Merge inbound to m-c. a=merge
authorRyan VanderMeulen <ryanvm@gmail.com>
Wed, 24 May 2017 16:32:59 -0400
changeset 360466 c575ecde53030c41c12ba228d8fe78c3ed896e76
parent 360420 934ff2cb74b00bb92a7ab4f39aeaa014a9075a67 (current diff)
parent 360465 33a1924fca18aee209f74c7e89750ca94446401b (diff)
child 360487 b39078a430e71599d2b4c56b80caafddc5d5b2f3
child 360520 541bf10775c707290af037b19da27c41dff4c738
push id31882
push userryanvm@gmail.com
push dateWed, 24 May 2017 20:33:11 +0000
treeherdermozilla-central@c575ecde5303 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmerge
milestone55.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge inbound to m-c. a=merge
browser/themes/shared/customizableui/panelUI.inc.css
dom/file/ipc/Blob.cpp
dom/file/ipc/BlobChild.h
dom/file/ipc/BlobParent.h
dom/file/ipc/MemoryStreamChild.h
dom/file/ipc/MemoryStreamParent.cpp
dom/file/ipc/MemoryStreamParent.h
dom/file/ipc/PBlob.ipdl
dom/file/ipc/PBlobStream.ipdl
dom/file/ipc/PMemoryStream.ipdl
dom/file/ipc/nsIRemoteBlob.h
old-configure.in
parser/html/nsHtml5StreamParserPtr.h
testing/web-platform/meta/battery-status/battery-interface-idlharness.html.ini
testing/web-platform/meta/battery-status/battery-promise-iframe.html.ini
testing/web-platform/meta/battery-status/battery-promise-window.html.ini
testing/web-platform/meta/battery-status/battery-promise.html.ini
testing/web-platform/meta/content-security-policy/navigation/to-javascript-url.html.ini
testing/web-platform/meta/intersection-observer/client-rect.html.ini
testing/web-platform/meta/intersection-observer/observer-attributes.html.ini
testing/web-platform/meta/intersection-observer/observer-exceptions.html.ini
testing/web-platform/meta/intersection-observer/observer-in-iframe.html.ini
testing/web-platform/meta/url/interfaces.html.ini
testing/web-platform/meta/webusb/idlharness.html.ini
testing/web-platform/tests/DOM-parsing/todo/internalSubset.html
testing/web-platform/tests/battery-status/battery-charging-manual.html
testing/web-platform/tests/battery-status/battery-discharging-manual.html
testing/web-platform/tests/battery-status/battery-full-manual.html
testing/web-platform/tests/battery-status/battery-interface-idlharness.html
testing/web-platform/tests/battery-status/battery-plugging-in-manual.html
testing/web-platform/tests/battery-status/battery-promise-iframe.html
testing/web-platform/tests/battery-status/battery-promise-window.html
testing/web-platform/tests/battery-status/battery-promise.html
testing/web-platform/tests/battery-status/battery-unplugging-manual.html
testing/web-platform/tests/battery-status/support-iframe-initial.html
testing/web-platform/tests/content-security-policy/navigation/to-javascript-url.html
testing/web-platform/tests/old-tests/submission/Microsoft/sandbox/iframe_sandbox_009.htm
testing/web-platform/tests/old-tests/submission/Microsoft/sandbox/sandbox_009-manual.htm
testing/web-platform/tests/presentation-api/controlling-ua/PresentationConnection_onclosed-manual.html
testing/web-platform/tests/presentation-api/controlling-ua/PresentationConnection_onconnected-manual.html
testing/web-platform/tests/presentation-api/controlling-ua/PresentationConnection_onterminated-manual.html
testing/web-platform/tests/url/interfaces.html
testing/web-platform/tests/webusb/idlharness.html
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -7107,17 +7107,18 @@ var gIdentityHandler = {
     if (sharing)
       this._identityBox.setAttribute("sharing", sharing);
     else
       this._identityBox.removeAttribute("sharing");
 
     this._sharingState = tab._sharingState;
 
     if (this._identityPopup.state == "open") {
-      this._handleHeightChange(() => this.updateSitePermissions());
+      this.updateSitePermissions();
+      this._identityPopupMultiView.descriptionHeightWorkaround();
     }
   },
 
   /**
    * Attempt to provide proper IDN treatment for host names
    */
   getEffectiveHost() {
     if (!this._IDNService)
@@ -7618,30 +7619,16 @@ var gIdentityHandler = {
     if (!this._permissionList.hasChildNodes() &&
         this._permissionReloadHint.hasAttribute("hidden")) {
       this._permissionEmptyHint.removeAttribute("hidden");
     } else {
       this._permissionEmptyHint.setAttribute("hidden", "true");
     }
   },
 
-  _handleHeightChange(aFunction, aWillShowReloadHint) {
-    let heightBefore = getComputedStyle(this._permissionList).height;
-    aFunction();
-    let heightAfter = getComputedStyle(this._permissionList).height;
-    // Showing the reload hint increases the height, we need to account for it.
-    if (aWillShowReloadHint) {
-      heightAfter = parseInt(heightAfter) +
-                    parseInt(getComputedStyle(this._permissionList.nextSibling).height);
-    }
-    let heightChange = parseInt(heightAfter) - parseInt(heightBefore);
-    if (heightChange)
-      this._identityPopupMultiView.setHeightToFit(heightChange);
-  },
-
   _createPermissionItem(aPermission) {
     let container = document.createElement("hbox");
     container.setAttribute("class", "identity-popup-permission-item");
     container.setAttribute("align", "center");
 
     let img = document.createElement("image");
     let classes = "identity-popup-permission-icon " + aPermission.id + "-icon";
     if (aPermission.state == SitePermissions.BLOCK)
@@ -7668,19 +7655,17 @@ var gIdentityHandler = {
     stateLabel.textContent = SitePermissions.getCurrentStateLabel(state, scope);
 
     let button = document.createElement("button");
     button.setAttribute("class", "identity-popup-permission-remove-button");
     let tooltiptext = gNavigatorBundle.getString("permissions.remove.tooltip");
     button.setAttribute("tooltiptext", tooltiptext);
     button.addEventListener("command", () => {
       let browser = gBrowser.selectedBrowser;
-      // Only resize the window if the reload hint was previously hidden.
-      this._handleHeightChange(() => this._permissionList.removeChild(container),
-                               this._permissionReloadHint.hasAttribute("hidden"));
+      this._permissionList.removeChild(container);
       if (aPermission.inUse &&
           ["camera", "microphone", "screen"].includes(aPermission.id)) {
         let windowId = this._sharingState.windowId;
         if (aPermission.id == "screen") {
           windowId = "screen:" + windowId;
         } else {
           // If we set persistent permissions or the sharing has
           // started due to existing persistent permissions, we need
@@ -7701,16 +7686,17 @@ var gIdentityHandler = {
           }
         }
         browser.messageManager.sendAsyncMessage("webrtc:StopSharing", windowId);
         webrtcUI.forgetActivePermissionsFromBrowser(gBrowser.selectedBrowser);
       }
       SitePermissions.remove(gBrowser.currentURI, aPermission.id, browser);
 
       this._permissionReloadHint.removeAttribute("hidden");
+      this._identityPopupMultiView.descriptionHeightWorkaround();
 
       // Set telemetry values for clearing a permission
       let histogram = Services.telemetry.getKeyedHistogramById("WEB_PERMISSION_CLEARED");
 
       let permissionType = 0;
       if (aPermission.state == SitePermissions.ALLOW &&
           aPermission.scope == SitePermissions.SCOPE_PERSISTENT) {
         // 1 : clear permanently allowed permission
--- a/browser/components/controlcenter/content/panel.inc.xul
+++ b/browser/components/controlcenter/content/panel.inc.xul
@@ -11,17 +11,18 @@
        orient="vertical">
 
   <broadcasterset>
     <broadcaster id="identity-popup-mcb-learn-more" class="text-link plain" value="&identity.learnMore;"/>
     <broadcaster id="identity-popup-insecure-login-forms-learn-more" class="text-link plain" value="&identity.learnMore;"/>
   </broadcasterset>
 
   <panelmultiview id="identity-popup-multiView"
-                  mainViewId="identity-popup-mainView">
+                  mainViewId="identity-popup-mainView"
+                  descriptionheightworkaround="true">
     <panelview id="identity-popup-mainView" flex="1">
 
       <!-- Security Section -->
       <hbox id="identity-popup-security" class="identity-popup-section">
         <vbox id="identity-popup-security-content" flex="1">
           <label class="plain">
             <label class="identity-popup-headline identity-popup-host"></label>
             <label class="identity-popup-headline identity-popup-hostless" crop="end"/>
@@ -91,29 +92,29 @@
           <vbox id="identity-popup-permission-list"/>
           <description id="identity-popup-permission-reload-hint">&identity.permissionsReloadHint;</description>
           <description id="identity-popup-permission-empty-hint">&identity.permissionsEmpty;</description>
         </vbox>
       </hbox>
     </panelview>
 
     <!-- Security SubView -->
-    <panelview id="identity-popup-securityView" flex="1">
+    <panelview id="identity-popup-securityView">
       <vbox id="identity-popup-securityView-header">
         <label class="plain">
           <label class="identity-popup-headline identity-popup-host"></label>
           <label class="identity-popup-headline identity-popup-hostless" crop="end"/>
         </label>
         <description class="identity-popup-connection-not-secure"
                      when-connection="not-secure secure-cert-user-overridden">&identity.connectionNotSecure;</description>
         <description class="identity-popup-connection-secure"
                      when-connection="secure secure-ev">&identity.connectionSecure;</description>
       </vbox>
 
-      <vbox id="identity-popup-securityView-body" flex="1">
+      <vbox id="identity-popup-securityView-body" class="panel-view-body-unscrollable">
         <!-- (EV) Certificate Information -->
         <description id="identity-popup-content-verified-by"
                      when-connection="secure-ev">&identity.connectionVerified2;</description>
         <description id="identity-popup-content-owner"
                      when-connection="secure-ev"
                      class="header"/>
         <description id="identity-popup-content-supplemental"
                      when-connection="secure-ev"/>
--- a/browser/components/customizableui/PanelMultiView.jsm
+++ b/browser/components/customizableui/PanelMultiView.jsm
@@ -166,30 +166,16 @@ this.PanelMultiView = class {
   }
   get _mainView() {
     return this._mainViewId ? this.document.getElementById(this._mainViewId) : null;
   }
   get showingSubViewAsMainView() {
     return this.node.getAttribute("mainViewIsSubView") == "true";
   }
 
-  get ignoreMutations() {
-    return this._ignoreMutations;
-  }
-  set ignoreMutations(val) {
-    this._ignoreMutations = val;
-    if (!val && this._panel.state == "open") {
-      if (this.showingSubView) {
-        this._syncContainerWithSubView();
-      } else {
-        this._syncContainerWithMainView();
-      }
-    }
-  }
-
   get _transitioning() {
     return this.__transitioning;
   }
   set _transitioning(val) {
     this.__transitioning = val;
     if (val) {
       this.node.setAttribute("transitioning", "true");
     } else {
@@ -259,23 +245,16 @@ this.PanelMultiView = class {
       // Set CSS-determined attributes now to prevent a layout flush when we do
       // it when transitioning between panels.
       this._dir = cs.direction;
       this.setMainView(this.panelViews.currentView);
       this.showMainView();
     } else {
       this._panel.addEventListener("popupshown", this);
       this._clickCapturer.addEventListener("click", this);
-      this._subViews.addEventListener("overflow", this);
-      this._mainViewContainer.addEventListener("overflow", this);
-
-      // Get a MutationObserver ready to react to subview size changes. We
-      // only attach this MutationObserver when a subview is being displayed.
-      this._subViewObserver = new window.MutationObserver(this._syncContainerWithSubView.bind(this));
-      this._mainViewObserver = new window.MutationObserver(this._syncContainerWithMainView.bind(this));
 
       this._mainViewContainer.setAttribute("panelid", this._panel.id);
 
       if (this._mainView) {
         this.setMainView(this._mainView);
       }
     }
 
@@ -285,35 +264,32 @@ this.PanelMultiView = class {
     // parts of the browser, to this instance.
     ["_mainView", "ignoreMutations", "showingSubView"].forEach(property => {
       Object.defineProperty(this.node, property, {
         enumerable: true,
         get: () => this[property],
         set: (val) => this[property] = val
       });
     });
-    ["goBack", "setHeightToFit", "setMainView", "showMainView", "showSubView"].forEach(method => {
+    ["goBack", "descriptionHeightWorkaround", "setMainView", "showMainView",
+     "showSubView"].forEach(method => {
       Object.defineProperty(this.node, method, {
         enumerable: true,
         value: (...args) => this[method](...args)
       });
     });
   }
 
   destructor() {
     if (this._mainView) {
       this._mainView.removeAttribute("mainview");
     }
     if (this.panelViews) {
       this.panelViews.clear();
     } else {
-      this._mainViewObserver.disconnect();
-      this._subViewObserver.disconnect();
-      this._subViews.removeEventListener("overflow", this);
-      this._mainViewContainer.removeEventListener("overflow", this);
       this._clickCapturer.removeEventListener("click", this);
     }
     this._panel.removeEventListener("popupshowing", this);
     this._panel.removeEventListener("popupshown", this);
     this._panel.removeEventListener("popuphidden", this);
     this.node = this._clickCapturer = this._viewContainer = this._mainViewContainer =
       this._subViews = this._viewStack = this.__dwu = null;
   }
@@ -340,17 +316,16 @@ this.PanelMultiView = class {
     if (this.panelViews) {
       // If the new main view is not yet in the zeroth position, make sure it's
       // inserted there.
       if (aNewMainView.parentNode != this._viewStack && this._viewStack.firstChild != aNewMainView) {
         this._viewStack.insertBefore(aNewMainView, this._viewStack.firstChild);
       }
     } else {
       if (this._mainView) {
-        this._mainViewObserver.disconnect();
         this._subViews.appendChild(this._mainView);
         this._mainView.removeAttribute("mainview");
       }
       this._mainViewId = aNewMainView.id;
       aNewMainView.setAttribute("mainview", "true");
       this._mainViewContainer.appendChild(aNewMainView);
     }
   }
@@ -359,24 +334,21 @@ this.PanelMultiView = class {
     if (this.panelViews) {
       this.showSubView(this._mainViewId);
     } else {
       if (this.showingSubView) {
         let viewNode = this._currentSubView;
         let evt = new this.window.CustomEvent("ViewHiding", { bubbles: true, cancelable: true });
         viewNode.dispatchEvent(evt);
 
-        viewNode.removeAttribute("current");
-        this._currentSubView = null;
-
-        this._subViewObserver.disconnect();
-
-        this._setViewContainerHeight(this._mainViewHeight);
-
-        this.node.setAttribute("viewtype", "main");
+        this._transitionHeight(() => {
+          viewNode.removeAttribute("current");
+          this._currentSubView = null;
+          this.node.setAttribute("viewtype", "main");
+        });
       }
 
       this._shiftMainView();
     }
   }
 
   showSubView(aViewId, aAnchor, aPreviousView, aAdopted = false) {
     const {document, window} = this;
@@ -474,19 +446,19 @@ this.PanelMultiView = class {
       //    node is at the left-most edge of the panel.
       // 2) The subview deck slides in so that it takes up almost all of the
       //    panel.
       // 3) If the subview is taller then the main panel contents, then the panel
       //    must grow to meet that new height. Otherwise, it must shrink.
       //
       // All three of these actions make use of CSS transformations, so they
       // should all occur simultaneously.
-      this.node.setAttribute("viewtype", "subview");
+      if (this.panelViews && playTransition) {
+        this.node.setAttribute("viewtype", "subview");
 
-      if (this.panelViews && playTransition) {
         // Sliding the next subview in means that the previous panelview stays
         // where it is and the active panelview slides in from the left in LTR
         // mode, right in RTL mode.
         let onTransitionEnd = () => {
           evt = new window.CustomEvent("ViewHiding", { bubbles: true, cancelable: true });
           previousViewNode.dispatchEvent(evt);
           previousViewNode.removeAttribute("current");
         };
@@ -599,44 +571,96 @@ this.PanelMultiView = class {
               if (aAnchor)
                 aAnchor.removeAttribute("open");
 
               this._viewContainer.removeAttribute("transition-reverse");
             }, { once: true });
           });
         }, { once: true });
       } else if (!this.panelViews) {
+        this._transitionHeight(() => {
+          viewNode.setAttribute("current", true);
+          this.node.setAttribute("viewtype", "subview");
+          // Now that the subview is visible, we can check the height of the
+          // description elements it contains.
+          this.descriptionHeightWorkaround(viewNode);
+        });
         this._shiftMainView(aAnchor);
-
-        this._mainViewHeight = this._viewStack.clientHeight;
-
-        let newHeight = this._heightOfSubview(viewNode, this._subViews);
-        this._setViewContainerHeight(newHeight);
-
-        this._subViewObserver.observe(viewNode, {
-          attributes: true,
-          characterData: true,
-          childList: true,
-          subtree: true
-        });
       }
     })();
   }
 
-  _setViewContainerHeight(aHeight) {
-    let container = this._viewContainer;
-    this._transitioning = true;
+  /**
+   * Applies the height transition for which <panelmultiview> is designed.
+   *
+   * The height transition involves two elements, the viewContainer and its only
+   * immediate child the viewStack. In order for this to work correctly, the
+   * viewContainer must have "overflow: hidden;" and the two elements must have
+   * no margins or padding. This means that the height of the viewStack is never
+   * limited by the viewContainer, but when the height of the container is not
+   * constrained it matches the height of the viewStack.
+   *
+   * @param changeFn
+   *        This synchronous function is called to make the DOM changes
+   *        that will result in a new height of the viewStack.
+   */
+  _transitionHeight(changeFn) {
+    if (this._panel.state != "open") {
+      changeFn();
+      return;
+    }
+
+    // Lock the dimensions of the window that hosts the popup panel. This
+    // in turn constrains the height of the viewContainer.
+    let rect = this._panel.popupBoxObject.getOuterScreenRect();
+    this._panel.setAttribute("width", rect.width);
+    this._panel.setAttribute("height", rect.height);
+
+    // Read the current height of the viewStack. If we are in the middle
+    // of a transition, this is the actual height of the element at this
+    // point in time.
+    let oldHeight = this._dwu.getBoundsWithoutFlushing(this._viewStack).height;
 
-    let onTransitionEnd = () => {
-      container.removeEventListener("transitionend", onTransitionEnd);
-      this._transitioning = false;
-    };
+    // Make the necessary DOM changes, and remove the "height" property of the
+    // viewStack to ensure that we read its final value even if we are in the
+    // middle of a transition. To avoid flickering, we have to prevent the panel
+    // from being painted in this temporary state, which requires a synchronous
+    // layout when reading the new height.
+    this._viewStack.style.removeProperty("height");
+    changeFn();
+    let newHeight = this._viewStack.getBoundingClientRect().height;
+
+    // Now we can allow the popup panel to resize again. This must occur
+    // in the same tick as the code below, but we can do this before
+    // setting the starting height in case the transition is not needed.
+    this._panel.removeAttribute("width");
+    this._panel.removeAttribute("height");
 
-    container.addEventListener("transitionend", onTransitionEnd);
-    container.style.height = `${aHeight}px`;
+    if (oldHeight != newHeight) {
+      // Height transitions can only occur between two numeric values, and
+      // cannot start if the height is not set. In case a transition is
+      // needed, we have to set the height to the old value, then force a
+      // synchronous layout so the panel won't resize unexpectedly.
+      this._viewStack.style.height = oldHeight + "px";
+      this._viewStack.getBoundingClientRect().height;
+
+      // We can now set the new height to start the transition, but
+      // before doing that we set up a listener to reset the height to
+      // "auto" at the end, so that DOM changes made after the
+      // transition ends are still reflected by the height of the panel.
+      let onTransitionEnd = event => {
+        if (event.target != this._viewStack) {
+          return;
+        }
+        this._viewStack.removeEventListener("transitionend", onTransitionEnd);
+        this._viewStack.style.removeProperty("height");
+      };
+      this._viewStack.addEventListener("transitionend", onTransitionEnd);
+      this._viewStack.style.height = newHeight + "px";
+    }
   }
 
   _shiftMainView(aAnchor) {
     if (aAnchor) {
       // We need to find the edge of the anchor, relative to the main panel.
       // Then we need to add half the width of the anchor. This is the target
       // that we need to transition to.
       let anchorRect = aAnchor.getBoundingClientRect();
@@ -682,58 +706,64 @@ this.PanelMultiView = class {
         }
         break;
       case "keydown":
         this._keyNavigation(aEvent);
         break;
       case "mousemove":
         this._resetKeyNavigation();
         break;
-      case "overflow":
-        if (!this.panelViews && aEvent.target.localName == "vbox") {
-          // Resize the right view on the next tick.
-          if (this.showingSubView) {
-            this.window.setTimeout(this._syncContainerWithSubView.bind(this), 0);
-          } else if (!this.transitioning) {
-            this.window.setTimeout(this._syncContainerWithMainView.bind(this), 0);
-          }
-        }
-        break;
       case "popupshowing":
         this.node.setAttribute("panelopen", "true");
         // Bug 941196 - The panel can get taller when opening a subview. Disabling
         // autoPositioning means that the panel won't jump around if an opened
         // subview causes the panel to exceed the dimensions of the screen in the
         // direction that the panel originally opened in. This property resets
         // every time the popup closes, which is why we have to set it each time.
         this._panel.autoPosition = false;
-
-        if (!this.panelViews) {
-          this._syncContainerWithMainView();
-          this._mainViewObserver.observe(this._mainView, {
-            attributes: true,
-            characterData: true,
-            childList: true,
-            subtree: true
-          });
-        } else {
+        if (this.panelViews) {
           this.window.addEventListener("keydown", this);
           this._panel.addEventListener("mousemove", this);
         }
         break;
       case "popupshown":
-        this._setMaxHeight();
+        // Now that the main view is visible, we can check the height of the
+        // description elements it contains.
+        this.descriptionHeightWorkaround();
+        // Now that the panel has opened, we can compute the distance from its
+        // anchor to the available margin of the screen, based on whether the
+        // panel actually opened towards the top or the bottom. We use this to
+        // limit its maximum height, which is relevant when opening a subview.
+        let maxHeight;
+        if (this._panel.alignmentPosition.startsWith("before_")) {
+          maxHeight = this._panel.getOuterScreenRect().bottom -
+                      this.window.screen.availTop;
+        } else {
+          maxHeight = this.window.screen.availTop +
+                      this.window.screen.availHeight -
+                      this._panel.getOuterScreenRect().top;
+        }
+        // To go from the maximum height of the panel to the maximum height of
+        // the view stack, we start by subtracting the height of the arrow box.
+        // We don't need to trigger a new layout because this does not change.
+        let arrowBox = this.document.getAnonymousElementByAttribute(
+                                        this._panel, "anonid", "arrowbox");
+        maxHeight -= this._dwu.getBoundsWithoutFlushing(arrowBox).height;
+        // We subtract a fixed margin to account for variable borders. We don't
+        // try to measure this accurately so it's faster, we don't depend on
+        // the arrowpanel structure, and we don't hit rounding errors. Instead,
+        // we use a value that is much greater than the typical borders and
+        // makes sense visually.
+        const EXTRA_MARGIN_PX = 8;
+        this._viewStack.style.maxHeight = (maxHeight - EXTRA_MARGIN_PX) + "px";
         break;
       case "popuphidden":
         this.node.removeAttribute("panelopen");
-        this._mainView.style.removeProperty("height");
         this.showMainView();
-        if (!this.panelViews) {
-          this._mainViewObserver.disconnect();
-        } else {
+        if (this.panelViews) {
           this.window.removeEventListener("keydown", this);
           this._panel.removeEventListener("mousemove", this);
           this._resetKeyNavigation();
           this._mainViewHeight = 0;
         }
         break;
     }
   }
@@ -867,138 +897,52 @@ this.PanelMultiView = class {
    */
   _getNavigableElements(view) {
     let buttons = Array.from(view.querySelectorAll(".subviewbutton:not([disabled])"));
     if (this._canGoBack(view))
       buttons.unshift(view.backButton);
     return buttons;
   }
 
-  _shouldSetPosition() {
-    return this.node.getAttribute("nosubviews") == "true";
-  }
-
-  _shouldSetHeight() {
-    return this.node.getAttribute("nosubviews") != "true";
-  }
-
-  _setMaxHeight() {
-    if (!this._shouldSetHeight())
-      return;
-
-    // Ignore the mutation that'll fire when we set the height of
-    // the main view.
-    this.ignoreMutations = true;
-    this._mainView.style.height = this.node.getBoundingClientRect().height + "px";
-    this.ignoreMutations = false;
-  }
-
-  _adjustContainerHeight() {
-    if (!this.ignoreMutations && !this.showingSubView && !this._transitioning) {
-      let height;
-      if (this.showingSubViewAsMainView) {
-        height = this._heightOfSubview(this._mainView);
-      } else {
-        height = this._mainView.scrollHeight;
-      }
-      this._viewContainer.style.height = height + "px";
-    }
-  }
-
-  _syncContainerWithSubView() {
-    // Check that this panel is still alive:
-    if (!this._panel || !this._panel.parentNode) {
-      return;
-    }
-
-    if (!this.ignoreMutations && this.showingSubView) {
-      let newHeight = this._heightOfSubview(this._currentSubView, this._subViews);
-      this._viewContainer.style.height = newHeight + "px";
-    }
-  }
-
-  _syncContainerWithMainView() {
-    // Check that this panel is still alive:
-    if (!this._panel || !this._panel.parentNode) {
+  /**
+   * If the main view or a subview contains wrapping elements, the attribute
+   * "descriptionheightworkaround" should be set on the view to force all the
+   * "description" elements to a fixed height. If the attribute is set and the
+   * visibility, contents, or width of any of these elements changes, this
+   * function should be called to refresh the calculated heights.
+   *
+   * @note While both "label" and "description" elements may contain wrapping
+   *       text, only "description" elements are used that way in panels.
+   *
+   * @param viewNode
+   *        Indicates the node to scan for descendant elements. This is the main
+   *        view if omitted.
+   */
+  descriptionHeightWorkaround(viewNode = this._mainView) {
+    if (!this.node.hasAttribute("descriptionheightworkaround")) {
+      // This view does not require the workaround.
       return;
     }
 
-    if (this._shouldSetPosition()) {
-      this._panel.adjustArrowPosition();
+    // We batch DOM changes together in order to reduce synchronous layouts.
+    // First we reset any change we may have made previously. The first time
+    // this is called, and in the best case scenario, this has no effect.
+    let items = [];
+    for (let element of viewNode.getElementsByTagName("description")) {
+      element.style.removeProperty("height");
+      items.push({ element });
     }
-
-    if (this._shouldSetHeight()) {
-      this._adjustContainerHeight();
+    // We now read the computed style to store the height of any element that
+    // may contain wrapping text, which will be zero if the element is hidden.
+    // This might trigger a synchronous layout, but if this function was called
+    // from a _transitionHeight callback and there are no description elements
+    // visible, then _transitionHeight will not trigger a layout again.
+    for (let item of items) {
+      item.height = item.element.getBoundingClientRect().height;
+    }
+    // Now we can make all the necessary DOM changes at once.
+    for (let item of items) {
+      if (item.height) {
+        item.element.style.height = item.height + "px";
+      }
     }
   }
-
-  /**
-   * Call this when the height of one of your views (the main view or a
-   * subview) changes and you want the heights of the multiview and panel
-   * to be the same as the view's height.
-   * If the caller can give a hint of the expected height change with the
-   * optional aExpectedChange parameter, it prevents flicker.
-   */
-  setHeightToFit(aExpectedChange) {
-    // Set the max-height to zero, wait until the height is actually
-    // updated, and then remove it.  If it's not removed, weird things can
-    // happen, like widgets in the panel won't respond to clicks even
-    // though they're visible.
-    const {window} = this;
-    let count = 5;
-    let height = window.getComputedStyle(this.node).height;
-    if (aExpectedChange)
-      this.node.style.maxHeight = (parseInt(height, 10) + aExpectedChange) + "px";
-    else
-      this.node.style.maxHeight = "0";
-    let interval = window.setInterval(() => {
-      if (height != window.getComputedStyle(this.node).height || --count == 0) {
-        window.clearInterval(interval);
-        this.node.style.removeProperty("max-height");
-      }
-    }, 0);
-  }
-
-  _heightOfSubview(aSubview, aContainerToCheck) {
-    function getFullHeight(element) {
-      // XXXgijs: unfortunately, scrollHeight rounds values, and there's no alternative
-      // that works with overflow: auto elements. Fortunately for us,
-      // we have exactly 1 (potentially) scrolling element in here (the subview body),
-      // and rounding 1 value is OK - rounding more than 1 and adding them means we get
-      // off-by-1 errors. Now we might be off by a subpixel, but we care less about that.
-      // So, use scrollHeight *only* if the element is vertically scrollable.
-      let height;
-      let elementCS;
-      if (element.scrollTopMax) {
-        height = element.scrollHeight;
-        // Bounding client rects include borders, scrollHeight doesn't:
-        elementCS = win.getComputedStyle(element);
-        height += parseFloat(elementCS.borderTopWidth) +
-                  parseFloat(elementCS.borderBottomWidth);
-      } else {
-        height = element.getBoundingClientRect().height;
-        if (height > 0) {
-          elementCS = win.getComputedStyle(element);
-        }
-      }
-      if (elementCS) {
-        // Include margins - but not borders or paddings because they
-        // were dealt with above.
-        height += parseFloat(elementCS.marginTop) + parseFloat(elementCS.marginBottom);
-      }
-      return height;
-    }
-    let win = aSubview.ownerGlobal;
-    let body = aSubview.querySelector(".panel-subview-body");
-    let height = getFullHeight(body || aSubview);
-    if (body) {
-      let header = aSubview.querySelector(".panel-subview-header");
-      let footer = aSubview.querySelector(".panel-subview-footer");
-      height += (header ? getFullHeight(header) : 0) +
-                (footer ? getFullHeight(footer) : 0);
-    }
-    if (aContainerToCheck) {
-      let containerCS = win.getComputedStyle(aContainerToCheck);
-      height += parseFloat(containerCS.paddingTop) + parseFloat(containerCS.paddingBottom);
-    }
-    return Math.ceil(height);
-  }
 }
--- a/browser/components/customizableui/content/panelUI.css
+++ b/browser/components/customizableui/content/panelUI.css
@@ -1,30 +1,31 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 .panel-viewstack[viewtype="main"] > .panel-clickcapturer {
   pointer-events: none;
 }
 
-.panel-mainview,
-.panel-viewcontainer,
-.panel-viewstack {
+.panel-viewcontainer {
   overflow: hidden;
 }
 
 .panel-viewstack {
-  position: relative;
+  transition: height var(--panelui-subview-transition-duration);
 }
 
 .panel-subviews {
-  -moz-stack-sizing: ignore;
+  -moz-stack-sizing: ignore-horizontal;
   transform: translateX(0);
-  overflow-y: auto;
+}
+
+.panel-viewstack[viewtype="main"] > .panel-subviews {
+  -moz-stack-sizing: ignore;
 }
 
 .panel-subviews[panelopen] {
   transition: transform var(--panelui-subview-transition-duration);
 }
 
 .panel-viewcontainer[panelopen]:-moz-any(:not([viewtype="main"]),[transitioning]) {
   transition-property: height;
--- a/browser/components/customizableui/content/panelUI.xml
+++ b/browser/components/customizableui/content/panelUI.xml
@@ -13,17 +13,17 @@
           xmlns:xul="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
           xmlns:xbl="http://www.mozilla.org/xbl">
 
   <binding id="panelmultiview">
     <resources>
       <stylesheet src="chrome://browser/content/customizableui/panelUI.css"/>
     </resources>
     <content>
-      <xul:box anonid="viewContainer" class="panel-viewcontainer" xbl:inherits="panelopen,viewtype,transitioning">
+      <xul:vbox anonid="viewContainer" class="panel-viewcontainer" xbl:inherits="panelopen,viewtype,transitioning">
         <xul:stack anonid="viewStack" xbl:inherits="viewtype,transitioning" class="panel-viewstack">
           <xul:vbox anonid="mainViewContainer" class="panel-mainview" xbl:inherits="viewtype"/>
 
           <!-- Used to capture click events over the PanelUI-mainView if we're in
                subview mode. That way, any click on the PanelUI-mainView causes us
                to revert to the mainView mode, whereupon PanelUI-click-capture then
                allows click events to go through it. -->
           <xul:vbox anonid="clickCapturer" class="panel-clickcapturer"/>
@@ -32,28 +32,28 @@
                subviews that are not being displayed. We're using this over a deck
                because a deck assumes the size of its largest child, regardless of
                whether or not it is shown. That's not good for our case, since we
                want to allow each subview to be uniquely sized. -->
           <xul:vbox anonid="subViews" class="panel-subviews" xbl:inherits="panelopen">
             <children includes="panelview"/>
           </xul:vbox>
         </xul:stack>
-      </xul:box>
+      </xul:vbox>
     </content>
     <implementation>
       <constructor><![CDATA[
         const {PanelMultiView} = Components.utils.import("resource:///modules/PanelMultiView.jsm", {});
         this.instance = new PanelMultiView(this);
-       ]]></constructor>
- 
-       <destructor><![CDATA[
+      ]]></constructor>
+
+      <destructor><![CDATA[
         this.instance.destructor();
-       ]]></destructor>
-     </implementation>
+      ]]></destructor>
+    </implementation>
   </binding>
 
   <binding id="photonpanelmultiview" extends="chrome://browser/content/customizableui/panelUI.xml#panelmultiview">
     <content>
       <xul:box anonid="viewContainer" class="panel-viewcontainer" xbl:inherits="panelopen,transitioning">
         <xul:stack anonid="viewStack" xbl:inherits="transitioning" class="panel-viewstack">
           <children includes="panelview"/>
         </xul:stack>
--- a/browser/components/downloads/content/downloads.js
+++ b/browser/components/downloads/content/downloads.js
@@ -298,30 +298,16 @@ const DownloadsPanel = {
         this.keyFocusing = false;
         break;
       case "keydown":
         this._onKeyDown(aEvent);
         break;
       case "keypress":
         this._onKeyPress(aEvent);
         break;
-      case "popupshown":
-        if (this.setHeightToFitOnShow) {
-          this.setHeightToFitOnShow = false;
-          this.setHeightToFit();
-        }
-        break;
-    }
-  },
-
-  setHeightToFit() {
-    if (this._state == this.kStateShown) {
-      DownloadsBlockedSubview.view.setHeightToFit();
-    } else {
-      this.setHeightToFitOnShow = true;
     }
   },
 
   // Callback functions from DownloadsView
 
   /**
    * Called after data loading finished.
    */
@@ -401,28 +387,25 @@ const DownloadsPanel = {
    * panel has successfully loaded.
    */
   _attachEventListeners() {
     // Handle keydown to support accel-V.
     this.panel.addEventListener("keydown", this);
     // Handle keypress to be able to preventDefault() events before they reach
     // the richlistbox, for keyboard navigation.
     this.panel.addEventListener("keypress", this);
-    // Handle height adjustment on show.
-    this.panel.addEventListener("popupshown", this);
   },
 
   /**
    * Unattach event listeners that were added in _attachEventListeners. This
    * is called automatically on panel termination.
    */
   _unattachEventListeners() {
     this.panel.removeEventListener("keydown", this);
     this.panel.removeEventListener("keypress", this);
-    this.panel.removeEventListener("popupshown", this);
   },
 
   _onKeyPress(aEvent) {
     // Handle unmodified keys only.
     if (aEvent.altKey || aEvent.ctrlKey || aEvent.shiftKey || aEvent.metaKey) {
       return;
     }
 
@@ -853,19 +836,16 @@ const DownloadsView = {
       this._removeViewItem(download);
       if (this._downloads.length >= this.kItemCountLimit) {
         // Reinsert the next item into the panel.
         this._addViewItem(this._downloads[this.kItemCountLimit - 1], false);
       }
     }
 
     this._itemCountChanged();
-
-    // Adjust the panel height if we removed items.
-    DownloadsPanel.setHeightToFit();
   },
 
   /**
    * Associates each richlistitem for a download with its corresponding
    * DownloadsViewItem object.
    */
   _itemsForElements: new Map(),
 
@@ -1540,20 +1520,16 @@ const DownloadsFooter = {
    */
   set showingSummary(aValue) {
     if (this._footerNode) {
       if (aValue) {
         this._footerNode.setAttribute("showingsummary", "true");
       } else {
         this._footerNode.removeAttribute("showingsummary");
       }
-      if (!aValue && this._showingSummary) {
-        // Make sure the panel's height shrinks when the summary is hidden.
-        DownloadsPanel.setHeightToFit();
-      }
       this._showingSummary = aValue;
     }
     return aValue;
   },
 
   /**
    * Element corresponding to the footer of the downloads panel.
    */
--- a/browser/components/downloads/content/downloadsOverlay.xul
+++ b/browser/components/downloads/content/downloadsOverlay.xul
@@ -103,32 +103,30 @@
                   accesskey="&cmd.removeFromHistory.accesskey;"/>
         <menuitem command="downloadsCmd_clearList"
                   label="&cmd.clearList2.label;"
                   accesskey="&cmd.clearList2.accesskey;"/>
       </menupopup>
 
       <panelmultiview id="downloadsPanel-multiView"
                       mainViewId="downloadsPanel-mainView"
-                      align="stretch">
+                      descriptionheightworkaround="true">
 
-        <panelview id="downloadsPanel-mainView"
-                   flex="1"
-                   align="stretch">
-          <richlistbox id="downloadsListBox"
-                       context="downloadsContextMenu"
-                       onmouseover="DownloadsView.onDownloadMouseOver(event);"
-                       onmouseout="DownloadsView.onDownloadMouseOut(event);"
-                       oncontextmenu="DownloadsView.onDownloadContextMenu(event);"
-                       ondragstart="DownloadsView.onDownloadDragStart(event);"/>
-          <description id="emptyDownloads"
-                       mousethrough="always">
-             &downloadsPanelEmpty.label;
-          </description>
-          <spacer flex="1"/>
+        <panelview id="downloadsPanel-mainView">
+          <vbox class="panel-view-body-unscrollable">
+            <richlistbox id="downloadsListBox"
+                         context="downloadsContextMenu"
+                         onmouseover="DownloadsView.onDownloadMouseOver(event);"
+                         onmouseout="DownloadsView.onDownloadMouseOut(event);"
+                         oncontextmenu="DownloadsView.onDownloadContextMenu(event);"
+                         ondragstart="DownloadsView.onDownloadDragStart(event);"/>
+            <description id="emptyDownloads"
+                         mousethrough="always"
+                         value="&downloadsPanelEmpty.label;"/>
+          </vbox>
           <vbox id="downloadsFooter"
                 class="downloadsPanelFooter">
             <stack>
               <hbox id="downloadsSummary"
                     align="center"
                     orient="horizontal"
                     onkeydown="DownloadsSummary.onKeyDown(event);"
                     onclick="DownloadsSummary.onClick(event);">
@@ -154,23 +152,22 @@
                         accesskey="&downloadsHistory.accesskey;"
                         flex="1"
                         oncommand="DownloadsPanel.showDownloadsHistory();"/>
               </hbox>
             </stack>
           </vbox>
         </panelview>
 
-        <panelview id="downloadsPanel-blockedSubview"
-                   orient="vertical"
-                   flex="1">
-          <description id="downloadsPanel-blockedSubview-title"/>
-          <description id="downloadsPanel-blockedSubview-details1"/>
-          <description id="downloadsPanel-blockedSubview-details2"/>
-          <spacer flex="1"/>
+        <panelview id="downloadsPanel-blockedSubview">
+          <vbox class="panel-view-body-unscrollable">
+            <description id="downloadsPanel-blockedSubview-title"/>
+            <description id="downloadsPanel-blockedSubview-details1"/>
+            <description id="downloadsPanel-blockedSubview-details2"/>
+          </vbox>
           <hbox id="downloadsPanel-blockedSubview-buttons"
                 class="downloadsPanelFooter"
                 align="stretch">
             <button id="downloadsPanel-blockedSubview-openButton"
                     class="downloadsPanelFooterButton"
                     command="downloadsCmd_unblockAndOpen"
                     flex="1"/>
             <toolbarseparator/>
--- a/browser/themes/shared/customizableui/panelUI.inc.css
+++ b/browser/themes/shared/customizableui/panelUI.inc.css
@@ -193,26 +193,32 @@
 .panel-viewstack[viewtype="main"] > .panel-subviews:-moz-locale-dir(rtl) {
   transform: translateX(-@menuPanelWidth@);
 }
 
 panelmultiview[nosubviews=true] > .panel-viewcontainer > .panel-viewstack > .panel-subviews {
   display: none;
 }
 
-.panel-viewstack:not([viewtype="main"]) > .panel-mainview > #PanelUI-mainView {
+panelview {
+  -moz-box-orient: vertical;
   -moz-box-flex: 1;
 }
 
 .panel-subview-body {
   overflow-y: auto;
   overflow-x: hidden;
   -moz-box-flex: 1;
 }
 
+.panel-view-body-unscrollable {
+  overflow: hidden;
+  -moz-box-flex: 1;
+}
+
 #PanelUI-popup .panel-subview-body {
   margin: -4px;
   padding: 4px 4px;
 }
 
 .panel-subview-header,
 .subviewbutton.panel-subview-footer {
   box-sizing: border-box;
@@ -220,16 +226,18 @@ panelmultiview[nosubviews=true] > .panel
   padding: 11px 12px;
 }
 
 .panel-subview-header {
   margin: -4px -4px 4px;
   border-bottom: 1px solid var(--panel-separator-color);
   color: GrayText;
   font-variant: small-caps;
+  /* Workaround for min-height not being accounted for in vertical layout. */
+  height: 41px;
 }
 
 .cui-widget-panelview .panel-subview-header,
 photonpanelmultiview .panel-subview-header {
   display: none;
 }
 
 .cui-widget-panelview .subviewbutton.panel-subview-footer {
--- a/browser/themes/shared/downloads/downloads.inc.css
+++ b/browser/themes/shared/downloads/downloads.inc.css
@@ -10,17 +10,16 @@
 %define itemFinished @item@[state="1"]
 %define itemNotFinished @item@:not([state="1"])
 %define itemFocused #downloadsListBox:focus > @item@[selected]
 
 /*** Panel and outer controls ***/
 
 #downloadsPanel > .panel-arrowcontainer > .panel-arrowcontent {
   overflow: hidden;
-  display: block;
 }
 
 #downloadsPanel > .panel-arrowcontainer > .panel-arrowcontent,
 #downloadsPanel-multiView > .panel-viewcontainer > .panel-viewstack > .panel-subviews {
   padding: 0;
 }
 
 #downloadsListBox {
--- a/db/sqlite3/src/sqlite3.c
+++ b/db/sqlite3/src/sqlite3.c
@@ -1,11 +1,11 @@
 /******************************************************************************
 ** This file is an amalgamation of many separate C source files from SQLite
-** version 3.18.0.  By combining all the individual C code files into this
+** version 3.19.1.  By combining all the individual C code files into this
 ** single large file, the entire code can be compiled as a single translation
 ** unit.  This allows many compilers to do optimizations that would not be
 ** possible if the files were compiled separately.  Performance improvements
 ** of 5% or more are commonly seen when SQLite is compiled as a single
 ** translation unit.
 **
 ** This file is all you need to compile SQLite.  To use SQLite in other
 ** programs, you need this file and the "sqlite3.h" header file that defines
@@ -393,19 +393,19 @@ extern "C" {
 ** within its configuration management system.  ^The SQLITE_SOURCE_ID
 ** string contains the date and time of the check-in (UTC) and a SHA1
 ** or SHA3-256 hash of the entire source tree.
 **
 ** See also: [sqlite3_libversion()],
 ** [sqlite3_libversion_number()], [sqlite3_sourceid()],
 ** [sqlite_version()] and [sqlite_source_id()].
 */
-#define SQLITE_VERSION        "3.18.0"
-#define SQLITE_VERSION_NUMBER 3018000
-#define SQLITE_SOURCE_ID      "2017-03-28 18:48:43 424a0d380332858ee55bdebc4af3789f74e70a2b3ba1cf29d84b9b4bcf3e2e37"
+#define SQLITE_VERSION        "3.19.1"
+#define SQLITE_VERSION_NUMBER 3019001
+#define SQLITE_SOURCE_ID      "2017-05-24 13:08:33 f6d7b988f40217821a382bc298180e9e6794f3ed79a83c6ef5cae048989b3f86"
 
 /*
 ** CAPI3REF: Run-Time Library Version Numbers
 ** KEYWORDS: sqlite3_version sqlite3_sourceid
 **
 ** These interfaces provide the same information as the [SQLITE_VERSION],
 ** [SQLITE_VERSION_NUMBER], and [SQLITE_SOURCE_ID] C preprocessor macros
 ** but are associated with the library instead of the header file.  ^(Cautious
@@ -1129,17 +1129,17 @@ struct sqlite3_io_methods {
 ** windows [VFS] in order to provide robustness in the presence of
 ** anti-virus programs.  By default, the windows VFS will retry file read,
 ** file write, and file delete operations up to 10 times, with a delay
 ** of 25 milliseconds before the first retry and with the delay increasing
 ** by an additional 25 milliseconds with each subsequent retry.  This
 ** opcode allows these two values (10 retries and 25 milliseconds of delay)
 ** to be adjusted.  The values are changed for all database connections
 ** within the same process.  The argument is a pointer to an array of two
-** integers where the first integer i the new retry count and the second
+** integers where the first integer is the new retry count and the second
 ** integer is the delay.  If either integer is negative, then the setting
 ** is not changed but instead the prior value of that setting is written
 ** into the array entry, allowing the current retry settings to be
 ** interrogated.  The zDbName parameter is ignored.
 **
 ** <li>[[SQLITE_FCNTL_PERSIST_WAL]]
 ** ^The [SQLITE_FCNTL_PERSIST_WAL] opcode is used to set or query the
 ** persistent [WAL | Write Ahead Log] setting.  By default, the auxiliary
@@ -2483,19 +2483,16 @@ SQLITE_API int sqlite3_total_changes(sql
 ** that are started after the sqlite3_interrupt() call and before the 
 ** running statements reaches zero are interrupted as if they had been
 ** running prior to the sqlite3_interrupt() call.  ^New SQL statements
 ** that are started after the running statement count reaches zero are
 ** not effected by the sqlite3_interrupt().
 ** ^A call to sqlite3_interrupt(D) that occurs when there are no running
 ** SQL statements is a no-op and has no effect on SQL statements
 ** that are started after the sqlite3_interrupt() call returns.
-**
-** If the database connection closes while [sqlite3_interrupt()]
-** is running then bad things will likely happen.
 */
 SQLITE_API void sqlite3_interrupt(sqlite3*);
 
 /*
 ** CAPI3REF: Determine If An SQL Statement Is Complete
 **
 ** These routines are useful during command-line input to determine if the
 ** currently entered text seems to form a complete SQL statement or
@@ -2948,16 +2945,17 @@ SQLITE_API sqlite3_int64 sqlite3_memory_
 ** internally and without recourse to the [sqlite3_vfs] xRandomness
 ** method.
 */
 SQLITE_API void sqlite3_randomness(int N, void *P);
 
 /*
 ** CAPI3REF: Compile-Time Authorization Callbacks
 ** METHOD: sqlite3
+** KEYWORDS: {authorizer callback}
 **
 ** ^This routine registers an authorizer callback with a particular
 ** [database connection], supplied in the first argument.
 ** ^The authorizer callback is invoked as SQL statements are being compiled
 ** by [sqlite3_prepare()] or its variants [sqlite3_prepare_v2()],
 ** [sqlite3_prepare16()] and [sqlite3_prepare16_v2()].  ^At various
 ** points during the compilation process, as logic is being created
 ** to perform various actions, the authorizer callback is invoked to
@@ -2975,26 +2973,32 @@ SQLITE_API void sqlite3_randomness(int N
 ** [sqlite3_prepare_v2()] or equivalent call that triggered the
 ** authorizer will fail with an error message explaining that
 ** access is denied. 
 **
 ** ^The first parameter to the authorizer callback is a copy of the third
 ** parameter to the sqlite3_set_authorizer() interface. ^The second parameter
 ** to the callback is an integer [SQLITE_COPY | action code] that specifies
 ** the particular action to be authorized. ^The third through sixth parameters
-** to the callback are zero-terminated strings that contain additional
-** details about the action to be authorized.
+** to the callback are either NULL pointers or zero-terminated strings
+** that contain additional details about the action to be authorized.
+** Applications must always be prepared to encounter a NULL pointer in any
+** of the third through the sixth parameters of the authorization callback.
 **
 ** ^If the action code is [SQLITE_READ]
 ** and the callback returns [SQLITE_IGNORE] then the
 ** [prepared statement] statement is constructed to substitute
 ** a NULL value in place of the table column that would have
 ** been read if [SQLITE_OK] had been returned.  The [SQLITE_IGNORE]
 ** return can be used to deny an untrusted user access to individual
 ** columns of a table.
+** ^When a table is referenced by a [SELECT] but no column values are
+** extracted from that table (for example in a query like
+** "SELECT count(*) FROM tab") then the [SQLITE_READ] authorizer callback
+** is invoked once for that table with a column name that is an empty string.
 ** ^If the action code is [SQLITE_DELETE] and the callback returns
 ** [SQLITE_IGNORE] then the [DELETE] operation proceeds but the
 ** [truncate optimization] is disabled and all rows are deleted individually.
 **
 ** An authorizer is used when [sqlite3_prepare | preparing]
 ** SQL statements from an untrusted source, to ensure that the SQL statements
 ** do not try to access data they are not allowed to see, or that they do not
 ** try to execute malicious statements that damage the database.  For
@@ -3977,17 +3981,17 @@ SQLITE_API int sqlite3_stmt_busy(sqlite3
 ** implementation of [application-defined SQL functions] are protected.
 ** ^The sqlite3_value object returned by
 ** [sqlite3_column_value()] is unprotected.
 ** Unprotected sqlite3_value objects may only be used with
 ** [sqlite3_result_value()] and [sqlite3_bind_value()].
 ** The [sqlite3_value_blob | sqlite3_value_type()] family of
 ** interfaces require protected sqlite3_value objects.
 */
-typedef struct Mem sqlite3_value;
+typedef struct sqlite3_value sqlite3_value;
 
 /*
 ** CAPI3REF: SQL Function Context Object
 **
 ** The context in which an SQL function executes is stored in an
 ** sqlite3_context object.  ^A pointer to an sqlite3_context object
 ** is always first parameter to [application-defined SQL functions].
 ** The application-defined SQL function implementation will pass this
@@ -5031,20 +5035,21 @@ SQLITE_API sqlite3 *sqlite3_context_db_h
 ** some circumstances the associated metadata may be preserved.  An example
 ** of where this might be useful is in a regular-expression matching
 ** function. The compiled version of the regular expression can be stored as
 ** metadata associated with the pattern string.  
 ** Then as long as the pattern string remains the same,
 ** the compiled regular expression can be reused on multiple
 ** invocations of the same function.
 **
-** ^The sqlite3_get_auxdata() interface returns a pointer to the metadata
-** associated by the sqlite3_set_auxdata() function with the Nth argument
-** value to the application-defined function. ^If there is no metadata
-** associated with the function argument, this sqlite3_get_auxdata() interface
+** ^The sqlite3_get_auxdata(C,N) interface returns a pointer to the metadata
+** associated by the sqlite3_set_auxdata(C,N,P,X) function with the Nth argument
+** value to the application-defined function.  ^N is zero for the left-most
+** function argument.  ^If there is no metadata
+** associated with the function argument, the sqlite3_get_auxdata(C,N) interface
 ** returns a NULL pointer.
 **
 ** ^The sqlite3_set_auxdata(C,N,P,X) interface saves P as metadata for the N-th
 ** argument of the application-defined function.  ^Subsequent
 ** calls to sqlite3_get_auxdata(C,N) return P from the most recent
 ** sqlite3_set_auxdata(C,N,P,X) call if the metadata is still valid or
 ** NULL if the metadata has been discarded.
 ** ^After each call to sqlite3_set_auxdata(C,N,P,X) where X is not NULL,
@@ -5065,16 +5070,20 @@ SQLITE_API sqlite3 *sqlite3_context_db_h
 ** should be called near the end of the function implementation and the
 ** function implementation should not make any use of P after
 ** sqlite3_set_auxdata() has been called.
 **
 ** ^(In practice, metadata is preserved between function calls for
 ** function parameters that are compile-time constants, including literal
 ** values and [parameters] and expressions composed from the same.)^
 **
+** The value of the N parameter to these interfaces should be non-negative.
+** Future enhancements may make use of negative N values to define new
+** kinds of function caching behavior.
+**
 ** These routines must be called from the same thread in which
 ** the SQL function is running.
 */
 SQLITE_API void *sqlite3_get_auxdata(sqlite3_context*, int N);
 SQLITE_API void sqlite3_set_auxdata(sqlite3_context*, int N, void*, void (*)(void*));
 
 
 /*
@@ -9659,17 +9668,17 @@ typedef struct sqlite3_changegroup sqlit
 **
 ** Any number of calls to add() and output() may be made between the calls to
 ** new() and delete(), and in any order.
 **
 ** As well as the regular sqlite3changegroup_add() and 
 ** sqlite3changegroup_output() functions, also available are the streaming
 ** versions sqlite3changegroup_add_strm() and sqlite3changegroup_output_strm().
 */
-int sqlite3changegroup_new(sqlite3_changegroup **pp);
+SQLITE_API int sqlite3changegroup_new(sqlite3_changegroup **pp);
 
 /*
 ** CAPI3REF: Add A Changeset To A Changegroup
 **
 ** Add all changes within the changeset (or patchset) in buffer pData (size
 ** nData bytes) to the changegroup. 
 **
 ** If the buffer contains a patchset, then all prior calls to this function
@@ -9736,17 +9745,17 @@ int sqlite3changegroup_new(sqlite3_chang
 ** case, this function fails with SQLITE_SCHEMA. If the input changeset
 ** appears to be corrupt and the corruption is detected, SQLITE_CORRUPT is
 ** returned. Or, if an out-of-memory condition occurs during processing, this
 ** function returns SQLITE_NOMEM. In all cases, if an error occurs the
 ** final contents of the changegroup is undefined.
 **
 ** If no error occurs, SQLITE_OK is returned.
 */
-int sqlite3changegroup_add(sqlite3_changegroup*, int nData, void *pData);
+SQLITE_API int sqlite3changegroup_add(sqlite3_changegroup*, int nData, void *pData);
 
 /*
 ** CAPI3REF: Obtain A Composite Changeset From A Changegroup
 **
 ** Obtain a buffer containing a changeset (or patchset) representing the
 ** current contents of the changegroup. If the inputs to the changegroup
 ** were themselves changesets, the output is a changeset. Or, if the
 ** inputs were patchsets, the output is also a patchset.
@@ -9762,26 +9771,26 @@ int sqlite3changegroup_add(sqlite3_chang
 **
 ** If an error occurs, an SQLite error code is returned and the output
 ** variables (*pnData) and (*ppData) are set to 0. Otherwise, SQLITE_OK
 ** is returned and the output variables are set to the size of and a 
 ** pointer to the output buffer, respectively. In this case it is the
 ** responsibility of the caller to eventually free the buffer using a
 ** call to sqlite3_free().
 */
-int sqlite3changegroup_output(
+SQLITE_API int sqlite3changegroup_output(
   sqlite3_changegroup*,
   int *pnData,                    /* OUT: Size of output buffer in bytes */
   void **ppData                   /* OUT: Pointer to output buffer */
 );
 
 /*
 ** CAPI3REF: Delete A Changegroup Object
 */
-void sqlite3changegroup_delete(sqlite3_changegroup*);
+SQLITE_API void sqlite3changegroup_delete(sqlite3_changegroup*);
 
 /*
 ** CAPI3REF: Apply A Changeset To A Database
 **
 ** Apply a changeset to a database. This function attempts to update the
 ** "main" database attached to handle db with the changes found in the
 ** changeset passed via the second and third arguments.
 **
@@ -10160,21 +10169,21 @@ SQLITE_API int sqlite3session_changeset_
   int (*xOutput)(void *pOut, const void *pData, int nData),
   void *pOut
 );
 SQLITE_API int sqlite3session_patchset_strm(
   sqlite3_session *pSession,
   int (*xOutput)(void *pOut, const void *pData, int nData),
   void *pOut
 );
-int sqlite3changegroup_add_strm(sqlite3_changegroup*, 
+SQLITE_API int sqlite3changegroup_add_strm(sqlite3_changegroup*, 
     int (*xInput)(void *pIn, void *pData, int *pnData),
     void *pIn
 );
-int sqlite3changegroup_output_strm(sqlite3_changegroup*,
+SQLITE_API int sqlite3changegroup_output_strm(sqlite3_changegroup*,
     int (*xOutput)(void *pOut, const void *pData, int nData), 
     void *pOut
 );
 
 
 /*
 ** Make sure we can call this stuff from C++.
 */
@@ -11448,86 +11457,86 @@ SQLITE_PRIVATE void sqlite3HashClear(Has
 #define TK_NOT                             19
 #define TK_EXISTS                          20
 #define TK_TEMP                            21
 #define TK_LP                              22
 #define TK_RP                              23
 #define TK_AS                              24
 #define TK_WITHOUT                         25
 #define TK_COMMA                           26
-#define TK_OR                              27
-#define TK_AND                             28
-#define TK_IS                              29
-#define TK_MATCH                           30
-#define TK_LIKE_KW                         31
-#define TK_BETWEEN                         32
-#define TK_IN                              33
-#define TK_ISNULL                          34
-#define TK_NOTNULL                         35
-#define TK_NE                              36
-#define TK_EQ                              37
-#define TK_GT                              38
-#define TK_LE                              39
-#define TK_LT                              40
-#define TK_GE                              41
-#define TK_ESCAPE                          42
-#define TK_BITAND                          43
-#define TK_BITOR                           44
-#define TK_LSHIFT                          45
-#define TK_RSHIFT                          46
-#define TK_PLUS                            47
-#define TK_MINUS                           48
-#define TK_STAR                            49
-#define TK_SLASH                           50
-#define TK_REM                             51
-#define TK_CONCAT                          52
-#define TK_COLLATE                         53
-#define TK_BITNOT                          54
-#define TK_ID                              55
-#define TK_INDEXED                         56
-#define TK_ABORT                           57
-#define TK_ACTION                          58
-#define TK_AFTER                           59
-#define TK_ANALYZE                         60
-#define TK_ASC                             61
-#define TK_ATTACH                          62
-#define TK_BEFORE                          63
-#define TK_BY                              64
-#define TK_CASCADE                         65
-#define TK_CAST                            66
-#define TK_COLUMNKW                        67
-#define TK_CONFLICT                        68
-#define TK_DATABASE                        69
-#define TK_DESC                            70
-#define TK_DETACH                          71
-#define TK_EACH                            72
-#define TK_FAIL                            73
-#define TK_FOR                             74
-#define TK_IGNORE                          75
-#define TK_INITIALLY                       76
-#define TK_INSTEAD                         77
-#define TK_NO                              78
-#define TK_KEY                             79
-#define TK_OF                              80
-#define TK_OFFSET                          81
-#define TK_PRAGMA                          82
-#define TK_RAISE                           83
-#define TK_RECURSIVE                       84
-#define TK_REPLACE                         85
-#define TK_RESTRICT                        86
-#define TK_ROW                             87
-#define TK_TRIGGER                         88
-#define TK_VACUUM                          89
-#define TK_VIEW                            90
-#define TK_VIRTUAL                         91
-#define TK_WITH                            92
-#define TK_REINDEX                         93
-#define TK_RENAME                          94
-#define TK_CTIME_KW                        95
-#define TK_ANY                             96
+#define TK_ID                              27
+#define TK_ABORT                           28
+#define TK_ACTION                          29
+#define TK_AFTER                           30
+#define TK_ANALYZE                         31
+#define TK_ASC                             32
+#define TK_ATTACH                          33
+#define TK_BEFORE                          34
+#define TK_BY                              35
+#define TK_CASCADE                         36
+#define TK_CAST                            37
+#define TK_COLUMNKW                        38
+#define TK_CONFLICT                        39
+#define TK_DATABASE                        40
+#define TK_DESC                            41
+#define TK_DETACH                          42
+#define TK_EACH                            43
+#define TK_FAIL                            44
+#define TK_FOR                             45
+#define TK_IGNORE                          46
+#define TK_INITIALLY                       47
+#define TK_INSTEAD                         48
+#define TK_LIKE_KW                         49
+#define TK_MATCH                           50
+#define TK_NO                              51
+#define TK_KEY                             52
+#define TK_OF                              53
+#define TK_OFFSET                          54
+#define TK_PRAGMA                          55
+#define TK_RAISE                           56
+#define TK_RECURSIVE                       57
+#define TK_REPLACE                         58
+#define TK_RESTRICT                        59
+#define TK_ROW                             60
+#define TK_TRIGGER                         61
+#define TK_VACUUM                          62
+#define TK_VIEW                            63
+#define TK_VIRTUAL                         64
+#define TK_WITH                            65
+#define TK_REINDEX                         66
+#define TK_RENAME                          67
+#define TK_CTIME_KW                        68
+#define TK_ANY                             69
+#define TK_OR                              70
+#define TK_AND                             71
+#define TK_IS                              72
+#define TK_BETWEEN                         73
+#define TK_IN                              74
+#define TK_ISNULL                          75
+#define TK_NOTNULL                         76
+#define TK_NE                              77
+#define TK_EQ                              78
+#define TK_GT                              79
+#define TK_LE                              80
+#define TK_LT                              81
+#define TK_GE                              82
+#define TK_ESCAPE                          83
+#define TK_BITAND                          84
+#define TK_BITOR                           85
+#define TK_LSHIFT                          86
+#define TK_RSHIFT                          87
+#define TK_PLUS                            88
+#define TK_MINUS                           89
+#define TK_STAR                            90
+#define TK_SLASH                           91
+#define TK_REM                             92
+#define TK_CONCAT                          93
+#define TK_COLLATE                         94
+#define TK_BITNOT                          95
+#define TK_INDEXED                         96
 #define TK_STRING                          97
 #define TK_JOIN_KW                         98
 #define TK_CONSTRAINT                      99
 #define TK_DEFAULT                        100
 #define TK_NULL                           101
 #define TK_PRIMARY                        102
 #define TK_UNIQUE                         103
 #define TK_CHECK                          104
@@ -11581,20 +11590,21 @@ SQLITE_PRIVATE void sqlite3HashClear(Has
 #define TK_COLUMN                         152
 #define TK_AGG_FUNCTION                   153
 #define TK_AGG_COLUMN                     154
 #define TK_UMINUS                         155
 #define TK_UPLUS                          156
 #define TK_REGISTER                       157
 #define TK_VECTOR                         158
 #define TK_SELECT_COLUMN                  159
-#define TK_ASTERISK                       160
-#define TK_SPAN                           161
-#define TK_SPACE                          162
-#define TK_ILLEGAL                        163
+#define TK_IF_NULL_ROW                    160
+#define TK_ASTERISK                       161
+#define TK_SPAN                           162
+#define TK_SPACE                          163
+#define TK_ILLEGAL                        164
 
