src/vdbemem.c

   1 /*
   2 ** 2004 May 26
   3 **
   4 ** The author disclaims copyright to this source code.  In place of
   5 ** a legal notice, here is a blessing:
   6 **
   7 **    May you do good and not evil.
   8 **    May you find forgiveness for yourself and forgive others.
   9 **    May you share freely, never taking more than you give.
  10 **
  11 *************************************************************************
  12 **
  13 ** This file contains code use to manipulate "Mem" structure.  A "Mem"
  14 ** stores a single value in the VDBE.  Mem is an opaque structure visible
  15 ** only within the VDBE.  Interface routines refer to a Mem using the
  16 ** name sqlite_value
  17 */
  18 #include "sqliteInt.h"
  19 #include "vdbeInt.h"
  20
  21 /* True if X is a power of two.  0 is considered a power of two here.
  22 ** In other words, return true if X has at most one bit set.
  23 */
  24 #define ISPOWEROF2(X)  (((X)&((X)-1))==0)
  25
  26 #ifdef SQLITE_DEBUG
  27 /*
  28 ** Check invariants on a Mem object.
  29 **
  30 ** This routine is intended for use inside of assert() statements, like
  31 ** this:    assert( sqlite3VdbeCheckMemInvariants(pMem) );
  32 */
  33 int sqlite3VdbeCheckMemInvariants(Mem *p){
  34   /* If MEM_Dyn is set then Mem.xDel!=0.
  35   ** Mem.xDel might not be initialized if MEM_Dyn is clear.
  36   */
  37   assert( (p->flags & MEM_Dyn)==0 || p->xDel!=0 );
  38
  39   /* MEM_Dyn may only be set if Mem.szMalloc==0.  In this way we
  40   ** ensure that if Mem.szMalloc>0 then it is safe to do
  41   ** Mem.z = Mem.zMalloc without having to check Mem.flags&MEM_Dyn.
  42   ** That saves a few cycles in inner loops. */
  43   assert( (p->flags & MEM_Dyn)==0 || p->szMalloc==0 );
  44
  45   /* Cannot have more than one of MEM_Int, MEM_Real, or MEM_IntReal */
  46   assert( ISPOWEROF2(p->flags & (MEM_Int|MEM_Real|MEM_IntReal)) );
  47
  48   if( p->flags & MEM_Null ){
  49     /* Cannot be both MEM_Null and some other type */
  50     assert( (p->flags & (MEM_Int|MEM_Real|MEM_Str|MEM_Blob|MEM_Agg))==0 );
  51
  52     /* If MEM_Null is set, then either the value is a pure NULL (the usual
  53     ** case) or it is a pointer set using sqlite3_bind_pointer() or
  54     ** sqlite3_result_pointer().  If a pointer, then MEM_Term must also be
  55     ** set.
  56     */
  57     if( (p->flags & (MEM_Term|MEM_Subtype))==(MEM_Term|MEM_Subtype) ){
  58       /* This is a pointer type.  There may be a flag to indicate what to
  59       ** do with the pointer. */
  60       assert( ((p->flags&MEM_Dyn)!=0 ? 1 : 0) +
  61               ((p->flags&MEM_Ephem)!=0 ? 1 : 0) +
  62               ((p->flags&MEM_Static)!=0 ? 1 : 0) <= 1 );
  63
  64       /* No other bits set */
  65       assert( (p->flags & ~(MEM_Null|MEM_Term|MEM_Subtype|MEM_FromBind
  66                            |MEM_Dyn|MEM_Ephem|MEM_Static))==0 );
  67     }else{
  68       /* A pure NULL might have other flags, such as MEM_Static, MEM_Dyn,
  69       ** MEM_Ephem, MEM_Cleared, or MEM_Subtype */
  70     }
  71   }else{
  72     /* The MEM_Cleared bit is only allowed on NULLs */
  73     assert( (p->flags & MEM_Cleared)==0 );
  74   }
  75
  76   /* The szMalloc field holds the correct memory allocation size */
  77   assert( p->szMalloc==0
  78        || (p->flags==MEM_Undefined
  79            && p->szMalloc<=sqlite3DbMallocSize(p->db,p->zMalloc))
  80        || p->szMalloc==sqlite3DbMallocSize(p->db,p->zMalloc));
  81
  82   /* If p holds a string or blob, the Mem.z must point to exactly
  83   ** one of the following:
  84   **
  85   **   (1) Memory in Mem.zMalloc and managed by the Mem object
  86   **   (2) Memory to be freed using Mem.xDel
  87   **   (3) An ephemeral string or blob
  88   **   (4) A static string or blob
  89   */
  90   if( (p->flags & (MEM_Str|MEM_Blob)) && p->n>0 ){
  91     assert(
  92       ((p->szMalloc>0 && p->z==p->zMalloc)? 1 : 0) +
  93       ((p->flags&MEM_Dyn)!=0 ? 1 : 0) +
  94       ((p->flags&MEM_Ephem)!=0 ? 1 : 0) +
  95       ((p->flags&MEM_Static)!=0 ? 1 : 0) == 1
  96     );
  97   }
  98   return 1;
  99 }
 100 #endif
 101
 102 /*
 103 ** Render a Mem object which is one of MEM_Int, MEM_Real, or MEM_IntReal
 104 ** into a buffer.
 105 */
 106 static void vdbeMemRenderNum(int sz, char *zBuf, Mem *p){
 107   StrAccum acc;
 108   assert( p->flags & (MEM_Int|MEM_Real|MEM_IntReal) );
 109   assert( sz>22 );
 110   if( p->flags & MEM_Int ){
 111 #if GCC_VERSION>=7000000
 112     /* Work-around for GCC bug
 113     ** https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96270 */
 114     i64 x;
 115     assert( (p->flags&MEM_Int)*2==sizeof(x) );
 116     memcpy(&x, (char*)&p->u, (p->flags&MEM_Int)*2);
 117     sqlite3Int64ToText(x, zBuf);
 118 #else
 119     sqlite3Int64ToText(p->u.i, zBuf);
 120 #endif
 121   }else{
 122     sqlite3StrAccumInit(&acc, 0, zBuf, sz, 0);
 123     sqlite3_str_appendf(&acc, "%!.15g",
 124          (p->flags & MEM_IntReal)!=0 ? (double)p->u.i : p->u.r);
 125     assert( acc.zText==zBuf && acc.mxAlloc<=0 );
 126     zBuf[acc.nChar] = 0; /* Fast version of sqlite3StrAccumFinish(&acc) */
 127   }
 128 }
 129
 130 #ifdef SQLITE_DEBUG
 131 /*
 132 ** Validity checks on pMem.  pMem holds a string.
 133 **
 134 ** (1) Check that string value of pMem agrees with its integer or real value.
 135 ** (2) Check that the string is correctly zero terminated
 136 **
 137 ** A single int or real value always converts to the same strings.  But
 138 ** many different strings can be converted into the same int or real.
 139 ** If a table contains a numeric value and an index is based on the
 140 ** corresponding string value, then it is important that the string be
 141 ** derived from the numeric value, not the other way around, to ensure
 142 ** that the index and table are consistent.  See ticket
 143 ** https://www.sqlite.org/src/info/343634942dd54ab (2018-01-31) for
 144 ** an example.
 145 **
 146 ** This routine looks at pMem to verify that if it has both a numeric
 147 ** representation and a string representation then the string rep has
 148 ** been derived from the numeric and not the other way around.  It returns
 149 ** true if everything is ok and false if there is a problem.
 150 **
 151 ** This routine is for use inside of assert() statements only.
 152 */
 153 int sqlite3VdbeMemValidStrRep(Mem *p){
 154   char zBuf[100];
 155   char *z;
 156   int i, j, incr;
 157   if( (p->flags & MEM_Str)==0 ) return 1;
 158   if( p->flags & MEM_Term ){
 159     /* Insure that the string is properly zero-terminated.  Pay particular
 160     ** attention to the case where p->n is odd */
 161     if( p->szMalloc>0 && p->z==p->zMalloc ){
 162       assert( p->enc==SQLITE_UTF8 || p->szMalloc >= ((p->n+1)&~1)+2 );
 163       assert( p->enc!=SQLITE_UTF8 || p->szMalloc >= p->n+1 );
 164     }
 165     assert( p->z[p->n]==0 );
 166     assert( p->enc==SQLITE_UTF8 || p->z[(p->n+1)&~1]==0 );
 167     assert( p->enc==SQLITE_UTF8 || p->z[((p->n+1)&~1)+1]==0 );
 168   }
 169   if( (p->flags & (MEM_Int|MEM_Real|MEM_IntReal))==0 ) return 1;
 170   vdbeMemRenderNum(sizeof(zBuf), zBuf, p);
 171   z = p->z;
 172   i = j = 0;
 173   incr = 1;
 174   if( p->enc!=SQLITE_UTF8 ){
 175     incr = 2;
 176     if( p->enc==SQLITE_UTF16BE ) z++;
 177   }
 178   while( zBuf[j] ){
 179     if( zBuf[j++]!=z[i] ) return 0;
 180     i += incr;
 181   }
 182   return 1;
 183 }
 184 #endif /* SQLITE_DEBUG */
 185
 186 /*
 187 ** If pMem is an object with a valid string representation, this routine
 188 ** ensures the internal encoding for the string representation is
 189 ** 'desiredEnc', one of SQLITE_UTF8, SQLITE_UTF16LE or SQLITE_UTF16BE.
 190 **
 191 ** If pMem is not a string object, or the encoding of the string
 192 ** representation is already stored using the requested encoding, then this
 193 ** routine is a no-op.
 194 **
 195 ** SQLITE_OK is returned if the conversion is successful (or not required).
 196 ** SQLITE_NOMEM may be returned if a malloc() fails during conversion
 197 ** between formats.
 198 */
 199 int sqlite3VdbeChangeEncoding(Mem *pMem, int desiredEnc){
 200 #ifndef SQLITE_OMIT_UTF16
 201   int rc;
 202 #endif
 203   assert( pMem!=0 );
 204   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 205   assert( desiredEnc==SQLITE_UTF8 || desiredEnc==SQLITE_UTF16LE
 206            || desiredEnc==SQLITE_UTF16BE );
 207   if( !(pMem->flags&MEM_Str) || pMem->enc==desiredEnc ){
 208     return SQLITE_OK;
 209   }
 210   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 211 #ifdef SQLITE_OMIT_UTF16
 212   return SQLITE_ERROR;
 213 #else
 214
 215   /* MemTranslate() may return SQLITE_OK or SQLITE_NOMEM. If NOMEM is returned,
 216   ** then the encoding of the value may not have changed.
 217   */
 218   rc = sqlite3VdbeMemTranslate(pMem, (u8)desiredEnc);
 219   assert(rc==SQLITE_OK    || rc==SQLITE_NOMEM);
 220   assert(rc==SQLITE_OK    || pMem->enc!=desiredEnc);
 221   assert(rc==SQLITE_NOMEM || pMem->enc==desiredEnc);
 222   return rc;
 223 #endif
 224 }
 225
 226 /*
 227 ** Make sure pMem->z points to a writable allocation of at least n bytes.
 228 **
 229 ** If the bPreserve argument is true, then copy of the content of
 230 ** pMem->z into the new allocation.  pMem must be either a string or
 231 ** blob if bPreserve is true.  If bPreserve is false, any prior content
 232 ** in pMem->z is discarded.
