xref: /illumos-gate/usr/src/lib/libsqlite/src/vdbe.c (revision 88e1588b)
1 /*
2  * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7 ** 2001 September 15
8 **
9 ** The author disclaims copyright to this source code.  In place of
10 ** a legal notice, here is a blessing:
11 **
12 **    May you do good and not evil.
13 **    May you find forgiveness for yourself and forgive others.
14 **    May you share freely, never taking more than you give.
15 **
16 *************************************************************************
17 ** The code in this file implements execution method of the
18 ** Virtual Database Engine (VDBE).  A separate file ("vdbeaux.c")
19 ** handles housekeeping details such as creating and deleting
20 ** VDBE instances.  This file is solely interested in executing
21 ** the VDBE program.
22 **
23 ** In the external interface, an "sqlite_vm*" is an opaque pointer
24 ** to a VDBE.
25 **
26 ** The SQL parser generates a program which is then executed by
27 ** the VDBE to do the work of the SQL statement.  VDBE programs are
28 ** similar in form to assembly language.  The program consists of
29 ** a linear sequence of operations.  Each operation has an opcode
30 ** and 3 operands.  Operands P1 and P2 are integers.  Operand P3
31 ** is a null-terminated string.   The P2 operand must be non-negative.
32 ** Opcodes will typically ignore one or more operands.  Many opcodes
33 ** ignore all three operands.
34 **
35 ** Computation results are stored on a stack.  Each entry on the
36 ** stack is either an integer, a null-terminated string, a floating point
37 ** number, or the SQL "NULL" value.  An inplicit conversion from one
38 ** type to the other occurs as necessary.
39 **
40 ** Most of the code in this file is taken up by the sqliteVdbeExec()
41 ** function which does the work of interpreting a VDBE program.
42 ** But other routines are also provided to help in building up
43 ** a program instruction by instruction.
44 **
45 ** Various scripts scan this source file in order to generate HTML
46 ** documentation, headers files, or other derived files.  The formatting
47 ** of the code in this file is, therefore, important.  See other comments
48 ** in this file for details.  If in doubt, do not deviate from existing
49 ** commenting and indentation practices when changing or adding code.
50 **
51 ** $Id: vdbe.c,v 1.268.2.3 2004/07/19 19:30:50 drh Exp $
52 */
53 #include "sqliteInt.h"
54 #include "os.h"
55 #include <ctype.h>
56 #include "vdbeInt.h"
57 
58 /*
59 ** The following global variable is incremented every time a cursor
60 ** moves, either by the OP_MoveTo or the OP_Next opcode.  The test
61 ** procedures use this information to make sure that indices are
62 ** working correctly.  This variable has no function other than to
63 ** help verify the correct operation of the library.
64 */
65 int sqlite_search_count = 0;
66 
67 /*
68 ** When this global variable is positive, it gets decremented once before
69 ** each instruction in the VDBE.  When reaches zero, the SQLITE_Interrupt
70 ** of the db.flags field is set in order to simulate an interrupt.
71 **
72 ** This facility is used for testing purposes only.  It does not function
73 ** in an ordinary build.
74 */
75 int sqlite_interrupt_count = 0;
76 
77 /*
78 ** Advance the virtual machine to the next output row.
79 **
80 ** The return vale will be either SQLITE_BUSY, SQLITE_DONE,
81 ** SQLITE_ROW, SQLITE_ERROR, or SQLITE_MISUSE.
82 **
83 ** SQLITE_BUSY means that the virtual machine attempted to open
84 ** a locked database and there is no busy callback registered.
85 ** Call sqlite_step() again to retry the open.  *pN is set to 0
86 ** and *pazColName and *pazValue are both set to NULL.
87 **
88 ** SQLITE_DONE means that the virtual machine has finished
89 ** executing.  sqlite_step() should not be called again on this
90 ** virtual machine.  *pN and *pazColName are set appropriately
91 ** but *pazValue is set to NULL.
92 **
93 ** SQLITE_ROW means that the virtual machine has generated another
94 ** row of the result set.  *pN is set to the number of columns in
95 ** the row.  *pazColName is set to the names of the columns followed
96 ** by the column datatypes.  *pazValue is set to the values of each
97 ** column in the row.  The value of the i-th column is (*pazValue)[i].
98 ** The name of the i-th column is (*pazColName)[i] and the datatype
99 ** of the i-th column is (*pazColName)[i+*pN].
100 **
101 ** SQLITE_ERROR means that a run-time error (such as a constraint
102 ** violation) has occurred.  The details of the error will be returned
103 ** by the next call to sqlite_finalize().  sqlite_step() should not
104 ** be called again on the VM.
105 **
106 ** SQLITE_MISUSE means that the this routine was called inappropriately.
107 ** Perhaps it was called on a virtual machine that had already been
108 ** finalized or on one that had previously returned SQLITE_ERROR or
109 ** SQLITE_DONE.  Or it could be the case the the same database connection
110 ** is being used simulataneously by two or more threads.
111 */
sqlite_step(sqlite_vm * pVm,int * pN,const char *** pazValue,const char *** pazColName)112 int sqlite_step(
113   sqlite_vm *pVm,              /* The virtual machine to execute */
114   int *pN,                     /* OUT: Number of columns in result */
115   const char ***pazValue,      /* OUT: Column data */
116   const char ***pazColName     /* OUT: Column names and datatypes */
117 ){
118   Vdbe *p = (Vdbe*)pVm;
119   sqlite *db;
120   int rc;
121 
122   if( p->magic!=VDBE_MAGIC_RUN ){
123     return SQLITE_MISUSE;
124   }
125   db = p->db;
126   if( sqliteSafetyOn(db) ){
127     p->rc = SQLITE_MISUSE;
128     return SQLITE_MISUSE;
129   }
130   if( p->explain ){
131     rc = sqliteVdbeList(p);
132   }else{
133     rc = sqliteVdbeExec(p);
134   }
135   if( rc==SQLITE_DONE || rc==SQLITE_ROW ){
136     if( pazColName ) *pazColName = (const char**)p->azColName;
137     if( pN ) *pN = p->nResColumn;
138   }else{
139     if( pazColName) *pazColName = 0;
140     if( pN ) *pN = 0;
141   }
142   if( pazValue ){
143     if( rc==SQLITE_ROW ){
144       *pazValue = (const char**)p->azResColumn;
145     }else{
146       *pazValue = 0;
147     }
148   }
149   if( sqliteSafetyOff(db) ){
150     return SQLITE_MISUSE;
151   }
152   return rc;
153 }
154 
155 /*
156 ** Insert a new aggregate element and make it the element that
157 ** has focus.
158 **
159 ** Return 0 on success and 1 if memory is exhausted.
160 */
AggInsert(Agg * p,char * zKey,int nKey)161 static int AggInsert(Agg *p, char *zKey, int nKey){
162   AggElem *pElem, *pOld;
163   int i;
164   Mem *pMem;
165   pElem = sqliteMalloc( sizeof(AggElem) + nKey +
166                         (p->nMem-1)*sizeof(pElem->aMem[0]) );
167   if( pElem==0 ) return 1;
168   pElem->zKey = (char*)&pElem->aMem[p->nMem];
169   memcpy(pElem->zKey, zKey, nKey);
170   pElem->nKey = nKey;
171   pOld = sqliteHashInsert(&p->hash, pElem->zKey, pElem->nKey, pElem);
172   if( pOld!=0 ){
173     assert( pOld==pElem );  /* Malloc failed on insert */
174     sqliteFree(pOld);
175     return 0;
176   }
177   for(i=0, pMem=pElem->aMem; i<p->nMem; i++, pMem++){
178     pMem->flags = MEM_Null;
179   }
180   p->pCurrent = pElem;
181   return 0;
182 }
183 
184 /*
185 ** Get the AggElem currently in focus
186 */
187 #define AggInFocus(P)   ((P).pCurrent ? (P).pCurrent : _AggInFocus(&(P)))
_AggInFocus(Agg * p)188 static AggElem *_AggInFocus(Agg *p){
189   HashElem *pElem = sqliteHashFirst(&p->hash);
190   if( pElem==0 ){
191     AggInsert(p,"",1);
192     pElem = sqliteHashFirst(&p->hash);
193   }
194   return pElem ? sqliteHashData(pElem) : 0;
195 }
196 
197 /*
198 ** Convert the given stack entity into a string if it isn't one
199 ** already.
200 */
201 #define Stringify(P) if(((P)->flags & MEM_Str)==0){hardStringify(P);}
hardStringify(Mem * pStack)202 static int hardStringify(Mem *pStack){
203   int fg = pStack->flags;
204   if( fg & MEM_Real ){
205     sqlite_snprintf(sizeof(pStack->zShort),pStack->zShort,"%.15g",pStack->r);
206   }else if( fg & MEM_Int ){
207     sqlite_snprintf(sizeof(pStack->zShort),pStack->zShort,"%d",pStack->i);
208   }else{
209     pStack->zShort[0] = 0;
210   }
211   pStack->z = pStack->zShort;
212   pStack->n = strlen(pStack->zShort)+1;
213   pStack->flags = MEM_Str | MEM_Short;
214   return 0;
215 }
216 
217 /*
218 ** Convert the given stack entity into a string that has been obtained
219 ** from sqliteMalloc().  This is different from Stringify() above in that
220 ** Stringify() will use the NBFS bytes of static string space if the string
221 ** will fit but this routine always mallocs for space.
222 ** Return non-zero if we run out of memory.
223 */
224 #define Dynamicify(P) (((P)->flags & MEM_Dyn)==0 ? hardDynamicify(P):0)
hardDynamicify(Mem * pStack)225 static int hardDynamicify(Mem *pStack){
226   int fg = pStack->flags;
227   char *z;
228   if( (fg & MEM_Str)==0 ){
229     hardStringify(pStack);
230   }
231   assert( (fg & MEM_Dyn)==0 );
232   z = sqliteMallocRaw( pStack->n );
233   if( z==0 ) return 1;
234   memcpy(z, pStack->z, pStack->n);
235   pStack->z = z;
236   pStack->flags |= MEM_Dyn;
237   return 0;
238 }
239 
240 /*
241 ** An ephemeral string value (signified by the MEM_Ephem flag) contains
242 ** a pointer to a dynamically allocated string where some other entity
243 ** is responsible for deallocating that string.  Because the stack entry
244 ** does not control the string, it might be deleted without the stack
245 ** entry knowing it.
246 **
247 ** This routine converts an ephemeral string into a dynamically allocated
248 ** string that the stack entry itself controls.  In other words, it
249 ** converts an MEM_Ephem string into an MEM_Dyn string.
250 */
251 #define Deephemeralize(P) \
252    if( ((P)->flags&MEM_Ephem)!=0 && hardDeephem(P) ){ goto no_mem;}
hardDeephem(Mem * pStack)253 static int hardDeephem(Mem *pStack){
254   char *z;
255   assert( (pStack->flags & MEM_Ephem)!=0 );
256   z = sqliteMallocRaw( pStack->n );
257   if( z==0 ) return 1;
258   memcpy(z, pStack->z, pStack->n);
259   pStack->z = z;
260   pStack->flags &= ~MEM_Ephem;
261   pStack->flags |= MEM_Dyn;
262   return 0;
263 }
264 
265 /*
266 ** Release the memory associated with the given stack level.  This
267 ** leaves the Mem.flags field in an inconsistent state.
268 */
269 #define	Release(P) \
270 	if ((P)->flags & MEM_Dyn) { \
271 		sqliteFree((P)->z); \
272 		(P)->z = NULL; \
273 	}
274 
275 /*
276 ** Pop the stack N times.
277 */
popStack(Mem ** ppTos,int N)278 static void popStack(Mem **ppTos, int N){
279   Mem *pTos = *ppTos;
280   while( N>0 ){
281     N--;
282     Release(pTos);
283     pTos--;
284   }
285   *ppTos = pTos;
286 }
287 
288 /*
289 ** Return TRUE if zNum is a 32-bit signed integer and write
290 ** the value of the integer into *pNum.  If zNum is not an integer
291 ** or is an integer that is too large to be expressed with just 32
292 ** bits, then return false.
293 **
294 ** Under Linux (RedHat 7.2) this routine is much faster than atoi()
295 ** for converting strings into integers.
296 */
toInt(const char * zNum,int * pNum)297 static int toInt(const char *zNum, int *pNum){
298   int v = 0;
299   int neg;
300   int i, c;
301   if( *zNum=='-' ){
302     neg = 1;
303     zNum++;
304   }else if( *zNum=='+' ){
305     neg = 0;
306     zNum++;
307   }else{
308     neg = 0;
309   }
310   for(i=0; (c=zNum[i])>='0' && c<='9'; i++){
311     v = v*10 + c - '0';
312   }
313   *pNum = neg ? -v : v;
314   return c==0 && i>0 && (i<10 || (i==10 && memcmp(zNum,"2147483647",10)<=0));
315 }
316 
317 /*
318 ** Convert the given stack entity into a integer if it isn't one
319 ** already.
320 **
321 ** Any prior string or real representation is invalidated.
322 ** NULLs are converted into 0.
323 */
324 #define Integerify(P) if(((P)->flags&MEM_Int)==0){ hardIntegerify(P); }
hardIntegerify(Mem * pStack)325 static void hardIntegerify(Mem *pStack){
326   if( pStack->flags & MEM_Real ){
327     pStack->i = (int)pStack->r;
328     Release(pStack);
329   }else if( pStack->flags & MEM_Str ){
330     toInt(pStack->z, &pStack->i);
331     Release(pStack);
332   }else{
333     pStack->i = 0;
334   }
335   pStack->flags = MEM_Int;
336 }
337 
338 /*
339 ** Get a valid Real representation for the given stack element.
340 **
341 ** Any prior string or integer representation is retained.
342 ** NULLs are converted into 0.0.
343 */
344 #define Realify(P) if(((P)->flags&MEM_Real)==0){ hardRealify(P); }
hardRealify(Mem * pStack)345 static void hardRealify(Mem *pStack){
346   if( pStack->flags & MEM_Str ){
347     pStack->r = sqliteAtoF(pStack->z, 0);
348   }else if( pStack->flags & MEM_Int ){
349     pStack->r = pStack->i;
350   }else{
351     pStack->r = 0.0;
352   }
353   pStack->flags |= MEM_Real;
354 }
355 
356 /*
357 ** The parameters are pointers to the head of two sorted lists
358 ** of Sorter structures.  Merge these two lists together and return
359 ** a single sorted list.  This routine forms the core of the merge-sort
360 ** algorithm.
361 **
362 ** In the case of a tie, left sorts in front of right.
363 */
Merge(Sorter * pLeft,Sorter * pRight)364 static Sorter *Merge(Sorter *pLeft, Sorter *pRight){
365   Sorter sHead;
366   Sorter *pTail;
367   pTail = &sHead;
368   pTail->pNext = 0;
369   while( pLeft && pRight ){
370     int c = sqliteSortCompare(pLeft->zKey, pRight->zKey);
371     if( c<=0 ){
372       pTail->pNext = pLeft;
373       pLeft = pLeft->pNext;
374     }else{
375       pTail->pNext = pRight;
376       pRight = pRight->pNext;
377     }
378     pTail = pTail->pNext;
379   }
380   if( pLeft ){
381     pTail->pNext = pLeft;
382   }else if( pRight ){
383     pTail->pNext = pRight;
384   }
385   return sHead.pNext;
386 }
387 
388 /*
389 ** The following routine works like a replacement for the standard
390 ** library routine fgets().  The difference is in how end-of-line (EOL)
391 ** is handled.  Standard fgets() uses LF for EOL under unix, CRLF
392 ** under windows, and CR under mac.  This routine accepts any of these
393 ** character sequences as an EOL mark.  The EOL mark is replaced by
394 ** a single LF character in zBuf.
395 */
vdbe_fgets(char * zBuf,int nBuf,FILE * in)396 static char *vdbe_fgets(char *zBuf, int nBuf, FILE *in){
397   int i, c;
398   for(i=0; i<nBuf-1 && (c=getc(in))!=EOF; i++){
399     zBuf[i] = c;
400     if( c=='\r' || c=='\n' ){
401       if( c=='\r' ){
402         zBuf[i] = '\n';
403         c = getc(in);
404         if( c!=EOF && c!='\n' ) ungetc(c, in);
405       }
406       i++;
407       break;
408     }
409   }
410   zBuf[i]  = 0;
411   return i>0 ? zBuf : 0;
412 }
413 
414 /*
415 ** Make sure there is space in the Vdbe structure to hold at least
416 ** mxCursor cursors.  If there is not currently enough space, then
417 ** allocate more.
418 **
419 ** If a memory allocation error occurs, return 1.  Return 0 if
420 ** everything works.
421 */
expandCursorArraySize(Vdbe * p,int mxCursor)422 static int expandCursorArraySize(Vdbe *p, int mxCursor){
423   if( mxCursor>=p->nCursor ){
424     Cursor *aCsr = sqliteRealloc( p->aCsr, (mxCursor+1)*sizeof(Cursor) );
425     if( aCsr==0 ) return 1;
426     p->aCsr = aCsr;
427     memset(&p->aCsr[p->nCursor], 0, sizeof(Cursor)*(mxCursor+1-p->nCursor));
428     p->nCursor = mxCursor+1;
429   }
430   return 0;
431 }
432 
433 #ifdef VDBE_PROFILE
434 /*
435 ** The following routine only works on pentium-class processors.
436 ** It uses the RDTSC opcode to read cycle count value out of the
437 ** processor and returns that value.  This can be used for high-res
438 ** profiling.
439 */
hwtime(void)440 __inline__ unsigned long long int hwtime(void){
441   unsigned long long int x;
442   __asm__("rdtsc\n\t"
443           "mov %%edx, %%ecx\n\t"
444           :"=A" (x));
445   return x;
446 }
447 #endif
448 
449 /*
450 ** The CHECK_FOR_INTERRUPT macro defined here looks to see if the
451 ** sqlite_interrupt() routine has been called.  If it has been, then
452 ** processing of the VDBE program is interrupted.
453 **
454 ** This macro added to every instruction that does a jump in order to
455 ** implement a loop.  This test used to be on every single instruction,
456 ** but that meant we more testing that we needed.  By only testing the
457 ** flag on jump instructions, we get a (small) speed improvement.
458 */
459 #define CHECK_FOR_INTERRUPT \
460    if( db->flags & SQLITE_Interrupt ) goto abort_due_to_interrupt;
461 
462 
463 /*
464 ** Execute as much of a VDBE program as we can then return.
465 **
466 ** sqliteVdbeMakeReady() must be called before this routine in order to
467 ** close the program with a final OP_Halt and to set up the callbacks
468 ** and the error message pointer.