 /* The token codes above must all fit in 8 bits */
 #define TKFLG_MASK           0xff  
 
 /* Flags that can be added to a token code when it is not
 ** being stored in a u8: */
 #define TKFLG_DONTFOLD       0x100  /* Omit constant folding optimizations */
 
@@ -12455,17 +12465,17 @@ SQLITE_PRIVATE int sqlite3BtreeDelete(Bt
 ** the information into this object helps to keep the interface more 
 ** organized and understandable, and it also helps the resulting code to
 ** run a little faster by using fewer registers for parameter passing.
 */
 struct BtreePayload {
   const void *pKey;       /* Key content for indexes.  NULL for tables */
   sqlite3_int64 nKey;     /* Size of pKey for indexes.  PRIMARY KEY for tabs */
   const void *pData;      /* Data for tables.  NULL for indexes */
-  struct Mem *aMem;       /* First of nMem value in the unpacked pKey */
+  sqlite3_value *aMem;    /* First of nMem value in the unpacked pKey */
   u16 nMem;               /* Number of aMem[] value.  Might be zero */
   int nData;              /* Size of pData.  0 if none. */
   int nZero;              /* Extra zero data appended after pData,nData */
 };
 
 SQLITE_PRIVATE int sqlite3BtreeInsert(BtCursor*, const BtreePayload *pPayload,
                        int flags, int seekResult);
 SQLITE_PRIVATE int sqlite3BtreeFirst(BtCursor*, int *pRes);
@@ -12585,17 +12595,17 @@ SQLITE_PRIVATE   int sqlite3SchemaMutexH
 ** of this structure.
 */
 typedef struct Vdbe Vdbe;
 
 /*
 ** The names of the following types declared in vdbeInt.h are required
 ** for the VdbeOp definition.
 */
-typedef struct Mem Mem;
+typedef struct sqlite3_value Mem;
 typedef struct SubProgram SubProgram;
 
 /*
 ** A single instruction of the virtual machine has an opcode
 ** and as many as three operands.  The instruction is recorded
 ** as an instance of the following structure:
 */
 struct VdbeOp {
@@ -12745,198 +12755,200 @@ typedef struct VdbeOpList VdbeOpList;
 #define OP_InitCoroutine  15
 #define OP_Yield          16
 #define OP_MustBeInt      17
 #define OP_Jump           18
 #define OP_Not            19 /* same as TK_NOT, synopsis: r[P2]= !r[P1]    */
 #define OP_Once           20
 #define OP_If             21
 #define OP_IfNot          22
-#define OP_SeekLT         23 /* synopsis: key=r[P3@P4]                     */
-#define OP_SeekLE         24 /* synopsis: key=r[P3@P4]                     */
-#define OP_SeekGE         25 /* synopsis: key=r[P3@P4]                     */
-#define OP_SeekGT         26 /* synopsis: key=r[P3@P4]                     */
-#define OP_Or             27 /* same as TK_OR, synopsis: r[P3]=(r[P1] || r[P2]) */
-#define OP_And            28 /* same as TK_AND, synopsis: r[P3]=(r[P1] && r[P2]) */
-#define OP_NoConflict     29 /* synopsis: key=r[P3@P4]                     */
-#define OP_NotFound       30 /* synopsis: key=r[P3@P4]                     */
-#define OP_Found          31 /* synopsis: key=r[P3@P4]                     */
-#define OP_SeekRowid      32 /* synopsis: intkey=r[P3]                     */
-#define OP_NotExists      33 /* synopsis: intkey=r[P3]                     */
-#define OP_IsNull         34 /* same as TK_ISNULL, synopsis: if r[P1]==NULL goto P2 */
-#define OP_NotNull        35 /* same as TK_NOTNULL, synopsis: if r[P1]!=NULL goto P2 */
-#define OP_Ne             36 /* same as TK_NE, synopsis: IF r[P3]!=r[P1]   */
-#define OP_Eq             37 /* same as TK_EQ, synopsis: IF r[P3]==r[P1]   */
-#define OP_Gt             38 /* same as TK_GT, synopsis: IF r[P3]>r[P1]    */
-#define OP_Le             39 /* same as TK_LE, synopsis: IF r[P3]<=r[P1]   */
-#define OP_Lt             40 /* same as TK_LT, synopsis: IF r[P3]<r[P1]    */
-#define OP_Ge             41 /* same as TK_GE, synopsis: IF r[P3]>=r[P1]   */
-#define OP_ElseNotEq      42 /* same as TK_ESCAPE                          */
-#define OP_BitAnd         43 /* same as TK_BITAND, synopsis: r[P3]=r[P1]&r[P2] */
-#define OP_BitOr          44 /* same as TK_BITOR, synopsis: r[P3]=r[P1]|r[P2] */
-#define OP_ShiftLeft      45 /* same as TK_LSHIFT, synopsis: r[P3]=r[P2]<<r[P1] */
-#define OP_ShiftRight     46 /* same as TK_RSHIFT, synopsis: r[P3]=r[P2]>>r[P1] */
-#define OP_Add            47 /* same as TK_PLUS, synopsis: r[P3]=r[P1]+r[P2] */
-#define OP_Subtract       48 /* same as TK_MINUS, synopsis: r[P3]=r[P2]-r[P1] */
-#define OP_Multiply       49 /* same as TK_STAR, synopsis: r[P3]=r[P1]*r[P2] */
-#define OP_Divide         50 /* same as TK_SLASH, synopsis: r[P3]=r[P2]/r[P1] */
-#define OP_Remainder      51 /* same as TK_REM, synopsis: r[P3]=r[P2]%r[P1] */
-#define OP_Concat         52 /* same as TK_CONCAT, synopsis: r[P3]=r[P2]+r[P1] */
-#define OP_Last           53
-#define OP_BitNot         54 /* same as TK_BITNOT, synopsis: r[P1]= ~r[P1] */
-#define OP_IfSmaller      55
-#define OP_SorterSort     56
-#define OP_Sort           57
-#define OP_Rewind         58
-#define OP_IdxLE          59 /* synopsis: key=r[P3@P4]                     */
-#define OP_IdxGT          60 /* synopsis: key=r[P3@P4]                     */
-#define OP_IdxLT          61 /* synopsis: key=r[P3@P4]                     */
-#define OP_IdxGE          62 /* synopsis: key=r[P3@P4]                     */
-#define OP_RowSetRead     63 /* synopsis: r[P3]=rowset(P1)                 */
-#define OP_RowSetTest     64 /* synopsis: if r[P3] in rowset(P1) goto P2   */
-#define OP_Program        65
-#define OP_FkIfZero       66 /* synopsis: if fkctr[P1]==0 goto P2          */
-#define OP_IfPos          67 /* synopsis: if r[P1]>0 then r[P1]-=P3, goto P2 */
-#define OP_IfNotZero      68 /* synopsis: if r[P1]!=0 then r[P1]--, goto P2 */
-#define OP_DecrJumpZero   69 /* synopsis: if (--r[P1])==0 goto P2          */
-#define OP_IncrVacuum     70
-#define OP_VNext          71
-#define OP_Init           72 /* synopsis: Start at P2                      */
-#define OP_Return         73
-#define OP_EndCoroutine   74
-#define OP_HaltIfNull     75 /* synopsis: if r[P3]=null halt               */
-#define OP_Halt           76
-#define OP_Integer        77 /* synopsis: r[P2]=P1                         */
-#define OP_Int64          78 /* synopsis: r[P2]=P4                         */
-#define OP_String         79 /* synopsis: r[P2]='P4' (len=P1)              */
-#define OP_Null           80 /* synopsis: r[P2..P3]=NULL                   */
-#define OP_SoftNull       81 /* synopsis: r[P1]=NULL                       */
-#define OP_Blob           82 /* synopsis: r[P2]=P4 (len=P1)                */
-#define OP_Variable       83 /* synopsis: r[P2]=parameter(P1,P4)           */
-#define OP_Move           84 /* synopsis: r[P2@P3]=r[P1@P3]                */
-#define OP_Copy           85 /* synopsis: r[P2@P3+1]=r[P1@P3+1]            */
-#define OP_SCopy          86 /* synopsis: r[P2]=r[P1]                      */
-#define OP_IntCopy        87 /* synopsis: r[P2]=r[P1]                      */
-#define OP_ResultRow      88 /* synopsis: output=r[P1@P2]                  */
-#define OP_CollSeq        89
-#define OP_Function0      90 /* synopsis: r[P3]=func(r[P2@P5])             */
-#define OP_Function       91 /* synopsis: r[P3]=func(r[P2@P5])             */
-#define OP_AddImm         92 /* synopsis: r[P1]=r[P1]+P2                   */
-#define OP_RealAffinity   93
+#define OP_IfNullRow      23 /* synopsis: if P1.nullRow then r[P3]=NULL, goto P2 */
+#define OP_SeekLT         24 /* synopsis: key=r[P3@P4]                     */
+#define OP_SeekLE         25 /* synopsis: key=r[P3@P4]                     */
+#define OP_SeekGE         26 /* synopsis: key=r[P3@P4]                     */
+#define OP_SeekGT         27 /* synopsis: key=r[P3@P4]                     */
+#define OP_NoConflict     28 /* synopsis: key=r[P3@P4]                     */
+#define OP_NotFound       29 /* synopsis: key=r[P3@P4]                     */
+#define OP_Found          30 /* synopsis: key=r[P3@P4]                     */
+#define OP_SeekRowid      31 /* synopsis: intkey=r[P3]                     */
+#define OP_NotExists      32 /* synopsis: intkey=r[P3]                     */
+#define OP_Last           33
+#define OP_IfSmaller      34
+#define OP_SorterSort     35
+#define OP_Sort           36
+#define OP_Rewind         37
+#define OP_IdxLE          38 /* synopsis: key=r[P3@P4]                     */
+#define OP_IdxGT          39 /* synopsis: key=r[P3@P4]                     */
+#define OP_IdxLT          40 /* synopsis: key=r[P3@P4]                     */
+#define OP_IdxGE          41 /* synopsis: key=r[P3@P4]                     */
+#define OP_RowSetRead     42 /* synopsis: r[P3]=rowset(P1)                 */
+#define OP_RowSetTest     43 /* synopsis: if r[P3] in rowset(P1) goto P2   */
+#define OP_Program        44
+#define OP_FkIfZero       45 /* synopsis: if fkctr[P1]==0 goto P2          */
+#define OP_IfPos          46 /* synopsis: if r[P1]>0 then r[P1]-=P3, goto P2 */
+#define OP_IfNotZero      47 /* synopsis: if r[P1]!=0 then r[P1]--, goto P2 */
+#define OP_DecrJumpZero   48 /* synopsis: if (--r[P1])==0 goto P2          */
+#define OP_IncrVacuum     49
+#define OP_VNext          50
+#define OP_Init           51 /* synopsis: Start at P2                      */
+#define OP_Return         52
+#define OP_EndCoroutine   53
+#define OP_HaltIfNull     54 /* synopsis: if r[P3]=null halt               */
+#define OP_Halt           55
+#define OP_Integer        56 /* synopsis: r[P2]=P1                         */
+#define OP_Int64          57 /* synopsis: r[P2]=P4                         */
+#define OP_String         58 /* synopsis: r[P2]='P4' (len=P1)              */
+#define OP_Null           59 /* synopsis: r[P2..P3]=NULL                   */
+#define OP_SoftNull       60 /* synopsis: r[P1]=NULL                       */
+#define OP_Blob           61 /* synopsis: r[P2]=P4 (len=P1)                */
+#define OP_Variable       62 /* synopsis: r[P2]=parameter(P1,P4)           */
+#define OP_Move           63 /* synopsis: r[P2@P3]=r[P1@P3]                */
+#define OP_Copy           64 /* synopsis: r[P2@P3+1]=r[P1@P3+1]            */
+#define OP_SCopy          65 /* synopsis: r[P2]=r[P1]                      */
+#define OP_IntCopy        66 /* synopsis: r[P2]=r[P1]                      */
+#define OP_ResultRow      67 /* synopsis: output=r[P1@P2]                  */
+#define OP_CollSeq        68
+#define OP_Function0      69 /* synopsis: r[P3]=func(r[P2@P5])             */
+#define OP_Or             70 /* same as TK_OR, synopsis: r[P3]=(r[P1] || r[P2]) */
+#define OP_And            71 /* same as TK_AND, synopsis: r[P3]=(r[P1] && r[P2]) */
+#define OP_Function       72 /* synopsis: r[P3]=func(r[P2@P5])             */
+#define OP_AddImm         73 /* synopsis: r[P1]=r[P1]+P2                   */
+#define OP_RealAffinity   74
+#define OP_IsNull         75 /* same as TK_ISNULL, synopsis: if r[P1]==NULL goto P2 */
+#define OP_NotNull        76 /* same as TK_NOTNULL, synopsis: if r[P1]!=NULL goto P2 */
+#define OP_Ne             77 /* same as TK_NE, synopsis: IF r[P3]!=r[P1]   */
+#define OP_Eq             78 /* same as TK_EQ, synopsis: IF r[P3]==r[P1]   */
+#define OP_Gt             79 /* same as TK_GT, synopsis: IF r[P3]>r[P1]    */
+#define OP_Le             80 /* same as TK_LE, synopsis: IF r[P3]<=r[P1]   */
+#define OP_Lt             81 /* same as TK_LT, synopsis: IF r[P3]<r[P1]    */
+#define OP_Ge             82 /* same as TK_GE, synopsis: IF r[P3]>=r[P1]   */
+#define OP_ElseNotEq      83 /* same as TK_ESCAPE                          */
+#define OP_BitAnd         84 /* same as TK_BITAND, synopsis: r[P3]=r[P1]&r[P2] */
+#define OP_BitOr          85 /* same as TK_BITOR, synopsis: r[P3]=r[P1]|r[P2] */
+#define OP_ShiftLeft      86 /* same as TK_LSHIFT, synopsis: r[P3]=r[P2]<<r[P1] */
+#define OP_ShiftRight     87 /* same as TK_RSHIFT, synopsis: r[P3]=r[P2]>>r[P1] */
+#define OP_Add            88 /* same as TK_PLUS, synopsis: r[P3]=r[P1]+r[P2] */
+#define OP_Subtract       89 /* same as TK_MINUS, synopsis: r[P3]=r[P2]-r[P1] */
+#define OP_Multiply       90 /* same as TK_STAR, synopsis: r[P3]=r[P1]*r[P2] */
+#define OP_Divide         91 /* same as TK_SLASH, synopsis: r[P3]=r[P2]/r[P1] */
+#define OP_Remainder      92 /* same as TK_REM, synopsis: r[P3]=r[P2]%r[P1] */
+#define OP_Concat         93 /* same as TK_CONCAT, synopsis: r[P3]=r[P2]+r[P1] */
 #define OP_Cast           94 /* synopsis: affinity(r[P1])                  */
-#define OP_Permutation    95
-#define OP_Compare        96 /* synopsis: r[P1@P3] <-> r[P2@P3]            */
+#define OP_BitNot         95 /* same as TK_BITNOT, synopsis: r[P1]= ~r[P1] */
+#define OP_Permutation    96
 #define OP_String8        97 /* same as TK_STRING, synopsis: r[P2]='P4'    */
-#define OP_Column         98 /* synopsis: r[P3]=PX                         */
-#define OP_Affinity       99 /* synopsis: affinity(r[P1@P2])               */
-#define OP_MakeRecord    100 /* synopsis: r[P3]=mkrec(r[P1@P2])            */
-#define OP_Count         101 /* synopsis: r[P2]=count()                    */
-#define OP_ReadCookie    102
-#define OP_SetCookie     103
-#define OP_ReopenIdx     104 /* synopsis: root=P2 iDb=P3                   */
-#define OP_OpenRead      105 /* synopsis: root=P2 iDb=P3                   */
-#define OP_OpenWrite     106 /* synopsis: root=P2 iDb=P3                   */
-#define OP_OpenAutoindex 107 /* synopsis: nColumn=P2                       */
-#define OP_OpenEphemeral 108 /* synopsis: nColumn=P2                       */
-#define OP_SorterOpen    109
-#define OP_SequenceTest  110 /* synopsis: if( cursor[P1].ctr++ ) pc = P2   */
-#define OP_OpenPseudo    111 /* synopsis: P3 columns in r[P2]              */
-#define OP_Close         112
-#define OP_ColumnsUsed   113
-#define OP_Sequence      114 /* synopsis: r[P2]=cursor[P1].ctr++           */
-#define OP_NewRowid      115 /* synopsis: r[P2]=rowid                      */
-#define OP_Insert        116 /* synopsis: intkey=r[P3] data=r[P2]          */
-#define OP_InsertInt     117 /* synopsis: intkey=P3 data=r[P2]             */
-#define OP_Delete        118
-#define OP_ResetCount    119
-#define OP_SorterCompare 120 /* synopsis: if key(P1)!=trim(r[P3],P4) goto P2 */
-#define OP_SorterData    121 /* synopsis: r[P2]=data                       */
-#define OP_RowData       122 /* synopsis: r[P2]=data                       */
-#define OP_Rowid         123 /* synopsis: r[P2]=rowid                      */
-#define OP_NullRow       124
-#define OP_SorterInsert  125 /* synopsis: key=r[P2]                        */
-#define OP_IdxInsert     126 /* synopsis: key=r[P2]                        */
-#define OP_IdxDelete     127 /* synopsis: key=r[P2@P3]                     */
-#define OP_Seek          128 /* synopsis: Move P3 to P1.rowid              */
-#define OP_IdxRowid      129 /* synopsis: r[P2]=rowid                      */
-#define OP_Destroy       130
-#define OP_Clear         131
+#define OP_Compare        98 /* synopsis: r[P1@P3] <-> r[P2@P3]            */
+#define OP_Column         99 /* synopsis: r[P3]=PX                         */
+#define OP_Affinity      100 /* synopsis: affinity(r[P1@P2])               */
+#define OP_MakeRecord    101 /* synopsis: r[P3]=mkrec(r[P1@P2])            */
+#define OP_Count         102 /* synopsis: r[P2]=count()                    */
+#define OP_ReadCookie    103
+#define OP_SetCookie     104
+#define OP_ReopenIdx     105 /* synopsis: root=P2 iDb=P3                   */
+#define OP_OpenRead      106 /* synopsis: root=P2 iDb=P3                   */
+#define OP_OpenWrite     107 /* synopsis: root=P2 iDb=P3                   */
+#define OP_OpenDup       108
+#define OP_OpenAutoindex 109 /* synopsis: nColumn=P2                       */
+#define OP_OpenEphemeral 110 /* synopsis: nColumn=P2                       */
+#define OP_SorterOpen    111
+#define OP_SequenceTest  112 /* synopsis: if( cursor[P1].ctr++ ) pc = P2   */
+#define OP_OpenPseudo    113 /* synopsis: P3 columns in r[P2]              */
+#define OP_Close         114
+#define OP_ColumnsUsed   115
+#define OP_Sequence      116 /* synopsis: r[P2]=cursor[P1].ctr++           */
+#define OP_NewRowid      117 /* synopsis: r[P2]=rowid                      */
+#define OP_Insert        118 /* synopsis: intkey=r[P3] data=r[P2]          */
+#define OP_InsertInt     119 /* synopsis: intkey=P3 data=r[P2]             */
+#define OP_Delete        120
+#define OP_ResetCount    121
+#define OP_SorterCompare 122 /* synopsis: if key(P1)!=trim(r[P3],P4) goto P2 */
+#define OP_SorterData    123 /* synopsis: r[P2]=data                       */
+#define OP_RowData       124 /* synopsis: r[P2]=data                       */
+#define OP_Rowid         125 /* synopsis: r[P2]=rowid                      */
+#define OP_NullRow       126
+#define OP_SorterInsert  127 /* synopsis: key=r[P2]                        */
+#define OP_IdxInsert     128 /* synopsis: key=r[P2]                        */
+#define OP_IdxDelete     129 /* synopsis: key=r[P2@P3]                     */
+#define OP_Seek          130 /* synopsis: Move P3 to P1.rowid              */
+#define OP_IdxRowid      131 /* synopsis: r[P2]=rowid                      */
 #define OP_Real          132 /* same as TK_FLOAT, synopsis: r[P2]=P4       */
-#define OP_ResetSorter   133
-#define OP_CreateIndex   134 /* synopsis: r[P2]=root iDb=P1                */
-#define OP_CreateTable   135 /* synopsis: r[P2]=root iDb=P1                */
-#define OP_SqlExec       136
-#define OP_ParseSchema   137
-#define OP_LoadAnalysis  138
-#define OP_DropTable     139
-#define OP_DropIndex     140
-#define OP_DropTrigger   141
-#define OP_IntegrityCk   142
-#define OP_RowSetAdd     143 /* synopsis: rowset(P1)=r[P2]                 */
-#define OP_Param         144
-#define OP_FkCounter     145 /* synopsis: fkctr[P1]+=P2                    */
-#define OP_MemMax        146 /* synopsis: r[P1]=max(r[P1],r[P2])           */
-#define OP_OffsetLimit   147 /* synopsis: if r[P1]>0 then r[P2]=r[P1]+max(0,r[P3]) else r[P2]=(-1) */
-#define OP_AggStep0      148 /* synopsis: accum=r[P3] step(r[P2@P5])       */
-#define OP_AggStep       149 /* synopsis: accum=r[P3] step(r[P2@P5])       */
-#define OP_AggFinal      150 /* synopsis: accum=r[P1] N=P2                 */
-#define OP_Expire        151
-#define OP_TableLock     152 /* synopsis: iDb=P1 root=P2 write=P3          */
-#define OP_VBegin        153
-#define OP_VCreate       154
-#define OP_VDestroy      155
-#define OP_VOpen         156
-#define OP_VColumn       157 /* synopsis: r[P3]=vcolumn(P2)                */
-#define OP_VRename       158
-#define OP_Pagecount     159
-#define OP_MaxPgcnt      160
-#define OP_CursorHint    161
-#define OP_Noop          162
-#define OP_Explain       163
+#define OP_Destroy       133
+#define OP_Clear         134
+#define OP_ResetSorter   135
+#define OP_CreateIndex   136 /* synopsis: r[P2]=root iDb=P1                */
+#define OP_CreateTable   137 /* synopsis: r[P2]=root iDb=P1                */
+#define OP_SqlExec       138
+#define OP_ParseSchema   139
+#define OP_LoadAnalysis  140
+#define OP_DropTable     141
+#define OP_DropIndex     142
+#define OP_DropTrigger   143
+#define OP_IntegrityCk   144
+#define OP_RowSetAdd     145 /* synopsis: rowset(P1)=r[P2]                 */
+#define OP_Param         146
+#define OP_FkCounter     147 /* synopsis: fkctr[P1]+=P2                    */
+#define OP_MemMax        148 /* synopsis: r[P1]=max(r[P1],r[P2])           */
+#define OP_OffsetLimit   149 /* synopsis: if r[P1]>0 then r[P2]=r[P1]+max(0,r[P3]) else r[P2]=(-1) */
+#define OP_AggStep0      150 /* synopsis: accum=r[P3] step(r[P2@P5])       */
+#define OP_AggStep       151 /* synopsis: accum=r[P3] step(r[P2@P5])       */
+#define OP_AggFinal      152 /* synopsis: accum=r[P1] N=P2                 */
+#define OP_Expire        153
+#define OP_TableLock     154 /* synopsis: iDb=P1 root=P2 write=P3          */
+#define OP_VBegin        155
+#define OP_VCreate       156
+#define OP_VDestroy      157
+#define OP_VOpen         158
+#define OP_VColumn       159 /* synopsis: r[P3]=vcolumn(P2)                */
+#define OP_VRename       160
+#define OP_Pagecount     161
+#define OP_MaxPgcnt      162
+#define OP_CursorHint    163
+#define OP_Noop          164
+#define OP_Explain       165
 
 /* Properties such as "out2" or "jump" that are specified in
 ** comments following the "case" for each opcode in the vdbe.c
 ** are encoded into bitvectors as follows:
 */
 #define OPFLG_JUMP        0x01  /* jump:  P2 holds jmp target */
 #define OPFLG_IN1         0x02  /* in1:   P1 is an input */
 #define OPFLG_IN2         0x04  /* in2:   P2 is an input */
 #define OPFLG_IN3         0x08  /* in3:   P3 is an input */
 #define OPFLG_OUT2        0x10  /* out2:  P2 is an output */
 #define OPFLG_OUT3        0x20  /* out3:  P3 is an output */
 #define OPFLG_INITIALIZER {\
 /*   0 */ 0x00, 0x00, 0x00, 0x01, 0x01, 0x01, 0x01, 0x01,\
 /*   8 */ 0x00, 0x10, 0x00, 0x01, 0x00, 0x01, 0x01, 0x01,\
-/*  16 */ 0x03, 0x03, 0x01, 0x12, 0x01, 0x03, 0x03, 0x09,\
-/*  24 */ 0x09, 0x09, 0x09, 0x26, 0x26, 0x09, 0x09, 0x09,\
-/*  32 */ 0x09, 0x09, 0x03, 0x03, 0x0b, 0x0b, 0x0b, 0x0b,\
-/*  40 */ 0x0b, 0x0b, 0x01, 0x26, 0x26, 0x26, 0x26, 0x26,\
-/*  48 */ 0x26, 0x26, 0x26, 0x26, 0x26, 0x01, 0x12, 0x01,\
-/*  56 */ 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x23,\
-/*  64 */ 0x0b, 0x01, 0x01, 0x03, 0x03, 0x03, 0x01, 0x01,\
-/*  72 */ 0x01, 0x02, 0x02, 0x08, 0x00, 0x10, 0x10, 0x10,\
-/*  80 */ 0x10, 0x00, 0x10, 0x10, 0x00, 0x00, 0x10, 0x10,\
-/*  88 */ 0x00, 0x00, 0x00, 0x00, 0x02, 0x02, 0x02, 0x00,\
-/*  96 */ 0x00, 0x10, 0x00, 0x00, 0x00, 0x10, 0x10, 0x00,\
+/*  16 */ 0x03, 0x03, 0x01, 0x12, 0x01, 0x03, 0x03, 0x01,\
+/*  24 */ 0x09, 0x09, 0x09, 0x09, 0x09, 0x09, 0x09, 0x09,\
+/*  32 */ 0x09, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,\
+/*  40 */ 0x01, 0x01, 0x23, 0x0b, 0x01, 0x01, 0x03, 0x03,\
+/*  48 */ 0x03, 0x01, 0x01, 0x01, 0x02, 0x02, 0x08, 0x00,\
+/*  56 */ 0x10, 0x10, 0x10, 0x10, 0x00, 0x10, 0x10, 0x00,\
+/*  64 */ 0x00, 0x10, 0x10, 0x00, 0x00, 0x00, 0x26, 0x26,\
+/*  72 */ 0x00, 0x02, 0x02, 0x03, 0x03, 0x0b, 0x0b, 0x0b,\
+/*  80 */ 0x0b, 0x0b, 0x0b, 0x01, 0x26, 0x26, 0x26, 0x26,\
+/*  88 */ 0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x02, 0x12,\
+/*  96 */ 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x10, 0x10,\
 /* 104 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
-/* 112 */ 0x00, 0x00, 0x10, 0x10, 0x00, 0x00, 0x00, 0x00,\
-/* 120 */ 0x00, 0x00, 0x00, 0x10, 0x00, 0x04, 0x04, 0x00,\
-/* 128 */ 0x00, 0x10, 0x10, 0x00, 0x10, 0x00, 0x10, 0x10,\
-/* 136 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06,\
-/* 144 */ 0x10, 0x00, 0x04, 0x1a, 0x00, 0x00, 0x00, 0x00,\
-/* 152 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10,\
-/* 160 */ 0x10, 0x00, 0x00, 0x00,}
+/* 112 */ 0x00, 0x00, 0x00, 0x00, 0x10, 0x10, 0x00, 0x00,\
+/* 120 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x04,\
+/* 128 */ 0x04, 0x00, 0x00, 0x10, 0x10, 0x10, 0x00, 0x00,\
+/* 136 */ 0x10, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
+/* 144 */ 0x00, 0x06, 0x10, 0x00, 0x04, 0x1a, 0x00, 0x00,\
+/* 152 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
+/* 160 */ 0x00, 0x10, 0x10, 0x00, 0x00, 0x00,}
 
 /* The sqlite3P2Values() routine is able to run faster if it knows
 ** the value of the largest JUMP opcode.  The smaller the maximum
 ** JUMP opcode the better, so the mkopcodeh.tcl script that
 ** generated this include file strives to group all JUMP opcodes
 ** together near the beginning of the list.
 */
-#define SQLITE_MX_JUMP_OPCODE  72  /* Maximum JUMP opcode */
+#define SQLITE_MX_JUMP_OPCODE  83  /* Maximum JUMP opcode */
 
 /************** End of opcodes.h *********************************************/
 /************** Continuing where we left off in vdbe.h ***********************/
 
 /*
 ** Prototypes for the VDBE interface.  See comments on the implementation
 ** for a description of what each of these routines does.
 */
@@ -15206,32 +15218,33 @@ struct Expr {
 ** column labels.  In this case, Expr.zSpan is typically the text of a
 ** column expression as it exists in a SELECT statement.  However, if
 ** the bSpanIsTab flag is set, then zSpan is overloaded to mean the name
 ** of the result column in the form: DATABASE.TABLE.COLUMN.  This later
 ** form is used for name resolution with nested FROM clauses.
 */
 struct ExprList {
   int nExpr;             /* Number of expressions on the list */
+  int nAlloc;            /* Number of a[] slots allocated */
   struct ExprList_item { /* For each expression in the list */
     Expr *pExpr;            /* The parse tree for this expression */
     char *zName;            /* Token associated with this expression */
     char *zSpan;            /* Original text of the expression */
     u8 sortOrder;           /* 1 for DESC or 0 for ASC */
     unsigned done :1;       /* A flag to indicate when processing is finished */
     unsigned bSpanIsTab :1; /* zSpan holds DB.TABLE.COLUMN */
     unsigned reusable :1;   /* Constant expression is reusable */
     union {
       struct {
         u16 iOrderByCol;      /* For ORDER BY, column number in result set */
         u16 iAlias;           /* Index into Parse.aAlias[] for zName */
       } x;
       int iConstExprReg;      /* Register in which Expr value is cached */
     } u;
-  } *a;                  /* Alloc a power of two greater or equal to nExpr */
+  } a[1];                  /* One slot for each expression in the list */
 };
 
 /*
 ** An instance of this structure is used by the parser to record both
 ** the parse tree for an expression and the span of input text for an
 ** expression.
 */
 struct ExprSpan {
@@ -16078,24 +16091,27 @@ struct Sqlite3Config {
 struct Walker {
   Parse *pParse;                            /* Parser context.  */
   int (*xExprCallback)(Walker*, Expr*);     /* Callback for expressions */
   int (*xSelectCallback)(Walker*,Select*);  /* Callback for SELECTs */
   void (*xSelectCallback2)(Walker*,Select*);/* Second callback for SELECTs */
   int walkerDepth;                          /* Number of subqueries */
   u8 eCode;                                 /* A small processing code */
   union {                                   /* Extra data for callback */
-    NameContext *pNC;                          /* Naming context */
-    int n;                                     /* A counter */
-    int iCur;                                  /* A cursor number */
-    SrcList *pSrcList;                         /* FROM clause */
-    struct SrcCount *pSrcCount;                /* Counting column references */
-    struct CCurHint *pCCurHint;                /* Used by codeCursorHint() */
-    int *aiCol;                                /* array of column indexes */
-    struct IdxCover *pIdxCover;                /* Check for index coverage */
+    NameContext *pNC;                         /* Naming context */
+    int n;                                    /* A counter */
+    int iCur;                                 /* A cursor number */
+    SrcList *pSrcList;                        /* FROM clause */
+    struct SrcCount *pSrcCount;               /* Counting column references */
+    struct CCurHint *pCCurHint;               /* Used by codeCursorHint() */
+    int *aiCol;                               /* array of column indexes */
+    struct IdxCover *pIdxCover;               /* Check for index coverage */
+    struct IdxExprTrans *pIdxTrans;           /* Convert indexed expr to column */
+    ExprList *pGroupBy;                       /* GROUP BY clause */
+    struct HavingToWhereCtx *pHavingCtx;      /* HAVING to WHERE clause ctx */
   } u;
 };
 
 /* Forward declarations */
 SQLITE_PRIVATE int sqlite3WalkExpr(Walker*, Expr*);
 SQLITE_PRIVATE int sqlite3WalkExprList(Walker*, ExprList*);
 SQLITE_PRIVATE int sqlite3WalkSelect(Walker*, Select*);
 SQLITE_PRIVATE int sqlite3WalkSelectExpr(Walker*, Select*);
@@ -16239,16 +16255,17 @@ SQLITE_PRIVATE void *sqlite3DbMallocZero
 SQLITE_PRIVATE void *sqlite3DbMallocRaw(sqlite3*, u64);
 SQLITE_PRIVATE void *sqlite3DbMallocRawNN(sqlite3*, u64);
 SQLITE_PRIVATE char *sqlite3DbStrDup(sqlite3*,const char*);
 SQLITE_PRIVATE char *sqlite3DbStrNDup(sqlite3*,const char*, u64);
 SQLITE_PRIVATE void *sqlite3Realloc(void*, u64);
 SQLITE_PRIVATE void *sqlite3DbReallocOrFree(sqlite3 *, void *, u64);
 SQLITE_PRIVATE void *sqlite3DbRealloc(sqlite3 *, void *, u64);
 SQLITE_PRIVATE void sqlite3DbFree(sqlite3*, void*);
+SQLITE_PRIVATE void sqlite3DbFreeNN(sqlite3*, void*);
 SQLITE_PRIVATE int sqlite3MallocSize(void*);
 SQLITE_PRIVATE int sqlite3DbMallocSize(sqlite3*, void*);
 SQLITE_PRIVATE void *sqlite3ScratchMalloc(int);
 SQLITE_PRIVATE void sqlite3ScratchFree(void*);
 SQLITE_PRIVATE void *sqlite3PageMalloc(int);
 SQLITE_PRIVATE void sqlite3PageFree(void*);
 SQLITE_PRIVATE void sqlite3MemSetDefault(void);
 #ifndef SQLITE_UNTESTABLE
@@ -16554,16 +16571,17 @@ SQLITE_PRIVATE void sqlite3BeginTransact
 SQLITE_PRIVATE void sqlite3CommitTransaction(Parse*);
 SQLITE_PRIVATE void sqlite3RollbackTransaction(Parse*);
 SQLITE_PRIVATE void sqlite3Savepoint(Parse*, int, Token*);
 SQLITE_PRIVATE void sqlite3CloseSavepoints(sqlite3 *);
 SQLITE_PRIVATE void sqlite3LeaveMutexAndCloseZombie(sqlite3*);
 SQLITE_PRIVATE int sqlite3ExprIsConstant(Expr*);
 SQLITE_PRIVATE int sqlite3ExprIsConstantNotJoin(Expr*);
 SQLITE_PRIVATE int sqlite3ExprIsConstantOrFunction(Expr*, u8);
+SQLITE_PRIVATE int sqlite3ExprIsConstantOrGroupBy(Parse*, Expr*, ExprList*);
 SQLITE_PRIVATE int sqlite3ExprIsTableConstant(Expr*,int);
 #ifdef SQLITE_ENABLE_CURSOR_HINTS
 SQLITE_PRIVATE int sqlite3ExprContainsSubquery(Expr*);
 #endif
 SQLITE_PRIVATE int sqlite3ExprIsInteger(Expr*, int*);
 SQLITE_PRIVATE int sqlite3ExprCanBeNull(const Expr*);
 SQLITE_PRIVATE int sqlite3ExprNeedsNoAffinityChange(const Expr*, char);
 SQLITE_PRIVATE int sqlite3IsRowid(const char*);
@@ -17263,19 +17281,26 @@ SQLITE_PRIVATE const unsigned char sqlit
 ** disabled by default.
 **
 ** EVIDENCE-OF: R-38799-08373 URI filenames can be enabled or disabled
 ** using the SQLITE_USE_URI=1 or SQLITE_USE_URI=0 compile-time options.
 **
 ** EVIDENCE-OF: R-43642-56306 By default, URI handling is globally
 ** disabled. The default value may be changed by compiling with the
 ** SQLITE_USE_URI symbol defined.
+**
+** URI filenames are enabled by default if SQLITE_HAS_CODEC is
+** enabled.
 */
 #ifndef SQLITE_USE_URI
-# define  SQLITE_USE_URI 0
+# ifdef SQLITE_HAS_CODEC
+#  define SQLITE_USE_URI 1
+# else
+#  define SQLITE_USE_URI 0
+# endif
 #endif
 
 /* EVIDENCE-OF: R-38720-18127 The default setting is determined by the
 ** SQLITE_ALLOW_COVERING_INDEX_SCAN compile-time option, or is "on" if
 ** that compile-time option is omitted.
 */
 #ifndef SQLITE_ALLOW_COVERING_INDEX_SCAN
 # define SQLITE_ALLOW_COVERING_INDEX_SCAN 1
@@ -18089,17 +18114,17 @@ struct VdbeFrame {
 
 #define VdbeFrameMem(p) ((Mem *)&((u8 *)p)[ROUND8(sizeof(VdbeFrame))])
 
 /*
 ** Internally, the vdbe manipulates nearly all SQL values as Mem
 ** structures. Each Mem struct may cache multiple representations (string,
 ** integer etc.) of the same value.
 */
-struct Mem {
+struct sqlite3_value {
   union MemValue {
     double r;           /* Real value used when MEM_Real is set in flags */
     i64 i;              /* Integer value used when MEM_Int is set in flags */
     int nZero;          /* Used when bit MEM_Zero is set in flags */
     FuncDef *pDef;      /* Used only when flags==MEM_Agg */
     RowSet *pRowSet;    /* Used only when flags==MEM_RowSet */
     VdbeFrame *pFrame;  /* Used when flags==MEM_Frame */
   } u;
@@ -18191,21 +18216,21 @@ struct Mem {
 /*
 ** Each auxiliary data pointer stored by a user defined function 
 ** implementation calling sqlite3_set_auxdata() is stored in an instance
 ** of this structure. All such structures associated with a single VM
 ** are stored in a linked list headed at Vdbe.pAuxData. All are destroyed
 ** when the VM is halted (if not before).
 */
 struct AuxData {
-  int iOp;                        /* Instruction number of OP_Function opcode */
-  int iArg;                       /* Index of function argument. */
+  int iAuxOp;                     /* Instruction number of OP_Function opcode */
+  int iAuxArg;                    /* Index of function argument. */
   void *pAux;                     /* Aux data pointer */
-  void (*xDelete)(void *);        /* Destructor for the aux data */
-  AuxData *pNext;                 /* Next element in list */
+  void (*xDeleteAux)(void*);      /* Destructor for the aux data */
+  AuxData *pNextAux;              /* Next element in list */
 };
 
 /*
 ** The "context" argument for an installable function.  A pointer to an
 ** instance of this structure is the first argument to the routines used
 ** implement the SQL functions.
 **
 ** There is a typedef for this structure in sqlite.h.  So all routines,
@@ -19219,18 +19244,20 @@ static int validJulianDay(sqlite3_int64 
 */
 static void computeYMD(DateTime *p){
   int Z, A, B, C, D, E, X1;
   if( p->validYMD ) return;
   if( !p->validJD ){
     p->Y = 2000;
     p->M = 1;
     p->D = 1;
-  }else{
-    assert( validJulianDay(p->iJD) );
+  }else if( !validJulianDay(p->iJD) ){
+    datetimeError(p);
+    return;
+  }else{
     Z = (int)((p->iJD + 43200000)/86400000);
     A = (int)((Z - 1867216.25)/36524.25);
     A = Z + 1 + A - (A/4);
     B = A + 1524;
     C = (int)((B - 122.1)/365.25);
     D = (36525*(C&32767))/100;
     E = (int)((B-D)/30.6001);
     X1 = (int)(30.6001*E);
@@ -24656,21 +24683,22 @@ SQLITE_API void sqlite3_free(void *p){
 ** *db->pnBytesFreed.
 */
 static SQLITE_NOINLINE void measureAllocationSize(sqlite3 *db, void *p){
   *db->pnBytesFreed += sqlite3DbMallocSize(db,p);
 }
 
 /*
 ** Free memory that might be associated with a particular database
-** connection.
-*/
-SQLITE_PRIVATE void sqlite3DbFree(sqlite3 *db, void *p){
+** connection.  Calling sqlite3DbFree(D,X) for X==0 is a harmless no-op.
+** The sqlite3DbFreeNN(D,X) version requires that X be non-NULL.
+*/
+SQLITE_PRIVATE void sqlite3DbFreeNN(sqlite3 *db, void *p){
   assert( db==0 || sqlite3_mutex_held(db->mutex) );
-  if( p==0 ) return;
+  assert( p!=0 );
   if( db ){
     if( db->pnBytesFreed ){
       measureAllocationSize(db, p);
       return;
     }
     if( isLookaside(db, p) ){
       LookasideSlot *pBuf = (LookasideSlot*)p;
 #ifdef SQLITE_DEBUG
@@ -24684,16 +24712,20 @@ SQLITE_PRIVATE void sqlite3DbFree(sqlite
     }
   }
   assert( sqlite3MemdebugHasType(p, (MEMTYPE_LOOKASIDE|MEMTYPE_HEAP)) );
   assert( sqlite3MemdebugNoType(p, (u8)~(MEMTYPE_LOOKASIDE|MEMTYPE_HEAP)) );
   assert( db!=0 || sqlite3MemdebugNoType(p, MEMTYPE_LOOKASIDE) );
   sqlite3MemdebugSetType(p, MEMTYPE_HEAP);
   sqlite3_free(p);
 }
+SQLITE_PRIVATE void sqlite3DbFree(sqlite3 *db, void *p){
+  assert( db==0 || sqlite3_mutex_held(db->mutex) );
+  if( p ) sqlite3DbFreeNN(db, p);
+}
 
 /*
 ** Change the size of an existing memory allocation
 */
 SQLITE_PRIVATE void *sqlite3Realloc(void *pOld, u64 nBytes){
   int nOld, nNew, nDiff;
   void *pNew;
   assert( sqlite3MemdebugHasType(pOld, MEMTYPE_HEAP) );
@@ -26376,25 +26408,30 @@ SQLITE_PRIVATE void sqlite3TreeViewSelec
 }
 
 /*
 ** Generate a human-readable explanation of an expression tree.
 */
 SQLITE_PRIVATE void sqlite3TreeViewExpr(TreeView *pView, const Expr *pExpr, u8 moreToFollow){
   const char *zBinOp = 0;   /* Binary operator */
   const char *zUniOp = 0;   /* Unary operator */
-  char zFlgs[30];
+  char zFlgs[60];
   pView = sqlite3TreeViewPush(pView, moreToFollow);
   if( pExpr==0 ){
     sqlite3TreeViewLine(pView, "nil");
     sqlite3TreeViewPop(pView);
     return;
   }
   if( pExpr->flags ){
-    sqlite3_snprintf(sizeof(zFlgs),zFlgs,"  flags=0x%x",pExpr->flags);
+    if( ExprHasProperty(pExpr, EP_FromJoin) ){
+      sqlite3_snprintf(sizeof(zFlgs),zFlgs,"  flags=0x%x iRJT=%d",
+                       pExpr->flags, pExpr->iRightJoinTable);
+    }else{
+      sqlite3_snprintf(sizeof(zFlgs),zFlgs,"  flags=0x%x",pExpr->flags);
+    }
   }else{
     zFlgs[0] = 0;
   }
   switch( pExpr->op ){
     case TK_AGG_COLUMN: {
       sqlite3TreeViewLine(pView, "AGG{%d:%d}%s",
             pExpr->iTable, pExpr->iColumn, zFlgs);
       break;
@@ -26603,16 +26640,21 @@ SQLITE_PRIVATE void sqlite3TreeViewExpr(
       sqlite3TreeViewBareExprList(pView, pExpr->x.pList, "VECTOR");
       break;
     }
     case TK_SELECT_COLUMN: {
       sqlite3TreeViewLine(pView, "SELECT-COLUMN %d", pExpr->iColumn);
       sqlite3TreeViewSelect(pView, pExpr->pLeft->x.pSelect, 0);
       break;
     }
+    case TK_IF_NULL_ROW: {
+      sqlite3TreeViewLine(pView, "IF-NULL-ROW %d", pExpr->iTable);
+      sqlite3TreeViewExpr(pView, pExpr->pLeft, 0);
+      break;
+    }
     default: {
       sqlite3TreeViewLine(pView, "op=%d", pExpr->op);
       break;
     }
   }
   if( zBinOp ){
     sqlite3TreeViewLine(pView, "%s%s", zBinOp, zFlgs);
     sqlite3TreeViewExpr(pView, pExpr->pLeft, 1);
@@ -28322,16 +28364,17 @@ SQLITE_PRIVATE int sqlite3GetInt32(const
     if( (u&0x80000000)==0 && sqlite3Isxdigit(zNum[i])==0 ){
       memcpy(pValue, &u, 4);
       return 1;
     }else{
       return 0;
     }
   }
 #endif
+  if( !sqlite3Isdigit(zNum[0]) ) return 0;
   while( zNum[0]=='0' ) zNum++;
   for(i=0; i<11 && (c = zNum[i] - '0')>=0 && c<=9; i++){
     v = v*10 + c;
   }
 
   /* The longest decimal representation of a 32 bit integer is 10 digits:
   **
   **             1234567890
@@ -29485,157 +29528,159 @@ SQLITE_PRIVATE const char *sqlite3Opcode
     /*  15 */ "InitCoroutine"    OpHelp(""),
     /*  16 */ "Yield"            OpHelp(""),
     /*  17 */ "MustBeInt"        OpHelp(""),
     /*  18 */ "Jump"             OpHelp(""),
     /*  19 */ "Not"              OpHelp("r[P2]= !r[P1]"),
     /*  20 */ "Once"             OpHelp(""),
     /*  21 */ "If"               OpHelp(""),
     /*  22 */ "IfNot"            OpHelp(""),
-    /*  23 */ "SeekLT"           OpHelp("key=r[P3@P4]"),
-    /*  24 */ "SeekLE"           OpHelp("key=r[P3@P4]"),
-    /*  25 */ "SeekGE"           OpHelp("key=r[P3@P4]"),
-    /*  26 */ "SeekGT"           OpHelp("key=r[P3@P4]"),
-    /*  27 */ "Or"               OpHelp("r[P3]=(r[P1] || r[P2])"),
-    /*  28 */ "And"              OpHelp("r[P3]=(r[P1] && r[P2])"),
-    /*  29 */ "NoConflict"       OpHelp("key=r[P3@P4]"),
-    /*  30 */ "NotFound"         OpHelp("key=r[P3@P4]"),
-    /*  31 */ "Found"            OpHelp("key=r[P3@P4]"),
-    /*  32 */ "SeekRowid"        OpHelp("intkey=r[P3]"),
-    /*  33 */ "NotExists"        OpHelp("intkey=r[P3]"),
-    /*  34 */ "IsNull"           OpHelp("if r[P1]==NULL goto P2"),
-    /*  35 */ "NotNull"          OpHelp("if r[P1]!=NULL goto P2"),
-    /*  36 */ "Ne"               OpHelp("IF r[P3]!=r[P1]"),
-    /*  37 */ "Eq"               OpHelp("IF r[P3]==r[P1]"),
-    /*  38 */ "Gt"               OpHelp("IF r[P3]>r[P1]"),
-    /*  39 */ "Le"               OpHelp("IF r[P3]<=r[P1]"),
-    /*  40 */ "Lt"               OpHelp("IF r[P3]<r[P1]"),
-    /*  41 */ "Ge"               OpHelp("IF r[P3]>=r[P1]"),
-    /*  42 */ "ElseNotEq"        OpHelp(""),
-    /*  43 */ "BitAnd"           OpHelp("r[P3]=r[P1]&r[P2]"),
-    /*  44 */ "BitOr"            OpHelp("r[P3]=r[P1]|r[P2]"),
-    /*  45 */ "ShiftLeft"        OpHelp("r[P3]=r[P2]<<r[P1]"),
-    /*  46 */ "ShiftRight"       OpHelp("r[P3]=r[P2]>>r[P1]"),
-    /*  47 */ "Add"              OpHelp("r[P3]=r[P1]+r[P2]"),
-    /*  48 */ "Subtract"         OpHelp("r[P3]=r[P2]-r[P1]"),
-    /*  49 */ "Multiply"         OpHelp("r[P3]=r[P1]*r[P2]"),
-    /*  50 */ "Divide"           OpHelp("r[P3]=r[P2]/r[P1]"),
-    /*  51 */ "Remainder"        OpHelp("r[P3]=r[P2]%r[P1]"),
-    /*  52 */ "Concat"           OpHelp("r[P3]=r[P2]+r[P1]"),
-    /*  53 */ "Last"             OpHelp(""),
-    /*  54 */ "BitNot"           OpHelp("r[P1]= ~r[P1]"),
-    /*  55 */ "IfSmaller"        OpHelp(""),
-    /*  56 */ "SorterSort"       OpHelp(""),
-    /*  57 */ "Sort"             OpHelp(""),
-    /*  58 */ "Rewind"           OpHelp(""),
-    /*  59 */ "IdxLE"            OpHelp("key=r[P3@P4]"),
-    /*  60 */ "IdxGT"            OpHelp("key=r[P3@P4]"),
-    /*  61 */ "IdxLT"            OpHelp("key=r[P3@P4]"),
-    /*  62 */ "IdxGE"            OpHelp("key=r[P3@P4]"),
-    /*  63 */ "RowSetRead"       OpHelp("r[P3]=rowset(P1)"),
-    /*  64 */ "RowSetTest"       OpHelp("if r[P3] in rowset(P1) goto P2"),
-    /*  65 */ "Program"          OpHelp(""),
-    /*  66 */ "FkIfZero"         OpHelp("if fkctr[P1]==0 goto P2"),
-    /*  67 */ "IfPos"            OpHelp("if r[P1]>0 then r[P1]-=P3, goto P2"),
-    /*  68 */ "IfNotZero"        OpHelp("if r[P1]!=0 then r[P1]--, goto P2"),
-    /*  69 */ "DecrJumpZero"     OpHelp("if (--r[P1])==0 goto P2"),
-    /*  70 */ "IncrVacuum"       OpHelp(""),
-    /*  71 */ "VNext"            OpHelp(""),
-    /*  72 */ "Init"             OpHelp("Start at P2"),
-    /*  73 */ "Return"           OpHelp(""),
-    /*  74 */ "EndCoroutine"     OpHelp(""),
-    /*  75 */ "HaltIfNull"       OpHelp("if r[P3]=null halt"),
-    /*  76 */ "Halt"             OpHelp(""),
-    /*  77 */ "Integer"          OpHelp("r[P2]=P1"),
-    /*  78 */ "Int64"            OpHelp("r[P2]=P4"),
-    /*  79 */ "String"           OpHelp("r[P2]='P4' (len=P1)"),
-    /*  80 */ "Null"             OpHelp("r[P2..P3]=NULL"),
-    /*  81 */ "SoftNull"         OpHelp("r[P1]=NULL"),
-    /*  82 */ "Blob"             OpHelp("r[P2]=P4 (len=P1)"),
-    /*  83 */ "Variable"         OpHelp("r[P2]=parameter(P1,P4)"),
-    /*  84 */ "Move"             OpHelp("r[P2@P3]=r[P1@P3]"),
-    /*  85 */ "Copy"             OpHelp("r[P2@P3+1]=r[P1@P3+1]"),
-    /*  86 */ "SCopy"            OpHelp("r[P2]=r[P1]"),
-    /*  87 */ "IntCopy"          OpHelp("r[P2]=r[P1]"),
-    /*  88 */ "ResultRow"        OpHelp("output=r[P1@P2]"),
-    /*  89 */ "CollSeq"          OpHelp(""),
-    /*  90 */ "Function0"        OpHelp("r[P3]=func(r[P2@P5])"),
-    /*  91 */ "Function"         OpHelp("r[P3]=func(r[P2@P5])"),
-    /*  92 */ "AddImm"           OpHelp("r[P1]=r[P1]+P2"),
-    /*  93 */ "RealAffinity"     OpHelp(""),
+    /*  23 */ "IfNullRow"        OpHelp("if P1.nullRow then r[P3]=NULL, goto P2"),
+    /*  24 */ "SeekLT"           OpHelp("key=r[P3@P4]"),
+    /*  25 */ "SeekLE"           OpHelp("key=r[P3@P4]"),
+    /*  26 */ "SeekGE"           OpHelp("key=r[P3@P4]"),
+    /*  27 */ "SeekGT"           OpHelp("key=r[P3@P4]"),
+    /*  28 */ "NoConflict"       OpHelp("key=r[P3@P4]"),
+    /*  29 */ "NotFound"         OpHelp("key=r[P3@P4]"),
+    /*  30 */ "Found"            OpHelp("key=r[P3@P4]"),
+    /*  31 */ "SeekRowid"        OpHelp("intkey=r[P3]"),
+    /*  32 */ "NotExists"        OpHelp("intkey=r[P3]"),
+    /*  33 */ "Last"             OpHelp(""),
+    /*  34 */ "IfSmaller"        OpHelp(""),
+    /*  35 */ "SorterSort"       OpHelp(""),
+    /*  36 */ "Sort"             OpHelp(""),
+    /*  37 */ "Rewind"           OpHelp(""),
+    /*  38 */ "IdxLE"            OpHelp("key=r[P3@P4]"),
+    /*  39 */ "IdxGT"            OpHelp("key=r[P3@P4]"),
+    /*  40 */ "IdxLT"            OpHelp("key=r[P3@P4]"),
+    /*  41 */ "IdxGE"            OpHelp("key=r[P3@P4]"),
+    /*  42 */ "RowSetRead"       OpHelp("r[P3]=rowset(P1)"),
+    /*  43 */ "RowSetTest"       OpHelp("if r[P3] in rowset(P1) goto P2"),
+    /*  44 */ "Program"          OpHelp(""),
+    /*  45 */ "FkIfZero"         OpHelp("if fkctr[P1]==0 goto P2"),
+    /*  46 */ "IfPos"            OpHelp("if r[P1]>0 then r[P1]-=P3, goto P2"),
+    /*  47 */ "IfNotZero"        OpHelp("if r[P1]!=0 then r[P1]--, goto P2"),
+    /*  48 */ "DecrJumpZero"     OpHelp("if (--r[P1])==0 goto P2"),
+    /*  49 */ "IncrVacuum"       OpHelp(""),
+    /*  50 */ "VNext"            OpHelp(""),
+    /*  51 */ "Init"             OpHelp("Start at P2"),
+    /*  52 */ "Return"           OpHelp(""),
+    /*  53 */ "EndCoroutine"     OpHelp(""),
+    /*  54 */ "HaltIfNull"       OpHelp("if r[P3]=null halt"),
+    /*  55 */ "Halt"             OpHelp(""),
+    /*  56 */ "Integer"          OpHelp("r[P2]=P1"),
+    /*  57 */ "Int64"            OpHelp("r[P2]=P4"),
+    /*  58 */ "String"           OpHelp("r[P2]='P4' (len=P1)"),
+    /*  59 */ "Null"             OpHelp("r[P2..P3]=NULL"),
+    /*  60 */ "SoftNull"         OpHelp("r[P1]=NULL"),
+    /*  61 */ "Blob"             OpHelp("r[P2]=P4 (len=P1)"),
+    /*  62 */ "Variable"         OpHelp("r[P2]=parameter(P1,P4)"),
+    /*  63 */ "Move"             OpHelp("r[P2@P3]=r[P1@P3]"),
+    /*  64 */ "Copy"             OpHelp("r[P2@P3+1]=r[P1@P3+1]"),
+    /*  65 */ "SCopy"            OpHelp("r[P2]=r[P1]"),
+    /*  66 */ "IntCopy"          OpHelp("r[P2]=r[P1]"),
+    /*  67 */ "ResultRow"        OpHelp("output=r[P1@P2]"),
+    /*  68 */ "CollSeq"          OpHelp(""),
+    /*  69 */ "Function0"        OpHelp("r[P3]=func(r[P2@P5])"),
+    /*  70 */ "Or"               OpHelp("r[P3]=(r[P1] || r[P2])"),
+    /*  71 */ "And"              OpHelp("r[P3]=(r[P1] && r[P2])"),
+    /*  72 */ "Function"         OpHelp("r[P3]=func(r[P2@P5])"),
+    /*  73 */ "AddImm"           OpHelp("r[P1]=r[P1]+P2"),
+    /*  74 */ "RealAffinity"     OpHelp(""),
+    /*  75 */ "IsNull"           OpHelp("if r[P1]==NULL goto P2"),
+    /*  76 */ "NotNull"          OpHelp("if r[P1]!=NULL goto P2"),
+    /*  77 */ "Ne"               OpHelp("IF r[P3]!=r[P1]"),
+    /*  78 */ "Eq"               OpHelp("IF r[P3]==r[P1]"),
+    /*  79 */ "Gt"               OpHelp("IF r[P3]>r[P1]"),
+    /*  80 */ "Le"               OpHelp("IF r[P3]<=r[P1]"),
+    /*  81 */ "Lt"               OpHelp("IF r[P3]<r[P1]"),
+    /*  82 */ "Ge"               OpHelp("IF r[P3]>=r[P1]"),
+    /*  83 */ "ElseNotEq"        OpHelp(""),
+    /*  84 */ "BitAnd"           OpHelp("r[P3]=r[P1]&r[P2]"),
+    /*  85 */ "BitOr"            OpHelp("r[P3]=r[P1]|r[P2]"),
+    /*  86 */ "ShiftLeft"        OpHelp("r[P3]=r[P2]<<r[P1]"),
+    /*  87 */ "ShiftRight"       OpHelp("r[P3]=r[P2]>>r[P1]"),
+    /*  88 */ "Add"              OpHelp("r[P3]=r[P1]+r[P2]"),
+    /*  89 */ "Subtract"         OpHelp("r[P3]=r[P2]-r[P1]"),
+    /*  90 */ "Multiply"         OpHelp("r[P3]=r[P1]*r[P2]"),
+    /*  91 */ "Divide"           OpHelp("r[P3]=r[P2]/r[P1]"),
+    /*  92 */ "Remainder"        OpHelp("r[P3]=r[P2]%r[P1]"),
+    /*  93 */ "Concat"           OpHelp("r[P3]=r[P2]+r[P1]"),
     /*  94 */ "Cast"             OpHelp("affinity(r[P1])"),
-    /*  95 */ "Permutation"      OpHelp(""),
-    /*  96 */ "Compare"          OpHelp("r[P1@P3] <-> r[P2@P3]"),
+    /*  95 */ "BitNot"           OpHelp("r[P1]= ~r[P1]"),
+    /*  96 */ "Permutation"      OpHelp(""),
     /*  97 */ "String8"          OpHelp("r[P2]='P4'"),
-    /*  98 */ "Column"           OpHelp("r[P3]=PX"),
-    /*  99 */ "Affinity"         OpHelp("affinity(r[P1@P2])"),
-    /* 100 */ "MakeRecord"       OpHelp("r[P3]=mkrec(r[P1@P2])"),
-    /* 101 */ "Count"            OpHelp("r[P2]=count()"),
-    /* 102 */ "ReadCookie"       OpHelp(""),
-    /* 103 */ "SetCookie"        OpHelp(""),
-    /* 104 */ "ReopenIdx"        OpHelp("root=P2 iDb=P3"),
-    /* 105 */ "OpenRead"         OpHelp("root=P2 iDb=P3"),
-    /* 106 */ "OpenWrite"        OpHelp("root=P2 iDb=P3"),
-    /* 107 */ "OpenAutoindex"    OpHelp("nColumn=P2"),
-    /* 108 */ "OpenEphemeral"    OpHelp("nColumn=P2"),
-    /* 109 */ "SorterOpen"       OpHelp(""),
-    /* 110 */ "SequenceTest"     OpHelp("if( cursor[P1].ctr++ ) pc = P2"),
-    /* 111 */ "OpenPseudo"       OpHelp("P3 columns in r[P2]"),
-    /* 112 */ "Close"            OpHelp(""),
-    /* 113 */ "ColumnsUsed"      OpHelp(""),
-    /* 114 */ "Sequence"         OpHelp("r[P2]=cursor[P1].ctr++"),
-    /* 115 */ "NewRowid"         OpHelp("r[P2]=rowid"),
-    /* 116 */ "Insert"           OpHelp("intkey=r[P3] data=r[P2]"),
-    /* 117 */ "InsertInt"        OpHelp("intkey=P3 data=r[P2]"),
-    /* 118 */ "Delete"           OpHelp(""),
-    /* 119 */ "ResetCount"       OpHelp(""),
-    /* 120 */ "SorterCompare"    OpHelp("if key(P1)!=trim(r[P3],P4) goto P2"),
-    /* 121 */ "SorterData"       OpHelp("r[P2]=data"),
-    /* 122 */ "RowData"          OpHelp("r[P2]=data"),
-    /* 123 */ "Rowid"            OpHelp("r[P2]=rowid"),
-    /* 124 */ "NullRow"          OpHelp(""),
-    /* 125 */ "SorterInsert"     OpHelp("key=r[P2]"),
-    /* 126 */ "IdxInsert"        OpHelp("key=r[P2]"),
-    /* 127 */ "IdxDelete"        OpHelp("key=r[P2@P3]"),
-    /* 128 */ "Seek"             OpHelp("Move P3 to P1.rowid"),
-    /* 129 */ "IdxRowid"         OpHelp("r[P2]=rowid"),
-    /* 130 */ "Destroy"          OpHelp(""),
-    /* 131 */ "Clear"            OpHelp(""),
+    /*  98 */ "Compare"          OpHelp("r[P1@P3] <-> r[P2@P3]"),
+    /*  99 */ "Column"           OpHelp("r[P3]=PX"),
+    /* 100 */ "Affinity"         OpHelp("affinity(r[P1@P2])"),
+    /* 101 */ "MakeRecord"       OpHelp("r[P3]=mkrec(r[P1@P2])"),
+    /* 102 */ "Count"            OpHelp("r[P2]=count()"),
+    /* 103 */ "ReadCookie"       OpHelp(""),
+    /* 104 */ "SetCookie"        OpHelp(""),
+    /* 105 */ "ReopenIdx"        OpHelp("root=P2 iDb=P3"),
+    /* 106 */ "OpenRead"         OpHelp("root=P2 iDb=P3"),
+    /* 107 */ "OpenWrite"        OpHelp("root=P2 iDb=P3"),
+    /* 108 */ "OpenDup"          OpHelp(""),
+    /* 109 */ "OpenAutoindex"    OpHelp("nColumn=P2"),
+    /* 110 */ "OpenEphemeral"    OpHelp("nColumn=P2"),
+    /* 111 */ "SorterOpen"       OpHelp(""),
+    /* 112 */ "SequenceTest"     OpHelp("if( cursor[P1].ctr++ ) pc = P2"),
+    /* 113 */ "OpenPseudo"       OpHelp("P3 columns in r[P2]"),
+    /* 114 */ "Close"            OpHelp(""),
+    /* 115 */ "ColumnsUsed"      OpHelp(""),
+    /* 116 */ "Sequence"         OpHelp("r[P2]=cursor[P1].ctr++"),
+    /* 117 */ "NewRowid"         OpHelp("r[P2]=rowid"),
+    /* 118 */ "Insert"           OpHelp("intkey=r[P3] data=r[P2]"),
+    /* 119 */ "InsertInt"        OpHelp("intkey=P3 data=r[P2]"),
+    /* 120 */ "Delete"           OpHelp(""),
+    /* 121 */ "ResetCount"       OpHelp(""),
+    /* 122 */ "SorterCompare"    OpHelp("if key(P1)!=trim(r[P3],P4) goto P2"),
+    /* 123 */ "SorterData"       OpHelp("r[P2]=data"),
+    /* 124 */ "RowData"          OpHelp("r[P2]=data"),
+    /* 125 */ "Rowid"            OpHelp("r[P2]=rowid"),
+    /* 126 */ "NullRow"          OpHelp(""),
+    /* 127 */ "SorterInsert"     OpHelp("key=r[P2]"),
+    /* 128 */ "IdxInsert"        OpHelp("key=r[P2]"),
+    /* 129 */ "IdxDelete"        OpHelp("key=r[P2@P3]"),
+    /* 130 */ "Seek"             OpHelp("Move P3 to P1.rowid"),
+    /* 131 */ "IdxRowid"         OpHelp("r[P2]=rowid"),
     /* 132 */ "Real"             OpHelp("r[P2]=P4"),
-    /* 133 */ "ResetSorter"      OpHelp(""),
-    /* 134 */ "CreateIndex"      OpHelp("r[P2]=root iDb=P1"),
-    /* 135 */ "CreateTable"      OpHelp("r[P2]=root iDb=P1"),
-    /* 136 */ "SqlExec"          OpHelp(""),
-    /* 137 */ "ParseSchema"      OpHelp(""),
-    /* 138 */ "LoadAnalysis"     OpHelp(""),
-    /* 139 */ "DropTable"        OpHelp(""),
-    /* 140 */ "DropIndex"        OpHelp(""),
-    /* 141 */ "DropTrigger"      OpHelp(""),
-    /* 142 */ "IntegrityCk"      OpHelp(""),
-    /* 143 */ "RowSetAdd"        OpHelp("rowset(P1)=r[P2]"),
-    /* 144 */ "Param"            OpHelp(""),
-    /* 145 */ "FkCounter"        OpHelp("fkctr[P1]+=P2"),
-    /* 146 */ "MemMax"           OpHelp("r[P1]=max(r[P1],r[P2])"),
-    /* 147 */ "OffsetLimit"      OpHelp("if r[P1]>0 then r[P2]=r[P1]+max(0,r[P3]) else r[P2]=(-1)"),
-    /* 148 */ "AggStep0"         OpHelp("accum=r[P3] step(r[P2@P5])"),
-    /* 149 */ "AggStep"          OpHelp("accum=r[P3] step(r[P2@P5])"),
-    /* 150 */ "AggFinal"         OpHelp("accum=r[P1] N=P2"),
-    /* 151 */ "Expire"           OpHelp(""),
-    /* 152 */ "TableLock"        OpHelp("iDb=P1 root=P2 write=P3"),
-    /* 153 */ "VBegin"           OpHelp(""),
-    /* 154 */ "VCreate"          OpHelp(""),
-    /* 155 */ "VDestroy"         OpHelp(""),
-    /* 156 */ "VOpen"            OpHelp(""),
-    /* 157 */ "VColumn"          OpHelp("r[P3]=vcolumn(P2)"),
-    /* 158 */ "VRename"          OpHelp(""),
-    /* 159 */ "Pagecount"        OpHelp(""),
-    /* 160 */ "MaxPgcnt"         OpHelp(""),
-    /* 161 */ "CursorHint"       OpHelp(""),
-    /* 162 */ "Noop"             OpHelp(""),
-    /* 163 */ "Explain"          OpHelp(""),
+    /* 133 */ "Destroy"          OpHelp(""),
+    /* 134 */ "Clear"            OpHelp(""),
+    /* 135 */ "ResetSorter"      OpHelp(""),
+    /* 136 */ "CreateIndex"      OpHelp("r[P2]=root iDb=P1"),
+    /* 137 */ "CreateTable"      OpHelp("r[P2]=root iDb=P1"),
+    /* 138 */ "SqlExec"          OpHelp(""),
+    /* 139 */ "ParseSchema"      OpHelp(""),
+    /* 140 */ "LoadAnalysis"     OpHelp(""),
+    /* 141 */ "DropTable"        OpHelp(""),
+    /* 142 */ "DropIndex"        OpHelp(""),
+    /* 143 */ "DropTrigger"      OpHelp(""),
+    /* 144 */ "IntegrityCk"      OpHelp(""),
+    /* 145 */ "RowSetAdd"        OpHelp("rowset(P1)=r[P2]"),
+    /* 146 */ "Param"            OpHelp(""),
+    /* 147 */ "FkCounter"        OpHelp("fkctr[P1]+=P2"),
+    /* 148 */ "MemMax"           OpHelp("r[P1]=max(r[P1],r[P2])"),
+    /* 149 */ "OffsetLimit"      OpHelp("if r[P1]>0 then r[P2]=r[P1]+max(0,r[P3]) else r[P2]=(-1)"),
+    /* 150 */ "AggStep0"         OpHelp("accum=r[P3] step(r[P2@P5])"),
+    /* 151 */ "AggStep"          OpHelp("accum=r[P3] step(r[P2@P5])"),
+    /* 152 */ "AggFinal"         OpHelp("accum=r[P1] N=P2"),
+    /* 153 */ "Expire"           OpHelp(""),
+    /* 154 */ "TableLock"        OpHelp("iDb=P1 root=P2 write=P3"),
+    /* 155 */ "VBegin"           OpHelp(""),
+    /* 156 */ "VCreate"          OpHelp(""),
+    /* 157 */ "VDestroy"         OpHelp(""),
+    /* 158 */ "VOpen"            OpHelp(""),
+    /* 159 */ "VColumn"          OpHelp("r[P3]=vcolumn(P2)"),
+    /* 160 */ "VRename"          OpHelp(""),
+    /* 161 */ "Pagecount"        OpHelp(""),
+    /* 162 */ "MaxPgcnt"         OpHelp(""),
+    /* 163 */ "CursorHint"       OpHelp(""),
+    /* 164 */ "Noop"             OpHelp(""),
+    /* 165 */ "Explain"          OpHelp(""),
   };
   return azName[i];
 }
 #endif
 
