Bug 1544443 - Upgrade to SQLite 3.28.0. r=mak
authorRyan VanderMeulen <ryanvm@gmail.com>
Tue, 30 Apr 2019 16:51:39 +0000
changeset 530807 e5eae28c1a24c6347a5cc74648d4e73be6919c17
parent 530806 5b6ff9ee055426d562ed0719ce486b93efac4c72
child 530808 1c79adcd8483d038b94b6690c65a6f868132733d
push id11265
push userffxbld-merge
push dateMon, 13 May 2019 10:53:39 +0000
treeherdermozilla-beta@77e0fe8dbdd3 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmak
bugs1544443
milestone68.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1544443 - Upgrade to SQLite 3.28.0. r=mak Differential Revision: https://phabricator.services.mozilla.com/D29379
db/sqlite3/src/sqlite3.c
db/sqlite3/src/sqlite3.h
old-configure.in
--- a/db/sqlite3/src/sqlite3.c
+++ b/db/sqlite3/src/sqlite3.c
@@ -1,11 +1,11 @@
 /******************************************************************************
 ** This file is an amalgamation of many separate C source files from SQLite
-** version 3.27.2.  By combining all the individual C code files into this
+** version 3.28.0.  By combining all the individual C code files into this
 ** single large file, the entire code can be compiled as a single translation
 ** unit.  This allows many compilers to do optimizations that would not be
 ** possible if the files were compiled separately.  Performance improvements
 ** of 5% or more are commonly seen when SQLite is compiled as a single
 ** translation unit.
 **
 ** This file is all you need to compile SQLite.  To use SQLite in other
 ** programs, you need this file and the "sqlite3.h" header file that defines
@@ -1157,19 +1157,19 @@ extern "C" {
 ** or SHA3-256 hash of the entire source tree.  If the source code has
 ** been edited in any way since it was last checked in, then the last
 ** four hexadecimal digits of the hash may be modified.
 **
 ** See also: [sqlite3_libversion()],
 ** [sqlite3_libversion_number()], [sqlite3_sourceid()],
 ** [sqlite_version()] and [sqlite_source_id()].
 */
-#define SQLITE_VERSION        "3.27.2"
-#define SQLITE_VERSION_NUMBER 3027002
-#define SQLITE_SOURCE_ID      "2019-02-25 16:06:06 bd49a8271d650fa89e446b42e513b595a717b9212c91dd384aab871fc1d0f6d7"
+#define SQLITE_VERSION        "3.28.0"
+#define SQLITE_VERSION_NUMBER 3028000
+#define SQLITE_SOURCE_ID      "2019-04-16 19:49:53 884b4b7e502b4e991677b53971277adfaf0a04a284f8e483e2553d0f83156b50"
 
 /*
 ** CAPI3REF: Run-Time Library Version Numbers
 ** KEYWORDS: sqlite3_version sqlite3_sourceid
 **
 ** These interfaces provide the same information as the [SQLITE_VERSION],
 ** [SQLITE_VERSION_NUMBER], and [SQLITE_SOURCE_ID] C preprocessor macros
 ** but are associated with the library instead of the header file.  ^(Cautious
@@ -1223,16 +1223,19 @@ SQLITE_API int sqlite3_libversion_number
 ** [SQLITE_OMIT_COMPILEOPTION_DIAGS] option at compile time.
 **
 ** See also: SQL functions [sqlite_compileoption_used()] and
 ** [sqlite_compileoption_get()] and the [compile_options pragma].
 */
 #ifndef SQLITE_OMIT_COMPILEOPTION_DIAGS
 SQLITE_API int sqlite3_compileoption_used(const char *zOptName);
 SQLITE_API const char *sqlite3_compileoption_get(int N);
+#else
+# define sqlite3_compileoption_used(X) 0
+# define sqlite3_compileoption_get(X)  ((void*)0)
 #endif
 
 /*
 ** CAPI3REF: Test To See If The Library Is Threadsafe
 **
 ** ^The sqlite3_threadsafe() function returns zero if and only if
 ** SQLite was compiled with mutexing code omitted due to the
 ** [SQLITE_THREADSAFE] compile-time option being set to 0.
@@ -3120,18 +3123,18 @@ struct sqlite3_mem_methods {
 ** positive to enable triggers or negative to leave the setting unchanged.
 ** The second parameter is a pointer to an integer into which
 ** is written 0 or 1 to indicate whether triggers are disabled or enabled
 ** following this call.  The second parameter may be a NULL pointer, in
 ** which case the trigger setting is not reported back. </dd>
 **
 ** [[SQLITE_DBCONFIG_ENABLE_FTS3_TOKENIZER]]
 ** <dt>SQLITE_DBCONFIG_ENABLE_FTS3_TOKENIZER</dt>
-** <dd> ^This option is used to enable or disable the two-argument
-** version of the [fts3_tokenizer()] function which is part of the
+** <dd> ^This option is used to enable or disable the
+** [fts3_tokenizer()] function which is part of the
 ** [FTS3] full-text search engine extension.
 ** There should be two additional arguments.
 ** The first argument is an integer which is 0 to disable fts3_tokenizer() or
 ** positive to enable fts3_tokenizer() or negative to leave the setting
 ** unchanged.
 ** The second parameter is a pointer to an integer into which
 ** is written 0 or 1 to indicate whether fts3_tokenizer is disabled or enabled
 ** following this call.  The second parameter may be a NULL pointer, in
@@ -3233,30 +3236,42 @@ struct sqlite3_mem_methods {
 ** deliberately corrupt the database file are disabled.  The disabled
 ** features include but are not limited to the following:
 ** <ul>
 ** <li> The [PRAGMA writable_schema=ON] statement.
 ** <li> Writes to the [sqlite_dbpage] virtual table.
 ** <li> Direct writes to [shadow tables].
 ** </ul>
 ** </dd>
+**
+** [[SQLITE_DBCONFIG_WRITABLE_SCHEMA]] <dt>SQLITE_DBCONFIG_WRITABLE_SCHEMA</dt>
+** <dd>The SQLITE_DBCONFIG_WRITABLE_SCHEMA option activates or deactivates the
+** "writable_schema" flag. This has the same effect and is logically equivalent
+** to setting [PRAGMA writable_schema=ON] or [PRAGMA writable_schema=OFF].
+** The first argument to this setting is an integer which is 0 to disable 
+** the writable_schema, positive to enable writable_schema, or negative to
+** leave the setting unchanged. The second parameter is a pointer to an
+** integer into which is written 0 or 1 to indicate whether the writable_schema
+** is enabled or disabled following this call.
+** </dd>
 ** </dl>
 */
 #define SQLITE_DBCONFIG_MAINDBNAME            1000 /* const char* */
 #define SQLITE_DBCONFIG_LOOKASIDE             1001 /* void* int int */
 #define SQLITE_DBCONFIG_ENABLE_FKEY           1002 /* int int* */
 #define SQLITE_DBCONFIG_ENABLE_TRIGGER        1003 /* int int* */
 #define SQLITE_DBCONFIG_ENABLE_FTS3_TOKENIZER 1004 /* int int* */
 #define SQLITE_DBCONFIG_ENABLE_LOAD_EXTENSION 1005 /* int int* */
 #define SQLITE_DBCONFIG_NO_CKPT_ON_CLOSE      1006 /* int int* */
 #define SQLITE_DBCONFIG_ENABLE_QPSG           1007 /* int int* */
 #define SQLITE_DBCONFIG_TRIGGER_EQP           1008 /* int int* */
 #define SQLITE_DBCONFIG_RESET_DATABASE        1009 /* int int* */
 #define SQLITE_DBCONFIG_DEFENSIVE             1010 /* int int* */
-#define SQLITE_DBCONFIG_MAX                   1010 /* Largest DBCONFIG */
+#define SQLITE_DBCONFIG_WRITABLE_SCHEMA       1011 /* int int* */
+#define SQLITE_DBCONFIG_MAX                   1011 /* Largest DBCONFIG */
 
 /*
 ** CAPI3REF: Enable Or Disable Extended Result Codes
 ** METHOD: sqlite3
 **
 ** ^The sqlite3_extended_result_codes() routine enables or disables the
 ** [extended result codes] feature of SQLite. ^The extended result
 ** codes are disabled by default for historical compatibility.
@@ -4929,16 +4944,28 @@ SQLITE_API const char *sqlite3_normalize
 ** ^The sqlite3_stmt_readonly() interface returns true for [BEGIN] since
 ** [BEGIN] merely sets internal flags, but the [BEGIN|BEGIN IMMEDIATE] and
 ** [BEGIN|BEGIN EXCLUSIVE] commands do touch the database and so
 ** sqlite3_stmt_readonly() returns false for those commands.
 */
 SQLITE_API int sqlite3_stmt_readonly(sqlite3_stmt *pStmt);
 
 /*
+** CAPI3REF: Query The EXPLAIN Setting For A Prepared Statement
+** METHOD: sqlite3_stmt
+**
+** ^The sqlite3_stmt_isexplain(S) interface returns 1 if the
+** prepared statement S is an EXPLAIN statement, or 2 if the
+** statement S is an EXPLAIN QUERY PLAN.
+** ^The sqlite3_stmt_isexplain(S) interface returns 0 if S is
+** an ordinary statement or a NULL pointer.
+*/
+SQLITE_API int sqlite3_stmt_isexplain(sqlite3_stmt *pStmt);
+
+/*
 ** CAPI3REF: Determine If A Prepared Statement Has Been Reset
 ** METHOD: sqlite3_stmt
 **
 ** ^The sqlite3_stmt_busy(S) interface returns true (non-zero) if the
 ** [prepared statement] S has been stepped at least once using 
 ** [sqlite3_step(S)] but has neither run to completion (returned
 ** [SQLITE_DONE] from [sqlite3_step(S)]) nor
 ** been reset using [sqlite3_reset(S)].  ^The sqlite3_stmt_busy(S)
@@ -5067,17 +5094,19 @@ typedef struct sqlite3_context sqlite3_c
 ** terminated.  If any NUL characters occur at byte offsets less than 
 ** the value of the fourth parameter then the resulting string value will
 ** contain embedded NULs.  The result of expressions involving strings
 ** with embedded NULs is undefined.
 **
 ** ^The fifth argument to the BLOB and string binding interfaces
 ** is a destructor used to dispose of the BLOB or
 ** string after SQLite has finished with it.  ^The destructor is called
-** to dispose of the BLOB or string even if the call to bind API fails.
+** to dispose of the BLOB or string even if the call to the bind API fails,
+** except the destructor is not called if the third parameter is a NULL
+** pointer or the fourth parameter is negative.
 ** ^If the fifth argument is
 ** the special value [SQLITE_STATIC], then SQLite assumes that the
 ** information is in static, unmanaged space and does not need to be freed.
 ** ^If the fifth argument has the value [SQLITE_TRANSIENT], then
 ** SQLite makes its own private copy of the data immediately, before
 ** the sqlite3_bind_*() routine returns.
 **
 ** ^The sixth argument to sqlite3_bind_text64() must be one of
@@ -5984,16 +6013,18 @@ SQLITE_API SQLITE_DEPRECATED int sqlite3
 ** TEXT in bytes
 ** <tr><td><b>sqlite3_value_type</b><td>&rarr;<td>Default
 ** datatype of the value
 ** <tr><td><b>sqlite3_value_numeric_type&nbsp;&nbsp;</b>
 ** <td>&rarr;&nbsp;&nbsp;<td>Best numeric datatype of the value
 ** <tr><td><b>sqlite3_value_nochange&nbsp;&nbsp;</b>
 ** <td>&rarr;&nbsp;&nbsp;<td>True if the column is unchanged in an UPDATE
 ** against a virtual table.
+** <tr><td><b>sqlite3_value_frombind&nbsp;&nbsp;</b>
+** <td>&rarr;&nbsp;&nbsp;<td>True if value originated from a [bound parameter]
 ** </table></blockquote>
 **
 ** <b>Details:</b>
 **
 ** These routines extract type, size, and content information from
 ** [protected sqlite3_value] objects.  Protected sqlite3_value objects
 ** are used to pass parameter information into implementation of
 ** [application-defined SQL functions] and [virtual tables].
@@ -6045,16 +6076,21 @@ SQLITE_API SQLITE_DEPRECATED int sqlite3
 ** the value for that column returned without setting a result (probably
 ** because it queried [sqlite3_vtab_nochange()] and found that the column
 ** was unchanging).  ^Within an [xUpdate] method, any value for which
 ** sqlite3_value_nochange(X) is true will in all other respects appear
 ** to be a NULL value.  If sqlite3_value_nochange(X) is invoked anywhere other
 ** than within an [xUpdate] method call for an UPDATE statement, then
 ** the return value is arbitrary and meaningless.
 **
+** ^The sqlite3_value_frombind(X) interface returns non-zero if the
+** value X originated from one of the [sqlite3_bind_int|sqlite3_bind()]
+** interfaces.  ^If X comes from an SQL literal value, or a table column,
+** and expression, then sqlite3_value_frombind(X) returns zero.
+**
 ** Please pay particular attention to the fact that the pointer returned
 ** from [sqlite3_value_blob()], [sqlite3_value_text()], or
 ** [sqlite3_value_text16()] can be invalidated by a subsequent call to
 ** [sqlite3_value_bytes()], [sqlite3_value_bytes16()], [sqlite3_value_text()],
 ** or [sqlite3_value_text16()].
 **
 ** These routines must be called from the same thread as
 ** the SQL function that supplied the [sqlite3_value*] parameters.
@@ -6090,16 +6126,17 @@ SQLITE_API const unsigned char *sqlite3_
 SQLITE_API const void *sqlite3_value_text16(sqlite3_value*);
 SQLITE_API const void *sqlite3_value_text16le(sqlite3_value*);
 SQLITE_API const void *sqlite3_value_text16be(sqlite3_value*);
 SQLITE_API int sqlite3_value_bytes(sqlite3_value*);
 SQLITE_API int sqlite3_value_bytes16(sqlite3_value*);
 SQLITE_API int sqlite3_value_type(sqlite3_value*);
 SQLITE_API int sqlite3_value_numeric_type(sqlite3_value*);
 SQLITE_API int sqlite3_value_nochange(sqlite3_value*);
+SQLITE_API int sqlite3_value_frombind(sqlite3_value*);
 
 /*
 ** CAPI3REF: Finding The Subtype Of SQL Values
 ** METHOD: sqlite3_value
 **
 ** The sqlite3_value_subtype(V) function returns the subtype for
 ** an [application-defined SQL function] argument V.  The subtype
 ** information can be used to pass a limited amount of context from
@@ -6825,17 +6862,17 @@ SQLITE_API sqlite3 *sqlite3_db_handle(sq
 /*
 ** CAPI3REF: Return The Filename For A Database Connection
 ** METHOD: sqlite3
 **
 ** ^The sqlite3_db_filename(D,N) interface returns a pointer to a filename
 ** associated with database N of connection D.  ^The main database file
 ** has the name "main".  If there is no attached database N on the database
 ** connection D, or if database N is a temporary or in-memory database, then
-** a NULL pointer is returned.
+** this function will return either a NULL pointer or an empty string.
 **
 ** ^The filename returned by this function is the output of the
 ** xFullPathname method of the [VFS].  ^In other words, the filename
 ** will be an absolute pathname, even if the filename used
 ** to open the database originally was a URI or relative pathname.
 */
 SQLITE_API const char *sqlite3_db_filename(sqlite3 *db, const char *zDbName);
 
@@ -11926,17 +11963,17 @@ SQLITE_API int sqlite3rebaser_configure(
 /*
 ** CAPI3REF: Rebase a changeset
 ** EXPERIMENTAL
 **
 ** Argument pIn must point to a buffer containing a changeset nIn bytes
 ** in size. This function allocates and populates a buffer with a copy
 ** of the changeset rebased rebased according to the configuration of the
 ** rebaser object passed as the first argument. If successful, (*ppOut)
-** is set to point to the new buffer containing the rebased changset and 
+** is set to point to the new buffer containing the rebased changeset and 
 ** (*pnOut) to its size in bytes and SQLITE_OK returned. It is the
 ** responsibility of the caller to eventually free the new buffer using
 ** sqlite3_free(). Otherwise, if an error occurs, (*ppOut) and (*pnOut)
 ** are set to zero and an SQLite error code returned.
 */
 SQLITE_API int sqlite3rebaser_rebase(
   sqlite3_rebaser*,
   int nIn, const void *pIn, 
@@ -12335,32 +12372,32 @@ struct Fts5PhraseIter {
 **   the callback, an SQLite error code is returned.
 **
 **
 ** xSetAuxdata(pFts5, pAux, xDelete)
 **
 **   Save the pointer passed as the second argument as the extension functions 
 **   "auxiliary data". The pointer may then be retrieved by the current or any
 **   future invocation of the same fts5 extension function made as part of
-**   of the same MATCH query using the xGetAuxdata() API.
+**   the same MATCH query using the xGetAuxdata() API.
 **
 **   Each extension function is allocated a single auxiliary data slot for
 **   each FTS query (MATCH expression). If the extension function is invoked 
 **   more than once for a single FTS query, then all invocations share a 
 **   single auxiliary data context.
 **
 **   If there is already an auxiliary data pointer when this function is
 **   invoked, then it is replaced by the new pointer. If an xDelete callback
 **   was specified along with the original pointer, it is invoked at this
 **   point.
 **
 **   The xDelete callback, if one is specified, is also invoked on the
 **   auxiliary data pointer after the FTS5 query has finished.
 **
-**   If an error (e.g. an OOM condition) occurs within this function, an
+**   If an error (e.g. an OOM condition) occurs within this function,
 **   the auxiliary data is set to NULL and an error code returned. If the
 **   xDelete parameter was not NULL, it is invoked on the auxiliary data
 **   pointer before returning.
 **
 **
 ** xGetAuxdata(pFts5, bClear)
 **
 **   Returns the current auxiliary data pointer for the fts5 extension 
@@ -13376,17 +13413,17 @@ typedef struct HashElem HashElem;
 ** in the table, it is faster to do a linear search than to manage
 ** the hash table.
 */
 struct Hash {
   unsigned int htsize;      /* Number of buckets in the hash table */
   unsigned int count;       /* Number of entries in this table */
   HashElem *first;          /* The first element of the array */
   struct _ht {              /* the hash table */
-    int count;                 /* Number of entries with this hash */
+    unsigned int count;        /* Number of entries with this hash */
     HashElem *chain;           /* Pointer to first entry with this hash */
   } *ht;
 };
 
