src/vdbemem.c

   1 /*
   2 ** 2004 May 26
   3 **
   4 ** The author disclaims copyright to this source code.  In place of
   5 ** a legal notice, here is a blessing:
   6 **
   7 **    May you do good and not evil.
   8 **    May you find forgiveness for yourself and forgive others.
   9 **    May you share freely, never taking more than you give.
  10 **
  11 *************************************************************************
  12 **
  13 ** This file contains code use to manipulate "Mem" structure.  A "Mem"
  14 ** stores a single value in the VDBE.  Mem is an opaque structure visible
  15 ** only within the VDBE.  Interface routines refer to a Mem using the
  16 ** name sqlite_value
  17 */
  18 #include "sqliteInt.h"
  19 #include "vdbeInt.h"
  20
  21 #ifdef SQLITE_DEBUG
  22 /*
  23 ** Check invariants on a Mem object.
  24 **
  25 ** This routine is intended for use inside of assert() statements, like
  26 ** this:    assert( sqlite3VdbeCheckMemInvariants(pMem) );
  27 */
  28 int sqlite3VdbeCheckMemInvariants(Mem *p){
  29   /* If MEM_Dyn is set then Mem.xDel!=0.
  30   ** Mem.xDel might not be initialized if MEM_Dyn is clear.
  31   */
  32   assert( (p->flags & MEM_Dyn)==0 || p->xDel!=0 );
  33
  34   /* MEM_Dyn may only be set if Mem.szMalloc==0.  In this way we
  35   ** ensure that if Mem.szMalloc>0 then it is safe to do
  36   ** Mem.z = Mem.zMalloc without having to check Mem.flags&MEM_Dyn.
  37   ** That saves a few cycles in inner loops. */
  38   assert( (p->flags & MEM_Dyn)==0 || p->szMalloc==0 );
  39
  40   /* Cannot be both MEM_Int and MEM_Real at the same time */
  41   assert( (p->flags & (MEM_Int|MEM_Real))!=(MEM_Int|MEM_Real) );
  42
  43   if( p->flags & MEM_Null ){
  44     /* Cannot be both MEM_Null and some other type */
  45     assert( (p->flags & (MEM_Int|MEM_Real|MEM_Str|MEM_Blob
  46                          |MEM_RowSet|MEM_Frame|MEM_Agg|MEM_Zero))==0 );
  47
  48     /* If MEM_Null is set, then either the value is a pure NULL (the usual
  49     ** case) or it is a pointer set using sqlite3_bind_pointer() or
  50     ** sqlite3_result_pointer().  If a pointer, then MEM_Term must also be
  51     ** set.
  52     */
  53     if( (p->flags & (MEM_Term|MEM_Subtype))==(MEM_Term|MEM_Subtype) ){
  54       /* This is a pointer type.  There may be a flag to indicate what to
  55       ** do with the pointer. */
  56       assert( ((p->flags&MEM_Dyn)!=0 ? 1 : 0) +
  57               ((p->flags&MEM_Ephem)!=0 ? 1 : 0) +
  58               ((p->flags&MEM_Static)!=0 ? 1 : 0) <= 1 );
  59
  60       /* No other bits set */
  61       assert( (p->flags & ~(MEM_Null|MEM_Term|MEM_Subtype
  62                            |MEM_Dyn|MEM_Ephem|MEM_Static))==0 );
  63     }else{
  64       /* A pure NULL might have other flags, such as MEM_Static, MEM_Dyn,
  65       ** MEM_Ephem, MEM_Cleared, or MEM_Subtype */
  66     }
  67   }else{
  68     /* The MEM_Cleared bit is only allowed on NULLs */
  69     assert( (p->flags & MEM_Cleared)==0 );
  70   }
  71
  72   /* The szMalloc field holds the correct memory allocation size */
  73   assert( p->szMalloc==0
  74        || p->szMalloc==sqlite3DbMallocSize(p->db,p->zMalloc) );
  75
  76   /* If p holds a string or blob, the Mem.z must point to exactly
  77   ** one of the following:
  78   **
  79   **   (1) Memory in Mem.zMalloc and managed by the Mem object
  80   **   (2) Memory to be freed using Mem.xDel
  81   **   (3) An ephemeral string or blob
  82   **   (4) A static string or blob
  83   */
  84   if( (p->flags & (MEM_Str|MEM_Blob)) && p->n>0 ){
  85     assert(
  86       ((p->szMalloc>0 && p->z==p->zMalloc)? 1 : 0) +
  87       ((p->flags&MEM_Dyn)!=0 ? 1 : 0) +
  88       ((p->flags&MEM_Ephem)!=0 ? 1 : 0) +
  89       ((p->flags&MEM_Static)!=0 ? 1 : 0) == 1
  90     );
  91   }
  92   return 1;
  93 }
  94 #endif
  95
  96
  97 /*
  98 ** If pMem is an object with a valid string representation, this routine
  99 ** ensures the internal encoding for the string representation is
 100 ** 'desiredEnc', one of SQLITE_UTF8, SQLITE_UTF16LE or SQLITE_UTF16BE.
 101 **
 102 ** If pMem is not a string object, or the encoding of the string
 103 ** representation is already stored using the requested encoding, then this
 104 ** routine is a no-op.
 105 **
 106 ** SQLITE_OK is returned if the conversion is successful (or not required).
 107 ** SQLITE_NOMEM may be returned if a malloc() fails during conversion
 108 ** between formats.
 109 */
 110 int sqlite3VdbeChangeEncoding(Mem *pMem, int desiredEnc){
 111 #ifndef SQLITE_OMIT_UTF16
 112   int rc;
 113 #endif
 114   assert( (pMem->flags&MEM_RowSet)==0 );
 115   assert( desiredEnc==SQLITE_UTF8 || desiredEnc==SQLITE_UTF16LE
 116            || desiredEnc==SQLITE_UTF16BE );
 117   if( !(pMem->flags&MEM_Str) || pMem->enc==desiredEnc ){
 118     return SQLITE_OK;
 119   }
 120   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 121 #ifdef SQLITE_OMIT_UTF16
 122   return SQLITE_ERROR;
 123 #else
 124
 125   /* MemTranslate() may return SQLITE_OK or SQLITE_NOMEM. If NOMEM is returned,
 126   ** then the encoding of the value may not have changed.
 127   */
 128   rc = sqlite3VdbeMemTranslate(pMem, (u8)desiredEnc);
 129   assert(rc==SQLITE_OK    || rc==SQLITE_NOMEM);
 130   assert(rc==SQLITE_OK    || pMem->enc!=desiredEnc);
 131   assert(rc==SQLITE_NOMEM || pMem->enc==desiredEnc);
 132   return rc;
 133 #endif
 134 }
 135
 136 /*
 137 ** Make sure pMem->z points to a writable allocation of at least
 138 ** min(n,32) bytes.
 139 **
 140 ** If the bPreserve argument is true, then copy of the content of
 141 ** pMem->z into the new allocation.  pMem must be either a string or
 142 ** blob if bPreserve is true.  If bPreserve is false, any prior content
 143 ** in pMem->z is discarded.
 144 */
 145 SQLITE_NOINLINE int sqlite3VdbeMemGrow(Mem *pMem, int n, int bPreserve){
 146   assert( sqlite3VdbeCheckMemInvariants(pMem) );
 147   assert( (pMem->flags&MEM_RowSet)==0 );
 148   testcase( pMem->db==0 );
 149
 150   /* If the bPreserve flag is set to true, then the memory cell must already
 151   ** contain a valid string or blob value.  */
 152   assert( bPreserve==0 || pMem->flags&(MEM_Blob|MEM_Str) );
 153   testcase( bPreserve && pMem->z==0 );
 154
 155   assert( pMem->szMalloc==0
 156        || pMem->szMalloc==sqlite3DbMallocSize(pMem->db, pMem->zMalloc) );
 157   if( n<32 ) n = 32;
 158   if( pMem->szMalloc>0 && bPreserve && pMem->z==pMem->zMalloc ){
 159     pMem->z = pMem->zMalloc = sqlite3DbReallocOrFree(pMem->db, pMem->z, n);
 160     bPreserve = 0;
 161   }else{
 162     if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
 163     pMem->zMalloc = sqlite3DbMallocRaw(pMem->db, n);
 164   }
 165   if( pMem->zMalloc==0 ){
 166     sqlite3VdbeMemSetNull(pMem);
 167     pMem->z = 0;
 168     pMem->szMalloc = 0;
 169     return SQLITE_NOMEM_BKPT;
 170   }else{
 171     pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
 172   }
 173
 174   if( bPreserve && pMem->z ){
 175     assert( pMem->z!=pMem->zMalloc );
 176     memcpy(pMem->zMalloc, pMem->z, pMem->n);
 177   }
 178   if( (pMem->flags&MEM_Dyn)!=0 ){
 179     assert( pMem->xDel!=0 && pMem->xDel!=SQLITE_DYNAMIC );
 180     pMem->xDel((void *)(pMem->z));
 181   }
 182
 183   pMem->z = pMem->zMalloc;
 184   pMem->flags &= ~(MEM_Dyn|MEM_Ephem|MEM_Static);
 185   return SQLITE_OK;
 186 }
 187
 188 /*
 189 ** Change the pMem->zMalloc allocation to be at least szNew bytes.
 190 ** If pMem->zMalloc already meets or exceeds the requested size, this
 191 ** routine is a no-op.
 192 **
 193 ** Any prior string or blob content in the pMem object may be discarded.
 194 ** The pMem->xDel destructor is called, if it exists.  Though MEM_Str
 195 ** and MEM_Blob values may be discarded, MEM_Int, MEM_Real, and MEM_Null
 196 ** values are preserved.
 197 **
 198 ** Return SQLITE_OK on success or an error code (probably SQLITE_NOMEM)
 199 ** if unable to complete the resizing.