 /************** End of opcodes.c *********************************************/
 /************** Begin file os_unix.c *****************************************/
 /*
@@ -45240,27 +45285,26 @@ static int pcache1InitBulk(PCache1 *pCac
   }
   if( szBulk > pCache->szAlloc*(i64)pCache->nMax ){
     szBulk = pCache->szAlloc*(i64)pCache->nMax;
   }
   zBulk = pCache->pBulk = sqlite3Malloc( szBulk );
   sqlite3EndBenignMalloc();
   if( zBulk ){
     int nBulk = sqlite3MallocSize(zBulk)/pCache->szAlloc;
-    int i;
-    for(i=0; i<nBulk; i++){
+    do{
       PgHdr1 *pX = (PgHdr1*)&zBulk[pCache->szPage];
       pX->page.pBuf = zBulk;
       pX->page.pExtra = &pX[1];
       pX->isBulkLocal = 1;
       pX->isAnchor = 0;
       pX->pNext = pCache->pFree;
       pCache->pFree = pX;
       zBulk += pCache->szAlloc;
-    }
+    }while( --nBulk );
   }
   return pCache->pFree!=0;
 }
 
 /*
 ** Malloc function used within this file to allocate space from the buffer
 ** configured using sqlite3_config(SQLITE_CONFIG_PAGECACHE) option. If no 
 ** such buffer exists or there is no space left in it, this function falls 
@@ -46166,17 +46210,17 @@ SQLITE_PRIVATE sqlite3_mutex *sqlite3Pca
 ** nReq is the number of bytes of memory required. Once this much has
 ** been released, the function returns. The return value is the total number 
 ** of bytes of memory released.
 */
 SQLITE_PRIVATE int sqlite3PcacheReleaseMemory(int nReq){
   int nFree = 0;
   assert( sqlite3_mutex_notheld(pcache1.grp.mutex) );
   assert( sqlite3_mutex_notheld(pcache1.mutex) );
-  if( sqlite3GlobalConfig.nPage==0 ){
+  if( sqlite3GlobalConfig.pPage==0 ){
     PgHdr1 *p;
     pcache1EnterMutex(&pcache1.grp);
     while( (nReq<0 || nFree<nReq)
        &&  (p=pcache1.grp.lru.pLruPrev)!=0
        &&  p->isAnchor==0
     ){
       nFree += pcache1MemSize(p->page.pBuf);
 #ifdef SQLITE_PCACHE_SEPARATE_HEADER
@@ -49126,16 +49170,21 @@ static int pager_playback_one_page(
 ){
   int rc;
   PgHdr *pPg;                   /* An existing page in the cache */
   Pgno pgno;                    /* The page number of a page in journal */
   u32 cksum;                    /* Checksum used for sanity checking */
   char *aData;                  /* Temporary storage for the page */
   sqlite3_file *jfd;            /* The file descriptor for the journal file */
   int isSynced;                 /* True if journal page is synced */
+#ifdef SQLITE_HAS_CODEC
+  /* The jrnlEnc flag is true if Journal pages should be passed through
+  ** the codec.  It is false for pure in-memory journals. */
+  const int jrnlEnc = (isMainJrnl || pPager->subjInMemory==0);
+#endif
 
   assert( (isMainJrnl&~1)==0 );      /* isMainJrnl is 0 or 1 */
   assert( (isSavepnt&~1)==0 );       /* isSavepnt is 0 or 1 */
   assert( isMainJrnl || pDone );     /* pDone always used on sub-journals */
   assert( isSavepnt || pDone==0 );   /* pDone never used on non-savepoint */
 
   aData = pPager->pTmpSpace;
   assert( aData );         /* Temp storage must have already been allocated */
@@ -49249,24 +49298,44 @@ static int pager_playback_one_page(
   }
   if( isOpen(pPager->fd)
    && (pPager->eState>=PAGER_WRITER_DBMOD || pPager->eState==PAGER_OPEN)
    && isSynced
   ){
     i64 ofst = (pgno-1)*(i64)pPager->pageSize;
     testcase( !isSavepnt && pPg!=0 && (pPg->flags&PGHDR_NEED_SYNC)!=0 );
     assert( !pagerUseWal(pPager) );
+
+    /* Write the data read from the journal back into the database file.
+    ** This is usually safe even for an encrypted database - as the data
+    ** was encrypted before it was written to the journal file. The exception
+    ** is if the data was just read from an in-memory sub-journal. In that
+    ** case it must be encrypted here before it is copied into the database
+    ** file.  */
+#ifdef SQLITE_HAS_CODEC
+    if( !jrnlEnc ){
+      CODEC2(pPager, aData, pgno, 7, rc=SQLITE_NOMEM_BKPT, aData);
+      rc = sqlite3OsWrite(pPager->fd, (u8 *)aData, pPager->pageSize, ofst);
+      CODEC1(pPager, aData, pgno, 3, rc=SQLITE_NOMEM_BKPT);
+    }else
+#endif
     rc = sqlite3OsWrite(pPager->fd, (u8 *)aData, pPager->pageSize, ofst);
+
     if( pgno>pPager->dbFileSize ){
       pPager->dbFileSize = pgno;
     }
     if( pPager->pBackup ){
-      CODEC1(pPager, aData, pgno, 3, rc=SQLITE_NOMEM_BKPT);
+#ifdef SQLITE_HAS_CODEC
+      if( jrnlEnc ){
+        CODEC1(pPager, aData, pgno, 3, rc=SQLITE_NOMEM_BKPT);
+        sqlite3BackupUpdate(pPager->pBackup, pgno, (u8*)aData);
+        CODEC2(pPager, aData, pgno, 7, rc=SQLITE_NOMEM_BKPT,aData);
+      }else
+#endif
       sqlite3BackupUpdate(pPager->pBackup, pgno, (u8*)aData);
-      CODEC2(pPager, aData, pgno, 7, rc=SQLITE_NOMEM_BKPT, aData);
     }
   }else if( !isMainJrnl && pPg==0 ){
     /* If this is a rollback of a savepoint and data was not written to
     ** the database and the page is not in-memory, there is a potential
     ** problem. When the page is next fetched by the b-tree layer, it 
     ** will be read from the database file, which may or may not be 
     ** current. 
     **
@@ -49308,17 +49377,19 @@ static int pager_playback_one_page(
 
     /* If this was page 1, then restore the value of Pager.dbFileVers.
     ** Do this before any decoding. */
     if( pgno==1 ){
       memcpy(&pPager->dbFileVers, &((u8*)pData)[24],sizeof(pPager->dbFileVers));
     }
 
     /* Decode the page just read from disk */
-    CODEC1(pPager, pData, pPg->pgno, 3, rc=SQLITE_NOMEM_BKPT);
+#if SQLITE_HAS_CODEC
+    if( jrnlEnc ){ CODEC1(pPager, pData, pPg->pgno, 3, rc=SQLITE_NOMEM_BKPT); }
+#endif
     sqlite3PcacheRelease(pPg);
   }
   return rc;
 }
 
 /*
 ** Parameter zMaster is the name of a master journal file. A single journal
 ** file that referred to the master journal file has just been rolled back.
@@ -51320,18 +51391,23 @@ static int subjournalPage(PgHdr *pPg){
     rc = openSubJournal(pPager);
 
     /* If the sub-journal was opened successfully (or was already open),
     ** write the journal record into the file.  */
     if( rc==SQLITE_OK ){
       void *pData = pPg->pData;
       i64 offset = (i64)pPager->nSubRec*(4+pPager->pageSize);
       char *pData2;
-  
-      CODEC2(pPager, pData, pPg->pgno, 7, return SQLITE_NOMEM_BKPT, pData2);
+
+#if SQLITE_HAS_CODEC   
+      if( !pPager->subjInMemory ){
+        CODEC2(pPager, pData, pPg->pgno, 7, return SQLITE_NOMEM_BKPT, pData2);
+      }else
+#endif
+      pData2 = pData;
       PAGERTRACE(("STMT-JOURNAL %d page %d\n", PAGERID(pPager), pPg->pgno));
       rc = write32bits(pPager->sjfd, offset, pPg->pgno);
       if( rc==SQLITE_OK ){
         rc = sqlite3OsWrite(pPager->sjfd, pData2, pPager->pageSize, offset+4);
       }
     }
   }
   if( rc==SQLITE_OK ){
@@ -58473,20 +58549,20 @@ struct BtCursor {
   u8 curPagerFlags;         /* Flags to send to sqlite3PagerGet() */
   u8 eState;                /* One of the CURSOR_XXX constants (see below) */
   u8 hints;                 /* As configured by CursorSetHints() */
   /* All fields above are zeroed when the cursor is allocated.  See
   ** sqlite3BtreeCursorZero().  Fields that follow must be manually
   ** initialized. */
   i8 iPage;                 /* Index of current page in apPage */
   u8 curIntKey;             /* Value of apPage[0]->intKey */
-  struct KeyInfo *pKeyInfo; /* Argument passed to comparison function */
-  void *padding1;           /* Make object size a multiple of 16 */
-  u16 aiIdx[BTCURSOR_MAX_DEPTH];        /* Current index in apPage[i] */
-  MemPage *apPage[BTCURSOR_MAX_DEPTH];  /* Pages from root to current page */
+  u16 ix;                   /* Current index for apPage[iPage] */
+  u16 aiIdx[BTCURSOR_MAX_DEPTH-1];     /* Current index in apPage[i] */
+  struct KeyInfo *pKeyInfo;            /* Arg passed to comparison function */
+  MemPage *apPage[BTCURSOR_MAX_DEPTH]; /* Pages from root to current page */
 };
 
 /*
 ** Legal values for BtCursor.curFlags
 */
 #define BTCF_WriteFlag    0x01   /* True if a write cursor */
 #define BTCF_ValidNKey    0x02   /* True if info.nKey is valid */
 #define BTCF_ValidOvfl    0x04   /* True if aOverflow is valid */
@@ -59452,36 +59528,37 @@ static void invalidateAllOverflowCache(B
 ** cursors open on any row within the table with root-page pgnoRoot.
 **
 ** Otherwise, if argument isClearTable is false, then the row with
 ** rowid iRow is being replaced or deleted. In this case invalidate
 ** only those incrblob cursors open on that specific row.
 */
 static void invalidateIncrblobCursors(
   Btree *pBtree,          /* The database file to check */
+  Pgno pgnoRoot,          /* The table that might be changing */
   i64 iRow,               /* The rowid that might be changing */
   int isClearTable        /* True if all rows are being deleted */
 ){
   BtCursor *p;
   if( pBtree->hasIncrblobCur==0 ) return;
   assert( sqlite3BtreeHoldsMutex(pBtree) );
   pBtree->hasIncrblobCur = 0;
   for(p=pBtree->pBt->pCursor; p; p=p->pNext){
     if( (p->curFlags & BTCF_Incrblob)!=0 ){
       pBtree->hasIncrblobCur = 1;
-      if( isClearTable || p->info.nKey==iRow ){
+      if( p->pgnoRoot==pgnoRoot && (isClearTable || p->info.nKey==iRow) ){
         p->eState = CURSOR_INVALID;
       }
     }
   }
 }
 
 #else
   /* Stub function when INCRBLOB is omitted */
-  #define invalidateIncrblobCursors(x,y,z)
+  #define invalidateIncrblobCursors(w,x,y,z)
 #endif /* SQLITE_OMIT_INCRBLOB */
 
 /*
 ** Set bit pgno of the BtShared.pHasContent bitvec. This is called 
 ** when a page that previously contained data becomes a free-list leaf 
 ** page.
 **
 ** The BtShared.pHasContent bitvec exists to work around an obscure
@@ -63269,27 +63346,27 @@ SQLITE_PRIVATE int sqlite3BtreeCloseCurs
 ** BtCursor.info is a cache of the information in the current cell.
 ** Using this cache reduces the number of calls to btreeParseCell().
 */
 #ifndef NDEBUG
   static void assertCellInfo(BtCursor *pCur){
     CellInfo info;
     int iPage = pCur->iPage;
     memset(&info, 0, sizeof(info));
-    btreeParseCell(pCur->apPage[iPage], pCur->aiIdx[iPage], &info);
+    btreeParseCell(pCur->apPage[iPage], pCur->ix, &info);
     assert( CORRUPT_DB || memcmp(&info, &pCur->info, sizeof(info))==0 );
   }
 #else
   #define assertCellInfo(x)
 #endif
 static SQLITE_NOINLINE void getCellInfo(BtCursor *pCur){
   if( pCur->info.nSize==0 ){
     int iPage = pCur->iPage;
     pCur->curFlags |= BTCF_ValidNKey;
-    btreeParseCell(pCur->apPage[iPage],pCur->aiIdx[iPage],&pCur->info);
+    btreeParseCell(pCur->apPage[iPage],pCur->ix,&pCur->info);
   }else{
     assertCellInfo(pCur);
   }
 }
 
 #ifndef NDEBUG  /* The next routine used only within assert() statements */
 /*
 ** Return true if the given BtCursor is valid.  A valid cursor is one
@@ -63486,17 +63563,17 @@ static int accessPayload(
   BtShared *pBt = pCur->pBt;                  /* Btree this cursor belongs to */
 #ifdef SQLITE_DIRECT_OVERFLOW_READ
   unsigned char * const pBufStart = pBuf;     /* Start of original out buffer */
 #endif
 
   assert( pPage );
   assert( eOp==0 || eOp==1 );
   assert( pCur->eState==CURSOR_VALID );
-  assert( pCur->aiIdx[pCur->iPage]<pPage->nCell );
+  assert( pCur->ix<pPage->nCell );
   assert( cursorHoldsMutex(pCur) );
 
   getCellInfo(pCur);
   aPayload = pCur->info.pPayload;
   assert( offset+amt <= pCur->info.nPayload );
 
   assert( aPayload > pPage->aData );
   if( (uptr)(aPayload - pPage->aData) > (pBt->usableSize - pCur->info.nLocal) ){
@@ -63673,17 +63750,17 @@ static int accessPayload(
 ** Return SQLITE_OK on success or an error code if anything goes
 ** wrong.  An error is returned if "offset+amt" is larger than
 ** the available payload.
 */
 SQLITE_PRIVATE int sqlite3BtreePayload(BtCursor *pCur, u32 offset, u32 amt, void *pBuf){
   assert( cursorHoldsMutex(pCur) );
   assert( pCur->eState==CURSOR_VALID );
   assert( pCur->iPage>=0 && pCur->apPage[pCur->iPage] );
-  assert( pCur->aiIdx[pCur->iPage]<pCur->apPage[pCur->iPage]->nCell );
+  assert( pCur->ix<pCur->apPage[pCur->iPage]->nCell );
   return accessPayload(pCur, offset, amt, (unsigned char*)pBuf, 0);
 }
 
 /*
 ** This variant of sqlite3BtreePayload() works even if the cursor has not
 ** in the CURSOR_VALID state.  It is only used by the sqlite3_blob_read()
 ** interface.
 */
@@ -63735,17 +63812,17 @@ static const void *fetchPayload(
   BtCursor *pCur,      /* Cursor pointing to entry to read from */
   u32 *pAmt            /* Write the number of available bytes here */
 ){
   u32 amt;
   assert( pCur!=0 && pCur->iPage>=0 && pCur->apPage[pCur->iPage]);
   assert( pCur->eState==CURSOR_VALID );
   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
   assert( cursorOwnsBtShared(pCur) );
-  assert( pCur->aiIdx[pCur->iPage]<pCur->apPage[pCur->iPage]->nCell );
+  assert( pCur->ix<pCur->apPage[pCur->iPage]->nCell );
   assert( pCur->info.nSize>0 );
   assert( pCur->info.pPayload>pCur->apPage[pCur->iPage]->aData || CORRUPT_DB );
   assert( pCur->info.pPayload<pCur->apPage[pCur->iPage]->aDataEnd ||CORRUPT_DB);
   amt = (int)(pCur->apPage[pCur->iPage]->aDataEnd - pCur->info.pPayload);
   if( pCur->info.nLocal<amt ) amt = pCur->info.nLocal;
   *pAmt = amt;
   return (void*)pCur->info.pPayload;
 }
@@ -63786,18 +63863,18 @@ static int moveToChild(BtCursor *pCur, u
   assert( pCur->eState==CURSOR_VALID );
   assert( pCur->iPage<BTCURSOR_MAX_DEPTH );
   assert( pCur->iPage>=0 );
   if( pCur->iPage>=(BTCURSOR_MAX_DEPTH-1) ){
     return SQLITE_CORRUPT_BKPT;
   }
   pCur->info.nSize = 0;
   pCur->curFlags &= ~(BTCF_ValidNKey|BTCF_ValidOvfl);
-  pCur->iPage++;
-  pCur->aiIdx[pCur->iPage] = 0;
+  pCur->aiIdx[pCur->iPage++] = pCur->ix;
+  pCur->ix = 0;
   return getAndInitPage(pBt, newPgno, &pCur->apPage[pCur->iPage],
                         pCur, pCur->curPagerFlags);
 }
 
 #ifdef SQLITE_DEBUG
 /*
 ** Page pParent is an internal (non-leaf) tree page. This function 
 ** asserts that page number iChild is the left-child if the iIdx'th
@@ -63835,16 +63912,17 @@ static void moveToParent(BtCursor *pCur)
   assertParentIndex(
     pCur->apPage[pCur->iPage-1], 
     pCur->aiIdx[pCur->iPage-1], 
     pCur->apPage[pCur->iPage]->pgno
   );
   testcase( pCur->aiIdx[pCur->iPage-1] > pCur->apPage[pCur->iPage-1]->nCell );
   pCur->info.nSize = 0;
   pCur->curFlags &= ~(BTCF_ValidNKey|BTCF_ValidOvfl);
+  pCur->ix = pCur->aiIdx[pCur->iPage-1];
   releasePageNotNull(pCur->apPage[pCur->iPage--]);
 }
 
 /*
 ** Move the cursor to point to the root page of its b-tree structure.
 **
 ** If the table has a virtual root page, then the cursor is moved to point
 ** to the virtual root page instead of the actual root page. A table has a
@@ -63916,17 +63994,17 @@ static int moveToRoot(BtCursor *pCur){
   ** in such a way that page pRoot is linked into a second b-tree table 
   ** (or the freelist).  */
   assert( pRoot->intKey==1 || pRoot->intKey==0 );
   if( pRoot->isInit==0 || (pCur->pKeyInfo==0)!=pRoot->intKey ){
     return SQLITE_CORRUPT_BKPT;
   }
 
 skip_init:  
-  pCur->aiIdx[0] = 0;
+  pCur->ix = 0;
   pCur->info.nSize = 0;
   pCur->curFlags &= ~(BTCF_AtLast|BTCF_ValidNKey|BTCF_ValidOvfl);
 
   pRoot = pCur->apPage[0];
   if( pRoot->nCell>0 ){
     pCur->eState = CURSOR_VALID;
   }else if( !pRoot->leaf ){
     Pgno subpage;
@@ -63950,18 +64028,18 @@ skip_init:
 static int moveToLeftmost(BtCursor *pCur){
   Pgno pgno;
   int rc = SQLITE_OK;
   MemPage *pPage;
 
   assert( cursorOwnsBtShared(pCur) );
   assert( pCur->eState==CURSOR_VALID );
   while( rc==SQLITE_OK && !(pPage = pCur->apPage[pCur->iPage])->leaf ){
-    assert( pCur->aiIdx[pCur->iPage]<pPage->nCell );
-    pgno = get4byte(findCell(pPage, pCur->aiIdx[pCur->iPage]));
+    assert( pCur->ix<pPage->nCell );
+    pgno = get4byte(findCell(pPage, pCur->ix));
     rc = moveToChild(pCur, pgno);
   }
   return rc;
 }
 
 /*
 ** Move the cursor down to the right-most leaf entry beneath the
 ** page to which it is currently pointing.  Notice the difference
@@ -63976,21 +64054,21 @@ static int moveToRightmost(BtCursor *pCu
   Pgno pgno;
   int rc = SQLITE_OK;
   MemPage *pPage = 0;
 
   assert( cursorOwnsBtShared(pCur) );
   assert( pCur->eState==CURSOR_VALID );
   while( !(pPage = pCur->apPage[pCur->iPage])->leaf ){
     pgno = get4byte(&pPage->aData[pPage->hdrOffset+8]);
-    pCur->aiIdx[pCur->iPage] = pPage->nCell;
+    pCur->ix = pPage->nCell;
     rc = moveToChild(pCur, pgno);
     if( rc ) return rc;
   }
-  pCur->aiIdx[pCur->iPage] = pPage->nCell-1;
+  pCur->ix = pPage->nCell-1;
   assert( pCur->info.nSize==0 );
   assert( (pCur->curFlags & BTCF_ValidNKey)==0 );
   return SQLITE_OK;
 }
 
 /* Move the cursor to the first entry in the table.  Return SQLITE_OK
 ** on success.  Set *pRes to 0 if the cursor actually points to something
 ** or set *pRes to 1 if the table is empty.
@@ -64028,17 +64106,17 @@ SQLITE_PRIVATE int sqlite3BtreeLast(BtCu
   if( CURSOR_VALID==pCur->eState && (pCur->curFlags & BTCF_AtLast)!=0 ){
 #ifdef SQLITE_DEBUG
     /* This block serves to assert() that the cursor really does point 
     ** to the last entry in the b-tree. */
     int ii;
     for(ii=0; ii<pCur->iPage; ii++){
       assert( pCur->aiIdx[ii]==pCur->apPage[ii]->nCell );
     }
-    assert( pCur->aiIdx[pCur->iPage]==pCur->apPage[pCur->iPage]->nCell-1 );
+    assert( pCur->ix==pCur->apPage[pCur->iPage]->nCell-1 );
     assert( pCur->apPage[pCur->iPage]->leaf );
 #endif
     return SQLITE_OK;
   }
 
   rc = moveToRoot(pCur);
   if( rc==SQLITE_OK ){
     if( CURSOR_INVALID==pCur->eState ){
@@ -64175,17 +64253,17 @@ SQLITE_PRIVATE int sqlite3BtreeMovetoUnp
     ** be the right kind (index or table) of b-tree page. Otherwise
     ** a moveToChild() or moveToRoot() call would have detected corruption.  */
     assert( pPage->nCell>0 );
     assert( pPage->intKey==(pIdxKey==0) );
     lwr = 0;
     upr = pPage->nCell-1;
     assert( biasRight==0 || biasRight==1 );
     idx = upr>>(1-biasRight); /* idx = biasRight ? upr : (lwr+upr)/2; */
-    pCur->aiIdx[pCur->iPage] = (u16)idx;
+    pCur->ix = (u16)idx;
     if( xRecordCompare==0 ){
       for(;;){
         i64 nCellKey;
         pCell = findCellPastPtr(pPage, idx);
         if( pPage->intKeyLeaf ){
           while( 0x80 <= *(pCell++) ){
             if( pCell>=pPage->aDataEnd ) return SQLITE_CORRUPT_BKPT;
           }
@@ -64194,17 +64272,17 @@ SQLITE_PRIVATE int sqlite3BtreeMovetoUnp
         if( nCellKey<intKey ){
           lwr = idx+1;
           if( lwr>upr ){ c = -1; break; }
         }else if( nCellKey>intKey ){
           upr = idx-1;
           if( lwr>upr ){ c = +1; break; }
         }else{
           assert( nCellKey==intKey );
-          pCur->aiIdx[pCur->iPage] = (u16)idx;
+          pCur->ix = (u16)idx;
           if( !pPage->leaf ){
             lwr = idx;
             goto moveto_next_layer;
           }else{
             pCur->curFlags |= BTCF_ValidNKey;
             pCur->info.nKey = nCellKey;
             pCur->info.nSize = 0;
             *pRes = 0;
@@ -64263,17 +64341,17 @@ SQLITE_PRIVATE int sqlite3BtreeMovetoUnp
             rc = SQLITE_CORRUPT_BKPT;
             goto moveto_finish;
           }
           pCellKey = sqlite3Malloc( nCell+18 );
           if( pCellKey==0 ){
             rc = SQLITE_NOMEM_BKPT;
             goto moveto_finish;
           }
-          pCur->aiIdx[pCur->iPage] = (u16)idx;
+          pCur->ix = (u16)idx;
           rc = accessPayload(pCur, 0, nCell, (unsigned char*)pCellKey, 0);
           pCur->curFlags &= ~BTCF_ValidOvfl;
           if( rc ){
             sqlite3_free(pCellKey);
             goto moveto_finish;
           }
           c = xRecordCompare(nCell, pCellKey, pIdxKey);
           sqlite3_free(pCellKey);
@@ -64285,41 +64363,41 @@ SQLITE_PRIVATE int sqlite3BtreeMovetoUnp
         if( c<0 ){
           lwr = idx+1;
         }else if( c>0 ){
           upr = idx-1;
         }else{
           assert( c==0 );
           *pRes = 0;
           rc = SQLITE_OK;
-          pCur->aiIdx[pCur->iPage] = (u16)idx;
+          pCur->ix = (u16)idx;
           if( pIdxKey->errCode ) rc = SQLITE_CORRUPT;
           goto moveto_finish;
         }
         if( lwr>upr ) break;
         assert( lwr+upr>=0 );
         idx = (lwr+upr)>>1;  /* idx = (lwr+upr)/2 */
       }
     }
     assert( lwr==upr+1 || (pPage->intKey && !pPage->leaf) );
     assert( pPage->isInit );
     if( pPage->leaf ){
-      assert( pCur->aiIdx[pCur->iPage]<pCur->apPage[pCur->iPage]->nCell );
-      pCur->aiIdx[pCur->iPage] = (u16)idx;
+      assert( pCur->ix<pCur->apPage[pCur->iPage]->nCell );
+      pCur->ix = (u16)idx;
       *pRes = c;
       rc = SQLITE_OK;
       goto moveto_finish;
     }
 moveto_next_layer:
     if( lwr>=pPage->nCell ){
       chldPg = get4byte(&pPage->aData[pPage->hdrOffset+8]);
     }else{
       chldPg = get4byte(findCell(pPage, lwr));
     }
-    pCur->aiIdx[pCur->iPage] = (u16)lwr;
+    pCur->ix = (u16)lwr;
     rc = moveToChild(pCur, chldPg);
     if( rc ) break;
   }
 moveto_finish:
   pCur->info.nSize = 0;
   assert( (pCur->curFlags & BTCF_ValidOvfl)==0 );
   return rc;
 }
@@ -64410,17 +64488,17 @@ static SQLITE_NOINLINE int btreeNext(BtC
         pCur->skipNext = 0;
         return SQLITE_OK;
       }
       pCur->skipNext = 0;
     }
   }
 
   pPage = pCur->apPage[pCur->iPage];
-  idx = ++pCur->aiIdx[pCur->iPage];
+  idx = ++pCur->ix;
   assert( pPage->isInit );
 
   /* If the database file is corrupt, it is possible for the value of idx 
   ** to be invalid here. This can only occur if a second cursor modifies
   ** the page while cursor pCur is holding a reference to it. Which can
   ** only happen if the database is corrupt in such a way as to link the
   ** page into more than one b-tree structure. */
   testcase( idx>pPage->nCell );
@@ -64434,17 +64512,17 @@ static SQLITE_NOINLINE int btreeNext(BtC
     do{
       if( pCur->iPage==0 ){
         *pRes = 1;
         pCur->eState = CURSOR_INVALID;
         return SQLITE_OK;
       }
       moveToParent(pCur);
       pPage = pCur->apPage[pCur->iPage];
-    }while( pCur->aiIdx[pCur->iPage]>=pPage->nCell );
+    }while( pCur->ix>=pPage->nCell );
     if( pPage->intKey ){
       return sqlite3BtreeNext(pCur, pRes);
     }else{
       return SQLITE_OK;
     }
   }
   if( pPage->leaf ){
     return SQLITE_OK;
@@ -64458,18 +64536,18 @@ SQLITE_PRIVATE int sqlite3BtreeNext(BtCu
   assert( pRes!=0 );
   assert( *pRes==0 || *pRes==1 );
   assert( pCur->skipNext==0 || pCur->eState!=CURSOR_VALID );
   pCur->info.nSize = 0;
   pCur->curFlags &= ~(BTCF_ValidNKey|BTCF_ValidOvfl);
   *pRes = 0;
   if( pCur->eState!=CURSOR_VALID ) return btreeNext(pCur, pRes);
   pPage = pCur->apPage[pCur->iPage];
-  if( (++pCur->aiIdx[pCur->iPage])>=pPage->nCell ){
-    pCur->aiIdx[pCur->iPage]--;
+  if( (++pCur->ix)>=pPage->nCell ){
+    pCur->ix--;
     return btreeNext(pCur, pRes);
   }
   if( pPage->leaf ){
     return SQLITE_OK;
   }else{
     return moveToLeftmost(pCur);
   }
 }
@@ -64523,33 +64601,33 @@ static SQLITE_NOINLINE int btreePrevious
       }
       pCur->skipNext = 0;
     }
   }
 
   pPage = pCur->apPage[pCur->iPage];
   assert( pPage->isInit );
   if( !pPage->leaf ){
-    int idx = pCur->aiIdx[pCur->iPage];
+    int idx = pCur->ix;
     rc = moveToChild(pCur, get4byte(findCell(pPage, idx)));
     if( rc ) return rc;
     rc = moveToRightmost(pCur);
   }else{
-    while( pCur->aiIdx[pCur->iPage]==0 ){
+    while( pCur->ix==0 ){
       if( pCur->iPage==0 ){
         pCur->eState = CURSOR_INVALID;
         *pRes = 1;
         return SQLITE_OK;
       }
       moveToParent(pCur);
     }
     assert( pCur->info.nSize==0 );
     assert( (pCur->curFlags & (BTCF_ValidOvfl))==0 );
 
-    pCur->aiIdx[pCur->iPage]--;
+    pCur->ix--;
     pPage = pCur->apPage[pCur->iPage];
     if( pPage->intKey && !pPage->leaf ){
       rc = sqlite3BtreePrevious(pCur, pRes);
     }else{
       rc = SQLITE_OK;
     }
   }
   return rc;
@@ -64558,22 +64636,22 @@ SQLITE_PRIVATE int sqlite3BtreePrevious(
   assert( cursorOwnsBtShared(pCur) );
   assert( pRes!=0 );
   assert( *pRes==0 || *pRes==1 );
   assert( pCur->skipNext==0 || pCur->eState!=CURSOR_VALID );
   *pRes = 0;
   pCur->curFlags &= ~(BTCF_AtLast|BTCF_ValidOvfl|BTCF_ValidNKey);
   pCur->info.nSize = 0;
   if( pCur->eState!=CURSOR_VALID
-   || pCur->aiIdx[pCur->iPage]==0
+   || pCur->ix==0
    || pCur->apPage[pCur->iPage]->leaf==0
   ){
     return btreePrevious(pCur, pRes);
   }
-  pCur->aiIdx[pCur->iPage]--;
+  pCur->ix--;
   return SQLITE_OK;
 }
 
 /*
 ** Allocate a new page from the database file.
 **
 ** The new page is marked as dirty.  (In other words, sqlite3PagerWrite()
 ** has already been called on the new page.)  The new page has also
@@ -66885,18 +66963,18 @@ static int balance(BtCursor *pCur){
         ** and copy the current contents of the root-page to it. The
         ** next iteration of the do-loop will balance the child page.
         */ 
         assert( balance_deeper_called==0 );
         VVA_ONLY( balance_deeper_called++ );
         rc = balance_deeper(pPage, &pCur->apPage[1]);
         if( rc==SQLITE_OK ){
           pCur->iPage = 1;
+          pCur->ix = 0;
           pCur->aiIdx[0] = 0;
-          pCur->aiIdx[1] = 0;
           assert( pCur->apPage[1]->nOverflow );
         }
       }else{
         break;
       }
     }else if( pPage->nOverflow==0 && pPage->nFree<=nMin ){
       break;
     }else{
@@ -67063,31 +67141,28 @@ SQLITE_PRIVATE int sqlite3BtreeInsert(
     rc = saveAllCursors(pBt, pCur->pgnoRoot, pCur);
     if( rc ) return rc;
   }
 
   if( pCur->pKeyInfo==0 ){
     assert( pX->pKey==0 );
     /* If this is an insert into a table b-tree, invalidate any incrblob 
     ** cursors open on the row being replaced */
-    invalidateIncrblobCursors(p, pX->nKey, 0);
+    invalidateIncrblobCursors(p, pCur->pgnoRoot, pX->nKey, 0);
 
     /* If BTREE_SAVEPOSITION is set, the cursor must already be pointing 
     ** to a row with the same key as the new entry being inserted.  */
     assert( (flags & BTREE_SAVEPOSITION)==0 || 
             ((pCur->curFlags&BTCF_ValidNKey)!=0 && pX->nKey==pCur->info.nKey) );
 
     /* If the cursor is currently on the last row and we are appending a
     ** new row onto the end, set the "loc" to avoid an unnecessary
     ** btreeMoveto() call */
     if( (pCur->curFlags&BTCF_ValidNKey)!=0 && pX->nKey==pCur->info.nKey ){
       loc = 0;
-    }else if( (pCur->curFlags&BTCF_ValidNKey)!=0 && pX->nKey>0
-               && pCur->info.nKey==pX->nKey-1 ){
-      loc = -1;
     }else if( loc==0 ){
       rc = sqlite3BtreeMovetoUnpacked(pCur, 0, pX->nKey, flags!=0, &loc);
       if( rc ) return rc;
     }
   }else if( loc==0 && (flags & BTREE_SAVEPOSITION)==0 ){
     if( pX->nMem ){
       UnpackedRecord r;
       r.pKeyInfo = pCur->pKeyInfo;
@@ -67115,17 +67190,17 @@ SQLITE_PRIVATE int sqlite3BtreeInsert(
           loc==0 ? "overwrite" : "new entry"));
   assert( pPage->isInit );
   newCell = pBt->pTmpSpace;
   assert( newCell!=0 );
   rc = fillInCell(pPage, newCell, pX, &szNew);
   if( rc ) goto end_insert;
   assert( szNew==pPage->xCellSize(pPage, newCell) );
   assert( szNew <= MX_CELL_SIZE(pBt) );
-  idx = pCur->aiIdx[pCur->iPage];
+  idx = pCur->ix;
   if( loc==0 ){
     CellInfo info;
     assert( idx<pPage->nCell );
     rc = sqlite3PagerWrite(pPage->pDbPage);
     if( rc ){
       goto end_insert;
     }
     oldCell = findCell(pPage, idx);
@@ -67143,17 +67218,18 @@ SQLITE_PRIVATE int sqlite3BtreeInsert(
       if( oldCell+szNew > pPage->aDataEnd ) return SQLITE_CORRUPT_BKPT;
       memcpy(oldCell, newCell, szNew);
       return SQLITE_OK;
     }
     dropCell(pPage, idx, info.nSize, &rc);
     if( rc ) goto end_insert;
   }else if( loc<0 && pPage->nCell>0 ){
     assert( pPage->leaf );
-    idx = ++pCur->aiIdx[pCur->iPage];
+    idx = ++pCur->ix;
+    pCur->curFlags &= ~BTCF_ValidNKey;
   }else{
     assert( pPage->leaf );
   }
   insertCell(pPage, idx, newCell, szNew, 0, 0, &rc);
   assert( pPage->nOverflow==0 || rc==SQLITE_OK );
   assert( rc!=SQLITE_OK || pPage->nCell>0 || pPage->nOverflow>0 );
 
   /* If no error has occurred and pPage has an overflow cell, call balance() 
@@ -67239,22 +67315,22 @@ SQLITE_PRIVATE int sqlite3BtreeDelete(Bt
   u8 bPreserve = flags & BTREE_SAVEPOSITION;  /* Keep cursor valid */
 
   assert( cursorOwnsBtShared(pCur) );
   assert( pBt->inTransaction==TRANS_WRITE );
   assert( (pBt->btsFlags & BTS_READ_ONLY)==0 );
   assert( pCur->curFlags & BTCF_WriteFlag );
   assert( hasSharedCacheTableLock(p, pCur->pgnoRoot, pCur->pKeyInfo!=0, 2) );
   assert( !hasReadConflicts(p, pCur->pgnoRoot) );
-  assert( pCur->aiIdx[pCur->iPage]<pCur->apPage[pCur->iPage]->nCell );
+  assert( pCur->ix<pCur->apPage[pCur->iPage]->nCell );
   assert( pCur->eState==CURSOR_VALID );
   assert( (flags & ~(BTREE_SAVEPOSITION | BTREE_AUXDELETE))==0 );
 
   iCellDepth = pCur->iPage;
-  iCellIdx = pCur->aiIdx[iCellDepth];
+  iCellIdx = pCur->ix;
   pPage = pCur->apPage[iCellDepth];
   pCell = findCell(pPage, iCellIdx);
 
   /* If the bPreserve flag is set to true, then the cursor position must
   ** be preserved following this delete operation. If the current delete
   ** will cause a b-tree rebalance, then this is done by saving the cursor
   ** key and leaving the cursor in CURSOR_REQUIRESEEK state before 
   ** returning. 
@@ -67293,17 +67369,17 @@ SQLITE_PRIVATE int sqlite3BtreeDelete(Bt
   if( pCur->curFlags & BTCF_Multiple ){
     rc = saveAllCursors(pBt, pCur->pgnoRoot, pCur);
     if( rc ) return rc;
   }
 
   /* If this is a delete operation to remove a row from a table b-tree,
   ** invalidate any incrblob cursors open on the row being deleted.  */
   if( pCur->pKeyInfo==0 ){
-    invalidateIncrblobCursors(p, pCur->info.nKey, 0);
+    invalidateIncrblobCursors(p, pCur->pgnoRoot, pCur->info.nKey, 0);
   }
 
   /* Make the page containing the entry to be deleted writable. Then free any
   ** overflow pages associated with the entry and finally remove the cell
   ** itself from within the page.  */
   rc = sqlite3PagerWrite(pPage->pDbPage);
   if( rc ) return rc;
   rc = clearCell(pPage, pCell, &info);
@@ -67361,17 +67437,17 @@ SQLITE_PRIVATE int sqlite3BtreeDelete(Bt
   if( rc==SQLITE_OK ){
     if( bSkipnext ){
       assert( bPreserve && (pCur->iPage==iCellDepth || CORRUPT_DB) );
       assert( pPage==pCur->apPage[pCur->iPage] || CORRUPT_DB );
       assert( (pPage->nCell>0 || CORRUPT_DB) && iCellIdx<=pPage->nCell );
       pCur->eState = CURSOR_SKIPNEXT;
       if( iCellIdx>=pPage->nCell ){
         pCur->skipNext = -1;
-        pCur->aiIdx[iCellDepth] = pPage->nCell-1;
+        pCur->ix = pPage->nCell-1;
       }else{
         pCur->skipNext = 1;
       }
     }else{
       rc = moveToRoot(pCur);
       if( bPreserve ){
         pCur->eState = CURSOR_REQUIRESEEK;
       }
@@ -67620,17 +67696,17 @@ SQLITE_PRIVATE int sqlite3BtreeClearTabl
   assert( p->inTrans==TRANS_WRITE );
 
   rc = saveAllCursors(pBt, (Pgno)iTable, 0);
 
   if( SQLITE_OK==rc ){
     /* Invalidate all incrblob cursors open on table iTable (assuming iTable
     ** is the root of a table b-tree - if it is not, the following call is
     ** a no-op).  */
-    invalidateIncrblobCursors(p, 0, 1);
+    invalidateIncrblobCursors(p, (Pgno)iTable, 0, 1);
     rc = clearDatabasePage(pBt, (Pgno)iTable, 0, pnChange);
   }
   sqlite3BtreeLeave(p);
   return rc;
 }
 
 /*
 ** Delete all information from the single table that pCur is open on.
@@ -67874,26 +67950,26 @@ SQLITE_PRIVATE int sqlite3BtreeCount(BtC
     if( pPage->leaf ){
       do {
         if( pCur->iPage==0 ){
           /* All pages of the b-tree have been visited. Return successfully. */
           *pnEntry = nEntry;
           return moveToRoot(pCur);
         }
         moveToParent(pCur);
-      }while ( pCur->aiIdx[pCur->iPage]>=pCur->apPage[pCur->iPage]->nCell );
-
-      pCur->aiIdx[pCur->iPage]++;
+      }while ( pCur->ix>=pCur->apPage[pCur->iPage]->nCell );
+
+      pCur->ix++;
       pPage = pCur->apPage[pCur->iPage];
     }
 
     /* Descend to the child node of the cell that the cursor currently 
     ** points at. This is the right-child if (iIdx==pPage->nCell).
     */
-    iIdx = pCur->aiIdx[pCur->iPage];
+    iIdx = pCur->ix;
     if( iIdx==pPage->nCell ){
       rc = moveToChild(pCur, get4byte(&pPage->aData[pPage->hdrOffset+8]));
     }else{
       rc = moveToChild(pCur, get4byte(findCell(pPage, iIdx)));
     }
   }
 
   /* An error has occurred. Return an error code. */
@@ -68268,16 +68344,17 @@ static int checkTreePage(
     }
 
     /* Check for integer primary key out of range */
     if( pPage->intKey ){
       if( keyCanBeEqual ? (info.nKey > maxKey) : (info.nKey >= maxKey) ){
         checkAppendMsg(pCheck, "Rowid %lld out of order", info.nKey);
       }
       maxKey = info.nKey;
+      keyCanBeEqual = 0;     /* Only the first key on the page may ==maxKey */
     }
 
     /* Check the content overflow list */
     if( info.nPayload>info.nLocal ){
       int nPage;       /* Number of pages on the overflow chain */
       Pgno pgnoOvfl;   /* First page of the overflow chain */
       assert( pc + info.nSize - 4 <= usableSize );
       nPage = (info.nPayload - info.nLocal + usableSize - 5)/(usableSize - 4);
@@ -69653,16 +69730,20 @@ SQLITE_PRIVATE int sqlite3VdbeCheckMemIn
   ** ensure that if Mem.szMalloc>0 then it is safe to do
   ** Mem.z = Mem.zMalloc without having to check Mem.flags&MEM_Dyn.
   ** That saves a few cycles in inner loops. */
   assert( (p->flags & MEM_Dyn)==0 || p->szMalloc==0 );
 
   /* Cannot be both MEM_Int and MEM_Real at the same time */
   assert( (p->flags & (MEM_Int|MEM_Real))!=(MEM_Int|MEM_Real) );
 
+  /* Cannot be both MEM_Null and some other type */
+  assert( (p->flags & MEM_Null)==0 ||
+          (p->flags & (MEM_Int|MEM_Real|MEM_Str|MEM_Blob))==0 );
+
   /* The szMalloc field holds the correct memory allocation size */
   assert( p->szMalloc==0
        || p->szMalloc==sqlite3DbMallocSize(p->db,p->zMalloc) );
 
   /* If p holds a string or blob, the Mem.z must point to exactly
   ** one of the following:
   **
   **   (1) Memory in Mem.zMalloc and managed by the Mem object
@@ -69738,36 +69819,34 @@ SQLITE_PRIVATE SQLITE_NOINLINE int sqlit
 
   /* If the bPreserve flag is set to true, then the memory cell must already
   ** contain a valid string or blob value.  */
   assert( bPreserve==0 || pMem->flags&(MEM_Blob|MEM_Str) );
   testcase( bPreserve && pMem->z==0 );
 
   assert( pMem->szMalloc==0
        || pMem->szMalloc==sqlite3DbMallocSize(pMem->db, pMem->zMalloc) );
-  if( pMem->szMalloc<n ){
-    if( n<32 ) n = 32;
-    if( bPreserve && pMem->szMalloc>0 && pMem->z==pMem->zMalloc ){
-      pMem->z = pMem->zMalloc = sqlite3DbReallocOrFree(pMem->db, pMem->z, n);
-      bPreserve = 0;
-    }else{
-      if( pMem->szMalloc>0 ) sqlite3DbFree(pMem->db, pMem->zMalloc);
-      pMem->zMalloc = sqlite3DbMallocRaw(pMem->db, n);
-    }
-    if( pMem->zMalloc==0 ){
-      sqlite3VdbeMemSetNull(pMem);
-      pMem->z = 0;
-      pMem->szMalloc = 0;
-      return SQLITE_NOMEM_BKPT;
-    }else{
-      pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
-    }
-  }
-
-  if( bPreserve && pMem->z && pMem->z!=pMem->zMalloc ){
+  if( n<32 ) n = 32;
+  if( bPreserve && pMem->szMalloc>0 && pMem->z==pMem->zMalloc ){
+    pMem->z = pMem->zMalloc = sqlite3DbReallocOrFree(pMem->db, pMem->z, n);
+    bPreserve = 0;
+  }else{
+    if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
+    pMem->zMalloc = sqlite3DbMallocRaw(pMem->db, n);
+  }
+  if( pMem->zMalloc==0 ){
+    sqlite3VdbeMemSetNull(pMem);
+    pMem->z = 0;
+    pMem->szMalloc = 0;
+    return SQLITE_NOMEM_BKPT;
+  }else{
+    pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
+  }
+
+  if( bPreserve && pMem->z && ALWAYS(pMem->z!=pMem->zMalloc) ){
     memcpy(pMem->zMalloc, pMem->z, pMem->n);
   }
   if( (pMem->flags&MEM_Dyn)!=0 ){
     assert( pMem->xDel!=0 && pMem->xDel!=SQLITE_DYNAMIC );
     pMem->xDel((void *)(pMem->z));
   }
 
   pMem->z = pMem->zMalloc;
@@ -69954,17 +70033,17 @@ SQLITE_PRIVATE int sqlite3VdbeMemFinaliz
     memset(&t, 0, sizeof(t));
     t.flags = MEM_Null;
     t.db = pMem->db;
     ctx.pOut = &t;
     ctx.pMem = pMem;
     ctx.pFunc = pFunc;
     pFunc->xFinalize(&ctx); /* IMP: R-24505-23230 */
     assert( (pMem->flags & MEM_Dyn)==0 );
-    if( pMem->szMalloc>0 ) sqlite3DbFree(pMem->db, pMem->zMalloc);
+    if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
     memcpy(pMem, &t, sizeof(t));
     rc = ctx.isError;
   }
   return rc;
 }
 
 /*
 ** If the memory cell contains a value that must be freed by
@@ -70005,17 +70084,17 @@ static SQLITE_NOINLINE void vdbeMemClear
 ** the unusual case where there really is memory in p that needs
 ** to be freed.
 */
 static SQLITE_NOINLINE void vdbeMemClear(Mem *p){
   if( VdbeMemDynamic(p) ){
     vdbeMemClearExternAndSetNull(p);
   }
   if( p->szMalloc ){
-    sqlite3DbFree(p->db, p->zMalloc);
+    sqlite3DbFreeNN(p->db, p->zMalloc);
     p->szMalloc = 0;
   }
   p->z = 0;
 }
 
 /*
 ** Release any memory resources held by the Mem.  Both the memory that is
 ** free by Mem.xDel and the Mem.zMalloc allocation are freed.
@@ -70033,17 +70112,17 @@ SQLITE_PRIVATE void sqlite3VdbeMemReleas
   }
 }
 
 /*
 ** Convert a 64-bit IEEE double into a 64-bit signed integer.
 ** If the double is out of range of a 64-bit signed integer then
 ** return the closest available 64-bit signed integer.
 */
-static i64 doubleToInt64(double r){
+static SQLITE_NOINLINE i64 doubleToInt64(double r){
 #ifdef SQLITE_OMIT_FLOATING_POINT
   /* When floating-point is omitted, double and int64 are the same thing */
   return r;
 #else
   /*
   ** Many compilers we encounter do not define constants for the
   ** minimum and maximum 64-bit integers, or they define them
   ** inconsistently.  And many do not understand the "LL" notation.
@@ -70069,53 +70148,59 @@ static i64 doubleToInt64(double r){
 ** If pMem is an integer, then the value is exact.  If pMem is
 ** a floating-point then the value returned is the integer part.
 ** If pMem is a string or blob, then we make an attempt to convert
 ** it into an integer and return that.  If pMem represents an
 ** an SQL-NULL value, return 0.
 **
 ** If pMem represents a string value, its encoding might be changed.
 */
+static SQLITE_NOINLINE i64 memIntValue(Mem *pMem){
+  i64 value = 0;
+  sqlite3Atoi64(pMem->z, &value, pMem->n, pMem->enc);
+  return value;
+}
 SQLITE_PRIVATE i64 sqlite3VdbeIntValue(Mem *pMem){
   int flags;
   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
   flags = pMem->flags;
   if( flags & MEM_Int ){
     return pMem->u.i;
   }else if( flags & MEM_Real ){
     return doubleToInt64(pMem->u.r);
   }else if( flags & (MEM_Str|MEM_Blob) ){
-    i64 value = 0;
     assert( pMem->z || pMem->n==0 );
-    sqlite3Atoi64(pMem->z, &value, pMem->n, pMem->enc);
-    return value;
+    return memIntValue(pMem);
   }else{
     return 0;
   }
 }
 
 /*
 ** Return the best representation of pMem that we can get into a
 ** double.  If pMem is already a double or an integer, return its
 ** value.  If it is a string or blob, try to convert it to a double.
 ** If it is a NULL, return 0.0.
 */
+static SQLITE_NOINLINE double memRealValue(Mem *pMem){
+  /* (double)0 In case of SQLITE_OMIT_FLOATING_POINT... */
+  double val = (double)0;
+  sqlite3AtoF(pMem->z, &val, pMem->n, pMem->enc);
+  return val;
+}
 SQLITE_PRIVATE double sqlite3VdbeRealValue(Mem *pMem){
   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
   assert( EIGHT_BYTE_ALIGNMENT(pMem) );
   if( pMem->flags & MEM_Real ){
     return pMem->u.r;
   }else if( pMem->flags & MEM_Int ){
     return (double)pMem->u.i;
   }else if( pMem->flags & (MEM_Str|MEM_Blob) ){
-    /* (double)0 In case of SQLITE_OMIT_FLOATING_POINT... */
-    double val = (double)0;
-    sqlite3AtoF(pMem->z, &val, pMem->n, pMem->enc);
-    return val;
+    return memRealValue(pMem);
   }else{
     /* (double)0 In case of SQLITE_OMIT_FLOATING_POINT... */
     return (double)0;
   }
 }
 