 /* Each element in the hash table is an instance of the following 
 ** structure.  All elements are stored on a single doubly-linked list.
 **
 ** Again, this structure is intended to be opaque, but it can't really
@@ -13517,109 +13554,104 @@ SQLITE_PRIVATE void sqlite3HashClear(Has
 #define TK_VIRTUAL                         80
 #define TK_WITH                            81
 #define TK_CURRENT                         82
 #define TK_FOLLOWING                       83
 #define TK_PARTITION                       84
 #define TK_PRECEDING                       85
 #define TK_RANGE                           86
 #define TK_UNBOUNDED                       87
-#define TK_REINDEX                         88
-#define TK_RENAME                          89
-#define TK_CTIME_KW                        90
-#define TK_ANY                             91
-#define TK_BITAND                          92
-#define TK_BITOR                           93
-#define TK_LSHIFT                          94
-#define TK_RSHIFT                          95
-#define TK_PLUS                            96
-#define TK_MINUS                           97
-#define TK_STAR                            98
-#define TK_SLASH                           99
-#define TK_REM                            100
-#define TK_CONCAT                         101
-#define TK_COLLATE                        102
-#define TK_BITNOT                         103
-#define TK_ON                             104
-#define TK_INDEXED                        105
-#define TK_STRING                         106
-#define TK_JOIN_KW                        107
-#define TK_CONSTRAINT                     108
-#define TK_DEFAULT                        109
-#define TK_NULL                           110
-#define TK_PRIMARY                        111
-#define TK_UNIQUE                         112
-#define TK_CHECK                          113
-#define TK_REFERENCES                     114
-#define TK_AUTOINCR                       115
-#define TK_INSERT                         116
-#define TK_DELETE                         117
-#define TK_UPDATE                         118
-#define TK_SET                            119
-#define TK_DEFERRABLE                     120
-#define TK_FOREIGN                        121
-#define TK_DROP                           122
-#define TK_UNION                          123
-#define TK_ALL                            124
-#define TK_EXCEPT                         125
-#define TK_INTERSECT                      126
-#define TK_SELECT                         127
-#define TK_VALUES                         128
-#define TK_DISTINCT                       129
-#define TK_DOT                            130
-#define TK_FROM                           131
-#define TK_JOIN                           132
-#define TK_USING                          133
-#define TK_ORDER                          134
-#define TK_GROUP                          135
-#define TK_HAVING                         136
-#define TK_LIMIT                          137
-#define TK_WHERE                          138
-#define TK_INTO                           139
-#define TK_NOTHING                        140
-#define TK_FLOAT                          141
-#define TK_BLOB                           142
-#define TK_INTEGER                        143
-#define TK_VARIABLE                       144
-#define TK_CASE                           145
-#define TK_WHEN                           146
-#define TK_THEN                           147
-#define TK_ELSE                           148
-#define TK_INDEX                          149
-#define TK_ALTER                          150
-#define TK_ADD                            151
-#define TK_WINDOW                         152
-#define TK_OVER                           153
-#define TK_FILTER                         154
-#define TK_TRUEFALSE                      155
-#define TK_ISNOT                          156
-#define TK_FUNCTION                       157
-#define TK_COLUMN                         158
-#define TK_AGG_FUNCTION                   159
-#define TK_AGG_COLUMN                     160
-#define TK_UMINUS                         161
-#define TK_UPLUS                          162
-#define TK_TRUTH                          163
-#define TK_REGISTER                       164
-#define TK_VECTOR                         165
-#define TK_SELECT_COLUMN                  166
-#define TK_IF_NULL_ROW                    167
-#define TK_ASTERISK                       168
-#define TK_SPAN                           169
-#define TK_END_OF_FILE                    170
-#define TK_UNCLOSED_STRING                171
-#define TK_SPACE                          172
-#define TK_ILLEGAL                        173
-
-/* The token codes above must all fit in 8 bits */
-#define TKFLG_MASK           0xff  
-
-/* Flags that can be added to a token code when it is not
-** being stored in a u8: */
-#define TKFLG_DONTFOLD       0x100  /* Omit constant folding optimizations */
+#define TK_EXCLUDE                         88
+#define TK_GROUPS                          89
+#define TK_OTHERS                          90
+#define TK_TIES                            91
+#define TK_REINDEX                         92
+#define TK_RENAME                          93
+#define TK_CTIME_KW                        94
+#define TK_ANY                             95
+#define TK_BITAND                          96
+#define TK_BITOR                           97
+#define TK_LSHIFT                          98
+#define TK_RSHIFT                          99
+#define TK_PLUS                           100
+#define TK_MINUS                          101
+#define TK_STAR                           102
+#define TK_SLASH                          103
+#define TK_REM                            104
+#define TK_CONCAT                         105
+#define TK_COLLATE                        106
+#define TK_BITNOT                         107
+#define TK_ON                             108
+#define TK_INDEXED                        109
+#define TK_STRING                         110
+#define TK_JOIN_KW                        111
+#define TK_CONSTRAINT                     112
+#define TK_DEFAULT                        113
+#define TK_NULL                           114
+#define TK_PRIMARY                        115
+#define TK_UNIQUE                         116
+#define TK_CHECK                          117
+#define TK_REFERENCES                     118
+#define TK_AUTOINCR                       119
+#define TK_INSERT                         120
+#define TK_DELETE                         121
+#define TK_UPDATE                         122
+#define TK_SET                            123
+#define TK_DEFERRABLE                     124
+#define TK_FOREIGN                        125
+#define TK_DROP                           126
+#define TK_UNION                          127
+#define TK_ALL                            128
+#define TK_EXCEPT                         129
+#define TK_INTERSECT                      130
+#define TK_SELECT                         131
+#define TK_VALUES                         132
+#define TK_DISTINCT                       133
+#define TK_DOT                            134
+#define TK_FROM                           135
+#define TK_JOIN                           136
+#define TK_USING                          137
+#define TK_ORDER                          138
+#define TK_GROUP                          139
+#define TK_HAVING                         140
+#define TK_LIMIT                          141
+#define TK_WHERE                          142
+#define TK_INTO                           143
+#define TK_NOTHING                        144
+#define TK_FLOAT                          145
+#define TK_BLOB                           146
+#define TK_INTEGER                        147
+#define TK_VARIABLE                       148
+#define TK_CASE                           149
+#define TK_WHEN                           150
+#define TK_THEN                           151
+#define TK_ELSE                           152
+#define TK_INDEX                          153
+#define TK_ALTER                          154
+#define TK_ADD                            155
+#define TK_WINDOW                         156
+#define TK_OVER                           157
+#define TK_FILTER                         158
+#define TK_TRUEFALSE                      159
+#define TK_ISNOT                          160
+#define TK_FUNCTION                       161
+#define TK_COLUMN                         162
+#define TK_AGG_FUNCTION                   163
+#define TK_AGG_COLUMN                     164
+#define TK_UMINUS                         165
+#define TK_UPLUS                          166
+#define TK_TRUTH                          167
+#define TK_REGISTER                       168
+#define TK_VECTOR                         169
+#define TK_SELECT_COLUMN                  170
+#define TK_IF_NULL_ROW                    171
+#define TK_ASTERISK                       172
+#define TK_SPAN                           173
+#define TK_SPACE                          174
+#define TK_ILLEGAL                        175
 
 /************** End of parse.h ***********************************************/
 /************** Continuing where we left off in sqliteInt.h ******************/
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <assert.h>
 #include <stddef.h>
@@ -14541,19 +14573,16 @@ struct BtreePayload {
   u16 nMem;               /* Number of aMem[] value.  Might be zero */
   int nData;              /* Size of pData.  0 if none. */
   int nZero;              /* Extra zero data appended after pData,nData */
 };
 
 SQLITE_PRIVATE int sqlite3BtreeInsert(BtCursor*, const BtreePayload *pPayload,
                        int flags, int seekResult);
 SQLITE_PRIVATE int sqlite3BtreeFirst(BtCursor*, int *pRes);
-#ifndef SQLITE_OMIT_WINDOWFUNC
-SQLITE_PRIVATE void sqlite3BtreeSkipNext(BtCursor*);
-#endif
 SQLITE_PRIVATE int sqlite3BtreeLast(BtCursor*, int *pRes);
 SQLITE_PRIVATE int sqlite3BtreeNext(BtCursor*, int flags);
 SQLITE_PRIVATE int sqlite3BtreeEof(BtCursor*);
 SQLITE_PRIVATE int sqlite3BtreePrevious(BtCursor*, int flags);
 SQLITE_PRIVATE i64 sqlite3BtreeIntegerKey(BtCursor*);
 #ifdef SQLITE_ENABLE_OFFSET_SQL_FUNC
 SQLITE_PRIVATE i64 sqlite3BtreeOffset(BtCursor*);
 #endif
@@ -14901,35 +14930,35 @@ typedef struct VdbeOpList VdbeOpList;
 #define OP_RealAffinity   84
 #define OP_Cast           85 /* synopsis: affinity(r[P1])                  */
 #define OP_Permutation    86
 #define OP_Compare        87 /* synopsis: r[P1@P3] <-> r[P2@P3]            */
 #define OP_IsTrue         88 /* synopsis: r[P2] = coalesce(r[P1]==TRUE,P3) ^ P4 */
 #define OP_Offset         89 /* synopsis: r[P3] = sqlite_offset(P1)        */
 #define OP_Column         90 /* synopsis: r[P3]=PX                         */
 #define OP_Affinity       91 /* synopsis: affinity(r[P1@P2])               */
-#define OP_BitAnd         92 /* same as TK_BITAND, synopsis: r[P3]=r[P1]&r[P2] */
-#define OP_BitOr          93 /* same as TK_BITOR, synopsis: r[P3]=r[P1]|r[P2] */
-#define OP_ShiftLeft      94 /* same as TK_LSHIFT, synopsis: r[P3]=r[P2]<<r[P1] */
-#define OP_ShiftRight     95 /* same as TK_RSHIFT, synopsis: r[P3]=r[P2]>>r[P1] */
-#define OP_Add            96 /* same as TK_PLUS, synopsis: r[P3]=r[P1]+r[P2] */
-#define OP_Subtract       97 /* same as TK_MINUS, synopsis: r[P3]=r[P2]-r[P1] */
-#define OP_Multiply       98 /* same as TK_STAR, synopsis: r[P3]=r[P1]*r[P2] */
-#define OP_Divide         99 /* same as TK_SLASH, synopsis: r[P3]=r[P2]/r[P1] */
-#define OP_Remainder     100 /* same as TK_REM, synopsis: r[P3]=r[P2]%r[P1] */
-#define OP_Concat        101 /* same as TK_CONCAT, synopsis: r[P3]=r[P2]+r[P1] */
-#define OP_MakeRecord    102 /* synopsis: r[P3]=mkrec(r[P1@P2])            */
-#define OP_BitNot        103 /* same as TK_BITNOT, synopsis: r[P2]= ~r[P1] */
-#define OP_Count         104 /* synopsis: r[P2]=count()                    */
-#define OP_ReadCookie    105
-#define OP_String8       106 /* same as TK_STRING, synopsis: r[P2]='P4'    */
-#define OP_SetCookie     107
-#define OP_ReopenIdx     108 /* synopsis: root=P2 iDb=P3                   */
-#define OP_OpenRead      109 /* synopsis: root=P2 iDb=P3                   */
-#define OP_OpenWrite     110 /* synopsis: root=P2 iDb=P3                   */
+#define OP_MakeRecord     92 /* synopsis: r[P3]=mkrec(r[P1@P2])            */
+#define OP_Count          93 /* synopsis: r[P2]=count()                    */
+#define OP_ReadCookie     94
+#define OP_SetCookie      95
+#define OP_BitAnd         96 /* same as TK_BITAND, synopsis: r[P3]=r[P1]&r[P2] */
+#define OP_BitOr          97 /* same as TK_BITOR, synopsis: r[P3]=r[P1]|r[P2] */
+#define OP_ShiftLeft      98 /* same as TK_LSHIFT, synopsis: r[P3]=r[P2]<<r[P1] */
+#define OP_ShiftRight     99 /* same as TK_RSHIFT, synopsis: r[P3]=r[P2]>>r[P1] */
+#define OP_Add           100 /* same as TK_PLUS, synopsis: r[P3]=r[P1]+r[P2] */
+#define OP_Subtract      101 /* same as TK_MINUS, synopsis: r[P3]=r[P2]-r[P1] */
+#define OP_Multiply      102 /* same as TK_STAR, synopsis: r[P3]=r[P1]*r[P2] */
+#define OP_Divide        103 /* same as TK_SLASH, synopsis: r[P3]=r[P2]/r[P1] */
+#define OP_Remainder     104 /* same as TK_REM, synopsis: r[P3]=r[P2]%r[P1] */
+#define OP_Concat        105 /* same as TK_CONCAT, synopsis: r[P3]=r[P2]+r[P1] */
+#define OP_ReopenIdx     106 /* synopsis: root=P2 iDb=P3                   */
+#define OP_BitNot        107 /* same as TK_BITNOT, synopsis: r[P2]= ~r[P1] */
+#define OP_OpenRead      108 /* synopsis: root=P2 iDb=P3                   */
+#define OP_OpenWrite     109 /* synopsis: root=P2 iDb=P3                   */
+#define OP_String8       110 /* same as TK_STRING, synopsis: r[P2]='P4'    */
 #define OP_OpenDup       111
 #define OP_OpenAutoindex 112 /* synopsis: nColumn=P2                       */
 #define OP_OpenEphemeral 113 /* synopsis: nColumn=P2                       */
 #define OP_SorterOpen    114
 #define OP_SequenceTest  115 /* synopsis: if( cursor[P1].ctr++ ) pc = P2   */
 #define OP_OpenPseudo    116 /* synopsis: P3 columns in r[P2]              */
 #define OP_Close         117
 #define OP_ColumnsUsed   118
@@ -14950,21 +14979,21 @@ typedef struct VdbeOpList VdbeOpList;
 #define OP_IdxDelete     133 /* synopsis: key=r[P2@P3]                     */
 #define OP_DeferredSeek  134 /* synopsis: Move P3 to P1.rowid if needed    */
 #define OP_IdxRowid      135 /* synopsis: r[P2]=rowid                      */
 #define OP_Destroy       136
 #define OP_Clear         137
 #define OP_ResetSorter   138
 #define OP_CreateBtree   139 /* synopsis: r[P2]=root iDb=P1 flags=P3       */
 #define OP_SqlExec       140
-#define OP_Real          141 /* same as TK_FLOAT, synopsis: r[P2]=P4       */
-#define OP_ParseSchema   142
-#define OP_LoadAnalysis  143
-#define OP_DropTable     144
-#define OP_DropIndex     145
+#define OP_ParseSchema   141
+#define OP_LoadAnalysis  142
+#define OP_DropTable     143
+#define OP_DropIndex     144
+#define OP_Real          145 /* same as TK_FLOAT, synopsis: r[P2]=P4       */
 #define OP_DropTrigger   146
 #define OP_IntegrityCk   147
 #define OP_RowSetAdd     148 /* synopsis: rowset(P1)=r[P2]                 */
 #define OP_Param         149
 #define OP_FkCounter     150 /* synopsis: fkctr[P1]+=P2                    */
 #define OP_MemMax        151 /* synopsis: r[P1]=max(r[P1],r[P2])           */
 #define OP_OffsetLimit   152 /* synopsis: if r[P1]>0 then r[P2]=r[P1]+max(0,r[P3]) else r[P2]=(-1) */
 #define OP_AggInverse    153 /* synopsis: accum=r[P3] inverse(r[P2@P5])    */
@@ -15005,24 +15034,24 @@ typedef struct VdbeOpList VdbeOpList;
 /*  24 */ 0x09, 0x09, 0x09, 0x09, 0x09, 0x09, 0x09, 0x09,\
 /*  32 */ 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,\
 /*  40 */ 0x01, 0x23, 0x0b, 0x26, 0x26, 0x01, 0x01, 0x03,\
 /*  48 */ 0x03, 0x03, 0x03, 0x03, 0x0b, 0x0b, 0x0b, 0x0b,\
 /*  56 */ 0x0b, 0x0b, 0x01, 0x01, 0x01, 0x01, 0x00, 0x00,\
 /*  64 */ 0x00, 0x00, 0x02, 0x02, 0x08, 0x00, 0x10, 0x10,\
 /*  72 */ 0x10, 0x10, 0x00, 0x10, 0x10, 0x00, 0x00, 0x10,\
 /*  80 */ 0x10, 0x00, 0x00, 0x02, 0x02, 0x02, 0x00, 0x00,\
-/*  88 */ 0x12, 0x20, 0x00, 0x00, 0x26, 0x26, 0x26, 0x26,\
-/*  96 */ 0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x00, 0x12,\
-/* 104 */ 0x10, 0x10, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00,\
+/*  88 */ 0x12, 0x20, 0x00, 0x00, 0x00, 0x10, 0x10, 0x00,\
+/*  96 */ 0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26, 0x26,\
+/* 104 */ 0x26, 0x26, 0x00, 0x12, 0x00, 0x00, 0x10, 0x00,\
 /* 112 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
 /* 120 */ 0x10, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
 /* 128 */ 0x10, 0x00, 0x00, 0x04, 0x04, 0x00, 0x00, 0x10,\
-/* 136 */ 0x10, 0x00, 0x00, 0x10, 0x00, 0x10, 0x00, 0x00,\
-/* 144 */ 0x00, 0x00, 0x00, 0x00, 0x06, 0x10, 0x00, 0x04,\
+/* 136 */ 0x10, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00,\
+/* 144 */ 0x00, 0x10, 0x00, 0x00, 0x06, 0x10, 0x00, 0x04,\
 /* 152 */ 0x1a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\
 /* 160 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x10,\
 /* 168 */ 0x00, 0x00, 0x00, 0x00, 0x00,}
 
 /* The sqlite3P2Values() routine is able to run faster if it knows
 ** the value of the largest JUMP opcode.  The smaller the maximum
 ** JUMP opcode the better, so the mkopcodeh.tcl script that
 ** generated this include file strives to group all JUMP opcodes
@@ -16320,16 +16349,17 @@ struct sqlite3 {
   void *pProfileArg;                        /* Argument to profile function */
 #endif
   void *pCommitArg;                 /* Argument to xCommitCallback() */
   int (*xCommitCallback)(void*);    /* Invoked at every commit. */
   void *pRollbackArg;               /* Argument to xRollbackCallback() */
   void (*xRollbackCallback)(void*); /* Invoked at every commit. */
   void *pUpdateArg;
   void (*xUpdateCallback)(void*,int, const char*,const char*,sqlite_int64);
+  Parse *pParse;                /* Current parse */
 #ifdef SQLITE_ENABLE_PREUPDATE_HOOK
   void *pPreUpdateArg;          /* First argument to xPreUpdateCallback */
   void (*xPreUpdateCallback)(   /* Registered using sqlite3_preupdate_hook() */
     void*,sqlite3*,int,char const*,char const*,sqlite3_int64,sqlite3_int64
   );
   PreUpdate *pPreUpdate;        /* Context for active pre-update callback */
 #endif /* SQLITE_ENABLE_PREUPDATE_HOOK */
 #ifndef SQLITE_OMIT_WAL
@@ -16453,25 +16483,26 @@ struct sqlite3 {
 #endif
 
 /*
 ** Allowed values for sqlite3.mDbFlags
 */
 #define DBFLAG_SchemaChange   0x0001  /* Uncommitted Hash table changes */
 #define DBFLAG_PreferBuiltin  0x0002  /* Preference to built-in funcs */
 #define DBFLAG_Vacuum         0x0004  /* Currently in a VACUUM */
-#define DBFLAG_SchemaKnownOk  0x0008  /* Schema is known to be valid */
+#define DBFLAG_VacuumInto     0x0008  /* Currently running VACUUM INTO */
+#define DBFLAG_SchemaKnownOk  0x0010  /* Schema is known to be valid */
 
 /*
 ** Bits of the sqlite3.dbOptFlags field that are used by the
 ** sqlite3_test_control(SQLITE_TESTCTRL_OPTIMIZATIONS,...) interface to
 ** selectively disable various optimizations.
 */
 #define SQLITE_QueryFlattener 0x0001   /* Query flattening */
-                          /*  0x0002   available for reuse */
+#define SQLITE_WindowFunc     0x0002   /* Use xInverse for window functions */
 #define SQLITE_GroupByOrder   0x0004   /* GROUPBY cover of ORDERBY */
 #define SQLITE_FactorOutConst 0x0008   /* Constant factoring */
 #define SQLITE_DistinctOpt    0x0010   /* DISTINCT using indexes */
 #define SQLITE_CoverIdxScan   0x0020   /* Covering index scans */
 #define SQLITE_OrderByIdxJoin 0x0040   /* ORDER BY of joins via index */
 #define SQLITE_Transitive     0x0080   /* Transitive constraints */
 #define SQLITE_OmitNoopJoin   0x0100   /* Omit unused tables in joins */
 #define SQLITE_CountOfView    0x0200   /* The count-of-view optimization */
@@ -16579,17 +16610,16 @@ struct FuncDestructor {
 #define SQLITE_FUNC_UNLIKELY 0x0400 /* Built-in unlikely() function */
 #define SQLITE_FUNC_CONSTANT 0x0800 /* Constant inputs give a constant output */
 #define SQLITE_FUNC_MINMAX   0x1000 /* True for min() and max() aggregates */
 #define SQLITE_FUNC_SLOCHNG  0x2000 /* "Slow Change". Value constant during a
                                     ** single query - might change over time */
 #define SQLITE_FUNC_AFFINITY 0x4000 /* Built-in affinity() function */
 #define SQLITE_FUNC_OFFSET   0x8000 /* Built-in sqlite_offset() function */
 #define SQLITE_FUNC_WINDOW   0x00010000 /* Built-in window-only function */
-#define SQLITE_FUNC_WINDOW_SIZE 0x20000 /* Requires partition size as arg. */
 #define SQLITE_FUNC_INTERNAL 0x00040000 /* For use by NestedParse() only */
 
 /*
 ** The following three macros, FUNCTION(), LIKEFUNC() and AGGREGATE() are
 ** used to create the initializers for the FuncDef structures.
 **
 **   FUNCTION(zName, nArg, iArg, bNC, xFunc)
 **     Used to create a scalar function definition of a function zName
@@ -17385,44 +17415,49 @@ struct Expr {
       int iAddr;             /* Subroutine entry address */
       int regReturn;         /* Register used to hold return address */
     } sub;
   } y;
 };
 