 233 */
 234 SQLITE_NOINLINE int sqlite3VdbeMemGrow(Mem *pMem, int n, int bPreserve){
 235   assert( sqlite3VdbeCheckMemInvariants(pMem) );
 236   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 237   testcase( pMem->db==0 );
 238
 239   /* If the bPreserve flag is set to true, then the memory cell must already
 240   ** contain a valid string or blob value.  */
 241   assert( bPreserve==0 || pMem->flags&(MEM_Blob|MEM_Str) );
 242   testcase( bPreserve && pMem->z==0 );
 243
 244   assert( pMem->szMalloc==0
 245        || (pMem->flags==MEM_Undefined
 246            && pMem->szMalloc<=sqlite3DbMallocSize(pMem->db,pMem->zMalloc))
 247        || pMem->szMalloc==sqlite3DbMallocSize(pMem->db,pMem->zMalloc));
 248   if( pMem->szMalloc>0 && bPreserve && pMem->z==pMem->zMalloc ){
 249     if( pMem->db ){
 250       pMem->z = pMem->zMalloc = sqlite3DbReallocOrFree(pMem->db, pMem->z, n);
 251     }else{
 252       pMem->zMalloc = sqlite3Realloc(pMem->z, n);
 253       if( pMem->zMalloc==0 ) sqlite3_free(pMem->z);
 254       pMem->z = pMem->zMalloc;
 255     }
 256     bPreserve = 0;
 257   }else{
 258     if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
 259     pMem->zMalloc = sqlite3DbMallocRaw(pMem->db, n);
 260   }
 261   if( pMem->zMalloc==0 ){
 262     sqlite3VdbeMemSetNull(pMem);
 263     pMem->z = 0;
 264     pMem->szMalloc = 0;
 265     return SQLITE_NOMEM_BKPT;
 266   }else{
 267     pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
 268   }
 269
 270   if( bPreserve && pMem->z ){
 271     assert( pMem->z!=pMem->zMalloc );
 272     memcpy(pMem->zMalloc, pMem->z, pMem->n);
 273   }
 274   if( (pMem->flags&MEM_Dyn)!=0 ){
 275     assert( pMem->xDel!=0 && pMem->xDel!=SQLITE_DYNAMIC );
 276     pMem->xDel((void *)(pMem->z));
 277   }
 278
 279   pMem->z = pMem->zMalloc;
 280   pMem->flags &= ~(MEM_Dyn|MEM_Ephem|MEM_Static);
 281   return SQLITE_OK;
 282 }
 283
 284 /*
 285 ** Change the pMem->zMalloc allocation to be at least szNew bytes.
 286 ** If pMem->zMalloc already meets or exceeds the requested size, this
 287 ** routine is a no-op.
 288 **
 289 ** Any prior string or blob content in the pMem object may be discarded.
 290 ** The pMem->xDel destructor is called, if it exists.  Though MEM_Str
 291 ** and MEM_Blob values may be discarded, MEM_Int, MEM_Real, MEM_IntReal,
 292 ** and MEM_Null values are preserved.
 293 **
 294 ** Return SQLITE_OK on success or an error code (probably SQLITE_NOMEM)
 295 ** if unable to complete the resizing.
 296 */
 297 int sqlite3VdbeMemClearAndResize(Mem *pMem, int szNew){
 298   assert( CORRUPT_DB || szNew>0 );
 299   assert( (pMem->flags & MEM_Dyn)==0 || pMem->szMalloc==0 );
 300   if( pMem->szMalloc<szNew ){
 301     return sqlite3VdbeMemGrow(pMem, szNew, 0);
 302   }
 303   assert( (pMem->flags & MEM_Dyn)==0 );
 304   pMem->z = pMem->zMalloc;
 305   pMem->flags &= (MEM_Null|MEM_Int|MEM_Real|MEM_IntReal);
 306   return SQLITE_OK;
 307 }
 308
 309 /*
 310 ** It is already known that pMem contains an unterminated string.
 311 ** Add the zero terminator.
 312 **
 313 ** Three bytes of zero are added.  In this way, there is guaranteed
 314 ** to be a double-zero byte at an even byte boundary in order to
 315 ** terminate a UTF16 string, even if the initial size of the buffer
 316 ** is an odd number of bytes.
 317 */
 318 static SQLITE_NOINLINE int vdbeMemAddTerminator(Mem *pMem){
 319   if( sqlite3VdbeMemGrow(pMem, pMem->n+3, 1) ){
 320     return SQLITE_NOMEM_BKPT;
 321   }
 322   pMem->z[pMem->n] = 0;
 323   pMem->z[pMem->n+1] = 0;
 324   pMem->z[pMem->n+2] = 0;
 325   pMem->flags |= MEM_Term;
 326   return SQLITE_OK;
 327 }
 328
 329 /*
 330 ** Change pMem so that its MEM_Str or MEM_Blob value is stored in
 331 ** MEM.zMalloc, where it can be safely written.
 332 **
 333 ** Return SQLITE_OK on success or SQLITE_NOMEM if malloc fails.
 334 */
 335 int sqlite3VdbeMemMakeWriteable(Mem *pMem){
 336   assert( pMem!=0 );
 337   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 338   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 339   if( (pMem->flags & (MEM_Str|MEM_Blob))!=0 ){
 340     if( ExpandBlob(pMem) ) return SQLITE_NOMEM;
 341     if( pMem->szMalloc==0 || pMem->z!=pMem->zMalloc ){
 342       int rc = vdbeMemAddTerminator(pMem);
 343       if( rc ) return rc;
 344     }
 345   }
 346   pMem->flags &= ~MEM_Ephem;
 347 #ifdef SQLITE_DEBUG
 348   pMem->pScopyFrom = 0;
 349 #endif
 350
 351   return SQLITE_OK;
 352 }
 353
 354 /*
 355 ** If the given Mem* has a zero-filled tail, turn it into an ordinary
 356 ** blob stored in dynamically allocated space.
 357 */
 358 #ifndef SQLITE_OMIT_INCRBLOB
 359 int sqlite3VdbeMemExpandBlob(Mem *pMem){
 360   int nByte;
 361   assert( pMem!=0 );
 362   assert( pMem->flags & MEM_Zero );
 363   assert( (pMem->flags&MEM_Blob)!=0 || MemNullNochng(pMem) );
 364   testcase( sqlite3_value_nochange(pMem) );
 365   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 366   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 367
 368   /* Set nByte to the number of bytes required to store the expanded blob. */
 369   nByte = pMem->n + pMem->u.nZero;
 370   if( nByte<=0 ){
 371     if( (pMem->flags & MEM_Blob)==0 ) return SQLITE_OK;
 372     nByte = 1;
 373   }
 374   if( sqlite3VdbeMemGrow(pMem, nByte, 1) ){
 375     return SQLITE_NOMEM_BKPT;
 376   }
 377   assert( pMem->z!=0 );
 378   assert( sqlite3DbMallocSize(pMem->db,pMem->z) >= nByte );
 379
 380   memset(&pMem->z[pMem->n], 0, pMem->u.nZero);
 381   pMem->n += pMem->u.nZero;
 382   pMem->flags &= ~(MEM_Zero|MEM_Term);
 383   return SQLITE_OK;
 384 }
 385 #endif
 386
 387 /*
 388 ** Make sure the given Mem is \u0000 terminated.
 389 */
 390 int sqlite3VdbeMemNulTerminate(Mem *pMem){
 391   assert( pMem!=0 );
 392   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 393   testcase( (pMem->flags & (MEM_Term|MEM_Str))==(MEM_Term|MEM_Str) );
 394   testcase( (pMem->flags & (MEM_Term|MEM_Str))==0 );
 395   if( (pMem->flags & (MEM_Term|MEM_Str))!=MEM_Str ){
 396     return SQLITE_OK;   /* Nothing to do */
 397   }else{
 398     return vdbeMemAddTerminator(pMem);
 399   }
 400 }
 401
 402 /*
 403 ** Add MEM_Str to the set of representations for the given Mem.  This
 404 ** routine is only called if pMem is a number of some kind, not a NULL
 405 ** or a BLOB.
 406 **
 407 ** Existing representations MEM_Int, MEM_Real, or MEM_IntReal are invalidated
 408 ** if bForce is true but are retained if bForce is false.
 409 **
 410 ** A MEM_Null value will never be passed to this function. This function is
 411 ** used for converting values to text for returning to the user (i.e. via
 412 ** sqlite3_value_text()), or for ensuring that values to be used as btree
 413 ** keys are strings. In the former case a NULL pointer is returned the
 414 ** user and the latter is an internal programming error.
 415 */
 416 int sqlite3VdbeMemStringify(Mem *pMem, u8 enc, u8 bForce){
 417   const int nByte = 32;
 418
 419   assert( pMem!=0 );
 420   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 421   assert( !(pMem->flags&MEM_Zero) );
 422   assert( !(pMem->flags&(MEM_Str|MEM_Blob)) );
 423   assert( pMem->flags&(MEM_Int|MEM_Real|MEM_IntReal) );
 424   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 425   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 426
 427
 428   if( sqlite3VdbeMemClearAndResize(pMem, nByte) ){
 429     pMem->enc = 0;
 430     return SQLITE_NOMEM_BKPT;
 431   }
 432
 433   vdbeMemRenderNum(nByte, pMem->z, pMem);
 434   assert( pMem->z!=0 );
 435   pMem->n = sqlite3Strlen30NN(pMem->z);
 436   pMem->enc = SQLITE_UTF8;
 437   pMem->flags |= MEM_Str|MEM_Term;
 438   if( bForce ) pMem->flags &= ~(MEM_Int|MEM_Real|MEM_IntReal);
 439   sqlite3VdbeChangeEncoding(pMem, enc);
 440   return SQLITE_OK;
 441 }
 442
 443 /*
 444 ** Memory cell pMem contains the context of an aggregate function.
 445 ** This routine calls the finalize method for that function.  The
 446 ** result of the aggregate is stored back into pMem.
 447 **
 448 ** Return SQLITE_ERROR if the finalizer reports an error.  SQLITE_OK
 449 ** otherwise.
 450 */
 451 int sqlite3VdbeMemFinalize(Mem *pMem, FuncDef *pFunc){
 452   sqlite3_context ctx;
 453   Mem t;
 454   assert( pFunc!=0 );
 455   assert( pMem!=0 );
 456   assert( pFunc->xFinalize!=0 );
 457   assert( (pMem->flags & MEM_Null)!=0 || pFunc==pMem->u.pDef );
 458   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 459   memset(&ctx, 0, sizeof(ctx));
 460   memset(&t, 0, sizeof(t));
 461   t.flags = MEM_Null;
 462   t.db = pMem->db;
 463   ctx.pOut = &t;
 464   ctx.pMem = pMem;
 465   ctx.pFunc = pFunc;
 466   pFunc->xFinalize(&ctx); /* IMP: R-24505-23230 */
 467   assert( (pMem->flags & MEM_Dyn)==0 );
 468   if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
 469   memcpy(pMem, &t, sizeof(t));
 470   return ctx.isError;
 471 }
 472
 473 /*
 474 ** Memory cell pAccum contains the context of an aggregate function.