469 **
470 ** Whenever a row or result data is available, this routine will either
471 ** invoke the result callback (if there is one) or return with
472 ** SQLITE_ROW.
473 **
474 ** If an attempt is made to open a locked database, then this routine
475 ** will either invoke the busy callback (if there is one) or it will
476 ** return SQLITE_BUSY.
477 **
478 ** If an error occurs, an error message is written to memory obtained
479 ** from sqliteMalloc() and p->zErrMsg is made to point to that memory.
480 ** The error code is stored in p->rc and this routine returns SQLITE_ERROR.
481 **
482 ** If the callback ever returns non-zero, then the program exits
483 ** immediately.  There will be no error message but the p->rc field is
484 ** set to SQLITE_ABORT and this routine will return SQLITE_ERROR.
485 **
486 ** A memory allocation error causes p->rc to be set to SQLITE_NOMEM and this
487 ** routine to return SQLITE_ERROR.
488 **
489 ** Other fatal errors return SQLITE_ERROR.
490 **
491 ** After this routine has finished, sqliteVdbeFinalize() should be
492 ** used to clean up the mess that was left behind.
493 */
sqliteVdbeExec(Vdbe * p)494 int sqliteVdbeExec(
495   Vdbe *p                    /* The VDBE */
496 ){
497   int pc;                    /* The program counter */
498   Op *pOp;                   /* Current operation */
499   int rc = SQLITE_OK;        /* Value to return */
500   sqlite *db = p->db;        /* The database */
501   Mem *pTos;                 /* Top entry in the operand stack */
502   char zBuf[100];            /* Space to sprintf() an integer */
503 #ifdef VDBE_PROFILE
504   unsigned long long start;  /* CPU clock count at start of opcode */
505   int origPc;                /* Program counter at start of opcode */
506 #endif
507 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
508   int nProgressOps = 0;      /* Opcodes executed since progress callback. */
509 #endif
510 
511   if( p->magic!=VDBE_MAGIC_RUN ) return SQLITE_MISUSE;
512   assert( db->magic==SQLITE_MAGIC_BUSY );
513   assert( p->rc==SQLITE_OK || p->rc==SQLITE_BUSY );
514   p->rc = SQLITE_OK;
515   assert( p->explain==0 );
516   if( sqlite_malloc_failed ) goto no_mem;
517   pTos = p->pTos;
518   if( p->popStack ){
519     popStack(&pTos, p->popStack);
520     p->popStack = 0;
521   }
522   CHECK_FOR_INTERRUPT;
523   for(pc=p->pc; rc==SQLITE_OK; pc++){
524     assert( pc>=0 && pc<p->nOp );
525     assert( pTos<=&p->aStack[pc] );
526 #ifdef VDBE_PROFILE
527     origPc = pc;
528     start = hwtime();
529 #endif
530     pOp = &p->aOp[pc];
531 
532     /* Only allow tracing if NDEBUG is not defined.
533     */
534 #ifndef NDEBUG
535     if( p->trace ){
536       sqliteVdbePrintOp(p->trace, pc, pOp);
537     }
538 #endif
539 
540     /* Check to see if we need to simulate an interrupt.  This only happens
541     ** if we have a special test build.
542     */
543 #ifdef SQLITE_TEST
544     if( sqlite_interrupt_count>0 ){
545       sqlite_interrupt_count--;
546       if( sqlite_interrupt_count==0 ){
547         sqlite_interrupt(db);
548       }
549     }
550 #endif
551 
552 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
553     /* Call the progress callback if it is configured and the required number
554     ** of VDBE ops have been executed (either since this invocation of
555     ** sqliteVdbeExec() or since last time the progress callback was called).
556     ** If the progress callback returns non-zero, exit the virtual machine with
557     ** a return code SQLITE_ABORT.
558     */
559     if( db->xProgress ){
560       if( db->nProgressOps==nProgressOps ){
561         if( db->xProgress(db->pProgressArg)!=0 ){
562           rc = SQLITE_ABORT;
563           continue; /* skip to the next iteration of the for loop */
564         }
565         nProgressOps = 0;
566       }
567       nProgressOps++;
568     }
569 #endif
570 
571     switch( pOp->opcode ){
572 
573 /*****************************************************************************
574 ** What follows is a massive switch statement where each case implements a
575 ** separate instruction in the virtual machine.  If we follow the usual
576 ** indentation conventions, each case should be indented by 6 spaces.  But
577 ** that is a lot of wasted space on the left margin.  So the code within
578 ** the switch statement will break with convention and be flush-left. Another
579 ** big comment (similar to this one) will mark the point in the code where
580 ** we transition back to normal indentation.
581 **
582 ** The formatting of each case is important.  The makefile for SQLite
583 ** generates two C files "opcodes.h" and "opcodes.c" by scanning this
584 ** file looking for lines that begin with "case OP_".  The opcodes.h files
585 ** will be filled with #defines that give unique integer values to each
586 ** opcode and the opcodes.c file is filled with an array of strings where
587 ** each string is the symbolic name for the corresponding opcode.
588 **
589 ** Documentation about VDBE opcodes is generated by scanning this file
590 ** for lines of that contain "Opcode:".  That line and all subsequent
591 ** comment lines are used in the generation of the opcode.html documentation
592 ** file.
593 **
594 ** SUMMARY:
595 **
596 **     Formatting is important to scripts that scan this file.
597 **     Do not deviate from the formatting style currently in use.
598 **
599 *****************************************************************************/
600 
601 /* Opcode:  Goto * P2 *
602 **
603 ** An unconditional jump to address P2.
604 ** The next instruction executed will be
605 ** the one at index P2 from the beginning of
606 ** the program.
607 */
608 case OP_Goto: {
609   CHECK_FOR_INTERRUPT;
610   pc = pOp->p2 - 1;
611   break;
612 }
613 
614 /* Opcode:  Gosub * P2 *
615 **
616 ** Push the current address plus 1 onto the return address stack
617 ** and then jump to address P2.
618 **
619 ** The return address stack is of limited depth.  If too many
620 ** OP_Gosub operations occur without intervening OP_Returns, then
621 ** the return address stack will fill up and processing will abort
622 ** with a fatal error.
623 */
624 case OP_Gosub: {
625   if( p->returnDepth>=sizeof(p->returnStack)/sizeof(p->returnStack[0]) ){
626     sqliteSetString(&p->zErrMsg, "return address stack overflow", (char*)0);
627     p->rc = SQLITE_INTERNAL;
628     return SQLITE_ERROR;
629   }
630   p->returnStack[p->returnDepth++] = pc+1;
631   pc = pOp->p2 - 1;
632   break;
633 }
634 
635 /* Opcode:  Return * * *
636 **
637 ** Jump immediately to the next instruction after the last unreturned
638 ** OP_Gosub.  If an OP_Return has occurred for all OP_Gosubs, then
639 ** processing aborts with a fatal error.
640 */
641 case OP_Return: {
642   if( p->returnDepth<=0 ){
643     sqliteSetString(&p->zErrMsg, "return address stack underflow", (char*)0);
644     p->rc = SQLITE_INTERNAL;
645     return SQLITE_ERROR;
646   }
647   p->returnDepth--;
648   pc = p->returnStack[p->returnDepth] - 1;
649   break;
650 }
651 
652 /* Opcode:  Halt P1 P2 *
653 **
654 ** Exit immediately.  All open cursors, Lists, Sorts, etc are closed
655 ** automatically.
656 **
657 ** P1 is the result code returned by sqlite_exec().  For a normal
658 ** halt, this should be SQLITE_OK (0).  For errors, it can be some
659 ** other value.  If P1!=0 then P2 will determine whether or not to
660 ** rollback the current transaction.  Do not rollback if P2==OE_Fail.
661 ** Do the rollback if P2==OE_Rollback.  If P2==OE_Abort, then back
662 ** out all changes that have occurred during this execution of the
663 ** VDBE, but do not rollback the transaction.
664 **
665 ** There is an implied "Halt 0 0 0" instruction inserted at the very end of
666 ** every program.  So a jump past the last instruction of the program
667 ** is the same as executing Halt.
668 */
669 case OP_Halt: {
670   p->magic = VDBE_MAGIC_HALT;
671   p->pTos = pTos;
672   if( pOp->p1!=SQLITE_OK ){
673     p->rc = pOp->p1;
674     p->errorAction = pOp->p2;
675     if( pOp->p3 ){
676       sqliteSetString(&p->zErrMsg, pOp->p3, (char*)0);
677     }
678     return SQLITE_ERROR;
679   }else{
680     p->rc = SQLITE_OK;
681     return SQLITE_DONE;
682   }
683 }
684 
685 /* Opcode: Integer P1 * P3
686 **
687 ** The integer value P1 is pushed onto the stack.  If P3 is not zero
688 ** then it is assumed to be a string representation of the same integer.
689 */
690 case OP_Integer: {
691   pTos++;
692   pTos->i = pOp->p1;
693   pTos->flags = MEM_Int;
694   if( pOp->p3 ){
695     pTos->z = pOp->p3;
696     pTos->flags |= MEM_Str | MEM_Static;
697     pTos->n = strlen(pOp->p3)+1;
698   }
699   break;
700 }
701 
702 /* Opcode: String * * P3
703 **
704 ** The string value P3 is pushed onto the stack.  If P3==0 then a
705 ** NULL is pushed onto the stack.
706 */
707 case OP_String: {
708   char *z = pOp->p3;
709   pTos++;
710   if( z==0 ){
711     pTos->flags = MEM_Null;
712   }else{
713     pTos->z = z;
714     pTos->n = strlen(z) + 1;
715     pTos->flags = MEM_Str | MEM_Static;
716   }
717   break;
718 }
719 
720 /* Opcode: Variable P1 * *
721 **
722 ** Push the value of variable P1 onto the stack.  A variable is
723 ** an unknown in the original SQL string as handed to sqlite_compile().
724 ** Any occurance of the '?' character in the original SQL is considered
725 ** a variable.  Variables in the SQL string are number from left to
726 ** right beginning with 1.  The values of variables are set using the
727 ** sqlite_bind() API.
728 */
729 case OP_Variable: {
730   int j = pOp->p1 - 1;
731   pTos++;
732   if( j>=0 && j<p->nVar && p->azVar[j]!=0 ){
733     pTos->z = p->azVar[j];
734     pTos->n = p->anVar[j];
735     pTos->flags = MEM_Str | MEM_Static;
736   }else{
737     pTos->flags = MEM_Null;
738   }
739   break;
740 }
741 
742 /* Opcode: Pop P1 * *
743 **
744 ** P1 elements are popped off of the top of stack and discarded.
745 */
746 case OP_Pop: {
747   assert( pOp->p1>=0 );
748   popStack(&pTos, pOp->p1);
749   assert( pTos>=&p->aStack[-1] );
750   break;
751 }
752 
753 /* Opcode: Dup P1 P2 *
754 **
755 ** A copy of the P1-th element of the stack
756 ** is made and pushed onto the top of the stack.
757 ** The top of the stack is element 0.  So the
758 ** instruction "Dup 0 0 0" will make a copy of the
759 ** top of the stack.
760 **
761 ** If the content of the P1-th element is a dynamically
762 ** allocated string, then a new copy of that string
763 ** is made if P2==0.  If P2!=0, then just a pointer
764 ** to the string is copied.
765 **
766 ** Also see the Pull instruction.
767 */
768 case OP_Dup: {
769   Mem *pFrom = &pTos[-pOp->p1];
770   assert( pFrom<=pTos && pFrom>=p->aStack );
771   pTos++;
772   memcpy(pTos, pFrom, sizeof(*pFrom)-NBFS);
773   if( pTos->flags & MEM_Str ){
774     if( pOp->p2 && (pTos->flags & (MEM_Dyn|MEM_Ephem)) ){
775       pTos->flags &= ~MEM_Dyn;
776       pTos->flags |= MEM_Ephem;
777     }else if( pTos->flags & MEM_Short ){
778       memcpy(pTos->zShort, pFrom->zShort, pTos->n);
779       pTos->z = pTos->zShort;
780     }else if( (pTos->flags & MEM_Static)==0 ){
781       pTos->z = sqliteMallocRaw(pFrom->n);
782       if( sqlite_malloc_failed ) goto no_mem;
783       memcpy(pTos->z, pFrom->z, pFrom->n);
784       pTos->flags &= ~(MEM_Static|MEM_Ephem|MEM_Short);
785       pTos->flags |= MEM_Dyn;
786     }
787   }
788   break;
789 }
790 
791 /* Opcode: Pull P1 * *
792 **
793 ** The P1-th element is removed from its current location on
794 ** the stack and pushed back on top of the stack.  The
795 ** top of the stack is element 0, so "Pull 0 0 0" is
796 ** a no-op.  "Pull 1 0 0" swaps the top two elements of
797 ** the stack.
798 **
799 ** See also the Dup instruction.
800 */
801 case OP_Pull: {
802   Mem *pFrom = &pTos[-pOp->p1];
803   int i;
804   Mem ts;
805 
806   ts = *pFrom;
807   Deephemeralize(pTos);
808   for(i=0; i<pOp->p1; i++, pFrom++){
809     Deephemeralize(&pFrom[1]);
810     *pFrom = pFrom[1];
811     assert( (pFrom->flags & MEM_Ephem)==0 );
812     if( pFrom->flags & MEM_Short ){
813       assert( pFrom->flags & MEM_Str );
814       assert( pFrom->z==pFrom[1].zShort );
815       pFrom->z = pFrom->zShort;
816     }
817   }
818   *pTos = ts;
819   if( pTos->flags & MEM_Short ){
820     assert( pTos->flags & MEM_Str );
821     assert( pTos->z==pTos[-pOp->p1].zShort );
822     pTos->z = pTos->zShort;
823   }
824   break;
825 }
826 
827 /* Opcode: Push P1 * *
828 **
829 ** Overwrite the value of the P1-th element down on the
830 ** stack (P1==0 is the top of the stack) with the value
831 ** of the top of the stack.  Then pop the top of the stack.
832 */
833 case OP_Push: {
834   Mem *pTo = &pTos[-pOp->p1];
835 
836   assert( pTo>=p->aStack );
837   Deephemeralize(pTos);
838   Release(pTo);
839   *pTo = *pTos;
840   if( pTo->flags & MEM_Short ){
841     assert( pTo->z==pTos->zShort );
842     pTo->z = pTo->zShort;
843   }
844   pTos--;
845   break;
846 }
847 
848 
849 /* Opcode: ColumnName P1 P2 P3
850 **
851 ** P3 becomes the P1-th column name (first is 0).  An array of pointers
852 ** to all column names is passed as the 4th parameter to the callback.
853 ** If P2==1 then this is the last column in the result set and thus the
854 ** number of columns in the result set will be P1.  There must be at least
855 ** one OP_ColumnName with a P2==1 before invoking OP_Callback and the
856 ** number of columns specified in OP_Callback must one more than the P1
857 ** value of the OP_ColumnName that has P2==1.
858 */
859 case OP_ColumnName: {
860   assert( pOp->p1>=0 && pOp->p1<p->nOp );
861   p->azColName[pOp->p1] = pOp->p3;
862   p->nCallback = 0;
863   if( pOp->p2 ) p->nResColumn = pOp->p1+1;
864   break;
865 }
866 
867 /* Opcode: Callback P1 * *
868 **
869 ** Pop P1 values off the stack and form them into an array.  Then
870 ** invoke the callback function using the newly formed array as the
871 ** 3rd parameter.
872 */
873 case OP_Callback: {
874   int i;
875   char **azArgv = p->zArgv;
876   Mem *pCol;
877 
878   pCol = &pTos[1-pOp->p1];
879   assert( pCol>=p->aStack );
880   for(i=0; i<pOp->p1; i++, pCol++){
881     if( pCol->flags & MEM_Null ){
882       azArgv[i] = 0;
883     }else{
884       Stringify(pCol);
885       azArgv[i] = pCol->z;
886     }
887   }
888   azArgv[i] = 0;
889   p->nCallback++;
890   p->azResColumn = azArgv;
891   assert( p->nResColumn==pOp->p1 );
892   p->popStack = pOp->p1;
893   p->pc = pc + 1;
894   p->pTos = pTos;
895   return SQLITE_ROW;
896 }
897 
898 /* Opcode: Concat P1 P2 P3
899 **
900 ** Look at the first P1 elements of the stack.  Append them all
901 ** together with the lowest element first.  Use P3 as a separator.
902 ** Put the result on the top of the stack.  The original P1 elements
903 ** are popped from the stack if P2==0 and retained if P2==1.  If
904 ** any element of the stack is NULL, then the result is NULL.
905 **
906 ** If P3 is NULL, then use no separator.  When P1==1, this routine
907 ** makes a copy of the top stack element into memory obtained
908 ** from sqliteMalloc().
909 */
910 case OP_Concat: {
911   char *zNew;
912   int nByte;
913   int nField;
914   int i, j;
915   char *zSep;
916   int nSep;
917   Mem *pTerm;
918 
919   nField = pOp->p1;
920   zSep = pOp->p3;
921   if( zSep==0 ) zSep = "";
922   nSep = strlen(zSep);
923   assert( &pTos[1-nField] >= p->aStack );
924   nByte = 1 - nSep;
925   pTerm = &pTos[1-nField];
926   for(i=0; i<nField; i++, pTerm++){
927     if( pTerm->flags & MEM_Null ){
928       nByte = -1;
929       break;
930     }else{
931       Stringify(pTerm);
932       nByte += pTerm->n - 1 + nSep;
933     }
934   }
935   if( nByte<0 ){
936     if( pOp->p2==0 ){
937       popStack(&pTos, nField);
938     }
939     pTos++;
940     pTos->flags = MEM_Null;
941     break;
942   }
943   zNew = sqliteMallocRaw( nByte );
944   if( zNew==0 ) goto no_mem;
945   j = 0;
946   pTerm = &pTos[1-nField];
947   for(i=j=0; i<nField; i++, pTerm++){
948     assert( pTerm->flags & MEM_Str );
949     memcpy(&zNew[j], pTerm->z, pTerm->n-1);
950     j += pTerm->n-1;
951     if( nSep>0 && i<nField-1 ){
952       memcpy(&zNew[j], zSep, nSep);
953       j += nSep;
954     }
955   }
956   zNew[j] = 0;
957   if( pOp->p2==0 ){
958     popStack(&pTos, nField);
959   }
960   pTos++;
961   pTos->n = nByte;
962   pTos->flags = MEM_Str|MEM_Dyn;
963   pTos->z = zNew;
964   break;
965 }
966 
967 /* Opcode: Add * * *
968 **
969 ** Pop the top two elements from the stack, add them together,
970 ** and push the result back onto the stack.  If either element
971 ** is a string then it is converted to a double using the atof()
972 ** function before the addition.
973 ** If either operand is NULL, the result is NULL.