 /*
 ** The MEM structure is already a MEM_Real.  Try to also make it a
@@ -70730,17 +70815,17 @@ static sqlite3_value *valueNew(sqlite3 *
           assert( pRec->pKeyInfo->nField+pRec->pKeyInfo->nXField==nCol );
           assert( pRec->pKeyInfo->enc==ENC(db) );
           pRec->aMem = (Mem *)((u8*)pRec + ROUND8(sizeof(UnpackedRecord)));
           for(i=0; i<nCol; i++){
             pRec->aMem[i].flags = MEM_Null;
             pRec->aMem[i].db = db;
           }
         }else{
-          sqlite3DbFree(db, pRec);
+          sqlite3DbFreeNN(db, pRec);
           pRec = 0;
         }
       }
       if( pRec==0 ) return 0;
       p->ppRec[0] = pRec;
     }
   
     pRec->nField = p->iVal+1;
@@ -70842,17 +70927,17 @@ static int valueFromFunction(
  value_from_function_out:
   if( rc!=SQLITE_OK ){
     pVal = 0;
   }
   if( apVal ){
     for(i=0; i<nVal; i++){
       sqlite3ValueFree(apVal[i]);
     }
-    sqlite3DbFree(db, apVal);
+    sqlite3DbFreeNN(db, apVal);
   }
 
   *ppVal = pVal;
   return rc;
 }
 #else
 # define valueFromFunction(a,b,c,d,e,f) SQLITE_OK
 #endif /* defined(SQLITE_ENABLE_STAT3_OR_STAT4) */
@@ -71041,17 +71126,17 @@ static void recordFunc(
   aRet = sqlite3DbMallocRawNN(db, nRet);
   if( aRet==0 ){
     sqlite3_result_error_nomem(context);
   }else{
     aRet[0] = nSerial+1;
     putVarint32(&aRet[1], iSerial);
     sqlite3VdbeSerialPut(&aRet[1+nSerial], argv[0], iSerial);
     sqlite3_result_blob(context, aRet, nRet, SQLITE_TRANSIENT);
-    sqlite3DbFree(db, aRet);
+    sqlite3DbFreeNN(db, aRet);
   }
 }
 
 /*
 ** Register built-in functions used to help read ANALYZE data.
 */
 SQLITE_PRIVATE void sqlite3AnalyzeFunctions(void){
   static FuncDef aAnalyzeTableFuncs[] = {
@@ -71268,17 +71353,17 @@ SQLITE_PRIVATE void sqlite3Stat4ProbeFre
     int i;
     int nCol = pRec->pKeyInfo->nField+pRec->pKeyInfo->nXField;
     Mem *aMem = pRec->aMem;
     sqlite3 *db = aMem[0].db;
     for(i=0; i<nCol; i++){
       sqlite3VdbeMemRelease(&aMem[i]);
     }
     sqlite3KeyInfoUnref(pRec->pKeyInfo);
-    sqlite3DbFree(db, pRec);
+    sqlite3DbFreeNN(db, pRec);
   }
 }
 #endif /* ifdef SQLITE_ENABLE_STAT4 */
 
 /*
 ** Change the string value of an sqlite3_value object
 */
 SQLITE_PRIVATE void sqlite3ValueSetStr(
@@ -71292,17 +71377,17 @@ SQLITE_PRIVATE void sqlite3ValueSetStr(
 }
 
 /*
 ** Free an sqlite3_value object
 */
 SQLITE_PRIVATE void sqlite3ValueFree(sqlite3_value *v){
   if( !v ) return;
   sqlite3VdbeMemRelease((Mem *)v);
-  sqlite3DbFree(((Mem*)v)->db, v);
+  sqlite3DbFreeNN(((Mem*)v)->db, v);
 }
 
 /*
 ** The sqlite3ValueBytes() routine returns the number of bytes in the
 ** sqlite3_value object assuming that it uses the encoding "enc".
 ** The valueBytes() routine is a helper function.
 */
 static SQLITE_NOINLINE int valueBytes(sqlite3_value *pVal, u8 enc){
@@ -72135,32 +72220,32 @@ SQLITE_PRIVATE void sqlite3VdbeJumpHere(
 
 
 /*
 ** If the input FuncDef structure is ephemeral, then free it.  If
 ** the FuncDef is not ephermal, then do nothing.
 */
 static void freeEphemeralFunction(sqlite3 *db, FuncDef *pDef){
   if( (pDef->funcFlags & SQLITE_FUNC_EPHEM)!=0 ){
-    sqlite3DbFree(db, pDef);
+    sqlite3DbFreeNN(db, pDef);
   }
 }
 
 static void vdbeFreeOpArray(sqlite3 *, Op *, int);
 
 /*
 ** Delete a P4 value if necessary.
 */
 static SQLITE_NOINLINE void freeP4Mem(sqlite3 *db, Mem *p){
   if( p->szMalloc ) sqlite3DbFree(db, p->zMalloc);
-  sqlite3DbFree(db, p);
+  sqlite3DbFreeNN(db, p);
 }
 static SQLITE_NOINLINE void freeP4FuncCtx(sqlite3 *db, sqlite3_context *p){
   freeEphemeralFunction(db, p->pFunc);
-  sqlite3DbFree(db, p);
+ sqlite3DbFreeNN(db, p);
 }
 static void freeP4(sqlite3 *db, int p4type, void *p4){
   assert( db );
   switch( p4type ){
     case P4_FUNCCTX: {
       freeP4FuncCtx(db, (sqlite3_context*)p4);
       break;
     }
@@ -72203,24 +72288,24 @@ static void freeP4(sqlite3 *db, int p4ty
 /*
 ** Free the space allocated for aOp and any p4 values allocated for the
 ** opcodes contained within. If aOp is not NULL it is assumed to contain 
 ** nOp entries. 
 */
 static void vdbeFreeOpArray(sqlite3 *db, Op *aOp, int nOp){
   if( aOp ){
     Op *pOp;
-    for(pOp=aOp; pOp<&aOp[nOp]; pOp++){
+    for(pOp=&aOp[nOp-1]; pOp>=aOp; pOp--){
       if( pOp->p4type ) freeP4(db, pOp->p4type, pOp->p4.p);
 #ifdef SQLITE_ENABLE_EXPLAIN_COMMENTS
       sqlite3DbFree(db, pOp->zComment);
 #endif     
     }
-  }
-  sqlite3DbFree(db, aOp);
+    sqlite3DbFreeNN(db, aOp);
+  }
 }
 
 /*
 ** Link the SubProgram object passed as the second argument into the linked
 ** list at Vdbe.pSubProgram. This list is used to delete all sub-program
 ** objects when the VM is no longer required.
 */
 SQLITE_PRIVATE void sqlite3VdbeLinkSubProgram(Vdbe *pVdbe, SubProgram *p){
@@ -72883,17 +72968,17 @@ static void releaseMemArray(Mem *p, int 
       */
       testcase( p->flags & MEM_Agg );
       testcase( p->flags & MEM_Dyn );
       testcase( p->flags & MEM_Frame );
       testcase( p->flags & MEM_RowSet );
       if( p->flags&(MEM_Agg|MEM_Dyn|MEM_Frame|MEM_RowSet) ){
         sqlite3VdbeMemRelease(p);
       }else if( p->szMalloc ){
-        sqlite3DbFree(db, p->zMalloc);
+        sqlite3DbFreeNN(db, p->zMalloc);
         p->szMalloc = 0;
       }
 
       p->flags = MEM_Undefined;
     }while( (++p)<pEnd );
   }
 }
 
@@ -73359,18 +73444,18 @@ SQLITE_PRIVATE void sqlite3VdbeFreeCurso
   }
   assert( pCx->pBtx==0 || pCx->eCurType==CURTYPE_BTREE );
   switch( pCx->eCurType ){
     case CURTYPE_SORTER: {
       sqlite3VdbeSorterClose(p->db, pCx);
       break;
     }
     case CURTYPE_BTREE: {
-      if( pCx->pBtx ){
-        sqlite3BtreeClose(pCx->pBtx);
+      if( pCx->isEphemeral ){
+        if( pCx->pBtx ) sqlite3BtreeClose(pCx->pBtx);
         /* The pCx->pCursor will be close automatically, if it exists, by
         ** the call above. */
       }else{
         assert( pCx->uc.pCursor!=0 );
         sqlite3BtreeCloseCursor(pCx->uc.pCursor);
       }
       break;
     }
@@ -74254,17 +74339,16 @@ SQLITE_PRIVATE int sqlite3VdbeReset(Vdbe
         );
         fprintf(out, "%s", zHdr);
         sqlite3VdbePrintOp(out, i, &p->aOp[i]);
       }
       fclose(out);
     }
   }
 #endif
-  p->iCurrentTime = 0;
   p->magic = VDBE_MAGIC_RESET;
   return p->rc & db->errMask;
 }
  
 /*
 ** Clean up and delete a VDBE after execution.  Return an integer which is
 ** the result code.  Write any error message text into *pzErrMsg.
 */
@@ -74293,26 +74377,28 @@ SQLITE_PRIVATE int sqlite3VdbeFinalize(V
 **
 **    * the corresponding bit in argument mask is clear (where the first
 **      function parameter corresponds to bit 0 etc.).
 */
 SQLITE_PRIVATE void sqlite3VdbeDeleteAuxData(sqlite3 *db, AuxData **pp, int iOp, int mask){
   while( *pp ){
     AuxData *pAux = *pp;
     if( (iOp<0)
-     || (pAux->iOp==iOp && (pAux->iArg>31 || !(mask & MASKBIT32(pAux->iArg))))
+     || (pAux->iAuxOp==iOp
+          && pAux->iAuxArg>=0
+          && (pAux->iAuxArg>31 || !(mask & MASKBIT32(pAux->iAuxArg))))
     ){
-      testcase( pAux->iArg==31 );
-      if( pAux->xDelete ){
-        pAux->xDelete(pAux->pAux);
-      }
-      *pp = pAux->pNext;
+      testcase( pAux->iAuxArg==31 );
+      if( pAux->xDeleteAux ){
+        pAux->xDeleteAux(pAux->pAux);
+      }
+      *pp = pAux->pNextAux;
       sqlite3DbFree(db, pAux);
     }else{
-      pp= &pAux->pNext;
+      pp= &pAux->pNextAux;
     }
   }
 }
 
 /*
 ** Free all memory associated with the Vdbe passed as the second argument,
 ** except for object itself, which is preserved.
 **
@@ -74364,17 +74450,17 @@ SQLITE_PRIVATE void sqlite3VdbeDelete(Vd
     assert( db->pVdbe==p );
     db->pVdbe = p->pNext;
   }
   if( p->pNext ){
     p->pNext->pPrev = p->pPrev;
   }
   p->magic = VDBE_MAGIC_DEAD;
   p->db = 0;
-  sqlite3DbFree(db, p);
+  sqlite3DbFreeNN(db, p);
 }
 
 /*
 ** The cursor "p" has a pending seek operation that has not yet been
 ** carried out.  Seek the cursor now.  If an error occurs, return
 ** the appropriate error code.
 */
 static int SQLITE_NOINLINE handleDeferredMoveto(VdbeCursor *p){
@@ -75923,17 +76009,17 @@ SQLITE_PRIVATE void sqlite3VtabImportErr
 */
 static void vdbeFreeUnpacked(sqlite3 *db, int nField, UnpackedRecord *p){
   if( p ){
     int i;
     for(i=0; i<nField; i++){
       Mem *pMem = &p->aMem[i];
       if( pMem->zMalloc ) sqlite3VdbeMemRelease(pMem);
     }
-    sqlite3DbFree(db, p);
+    sqlite3DbFreeNN(db, p);
   }
 }
 #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
 
 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
 /*
 ** Invoke the pre-update hook. If this is an UPDATE or DELETE pre-update call,
 ** then cursor passed as the second argument should point to the row about
@@ -75990,17 +76076,17 @@ SQLITE_PRIVATE void sqlite3VdbePreUpdate
   sqlite3DbFree(db, preupdate.aRecord);
   vdbeFreeUnpacked(db, preupdate.keyinfo.nField+1, preupdate.pUnpacked);
   vdbeFreeUnpacked(db, preupdate.keyinfo.nField+1, preupdate.pNewUnpacked);
   if( preupdate.aNew ){
     int i;
     for(i=0; i<pCsr->nField; i++){
       sqlite3VdbeMemRelease(&preupdate.aNew[i]);
     }
-    sqlite3DbFree(db, preupdate.aNew);
+    sqlite3DbFreeNN(db, preupdate.aNew);
   }
 }
 #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
 
 /************** End of vdbeaux.c *********************************************/
 /************** Begin file vdbeapi.c *****************************************/
 /*
 ** 2004 May 26
@@ -76803,75 +76889,89 @@ SQLITE_API void *sqlite3_aggregate_conte
   }else{
     return (void*)p->pMem->z;
   }
 }
 
 /*
 ** Return the auxiliary data pointer, if any, for the iArg'th argument to
 ** the user-function defined by pCtx.
+**
+** The left-most argument is 0.
+**
+** Undocumented behavior:  If iArg is negative then access a cache of
+** auxiliary data pointers that is available to all functions within a
+** single prepared statement.  The iArg values must match.
 */
 SQLITE_API void *sqlite3_get_auxdata(sqlite3_context *pCtx, int iArg){
   AuxData *pAuxData;
 
   assert( sqlite3_mutex_held(pCtx->pOut->db->mutex) );
 #if SQLITE_ENABLE_STAT3_OR_STAT4
   if( pCtx->pVdbe==0 ) return 0;
 #else
   assert( pCtx->pVdbe!=0 );
 #endif
-  for(pAuxData=pCtx->pVdbe->pAuxData; pAuxData; pAuxData=pAuxData->pNext){
-    if( pAuxData->iOp==pCtx->iOp && pAuxData->iArg==iArg ) break;
-  }
-
-  return (pAuxData ? pAuxData->pAux : 0);
+  for(pAuxData=pCtx->pVdbe->pAuxData; pAuxData; pAuxData=pAuxData->pNextAux){
+    if(  pAuxData->iAuxArg==iArg && (pAuxData->iAuxOp==pCtx->iOp || iArg<0) ){
+      return pAuxData->pAux;
+    }
+  }
+  return 0;
 }
 
 /*
 ** Set the auxiliary data pointer and delete function, for the iArg'th
 ** argument to the user-function defined by pCtx. Any previous value is
 ** deleted by calling the delete function specified when it was set.
+**
+** The left-most argument is 0.
+**
+** Undocumented behavior:  If iArg is negative then make the data available
+** to all functions within the current prepared statement using iArg as an
+** access code.
 */
 SQLITE_API void sqlite3_set_auxdata(
   sqlite3_context *pCtx, 
   int iArg, 
   void *pAux, 
   void (*xDelete)(void*)
 ){
   AuxData *pAuxData;
   Vdbe *pVdbe = pCtx->pVdbe;
 
   assert( sqlite3_mutex_held(pCtx->pOut->db->mutex) );
-  if( iArg<0 ) goto failed;
 #ifdef SQLITE_ENABLE_STAT3_OR_STAT4
   if( pVdbe==0 ) goto failed;
 #else
   assert( pVdbe!=0 );
 #endif
 
-  for(pAuxData=pVdbe->pAuxData; pAuxData; pAuxData=pAuxData->pNext){
-    if( pAuxData->iOp==pCtx->iOp && pAuxData->iArg==iArg ) break;
+  for(pAuxData=pVdbe->pAuxData; pAuxData; pAuxData=pAuxData->pNextAux){
+    if( pAuxData->iAuxArg==iArg && (pAuxData->iAuxOp==pCtx->iOp || iArg<0) ){
+      break;
+    }
   }
   if( pAuxData==0 ){
     pAuxData = sqlite3DbMallocZero(pVdbe->db, sizeof(AuxData));
     if( !pAuxData ) goto failed;
-    pAuxData->iOp = pCtx->iOp;
-    pAuxData->iArg = iArg;
-    pAuxData->pNext = pVdbe->pAuxData;
+    pAuxData->iAuxOp = pCtx->iOp;
+    pAuxData->iAuxArg = iArg;
+    pAuxData->pNextAux = pVdbe->pAuxData;
     pVdbe->pAuxData = pAuxData;
     if( pCtx->fErrorOrAux==0 ){
       pCtx->isError = 0;
       pCtx->fErrorOrAux = 1;
     }
-  }else if( pAuxData->xDelete ){
-    pAuxData->xDelete(pAuxData->pAux);
+  }else if( pAuxData->xDeleteAux ){
+    pAuxData->xDeleteAux(pAuxData->pAux);
   }
 
   pAuxData->pAux = pAux;
-  pAuxData->xDelete = xDelete;
+  pAuxData->xDeleteAux = xDelete;
   return;
 
 failed:
   if( xDelete ){
     xDelete(pAux);
   }
 }
 
@@ -78576,16 +78676,17 @@ static void memTracePrint(Mem *p){
     printf(" %s", zBuf);
   }
   if( p->flags & MEM_Subtype ) printf(" subtype=0x%02x", p->eSubtype);
 }
 static void registerTrace(int iReg, Mem *p){
   printf("REG[%d] = ", iReg);
   memTracePrint(p);
   printf("\n");
+  sqlite3VdbeCheckMemInvariants(p);
 }
 #endif
 
 #ifdef SQLITE_DEBUG
 #  define REGISTER_TRACE(R,M) if(db->flags&SQLITE_VdbeTrace)registerTrace(R,M)
 #else
 #  define REGISTER_TRACE(R,M)
 #endif
@@ -78942,17 +79043,17 @@ SQLITE_PRIVATE int sqlite3VdbeExec(
 ** that this Goto is the bottom of a loop and that the lines from P2 down
 ** to the current line should be indented for EXPLAIN output.
 */
 case OP_Goto: {             /* jump */
 jump_to_p2_and_check_for_interrupt:
   pOp = &aOp[pOp->p2 - 1];
 
   /* Opcodes that are used as the bottom of a loop (OP_Next, OP_Prev,
-  ** OP_VNext, OP_RowSetNext, or OP_SorterNext) all jump here upon
+  ** OP_VNext, or OP_SorterNext) all jump here upon
   ** completion.  Check to see if sqlite3_interrupt() has been called
   ** or if the progress callback needs to be invoked. 
   **
   ** This code uses unstructured "goto" statements and does not look clean.
   ** But that is not due to sloppy coding habits. The code is written this
   ** way for performance, to avoid having to run the interrupt and progress
   ** checks on every opcode.  This helps sqlite3_step() to run about 1.5%
   ** faster according to "valgrind --tool=cachegrind" */
@@ -79330,17 +79431,17 @@ case OP_Null: {           /* out2 */
 ** Set register P1 to have the value NULL as seen by the OP_MakeRecord
 ** instruction, but do not free any string or blob memory associated with
 ** the register, so that if the value was a string or blob that was
 ** previously copied using OP_SCopy, the copies will continue to be valid.
 */
 case OP_SoftNull: {
   assert( pOp->p1>0 && pOp->p1<=(p->nMem+1 - p->nCursor) );
   pOut = &aMem[pOp->p1];
-  pOut->flags = (pOut->flags|MEM_Null)&~MEM_Undefined;
+  pOut->flags = (pOut->flags&~(MEM_Undefined|MEM_AffMask))|MEM_Null;
   break;
 }
 
 /* Opcode: Blob P1 P2 * P4 *
 ** Synopsis: r[P2]=P4 (len=P1)
 **
 ** P4 points to a blob of data P1 bytes long.  Store this
 ** blob in register P2.
@@ -79673,17 +79774,16 @@ case OP_Remainder: {           /* same a
   double rB;      /* Real value of right operand */
 
   pIn1 = &aMem[pOp->p1];
   type1 = numericType(pIn1);
   pIn2 = &aMem[pOp->p2];
   type2 = numericType(pIn2);
   pOut = &aMem[pOp->p3];
   flags = pIn1->flags | pIn2->flags;
-  if( (flags & MEM_Null)!=0 ) goto arithmetic_result_is_null;
   if( (type1 & type2 & MEM_Int)!=0 ){
     iA = pIn1->u.i;
     iB = pIn2->u.i;
     bIntint = 1;
     switch( pOp->opcode ){
       case OP_Add:       if( sqlite3AddInt64(&iB,iA) ) goto fp_math;  break;
       case OP_Subtract:  if( sqlite3SubInt64(&iB,iA) ) goto fp_math;  break;
       case OP_Multiply:  if( sqlite3MulInt64(&iB,iA) ) goto fp_math;  break;
@@ -79697,16 +79797,18 @@ case OP_Remainder: {           /* same a
         if( iA==0 ) goto arithmetic_result_is_null;
         if( iA==-1 ) iA = 1;
         iB %= iA;
         break;
       }
     }
     pOut->u.i = iB;
     MemSetTypeFlag(pOut, MEM_Int);
+  }else if( (flags & MEM_Null)!=0 ){
+    goto arithmetic_result_is_null;
   }else{
     bIntint = 0;
 fp_math:
     rA = sqlite3VdbeRealValue(pIn1);
     rB = sqlite3VdbeRealValue(pIn2);
     switch( pOp->opcode ){
       case OP_Add:         rB += rA;       break;
       case OP_Subtract:    rB -= rA;       break;
@@ -79744,17 +79846,17 @@ fp_math:
 
 arithmetic_result_is_null:
   sqlite3VdbeMemSetNull(pOut);
   break;
 }
 
 /* Opcode: CollSeq P1 * * P4
 **
-** P4 is a pointer to a CollSeq struct. If the next call to a user function
+** P4 is a pointer to a CollSeq object. If the next call to a user function
 ** or aggregate calls sqlite3GetFuncCollSeq(), this collation sequence will
 ** be returned. This is used by the built-in min(), max() and nullif()
 ** functions.
 **
 ** If P1 is not zero, then it is a register that a subsequent min() or
 ** max() aggregate will set to 1 if the current row is not the minimum or
 ** maximum.  The P1 register is initialized to 0 by this instruction.
 **
@@ -80025,21 +80127,21 @@ case OP_RealAffinity: {                 
 
 #ifndef SQLITE_OMIT_CAST
 /* Opcode: Cast P1 P2 * * *
 ** Synopsis: affinity(r[P1])
 **
 ** Force the value in register P1 to be the type defined by P2.
 ** 
 ** <ul>
-** <li value="97"> TEXT
-** <li value="98"> BLOB
-** <li value="99"> NUMERIC
-** <li value="100"> INTEGER
-** <li value="101"> REAL
+** <li> P2=='A' &rarr; BLOB
+** <li> P2=='B' &rarr; TEXT
+** <li> P2=='C' &rarr; NUMERIC
+** <li> P2=='D' &rarr; INTEGER
+** <li> P2=='E' &rarr; REAL
 ** </ul>
 **
 ** A NULL value is not changed by this routine.  It remains NULL.
 */
 case OP_Cast: {                  /* in1 */
   assert( pOp->p2>=SQLITE_AFF_BLOB && pOp->p2<=SQLITE_AFF_REAL );
   testcase( pOp->p2==SQLITE_AFF_TEXT );
   testcase( pOp->p2==SQLITE_AFF_BLOB );
@@ -80608,37 +80710,55 @@ case OP_NotNull: {            /* same as
   pIn1 = &aMem[pOp->p1];
   VdbeBranchTaken( (pIn1->flags & MEM_Null)==0, 2);
   if( (pIn1->flags & MEM_Null)==0 ){
     goto jump_to_p2;
   }
   break;
 }
 
+/* Opcode: IfNullRow P1 P2 P3 * *
+** Synopsis: if P1.nullRow then r[P3]=NULL, goto P2
+**
+** Check the cursor P1 to see if it is currently pointing at a NULL row.
+** If it is, then set register P3 to NULL and jump immediately to P2.
+** If P1 is not on a NULL row, then fall through without making any
+** changes.
+*/
+case OP_IfNullRow: {         /* jump */
+  assert( pOp->p1>=0 && pOp->p1<p->nCursor );
+  assert( p->apCsr[pOp->p1]!=0 );
+  if( p->apCsr[pOp->p1]->nullRow ){
+    sqlite3VdbeMemSetNull(aMem + pOp->p3);
+    goto jump_to_p2;
+  }
+  break;
+}
+
 /* Opcode: Column P1 P2 P3 P4 P5
 ** Synopsis: r[P3]=PX
 **
 ** Interpret the data that cursor P1 points to as a structure built using
 ** the MakeRecord instruction.  (See the MakeRecord opcode for additional
 ** information about the format of the data.)  Extract the P2-th column
 ** from this record.  If there are less that (P2+1) 
 ** values in the record, extract a NULL.
 **
 ** The value extracted is stored in register P3.
 **
-** If the column contains fewer than P2 fields, then extract a NULL.  Or,
+** If the record contains fewer than P2 fields, then extract a NULL.  Or,
 ** if the P4 argument is a P4_MEM use the value of the P4 argument as
 ** the result.
 **
 ** If the OPFLAG_CLEARCACHE bit is set on P5 and P1 is a pseudo-table cursor,
 ** then the cache of the cursor is reset prior to extracting the column.
 ** The first OP_Column against a pseudo-table after the value of the content
 ** register has changed should have this bit set.
 **
-** If the OPFLAG_LENGTHARG and OPFLAG_TYPEOFARG bits are set on P5 when
+** If the OPFLAG_LENGTHARG and OPFLAG_TYPEOFARG bits are set on P5 then
 ** the result is guaranteed to only be used as the argument of a length()
 ** or typeof() function, respectively.  The loading of large blobs can be
 ** skipped for length() and all content loading can be skipped for typeof().
 */
 case OP_Column: {
   int p2;            /* column number to retrieve */
   VdbeCursor *pC;    /* The VDBE cursor */
   BtCursor *pCrsr;   /* The BTree cursor */
@@ -80883,46 +81003,46 @@ op_column_out:
   break;
 }
 
 /* Opcode: Affinity P1 P2 * P4 *
 ** Synopsis: affinity(r[P1@P2])
 **
 ** Apply affinities to a range of P2 registers starting with P1.
 **
-** P4 is a string that is P2 characters long. The nth character of the
-** string indicates the column affinity that should be used for the nth
+** P4 is a string that is P2 characters long. The N-th character of the
+** string indicates the column affinity that should be used for the N-th
 ** memory cell in the range.
 */
 case OP_Affinity: {
   const char *zAffinity;   /* The affinity to be applied */
-  char cAff;               /* A single character of affinity */
 
   zAffinity = pOp->p4.z;
   assert( zAffinity!=0 );
+  assert( pOp->p2>0 );
   assert( zAffinity[pOp->p2]==0 );
   pIn1 = &aMem[pOp->p1];
-  while( (cAff = *(zAffinity++))!=0 ){
+  do{
     assert( pIn1 <= &p->aMem[(p->nMem+1 - p->nCursor)] );
     assert( memIsValid(pIn1) );
-    applyAffinity(pIn1, cAff, encoding);
+    applyAffinity(pIn1, *(zAffinity++), encoding);
     pIn1++;
-  }
+  }while( zAffinity[0] );
   break;
 }
 
 /* Opcode: MakeRecord P1 P2 P3 P4 *
 ** Synopsis: r[P3]=mkrec(r[P1@P2])
 **
 ** Convert P2 registers beginning with P1 into the [record format]
 ** use as a data record in a database table or as a key
 ** in an index.  The OP_Column opcode can decode the record later.
 **
-** P4 may be a string that is P2 characters long.  The nth character of the
-** string indicates the column affinity that should be used for the nth
+** P4 may be a string that is P2 characters long.  The N-th character of the
+** string indicates the column affinity that should be used for the N-th
 ** field of the index key.
 **
 ** The mapping from character to affinity is given by the SQLITE_AFF_
 ** macros defined in sqliteInt.h.
 **
 ** If P4 is NULL then all index fields have the affinity BLOB.
 */
 case OP_MakeRecord: {
@@ -81071,17 +81191,16 @@ case OP_MakeRecord: {
 
   assert( pOp->p3>0 && pOp->p3<=(p->nMem+1 - p->nCursor) );
   pOut->n = (int)nByte;
   pOut->flags = MEM_Blob;
   if( nZero ){
     pOut->u.nZero = nZero;
     pOut->flags |= MEM_Zero;
   }
-  pOut->enc = SQLITE_UTF8;  /* In case the blob is ever converted to text */
   REGISTER_TRACE(pOp->p3, pOut);
   UPDATE_MAX_BLOBSIZE(pOut);
   break;
 }
 
 /* Opcode: Count P1 P2 * * *
 ** Synopsis: r[P2]=count()
 **
@@ -81701,16 +81820,47 @@ open_cursor_set_hints:
   testcase( pOp->p2 & OPFLAG_SEEKEQ );
 #endif
   sqlite3BtreeCursorHintFlags(pCur->uc.pCursor,
                                (pOp->p5 & (OPFLAG_BULKCSR|OPFLAG_SEEKEQ)));
   if( rc ) goto abort_due_to_error;
   break;
 }
 
+/* Opcode: OpenDup P1 P2 * * *
+**
+** Open a new cursor P1 that points to the same ephemeral table as
+** cursor P2.  The P2 cursor must have been opened by a prior OP_OpenEphemeral
+** opcode.  Only ephemeral cursors may be duplicated.
+**
+** Duplicate ephemeral cursors are used for self-joins of materialized views.
+*/
+case OP_OpenDup: {
+  VdbeCursor *pOrig;    /* The original cursor to be duplicated */
+  VdbeCursor *pCx;      /* The new cursor */
+
+  pOrig = p->apCsr[pOp->p2];
+  assert( pOrig->pBtx!=0 );  /* Only ephemeral cursors can be duplicated */
+
+  pCx = allocateCursor(p, pOp->p1, pOrig->nField, -1, CURTYPE_BTREE);
+  if( pCx==0 ) goto no_mem;
+  pCx->nullRow = 1;
+  pCx->isEphemeral = 1;
+  pCx->pKeyInfo = pOrig->pKeyInfo;
+  pCx->isTable = pOrig->isTable;
+  rc = sqlite3BtreeCursor(pOrig->pBtx, MASTER_ROOT, BTREE_WRCSR,
+                          pCx->pKeyInfo, pCx->uc.pCursor);
+  /* The sqlite3BtreeCursor() routine can only fail for the first cursor
+  ** opened for a database.  Since there is already an open cursor when this
+  ** opcode is run, the sqlite3BtreeCursor() cannot fail */
+  assert( rc==SQLITE_OK );
+  break;
+}
+
+
 /* Opcode: OpenEphemeral P1 P2 * P4 P5
 ** Synopsis: nColumn=P2
 **
 ** Open a new cursor P1 to a transient table.
 ** The cursor is always opened read/write even if 
 ** the main database is read-only.  The ephemeral
 ** table is deleted automatically when the cursor is closed.
 **
@@ -82236,37 +82386,39 @@ case OP_Found: {        /* jump, in3 */
       assert( memIsValid(&r.aMem[ii]) );
       assert( (r.aMem[ii].flags & MEM_Zero)==0 || r.aMem[ii].n==0 );
       if( ii ) REGISTER_TRACE(pOp->p3+ii, &r.aMem[ii]);
     }
 #endif
     pIdxKey = &r;
     pFree = 0;
   }else{
+    assert( pIn3->flags & MEM_Blob );
+    rc = ExpandBlob(pIn3);
+    assert( rc==SQLITE_OK || rc==SQLITE_NOMEM );
+    if( rc ) goto no_mem;
     pFree = pIdxKey = sqlite3VdbeAllocUnpackedRecord(pC->pKeyInfo);
     if( pIdxKey==0 ) goto no_mem;
-    assert( pIn3->flags & MEM_Blob );
-    (void)ExpandBlob(pIn3);
     sqlite3VdbeRecordUnpack(pC->pKeyInfo, pIn3->n, pIn3->z, pIdxKey);
   }
   pIdxKey->default_rc = 0;
   takeJump = 0;
   if( pOp->opcode==OP_NoConflict ){
     /* For the OP_NoConflict opcode, take the jump if any of the
     ** input fields are NULL, since any key with a NULL will not
     ** conflict */
     for(ii=0; ii<pIdxKey->nField; ii++){
       if( pIdxKey->aMem[ii].flags & MEM_Null ){
         takeJump = 1;
         break;
       }
     }
   }
   rc = sqlite3BtreeMovetoUnpacked(pC->uc.pCursor, pIdxKey, 0, 0, &res);
-  if( pFree ) sqlite3DbFree(db, pFree);
+  if( pFree ) sqlite3DbFreeNN(db, pFree);
   if( rc!=SQLITE_OK ){
     goto abort_due_to_error;
   }
   pC->seekResult = res;
   alreadyExists = (res==0);
   pC->nullRow = 1-alreadyExists;
   pC->deferredMoveto = 0;
   pC->cacheStatus = CACHE_STALE;
@@ -83566,20 +83718,27 @@ case OP_IdxGE:  {       /* jump */
 ** The table being destroyed is in the main database file if P3==0.  If
 ** P3==1 then the table to be clear is in the auxiliary database file
 ** that is used to store tables create using CREATE TEMPORARY TABLE.
 **
 ** If AUTOVACUUM is enabled then it is possible that another root page
 ** might be moved into the newly deleted root page in order to keep all
 ** root pages contiguous at the beginning of the database.  The former
 ** value of the root page that moved - its value before the move occurred -
-** is stored in register P2.  If no page 
-** movement was required (because the table being dropped was already 
-** the last one in the database) then a zero is stored in register P2.
-** If AUTOVACUUM is disabled then a zero is stored in register P2.
+** is stored in register P2. If no page movement was required (because the
+** table being dropped was already the last one in the database) then a 
+** zero is stored in register P2.  If AUTOVACUUM is disabled then a zero 
+** is stored in register P2.
+**
+** This opcode throws an error if there are any active reader VMs when
+** it is invoked. This is done to avoid the difficulty associated with 
+** updating existing cursors when a root page is moved in an AUTOVACUUM 
+** database. This error is thrown even if the database is not an AUTOVACUUM 
+** db in order to avoid introducing an incompatibility between autovacuum 
+** and non-autovacuum modes.
 **
 ** See also: Clear
 */
 case OP_Destroy: {     /* out2 */
   int iMoved;
   int iDb;
 
   assert( p->readOnly==0 );
@@ -83774,17 +83933,17 @@ case OP_ParseSchema: {
       rc = SQLITE_NOMEM_BKPT;
     }else{
       assert( db->init.busy==0 );
       db->init.busy = 1;
       initData.rc = SQLITE_OK;
       assert( !db->mallocFailed );
       rc = sqlite3_exec(db, zSql, sqlite3InitCallback, &initData, 0);
       if( rc==SQLITE_OK ) rc = initData.rc;
-      sqlite3DbFree(db, zSql);
+      sqlite3DbFreeNN(db, zSql);
       db->init.busy = 0;
     }
   }
   if( rc ){
     sqlite3ResetAllSchemasOfConnection(db);
     if( rc==SQLITE_NOMEM ){
       goto no_mem;
     }
@@ -83902,17 +84061,17 @@ case OP_IntegrityCk: {
   sqlite3VdbeChangeEncoding(pIn1, encoding);
   break;
 }
 #endif /* SQLITE_OMIT_INTEGRITY_CHECK */
 
 /* Opcode: RowSetAdd P1 P2 * * *
 ** Synopsis: rowset(P1)=r[P2]
 **
-** Insert the integer value held by register P2 into a boolean index
+** Insert the integer value held by register P2 into a RowSet object
 ** held in register P1.
 **
 ** An assertion fails if P2 is not an integer.
 */
 case OP_RowSetAdd: {       /* in1, in2 */
   pIn1 = &aMem[pOp->p1];
   pIn2 = &aMem[pOp->p2];
   assert( (pIn2->flags & MEM_Int)!=0 );
@@ -83922,18 +84081,19 @@ case OP_RowSetAdd: {       /* in1, in2 *
   }
   sqlite3RowSetInsert(pIn1->u.pRowSet, pIn2->u.i);
   break;
 }
 
 /* Opcode: RowSetRead P1 P2 P3 * *
 ** Synopsis: r[P3]=rowset(P1)
 **
-** Extract the smallest value from boolean index P1 and put that value into
-** register P3.  Or, if boolean index P1 is initially empty, leave P3
+** Extract the smallest value from the RowSet object in P1
+** and put that value into register P3.
+** Or, if RowSet object P1 is initially empty, leave P3
 ** unchanged and jump to instruction P2.
 */
 case OP_RowSetRead: {       /* jump, in1, out3 */
   i64 val;
 
   pIn1 = &aMem[pOp->p1];
   if( (pIn1->flags & MEM_RowSet)==0 
    || sqlite3RowSetNext(pIn1->u.pRowSet, &val)==0
@@ -83954,25 +84114,24 @@ case OP_RowSetRead: {       /* jump, in1
 ** Synopsis: if r[P3] in rowset(P1) goto P2
 **
 ** Register P3 is assumed to hold a 64-bit integer value. If register P1
 ** contains a RowSet object and that RowSet object contains
 ** the value held in P3, jump to register P2. Otherwise, insert the
 ** integer in P3 into the RowSet and continue on to the
 ** next opcode.
 **
-** The RowSet object is optimized for the case where successive sets
-** of integers, where each set contains no duplicates. Each set
-** of values is identified by a unique P4 value. The first set
-** must have P4==0, the final set P4=-1.  P4 must be either -1 or
-** non-negative.  For non-negative values of P4 only the lower 4
-** bits are significant.
+** The RowSet object is optimized for the case where sets of integers
+** are inserted in distinct phases, which each set contains no duplicates.
+** Each set is identified by a unique P4 value. The first set
+** must have P4==0, the final set must have P4==-1, and for all other sets
+** must have P4>0.
 **
 ** This allows optimizations: (a) when P4==0 there is no need to test
-** the rowset object for P3, as it is guaranteed not to contain it,
+** the RowSet object for P3, as it is guaranteed not to contain it,
 ** (b) when P4==-1 there is no need to insert the value, as it will
 ** never be tested for, and (c) when a value that is part of set X is
 ** inserted, there is no need to search to see if the same value was
 ** previously inserted as part of set X (only if it was previously
 ** inserted as part of some other set).
 */
 case OP_RowSetTest: {                     /* jump, in1, in3 */
   int iSet;
@@ -86702,47 +86861,46 @@ static int vdbeSorterCompareInt(
   const int s2 = p2[1];                 /* Right hand serial type */
   const u8 * const v1 = &p1[ p1[0] ];   /* Pointer to value 1 */
   const u8 * const v2 = &p2[ p2[0] ];   /* Pointer to value 2 */
   int res;                              /* Return value */
 
   assert( (s1>0 && s1<7) || s1==8 || s1==9 );
   assert( (s2>0 && s2<7) || s2==8 || s2==9 );
 
-  if( s1>7 && s2>7 ){
+  if( s1==s2 ){
+    /* The two values have the same sign. Compare using memcmp(). */
+    static const u8 aLen[] = {0, 1, 2, 3, 4, 6, 8, 0, 0, 0 };
+    const u8 n = aLen[s1];
+    int i;
+    res = 0;
+    for(i=0; i<n; i++){
+      if( (res = v1[i] - v2[i])!=0 ){
+        if( ((v1[0] ^ v2[0]) & 0x80)!=0 ){
+          res = v1[0] & 0x80 ? -1 : +1;
+        }
+        break;
+      }
+    }
+  }else if( s1>7 && s2>7 ){
     res = s1 - s2;
   }else{
-    if( s1==s2 ){
-      if( (*v1 ^ *v2) & 0x80 ){
-        /* The two values have different signs */
-        res = (*v1 & 0x80) ? -1 : +1;
-      }else{
-        /* The two values have the same sign. Compare using memcmp(). */
-        static const u8 aLen[] = {0, 1, 2, 3, 4, 6, 8 };
-        int i;
-        res = 0;
-        for(i=0; i<aLen[s1]; i++){
-          if( (res = v1[i] - v2[i]) ) break;
-        }
-      }
-    }else{
-      if( s2>7 ){
-        res = +1;
-      }else if( s1>7 ){
-        res = -1;
-      }else{
-        res = s1 - s2;
-      }
-      assert( res!=0 );
-
-      if( res>0 ){
-        if( *v1 & 0x80 ) res = -1;
-      }else{
-        if( *v2 & 0x80 ) res = +1;
-      }
+    if( s2>7 ){
+      res = +1;
+    }else if( s1>7 ){
+      res = -1;
+    }else{
+      res = s1 - s2;
+    }
+    assert( res!=0 );
+
+    if( res>0 ){
+      if( *v1 & 0x80 ) res = -1;
+    }else{
+      if( *v2 & 0x80 ) res = +1;
     }
   }
 
   if( res==0 ){
     if( pTask->pSorter->pKeyInfo->nField>1 ){
       res = vdbeSorterCompareTail(
           pTask, pbKey2Cached, pKey1, nKey1, pKey2, nKey2
       );
@@ -90787,17 +90945,17 @@ SQLITE_PRIVATE char sqlite3ExprAffinity(
   }
   if( op==TK_REGISTER ) op = pExpr->op2;
 #ifndef SQLITE_OMIT_CAST
   if( op==TK_CAST ){
     assert( !ExprHasProperty(pExpr, EP_IntValue) );
     return sqlite3AffinityType(pExpr->u.zToken, 0);
   }
 #endif
-  if( op==TK_AGG_COLUMN || op==TK_COLUMN ){
+  if( (op==TK_AGG_COLUMN || op==TK_COLUMN) && pExpr->pTab ){
     return sqlite3TableColumnAffinity(pExpr->pTab, pExpr->iColumn);
   }
   if( op==TK_SELECT_COLUMN ){
     assert( pExpr->pLeft->flags&EP_xIsSelect );
     return sqlite3ExprAffinity(
         pExpr->pLeft->x.pSelect->pEList->a[pExpr->iColumn].pExpr
     );
   }
@@ -91081,17 +91239,16 @@ SQLITE_PRIVATE int sqlite3ExprVectorSize
     return pExpr->x.pList->nExpr;
   }else if( op==TK_SELECT ){
     return pExpr->x.pSelect->pEList->nExpr;
   }else{
     return 1;
   }
 }
 
-#ifndef SQLITE_OMIT_SUBQUERY
 /*
 ** Return a pointer to a subexpression of pVector that is the i-th
 ** column of the vector (numbered starting with 0).  The caller must
 ** ensure that i is within range.
 **
 ** If pVector is really a scalar (and "scalar" here includes subqueries
 ** that return a single column!) then return pVector unmodified.
 **
@@ -91109,19 +91266,17 @@ SQLITE_PRIVATE Expr *sqlite3VectorFieldS
     if( pVector->op==TK_SELECT || pVector->op2==TK_SELECT ){
       return pVector->x.pSelect->pEList->a[i].pExpr;
     }else{
       return pVector->x.pList->a[i].pExpr;
     }
   }
   return pVector;
 }
-#endif /* !defined(SQLITE_OMIT_SUBQUERY) */
-
-#ifndef SQLITE_OMIT_SUBQUERY
+
 /*
 ** Compute and return a new Expr object which when passed to
 ** sqlite3ExprCode() will generate all necessary code to compute
 ** the iField-th column of the vector expression pVector.
 **
 ** It is ok for pVector to be a scalar (as long as iField==0).  
 ** In that case, this routine works like sqlite3ExprDup().
 **
@@ -91169,17 +91324,16 @@ SQLITE_PRIVATE Expr *sqlite3ExprForVecto
     }
     assert( pRet==0 || pRet->iTable==0 );
   }else{
     if( pVector->op==TK_VECTOR ) pVector = pVector->x.pList->a[iField].pExpr;
     pRet = sqlite3ExprDup(pParse->db, pVector, 0);
   }
   return pRet;
 }
-#endif /* !define(SQLITE_OMIT_SUBQUERY) */
 
 /*
 ** If expression pExpr is of type TK_SELECT, generate code to evaluate
 ** it. Return the register in which the result is stored (or, if the 
 ** sub-select returns more than one column, the first in an array
 ** of registers in which the result is stored).
 **
 ** If pExpr is not a TK_SELECT expression, return 0.
@@ -91685,17 +91839,17 @@ SQLITE_PRIVATE void sqlite3ExprAssignVar
   const char *z;
   ynVar x;
 
   if( pExpr==0 ) return;
   assert( !ExprHasProperty(pExpr, EP_IntValue|EP_Reduced|EP_TokenOnly) );
   z = pExpr->u.zToken;
   assert( z!=0 );
   assert( z[0]!=0 );
-  assert( n==sqlite3Strlen30(z) );
+  assert( n==(u32)sqlite3Strlen30(z) );
   if( z[1]==0 ){
     /* Wildcard of the form "?".  Assign the next variable number */
     assert( z[0]=='?' );
     x = (ynVar)(++pParse->nVar);
   }else{
     int doAdd = 0;
     if( z[0]=='?' ){
       /* Wildcard of the form "?nnn".  Convert "nnn" to an integer and
@@ -91767,17 +91921,17 @@ static SQLITE_NOINLINE void sqlite3ExprD
     if( ExprHasProperty(p, EP_xIsSelect) ){
       sqlite3SelectDelete(db, p->x.pSelect);
     }else{
       sqlite3ExprListDelete(db, p->x.pList);
     }
   }
   if( ExprHasProperty(p, EP_MemToken) ) sqlite3DbFree(db, p->u.zToken);
   if( !ExprHasProperty(p, EP_Static) ){
-    sqlite3DbFree(db, p);
+    sqlite3DbFreeNN(db, p);
   }
 }
 SQLITE_PRIVATE void sqlite3ExprDelete(sqlite3 *db, Expr *p){
   if( p ) sqlite3ExprDeleteNN(db, p);
 }
 
 /*
 ** Return the number of bytes allocated for the expression structure 
@@ -92034,25 +92188,21 @@ SQLITE_PRIVATE Expr *sqlite3ExprDup(sqli
 }
 SQLITE_PRIVATE ExprList *sqlite3ExprListDup(sqlite3 *db, ExprList *p, int flags){
   ExprList *pNew;
   struct ExprList_item *pItem, *pOldItem;
   int i;
   Expr *pPriorSelectCol = 0;
   assert( db!=0 );
   if( p==0 ) return 0;
-  pNew = sqlite3DbMallocRawNN(db, sizeof(*pNew) );
+  pNew = sqlite3DbMallocRawNN(db, 
+             sizeof(*pNew)+sizeof(pNew->a[0])*(p->nExpr-1) );
   if( pNew==0 ) return 0;
-  pNew->nExpr = i = p->nExpr;
-  if( (flags & EXPRDUP_REDUCE)==0 ) for(i=1; i<p->nExpr; i+=i){}
-  pNew->a = pItem = sqlite3DbMallocRawNN(db,  i*sizeof(p->a[0]) );
-  if( pItem==0 ){
-    sqlite3DbFree(db, pNew);
-    return 0;
-  } 
+  pNew->nAlloc = pNew->nExpr = p->nExpr;
+  pItem = pNew->a;
   pOldItem = p->a;
   for(i=0; i<p->nExpr; i++, pItem++, pOldItem++){
     Expr *pOldExpr = pOldItem->pExpr;
     Expr *pNewExpr;
     pItem->pExpr = sqlite3ExprDup(db, pOldExpr, flags);
     if( pOldExpr 
      && pOldExpr->op==TK_SELECT_COLUMN
      && (pNewExpr = pItem->pExpr)!=0 
@@ -92133,17 +92283,17 @@ SQLITE_PRIVATE IdList *sqlite3IdListDup(
   int i;
   assert( db!=0 );
   if( p==0 ) return 0;
   pNew = sqlite3DbMallocRawNN(db, sizeof(*pNew) );
   if( pNew==0 ) return 0;
   pNew->nId = p->nId;
   pNew->a = sqlite3DbMallocRawNN(db, p->nId*sizeof(p->a[0]) );
   if( pNew->a==0 ){
-    sqlite3DbFree(db, pNew);
+    sqlite3DbFreeNN(db, pNew);
     return 0;
   }
   /* Note that because the size of the allocation for p->a[] is not
   ** necessarily a power of two, sqlite3IdListAppend() may not be called
   ** on the duplicate created by this function. */
   for(i=0; i<p->nId; i++){
     struct IdList_item *pNewItem = &pNew->a[i];
     struct IdList_item *pOldItem = &p->a[i];
@@ -92204,41 +92354,39 @@ SQLITE_PRIVATE Select *sqlite3SelectDup(
 ** NULL is returned.  If non-NULL is returned, then it is guaranteed
 ** that the new entry was successfully appended.
 */
 SQLITE_PRIVATE ExprList *sqlite3ExprListAppend(
   Parse *pParse,          /* Parsing context */
   ExprList *pList,        /* List to which to append. Might be NULL */
   Expr *pExpr             /* Expression to be appended. Might be NULL */
 ){
+  struct ExprList_item *pItem;
   sqlite3 *db = pParse->db;
   assert( db!=0 );
   if( pList==0 ){
     pList = sqlite3DbMallocRawNN(db, sizeof(ExprList) );
     if( pList==0 ){
       goto no_mem;
     }
     pList->nExpr = 0;
-    pList->a = sqlite3DbMallocRawNN(db, sizeof(pList->a[0]));
-    if( pList->a==0 ) goto no_mem;
-  }else if( (pList->nExpr & (pList->nExpr-1))==0 ){
-    struct ExprList_item *a;
-    assert( pList->nExpr>0 );
-    a = sqlite3DbRealloc(db, pList->a, pList->nExpr*2*sizeof(pList->a[0]));
-    if( a==0 ){
+    pList->nAlloc = 1;
+  }else if( pList->nExpr==pList->nAlloc ){
+    ExprList *pNew;
+    pNew = sqlite3DbRealloc(db, pList, 
+             sizeof(*pList)+(2*pList->nAlloc - 1)*sizeof(pList->a[0]));
+    if( pNew==0 ){
       goto no_mem;
     }
-    pList->a = a;
-  }
-  assert( pList->a!=0 );
-  if( 1 ){
-    struct ExprList_item *pItem = &pList->a[pList->nExpr++];
-    memset(pItem, 0, sizeof(*pItem));
-    pItem->pExpr = pExpr;
-  }
+    pList = pNew;
+    pList->nAlloc *= 2;
+  }
+  pItem = &pList->a[pList->nExpr++];
+  memset(pItem, 0, sizeof(*pItem));
+  pItem->pExpr = pExpr;
   return pList;
 
 no_mem:     
   /* Avoid leaking memory if malloc has failed. */
   sqlite3ExprDelete(db, pExpr);
   sqlite3ExprListDelete(db, pList);
   return 0;
 }
@@ -92285,30 +92433,29 @@ SQLITE_PRIVATE ExprList *sqlite3ExprList
     pList = sqlite3ExprListAppend(pParse, pList, pSubExpr);
     if( pList ){
       assert( pList->nExpr==iFirst+i+1 );
       pList->a[pList->nExpr-1].zName = pColumns->a[i].zName;
       pColumns->a[i].zName = 0;
     }
   }
 
-  if( pExpr->op==TK_SELECT ){
-    if( pList && pList->a[iFirst].pExpr ){
-      Expr *pFirst = pList->a[iFirst].pExpr;
-      assert( pFirst->op==TK_SELECT_COLUMN );
+  if( !db->mallocFailed && pExpr->op==TK_SELECT && ALWAYS(pList!=0) ){
+    Expr *pFirst = pList->a[iFirst].pExpr;
+    assert( pFirst!=0 );
+    assert( pFirst->op==TK_SELECT_COLUMN );
      
-      /* Store the SELECT statement in pRight so it will be deleted when
-      ** sqlite3ExprListDelete() is called */
-      pFirst->pRight = pExpr;
-      pExpr = 0;
-
-      /* Remember the size of the LHS in iTable so that we can check that
-      ** the RHS and LHS sizes match during code generation. */
-      pFirst->iTable = pColumns->nId;
-    }
+    /* Store the SELECT statement in pRight so it will be deleted when
+    ** sqlite3ExprListDelete() is called */
+    pFirst->pRight = pExpr;
+    pExpr = 0;
+
+    /* Remember the size of the LHS in iTable so that we can check that
+    ** the RHS and LHS sizes match during code generation. */
+    pFirst->iTable = pColumns->nId;
   }
 
 vector_append_error:
   sqlite3ExprDelete(db, pExpr);
   sqlite3IdListDelete(db, pColumns);
   return pList;
 }
 
@@ -92392,26 +92539,26 @@ SQLITE_PRIVATE void sqlite3ExprListCheck
     sqlite3ErrorMsg(pParse, "too many columns in %s", zObject);
   }
 }
 
 /*
 ** Delete an entire expression list.
 */
 static SQLITE_NOINLINE void exprListDeleteNN(sqlite3 *db, ExprList *pList){
-  int i;
-  struct ExprList_item *pItem;
-  assert( pList->a!=0 || pList->nExpr==0 );
-  for(pItem=pList->a, i=0; i<pList->nExpr; i++, pItem++){
+  int i = pList->nExpr;
+  struct ExprList_item *pItem =  pList->a;
+  assert( pList->nExpr>0 );
+  do{
     sqlite3ExprDelete(db, pItem->pExpr);
     sqlite3DbFree(db, pItem->zName);
     sqlite3DbFree(db, pItem->zSpan);
-  }
-  sqlite3DbFree(db, pList->a);
-  sqlite3DbFree(db, pList);
+    pItem++;
+  }while( --i>0 );
+  sqlite3DbFreeNN(db, pList);
 }
 SQLITE_PRIVATE void sqlite3ExprListDelete(sqlite3 *db, ExprList *pList){
   if( pList ) exprListDeleteNN(db, pList);
 }
 
 /*
 ** Return the bitwise-OR of all Expr.flags fields in the given
 ** ExprList.
@@ -92551,16 +92698,75 @@ SQLITE_PRIVATE int sqlite3ExprIsConstant
 ** for any single row of the table with cursor iCur.  In other words, the
 ** expression must not refer to any non-deterministic function nor any
 ** table other than iCur.
 */
 SQLITE_PRIVATE int sqlite3ExprIsTableConstant(Expr *p, int iCur){
   return exprIsConst(p, 3, iCur);
 }
 
+
+/*
+** sqlite3WalkExpr() callback used by sqlite3ExprIsConstantOrGroupBy().
+*/
+static int exprNodeIsConstantOrGroupBy(Walker *pWalker, Expr *pExpr){
+  ExprList *pGroupBy = pWalker->u.pGroupBy;
+  int i;
+
+  /* Check if pExpr is identical to any GROUP BY term. If so, consider
+  ** it constant.  */
+  for(i=0; i<pGroupBy->nExpr; i++){
+    Expr *p = pGroupBy->a[i].pExpr;
+    if( sqlite3ExprCompare(pExpr, p, -1)<2 ){
+      CollSeq *pColl = sqlite3ExprCollSeq(pWalker->pParse, p);
+      if( pColl==0 || sqlite3_stricmp("BINARY", pColl->zName)==0 ){
+        return WRC_Prune;
+      }
+    }
+  }
+
+  /* Check if pExpr is a sub-select. If so, consider it variable. */
+  if( ExprHasProperty(pExpr, EP_xIsSelect) ){
+    pWalker->eCode = 0;
+    return WRC_Abort;
+  }
+
+  return exprNodeIsConstant(pWalker, pExpr);
+}
+
+/*
+** Walk the expression tree passed as the first argument. Return non-zero
+** if the expression consists entirely of constants or copies of terms 
+** in pGroupBy that sort with the BINARY collation sequence.
+**
+** This routine is used to determine if a term of the HAVING clause can
+** be promoted into the WHERE clause.  In order for such a promotion to work,
+** the value of the HAVING clause term must be the same for all members of
+** a "group".  The requirement that the GROUP BY term must be BINARY
+** assumes that no other collating sequence will have a finer-grained
+** grouping than binary.  In other words (A=B COLLATE binary) implies
+** A=B in every other collating sequence.  The requirement that the
+** GROUP BY be BINARY is stricter than necessary.  It would also work
+** to promote HAVING clauses that use the same alternative collating
+** sequence as the GROUP BY term, but that is much harder to check,
+** alternative collating sequences are uncommon, and this is only an
+** optimization, so we take the easy way out and simply require the
+** GROUP BY to use the BINARY collating sequence.
+*/
+SQLITE_PRIVATE int sqlite3ExprIsConstantOrGroupBy(Parse *pParse, Expr *p, ExprList *pGroupBy){
+  Walker w;
+  memset(&w, 0, sizeof(w));
+  w.eCode = 1;
+  w.xExprCallback = exprNodeIsConstantOrGroupBy;
+  w.u.pGroupBy = pGroupBy;
+  w.pParse = pParse;
+  sqlite3WalkExpr(&w, p);
+  return w.eCode;
+}
+
 /*
 ** Walk an expression tree.  Return non-zero if the expression is constant
 ** or a function call with constant arguments.  Return and 0 if there
 ** are any variables.
 **
 ** For the purposes of this function, a double-quoted string (ex: "abc")
 ** is considered a variable but a single-quoted string (ex: 'abc') is
 ** a constant.
@@ -93928,16 +94134,20 @@ SQLITE_PRIVATE void sqlite3ExprCodeLoadI
 */
 SQLITE_PRIVATE void sqlite3ExprCodeGetColumnOfTable(
   Vdbe *v,        /* The VDBE under construction */
   Table *pTab,    /* The table containing the value */
   int iTabCur,    /* The table cursor.  Or the PK cursor for WITHOUT ROWID */
   int iCol,       /* Index of the column to extract */
   int regOut      /* Extract the value into this register */
 ){
+  if( pTab==0 ){
+    sqlite3VdbeAddOp3(v, OP_Column, iTabCur, iCol, regOut);
+    return;
+  }
   if( iCol<0 || iCol==pTab->iPKey ){
     sqlite3VdbeAddOp2(v, OP_Rowid, iTabCur, regOut);
   }else{
     int op = IsVirtual(pTab) ? OP_VColumn : OP_Column;
     int x = iCol;
     if( !HasRowid(pTab) && !IsVirtual(pTab) ){
       x = sqlite3ColumnOfIndex(sqlite3PrimaryKeyIndex(pTab), iCol);
     }
@@ -94084,17 +94294,21 @@ static void exprToRegister(Expr *p, int 
 static int exprCodeVector(Parse *pParse, Expr *p, int *piFreeable){
   int iResult;
   int nResult = sqlite3ExprVectorSize(p);
   if( nResult==1 ){
     iResult = sqlite3ExprCodeTemp(pParse, p, piFreeable);
   }else{
     *piFreeable = 0;
     if( p->op==TK_SELECT ){
+#if SQLITE_OMIT_SUBQUERY
+      iResult = 0;
+#else
       iResult = sqlite3CodeSubselect(pParse, p, 0, 0);
+#endif
     }else{
       int i;
       iResult = pParse->nMem+1;
       pParse->nMem += nResult;
       for(i=0; i<nResult; i++){
         sqlite3ExprCodeFactorable(pParse, p->x.pList->a[i].pExpr, i+iResult);
       }
     }
@@ -94621,16 +94835,27 @@ SQLITE_PRIVATE int sqlite3ExprCodeTarget
       break;
     }
 
     case TK_VECTOR: {
       sqlite3ErrorMsg(pParse, "row value misused");
       break;
     }
 
+    case TK_IF_NULL_ROW: {
+      int addrINR;
+      addrINR = sqlite3VdbeAddOp1(v, OP_IfNullRow, pExpr->iTable);
+      sqlite3ExprCachePush(pParse);
+      inReg = sqlite3ExprCodeTarget(pParse, pExpr->pLeft, target);
+      sqlite3ExprCachePop(pParse);
+      sqlite3VdbeJumpHere(v, addrINR);
+      sqlite3VdbeChangeP3(v, addrINR, inReg);
+      break;
+    }
+
     /*
     ** Form A:
     **   CASE x WHEN e1 THEN r1 WHEN e2 THEN r2 ... WHEN eN THEN rN ELSE y END
     **
     ** Form B:
     **   CASE WHEN e1 THEN r1 WHEN e2 THEN r2 ... WHEN eN THEN rN ELSE y END
     **
     ** Form A is can be transformed into the equivalent form B as follows:
@@ -99398,16 +99623,28 @@ SQLITE_PRIVATE int sqlite3AuthCheck(
   */
   if( db->init.busy || IN_DECLARE_VTAB ){
     return SQLITE_OK;
   }
 
   if( db->xAuth==0 ){
     return SQLITE_OK;
   }
+
+  /* EVIDENCE-OF: R-43249-19882 The third through sixth parameters to the
+  ** callback are either NULL pointers or zero-terminated strings that
+  ** contain additional details about the action to be authorized.
+  **
+  ** The following testcase() macros show that any of the 3rd through 6th
+  ** parameters can be either NULL or a string. */
+  testcase( zArg1==0 );
+  testcase( zArg2==0 );
+  testcase( zArg3==0 );
+  testcase( pParse->zAuthContext==0 );
+
   rc = db->xAuth(db->pAuthArg, code, zArg1, zArg2, zArg3, pParse->zAuthContext
 #ifdef SQLITE_USER_AUTHENTICATION
                  ,db->auth.zAuthUser
 #endif
                 );
   if( rc==SQLITE_DENY ){
     sqlite3ErrorMsg(pParse, "not authorized");
     pParse->rc = SQLITE_AUTH;
@@ -103069,17 +103306,17 @@ SQLITE_PRIVATE IdList *sqlite3IdListAppe
 */
 SQLITE_PRIVATE void sqlite3IdListDelete(sqlite3 *db, IdList *pList){
   int i;
   if( pList==0 ) return;
   for(i=0; i<pList->nId; i++){
     sqlite3DbFree(db, pList->a[i].zName);
   }
   sqlite3DbFree(db, pList->a);
-  sqlite3DbFree(db, pList);
+  sqlite3DbFreeNN(db, pList);
 }
 