 475 ** This routine calls the xValue method for that function and stores
 476 ** the results in memory cell pMem.
 477 **
 478 ** SQLITE_ERROR is returned if xValue() reports an error. SQLITE_OK
 479 ** otherwise.
 480 */
 481 #ifndef SQLITE_OMIT_WINDOWFUNC
 482 int sqlite3VdbeMemAggValue(Mem *pAccum, Mem *pOut, FuncDef *pFunc){
 483   sqlite3_context ctx;
 484   assert( pFunc!=0 );
 485   assert( pFunc->xValue!=0 );
 486   assert( (pAccum->flags & MEM_Null)!=0 || pFunc==pAccum->u.pDef );
 487   assert( pAccum->db==0 || sqlite3_mutex_held(pAccum->db->mutex) );
 488   memset(&ctx, 0, sizeof(ctx));
 489   sqlite3VdbeMemSetNull(pOut);
 490   ctx.pOut = pOut;
 491   ctx.pMem = pAccum;
 492   ctx.pFunc = pFunc;
 493   pFunc->xValue(&ctx);
 494   return ctx.isError;
 495 }
 496 #endif /* SQLITE_OMIT_WINDOWFUNC */
 497
 498 /*
 499 ** If the memory cell contains a value that must be freed by
 500 ** invoking the external callback in Mem.xDel, then this routine
 501 ** will free that value.  It also sets Mem.flags to MEM_Null.
 502 **
 503 ** This is a helper routine for sqlite3VdbeMemSetNull() and
 504 ** for sqlite3VdbeMemRelease().  Use those other routines as the
 505 ** entry point for releasing Mem resources.
 506 */
 507 static SQLITE_NOINLINE void vdbeMemClearExternAndSetNull(Mem *p){
 508   assert( p->db==0 || sqlite3_mutex_held(p->db->mutex) );
 509   assert( VdbeMemDynamic(p) );
 510   if( p->flags&MEM_Agg ){
 511     sqlite3VdbeMemFinalize(p, p->u.pDef);
 512     assert( (p->flags & MEM_Agg)==0 );
 513     testcase( p->flags & MEM_Dyn );
 514   }
 515   if( p->flags&MEM_Dyn ){
 516     assert( p->xDel!=SQLITE_DYNAMIC && p->xDel!=0 );
 517     p->xDel((void *)p->z);
 518   }
 519   p->flags = MEM_Null;
 520 }
 521
 522 /*
 523 ** Release memory held by the Mem p, both external memory cleared
 524 ** by p->xDel and memory in p->zMalloc.
 525 **
 526 ** This is a helper routine invoked by sqlite3VdbeMemRelease() in
 527 ** the unusual case where there really is memory in p that needs
 528 ** to be freed.
 529 */
 530 static SQLITE_NOINLINE void vdbeMemClear(Mem *p){
 531   if( VdbeMemDynamic(p) ){
 532     vdbeMemClearExternAndSetNull(p);
 533   }
 534   if( p->szMalloc ){
 535     sqlite3DbFreeNN(p->db, p->zMalloc);
 536     p->szMalloc = 0;
 537   }
 538   p->z = 0;
 539 }
 540
 541 /*
 542 ** Release any memory resources held by the Mem.  Both the memory that is
 543 ** free by Mem.xDel and the Mem.zMalloc allocation are freed.
 544 **
 545 ** Use this routine prior to clean up prior to abandoning a Mem, or to
 546 ** reset a Mem back to its minimum memory utilization.
 547 **
 548 ** Use sqlite3VdbeMemSetNull() to release just the Mem.xDel space
 549 ** prior to inserting new content into the Mem.
 550 */
 551 void sqlite3VdbeMemRelease(Mem *p){
 552   assert( sqlite3VdbeCheckMemInvariants(p) );
 553   if( VdbeMemDynamic(p) || p->szMalloc ){
 554     vdbeMemClear(p);
 555   }
 556 }
 557
 558 /*
 559 ** Convert a 64-bit IEEE double into a 64-bit signed integer.
 560 ** If the double is out of range of a 64-bit signed integer then
 561 ** return the closest available 64-bit signed integer.
 562 */
 563 static SQLITE_NOINLINE i64 doubleToInt64(double r){
 564 #ifdef SQLITE_OMIT_FLOATING_POINT
 565   /* When floating-point is omitted, double and int64 are the same thing */
 566   return r;
 567 #else
 568   /*
 569   ** Many compilers we encounter do not define constants for the
 570   ** minimum and maximum 64-bit integers, or they define them
 571   ** inconsistently.  And many do not understand the "LL" notation.
 572   ** So we define our own static constants here using nothing
 573   ** larger than a 32-bit integer constant.
 574   */
 575   static const i64 maxInt = LARGEST_INT64;
 576   static const i64 minInt = SMALLEST_INT64;
 577
 578   if( r<=(double)minInt ){
 579     return minInt;
 580   }else if( r>=(double)maxInt ){
 581     return maxInt;
 582   }else{
 583     return (i64)r;
 584   }
 585 #endif
 586 }
 587
 588 /*
 589 ** Return some kind of integer value which is the best we can do
 590 ** at representing the value that *pMem describes as an integer.
 591 ** If pMem is an integer, then the value is exact.  If pMem is
 592 ** a floating-point then the value returned is the integer part.
 593 ** If pMem is a string or blob, then we make an attempt to convert
 594 ** it into an integer and return that.  If pMem represents an
 595 ** an SQL-NULL value, return 0.
 596 **
 597 ** If pMem represents a string value, its encoding might be changed.
 598 */
 599 static SQLITE_NOINLINE i64 memIntValue(Mem *pMem){
 600   i64 value = 0;
 601   sqlite3Atoi64(pMem->z, &value, pMem->n, pMem->enc);
 602   return value;
 603 }
 604 i64 sqlite3VdbeIntValue(Mem *pMem){
 605   int flags;
 606   assert( pMem!=0 );
 607   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 608   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 609   flags = pMem->flags;
 610   if( flags & (MEM_Int|MEM_IntReal) ){
 611     testcase( flags & MEM_IntReal );
 612     return pMem->u.i;
 613   }else if( flags & MEM_Real ){
 614     return doubleToInt64(pMem->u.r);
 615   }else if( (flags & (MEM_Str|MEM_Blob))!=0 && pMem->z!=0 ){
 616     return memIntValue(pMem);
 617   }else{
 618     return 0;
 619   }
 620 }
 621
 622 /*
 623 ** Return the best representation of pMem that we can get into a
 624 ** double.  If pMem is already a double or an integer, return its
 625 ** value.  If it is a string or blob, try to convert it to a double.
 626 ** If it is a NULL, return 0.0.
 627 */
 628 static SQLITE_NOINLINE double memRealValue(Mem *pMem){
 629   /* (double)0 In case of SQLITE_OMIT_FLOATING_POINT... */
 630   double val = (double)0;
 631   sqlite3AtoF(pMem->z, &val, pMem->n, pMem->enc);
 632   return val;
 633 }
 634 double sqlite3VdbeRealValue(Mem *pMem){
 635   assert( pMem!=0 );
 636   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 637   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 638   if( pMem->flags & MEM_Real ){
 639     return pMem->u.r;
 640   }else if( pMem->flags & (MEM_Int|MEM_IntReal) ){
 641     testcase( pMem->flags & MEM_IntReal );
 642     return (double)pMem->u.i;
 643   }else if( pMem->flags & (MEM_Str|MEM_Blob) ){
 644     return memRealValue(pMem);
 645   }else{
 646     /* (double)0 In case of SQLITE_OMIT_FLOATING_POINT... */
 647     return (double)0;
 648   }
 649 }
 650
 651 /*
 652 ** Return 1 if pMem represents true, and return 0 if pMem represents false.
 653 ** Return the value ifNull if pMem is NULL.
 654 */
 655 int sqlite3VdbeBooleanValue(Mem *pMem, int ifNull){
 656   testcase( pMem->flags & MEM_IntReal );
 657   if( pMem->flags & (MEM_Int|MEM_IntReal) ) return pMem->u.i!=0;
 658   if( pMem->flags & MEM_Null ) return ifNull;
 659   return sqlite3VdbeRealValue(pMem)!=0.0;
 660 }
 661
 662 /*
 663 ** The MEM structure is already a MEM_Real.  Try to also make it a
 664 ** MEM_Int if we can.
 665 */
 666 void sqlite3VdbeIntegerAffinity(Mem *pMem){
 667   i64 ix;
 668   assert( pMem!=0 );
 669   assert( pMem->flags & MEM_Real );
 670   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 671   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 672   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 673
 674   ix = doubleToInt64(pMem->u.r);
 675
 676   /* Only mark the value as an integer if
 677   **
 678   **    (1) the round-trip conversion real->int->real is a no-op, and
 679   **    (2) The integer is neither the largest nor the smallest
 680   **        possible integer (ticket #3922)
 681   **
 682   ** The second and third terms in the following conditional enforces
 683   ** the second condition under the assumption that addition overflow causes
 684   ** values to wrap around.
 685   */
 686   if( pMem->u.r==ix && ix>SMALLEST_INT64 && ix<LARGEST_INT64 ){
 687     pMem->u.i = ix;
 688     MemSetTypeFlag(pMem, MEM_Int);
 689   }
 690 }
 691
 692 /*
 693 ** Convert pMem to type integer.  Invalidate any prior representations.
 694 */
 695 int sqlite3VdbeMemIntegerify(Mem *pMem){
 696   assert( pMem!=0 );
 697   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 698   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 699   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 700
 701   pMem->u.i = sqlite3VdbeIntValue(pMem);
 702   MemSetTypeFlag(pMem, MEM_Int);
 703   return SQLITE_OK;
 704 }
 705
 706 /*
 707 ** Convert pMem so that it is of type MEM_Real.
 708 ** Invalidate any prior representations.
 709 */
 710 int sqlite3VdbeMemRealify(Mem *pMem){
 711   assert( pMem!=0 );
 712   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 713   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 714
 715   pMem->u.r = sqlite3VdbeRealValue(pMem);
 716   MemSetTypeFlag(pMem, MEM_Real);
 717   return SQLITE_OK;
 718 }
 719
 720 /* Compare a floating point value to an integer.  Return true if the two
 721 ** values are the same within the precision of the floating point value.
 722 **
 723 ** This function assumes that i was obtained by assignment from r1.
 724 **
 725 ** For some versions of GCC on 32-bit machines, if you do the more obvious
 726 ** comparison of "r1==(double)i" you sometimes get an answer of false even
 727 ** though the r1 and (double)i values are bit-for-bit the same.
 728 */
 729 int sqlite3RealSameAsInt(double r1, sqlite3_int64 i){
 730   double r2 = (double)i;
 731   return r1==0.0
 732       || (memcmp(&r1, &r2, sizeof(r1))==0
 733           && i >= -2251799813685248LL && i < 2251799813685248LL);
 734 }
 735
 736 /*
 737 ** Convert pMem so that it has type MEM_Real or MEM_Int.
 738 ** Invalidate any prior representations.
 739 **
 740 ** Every effort is made to force the conversion, even if the input
 741 ** is a string that does not look completely like a number.  Convert
 742 ** as much of the string as we can and ignore the rest.