 /*
 ** The following are the meanings of bits in the Expr.flags field.
+** Value restrictions:
+**
+**          EP_Agg == NC_HasAgg == SF_HasAgg
+**          EP_Win == NC_HasWin
 */
 #define EP_FromJoin  0x000001 /* Originates in ON/USING clause of outer join */
-#define EP_Agg       0x000002 /* Contains one or more aggregate functions */
+#define EP_Distinct  0x000002 /* Aggregate function with DISTINCT keyword */
 #define EP_HasFunc   0x000004 /* Contains one or more functions of any kind */
 #define EP_FixedCol  0x000008 /* TK_Column with a known fixed value */
-#define EP_Distinct  0x000010 /* Aggregate function with DISTINCT keyword */
+#define EP_Agg       0x000010 /* Contains one or more aggregate functions */
 #define EP_VarSelect 0x000020 /* pSelect is correlated, not constant */
 #define EP_DblQuoted 0x000040 /* token.z was originally in "..." */
 #define EP_InfixFunc 0x000080 /* True for an infix function: LIKE, GLOB, etc */
 #define EP_Collate   0x000100 /* Tree contains a TK_COLLATE operator */
 #define EP_Generic   0x000200 /* Ignore COLLATE or affinity on this tree */
 #define EP_IntValue  0x000400 /* Integer value contained in u.iValue */
 #define EP_xIsSelect 0x000800 /* x.pSelect is valid (otherwise x.pList is) */
 #define EP_Skip      0x001000 /* COLLATE, AS, or UNLIKELY */
 #define EP_Reduced   0x002000 /* Expr struct EXPR_REDUCEDSIZE bytes only */
 #define EP_TokenOnly 0x004000 /* Expr struct EXPR_TOKENONLYSIZE bytes only */
-#define EP_Static    0x008000 /* Held in memory not obtained from malloc() */
+#define EP_Win       0x008000 /* Contains window functions */
 #define EP_MemToken  0x010000 /* Need to sqlite3DbFree() Expr.zToken */
 #define EP_NoReduce  0x020000 /* Cannot EXPRDUP_REDUCE this Expr */
 #define EP_Unlikely  0x040000 /* unlikely() or likelihood() function */
 #define EP_ConstFunc 0x080000 /* A SQLITE_FUNC_CONSTANT or _SLOCHNG function */
 #define EP_CanBeNull 0x100000 /* Can be null despite NOT NULL constraint */
 #define EP_Subquery  0x200000 /* Tree contains a TK_SELECT operator */
 #define EP_Alias     0x400000 /* Is an alias for a result set column */
 #define EP_Leaf      0x800000 /* Expr.pLeft, .pRight, .u.pSelect all NULL */
 #define EP_WinFunc  0x1000000 /* TK_FUNCTION with Expr.y.pWin set */
 #define EP_Subrtn   0x2000000 /* Uses Expr.y.sub. TK_IN, _SELECT, or _EXISTS */
 #define EP_Quoted   0x4000000 /* TK_ID was originally quoted */
+#define EP_Static   0x8000000 /* Held in memory not obtained from malloc() */
 
 /*
 ** The EP_Propagate mask is a set of properties that automatically propagate
 ** upwards into parent nodes.
 */
 #define EP_Propagate (EP_Collate|EP_Subquery|EP_HasFunc)
 
 /*
@@ -17652,33 +17687,35 @@ struct NameContext {
   u16 ncFlags;         /* Zero or more NC_* flags defined below */
   Select *pWinSelect;  /* SELECT statement for any window functions */
 };
 
 /*
 ** Allowed values for the NameContext, ncFlags field.
 **
 ** Value constraints (all checked via assert()):
-**    NC_HasAgg    == SF_HasAgg
+**    NC_HasAgg    == SF_HasAgg    == EP_Agg
 **    NC_MinMaxAgg == SF_MinMaxAgg == SQLITE_FUNC_MINMAX
+**    NC_HasWin    == EP_Win
 **
 */
 #define NC_AllowAgg  0x0001  /* Aggregate functions are allowed here */
 #define NC_PartIdx   0x0002  /* True if resolving a partial index WHERE */
 #define NC_IsCheck   0x0004  /* True if resolving names in a CHECK constraint */
 #define NC_InAggFunc 0x0008  /* True if analyzing arguments to an agg func */
 #define NC_HasAgg    0x0010  /* One or more aggregate functions seen */
 #define NC_IdxExpr   0x0020  /* True if resolving columns of CREATE INDEX */
 #define NC_VarSelect 0x0040  /* A correlated subquery has been seen */
 #define NC_UEList    0x0080  /* True if uNC.pEList is used */
 #define NC_UAggInfo  0x0100  /* True if uNC.pAggInfo is used */
 #define NC_UUpsert   0x0200  /* True if uNC.pUpsert is used */
 #define NC_MinMaxAgg 0x1000  /* min/max aggregates seen.  See note above */
 #define NC_Complex   0x2000  /* True if a function or subquery seen */
 #define NC_AllowWin  0x4000  /* Window functions are allowed here */
+#define NC_HasWin    0x8000  /* One or more window functions seen */
 
 /*
 ** An instance of the following object describes a single ON CONFLICT
 ** clause in an upsert.
 **
 ** The pUpsertTarget field is only set if the ON CONFLICT clause includes
 ** conflict-target clause.  (In "ON CONFLICT(a,b)" the "(a,b)" is the
 ** conflict-target clause.)  The pUpsertTargetWhere is the optional
@@ -17983,16 +18020,17 @@ struct Parse {
   int nSelect;         /* Number of SELECT stmts. Counter for Select.selId */
 #ifndef SQLITE_OMIT_SHARED_CACHE
   int nTableLock;        /* Number of locks in aTableLock */
   TableLock *aTableLock; /* Required table locks for shared-cache mode */
 #endif
   AutoincInfo *pAinc;  /* Information about AUTOINCREMENT counters */
   Parse *pToplevel;    /* Parse structure for main program (or NULL) */
   Table *pTriggerTab;  /* Table triggers are being coded for */
+  Parse *pParentParse; /* Parent parser if this parser is nested */
   int addrCrTab;       /* Address of OP_CreateBtree opcode on CREATE TABLE */
   u32 nQueryLoop;      /* Est number of iterations of a query (10*log2(N)) */
   u32 oldmask;         /* Mask of old.* columns referenced */
   u32 newmask;         /* Mask of new.* columns referenced */
   u8 eTriggerOp;       /* TK_UPDATE, TK_INSERT or TK_DELETE */
   u8 eOrconf;          /* Default ON CONFLICT policy for trigger steps */
   u8 disableTriggers;  /* True to disable triggers */
 
@@ -18423,71 +18461,78 @@ struct With {
 */
 struct TreeView {
   int iLevel;             /* Which level of the tree we are on */
   u8  bLine[100];         /* Draw vertical in column i if bLine[i] is true */
 };
 #endif /* SQLITE_DEBUG */
 
 /*
-** This object is used in varioius ways, all related to window functions
+** This object is used in various ways, all related to window functions
 **
 **   (1) A single instance of this structure is attached to the
 **       the Expr.pWin field for each window function in an expression tree.
 **       This object holds the information contained in the OVER clause,
 **       plus additional fields used during code generation.
 **
 **   (2) All window functions in a single SELECT form a linked-list
 **       attached to Select.pWin.  The Window.pFunc and Window.pExpr
 **       fields point back to the expression that is the window function.
 **
 **   (3) The terms of the WINDOW clause of a SELECT are instances of this
 **       object on a linked list attached to Select.pWinDefn.
 **
 ** The uses (1) and (2) are really the same Window object that just happens
-** to be accessible in two different ways.  Use (3) is are separate objects.
+** to be accessible in two different ways.  Use case (3) are separate objects.
 */
 struct Window {
   char *zName;            /* Name of window (may be NULL) */
+  char *zBase;            /* Name of base window for chaining (may be NULL) */
   ExprList *pPartition;   /* PARTITION BY clause */
   ExprList *pOrderBy;     /* ORDER BY clause */
-  u8 eType;               /* TK_RANGE or TK_ROWS */
+  u8 eFrmType;            /* TK_RANGE, TK_GROUPS, TK_ROWS, or 0 */
   u8 eStart;              /* UNBOUNDED, CURRENT, PRECEDING or FOLLOWING */
   u8 eEnd;                /* UNBOUNDED, CURRENT, PRECEDING or FOLLOWING */
+  u8 bImplicitFrame;      /* True if frame was implicitly specified */
+  u8 eExclude;            /* TK_NO, TK_CURRENT, TK_TIES, TK_GROUP, or 0 */
   Expr *pStart;           /* Expression for "<expr> PRECEDING" */
   Expr *pEnd;             /* Expression for "<expr> FOLLOWING" */
   Window *pNextWin;       /* Next window function belonging to this SELECT */
   Expr *pFilter;          /* The FILTER expression */
   FuncDef *pFunc;         /* The function */
   int iEphCsr;            /* Partition buffer or Peer buffer */
   int regAccum;
   int regResult;
   int csrApp;             /* Function cursor (used by min/max) */
   int regApp;             /* Function register (also used by min/max) */
-  int regPart;            /* First in a set of registers holding PARTITION BY
-                          ** and ORDER BY values for the window */
+  int regPart;            /* Array of registers for PARTITION BY values */
   Expr *pOwner;           /* Expression object this window is attached to */
   int nBufferCol;         /* Number of columns in buffer table */
   int iArgCol;            /* Offset of first argument for this function */
+  int regOne;             /* Register containing constant value 1 */
+  int regStartRowid;
+  int regEndRowid;
 };
 
 #ifndef SQLITE_OMIT_WINDOWFUNC
 SQLITE_PRIVATE void sqlite3WindowDelete(sqlite3*, Window*);
 SQLITE_PRIVATE void sqlite3WindowListDelete(sqlite3 *db, Window *p);
-SQLITE_PRIVATE Window *sqlite3WindowAlloc(Parse*, int, int, Expr*, int , Expr*);
+SQLITE_PRIVATE Window *sqlite3WindowAlloc(Parse*, int, int, Expr*, int , Expr*, u8);
 SQLITE_PRIVATE void sqlite3WindowAttach(Parse*, Expr*, Window*);
 SQLITE_PRIVATE int sqlite3WindowCompare(Parse*, Window*, Window*);
 SQLITE_PRIVATE void sqlite3WindowCodeInit(Parse*, Window*);
 SQLITE_PRIVATE void sqlite3WindowCodeStep(Parse*, Select*, WhereInfo*, int, int);
 SQLITE_PRIVATE int sqlite3WindowRewrite(Parse*, Select*);
 SQLITE_PRIVATE int sqlite3ExpandSubquery(Parse*, struct SrcList_item*);
 SQLITE_PRIVATE void sqlite3WindowUpdate(Parse*, Window*, Window*, FuncDef*);
 SQLITE_PRIVATE Window *sqlite3WindowDup(sqlite3 *db, Expr *pOwner, Window *p);
 SQLITE_PRIVATE Window *sqlite3WindowListDup(sqlite3 *db, Window *p);
 SQLITE_PRIVATE void sqlite3WindowFunctions(void);
+SQLITE_PRIVATE void sqlite3WindowChain(Parse*, Window*, Window*);
+SQLITE_PRIVATE Window *sqlite3WindowAssemble(Parse*, Window*, ExprList*, ExprList*, Token*);
 #else
 # define sqlite3WindowDelete(a,b)
 # define sqlite3WindowFunctions()
 # define sqlite3WindowAttach(a,b,c)
 #endif
 
 /*
 ** Assuming zIn points to the first byte of a UTF-8 character,
@@ -18707,16 +18752,17 @@ SQLITE_PRIVATE   void sqlite3TreeViewWit
 SQLITE_PRIVATE   void sqlite3TreeViewWindow(TreeView*, const Window*, u8);
 SQLITE_PRIVATE   void sqlite3TreeViewWinFunc(TreeView*, const Window*, u8);
 #endif
 #endif
 
 
 SQLITE_PRIVATE void sqlite3SetString(char **, sqlite3*, const char*);
 SQLITE_PRIVATE void sqlite3ErrorMsg(Parse*, const char*, ...);
+SQLITE_PRIVATE int sqlite3ErrorToParser(sqlite3*,int);
 SQLITE_PRIVATE void sqlite3Dequote(char*);
 SQLITE_PRIVATE void sqlite3DequoteExpr(Expr*);
 SQLITE_PRIVATE void sqlite3TokenInit(Token*,char*);
 SQLITE_PRIVATE int sqlite3KeywordCode(const unsigned char*, int);
 SQLITE_PRIVATE int sqlite3RunParser(Parse*, const char*, char **);
 SQLITE_PRIVATE void sqlite3FinishCoding(Parse*);
 SQLITE_PRIVATE int sqlite3GetTempReg(Parse*);
 SQLITE_PRIVATE void sqlite3ReleaseTempReg(Parse*,int);
@@ -20130,21 +20176,21 @@ struct sqlite3_value {
 ** flags may coexist with the MEM_Str flag.
 */
 #define MEM_Null      0x0001   /* Value is NULL (or a pointer) */
 #define MEM_Str       0x0002   /* Value is a string */
 #define MEM_Int       0x0004   /* Value is an integer */
 #define MEM_Real      0x0008   /* Value is a real number */
 #define MEM_Blob      0x0010   /* Value is a BLOB */
 #define MEM_AffMask   0x001f   /* Mask of affinity bits */
-/* Available          0x0020   */
+#define MEM_FromBind  0x0020   /* Value originates from sqlite3_bind() */
 /* Available          0x0040   */
 #define MEM_Undefined 0x0080   /* Value is undefined */
 #define MEM_Cleared   0x0100   /* NULL set by OP_Null, not from data */
-#define MEM_TypeMask  0xc1ff   /* Mask of type bits */
+#define MEM_TypeMask  0xc1df   /* Mask of type bits */
 
 
 /* Whenever Mem contains a valid string or blob representation, one of
 ** the following flags must be set to determine the memory management
 ** policy for Mem.z.  The MEM_Term flag tells us whether or not the
 ** string is \000 or \u0000 terminated
 */
 #define MEM_Term      0x0200   /* String in Mem.z is zero terminated */
@@ -20167,16 +20213,22 @@ struct sqlite3_value {
 
 /*
 ** Clear any existing type flags from a Mem and replace them with f
 */
 #define MemSetTypeFlag(p, f) \
    ((p)->flags = ((p)->flags&~(MEM_TypeMask|MEM_Zero))|f)
 
 /*
+** True if Mem X is a NULL-nochng type.
+*/
+#define MemNullNochng(X) \
+  ((X)->flags==(MEM_Null|MEM_Zero) && (X)->n==0 && (X)->u.nZero==0)
+
+/*
 ** Return true if a memory cell is not marked as invalid.  This macro
 ** is for use inside assert() statements only.
 */
 #ifdef SQLITE_DEBUG
 #define memIsValid(M)  ((M)->flags & MEM_Undefined)==0
 #endif
 
 /*
@@ -27115,16 +27167,19 @@ SQLITE_PRIVATE void sqlite3SetString(cha
 */
 SQLITE_PRIVATE void sqlite3OomFault(sqlite3 *db){
   if( db->mallocFailed==0 && db->bBenignMalloc==0 ){
     db->mallocFailed = 1;
     if( db->nVdbeExec>0 ){
       db->u1.isInterrupted = 1;
     }
     db->lookaside.bDisable++;
+    if( db->pParse ){
+      db->pParse->rc = SQLITE_NOMEM_BKPT;
+    }
   }
 }
 
 /*
 ** This routine reactivates the memory allocator and clears the
 ** db->mallocFailed flag as necessary.
 **
 ** The memory allocator is not restarted if there are running
@@ -27308,17 +27363,18 @@ static char et_getdigit(LONGDOUBLE_TYPE 
 #endif /* SQLITE_OMIT_FLOATING_POINT */
 
 /*
 ** Set the StrAccum object to an error mode.
 */
 static void setStrAccumError(StrAccum *p, u8 eError){
   assert( eError==SQLITE_NOMEM || eError==SQLITE_TOOBIG );
   p->accError = eError;
-  p->nAlloc = 0;
+  if( p->mxAlloc ) sqlite3_str_reset(p);
+  if( eError==SQLITE_TOOBIG ) sqlite3ErrorToParser(p->db, eError);
 }
 
 /*
 ** Extra argument values from a PrintfArguments object
 */
 static sqlite3_int64 getIntArg(PrintfArguments *p){
   if( p->nArg<=p->nUsed ) return 0;
   return sqlite3_value_int64(p->apArg[p->nUsed++]);
@@ -27338,16 +27394,17 @@ static char *getTextArg(PrintfArguments 
 ** If the requested size of the temp buffer is larger than the size
 ** of the output buffer in pAccum, then cause an SQLITE_TOOBIG error.
 ** Do the size check before the memory allocation to prevent rogue
 ** SQL from requesting large allocations using the precision or width
 ** field of the printf() function.
 */
 static char *printfTempBuf(sqlite3_str *pAccum, sqlite3_int64 n){
   char *z;
+  if( pAccum->accError ) return 0;
   if( n>pAccum->nAlloc && n>pAccum->mxAlloc ){
     setStrAccumError(pAccum, SQLITE_TOOBIG);
     return 0;
   }
   z = sqlite3DbMallocRaw(pAccum->db, n);
   if( z==0 ){
     setStrAccumError(pAccum, SQLITE_NOMEM);
   }
@@ -28057,19 +28114,18 @@ static int sqlite3StrAccumEnlarge(StrAcc
   char *zNew;
   assert( p->nChar+(i64)N >= p->nAlloc ); /* Only called if really needed */
   if( p->accError ){
     testcase(p->accError==SQLITE_TOOBIG);
     testcase(p->accError==SQLITE_NOMEM);
     return 0;
   }
   if( p->mxAlloc==0 ){
-    N = p->nAlloc - p->nChar - 1;
     setStrAccumError(p, SQLITE_TOOBIG);
-    return N;
+    return p->nAlloc - p->nChar - 1;
   }else{
     char *zOld = isMalloced(p) ? p->zText : 0;
     i64 szNew = p->nChar;
     szNew += N + 1;
     if( szNew+p->nChar<=p->mxAlloc ){
       /* Force exponential buffer size growth as long as it does not overflow,
       ** to avoid having to call this routine too often */
       szNew += p->nChar;
@@ -28131,17 +28187,17 @@ static void SQLITE_NOINLINE enlargeAndAp
 /*
 ** Append N bytes of text from z to the StrAccum object.  Increase the
 ** size of the memory allocation for StrAccum if necessary.
 */
 SQLITE_API void sqlite3_str_append(sqlite3_str *p, const char *z, int N){
   assert( z!=0 || N==0 );
   assert( p->zText!=0 || p->nChar==0 || p->accError );
   assert( N>=0 );
-  assert( p->accError==0 || p->nAlloc==0 );
+  assert( p->accError==0 || p->nAlloc==0 || p->mxAlloc==0 );
   if( p->nChar+N >= p->nAlloc ){
     enlargeAndAppend(p,z,N);
   }else if( N ){
     assert( p->zText );
     p->nChar += N;
     memcpy(&p->zText[p->nChar-N], z, N);
   }
 }
@@ -28764,34 +28820,72 @@ SQLITE_PRIVATE void sqlite3TreeViewBound
 }
 #endif /* SQLITE_OMIT_WINDOWFUNC */
 
