src/malloc.c

   1 /*
   2 ** 2001 September 15
   3 **
   4 ** The author disclaims copyright to this source code.  In place of
   5 ** a legal notice, here is a blessing:
   6 **
   7 **    May you do good and not evil.
   8 **    May you find forgiveness for yourself and forgive others.
   9 **    May you share freely, never taking more than you give.
  10 **
  11 *************************************************************************
  12 **
  13 ** Memory allocation functions used throughout sqlite.
  14 */
  15 #include "sqliteInt.h"
  16 #include <stdarg.h>
  17
  18 /*
  19 ** Attempt to release up to n bytes of non-essential memory currently
  20 ** held by SQLite. An example of non-essential memory is memory used to
  21 ** cache database pages that are not currently in use.
  22 */
  23 int sqlite3_release_memory(int n){
  24 #ifdef SQLITE_ENABLE_MEMORY_MANAGEMENT
  25   return sqlite3PcacheReleaseMemory(n);
  26 #else
  27   /* IMPLEMENTATION-OF: R-34391-24921 The sqlite3_release_memory() routine
  28   ** is a no-op returning zero if SQLite is not compiled with
  29   ** SQLITE_ENABLE_MEMORY_MANAGEMENT. */
  30   UNUSED_PARAMETER(n);
  31   return 0;
  32 #endif
  33 }
  34
  35 /*
  36 ** Default value of the hard heap limit.  0 means "no limit".
  37 */
  38 #ifndef SQLITE_MAX_MEMORY
  39 # define SQLITE_MAX_MEMORY 0
  40 #endif
  41
  42 /*
  43 ** State information local to the memory allocation subsystem.
  44 */
  45 static SQLITE_WSD struct Mem0Global {
  46   sqlite3_mutex *mutex;         /* Mutex to serialize access */
  47   sqlite3_int64 alarmThreshold; /* The soft heap limit */
  48   sqlite3_int64 hardLimit;      /* The hard upper bound on memory */
  49
  50   /*
  51   ** True if heap is nearly "full" where "full" is defined by the
  52   ** sqlite3_soft_heap_limit() setting.
  53   */
  54   int nearlyFull;
  55 } mem0 = { 0, SQLITE_MAX_MEMORY, SQLITE_MAX_MEMORY, 0 };
  56
  57 #define mem0 GLOBAL(struct Mem0Global, mem0)
  58
  59 /*
  60 ** Return the memory allocator mutex. sqlite3_status() needs it.
  61 */
  62 sqlite3_mutex *sqlite3MallocMutex(void){
  63   return mem0.mutex;
  64 }
  65
  66 #ifndef SQLITE_OMIT_DEPRECATED
  67 /*
  68 ** Deprecated external interface.  It used to set an alarm callback
  69 ** that was invoked when memory usage grew too large.  Now it is a
  70 ** no-op.
  71 */
  72 int sqlite3_memory_alarm(
  73   void(*xCallback)(void *pArg, sqlite3_int64 used,int N),
  74   void *pArg,
  75   sqlite3_int64 iThreshold
  76 ){
  77   (void)xCallback;
  78   (void)pArg;
  79   (void)iThreshold;
  80   return SQLITE_OK;
  81 }
  82 #endif
  83
  84 /*
  85 ** Set the soft heap-size limit for the library.  An argument of
  86 ** zero disables the limit.  A negative argument is a no-op used to
  87 ** obtain the return value.
  88 **
  89 ** The return value is the value of the heap limit just before this
  90 ** interface was called.
  91 **
  92 ** If the hard heap limit is enabled, then the soft heap limit cannot
  93 ** be disabled nor raised above the hard heap limit.
  94 */
  95 sqlite3_int64 sqlite3_soft_heap_limit64(sqlite3_int64 n){
  96   sqlite3_int64 priorLimit;
  97   sqlite3_int64 excess;
  98   sqlite3_int64 nUsed;
  99 #ifndef SQLITE_OMIT_AUTOINIT
 100   int rc = sqlite3_initialize();
 101   if( rc ) return -1;
 102 #endif
 103   sqlite3_mutex_enter(mem0.mutex);
 104   priorLimit = mem0.alarmThreshold;
 105   if( n<0 ){
 106     sqlite3_mutex_leave(mem0.mutex);
 107     return priorLimit;
 108   }
 109   if( mem0.hardLimit>0 && (n>mem0.hardLimit || n==0) ){
 110     n = mem0.hardLimit;
 111   }
 112   mem0.alarmThreshold = n;
 113   nUsed = sqlite3StatusValue(SQLITE_STATUS_MEMORY_USED);
 114   AtomicStore(&mem0.nearlyFull, n>0 && n<=nUsed);
 115   sqlite3_mutex_leave(mem0.mutex);
 116   excess = sqlite3_memory_used() - n;
 117   if( excess>0 ) sqlite3_release_memory((int)(excess & 0x7fffffff));
 118   return priorLimit;
 119 }
 120 void sqlite3_soft_heap_limit(int n){
 121   if( n<0 ) n = 0;
 122   sqlite3_soft_heap_limit64(n);
 123 }
 124
 125 /*
 126 ** Set the hard heap-size limit for the library. An argument of zero
 127 ** disables the hard heap limit.  A negative argument is a no-op used
 128 ** to obtain the return value without affecting the hard heap limit.
