 );
1106     testcase( nAlloc==32 );
1107     if( sqlite3VdbeMemClearAndResize(pMem, (int)MAX(nAlloc,32)) ){
1108       return SQLITE_NOMEM_BKPT;
1109     }
1110     memcpy(pMem->z, z, nAlloc);
1111   }else{
1112     sqlite3VdbeMemRelease(pMem);
1113     pMem->z = (char *)z;
1114     if( xDel==SQLITE_DYNAMIC ){
1115       pMem->zMalloc = pMem->z;
1116       pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
1117     }else{
1118       pMem->xDel = xDel;
1119       flags |= ((xDel==SQLITE_STATIC)?MEM_Static:MEM_Dyn);
1120     }
1121   }
1122
1123   pMem->n = nByte;
1124   pMem->flags = flags;
1125   pMem->enc = (enc==0 ? SQLITE_UTF8 : enc);
1126
1127 #ifndef SQLITE_OMIT_UTF16
1128   if( pMem->enc!=SQLITE_UTF8 && sqlite3VdbeMemHandleBom(pMem) ){
1129     return SQLITE_NOMEM_BKPT;
1130   }
1131 #endif
1132
1133   if( nByte>iLimit ){
1134     return SQLITE_TOOBIG;
1135   }
1136
1137   return SQLITE_OK;
1138 }
1139
1140 /*
1141 ** Move data out of a btree key or data field and into a Mem structure.
1142 ** The data is payload from the entry that pCur is currently pointing
1143 ** to.  offset and amt determine what portion of the data or key to retrieve.
1144 ** The result is written into the pMem element.
1145 **
1146 ** The pMem object must have been initialized.  This routine will use
1147 ** pMem->zMalloc to hold the content from the btree, if possible.  New
1148 ** pMem->zMalloc space will be allocated if necessary.  The calling routine
1149 ** is responsible for making sure that the pMem object is eventually
1150 ** destroyed.
1151 **
1152 ** If this routine fails for any reason (malloc returns NULL or unable
1153 ** to read from the disk) then the pMem is left in an inconsistent state.
1154 */
1155 static SQLITE_NOINLINE int vdbeMemFromBtreeResize(
1156   BtCursor *pCur,   /* Cursor pointing at record to retrieve. */
1157   u32 offset,       /* Offset from the start of data to return bytes from. */
1158   u32 amt,          /* Number of bytes to return. */
1159   Mem *pMem         /* OUT: Return data in this Mem structure. */
1160 ){
1161   int rc;
1162   pMem->flags = MEM_Null;
1163   if( sqlite3BtreeMaxRecordSize(pCur)<offset+amt ){
1164     return SQLITE_CORRUPT_BKPT;
1165   }
1166   if( SQLITE_OK==(rc = sqlite3VdbeMemClearAndResize(pMem, amt+1)) ){
1167     rc = sqlite3BtreePayload(pCur, offset, amt, pMem->z);
1168     if( rc==SQLITE_OK ){
1169       pMem->z[amt] = 0;   /* Overrun area used when reading malformed records */
1170       pMem->flags = MEM_Blob;
1171       pMem->n = (int)amt;
1172     }else{
1173       sqlite3VdbeMemRelease(pMem);
1174     }
1175   }
1176   return rc;
1177 }
1178 int sqlite3VdbeMemFromBtree(
1179   BtCursor *pCur,   /* Cursor pointing at record to retrieve. */
1180   u32 offset,       /* Offset from the start of data to return bytes from. */
1181   u32 amt,          /* Number of bytes to return. */
1182   Mem *pMem         /* OUT: Return data in this Mem structure. */
1183 ){
1184   char *zData;        /* Data from the btree layer */
1185   u32 available = 0;  /* Number of bytes available on the local btree page */
1186   int rc = SQLITE_OK; /* Return code */
1187
1188   assert( sqlite3BtreeCursorIsValid(pCur) );
1189   assert( !VdbeMemDynamic(pMem) );
1190
1191   /* Note: the calls to BtreeKeyFetch() and DataFetch() below assert()
1192   ** that both the BtShared and database handle mutexes are held. */
1193   assert( !sqlite3VdbeMemIsRowSet(pMem) );
1194   zData = (char *)sqlite3BtreePayloadFetch(pCur, &available);
1195   assert( zData!=0 );
1196
1197   if( offset+amt<=available ){
1198     pMem->z = &zData[offset];
1199     pMem->flags = MEM_Blob|MEM_Ephem;
1200     pMem->n = (int)amt;
1201   }else{
1202     rc = vdbeMemFromBtreeResize(pCur, offset, amt, pMem);
1203   }
1204
1205   return rc;
1206 }
1207
1208 /*
1209 ** The pVal argument is known to be a value other than NULL.
1210 ** Convert it into a string with encoding enc and return a pointer
1211 ** to a zero-terminated version of that string.