 #ifndef SQLITE_OMIT_WINDOWFUNC
 /*
 ** Generate a human-readable explanation for a Window object
 */
 SQLITE_PRIVATE void sqlite3TreeViewWindow(TreeView *pView, const Window *pWin, u8 more){
+  int nElement = 0;
+  if( pWin->pFilter ){
+    sqlite3TreeViewItem(pView, "FILTER", 1);
+    sqlite3TreeViewExpr(pView, pWin->pFilter, 0);
+    sqlite3TreeViewPop(pView);
+  }
   pView = sqlite3TreeViewPush(pView, more);
   if( pWin->zName ){
-    sqlite3TreeViewLine(pView, "OVER %s", pWin->zName);
-  }else{
-    sqlite3TreeViewLine(pView, "OVER");
+    sqlite3TreeViewLine(pView, "OVER %s (%p)", pWin->zName, pWin);
+  }else{
+    sqlite3TreeViewLine(pView, "OVER (%p)", pWin);
+  }
+  if( pWin->zBase )    nElement++;
+  if( pWin->pOrderBy ) nElement++;
+  if( pWin->eFrmType ) nElement++;
+  if( pWin->eExclude ) nElement++;
+  if( pWin->zBase ){
+    sqlite3TreeViewPush(pView, (--nElement)>0);
+    sqlite3TreeViewLine(pView, "window: %s", pWin->zBase);
+    sqlite3TreeViewPop(pView);
   }
   if( pWin->pPartition ){
-    sqlite3TreeViewExprList(pView, pWin->pPartition, 1, "PARTITION-BY");
+    sqlite3TreeViewExprList(pView, pWin->pPartition, nElement>0,"PARTITION-BY");
   }
   if( pWin->pOrderBy ){
-    sqlite3TreeViewExprList(pView, pWin->pOrderBy, 1, "ORDER-BY");
-  }
-  if( pWin->eType ){
-    sqlite3TreeViewItem(pView, pWin->eType==TK_RANGE ? "RANGE" : "ROWS", 0);
+    sqlite3TreeViewExprList(pView, pWin->pOrderBy, (--nElement)>0, "ORDER-BY");
+  }
+  if( pWin->eFrmType ){
+    char zBuf[30];
+    const char *zFrmType = "ROWS";
+    if( pWin->eFrmType==TK_RANGE ) zFrmType = "RANGE";
+    if( pWin->eFrmType==TK_GROUPS ) zFrmType = "GROUPS";
+    sqlite3_snprintf(sizeof(zBuf),zBuf,"%s%s",zFrmType,
+        pWin->bImplicitFrame ? " (implied)" : "");
+    sqlite3TreeViewItem(pView, zBuf, (--nElement)>0);
     sqlite3TreeViewBound(pView, pWin->eStart, pWin->pStart, 1);
     sqlite3TreeViewBound(pView, pWin->eEnd, pWin->pEnd, 0);
     sqlite3TreeViewPop(pView);
   }
+  if( pWin->eExclude ){
+    char zBuf[30];
+    const char *zExclude;
+    switch( pWin->eExclude ){
+      case TK_NO:      zExclude = "NO OTHERS";   break;
+      case TK_CURRENT: zExclude = "CURRENT ROW"; break;
+      case TK_GROUP:   zExclude = "GROUP";       break;
+      case TK_TIES:    zExclude = "TIES";        break;
+      default:
+        sqlite3_snprintf(sizeof(zBuf),zBuf,"invalid(%d)", pWin->eExclude);
+        zExclude = zBuf;
+        break;
+    }
+    sqlite3TreeViewPush(pView, 0);
+    sqlite3TreeViewLine(pView, "EXCLUDE %s", zExclude);
+    sqlite3TreeViewPop(pView);
+  }
   sqlite3TreeViewPop(pView);
 }
 #endif /* SQLITE_OMIT_WINDOWFUNC */
 
 #ifndef SQLITE_OMIT_WINDOWFUNC
 /*
 ** Generate a human-readable explanation for a Window Function object
 */
@@ -29761,21 +29855,21 @@ SQLITE_PRIVATE u32 sqlite3Utf8Read(
 
 #ifndef SQLITE_OMIT_UTF16
 /*
 ** This routine transforms the internal text encoding used by pMem to
 ** desiredEnc. It is an error if the string is already of the desired
 ** encoding, or if *pMem does not contain a string value.
 */
 SQLITE_PRIVATE SQLITE_NOINLINE int sqlite3VdbeMemTranslate(Mem *pMem, u8 desiredEnc){
-  int len;                    /* Maximum length of output string in bytes */
-  unsigned char *zOut;                  /* Output buffer */
-  unsigned char *zIn;                   /* Input iterator */
-  unsigned char *zTerm;                 /* End of input */
-  unsigned char *z;                     /* Output iterator */
+  sqlite3_int64 len;          /* Maximum length of output string in bytes */
+  unsigned char *zOut;        /* Output buffer */
+  unsigned char *zIn;         /* Input iterator */
+  unsigned char *zTerm;       /* End of input */
+  unsigned char *z;           /* Output iterator */
   unsigned int c;
 
   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
   assert( pMem->flags&MEM_Str );
   assert( pMem->enc!=desiredEnc );
   assert( pMem->enc!=0 );
   assert( pMem->n>=0 );
 
@@ -29814,24 +29908,24 @@ SQLITE_PRIVATE SQLITE_NOINLINE int sqlit
   /* Set len to the maximum number of bytes required in the output buffer. */
   if( desiredEnc==SQLITE_UTF8 ){
     /* When converting from UTF-16, the maximum growth results from
     ** translating a 2-byte character to a 4-byte UTF-8 character.
     ** A single byte is required for the output string
     ** nul-terminator.
     */
     pMem->n &= ~1;
-    len = pMem->n * 2 + 1;
+    len = 2 * (sqlite3_int64)pMem->n + 1;
   }else{
     /* When converting from UTF-8 to UTF-16 the maximum growth is caused
     ** when a 1-byte UTF-8 character is translated into a 2-byte UTF-16
     ** character. Two bytes are required in the output buffer for the
     ** nul-terminator.
     */
-    len = pMem->n * 2 + 2;
+    len = 2 * (sqlite3_int64)pMem->n + 2;
   }
 
   /* Set zIn to point at the start of the input buffer and zTerm to point 1
   ** byte past the end.
   **
   ** Variable zOut is set to point at the output buffer, space obtained
   ** from sqlite3_malloc().
   */
@@ -30128,25 +30222,33 @@ SQLITE_PRIVATE void sqlite3UtfSelfTest(v
 #ifdef SQLITE_COVERAGE_TEST
 SQLITE_PRIVATE void sqlite3Coverage(int x){
   static unsigned dummy = 0;
   dummy += (unsigned)x;
 }
 #endif
 
 /*
-** Give a callback to the test harness that can be used to simulate faults
-** in places where it is difficult or expensive to do so purely by means
-** of inputs.
-**
-** The intent of the integer argument is to let the fault simulator know
-** which of multiple sqlite3FaultSim() calls has been hit.
-**
-** Return whatever integer value the test callback returns, or return
-** SQLITE_OK if no test callback is installed.
+** Calls to sqlite3FaultSim() are used to simulate a failure during testing,
+** or to bypass normal error detection during testing in order to let 
+** execute proceed futher downstream.
+**
+** In deployment, sqlite3FaultSim() *always* return SQLITE_OK (0).  The
+** sqlite3FaultSim() function only returns non-zero during testing.
+**
+** During testing, if the test harness has set a fault-sim callback using
+** a call to sqlite3_test_control(SQLITE_TESTCTRL_FAULT_INSTALL), then
+** each call to sqlite3FaultSim() is relayed to that application-supplied
+** callback and the integer return value form the application-supplied
+** callback is returned by sqlite3FaultSim().
+**
+** The integer argument to sqlite3FaultSim() is a code to identify which
+** sqlite3FaultSim() instance is being invoked. Each call to sqlite3FaultSim()
+** should have a unique code.  To prevent legacy testing applications from
+** breaking, the codes should not be changed or reused.
 */
 #ifndef SQLITE_UNTESTABLE
 SQLITE_PRIVATE int sqlite3FaultSim(int iTest){
   int (*xCallback)(int) = sqlite3GlobalConfig.xTestCallback;
   return xCallback ? xCallback(iTest) : SQLITE_OK;
 }
 #endif
 
@@ -30322,16 +30424,29 @@ SQLITE_PRIVATE void sqlite3ErrorMsg(Pars
     pParse->nErr++;
     sqlite3DbFree(db, pParse->zErrMsg);
     pParse->zErrMsg = zMsg;
     pParse->rc = SQLITE_ERROR;
   }
 }
 
 /*
+** If database connection db is currently parsing SQL, then transfer
+** error code errCode to that parser if the parser has not already
+** encountered some other kind of error.
+*/
+SQLITE_PRIVATE int sqlite3ErrorToParser(sqlite3 *db, int errCode){
+  Parse *pParse;
+  if( db==0 || (pParse = db->pParse)==0 ) return errCode;
+  pParse->rc = errCode;
+  pParse->nErr++;
+  return errCode;
+}
+
+/*
 ** Convert an SQL-style quoted string into a normal string by removing
 ** the quote characters.  The conversion is done in-place.  If the
 ** input does not begin with a quote character, then this routine
 ** is a no-op.
 **
 ** The input string must be zero-terminated.  A new zero-terminator
 ** is added to the dequoted string.
 **
@@ -31672,17 +31787,17 @@ SQLITE_PRIVATE VList *sqlite3VListAdd(
   int nInt;              /* number of sizeof(int) objects needed for zName */
   char *z;               /* Pointer to where zName will be stored */
   int i;                 /* Index in pIn[] where zName is stored */
 
   nInt = nName/4 + 3;
   assert( pIn==0 || pIn[0]>=3 );  /* Verify ok to add new elements */
   if( pIn==0 || pIn[1]+nInt > pIn[0] ){
     /* Enlarge the allocation */
-    int nAlloc = (pIn ? pIn[0]*2 : 10) + nInt;
+    sqlite3_int64 nAlloc = (pIn ? 2*(sqlite3_int64)pIn[0] : 10) + nInt;
     VList *pOut = sqlite3DbRealloc(db, pIn, nAlloc*sizeof(int));
     if( pOut==0 ) return pIn;
     if( pIn==0 ) pOut[1] = 2;
     pIn = pOut;
     pIn[0] = nAlloc;
   }
   i = pIn[1];
   pIn[i] = iVal;
@@ -31878,17 +31993,17 @@ static int rehash(Hash *pH, unsigned int
 ** If pH is not NULL, then the hash for this key is written to *pH.
 */
 static HashElem *findElementWithHash(
   const Hash *pH,     /* The pH to be searched */
   const char *pKey,   /* The key we are searching for */
   unsigned int *pHash /* Write the hash value here */
 ){
   HashElem *elem;                /* Used to loop thru the element list */
-  int count;                     /* Number of elements left to test */
+  unsigned int count;            /* Number of elements left to test */
   unsigned int h;                /* The computed hash */
   static HashElem nullElement = { 0, 0, 0, 0 };
 
   if( pH->ht ){   /*OPTIMIZATION-IF-TRUE*/
     struct _ht *pEntry;
     h = strHash(pKey) % pH->htsize;
     pEntry = &pH->ht[h];
     elem = pEntry->chain;
@@ -31926,18 +32041,18 @@ static void removeElementGivenHash(
   if( elem->next ){
     elem->next->prev = elem->prev;
   }
   if( pH->ht ){
     pEntry = &pH->ht[h];
     if( pEntry->chain==elem ){
       pEntry->chain = elem->next;
     }
+    assert( pEntry->count>0 );
     pEntry->count--;
-    assert( pEntry->count>=0 );
   }
   sqlite3_free( elem );
   pH->count--;
   if( pH->count==0 ){
     assert( pH->first==0 );
     assert( pH->count==0 );
     sqlite3HashClear(pH);
   }
@@ -32102,35 +32217,35 @@ SQLITE_PRIVATE const char *sqlite3Opcode
     /*  84 */ "RealAffinity"     OpHelp(""),
     /*  85 */ "Cast"             OpHelp("affinity(r[P1])"),
     /*  86 */ "Permutation"      OpHelp(""),
     /*  87 */ "Compare"          OpHelp("r[P1@P3] <-> r[P2@P3]"),
     /*  88 */ "IsTrue"           OpHelp("r[P2] = coalesce(r[P1]==TRUE,P3) ^ P4"),
     /*  89 */ "Offset"           OpHelp("r[P3] = sqlite_offset(P1)"),
     /*  90 */ "Column"           OpHelp("r[P3]=PX"),
     /*  91 */ "Affinity"         OpHelp("affinity(r[P1@P2])"),
-    /*  92 */ "BitAnd"           OpHelp("r[P3]=r[P1]&r[P2]"),
-    /*  93 */ "BitOr"            OpHelp("r[P3]=r[P1]|r[P2]"),
-    /*  94 */ "ShiftLeft"        OpHelp("r[P3]=r[P2]<<r[P1]"),
-    /*  95 */ "ShiftRight"       OpHelp("r[P3]=r[P2]>>r[P1]"),
-    /*  96 */ "Add"              OpHelp("r[P3]=r[P1]+r[P2]"),
-    /*  97 */ "Subtract"         OpHelp("r[P3]=r[P2]-r[P1]"),
-    /*  98 */ "Multiply"         OpHelp("r[P3]=r[P1]*r[P2]"),
-    /*  99 */ "Divide"           OpHelp("r[P3]=r[P2]/r[P1]"),
-    /* 100 */ "Remainder"        OpHelp("r[P3]=r[P2]%r[P1]"),
-    /* 101 */ "Concat"           OpHelp("r[P3]=r[P2]+r[P1]"),
-    /* 102 */ "MakeRecord"       OpHelp("r[P3]=mkrec(r[P1@P2])"),
-    /* 103 */ "BitNot"           OpHelp("r[P2]= ~r[P1]"),
-    /* 104 */ "Count"            OpHelp("r[P2]=count()"),
-    /* 105 */ "ReadCookie"       OpHelp(""),
-    /* 106 */ "String8"          OpHelp("r[P2]='P4'"),
-    /* 107 */ "SetCookie"        OpHelp(""),
-    /* 108 */ "ReopenIdx"        OpHelp("root=P2 iDb=P3"),
-    /* 109 */ "OpenRead"         OpHelp("root=P2 iDb=P3"),
-    /* 110 */ "OpenWrite"        OpHelp("root=P2 iDb=P3"),
+    /*  92 */ "MakeRecord"       OpHelp("r[P3]=mkrec(r[P1@P2])"),
+    /*  93 */ "Count"            OpHelp("r[P2]=count()"),
+    /*  94 */ "ReadCookie"       OpHelp(""),
+    /*  95 */ "SetCookie"        OpHelp(""),
+    /*  96 */ "BitAnd"           OpHelp("r[P3]=r[P1]&r[P2]"),
+    /*  97 */ "BitOr"            OpHelp("r[P3]=r[P1]|r[P2]"),
+    /*  98 */ "ShiftLeft"        OpHelp("r[P3]=r[P2]<<r[P1]"),
+    /*  99 */ "ShiftRight"       OpHelp("r[P3]=r[P2]>>r[P1]"),
+    /* 100 */ "Add"              OpHelp("r[P3]=r[P1]+r[P2]"),
+    /* 101 */ "Subtract"         OpHelp("r[P3]=r[P2]-r[P1]"),
+    /* 102 */ "Multiply"         OpHelp("r[P3]=r[P1]*r[P2]"),
+    /* 103 */ "Divide"           OpHelp("r[P3]=r[P2]/r[P1]"),
+    /* 104 */ "Remainder"        OpHelp("r[P3]=r[P2]%r[P1]"),
+    /* 105 */ "Concat"           OpHelp("r[P3]=r[P2]+r[P1]"),
+    /* 106 */ "ReopenIdx"        OpHelp("root=P2 iDb=P3"),
+    /* 107 */ "BitNot"           OpHelp("r[P2]= ~r[P1]"),
+    /* 108 */ "OpenRead"         OpHelp("root=P2 iDb=P3"),
+    /* 109 */ "OpenWrite"        OpHelp("root=P2 iDb=P3"),
+    /* 110 */ "String8"          OpHelp("r[P2]='P4'"),
     /* 111 */ "OpenDup"          OpHelp(""),
     /* 112 */ "OpenAutoindex"    OpHelp("nColumn=P2"),
     /* 113 */ "OpenEphemeral"    OpHelp("nColumn=P2"),
     /* 114 */ "SorterOpen"       OpHelp(""),
     /* 115 */ "SequenceTest"     OpHelp("if( cursor[P1].ctr++ ) pc = P2"),
     /* 116 */ "OpenPseudo"       OpHelp("P3 columns in r[P2]"),
     /* 117 */ "Close"            OpHelp(""),
     /* 118 */ "ColumnsUsed"      OpHelp(""),
@@ -32151,21 +32266,21 @@ SQLITE_PRIVATE const char *sqlite3Opcode
     /* 133 */ "IdxDelete"        OpHelp("key=r[P2@P3]"),
     /* 134 */ "DeferredSeek"     OpHelp("Move P3 to P1.rowid if needed"),
     /* 135 */ "IdxRowid"         OpHelp("r[P2]=rowid"),
     /* 136 */ "Destroy"          OpHelp(""),
     /* 137 */ "Clear"            OpHelp(""),
     /* 138 */ "ResetSorter"      OpHelp(""),
     /* 139 */ "CreateBtree"      OpHelp("r[P2]=root iDb=P1 flags=P3"),
     /* 140 */ "SqlExec"          OpHelp(""),
-    /* 141 */ "Real"             OpHelp("r[P2]=P4"),
-    /* 142 */ "ParseSchema"      OpHelp(""),
-    /* 143 */ "LoadAnalysis"     OpHelp(""),
-    /* 144 */ "DropTable"        OpHelp(""),
-    /* 145 */ "DropIndex"        OpHelp(""),
+    /* 141 */ "ParseSchema"      OpHelp(""),
+    /* 142 */ "LoadAnalysis"     OpHelp(""),
+    /* 143 */ "DropTable"        OpHelp(""),
+    /* 144 */ "DropIndex"        OpHelp(""),
+    /* 145 */ "Real"             OpHelp("r[P2]=P4"),
     /* 146 */ "DropTrigger"      OpHelp(""),
     /* 147 */ "IntegrityCk"      OpHelp(""),
     /* 148 */ "RowSetAdd"        OpHelp("rowset(P1)=r[P2]"),
     /* 149 */ "Param"            OpHelp(""),
     /* 150 */ "FkCounter"        OpHelp("fkctr[P1]+=P2"),
     /* 151 */ "MemMax"           OpHelp("r[P1]=max(r[P1],r[P2])"),
     /* 152 */ "OffsetLimit"      OpHelp("if r[P1]>0 then r[P2]=r[P1]+max(0,r[P3]) else r[P2]=(-1)"),
     /* 153 */ "AggInverse"       OpHelp("accum=r[P3] inverse(r[P2@P5])"),
@@ -49011,19 +49126,17 @@ static void pcache1FreePage(PgHdr1 *p){
 }
 
 /*
 ** Malloc function used by SQLite to obtain space from the buffer configured
 ** using sqlite3_config(SQLITE_CONFIG_PAGECACHE) option. If no such buffer
 ** exists, this function falls back to sqlite3Malloc().
 */
 SQLITE_PRIVATE void *sqlite3PageMalloc(int sz){
-  /* During rebalance operations on a corrupt database file, it is sometimes
-  ** (rarely) possible to overread the temporary page buffer by a few bytes.
-  ** Enlarge the allocation slightly so that this does not cause problems. */
+  assert( sz<=65536+8 ); /* These allocations are never very large */
   return pcache1Alloc(sz);
 }
 
 /*
 ** Free an allocated buffer obtained from sqlite3PageMalloc().
 */
 SQLITE_PRIVATE void sqlite3PageFree(void *p){
   pcache1Free(p);
@@ -51297,16 +51410,19 @@ static const unsigned char aJournalMagic
 **
 **   * the database file is open,
 **   * there are no dirty pages in the cache, and
 **   * the desired page is not currently in the wal file.
 */
 SQLITE_PRIVATE int sqlite3PagerDirectReadOk(Pager *pPager, Pgno pgno){
   if( pPager->fd->pMethods==0 ) return 0;
   if( sqlite3PCacheIsDirty(pPager->pPCache) ) return 0;
+#ifdef SQLITE_HAS_CODEC
+  if( pPager->xCodec!=0 ) return 0;
+#endif
 #ifndef SQLITE_OMIT_WAL
   if( pPager->pWal ){
     u32 iRead = 0;
     int rc;
     rc = sqlite3WalFindFrame(pPager->pWal, pgno, &iRead);
     return (rc==SQLITE_OK && iRead==0);
   }
 #endif
@@ -54246,18 +54362,24 @@ SQLITE_PRIVATE int sqlite3PagerSetPagesi
   ){
     char *pNew = NULL;             /* New temp space */
     i64 nByte = 0;
 
     if( pPager->eState>PAGER_OPEN && isOpen(pPager->fd) ){
       rc = sqlite3OsFileSize(pPager->fd, &nByte);
     }
     if( rc==SQLITE_OK ){
-      pNew = (char *)sqlite3PageMalloc(pageSize);
-      if( !pNew ) rc = SQLITE_NOMEM_BKPT;
+      /* 8 bytes of zeroed overrun space is sufficient so that the b-tree
+      * cell header parser will never run off the end of the allocation */
+      pNew = (char *)sqlite3PageMalloc(pageSize+8);
+      if( !pNew ){
+        rc = SQLITE_NOMEM_BKPT;
+      }else{
+        memset(pNew+pageSize, 0, 8);
+      }
     }
 
     if( rc==SQLITE_OK ){
       pager_reset(pPager);
       rc = sqlite3PcacheSetPageSize(pPager->pPCache, pageSize);
     }
     if( rc==SQLITE_OK ){
       sqlite3PageFree(pPager->pTmpSpace);
@@ -57628,18 +57750,22 @@ SQLITE_PRIVATE int sqlite3PagerMovepage(
 