 129 **
 130 ** The return value is the value of the hard heap limit just prior to
 131 ** calling this interface.
 132 **
 133 ** Setting the hard heap limit will also activate the soft heap limit
 134 ** and constrain the soft heap limit to be no more than the hard heap
 135 ** limit.
 136 */
 137 sqlite3_int64 sqlite3_hard_heap_limit64(sqlite3_int64 n){
 138   sqlite3_int64 priorLimit;
 139 #ifndef SQLITE_OMIT_AUTOINIT
 140   int rc = sqlite3_initialize();
 141   if( rc ) return -1;
 142 #endif
 143   sqlite3_mutex_enter(mem0.mutex);
 144   priorLimit = mem0.hardLimit;
 145   if( n>=0 ){
 146     mem0.hardLimit = n;
 147     if( n<mem0.alarmThreshold || mem0.alarmThreshold==0 ){
 148       mem0.alarmThreshold = n;
 149     }
 150   }
 151   sqlite3_mutex_leave(mem0.mutex);
 152   return priorLimit;
 153 }
 154
 155
 156 /*
 157 ** Initialize the memory allocation subsystem.
 158 */
 159 int sqlite3MallocInit(void){
 160   int rc;
 161   if( sqlite3GlobalConfig.m.xMalloc==0 ){
 162     sqlite3MemSetDefault();
 163   }
 164   mem0.mutex = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MEM);
 165   if( sqlite3GlobalConfig.pPage==0 || sqlite3GlobalConfig.szPage<512
 166       || sqlite3GlobalConfig.nPage<=0 ){
 167     sqlite3GlobalConfig.pPage = 0;
 168     sqlite3GlobalConfig.szPage = 0;
 169   }
 170   rc = sqlite3GlobalConfig.m.xInit(sqlite3GlobalConfig.m.pAppData);
 171   if( rc!=SQLITE_OK ) memset(&mem0, 0, sizeof(mem0));
 172 /* BEGIN SQLCIPHER */
 173 #ifdef SQLITE_HAS_CODEC
 174   /* install wrapping functions for memory management
 175      that will wipe all memory allocated by SQLite
 176      when freed */
 177   if( rc==SQLITE_OK ) {
 178     extern void sqlcipher_init_memmethods(void);
 179     sqlcipher_init_memmethods();
 180   }
 181 #endif
 182 /* END SQLCIPHER */
 183   return rc;
 184 }
 185
 186 /*
 187 ** Return true if the heap is currently under memory pressure - in other
 188 ** words if the amount of heap used is close to the limit set by
 189 ** sqlite3_soft_heap_limit().
 190 */
 191 int sqlite3HeapNearlyFull(void){
 192   return AtomicLoad(&mem0.nearlyFull);
 193 }
 194
 195 /*
 196 ** Deinitialize the memory allocation subsystem.
 197 */
 198 void sqlite3MallocEnd(void){
 199   if( sqlite3GlobalConfig.m.xShutdown ){
 200     sqlite3GlobalConfig.m.xShutdown(sqlite3GlobalConfig.m.pAppData);
 201   }
 202   memset(&mem0, 0, sizeof(mem0));
 203 }
 204
 205 /*
 206 ** Return the amount of memory currently checked out.
 207 */
 208 sqlite3_int64 sqlite3_memory_used(void){
 209   sqlite3_int64 res, mx;
 210   sqlite3_status64(SQLITE_STATUS_MEMORY_USED, &res, &mx, 0);
 211   return res;
 212 }
 213
 214 /*
 215 ** Return the maximum amount of memory that has ever been
 216 ** checked out since either the beginning of this process
 217 ** or since the most recent reset.
 218 */
 219 sqlite3_int64 sqlite3_memory_highwater(int resetFlag){
 220   sqlite3_int64 res, mx;
 221   sqlite3_status64(SQLITE_STATUS_MEMORY_USED, &res, &mx, resetFlag);
 222   return mx;
 223 }
 224
 225 /*
 226 ** Trigger the alarm
 227 */
 228 static void sqlite3MallocAlarm(int nByte){
 229   if( mem0.alarmThreshold<=0 ) return;
 230   sqlite3_mutex_leave(mem0.mutex);
 231   sqlite3_release_memory(nByte);
 232   sqlite3_mutex_enter(mem0.mutex);
 233 }
 234
 235 #ifdef SQLITE_DEBUG
 236 /*
 237 ** This routine is called whenever an out-of-memory condition is seen,
 238 ** It's only purpose to to serve as a breakpoint for gdb or similar
 239 ** code debuggers when working on out-of-memory conditions, for example
 240 ** caused by PRAGMA hard_heap_limit=N.
 241 */
 242 static SQLITE_NOINLINE void test_oom_breakpoint(u64 n){
 243   static u64 nOomFault = 0;
 244   nOomFault += n;
 245   /* The assert() is never reached in a human lifetime.  It  is here mostly
 246   ** to prevent code optimizers from optimizing out this function. */
 247   assert( (nOomFault>>32) < 0xffffffff );
 248 }
 249 #else
 250 # define test_oom_breakpoint(X)   /* No-op for production builds */
 251 #endif
 252
 253 /*
 254 ** Do a memory allocation with statistics and alarms.  Assume the
 255 ** lock is already held.