974 */
975 /* Opcode: Multiply * * *
976 **
977 ** Pop the top two elements from the stack, multiply them together,
978 ** and push the result back onto the stack.  If either element
979 ** is a string then it is converted to a double using the atof()
980 ** function before the multiplication.
981 ** If either operand is NULL, the result is NULL.
982 */
983 /* Opcode: Subtract * * *
984 **
985 ** Pop the top two elements from the stack, subtract the
986 ** first (what was on top of the stack) from the second (the
987 ** next on stack)
988 ** and push the result back onto the stack.  If either element
989 ** is a string then it is converted to a double using the atof()
990 ** function before the subtraction.
991 ** If either operand is NULL, the result is NULL.
992 */
993 /* Opcode: Divide * * *
994 **
995 ** Pop the top two elements from the stack, divide the
996 ** first (what was on top of the stack) from the second (the
997 ** next on stack)
998 ** and push the result back onto the stack.  If either element
999 ** is a string then it is converted to a double using the atof()
1000 ** function before the division.  Division by zero returns NULL.
1001 ** If either operand is NULL, the result is NULL.
1002 */
1003 /* Opcode: Remainder * * *
1004 **
1005 ** Pop the top two elements from the stack, divide the
1006 ** first (what was on top of the stack) from the second (the
1007 ** next on stack)
1008 ** and push the remainder after division onto the stack.  If either element
1009 ** is a string then it is converted to a double using the atof()
1010 ** function before the division.  Division by zero returns NULL.
1011 ** If either operand is NULL, the result is NULL.
1012 */
1013 case OP_Add:
1014 case OP_Subtract:
1015 case OP_Multiply:
1016 case OP_Divide:
1017 case OP_Remainder: {
1018   Mem *pNos = &pTos[-1];
1019   assert( pNos>=p->aStack );
1020   if( ((pTos->flags | pNos->flags) & MEM_Null)!=0 ){
1021     Release(pTos);
1022     pTos--;
1023     Release(pTos);
1024     pTos->flags = MEM_Null;
1025   }else if( (pTos->flags & pNos->flags & MEM_Int)==MEM_Int ){
1026     int a, b;
1027     a = pTos->i;
1028     b = pNos->i;
1029     switch( pOp->opcode ){
1030       case OP_Add:         b += a;       break;
1031       case OP_Subtract:    b -= a;       break;
1032       case OP_Multiply:    b *= a;       break;
1033       case OP_Divide: {
1034         if( a==0 ) goto divide_by_zero;
1035         b /= a;
1036         break;
1037       }
1038       default: {
1039         if( a==0 ) goto divide_by_zero;
1040         b %= a;
1041         break;
1042       }
1043     }
1044     Release(pTos);
1045     pTos--;
1046     Release(pTos);
1047     pTos->i = b;
1048     pTos->flags = MEM_Int;
1049   }else{
1050     double a, b;
1051     Realify(pTos);
1052     Realify(pNos);
1053     a = pTos->r;
1054     b = pNos->r;
1055     switch( pOp->opcode ){
1056       case OP_Add:         b += a;       break;
1057       case OP_Subtract:    b -= a;       break;
1058       case OP_Multiply:    b *= a;       break;
1059       case OP_Divide: {
1060         if( a==0.0 ) goto divide_by_zero;
1061         b /= a;
1062         break;
1063       }
1064       default: {
1065         int ia = (int)a;
1066         int ib = (int)b;
1067         if( ia==0.0 ) goto divide_by_zero;
1068         b = ib % ia;
1069         break;
1070       }
1071     }
1072     Release(pTos);
1073     pTos--;
1074     Release(pTos);
1075     pTos->r = b;
1076     pTos->flags = MEM_Real;
1077   }
1078   break;
1079 
1080 divide_by_zero:
1081   Release(pTos);
1082   pTos--;
1083   Release(pTos);
1084   pTos->flags = MEM_Null;
1085   break;
1086 }
1087 
1088 /* Opcode: Function P1 * P3
1089 **
1090 ** Invoke a user function (P3 is a pointer to a Function structure that
1091 ** defines the function) with P1 string arguments taken from the stack.
1092 ** Pop all arguments from the stack and push back the result.
1093 **
1094 ** See also: AggFunc
1095 */
1096 case OP_Function: {
1097   int n, i;
1098   Mem *pArg;
1099   char **azArgv;
1100   sqlite_func ctx;
1101 
1102   n = pOp->p1;
1103   pArg = &pTos[1-n];
1104   azArgv = p->zArgv;
1105   for(i=0; i<n; i++, pArg++){
1106     if( pArg->flags & MEM_Null ){
1107       azArgv[i] = 0;
1108     }else{
1109       Stringify(pArg);
1110       azArgv[i] = pArg->z;
1111     }
1112   }
1113   ctx.pFunc = (FuncDef*)pOp->p3;
1114   ctx.s.flags = MEM_Null;
1115   ctx.s.z = 0;
1116   ctx.isError = 0;
1117   ctx.isStep = 0;
1118   if( sqliteSafetyOff(db) ) goto abort_due_to_misuse;
1119   (*ctx.pFunc->xFunc)(&ctx, n, (const char**)azArgv);
1120   if( sqliteSafetyOn(db) ) goto abort_due_to_misuse;
1121   popStack(&pTos, n);
1122   pTos++;
1123   *pTos = ctx.s;
1124   if( pTos->flags & MEM_Short ){
1125     pTos->z = pTos->zShort;
1126   }
1127   if( ctx.isError ){
1128     sqliteSetString(&p->zErrMsg,
1129        (pTos->flags & MEM_Str)!=0 ? pTos->z : "user function error", (char*)0);
1130     rc = SQLITE_ERROR;
1131   }
1132   break;
1133 }
1134 
1135 /* Opcode: BitAnd * * *
1136 **
1137 ** Pop the top two elements from the stack.  Convert both elements
1138 ** to integers.  Push back onto the stack the bit-wise AND of the
1139 ** two elements.
1140 ** If either operand is NULL, the result is NULL.
1141 */
1142 /* Opcode: BitOr * * *
1143 **
1144 ** Pop the top two elements from the stack.  Convert both elements
1145 ** to integers.  Push back onto the stack the bit-wise OR of the
1146 ** two elements.
1147 ** If either operand is NULL, the result is NULL.
1148 */
1149 /* Opcode: ShiftLeft * * *
1150 **
1151 ** Pop the top two elements from the stack.  Convert both elements
1152 ** to integers.  Push back onto the stack the top element shifted
1153 ** left by N bits where N is the second element on the stack.
1154 ** If either operand is NULL, the result is NULL.
1155 */
1156 /* Opcode: ShiftRight * * *
1157 **
1158 ** Pop the top two elements from the stack.  Convert both elements
1159 ** to integers.  Push back onto the stack the top element shifted
1160 ** right by N bits where N is the second element on the stack.
1161 ** If either operand is NULL, the result is NULL.
1162 */
1163 case OP_BitAnd:
1164 case OP_BitOr:
1165 case OP_ShiftLeft:
1166 case OP_ShiftRight: {
1167   Mem *pNos = &pTos[-1];
1168   int a, b;
1169 
1170   assert( pNos>=p->aStack );
1171   if( (pTos->flags | pNos->flags) & MEM_Null ){
1172     popStack(&pTos, 2);
1173     pTos++;
1174     pTos->flags = MEM_Null;
1175     break;
1176   }
1177   Integerify(pTos);
1178   Integerify(pNos);
1179   a = pTos->i;
1180   b = pNos->i;
1181   switch( pOp->opcode ){
1182     case OP_BitAnd:      a &= b;     break;
1183     case OP_BitOr:       a |= b;     break;
1184     case OP_ShiftLeft:   a <<= b;    break;
1185     case OP_ShiftRight:  a >>= b;    break;
1186     default:   /* CANT HAPPEN */     break;
1187   }
1188   assert( (pTos->flags & MEM_Dyn)==0 );
1189   assert( (pNos->flags & MEM_Dyn)==0 );
1190   pTos--;
1191   Release(pTos);
1192   pTos->i = a;
1193   pTos->flags = MEM_Int;
1194   break;
1195 }
1196 
1197 /* Opcode: AddImm  P1 * *
1198 **
1199 ** Add the value P1 to whatever is on top of the stack.  The result
1200 ** is always an integer.
1201 **
1202 ** To force the top of the stack to be an integer, just add 0.
1203 */
1204 case OP_AddImm: {
1205   assert( pTos>=p->aStack );
1206   Integerify(pTos);
1207   pTos->i += pOp->p1;
1208   break;
1209 }
1210 
1211 /* Opcode: ForceInt P1 P2 *
1212 **
1213 ** Convert the top of the stack into an integer.  If the current top of
1214 ** the stack is not numeric (meaning that is is a NULL or a string that
1215 ** does not look like an integer or floating point number) then pop the
1216 ** stack and jump to P2.  If the top of the stack is numeric then
1217 ** convert it into the least integer that is greater than or equal to its
1218 ** current value if P1==0, or to the least integer that is strictly
1219 ** greater than its current value if P1==1.
1220 */
1221 case OP_ForceInt: {
1222   int v;
1223   assert( pTos>=p->aStack );
1224   if( (pTos->flags & (MEM_Int|MEM_Real))==0
1225          && ((pTos->flags & MEM_Str)==0 || sqliteIsNumber(pTos->z)==0) ){
1226     Release(pTos);
1227     pTos--;
1228     pc = pOp->p2 - 1;
1229     break;
1230   }
1231   if( pTos->flags & MEM_Int ){
1232     v = pTos->i + (pOp->p1!=0);
1233   }else{
1234     Realify(pTos);
1235     v = (int)pTos->r;
1236     if( pTos->r>(double)v ) v++;
1237     if( pOp->p1 && pTos->r==(double)v ) v++;
1238   }
1239   Release(pTos);
1240   pTos->i = v;
1241   pTos->flags = MEM_Int;
1242   break;
1243 }
1244 
1245 /* Opcode: MustBeInt P1 P2 *
1246 **
1247 ** Force the top of the stack to be an integer.  If the top of the
1248 ** stack is not an integer and cannot be converted into an integer
1249 ** with out data loss, then jump immediately to P2, or if P2==0
1250 ** raise an SQLITE_MISMATCH exception.
1251 **
1252 ** If the top of the stack is not an integer and P2 is not zero and
1253 ** P1 is 1, then the stack is popped.  In all other cases, the depth
1254 ** of the stack is unchanged.
1255 */
1256 case OP_MustBeInt: {
1257   assert( pTos>=p->aStack );
1258   if( pTos->flags & MEM_Int ){
1259     /* Do nothing */
1260   }else if( pTos->flags & MEM_Real ){
1261     int i = (int)pTos->r;
1262     double r = (double)i;
1263     if( r!=pTos->r ){
1264       goto mismatch;
1265     }
1266     pTos->i = i;
1267   }else if( pTos->flags & MEM_Str ){
1268     int v;
1269     if( !toInt(pTos->z, &v) ){
1270       double r;
1271       if( !sqliteIsNumber(pTos->z) ){
1272         goto mismatch;
1273       }
1274       Realify(pTos);
1275       v = (int)pTos->r;
1276       r = (double)v;
1277       if( r!=pTos->r ){
1278         goto mismatch;
1279       }
1280     }
1281     pTos->i = v;
1282   }else{
1283     goto mismatch;
1284   }
1285   Release(pTos);
1286   pTos->flags = MEM_Int;
1287   break;
1288 
1289 mismatch:
1290   if( pOp->p2==0 ){
1291     rc = SQLITE_MISMATCH;
1292     goto abort_due_to_error;
1293   }else{
1294     if( pOp->p1 ) popStack(&pTos, 1);
1295     pc = pOp->p2 - 1;
1296   }
1297   break;
1298 }
1299 
1300 /* Opcode: Eq P1 P2 *
1301 **
1302 ** Pop the top two elements from the stack.  If they are equal, then
1303 ** jump to instruction P2.  Otherwise, continue to the next instruction.
1304 **
1305 ** If either operand is NULL (and thus if the result is unknown) then
1306 ** take the jump if P1 is true.
1307 **
1308 ** If both values are numeric, they are converted to doubles using atof()
1309 ** and compared for equality that way.  Otherwise the strcmp() library
1310 ** routine is used for the comparison.  For a pure text comparison
1311 ** use OP_StrEq.
1312 **
1313 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
1314 ** stack if the jump would have been taken, or a 0 if not.  Push a
1315 ** NULL if either operand was NULL.
1316 */
1317 /* Opcode: Ne P1 P2 *
1318 **
1319 ** Pop the top two elements from the stack.  If they are not equal, then
1320 ** jump to instruction P2.  Otherwise, continue to the next instruction.
1321 **
1322 ** If either operand is NULL (and thus if the result is unknown) then
1323 ** take the jump if P1 is true.
1324 **
1325 ** If both values are numeric, they are converted to doubles using atof()
1326 ** and compared in that format.  Otherwise the strcmp() library
1327 ** routine is used for the comparison.  For a pure text comparison
1328 ** use OP_StrNe.
1329 **
1330 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
1331 ** stack if the jump would have been taken, or a 0 if not.  Push a
1332 ** NULL if either operand was NULL.
1333 */
1334 /* Opcode: Lt P1 P2 *
1335 **
1336 ** Pop the top two elements from the stack.  If second element (the
1337 ** next on stack) is less than the first (the top of stack), then
1338 ** jump to instruction P2.  Otherwise, continue to the next instruction.
1339 ** In other words, jump if NOS<TOS.
1340 **
1341 ** If either operand is NULL (and thus if the result is unknown) then
1342 ** take the jump if P1 is true.
1343 **
1344 ** If both values are numeric, they are converted to doubles using atof()
1345 ** and compared in that format.  Numeric values are always less than
1346 ** non-numeric values.  If both operands are non-numeric, the strcmp() library
1347 ** routine is used for the comparison.  For a pure text comparison
1348 ** use OP_StrLt.
1349 **
1350 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
1351 ** stack if the jump would have been taken, or a 0 if not.  Push a
1352 ** NULL if either operand was NULL.
1353 */
1354 /* Opcode: Le P1 P2 *
1355 **
1356 ** Pop the top two elements from the stack.  If second element (the
1357 ** next on stack) is less than or equal to the first (the top of stack),
1358 ** then jump to instruction P2. In other words, jump if NOS<=TOS.
1359 **
1360 ** If either operand is NULL (and thus if the result is unknown) then
1361 ** take the jump if P1 is true.
1362 **
1363 ** If both values are numeric, they are converted to doubles using atof()
1364 ** and compared in that format.  Numeric values are always less than
1365 ** non-numeric values.  If both operands are non-numeric, the strcmp() library
1366 ** routine is used for the comparison.  For a pure text comparison
1367 ** use OP_StrLe.
1368 **
1369 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
1370 ** stack if the jump would have been taken, or a 0 if not.  Push a
1371 ** NULL if either operand was NULL.
1372 */
1373 /* Opcode: Gt P1 P2 *
1374 **
1375 ** Pop the top two elements from the stack.  If second element (the
1376 ** next on stack) is greater than the first (the top of stack),
1377 ** then jump to instruction P2. In other words, jump if NOS>TOS.
1378 **
1379 ** If either operand is NULL (and thus if the result is unknown) then
1380 ** take the jump if P1 is true.
1381 **
1382 ** If both values are numeric, they are converted to doubles using atof()
1383 ** and compared in that format.  Numeric values are always less than
1384 ** non-numeric values.  If both operands are non-numeric, the strcmp() library
1385 ** routine is used for the comparison.  For a pure text comparison
1386 ** use OP_StrGt.
1387 **
1388 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
1389 ** stack if the jump would have been taken, or a 0 if not.  Push a
1390 ** NULL if either operand was NULL.
1391 */
1392 /* Opcode: Ge P1 P2 *
1393 **
1394 ** Pop the top two elements from the stack.  If second element (the next
1395 ** on stack) is greater than or equal to the first (the top of stack),
1396 ** then jump to instruction P2. In other words, jump if NOS>=TOS.
1397 **
1398 ** If either operand is NULL (and thus if the result is unknown) then
1399 ** take the jump if P1 is true.
1400 **
1401 ** If both values are numeric, they are converted to doubles using atof()
1402 ** and compared in that format.  Numeric values are always less than
1403 ** non-numeric values.  If both operands are non-numeric, the strcmp() library
1404 ** routine is used for the comparison.  For a pure text comparison
1405 ** use OP_StrGe.
1406 **
1407 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
1408 ** stack if the jump would have been taken, or a 0 if not.  Push a
1409 ** NULL if either operand was NULL.
1410 */
1411 case OP_Eq:
1412 case OP_Ne:
1413 case OP_Lt:
1414 case OP_Le:
1415 case OP_Gt:
1416 case OP_Ge: {
1417   Mem *pNos = &pTos[-1];
1418   int c, v;
1419   int ft, fn;
1420   assert( pNos>=p->aStack );
1421   ft = pTos->flags;
1422   fn = pNos->flags;
1423   if( (ft | fn) & MEM_Null ){
1424     popStack(&pTos, 2);
1425     if( pOp->p2 ){
1426       if( pOp->p1 ) pc = pOp->p2-1;
1427     }else{
1428       pTos++;
1429       pTos->flags = MEM_Null;
1430     }
1431     break;
1432   }else if( (ft & fn & MEM_Int)==MEM_Int ){
1433     c = pNos->i - pTos->i;
1434   }else if( (ft & MEM_Int)!=0 && (fn & MEM_Str)!=0 && toInt(pNos->z,&v) ){
1435     c = v - pTos->i;
1436   }else if( (fn & MEM_Int)!=0 && (ft & MEM_Str)!=0 && toInt(pTos->z,&v) ){
1437     c = pNos->i - v;
1438   }else{
1439     Stringify(pTos);
1440     Stringify(pNos);
1441     c = sqliteCompare(pNos->z, pTos->z);
1442   }
1443   switch( pOp->opcode ){
1444     case OP_Eq:    c = c==0;     break;
1445     case OP_Ne:    c = c!=0;     break;
1446     case OP_Lt:    c = c<0;      break;
1447     case OP_Le:    c = c<=0;     break;
1448     case OP_Gt:    c = c>0;      break;
1449     default:       c = c>=0;     break;
1450   }
1451   popStack(&pTos, 2);
1452   if( pOp->p2 ){
1453     if( c ) pc = pOp->p2-1;
1454   }else{
1455     pTos++;
1456     pTos->i = c;
1457     pTos->flags = MEM_Int;
1458   }
1459   break;
1460 }
1461 /* INSERT NO CODE HERE!
1462 **
1463 ** The opcode numbers are extracted from this source file by doing
1464 **
1465 **    grep '^case OP_' vdbe.c | ... >opcodes.h
1466 **
1467 ** The opcodes are numbered in the order that they appear in this file.
