src/vdbemem.c

   1 /*
   2 ** 2004 May 26
   3 **
   4 ** The author disclaims copyright to this source code.  In place of
   5 ** a legal notice, here is a blessing:
   6 **
   7 **    May you do good and not evil.
   8 **    May you find forgiveness for yourself and forgive others.
   9 **    May you share freely, never taking more than you give.
  10 **
  11 *************************************************************************
  12 **
  13 ** This file contains code use to manipulate "Mem" structure.  A "Mem"
  14 ** stores a single value in the VDBE.  Mem is an opaque structure visible
  15 ** only within the VDBE.  Interface routines refer to a Mem using the
  16 ** name sqlite_value
  17 */
  18 #include "sqliteInt.h"
  19 #include "vdbeInt.h"
  20
  21 /* True if X is a power of two.  0 is considered a power of two here.
  22 ** In other words, return true if X has at most one bit set.
  23 */
  24 #define ISPOWEROF2(X)  (((X)&((X)-1))==0)
  25
  26 #ifdef SQLITE_DEBUG
  27 /*
  28 ** Check invariants on a Mem object.
  29 **
  30 ** This routine is intended for use inside of assert() statements, like
  31 ** this:    assert( sqlite3VdbeCheckMemInvariants(pMem) );
  32 */
  33 int sqlite3VdbeCheckMemInvariants(Mem *p){
  34   /* If MEM_Dyn is set then Mem.xDel!=0.
  35   ** Mem.xDel might not be initialized if MEM_Dyn is clear.
  36   */
  37   assert( (p->flags & MEM_Dyn)==0 || p->xDel!=0 );
  38
  39   /* MEM_Dyn may only be set if Mem.szMalloc==0.  In this way we
  40   ** ensure that if Mem.szMalloc>0 then it is safe to do
  41   ** Mem.z = Mem.zMalloc without having to check Mem.flags&MEM_Dyn.
  42   ** That saves a few cycles in inner loops. */
  43   assert( (p->flags & MEM_Dyn)==0 || p->szMalloc==0 );
  44
  45   /* Cannot have more than one of MEM_Int, MEM_Real, or MEM_IntReal */
  46   assert( ISPOWEROF2(p->flags & (MEM_Int|MEM_Real|MEM_IntReal)) );
  47
  48   if( p->flags & MEM_Null ){
  49     /* Cannot be both MEM_Null and some other type */
  50     assert( (p->flags & (MEM_Int|MEM_Real|MEM_Str|MEM_Blob|MEM_Agg))==0 );
  51
  52     /* If MEM_Null is set, then either the value is a pure NULL (the usual
  53     ** case) or it is a pointer set using sqlite3_bind_pointer() or
  54     ** sqlite3_result_pointer().  If a pointer, then MEM_Term must also be
  55     ** set.
  56     */
  57     if( (p->flags & (MEM_Term|MEM_Subtype))==(MEM_Term|MEM_Subtype) ){
  58       /* This is a pointer type.  There may be a flag to indicate what to
  59       ** do with the pointer. */
  60       assert( ((p->flags&MEM_Dyn)!=0 ? 1 : 0) +
  61               ((p->flags&MEM_Ephem)!=0 ? 1 : 0) +
  62               ((p->flags&MEM_Static)!=0 ? 1 : 0) <= 1 );
  63
  64       /* No other bits set */
  65       assert( (p->flags & ~(MEM_Null|MEM_Term|MEM_Subtype|MEM_FromBind
  66                            |MEM_Dyn|MEM_Ephem|MEM_Static))==0 );
  67     }else{
  68       /* A pure NULL might have other flags, such as MEM_Static, MEM_Dyn,
  69       ** MEM_Ephem, MEM_Cleared, or MEM_Subtype */
  70     }
  71   }else{
  72     /* The MEM_Cleared bit is only allowed on NULLs */
  73     assert( (p->flags & MEM_Cleared)==0 );
  74   }
  75
  76   /* The szMalloc field holds the correct memory allocation size */
  77   assert( p->szMalloc==0
  78        || (p->flags==MEM_Undefined
  79            && p->szMalloc<=sqlite3DbMallocSize(p->db,p->zMalloc))
  80        || p->szMalloc==sqlite3DbMallocSize(p->db,p->zMalloc));
  81
  82   /* If p holds a string or blob, the Mem.z must point to exactly
  83   ** one of the following:
  84   **
  85   **   (1) Memory in Mem.zMalloc and managed by the Mem object
  86   **   (2) Memory to be freed using Mem.xDel
  87   **   (3) An ephemeral string or blob
  88   **   (4) A static string or blob
  89   */
  90   if( (p->flags & (MEM_Str|MEM_Blob)) && p->n>0 ){
  91     assert(
  92       ((p->szMalloc>0 && p->z==p->zMalloc)? 1 : 0) +
  93       ((p->flags&MEM_Dyn)!=0 ? 1 : 0) +
  94       ((p->flags&MEM_Ephem)!=0 ? 1 : 0) +
  95       ((p->flags&MEM_Static)!=0 ? 1 : 0) == 1
  96     );
  97   }
  98   return 1;
  99 }
 100 #endif
 101
 102 /*
 103 ** Render a Mem object which is one of MEM_Int, MEM_Real, or MEM_IntReal
 104 ** into a buffer.
 105 */
 106 static void vdbeMemRenderNum(int sz, char *zBuf, Mem *p){
 107   StrAccum acc;
 108   assert( p->flags & (MEM_Int|MEM_Real|MEM_IntReal) );
 109   assert( sz>22 );
 110   if( p->flags & MEM_Int ){
 111 #if GCC_VERSION>=7000000
 112     /* Work-around for GCC bug
 113     ** https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96270 */
 114     i64 x;
 115     assert( (p->flags&MEM_Int)*2==sizeof(x) );
 116     memcpy(&x, (char*)&p->u, (p->flags&MEM_Int)*2);
 117     p->n = sqlite3Int64ToText(x, zBuf);
 118 #else
 119     p->n = sqlite3Int64ToText(p->u.i, zBuf);
 120 #endif
 121   }else{
 122     sqlite3StrAccumInit(&acc, 0, zBuf, sz, 0);
 123     sqlite3_str_appendf(&acc, "%!.15g",
 124          (p->flags & MEM_IntReal)!=0 ? (double)p->u.i : p->u.r);
 125     assert( acc.zText==zBuf && acc.mxAlloc<=0 );
 126     zBuf[acc.nChar] = 0; /* Fast version of sqlite3StrAccumFinish(&acc) */
 127     p->n = acc.nChar;
 128   }
 129 }
 130
 131 #ifdef SQLITE_DEBUG
 132 /*
 133 ** Validity checks on pMem.  pMem holds a string.
 134 **
 135 ** (1) Check that string value of pMem agrees with its integer or real value.
 136 ** (2) Check that the string is correctly zero terminated
 137 **
 138 ** A single int or real value always converts to the same strings.  But
 139 ** many different strings can be converted into the same int or real.
 140 ** If a table contains a numeric value and an index is based on the
 141 ** corresponding string value, then it is important that the string be
 142 ** derived from the numeric value, not the other way around, to ensure
 143 ** that the index and table are consistent.  See ticket
 144 ** https://www.sqlite.org/src/info/343634942dd54ab (2018-01-31) for
 145 ** an example.
 146 **
 147 ** This routine looks at pMem to verify that if it has both a numeric
 148 ** representation and a string representation then the string rep has
 149 ** been derived from the numeric and not the other way around.  It returns
 150 ** true if everything is ok and false if there is a problem.
 151 **
 152 ** This routine is for use inside of assert() statements only.
 153 */
 154 int sqlite3VdbeMemValidStrRep(Mem *p){
 155   Mem tmp;
 156   char zBuf[100];
 157   char *z;
 158   int i, j, incr;
 159   if( (p->flags & MEM_Str)==0 ) return 1;
 160   if( p->db && p->db->mallocFailed ) return 1;
 161   if( p->flags & MEM_Term ){
 162     /* Insure that the string is properly zero-terminated.  Pay particular
 163     ** attention to the case where p->n is odd */
 164     if( p->szMalloc>0 && p->z==p->zMalloc ){
 165       assert( p->enc==SQLITE_UTF8 || p->szMalloc >= ((p->n+1)&~1)+2 );
 166       assert( p->enc!=SQLITE_UTF8 || p->szMalloc >= p->n+1 );
 167     }
 168     assert( p->z[p->n]==0 );
 169     assert( p->enc==SQLITE_UTF8 || p->z[(p->n+1)&~1]==0 );
 170     assert( p->enc==SQLITE_UTF8 || p->z[((p->n+1)&~1)+1]==0 );
 171   }
 172   if( (p->flags & (MEM_Int|MEM_Real|MEM_IntReal))==0 ) return 1;
 173   memcpy(&tmp, p, sizeof(tmp));
 174   vdbeMemRenderNum(sizeof(zBuf), zBuf, &tmp);
 175   z = p->z;
 176   i = j = 0;
 177   incr = 1;
 178   if( p->enc!=SQLITE_UTF8 ){
 179     incr = 2;
 180     if( p->enc==SQLITE_UTF16BE ) z++;
 181   }
 182   while( zBuf[j] ){
 183     if( zBuf[j++]!=z[i] ) return 0;
 184     i += incr;
 185   }
 186   return 1;
 187 }
 188 #endif /* SQLITE_DEBUG */
 189
 190 /*
 191 ** If pMem is an object with a valid string representation, this routine
 192 ** ensures the internal encoding for the string representation is
 193 ** 'desiredEnc', one of SQLITE_UTF8, SQLITE_UTF16LE or SQLITE_UTF16BE.
 194 **
 195 ** If pMem is not a string object, or the encoding of the string
 196 ** representation is already stored using the requested encoding, then this
 197 ** routine is a no-op.
 198 **
 199 ** SQLITE_OK is returned if the conversion is successful (or not required).
 200 ** SQLITE_NOMEM may be returned if a malloc() fails during conversion
 201 ** between formats.
 202 */
 203 int sqlite3VdbeChangeEncoding(Mem *pMem, int desiredEnc){
 204 #ifndef SQLITE_OMIT_UTF16
 205   int rc;
 206 #endif
 207   assert( pMem!=0 );
 208   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 209   assert( desiredEnc==SQLITE_UTF8 || desiredEnc==SQLITE_UTF16LE
 210            || desiredEnc==SQLITE_UTF16BE );
 211   if( !(pMem->flags&MEM_Str) ){
 212     pMem->enc = desiredEnc;
 213     return SQLITE_OK;
 214   }
 215   if( pMem->enc==desiredEnc ){
 216     return SQLITE_OK;
 217   }
 218   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 219 #ifdef SQLITE_OMIT_UTF16
 220   return SQLITE_ERROR;
 221 #else
 222
 223   /* MemTranslate() may return SQLITE_OK or SQLITE_NOMEM. If NOMEM is returned,
 224   ** then the encoding of the value may not have changed.
 225   */
 226   rc = sqlite3VdbeMemTranslate(pMem, (u8)desiredEnc);
 227   assert(rc==SQLITE_OK    || rc==SQLITE_NOMEM);
 228   assert(rc==SQLITE_OK    || pMem->enc!=desiredEnc);
 229   assert(rc==SQLITE_NOMEM || pMem->enc==desiredEnc);
 230   return rc;
 231 #endif
 232 }
 233
 234 /*
 235 ** Make sure pMem->z points to a writable allocation of at least n bytes.
 236 **
 237 ** If the bPreserve argument is true, then copy of the content of
 238 ** pMem->z into the new allocation.  pMem must be either a string or
 239 ** blob if bPreserve is true.  If bPreserve is false, any prior content
 240 ** in pMem->z is discarded.