 743 */
 744 int sqlite3VdbeMemNumerify(Mem *pMem){
 745   assert( pMem!=0 );
 746   testcase( pMem->flags & MEM_Int );
 747   testcase( pMem->flags & MEM_Real );
 748   testcase( pMem->flags & MEM_IntReal );
 749   testcase( pMem->flags & MEM_Null );
 750   if( (pMem->flags & (MEM_Int|MEM_Real|MEM_IntReal|MEM_Null))==0 ){
 751     int rc;
 752     sqlite3_int64 ix;
 753     assert( (pMem->flags & (MEM_Blob|MEM_Str))!=0 );
 754     assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 755     rc = sqlite3AtoF(pMem->z, &pMem->u.r, pMem->n, pMem->enc);
 756     if( ((rc==0 || rc==1) && sqlite3Atoi64(pMem->z, &ix, pMem->n, pMem->enc)<=1)
 757      || sqlite3RealSameAsInt(pMem->u.r, (ix = (i64)pMem->u.r))
 758     ){
 759       pMem->u.i = ix;
 760       MemSetTypeFlag(pMem, MEM_Int);
 761     }else{
 762       MemSetTypeFlag(pMem, MEM_Real);
 763     }
 764   }
 765   assert( (pMem->flags & (MEM_Int|MEM_Real|MEM_IntReal|MEM_Null))!=0 );
 766   pMem->flags &= ~(MEM_Str|MEM_Blob|MEM_Zero);
 767   return SQLITE_OK;
 768 }
 769
 770 /*
 771 ** Cast the datatype of the value in pMem according to the affinity
 772 ** "aff".  Casting is different from applying affinity in that a cast
 773 ** is forced.  In other words, the value is converted into the desired
 774 ** affinity even if that results in loss of data.  This routine is
 775 ** used (for example) to implement the SQL "cast()" operator.
 776 */
 777 int sqlite3VdbeMemCast(Mem *pMem, u8 aff, u8 encoding){
 778   if( pMem->flags & MEM_Null ) return SQLITE_OK;
 779   switch( aff ){
 780     case SQLITE_AFF_BLOB: {   /* Really a cast to BLOB */
 781       if( (pMem->flags & MEM_Blob)==0 ){
 782         sqlite3ValueApplyAffinity(pMem, SQLITE_AFF_TEXT, encoding);
 783         assert( pMem->flags & MEM_Str || pMem->db->mallocFailed );
 784         if( pMem->flags & MEM_Str ) MemSetTypeFlag(pMem, MEM_Blob);
 785       }else{
 786         pMem->flags &= ~(MEM_TypeMask&~MEM_Blob);
 787       }
 788       break;
 789     }
 790     case SQLITE_AFF_NUMERIC: {
 791       sqlite3VdbeMemNumerify(pMem);
 792       break;
 793     }
 794     case SQLITE_AFF_INTEGER: {
 795       sqlite3VdbeMemIntegerify(pMem);
 796       break;
 797     }
 798     case SQLITE_AFF_REAL: {
 799       sqlite3VdbeMemRealify(pMem);
 800       break;
 801     }
 802     default: {
 803       assert( aff==SQLITE_AFF_TEXT );
 804       assert( MEM_Str==(MEM_Blob>>3) );
 805       pMem->flags |= (pMem->flags&MEM_Blob)>>3;
 806       sqlite3ValueApplyAffinity(pMem, SQLITE_AFF_TEXT, encoding);
 807       assert( pMem->flags & MEM_Str || pMem->db->mallocFailed );
 808       pMem->flags &= ~(MEM_Int|MEM_Real|MEM_IntReal|MEM_Blob|MEM_Zero);
 809       return sqlite3VdbeChangeEncoding(pMem, encoding);
 810     }
 811   }
 812   return SQLITE_OK;
 813 }
 814
 815 /*
 816 ** Initialize bulk memory to be a consistent Mem object.
 817 **
 818 ** The minimum amount of initialization feasible is performed.
 819 */
 820 void sqlite3VdbeMemInit(Mem *pMem, sqlite3 *db, u16 flags){
 821   assert( (flags & ~MEM_TypeMask)==0 );
 822   pMem->flags = flags;
 823   pMem->db = db;
 824   pMem->szMalloc = 0;
 825 }
 826
 827
 828 /*
 829 ** Delete any previous value and set the value stored in *pMem to NULL.
 830 **
 831 ** This routine calls the Mem.xDel destructor to dispose of values that
 832 ** require the destructor.  But it preserves the Mem.zMalloc memory allocation.
 833 ** To free all resources, use sqlite3VdbeMemRelease(), which both calls this
 834 ** routine to invoke the destructor and deallocates Mem.zMalloc.
 835 **
 836 ** Use this routine to reset the Mem prior to insert a new value.
 837 **
 838 ** Use sqlite3VdbeMemRelease() to complete erase the Mem prior to abandoning it.
 839 */
 840 void sqlite3VdbeMemSetNull(Mem *pMem){
 841   if( VdbeMemDynamic(pMem) ){
 842     vdbeMemClearExternAndSetNull(pMem);
 843   }else{
 844     pMem->flags = MEM_Null;
 845   }
 846 }
 847 void sqlite3ValueSetNull(sqlite3_value *p){
 848   sqlite3VdbeMemSetNull((Mem*)p);
 849 }
 850
 851 /*
 852 ** Delete any previous value and set the value to be a BLOB of length
 853 ** n containing all zeros.
 854 */
 855 #ifndef SQLITE_OMIT_INCRBLOB
 856 void sqlite3VdbeMemSetZeroBlob(Mem *pMem, int n){
 857   sqlite3VdbeMemRelease(pMem);
 858   pMem->flags = MEM_Blob|MEM_Zero;
 859   pMem->n = 0;
 860   if( n<0 ) n = 0;
 861   pMem->u.nZero = n;
 862   pMem->enc = SQLITE_UTF8;
 863   pMem->z = 0;
 864 }
 865 #else
 866 int sqlite3VdbeMemSetZeroBlob(Mem *pMem, int n){
 867   int nByte = n>0?n:1;
 868   if( sqlite3VdbeMemGrow(pMem, nByte, 0) ){
 869     return SQLITE_NOMEM_BKPT;
 870   }
 871   assert( pMem->z!=0 );
 872   assert( sqlite3DbMallocSize(pMem->db, pMem->z)>=nByte );
 873   memset(pMem->z, 0, nByte);
 874   pMem->n = n>0?n:0;
 875   pMem->flags = MEM_Blob;
 876   pMem->enc = SQLITE_UTF8;
 877   return SQLITE_OK;
 878 }
 879 #endif
 880
 881 /*
 882 ** The pMem is known to contain content that needs to be destroyed prior
 883 ** to a value change.  So invoke the destructor, then set the value to
 884 ** a 64-bit integer.
 885 */
 886 static SQLITE_NOINLINE void vdbeReleaseAndSetInt64(Mem *pMem, i64 val){
 887   sqlite3VdbeMemSetNull(pMem);
 888   pMem->u.i = val;
 889   pMem->flags = MEM_Int;
 890 }
 891
 892 /*
 893 ** Delete any previous value and set the value stored in *pMem to val,
 894 ** manifest type INTEGER.
 895 */
 896 void sqlite3VdbeMemSetInt64(Mem *pMem, i64 val){
 897   if( VdbeMemDynamic(pMem) ){
 898     vdbeReleaseAndSetInt64(pMem, val);
 899   }else{
 900     pMem->u.i = val;
 901     pMem->flags = MEM_Int;
 902   }
 903 }
 904
 905 /* A no-op destructor */
 906 void sqlite3NoopDestructor(void *p){ UNUSED_PARAMETER(p); }
 907
 908 /*
 909 ** Set the value stored in *pMem should already be a NULL.
 910 ** Also store a pointer to go with it.
 911 */
 912 void sqlite3VdbeMemSetPointer(
 913   Mem *pMem,
 914   void *pPtr,
 915   const char *zPType,
 916   void (*xDestructor)(void*)
 917 ){
 918   assert( pMem->flags==MEM_Null );
 919   pMem->u.zPType = zPType ? zPType : "";
 920   pMem->z = pPtr;
 921   pMem->flags = MEM_Null|MEM_Dyn|MEM_Subtype|MEM_Term;
 922   pMem->eSubtype = 'p';
 923   pMem->xDel = xDestructor ? xDestructor : sqlite3NoopDestructor;
 924 }
 925
 926 #ifndef SQLITE_OMIT_FLOATING_POINT
 927 /*
 928 ** Delete any previous value and set the value stored in *pMem to val,
 929 ** manifest type REAL.
 930 */
 931 void sqlite3VdbeMemSetDouble(Mem *pMem, double val){
 932   sqlite3VdbeMemSetNull(pMem);
 933   if( !sqlite3IsNaN(val) ){
 934     pMem->u.r = val;
 935     pMem->flags = MEM_Real;
 936   }
 937 }
 938 #endif
 939
 940 #ifdef SQLITE_DEBUG
 941 /*
 942 ** Return true if the Mem holds a RowSet object.  This routine is intended
 943 ** for use inside of assert() statements.
 944 */
 945 int sqlite3VdbeMemIsRowSet(const Mem *pMem){
 946   return (pMem->flags&(MEM_Blob|MEM_Dyn))==(MEM_Blob|MEM_Dyn)
 947          && pMem->xDel==sqlite3RowSetDelete;
 948 }
 949 #endif
 950
 951 /*
 952 ** Delete any previous value and set the value of pMem to be an
 953 ** empty boolean index.
 954 **
 955 ** Return SQLITE_OK on success and SQLITE_NOMEM if a memory allocation
 956 ** error occurs.
 957 */
 958 int sqlite3VdbeMemSetRowSet(Mem *pMem){
 959   sqlite3 *db = pMem->db;
 960   RowSet *p;
 961   assert( db!=0 );
 962   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 963   sqlite3VdbeMemRelease(pMem);
 964   p = sqlite3RowSetInit(db);
 965   if( p==0 ) return SQLITE_NOMEM;
 966   pMem->z = (char*)p;
 967   pMem->flags = MEM_Blob|MEM_Dyn;
 968   pMem->xDel = sqlite3RowSetDelete;
 969   return SQLITE_OK;
 970 }
 971
 972 /*
 973 ** Return true if the Mem object contains a TEXT or BLOB that is
 974 ** too large - whose size exceeds SQLITE_MAX_LENGTH.
 975 */
 976 int sqlite3VdbeMemTooBig(Mem *p){
 977   assert( p->db!=0 );
 978   if( p->flags & (MEM_Str|MEM_Blob) ){
 979     int n = p->n;
 980     if( p->flags & MEM_Zero ){
 981       n += p->u.nZero;
 982     }
 983     return n>p->db->aLimit[SQLITE_LIMIT_LENGTH];
 984   }
 985   return 0;
 986 }
 987
 988 #ifdef SQLITE_DEBUG
 989 /*
 990 ** This routine prepares a memory cell for modification by breaking
 991 ** its link to a shallow copy and by marking any current shallow
 992 ** copies of this cell as invalid.
 993 **
 994 ** This is used for testing and debugging only - to help ensure that shallow
 995 ** copies (created by OP_SCopy) are not misused.