1468 ** But in order for the expression generating code to work right, the
1469 ** string comparison operators that follow must be numbered exactly 6
1470 ** greater than the numeric comparison opcodes above.  So no other
1471 ** cases can appear between the two.
1472 */
1473 /* Opcode: StrEq P1 P2 *
1474 **
1475 ** Pop the top two elements from the stack.  If they are equal, then
1476 ** jump to instruction P2.  Otherwise, continue to the next instruction.
1477 **
1478 ** If either operand is NULL (and thus if the result is unknown) then
1479 ** take the jump if P1 is true.
1480 **
1481 ** The strcmp() library routine is used for the comparison.  For a
1482 ** numeric comparison, use OP_Eq.
1483 **
1484 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
1485 ** stack if the jump would have been taken, or a 0 if not.  Push a
1486 ** NULL if either operand was NULL.
1487 */
1488 /* Opcode: StrNe P1 P2 *
1489 **
1490 ** Pop the top two elements from the stack.  If they are not equal, then
1491 ** jump to instruction P2.  Otherwise, continue to the next instruction.
1492 **
1493 ** If either operand is NULL (and thus if the result is unknown) then
1494 ** take the jump if P1 is true.
1495 **
1496 ** The strcmp() library routine is used for the comparison.  For a
1497 ** numeric comparison, use OP_Ne.
1498 **
1499 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
1500 ** stack if the jump would have been taken, or a 0 if not.  Push a
1501 ** NULL if either operand was NULL.
1502 */
1503 /* Opcode: StrLt P1 P2 *
1504 **
1505 ** Pop the top two elements from the stack.  If second element (the
1506 ** next on stack) is less than the first (the top of stack), then
1507 ** jump to instruction P2.  Otherwise, continue to the next instruction.
1508 ** In other words, jump if NOS<TOS.
1509 **
1510 ** If either operand is NULL (and thus if the result is unknown) then
1511 ** take the jump if P1 is true.
1512 **
1513 ** The strcmp() library routine is used for the comparison.  For a
1514 ** numeric comparison, use OP_Lt.
1515 **
1516 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
1517 ** stack if the jump would have been taken, or a 0 if not.  Push a
1518 ** NULL if either operand was NULL.
1519 */
1520 /* Opcode: StrLe P1 P2 *
1521 **
1522 ** Pop the top two elements from the stack.  If second element (the
1523 ** next on stack) is less than or equal to the first (the top of stack),
1524 ** then jump to instruction P2. In other words, jump if NOS<=TOS.
1525 **
1526 ** If either operand is NULL (and thus if the result is unknown) then
1527 ** take the jump if P1 is true.
1528 **
1529 ** The strcmp() library routine is used for the comparison.  For a
1530 ** numeric comparison, use OP_Le.
1531 **
1532 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
1533 ** stack if the jump would have been taken, or a 0 if not.  Push a
1534 ** NULL if either operand was NULL.
1535 */
1536 /* Opcode: StrGt P1 P2 *
1537 **
1538 ** Pop the top two elements from the stack.  If second element (the
1539 ** next on stack) is greater than the first (the top of stack),
1540 ** then jump to instruction P2. In other words, jump if NOS>TOS.
1541 **
1542 ** If either operand is NULL (and thus if the result is unknown) then
1543 ** take the jump if P1 is true.
1544 **
1545 ** The strcmp() library routine is used for the comparison.  For a
1546 ** numeric comparison, use OP_Gt.
1547 **
1548 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
1549 ** stack if the jump would have been taken, or a 0 if not.  Push a
1550 ** NULL if either operand was NULL.
1551 */
1552 /* Opcode: StrGe P1 P2 *
1553 **
1554 ** Pop the top two elements from the stack.  If second element (the next
1555 ** on stack) is greater than or equal to the first (the top of stack),
1556 ** then jump to instruction P2. In other words, jump if NOS>=TOS.
1557 **
1558 ** If either operand is NULL (and thus if the result is unknown) then
1559 ** take the jump if P1 is true.
1560 **
1561 ** The strcmp() library routine is used for the comparison.  For a
1562 ** numeric comparison, use OP_Ge.
1563 **
1564 ** If P2 is zero, do not jump.  Instead, push an integer 1 onto the
1565 ** stack if the jump would have been taken, or a 0 if not.  Push a
1566 ** NULL if either operand was NULL.
1567 */
1568 case OP_StrEq:
1569 case OP_StrNe:
1570 case OP_StrLt:
1571 case OP_StrLe:
1572 case OP_StrGt:
1573 case OP_StrGe: {
1574   Mem *pNos = &pTos[-1];
1575   int c;
1576   assert( pNos>=p->aStack );
1577   if( (pNos->flags | pTos->flags) & MEM_Null ){
1578     popStack(&pTos, 2);
1579     if( pOp->p2 ){
1580       if( pOp->p1 ) pc = pOp->p2-1;
1581     }else{
1582       pTos++;
1583       pTos->flags = MEM_Null;
1584     }
1585     break;
1586   }else{
1587     Stringify(pTos);
1588     Stringify(pNos);
1589     c = strcmp(pNos->z, pTos->z);
1590   }
1591   /* The asserts on each case of the following switch are there to verify
1592   ** that string comparison opcodes are always exactly 6 greater than the
1593   ** corresponding numeric comparison opcodes.  The code generator depends
1594   ** on this fact.
1595   */
1596   switch( pOp->opcode ){
1597     case OP_StrEq:    c = c==0;    assert( pOp->opcode-6==OP_Eq );   break;
1598     case OP_StrNe:    c = c!=0;    assert( pOp->opcode-6==OP_Ne );   break;
1599     case OP_StrLt:    c = c<0;     assert( pOp->opcode-6==OP_Lt );   break;
1600     case OP_StrLe:    c = c<=0;    assert( pOp->opcode-6==OP_Le );   break;
1601     case OP_StrGt:    c = c>0;     assert( pOp->opcode-6==OP_Gt );   break;
1602     default:          c = c>=0;    assert( pOp->opcode-6==OP_Ge );   break;
1603   }
1604   popStack(&pTos, 2);
1605   if( pOp->p2 ){
1606     if( c ) pc = pOp->p2-1;
1607   }else{
1608     pTos++;
1609     pTos->flags = MEM_Int;
1610     pTos->i = c;
1611   }
1612   break;
1613 }
1614 
1615 /* Opcode: And * * *
1616 **
1617 ** Pop two values off the stack.  Take the logical AND of the
1618 ** two values and push the resulting boolean value back onto the
1619 ** stack.
1620 */
1621 /* Opcode: Or * * *
1622 **
1623 ** Pop two values off the stack.  Take the logical OR of the
1624 ** two values and push the resulting boolean value back onto the
1625 ** stack.
1626 */
1627 case OP_And:
1628 case OP_Or: {
1629   Mem *pNos = &pTos[-1];
1630   int v1, v2;    /* 0==TRUE, 1==FALSE, 2==UNKNOWN or NULL */
1631 
1632   assert( pNos>=p->aStack );
1633   if( pTos->flags & MEM_Null ){
1634     v1 = 2;
1635   }else{
1636     Integerify(pTos);
1637     v1 = pTos->i==0;
1638   }
1639   if( pNos->flags & MEM_Null ){
1640     v2 = 2;
1641   }else{
1642     Integerify(pNos);
1643     v2 = pNos->i==0;
1644   }
1645   if( pOp->opcode==OP_And ){
1646     static const unsigned char and_logic[] = { 0, 1, 2, 1, 1, 1, 2, 1, 2 };
1647     v1 = and_logic[v1*3+v2];
1648   }else{
1649     static const unsigned char or_logic[] = { 0, 0, 0, 0, 1, 2, 0, 2, 2 };
1650     v1 = or_logic[v1*3+v2];
1651   }
1652   popStack(&pTos, 2);
1653   pTos++;
1654   if( v1==2 ){
1655     pTos->flags = MEM_Null;
1656   }else{
1657     pTos->i = v1==0;
1658     pTos->flags = MEM_Int;
1659   }
1660   break;
1661 }
1662 
1663 /* Opcode: Negative * * *
1664 **
1665 ** Treat the top of the stack as a numeric quantity.  Replace it
1666 ** with its additive inverse.  If the top of the stack is NULL
1667 ** its value is unchanged.
1668 */
1669 /* Opcode: AbsValue * * *
1670 **
1671 ** Treat the top of the stack as a numeric quantity.  Replace it
1672 ** with its absolute value. If the top of the stack is NULL
1673 ** its value is unchanged.
1674 */
1675 case OP_Negative:
1676 case OP_AbsValue: {
1677   assert( pTos>=p->aStack );
1678   if( pTos->flags & MEM_Real ){
1679     Release(pTos);
1680     if( pOp->opcode==OP_Negative || pTos->r<0.0 ){
1681       pTos->r = -pTos->r;
1682     }
1683     pTos->flags = MEM_Real;
1684   }else if( pTos->flags & MEM_Int ){
1685     Release(pTos);
1686     if( pOp->opcode==OP_Negative || pTos->i<0 ){
1687       pTos->i = -pTos->i;
1688     }
1689     pTos->flags = MEM_Int;
1690   }else if( pTos->flags & MEM_Null ){
1691     /* Do nothing */
1692   }else{
1693     Realify(pTos);
1694     Release(pTos);
1695     if( pOp->opcode==OP_Negative || pTos->r<0.0 ){
1696       pTos->r = -pTos->r;
1697     }
1698     pTos->flags = MEM_Real;
1699   }
1700   break;
1701 }
1702 
1703 /* Opcode: Not * * *
1704 **
1705 ** Interpret the top of the stack as a boolean value.  Replace it
1706 ** with its complement.  If the top of the stack is NULL its value
1707 ** is unchanged.
1708 */
1709 case OP_Not: {
1710   assert( pTos>=p->aStack );
1711   if( pTos->flags & MEM_Null ) break;  /* Do nothing to NULLs */
1712   Integerify(pTos);
1713   Release(pTos);
1714   pTos->i = !pTos->i;
1715   pTos->flags = MEM_Int;
1716   break;
1717 }
1718 
1719 /* Opcode: BitNot * * *
1720 **
1721 ** Interpret the top of the stack as an value.  Replace it
1722 ** with its ones-complement.  If the top of the stack is NULL its
1723 ** value is unchanged.
1724 */
1725 case OP_BitNot: {
1726   assert( pTos>=p->aStack );
1727   if( pTos->flags & MEM_Null ) break;  /* Do nothing to NULLs */
1728   Integerify(pTos);
1729   Release(pTos);
1730   pTos->i = ~pTos->i;
1731   pTos->flags = MEM_Int;
1732   break;
1733 }
1734 
1735 /* Opcode: Noop * * *
1736 **
1737 ** Do nothing.  This instruction is often useful as a jump
1738 ** destination.
1739 */
1740 case OP_Noop: {
1741   break;
1742 }
1743 
1744 /* Opcode: If P1 P2 *
1745 **
1746 ** Pop a single boolean from the stack.  If the boolean popped is
1747 ** true, then jump to p2.  Otherwise continue to the next instruction.
1748 ** An integer is false if zero and true otherwise.  A string is
1749 ** false if it has zero length and true otherwise.
1750 **
1751 ** If the value popped of the stack is NULL, then take the jump if P1
1752 ** is true and fall through if P1 is false.
1753 */
1754 /* Opcode: IfNot P1 P2 *
1755 **
1756 ** Pop a single boolean from the stack.  If the boolean popped is
1757 ** false, then jump to p2.  Otherwise continue to the next instruction.
1758 ** An integer is false if zero and true otherwise.  A string is
1759 ** false if it has zero length and true otherwise.
1760 **
1761 ** If the value popped of the stack is NULL, then take the jump if P1
1762 ** is true and fall through if P1 is false.
1763 */
1764 case OP_If:
1765 case OP_IfNot: {
1766   int c;
1767   assert( pTos>=p->aStack );
1768   if( pTos->flags & MEM_Null ){
1769     c = pOp->p1;
1770   }else{
1771     Integerify(pTos);
1772     c = pTos->i;
1773     if( pOp->opcode==OP_IfNot ) c = !c;
1774   }
1775   assert( (pTos->flags & MEM_Dyn)==0 );
1776   pTos--;
1777   if( c ) pc = pOp->p2-1;
1778   break;
1779 }
1780 
1781 /* Opcode: IsNull P1 P2 *
1782 **
1783 ** If any of the top abs(P1) values on the stack are NULL, then jump
1784 ** to P2.  Pop the stack P1 times if P1>0.   If P1<0 leave the stack
1785 ** unchanged.
1786 */
1787 case OP_IsNull: {
1788   int i, cnt;
1789   Mem *pTerm;
1790   cnt = pOp->p1;
1791   if( cnt<0 ) cnt = -cnt;
1792   pTerm = &pTos[1-cnt];
1793   assert( pTerm>=p->aStack );
1794   for(i=0; i<cnt; i++, pTerm++){
1795     if( pTerm->flags & MEM_Null ){
1796       pc = pOp->p2-1;
1797       break;
1798     }
1799   }
1800   if( pOp->p1>0 ) popStack(&pTos, cnt);
1801   break;
1802 }
1803 
1804 /* Opcode: NotNull P1 P2 *
1805 **
1806 ** Jump to P2 if the top P1 values on the stack are all not NULL.  Pop the
1807 ** stack if P1 times if P1 is greater than zero.  If P1 is less than
1808 ** zero then leave the stack unchanged.
1809 */
1810 case OP_NotNull: {
1811   int i, cnt;
1812   cnt = pOp->p1;
1813   if( cnt<0 ) cnt = -cnt;
1814   assert( &pTos[1-cnt] >= p->aStack );
1815   for(i=0; i<cnt && (pTos[1+i-cnt].flags & MEM_Null)==0; i++){}
1816   if( i>=cnt ) pc = pOp->p2-1;
1817   if( pOp->p1>0 ) popStack(&pTos, cnt);
1818   break;
1819 }
1820 
1821 /* Opcode: MakeRecord P1 P2 *
1822 **
1823 ** Convert the top P1 entries of the stack into a single entry
1824 ** suitable for use as a data record in a database table.  The
1825 ** details of the format are irrelevant as long as the OP_Column
1826 ** opcode can decode the record later.  Refer to source code
1827 ** comments for the details of the record format.
1828 **
1829 ** If P2 is true (non-zero) and one or more of the P1 entries
1830 ** that go into building the record is NULL, then add some extra
1831 ** bytes to the record to make it distinct for other entries created
1832 ** during the same run of the VDBE.  The extra bytes added are a
1833 ** counter that is reset with each run of the VDBE, so records
1834 ** created this way will not necessarily be distinct across runs.
1835 ** But they should be distinct for transient tables (created using
1836 ** OP_OpenTemp) which is what they are intended for.
1837 **
1838 ** (Later:) The P2==1 option was intended to make NULLs distinct
1839 ** for the UNION operator.  But I have since discovered that NULLs
1840 ** are indistinct for UNION.  So this option is never used.
1841 */
1842 case OP_MakeRecord: {
1843   char *zNewRecord;
1844   int nByte;
1845   int nField;
1846   int i, j;
1847   int idxWidth;
1848   u32 addr;
1849   Mem *pRec;
1850   int addUnique = 0;   /* True to cause bytes to be added to make the
1851                        ** generated record distinct */
1852   char zTemp[NBFS];    /* Temp space for small records */
1853 
1854   /* Assuming the record contains N fields, the record format looks
1855   ** like this:
1856   **
1857   **   -------------------------------------------------------------------
1858   **   | idx0 | idx1 | ... | idx(N-1) | idx(N) | data0 | ... | data(N-1) |
1859   **   -------------------------------------------------------------------
1860   **
1861   ** All data fields are converted to strings before being stored and
1862   ** are stored with their null terminators.  NULL entries omit the
1863   ** null terminator.  Thus an empty string uses 1 byte and a NULL uses
1864   ** zero bytes.  Data(0) is taken from the lowest element of the stack
1865   ** and data(N-1) is the top of the stack.
1866   **
1867   ** Each of the idx() entries is either 1, 2, or 3 bytes depending on
1868   ** how big the total record is.  Idx(0) contains the offset to the start
1869   ** of data(0).  Idx(k) contains the offset to the start of data(k).
1870   ** Idx(N) contains the total number of bytes in the record.
1871   */
1872   nField = pOp->p1;
1873   pRec = &pTos[1-nField];
1874   assert( pRec>=p->aStack );
1875   nByte = 0;
1876   for(i=0; i<nField; i++, pRec++){
1877     if( pRec->flags & MEM_Null ){
1878       addUnique = pOp->p2;
1879     }else{
1880       Stringify(pRec);
1881       nByte += pRec->n;
1882     }
1883   }
1884   if( addUnique ) nByte += sizeof(p->uniqueCnt);
1885   if( nByte + nField + 1 < 256 ){
1886     idxWidth = 1;
1887   }else if( nByte + 2*nField + 2 < 65536 ){
1888     idxWidth = 2;
1889   }else{
1890     idxWidth = 3;
1891   }
1892   nByte += idxWidth*(nField + 1);
1893   if( nByte>MAX_BYTES_PER_ROW ){
1894     rc = SQLITE_TOOBIG;
1895     goto abort_due_to_error;
1896   }
1897   if( nByte<=NBFS ){
1898     zNewRecord = zTemp;
1899   }else{
1900     zNewRecord = sqliteMallocRaw( nByte );
1901     if( zNewRecord==0 ) goto no_mem;
1902   }
1903   j = 0;
1904   addr = idxWidth*(nField+1) + addUnique*sizeof(p->uniqueCnt);
1905   for(i=0, pRec=&pTos[1-nField]; i<nField; i++, pRec++){
1906     zNewRecord[j++] = addr & 0xff;
1907     if( idxWidth>1 ){
1908       zNewRecord[j++] = (addr>>8)&0xff;
1909       if( idxWidth>2 ){
1910         zNewRecord[j++] = (addr>>16)&0xff;
1911       }
1912     }
1913     if( (pRec->flags & MEM_Null)==0 ){
1914       addr += pRec->n;
1915     }
1916   }
1917   zNewRecord[j++] = addr & 0xff;
1918   if( idxWidth>1 ){
1919     zNewRecord[j++] = (addr>>8)&0xff;
1920     if( idxWidth>2 ){
1921       zNewRecord[j++] = (addr>>16)&0xff;
1922     }
1923   }
1924   if( addUnique ){
1925     memcpy(&zNewRecord[j], &p->uniqueCnt, sizeof(p->uniqueCnt));
1926     p->uniqueCnt++;
1927     j += sizeof(p->uniqueCnt);
1928   }
1929   for(i=0, pRec=&pTos[1-nField]; i<nField; i++, pRec++){
1930     if( (pRec->flags & MEM_Null)==0 ){
1931       memcpy(&zNewRecord[j], pRec->z, pRec->n);
1932       j += pRec->n;
1933     }
1934   }
1935   popStack(&pTos, nField);
1936   pTos++;
1937   pTos->n = nByte;
1938   if( nByte<=NBFS ){
1939     assert( zNewRecord==zTemp );
1940     memcpy(pTos->zShort, zTemp, nByte);
1941     pTos->z = pTos->zShort;
1942     pTos->flags = MEM_Str | MEM_Short;
1943   }else{
1944     assert( zNewRecord!=zTemp );
1945     pTos->z = zNewRecord;
1946     pTos->flags = MEM_Str | MEM_Dyn;
1947   }
1948   break;
1949 }
1950 
1951 /* Opcode: MakeKey P1 P2 P3
1952 **
1953 ** Convert the top P1 entries of the stack into a single entry suitable
1954 ** for use as the key in an index.  The top P1 records are
1955 ** converted to strings and merged.  The null-terminators
1956 ** are retained and used as separators.
