Make sure registers are cleared properly prior to being used to store

the result of an OP_Column operator.

FossilOrigin-Name: 78fb8838d80b229418c347c63579989432e1af7d

diff --git a/manifest b/manifest
index 100a334778e6e6ba797a19c43c420687bd1d15f5..20bc2b4129657e489d3b1eca68e40549fdb68eec 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Simplification\sof\sthe\sOP_Column\slogic\sfor\sthe\scase\sof\srows\swith\soverflow.
-D 2014-09-16T18:22:44.852
+C Make\ssure\sregisters\sare\scleared\sproperly\sprior\sto\sbeing\sused\sto\sstore\nthe\sresult\sof\san\sOP_Column\soperator.
+D 2014-09-16T20:05:21.909
 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f
 F Makefile.in cf57f673d77606ab0f2d9627ca52a9ba1464146a
 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23
@@ -288,13 +288,13 @@ F src/update.c 729f6f18fc27740591d085e1172cebe311144bf0
 F src/utf.c 77abb5e6d27f3d236e50f7c8fff1d00e15262359
 F src/util.c 4006c01772bd8d8ac4306d523bbcee41d3e392d8
 F src/vacuum.c 59f03f92bcff57faa6a8ca256eb29ccddfb0614a
-F src/vdbe.c ff1b0b4f41355ba207bdc691b1017e7642f42c6b
+F src/vdbe.c 6a45baf86fcc6c294d57e0aef8c9f2c54f07ff18
 F src/vdbe.h 09f5b4e3719fa454f252322b1cdab5cf1f361327
 F src/vdbeInt.h dc1743de339f5556cc6687219cf8727ad0d35f72
 F src/vdbeapi.c 4d2aa56efa1b4a010012466bf8e97dbf179081a6
-F src/vdbeaux.c 79ce140ee79ecc7638eac070b48f1d24bbf9653c
+F src/vdbeaux.c 211ad29d51e01c44a0db1ab69b74c11c8de1cccf
 F src/vdbeblob.c 848238dc73e93e48432991bb5651bf87d865eca4
-F src/vdbemem.c 8abc122ce5359a120196e0825dca9a08a787aff6
+F src/vdbemem.c 18556fc614426886e380def839bdcf9cadbb752a
 F src/vdbesort.c 09efa5e5098d1a159cd21f588eb118e4fe87cfde
 F src/vdbetrace.c 16d39c1ef7d1f4a3a7464bea3b7b4bdd7849c415
 F src/vtab.c 019dbfd0406a7447c990e1f7bd1dfcdb8895697f
@@ -1198,7 +1198,7 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1
 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4
 F tool/warnings.sh 0abfd78ceb09b7f7c27c688c8e3fe93268a13b32
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
-P a10a6bba4963761b490b7243b388dcc920c4cfed
-R e7cf963c2745f47a3657ad38e9817c1f
+P f73678038d8fc399c1ca55230ae45962007c909c
+R 39f3c2bf48f680cf4e99aef8c3698c28
 U drh
-Z 153a841014a3e255f6703a490d77aa20
+Z e586af33404759487ed3f6653fe697fa

diff --git a/manifest.uuid b/manifest.uuid
index 9162c28d1d5269857e150d6dc9cbe8e41ae3401e..0d00de35928d34125fdc44b4c48fc76b2e8bf0f6 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-f73678038d8fc399c1ca55230ae45962007c909c
\ No newline at end of file
+78fb8838d80b229418c347c63579989432e1af7d
\ No newline at end of file

diff --git a/src/vdbe.c b/src/vdbe.c
index 20301edc56b501a0a4f8680ba6efbb68cf8ada4f..4bdfbfbdeb4e91376f634137e69163b7859b1ef5 100644 (file)
--- a/src/vdbe.c
+++ b/src/vdbe.c
@@ -2437,10 +2437,10 @@ case OP_Column: {
   assert( p2<pC->nHdrParsed );
   assert( rc==SQLITE_OK );
   assert( sqlite3VdbeCheckMemInvariants(pDest) );
+  VdbeMemReleaseExtern(pDest);
   if( pC->szRow>=aOffset[p2+1] ){
     /* This is the common case where the desired content fits on the original
     ** page - where the content is not on an overflow page */
-    VdbeMemReleaseExtern(pDest);
     sqlite3VdbeSerialGet(pC->aRow+aOffset[p2], aType[p2], pDest);
   }else{
     /* This branch happens only when content is on overflow pages */

diff --git a/src/vdbeaux.c b/src/vdbeaux.c
index b7e3da7584e26299d91b5b79bbb2207f0c756ab9..10495e76e41d7f480a6321d6a1cc3437917abb97 100644 (file)
--- a/src/vdbeaux.c
+++ b/src/vdbeaux.c
@@ -3306,6 +3306,7 @@ static int vdbeCompareMemString(
     c1.db = c2.db = pMem1->db;
     c1.flags = c2.flags = 0;
     c1.zMalloc = c2.zMalloc = 0;
+    c1.xDel = c2.xDel = 0;
     sqlite3VdbeMemShallowCopy(&c1, pMem1, MEM_Ephem);
     sqlite3VdbeMemShallowCopy(&c2, pMem2, MEM_Ephem);
     v1 = sqlite3ValueText((sqlite3_value*)&c1, pColl->enc);

diff --git a/src/vdbemem.c b/src/vdbemem.c
index 432cd4e898e2c179117c15fdad3da8c21272f662..c75046ab875c64859d3b1d286b15f94eaa6a856a 100644 (file)
--- a/src/vdbemem.c
+++ b/src/vdbemem.c
@@ -310,9 +310,13 @@ int sqlite3VdbeMemFinalize(Mem *pMem, FuncDef *pFunc){
 }
 