 256 */
 257 static void mallocWithAlarm(int n, void **pp){
 258   void *p;
 259   int nFull;
 260   assert( sqlite3_mutex_held(mem0.mutex) );
 261   assert( n>0 );
 262
 263   /* In Firefox (circa 2017-02-08), xRoundup() is remapped to an internal
 264   ** implementation of malloc_good_size(), which must be called in debug
 265   ** mode and specifically when the DMD "Dark Matter Detector" is enabled
 266   ** or else a crash results.  Hence, do not attempt to optimize out the
 267   ** following xRoundup() call. */
 268   nFull = sqlite3GlobalConfig.m.xRoundup(n);
 269
 270   sqlite3StatusHighwater(SQLITE_STATUS_MALLOC_SIZE, n);
 271   if( mem0.alarmThreshold>0 ){
 272     sqlite3_int64 nUsed = sqlite3StatusValue(SQLITE_STATUS_MEMORY_USED);
 273     if( nUsed >= mem0.alarmThreshold - nFull ){
 274       AtomicStore(&mem0.nearlyFull, 1);
 275       sqlite3MallocAlarm(nFull);
 276       if( mem0.hardLimit ){
 277         nUsed = sqlite3StatusValue(SQLITE_STATUS_MEMORY_USED);
 278         if( nUsed >= mem0.hardLimit - nFull ){
 279           test_oom_breakpoint(1);
 280           *pp = 0;
 281           return;
 282         }
 283       }
 284     }else{
 285       AtomicStore(&mem0.nearlyFull, 0);
 286     }
 287   }
 288   p = sqlite3GlobalConfig.m.xMalloc(nFull);
 289 #ifdef SQLITE_ENABLE_MEMORY_MANAGEMENT
 290   if( p==0 && mem0.alarmThreshold>0 ){
 291     sqlite3MallocAlarm(nFull);
 292     p = sqlite3GlobalConfig.m.xMalloc(nFull);
 293   }
 294 #endif
 295   if( p ){
 296     nFull = sqlite3MallocSize(p);
 297     sqlite3StatusUp(SQLITE_STATUS_MEMORY_USED, nFull);
 298     sqlite3StatusUp(SQLITE_STATUS_MALLOC_COUNT, 1);
 299   }
 300   *pp = p;
 301 }
 302
 303 /*
 304 ** Maximum size of any single memory allocation.
 305 **
 306 ** This is not a limit on the total amount of memory used.  This is
 307 ** a limit on the size parameter to sqlite3_malloc() and sqlite3_realloc().
 308 **
 309 ** The upper bound is slightly less than 2GiB:  0x7ffffeff == 2,147,483,391
 310 ** This provides a 256-byte safety margin for defense against 32-bit
 311 ** signed integer overflow bugs when computing memory allocation sizes.
 312 ** Paranoid applications might want to reduce the maximum allocation size
 313 ** further for an even larger safety margin.  0x3fffffff or 0x0fffffff
 314 ** or even smaller would be reasonable upper bounds on the size of a memory
 315 ** allocations for most applications.
 316 */
 317 #ifndef SQLITE_MAX_ALLOCATION_SIZE
 318 # define SQLITE_MAX_ALLOCATION_SIZE  2147483391
 319 #endif
 320 #if SQLITE_MAX_ALLOCATION_SIZE>2147483391
 321 # error Maximum size for SQLITE_MAX_ALLOCATION_SIZE is 2147483391
 322 #endif
 323
 324 /*
 325 ** Allocate memory.  This routine is like sqlite3_malloc() except that it
 326 ** assumes the memory subsystem has already been initialized.
 327 */
 328 void *sqlite3Malloc(u64 n){
 329   void *p;
 330   if( n==0 || n>SQLITE_MAX_ALLOCATION_SIZE ){
 331     p = 0;
 332   }else if( sqlite3GlobalConfig.bMemstat ){
 333     sqlite3_mutex_enter(mem0.mutex);
 334     mallocWithAlarm((int)n, &p);
 335     sqlite3_mutex_leave(mem0.mutex);
 336   }else{
 337     p = sqlite3GlobalConfig.m.xMalloc((int)n);
 338   }
 339   assert( EIGHT_BYTE_ALIGNMENT(p) );  /* IMP: R-11148-40995 */
 340   return p;
 341 }
 342
 343 /*
 344 ** This version of the memory allocation is for use by the application.
 345 ** First make sure the memory subsystem is initialized, then do the
 346 ** allocation.
 347 */
 348 void *sqlite3_malloc(int n){
 349 #ifndef SQLITE_OMIT_AUTOINIT
 350   if( sqlite3_initialize() ) return 0;
 351 #endif
 352   return n<=0 ? 0 : sqlite3Malloc(n);
 353 }
 354 void *sqlite3_malloc64(sqlite3_uint64 n){
 355 #ifndef SQLITE_OMIT_AUTOINIT
 356   if( sqlite3_initialize() ) return 0;
 357 #endif
 358   return sqlite3Malloc(n);
 359 }
 360
 361 /*
 362 ** TRUE if p is a lookaside memory allocation from db
 363 */
 364 #ifndef SQLITE_OMIT_LOOKASIDE
 365 static int isLookaside(sqlite3 *db, const void *p){
 366   return SQLITE_WITHIN(p, db->lookaside.pStart, db->lookaside.pTrueEnd);
 367 }
 368 #else
 369 #define isLookaside(A,B) 0
 370 #endif
 371
 372 /*
 373 ** Return the size of a memory allocation previously obtained from
 374 ** sqlite3Malloc() or sqlite3_malloc().
