000001  /*
000002  ** 2008 August 18
000003  **
000004  ** The author disclaims copyright to this source code.  In place of
000005  ** a legal notice, here is a blessing:
000006  **
000007  **    May you do good and not evil.
000008  **    May you find forgiveness for yourself and forgive others.
000009  **    May you share freely, never taking more than you give.
000010  **
000011  *************************************************************************
000012  **
000013  ** This file contains routines used for walking the parser tree and
000014  ** resolve all identifiers by associating them with a particular
000015  ** table and column.
000016  */
000017  #include "sqliteInt.h"
000018  
000019  /*
000020  ** Magic table number to mean the EXCLUDED table in an UPSERT statement.
000021  */
000022  #define EXCLUDED_TABLE_NUMBER  2
000023  
000024  /*
000025  ** Walk the expression tree pExpr and increase the aggregate function
000026  ** depth (the Expr.op2 field) by N on every TK_AGG_FUNCTION node.
000027  ** This needs to occur when copying a TK_AGG_FUNCTION node from an
000028  ** outer query into an inner subquery.
000029  **
000030  ** incrAggFunctionDepth(pExpr,n) is the main routine.  incrAggDepth(..)
000031  ** is a helper function - a callback for the tree walker.
000032  **
000033  ** See also the sqlite3WindowExtraAggFuncDepth() routine in window.c
000034  */
000035  static int incrAggDepth(Walker *pWalker, Expr *pExpr){
000036    if( pExpr->op==TK_AGG_FUNCTION ) pExpr->op2 += pWalker->u.n;
000037    return WRC_Continue;
000038  }
000039  static void incrAggFunctionDepth(Expr *pExpr, int N){
000040    if( N>0 ){
000041      Walker w;
000042      memset(&w, 0, sizeof(w));
000043      w.xExprCallback = incrAggDepth;
000044      w.u.n = N;
000045      sqlite3WalkExpr(&w, pExpr);
000046    }
000047  }
000048  
000049  /*
000050  ** Turn the pExpr expression into an alias for the iCol-th column of the
000051  ** result set in pEList.
000052  **
000053  ** If the reference is followed by a COLLATE operator, then make sure
000054  ** the COLLATE operator is preserved.  For example:
000055  **
000056  **     SELECT a+b, c+d FROM t1 ORDER BY 1 COLLATE nocase;
000057  **
000058  ** Should be transformed into:
000059  **
000060  **     SELECT a+b, c+d FROM t1 ORDER BY (a+b) COLLATE nocase;
000061  **
000062  ** The nSubquery parameter specifies how many levels of subquery the
000063  ** alias is removed from the original expression.  The usual value is
000064  ** zero but it might be more if the alias is contained within a subquery
000065  ** of the original expression.  The Expr.op2 field of TK_AGG_FUNCTION
000066  ** structures must be increased by the nSubquery amount.
000067  */
000068  static void resolveAlias(
000069    Parse *pParse,         /* Parsing context */
000070    ExprList *pEList,      /* A result set */
000071    int iCol,              /* A column in the result set.  0..pEList->nExpr-1 */
000072    Expr *pExpr,           /* Transform this into an alias to the result set */
000073    int nSubquery          /* Number of subqueries that the label is moving */
000074  ){
000075    Expr *pOrig;           /* The iCol-th column of the result set */
000076    Expr *pDup;            /* Copy of pOrig */
000077    sqlite3 *db;           /* The database connection */
000078  
000079    assert( iCol>=0 && iCol<pEList->nExpr );
000080    pOrig = pEList->a[iCol].pExpr;
000081    assert( pOrig!=0 );
000082    assert( !ExprHasProperty(pExpr, EP_Reduced|EP_TokenOnly) );
000083    if( pExpr->pAggInfo ) return;
000084    db = pParse->db;
000085    pDup = sqlite3ExprDup(db, pOrig, 0);
000086    if( db->mallocFailed ){
000087      sqlite3ExprDelete(db, pDup);
000088      pDup = 0;
000089    }else{
000090      Expr temp;
000091      incrAggFunctionDepth(pDup, nSubquery);
000092      if( pExpr->op==TK_COLLATE ){
000093        assert( !ExprHasProperty(pExpr, EP_IntValue) );
000094        pDup = sqlite3ExprAddCollateString(pParse, pDup, pExpr->u.zToken);
000095      }
000096      memcpy(&temp, pDup, sizeof(Expr));
000097      memcpy(pDup, pExpr, sizeof(Expr));
000098      memcpy(pExpr, &temp, sizeof(Expr));
000099      if( ExprHasProperty(pExpr, EP_WinFunc) ){
000100        if( ALWAYS(pExpr->y.pWin!=0) ){
000101          pExpr->y.pWin->pOwner = pExpr;
000102        }
000103      }
000104      sqlite3ExprDeferredDelete(pParse, pDup);
000105    }
000106  }
000107  
000108  /*
000109  ** Subqueries store the original database, table and column names for their
000110  ** result sets in ExprList.a[].zSpan, in the form "DATABASE.TABLE.COLUMN",
000111  ** and mark the expression-list item by setting ExprList.a[].fg.eEName
000112  ** to ENAME_TAB.
000113  **
000114  ** Check to see if the zSpan/eEName of the expression-list item passed to this
000115  ** routine matches the zDb, zTab, and zCol.  If any of zDb, zTab, and zCol are
000116  ** NULL then those fields will match anything. Return true if there is a match,
000117  ** or false otherwise.
000118  **
000119  ** SF_NestedFrom subqueries also store an entry for the implicit rowid (or
000120  ** _rowid_, or oid) column by setting ExprList.a[].fg.eEName to ENAME_ROWID,
000121  ** and setting zSpan to "DATABASE.TABLE.<rowid-alias>". This type of pItem
000122  ** argument matches if zCol is a rowid alias. If it is not NULL, (*pbRowid)
000123  ** is set to 1 if there is this kind of match.
000124  */
000125  int sqlite3MatchEName(
000126    const struct ExprList_item *pItem,
000127    const char *zCol,
000128    const char *zTab,
000129    const char *zDb,
000130    int *pbRowid
000131  ){
000132    int n;
000133    const char *zSpan;
000134    int eEName = pItem->fg.eEName;
000135    if( eEName!=ENAME_TAB && (eEName!=ENAME_ROWID || NEVER(pbRowid==0)) ){
000136      return 0;
000137    }
000138    assert( pbRowid==0 || *pbRowid==0 );
000139    zSpan = pItem->zEName;
000140    for(n=0; ALWAYS(zSpan[n]) && zSpan[n]!='.'; n++){}
000141    if( zDb && (sqlite3StrNICmp(zSpan, zDb, n)!=0 || zDb[n]!=0) ){
000142      return 0;
000143    }
000144    zSpan += n+1;
000145    for(n=0; ALWAYS(zSpan[n]) && zSpan[n]!='.'; n++){}
000146    if( zTab && (sqlite3StrNICmp(zSpan, zTab, n)!=0 || zTab[n]!=0) ){
000147      return 0;
000148    }
000149    zSpan += n+1;
000150    if( zCol ){
000151      if( eEName==ENAME_TAB && sqlite3StrICmp(zSpan, zCol)!=0 ) return 0;
000152      if( eEName==ENAME_ROWID && sqlite3IsRowid(zCol)==0 ) return 0;
000153    }
000154    if( eEName==ENAME_ROWID ) *pbRowid = 1;
000155    return 1;
000156  }
000157  
000158  /*
000159  ** Return TRUE if the double-quoted string  mis-feature should be supported.
000160  */
000161  static int areDoubleQuotedStringsEnabled(sqlite3 *db, NameContext *pTopNC){
000162    if( db->init.busy ) return 1;  /* Always support for legacy schemas */
000163    if( pTopNC->ncFlags & NC_IsDDL ){
000164      /* Currently parsing a DDL statement */
000165      if( sqlite3WritableSchema(db) && (db->flags & SQLITE_DqsDML)!=0 ){
000166        return 1;
000167      }
000168      return (db->flags & SQLITE_DqsDDL)!=0;
000169    }else{
000170      /* Currently parsing a DML statement */
000171      return (db->flags & SQLITE_DqsDML)!=0;
000172    }
000173  }
000174  
000175  /*
000176  ** The argument is guaranteed to be a non-NULL Expr node of type TK_COLUMN.
000177  ** return the appropriate colUsed mask.
000178  */
000179  Bitmask sqlite3ExprColUsed(Expr *pExpr){
000180    int n;
000181    Table *pExTab;
000182  
000183    n = pExpr->iColumn;
000184    assert( ExprUseYTab(pExpr) );
000185    pExTab = pExpr->y.pTab;
000186    assert( pExTab!=0 );
000187    assert( n < pExTab->nCol );
000188    if( (pExTab->tabFlags & TF_HasGenerated)!=0
000189     && (pExTab->aCol[n].colFlags & COLFLAG_GENERATED)!=0
000190    ){
000191      testcase( pExTab->nCol==BMS-1 );
000192      testcase( pExTab->nCol==BMS );
000193      return pExTab->nCol>=BMS ? ALLBITS : MASKBIT(pExTab->nCol)-1;
000194    }else{
000195      testcase( n==BMS-1 );
000196      testcase( n==BMS );
000197      if( n>=BMS ) n = BMS-1;
000198      return ((Bitmask)1)<<n;
000199    }
000200  }
000201  
000202  /*
000203  ** Create a new expression term for the column specified by pMatch and
000204  ** iColumn.  Append this new expression term to the FULL JOIN Match set
000205  ** in *ppList.  Create a new *ppList if this is the first term in the
000206  ** set.
000207  */
000208  static void extendFJMatch(
000209    Parse *pParse,          /* Parsing context */
000210    ExprList **ppList,      /* ExprList to extend */
000211    SrcItem *pMatch,        /* Source table containing the column */
000212    i16 iColumn             /* The column number */
000213  ){
000214    Expr *pNew = sqlite3ExprAlloc(pParse->db, TK_COLUMN, 0, 0);
000215    if( pNew ){
000216      pNew->iTable = pMatch->iCursor;
000217      pNew->iColumn = iColumn;
000218      pNew->y.pTab = pMatch->pSTab;
000219      assert( (pMatch->fg.jointype & (JT_LEFT|JT_LTORJ))!=0 );
000220      ExprSetProperty(pNew, EP_CanBeNull);
000221      *ppList = sqlite3ExprListAppend(pParse, *ppList, pNew);
000222    }
000223  }
000224  
000225  /*
000226  ** Return TRUE (non-zero) if zTab is a valid name for the schema table pTab.
000227  */
000228  static SQLITE_NOINLINE int isValidSchemaTableName(
000229    const char *zTab,         /* Name as it appears in the SQL */
000230    Table *pTab,              /* The schema table we are trying to match */
000231    const char *zDb           /* non-NULL if a database qualifier is present */
000232  ){
000233    const char *zLegacy;
000234    assert( pTab!=0 );
000235    assert( pTab->tnum==1 );
000236    if( sqlite3StrNICmp(zTab, "sqlite_", 7)!=0 ) return 0;
000237    zLegacy = pTab->zName;
000238    if( strcmp(zLegacy+7, &LEGACY_TEMP_SCHEMA_TABLE[7])==0 ){
000239      if( sqlite3StrICmp(zTab+7, &PREFERRED_TEMP_SCHEMA_TABLE[7])==0 ){
000240        return 1;
000241      }
000242      if( zDb==0 ) return 0;
000243      if( sqlite3StrICmp(zTab+7, &LEGACY_SCHEMA_TABLE[7])==0 ) return 1;
000244      if( sqlite3StrICmp(zTab+7, &PREFERRED_SCHEMA_TABLE[7])==0 ) return 1;
000245    }else{
000246      if( sqlite3StrICmp(zTab+7, &PREFERRED_SCHEMA_TABLE[7])==0 ) return 1;
000247    }
000248    return 0;
000249  }
000250  
000251  /*
000252  ** Given the name of a column of the form X.Y.Z or Y.Z or just Z, look up
000253  ** that name in the set of source tables in pSrcList and make the pExpr
000254  ** expression node refer back to that source column.  The following changes
000255  ** are made to pExpr:
000256  **
000257  **    pExpr->iDb           Set the index in db->aDb[] of the database X
000258  **                         (even if X is implied).
000259  **    pExpr->iTable        Set to the cursor number for the table obtained
000260  **                         from pSrcList.
000261  **    pExpr->y.pTab        Points to the Table structure of X.Y (even if
000262  **                         X and/or Y are implied.)
000263  **    pExpr->iColumn       Set to the column number within the table.
000264  **    pExpr->op            Set to TK_COLUMN.
000265  **    pExpr->pLeft         Any expression this points to is deleted
000266  **    pExpr->pRight        Any expression this points to is deleted.
000267  **
000268  ** The zDb variable is the name of the database (the "X").  This value may be
000269  ** NULL meaning that name is of the form Y.Z or Z.  Any available database
000270  ** can be used.  The zTable variable is the name of the table (the "Y").  This
000271  ** value can be NULL if zDb is also NULL.  If zTable is NULL it
000272  ** means that the form of the name is Z and that columns from any table
000273  ** can be used.
000274  **
000275  ** If the name cannot be resolved unambiguously, leave an error message
000276  ** in pParse and return WRC_Abort.  Return WRC_Prune on success.