   /* If the cache contains a page with page-number pgno, remove it
   ** from its hash chain. Also, if the PGHDR_NEED_SYNC flag was set for 
   ** page pgno before the 'move' operation, it needs to be retained 
   ** for the page moved there.
   */
   pPg->flags &= ~PGHDR_NEED_SYNC;
   pPgOld = sqlite3PagerLookup(pPager, pgno);
-  assert( !pPgOld || pPgOld->nRef==1 );
+  assert( !pPgOld || pPgOld->nRef==1 || CORRUPT_DB );
   if( pPgOld ){
+    if( pPgOld->nRef>1 ){
+      sqlite3PagerUnrefNotNull(pPgOld);
+      return SQLITE_CORRUPT_BKPT;
+    }
     pPg->flags |= (pPgOld->flags&PGHDR_NEED_SYNC);
     if( pPager->tempFile ){
       /* Do not discard pages from an in-memory database since we might
       ** need to rollback later.  Just move the page out of the way. */
       sqlite3PcacheMove(pPgOld, pPager->dbSize+1);
     }else{
       sqlite3PcacheDrop(pPgOld);
     }
@@ -58157,17 +58283,17 @@ SQLITE_PRIVATE int sqlite3PagerSnapshotC
 }
 
 /*
 ** Release a lock obtained by an earlier successful call to
 ** sqlite3PagerSnapshotCheck().
 */
 SQLITE_PRIVATE void sqlite3PagerSnapshotUnlock(Pager *pPager){
   assert( pPager->pWal );
-  return sqlite3WalSnapshotUnlock(pPager->pWal);
+  sqlite3WalSnapshotUnlock(pPager->pWal);
 }
 
 #endif /* SQLITE_ENABLE_SNAPSHOT */
 #endif /* !SQLITE_OMIT_WAL */
 
 #ifdef SQLITE_ENABLE_ZIPVFS
 /*
 ** A read-lock must be held on the pager when this function is called. If
@@ -58758,17 +58884,17 @@ static SQLITE_NOINLINE int walIndexPageR
   Wal *pWal,               /* The WAL context */
   int iPage,               /* The page we seek */
   volatile u32 **ppPage    /* Write the page pointer here */
 ){
   int rc = SQLITE_OK;
 
   /* Enlarge the pWal->apWiData[] array if required */
   if( pWal->nWiData<=iPage ){
-    int nByte = sizeof(u32*)*(iPage+1);
+    sqlite3_int64 nByte = sizeof(u32*)*(iPage+1);
     volatile u32 **apNew;
     apNew = (volatile u32 **)sqlite3_realloc64((void *)pWal->apWiData, nByte);
     if( !apNew ){
       *ppPage = 0;
       return SQLITE_NOMEM_BKPT;
     }
     memset((void*)&apNew[pWal->nWiData], 0,
            sizeof(u32*)*(iPage+1-pWal->nWiData));
@@ -58862,16 +58988,17 @@ static void walChecksumBytes(
     s1 = aIn[0];
     s2 = aIn[1];
   }else{
     s1 = s2 = 0;
   }
 
   assert( nByte>=8 );
   assert( (nByte&0x00000007)==0 );
+  assert( nByte<=65536 );
 
   if( nativeCksum ){
     do {
       s1 += *aData++ + s2;
       s2 += *aData++ + s1;
     }while( aData<aEnd );
   }else{
     do {
@@ -59169,31 +59296,33 @@ static u32 walFramePgno(Wal *pWal, u32 i
 ** pWal->hdr.mxFrame advances to the point where those hash tables are
 ** actually needed.
 */
 static void walCleanupHash(Wal *pWal){
   WalHashLoc sLoc;                /* Hash table location */
   int iLimit = 0;                 /* Zero values greater than this */
   int nByte;                      /* Number of bytes to zero in aPgno[] */
   int i;                          /* Used to iterate through aHash[] */
+  int rc;                         /* Return code form walHashGet() */
 
   assert( pWal->writeLock );
   testcase( pWal->hdr.mxFrame==HASHTABLE_NPAGE_ONE-1 );
   testcase( pWal->hdr.mxFrame==HASHTABLE_NPAGE_ONE );
   testcase( pWal->hdr.mxFrame==HASHTABLE_NPAGE_ONE+1 );
 
   if( pWal->hdr.mxFrame==0 ) return;
 
   /* Obtain pointers to the hash-table and page-number array containing 
   ** the entry that corresponds to frame pWal->hdr.mxFrame. It is guaranteed
-  ** that the page said hash-table and array reside on is already mapped.
+  ** that the page said hash-table and array reside on is already mapped.(1)
   */
   assert( pWal->nWiData>walFramePage(pWal->hdr.mxFrame) );
   assert( pWal->apWiData[walFramePage(pWal->hdr.mxFrame)] );
-  walHashGet(pWal, walFramePage(pWal->hdr.mxFrame), &sLoc);
+  rc = walHashGet(pWal, walFramePage(pWal->hdr.mxFrame), &sLoc);
+  if( NEVER(rc) ) return; /* Defense-in-depth, in case (1) above is wrong */
 
   /* Zero all hash-table entries that correspond to frame numbers greater
   ** than pWal->hdr.mxFrame.
   */
   iLimit = pWal->hdr.mxFrame - sLoc.iZero;
   assert( iLimit>0 );
   for(i=0; i<HASHTABLE_NSLOT; i++){
     if( sLoc.aHash[i]>iLimit ){
@@ -59797,17 +59926,17 @@ static void walIteratorFree(WalIterator 
 **
 ** The calling routine should invoke walIteratorFree() to destroy the
 ** WalIterator object when it has finished with it.
 */
 static int walIteratorInit(Wal *pWal, u32 nBackfill, WalIterator **pp){
   WalIterator *p;                 /* Return value */
   int nSegment;                   /* Number of segments to merge */
   u32 iLast;                      /* Last frame in log */
-  int nByte;                      /* Number of bytes to allocate */
+  sqlite3_int64 nByte;            /* Number of bytes to allocate */
   int i;                          /* Iterator variable */
   ht_slot *aTmp;                  /* Temp space used by merge-sort */
   int rc = SQLITE_OK;             /* Return Code */
 
   /* This routine only runs while holding the checkpoint lock. And
   ** it only runs if there is actually content in the log (mxFrame>0).
   */
   assert( pWal->ckptLock && pWal->hdr.mxFrame>0 );
@@ -62333,17 +62462,17 @@ struct MemPage {
   u8 leaf;             /* True if a leaf page */
   u8 hdrOffset;        /* 100 for page 1.  0 otherwise */
   u8 childPtrSize;     /* 0 if leaf==1.  4 if leaf==0 */
   u8 max1bytePayload;  /* min(maxLocal,127) */
   u8 nOverflow;        /* Number of overflow cell bodies in aCell[] */
   u16 maxLocal;        /* Copy of BtShared.maxLocal or BtShared.maxLeaf */
   u16 minLocal;        /* Copy of BtShared.minLocal or BtShared.minLeaf */
   u16 cellOffset;      /* Index in aData of first cell pointer */
-  u16 nFree;           /* Number of free bytes on the page */
+  int nFree;           /* Number of free bytes on the page. -1 for unknown */
   u16 nCell;           /* Number of cells on this page, local and ovfl */
   u16 maskPage;        /* Mask for page offset */
   u16 aiOvfl[4];       /* Insert the i-th overflow cell before the aiOvfl-th
                        ** non-overflow cell */
   u8 *apOvfl[4];       /* Pointers to the body of overflow cells */
   BtShared *pBt;       /* Pointer to BtShared that this page is part of */
   u8 *aData;           /* Pointer to disk image of the page data */
   u8 *aDataEnd;        /* One byte past the end of usable data */
@@ -63887,24 +64016,28 @@ moveto_done:
 ** Restore the cursor to the position it was in (or as close to as possible)
 ** when saveCursorPosition() was called. Note that this call deletes the 
 ** saved position info stored by saveCursorPosition(), so there can be
 ** at most one effective restoreCursorPosition() call after each 
 ** saveCursorPosition().
 */
 static int btreeRestoreCursorPosition(BtCursor *pCur){
   int rc;
-  int skipNext;
+  int skipNext = 0;
   assert( cursorOwnsBtShared(pCur) );
   assert( pCur->eState>=CURSOR_REQUIRESEEK );
   if( pCur->eState==CURSOR_FAULT ){
     return pCur->skipNext;
   }
   pCur->eState = CURSOR_INVALID;
-  rc = btreeMoveto(pCur, pCur->pKey, pCur->nKey, 0, &skipNext);
+  if( sqlite3FaultSim(410) ){
+    rc = SQLITE_IOERR;
+  }else{
+    rc = btreeMoveto(pCur, pCur->pKey, pCur->nKey, 0, &skipNext);
+  }
   if( rc==SQLITE_OK ){
     sqlite3_free(pCur->pKey);
     pCur->pKey = 0;
     assert( pCur->eState==CURSOR_VALID || pCur->eState==CURSOR_INVALID );
     if( skipNext ) pCur->skipNext = skipNext;
     if( pCur->skipNext && pCur->eState==CURSOR_VALID ){
       pCur->eState = CURSOR_SKIPNEXT;
     }
@@ -64475,32 +64608,28 @@ static int defragmentPage(MemPage *pPage
   assert( pPage->pBt->usableSize <= SQLITE_MAX_PAGE_SIZE );
   assert( pPage->nOverflow==0 );
   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
   temp = 0;
   src = data = pPage->aData;
   hdr = pPage->hdrOffset;
   cellOffset = pPage->cellOffset;
   nCell = pPage->nCell;
-  assert( nCell==get2byte(&data[hdr+3]) );
+  assert( nCell==get2byte(&data[hdr+3]) || CORRUPT_DB );
   iCellFirst = cellOffset + 2*nCell;
   usableSize = pPage->pBt->usableSize;
 
   /* This block handles pages with two or fewer free blocks and nMaxFrag
   ** or fewer fragmented bytes. In this case it is faster to move the
   ** two (or one) blocks of cells using memmove() and add the required
   ** offsets to each pointer in the cell-pointer array than it is to 
   ** reconstruct the entire page.  */
   if( (int)data[hdr+7]<=nMaxFrag ){
     int iFree = get2byte(&data[hdr+1]);
-
-    /* If the initial freeblock offset were out of bounds, that would
-    ** have been detected by btreeInitPage() when it was computing the
-    ** number of free bytes on the page. */
-    assert( iFree<=usableSize-4 );
+    if( iFree>usableSize-4 ) return SQLITE_CORRUPT_PAGE(pPage);
     if( iFree ){
       int iFree2 = get2byte(&data[iFree]);
       if( iFree2>usableSize-4 ) return SQLITE_CORRUPT_PAGE(pPage);
       if( 0==iFree2 || (data[iFree2]==0 && data[iFree2+1]==0) ){
         u8 *pEnd = &data[cellOffset + nCell*2];
         u8 *pAddr;
         int sz2 = 0;
         int sz = get2byte(&data[iFree+2]);
@@ -64509,17 +64638,20 @@ static int defragmentPage(MemPage *pPage
           return SQLITE_CORRUPT_PAGE(pPage);
         }
         if( iFree2 ){
           if( iFree+sz>iFree2 ) return SQLITE_CORRUPT_PAGE(pPage);
           sz2 = get2byte(&data[iFree2+2]);
           if( iFree2+sz2 > usableSize ) return SQLITE_CORRUPT_PAGE(pPage);
           memmove(&data[iFree+sz+sz2], &data[iFree+sz], iFree2-(iFree+sz));
           sz += sz2;
-        }
+        }else if( iFree+sz>usableSize ){
+          return SQLITE_CORRUPT_PAGE(pPage);
+        }
+
         cbrk = top+sz;
         assert( cbrk+(iFree-top) <= usableSize );
         memmove(&data[cbrk], &data[top], iFree-top);
         for(pAddr=&data[cellOffset]; pAddr<pEnd; pAddr+=2){
           pc = get2byte(pAddr);
           if( pc<iFree ){ put2byte(pAddr, pc+sz); }
           else if( pc<iFree2 ){ put2byte(pAddr, pc+sz2); }
         }
@@ -64560,16 +64692,17 @@ static int defragmentPage(MemPage *pPage
       memcpy(&temp[x], &data[x], (cbrk+size) - x);
       src = temp;
     }
     memcpy(&data[cbrk], &src[pc], size);
   }
   data[hdr+7] = 0;
 
  defragment_out:
+  assert( pPage->nFree>=0 );
   if( data[hdr+7]+cbrk-iCellFirst!=pPage->nFree ){
     return SQLITE_CORRUPT_PAGE(pPage);
   }
   assert( cbrk>=iCellFirst );
   put2byte(&data[hdr+5], cbrk);
   data[hdr+1] = 0;
   data[hdr+2] = 0;
   memset(&data[iCellFirst], 0, cbrk-iCellFirst);
@@ -64587,60 +64720,67 @@ static int defragmentPage(MemPage *pPage
 ** This function may detect corruption within pPg.  If corruption is
 ** detected then *pRc is set to SQLITE_CORRUPT and NULL is returned.
 **
 ** Slots on the free list that are between 1 and 3 bytes larger than nByte
 ** will be ignored if adding the extra space to the fragmentation count
 ** causes the fragmentation count to exceed 60.
 */
 static u8 *pageFindSlot(MemPage *pPg, int nByte, int *pRc){
-  const int hdr = pPg->hdrOffset;
-  u8 * const aData = pPg->aData;
-  int iAddr = hdr + 1;
-  int pc = get2byte(&aData[iAddr]);
-  int x;
-  int usableSize = pPg->pBt->usableSize;
-  int size;            /* Size of the free slot */
+  const int hdr = pPg->hdrOffset;            /* Offset to page header */
+  u8 * const aData = pPg->aData;             /* Page data */
+  int iAddr = hdr + 1;                       /* Address of ptr to pc */
+  int pc = get2byte(&aData[iAddr]);          /* Address of a free slot */
+  int x;                                     /* Excess size of the slot */
+  int maxPC = pPg->pBt->usableSize - nByte;  /* Max address for a usable slot */
+  int size;                                  /* Size of the free slot */
 
   assert( pc>0 );
-  while( pc<=usableSize-4 ){
+  while( pc<=maxPC ){
     /* EVIDENCE-OF: R-22710-53328 The third and fourth bytes of each
     ** freeblock form a big-endian integer which is the size of the freeblock
     ** in bytes, including the 4-byte header. */
     size = get2byte(&aData[pc+2]);
     if( (x = size - nByte)>=0 ){
       testcase( x==4 );
       testcase( x==3 );
-      if( size+pc > usableSize ){
-        *pRc = SQLITE_CORRUPT_PAGE(pPg);
-        return 0;
-      }else if( x<4 ){
+      if( x<4 ){
         /* EVIDENCE-OF: R-11498-58022 In a well-formed b-tree page, the total
         ** number of bytes in fragments may not exceed 60. */
         if( aData[hdr+7]>57 ) return 0;
 
         /* Remove the slot from the free-list. Update the number of
         ** fragmented bytes within the page. */
         memcpy(&aData[iAddr], &aData[pc], 2);
         aData[hdr+7] += (u8)x;
+      }else if( x+pc > maxPC ){
+        /* This slot extends off the end of the usable part of the page */
+        *pRc = SQLITE_CORRUPT_PAGE(pPg);
+        return 0;
       }else{
         /* The slot remains on the free-list. Reduce its size to account
-         ** for the portion used by the new allocation. */
+        ** for the portion used by the new allocation. */
         put2byte(&aData[pc+2], x);
       }
       return &aData[pc + x];
     }
     iAddr = pc;
     pc = get2byte(&aData[pc]);
-    if( pc<iAddr+size ) break;
-  }
-  if( pc ){
+    if( pc<=iAddr+size ){
+      if( pc ){
+        /* The next slot in the chain is not past the end of the current slot */
+        *pRc = SQLITE_CORRUPT_PAGE(pPg);
+      }
+      return 0;
+    }
+  }
+  if( pc>maxPC+nByte-4 ){
+    /* The free slot chain extends off the end of the page */
     *pRc = SQLITE_CORRUPT_PAGE(pPg);
   }
-
   return 0;
 }
 
 /*
 ** Allocate nByte bytes of space from within the B-Tree page passed
 ** as the first argument. Write into *pIdx the index into pPage->aData[]
 ** of the first byte of allocated space. Return either SQLITE_OK or
 ** an error code (usually SQLITE_CORRUPT).
@@ -64680,19 +64820,19 @@ static int allocateSpace(MemPage *pPage,
   if( gap>top ){
     if( top==0 && pPage->pBt->usableSize==65536 ){
       top = 65536;
     }else{
       return SQLITE_CORRUPT_PAGE(pPage);
     }
   }
 
-  /* If there is enough space between gap and top for one more cell pointer
-  ** array entry offset, and if the freelist is not empty, then search the
-  ** freelist looking for a free slot big enough to satisfy the request.
+  /* If there is enough space between gap and top for one more cell pointer,
+  ** and if the freelist is not empty, then search the
+  ** freelist looking for a slot big enough to satisfy the request.
   */
   testcase( gap+2==top );
   testcase( gap+1==top );
   testcase( gap==top );
   if( (data[hdr+2] || data[hdr+1]) && gap+2<=top ){
     u8 *pSpace = pageFindSlot(pPage, nByte, &rc);
     if( pSpace ){
       assert( pSpace>=data && (pSpace - data)<65536 );
@@ -64704,25 +64844,26 @@ static int allocateSpace(MemPage *pPage,
   }
 
   /* The request could not be fulfilled using a freelist slot.  Check
   ** to see if defragmentation is necessary.
   */
   testcase( gap+2+nByte==top );
   if( gap+2+nByte>top ){
     assert( pPage->nCell>0 || CORRUPT_DB );
+    assert( pPage->nFree>=0 );
     rc = defragmentPage(pPage, MIN(4, pPage->nFree - (2+nByte)));
     if( rc ) return rc;
     top = get2byteNotZero(&data[hdr+5]);
     assert( gap+2+nByte<=top );
   }
 
 
   /* Allocate memory from the gap in between the cell pointer array
-  ** and the cell content area.  The btreeInitPage() call has already
+  ** and the cell content area.  The btreeComputeFreeSpace() call has already
   ** validated the freelist.  Given that the freelist is valid, there
   ** is no way that the allocation can extend off the end of the page.
   ** The assert() below verifies the previous sentence.
   */
   top -= nByte;
   put2byte(&data[hdr+5], top);
   assert( top+nByte <= (int)pPage->pBt->usableSize );
   *pIdx = top;
@@ -64731,17 +64872,17 @@ static int allocateSpace(MemPage *pPage,
 
 /*
 ** Return a section of the pPage->aData to the freelist.
 ** The first byte of the new free block is pPage->aData[iStart]
 ** and the size of the block is iSize bytes.
 **
 ** Adjacent freeblocks are coalesced.
 **
-** Note that even though the freeblock list was checked by btreeInitPage(),
+** Even though the freeblock list was checked by btreeComputeFreeSpace(),
 ** that routine will not detect overlap between cells or freeblocks.  Nor
 ** does it detect cells or freeblocks that encrouch into the reserved bytes
 ** at the end of the page.  So do additional corruption checks inside this
 ** routine and return SQLITE_CORRUPT if any problems are found.
 */
 static int freeSpace(MemPage *pPage, u16 iStart, u16 iSize){
   u16 iPtr;                             /* Address of ptr to next freeblock */
   u16 iFreeBlk;                         /* Address of the next freeblock */
@@ -64893,107 +65034,47 @@ static int decodeFlags(MemPage *pPage, i
     ** an error. */
     return SQLITE_CORRUPT_PAGE(pPage);
   }
   pPage->max1bytePayload = pBt->max1bytePayload;
   return SQLITE_OK;
 }
 