 375 */
 376 int sqlite3MallocSize(const void *p){
 377   assert( sqlite3MemdebugHasType(p, MEMTYPE_HEAP) );
 378   return sqlite3GlobalConfig.m.xSize((void*)p);
 379 }
 380 static int lookasideMallocSize(sqlite3 *db, const void *p){
 381 #ifndef SQLITE_OMIT_TWOSIZE_LOOKASIDE
 382   return p<db->lookaside.pMiddle ? db->lookaside.szTrue : LOOKASIDE_SMALL;
 383 #else
 384   return db->lookaside.szTrue;
 385 #endif
 386 }
 387 int sqlite3DbMallocSize(sqlite3 *db, const void *p){
 388   assert( p!=0 );
 389 #ifdef SQLITE_DEBUG
 390   if( db==0 ){
 391     assert( sqlite3MemdebugNoType(p, (u8)~MEMTYPE_HEAP) );
 392     assert( sqlite3MemdebugHasType(p, MEMTYPE_HEAP) );
 393   }else if( !isLookaside(db,p) ){
 394     assert( sqlite3MemdebugHasType(p, (MEMTYPE_LOOKASIDE|MEMTYPE_HEAP)) );
 395     assert( sqlite3MemdebugNoType(p, (u8)~(MEMTYPE_LOOKASIDE|MEMTYPE_HEAP)) );
 396   }
 397 #endif
 398   if( db ){
 399     if( ((uptr)p)<(uptr)(db->lookaside.pTrueEnd) ){
 400 #ifndef SQLITE_OMIT_TWOSIZE_LOOKASIDE
 401       if( ((uptr)p)>=(uptr)(db->lookaside.pMiddle) ){
 402         assert( sqlite3_mutex_held(db->mutex) );
 403         return LOOKASIDE_SMALL;
 404       }
 405 #endif
 406       if( ((uptr)p)>=(uptr)(db->lookaside.pStart) ){
 407         assert( sqlite3_mutex_held(db->mutex) );
 408         return db->lookaside.szTrue;
 409       }
 410     }
 411   }
 412   return sqlite3GlobalConfig.m.xSize((void*)p);
 413 }
 414 sqlite3_uint64 sqlite3_msize(void *p){
 415   assert( sqlite3MemdebugNoType(p, (u8)~MEMTYPE_HEAP) );
 416   assert( sqlite3MemdebugHasType(p, MEMTYPE_HEAP) );
 417   return p ? sqlite3GlobalConfig.m.xSize(p) : 0;
 418 }
 419
 420 /*
 421 ** Free memory previously obtained from sqlite3Malloc().
 422 */
 423 void sqlite3_free(void *p){
 424   if( p==0 ) return;  /* IMP: R-49053-54554 */
 425   assert( sqlite3MemdebugHasType(p, MEMTYPE_HEAP) );
 426   assert( sqlite3MemdebugNoType(p, (u8)~MEMTYPE_HEAP) );
 427   if( sqlite3GlobalConfig.bMemstat ){
 428     sqlite3_mutex_enter(mem0.mutex);
 429     sqlite3StatusDown(SQLITE_STATUS_MEMORY_USED, sqlite3MallocSize(p));
 430     sqlite3StatusDown(SQLITE_STATUS_MALLOC_COUNT, 1);
 431     sqlite3GlobalConfig.m.xFree(p);
 432     sqlite3_mutex_leave(mem0.mutex);
 433   }else{
 434     sqlite3GlobalConfig.m.xFree(p);
 435   }
 436 }
 437
 438 /*
 439 ** Add the size of memory allocation "p" to the count in
 440 ** *db->pnBytesFreed.
 441 */
 442 static SQLITE_NOINLINE void measureAllocationSize(sqlite3 *db, void *p){
 443   *db->pnBytesFreed += sqlite3DbMallocSize(db,p);
 444 }
 445
 446 /*
 447 ** Free memory that might be associated with a particular database
 448 ** connection.  Calling sqlite3DbFree(D,X) for X==0 is a harmless no-op.
 449 ** The sqlite3DbFreeNN(D,X) version requires that X be non-NULL.