 996 */
 997 void sqlite3VdbeMemAboutToChange(Vdbe *pVdbe, Mem *pMem){
 998   int i;
 999   Mem *pX;
1000   for(i=1, pX=pVdbe->aMem+1; i<pVdbe->nMem; i++, pX++){
1001     if( pX->pScopyFrom==pMem ){
1002       u16 mFlags;
1003       if( pVdbe->db->flags & SQLITE_VdbeTrace ){
1004         sqlite3DebugPrintf("Invalidate R[%d] due to change in R[%d]\n",
1005           (int)(pX - pVdbe->aMem), (int)(pMem - pVdbe->aMem));
1006       }
1007       /* If pX is marked as a shallow copy of pMem, then try to verify that
1008       ** no significant changes have been made to pX since the OP_SCopy.
1009       ** A significant change would indicated a missed call to this
1010       ** function for pX.  Minor changes, such as adding or removing a
1011       ** dual type, are allowed, as long as the underlying value is the
1012       ** same. */
1013       mFlags = pMem->flags & pX->flags & pX->mScopyFlags;
1014       assert( (mFlags&(MEM_Int|MEM_IntReal))==0 || pMem->u.i==pX->u.i );
1015
1016       /* pMem is the register that is changing.  But also mark pX as
1017       ** undefined so that we can quickly detect the shallow-copy error */
1018       pX->flags = MEM_Undefined;
1019       pX->pScopyFrom = 0;
1020     }
1021   }
1022   pMem->pScopyFrom = 0;
1023 }
1024 #endif /* SQLITE_DEBUG */
1025
1026 /*
1027 ** Make an shallow copy of pFrom into pTo.  Prior contents of
1028 ** pTo are freed.  The pFrom->z field is not duplicated.  If
1029 ** pFrom->z is used, then pTo->z points to the same thing as pFrom->z
1030 ** and flags gets srcType (either MEM_Ephem or MEM_Static).
1031 */
1032 static SQLITE_NOINLINE void vdbeClrCopy(Mem *pTo, const Mem *pFrom, int eType){
1033   vdbeMemClearExternAndSetNull(pTo);
1034   assert( !VdbeMemDynamic(pTo) );
1035   sqlite3VdbeMemShallowCopy(pTo, pFrom, eType);
1036 }
1037 void sqlite3VdbeMemShallowCopy(Mem *pTo, const Mem *pFrom, int srcType){
1038   assert( !sqlite3VdbeMemIsRowSet(pFrom) );
1039   assert( pTo->db==pFrom->db );
1040   if( VdbeMemDynamic(pTo) ){ vdbeClrCopy(pTo,pFrom,srcType); return; }
1041   memcpy(pTo, pFrom, MEMCELLSIZE);
1042   if( (pFrom->flags&MEM_Static)==0 ){
1043     pTo->flags &= ~(MEM_Dyn|MEM_Static|MEM_Ephem);
1044     assert( srcType==MEM_Ephem || srcType==MEM_Static );
1045     pTo->flags |= srcType;
1046   }
1047 }
1048
1049 /*
1050 ** Make a full copy of pFrom into pTo.  Prior contents of pTo are
1051 ** freed before the copy is made.
1052 */
1053 int sqlite3VdbeMemCopy(Mem *pTo, const Mem *pFrom){
1054   int rc = SQLITE_OK;
1055
1056   assert( !sqlite3VdbeMemIsRowSet(pFrom) );
1057   if( VdbeMemDynamic(pTo) ) vdbeMemClearExternAndSetNull(pTo);
1058   memcpy(pTo, pFrom, MEMCELLSIZE);
1059   pTo->flags &= ~MEM_Dyn;
1060   if( pTo->flags&(MEM_Str|MEM_Blob) ){
1061     if( 0==(pFrom->flags&MEM_Static) ){
1062       pTo->flags |= MEM_Ephem;
1063       rc = sqlite3VdbeMemMakeWriteable(pTo);
1064     }
1065   }
1066
1067   return rc;
1068 }
1069
1070 /*
1071 ** Transfer the contents of pFrom to pTo. Any existing value in pTo is
1072 ** freed. If pFrom contains ephemeral data, a copy is made.
1073 **
1074 ** pFrom contains an SQL NULL when this routine returns.
1075 */
1076 void sqlite3VdbeMemMove(Mem *pTo, Mem *pFrom){
1077   assert( pFrom->db==0 || sqlite3_mutex_held(pFrom->db->mutex) );
1078   assert( pTo->db==0 || sqlite3_mutex_held(pTo->db->mutex) );
1079   assert( pFrom->db==0 || pTo->db==0 || pFrom->db==pTo->db );
1080
1081   sqlite3VdbeMemRelease(pTo);
1082   memcpy(pTo, pFrom, sizeof(Mem));
1083   pFrom->flags = MEM_Null;
1084   pFrom->szMalloc = 0;
1085 }
1086
1087 /*
1088 ** Change the value of a Mem to be a string or a BLOB.
1089 **
1090 ** The memory management strategy depends on the value of the xDel
1091 ** parameter. If the value passed is SQLITE_TRANSIENT, then the
1092 ** string is copied into a (possibly existing) buffer managed by the
1093 ** Mem structure. Otherwise, any existing buffer is freed and the
1094 ** pointer copied.
1095 **
1096 ** If the string is too large (if it exceeds the SQLITE_LIMIT_LENGTH
1097 ** size limit) then no memory allocation occurs.  If the string can be
1098 ** stored without allocating memory, then it is.  If a memory allocation
1099 ** is required to store the string, then value of pMem is unchanged.  In
1100 ** either case, SQLITE_TOOBIG is returned.
1101 */
1102 int sqlite3VdbeMemSetStr(
1103   Mem *pMem,          /* Memory cell to set to string value */
1104   const char *z,      /* String pointer */
1105   i64 n,              /* Bytes in string, or negative */
1106   u8 enc,             /* Encoding of z.  0 for BLOBs */
1107   void (*xDel)(void*) /* Destructor function */
1108 ){
1109   i64 nByte = n;      /* New value for pMem->n */
1110   int iLimit;         /* Maximum allowed string or blob size */
1111   u16 flags = 0;      /* New value for pMem->flags */
1112
1113   assert( pMem!=0 );
1114   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
1115   assert( !sqlite3VdbeMemIsRowSet(pMem) );
1116
1117   /* If z is a NULL pointer, set pMem to contain an SQL NULL. */
1118   if( !z ){
1119     sqlite3VdbeMemSetNull(pMem);
1120     return SQLITE_OK;
1121   }
1122
1123   if( pMem->db ){
1124     iLimit = pMem->db->aLimit[SQLITE_LIMIT_LENGTH];
1125   }else{
1126     iLimit = SQLITE_MAX_LENGTH;
1127   }
1128   flags = (enc==0?MEM_Blob:MEM_Str);
1129   if( nByte<0 ){
1130     assert( enc!=0 );
1131     if( enc==SQLITE_UTF8 ){
1132       nByte = strlen(z);
1133     }else{
1134       for(nByte=0; nByte<=iLimit && (z[nByte] | z[nByte+1]); nByte+=2){}
1135     }
1136     flags |= MEM_Term;
1137   }
1138
1139   /* The following block sets the new values of Mem.z and Mem.xDel. It
1140   ** also sets a flag in local variable "flags" to indicate the memory
1141   ** management (one of MEM_Dyn or MEM_Static).
1142   */
1143   if( xDel==SQLITE_TRANSIENT ){
1144     i64 nAlloc = nByte;
1145     if( flags&MEM_Term ){
1146       nAlloc += (enc==SQLITE_UTF8?1:2);
1147     }
1148     if( nByte>iLimit ){
1149       return sqlite3ErrorToParser(pMem->db, SQLITE_TOOBIG);
1150     }
1151     testcase( nAlloc==0 );
1152     testcase( nAlloc==31 );
1153     testcase( nAlloc==32 );
1154     if( sqlite3VdbeMemClearAndResize(pMem, (int)MAX(nAlloc,32)) ){
1155       return SQLITE_NOMEM_BKPT;
1156     }
1157     memcpy(pMem->z, z, nAlloc);
1158   }else{
1159     sqlite3VdbeMemRelease(pMem);
1160     pMem->z = (char *)z;
1161     if( xDel==SQLITE_DYNAMIC ){
1162       pMem->zMalloc = pMem->z;
1163       pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
1164     }else{
1165       pMem->xDel = xDel;
1166       flags |= ((xDel==SQLITE_STATIC)?MEM_Static:MEM_Dyn);
1167     }
1168   }
1169
1170   pMem->n = (int)(nByte & 0x7fffffff);
1171   pMem->flags = flags;
1172   if( enc ){
1173     pMem->enc = enc;
1174 #ifdef SQLITE_ENABLE_SESSION
1175   }else if( pMem->db==0 ){
1176     pMem->enc = SQLITE_UTF8;
1177 #endif
1178   }else{
1179     assert( pMem->db!=0 );
1180     pMem->enc = ENC(pMem->db);
1181   }
1182
1183 #ifndef SQLITE_OMIT_UTF16
1184   if( enc>SQLITE_UTF8 && sqlite3VdbeMemHandleBom(pMem) ){
1185     return SQLITE_NOMEM_BKPT;
1186   }
1187 #endif
1188
1189   if( nByte>iLimit ){
1190     return sqlite3ErrorToParser(pMem->db, SQLITE_TOOBIG);
1191   }
1192
1193   return SQLITE_OK;
1194 }
1195
1196 /*
1197 ** Move data out of a btree key or data field and into a Mem structure.
1198 ** The data is payload from the entry that pCur is currently pointing
1199 ** to.  offset and amt determine what portion of the data or key to retrieve.
1200 ** The result is written into the pMem element.
1201 **
1202 ** The pMem object must have been initialized.  This routine will use
1203 ** pMem->zMalloc to hold the content from the btree, if possible.  New
1204 ** pMem->zMalloc space will be allocated if necessary.  The calling routine
1205 ** is responsible for making sure that the pMem object is eventually
1206 ** destroyed.
1207 **
1208 ** If this routine fails for any reason (malloc returns NULL or unable
1209 ** to read from the disk) then the pMem is left in an inconsistent state.
1210 */
1211 int sqlite3VdbeMemFromBtree(
1212   BtCursor *pCur,   /* Cursor pointing at record to retrieve. */
1213   u32 offset,       /* Offset from the start of data to return bytes from. */
1214   u32 amt,          /* Number of bytes to return. */
1215   Mem *pMem         /* OUT: Return data in this Mem structure. */
1216 ){
1217   int rc;
1218   pMem->flags = MEM_Null;
1219   if( sqlite3BtreeMaxRecordSize(pCur)<offset+amt ){
1220     return SQLITE_CORRUPT_BKPT;
1221   }
1222   if( SQLITE_OK==(rc = sqlite3VdbeMemClearAndResize(pMem, amt+1)) ){
1223     rc = sqlite3BtreePayload(pCur, offset, amt, pMem->z);
1224     if( rc==SQLITE_OK ){
1225       pMem->z[amt] = 0;   /* Overrun area used when reading malformed records */
1226       pMem->flags = MEM_Blob;
1227       pMem->n = (int)amt;
1228     }else{
1229       sqlite3VdbeMemRelease(pMem);
1230     }
1231   }
1232   return rc;
1233 }
1234 int sqlite3VdbeMemFromBtreeZeroOffset(
1235   BtCursor *pCur,   /* Cursor pointing at record to retrieve. */
1236   u32 amt,          /* Number of bytes to return. */
1237   Mem *pMem         /* OUT: Return data in this Mem structure. */
1238 ){
1239   u32 available = 0;  /* Number of bytes available on the local btree page */
1240   int rc = SQLITE_OK; /* Return code */
1241
1242   assert( sqlite3BtreeCursorIsValid(pCur) );
1243   assert( !VdbeMemDynamic(pMem) );
1244
1245   /* Note: the calls to BtreeKeyFetch() and DataFetch() below assert()
1246   ** that both the BtShared and database handle mutexes are held. */
1247   assert( !sqlite3VdbeMemIsRowSet(pMem) );
1248   pMem->z = (char *)sqlite3BtreePayloadFetch(pCur, &available);
1249   assert( pMem->z!=0 );
1250
1251   if( amt<=available ){
1252     pMem->flags = MEM_Blob|MEM_Ephem;
1253     pMem->n = (int)amt;
1254   }else{
1255     rc = sqlite3VdbeMemFromBtree(pCur, 0, amt, pMem);
1256   }
1257
1258   return rc;
1259 }
1260
1261 /*
1262 ** The pVal argument is known to be a value other than NULL.