1212 */
1213 static SQLITE_NOINLINE const void *valueToText(sqlite3_value* pVal, u8 enc){
1214   assert( pVal!=0 );
1215   assert( pVal->db==0 || sqlite3_mutex_held(pVal->db->mutex) );
1216   assert( (enc&3)==(enc&~SQLITE_UTF16_ALIGNED) );
1217   assert( !sqlite3VdbeMemIsRowSet(pVal) );
1218   assert( (pVal->flags & (MEM_Null))==0 );
1219   if( pVal->flags & (MEM_Blob|MEM_Str) ){
1220     if( ExpandBlob(pVal) ) return 0;
1221     pVal->flags |= MEM_Str;
1222     if( pVal->enc != (enc & ~SQLITE_UTF16_ALIGNED) ){
1223       sqlite3VdbeChangeEncoding(pVal, enc & ~SQLITE_UTF16_ALIGNED);
1224     }
1225     if( (enc & SQLITE_UTF16_ALIGNED)!=0 && 1==(1&SQLITE_PTR_TO_INT(pVal->z)) ){
1226       assert( (pVal->flags & (MEM_Ephem|MEM_Static))!=0 );
1227       if( sqlite3VdbeMemMakeWriteable(pVal)!=SQLITE_OK ){
1228         return 0;
1229       }
1230     }
1231     sqlite3VdbeMemNulTerminate(pVal); /* IMP: R-31275-44060 */
1232   }else{
1233     sqlite3VdbeMemStringify(pVal, enc, 0);
1234     assert( 0==(1&SQLITE_PTR_TO_INT(pVal->z)) );
1235   }
1236   assert(pVal->enc==(enc & ~SQLITE_UTF16_ALIGNED) || pVal->db==0
1237               || pVal->db->mallocFailed );
1238   if( pVal->enc==(enc & ~SQLITE_UTF16_ALIGNED) ){
1239     assert( sqlite3VdbeMemValidStrRep(pVal) );
1240     return pVal->z;
1241   }else{
1242     return 0;
1243   }
1244 }
1245
1246 /* This function is only available internally, it is not part of the
1247 ** external API. It works in a similar way to sqlite3_value_text(),
1248 ** except the data returned is in the encoding specified by the second
1249 ** parameter, which must be one of SQLITE_UTF16BE, SQLITE_UTF16LE or
1250 ** SQLITE_UTF8.
1251 **
1252 ** (2006-02-16:)  The enc value can be or-ed with SQLITE_UTF16_ALIGNED.
1253 ** If that is the case, then the result must be aligned on an even byte
1254 ** boundary.
1255 */
1256 const void *sqlite3ValueText(sqlite3_value* pVal, u8 enc){
1257   if( !pVal ) return 0;
1258   assert( pVal->db==0 || sqlite3_mutex_held(pVal->db->mutex) );
1259   assert( (enc&3)==(enc&~SQLITE_UTF16_ALIGNED) );
1260   assert( !sqlite3VdbeMemIsRowSet(pVal) );
1261   if( (pVal->flags&(MEM_Str|MEM_Term))==(MEM_Str|MEM_Term) && pVal->enc==enc ){
1262     assert( sqlite3VdbeMemValidStrRep(pVal) );
1263     return pVal->z;
1264   }
1265   if( pVal->flags&MEM_Null ){
1266     return 0;
1267   }
1268   return valueToText(pVal, enc);
1269 }
1270
1271 /*
1272 ** Create a new sqlite3_value object.
1273 */
1274 sqlite3_value *sqlite3ValueNew(sqlite3 *db){
1275   Mem *p = sqlite3DbMallocZero(db, sizeof(*p));
1276   if( p ){
1277     p->flags = MEM_Null;
1278     p->db = db;
1279   }
1280   return p;
1281 }
1282
1283 /*
1284 ** Context object passed by sqlite3Stat4ProbeSetValue() through to
1285 ** valueNew(). See comments above valueNew() for details.
1286 */
1287 struct ValueNewStat4Ctx {
1288   Parse *pParse;
1289   Index *pIdx;
1290   UnpackedRecord **ppRec;
1291   int iVal;
1292 };
1293
1294 /*
1295 ** Allocate and return a pointer to a new sqlite3_value object. If
1296 ** the second argument to this function is NULL, the object is allocated
1297 ** by calling sqlite3ValueNew().
1298 **
1299 ** Otherwise, if the second argument is non-zero, then this function is
1300 ** being called indirectly by sqlite3Stat4ProbeSetValue(). If it has not
1301 ** already been allocated, allocate the UnpackedRecord structure that
1302 ** that function will return to its caller here. Then return a pointer to
1303 ** an sqlite3_value within the UnpackedRecord.a[] array.