 450 */
 451 void sqlite3DbFreeNN(sqlite3 *db, void *p){
 452   assert( db==0 || sqlite3_mutex_held(db->mutex) );
 453   assert( p!=0 );
 454   if( db ){
 455     if( ((uptr)p)<(uptr)(db->lookaside.pEnd) ){
 456 #ifndef SQLITE_OMIT_TWOSIZE_LOOKASIDE
 457       if( ((uptr)p)>=(uptr)(db->lookaside.pMiddle) ){
 458         LookasideSlot *pBuf = (LookasideSlot*)p;
 459         assert( db->pnBytesFreed==0 );
 460 #ifdef SQLITE_DEBUG
 461         memset(p, 0xaa, LOOKASIDE_SMALL);  /* Trash freed content */
 462 #endif
 463         pBuf->pNext = db->lookaside.pSmallFree;
 464         db->lookaside.pSmallFree = pBuf;
 465         return;
 466       }
 467 #endif /* SQLITE_OMIT_TWOSIZE_LOOKASIDE */
 468       if( ((uptr)p)>=(uptr)(db->lookaside.pStart) ){
 469         LookasideSlot *pBuf = (LookasideSlot*)p;
 470         assert( db->pnBytesFreed==0 );
 471 #ifdef SQLITE_DEBUG
 472         memset(p, 0xaa, db->lookaside.szTrue);  /* Trash freed content */
 473 #endif
 474         pBuf->pNext = db->lookaside.pFree;
 475         db->lookaside.pFree = pBuf;
 476         return;
 477       }
 478     }
 479     if( db->pnBytesFreed ){
 480       measureAllocationSize(db, p);
 481       return;
 482     }
 483   }
 484   assert( sqlite3MemdebugHasType(p, (MEMTYPE_LOOKASIDE|MEMTYPE_HEAP)) );
 485   assert( sqlite3MemdebugNoType(p, (u8)~(MEMTYPE_LOOKASIDE|MEMTYPE_HEAP)) );
 486   assert( db!=0 || sqlite3MemdebugNoType(p, MEMTYPE_LOOKASIDE) );
 487   sqlite3MemdebugSetType(p, MEMTYPE_HEAP);
 488   sqlite3_free(p);
 489 }
 490 void sqlite3DbNNFreeNN(sqlite3 *db, void *p){
 491   assert( db!=0 );
 492   assert( sqlite3_mutex_held(db->mutex) );
 493   assert( p!=0 );
 494   if( ((uptr)p)<(uptr)(db->lookaside.pEnd) ){
 495 #ifndef SQLITE_OMIT_TWOSIZE_LOOKASIDE
 496     if( ((uptr)p)>=(uptr)(db->lookaside.pMiddle) ){
 497       LookasideSlot *pBuf = (LookasideSlot*)p;
 498       assert( db->pnBytesFreed==0 );
 499 #ifdef SQLITE_DEBUG
 500       memset(p, 0xaa, LOOKASIDE_SMALL);  /* Trash freed content */
 501 #endif
 502       pBuf->pNext = db->lookaside.pSmallFree;
 503       db->lookaside.pSmallFree = pBuf;
 504       return;
 505     }
 506 #endif /* SQLITE_OMIT_TWOSIZE_LOOKASIDE */
 507     if( ((uptr)p)>=(uptr)(db->lookaside.pStart) ){
 508       LookasideSlot *pBuf = (LookasideSlot*)p;
 509       assert( db->pnBytesFreed==0 );
 510 #ifdef SQLITE_DEBUG
 511       memset(p, 0xaa, db->lookaside.szTrue);  /* Trash freed content */
 512 #endif
 513       pBuf->pNext = db->lookaside.pFree;
 514       db->lookaside.pFree = pBuf;
 515       return;
 516     }
 517   }
 518   if( db->pnBytesFreed ){
 519     measureAllocationSize(db, p);
 520     return;
 521   }
 522   assert( sqlite3MemdebugHasType(p, (MEMTYPE_LOOKASIDE|MEMTYPE_HEAP)) );
 523   assert( sqlite3MemdebugNoType(p, (u8)~(MEMTYPE_LOOKASIDE|MEMTYPE_HEAP)) );
 524   sqlite3MemdebugSetType(p, MEMTYPE_HEAP);
 525   sqlite3_free(p);
 526 }
 527 void sqlite3DbFree(sqlite3 *db, void *p){
 528   assert( db==0 || sqlite3_mutex_held(db->mutex) );
 529   if( p ) sqlite3DbFreeNN(db, p);
 530 }
 531
 532 /*
 533 ** Change the size of an existing memory allocation
 534 */
 535 void *sqlite3Realloc(void *pOld, u64 nBytes){
 536   int nOld, nNew, nDiff;
 537   void *pNew;
 538   assert( sqlite3MemdebugHasType(pOld, MEMTYPE_HEAP) );
 539   assert( sqlite3MemdebugNoType(pOld, (u8)~MEMTYPE_HEAP) );
 540   if( pOld==0 ){
 541     return sqlite3Malloc(nBytes); /* IMP: R-04300-56712 */
 542   }
 543   if( nBytes==0 ){
 544     sqlite3_free(pOld); /* IMP: R-26507-47431 */
 545     return 0;
 546   }
 547   if( nBytes>=0x7fffff00 ){
 548     /* The 0x7ffff00 limit term is explained in comments on sqlite3Malloc() */
 549     return 0;
 550   }
 551   nOld = sqlite3MallocSize(pOld);
 552   /* IMPLEMENTATION-OF: R-46199-30249 SQLite guarantees that the second
 553   ** argument to xRealloc is always a value returned by a prior call to
 554   ** xRoundup. */
 555   nNew = sqlite3GlobalConfig.m.xRoundup((int)nBytes);
 556   if( nOld==nNew ){
 557     pNew = pOld;
 558   }else if( sqlite3GlobalConfig.bMemstat ){
 559     sqlite3_int64 nUsed;
 560     sqlite3_mutex_enter(mem0.mutex);
 561     sqlite3StatusHighwater(SQLITE_STATUS_MALLOC_SIZE, (int)nBytes);
 562     nDiff = nNew - nOld;
 563     if( nDiff>0 && (nUsed = sqlite3StatusValue(SQLITE_STATUS_MEMORY_USED)) >=
 564           mem0.alarmThreshold-nDiff ){
 565       sqlite3MallocAlarm(nDiff);
 566       if( mem0.hardLimit>0 && nUsed >= mem0.hardLimit - nDiff ){
 567         sqlite3_mutex_leave(mem0.mutex);
 568         test_oom_breakpoint(1);
 569         return 0;
 570       }
 571     }
 572     pNew = sqlite3GlobalConfig.m.xRealloc(pOld, nNew);
 573 #ifdef SQLITE_ENABLE_MEMORY_MANAGEMENT
 574     if( pNew==0 && mem0.alarmThreshold>0 ){
 575       sqlite3MallocAlarm((int)nBytes);
 576       pNew = sqlite3GlobalConfig.m.xRealloc(pOld, nNew);
 577     }
 578 #endif
 579     if( pNew ){
 580       nNew = sqlite3MallocSize(pNew);
 581       sqlite3StatusUp(SQLITE_STATUS_MEMORY_USED, nNew-nOld);
 582     }
 583     sqlite3_mutex_leave(mem0.mutex);
 584   }else{
 585     pNew = sqlite3GlobalConfig.m.xRealloc(pOld, nNew);
 586   }
 587   assert( EIGHT_BYTE_ALIGNMENT(pNew) ); /* IMP: R-11148-40995 */
 588   return pNew;
 589 }
 590
 591 /*
 592 ** The public interface to sqlite3Realloc.  Make sure that the memory
 593 ** subsystem is initialized prior to invoking sqliteRealloc.