1263 ** Convert it into a string with encoding enc and return a pointer
1264 ** to a zero-terminated version of that string.
1265 */
1266 static SQLITE_NOINLINE const void *valueToText(sqlite3_value* pVal, u8 enc){
1267   assert( pVal!=0 );
1268   assert( pVal->db==0 || sqlite3_mutex_held(pVal->db->mutex) );
1269   assert( (enc&3)==(enc&~SQLITE_UTF16_ALIGNED) );
1270   assert( !sqlite3VdbeMemIsRowSet(pVal) );
1271   assert( (pVal->flags & (MEM_Null))==0 );
1272   if( pVal->flags & (MEM_Blob|MEM_Str) ){
1273     if( ExpandBlob(pVal) ) return 0;
1274     pVal->flags |= MEM_Str;
1275     if( pVal->enc != (enc & ~SQLITE_UTF16_ALIGNED) ){
1276       sqlite3VdbeChangeEncoding(pVal, enc & ~SQLITE_UTF16_ALIGNED);
1277     }
1278     if( (enc & SQLITE_UTF16_ALIGNED)!=0 && 1==(1&SQLITE_PTR_TO_INT(pVal->z)) ){
1279       assert( (pVal->flags & (MEM_Ephem|MEM_Static))!=0 );
1280       if( sqlite3VdbeMemMakeWriteable(pVal)!=SQLITE_OK ){
1281         return 0;
1282       }
1283     }
1284     sqlite3VdbeMemNulTerminate(pVal); /* IMP: R-31275-44060 */
1285   }else{
1286     sqlite3VdbeMemStringify(pVal, enc, 0);
1287     assert( 0==(1&SQLITE_PTR_TO_INT(pVal->z)) );
1288   }
1289   assert(pVal->enc==(enc & ~SQLITE_UTF16_ALIGNED) || pVal->db==0
1290               || pVal->db->mallocFailed );
1291   if( pVal->enc==(enc & ~SQLITE_UTF16_ALIGNED) ){
1292     assert( sqlite3VdbeMemValidStrRep(pVal) );
1293     return pVal->z;
1294   }else{
1295     return 0;
1296   }
1297 }
1298
1299 /* This function is only available internally, it is not part of the
1300 ** external API. It works in a similar way to sqlite3_value_text(),
1301 ** except the data returned is in the encoding specified by the second
1302 ** parameter, which must be one of SQLITE_UTF16BE, SQLITE_UTF16LE or
1303 ** SQLITE_UTF8.
1304 **
1305 ** (2006-02-16:)  The enc value can be or-ed with SQLITE_UTF16_ALIGNED.
1306 ** If that is the case, then the result must be aligned on an even byte
1307 ** boundary.
1308 */
1309 const void *sqlite3ValueText(sqlite3_value* pVal, u8 enc){
1310   if( !pVal ) return 0;
1311   assert( pVal->db==0 || sqlite3_mutex_held(pVal->db->mutex) );
1312   assert( (enc&3)==(enc&~SQLITE_UTF16_ALIGNED) );
1313   assert( !sqlite3VdbeMemIsRowSet(pVal) );
1314   if( (pVal->flags&(MEM_Str|MEM_Term))==(MEM_Str|MEM_Term) && pVal->enc==enc ){
1315     assert( sqlite3VdbeMemValidStrRep(pVal) );
1316     return pVal->z;
1317   }
1318   if( pVal->flags&MEM_Null ){
1319     return 0;
1320   }
1321   return valueToText(pVal, enc);
1322 }
1323
1324 /*
1325 ** Create a new sqlite3_value object.
1326 */
1327 sqlite3_value *sqlite3ValueNew(sqlite3 *db){
1328   Mem *p = sqlite3DbMallocZero(db, sizeof(*p));
1329   if( p ){
1330     p->flags = MEM_Null;
1331     p->db = db;
1332   }
1333   return p;
1334 }
1335
1336 /*
1337 ** Context object passed by sqlite3Stat4ProbeSetValue() through to
1338 ** valueNew(). See comments above valueNew() for details.
1339 */
1340 struct ValueNewStat4Ctx {
1341   Parse *pParse;
1342   Index *pIdx;
1343   UnpackedRecord **ppRec;
1344   int iVal;
1345 };
1346
1347 /*
1348 ** Allocate and return a pointer to a new sqlite3_value object. If
1349 ** the second argument to this function is NULL, the object is allocated
1350 ** by calling sqlite3ValueNew().
1351 **
1352 ** Otherwise, if the second argument is non-zero, then this function is
1353 ** being called indirectly by sqlite3Stat4ProbeSetValue(). If it has not
1354 ** already been allocated, allocate the UnpackedRecord structure that
1355 ** that function will return to its caller here. Then return a pointer to
1356 ** an sqlite3_value within the UnpackedRecord.a[] array.
1357 */
1358 static sqlite3_value *valueNew(sqlite3 *db, struct ValueNewStat4Ctx *p){
1359 #ifdef SQLITE_ENABLE_STAT4
1360   if( p ){
1361     UnpackedRecord *pRec = p->ppRec[0];
1362
1363     if( pRec==0 ){
1364       Index *pIdx = p->pIdx;      /* Index being probed */
1365       int nByte;                  /* Bytes of space to allocate */
1366       int i;                      /* Counter variable */
1367       int nCol = pIdx->nColumn;   /* Number of index columns including rowid */
1368
1369       nByte = sizeof(Mem) * nCol + ROUND8(sizeof(UnpackedRecord));
1370       pRec = (UnpackedRecord*)sqlite3DbMallocZero(db, nByte);
1371       if( pRec ){
1372         pRec->pKeyInfo = sqlite3KeyInfoOfIndex(p->pParse, pIdx);
1373         if( pRec->pKeyInfo ){
1374           assert( pRec->pKeyInfo->nAllField==nCol );
1375           assert( pRec->pKeyInfo->enc==ENC(db) );
1376           pRec->aMem = (Mem *)((u8*)pRec + ROUND8(sizeof(UnpackedRecord)));
1377           for(i=0; i<nCol; i++){
1378             pRec->aMem[i].flags = MEM_Null;
1379             pRec->aMem[i].db = db;
1380           }
1381         }else{
1382           sqlite3DbFreeNN(db, pRec);
1383           pRec = 0;
1384         }
1385       }
1386       if( pRec==0 ) return 0;
1387       p->ppRec[0] = pRec;
1388     }
1389
1390     pRec->nField = p->iVal+1;
1391     return &pRec->aMem[p->iVal];
1392   }
1393 #else
1394   UNUSED_PARAMETER(p);
1395 #endif /* defined(SQLITE_ENABLE_STAT4) */
1396   return sqlite3ValueNew(db);
1397 }
1398
1399 /*
1400 ** The expression object indicated by the second argument is guaranteed
1401 ** to be a scalar SQL function. If
1402 **
1403 **   * all function arguments are SQL literals,
1404 **   * one of the SQLITE_FUNC_CONSTANT or _SLOCHNG function flags is set, and
1405 **   * the SQLITE_FUNC_NEEDCOLL function flag is not set,
1406 **
1407 ** then this routine attempts to invoke the SQL function. Assuming no
1408 ** error occurs, output parameter (*ppVal) is set to point to a value
1409 ** object containing the result before returning SQLITE_OK.
1410 **
1411 ** Affinity aff is applied to the result of the function before returning.
1412 ** If the result is a text value, the sqlite3_value object uses encoding
1413 ** enc.
1414 **
1415 ** If the conditions above are not met, this function returns SQLITE_OK
1416 ** and sets (*ppVal) to NULL. Or, if an error occurs, (*ppVal) is set to
1417 ** NULL and an SQLite error code returned.
1418 */
1419 #ifdef SQLITE_ENABLE_STAT4
1420 static int valueFromFunction(
1421   sqlite3 *db,                    /* The database connection */
1422   const Expr *p,                  /* The expression to evaluate */
1423   u8 enc,                         /* Encoding to use */
1424   u8 aff,                         /* Affinity to use */
1425   sqlite3_value **ppVal,          /* Write the new value here */
1426   struct ValueNewStat4Ctx *pCtx   /* Second argument for valueNew() */
1427 ){
1428   sqlite3_context ctx;            /* Context object for function invocation */
1429   sqlite3_value **apVal = 0;      /* Function arguments */
1430   int nVal = 0;                   /* Size of apVal[] array */
1431   FuncDef *pFunc = 0;             /* Function definition */
1432   sqlite3_value *pVal = 0;        /* New value */
1433   int rc = SQLITE_OK;             /* Return code */
1434   ExprList *pList = 0;            /* Function arguments */
1435   int i;                          /* Iterator variable */
1436
1437   assert( pCtx!=0 );
1438   assert( (p->flags & EP_TokenOnly)==0 );
1439   assert( ExprUseXList(p) );
1440   pList = p->x.pList;
1441   if( pList ) nVal = pList->nExpr;
1442   assert( !ExprHasProperty(p, EP_IntValue) );
1443   pFunc = sqlite3FindFunction(db, p->u.zToken, nVal, enc, 0);
1444   assert( pFunc );
1445   if( (pFunc->funcFlags & (SQLITE_FUNC_CONSTANT|SQLITE_FUNC_SLOCHNG))==0
1446    || (pFunc->funcFlags & SQLITE_FUNC_NEEDCOLL)
1447   ){
1448     return SQLITE_OK;
1449   }
1450
1451   if( pList ){
1452     apVal = (sqlite3_value**)sqlite3DbMallocZero(db, sizeof(apVal[0]) * nVal);
1453     if( apVal==0 ){
1454       rc = SQLITE_NOMEM_BKPT;
1455       goto value_from_function_out;
1456     }
1457     for(i=0; i<nVal; i++){
1458       rc = sqlite3ValueFromExpr(db, pList->a[i].pExpr, enc, aff, &apVal[i]);
1459       if( apVal[i]==0 || rc!=SQLITE_OK ) goto value_from_function_out;
1460     }
1461   }
1462
1463   pVal = valueNew(db, pCtx);
1464   if( pVal==0 ){
1465     rc = SQLITE_NOMEM_BKPT;
1466     goto value_from_function_out;
1467   }
1468
1469   assert( pCtx->pParse->rc==SQLITE_OK );
1470   memset(&ctx, 0, sizeof(ctx));
1471   ctx.pOut = pVal;
1472   ctx.pFunc = pFunc;
1473   pFunc->xSFunc(&ctx, nVal, apVal);
1474   if( ctx.isError ){
1475     rc = ctx.isError;
1476     sqlite3ErrorMsg(pCtx->pParse, "%s", sqlite3_value_text(pVal));
1477   }else{
1478     sqlite3ValueApplyAffinity(pVal, aff, SQLITE_UTF8);
1479     assert( rc==SQLITE_OK );
1480     rc = sqlite3VdbeChangeEncoding(pVal, enc);
1481     if( rc==SQLITE_OK && sqlite3VdbeMemTooBig(pVal) ){
1482       rc = SQLITE_TOOBIG;
1483       pCtx->pParse->nErr++;
1484     }
1485   }
1486   pCtx->pParse->rc = rc;
1487
1488  value_from_function_out:
1489   if( rc!=SQLITE_OK ){
1490     pVal = 0;
1491   }
1492   if( apVal ){
1493     for(i=0; i<nVal; i++){
1494       sqlite3ValueFree(apVal[i]);
1495     }
1496     sqlite3DbFreeNN(db, apVal);
1497   }
1498
1499   *ppVal = pVal;
1500   return rc;
1501 }
1502 #else
1503 # define valueFromFunction(a,b,c,d,e,f) SQLITE_OK
1504 #endif /* defined(SQLITE_ENABLE_STAT4) */
1505
1506 /*
1507 ** Extract a value from the supplied expression in the manner described
1508 ** above sqlite3ValueFromExpr(). Allocate the sqlite3_value object
1509 ** using valueNew().