 200 */
 201 int sqlite3VdbeMemClearAndResize(Mem *pMem, int szNew){
 202   assert( szNew>0 );
 203   assert( (pMem->flags & MEM_Dyn)==0 || pMem->szMalloc==0 );
 204   if( pMem->szMalloc<szNew ){
 205     return sqlite3VdbeMemGrow(pMem, szNew, 0);
 206   }
 207   assert( (pMem->flags & MEM_Dyn)==0 );
 208   pMem->z = pMem->zMalloc;
 209   pMem->flags &= (MEM_Null|MEM_Int|MEM_Real);
 210   return SQLITE_OK;
 211 }
 212
 213 /*
 214 ** It is already known that pMem contains an unterminated string.
 215 ** Add the zero terminator.
 216 */
 217 static SQLITE_NOINLINE int vdbeMemAddTerminator(Mem *pMem){
 218   if( sqlite3VdbeMemGrow(pMem, pMem->n+2, 1) ){
 219     return SQLITE_NOMEM_BKPT;
 220   }
 221   pMem->z[pMem->n] = 0;
 222   pMem->z[pMem->n+1] = 0;
 223   pMem->flags |= MEM_Term;
 224   return SQLITE_OK;
 225 }
 226
 227 /*
 228 ** Change pMem so that its MEM_Str or MEM_Blob value is stored in
 229 ** MEM.zMalloc, where it can be safely written.
 230 **
 231 ** Return SQLITE_OK on success or SQLITE_NOMEM if malloc fails.
 232 */
 233 int sqlite3VdbeMemMakeWriteable(Mem *pMem){
 234   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 235   assert( (pMem->flags&MEM_RowSet)==0 );
 236   if( (pMem->flags & (MEM_Str|MEM_Blob))!=0 ){
 237     if( ExpandBlob(pMem) ) return SQLITE_NOMEM;
 238     if( pMem->szMalloc==0 || pMem->z!=pMem->zMalloc ){
 239       int rc = vdbeMemAddTerminator(pMem);
 240       if( rc ) return rc;
 241     }
 242   }
 243   pMem->flags &= ~MEM_Ephem;
 244 #ifdef SQLITE_DEBUG
 245   pMem->pScopyFrom = 0;
 246 #endif
 247
 248   return SQLITE_OK;
 249 }
 250
 251 /*
 252 ** If the given Mem* has a zero-filled tail, turn it into an ordinary
 253 ** blob stored in dynamically allocated space.
 254 */
 255 #ifndef SQLITE_OMIT_INCRBLOB
 256 int sqlite3VdbeMemExpandBlob(Mem *pMem){
 257   int nByte;
 258   assert( pMem->flags & MEM_Zero );
 259   assert( pMem->flags&MEM_Blob );
 260   assert( (pMem->flags&MEM_RowSet)==0 );
 261   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 262
 263   /* Set nByte to the number of bytes required to store the expanded blob. */
 264   nByte = pMem->n + pMem->u.nZero;
 265   if( nByte<=0 ){
 266     nByte = 1;
 267   }
 268   if( sqlite3VdbeMemGrow(pMem, nByte, 1) ){
 269     return SQLITE_NOMEM_BKPT;
 270   }
 271
 272   memset(&pMem->z[pMem->n], 0, pMem->u.nZero);
 273   pMem->n += pMem->u.nZero;
 274   pMem->flags &= ~(MEM_Zero|MEM_Term);
 275   return SQLITE_OK;
 276 }
 277 #endif
 278
 279 /*
 280 ** Make sure the given Mem is \u0000 terminated.
 281 */
 282 int sqlite3VdbeMemNulTerminate(Mem *pMem){
 283   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 284   testcase( (pMem->flags & (MEM_Term|MEM_Str))==(MEM_Term|MEM_Str) );
 285   testcase( (pMem->flags & (MEM_Term|MEM_Str))==0 );
 286   if( (pMem->flags & (MEM_Term|MEM_Str))!=MEM_Str ){
 287     return SQLITE_OK;   /* Nothing to do */
 288   }else{
 289     return vdbeMemAddTerminator(pMem);
 290   }
 291 }
 292
 293 /*
 294 ** Add MEM_Str to the set of representations for the given Mem.  Numbers
 295 ** are converted using sqlite3_snprintf().  Converting a BLOB to a string
 296 ** is a no-op.
 297 **
 298 ** Existing representations MEM_Int and MEM_Real are invalidated if
 299 ** bForce is true but are retained if bForce is false.
 300 **
 301 ** A MEM_Null value will never be passed to this function. This function is
 302 ** used for converting values to text for returning to the user (i.e. via
 303 ** sqlite3_value_text()), or for ensuring that values to be used as btree
 304 ** keys are strings. In the former case a NULL pointer is returned the
 305 ** user and the latter is an internal programming error.
 306 */
 307 int sqlite3VdbeMemStringify(Mem *pMem, u8 enc, u8 bForce){
 308   int fg = pMem->flags;
 309   const int nByte = 32;
 310
 311   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 312   assert( !(fg&MEM_Zero) );
 313   assert( !(fg&(MEM_Str|MEM_Blob)) );
 314   assert( fg&(MEM_Int|MEM_Real) );
 315   assert( (pMem->flags&MEM_RowSet)==0 );
 316   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 317
 318
 319   if( sqlite3VdbeMemClearAndResize(pMem, nByte) ){
 320     pMem->enc = 0;
 321     return SQLITE_NOMEM_BKPT;
 322   }
 323
 324   /* For a Real or Integer, use sqlite3_snprintf() to produce the UTF-8
 325   ** string representation of the value. Then, if the required encoding
 326   ** is UTF-16le or UTF-16be do a translation.
 327   **
 328   ** FIX ME: It would be better if sqlite3_snprintf() could do UTF-16.
 329   */
 330   if( fg & MEM_Int ){
 331     sqlite3_snprintf(nByte, pMem->z, "%lld", pMem->u.i);
 332   }else{
 333     assert( fg & MEM_Real );
 334     sqlite3_snprintf(nByte, pMem->z, "%!.15g", pMem->u.r);
 335   }
 336   pMem->n = sqlite3Strlen30(pMem->z);
 337   pMem->enc = SQLITE_UTF8;
 338   pMem->flags |= MEM_Str|MEM_Term;
 339   if( bForce ) pMem->flags &= ~(MEM_Int|MEM_Real);
 340   sqlite3VdbeChangeEncoding(pMem, enc);
 341   return SQLITE_OK;
 342 }
 343
 344 /*
 345 ** Memory cell pMem contains the context of an aggregate function.
 346 ** This routine calls the finalize method for that function.  The
 347 ** result of the aggregate is stored back into pMem.
 348 **
 349 ** Return SQLITE_ERROR if the finalizer reports an error.  SQLITE_OK
 350 ** otherwise.
 351 */
 352 int sqlite3VdbeMemFinalize(Mem *pMem, FuncDef *pFunc){
 353   sqlite3_context ctx;
 354   Mem t;
 355   assert( pFunc!=0 );
 356   assert( pFunc->xFinalize!=0 );
 357   assert( (pMem->flags & MEM_Null)!=0 || pFunc==pMem->u.pDef );
 358   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 359   memset(&ctx, 0, sizeof(ctx));
 360   memset(&t, 0, sizeof(t));
 361   t.flags = MEM_Null;
 362   t.db = pMem->db;
 363   ctx.pOut = &t;
 364   ctx.pMem = pMem;
 365   ctx.pFunc = pFunc;
 366   pFunc->xFinalize(&ctx); /* IMP: R-24505-23230 */
 367   assert( (pMem->flags & MEM_Dyn)==0 );
 368   if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
 369   memcpy(pMem, &t, sizeof(t));
 370   return ctx.isError;
 371 }
 372
 373 /*
 374 ** If the memory cell contains a value that must be freed by
 375 ** invoking the external callback in Mem.xDel, then this routine
 376 ** will free that value.  It also sets Mem.flags to MEM_Null.
 377 **
 378 ** This is a helper routine for sqlite3VdbeMemSetNull() and
 379 ** for sqlite3VdbeMemRelease().  Use those other routines as the
 380 ** entry point for releasing Mem resources.
 381 */
 382 static SQLITE_NOINLINE void vdbeMemClearExternAndSetNull(Mem *p){
 383   assert( p->db==0 || sqlite3_mutex_held(p->db->mutex) );
 384   assert( VdbeMemDynamic(p) );
 385   if( p->flags&MEM_Agg ){
 386     sqlite3VdbeMemFinalize(p, p->u.pDef);
 387     assert( (p->flags & MEM_Agg)==0 );
 388     testcase( p->flags & MEM_Dyn );
 389   }
 390   if( p->flags&MEM_Dyn ){
 391     assert( (p->flags&MEM_RowSet)==0 );
 392     assert( p->xDel!=SQLITE_DYNAMIC && p->xDel!=0 );
 393     p->xDel((void *)p->z);
 394   }else if( p->flags&MEM_RowSet ){
 395     sqlite3RowSetClear(p->u.pRowSet);
 396   }else if( p->flags&MEM_Frame ){
 397     VdbeFrame *pFrame = p->u.pFrame;
 398     pFrame->pParent = pFrame->v->pDelFrame;
 399     pFrame->v->pDelFrame = pFrame;
 400   }
 401   p->flags = MEM_Null;
 402 }
 403
 404 /*
 405 ** Release memory held by the Mem p, both external memory cleared
 406 ** by p->xDel and memory in p->zMalloc.
 407 **
 408 ** This is a helper routine invoked by sqlite3VdbeMemRelease() in
 409 ** the unusual case where there really is memory in p that needs
 410 ** to be freed.
 411 */
 412 static SQLITE_NOINLINE void vdbeMemClear(Mem *p){
 413   if( VdbeMemDynamic(p) ){
 414     vdbeMemClearExternAndSetNull(p);
 415   }
 416   if( p->szMalloc ){
 417     sqlite3DbFreeNN(p->db, p->zMalloc);
 418     p->szMalloc = 0;
 419   }
 420   p->z = 0;
 421 }
 422
 423 /*
 424 ** Release any memory resources held by the Mem.  Both the memory that is
 425 ** free by Mem.xDel and the Mem.zMalloc allocation are freed.
 426 **
 427 ** Use this routine prior to clean up prior to abandoning a Mem, or to
 428 ** reset a Mem back to its minimum memory utilization.