 594 */
 595 void *sqlite3_realloc(void *pOld, int n){
 596 #ifndef SQLITE_OMIT_AUTOINIT
 597   if( sqlite3_initialize() ) return 0;
 598 #endif
 599   if( n<0 ) n = 0;  /* IMP: R-26507-47431 */
 600   return sqlite3Realloc(pOld, n);
 601 }
 602 void *sqlite3_realloc64(void *pOld, sqlite3_uint64 n){
 603 #ifndef SQLITE_OMIT_AUTOINIT
 604   if( sqlite3_initialize() ) return 0;
 605 #endif
 606   return sqlite3Realloc(pOld, n);
 607 }
 608
 609
 610 /*
 611 ** Allocate and zero memory.
 612 */
 613 void *sqlite3MallocZero(u64 n){
 614   void *p = sqlite3Malloc(n);
 615   if( p ){
 616     memset(p, 0, (size_t)n);
 617   }
 618   return p;
 619 }
 620
 621 /*
 622 ** Allocate and zero memory.  If the allocation fails, make
 623 ** the mallocFailed flag in the connection pointer.
 624 */
 625 void *sqlite3DbMallocZero(sqlite3 *db, u64 n){
 626   void *p;
 627   testcase( db==0 );
 628   p = sqlite3DbMallocRaw(db, n);
 629   if( p ) memset(p, 0, (size_t)n);
 630   return p;
 631 }
 632
 633
 634 /* Finish the work of sqlite3DbMallocRawNN for the unusual and
 635 ** slower case when the allocation cannot be fulfilled using lookaside.
 636 */
 637 static SQLITE_NOINLINE void *dbMallocRawFinish(sqlite3 *db, u64 n){
 638   void *p;
 639   assert( db!=0 );
 640   p = sqlite3Malloc(n);
 641   if( !p ) sqlite3OomFault(db);
 642   sqlite3MemdebugSetType(p,
 643          (db->lookaside.bDisable==0) ? MEMTYPE_LOOKASIDE : MEMTYPE_HEAP);
 644   return p;
 645 }
 646
 647 /*
 648 ** Allocate memory, either lookaside (if possible) or heap.
 649 ** If the allocation fails, set the mallocFailed flag in
 650 ** the connection pointer.
 651 **
 652 ** If db!=0 and db->mallocFailed is true (indicating a prior malloc
 653 ** failure on the same database connection) then always return 0.
 654 ** Hence for a particular database connection, once malloc starts
 655 ** failing, it fails consistently until mallocFailed is reset.
 656 ** This is an important assumption.  There are many places in the
 657 ** code that do things like this:
 658 **
 659 **         int *a = (int*)sqlite3DbMallocRaw(db, 100);
 660 **         int *b = (int*)sqlite3DbMallocRaw(db, 200);
 661 **         if( b ) a[10] = 9;
 662 **
 663 ** In other words, if a subsequent malloc (ex: "b") worked, it is assumed
 664 ** that all prior mallocs (ex: "a") worked too.
 665 **
 666 ** The sqlite3MallocRawNN() variant guarantees that the "db" parameter is
 667 ** not a NULL pointer.