000277  */
000278  static int lookupName(
000279    Parse *pParse,       /* The parsing context */
000280    const char *zDb,     /* Name of the database containing table, or NULL */
000281    const char *zTab,    /* Name of table containing column, or NULL */
000282    const Expr *pRight,  /* Name of the column. */
000283    NameContext *pNC,    /* The name context used to resolve the name */
000284    Expr *pExpr          /* Make this EXPR node point to the selected column */
000285  ){
000286    int i, j;                         /* Loop counters */
000287    int cnt = 0;                      /* Number of matching column names */
000288    int cntTab = 0;                   /* Number of potential "rowid" matches */
000289    int nSubquery = 0;                /* How many levels of subquery */
000290    sqlite3 *db = pParse->db;         /* The database connection */
000291    SrcItem *pItem;                   /* Use for looping over pSrcList items */
000292    SrcItem *pMatch = 0;              /* The matching pSrcList item */
000293    NameContext *pTopNC = pNC;        /* First namecontext in the list */
000294    Schema *pSchema = 0;              /* Schema of the expression */
000295    int eNewExprOp = TK_COLUMN;       /* New value for pExpr->op on success */
000296    Table *pTab = 0;                  /* Table holding the row */
000297    Column *pCol;                     /* A column of pTab */
000298    ExprList *pFJMatch = 0;           /* Matches for FULL JOIN .. USING */
000299    const char *zCol = pRight->u.zToken;
000300  
000301    assert( pNC );     /* the name context cannot be NULL. */
000302    assert( zCol );    /* The Z in X.Y.Z cannot be NULL */
000303    assert( zDb==0 || zTab!=0 );
000304    assert( !ExprHasProperty(pExpr, EP_TokenOnly|EP_Reduced) );
000305  
000306    /* Initialize the node to no-match */
000307    pExpr->iTable = -1;
000308    ExprSetVVAProperty(pExpr, EP_NoReduce);
000309  
000310    /* Translate the schema name in zDb into a pointer to the corresponding
000311    ** schema.  If not found, pSchema will remain NULL and nothing will match
000312    ** resulting in an appropriate error message toward the end of this routine
000313    */
000314    if( zDb ){
000315      testcase( pNC->ncFlags & NC_PartIdx );
000316      testcase( pNC->ncFlags & NC_IsCheck );
000317      if( (pNC->ncFlags & (NC_PartIdx|NC_IsCheck))!=0 ){
000318        /* Silently ignore database qualifiers inside CHECK constraints and
000319        ** partial indices.  Do not raise errors because that might break
000320        ** legacy and because it does not hurt anything to just ignore the
000321        ** database name. */
000322        zDb = 0;
000323      }else{
000324        for(i=0; i<db->nDb; i++){
000325          assert( db->aDb[i].zDbSName );
000326          if( sqlite3StrICmp(db->aDb[i].zDbSName,zDb)==0 ){
000327            pSchema = db->aDb[i].pSchema;
000328            break;
000329          }
000330        }
000331        if( i==db->nDb && sqlite3StrICmp("main", zDb)==0 ){
000332          /* This branch is taken when the main database has been renamed
000333          ** using SQLITE_DBCONFIG_MAINDBNAME. */
000334          pSchema = db->aDb[0].pSchema;
000335          zDb = db->aDb[0].zDbSName;
000336        }
000337      }
000338    }
000339  
000340    /* Start at the inner-most context and move outward until a match is found */
000341    assert( pNC && cnt==0 );
000342    do{
000343      ExprList *pEList;
000344      SrcList *pSrcList = pNC->pSrcList;
000345  
000346      if( pSrcList ){
000347        for(i=0, pItem=pSrcList->a; i<pSrcList->nSrc; i++, pItem++){
000348          u8 hCol;
000349          pTab = pItem->pSTab;
000350          assert( pTab!=0 && pTab->zName!=0 );
000351          assert( pTab->nCol>0 || pParse->nErr );
000352          assert( (int)pItem->fg.isNestedFrom == IsNestedFrom(pItem));
000353          if( pItem->fg.isNestedFrom ){
000354            /* In this case, pItem is a subquery that has been formed from a
000355            ** parenthesized subset of the FROM clause terms.  Example:
000356            **   .... FROM t1 LEFT JOIN (t2 RIGHT JOIN t3 USING(x)) USING(y) ...
000357            **                          \_________________________/
000358            **             This pItem -------------^
000359            */
000360            int hit = 0;
000361            Select *pSel;
000362            assert( pItem->fg.isSubquery );
000363            assert( pItem->u4.pSubq!=0 );
000364            pSel = pItem->u4.pSubq->pSelect;
000365            assert( pSel!=0 );
000366            pEList = pSel->pEList;
000367            assert( pEList!=0 );
000368            assert( pEList->nExpr==pTab->nCol );
000369            for(j=0; j<pEList->nExpr; j++){
000370              int bRowid = 0;       /* True if possible rowid match */
000371              if( !sqlite3MatchEName(&pEList->a[j], zCol, zTab, zDb, &bRowid) ){
000372                continue;
000373              }
000374              if( bRowid==0 ){
000375                if( cnt>0 ){
000376                  if( pItem->fg.isUsing==0
000377                   || sqlite3IdListIndex(pItem->u3.pUsing, zCol)<0
000378                  ){
000379                    /* Two or more tables have the same column name which is
000380                    ** not joined by USING.  This is an error.  Signal as much
000381                    ** by clearing pFJMatch and letting cnt go above 1. */
000382                    sqlite3ExprListDelete(db, pFJMatch);
000383                    pFJMatch = 0;
000384                  }else
000385                  if( (pItem->fg.jointype & JT_RIGHT)==0 ){
000386                    /* An INNER or LEFT JOIN.  Use the left-most table */
000387                    continue;
000388                  }else
000389                  if( (pItem->fg.jointype & JT_LEFT)==0 ){
000390                    /* A RIGHT JOIN.  Use the right-most table */
000391                    cnt = 0;
000392                    sqlite3ExprListDelete(db, pFJMatch);
000393                    pFJMatch = 0;
000394                  }else{
000395                    /* For a FULL JOIN, we must construct a coalesce() func */
000396                    extendFJMatch(pParse, &pFJMatch, pMatch, pExpr->iColumn);
000397                  }
000398                }
000399                cnt++;
000400                hit = 1;
000401              }else if( cnt>0 ){
000402                /* This is a potential rowid match, but there has already been
000403                ** a real match found. So this can be ignored.  */
000404                continue;
000405              }
000406              cntTab++;
000407              pMatch = pItem;
000408              pExpr->iColumn = j;
000409              pEList->a[j].fg.bUsed = 1;
000410  
000411              /* rowid cannot be part of a USING clause - assert() this. */
000412              assert( bRowid==0 || pEList->a[j].fg.bUsingTerm==0 );
000413              if( pEList->a[j].fg.bUsingTerm ) break;
000414            }
000415            if( hit || zTab==0 ) continue;
000416          }
000417          assert( zDb==0 || zTab!=0 );
000418          if( zTab ){
000419            if( zDb ){
000420              if( pTab->pSchema!=pSchema ) continue;
000421              if( pSchema==0 && strcmp(zDb,"*")!=0 ) continue;
000422            }
000423            if( pItem->zAlias!=0 ){
000424              if( sqlite3StrICmp(zTab, pItem->zAlias)!=0 ){
000425                continue;
000426              }
000427            }else if( sqlite3StrICmp(zTab, pTab->zName)!=0 ){
000428              if( pTab->tnum!=1 ) continue;
000429              if( !isValidSchemaTableName(zTab, pTab, zDb) ) continue;
000430            }
000431            assert( ExprUseYTab(pExpr) );
000432            if( IN_RENAME_OBJECT && pItem->zAlias ){
000433              sqlite3RenameTokenRemap(pParse, 0, (void*)&pExpr->y.pTab);
000434            }
000435          }
000436          hCol = sqlite3StrIHash(zCol);
000437          for(j=0, pCol=pTab->aCol; j<pTab->nCol; j++, pCol++){
000438            if( pCol->hName==hCol
000439             && sqlite3StrICmp(pCol->zCnName, zCol)==0
000440            ){
000441              if( cnt>0 ){
000442                if( pItem->fg.isUsing==0
000443                 || sqlite3IdListIndex(pItem->u3.pUsing, zCol)<0
000444                ){
000445                  /* Two or more tables have the same column name which is
000446                  ** not joined by USING.  This is an error.  Signal as much
000447                  ** by clearing pFJMatch and letting cnt go above 1. */
000448                  sqlite3ExprListDelete(db, pFJMatch);
000449                  pFJMatch = 0;
000450                }else
000451                if( (pItem->fg.jointype & JT_RIGHT)==0 ){
000452                  /* An INNER or LEFT JOIN.  Use the left-most table */
000453                  continue;
000454                }else
000455                if( (pItem->fg.jointype & JT_LEFT)==0 ){
000456                  /* A RIGHT JOIN.  Use the right-most table */
000457                  cnt = 0;
000458                  sqlite3ExprListDelete(db, pFJMatch);
000459                  pFJMatch = 0;
000460                }else{
000461                  /* For a FULL JOIN, we must construct a coalesce() func */
000462                  extendFJMatch(pParse, &pFJMatch, pMatch, pExpr->iColumn);
000463                }
000464              }
000465              cnt++;
000466              pMatch = pItem;
000467              /* Substitute the rowid (column -1) for the INTEGER PRIMARY KEY */
000468              pExpr->iColumn = j==pTab->iPKey ? -1 : (i16)j;
000469              if( pItem->fg.isNestedFrom ){
000470                sqlite3SrcItemColumnUsed(pItem, j);
000471              }
000472              break;
000473            }
000474          }
000475          if( 0==cnt && VisibleRowid(pTab) ){
000476            /* pTab is a potential ROWID match.  Keep track of it and match
000477            ** the ROWID later if that seems appropriate.  (Search for "cntTab"
000478            ** to find related code.)  Only allow a ROWID match if there is
000479            ** a single ROWID match candidate.
000480            */
000481  #ifdef SQLITE_ALLOW_ROWID_IN_VIEW
000482            /* In SQLITE_ALLOW_ROWID_IN_VIEW mode, allow a ROWID match
000483            ** if there is a single VIEW candidate or if there is a single
000484            ** non-VIEW candidate plus multiple VIEW candidates.  In other
000485            ** words non-VIEW candidate terms take precedence over VIEWs.
000486            */
000487            if( cntTab==0
000488             || (cntTab==1
000489                 && pMatch!=0
000490                 && ALWAYS(pMatch->pSTab!=0)
000491                 && (pMatch->pSTab->tabFlags & TF_Ephemeral)!=0
000492                 && (pTab->tabFlags & TF_Ephemeral)==0)
000493            ){
000494              cntTab = 1;
000495              pMatch = pItem;
000496            }else{
000497              cntTab++;
000498            }
000499  #else
000500            /* The (much more common) non-SQLITE_ALLOW_ROWID_IN_VIEW case is
000501            ** simpler since we require exactly one candidate, which will
000502            ** always be a non-VIEW
000503            */
000504            cntTab++;
000505            pMatch = pItem;
000506  #endif
000507          }
000508        }
000509        if( pMatch ){
000510          pExpr->iTable = pMatch->iCursor;
000511          assert( ExprUseYTab(pExpr) );
000512          pExpr->y.pTab = pMatch->pSTab;
000513          if( (pMatch->fg.jointype & (JT_LEFT|JT_LTORJ))!=0 ){
000514            ExprSetProperty(pExpr, EP_CanBeNull);
000515          }
000516          pSchema = pExpr->y.pTab->pSchema;
000517        }
000518      } /* if( pSrcList ) */
000519  
000520  #if !defined(SQLITE_OMIT_TRIGGER) || !defined(SQLITE_OMIT_UPSERT)
000521      /* If we have not already resolved the name, then maybe
000522      ** it is a new.* or old.* trigger argument reference.  Or
000523      ** maybe it is an excluded.* from an upsert.  Or maybe it is
000524      ** a reference in the RETURNING clause to a table being modified.