 429 **
 430 ** Use sqlite3VdbeMemSetNull() to release just the Mem.xDel space
 431 ** prior to inserting new content into the Mem.
 432 */
 433 void sqlite3VdbeMemRelease(Mem *p){
 434   assert( sqlite3VdbeCheckMemInvariants(p) );
 435   if( VdbeMemDynamic(p) || p->szMalloc ){
 436     vdbeMemClear(p);
 437   }
 438 }
 439
 440 /*
 441 ** Convert a 64-bit IEEE double into a 64-bit signed integer.
 442 ** If the double is out of range of a 64-bit signed integer then
 443 ** return the closest available 64-bit signed integer.
 444 */
 445 static SQLITE_NOINLINE i64 doubleToInt64(double r){
 446 #ifdef SQLITE_OMIT_FLOATING_POINT
 447   /* When floating-point is omitted, double and int64 are the same thing */
 448   return r;
 449 #else
 450   /*
 451   ** Many compilers we encounter do not define constants for the
 452   ** minimum and maximum 64-bit integers, or they define them
 453   ** inconsistently.  And many do not understand the "LL" notation.
 454   ** So we define our own static constants here using nothing
 455   ** larger than a 32-bit integer constant.
 456   */
 457   static const i64 maxInt = LARGEST_INT64;
 458   static const i64 minInt = SMALLEST_INT64;
 459
 460   if( r<=(double)minInt ){
 461     return minInt;
 462   }else if( r>=(double)maxInt ){
 463     return maxInt;
 464   }else{
 465     return (i64)r;
 466   }
 467 #endif
 468 }
 469
 470 /*
 471 ** Return some kind of integer value which is the best we can do
 472 ** at representing the value that *pMem describes as an integer.
 473 ** If pMem is an integer, then the value is exact.  If pMem is
 474 ** a floating-point then the value returned is the integer part.
 475 ** If pMem is a string or blob, then we make an attempt to convert
 476 ** it into an integer and return that.  If pMem represents an
 477 ** an SQL-NULL value, return 0.
 478 **
 479 ** If pMem represents a string value, its encoding might be changed.
 480 */
 481 static SQLITE_NOINLINE i64 memIntValue(Mem *pMem){
 482   i64 value = 0;
 483   sqlite3Atoi64(pMem->z, &value, pMem->n, pMem->enc);
 484   return value;
 485 }
 486 i64 sqlite3VdbeIntValue(Mem *pMem){
 487   int flags;
 488   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 489   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 490   flags = pMem->flags;
 491   if( flags & MEM_Int ){
 492     return pMem->u.i;
 493   }else if( flags & MEM_Real ){
 494     return doubleToInt64(pMem->u.r);
 495   }else if( flags & (MEM_Str|MEM_Blob) ){
 496     assert( pMem->z || pMem->n==0 );
 497     return memIntValue(pMem);
 498   }else{
 499     return 0;
 500   }
 501 }
 502
 503 /*
 504 ** Return the best representation of pMem that we can get into a
 505 ** double.  If pMem is already a double or an integer, return its
 506 ** value.  If it is a string or blob, try to convert it to a double.
 507 ** If it is a NULL, return 0.0.
 508 */
 509 static SQLITE_NOINLINE double memRealValue(Mem *pMem){
 510   /* (double)0 In case of SQLITE_OMIT_FLOATING_POINT... */
 511   double val = (double)0;
 512   sqlite3AtoF(pMem->z, &val, pMem->n, pMem->enc);
 513   return val;
 514 }
 515 double sqlite3VdbeRealValue(Mem *pMem){
 516   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 517   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 518   if( pMem->flags & MEM_Real ){
 519     return pMem->u.r;
 520   }else if( pMem->flags & MEM_Int ){
 521     return (double)pMem->u.i;
 522   }else if( pMem->flags & (MEM_Str|MEM_Blob) ){
 523     return memRealValue(pMem);
 524   }else{
 525     /* (double)0 In case of SQLITE_OMIT_FLOATING_POINT... */
 526     return (double)0;
 527   }
 528 }
 529
 530 /*
 531 ** The MEM structure is already a MEM_Real.  Try to also make it a
 532 ** MEM_Int if we can.
 533 */
 534 void sqlite3VdbeIntegerAffinity(Mem *pMem){
 535   i64 ix;
 536   assert( pMem->flags & MEM_Real );
 537   assert( (pMem->flags & MEM_RowSet)==0 );
 538   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 539   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 540
 541   ix = doubleToInt64(pMem->u.r);
 542
 543   /* Only mark the value as an integer if
 544   **
 545   **    (1) the round-trip conversion real->int->real is a no-op, and
 546   **    (2) The integer is neither the largest nor the smallest
 547   **        possible integer (ticket #3922)
 548   **
 549   ** The second and third terms in the following conditional enforces
 550   ** the second condition under the assumption that addition overflow causes
 551   ** values to wrap around.
 552   */
 553   if( pMem->u.r==ix && ix>SMALLEST_INT64 && ix<LARGEST_INT64 ){
 554     pMem->u.i = ix;
 555     MemSetTypeFlag(pMem, MEM_Int);
 556   }
 557 }
 558
 559 /*
 560 ** Convert pMem to type integer.  Invalidate any prior representations.
 561 */
 562 int sqlite3VdbeMemIntegerify(Mem *pMem){
 563   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 564   assert( (pMem->flags & MEM_RowSet)==0 );
 565   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 566
 567   pMem->u.i = sqlite3VdbeIntValue(pMem);
 568   MemSetTypeFlag(pMem, MEM_Int);
 569   return SQLITE_OK;
 570 }
 571
 572 /*
 573 ** Convert pMem so that it is of type MEM_Real.
 574 ** Invalidate any prior representations.
 575 */
 576 int sqlite3VdbeMemRealify(Mem *pMem){
 577   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 578   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 579
 580   pMem->u.r = sqlite3VdbeRealValue(pMem);
 581   MemSetTypeFlag(pMem, MEM_Real);
 582   return SQLITE_OK;
 583 }
 584
 585 /*
 586 ** Convert pMem so that it has types MEM_Real or MEM_Int or both.
 587 ** Invalidate any prior representations.
 588 **
 589 ** Every effort is made to force the conversion, even if the input
 590 ** is a string that does not look completely like a number.  Convert
 591 ** as much of the string as we can and ignore the rest.
 592 */
 593 int sqlite3VdbeMemNumerify(Mem *pMem){
 594   if( (pMem->flags & (MEM_Int|MEM_Real|MEM_Null))==0 ){
 595     int rc;
 596     assert( (pMem->flags & (MEM_Blob|MEM_Str))!=0 );
 597     assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 598     rc = sqlite3Atoi64(pMem->z, &pMem->u.i, pMem->n, pMem->enc);
 599     if( rc==0 ){
 600       MemSetTypeFlag(pMem, MEM_Int);
 601     }else{
 602       i64 i = pMem->u.i;
 603       sqlite3AtoF(pMem->z, &pMem->u.r, pMem->n, pMem->enc);
 604       if( rc==1 && pMem->u.r==(double)i ){
 605         pMem->u.i = i;
 606         MemSetTypeFlag(pMem, MEM_Int);
 607       }else{
 608         MemSetTypeFlag(pMem, MEM_Real);
 609       }
 610     }
 611   }
 612   assert( (pMem->flags & (MEM_Int|MEM_Real|MEM_Null))!=0 );
 613   pMem->flags &= ~(MEM_Str|MEM_Blob|MEM_Zero);
 614   return SQLITE_OK;
 615 }
 616
 617 /*
 618 ** Cast the datatype of the value in pMem according to the affinity
 619 ** "aff".  Casting is different from applying affinity in that a cast
 620 ** is forced.  In other words, the value is converted into the desired
 621 ** affinity even if that results in loss of data.  This routine is
 622 ** used (for example) to implement the SQL "cast()" operator.
 623 */
 624 void sqlite3VdbeMemCast(Mem *pMem, u8 aff, u8 encoding){
 625   if( pMem->flags & MEM_Null ) return;
 626   switch( aff ){
 627     case SQLITE_AFF_BLOB: {   /* Really a cast to BLOB */
 628       if( (pMem->flags & MEM_Blob)==0 ){
 629         sqlite3ValueApplyAffinity(pMem, SQLITE_AFF_TEXT, encoding);
 630         assert( pMem->flags & MEM_Str || pMem->db->mallocFailed );
 631         if( pMem->flags & MEM_Str ) MemSetTypeFlag(pMem, MEM_Blob);
 632       }else{
 633         pMem->flags &= ~(MEM_TypeMask&~MEM_Blob);
 634       }
 635       break;
 636     }
 637     case SQLITE_AFF_NUMERIC: {
 638       sqlite3VdbeMemNumerify(pMem);
 639       break;
 640     }
 641     case SQLITE_AFF_INTEGER: {
 642       sqlite3VdbeMemIntegerify(pMem);
 643       break;
 644     }
 645     case SQLITE_AFF_REAL: {
 646       sqlite3VdbeMemRealify(pMem);
 647       break;
 648     }
 649     default: {
 650       assert( aff==SQLITE_AFF_TEXT );
 651       assert( MEM_Str==(MEM_Blob>>3) );
 652       pMem->flags |= (pMem->flags&MEM_Blob)>>3;
 653       sqlite3ValueApplyAffinity(pMem, SQLITE_AFF_TEXT, encoding);
 654       assert( pMem->flags & MEM_Str || pMem->db->mallocFailed );
 655       pMem->flags &= ~(MEM_Int|MEM_Real|MEM_Blob|MEM_Zero);
 656       break;
 657     }
 658   }
 659 }
 660
 661 /*
 662 ** Initialize bulk memory to be a consistent Mem object.
 663 **
 664 ** The minimum amount of initialization feasible is performed.
 665 */
 666 void sqlite3VdbeMemInit(Mem *pMem, sqlite3 *db, u16 flags){
 667   assert( (flags & ~MEM_TypeMask)==0 );
 668   pMem->flags = flags;
 669   pMem->db = db;
 670   pMem->szMalloc = 0;
 671 }
 672
 673
 674 /*
 675 ** Delete any previous value and set the value stored in *pMem to NULL.
