extensions/sqlite/sqlite-source/expr.c
author Asher Baker <asherkin@gmail.com>
Thu Apr 26 16:58:18 2012 +0100 (2012-04-26)
changeset 3488 bee90c8ef6c3
parent 1952 b7aa2b626807
permissions -rw-r--r--
Fixed client serials not being unique on Windows (bug 5285, r=psychonic).
     1 /*
     2 ** 2001 September 15
     3 **
     4 ** The author disclaims copyright to this source code.  In place of
     5 ** a legal notice, here is a blessing:
     6 **
     7 **    May you do good and not evil.
     8 **    May you find forgiveness for yourself and forgive others.
     9 **    May you share freely, never taking more than you give.
    10 **
    11 *************************************************************************
    12 ** This file contains routines used for analyzing expressions and
    13 ** for generating VDBE code that evaluates expressions in SQLite.
    14 **
    15 ** $Id$
    16 */
    17 #include "sqliteInt.h"
    18 #include <ctype.h>
    19 
    20 /*
    21 ** Return the 'affinity' of the expression pExpr if any.
    22 **
    23 ** If pExpr is a column, a reference to a column via an 'AS' alias,
    24 ** or a sub-select with a column as the return value, then the 
    25 ** affinity of that column is returned. Otherwise, 0x00 is returned,
    26 ** indicating no affinity for the expression.
    27 **
    28 ** i.e. the WHERE clause expresssions in the following statements all
    29 ** have an affinity:
    30 **
    31 ** CREATE TABLE t1(a);
    32 ** SELECT * FROM t1 WHERE a;
    33 ** SELECT a AS b FROM t1 WHERE b;
    34 ** SELECT * FROM t1 WHERE (select a from t1);
    35 */
    36 char sqlite3ExprAffinity(Expr *pExpr){
    37   int op = pExpr->op;
    38   if( op==TK_SELECT ){
    39     return sqlite3ExprAffinity(pExpr->pSelect->pEList->a[0].pExpr);
    40   }
    41 #ifndef SQLITE_OMIT_CAST
    42   if( op==TK_CAST ){
    43     return sqlite3AffinityType(&pExpr->token);
    44   }
    45 #endif
    46   return pExpr->affinity;
    47 }
    48 
    49 /*
    50 ** Set the collating sequence for expression pExpr to be the collating
    51 ** sequence named by pToken.   Return a pointer to the revised expression.
    52 ** The collating sequence is marked as "explicit" using the EP_ExpCollate
    53 ** flag.  An explicit collating sequence will override implicit
    54 ** collating sequences.
    55 */
    56 Expr *sqlite3ExprSetColl(Parse *pParse, Expr *pExpr, Token *pName){
    57   CollSeq *pColl;
    58   if( pExpr==0 ) return 0;
    59   pColl = sqlite3LocateCollSeq(pParse, (char*)pName->z, pName->n);
    60   if( pColl ){
    61     pExpr->pColl = pColl;
    62     pExpr->flags |= EP_ExpCollate;
    63   }
    64   return pExpr;
    65 }
    66 
    67 /*
    68 ** Return the default collation sequence for the expression pExpr. If
    69 ** there is no default collation type, return 0.
    70 */
    71 CollSeq *sqlite3ExprCollSeq(Parse *pParse, Expr *pExpr){
    72   CollSeq *pColl = 0;
    73   if( pExpr ){
    74     int op;
    75     pColl = pExpr->pColl;
    76     op = pExpr->op;
    77     if( (op==TK_CAST || op==TK_UPLUS) && !pColl ){
    78       return sqlite3ExprCollSeq(pParse, pExpr->pLeft);
    79     }
    80   }
    81   if( sqlite3CheckCollSeq(pParse, pColl) ){ 
    82     pColl = 0;
    83   }
    84   return pColl;
    85 }
    86 
    87 /*
    88 ** pExpr is an operand of a comparison operator.  aff2 is the
    89 ** type affinity of the other operand.  This routine returns the
    90 ** type affinity that should be used for the comparison operator.
    91 */
    92 char sqlite3CompareAffinity(Expr *pExpr, char aff2){
    93   char aff1 = sqlite3ExprAffinity(pExpr);
    94   if( aff1 && aff2 ){
    95     /* Both sides of the comparison are columns. If one has numeric
    96     ** affinity, use that. Otherwise use no affinity.
    97     */
    98     if( sqlite3IsNumericAffinity(aff1) || sqlite3IsNumericAffinity(aff2) ){
    99       return SQLITE_AFF_NUMERIC;
   100     }else{
   101       return SQLITE_AFF_NONE;
   102     }
   103   }else if( !aff1 && !aff2 ){
   104     /* Neither side of the comparison is a column.  Compare the
   105     ** results directly.
   106     */
   107     return SQLITE_AFF_NONE;
   108   }else{
   109     /* One side is a column, the other is not. Use the columns affinity. */
   110     assert( aff1==0 || aff2==0 );
   111     return (aff1 + aff2);
   112   }
   113 }
   114 
   115 /*
   116 ** pExpr is a comparison operator.  Return the type affinity that should
   117 ** be applied to both operands prior to doing the comparison.
   118 */
   119 static char comparisonAffinity(Expr *pExpr){
   120   char aff;
   121   assert( pExpr->op==TK_EQ || pExpr->op==TK_IN || pExpr->op==TK_LT ||
   122           pExpr->op==TK_GT || pExpr->op==TK_GE || pExpr->op==TK_LE ||
   123           pExpr->op==TK_NE );
   124   assert( pExpr->pLeft );
   125   aff = sqlite3ExprAffinity(pExpr->pLeft);
   126   if( pExpr->pRight ){
   127     aff = sqlite3CompareAffinity(pExpr->pRight, aff);
   128   }
   129   else if( pExpr->pSelect ){
   130     aff = sqlite3CompareAffinity(pExpr->pSelect->pEList->a[0].pExpr, aff);
   131   }
   132   else if( !aff ){
   133     aff = SQLITE_AFF_NONE;
   134   }
   135   return aff;
   136 }
   137 
   138 /*
   139 ** pExpr is a comparison expression, eg. '=', '<', IN(...) etc.
   140 ** idx_affinity is the affinity of an indexed column. Return true
   141 ** if the index with affinity idx_affinity may be used to implement
   142 ** the comparison in pExpr.
   143 */
   144 int sqlite3IndexAffinityOk(Expr *pExpr, char idx_affinity){
   145   char aff = comparisonAffinity(pExpr);
   146   switch( aff ){
   147     case SQLITE_AFF_NONE:
   148       return 1;
   149     case SQLITE_AFF_TEXT:
   150       return idx_affinity==SQLITE_AFF_TEXT;
   151     default:
   152       return sqlite3IsNumericAffinity(idx_affinity);
   153   }
   154 }
   155 
   156 /*
   157 ** Return the P1 value that should be used for a binary comparison
   158 ** opcode (OP_Eq, OP_Ge etc.) used to compare pExpr1 and pExpr2.
   159 ** If jumpIfNull is true, then set the low byte of the returned
   160 ** P1 value to tell the opcode to jump if either expression
   161 ** evaluates to NULL.
   162 */
   163 static int binaryCompareP1(Expr *pExpr1, Expr *pExpr2, int jumpIfNull){
   164   char aff = sqlite3ExprAffinity(pExpr2);
   165   return ((int)sqlite3CompareAffinity(pExpr1, aff))+(jumpIfNull?0x100:0);
   166 }
   167 
   168 /*
   169 ** Return a pointer to the collation sequence that should be used by
   170 ** a binary comparison operator comparing pLeft and pRight.
   171 **
   172 ** If the left hand expression has a collating sequence type, then it is
   173 ** used. Otherwise the collation sequence for the right hand expression
   174 ** is used, or the default (BINARY) if neither expression has a collating
   175 ** type.
   176 **
   177 ** Argument pRight (but not pLeft) may be a null pointer. In this case,
   178 ** it is not considered.
   179 */
   180 CollSeq *sqlite3BinaryCompareCollSeq(
   181   Parse *pParse, 
   182   Expr *pLeft, 
   183   Expr *pRight
   184 ){
   185   CollSeq *pColl;
   186   assert( pLeft );
   187   if( pLeft->flags & EP_ExpCollate ){
   188     assert( pLeft->pColl );
   189     pColl = pLeft->pColl;
   190   }else if( pRight && pRight->flags & EP_ExpCollate ){
   191     assert( pRight->pColl );
   192     pColl = pRight->pColl;
   193   }else{
   194     pColl = sqlite3ExprCollSeq(pParse, pLeft);
   195     if( !pColl ){
   196       pColl = sqlite3ExprCollSeq(pParse, pRight);
   197     }
   198   }
   199   return pColl;
   200 }
   201 
   202 /*
   203 ** Generate code for a comparison operator.
   204 */
   205 static int codeCompare(
   206   Parse *pParse,    /* The parsing (and code generating) context */
   207   Expr *pLeft,      /* The left operand */
   208   Expr *pRight,     /* The right operand */
   209   int opcode,       /* The comparison opcode */
   210   int dest,         /* Jump here if true.  */
   211   int jumpIfNull    /* If true, jump if either operand is NULL */
   212 ){
   213   int p1 = binaryCompareP1(pLeft, pRight, jumpIfNull);
   214   CollSeq *p3 = sqlite3BinaryCompareCollSeq(pParse, pLeft, pRight);
   215   return sqlite3VdbeOp3(pParse->pVdbe, opcode, p1, dest, (void*)p3, P3_COLLSEQ);
   216 }
   217 
   218 /*
   219 ** Construct a new expression node and return a pointer to it.  Memory
   220 ** for this node is obtained from sqlite3_malloc().  The calling function
   221 ** is responsible for making sure the node eventually gets freed.
   222 */
   223 Expr *sqlite3Expr(
   224   sqlite3 *db,            /* Handle for sqlite3DbMallocZero() (may be null) */
   225   int op,                 /* Expression opcode */
   226   Expr *pLeft,            /* Left operand */
   227   Expr *pRight,           /* Right operand */
   228   const Token *pToken     /* Argument token */
   229 ){
   230   Expr *pNew;
   231   pNew = sqlite3DbMallocZero(db, sizeof(Expr));
   232   if( pNew==0 ){
   233     /* When malloc fails, delete pLeft and pRight. Expressions passed to 
   234     ** this function must always be allocated with sqlite3Expr() for this 
   235     ** reason. 
   236     */
   237     sqlite3ExprDelete(pLeft);
   238     sqlite3ExprDelete(pRight);
   239     return 0;
   240   }
   241   pNew->op = op;
   242   pNew->pLeft = pLeft;
   243   pNew->pRight = pRight;
   244   pNew->iAgg = -1;
   245   if( pToken ){
   246     assert( pToken->dyn==0 );
   247     pNew->span = pNew->token = *pToken;
   248   }else if( pLeft ){
   249     if( pRight ){
   250       sqlite3ExprSpan(pNew, &pLeft->span, &pRight->span);
   251       if( pRight->flags & EP_ExpCollate ){
   252         pNew->flags |= EP_ExpCollate;
   253         pNew->pColl = pRight->pColl;
   254       }
   255     }
   256     if( pLeft->flags & EP_ExpCollate ){
   257       pNew->flags |= EP_ExpCollate;
   258       pNew->pColl = pLeft->pColl;
   259     }
   260   }
   261 
   262   sqlite3ExprSetHeight(pNew);
   263   return pNew;
   264 }
   265 
   266 /*
   267 ** Works like sqlite3Expr() except that it takes an extra Parse*
   268 ** argument and notifies the associated connection object if malloc fails.
   269 */
   270 Expr *sqlite3PExpr(
   271   Parse *pParse,          /* Parsing context */
   272   int op,                 /* Expression opcode */
   273   Expr *pLeft,            /* Left operand */
   274   Expr *pRight,           /* Right operand */
   275   const Token *pToken     /* Argument token */
   276 ){
   277   return sqlite3Expr(pParse->db, op, pLeft, pRight, pToken);
   278 }
   279 
   280 /*
   281 ** When doing a nested parse, you can include terms in an expression
   282 ** that look like this:   #0 #1 #2 ...  These terms refer to elements
   283 ** on the stack.  "#0" means the top of the stack.
   284 ** "#1" means the next down on the stack.  And so forth.
   285 **
   286 ** This routine is called by the parser to deal with on of those terms.
   287 ** It immediately generates code to store the value in a memory location.
   288 ** The returns an expression that will code to extract the value from
   289 ** that memory location as needed.
   290 */
   291 Expr *sqlite3RegisterExpr(Parse *pParse, Token *pToken){
   292   Vdbe *v = pParse->pVdbe;
   293   Expr *p;
   294   int depth;
   295   if( pParse->nested==0 ){
   296     sqlite3ErrorMsg(pParse, "near \"%T\": syntax error", pToken);
   297     return sqlite3PExpr(pParse, TK_NULL, 0, 0, 0);
   298   }
   299   if( v==0 ) return 0;
   300   p = sqlite3PExpr(pParse, TK_REGISTER, 0, 0, pToken);
   301   if( p==0 ){
   302     return 0;  /* Malloc failed */
   303   }
   304   depth = atoi((char*)&pToken->z[1]);
   305   p->iTable = pParse->nMem++;
   306   sqlite3VdbeAddOp(v, OP_Dup, depth, 0);
   307   sqlite3VdbeAddOp(v, OP_MemStore, p->iTable, 1);
   308   return p;
   309 }
   310 
   311 /*
   312 ** Join two expressions using an AND operator.  If either expression is
   313 ** NULL, then just return the other expression.
   314 */
   315 Expr *sqlite3ExprAnd(sqlite3 *db, Expr *pLeft, Expr *pRight){
   316   if( pLeft==0 ){
   317     return pRight;
   318   }else if( pRight==0 ){
   319     return pLeft;
   320   }else{
   321     return sqlite3Expr(db, TK_AND, pLeft, pRight, 0);
   322   }
   323 }
   324 
   325 /*
   326 ** Set the Expr.span field of the given expression to span all
   327 ** text between the two given tokens.
   328 */
   329 void sqlite3ExprSpan(Expr *pExpr, Token *pLeft, Token *pRight){
   330   assert( pRight!=0 );
   331   assert( pLeft!=0 );
   332   if( pExpr && pRight->z && pLeft->z ){
   333     assert( pLeft->dyn==0 || pLeft->z[pLeft->n]==0 );
   334     if( pLeft->dyn==0 && pRight->dyn==0 ){
   335       pExpr->span.z = pLeft->z;
   336       pExpr->span.n = pRight->n + (pRight->z - pLeft->z);
   337     }else{
   338       pExpr->span.z = 0;
   339     }
   340   }
   341 }
   342 
   343 /*
   344 ** Construct a new expression node for a function with multiple
   345 ** arguments.