000525      */
000526      if( cnt==0 && zDb==0 ){
000527        pTab = 0;
000528  #ifndef SQLITE_OMIT_TRIGGER
000529        if( pParse->pTriggerTab!=0 ){
000530          int op = pParse->eTriggerOp;
000531          assert( op==TK_DELETE || op==TK_UPDATE || op==TK_INSERT );
000532          if( pParse->bReturning ){
000533            if( (pNC->ncFlags & NC_UBaseReg)!=0
000534             && ALWAYS(zTab==0
000535                       || sqlite3StrICmp(zTab,pParse->pTriggerTab->zName)==0
000536                       || isValidSchemaTableName(zTab, pParse->pTriggerTab, 0))
000537            ){
000538              pExpr->iTable = op!=TK_DELETE;
000539              pTab = pParse->pTriggerTab;
000540            }
000541          }else if( op!=TK_DELETE && zTab && sqlite3StrICmp("new",zTab) == 0 ){
000542            pExpr->iTable = 1;
000543            pTab = pParse->pTriggerTab;
000544          }else if( op!=TK_INSERT && zTab && sqlite3StrICmp("old",zTab)==0 ){
000545            pExpr->iTable = 0;
000546            pTab = pParse->pTriggerTab;
000547          }
000548        }
000549  #endif /* SQLITE_OMIT_TRIGGER */
000550  #ifndef SQLITE_OMIT_UPSERT
000551        if( (pNC->ncFlags & NC_UUpsert)!=0 && zTab!=0 ){
000552          Upsert *pUpsert = pNC->uNC.pUpsert;
000553          if( pUpsert && sqlite3StrICmp("excluded",zTab)==0 ){
000554            pTab = pUpsert->pUpsertSrc->a[0].pSTab;
000555            pExpr->iTable = EXCLUDED_TABLE_NUMBER;
000556          }
000557        }
000558  #endif /* SQLITE_OMIT_UPSERT */
000559  
000560        if( pTab ){
000561          int iCol;
000562          u8 hCol = sqlite3StrIHash(zCol);
000563          pSchema = pTab->pSchema;
000564          cntTab++;
000565          for(iCol=0, pCol=pTab->aCol; iCol<pTab->nCol; iCol++, pCol++){
000566            if( pCol->hName==hCol
000567             && sqlite3StrICmp(pCol->zCnName, zCol)==0
000568            ){
000569              if( iCol==pTab->iPKey ){
000570                iCol = -1;
000571              }
000572              break;
000573            }
000574          }
000575          if( iCol>=pTab->nCol && sqlite3IsRowid(zCol) && VisibleRowid(pTab) ){
000576            /* IMP: R-51414-32910 */
000577            iCol = -1;
000578          }
000579          if( iCol<pTab->nCol ){
000580            cnt++;
000581            pMatch = 0;
000582  #ifndef SQLITE_OMIT_UPSERT
000583            if( pExpr->iTable==EXCLUDED_TABLE_NUMBER ){
000584              testcase( iCol==(-1) );
000585              assert( ExprUseYTab(pExpr) );
000586              if( IN_RENAME_OBJECT ){
000587                pExpr->iColumn = iCol;
000588                pExpr->y.pTab = pTab;
000589                eNewExprOp = TK_COLUMN;
000590              }else{
000591                pExpr->iTable = pNC->uNC.pUpsert->regData +
000592                   sqlite3TableColumnToStorage(pTab, iCol);
000593                eNewExprOp = TK_REGISTER;
000594              }
000595            }else
000596  #endif /* SQLITE_OMIT_UPSERT */
000597            {
000598              assert( ExprUseYTab(pExpr) );
000599              pExpr->y.pTab = pTab;
000600              if( pParse->bReturning ){
000601                eNewExprOp = TK_REGISTER;
000602                pExpr->op2 = TK_COLUMN;
000603                pExpr->iColumn = iCol;
000604                pExpr->iTable = pNC->uNC.iBaseReg + (pTab->nCol+1)*pExpr->iTable +
000605                   sqlite3TableColumnToStorage(pTab, iCol) + 1;
000606              }else{
000607                pExpr->iColumn = (i16)iCol;
000608                eNewExprOp = TK_TRIGGER;
000609  #ifndef SQLITE_OMIT_TRIGGER
000610                if( iCol<0 ){
000611                  pExpr->affExpr = SQLITE_AFF_INTEGER;
000612                }else if( pExpr->iTable==0 ){
000613                  testcase( iCol==31 );
000614                  testcase( iCol==32 );
000615                  pParse->oldmask |= (iCol>=32 ? 0xffffffff : (((u32)1)<<iCol));
000616                }else{
000617                  testcase( iCol==31 );
000618                  testcase( iCol==32 );
000619                  pParse->newmask |= (iCol>=32 ? 0xffffffff : (((u32)1)<<iCol));
000620                }
000621  #endif /* SQLITE_OMIT_TRIGGER */
000622              }
000623            }
000624          }
000625        }
000626      }
000627  #endif /* !defined(SQLITE_OMIT_TRIGGER) || !defined(SQLITE_OMIT_UPSERT) */
000628  
000629      /*
000630      ** Perhaps the name is a reference to the ROWID
000631      */
000632      if( cnt==0
000633       && cntTab>=1
000634       && pMatch
000635       && (pNC->ncFlags & (NC_IdxExpr|NC_GenCol))==0
000636       && sqlite3IsRowid(zCol)
000637       && ALWAYS(VisibleRowid(pMatch->pSTab) || pMatch->fg.isNestedFrom)
000638      ){
000639        cnt = cntTab;
000640  #if SQLITE_ALLOW_ROWID_IN_VIEW+0==2
000641        if( pMatch->pSTab!=0 && IsView(pMatch->pSTab) ){
000642          eNewExprOp = TK_NULL;
000643        }
000644  #endif
000645        if( pMatch->fg.isNestedFrom==0 ) pExpr->iColumn = -1;
000646        pExpr->affExpr = SQLITE_AFF_INTEGER;
000647      }
000648  
000649      /*
000650      ** If the input is of the form Z (not Y.Z or X.Y.Z) then the name Z
000651      ** might refer to an result-set alias.  This happens, for example, when
000652      ** we are resolving names in the WHERE clause of the following command:
000653      **
000654      **     SELECT a+b AS x FROM table WHERE x<10;
000655      **
000656      ** In cases like this, replace pExpr with a copy of the expression that
000657      ** forms the result set entry ("a+b" in the example) and return immediately.
000658      ** Note that the expression in the result set should have already been
000659      ** resolved by the time the WHERE clause is resolved.
000660      **
000661      ** The ability to use an output result-set column in the WHERE, GROUP BY,
000662      ** or HAVING clauses, or as part of a larger expression in the ORDER BY
000663      ** clause is not standard SQL.  This is a (goofy) SQLite extension, that
000664      ** is supported for backwards compatibility only. Hence, we issue a warning
000665      ** on sqlite3_log() whenever the capability is used.
000666      */
000667      if( cnt==0
000668       && (pNC->ncFlags & NC_UEList)!=0
000669       && zTab==0
000670      ){
000671        pEList = pNC->uNC.pEList;
000672        assert( pEList!=0 );
000673        for(j=0; j<pEList->nExpr; j++){
000674          char *zAs = pEList->a[j].zEName;
000675          if( pEList->a[j].fg.eEName==ENAME_NAME
000676           && sqlite3_stricmp(zAs, zCol)==0
000677          ){
000678            Expr *pOrig;
000679            assert( pExpr->pLeft==0 && pExpr->pRight==0 );
000680            assert( ExprUseXList(pExpr)==0 || pExpr->x.pList==0 );
000681            assert( ExprUseXSelect(pExpr)==0 || pExpr->x.pSelect==0 );
000682            pOrig = pEList->a[j].pExpr;
000683            if( (pNC->ncFlags&NC_AllowAgg)==0 && ExprHasProperty(pOrig, EP_Agg) ){
000684              sqlite3ErrorMsg(pParse, "misuse of aliased aggregate %s", zAs);
000685              return WRC_Abort;
000686            }
000687            if( ExprHasProperty(pOrig, EP_Win)
000688             && ((pNC->ncFlags&NC_AllowWin)==0 || pNC!=pTopNC )
000689            ){
000690              sqlite3ErrorMsg(pParse, "misuse of aliased window function %s",zAs);
000691              return WRC_Abort;
000692            }
000693            if( sqlite3ExprVectorSize(pOrig)!=1 ){
000694              sqlite3ErrorMsg(pParse, "row value misused");
000695              return WRC_Abort;
000696            }
000697            resolveAlias(pParse, pEList, j, pExpr, nSubquery);
000698            cnt = 1;
000699            pMatch = 0;
000700            assert( zTab==0 && zDb==0 );
000701            if( IN_RENAME_OBJECT ){
000702              sqlite3RenameTokenRemap(pParse, 0, (void*)pExpr);
000703            }
000704            goto lookupname_end;
000705          }
000706        }
000707      }
000708  
000709      /* Advance to the next name context.  The loop will exit when either
000710      ** we have a match (cnt>0) or when we run out of name contexts.
000711      */
000712      if( cnt ) break;
000713      pNC = pNC->pNext;
000714      nSubquery++;
000715    }while( pNC );
000716  
000717  
000718    /*
000719    ** If X and Y are NULL (in other words if only the column name Z is
000720    ** supplied) and the value of Z is enclosed in double-quotes, then
000721    ** Z is a string literal if it doesn't match any column names.  In that
000722    ** case, we need to return right away and not make any changes to
000723    ** pExpr.
000724    **
000725    ** Because no reference was made to outer contexts, the pNC->nRef
000726    ** fields are not changed in any context.
000727    */
000728    if( cnt==0 && zTab==0 ){
000729      assert( pExpr->op==TK_ID );
000730      if( ExprHasProperty(pExpr,EP_DblQuoted)
000731       && areDoubleQuotedStringsEnabled(db, pTopNC)
000732      ){
000733        /* If a double-quoted identifier does not match any known column name,
000734        ** then treat it as a string.
000735        **
000736        ** This hack was added in the early days of SQLite in a misguided attempt
000737        ** to be compatible with MySQL 3.x, which used double-quotes for strings.
000738        ** I now sorely regret putting in this hack. The effect of this hack is
000739        ** that misspelled identifier names are silently converted into strings
000740        ** rather than causing an error, to the frustration of countless
000741        ** programmers. To all those frustrated programmers, my apologies.
000742        **
000743        ** Someday, I hope to get rid of this hack. Unfortunately there is
000744        ** a huge amount of legacy SQL that uses it. So for now, we just
000745        ** issue a warning.
000746        */
000747        sqlite3_log(SQLITE_WARNING,
000748          "double-quoted string literal: \"%w\"", zCol);
000749  #ifdef SQLITE_ENABLE_NORMALIZE
000750        sqlite3VdbeAddDblquoteStr(db, pParse->pVdbe, zCol);
000751  #endif
000752        pExpr->op = TK_STRING;
000753        memset(&pExpr->y, 0, sizeof(pExpr->y));
000754        return WRC_Prune;
000755      }
000756      if( sqlite3ExprIdToTrueFalse(pExpr) ){
000757        return WRC_Prune;
000758      }
000759    }
000760  
000761    /*
000762    ** cnt==0 means there was not match.
000763    ** cnt>1 means there were two or more matches.
000764    **
000765    ** cnt==0 is always an error.  cnt>1 is often an error, but might
000766    ** be multiple matches for a NATURAL LEFT JOIN or a LEFT JOIN USING.
000767    */
000768    assert( pFJMatch==0 || cnt>0 );
000769    assert( !ExprHasProperty(pExpr, EP_xIsSelect|EP_IntValue) );
000770    if( cnt!=1 ){
000771      const char *zErr;
000772      if( pFJMatch ){
000773        if( pFJMatch->nExpr==cnt-1 ){
000774          if( ExprHasProperty(pExpr,EP_Leaf) ){
000775            ExprClearProperty(pExpr,EP_Leaf);
000776          }else{
000777            sqlite3ExprDelete(db, pExpr->pLeft);
000778            pExpr->pLeft = 0;
000779            sqlite3ExprDelete(db, pExpr->pRight);
000780            pExpr->pRight = 0;
000781          }
000782          extendFJMatch(pParse, &pFJMatch, pMatch, pExpr->iColumn);
000783          pExpr->op = TK_FUNCTION;
000784          pExpr->u.zToken = "coalesce";
000785          pExpr->x.pList = pFJMatch;
000786          cnt = 1;
000787          goto lookupname_end;
000788        }else{
000789          sqlite3ExprListDelete(db, pFJMatch);
000790          pFJMatch = 0;
000791        }
000792      }
000793      zErr = cnt==0 ? "no such column" : "ambiguous column name";
000794      if( zDb ){
000795        sqlite3ErrorMsg(pParse, "%s: %s.%s.%s", zErr, zDb, zTab, zCol);
000796      }else if( zTab ){
000797        sqlite3ErrorMsg(pParse, "%s: %s.%s", zErr, zTab, zCol);
000798      }else if( cnt==0 && ExprHasProperty(pRight,EP_DblQuoted) ){
000799        sqlite3ErrorMsg(pParse, "%s: \"%s\" - should this be a"
000800                                " string literal in single-quotes?",
000801                                zErr, zCol);
000802      }else{
000803        sqlite3ErrorMsg(pParse, "%s: %s", zErr, zCol);
000804      }
000805      sqlite3RecordErrorOffsetOfExpr(pParse->db, pExpr);
000806      pParse->checkSchema = 1;
000807      pTopNC->nNcErr++;
000808      eNewExprOp = TK_NULL;
000809    }
000810    assert( pFJMatch==0 );
000811  
000812    /* Remove all substructure from pExpr */
000813    if( !ExprHasProperty(pExpr,(EP_TokenOnly|EP_Leaf)) ){
000814      sqlite3ExprDelete(db, pExpr->pLeft);
000815      pExpr->pLeft = 0;
000816      sqlite3ExprDelete(db, pExpr->pRight);
000817      pExpr->pRight = 0;
000818      ExprSetProperty(pExpr, EP_Leaf);
000819    }
000820  
000821    /* If a column from a table in pSrcList is referenced, then record
000822    ** this fact in the pSrcList.a[].colUsed bitmask.  Column 0 causes
000823    ** bit 0 to be set.  Column 1 sets bit 1.  And so forth.  Bit 63 is
000824    ** set if the 63rd or any subsequent column is used.
000825    **
000826    ** The colUsed mask is an optimization used to help determine if an
000827    ** index is a covering index.  The correct answer is still obtained
000828    ** if the mask contains extra set bits.  However, it is important to
000829    ** avoid setting bits beyond the maximum column number of the table.
000830    ** (See ticket [b92e5e8ec2cdbaa1]).
000831    **
000832    ** If a generated column is referenced, set bits for every column
000833    ** of the table.
000834    */
000835    if( pMatch ){
000836      if( pExpr->iColumn>=0 ){
000837        pMatch->colUsed |= sqlite3ExprColUsed(pExpr);
000838      }else{
000839        pMatch->fg.rowidUsed = 1;
000840      }
000841    }
000842  
000843    pExpr->op = eNewExprOp;
000844  lookupname_end:
000845    if( cnt==1 ){
000846      assert( pNC!=0 );
000847  #ifndef SQLITE_OMIT_AUTHORIZATION
000848      if( pParse->db->xAuth
000849       && (pExpr->op==TK_COLUMN || pExpr->op==TK_TRIGGER)
000850      ){
000851        sqlite3AuthRead(pParse, pExpr, pSchema, pNC->pSrcList);
000852      }
000853  #endif
000854      /* Increment the nRef value on all name contexts from TopNC up to
000855      ** the point where the name matched. */
000856      for(;;){
000857        assert( pTopNC!=0 );
000858        pTopNC->nRef++;
000859        if( pTopNC==pNC ) break;
000860        pTopNC = pTopNC->pNext;
000861      }
000862      return WRC_Prune;
000863    } else {
000864      return WRC_Abort;
000865    }
000866  }
000867  
000868  /*
000869  ** Allocate and return a pointer to an expression to load the column iCol
000870  ** from datasource iSrc in SrcList pSrc.