 241 */
 242 SQLITE_NOINLINE int sqlite3VdbeMemGrow(Mem *pMem, int n, int bPreserve){
 243   assert( sqlite3VdbeCheckMemInvariants(pMem) );
 244   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 245   testcase( pMem->db==0 );
 246
 247   /* If the bPreserve flag is set to true, then the memory cell must already
 248   ** contain a valid string or blob value.  */
 249   assert( bPreserve==0 || pMem->flags&(MEM_Blob|MEM_Str) );
 250   testcase( bPreserve && pMem->z==0 );
 251
 252   assert( pMem->szMalloc==0
 253        || (pMem->flags==MEM_Undefined
 254            && pMem->szMalloc<=sqlite3DbMallocSize(pMem->db,pMem->zMalloc))
 255        || pMem->szMalloc==sqlite3DbMallocSize(pMem->db,pMem->zMalloc));
 256   if( pMem->szMalloc>0 && bPreserve && pMem->z==pMem->zMalloc ){
 257     if( pMem->db ){
 258       pMem->z = pMem->zMalloc = sqlite3DbReallocOrFree(pMem->db, pMem->z, n);
 259     }else{
 260       pMem->zMalloc = sqlite3Realloc(pMem->z, n);
 261       if( pMem->zMalloc==0 ) sqlite3_free(pMem->z);
 262       pMem->z = pMem->zMalloc;
 263     }
 264     bPreserve = 0;
 265   }else{
 266     if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
 267     pMem->zMalloc = sqlite3DbMallocRaw(pMem->db, n);
 268   }
 269   if( pMem->zMalloc==0 ){
 270     sqlite3VdbeMemSetNull(pMem);
 271     pMem->z = 0;
 272     pMem->szMalloc = 0;
 273     return SQLITE_NOMEM_BKPT;
 274   }else{
 275     pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
 276   }
 277
 278   if( bPreserve && pMem->z ){
 279     assert( pMem->z!=pMem->zMalloc );
 280     memcpy(pMem->zMalloc, pMem->z, pMem->n);
 281   }
 282   if( (pMem->flags&MEM_Dyn)!=0 ){
 283     assert( pMem->xDel!=0 && pMem->xDel!=SQLITE_DYNAMIC );
 284     pMem->xDel((void *)(pMem->z));
 285   }
 286
 287   pMem->z = pMem->zMalloc;
 288   pMem->flags &= ~(MEM_Dyn|MEM_Ephem|MEM_Static);
 289   return SQLITE_OK;
 290 }
 291
 292 /*
 293 ** Change the pMem->zMalloc allocation to be at least szNew bytes.
 294 ** If pMem->zMalloc already meets or exceeds the requested size, this
 295 ** routine is a no-op.
 296 **
 297 ** Any prior string or blob content in the pMem object may be discarded.
 298 ** The pMem->xDel destructor is called, if it exists.  Though MEM_Str
 299 ** and MEM_Blob values may be discarded, MEM_Int, MEM_Real, MEM_IntReal,
 300 ** and MEM_Null values are preserved.
 301 **
 302 ** Return SQLITE_OK on success or an error code (probably SQLITE_NOMEM)
 303 ** if unable to complete the resizing.
 304 */
 305 int sqlite3VdbeMemClearAndResize(Mem *pMem, int szNew){
 306   assert( CORRUPT_DB || szNew>0 );
 307   assert( (pMem->flags & MEM_Dyn)==0 || pMem->szMalloc==0 );
 308   if( pMem->szMalloc<szNew ){
 309     return sqlite3VdbeMemGrow(pMem, szNew, 0);
 310   }
 311   assert( (pMem->flags & MEM_Dyn)==0 );
 312   pMem->z = pMem->zMalloc;
 313   pMem->flags &= (MEM_Null|MEM_Int|MEM_Real|MEM_IntReal);
 314   return SQLITE_OK;
 315 }
 316
 317 /*
 318 ** If pMem is already a string, detect if it is a zero-terminated
 319 ** string, or make it into one if possible, and mark it as such.
 320 **
 321 ** This is an optimization.  Correct operation continues even if
 322 ** this routine is a no-op.
 323 */
 324 void sqlite3VdbeMemZeroTerminateIfAble(Mem *pMem){
 325   if( (pMem->flags & (MEM_Str|MEM_Term|MEM_Ephem|MEM_Static))!=MEM_Str ){
 326     /* pMem must be a string, and it cannot be an ephemeral or static string */
 327     return;
 328   }
 329   if( pMem->enc!=SQLITE_UTF8 ) return;
 330   if( NEVER(pMem->z==0) ) return;
 331   if( pMem->flags & MEM_Dyn ){
 332     if( pMem->xDel==sqlite3_free
 333      && sqlite3_msize(pMem->z) >= (u64)(pMem->n+1)
 334     ){
 335       pMem->z[pMem->n] = 0;
 336       pMem->flags |= MEM_Term;
 337       return;
 338     }
 339     if( pMem->xDel==sqlite3RCStrUnref ){
 340       /* Blindly assume that all RCStr objects are zero-terminated */
 341       pMem->flags |= MEM_Term;
 342       return;
 343     }
 344   }else if( pMem->szMalloc >= pMem->n+1 ){
 345     pMem->z[pMem->n] = 0;
 346     pMem->flags |= MEM_Term;
 347     return;
 348   }
 349 }
 350
 351 /*
 352 ** It is already known that pMem contains an unterminated string.
 353 ** Add the zero terminator.
 354 **
 355 ** Three bytes of zero are added.  In this way, there is guaranteed
 356 ** to be a double-zero byte at an even byte boundary in order to
 357 ** terminate a UTF16 string, even if the initial size of the buffer
 358 ** is an odd number of bytes.
 359 */
 360 static SQLITE_NOINLINE int vdbeMemAddTerminator(Mem *pMem){
 361   if( sqlite3VdbeMemGrow(pMem, pMem->n+3, 1) ){
 362     return SQLITE_NOMEM_BKPT;
 363   }
 364   pMem->z[pMem->n] = 0;
 365   pMem->z[pMem->n+1] = 0;
 366   pMem->z[pMem->n+2] = 0;
 367   pMem->flags |= MEM_Term;
 368   return SQLITE_OK;
 369 }
 370
 371 /*
 372 ** Change pMem so that its MEM_Str or MEM_Blob value is stored in
 373 ** MEM.zMalloc, where it can be safely written.
 374 **
 375 ** Return SQLITE_OK on success or SQLITE_NOMEM if malloc fails.
 376 */
 377 int sqlite3VdbeMemMakeWriteable(Mem *pMem){
 378   assert( pMem!=0 );
 379   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 380   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 381   if( (pMem->flags & (MEM_Str|MEM_Blob))!=0 ){
 382     if( ExpandBlob(pMem) ) return SQLITE_NOMEM;
 383     if( pMem->szMalloc==0 || pMem->z!=pMem->zMalloc ){
 384       int rc = vdbeMemAddTerminator(pMem);
 385       if( rc ) return rc;
 386     }
 387   }
 388   pMem->flags &= ~MEM_Ephem;
 389 #ifdef SQLITE_DEBUG
 390   pMem->pScopyFrom = 0;
 391 #endif
 392
 393   return SQLITE_OK;
 394 }
 395
 396 /*
 397 ** If the given Mem* has a zero-filled tail, turn it into an ordinary
 398 ** blob stored in dynamically allocated space.
 399 */
 400 #ifndef SQLITE_OMIT_INCRBLOB
 401 int sqlite3VdbeMemExpandBlob(Mem *pMem){
 402   int nByte;
 403   assert( pMem!=0 );
 404   assert( pMem->flags & MEM_Zero );
 405   assert( (pMem->flags&MEM_Blob)!=0 || MemNullNochng(pMem) );
 406   testcase( sqlite3_value_nochange(pMem) );
 407   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 408   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 409
 410   /* Set nByte to the number of bytes required to store the expanded blob. */
 411   nByte = pMem->n + pMem->u.nZero;
 412   if( nByte<=0 ){
 413     if( (pMem->flags & MEM_Blob)==0 ) return SQLITE_OK;
 414     nByte = 1;
 415   }
 416   if( sqlite3VdbeMemGrow(pMem, nByte, 1) ){
 417     return SQLITE_NOMEM_BKPT;
 418   }
 419   assert( pMem->z!=0 );
 420   assert( sqlite3DbMallocSize(pMem->db,pMem->z) >= nByte );
 421
 422   memset(&pMem->z[pMem->n], 0, pMem->u.nZero);
 423   pMem->n += pMem->u.nZero;
 424   pMem->flags &= ~(MEM_Zero|MEM_Term);
 425   return SQLITE_OK;
 426 }
 427 #endif
 428
 429 /*
 430 ** Make sure the given Mem is \u0000 terminated.
 431 */
 432 int sqlite3VdbeMemNulTerminate(Mem *pMem){
 433   assert( pMem!=0 );
 434   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 435   testcase( (pMem->flags & (MEM_Term|MEM_Str))==(MEM_Term|MEM_Str) );
 436   testcase( (pMem->flags & (MEM_Term|MEM_Str))==0 );
 437   if( (pMem->flags & (MEM_Term|MEM_Str))!=MEM_Str ){
 438     return SQLITE_OK;   /* Nothing to do */
 439   }else{
 440     return vdbeMemAddTerminator(pMem);
 441   }
 442 }
 443
 444 /*
 445 ** Add MEM_Str to the set of representations for the given Mem.  This
 446 ** routine is only called if pMem is a number of some kind, not a NULL
 447 ** or a BLOB.
 448 **
 449 ** Existing representations MEM_Int, MEM_Real, or MEM_IntReal are invalidated
 450 ** if bForce is true but are retained if bForce is false.
 451 **
 452 ** A MEM_Null value will never be passed to this function. This function is
 453 ** used for converting values to text for returning to the user (i.e. via
 454 ** sqlite3_value_text()), or for ensuring that values to be used as btree
 455 ** keys are strings. In the former case a NULL pointer is returned the
 456 ** user and the latter is an internal programming error.
 457 */
 458 int sqlite3VdbeMemStringify(Mem *pMem, u8 enc, u8 bForce){
 459   const int nByte = 32;
 460
 461   assert( pMem!=0 );
 462   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 463   assert( !(pMem->flags&MEM_Zero) );
 464   assert( !(pMem->flags&(MEM_Str|MEM_Blob)) );
 465   assert( pMem->flags&(MEM_Int|MEM_Real|MEM_IntReal) );
 466   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 467   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 468
 469
 470   if( sqlite3VdbeMemClearAndResize(pMem, nByte) ){
 471     pMem->enc = 0;
 472     return SQLITE_NOMEM_BKPT;
 473   }
 474
 475   vdbeMemRenderNum(nByte, pMem->z, pMem);
 476   assert( pMem->z!=0 );
 477   assert( pMem->n==(int)sqlite3Strlen30NN(pMem->z) );
 478   pMem->enc = SQLITE_UTF8;
 479   pMem->flags |= MEM_Str|MEM_Term;
 480   if( bForce ) pMem->flags &= ~(MEM_Int|MEM_Real|MEM_IntReal);
 481   sqlite3VdbeChangeEncoding(pMem, enc);
 482   return SQLITE_OK;
 483 }
 484
 485 /*
 486 ** Memory cell pMem contains the context of an aggregate function.
 487 ** This routine calls the finalize method for that function.  The
 488 ** result of the aggregate is stored back into pMem.
 489 **
 490 ** Return SQLITE_ERROR if the finalizer reports an error.  SQLITE_OK
 491 ** otherwise.