 /*
-** Initialize the auxiliary information for a disk block.
-**
-** Return SQLITE_OK on success.  If we see that the page does
-** not contain a well-formed database page, then return 
-** SQLITE_CORRUPT.  Note that a return of SQLITE_OK does not
-** guarantee that the page is well-formed.  It only shows that
-** we failed to detect any corruption.
-*/
-static int btreeInitPage(MemPage *pPage){
+** Compute the amount of freespace on the page.  In other words, fill
+** in the pPage->nFree field.
+*/
+static int btreeComputeFreeSpace(MemPage *pPage){
   int pc;            /* Address of a freeblock within pPage->aData[] */
   u8 hdr;            /* Offset to beginning of page header */
   u8 *data;          /* Equal to pPage->aData */
-  BtShared *pBt;        /* The main btree structure */
   int usableSize;    /* Amount of usable space on each page */
-  u16 cellOffset;    /* Offset from start of page to first cell pointer */
   int nFree;         /* Number of unused bytes on the page */
   int top;           /* First byte of the cell content area */
   int iCellFirst;    /* First allowable cell or freeblock offset */
   int iCellLast;     /* Last possible cell or freeblock offset */
 
   assert( pPage->pBt!=0 );
   assert( pPage->pBt->db!=0 );
   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
   assert( pPage->pgno==sqlite3PagerPagenumber(pPage->pDbPage) );
   assert( pPage == sqlite3PagerGetExtra(pPage->pDbPage) );
   assert( pPage->aData == sqlite3PagerGetData(pPage->pDbPage) );
-  assert( pPage->isInit==0 );
-
-  pBt = pPage->pBt;
+  assert( pPage->isInit==1 );
+  assert( pPage->nFree<0 );
+
+  usableSize = pPage->pBt->usableSize;
   hdr = pPage->hdrOffset;
   data = pPage->aData;
-  /* EVIDENCE-OF: R-28594-02890 The one-byte flag at offset 0 indicating
-  ** the b-tree page type. */
-  if( decodeFlags(pPage, data[hdr]) ){
-    return SQLITE_CORRUPT_PAGE(pPage);
-  }
-  assert( pBt->pageSize>=512 && pBt->pageSize<=65536 );
-  pPage->maskPage = (u16)(pBt->pageSize - 1);
-  pPage->nOverflow = 0;
-  usableSize = pBt->usableSize;
-  pPage->cellOffset = cellOffset = hdr + 8 + pPage->childPtrSize;
-  pPage->aDataEnd = &data[usableSize];
-  pPage->aCellIdx = &data[cellOffset];
-  pPage->aDataOfst = &data[pPage->childPtrSize];
   /* EVIDENCE-OF: R-58015-48175 The two-byte integer at offset 5 designates
   ** the start of the cell content area. A zero value for this integer is
   ** interpreted as 65536. */
   top = get2byteNotZero(&data[hdr+5]);
-  /* EVIDENCE-OF: R-37002-32774 The two-byte integer at offset 3 gives the
-  ** number of cells on the page. */
-  pPage->nCell = get2byte(&data[hdr+3]);
-  if( pPage->nCell>MX_CELL(pBt) ){
-    /* To many cells for a single page.  The page must be corrupt */
-    return SQLITE_CORRUPT_PAGE(pPage);
-  }
-  testcase( pPage->nCell==MX_CELL(pBt) );
-  /* EVIDENCE-OF: R-24089-57979 If a page contains no cells (which is only
-  ** possible for a root page of a table that contains no rows) then the
-  ** offset to the cell content area will equal the page size minus the
-  ** bytes of reserved space. */
-  assert( pPage->nCell>0 || top==usableSize || CORRUPT_DB );
-
-  /* A malformed database page might cause us to read past the end
-  ** of page when parsing a cell.  
-  **
-  ** The following block of code checks early to see if a cell extends
-  ** past the end of a page boundary and causes SQLITE_CORRUPT to be 
-  ** returned if it does.
-  */
-  iCellFirst = cellOffset + 2*pPage->nCell;
+  iCellFirst = hdr + 8 + pPage->childPtrSize + 2*pPage->nCell;
   iCellLast = usableSize - 4;
-  if( pBt->db->flags & SQLITE_CellSizeCk ){
-    int i;            /* Index into the cell pointer array */
-    int sz;           /* Size of a cell */
-
-    if( !pPage->leaf ) iCellLast--;
-    for(i=0; i<pPage->nCell; i++){
-      pc = get2byteAligned(&data[cellOffset+i*2]);
-      testcase( pc==iCellFirst );
-      testcase( pc==iCellLast );
-      if( pc<iCellFirst || pc>iCellLast ){
-        return SQLITE_CORRUPT_PAGE(pPage);
-      }
-      sz = pPage->xCellSize(pPage, &data[pc]);
-      testcase( pc+sz==usableSize );
-      if( pc+sz>usableSize ){
-        return SQLITE_CORRUPT_PAGE(pPage);
-      }
-    }
-    if( !pPage->leaf ) iCellLast++;
-  }  
 
   /* Compute the total free space on the page
   ** EVIDENCE-OF: R-23588-34450 The two-byte integer at offset 1 gives the
   ** start of the first freeblock on the page, or is zero if there are no
   ** freeblocks. */
   pc = get2byte(&data[hdr+1]);
   nFree = data[hdr+7] + top;  /* Init nFree to non-freeblock free space */
   if( pc>0 ){
@@ -65031,17 +65112,110 @@ static int btreeInitPage(MemPage *pPage)
   ** of the page, then the page must be corrupted. This check also
   ** serves to verify that the offset to the start of the cell-content
   ** area, according to the page header, lies within the page.
   */
   if( nFree>usableSize ){
     return SQLITE_CORRUPT_PAGE(pPage);
   }
   pPage->nFree = (u16)(nFree - iCellFirst);
+  return SQLITE_OK;
+}
+
+/*
+** Do additional sanity check after btreeInitPage() if
+** PRAGMA cell_size_check=ON 
+*/
+static SQLITE_NOINLINE int btreeCellSizeCheck(MemPage *pPage){
+  int iCellFirst;    /* First allowable cell or freeblock offset */
+  int iCellLast;     /* Last possible cell or freeblock offset */
+  int i;             /* Index into the cell pointer array */
+  int sz;            /* Size of a cell */
+  int pc;            /* Address of a freeblock within pPage->aData[] */
+  u8 *data;          /* Equal to pPage->aData */
+  int usableSize;    /* Maximum usable space on the page */
+  int cellOffset;    /* Start of cell content area */
+
+  iCellFirst = pPage->cellOffset + 2*pPage->nCell;
+  usableSize = pPage->pBt->usableSize;
+  iCellLast = usableSize - 4;
+  data = pPage->aData;
+  cellOffset = pPage->cellOffset;
+  if( !pPage->leaf ) iCellLast--;
+  for(i=0; i<pPage->nCell; i++){
+    pc = get2byteAligned(&data[cellOffset+i*2]);
+    testcase( pc==iCellFirst );
+    testcase( pc==iCellLast );
+    if( pc<iCellFirst || pc>iCellLast ){
+      return SQLITE_CORRUPT_PAGE(pPage);
+    }
+    sz = pPage->xCellSize(pPage, &data[pc]);
+    testcase( pc+sz==usableSize );
+    if( pc+sz>usableSize ){
+      return SQLITE_CORRUPT_PAGE(pPage);
+    }
+  }
+  return SQLITE_OK;
+}
+
+/*
+** Initialize the auxiliary information for a disk block.
+**
+** Return SQLITE_OK on success.  If we see that the page does
+** not contain a well-formed database page, then return 
+** SQLITE_CORRUPT.  Note that a return of SQLITE_OK does not
+** guarantee that the page is well-formed.  It only shows that
+** we failed to detect any corruption.
+*/
+static int btreeInitPage(MemPage *pPage){
+  u8 *data;          /* Equal to pPage->aData */
+  BtShared *pBt;        /* The main btree structure */
+
+  assert( pPage->pBt!=0 );
+  assert( pPage->pBt->db!=0 );
+  assert( sqlite3_mutex_held(pPage->pBt->mutex) );
+  assert( pPage->pgno==sqlite3PagerPagenumber(pPage->pDbPage) );
+  assert( pPage == sqlite3PagerGetExtra(pPage->pDbPage) );
+  assert( pPage->aData == sqlite3PagerGetData(pPage->pDbPage) );
+  assert( pPage->isInit==0 );
+
+  pBt = pPage->pBt;
+  data = pPage->aData + pPage->hdrOffset;
+  /* EVIDENCE-OF: R-28594-02890 The one-byte flag at offset 0 indicating
+  ** the b-tree page type. */
+  if( decodeFlags(pPage, data[0]) ){
+    return SQLITE_CORRUPT_PAGE(pPage);
+  }
+  assert( pBt->pageSize>=512 && pBt->pageSize<=65536 );
+  pPage->maskPage = (u16)(pBt->pageSize - 1);
+  pPage->nOverflow = 0;
+  pPage->cellOffset = pPage->hdrOffset + 8 + pPage->childPtrSize;
+  pPage->aCellIdx = data + pPage->childPtrSize + 8;
+  pPage->aDataEnd = pPage->aData + pBt->usableSize;
+  pPage->aDataOfst = pPage->aData + pPage->childPtrSize;
+  /* EVIDENCE-OF: R-37002-32774 The two-byte integer at offset 3 gives the
+  ** number of cells on the page. */
+  pPage->nCell = get2byte(&data[3]);
+  if( pPage->nCell>MX_CELL(pBt) ){
+    /* To many cells for a single page.  The page must be corrupt */
+    return SQLITE_CORRUPT_PAGE(pPage);
+  }
+  testcase( pPage->nCell==MX_CELL(pBt) );
+  /* EVIDENCE-OF: R-24089-57979 If a page contains no cells (which is only
+  ** possible for a root page of a table that contains no rows) then the
+  ** offset to the cell content area will equal the page size minus the
+  ** bytes of reserved space. */
+  assert( pPage->nCell>0
+       || get2byteNotZero(&data[5])==(int)pBt->usableSize
+       || CORRUPT_DB );
+  pPage->nFree = -1;  /* Indicate that this value is yet uncomputed */
   pPage->isInit = 1;
+  if( pBt->db->flags & SQLITE_CellSizeCk ){
+    return btreeCellSizeCheck(pPage);
+  }
   return SQLITE_OK;
 }
 
 /*
 ** Set up a raw page so that it looks like a database page holding
 ** no entries.
 */
 static void zeroPage(MemPage *pPage, int flags){
@@ -65174,44 +65348,44 @@ static int getAndInitPage(
   DbPage *pDbPage;
   assert( sqlite3_mutex_held(pBt->mutex) );
   assert( pCur==0 || ppPage==&pCur->pPage );
   assert( pCur==0 || bReadOnly==pCur->curPagerFlags );
   assert( pCur==0 || pCur->iPage>0 );
 
   if( pgno>btreePagecount(pBt) ){
     rc = SQLITE_CORRUPT_BKPT;
-    goto getAndInitPage_error;
+    goto getAndInitPage_error1;
   }
   rc = sqlite3PagerGet(pBt->pPager, pgno, (DbPage**)&pDbPage, bReadOnly);
   if( rc ){
-    goto getAndInitPage_error;
+    goto getAndInitPage_error1;
   }
   *ppPage = (MemPage*)sqlite3PagerGetExtra(pDbPage);
   if( (*ppPage)->isInit==0 ){
     btreePageFromDbPage(pDbPage, pgno, pBt);
     rc = btreeInitPage(*ppPage);
     if( rc!=SQLITE_OK ){
-      releasePage(*ppPage);
-      goto getAndInitPage_error;
+      goto getAndInitPage_error2;
     }
   }
   assert( (*ppPage)->pgno==pgno );
   assert( (*ppPage)->aData==sqlite3PagerGetData(pDbPage) );
 
   /* If obtaining a child page for a cursor, we must verify that the page is
   ** compatible with the root page. */
   if( pCur && ((*ppPage)->nCell<1 || (*ppPage)->intKey!=pCur->curIntKey) ){
     rc = SQLITE_CORRUPT_PGNO(pgno);
-    releasePage(*ppPage);
-    goto getAndInitPage_error;
-  }
-  return SQLITE_OK;
-
-getAndInitPage_error:
+    goto getAndInitPage_error2;
+  }
+  return SQLITE_OK;
+
+getAndInitPage_error2:
+  releasePage(*ppPage);
+getAndInitPage_error1:
   if( pCur ){
     pCur->iPage--;
     pCur->pPage = pCur->apPage[pCur->iPage];
   }
   testcase( pgno==0 );
   assert( pgno!=0 || rc==SQLITE_CORRUPT );
   return rc;
 }
@@ -68282,33 +68456,16 @@ SQLITE_PRIVATE int sqlite3BtreeFirst(BtC
   }else if( rc==SQLITE_EMPTY ){
     assert( pCur->pgnoRoot==0 || pCur->pPage->nCell==0 );
     *pRes = 1;
     rc = SQLITE_OK;
   }
   return rc;
 }
 
-/*
-** This function is a no-op if cursor pCur does not point to a valid row.
-** Otherwise, if pCur is valid, configure it so that the next call to
-** sqlite3BtreeNext() is a no-op.
-*/
-#ifndef SQLITE_OMIT_WINDOWFUNC
-SQLITE_PRIVATE void sqlite3BtreeSkipNext(BtCursor *pCur){
-  /* We believe that the cursor must always be in the valid state when
-  ** this routine is called, but the proof is difficult, so we add an
-  ** ALWaYS() test just in case we are wrong. */
-  if( ALWAYS(pCur->eState==CURSOR_VALID) ){
-    pCur->eState = CURSOR_SKIPNEXT;
-    pCur->skipNext = 1;
-  }
-}
-#endif /* SQLITE_OMIT_WINDOWFUNC */
-
 /* Move the cursor to the last entry in the table.  Return SQLITE_OK
 ** on success.  Set *pRes to 0 if the cursor actually points to something
 ** or set *pRes to 1 if the table is empty.
 */
 SQLITE_PRIVATE int sqlite3BtreeLast(BtCursor *pCur, int *pRes){
   int rc;
  
   assert( cursorOwnsBtShared(pCur) );
@@ -68564,17 +68721,17 @@ SQLITE_PRIVATE int sqlite3BtreeMovetoUnp
           }
           pCur->ix = (u16)idx;
           rc = accessPayload(pCur, 0, nCell, (unsigned char*)pCellKey, 0);
           pCur->curFlags &= ~BTCF_ValidOvfl;
           if( rc ){
             sqlite3_free(pCellKey);
             goto moveto_finish;
           }
-          c = xRecordCompare(nCell, pCellKey, pIdxKey);
+          c = sqlite3VdbeRecordCompare(nCell, pCellKey, pIdxKey);
           sqlite3_free(pCellKey);
         }
         assert( 
             (pIdxKey->errCode!=SQLITE_CORRUPT || c==0)
          && (pIdxKey->errCode!=SQLITE_NOMEM || pCur->pBtree->db->mallocFailed)
         );
         if( c<0 ){
           lwr = idx+1;
@@ -69196,23 +69353,25 @@ end_allocate_page:
 ** its reference count is not altered by this function.
 */
 static int freePage2(BtShared *pBt, MemPage *pMemPage, Pgno iPage){
   MemPage *pTrunk = 0;                /* Free-list trunk page */
   Pgno iTrunk = 0;                    /* Page number of free-list trunk page */ 
   MemPage *pPage1 = pBt->pPage1;      /* Local reference to page 1 */
   MemPage *pPage;                     /* Page being freed. May be NULL. */
   int rc;                             /* Return Code */
-  int nFree;                          /* Initial number of pages on free-list */
+  u32 nFree;                          /* Initial number of pages on free-list */
 
   assert( sqlite3_mutex_held(pBt->mutex) );
   assert( CORRUPT_DB || iPage>1 );
   assert( !pMemPage || pMemPage->pgno==iPage );
 
-  if( iPage<2 ) return SQLITE_CORRUPT_BKPT;
+  if( iPage<2 || iPage>pBt->nPage ){
+    return SQLITE_CORRUPT_BKPT;
+  }
   if( pMemPage ){
     pPage = pMemPage;
     sqlite3PagerRef(pPage->pDbPage);
   }else{
     pPage = btreePageLookup(pBt, iPage);
   }
 
   /* Increment the free page count on pPage1 */
@@ -69613,16 +69772,17 @@ static void dropCell(MemPage *pPage, int
   int rc;         /* The return code */
   int hdr;        /* Beginning of the header.  0 most pages.  100 page 1 */
 
   if( *pRC ) return;
   assert( idx>=0 && idx<pPage->nCell );
   assert( CORRUPT_DB || sz==cellSize(pPage, idx) );
   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
+  assert( pPage->nFree>=0 );
   data = pPage->aData;
   ptr = &pPage->aCellIdx[2*idx];
   pc = get2byte(ptr);
   hdr = pPage->hdrOffset;
   testcase( pc==get2byte(&data[hdr+5]) );
   testcase( pc+sz==pPage->pBt->usableSize );
   if( pc+sz > pPage->pBt->usableSize ){
     *pRC = SQLITE_CORRUPT_BKPT;
@@ -69683,16 +69843,17 @@ static void insertCell(
   assert( ArraySize(pPage->apOvfl)==ArraySize(pPage->aiOvfl) );
   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
   /* The cell should normally be sized correctly.  However, when moving a
   ** malformed cell from a leaf page to an interior page, if the cell size
   ** wanted to be less than 4 but got rounded up to 4 on the leaf, then size
   ** might be less than 8 (leaf-size + pointer) on the interior node.  Hence
   ** the term after the || in the following assert(). */
   assert( sz==pPage->xCellSize(pPage, pCell) || (sz==8 && iChild>0) );
+  assert( pPage->nFree>=0 );
   if( pPage->nOverflow || sz+2>pPage->nFree ){
     if( pTemp ){
       memcpy(pTemp, pCell, sz);
       pCell = pTemp;
     }
     if( iChild ){
       put4byte(pCell, iChild);
     }
@@ -69740,17 +69901,17 @@ static void insertCell(
       memcpy(&data[idx], pCell, sz);
     }
     pIns = pPage->aCellIdx + i*2;
     memmove(pIns+2, pIns, 2*(pPage->nCell - i));
     put2byte(pIns, idx);
     pPage->nCell++;
     /* increment the cell count */
     if( (++data[pPage->hdrOffset+4])==0 ) data[pPage->hdrOffset+3]++;
-    assert( get2byte(&data[pPage->hdrOffset+3])==pPage->nCell );
+    assert( get2byte(&data[pPage->hdrOffset+3])==pPage->nCell || CORRUPT_DB );
 #ifndef SQLITE_OMIT_AUTOVACUUM
     if( pPage->pBt->autoVacuum ){
       /* The cell may contain a pointer to an overflow page. If so, write
       ** the entry for the overflow page into the pointer map.
       */
       ptrmapPutOvflPtr(pPage, pPage, pCell, pRC);
     }
 #endif
@@ -69827,18 +69988,23 @@ static void insertCell(
 **    ixNx[2] = Number of cells in Child-1 and Child-2 + 1 for 1st divider.
 **    ixNx[3] = Number of cells in Child-1 and Child-2 + both divider cells
 **    ixNx[4] = Total number of cells.
 **
 ** For a table-btree, the concept is similar, except only apEnd[0]..apEnd[2]
 ** are used and they point to the leaf pages only, and the ixNx value are:
 **
 **    ixNx[0] = Number of cells in Child-1.
-**    ixNx[1] = Number of cells in Child-1 and Child-2 + 1 for 1st divider.
-**    ixNx[2] = Number of cells in Child-1 and Child-2 + both divider cells
+**    ixNx[1] = Number of cells in Child-1 and Child-2.
+**    ixNx[2] = Total number of cells.
+**
+** Sometimes when deleting, a child page can have zero cells.  In those
+** cases, ixNx[] entries with higher indexes, and the corresponding apEnd[]
+** entries, shift down.  The end result is that each ixNx[] entry should
+** be larger than the previous
 */
 typedef struct CellArray CellArray;
 struct CellArray {
   int nCell;              /* Number of cells in apCell[] */
   MemPage *pRef;          /* Reference page */
   u8 **apCell;            /* All cells begin balanced */
   u16 *szCell;            /* Local size of all cells in apCell[] */
   u8 *apEnd[NB*2];        /* MemPage.aDataEnd values */
@@ -70157,18 +70323,19 @@ static int editPage(
     nCell += nAdd;
   }
 
