When generating code for a subquery, make a copy of the Select object and

generate the code out of the copy, in case the code generator makes
modifications to expression and the Select object needs to be reused.

FossilOrigin-Name: 4edddcc0bc8d71e9b8abac67bc3766f1d9143dddd1f59264859ce65e5aa9b8c6

diff --git a/manifest b/manifest
index 75b662d105db2a9d1a1ca25adf767341e3ff565f..dac35a2241667f4071e0d5957939fa3d0260b80a 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Ensure\sthat\swhen\scode\sfor\sa\sscalar\sSELECT\sfeaturing\swindow\sfunctions\sis\sgenerated\smore\sthan\sonce\sby\sthe\splanner,\sseparate\sephemeral\stables\sare\sopened\sfor\seach\sinstance.
-D 2020-01-01T20:17:15.714
+C When\sgenerating\scode\sfor\sa\ssubquery,\smake\sa\scopy\sof\sthe\sSelect\sobject\sand\ngenerate\sthe\scode\sout\sof\sthe\scopy,\sin\scase\sthe\scode\sgenerator\smakes\nmodifications\sto\sexpression\sand\sthe\sSelect\sobject\sneeds\sto\sbe\sreused.
+D 2020-01-01T21:14:30.174
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -480,7 +480,7 @@ F src/date.c e1d8ac7102f3f283e63e13867acb0efa33861cf34f0faf4cdbaf9fa7a1eb7041
 F src/dbpage.c 135eb3b5e74f9ef74bde5cec2571192c90c86984fa534c88bf4a055076fa19b7
 F src/dbstat.c 6c407e549406c10fde9ac3987f6d734459205239ad370369bc5fcd683084a4fa
 F src/delete.c a5c59b9c0251cf7682bc52af0d64f09b1aefc6781a63592c8f1136f7b73c66e4
-F src/expr.c e76660a57fa2bbe4103686dc8add1a8c5ca40ae139076956dc8c670f5af34e93
+F src/expr.c 7f3a19d0d400d079bd5e40389c75634a1b6feeb91eadfff5919d5b7d73f0c418
 F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
 F src/fkey.c 92a248ec0fa4ed8ab60c98d9b188ce173aaf218f32e7737ba77deb2a684f9847
 F src/func.c 259496e4856bd0a3215d16804992f3339f3e8db29f129a5a7285c341488bbe9c
@@ -1295,7 +1295,7 @@ F test/schema6.test e4bd1f23d368695eb9e7b51ef6e02ca0642ea2ab4a52579959826b5e7dce
 F test/schemafault.test 1936bceca55ac82c5efbcc9fc91a1933e45c8d1e1d106b9a7e56c972a5a2a51e
 F test/securedel.test 2f70b2449186a1921bd01ec9da407fbfa98c3a7a5521854c300c194b2ff09384
 F test/securedel2.test 2d54c28e46eb1fd6902089958b20b1b056c6f1c5
-F test/select1.test b887331202618dbdabed92446b661ebd95a55ef3923700af56ed71266e9c1157
+F test/select1.test 0aaefed5e770232effeba2d19b8dde01b639d617b844cb2492a75961e4119549
 F test/select2.test 352480e0e9c66eda9c3044e412abdf5be0215b56
 F test/select3.test 3905450067c28766bc83ee397f6d87342de868baa60f2bcfd00f286dfbd62cb9
 F test/select4.test 5389d9895968d1196c457d59b3ee6515d771d328
@@ -1853,7 +1853,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 07e504d5174a1a8b1aa05ec5b44ac81ab3ea706c5a098caa88deb3d489cec8fb
-R ca9b505edc6627c7559e6f132a7a42f0
-U dan
-Z 91f49b7c37ac409cb8d99713dae333ea
+P ce1417325273aba866767349b55d9bbfb61a08e716bebda2122918a9657ee38c
+R 27455ef65ab3880a3c1e4f96d6b4fc0f
+U drh
+Z c1086ddd18661ca4be21f6cd956e9129

diff --git a/manifest.uuid b/manifest.uuid
index d2e2d0b7591e8091d788d3139bc38d38c8477d68..0e9ee4f3a63b9932d8d9742a1e2ba0bef073861f 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-ce1417325273aba866767349b55d9bbfb61a08e716bebda2122918a9657ee38c
\ No newline at end of file
+4edddcc0bc8d71e9b8abac67bc3766f1d9143dddd1f59264859ce65e5aa9b8c6
\ No newline at end of file

diff --git a/src/expr.c b/src/expr.c
index 1c03cf634e39ef08a69750108342a649806a2c59..b441b9a4f7f52adf47cecedef8d57eaff5683e36 100644 (file)
--- a/src/expr.c
+++ b/src/expr.c
@@ -2933,6 +2933,8 @@ int sqlite3CodeSubselect(Parse *pParse, Expr *pExpr){
   SelectDest dest;            /* How to deal with SELECT result */
   int nReg;                   /* Registers to allocate */
   Expr *pLimit;               /* New limit expression */
+  Select *pCopy;              /* Copy of pSel */
+  int rc;                     /* return value from subroutine call */
 
   Vdbe *v = pParse->pVdbe;
   assert( v!=0 );
@@ -3016,9 +3018,16 @@ int sqlite3CodeSubselect(Parse *pParse, Expr *pExpr){
     pSel->pLimit = sqlite3PExpr(pParse, TK_LIMIT, pLimit, 0);
   }
   pSel->iLimit = 0;
-  if( sqlite3Select(pParse, pSel, &dest) ){
-    return 0;
-  }
+
+  /* pSel might be reused.  So generate code using a copy of pSel, so that
+  ** if the code generator modifies the underlying structure of the SELECT
+  ** (for example in whereIndexExprTrans()) the original in pSel will be
+  ** unchanged. */
+  pCopy = sqlite3SelectDup(pParse->db, pSel, 0);
+  rc = sqlite3Select(pParse, pCopy, &dest);
+  sqlite3SelectDelete(pParse->db, pCopy);
+  if( rc ) return 0;
+
   pExpr->iTable = rReg = dest.iSDParm;
   ExprSetVVAProperty(pExpr, EP_NoReduce);
   if( addrOnce ){

diff --git a/test/select1.test b/test/select1.test
index 47dcd0fe4a949dffab2dda12aca033a8562ba395..b4d62554ae9fba12a5620397bdacffdf79a94bdc 100644 (file)
--- a/test/select1.test
+++ b/test/select1.test
@@ -1184,5 +1184,18 @@ do_catchsql_test select-19.21 {
     ORDER BY 1;
 } {1 {table t1 has 1 columns but 15 values were supplied}}
 
+# 2020-01-01 Found by Yongheng's fuzzer
+#
+reset_db
+do_execsql_test select-20.10 {
+  CREATE TABLE t1 (
+    a INTEGER PRIMARY KEY,
+    b AS('Y') UNIQUE
+  );
+  INSERT INTO t1(a) VALUES (10);
+  SELECT * FROM t1 JOIN t1 USING(a,b)
+   WHERE ((SELECT t1.a FROM t1 AS x GROUP BY b) AND b=0)
+      OR a = 10;
+} {10 Y}
 
 finish_test