 /*
 ** Return the index in pList of the identifier named zId.  Return -1
 ** if not found.
 */
 SQLITE_PRIVATE int sqlite3IdListIndex(IdList *pList, const char *zName){
   int i;
@@ -103259,17 +103496,17 @@ SQLITE_PRIVATE void sqlite3SrcListDelete
     sqlite3DbFree(db, pItem->zAlias);
     if( pItem->fg.isIndexedBy ) sqlite3DbFree(db, pItem->u1.zIndexedBy);
     if( pItem->fg.isTabFunc ) sqlite3ExprListDelete(db, pItem->u1.pFuncArg);
     sqlite3DeleteTable(db, pItem->pTab);
     sqlite3SelectDelete(db, pItem->pSelect);
     sqlite3ExprDelete(db, pItem->pOn);
     sqlite3IdListDelete(db, pItem->pUsing);
   }
-  sqlite3DbFree(db, pList);
+  sqlite3DbFreeNN(db, pList);
 }
 
 /*
 ** This routine is called by the parser to add a new term to the
 ** end of a growing FROM clause.  The "p" parameter is the part of
 ** the FROM clause that has already been constructed.  "p" is NULL
 ** if this is the first term of the FROM clause.  pTable and pDatabase
 ** are the name of the table and database named in the FROM clause term.
@@ -104733,17 +104970,24 @@ SQLITE_PRIVATE void sqlite3DeleteFrom(
     memCnt = ++pParse->nMem;
     sqlite3VdbeAddOp2(v, OP_Integer, 0, memCnt);
   }
 
 #ifndef SQLITE_OMIT_TRUNCATE_OPTIMIZATION
   /* Special case: A DELETE without a WHERE clause deletes everything.
   ** It is easier just to erase the whole table. Prior to version 3.6.5,
   ** this optimization caused the row change count (the value returned by 
-  ** API function sqlite3_count_changes) to be set incorrectly.  */
+  ** API function sqlite3_count_changes) to be set incorrectly.
+  **
+  ** The "rcauth==SQLITE_OK" terms is the
+  ** IMPLEMENATION-OF: R-17228-37124 If the action code is SQLITE_DELETE and
+  ** the callback returns SQLITE_IGNORE then the DELETE operation proceeds but
+  ** the truncate optimization is disabled and all rows are deleted
+  ** individually.
+  */
   if( rcauth==SQLITE_OK
    && pWhere==0
    && !bComplex
    && !IsVirtual(pTab)
 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
    && db->xPreUpdateCallback==0
 #endif
   ){
@@ -108243,48 +108487,63 @@ SQLITE_PRIVATE u32 sqlite3FkOldmask(
 ** parameter aChange is passed a NULL value. For an UPDATE, aChange points
 ** to an array of size N, where N is the number of columns in table pTab.
 ** If the i'th column is not modified by the UPDATE, then the corresponding 
 ** entry in the aChange[] array is set to -1. If the column is modified,
 ** the value is 0 or greater. Parameter chngRowid is set to true if the
 ** UPDATE statement modifies the rowid fields of the table.
 **
 ** If any foreign key processing will be required, this function returns
-** true. If there is no foreign key related processing, this function 
-** returns false.
+** non-zero. If there is no foreign key related processing, this function 
+** returns zero.
+**
+** For an UPDATE, this function returns 2 if:
+**
+**   * There are any FKs for which pTab is the child and the parent table, or
+**   * the UPDATE modifies one or more parent keys for which the action is
+**     not "NO ACTION" (i.e. is CASCADE, SET DEFAULT or SET NULL).
+**
+** Or, assuming some other foreign key processing is required, 1.
 */
 SQLITE_PRIVATE int sqlite3FkRequired(
   Parse *pParse,                  /* Parse context */
   Table *pTab,                    /* Table being modified */
   int *aChange,                   /* Non-NULL for UPDATE operations */
   int chngRowid                   /* True for UPDATE that affects rowid */
 ){
+  int eRet = 0;
   if( pParse->db->flags&SQLITE_ForeignKeys ){
     if( !aChange ){
       /* A DELETE operation. Foreign key processing is required if the 
       ** table in question is either the child or parent table for any 
       ** foreign key constraint.  */
-      return (sqlite3FkReferences(pTab) || pTab->pFKey);
+      eRet = (sqlite3FkReferences(pTab) || pTab->pFKey);
     }else{
       /* This is an UPDATE. Foreign key processing is only required if the
       ** operation modifies one or more child or parent key columns. */
       FKey *p;
 
       /* Check if any child key columns are being modified. */
       for(p=pTab->pFKey; p; p=p->pNextFrom){
-        if( fkChildIsModified(pTab, p, aChange, chngRowid) ) return 1;
+        if( 0==sqlite3_stricmp(pTab->zName, p->zTo) ) return 2;
+        if( fkChildIsModified(pTab, p, aChange, chngRowid) ){
+          eRet = 1;
+        }
       }
 
       /* Check if any parent key columns are being modified. */
       for(p=sqlite3FkReferences(pTab); p; p=p->pNextTo){
-        if( fkParentIsModified(pTab, p, aChange, chngRowid) ) return 1;
-      }
-    }
-  }
-  return 0;
+        if( fkParentIsModified(pTab, p, aChange, chngRowid) ){
+          if( p->aAction[1]!=OE_None ) return 2;
+          eRet = 1;
+        }
+      }
+    }
+  }
+  return eRet;
 }
 
 /*
 ** This function is called when an UPDATE or DELETE operation is being 
 ** compiled on table pTab, which is the parent table of foreign-key pFKey.
 ** If the current operation is an UPDATE, then the pChanges parameter is
 ** passed a pointer to the list of columns being modified. If it is a
 ** DELETE, pChanges is passed a NULL pointer.
@@ -112784,17 +113043,17 @@ static const PragmaName aPragmaName[] = 
  {/* zName:     */ "mmap_size",
   /* ePragTyp:  */ PragTyp_MMAP_SIZE,
   /* ePragFlg:  */ 0,
   /* ColNames:  */ 0, 0,
   /* iArg:      */ 0 },
 #endif
  {/* zName:     */ "optimize",
   /* ePragTyp:  */ PragTyp_OPTIMIZE,
-  /* ePragFlg:  */ PragFlg_Result1,
+  /* ePragFlg:  */ PragFlg_Result1|PragFlg_NeedSchema,
   /* ColNames:  */ 0, 0,
   /* iArg:      */ 0 },
 #if !defined(SQLITE_OMIT_PAGER_PRAGMAS)
  {/* zName:     */ "page_count",
   /* ePragTyp:  */ PragTyp_PAGE_COUNT,
   /* ePragFlg:  */ PragFlg_NeedSchema|PragFlg_Result0|PragFlg_SchemaReq,
   /* ColNames:  */ 0, 0,
   /* iArg:      */ 0 },
@@ -114284,43 +114543,47 @@ SQLITE_PRIVATE void sqlite3Pragma(
         pParent = sqlite3FindTable(db, pFK->zTo, zDb);
         pIdx = 0;
         aiCols = 0;
         if( pParent ){
           x = sqlite3FkLocateIndex(pParse, pParent, pFK, &pIdx, &aiCols);
           assert( x==0 );
         }
         addrOk = sqlite3VdbeMakeLabel(v);
-        if( pParent && pIdx==0 ){
-          int iKey = pFK->aCol[0].iFrom;
-          assert( iKey>=0 && iKey<pTab->nCol );
-          if( iKey!=pTab->iPKey ){
-            sqlite3VdbeAddOp3(v, OP_Column, 0, iKey, regRow);
-            sqlite3ColumnDefault(v, pTab, iKey, regRow);
-            sqlite3VdbeAddOp2(v, OP_IsNull, regRow, addrOk); VdbeCoverage(v);
-          }else{
-            sqlite3VdbeAddOp2(v, OP_Rowid, 0, regRow);
-          }
-          sqlite3VdbeAddOp3(v, OP_SeekRowid, i, 0, regRow); VdbeCoverage(v);
+
+        /* Generate code to read the child key values into registers
+        ** regRow..regRow+n. If any of the child key values are NULL, this 
+        ** row cannot cause an FK violation. Jump directly to addrOk in 
+        ** this case. */
+        for(j=0; j<pFK->nCol; j++){
+          int iCol = aiCols ? aiCols[j] : pFK->aCol[j].iFrom;
+          sqlite3ExprCodeGetColumnOfTable(v, pTab, 0, iCol, regRow+j);
+          sqlite3VdbeAddOp2(v, OP_IsNull, regRow+j, addrOk); VdbeCoverage(v);
+        }
+
+        /* Generate code to query the parent index for a matching parent
+        ** key. If a match is found, jump to addrOk. */
+        if( pIdx ){
+          sqlite3VdbeAddOp4(v, OP_MakeRecord, regRow, pFK->nCol, regKey,
+              sqlite3IndexAffinityStr(db,pIdx), pFK->nCol);
+          sqlite3VdbeAddOp4Int(v, OP_Found, i, addrOk, regKey, 0);
+          VdbeCoverage(v);
+        }else if( pParent ){
+          int jmp = sqlite3VdbeCurrentAddr(v)+2;
+          sqlite3VdbeAddOp3(v, OP_SeekRowid, i, jmp, regRow); VdbeCoverage(v);
           sqlite3VdbeGoto(v, addrOk);
-          sqlite3VdbeJumpHere(v, sqlite3VdbeCurrentAddr(v)-2);
+          assert( pFK->nCol==1 );
+        }
+
+        /* Generate code to report an FK violation to the caller. */
+        if( HasRowid(pTab) ){
+          sqlite3VdbeAddOp2(v, OP_Rowid, 0, regResult+1);
         }else{
-          for(j=0; j<pFK->nCol; j++){
-            sqlite3ExprCodeGetColumnOfTable(v, pTab, 0,
-                            aiCols ? aiCols[j] : pFK->aCol[j].iFrom, regRow+j);
-            sqlite3VdbeAddOp2(v, OP_IsNull, regRow+j, addrOk); VdbeCoverage(v);
-          }
-          if( pParent ){
-            sqlite3VdbeAddOp4(v, OP_MakeRecord, regRow, pFK->nCol, regKey,
-                              sqlite3IndexAffinityStr(db,pIdx), pFK->nCol);
-            sqlite3VdbeAddOp4Int(v, OP_Found, i, addrOk, regKey, 0);
-            VdbeCoverage(v);
-          }
-        }
-        sqlite3VdbeAddOp2(v, OP_Rowid, 0, regResult+1);
+          sqlite3VdbeAddOp2(v, OP_Null, 0, regResult+1);
+        }
         sqlite3VdbeMultiLoad(v, regResult+2, "si", pFK->zTo, i-1);
         sqlite3VdbeAddOp2(v, OP_ResultRow, regResult, 4);
         sqlite3VdbeResolveLabel(v, addrOk);
         sqlite3DbFree(db, aiCols);
       }
       sqlite3VdbeAddOp2(v, OP_Next, 0, addrTop+1); VdbeCoverage(v);
       sqlite3VdbeJumpHere(v, addrTop);
     }
@@ -114496,35 +114759,38 @@ SQLITE_PRIVATE void sqlite3Pragma(
           zErr = sqlite3MPrintf(db, "NULL value in %s.%s", pTab->zName,
                               pTab->aCol[j].zName);
           sqlite3VdbeAddOp4(v, OP_String8, 0, 3, 0, zErr, P4_DYNAMIC);
           integrityCheckResultRow(v, 3);
           sqlite3VdbeJumpHere(v, jmp2);
         }
         /* Verify CHECK constraints */
         if( pTab->pCheck && (db->flags & SQLITE_IgnoreChecks)==0 ){
-          int addrCkFault = sqlite3VdbeMakeLabel(v);
-          int addrCkOk = sqlite3VdbeMakeLabel(v);
-          ExprList *pCheck = pTab->pCheck;
-          char *zErr;
-          int k;
-          pParse->iSelfTab = iDataCur;
-          sqlite3ExprCachePush(pParse);
-          for(k=pCheck->nExpr-1; k>0; k--){
-            sqlite3ExprIfFalse(pParse, pCheck->a[k].pExpr, addrCkFault, 0);
-          }
-          sqlite3ExprIfTrue(pParse, pCheck->a[0].pExpr, addrCkOk, 
-                            SQLITE_JUMPIFNULL);
-          sqlite3VdbeResolveLabel(v, addrCkFault);
-          zErr = sqlite3MPrintf(db, "CHECK constraint failed in %s",
-                                pTab->zName);
-          sqlite3VdbeAddOp4(v, OP_String8, 0, 3, 0, zErr, P4_DYNAMIC);
-          integrityCheckResultRow(v, 3);
-          sqlite3VdbeResolveLabel(v, addrCkOk);
-          sqlite3ExprCachePop(pParse);
+          ExprList *pCheck = sqlite3ExprListDup(db, pTab->pCheck, 0);
+          if( db->mallocFailed==0 ){
+            int addrCkFault = sqlite3VdbeMakeLabel(v);
+            int addrCkOk = sqlite3VdbeMakeLabel(v);
+            char *zErr;
+            int k;
+            pParse->iSelfTab = iDataCur;
+            sqlite3ExprCachePush(pParse);
+            for(k=pCheck->nExpr-1; k>0; k--){
+              sqlite3ExprIfFalse(pParse, pCheck->a[k].pExpr, addrCkFault, 0);
+            }
+            sqlite3ExprIfTrue(pParse, pCheck->a[0].pExpr, addrCkOk, 
+                SQLITE_JUMPIFNULL);
+            sqlite3VdbeResolveLabel(v, addrCkFault);
+            zErr = sqlite3MPrintf(db, "CHECK constraint failed in %s",
+                pTab->zName);
+            sqlite3VdbeAddOp4(v, OP_String8, 0, 3, 0, zErr, P4_DYNAMIC);
+            integrityCheckResultRow(v, 3);
+            sqlite3VdbeResolveLabel(v, addrCkOk);
+            sqlite3ExprCachePop(pParse);
+          }
+          sqlite3ExprListDelete(db, pCheck);
         }
         /* Validate index entries for the current row */
         for(j=0, pIdx=pTab->pIndex; pIdx && !isQuick; pIdx=pIdx->pNext, j++){
           int jmp2, jmp3, jmp4, jmp5;
           int ckUniq = sqlite3VdbeMakeLabel(v);
           if( pPk==pIdx ) continue;
           r1 = sqlite3GenerateIndexKey(pParse, pIdx, iDataCur, 0, 0, &jmp3,
                                        pPrior, r1);
@@ -116318,17 +116584,17 @@ static void clearSelect(sqlite3 *db, Sel
     sqlite3SrcListDelete(db, p->pSrc);
     sqlite3ExprDelete(db, p->pWhere);
     sqlite3ExprListDelete(db, p->pGroupBy);
     sqlite3ExprDelete(db, p->pHaving);
     sqlite3ExprListDelete(db, p->pOrderBy);
     sqlite3ExprDelete(db, p->pLimit);
     sqlite3ExprDelete(db, p->pOffset);
     if( p->pWith ) sqlite3WithDelete(db, p->pWith);
-    if( bFree ) sqlite3DbFree(db, p);
+    if( bFree ) sqlite3DbFreeNN(db, p);
     p = pPrior;
     bFree = 1;
   }
 }
 
 /*
 ** Initialize a SelectDest structure.
 */
@@ -116354,50 +116620,49 @@ SQLITE_PRIVATE Select *sqlite3SelectNew(
   Expr *pHaving,        /* the HAVING clause */
   ExprList *pOrderBy,   /* the ORDER BY clause */
   u32 selFlags,         /* Flag parameters, such as SF_Distinct */
   Expr *pLimit,         /* LIMIT value.  NULL means not used */
   Expr *pOffset         /* OFFSET value.  NULL means no offset */
 ){
   Select *pNew;
   Select standin;
-  sqlite3 *db = pParse->db;
-  pNew = sqlite3DbMallocRawNN(db, sizeof(*pNew) );
+  pNew = sqlite3DbMallocRawNN(pParse->db, sizeof(*pNew) );
   if( pNew==0 ){
-    assert( db->mallocFailed );
+    assert( pParse->db->mallocFailed );
     pNew = &standin;
   }
   if( pEList==0 ){
-    pEList = sqlite3ExprListAppend(pParse, 0, sqlite3Expr(db,TK_ASTERISK,0));
+    pEList = sqlite3ExprListAppend(pParse, 0, sqlite3Expr(pParse->db,TK_ASTERISK,0));
   }
   pNew->pEList = pEList;
   pNew->op = TK_SELECT;
   pNew->selFlags = selFlags;
   pNew->iLimit = 0;
   pNew->iOffset = 0;
 #if SELECTTRACE_ENABLED
   pNew->zSelName[0] = 0;
 #endif
   pNew->addrOpenEphm[0] = -1;
   pNew->addrOpenEphm[1] = -1;
   pNew->nSelectRow = 0;
-  if( pSrc==0 ) pSrc = sqlite3DbMallocZero(db, sizeof(*pSrc));
+  if( pSrc==0 ) pSrc = sqlite3DbMallocZero(pParse->db, sizeof(*pSrc));
   pNew->pSrc = pSrc;
   pNew->pWhere = pWhere;
   pNew->pGroupBy = pGroupBy;
   pNew->pHaving = pHaving;
   pNew->pOrderBy = pOrderBy;
   pNew->pPrior = 0;
   pNew->pNext = 0;
   pNew->pLimit = pLimit;
   pNew->pOffset = pOffset;
   pNew->pWith = 0;
-  assert( pOffset==0 || pLimit!=0 || pParse->nErr>0 || db->mallocFailed!=0 );
-  if( db->mallocFailed ) {
-    clearSelect(db, pNew, pNew!=&standin);
+  assert( pOffset==0 || pLimit!=0 || pParse->nErr>0 || pParse->db->mallocFailed!=0 );
+  if( pParse->db->mallocFailed ) {
+    clearSelect(pParse->db, pNew, pNew!=&standin);
     pNew = 0;
   }else{
     assert( pNew->pSrc!=0 || pParse->nErr>0 );
   }
   assert( pNew!=&standin );
   return pNew;
 }
 
@@ -117297,17 +117562,17 @@ SQLITE_PRIVATE KeyInfo *sqlite3KeyInfoAl
 
 /*
 ** Deallocate a KeyInfo object
 */
 SQLITE_PRIVATE void sqlite3KeyInfoUnref(KeyInfo *p){
   if( p ){
     assert( p->nRef>0 );
     p->nRef--;
-    if( p->nRef==0 ) sqlite3DbFree(p->db, p);
+    if( p->nRef==0 ) sqlite3DbFreeNN(p->db, p);
   }
 }
 
 /*
 ** Make a new pointer to a KeyInfo object
 */
 SQLITE_PRIVATE KeyInfo *sqlite3KeyInfoRef(KeyInfo *p){
   if( p ){
@@ -117772,16 +118037,17 @@ static void generateColumnTypes(
   ExprList *pEList    /* Expressions defining the result set */
 ){
 #ifndef SQLITE_OMIT_DECLTYPE
   Vdbe *v = pParse->pVdbe;
   int i;
   NameContext sNC;
   sNC.pSrcList = pTabList;
   sNC.pParse = pParse;
+  sNC.pNext = 0;
   for(i=0; i<pEList->nExpr; i++){
     Expr *p = pEList->a[i].pExpr;
     const char *zType;
 #ifdef SQLITE_ENABLE_COLUMN_METADATA
     const char *zOrigDb = 0;
     const char *zOrigTab = 0;
     const char *zOrigCol = 0;
     zType = columnType(&sNC, p, &zOrigDb, &zOrigTab, &zOrigCol, 0);
@@ -117797,27 +118063,41 @@ static void generateColumnTypes(
     zType = columnType(&sNC, p, 0, 0, 0, 0);
 #endif
     sqlite3VdbeSetColName(v, i, COLNAME_DECLTYPE, zType, SQLITE_TRANSIENT);
   }
 #endif /* !defined(SQLITE_OMIT_DECLTYPE) */
 }
 
 /*
+** Return the Table objecct in the SrcList that has cursor iCursor.
+** Or return NULL if no such Table object exists in the SrcList.
+*/
+static Table *tableWithCursor(SrcList *pList, int iCursor){
+  int j;
+  for(j=0; j<pList->nSrc; j++){
+    if( pList->a[j].iCursor==iCursor ) return pList->a[j].pTab;
+  }
+  return 0;
+}
+
+
+/*
 ** Generate code that will tell the VDBE the names of columns
 ** in the result set.  This information is used to provide the
 ** azCol[] values in the callback.
 */
 static void generateColumnNames(
   Parse *pParse,      /* Parser context */
   SrcList *pTabList,  /* List of tables */
   ExprList *pEList    /* Expressions defining the result set */
 ){
   Vdbe *v = pParse->pVdbe;
-  int i, j;
+  int i;
+  Table *pTab;
   sqlite3 *db = pParse->db;
   int fullNames, shortNames;
 
 #ifndef SQLITE_OMIT_EXPLAIN
   /* If this is an EXPLAIN, skip this step */
   if( pParse->explain ){
     return;
   }
@@ -117832,25 +118112,21 @@ static void generateColumnNames(
   sqlite3VdbeSetNumCols(v, pEList->nExpr);
   for(i=0; i<pEList->nExpr; i++){
     Expr *p;
     p = pEList->a[i].pExpr;
     if( NEVER(p==0) ) continue;
     if( pEList->a[i].zName ){
       char *zName = pEList->a[i].zName;
       sqlite3VdbeSetColName(v, i, COLNAME_NAME, zName, SQLITE_TRANSIENT);
-    }else if( p->op==TK_COLUMN || p->op==TK_AGG_COLUMN ){
-      Table *pTab;
+    }else if( (p->op==TK_COLUMN || p->op==TK_AGG_COLUMN)
+           && (pTab = tableWithCursor(pTabList, p->iTable))!=0
+    ){
       char *zCol;
       int iCol = p->iColumn;
-      for(j=0; ALWAYS(j<pTabList->nSrc); j++){
-        if( pTabList->a[j].iCursor==p->iTable ) break;
-      }
-      assert( j<pTabList->nSrc );
-      pTab = pTabList->a[j].pTab;
       if( iCol<0 ) iCol = pTab->iPKey;
       assert( iCol==-1 || (iCol>=0 && iCol<pTab->nCol) );
       if( iCol<0 ){
         zCol = "rowid";
       }else{
         zCol = pTab->aCol[iCol].zName;
       }
       if( !shortNames && !fullNames ){
@@ -117922,17 +118198,17 @@ SQLITE_PRIVATE int sqlite3ColumnsFromExp
       /* If the column contains an "AS <name>" phrase, use <name> as the name */
     }else{
       Expr *pColExpr = p;  /* The expression that is the result column name */
       Table *pTab;         /* Table associated with this expression */
       while( pColExpr->op==TK_DOT ){
         pColExpr = pColExpr->pRight;
         assert( pColExpr!=0 );
       }
-      if( pColExpr->op==TK_COLUMN && ALWAYS(pColExpr->pTab!=0) ){
+      if( pColExpr->op==TK_COLUMN && pColExpr->pTab!=0 ){
         /* For columns use the column name name */
         int iCol = pColExpr->iColumn;
         pTab = pColExpr->pTab;
         if( iCol<0 ) iCol = pTab->iPKey;
         zName = iCol>=0 ? pTab->aCol[iCol].zName : "rowid";
       }else if( pColExpr->op==TK_ID ){
         assert( !ExprHasProperty(pColExpr, EP_IntValue) );
         zName = pColExpr->u.zToken;
@@ -119142,17 +119418,17 @@ static int multiSelectOrderBy(
         assert( pItem->u.x.iOrderByCol>0 );
         if( pItem->u.x.iOrderByCol==i ) break;
       }
       if( j==nOrderBy ){
         Expr *pNew = sqlite3Expr(db, TK_INTEGER, 0);
         if( pNew==0 ) return SQLITE_NOMEM_BKPT;
         pNew->flags |= EP_IntValue;
         pNew->u.iValue = i;
-        pOrderBy = sqlite3ExprListAppend(pParse, pOrderBy, pNew);
+        p->pOrderBy = pOrderBy = sqlite3ExprListAppend(pParse, pOrderBy, pNew);
         if( pOrderBy ) pOrderBy->a[nOrderBy++].u.x.iOrderByCol = (u16)i;
       }
     }
   }
 
   /* Compute the comparison permutation and keyinfo that is used with
   ** the permutation used to determine if the next
   ** row of results comes from selectA or selectB.  Also add explicit
@@ -119376,107 +119652,130 @@ static int multiSelectOrderBy(
   /*** TBD:  Insert subroutine calls to close cursors on incomplete
   **** subqueries ****/
   explainComposite(pParse, p->op, iSub1, iSub2, 0);
   return pParse->nErr!=0;
 }
 #endif
 
 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
+
+/* An instance of the SubstContext object describes an substitution edit
+** to be performed on a parse tree.
+**
+** All references to columns in table iTable are to be replaced by corresponding
+** expressions in pEList.
+*/
+typedef struct SubstContext {
+  Parse *pParse;            /* The parsing context */
+  int iTable;               /* Replace references to this table */
+  int iNewTable;            /* New table number */
+  int isLeftJoin;           /* Add TK_IF_NULL_ROW opcodes on each replacement */
+  ExprList *pEList;         /* Replacement expressions */
+} SubstContext;
+
 /* Forward Declarations */
-static void substExprList(Parse*, ExprList*, int, ExprList*);
-static void substSelect(Parse*, Select *, int, ExprList*, int);
+static void substExprList(SubstContext*, ExprList*);
+static void substSelect(SubstContext*, Select*, int);
 
 /*
 ** Scan through the expression pExpr.  Replace every reference to
 ** a column in table number iTable with a copy of the iColumn-th
 ** entry in pEList.  (But leave references to the ROWID column 
 ** unchanged.)
 **
 ** This routine is part of the flattening procedure.  A subquery
 ** whose result set is defined by pEList appears as entry in the
 ** FROM clause of a SELECT such that the VDBE cursor assigned to that
-** FORM clause entry is iTable.  This routine make the necessary 
+** FORM clause entry is iTable.  This routine makes the necessary 
 ** changes to pExpr so that it refers directly to the source table
 ** of the subquery rather the result set of the subquery.
 */
 static Expr *substExpr(
-  Parse *pParse,      /* Report errors here */
-  Expr *pExpr,        /* Expr in which substitution occurs */
-  int iTable,         /* Table to be substituted */
-  ExprList *pEList    /* Substitute expressions */
-){
-  sqlite3 *db = pParse->db;
+  SubstContext *pSubst,  /* Description of the substitution */
+  Expr *pExpr            /* Expr in which substitution occurs */
+){
   if( pExpr==0 ) return 0;
-  if( pExpr->op==TK_COLUMN && pExpr->iTable==iTable ){
+  if( ExprHasProperty(pExpr, EP_FromJoin) && pExpr->iRightJoinTable==pSubst->iTable ){
+    pExpr->iRightJoinTable = pSubst->iNewTable;
+  }
+  if( pExpr->op==TK_COLUMN && pExpr->iTable==pSubst->iTable ){
     if( pExpr->iColumn<0 ){
       pExpr->op = TK_NULL;
     }else{
       Expr *pNew;
-      Expr *pCopy = pEList->a[pExpr->iColumn].pExpr;
-      assert( pEList!=0 && pExpr->iColumn<pEList->nExpr );
+      Expr *pCopy = pSubst->pEList->a[pExpr->iColumn].pExpr;
+      Expr ifNullRow;
+      assert( pSubst->pEList!=0 && pExpr->iColumn<pSubst->pEList->nExpr );
       assert( pExpr->pLeft==0 && pExpr->pRight==0 );
       if( sqlite3ExprIsVector(pCopy) ){
-        sqlite3VectorErrorMsg(pParse, pCopy);
-      }else{
+        sqlite3VectorErrorMsg(pSubst->pParse, pCopy);
+      }else{
+        sqlite3 *db = pSubst->pParse->db;
+        if( pSubst->isLeftJoin && pCopy->op!=TK_COLUMN ){
+          memset(&ifNullRow, 0, sizeof(ifNullRow));
+          ifNullRow.op = TK_IF_NULL_ROW;
+          ifNullRow.pLeft = pCopy;
+          ifNullRow.iTable = pSubst->iNewTable;
+          pCopy = &ifNullRow;
+        }
         pNew = sqlite3ExprDup(db, pCopy, 0);
         if( pNew && (pExpr->flags & EP_FromJoin) ){
           pNew->iRightJoinTable = pExpr->iRightJoinTable;
           pNew->flags |= EP_FromJoin;
         }
         sqlite3ExprDelete(db, pExpr);
         pExpr = pNew;
       }
     }
   }else{
-    pExpr->pLeft = substExpr(pParse, pExpr->pLeft, iTable, pEList);
-    pExpr->pRight = substExpr(pParse, pExpr->pRight, iTable, pEList);
+    if( pExpr->op==TK_IF_NULL_ROW && pExpr->iTable==pSubst->iTable ){
+      pExpr->iTable = pSubst->iNewTable;
+    }
+    pExpr->pLeft = substExpr(pSubst, pExpr->pLeft);
+    pExpr->pRight = substExpr(pSubst, pExpr->pRight);
     if( ExprHasProperty(pExpr, EP_xIsSelect) ){
-      substSelect(pParse, pExpr->x.pSelect, iTable, pEList, 1);
-    }else{
-      substExprList(pParse, pExpr->x.pList, iTable, pEList);
+      substSelect(pSubst, pExpr->x.pSelect, 1);
+    }else{
+      substExprList(pSubst, pExpr->x.pList);
     }
   }
   return pExpr;
 }
 static void substExprList(
-  Parse *pParse,       /* Report errors here */
-  ExprList *pList,     /* List to scan and in which to make substitutes */
-  int iTable,          /* Table to be substituted */
-  ExprList *pEList     /* Substitute values */
+  SubstContext *pSubst, /* Description of the substitution */
+  ExprList *pList       /* List to scan and in which to make substitutes */
 ){
   int i;
   if( pList==0 ) return;
   for(i=0; i<pList->nExpr; i++){
-    pList->a[i].pExpr = substExpr(pParse, pList->a[i].pExpr, iTable, pEList);
+    pList->a[i].pExpr = substExpr(pSubst, pList->a[i].pExpr);
   }
 }
 static void substSelect(
-  Parse *pParse,       /* Report errors here */
-  Select *p,           /* SELECT statement in which to make substitutions */
-  int iTable,          /* Table to be replaced */
-  ExprList *pEList,    /* Substitute values */
-  int doPrior          /* Do substitutes on p->pPrior too */
+  SubstContext *pSubst, /* Description of the substitution */
+  Select *p,            /* SELECT statement in which to make substitutions */
+  int doPrior           /* Do substitutes on p->pPrior too */
 ){
   SrcList *pSrc;
   struct SrcList_item *pItem;
   int i;
   if( !p ) return;
   do{
-    substExprList(pParse, p->pEList, iTable, pEList);
-    substExprList(pParse, p->pGroupBy, iTable, pEList);
-    substExprList(pParse, p->pOrderBy, iTable, pEList);
-    p->pHaving = substExpr(pParse, p->pHaving, iTable, pEList);
-    p->pWhere = substExpr(pParse, p->pWhere, iTable, pEList);
+    substExprList(pSubst, p->pEList);
+    substExprList(pSubst, p->pGroupBy);
+    substExprList(pSubst, p->pOrderBy);
+    p->pHaving = substExpr(pSubst, p->pHaving);
+    p->pWhere = substExpr(pSubst, p->pWhere);
     pSrc = p->pSrc;
     assert( pSrc!=0 );
     for(i=pSrc->nSrc, pItem=pSrc->a; i>0; i--, pItem++){
-      substSelect(pParse, pItem->pSelect, iTable, pEList, 1);
+      substSelect(pSubst, pItem->pSelect, 1);
       if( pItem->fg.isTabFunc ){
-        substExprList(pParse, pItem->u1.pFuncArg, iTable, pEList);
+        substExprList(pSubst, pItem->u1.pFuncArg);
       }
     }
   }while( doPrior && (p = p->pPrior)!=0 );
 }
 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
 
 #if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
 /*
@@ -119509,30 +119808,31 @@ static void substSelect(
 **
 **   (1)  The subquery and the outer query do not both use aggregates.
 **
 **   (2)  The subquery is not an aggregate or (2a) the outer query is not a join
 **        and (2b) the outer query does not use subqueries other than the one
 **        FROM-clause subquery that is a candidate for flattening.  (2b is
 **        due to ticket [2f7170d73bf9abf80] from 2015-02-09.)
 **
-**   (3)  The subquery is not the right operand of a left outer join
-**        (Originally ticket #306.  Strengthened by ticket #3300)
+**   (3)  The subquery is not the right operand of a LEFT JOIN
+**        or the subquery is not itself a join and the outer query is not
+**        an aggregate.
 **
 **   (4)  The subquery is not DISTINCT.
 **
 **  (**)  At one point restrictions (4) and (5) defined a subset of DISTINCT
 **        sub-queries that were excluded from this optimization. Restriction 
 **        (4) has since been expanded to exclude all DISTINCT subqueries.
 **
 **   (6)  The subquery does not use aggregates or the outer query is not
 **        DISTINCT.
 **
 **   (7)  The subquery has a FROM clause.  TODO:  For subqueries without
-**        A FROM clause, consider adding a FROM close with the special
+**        A FROM clause, consider adding a FROM clause with the special
 **        table sqlite_once that consists of a single row containing a
 **        single NULL.
 **
 **   (8)  The subquery does not use LIMIT or the outer query is not a join.
 **
 **   (9)  The subquery does not use LIMIT or the outer query does not use
 **        aggregates.
 **
@@ -119628,16 +119928,18 @@ static int flattenSubquery(
   const char *zSavedAuthContext = pParse->zAuthContext;
   Select *pParent;    /* Current UNION ALL term of the other query */
   Select *pSub;       /* The inner query or "subquery" */
   Select *pSub1;      /* Pointer to the rightmost select in sub-query */
   SrcList *pSrc;      /* The FROM clause of the outer query */
   SrcList *pSubSrc;   /* The FROM clause of the subquery */
   ExprList *pList;    /* The result set of the outer query */
   int iParent;        /* VDBE cursor number of the pSub result set temp table */
+  int iNewParent = -1;/* Replacement table for iParent */
+  int isLeftJoin = 0; /* True if pSub is the right side of a LEFT JOIN */    
   int i;              /* Loop counter */
   Expr *pWhere;                    /* The WHERE clause */
   struct SrcList_item *pSubitem;   /* The subquery */
   sqlite3 *db = pParse->db;
 
   /* Check to see if flattening is permitted.  Return 0 if not.
   */
   assert( p!=0 );
@@ -119654,17 +119956,17 @@ static int flattenSubquery(
     if( pSrc->nSrc>1 ) return 0;                         /* Restriction (2a)  */
     if( (p->pWhere && ExprHasProperty(p->pWhere,EP_Subquery))
      || (sqlite3ExprListFlags(p->pEList) & EP_Subquery)!=0
      || (sqlite3ExprListFlags(p->pOrderBy) & EP_Subquery)!=0
     ){
       return 0;                                          /* Restriction (2b)  */
     }
   }
-    
+
   pSubSrc = pSub->pSrc;
   assert( pSubSrc );
   /* Prior to version 3.1.2, when LIMIT and OFFSET had to be simple constants,
   ** not arbitrary expressions, we allowed some combining of LIMIT and OFFSET
   ** because they could be computed at compile-time.  But when LIMIT and OFFSET
   ** became arbitrary expressions, we were forced to add restrictions (13)
   ** and (14). */
   if( pSub->pLimit && p->pLimit ) return 0;              /* Restriction (13) */
@@ -119692,50 +119994,40 @@ static int flattenSubquery(
   testcase( pSub->selFlags & SF_MinMaxAgg );
   if( pSub->selFlags & (SF_Recursive|SF_MinMaxAgg) ){
     return 0; /* Restrictions (22) and (24) */
   }
   if( (p->selFlags & SF_Recursive) && pSub->pPrior ){
     return 0; /* Restriction (23) */
   }
 
-  /* OBSOLETE COMMENT 1:
-  ** Restriction 3:  If the subquery is a join, make sure the subquery is 
-  ** not used as the right operand of an outer join.  Examples of why this
-  ** is not allowed:
+  /*
+  ** If the subquery is the right operand of a LEFT JOIN, then the
+  ** subquery may not be a join itself.  Example of why this is not allowed:
   **
   **         t1 LEFT OUTER JOIN (t2 JOIN t3)
   **
   ** If we flatten the above, we would get
   **
   **         (t1 LEFT OUTER JOIN t2) JOIN t3
   **
   ** which is not at all the same thing.
   **
-  ** OBSOLETE COMMENT 2:
-  ** Restriction 12:  If the subquery is the right operand of a left outer
-  ** join, make sure the subquery has no WHERE clause.
-  ** An examples of why this is not allowed:
-  **
-  **         t1 LEFT OUTER JOIN (SELECT * FROM t2 WHERE t2.x>0)
-  **
-  ** If we flatten the above, we would get
-  **
-  **         (t1 LEFT OUTER JOIN t2) WHERE t2.x>0
-  **
-  ** But the t2.x>0 test will always fail on a NULL row of t2, which
-  ** effectively converts the OUTER JOIN into an INNER JOIN.
-  **
-  ** THIS OVERRIDES OBSOLETE COMMENTS 1 AND 2 ABOVE:
-  ** Ticket #3300 shows that flattening the right term of a LEFT JOIN
-  ** is fraught with danger.  Best to avoid the whole thing.  If the
-  ** subquery is the right term of a LEFT JOIN, then do not flatten.
+  ** If the subquery is the right operand of a LEFT JOIN, then the outer
+  ** query cannot be an aggregate.  This is an artifact of the way aggregates
+  ** are processed - there is not mechanism to determine if the LEFT JOIN
+  ** table should be all-NULL.
+  **
+  ** See also tickets #306, #350, and #3300.
   */
   if( (pSubitem->fg.jointype & JT_OUTER)!=0 ){
-    return 0;
+    isLeftJoin = 1;
+    if( pSubSrc->nSrc>1 || isAgg ){
+      return 0; /* Restriction (3) */
+    }
   }
 
   /* Restriction 17: If the sub-query is a compound SELECT, then it must
   ** use only the UNION ALL operator. And none of the simple select queries
   ** that make up the compound SELECT are allowed to be aggregate or distinct
   ** queries.
   */
   if( pSub->pPrior ){
@@ -119934,16 +120226,17 @@ static int flattenSubquery(
 
     /* Transfer the FROM clause terms from the subquery into the
     ** outer query.
     */
     for(i=0; i<nSubSrc; i++){
       sqlite3IdListDelete(db, pSrc->a[i+iFrom].pUsing);
       assert( pSrc->a[i+iFrom].fg.isTabFunc==0 );
       pSrc->a[i+iFrom] = pSubSrc->a[i];
+      iNewParent = pSubSrc->a[i].iCursor;
       memset(&pSubSrc->a[i], 0, sizeof(pSubSrc->a[i]));
     }
     pSrc->a[iFrom].fg.jointype = jointype;
   
     /* Now begin substituting subquery result set expressions for 
     ** references to the iParent in the outer query.
     ** 
     ** Example:
@@ -119979,30 +120272,39 @@ static int flattenSubquery(
         pOrderBy->a[i].u.x.iOrderByCol = 0;
       }
       assert( pParent->pOrderBy==0 );
       assert( pSub->pPrior==0 );
       pParent->pOrderBy = pOrderBy;
       pSub->pOrderBy = 0;
     }
     pWhere = sqlite3ExprDup(db, pSub->pWhere, 0);
+    if( isLeftJoin ){
+      setJoinExpr(pWhere, iNewParent);
+    }
     if( subqueryIsAgg ){
       assert( pParent->pHaving==0 );
       pParent->pHaving = pParent->pWhere;
       pParent->pWhere = pWhere;
       pParent->pHaving = sqlite3ExprAnd(db, 
           sqlite3ExprDup(db, pSub->pHaving, 0), pParent->pHaving
       );
       assert( pParent->pGroupBy==0 );
       pParent->pGroupBy = sqlite3ExprListDup(db, pSub->pGroupBy, 0);
     }else{
       pParent->pWhere = sqlite3ExprAnd(db, pWhere, pParent->pWhere);
     }
     if( db->mallocFailed==0 ){
-      substSelect(pParse, pParent, iParent, pSub->pEList, 0);
+      SubstContext x;
+      x.pParse = pParse;
+      x.iTable = iParent;
+      x.iNewTable = iNewParent;
+      x.isLeftJoin = isLeftJoin;
+      x.pEList = pSub->pEList;
+      substSelect(&x, pParent, 0);
     }
   
     /* The flattened query is distinct if either the inner or the
     ** outer query is distinct. 
     */
     pParent->selFlags |= pSub->selFlags & SF_Distinct;
   
     /*
@@ -120095,18 +120397,24 @@ static int pushDownWhereTerms(
   while( pWhere->op==TK_AND ){
     nChng += pushDownWhereTerms(pParse, pSubq, pWhere->pRight, iCursor);
     pWhere = pWhere->pLeft;
   }
   if( ExprHasProperty(pWhere,EP_FromJoin) ) return 0; /* restriction 5 */
   if( sqlite3ExprIsTableConstant(pWhere, iCursor) ){
     nChng++;
     while( pSubq ){
+      SubstContext x;
       pNew = sqlite3ExprDup(pParse->db, pWhere, 0);
-      pNew = substExpr(pParse, pNew, iCursor, pSubq->pEList);
+      x.pParse = pParse;
+      x.iTable = iCursor;
+      x.iNewTable = iCursor;
+      x.isLeftJoin = 0;
+      x.pEList = pSubq->pEList;
+      pNew = substExpr(&x, pNew);
       pSubq->pWhere = sqlite3ExprAnd(pParse->db, pSubq->pWhere, pNew);
       pSubq = pSubq->pPrior;
     }
   }
   return nChng;
 }
 #endif /* !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW) */
 
@@ -121089,16 +121397,113 @@ static void explainSimpleCount(
     );
   }
 }
 #else
 # define explainSimpleCount(a,b,c)
 #endif
 
 /*
+** Context object for havingToWhereExprCb().
+*/
+struct HavingToWhereCtx {
+  Expr **ppWhere;
+  ExprList *pGroupBy;
+};
+
+/*
+** sqlite3WalkExpr() callback used by havingToWhere().
+**
+** If the node passed to the callback is a TK_AND node, return 
+** WRC_Continue to tell sqlite3WalkExpr() to iterate through child nodes.
+**
+** Otherwise, return WRC_Prune. In this case, also check if the 
+** sub-expression matches the criteria for being moved to the WHERE
+** clause. If so, add it to the WHERE clause and replace the sub-expression
+** within the HAVING expression with a constant "1".
+*/
+static int havingToWhereExprCb(Walker *pWalker, Expr *pExpr){
+  if( pExpr->op!=TK_AND ){
+    struct HavingToWhereCtx *p = pWalker->u.pHavingCtx;
+    if( sqlite3ExprIsConstantOrGroupBy(pWalker->pParse, pExpr, p->pGroupBy) ){
+      sqlite3 *db = pWalker->pParse->db;
+      Expr *pNew = sqlite3ExprAlloc(db, TK_INTEGER, &sqlite3IntTokens[1], 0);
+      if( pNew ){
+        Expr *pWhere = *(p->ppWhere);
+        SWAP(Expr, *pNew, *pExpr);
+        pNew = sqlite3ExprAnd(db, pWhere, pNew);
+        *(p->ppWhere) = pNew;
+      }
+    }
+    return WRC_Prune;
+  }
+  return WRC_Continue;
+}
+
+/*
+** Transfer eligible terms from the HAVING clause of a query, which is
+** processed after grouping, to the WHERE clause, which is processed before
+** grouping. For example, the query:
+**
+**   SELECT * FROM <tables> WHERE a=? GROUP BY b HAVING b=? AND c=?
+**
+** can be rewritten as:
+**
+**   SELECT * FROM <tables> WHERE a=? AND b=? GROUP BY b HAVING c=?
+**
+** A term of the HAVING expression is eligible for transfer if it consists
+** entirely of constants and expressions that are also GROUP BY terms that
+** use the "BINARY" collation sequence.
+*/
+static void havingToWhere(
+  Parse *pParse,
+  ExprList *pGroupBy,
+  Expr *pHaving, 
+  Expr **ppWhere
+){
+  struct HavingToWhereCtx sCtx;
+  Walker sWalker;
+
+  sCtx.ppWhere = ppWhere;
+  sCtx.pGroupBy = pGroupBy;
+
+  memset(&sWalker, 0, sizeof(sWalker));
+  sWalker.pParse = pParse;
+  sWalker.xExprCallback = havingToWhereExprCb;
+  sWalker.u.pHavingCtx = &sCtx;
+  sqlite3WalkExpr(&sWalker, pHaving);
+}
+
+/*
+** Check to see if the pThis entry of pTabList is a self-join of a prior view.
+** If it is, then return the SrcList_item for the prior view.  If it is not,
+** then return 0.
+*/
+static struct SrcList_item *isSelfJoinView(
+  SrcList *pTabList,           /* Search for self-joins in this FROM clause */
+  struct SrcList_item *pThis   /* Search for prior reference to this subquery */
+){
+  struct SrcList_item *pItem;
+  for(pItem = pTabList->a; pItem<pThis; pItem++){
+    if( pItem->pSelect==0 ) continue;
+    if( pItem->fg.viaCoroutine ) continue;
+    if( pItem->zName==0 ) continue;
+    if( sqlite3_stricmp(pItem->zDatabase, pThis->zDatabase)!=0 ) continue;
+    if( sqlite3_stricmp(pItem->zName, pThis->zName)!=0 ) continue;
+    if( sqlite3ExprCompare(pThis->pSelect->pWhere, pItem->pSelect->pWhere, -1) ){
+      /* The view was modified by some other optimization such as
+      ** pushDownWhereTerms() */
+      continue;
+    }
+    return pItem;
+  }
+  return 0;
+}
+
+/*
 ** Generate code for the SELECT statement given in the p argument.  
 **
 ** The results are returned according to the SelectDest structure.
 ** See comments in sqliteInt.h for further information.
 **
 ** This routine returns the number of errors.  If any errors are
 ** encountered, then an appropriate error message is left in
 ** pParse->zErrMsg.
@@ -121227,33 +121632,62 @@ SQLITE_PRIVATE int sqlite3Select(
 #if SELECTTRACE_ENABLED
     SELECTTRACE(1,pParse,p,("end compound-select processing\n"));
     pParse->nSelectIndent--;
 #endif
     return rc;
   }
 #endif
 
-  /* Generate code for all sub-queries in the FROM clause
-  */
-#if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
+  /* For each term in the FROM clause, do two things:
+  ** (1) Authorized unreferenced tables
+  ** (2) Generate code for all sub-queries
+  */
   for(i=0; i<pTabList->nSrc; i++){
     struct SrcList_item *pItem = &pTabList->a[i];
     SelectDest dest;
-    Select *pSub = pItem->pSelect;
+    Select *pSub;
+
+    /* Issue SQLITE_READ authorizations with a fake column name for any tables that
+    ** are referenced but from which no values are extracted. Examples of where these
+    ** kinds of null SQLITE_READ authorizations would occur:
+    **
+    **     SELECT count(*) FROM t1;   -- SQLITE_READ t1.""
+    **     SELECT t1.* FROM t1, t2;   -- SQLITE_READ t2.""
+    **
+    ** The fake column name is an empty string.  It is possible for a table to
+    ** have a column named by the empty string, in which case there is no way to
+    ** distinguish between an unreferenced table and an actual reference to the
+    ** "" column.  The original design was for the fake column name to be a NULL,
+    ** which would be unambiguous.  But legacy authorization callbacks might
+    ** assume the column name is non-NULL and segfault.  The use of an empty string
+    ** for the fake column name seems safer.
+    */
+    if( pItem->colUsed==0 ){
+      sqlite3AuthCheck(pParse, SQLITE_READ, pItem->zName, "", pItem->zDatabase);
+    }
+
+#if !defined(SQLITE_OMIT_SUBQUERY) || !defined(SQLITE_OMIT_VIEW)
+    /* Generate code for all sub-queries in the FROM clause
+    */
+    pSub = pItem->pSelect;
     if( pSub==0 ) continue;
 
     /* Sometimes the code for a subquery will be generated more than
     ** once, if the subquery is part of the WHERE clause in a LEFT JOIN,
     ** for example.  In that case, do not regenerate the code to manifest
     ** a view or the co-routine to implement a view.  The first instance
     ** is sufficient, though the subroutine to manifest the view does need
     ** to be invoked again. */
     if( pItem->addrFillSub ){
       if( pItem->fg.viaCoroutine==0 ){
+        /* The subroutine that manifests the view might be a one-time routine,
+        ** or it might need to be rerun on each iteration because it
+        ** encodes a correlated subquery. */
+        testcase( sqlite3VdbeGetOp(v, pItem->addrFillSub)->opcode==OP_Once );
         sqlite3VdbeAddOp2(v, OP_Gosub, pItem->regReturn, pItem->addrFillSub);
       }
       continue;
     }
 
     /* Increment Parse.nHeight by the height of the largest expression
     ** tree referred to by this, the parent select. The child select
     ** may contain expression trees of at most
@@ -121318,43 +121752,50 @@ SQLITE_PRIVATE int sqlite3Select(
       /* Generate a subroutine that will fill an ephemeral table with
       ** the content of this subquery.  pItem->addrFillSub will point
       ** to the address of the generated subroutine.  pItem->regReturn
       ** is a register allocated to hold the subroutine return address
       */
       int topAddr;
       int onceAddr = 0;
       int retAddr;
+      struct SrcList_item *pPrior;
+
       assert( pItem->addrFillSub==0 );
       pItem->regReturn = ++pParse->nMem;
       topAddr = sqlite3VdbeAddOp2(v, OP_Integer, 0, pItem->regReturn);
       pItem->addrFillSub = topAddr+1;
       if( pItem->fg.isCorrelated==0 ){
         /* If the subquery is not correlated and if we are not inside of
         ** a trigger, then we only need to compute the value of the subquery
         ** once. */
         onceAddr = sqlite3VdbeAddOp0(v, OP_Once); VdbeCoverage(v);
         VdbeComment((v, "materialize \"%s\"", pItem->pTab->zName));
       }else{
         VdbeNoopComment((v, "materialize \"%s\"", pItem->pTab->zName));
       }
-      sqlite3SelectDestInit(&dest, SRT_EphemTab, pItem->iCursor);
-      explainSetInteger(pItem->iSelectId, (u8)pParse->iNextSelectId);
-      sqlite3Select(pParse, pSub, &dest);
+      pPrior = isSelfJoinView(pTabList, pItem);
+      if( pPrior ){
+        sqlite3VdbeAddOp2(v, OP_OpenDup, pItem->iCursor, pPrior->iCursor);
+      }else{
+        sqlite3SelectDestInit(&dest, SRT_EphemTab, pItem->iCursor);
+        explainSetInteger(pItem->iSelectId, (u8)pParse->iNextSelectId);
+        sqlite3Select(pParse, pSub, &dest);
+      }
       pItem->pTab->nRowLogEst = pSub->nSelectRow;
       if( onceAddr ) sqlite3VdbeJumpHere(v, onceAddr);
       retAddr = sqlite3VdbeAddOp1(v, OP_Return, pItem->regReturn);
       VdbeComment((v, "end %s", pItem->pTab->zName));
       sqlite3VdbeChangeP1(v, topAddr, retAddr);
       sqlite3ClearTempRegCache(pParse);
     }
     if( db->mallocFailed ) goto select_end;
     pParse->nHeight -= sqlite3SelectExprHeight(p);
-  }
-#endif
+#endif
+  }
 
   /* Various elements of the SELECT copied into local variables for
   ** convenience */
   pEList = p->pEList;
   pWhere = p->pWhere;
   pGroupBy = p->pGroupBy;
   pHaving = p->pHaving;
   sDistinct.isTnct = (p->selFlags & SF_Distinct)!=0;
@@ -121552,16 +121993,21 @@ SQLITE_PRIVATE int sqlite3Select(
     sNC.pSrcList = pTabList;
     sNC.pAggInfo = &sAggInfo;
     sAggInfo.mnReg = pParse->nMem+1;
     sAggInfo.nSortingColumn = pGroupBy ? pGroupBy->nExpr : 0;
     sAggInfo.pGroupBy = pGroupBy;
     sqlite3ExprAnalyzeAggList(&sNC, pEList);
     sqlite3ExprAnalyzeAggList(&sNC, sSort.pOrderBy);
     if( pHaving ){
+      if( pGroupBy ){
+        assert( pWhere==p->pWhere );
+        havingToWhere(pParse, pGroupBy, pHaving, &p->pWhere);
+        pWhere = p->pWhere;
+      }
       sqlite3ExprAnalyzeAggregates(&sNC, pHaving);
     }
     sAggInfo.nAccumulator = sAggInfo.nColumn;
     for(i=0; i<sAggInfo.nFunc; i++){
       assert( !ExprHasProperty(sAggInfo.aFunc[i].pExpr, EP_xIsSelect) );
       sNC.ncFlags |= NC_InAggFunc;
       sqlite3ExprAnalyzeAggList(&sNC, sAggInfo.aFunc[i].pExpr->x.pList);
       sNC.ncFlags &= ~NC_InAggFunc;
@@ -123564,17 +124010,17 @@ SQLITE_PRIVATE void sqlite3Update(
   /* There is one entry in the aRegIdx[] array for each index on the table
   ** being updated.  Fill in aRegIdx[] with a register number that will hold
   ** the key for accessing each index.
   **
   ** FIXME:  Be smarter about omitting indexes that use expressions.
   */
   for(j=0, pIdx=pTab->pIndex; pIdx; pIdx=pIdx->pNext, j++){
     int reg;
-    if( chngKey || hasFK || pIdx->pPartIdxWhere || pIdx==pPk ){
+    if( chngKey || hasFK>1 || pIdx->pPartIdxWhere || pIdx==pPk ){
       reg = ++pParse->nMem;
       pParse->nMem += pIdx->nColumn;
     }else{
       reg = 0;
       for(i=0; i<pIdx->nKeyCol; i++){
         i16 iIdxCol = pIdx->aiColumn[i];
         if( iIdxCol<0 || aXRef[iIdxCol]>=0 ){
           reg = ++pParse->nMem;
@@ -123919,28 +124365,28 @@ SQLITE_PRIVATE void sqlite3Update(
     ** That (regNew==regnewRowid+1) is true is also important for the 
     ** pre-update hook. If the caller invokes preupdate_new(), the returned
     ** value is copied from memory cell (regNewRowid+1+iCol), where iCol
     ** is the column index supplied by the user.
     */
     assert( regNew==regNewRowid+1 );
 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
     sqlite3VdbeAddOp3(v, OP_Delete, iDataCur,
-        OPFLAG_ISUPDATE | ((hasFK || chngKey) ? 0 : OPFLAG_ISNOOP),
+        OPFLAG_ISUPDATE | ((hasFK>1 || chngKey) ? 0 : OPFLAG_ISNOOP),
         regNewRowid
     );
     if( eOnePass==ONEPASS_MULTI ){
       assert( hasFK==0 && chngKey==0 );
       sqlite3VdbeChangeP5(v, OPFLAG_SAVEPOSITION);
     }
     if( !pParse->nested ){
       sqlite3VdbeAppendP4(v, pTab, P4_TABLE);
     }
 #else
-    if( hasFK || chngKey ){
+    if( hasFK>1 || chngKey ){
       sqlite3VdbeAddOp2(v, OP_Delete, iDataCur, 0);
     }
 #endif
     if( bReplace || chngKey ){
       sqlite3VdbeJumpHere(v, addr1);
     }
 
     if( hasFK ){
@@ -125573,17 +126019,17 @@ SQLITE_PRIVATE FuncDef *sqlite3VtabOverl
   char *zLowerName;
   unsigned char *z;
 
 
   /* Check to see the left operand is a column in a virtual table */
   if( NEVER(pExpr==0) ) return pDef;
   if( pExpr->op!=TK_COLUMN ) return pDef;
   pTab = pExpr->pTab;
-  if( NEVER(pTab==0) ) return pDef;
+  if( pTab==0 ) return pDef;
   if( !IsVirtual(pTab) ) return pDef;
   pVtab = sqlite3GetVTable(db, pTab)->pVtab;
   assert( pVtab!=0 );
   assert( pVtab->pModule!=0 );
   pMod = (sqlite3_module *)pVtab->pModule;
   if( pMod->xFindFunction==0 ) return pDef;
  
   /* Call the xFindFunction method on the virtual table implementation
@@ -125908,16 +126354,17 @@ struct WhereLoop {
   LogEst rSetup;        /* One-time setup cost (ex: create transient index) */
   LogEst rRun;          /* Cost of running each loop */
   LogEst nOut;          /* Estimated number of output rows */
   union {
     struct {               /* Information for internal btree tables */
       u16 nEq;               /* Number of equality constraints */
       u16 nBtm;              /* Size of BTM vector */
       u16 nTop;              /* Size of TOP vector */
+      u16 nIdxCol;           /* Index column used for ORDER BY */
       Index *pIndex;         /* Index used, or NULL */
     } btree;
     struct {               /* Information for virtual tables */
       int idxNum;            /* Index number */
       u8 needFree;           /* True if sqlite3_free(idxStr) is needed */
       i8 isOrdered;          /* True if satisfies ORDER BY */
       u16 omitMask;          /* Terms that may be omitted */
       char *idxStr;          /* Index identifier string */
@@ -126201,16 +126648,17 @@ struct WhereLoopBuilder {
 ** An instance of this object holds the complete state of the query
 ** planner.
 */
 struct WhereInfo {
   Parse *pParse;            /* Parsing and code generating context */
   SrcList *pTabList;        /* List of tables in the join */
   ExprList *pOrderBy;       /* The ORDER BY clause or NULL */
   ExprList *pResultSet;     /* Result set of the query */
+  Expr *pWhere;             /* The complete WHERE clause */
   LogEst iLimit;            /* LIMIT if wctrlFlags has WHERE_USE_LIMIT */
   int aiCurOnePass[2];      /* OP_OpenWrite cursors for the ONEPASS opt */
   int iContinue;            /* Jump here to continue with next record */
   int iBreak;               /* Jump here to break out of the loop */
   int savedNQueryLoop;      /* pParse->nQueryLoop outside the WHERE loop */
   u16 wctrlFlags;           /* Flags originally passed to sqlite3WhereBegin() */
   u8 nLevel;                /* Number of nested loop */
   i8 nOBSat;                /* Number of ORDER BY terms satisfied by indices */
@@ -127361,16 +127809,79 @@ static void codeExprOrVector(Parse *pPar
       }
     }
   }else{
     assert( nReg==1 );
     sqlite3ExprCode(pParse, p, iReg);
   }
 }
 
