src/vdbemem.c

   1 /*
   2 ** 2004 May 26
   3 **
   4 ** The author disclaims copyright to this source code.  In place of
   5 ** a legal notice, here is a blessing:
   6 **
   7 **    May you do good and not evil.
   8 **    May you find forgiveness for yourself and forgive others.
   9 **    May you share freely, never taking more than you give.
  10 **
  11 *************************************************************************
  12 **
  13 ** This file contains code use to manipulate "Mem" structure.  A "Mem"
  14 ** stores a single value in the VDBE.  Mem is an opaque structure visible
  15 ** only within the VDBE.  Interface routines refer to a Mem using the
  16 ** name sqlite_value
  17 */
  18 #include "sqliteInt.h"
  19 #include "vdbeInt.h"
  20
  21 /* True if X is a power of two.  0 is considered a power of two here.
  22 ** In other words, return true if X has at most one bit set.
  23 */
  24 #define ISPOWEROF2(X)  (((X)&((X)-1))==0)
  25
  26 #ifdef SQLITE_DEBUG
  27 /*
  28 ** Check invariants on a Mem object.
  29 **
  30 ** This routine is intended for use inside of assert() statements, like
  31 ** this:    assert( sqlite3VdbeCheckMemInvariants(pMem) );
  32 */
  33 int sqlite3VdbeCheckMemInvariants(Mem *p){
  34   /* If MEM_Dyn is set then Mem.xDel!=0.
  35   ** Mem.xDel might not be initialized if MEM_Dyn is clear.
  36   */
  37   assert( (p->flags & MEM_Dyn)==0 || p->xDel!=0 );
  38
  39   /* MEM_Dyn may only be set if Mem.szMalloc==0.  In this way we
  40   ** ensure that if Mem.szMalloc>0 then it is safe to do
  41   ** Mem.z = Mem.zMalloc without having to check Mem.flags&MEM_Dyn.
  42   ** That saves a few cycles in inner loops. */
  43   assert( (p->flags & MEM_Dyn)==0 || p->szMalloc==0 );
  44
  45   /* Cannot have more than one of MEM_Int, MEM_Real, or MEM_IntReal */
  46   assert( ISPOWEROF2(p->flags & (MEM_Int|MEM_Real|MEM_IntReal)) );
  47
  48   if( p->flags & MEM_Null ){
  49     /* Cannot be both MEM_Null and some other type */
  50     assert( (p->flags & (MEM_Int|MEM_Real|MEM_Str|MEM_Blob|MEM_Agg))==0 );
  51
  52     /* If MEM_Null is set, then either the value is a pure NULL (the usual
  53     ** case) or it is a pointer set using sqlite3_bind_pointer() or
  54     ** sqlite3_result_pointer().  If a pointer, then MEM_Term must also be
  55     ** set.
  56     */
  57     if( (p->flags & (MEM_Term|MEM_Subtype))==(MEM_Term|MEM_Subtype) ){
  58       /* This is a pointer type.  There may be a flag to indicate what to
  59       ** do with the pointer. */
  60       assert( ((p->flags&MEM_Dyn)!=0 ? 1 : 0) +
  61               ((p->flags&MEM_Ephem)!=0 ? 1 : 0) +
  62               ((p->flags&MEM_Static)!=0 ? 1 : 0) <= 1 );
  63
  64       /* No other bits set */
  65       assert( (p->flags & ~(MEM_Null|MEM_Term|MEM_Subtype|MEM_FromBind
  66                            |MEM_Dyn|MEM_Ephem|MEM_Static))==0 );
  67     }else{
  68       /* A pure NULL might have other flags, such as MEM_Static, MEM_Dyn,
  69       ** MEM_Ephem, MEM_Cleared, or MEM_Subtype */
  70     }
  71   }else{
  72     /* The MEM_Cleared bit is only allowed on NULLs */
  73     assert( (p->flags & MEM_Cleared)==0 );
  74   }
  75
  76   /* The szMalloc field holds the correct memory allocation size */
  77   assert( p->szMalloc==0
  78        || (p->flags==MEM_Undefined
  79            && p->szMalloc<=sqlite3DbMallocSize(p->db,p->zMalloc))
  80        || p->szMalloc==sqlite3DbMallocSize(p->db,p->zMalloc));
  81
  82   /* If p holds a string or blob, the Mem.z must point to exactly
  83   ** one of the following:
  84   **
  85   **   (1) Memory in Mem.zMalloc and managed by the Mem object
  86   **   (2) Memory to be freed using Mem.xDel
  87   **   (3) An ephemeral string or blob
  88   **   (4) A static string or blob
  89   */
  90   if( (p->flags & (MEM_Str|MEM_Blob)) && p->n>0 ){
  91     assert(
  92       ((p->szMalloc>0 && p->z==p->zMalloc)? 1 : 0) +
  93       ((p->flags&MEM_Dyn)!=0 ? 1 : 0) +
  94       ((p->flags&MEM_Ephem)!=0 ? 1 : 0) +
  95       ((p->flags&MEM_Static)!=0 ? 1 : 0) == 1
  96     );
  97   }
  98   return 1;
  99 }
 100 #endif
 101
 102 /*
 103 ** Render a Mem object which is one of MEM_Int, MEM_Real, or MEM_IntReal
 104 ** into a buffer.
 105 */
 106 static void vdbeMemRenderNum(int sz, char *zBuf, Mem *p){
 107   StrAccum acc;
 108   assert( p->flags & (MEM_Int|MEM_Real|MEM_IntReal) );
 109   assert( sz>22 );
 110   if( p->flags & MEM_Int ){
 111 #if GCC_VERSION>=7000000
 112     /* Work-around for GCC bug
 113     ** https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96270 */
 114     i64 x;
 115     assert( (p->flags&MEM_Int)*2==sizeof(x) );
 116     memcpy(&x, (char*)&p->u, (p->flags&MEM_Int)*2);
 117     p->n = sqlite3Int64ToText(x, zBuf);
 118 #else
 119     p->n = sqlite3Int64ToText(p->u.i, zBuf);
 120 #endif
 121   }else{
 122     sqlite3StrAccumInit(&acc, 0, zBuf, sz, 0);
 123     sqlite3_str_appendf(&acc, "%!.15g",
 124          (p->flags & MEM_IntReal)!=0 ? (double)p->u.i : p->u.r);
 125     assert( acc.zText==zBuf && acc.mxAlloc<=0 );
 126     zBuf[acc.nChar] = 0; /* Fast version of sqlite3StrAccumFinish(&acc) */
 127     p->n = acc.nChar;
 128   }
 129 }
 130
 131 #ifdef SQLITE_DEBUG
 132 /*
 133 ** Validity checks on pMem.  pMem holds a string.
 134 **
 135 ** (1) Check that string value of pMem agrees with its integer or real value.
 136 ** (2) Check that the string is correctly zero terminated
 137 **
 138 ** A single int or real value always converts to the same strings.  But
 139 ** many different strings can be converted into the same int or real.
 140 ** If a table contains a numeric value and an index is based on the
 141 ** corresponding string value, then it is important that the string be
 142 ** derived from the numeric value, not the other way around, to ensure
 143 ** that the index and table are consistent.  See ticket
 144 ** https://www.sqlite.org/src/info/343634942dd54ab (2018-01-31) for
 145 ** an example.
 146 **
 147 ** This routine looks at pMem to verify that if it has both a numeric
 148 ** representation and a string representation then the string rep has
 149 ** been derived from the numeric and not the other way around.  It returns
 150 ** true if everything is ok and false if there is a problem.
 151 **
 152 ** This routine is for use inside of assert() statements only.
 153 */
 154 int sqlite3VdbeMemValidStrRep(Mem *p){
 155   Mem tmp;
 156   char zBuf[100];
 157   char *z;
 158   int i, j, incr;
 159   if( (p->flags & MEM_Str)==0 ) return 1;
 160   if( p->flags & MEM_Term ){
 161     /* Insure that the string is properly zero-terminated.  Pay particular
 162     ** attention to the case where p->n is odd */
 163     if( p->szMalloc>0 && p->z==p->zMalloc ){
 164       assert( p->enc==SQLITE_UTF8 || p->szMalloc >= ((p->n+1)&~1)+2 );
 165       assert( p->enc!=SQLITE_UTF8 || p->szMalloc >= p->n+1 );
 166     }
 167     assert( p->z[p->n]==0 );
 168     assert( p->enc==SQLITE_UTF8 || p->z[(p->n+1)&~1]==0 );
 169     assert( p->enc==SQLITE_UTF8 || p->z[((p->n+1)&~1)+1]==0 );
 170   }
 171   if( (p->flags & (MEM_Int|MEM_Real|MEM_IntReal))==0 ) return 1;
 172   memcpy(&tmp, p, sizeof(tmp));
 173   vdbeMemRenderNum(sizeof(zBuf), zBuf, &tmp);
 174   z = p->z;
 175   i = j = 0;
 176   incr = 1;
 177   if( p->enc!=SQLITE_UTF8 ){
 178     incr = 2;
 179     if( p->enc==SQLITE_UTF16BE ) z++;
 180   }
 181   while( zBuf[j] ){
 182     if( zBuf[j++]!=z[i] ) return 0;
 183     i += incr;
 184   }
 185   return 1;
 186 }
 187 #endif /* SQLITE_DEBUG */
 188
 189 /*
 190 ** If pMem is an object with a valid string representation, this routine
 191 ** ensures the internal encoding for the string representation is
 192 ** 'desiredEnc', one of SQLITE_UTF8, SQLITE_UTF16LE or SQLITE_UTF16BE.
 193 **
 194 ** If pMem is not a string object, or the encoding of the string
 195 ** representation is already stored using the requested encoding, then this
 196 ** routine is a no-op.
 197 **
 198 ** SQLITE_OK is returned if the conversion is successful (or not required).
 199 ** SQLITE_NOMEM may be returned if a malloc() fails during conversion
 200 ** between formats.
 201 */
 202 int sqlite3VdbeChangeEncoding(Mem *pMem, int desiredEnc){
 203 #ifndef SQLITE_OMIT_UTF16
 204   int rc;
 205 #endif
 206   assert( pMem!=0 );
 207   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 208   assert( desiredEnc==SQLITE_UTF8 || desiredEnc==SQLITE_UTF16LE
 209            || desiredEnc==SQLITE_UTF16BE );
 210   if( !(pMem->flags&MEM_Str) ){
 211     pMem->enc = desiredEnc;
 212     return SQLITE_OK;
 213   }
 214   if( pMem->enc==desiredEnc ){
 215     return SQLITE_OK;
 216   }
 217   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 218 #ifdef SQLITE_OMIT_UTF16
 219   return SQLITE_ERROR;
 220 #else
 221
 222   /* MemTranslate() may return SQLITE_OK or SQLITE_NOMEM. If NOMEM is returned,
 223   ** then the encoding of the value may not have changed.
 224   */
 225   rc = sqlite3VdbeMemTranslate(pMem, (u8)desiredEnc);
 226   assert(rc==SQLITE_OK    || rc==SQLITE_NOMEM);
 227   assert(rc==SQLITE_OK    || pMem->enc!=desiredEnc);
 228   assert(rc==SQLITE_NOMEM || pMem->enc==desiredEnc);
 229   return rc;
 230 #endif
 231 }
 232
 233 /*
 234 ** Make sure pMem->z points to a writable allocation of at least n bytes.
 235 **
 236 ** If the bPreserve argument is true, then copy of the content of
 237 ** pMem->z into the new allocation.  pMem must be either a string or
 238 ** blob if bPreserve is true.  If bPreserve is false, any prior content
 239 ** in pMem->z is discarded.