 492 */
 493 int sqlite3VdbeMemFinalize(Mem *pMem, FuncDef *pFunc){
 494   sqlite3_context ctx;
 495   Mem t;
 496   assert( pFunc!=0 );
 497   assert( pMem!=0 );
 498   assert( pMem->db!=0 );
 499   assert( pFunc->xFinalize!=0 );
 500   assert( (pMem->flags & MEM_Null)!=0 || pFunc==pMem->u.pDef );
 501   assert( sqlite3_mutex_held(pMem->db->mutex) );
 502   memset(&ctx, 0, sizeof(ctx));
 503   memset(&t, 0, sizeof(t));
 504   t.flags = MEM_Null;
 505   t.db = pMem->db;
 506   ctx.pOut = &t;
 507   ctx.pMem = pMem;
 508   ctx.pFunc = pFunc;
 509   ctx.enc = ENC(t.db);
 510   pFunc->xFinalize(&ctx); /* IMP: R-24505-23230 */
 511   assert( (pMem->flags & MEM_Dyn)==0 );
 512   if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
 513   memcpy(pMem, &t, sizeof(t));
 514   return ctx.isError;
 515 }
 516
 517 /*
 518 ** Memory cell pAccum contains the context of an aggregate function.
 519 ** This routine calls the xValue method for that function and stores
 520 ** the results in memory cell pMem.
 521 **
 522 ** SQLITE_ERROR is returned if xValue() reports an error. SQLITE_OK
 523 ** otherwise.
 524 */
 525 #ifndef SQLITE_OMIT_WINDOWFUNC
 526 int sqlite3VdbeMemAggValue(Mem *pAccum, Mem *pOut, FuncDef *pFunc){
 527   sqlite3_context ctx;
 528   assert( pFunc!=0 );
 529   assert( pFunc->xValue!=0 );
 530   assert( (pAccum->flags & MEM_Null)!=0 || pFunc==pAccum->u.pDef );
 531   assert( pAccum->db!=0 );
 532   assert( sqlite3_mutex_held(pAccum->db->mutex) );
 533   memset(&ctx, 0, sizeof(ctx));
 534   sqlite3VdbeMemSetNull(pOut);
 535   ctx.pOut = pOut;
 536   ctx.pMem = pAccum;
 537   ctx.pFunc = pFunc;
 538   ctx.enc = ENC(pAccum->db);
 539   pFunc->xValue(&ctx);
 540   return ctx.isError;
 541 }
 542 #endif /* SQLITE_OMIT_WINDOWFUNC */
 543
 544 /*
 545 ** If the memory cell contains a value that must be freed by
 546 ** invoking the external callback in Mem.xDel, then this routine
 547 ** will free that value.  It also sets Mem.flags to MEM_Null.
 548 **
 549 ** This is a helper routine for sqlite3VdbeMemSetNull() and
 550 ** for sqlite3VdbeMemRelease().  Use those other routines as the
 551 ** entry point for releasing Mem resources.
 552 */
 553 static SQLITE_NOINLINE void vdbeMemClearExternAndSetNull(Mem *p){
 554   assert( p->db==0 || sqlite3_mutex_held(p->db->mutex) );
 555   assert( VdbeMemDynamic(p) );
 556   if( p->flags&MEM_Agg ){
 557     sqlite3VdbeMemFinalize(p, p->u.pDef);
 558     assert( (p->flags & MEM_Agg)==0 );
 559     testcase( p->flags & MEM_Dyn );
 560   }
 561   if( p->flags&MEM_Dyn ){
 562     assert( p->xDel!=SQLITE_DYNAMIC && p->xDel!=0 );
 563     p->xDel((void *)p->z);
 564   }
 565   p->flags = MEM_Null;
 566 }
 567
 568 /*
 569 ** Release memory held by the Mem p, both external memory cleared
 570 ** by p->xDel and memory in p->zMalloc.
 571 **
 572 ** This is a helper routine invoked by sqlite3VdbeMemRelease() in
 573 ** the unusual case where there really is memory in p that needs
 574 ** to be freed.
 575 */
 576 static SQLITE_NOINLINE void vdbeMemClear(Mem *p){
 577   if( VdbeMemDynamic(p) ){
 578     vdbeMemClearExternAndSetNull(p);
 579   }
 580   if( p->szMalloc ){
 581     sqlite3DbFreeNN(p->db, p->zMalloc);
 582     p->szMalloc = 0;
 583   }
 584   p->z = 0;
 585 }
 586
 587 /*
 588 ** Release any memory resources held by the Mem.  Both the memory that is
 589 ** free by Mem.xDel and the Mem.zMalloc allocation are freed.
 590 **
 591 ** Use this routine prior to clean up prior to abandoning a Mem, or to
 592 ** reset a Mem back to its minimum memory utilization.
 593 **
 594 ** Use sqlite3VdbeMemSetNull() to release just the Mem.xDel space
 595 ** prior to inserting new content into the Mem.
 596 */
 597 void sqlite3VdbeMemRelease(Mem *p){
 598   assert( sqlite3VdbeCheckMemInvariants(p) );
 599   if( VdbeMemDynamic(p) || p->szMalloc ){
 600     vdbeMemClear(p);
 601   }
 602 }
 603
 604 /* Like sqlite3VdbeMemRelease() but faster for cases where we
 605 ** know in advance that the Mem is not MEM_Dyn or MEM_Agg.
 606 */
 607 void sqlite3VdbeMemReleaseMalloc(Mem *p){
 608   assert( !VdbeMemDynamic(p) );
 609   if( p->szMalloc ) vdbeMemClear(p);
 610 }
 611
 612 /*
 613 ** Return some kind of integer value which is the best we can do
 614 ** at representing the value that *pMem describes as an integer.
 615 ** If pMem is an integer, then the value is exact.  If pMem is
 616 ** a floating-point then the value returned is the integer part.
 617 ** If pMem is a string or blob, then we make an attempt to convert
 618 ** it into an integer and return that.  If pMem represents an
 619 ** an SQL-NULL value, return 0.
 620 **
 621 ** If pMem represents a string value, its encoding might be changed.
 622 */
 623 static SQLITE_NOINLINE i64 memIntValue(const Mem *pMem){
 624   i64 value = 0;
 625   sqlite3Atoi64(pMem->z, &value, pMem->n, pMem->enc);
 626   return value;
 627 }
 628 i64 sqlite3VdbeIntValue(const Mem *pMem){
 629   int flags;
 630   assert( pMem!=0 );
 631   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 632   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 633   flags = pMem->flags;
 634   if( flags & (MEM_Int|MEM_IntReal) ){
 635     testcase( flags & MEM_IntReal );
 636     return pMem->u.i;
 637   }else if( flags & MEM_Real ){
 638     return sqlite3RealToI64(pMem->u.r);
 639   }else if( (flags & (MEM_Str|MEM_Blob))!=0 && pMem->z!=0 ){
 640     return memIntValue(pMem);
 641   }else{
 642     return 0;
 643   }
 644 }
 645
 646 /*
 647 ** Return the best representation of pMem that we can get into a
 648 ** double.  If pMem is already a double or an integer, return its
 649 ** value.  If it is a string or blob, try to convert it to a double.
 650 ** If it is a NULL, return 0.0.
 651 */
 652 static SQLITE_NOINLINE double memRealValue(Mem *pMem){
 653   /* (double)0 In case of SQLITE_OMIT_FLOATING_POINT... */
 654   double val = (double)0;
 655   sqlite3AtoF(pMem->z, &val, pMem->n, pMem->enc);
 656   return val;
 657 }
 658 double sqlite3VdbeRealValue(Mem *pMem){
 659   assert( pMem!=0 );
 660   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 661   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 662   if( pMem->flags & MEM_Real ){
 663     return pMem->u.r;
 664   }else if( pMem->flags & (MEM_Int|MEM_IntReal) ){
 665     testcase( pMem->flags & MEM_IntReal );
 666     return (double)pMem->u.i;
 667   }else if( pMem->flags & (MEM_Str|MEM_Blob) ){
 668     return memRealValue(pMem);
 669   }else{
 670     /* (double)0 In case of SQLITE_OMIT_FLOATING_POINT... */
 671     return (double)0;
 672   }
 673 }
 674
 675 /*
 676 ** Return 1 if pMem represents true, and return 0 if pMem represents false.
 677 ** Return the value ifNull if pMem is NULL.
 678 */
 679 int sqlite3VdbeBooleanValue(Mem *pMem, int ifNull){
 680   testcase( pMem->flags & MEM_IntReal );
 681   if( pMem->flags & (MEM_Int|MEM_IntReal) ) return pMem->u.i!=0;
 682   if( pMem->flags & MEM_Null ) return ifNull;
 683   return sqlite3VdbeRealValue(pMem)!=0.0;
 684 }
 685
 686 /*
 687 ** The MEM structure is already a MEM_Real or MEM_IntReal. Try to
 688 ** make it a MEM_Int if we can.
 689 */
 690 void sqlite3VdbeIntegerAffinity(Mem *pMem){
 691   assert( pMem!=0 );
 692   assert( pMem->flags & (MEM_Real|MEM_IntReal) );
 693   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 694   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 695   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 696
 697   if( pMem->flags & MEM_IntReal ){
 698     MemSetTypeFlag(pMem, MEM_Int);
 699   }else{
 700     i64 ix = sqlite3RealToI64(pMem->u.r);
 701
 702     /* Only mark the value as an integer if
 703     **
 704     **    (1) the round-trip conversion real->int->real is a no-op, and
 705     **    (2) The integer is neither the largest nor the smallest
 706     **        possible integer (ticket #3922)
 707     **
 708     ** The second and third terms in the following conditional enforces
 709     ** the second condition under the assumption that addition overflow causes
 710     ** values to wrap around.
 711     */
 712     if( pMem->u.r==ix && ix>SMALLEST_INT64 && ix<LARGEST_INT64 ){
 713       pMem->u.i = ix;
 714       MemSetTypeFlag(pMem, MEM_Int);
 715     }
 716   }
 717 }
 718
 719 /*
 720 ** Convert pMem to type integer.  Invalidate any prior representations.
 721 */
 722 int sqlite3VdbeMemIntegerify(Mem *pMem){
 723   assert( pMem!=0 );
 724   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 725   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 726   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 727
 728   pMem->u.i = sqlite3VdbeIntValue(pMem);
 729   MemSetTypeFlag(pMem, MEM_Int);
 730   return SQLITE_OK;
 731 }
 732
 733 /*
 734 ** Convert pMem so that it is of type MEM_Real.
 735 ** Invalidate any prior representations.
 736 */
 737 int sqlite3VdbeMemRealify(Mem *pMem){
 738   assert( pMem!=0 );
 739   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 740   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 741
 742   pMem->u.r = sqlite3VdbeRealValue(pMem);
 743   MemSetTypeFlag(pMem, MEM_Real);
 744   return SQLITE_OK;
 745 }
 746
 747 /* Compare a floating point value to an integer.  Return true if the two
 748 ** values are the same within the precision of the floating point value.
 749 **
 750 ** This function assumes that i was obtained by assignment from r1.
 751 **
 752 ** For some versions of GCC on 32-bit machines, if you do the more obvious
 753 ** comparison of "r1==(double)i" you sometimes get an answer of false even
 754 ** though the r1 and (double)i values are bit-for-bit the same.
 755 */
 756 int sqlite3RealSameAsInt(double r1, sqlite3_int64 i){
 757   double r2 = (double)i;
 758   return r1==0.0
 759       || (memcmp(&r1, &r2, sizeof(r1))==0
 760           && i >= -2251799813685248LL && i < 2251799813685248LL);
 761 }
 762
 763 /* Convert a floating point value to its closest integer.  Do so in
 764 ** a way that avoids 'outside the range of representable values' warnings
 765 ** from UBSAN.
 766 */
 767 i64 sqlite3RealToI64(double r){
 768   if( r<-9223372036854774784.0 ) return SMALLEST_INT64;
 769   if( r>+9223372036854774784.0 ) return LARGEST_INT64;
 770   return (i64)r;
 771 }
 772
 773 /*
 774 ** Convert pMem so that it has type MEM_Real or MEM_Int.
 775 ** Invalidate any prior representations.
 776 **
 777 ** Every effort is made to force the conversion, even if the input
 778 ** is a string that does not look completely like a number.  Convert
 779 ** as much of the string as we can and ignore the rest.