   346 */
   347 Expr *sqlite3ExprFunction(Parse *pParse, ExprList *pList, Token *pToken){
   348   Expr *pNew;
   349   assert( pToken );
   350   pNew = sqlite3DbMallocZero(pParse->db, sizeof(Expr) );
   351   if( pNew==0 ){
   352     sqlite3ExprListDelete(pList); /* Avoid leaking memory when malloc fails */
   353     return 0;
   354   }
   355   pNew->op = TK_FUNCTION;
   356   pNew->pList = pList;
   357   assert( pToken->dyn==0 );
   358   pNew->token = *pToken;
   359   pNew->span = pNew->token;
   360 
   361   sqlite3ExprSetHeight(pNew);
   362   return pNew;
   363 }
   364 
   365 /*
   366 ** Assign a variable number to an expression that encodes a wildcard
   367 ** in the original SQL statement.  
   368 **
   369 ** Wildcards consisting of a single "?" are assigned the next sequential
   370 ** variable number.
   371 **
   372 ** Wildcards of the form "?nnn" are assigned the number "nnn".  We make
   373 ** sure "nnn" is not too be to avoid a denial of service attack when
   374 ** the SQL statement comes from an external source.
   375 **
   376 ** Wildcards of the form ":aaa" or "$aaa" are assigned the same number
   377 ** as the previous instance of the same wildcard.  Or if this is the first
   378 ** instance of the wildcard, the next sequenial variable number is
   379 ** assigned.
   380 */
   381 void sqlite3ExprAssignVarNumber(Parse *pParse, Expr *pExpr){
   382   Token *pToken;
   383   sqlite3 *db = pParse->db;
   384 
   385   if( pExpr==0 ) return;
   386   pToken = &pExpr->token;
   387   assert( pToken->n>=1 );
   388   assert( pToken->z!=0 );
   389   assert( pToken->z[0]!=0 );
   390   if( pToken->n==1 ){
   391     /* Wildcard of the form "?".  Assign the next variable number */
   392     pExpr->iTable = ++pParse->nVar;
   393   }else if( pToken->z[0]=='?' ){
   394     /* Wildcard of the form "?nnn".  Convert "nnn" to an integer and
   395     ** use it as the variable number */
   396     int i;
   397     pExpr->iTable = i = atoi((char*)&pToken->z[1]);
   398     if( i<1 || i>SQLITE_MAX_VARIABLE_NUMBER ){
   399       sqlite3ErrorMsg(pParse, "variable number must be between ?1 and ?%d",
   400           SQLITE_MAX_VARIABLE_NUMBER);
   401     }
   402     if( i>pParse->nVar ){
   403       pParse->nVar = i;
   404     }
   405   }else{
   406     /* Wildcards of the form ":aaa" or "$aaa".  Reuse the same variable
   407     ** number as the prior appearance of the same name, or if the name
   408     ** has never appeared before, reuse the same variable number
   409     */
   410     int i, n;
   411     n = pToken->n;
   412     for(i=0; i<pParse->nVarExpr; i++){
   413       Expr *pE;
   414       if( (pE = pParse->apVarExpr[i])!=0
   415           && pE->token.n==n
   416           && memcmp(pE->token.z, pToken->z, n)==0 ){
   417         pExpr->iTable = pE->iTable;
   418         break;
   419       }
   420     }
   421     if( i>=pParse->nVarExpr ){
   422       pExpr->iTable = ++pParse->nVar;
   423       if( pParse->nVarExpr>=pParse->nVarExprAlloc-1 ){
   424         pParse->nVarExprAlloc += pParse->nVarExprAlloc + 10;
   425         pParse->apVarExpr =
   426             sqlite3DbReallocOrFree(
   427               db,
   428               pParse->apVarExpr,
   429               pParse->nVarExprAlloc*sizeof(pParse->apVarExpr[0])
   430             );
   431       }
   432       if( !db->mallocFailed ){
   433         assert( pParse->apVarExpr!=0 );
   434         pParse->apVarExpr[pParse->nVarExpr++] = pExpr;
   435       }
   436     }
   437   } 
   438   if( !pParse->nErr && pParse->nVar>SQLITE_MAX_VARIABLE_NUMBER ){
   439     sqlite3ErrorMsg(pParse, "too many SQL variables");
   440   }
   441 }
   442 
   443 /*
   444 ** Recursively delete an expression tree.
   445 */
   446 void sqlite3ExprDelete(Expr *p){
   447   if( p==0 ) return;
   448   if( p->span.dyn ) sqlite3_free((char*)p->span.z);
   449   if( p->token.dyn ) sqlite3_free((char*)p->token.z);
   450   sqlite3ExprDelete(p->pLeft);
   451   sqlite3ExprDelete(p->pRight);
   452   sqlite3ExprListDelete(p->pList);
   453   sqlite3SelectDelete(p->pSelect);
   454   sqlite3_free(p);
   455 }
   456 
   457 /*
   458 ** The Expr.token field might be a string literal that is quoted.
   459 ** If so, remove the quotation marks.
   460 */
   461 void sqlite3DequoteExpr(sqlite3 *db, Expr *p){
   462   if( ExprHasAnyProperty(p, EP_Dequoted) ){
   463     return;
   464   }
   465   ExprSetProperty(p, EP_Dequoted);
   466   if( p->token.dyn==0 ){
   467     sqlite3TokenCopy(db, &p->token, &p->token);
   468   }
   469   sqlite3Dequote((char*)p->token.z);
   470 }
   471 
   472 
   473 /*
   474 ** The following group of routines make deep copies of expressions,
   475 ** expression lists, ID lists, and select statements.  The copies can
   476 ** be deleted (by being passed to their respective ...Delete() routines)
   477 ** without effecting the originals.
   478 **
   479 ** The expression list, ID, and source lists return by sqlite3ExprListDup(),
   480 ** sqlite3IdListDup(), and sqlite3SrcListDup() can not be further expanded 
   481 ** by subsequent calls to sqlite*ListAppend() routines.
   482 **
   483 ** Any tables that the SrcList might point to are not duplicated.
   484 */
   485 Expr *sqlite3ExprDup(sqlite3 *db, Expr *p){
   486   Expr *pNew;
   487   if( p==0 ) return 0;
   488   pNew = sqlite3DbMallocRaw(db, sizeof(*p) );
   489   if( pNew==0 ) return 0;
   490   memcpy(pNew, p, sizeof(*pNew));
   491   if( p->token.z!=0 ){
   492     pNew->token.z = (u8*)sqlite3DbStrNDup(db, (char*)p->token.z, p->token.n);
   493     pNew->token.dyn = 1;
   494   }else{
   495     assert( pNew->token.z==0 );
   496   }
   497   pNew->span.z = 0;
   498   pNew->pLeft = sqlite3ExprDup(db, p->pLeft);
   499   pNew->pRight = sqlite3ExprDup(db, p->pRight);
   500   pNew->pList = sqlite3ExprListDup(db, p->pList);
   501   pNew->pSelect = sqlite3SelectDup(db, p->pSelect);
   502   return pNew;
   503 }
   504 void sqlite3TokenCopy(sqlite3 *db, Token *pTo, Token *pFrom){
   505   if( pTo->dyn ) sqlite3_free((char*)pTo->z);
   506   if( pFrom->z ){
   507     pTo->n = pFrom->n;
   508     pTo->z = (u8*)sqlite3DbStrNDup(db, (char*)pFrom->z, pFrom->n);
   509     pTo->dyn = 1;
   510   }else{
   511     pTo->z = 0;
   512   }
   513 }
   514 ExprList *sqlite3ExprListDup(sqlite3 *db, ExprList *p){
   515   ExprList *pNew;
   516   struct ExprList_item *pItem, *pOldItem;
   517   int i;
   518   if( p==0 ) return 0;
   519   pNew = sqlite3DbMallocRaw(db, sizeof(*pNew) );
   520   if( pNew==0 ) return 0;
   521   pNew->iECursor = 0;
   522   pNew->nExpr = pNew->nAlloc = p->nExpr;
   523   pNew->a = pItem = sqlite3DbMallocRaw(db,  p->nExpr*sizeof(p->a[0]) );
   524   if( pItem==0 ){
   525     sqlite3_free(pNew);
   526     return 0;
   527   } 
   528   pOldItem = p->a;
   529   for(i=0; i<p->nExpr; i++, pItem++, pOldItem++){
   530     Expr *pNewExpr, *pOldExpr;
   531     pItem->pExpr = pNewExpr = sqlite3ExprDup(db, pOldExpr = pOldItem->pExpr);
   532     if( pOldExpr->span.z!=0 && pNewExpr ){
   533       /* Always make a copy of the span for top-level expressions in the
   534       ** expression list.  The logic in SELECT processing that determines
   535       ** the names of columns in the result set needs this information */
   536       sqlite3TokenCopy(db, &pNewExpr->span, &pOldExpr->span);
   537     }
   538     assert( pNewExpr==0 || pNewExpr->span.z!=0 
   539             || pOldExpr->span.z==0
   540             || db->mallocFailed );
   541     pItem->zName = sqlite3DbStrDup(db, pOldItem->zName);
   542     pItem->sortOrder = pOldItem->sortOrder;
   543     pItem->isAgg = pOldItem->isAgg;
   544     pItem->done = 0;
   545   }
   546   return pNew;
   547 }
   548 
   549 /*
   550 ** If cursors, triggers, views and subqueries are all omitted from
   551 ** the build, then none of the following routines, except for 
   552 ** sqlite3SelectDup(), can be called. sqlite3SelectDup() is sometimes
   553 ** called with a NULL argument.
   554 */
   555 #if !defined(SQLITE_OMIT_VIEW) || !defined(SQLITE_OMIT_TRIGGER) \
   556  || !defined(SQLITE_OMIT_SUBQUERY)
   557 SrcList *sqlite3SrcListDup(sqlite3 *db, SrcList *p){
   558   SrcList *pNew;
   559   int i;
   560   int nByte;
   561   if( p==0 ) return 0;
   562   nByte = sizeof(*p) + (p->nSrc>0 ? sizeof(p->a[0]) * (p->nSrc-1) : 0);
   563   pNew = sqlite3DbMallocRaw(db, nByte );
   564   if( pNew==0 ) return 0;
   565   pNew->nSrc = pNew->nAlloc = p->nSrc;
   566   for(i=0; i<p->nSrc; i++){
   567     struct SrcList_item *pNewItem = &pNew->a[i];
   568     struct SrcList_item *pOldItem = &p->a[i];
   569     Table *pTab;
   570     pNewItem->zDatabase = sqlite3DbStrDup(db, pOldItem->zDatabase);
   571     pNewItem->zName = sqlite3DbStrDup(db, pOldItem->zName);
   572     pNewItem->zAlias = sqlite3DbStrDup(db, pOldItem->zAlias);
   573     pNewItem->jointype = pOldItem->jointype;
   574     pNewItem->iCursor = pOldItem->iCursor;
   575     pNewItem->isPopulated = pOldItem->isPopulated;
   576     pTab = pNewItem->pTab = pOldItem->pTab;
   577     if( pTab ){
   578       pTab->nRef++;
   579     }
   580     pNewItem->pSelect = sqlite3SelectDup(db, pOldItem->pSelect);
   581     pNewItem->pOn = sqlite3ExprDup(db, pOldItem->pOn);
   582     pNewItem->pUsing = sqlite3IdListDup(db, pOldItem->pUsing);
   583     pNewItem->colUsed = pOldItem->colUsed;
   584   }
   585   return pNew;
   586 }
   587 IdList *sqlite3IdListDup(sqlite3 *db, IdList *p){
   588   IdList *pNew;
   589   int i;
   590   if( p==0 ) return 0;
   591   pNew = sqlite3DbMallocRaw(db, sizeof(*pNew) );
   592   if( pNew==0 ) return 0;
   593   pNew->nId = pNew->nAlloc = p->nId;
   594   pNew->a = sqlite3DbMallocRaw(db, p->nId*sizeof(p->a[0]) );
   595   if( pNew->a==0 ){
   596     sqlite3_free(pNew);
   597     return 0;
   598   }
   599   for(i=0; i<p->nId; i++){
   600     struct IdList_item *pNewItem = &pNew->a[i];
   601     struct IdList_item *pOldItem = &p->a[i];
   602     pNewItem->zName = sqlite3DbStrDup(db, pOldItem->zName);
   603     pNewItem->idx = pOldItem->idx;
   604   }
   605   return pNew;
   606 }
   607 Select *sqlite3SelectDup(sqlite3 *db, Select *p){
   608   Select *pNew;
   609   if( p==0 ) return 0;
   610   pNew = sqlite3DbMallocRaw(db, sizeof(*p) );
   611   if( pNew==0 ) return 0;
   612   pNew->isDistinct = p->isDistinct;
   613   pNew->pEList = sqlite3ExprListDup(db, p->pEList);
   614   pNew->pSrc = sqlite3SrcListDup(db, p->pSrc);
   615   pNew->pWhere = sqlite3ExprDup(db, p->pWhere);
   616   pNew->pGroupBy = sqlite3ExprListDup(db, p->pGroupBy);
   617   pNew->pHaving = sqlite3ExprDup(db, p->pHaving);
   618   pNew->pOrderBy = sqlite3ExprListDup(db, p->pOrderBy);
   619   pNew->op = p->op;
   620   pNew->pPrior = sqlite3SelectDup(db, p->pPrior);
   621   pNew->pLimit = sqlite3ExprDup(db, p->pLimit);
   622   pNew->pOffset = sqlite3ExprDup(db, p->pOffset);
   623   pNew->iLimit = -1;
   624   pNew->iOffset = -1;
   625   pNew->isResolved = p->isResolved;
   626   pNew->isAgg = p->isAgg;
   627   pNew->usesEphm = 0;
   628   pNew->disallowOrderBy = 0;
   629   pNew->pRightmost = 0;
   630   pNew->addrOpenEphm[0] = -1;
   631   pNew->addrOpenEphm[1] = -1;
   632   pNew->addrOpenEphm[2] = -1;
   633   return pNew;
   634 }
   635 #else
   636 Select *sqlite3SelectDup(sqlite3 *db, Select *p){
   637   assert( p==0 );
   638   return 0;
   639 }
   640 #endif
   641 
   642 
   643 /*
   644 ** Add a new element to the end of an expression list.  If pList is
   645 ** initially NULL, then create a new expression list.
   646 */
   647 ExprList *sqlite3ExprListAppend(
   648   Parse *pParse,          /* Parsing context */
   649   ExprList *pList,        /* List to which to append. Might be NULL */
   650   Expr *pExpr,            /* Expression to be appended */
   651   Token *pName            /* AS keyword for the expression */
   652 ){
   653   sqlite3 *db = pParse->db;
   654   if( pList==0 ){
   655     pList = sqlite3DbMallocZero(db, sizeof(ExprList) );
   656     if( pList==0 ){
   657       goto no_mem;
   658     }
   659     assert( pList->nAlloc==0 );
   660   }
   661   if( pList->nAlloc<=pList->nExpr ){
   662     struct ExprList_item *a;
   663     int n = pList->nAlloc*2 + 4;
   664     a = sqlite3DbRealloc(db, pList->a, n*sizeof(pList->a[0]));
   665     if( a==0 ){
   666       goto no_mem;
   667     }
   668     pList->a = a;
   669     pList->nAlloc = n;
   670   }
   671   assert( pList->a!=0 );
   672   if( pExpr || pName ){
   673     struct ExprList_item *pItem = &pList->a[pList->nExpr++];
   674     memset(pItem, 0, sizeof(*pItem));
   675     pItem->zName = sqlite3NameFromToken(db, pName);
   676     pItem->pExpr = pExpr;
   677   }
   678   return pList;
   679 
   680 no_mem:     
   681   /* Avoid leaking memory if malloc has failed. */
   682   sqlite3ExprDelete(pExpr);
   683   sqlite3ExprListDelete(pList);
   684   return 0;
   685 }
   686 
   687 /*
   688 ** If the expression list pEList contains more than iLimit elements,
   689 ** leave an error message in pParse.