1510 **
1511 ** If pCtx is NULL and an error occurs after the sqlite3_value object
1512 ** has been allocated, it is freed before returning. Or, if pCtx is not
1513 ** NULL, it is assumed that the caller will free any allocated object
1514 ** in all cases.
1515 */
1516 static int valueFromExpr(
1517   sqlite3 *db,                    /* The database connection */
1518   const Expr *pExpr,              /* The expression to evaluate */
1519   u8 enc,                         /* Encoding to use */
1520   u8 affinity,                    /* Affinity to use */
1521   sqlite3_value **ppVal,          /* Write the new value here */
1522   struct ValueNewStat4Ctx *pCtx   /* Second argument for valueNew() */
1523 ){
1524   int op;
1525   char *zVal = 0;
1526   sqlite3_value *pVal = 0;
1527   int negInt = 1;
1528   const char *zNeg = "";
1529   int rc = SQLITE_OK;
1530
1531   assert( pExpr!=0 );
1532   while( (op = pExpr->op)==TK_UPLUS || op==TK_SPAN ) pExpr = pExpr->pLeft;
1533 #if defined(SQLITE_ENABLE_STAT4)
1534   if( op==TK_REGISTER ) op = pExpr->op2;
1535 #else
1536   if( NEVER(op==TK_REGISTER) ) op = pExpr->op2;
1537 #endif
1538
1539   /* Compressed expressions only appear when parsing the DEFAULT clause
1540   ** on a table column definition, and hence only when pCtx==0.  This
1541   ** check ensures that an EP_TokenOnly expression is never passed down
1542   ** into valueFromFunction(). */
1543   assert( (pExpr->flags & EP_TokenOnly)==0 || pCtx==0 );
1544
1545   if( op==TK_CAST ){
1546     u8 aff;
1547     assert( !ExprHasProperty(pExpr, EP_IntValue) );
1548     aff = sqlite3AffinityType(pExpr->u.zToken,0);
1549     rc = valueFromExpr(db, pExpr->pLeft, enc, aff, ppVal, pCtx);
1550     testcase( rc!=SQLITE_OK );
1551     if( *ppVal ){
1552       sqlite3VdbeMemCast(*ppVal, aff, SQLITE_UTF8);
1553       sqlite3ValueApplyAffinity(*ppVal, affinity, SQLITE_UTF8);
1554     }
1555     return rc;
1556   }
1557
1558   /* Handle negative integers in a single step.  This is needed in the
1559   ** case when the value is -9223372036854775808.
1560   */
1561   if( op==TK_UMINUS
1562    && (pExpr->pLeft->op==TK_INTEGER || pExpr->pLeft->op==TK_FLOAT) ){
1563     pExpr = pExpr->pLeft;
1564     op = pExpr->op;
1565     negInt = -1;
1566     zNeg = "-";
1567   }
1568
1569   if( op==TK_STRING || op==TK_FLOAT || op==TK_INTEGER ){
1570     pVal = valueNew(db, pCtx);
1571     if( pVal==0 ) goto no_mem;
1572     if( ExprHasProperty(pExpr, EP_IntValue) ){
1573       sqlite3VdbeMemSetInt64(pVal, (i64)pExpr->u.iValue*negInt);
1574     }else{
1575       zVal = sqlite3MPrintf(db, "%s%s", zNeg, pExpr->u.zToken);
1576       if( zVal==0 ) goto no_mem;
1577       sqlite3ValueSetStr(pVal, -1, zVal, SQLITE_UTF8, SQLITE_DYNAMIC);
1578     }
1579     if( (op==TK_INTEGER || op==TK_FLOAT ) && affinity==SQLITE_AFF_BLOB ){
1580       sqlite3ValueApplyAffinity(pVal, SQLITE_AFF_NUMERIC, SQLITE_UTF8);
1581     }else{
1582       sqlite3ValueApplyAffinity(pVal, affinity, SQLITE_UTF8);
1583     }
1584     assert( (pVal->flags & MEM_IntReal)==0 );
1585     if( pVal->flags & (MEM_Int|MEM_IntReal|MEM_Real) ){
1586       testcase( pVal->flags & MEM_Int );
1587       testcase( pVal->flags & MEM_Real );
1588       pVal->flags &= ~MEM_Str;
1589     }
1590     if( enc!=SQLITE_UTF8 ){
1591       rc = sqlite3VdbeChangeEncoding(pVal, enc);
1592     }
1593   }else if( op==TK_UMINUS ) {
1594     /* This branch happens for multiple negative signs.  Ex: -(-5) */
1595     if( SQLITE_OK==valueFromExpr(db,pExpr->pLeft,enc,affinity,&pVal,pCtx)
1596      && pVal!=0
1597     ){
1598       sqlite3VdbeMemNumerify(pVal);
1599       if( pVal->flags & MEM_Real ){
1600         pVal->u.r = -pVal->u.r;
1601       }else if( pVal->u.i==SMALLEST_INT64 ){
1602 #ifndef SQLITE_OMIT_FLOATING_POINT
1603         pVal->u.r = -(double)SMALLEST_INT64;
1604 #else
1605         pVal->u.r = LARGEST_INT64;
1606 #endif
1607         MemSetTypeFlag(pVal, MEM_Real);
1608       }else{
1609         pVal->u.i = -pVal->u.i;
1610       }
1611       sqlite3ValueApplyAffinity(pVal, affinity, enc);
1612     }
1613   }else if( op==TK_NULL ){
1614     pVal = valueNew(db, pCtx);
1615     if( pVal==0 ) goto no_mem;
1616     sqlite3VdbeMemSetNull(pVal);
1617   }
1618 #ifndef SQLITE_OMIT_BLOB_LITERAL
1619   else if( op==TK_BLOB ){
1620     int nVal;
1621     assert( !ExprHasProperty(pExpr, EP_IntValue) );
1622     assert( pExpr->u.zToken[0]=='x' || pExpr->u.zToken[0]=='X' );
1623     assert( pExpr->u.zToken[1]=='\'' );
1624     pVal = valueNew(db, pCtx);
1625     if( !pVal ) goto no_mem;
1626     zVal = &pExpr->u.zToken[2];
1627     nVal = sqlite3Strlen30(zVal)-1;
1628     assert( zVal[nVal]=='\'' );
1629     sqlite3VdbeMemSetStr(pVal, sqlite3HexToBlob(db, zVal, nVal), nVal/2,
1630                          0, SQLITE_DYNAMIC);
1631   }
1632 #endif
1633 #ifdef SQLITE_ENABLE_STAT4
1634   else if( op==TK_FUNCTION && pCtx!=0 ){
1635     rc = valueFromFunction(db, pExpr, enc, affinity, &pVal, pCtx);
1636   }
1637 #endif
1638   else if( op==TK_TRUEFALSE ){
1639     assert( !ExprHasProperty(pExpr, EP_IntValue) );
1640     pVal = valueNew(db, pCtx);
1641     if( pVal ){
1642       pVal->flags = MEM_Int;
1643       pVal->u.i = pExpr->u.zToken[4]==0;
1644     }
1645   }
1646
1647   *ppVal = pVal;
1648   return rc;
1649
1650 no_mem:
1651 #ifdef SQLITE_ENABLE_STAT4
1652   if( pCtx==0 || pCtx->pParse->nErr==0 )
1653 #endif
1654     sqlite3OomFault(db);
1655   sqlite3DbFree(db, zVal);
1656   assert( *ppVal==0 );
1657 #ifdef SQLITE_ENABLE_STAT4
1658   if( pCtx==0 ) sqlite3ValueFree(pVal);
1659 #else
1660   assert( pCtx==0 ); sqlite3ValueFree(pVal);
1661 #endif
1662   return SQLITE_NOMEM_BKPT;
1663 }
1664
1665 /*
1666 ** Create a new sqlite3_value object, containing the value of pExpr.
1667 **
1668 ** This only works for very simple expressions that consist of one constant
1669 ** token (i.e. "5", "5.1", "'a string'"). If the expression can
1670 ** be converted directly into a value, then the value is allocated and
1671 ** a pointer written to *ppVal. The caller is responsible for deallocating
1672 ** the value by passing it to sqlite3ValueFree() later on. If the expression
1673 ** cannot be converted to a value, then *ppVal is set to NULL.
1674 */
1675 int sqlite3ValueFromExpr(
1676   sqlite3 *db,              /* The database connection */
1677   const Expr *pExpr,        /* The expression to evaluate */
1678   u8 enc,                   /* Encoding to use */
1679   u8 affinity,              /* Affinity to use */
1680   sqlite3_value **ppVal     /* Write the new value here */
1681 ){
1682   return pExpr ? valueFromExpr(db, pExpr, enc, affinity, ppVal, 0) : 0;
1683 }
1684
1685 #ifdef SQLITE_ENABLE_STAT4
1686 /*
1687 ** Attempt to extract a value from pExpr and use it to construct *ppVal.
1688 **
1689 ** If pAlloc is not NULL, then an UnpackedRecord object is created for
1690 ** pAlloc if one does not exist and the new value is added to the
1691 ** UnpackedRecord object.
1692 **
1693 ** A value is extracted in the following cases:
1694 **
1695 **  * (pExpr==0). In this case the value is assumed to be an SQL NULL,
1696 **
1697 **  * The expression is a bound variable, and this is a reprepare, or
1698 **
1699 **  * The expression is a literal value.
1700 **
1701 ** On success, *ppVal is made to point to the extracted value.  The caller
1702 ** is responsible for ensuring that the value is eventually freed.