 240 */
 241 SQLITE_NOINLINE int sqlite3VdbeMemGrow(Mem *pMem, int n, int bPreserve){
 242   assert( sqlite3VdbeCheckMemInvariants(pMem) );
 243   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 244   testcase( pMem->db==0 );
 245
 246   /* If the bPreserve flag is set to true, then the memory cell must already
 247   ** contain a valid string or blob value.  */
 248   assert( bPreserve==0 || pMem->flags&(MEM_Blob|MEM_Str) );
 249   testcase( bPreserve && pMem->z==0 );
 250
 251   assert( pMem->szMalloc==0
 252        || (pMem->flags==MEM_Undefined
 253            && pMem->szMalloc<=sqlite3DbMallocSize(pMem->db,pMem->zMalloc))
 254        || pMem->szMalloc==sqlite3DbMallocSize(pMem->db,pMem->zMalloc));
 255   if( pMem->szMalloc>0 && bPreserve && pMem->z==pMem->zMalloc ){
 256     if( pMem->db ){
 257       pMem->z = pMem->zMalloc = sqlite3DbReallocOrFree(pMem->db, pMem->z, n);
 258     }else{
 259       pMem->zMalloc = sqlite3Realloc(pMem->z, n);
 260       if( pMem->zMalloc==0 ) sqlite3_free(pMem->z);
 261       pMem->z = pMem->zMalloc;
 262     }
 263     bPreserve = 0;
 264   }else{
 265     if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
 266     pMem->zMalloc = sqlite3DbMallocRaw(pMem->db, n);
 267   }
 268   if( pMem->zMalloc==0 ){
 269     sqlite3VdbeMemSetNull(pMem);
 270     pMem->z = 0;
 271     pMem->szMalloc = 0;
 272     return SQLITE_NOMEM_BKPT;
 273   }else{
 274     pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
 275   }
 276
 277   if( bPreserve && pMem->z ){
 278     assert( pMem->z!=pMem->zMalloc );
 279     memcpy(pMem->zMalloc, pMem->z, pMem->n);
 280   }
 281   if( (pMem->flags&MEM_Dyn)!=0 ){
 282     assert( pMem->xDel!=0 && pMem->xDel!=SQLITE_DYNAMIC );
 283     pMem->xDel((void *)(pMem->z));
 284   }
 285
 286   pMem->z = pMem->zMalloc;
 287   pMem->flags &= ~(MEM_Dyn|MEM_Ephem|MEM_Static);
 288   return SQLITE_OK;
 289 }
 290
 291 /*
 292 ** Change the pMem->zMalloc allocation to be at least szNew bytes.
 293 ** If pMem->zMalloc already meets or exceeds the requested size, this
 294 ** routine is a no-op.
 295 **
 296 ** Any prior string or blob content in the pMem object may be discarded.
 297 ** The pMem->xDel destructor is called, if it exists.  Though MEM_Str
 298 ** and MEM_Blob values may be discarded, MEM_Int, MEM_Real, MEM_IntReal,
 299 ** and MEM_Null values are preserved.
 300 **
 301 ** Return SQLITE_OK on success or an error code (probably SQLITE_NOMEM)
 302 ** if unable to complete the resizing.
 303 */
 304 int sqlite3VdbeMemClearAndResize(Mem *pMem, int szNew){
 305   assert( CORRUPT_DB || szNew>0 );
 306   assert( (pMem->flags & MEM_Dyn)==0 || pMem->szMalloc==0 );
 307   if( pMem->szMalloc<szNew ){
 308     return sqlite3VdbeMemGrow(pMem, szNew, 0);
 309   }
 310   assert( (pMem->flags & MEM_Dyn)==0 );
 311   pMem->z = pMem->zMalloc;
 312   pMem->flags &= (MEM_Null|MEM_Int|MEM_Real|MEM_IntReal);
 313   return SQLITE_OK;
 314 }
 315
 316 /*
 317 ** It is already known that pMem contains an unterminated string.
 318 ** Add the zero terminator.
 319 **
 320 ** Three bytes of zero are added.  In this way, there is guaranteed
 321 ** to be a double-zero byte at an even byte boundary in order to
 322 ** terminate a UTF16 string, even if the initial size of the buffer
 323 ** is an odd number of bytes.
 324 */
 325 static SQLITE_NOINLINE int vdbeMemAddTerminator(Mem *pMem){
 326   if( sqlite3VdbeMemGrow(pMem, pMem->n+3, 1) ){
 327     return SQLITE_NOMEM_BKPT;
 328   }
 329   pMem->z[pMem->n] = 0;
 330   pMem->z[pMem->n+1] = 0;
 331   pMem->z[pMem->n+2] = 0;
 332   pMem->flags |= MEM_Term;
 333   return SQLITE_OK;
 334 }
 335
 336 /*
 337 ** Change pMem so that its MEM_Str or MEM_Blob value is stored in
 338 ** MEM.zMalloc, where it can be safely written.
 339 **
 340 ** Return SQLITE_OK on success or SQLITE_NOMEM if malloc fails.
 341 */
 342 int sqlite3VdbeMemMakeWriteable(Mem *pMem){
 343   assert( pMem!=0 );
 344   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 345   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 346   if( (pMem->flags & (MEM_Str|MEM_Blob))!=0 ){
 347     if( ExpandBlob(pMem) ) return SQLITE_NOMEM;
 348     if( pMem->szMalloc==0 || pMem->z!=pMem->zMalloc ){
 349       int rc = vdbeMemAddTerminator(pMem);
 350       if( rc ) return rc;
 351     }
 352   }
 353   pMem->flags &= ~MEM_Ephem;
 354 #ifdef SQLITE_DEBUG
 355   pMem->pScopyFrom = 0;
 356 #endif
 357
 358   return SQLITE_OK;
 359 }
 360
 361 /*
 362 ** If the given Mem* has a zero-filled tail, turn it into an ordinary
 363 ** blob stored in dynamically allocated space.
 364 */
 365 #ifndef SQLITE_OMIT_INCRBLOB
 366 int sqlite3VdbeMemExpandBlob(Mem *pMem){
 367   int nByte;
 368   assert( pMem!=0 );
 369   assert( pMem->flags & MEM_Zero );
 370   assert( (pMem->flags&MEM_Blob)!=0 || MemNullNochng(pMem) );
 371   testcase( sqlite3_value_nochange(pMem) );
 372   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 373   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 374
 375   /* Set nByte to the number of bytes required to store the expanded blob. */
 376   nByte = pMem->n + pMem->u.nZero;
 377   if( nByte<=0 ){
 378     if( (pMem->flags & MEM_Blob)==0 ) return SQLITE_OK;
 379     nByte = 1;
 380   }
 381   if( sqlite3VdbeMemGrow(pMem, nByte, 1) ){
 382     return SQLITE_NOMEM_BKPT;
 383   }
 384   assert( pMem->z!=0 );
 385   assert( sqlite3DbMallocSize(pMem->db,pMem->z) >= nByte );
 386
 387   memset(&pMem->z[pMem->n], 0, pMem->u.nZero);
 388   pMem->n += pMem->u.nZero;
 389   pMem->flags &= ~(MEM_Zero|MEM_Term);
 390   return SQLITE_OK;
 391 }
 392 #endif
 393
 394 /*
 395 ** Make sure the given Mem is \u0000 terminated.
 396 */
 397 int sqlite3VdbeMemNulTerminate(Mem *pMem){
 398   assert( pMem!=0 );
 399   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 400   testcase( (pMem->flags & (MEM_Term|MEM_Str))==(MEM_Term|MEM_Str) );
 401   testcase( (pMem->flags & (MEM_Term|MEM_Str))==0 );
 402   if( (pMem->flags & (MEM_Term|MEM_Str))!=MEM_Str ){
 403     return SQLITE_OK;   /* Nothing to do */
 404   }else{
 405     return vdbeMemAddTerminator(pMem);
 406   }
 407 }
 408
 409 /*
 410 ** Add MEM_Str to the set of representations for the given Mem.  This
 411 ** routine is only called if pMem is a number of some kind, not a NULL
 412 ** or a BLOB.
 413 **
 414 ** Existing representations MEM_Int, MEM_Real, or MEM_IntReal are invalidated
 415 ** if bForce is true but are retained if bForce is false.
 416 **
 417 ** A MEM_Null value will never be passed to this function. This function is
 418 ** used for converting values to text for returning to the user (i.e. via
 419 ** sqlite3_value_text()), or for ensuring that values to be used as btree
 420 ** keys are strings. In the former case a NULL pointer is returned the
 421 ** user and the latter is an internal programming error.
 422 */
 423 int sqlite3VdbeMemStringify(Mem *pMem, u8 enc, u8 bForce){
 424   const int nByte = 32;
 425
 426   assert( pMem!=0 );
 427   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 428   assert( !(pMem->flags&MEM_Zero) );
 429   assert( !(pMem->flags&(MEM_Str|MEM_Blob)) );
 430   assert( pMem->flags&(MEM_Int|MEM_Real|MEM_IntReal) );
 431   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 432   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 433
 434
 435   if( sqlite3VdbeMemClearAndResize(pMem, nByte) ){
 436     pMem->enc = 0;
 437     return SQLITE_NOMEM_BKPT;
 438   }
 439
 440   vdbeMemRenderNum(nByte, pMem->z, pMem);
 441   assert( pMem->z!=0 );
 442   assert( pMem->n==sqlite3Strlen30NN(pMem->z) );
 443   pMem->enc = SQLITE_UTF8;
 444   pMem->flags |= MEM_Str|MEM_Term;
 445   if( bForce ) pMem->flags &= ~(MEM_Int|MEM_Real|MEM_IntReal);
 446   sqlite3VdbeChangeEncoding(pMem, enc);
 447   return SQLITE_OK;
 448 }
 449
 450 /*
 451 ** Memory cell pMem contains the context of an aggregate function.
 452 ** This routine calls the finalize method for that function.  The
 453 ** result of the aggregate is stored back into pMem.
 454 **
 455 ** Return SQLITE_ERROR if the finalizer reports an error.  SQLITE_OK
 456 ** otherwise.
 457 */
 458 int sqlite3VdbeMemFinalize(Mem *pMem, FuncDef *pFunc){
 459   sqlite3_context ctx;
 460   Mem t;
 461   assert( pFunc!=0 );
 462   assert( pMem!=0 );
 463   assert( pMem->db!=0 );
 464   assert( pFunc->xFinalize!=0 );
 465   assert( (pMem->flags & MEM_Null)!=0 || pFunc==pMem->u.pDef );
 466   assert( sqlite3_mutex_held(pMem->db->mutex) );
 467   memset(&ctx, 0, sizeof(ctx));
 468   memset(&t, 0, sizeof(t));
 469   t.flags = MEM_Null;
 470   t.db = pMem->db;
 471   ctx.pOut = &t;
 472   ctx.pMem = pMem;
 473   ctx.pFunc = pFunc;
 474   ctx.enc = ENC(t.db);
 475   pFunc->xFinalize(&ctx); /* IMP: R-24505-23230 */
 476   assert( (pMem->flags & MEM_Dyn)==0 );
 477   if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
 478   memcpy(pMem, &t, sizeof(t));
 479   return ctx.isError;
 480 }
 481
 482 /*
 483 ** Memory cell pAccum contains the context of an aggregate function.
 484 ** This routine calls the xValue method for that function and stores
 485 ** the results in memory cell pMem.