   690 */
   691 void sqlite3ExprListCheckLength(
   692   Parse *pParse,
   693   ExprList *pEList,
   694   int iLimit,
   695   const char *zObject
   696 ){
   697   if( pEList && pEList->nExpr>iLimit ){
   698     sqlite3ErrorMsg(pParse, "too many columns in %s", zObject);
   699   }
   700 }
   701 
   702 
   703 #if defined(SQLITE_TEST) || SQLITE_MAX_EXPR_DEPTH>0
   704 /* The following three functions, heightOfExpr(), heightOfExprList()
   705 ** and heightOfSelect(), are used to determine the maximum height
   706 ** of any expression tree referenced by the structure passed as the
   707 ** first argument.
   708 **
   709 ** If this maximum height is greater than the current value pointed
   710 ** to by pnHeight, the second parameter, then set *pnHeight to that
   711 ** value.
   712 */
   713 static void heightOfExpr(Expr *p, int *pnHeight){
   714   if( p ){
   715     if( p->nHeight>*pnHeight ){
   716       *pnHeight = p->nHeight;
   717     }
   718   }
   719 }
   720 static void heightOfExprList(ExprList *p, int *pnHeight){
   721   if( p ){
   722     int i;
   723     for(i=0; i<p->nExpr; i++){
   724       heightOfExpr(p->a[i].pExpr, pnHeight);
   725     }
   726   }
   727 }
   728 static void heightOfSelect(Select *p, int *pnHeight){
   729   if( p ){
   730     heightOfExpr(p->pWhere, pnHeight);
   731     heightOfExpr(p->pHaving, pnHeight);
   732     heightOfExpr(p->pLimit, pnHeight);
   733     heightOfExpr(p->pOffset, pnHeight);
   734     heightOfExprList(p->pEList, pnHeight);
   735     heightOfExprList(p->pGroupBy, pnHeight);
   736     heightOfExprList(p->pOrderBy, pnHeight);
   737     heightOfSelect(p->pPrior, pnHeight);
   738   }
   739 }
   740 
   741 /*
   742 ** Set the Expr.nHeight variable in the structure passed as an 
   743 ** argument. An expression with no children, Expr.pList or 
   744 ** Expr.pSelect member has a height of 1. Any other expression
   745 ** has a height equal to the maximum height of any other 
   746 ** referenced Expr plus one.
   747 */
   748 void sqlite3ExprSetHeight(Expr *p){
   749   int nHeight = 0;
   750   heightOfExpr(p->pLeft, &nHeight);
   751   heightOfExpr(p->pRight, &nHeight);
   752   heightOfExprList(p->pList, &nHeight);
   753   heightOfSelect(p->pSelect, &nHeight);
   754   p->nHeight = nHeight + 1;
   755 }
   756 
   757 /*
   758 ** Return the maximum height of any expression tree referenced
   759 ** by the select statement passed as an argument.
   760 */
   761 int sqlite3SelectExprHeight(Select *p){
   762   int nHeight = 0;
   763   heightOfSelect(p, &nHeight);
   764   return nHeight;
   765 }
   766 #endif
   767 
   768 /*
   769 ** Delete an entire expression list.
   770 */
   771 void sqlite3ExprListDelete(ExprList *pList){
   772   int i;
   773   struct ExprList_item *pItem;
   774   if( pList==0 ) return;
   775   assert( pList->a!=0 || (pList->nExpr==0 && pList->nAlloc==0) );
   776   assert( pList->nExpr<=pList->nAlloc );
   777   for(pItem=pList->a, i=0; i<pList->nExpr; i++, pItem++){
   778     sqlite3ExprDelete(pItem->pExpr);
   779     sqlite3_free(pItem->zName);
   780   }
   781   sqlite3_free(pList->a);
   782   sqlite3_free(pList);
   783 }
   784 
   785 /*
   786 ** Walk an expression tree.  Call xFunc for each node visited.
   787 **
   788 ** The return value from xFunc determines whether the tree walk continues.
   789 ** 0 means continue walking the tree.  1 means do not walk children
   790 ** of the current node but continue with siblings.  2 means abandon
   791 ** the tree walk completely.
   792 **
   793 ** The return value from this routine is 1 to abandon the tree walk
   794 ** and 0 to continue.
   795 **
   796 ** NOTICE:  This routine does *not* descend into subqueries.
   797 */
   798 static int walkExprList(ExprList *, int (*)(void *, Expr*), void *);
   799 static int walkExprTree(Expr *pExpr, int (*xFunc)(void*,Expr*), void *pArg){
   800   int rc;
   801   if( pExpr==0 ) return 0;
   802   rc = (*xFunc)(pArg, pExpr);
   803   if( rc==0 ){
   804     if( walkExprTree(pExpr->pLeft, xFunc, pArg) ) return 1;
   805     if( walkExprTree(pExpr->pRight, xFunc, pArg) ) return 1;
   806     if( walkExprList(pExpr->pList, xFunc, pArg) ) return 1;
   807   }
   808   return rc>1;
   809 }
   810 
   811 /*
   812 ** Call walkExprTree() for every expression in list p.
   813 */
   814 static int walkExprList(ExprList *p, int (*xFunc)(void *, Expr*), void *pArg){
   815   int i;
   816   struct ExprList_item *pItem;
   817   if( !p ) return 0;
   818   for(i=p->nExpr, pItem=p->a; i>0; i--, pItem++){
   819     if( walkExprTree(pItem->pExpr, xFunc, pArg) ) return 1;
   820   }
   821   return 0;
   822 }
   823 
   824 /*
   825 ** Call walkExprTree() for every expression in Select p, not including
   826 ** expressions that are part of sub-selects in any FROM clause or the LIMIT
   827 ** or OFFSET expressions..
   828 */
   829 static int walkSelectExpr(Select *p, int (*xFunc)(void *, Expr*), void *pArg){
   830   walkExprList(p->pEList, xFunc, pArg);
   831   walkExprTree(p->pWhere, xFunc, pArg);
   832   walkExprList(p->pGroupBy, xFunc, pArg);
   833   walkExprTree(p->pHaving, xFunc, pArg);
   834   walkExprList(p->pOrderBy, xFunc, pArg);
   835   if( p->pPrior ){
   836     walkSelectExpr(p->pPrior, xFunc, pArg);
   837   }
   838   return 0;
   839 }
   840 
   841 
   842 /*
   843 ** This routine is designed as an xFunc for walkExprTree().
   844 **
   845 ** pArg is really a pointer to an integer.  If we can tell by looking
   846 ** at pExpr that the expression that contains pExpr is not a constant
   847 ** expression, then set *pArg to 0 and return 2 to abandon the tree walk.
   848 ** If pExpr does does not disqualify the expression from being a constant
   849 ** then do nothing.
   850 **
   851 ** After walking the whole tree, if no nodes are found that disqualify
   852 ** the expression as constant, then we assume the whole expression
   853 ** is constant.  See sqlite3ExprIsConstant() for additional information.
   854 */
   855 static int exprNodeIsConstant(void *pArg, Expr *pExpr){
   856   int *pN = (int*)pArg;
   857 
   858   /* If *pArg is 3 then any term of the expression that comes from
   859   ** the ON or USING clauses of a join disqualifies the expression
   860   ** from being considered constant. */
   861   if( (*pN)==3 && ExprHasAnyProperty(pExpr, EP_FromJoin) ){
   862     *pN = 0;
   863     return 2;
   864   }
   865 
   866   switch( pExpr->op ){
   867     /* Consider functions to be constant if all their arguments are constant
   868     ** and *pArg==2 */
   869     case TK_FUNCTION:
   870       if( (*pN)==2 ) return 0;
   871       /* Fall through */
   872     case TK_ID:
   873     case TK_COLUMN:
   874     case TK_DOT:
   875     case TK_AGG_FUNCTION:
   876     case TK_AGG_COLUMN:
   877 #ifndef SQLITE_OMIT_SUBQUERY
   878     case TK_SELECT:
   879     case TK_EXISTS:
   880 #endif
   881       *pN = 0;
   882       return 2;
   883     case TK_IN:
   884       if( pExpr->pSelect ){
   885         *pN = 0;
   886         return 2;
   887       }
   888     default:
   889       return 0;
   890   }
   891 }
   892 
   893 /*
   894 ** Walk an expression tree.  Return 1 if the expression is constant
   895 ** and 0 if it involves variables or function calls.
   896 **
   897 ** For the purposes of this function, a double-quoted string (ex: "abc")
   898 ** is considered a variable but a single-quoted string (ex: 'abc') is
   899 ** a constant.
   900 */
   901 int sqlite3ExprIsConstant(Expr *p){
   902   int isConst = 1;
   903   walkExprTree(p, exprNodeIsConstant, &isConst);
   904   return isConst;
   905 }
   906 
   907 /*
   908 ** Walk an expression tree.  Return 1 if the expression is constant
   909 ** that does no originate from the ON or USING clauses of a join.
   910 ** Return 0 if it involves variables or function calls or terms from
   911 ** an ON or USING clause.
   912 */
   913 int sqlite3ExprIsConstantNotJoin(Expr *p){
   914   int isConst = 3;
   915   walkExprTree(p, exprNodeIsConstant, &isConst);
   916   return isConst!=0;
   917 }
   918 
   919 /*
   920 ** Walk an expression tree.  Return 1 if the expression is constant
   921 ** or a function call with constant arguments.  Return and 0 if there
   922 ** are any variables.
   923 **
   924 ** For the purposes of this function, a double-quoted string (ex: "abc")
   925 ** is considered a variable but a single-quoted string (ex: 'abc') is
   926 ** a constant.
   927 */
   928 int sqlite3ExprIsConstantOrFunction(Expr *p){
   929   int isConst = 2;
   930   walkExprTree(p, exprNodeIsConstant, &isConst);
   931   return isConst!=0;
   932 }
   933 
   934 /*
   935 ** If the expression p codes a constant integer that is small enough
   936 ** to fit in a 32-bit integer, return 1 and put the value of the integer
   937 ** in *pValue.  If the expression is not an integer or if it is too big
   938 ** to fit in a signed 32-bit integer, return 0 and leave *pValue unchanged.
   939 */
   940 int sqlite3ExprIsInteger(Expr *p, int *pValue){
   941   switch( p->op ){
   942     case TK_INTEGER: {
   943       if( sqlite3GetInt32((char*)p->token.z, pValue) ){
   944         return 1;
   945       }
   946       break;
   947     }
   948     case TK_UPLUS: {
   949       return sqlite3ExprIsInteger(p->pLeft, pValue);
   950     }
   951     case TK_UMINUS: {
   952       int v;
   953       if( sqlite3ExprIsInteger(p->pLeft, &v) ){
   954         *pValue = -v;
   955         return 1;
   956       }
   957       break;
   958     }
   959     default: break;
   960   }
   961   return 0;
   962 }
   963 
   964 /*
   965 ** Return TRUE if the given string is a row-id column name.
   966 */
   967 int sqlite3IsRowid(const char *z){
   968   if( sqlite3StrICmp(z, "_ROWID_")==0 ) return 1;
   969   if( sqlite3StrICmp(z, "ROWID")==0 ) return 1;
   970   if( sqlite3StrICmp(z, "OID")==0 ) return 1;
   971   return 0;
   972 }
   973 
   974 /*
   975 ** Given the name of a column of the form X.Y.Z or Y.Z or just Z, look up
   976 ** that name in the set of source tables in pSrcList and make the pExpr 
   977 ** expression node refer back to that source column.  The following changes
   978 ** are made to pExpr:
   979 **
   980 **    pExpr->iDb           Set the index in db->aDb[] of the database holding
   981 **                         the table.
   982 **    pExpr->iTable        Set to the cursor number for the table obtained
   983 **                         from pSrcList.
   984 **    pExpr->iColumn       Set to the column number within the table.
   985 **    pExpr->op            Set to TK_COLUMN.
   986 **    pExpr->pLeft         Any expression this points to is deleted
   987 **    pExpr->pRight        Any expression this points to is deleted.
   988 **
   989 ** The pDbToken is the name of the database (the "X").  This value may be
   990 ** NULL meaning that name is of the form Y.Z or Z.  Any available database
   991 ** can be used.  The pTableToken is the name of the table (the "Y").  This
   992 ** value can be NULL if pDbToken is also NULL.  If pTableToken is NULL it
   993 ** means that the form of the name is Z and that columns from any table
   994 ** can be used.
   995 **
   996 ** If the name cannot be resolved unambiguously, leave an error message
   997 ** in pParse and return non-zero.  Return zero on success.