 780 */
 781 int sqlite3VdbeMemNumerify(Mem *pMem){
 782   assert( pMem!=0 );
 783   testcase( pMem->flags & MEM_Int );
 784   testcase( pMem->flags & MEM_Real );
 785   testcase( pMem->flags & MEM_IntReal );
 786   testcase( pMem->flags & MEM_Null );
 787   if( (pMem->flags & (MEM_Int|MEM_Real|MEM_IntReal|MEM_Null))==0 ){
 788     int rc;
 789     sqlite3_int64 ix;
 790     assert( (pMem->flags & (MEM_Blob|MEM_Str))!=0 );
 791     assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 792     rc = sqlite3AtoF(pMem->z, &pMem->u.r, pMem->n, pMem->enc);
 793     if( ((rc==0 || rc==1) && sqlite3Atoi64(pMem->z, &ix, pMem->n, pMem->enc)<=1)
 794      || sqlite3RealSameAsInt(pMem->u.r, (ix = sqlite3RealToI64(pMem->u.r)))
 795     ){
 796       pMem->u.i = ix;
 797       MemSetTypeFlag(pMem, MEM_Int);
 798     }else{
 799       MemSetTypeFlag(pMem, MEM_Real);
 800     }
 801   }
 802   assert( (pMem->flags & (MEM_Int|MEM_Real|MEM_IntReal|MEM_Null))!=0 );
 803   pMem->flags &= ~(MEM_Str|MEM_Blob|MEM_Zero);
 804   return SQLITE_OK;
 805 }
 806
 807 /*
 808 ** Cast the datatype of the value in pMem according to the affinity
 809 ** "aff".  Casting is different from applying affinity in that a cast
 810 ** is forced.  In other words, the value is converted into the desired
 811 ** affinity even if that results in loss of data.  This routine is
 812 ** used (for example) to implement the SQL "cast()" operator.
 813 */
 814 int sqlite3VdbeMemCast(Mem *pMem, u8 aff, u8 encoding){
 815   if( pMem->flags & MEM_Null ) return SQLITE_OK;
 816   switch( aff ){
 817     case SQLITE_AFF_BLOB: {   /* Really a cast to BLOB */
 818       if( (pMem->flags & MEM_Blob)==0 ){
 819         sqlite3ValueApplyAffinity(pMem, SQLITE_AFF_TEXT, encoding);
 820         assert( pMem->flags & MEM_Str || pMem->db->mallocFailed );
 821         if( pMem->flags & MEM_Str ) MemSetTypeFlag(pMem, MEM_Blob);
 822       }else{
 823         pMem->flags &= ~(MEM_TypeMask&~MEM_Blob);
 824       }
 825       break;
 826     }
 827     case SQLITE_AFF_NUMERIC: {
 828       sqlite3VdbeMemNumerify(pMem);
 829       break;
 830     }
 831     case SQLITE_AFF_INTEGER: {
 832       sqlite3VdbeMemIntegerify(pMem);
 833       break;
 834     }
 835     case SQLITE_AFF_REAL: {
 836       sqlite3VdbeMemRealify(pMem);
 837       break;
 838     }
 839     default: {
 840       int rc;
 841       assert( aff==SQLITE_AFF_TEXT );
 842       assert( MEM_Str==(MEM_Blob>>3) );
 843       pMem->flags |= (pMem->flags&MEM_Blob)>>3;
 844       sqlite3ValueApplyAffinity(pMem, SQLITE_AFF_TEXT, encoding);
 845       assert( pMem->flags & MEM_Str || pMem->db->mallocFailed );
 846       pMem->flags &= ~(MEM_Int|MEM_Real|MEM_IntReal|MEM_Blob|MEM_Zero);
 847       if( encoding!=SQLITE_UTF8 ) pMem->n &= ~1;
 848       rc = sqlite3VdbeChangeEncoding(pMem, encoding);
 849       if( rc ) return rc;
 850       sqlite3VdbeMemZeroTerminateIfAble(pMem);
 851     }
 852   }
 853   return SQLITE_OK;
 854 }
 855
 856 /*
 857 ** Initialize bulk memory to be a consistent Mem object.
 858 **
 859 ** The minimum amount of initialization feasible is performed.
 860 */
 861 void sqlite3VdbeMemInit(Mem *pMem, sqlite3 *db, u16 flags){
 862   assert( (flags & ~MEM_TypeMask)==0 );
 863   pMem->flags = flags;
 864   pMem->db = db;
 865   pMem->szMalloc = 0;
 866 }
 867
 868
 869 /*
 870 ** Delete any previous value and set the value stored in *pMem to NULL.
 871 **
 872 ** This routine calls the Mem.xDel destructor to dispose of values that
 873 ** require the destructor.  But it preserves the Mem.zMalloc memory allocation.
 874 ** To free all resources, use sqlite3VdbeMemRelease(), which both calls this
 875 ** routine to invoke the destructor and deallocates Mem.zMalloc.
 876 **
 877 ** Use this routine to reset the Mem prior to insert a new value.
 878 **
 879 ** Use sqlite3VdbeMemRelease() to complete erase the Mem prior to abandoning it.
 880 */
 881 void sqlite3VdbeMemSetNull(Mem *pMem){
 882   if( VdbeMemDynamic(pMem) ){
 883     vdbeMemClearExternAndSetNull(pMem);
 884   }else{
 885     pMem->flags = MEM_Null;
 886   }
 887 }
 888 void sqlite3ValueSetNull(sqlite3_value *p){
 889   sqlite3VdbeMemSetNull((Mem*)p);
 890 }
 891
 892 /*
 893 ** Delete any previous value and set the value to be a BLOB of length
 894 ** n containing all zeros.
 895 */
 896 #ifndef SQLITE_OMIT_INCRBLOB
 897 void sqlite3VdbeMemSetZeroBlob(Mem *pMem, int n){
 898   sqlite3VdbeMemRelease(pMem);
 899   pMem->flags = MEM_Blob|MEM_Zero;
 900   pMem->n = 0;
 901   if( n<0 ) n = 0;
 902   pMem->u.nZero = n;
 903   pMem->enc = SQLITE_UTF8;
 904   pMem->z = 0;
 905 }
 906 #else
 907 int sqlite3VdbeMemSetZeroBlob(Mem *pMem, int n){
 908   int nByte = n>0?n:1;
 909   if( sqlite3VdbeMemGrow(pMem, nByte, 0) ){
 910     return SQLITE_NOMEM_BKPT;
 911   }
 912   assert( pMem->z!=0 );
 913   assert( sqlite3DbMallocSize(pMem->db, pMem->z)>=nByte );
 914   memset(pMem->z, 0, nByte);
 915   pMem->n = n>0?n:0;
 916   pMem->flags = MEM_Blob;
 917   pMem->enc = SQLITE_UTF8;
 918   return SQLITE_OK;
 919 }
 920 #endif
 921
 922 /*
 923 ** The pMem is known to contain content that needs to be destroyed prior
 924 ** to a value change.  So invoke the destructor, then set the value to
 925 ** a 64-bit integer.
 926 */
 927 static SQLITE_NOINLINE void vdbeReleaseAndSetInt64(Mem *pMem, i64 val){
 928   sqlite3VdbeMemSetNull(pMem);
 929   pMem->u.i = val;
 930   pMem->flags = MEM_Int;
 931 }
 932
 933 /*
 934 ** Delete any previous value and set the value stored in *pMem to val,
 935 ** manifest type INTEGER.
 936 */
 937 void sqlite3VdbeMemSetInt64(Mem *pMem, i64 val){
 938   if( VdbeMemDynamic(pMem) ){
 939     vdbeReleaseAndSetInt64(pMem, val);
 940   }else{
 941     pMem->u.i = val;
 942     pMem->flags = MEM_Int;
 943   }
 944 }
 945
 946 /*
 947 ** Set the iIdx'th entry of array aMem[] to contain integer value val.
 948 */
 949 void sqlite3MemSetArrayInt64(sqlite3_value *aMem, int iIdx, i64 val){
 950   sqlite3VdbeMemSetInt64(&aMem[iIdx], val);
 951 }
 952
 953 /* A no-op destructor */
 954 void sqlite3NoopDestructor(void *p){ UNUSED_PARAMETER(p); }
 955
 956 /*
 957 ** Set the value stored in *pMem should already be a NULL.
 958 ** Also store a pointer to go with it.
 959 */
 960 void sqlite3VdbeMemSetPointer(
 961   Mem *pMem,
 962   void *pPtr,
 963   const char *zPType,
 964   void (*xDestructor)(void*)
 965 ){
 966   assert( pMem->flags==MEM_Null );
 967   vdbeMemClear(pMem);
 968   pMem->u.zPType = zPType ? zPType : "";
 969   pMem->z = pPtr;
 970   pMem->flags = MEM_Null|MEM_Dyn|MEM_Subtype|MEM_Term;
 971   pMem->eSubtype = 'p';
 972   pMem->xDel = xDestructor ? xDestructor : sqlite3NoopDestructor;
 973 }
 974
 975 #ifndef SQLITE_OMIT_FLOATING_POINT
 976 /*
 977 ** Delete any previous value and set the value stored in *pMem to val,
 978 ** manifest type REAL.
 979 */
 980 void sqlite3VdbeMemSetDouble(Mem *pMem, double val){
 981   sqlite3VdbeMemSetNull(pMem);
 982   if( !sqlite3IsNaN(val) ){
 983     pMem->u.r = val;
 984     pMem->flags = MEM_Real;
 985   }
 986 }
 987 #endif
 988
 989 #ifdef SQLITE_DEBUG
 990 /*
 991 ** Return true if the Mem holds a RowSet object.  This routine is intended
 992 ** for use inside of assert() statements.
 993 */
 994 int sqlite3VdbeMemIsRowSet(const Mem *pMem){
 995   return (pMem->flags&(MEM_Blob|MEM_Dyn))==(MEM_Blob|MEM_Dyn)
 996          && pMem->xDel==sqlite3RowSetDelete;
 997 }
 998 #endif
 999
1000 /*
1001 ** Delete any previous value and set the value of pMem to be an
1002 ** empty boolean index.
1003 **
1004 ** Return SQLITE_OK on success and SQLITE_NOMEM if a memory allocation
1005 ** error occurs.
1006 */
1007 int sqlite3VdbeMemSetRowSet(Mem *pMem){
1008   sqlite3 *db = pMem->db;
1009   RowSet *p;
1010   assert( db!=0 );
1011   assert( !sqlite3VdbeMemIsRowSet(pMem) );
1012   sqlite3VdbeMemRelease(pMem);
1013   p = sqlite3RowSetInit(db);
1014   if( p==0 ) return SQLITE_NOMEM;
1015   pMem->z = (char*)p;
1016   pMem->flags = MEM_Blob|MEM_Dyn;
1017   pMem->xDel = sqlite3RowSetDelete;
1018   return SQLITE_OK;
1019 }
1020
1021 /*
1022 ** Return true if the Mem object contains a TEXT or BLOB that is
1023 ** too large - whose size exceeds SQLITE_MAX_LENGTH.
1024 */
1025 int sqlite3VdbeMemTooBig(Mem *p){
1026   assert( p->db!=0 );
1027   if( p->flags & (MEM_Str|MEM_Blob) ){
1028     int n = p->n;
1029     if( p->flags & MEM_Zero ){
1030       n += p->u.nZero;
1031     }
1032     return n>p->db->aLimit[SQLITE_LIMIT_LENGTH];
1033   }
1034   return 0;
1035 }
1036
1037 #ifdef SQLITE_DEBUG
1038 /*
1039 ** This routine prepares a memory cell for modification by breaking
1040 ** its link to a shallow copy and by marking any current shallow
1041 ** copies of this cell as invalid.
1042 **
1043 ** This is used for testing and debugging only - to help ensure that shallow
1044 ** copies (created by OP_SCopy) are not misused.