000871  */
000872  Expr *sqlite3CreateColumnExpr(sqlite3 *db, SrcList *pSrc, int iSrc, int iCol){
000873    Expr *p = sqlite3ExprAlloc(db, TK_COLUMN, 0, 0);
000874    if( p ){
000875      SrcItem *pItem = &pSrc->a[iSrc];
000876      Table *pTab;
000877      assert( ExprUseYTab(p) );
000878      pTab = p->y.pTab = pItem->pSTab;
000879      p->iTable = pItem->iCursor;
000880      if( p->y.pTab->iPKey==iCol ){
000881        p->iColumn = -1;
000882      }else{
000883        p->iColumn = (ynVar)iCol;
000884        if( (pTab->tabFlags & TF_HasGenerated)!=0
000885         && (pTab->aCol[iCol].colFlags & COLFLAG_GENERATED)!=0
000886        ){
000887          testcase( pTab->nCol==63 );
000888          testcase( pTab->nCol==64 );
000889          pItem->colUsed = pTab->nCol>=64 ? ALLBITS : MASKBIT(pTab->nCol)-1;
000890        }else{
000891          testcase( iCol==BMS );
000892          testcase( iCol==BMS-1 );
000893          pItem->colUsed |= ((Bitmask)1)<<(iCol>=BMS ? BMS-1 : iCol);
000894        }
000895      }
000896    }
000897    return p;
000898  }
000899  
000900  /*
000901  ** Report an error that an expression is not valid for some set of
000902  ** pNC->ncFlags values determined by validMask.
000903  **
000904  ** static void notValid(
000905  **   Parse *pParse,       // Leave error message here
000906  **   NameContext *pNC,    // The name context
000907  **   const char *zMsg,    // Type of error
000908  **   int validMask,       // Set of contexts for which prohibited
000909  **   Expr *pExpr          // Invalidate this expression on error
000910  ** ){...}
000911  **
000912  ** As an optimization, since the conditional is almost always false
000913  ** (because errors are rare), the conditional is moved outside of the
000914  ** function call using a macro.
000915  */
000916  static void notValidImpl(
000917     Parse *pParse,       /* Leave error message here */
000918     NameContext *pNC,    /* The name context */
000919     const char *zMsg,    /* Type of error */
000920     Expr *pExpr,         /* Invalidate this expression on error */
000921     Expr *pError         /* Associate error with this expression */
000922  ){
000923    const char *zIn = "partial index WHERE clauses";
000924    if( pNC->ncFlags & NC_IdxExpr )      zIn = "index expressions";
000925  #ifndef SQLITE_OMIT_CHECK
000926    else if( pNC->ncFlags & NC_IsCheck ) zIn = "CHECK constraints";
000927  #endif
000928  #ifndef SQLITE_OMIT_GENERATED_COLUMNS
000929    else if( pNC->ncFlags & NC_GenCol ) zIn = "generated columns";
000930  #endif
000931    sqlite3ErrorMsg(pParse, "%s prohibited in %s", zMsg, zIn);
000932    if( pExpr ) pExpr->op = TK_NULL;
000933    sqlite3RecordErrorOffsetOfExpr(pParse->db, pError);
000934  }
000935  #define sqlite3ResolveNotValid(P,N,M,X,E,R) \
000936    assert( ((X)&~(NC_IsCheck|NC_PartIdx|NC_IdxExpr|NC_GenCol))==0 ); \
000937    if( ((N)->ncFlags & (X))!=0 ) notValidImpl(P,N,M,E,R);
000938  
000939  /*
000940  ** Expression p should encode a floating point value between 1.0 and 0.0.
000941  ** Return 1024 times this value.  Or return -1 if p is not a floating point
000942  ** value between 1.0 and 0.0.
000943  */
000944  static int exprProbability(Expr *p){
000945    double r = -1.0;
000946    if( p->op!=TK_FLOAT ) return -1;
000947    assert( !ExprHasProperty(p, EP_IntValue) );
000948    sqlite3AtoF(p->u.zToken, &r, sqlite3Strlen30(p->u.zToken), SQLITE_UTF8);
000949    assert( r>=0.0 );
000950    if( r>1.0 ) return -1;
000951    return (int)(r*134217728.0);
000952  }
000953  
000954  /*
000955  ** This routine is callback for sqlite3WalkExpr().
000956  **
000957  ** Resolve symbolic names into TK_COLUMN operators for the current
000958  ** node in the expression tree.  Return 0 to continue the search down
000959  ** the tree or 2 to abort the tree walk.
000960  **
000961  ** This routine also does error checking and name resolution for
000962  ** function names.  The operator for aggregate functions is changed
000963  ** to TK_AGG_FUNCTION.
000964  */
000965  static int resolveExprStep(Walker *pWalker, Expr *pExpr){
000966    NameContext *pNC;
000967    Parse *pParse;
000968  
000969    pNC = pWalker->u.pNC;
000970    assert( pNC!=0 );
000971    pParse = pNC->pParse;
000972    assert( pParse==pWalker->pParse );
000973  
000974  #ifndef NDEBUG
000975    if( pNC->pSrcList && pNC->pSrcList->nAlloc>0 ){
000976      SrcList *pSrcList = pNC->pSrcList;
000977      int i;
000978      for(i=0; i<pNC->pSrcList->nSrc; i++){
000979        assert( pSrcList->a[i].iCursor>=0 && pSrcList->a[i].iCursor<pParse->nTab);
000980      }
000981    }
000982  #endif
000983    switch( pExpr->op ){
000984  
000985      /* The special operator TK_ROW means use the rowid for the first
000986      ** column in the FROM clause.  This is used by the LIMIT and ORDER BY
000987      ** clause processing on UPDATE and DELETE statements, and by
000988      ** UPDATE ... FROM statement processing.
000989      */
000990      case TK_ROW: {
000991        SrcList *pSrcList = pNC->pSrcList;
000992        SrcItem *pItem;
000993        assert( pSrcList && pSrcList->nSrc>=1 );
000994        pItem = pSrcList->a;
000995        pExpr->op = TK_COLUMN;
000996        assert( ExprUseYTab(pExpr) );
000997        pExpr->y.pTab = pItem->pSTab;
000998        pExpr->iTable = pItem->iCursor;
000999        pExpr->iColumn--;
001000        pExpr->affExpr = SQLITE_AFF_INTEGER;
001001        break;
001002      }
001003  
001004      /* An optimization:  Attempt to convert
001005      **
001006      **      "expr IS NOT NULL"  -->  "TRUE"
001007      **      "expr IS NULL"      -->  "FALSE"
001008      **
001009      ** if we can prove that "expr" is never NULL.  Call this the
001010      ** "NOT NULL strength reduction optimization".
001011      **
001012      ** If this optimization occurs, also restore the NameContext ref-counts
001013      ** to the state they where in before the "column" LHS expression was
001014      ** resolved.  This prevents "column" from being counted as having been
001015      ** referenced, which might prevent a SELECT from being erroneously
001016      ** marked as correlated.
001017      **
001018      ** 2024-03-28: Beware of aggregates.  A bare column of aggregated table
001019      ** can still evaluate to NULL even though it is marked as NOT NULL.
001020      ** Example:
001021      **
001022      **       CREATE TABLE t1(a INT NOT NULL);
001023      **       SELECT a, a IS NULL, a IS NOT NULL, count(*) FROM t1;
001024      **
001025      ** The "a IS NULL" and "a IS NOT NULL" expressions cannot be optimized
001026      ** here because at the time this case is hit, we do not yet know whether
001027      ** or not t1 is being aggregated.  We have to assume the worst and omit
001028      ** the optimization.  The only time it is safe to apply this optimization
001029      ** is within the WHERE clause.
001030      */
001031      case TK_NOTNULL:
001032      case TK_ISNULL: {
001033        int anRef[8];
001034        NameContext *p;
001035        int i;
001036        for(i=0, p=pNC; p && i<ArraySize(anRef); p=p->pNext, i++){
001037          anRef[i] = p->nRef;
001038        }
001039        sqlite3WalkExpr(pWalker, pExpr->pLeft);
001040        if( IN_RENAME_OBJECT ) return WRC_Prune;
001041        if( sqlite3ExprCanBeNull(pExpr->pLeft) ){
001042          /* The expression can be NULL.  So the optimization does not apply */
001043          return WRC_Prune;
001044        }
001045  
001046        for(i=0, p=pNC; p; p=p->pNext, i++){
001047          if( (p->ncFlags & NC_Where)==0 ){
001048            return WRC_Prune;  /* Not in a WHERE clause.  Unsafe to optimize. */
001049          }
001050        }
001051        testcase( ExprHasProperty(pExpr, EP_OuterON) );
001052        assert( !ExprHasProperty(pExpr, EP_IntValue) );
001053  #if TREETRACE_ENABLED
001054        if( sqlite3TreeTrace & 0x80000 ){
001055          sqlite3DebugPrintf(
001056             "NOT NULL strength reduction converts the following to %d:\n",
001057             pExpr->op==TK_NOTNULL
001058          );
001059          sqlite3ShowExpr(pExpr);
001060        }
001061  #endif /* TREETRACE_ENABLED */
001062        pExpr->u.iValue = (pExpr->op==TK_NOTNULL);
001063        pExpr->flags |= EP_IntValue;
001064        pExpr->op = TK_INTEGER;
001065        for(i=0, p=pNC; p && i<ArraySize(anRef); p=p->pNext, i++){
001066          p->nRef = anRef[i];
001067        }
001068        sqlite3ExprDelete(pParse->db, pExpr->pLeft);
001069        pExpr->pLeft = 0;
001070        return WRC_Prune;
001071      }
001072  
001073      /* A column name:                    ID
001074      ** Or table name and column name:    ID.ID
001075      ** Or a database, table and column:  ID.ID.ID
001076      **
001077      ** The TK_ID and TK_OUT cases are combined so that there will only
001078      ** be one call to lookupName().  Then the compiler will in-line
001079      ** lookupName() for a size reduction and performance increase.
001080      */
001081      case TK_ID:
001082      case TK_DOT: {
001083        const char *zTable;
001084        const char *zDb;
001085        Expr *pRight;
001086  
001087        if( pExpr->op==TK_ID ){
001088          zDb = 0;
001089          zTable = 0;
001090          assert( !ExprHasProperty(pExpr, EP_IntValue) );
001091          pRight = pExpr;
001092        }else{
001093          Expr *pLeft = pExpr->pLeft;
001094          testcase( pNC->ncFlags & NC_IdxExpr );
001095          testcase( pNC->ncFlags & NC_GenCol );
001096          sqlite3ResolveNotValid(pParse, pNC, "the \".\" operator",
001097                                 NC_IdxExpr|NC_GenCol, 0, pExpr);
001098          pRight = pExpr->pRight;
001099          if( pRight->op==TK_ID ){
001100            zDb = 0;
001101          }else{
001102            assert( pRight->op==TK_DOT );
001103            assert( !ExprHasProperty(pRight, EP_IntValue) );
001104            zDb = pLeft->u.zToken;
001105            pLeft = pRight->pLeft;
001106            pRight = pRight->pRight;
001107          }
001108          assert( ExprUseUToken(pLeft) && ExprUseUToken(pRight) );
001109          zTable = pLeft->u.zToken;
001110          assert( ExprUseYTab(pExpr) );
001111          if( IN_RENAME_OBJECT ){
001112            sqlite3RenameTokenRemap(pParse, (void*)pExpr, (void*)pRight);
001113            sqlite3RenameTokenRemap(pParse, (void*)&pExpr->y.pTab, (void*)pLeft);
001114          }
001115        }
001116        return lookupName(pParse, zDb, zTable, pRight, pNC, pExpr);
001117      }
001118  
001119      /* Resolve function names
001120      */
001121      case TK_FUNCTION: {
001122        ExprList *pList;            /* The argument list */
001123        int n;                      /* Number of arguments */
001124        int no_such_func = 0;       /* True if no such function exists */
001125        int wrong_num_args = 0;     /* True if wrong number of arguments */
001126        int is_agg = 0;             /* True if is an aggregate function */
001127        const char *zId;            /* The function name. */
001128        FuncDef *pDef;              /* Information about the function */
001129        u8 enc = ENC(pParse->db);   /* The database encoding */
001130        int savedAllowFlags = (pNC->ncFlags & (NC_AllowAgg | NC_AllowWin));
001131  #ifndef SQLITE_OMIT_WINDOWFUNC
001132        Window *pWin = (IsWindowFunc(pExpr) ? pExpr->y.pWin : 0);
001133  #endif
001134        assert( !ExprHasProperty(pExpr, EP_xIsSelect|EP_IntValue) );
001135        assert( pExpr->pLeft==0 || pExpr->pLeft->op==TK_ORDER );
001136        pList = pExpr->x.pList;
001137        n = pList ? pList->nExpr : 0;
001138        zId = pExpr->u.zToken;
001139        pDef = sqlite3FindFunction(pParse->db, zId, n, enc, 0);
001140        if( pDef==0 ){
001141          pDef = sqlite3FindFunction(pParse->db, zId, -2, enc, 0);
001142          if( pDef==0 ){
001143            no_such_func = 1;
001144          }else{
001145            wrong_num_args = 1;
001146          }
001147        }else{
001148          is_agg = pDef->xFinalize!=0;
001149          if( pDef->funcFlags & SQLITE_FUNC_UNLIKELY ){
001150            ExprSetProperty(pExpr, EP_Unlikely);
001151            if( n==2 ){
001152              pExpr->iTable = exprProbability(pList->a[1].pExpr);
001153              if( pExpr->iTable<0 ){
001154                sqlite3ErrorMsg(pParse,
001155                  "second argument to %#T() must be a "
001156                  "constant between 0.0 and 1.0", pExpr);
001157                pNC->nNcErr++;
001158              }
001159            }else{
001160              /* EVIDENCE-OF: R-61304-29449 The unlikely(X) function is
001161              ** equivalent to likelihood(X, 0.0625).