1957 ** The lowest entry in the stack is the first field and the top of the
1958 ** stack becomes the last.
1959 **
1960 ** If P2 is not zero, then the original entries remain on the stack
1961 ** and the new key is pushed on top.  If P2 is zero, the original
1962 ** data is popped off the stack first then the new key is pushed
1963 ** back in its place.
1964 **
1965 ** P3 is a string that is P1 characters long.  Each character is either
1966 ** an 'n' or a 't' to indicates if the argument should be intepreted as
1967 ** numeric or text type.  The first character of P3 corresponds to the
1968 ** lowest element on the stack.  If P3 is NULL then all arguments are
1969 ** assumed to be of the numeric type.
1970 **
1971 ** The type makes a difference in that text-type fields may not be
1972 ** introduced by 'b' (as described in the next paragraph).  The
1973 ** first character of a text-type field must be either 'a' (if it is NULL)
1974 ** or 'c'.  Numeric fields will be introduced by 'b' if their content
1975 ** looks like a well-formed number.  Otherwise the 'a' or 'c' will be
1976 ** used.
1977 **
1978 ** The key is a concatenation of fields.  Each field is terminated by
1979 ** a single 0x00 character.  A NULL field is introduced by an 'a' and
1980 ** is followed immediately by its 0x00 terminator.  A numeric field is
1981 ** introduced by a single character 'b' and is followed by a sequence
1982 ** of characters that represent the number such that a comparison of
1983 ** the character string using memcpy() sorts the numbers in numerical
1984 ** order.  The character strings for numbers are generated using the
1985 ** sqliteRealToSortable() function.  A text field is introduced by a
1986 ** 'c' character and is followed by the exact text of the field.  The
1987 ** use of an 'a', 'b', or 'c' character at the beginning of each field
1988 ** guarantees that NULLs sort before numbers and that numbers sort
1989 ** before text.  0x00 characters do not occur except as separators
1990 ** between fields.
1991 **
1992 ** See also: MakeIdxKey, SortMakeKey
1993 */
1994 /* Opcode: MakeIdxKey P1 P2 P3
1995 **
1996 ** Convert the top P1 entries of the stack into a single entry suitable
1997 ** for use as the key in an index.  In addition, take one additional integer
1998 ** off of the stack, treat that integer as a four-byte record number, and
1999 ** append the four bytes to the key.  Thus a total of P1+1 entries are
2000 ** popped from the stack for this instruction and a single entry is pushed
2001 ** back.  The first P1 entries that are popped are strings and the last
2002 ** entry (the lowest on the stack) is an integer record number.
2003 **
2004 ** The converstion of the first P1 string entries occurs just like in
2005 ** MakeKey.  Each entry is separated from the others by a null.
2006 ** The entire concatenation is null-terminated.  The lowest entry
2007 ** in the stack is the first field and the top of the stack becomes the
2008 ** last.
2009 **
2010 ** If P2 is not zero and one or more of the P1 entries that go into the
2011 ** generated key is NULL, then jump to P2 after the new key has been
2012 ** pushed on the stack.  In other words, jump to P2 if the key is
2013 ** guaranteed to be unique.  This jump can be used to skip a subsequent
2014 ** uniqueness test.
2015 **
2016 ** P3 is a string that is P1 characters long.  Each character is either
2017 ** an 'n' or a 't' to indicates if the argument should be numeric or
2018 ** text.  The first character corresponds to the lowest element on the
2019 ** stack.  If P3 is null then all arguments are assumed to be numeric.
2020 **
2021 ** See also:  MakeKey, SortMakeKey
2022 */
2023 case OP_MakeIdxKey:
2024 case OP_MakeKey: {
2025   char *zNewKey;
2026   int nByte;
2027   int nField;
2028   int addRowid;
2029   int i, j;
2030   int containsNull = 0;
2031   Mem *pRec;
2032   char zTemp[NBFS];
2033 
2034   addRowid = pOp->opcode==OP_MakeIdxKey;
2035   nField = pOp->p1;
2036   pRec = &pTos[1-nField];
2037   assert( pRec>=p->aStack );
2038   nByte = 0;
2039   for(j=0, i=0; i<nField; i++, j++, pRec++){
2040     int flags = pRec->flags;
2041     int len;
2042     char *z;
2043     if( flags & MEM_Null ){
2044       nByte += 2;
2045       containsNull = 1;
2046     }else if( pOp->p3 && pOp->p3[j]=='t' ){
2047       Stringify(pRec);
2048       pRec->flags &= ~(MEM_Int|MEM_Real);
2049       nByte += pRec->n+1;
2050     }else if( (flags & (MEM_Real|MEM_Int))!=0 || sqliteIsNumber(pRec->z) ){
2051       if( (flags & (MEM_Real|MEM_Int))==MEM_Int ){
2052         pRec->r = pRec->i;
2053       }else if( (flags & (MEM_Real|MEM_Int))==0 ){
2054         pRec->r = sqliteAtoF(pRec->z, 0);
2055       }
2056       Release(pRec);
2057       z = pRec->zShort;
2058       sqliteRealToSortable(pRec->r, z);
2059       len = strlen(z);
2060       pRec->z = 0;
2061       pRec->flags = MEM_Real;
2062       pRec->n = len+1;
2063       nByte += pRec->n+1;
2064     }else{
2065       nByte += pRec->n+1;
2066     }
2067   }
2068   if( nByte+sizeof(u32)>MAX_BYTES_PER_ROW ){
2069     rc = SQLITE_TOOBIG;
2070     goto abort_due_to_error;
2071   }
2072   if( addRowid ) nByte += sizeof(u32);
2073   if( nByte<=NBFS ){
2074     zNewKey = zTemp;
2075   }else{
2076     zNewKey = sqliteMallocRaw( nByte );
2077     if( zNewKey==0 ) goto no_mem;
2078   }
2079   j = 0;
2080   pRec = &pTos[1-nField];
2081   for(i=0; i<nField; i++, pRec++){
2082     if( pRec->flags & MEM_Null ){
2083       zNewKey[j++] = 'a';
2084       zNewKey[j++] = 0;
2085     }else if( pRec->flags==MEM_Real ){
2086       zNewKey[j++] = 'b';
2087       memcpy(&zNewKey[j], pRec->zShort, pRec->n);
2088       j += pRec->n;
2089     }else{
2090       assert( pRec->flags & MEM_Str );
2091       zNewKey[j++] = 'c';
2092       memcpy(&zNewKey[j], pRec->z, pRec->n);
2093       j += pRec->n;
2094     }
2095   }
2096   if( addRowid ){
2097     u32 iKey;
2098     pRec = &pTos[-nField];
2099     assert( pRec>=p->aStack );
2100     Integerify(pRec);
2101     iKey = intToKey(pRec->i);
2102     memcpy(&zNewKey[j], &iKey, sizeof(u32));
2103     popStack(&pTos, nField+1);
2104     if( pOp->p2 && containsNull ) pc = pOp->p2 - 1;
2105   }else{
2106     if( pOp->p2==0 ) popStack(&pTos, nField);
2107   }
2108   pTos++;
2109   pTos->n = nByte;
2110   if( nByte<=NBFS ){
2111     assert( zNewKey==zTemp );
2112     pTos->z = pTos->zShort;
2113     memcpy(pTos->zShort, zTemp, nByte);
2114     pTos->flags = MEM_Str | MEM_Short;
2115   }else{
2116     pTos->z = zNewKey;
2117     pTos->flags = MEM_Str | MEM_Dyn;
2118   }
2119   break;
2120 }
2121 
2122 /* Opcode: IncrKey * * *
2123 **
2124 ** The top of the stack should contain an index key generated by
2125 ** The MakeKey opcode.  This routine increases the least significant
2126 ** byte of that key by one.  This is used so that the MoveTo opcode
2127 ** will move to the first entry greater than the key rather than to
2128 ** the key itself.
2129 */
2130 case OP_IncrKey: {
2131   assert( pTos>=p->aStack );
2132   /* The IncrKey opcode is only applied to keys generated by
2133   ** MakeKey or MakeIdxKey and the results of those operands
2134   ** are always dynamic strings or zShort[] strings.  So we
2135   ** are always free to modify the string in place.
2136   */
2137   assert( pTos->flags & (MEM_Dyn|MEM_Short) );
2138   pTos->z[pTos->n-1]++;
2139   break;
2140 }
2141 
2142 /* Opcode: Checkpoint P1 * *
2143 **
2144 ** Begin a checkpoint.  A checkpoint is the beginning of a operation that
2145 ** is part of a larger transaction but which might need to be rolled back
2146 ** itself without effecting the containing transaction.  A checkpoint will
2147 ** be automatically committed or rollback when the VDBE halts.
2148 **
2149 ** The checkpoint is begun on the database file with index P1.  The main
2150 ** database file has an index of 0 and the file used for temporary tables
2151 ** has an index of 1.
2152 */
2153 case OP_Checkpoint: {
2154   int i = pOp->p1;
2155   if( i>=0 && i<db->nDb && db->aDb[i].pBt && db->aDb[i].inTrans==1 ){
2156     rc = sqliteBtreeBeginCkpt(db->aDb[i].pBt);
2157     if( rc==SQLITE_OK ) db->aDb[i].inTrans = 2;
2158   }
2159   break;
2160 }
2161 
2162 /* Opcode: Transaction P1 * *
2163 **
2164 ** Begin a transaction.  The transaction ends when a Commit or Rollback
2165 ** opcode is encountered.  Depending on the ON CONFLICT setting, the
2166 ** transaction might also be rolled back if an error is encountered.
2167 **
2168 ** P1 is the index of the database file on which the transaction is
2169 ** started.  Index 0 is the main database file and index 1 is the
2170 ** file used for temporary tables.
2171 **
2172 ** A write lock is obtained on the database file when a transaction is
2173 ** started.  No other process can read or write the file while the
2174 ** transaction is underway.  Starting a transaction also creates a
2175 ** rollback journal.  A transaction must be started before any changes
2176 ** can be made to the database.
2177 */
2178 case OP_Transaction: {
2179   int busy = 1;
2180   int i = pOp->p1;
2181   assert( i>=0 && i<db->nDb );
2182   if( db->aDb[i].inTrans ) break;
2183   while( db->aDb[i].pBt!=0 && busy ){
2184     rc = sqliteBtreeBeginTrans(db->aDb[i].pBt);
2185     switch( rc ){
2186       case SQLITE_BUSY: {
2187         if( db->xBusyCallback==0 ){
2188           p->pc = pc;
2189           p->undoTransOnError = 1;
2190           p->rc = SQLITE_BUSY;
2191           p->pTos = pTos;
2192           return SQLITE_BUSY;
2193         }else if( (*db->xBusyCallback)(db->pBusyArg, "", busy++)==0 ){
2194           sqliteSetString(&p->zErrMsg, sqlite_error_string(rc), (char*)0);
2195           busy = 0;
2196         }
2197         break;
2198       }
2199       case SQLITE_READONLY: {
2200         rc = SQLITE_OK;
2201       }
2202       /* FALLTHROUGH */
2203       case SQLITE_OK: {
2204         p->inTempTrans = 0;
2205         busy = 0;
2206         break;
2207       }
2208       default: {
2209         goto abort_due_to_error;
2210       }
2211     }
2212   }
2213   db->aDb[i].inTrans = 1;
2214   p->undoTransOnError = 1;
2215   break;
2216 }
2217 
2218 /* Opcode: Commit * * *
2219 **
2220 ** Cause all modifications to the database that have been made since the
2221 ** last Transaction to actually take effect.  No additional modifications
2222 ** are allowed until another transaction is started.  The Commit instruction
2223 ** deletes the journal file and releases the write lock on the database.
2224 ** A read lock continues to be held if there are still cursors open.
2225 */
2226 case OP_Commit: {
2227   int i;
2228   if( db->xCommitCallback!=0 ){
2229     if( sqliteSafetyOff(db) ) goto abort_due_to_misuse;
2230     if( db->xCommitCallback(db->pCommitArg)!=0 ){
2231       rc = SQLITE_CONSTRAINT;
2232     }
2233     if( sqliteSafetyOn(db) ) goto abort_due_to_misuse;
2234   }
2235   for(i=0; rc==SQLITE_OK && i<db->nDb; i++){
2236     if( db->aDb[i].inTrans ){
2237       rc = sqliteBtreeCommit(db->aDb[i].pBt);
2238       db->aDb[i].inTrans = 0;
2239     }
2240   }
2241   if( rc==SQLITE_OK ){
2242     sqliteCommitInternalChanges(db);
2243   }else{
2244     sqliteRollbackAll(db);
2245   }
2246   break;
2247 }
2248 
2249 /* Opcode: Rollback P1 * *
2250 **
2251 ** Cause all modifications to the database that have been made since the
2252 ** last Transaction to be undone. The database is restored to its state
2253 ** before the Transaction opcode was executed.  No additional modifications
2254 ** are allowed until another transaction is started.
2255 **
2256 ** P1 is the index of the database file that is committed.  An index of 0
2257 ** is used for the main database and an index of 1 is used for the file used
2258 ** to hold temporary tables.
2259 **
2260 ** This instruction automatically closes all cursors and releases both
2261 ** the read and write locks on the indicated database.
2262 */
2263 case OP_Rollback: {
2264   sqliteRollbackAll(db);
2265   break;
2266 }
2267 
2268 /* Opcode: ReadCookie P1 P2 *
2269 **
2270 ** Read cookie number P2 from database P1 and push it onto the stack.
2271 ** P2==0 is the schema version.  P2==1 is the database format.
2272 ** P2==2 is the recommended pager cache size, and so forth.  P1==0 is
2273 ** the main database file and P1==1 is the database file used to store
2274 ** temporary tables.
2275 **
2276 ** There must be a read-lock on the database (either a transaction
2277 ** must be started or there must be an open cursor) before
2278 ** executing this instruction.
2279 */
2280 case OP_ReadCookie: {
2281   int aMeta[SQLITE_N_BTREE_META];
2282   assert( pOp->p2<SQLITE_N_BTREE_META );
2283   assert( pOp->p1>=0 && pOp->p1<db->nDb );
2284   assert( db->aDb[pOp->p1].pBt!=0 );
2285   rc = sqliteBtreeGetMeta(db->aDb[pOp->p1].pBt, aMeta);
2286   pTos++;
2287   pTos->i = aMeta[1+pOp->p2];
2288   pTos->flags = MEM_Int;
2289   break;
2290 }
2291 
2292 /* Opcode: SetCookie P1 P2 *
2293 **
2294 ** Write the top of the stack into cookie number P2 of database P1.
2295 ** P2==0 is the schema version.  P2==1 is the database format.
2296 ** P2==2 is the recommended pager cache size, and so forth.  P1==0 is
2297 ** the main database file and P1==1 is the database file used to store
2298 ** temporary tables.
2299 **
2300 ** A transaction must be started before executing this opcode.
2301 */
2302 case OP_SetCookie: {
2303   int aMeta[SQLITE_N_BTREE_META];
2304   assert( pOp->p2<SQLITE_N_BTREE_META );
2305   assert( pOp->p1>=0 && pOp->p1<db->nDb );
2306   assert( db->aDb[pOp->p1].pBt!=0 );
2307   assert( pTos>=p->aStack );
2308   Integerify(pTos)
2309   rc = sqliteBtreeGetMeta(db->aDb[pOp->p1].pBt, aMeta);
2310   if( rc==SQLITE_OK ){
2311     aMeta[1+pOp->p2] = pTos->i;
2312     rc = sqliteBtreeUpdateMeta(db->aDb[pOp->p1].pBt, aMeta);
2313   }
2314   Release(pTos);
2315   pTos--;
2316   break;
2317 }
2318 
2319 /* Opcode: VerifyCookie P1 P2 *
2320 **
2321 ** Check the value of global database parameter number 0 (the
2322 ** schema version) and make sure it is equal to P2.
2323 ** P1 is the database number which is 0 for the main database file
2324 ** and 1 for the file holding temporary tables and some higher number
2325 ** for auxiliary databases.
2326 **
2327 ** The cookie changes its value whenever the database schema changes.
2328 ** This operation is used to detect when that the cookie has changed
2329 ** and that the current process needs to reread the schema.
2330 **
2331 ** Either a transaction needs to have been started or an OP_Open needs
2332 ** to be executed (to establish a read lock) before this opcode is
2333 ** invoked.
2334 */
2335 case OP_VerifyCookie: {
2336   int aMeta[SQLITE_N_BTREE_META];
2337   assert( pOp->p1>=0 && pOp->p1<db->nDb );
2338   rc = sqliteBtreeGetMeta(db->aDb[pOp->p1].pBt, aMeta);
2339   if( rc==SQLITE_OK && aMeta[1]!=pOp->p2 ){
2340     sqliteSetString(&p->zErrMsg, "database schema has changed", (char*)0);
2341     rc = SQLITE_SCHEMA;
2342   }
2343   break;
2344 }
2345 
2346 /* Opcode: OpenRead P1 P2 P3
2347 **
2348 ** Open a read-only cursor for the database table whose root page is
2349 ** P2 in a database file.  The database file is determined by an
2350 ** integer from the top of the stack.  0 means the main database and
2351 ** 1 means the database used for temporary tables.  Give the new
2352 ** cursor an identifier of P1.  The P1 values need not be contiguous
2353 ** but all P1 values should be small integers.  It is an error for
2354 ** P1 to be negative.
2355 **
2356 ** If P2==0 then take the root page number from the next of the stack.
2357 **
2358 ** There will be a read lock on the database whenever there is an
2359 ** open cursor.  If the database was unlocked prior to this instruction
2360 ** then a read lock is acquired as part of this instruction.  A read
2361 ** lock allows other processes to read the database but prohibits
2362 ** any other process from modifying the database.  The read lock is
2363 ** released when all cursors are closed.  If this instruction attempts
2364 ** to get a read lock but fails, the script terminates with an
2365 ** SQLITE_BUSY error code.