1045 */
1046 void sqlite3VdbeMemAboutToChange(Vdbe *pVdbe, Mem *pMem){
1047   int i;
1048   Mem *pX;
1049   for(i=1, pX=pVdbe->aMem+1; i<pVdbe->nMem; i++, pX++){
1050     if( pX->pScopyFrom==pMem ){
1051       u16 mFlags;
1052       if( pVdbe->db->flags & SQLITE_VdbeTrace ){
1053         sqlite3DebugPrintf("Invalidate R[%d] due to change in R[%d]\n",
1054           (int)(pX - pVdbe->aMem), (int)(pMem - pVdbe->aMem));
1055       }
1056       /* If pX is marked as a shallow copy of pMem, then try to verify that
1057       ** no significant changes have been made to pX since the OP_SCopy.
1058       ** A significant change would indicated a missed call to this
1059       ** function for pX.  Minor changes, such as adding or removing a
1060       ** dual type, are allowed, as long as the underlying value is the
1061       ** same. */
1062       mFlags = pMem->flags & pX->flags & pX->mScopyFlags;
1063       assert( (mFlags&(MEM_Int|MEM_IntReal))==0 || pMem->u.i==pX->u.i );
1064
1065       /* pMem is the register that is changing.  But also mark pX as
1066       ** undefined so that we can quickly detect the shallow-copy error */
1067       pX->flags = MEM_Undefined;
1068       pX->pScopyFrom = 0;
1069     }
1070   }
1071   pMem->pScopyFrom = 0;
1072 }
1073 #endif /* SQLITE_DEBUG */
1074
1075 /*
1076 ** Make an shallow copy of pFrom into pTo.  Prior contents of
1077 ** pTo are freed.  The pFrom->z field is not duplicated.  If
1078 ** pFrom->z is used, then pTo->z points to the same thing as pFrom->z
1079 ** and flags gets srcType (either MEM_Ephem or MEM_Static).
1080 */
1081 static SQLITE_NOINLINE void vdbeClrCopy(Mem *pTo, const Mem *pFrom, int eType){
1082   vdbeMemClearExternAndSetNull(pTo);
1083   assert( !VdbeMemDynamic(pTo) );
1084   sqlite3VdbeMemShallowCopy(pTo, pFrom, eType);
1085 }
1086 void sqlite3VdbeMemShallowCopy(Mem *pTo, const Mem *pFrom, int srcType){
1087   assert( !sqlite3VdbeMemIsRowSet(pFrom) );
1088   assert( pTo->db==pFrom->db );
1089   if( VdbeMemDynamic(pTo) ){ vdbeClrCopy(pTo,pFrom,srcType); return; }
1090   memcpy(pTo, pFrom, MEMCELLSIZE);
1091   if( (pFrom->flags&MEM_Static)==0 ){
1092     pTo->flags &= ~(MEM_Dyn|MEM_Static|MEM_Ephem);
1093     assert( srcType==MEM_Ephem || srcType==MEM_Static );
1094     pTo->flags |= srcType;
1095   }
1096 }
1097
1098 /*
1099 ** Make a full copy of pFrom into pTo.  Prior contents of pTo are
1100 ** freed before the copy is made.
1101 */
1102 int sqlite3VdbeMemCopy(Mem *pTo, const Mem *pFrom){
1103   int rc = SQLITE_OK;
1104
1105   assert( !sqlite3VdbeMemIsRowSet(pFrom) );
1106   if( VdbeMemDynamic(pTo) ) vdbeMemClearExternAndSetNull(pTo);
1107   memcpy(pTo, pFrom, MEMCELLSIZE);
1108   pTo->flags &= ~MEM_Dyn;
1109   if( pTo->flags&(MEM_Str|MEM_Blob) ){
1110     if( 0==(pFrom->flags&MEM_Static) ){
1111       pTo->flags |= MEM_Ephem;
1112       rc = sqlite3VdbeMemMakeWriteable(pTo);
1113     }
1114   }
1115
1116   return rc;
1117 }
1118
1119 /*
1120 ** Transfer the contents of pFrom to pTo. Any existing value in pTo is
1121 ** freed. If pFrom contains ephemeral data, a copy is made.
1122 **
1123 ** pFrom contains an SQL NULL when this routine returns.
1124 */
1125 void sqlite3VdbeMemMove(Mem *pTo, Mem *pFrom){
1126   assert( pFrom->db==0 || sqlite3_mutex_held(pFrom->db->mutex) );
1127   assert( pTo->db==0 || sqlite3_mutex_held(pTo->db->mutex) );
1128   assert( pFrom->db==0 || pTo->db==0 || pFrom->db==pTo->db );
1129
1130   sqlite3VdbeMemRelease(pTo);
1131   memcpy(pTo, pFrom, sizeof(Mem));
1132   pFrom->flags = MEM_Null;
1133   pFrom->szMalloc = 0;
1134 }
1135
1136 /*
1137 ** Change the value of a Mem to be a string or a BLOB.
1138 **
1139 ** The memory management strategy depends on the value of the xDel
1140 ** parameter. If the value passed is SQLITE_TRANSIENT, then the
1141 ** string is copied into a (possibly existing) buffer managed by the
1142 ** Mem structure. Otherwise, any existing buffer is freed and the
1143 ** pointer copied.
1144 **
1145 ** If the string is too large (if it exceeds the SQLITE_LIMIT_LENGTH
1146 ** size limit) then no memory allocation occurs.  If the string can be
1147 ** stored without allocating memory, then it is.  If a memory allocation
1148 ** is required to store the string, then value of pMem is unchanged.  In
1149 ** either case, SQLITE_TOOBIG is returned.
1150 **
1151 ** The "enc" parameter is the text encoding for the string, or zero
1152 ** to store a blob.
1153 **
1154 ** If n is negative, then the string consists of all bytes up to but
1155 ** excluding the first zero character.  The n parameter must be
1156 ** non-negative for blobs.
1157 */
1158 int sqlite3VdbeMemSetStr(
1159   Mem *pMem,          /* Memory cell to set to string value */
1160   const char *z,      /* String pointer */
1161   i64 n,              /* Bytes in string, or negative */
1162   u8 enc,             /* Encoding of z.  0 for BLOBs */
1163   void (*xDel)(void*) /* Destructor function */
1164 ){
1165   i64 nByte = n;      /* New value for pMem->n */
1166   int iLimit;         /* Maximum allowed string or blob size */
1167   u16 flags;          /* New value for pMem->flags */
1168
1169   assert( pMem!=0 );
1170   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
1171   assert( !sqlite3VdbeMemIsRowSet(pMem) );
1172   assert( enc!=0 || n>=0 );
1173
1174   /* If z is a NULL pointer, set pMem to contain an SQL NULL. */
1175   if( !z ){
1176     sqlite3VdbeMemSetNull(pMem);
1177     return SQLITE_OK;
1178   }
1179
1180   if( pMem->db ){
1181     iLimit = pMem->db->aLimit[SQLITE_LIMIT_LENGTH];
1182   }else{
1183     iLimit = SQLITE_MAX_LENGTH;
1184   }
1185   if( nByte<0 ){
1186     assert( enc!=0 );
1187     if( enc==SQLITE_UTF8 ){
1188       nByte = strlen(z);
1189     }else{
1190       for(nByte=0; nByte<=iLimit && (z[nByte] | z[nByte+1]); nByte+=2){}
1191     }
1192     flags= MEM_Str|MEM_Term;
1193   }else if( enc==0 ){
1194     flags = MEM_Blob;
1195     enc = SQLITE_UTF8;
1196   }else{
1197     flags = MEM_Str;
1198   }
1199   if( nByte>iLimit ){
1200     if( xDel && xDel!=SQLITE_TRANSIENT ){
1201       if( xDel==SQLITE_DYNAMIC ){
1202         sqlite3DbFree(pMem->db, (void*)z);
1203       }else{
1204         xDel((void*)z);
1205       }
1206     }
1207     sqlite3VdbeMemSetNull(pMem);
1208     return sqlite3ErrorToParser(pMem->db, SQLITE_TOOBIG);
1209   }
1210
1211   /* The following block sets the new values of Mem.z and Mem.xDel. It
1212   ** also sets a flag in local variable "flags" to indicate the memory
1213   ** management (one of MEM_Dyn or MEM_Static).
1214   */
1215   if( xDel==SQLITE_TRANSIENT ){
1216     i64 nAlloc = nByte;
1217     if( flags&MEM_Term ){
1218       nAlloc += (enc==SQLITE_UTF8?1:2);
1219     }
1220     testcase( nAlloc==0 );
1221     testcase( nAlloc==31 );
1222     testcase( nAlloc==32 );
1223     if( sqlite3VdbeMemClearAndResize(pMem, (int)MAX(nAlloc,32)) ){
1224       return SQLITE_NOMEM_BKPT;
1225     }
1226     memcpy(pMem->z, z, nAlloc);
1227   }else{
1228     sqlite3VdbeMemRelease(pMem);
1229     pMem->z = (char *)z;
1230     if( xDel==SQLITE_DYNAMIC ){
1231       pMem->zMalloc = pMem->z;
1232       pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
1233     }else{
1234       pMem->xDel = xDel;
1235       flags |= ((xDel==SQLITE_STATIC)?MEM_Static:MEM_Dyn);
1236     }
1237   }
1238
1239   pMem->n = (int)(nByte & 0x7fffffff);
1240   pMem->flags = flags;
1241   pMem->enc = enc;
1242
1243 #ifndef SQLITE_OMIT_UTF16
1244   if( enc>SQLITE_UTF8 && sqlite3VdbeMemHandleBom(pMem) ){
1245     return SQLITE_NOMEM_BKPT;
1246   }
1247 #endif
1248
1249
1250   return SQLITE_OK;
1251 }
1252
1253 /*
1254 ** Move data out of a btree key or data field and into a Mem structure.
1255 ** The data is payload from the entry that pCur is currently pointing
1256 ** to.  offset and amt determine what portion of the data or key to retrieve.
1257 ** The result is written into the pMem element.
1258 **
1259 ** The pMem object must have been initialized.  This routine will use
1260 ** pMem->zMalloc to hold the content from the btree, if possible.  New
1261 ** pMem->zMalloc space will be allocated if necessary.  The calling routine
1262 ** is responsible for making sure that the pMem object is eventually
1263 ** destroyed.
1264 **
1265 ** If this routine fails for any reason (malloc returns NULL or unable
1266 ** to read from the disk) then the pMem is left in an inconsistent state.
1267 */
1268 int sqlite3VdbeMemFromBtree(
1269   BtCursor *pCur,   /* Cursor pointing at record to retrieve. */
1270   u32 offset,       /* Offset from the start of data to return bytes from. */
1271   u32 amt,          /* Number of bytes to return. */
1272   Mem *pMem         /* OUT: Return data in this Mem structure. */
1273 ){
1274   int rc;
1275   pMem->flags = MEM_Null;
1276   if( sqlite3BtreeMaxRecordSize(pCur)<offset+amt ){
1277     return SQLITE_CORRUPT_BKPT;
1278   }
1279   if( SQLITE_OK==(rc = sqlite3VdbeMemClearAndResize(pMem, amt+1)) ){
1280     rc = sqlite3BtreePayload(pCur, offset, amt, pMem->z);
1281     if( rc==SQLITE_OK ){
1282       pMem->z[amt] = 0;   /* Overrun area used when reading malformed records */
1283       pMem->flags = MEM_Blob;
1284       pMem->n = (int)amt;
1285     }else{
1286       sqlite3VdbeMemRelease(pMem);
1287     }
1288   }
1289   return rc;
1290 }
1291 int sqlite3VdbeMemFromBtreeZeroOffset(
1292   BtCursor *pCur,   /* Cursor pointing at record to retrieve. */
1293   u32 amt,          /* Number of bytes to return. */
1294   Mem *pMem         /* OUT: Return data in this Mem structure. */
1295 ){
1296   u32 available = 0;  /* Number of bytes available on the local btree page */
1297   int rc = SQLITE_OK; /* Return code */
1298
1299   assert( sqlite3BtreeCursorIsValid(pCur) );
1300   assert( !VdbeMemDynamic(pMem) );
1301
1302   /* Note: the calls to BtreeKeyFetch() and DataFetch() below assert()
1303   ** that both the BtShared and database handle mutexes are held. */
1304   assert( !sqlite3VdbeMemIsRowSet(pMem) );
1305   pMem->z = (char *)sqlite3BtreePayloadFetch(pCur, &available);
1306   assert( pMem->z!=0 );
1307
1308   if( amt<=available ){
1309     pMem->flags = MEM_Blob|MEM_Ephem;
1310     pMem->n = (int)amt;
1311   }else{
1312     rc = sqlite3VdbeMemFromBtree(pCur, 0, amt, pMem);
1313   }
1314
1315   return rc;
1316 }
1317
1318 /*
1319 ** The pVal argument is known to be a value other than NULL.