 486 **
 487 ** SQLITE_ERROR is returned if xValue() reports an error. SQLITE_OK
 488 ** otherwise.
 489 */
 490 #ifndef SQLITE_OMIT_WINDOWFUNC
 491 int sqlite3VdbeMemAggValue(Mem *pAccum, Mem *pOut, FuncDef *pFunc){
 492   sqlite3_context ctx;
 493   assert( pFunc!=0 );
 494   assert( pFunc->xValue!=0 );
 495   assert( (pAccum->flags & MEM_Null)!=0 || pFunc==pAccum->u.pDef );
 496   assert( pAccum->db!=0 );
 497   assert( sqlite3_mutex_held(pAccum->db->mutex) );
 498   memset(&ctx, 0, sizeof(ctx));
 499   sqlite3VdbeMemSetNull(pOut);
 500   ctx.pOut = pOut;
 501   ctx.pMem = pAccum;
 502   ctx.pFunc = pFunc;
 503   ctx.enc = ENC(pAccum->db);
 504   pFunc->xValue(&ctx);
 505   return ctx.isError;
 506 }
 507 #endif /* SQLITE_OMIT_WINDOWFUNC */
 508
 509 /*
 510 ** If the memory cell contains a value that must be freed by
 511 ** invoking the external callback in Mem.xDel, then this routine
 512 ** will free that value.  It also sets Mem.flags to MEM_Null.
 513 **
 514 ** This is a helper routine for sqlite3VdbeMemSetNull() and
 515 ** for sqlite3VdbeMemRelease().  Use those other routines as the
 516 ** entry point for releasing Mem resources.
 517 */
 518 static SQLITE_NOINLINE void vdbeMemClearExternAndSetNull(Mem *p){
 519   assert( p->db==0 || sqlite3_mutex_held(p->db->mutex) );
 520   assert( VdbeMemDynamic(p) );
 521   if( p->flags&MEM_Agg ){
 522     sqlite3VdbeMemFinalize(p, p->u.pDef);
 523     assert( (p->flags & MEM_Agg)==0 );
 524     testcase( p->flags & MEM_Dyn );
 525   }
 526   if( p->flags&MEM_Dyn ){
 527     assert( p->xDel!=SQLITE_DYNAMIC && p->xDel!=0 );
 528     p->xDel((void *)p->z);
 529   }
 530   p->flags = MEM_Null;
 531 }
 532
 533 /*
 534 ** Release memory held by the Mem p, both external memory cleared
 535 ** by p->xDel and memory in p->zMalloc.
 536 **
 537 ** This is a helper routine invoked by sqlite3VdbeMemRelease() in
 538 ** the unusual case where there really is memory in p that needs
 539 ** to be freed.
 540 */
 541 static SQLITE_NOINLINE void vdbeMemClear(Mem *p){
 542   if( VdbeMemDynamic(p) ){
 543     vdbeMemClearExternAndSetNull(p);
 544   }
 545   if( p->szMalloc ){
 546     sqlite3DbFreeNN(p->db, p->zMalloc);
 547     p->szMalloc = 0;
 548   }
 549   p->z = 0;
 550 }
 551
 552 /*
 553 ** Release any memory resources held by the Mem.  Both the memory that is
 554 ** free by Mem.xDel and the Mem.zMalloc allocation are freed.
 555 **
 556 ** Use this routine prior to clean up prior to abandoning a Mem, or to
 557 ** reset a Mem back to its minimum memory utilization.
 558 **
 559 ** Use sqlite3VdbeMemSetNull() to release just the Mem.xDel space
 560 ** prior to inserting new content into the Mem.
 561 */
 562 void sqlite3VdbeMemRelease(Mem *p){
 563   assert( sqlite3VdbeCheckMemInvariants(p) );
 564   if( VdbeMemDynamic(p) || p->szMalloc ){
 565     vdbeMemClear(p);
 566   }
 567 }
 568
 569 /* Like sqlite3VdbeMemRelease() but faster for cases where we
 570 ** know in advance that the Mem is not MEM_Dyn or MEM_Agg.
 571 */
 572 void sqlite3VdbeMemReleaseMalloc(Mem *p){
 573   assert( !VdbeMemDynamic(p) );
 574   if( p->szMalloc ) vdbeMemClear(p);
 575 }
 576
 577 /*
 578 ** Convert a 64-bit IEEE double into a 64-bit signed integer.
 579 ** If the double is out of range of a 64-bit signed integer then
 580 ** return the closest available 64-bit signed integer.
 581 */
 582 static SQLITE_NOINLINE i64 doubleToInt64(double r){
 583 #ifdef SQLITE_OMIT_FLOATING_POINT
 584   /* When floating-point is omitted, double and int64 are the same thing */
 585   return r;
 586 #else
 587   /*
 588   ** Many compilers we encounter do not define constants for the
 589   ** minimum and maximum 64-bit integers, or they define them
 590   ** inconsistently.  And many do not understand the "LL" notation.
 591   ** So we define our own static constants here using nothing
 592   ** larger than a 32-bit integer constant.
 593   */
 594   static const i64 maxInt = LARGEST_INT64;
 595   static const i64 minInt = SMALLEST_INT64;
 596
 597   if( r<=(double)minInt ){
 598     return minInt;
 599   }else if( r>=(double)maxInt ){
 600     return maxInt;
 601   }else{
 602     return (i64)r;
 603   }
 604 #endif
 605 }
 606
 607 /*
 608 ** Return some kind of integer value which is the best we can do
 609 ** at representing the value that *pMem describes as an integer.
 610 ** If pMem is an integer, then the value is exact.  If pMem is
 611 ** a floating-point then the value returned is the integer part.
 612 ** If pMem is a string or blob, then we make an attempt to convert
 613 ** it into an integer and return that.  If pMem represents an
 614 ** an SQL-NULL value, return 0.
 615 **
 616 ** If pMem represents a string value, its encoding might be changed.
 617 */
 618 static SQLITE_NOINLINE i64 memIntValue(const Mem *pMem){
 619   i64 value = 0;
 620   sqlite3Atoi64(pMem->z, &value, pMem->n, pMem->enc);
 621   return value;
 622 }
 623 i64 sqlite3VdbeIntValue(const Mem *pMem){
 624   int flags;
 625   assert( pMem!=0 );
 626   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 627   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 628   flags = pMem->flags;
 629   if( flags & (MEM_Int|MEM_IntReal) ){
 630     testcase( flags & MEM_IntReal );
 631     return pMem->u.i;
 632   }else if( flags & MEM_Real ){
 633     return doubleToInt64(pMem->u.r);
 634   }else if( (flags & (MEM_Str|MEM_Blob))!=0 && pMem->z!=0 ){
 635     return memIntValue(pMem);
 636   }else{
 637     return 0;
 638   }
 639 }
 640
 641 /*
 642 ** Return the best representation of pMem that we can get into a
 643 ** double.  If pMem is already a double or an integer, return its
 644 ** value.  If it is a string or blob, try to convert it to a double.
 645 ** If it is a NULL, return 0.0.
 646 */
 647 static SQLITE_NOINLINE double memRealValue(Mem *pMem){
 648   /* (double)0 In case of SQLITE_OMIT_FLOATING_POINT... */
 649   double val = (double)0;
 650   sqlite3AtoF(pMem->z, &val, pMem->n, pMem->enc);
 651   return val;
 652 }
 653 double sqlite3VdbeRealValue(Mem *pMem){
 654   assert( pMem!=0 );
 655   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 656   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 657   if( pMem->flags & MEM_Real ){
 658     return pMem->u.r;
 659   }else if( pMem->flags & (MEM_Int|MEM_IntReal) ){
 660     testcase( pMem->flags & MEM_IntReal );
 661     return (double)pMem->u.i;
 662   }else if( pMem->flags & (MEM_Str|MEM_Blob) ){
 663     return memRealValue(pMem);
 664   }else{
 665     /* (double)0 In case of SQLITE_OMIT_FLOATING_POINT... */
 666     return (double)0;
 667   }
 668 }
 669
 670 /*
 671 ** Return 1 if pMem represents true, and return 0 if pMem represents false.
 672 ** Return the value ifNull if pMem is NULL.
 673 */
 674 int sqlite3VdbeBooleanValue(Mem *pMem, int ifNull){
 675   testcase( pMem->flags & MEM_IntReal );
 676   if( pMem->flags & (MEM_Int|MEM_IntReal) ) return pMem->u.i!=0;
 677   if( pMem->flags & MEM_Null ) return ifNull;
 678   return sqlite3VdbeRealValue(pMem)!=0.0;
 679 }
 680
 681 /*
 682 ** The MEM structure is already a MEM_Real or MEM_IntReal. Try to
 683 ** make it a MEM_Int if we can.
 684 */
 685 void sqlite3VdbeIntegerAffinity(Mem *pMem){
 686   assert( pMem!=0 );
 687   assert( pMem->flags & (MEM_Real|MEM_IntReal) );
 688   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 689   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 690   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 691
 692   if( pMem->flags & MEM_IntReal ){
 693     MemSetTypeFlag(pMem, MEM_Int);
 694   }else{
 695     i64 ix = doubleToInt64(pMem->u.r);
 696
 697     /* Only mark the value as an integer if
 698     **
 699     **    (1) the round-trip conversion real->int->real is a no-op, and
 700     **    (2) The integer is neither the largest nor the smallest
 701     **        possible integer (ticket #3922)
 702     **
 703     ** The second and third terms in the following conditional enforces
 704     ** the second condition under the assumption that addition overflow causes
 705     ** values to wrap around.
 706     */
 707     if( pMem->u.r==ix && ix>SMALLEST_INT64 && ix<LARGEST_INT64 ){
 708       pMem->u.i = ix;
 709       MemSetTypeFlag(pMem, MEM_Int);
 710     }
 711   }
 712 }
 713
 714 /*
 715 ** Convert pMem to type integer.  Invalidate any prior representations.
 716 */
 717 int sqlite3VdbeMemIntegerify(Mem *pMem){
 718   assert( pMem!=0 );
 719   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 720   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 721   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 722
 723   pMem->u.i = sqlite3VdbeIntValue(pMem);
 724   MemSetTypeFlag(pMem, MEM_Int);
 725   return SQLITE_OK;
 726 }
 727
 728 /*
 729 ** Convert pMem so that it is of type MEM_Real.
 730 ** Invalidate any prior representations.
 731 */
 732 int sqlite3VdbeMemRealify(Mem *pMem){
 733   assert( pMem!=0 );
 734   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 735   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
 736
 737   pMem->u.r = sqlite3VdbeRealValue(pMem);
 738   MemSetTypeFlag(pMem, MEM_Real);
 739   return SQLITE_OK;
 740 }
 741
 742 /* Compare a floating point value to an integer.  Return true if the two
 743 ** values are the same within the precision of the floating point value.
 744 **
 745 ** This function assumes that i was obtained by assignment from r1.
 746 **
 747 ** For some versions of GCC on 32-bit machines, if you do the more obvious
 748 ** comparison of "r1==(double)i" you sometimes get an answer of false even
 749 ** though the r1 and (double)i values are bit-for-bit the same.
 750 */
 751 int sqlite3RealSameAsInt(double r1, sqlite3_int64 i){
 752   double r2 = (double)i;
 753   return r1==0.0
 754       || (memcmp(&r1, &r2, sizeof(r1))==0
 755           && i >= -2251799813685248LL && i < 2251799813685248LL);
 756 }
 757
 758 /* Convert a floating point value to its closest integer.  Do so in
 759 ** a way that avoids 'outside the range of representable values' warnings
 760 ** from UBSAN.