 676 **
 677 ** This routine calls the Mem.xDel destructor to dispose of values that
 678 ** require the destructor.  But it preserves the Mem.zMalloc memory allocation.
 679 ** To free all resources, use sqlite3VdbeMemRelease(), which both calls this
 680 ** routine to invoke the destructor and deallocates Mem.zMalloc.
 681 **
 682 ** Use this routine to reset the Mem prior to insert a new value.
 683 **
 684 ** Use sqlite3VdbeMemRelease() to complete erase the Mem prior to abandoning it.
 685 */
 686 void sqlite3VdbeMemSetNull(Mem *pMem){
 687   if( VdbeMemDynamic(pMem) ){
 688     vdbeMemClearExternAndSetNull(pMem);
 689   }else{
 690     pMem->flags = MEM_Null;
 691   }
 692 }
 693 void sqlite3ValueSetNull(sqlite3_value *p){
 694   sqlite3VdbeMemSetNull((Mem*)p);
 695 }
 696
 697 /*
 698 ** Delete any previous value and set the value to be a BLOB of length
 699 ** n containing all zeros.
 700 */
 701 void sqlite3VdbeMemSetZeroBlob(Mem *pMem, int n){
 702   sqlite3VdbeMemRelease(pMem);
 703   pMem->flags = MEM_Blob|MEM_Zero;
 704   pMem->n = 0;
 705   if( n<0 ) n = 0;
 706   pMem->u.nZero = n;
 707   pMem->enc = SQLITE_UTF8;
 708   pMem->z = 0;
 709 }
 710
 711 /*
 712 ** The pMem is known to contain content that needs to be destroyed prior
 713 ** to a value change.  So invoke the destructor, then set the value to
 714 ** a 64-bit integer.
 715 */
 716 static SQLITE_NOINLINE void vdbeReleaseAndSetInt64(Mem *pMem, i64 val){
 717   sqlite3VdbeMemSetNull(pMem);
 718   pMem->u.i = val;
 719   pMem->flags = MEM_Int;
 720 }
 721
 722 /*
 723 ** Delete any previous value and set the value stored in *pMem to val,
 724 ** manifest type INTEGER.
 725 */
 726 void sqlite3VdbeMemSetInt64(Mem *pMem, i64 val){
 727   if( VdbeMemDynamic(pMem) ){
 728     vdbeReleaseAndSetInt64(pMem, val);
 729   }else{
 730     pMem->u.i = val;
 731     pMem->flags = MEM_Int;
 732   }
 733 }
 734
 735 /* A no-op destructor */
 736 static void sqlite3NoopDestructor(void *p){ UNUSED_PARAMETER(p); }
 737
 738 /*
 739 ** Set the value stored in *pMem should already be a NULL.
 740 ** Also store a pointer to go with it.
 741 */
 742 void sqlite3VdbeMemSetPointer(
 743   Mem *pMem,
 744   void *pPtr,
 745   const char *zPType,
 746   void (*xDestructor)(void*)
 747 ){
 748   assert( pMem->flags==MEM_Null );
 749   pMem->u.zPType = zPType ? zPType : "";
 750   pMem->z = pPtr;
 751   pMem->flags = MEM_Null|MEM_Dyn|MEM_Subtype|MEM_Term;
 752   pMem->eSubtype = 'p';
 753   pMem->xDel = xDestructor ? xDestructor : sqlite3NoopDestructor;
 754 }
 755
 756 #ifndef SQLITE_OMIT_FLOATING_POINT
 757 /*
 758 ** Delete any previous value and set the value stored in *pMem to val,
 759 ** manifest type REAL.
 760 */
 761 void sqlite3VdbeMemSetDouble(Mem *pMem, double val){
 762   sqlite3VdbeMemSetNull(pMem);
 763   if( !sqlite3IsNaN(val) ){
 764     pMem->u.r = val;
 765     pMem->flags = MEM_Real;
 766   }
 767 }
 768 #endif
 769
 770 /*
 771 ** Delete any previous value and set the value of pMem to be an
 772 ** empty boolean index.
 773 */
 774 void sqlite3VdbeMemSetRowSet(Mem *pMem){
 775   sqlite3 *db = pMem->db;
 776   assert( db!=0 );
 777   assert( (pMem->flags & MEM_RowSet)==0 );
 778   sqlite3VdbeMemRelease(pMem);
 779   pMem->zMalloc = sqlite3DbMallocRawNN(db, 64);
 780   if( db->mallocFailed ){
 781     pMem->flags = MEM_Null;
 782     pMem->szMalloc = 0;
 783   }else{
 784     assert( pMem->zMalloc );
 785     pMem->szMalloc = sqlite3DbMallocSize(db, pMem->zMalloc);
 786     pMem->u.pRowSet = sqlite3RowSetInit(db, pMem->zMalloc, pMem->szMalloc);
 787     assert( pMem->u.pRowSet!=0 );
 788     pMem->flags = MEM_RowSet;
 789   }
 790 }
 791
 792 /*
 793 ** Return true if the Mem object contains a TEXT or BLOB that is
 794 ** too large - whose size exceeds SQLITE_MAX_LENGTH.
 795 */
 796 int sqlite3VdbeMemTooBig(Mem *p){
 797   assert( p->db!=0 );
 798   if( p->flags & (MEM_Str|MEM_Blob) ){
 799     int n = p->n;
 800     if( p->flags & MEM_Zero ){
 801       n += p->u.nZero;
 802     }
 803     return n>p->db->aLimit[SQLITE_LIMIT_LENGTH];
 804   }
 805   return 0;
 806 }
 807
 808 #ifdef SQLITE_DEBUG
 809 /*
 810 ** This routine prepares a memory cell for modification by breaking
 811 ** its link to a shallow copy and by marking any current shallow
 812 ** copies of this cell as invalid.
 813 **
 814 ** This is used for testing and debugging only - to make sure shallow
 815 ** copies are not misused.
 816 */
 817 void sqlite3VdbeMemAboutToChange(Vdbe *pVdbe, Mem *pMem){
 818   int i;
 819   Mem *pX;
 820   for(i=0, pX=pVdbe->aMem; i<pVdbe->nMem; i++, pX++){
 821     if( pX->pScopyFrom==pMem ){
 822       pX->flags |= MEM_Undefined;
 823       pX->pScopyFrom = 0;
 824     }
 825   }
 826   pMem->pScopyFrom = 0;
 827 }
 828 #endif /* SQLITE_DEBUG */
 829
 830
 831 /*
 832 ** Make an shallow copy of pFrom into pTo.  Prior contents of
 833 ** pTo are freed.  The pFrom->z field is not duplicated.  If
 834 ** pFrom->z is used, then pTo->z points to the same thing as pFrom->z
 835 ** and flags gets srcType (either MEM_Ephem or MEM_Static).
 836 */
 837 static SQLITE_NOINLINE void vdbeClrCopy(Mem *pTo, const Mem *pFrom, int eType){
 838   vdbeMemClearExternAndSetNull(pTo);
 839   assert( !VdbeMemDynamic(pTo) );
 840   sqlite3VdbeMemShallowCopy(pTo, pFrom, eType);
 841 }
 842 void sqlite3VdbeMemShallowCopy(Mem *pTo, const Mem *pFrom, int srcType){
 843   assert( (pFrom->flags & MEM_RowSet)==0 );
 844   assert( pTo->db==pFrom->db );
 845   if( VdbeMemDynamic(pTo) ){ vdbeClrCopy(pTo,pFrom,srcType); return; }
 846   memcpy(pTo, pFrom, MEMCELLSIZE);
 847   if( (pFrom->flags&MEM_Static)==0 ){
 848     pTo->flags &= ~(MEM_Dyn|MEM_Static|MEM_Ephem);
 849     assert( srcType==MEM_Ephem || srcType==MEM_Static );
 850     pTo->flags |= srcType;
 851   }
 852 }
 853
 854 /*
 855 ** Make a full copy of pFrom into pTo.  Prior contents of pTo are
 856 ** freed before the copy is made.
 857 */
 858 int sqlite3VdbeMemCopy(Mem *pTo, const Mem *pFrom){
 859   int rc = SQLITE_OK;
 860
 861   assert( (pFrom->flags & MEM_RowSet)==0 );
 862   if( VdbeMemDynamic(pTo) ) vdbeMemClearExternAndSetNull(pTo);
 863   memcpy(pTo, pFrom, MEMCELLSIZE);
 864   pTo->flags &= ~MEM_Dyn;
 865   if( pTo->flags&(MEM_Str|MEM_Blob) ){
 866     if( 0==(pFrom->flags&MEM_Static) ){
 867       pTo->flags |= MEM_Ephem;
 868       rc = sqlite3VdbeMemMakeWriteable(pTo);
 869     }
 870   }
 871
 872   return rc;
 873 }
 874
 875 /*
 876 ** Transfer the contents of pFrom to pTo. Any existing value in pTo is
 877 ** freed. If pFrom contains ephemeral data, a copy is made.
 878 **
 879 ** pFrom contains an SQL NULL when this routine returns.
 880 */
 881 void sqlite3VdbeMemMove(Mem *pTo, Mem *pFrom){
 882   assert( pFrom->db==0 || sqlite3_mutex_held(pFrom->db->mutex) );
 883   assert( pTo->db==0 || sqlite3_mutex_held(pTo->db->mutex) );
 884   assert( pFrom->db==0 || pTo->db==0 || pFrom->db==pTo->db );
 885
 886   sqlite3VdbeMemRelease(pTo);
 887   memcpy(pTo, pFrom, sizeof(Mem));
 888   pFrom->flags = MEM_Null;
 889   pFrom->szMalloc = 0;
 890 }
 891
 892 /*
 893 ** Change the value of a Mem to be a string or a BLOB.
 894 **
 895 ** The memory management strategy depends on the value of the xDel
 896 ** parameter. If the value passed is SQLITE_TRANSIENT, then the
 897 ** string is copied into a (possibly existing) buffer managed by the
 898 ** Mem structure. Otherwise, any existing buffer is freed and the
 899 ** pointer copied.