   /* Add any overflow cells */
   for(i=0; i<pPg->nOverflow; i++){
     int iCell = (iOld + pPg->aiOvfl[i]) - iNew;
     if( iCell>=0 && iCell<nNew ){
       pCellptr = &pPg->aCellIdx[iCell * 2];
-      assert( nCell>=iCell );
-      memmove(&pCellptr[2], pCellptr, (nCell - iCell) * 2);
+      if( nCell>iCell ){
+        memmove(&pCellptr[2], pCellptr, (nCell - iCell) * 2);
+      }
       nCell++;
       if( pageInsertArray(
             pPg, pBegin, &pData, pCellptr,
             iCell+iNew, 1, pCArray
       ) ) goto editpage_fail;
     }
   }
 
@@ -70234,18 +70401,20 @@ static int balance_quick(MemPage *pParen
   BtShared *const pBt = pPage->pBt;    /* B-Tree Database */
   MemPage *pNew;                       /* Newly allocated page */
   int rc;                              /* Return Code */
   Pgno pgnoNew;                        /* Page number of pNew */
 
   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
   assert( sqlite3PagerIswriteable(pParent->pDbPage) );
   assert( pPage->nOverflow==1 );
-
+  
   if( pPage->nCell==0 ) return SQLITE_CORRUPT_BKPT;  /* dbfuzz001.test */
+  assert( pPage->nFree>=0 );
+  assert( pParent->nFree>=0 );
 
   /* Allocate a new page. This page will become the right-sibling of 
   ** pPage. Make the parent page writable, so that the new divider cell
   ** may be inserted. If both these operations are successful, proceed.
   */
   rc = allocateBtreePage(pBt, &pNew, &pgnoNew, 0, 0);
 
   if( rc==SQLITE_OK ){
@@ -70405,16 +70574,17 @@ static void copyNodeContent(MemPage *pFr
   
     /* Reinitialize page pTo so that the contents of the MemPage structure
     ** match the new data. The initialization of pTo can actually fail under
     ** fairly obscure circumstances, even though it is a copy of initialized 
     ** page pFrom.
     */
     pTo->isInit = 0;
     rc = btreeInitPage(pTo);
+    if( rc==SQLITE_OK ) rc = btreeComputeFreeSpace(pTo);
     if( rc!=SQLITE_OK ){
       *pRC = rc;
       return;
     }
   
     /* If this is an auto-vacuum database, update the pointer-map entries
     ** for any b-tree or overflow pages that pTo now contains the pointers to.
     */
@@ -70513,16 +70683,17 @@ static int balance_nonroot(
   ** is called (indirectly) from sqlite3BtreeDelete().
   */
   assert( pParent->nOverflow==0 || pParent->nOverflow==1 );
   assert( pParent->nOverflow==0 || pParent->aiOvfl[0]==iParentIdx );
 
   if( !aOvflSpace ){
     return SQLITE_NOMEM_BKPT;
   }
+  assert( pParent->nFree>=0 );
 
   /* Find the sibling pages to balance. Also locate the cells in pParent 
   ** that divide the siblings. An attempt is made to find NN siblings on 
   ** either side of pPage. More siblings are taken from one side, however, 
   ** if there are fewer than NN siblings on the other side. If pParent
   ** has NB or fewer children then all children of pParent are taken.  
   **
   ** This loop also drops the divider cells from the parent page. This
@@ -70552,17 +70723,23 @@ static int balance_nonroot(
   }
   pgno = get4byte(pRight);
   while( 1 ){
     rc = getAndInitPage(pBt, pgno, &apOld[i], 0, 0);
     if( rc ){
       memset(apOld, 0, (i+1)*sizeof(MemPage*));
       goto balance_cleanup;
     }
-    nMaxCells += 1+apOld[i]->nCell+apOld[i]->nOverflow;
+    if( apOld[i]->nFree<0 ){
+      rc = btreeComputeFreeSpace(apOld[i]);
+      if( rc ){
+        memset(apOld, 0, (i)*sizeof(MemPage*));
+        goto balance_cleanup;
+      }
+    }
     if( (i--)==0 ) break;
 
     if( pParent->nOverflow && i+nxDiv==pParent->aiOvfl[0] ){
       apDiv[i] = pParent->apOvfl[0];
       pgno = get4byte(apDiv[i]);
       szNew[i] = pParent->xCellSize(pParent, apDiv[i]);
       pParent->nOverflow = 0;
     }else{
@@ -70596,27 +70773,28 @@ static int balance_nonroot(
         }
       }
       dropCell(pParent, i+nxDiv-pParent->nOverflow, szNew[i], &rc);
     }
   }
 
   /* Make nMaxCells a multiple of 4 in order to preserve 8-byte
   ** alignment */
+  nMaxCells = nOld*(MX_CELL(pBt) + ArraySize(pParent->apOvfl));
   nMaxCells = (nMaxCells + 3)&~3;
 
   /*
   ** Allocate space for memory structures
   */
   szScratch =
        nMaxCells*sizeof(u8*)                       /* b.apCell */
      + nMaxCells*sizeof(u16)                       /* b.szCell */
      + pBt->pageSize;                              /* aSpace1 */
 
-  assert( szScratch<=6*(int)pBt->pageSize );
+  assert( szScratch<=7*(int)pBt->pageSize );
   b.apCell = sqlite3StackAllocRaw(0, szScratch );
   if( b.apCell==0 ){
     rc = SQLITE_NOMEM_BKPT;
     goto balance_cleanup;
   }
   b.szCell = (u16*)&b.apCell[nMaxCells];
   aSpace1 = (u8*)&b.szCell[nMaxCells];
   assert( EIGHT_BYTE_ALIGNMENT(aSpace1) );
@@ -70746,21 +70924,25 @@ static int balance_nonroot(
   ** usableSpace: Number of bytes of space available on each sibling.
   ** 
   */
   usableSpace = pBt->usableSize - 12 + leafCorrection;
   for(i=k=0; i<nOld; i++, k++){
     MemPage *p = apOld[i];
     b.apEnd[k] = p->aDataEnd;
     b.ixNx[k] = cntOld[i];
+    if( k && b.ixNx[k]==b.ixNx[k-1] ){
+      k--;  /* Omit b.ixNx[] entry for child pages with no cells */
+    }
     if( !leafData ){
       k++;
       b.apEnd[k] = pParent->aDataEnd;
       b.ixNx[k] = cntOld[i]+1;
     }
+    assert( p->nFree>=0 );
     szNew[i] = usableSpace - p->nFree;
     for(j=0; j<p->nOverflow; j++){
       szNew[i] += 2 + p->xCellSize(p, p->apOvfl[j]);
     }
     cntNew[i] = cntOld[i];
   }
   k = nOld;
   for(i=0; i<k; i++){
@@ -70976,43 +71158,42 @@ static int balance_nonroot(
   ** If the sibling pages are not leaves, then the pointer map entry 
   ** associated with the right-child of each sibling may also need to be 
   ** updated. This happens below, after the sibling pages have been 
   ** populated, not here.
   */
   if( ISAUTOVACUUM ){
     MemPage *pOld;
     MemPage *pNew = pOld = apNew[0];
-    u8 *aOld = pNew->aData;
     int cntOldNext = pNew->nCell + pNew->nOverflow;
-    int usableSize = pBt->usableSize;
     int iNew = 0;
     int iOld = 0;
 
     for(i=0; i<b.nCell; i++){
       u8 *pCell = b.apCell[i];
-      if( i==cntOldNext ){
-        pOld = (++iOld)<nNew ? apNew[iOld] : apOld[iOld];
+      while( i==cntOldNext ){
+        iOld++;
+        assert( iOld<nNew || iOld<nOld );
+        pOld = iOld<nNew ? apNew[iOld] : apOld[iOld];
         cntOldNext += pOld->nCell + pOld->nOverflow + !leafData;
-        aOld = pOld->aData;
       }
       if( i==cntNew[iNew] ){
         pNew = apNew[++iNew];
         if( !leafData ) continue;
       }
 
       /* Cell pCell is destined for new sibling page pNew. Originally, it
       ** was either part of sibling page iOld (possibly an overflow cell), 
       ** or else the divider cell to the left of sibling page iOld. So,
       ** if sibling page iOld had the same page number as pNew, and if
       ** pCell really was a part of sibling page iOld (not a divider or
       ** overflow cell), we can skip updating the pointer map entries.  */
       if( iOld>=nNew
        || pNew->pgno!=aPgno[iOld]
-       || !SQLITE_WITHIN(pCell,aOld,&aOld[usableSize])
+       || !SQLITE_WITHIN(pCell,pOld->aData,pOld->aDataEnd)
       ){
         if( !leafCorrection ){
           ptrmapPut(pBt, get4byte(pCell), PTRMAP_BTREE, pNew->pgno, &rc);
         }
         if( cachedCellSize(&b,i)>pNew->minLocal ){
           ptrmapPutOvflPtr(pNew, pOld, pCell, &rc);
         }
         if( rc ) goto balance_cleanup;
@@ -71153,17 +71334,18 @@ static int balance_nonroot(
     ** copied into the parent, because if the parent is page 1 then it will
     ** by smaller than the child due to the database header, and so all the
     ** free space needs to be up front.
     */
     assert( nNew==1 || CORRUPT_DB );
     rc = defragmentPage(apNew[0], -1);
     testcase( rc!=SQLITE_OK );
     assert( apNew[0]->nFree == 
-        (get2byte(&apNew[0]->aData[5])-apNew[0]->cellOffset-apNew[0]->nCell*2)
+        (get2byteNotZero(&apNew[0]->aData[5]) - apNew[0]->cellOffset
+          - apNew[0]->nCell*2)
       || rc!=SQLITE_OK
     );
     copyNodeContent(apNew[0], pParent, &rc);
     freePage(apNew[0], &rc);
   }else if( ISAUTOVACUUM && !leafCorrection ){
     /* Fix the pointer map entries associated with the right-child of each
     ** sibling page. All other pointer map entries have already been taken
     ** care of.  */
@@ -71252,17 +71434,17 @@ static int balance_deeper(MemPage *pRoot
   }
   if( rc ){
     *ppChild = 0;
     releasePage(pChild);
     return rc;
   }
   assert( sqlite3PagerIswriteable(pChild->pDbPage) );
   assert( sqlite3PagerIswriteable(pRoot->pDbPage) );
-  assert( pChild->nCell==pRoot->nCell );
+  assert( pChild->nCell==pRoot->nCell || CORRUPT_DB );
 
   TRACE(("BALANCE: copy root %d into %d\n", pRoot->pgno, pChild->pgno));
 
   /* Copy the overflow cells from pRoot to pChild */
   memcpy(pChild->aiOvfl, pRoot->aiOvfl,
          pRoot->nOverflow*sizeof(pRoot->aiOvfl[0]));
   memcpy(pChild->apOvfl, pRoot->apOvfl,
          pRoot->nOverflow*sizeof(pRoot->apOvfl[0]));
@@ -71294,16 +71476,17 @@ static int balance(BtCursor *pCur){
 
   VVA_ONLY( int balance_quick_called = 0 );
   VVA_ONLY( int balance_deeper_called = 0 );
 
   do {
     int iPage = pCur->iPage;
     MemPage *pPage = pCur->pPage;
 
+    if( NEVER(pPage->nFree<0) && btreeComputeFreeSpace(pPage) ) break;
     if( iPage==0 ){
       if( pPage->nOverflow ){
         /* The root page of the b-tree is overfull. In this case call the
         ** balance_deeper() function to create a new child for the root-page
         ** and copy the current contents of the root-page to it. The
         ** next iteration of the do-loop will balance the child page.
         */ 
         assert( balance_deeper_called==0 );
@@ -71322,16 +71505,19 @@ static int balance(BtCursor *pCur){
       }
     }else if( pPage->nOverflow==0 && pPage->nFree<=nMin ){
       break;
     }else{
       MemPage * const pParent = pCur->apPage[iPage-1];
       int const iIdx = pCur->aiIdx[iPage-1];
 
       rc = sqlite3PagerWrite(pParent->pDbPage);
+      if( rc==SQLITE_OK && pParent->nFree<0 ){
+        rc = btreeComputeFreeSpace(pParent);
+      }
       if( rc==SQLITE_OK ){
 #ifndef SQLITE_OMIT_QUICKBALANCE
         if( pPage->intKeyLeaf
          && pPage->nOverflow==1
          && pPage->aiOvfl[0]==pPage->nCell
          && pParent->pgno!=1
          && pParent->nCell==iIdx
         ){
@@ -71668,16 +71854,20 @@ SQLITE_PRIVATE int sqlite3BtreeInsert(
     }
 
   }
   assert( pCur->eState==CURSOR_VALID || (pCur->eState==CURSOR_INVALID && loc) );
 
   pPage = pCur->pPage;
   assert( pPage->intKey || pX->nKey>=0 );
   assert( pPage->leaf || !pPage->intKey );
+  if( pPage->nFree<0 ){
+    rc = btreeComputeFreeSpace(pPage);
+    if( rc ) return rc;
+  }
 
   TRACE(("INSERT: table=%d nkey=%lld ndata=%d page=%d %s\n",
           pCur->pgnoRoot, pX->nKey, pX->nData, pPage->pgno,
           loc==0 ? "overwrite" : "new entry"));
   assert( pPage->isInit );
   newCell = pBt->pTmpSpace;
   assert( newCell!=0 );
   rc = fillInCell(pPage, newCell, pX, &szNew);
@@ -71810,24 +72000,28 @@ SQLITE_PRIVATE int sqlite3BtreeDelete(Bt
   u8 bPreserve = flags & BTREE_SAVEPOSITION;  /* Keep cursor valid */
 
   assert( cursorOwnsBtShared(pCur) );
   assert( pBt->inTransaction==TRANS_WRITE );
   assert( (pBt->btsFlags & BTS_READ_ONLY)==0 );
   assert( pCur->curFlags & BTCF_WriteFlag );
   assert( hasSharedCacheTableLock(p, pCur->pgnoRoot, pCur->pKeyInfo!=0, 2) );
   assert( !hasReadConflicts(p, pCur->pgnoRoot) );
-  assert( pCur->ix<pCur->pPage->nCell );
+  assert( (flags & ~(BTREE_SAVEPOSITION | BTREE_AUXDELETE))==0 );
+  if( pCur->eState==CURSOR_REQUIRESEEK ){
+    rc = btreeRestoreCursorPosition(pCur);
+    if( rc ) return rc;
+  }
   assert( pCur->eState==CURSOR_VALID );
-  assert( (flags & ~(BTREE_SAVEPOSITION | BTREE_AUXDELETE))==0 );
 
   iCellDepth = pCur->iPage;
   iCellIdx = pCur->ix;
   pPage = pCur->pPage;
   pCell = findCell(pPage, iCellIdx);
+  if( pPage->nFree<0 && btreeComputeFreeSpace(pPage) ) return SQLITE_CORRUPT;
 
   /* If the bPreserve flag is set to true, then the cursor position must
   ** be preserved following this delete operation. If the current delete
   ** will cause a b-tree rebalance, then this is done by saving the cursor
   ** key and leaving the cursor in CURSOR_REQUIRESEEK state before 
   ** returning. 
   **
   ** Or, if the current delete will not cause a rebalance, then the cursor
@@ -71888,16 +72082,20 @@ SQLITE_PRIVATE int sqlite3BtreeDelete(Bt
   ** node. The cell from the leaf node needs to be moved to the internal
   ** node to replace the deleted cell.  */
   if( !pPage->leaf ){
     MemPage *pLeaf = pCur->pPage;
     int nCell;
     Pgno n;
     unsigned char *pTmp;
 
+    if( pLeaf->nFree<0 ){
+      rc = btreeComputeFreeSpace(pLeaf);
+      if( rc ) return rc;
+    }
     if( iCellDepth<pCur->iPage-1 ){
       n = pCur->apPage[iCellDepth+1]->pgno;
     }else{
       n = pCur->pPage->pgno;
     }
     pCell = findCell(pLeaf, pLeaf->nCell-1);
     if( pCell<&pLeaf->aData[4] ) return SQLITE_CORRUPT_BKPT;
     nCell = pLeaf->xCellSize(pLeaf, pCell);
@@ -72246,16 +72444,19 @@ SQLITE_PRIVATE int sqlite3BtreeClearTabl
 static int btreeDropTable(Btree *p, Pgno iTable, int *piMoved){
   int rc;
   MemPage *pPage = 0;
   BtShared *pBt = p->pBt;
 
   assert( sqlite3BtreeHoldsMutex(p) );
   assert( p->inTrans==TRANS_WRITE );
   assert( iTable>=2 );
+  if( iTable>btreePagecount(pBt) ){
+    return SQLITE_CORRUPT_BKPT;
+  }
 
   rc = btreeGetPage(pBt, (Pgno)iTable, &pPage, 0);
   if( rc ) return rc;
   rc = sqlite3BtreeClearTable(p, iTable, 0);
   if( rc ){
     releasePage(pPage);
     return rc;
   }
@@ -72594,20 +72795,20 @@ static void checkPtrmap(
 /*
 ** Check the integrity of the freelist or of an overflow page list.
 ** Verify that the number of pages on the list is N.
 */
 static void checkList(
   IntegrityCk *pCheck,  /* Integrity checking context */
   int isFreeList,       /* True for a freelist.  False for overflow page list */
   int iPage,            /* Page number for first page in the list */
-  int N                 /* Expected number of pages in the list */
-){
-  int i;
-  int expected = N;
+  u32 N                 /* Expected number of pages in the list */
+){
+  int i;
+  u32 expected = N;
   int nErrAtStart = pCheck->nErr;
   while( iPage!=0 && pCheck->mxErr ){
     DbPage *pOvflPage;
     unsigned char *pOvflData;
     if( checkRef(pCheck, iPage) ) break;
     N--;
     if( sqlite3PagerGet(pCheck->pPager, (Pgno)iPage, &pOvflPage, 0) ){
       checkAppendMsg(pCheck, "failed to get page %d", iPage);
@@ -72779,16 +72980,21 @@ static int checkTreePage(
   savedIsInit = pPage->isInit;
   pPage->isInit = 0;
   if( (rc = btreeInitPage(pPage))!=0 ){
     assert( rc==SQLITE_CORRUPT );  /* The only possible error from InitPage */
     checkAppendMsg(pCheck,
                    "btreeInitPage() returns error code %d", rc);
     goto end_of_check;
   }
+  if( (rc = btreeComputeFreeSpace(pPage))!=0 ){
+    assert( rc==SQLITE_CORRUPT );
+    checkAppendMsg(pCheck, "free space corruption", rc);
+    goto end_of_check;
+  }
   data = pPage->aData;
   hdr = pPage->hdrOffset;
 
   /* Set up for cell analysis */
   pCheck->zPfx = "On tree page %d cell %d: ";
   contentOffset = get2byteNotZero(&data[hdr+5]);
   assert( contentOffset<=usableSize );  /* Enforced by btreeInitPage() */
 
@@ -72851,17 +73057,17 @@ static int checkTreePage(
         checkAppendMsg(pCheck, "Rowid %lld out of order", info.nKey);
       }
       maxKey = info.nKey;
       keyCanBeEqual = 0;     /* Only the first key on the page may ==maxKey */
     }
 
     /* Check the content overflow list */
     if( info.nPayload>info.nLocal ){
-      int nPage;       /* Number of pages on the overflow chain */
+      u32 nPage;       /* Number of pages on the overflow chain */
       Pgno pgnoOvfl;   /* First page of the overflow chain */
       assert( pc + info.nSize - 4 <= usableSize );
       nPage = (info.nPayload - info.nLocal + usableSize - 5)/(usableSize - 4);
       pgnoOvfl = get4byte(&pCell[info.nSize - 4]);
 #ifndef SQLITE_OMIT_AUTOVACUUM
       if( pBt->autoVacuum ){
         checkPtrmap(pCheck, pgnoOvfl, PTRMAP_OVERFLOW1, iPage);
       }
@@ -72911,29 +73117,29 @@ static int checkTreePage(
     **
     ** EVIDENCE-OF: R-20690-50594 The second field of the b-tree page header
     ** is the offset of the first freeblock, or zero if there are no
     ** freeblocks on the page. 
     */
     i = get2byte(&data[hdr+1]);
     while( i>0 ){
       int size, j;
-      assert( (u32)i<=usableSize-4 );     /* Enforced by btreeInitPage() */
+      assert( (u32)i<=usableSize-4 ); /* Enforced by btreeComputeFreeSpace() */
       size = get2byte(&data[i+2]);
-      assert( (u32)(i+size)<=usableSize );  /* Enforced by btreeInitPage() */
+      assert( (u32)(i+size)<=usableSize ); /* due to btreeComputeFreeSpace() */
       btreeHeapInsert(heap, (((u32)i)<<16)|(i+size-1));
       /* EVIDENCE-OF: R-58208-19414 The first 2 bytes of a freeblock are a
       ** big-endian integer which is the offset in the b-tree page of the next
       ** freeblock in the chain, or zero if the freeblock is the last on the
       ** chain. */
       j = get2byte(&data[i]);
       /* EVIDENCE-OF: R-06866-39125 Freeblocks are always connected in order of
       ** increasing offset. */
-      assert( j==0 || j>i+size );  /* Enforced by btreeInitPage() */
-      assert( (u32)j<=usableSize-4 );   /* Enforced by btreeInitPage() */
+      assert( j==0 || j>i+size );     /* Enforced by btreeComputeFreeSpace() */
+      assert( (u32)j<=usableSize-4 ); /* Enforced by btreeComputeFreeSpace() */
       i = j;
     }
     /* Analyze the min-heap looking for overlap between cells and/or 
     ** freeblocks, and counting the number of untracked bytes in nFrag.
     ** 
     ** Each min-heap entry is of the form:    (start_address<<16)|end_address.
     ** There is an implied first entry the covers the page header, the cell
     ** pointer index, and the gap between the cell pointer index and the start
@@ -74267,17 +74473,17 @@ SQLITE_PRIVATE int sqlite3VdbeCheckMemIn
     if( (p->flags & (MEM_Term|MEM_Subtype))==(MEM_Term|MEM_Subtype) ){
       /* This is a pointer type.  There may be a flag to indicate what to
       ** do with the pointer. */
       assert( ((p->flags&MEM_Dyn)!=0 ? 1 : 0) +
               ((p->flags&MEM_Ephem)!=0 ? 1 : 0) +
               ((p->flags&MEM_Static)!=0 ? 1 : 0) <= 1 );
 