001162              ** EVIDENCE-OF: R-01283-11636 The unlikely(X) function is
001163              ** short-hand for likelihood(X,0.0625).
001164              ** EVIDENCE-OF: R-36850-34127 The likely(X) function is short-hand
001165              ** for likelihood(X,0.9375).
001166              ** EVIDENCE-OF: R-53436-40973 The likely(X) function is equivalent
001167              ** to likelihood(X,0.9375). */
001168              /* TUNING: unlikely() probability is 0.0625.  likely() is 0.9375 */
001169              pExpr->iTable = pDef->zName[0]=='u' ? 8388608 : 125829120;
001170            }            
001171          }
001172  #ifndef SQLITE_OMIT_AUTHORIZATION
001173          {
001174            int auth = sqlite3AuthCheck(pParse, SQLITE_FUNCTION, 0,pDef->zName,0);
001175            if( auth!=SQLITE_OK ){
001176              if( auth==SQLITE_DENY ){
001177                sqlite3ErrorMsg(pParse, "not authorized to use function: %#T",
001178                                        pExpr);
001179                pNC->nNcErr++;
001180              }
001181              pExpr->op = TK_NULL;
001182              return WRC_Prune;
001183            }
001184          }
001185  #endif
001186  
001187          /* If the function may call sqlite3_value_subtype(), then set the 
001188          ** EP_SubtArg flag on all of its argument expressions. This prevents
001189          ** where.c from replacing the expression with a value read from an
001190          ** index on the same expression, which will not have the correct 
001191          ** subtype. Also set the flag if the function expression itself is
001192          ** an EP_SubtArg expression. In this case subtypes are required as 
001193          ** the function may return a value with a subtype back to its 
001194          ** caller using sqlite3_result_value().  */
001195          if( (pDef->funcFlags & SQLITE_SUBTYPE) 
001196           || ExprHasProperty(pExpr, EP_SubtArg) 
001197          ){
001198            int ii;
001199            for(ii=0; ii<n; ii++){
001200              ExprSetProperty(pList->a[ii].pExpr, EP_SubtArg);
001201            }
001202          }
001203  
001204          if( pDef->funcFlags & (SQLITE_FUNC_CONSTANT|SQLITE_FUNC_SLOCHNG) ){
001205            /* For the purposes of the EP_ConstFunc flag, date and time
001206            ** functions and other functions that change slowly are considered
001207            ** constant because they are constant for the duration of one query.
001208            ** This allows them to be factored out of inner loops. */
001209            ExprSetProperty(pExpr,EP_ConstFunc);
001210          }
001211          if( (pDef->funcFlags & SQLITE_FUNC_CONSTANT)==0 ){
001212            /* Clearly non-deterministic functions like random(), but also
001213            ** date/time functions that use 'now', and other functions like
001214            ** sqlite_version() that might change over time cannot be used
001215            ** in an index or generated column.  Curiously, they can be used
001216            ** in a CHECK constraint.  SQLServer, MySQL, and PostgreSQL all
001217            ** all this. */
001218            sqlite3ResolveNotValid(pParse, pNC, "non-deterministic functions",
001219                                   NC_IdxExpr|NC_PartIdx|NC_GenCol, 0, pExpr);
001220          }else{
001221            assert( (NC_SelfRef & 0xff)==NC_SelfRef ); /* Must fit in 8 bits */
001222            pExpr->op2 = pNC->ncFlags & NC_SelfRef;
001223            if( pNC->ncFlags & NC_FromDDL ) ExprSetProperty(pExpr, EP_FromDDL);
001224          }
001225          if( (pDef->funcFlags & SQLITE_FUNC_INTERNAL)!=0
001226           && pParse->nested==0
001227           && (pParse->db->mDbFlags & DBFLAG_InternalFunc)==0
001228          ){
001229            /* Internal-use-only functions are disallowed unless the
001230            ** SQL is being compiled using sqlite3NestedParse() or
001231            ** the SQLITE_TESTCTRL_INTERNAL_FUNCTIONS test-control has be
001232            ** used to activate internal functions for testing purposes */
001233            no_such_func = 1;
001234            pDef = 0;
001235          }else
001236          if( (pDef->funcFlags & (SQLITE_FUNC_DIRECT|SQLITE_FUNC_UNSAFE))!=0
001237           && !IN_RENAME_OBJECT
001238          ){
001239            sqlite3ExprFunctionUsable(pParse, pExpr, pDef);
001240          }
001241        }
001242  
001243        if( 0==IN_RENAME_OBJECT ){
001244  #ifndef SQLITE_OMIT_WINDOWFUNC
001245          assert( is_agg==0 || (pDef->funcFlags & SQLITE_FUNC_MINMAX)
001246            || (pDef->xValue==0 && pDef->xInverse==0)
001247            || (pDef->xValue && pDef->xInverse && pDef->xSFunc && pDef->xFinalize)
001248          );
001249          if( pDef && pDef->xValue==0 && pWin ){
001250            sqlite3ErrorMsg(pParse,
001251                "%#T() may not be used as a window function", pExpr
001252            );
001253            pNC->nNcErr++;
001254          }else if(
001255                (is_agg && (pNC->ncFlags & NC_AllowAgg)==0)
001256             || (is_agg && (pDef->funcFlags&SQLITE_FUNC_WINDOW) && !pWin)
001257             || (is_agg && pWin && (pNC->ncFlags & NC_AllowWin)==0)
001258          ){
001259            const char *zType;
001260            if( (pDef->funcFlags & SQLITE_FUNC_WINDOW) || pWin ){
001261              zType = "window";
001262            }else{
001263              zType = "aggregate";
001264            }
001265            sqlite3ErrorMsg(pParse, "misuse of %s function %#T()",zType,pExpr);
001266            pNC->nNcErr++;
001267            is_agg = 0;
001268          }
001269  #else
001270          if( (is_agg && (pNC->ncFlags & NC_AllowAgg)==0) ){
001271            sqlite3ErrorMsg(pParse,"misuse of aggregate function %#T()",pExpr);
001272            pNC->nNcErr++;
001273            is_agg = 0;
001274          }
001275  #endif
001276          else if( no_such_func && pParse->db->init.busy==0
001277  #ifdef SQLITE_ENABLE_UNKNOWN_SQL_FUNCTION
001278                    && pParse->explain==0
001279  #endif
001280          ){
001281            sqlite3ErrorMsg(pParse, "no such function: %#T", pExpr);
001282            pNC->nNcErr++;
001283          }else if( wrong_num_args ){
001284            sqlite3ErrorMsg(pParse,"wrong number of arguments to function %#T()",
001285                 pExpr);
001286            pNC->nNcErr++;
001287          }
001288  #ifndef SQLITE_OMIT_WINDOWFUNC
001289          else if( is_agg==0 && ExprHasProperty(pExpr, EP_WinFunc) ){
001290            sqlite3ErrorMsg(pParse,
001291                "FILTER may not be used with non-aggregate %#T()",
001292                pExpr
001293            );
001294            pNC->nNcErr++;
001295          }
001296  #endif
001297          else if( is_agg==0 && pExpr->pLeft ){
001298            sqlite3ExprOrderByAggregateError(pParse, pExpr);
001299            pNC->nNcErr++;
001300          }
001301          if( is_agg ){
001302            /* Window functions may not be arguments of aggregate functions.
001303            ** Or arguments of other window functions. But aggregate functions
001304            ** may be arguments for window functions.  */
001305  #ifndef SQLITE_OMIT_WINDOWFUNC
001306            pNC->ncFlags &= ~(NC_AllowWin | (!pWin ? NC_AllowAgg : 0));
001307  #else
001308            pNC->ncFlags &= ~NC_AllowAgg;
001309  #endif
001310          }
001311        }
001312        else if( ExprHasProperty(pExpr, EP_WinFunc) || pExpr->pLeft ){
001313          is_agg = 1;
001314        }
001315        sqlite3WalkExprList(pWalker, pList);
001316        if( is_agg ){
001317          if( pExpr->pLeft ){
001318            assert( pExpr->pLeft->op==TK_ORDER );
001319            assert( ExprUseXList(pExpr->pLeft) );
001320            sqlite3WalkExprList(pWalker, pExpr->pLeft->x.pList);
001321          }
001322  #ifndef SQLITE_OMIT_WINDOWFUNC
001323          if( pWin && pParse->nErr==0 ){
001324            Select *pSel = pNC->pWinSelect;
001325            assert( ExprUseYWin(pExpr) && pWin==pExpr->y.pWin );
001326            if( IN_RENAME_OBJECT==0 ){
001327              sqlite3WindowUpdate(pParse, pSel ? pSel->pWinDefn : 0, pWin, pDef);
001328              if( pParse->db->mallocFailed ) break;
001329            }
001330            sqlite3WalkExprList(pWalker, pWin->pPartition);
001331            sqlite3WalkExprList(pWalker, pWin->pOrderBy);
001332            sqlite3WalkExpr(pWalker, pWin->pFilter);
001333            sqlite3WindowLink(pSel, pWin);
001334            pNC->ncFlags |= NC_HasWin;
001335          }else
001336  #endif /* SQLITE_OMIT_WINDOWFUNC */
001337          {
001338            NameContext *pNC2;          /* For looping up thru outer contexts */
001339            pExpr->op = TK_AGG_FUNCTION;
001340            pExpr->op2 = 0;
001341  #ifndef SQLITE_OMIT_WINDOWFUNC
001342            if( ExprHasProperty(pExpr, EP_WinFunc) ){
001343              sqlite3WalkExpr(pWalker, pExpr->y.pWin->pFilter);
001344            }
001345  #endif
001346            pNC2 = pNC;
001347            while( pNC2
001348                && sqlite3ReferencesSrcList(pParse, pExpr, pNC2->pSrcList)==0
001349            ){
001350              pExpr->op2 += (1 + pNC2->nNestedSelect);
001351              pNC2 = pNC2->pNext;
001352            }
001353            assert( pDef!=0 || IN_RENAME_OBJECT );
001354            if( pNC2 && pDef ){
001355              pExpr->op2 += pNC2->nNestedSelect;
001356              assert( SQLITE_FUNC_MINMAX==NC_MinMaxAgg );
001357              assert( SQLITE_FUNC_ANYORDER==NC_OrderAgg );
001358              testcase( (pDef->funcFlags & SQLITE_FUNC_MINMAX)!=0 );
001359              testcase( (pDef->funcFlags & SQLITE_FUNC_ANYORDER)!=0 );
001360              pNC2->ncFlags |= NC_HasAgg
001361                | ((pDef->funcFlags^SQLITE_FUNC_ANYORDER)
001362                    & (SQLITE_FUNC_MINMAX|SQLITE_FUNC_ANYORDER));
001363            }
001364          }
001365          pNC->ncFlags |= savedAllowFlags;
001366        }
001367        /* FIX ME:  Compute pExpr->affinity based on the expected return
001368        ** type of the function
001369        */
001370        return WRC_Prune;
001371      }
001372  #ifndef SQLITE_OMIT_SUBQUERY
001373      case TK_SELECT:
001374      case TK_EXISTS:  testcase( pExpr->op==TK_EXISTS );
001375  #endif
001376      case TK_IN: {
001377        testcase( pExpr->op==TK_IN );
001378        if( ExprUseXSelect(pExpr) ){
001379          int nRef = pNC->nRef;
001380          testcase( pNC->ncFlags & NC_IsCheck );
001381          testcase( pNC->ncFlags & NC_PartIdx );
001382          testcase( pNC->ncFlags & NC_IdxExpr );
001383          testcase( pNC->ncFlags & NC_GenCol );
001384          assert( pExpr->x.pSelect );
001385          if( pNC->ncFlags & NC_SelfRef ){
001386            notValidImpl(pParse, pNC, "subqueries", pExpr, pExpr);
001387          }else{
001388            sqlite3WalkSelect(pWalker, pExpr->x.pSelect);
001389          }
001390          assert( pNC->nRef>=nRef );
001391          if( nRef!=pNC->nRef ){
001392            ExprSetProperty(pExpr, EP_VarSelect);
001393            pExpr->x.pSelect->selFlags |= SF_Correlated;
001394          }
001395          pNC->ncFlags |= NC_Subquery;
001396        }
001397        break;
001398      }
001399      case TK_VARIABLE: {
001400        testcase( pNC->ncFlags & NC_IsCheck );
001401        testcase( pNC->ncFlags & NC_PartIdx );
001402        testcase( pNC->ncFlags & NC_IdxExpr );
001403        testcase( pNC->ncFlags & NC_GenCol );
001404        sqlite3ResolveNotValid(pParse, pNC, "parameters",
001405                 NC_IsCheck|NC_PartIdx|NC_IdxExpr|NC_GenCol, pExpr, pExpr);
001406        break;
001407      }
001408      case TK_IS:
001409      case TK_ISNOT: {
001410        Expr *pRight = sqlite3ExprSkipCollateAndLikely(pExpr->pRight);
001411        assert( !ExprHasProperty(pExpr, EP_Reduced) );
001412        /* Handle special cases of "x IS TRUE", "x IS FALSE", "x IS NOT TRUE",
001413        ** and "x IS NOT FALSE". */
001414        if( ALWAYS(pRight) && (pRight->op==TK_ID || pRight->op==TK_TRUEFALSE) ){
001415          int rc = resolveExprStep(pWalker, pRight);
001416          if( rc==WRC_Abort ) return WRC_Abort;
001417          if( pRight->op==TK_TRUEFALSE ){
001418            pExpr->op2 = pExpr->op;
001419            pExpr->op = TK_TRUTH;
001420            return WRC_Continue;
001421          }
001422        }
001423        /* no break */ deliberate_fall_through
001424      }
001425      case TK_BETWEEN:
001426      case TK_EQ:
001427      case TK_NE:
001428      case TK_LT:
001429      case TK_LE:
001430      case TK_GT:
001431      case TK_GE: {
001432        int nLeft, nRight;
001433        if( pParse->db->mallocFailed ) break;
001434        assert( pExpr->pLeft!=0 );
001435        nLeft = sqlite3ExprVectorSize(pExpr->pLeft);
001436        if( pExpr->op==TK_BETWEEN ){
001437          assert( ExprUseXList(pExpr) );
001438          nRight = sqlite3ExprVectorSize(pExpr->x.pList->a[0].pExpr);
001439          if( nRight==nLeft ){
001440            nRight = sqlite3ExprVectorSize(pExpr->x.pList->a[1].pExpr);
001441          }
001442        }else{
001443          assert( pExpr->pRight!=0 );
001444          nRight = sqlite3ExprVectorSize(pExpr->pRight);
001445        }
001446        if( nLeft!=nRight ){
001447          testcase( pExpr->op==TK_EQ );
001448          testcase( pExpr->op==TK_NE );
001449          testcase( pExpr->op==TK_LT );
001450          testcase( pExpr->op==TK_LE );
001451          testcase( pExpr->op==TK_GT );
001452          testcase( pExpr->op==TK_GE );
001453          testcase( pExpr->op==TK_IS );
001454          testcase( pExpr->op==TK_ISNOT );
001455          testcase( pExpr->op==TK_BETWEEN );
001456          sqlite3ErrorMsg(pParse, "row value misused");
001457          sqlite3RecordErrorOffsetOfExpr(pParse->db, pExpr);
001458        }
001459        break;
001460      }
001461    }
001462    assert( pParse->db->mallocFailed==0 || pParse->nErr!=0 );
001463    return pParse->nErr ? WRC_Abort : WRC_Continue;
001464  }
001465  
001466  /*
001467  ** pEList is a list of expressions which are really the result set of the
001468  ** a SELECT statement.  pE is a term in an ORDER BY or GROUP BY clause.