1304 */
1305 static sqlite3_value *valueNew(sqlite3 *db, struct ValueNewStat4Ctx *p){
1306 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1307   if( p ){
1308     UnpackedRecord *pRec = p->ppRec[0];
1309
1310     if( pRec==0 ){
1311       Index *pIdx = p->pIdx;      /* Index being probed */
1312       int nByte;                  /* Bytes of space to allocate */
1313       int i;                      /* Counter variable */
1314       int nCol = pIdx->nColumn;   /* Number of index columns including rowid */
1315
1316       nByte = sizeof(Mem) * nCol + ROUND8(sizeof(UnpackedRecord));
1317       pRec = (UnpackedRecord*)sqlite3DbMallocZero(db, nByte);
1318       if( pRec ){
1319         pRec->pKeyInfo = sqlite3KeyInfoOfIndex(p->pParse, pIdx);
1320         if( pRec->pKeyInfo ){
1321           assert( pRec->pKeyInfo->nAllField==nCol );
1322           assert( pRec->pKeyInfo->enc==ENC(db) );
1323           pRec->aMem = (Mem *)((u8*)pRec + ROUND8(sizeof(UnpackedRecord)));
1324           for(i=0; i<nCol; i++){
1325             pRec->aMem[i].flags = MEM_Null;
1326             pRec->aMem[i].db = db;
1327           }
1328         }else{
1329           sqlite3DbFreeNN(db, pRec);
1330           pRec = 0;
1331         }
1332       }
1333       if( pRec==0 ) return 0;
1334       p->ppRec[0] = pRec;
1335     }
1336
1337     pRec->nField = p->iVal+1;
1338     return &pRec->aMem[p->iVal];
1339   }
1340 #else
1341   UNUSED_PARAMETER(p);
1342 #endif /* defined(SQLITE_ENABLE_STAT3_OR_STAT4) */
1343   return sqlite3ValueNew(db);
1344 }
1345
1346 /*
1347 ** The expression object indicated by the second argument is guaranteed
1348 ** to be a scalar SQL function. If
1349 **
1350 **   * all function arguments are SQL literals,
1351 **   * one of the SQLITE_FUNC_CONSTANT or _SLOCHNG function flags is set, and
1352 **   * the SQLITE_FUNC_NEEDCOLL function flag is not set,
1353 **
1354 ** then this routine attempts to invoke the SQL function. Assuming no
1355 ** error occurs, output parameter (*ppVal) is set to point to a value
1356 ** object containing the result before returning SQLITE_OK.
1357 **
1358 ** Affinity aff is applied to the result of the function before returning.
1359 ** If the result is a text value, the sqlite3_value object uses encoding
1360 ** enc.
1361 **
1362 ** If the conditions above are not met, this function returns SQLITE_OK
1363 ** and sets (*ppVal) to NULL. Or, if an error occurs, (*ppVal) is set to
1364 ** NULL and an SQLite error code returned.
1365 */
1366 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1367 static int valueFromFunction(
1368   sqlite3 *db,                    /* The database connection */
1369   Expr *p,                        /* The expression to evaluate */
1370   u8 enc,                         /* Encoding to use */
1371   u8 aff,                         /* Affinity to use */
1372   sqlite3_value **ppVal,          /* Write the new value here */
1373   struct ValueNewStat4Ctx *pCtx   /* Second argument for valueNew() */
1374 ){
1375   sqlite3_context ctx;            /* Context object for function invocation */
1376   sqlite3_value **apVal = 0;      /* Function arguments */
1377   int nVal = 0;                   /* Size of apVal[] array */
1378   FuncDef *pFunc = 0;             /* Function definition */
1379   sqlite3_value *pVal = 0;        /* New value */
1380   int rc = SQLITE_OK;             /* Return code */
1381   ExprList *pList = 0;            /* Function arguments */
1382   int i;                          /* Iterator variable */
1383
1384   assert( pCtx!=0 );
1385   assert( (p->flags & EP_TokenOnly)==0 );
1386   pList = p->x.pList;
1387   if( pList ) nVal = pList->nExpr;
1388   pFunc = sqlite3FindFunction(db, p->u.zToken, nVal, enc, 0);
1389   assert( pFunc );
1390   if( (pFunc->funcFlags & (SQLITE_FUNC_CONSTANT|SQLITE_FUNC_SLOCHNG))==0
1391    || (pFunc->funcFlags & SQLITE_FUNC_NEEDCOLL)