2366 **
2367 ** The P3 value is the name of the table or index being opened.
2368 ** The P3 value is not actually used by this opcode and may be
2369 ** omitted.  But the code generator usually inserts the index or
2370 ** table name into P3 to make the code easier to read.
2371 **
2372 ** See also OpenWrite.
2373 */
2374 /* Opcode: OpenWrite P1 P2 P3
2375 **
2376 ** Open a read/write cursor named P1 on the table or index whose root
2377 ** page is P2.  If P2==0 then take the root page number from the stack.
2378 **
2379 ** The P3 value is the name of the table or index being opened.
2380 ** The P3 value is not actually used by this opcode and may be
2381 ** omitted.  But the code generator usually inserts the index or
2382 ** table name into P3 to make the code easier to read.
2383 **
2384 ** This instruction works just like OpenRead except that it opens the cursor
2385 ** in read/write mode.  For a given table, there can be one or more read-only
2386 ** cursors or a single read/write cursor but not both.
2387 **
2388 ** See also OpenRead.
2389 */
2390 case OP_OpenRead:
2391 case OP_OpenWrite: {
2392   int busy = 0;
2393   int i = pOp->p1;
2394   int p2 = pOp->p2;
2395   int wrFlag;
2396   Btree *pX;
2397   int iDb;
2398 
2399   assert( pTos>=p->aStack );
2400   Integerify(pTos);
2401   iDb = pTos->i;
2402   pTos--;
2403   assert( iDb>=0 && iDb<db->nDb );
2404   pX = db->aDb[iDb].pBt;
2405   assert( pX!=0 );
2406   wrFlag = pOp->opcode==OP_OpenWrite;
2407   if( p2<=0 ){
2408     assert( pTos>=p->aStack );
2409     Integerify(pTos);
2410     p2 = pTos->i;
2411     pTos--;
2412     if( p2<2 ){
2413       sqliteSetString(&p->zErrMsg, "root page number less than 2", (char*)0);
2414       rc = SQLITE_INTERNAL;
2415       break;
2416     }
2417   }
2418   assert( i>=0 );
2419   if( expandCursorArraySize(p, i) ) goto no_mem;
2420   sqliteVdbeCleanupCursor(&p->aCsr[i]);
2421   memset(&p->aCsr[i], 0, sizeof(Cursor));
2422   p->aCsr[i].nullRow = 1;
2423   if( pX==0 ) break;
2424   do{
2425     rc = sqliteBtreeCursor(pX, p2, wrFlag, &p->aCsr[i].pCursor);
2426     switch( rc ){
2427       case SQLITE_BUSY: {
2428         if( db->xBusyCallback==0 ){
2429           p->pc = pc;
2430           p->rc = SQLITE_BUSY;
2431           p->pTos = &pTos[1 + (pOp->p2<=0)]; /* Operands must remain on stack */
2432           return SQLITE_BUSY;
2433         }else if( (*db->xBusyCallback)(db->pBusyArg, pOp->p3, ++busy)==0 ){
2434           sqliteSetString(&p->zErrMsg, sqlite_error_string(rc), (char*)0);
2435           busy = 0;
2436         }
2437         break;
2438       }
2439       case SQLITE_OK: {
2440         busy = 0;
2441         break;
2442       }
2443       default: {
2444         goto abort_due_to_error;
2445       }
2446     }
2447   }while( busy );
2448   break;
2449 }
2450 
2451 /* Opcode: OpenTemp P1 P2 *
2452 **
2453 ** Open a new cursor to a transient table.
2454 ** The transient cursor is always opened read/write even if
2455 ** the main database is read-only.  The transient table is deleted
2456 ** automatically when the cursor is closed.
2457 **
2458 ** The cursor points to a BTree table if P2==0 and to a BTree index
2459 ** if P2==1.  A BTree table must have an integer key and can have arbitrary
2460 ** data.  A BTree index has no data but can have an arbitrary key.
2461 **
2462 ** This opcode is used for tables that exist for the duration of a single
2463 ** SQL statement only.  Tables created using CREATE TEMPORARY TABLE
2464 ** are opened using OP_OpenRead or OP_OpenWrite.  "Temporary" in the
2465 ** context of this opcode means for the duration of a single SQL statement
2466 ** whereas "Temporary" in the context of CREATE TABLE means for the duration
2467 ** of the connection to the database.  Same word; different meanings.
2468 */
2469 case OP_OpenTemp: {
2470   int i = pOp->p1;
2471   Cursor *pCx;
2472   assert( i>=0 );
2473   if( expandCursorArraySize(p, i) ) goto no_mem;
2474   pCx = &p->aCsr[i];
2475   sqliteVdbeCleanupCursor(pCx);
2476   memset(pCx, 0, sizeof(*pCx));
2477   pCx->nullRow = 1;
2478   rc = sqliteBtreeFactory(db, 0, 1, TEMP_PAGES, &pCx->pBt);
2479 
2480   if( rc==SQLITE_OK ){
2481     rc = sqliteBtreeBeginTrans(pCx->pBt);
2482   }
2483   if( rc==SQLITE_OK ){
2484     if( pOp->p2 ){
2485       int pgno;
2486       rc = sqliteBtreeCreateIndex(pCx->pBt, &pgno);
2487       if( rc==SQLITE_OK ){
2488         rc = sqliteBtreeCursor(pCx->pBt, pgno, 1, &pCx->pCursor);
2489       }
2490     }else{
2491       rc = sqliteBtreeCursor(pCx->pBt, 2, 1, &pCx->pCursor);
2492     }
2493   }
2494   break;
2495 }
2496 
2497 /* Opcode: OpenPseudo P1 * *
2498 **
2499 ** Open a new cursor that points to a fake table that contains a single
2500 ** row of data.  Any attempt to write a second row of data causes the
2501 ** first row to be deleted.  All data is deleted when the cursor is
2502 ** closed.
2503 **
2504 ** A pseudo-table created by this opcode is useful for holding the
2505 ** NEW or OLD tables in a trigger.
2506 */
2507 case OP_OpenPseudo: {
2508   int i = pOp->p1;
2509   Cursor *pCx;
2510   assert( i>=0 );
2511   if( expandCursorArraySize(p, i) ) goto no_mem;
2512   pCx = &p->aCsr[i];
2513   sqliteVdbeCleanupCursor(pCx);
2514   memset(pCx, 0, sizeof(*pCx));
2515   pCx->nullRow = 1;
2516   pCx->pseudoTable = 1;
2517   break;
2518 }
2519 
2520 /* Opcode: Close P1 * *
2521 **
2522 ** Close a cursor previously opened as P1.  If P1 is not
2523 ** currently open, this instruction is a no-op.
2524 */
2525 case OP_Close: {
2526   int i = pOp->p1;
2527   if( i>=0 && i<p->nCursor ){
2528     sqliteVdbeCleanupCursor(&p->aCsr[i]);
2529   }
2530   break;
2531 }
2532 
2533 /* Opcode: MoveTo P1 P2 *
2534 **
2535 ** Pop the top of the stack and use its value as a key.  Reposition
2536 ** cursor P1 so that it points to an entry with a matching key.  If
2537 ** the table contains no record with a matching key, then the cursor
2538 ** is left pointing at the first record that is greater than the key.
2539 ** If there are no records greater than the key and P2 is not zero,
2540 ** then an immediate jump to P2 is made.
2541 **
2542 ** See also: Found, NotFound, Distinct, MoveLt
2543 */
2544 /* Opcode: MoveLt P1 P2 *
2545 **
2546 ** Pop the top of the stack and use its value as a key.  Reposition
2547 ** cursor P1 so that it points to the entry with the largest key that is
2548 ** less than the key popped from the stack.
2549 ** If there are no records less than than the key and P2
2550 ** is not zero then an immediate jump to P2 is made.
2551 **
2552 ** See also: MoveTo
2553 */
2554 case OP_MoveLt:
2555 case OP_MoveTo: {
2556   int i = pOp->p1;
2557   Cursor *pC;
2558 
2559   assert( pTos>=p->aStack );
2560   assert( i>=0 && i<p->nCursor );
2561   pC = &p->aCsr[i];
2562   if( pC->pCursor!=0 ){
2563     int res, oc;
2564     pC->nullRow = 0;
2565     if( pTos->flags & MEM_Int ){
2566       int iKey = intToKey(pTos->i);
2567       if( pOp->p2==0 && pOp->opcode==OP_MoveTo ){
2568         pC->movetoTarget = iKey;
2569         pC->deferredMoveto = 1;
2570         Release(pTos);
2571         pTos--;
2572         break;
2573       }
2574       sqliteBtreeMoveto(pC->pCursor, (char*)&iKey, sizeof(int), &res);
2575       pC->lastRecno = pTos->i;
2576       pC->recnoIsValid = res==0;
2577     }else{
2578       Stringify(pTos);
2579       sqliteBtreeMoveto(pC->pCursor, pTos->z, pTos->n, &res);
2580       pC->recnoIsValid = 0;
2581     }
2582     pC->deferredMoveto = 0;
2583     sqlite_search_count++;
2584     oc = pOp->opcode;
2585     if( oc==OP_MoveTo && res<0 ){
2586       sqliteBtreeNext(pC->pCursor, &res);
2587       pC->recnoIsValid = 0;
2588       if( res && pOp->p2>0 ){
2589         pc = pOp->p2 - 1;
2590       }
2591     }else if( oc==OP_MoveLt ){
2592       if( res>=0 ){
2593         sqliteBtreePrevious(pC->pCursor, &res);
2594         pC->recnoIsValid = 0;
2595       }else{
2596         /* res might be negative because the table is empty.  Check to
2597         ** see if this is the case.
2598         */
2599         int keysize;
2600         res = sqliteBtreeKeySize(pC->pCursor,&keysize)!=0 || keysize==0;
2601       }
2602       if( res && pOp->p2>0 ){
2603         pc = pOp->p2 - 1;
2604       }
2605     }
2606   }
2607   Release(pTos);
2608   pTos--;
2609   break;
2610 }
2611 
2612 /* Opcode: Distinct P1 P2 *
2613 **
2614 ** Use the top of the stack as a string key.  If a record with that key does
2615 ** not exist in the table of cursor P1, then jump to P2.  If the record
2616 ** does already exist, then fall thru.  The cursor is left pointing
2617 ** at the record if it exists. The key is not popped from the stack.
2618 **
2619 ** This operation is similar to NotFound except that this operation
2620 ** does not pop the key from the stack.
2621 **
2622 ** See also: Found, NotFound, MoveTo, IsUnique, NotExists
2623 */
2624 /* Opcode: Found P1 P2 *
2625 **
2626 ** Use the top of the stack as a string key.  If a record with that key
2627 ** does exist in table of P1, then jump to P2.  If the record
2628 ** does not exist, then fall thru.  The cursor is left pointing
2629 ** to the record if it exists.  The key is popped from the stack.
2630 **
2631 ** See also: Distinct, NotFound, MoveTo, IsUnique, NotExists
2632 */
2633 /* Opcode: NotFound P1 P2 *
2634 **
2635 ** Use the top of the stack as a string key.  If a record with that key
2636 ** does not exist in table of P1, then jump to P2.  If the record
2637 ** does exist, then fall thru.  The cursor is left pointing to the
2638 ** record if it exists.  The key is popped from the stack.
2639 **
2640 ** The difference between this operation and Distinct is that
2641 ** Distinct does not pop the key from the stack.
2642 **
2643 ** See also: Distinct, Found, MoveTo, NotExists, IsUnique
2644 */
2645 case OP_Distinct:
2646 case OP_NotFound:
2647 case OP_Found: {
2648   int i = pOp->p1;
2649   int alreadyExists = 0;
2650   Cursor *pC;
2651   assert( pTos>=p->aStack );
2652   assert( i>=0 && i<p->nCursor );
2653   if( (pC = &p->aCsr[i])->pCursor!=0 ){
2654     int res, rx;
2655     Stringify(pTos);
2656     rx = sqliteBtreeMoveto(pC->pCursor, pTos->z, pTos->n, &res);
2657     alreadyExists = rx==SQLITE_OK && res==0;
2658     pC->deferredMoveto = 0;
2659   }
2660   if( pOp->opcode==OP_Found ){
2661     if( alreadyExists ) pc = pOp->p2 - 1;
2662   }else{
2663     if( !alreadyExists ) pc = pOp->p2 - 1;
2664   }
2665   if( pOp->opcode!=OP_Distinct ){
2666     Release(pTos);
2667     pTos--;
2668   }
2669   break;
2670 }
2671 
2672 /* Opcode: IsUnique P1 P2 *
2673 **
2674 ** The top of the stack is an integer record number.  Call this
2675 ** record number R.  The next on the stack is an index key created
2676 ** using MakeIdxKey.  Call it K.  This instruction pops R from the
2677 ** stack but it leaves K unchanged.
2678 **
2679 ** P1 is an index.  So all but the last four bytes of K are an
2680 ** index string.  The last four bytes of K are a record number.
2681 **
2682 ** This instruction asks if there is an entry in P1 where the
2683 ** index string matches K but the record number is different
2684 ** from R.  If there is no such entry, then there is an immediate
2685 ** jump to P2.  If any entry does exist where the index string
2686 ** matches K but the record number is not R, then the record
2687 ** number for that entry is pushed onto the stack and control
2688 ** falls through to the next instruction.
2689 **
2690 ** See also: Distinct, NotFound, NotExists, Found
2691 */
2692 case OP_IsUnique: {
2693   int i = pOp->p1;
2694   Mem *pNos = &pTos[-1];
2695   BtCursor *pCrsr;
2696   int R;
2697 
2698   /* Pop the value R off the top of the stack
2699   */
2700   assert( pNos>=p->aStack );
2701   Integerify(pTos);
2702   R = pTos->i;
2703   pTos--;
2704   assert( i>=0 && i<=p->nCursor );
2705   if( (pCrsr = p->aCsr[i].pCursor)!=0 ){
2706     int res, rc;
2707     int v;         /* The record number on the P1 entry that matches K */
2708     char *zKey;    /* The value of K */
2709     int nKey;      /* Number of bytes in K */
2710 
2711     /* Make sure K is a string and make zKey point to K
2712     */
2713     Stringify(pNos);
2714     zKey = pNos->z;
2715     nKey = pNos->n;
2716     assert( nKey >= 4 );
2717 
2718     /* Search for an entry in P1 where all but the last four bytes match K.
2719     ** If there is no such entry, jump immediately to P2.
2720     */
2721     assert( p->aCsr[i].deferredMoveto==0 );
2722     rc = sqliteBtreeMoveto(pCrsr, zKey, nKey-4, &res);
2723     if( rc!=SQLITE_OK ) goto abort_due_to_error;
2724     if( res<0 ){
2725       rc = sqliteBtreeNext(pCrsr, &res);
2726       if( res ){
2727         pc = pOp->p2 - 1;
2728         break;
2729       }
2730     }
2731     rc = sqliteBtreeKeyCompare(pCrsr, zKey, nKey-4, 4, &res);
2732     if( rc!=SQLITE_OK ) goto abort_due_to_error;
2733     if( res>0 ){
2734       pc = pOp->p2 - 1;
2735       break;
2736     }
2737 
2738     /* At this point, pCrsr is pointing to an entry in P1 where all but
2739     ** the last for bytes of the key match K.  Check to see if the last
2740     ** four bytes of the key are different from R.  If the last four
2741     ** bytes equal R then jump immediately to P2.
2742     */
2743     sqliteBtreeKey(pCrsr, nKey - 4, 4, (char*)&v);
2744     v = keyToInt(v);
2745     if( v==R ){
2746       pc = pOp->p2 - 1;
2747       break;
2748     }
2749 
2750     /* The last four bytes of the key are different from R.  Convert the
2751     ** last four bytes of the key into an integer and push it onto the
2752     ** stack.  (These bytes are the record number of an entry that
2753     ** violates a UNIQUE constraint.)
2754     */
2755     pTos++;
2756     pTos->i = v;
2757     pTos->flags = MEM_Int;
2758   }
2759   break;
2760 }
2761 
2762 /* Opcode: NotExists P1 P2 *
2763 **
2764 ** Use the top of the stack as a integer key.  If a record with that key
2765 ** does not exist in table of P1, then jump to P2.  If the record
2766 ** does exist, then fall thru.  The cursor is left pointing to the
2767 ** record if it exists.  The integer key is popped from the stack.
2768 **
2769 ** The difference between this operation and NotFound is that this
2770 ** operation assumes the key is an integer and NotFound assumes it
2771 ** is a string.
2772 **
2773 ** See also: Distinct, Found, MoveTo, NotFound, IsUnique
2774 */
2775 case OP_NotExists: {
2776   int i = pOp->p1;
2777   BtCursor *pCrsr;
2778   assert( pTos>=p->aStack );
2779   assert( i>=0 && i<p->nCursor );
2780   if( (pCrsr = p->aCsr[i].pCursor)!=0 ){
2781     int res, rx, iKey;
2782     assert( pTos->flags & MEM_Int );
2783     iKey = intToKey(pTos->i);
2784     rx = sqliteBtreeMoveto(pCrsr, (char*)&iKey, sizeof(int), &res);
2785     p->aCsr[i].lastRecno = pTos->i;
2786     p->aCsr[i].recnoIsValid = res==0;
2787     p->aCsr[i].nullRow = 0;
2788     if( rx!=SQLITE_OK || res!=0 ){
2789       pc = pOp->p2 - 1;
2790       p->aCsr[i].recnoIsValid = 0;
2791     }
2792   }
2793   Release(pTos);
2794   pTos--;
2795   break;
2796 }
2797 
2798 /* Opcode: NewRecno P1 * *
2799 **
2800 ** Get a new integer record number used as the key to a table.
2801 ** The record number is not previously used as a key in the database
2802 ** table that cursor P1 points to.  The new record number is pushed
2803 ** onto the stack.
2804 */
2805 case OP_NewRecno: {
2806   int i = pOp->p1;
2807   int v = 0;
2808   Cursor *pC;
2809   assert( i>=0 && i<p->nCursor );
2810   if( (pC = &p->aCsr[i])->pCursor==0 ){
2811     v = 0;
2812   }else{
2813     /* The next rowid or record number (different terms for the same
2814     ** thing) is obtained in a two-step algorithm.
2815     **
2816     ** First we attempt to find the largest existing rowid and add one
2817     ** to that.  But if the largest existing rowid is already the maximum
2818     ** positive integer, we have to fall through to the second
2819     ** probabilistic algorithm
2820     **
2821     ** The second algorithm is to select a rowid at random and see if
2822     ** it already exists in the table.  If it does not exist, we have
2823     ** succeeded.  If the random rowid does exist, we select a new one
2824     ** and try again, up to 1000 times.