+/* An instance of the IdxExprTrans object carries information about a
+** mapping from an expression on table columns into a column in an index
+** down through the Walker.
+*/
+typedef struct IdxExprTrans {
+  Expr *pIdxExpr;    /* The index expression */
+  int iTabCur;       /* The cursor of the corresponding table */
+  int iIdxCur;       /* The cursor for the index */
+  int iIdxCol;       /* The column for the index */
+} IdxExprTrans;
+
+/* The walker node callback used to transform matching expressions into
+** a reference to an index column for an index on an expression.
+**
+** If pExpr matches, then transform it into a reference to the index column
+** that contains the value of pExpr.
+*/
+static int whereIndexExprTransNode(Walker *p, Expr *pExpr){
+  IdxExprTrans *pX = p->u.pIdxTrans;
+  if( sqlite3ExprCompare(pExpr, pX->pIdxExpr, pX->iTabCur)==0 ){
+    pExpr->op = TK_COLUMN;
+    pExpr->iTable = pX->iIdxCur;
+    pExpr->iColumn = pX->iIdxCol;
+    pExpr->pTab = 0;
+    return WRC_Prune;
+  }else{
+    return WRC_Continue;
+  }
+}
+
+/*
+** For an indexes on expression X, locate every instance of expression X in pExpr
+** and change that subexpression into a reference to the appropriate column of
+** the index.
+*/
+static void whereIndexExprTrans(
+  Index *pIdx,      /* The Index */
+  int iTabCur,      /* Cursor of the table that is being indexed */
+  int iIdxCur,      /* Cursor of the index itself */
+  WhereInfo *pWInfo /* Transform expressions in this WHERE clause */
+){
+  int iIdxCol;               /* Column number of the index */
+  ExprList *aColExpr;        /* Expressions that are indexed */
+  Walker w;
+  IdxExprTrans x;
+  aColExpr = pIdx->aColExpr;
+  if( aColExpr==0 ) return;  /* Not an index on expressions */
+  memset(&w, 0, sizeof(w));
+  w.xExprCallback = whereIndexExprTransNode;
+  w.u.pIdxTrans = &x;
+  x.iTabCur = iTabCur;
+  x.iIdxCur = iIdxCur;
+  for(iIdxCol=0; iIdxCol<aColExpr->nExpr; iIdxCol++){
+    if( pIdx->aiColumn[iIdxCol]!=XN_EXPR ) continue;
+    assert( aColExpr->a[iIdxCol].pExpr!=0 );
+    x.iIdxCol = iIdxCol;
+    x.pIdxExpr = aColExpr->a[iIdxCol].pExpr;
+    sqlite3WalkExpr(&w, pWInfo->pWhere);
+    sqlite3WalkExprList(&w, pWInfo->pOrderBy);
+    sqlite3WalkExprList(&w, pWInfo->pResultSet);
+  }
+}
+
 /*
 ** Generate code for the start of the iLevel-th loop in the WHERE clause
 ** implementation described by pWInfo.
 */
 SQLITE_PRIVATE Bitmask sqlite3WhereCodeOneLoopStart(
   WhereInfo *pWInfo,   /* Complete information about the WHERE clause */
   int iLevel,          /* Which level of pWInfo->a[] should be coded */
   Bitmask notReady     /* Which tables are currently available */
@@ -127388,16 +127899,18 @@ SQLITE_PRIVATE Bitmask sqlite3WhereCodeO
   sqlite3 *db;                    /* Database connection */
   Vdbe *v;                        /* The prepared stmt under constructions */
   struct SrcList_item *pTabItem;  /* FROM clause term being coded */
   int addrBrk;                    /* Jump here to break out of the loop */
   int addrHalt;                   /* addrBrk for the outermost loop */
   int addrCont;                   /* Jump here to continue with next cycle */
   int iRowidReg = 0;        /* Rowid is stored in this register, if not zero */
   int iReleaseReg = 0;      /* Temp register to free before returning */
+  Index *pIdx = 0;          /* Index used by loop (if any) */
+  int loopAgain;            /* True if constraint generator loop should repeat */
 
   pParse = pWInfo->pParse;
   v = pParse->pVdbe;
   pWC = &pWInfo->sWC;
   db = pParse->db;
   pLevel = &pWInfo->a[iLevel];
   pLoop = pLevel->pWLoop;
   pTabItem = &pWInfo->pTabList->a[pLevel->iFrom];
@@ -127713,17 +128226,16 @@ SQLITE_PRIVATE Bitmask sqlite3WhereCodeO
     u16 nTop = pLoop->u.btree.nTop;   /* Length of TOP vector */
     int regBase;                 /* Base register holding constraint values */
     WhereTerm *pRangeStart = 0;  /* Inequality constraint at range start */
     WhereTerm *pRangeEnd = 0;    /* Inequality constraint at range end */
     int startEq;                 /* True if range start uses ==, >= or <= */
     int endEq;                   /* True if range end uses ==, >= or <= */
     int start_constraints;       /* Start of range is constrained */
     int nConstraint;             /* Number of constraint terms */
-    Index *pIdx;                 /* The index we will be using */
     int iIdxCur;                 /* The VDBE cursor for the index */
     int nExtraReg = 0;           /* Number of extra registers needed */
     int op;                      /* Instruction opcode */
     char *zStartAff;             /* Affinity for start of range constraint */
     char *zEndAff = 0;           /* Affinity for end of range constraint */
     u8 bSeekPastNull = 0;        /* True to seek past initial nulls */
     u8 bStopAtNull = 0;          /* Add condition to terminate at NULLs */
 
@@ -127942,31 +128454,39 @@ SQLITE_PRIVATE Bitmask sqlite3WhereCodeO
       for(j=0; j<pPk->nKeyCol; j++){
         k = sqlite3ColumnOfIndex(pIdx, pPk->aiColumn[j]);
         sqlite3VdbeAddOp3(v, OP_Column, iIdxCur, k, iRowidReg+j);
       }
       sqlite3VdbeAddOp4Int(v, OP_NotFound, iCur, addrCont,
                            iRowidReg, pPk->nKeyCol); VdbeCoverage(v);
     }
 
+    /* If pIdx is an index on one or more expressions, then look through
+    ** all the expressions in pWInfo and try to transform matching expressions
+    ** into reference to index columns.
+    */
+    whereIndexExprTrans(pIdx, iCur, iIdxCur, pWInfo);
+
+
     /* Record the instruction used to terminate the loop. */
     if( pLoop->wsFlags & WHERE_ONEROW ){
       pLevel->op = OP_Noop;
     }else if( bRev ){
       pLevel->op = OP_Prev;
     }else{
       pLevel->op = OP_Next;
     }
     pLevel->p1 = iIdxCur;
     pLevel->p3 = (pLoop->wsFlags&WHERE_UNQ_WANTED)!=0 ? 1:0;
     if( (pLoop->wsFlags & WHERE_CONSTRAINT)==0 ){
       pLevel->p5 = SQLITE_STMTSTATUS_FULLSCAN_STEP;
     }else{
       assert( pLevel->p5==0 );
     }
+    if( omitTable ) pIdx = 0;
   }else
 
 #ifndef SQLITE_OMIT_OR_OPTIMIZATION
   if( pLoop->wsFlags & WHERE_MULTI_OR ){
     /* Case 5:  Two or more separately indexed terms connected by OR
     **
     ** Example:
     **
@@ -128274,53 +128794,66 @@ SQLITE_PRIVATE Bitmask sqlite3WhereCodeO
   }
 
 #ifdef SQLITE_ENABLE_STMT_SCANSTATUS
   pLevel->addrVisit = sqlite3VdbeCurrentAddr(v);
 #endif
 
   /* Insert code to test every subexpression that can be completely
   ** computed using the current set of tables.
-  */
-  for(pTerm=pWC->a, j=pWC->nTerm; j>0; j--, pTerm++){
-    Expr *pE;
-    int skipLikeAddr = 0;
-    testcase( pTerm->wtFlags & TERM_VIRTUAL );
-    testcase( pTerm->wtFlags & TERM_CODED );
-    if( pTerm->wtFlags & (TERM_VIRTUAL|TERM_CODED) ) continue;
-    if( (pTerm->prereqAll & pLevel->notReady)!=0 ){
-      testcase( pWInfo->untestedTerms==0
-               && (pWInfo->wctrlFlags & WHERE_OR_SUBCLAUSE)!=0 );
-      pWInfo->untestedTerms = 1;
-      continue;
-    }
-    pE = pTerm->pExpr;
-    assert( pE!=0 );
-    if( pLevel->iLeftJoin && !ExprHasProperty(pE, EP_FromJoin) ){
-      continue;
-    }
-    if( pTerm->wtFlags & TERM_LIKECOND ){
-      /* If the TERM_LIKECOND flag is set, that means that the range search
-      ** is sufficient to guarantee that the LIKE operator is true, so we
-      ** can skip the call to the like(A,B) function.  But this only works
-      ** for strings.  So do not skip the call to the function on the pass
-      ** that compares BLOBs. */
+  **
+  ** This loop may run either once (pIdx==0) or twice (pIdx!=0). If
+  ** it is run twice, then the first iteration codes those sub-expressions
+  ** that can be computed using columns from pIdx only (without seeking
+  ** the main table cursor). 
+  */
+  do{
+    loopAgain = 0;
+    for(pTerm=pWC->a, j=pWC->nTerm; j>0; j--, pTerm++){
+      Expr *pE;
+      int skipLikeAddr = 0;
+      testcase( pTerm->wtFlags & TERM_VIRTUAL );
+      testcase( pTerm->wtFlags & TERM_CODED );
+      if( pTerm->wtFlags & (TERM_VIRTUAL|TERM_CODED) ) continue;
+      if( (pTerm->prereqAll & pLevel->notReady)!=0 ){
+        testcase( pWInfo->untestedTerms==0
+            && (pWInfo->wctrlFlags & WHERE_OR_SUBCLAUSE)!=0 );
+        pWInfo->untestedTerms = 1;
+        continue;
+      }
+      pE = pTerm->pExpr;
+      assert( pE!=0 );
+      if( pLevel->iLeftJoin && !ExprHasProperty(pE, EP_FromJoin) ){
+        continue;
+      }
+      if( pIdx && !sqlite3ExprCoveredByIndex(pE, pLevel->iTabCur, pIdx) ){
+        loopAgain = 1;
+        continue;
+      }
+      if( pTerm->wtFlags & TERM_LIKECOND ){
+        /* If the TERM_LIKECOND flag is set, that means that the range search
+        ** is sufficient to guarantee that the LIKE operator is true, so we
+        ** can skip the call to the like(A,B) function.  But this only works
+        ** for strings.  So do not skip the call to the function on the pass
+        ** that compares BLOBs. */
 #ifdef SQLITE_LIKE_DOESNT_MATCH_BLOBS
-      continue;
-#else
-      u32 x = pLevel->iLikeRepCntr;
-      assert( x>0 );
-      skipLikeAddr = sqlite3VdbeAddOp1(v, (x&1)? OP_IfNot : OP_If, (int)(x>>1));
-      VdbeCoverage(v);
-#endif
-    }
-    sqlite3ExprIfFalse(pParse, pE, addrCont, SQLITE_JUMPIFNULL);
-    if( skipLikeAddr ) sqlite3VdbeJumpHere(v, skipLikeAddr);
-    pTerm->wtFlags |= TERM_CODED;
-  }
+        continue;
+#else
+        u32 x = pLevel->iLikeRepCntr;
+        assert( x>0 );
+        skipLikeAddr = sqlite3VdbeAddOp1(v, (x&1)?OP_IfNot:OP_If, (int)(x>>1));
+        VdbeCoverage(v);
+#endif
+      }
+      sqlite3ExprIfFalse(pParse, pE, addrCont, SQLITE_JUMPIFNULL);
+      if( skipLikeAddr ) sqlite3VdbeJumpHere(v, skipLikeAddr);
+      pTerm->wtFlags |= TERM_CODED;
+    }
+    pIdx = 0;
+  }while( loopAgain );
 
   /* Insert code to test for implied constraints based on transitivity
   ** of the "==" operator.
   **
   ** Example: If the WHERE clause contains "t1.a=t2.b" and "t2.b=123"
   ** and we are coding the t1 loop and the t2 loop has not yet coded,
   ** then we cannot use the "t1.a=t2.b" constraint, but we can code
   ** the implied "t1.a=123" constraint.
@@ -129203,68 +129736,74 @@ static Bitmask exprSelectUsage(WhereMask
   }
   return mask;
 }
 
 /*
 ** Expression pExpr is one operand of a comparison operator that might
 ** be useful for indexing.  This routine checks to see if pExpr appears
 ** in any index.  Return TRUE (1) if pExpr is an indexed term and return
-** FALSE (0) if not.  If TRUE is returned, also set *piCur to the cursor
-** number of the table that is indexed and *piColumn to the column number
+** FALSE (0) if not.  If TRUE is returned, also set aiCurCol[0] to the cursor
+** number of the table that is indexed and aiCurCol[1] to the column number
 ** of the column that is indexed, or XN_EXPR (-2) if an expression is being
 ** indexed.
 **
 ** If pExpr is a TK_COLUMN column reference, then this routine always returns
 ** true even if that particular column is not indexed, because the column
 ** might be added to an automatic index later.
 */
-static int exprMightBeIndexed(
+static SQLITE_NOINLINE int exprMightBeIndexed2(
   SrcList *pFrom,        /* The FROM clause */
-  int op,                /* The specific comparison operator */
   Bitmask mPrereq,       /* Bitmask of FROM clause terms referenced by pExpr */
-  Expr *pExpr,           /* An operand of a comparison operator */
-  int *piCur,            /* Write the referenced table cursor number here */
-  int *piColumn          /* Write the referenced table column number here */
+  int *aiCurCol,         /* Write the referenced table cursor and column here */
+  Expr *pExpr            /* An operand of a comparison operator */
 ){
   Index *pIdx;
   int i;
   int iCur;
-
+  for(i=0; mPrereq>1; i++, mPrereq>>=1){}
+  iCur = pFrom->a[i].iCursor;
+  for(pIdx=pFrom->a[i].pTab->pIndex; pIdx; pIdx=pIdx->pNext){
+    if( pIdx->aColExpr==0 ) continue;
+    for(i=0; i<pIdx->nKeyCol; i++){
+      if( pIdx->aiColumn[i]!=XN_EXPR ) continue;
+      if( sqlite3ExprCompareSkip(pExpr, pIdx->aColExpr->a[i].pExpr, iCur)==0 ){
+        aiCurCol[0] = iCur;
+        aiCurCol[1] = XN_EXPR;
+        return 1;
+      }
+    }
+  }
+  return 0;
+}
+static int exprMightBeIndexed(
+  SrcList *pFrom,        /* The FROM clause */
+  Bitmask mPrereq,       /* Bitmask of FROM clause terms referenced by pExpr */
+  int *aiCurCol,         /* Write the referenced table cursor & column here */
+  Expr *pExpr,           /* An operand of a comparison operator */
+  int op                 /* The specific comparison operator */
+){
   /* If this expression is a vector to the left or right of a 
   ** inequality constraint (>, <, >= or <=), perform the processing 
   ** on the first element of the vector.  */
   assert( TK_GT+1==TK_LE && TK_GT+2==TK_LT && TK_GT+3==TK_GE );
   assert( TK_IS<TK_GE && TK_ISNULL<TK_GE && TK_IN<TK_GE );
   assert( op<=TK_GE );
   if( pExpr->op==TK_VECTOR && (op>=TK_GT && ALWAYS(op<=TK_GE)) ){
     pExpr = pExpr->x.pList->a[0].pExpr;
   }
 
   if( pExpr->op==TK_COLUMN ){
-    *piCur = pExpr->iTable;
-    *piColumn = pExpr->iColumn;
+    aiCurCol[0] = pExpr->iTable;
+    aiCurCol[1] = pExpr->iColumn;
     return 1;
   }
   if( mPrereq==0 ) return 0;                 /* No table references */
   if( (mPrereq&(mPrereq-1))!=0 ) return 0;   /* Refs more than one table */
-  for(i=0; mPrereq>1; i++, mPrereq>>=1){}
-  iCur = pFrom->a[i].iCursor;
-  for(pIdx=pFrom->a[i].pTab->pIndex; pIdx; pIdx=pIdx->pNext){
-    if( pIdx->aColExpr==0 ) continue;
-    for(i=0; i<pIdx->nKeyCol; i++){
-      if( pIdx->aiColumn[i]!=XN_EXPR ) continue;
-      if( sqlite3ExprCompareSkip(pExpr, pIdx->aColExpr->a[i].pExpr, iCur)==0 ){
-        *piCur = iCur;
-        *piColumn = XN_EXPR;
-        return 1;
-      }
-    }
-  }
-  return 0;
+  return exprMightBeIndexed2(pFrom,mPrereq,aiCurCol,pExpr);
 }
 
 /*
 ** The input to this routine is an WhereTerm structure with only the
 ** "pExpr" field filled in.  The job of this routine is to analyze the
 ** subexpression and populate all the other fields of the WhereTerm
 ** structure.
 **
@@ -129334,35 +129873,35 @@ static void exprAnalyze(
       return;
     }
   }
   pTerm->prereqAll = prereqAll;
   pTerm->leftCursor = -1;
   pTerm->iParent = -1;
   pTerm->eOperator = 0;
   if( allowedOp(op) ){
-    int iCur, iColumn;
+    int aiCurCol[2];
     Expr *pLeft = sqlite3ExprSkipCollate(pExpr->pLeft);
     Expr *pRight = sqlite3ExprSkipCollate(pExpr->pRight);
     u16 opMask = (pTerm->prereqRight & prereqLeft)==0 ? WO_ALL : WO_EQUIV;
 
     if( pTerm->iField>0 ){
       assert( op==TK_IN );
       assert( pLeft->op==TK_VECTOR );
       pLeft = pLeft->x.pList->a[pTerm->iField-1].pExpr;
     }
 
-    if( exprMightBeIndexed(pSrc, op, prereqLeft, pLeft, &iCur, &iColumn) ){
-      pTerm->leftCursor = iCur;
-      pTerm->u.leftColumn = iColumn;
+    if( exprMightBeIndexed(pSrc, prereqLeft, aiCurCol, pLeft, op) ){
+      pTerm->leftCursor = aiCurCol[0];
+      pTerm->u.leftColumn = aiCurCol[1];
       pTerm->eOperator = operatorMask(op) & opMask;
     }
     if( op==TK_IS ) pTerm->wtFlags |= TERM_IS;
     if( pRight 
-     && exprMightBeIndexed(pSrc, op, pTerm->prereqRight, pRight, &iCur,&iColumn)
+     && exprMightBeIndexed(pSrc, pTerm->prereqRight, aiCurCol, pRight, op)
     ){
       WhereTerm *pNew;
       Expr *pDup;
       u16 eExtraOp = 0;        /* Extra bits for pNew->eOperator */
       assert( pTerm->iField==0 );
       if( pTerm->leftCursor>=0 ){
         int idxNew;
         pDup = sqlite3ExprDup(db, pExpr, 0);
@@ -129382,18 +129921,18 @@ static void exprAnalyze(
           pTerm->eOperator |= WO_EQUIV;
           eExtraOp = WO_EQUIV;
         }
       }else{
         pDup = pExpr;
         pNew = pTerm;
       }
       exprCommute(pParse, pDup);
-      pNew->leftCursor = iCur;
-      pNew->u.leftColumn = iColumn;
+      pNew->leftCursor = aiCurCol[0];
+      pNew->u.leftColumn = aiCurCol[1];
       testcase( (prereqLeft | extraRight) != prereqLeft );
       pNew->prereqRight = prereqLeft | extraRight;
       pNew->prereqAll = prereqAll;
       pNew->eOperator = (operatorMask(pDup->op) + eExtraOp) & opMask;
     }
   }
 
 #ifndef SQLITE_OMIT_BETWEEN_OPTIMIZATION
@@ -131615,42 +132154,42 @@ static void whereLoopInit(WhereLoop *p){
 static void whereLoopClearUnion(sqlite3 *db, WhereLoop *p){
   if( p->wsFlags & (WHERE_VIRTUALTABLE|WHERE_AUTO_INDEX) ){
     if( (p->wsFlags & WHERE_VIRTUALTABLE)!=0 && p->u.vtab.needFree ){
       sqlite3_free(p->u.vtab.idxStr);
       p->u.vtab.needFree = 0;
       p->u.vtab.idxStr = 0;
     }else if( (p->wsFlags & WHERE_AUTO_INDEX)!=0 && p->u.btree.pIndex!=0 ){
       sqlite3DbFree(db, p->u.btree.pIndex->zColAff);
-      sqlite3DbFree(db, p->u.btree.pIndex);
+      sqlite3DbFreeNN(db, p->u.btree.pIndex);
       p->u.btree.pIndex = 0;
     }
   }
 }
 
 /*
 ** Deallocate internal memory used by a WhereLoop object
 */
 static void whereLoopClear(sqlite3 *db, WhereLoop *p){
-  if( p->aLTerm!=p->aLTermSpace ) sqlite3DbFree(db, p->aLTerm);
+  if( p->aLTerm!=p->aLTermSpace ) sqlite3DbFreeNN(db, p->aLTerm);
   whereLoopClearUnion(db, p);
   whereLoopInit(p);
 }
 
 /*
 ** Increase the memory allocation for pLoop->aLTerm[] to be at least n.
 */
 static int whereLoopResize(sqlite3 *db, WhereLoop *p, int n){
   WhereTerm **paNew;
   if( p->nLSlot>=n ) return SQLITE_OK;
   n = (n+7)&~7;
   paNew = sqlite3DbMallocRawNN(db, sizeof(p->aLTerm[0])*n);
   if( paNew==0 ) return SQLITE_NOMEM_BKPT;
   memcpy(paNew, p->aLTerm, sizeof(p->aLTerm[0])*p->nLSlot);
-  if( p->aLTerm!=p->aLTermSpace ) sqlite3DbFree(db, p->aLTerm);
+  if( p->aLTerm!=p->aLTermSpace ) sqlite3DbFreeNN(db, p->aLTerm);
   p->aLTerm = paNew;
   p->nLSlot = n;
   return SQLITE_OK;
 }
 
 /*
 ** Transfer content from the second pLoop into the first.
 */
@@ -131670,17 +132209,17 @@ static int whereLoopXfer(sqlite3 *db, Wh
   return SQLITE_OK;
 }
 
 /*
 ** Delete a WhereLoop object
 */
 static void whereLoopDelete(sqlite3 *db, WhereLoop *p){
   whereLoopClear(db, p);
-  sqlite3DbFree(db, p);
+  sqlite3DbFreeNN(db, p);
 }
 
 /*
 ** Free a WhereInfo structure
 */
 static void whereInfoFree(sqlite3 *db, WhereInfo *pWInfo){
   if( ALWAYS(pWInfo) ){
     int i;
@@ -131691,17 +132230,17 @@ static void whereInfoFree(sqlite3 *db, W
       }
     }
     sqlite3WhereClauseClear(&pWInfo->sWC);
     while( pWInfo->pLoops ){
       WhereLoop *p = pWInfo->pLoops;
       pWInfo->pLoops = p->pNextLoop;
       whereLoopDelete(db, p);
     }
-    sqlite3DbFree(db, pWInfo);
+    sqlite3DbFreeNN(db, pWInfo);
   }
 }
 
 /*
 ** Return TRUE if all of the following are true:
 **
 **   (1)  X has the same or lower cost that Y
 **   (2)  X is a proper subset of Y
@@ -133082,17 +133621,17 @@ static int whereLoopAddVirtual(
     if( rc==SQLITE_OK && seenZeroNoIN==0 ){
       WHERETRACE(0x40, ("  VirtualOne: all disabled and w/o IN\n"));
       rc = whereLoopAddVirtualOne(
           pBuilder, mPrereq, mPrereq, WO_IN, p, mNoOmit, &bIn);
     }
   }
 
   if( p->needToFreeIdxStr ) sqlite3_free(p->idxStr);
-  sqlite3DbFree(pParse->db, p);
+  sqlite3DbFreeNN(pParse->db, p);
   return rc;
 }
 #endif /* SQLITE_OMIT_VIRTUALTABLE */
 
 /*
 ** Add WhereLoop entries to handle OR terms.  This works for either
 ** btrees or virtual tables.
 */
@@ -133266,17 +133805,17 @@ static int whereLoopAddAll(WhereLoopBuil
     if( rc || db->mallocFailed ) break;
   }
 
   whereLoopClear(db, pNew);
   return rc;
 }
 
 /*
-** Examine a WherePath (with the addition of the extra WhereLoop of the 5th
+** Examine a WherePath (with the addition of the extra WhereLoop of the 6th
 ** parameters) to see if it outputs rows in the requested ORDER BY
 ** (or GROUP BY) without requiring a separate sort operation.  Return N:
 ** 
 **   N>0:   N terms of the ORDER BY clause are satisfied
 **   N==0:  No terms of the ORDER BY clause are satisfied
 **   N<0:   Unknown yet how many terms of ORDER BY might be satisfied.   
 **
 ** Note that processing for WHERE_GROUPBY and WHERE_DISTINCTBY is not as
@@ -133361,16 +133900,18 @@ static i8 wherePathSatisfiesOrderBy(
       pLoop = pPath->aLoop[iLoop];
       if( wctrlFlags & WHERE_ORDERBY_LIMIT ) continue;
     }else{
       pLoop = pLast;
     }
     if( pLoop->wsFlags & WHERE_VIRTUALTABLE ){
       if( pLoop->u.vtab.isOrdered ) obSat = obDone;
       break;
+    }else{
+      pLoop->u.btree.nIdxCol = 0;
     }
     iCur = pWInfo->pTabList->a[pLoop->iTab].iCursor;
 
     /* Mark off any ORDER BY term X that is a column in the table of
     ** the current loop for which there is term in the WHERE
     ** clause of the form X IS NULL or X=? that reference only outer
     ** loops.
     */
@@ -133506,16 +134047,17 @@ static i8 wherePathSatisfiesOrderBy(
               continue;
             }
           }
           if( iColumn>=0 ){
             pColl = sqlite3ExprCollSeq(pWInfo->pParse, pOrderBy->a[i].pExpr);
             if( !pColl ) pColl = db->pDfltColl;
             if( sqlite3StrICmp(pColl->zName, pIndex->azColl[j])!=0 ) continue;
           }
+          pLoop->u.btree.nIdxCol = j+1;
           isMatch = 1;
           break;
         }
         if( isMatch && (wctrlFlags & WHERE_GROUPBY)==0 ){
           /* Make sure the sort order is compatible in an ORDER BY clause.
           ** Sort order is irrelevant for a GROUP BY clause. */
           if( revSet ){
             if( (rev ^ revIdx)!=pOrderBy->a[i].sortOrder ) isMatch = 0;
@@ -133937,17 +134479,17 @@ static int wherePathSolver(WhereInfo *pW
     pFrom = aTo;
     aTo = aFrom;
     aFrom = pFrom;
     nFrom = nTo;
   }
 
   if( nFrom==0 ){
     sqlite3ErrorMsg(pParse, "no query solution");
-    sqlite3DbFree(db, pSpace);
+    sqlite3DbFreeNN(db, pSpace);
     return SQLITE_ERROR;
   }
   
   /* Find the lowest cost path.  pFrom will be left pointing to that path */
   pFrom = aFrom;
   for(ii=1; ii<nFrom; ii++){
     if( pFrom->rCost>aFrom[ii].rCost ) pFrom = &aFrom[ii];
   }
@@ -134013,17 +134555,17 @@ static int wherePathSolver(WhereInfo *pW
       }
     }
   }
 
 
   pWInfo->nRowOut = pFrom->nRow;
 
   /* Free temporary memory and return success */
-  sqlite3DbFree(db, pSpace);
+  sqlite3DbFreeNN(db, pSpace);
   return SQLITE_OK;
 }
 
 /*
 ** Most queries use only a single table (they are not joins) and have
 ** simple == constraints against indexed fields.  This routine attempts
 ** to plan those simple cases using much less ceremony than the
 ** general-purpose query planner, and thereby yield faster sqlite3_prepare()
@@ -134091,17 +134633,18 @@ static int whereShortCut(WhereLoopBuilde
       /* TUNING: Cost of a unique index lookup is 15 */
       pLoop->rRun = 39;  /* 39==sqlite3LogEst(15) */
       break;
     }
   }
   if( pLoop->wsFlags ){
     pLoop->nOut = (LogEst)1;
     pWInfo->a[0].pWLoop = pLoop;
-    pLoop->maskSelf = sqlite3WhereGetMask(&pWInfo->sMaskSet, iCur);
+    assert( pWInfo->sMaskSet.n==1 && iCur==pWInfo->sMaskSet.ix[0] );
+    pLoop->maskSelf = 1; /* sqlite3WhereGetMask(&pWInfo->sMaskSet, iCur); */
     pWInfo->a[0].iTabCur = iCur;
     pWInfo->nRowOut = 1;
     if( pWInfo->pOrderBy ) pWInfo->nOBSat =  pWInfo->pOrderBy->nExpr;
     if( pWInfo->wctrlFlags & WHERE_WANT_DISTINCT ){
       pWInfo->eDistinct = WHERE_DISTINCT_UNIQUE;
     }
 #ifdef SQLITE_DEBUG
     pLoop->cId = '0';
@@ -134275,16 +134818,17 @@ SQLITE_PRIVATE WhereInfo *sqlite3WhereBe
   if( db->mallocFailed ){
     sqlite3DbFree(db, pWInfo);
     pWInfo = 0;
     goto whereBeginError;
   }
   pWInfo->pParse = pParse;
   pWInfo->pTabList = pTabList;
   pWInfo->pOrderBy = pOrderBy;
+  pWInfo->pWhere = pWhere;
   pWInfo->pResultSet = pResultSet;
   pWInfo->aiCurOnePass[0] = pWInfo->aiCurOnePass[1] = -1;
   pWInfo->nLevel = nTabList;
   pWInfo->iBreak = pWInfo->iContinue = sqlite3VdbeMakeLabel(v);
   pWInfo->wctrlFlags = wctrlFlags;
   pWInfo->iLimit = iAuxArg;
   pWInfo->savedNQueryLoop = pParse->nQueryLoop;
   memset(&pWInfo->nOBSat, 0, 
@@ -134585,16 +135129,17 @@ SQLITE_PRIVATE WhereInfo *sqlite3WhereBe
       assert( pIx->pSchema==pTab->pSchema );
       assert( iIndexCur>=0 );
       if( op ){
         sqlite3VdbeAddOp3(v, op, iIndexCur, pIx->tnum, iDb);
         sqlite3VdbeSetP4KeyInfo(pParse, pIx);
         if( (pLoop->wsFlags & WHERE_CONSTRAINT)!=0
          && (pLoop->wsFlags & (WHERE_COLUMN_RANGE|WHERE_SKIPSCAN))==0
          && (pWInfo->wctrlFlags&WHERE_ORDERBY_MIN)==0
+         && pWInfo->eDistinct!=WHERE_DISTINCT_ORDERED
         ){
           sqlite3VdbeChangeP5(v, OPFLAG_SEEKEQ); /* Hint to COMDB2 */
         }
         VdbeComment((v, "%s", pIx->zName));
 #ifdef SQLITE_ENABLE_COLUMN_USED_MASK
         {
           u64 colUsed = 0;
           int ii, jj;
@@ -134673,24 +135218,53 @@ SQLITE_PRIVATE void sqlite3WhereEnd(Wher
   /* Generate loop termination code.
   */
   VdbeModuleComment((v, "End WHERE-core"));
   sqlite3ExprCacheClear(pParse);
   for(i=pWInfo->nLevel-1; i>=0; i--){
     int addr;
     pLevel = &pWInfo->a[i];
     pLoop = pLevel->pWLoop;
-    sqlite3VdbeResolveLabel(v, pLevel->addrCont);
     if( pLevel->op!=OP_Noop ){
+#ifndef SQLITE_DISABLE_SKIPAHEAD_DISTINCT
+      int addrSeek = 0;
+      Index *pIdx;
+      int n;
+      if( pWInfo->eDistinct==WHERE_DISTINCT_ORDERED
+       && (pLoop->wsFlags & WHERE_INDEXED)!=0
+       && (pIdx = pLoop->u.btree.pIndex)->hasStat1
+       && (n = pLoop->u.btree.nIdxCol)>0
+       && pIdx->aiRowLogEst[n]>=36
+      ){
+        int r1 = pParse->nMem+1;
+        int j, op;
+        for(j=0; j<n; j++){
+          sqlite3VdbeAddOp3(v, OP_Column, pLevel->iIdxCur, j, r1+j);
+        }
+        pParse->nMem += n+1;
+        op = pLevel->op==OP_Prev ? OP_SeekLT : OP_SeekGT;
+        addrSeek = sqlite3VdbeAddOp4Int(v, op, pLevel->iIdxCur, 0, r1, n);
+        VdbeCoverageIf(v, op==OP_SeekLT);
+        VdbeCoverageIf(v, op==OP_SeekGT);
+        sqlite3VdbeAddOp2(v, OP_Goto, 1, pLevel->p2);
+      }
+#endif /* SQLITE_DISABLE_SKIPAHEAD_DISTINCT */
+      /* The common case: Advance to the next row */
+      sqlite3VdbeResolveLabel(v, pLevel->addrCont);
       sqlite3VdbeAddOp3(v, pLevel->op, pLevel->p1, pLevel->p2, pLevel->p3);
       sqlite3VdbeChangeP5(v, pLevel->p5);
       VdbeCoverage(v);
       VdbeCoverageIf(v, pLevel->op==OP_Next);
       VdbeCoverageIf(v, pLevel->op==OP_Prev);
       VdbeCoverageIf(v, pLevel->op==OP_VNext);
+#ifndef SQLITE_DISABLE_SKIPAHEAD_DISTINCT
+      if( addrSeek ) sqlite3VdbeJumpHere(v, addrSeek);
+#endif
+    }else{
+      sqlite3VdbeResolveLabel(v, pLevel->addrCont);
     }
     if( pLoop->wsFlags & WHERE_IN_ABLE && pLevel->u.in.nIn>0 ){
       struct InLoop *pIn;
       int j;
       sqlite3VdbeResolveLabel(v, pLevel->addrNxt);
       for(j=pLevel->u.in.nIn, pIn=&pLevel->u.in.aInLoop[j-1]; j>0; j--, pIn--){
         sqlite3VdbeJumpHere(v, pIn->addrInTop+1);
         if( pIn->eEndLoopOp!=OP_Noop ){
@@ -134803,16 +135377,18 @@ SQLITE_PRIVATE void sqlite3WhereEnd(Wher
             pOp->p2 = x;
             pOp->p1 = pLevel->iIdxCur;
           }
           assert( (pLoop->wsFlags & WHERE_IDX_ONLY)==0 || x>=0 
               || pWInfo->eOnePass );
         }else if( pOp->opcode==OP_Rowid ){
           pOp->p1 = pLevel->iIdxCur;
           pOp->opcode = OP_IdxRowid;
+        }else if( pOp->opcode==OP_IfNullRow ){
+          pOp->p1 = pLevel->iIdxCur;
         }
       }
     }
   }
 