1320 ** Convert it into a string with encoding enc and return a pointer
1321 ** to a zero-terminated version of that string.
1322 */
1323 static SQLITE_NOINLINE const void *valueToText(sqlite3_value* pVal, u8 enc){
1324   assert( pVal!=0 );
1325   assert( pVal->db==0 || sqlite3_mutex_held(pVal->db->mutex) );
1326   assert( (enc&3)==(enc&~SQLITE_UTF16_ALIGNED) );
1327   assert( !sqlite3VdbeMemIsRowSet(pVal) );
1328   assert( (pVal->flags & (MEM_Null))==0 );
1329   if( pVal->flags & (MEM_Blob|MEM_Str) ){
1330     if( ExpandBlob(pVal) ) return 0;
1331     pVal->flags |= MEM_Str;
1332     if( pVal->enc != (enc & ~SQLITE_UTF16_ALIGNED) ){
1333       sqlite3VdbeChangeEncoding(pVal, enc & ~SQLITE_UTF16_ALIGNED);
1334     }
1335     if( (enc & SQLITE_UTF16_ALIGNED)!=0 && 1==(1&SQLITE_PTR_TO_INT(pVal->z)) ){
1336       assert( (pVal->flags & (MEM_Ephem|MEM_Static))!=0 );
1337       if( sqlite3VdbeMemMakeWriteable(pVal)!=SQLITE_OK ){
1338         return 0;
1339       }
1340     }
1341     sqlite3VdbeMemNulTerminate(pVal); /* IMP: R-31275-44060 */
1342   }else{
1343     sqlite3VdbeMemStringify(pVal, enc, 0);
1344     assert( 0==(1&SQLITE_PTR_TO_INT(pVal->z)) );
1345   }
1346   assert(pVal->enc==(enc & ~SQLITE_UTF16_ALIGNED) || pVal->db==0
1347               || pVal->db->mallocFailed );
1348   if( pVal->enc==(enc & ~SQLITE_UTF16_ALIGNED) ){
1349     assert( sqlite3VdbeMemValidStrRep(pVal) );
1350     return pVal->z;
1351   }else{
1352     return 0;
1353   }
1354 }
1355
1356 /* This function is only available internally, it is not part of the
1357 ** external API. It works in a similar way to sqlite3_value_text(),
1358 ** except the data returned is in the encoding specified by the second
1359 ** parameter, which must be one of SQLITE_UTF16BE, SQLITE_UTF16LE or
1360 ** SQLITE_UTF8.
1361 **
1362 ** (2006-02-16:)  The enc value can be or-ed with SQLITE_UTF16_ALIGNED.
1363 ** If that is the case, then the result must be aligned on an even byte
1364 ** boundary.
1365 */
1366 const void *sqlite3ValueText(sqlite3_value* pVal, u8 enc){
1367   if( !pVal ) return 0;
1368   assert( pVal->db==0 || sqlite3_mutex_held(pVal->db->mutex) );
1369   assert( (enc&3)==(enc&~SQLITE_UTF16_ALIGNED) );
1370   assert( !sqlite3VdbeMemIsRowSet(pVal) );
1371   if( (pVal->flags&(MEM_Str|MEM_Term))==(MEM_Str|MEM_Term) && pVal->enc==enc ){
1372     assert( sqlite3VdbeMemValidStrRep(pVal) );
1373     return pVal->z;
1374   }
1375   if( pVal->flags&MEM_Null ){
1376     return 0;
1377   }
1378   return valueToText(pVal, enc);
1379 }
1380
1381 /* Return true if sqlit3_value object pVal is a string or blob value
1382 ** that uses the destructor specified in the second argument.
1383 **
1384 ** TODO:  Maybe someday promote this interface into a published API so
1385 ** that third-party extensions can get access to it?
1386 */
1387 int sqlite3ValueIsOfClass(const sqlite3_value *pVal, void(*xFree)(void*)){
1388   if( ALWAYS(pVal!=0)
1389    && ALWAYS((pVal->flags & (MEM_Str|MEM_Blob))!=0)
1390    && (pVal->flags & MEM_Dyn)!=0
1391    && pVal->xDel==xFree
1392   ){
1393     return 1;
1394   }else{
1395     return 0;
1396   }
1397 }
1398
1399 /*
1400 ** Create a new sqlite3_value object.
1401 */
1402 sqlite3_value *sqlite3ValueNew(sqlite3 *db){
1403   Mem *p = sqlite3DbMallocZero(db, sizeof(*p));
1404   if( p ){
1405     p->flags = MEM_Null;
1406     p->db = db;
1407   }
1408   return p;
1409 }
1410
1411 /*
1412 ** Context object passed by sqlite3Stat4ProbeSetValue() through to
1413 ** valueNew(). See comments above valueNew() for details.
1414 */
1415 struct ValueNewStat4Ctx {
1416   Parse *pParse;
1417   Index *pIdx;
1418   UnpackedRecord **ppRec;
1419   int iVal;
1420 };
1421
1422 /*
1423 ** Allocate and return a pointer to a new sqlite3_value object. If
1424 ** the second argument to this function is NULL, the object is allocated
1425 ** by calling sqlite3ValueNew().
1426 **
1427 ** Otherwise, if the second argument is non-zero, then this function is
1428 ** being called indirectly by sqlite3Stat4ProbeSetValue(). If it has not
1429 ** already been allocated, allocate the UnpackedRecord structure that
1430 ** that function will return to its caller here. Then return a pointer to
1431 ** an sqlite3_value within the UnpackedRecord.a[] array.
1432 */
1433 static sqlite3_value *valueNew(sqlite3 *db, struct ValueNewStat4Ctx *p){
1434 #ifdef SQLITE_ENABLE_STAT4
1435   if( p ){
1436     UnpackedRecord *pRec = p->ppRec[0];
1437
1438     if( pRec==0 ){
1439       Index *pIdx = p->pIdx;      /* Index being probed */
1440       int nByte;                  /* Bytes of space to allocate */
1441       int i;                      /* Counter variable */
1442       int nCol = pIdx->nColumn;   /* Number of index columns including rowid */
1443
1444       nByte = sizeof(Mem) * nCol + ROUND8(sizeof(UnpackedRecord));
1445       pRec = (UnpackedRecord*)sqlite3DbMallocZero(db, nByte);
1446       if( pRec ){
1447         pRec->pKeyInfo = sqlite3KeyInfoOfIndex(p->pParse, pIdx);
1448         if( pRec->pKeyInfo ){
1449           assert( pRec->pKeyInfo->nAllField==nCol );
1450           assert( pRec->pKeyInfo->enc==ENC(db) );
1451           pRec->aMem = (Mem *)((u8*)pRec + ROUND8(sizeof(UnpackedRecord)));
1452           for(i=0; i<nCol; i++){
1453             pRec->aMem[i].flags = MEM_Null;
1454             pRec->aMem[i].db = db;
1455           }
1456         }else{
1457           sqlite3DbFreeNN(db, pRec);
1458           pRec = 0;
1459         }
1460       }
1461       if( pRec==0 ) return 0;
1462       p->ppRec[0] = pRec;
1463     }
1464
1465     pRec->nField = p->iVal+1;
1466     sqlite3VdbeMemSetNull(&pRec->aMem[p->iVal]);
1467     return &pRec->aMem[p->iVal];
1468   }
1469 #else
1470   UNUSED_PARAMETER(p);
1471 #endif /* defined(SQLITE_ENABLE_STAT4) */
1472   return sqlite3ValueNew(db);
1473 }
1474
1475 /*
1476 ** The expression object indicated by the second argument is guaranteed
1477 ** to be a scalar SQL function. If
1478 **
1479 **   * all function arguments are SQL literals,
1480 **   * one of the SQLITE_FUNC_CONSTANT or _SLOCHNG function flags is set, and
1481 **   * the SQLITE_FUNC_NEEDCOLL function flag is not set,
1482 **
1483 ** then this routine attempts to invoke the SQL function. Assuming no
1484 ** error occurs, output parameter (*ppVal) is set to point to a value
1485 ** object containing the result before returning SQLITE_OK.
1486 **
1487 ** Affinity aff is applied to the result of the function before returning.
1488 ** If the result is a text value, the sqlite3_value object uses encoding
1489 ** enc.
1490 **
1491 ** If the conditions above are not met, this function returns SQLITE_OK
1492 ** and sets (*ppVal) to NULL. Or, if an error occurs, (*ppVal) is set to
1493 ** NULL and an SQLite error code returned.
1494 */
1495 #ifdef SQLITE_ENABLE_STAT4
1496 static int valueFromFunction(
1497   sqlite3 *db,                    /* The database connection */
1498   const Expr *p,                  /* The expression to evaluate */
1499   u8 enc,                         /* Encoding to use */
1500   u8 aff,                         /* Affinity to use */
1501   sqlite3_value **ppVal,          /* Write the new value here */
1502   struct ValueNewStat4Ctx *pCtx   /* Second argument for valueNew() */
1503 ){
1504   sqlite3_context ctx;            /* Context object for function invocation */
1505   sqlite3_value **apVal = 0;      /* Function arguments */
1506   int nVal = 0;                   /* Size of apVal[] array */
1507   FuncDef *pFunc = 0;             /* Function definition */
1508   sqlite3_value *pVal = 0;        /* New value */
1509   int rc = SQLITE_OK;             /* Return code */
1510   ExprList *pList = 0;            /* Function arguments */
1511   int i;                          /* Iterator variable */
1512
1513   assert( pCtx!=0 );
1514   assert( (p->flags & EP_TokenOnly)==0 );
1515   assert( ExprUseXList(p) );
1516   pList = p->x.pList;
1517   if( pList ) nVal = pList->nExpr;
1518   assert( !ExprHasProperty(p, EP_IntValue) );
1519   pFunc = sqlite3FindFunction(db, p->u.zToken, nVal, enc, 0);
1520 #ifdef SQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
1521   if( pFunc==0 ) return SQLITE_OK;
1522 #endif
1523   assert( pFunc );
1524   if( (pFunc->funcFlags & (SQLITE_FUNC_CONSTANT|SQLITE_FUNC_SLOCHNG))==0
1525    || (pFunc->funcFlags & (SQLITE_FUNC_NEEDCOLL|SQLITE_FUNC_RUNONLY))!=0
1526   ){
1527     return SQLITE_OK;
1528   }
1529
1530   if( pList ){
1531     apVal = (sqlite3_value**)sqlite3DbMallocZero(db, sizeof(apVal[0]) * nVal);
1532     if( apVal==0 ){
1533       rc = SQLITE_NOMEM_BKPT;
1534       goto value_from_function_out;
1535     }
1536     for(i=0; i<nVal; i++){
1537       rc = sqlite3ValueFromExpr(db, pList->a[i].pExpr, enc, aff, &apVal[i]);
1538       if( apVal[i]==0 || rc!=SQLITE_OK ) goto value_from_function_out;
1539     }
1540   }
1541
1542   pVal = valueNew(db, pCtx);
1543   if( pVal==0 ){
1544     rc = SQLITE_NOMEM_BKPT;
1545     goto value_from_function_out;
1546   }
1547
1548   memset(&ctx, 0, sizeof(ctx));
1549   ctx.pOut = pVal;
1550   ctx.pFunc = pFunc;
1551   ctx.enc = ENC(db);
1552   pFunc->xSFunc(&ctx, nVal, apVal);
1553   if( ctx.isError ){
1554     rc = ctx.isError;
1555     sqlite3ErrorMsg(pCtx->pParse, "%s", sqlite3_value_text(pVal));
1556   }else{
1557     sqlite3ValueApplyAffinity(pVal, aff, SQLITE_UTF8);
1558     assert( rc==SQLITE_OK );
1559     rc = sqlite3VdbeChangeEncoding(pVal, enc);
1560     if( NEVER(rc==SQLITE_OK && sqlite3VdbeMemTooBig(pVal)) ){
1561       rc = SQLITE_TOOBIG;
1562       pCtx->pParse->nErr++;
1563     }
1564   }
1565
1566  value_from_function_out:
1567   if( rc!=SQLITE_OK ){
1568     pVal = 0;
1569     pCtx->pParse->rc = rc;
1570   }
1571   if( apVal ){
1572     for(i=0; i<nVal; i++){
1573       sqlite3ValueFree(apVal[i]);
1574     }
1575     sqlite3DbFreeNN(db, apVal);
1576   }
1577
1578   *ppVal = pVal;
1579   return rc;
1580 }
1581 #else
1582 # define valueFromFunction(a,b,c,d,e,f) SQLITE_OK
1583 #endif /* defined(SQLITE_ENABLE_STAT4) */
1584
1585 /*
1586 ** Extract a value from the supplied expression in the manner described
1587 ** above sqlite3ValueFromExpr(). Allocate the sqlite3_value object
1588 ** using valueNew().