2825     **
2826     ** For a table with less than 2 billion entries, the probability
2827     ** of not finding a unused rowid is about 1.0e-300.  This is a
2828     ** non-zero probability, but it is still vanishingly small and should
2829     ** never cause a problem.  You are much, much more likely to have a
2830     ** hardware failure than for this algorithm to fail.
2831     **
2832     ** The analysis in the previous paragraph assumes that you have a good
2833     ** source of random numbers.  Is a library function like lrand48()
2834     ** good enough?  Maybe. Maybe not. It's hard to know whether there
2835     ** might be subtle bugs is some implementations of lrand48() that
2836     ** could cause problems. To avoid uncertainty, SQLite uses its own
2837     ** random number generator based on the RC4 algorithm.
2838     **
2839     ** To promote locality of reference for repetitive inserts, the
2840     ** first few attempts at chosing a random rowid pick values just a little
2841     ** larger than the previous rowid.  This has been shown experimentally
2842     ** to double the speed of the COPY operation.
2843     */
2844     int res, rx, cnt, x;
2845     cnt = 0;
2846     if( !pC->useRandomRowid ){
2847       if( pC->nextRowidValid ){
2848         v = pC->nextRowid;
2849       }else{
2850         rx = sqliteBtreeLast(pC->pCursor, &res);
2851         if( res ){
2852           v = 1;
2853         }else{
2854           sqliteBtreeKey(pC->pCursor, 0, sizeof(v), (void*)&v);
2855           v = keyToInt(v);
2856           if( v==0x7fffffff ){
2857             pC->useRandomRowid = 1;
2858           }else{
2859             v++;
2860           }
2861         }
2862       }
2863       if( v<0x7fffffff ){
2864         pC->nextRowidValid = 1;
2865         pC->nextRowid = v+1;
2866       }else{
2867         pC->nextRowidValid = 0;
2868       }
2869     }
2870     if( pC->useRandomRowid ){
2871       v = db->priorNewRowid;
2872       cnt = 0;
2873       do{
2874         if( v==0 || cnt>2 ){
2875           sqliteRandomness(sizeof(v), &v);
2876           if( cnt<5 ) v &= 0xffffff;
2877         }else{
2878           unsigned char r;
2879           sqliteRandomness(1, &r);
2880           v += r + 1;
2881         }
2882         if( v==0 ) continue;
2883         x = intToKey(v);
2884         rx = sqliteBtreeMoveto(pC->pCursor, &x, sizeof(int), &res);
2885         cnt++;
2886       }while( cnt<1000 && rx==SQLITE_OK && res==0 );
2887       db->priorNewRowid = v;
2888       if( rx==SQLITE_OK && res==0 ){
2889         rc = SQLITE_FULL;
2890         goto abort_due_to_error;
2891       }
2892     }
2893     pC->recnoIsValid = 0;
2894     pC->deferredMoveto = 0;
2895   }
2896   pTos++;
2897   pTos->i = v;
2898   pTos->flags = MEM_Int;
2899   break;
2900 }
2901 
2902 /* Opcode: PutIntKey P1 P2 *
2903 **
2904 ** Write an entry into the table of cursor P1.  A new entry is
2905 ** created if it doesn't already exist or the data for an existing
2906 ** entry is overwritten.  The data is the value on the top of the
2907 ** stack.  The key is the next value down on the stack.  The key must
2908 ** be an integer.  The stack is popped twice by this instruction.
2909 **
2910 ** If the OPFLAG_NCHANGE flag of P2 is set, then the row change count is
2911 ** incremented (otherwise not).  If the OPFLAG_CSCHANGE flag is set,
2912 ** then the current statement change count is incremented (otherwise not).
2913 ** If the OPFLAG_LASTROWID flag of P2 is set, then rowid is
2914 ** stored for subsequent return by the sqlite_last_insert_rowid() function
2915 ** (otherwise it's unmodified).
2916 */
2917 /* Opcode: PutStrKey P1 * *
2918 **
2919 ** Write an entry into the table of cursor P1.  A new entry is
2920 ** created if it doesn't already exist or the data for an existing
2921 ** entry is overwritten.  The data is the value on the top of the
2922 ** stack.  The key is the next value down on the stack.  The key must
2923 ** be a string.  The stack is popped twice by this instruction.
2924 **
2925 ** P1 may not be a pseudo-table opened using the OpenPseudo opcode.
2926 */
2927 case OP_PutIntKey:
2928 case OP_PutStrKey: {
2929   Mem *pNos = &pTos[-1];
2930   int i = pOp->p1;
2931   Cursor *pC;
2932   assert( pNos>=p->aStack );
2933   assert( i>=0 && i<p->nCursor );
2934   if( ((pC = &p->aCsr[i])->pCursor!=0 || pC->pseudoTable) ){
2935     char *zKey;
2936     int nKey, iKey;
2937     if( pOp->opcode==OP_PutStrKey ){
2938       Stringify(pNos);
2939       nKey = pNos->n;
2940       zKey = pNos->z;
2941     }else{
2942       assert( pNos->flags & MEM_Int );
2943       nKey = sizeof(int);
2944       iKey = intToKey(pNos->i);
2945       zKey = (char*)&iKey;
2946       if( pOp->p2 & OPFLAG_NCHANGE ) db->nChange++;
2947       if( pOp->p2 & OPFLAG_LASTROWID ) db->lastRowid = pNos->i;
2948       if( pOp->p2 & OPFLAG_CSCHANGE ) db->csChange++;
2949       if( pC->nextRowidValid && pTos->i>=pC->nextRowid ){
2950         pC->nextRowidValid = 0;
2951       }
2952     }
2953     if( pTos->flags & MEM_Null ){
2954       pTos->z = 0;
2955       pTos->n = 0;
2956     }else{
2957       assert( pTos->flags & MEM_Str );
2958     }
2959     if( pC->pseudoTable ){
2960       /* PutStrKey does not work for pseudo-tables.
2961       ** The following assert makes sure we are not trying to use
2962       ** PutStrKey on a pseudo-table
2963       */
2964       assert( pOp->opcode==OP_PutIntKey );
2965       sqliteFree(pC->pData);
2966       pC->iKey = iKey;
2967       pC->nData = pTos->n;
2968       if( pTos->flags & MEM_Dyn ){
2969         pC->pData = pTos->z;
2970         pTos->flags = MEM_Null;
2971       }else{
2972         pC->pData = sqliteMallocRaw( pC->nData );
2973         if( pC->pData ){
2974           memcpy(pC->pData, pTos->z, pC->nData);
2975         }
2976       }
2977       pC->nullRow = 0;
2978     }else{
2979       rc = sqliteBtreeInsert(pC->pCursor, zKey, nKey, pTos->z, pTos->n);
2980     }
2981     pC->recnoIsValid = 0;
2982     pC->deferredMoveto = 0;
2983   }
2984   popStack(&pTos, 2);
2985   break;
2986 }
2987 
2988 /* Opcode: Delete P1 P2 *
2989 **
2990 ** Delete the record at which the P1 cursor is currently pointing.
2991 **
2992 ** The cursor will be left pointing at either the next or the previous
2993 ** record in the table. If it is left pointing at the next record, then
2994 ** the next Next instruction will be a no-op.  Hence it is OK to delete
2995 ** a record from within an Next loop.
2996 **
2997 ** If the OPFLAG_NCHANGE flag of P2 is set, then the row change count is
2998 ** incremented (otherwise not).  If OPFLAG_CSCHANGE flag is set,
2999 ** then the current statement change count is incremented (otherwise not).
3000 **
3001 ** If P1 is a pseudo-table, then this instruction is a no-op.
3002 */
3003 case OP_Delete: {
3004   int i = pOp->p1;
3005   Cursor *pC;
3006   assert( i>=0 && i<p->nCursor );
3007   pC = &p->aCsr[i];
3008   if( pC->pCursor!=0 ){
3009     sqliteVdbeCursorMoveto(pC);
3010     rc = sqliteBtreeDelete(pC->pCursor);
3011     pC->nextRowidValid = 0;
3012   }
3013   if( pOp->p2 & OPFLAG_NCHANGE ) db->nChange++;
3014   if( pOp->p2 & OPFLAG_CSCHANGE ) db->csChange++;
3015   break;
3016 }
3017 
3018 /* Opcode: SetCounts * * *
3019 **
3020 ** Called at end of statement.  Updates lsChange (last statement change count)
3021 ** and resets csChange (current statement change count) to 0.
3022 */
3023 case OP_SetCounts: {
3024   db->lsChange=db->csChange;
3025   db->csChange=0;
3026   break;
3027 }
3028 
3029 /* Opcode: KeyAsData P1 P2 *
3030 **
3031 ** Turn the key-as-data mode for cursor P1 either on (if P2==1) or
3032 ** off (if P2==0).  In key-as-data mode, the OP_Column opcode pulls
3033 ** data off of the key rather than the data.  This is used for
3034 ** processing compound selects.
3035 */
3036 case OP_KeyAsData: {
3037   int i = pOp->p1;
3038   assert( i>=0 && i<p->nCursor );
3039   p->aCsr[i].keyAsData = pOp->p2;
3040   break;
3041 }
3042 
3043 /* Opcode: RowData P1 * *
3044 **
3045 ** Push onto the stack the complete row data for cursor P1.
3046 ** There is no interpretation of the data.  It is just copied
3047 ** onto the stack exactly as it is found in the database file.
3048 **
3049 ** If the cursor is not pointing to a valid row, a NULL is pushed
3050 ** onto the stack.
3051 */
3052 /* Opcode: RowKey P1 * *
3053 **
3054 ** Push onto the stack the complete row key for cursor P1.
3055 ** There is no interpretation of the key.  It is just copied
3056 ** onto the stack exactly as it is found in the database file.
3057 **
3058 ** If the cursor is not pointing to a valid row, a NULL is pushed
3059 ** onto the stack.
3060 */
3061 case OP_RowKey:
3062 case OP_RowData: {
3063   int i = pOp->p1;
3064   Cursor *pC;
3065   int n;
3066 
3067   pTos++;
3068   assert( i>=0 && i<p->nCursor );
3069   pC = &p->aCsr[i];
3070   if( pC->nullRow ){
3071     pTos->flags = MEM_Null;
3072   }else if( pC->pCursor!=0 ){
3073     BtCursor *pCrsr = pC->pCursor;
3074     sqliteVdbeCursorMoveto(pC);
3075     if( pC->nullRow ){
3076       pTos->flags = MEM_Null;
3077       break;
3078     }else if( pC->keyAsData || pOp->opcode==OP_RowKey ){
3079       sqliteBtreeKeySize(pCrsr, &n);
3080     }else{
3081       sqliteBtreeDataSize(pCrsr, &n);
3082     }
3083     pTos->n = n;
3084     if( n<=NBFS ){
3085       pTos->flags = MEM_Str | MEM_Short;
3086       pTos->z = pTos->zShort;
3087     }else{
3088       char *z = sqliteMallocRaw( n );
3089       if( z==0 ) goto no_mem;
3090       pTos->flags = MEM_Str | MEM_Dyn;
3091       pTos->z = z;
3092     }
3093     if( pC->keyAsData || pOp->opcode==OP_RowKey ){
3094       sqliteBtreeKey(pCrsr, 0, n, pTos->z);
3095     }else{
3096       sqliteBtreeData(pCrsr, 0, n, pTos->z);
3097     }
3098   }else if( pC->pseudoTable ){
3099     pTos->n = pC->nData;
3100     pTos->z = pC->pData;
3101     pTos->flags = MEM_Str|MEM_Ephem;
3102   }else{
3103     pTos->flags = MEM_Null;
3104   }
3105   break;
3106 }
3107 
3108 /* Opcode: Column P1 P2 *
3109 **
3110 ** Interpret the data that cursor P1 points to as
3111 ** a structure built using the MakeRecord instruction.
3112 ** (See the MakeRecord opcode for additional information about
3113 ** the format of the data.)
3114 ** Push onto the stack the value of the P2-th column contained
3115 ** in the data.
3116 **
3117 ** If the KeyAsData opcode has previously executed on this cursor,
3118 ** then the field might be extracted from the key rather than the
3119 ** data.
3120 **
3121 ** If P1 is negative, then the record is stored on the stack rather
3122 ** than in a table.  For P1==-1, the top of the stack is used.
3123 ** For P1==-2, the next on the stack is used.  And so forth.  The
3124 ** value pushed is always just a pointer into the record which is
3125 ** stored further down on the stack.  The column value is not copied.
3126 */
3127 case OP_Column: {
3128   int amt, offset, end, payloadSize;
3129   int i = pOp->p1;
3130   int p2 = pOp->p2;
3131   Cursor *pC;
3132   char *zRec;
3133   BtCursor *pCrsr;
3134   int idxWidth;
3135   unsigned char aHdr[10];
3136 
3137   assert( i<p->nCursor );
3138   pTos++;
3139   if( i<0 ){
3140     assert( &pTos[i]>=p->aStack );
3141     assert( pTos[i].flags & MEM_Str );
3142     zRec = pTos[i].z;
3143     payloadSize = pTos[i].n;
3144   }else if( (pC = &p->aCsr[i])->pCursor!=0 ){
3145     sqliteVdbeCursorMoveto(pC);
3146     zRec = 0;
3147     pCrsr = pC->pCursor;
3148     if( pC->nullRow ){
3149       payloadSize = 0;
3150     }else if( pC->keyAsData ){
3151       sqliteBtreeKeySize(pCrsr, &payloadSize);
3152     }else{
3153       sqliteBtreeDataSize(pCrsr, &payloadSize);
3154     }
3155   }else if( pC->pseudoTable ){
3156     payloadSize = pC->nData;
3157     zRec = pC->pData;
3158     assert( payloadSize==0 || zRec!=0 );
3159   }else{
3160     payloadSize = 0;
3161   }
3162 
3163   /* Figure out how many bytes in the column data and where the column
3164   ** data begins.
3165   */
3166   if( payloadSize==0 ){
3167     pTos->flags = MEM_Null;
3168     break;
3169   }else if( payloadSize<256 ){
3170     idxWidth = 1;
3171   }else if( payloadSize<65536 ){
3172     idxWidth = 2;
3173   }else{
3174     idxWidth = 3;
3175   }
3176 
3177   /* Figure out where the requested column is stored and how big it is.
3178   */
3179   if( payloadSize < idxWidth*(p2+1) ){
3180     rc = SQLITE_CORRUPT;
3181     goto abort_due_to_error;
3182   }
3183   if( zRec ){
3184     memcpy(aHdr, &zRec[idxWidth*p2], idxWidth*2);
3185   }else if( pC->keyAsData ){
3186     sqliteBtreeKey(pCrsr, idxWidth*p2, idxWidth*2, (char*)aHdr);
3187   }else{
3188     sqliteBtreeData(pCrsr, idxWidth*p2, idxWidth*2, (char*)aHdr);
3189   }
3190   offset = aHdr[0];
3191   end = aHdr[idxWidth];
3192   if( idxWidth>1 ){
3193     offset |= aHdr[1]<<8;
3194     end |= aHdr[idxWidth+1]<<8;
3195     if( idxWidth>2 ){
3196       offset |= aHdr[2]<<16;
3197       end |= aHdr[idxWidth+2]<<16;
3198     }
3199   }
3200   amt = end - offset;
3201   if( amt<0 || offset<0 || end>payloadSize ){
3202     rc = SQLITE_CORRUPT;
3203     goto abort_due_to_error;
3204   }
3205 
3206   /* amt and offset now hold the offset to the start of data and the
3207   ** amount of data.  Go get the data and put it on the stack.
3208   */
3209   pTos->n = amt;
3210   if( amt==0 ){
3211     pTos->flags = MEM_Null;
3212   }else if( zRec ){
3213     pTos->flags = MEM_Str | MEM_Ephem;
3214     pTos->z = &zRec[offset];
3215   }else{
3216     if( amt<=NBFS ){
3217       pTos->flags = MEM_Str | MEM_Short;
3218       pTos->z = pTos->zShort;
3219     }else{
3220       char *z = sqliteMallocRaw( amt );
3221       if( z==0 ) goto no_mem;
3222       pTos->flags = MEM_Str | MEM_Dyn;
3223       pTos->z = z;
3224     }
3225     if( pC->keyAsData ){
3226       sqliteBtreeKey(pCrsr, offset, amt, pTos->z);
3227     }else{
3228       sqliteBtreeData(pCrsr, offset, amt, pTos->z);
3229     }
3230   }
3231   break;
3232 }
3233 
3234 /* Opcode: Recno P1 * *
3235 **
3236 ** Push onto the stack an integer which is the first 4 bytes of the
3237 ** the key to the current entry in a sequential scan of the database
3238 ** file P1.  The sequential scan should have been started using the
3239 ** Next opcode.
3240 */
3241 case OP_Recno: {
3242   int i = pOp->p1;
3243   Cursor *pC;
3244   int v;
3245 
3246   assert( i>=0 && i<p->nCursor );
3247   pC = &p->aCsr[i];
3248   sqliteVdbeCursorMoveto(pC);
3249   pTos++;
3250   if( pC->recnoIsValid ){
3251     v = pC->lastRecno;
3252   }else if( pC->pseudoTable ){
3253     v = keyToInt(pC->iKey);
3254   }else if( pC->nullRow || pC->pCursor==0 ){
3255     pTos->flags = MEM_Null;
3256     break;
3257   }else{
3258     assert( pC->pCursor!=0 );
3259     sqliteBtreeKey(pC->pCursor, 0, sizeof(u32), (char*)&v);
3260     v = keyToInt(v);
3261   }
3262   pTos->i = v;
3263   pTos->flags = MEM_Int;
3264   break;
3265 }
3266 
3267 /* Opcode: FullKey P1 * *
3268 **
3269 ** Extract the complete key from the record that cursor P1 is currently
3270 ** pointing to and push the key onto the stack as a string.
3271 **
3272 ** Compare this opcode to Recno.  The Recno opcode extracts the first
3273 ** 4 bytes of the key and pushes those bytes onto the stack as an
3274 ** integer.  This instruction pushes the entire key as a string.
3275 **
3276 ** This opcode may not be used on a pseudo-table.
