From: dan <Dan Kennedy>
Date: Wed, 29 Jul 2026 14:23:30 +0000 (+0000)
Subject: Avoid apply an affinity to a register that might be the result of a TK_AGG_COLUMN... 
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=98c319e259923b5488d4a7038cc9153277ead8f3;p=thirdparty%2Fsqlite.git

Avoid apply an affinity to a register that might be the result of a TK_AGG_COLUMN expression, as it might be reused. Possible fix for bug [bugs:/info/2026-07-29T05:51:06Z | 2026-07-29T05:51:06Z].

FossilOrigin-Name: e5cce8a0026e71985f3afd07aba4b3f550871a1079d18234efa19438eed15d2d
---

diff --git a/manifest b/manifest
index 93996c4ee0..34195ef1fa 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Fix\sthe\ssha1()\sextension\sfunction\sso\sthat\sit\sinterprets\szero-length\nBLOBs\sas\sBLOBs\sand\snot\sas\sNULL.\s\sAlso\sadd\sa\sfew\stest\scases\sfor\sthat\nextension\sfunction,\swhich\swas\spreviously\scompletely\suntested.\n[bugs:/info/2026-07-29T06:31:41Z|Bug\s2026-07-29T06:31:41Z].
-D 2026-07-29T10:28:44.733
+C Avoid\sapply\san\saffinity\sto\sa\sregister\sthat\smight\sbe\sthe\sresult\sof\sa\sTK_AGG_COLUMN\sexpression,\sas\sit\smight\sbe\sreused.\sPossible\sfix\sfor\sbug\s[bugs:/info/2026-07-29T05:51:06Z\s|\s2026-07-29T05:51:06Z].
+D 2026-07-29T14:23:30.666
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -693,7 +693,7 @@ F src/date.c e1a002a4199bfa85e8778c0f72182c679580b131147d8e46d9221cfceffb8500
 F src/dbpage.c c6a9de13b0a01f0bc94a41e16213ab1ecd15ccfe86df7255ced40fda9446257d
 F src/dbstat.c 73362c0df0f40ad5523a6f5501224959d0976757b511299bf892313e79d14f5c
 F src/delete.c 59eeca3fb88c29329afc41bb803ee568b120d9dd7470b5f38ab55cc38390b451
-F src/expr.c f9bb5f7677dbc85fcb598c9444a5dafa0f21d9ae7b2d8f63fb3b2c36f6eb3cf6
+F src/expr.c 43c750797e82d5686c0f198d759f77d9c9166038837d7574d75d71649e09a335
 F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
 F src/fkey.c 931f74cec1dc8038a0217ef340c91ce147dd1bbed08dc40c47ee0ec6edfffb08
 F src/func.c 208b4d073a1e823df8d0e19d0529093c09a9984851dcfda9808445541cefe6d0
@@ -1293,7 +1293,7 @@ F test/in3.test 3cbf58c87f4052cee3a58b37b6389777505aa0c0
 F test/in4.test 6630816b7e59b7bd336b0a95cbf831dcf046d35b10ea987d6e69d223735f1887
 F test/in5.test 4fd79c70dfa0681313e8cdca07f5ff0400bdc0e20f808a5c59eaef1e4b48082a
 F test/in6.test f5f40d6816a8bb7c784424b58a10ac38efb76ab29127a2c17399e0cbeeda0e4b
-F test/in7.test d9efdee00b074a60c6343993b2eda78bc369ab080dad864513c73f8aca89d566
+F test/in7.test 5a3109dd348d43e70235ac3acf1390b0f41fb6e6deb51f6cab489e8ab4aad276
 F test/incrblob.test c9b96afc292aeff43d6687bcb09b0280aa599822
 F test/incrblob2.test a494c9e848560039a23974b9119cfc2cf3ad3bd15cc2694ee6367ae537ef8f1f
 F test/incrblob3.test 67621a04b3084113bf38ce03797d70eca012d9d8f948193b8f655df577b0da6f
@@ -2218,8 +2218,11 @@ F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee
 F tool/warnings.sh a554d13f6e5cf3760f041b87939e3d616ec6961859c3245e8ef701d1eafc2ca2
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
 F tool/winmain.c 00c8fb88e365c9017db14c73d3c78af62194d9644feaf60e220ab0f411f3604c
-P 1ed5e5bed26e3d38dd09541ce73dc68188574e236ecb60142260a0c40bf8902a
-R 6ce74aef2f51db9d2c3ebc6d22322ce0
-U drh
-Z af18f06a2c863de02c94ce6afa93abdc
+P 978d12de384fef985d0363633566304bb20f452dfe8ceb836ca1d353a135f30a
+R 5bf3286aa5a11fc30f08a59a10d74412
+T *branch * bug-2026-07-29T05:51:06
+T *sym-bug-2026-07-29T05:51:06 *
+T -sym-trunk *
+U dan
+Z 67caa51a69040baea70ecb8ab3608217
 # Remove this line to create a well-formed Fossil manifest.
diff --git a/manifest.tags b/manifest.tags
index bec971799f..8bea50b35a 100644
--- a/manifest.tags
+++ b/manifest.tags
@@ -1,2 +1,2 @@
-branch trunk
-tag trunk
+branch bug-2026-07-29T05:51:06
+tag bug-2026-07-29T05:51:06
diff --git a/manifest.uuid b/manifest.uuid
index 6ed5966ae9..062ddc742a 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-978d12de384fef985d0363633566304bb20f452dfe8ceb836ca1d353a135f30a
+e5cce8a0026e71985f3afd07aba4b3f550871a1079d18234efa19438eed15d2d
diff --git a/src/expr.c b/src/expr.c
index a02cbcb68a..f24af0aa47 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -4166,7 +4166,21 @@ static void sqlite3ExprCodeIN(
     ** we need to reorder the LHS values to be in index order.  Run Affinity
     ** before reordering the columns, so that the affinity is correct.
     */
-    sqlite3VdbeAddOp4(v, OP_Affinity, rLhs, nVector, 0, zAff, nVector);
+    if( nVector==1 ){
+      char aff = zAff[0];
+      if( aff>=SQLITE_AFF_TEXT && aff!=sqlite3ExprAffinity(pLeft) ){
+        /* The OP_Affinity below may change the value. In this case, create a
+        ** copy of rLhs to run OP_Affinity on, in case the original register
+        ** is used again (e.g. if it is TK_AGG_COLUMN).  */
+        int rTmp = sqlite3GetTempReg(pParse);
+        sqlite3VdbeAddOp3(v, OP_Copy, rLhs, rTmp, 0);
+        rLhs = rTmp;
+        sqlite3VdbeAddOp4(v, OP_Affinity, rLhs, 1, 0, zAff, 1);
+      }
+    }else{
+      sqlite3VdbeAddOp4(v, OP_Affinity, rLhs, nVector, 0, zAff, nVector);
+    }
+
     for(i=0; i<nVector && aiMap[i]==i; i++){} /* Are LHS fields reordered? */
     if( i!=nVector ){
       /* Need to reorder the LHS fields according to aiMap */
diff --git a/test/in7.test b/test/in7.test
index 763396140a..af93b1cba5 100644
--- a/test/in7.test
+++ b/test/in7.test
@@ -248,4 +248,94 @@ do_execsql_test 4.0 {
   SELECT quote(b) FROM t1;
 } {X'3333'}
 