1392   ){
1393     return SQLITE_OK;
1394   }
1395
1396   if( pList ){
1397     apVal = (sqlite3_value**)sqlite3DbMallocZero(db, sizeof(apVal[0]) * nVal);
1398     if( apVal==0 ){
1399       rc = SQLITE_NOMEM_BKPT;
1400       goto value_from_function_out;
1401     }
1402     for(i=0; i<nVal; i++){
1403       rc = sqlite3ValueFromExpr(db, pList->a[i].pExpr, enc, aff, &apVal[i]);
1404       if( apVal[i]==0 || rc!=SQLITE_OK ) goto value_from_function_out;
1405     }
1406   }
1407
1408   pVal = valueNew(db, pCtx);
1409   if( pVal==0 ){
1410     rc = SQLITE_NOMEM_BKPT;
1411     goto value_from_function_out;
1412   }
1413
1414   assert( pCtx->pParse->rc==SQLITE_OK );
1415   memset(&ctx, 0, sizeof(ctx));
1416   ctx.pOut = pVal;
1417   ctx.pFunc = pFunc;
1418   pFunc->xSFunc(&ctx, nVal, apVal);
1419   if( ctx.isError ){
1420     rc = ctx.isError;
1421     sqlite3ErrorMsg(pCtx->pParse, "%s", sqlite3_value_text(pVal));
1422   }else{
1423     sqlite3ValueApplyAffinity(pVal, aff, SQLITE_UTF8);
1424     assert( rc==SQLITE_OK );
1425     rc = sqlite3VdbeChangeEncoding(pVal, enc);
1426     if( rc==SQLITE_OK && sqlite3VdbeMemTooBig(pVal) ){
1427       rc = SQLITE_TOOBIG;
1428       pCtx->pParse->nErr++;
1429     }
1430   }
1431   pCtx->pParse->rc = rc;
1432
1433  value_from_function_out:
1434   if( rc!=SQLITE_OK ){
1435     pVal = 0;
1436   }
1437   if( apVal ){
1438     for(i=0; i<nVal; i++){
1439       sqlite3ValueFree(apVal[i]);
1440     }
1441     sqlite3DbFreeNN(db, apVal);
1442   }
1443
1444   *ppVal = pVal;
1445   return rc;
1446 }
1447 #else
1448 # define valueFromFunction(a,b,c,d,e,f) SQLITE_OK
1449 #endif /* defined(SQLITE_ENABLE_STAT3_OR_STAT4) */
1450
1451 /*
1452 ** Extract a value from the supplied expression in the manner described
1453 ** above sqlite3ValueFromExpr(). Allocate the sqlite3_value object
1454 ** using valueNew().
1455 **
1456 ** If pCtx is NULL and an error occurs after the sqlite3_value object
1457 ** has been allocated, it is freed before returning. Or, if pCtx is not
1458 ** NULL, it is assumed that the caller will free any allocated object
1459 ** in all cases.
1460 */
1461 static int valueFromExpr(
1462   sqlite3 *db,                    /* The database connection */
1463   Expr *pExpr,                    /* The expression to evaluate */
1464   u8 enc,                         /* Encoding to use */
1465   u8 affinity,                    /* Affinity to use */
1466   sqlite3_value **ppVal,          /* Write the new value here */
1467   struct ValueNewStat4Ctx *pCtx   /* Second argument for valueNew() */
1468 ){
1469   int op;
1470   char *zVal = 0;
1471   sqlite3_value *pVal = 0;
1472   int negInt = 1;
1473   const char *zNeg = "";
1474   int rc = SQLITE_OK;
1475
1476   assert( pExpr!=0 );
1477   while( (op = pExpr->op)==TK_UPLUS || op==TK_SPAN ) pExpr = pExpr->pLeft;
1478 #if defined(SQLITE_ENABLE_STAT3_OR_STAT4)
1479   if( op==TK_REGISTER ) op = pExpr->op2;
1480 #else
1481   if( NEVER(op==TK_REGISTER) ) op = pExpr->op2;
1482 #endif
1483
1484   /* Compressed expressions only appear when parsing the DEFAULT clause
1485   ** on a table column definition, and hence only when pCtx==0.  This
1486   ** check ensures that an EP_TokenOnly expression is never passed down
1487   ** into valueFromFunction(). */
1488   assert( (pExpr->flags & EP_TokenOnly)==0 || pCtx==0 );
1489
1490   if( op==TK_CAST ){
1491     u8 aff = sqlite3AffinityType(pExpr->u.zToken,0);
1492     rc = valueFromExpr(db, pExpr->pLeft, enc, aff, ppVal, pCtx);
1493     testcase( rc!=SQLITE_OK );
1494     if( *ppVal ){
1495       sqlite3VdbeMemCast(*ppVal, aff, SQLITE_UTF8);
1496       sqlite3ValueApplyAffinity(*ppVal, affinity, SQLITE_UTF8);
1497     }
1498     return rc;
1499   }
1500
1501   /* Handle negative integers in a single step.  This is needed in the
1502   ** case when the value is -9223372036854775808.