001469  ** This routine checks to see if pE is a simple identifier which corresponds
001470  ** to the AS-name of one of the terms of the expression list.  If it is,
001471  ** this routine return an integer between 1 and N where N is the number of
001472  ** elements in pEList, corresponding to the matching entry.  If there is
001473  ** no match, or if pE is not a simple identifier, then this routine
001474  ** return 0.
001475  **
001476  ** pEList has been resolved.  pE has not.
001477  */
001478  static int resolveAsName(
001479    Parse *pParse,     /* Parsing context for error messages */
001480    ExprList *pEList,  /* List of expressions to scan */
001481    Expr *pE           /* Expression we are trying to match */
001482  ){
001483    int i;             /* Loop counter */
001484  
001485    UNUSED_PARAMETER(pParse);
001486  
001487    if( pE->op==TK_ID ){
001488      const char *zCol;
001489      assert( !ExprHasProperty(pE, EP_IntValue) );
001490      zCol = pE->u.zToken;
001491      for(i=0; i<pEList->nExpr; i++){
001492        if( pEList->a[i].fg.eEName==ENAME_NAME
001493         && sqlite3_stricmp(pEList->a[i].zEName, zCol)==0
001494        ){
001495          return i+1;
001496        }
001497      }
001498    }
001499    return 0;
001500  }
001501  
001502  /*
001503  ** pE is a pointer to an expression which is a single term in the
001504  ** ORDER BY of a compound SELECT.  The expression has not been
001505  ** name resolved.
001506  **
001507  ** At the point this routine is called, we already know that the
001508  ** ORDER BY term is not an integer index into the result set.  That
001509  ** case is handled by the calling routine.
001510  **
001511  ** Attempt to match pE against result set columns in the left-most
001512  ** SELECT statement.  Return the index i of the matching column,
001513  ** as an indication to the caller that it should sort by the i-th column.
001514  ** The left-most column is 1.  In other words, the value returned is the
001515  ** same integer value that would be used in the SQL statement to indicate
001516  ** the column.
001517  **
001518  ** If there is no match, return 0.  Return -1 if an error occurs.
001519  */
001520  static int resolveOrderByTermToExprList(
001521    Parse *pParse,     /* Parsing context for error messages */
001522    Select *pSelect,   /* The SELECT statement with the ORDER BY clause */
001523    Expr *pE           /* The specific ORDER BY term */
001524  ){
001525    int i;             /* Loop counter */
001526    ExprList *pEList;  /* The columns of the result set */
001527    NameContext nc;    /* Name context for resolving pE */
001528    sqlite3 *db;       /* Database connection */
001529    int rc;            /* Return code from subprocedures */
001530    u8 savedSuppErr;   /* Saved value of db->suppressErr */
001531  
001532    assert( sqlite3ExprIsInteger(pE, &i, 0)==0 );
001533    pEList = pSelect->pEList;
001534  
001535    /* Resolve all names in the ORDER BY term expression
001536    */
001537    memset(&nc, 0, sizeof(nc));
001538    nc.pParse = pParse;
001539    nc.pSrcList = pSelect->pSrc;
001540    nc.uNC.pEList = pEList;
001541    nc.ncFlags = NC_AllowAgg|NC_UEList|NC_NoSelect;
001542    nc.nNcErr = 0;
001543    db = pParse->db;
001544    savedSuppErr = db->suppressErr;
001545    db->suppressErr = 1;
001546    rc = sqlite3ResolveExprNames(&nc, pE);
001547    db->suppressErr = savedSuppErr;
001548    if( rc ) return 0;
001549  
001550    /* Try to match the ORDER BY expression against an expression
001551    ** in the result set.  Return an 1-based index of the matching
001552    ** result-set entry.
001553    */
001554    for(i=0; i<pEList->nExpr; i++){
001555      if( sqlite3ExprCompare(0, pEList->a[i].pExpr, pE, -1)<2 ){
001556        return i+1;
001557      }
001558    }
001559  
001560    /* If no match, return 0. */
001561    return 0;
001562  }
001563  
001564  /*
001565  ** Generate an ORDER BY or GROUP BY term out-of-range error.
001566  */
001567  static void resolveOutOfRangeError(
001568    Parse *pParse,         /* The error context into which to write the error */
001569    const char *zType,     /* "ORDER" or "GROUP" */
001570    int i,                 /* The index (1-based) of the term out of range */
001571    int mx,                /* Largest permissible value of i */
001572    Expr *pError           /* Associate the error with the expression */
001573  ){
001574    sqlite3ErrorMsg(pParse,
001575      "%r %s BY term out of range - should be "
001576      "between 1 and %d", i, zType, mx);
001577    sqlite3RecordErrorOffsetOfExpr(pParse->db, pError);
001578  }
001579  
001580  /*
001581  ** Analyze the ORDER BY clause in a compound SELECT statement.   Modify
001582  ** each term of the ORDER BY clause is a constant integer between 1
001583  ** and N where N is the number of columns in the compound SELECT.
001584  **
001585  ** ORDER BY terms that are already an integer between 1 and N are
001586  ** unmodified.  ORDER BY terms that are integers outside the range of
001587  ** 1 through N generate an error.  ORDER BY terms that are expressions
001588  ** are matched against result set expressions of compound SELECT
001589  ** beginning with the left-most SELECT and working toward the right.
001590  ** At the first match, the ORDER BY expression is transformed into
001591  ** the integer column number.
001592  **
001593  ** Return the number of errors seen.
001594  */
001595  static int resolveCompoundOrderBy(
001596    Parse *pParse,        /* Parsing context.  Leave error messages here */
001597    Select *pSelect       /* The SELECT statement containing the ORDER BY */
001598  ){
001599    int i;
001600    ExprList *pOrderBy;
001601    ExprList *pEList;
001602    sqlite3 *db;
001603    int moreToDo = 1;
001604  
001605    pOrderBy = pSelect->pOrderBy;
001606    if( pOrderBy==0 ) return 0;
001607    db = pParse->db;
001608    if( pOrderBy->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
001609      sqlite3ErrorMsg(pParse, "too many terms in ORDER BY clause");
001610      return 1;
001611    }
001612    for(i=0; i<pOrderBy->nExpr; i++){
001613      pOrderBy->a[i].fg.done = 0;
001614    }
001615    pSelect->pNext = 0;
001616    while( pSelect->pPrior ){
001617      pSelect->pPrior->pNext = pSelect;
001618      pSelect = pSelect->pPrior;
001619    }
001620    while( pSelect && moreToDo ){
001621      struct ExprList_item *pItem;
001622      moreToDo = 0;
001623      pEList = pSelect->pEList;
001624      assert( pEList!=0 );
001625      for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
001626        int iCol = -1;
001627        Expr *pE, *pDup;
001628        if( pItem->fg.done ) continue;
001629        pE = sqlite3ExprSkipCollateAndLikely(pItem->pExpr);
001630        if( NEVER(pE==0) ) continue;
001631        if( sqlite3ExprIsInteger(pE, &iCol, 0) ){
001632          if( iCol<=0 || iCol>pEList->nExpr ){
001633            resolveOutOfRangeError(pParse, "ORDER", i+1, pEList->nExpr, pE);
001634            return 1;
001635          }
001636        }else{
001637          iCol = resolveAsName(pParse, pEList, pE);
001638          if( iCol==0 ){
001639            /* Now test if expression pE matches one of the values returned
001640            ** by pSelect. In the usual case this is done by duplicating the
001641            ** expression, resolving any symbols in it, and then comparing
001642            ** it against each expression returned by the SELECT statement.
001643            ** Once the comparisons are finished, the duplicate expression
001644            ** is deleted.
001645            **
001646            ** If this is running as part of an ALTER TABLE operation and
001647            ** the symbols resolve successfully, also resolve the symbols in the
001648            ** actual expression. This allows the code in alter.c to modify
001649            ** column references within the ORDER BY expression as required.  */
001650            pDup = sqlite3ExprDup(db, pE, 0);
001651            if( !db->mallocFailed ){
001652              assert(pDup);
001653              iCol = resolveOrderByTermToExprList(pParse, pSelect, pDup);
001654              if( IN_RENAME_OBJECT && iCol>0 ){
001655                resolveOrderByTermToExprList(pParse, pSelect, pE);
001656              }
001657            }
001658            sqlite3ExprDelete(db, pDup);
001659          }
001660        }
001661        if( iCol>0 ){
001662          /* Convert the ORDER BY term into an integer column number iCol,
001663          ** taking care to preserve the COLLATE clause if it exists. */
001664          if( !IN_RENAME_OBJECT ){
001665            Expr *pNew = sqlite3Expr(db, TK_INTEGER, 0);
001666            if( pNew==0 ) return 1;
001667            pNew->flags |= EP_IntValue;
001668            pNew->u.iValue = iCol;
001669            if( pItem->pExpr==pE ){
001670              pItem->pExpr = pNew;
001671            }else{
001672              Expr *pParent = pItem->pExpr;
001673              assert( pParent->op==TK_COLLATE );
001674              while( pParent->pLeft->op==TK_COLLATE ) pParent = pParent->pLeft;
001675              assert( pParent->pLeft==pE );
001676              pParent->pLeft = pNew;
001677            }
001678            sqlite3ExprDelete(db, pE);
001679            pItem->u.x.iOrderByCol = (u16)iCol;
001680          }
001681          pItem->fg.done = 1;
001682        }else{
001683          moreToDo = 1;
001684        }
001685      }
001686      pSelect = pSelect->pNext;
001687    }
001688    for(i=0; i<pOrderBy->nExpr; i++){
001689      if( pOrderBy->a[i].fg.done==0 ){
001690        sqlite3ErrorMsg(pParse, "%r ORDER BY term does not match any "
001691              "column in the result set", i+1);
001692        return 1;
001693      }
001694    }
001695    return 0;
001696  }
001697  
001698  /*
001699  ** Check every term in the ORDER BY or GROUP BY clause pOrderBy of
001700  ** the SELECT statement pSelect.  If any term is reference to a
001701  ** result set expression (as determined by the ExprList.a.u.x.iOrderByCol
001702  ** field) then convert that term into a copy of the corresponding result set
001703  ** column.
001704  **
001705  ** If any errors are detected, add an error message to pParse and
001706  ** return non-zero.  Return zero if no errors are seen.
001707  */
001708  int sqlite3ResolveOrderGroupBy(
001709    Parse *pParse,        /* Parsing context.  Leave error messages here */
001710    Select *pSelect,      /* The SELECT statement containing the clause */
001711    ExprList *pOrderBy,   /* The ORDER BY or GROUP BY clause to be processed */
001712    const char *zType     /* "ORDER" or "GROUP" */
001713  ){
001714    int i;
001715    sqlite3 *db = pParse->db;
001716    ExprList *pEList;
001717    struct ExprList_item *pItem;
001718  
001719    if( pOrderBy==0 || pParse->db->mallocFailed || IN_RENAME_OBJECT ) return 0;
001720    if( pOrderBy->nExpr>db->aLimit[SQLITE_LIMIT_COLUMN] ){
001721      sqlite3ErrorMsg(pParse, "too many terms in %s BY clause", zType);
001722      return 1;
001723    }
001724    pEList = pSelect->pEList;
001725    assert( pEList!=0 );  /* sqlite3SelectNew() guarantees this */
001726    for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
001727      if( pItem->u.x.iOrderByCol ){
001728        if( pItem->u.x.iOrderByCol>pEList->nExpr ){
001729          resolveOutOfRangeError(pParse, zType, i+1, pEList->nExpr, 0);
001730          return 1;
001731        }
001732        resolveAlias(pParse, pEList, pItem->u.x.iOrderByCol-1, pItem->pExpr,0);
001733      }
001734    }
001735    return 0;
001736  }
001737  
001738  #ifndef SQLITE_OMIT_WINDOWFUNC
001739  /*
001740  ** Walker callback for windowRemoveExprFromSelect().