 900 **
 901 ** If the string is too large (if it exceeds the SQLITE_LIMIT_LENGTH
 902 ** size limit) then no memory allocation occurs.  If the string can be
 903 ** stored without allocating memory, then it is.  If a memory allocation
 904 ** is required to store the string, then value of pMem is unchanged.  In
 905 ** either case, SQLITE_TOOBIG is returned.
 906 */
 907 int sqlite3VdbeMemSetStr(
 908   Mem *pMem,          /* Memory cell to set to string value */
 909   const char *z,      /* String pointer */
 910   int n,              /* Bytes in string, or negative */
 911   u8 enc,             /* Encoding of z.  0 for BLOBs */
 912   void (*xDel)(void*) /* Destructor function */
 913 ){
 914   int nByte = n;      /* New value for pMem->n */
 915   int iLimit;         /* Maximum allowed string or blob size */
 916   u16 flags = 0;      /* New value for pMem->flags */
 917
 918   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 919   assert( (pMem->flags & MEM_RowSet)==0 );
 920
 921   /* If z is a NULL pointer, set pMem to contain an SQL NULL. */
 922   if( !z ){
 923     sqlite3VdbeMemSetNull(pMem);
 924     return SQLITE_OK;
 925   }
 926
 927   if( pMem->db ){
 928     iLimit = pMem->db->aLimit[SQLITE_LIMIT_LENGTH];
 929   }else{
 930     iLimit = SQLITE_MAX_LENGTH;
 931   }
 932   flags = (enc==0?MEM_Blob:MEM_Str);
 933   if( nByte<0 ){
 934     assert( enc!=0 );
 935     if( enc==SQLITE_UTF8 ){
 936       nByte = 0x7fffffff & (int)strlen(z);
 937       if( nByte>iLimit ) nByte = iLimit+1;
 938     }else{
 939       for(nByte=0; nByte<=iLimit && (z[nByte] | z[nByte+1]); nByte+=2){}
 940     }
 941     flags |= MEM_Term;
 942   }
 943
 944   /* The following block sets the new values of Mem.z and Mem.xDel. It
 945   ** also sets a flag in local variable "flags" to indicate the memory
 946   ** management (one of MEM_Dyn or MEM_Static).
 947   */
 948   if( xDel==SQLITE_TRANSIENT ){
 949     int nAlloc = nByte;
 950     if( flags&MEM_Term ){
 951       nAlloc += (enc==SQLITE_UTF8?1:2);
 952     }
 953     if( nByte>iLimit ){
 954       return SQLITE_TOOBIG;
 955     }
 956     testcase( nAlloc==0 );
 957     testcase( nAlloc==31 );
 958     testcase( nAlloc==32 );
 959     if( sqlite3VdbeMemClearAndResize(pMem, MAX(nAlloc,32)) ){
 960       return SQLITE_NOMEM_BKPT;
 961     }
 962     memcpy(pMem->z, z, nAlloc);
 963   }else if( xDel==SQLITE_DYNAMIC ){
 964     sqlite3VdbeMemRelease(pMem);
 965     pMem->zMalloc = pMem->z = (char *)z;
 966     pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
 967   }else{
 968     sqlite3VdbeMemRelease(pMem);
 969     pMem->z = (char *)z;
 970     pMem->xDel = xDel;
 971     flags |= ((xDel==SQLITE_STATIC)?MEM_Static:MEM_Dyn);
 972   }
 973
 974   pMem->n = nByte;
 975   pMem->flags = flags;
 976   pMem->enc = (enc==0 ? SQLITE_UTF8 : enc);
 977
 978 #ifndef SQLITE_OMIT_UTF16
 979   if( pMem->enc!=SQLITE_UTF8 && sqlite3VdbeMemHandleBom(pMem) ){
 980     return SQLITE_NOMEM_BKPT;
 981   }
 982 #endif
 983
 984   if( nByte>iLimit ){
 985     return SQLITE_TOOBIG;
 986   }
 987
 988   return SQLITE_OK;
 989 }
 990
 991 /*
 992 ** Move data out of a btree key or data field and into a Mem structure.
 993 ** The data is payload from the entry that pCur is currently pointing
 994 ** to.  offset and amt determine what portion of the data or key to retrieve.
 995 ** The result is written into the pMem element.
 996 **
 997 ** The pMem object must have been initialized.  This routine will use
 998 ** pMem->zMalloc to hold the content from the btree, if possible.  New
 999 ** pMem->zMalloc space will be allocated if necessary.  The calling routine
1000 ** is responsible for making sure that the pMem object is eventually
1001 ** destroyed.
1002 **
1003 ** If this routine fails for any reason (malloc returns NULL or unable
1004 ** to read from the disk) then the pMem is left in an inconsistent state.
1005 */
1006 static SQLITE_NOINLINE int vdbeMemFromBtreeResize(
1007   BtCursor *pCur,   /* Cursor pointing at record to retrieve. */
1008   u32 offset,       /* Offset from the start of data to return bytes from. */
1009   u32 amt,          /* Number of bytes to return. */
1010   Mem *pMem         /* OUT: Return data in this Mem structure. */
1011 ){
1012   int rc;
1013   pMem->flags = MEM_Null;
1014   if( SQLITE_OK==(rc = sqlite3VdbeMemClearAndResize(pMem, amt+1)) ){
1015     rc = sqlite3BtreePayload(pCur, offset, amt, pMem->z);
1016     if( rc==SQLITE_OK ){
1017       pMem->z[amt] = 0;   /* Overrun area used when reading malformed records */
1018       pMem->flags = MEM_Blob;
1019       pMem->n = (int)amt;
1020     }else{
1021       sqlite3VdbeMemRelease(pMem);
1022     }
1023   }
1024   return rc;
1025 }
1026 int sqlite3VdbeMemFromBtree(
1027   BtCursor *pCur,   /* Cursor pointing at record to retrieve. */
1028   u32 offset,       /* Offset from the start of data to return bytes from. */
1029   u32 amt,          /* Number of bytes to return. */
1030   Mem *pMem         /* OUT: Return data in this Mem structure. */
1031 ){
1032   char *zData;        /* Data from the btree layer */
1033   u32 available = 0;  /* Number of bytes available on the local btree page */
1034   int rc = SQLITE_OK; /* Return code */
1035
1036   assert( sqlite3BtreeCursorIsValid(pCur) );
1037   assert( !VdbeMemDynamic(pMem) );
1038
1039   /* Note: the calls to BtreeKeyFetch() and DataFetch() below assert()
1040   ** that both the BtShared and database handle mutexes are held. */
1041   assert( (pMem->flags & MEM_RowSet)==0 );
1042   zData = (char *)sqlite3BtreePayloadFetch(pCur, &available);
1043   assert( zData!=0 );
1044
1045   if( offset+amt<=available ){
1046     pMem->z = &zData[offset];
1047     pMem->flags = MEM_Blob|MEM_Ephem;
1048     pMem->n = (int)amt;
1049   }else{
1050     rc = vdbeMemFromBtreeResize(pCur, offset, amt, pMem);
1051   }
1052
1053   return rc;
1054 }
1055
1056 /*
1057 ** The pVal argument is known to be a value other than NULL.
1058 ** Convert it into a string with encoding enc and return a pointer
1059 ** to a zero-terminated version of that string.
1060 */
1061 static SQLITE_NOINLINE const void *valueToText(sqlite3_value* pVal, u8 enc){
1062   assert( pVal!=0 );
1063   assert( pVal->db==0 || sqlite3_mutex_held(pVal->db->mutex) );
1064   assert( (enc&3)==(enc&~SQLITE_UTF16_ALIGNED) );
1065   assert( (pVal->flags & MEM_RowSet)==0 );
1066   assert( (pVal->flags & (MEM_Null))==0 );
1067   if( pVal->flags & (MEM_Blob|MEM_Str) ){
1068     if( ExpandBlob(pVal) ) return 0;
1069     pVal->flags |= MEM_Str;
1070     if( pVal->enc != (enc & ~SQLITE_UTF16_ALIGNED) ){
1071       sqlite3VdbeChangeEncoding(pVal, enc & ~SQLITE_UTF16_ALIGNED);
1072     }
1073     if( (enc & SQLITE_UTF16_ALIGNED)!=0 && 1==(1&SQLITE_PTR_TO_INT(pVal->z)) ){
1074       assert( (pVal->flags & (MEM_Ephem|MEM_Static))!=0 );
1075       if( sqlite3VdbeMemMakeWriteable(pVal)!=SQLITE_OK ){
1076         return 0;
1077       }
1078     }
1079     sqlite3VdbeMemNulTerminate(pVal); /* IMP: R-31275-44060 */
1080   }else{
1081     sqlite3VdbeMemStringify(pVal, enc, 0);
1082     assert( 0==(1&SQLITE_PTR_TO_INT(pVal->z)) );
1083   }
1084   assert(pVal->enc==(enc & ~SQLITE_UTF16_ALIGNED) || pVal->db==0
1085               || pVal->db->mallocFailed );
1086   if( pVal->enc==(enc & ~SQLITE_UTF16_ALIGNED) ){
1087     return pVal->z;
1088   }else{
1089     return 0;
1090   }
1091 }
1092
1093 /* This function is only available internally, it is not part of the
1094 ** external API. It works in a similar way to sqlite3_value_text(),
1095 ** except the data returned is in the encoding specified by the second
1096 ** parameter, which must be one of SQLITE_UTF16BE, SQLITE_UTF16LE or
1097 ** SQLITE_UTF8.
1098 **
1099 ** (2006-02-16:)  The enc value can be or-ed with SQLITE_UTF16_ALIGNED.
1100 ** If that is the case, then the result must be aligned on an even byte
1101 ** boundary.
1102 */
1103 const void *sqlite3ValueText(sqlite3_value* pVal, u8 enc){
1104   if( !pVal ) return 0;
1105   assert( pVal->db==0 || sqlite3_mutex_held(pVal->db->mutex) );
1106   assert( (enc&3)==(enc&~SQLITE_UTF16_ALIGNED) );
1107   assert( (pVal->flags & MEM_RowSet)==0 );
1108   if( (pVal->flags&(MEM_Str|MEM_Term))==(MEM_Str|MEM_Term) && pVal->enc==enc ){
1109     return pVal->z;
1110   }
1111   if( pVal->flags&MEM_Null ){
1112     return 0;
1113   }
1114   return valueToText(pVal, enc);
1115 }
1116
1117 /*
1118 ** Create a new sqlite3_value object.