1503   */
1504   if( op==TK_UMINUS
1505    && (pExpr->pLeft->op==TK_INTEGER || pExpr->pLeft->op==TK_FLOAT) ){
1506     pExpr = pExpr->pLeft;
1507     op = pExpr->op;
1508     negInt = -1;
1509     zNeg = "-";
1510   }
1511
1512   if( op==TK_STRING || op==TK_FLOAT || op==TK_INTEGER ){
1513     pVal = valueNew(db, pCtx);
1514     if( pVal==0 ) goto no_mem;
1515     if( ExprHasProperty(pExpr, EP_IntValue) ){
1516       sqlite3VdbeMemSetInt64(pVal, (i64)pExpr->u.iValue*negInt);
1517     }else{
1518       zVal = sqlite3MPrintf(db, "%s%s", zNeg, pExpr->u.zToken);
1519       if( zVal==0 ) goto no_mem;
1520       sqlite3ValueSetStr(pVal, -1, zVal, SQLITE_UTF8, SQLITE_DYNAMIC);
1521     }
1522     if( (op==TK_INTEGER || op==TK_FLOAT ) && affinity==SQLITE_AFF_BLOB ){
1523       sqlite3ValueApplyAffinity(pVal, SQLITE_AFF_NUMERIC, SQLITE_UTF8);
1524     }else{
1525       sqlite3ValueApplyAffinity(pVal, affinity, SQLITE_UTF8);
1526     }
1527     assert( (pVal->flags & MEM_IntReal)==0 );
1528     if( pVal->flags & (MEM_Int|MEM_IntReal|MEM_Real) ){
1529       testcase( pVal->flags & MEM_Int );
1530       testcase( pVal->flags & MEM_Real );
1531       pVal->flags &= ~MEM_Str;
1532     }
1533     if( enc!=SQLITE_UTF8 ){
1534       rc = sqlite3VdbeChangeEncoding(pVal, enc);
1535     }
1536   }else if( op==TK_UMINUS ) {
1537     /* This branch happens for multiple negative signs.  Ex: -(-5) */
1538     if( SQLITE_OK==valueFromExpr(db,pExpr->pLeft,enc,affinity,&pVal,pCtx)
1539      && pVal!=0
1540     ){
1541       sqlite3VdbeMemNumerify(pVal);
1542       if( pVal->flags & MEM_Real ){
1543         pVal->u.r = -pVal->u.r;
1544       }else if( pVal->u.i==SMALLEST_INT64 ){
1545         pVal->u.r = -(double)SMALLEST_INT64;
1546         MemSetTypeFlag(pVal, MEM_Real);
1547       }else{
1548         pVal->u.i = -pVal->u.i;
1549       }
1550       sqlite3ValueApplyAffinity(pVal, affinity, enc);
1551     }
1552   }else if( op==TK_NULL ){
1553     pVal = valueNew(db, pCtx);
1554     if( pVal==0 ) goto no_mem;
1555     sqlite3VdbeMemSetNull(pVal);
1556   }
1557 #ifndef SQLITE_OMIT_BLOB_LITERAL
1558   else if( op==TK_BLOB ){
1559     int nVal;
1560     assert( pExpr->u.zToken[0]=='x' || pExpr->u.zToken[0]=='X' );
1561     assert( pExpr->u.zToken[1]=='\'' );
1562     pVal = valueNew(db, pCtx);
1563     if( !pVal ) goto no_mem;
1564     zVal = &pExpr->u.zToken[2];
1565     nVal = sqlite3Strlen30(zVal)-1;
1566     assert( zVal[nVal]=='\'' );
1567     sqlite3VdbeMemSetStr(pVal, sqlite3HexToBlob(db, zVal, nVal), nVal/2,
1568                          0, SQLITE_DYNAMIC);
1569   }
1570 #endif
1571 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1572   else if( op==TK_FUNCTION && pCtx!=0 ){
1573     rc = valueFromFunction(db, pExpr, enc, affinity, &pVal, pCtx);
1574   }
1575 #endif
1576   else if( op==TK_TRUEFALSE ){
1577     pVal = valueNew(db, pCtx);
1578     if( pVal ){
1579       pVal->flags = MEM_Int;
1580       pVal->u.i = pExpr->u.zToken[4]==0;
1581     }
1582   }
1583
1584   *ppVal = pVal;
1585   return rc;
1586
1587 no_mem:
1588 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1589   if( pCtx==0 || pCtx->pParse->nErr==0 )
1590 #endif
1591     sqlite3OomFault(db);
1592   sqlite3DbFree(db, zVal);
1593   assert( *ppVal==0 );
1594 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1595   if( pCtx==0 ) sqlite3ValueFree(pVal);
1596 #else
1597   assert( pCtx==0 ); sqlite3ValueFree(pVal);
1598 #endif
1599   return SQLITE_NOMEM_BKPT;
1600 }
1601
1602 /*
1603 ** Create a new sqlite3_value object, containing the value of pExpr.
1604 **
1605 ** This only works for very simple expressions that consist of one constant
1606 ** token (i.e. "5", "5.1", "'a string'"). If the expression can
1607 ** be converted directly into a value, then the value is allocated and
1608 ** a pointer written to *ppVal. The caller is responsible for deallocating
1609 ** the value by passing it to sqlite3ValueFree() later on. If the expression
1610 ** cannot be converted to a value, then *ppVal is set to NULL.