3277 */
3278 case OP_FullKey: {
3279   int i = pOp->p1;
3280   BtCursor *pCrsr;
3281 
3282   assert( p->aCsr[i].keyAsData );
3283   assert( !p->aCsr[i].pseudoTable );
3284   assert( i>=0 && i<p->nCursor );
3285   pTos++;
3286   if( (pCrsr = p->aCsr[i].pCursor)!=0 ){
3287     int amt;
3288     char *z;
3289 
3290     sqliteVdbeCursorMoveto(&p->aCsr[i]);
3291     sqliteBtreeKeySize(pCrsr, &amt);
3292     if( amt<=0 ){
3293       rc = SQLITE_CORRUPT;
3294       goto abort_due_to_error;
3295     }
3296     if( amt>NBFS ){
3297       z = sqliteMallocRaw( amt );
3298       if( z==0 ) goto no_mem;
3299       pTos->flags = MEM_Str | MEM_Dyn;
3300     }else{
3301       z = pTos->zShort;
3302       pTos->flags = MEM_Str | MEM_Short;
3303     }
3304     sqliteBtreeKey(pCrsr, 0, amt, z);
3305     pTos->z = z;
3306     pTos->n = amt;
3307   }
3308   break;
3309 }
3310 
3311 /* Opcode: NullRow P1 * *
3312 **
3313 ** Move the cursor P1 to a null row.  Any OP_Column operations
3314 ** that occur while the cursor is on the null row will always push
3315 ** a NULL onto the stack.
3316 */
3317 case OP_NullRow: {
3318   int i = pOp->p1;
3319 
3320   assert( i>=0 && i<p->nCursor );
3321   p->aCsr[i].nullRow = 1;
3322   p->aCsr[i].recnoIsValid = 0;
3323   break;
3324 }
3325 
3326 /* Opcode: Last P1 P2 *
3327 **
3328 ** The next use of the Recno or Column or Next instruction for P1
3329 ** will refer to the last entry in the database table or index.
3330 ** If the table or index is empty and P2>0, then jump immediately to P2.
3331 ** If P2 is 0 or if the table or index is not empty, fall through
3332 ** to the following instruction.
3333 */
3334 case OP_Last: {
3335   int i = pOp->p1;
3336   Cursor *pC;
3337   BtCursor *pCrsr;
3338 
3339   assert( i>=0 && i<p->nCursor );
3340   pC = &p->aCsr[i];
3341   if( (pCrsr = pC->pCursor)!=0 ){
3342     int res;
3343     rc = sqliteBtreeLast(pCrsr, &res);
3344     pC->nullRow = res;
3345     pC->deferredMoveto = 0;
3346     if( res && pOp->p2>0 ){
3347       pc = pOp->p2 - 1;
3348     }
3349   }else{
3350     pC->nullRow = 0;
3351   }
3352   break;
3353 }
3354 
3355 /* Opcode: Rewind P1 P2 *
3356 **
3357 ** The next use of the Recno or Column or Next instruction for P1
3358 ** will refer to the first entry in the database table or index.
3359 ** If the table or index is empty and P2>0, then jump immediately to P2.
3360 ** If P2 is 0 or if the table or index is not empty, fall through
3361 ** to the following instruction.
3362 */
3363 case OP_Rewind: {
3364   int i = pOp->p1;
3365   Cursor *pC;
3366   BtCursor *pCrsr;
3367 
3368   assert( i>=0 && i<p->nCursor );
3369   pC = &p->aCsr[i];
3370   if( (pCrsr = pC->pCursor)!=0 ){
3371     int res;
3372     rc = sqliteBtreeFirst(pCrsr, &res);
3373     pC->atFirst = res==0;
3374     pC->nullRow = res;
3375     pC->deferredMoveto = 0;
3376     if( res && pOp->p2>0 ){
3377       pc = pOp->p2 - 1;
3378     }
3379   }else{
3380     pC->nullRow = 0;
3381   }
3382   break;
3383 }
3384 
3385 /* Opcode: Next P1 P2 *
3386 **
3387 ** Advance cursor P1 so that it points to the next key/data pair in its
3388 ** table or index.  If there are no more key/value pairs then fall through
3389 ** to the following instruction.  But if the cursor advance was successful,
3390 ** jump immediately to P2.
3391 **
3392 ** See also: Prev
3393 */
3394 /* Opcode: Prev P1 P2 *
3395 **
3396 ** Back up cursor P1 so that it points to the previous key/data pair in its
3397 ** table or index.  If there is no previous key/value pairs then fall through
3398 ** to the following instruction.  But if the cursor backup was successful,
3399 ** jump immediately to P2.
3400 */
3401 case OP_Prev:
3402 case OP_Next: {
3403   Cursor *pC;
3404   BtCursor *pCrsr;
3405 
3406   CHECK_FOR_INTERRUPT;
3407   assert( pOp->p1>=0 && pOp->p1<p->nCursor );
3408   pC = &p->aCsr[pOp->p1];
3409   if( (pCrsr = pC->pCursor)!=0 ){
3410     int res;
3411     if( pC->nullRow ){
3412       res = 1;
3413     }else{
3414       assert( pC->deferredMoveto==0 );
3415       rc = pOp->opcode==OP_Next ? sqliteBtreeNext(pCrsr, &res) :
3416                                   sqliteBtreePrevious(pCrsr, &res);
3417       pC->nullRow = res;
3418     }
3419     if( res==0 ){
3420       pc = pOp->p2 - 1;
3421       sqlite_search_count++;
3422     }
3423   }else{
3424     pC->nullRow = 1;
3425   }
3426   pC->recnoIsValid = 0;
3427   break;
3428 }
3429 
3430 /* Opcode: IdxPut P1 P2 P3
3431 **
3432 ** The top of the stack holds a SQL index key made using the
3433 ** MakeIdxKey instruction.  This opcode writes that key into the
3434 ** index P1.  Data for the entry is nil.
3435 **
3436 ** If P2==1, then the key must be unique.  If the key is not unique,
3437 ** the program aborts with a SQLITE_CONSTRAINT error and the database
3438 ** is rolled back.  If P3 is not null, then it becomes part of the
3439 ** error message returned with the SQLITE_CONSTRAINT.
3440 */
3441 case OP_IdxPut: {
3442   int i = pOp->p1;
3443   BtCursor *pCrsr;
3444   assert( pTos>=p->aStack );
3445   assert( i>=0 && i<p->nCursor );
3446   assert( pTos->flags & MEM_Str );
3447   if( (pCrsr = p->aCsr[i].pCursor)!=0 ){
3448     int nKey = pTos->n;
3449     const char *zKey = pTos->z;
3450     if( pOp->p2 ){
3451       int res, n;
3452       assert( nKey >= 4 );
3453       rc = sqliteBtreeMoveto(pCrsr, zKey, nKey-4, &res);
3454       if( rc!=SQLITE_OK ) goto abort_due_to_error;
3455       while( res!=0 ){
3456         int c;
3457         sqliteBtreeKeySize(pCrsr, &n);
3458         if( n==nKey
3459            && sqliteBtreeKeyCompare(pCrsr, zKey, nKey-4, 4, &c)==SQLITE_OK
3460            && c==0
3461         ){
3462           rc = SQLITE_CONSTRAINT;
3463           if( pOp->p3 && pOp->p3[0] ){
3464             sqliteSetString(&p->zErrMsg, pOp->p3, (char*)0);
3465           }
3466           goto abort_due_to_error;
3467         }
3468         if( res<0 ){
3469           sqliteBtreeNext(pCrsr, &res);
3470           res = +1;
3471         }else{
3472           break;
3473         }
3474       }
3475     }
3476     rc = sqliteBtreeInsert(pCrsr, zKey, nKey, "", 0);
3477     assert( p->aCsr[i].deferredMoveto==0 );
3478   }
3479   Release(pTos);
3480   pTos--;
3481   break;
3482 }
3483 
3484 /* Opcode: IdxDelete P1 * *
3485 **
3486 ** The top of the stack is an index key built using the MakeIdxKey opcode.
3487 ** This opcode removes that entry from the index.
3488 */
3489 case OP_IdxDelete: {
3490   int i = pOp->p1;
3491   BtCursor *pCrsr;
3492   assert( pTos>=p->aStack );
3493   assert( pTos->flags & MEM_Str );
3494   assert( i>=0 && i<p->nCursor );
3495   if( (pCrsr = p->aCsr[i].pCursor)!=0 ){
3496     int rx, res;
3497     rx = sqliteBtreeMoveto(pCrsr, pTos->z, pTos->n, &res);
3498     if( rx==SQLITE_OK && res==0 ){
3499       rc = sqliteBtreeDelete(pCrsr);
3500     }
3501     assert( p->aCsr[i].deferredMoveto==0 );
3502   }
3503   Release(pTos);
3504   pTos--;
3505   break;
3506 }
3507 
3508 /* Opcode: IdxRecno P1 * *
3509 **
3510 ** Push onto the stack an integer which is the last 4 bytes of the
3511 ** the key to the current entry in index P1.  These 4 bytes should
3512 ** be the record number of the table entry to which this index entry
3513 ** points.
3514 **
3515 ** See also: Recno, MakeIdxKey.
3516 */
3517 case OP_IdxRecno: {
3518   int i = pOp->p1;
3519   BtCursor *pCrsr;
3520 
3521   assert( i>=0 && i<p->nCursor );
3522   pTos++;
3523   if( (pCrsr = p->aCsr[i].pCursor)!=0 ){
3524     int v;
3525     int sz;
3526     assert( p->aCsr[i].deferredMoveto==0 );
3527     sqliteBtreeKeySize(pCrsr, &sz);
3528     if( sz<sizeof(u32) ){
3529       pTos->flags = MEM_Null;
3530     }else{
3531       sqliteBtreeKey(pCrsr, sz - sizeof(u32), sizeof(u32), (char*)&v);
3532       v = keyToInt(v);
3533       pTos->i = v;
3534       pTos->flags = MEM_Int;
3535     }
3536   }else{
3537     pTos->flags = MEM_Null;
3538   }
3539   break;
3540 }
3541 
3542 /* Opcode: IdxGT P1 P2 *
3543 **
3544 ** Compare the top of the stack against the key on the index entry that
3545 ** cursor P1 is currently pointing to.  Ignore the last 4 bytes of the
3546 ** index entry.  If the index entry is greater than the top of the stack
3547 ** then jump to P2.  Otherwise fall through to the next instruction.
3548 ** In either case, the stack is popped once.
3549 */
3550 /* Opcode: IdxGE P1 P2 *
3551 **
3552 ** Compare the top of the stack against the key on the index entry that
3553 ** cursor P1 is currently pointing to.  Ignore the last 4 bytes of the
3554 ** index entry.  If the index entry is greater than or equal to
3555 ** the top of the stack
3556 ** then jump to P2.  Otherwise fall through to the next instruction.
3557 ** In either case, the stack is popped once.
3558 */
3559 /* Opcode: IdxLT P1 P2 *
3560 **
3561 ** Compare the top of the stack against the key on the index entry that
3562 ** cursor P1 is currently pointing to.  Ignore the last 4 bytes of the
3563 ** index entry.  If the index entry is less than the top of the stack
3564 ** then jump to P2.  Otherwise fall through to the next instruction.
3565 ** In either case, the stack is popped once.
3566 */
3567 case OP_IdxLT:
3568 case OP_IdxGT:
3569 case OP_IdxGE: {
3570   int i= pOp->p1;
3571   BtCursor *pCrsr;
3572 
3573   assert( i>=0 && i<p->nCursor );
3574   assert( pTos>=p->aStack );
3575   if( (pCrsr = p->aCsr[i].pCursor)!=0 ){
3576     int res, rc;
3577 
3578     Stringify(pTos);
3579     assert( p->aCsr[i].deferredMoveto==0 );
3580     rc = sqliteBtreeKeyCompare(pCrsr, pTos->z, pTos->n, 4, &res);
3581     if( rc!=SQLITE_OK ){
3582       break;
3583     }
3584     if( pOp->opcode==OP_IdxLT ){
3585       res = -res;
3586     }else if( pOp->opcode==OP_IdxGE ){
3587       res++;
3588     }
3589     if( res>0 ){
3590       pc = pOp->p2 - 1 ;
3591     }
3592   }
3593   Release(pTos);
3594   pTos--;
3595   break;
3596 }
3597 
3598 /* Opcode: IdxIsNull P1 P2 *
3599 **
3600 ** The top of the stack contains an index entry such as might be generated
3601 ** by the MakeIdxKey opcode.  This routine looks at the first P1 fields of
3602 ** that key.  If any of the first P1 fields are NULL, then a jump is made
3603 ** to address P2.  Otherwise we fall straight through.
3604 **
3605 ** The index entry is always popped from the stack.
3606 */
3607 case OP_IdxIsNull: {
3608   int i = pOp->p1;
3609   int k, n;
3610   const char *z;
3611 
3612   assert( pTos>=p->aStack );
3613   assert( pTos->flags & MEM_Str );
3614   z = pTos->z;
3615   n = pTos->n;
3616   for(k=0; k<n && i>0; i--){
3617     if( z[k]=='a' ){
3618       pc = pOp->p2-1;
3619       break;
3620     }
3621     while( k<n && z[k] ){ k++; }
3622     k++;
3623   }
3624   Release(pTos);
3625   pTos--;
3626   break;
3627 }
3628 
3629 /* Opcode: Destroy P1 P2 *
3630 **
3631 ** Delete an entire database table or index whose root page in the database
3632 ** file is given by P1.
3633 **
3634 ** The table being destroyed is in the main database file if P2==0.  If
3635 ** P2==1 then the table to be clear is in the auxiliary database file
3636 ** that is used to store tables create using CREATE TEMPORARY TABLE.
3637 **
3638 ** See also: Clear
3639 */
3640 case OP_Destroy: {
3641   rc = sqliteBtreeDropTable(db->aDb[pOp->p2].pBt, pOp->p1);
3642   break;
3643 }
3644 
3645 /* Opcode: Clear P1 P2 *
3646 **
3647 ** Delete all contents of the database table or index whose root page
3648 ** in the database file is given by P1.  But, unlike Destroy, do not
3649 ** remove the table or index from the database file.
3650 **
3651 ** The table being clear is in the main database file if P2==0.  If
3652 ** P2==1 then the table to be clear is in the auxiliary database file
3653 ** that is used to store tables create using CREATE TEMPORARY TABLE.
3654 **
3655 ** See also: Destroy
3656 */
3657 case OP_Clear: {
3658   rc = sqliteBtreeClearTable(db->aDb[pOp->p2].pBt, pOp->p1);
3659   break;
3660 }
3661 
3662 /* Opcode: CreateTable * P2 P3
3663 **
3664 ** Allocate a new table in the main database file if P2==0 or in the
3665 ** auxiliary database file if P2==1.  Push the page number
3666 ** for the root page of the new table onto the stack.
3667 **
3668 ** The root page number is also written to a memory location that P3
3669 ** points to.  This is the mechanism is used to write the root page
3670 ** number into the parser's internal data structures that describe the
3671 ** new table.
3672 **
3673 ** The difference between a table and an index is this:  A table must
3674 ** have a 4-byte integer key and can have arbitrary data.  An index
3675 ** has an arbitrary key but no data.
3676 **
3677 ** See also: CreateIndex
3678 */
3679 /* Opcode: CreateIndex * P2 P3
3680 **
3681 ** Allocate a new index in the main database file if P2==0 or in the
3682 ** auxiliary database file if P2==1.  Push the page number of the
3683 ** root page of the new index onto the stack.
3684 **
3685 ** See documentation on OP_CreateTable for additional information.
3686 */
3687 case OP_CreateIndex:
3688 case OP_CreateTable: {
3689   int pgno;
3690   assert( pOp->p3!=0 && pOp->p3type==P3_POINTER );
3691   assert( pOp->p2>=0 && pOp->p2<db->nDb );
3692   assert( db->aDb[pOp->p2].pBt!=0 );
3693   if( pOp->opcode==OP_CreateTable ){
3694     rc = sqliteBtreeCreateTable(db->aDb[pOp->p2].pBt, &pgno);
3695   }else{
3696     rc = sqliteBtreeCreateIndex(db->aDb[pOp->p2].pBt, &pgno);
3697   }
3698   pTos++;
3699   if( rc==SQLITE_OK ){
3700     pTos->i = pgno;
3701     pTos->flags = MEM_Int;
3702     *(u32*)pOp->p3 = pgno;
3703     pOp->p3 = 0;
3704   }else{
3705     pTos->flags = MEM_Null;
3706   }
3707   break;
3708 }
3709 
3710 /* Opcode: IntegrityCk P1 P2 *
3711 **
3712 ** Do an analysis of the currently open database.  Push onto the
3713 ** stack the text of an error message describing any problems.
3714 ** If there are no errors, push a "ok" onto the stack.
3715 **
3716 ** P1 is the index of a set that contains the root page numbers
3717 ** for all tables and indices in the main database file.  The set
3718 ** is cleared by this opcode.  In other words, after this opcode
3719 ** has executed, the set will be empty.
3720 **
3721 ** If P2 is not zero, the check is done on the auxiliary database
3722 ** file, not the main database file.
3723 **
3724 ** This opcode is used for testing purposes only.
3725 */
3726 case OP_IntegrityCk: {
3727   int nRoot;
3728   int *aRoot;
3729   int iSet = pOp->p1;
3730   Set *pSet;
3731   int j;
3732   HashElem *i;
3733   char *z;
3734 
3735   assert( iSet>=0 && iSet<p->nSet );
3736   pTos++;
3737   pSet = &p->aSet[iSet];
3738   nRoot = sqliteHashCount(&pSet->hash);
3739   aRoot = sqliteMallocRaw( sizeof(int)*(nRoot+1) );
3740   if( aRoot==0 ) goto no_mem;
3741   for(j=0, i=sqliteHashFirst(&pSet->hash); i; i=sqliteHashNext(i), j++){
3742     toInt((char*)sqliteHashKey(i), &aRoot[j]);
3743   }
3744   aRoot[j] = 0;
3745   sqliteHashClear(&pSet->hash);
3746   pSet->prev = 0;
3747   z = sqliteBtreeIntegrityCheck(db->aDb[pOp->p2].pBt, aRoot, nRoot);
3748   if( z==0 || z[0]==0 ){
3749     if( z ) sqliteFree(z);
3750     pTos->z = "ok";
3751     pTos->n = 3;
3752     pTos->flags = MEM_Str | MEM_Static;
3753   }else{
3754     pTos->z = z;
3755     pTos->n = strlen(z) + 1;
3756     pTos->flags = MEM_Str | MEM_Dyn;
3757   }
3758   sqliteFree(aRoot);
3759   break;
3760 }
3761 
3762 /* Opcode: ListWrite * * *
3763 **
3764 ** Write the integer on the top of the stack
3765 ** into the temporary storage list.
3766 */
3767 case OP_ListWrite: {
3768   Keylist *pKeylist;
3769   assert( pTos>=p->aStack );
3770   pKeylist = p->pList;
3771   if( pKeylist==0 || pKeylist->nUsed>=pKeylist->nKey ){
3772     pKeylist = sqliteMallocRaw( sizeof(Keylist)+999*sizeof(pKeylist->aKey[0]) );
3773     if(