1119 */
1120 sqlite3_value *sqlite3ValueNew(sqlite3 *db){
1121   Mem *p = sqlite3DbMallocZero(db, sizeof(*p));
1122   if( p ){
1123     p->flags = MEM_Null;
1124     p->db = db;
1125   }
1126   return p;
1127 }
1128
1129 /*
1130 ** Context object passed by sqlite3Stat4ProbeSetValue() through to
1131 ** valueNew(). See comments above valueNew() for details.
1132 */
1133 struct ValueNewStat4Ctx {
1134   Parse *pParse;
1135   Index *pIdx;
1136   UnpackedRecord **ppRec;
1137   int iVal;
1138 };
1139
1140 /*
1141 ** Allocate and return a pointer to a new sqlite3_value object. If
1142 ** the second argument to this function is NULL, the object is allocated
1143 ** by calling sqlite3ValueNew().
1144 **
1145 ** Otherwise, if the second argument is non-zero, then this function is
1146 ** being called indirectly by sqlite3Stat4ProbeSetValue(). If it has not
1147 ** already been allocated, allocate the UnpackedRecord structure that
1148 ** that function will return to its caller here. Then return a pointer to
1149 ** an sqlite3_value within the UnpackedRecord.a[] array.
1150 */
1151 static sqlite3_value *valueNew(sqlite3 *db, struct ValueNewStat4Ctx *p){
1152 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1153   if( p ){
1154     UnpackedRecord *pRec = p->ppRec[0];
1155
1156     if( pRec==0 ){
1157       Index *pIdx = p->pIdx;      /* Index being probed */
1158       int nByte;                  /* Bytes of space to allocate */
1159       int i;                      /* Counter variable */
1160       int nCol = pIdx->nColumn;   /* Number of index columns including rowid */
1161
1162       nByte = sizeof(Mem) * nCol + ROUND8(sizeof(UnpackedRecord));
1163       pRec = (UnpackedRecord*)sqlite3DbMallocZero(db, nByte);
1164       if( pRec ){
1165         pRec->pKeyInfo = sqlite3KeyInfoOfIndex(p->pParse, pIdx);
1166         if( pRec->pKeyInfo ){
1167           assert( pRec->pKeyInfo->nAllField==nCol );
1168           assert( pRec->pKeyInfo->enc==ENC(db) );
1169           pRec->aMem = (Mem *)((u8*)pRec + ROUND8(sizeof(UnpackedRecord)));
1170           for(i=0; i<nCol; i++){
1171             pRec->aMem[i].flags = MEM_Null;
1172             pRec->aMem[i].db = db;
1173           }
1174         }else{
1175           sqlite3DbFreeNN(db, pRec);
1176           pRec = 0;
1177         }
1178       }
1179       if( pRec==0 ) return 0;
1180       p->ppRec[0] = pRec;
1181     }
1182
1183     pRec->nField = p->iVal+1;
1184     return &pRec->aMem[p->iVal];
1185   }
1186 #else
1187   UNUSED_PARAMETER(p);
1188 #endif /* defined(SQLITE_ENABLE_STAT3_OR_STAT4) */
1189   return sqlite3ValueNew(db);
1190 }
1191
1192 /*
1193 ** The expression object indicated by the second argument is guaranteed
1194 ** to be a scalar SQL function. If
1195 **
1196 **   * all function arguments are SQL literals,
1197 **   * one of the SQLITE_FUNC_CONSTANT or _SLOCHNG function flags is set, and
1198 **   * the SQLITE_FUNC_NEEDCOLL function flag is not set,
1199 **
1200 ** then this routine attempts to invoke the SQL function. Assuming no
1201 ** error occurs, output parameter (*ppVal) is set to point to a value
1202 ** object containing the result before returning SQLITE_OK.
1203 **
1204 ** Affinity aff is applied to the result of the function before returning.
1205 ** If the result is a text value, the sqlite3_value object uses encoding
1206 ** enc.
1207 **
1208 ** If the conditions above are not met, this function returns SQLITE_OK
1209 ** and sets (*ppVal) to NULL. Or, if an error occurs, (*ppVal) is set to
1210 ** NULL and an SQLite error code returned.
1211 */
1212 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1213 static int valueFromFunction(
1214   sqlite3 *db,                    /* The database connection */
1215   Expr *p,                        /* The expression to evaluate */
1216   u8 enc,                         /* Encoding to use */
1217   u8 aff,                         /* Affinity to use */
1218   sqlite3_value **ppVal,          /* Write the new value here */
1219   struct ValueNewStat4Ctx *pCtx   /* Second argument for valueNew() */
1220 ){
1221   sqlite3_context ctx;            /* Context object for function invocation */
1222   sqlite3_value **apVal = 0;      /* Function arguments */
1223   int nVal = 0;                   /* Size of apVal[] array */
1224   FuncDef *pFunc = 0;             /* Function definition */
1225   sqlite3_value *pVal = 0;        /* New value */
1226   int rc = SQLITE_OK;             /* Return code */
1227   ExprList *pList = 0;            /* Function arguments */
1228   int i;                          /* Iterator variable */
1229
1230   assert( pCtx!=0 );
1231   assert( (p->flags & EP_TokenOnly)==0 );
1232   pList = p->x.pList;
1233   if( pList ) nVal = pList->nExpr;
1234   pFunc = sqlite3FindFunction(db, p->u.zToken, nVal, enc, 0);
1235   assert( pFunc );
1236   if( (pFunc->funcFlags & (SQLITE_FUNC_CONSTANT|SQLITE_FUNC_SLOCHNG))==0
1237    || (pFunc->funcFlags & SQLITE_FUNC_NEEDCOLL)
1238   ){
1239     return SQLITE_OK;
1240   }
1241
1242   if( pList ){
1243     apVal = (sqlite3_value**)sqlite3DbMallocZero(db, sizeof(apVal[0]) * nVal);
1244     if( apVal==0 ){
1245       rc = SQLITE_NOMEM_BKPT;
1246       goto value_from_function_out;
1247     }
1248     for(i=0; i<nVal; i++){
1249       rc = sqlite3ValueFromExpr(db, pList->a[i].pExpr, enc, aff, &apVal[i]);
1250       if( apVal[i]==0 || rc!=SQLITE_OK ) goto value_from_function_out;
1251     }
1252   }
1253
1254   pVal = valueNew(db, pCtx);
1255   if( pVal==0 ){
1256     rc = SQLITE_NOMEM_BKPT;
1257     goto value_from_function_out;
1258   }
1259
1260   assert( pCtx->pParse->rc==SQLITE_OK );
1261   memset(&ctx, 0, sizeof(ctx));
1262   ctx.pOut = pVal;
1263   ctx.pFunc = pFunc;
1264   pFunc->xSFunc(&ctx, nVal, apVal);
1265   if( ctx.isError ){
1266     rc = ctx.isError;
1267     sqlite3ErrorMsg(pCtx->pParse, "%s", sqlite3_value_text(pVal));
1268   }else{
1269     sqlite3ValueApplyAffinity(pVal, aff, SQLITE_UTF8);
1270     assert( rc==SQLITE_OK );
1271     rc = sqlite3VdbeChangeEncoding(pVal, enc);
1272     if( rc==SQLITE_OK && sqlite3VdbeMemTooBig(pVal) ){
1273       rc = SQLITE_TOOBIG;
1274       pCtx->pParse->nErr++;
1275     }
1276   }
1277   pCtx->pParse->rc = rc;
1278
1279  value_from_function_out:
1280   if( rc!=SQLITE_OK ){
1281     pVal = 0;
1282   }
1283   if( apVal ){
1284     for(i=0; i<nVal; i++){
1285       sqlite3ValueFree(apVal[i]);
1286     }
1287     sqlite3DbFreeNN(db, apVal);
1288   }
1289
1290   *ppVal = pVal;
1291   return rc;
1292 }
1293 #else
1294 # define valueFromFunction(a,b,c,d,e,f) SQLITE_OK
1295 #endif /* defined(SQLITE_ENABLE_STAT3_OR_STAT4) */
1296
1297 /*
1298 ** Extract a value from the supplied expression in the manner described
1299 ** above sqlite3ValueFromExpr(). Allocate the sqlite3_value object
1300 ** using valueNew().
1301 **
1302 ** If pCtx is NULL and an error occurs after the sqlite3_value object
1303 ** has been allocated, it is freed before returning. Or, if pCtx is not
1304 ** NULL, it is assumed that the caller will free any allocated object
1305 ** in all cases.
1306 */
1307 static int valueFromExpr(
1308   sqlite3 *db,                    /* The database connection */
1309   Expr *pExpr,                    /* The expression to evaluate */
1310   u8 enc,                         /* Encoding to use */
1311   u8 affinity,                    /* Affinity to use */
1312   sqlite3_value **ppVal,          /* Write the new value here */
1313   struct ValueNewStat4Ctx *pCtx   /* Second argument for valueNew() */
1314 ){
1315   int op;
1316   char *zVal = 0;
1317   sqlite3_value *pVal = 0;
1318   int negInt = 1;
1319   const char *zNeg = "";
1320   int rc = SQLITE_OK;
1321
1322   assert( pExpr!=0 );
1323   while( (op = pExpr->op)==TK_UPLUS || op==TK_SPAN ) pExpr = pExpr->pLeft;
1324 #if defined(SQLITE_ENABLE_STAT3_OR_STAT4)
1325   if( op==TK_REGISTER ) op = pExpr->op2;
1326 #else
1327   if( NEVER(op==TK_REGISTER) ) op = pExpr->op2;
1328 #endif
1329
1330   /* Compressed expressions only appear when parsing the DEFAULT clause
1331   ** on a table column definition, and hence only when pCtx==0.  This
1332   ** check ensures that an EP_TokenOnly expression is never passed down
1333   ** into valueFromFunction(). */
1334   assert( (pExpr->flags & EP_TokenOnly)==0 || pCtx==0 );
1335
1336   if( op==TK_CAST ){
1337     u8 aff = sqlite3AffinityType(pExpr->u.zToken,0);
1338     rc = valueFromExpr(db, pExpr->pLeft, enc, aff, ppVal, pCtx);
1339     testcase( rc!=SQLITE_OK );
1340     if( *ppVal ){
1341       sqlite3VdbeMemCast(*ppVal, aff, SQLITE_UTF8);
1342       sqlite3ValueApplyAffinity(*ppVal, affinity, SQLITE_UTF8);
1343     }
1344     return rc;
1345   }
1346
1347   /* Handle negative integers in a single step.  This is needed in the
1348   ** case when the value is -9223372036854775808.