 761 */
 762 i64 sqlite3RealToI64(double r){
 763   if( r<=(double)SMALLEST_INT64 ) return SMALLEST_INT64;
 764   if( r>=(double)LARGEST_INT64) return LARGEST_INT64;
 765   return (i64)r;
 766 }
 767
 768 /*
 769 ** Convert pMem so that it has type MEM_Real or MEM_Int.
 770 ** Invalidate any prior representations.
 771 **
 772 ** Every effort is made to force the conversion, even if the input
 773 ** is a string that does not look completely like a number.  Convert
 774 ** as much of the string as we can and ignore the rest.
 775 */
 776 int sqlite3VdbeMemNumerify(Mem *pMem){
 777   assert( pMem!=0 );
 778   testcase( pMem->flags & MEM_Int );
 779   testcase( pMem->flags & MEM_Real );
 780   testcase( pMem->flags & MEM_IntReal );
 781   testcase( pMem->flags & MEM_Null );
 782   if( (pMem->flags & (MEM_Int|MEM_Real|MEM_IntReal|MEM_Null))==0 ){
 783     int rc;
 784     sqlite3_int64 ix;
 785     assert( (pMem->flags & (MEM_Blob|MEM_Str))!=0 );
 786     assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 787     rc = sqlite3AtoF(pMem->z, &pMem->u.r, pMem->n, pMem->enc);
 788     if( ((rc==0 || rc==1) && sqlite3Atoi64(pMem->z, &ix, pMem->n, pMem->enc)<=1)
 789      || sqlite3RealSameAsInt(pMem->u.r, (ix = sqlite3RealToI64(pMem->u.r)))
 790     ){
 791       pMem->u.i = ix;
 792       MemSetTypeFlag(pMem, MEM_Int);
 793     }else{
 794       MemSetTypeFlag(pMem, MEM_Real);
 795     }
 796   }
 797   assert( (pMem->flags & (MEM_Int|MEM_Real|MEM_IntReal|MEM_Null))!=0 );
 798   pMem->flags &= ~(MEM_Str|MEM_Blob|MEM_Zero);
 799   return SQLITE_OK;
 800 }
 801
 802 /*
 803 ** Cast the datatype of the value in pMem according to the affinity
 804 ** "aff".  Casting is different from applying affinity in that a cast
 805 ** is forced.  In other words, the value is converted into the desired
 806 ** affinity even if that results in loss of data.  This routine is
 807 ** used (for example) to implement the SQL "cast()" operator.
 808 */
 809 int sqlite3VdbeMemCast(Mem *pMem, u8 aff, u8 encoding){
 810   if( pMem->flags & MEM_Null ) return SQLITE_OK;
 811   switch( aff ){
 812     case SQLITE_AFF_BLOB: {   /* Really a cast to BLOB */
 813       if( (pMem->flags & MEM_Blob)==0 ){
 814         sqlite3ValueApplyAffinity(pMem, SQLITE_AFF_TEXT, encoding);
 815         assert( pMem->flags & MEM_Str || pMem->db->mallocFailed );
 816         if( pMem->flags & MEM_Str ) MemSetTypeFlag(pMem, MEM_Blob);
 817       }else{
 818         pMem->flags &= ~(MEM_TypeMask&~MEM_Blob);
 819       }
 820       break;
 821     }
 822     case SQLITE_AFF_NUMERIC: {
 823       sqlite3VdbeMemNumerify(pMem);
 824       break;
 825     }
 826     case SQLITE_AFF_INTEGER: {
 827       sqlite3VdbeMemIntegerify(pMem);
 828       break;
 829     }
 830     case SQLITE_AFF_REAL: {
 831       sqlite3VdbeMemRealify(pMem);
 832       break;
 833     }
 834     default: {
 835       assert( aff==SQLITE_AFF_TEXT );
 836       assert( MEM_Str==(MEM_Blob>>3) );
 837       pMem->flags |= (pMem->flags&MEM_Blob)>>3;
 838       sqlite3ValueApplyAffinity(pMem, SQLITE_AFF_TEXT, encoding);
 839       assert( pMem->flags & MEM_Str || pMem->db->mallocFailed );
 840       pMem->flags &= ~(MEM_Int|MEM_Real|MEM_IntReal|MEM_Blob|MEM_Zero);
 841       if( encoding!=SQLITE_UTF8 ) pMem->n &= ~1;
 842       return sqlite3VdbeChangeEncoding(pMem, encoding);
 843     }
 844   }
 845   return SQLITE_OK;
 846 }
 847
 848 /*
 849 ** Initialize bulk memory to be a consistent Mem object.
 850 **
 851 ** The minimum amount of initialization feasible is performed.
 852 */
 853 void sqlite3VdbeMemInit(Mem *pMem, sqlite3 *db, u16 flags){
 854   assert( (flags & ~MEM_TypeMask)==0 );
 855   pMem->flags = flags;
 856   pMem->db = db;
 857   pMem->szMalloc = 0;
 858 }
 859
 860
 861 /*
 862 ** Delete any previous value and set the value stored in *pMem to NULL.
 863 **
 864 ** This routine calls the Mem.xDel destructor to dispose of values that
 865 ** require the destructor.  But it preserves the Mem.zMalloc memory allocation.
 866 ** To free all resources, use sqlite3VdbeMemRelease(), which both calls this
 867 ** routine to invoke the destructor and deallocates Mem.zMalloc.
 868 **
 869 ** Use this routine to reset the Mem prior to insert a new value.
 870 **
 871 ** Use sqlite3VdbeMemRelease() to complete erase the Mem prior to abandoning it.
 872 */
 873 void sqlite3VdbeMemSetNull(Mem *pMem){
 874   if( VdbeMemDynamic(pMem) ){
 875     vdbeMemClearExternAndSetNull(pMem);
 876   }else{
 877     pMem->flags = MEM_Null;
 878   }
 879 }
 880 void sqlite3ValueSetNull(sqlite3_value *p){
 881   sqlite3VdbeMemSetNull((Mem*)p);
 882 }
 883
 884 /*
 885 ** Delete any previous value and set the value to be a BLOB of length
 886 ** n containing all zeros.
 887 */
 888 #ifndef SQLITE_OMIT_INCRBLOB
 889 void sqlite3VdbeMemSetZeroBlob(Mem *pMem, int n){
 890   sqlite3VdbeMemRelease(pMem);
 891   pMem->flags = MEM_Blob|MEM_Zero;
 892   pMem->n = 0;
 893   if( n<0 ) n = 0;
 894   pMem->u.nZero = n;
 895   pMem->enc = SQLITE_UTF8;
 896   pMem->z = 0;
 897 }
 898 #else
 899 int sqlite3VdbeMemSetZeroBlob(Mem *pMem, int n){
 900   int nByte = n>0?n:1;
 901   if( sqlite3VdbeMemGrow(pMem, nByte, 0) ){
 902     return SQLITE_NOMEM_BKPT;
 903   }
 904   assert( pMem->z!=0 );
 905   assert( sqlite3DbMallocSize(pMem->db, pMem->z)>=nByte );
 906   memset(pMem->z, 0, nByte);
 907   pMem->n = n>0?n:0;
 908   pMem->flags = MEM_Blob;
 909   pMem->enc = SQLITE_UTF8;
 910   return SQLITE_OK;
 911 }
 912 #endif
 913
 914 /*
 915 ** The pMem is known to contain content that needs to be destroyed prior
 916 ** to a value change.  So invoke the destructor, then set the value to
 917 ** a 64-bit integer.
 918 */
 919 static SQLITE_NOINLINE void vdbeReleaseAndSetInt64(Mem *pMem, i64 val){
 920   sqlite3VdbeMemSetNull(pMem);
 921   pMem->u.i = val;
 922   pMem->flags = MEM_Int;
 923 }
 924
 925 /*
 926 ** Delete any previous value and set the value stored in *pMem to val,
 927 ** manifest type INTEGER.
 928 */
 929 void sqlite3VdbeMemSetInt64(Mem *pMem, i64 val){
 930   if( VdbeMemDynamic(pMem) ){
 931     vdbeReleaseAndSetInt64(pMem, val);
 932   }else{
 933     pMem->u.i = val;
 934     pMem->flags = MEM_Int;
 935   }
 936 }
 937
 938 /* A no-op destructor */
 939 void sqlite3NoopDestructor(void *p){ UNUSED_PARAMETER(p); }
 940
 941 /*
 942 ** Set the value stored in *pMem should already be a NULL.
 943 ** Also store a pointer to go with it.
 944 */
 945 void sqlite3VdbeMemSetPointer(
 946   Mem *pMem,
 947   void *pPtr,
 948   const char *zPType,
 949   void (*xDestructor)(void*)
 950 ){
 951   assert( pMem->flags==MEM_Null );
 952   vdbeMemClear(pMem);
 953   pMem->u.zPType = zPType ? zPType : "";
 954   pMem->z = pPtr;
 955   pMem->flags = MEM_Null|MEM_Dyn|MEM_Subtype|MEM_Term;
 956   pMem->eSubtype = 'p';
 957   pMem->xDel = xDestructor ? xDestructor : sqlite3NoopDestructor;
 958 }
 959
 960 #ifndef SQLITE_OMIT_FLOATING_POINT
 961 /*
 962 ** Delete any previous value and set the value stored in *pMem to val,
 963 ** manifest type REAL.
 964 */
 965 void sqlite3VdbeMemSetDouble(Mem *pMem, double val){
 966   sqlite3VdbeMemSetNull(pMem);
 967   if( !sqlite3IsNaN(val) ){
 968     pMem->u.r = val;
 969     pMem->flags = MEM_Real;
 970   }
 971 }
 972 #endif
 973
 974 #ifdef SQLITE_DEBUG
 975 /*
 976 ** Return true if the Mem holds a RowSet object.  This routine is intended
 977 ** for use inside of assert() statements.
 978 */
 979 int sqlite3VdbeMemIsRowSet(const Mem *pMem){
 980   return (pMem->flags&(MEM_Blob|MEM_Dyn))==(MEM_Blob|MEM_Dyn)
 981          && pMem->xDel==sqlite3RowSetDelete;
 982 }
 983 #endif
 984
 985 /*
 986 ** Delete any previous value and set the value of pMem to be an
 987 ** empty boolean index.
 988 **
 989 ** Return SQLITE_OK on success and SQLITE_NOMEM if a memory allocation
 990 ** error occurs.
 991 */
 992 int sqlite3VdbeMemSetRowSet(Mem *pMem){
 993   sqlite3 *db = pMem->db;
 994   RowSet *p;
 995   assert( db!=0 );
 996   assert( !sqlite3VdbeMemIsRowSet(pMem) );
 997   sqlite3VdbeMemRelease(pMem);
 998   p = sqlite3RowSetInit(db);
 999   if( p==0 ) return SQLITE_NOMEM;
1000   pMem->z = (char*)p;
1001   pMem->flags = MEM_Blob|MEM_Dyn;
1002   pMem->xDel = sqlite3RowSetDelete;
1003   return SQLITE_OK;
1004 }
1005
1006 /*
1007 ** Return true if the Mem object contains a TEXT or BLOB that is
1008 ** too large - whose size exceeds SQLITE_MAX_LENGTH.