1611 */
1612 int sqlite3ValueFromExpr(
1613   sqlite3 *db,              /* The database connection */
1614   Expr *pExpr,              /* The expression to evaluate */
1615   u8 enc,                   /* Encoding to use */
1616   u8 affinity,              /* Affinity to use */
1617   sqlite3_value **ppVal     /* Write the new value here */
1618 ){
1619   return pExpr ? valueFromExpr(db, pExpr, enc, affinity, ppVal, 0) : 0;
1620 }
1621
1622 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1623 /*
1624 ** The implementation of the sqlite_record() function. This function accepts
1625 ** a single argument of any type. The return value is a formatted database
1626 ** record (a blob) containing the argument value.
1627 **
1628 ** This is used to convert the value stored in the 'sample' column of the
1629 ** sqlite_stat3 table to the record format SQLite uses internally.
1630 */
1631 static void recordFunc(
1632   sqlite3_context *context,
1633   int argc,
1634   sqlite3_value **argv
1635 ){
1636   const int file_format = 1;
1637   u32 iSerial;                    /* Serial type */
1638   int nSerial;                    /* Bytes of space for iSerial as varint */
1639   u32 nVal;                       /* Bytes of space required for argv[0] */
1640   int nRet;
1641   sqlite3 *db;
1642   u8 *aRet;
1643
1644   UNUSED_PARAMETER( argc );
1645   iSerial = sqlite3VdbeSerialType(argv[0], file_format, &nVal);
1646   nSerial = sqlite3VarintLen(iSerial);
1647   db = sqlite3_context_db_handle(context);
1648
1649   nRet = 1 + nSerial + nVal;
1650   aRet = sqlite3DbMallocRawNN(db, nRet);
1651   if( aRet==0 ){
1652     sqlite3_result_error_nomem(context);
1653   }else{
1654     aRet[0] = nSerial+1;
1655     putVarint32(&aRet[1], iSerial);
1656     sqlite3VdbeSerialPut(&aRet[1+nSerial], argv[0], iSerial);
1657     sqlite3_result_blob(context, aRet, nRet, SQLITE_TRANSIENT);
1658     sqlite3DbFreeNN(db, aRet);
1659   }
1660 }
1661
1662 /*
1663 ** Register built-in functions used to help read ANALYZE data.
1664 */
1665 void sqlite3AnalyzeFunctions(void){
1666   static FuncDef aAnalyzeTableFuncs[] = {
1667     FUNCTION(sqlite_record,   1, 0, 0, recordFunc),
1668   };
1669   sqlite3InsertBuiltinFuncs(aAnalyzeTableFuncs, ArraySize(aAnalyzeTableFuncs));
1670 }
1671
1672 /*
1673 ** Attempt to extract a value from pExpr and use it to construct *ppVal.
1674 **
1675 ** If pAlloc is not NULL, then an UnpackedRecord object is created for
1676 ** pAlloc if one does not exist and the new value is added to the
1677 ** UnpackedRecord object.
1678 **
1679 ** A value is extracted in the following cases:
1680 **
1681 **  * (pExpr==0). In this case the value is assumed to be an SQL NULL,
1682 **
1683 **  * The expression is a bound variable, and this is a reprepare, or
1684 **
1685 **  * The expression is a literal value.
1686 **
1687 ** On success, *ppVal is made to point to the extracted value.  The caller
1688 ** is responsible for ensuring that the value is eventually freed.
1689 */
1690 static int stat4ValueFromExpr(
1691   Parse *pParse,                  /* Parse context */
1692   Expr *pExpr,                    /* The expression to extract a value from */
1693   u8 affinity,                    /* Affinity to use */
1694   struct ValueNewStat4Ctx *pAlloc,/* How to allocate space.  Or NULL */
1695   sqlite3_value **ppVal           /* OUT: New value object (or NULL) */
1696 ){
1697   int rc = SQLITE_OK;
1698   sqlite3_value *pVal = 0;
1699   sqlite3 *db = pParse->db;
1700
1701   /* Skip over any TK_COLLATE nodes */
1702   pExpr = sqlite3ExprSkipCollate(pExpr);
1703
1704   assert( pExpr==0 || pExpr->op!=TK_REGISTER || pExpr->op2!=TK_VARIABLE );
1705   if( !pExpr ){
1706     pVal = valueNew(db, pAlloc);
1707     if( pVal ){
1708       sqlite3VdbeMemSetNull((Mem*)pVal);
1709     }
1710   }else if( pExpr->op==TK_VARIABLE && (db->flags & SQLITE_EnableQPSG)==0 ){
1711     Vdbe *v;
1712     int iBindVar = pExpr->iColumn;
1713     sqlite3VdbeSetVarmask(pParse->pVdbe, iBindVar);
1714     if( (v = pParse->pReprepare)!=0 ){
1715       pVal = valueNew(db, pAlloc);
1716       if( pVal ){
1717         rc = sqlite3VdbeMemCopy((Mem*)pVal, &v->aVar[iBindVar-1]);
1718         sqlite3ValueApplyAffinity(pVal, affinity, ENC(db));
1719         pVal->db = pParse->db;
1720       }
1721     }
1722   }else{
1723     rc = valueFromExpr(db, pExpr, ENC(db), affinity, &pVal, pAlloc);
1724   }
1725
1726   assert( pVal==0 || pVal->db==db );
1727   *ppVal = pVal;
1728   return rc;
1729 }
1730
1731 /*
1732 ** This function is used to allocate and populate UnpackedRecord
1733 ** structures intended to be compared against sample index keys stored
1734 ** in the sqlite_stat4 table.