 668 */
 669 void *sqlite3DbMallocRaw(sqlite3 *db, u64 n){
 670   void *p;
 671   if( db ) return sqlite3DbMallocRawNN(db, n);
 672   p = sqlite3Malloc(n);
 673   sqlite3MemdebugSetType(p, MEMTYPE_HEAP);
 674   return p;
 675 }
 676 void *sqlite3DbMallocRawNN(sqlite3 *db, u64 n){
 677 #ifndef SQLITE_OMIT_LOOKASIDE
 678   LookasideSlot *pBuf;
 679   assert( db!=0 );
 680   assert( sqlite3_mutex_held(db->mutex) );
 681   assert( db->pnBytesFreed==0 );
 682   if( n>db->lookaside.sz ){
 683     if( !db->lookaside.bDisable ){
 684       db->lookaside.anStat[1]++;
 685     }else if( db->mallocFailed ){
 686       return 0;
 687     }
 688     return dbMallocRawFinish(db, n);
 689   }
 690 #ifndef SQLITE_OMIT_TWOSIZE_LOOKASIDE
 691   if( n<=LOOKASIDE_SMALL ){
 692     if( (pBuf = db->lookaside.pSmallFree)!=0 ){
 693       db->lookaside.pSmallFree = pBuf->pNext;
 694       db->lookaside.anStat[0]++;
 695       return (void*)pBuf;
 696     }else if( (pBuf = db->lookaside.pSmallInit)!=0 ){
 697       db->lookaside.pSmallInit = pBuf->pNext;
 698       db->lookaside.anStat[0]++;
 699       return (void*)pBuf;
 700     }
 701   }
 702 #endif
 703   if( (pBuf = db->lookaside.pFree)!=0 ){
 704     db->lookaside.pFree = pBuf->pNext;
 705     db->lookaside.anStat[0]++;
 706     return (void*)pBuf;
 707   }else if( (pBuf = db->lookaside.pInit)!=0 ){
 708     db->lookaside.pInit = pBuf->pNext;
 709     db->lookaside.anStat[0]++;
 710     return (void*)pBuf;
 711   }else{
 712     db->lookaside.anStat[2]++;
 713   }
 714 #else
 715   assert( db!=0 );
 716   assert( sqlite3_mutex_held(db->mutex) );
 717   assert( db->pnBytesFreed==0 );
 718   if( db->mallocFailed ){
 719     return 0;
 720   }
 721 #endif
 722   return dbMallocRawFinish(db, n);
 723 }
 724
 725 /* Forward declaration */
 726 static SQLITE_NOINLINE void *dbReallocFinish(sqlite3 *db, void *p, u64 n);
 727
 728 /*
 729 ** Resize the block of memory pointed to by p to n bytes. If the
 730 ** resize fails, set the mallocFailed flag in the connection object.
 731 */
 732 void *sqlite3DbRealloc(sqlite3 *db, void *p, u64 n){
 733   assert( db!=0 );
 734   if( p==0 ) return sqlite3DbMallocRawNN(db, n);
 735   assert( sqlite3_mutex_held(db->mutex) );
 736   if( ((uptr)p)<(uptr)db->lookaside.pEnd ){
 737 #ifndef SQLITE_OMIT_TWOSIZE_LOOKASIDE
 738     if( ((uptr)p)>=(uptr)db->lookaside.pMiddle ){
 739       if( n<=LOOKASIDE_SMALL ) return p;
 740     }else
 741 #endif
 742     if( ((uptr)p)>=(uptr)db->lookaside.pStart ){
 743       if( n<=db->lookaside.szTrue ) return p;
 744     }
 745   }
 746   return dbReallocFinish(db, p, n);
 747 }
 748 static SQLITE_NOINLINE void *dbReallocFinish(sqlite3 *db, void *p, u64 n){
 749   void *pNew = 0;
 750   assert( db!=0 );
 751   assert( p!=0 );
 752   if( db->mallocFailed==0 ){
 753     if( isLookaside(db, p) ){
 754       pNew = sqlite3DbMallocRawNN(db, n);
 755       if( pNew ){
 756         memcpy(pNew, p, lookasideMallocSize(db, p));
 757         sqlite3DbFree(db, p);
 758       }
 759     }else{
 760       assert( sqlite3MemdebugHasType(p, (MEMTYPE_LOOKASIDE|MEMTYPE_HEAP)) );
 761       assert( sqlite3MemdebugNoType(p, (u8)~(MEMTYPE_LOOKASIDE|MEMTYPE_HEAP)) );
 762       sqlite3MemdebugSetType(p, MEMTYPE_HEAP);
 763       pNew = sqlite3Realloc(p, n);
 764       if( !pNew ){
 765         sqlite3OomFault(db);
 766       }
 767       sqlite3MemdebugSetType(pNew,
 768             (db->lookaside.bDisable==0 ? MEMTYPE_LOOKASIDE : MEMTYPE_HEAP));
 769     }
 770   }
 771   return pNew;
 772 }
 773
 774 /*
 775 ** Attempt to reallocate p.  If the reallocation fails, then free p
 776 ** and set the mallocFailed flag in the database connection.
 777 */
 778 void *sqlite3DbReallocOrFree(sqlite3 *db, void *p, u64 n){
 779   void *pNew;
 780   pNew = sqlite3DbRealloc(db, p, n);
 781   if( !pNew ){
 782     sqlite3DbFree(db, p);
 783   }
 784   return pNew;
 785 }
 786
 787 /*
 788 ** Make a copy of a string in memory obtained from sqliteMalloc(). These
 789 ** functions call sqlite3MallocRaw() directly instead of sqliteMalloc(). This
 790 ** is because when memory debugging is turned on, these two functions are
 791 ** called via macros that record the current file and line number in the
 792 ** ThreadData structure.