1349   */
1350   if( op==TK_UMINUS
1351    && (pExpr->pLeft->op==TK_INTEGER || pExpr->pLeft->op==TK_FLOAT) ){
1352     pExpr = pExpr->pLeft;
1353     op = pExpr->op;
1354     negInt = -1;
1355     zNeg = "-";
1356   }
1357
1358   if( op==TK_STRING || op==TK_FLOAT || op==TK_INTEGER ){
1359     pVal = valueNew(db, pCtx);
1360     if( pVal==0 ) goto no_mem;
1361     if( ExprHasProperty(pExpr, EP_IntValue) ){
1362       sqlite3VdbeMemSetInt64(pVal, (i64)pExpr->u.iValue*negInt);
1363     }else{
1364       zVal = sqlite3MPrintf(db, "%s%s", zNeg, pExpr->u.zToken);
1365       if( zVal==0 ) goto no_mem;
1366       sqlite3ValueSetStr(pVal, -1, zVal, SQLITE_UTF8, SQLITE_DYNAMIC);
1367     }
1368     if( (op==TK_INTEGER || op==TK_FLOAT ) && affinity==SQLITE_AFF_BLOB ){
1369       sqlite3ValueApplyAffinity(pVal, SQLITE_AFF_NUMERIC, SQLITE_UTF8);
1370     }else{
1371       sqlite3ValueApplyAffinity(pVal, affinity, SQLITE_UTF8);
1372     }
1373     if( pVal->flags & (MEM_Int|MEM_Real) ) pVal->flags &= ~MEM_Str;
1374     if( enc!=SQLITE_UTF8 ){
1375       rc = sqlite3VdbeChangeEncoding(pVal, enc);
1376     }
1377   }else if( op==TK_UMINUS ) {
1378     /* This branch happens for multiple negative signs.  Ex: -(-5) */
1379     if( SQLITE_OK==valueFromExpr(db,pExpr->pLeft,enc,affinity,&pVal,pCtx)
1380      && pVal!=0
1381     ){
1382       sqlite3VdbeMemNumerify(pVal);
1383       if( pVal->flags & MEM_Real ){
1384         pVal->u.r = -pVal->u.r;
1385       }else if( pVal->u.i==SMALLEST_INT64 ){
1386         pVal->u.r = -(double)SMALLEST_INT64;
1387         MemSetTypeFlag(pVal, MEM_Real);
1388       }else{
1389         pVal->u.i = -pVal->u.i;
1390       }
1391       sqlite3ValueApplyAffinity(pVal, affinity, enc);
1392     }
1393   }else if( op==TK_NULL ){
1394     pVal = valueNew(db, pCtx);
1395     if( pVal==0 ) goto no_mem;
1396     sqlite3VdbeMemNumerify(pVal);
1397   }
1398 #ifndef SQLITE_OMIT_BLOB_LITERAL
1399   else if( op==TK_BLOB ){
1400     int nVal;
1401     assert( pExpr->u.zToken[0]=='x' || pExpr->u.zToken[0]=='X' );
1402     assert( pExpr->u.zToken[1]=='\'' );
1403     pVal = valueNew(db, pCtx);
1404     if( !pVal ) goto no_mem;
1405     zVal = &pExpr->u.zToken[2];
1406     nVal = sqlite3Strlen30(zVal)-1;
1407     assert( zVal[nVal]=='\'' );
1408     sqlite3VdbeMemSetStr(pVal, sqlite3HexToBlob(db, zVal, nVal), nVal/2,
1409                          0, SQLITE_DYNAMIC);
1410   }
1411 #endif
1412
1413 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1414   else if( op==TK_FUNCTION && pCtx!=0 ){
1415     rc = valueFromFunction(db, pExpr, enc, affinity, &pVal, pCtx);
1416   }
1417 #endif
1418
1419   *ppVal = pVal;
1420   return rc;
1421
1422 no_mem:
1423 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1424   if( pCtx==0 || pCtx->pParse->nErr==0 )
1425 #endif
1426     sqlite3OomFault(db);
1427   sqlite3DbFree(db, zVal);
1428   assert( *ppVal==0 );
1429 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1430   if( pCtx==0 ) sqlite3ValueFree(pVal);
1431 #else
1432   assert( pCtx==0 ); sqlite3ValueFree(pVal);
1433 #endif
1434   return SQLITE_NOMEM_BKPT;
1435 }
1436
1437 /*
1438 ** Create a new sqlite3_value object, containing the value of pExpr.
1439 **
1440 ** This only works for very simple expressions that consist of one constant
1441 ** token (i.e. "5", "5.1", "'a string'"). If the expression can
1442 ** be converted directly into a value, then the value is allocated and
1443 ** a pointer written to *ppVal. The caller is responsible for deallocating
1444 ** the value by passing it to sqlite3ValueFree() later on. If the expression
1445 ** cannot be converted to a value, then *ppVal is set to NULL.
1446 */
1447 int sqlite3ValueFromExpr(
1448   sqlite3 *db,              /* The database connection */
1449   Expr *pExpr,              /* The expression to evaluate */
1450   u8 enc,                   /* Encoding to use */
1451   u8 affinity,              /* Affinity to use */
1452   sqlite3_value **ppVal     /* Write the new value here */
1453 ){
1454   return pExpr ? valueFromExpr(db, pExpr, enc, affinity, ppVal, 0) : 0;
1455 }
1456
1457 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
1458 /*
1459 ** The implementation of the sqlite_record() function. This function accepts
1460 ** a single argument of any type. The return value is a formatted database
1461 ** record (a blob) containing the argument value.
1462 **
1463 ** This is used to convert the value stored in the 'sample' column of the
1464 ** sqlite_stat3 table to the record format SQLite uses internally.
1465 */
1466 static void recordFunc(
1467   sqlite3_context *context,
1468   int argc,
1469   sqlite3_value **argv
1470 ){
1471   const int file_format = 1;
1472   u32 iSerial;                    /* Serial type */
1473   int nSerial;                    /* Bytes of space for iSerial as varint */
1474   u32 nVal;                       /* Bytes of space required for argv[0] */
1475   int nRet;
1476   sqlite3 *db;
1477   u8 *aRet;
1478
1479   UNUSED_PARAMETER( argc );
1480   iSerial = sqlite3VdbeSerialType(argv[0], file_format, &nVal);
1481   nSerial = sqlite3VarintLen(iSerial);
1482   db = sqlite3_context_db_handle(context);
1483
1484   nRet = 1 + nSerial + nVal;
1485   aRet = sqlite3DbMallocRawNN(db, nRet);
1486   if( aRet==0 ){
1487     sqlite3_result_error_nomem(context);
1488   }else{
1489     aRet[0] = nSerial+1;
1490     putVarint32(&aRet[1], iSerial);
1491     sqlite3VdbeSerialPut(&aRet[1+nSerial], argv[0], iSerial);
1492     sqlite3_result_blob(context, aRet, nRet, SQLITE_TRANSIENT);
1493     sqlite3DbFreeNN(db, aRet);
1494   }
1495 }
1496
1497 /*
1498 ** Register built-in functions used to help read ANALYZE data.
1499 */
1500 void sqlite3AnalyzeFunctions(void){
1501   static FuncDef aAnalyzeTableFuncs[] = {
1502     FUNCTION(sqlite_record,   1, 0, 0, recordFunc),
1503   };
1504   sqlite3InsertBuiltinFuncs(aAnalyzeTableFuncs, ArraySize(aAnalyzeTableFuncs));
1505 }
1506
1507 /*
1508 ** Attempt to extract a value from pExpr and use it to construct *ppVal.
1509 **
1510 ** If pAlloc is not NULL, then an UnpackedRecord object is created for
1511 ** pAlloc if one does not exist and the new value is added to the
1512 ** UnpackedRecord object.
1513 **
1514 ** A value is extracted in the following cases:
1515 **
1516 **  * (pExpr==0). In this case the value is assumed to be an SQL NULL,
1517 **
1518 **  * The expression is a bound variable, and this is a reprepare, or
1519 **
1520 **  * The expression is a literal value.
1521 **
1522 ** On success, *ppVal is made to point to the extracted value.  The caller
1523 ** is responsible for ensuring that the value is eventually freed.
1524 */
1525 static int stat4ValueFromExpr(
1526   Parse *pParse,                  /* Parse context */
1527   Expr *pExpr,                    /* The expression to extract a value from */
1528   u8 affinity,                    /* Affinity to use */
1529   struct ValueNewStat4Ctx *pAlloc,/* How to allocate space.  Or NULL */
1530   sqlite3_value **ppVal           /* OUT: New value object (or NULL) */
1531 ){
1532   int rc = SQLITE_OK;
1533   sqlite3_value *pVal = 0;
1534   sqlite3 *db = pParse->db;
1535
1536   /* Skip over any TK_COLLATE nodes */
1537   pExpr = sqlite3ExprSkipCollate(pExpr);
1538
1539   assert( pExpr==0 || pExpr->op!=TK_REGISTER || pExpr->op2!=TK_VARIABLE );
1540   if( !pExpr ){
1541     pVal = valueNew(db, pAlloc);
1542     if( pVal ){
1543       sqlite3VdbeMemSetNull((Mem*)pVal);
1544     }
1545   }else if( pExpr->op==TK_VARIABLE && (db->flags & SQLITE_EnableQPSG)==0 ){
1546     Vdbe *v;
1547     int iBindVar = pExpr->iColumn;
1548     sqlite3VdbeSetVarmask(pParse->pVdbe, iBindVar);
1549     if( (v = pParse->pReprepare)!=0 ){
1550       pVal = valueNew(db, pAlloc);
1551       if( pVal ){
1552         rc = sqlite3VdbeMemCopy((Mem*)pVal, &v->aVar[iBindVar-1]);
1553         sqlite3ValueApplyAffinity(pVal, affinity, ENC(db));
1554         pVal->db = pParse->db;
1555       }
1556     }
1557   }else{
1558     rc = valueFromExpr(db, pExpr, ENC(db), affinity, &pVal, pAlloc);
1559   }
1560
1561   assert( pVal==0 || pVal->db==db );
1562   *ppVal = pVal;
1563   return rc;
1564 }
1565
1566 /*
1567 ** This function is used to allocate and populate UnpackedRecord
1568 ** structures intended to be compared against sample index keys stored
1569 ** in the sqlite_stat4 table.