1735 **
1736 ** A single call to this function populates zero or more fields of the
1737 ** record starting with field iVal (fields are numbered from left to
1738 ** right starting with 0). A single field is populated if:
1739 **
1740 **  * (pExpr==0). In this case the value is assumed to be an SQL NULL,
1741 **
1742 **  * The expression is a bound variable, and this is a reprepare, or
1743 **
1744 **  * The sqlite3ValueFromExpr() function is able to extract a value
1745 **    from the expression (i.e. the expression is a literal value).
1746 **
1747 ** Or, if pExpr is a TK_VECTOR, one field is populated for each of the
1748 ** vector components that match either of the two latter criteria listed
1749 ** above.
1750 **
1751 ** Before any value is appended to the record, the affinity of the
1752 ** corresponding column within index pIdx is applied to it. Before
1753 ** this function returns, output parameter *pnExtract is set to the
1754 ** number of values appended to the record.
1755 **
1756 ** When this function is called, *ppRec must either point to an object
1757 ** allocated by an earlier call to this function, or must be NULL. If it
1758 ** is NULL and a value can be successfully extracted, a new UnpackedRecord
1759 ** is allocated (and *ppRec set to point to it) before returning.
1760 **
1761 ** Unless an error is encountered, SQLITE_OK is returned. It is not an
1762 ** error if a value cannot be extracted from pExpr. If an error does
1763 ** occur, an SQLite error code is returned.
1764 */
1765 int sqlite3Stat4ProbeSetValue(
1766   Parse *pParse,                  /* Parse context */
1767   Index *pIdx,                    /* Index being probed */
1768   UnpackedRecord **ppRec,         /* IN/OUT: Probe record */
1769   Expr *pExpr,                    /* The expression to extract a value from */
1770   int nElem,                      /* Maximum number of values to append */
1771   int iVal,                       /* Array element to populate */
1772   int *pnExtract                  /* OUT: Values appended to the record */
1773 ){
1774   int rc = SQLITE_OK;
1775   int nExtract = 0;
1776
1777   if( pExpr==0 || pExpr->op!=TK_SELECT ){
1778     int i;
1779     struct ValueNewStat4Ctx alloc;
1780
1781     alloc.pParse = pParse;
1782     alloc.pIdx = pIdx;
1783     alloc.ppRec = ppRec;
1784
1785     for(i=0; i<nElem; i++){
1786       sqlite3_value *pVal = 0;
1787       Expr *pElem = (pExpr ? sqlite3VectorFieldSubexpr(pExpr, i) : 0);
1788       u8 aff = sqlite3IndexColumnAffinity(pParse->db, pIdx, iVal+i);
1789       alloc.iVal = iVal+i;
1790       rc = stat4ValueFromExpr(pParse, pElem, aff, &alloc, &pVal);
1791       if( !pVal ) break;
1792       nExtract++;
1793     }
1794   }
1795
1796   *pnExtract = nExtract;
1797   return rc;
1798 }
1799
1800 /*
1801 ** Attempt to extract a value from expression pExpr using the methods
1802 ** as described for sqlite3Stat4ProbeSetValue() above.
1803 **
1804 ** If successful, set *ppVal to point to a new value object and return
1805 ** SQLITE_OK. If no value can be extracted, but no other error occurs
1806 ** (e.g. OOM), return SQLITE_OK and set *ppVal to NULL. Or, if an error
1807 ** does occur, return an SQLite error code. The final value of *ppVal
1808 ** is undefined in this case.
1809 */
1810 int sqlite3Stat4ValueFromExpr(
1811   Parse *pParse,                  /* Parse context */
1812   Expr *pExpr,                    /* The expression to extract a value from */
1813   u8 affinity,                    /* Affinity to use */
1814   sqlite3_value **ppVal           /* OUT: New value object (or NULL) */
1815 ){
1816   return stat4ValueFromExpr(pParse, pExpr, affinity, 0, ppVal);
1817 }
1818
1819 /*
1820 ** Extract the iCol-th column from the nRec-byte record in pRec.  Write
1821 ** the column value into *ppVal.  If *ppVal is initially NULL then a new
1822 ** sqlite3_value object is allocated.
1823 **
1824 ** If *ppVal is initially NULL then the caller is responsible for
1825 ** ensuring that the value written into *ppVal is eventually freed.