1589 **
1590 ** If pCtx is NULL and an error occurs after the sqlite3_value object
1591 ** has been allocated, it is freed before returning. Or, if pCtx is not
1592 ** NULL, it is assumed that the caller will free any allocated object
1593 ** in all cases.
1594 */
1595 static int valueFromExpr(
1596   sqlite3 *db,                    /* The database connection */
1597   const Expr *pExpr,              /* The expression to evaluate */
1598   u8 enc,                         /* Encoding to use */
1599   u8 affinity,                    /* Affinity to use */
1600   sqlite3_value **ppVal,          /* Write the new value here */
1601   struct ValueNewStat4Ctx *pCtx   /* Second argument for valueNew() */
1602 ){
1603   int op;
1604   char *zVal = 0;
1605   sqlite3_value *pVal = 0;
1606   int negInt = 1;
1607   const char *zNeg = "";
1608   int rc = SQLITE_OK;
1609
1610   assert( pExpr!=0 );
1611   while( (op = pExpr->op)==TK_UPLUS || op==TK_SPAN ) pExpr = pExpr->pLeft;
1612   if( op==TK_REGISTER ) op = pExpr->op2;
1613
1614   /* Compressed expressions only appear when parsing the DEFAULT clause
1615   ** on a table column definition, and hence only when pCtx==0.  This
1616   ** check ensures that an EP_TokenOnly expression is never passed down
1617   ** into valueFromFunction(). */
1618   assert( (pExpr->flags & EP_TokenOnly)==0 || pCtx==0 );
1619
1620   if( op==TK_CAST ){
1621     u8 aff;
1622     assert( !ExprHasProperty(pExpr, EP_IntValue) );
1623     aff = sqlite3AffinityType(pExpr->u.zToken,0);
1624     rc = valueFromExpr(db, pExpr->pLeft, enc, aff, ppVal, pCtx);
1625     testcase( rc!=SQLITE_OK );
1626     if( *ppVal ){
1627 #ifdef SQLITE_ENABLE_STAT4
1628       rc = ExpandBlob(*ppVal);
1629 #else
1630       /* zero-blobs only come from functions, not literal values.  And
1631       ** functions are only processed under STAT4 */
1632       assert( (ppVal[0][0].flags & MEM_Zero)==0 );
1633 #endif
1634       sqlite3VdbeMemCast(*ppVal, aff, enc);
1635       sqlite3ValueApplyAffinity(*ppVal, affinity, enc);
1636     }
1637     return rc;
1638   }
1639
1640   /* Handle negative integers in a single step.  This is needed in the
1641   ** case when the value is -9223372036854775808. Except - do not do this
1642   ** for hexadecimal literals.  */
1643   if( op==TK_UMINUS ){
1644     Expr *pLeft = pExpr->pLeft;
1645     if( (pLeft->op==TK_INTEGER || pLeft->op==TK_FLOAT) ){
1646       if( ExprHasProperty(pLeft, EP_IntValue)
1647        || pLeft->u.zToken[0]!='0' || (pLeft->u.zToken[1] & ~0x20)!='X'
1648       ){
1649         pExpr = pLeft;
1650         op = pExpr->op;
1651         negInt = -1;
1652         zNeg = "-";
1653       }
1654     }
1655   }
1656
1657   if( op==TK_STRING || op==TK_FLOAT || op==TK_INTEGER ){
1658     pVal = valueNew(db, pCtx);
1659     if( pVal==0 ) goto no_mem;
1660     if( ExprHasProperty(pExpr, EP_IntValue) ){
1661       sqlite3VdbeMemSetInt64(pVal, (i64)pExpr->u.iValue*negInt);
1662     }else{
1663       i64 iVal;
1664       if( op==TK_INTEGER && 0==sqlite3DecOrHexToI64(pExpr->u.zToken, &iVal) ){
1665         sqlite3VdbeMemSetInt64(pVal, iVal*negInt);
1666       }else{
1667         zVal = sqlite3MPrintf(db, "%s%s", zNeg, pExpr->u.zToken);
1668         if( zVal==0 ) goto no_mem;
1669         sqlite3ValueSetStr(pVal, -1, zVal, SQLITE_UTF8, SQLITE_DYNAMIC);
1670       }
1671     }
1672     if( affinity==SQLITE_AFF_BLOB ){
1673       if( op==TK_FLOAT ){
1674         assert( pVal && pVal->z && pVal->flags==(MEM_Str|MEM_Term) );
1675         sqlite3AtoF(pVal->z, &pVal->u.r, pVal->n, SQLITE_UTF8);
1676         pVal->flags = MEM_Real;
1677       }else if( op==TK_INTEGER ){
1678         /* This case is required by -9223372036854775808 and other strings
1679         ** that look like integers but cannot be handled by the
1680         ** sqlite3DecOrHexToI64() call above.  */
1681         sqlite3ValueApplyAffinity(pVal, SQLITE_AFF_NUMERIC, SQLITE_UTF8);
1682       }
1683     }else{
1684       sqlite3ValueApplyAffinity(pVal, affinity, SQLITE_UTF8);
1685     }
1686     assert( (pVal->flags & MEM_IntReal)==0 );
1687     if( pVal->flags & (MEM_Int|MEM_IntReal|MEM_Real) ){
1688       testcase( pVal->flags & MEM_Int );
1689       testcase( pVal->flags & MEM_Real );
1690       pVal->flags &= ~MEM_Str;
1691     }
1692     if( enc!=SQLITE_UTF8 ){
1693       rc = sqlite3VdbeChangeEncoding(pVal, enc);
1694     }
1695   }else if( op==TK_UMINUS ) {
1696     /* This branch happens for multiple negative signs.  Ex: -(-5) */
1697     if( SQLITE_OK==valueFromExpr(db,pExpr->pLeft,enc,affinity,&pVal,pCtx)
1698      && pVal!=0
1699     ){
1700       sqlite3VdbeMemNumerify(pVal);
1701       if( pVal->flags & MEM_Real ){
1702         pVal->u.r = -pVal->u.r;
1703       }else if( pVal->u.i==SMALLEST_INT64 ){
1704 #ifndef SQLITE_OMIT_FLOATING_POINT
1705         pVal->u.r = -(double)SMALLEST_INT64;
1706 #else
1707         pVal->u.r = LARGEST_INT64;
1708 #endif
1709         MemSetTypeFlag(pVal, MEM_Real);
1710       }else{
1711         pVal->u.i = -pVal->u.i;
1712       }
1713       sqlite3ValueApplyAffinity(pVal, affinity, enc);
1714     }
1715   }else if( op==TK_NULL ){
1716     pVal = valueNew(db, pCtx);
1717     if( pVal==0 ) goto no_mem;
1718     sqlite3VdbeMemSetNull(pVal);
1719   }
1720 #ifndef SQLITE_OMIT_BLOB_LITERAL
1721   else if( op==TK_BLOB ){
1722     int nVal;
1723     assert( !ExprHasProperty(pExpr, EP_IntValue) );
1724     assert( pExpr->u.zToken[0]=='x' || pExpr->u.zToken[0]=='X' );
1725     assert( pExpr->u.zToken[1]=='\'' );
1726     pVal = valueNew(db, pCtx);
1727     if( !pVal ) goto no_mem;
1728     zVal = &pExpr->u.zToken[2];
1729     nVal = sqlite3Strlen30(zVal)-1;
1730     assert( zVal[nVal]=='\'' );
1731     sqlite3VdbeMemSetStr(pVal, sqlite3HexToBlob(db, zVal, nVal), nVal/2,
1732                          0, SQLITE_DYNAMIC);
1733   }
1734 #endif
1735 #ifdef SQLITE_ENABLE_STAT4
1736   else if( op==TK_FUNCTION && pCtx!=0 ){
1737     rc = valueFromFunction(db, pExpr, enc, affinity, &pVal, pCtx);
1738   }
1739 #endif
1740   else if( op==TK_TRUEFALSE ){
1741     assert( !ExprHasProperty(pExpr, EP_IntValue) );
1742     pVal = valueNew(db, pCtx);
1743     if( pVal ){
1744       pVal->flags = MEM_Int;
1745       pVal->u.i = pExpr->u.zToken[4]==0;
1746       sqlite3ValueApplyAffinity(pVal, affinity, enc);
1747     }
1748   }
1749
1750   *ppVal = pVal;
1751   return rc;
1752
1753 no_mem:
1754 #ifdef SQLITE_ENABLE_STAT4
1755   if( pCtx==0 || NEVER(pCtx->pParse->nErr==0) )
1756 #endif
1757     sqlite3OomFault(db);
1758   sqlite3DbFree(db, zVal);
1759   assert( *ppVal==0 );
1760 #ifdef SQLITE_ENABLE_STAT4
1761   if( pCtx==0 ) sqlite3ValueFree(pVal);
1762 #else
1763   assert( pCtx==0 ); sqlite3ValueFree(pVal);
1764 #endif
1765   return SQLITE_NOMEM_BKPT;
1766 }
1767
1768 /*
1769 ** Create a new sqlite3_value object, containing the value of pExpr.
1770 **
1771 ** This only works for very simple expressions that consist of one constant
1772 ** token (i.e. "5", "5.1", "'a string'"). If the expression can
1773 ** be converted directly into a value, then the value is allocated and
1774 ** a pointer written to *ppVal. The caller is responsible for deallocating
1775 ** the value by passing it to sqlite3ValueFree() later on. If the expression
1776 ** cannot be converted to a value, then *ppVal is set to NULL.
1777 */
1778 int sqlite3ValueFromExpr(
1779   sqlite3 *db,              /* The database connection */
1780   const Expr *pExpr,        /* The expression to evaluate */
1781   u8 enc,                   /* Encoding to use */
1782   u8 affinity,              /* Affinity to use */
1783   sqlite3_value **ppVal     /* Write the new value here */
1784 ){
1785   return pExpr ? valueFromExpr(db, pExpr, enc, affinity, ppVal, 0) : 0;
1786 }
1787
1788 #ifdef SQLITE_ENABLE_STAT4
1789 /*
1790 ** Attempt to extract a value from pExpr and use it to construct *ppVal.
1791 **
1792 ** If pAlloc is not NULL, then an UnpackedRecord object is created for
1793 ** pAlloc if one does not exist and the new value is added to the
1794 ** UnpackedRecord object.