1703 */
1704 static int stat4ValueFromExpr(
1705   Parse *pParse,                  /* Parse context */
1706   Expr *pExpr,                    /* The expression to extract a value from */
1707   u8 affinity,                    /* Affinity to use */
1708   struct ValueNewStat4Ctx *pAlloc,/* How to allocate space.  Or NULL */
1709   sqlite3_value **ppVal           /* OUT: New value object (or NULL) */
1710 ){
1711   int rc = SQLITE_OK;
1712   sqlite3_value *pVal = 0;
1713   sqlite3 *db = pParse->db;
1714
1715   /* Skip over any TK_COLLATE nodes */
1716   pExpr = sqlite3ExprSkipCollate(pExpr);
1717
1718   assert( pExpr==0 || pExpr->op!=TK_REGISTER || pExpr->op2!=TK_VARIABLE );
1719   if( !pExpr ){
1720     pVal = valueNew(db, pAlloc);
1721     if( pVal ){
1722       sqlite3VdbeMemSetNull((Mem*)pVal);
1723     }
1724   }else if( pExpr->op==TK_VARIABLE && (db->flags & SQLITE_EnableQPSG)==0 ){
1725     Vdbe *v;
1726     int iBindVar = pExpr->iColumn;
1727     sqlite3VdbeSetVarmask(pParse->pVdbe, iBindVar);
1728     if( (v = pParse->pReprepare)!=0 ){
1729       pVal = valueNew(db, pAlloc);
1730       if( pVal ){
1731         rc = sqlite3VdbeMemCopy((Mem*)pVal, &v->aVar[iBindVar-1]);
1732         sqlite3ValueApplyAffinity(pVal, affinity, ENC(db));
1733         pVal->db = pParse->db;
1734       }
1735     }
1736   }else{
1737     rc = valueFromExpr(db, pExpr, ENC(db), affinity, &pVal, pAlloc);
1738   }
1739
1740   assert( pVal==0 || pVal->db==db );
1741   *ppVal = pVal;
1742   return rc;
1743 }
1744
1745 /*
1746 ** This function is used to allocate and populate UnpackedRecord
1747 ** structures intended to be compared against sample index keys stored
1748 ** in the sqlite_stat4 table.
1749 **
1750 ** A single call to this function populates zero or more fields of the
1751 ** record starting with field iVal (fields are numbered from left to
1752 ** right starting with 0). A single field is populated if:
1753 **
1754 **  * (pExpr==0). In this case the value is assumed to be an SQL NULL,
1755 **
1756 **  * The expression is a bound variable, and this is a reprepare, or
1757 **
1758 **  * The sqlite3ValueFromExpr() function is able to extract a value
1759 **    from the expression (i.e. the expression is a literal value).
1760 **
1761 ** Or, if pExpr is a TK_VECTOR, one field is populated for each of the
1762 ** vector components that match either of the two latter criteria listed
1763 ** above.
1764 **
1765 ** Before any value is appended to the record, the affinity of the
1766 ** corresponding column within index pIdx is applied to it. Before
1767 ** this function returns, output parameter *pnExtract is set to the
1768 ** number of values appended to the record.
1769 **
1770 ** When this function is called, *ppRec must either point to an object
1771 ** allocated by an earlier call to this function, or must be NULL. If it
1772 ** is NULL and a value can be successfully extracted, a new UnpackedRecord
1773 ** is allocated (and *ppRec set to point to it) before returning.
1774 **
1775 ** Unless an error is encountered, SQLITE_OK is returned. It is not an
1776 ** error if a value cannot be extracted from pExpr. If an error does
1777 ** occur, an SQLite error code is returned.
1778 */
1779 int sqlite3Stat4ProbeSetValue(
1780   Parse *pParse,                  /* Parse context */
1781   Index *pIdx,                    /* Index being probed */
1782   UnpackedRecord **ppRec,         /* IN/OUT: Probe record */
1783   Expr *pExpr,                    /* The expression to extract a value from */
1784   int nElem,                      /* Maximum number of values to append */
1785   int iVal,                       /* Array element to populate */
1786   int *pnExtract                  /* OUT: Values appended to the record */
1787 ){
1788   int rc = SQLITE_OK;
1789   int nExtract = 0;
1790
1791   if( pExpr==0 || pExpr->op!=TK_SELECT ){
1792     int i;
1793     struct ValueNewStat4Ctx alloc;
1794
1795     alloc.pParse = pParse;
1796     alloc.pIdx = pIdx;
1797     alloc.ppRec = ppRec;
1798
1799     for(i=0; i<nElem; i++){
1800       sqlite3_value *pVal = 0;
1801       Expr *pElem = (pExpr ? sqlite3VectorFieldSubexpr(pExpr, i) : 0);
1802       u8 aff = sqlite3IndexColumnAffinity(pParse->db, pIdx, iVal+i);
1803       alloc.iVal = iVal+i;
1804       rc = stat4ValueFromExpr(pParse, pElem, aff, &alloc, &pVal);
1805       if( !pVal ) break;
1806       nExtract++;
1807     }
1808   }
1809
1810   *pnExtract = nExtract;
1811   return rc;
1812 }
1813
1814 /*
1815 ** Attempt to extract a value from expression pExpr using the methods
1816 ** as described for sqlite3Stat4ProbeSetValue() above.
1817 **
1818 ** If successful, set *ppVal to point to a new value object and return
1819 ** SQLITE_OK. If no value can be extracted, but no other error occurs
1820 ** (e.g. OOM), return SQLITE_OK and set *ppVal to NULL. Or, if an error
1821 ** does occur, return an SQLite error code. The final value of *ppVal
1822 ** is undefined in this case.
1823 */
1824 int sqlite3Stat4ValueFromExpr(
1825   Parse *pParse,                  /* Parse context */
1826   Expr *pExpr,                    /* The expression to extract a value from */
1827   u8 affinity,                    /* Affinity to use */
1828   sqlite3_value **ppVal           /* OUT: New value object (or NULL) */
1829 ){
1830   return stat4ValueFromExpr(pParse, pExpr, affinity, 0, ppVal);
1831 }
1832
1833 /*
1834 ** Extract the iCol-th column from the nRec-byte record in pRec.  Write
1835 ** the column value into *ppVal.  If *ppVal is initially NULL then a new
1836 ** sqlite3_value object is allocated.
1837 **
1838 ** If *ppVal is initially NULL then the caller is responsible for
1839 ** ensuring that the value written into *ppVal is eventually freed.
1840 */
1841 int sqlite3Stat4Column(
1842   sqlite3 *db,                    /* Database handle */
1843   const void *pRec,               /* Pointer to buffer containing record */
1844   int nRec,                       /* Size of buffer pRec in bytes */
1845   int iCol,                       /* Column to extract */
1846   sqlite3_value **ppVal           /* OUT: Extracted value */
1847 ){
1848   u32 t = 0;                      /* a column type code */
1849   int nHdr;                       /* Size of the header in the record */
1850   int iHdr;                       /* Next unread header byte */
1851   int iField;                     /* Next unread data byte */
1852   int szField = 0;                /* Size of the current data field */
1853   int i;                          /* Column index */
1854   u8 *a = (u8*)pRec;              /* Typecast byte array */
1855   Mem *pMem = *ppVal;             /* Write result into this Mem object */
1856
1857   assert( iCol>0 );
1858   iHdr = getVarint32(a, nHdr);
1859   if( nHdr>nRec || iHdr>=nHdr ) return SQLITE_CORRUPT_BKPT;
1860   iField = nHdr;
1861   for(i=0; i<=iCol; i++){
1862     iHdr += getVarint32(&a[iHdr], t);
1863     testcase( iHdr==nHdr );
1864     testcase( iHdr==nHdr+1 );
1865     if( iHdr>nHdr ) return SQLITE_CORRUPT_BKPT;
1866     szField = sqlite3VdbeSerialTypeLen(t);
1867     iField += szField;
1868   }
1869   testcase( iField==nRec );
1870   testcase( iField==nRec+1 );
1871   if( iField>nRec ) return SQLITE_CORRUPT_BKPT;
1872   if( pMem==0 ){
1873     pMem = *ppVal = sqlite3ValueNew(db);
1874     if( pMem==0 ) return SQLITE_NOMEM_BKPT;
1875   }
1876   sqlite3VdbeSerialGet(&a[iField-szField], t, pMem);
1877   pMem->enc = ENC(db);
1878   return SQLITE_OK;
1879 }
1880
1881 /*
1882 ** Unless it is NULL, the argument must be an UnpackedRecord object returned
1883 ** by an earlier call to sqlite3Stat4ProbeSetValue(). This call deletes
1884 ** the object.
1885 */
1886 void sqlite3Stat4ProbeFree(UnpackedRecord *pRec){
1887   if( pRec ){
1888     int i;
1889     int nCol = pRec->pKeyInfo->nAllField;
1890     Mem *aMem = pRec->aMem;
1891     sqlite3 *db = aMem[0].db;
1892     for(i=0; i<nCol; i++){
1893       sqlite3VdbeMemRelease(&aMem[i]);
1894     }
1895     sqlite3KeyInfoUnref(pRec->pKeyInfo);
1896     sqlite3DbFreeNN(db, pRec);
1897   }
1898 }
1899 #endif /* ifdef SQLITE_ENABLE_STAT4 */
1900
1901 /*
1902 ** Change the string value of an sqlite3_value object
1903 */
1904 void sqlite3ValueSetStr(
1905   sqlite3_value *v,     /* Value to be set */
1906   int n,                /* Length of string z */
1907   const void *z,        /* Text of the new string */
1908   u8 enc,               /* Encoding to use */
1909   void (*xDel)(void*)   /* Destructor for the string */
1910 ){
1911   if( v ) sqlite3VdbeMemSetStr((Mem *)v, z, n, enc, xDel);
1912 }
1913
1914 /*
1915 ** Free an sqlite3_value object
1916 */
1917 void sqlite3ValueFree(sqlite3_value *v){
1918   if( !v ) return;
1919   sqlite3VdbeMemRelease((Mem *)v);
1920   sqlite3DbFreeNN(((Mem*)v)->db, v);
1921 }
1922
1923 /*
1924 ** The sqlite3ValueBytes() routine returns the number of bytes in the
1925 ** sqlite3_value object assuming that it uses the encoding "enc".
1926 ** The valueBytes() routine is a helper function.
1927 */
1928 static SQLITE_NOINLINE int valueBytes(sqlite3_value *pVal, u8 enc){
1929   return valueToText(pVal, enc)!=0 ? pVal->n : 0;
1930 }
1931 int sqlite3ValueBytes(sqlite3_value *pVal, u8 enc){
1932   Mem *p = (Mem*)pVal;
1933   assert( (p->flags & MEM_Null)==0 || (p->flags & (MEM_Str|MEM_Blob))==0 );
1934   if( (p->flags & MEM_Str)!=0 && pVal->enc==enc ){
1935     return p->n;
1936   }
1937   if( (p->flags & MEM_Blob)!=0 ){
1938     if( p->flags & MEM_Zero ){
1939       return p->n + p->u.nZero;
1940     }else{
1941       return p->n;
1942     }
1943   }
1944   if( p->flags & MEM_Null ) return 0;
1945   return valueBytes(pVal, enc);
1946 }