   998 */
   999 static int lookupName(
  1000   Parse *pParse,       /* The parsing context */
  1001   Token *pDbToken,     /* Name of the database containing table, or NULL */
  1002   Token *pTableToken,  /* Name of table containing column, or NULL */
  1003   Token *pColumnToken, /* Name of the column. */
  1004   NameContext *pNC,    /* The name context used to resolve the name */
  1005   Expr *pExpr          /* Make this EXPR node point to the selected column */
  1006 ){
  1007   char *zDb = 0;       /* Name of the database.  The "X" in X.Y.Z */
  1008   char *zTab = 0;      /* Name of the table.  The "Y" in X.Y.Z or Y.Z */
  1009   char *zCol = 0;      /* Name of the column.  The "Z" */
  1010   int i, j;            /* Loop counters */
  1011   int cnt = 0;         /* Number of matching column names */
  1012   int cntTab = 0;      /* Number of matching table names */
  1013   sqlite3 *db = pParse->db;  /* The database */
  1014   struct SrcList_item *pItem;       /* Use for looping over pSrcList items */
  1015   struct SrcList_item *pMatch = 0;  /* The matching pSrcList item */
  1016   NameContext *pTopNC = pNC;        /* First namecontext in the list */
  1017   Schema *pSchema = 0;              /* Schema of the expression */
  1018 
  1019   assert( pColumnToken && pColumnToken->z ); /* The Z in X.Y.Z cannot be NULL */
  1020   zDb = sqlite3NameFromToken(db, pDbToken);
  1021   zTab = sqlite3NameFromToken(db, pTableToken);
  1022   zCol = sqlite3NameFromToken(db, pColumnToken);
  1023   if( db->mallocFailed ){
  1024     goto lookupname_end;
  1025   }
  1026 
  1027   pExpr->iTable = -1;
  1028   while( pNC && cnt==0 ){
  1029     ExprList *pEList;
  1030     SrcList *pSrcList = pNC->pSrcList;
  1031 
  1032     if( pSrcList ){
  1033       for(i=0, pItem=pSrcList->a; i<pSrcList->nSrc; i++, pItem++){
  1034         Table *pTab;
  1035         int iDb;
  1036         Column *pCol;
  1037   
  1038         pTab = pItem->pTab;
  1039         assert( pTab!=0 );
  1040         iDb = sqlite3SchemaToIndex(db, pTab->pSchema);
  1041         assert( pTab->nCol>0 );
  1042         if( zTab ){
  1043           if( pItem->zAlias ){
  1044             char *zTabName = pItem->zAlias;
  1045             if( sqlite3StrICmp(zTabName, zTab)!=0 ) continue;
  1046           }else{
  1047             char *zTabName = pTab->zName;
  1048             if( zTabName==0 || sqlite3StrICmp(zTabName, zTab)!=0 ) continue;
  1049             if( zDb!=0 && sqlite3StrICmp(db->aDb[iDb].zName, zDb)!=0 ){
  1050               continue;
  1051             }
  1052           }
  1053         }
  1054         if( 0==(cntTab++) ){
  1055           pExpr->iTable = pItem->iCursor;
  1056           pSchema = pTab->pSchema;
  1057           pMatch = pItem;
  1058         }
  1059         for(j=0, pCol=pTab->aCol; j<pTab->nCol; j++, pCol++){
  1060           if( sqlite3StrICmp(pCol->zName, zCol)==0 ){
  1061             const char *zColl = pTab->aCol[j].zColl;
  1062             IdList *pUsing;
  1063             cnt++;
  1064             pExpr->iTable = pItem->iCursor;
  1065             pMatch = pItem;
  1066             pSchema = pTab->pSchema;
  1067             /* Substitute the rowid (column -1) for the INTEGER PRIMARY KEY */
  1068             pExpr->iColumn = j==pTab->iPKey ? -1 : j;
  1069             pExpr->affinity = pTab->aCol[j].affinity;
  1070             if( (pExpr->flags & EP_ExpCollate)==0 ){
  1071               pExpr->pColl = sqlite3FindCollSeq(db, ENC(db), zColl,-1, 0);
  1072             }
  1073             if( i<pSrcList->nSrc-1 ){
  1074               if( pItem[1].jointype & JT_NATURAL ){
  1075                 /* If this match occurred in the left table of a natural join,
  1076                 ** then skip the right table to avoid a duplicate match */
  1077                 pItem++;
  1078                 i++;
  1079               }else if( (pUsing = pItem[1].pUsing)!=0 ){
  1080                 /* If this match occurs on a column that is in the USING clause
  1081                 ** of a join, skip the search of the right table of the join
  1082                 ** to avoid a duplicate match there. */
  1083                 int k;
  1084                 for(k=0; k<pUsing->nId; k++){
  1085                   if( sqlite3StrICmp(pUsing->a[k].zName, zCol)==0 ){
  1086                     pItem++;
  1087                     i++;
  1088                     break;
  1089                   }
  1090                 }
  1091               }
  1092             }
  1093             break;
  1094           }
  1095         }
  1096       }
  1097     }
  1098 
  1099 #ifndef SQLITE_OMIT_TRIGGER
  1100     /* If we have not already resolved the name, then maybe 
  1101     ** it is a new.* or old.* trigger argument reference
  1102     */
  1103     if( zDb==0 && zTab!=0 && cnt==0 && pParse->trigStack!=0 ){
  1104       TriggerStack *pTriggerStack = pParse->trigStack;
  1105       Table *pTab = 0;
  1106       if( pTriggerStack->newIdx != -1 && sqlite3StrICmp("new", zTab) == 0 ){
  1107         pExpr->iTable = pTriggerStack->newIdx;
  1108         assert( pTriggerStack->pTab );
  1109         pTab = pTriggerStack->pTab;
  1110       }else if( pTriggerStack->oldIdx != -1 && sqlite3StrICmp("old", zTab)==0 ){
  1111         pExpr->iTable = pTriggerStack->oldIdx;
  1112         assert( pTriggerStack->pTab );
  1113         pTab = pTriggerStack->pTab;
  1114       }
  1115 
  1116       if( pTab ){ 
  1117         int iCol;
  1118         Column *pCol = pTab->aCol;
  1119 
  1120         pSchema = pTab->pSchema;
  1121         cntTab++;
  1122         for(iCol=0; iCol < pTab->nCol; iCol++, pCol++) {
  1123           if( sqlite3StrICmp(pCol->zName, zCol)==0 ){
  1124             const char *zColl = pTab->aCol[iCol].zColl;
  1125             cnt++;
  1126             pExpr->iColumn = iCol==pTab->iPKey ? -1 : iCol;
  1127             pExpr->affinity = pTab->aCol[iCol].affinity;
  1128             if( (pExpr->flags & EP_ExpCollate)==0 ){
  1129               pExpr->pColl = sqlite3FindCollSeq(db, ENC(db), zColl,-1, 0);
  1130             }
  1131             pExpr->pTab = pTab;
  1132             break;
  1133           }
  1134         }
  1135       }
  1136     }
  1137 #endif /* !defined(SQLITE_OMIT_TRIGGER) */
  1138 
  1139     /*
  1140     ** Perhaps the name is a reference to the ROWID
  1141     */
  1142     if( cnt==0 && cntTab==1 && sqlite3IsRowid(zCol) ){
  1143       cnt = 1;
  1144       pExpr->iColumn = -1;
  1145       pExpr->affinity = SQLITE_AFF_INTEGER;
  1146     }
  1147 
  1148     /*
  1149     ** If the input is of the form Z (not Y.Z or X.Y.Z) then the name Z
  1150     ** might refer to an result-set alias.  This happens, for example, when
  1151     ** we are resolving names in the WHERE clause of the following command:
  1152     **
  1153     **     SELECT a+b AS x FROM table WHERE x<10;
  1154     **
  1155     ** In cases like this, replace pExpr with a copy of the expression that
  1156     ** forms the result set entry ("a+b" in the example) and return immediately.
  1157     ** Note that the expression in the result set should have already been
  1158     ** resolved by the time the WHERE clause is resolved.
  1159     */
  1160     if( cnt==0 && (pEList = pNC->pEList)!=0 && zTab==0 ){
  1161       for(j=0; j<pEList->nExpr; j++){
  1162         char *zAs = pEList->a[j].zName;
  1163         if( zAs!=0 && sqlite3StrICmp(zAs, zCol)==0 ){
  1164           Expr *pDup, *pOrig;
  1165           assert( pExpr->pLeft==0 && pExpr->pRight==0 );
  1166           assert( pExpr->pList==0 );
  1167           assert( pExpr->pSelect==0 );
  1168           pOrig = pEList->a[j].pExpr;
  1169           if( !pNC->allowAgg && ExprHasProperty(pOrig, EP_Agg) ){
  1170             sqlite3ErrorMsg(pParse, "misuse of aliased aggregate %s", zAs);
  1171             sqlite3_free(zCol);
  1172             return 2;
  1173           }
  1174           pDup = sqlite3ExprDup(db, pOrig);
  1175           if( pExpr->flags & EP_ExpCollate ){
  1176             pDup->pColl = pExpr->pColl;
  1177             pDup->flags |= EP_ExpCollate;
  1178           }
  1179           if( pExpr->span.dyn ) sqlite3_free((char*)pExpr->span.z);
  1180           if( pExpr->token.dyn ) sqlite3_free((char*)pExpr->token.z);
  1181           memcpy(pExpr, pDup, sizeof(*pExpr));
  1182           sqlite3_free(pDup);
  1183           cnt = 1;
  1184           pMatch = 0;
  1185           assert( zTab==0 && zDb==0 );
  1186           goto lookupname_end_2;
  1187         }
  1188       } 
  1189     }
  1190 
  1191     /* Advance to the next name context.  The loop will exit when either
  1192     ** we have a match (cnt>0) or when we run out of name contexts.
  1193     */
  1194     if( cnt==0 ){
  1195       pNC = pNC->pNext;
  1196     }
  1197   }
  1198 
  1199   /*
  1200   ** If X and Y are NULL (in other words if only the column name Z is
  1201   ** supplied) and the value of Z is enclosed in double-quotes, then
  1202   ** Z is a string literal if it doesn't match any column names.  In that
  1203   ** case, we need to return right away and not make any changes to
  1204   ** pExpr.
  1205   **
  1206   ** Because no reference was made to outer contexts, the pNC->nRef
  1207   ** fields are not changed in any context.
  1208   */
  1209   if( cnt==0 && zTab==0 && pColumnToken->z[0]=='"' ){
  1210     sqlite3_free(zCol);
  1211     return 0;
  1212   }
  1213 
  1214   /*
  1215   ** cnt==0 means there was not match.  cnt>1 means there were two or
  1216   ** more matches.  Either way, we have an error.
  1217   */
  1218   if( cnt!=1 ){
  1219     char *z = 0;
  1220     char *zErr;
  1221     zErr = cnt==0 ? "no such column: %s" : "ambiguous column name: %s";
  1222     if( zDb ){
  1223       sqlite3SetString(&z, zDb, ".", zTab, ".", zCol, (char*)0);
  1224     }else if( zTab ){
  1225       sqlite3SetString(&z, zTab, ".", zCol, (char*)0);
  1226     }else{
  1227       z = sqlite3StrDup(zCol);
  1228     }
  1229     if( z ){
  1230       sqlite3ErrorMsg(pParse, zErr, z);
  1231       sqlite3_free(z);
  1232       pTopNC->nErr++;
  1233     }else{
  1234       db->mallocFailed = 1;
  1235     }
  1236   }
  1237 
  1238   /* If a column from a table in pSrcList is referenced, then record
  1239   ** this fact in the pSrcList.a[].colUsed bitmask.  Column 0 causes
  1240   ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.  If the
  1241   ** column number is greater than the number of bits in the bitmask
  1242   ** then set the high-order bit of the bitmask.
  1243   */
  1244   if( pExpr->iColumn>=0 && pMatch!=0 ){
  1245     int n = pExpr->iColumn;
  1246     if( n>=sizeof(Bitmask)*8 ){
  1247       n = sizeof(Bitmask)*8-1;
  1248     }
  1249     assert( pMatch->iCursor==pExpr->iTable );
  1250     pMatch->colUsed |= ((Bitmask)1)<<n;
  1251   }
  1252 
  1253 lookupname_end:
  1254   /* Clean up and return
  1255   */
  1256   sqlite3_free(zDb);
  1257   sqlite3_free(zTab);
  1258   sqlite3ExprDelete(pExpr->pLeft);
  1259   pExpr->pLeft = 0;
  1260   sqlite3ExprDelete(pExpr->pRight);
  1261   pExpr->pRight = 0;
  1262   pExpr->op = TK_COLUMN;
  1263 lookupname_end_2:
  1264   sqlite3_free(zCol);
  1265   if( cnt==1 ){
  1266     assert( pNC!=0 );
  1267     sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList);
  1268     if( pMatch && !pMatch->pSelect ){
  1269       pExpr->pTab = pMatch->pTab;
  1270     }
  1271     /* Increment the nRef value on all name contexts from TopNC up to
  1272     ** the point where the name matched. */
  1273     for(;;){
  1274       assert( pTopNC!=0 );
  1275       pTopNC->nRef++;
  1276       if( pTopNC==pNC ) break;
  1277       pTopNC = pTopNC->pNext;
  1278     }
  1279     return 0;
  1280   } else {
  1281     return 1;
  1282   }
  1283 }
  1284 
  1285 /*
  1286 ** This routine is designed as an xFunc for walkExprTree().
  1287 **
  1288 ** Resolve symbolic names into TK_COLUMN operators for the current
  1289 ** node in the expression tree.  Return 0 to continue the search down
  1290 ** the tree or 2 to abort the tree walk.
  1291 **
  1292 ** This routine also does error checking and name resolution for
  1293 ** function names.  The operator for aggregate functions is changed
  1294 ** to TK_AGG_FUNCTION.
  1295 */
  1296 static int nameResolverStep(void *pArg, Expr *pExpr){
  1297   NameContext *pNC = (NameContext*)pArg;
  1298   Parse *pParse;
  1299 
  1300   if( pExpr==0 ) return 1;
  1301   assert( pNC!=0 );
  1302   pParse = pNC->pParse;
  1303 
  1304   if( ExprHasAnyProperty(pExpr, EP_Resolved) ) return 1;
  1305   ExprSetProperty(pExpr, EP_Resolved);
  1306 #ifndef NDEBUG
  1307   if( pNC->pSrcList && pNC->pSrcList->nAlloc>0 ){
  1308     SrcList *pSrcList = pNC->pSrcList;
  1309     int i;
  1310     for(i=0; i<pNC->pSrcList->nSrc; i++){
  1311       assert( pSrcList->a[i].iCursor>=0 && pSrcList->a[i].iCursor<pParse->nTab);
  1312     }
  1313   }
  1314 #endif
  1315   switch( pExpr->op ){
  1316     /* Double-quoted strings (ex: "abc") are used as identifiers if
  1317     ** possible.  Otherwise they remain as strings.  Single-quoted
  1318     ** strings (ex: 'abc') are always string literals.
  1319     */
  1320     case TK_STRING: {
  1321       if( pExpr->token.z[0]=='\'' ) break;
  1322       /* Fall thru into the TK_ID case if this is a double-quoted string */
  1323     }
  1324     /* A lone identifier is the name of a column.