1795 **
1796 ** A value is extracted in the following cases:
1797 **
1798 **  * (pExpr==0). In this case the value is assumed to be an SQL NULL,
1799 **
1800 **  * The expression is a bound variable, and this is a reprepare, or
1801 **
1802 **  * The expression is a literal value.
1803 **
1804 ** On success, *ppVal is made to point to the extracted value.  The caller
1805 ** is responsible for ensuring that the value is eventually freed.
1806 */
1807 static int stat4ValueFromExpr(
1808   Parse *pParse,                  /* Parse context */
1809   Expr *pExpr,                    /* The expression to extract a value from */
1810   u8 affinity,                    /* Affinity to use */
1811   struct ValueNewStat4Ctx *pAlloc,/* How to allocate space.  Or NULL */
1812   sqlite3_value **ppVal           /* OUT: New value object (or NULL) */
1813 ){
1814   int rc = SQLITE_OK;
1815   sqlite3_value *pVal = 0;
1816   sqlite3 *db = pParse->db;
1817
1818   /* Skip over any TK_COLLATE nodes */
1819   pExpr = sqlite3ExprSkipCollate(pExpr);
1820
1821   assert( pExpr==0 || pExpr->op!=TK_REGISTER || pExpr->op2!=TK_VARIABLE );
1822   if( !pExpr ){
1823     pVal = valueNew(db, pAlloc);
1824     if( pVal ){
1825       sqlite3VdbeMemSetNull((Mem*)pVal);
1826     }
1827   }else if( pExpr->op==TK_VARIABLE && (db->flags & SQLITE_EnableQPSG)==0 ){
1828     Vdbe *v;
1829     int iBindVar = pExpr->iColumn;
1830     sqlite3VdbeSetVarmask(pParse->pVdbe, iBindVar);
1831     if( (v = pParse->pReprepare)!=0 ){
1832       pVal = valueNew(db, pAlloc);
1833       if( pVal ){
1834         rc = sqlite3VdbeMemCopy((Mem*)pVal, &v->aVar[iBindVar-1]);
1835         sqlite3ValueApplyAffinity(pVal, affinity, ENC(db));
1836         pVal->db = pParse->db;
1837       }
1838     }
1839   }else{
1840     rc = valueFromExpr(db, pExpr, ENC(db), affinity, &pVal, pAlloc);
1841   }
1842
1843   assert( pVal==0 || pVal->db==db );
1844   *ppVal = pVal;
1845   return rc;
1846 }
1847
1848 /*
1849 ** This function is used to allocate and populate UnpackedRecord
1850 ** structures intended to be compared against sample index keys stored
1851 ** in the sqlite_stat4 table.
1852 **
1853 ** A single call to this function populates zero or more fields of the
1854 ** record starting with field iVal (fields are numbered from left to
1855 ** right starting with 0). A single field is populated if:
1856 **
1857 **  * (pExpr==0). In this case the value is assumed to be an SQL NULL,
1858 **
1859 **  * The expression is a bound variable, and this is a reprepare, or
1860 **
1861 **  * The sqlite3ValueFromExpr() function is able to extract a value
1862 **    from the expression (i.e. the expression is a literal value).
1863 **
1864 ** Or, if pExpr is a TK_VECTOR, one field is populated for each of the
1865 ** vector components that match either of the two latter criteria listed
1866 ** above.
1867 **
1868 ** Before any value is appended to the record, the affinity of the
1869 ** corresponding column within index pIdx is applied to it. Before
1870 ** this function returns, output parameter *pnExtract is set to the
1871 ** number of values appended to the record.
1872 **
1873 ** When this function is called, *ppRec must either point to an object
1874 ** allocated by an earlier call to this function, or must be NULL. If it
1875 ** is NULL and a value can be successfully extracted, a new UnpackedRecord
1876 ** is allocated (and *ppRec set to point to it) before returning.
1877 **
1878 ** Unless an error is encountered, SQLITE_OK is returned. It is not an
1879 ** error if a value cannot be extracted from pExpr. If an error does
1880 ** occur, an SQLite error code is returned.
1881 */
1882 int sqlite3Stat4ProbeSetValue(
1883   Parse *pParse,                  /* Parse context */
1884   Index *pIdx,                    /* Index being probed */
1885   UnpackedRecord **ppRec,         /* IN/OUT: Probe record */
1886   Expr *pExpr,                    /* The expression to extract a value from */
1887   int nElem,                      /* Maximum number of values to append */
1888   int iVal,                       /* Array element to populate */
1889   int *pnExtract                  /* OUT: Values appended to the record */
1890 ){
1891   int rc = SQLITE_OK;
1892   int nExtract = 0;
1893
1894   if( pExpr==0 || pExpr->op!=TK_SELECT ){
1895     int i;
1896     struct ValueNewStat4Ctx alloc;
1897
1898     alloc.pParse = pParse;
1899     alloc.pIdx = pIdx;
1900     alloc.ppRec = ppRec;
1901
1902     for(i=0; i<nElem; i++){
1903       sqlite3_value *pVal = 0;
1904       Expr *pElem = (pExpr ? sqlite3VectorFieldSubexpr(pExpr, i) : 0);
1905       u8 aff = sqlite3IndexColumnAffinity(pParse->db, pIdx, iVal+i);
1906       alloc.iVal = iVal+i;
1907       rc = stat4ValueFromExpr(pParse, pElem, aff, &alloc, &pVal);
1908       if( !pVal ) break;
1909       nExtract++;
1910     }
1911   }
1912
1913   *pnExtract = nExtract;
1914   return rc;
1915 }
1916
1917 /*
1918 ** Attempt to extract a value from expression pExpr using the methods
1919 ** as described for sqlite3Stat4ProbeSetValue() above.
1920 **
1921 ** If successful, set *ppVal to point to a new value object and return
1922 ** SQLITE_OK. If no value can be extracted, but no other error occurs
1923 ** (e.g. OOM), return SQLITE_OK and set *ppVal to NULL. Or, if an error
1924 ** does occur, return an SQLite error code. The final value of *ppVal
1925 ** is undefined in this case.
1926 */
1927 int sqlite3Stat4ValueFromExpr(
1928   Parse *pParse,                  /* Parse context */
1929   Expr *pExpr,                    /* The expression to extract a value from */
1930   u8 affinity,                    /* Affinity to use */
1931   sqlite3_value **ppVal           /* OUT: New value object (or NULL) */
1932 ){
1933   return stat4ValueFromExpr(pParse, pExpr, affinity, 0, ppVal);
1934 }
1935
1936 /*
1937 ** Extract the iCol-th column from the nRec-byte record in pRec.  Write
1938 ** the column value into *ppVal.  If *ppVal is initially NULL then a new
1939 ** sqlite3_value object is allocated.
1940 **
1941 ** If *ppVal is initially NULL then the caller is responsible for
1942 ** ensuring that the value written into *ppVal is eventually freed.
1943 */
1944 int sqlite3Stat4Column(
1945   sqlite3 *db,                    /* Database handle */
1946   const void *pRec,               /* Pointer to buffer containing record */
1947   int nRec,                       /* Size of buffer pRec in bytes */
1948   int iCol,                       /* Column to extract */
1949   sqlite3_value **ppVal           /* OUT: Extracted value */
1950 ){
1951   u32 t = 0;                      /* a column type code */
1952   u32 nHdr;                       /* Size of the header in the record */
1953   u32 iHdr;                       /* Next unread header byte */
1954   i64 iField;                     /* Next unread data byte */
1955   u32 szField = 0;                /* Size of the current data field */
1956   int i;                          /* Column index */
1957   u8 *a = (u8*)pRec;              /* Typecast byte array */
1958   Mem *pMem = *ppVal;             /* Write result into this Mem object */
1959
1960   assert( iCol>0 );
1961   iHdr = getVarint32(a, nHdr);
1962   if( nHdr>nRec || iHdr>=nHdr ) return SQLITE_CORRUPT_BKPT;
1963   iField = nHdr;
1964   for(i=0; i<=iCol; i++){
1965     iHdr += getVarint32(&a[iHdr], t);
1966     testcase( iHdr==nHdr );
1967     testcase( iHdr==nHdr+1 );
1968     if( iHdr>nHdr ) return SQLITE_CORRUPT_BKPT;
1969     szField = sqlite3VdbeSerialTypeLen(t);
1970     iField += szField;
1971   }
1972   testcase( iField==nRec );
1973   testcase( iField==nRec+1 );
1974   if( iField>nRec ) return SQLITE_CORRUPT_BKPT;
1975   if( pMem==0 ){
1976     pMem = *ppVal = sqlite3ValueNew(db);
1977     if( pMem==0 ) return SQLITE_NOMEM_BKPT;
1978   }
1979   sqlite3VdbeSerialGet(&a[iField-szField], t, pMem);
1980   pMem->enc = ENC(db);
1981   return SQLITE_OK;
1982 }
1983
1984 /*
1985 ** Unless it is NULL, the argument must be an UnpackedRecord object returned
1986 ** by an earlier call to sqlite3Stat4ProbeSetValue(). This call deletes
1987 ** the object.
1988 */
1989 void sqlite3Stat4ProbeFree(UnpackedRecord *pRec){
1990   if( pRec ){
1991     int i;
1992     int nCol = pRec->pKeyInfo->nAllField;
1993     Mem *aMem = pRec->aMem;
1994     sqlite3 *db = aMem[0].db;
1995     for(i=0; i<nCol; i++){
1996       sqlite3VdbeMemRelease(&aMem[i]);
1997     }
1998     sqlite3KeyInfoUnref(pRec->pKeyInfo);
1999     sqlite3DbFreeNN(db, pRec);
2000   }
2001 }
2002 #endif /* ifdef SQLITE_ENABLE_STAT4 */
2003
2004 /*
2005 ** Change the string value of an sqlite3_value object
2006 */
2007 void sqlite3ValueSetStr(
2008   sqlite3_value *v,     /* Value to be set */
2009   int n,                /* Length of string z */
2010   const void *z,        /* Text of the new string */
2011   u8 enc,               /* Encoding to use */
2012   void (*xDel)(void*)   /* Destructor for the string */
2013 ){
2014   if( v ) sqlite3VdbeMemSetStr((Mem *)v, z, n, enc, xDel);
2015 }
2016
2017 /*
2018 ** Free an sqlite3_value object
2019 */
2020 void sqlite3ValueFree(sqlite3_value *v){
2021   if( !v ) return;
2022   sqlite3VdbeMemRelease((Mem *)v);
2023   sqlite3DbFreeNN(((Mem*)v)->db, v);
2024 }
2025
2026 /*
2027 ** The sqlite3ValueBytes() routine returns the number of bytes in the
2028 ** sqlite3_value object assuming that it uses the encoding "enc".
2029 ** The valueBytes() routine is a helper function.
2030 */
2031 static SQLITE_NOINLINE int valueBytes(sqlite3_value *pVal, u8 enc){
2032   return valueToText(pVal, enc)!=0 ? pVal->n : 0;
2033 }
2034 int sqlite3ValueBytes(sqlite3_value *pVal, u8 enc){
2035   Mem *p = (Mem*)pVal;
2036   assert( (p->flags & MEM_Null)==0 || (p->flags & (MEM_Str|MEM_Blob))==0 );
2037   if( (p->flags & MEM_Str)!=0 && pVal->enc==enc ){
2038     return p->n;
2039   }
2040   if( (p->flags & MEM_Str)!=0 && enc!=SQLITE_UTF8 && pVal->enc!=SQLITE_UTF8 ){
2041     return p->n;
2042   }
2043   if( (p->flags & MEM_Blob)!=0 ){
2044     if( p->flags & MEM_Zero ){
2045       return p->n + p->u.nZero;
2046     }else{
2047       return p->n;
2048     }
2049   }
2050   if( p->flags & MEM_Null ) return 0;
2051   return valueBytes(pVal, enc);
2052 }