Fix a VDBE stack overflow issue with the UPDATE statement.

FossilOrigin-Name: 715cecb8c795a28f312544031884622827358eda

diff --git a/manifest b/manifest
index 24900374302eb2ab61d438364a8126c37937b0a6..41c92b8f257b620cd14df07ffe475a74b03de54d 100644 (file)
--- a/manifest
+++ b/manifest
@@ -1,5 +1,8 @@
-C Version\s3.3.6\s(CVS\s3206)
-D 2006-06-06T13:34:16
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
+C Fix\sa\sVDBE\sstack\soverflow\sissue\swith\sthe\sUPDATE\sstatement.
+D 2009-09-03T19:43:49
 F Makefile.in 87b6d483513ab8a4e763775bc5b434d6b5c34963
 F Makefile.linux-gcc 74ba0eadf88748a9ce3fd03d2a3ede2e6715baec
 F README 9c4e2d6706bdcc3efdd773ce752a8cdab4f90028
@@ -87,7 +90,7 @@ F src/test_md5.c 6c42bc0a3c0b54be34623ff77a0eec32b2fa96e3
 F src/test_server.c a6460daed0b92ecbc2531b6dc73717470e7a648c
 F src/tokenize.c 91dc520980c0e2fb9265046adf8b7a86eff881dd
 F src/trigger.c 48bbb94c11954c8e132efcc04478efe8304c4196
-F src/update.c 34add66fcd3301b33b6e4c4c813f4e408f7ee4a0
+F src/update.c 7c8eaf12840a0bbe112150e21ad883fed4fb15dc
 F src/utf.c ab81ac59084ff1c07d421eb1a0a84ec809603b44
 F src/util.c ca6ee72772c0f5dc04d2e0ab1973fd3b6a9bf79d
 F src/vacuum.c 5b37d0f436f8e1ffacd17934e44720b38d2247f9
@@ -120,6 +123,7 @@ F test/autovacuum_crash.test 05a63b8805b20cfba7ace82856ce4ccdda075a31
 F test/autovacuum_ioerr.test c46a76869cb6eddbbb40b419b2b6c4c001766b1f
 F test/autovacuum_ioerr2.test 2f8a3fb31f833fd0ca86ad4ad98913c73e807572
 F test/avtrans.test b77740800de0d2cdcf394ef94d2d61225a1941d8
+F test/bb20090903.test 09b1a6cc0288a61b2380d0ac4f5eca2b6f94009a
 F test/between.test 16b1776c6323faadb097a52d673e8e3d8be7d070
 F test/bigfile.test ebc9ce9216e08bead63734ab816d0f27858f3b80
 F test/bigrow.test f0aeb7573dcb8caaafea76454be3ade29b7fc747
@@ -358,7 +362,18 @@ F www/tclsqlite.tcl bb0d1357328a42b1993d78573e587c6dcbc964b9
 F www/vdbe.tcl 87a31ace769f20d3627a64fa1fade7fed47b90d0
 F www/version3.tcl 890248cf7b70e60c383b0e84d77d5132b3ead42b
 F www/whentouse.tcl 97e2b5cd296f7d8057e11f44427dea8a4c2db513
-P b2e11e02902d6fa8fc2fb95cda4810e837d6861e
-R 505b982c1bdabcdfb694033eb3799e95
+P c11cb07e4b3f0b815a7099c8d201b3473869cba2
+R 1dd0ff98934a1fbb1355ae4c8644884f
+T *bgcolor * #7496fe
+T *branch * branch-3.3.6
+T *sym-branch-3.3.6 *
+T -sym-trunk *
 U drh
-Z 520f79fd80b6c51afb7f59475232b5c8
+Z c7fbac8b53d958c13ebf7779b5fc76a4
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1.4.6 (GNU/Linux)
+
+iD8DBQFKoBx6oxKgR168RlERAh5sAJ9owaIBcuBNe7ASkXARNjYjHAREfgCdGjfj
+lVgY6QGiPYeI/cpXIHLzEWQ=
+=bfHa
+-----END PGP SIGNATURE-----

diff --git a/manifest.uuid b/manifest.uuid
index e42e8cc98d4ca55ea51f6dc4e8152b9baf3205bb..009232a85033b9c79bf2c7370175966013612a8c 100644 (file)
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-c11cb07e4b3f0b815a7099c8d201b3473869cba2
\ No newline at end of file
+715cecb8c795a28f312544031884622827358eda
\ No newline at end of file

diff --git a/src/update.c b/src/update.c
index b3cd7aed090ae7375f87bf7cf897765fd943b933..8956624c76f91868e9cffbac94e6166ed28e3045 100644 (file)
--- a/src/update.c
+++ b/src/update.c
@@ -90,6 +90,7 @@ void sqlite3Update(
   AuthContext sContext;  /* The authorization context */
   NameContext sNC;       /* The name-context to resolve expressions in */
   int iDb;               /* Database containing the table being updated */
+  int regRowid;          /* Memory holding rowid to be updated */
 
 #ifndef SQLITE_OMIT_TRIGGER
   int isView;                  /* Trying to update a view */
@@ -305,7 +306,6 @@ void sqlite3Update(
     addr = sqlite3VdbeAddOp(v, OP_FifoRead, 0, 0);
 
     if( !isView ){
-      sqlite3VdbeAddOp(v, OP_Dup, 0, 0);
       sqlite3VdbeAddOp(v, OP_Dup, 0, 0);
       /* Open a cursor and make it point to the record that is
       ** being updated.
@@ -395,9 +395,11 @@ void sqlite3Update(
     */
     if( !triggers_exist ){
       addr = sqlite3VdbeAddOp(v, OP_FifoRead, 0, 0);
-      sqlite3VdbeAddOp(v, OP_Dup, 0, 0);
     }
+    regRowid = pParse->nMem++;
+    sqlite3VdbeAddOp(v, OP_MemStore, regRowid, 0);
     sqlite3VdbeAddOp(v, OP_NotExists, iCur, addr);
+    sqlite3VdbeAddOp(v, OP_MemLoad, regRowid, 0);
 