001741  */
001742  static int resolveRemoveWindowsCb(Walker *pWalker, Expr *pExpr){
001743    UNUSED_PARAMETER(pWalker);
001744    if( ExprHasProperty(pExpr, EP_WinFunc) ){
001745      Window *pWin = pExpr->y.pWin;
001746      sqlite3WindowUnlinkFromSelect(pWin);
001747    }
001748    return WRC_Continue;
001749  }
001750  
001751  /*
001752  ** Remove any Window objects owned by the expression pExpr from the
001753  ** Select.pWin list of Select object pSelect.
001754  */
001755  static void windowRemoveExprFromSelect(Select *pSelect, Expr *pExpr){
001756    if( pSelect->pWin ){
001757      Walker sWalker;
001758      memset(&sWalker, 0, sizeof(Walker));
001759      sWalker.xExprCallback = resolveRemoveWindowsCb;
001760      sWalker.u.pSelect = pSelect;
001761      sqlite3WalkExpr(&sWalker, pExpr);
001762    }
001763  }
001764  #else
001765  # define windowRemoveExprFromSelect(a, b)
001766  #endif /* SQLITE_OMIT_WINDOWFUNC */
001767  
001768  /*
001769  ** pOrderBy is an ORDER BY or GROUP BY clause in SELECT statement pSelect.
001770  ** The Name context of the SELECT statement is pNC.  zType is either
001771  ** "ORDER" or "GROUP" depending on which type of clause pOrderBy is.
001772  **
001773  ** This routine resolves each term of the clause into an expression.
001774  ** If the order-by term is an integer I between 1 and N (where N is the
001775  ** number of columns in the result set of the SELECT) then the expression
001776  ** in the resolution is a copy of the I-th result-set expression.  If
001777  ** the order-by term is an identifier that corresponds to the AS-name of
001778  ** a result-set expression, then the term resolves to a copy of the
001779  ** result-set expression.  Otherwise, the expression is resolved in
001780  ** the usual way - using sqlite3ResolveExprNames().
001781  **
001782  ** This routine returns the number of errors.  If errors occur, then
001783  ** an appropriate error message might be left in pParse.  (OOM errors
001784  ** excepted.)
001785  */
001786  static int resolveOrderGroupBy(
001787    NameContext *pNC,     /* The name context of the SELECT statement */
001788    Select *pSelect,      /* The SELECT statement holding pOrderBy */
001789    ExprList *pOrderBy,   /* An ORDER BY or GROUP BY clause to resolve */
001790    const char *zType     /* Either "ORDER" or "GROUP", as appropriate */
001791  ){
001792    int i, j;                      /* Loop counters */
001793    int iCol;                      /* Column number */
001794    struct ExprList_item *pItem;   /* A term of the ORDER BY clause */
001795    Parse *pParse;                 /* Parsing context */
001796    int nResult;                   /* Number of terms in the result set */
001797  
001798    assert( pOrderBy!=0 );
001799    nResult = pSelect->pEList->nExpr;
001800    pParse = pNC->pParse;
001801    for(i=0, pItem=pOrderBy->a; i<pOrderBy->nExpr; i++, pItem++){
001802      Expr *pE = pItem->pExpr;
001803      Expr *pE2 = sqlite3ExprSkipCollateAndLikely(pE);
001804      if( NEVER(pE2==0) ) continue;
001805      if( zType[0]!='G' ){
001806        iCol = resolveAsName(pParse, pSelect->pEList, pE2);
001807        if( iCol>0 ){
001808          /* If an AS-name match is found, mark this ORDER BY column as being
001809          ** a copy of the iCol-th result-set column.  The subsequent call to
001810          ** sqlite3ResolveOrderGroupBy() will convert the expression to a
001811          ** copy of the iCol-th result-set expression. */
001812          pItem->u.x.iOrderByCol = (u16)iCol;
001813          continue;
001814        }
001815      }
001816      if( sqlite3ExprIsInteger(pE2, &iCol, 0) ){
001817        /* The ORDER BY term is an integer constant.  Again, set the column
001818        ** number so that sqlite3ResolveOrderGroupBy() will convert the
001819        ** order-by term to a copy of the result-set expression */
001820        if( iCol<1 || iCol>0xffff ){
001821          resolveOutOfRangeError(pParse, zType, i+1, nResult, pE2);
001822          return 1;
001823        }
001824        pItem->u.x.iOrderByCol = (u16)iCol;
001825        continue;
001826      }
001827  
001828      /* Otherwise, treat the ORDER BY term as an ordinary expression */
001829      pItem->u.x.iOrderByCol = 0;
001830      if( sqlite3ResolveExprNames(pNC, pE) ){
001831        return 1;
001832      }
001833      for(j=0; j<pSelect->pEList->nExpr; j++){
001834        if( sqlite3ExprCompare(0, pE, pSelect->pEList->a[j].pExpr, -1)==0 ){
001835          /* Since this expression is being changed into a reference
001836          ** to an identical expression in the result set, remove all Window
001837          ** objects belonging to the expression from the Select.pWin list. */
001838          windowRemoveExprFromSelect(pSelect, pE);
001839          pItem->u.x.iOrderByCol = j+1;
001840        }
001841      }
001842    }
001843    return sqlite3ResolveOrderGroupBy(pParse, pSelect, pOrderBy, zType);
001844  }
001845  
001846  /*
001847  ** Resolve names in the SELECT statement p and all of its descendants.
001848  */
001849  static int resolveSelectStep(Walker *pWalker, Select *p){
001850    NameContext *pOuterNC;  /* Context that contains this SELECT */
001851    NameContext sNC;        /* Name context of this SELECT */
001852    int isCompound;         /* True if p is a compound select */
001853    int nCompound;          /* Number of compound terms processed so far */
001854    Parse *pParse;          /* Parsing context */
001855    int i;                  /* Loop counter */
001856    ExprList *pGroupBy;     /* The GROUP BY clause */
001857    Select *pLeftmost;      /* Left-most of SELECT of a compound */
001858    sqlite3 *db;            /* Database connection */
001859   
001860  
001861    assert( p!=0 );
001862    if( p->selFlags & SF_Resolved ){
001863      return WRC_Prune;
001864    }
001865    pOuterNC = pWalker->u.pNC;
001866    pParse = pWalker->pParse;
001867    db = pParse->db;
001868  
001869    /* Normally sqlite3SelectExpand() will be called first and will have
001870    ** already expanded this SELECT.  However, if this is a subquery within
001871    ** an expression, sqlite3ResolveExprNames() will be called without a
001872    ** prior call to sqlite3SelectExpand().  When that happens, let
001873    ** sqlite3SelectPrep() do all of the processing for this SELECT.
001874    ** sqlite3SelectPrep() will invoke both sqlite3SelectExpand() and
001875    ** this routine in the correct order.
001876    */
001877    if( (p->selFlags & SF_Expanded)==0 ){
001878      sqlite3SelectPrep(pParse, p, pOuterNC);
001879      return pParse->nErr ? WRC_Abort : WRC_Prune;
001880    }
001881  
001882    isCompound = p->pPrior!=0;
001883    nCompound = 0;
001884    pLeftmost = p;
001885    while( p ){
001886      assert( (p->selFlags & SF_Expanded)!=0 );
001887      assert( (p->selFlags & SF_Resolved)==0 );
001888      p->selFlags |= SF_Resolved;
001889  
001890      /* Resolve the expressions in the LIMIT and OFFSET clauses. These
001891      ** are not allowed to refer to any names, so pass an empty NameContext.
001892      */
001893      memset(&sNC, 0, sizeof(sNC));
001894      sNC.pParse = pParse;
001895      sNC.pWinSelect = p;
001896      if( sqlite3ResolveExprNames(&sNC, p->pLimit) ){
001897        return WRC_Abort;
001898      }
001899  
001900      /* If the SF_Converted flags is set, then this Select object was
001901      ** was created by the convertCompoundSelectToSubquery() function.
001902      ** In this case the ORDER BY clause (p->pOrderBy) should be resolved
001903      ** as if it were part of the sub-query, not the parent. This block
001904      ** moves the pOrderBy down to the sub-query. It will be moved back
001905      ** after the names have been resolved.  */
001906      if( p->selFlags & SF_Converted ){
001907        Select *pSub;
001908        assert( p->pSrc->a[0].fg.isSubquery );
001909        assert( p->pSrc->a[0].u4.pSubq!=0 );
001910        pSub = p->pSrc->a[0].u4.pSubq->pSelect;
001911        assert( pSub!=0 );
001912        assert( p->pSrc->nSrc==1 && p->pOrderBy );
001913        assert( pSub->pPrior && pSub->pOrderBy==0 );
001914        pSub->pOrderBy = p->pOrderBy;
001915        p->pOrderBy = 0;
001916      }
001917   
001918      /* Recursively resolve names in all subqueries in the FROM clause
001919      */
001920      if( pOuterNC ) pOuterNC->nNestedSelect++;
001921      for(i=0; i<p->pSrc->nSrc; i++){
001922        SrcItem *pItem = &p->pSrc->a[i];
001923        assert( pItem->zName!=0
001924                || pItem->fg.isSubquery );  /* Test of tag-20240424-1*/
001925        if( pItem->fg.isSubquery
001926         && (pItem->u4.pSubq->pSelect->selFlags & SF_Resolved)==0
001927        ){
001928          int nRef = pOuterNC ? pOuterNC->nRef : 0;
001929          const char *zSavedContext = pParse->zAuthContext;
001930  
001931          if( pItem->zName ) pParse->zAuthContext = pItem->zName;
001932          sqlite3ResolveSelectNames(pParse, pItem->u4.pSubq->pSelect, pOuterNC);
001933          pParse->zAuthContext = zSavedContext;
001934          if( pParse->nErr ) return WRC_Abort;
001935          assert( db->mallocFailed==0 );
001936  
001937          /* If the number of references to the outer context changed when
001938          ** expressions in the sub-select were resolved, the sub-select
001939          ** is correlated. It is not required to check the refcount on any
001940          ** but the innermost outer context object, as lookupName() increments
001941          ** the refcount on all contexts between the current one and the
001942          ** context containing the column when it resolves a name. */
001943          if( pOuterNC ){
001944            assert( pItem->fg.isCorrelated==0 && pOuterNC->nRef>=nRef );
001945            pItem->fg.isCorrelated = (pOuterNC->nRef>nRef);
001946          }
001947        }
001948      }
001949      if( pOuterNC && ALWAYS(pOuterNC->nNestedSelect>0) ){
001950        pOuterNC->nNestedSelect--;
001951      }
001952   
001953      /* Set up the local name-context to pass to sqlite3ResolveExprNames() to
001954      ** resolve the result-set expression list.
001955      */
001956      sNC.ncFlags = NC_AllowAgg|NC_AllowWin;
001957      sNC.pSrcList = p->pSrc;
001958      sNC.pNext = pOuterNC;
001959   
001960      /* Resolve names in the result set. */
001961      if( sqlite3ResolveExprListNames(&sNC, p->pEList) ) return WRC_Abort;
001962      sNC.ncFlags &= ~NC_AllowWin;
001963   
001964      /* If there are no aggregate functions in the result-set, and no GROUP BY
001965      ** expression, do not allow aggregates in any of the other expressions.
001966      */
001967      assert( (p->selFlags & SF_Aggregate)==0 );
001968      pGroupBy = p->pGroupBy;
001969      if( pGroupBy || (sNC.ncFlags & NC_HasAgg)!=0 ){
001970        assert( NC_MinMaxAgg==SF_MinMaxAgg );
001971        assert( NC_OrderAgg==SF_OrderByReqd );
001972        p->selFlags |= SF_Aggregate | (sNC.ncFlags&(NC_MinMaxAgg|NC_OrderAgg));
001973      }else{
001974        sNC.ncFlags &= ~NC_AllowAgg;
001975      }
001976   
001977      /* Add the output column list to the name-context before parsing the
001978      ** other expressions in the SELECT statement. This is so that
001979      ** expressions in the WHERE clause (etc.) can refer to expressions by
001980      ** aliases in the result set.
001981      **
001982      ** Minor point: If this is the case, then the expression will be
001983      ** re-evaluated for each reference to it.
001984      */
001985      assert( (sNC.ncFlags & (NC_UAggInfo|NC_UUpsert|NC_UBaseReg))==0 );
001986      sNC.uNC.pEList = p->pEList;
001987      sNC.ncFlags |= NC_UEList;
001988      if( p->pHaving ){
001989        if( (p->selFlags & SF_Aggregate)==0 ){
001990          sqlite3ErrorMsg(pParse, "HAVING clause on a non-aggregate query");
001991          return WRC_Abort;
001992        }
001993        if( sqlite3ResolveExprNames(&sNC, p->pHaving) ) return WRC_Abort;
001994      }
001995      sNC.ncFlags |= NC_Where;
001996      if( sqlite3ResolveExprNames(&sNC, p->pWhere) ) return WRC_Abort;
001997      sNC.ncFlags &= ~NC_Where;
001998  
001999      /* Resolve names in table-valued-function arguments */
002000      for(i=0; i<p->pSrc->nSrc; i++){
002001        SrcItem *pItem = &p->pSrc->a[i];
002002        if( pItem->fg.isTabFunc
002003         && sqlite3ResolveExprListNames(&sNC, pItem->u1.pFuncArg)
002004        ){
002005          return WRC_Abort;
002006        }
002007      }
002008  
002009  #ifndef SQLITE_OMIT_WINDOWFUNC
002010      if( IN_RENAME_OBJECT ){
002011        Window *pWin;
002012        for(pWin=p->pWinDefn; pWin; pWin=pWin->pNextWin){
002013          if( sqlite3ResolveExprListNames(&sNC, pWin->pOrderBy)
002014           || sqlite3ResolveExprListNames(&sNC, pWin->pPartition)
002015          ){
002016            return WRC_Abort;
002017          }
002018        }
002019      }
002020  #endif
002021  
002022      /* The ORDER BY and GROUP BY clauses may not refer to terms in
002023      ** outer queries
002024      */
002025      sNC.pNext = 0;
002026      sNC.ncFlags |= NC_AllowAgg|NC_AllowWin;
002027  
002028      /* If this is a converted compound query, move the ORDER BY clause from
002029      ** the sub-query back to the parent query. At this point each term
002030      ** within the ORDER BY clause has been transformed to an integer value.