   /* Final cleanup
   */
   pParse->nQueryLoop = pWInfo->savedNQueryLoop;
@@ -135112,17 +135688,17 @@ static void disableLookaside(Parse *pPar
 */
 #ifndef INTERFACE
 # define INTERFACE 1
 #endif
 /************* Begin control #defines *****************************************/
 #define YYCODETYPE unsigned char
 #define YYNOCODE 252
 #define YYACTIONTYPE unsigned short int
-#define YYWILDCARD 96
+#define YYWILDCARD 69
 #define sqlite3ParserTOKENTYPE Token
 typedef union {
   int yyinit;
   sqlite3ParserTOKENTYPE yy0;
   Expr* yy72;
   TriggerStep* yy145;
   ExprList* yy148;
   SrcList* yy185;
@@ -135219,425 +135795,425 @@ typedef union {
 **                     yy_action.  Used to detect hash collisions.
 **  yy_shift_ofst[]    For each state, the offset into yy_action for
 **                     shifting terminals.
 **  yy_reduce_ofst[]   For each state, the offset into yy_action for
 **                     shifting non-terminals after a reduce.
 **  yy_default[]       Default action for each state.
 **
 *********** Begin parsing tables **********************************************/
-#define YY_ACTTAB_COUNT (1567)
+#define YY_ACTTAB_COUNT (1566)
 static const YYACTIONTYPE yy_action[] = {
- /*     0 */   325,  832,  351,  825,    5,  203,  203,  819,   99,  100,
- /*    10 */    90,  978,  978,  853,  856,  845,  845,   97,   97,   98,
- /*    20 */    98,   98,   98,  301,   96,   96,   96,   96,   95,   95,
- /*    30 */    94,   94,   94,   93,  351,  325,  976,  976,  824,  824,
- /*    40 */   826,  946,  354,   99,  100,   90,  978,  978,  853,  856,
- /*    50 */   845,  845,   97,   97,   98,   98,   98,   98,  338,   96,
- /*    60 */    96,   96,   96,   95,   95,   94,   94,   94,   93,  351,
- /*    70 */    95,   95,   94,   94,   94,   93,  351,  791,  976,  976,
- /*    80 */   325,   94,   94,   94,   93,  351,  792,   75,   99,  100,
- /*    90 */    90,  978,  978,  853,  856,  845,  845,   97,   97,   98,
- /*   100 */    98,   98,   98,  450,   96,   96,   96,   96,   95,   95,
- /*   110 */    94,   94,   94,   93,  351, 1333,  155,  155,    2,  325,
- /*   120 */   275,  146,  132,   52,   52,   93,  351,   99,  100,   90,
- /*   130 */   978,  978,  853,  856,  845,  845,   97,   97,   98,   98,
- /*   140 */    98,   98,  101,   96,   96,   96,   96,   95,   95,   94,
- /*   150 */    94,   94,   93,  351,  957,  957,  325,  268,  428,  413,
- /*   160 */   411,   61,  752,  752,   99,  100,   90,  978,  978,  853,
- /*   170 */   856,  845,  845,   97,   97,   98,   98,   98,   98,   60,
- /*   180 */    96,   96,   96,   96,   95,   95,   94,   94,   94,   93,
- /*   190 */   351,  325,  270,  329,  273,  277,  958,  959,  250,   99,
- /*   200 */   100,   90,  978,  978,  853,  856,  845,  845,   97,   97,
- /*   210 */    98,   98,   98,   98,  301,   96,   96,   96,   96,   95,
- /*   220 */    95,   94,   94,   94,   93,  351,  325,  937, 1326,  698,
- /*   230 */   706, 1326,  242,  412,   99,  100,   90,  978,  978,  853,
- /*   240 */   856,  845,  845,   97,   97,   98,   98,   98,   98,  347,
- /*   250 */    96,   96,   96,   96,   95,   95,   94,   94,   94,   93,
- /*   260 */   351,  325,  937, 1327,  384,  699, 1327,  381,  379,   99,
- /*   270 */   100,   90,  978,  978,  853,  856,  845,  845,   97,   97,
- /*   280 */    98,   98,   98,   98,  701,   96,   96,   96,   96,   95,
- /*   290 */    95,   94,   94,   94,   93,  351,  325,   92,   89,  178,
- /*   300 */   833,  935,  373,  700,   99,  100,   90,  978,  978,  853,
- /*   310 */   856,  845,  845,   97,   97,   98,   98,   98,   98,  375,
- /*   320 */    96,   96,   96,   96,   95,   95,   94,   94,   94,   93,
- /*   330 */   351,  325, 1275,  946,  354,  818,  935,  739,  739,   99,
- /*   340 */   100,   90,  978,  978,  853,  856,  845,  845,   97,   97,
- /*   350 */    98,   98,   98,   98,  230,   96,   96,   96,   96,   95,
- /*   360 */    95,   94,   94,   94,   93,  351,  325,  968,  227,   92,
- /*   370 */    89,  178,  373,  300,   99,  100,   90,  978,  978,  853,
- /*   380 */   856,  845,  845,   97,   97,   98,   98,   98,   98,  920,
- /*   390 */    96,   96,   96,   96,   95,   95,   94,   94,   94,   93,
- /*   400 */   351,  325,  449,  447,  447,  447,  147,  737,  737,   99,
- /*   410 */   100,   90,  978,  978,  853,  856,  845,  845,   97,   97,
- /*   420 */    98,   98,   98,   98,  296,   96,   96,   96,   96,   95,
- /*   430 */    95,   94,   94,   94,   93,  351,  325,  419,  231,  957,
- /*   440 */   957,  158,   25,  422,   99,  100,   90,  978,  978,  853,
- /*   450 */   856,  845,  845,   97,   97,   98,   98,   98,   98,  450,
- /*   460 */    96,   96,   96,   96,   95,   95,   94,   94,   94,   93,
- /*   470 */   351,  443,  224,  224,  420,  957,  957,  961,  325,   52,
- /*   480 */    52,  958,  959,  176,  415,   78,   99,  100,   90,  978,
- /*   490 */   978,  853,  856,  845,  845,   97,   97,   98,   98,   98,
- /*   500 */    98,  379,   96,   96,   96,   96,   95,   95,   94,   94,
- /*   510 */    94,   93,  351,  325,  428,  418,  298,  958,  959,  961,
- /*   520 */    81,   99,   88,   90,  978,  978,  853,  856,  845,  845,
- /*   530 */    97,   97,   98,   98,   98,   98,  717,   96,   96,   96,
- /*   540 */    96,   95,   95,   94,   94,   94,   93,  351,  325,  842,
- /*   550 */   842,  854,  857,  996,  318,  343,  379,  100,   90,  978,
- /*   560 */   978,  853,  856,  845,  845,   97,   97,   98,   98,   98,
- /*   570 */    98,  450,   96,   96,   96,   96,   95,   95,   94,   94,
- /*   580 */    94,   93,  351,  325,  350,  350,  350,  260,  377,  340,
- /*   590 */   928,   52,   52,   90,  978,  978,  853,  856,  845,  845,
- /*   600 */    97,   97,   98,   98,   98,   98,  361,   96,   96,   96,
- /*   610 */    96,   95,   95,   94,   94,   94,   93,  351,   86,  445,
- /*   620 */   846,    3, 1202,  361,  360,  378,  344,  813,  957,  957,
- /*   630 */  1299,   86,  445,  729,    3,  212,  169,  287,  405,  282,
- /*   640 */   404,  199,  232,  450,  300,  760,   83,   84,  280,  245,
- /*   650 */   262,  365,  251,   85,  352,  352,   92,   89,  178,   83,
- /*   660 */    84,  242,  412,   52,   52,  448,   85,  352,  352,  246,
- /*   670 */   958,  959,  194,  455,  670,  402,  399,  398,  448,  243,
- /*   680 */   221,  114,  434,  776,  361,  450,  397,  268,  747,  224,
- /*   690 */   224,  132,  132,  198,  832,  434,  452,  451,  428,  427,
- /*   700 */   819,  415,  734,  713,  132,   52,   52,  832,  268,  452,
- /*   710 */   451,  734,  194,  819,  363,  402,  399,  398,  450, 1270,
- /*   720 */  1270,   23,  957,  957,   86,  445,  397,    3,  228,  429,
- /*   730 */   894,  824,  824,  826,  827,   19,  203,  720,   52,   52,
- /*   740 */   428,  408,  439,  249,  824,  824,  826,  827,   19,  229,
- /*   750 */   403,  153,   83,   84,  761,  177,  241,  450,  721,   85,
- /*   760 */   352,  352,  120,  157,  958,  959,   58,  976,  409,  355,
- /*   770 */   330,  448,  268,  428,  430,  320,  790,   32,   32,   86,
- /*   780 */   445,  776,    3,  341,   98,   98,   98,   98,  434,   96,
- /*   790 */    96,   96,   96,   95,   95,   94,   94,   94,   93,  351,
- /*   800 */   832,  120,  452,  451,  813,  886,  819,   83,   84,  976,
- /*   810 */   813,  132,  410,  919,   85,  352,  352,  132,  407,  789,
- /*   820 */   957,  957,   92,   89,  178,  916,  448,  262,  370,  261,
- /*   830 */    82,  913,   80,  262,  370,  261,  776,  824,  824,  826,
- /*   840 */   827,   19,  933,  434,   96,   96,   96,   96,   95,   95,
- /*   850 */    94,   94,   94,   93,  351,  832,   74,  452,  451,  957,
- /*   860 */   957,  819,  958,  959,  120,   92,   89,  178,  944,    2,
- /*   870 */   917,  964,  268,    1,  975,   76,  445,  762,    3,  708,
- /*   880 */   900,  900,  387,  957,  957,  757,  918,  371,  740,  778,
- /*   890 */   756,  257,  824,  824,  826,  827,   19,  417,  741,  450,
- /*   900 */    24,  958,  959,   83,   84,  369,  957,  957,  177,  226,
- /*   910 */    85,  352,  352,  884,  315,  314,  313,  215,  311,   10,
- /*   920 */    10,  683,  448,  349,  348,  958,  959,  908,  777,  157,
- /*   930 */   120,  957,  957,  337,  776,  416,  711,  310,  450,  434,
- /*   940 */   450,  321,  450,  791,  103,  200,  175,  450,  958,  959,
- /*   950 */   907,  832,  792,  452,  451,    9,    9,  819,   10,   10,
- /*   960 */    52,   52,   51,   51,  180,  716,  248,   10,   10,  171,
- /*   970 */   170,  167,  339,  958,  959,  247,  984,  702,  702,  450,
- /*   980 */   715,  233,  686,  982,  888,  983,  182,  913,  824,  824,
- /*   990 */   826,  827,   19,  183,  256,  423,  132,  181,  394,   10,
- /*  1000 */    10,  888,  890,  749,  957,  957,  916,  268,  985,  198,
- /*  1010 */   985,  349,  348,  425,  415,  299,  817,  832,  326,  825,
- /*  1020 */   120,  332,  133,  819,  268,   98,   98,   98,   98,   91,
- /*  1030 */    96,   96,   96,   96,   95,   95,   94,   94,   94,   93,
- /*  1040 */   351,  157,  810,  371,  382,  359,  958,  959,  358,  268,
- /*  1050 */   450,  917,  368,  324,  824,  824,  826,  450,  709,  450,
- /*  1060 */   264,  380,  888,  450,  876,  746,  253,  918,  255,  433,
- /*  1070 */    36,   36,  234,  450,  234,  120,  269,   37,   37,   12,
- /*  1080 */    12,  334,  272,   27,   27,  450,  330,  118,  450,  162,
- /*  1090 */   742,  280,  450,   38,   38,  450,  985,  356,  985,  450,
- /*  1100 */   709, 1209,  450,  132,  450,   39,   39,  450,   40,   40,
- /*  1110 */   450,  362,   41,   41,  450,   42,   42,  450,  254,   28,
- /*  1120 */    28,  450,   29,   29,   31,   31,  450,   43,   43,  450,
- /*  1130 */    44,   44,  450,  714,   45,   45,  450,   11,   11,  767,
- /*  1140 */   450,   46,   46,  450,  268,  450,  105,  105,  450,   47,
- /*  1150 */    47,  450,   48,   48,  450,  237,   33,   33,  450,  172,
- /*  1160 */    49,   49,  450,   50,   50,   34,   34,  274,  122,  122,
- /*  1170 */   450,  123,  123,  450,  124,  124,  450,  897,   56,   56,
- /*  1180 */   450,  896,   35,   35,  450,  267,  450,  817,  450,  817,
- /*  1190 */   106,  106,  450,   53,   53,  385,  107,  107,  450,  817,
- /*  1200 */   108,  108,  817,  450,  104,  104,  121,  121,  119,  119,
- /*  1210 */   450,  117,  112,  112,  450,  276,  450,  225,  111,  111,
- /*  1220 */   450,  730,  450,  109,  109,  450,  673,  674,  675,  911,
- /*  1230 */   110,  110,  317,  998,   55,   55,   57,   57,  692,  331,
- /*  1240 */    54,   54,   26,   26,  696,   30,   30,  317,  936,  197,
- /*  1250 */   196,  195,  335,  281,  336,  446,  331,  745,  689,  436,
- /*  1260 */   440,  444,  120,   72,  386,  223,  175,  345,  757,  932,
- /*  1270 */    20,  286,  319,  756,  815,  372,  374,  202,  202,  202,
- /*  1280 */   263,  395,  285,   74,  208,   21,  696,  719,  718,  883,
- /*  1290 */   120,  120,  120,  120,  120,  754,  278,  828,   77,   74,
- /*  1300 */   726,  727,  785,  783,  879,  202,  999,  208,  893,  892,
- /*  1310 */   893,  892,  694,  816,  763,  116,  774, 1289,  431,  432,
- /*  1320 */   302,  999,  390,  303,  823,  697,  691,  680,  159,  289,
- /*  1330 */   679,  883,  681,  951,  291,  218,  293,    7,  316,  828,
- /*  1340 */   173,  805,  259,  364,  252,  910,  376,  713,  295,  435,
- /*  1350 */   308,  168,  954,  993,  135,  400,  990,  284,  881,  880,
- /*  1360 */   205,  927,  925,   59,  333,   62,  144,  156,  130,   72,
- /*  1370 */   802,  366,  367,  393,  137,  185,  189,  160,  139,  383,
- /*  1380 */    67,  895,  140,  141,  142,  148,  389,  812,  775,  266,
- /*  1390 */   219,  190,  154,  391,  912,  875,  271,  406,  191,  322,
- /*  1400 */   682,  733,  192,  342,  732,  724,  731,  711,  723,  421,
- /*  1410 */   705,   71,  323,    6,  204,  771,  288,   79,  297,  346,
- /*  1420 */   772,  704,  290,  283,  703,  770,  292,  294,  966,  239,
- /*  1430 */   769,  102,  861,  438,  426,  240,  424,  442,   73,  213,
- /*  1440 */   688,  238,   22,  453,  952,  214,  217,  216,  454,  677,
- /*  1450 */   676,  671,  753,  125,  115,  235,  126,  669,  353,  166,
- /*  1460 */   127,  244,  179,  357,  306,  304,  305,  307,  113,  891,
- /*  1470 */   327,  889,  811,  328,  134,  128,  136,  138,  743,  258,
- /*  1480 */   906,  184,  143,  129,  909,  186,   63,   64,  145,  187,
- /*  1490 */   905,   65,    8,   66,   13,  188,  202,  898,  265,  149,
- /*  1500 */   987,  388,  150,  685,  161,  392,  285,  193,  279,  396,
- /*  1510 */   151,  401,   68,   14,   15,  722,   69,  236,  831,  131,
- /*  1520 */   830,  859,   70,  751,   16,  414,  755,    4,  174,  220,
- /*  1530 */   222,  784,  201,  152,  779,   77,   74,   17,   18,  874,
- /*  1540 */   860,  858,  915,  863,  914,  207,  206,  941,  163,  437,
- /*  1550 */   947,  942,  164,  209, 1002,  441,  862,  165,  210,  829,
- /*  1560 */   695,   87,  312,  211, 1291, 1290,  309,
+ /*     0 */   325,  411,  343,  752,  752,  203,  946,  354,  976,   98,
+ /*    10 */    98,   98,   98,   91,   96,   96,   96,   96,   95,   95,
+ /*    20 */    94,   94,   94,   93,  351, 1333,  155,  155,    2,  813,
+ /*    30 */   978,  978,   98,   98,   98,   98,   20,   96,   96,   96,
+ /*    40 */    96,   95,   95,   94,   94,   94,   93,  351,   92,   89,
+ /*    50 */   178,   99,  100,   90,  853,  856,  845,  845,   97,   97,
+ /*    60 */    98,   98,   98,   98,  351,   96,   96,   96,   96,   95,
+ /*    70 */    95,   94,   94,   94,   93,  351,  325,  340,  976,  262,
+ /*    80 */   365,  251,  212,  169,  287,  405,  282,  404,  199,  791,
+ /*    90 */   242,  412,   21,  957,  379,  280,   93,  351,  792,   95,
+ /*   100 */    95,   94,   94,   94,   93,  351,  978,  978,   96,   96,
+ /*   110 */    96,   96,   95,   95,   94,   94,   94,   93,  351,  813,
+ /*   120 */   329,  242,  412,  913,  832,  913,  132,   99,  100,   90,
+ /*   130 */   853,  856,  845,  845,   97,   97,   98,   98,   98,   98,
+ /*   140 */   450,   96,   96,   96,   96,   95,   95,   94,   94,   94,
+ /*   150 */    93,  351,  325,  825,  349,  348,  120,  819,  120,   75,
+ /*   160 */    52,   52,  957,  958,  959,  760,  984,  146,  361,  262,
+ /*   170 */   370,  261,  957,  982,  961,  983,   92,   89,  178,  371,
+ /*   180 */   230,  371,  978,  978,  817,  361,  360,  101,  824,  824,
+ /*   190 */   826,  384,   24,  964,  381,  428,  413,  369,  985,  380,
+ /*   200 */   985,  708,  325,   99,  100,   90,  853,  856,  845,  845,
+ /*   210 */    97,   97,   98,   98,   98,   98,  373,   96,   96,   96,
+ /*   220 */    96,   95,   95,   94,   94,   94,   93,  351,  957,  132,
+ /*   230 */   897,  450,  978,  978,  896,   60,   94,   94,   94,   93,
+ /*   240 */   351,  957,  958,  959,  961,  103,  361,  957,  385,  334,
+ /*   250 */   702,   52,   52,   99,  100,   90,  853,  856,  845,  845,
+ /*   260 */    97,   97,   98,   98,   98,   98,  698,   96,   96,   96,
+ /*   270 */    96,   95,   95,   94,   94,   94,   93,  351,  325,  455,
+ /*   280 */   670,  450,  227,   61,  157,  243,  344,  114,  701,  888,
+ /*   290 */   147,  832,  957,  373,  747,  957,  320,  957,  958,  959,
+ /*   300 */   194,   10,   10,  402,  399,  398,  888,  890,  978,  978,
+ /*   310 */   762,  171,  170,  157,  397,  337,  957,  958,  959,  702,
+ /*   320 */   825,  310,  153,  957,  819,  321,   82,   23,   80,   99,
+ /*   330 */   100,   90,  853,  856,  845,  845,   97,   97,   98,   98,
+ /*   340 */    98,   98,  894,   96,   96,   96,   96,   95,   95,   94,
+ /*   350 */    94,   94,   93,  351,  325,  824,  824,  826,  277,  231,
+ /*   360 */   300,  957,  958,  959,  957,  958,  959,  888,  194,   25,
+ /*   370 */   450,  402,  399,  398,  957,  355,  300,  450,  957,   74,
+ /*   380 */   450,    1,  397,  132,  978,  978,  957,  224,  224,  813,
+ /*   390 */    10,   10,  957,  958,  959,  968,  132,   52,   52,  415,
+ /*   400 */    52,   52,  739,  739,  339,   99,  100,   90,  853,  856,
+ /*   410 */   845,  845,   97,   97,   98,   98,   98,   98,  790,   96,
+ /*   420 */    96,   96,   96,   95,   95,   94,   94,   94,   93,  351,
+ /*   430 */   325,  789,  428,  418,  706,  428,  427, 1270, 1270,  262,
+ /*   440 */   370,  261,  957,  957,  958,  959,  757,  957,  958,  959,
+ /*   450 */   450,  756,  450,  734,  713,  957,  958,  959,  443,  711,
+ /*   460 */   978,  978,  734,  394,   92,   89,  178,  447,  447,  447,
+ /*   470 */    51,   51,   52,   52,  439,  778,  700,   92,   89,  178,
+ /*   480 */   172,   99,  100,   90,  853,  856,  845,  845,   97,   97,
+ /*   490 */    98,   98,   98,   98,  198,   96,   96,   96,   96,   95,
+ /*   500 */    95,   94,   94,   94,   93,  351,  325,  428,  408,  916,
+ /*   510 */   699,  957,  958,  959,   92,   89,  178,  224,  224,  157,
+ /*   520 */   241,  221,  419,  299,  776,  917,  416,  375,  450,  415,
+ /*   530 */    58,  324,  737,  737,  920,  379,  978,  978,  379,  777,
+ /*   540 */   449,  918,  363,  740,  296,  686,    9,    9,   52,   52,
+ /*   550 */   234,  330,  234,  256,  417,  741,  280,   99,  100,   90,
+ /*   560 */   853,  856,  845,  845,   97,   97,   98,   98,   98,   98,
+ /*   570 */   450,   96,   96,   96,   96,   95,   95,   94,   94,   94,
+ /*   580 */    93,  351,  325,  423,   72,  450,  833,  120,  368,  450,
+ /*   590 */    10,   10,    5,  301,  203,  450,  177,  976,  253,  420,
+ /*   600 */   255,  776,  200,  175,  233,   10,   10,  842,  842,   36,
+ /*   610 */    36, 1299,  978,  978,  729,   37,   37,  349,  348,  425,
+ /*   620 */   203,  260,  776,  976,  232,  937, 1326,  876,  338, 1326,
+ /*   630 */   422,  854,  857,   99,  100,   90,  853,  856,  845,  845,
+ /*   640 */    97,   97,   98,   98,   98,   98,  268,   96,   96,   96,
+ /*   650 */    96,   95,   95,   94,   94,   94,   93,  351,  325,  846,
+ /*   660 */   450,  985,  818,  985, 1209,  450,  916,  976,  720,  350,
+ /*   670 */   350,  350,  935,  177,  450,  937, 1327,  254,  198, 1327,
+ /*   680 */    12,   12,  917,  403,  450,   27,   27,  250,  978,  978,
+ /*   690 */   118,  721,  162,  976,   38,   38,  268,  176,  918,  776,
+ /*   700 */   433, 1275,  946,  354,   39,   39,  317,  998,  325,   99,
+ /*   710 */   100,   90,  853,  856,  845,  845,   97,   97,   98,   98,
+ /*   720 */    98,   98,  935,   96,   96,   96,   96,   95,   95,   94,
+ /*   730 */    94,   94,   93,  351,  450,  330,  450,  358,  978,  978,
+ /*   740 */   717,  317,  936,  341,  900,  900,  387,  673,  674,  675,
+ /*   750 */   275,  996,  318,  999,   40,   40,   41,   41,  268,   99,
+ /*   760 */   100,   90,  853,  856,  845,  845,   97,   97,   98,   98,
+ /*   770 */    98,   98,  450,   96,   96,   96,   96,   95,   95,   94,
+ /*   780 */    94,   94,   93,  351,  325,  450,  356,  450,  999,  450,
+ /*   790 */   692,  331,   42,   42,  791,  270,  450,  273,  450,  228,
+ /*   800 */   450,  298,  450,  792,  450,   28,   28,   29,   29,   31,
+ /*   810 */    31,  450,  817,  450,  978,  978,   43,   43,   44,   44,
+ /*   820 */    45,   45,   11,   11,   46,   46,  893,   78,  893,  268,
+ /*   830 */   268,  105,  105,   47,   47,   99,  100,   90,  853,  856,
+ /*   840 */   845,  845,   97,   97,   98,   98,   98,   98,  450,   96,
+ /*   850 */    96,   96,   96,   95,   95,   94,   94,   94,   93,  351,
+ /*   860 */   325,  450,  117,  450,  749,  158,  450,  696,   48,   48,
+ /*   870 */   229,  919,  450,  928,  450,  415,  450,  335,  450,  245,
+ /*   880 */   450,   33,   33,   49,   49,  450,   50,   50,  246,  817,
+ /*   890 */   978,  978,   34,   34,  122,  122,  123,  123,  124,  124,
+ /*   900 */    56,   56,  268,   81,  249,   35,   35,  197,  196,  195,
+ /*   910 */   325,   99,  100,   90,  853,  856,  845,  845,   97,   97,
+ /*   920 */    98,   98,   98,   98,  450,   96,   96,   96,   96,   95,
+ /*   930 */    95,   94,   94,   94,   93,  351,  450,  696,  450,  817,
+ /*   940 */   978,  978,  975,  884,  106,  106,  268,  886,  268,  944,
+ /*   950 */     2,  892,  268,  892,  336,  716,   53,   53,  107,  107,
+ /*   960 */   325,   99,  100,   90,  853,  856,  845,  845,   97,   97,
+ /*   970 */    98,   98,   98,   98,  450,   96,   96,   96,   96,   95,
+ /*   980 */    95,   94,   94,   94,   93,  351,  450,  746,  450,  742,
+ /*   990 */   978,  978,  715,  267,  108,  108,  446,  331,  332,  133,
+ /*  1000 */   223,  175,  301,  225,  386,  933,  104,  104,  121,  121,
+ /*  1010 */   325,   99,   88,   90,  853,  856,  845,  845,   97,   97,
+ /*  1020 */    98,   98,   98,   98,  817,   96,   96,   96,   96,   95,
+ /*  1030 */    95,   94,   94,   94,   93,  351,  450,  347,  450,  167,
+ /*  1040 */   978,  978,  932,  815,  372,  319,  202,  202,  374,  263,
+ /*  1050 */   395,  202,   74,  208,  726,  727,  119,  119,  112,  112,
+ /*  1060 */   325,  407,  100,   90,  853,  856,  845,  845,   97,   97,
+ /*  1070 */    98,   98,   98,   98,  450,   96,   96,   96,   96,   95,
+ /*  1080 */    95,   94,   94,   94,   93,  351,  450,  757,  450,  345,
+ /*  1090 */   978,  978,  756,  278,  111,  111,   74,  719,  718,  709,
+ /*  1100 */   286,  883,  754, 1289,  257,   77,  109,  109,  110,  110,
+ /*  1110 */   908,  285,  810,   90,  853,  856,  845,  845,   97,   97,
+ /*  1120 */    98,   98,   98,   98,  911,   96,   96,   96,   96,   95,
+ /*  1130 */    95,   94,   94,   94,   93,  351,   86,  445,  450,    3,
+ /*  1140 */  1202,  450,  745,  132,  352,  120,  689,   86,  445,  785,
+ /*  1150 */     3,  767,  202,  377,  448,  352,  907,  120,   55,   55,
+ /*  1160 */   450,   57,   57,  828,  879,  448,  450,  208,  450,  709,
+ /*  1170 */   450,  883,  237,  434,  436,  120,  440,  429,  362,  120,
+ /*  1180 */    54,   54,  132,  450,  434,  832,   52,   52,   26,   26,
+ /*  1190 */    30,   30,  382,  132,  409,  444,  832,  694,  264,  390,
+ /*  1200 */   116,  269,  272,   32,   32,   83,   84,  120,  274,  120,
+ /*  1210 */   120,  276,   85,  352,  452,  451,   83,   84,  819,  730,
+ /*  1220 */   714,  428,  430,   85,  352,  452,  451,  120,  120,  819,
+ /*  1230 */   378,  218,  281,  828,  783,  816,   86,  445,  410,    3,
+ /*  1240 */   763,  774,  431,  432,  352,  302,  303,  823,  697,  824,
+ /*  1250 */   824,  826,  827,   19,  448,  691,  680,  679,  681,  951,
+ /*  1260 */   824,  824,  826,  827,   19,  289,  159,  291,  293,    7,
+ /*  1270 */   316,  173,  259,  434,  805,  364,  252,  910,  376,  713,
+ /*  1280 */   295,  435,  168,  993,  400,  832,  284,  881,  880,  205,
+ /*  1290 */   954,  308,  927,   86,  445,  990,    3,  925,  333,  144,
+ /*  1300 */   130,  352,   72,  135,   59,   83,   84,  761,  137,  366,
+ /*  1310 */   802,  448,   85,  352,  452,  451,  139,  226,  819,  140,
+ /*  1320 */   156,   62,  315,  314,  313,  215,  311,  367,  393,  683,
+ /*  1330 */   434,  185,  141,  912,  142,  160,  148,  812,  875,  383,
+ /*  1340 */   189,   67,  832,  180,  389,  248,  895,  775,  219,  824,
+ /*  1350 */   824,  826,  827,   19,  247,  190,  266,  154,  391,  271,
+ /*  1360 */   191,  192,   83,   84,  682,  406,  733,  182,  322,   85,
+ /*  1370 */   352,  452,  451,  732,  183,  819,  342,  132,  181,  711,
+ /*  1380 */   731,  421,   76,  445,  705,    3,  323,  704,  283,  724,
+ /*  1390 */   352,  771,  703,  966,  723,   71,  204,    6,  288,  290,
+ /*  1400 */   448,  772,  770,  769,   79,  292,  824,  824,  826,  827,
+ /*  1410 */    19,  294,  297,  438,  346,  442,  102,  861,  753,  434,
+ /*  1420 */   238,  426,   73,  305,  239,  304,  326,  240,  424,  306,
+ /*  1430 */   307,  832,  213,  688,   22,  952,  453,  214,  216,  217,
+ /*  1440 */   454,  677,  115,  676,  671,  125,  126,  235,  127,  669,
+ /*  1450 */   327,   83,   84,  359,  353,  244,  166,  328,   85,  352,
+ /*  1460 */   452,  451,  134,  179,  819,  357,  113,  891,  811,  889,
+ /*  1470 */   136,  128,  138,  743,  258,  184,  906,  143,  145,   63,
+ /*  1480 */    64,   65,   66,  129,  909,  905,  187,  186,    8,   13,
+ /*  1490 */   188,  265,  898,  149,  202,  824,  824,  826,  827,   19,
+ /*  1500 */   388,  987,  150,  161,  285,  685,  392,  396,  151,  722,
+ /*  1510 */   193,   68,   14,  401,  279,   15,   69,  236,  831,  830,
+ /*  1520 */   131,  859,  751,   70,   16,  414,  755,    4,  784,  220,
+ /*  1530 */   222,  174,  152,  437,  779,  201,   17,   77,   74,   18,
+ /*  1540 */   874,  860,  858,  915,  863,  914,  207,  206,  941,  163,
+ /*  1550 */   210,  942,  209,  164,  441,  862,  165,  211,  829,  695,
+ /*  1560 */    87,  312,  309,  947, 1291, 1290,
 };
 static const YYCODETYPE yy_lookahead[] = {
- /*     0 */    19,   95,   53,   97,   22,   24,   24,  101,   27,   28,
- /*    10 */    29,   30,   31,   32,   33,   34,   35,   36,   37,   38,
- /*    20 */    39,   40,   41,  152,   43,   44,   45,   46,   47,   48,
- /*    30 */    49,   50,   51,   52,   53,   19,   55,   55,  132,  133,
- /*    40 */   134,    1,    2,   27,   28,   29,   30,   31,   32,   33,
- /*    50 */    34,   35,   36,   37,   38,   39,   40,   41,  187,   43,
- /*    60 */    44,   45,   46,   47,   48,   49,   50,   51,   52,   53,
- /*    70 */    47,   48,   49,   50,   51,   52,   53,   61,   97,   97,
- /*    80 */    19,   49,   50,   51,   52,   53,   70,   26,   27,   28,
- /*    90 */    29,   30,   31,   32,   33,   34,   35,   36,   37,   38,
- /*   100 */    39,   40,   41,  152,   43,   44,   45,   46,   47,   48,
- /*   110 */    49,   50,   51,   52,   53,  144,  145,  146,  147,   19,
- /*   120 */    16,   22,   92,  172,  173,   52,   53,   27,   28,   29,
- /*   130 */    30,   31,   32,   33,   34,   35,   36,   37,   38,   39,
- /*   140 */    40,   41,   81,   43,   44,   45,   46,   47,   48,   49,
- /*   150 */    50,   51,   52,   53,   55,   56,   19,  152,  207,  208,
- /*   160 */   115,   24,  117,  118,   27,   28,   29,   30,   31,   32,
- /*   170 */    33,   34,   35,   36,   37,   38,   39,   40,   41,   79,
- /*   180 */    43,   44,   45,   46,   47,   48,   49,   50,   51,   52,
- /*   190 */    53,   19,   88,  157,   90,   23,   97,   98,  193,   27,
- /*   200 */    28,   29,   30,   31,   32,   33,   34,   35,   36,   37,
- /*   210 */    38,   39,   40,   41,  152,   43,   44,   45,   46,   47,
- /*   220 */    48,   49,   50,   51,   52,   53,   19,   22,   23,  172,
- /*   230 */    23,   26,  119,  120,   27,   28,   29,   30,   31,   32,
- /*   240 */    33,   34,   35,   36,   37,   38,   39,   40,   41,  187,
- /*   250 */    43,   44,   45,   46,   47,   48,   49,   50,   51,   52,
- /*   260 */    53,   19,   22,   23,  228,   23,   26,  231,  152,   27,
- /*   270 */    28,   29,   30,   31,   32,   33,   34,   35,   36,   37,
- /*   280 */    38,   39,   40,   41,  172,   43,   44,   45,   46,   47,
- /*   290 */    48,   49,   50,   51,   52,   53,   19,  221,  222,  223,
- /*   300 */    23,   96,  152,  172,   27,   28,   29,   30,   31,   32,
- /*   310 */    33,   34,   35,   36,   37,   38,   39,   40,   41,  152,
- /*   320 */    43,   44,   45,   46,   47,   48,   49,   50,   51,   52,
- /*   330 */    53,   19,    0,    1,    2,   23,   96,  190,  191,   27,
- /*   340 */    28,   29,   30,   31,   32,   33,   34,   35,   36,   37,
- /*   350 */    38,   39,   40,   41,  238,   43,   44,   45,   46,   47,
- /*   360 */    48,   49,   50,   51,   52,   53,   19,  185,  218,  221,
- /*   370 */   222,  223,  152,  152,   27,   28,   29,   30,   31,   32,
- /*   380 */    33,   34,   35,   36,   37,   38,   39,   40,   41,  241,
- /*   390 */    43,   44,   45,   46,   47,   48,   49,   50,   51,   52,
- /*   400 */    53,   19,  152,  168,  169,  170,   22,  190,  191,   27,
- /*   410 */    28,   29,   30,   31,   32,   33,   34,   35,   36,   37,
- /*   420 */    38,   39,   40,   41,  152,   43,   44,   45,   46,   47,
- /*   430 */    48,   49,   50,   51,   52,   53,   19,   19,  218,   55,
- /*   440 */    56,   24,   22,  152,   27,   28,   29,   30,   31,   32,
- /*   450 */    33,   34,   35,   36,   37,   38,   39,   40,   41,  152,
- /*   460 */    43,   44,   45,   46,   47,   48,   49,   50,   51,   52,
- /*   470 */    53,  250,  194,  195,   56,   55,   56,   55,   19,  172,
- /*   480 */   173,   97,   98,  152,  206,  138,   27,   28,   29,   30,
- /*   490 */    31,   32,   33,   34,   35,   36,   37,   38,   39,   40,
- /*   500 */    41,  152,   43,   44,   45,   46,   47,   48,   49,   50,
- /*   510 */    51,   52,   53,   19,  207,  208,  152,   97,   98,   97,
- /*   520 */   138,   27,   28,   29,   30,   31,   32,   33,   34,   35,
- /*   530 */    36,   37,   38,   39,   40,   41,  181,   43,   44,   45,
- /*   540 */    46,   47,   48,   49,   50,   51,   52,   53,   19,   30,
- /*   550 */    31,   32,   33,  247,  248,   19,  152,   28,   29,   30,
- /*   560 */    31,   32,   33,   34,   35,   36,   37,   38,   39,   40,
- /*   570 */    41,  152,   43,   44,   45,   46,   47,   48,   49,   50,
- /*   580 */    51,   52,   53,   19,  168,  169,  170,  238,   19,   53,
- /*   590 */   152,  172,  173,   29,   30,   31,   32,   33,   34,   35,
- /*   600 */    36,   37,   38,   39,   40,   41,  152,   43,   44,   45,
- /*   610 */    46,   47,   48,   49,   50,   51,   52,   53,   19,   20,
- /*   620 */   101,   22,   23,  169,  170,   56,  207,   85,   55,   56,
- /*   630 */    23,   19,   20,   26,   22,   99,  100,  101,  102,  103,
- /*   640 */   104,  105,  238,  152,  152,  210,   47,   48,  112,  152,
- /*   650 */   108,  109,  110,   54,   55,   56,  221,  222,  223,   47,
- /*   660 */    48,  119,  120,  172,  173,   66,   54,   55,   56,  152,
- /*   670 */    97,   98,   99,  148,  149,  102,  103,  104,   66,  154,
- /*   680 */    23,  156,   83,   26,  230,  152,  113,  152,  163,  194,
- /*   690 */   195,   92,   92,   30,   95,   83,   97,   98,  207,  208,
- /*   700 */   101,  206,  179,  180,   92,  172,  173,   95,  152,   97,
- /*   710 */    98,  188,   99,  101,  219,  102,  103,  104,  152,  119,
- /*   720 */   120,  196,   55,   56,   19,   20,  113,   22,  193,  163,
- /*   730 */    11,  132,  133,  134,  135,  136,   24,   65,  172,  173,
- /*   740 */   207,  208,  250,  152,  132,  133,  134,  135,  136,  193,
- /*   750 */    78,   84,   47,   48,   49,   98,  199,  152,   86,   54,
- /*   760 */    55,   56,  196,  152,   97,   98,  209,   55,  163,  244,
- /*   770 */   107,   66,  152,  207,  208,  164,  175,  172,  173,   19,
- /*   780 */    20,  124,   22,  111,   38,   39,   40,   41,   83,   43,
- /*   790 */    44,   45,   46,   47,   48,   49,   50,   51,   52,   53,
- /*   800 */    95,  196,   97,   98,   85,  152,  101,   47,   48,   97,
- /*   810 */    85,   92,  207,  193,   54,   55,   56,   92,   49,  175,
- /*   820 */    55,   56,  221,  222,  223,   12,   66,  108,  109,  110,
- /*   830 */   137,  163,  139,  108,  109,  110,   26,  132,  133,  134,
- /*   840 */   135,  136,  152,   83,   43,   44,   45,   46,   47,   48,
- /*   850 */    49,   50,   51,   52,   53,   95,   26,   97,   98,   55,
- /*   860 */    56,  101,   97,   98,  196,  221,  222,  223,  146,  147,
- /*   870 */    57,  171,  152,   22,   26,   19,   20,   49,   22,  179,
- /*   880 */   108,  109,  110,   55,   56,  116,   73,  219,   75,  124,
- /*   890 */   121,  152,  132,  133,  134,  135,  136,  163,   85,  152,
- /*   900 */   232,   97,   98,   47,   48,  237,   55,   56,   98,    5,
- /*   910 */    54,   55,   56,  193,   10,   11,   12,   13,   14,  172,
- /*   920 */   173,   17,   66,   47,   48,   97,   98,  152,  124,  152,
- /*   930 */   196,   55,   56,  186,  124,  152,  106,  160,  152,   83,
- /*   940 */   152,  164,  152,   61,   22,  211,  212,  152,   97,   98,
- /*   950 */   152,   95,   70,   97,   98,  172,  173,  101,  172,  173,
- /*   960 */   172,  173,  172,  173,   60,  181,   62,  172,  173,   47,
- /*   970 */    48,  123,  186,   97,   98,   71,  100,   55,   56,  152,
- /*   980 */   181,  186,   21,  107,  152,  109,   82,  163,  132,  133,
- /*   990 */   134,  135,  136,   89,   16,  207,   92,   93,   19,  172,
- /*  1000 */   173,  169,  170,  195,   55,   56,   12,  152,  132,   30,
- /*  1010 */   134,   47,   48,  186,  206,  225,  152,   95,  114,   97,
- /*  1020 */   196,  245,  246,  101,  152,   38,   39,   40,   41,   42,
- /*  1030 */    43,   44,   45,   46,   47,   48,   49,   50,   51,   52,
- /*  1040 */    53,  152,  163,  219,  152,  141,   97,   98,  193,  152,
- /*  1050 */   152,   57,   91,  164,  132,  133,  134,  152,   55,  152,
- /*  1060 */   152,  237,  230,  152,  103,  193,   88,   73,   90,   75,
- /*  1070 */   172,  173,  183,  152,  185,  196,  152,  172,  173,  172,
- /*  1080 */   173,  217,  152,  172,  173,  152,  107,   22,  152,   24,
- /*  1090 */   193,  112,  152,  172,  173,  152,  132,  242,  134,  152,
- /*  1100 */    97,  140,  152,   92,  152,  172,  173,  152,  172,  173,
- /*  1110 */   152,  100,  172,  173,  152,  172,  173,  152,  140,  172,
- /*  1120 */   173,  152,  172,  173,  172,  173,  152,  172,  173,  152,
- /*  1130 */   172,  173,  152,  152,  172,  173,  152,  172,  173,  213,
- /*  1140 */   152,  172,  173,  152,  152,  152,  172,  173,  152,  172,
- /*  1150 */   173,  152,  172,  173,  152,  210,  172,  173,  152,   26,
- /*  1160 */   172,  173,  152,  172,  173,  172,  173,  152,  172,  173,
- /*  1170 */   152,  172,  173,  152,  172,  173,  152,   59,  172,  173,
- /*  1180 */   152,   63,  172,  173,  152,  193,  152,  152,  152,  152,
- /*  1190 */   172,  173,  152,  172,  173,   77,  172,  173,  152,  152,
- /*  1200 */   172,  173,  152,  152,  172,  173,  172,  173,  172,  173,
- /*  1210 */   152,   22,  172,  173,  152,  152,  152,   22,  172,  173,
- /*  1220 */   152,  152,  152,  172,  173,  152,    7,    8,    9,  163,
- /*  1230 */   172,  173,   22,   23,  172,  173,  172,  173,  166,  167,
- /*  1240 */   172,  173,  172,  173,   55,  172,  173,   22,   23,  108,
- /*  1250 */   109,  110,  217,  152,  217,  166,  167,  163,  163,  163,
- /*  1260 */   163,  163,  196,  130,  217,  211,  212,  217,  116,   23,
- /*  1270 */    22,  101,   26,  121,   23,   23,   23,   26,   26,   26,
- /*  1280 */    23,   23,  112,   26,   26,   37,   97,  100,  101,   55,
- /*  1290 */   196,  196,  196,  196,  196,   23,   23,   55,   26,   26,
- /*  1300 */     7,    8,   23,  152,   23,   26,   96,   26,  132,  132,
- /*  1310 */   134,  134,   23,  152,  152,   26,  152,  122,  152,  191,
- /*  1320 */   152,   96,  234,  152,  152,  152,  152,  152,  197,  210,
- /*  1330 */   152,   97,  152,  152,  210,  233,  210,  198,  150,   97,
- /*  1340 */   184,  201,  239,  214,  214,  201,  239,  180,  214,  227,
- /*  1350 */   200,  198,  155,   67,  243,  176,   69,  175,  175,  175,
- /*  1360 */   122,  159,  159,  240,  159,  240,   22,  220,   27,  130,
- /*  1370 */   201,   18,  159,   18,  189,  158,  158,  220,  192,  159,
- /*  1380 */   137,  236,  192,  192,  192,  189,   74,  189,  159,  235,
- /*  1390 */   159,  158,   22,  177,  201,  201,  159,  107,  158,  177,
- /*  1400 */   159,  174,  158,   76,  174,  182,  174,  106,  182,  125,
- /*  1410 */   174,  107,  177,   22,  159,  216,  215,  137,  159,   53,
- /*  1420 */   216,  176,  215,  174,  174,  216,  215,  215,  174,  229,
- /*  1430 */   216,  129,  224,  177,  126,  229,  127,  177,  128,   25,
- /*  1440 */   162,  226,   26,  161,   13,  153,    6,  153,  151,  151,
- /*  1450 */   151,  151,  205,  165,  178,  178,  165,    4,    3,   22,
- /*  1460 */   165,  142,   15,   94,  202,  204,  203,  201,   16,   23,
- /*  1470 */   249,   23,  120,  249,  246,  111,  131,  123,   20,   16,
- /*  1480 */     1,  125,  123,  111,   56,   64,   37,   37,  131,  122,
- /*  1490 */     1,   37,    5,   37,   22,  107,   26,   80,  140,   80,
- /*  1500 */    87,   72,  107,   20,   24,   19,  112,  105,   23,   79,
- /*  1510 */    22,   79,   22,   22,   22,   58,   22,   79,   23,   68,
- /*  1520 */    23,   23,   26,  116,   22,   26,   23,   22,  122,   23,
- /*  1530 */    23,   56,   64,   22,  124,   26,   26,   64,   64,   23,
- /*  1540 */    23,   23,   23,   11,   23,   22,   26,   23,   22,   24,
- /*  1550 */     1,   23,   22,   26,  251,   24,   23,   22,  122,   23,
- /*  1560 */    23,   22,   15,  122,  122,  122,   23,
-};
-#define YY_SHIFT_USE_DFLT (1567)
+ /*     0 */    19,  115,   19,  117,  118,   24,    1,    2,   27,   79,
+ /*    10 */    80,   81,   82,   83,   84,   85,   86,   87,   88,   89,
+ /*    20 */    90,   91,   92,   93,   94,  144,  145,  146,  147,   58,
+ /*    30 */    49,   50,   79,   80,   81,   82,   22,   84,   85,   86,
+ /*    40 */    87,   88,   89,   90,   91,   92,   93,   94,  221,  222,
+ /*    50 */   223,   70,   71,   72,   73,   74,   75,   76,   77,   78,
+ /*    60 */    79,   80,   81,   82,   94,   84,   85,   86,   87,   88,
+ /*    70 */    89,   90,   91,   92,   93,   94,   19,   94,   97,  108,
+ /*    80 */   109,  110,   99,  100,  101,  102,  103,  104,  105,   32,
+ /*    90 */   119,  120,   78,   27,  152,  112,   93,   94,   41,   88,
+ /*   100 */    89,   90,   91,   92,   93,   94,   49,   50,   84,   85,
+ /*   110 */    86,   87,   88,   89,   90,   91,   92,   93,   94,   58,
+ /*   120 */   157,  119,  120,  163,   68,  163,   65,   70,   71,   72,
+ /*   130 */    73,   74,   75,   76,   77,   78,   79,   80,   81,   82,
+ /*   140 */   152,   84,   85,   86,   87,   88,   89,   90,   91,   92,
+ /*   150 */    93,   94,   19,   97,   88,   89,  196,  101,  196,   26,
+ /*   160 */   172,  173,   96,   97,   98,  210,  100,   22,  152,  108,
+ /*   170 */   109,  110,   27,  107,   27,  109,  221,  222,  223,  219,
+ /*   180 */   238,  219,   49,   50,  152,  169,  170,   54,  132,  133,
+ /*   190 */   134,  228,  232,  171,  231,  207,  208,  237,  132,  237,
+ /*   200 */   134,  179,   19,   70,   71,   72,   73,   74,   75,   76,
+ /*   210 */    77,   78,   79,   80,   81,   82,  152,   84,   85,   86,
+ /*   220 */    87,   88,   89,   90,   91,   92,   93,   94,   27,   65,
+ /*   230 */    30,  152,   49,   50,   34,   52,   90,   91,   92,   93,
+ /*   240 */    94,   96,   97,   98,   97,   22,  230,   27,   48,  217,
+ /*   250 */    27,  172,  173,   70,   71,   72,   73,   74,   75,   76,
+ /*   260 */    77,   78,   79,   80,   81,   82,  172,   84,   85,   86,
+ /*   270 */    87,   88,   89,   90,   91,   92,   93,   94,   19,  148,
+ /*   280 */   149,  152,  218,   24,  152,  154,  207,  156,  172,  152,
+ /*   290 */    22,   68,   27,  152,  163,   27,  164,   96,   97,   98,
+ /*   300 */    99,  172,  173,  102,  103,  104,  169,  170,   49,   50,
+ /*   310 */    90,   88,   89,  152,  113,  186,   96,   97,   98,   96,
+ /*   320 */    97,  160,   57,   27,  101,  164,  137,  196,  139,   70,
+ /*   330 */    71,   72,   73,   74,   75,   76,   77,   78,   79,   80,
+ /*   340 */    81,   82,   11,   84,   85,   86,   87,   88,   89,   90,
+ /*   350 */    91,   92,   93,   94,   19,  132,  133,  134,   23,  218,
+ /*   360 */   152,   96,   97,   98,   96,   97,   98,  230,   99,   22,
+ /*   370 */   152,  102,  103,  104,   27,  244,  152,  152,   27,   26,
+ /*   380 */   152,   22,  113,   65,   49,   50,   27,  194,  195,   58,
+ /*   390 */   172,  173,   96,   97,   98,  185,   65,  172,  173,  206,
+ /*   400 */   172,  173,  190,  191,  186,   70,   71,   72,   73,   74,
+ /*   410 */    75,   76,   77,   78,   79,   80,   81,   82,  175,   84,
+ /*   420 */    85,   86,   87,   88,   89,   90,   91,   92,   93,   94,
+ /*   430 */    19,  175,  207,  208,   23,  207,  208,  119,  120,  108,
+ /*   440 */   109,  110,   27,   96,   97,   98,  116,   96,   97,   98,
+ /*   450 */   152,  121,  152,  179,  180,   96,   97,   98,  250,  106,
+ /*   460 */    49,   50,  188,   19,  221,  222,  223,  168,  169,  170,
+ /*   470 */   172,  173,  172,  173,  250,  124,  172,  221,  222,  223,
+ /*   480 */    26,   70,   71,   72,   73,   74,   75,   76,   77,   78,
+ /*   490 */    79,   80,   81,   82,   50,   84,   85,   86,   87,   88,
+ /*   500 */    89,   90,   91,   92,   93,   94,   19,  207,  208,   12,
+ /*   510 */    23,   96,   97,   98,  221,  222,  223,  194,  195,  152,
+ /*   520 */   199,   23,   19,  225,   26,   28,  152,  152,  152,  206,
+ /*   530 */   209,  164,  190,  191,  241,  152,   49,   50,  152,  124,
+ /*   540 */   152,   44,  219,   46,  152,   21,  172,  173,  172,  173,
+ /*   550 */   183,  107,  185,   16,  163,   58,  112,   70,   71,   72,
+ /*   560 */    73,   74,   75,   76,   77,   78,   79,   80,   81,   82,
+ /*   570 */   152,   84,   85,   86,   87,   88,   89,   90,   91,   92,
+ /*   580 */    93,   94,   19,  207,  130,  152,   23,  196,   64,  152,
+ /*   590 */   172,  173,   22,  152,   24,  152,   98,   27,   61,   96,
+ /*   600 */    63,   26,  211,  212,  186,  172,  173,   49,   50,  172,
+ /*   610 */   173,   23,   49,   50,   26,  172,  173,   88,   89,  186,
+ /*   620 */    24,  238,  124,   27,  238,   22,   23,  103,  187,   26,
+ /*   630 */   152,   73,   74,   70,   71,   72,   73,   74,   75,   76,
+ /*   640 */    77,   78,   79,   80,   81,   82,  152,   84,   85,   86,
+ /*   650 */    87,   88,   89,   90,   91,   92,   93,   94,   19,  101,
+ /*   660 */   152,  132,   23,  134,  140,  152,   12,   97,   36,  168,
+ /*   670 */   169,  170,   69,   98,  152,   22,   23,  140,   50,   26,
+ /*   680 */   172,  173,   28,   51,  152,  172,  173,  193,   49,   50,
+ /*   690 */    22,   59,   24,   97,  172,  173,  152,  152,   44,  124,
+ /*   700 */    46,    0,    1,    2,  172,  173,   22,   23,   19,   70,
+ /*   710 */    71,   72,   73,   74,   75,   76,   77,   78,   79,   80,
+ /*   720 */    81,   82,   69,   84,   85,   86,   87,   88,   89,   90,
+ /*   730 */    91,   92,   93,   94,  152,  107,  152,  193,   49,   50,
+ /*   740 */   181,   22,   23,  111,  108,  109,  110,    7,    8,    9,
+ /*   750 */    16,  247,  248,   69,  172,  173,  172,  173,  152,   70,
+ /*   760 */    71,   72,   73,   74,   75,   76,   77,   78,   79,   80,
+ /*   770 */    81,   82,  152,   84,   85,   86,   87,   88,   89,   90,
+ /*   780 */    91,   92,   93,   94,   19,  152,  242,  152,   69,  152,
+ /*   790 */   166,  167,  172,  173,   32,   61,  152,   63,  152,  193,
+ /*   800 */   152,  152,  152,   41,  152,  172,  173,  172,  173,  172,
+ /*   810 */   173,  152,  152,  152,   49,   50,  172,  173,  172,  173,
+ /*   820 */   172,  173,  172,  173,  172,  173,  132,  138,  134,  152,
+ /*   830 */   152,  172,  173,  172,  173,   70,   71,   72,   73,   74,
+ /*   840 */    75,   76,   77,   78,   79,   80,   81,   82,  152,   84,
+ /*   850 */    85,   86,   87,   88,   89,   90,   91,   92,   93,   94,
+ /*   860 */    19,  152,   22,  152,  195,   24,  152,   27,  172,  173,
+ /*   870 */   193,  193,  152,  152,  152,  206,  152,  217,  152,  152,
+ /*   880 */   152,  172,  173,  172,  173,  152,  172,  173,  152,  152,
+ /*   890 */    49,   50,  172,  173,  172,  173,  172,  173,  172,  173,
+ /*   900 */   172,  173,  152,  138,  152,  172,  173,  108,  109,  110,
+ /*   910 */    19,   70,   71,   72,   73,   74,   75,   76,   77,   78,
+ /*   920 */    79,   80,   81,   82,  152,   84,   85,   86,   87,   88,
+ /*   930 */    89,   90,   91,   92,   93,   94,  152,   97,  152,  152,
+ /*   940 */    49,   50,   26,  193,  172,  173,  152,  152,  152,  146,
+ /*   950 */   147,  132,  152,  134,  217,  181,  172,  173,  172,  173,
+ /*   960 */    19,   70,   71,   72,   73,   74,   75,   76,   77,   78,
+ /*   970 */    79,   80,   81,   82,  152,   84,   85,   86,   87,   88,
+ /*   980 */    89,   90,   91,   92,   93,   94,  152,  193,  152,  193,
+ /*   990 */    49,   50,  181,  193,  172,  173,  166,  167,  245,  246,
+ /*  1000 */   211,  212,  152,   22,  217,  152,  172,  173,  172,  173,
+ /*  1010 */    19,   70,   71,   72,   73,   74,   75,   76,   77,   78,
+ /*  1020 */    79,   80,   81,   82,  152,   84,   85,   86,   87,   88,
+ /*  1030 */    89,   90,   91,   92,   93,   94,  152,  187,  152,  123,
+ /*  1040 */    49,   50,   23,   23,   23,   26,   26,   26,   23,   23,
+ /*  1050 */    23,   26,   26,   26,    7,    8,  172,  173,  172,  173,
+ /*  1060 */    19,   90,   71,   72,   73,   74,   75,   76,   77,   78,
+ /*  1070 */    79,   80,   81,   82,  152,   84,   85,   86,   87,   88,
+ /*  1080 */    89,   90,   91,   92,   93,   94,  152,  116,  152,  217,
+ /*  1090 */    49,   50,  121,   23,  172,  173,   26,  100,  101,   27,
+ /*  1100 */   101,   27,   23,  122,  152,   26,  172,  173,  172,  173,
+ /*  1110 */   152,  112,  163,   72,   73,   74,   75,   76,   77,   78,
+ /*  1120 */    79,   80,   81,   82,  163,   84,   85,   86,   87,   88,
+ /*  1130 */    89,   90,   91,   92,   93,   94,   19,   20,  152,   22,
+ /*  1140 */    23,  152,  163,   65,   27,  196,  163,   19,   20,   23,
+ /*  1150 */    22,  213,   26,   19,   37,   27,  152,  196,  172,  173,
+ /*  1160 */   152,  172,  173,   27,   23,   37,  152,   26,  152,   97,
+ /*  1170 */   152,   97,  210,   56,  163,  196,  163,  163,  100,  196,
+ /*  1180 */   172,  173,   65,  152,   56,   68,  172,  173,  172,  173,
+ /*  1190 */   172,  173,  152,   65,  163,  163,   68,   23,  152,  234,
+ /*  1200 */    26,  152,  152,  172,  173,   88,   89,  196,  152,  196,
+ /*  1210 */   196,  152,   95,   96,   97,   98,   88,   89,  101,  152,
+ /*  1220 */   152,  207,  208,   95,   96,   97,   98,  196,  196,  101,
+ /*  1230 */    96,  233,  152,   97,  152,  152,   19,   20,  207,   22,
+ /*  1240 */   152,  152,  152,  191,   27,  152,  152,  152,  152,  132,
+ /*  1250 */   133,  134,  135,  136,   37,  152,  152,  152,  152,  152,
+ /*  1260 */   132,  133,  134,  135,  136,  210,  197,  210,  210,  198,
+ /*  1270 */   150,  184,  239,   56,  201,  214,  214,  201,  239,  180,
+ /*  1280 */   214,  227,  198,   38,  176,   68,  175,  175,  175,  122,
+ /*  1290 */   155,  200,  159,   19,   20,   40,   22,  159,  159,   22,
+ /*  1300 */    70,   27,  130,  243,  240,   88,   89,   90,  189,   18,
+ /*  1310 */   201,   37,   95,   96,   97,   98,  192,    5,  101,  192,
+ /*  1320 */   220,  240,   10,   11,   12,   13,   14,  159,   18,   17,
+ /*  1330 */    56,  158,  192,  201,  192,  220,  189,  189,  201,  159,
+ /*  1340 */   158,  137,   68,   31,   45,   33,  236,  159,  159,  132,
+ /*  1350 */   133,  134,  135,  136,   42,  158,  235,   22,  177,  159,
+ /*  1360 */   158,  158,   88,   89,  159,  107,  174,   55,  177,   95,
+ /*  1370 */    96,   97,   98,  174,   62,  101,   47,   65,   66,  106,
+ /*  1380 */   174,  125,   19,   20,  174,   22,  177,  176,  174,  182,
+ /*  1390 */    27,  216,  174,  174,  182,  107,  159,   22,  215,  215,
+ /*  1400 */    37,  216,  216,  216,  137,  215,  132,  133,  134,  135,
+ /*  1410 */   136,  215,  159,  177,   94,  177,  129,  224,  205,   56,
+ /*  1420 */   226,  126,  128,  203,  229,  204,  114,  229,  127,  202,
+ /*  1430 */   201,   68,   25,  162,   26,   13,  161,  153,  153,    6,
+ /*  1440 */   151,  151,  178,  151,  151,  165,  165,  178,  165,    4,
+ /*  1450 */   249,   88,   89,  141,    3,  142,   22,  249,   95,   96,
+ /*  1460 */    97,   98,  246,   15,  101,   67,   16,   23,  120,   23,
+ /*  1470 */   131,  111,  123,   20,   16,  125,    1,  123,  131,   78,
+ /*  1480 */    78,   78,   78,  111,   96,    1,  122,   35,    5,   22,
+ /*  1490 */   107,  140,   53,   53,   26,  132,  133,  134,  135,  136,
+ /*  1500 */    43,   60,  107,   24,  112,   20,   19,   52,   22,   29,
+ /*  1510 */   105,   22,   22,   52,   23,   22,   22,   52,   23,   23,
+ /*  1520 */    39,   23,  116,   26,   22,   26,   23,   22,   96,   23,
+ /*  1530 */    23,  122,   22,   24,  124,   35,   35,   26,   26,   35,
+ /*  1540 */    23,   23,   23,   23,   11,   23,   22,   26,   23,   22,
+ /*  1550 */   122,   23,   26,   22,   24,   23,   22,  122,   23,   23,
+ /*  1560 */    22,   15,   23,    1,  122,  122,
+};
+#define YY_SHIFT_USE_DFLT (1566)
 #define YY_SHIFT_COUNT    (455)
-#define YY_SHIFT_MIN      (-94)
-#define YY_SHIFT_MAX      (1549)
+#define YY_SHIFT_MIN      (-114)
+#define YY_SHIFT_MAX      (1562)
 static const short yy_shift_ofst[] = {
- /*     0 */    40,  599,  904,  612,  760,  760,  760,  760,  725,  -19,
- /*    10 */    16,   16,  100,  760,  760,  760,  760,  760,  760,  760,
- /*    20 */   876,  876,  573,  542,  719,  600,   61,  137,  172,  207,
- /*    30 */   242,  277,  312,  347,  382,  417,  459,  459,  459,  459,
- /*    40 */   459,  459,  459,  459,  459,  459,  459,  459,  459,  459,
- /*    50 */   459,  459,  459,  494,  459,  529,  564,  564,  705,  760,
- /*    60 */   760,  760,  760,  760,  760,  760,  760,  760,  760,  760,
- /*    70 */   760,  760,  760,  760,  760,  760,  760,  760,  760,  760,
- /*    80 */   760,  760,  760,  760,  760,  760,  760,  760,  760,  760,
- /*    90 */   856,  760,  760,  760,  760,  760,  760,  760,  760,  760,
- /*   100 */   760,  760,  760,  760,  987,  746,  746,  746,  746,  746,
- /*   110 */   801,   23,   32,  949,  961,  979,  964,  964,  949,   73,
- /*   120 */   113,  -51, 1567, 1567, 1567,  536,  536,  536,   99,   99,
- /*   130 */   813,  813,  667,  205,  240,  949,  949,  949,  949,  949,
- /*   140 */   949,  949,  949,  949,  949,  949,  949,  949,  949,  949,
- /*   150 */   949,  949,  949,  949,  949,  332, 1011,  422,  422,  113,
- /*   160 */    30,   30,   30,   30,   30,   30, 1567, 1567, 1567,  922,
- /*   170 */   -94,  -94,  384,  613,  828,  420,  765,  804,  851,  949,
- /*   180 */   949,  949,  949,  949,  949,  949,  949,  949,  949,  949,
- /*   190 */   949,  949,  949,  949,  949,  672,  672,  672,  949,  949,
- /*   200 */   657,  949,  949,  949,  -18,  949,  949,  994,  949,  949,
- /*   210 */   949,  949,  949,  949,  949,  949,  949,  949,  772, 1118,
- /*   220 */   712,  712,  712,  810,   45,  769, 1219, 1133,  418,  418,
- /*   230 */   569, 1133,  569,  830,  607,  663,  882,  418,  693,  882,
- /*   240 */   882,  848, 1152, 1065, 1286, 1238, 1238, 1287, 1287, 1238,
- /*   250 */  1344, 1341, 1239, 1353, 1353, 1353, 1353, 1238, 1355, 1239,
- /*   260 */  1344, 1341, 1341, 1239, 1238, 1355, 1243, 1312, 1238, 1238,
- /*   270 */  1355, 1370, 1238, 1355, 1238, 1355, 1370, 1290, 1290, 1290,
- /*   280 */  1327, 1370, 1290, 1301, 1290, 1327, 1290, 1290, 1284, 1304,
- /*   290 */  1284, 1304, 1284, 1304, 1284, 1304, 1238, 1391, 1238, 1280,
- /*   300 */  1370, 1366, 1366, 1370, 1302, 1308, 1310, 1309, 1239, 1414,
- /*   310 */  1416, 1431, 1431, 1440, 1440, 1440, 1440, 1567, 1567, 1567,
- /*   320 */  1567, 1567, 1567, 1567, 1567,  519,  978, 1210, 1225,  104,
- /*   330 */  1141, 1189, 1246, 1248, 1251, 1252, 1253, 1257, 1258, 1273,
- /*   340 */  1003, 1187, 1293, 1170, 1272, 1279, 1234, 1281, 1176, 1177,
- /*   350 */  1289, 1242, 1195, 1453, 1455, 1437, 1319, 1447, 1369, 1452,
- /*   360 */  1446, 1448, 1352, 1345, 1364, 1354, 1458, 1356, 1463, 1479,
- /*   370 */  1359, 1357, 1449, 1450, 1454, 1456, 1372, 1428, 1421, 1367,
- /*   380 */  1489, 1487, 1472, 1388, 1358, 1417, 1470, 1419, 1413, 1429,
- /*   390 */  1395, 1480, 1483, 1486, 1394, 1402, 1488, 1430, 1490, 1491,
- /*   400 */  1485, 1492, 1432, 1457, 1494, 1438, 1451, 1495, 1497, 1498,
- /*   410 */  1496, 1407, 1502, 1503, 1505, 1499, 1406, 1506, 1507, 1475,
- /*   420 */  1468, 1511, 1410, 1509, 1473, 1510, 1474, 1516, 1509, 1517,
- /*   430 */  1518, 1519, 1520, 1521, 1523, 1532, 1524, 1526, 1525, 1527,
- /*   440 */  1528, 1530, 1531, 1527, 1533, 1535, 1536, 1537, 1539, 1436,
- /*   450 */  1441, 1442, 1443, 1543, 1547, 1549,
-};
-#define YY_REDUCE_USE_DFLT (-130)
+ /*     0 */     5, 1117, 1312, 1128, 1274, 1274, 1274, 1274,   61,  -19,
+ /*    10 */    57,   57,  183, 1274, 1274, 1274, 1274, 1274, 1274, 1274,
+ /*    20 */    66,   66,  201,  -29,  331,  318,  133,  259,  335,  411,
+ /*    30 */   487,  563,  639,  689,  765,  841,  891,  891,  891,  891,
+ /*    40 */   891,  891,  891,  891,  891,  891,  891,  891,  891,  891,
+ /*    50 */   891,  891,  891,  941,  891,  991, 1041, 1041, 1217, 1274,
+ /*    60 */  1274, 1274, 1274, 1274, 1274, 1274, 1274, 1274, 1274, 1274,
+ /*    70 */  1274, 1274, 1274, 1274, 1274, 1274, 1274, 1274, 1274, 1274,
+ /*    80 */  1274, 1274, 1274, 1274, 1274, 1274, 1274, 1274, 1274, 1274,
+ /*    90 */  1363, 1274, 1274, 1274, 1274, 1274, 1274, 1274, 1274, 1274,
+ /*   100 */  1274, 1274, 1274, 1274,  -70,  -47,  -47,  -47,  -47,  -47,
+ /*   110 */    24,   11,  146,  296,  524,  444,  529,  529,  296,    3,
+ /*   120 */     2,  -30, 1566, 1566, 1566,  -17,  -17,  -17,  145,  145,
+ /*   130 */   497,  497,  265,  603,  653,  296,  296,  296,  296,  296,
+ /*   140 */   296,  296,  296,  296,  296,  296,  296,  296,  296,  296,
+ /*   150 */   296,  296,  296,  296,  296,  701, 1078,  147,  147,    2,
+ /*   160 */   164,  164,  164,  164,  164,  164, 1566, 1566, 1566,  223,
+ /*   170 */    56,   56,  268,  269,  220,  347,  351,  415,  359,  296,
+ /*   180 */   296,  296,  296,  296,  296,  296,  296,  296,  296,  296,
+ /*   190 */   296,  296,  296,  296,  296,  632,  632,  632,  296,  296,
+ /*   200 */   498,  296,  296,  296,  570,  296,  296,  654,  296,  296,
+ /*   210 */   296,  296,  296,  296,  296,  296,  296,  296,  636,  200,
+ /*   220 */   596,  596,  596,  575, -114,  971,  740,  454,  503,  503,
+ /*   230 */  1134,  454, 1134,  353,  588,  628,  762,  503,  189,  762,
+ /*   240 */   762,  916,  330,  668, 1245, 1167, 1167, 1255, 1255, 1167,
+ /*   250 */  1277, 1230, 1172, 1291, 1291, 1291, 1291, 1167, 1310, 1172,
+ /*   260 */  1277, 1230, 1230, 1172, 1167, 1310, 1204, 1299, 1167, 1167,
+ /*   270 */  1310, 1335, 1167, 1310, 1167, 1310, 1335, 1258, 1258, 1258,
+ /*   280 */  1329, 1335, 1258, 1273, 1258, 1329, 1258, 1258, 1256, 1288,
+ /*   290 */  1256, 1288, 1256, 1288, 1256, 1288, 1167, 1375, 1167, 1267,
+ /*   300 */  1335, 1320, 1320, 1335, 1287, 1295, 1294, 1301, 1172, 1407,
+ /*   310 */  1408, 1422, 1422, 1433, 1433, 1433, 1433, 1566, 1566, 1566,
+ /*   320 */  1566, 1566, 1566, 1566, 1566,  558,  537,  684,  719,  734,
+ /*   330 */   799,  840, 1019,   14, 1020, 1021, 1025, 1026, 1027, 1070,
+ /*   340 */  1072,  997, 1047,  999, 1079, 1126, 1074, 1141,  694,  819,
+ /*   350 */  1174, 1136,  981, 1445, 1451, 1434, 1313, 1448, 1398, 1450,
+ /*   360 */  1444, 1446, 1348, 1339, 1360, 1349, 1453, 1350, 1458, 1475,
+ /*   370 */  1354, 1347, 1401, 1402, 1403, 1404, 1372, 1388, 1452, 1364,
+ /*   380 */  1484, 1483, 1467, 1383, 1351, 1439, 1468, 1440, 1441, 1457,
+ /*   390 */  1395, 1479, 1485, 1487, 1392, 1405, 1486, 1455, 1489, 1490,
+ /*   400 */  1491, 1493, 1461, 1480, 1494, 1465, 1481, 1495, 1496, 1498,
+ /*   410 */  1497, 1406, 1502, 1503, 1505, 1499, 1409, 1506, 1507, 1432,
+ /*   420 */  1500, 1510, 1410, 1511, 1501, 1512, 1504, 1517, 1511, 1518,
+ /*   430 */  1519, 1520, 1521, 1522, 1524, 1533, 1525, 1527, 1509, 1526,
+ /*   440 */  1528, 1531, 1530, 1526, 1532, 1534, 1535, 1536, 1538, 1428,
+ /*   450 */  1435, 1442, 1443, 1539, 1546, 1562,
+};
+#define YY_REDUCE_USE_DFLT (-174)
 #define YY_REDUCE_COUNT (324)
-#define YY_REDUCE_MIN   (-129)
-#define YY_REDUCE_MAX   (1300)
+#define YY_REDUCE_MIN   (-173)
+#define YY_REDUCE_MAX   (1293)
 static const short yy_reduce_ofst[] = {
- /*     0 */   -29,  566,  525,  605,  -49,  307,  491,  533,  668,  435,
- /*    10 */   601,  644,  148,  747,  786,  795,  419,  788,  827,  790,
- /*    20 */   454,  832,  889,  495,  824,  734,   76,   76,   76,   76,
- /*    30 */    76,   76,   76,   76,   76,   76,   76,   76,   76,   76,
- /*    40 */    76,   76,   76,   76,   76,   76,   76,   76,   76,   76,
- /*    50 */    76,   76,   76,   76,   76,   76,   76,   76,  783,  898,
- /*    60 */   905,  907,  911,  921,  933,  936,  940,  943,  947,  950,
- /*    70 */   952,  955,  958,  962,  965,  969,  974,  977,  980,  984,
- /*    80 */   988,  991,  993,  996,  999, 1002, 1006, 1010, 1018, 1021,
- /*    90 */  1024, 1028, 1032, 1034, 1036, 1040, 1046, 1051, 1058, 1062,
- /*   100 */  1064, 1068, 1070, 1073,   76,   76,   76,   76,   76,   76,
- /*   110 */    76,   76,   76,  855,   36,  523,  235,  416,  777,   76,
- /*   120 */   278,   76,   76,   76,   76,  700,  700,  700,  150,  220,
- /*   130 */   147,  217,  221,  306,  306,  611,    5,  535,  556,  620,
- /*   140 */   720,  872,  897,  116,  864,  349, 1035, 1037,  404, 1047,
- /*   150 */   992, -129, 1050,  492,   62,  722,  879, 1072, 1089,  808,
- /*   160 */  1066, 1094, 1095, 1096, 1097, 1098,  776, 1054,  557,   57,
- /*   170 */   112,  131,  167,  182,  250,  272,  291,  331,  364,  438,
- /*   180 */   497,  517,  591,  653,  690,  739,  775,  798,  892,  908,
- /*   190 */   924,  930, 1015, 1063, 1069,  355,  784,  799,  981, 1101,
- /*   200 */   926, 1151, 1161, 1162,  945, 1164, 1166, 1128, 1168, 1171,
- /*   210 */  1172,  250, 1173, 1174, 1175, 1178, 1180, 1181, 1088, 1102,
- /*   220 */  1119, 1124, 1126,  926, 1131, 1139, 1188, 1140, 1129, 1130,
- /*   230 */  1103, 1144, 1107, 1179, 1156, 1167, 1182, 1134, 1122, 1183,
- /*   240 */  1184, 1150, 1153, 1197, 1111, 1202, 1203, 1123, 1125, 1205,
- /*   250 */  1147, 1185, 1169, 1186, 1190, 1191, 1192, 1213, 1217, 1193,
- /*   260 */  1157, 1196, 1198, 1194, 1220, 1218, 1145, 1154, 1229, 1231,
- /*   270 */  1233, 1216, 1237, 1240, 1241, 1244, 1222, 1227, 1230, 1232,
- /*   280 */  1223, 1235, 1236, 1245, 1249, 1226, 1250, 1254, 1199, 1201,
- /*   290 */  1204, 1207, 1209, 1211, 1214, 1212, 1255, 1208, 1259, 1215,
- /*   300 */  1256, 1200, 1206, 1260, 1247, 1261, 1263, 1262, 1266, 1278,
- /*   310 */  1282, 1292, 1294, 1297, 1298, 1299, 1300, 1221, 1224, 1228,
- /*   320 */  1288, 1291, 1276, 1277, 1295,
+ /*     0 */  -119, 1014,  131, 1031,  -12,  225,  228,  300,  -40,  -45,
+ /*    10 */   243,  256,  293,  129,  218,  418,   79,  376,  433,  298,
+ /*    20 */    16,  137,  367,  323,  -38,  391, -173, -173, -173, -173,
+ /*    30 */  -173, -173, -173, -173, -173, -173, -173, -173, -173, -173,
+ /*    40 */  -173, -173, -173, -173, -173, -173, -173, -173, -173, -173,
+ /*    50 */  -173, -173, -173, -173, -173, -173, -173, -173,  374,  437,
+ /*    60 */   443,  508,  513,  522,  532,  582,  584,  620,  633,  635,
+ /*    70 */   637,  644,  646,  648,  650,  652,  659,  661,  696,  709,
+ /*    80 */   711,  714,  720,  722,  724,  726,  728,  733,  772,  784,
+ /*    90 */   786,  822,  834,  836,  884,  886,  922,  934,  936,  986,
+ /*   100 */   989, 1008, 1016, 1018, -173, -173, -173, -173, -173, -173,
+ /*   110 */  -173, -173, -173,  544,  -37,  274,  299,  501,  161, -173,
+ /*   120 */   193, -173, -173, -173, -173,   22,   22,   22,   64,  141,
+ /*   130 */   212,  342,  208,  504,  504,  132,  494,  606,  677,  678,
+ /*   140 */   750,  794,  796,  -58,   32,  383,  660,  737,  386,  787,
+ /*   150 */   800,  441,  872,  224,  850,  803,  949,  624,  830,  669,
+ /*   160 */   961,  979,  983, 1011, 1013, 1032,  753,  789,  321,   94,
+ /*   170 */   116,  304,  375,  210,  388,  392,  478,  545,  649,  721,
+ /*   180 */   727,  736,  752,  795,  853,  952,  958, 1004, 1040, 1046,
+ /*   190 */  1049, 1050, 1056, 1059, 1067,  559,  774,  811, 1068, 1080,
+ /*   200 */   938, 1082, 1083, 1088,  962, 1089, 1090, 1052, 1093, 1094,
+ /*   210 */  1095,  388, 1096, 1103, 1104, 1105, 1106, 1107,  965,  998,
+ /*   220 */  1055, 1057, 1058,  938, 1069, 1071, 1120, 1073, 1061, 1062,
+ /*   230 */  1033, 1076, 1039, 1108, 1087, 1099, 1111, 1066, 1054, 1112,
+ /*   240 */  1113, 1091, 1084, 1135, 1060, 1133, 1138, 1064, 1081, 1139,
+ /*   250 */  1100, 1119, 1109, 1124, 1127, 1140, 1142, 1168, 1173, 1132,
+ /*   260 */  1115, 1147, 1148, 1137, 1180, 1182, 1110, 1121, 1188, 1189,
+ /*   270 */  1197, 1181, 1200, 1202, 1205, 1203, 1191, 1192, 1199, 1206,
+ /*   280 */  1207, 1209, 1210, 1211, 1214, 1212, 1218, 1219, 1175, 1183,
+ /*   290 */  1185, 1184, 1186, 1190, 1187, 1196, 1237, 1193, 1253, 1194,
+ /*   300 */  1236, 1195, 1198, 1238, 1213, 1221, 1220, 1227, 1229, 1271,
+ /*   310 */  1275, 1284, 1285, 1289, 1290, 1292, 1293, 1201, 1208, 1216,
+ /*   320 */  1280, 1281, 1264, 1269, 1283,
 };
 static const YYACTIONTYPE yy_default[] = {
  /*     0 */  1280, 1270, 1270, 1270, 1202, 1202, 1202, 1202, 1270, 1096,
  /*    10 */  1125, 1125, 1254, 1332, 1332, 1332, 1332, 1332, 1332, 1201,
  /*    20 */  1332, 1332, 1332, 1332, 1270, 1100, 1131, 1332, 1332, 1332,
  /*    30 */  1332, 1203, 1204, 1332, 1332, 1332, 1253, 1255, 1141, 1140,
  /*    40 */  1139, 1138, 1236, 1112, 1136, 1129, 1133, 1203, 1197, 1198,
  /*    50 */  1196, 1200, 1204, 1332, 1132, 1167, 1181, 1166, 1332, 1332,
@@ -135697,110 +136273,83 @@ static const YYACTIONTYPE yy_default[] =
 ** This feature can be used, for example, to cause some keywords in a language
 ** to revert to identifiers if they keyword does not apply in the context where
 ** it appears.
 */
 #ifdef YYFALLBACK
 static const YYCODETYPE yyFallback[] = {
     0,  /*          $ => nothing */
     0,  /*       SEMI => nothing */
-   55,  /*    EXPLAIN => ID */
-   55,  /*      QUERY => ID */
-   55,  /*       PLAN => ID */
-   55,  /*      BEGIN => ID */
+   27,  /*    EXPLAIN => ID */
+   27,  /*      QUERY => ID */
+   27,  /*       PLAN => ID */
+   27,  /*      BEGIN => ID */
     0,  /* TRANSACTION => nothing */
-   55,  /*   DEFERRED => ID */
-   55,  /*  IMMEDIATE => ID */
-   55,  /*  EXCLUSIVE => ID */
+   27,  /*   DEFERRED => ID */
+   27,  /*  IMMEDIATE => ID */
+   27,  /*  EXCLUSIVE => ID */
     0,  /*     COMMIT => nothing */
-   55,  /*        END => ID */
-   55,  /*   ROLLBACK => ID */
-   55,  /*  SAVEPOINT => ID */
-   55,  /*    RELEASE => ID */
+   27,  /*        END => ID */
+   27,  /*   ROLLBACK => ID */
+   27,  /*  SAVEPOINT => ID */
+   27,  /*    RELEASE => ID */
     0,  /*         TO => nothing */
     0,  /*      TABLE => nothing */
     0,  /*     CREATE => nothing */
-   55,  /*         IF => ID */
+   27,  /*         IF => ID */
     0,  /*        NOT => nothing */
     0,  /*     EXISTS => nothing */
-   55,  /*       TEMP => ID */
+   27,  /*       TEMP => ID */
     0,  /*         LP => nothing */
     0,  /*         RP => nothing */
     0,  /*         AS => nothing */
-   55,  /*    WITHOUT => ID */
+   27,  /*    WITHOUT => ID */
     0,  /*      COMMA => nothing */
-    0,  /*         OR => nothing */
-    0,  /*        AND => nothing */
-    0,  /*         IS => nothing */
-   55,  /*      MATCH => ID */
-   55,  /*    LIKE_KW => ID */
-    0,  /*    BETWEEN => nothing */
-    0,  /*         IN => nothing */
-    0,  /*     ISNULL => nothing */
-    0,  /*    NOTNULL => nothing */
-    0,  /*         NE => nothing */
-    0,  /*         EQ => nothing */
-    0,  /*         GT => nothing */
-    0,  /*         LE => nothing */
-    0,  /*         LT => nothing */
-    0,  /*         GE => nothing */
-    0,  /*     ESCAPE => nothing */
-    0,  /*     BITAND => nothing */
-    0,  /*      BITOR => nothing */
-    0,  /*     LSHIFT => nothing */
-    0,  /*     RSHIFT => nothing */
-    0,  /*       PLUS => nothing */
-    0,  /*      MINUS => nothing */
-    0,  /*       STAR => nothing */
-    0,  /*      SLASH => nothing */
-    0,  /*        REM => nothing */
-    0,  /*     CONCAT => nothing */
-    0,  /*    COLLATE => nothing */
-    0,  /*     BITNOT => nothing */
     0,  /*         ID => nothing */
-    0,  /*    INDEXED => nothing */
-   55,  /*      ABORT => ID */
-   55,  /*     ACTION => ID */
-   55,  /*      AFTER => ID */
-   55,  /*    ANALYZE => ID */
-   55,  /*        ASC => ID */
-   55,  /*     ATTACH => ID */
-   55,  /*     BEFORE => ID */
-   55,  /*         BY => ID */
-   55,  /*    CASCADE => ID */
-   55,  /*       CAST => ID */
-   55,  /*   COLUMNKW => ID */
-   55,  /*   CONFLICT => ID */
-   55,  /*   DATABASE => ID */
-   55,  /*       DESC => ID */
-   55,  /*     DETACH => ID */
-   55,  /*       EACH => ID */
-   55,  /*       FAIL => ID */
-   55,  /*        FOR => ID */
-   55,  /*     IGNORE => ID */
-   55,  /*  INITIALLY => ID */
-   55,  /*    INSTEAD => ID */
-   55,  /*         NO => ID */
-   55,  /*        KEY => ID */
-   55,  /*         OF => ID */
-   55,  /*     OFFSET => ID */
-   55,  /*     PRAGMA => ID */
-   55,  /*      RAISE => ID */
-   55,  /*  RECURSIVE => ID */
-   55,  /*    REPLACE => ID */
-   55,  /*   RESTRICT => ID */
-   55,  /*        ROW => ID */
-   55,  /*    TRIGGER => ID */
-   55,  /*     VACUUM => ID */
-   55,  /*       VIEW => ID */
-   55,  /*    VIRTUAL => ID */
-   55,  /*       WITH => ID */
-   55,  /*    REINDEX => ID */
-   55,  /*     RENAME => ID */
-   55,  /*   CTIME_KW => ID */
+   27,  /*      ABORT => ID */
+   27,  /*     ACTION => ID */
+   27,  /*      AFTER => ID */
+   27,  /*    ANALYZE => ID */
+   27,  /*        ASC => ID */
+   27,  /*     ATTACH => ID */
+   27,  /*     BEFORE => ID */
+   27,  /*         BY => ID */
+   27,  /*    CASCADE => ID */
+   27,  /*       CAST => ID */
+   27,  /*   COLUMNKW => ID */
+   27,  /*   CONFLICT => ID */
+   27,  /*   DATABASE => ID */
+   27,  /*       DESC => ID */
+   27,  /*     DETACH => ID */
+   27,  /*       EACH => ID */
+   27,  /*       FAIL => ID */
+   27,  /*        FOR => ID */
+   27,  /*     IGNORE => ID */
+   27,  /*  INITIALLY => ID */
+   27,  /*    INSTEAD => ID */
+   27,  /*    LIKE_KW => ID */
+   27,  /*      MATCH => ID */
+   27,  /*         NO => ID */
+   27,  /*        KEY => ID */
+   27,  /*         OF => ID */
+   27,  /*     OFFSET => ID */
+   27,  /*     PRAGMA => ID */
+   27,  /*      RAISE => ID */
+   27,  /*  RECURSIVE => ID */
+   27,  /*    REPLACE => ID */
+   27,  /*   RESTRICT => ID */
+   27,  /*        ROW => ID */
+   27,  /*    TRIGGER => ID */
+   27,  /*     VACUUM => ID */
+   27,  /*       VIEW => ID */
+   27,  /*    VIRTUAL => ID */
+   27,  /*       WITH => ID */
+   27,  /*    REINDEX => ID */
+   27,  /*     RENAME => ID */
+   27,  /*   CTIME_KW => ID */
 };
 #endif /* YYFALLBACK */
 