1570 **
1571 ** A single call to this function populates zero or more fields of the
1572 ** record starting with field iVal (fields are numbered from left to
1573 ** right starting with 0). A single field is populated if:
1574 **
1575 **  * (pExpr==0). In this case the value is assumed to be an SQL NULL,
1576 **
1577 **  * The expression is a bound variable, and this is a reprepare, or
1578 **
1579 **  * The sqlite3ValueFromExpr() function is able to extract a value
1580 **    from the expression (i.e. the expression is a literal value).
1581 **
1582 ** Or, if pExpr is a TK_VECTOR, one field is populated for each of the
1583 ** vector components that match either of the two latter criteria listed
1584 ** above.
1585 **
1586 ** Before any value is appended to the record, the affinity of the
1587 ** corresponding column within index pIdx is applied to it. Before
1588 ** this function returns, output parameter *pnExtract is set to the
1589 ** number of values appended to the record.
1590 **
1591 ** When this function is called, *ppRec must either point to an object
1592 ** allocated by an earlier call to this function, or must be NULL. If it
1593 ** is NULL and a value can be successfully extracted, a new UnpackedRecord
1594 ** is allocated (and *ppRec set to point to it) before returning.
1595 **
1596 ** Unless an error is encountered, SQLITE_OK is returned. It is not an
1597 ** error if a value cannot be extracted from pExpr. If an error does
1598 ** occur, an SQLite error code is returned.
1599 */
1600 int sqlite3Stat4ProbeSetValue(
1601   Parse *pParse,                  /* Parse context */
1602   Index *pIdx,                    /* Index being probed */
1603   UnpackedRecord **ppRec,         /* IN/OUT: Probe record */
1604   Expr *pExpr,                    /* The expression to extract a value from */
1605   int nElem,                      /* Maximum number of values to append */
1606   int iVal,                       /* Array element to populate */
1607   int *pnExtract                  /* OUT: Values appended to the record */
1608 ){
1609   int rc = SQLITE_OK;
1610   int nExtract = 0;
1611
1612   if( pExpr==0 || pExpr->op!=TK_SELECT ){
1613     int i;
1614     struct ValueNewStat4Ctx alloc;
1615
1616     alloc.pParse = pParse;
1617     alloc.pIdx = pIdx;
1618     alloc.ppRec = ppRec;
1619
1620     for(i=0; i<nElem; i++){
1621       sqlite3_value *pVal = 0;
1622       Expr *pElem = (pExpr ? sqlite3VectorFieldSubexpr(pExpr, i) : 0);
1623       u8 aff = sqlite3IndexColumnAffinity(pParse->db, pIdx, iVal+i);
1624       alloc.iVal = iVal+i;
1625       rc = stat4ValueFromExpr(pParse, pElem, aff, &alloc, &pVal);
1626       if( !pVal ) break;
1627       nExtract++;
1628     }
1629   }
1630
1631   *pnExtract = nExtract;
1632   return rc;
1633 }
1634
1635 /*
1636 ** Attempt to extract a value from expression pExpr using the methods
1637 ** as described for sqlite3Stat4ProbeSetValue() above.
1638 **
1639 ** If successful, set *ppVal to point to a new value object and return
1640 ** SQLITE_OK. If no value can be extracted, but no other error occurs
1641 ** (e.g. OOM), return SQLITE_OK and set *ppVal to NULL. Or, if an error
1642 ** does occur, return an SQLite error code. The final value of *ppVal
1643 ** is undefined in this case.
1644 */
1645 int sqlite3Stat4ValueFromExpr(
1646   Parse *pParse,                  /* Parse context */
1647   Expr *pExpr,                    /* The expression to extract a value from */
1648   u8 affinity,                    /* Affinity to use */
1649   sqlite3_value **ppVal           /* OUT: New value object (or NULL) */
1650 ){
1651   return stat4ValueFromExpr(pParse, pExpr, affinity, 0, ppVal);
1652 }
1653
1654 /*
1655 ** Extract the iCol-th column from the nRec-byte record in pRec.  Write
1656 ** the column value into *ppVal.  If *ppVal is initially NULL then a new
1657 ** sqlite3_value object is allocated.
1658 **
1659 ** If *ppVal is initially NULL then the caller is responsible for
1660 ** ensuring that the value written into *ppVal is eventually freed.
1661 */
1662 int sqlite3Stat4Column(
1663   sqlite3 *db,                    /* Database handle */
1664   const void *pRec,               /* Pointer to buffer containing record */
1665   int nRec,                       /* Size of buffer pRec in bytes */
1666   int iCol,                       /* Column to extract */
1667   sqlite3_value **ppVal           /* OUT: Extracted value */
1668 ){
1669   u32 t;                          /* a column type code */
1670   int nHdr;                       /* Size of the header in the record */
1671   int iHdr;                       /* Next unread header byte */
1672   int iField;                     /* Next unread data byte */
1673   int szField;                    /* Size of the current data field */
1674   int i;                          /* Column index */
1675   u8 *a = (u8*)pRec;              /* Typecast byte array */
1676   Mem *pMem = *ppVal;             /* Write result into this Mem object */
1677
1678   assert( iCol>0 );
1679   iHdr = getVarint32(a, nHdr);
1680   if( nHdr>nRec || iHdr>=nHdr ) return SQLITE_CORRUPT_BKPT;
1681   iField = nHdr;
1682   for(i=0; i<=iCol; i++){
1683     iHdr += getVarint32(&a[iHdr], t);
1684     testcase( iHdr==nHdr );
1685     testcase( iHdr==nHdr+1 );
1686     if( iHdr>nHdr ) return SQLITE_CORRUPT_BKPT;
1687     szField = sqlite3VdbeSerialTypeLen(t);
1688     iField += szField;
1689   }
1690   testcase( iField==nRec );
1691   testcase( iField==nRec+1 );
1692   if( iField>nRec ) return SQLITE_CORRUPT_BKPT;
1693   if( pMem==0 ){
1694     pMem = *ppVal = sqlite3ValueNew(db);
1695     if( pMem==0 ) return SQLITE_NOMEM_BKPT;
1696   }
1697   sqlite3VdbeSerialGet(&a[iField-szField], t, pMem);
1698   pMem->enc = ENC(db);
1699   return SQLITE_OK;
1700 }
1701
1702 /*
1703 ** Unless it is NULL, the argument must be an UnpackedRecord object returned
1704 ** by an earlier call to sqlite3Stat4ProbeSetValue(). This call deletes
1705 ** the object.
1706 */
1707 void sqlite3Stat4ProbeFree(UnpackedRecord *pRec){
1708   if( pRec ){
1709     int i;
1710     int nCol = pRec->pKeyInfo->nAllField;
1711     Mem *aMem = pRec->aMem;
1712     sqlite3 *db = aMem[0].db;
1713     for(i=0; i<nCol; i++){
1714       sqlite3VdbeMemRelease(&aMem[i]);
1715     }
1716     sqlite3KeyInfoUnref(pRec->pKeyInfo);
1717     sqlite3DbFreeNN(db, pRec);
1718   }
1719 }
1720 #endif /* ifdef SQLITE_ENABLE_STAT4 */
1721
1722 /*
1723 ** Change the string value of an sqlite3_value object
1724 */
1725 void sqlite3ValueSetStr(
1726   sqlite3_value *v,     /* Value to be set */
1727   int n,                /* Length of string z */
1728   const void *z,        /* Text of the new string */
1729   u8 enc,               /* Encoding to use */
1730   void (*xDel)(void*)   /* Destructor for the string */
1731 ){
1732   if( v ) sqlite3VdbeMemSetStr((Mem *)v, z, n, enc, xDel);
1733 }
1734
1735 /*
1736 ** Free an sqlite3_value object
1737 */
1738 void sqlite3ValueFree(sqlite3_value *v){
1739   if( !v ) return;
1740   sqlite3VdbeMemRelease((Mem *)v);
1741   sqlite3DbFreeNN(((Mem*)v)->db, v);
1742 }
1743
1744 /*
1745 ** The sqlite3ValueBytes() routine returns the number of bytes in the
1746 ** sqlite3_value object assuming that it uses the encoding "enc".
1747 ** The valueBytes() routine is a helper function.
1748 */
1749 static SQLITE_NOINLINE int valueBytes(sqlite3_value *pVal, u8 enc){
1750   return valueToText(pVal, enc)!=0 ? pVal->n : 0;
1751 }
1752 int sqlite3ValueBytes(sqlite3_value *pVal, u8 enc){
1753   Mem *p = (Mem*)pVal;
1754   assert( (p->flags & MEM_Null)==0 || (p->flags & (MEM_Str|MEM_Blob))==0 );
1755   if( (p->flags & MEM_Str)!=0 && pVal->enc==enc ){
1756     return p->n;
1757   }
1758   if( (p->flags & MEM_Blob)!=0 ){
1759     if( p->flags & MEM_Zero ){
1760       return p->n + p->u.nZero;
1761     }else{
1762       return p->n;
1763     }
1764   }
1765   if( p->flags & MEM_Null ) return 0;
1766   return valueBytes(pVal, enc);
1767 }