1009 */
1010 int sqlite3VdbeMemTooBig(Mem *p){
1011   assert( p->db!=0 );
1012   if( p->flags & (MEM_Str|MEM_Blob) ){
1013     int n = p->n;
1014     if( p->flags & MEM_Zero ){
1015       n += p->u.nZero;
1016     }
1017     return n>p->db->aLimit[SQLITE_LIMIT_LENGTH];
1018   }
1019   return 0;
1020 }
1021
1022 #ifdef SQLITE_DEBUG
1023 /*
1024 ** This routine prepares a memory cell for modification by breaking
1025 ** its link to a shallow copy and by marking any current shallow
1026 ** copies of this cell as invalid.
1027 **
1028 ** This is used for testing and debugging only - to help ensure that shallow
1029 ** copies (created by OP_SCopy) are not misused.
1030 */
1031 void sqlite3VdbeMemAboutToChange(Vdbe *pVdbe, Mem *pMem){
1032   int i;
1033   Mem *pX;
1034   for(i=1, pX=pVdbe->aMem+1; i<pVdbe->nMem; i++, pX++){
1035     if( pX->pScopyFrom==pMem ){
1036       u16 mFlags;
1037       if( pVdbe->db->flags & SQLITE_VdbeTrace ){
1038         sqlite3DebugPrintf("Invalidate R[%d] due to change in R[%d]\n",
1039           (int)(pX - pVdbe->aMem), (int)(pMem - pVdbe->aMem));
1040       }
1041       /* If pX is marked as a shallow copy of pMem, then try to verify that
1042       ** no significant changes have been made to pX since the OP_SCopy.
1043       ** A significant change would indicated a missed call to this
1044       ** function for pX.  Minor changes, such as adding or removing a
1045       ** dual type, are allowed, as long as the underlying value is the
1046       ** same. */
1047       mFlags = pMem->flags & pX->flags & pX->mScopyFlags;
1048       assert( (mFlags&(MEM_Int|MEM_IntReal))==0 || pMem->u.i==pX->u.i );
1049
1050       /* pMem is the register that is changing.  But also mark pX as
1051       ** undefined so that we can quickly detect the shallow-copy error */
1052       pX->flags = MEM_Undefined;
1053       pX->pScopyFrom = 0;
1054     }
1055   }
1056   pMem->pScopyFrom = 0;
1057 }
1058 #endif /* SQLITE_DEBUG */
1059
1060 /*
1061 ** Make an shallow copy of pFrom into pTo.  Prior contents of
1062 ** pTo are freed.  The pFrom->z field is not duplicated.  If
1063 ** pFrom->z is used, then pTo->z points to the same thing as pFrom->z
1064 ** and flags gets srcType (either MEM_Ephem or MEM_Static).
1065 */
1066 static SQLITE_NOINLINE void vdbeClrCopy(Mem *pTo, const Mem *pFrom, int eType){
1067   vdbeMemClearExternAndSetNull(pTo);
1068   assert( !VdbeMemDynamic(pTo) );
1069   sqlite3VdbeMemShallowCopy(pTo, pFrom, eType);
1070 }
1071 void sqlite3VdbeMemShallowCopy(Mem *pTo, const Mem *pFrom, int srcType){
1072   assert( !sqlite3VdbeMemIsRowSet(pFrom) );
1073   assert( pTo->db==pFrom->db );
1074   if( VdbeMemDynamic(pTo) ){ vdbeClrCopy(pTo,pFrom,srcType); return; }
1075   memcpy(pTo, pFrom, MEMCELLSIZE);
1076   if( (pFrom->flags&MEM_Static)==0 ){
1077     pTo->flags &= ~(MEM_Dyn|MEM_Static|MEM_Ephem);
1078     assert( srcType==MEM_Ephem || srcType==MEM_Static );
1079     pTo->flags |= srcType;
1080   }
1081 }
1082
1083 /*
1084 ** Make a full copy of pFrom into pTo.  Prior contents of pTo are
1085 ** freed before the copy is made.
1086 */
1087 int sqlite3VdbeMemCopy(Mem *pTo, const Mem *pFrom){
1088   int rc = SQLITE_OK;
1089
1090   assert( !sqlite3VdbeMemIsRowSet(pFrom) );
1091   if( VdbeMemDynamic(pTo) ) vdbeMemClearExternAndSetNull(pTo);
1092   memcpy(pTo, pFrom, MEMCELLSIZE);
1093   pTo->flags &= ~MEM_Dyn;
1094   if( pTo->flags&(MEM_Str|MEM_Blob) ){
1095     if( 0==(pFrom->flags&MEM_Static) ){
1096       pTo->flags |= MEM_Ephem;
1097       rc = sqlite3VdbeMemMakeWriteable(pTo);
1098     }
1099   }
1100
1101   return rc;
1102 }
1103
1104 /*
1105 ** Transfer the contents of pFrom to pTo. Any existing value in pTo is
1106 ** freed. If pFrom contains ephemeral data, a copy is made.
1107 **
1108 ** pFrom contains an SQL NULL when this routine returns.
1109 */
1110 void sqlite3VdbeMemMove(Mem *pTo, Mem *pFrom){
1111   assert( pFrom->db==0 || sqlite3_mutex_held(pFrom->db->mutex) );
1112   assert( pTo->db==0 || sqlite3_mutex_held(pTo->db->mutex) );
1113   assert( pFrom->db==0 || pTo->db==0 || pFrom->db==pTo->db );
1114
1115   sqlite3VdbeMemRelease(pTo);
1116   memcpy(pTo, pFrom, sizeof(Mem));
1117   pFrom->flags = MEM_Null;
1118   pFrom->szMalloc = 0;
1119 }
1120
1121 /*
1122 ** Change the value of a Mem to be a string or a BLOB.
1123 **
1124 ** The memory management strategy depends on the value of the xDel
1125 ** parameter. If the value passed is SQLITE_TRANSIENT, then the
1126 ** string is copied into a (possibly existing) buffer managed by the
1127 ** Mem structure. Otherwise, any existing buffer is freed and the
1128 ** pointer copied.
1129 **
1130 ** If the string is too large (if it exceeds the SQLITE_LIMIT_LENGTH
1131 ** size limit) then no memory allocation occurs.  If the string can be
1132 ** stored without allocating memory, then it is.  If a memory allocation
1133 ** is required to store the string, then value of pMem is unchanged.  In
1134 ** either case, SQLITE_TOOBIG is returned.
1135 **
1136 ** The "enc" parameter is the text encoding for the string, or zero
1137 ** to store a blob.
1138 **
1139 ** If n is negative, then the string consists of all bytes up to but
1140 ** excluding the first zero character.  The n parameter must be
1141 ** non-negative for blobs.
1142 */
1143 int sqlite3VdbeMemSetStr(
1144   Mem *pMem,          /* Memory cell to set to string value */
1145   const char *z,      /* String pointer */
1146   i64 n,              /* Bytes in string, or negative */
1147   u8 enc,             /* Encoding of z.  0 for BLOBs */
1148   void (*xDel)(void*) /* Destructor function */
1149 ){
1150   i64 nByte = n;      /* New value for pMem->n */
1151   int iLimit;         /* Maximum allowed string or blob size */
1152   u16 flags;          /* New value for pMem->flags */
1153
1154   assert( pMem!=0 );
1155   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
1156   assert( !sqlite3VdbeMemIsRowSet(pMem) );
1157   assert( enc!=0 || n>=0 );
1158
1159   /* If z is a NULL pointer, set pMem to contain an SQL NULL. */
1160   if( !z ){
1161     sqlite3VdbeMemSetNull(pMem);
1162     return SQLITE_OK;
1163   }
1164
1165   if( pMem->db ){
1166     iLimit = pMem->db->aLimit[SQLITE_LIMIT_LENGTH];
1167   }else{
1168     iLimit = SQLITE_MAX_LENGTH;
1169   }
1170   if( nByte<0 ){
1171     assert( enc!=0 );
1172     if( enc==SQLITE_UTF8 ){
1173       nByte = strlen(z);
1174     }else{
1175       for(nByte=0; nByte<=iLimit && (z[nByte] | z[nByte+1]); nByte+=2){}
1176     }
1177     flags= MEM_Str|MEM_Term;
1178   }else if( enc==0 ){
1179     flags = MEM_Blob;
1180     enc = SQLITE_UTF8;
1181   }else{
1182     flags = MEM_Str;
1183   }
1184   if( nByte>iLimit ){
1185     if( xDel && xDel!=SQLITE_TRANSIENT ){
1186       if( xDel==SQLITE_DYNAMIC ){
1187         sqlite3DbFree(pMem->db, (void*)z);
1188       }else{
1189         xDel((void*)z);
1190       }
1191     }
1192     sqlite3VdbeMemSetNull(pMem);
1193     return sqlite3ErrorToParser(pMem->db, SQLITE_TOOBIG);
1194   }
1195
1196   /* The following block sets the new values of Mem.z and Mem.xDel. It
1197   ** also sets a flag in local variable "flags" to indicate the memory
1198   ** management (one of MEM_Dyn or MEM_Static).
1199   */
1200   if( xDel==SQLITE_TRANSIENT ){
1201     i64 nAlloc = nByte;
1202     if( flags&MEM_Term ){
1203       nAlloc += (enc==SQLITE_UTF8?1:2);
1204     }
1205     testcase( nAlloc==0 );
1206     testcase( nAlloc==31 );
1207     testcase( nAlloc==32 );
1208     if( sqlite3VdbeMemClearAndResize(pMem, (int)MAX(nAlloc,32)) ){
1209       return SQLITE_NOMEM_BKPT;
1210     }
1211     memcpy(pMem->z, z, nAlloc);
1212   }else{
1213     sqlite3VdbeMemRelease(pMem);
1214     pMem->z = (char *)z;
1215     if( xDel==SQLITE_DYNAMIC ){
1216       pMem->zMalloc = pMem->z;
1217       pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
1218     }else{
1219       pMem->xDel = xDel;
1220       flags |= ((xDel==SQLITE_STATIC)?MEM_Static:MEM_Dyn);
1221     }
1222   }
1223
1224   pMem->n = (int)(nByte & 0x7fffffff);
1225   pMem->flags = flags;
1226   pMem->enc = enc;
1227
1228 #ifndef SQLITE_OMIT_UTF16
1229   if( enc>SQLITE_UTF8 && sqlite3VdbeMemHandleBom(pMem) ){
1230     return SQLITE_NOMEM_BKPT;
1231   }
1232 #endif
1233
1234
1235   return SQLITE_OK;
1236 }
1237
1238 /*
1239 ** Move data out of a btree key or data field and into a Mem structure.
1240 ** The data is payload from the entry that pCur is currently pointing
1241 ** to.  offset and amt determine what portion of the data or key to retrieve.
1242 ** The result is written into the pMem element.
1243 **
1244 ** The pMem object must have been initialized.  This routine will use
1245 ** pMem->zMalloc to hold the content from the btree, if possible.  New
1246 ** pMem->zMalloc space will be allocated if necessary.  The calling routine
1247 ** is responsible for making sure that the pMem object is eventually
1248 ** destroyed.
1249 **
1250 ** If this routine fails for any reason (malloc returns NULL or unable
1251 ** to read from the disk) then the pMem is left in an inconsistent state.