+
+reset_db
+do_execsql_test 5.0 {
+  CREATE TABLE t0(c0 INT, c1 TEXT, PRIMARY KEY(c0));
+  CREATE VIEW v74(vout) AS SELECT t0.c1 FROM t0 GROUP BY t0.c1;
+  INSERT INTO t0(c0, c1) VALUES (1, -89807229);
+}
+
+do_execsql_test 5.1 {
+  SELECT vout,
+         (vout IN (SELECT t0.c1 FROM t0)) AS A,
+         (vout IN (SELECT t0.c0 FROM t0)) AS D,
+         ((vout IN (SELECT t0.c1 FROM t0)) AND NOT (vout IN (SELECT t0.c0 FROM t0))) AS P
+           FROM v74;
+} {-89807229 1 0 1}
+
+do_execsql_test 5.2 {
+  SELECT * FROM v74
+    WHERE (vout IN (SELECT t0.c1 FROM t0))
+} {-89807229}
+
+do_execsql_test 5.3 {
+  SELECT * FROM v74
+    WHERE NOT (vout IN (SELECT t0.c0 FROM t0));
+} {-89807229}
+
+do_execsql_test 5.4 {
+  SELECT * FROM v74
+    WHERE (vout IN (SELECT t0.c1 FROM t0))
+} {-89807229}
+
+do_execsql_test 5.5 {
+  SELECT t0.c1 FROM t0 GROUP BY t0.c1
+     HAVING 
+     NOT (t0.c1 IN (SELECT t0.c0 FROM t0))
+     AND (t0.c1 IN (SELECT t0.c1 FROM t0)) 
+} {-89807229}
+
+do_execsql_test 5.6 {
+  SELECT t0.c1 FROM t0 GROUP BY t0.c1
+     HAVING 
+             (t0.c1 IN (SELECT t0.c1 FROM t0)) 
+     AND NOT (t0.c1 IN (SELECT t0.c0 FROM t0))
+} {-89807229}
+
+#---------------------------------------------------------------
+
+do_execsql_test 5.7 {
+  CREATE TABLE t1(a TEXT);
+  INSERT INTO t1 VALUES('07777');
+
+  CREATE TABLE t2(b TEXT);
+  INSERT INTO t2 VALUES('07777');
+
+  CREATE TABLE t3(c INT, PRIMARY KEY(c));
+  INSERT INTO t3 VALUES(7777);
+}
+
+do_execsql_test 5.8 {
+  SELECT * FROM t1 GROUP BY t1.a
+} {07777}
+
+do_execsql_test 5.9 {
+  SELECT * FROM t1 GROUP BY t1.a
+     HAVING 
+             (t1.a IN (SELECT t3.c FROM t3)) 
+         AND (t1.a IN (SELECT t2.b FROM t2))
+} {07777}
+
+do_execsql_test 5.10 {
+  SELECT * FROM t1 GROUP BY t1.a
+     HAVING 
+             (t1.a IN (SELECT t2.b FROM t2))
+         AND (t1.a IN (SELECT t3.c FROM t3)) 
+} {07777}
+
+do_execsql_test 5.11 {
+  SELECT * FROM t1 GROUP BY t1.a HAVING (t1.a IN (SELECT t3.c FROM t3)) 
+} {07777}
+
+do_execsql_test 5.12 {
+  SELECT 
+      t1.a, 
+      (t1.a IN (SELECT t3.c FROM t3)), 
+      t1.a
+  FROM t1 
+  GROUP BY t1.a 
+} {07777 1 07777}
+
 finish_test
+