1826 */
1827 int sqlite3Stat4Column(
1828   sqlite3 *db,                    /* Database handle */
1829   const void *pRec,               /* Pointer to buffer containing record */
1830   int nRec,                       /* Size of buffer pRec in bytes */
1831   int iCol,                       /* Column to extract */
1832   sqlite3_value **ppVal           /* OUT: Extracted value */
1833 ){
1834   u32 t = 0;                      /* a column type code */
1835   int nHdr;                       /* Size of the header in the record */
1836   int iHdr;                       /* Next unread header byte */
1837   int iField;                     /* Next unread data byte */
1838   int szField = 0;                /* Size of the current data field */
1839   int i;                          /* Column index */
1840   u8 *a = (u8*)pRec;              /* Typecast byte array */
1841   Mem *pMem = *ppVal;             /* Write result into this Mem object */
1842
1843   assert( iCol>0 );
1844   iHdr = getVarint32(a, nHdr);
1845   if( nHdr>nRec || iHdr>=nHdr ) return SQLITE_CORRUPT_BKPT;
1846   iField = nHdr;
1847   for(i=0; i<=iCol; i++){
1848     iHdr += getVarint32(&a[iHdr], t);
1849     testcase( iHdr==nHdr );
1850     testcase( iHdr==nHdr+1 );
1851     if( iHdr>nHdr ) return SQLITE_CORRUPT_BKPT;
1852     szField = sqlite3VdbeSerialTypeLen(t);
1853     iField += szField;
1854   }
1855   testcase( iField==nRec );
1856   testcase( iField==nRec+1 );
1857   if( iField>nRec ) return SQLITE_CORRUPT_BKPT;
1858   if( pMem==0 ){
1859     pMem = *ppVal = sqlite3ValueNew(db);
1860     if( pMem==0 ) return SQLITE_NOMEM_BKPT;
1861   }
1862   sqlite3VdbeSerialGet(&a[iField-szField], t, pMem);
1863   pMem->enc = ENC(db);
1864   return SQLITE_OK;
1865 }
1866
1867 /*
1868 ** Unless it is NULL, the argument must be an UnpackedRecord object returned
1869 ** by an earlier call to sqlite3Stat4ProbeSetValue(). This call deletes
1870 ** the object.
1871 */
1872 void sqlite3Stat4ProbeFree(UnpackedRecord *pRec){
1873   if( pRec ){
1874     int i;
1875     int nCol = pRec->pKeyInfo->nAllField;
1876     Mem *aMem = pRec->aMem;
1877     sqlite3 *db = aMem[0].db;
1878     for(i=0; i<nCol; i++){
1879       sqlite3VdbeMemRelease(&aMem[i]);
1880     }
1881     sqlite3KeyInfoUnref(pRec->pKeyInfo);
1882     sqlite3DbFreeNN(db, pRec);
1883   }
1884 }
1885 #endif /* ifdef SQLITE_ENABLE_STAT4 */
1886
1887 /*
1888 ** Change the string value of an sqlite3_value object
1889 */
1890 void sqlite3ValueSetStr(
1891   sqlite3_value *v,     /* Value to be set */
1892   int n,                /* Length of string z */
1893   const void *z,        /* Text of the new string */
1894   u8 enc,               /* Encoding to use */
1895   void (*xDel)(void*)   /* Destructor for the string */
1896 ){
1897   if( v ) sqlite3VdbeMemSetStr((Mem *)v, z, n, enc, xDel);
1898 }
1899
1900 /*
1901 ** Free an sqlite3_value object
1902 */
1903 void sqlite3ValueFree(sqlite3_value *v){
1904   if( !v ) return;
1905   sqlite3VdbeMemRelease((Mem *)v);
1906   sqlite3DbFreeNN(((Mem*)v)->db, v);
1907 }
1908
1909 /*
1910 ** The sqlite3ValueBytes() routine returns the number of bytes in the
1911 ** sqlite3_value object assuming that it uses the encoding "enc".
1912 ** The valueBytes() routine is a helper function.
1913 */
1914 static SQLITE_NOINLINE int valueBytes(sqlite3_value *pVal, u8 enc){
1915   return valueToText(pVal, enc)!=0 ? pVal->n : 0;
1916 }
1917 int sqlite3ValueBytes(sqlite3_value *pVal, u8 enc){
1918   Mem *p = (Mem*)pVal;
1919   assert( (p->flags & MEM_Null)==0 || (p->flags & (MEM_Str|MEM_Blob))==0 );
1920   if( (p->flags & MEM_Str)!=0 && pVal->enc==enc ){
1921     return p->n;
1922   }
1923   if( (p->flags & MEM_Blob)!=0 ){
1924     if( p->flags & MEM_Zero ){
1925       return p->n + p->u.nZero;
1926     }else{
1927       return p->n;
1928     }
1929   }
1930   if( p->flags & MEM_Null ) return 0;
1931   return valueBytes(pVal, enc);
1932 }