     /* If the record number will change, push the record number as it
     ** will be after the update. (The old record number is currently

diff --git a/test/bb20090903.test b/test/bb20090903.test
new file mode 100644 (file)
index 0000000..6b28174
--- /dev/null
+++ b/test/bb20090903.test
@@ -0,0 +1,116 @@
+# 2009 Sep 03
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+# This file implements regression tests for SQLite library.
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+
+proc moverows {x} {
+  db eval {UPDATE t1 SET x=x+1000}
+  return $x
+}
+
+do_test bb20090903-1.0 {
+  db eval {
+    CREATE TABLE t1(x INTEGER PRIMARY KEY, y);
+    INSERT INTO t1 VALUES(1,1);
+    INSERT INTO t1 VALUES(2,2);
+    INSERT INTO t1 SELECT x+2, y+2 FROM t1;
+    INSERT INTO t1 SELECT x+4, y+4 FROM t1;
+    INSERT INTO t1 SELECT x+8, y+8 FROM t1;
+    INSERT INTO t1 SELECT x+16, y+16 FROM t1;
+    INSERT INTO t1 SELECT x+32, y+32 FROM t1;
+  }
+  db function moverows moverows
+  db eval {
+    UPDATE t1 SET y=moverows(y);
+  }
+  db eval {
+    SELECT * FROM t1;
+  }
+} {1 1 1001 1 1002 2 1003 3 1004 4 1005 5 1006 6 1007 7 1008 8 1009 9 1010 10 1011 11 1012 12 1013 13 1014 14 1015 15 1016 16 1017 17 1018 18 1019 19 1020 20 1021 21 1022 22 1023 23 1024 24 1025 25 1026 26 1027 27 1028 28 1029 29 1030 30 1031 31 1032 32 1033 33 1034 34 1035 35 1036 36 1037 37 1038 38 1039 39 1040 40 1041 41 1042 42 1043 43 1044 44 1045 45 1046 46 1047 47 1048 48 1049 49 1050 50 1051 51 1052 52 1053 53 1054 54 1055 55 1056 56 1057 57 1058 58 1059 59 1060 60 1061 61 1062 62 1063 63 1064 64}
+
+do_test bb20090903-1.2 {
+  db eval {
+    DELETE FROM t1 WHERE x<1000;
+    UPDATE t1 SET x=x-1000;
+    SELECT count(*) FROM t1;
+    SELECT count(*) FROM t1 WHERE x!=y;
+  }
+} {64 0}
+
+do_test bb20090903-1.3 {
+  db eval {
+    CREATE TABLE t2(x INTEGER PRIMARY KEY, y);
+    INSERT INTO t2 SELECT * FROM t1;
+    CREATE TRIGGER r2a AFTER UPDATE ON t2 BEGIN
+      DELETE FROM t2;
+    END;
+    UPDATE t2 SET x=x+1000;
+    SELECT * FROM t2;
+  }
+} {}
+
+do_test bb20090903-1.4 {
+  db eval {
+    INSERT INTO t2 SELECT * FROM t1;
+    DROP TRIGGER r2a;
+    CREATE TRIGGER r2a BEFORE UPDATE ON t2 BEGIN
+      DELETE FROM t2;
+    END;
+    UPDATE t2 SET x=x+1000;
+    SELECT * FROM t2;
+  }
+} {}
+
+do_test bb20090903-1.5 {
+  db eval {
+    INSERT INTO t2 SELECT * FROM t1;
+    CREATE TABLE t3(x);
+    DROP TRIGGER r2a;
+    CREATE TRIGGER r2a AFTER UPDATE ON t2 BEGIN
+      INSERT INTO t3 VALUES(old.x);
+    END;
+    UPDATE t2 SET x=x+1000;
+    SELECT * FROM t3;
+  }
+} {1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64}
+
+do_test bb20090903-1.6 {
+  db eval {
+    DELETE FROM t2;
+    INSERT INTO t2 SELECT * FROM t1;
+    DROP TRIGGER r2a;
+    CREATE TRIGGER r2a AFTER UPDATE ON t2 BEGIN
+      DELETE FROM t2 WHERE x>10 AND x<1000;
+    END;
+    UPDATE t2 SET x=x+1000;
+    SELECT * FROM t2;
+  }
+} {1001 1 1002 2 1003 3 1004 4 1005 5 1006 6 1007 7 1008 8 1009 9 1010 10}
+
+do_test bb20090903-1.7 {
+  db eval {
+    DELETE FROM t2;
+    INSERT INTO t2 SELECT * FROM t1;
+    DROP TRIGGER r2a;
+    CREATE TRIGGER r2a BEFORE UPDATE ON t2 BEGIN
+      DELETE FROM t2 WHERE x>10 AND x<1000;
+    END;
+    UPDATE t2 SET x=x+1000;
+    SELECT * FROM t2;
+  }
+} {1001 1 1002 2 1003 3 1004 4 1005 5 1006 6 1007 7 1008 8 1009 9 1010 10}
+
+
+
+finish_test