  1325     */
  1326     case TK_ID: {
  1327       lookupName(pParse, 0, 0, &pExpr->token, pNC, pExpr);
  1328       return 1;
  1329     }
  1330   
  1331     /* A table name and column name:     ID.ID
  1332     ** Or a database, table and column:  ID.ID.ID
  1333     */
  1334     case TK_DOT: {
  1335       Token *pColumn;
  1336       Token *pTable;
  1337       Token *pDb;
  1338       Expr *pRight;
  1339 
  1340       /* if( pSrcList==0 ) break; */
  1341       pRight = pExpr->pRight;
  1342       if( pRight->op==TK_ID ){
  1343         pDb = 0;
  1344         pTable = &pExpr->pLeft->token;
  1345         pColumn = &pRight->token;
  1346       }else{
  1347         assert( pRight->op==TK_DOT );
  1348         pDb = &pExpr->pLeft->token;
  1349         pTable = &pRight->pLeft->token;
  1350         pColumn = &pRight->pRight->token;
  1351       }
  1352       lookupName(pParse, pDb, pTable, pColumn, pNC, pExpr);
  1353       return 1;
  1354     }
  1355 
  1356     /* Resolve function names
  1357     */
  1358     case TK_CONST_FUNC:
  1359     case TK_FUNCTION: {
  1360       ExprList *pList = pExpr->pList;    /* The argument list */
  1361       int n = pList ? pList->nExpr : 0;  /* Number of arguments */
  1362       int no_such_func = 0;       /* True if no such function exists */
  1363       int wrong_num_args = 0;     /* True if wrong number of arguments */
  1364       int is_agg = 0;             /* True if is an aggregate function */
  1365       int i;
  1366       int auth;                   /* Authorization to use the function */
  1367       int nId;                    /* Number of characters in function name */
  1368       const char *zId;            /* The function name. */
  1369       FuncDef *pDef;              /* Information about the function */
  1370       int enc = ENC(pParse->db);  /* The database encoding */
  1371 
  1372       zId = (char*)pExpr->token.z;
  1373       nId = pExpr->token.n;
  1374       pDef = sqlite3FindFunction(pParse->db, zId, nId, n, enc, 0);
  1375       if( pDef==0 ){
  1376         pDef = sqlite3FindFunction(pParse->db, zId, nId, -1, enc, 0);
  1377         if( pDef==0 ){
  1378           no_such_func = 1;
  1379         }else{
  1380           wrong_num_args = 1;
  1381         }
  1382       }else{
  1383         is_agg = pDef->xFunc==0;
  1384       }
  1385 #ifndef SQLITE_OMIT_AUTHORIZATION
  1386       if( pDef ){
  1387         auth = sqlite3AuthCheck(pParse, SQLITE_FUNCTION, 0, pDef->zName, 0);
  1388         if( auth!=SQLITE_OK ){
  1389           if( auth==SQLITE_DENY ){
  1390             sqlite3ErrorMsg(pParse, "not authorized to use function: %s",
  1391                                     pDef->zName);
  1392             pNC->nErr++;
  1393           }
  1394           pExpr->op = TK_NULL;
  1395           return 1;
  1396         }
  1397       }
  1398 #endif
  1399       if( is_agg && !pNC->allowAgg ){
  1400         sqlite3ErrorMsg(pParse, "misuse of aggregate function %.*s()", nId,zId);
  1401         pNC->nErr++;
  1402         is_agg = 0;
  1403       }else if( no_such_func ){
  1404         sqlite3ErrorMsg(pParse, "no such function: %.*s", nId, zId);
  1405         pNC->nErr++;
  1406       }else if( wrong_num_args ){
  1407         sqlite3ErrorMsg(pParse,"wrong number of arguments to function %.*s()",
  1408              nId, zId);
  1409         pNC->nErr++;
  1410       }
  1411       if( is_agg ){
  1412         pExpr->op = TK_AGG_FUNCTION;
  1413         pNC->hasAgg = 1;
  1414       }
  1415       if( is_agg ) pNC->allowAgg = 0;
  1416       for(i=0; pNC->nErr==0 && i<n; i++){
  1417         walkExprTree(pList->a[i].pExpr, nameResolverStep, pNC);
  1418       }
  1419       if( is_agg ) pNC->allowAgg = 1;
  1420       /* FIX ME:  Compute pExpr->affinity based on the expected return
  1421       ** type of the function 
  1422       */
  1423       return is_agg;
  1424     }
  1425 #ifndef SQLITE_OMIT_SUBQUERY
  1426     case TK_SELECT:
  1427     case TK_EXISTS:
  1428 #endif
  1429     case TK_IN: {
  1430       if( pExpr->pSelect ){
  1431         int nRef = pNC->nRef;
  1432 #ifndef SQLITE_OMIT_CHECK
  1433         if( pNC->isCheck ){
  1434           sqlite3ErrorMsg(pParse,"subqueries prohibited in CHECK constraints");
  1435         }
  1436 #endif
  1437         sqlite3SelectResolve(pParse, pExpr->pSelect, pNC);
  1438         assert( pNC->nRef>=nRef );
  1439         if( nRef!=pNC->nRef ){
  1440           ExprSetProperty(pExpr, EP_VarSelect);
  1441         }
  1442       }
  1443       break;
  1444     }
  1445 #ifndef SQLITE_OMIT_CHECK
  1446     case TK_VARIABLE: {
  1447       if( pNC->isCheck ){
  1448         sqlite3ErrorMsg(pParse,"parameters prohibited in CHECK constraints");
  1449       }
  1450       break;
  1451     }
  1452 #endif
  1453   }
  1454   return 0;
  1455 }
  1456 
  1457 /*
  1458 ** This routine walks an expression tree and resolves references to
  1459 ** table columns.  Nodes of the form ID.ID or ID resolve into an
  1460 ** index to the table in the table list and a column offset.  The 
  1461 ** Expr.opcode for such nodes is changed to TK_COLUMN.  The Expr.iTable
  1462 ** value is changed to the index of the referenced table in pTabList
  1463 ** plus the "base" value.  The base value will ultimately become the
  1464 ** VDBE cursor number for a cursor that is pointing into the referenced
  1465 ** table.  The Expr.iColumn value is changed to the index of the column 
  1466 ** of the referenced table.  The Expr.iColumn value for the special
  1467 ** ROWID column is -1.  Any INTEGER PRIMARY KEY column is tried as an
  1468 ** alias for ROWID.
  1469 **
  1470 ** Also resolve function names and check the functions for proper
  1471 ** usage.  Make sure all function names are recognized and all functions
  1472 ** have the correct number of arguments.  Leave an error message
  1473 ** in pParse->zErrMsg if anything is amiss.  Return the number of errors.
  1474 **
  1475 ** If the expression contains aggregate functions then set the EP_Agg
  1476 ** property on the expression.
  1477 */
  1478 int sqlite3ExprResolveNames( 
  1479   NameContext *pNC,       /* Namespace to resolve expressions in. */
  1480   Expr *pExpr             /* The expression to be analyzed. */
  1481 ){
  1482   int savedHasAgg;
  1483   if( pExpr==0 ) return 0;
  1484 #if defined(SQLITE_TEST) || SQLITE_MAX_EXPR_DEPTH>0
  1485   if( (pExpr->nHeight+pNC->pParse->nHeight)>SQLITE_MAX_EXPR_DEPTH ){
  1486     sqlite3ErrorMsg(pNC->pParse, 
  1487        "Expression tree is too large (maximum depth %d)",
  1488        SQLITE_MAX_EXPR_DEPTH
  1489     );
  1490     return 1;
  1491   }
  1492   pNC->pParse->nHeight += pExpr->nHeight;
  1493 #endif
  1494   savedHasAgg = pNC->hasAgg;
  1495   pNC->hasAgg = 0;
  1496   walkExprTree(pExpr, nameResolverStep, pNC);
  1497 #if defined(SQLITE_TEST) || SQLITE_MAX_EXPR_DEPTH>0
  1498   pNC->pParse->nHeight -= pExpr->nHeight;
  1499 #endif
  1500   if( pNC->nErr>0 ){
  1501     ExprSetProperty(pExpr, EP_Error);
  1502   }
  1503   if( pNC->hasAgg ){
  1504     ExprSetProperty(pExpr, EP_Agg);
  1505   }else if( savedHasAgg ){
  1506     pNC->hasAgg = 1;
  1507   }
  1508   return ExprHasProperty(pExpr, EP_Error);
  1509 }
  1510 
  1511 /*
  1512 ** A pointer instance of this structure is used to pass information
  1513 ** through walkExprTree into codeSubqueryStep().
  1514 */
  1515 typedef struct QueryCoder QueryCoder;
  1516 struct QueryCoder {
  1517   Parse *pParse;       /* The parsing context */
  1518   NameContext *pNC;    /* Namespace of first enclosing query */
  1519 };
  1520 
  1521 
  1522 /*
  1523 ** Generate code for scalar subqueries used as an expression
  1524 ** and IN operators.  Examples:
  1525 **
  1526 **     (SELECT a FROM b)          -- subquery
  1527 **     EXISTS (SELECT a FROM b)   -- EXISTS subquery
  1528 **     x IN (4,5,11)              -- IN operator with list on right-hand side
  1529 **     x IN (SELECT a FROM b)     -- IN operator with subquery on the right
  1530 **
  1531 ** The pExpr parameter describes the expression that contains the IN
  1532 ** operator or subquery.
  1533 */
  1534 #ifndef SQLITE_OMIT_SUBQUERY
  1535 void sqlite3CodeSubselect(Parse *pParse, Expr *pExpr){
  1536   int testAddr = 0;                       /* One-time test address */
  1537   Vdbe *v = sqlite3GetVdbe(pParse);
  1538   if( v==0 ) return;
  1539 
  1540 
  1541   /* This code must be run in its entirety every time it is encountered
  1542   ** if any of the following is true:
  1543   **
  1544   **    *  The right-hand side is a correlated subquery
  1545   **    *  The right-hand side is an expression list containing variables
  1546   **    *  We are inside a trigger
  1547   **
  1548   ** If all of the above are false, then we can run this code just once
  1549   ** save the results, and reuse the same result on subsequent invocations.
  1550   */
  1551   if( !ExprHasAnyProperty(pExpr, EP_VarSelect) && !pParse->trigStack ){
  1552     int mem = pParse->nMem++;
  1553     sqlite3VdbeAddOp(v, OP_MemLoad, mem, 0);
  1554     testAddr = sqlite3VdbeAddOp(v, OP_If, 0, 0);
  1555     assert( testAddr>0 || pParse->db->mallocFailed );
  1556     sqlite3VdbeAddOp(v, OP_MemInt, 1, mem);
  1557   }
  1558 
  1559   switch( pExpr->op ){
  1560     case TK_IN: {
  1561       char affinity;
  1562       KeyInfo keyInfo;
  1563       int addr;        /* Address of OP_OpenEphemeral instruction */
  1564 
  1565       affinity = sqlite3ExprAffinity(pExpr->pLeft);
  1566 
  1567       /* Whether this is an 'x IN(SELECT...)' or an 'x IN(<exprlist>)'
  1568       ** expression it is handled the same way. A virtual table is 
  1569       ** filled with single-field index keys representing the results
  1570       ** from the SELECT or the <exprlist>.
  1571       **
  1572       ** If the 'x' expression is a column value, or the SELECT...
  1573       ** statement returns a column value, then the affinity of that
  1574       ** column is used to build the index keys. If both 'x' and the
  1575       ** SELECT... statement are columns, then numeric affinity is used
  1576       ** if either column has NUMERIC or INTEGER affinity. If neither
  1577       ** 'x' nor the SELECT... statement are columns, then numeric affinity
  1578       ** is used.
  1579       */
  1580       pExpr->iTable = pParse->nTab++;
  1581       addr = sqlite3VdbeAddOp(v, OP_OpenEphemeral, pExpr->iTable, 0);
  1582       memset(&keyInfo, 0, sizeof(keyInfo));
  1583       keyInfo.nField = 1;
  1584       sqlite3VdbeAddOp(v, OP_SetNumColumns, pExpr->iTable, 1);
  1585 
  1586       if( pExpr->pSelect ){
  1587         /* Case 1:     expr IN (SELECT ...)
  1588         **
  1589         ** Generate code to write the results of the select into the temporary
  1590         ** table allocated and opened above.
  1591         */
  1592         int iParm = pExpr->iTable +  (((int)affinity)<<16);
  1593         ExprList *pEList;
  1594         assert( (pExpr->iTable&0x0000FFFF)==pExpr->iTable );
  1595         if( sqlite3Select(pParse, pExpr->pSelect, SRT_Set, iParm, 0, 0, 0, 0) ){
  1596           return;
  1597         }
  1598         pEList = pExpr->pSelect->pEList;
  1599         if( pEList && pEList->nExpr>0 ){ 
  1600           keyInfo.aColl[0] = sqlite3BinaryCompareCollSeq(pParse, pExpr->pLeft,
  1601               pEList->a[0].pExpr);
  1602         }
  1603       }else if( pExpr->pList ){
  1604         /* Case 2:     expr IN (exprlist)
  1605         **
  1606         ** For each expression, build an index key from the evaluation and
  1607         ** store it in the temporary table. If <expr> is a column, then use
  1608         ** that columns affinity when building index keys. If <expr> is not
  1609         ** a column, use numeric affinity.
  1610         */
  1611         int i;
  1612         ExprList *pList = pExpr->pList;
  1613         struct ExprList_item *pItem;
  1614 
  1615         if( !affinity ){
  1616           affinity = SQLITE_AFF_NONE;
  1617         }
  1618         keyInfo.aColl[0] = pExpr->pLeft->pColl;
  1619 
  1620         /* Loop through each expression in <exprlist>. */
  1621         for(i=pList->nExpr, pItem=pList->a; i>0; i--, pItem++){
  1622           Expr *pE2 = pItem->pExpr;
  1623 
  1624           /* If the expression is not constant then we will need to
  1625           ** disable the test that was generated above that makes sure
  1626           ** this code only executes once.  Because for a non-constant
  1627           ** expression we need to rerun this code each time.
  1628           */
  1629           if( testAddr>0 && !sqlite3ExprIsConstant(pE2) ){
  1630             sqlite3VdbeChangeToNoop(v, testAddr-1, 3);
  1631             testAddr = 0;
  1632           }
  1633 
  1634           /* Evaluate the expression and insert it into the temp table */
  1635           sqlite3ExprCode(pParse, pE2);
  1636           sqlite3VdbeOp3(v, OP_MakeRecord, 1, 0, &affinity, 1);
  1637           sqlite3VdbeAddOp(v, OP_IdxInsert, pExpr->iTable, 0);
  1638         }
  1639       }
  1640       sqlite3VdbeChangeP3(v, addr, (void *)&keyInfo, P3_KEYINFO);
  1641       break;
  1642     }
  1643 
  1644     case TK_EXISTS:
  1645     case TK_SELECT: {
  1646       /* This has to be a scalar SELECT.  Generate code to put the
  1647       ** value of this select in a memory cell and record the number
  1648       ** of the memory cell in iColumn.
  1649       */
  1650       static const Token one = { (u8*)"1", 0, 1 };
  1651       Select *pSel;
  1652       int iMem;
  1653       int sop;
  1654 
  1655       pExpr->iColumn = iMem = pParse->nMem++;
  1656       pSel = pExpr->pSelect;
  1657       if( pExpr->op==TK_SELECT ){
  1658         sop = SRT_Mem;
  1659         sqlite3VdbeAddOp(v, OP_MemNull, iMem, 0);
  1660         VdbeComment((v, "# Init subquery result"));
  1661       }else{
  1662         sop = SRT_Exists;
  1663         sqlite3VdbeAddOp(v, OP_MemInt, 0, iMem);
  1664         VdbeComment((v, "# Init EXISTS result"));
  1665       }
  1666       sqlite3ExprDelete(pSel->pLimit);
  1667       pSel->pLimit = sqlite3PExpr(pParse, TK_INTEGER, 0, 0, &one);
  1668       if( sqlite3Select(pParse, pSel, sop, iMem, 0, 0, 0, 0) ){
  1669         return;
  1670       }
  1671       break;
  1672     }
  1673   }
  1674 
  1675   if( testAddr ){
  1676     sqlite3VdbeJumpHere(v, testAddr);
  1677   }
  1678 
  1679   return;
  1680 }
  1681 #endif /* SQLITE_OMIT_SUBQUERY */
  1682 
  1683 /*
  1684 ** Generate an instruction that will put the integer describe by
  1685 ** text z[0..n-1] on the stack.