 793 */
 794 char *sqlite3DbStrDup(sqlite3 *db, const char *z){
 795   char *zNew;
 796   size_t n;
 797   if( z==0 ){
 798     return 0;
 799   }
 800   n = strlen(z) + 1;
 801   zNew = sqlite3DbMallocRaw(db, n);
 802   if( zNew ){
 803     memcpy(zNew, z, n);
 804   }
 805   return zNew;
 806 }
 807 char *sqlite3DbStrNDup(sqlite3 *db, const char *z, u64 n){
 808   char *zNew;
 809   assert( db!=0 );
 810   assert( z!=0 || n==0 );
 811   assert( (n&0x7fffffff)==n );
 812   zNew = z ? sqlite3DbMallocRawNN(db, n+1) : 0;
 813   if( zNew ){
 814     memcpy(zNew, z, (size_t)n);
 815     zNew[n] = 0;
 816   }
 817   return zNew;
 818 }
 819
 820 /*
 821 ** The text between zStart and zEnd represents a phrase within a larger
 822 ** SQL statement.  Make a copy of this phrase in space obtained form
 823 ** sqlite3DbMalloc().  Omit leading and trailing whitespace.
 824 */
 825 char *sqlite3DbSpanDup(sqlite3 *db, const char *zStart, const char *zEnd){
 826   int n;
 827 #ifdef SQLITE_DEBUG
 828   /* Because of the way the parser works, the span is guaranteed to contain
 829   ** at least one non-space character */
 830   for(n=0; sqlite3Isspace(zStart[n]); n++){ assert( &zStart[n]<zEnd ); }
 831 #endif
 832   while( sqlite3Isspace(zStart[0]) ) zStart++;
 833   n = (int)(zEnd - zStart);
 834   while( sqlite3Isspace(zStart[n-1]) ) n--;
 835   return sqlite3DbStrNDup(db, zStart, n);
 836 }
 837
 838 /*
 839 ** Free any prior content in *pz and replace it with a copy of zNew.
 840 */
 841 void sqlite3SetString(char **pz, sqlite3 *db, const char *zNew){
 842   char *z = sqlite3DbStrDup(db, zNew);
 843   sqlite3DbFree(db, *pz);
 844   *pz = z;
 845 }
 846
 847 /*
 848 ** Call this routine to record the fact that an OOM (out-of-memory) error
 849 ** has happened.  This routine will set db->mallocFailed, and also
 850 ** temporarily disable the lookaside memory allocator and interrupt
 851 ** any running VDBEs.
 852 **
 853 ** Always return a NULL pointer so that this routine can be invoked using
 854 **
 855 **      return sqlite3OomFault(db);
 856 **
 857 ** and thereby avoid unnecessary stack frame allocations for the overwhelmingly
 858 ** common case where no OOM occurs.
 859 */
 860 void *sqlite3OomFault(sqlite3 *db){
 861   if( db->mallocFailed==0 && db->bBenignMalloc==0 ){
 862     db->mallocFailed = 1;
 863     if( db->nVdbeExec>0 ){
 864       AtomicStore(&db->u1.isInterrupted, 1);
 865     }
 866     DisableLookaside;
 867     if( db->pParse ){
 868       Parse *pParse;
 869       sqlite3ErrorMsg(db->pParse, "out of memory");
 870       db->pParse->rc = SQLITE_NOMEM_BKPT;
 871       for(pParse=db->pParse->pOuterParse; pParse; pParse = pParse->pOuterParse){
 872         pParse->nErr++;
 873         pParse->rc = SQLITE_NOMEM;
 874       }
 875     }
 876   }
 877   return 0;
 878 }
 879
 880 /*
 881 ** This routine reactivates the memory allocator and clears the
 882 ** db->mallocFailed flag as necessary.
 883 **
 884 ** The memory allocator is not restarted if there are running
 885 ** VDBEs.
 886 */
 887 void sqlite3OomClear(sqlite3 *db){
 888   if( db->mallocFailed && db->nVdbeExec==0 ){
 889     db->mallocFailed = 0;
 890     AtomicStore(&db->u1.isInterrupted, 0);
 891     assert( db->lookaside.bDisable>0 );
 892     EnableLookaside;
 893   }
 894 }
 895
 896 /*
 897 ** Take actions at the end of an API call to deal with error codes.
 898 */
 899 static SQLITE_NOINLINE int apiHandleError(sqlite3 *db, int rc){
 900   if( db->mallocFailed || rc==SQLITE_IOERR_NOMEM ){
 901     sqlite3OomClear(db);
 902     sqlite3Error(db, SQLITE_NOMEM);
 903     return SQLITE_NOMEM_BKPT;
 904   }
 905   return rc & db->errMask;
 906 }
 907
 908 /*
 909 ** This function must be called before exiting any API function (i.e.
 910 ** returning control to the user) that has called sqlite3_malloc or
 911 ** sqlite3_realloc.
 912 **
 913 ** The returned value is normally a copy of the second argument to this
 914 ** function. However, if a malloc() failure has occurred since the previous
 915 ** invocation SQLITE_NOMEM is returned instead.
 916 **
 917 ** If an OOM as occurred, then the connection error-code (the value
 918 ** returned by sqlite3_errcode()) is set to SQLITE_NOMEM.
 919 */
 920 int sqlite3ApiExit(sqlite3* db, int rc){
 921   /* If the db handle must hold the connection handle mutex here.
 922   ** Otherwise the read (and possible write) of db->mallocFailed
 923   ** is unsafe, as is the call to sqlite3Error().
 924   */
 925   assert( db!=0 );
 926   assert( sqlite3_mutex_held(db->mutex) );
 927   if( db->mallocFailed || rc ){
 928     return apiHandleError(db, rc);
 929   }
 930   return 0;
 931 }