1252 */
1253 int sqlite3VdbeMemFromBtree(
1254   BtCursor *pCur,   /* Cursor pointing at record to retrieve. */
1255   u32 offset,       /* Offset from the start of data to return bytes from. */
1256   u32 amt,          /* Number of bytes to return. */
1257   Mem *pMem         /* OUT: Return data in this Mem structure. */
1258 ){
1259   int rc;
1260   pMem->flags = MEM_Null;
1261   if( sqlite3BtreeMaxRecordSize(pCur)<offset+amt ){
1262     return SQLITE_CORRUPT_BKPT;
1263   }
1264   if( SQLITE_OK==(rc = sqlite3VdbeMemClearAndResize(pMem, amt+1)) ){
1265     rc = sqlite3BtreePayload(pCur, offset, amt, pMem->z);
1266     if( rc==SQLITE_OK ){
1267       pMem->z[amt] = 0;   /* Overrun area used when reading malformed records */
1268       pMem->flags = MEM_Blob;
1269       pMem->n = (int)amt;
1270     }else{
1271       sqlite3VdbeMemRelease(pMem);
1272     }
1273   }
1274   return rc;
1275 }
1276 int sqlite3VdbeMemFromBtreeZeroOffset(
1277   BtCursor *pCur,   /* Cursor pointing at record to retrieve. */
1278   u32 amt,          /* Number of bytes to return. */
1279   Mem *pMem         /* OUT: Return data in this Mem structure. */
1280 ){
1281   u32 available = 0;  /* Number of bytes available on the local btree page */
1282   int rc = SQLITE_OK; /* Return code */
1283
1284   assert( sqlite3BtreeCursorIsValid(pCur) );
1285   assert( !VdbeMemDynamic(pMem) );
1286
1287   /* Note: the calls to BtreeKeyFetch() and DataFetch() below assert()
1288   ** that both the BtShared and database handle mutexes are held. */
1289   assert( !sqlite3VdbeMemIsRowSet(pMem) );
1290   pMem->z = (char *)sqlite3BtreePayloadFetch(pCur, &available);
1291   assert( pMem->z!=0 );
1292
1293   if( amt<=available ){
1294     pMem->flags = MEM_Blob|MEM_Ephem;
1295     pMem->n = (int)amt;
1296   }else{
1297     rc = sqlite3VdbeMemFromBtree(pCur, 0, amt, pMem);
1298   }
1299
1300   return rc;
1301 }
1302
1303 /*
1304 ** The pVal argument is known to be a value other than NULL.
1305 ** Convert it into a string with encoding enc and return a pointer
1306 ** to a zero-terminated version of that string.
1307 */
1308 static SQLITE_NOINLINE const void *valueToText(sqlite3_value* pVal, u8 enc){
1309   assert( pVal!=0 );
1310   assert( pVal->db==0 || sqlite3_mutex_held(pVal->db->mutex) );
1311   assert( (enc&3)==(enc&~SQLITE_UTF16_ALIGNED) );
1312   assert( !sqlite3VdbeMemIsRowSet(pVal) );
1313   assert( (pVal->flags & (MEM_Null))==0 );
1314   if( pVal->flags & (MEM_Blob|MEM_Str) ){
1315     if( ExpandBlob(pVal) ) return 0;
1316     pVal->flags |= MEM_Str;
1317     if( pVal->enc != (enc & ~SQLITE_UTF16_ALIGNED) ){
1318       sqlite3VdbeChangeEncoding(pVal, enc & ~SQLITE_UTF16_ALIGNED);
1319     }
1320     if( (enc & SQLITE_UTF16_ALIGNED)!=0 && 1==(1&SQLITE_PTR_TO_INT(pVal->z)) ){
1321       assert( (pVal->flags & (MEM_Ephem|MEM_Static))!=0 );
1322       if( sqlite3VdbeMemMakeWriteable(pVal)!=SQLITE_OK ){
1323         return 0;
1324       }
1325     }
1326     sqlite3VdbeMemNulTerminate(pVal); /* IMP: R-31275-44060 */
1327   }else{
1328     sqlite3VdbeMemStringify(pVal, enc, 0);
1329     assert( 0==(1&SQLITE_PTR_TO_INT(pVal->z)) );
1330   }
1331   assert(pVal->enc==(enc & ~SQLITE_UTF16_ALIGNED) || pVal->db==0
1332               || pVal->db->mallocFailed );
1333   if( pVal->enc==(enc & ~SQLITE_UTF16_ALIGNED) ){
1334     assert( sqlite3VdbeMemValidStrRep(pVal) );
1335     return pVal->z;
1336   }else{
1337     return 0;
1338   }
1339 }
1340
1341 /* This function is only available internally, it is not part of the
1342 ** external API. It works in a similar way to sqlite3_value_text(),
1343 ** except the data returned is in the encoding specified by the second
1344 ** parameter, which must be one of SQLITE_UTF16BE, SQLITE_UTF16LE or
1345 ** SQLITE_UTF8.
1346 **
1347 ** (2006-02-16:)  The enc value can be or-ed with SQLITE_UTF16_ALIGNED.
1348 ** If that is the case, then the result must be aligned on an even byte
1349 ** boundary.
1350 */
1351 const void *sqlite3ValueText(sqlite3_value* pVal, u8 enc){
1352   if( !pVal ) return 0;
1353   assert( pVal->db==0 || sqlite3_mutex_held(pVal->db->mutex) );
1354   assert( (enc&3)==(enc&~SQLITE_UTF16_ALIGNED) );
1355   assert( !sqlite3VdbeMemIsRowSet(pVal) );
1356   if( (pVal->flags&(MEM_Str|MEM_Term))==(MEM_Str|MEM_Term) && pVal->enc==enc ){
1357     assert( sqlite3VdbeMemValidStrRep(pVal) );
1358     return pVal->z;
1359   }
1360   if( pVal->flags&MEM_Null ){
1361     return 0;
1362   }
1363   return valueToText(pVal, enc);
1364 }
1365
1366 /*
1367 ** Create a new sqlite3_value object.
1368 */
1369 sqlite3_value *sqlite3ValueNew(sqlite3 *db){
1370   Mem *p = sqlite3DbMallocZero(db, sizeof(*p));
1371   if( p ){
1372     p->flags = MEM_Null;
1373     p->db = db;
1374   }
1375   return p;
1376 }
1377
1378 /*
1379 ** Context object passed by sqlite3Stat4ProbeSetValue() through to
1380 ** valueNew(). See comments above valueNew() for details.
1381 */
1382 struct ValueNewStat4Ctx {
1383   Parse *pParse;
1384   Index *pIdx;
1385   UnpackedRecord **ppRec;
1386   int iVal;
1387 };
1388
1389 /*
1390 ** Allocate and return a pointer to a new sqlite3_value object. If
1391 ** the second argument to this function is NULL, the object is allocated
1392 ** by calling sqlite3ValueNew().
1393 **
1394 ** Otherwise, if the second argument is non-zero, then this function is
1395 ** being called indirectly by sqlite3Stat4ProbeSetValue(). If it has not
1396 ** already been allocated, allocate the UnpackedRecord structure that
1397 ** that function will return to its caller here. Then return a pointer to
1398 ** an sqlite3_value within the UnpackedRecord.a[] array.
1399 */
1400 static sqlite3_value *valueNew(sqlite3 *db, struct ValueNewStat4Ctx *p){
1401 #ifdef SQLITE_ENABLE_STAT4
1402   if( p ){
1403     UnpackedRecord *pRec = p->ppRec[0];
1404
1405     if( pRec==0 ){
1406       Index *pIdx = p->pIdx;      /* Index being probed */
1407       int nByte;                  /* Bytes of space to allocate */
1408       int i;                      /* Counter variable */
1409       int nCol = pIdx->nColumn;   /* Number of index columns including rowid */
1410
1411       nByte = sizeof(Mem) * nCol + ROUND8(sizeof(UnpackedRecord));
1412       pRec = (UnpackedRecord*)sqlite3DbMallocZero(db, nByte);
1413       if( pRec ){
1414         pRec->pKeyInfo = sqlite3KeyInfoOfIndex(p->pParse, pIdx);
1415         if( pRec->pKeyInfo ){
1416           assert( pRec->pKeyInfo->nAllField==nCol );
1417           assert( pRec->pKeyInfo->enc==ENC(db) );
1418           pRec->aMem = (Mem *)((u8*)pRec + ROUND8(sizeof(UnpackedRecord)));
1419           for(i=0; i<nCol; i++){
1420             pRec->aMem[i].flags = MEM_Null;
1421             pRec->aMem[i].db = db;
1422           }
1423         }else{
1424           sqlite3DbFreeNN(db, pRec);
1425           pRec = 0;
1426         }
1427       }
1428       if( pRec==0 ) return 0;
1429       p->ppRec[0] = pRec;
1430     }
1431
1432     pRec->nField = p->iVal+1;
1433     return &pRec->aMem[p->iVal];
1434   }
1435 #else
1436   UNUSED_PARAMETER(p);
1437 #endif /* defined(SQLITE_ENABLE_STAT4) */
1438   return sqlite3ValueNew(db);
1439 }
1440
1441 /*
1442 ** The expression object indicated by the second argument is guaranteed
1443 ** to be a scalar SQL function. If
1444 **
1445 **   * all function arguments are SQL literals,
1446 **   * one of the SQLITE_FUNC_CONSTANT or _SLOCHNG function flags is set, and
1447 **   * the SQLITE_FUNC_NEEDCOLL function flag is not set,
1448 **
1449 ** then this routine attempts to invoke the SQL function. Assuming no
1450 ** error occurs, output parameter (*ppVal) is set to point to a value
1451 ** object containing the result before returning SQLITE_OK.
1452 **
1453 ** Affinity aff is applied to the result of the function before returning.
1454 ** If the result is a text value, the sqlite3_value object uses encoding
1455 ** enc.
1456 **
1457 ** If the conditions above are not met, this function returns SQLITE_OK
1458 ** and sets (*ppVal) to NULL. Or, if an error occurs, (*ppVal) is set to
1459 ** NULL and an SQLite error code returned.