 /*
-** If the memory cell contains a string value that must be freed by
-** invoking an external callback, free it now. Calling this function
-** does not free any Mem.zMalloc buffer.
+** If the memory cell contains a value that must be freed by
+** invoking an external callback, then free it now. 
+**
+** This routine does NOT do any of the following:
+**    (1)  Set the Mem.flags field to a rational value.
+**    (2)  Free memory held by Mem.zMalloc
+** The caller is expected to take care of setting Mem.flags appropriately.
 **
 ** The VdbeMemReleaseExtern() macro invokes this routine if only if there
 ** is work for this routine to do.
@@ -340,8 +344,8 @@ void sqlite3VdbeMemReleaseExternal(Mem *p){
 ** by p->xDel and memory in p->zMalloc.
 **
 ** This is a helper routine invoked by sqlite3VdbeMemRelease() in
-** the uncommon case when there really is memory in p that is
-** need of freeing.
+** the uncommon case when there really is memory in p that needs
+** to be freeing.
 */
 static SQLITE_NOINLINE void vdbeMemRelease(Mem *p){
   if( VdbeMemDynamic(p) ){
@@ -355,9 +359,11 @@ static SQLITE_NOINLINE void vdbeMemRelease(Mem *p){
 }
 
 /*
-** Release any memory held by the Mem. This may leave the Mem in an
-** inconsistent state, for example with (Mem.z==0) and
-** (Mem.flags==MEM_Str).
+** Release any memory held by the Mem. This may leave the Mem.flags in an
+** inconsistent state, for example with (Mem.z==0) and (Mem.flags==MEM_Str).
+**
+** This routine releases both the Mem.xDel space and the Mem.zMalloc space.
+** Use sqlite3VdbeMemReleaseExternal() to release just the Mem.xDel space.
 */
 void sqlite3VdbeMemRelease(Mem *p){
   assert( sqlite3VdbeCheckMemInvariants(p) );
@@ -733,7 +739,7 @@ void sqlite3VdbeMemShallowCopy(Mem *pTo, const Mem *pFrom, int srcType){
   assert( pTo->db==pFrom->db );
   VdbeMemReleaseExtern(pTo);
   memcpy(pTo, pFrom, MEMCELLSIZE);
-  pTo->xDel = 0;
+  assert( pTo->xDel==0 );
   if( (pFrom->flags&MEM_Static)==0 ){
     pTo->flags &= ~(MEM_Dyn|MEM_Static|MEM_Ephem);
     assert( srcType==MEM_Ephem || srcType==MEM_Static );
@@ -753,7 +759,7 @@ int sqlite3VdbeMemCopy(Mem *pTo, const Mem *pFrom){
   VdbeMemReleaseExtern(pTo);
   memcpy(pTo, pFrom, MEMCELLSIZE);
   pTo->flags &= ~MEM_Dyn;
-  pTo->xDel = 0;
+  assert( pTo->xDel==0 );
 
   if( pTo->flags&(MEM_Str|MEM_Blob) ){
     if( 0==(pFrom->flags&MEM_Static) ){
@@ -906,6 +912,7 @@ int sqlite3VdbeMemFromBtree(
   int rc = SQLITE_OK; /* Return code */
 
   assert( sqlite3BtreeCursorIsValid(pCur) );
+  assert( pMem->xDel==0 );
 
   /* Note: the calls to BtreeKeyFetch() and DataFetch() below assert() 
   ** that both the BtShared and database handle mutexes are held. */
@@ -922,19 +929,22 @@ int sqlite3VdbeMemFromBtree(
     pMem->z = &zData[offset];
     pMem->flags = MEM_Blob|MEM_Ephem;
     pMem->n = (int)amt;
-  }else if( SQLITE_OK==(rc = sqlite3VdbeMemGrow(pMem, amt+2, 0)) ){
-    if( key ){
-      rc = sqlite3BtreeKey(pCur, offset, amt, pMem->z);
-    }else{
-      rc = sqlite3BtreeData(pCur, offset, amt, pMem->z);
-    }
-    if( rc==SQLITE_OK ){
-      pMem->z[amt] = 0;
-      pMem->z[amt+1] = 0;
-      pMem->flags = MEM_Blob|MEM_Term;
-      pMem->n = (int)amt;
-    }else{
-      sqlite3VdbeMemRelease(pMem);
+  }else{
+    pMem->flags = MEM_Null;
+    if( SQLITE_OK==(rc = sqlite3VdbeMemGrow(pMem, amt+2, 0)) ){
+      if( key ){
+        rc = sqlite3BtreeKey(pCur, offset, amt, pMem->z);
+      }else{
+        rc = sqlite3BtreeData(pCur, offset, amt, pMem->z);
+      }
+      if( rc==SQLITE_OK ){
+        pMem->z[amt] = 0;
+        pMem->z[amt+1] = 0;
+        pMem->flags = MEM_Blob|MEM_Term;
+        pMem->n = (int)amt;
+      }else{
+        sqlite3VdbeMemRelease(pMem);
+      }
     }
   }