  1686 */
  1687 static void codeInteger(Vdbe *v, const char *z, int n){
  1688   assert( z || v==0 || sqlite3VdbeDb(v)->mallocFailed );
  1689   if( z ){
  1690     int i;
  1691     if( sqlite3GetInt32(z, &i) ){
  1692       sqlite3VdbeAddOp(v, OP_Integer, i, 0);
  1693     }else if( sqlite3FitsIn64Bits(z) ){
  1694       sqlite3VdbeOp3(v, OP_Int64, 0, 0, z, n);
  1695     }else{
  1696       sqlite3VdbeOp3(v, OP_Real, 0, 0, z, n);
  1697     }
  1698   }
  1699 }
  1700 
  1701 
  1702 /*
  1703 ** Generate code that will extract the iColumn-th column from
  1704 ** table pTab and push that column value on the stack.  There
  1705 ** is an open cursor to pTab in iTable.  If iColumn<0 then
  1706 ** code is generated that extracts the rowid.
  1707 */
  1708 void sqlite3ExprCodeGetColumn(Vdbe *v, Table *pTab, int iColumn, int iTable){
  1709   if( iColumn<0 ){
  1710     int op = (pTab && IsVirtual(pTab)) ? OP_VRowid : OP_Rowid;
  1711     sqlite3VdbeAddOp(v, op, iTable, 0);
  1712   }else if( pTab==0 ){
  1713     sqlite3VdbeAddOp(v, OP_Column, iTable, iColumn);
  1714   }else{
  1715     int op = IsVirtual(pTab) ? OP_VColumn : OP_Column;
  1716     sqlite3VdbeAddOp(v, op, iTable, iColumn);
  1717     sqlite3ColumnDefault(v, pTab, iColumn);
  1718 #ifndef SQLITE_OMIT_FLOATING_POINT
  1719     if( pTab->aCol[iColumn].affinity==SQLITE_AFF_REAL ){
  1720       sqlite3VdbeAddOp(v, OP_RealAffinity, 0, 0);
  1721     }
  1722 #endif
  1723   }
  1724 }
  1725 
  1726 /*
  1727 ** Generate code into the current Vdbe to evaluate the given
  1728 ** expression and leave the result on the top of stack.
  1729 **
  1730 ** This code depends on the fact that certain token values (ex: TK_EQ)
  1731 ** are the same as opcode values (ex: OP_Eq) that implement the corresponding
  1732 ** operation.  Special comments in vdbe.c and the mkopcodeh.awk script in
  1733 ** the make process cause these values to align.  Assert()s in the code
  1734 ** below verify that the numbers are aligned correctly.
  1735 */
  1736 void sqlite3ExprCode(Parse *pParse, Expr *pExpr){
  1737   Vdbe *v = pParse->pVdbe;
  1738   int op;
  1739   int stackChng = 1;    /* Amount of change to stack depth */
  1740 
  1741   if( v==0 ) return;
  1742   if( pExpr==0 ){
  1743     sqlite3VdbeAddOp(v, OP_Null, 0, 0);
  1744     return;
  1745   }
  1746   op = pExpr->op;
  1747   switch( op ){
  1748     case TK_AGG_COLUMN: {
  1749       AggInfo *pAggInfo = pExpr->pAggInfo;
  1750       struct AggInfo_col *pCol = &pAggInfo->aCol[pExpr->iAgg];
  1751       if( !pAggInfo->directMode ){
  1752         sqlite3VdbeAddOp(v, OP_MemLoad, pCol->iMem, 0);
  1753         break;
  1754       }else if( pAggInfo->useSortingIdx ){
  1755         sqlite3VdbeAddOp(v, OP_Column, pAggInfo->sortingIdx,
  1756                               pCol->iSorterColumn);
  1757         break;
  1758       }
  1759       /* Otherwise, fall thru into the TK_COLUMN case */
  1760     }
  1761     case TK_COLUMN: {
  1762       if( pExpr->iTable<0 ){
  1763         /* This only happens when coding check constraints */
  1764         assert( pParse->ckOffset>0 );
  1765         sqlite3VdbeAddOp(v, OP_Dup, pParse->ckOffset-pExpr->iColumn-1, 1);
  1766       }else{
  1767         sqlite3ExprCodeGetColumn(v, pExpr->pTab, pExpr->iColumn, pExpr->iTable);
  1768       }
  1769       break;
  1770     }
  1771     case TK_INTEGER: {
  1772       codeInteger(v, (char*)pExpr->token.z, pExpr->token.n);
  1773       break;
  1774     }
  1775     case TK_FLOAT:
  1776     case TK_STRING: {
  1777       assert( TK_FLOAT==OP_Real );
  1778       assert( TK_STRING==OP_String8 );
  1779       sqlite3DequoteExpr(pParse->db, pExpr);
  1780       sqlite3VdbeOp3(v, op, 0, 0, (char*)pExpr->token.z, pExpr->token.n);
  1781       break;
  1782     }
  1783     case TK_NULL: {
  1784       sqlite3VdbeAddOp(v, OP_Null, 0, 0);
  1785       break;
  1786     }
  1787 #ifndef SQLITE_OMIT_BLOB_LITERAL
  1788     case TK_BLOB: {
  1789       int n;
  1790       const char *z;
  1791       assert( TK_BLOB==OP_HexBlob );
  1792       n = pExpr->token.n - 3;
  1793       z = (char*)pExpr->token.z + 2;
  1794       assert( n>=0 );
  1795       if( n==0 ){
  1796         z = "";
  1797       }
  1798       sqlite3VdbeOp3(v, op, 0, 0, z, n);
  1799       break;
  1800     }
  1801 #endif
  1802     case TK_VARIABLE: {
  1803       sqlite3VdbeAddOp(v, OP_Variable, pExpr->iTable, 0);
  1804       if( pExpr->token.n>1 ){
  1805         sqlite3VdbeChangeP3(v, -1, (char*)pExpr->token.z, pExpr->token.n);
  1806       }
  1807       break;
  1808     }
  1809     case TK_REGISTER: {
  1810       sqlite3VdbeAddOp(v, OP_MemLoad, pExpr->iTable, 0);
  1811       break;
  1812     }
  1813 #ifndef SQLITE_OMIT_CAST
  1814     case TK_CAST: {
  1815       /* Expressions of the form:   CAST(pLeft AS token) */
  1816       int aff, to_op;
  1817       sqlite3ExprCode(pParse, pExpr->pLeft);
  1818       aff = sqlite3AffinityType(&pExpr->token);
  1819       to_op = aff - SQLITE_AFF_TEXT + OP_ToText;
  1820       assert( to_op==OP_ToText    || aff!=SQLITE_AFF_TEXT    );
  1821       assert( to_op==OP_ToBlob    || aff!=SQLITE_AFF_NONE    );
  1822       assert( to_op==OP_ToNumeric || aff!=SQLITE_AFF_NUMERIC );
  1823       assert( to_op==OP_ToInt     || aff!=SQLITE_AFF_INTEGER );
  1824       assert( to_op==OP_ToReal    || aff!=SQLITE_AFF_REAL    );
  1825       sqlite3VdbeAddOp(v, to_op, 0, 0);
  1826       stackChng = 0;
  1827       break;
  1828     }
  1829 #endif /* SQLITE_OMIT_CAST */
  1830     case TK_LT:
  1831     case TK_LE:
  1832     case TK_GT:
  1833     case TK_GE:
  1834     case TK_NE:
  1835     case TK_EQ: {
  1836       assert( TK_LT==OP_Lt );
  1837       assert( TK_LE==OP_Le );
  1838       assert( TK_GT==OP_Gt );
  1839       assert( TK_GE==OP_Ge );
  1840       assert( TK_EQ==OP_Eq );
  1841       assert( TK_NE==OP_Ne );
  1842       sqlite3ExprCode(pParse, pExpr->pLeft);
  1843       sqlite3ExprCode(pParse, pExpr->pRight);
  1844       codeCompare(pParse, pExpr->pLeft, pExpr->pRight, op, 0, 0);
  1845       stackChng = -1;
  1846       break;
  1847     }
  1848     case TK_AND:
  1849     case TK_OR:
  1850     case TK_PLUS:
  1851     case TK_STAR:
  1852     case TK_MINUS:
  1853     case TK_REM:
  1854     case TK_BITAND:
  1855     case TK_BITOR:
  1856     case TK_SLASH:
  1857     case TK_LSHIFT:
  1858     case TK_RSHIFT: 
  1859     case TK_CONCAT: {
  1860       assert( TK_AND==OP_And );
  1861       assert( TK_OR==OP_Or );
  1862       assert( TK_PLUS==OP_Add );
  1863       assert( TK_MINUS==OP_Subtract );
  1864       assert( TK_REM==OP_Remainder );
  1865       assert( TK_BITAND==OP_BitAnd );
  1866       assert( TK_BITOR==OP_BitOr );
  1867       assert( TK_SLASH==OP_Divide );
  1868       assert( TK_LSHIFT==OP_ShiftLeft );
  1869       assert( TK_RSHIFT==OP_ShiftRight );
  1870       assert( TK_CONCAT==OP_Concat );
  1871       sqlite3ExprCode(pParse, pExpr->pLeft);
  1872       sqlite3ExprCode(pParse, pExpr->pRight);
  1873       sqlite3VdbeAddOp(v, op, 0, 0);
  1874       stackChng = -1;
  1875       break;
  1876     }
  1877     case TK_UMINUS: {
  1878       Expr *pLeft = pExpr->pLeft;
  1879       assert( pLeft );
  1880       if( pLeft->op==TK_FLOAT || pLeft->op==TK_INTEGER ){
  1881         Token *p = &pLeft->token;
  1882         char *z = sqlite3MPrintf(pParse->db, "-%.*s", p->n, p->z);
  1883         if( pLeft->op==TK_FLOAT ){
  1884           sqlite3VdbeOp3(v, OP_Real, 0, 0, z, p->n+1);
  1885         }else{
  1886           codeInteger(v, z, p->n+1);
  1887         }
  1888         sqlite3_free(z);
  1889         break;
  1890       }
  1891       /* Fall through into TK_NOT */
  1892     }
  1893     case TK_BITNOT:
  1894     case TK_NOT: {
  1895       assert( TK_BITNOT==OP_BitNot );
  1896       assert( TK_NOT==OP_Not );
  1897       sqlite3ExprCode(pParse, pExpr->pLeft);
  1898       sqlite3VdbeAddOp(v, op, 0, 0);
  1899       stackChng = 0;
  1900       break;
  1901     }
  1902     case TK_ISNULL:
  1903     case TK_NOTNULL: {
  1904       int dest;
  1905       assert( TK_ISNULL==OP_IsNull );
  1906       assert( TK_NOTNULL==OP_NotNull );
  1907       sqlite3VdbeAddOp(v, OP_Integer, 1, 0);
  1908       sqlite3ExprCode(pParse, pExpr->pLeft);
  1909       dest = sqlite3VdbeCurrentAddr(v) + 2;
  1910       sqlite3VdbeAddOp(v, op, 1, dest);
  1911       sqlite3VdbeAddOp(v, OP_AddImm, -1, 0);
  1912       stackChng = 0;
  1913       break;
  1914     }
  1915     case TK_AGG_FUNCTION: {
  1916       AggInfo *pInfo = pExpr->pAggInfo;
  1917       if( pInfo==0 ){
  1918         sqlite3ErrorMsg(pParse, "misuse of aggregate: %T",
  1919             &pExpr->span);
  1920       }else{
  1921         sqlite3VdbeAddOp(v, OP_MemLoad, pInfo->aFunc[pExpr->iAgg].iMem, 0);
  1922       }
  1923       break;
  1924     }
  1925     case TK_CONST_FUNC:
  1926     case TK_FUNCTION: {
  1927       ExprList *pList = pExpr->pList;
  1928       int nExpr = pList ? pList->nExpr : 0;
  1929       FuncDef *pDef;
  1930       int nId;
  1931       const char *zId;
  1932       int constMask = 0;
  1933       int i;
  1934       sqlite3 *db = pParse->db;
  1935       u8 enc = ENC(db);
  1936       CollSeq *pColl = 0;
  1937 
  1938       zId = (char*)pExpr->token.z;
  1939       nId = pExpr->token.n;
  1940       pDef = sqlite3FindFunction(pParse->db, zId, nId, nExpr, enc, 0);
  1941       assert( pDef!=0 );
  1942       nExpr = sqlite3ExprCodeExprList(pParse, pList);
  1943 #ifndef SQLITE_OMIT_VIRTUALTABLE
  1944       /* Possibly overload the function if the first argument is
  1945       ** a virtual table column.
  1946       **
  1947       ** For infix functions (LIKE, GLOB, REGEXP, and MATCH) use the
  1948       ** second argument, not the first, as the argument to test to
  1949       ** see if it is a column in a virtual table.  This is done because
  1950       ** the left operand of infix functions (the operand we want to
  1951       ** control overloading) ends up as the second argument to the
  1952       ** function.  The expression "A glob B" is equivalent to 
  1953       ** "glob(B,A).  We want to use the A in "A glob B" to test
  1954       ** for function overloading.  But we use the B term in "glob(B,A)".
  1955       */
  1956       if( nExpr>=2 && (pExpr->flags & EP_InfixFunc) ){
  1957         pDef = sqlite3VtabOverloadFunction(db, pDef, nExpr, pList->a[1].pExpr);
  1958       }else if( nExpr>0 ){
  1959         pDef = sqlite3VtabOverloadFunction(db, pDef, nExpr, pList->a[0].pExpr);
  1960       }
  1961 #endif
  1962       for(i=0; i<nExpr && i<32; i++){
  1963         if( sqlite3ExprIsConstant(pList->a[i].pExpr) ){
  1964           constMask |= (1<<i);
  1965         }
  1966         if( pDef->needCollSeq && !pColl ){
  1967           pColl = sqlite3ExprCollSeq(pParse, pList->a[i].pExpr);
  1968         }
  1969       }
  1970       if( pDef->needCollSeq ){
  1971         if( !pColl ) pColl = pParse->db->pDfltColl; 
  1972         sqlite3VdbeOp3(v, OP_CollSeq, 0, 0, (char *)pColl, P3_COLLSEQ);
  1973       }
  1974       sqlite3VdbeOp3(v, OP_Function, constMask, nExpr, (char*)pDef, P3_FUNCDEF);
  1975       stackChng = 1-nExpr;
  1976       break;
  1977     }
  1978 #ifndef SQLITE_OMIT_SUBQUERY
  1979     case TK_EXISTS:
  1980     case TK_SELECT: {
  1981       if( pExpr->iColumn==0 ){
  1982         sqlite3CodeSubselect(pParse, pExpr);
  1983       }
  1984       sqlite3VdbeAddOp(v, OP_MemLoad, pExpr->iColumn, 0);
  1985       VdbeComment((v, "# load subquery result"));
  1986       break;
  1987     }
  1988     case TK_IN: {
  1989       int addr;
  1990       char affinity;
  1991       int ckOffset = pParse->ckOffset;
  1992       sqlite3CodeSubselect(pParse, pExpr);
  1993 
  1994       /* Figure out the affinity to use to create a key from the results
  1995       ** of the expression. affinityStr stores a static string suitable for
  1996       ** P3 of OP_MakeRecord.