002031      ** These integers will be replaced by copies of the corresponding result
002032      ** set expressions by the call to resolveOrderGroupBy() below.  */
002033      if( p->selFlags & SF_Converted ){
002034        Select *pSub;
002035        assert( p->pSrc->a[0].fg.isSubquery );
002036        pSub = p->pSrc->a[0].u4.pSubq->pSelect;
002037        assert( pSub!=0 );
002038        p->pOrderBy = pSub->pOrderBy;
002039        pSub->pOrderBy = 0;
002040      }
002041  
002042      /* Process the ORDER BY clause for singleton SELECT statements.
002043      ** The ORDER BY clause for compounds SELECT statements is handled
002044      ** below, after all of the result-sets for all of the elements of
002045      ** the compound have been resolved.
002046      **
002047      ** If there is an ORDER BY clause on a term of a compound-select other
002048      ** than the right-most term, then that is a syntax error.  But the error
002049      ** is not detected until much later, and so we need to go ahead and
002050      ** resolve those symbols on the incorrect ORDER BY for consistency.
002051      */
002052      if( p->pOrderBy!=0
002053       && isCompound<=nCompound  /* Defer right-most ORDER BY of a compound */
002054       && resolveOrderGroupBy(&sNC, p, p->pOrderBy, "ORDER")
002055      ){
002056        return WRC_Abort;
002057      }
002058      if( db->mallocFailed ){
002059        return WRC_Abort;
002060      }
002061      sNC.ncFlags &= ~NC_AllowWin;
002062   
002063      /* Resolve the GROUP BY clause.  At the same time, make sure
002064      ** the GROUP BY clause does not contain aggregate functions.
002065      */
002066      if( pGroupBy ){
002067        struct ExprList_item *pItem;
002068     
002069        if( resolveOrderGroupBy(&sNC, p, pGroupBy, "GROUP") || db->mallocFailed ){
002070          return WRC_Abort;
002071        }
002072        for(i=0, pItem=pGroupBy->a; i<pGroupBy->nExpr; i++, pItem++){
002073          if( ExprHasProperty(pItem->pExpr, EP_Agg) ){
002074            sqlite3ErrorMsg(pParse, "aggregate functions are not allowed in "
002075                "the GROUP BY clause");
002076            return WRC_Abort;
002077          }
002078        }
002079      }
002080  
002081      /* If this is part of a compound SELECT, check that it has the right
002082      ** number of expressions in the select list. */
002083      if( p->pNext && p->pEList->nExpr!=p->pNext->pEList->nExpr ){
002084        sqlite3SelectWrongNumTermsError(pParse, p->pNext);
002085        return WRC_Abort;
002086      }
002087  
002088      /* Advance to the next term of the compound
002089      */
002090      p = p->pPrior;
002091      nCompound++;
002092    }
002093  
002094    /* Resolve the ORDER BY on a compound SELECT after all terms of
002095    ** the compound have been resolved.
002096    */
002097    if( isCompound && resolveCompoundOrderBy(pParse, pLeftmost) ){
002098      return WRC_Abort;
002099    }
002100  
002101    return WRC_Prune;
002102  }
002103  
002104  /*
002105  ** This routine walks an expression tree and resolves references to
002106  ** table columns and result-set columns.  At the same time, do error
002107  ** checking on function usage and set a flag if any aggregate functions
002108  ** are seen.
002109  **
002110  ** To resolve table columns references we look for nodes (or subtrees) of the
002111  ** form X.Y.Z or Y.Z or just Z where
002112  **
002113  **      X:   The name of a database.  Ex:  "main" or "temp" or
002114  **           the symbolic name assigned to an ATTACH-ed database.
002115  **
002116  **      Y:   The name of a table in a FROM clause.  Or in a trigger
002117  **           one of the special names "old" or "new".
002118  **
002119  **      Z:   The name of a column in table Y.
002120  **
002121  ** The node at the root of the subtree is modified as follows:
002122  **
002123  **    Expr.op        Changed to TK_COLUMN
002124  **    Expr.pTab      Points to the Table object for X.Y
002125  **    Expr.iColumn   The column index in X.Y.  -1 for the rowid.
002126  **    Expr.iTable    The VDBE cursor number for X.Y
002127  **
002128  **
002129  ** To resolve result-set references, look for expression nodes of the
002130  ** form Z (with no X and Y prefix) where the Z matches the right-hand
002131  ** size of an AS clause in the result-set of a SELECT.  The Z expression
002132  ** is replaced by a copy of the left-hand side of the result-set expression.
002133  ** Table-name and function resolution occurs on the substituted expression
002134  ** tree.  For example, in:
002135  **
002136  **      SELECT a+b AS x, c+d AS y FROM t1 ORDER BY x;
002137  **
002138  ** The "x" term of the order by is replaced by "a+b" to render:
002139  **
002140  **      SELECT a+b AS x, c+d AS y FROM t1 ORDER BY a+b;
002141  **
002142  ** Function calls are checked to make sure that the function is
002143  ** defined and that the correct number of arguments are specified.
002144  ** If the function is an aggregate function, then the NC_HasAgg flag is
002145  ** set and the opcode is changed from TK_FUNCTION to TK_AGG_FUNCTION.
002146  ** If an expression contains aggregate functions then the EP_Agg
002147  ** property on the expression is set.
002148  **
002149  ** An error message is left in pParse if anything is amiss.  The number
002150  ** if errors is returned.
002151  */
002152  int sqlite3ResolveExprNames(
002153    NameContext *pNC,       /* Namespace to resolve expressions in. */
002154    Expr *pExpr             /* The expression to be analyzed. */
002155  ){
002156    int savedHasAgg;
002157    Walker w;
002158  
002159    if( pExpr==0 ) return SQLITE_OK;
002160    savedHasAgg = pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
002161    pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
002162    w.pParse = pNC->pParse;
002163    w.xExprCallback = resolveExprStep;
002164    w.xSelectCallback = (pNC->ncFlags & NC_NoSelect) ? 0 : resolveSelectStep;
002165    w.xSelectCallback2 = 0;
002166    w.u.pNC = pNC;
002167  #if SQLITE_MAX_EXPR_DEPTH>0
002168    w.pParse->nHeight += pExpr->nHeight;
002169    if( sqlite3ExprCheckHeight(w.pParse, w.pParse->nHeight) ){
002170      return SQLITE_ERROR;
002171    }
002172  #endif
002173    assert( pExpr!=0 );
002174    sqlite3WalkExprNN(&w, pExpr);
002175  #if SQLITE_MAX_EXPR_DEPTH>0
002176    w.pParse->nHeight -= pExpr->nHeight;
002177  #endif
002178    assert( EP_Agg==NC_HasAgg );
002179    assert( EP_Win==NC_HasWin );
002180    testcase( pNC->ncFlags & NC_HasAgg );
002181    testcase( pNC->ncFlags & NC_HasWin );
002182    ExprSetProperty(pExpr, pNC->ncFlags & (NC_HasAgg|NC_HasWin) );
002183    pNC->ncFlags |= savedHasAgg;
002184    return pNC->nNcErr>0 || w.pParse->nErr>0;
002185  }
002186  
002187  /*
002188  ** Resolve all names for all expression in an expression list.  This is
002189  ** just like sqlite3ResolveExprNames() except that it works for an expression
002190  ** list rather than a single expression.
002191  **
002192  ** The return value is SQLITE_OK (0) for success or SQLITE_ERROR (1) for a
002193  ** failure.
002194  */
002195  int sqlite3ResolveExprListNames(
002196    NameContext *pNC,       /* Namespace to resolve expressions in. */
002197    ExprList *pList         /* The expression list to be analyzed. */
002198  ){
002199    int i;
002200    int savedHasAgg = 0;
002201    Walker w;
002202    if( pList==0 ) return SQLITE_OK;
002203    w.pParse = pNC->pParse;
002204    w.xExprCallback = resolveExprStep;
002205    w.xSelectCallback = resolveSelectStep;
002206    w.xSelectCallback2 = 0;
002207    w.u.pNC = pNC;
002208    savedHasAgg = pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
002209    pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
002210    for(i=0; i<pList->nExpr; i++){
002211      Expr *pExpr = pList->a[i].pExpr;
002212      if( pExpr==0 ) continue;
002213  #if SQLITE_MAX_EXPR_DEPTH>0
002214      w.pParse->nHeight += pExpr->nHeight;
002215      if( sqlite3ExprCheckHeight(w.pParse, w.pParse->nHeight) ){
002216        return SQLITE_ERROR;
002217      }
002218  #endif
002219      sqlite3WalkExprNN(&w, pExpr);
002220  #if SQLITE_MAX_EXPR_DEPTH>0
002221      w.pParse->nHeight -= pExpr->nHeight;
002222  #endif
002223      assert( EP_Agg==NC_HasAgg );
002224      assert( EP_Win==NC_HasWin );
002225      testcase( pNC->ncFlags & NC_HasAgg );
002226      testcase( pNC->ncFlags & NC_HasWin );
002227      if( pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg) ){
002228        ExprSetProperty(pExpr, pNC->ncFlags & (NC_HasAgg|NC_HasWin) );
002229        savedHasAgg |= pNC->ncFlags &
002230                            (NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
002231        pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin|NC_OrderAgg);
002232      }
002233      if( w.pParse->nErr>0 ) return SQLITE_ERROR;
002234    }
002235    pNC->ncFlags |= savedHasAgg;
002236    return SQLITE_OK;
002237  }
002238  
002239  /*
002240  ** Resolve all names in all expressions of a SELECT and in all
002241  ** descendants of the SELECT, including compounds off of p->pPrior,
002242  ** subqueries in expressions, and subqueries used as FROM clause
002243  ** terms.
002244  **
002245  ** See sqlite3ResolveExprNames() for a description of the kinds of
002246  ** transformations that occur.
002247  **
002248  ** All SELECT statements should have been expanded using
002249  ** sqlite3SelectExpand() prior to invoking this routine.
002250  */
002251  void sqlite3ResolveSelectNames(
002252    Parse *pParse,         /* The parser context */
002253    Select *p,             /* The SELECT statement being coded. */
002254    NameContext *pOuterNC  /* Name context for parent SELECT statement */
002255  ){
002256    Walker w;
002257  
002258    assert( p!=0 );
002259    w.xExprCallback = resolveExprStep;
002260    w.xSelectCallback = resolveSelectStep;
002261    w.xSelectCallback2 = 0;
002262    w.pParse = pParse;
002263    w.u.pNC = pOuterNC;
002264    sqlite3WalkSelect(&w, p);
002265  }
002266  
002267  /*
002268  ** Resolve names in expressions that can only reference a single table
002269  ** or which cannot reference any tables at all.  Examples:
002270  **
002271  **                                                    "type" flag
002272  **                                                    ------------
002273  **    (1)   CHECK constraints                         NC_IsCheck
002274  **    (2)   WHERE clauses on partial indices          NC_PartIdx
002275  **    (3)   Expressions in indexes on expressions     NC_IdxExpr
002276  **    (4)   Expression arguments to VACUUM INTO.      0
002277  **    (5)   GENERATED ALWAYS as expressions           NC_GenCol
002278  **
002279  ** In all cases except (4), the Expr.iTable value for Expr.op==TK_COLUMN
002280  ** nodes of the expression is set to -1 and the Expr.iColumn value is
002281  ** set to the column number.  In case (4), TK_COLUMN nodes cause an error.
002282  **
002283  ** Any errors cause an error message to be set in pParse.
002284  */
002285  int sqlite3ResolveSelfReference(
002286    Parse *pParse,   /* Parsing context */
002287    Table *pTab,     /* The table being referenced, or NULL */
002288    int type,        /* NC_IsCheck, NC_PartIdx, NC_IdxExpr, NC_GenCol, or 0 */
002289    Expr *pExpr,     /* Expression to resolve.  May be NULL. */
002290    ExprList *pList  /* Expression list to resolve.  May be NULL. */
002291  ){
002292    SrcList sSrc;                   /* Fake SrcList for pParse->pNewTable */
002293    NameContext sNC;                /* Name context for pParse->pNewTable */
002294    int rc;
002295  
002296    assert( type==0 || pTab!=0 );
002297    assert( type==NC_IsCheck || type==NC_PartIdx || type==NC_IdxExpr
002298            || type==NC_GenCol || pTab==0 );
002299    memset(&sNC, 0, sizeof(sNC));
002300    memset(&sSrc, 0, sizeof(sSrc));
002301    if( pTab ){
002302      sSrc.nSrc = 1;
002303      sSrc.a[0].zName = pTab->zName;
002304      sSrc.a[0].pSTab = pTab;
002305      sSrc.a[0].iCursor = -1;
002306      if( pTab->pSchema!=pParse->db->aDb[1].pSchema ){
002307        /* Cause EP_FromDDL to be set on TK_FUNCTION nodes of non-TEMP
002308        ** schema elements */
002309        type |= NC_FromDDL;
002310      }
002311    }
002312    sNC.pParse = pParse;
002313    sNC.pSrcList = &sSrc;
002314    sNC.ncFlags = type | NC_IsDDL;
002315    if( (rc = sqlite3ResolveExprNames(&sNC, pExpr))!=SQLITE_OK ) return rc;
002316    if( pList ) rc = sqlite3ResolveExprListNames(&sNC, pList);
002317    return rc;
002318  }