1460 */
1461 #ifdef SQLITE_ENABLE_STAT4
1462 static int valueFromFunction(
1463   sqlite3 *db,                    /* The database connection */
1464   const Expr *p,                  /* The expression to evaluate */
1465   u8 enc,                         /* Encoding to use */
1466   u8 aff,                         /* Affinity to use */
1467   sqlite3_value **ppVal,          /* Write the new value here */
1468   struct ValueNewStat4Ctx *pCtx   /* Second argument for valueNew() */
1469 ){
1470   sqlite3_context ctx;            /* Context object for function invocation */
1471   sqlite3_value **apVal = 0;      /* Function arguments */
1472   int nVal = 0;                   /* Size of apVal[] array */
1473   FuncDef *pFunc = 0;             /* Function definition */
1474   sqlite3_value *pVal = 0;        /* New value */
1475   int rc = SQLITE_OK;             /* Return code */
1476   ExprList *pList = 0;            /* Function arguments */
1477   int i;                          /* Iterator variable */
1478
1479   assert( pCtx!=0 );
1480   assert( (p->flags & EP_TokenOnly)==0 );
1481   assert( ExprUseXList(p) );
1482   pList = p->x.pList;
1483   if( pList ) nVal = pList->nExpr;
1484   assert( !ExprHasProperty(p, EP_IntValue) );
1485   pFunc = sqlite3FindFunction(db, p->u.zToken, nVal, enc, 0);
1486   assert( pFunc );
1487   if( (pFunc->funcFlags & (SQLITE_FUNC_CONSTANT|SQLITE_FUNC_SLOCHNG))==0
1488    || (pFunc->funcFlags & SQLITE_FUNC_NEEDCOLL)
1489   ){
1490     return SQLITE_OK;
1491   }
1492
1493   if( pList ){
1494     apVal = (sqlite3_value**)sqlite3DbMallocZero(db, sizeof(apVal[0]) * nVal);
1495     if( apVal==0 ){
1496       rc = SQLITE_NOMEM_BKPT;
1497       goto value_from_function_out;
1498     }
1499     for(i=0; i<nVal; i++){
1500       rc = sqlite3ValueFromExpr(db, pList->a[i].pExpr, enc, aff, &apVal[i]);
1501       if( apVal[i]==0 || rc!=SQLITE_OK ) goto value_from_function_out;
1502     }
1503   }
1504
1505   pVal = valueNew(db, pCtx);
1506   if( pVal==0 ){
1507     rc = SQLITE_NOMEM_BKPT;
1508     goto value_from_function_out;
1509   }
1510
1511   memset(&ctx, 0, sizeof(ctx));
1512   ctx.pOut = pVal;
1513   ctx.pFunc = pFunc;
1514   ctx.enc = ENC(db);
1515   pFunc->xSFunc(&ctx, nVal, apVal);
1516   if( ctx.isError ){
1517     rc = ctx.isError;
1518     sqlite3ErrorMsg(pCtx->pParse, "%s", sqlite3_value_text(pVal));
1519   }else{
1520     sqlite3ValueApplyAffinity(pVal, aff, SQLITE_UTF8);
1521     assert( rc==SQLITE_OK );
1522     assert( enc==pVal->enc
1523          || (pVal->flags & MEM_Str)==0
1524          || db->mallocFailed  );
1525 #if 0  /* Not reachable except after a prior failure */
1526     rc = sqlite3VdbeChangeEncoding(pVal, enc);
1527     if( rc==SQLITE_OK && sqlite3VdbeMemTooBig(pVal) ){
1528       rc = SQLITE_TOOBIG;
1529       pCtx->pParse->nErr++;
1530     }
1531 #endif
1532   }
1533
1534  value_from_function_out:
1535   if( rc!=SQLITE_OK ){
1536     pVal = 0;
1537     pCtx->pParse->rc = rc;
1538   }
1539   if( apVal ){
1540     for(i=0; i<nVal; i++){
1541       sqlite3ValueFree(apVal[i]);
1542     }
1543     sqlite3DbFreeNN(db, apVal);
1544   }
1545
1546   *ppVal = pVal;
1547   return rc;
1548 }
1549 #else
1550 # define valueFromFunction(a,b,c,d,e,f) SQLITE_OK
1551 #endif /* defined(SQLITE_ENABLE_STAT4) */
1552
1553 /*
1554 ** Extract a value from the supplied expression in the manner described
1555 ** above sqlite3ValueFromExpr(). Allocate the sqlite3_value object
1556 ** using valueNew().
1557 **
1558 ** If pCtx is NULL and an error occurs after the sqlite3_value object
1559 ** has been allocated, it is freed before returning. Or, if pCtx is not
1560 ** NULL, it is assumed that the caller will free any allocated object
1561 ** in all cases.
1562 */
1563 static int valueFromExpr(
1564   sqlite3 *db,                    /* The database connection */
1565   const Expr *pExpr,              /* The expression to evaluate */
1566   u8 enc,                         /* Encoding to use */
1567   u8 affinity,                    /* Affinity to use */
1568   sqlite3_value **ppVal,          /* Write the new value here */
1569   struct ValueNewStat4Ctx *pCtx   /* Second argument for valueNew() */
1570 ){
1571   int op;
1572   char *zVal = 0;
1573   sqlite3_value *pVal = 0;
1574   int negInt = 1;
1575   const char *zNeg = "";
1576   int rc = SQLITE_OK;
1577
1578   assert( pExpr!=0 );
1579   while( (op = pExpr->op)==TK_UPLUS || op==TK_SPAN ) pExpr = pExpr->pLeft;
1580   if( op==TK_REGISTER ) op = pExpr->op2;
1581
1582   /* Compressed expressions only appear when parsing the DEFAULT clause
1583   ** on a table column definition, and hence only when pCtx==0.  This
1584   ** check ensures that an EP_TokenOnly expression is never passed down
1585   ** into valueFromFunction(). */
1586   assert( (pExpr->flags & EP_TokenOnly)==0 || pCtx==0 );
1587
1588   if( op==TK_CAST ){
1589     u8 aff;
1590     assert( !ExprHasProperty(pExpr, EP_IntValue) );
1591     aff = sqlite3AffinityType(pExpr->u.zToken,0);
1592     rc = valueFromExpr(db, pExpr->pLeft, enc, aff, ppVal, pCtx);
1593     testcase( rc!=SQLITE_OK );
1594     if( *ppVal ){
1595       sqlite3VdbeMemCast(*ppVal, aff, enc);
1596       sqlite3ValueApplyAffinity(*ppVal, affinity, enc);
1597     }
1598     return rc;
1599   }
1600
1601   /* Handle negative integers in a single step.  This is needed in the
1602   ** case when the value is -9223372036854775808.
1603   */
1604   if( op==TK_UMINUS
1605    && (pExpr->pLeft->op==TK_INTEGER || pExpr->pLeft->op==TK_FLOAT) ){
1606     pExpr = pExpr->pLeft;
1607     op = pExpr->op;
1608     negInt = -1;
1609     zNeg = "-";
1610   }
1611
1612   if( op==TK_STRING || op==TK_FLOAT || op==TK_INTEGER ){
1613     pVal = valueNew(db, pCtx);
1614     if( pVal==0 ) goto no_mem;
1615     if( ExprHasProperty(pExpr, EP_IntValue) ){
1616       sqlite3VdbeMemSetInt64(pVal, (i64)pExpr->u.iValue*negInt);
1617     }else{
1618       zVal = sqlite3MPrintf(db, "%s%s", zNeg, pExpr->u.zToken);
1619       if( zVal==0 ) goto no_mem;
1620       sqlite3ValueSetStr(pVal, -1, zVal, SQLITE_UTF8, SQLITE_DYNAMIC);
1621     }
1622     if( (op==TK_INTEGER || op==TK_FLOAT ) && affinity==SQLITE_AFF_BLOB ){
1623       sqlite3ValueApplyAffinity(pVal, SQLITE_AFF_NUMERIC, SQLITE_UTF8);
1624     }else{
1625       sqlite3ValueApplyAffinity(pVal, affinity, SQLITE_UTF8);
1626     }
1627     assert( (pVal->flags & MEM_IntReal)==0 );
1628     if( pVal->flags & (MEM_Int|MEM_IntReal|MEM_Real) ){
1629       testcase( pVal->flags & MEM_Int );
1630       testcase( pVal->flags & MEM_Real );
1631       pVal->flags &= ~MEM_Str;
1632     }
1633     if( enc!=SQLITE_UTF8 ){
1634       rc = sqlite3VdbeChangeEncoding(pVal, enc);
1635     }
1636   }else if( op==TK_UMINUS ) {
1637     /* This branch happens for multiple negative signs.  Ex: -(-5) */
1638     if( SQLITE_OK==valueFromExpr(db,pExpr->pLeft,enc,affinity,&pVal,pCtx)
1639      && pVal!=0
1640     ){
1641       sqlite3VdbeMemNumerify(pVal);
1642       if( pVal->flags & MEM_Real ){
1643         pVal->u.r = -pVal->u.r;
1644       }else if( pVal->u.i==SMALLEST_INT64 ){
1645 #ifndef SQLITE_OMIT_FLOATING_POINT
1646         pVal->u.r = -(double)SMALLEST_INT64;
1647 #else
1648         pVal->u.r = LARGEST_INT64;
1649 #endif
1650         MemSetTypeFlag(pVal, MEM_Real);
1651       }else{
1652         pVal->u.i = -pVal->u.i;
1653       }
1654       sqlite3ValueApplyAffinity(pVal, affinity, enc);
1655     }
1656   }else if( op==TK_NULL ){
1657     pVal = valueNew(db, pCtx);
1658     if( pVal==0 ) goto no_mem;
1659     sqlite3VdbeMemSetNull(pVal);
1660   }
1661 #ifndef SQLITE_OMIT_BLOB_LITERAL
1662   else if( op==TK_BLOB ){
1663     int nVal;
1664     assert( !ExprHasProperty(pExpr, EP_IntValue) );
1665     assert( pExpr->u.zToken[0]=='x' || pExpr->u.zToken[0]=='X' );
1666     assert( pExpr->u.zToken[1]=='\'' );
1667     pVal = valueNew(db, pCtx);
1668     if( !pVal ) goto no_mem;
1669     zVal = &pExpr->u.zToken[2];
1670     nVal = sqlite3Strlen30(zVal)-1;
1671     assert( zVal[nVal]=='\'' );
1672     sqlite3VdbeMemSetStr(pVal, sqlite3HexToBlob(db, zVal, nVal), nVal/2,
1673                          0, SQLITE_DYNAMIC);
1674   }
1675 #endif
1676 #ifdef SQLITE_ENABLE_STAT4
1677   else if( op==TK_FUNCTION && pCtx!=0 ){
1678     rc = valueFromFunction(db, pExpr, enc, affinity, &pVal, pCtx);
1679   }
1680 #endif
1681   else if( op==TK_TRUEFALSE ){
1682     assert( !ExprHasProperty(pExpr, EP_IntValue) );
1683     pVal = valueNew(db, pCtx);
1684     if( pVal ){
1685       pVal->flags = MEM_Int;
1686       pVal->u.i = pExpr->u.zToken[4]==0;
1687     }
1688   }
1689
1690   *ppVal = pVal;
1691   return rc;
1692
1693 no_mem:
1694 #ifdef SQLITE_ENABLE_STAT4
1695   if( pCtx==0 || NEVER(pCtx->pParse->nErr==0) )
1696 #endif
1697     sqlite3OomFault(db);
1698   sqlite3DbFree(db, zVal);
1699   assert( *ppVal==0 );
1700 #ifdef SQLITE_ENABLE_STAT4
1701   if( pCtx==0 ) sqlite3ValueFree(pVal);
1702 #else
1703   assert( pCtx==0 ); sqlite3ValueFree(pVal);
1704 #endif
1705   return SQLITE_NOMEM_BKPT;
1706 }
1707
1708 /*
1709 ** Create a new sqlite3_value object, containing the value of pExpr.
1710 **
1711 ** This only works for very simple expressions that consist of one constant
1712 ** token (i.e. "5", "5.1", "'a string'"). If the expression can
1713 ** be converted directly into a value, then the value is allocated and
1714 ** a pointer written to *ppVal. The caller is responsible for deallocating
1715 ** the value by passing it to sqlite3ValueFree() later on. If the expression
1716 ** cannot be converted to a value, then *ppVal is set to NULL.
1717 */
1718 int sqlite3ValueFromExpr(
1719   sqlite3 *db,              /* The database connection */
1720   const Expr *pExpr,        /* The expression to evaluate */
1721   u8 enc,                   /* Encoding to use */
1722   u8 affinity,              /* Affinity to use */
1723   sqlite3_value **ppVal     /* Write the new value here */
1724 ){
1725   return pExpr ? valueFromExpr(db, pExpr, enc, affinity, ppVal, 0) : 0;
1726 }
1727
1728 #ifdef SQLITE_ENABLE_STAT4
1729 /*
1730 ** Attempt to extract a value from pExpr and use it to construct *ppVal.
1731 **
1732 ** If pAlloc is not NULL, then an UnpackedRecord object is created for
1733 ** pAlloc if one does not exist and the new value is added to the
1734 ** UnpackedRecord object.
1735 **
1736 ** A value is extracted in the following cases:
1737 **
1738 **  * (pExpr==0). In this case the value is assumed to be an SQL NULL,
1739 **
1740 **  * The expression is a bound variable, and this is a reprepare, or
1741 **
1742 **  * The expression is a literal value.