  1997       */
  1998       affinity = comparisonAffinity(pExpr);
  1999 
  2000       sqlite3VdbeAddOp(v, OP_Integer, 1, 0);
  2001       pParse->ckOffset = (ckOffset ? (ckOffset+1) : 0);
  2002 
  2003       /* Code the <expr> from "<expr> IN (...)". The temporary table
  2004       ** pExpr->iTable contains the values that make up the (...) set.
  2005       */
  2006       sqlite3ExprCode(pParse, pExpr->pLeft);
  2007       addr = sqlite3VdbeCurrentAddr(v);
  2008       sqlite3VdbeAddOp(v, OP_NotNull, -1, addr+4);            /* addr + 0 */
  2009       sqlite3VdbeAddOp(v, OP_Pop, 2, 0);
  2010       sqlite3VdbeAddOp(v, OP_Null, 0, 0);
  2011       sqlite3VdbeAddOp(v, OP_Goto, 0, addr+7);
  2012       sqlite3VdbeOp3(v, OP_MakeRecord, 1, 0, &affinity, 1);   /* addr + 4 */
  2013       sqlite3VdbeAddOp(v, OP_Found, pExpr->iTable, addr+7);
  2014       sqlite3VdbeAddOp(v, OP_AddImm, -1, 0);                  /* addr + 6 */
  2015 
  2016       break;
  2017     }
  2018 #endif
  2019     case TK_BETWEEN: {
  2020       Expr *pLeft = pExpr->pLeft;
  2021       struct ExprList_item *pLItem = pExpr->pList->a;
  2022       Expr *pRight = pLItem->pExpr;
  2023       sqlite3ExprCode(pParse, pLeft);
  2024       sqlite3VdbeAddOp(v, OP_Dup, 0, 0);
  2025       sqlite3ExprCode(pParse, pRight);
  2026       codeCompare(pParse, pLeft, pRight, OP_Ge, 0, 0);
  2027       sqlite3VdbeAddOp(v, OP_Pull, 1, 0);
  2028       pLItem++;
  2029       pRight = pLItem->pExpr;
  2030       sqlite3ExprCode(pParse, pRight);
  2031       codeCompare(pParse, pLeft, pRight, OP_Le, 0, 0);
  2032       sqlite3VdbeAddOp(v, OP_And, 0, 0);
  2033       break;
  2034     }
  2035     case TK_UPLUS: {
  2036       sqlite3ExprCode(pParse, pExpr->pLeft);
  2037       stackChng = 0;
  2038       break;
  2039     }
  2040     case TK_CASE: {
  2041       int expr_end_label;
  2042       int jumpInst;
  2043       int nExpr;
  2044       int i;
  2045       ExprList *pEList;
  2046       struct ExprList_item *aListelem;
  2047 
  2048       assert(pExpr->pList);
  2049       assert((pExpr->pList->nExpr % 2) == 0);
  2050       assert(pExpr->pList->nExpr > 0);
  2051       pEList = pExpr->pList;
  2052       aListelem = pEList->a;
  2053       nExpr = pEList->nExpr;
  2054       expr_end_label = sqlite3VdbeMakeLabel(v);
  2055       if( pExpr->pLeft ){
  2056         sqlite3ExprCode(pParse, pExpr->pLeft);
  2057       }
  2058       for(i=0; i<nExpr; i=i+2){
  2059         sqlite3ExprCode(pParse, aListelem[i].pExpr);
  2060         if( pExpr->pLeft ){
  2061           sqlite3VdbeAddOp(v, OP_Dup, 1, 1);
  2062           jumpInst = codeCompare(pParse, pExpr->pLeft, aListelem[i].pExpr,
  2063                                  OP_Ne, 0, 1);
  2064           sqlite3VdbeAddOp(v, OP_Pop, 1, 0);
  2065         }else{
  2066           jumpInst = sqlite3VdbeAddOp(v, OP_IfNot, 1, 0);
  2067         }
  2068         sqlite3ExprCode(pParse, aListelem[i+1].pExpr);
  2069         sqlite3VdbeAddOp(v, OP_Goto, 0, expr_end_label);
  2070         sqlite3VdbeJumpHere(v, jumpInst);
  2071       }
  2072       if( pExpr->pLeft ){
  2073         sqlite3VdbeAddOp(v, OP_Pop, 1, 0);
  2074       }
  2075       if( pExpr->pRight ){
  2076         sqlite3ExprCode(pParse, pExpr->pRight);
  2077       }else{
  2078         sqlite3VdbeAddOp(v, OP_Null, 0, 0);
  2079       }
  2080       sqlite3VdbeResolveLabel(v, expr_end_label);
  2081       break;
  2082     }
  2083 #ifndef SQLITE_OMIT_TRIGGER
  2084     case TK_RAISE: {
  2085       if( !pParse->trigStack ){
  2086         sqlite3ErrorMsg(pParse,
  2087                        "RAISE() may only be used within a trigger-program");
  2088         return;
  2089       }
  2090       if( pExpr->iColumn!=OE_Ignore ){
  2091          assert( pExpr->iColumn==OE_Rollback ||
  2092                  pExpr->iColumn == OE_Abort ||
  2093                  pExpr->iColumn == OE_Fail );
  2094          sqlite3DequoteExpr(pParse->db, pExpr);
  2095          sqlite3VdbeOp3(v, OP_Halt, SQLITE_CONSTRAINT, pExpr->iColumn,
  2096                         (char*)pExpr->token.z, pExpr->token.n);
  2097       } else {
  2098          assert( pExpr->iColumn == OE_Ignore );
  2099          sqlite3VdbeAddOp(v, OP_ContextPop, 0, 0);
  2100          sqlite3VdbeAddOp(v, OP_Goto, 0, pParse->trigStack->ignoreJump);
  2101          VdbeComment((v, "# raise(IGNORE)"));
  2102       }
  2103       stackChng = 0;
  2104       break;
  2105     }
  2106 #endif
  2107   }
  2108 
  2109   if( pParse->ckOffset ){
  2110     pParse->ckOffset += stackChng;
  2111     assert( pParse->ckOffset );
  2112   }
  2113 }
  2114 
  2115 #ifndef SQLITE_OMIT_TRIGGER
  2116 /*
  2117 ** Generate code that evalutes the given expression and leaves the result
  2118 ** on the stack.  See also sqlite3ExprCode().
  2119 **
  2120 ** This routine might also cache the result and modify the pExpr tree
  2121 ** so that it will make use of the cached result on subsequent evaluations
  2122 ** rather than evaluate the whole expression again.  Trivial expressions are
  2123 ** not cached.  If the expression is cached, its result is stored in a 
  2124 ** memory location.
  2125 */
  2126 void sqlite3ExprCodeAndCache(Parse *pParse, Expr *pExpr){
  2127   Vdbe *v = pParse->pVdbe;
  2128   int iMem;
  2129   int addr1, addr2;
  2130   if( v==0 ) return;
  2131   addr1 = sqlite3VdbeCurrentAddr(v);
  2132   sqlite3ExprCode(pParse, pExpr);
  2133   addr2 = sqlite3VdbeCurrentAddr(v);
  2134   if( addr2>addr1+1 || sqlite3VdbeGetOp(v, addr1)->opcode==OP_Function ){
  2135     iMem = pExpr->iTable = pParse->nMem++;
  2136     sqlite3VdbeAddOp(v, OP_MemStore, iMem, 0);
  2137     pExpr->op = TK_REGISTER;
  2138   }
  2139 }
  2140 #endif
  2141 
  2142 /*
  2143 ** Generate code that pushes the value of every element of the given
  2144 ** expression list onto the stack.
  2145 **
  2146 ** Return the number of elements pushed onto the stack.
  2147 */
  2148 int sqlite3ExprCodeExprList(
  2149   Parse *pParse,     /* Parsing context */
  2150   ExprList *pList    /* The expression list to be coded */
  2151 ){
  2152   struct ExprList_item *pItem;
  2153   int i, n;
  2154   if( pList==0 ) return 0;
  2155   n = pList->nExpr;
  2156   for(pItem=pList->a, i=n; i>0; i--, pItem++){
  2157     sqlite3ExprCode(pParse, pItem->pExpr);
  2158   }
  2159   return n;
  2160 }
  2161 
  2162 /*
  2163 ** Generate code for a boolean expression such that a jump is made
  2164 ** to the label "dest" if the expression is true but execution
  2165 ** continues straight thru if the expression is false.
  2166 **
  2167 ** If the expression evaluates to NULL (neither true nor false), then
  2168 ** take the jump if the jumpIfNull flag is true.
  2169 **
  2170 ** This code depends on the fact that certain token values (ex: TK_EQ)
  2171 ** are the same as opcode values (ex: OP_Eq) that implement the corresponding
  2172 ** operation.  Special comments in vdbe.c and the mkopcodeh.awk script in
  2173 ** the make process cause these values to align.  Assert()s in the code
  2174 ** below verify that the numbers are aligned correctly.
  2175 */
  2176 void sqlite3ExprIfTrue(Parse *pParse, Expr *pExpr, int dest, int jumpIfNull){
  2177   Vdbe *v = pParse->pVdbe;
  2178   int op = 0;
  2179   int ckOffset = pParse->ckOffset;
  2180   if( v==0 || pExpr==0 ) return;
  2181   op = pExpr->op;
  2182   switch( op ){
  2183     case TK_AND: {
  2184       int d2 = sqlite3VdbeMakeLabel(v);
  2185       sqlite3ExprIfFalse(pParse, pExpr->pLeft, d2, !jumpIfNull);
  2186       sqlite3ExprIfTrue(pParse, pExpr->pRight, dest, jumpIfNull);
  2187       sqlite3VdbeResolveLabel(v, d2);
  2188       break;
  2189     }
  2190     case TK_OR: {
  2191       sqlite3ExprIfTrue(pParse, pExpr->pLeft, dest, jumpIfNull);
  2192       sqlite3ExprIfTrue(pParse, pExpr->pRight, dest, jumpIfNull);
  2193       break;
  2194     }
  2195     case TK_NOT: {
  2196       sqlite3ExprIfFalse(pParse, pExpr->pLeft, dest, jumpIfNull);
  2197       break;
  2198     }
  2199     case TK_LT:
  2200     case TK_LE:
  2201     case TK_GT:
  2202     case TK_GE:
  2203     case TK_NE:
  2204     case TK_EQ: {
  2205       assert( TK_LT==OP_Lt );
  2206       assert( TK_LE==OP_Le );
  2207       assert( TK_GT==OP_Gt );
  2208       assert( TK_GE==OP_Ge );
  2209       assert( TK_EQ==OP_Eq );
  2210       assert( TK_NE==OP_Ne );
  2211       sqlite3ExprCode(pParse, pExpr->pLeft);
  2212       sqlite3ExprCode(pParse, pExpr->pRight);
  2213       codeCompare(pParse, pExpr->pLeft, pExpr->pRight, op, dest, jumpIfNull);
  2214       break;
  2215     }
  2216     case TK_ISNULL:
  2217     case TK_NOTNULL: {
  2218       assert( TK_ISNULL==OP_IsNull );
  2219       assert( TK_NOTNULL==OP_NotNull );
  2220       sqlite3ExprCode(pParse, pExpr->pLeft);
  2221       sqlite3VdbeAddOp(v, op, 1, dest);
  2222       break;
  2223     }
  2224     case TK_BETWEEN: {
  2225       /* The expression "x BETWEEN y AND z" is implemented as:
  2226       **
  2227       ** 1 IF (x < y) GOTO 3
  2228       ** 2 IF (x <= z) GOTO <dest>
  2229       ** 3 ...
  2230       */
  2231       int addr;
  2232       Expr *pLeft = pExpr->pLeft;
  2233       Expr *pRight = pExpr->pList->a[0].pExpr;
  2234       sqlite3ExprCode(pParse, pLeft);
  2235       sqlite3VdbeAddOp(v, OP_Dup, 0, 0);
  2236       sqlite3ExprCode(pParse, pRight);
  2237       addr = codeCompare(pParse, pLeft, pRight, OP_Lt, 0, !jumpIfNull);
  2238 
  2239       pRight = pExpr->pList->a[1].pExpr;
  2240       sqlite3ExprCode(pParse, pRight);
  2241       codeCompare(pParse, pLeft, pRight, OP_Le, dest, jumpIfNull);
  2242 
  2243       sqlite3VdbeAddOp(v, OP_Integer, 0, 0);
  2244       sqlite3VdbeJumpHere(v, addr);
  2245       sqlite3VdbeAddOp(v, OP_Pop, 1, 0);
  2246       break;
  2247     }
  2248     default: {
  2249       sqlite3ExprCode(pParse, pExpr);
  2250       sqlite3VdbeAddOp(v, OP_If, jumpIfNull, dest);
  2251       break;
  2252     }
  2253   }
  2254   pParse->ckOffset = ckOffset;
  2255 }
  2256 
  2257 /*
  2258 ** Generate code for a boolean expression such that a jump is made
  2259 ** to the label "dest" if the expression is false but execution
  2260 ** continues straight thru if the expression is true.
  2261 **
  2262 ** If the expression evaluates to NULL (neither true nor false) then
  2263 ** jump if jumpIfNull is true or fall through if jumpIfNull is false.
  2264 */
  2265 void sqlite3ExprIfFalse(Parse *pParse, Expr *pExpr, int dest, int jumpIfNull){
  2266   Vdbe *v = pParse->pVdbe;
  2267   int op = 0;
  2268   int ckOffset = pParse->ckOffset;
  2269   if( v==0 || pExpr==0 ) return;
  2270 
  2271   /* The value of pExpr->op and op are related as follows:
  2272   **
  2273   **       pExpr->op            op
  2274   **       ---------          ----------
  2275   **       TK_ISNULL          OP_NotNull
  2276   **       TK_NOTNULL         OP_IsNull
  2277   **       TK_NE              OP_Eq
  2278   **       TK_EQ              OP_Ne
  2279   **       TK_GT              OP_Le
  2280   **       TK_LE              OP_Gt
  2281   **       TK_GE              OP_Lt
  2282   **       TK_LT              OP_Ge
  2283   **
  2284   ** For other values of pExpr->op, op is undefined and unused.
  2285   ** The value of TK_ and OP_ constants are arranged such that we
  2286   ** can compute the mapping above using the following expression.
  2287   ** Assert()s verify that the computation is correct.