 /* The following structure represents a single element of the
 ** parser's stack.  Information stored includes:
 **
 **   +  The state number for the parser at this level of the stack.
 **
@@ -135882,35 +136431,35 @@ SQLITE_PRIVATE void sqlite3ParserTrace(F
 ** are required.  The following table supplies these names */
 static const char *const yyTokenName[] = { 
   "$",             "SEMI",          "EXPLAIN",       "QUERY",       
   "PLAN",          "BEGIN",         "TRANSACTION",   "DEFERRED",    
   "IMMEDIATE",     "EXCLUSIVE",     "COMMIT",        "END",         
   "ROLLBACK",      "SAVEPOINT",     "RELEASE",       "TO",          
   "TABLE",         "CREATE",        "IF",            "NOT",         
   "EXISTS",        "TEMP",          "LP",            "RP",          
-  "AS",            "WITHOUT",       "COMMA",         "OR",          
-  "AND",           "IS",            "MATCH",         "LIKE_KW",     
-  "BETWEEN",       "IN",            "ISNULL",        "NOTNULL",     
-  "NE",            "EQ",            "GT",            "LE",          
-  "LT",            "GE",            "ESCAPE",        "BITAND",      
-  "BITOR",         "LSHIFT",        "RSHIFT",        "PLUS",        
-  "MINUS",         "STAR",          "SLASH",         "REM",         
-  "CONCAT",        "COLLATE",       "BITNOT",        "ID",          
-  "INDEXED",       "ABORT",         "ACTION",        "AFTER",       
-  "ANALYZE",       "ASC",           "ATTACH",        "BEFORE",      
-  "BY",            "CASCADE",       "CAST",          "COLUMNKW",    
-  "CONFLICT",      "DATABASE",      "DESC",          "DETACH",      
-  "EACH",          "FAIL",          "FOR",           "IGNORE",      
-  "INITIALLY",     "INSTEAD",       "NO",            "KEY",         
-  "OF",            "OFFSET",        "PRAGMA",        "RAISE",       
-  "RECURSIVE",     "REPLACE",       "RESTRICT",      "ROW",         
-  "TRIGGER",       "VACUUM",        "VIEW",          "VIRTUAL",     
-  "WITH",          "REINDEX",       "RENAME",        "CTIME_KW",    
-  "ANY",           "STRING",        "JOIN_KW",       "CONSTRAINT",  
+  "AS",            "WITHOUT",       "COMMA",         "ID",          
+  "ABORT",         "ACTION",        "AFTER",         "ANALYZE",     
+  "ASC",           "ATTACH",        "BEFORE",        "BY",          
+  "CASCADE",       "CAST",          "COLUMNKW",      "CONFLICT",    
+  "DATABASE",      "DESC",          "DETACH",        "EACH",        
+  "FAIL",          "FOR",           "IGNORE",        "INITIALLY",   
+  "INSTEAD",       "LIKE_KW",       "MATCH",         "NO",          
+  "KEY",           "OF",            "OFFSET",        "PRAGMA",      
+  "RAISE",         "RECURSIVE",     "REPLACE",       "RESTRICT",    
+  "ROW",           "TRIGGER",       "VACUUM",        "VIEW",        
+  "VIRTUAL",       "WITH",          "REINDEX",       "RENAME",      
+  "CTIME_KW",      "ANY",           "OR",            "AND",         
+  "IS",            "BETWEEN",       "IN",            "ISNULL",      
+  "NOTNULL",       "NE",            "EQ",            "GT",          
+  "LE",            "LT",            "GE",            "ESCAPE",      
+  "BITAND",        "BITOR",         "LSHIFT",        "RSHIFT",      
+  "PLUS",          "MINUS",         "STAR",          "SLASH",       
+  "REM",           "CONCAT",        "COLLATE",       "BITNOT",      
+  "INDEXED",       "STRING",        "JOIN_KW",       "CONSTRAINT",  
   "DEFAULT",       "NULL",          "PRIMARY",       "UNIQUE",      
   "CHECK",         "REFERENCES",    "AUTOINCR",      "ON",          
   "INSERT",        "DELETE",        "UPDATE",        "SET",         
   "DEFERRABLE",    "FOREIGN",       "DROP",          "UNION",       
   "ALL",           "EXCEPT",        "INTERSECT",     "SELECT",      
   "VALUES",        "DISTINCT",      "DOT",           "FROM",        
   "JOIN",          "USING",         "ORDER",         "GROUP",       
   "HAVING",        "LIMIT",         "WHERE",         "INTO",        
@@ -139377,30 +139926,30 @@ SQLITE_PRIVATE int sqlite3RunParser(Pars
   int nErr = 0;                   /* Number of errors encountered */
   void *pEngine;                  /* The LEMON-generated LALR(1) parser */
   int n = 0;                      /* Length of the next token token */
   int tokenType;                  /* type of the next token */
   int lastTokenParsed = -1;       /* type of the previous token */
   sqlite3 *db = pParse->db;       /* The database connection */
   int mxSqlLen;                   /* Max length of an SQL string */
 #ifdef sqlite3Parser_ENGINEALWAYSONSTACK
-  unsigned char zSpace[sizeof(yyParser)];  /* Space for parser engine object */
+  yyParser sEngine;    /* Space to hold the Lemon-generated Parser object */
 #endif
 
   assert( zSql!=0 );
   mxSqlLen = db->aLimit[SQLITE_LIMIT_SQL_LENGTH];
   if( db->nVdbeActive==0 ){
     db->u1.isInterrupted = 0;
   }
   pParse->rc = SQLITE_OK;
   pParse->zTail = zSql;
   assert( pzErrMsg!=0 );
   /* sqlite3ParserTrace(stdout, "parser: "); */
 #ifdef sqlite3Parser_ENGINEALWAYSONSTACK
-  pEngine = zSpace;
+  pEngine = &sEngine;
   sqlite3ParserInit(pEngine);
 #else
   pEngine = sqlite3ParserAlloc(sqlite3Malloc);
   if( pEngine==0 ){
     sqlite3OomFault(db);
     return SQLITE_NOMEM_BKPT;
   }
 #endif
@@ -139499,17 +140048,17 @@ SQLITE_PRIVATE int sqlite3RunParser(Pars
   }
 
   if( pParse->pWithToFree ) sqlite3WithDelete(db, pParse->pWithToFree);
   sqlite3DeleteTrigger(db, pParse->pNewTrigger);
   sqlite3DbFree(db, pParse->pVList);
   while( pParse->pAinc ){
     AutoincInfo *p = pParse->pAinc;
     pParse->pAinc = p->pNext;
-    sqlite3DbFree(db, p);
+    sqlite3DbFreeNN(db, p);
   }
   while( pParse->pZombieTab ){
     Table *p = pParse->pZombieTab;
     pParse->pZombieTab = p->pNextZombie;
     sqlite3DeleteTable(db, p);
   }
   assert( nErr==0 || pParse->rc!=SQLITE_OK );
   return nErr;
@@ -142993,26 +143542,28 @@ opendb_out:
   if( sqlite3GlobalConfig.xSqllog ){
     /* Opening a db handle. Fourth parameter is passed 0. */
     void *pArg = sqlite3GlobalConfig.pSqllogArg;
     sqlite3GlobalConfig.xSqllog(pArg, db, zFilename, 0);
   }
 #endif
 #if defined(SQLITE_HAS_CODEC)
   if( rc==SQLITE_OK ){
-    const char *zHexKey = sqlite3_uri_parameter(zOpen, "hexkey");
-    if( zHexKey && zHexKey[0] ){
+    const char *zKey;
+    if( (zKey = sqlite3_uri_parameter(zOpen, "hexkey"))!=0 && zKey[0] ){
       u8 iByte;
       int i;
-      char zKey[40];
-      for(i=0, iByte=0; i<sizeof(zKey)*2 && sqlite3Isxdigit(zHexKey[i]); i++){
-        iByte = (iByte<<4) + sqlite3HexToInt(zHexKey[i]);
-        if( (i&1)!=0 ) zKey[i/2] = iByte;
-      }
-      sqlite3_key_v2(db, 0, zKey, i/2);
+      char zDecoded[40];
+      for(i=0, iByte=0; i<sizeof(zDecoded)*2 && sqlite3Isxdigit(zKey[i]); i++){
+        iByte = (iByte<<4) + sqlite3HexToInt(zKey[i]);
+        if( (i&1)!=0 ) zDecoded[i/2] = iByte;
+      }
+      sqlite3_key_v2(db, 0, zDecoded, i/2);
+    }else if( (zKey = sqlite3_uri_parameter(zOpen, "key"))!=0 ){
+      sqlite3_key_v2(db, 0, zKey, sqlite3Strlen30(zKey));
     }
   }
 #endif
   sqlite3_free(zOpen);
   return rc & 0xff;
 }
 
 /*
@@ -145607,34 +146158,36 @@ SQLITE_PRIVATE int sqlite3Fts3GetVarint(
     b += (c&0x7F) << shift;
     if( (c & 0x80)==0 ) break;
   }
   *v = b;
   return (int)(p - pStart);
 }
 
 /*
-** Similar to sqlite3Fts3GetVarint(), except that the output is truncated to a
-** 32-bit integer before it is returned.
+** Similar to sqlite3Fts3GetVarint(), except that the output is truncated to 
+** a non-negative 32-bit integer before it is returned.
 */
 SQLITE_PRIVATE int sqlite3Fts3GetVarint32(const char *p, int *pi){
   u32 a;
 
 #ifndef fts3GetVarint32
   GETVARINT_INIT(a, p, 0,  0x00,     0x80, *pi, 1);
 #else
   a = (*p++);
   assert( a & 0x80 );
 #endif
 
   GETVARINT_STEP(a, p, 7,  0x7F,     0x4000, *pi, 2);
   GETVARINT_STEP(a, p, 14, 0x3FFF,   0x200000, *pi, 3);
   GETVARINT_STEP(a, p, 21, 0x1FFFFF, 0x10000000, *pi, 4);
   a = (a & 0x0FFFFFFF );
-  *pi = (int)(a | ((u32)(*p & 0x0F) << 28));
+  *pi = (int)(a | ((u32)(*p & 0x07) << 28));
+  assert( 0==(a & 0x80000000) );
+  assert( *pi>=0 );
   return 5;
 }
 
 /*
 ** Return the number of bytes required to encode v as a varint
 */
 SQLITE_PRIVATE int sqlite3Fts3VarintLen(sqlite3_uint64 v){
   int i = 0;
@@ -146454,75 +147007,76 @@ static int fts3InitVtab(
         rc = SQLITE_NOMEM;
       }else{
         for(iOpt=0; iOpt<SizeofArray(aFts4Opt); iOpt++){
           struct Fts4Option *pOp = &aFts4Opt[iOpt];
           if( nKey==pOp->nOpt && !sqlite3_strnicmp(z, pOp->zOpt, pOp->nOpt) ){
             break;
           }
         }
-        if( iOpt==SizeofArray(aFts4Opt) ){
-          sqlite3Fts3ErrMsg(pzErr, "unrecognized parameter: %s", z);
-          rc = SQLITE_ERROR;
-        }else{
-          switch( iOpt ){
-            case 0:               /* MATCHINFO */
-              if( strlen(zVal)!=4 || sqlite3_strnicmp(zVal, "fts3", 4) ){
-                sqlite3Fts3ErrMsg(pzErr, "unrecognized matchinfo: %s", zVal);
-                rc = SQLITE_ERROR;
-              }
-              bNoDocsize = 1;
-              break;
-
-            case 1:               /* PREFIX */
-              sqlite3_free(zPrefix);
-              zPrefix = zVal;
-              zVal = 0;
-              break;
-
-            case 2:               /* COMPRESS */
-              sqlite3_free(zCompress);
-              zCompress = zVal;
-              zVal = 0;
-              break;
-
-            case 3:               /* UNCOMPRESS */
-              sqlite3_free(zUncompress);
-              zUncompress = zVal;
-              zVal = 0;
-              break;
-
-            case 4:               /* ORDER */
-              if( (strlen(zVal)!=3 || sqlite3_strnicmp(zVal, "asc", 3)) 
-               && (strlen(zVal)!=4 || sqlite3_strnicmp(zVal, "desc", 4)) 
-              ){
-                sqlite3Fts3ErrMsg(pzErr, "unrecognized order: %s", zVal);
-                rc = SQLITE_ERROR;
-              }
-              bDescIdx = (zVal[0]=='d' || zVal[0]=='D');
-              break;
-
-            case 5:              /* CONTENT */
-              sqlite3_free(zContent);
-              zContent = zVal;
-              zVal = 0;
-              break;
-
-            case 6:              /* LANGUAGEID */
-              assert( iOpt==6 );
-              sqlite3_free(zLanguageid);
-              zLanguageid = zVal;
-              zVal = 0;
-              break;
-
-            case 7:              /* NOTINDEXED */
-              azNotindexed[nNotindexed++] = zVal;
-              zVal = 0;
-              break;
-          }
+        switch( iOpt ){
+          case 0:               /* MATCHINFO */
+            if( strlen(zVal)!=4 || sqlite3_strnicmp(zVal, "fts3", 4) ){
+              sqlite3Fts3ErrMsg(pzErr, "unrecognized matchinfo: %s", zVal);
+              rc = SQLITE_ERROR;
+            }
+            bNoDocsize = 1;
+            break;
+
+          case 1:               /* PREFIX */
+            sqlite3_free(zPrefix);
+            zPrefix = zVal;
+            zVal = 0;
+            break;
+
+          case 2:               /* COMPRESS */
+            sqlite3_free(zCompress);
+            zCompress = zVal;
+            zVal = 0;
+            break;
+
+          case 3:               /* UNCOMPRESS */
+            sqlite3_free(zUncompress);
+            zUncompress = zVal;
+            zVal = 0;
+            break;
+
+          case 4:               /* ORDER */
+            if( (strlen(zVal)!=3 || sqlite3_strnicmp(zVal, "asc", 3)) 
+             && (strlen(zVal)!=4 || sqlite3_strnicmp(zVal, "desc", 4)) 
+            ){
+              sqlite3Fts3ErrMsg(pzErr, "unrecognized order: %s", zVal);
+              rc = SQLITE_ERROR;
+            }
+            bDescIdx = (zVal[0]=='d' || zVal[0]=='D');
+            break;
+
+          case 5:              /* CONTENT */
+            sqlite3_free(zContent);
+            zContent = zVal;
+            zVal = 0;
+            break;
+
+          case 6:              /* LANGUAGEID */
+            assert( iOpt==6 );
+            sqlite3_free(zLanguageid);
+            zLanguageid = zVal;
+            zVal = 0;
+            break;
+
+          case 7:              /* NOTINDEXED */
+            azNotindexed[nNotindexed++] = zVal;
+            zVal = 0;
+            break;
+
+          default:
+            assert( iOpt==SizeofArray(aFts4Opt) );
+            sqlite3Fts3ErrMsg(pzErr, "unrecognized parameter: %s", z);
+            rc = SQLITE_ERROR;
+            break;
         }
         sqlite3_free(zVal);
       }
     }
 
     /* Otherwise, the argument is a column name. */
     else {
       nString += (int)(strlen(z) + 1);
@@ -147081,17 +147635,18 @@ static int fts3ScanInteriorNode(
     /* Load the next term on the node into zBuffer. Use realloc() to expand
     ** the size of zBuffer if required.  */
     if( !isFirstTerm ){
       zCsr += fts3GetVarint32(zCsr, &nPrefix);
     }
     isFirstTerm = 0;
     zCsr += fts3GetVarint32(zCsr, &nSuffix);
     
-    if( nPrefix<0 || nSuffix<0 || &zCsr[nSuffix]>zEnd ){
+    assert( nPrefix>=0 && nSuffix>=0 );
+    if( &zCsr[nSuffix]>zEnd ){
       rc = FTS_CORRUPT_VTAB;
       goto finish_scan;
     }
     if( nPrefix+nSuffix>nAlloc ){
       char *zNew;
       nAlloc = (nPrefix+nSuffix) * 2;
       zNew = (char *)sqlite3_realloc(zBuffer, nAlloc);
       if( !zNew ){
@@ -147891,17 +148446,17 @@ SQLITE_PRIVATE int sqlite3Fts3FirstFilte
     if( *p==0x02 ){
       nOut += sqlite3Fts3PutVarint(&pOut[nOut], iDelta);
       pOut[nOut++] = 0x02;
       bWritten = 1;
     }
     fts3ColumnlistCopy(0, &p);
   }
 
-  while( p<pEnd && *p==0x01 ){
+  while( p<pEnd ){
     sqlite3_int64 iCol;
     p++;
     p += sqlite3Fts3GetVarint(p, &iCol);
     if( *p==0x02 ){
       if( bWritten==0 ){
         nOut += sqlite3Fts3PutVarint(&pOut[nOut], iDelta);
         bWritten = 1;
       }
@@ -148571,43 +149126,48 @@ static int fts3ColumnMethod(
 ){
   int rc = SQLITE_OK;             /* Return Code */
   Fts3Cursor *pCsr = (Fts3Cursor *) pCursor;
   Fts3Table *p = (Fts3Table *)pCursor->pVtab;
 
   /* The column value supplied by SQLite must be in range. */
   assert( iCol>=0 && iCol<=p->nColumn+2 );
 
-  if( iCol==p->nColumn+1 ){
-    /* This call is a request for the "docid" column. Since "docid" is an 
-    ** alias for "rowid", use the xRowid() method to obtain the value.
-    */
-    sqlite3_result_int64(pCtx, pCsr->iPrevId);
-  }else if( iCol==p->nColumn ){
-    /* The extra column whose name is the same as the table.
-    ** Return a blob which is a pointer to the cursor.  */
-    sqlite3_result_blob(pCtx, &pCsr, sizeof(pCsr), SQLITE_TRANSIENT);
-  }else if( iCol==p->nColumn+2 && pCsr->pExpr ){
-    sqlite3_result_int64(pCtx, pCsr->iLangid);
-  }else{
-    /* The requested column is either a user column (one that contains 
-    ** indexed data), or the language-id column.  */
-    rc = fts3CursorSeek(0, pCsr);
-
-    if( rc==SQLITE_OK ){
-      if( iCol==p->nColumn+2 ){
-        int iLangid = 0;
-        if( p->zLanguageid ){
-          iLangid = sqlite3_column_int(pCsr->pStmt, p->nColumn+1);
-        }
-        sqlite3_result_int(pCtx, iLangid);
-      }else if( sqlite3_data_count(pCsr->pStmt)>(iCol+1) ){
+  switch( iCol-p->nColumn ){
+    case 0:
+      /* The special 'table-name' column */
+      sqlite3_result_blob(pCtx, &pCsr, sizeof(Fts3Cursor*), SQLITE_TRANSIENT);
+      sqlite3_result_subtype(pCtx, SQLITE_BLOB);
+      break;
+
+    case 1:
+      /* The docid column */
+      sqlite3_result_int64(pCtx, pCsr->iPrevId);
+      break;
+
+    case 2:
+      if( pCsr->pExpr ){
+        sqlite3_result_int64(pCtx, pCsr->iLangid);
+        break;
+      }else if( p->zLanguageid==0 ){
+        sqlite3_result_int(pCtx, 0);
+        break;
+      }else{
+        iCol = p->nColumn;
+        /* fall-through */
+      }
+
+    default:
+      /* A user column. Or, if this is a full-table scan, possibly the
+      ** language-id column. Seek the cursor. */
+      rc = fts3CursorSeek(0, pCsr);
+      if( rc==SQLITE_OK && sqlite3_data_count(pCsr->pStmt)-1>iCol ){
         sqlite3_result_value(pCtx, sqlite3_column_value(pCsr->pStmt, iCol+1));
       }
-    }
+      break;
   }
 
   assert( ((Fts3Table *)pCsr->base.pVtab)->pSegments==0 );
   return rc;
 }
 
 /* 
 ** This function is the implementation of the xUpdate callback used by 
@@ -148677,27 +149237,21 @@ static int fts3SyncMethod(sqlite3_vtab *
 ** If it is currently unknown whether or not the FTS table has an %_stat
 ** table (if p->bHasStat==2), attempt to determine this (set p->bHasStat
 ** to 0 or 1). Return SQLITE_OK if successful, or an SQLite error code
 ** if an error occurs.
 */
 static int fts3SetHasStat(Fts3Table *p){
   int rc = SQLITE_OK;
   if( p->bHasStat==2 ){
-    const char *zFmt ="SELECT 1 FROM %Q.sqlite_master WHERE tbl_name='%q_stat'";
-    char *zSql = sqlite3_mprintf(zFmt, p->zDb, p->zName);
-    if( zSql ){
-      sqlite3_stmt *pStmt = 0;
-      rc = sqlite3_prepare_v2(p->db, zSql, -1, &pStmt, 0);
-      if( rc==SQLITE_OK ){
-        int bHasStat = (sqlite3_step(pStmt)==SQLITE_ROW);
-        rc = sqlite3_finalize(pStmt);
-        if( rc==SQLITE_OK ) p->bHasStat = (u8)bHasStat;
-      }
-      sqlite3_free(zSql);
+    char *zTbl = sqlite3_mprintf("%s_stat", p->zName);
+    if( zTbl ){
+      int res = sqlite3_table_column_metadata(p->db, p->zDb, zTbl, 0,0,0,0,0,0);
+      sqlite3_free(zTbl);
+      p->bHasStat = (res==SQLITE_OK);
     }else{
       rc = SQLITE_NOMEM;
     }
   }
   return rc;
 }
 
 /*
@@ -148794,28 +149348,26 @@ static void fts3ReversePoslist(char *pSt
 ** string passed via zFunc is used as part of the error message.
 */
 static int fts3FunctionArg(
   sqlite3_context *pContext,      /* SQL function call context */
   const char *zFunc,              /* Function name */
   sqlite3_value *pVal,            /* argv[0] passed to function */
   Fts3Cursor **ppCsr              /* OUT: Store cursor handle here */
 ){
-  Fts3Cursor *pRet;
-  if( sqlite3_value_type(pVal)!=SQLITE_BLOB 
-   || sqlite3_value_bytes(pVal)!=sizeof(Fts3Cursor *)
-  ){
+  int rc = SQLITE_OK;
+  if( sqlite3_value_subtype(pVal)==SQLITE_BLOB ){
+    *ppCsr = *(Fts3Cursor**)sqlite3_value_blob(pVal);
+  }else{
     char *zErr = sqlite3_mprintf("illegal first argument to %s", zFunc);
     sqlite3_result_error(pContext, zErr, -1);
     sqlite3_free(zErr);
-    return SQLITE_ERROR;
-  }
-  memcpy(&pRet, sqlite3_value_blob(pVal), sizeof(Fts3Cursor *));
-  *ppCsr = pRet;
-  return SQLITE_OK;
+    rc = SQLITE_ERROR;
+  }
+  return rc;
 }
 
 /*
 ** Implementation of the snippet() function for FTS3
 */
 static void fts3SnippetFunc(
   sqlite3_context *pContext,      /* SQLite function call context */
   int nVal,                       /* Size of apVal[] array */
@@ -149192,17 +149744,17 @@ SQLITE_PRIVATE int sqlite3Fts3Init(sqlit
 
 #ifdef SQLITE_TEST
   if( rc==SQLITE_OK ){
     rc = sqlite3Fts3ExprInitTestInterface(db);
   }
 #endif
 
   /* Create the virtual table wrapper around the hash-table and overload 
-  ** the two scalar functions. If this is successful, register the
+  ** the four scalar functions. If this is successful, register the
   ** module with sqlite.
   */
   if( SQLITE_OK==rc 
    && SQLITE_OK==(rc = sqlite3Fts3InitHashTable(db, pHash, "fts3_tokenizer"))
    && SQLITE_OK==(rc = sqlite3_overload_function(db, "snippet", -1))
    && SQLITE_OK==(rc = sqlite3_overload_function(db, "offsets", 1))
    && SQLITE_OK==(rc = sqlite3_overload_function(db, "matchinfo", 1))
    && SQLITE_OK==(rc = sqlite3_overload_function(db, "matchinfo", 2))
@@ -149775,17 +150327,17 @@ static int fts3EvalIncrPhraseNext(
   Fts3Doclist *pDL = &p->doclist;
   Fts3Table *pTab = (Fts3Table *)pCsr->base.pVtab;
   u8 bEof = 0;
 
   /* This is only called if it is guaranteed that the phrase has at least
   ** one incremental token. In which case the bIncr flag is set. */
   assert( p->bIncr==1 );
 
-  if( p->nToken==1 && p->bIncr ){
+  if( p->nToken==1 ){
     rc = sqlite3Fts3MsrIncrNext(pTab, p->aToken[0].pSegcsr, 
         &pDL->iDocid, &pDL->pList, &pDL->nList
     );
     if( pDL->pList==0 ) bEof = 1;
   }else{
     int bDescDoclist = pCsr->bDesc;
     struct TokenDoclist a[MAX_INCR_PHRASE_TOKENS];
 
@@ -150008,29 +150560,29 @@ static void fts3EvalTokenCosts(
 **
 ** The average document size in pages is calculated by first calculating 
 ** determining the average size in bytes, B. If B is less than the amount
 ** of data that will fit on a single leaf page of an intkey table in
 ** this database, then the average docsize is 1. Otherwise, it is 1 plus
 ** the number of overflow pages consumed by a record B bytes in size.
 */
 static int fts3EvalAverageDocsize(Fts3Cursor *pCsr, int *pnPage){
+  int rc = SQLITE_OK;
   if( pCsr->nRowAvg==0 ){
     /* The average document size, which is required to calculate the cost
     ** of each doclist, has not yet been determined. Read the required 
     ** data from the %_stat table to calculate it.
     **
     ** Entry 0 of the %_stat table is a blob containing (nCol+1) FTS3 
     ** varints, where nCol is the number of columns in the FTS3 table.
     ** The first varint is the number of documents currently stored in
     ** the table. The following nCol varints contain the total amount of
     ** data stored in all rows of each column of the table, from left
     ** to right.
     */
-    int rc;
     Fts3Table *p = (Fts3Table*)pCsr->base.pVtab;
     sqlite3_stmt *pStmt;
     sqlite3_int64 nDoc = 0;
     sqlite3_int64 nByte = 0;
     const char *pEnd;
     const char *a;
 
     rc = sqlite3Fts3SelectDoctotal(p, &pStmt);
@@ -150047,21 +150599,20 @@ static int fts3EvalAverageDocsize(Fts3Cu
       sqlite3_reset(pStmt);
       return FTS_CORRUPT_VTAB;
     }
 
     pCsr->nDoc = nDoc;
     pCsr->nRowAvg = (int)(((nByte / nDoc) + p->nPgsz) / p->nPgsz);
     assert( pCsr->nRowAvg>0 ); 
     rc = sqlite3_reset(pStmt);
-    if( rc!=SQLITE_OK ) return rc;
   }
 
   *pnPage = pCsr->nRowAvg;
-  return SQLITE_OK;
+  return rc;
 }
 
 /*
 ** This function is called to select the tokens (if any) that will be 
 ** deferred. The array aTC[] has already been populated when this is
 ** called.
 **
 ** This function is called once for each AND/NEAR cluster in the 
@@ -150401,17 +150952,18 @@ static void fts3EvalNextRow(
               fts3EvalNextRow(pCsr, pLeft, pRc);
             }else{
               fts3EvalNextRow(pCsr, pRight, pRc);
             }
           }
           pExpr->iDocid = pLeft->iDocid;
           pExpr->bEof = (pLeft->bEof || pRight->bEof);
           if( pExpr->eType==FTSQUERY_NEAR && pExpr->bEof ){
-            if( pRight->pPhrase && pRight->pPhrase->doclist.aAll ){
+            assert( pRight->eType==FTSQUERY_PHRASE );
+            if( pRight->pPhrase->doclist.aAll ){
               Fts3Doclist *pDl = &pRight->pPhrase->doclist;
               while( *pRc==SQLITE_OK && pRight->bEof==0 ){
                 memset(pDl->pList, 0, pDl->nList);
                 fts3EvalNextRow(pCsr, pRight, pRc);
               }
             }
             if( pLeft->pPhrase && pLeft->pPhrase->doclist.aAll ){
               Fts3Doclist *pDl = &pLeft->pPhrase->doclist;
@@ -150430,17 +150982,17 @@ static void fts3EvalNextRow(
         Fts3Expr *pRight = pExpr->pRight;
         sqlite3_int64 iCmp = DOCID_CMP(pLeft->iDocid, pRight->iDocid);
 
         assert( pLeft->bStart || pLeft->iDocid==pRight->iDocid );
         assert( pRight->bStart || pLeft->iDocid==pRight->iDocid );
 
         if( pRight->bEof || (pLeft->bEof==0 && iCmp<0) ){
           fts3EvalNextRow(pCsr, pLeft, pRc);
-        }else if( pLeft->bEof || (pRight->bEof==0 && iCmp>0) ){
+        }else if( pLeft->bEof || iCmp>0 ){
           fts3EvalNextRow(pCsr, pRight, pRc);
         }else{
           fts3EvalNextRow(pCsr, pLeft, pRc);
           fts3EvalNextRow(pCsr, pRight, pRc);
         }
 
         pExpr->bEof = (pLeft->bEof && pRight->bEof);
         iCmp = DOCID_CMP(pLeft->iDocid, pRight->iDocid);
@@ -150522,61 +151074,57 @@ static int fts3EvalNearTest(Fts3Expr *pE
   **               "w"      "x"
   **
   ** The right-hand child of a NEAR node is always a phrase. The 
   ** left-hand child may be either a phrase or a NEAR node. There are
   ** no exceptions to this - it's the way the parser in fts3_expr.c works.
   */
   if( *pRc==SQLITE_OK 
    && pExpr->eType==FTSQUERY_NEAR 
-   && pExpr->bEof==0
    && (pExpr->pParent==0 || pExpr->pParent->eType!=FTSQUERY_NEAR)
   ){
     Fts3Expr *p; 
     int nTmp = 0;                 /* Bytes of temp space */
     char *aTmp;                   /* Temp space for PoslistNearMerge() */
 
     /* Allocate temporary working space. */
     for(p=pExpr; p->pLeft; p=p->pLeft){
+      assert( p->pRight->pPhrase->doclist.nList>0 );
       nTmp += p->pRight->pPhrase->doclist.nList;
     }
     nTmp += p->pPhrase->doclist.nList;
-    if( nTmp==0 ){
+    aTmp = sqlite3_malloc(nTmp*2);
+    if( !aTmp ){
+      *pRc = SQLITE_NOMEM;
       res = 0;
     }else{
-      aTmp = sqlite3_malloc(nTmp*2);
-      if( !aTmp ){
-        *pRc = SQLITE_NOMEM;
-        res = 0;
-      }else{
-        char *aPoslist = p->pPhrase->doclist.pList;
-        int nToken = p->pPhrase->nToken;
-
-        for(p=p->pParent;res && p && p->eType==FTSQUERY_NEAR; p=p->pParent){
-          Fts3Phrase *pPhrase = p->pRight->pPhrase;
-          int nNear = p->nNear;
-          res = fts3EvalNearTrim(nNear, aTmp, &aPoslist, &nToken, pPhrase);
-        }
-
-        aPoslist = pExpr->pRight->pPhrase->doclist.pList;
-        nToken = pExpr->pRight->pPhrase->nToken;
-        for(p=pExpr->pLeft; p && res; p=p->pLeft){
-          int nNear;
-          Fts3Phrase *pPhrase;
-          assert( p->pParent && p->pParent->pLeft==p );
-          nNear = p->pParent->nNear;
-          pPhrase = (
-              p->eType==FTSQUERY_NEAR ? p->pRight->pPhrase : p->pPhrase
-              );
-          res = fts3EvalNearTrim(nNear, aTmp, &aPoslist, &nToken, pPhrase);
-        }
-      }
-
-      sqlite3_free(aTmp);
-    }
+      char *aPoslist = p->pPhrase->doclist.pList;
+      int nToken = p->pPhrase->nToken;
+
+      for(p=p->pParent;res && p && p->eType==FTSQUERY_NEAR; p=p->pParent){
+        Fts3Phrase *pPhrase = p->pRight->pPhrase;
+        int nNear = p->nNear;
+        res = fts3EvalNearTrim(nNear, aTmp, &aPoslist, &nToken, pPhrase);
+      }
+
+      aPoslist = pExpr->pRight->pPhrase->doclist.pList;
+      nToken = pExpr->pRight->pPhrase->nToken;
+      for(p=pExpr->pLeft; p && res; p=p->pLeft){
+        int nNear;
+        Fts3Phrase *pPhrase;
+        assert( p->pParent && p->pParent->pLeft==p );
+        nNear = p->pParent->nNear;
+        pPhrase = (
+            p->eType==FTSQUERY_NEAR ? p->pRight->pPhrase : p->pPhrase
+        );
+        res = fts3EvalNearTrim(nNear, aTmp, &aPoslist, &nToken, pPhrase);
+      }
+    }
+
+    sqlite3_free(aTmp);
   }
 
   return res;
 }
 
 /*
 ** This function is a helper function for sqlite3Fts3EvalTestDeferred().
 ** Assuming no error occurs or has occurred, It returns non-zero if the
@@ -166673,22 +167221,46 @@ static int rtreeRename(sqlite3_vtab *pVt
     "ALTER TABLE %Q.'%q_node'   RENAME TO \"%w_node\";"
     "ALTER TABLE %Q.'%q_parent' RENAME TO \"%w_parent\";"
     "ALTER TABLE %Q.'%q_rowid'  RENAME TO \"%w_rowid\";"
     , pRtree->zDb, pRtree->zName, zNewName 
     , pRtree->zDb, pRtree->zName, zNewName 
     , pRtree->zDb, pRtree->zName, zNewName
   );
   if( zSql ){
+    nodeBlobReset(pRtree);
     rc = sqlite3_exec(pRtree->db, zSql, 0, 0, 0);
     sqlite3_free(zSql);
   }
   return rc;
 }
 
+/*
+** The xSavepoint method.
+**
+** This module does not need to do anything to support savepoints. However,
+** it uses this hook to close any open blob handle. This is done because a 
+** DROP TABLE command - which fortunately always opens a savepoint - cannot 
+** succeed if there are any open blob handles. i.e. if the blob handle were
+** not closed here, the following would fail:
+**
+**   BEGIN;
+**     INSERT INTO rtree...
+**     DROP TABLE <tablename>;    -- Would fail with SQLITE_LOCKED
+**   COMMIT;
+*/
+static int rtreeSavepoint(sqlite3_vtab *pVtab, int iSavepoint){
+  Rtree *pRtree = (Rtree *)pVtab;
+  int iwt = pRtree->inWrTrans;
+  UNUSED_PARAMETER(iSavepoint);
+  pRtree->inWrTrans = 0;
+  nodeBlobReset(pRtree);
+  pRtree->inWrTrans = iwt;
+  return SQLITE_OK;
+}
 
 /*
 ** This function populates the pRtree->nRowEst variable with an estimate
 ** of the number of rows in the virtual table. If possible, this is based
 ** on sqlite_stat1 data. Otherwise, use RTREE_DEFAULT_ROWEST.
 */
 static int rtreeQueryStat1(sqlite3 *db, Rtree *pRtree){
   const char *zFmt = "SELECT stat FROM %Q.sqlite_stat1 WHERE tbl = '%q_rowid'";
@@ -166725,17 +167297,17 @@ static int rtreeQueryStat1(sqlite3 *db, 
     }
     sqlite3_free(zSql);
   }
 
   return rc;
 }
 
 static sqlite3_module rtreeModule = {
-  0,                          /* iVersion */
+  2,                          /* iVersion */
   rtreeCreate,                /* xCreate - create a table */
   rtreeConnect,               /* xConnect - connect to an existing table */
   rtreeBestIndex,             /* xBestIndex - Determine search strategy */
   rtreeDisconnect,            /* xDisconnect - Disconnect from a table */
   rtreeDestroy,               /* xDestroy - Drop a table */
   rtreeOpen,                  /* xOpen - open a cursor */
   rtreeClose,                 /* xClose - close a cursor */
   rtreeFilter,                /* xFilter - configure scan constraints */
@@ -166745,17 +167317,17 @@ static sqlite3_module rtreeModule = {
   rtreeRowid,                 /* xRowid - read data */
   rtreeUpdate,                /* xUpdate - write data */
   rtreeBeginTransaction,      /* xBegin - begin transaction */
   rtreeEndTransaction,        /* xSync - sync transaction */
   rtreeEndTransaction,        /* xCommit - commit transaction */
   rtreeEndTransaction,        /* xRollback - rollback transaction */
   0,                          /* xFindFunction - function overloading */
   rtreeRename,                /* xRename - rename the table */
-  0,                          /* xSavepoint */
+  rtreeSavepoint,             /* xSavepoint */
   0,                          /* xRelease */
   0,                          /* xRollbackTo */
 };
 
 static int rtreeSqlInit(
   Rtree *pRtree, 
   sqlite3 *db, 
   const char *zDb, 
@@ -178902,16 +179474,17 @@ static const char jsonIsSpace[] = {
 };
 #define safe_isspace(x) (jsonIsSpace[(unsigned char)x])
 
 #ifndef SQLITE_AMALGAMATION
   /* Unsigned integer types.  These are already defined in the sqliteInt.h,
   ** but the definitions need to be repeated for separate compilation. */
   typedef sqlite3_uint64 u64;
   typedef unsigned int u32;
+  typedef unsigned short int u16;
   typedef unsigned char u8;
 #endif
 
 /* Objects */
 typedef struct JsonString JsonString;
 typedef struct JsonNode JsonNode;
 typedef struct JsonParse JsonParse;
 
@@ -178981,17 +179554,28 @@ struct JsonNode {
 struct JsonParse {
   u32 nNode;         /* Number of slots of aNode[] used */
   u32 nAlloc;        /* Number of slots of aNode[] allocated */
   JsonNode *aNode;   /* Array of nodes containing the parse */
   const char *zJson; /* Original JSON string */
   u32 *aUp;          /* Index of parent of each node */
   u8 oom;            /* Set to true if out of memory */
   u8 nErr;           /* Number of errors seen */
-};
+  u16 iDepth;        /* Nesting depth */
+  int nJson;         /* Length of the zJson string in bytes */
+};
+
+/*
+** Maximum nesting depth of JSON for this implementation.
+**
+** This limit is needed to avoid a stack overflow in the recursive
+** descent parser.  A depth of 2000 is far deeper than any sane JSON
+** should go.
+*/
+#define JSON_MAX_DEPTH  2000
 
 /**************************************************************************
 ** Utility routines for dealing with JsonString objects
 **************************************************************************/
 
 /* Set the JsonString object to an empty string
 */
 static void jsonZero(JsonString *p){
@@ -179215,16 +179799,24 @@ static void jsonParseReset(JsonParse *pP
   pParse->aNode = 0;
   pParse->nNode = 0;
   pParse->nAlloc = 0;
   sqlite3_free(pParse->aUp);
   pParse->aUp = 0;
 }
 
 /*
+** Free a JsonParse object that was obtained from sqlite3_malloc().
+*/
+static void jsonParseFree(JsonParse *pParse){
+  jsonParseReset(pParse);
+  sqlite3_free(pParse);
+}
+
+/*
 ** Convert the JsonNode pNode into a pure JSON string and
 ** append to pOut.  Subsubstructure is also included.  Return
 ** the number of JsonNode objects that are encoded.
 */
 static void jsonRenderNode(
   JsonNode *pNode,               /* The node to render */
   JsonString *pOut,              /* Write JSON here */
   sqlite3_value **aReplace       /* Replacement values */
@@ -179539,137 +180131,151 @@ static int jsonIs4Hex(const char *z){
 ** non-whitespace character is ']'.
 */
 static int jsonParseValue(JsonParse *pParse, u32 i){
   char c;
   u32 j;
   int iThis;
   int x;
   JsonNode *pNode;
-  while( safe_isspace(pParse->zJson[i]) ){ i++; }
-  if( (c = pParse->zJson[i])=='{' ){
+  const char *z = pParse->zJson;
+  while( safe_isspace(z[i]) ){ i++; }
+  if( (c = z[i])=='{' ){
     /* Parse object */
     iThis = jsonParseAddNode(pParse, JSON_OBJECT, 0, 0);
     if( iThis<0 ) return -1;
     for(j=i+1;;j++){
-      while( safe_isspace(pParse->zJson[j]) ){ j++; }
+      while( safe_isspace(z[j]) ){ j++; }
+      if( ++pParse->iDepth > JSON_MAX_DEPTH ) return -1;
       x = jsonParseValue(pParse, j);
       if( x<0 ){
+        pParse->iDepth--;
         if( x==(-2) && pParse->nNode==(u32)iThis+1 ) return j+1;
         return -1;
       }
       if( pParse->oom ) return -1;
       pNode = &pParse->aNode[pParse->nNode-1];
       if( pNode->eType!=JSON_STRING ) return -1;
       pNode->jnFlags |= JNODE_LABEL;
       j = x;
-      while( safe_isspace(pParse->zJson[j]) ){ j++; }
-      if( pParse->zJson[j]!=':' ) return -1;
+      while( safe_isspace(z[j]) ){ j++; }
+      if( z[j]!=':' ) return -1;
       j++;
       x = jsonParseValue(pParse, j);
+      pParse->iDepth--;
       if( x<0 ) return -1;
       j = x;
-      while( safe_isspace(pParse->zJson[j]) ){ j++; }
-      c = pParse->zJson[j];
+      while( safe_isspace(z[j]) ){ j++; }
+      c = z[j];
       if( c==',' ) continue;
       if( c!='}' ) return -1;
       break;
     }
     pParse->aNode[iThis].n = pParse->nNode - (u32)iThis - 1;
     return j+1;
   }else if( c=='[' ){
     /* Parse array */
     iThis = jsonParseAddNode(pParse, JSON_ARRAY, 0, 0);
     if( iThis<0 ) return -1;
     for(j=i+1;;j++){
-      while( safe_isspace(pParse->zJson[j]) ){ j++; }
+      while( safe_isspace(z[j]) ){ j++; }
+      if( ++pParse->iDepth > JSON_MAX_DEPTH ) return -1;
       x = jsonParseValue(pParse, j);
+      pParse->iDepth--;
       if( x<0 ){
         if( x==(-3) && pParse->nNode==(u32)iThis+1 ) return j+1;
         return -1;
       }
       j = x;
-      while( safe_isspace(pParse->zJson[j]) ){ j++; }
-      c = pParse->zJson[j];
+      while( safe_isspace(z[j]) ){ j++; }
+      c = z[j];
       if( c==',' ) continue;
       if( c!=']' ) return -1;
       break;
     }
     pParse->aNode[iThis].n = pParse->nNode - (u32)iThis - 1;
     return j+1;
   }else if( c=='"' ){
     /* Parse string */
     u8 jnFlags = 0;
     j = i+1;
     for(;;){
-      c = pParse->zJson[j];
-      if( c==0 ) return -1;
+      c = z[j];
+      if( (c & ~0x1f)==0 ){
+        /* Control characters are not allowed in strings */
+        return -1;
+      }
       if( c=='\\' ){
-        c = pParse->zJson[++j];
+        c = z[++j];
         if( c=='"' || c=='\\' || c=='/' || c=='b' || c=='f'
            || c=='n' || c=='r' || c=='t'
-           || (c=='u' && jsonIs4Hex(pParse->zJson+j+1)) ){
+           || (c=='u' && jsonIs4Hex(z+j+1)) ){
           jnFlags = JNODE_ESCAPE;
         }else{
           return -1;
         }
       }else if( c=='"' ){
         break;
       }
       j++;
     }
-    jsonParseAddNode(pParse, JSON_STRING, j+1-i, &pParse->zJson[i]);
+    jsonParseAddNode(pParse, JSON_STRING, j+1-i, &z[i]);
     if( !pParse->oom ) pParse->aNode[pParse->nNode-1].jnFlags = jnFlags;
     return j+1;
   }else if( c=='n'
-         && strncmp(pParse->zJson+i,"null",4)==0
-         && !safe_isalnum(pParse->zJson[i+4]) ){
+         && strncmp(z+i,"null",4)==0
+         && !safe_isalnum(z[i+4]) ){
     jsonParseAddNode(pParse, JSON_NULL, 0, 0);
     return i+4;
   }else if( c=='t'
-         && strncmp(pParse->zJson+i,"true",4)==0
-         && !safe_isalnum(pParse->zJson[i+4]) ){
+         && strncmp(z+i,"true",4)==0
+         && !safe_isalnum(z[i+4]) ){
     jsonParseAddNode(pParse, JSON_TRUE, 0, 0);
     return i+4;
   }else if( c=='f'
-         && strncmp(pParse->zJson+i,"false",5)==0
-         && !safe_isalnum(pParse->zJson[i+5]) ){
+         && strncmp(z+i,"false",5)==0
+         && !safe_isalnum(z[i+5]) ){
     jsonParseAddNode(pParse, JSON_FALSE, 0, 0);
     return i+5;
   }else if( c=='-' || (c>='0' && c<='9') ){
     /* Parse number */
     u8 seenDP = 0;
     u8 seenE = 0;
+    assert( '-' < '0' );
+    if( c<='0' ){
+      j = c=='-' ? i+1 : i;
+      if( z[j]=='0' && z[j+1]>='0' && z[j+1]<='9' ) return -1;
+    }
     j = i+1;
     for(;; j++){
-      c = pParse->zJson[j];
+      c = z[j];
       if( c>='0' && c<='9' ) continue;
       if( c=='.' ){
-        if( pParse->zJson[j-1]=='-' ) return -1;
+        if( z[j-1]=='-' ) return -1;
         if( seenDP ) return -1;
         seenDP = 1;
         continue;
       }
       if( c=='e' || c=='E' ){
-        if( pParse->zJson[j-1]<'0' ) return -1;
+        if( z[j-1]<'0' ) return -1;
         if( seenE ) return -1;
         seenDP = seenE = 1;
-        c = pParse->zJson[j+1];
+        c = z[j+1];
         if( c=='+' || c=='-' ){
           j++;
-          c = pParse->zJson[j+1];
+          c = z[j+1];
         }
         if( c<'0' || c>'9' ) return -1;
         continue;
       }
       break;
     }
-    if( pParse->zJson[j-1]<'0' ) return -1;
+    if( z[j-1]<'0' ) return -1;
     jsonParseAddNode(pParse, seenDP ? JSON_REAL : JSON_INT,
-                        j - i, &pParse->zJson[i]);
+                        j - i, &z[i]);
     return j;
   }else if( c=='}' ){
     return -2;  /* End of {...} */
   }else if( c==']' ){
     return -3;  /* End of [...] */
   }else if( c==0 ){
     return 0;   /* End of file */
   }else{
@@ -179691,16 +180297,17 @@ static int jsonParse(
 ){
   int i;
   memset(pParse, 0, sizeof(*pParse));
   if( zJson==0 ) return 1;
   pParse->zJson = zJson;
   i = jsonParseValue(pParse, 0);
   if( pParse->oom ) i = -1;
   if( i>0 ){
+    assert( pParse->iDepth==0 );
     while( safe_isspace(zJson[i]) ) i++;
     if( zJson[i] ) i = -1;
   }
   if( i<=0 ){
     if( pCtx!=0 ){
       if( pParse->oom ){
         sqlite3_result_error_nomem(pCtx);
       }else{
@@ -179751,16 +180358,59 @@ static int jsonParseFindParents(JsonPars
     pParse->oom = 1;
     return SQLITE_NOMEM;
   }
   jsonParseFillInParentage(pParse, 0, 0);
   return SQLITE_OK;
 }
 
 /*
+** Magic number used for the JSON parse cache in sqlite3_get_auxdata()
+*/
+#define JSON_CACHE_ID  (-429938)
+
+/*
+** Obtain a complete parse of the JSON found in the first argument
+** of the argv array.  Use the sqlite3_get_auxdata() cache for this
+** parse if it is available.  If the cache is not available or if it
+** is no longer valid, parse the JSON again and return the new parse,
+** and also register the new parse so that it will be available for
+** future sqlite3_get_auxdata() calls.
+*/
+static JsonParse *jsonParseCached(
+  sqlite3_context *pCtx,
+  sqlite3_value **argv
+){
+  const char *zJson = (const char*)sqlite3_value_text(argv[0]);
+  int nJson = sqlite3_value_bytes(argv[0]);
+  JsonParse *p;
+  if( zJson==0 ) return 0;
+  p = (JsonParse*)sqlite3_get_auxdata(pCtx, JSON_CACHE_ID);
+  if( p && p->nJson==nJson && memcmp(p->zJson,zJson,nJson)==0 ){
+    p->nErr = 0;
+    return p; /* The cached entry matches, so return it */
+  }
+  p = sqlite3_malloc( sizeof(*p) + nJson + 1 );
+  if( p==0 ){
+    sqlite3_result_error_nomem(pCtx);
+    return 0;
+  }
+  memset(p, 0, sizeof(*p));
+  p->zJson = (char*)&p[1];
+  memcpy((char*)p->zJson, zJson, nJson+1);
+  if( jsonParse(p, pCtx, p->zJson) ){
+    sqlite3_free(p);
+    return 0;
+  }
+  p->nJson = nJson;
+  sqlite3_set_auxdata(pCtx, JSON_CACHE_ID, p, (void(*)(void*))jsonParseFree);
+  return (JsonParse*)sqlite3_get_auxdata(pCtx, JSON_CACHE_ID);
+}
+
+/*
 ** Compare the OBJECT label at pNode against zKey,nKey.  Return true on
 ** a match.
 */
 static int jsonLabelCompare(JsonNode *pNode, const char *zKey, u32 nKey){
   if( pNode->jnFlags & JNODE_RAW ){
     if( pNode->n!=nKey ) return 0;
     return strncmp(pNode->u.zJContent, zKey, nKey)==0;
   }else{
@@ -180115,68 +180765,70 @@ static void jsonArrayFunc(
 ** Return the number of elements in the top-level JSON array.  
 ** Return 0 if the input is not a well-formed JSON array.
 */
 static void jsonArrayLengthFunc(
   sqlite3_context *ctx,
   int argc,
   sqlite3_value **argv
 ){
-  JsonParse x;          /* The parse */
+  JsonParse *p;          /* The parse */
   sqlite3_int64 n = 0;
   u32 i;
   JsonNode *pNode;
 
-  if( jsonParse(&x, ctx, (const char*)sqlite3_value_text(argv[0])) ) return;
-  assert( x.nNode );
+  p = jsonParseCached(ctx, argv);
+  if( p==0 ) return;
+  assert( p->nNode );
   if( argc==2 ){
     const char *zPath = (const char*)sqlite3_value_text(argv[1]);
-    pNode = jsonLookup(&x, zPath, 0, ctx);
-  }else{
-    pNode = x.aNode;
+    pNode = jsonLookup(p, zPath, 0, ctx);
+  }else{
+    pNode = p->aNode;
   }
   if( pNode==0 ){
-    x.nErr = 1;
-  }else if( pNode->eType==JSON_ARRAY ){
+    return;
+  }
+  if( pNode->eType==JSON_ARRAY ){
     assert( (pNode->jnFlags & JNODE_APPEND)==0 );
     for(i=1; i<=pNode->n; n++){
       i += jsonNodeSize(&pNode[i]);
     }
   }
-  if( x.nErr==0 ) sqlite3_result_int64(ctx, n);
-  jsonParseReset(&x);
+  sqlite3_result_int64(ctx, n);
 }
 
 /*
 ** json_extract(JSON, PATH, ...)
 **
 ** Return the element described by PATH.  Return NULL if there is no
 ** PATH element.  If there are multiple PATHs, then return a JSON array
 ** with the result from each path.  Throw an error if the JSON or any PATH
 ** is malformed.
 */
 static void jsonExtractFunc(
   sqlite3_context *ctx,
   int argc,
   sqlite3_value **argv
 ){
-  JsonParse x;          /* The parse */
+  JsonParse *p;          /* The parse */
   JsonNode *pNode;
   const char *zPath;
   JsonString jx;
   int i;
 
   if( argc<2 ) return;
-  if( jsonParse(&x, ctx, (const char*)sqlite3_value_text(argv[0])) ) return;
+  p = jsonParseCached(ctx, argv);
+  if( p==0 ) return;
   jsonInit(&jx, ctx);
   jsonAppendChar(&jx, '[');
   for(i=1; i<argc; i++){
     zPath = (const char*)sqlite3_value_text(argv[i]);
-    pNode = jsonLookup(&x, zPath, 0, ctx);
-    if( x.nErr ) break;
+    pNode = jsonLookup(p, zPath, 0, ctx);
+    if( p->nErr ) break;
     if( argc>2 ){
       jsonAppendSeparator(&jx);
       if( pNode ){
         jsonRenderNode(pNode, &jx, 0);
       }else{
         jsonAppendRaw(&jx, "null", 4);
       }
     }else if( pNode ){
@@ -180184,24 +180836,23 @@ static void jsonExtractFunc(
     }
   }
   if( argc>2 && i==argc ){
     jsonAppendChar(&jx, ']');
     jsonResult(&jx);
     sqlite3_result_subtype(ctx, JSON_SUBTYPE);
   }
   jsonReset(&jx);
-  jsonParseReset(&x);
 }
 
 /* This is the RFC 7396 MergePatch algorithm.
 */
 static JsonNode *jsonMergePatch(
   JsonParse *pParse,   /* The JSON parser that contains the TARGET */
-  int iTarget,         /* Node of the TARGET in pParse */
+  u32 iTarget,         /* Node of the TARGET in pParse */
   JsonNode *pPatch     /* The PATCH */
 ){
   u32 i, j;
   u32 iRoot;
   JsonNode *pTarget;
   if( pPatch->eType!=JSON_OBJECT ){
     return pPatch;
   }
@@ -182200,19 +182851,19 @@ static int sqlite3Fts5IndexWrite(
 static int sqlite3Fts5IndexBeginWrite(
   Fts5Index *p,                   /* Index to write to */
   int bDelete,                    /* True if current operation is a delete */
   i64 iDocid                      /* Docid to add or remove data from */
 );
 
 /*
 ** Flush any data stored in the in-memory hash tables to the database.
-** If the bCommit flag is true, also close any open blob handles.
-*/
-static int sqlite3Fts5IndexSync(Fts5Index *p, int bCommit);
+** Also close any open blob handles.
+*/
+static int sqlite3Fts5IndexSync(Fts5Index *p);
 
 /*
 ** Discard any data stored in the in-memory hash tables. Do not write it
 ** to the database. Additionally, assume that the contents of the %_data
 ** table may have changed on disk. So any in-memory caches of %_data 
 ** records must be invalidated.
 */
 static int sqlite3Fts5IndexRollback(Fts5Index *p);
@@ -182372,17 +183023,17 @@ static int sqlite3Fts5StorageIntegrity(F
 
 static int sqlite3Fts5StorageStmt(Fts5Storage *p, int eStmt, sqlite3_stmt**, char**);
 static void sqlite3Fts5StorageStmtRelease(Fts5Storage *p, int eStmt, sqlite3_stmt*);
 
 static int sqlite3Fts5StorageDocsize(Fts5Storage *p, i64 iRowid, int *aCol);
 static int sqlite3Fts5StorageSize(Fts5Storage *p, int iCol, i64 *pnAvg);
 static int sqlite3Fts5StorageRowCount(Fts5Storage *p, i64 *pnRow);
 
-static int sqlite3Fts5StorageSync(Fts5Storage *p, int bCommit);
+static int sqlite3Fts5StorageSync(Fts5Storage *p);
 static int sqlite3Fts5StorageRollback(Fts5Storage *p);
 
 static int sqlite3Fts5StorageConfigValue(
     Fts5Storage *p, const char*, sqlite3_value*, int
 );
 
 static int sqlite3Fts5StorageDeleteAll(Fts5Storage *p);
 static int sqlite3Fts5StorageRebuild(Fts5Storage *p);
@@ -182408,16 +183059,17 @@ typedef struct Fts5ExprNearset Fts5ExprN
 struct Fts5Token {
   const char *p;                  /* Token text (not NULL terminated) */
   int n;                          /* Size of buffer p in bytes */
 };
 
 /* Parse a MATCH expression. */
 static int sqlite3Fts5ExprNew(
   Fts5Config *pConfig, 
+  int iCol,                       /* Column on LHS of MATCH operator */
   const char *zExpr,
   Fts5Expr **ppNew, 
   char **pzErr
 );
 
 /*
 ** for(rc = sqlite3Fts5ExprFirst(pExpr, pIdx, bDesc);
 **     rc==SQLITE_OK && 0==sqlite3Fts5ExprEof(pExpr);
@@ -182492,17 +183144,17 @@ static Fts5Colset *sqlite3Fts5ParseColse
   Fts5Token *
 );
 
 static void sqlite3Fts5ParsePhraseFree(Fts5ExprPhrase*);
 static void sqlite3Fts5ParseNearsetFree(Fts5ExprNearset*);
 static void sqlite3Fts5ParseNodeFree(Fts5ExprNode*);
 
 static void sqlite3Fts5ParseSetDistance(Fts5Parse*, Fts5ExprNearset*, Fts5Token*);
-static void sqlite3Fts5ParseSetColset(Fts5Parse*, Fts5ExprNearset*, Fts5Colset*);
+static void sqlite3Fts5ParseSetColset(Fts5Parse*, Fts5ExprNode*, Fts5Colset*);
 static Fts5Colset *sqlite3Fts5ParseColsetInvert(Fts5Parse*, Fts5Colset*);
 static void sqlite3Fts5ParseFinished(Fts5Parse *pParse, Fts5ExprNode *p);
 static void sqlite3Fts5ParseNear(Fts5Parse *pParse, Fts5Token*);
 
 /*
 ** End of interface to code in fts5_expr.c.
 **************************************************************************/
 
@@ -182549,22 +183201,22 @@ static int sqlite3Fts5UnicodeFold(int c,
 
 #endif
 
 #define FTS5_OR                               1
 #define FTS5_AND                              2
 #define FTS5_NOT                              3
 #define FTS5_TERM                             4
 #define FTS5_COLON                            5
-#define FTS5_LP                               6
-#define FTS5_RP                               7
-#define FTS5_MINUS                            8
-#define FTS5_LCP                              9
-#define FTS5_RCP                             10
-#define FTS5_STRING                          11
+#define FTS5_MINUS                            6
+#define FTS5_LCP                              7
+#define FTS5_RCP                              8
+#define FTS5_STRING                           9
+#define FTS5_LP                              10
+#define FTS5_RP                              11
 #define FTS5_COMMA                           12
 #define FTS5_PLUS                            13
 #define FTS5_STAR                            14
 
 /*
 ** 2000-05-29
 **
 ** The author disclaims copyright to this source code.  In place of
@@ -182690,26 +183342,26 @@ typedef union {
 } fts5YYMINORTYPE;
 #ifndef fts5YYSTACKDEPTH
 #define fts5YYSTACKDEPTH 100
 #endif
 #define sqlite3Fts5ParserARG_SDECL Fts5Parse *pParse;
 #define sqlite3Fts5ParserARG_PDECL ,Fts5Parse *pParse
 #define sqlite3Fts5ParserARG_FETCH Fts5Parse *pParse = fts5yypParser->pParse
 #define sqlite3Fts5ParserARG_STORE fts5yypParser->pParse = pParse
-#define fts5YYNSTATE             29
-#define fts5YYNRULE              26
-#define fts5YY_MAX_SHIFT         28
-#define fts5YY_MIN_SHIFTREDUCE   45
-#define fts5YY_MAX_SHIFTREDUCE   70
-#define fts5YY_MIN_REDUCE        71
-#define fts5YY_MAX_REDUCE        96
-#define fts5YY_ERROR_ACTION      97
-#define fts5YY_ACCEPT_ACTION     98
-#define fts5YY_NO_ACTION         99
+#define fts5YYNSTATE             33
+#define fts5YYNRULE              27
+#define fts5YY_MAX_SHIFT         32
+#define fts5YY_MIN_SHIFTREDUCE   50
+#define fts5YY_MAX_SHIFTREDUCE   76
+#define fts5YY_MIN_REDUCE        77
+#define fts5YY_MAX_REDUCE        103
+#define fts5YY_ERROR_ACTION      104
+#define fts5YY_ACCEPT_ACTION     105
+#define fts5YY_NO_ACTION         106
 /************* End control #defines *******************************************/
 
 /* Define the fts5yytestcase() macro to be a no-op if is not already defined
 ** otherwise.
 **
 ** Applications can choose to define fts5yytestcase() in the %include section
 ** to a macro that can assist in verifying code coverage.  For production
 ** code the fts5yytestcase() macro should be turned off.  But it is useful
@@ -182771,60 +183423,64 @@ typedef union {
 **                     fts5yy_action.  Used to detect hash collisions.
 **  fts5yy_shift_ofst[]    For each state, the offset into fts5yy_action for
 **                     shifting terminals.
 **  fts5yy_reduce_ofst[]   For each state, the offset into fts5yy_action for
 **                     shifting non-terminals after a reduce.
 **  fts5yy_default[]       Default action for each state.
 **
 *********** Begin parsing tables **********************************************/
-#define fts5YY_ACTTAB_COUNT (85)
+#define fts5YY_ACTTAB_COUNT (98)
 static const fts5YYACTIONTYPE fts5yy_action[] = {
- /*     0 */    98,   16,   51,    5,   53,   27,   83,    7,   26,   15,
- /*    10 */    51,    5,   53,   27,   13,   69,   26,   48,   51,    5,
- /*    20 */    53,   27,   19,   11,   26,    9,   20,   51,    5,   53,
- /*    30 */    27,   13,   22,   26,   28,   51,    5,   53,   27,   68,
- /*    40 */     1,   26,   19,   11,   17,    9,   52,   10,   53,   27,
- /*    50 */    23,   24,   26,   54,    3,    4,    2,   26,    6,   21,
- /*    60 */    49,   71,    3,    4,    2,    7,   56,   59,   55,   59,
- /*    70 */     4,    2,   12,   69,   58,   60,   18,   67,   62,   69,
- /*    80 */    25,   66,    8,   14,    2,
+ /*     0 */   105,   19,   63,    6,   26,   66,   65,   24,   24,   17,
+ /*    10 */    63,    6,   26,   16,   65,   54,   24,   18,   63,    6,
+ /*    20 */    26,   10,   65,   12,   24,   75,   59,   63,    6,   26,
+ /*    30 */    13,   65,   75,   24,   20,   63,    6,   26,   74,   65,
+ /*    40 */    56,   24,   27,   63,    6,   26,   73,   65,   21,   24,
+ /*    50 */    23,   15,   30,   11,    1,   64,   22,   25,    9,   65,
+ /*    60 */     7,   24,    3,    4,    5,    3,    4,    5,    3,   77,
+ /*    70 */     4,    5,    3,   61,   23,   15,   60,   11,   80,   12,
+ /*    80 */     2,   13,   68,   10,   29,   52,   55,   75,   31,   32,
+ /*    90 */     8,   28,    5,    3,   51,   55,   72,   14,
 };
 static const fts5YYCODETYPE fts5yy_lookahead[] = {
- /*     0 */    16,   17,   18,   19,   20,   21,    5,    6,   24,   17,
- /*    10 */    18,   19,   20,   21,   11,   14,   24,   17,   18,   19,
- /*    20 */    20,   21,    8,    9,   24,   11,   17,   18,   19,   20,
- /*    30 */    21,   11,   12,   24,   17,   18,   19,   20,   21,   26,
- /*    40 */     6,   24,    8,    9,