1743 **
1744 ** On success, *ppVal is made to point to the extracted value.  The caller
1745 ** is responsible for ensuring that the value is eventually freed.
1746 */
1747 static int stat4ValueFromExpr(
1748   Parse *pParse,                  /* Parse context */
1749   Expr *pExpr,                    /* The expression to extract a value from */
1750   u8 affinity,                    /* Affinity to use */
1751   struct ValueNewStat4Ctx *pAlloc,/* How to allocate space.  Or NULL */
1752   sqlite3_value **ppVal           /* OUT: New value object (or NULL) */
1753 ){
1754   int rc = SQLITE_OK;
1755   sqlite3_value *pVal = 0;
1756   sqlite3 *db = pParse->db;
1757
1758   /* Skip over any TK_COLLATE nodes */
1759   pExpr = sqlite3ExprSkipCollate(pExpr);
1760
1761   assert( pExpr==0 || pExpr->op!=TK_REGISTER || pExpr->op2!=TK_VARIABLE );
1762   if( !pExpr ){
1763     pVal = valueNew(db, pAlloc);
1764     if( pVal ){
1765       sqlite3VdbeMemSetNull((Mem*)pVal);
1766     }
1767   }else if( pExpr->op==TK_VARIABLE && (db->flags & SQLITE_EnableQPSG)==0 ){
1768     Vdbe *v;
1769     int iBindVar = pExpr->iColumn;
1770     sqlite3VdbeSetVarmask(pParse->pVdbe, iBindVar);
1771     if( (v = pParse->pReprepare)!=0 ){
1772       pVal = valueNew(db, pAlloc);
1773       if( pVal ){
1774         rc = sqlite3VdbeMemCopy((Mem*)pVal, &v->aVar[iBindVar-1]);
1775         sqlite3ValueApplyAffinity(pVal, affinity, ENC(db));
1776         pVal->db = pParse->db;
1777       }
1778     }
1779   }else{
1780     rc = valueFromExpr(db, pExpr, ENC(db), affinity, &pVal, pAlloc);
1781   }
1782
1783   assert( pVal==0 || pVal->db==db );
1784   *ppVal = pVal;
1785   return rc;
1786 }
1787
1788 /*
1789 ** This function is used to allocate and populate UnpackedRecord
1790 ** structures intended to be compared against sample index keys stored
1791 ** in the sqlite_stat4 table.
1792 **
1793 ** A single call to this function populates zero or more fields of the
1794 ** record starting with field iVal (fields are numbered from left to
1795 ** right starting with 0). A single field is populated if:
1796 **
1797 **  * (pExpr==0). In this case the value is assumed to be an SQL NULL,
1798 **
1799 **  * The expression is a bound variable, and this is a reprepare, or
1800 **
1801 **  * The sqlite3ValueFromExpr() function is able to extract a value
1802 **    from the expression (i.e. the expression is a literal value).
1803 **
1804 ** Or, if pExpr is a TK_VECTOR, one field is populated for each of the
1805 ** vector components that match either of the two latter criteria listed
1806 ** above.
1807 **
1808 ** Before any value is appended to the record, the affinity of the
1809 ** corresponding column within index pIdx is applied to it. Before
1810 ** this function returns, output parameter *pnExtract is set to the
1811 ** number of values appended to the record.
1812 **
1813 ** When this function is called, *ppRec must either point to an object
1814 ** allocated by an earlier call to this function, or must be NULL. If it
1815 ** is NULL and a value can be successfully extracted, a new UnpackedRecord
1816 ** is allocated (and *ppRec set to point to it) before returning.
1817 **
1818 ** Unless an error is encountered, SQLITE_OK is returned. It is not an
1819 ** error if a value cannot be extracted from pExpr. If an error does
1820 ** occur, an SQLite error code is returned.
1821 */
1822 int sqlite3Stat4ProbeSetValue(
1823   Parse *pParse,                  /* Parse context */
1824   Index *pIdx,                    /* Index being probed */
1825   UnpackedRecord **ppRec,         /* IN/OUT: Probe record */
1826   Expr *pExpr,                    /* The expression to extract a value from */
1827   int nElem,                      /* Maximum number of values to append */
1828   int iVal,                       /* Array element to populate */
1829   int *pnExtract                  /* OUT: Values appended to the record */
1830 ){
1831   int rc = SQLITE_OK;
1832   int nExtract = 0;
1833
1834   if( pExpr==0 || pExpr->op!=TK_SELECT ){
1835     int i;
1836     struct ValueNewStat4Ctx alloc;
1837
1838     alloc.pParse = pParse;
1839     alloc.pIdx = pIdx;
1840     alloc.ppRec = ppRec;
1841
1842     for(i=0; i<nElem; i++){
1843       sqlite3_value *pVal = 0;
1844       Expr *pElem = (pExpr ? sqlite3VectorFieldSubexpr(pExpr, i) : 0);
1845       u8 aff = sqlite3IndexColumnAffinity(pParse->db, pIdx, iVal+i);
1846       alloc.iVal = iVal+i;
1847       rc = stat4ValueFromExpr(pParse, pElem, aff, &alloc, &pVal);
1848       if( !pVal ) break;
1849       nExtract++;
1850     }
1851   }
1852
1853   *pnExtract = nExtract;
1854   return rc;
1855 }
1856
1857 /*
1858 ** Attempt to extract a value from expression pExpr using the methods
1859 ** as described for sqlite3Stat4ProbeSetValue() above.
1860 **
1861 ** If successful, set *ppVal to point to a new value object and return
1862 ** SQLITE_OK. If no value can be extracted, but no other error occurs
1863 ** (e.g. OOM), return SQLITE_OK and set *ppVal to NULL. Or, if an error
1864 ** does occur, return an SQLite error code. The final value of *ppVal
1865 ** is undefined in this case.
1866 */
1867 int sqlite3Stat4ValueFromExpr(
1868   Parse *pParse,                  /* Parse context */
1869   Expr *pExpr,                    /* The expression to extract a value from */
1870   u8 affinity,                    /* Affinity to use */
1871   sqlite3_value **ppVal           /* OUT: New value object (or NULL) */
1872 ){
1873   return stat4ValueFromExpr(pParse, pExpr, affinity, 0, ppVal);
1874 }
1875
1876 /*
1877 ** Extract the iCol-th column from the nRec-byte record in pRec.  Write
1878 ** the column value into *ppVal.  If *ppVal is initially NULL then a new
1879 ** sqlite3_value object is allocated.
1880 **
1881 ** If *ppVal is initially NULL then the caller is responsible for
1882 ** ensuring that the value written into *ppVal is eventually freed.
1883 */
1884 int sqlite3Stat4Column(
1885   sqlite3 *db,                    /* Database handle */
1886   const void *pRec,               /* Pointer to buffer containing record */
1887   int nRec,                       /* Size of buffer pRec in bytes */
1888   int iCol,                       /* Column to extract */
1889   sqlite3_value **ppVal           /* OUT: Extracted value */
1890 ){
1891   u32 t = 0;                      /* a column type code */
1892   int nHdr;                       /* Size of the header in the record */
1893   int iHdr;                       /* Next unread header byte */
1894   int iField;                     /* Next unread data byte */
1895   int szField = 0;                /* Size of the current data field */
1896   int i;                          /* Column index */
1897   u8 *a = (u8*)pRec;              /* Typecast byte array */
1898   Mem *pMem = *ppVal;             /* Write result into this Mem object */
1899
1900   assert( iCol>0 );
1901   iHdr = getVarint32(a, nHdr);
1902   if( nHdr>nRec || iHdr>=nHdr ) return SQLITE_CORRUPT_BKPT;
1903   iField = nHdr;
1904   for(i=0; i<=iCol; i++){
1905     iHdr += getVarint32(&a[iHdr], t);
1906     testcase( iHdr==nHdr );
1907     testcase( iHdr==nHdr+1 );
1908     if( iHdr>nHdr ) return SQLITE_CORRUPT_BKPT;
1909     szField = sqlite3VdbeSerialTypeLen(t);
1910     iField += szField;
1911   }
1912   testcase( iField==nRec );
1913   testcase( iField==nRec+1 );
1914   if( iField>nRec ) return SQLITE_CORRUPT_BKPT;
1915   if( pMem==0 ){
1916     pMem = *ppVal = sqlite3ValueNew(db);
1917     if( pMem==0 ) return SQLITE_NOMEM_BKPT;
1918   }
1919   sqlite3VdbeSerialGet(&a[iField-szField], t, pMem);
1920   pMem->enc = ENC(db);
1921   return SQLITE_OK;
1922 }
1923
1924 /*
1925 ** Unless it is NULL, the argument must be an UnpackedRecord object returned
1926 ** by an earlier call to sqlite3Stat4ProbeSetValue(). This call deletes
1927 ** the object.
1928 */
1929 void sqlite3Stat4ProbeFree(UnpackedRecord *pRec){
1930   if( pRec ){
1931     int i;
1932     int nCol = pRec->pKeyInfo->nAllField;
1933     Mem *aMem = pRec->aMem;
1934     sqlite3 *db = aMem[0].db;
1935     for(i=0; i<nCol; i++){
1936       sqlite3VdbeMemRelease(&aMem[i]);
1937     }
1938     sqlite3KeyInfoUnref(pRec->pKeyInfo);
1939     sqlite3DbFreeNN(db, pRec);
1940   }
1941 }
1942 #endif /* ifdef SQLITE_ENABLE_STAT4 */
1943
1944 /*
1945 ** Change the string value of an sqlite3_value object
1946 */
1947 void sqlite3ValueSetStr(
1948   sqlite3_value *v,     /* Value to be set */
1949   int n,                /* Length of string z */
1950   const void *z,        /* Text of the new string */
1951   u8 enc,               /* Encoding to use */
1952   void (*xDel)(void*)   /* Destructor for the string */
1953 ){
1954   if( v ) sqlite3VdbeMemSetStr((Mem *)v, z, n, enc, xDel);
1955 }
1956
1957 /*
1958 ** Free an sqlite3_value object
1959 */
1960 void sqlite3ValueFree(sqlite3_value *v){
1961   if( !v ) return;
1962   sqlite3VdbeMemRelease((Mem *)v);
1963   sqlite3DbFreeNN(((Mem*)v)->db, v);
1964 }
1965
1966 /*
1967 ** The sqlite3ValueBytes() routine returns the number of bytes in the
1968 ** sqlite3_value object assuming that it uses the encoding "enc".
1969 ** The valueBytes() routine is a helper function.
1970 */
1971 static SQLITE_NOINLINE int valueBytes(sqlite3_value *pVal, u8 enc){
1972   return valueToText(pVal, enc)!=0 ? pVal->n : 0;
1973 }
1974 int sqlite3ValueBytes(sqlite3_value *pVal, u8 enc){
1975   Mem *p = (Mem*)pVal;
1976   assert( (p->flags & MEM_Null)==0 || (p->flags & (MEM_Str|MEM_Blob))==0 );
1977   if( (p->flags & MEM_Str)!=0 && pVal->enc==enc ){
1978     return p->n;
1979   }
1980   if( (p->flags & MEM_Str)!=0 && enc!=SQLITE_UTF8 && pVal->enc!=SQLITE_UTF8 ){
1981     return p->n;
1982   }
1983   if( (p->flags & MEM_Blob)!=0 ){
1984     if( p->flags & MEM_Zero ){
1985       return p->n + p->u.nZero;
1986     }else{
1987       return p->n;
1988     }
1989   }
1990   if( p->flags & MEM_Null ) return 0;
1991   return valueBytes(pVal, enc);
1992 }