  2288   */
  2289   op = ((pExpr->op+(TK_ISNULL&1))^1)-(TK_ISNULL&1);
  2290 
  2291   /* Verify correct alignment of TK_ and OP_ constants
  2292   */
  2293   assert( pExpr->op!=TK_ISNULL || op==OP_NotNull );
  2294   assert( pExpr->op!=TK_NOTNULL || op==OP_IsNull );
  2295   assert( pExpr->op!=TK_NE || op==OP_Eq );
  2296   assert( pExpr->op!=TK_EQ || op==OP_Ne );
  2297   assert( pExpr->op!=TK_LT || op==OP_Ge );
  2298   assert( pExpr->op!=TK_LE || op==OP_Gt );
  2299   assert( pExpr->op!=TK_GT || op==OP_Le );
  2300   assert( pExpr->op!=TK_GE || op==OP_Lt );
  2301 
  2302   switch( pExpr->op ){
  2303     case TK_AND: {
  2304       sqlite3ExprIfFalse(pParse, pExpr->pLeft, dest, jumpIfNull);
  2305       sqlite3ExprIfFalse(pParse, pExpr->pRight, dest, jumpIfNull);
  2306       break;
  2307     }
  2308     case TK_OR: {
  2309       int d2 = sqlite3VdbeMakeLabel(v);
  2310       sqlite3ExprIfTrue(pParse, pExpr->pLeft, d2, !jumpIfNull);
  2311       sqlite3ExprIfFalse(pParse, pExpr->pRight, dest, jumpIfNull);
  2312       sqlite3VdbeResolveLabel(v, d2);
  2313       break;
  2314     }
  2315     case TK_NOT: {
  2316       sqlite3ExprIfTrue(pParse, pExpr->pLeft, dest, jumpIfNull);
  2317       break;
  2318     }
  2319     case TK_LT:
  2320     case TK_LE:
  2321     case TK_GT:
  2322     case TK_GE:
  2323     case TK_NE:
  2324     case TK_EQ: {
  2325       sqlite3ExprCode(pParse, pExpr->pLeft);
  2326       sqlite3ExprCode(pParse, pExpr->pRight);
  2327       codeCompare(pParse, pExpr->pLeft, pExpr->pRight, op, dest, jumpIfNull);
  2328       break;
  2329     }
  2330     case TK_ISNULL:
  2331     case TK_NOTNULL: {
  2332       sqlite3ExprCode(pParse, pExpr->pLeft);
  2333       sqlite3VdbeAddOp(v, op, 1, dest);
  2334       break;
  2335     }
  2336     case TK_BETWEEN: {
  2337       /* The expression is "x BETWEEN y AND z". It is implemented as:
  2338       **
  2339       ** 1 IF (x >= y) GOTO 3
  2340       ** 2 GOTO <dest>
  2341       ** 3 IF (x > z) GOTO <dest>
  2342       */
  2343       int addr;
  2344       Expr *pLeft = pExpr->pLeft;
  2345       Expr *pRight = pExpr->pList->a[0].pExpr;
  2346       sqlite3ExprCode(pParse, pLeft);
  2347       sqlite3VdbeAddOp(v, OP_Dup, 0, 0);
  2348       sqlite3ExprCode(pParse, pRight);
  2349       addr = sqlite3VdbeCurrentAddr(v);
  2350       codeCompare(pParse, pLeft, pRight, OP_Ge, addr+3, !jumpIfNull);
  2351 
  2352       sqlite3VdbeAddOp(v, OP_Pop, 1, 0);
  2353       sqlite3VdbeAddOp(v, OP_Goto, 0, dest);
  2354       pRight = pExpr->pList->a[1].pExpr;
  2355       sqlite3ExprCode(pParse, pRight);
  2356       codeCompare(pParse, pLeft, pRight, OP_Gt, dest, jumpIfNull);
  2357       break;
  2358     }
  2359     default: {
  2360       sqlite3ExprCode(pParse, pExpr);
  2361       sqlite3VdbeAddOp(v, OP_IfNot, jumpIfNull, dest);
  2362       break;
  2363     }
  2364   }
  2365   pParse->ckOffset = ckOffset;
  2366 }
  2367 
  2368 /*
  2369 ** Do a deep comparison of two expression trees.  Return TRUE (non-zero)
  2370 ** if they are identical and return FALSE if they differ in any way.
  2371 **
  2372 ** Sometimes this routine will return FALSE even if the two expressions
  2373 ** really are equivalent.  If we cannot prove that the expressions are
  2374 ** identical, we return FALSE just to be safe.  So if this routine
  2375 ** returns false, then you do not really know for certain if the two
  2376 ** expressions are the same.  But if you get a TRUE return, then you
  2377 ** can be sure the expressions are the same.  In the places where
  2378 ** this routine is used, it does not hurt to get an extra FALSE - that
  2379 ** just might result in some slightly slower code.  But returning
  2380 ** an incorrect TRUE could lead to a malfunction.
  2381 */
  2382 int sqlite3ExprCompare(Expr *pA, Expr *pB){
  2383   int i;
  2384   if( pA==0||pB==0 ){
  2385     return pB==pA;
  2386   }
  2387   if( pA->op!=pB->op ) return 0;
  2388   if( (pA->flags & EP_Distinct)!=(pB->flags & EP_Distinct) ) return 0;
  2389   if( !sqlite3ExprCompare(pA->pLeft, pB->pLeft) ) return 0;
  2390   if( !sqlite3ExprCompare(pA->pRight, pB->pRight) ) return 0;
  2391   if( pA->pList ){
  2392     if( pB->pList==0 ) return 0;
  2393     if( pA->pList->nExpr!=pB->pList->nExpr ) return 0;
  2394     for(i=0; i<pA->pList->nExpr; i++){
  2395       if( !sqlite3ExprCompare(pA->pList->a[i].pExpr, pB->pList->a[i].pExpr) ){
  2396         return 0;
  2397       }
  2398     }
  2399   }else if( pB->pList ){
  2400     return 0;
  2401   }
  2402   if( pA->pSelect || pB->pSelect ) return 0;
  2403   if( pA->iTable!=pB->iTable || pA->iColumn!=pB->iColumn ) return 0;
  2404   if( pA->op!=TK_COLUMN && pA->token.z ){
  2405     if( pB->token.z==0 ) return 0;
  2406     if( pB->token.n!=pA->token.n ) return 0;
  2407     if( sqlite3StrNICmp((char*)pA->token.z,(char*)pB->token.z,pB->token.n)!=0 ){
  2408       return 0;
  2409     }
  2410   }
  2411   return 1;
  2412 }
  2413 
  2414 
  2415 /*
  2416 ** Add a new element to the pAggInfo->aCol[] array.  Return the index of
  2417 ** the new element.  Return a negative number if malloc fails.
  2418 */
  2419 static int addAggInfoColumn(sqlite3 *db, AggInfo *pInfo){
  2420   int i;
  2421   pInfo->aCol = sqlite3ArrayAllocate(
  2422        db,
  2423        pInfo->aCol,
  2424        sizeof(pInfo->aCol[0]),
  2425        3,
  2426        &pInfo->nColumn,
  2427        &pInfo->nColumnAlloc,
  2428        &i
  2429   );
  2430   return i;
  2431 }    
  2432 
  2433 /*
  2434 ** Add a new element to the pAggInfo->aFunc[] array.  Return the index of
  2435 ** the new element.  Return a negative number if malloc fails.
  2436 */
  2437 static int addAggInfoFunc(sqlite3 *db, AggInfo *pInfo){
  2438   int i;
  2439   pInfo->aFunc = sqlite3ArrayAllocate(
  2440        db, 
  2441        pInfo->aFunc,
  2442        sizeof(pInfo->aFunc[0]),
  2443        3,
  2444        &pInfo->nFunc,
  2445        &pInfo->nFuncAlloc,
  2446        &i
  2447   );
  2448   return i;
  2449 }    
  2450 
  2451 /*
  2452 ** This is an xFunc for walkExprTree() used to implement 
  2453 ** sqlite3ExprAnalyzeAggregates().  See sqlite3ExprAnalyzeAggregates
  2454 ** for additional information.
  2455 **
  2456 ** This routine analyzes the aggregate function at pExpr.
  2457 */
  2458 static int analyzeAggregate(void *pArg, Expr *pExpr){
  2459   int i;
  2460   NameContext *pNC = (NameContext *)pArg;
  2461   Parse *pParse = pNC->pParse;
  2462   SrcList *pSrcList = pNC->pSrcList;
  2463   AggInfo *pAggInfo = pNC->pAggInfo;
  2464 
  2465   switch( pExpr->op ){
  2466     case TK_AGG_COLUMN:
  2467     case TK_COLUMN: {
  2468       /* Check to see if the column is in one of the tables in the FROM
  2469       ** clause of the aggregate query */
  2470       if( pSrcList ){
  2471         struct SrcList_item *pItem = pSrcList->a;
  2472         for(i=0; i<pSrcList->nSrc; i++, pItem++){
  2473           struct AggInfo_col *pCol;
  2474           if( pExpr->iTable==pItem->iCursor ){
  2475             /* If we reach this point, it means that pExpr refers to a table
  2476             ** that is in the FROM clause of the aggregate query.  
  2477             **
  2478             ** Make an entry for the column in pAggInfo->aCol[] if there
  2479             ** is not an entry there already.
  2480             */
  2481             int k;
  2482             pCol = pAggInfo->aCol;
  2483             for(k=0; k<pAggInfo->nColumn; k++, pCol++){
  2484               if( pCol->iTable==pExpr->iTable &&
  2485                   pCol->iColumn==pExpr->iColumn ){
  2486                 break;
  2487               }
  2488             }
  2489             if( (k>=pAggInfo->nColumn)
  2490              && (k = addAggInfoColumn(pParse->db, pAggInfo))>=0 
  2491             ){
  2492               pCol = &pAggInfo->aCol[k];
  2493               pCol->pTab = pExpr->pTab;
  2494               pCol->iTable = pExpr->iTable;
  2495               pCol->iColumn = pExpr->iColumn;
  2496               pCol->iMem = pParse->nMem++;
  2497               pCol->iSorterColumn = -1;
  2498               pCol->pExpr = pExpr;
  2499               if( pAggInfo->pGroupBy ){
  2500                 int j, n;
  2501                 ExprList *pGB = pAggInfo->pGroupBy;
  2502                 struct ExprList_item *pTerm = pGB->a;
  2503                 n = pGB->nExpr;
  2504                 for(j=0; j<n; j++, pTerm++){
  2505                   Expr *pE = pTerm->pExpr;
  2506                   if( pE->op==TK_COLUMN && pE->iTable==pExpr->iTable &&
  2507                       pE->iColumn==pExpr->iColumn ){
  2508                     pCol->iSorterColumn = j;
  2509                     break;
  2510                   }
  2511                 }
  2512               }
  2513               if( pCol->iSorterColumn<0 ){
  2514                 pCol->iSorterColumn = pAggInfo->nSortingColumn++;
  2515               }
  2516             }
  2517             /* There is now an entry for pExpr in pAggInfo->aCol[] (either
  2518             ** because it was there before or because we just created it).
  2519             ** Convert the pExpr to be a TK_AGG_COLUMN referring to that
  2520             ** pAggInfo->aCol[] entry.
  2521             */
  2522             pExpr->pAggInfo = pAggInfo;
  2523             pExpr->op = TK_AGG_COLUMN;
  2524             pExpr->iAgg = k;
  2525             break;
  2526           } /* endif pExpr->iTable==pItem->iCursor */
  2527         } /* end loop over pSrcList */
  2528       }
  2529       return 1;
  2530     }
  2531     case TK_AGG_FUNCTION: {
  2532       /* The pNC->nDepth==0 test causes aggregate functions in subqueries
  2533       ** to be ignored */
  2534       if( pNC->nDepth==0 ){
  2535         /* Check to see if pExpr is a duplicate of another aggregate 
  2536         ** function that is already in the pAggInfo structure
  2537         */
  2538         struct AggInfo_func *pItem = pAggInfo->aFunc;
  2539         for(i=0; i<pAggInfo->nFunc; i++, pItem++){
  2540           if( sqlite3ExprCompare(pItem->pExpr, pExpr) ){
  2541             break;
  2542           }
  2543         }
  2544         if( i>=pAggInfo->nFunc ){
  2545           /* pExpr is original.  Make a new entry in pAggInfo->aFunc[]
  2546           */
  2547           u8 enc = ENC(pParse->db);
  2548           i = addAggInfoFunc(pParse->db, pAggInfo);
  2549           if( i>=0 ){
  2550             pItem = &pAggInfo->aFunc[i];
  2551             pItem->pExpr = pExpr;
  2552             pItem->iMem = pParse->nMem++;
  2553             pItem->pFunc = sqlite3FindFunction(pParse->db,
  2554                    (char*)pExpr->token.z, pExpr->token.n,
  2555                    pExpr->pList ? pExpr->pList->nExpr : 0, enc, 0);
  2556             if( pExpr->flags & EP_Distinct ){
  2557               pItem->iDistinct = pParse->nTab++;
  2558             }else{
  2559               pItem->iDistinct = -1;
  2560             }
  2561           }
  2562         }
  2563         /* Make pExpr point to the appropriate pAggInfo->aFunc[] entry
  2564         */
  2565         pExpr->iAgg = i;
  2566         pExpr->pAggInfo = pAggInfo;
  2567         return 1;
  2568       }
  2569     }
  2570   }
  2571 
  2572   /* Recursively walk subqueries looking for TK_COLUMN nodes that need
  2573   ** to be changed to TK_AGG_COLUMN.  But increment nDepth so that
  2574   ** TK_AGG_FUNCTION nodes in subqueries will be unchanged.
  2575   */
  2576   if( pExpr->pSelect ){
  2577     pNC->nDepth++;
  2578     walkSelectExpr(pExpr->pSelect, analyzeAggregate, pNC);
  2579     pNC->nDepth--;
  2580   }
  2581   return 0;
  2582 }
  2583 
  2584 /*
  2585 ** Analyze the given expression looking for aggregate functions and
  2586 ** for variables that need to be added to the pParse->aAgg[] array.
  2587 ** Make additional entries to the pParse->aAgg[] array as necessary.
  2588 **
  2589 ** This routine should only be called after the expression has been
  2590 ** analyzed by sqlite3ExprResolveNames().
  2591 **
  2592 ** If errors are seen, leave an error message in zErrMsg and return
  2593 ** the number of errors.
  2594 */
  2595 int sqlite3ExprAnalyzeAggregates(NameContext *pNC, Expr *pExpr){
  2596   int nErr = pNC->pParse->nErr;
  2597   walkExprTree(pExpr, analyzeAggregate, pNC);
  2598   return pNC->pParse->nErr - nErr;
  2599 }
  2600 
  2601 /*
  2602 ** Call sqlite3ExprAnalyzeAggregates() for every expression in an
  2603 ** expression list.  Return the number of errors.
  2604 **
  2605 ** If an error is found, the analysis is cut short.
  2606 */
  2607 int sqlite3ExprAnalyzeAggList(NameContext *pNC, ExprList *pList){
  2608   struct ExprList_item *pItem;
  2609   int i;
  2610   int nErr = 0;
  2611   if( pList ){
  2612     for(pItem=pList->a, i=0; nErr==0 && i<pList->nExpr; i++, pItem++){
  2613       nErr += sqlite3ExprAnalyzeAggregates(pNC, pItem->pExpr);
  2614     }
  2615   }
  2616   return nErr;
  2617 }