       /* No other bits set */
-      assert( (p->flags & ~(MEM_Null|MEM_Term|MEM_Subtype
+      assert( (p->flags & ~(MEM_Null|MEM_Term|MEM_Subtype|MEM_FromBind
                            |MEM_Dyn|MEM_Ephem|MEM_Static))==0 );
     }else{
       /* A pure NULL might have other flags, such as MEM_Static, MEM_Dyn,
       ** MEM_Ephem, MEM_Cleared, or MEM_Subtype */
     }
   }else{
     /* The MEM_Cleared bit is only allowed on NULLs */
     assert( (p->flags & MEM_Cleared)==0 );
@@ -74388,18 +74594,17 @@ SQLITE_PRIVATE int sqlite3VdbeChangeEnco
   assert(rc==SQLITE_OK    || rc==SQLITE_NOMEM);
   assert(rc==SQLITE_OK    || pMem->enc!=desiredEnc);
   assert(rc==SQLITE_NOMEM || pMem->enc==desiredEnc);
   return rc;
 #endif
 }
 
 /*
-** Make sure pMem->z points to a writable allocation of at least 
-** min(n,32) bytes.
+** Make sure pMem->z points to a writable allocation of at least n bytes.
 **
 ** If the bPreserve argument is true, then copy of the content of
 ** pMem->z into the new allocation.  pMem must be either a string or
 ** blob if bPreserve is true.  If bPreserve is false, any prior content
 ** in pMem->z is discarded.
 */
 SQLITE_PRIVATE SQLITE_NOINLINE int sqlite3VdbeMemGrow(Mem *pMem, int n, int bPreserve){
   assert( sqlite3VdbeCheckMemInvariants(pMem) );
@@ -74408,17 +74613,16 @@ SQLITE_PRIVATE SQLITE_NOINLINE int sqlit
 
   /* If the bPreserve flag is set to true, then the memory cell must already
   ** contain a valid string or blob value.  */
   assert( bPreserve==0 || pMem->flags&(MEM_Blob|MEM_Str) );
   testcase( bPreserve && pMem->z==0 );
 
   assert( pMem->szMalloc==0
        || pMem->szMalloc==sqlite3DbMallocSize(pMem->db, pMem->zMalloc) );
-  if( n<32 ) n = 32;
   if( pMem->szMalloc>0 && bPreserve && pMem->z==pMem->zMalloc ){
     pMem->z = pMem->zMalloc = sqlite3DbReallocOrFree(pMem->db, pMem->z, n);
     bPreserve = 0;
   }else{
     if( pMem->szMalloc>0 ) sqlite3DbFreeNN(pMem->db, pMem->zMalloc);
     pMem->zMalloc = sqlite3DbMallocRaw(pMem->db, n);
   }
   if( pMem->zMalloc==0 ){
@@ -74510,23 +74714,25 @@ SQLITE_PRIVATE int sqlite3VdbeMemMakeWri
 /*
 ** If the given Mem* has a zero-filled tail, turn it into an ordinary
 ** blob stored in dynamically allocated space.
 */
 #ifndef SQLITE_OMIT_INCRBLOB
 SQLITE_PRIVATE int sqlite3VdbeMemExpandBlob(Mem *pMem){
   int nByte;
   assert( pMem->flags & MEM_Zero );
-  assert( pMem->flags&MEM_Blob );
+  assert( (pMem->flags&MEM_Blob)!=0 || MemNullNochng(pMem) );
+  testcase( sqlite3_value_nochange(pMem) );
   assert( !sqlite3VdbeMemIsRowSet(pMem) );
   assert( pMem->db==0 || sqlite3_mutex_held(pMem->db->mutex) );
 
   /* Set nByte to the number of bytes required to store the expanded blob. */
   nByte = pMem->n + pMem->u.nZero;
   if( nByte<=0 ){
+    if( (pMem->flags & MEM_Blob)==0 ) return SQLITE_OK;
     nByte = 1;
   }
   if( sqlite3VdbeMemGrow(pMem, nByte, 1) ){
     return SQLITE_NOMEM_BKPT;
   }
 
   memset(&pMem->z[pMem->n], 0, pMem->u.nZero);
   pMem->n += pMem->u.nZero;
@@ -75257,51 +75463,51 @@ SQLITE_PRIVATE int sqlite3VdbeMemSetStr(
   }else{
     iLimit = SQLITE_MAX_LENGTH;
   }
   flags = (enc==0?MEM_Blob:MEM_Str);
   if( nByte<0 ){
     assert( enc!=0 );
     if( enc==SQLITE_UTF8 ){
       nByte = 0x7fffffff & (int)strlen(z);
-      if( nByte>iLimit ) nByte = iLimit+1;
     }else{
       for(nByte=0; nByte<=iLimit && (z[nByte] | z[nByte+1]); nByte+=2){}
     }
     flags |= MEM_Term;
   }
 
   /* The following block sets the new values of Mem.z and Mem.xDel. It
   ** also sets a flag in local variable "flags" to indicate the memory
   ** management (one of MEM_Dyn or MEM_Static).
   */
   if( xDel==SQLITE_TRANSIENT ){
-    int nAlloc = nByte;
+    u32 nAlloc = nByte;
     if( flags&MEM_Term ){
       nAlloc += (enc==SQLITE_UTF8?1:2);
     }
     if( nByte>iLimit ){
-      return SQLITE_TOOBIG;
+      return sqlite3ErrorToParser(pMem->db, SQLITE_TOOBIG);
     }
     testcase( nAlloc==0 );
     testcase( nAlloc==31 );
     testcase( nAlloc==32 );
-    if( sqlite3VdbeMemClearAndResize(pMem, MAX(nAlloc,32)) ){
+    if( sqlite3VdbeMemClearAndResize(pMem, (int)MAX(nAlloc,32)) ){
       return SQLITE_NOMEM_BKPT;
     }
     memcpy(pMem->z, z, nAlloc);
-  }else if( xDel==SQLITE_DYNAMIC ){
-    sqlite3VdbeMemRelease(pMem);
-    pMem->zMalloc = pMem->z = (char *)z;
-    pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
   }else{
     sqlite3VdbeMemRelease(pMem);
     pMem->z = (char *)z;
-    pMem->xDel = xDel;
-    flags |= ((xDel==SQLITE_STATIC)?MEM_Static:MEM_Dyn);
+    if( xDel==SQLITE_DYNAMIC ){
+      pMem->zMalloc = pMem->z;
+      pMem->szMalloc = sqlite3DbMallocSize(pMem->db, pMem->zMalloc);
+    }else{
+      pMem->xDel = xDel;
+      flags |= ((xDel==SQLITE_STATIC)?MEM_Static:MEM_Dyn);
+    }
   }
 
   pMem->n = nByte;
   pMem->flags = flags;
   pMem->enc = (enc==0 ? SQLITE_UTF8 : enc);
 
 #ifndef SQLITE_OMIT_UTF16
   if( pMem->enc!=SQLITE_UTF8 && sqlite3VdbeMemHandleBom(pMem) ){
@@ -76259,19 +76465,21 @@ static int growOpArray(Vdbe *v, int nOp)
   /* The SQLITE_TEST_REALLOC_STRESS compile-time option is designed to force
   ** more frequent reallocs and hence provide more opportunities for 
   ** simulated OOM faults.  SQLITE_TEST_REALLOC_STRESS is generally used
   ** during testing only.  With SQLITE_TEST_REALLOC_STRESS grow the op array
   ** by the minimum* amount required until the size reaches 512.  Normal
   ** operation (without SQLITE_TEST_REALLOC_STRESS) is to double the current
   ** size of the op array or add 1KB of space, whichever is smaller. */
 #ifdef SQLITE_TEST_REALLOC_STRESS
-  int nNew = (v->nOpAlloc>=512 ? v->nOpAlloc*2 : v->nOpAlloc+nOp);
-#else
-  int nNew = (v->nOpAlloc ? v->nOpAlloc*2 : (int)(1024/sizeof(Op)));
+  sqlite3_int64 nNew = (v->nOpAlloc>=512 ? 2*(sqlite3_int64)v->nOpAlloc
+                        : (sqlite3_int64)v->nOpAlloc+nOp);
+#else
+  sqlite3_int64 nNew = (v->nOpAlloc ? 2*(sqlite3_int64)v->nOpAlloc
+                        : (sqlite3_int64)(1024/sizeof(Op)));
   UNUSED_PARAMETER(nOp);
 #endif
 
   /* Ensure that the size of a VDBE does not grow too large */
   if( nNew > p->db->aLimit[SQLITE_LIMIT_VDBE_OP] ){
     sqlite3OomFault(p->db);
     return SQLITE_NOMEM;
   }
@@ -76741,16 +76949,17 @@ SQLITE_PRIVATE int sqlite3VdbeAssertMayA
   VdbeOpIter sIter;
   memset(&sIter, 0, sizeof(sIter));
   sIter.v = v;
 
   while( (pOp = opIterNext(&sIter))!=0 ){
     int opcode = pOp->opcode;
     if( opcode==OP_Destroy || opcode==OP_VUpdate || opcode==OP_VRename 
      || opcode==OP_VDestroy
+     || (opcode==OP_Function0 && pOp->p4.pFunc->funcFlags&SQLITE_FUNC_INTERNAL)
      || ((opcode==OP_Halt || opcode==OP_HaltIfNull) 
       && ((pOp->p1)!=SQLITE_OK && pOp->p2==OE_Abort))
     ){
       hasAbort = 1;
       break;
     }
     if( opcode==OP_CreateBtree && pOp->p3==BTREE_INTKEY ) hasCreateTable = 1;
     if( opcode==OP_InitCoroutine ) hasInitCoroutine = 1;
@@ -77048,17 +77257,17 @@ SQLITE_PRIVATE VdbeOp *sqlite3VdbeAddOpL
 SQLITE_PRIVATE void sqlite3VdbeScanStatus(
   Vdbe *p,                        /* VM to add scanstatus() to */
   int addrExplain,                /* Address of OP_Explain (or 0) */
   int addrLoop,                   /* Address of loop counter */ 
   int addrVisit,                  /* Address of rows visited counter */
   LogEst nEst,                    /* Estimated number of output rows */
   const char *zName               /* Name of table or index being scanned */
 ){
-  int nByte = (p->nScan+1) * sizeof(ScanStatus);
+  sqlite3_int64 nByte = (p->nScan+1) * sizeof(ScanStatus);
   ScanStatus *aNew;
   aNew = (ScanStatus*)sqlite3DbRealloc(p->db, p->aScan, nByte);
   if( aNew ){
     ScanStatus *pNew = &aNew[p->nScan++];
     pNew->addrExplain = addrExplain;
     pNew->addrLoop = addrLoop;
     pNew->addrVisit = addrVisit;
     pNew->nEst = nEst;
@@ -78169,19 +78378,19 @@ SQLITE_PRIVATE void sqlite3VdbeIOTraceSq
 }
 #endif /* !SQLITE_OMIT_TRACE && SQLITE_ENABLE_IOTRACE */
 
 /* An instance of this object describes bulk memory available for use
 ** by subcomponents of a prepared statement.  Space is allocated out
 ** of a ReusableSpace object by the allocSpace() routine below.
 */
 struct ReusableSpace {
-  u8 *pSpace;          /* Available memory */
-  int nFree;           /* Bytes of available memory */
-  int nNeeded;         /* Total bytes that could not be allocated */
+  u8 *pSpace;            /* Available memory */
+  sqlite3_int64 nFree;   /* Bytes of available memory */
+  sqlite3_int64 nNeeded; /* Total bytes that could not be allocated */
 };
 
 /* Try to allocate nByte bytes of 8-byte aligned bulk memory for pBuf
 ** from the ReusableSpace object.  Return a pointer to the allocated
 ** memory on success.  If insufficient memory is available in the
 ** ReusableSpace object, increase the ReusableSpace.nNeeded
 ** value by the amount needed and return NULL.
 **
@@ -78191,17 +78400,17 @@ struct ReusableSpace {
 **
 ** This allocator is employed to repurpose unused slots at the end of the
 ** opcode array of prepared state for other memory needs of the prepared
 ** statement.
 */
 static void *allocSpace(
   struct ReusableSpace *p,  /* Bulk memory available for allocation */
   void *pBuf,               /* Pointer to a prior allocation */
-  int nByte                 /* Bytes of memory needed */
+  sqlite3_int64 nByte       /* Bytes of memory needed */
 ){
   assert( EIGHT_BYTE_ALIGNMENT(p->pSpace) );
   if( pBuf==0 ){
     nByte = ROUND8(nByte);
     if( nByte <= p->nFree ){
       p->nFree -= nByte;
       pBuf = &p->pSpace[p->nFree];
     }else{
@@ -81148,17 +81357,17 @@ static SQLITE_NOINLINE void invokeProfil
   sqlite3_int64 iNow;
   sqlite3_int64 iElapse;
   assert( p->startTime>0 );
   assert( (db->mTrace & (SQLITE_TRACE_PROFILE|SQLITE_TRACE_XPROFILE))!=0 );
   assert( db->init.busy==0 );
   assert( p->zSql!=0 );
   sqlite3OsCurrentTimeInt64(db->pVfs, &iNow);
   iElapse = (iNow - p->startTime)*1000000;
-#ifndef SQLITE_OMIT_DEPRECATED  	
+#ifndef SQLITE_OMIT_DEPRECATED
   if( db->xProfile ){
     db->xProfile(db->pProfileArg, p->zSql, iElapse);
   }
 #endif
   if( db->mTrace & SQLITE_TRACE_PROFILE ){
     db->xTrace(SQLITE_TRACE_PROFILE, db->pTraceArg, p, (void*)&iElapse);
   }
   p->startTime = 0;
@@ -81356,16 +81565,21 @@ SQLITE_API int sqlite3_value_type(sqlite
   return aType[pVal->flags&MEM_AffMask];
 }
 
 /* Return true if a parameter to xUpdate represents an unchanged column */
 SQLITE_API int sqlite3_value_nochange(sqlite3_value *pVal){
   return (pVal->flags&(MEM_Null|MEM_Zero))==(MEM_Null|MEM_Zero);
 }
 
+/* Return true if a parameter value originated from an sqlite3_bind() */
+SQLITE_API int sqlite3_value_frombind(sqlite3_value *pVal){
+  return (pVal->flags&MEM_FromBind)!=0;
+}
+
 /* Make a copy of an sqlite3_value object
 */
 SQLITE_API sqlite3_value *sqlite3_value_dup(const sqlite3_value *pOrig){
   sqlite3_value *pNew;
   if( pOrig==0 ) return 0;
   pNew = sqlite3_malloc( sizeof(*pNew) );
   if( pNew==0 ) return 0;
   memset(pNew, 0, sizeof(*pNew));
@@ -82201,20 +82415,20 @@ SQLITE_API int sqlite3_column_type(sqlit
 **    2      The name of the database that the column derives from
 **    3      The name of the table that the column derives from
 **    4      The name of the table column that the result column derives from
 **
 ** If the result is not a simple column reference (if it is an expression
 ** or a constant) then useTypes 2, 3, and 4 return NULL.
 */
 static const void *columnName(
-  sqlite3_stmt *pStmt,
-  int N,
-  const void *(*xFunc)(Mem*),
-  int useType
+  sqlite3_stmt *pStmt,     /* The statement */
+  int N,                   /* Which column to get the name for */
+  int useUtf16,            /* True to return the name as UTF16 */
+  int useType              /* What type of name */
 ){
   const void *ret;
   Vdbe *p;
   int n;
   sqlite3 *db;
 #ifdef SQLITE_ENABLE_API_ARMOR
   if( pStmt==0 ){
     (void)SQLITE_MISUSE_BKPT;
@@ -82225,41 +82439,46 @@ static const void *columnName(
   p = (Vdbe *)pStmt;
   db = p->db;
   assert( db!=0 );
   n = sqlite3_column_count(pStmt);
   if( N<n && N>=0 ){
     N += useType*n;
     sqlite3_mutex_enter(db->mutex);
     assert( db->mallocFailed==0 );
-    ret = xFunc(&p->aColName[N]);
-     /* A malloc may have failed inside of the xFunc() call. If this
+#ifndef SQLITE_OMIT_UTF16
+    if( useUtf16 ){
+      ret = sqlite3_value_text16((sqlite3_value*)&p->aColName[N]);
+    }else
+#endif
+    {
+      ret = sqlite3_value_text((sqlite3_value*)&p->aColName[N]);
+    }
+    /* A malloc may have failed inside of the _text() call. If this
     ** is the case, clear the mallocFailed flag and return NULL.
     */
     if( db->mallocFailed ){
       sqlite3OomClear(db);
       ret = 0;
     }
     sqlite3_mutex_leave(db->mutex);
   }
   return ret;
 }
 
 /*
 ** Return the name of the Nth column of the result set returned by SQL
 ** statement pStmt.
 */
 SQLITE_API const char *sqlite3_column_name(sqlite3_stmt *pStmt, int N){
-  return columnName(
-      pStmt, N, (const void*(*)(Mem*))sqlite3_value_text, COLNAME_NAME);
+  return columnName(pStmt, N, 0, COLNAME_NAME);
 }
 #ifndef SQLITE_OMIT_UTF16
 SQLITE_API const void *sqlite3_column_name16(sqlite3_stmt *pStmt, int N){
-  return columnName(
-      pStmt, N, (const void*(*)(Mem*))sqlite3_value_text16, COLNAME_NAME);
+  return columnName(pStmt, N, 1, COLNAME_NAME);
 }
 #endif
 
 /*
 ** Constraint:  If you have ENABLE_COLUMN_METADATA then you must
 ** not define OMIT_DECLTYPE.
 */
 #if defined(SQLITE_OMIT_DECLTYPE) && defined(SQLITE_ENABLE_COLUMN_METADATA)
@@ -82268,73 +82487,65 @@ SQLITE_API const void *sqlite3_column_na
 #endif
 
 #ifndef SQLITE_OMIT_DECLTYPE
 /*
 ** Return the column declaration type (if applicable) of the 'i'th column
 ** of the result set of SQL statement pStmt.
 */
 SQLITE_API const char *sqlite3_column_decltype(sqlite3_stmt *pStmt, int N){
-  return columnName(
-      pStmt, N, (const void*(*)(Mem*))sqlite3_value_text, COLNAME_DECLTYPE);
+  return columnName(pStmt, N, 0, COLNAME_DECLTYPE);
 }
 #ifndef SQLITE_OMIT_UTF16
 SQLITE_API const void *sqlite3_column_decltype16(sqlite3_stmt *pStmt, int N){
-  return columnName(
-      pStmt, N, (const void*(*)(Mem*))sqlite3_value_text16, COLNAME_DECLTYPE);
+  return columnName(pStmt, N, 1, COLNAME_DECLTYPE);
 }
 #endif /* SQLITE_OMIT_UTF16 */
 #endif /* SQLITE_OMIT_DECLTYPE */
 
 #ifdef SQLITE_ENABLE_COLUMN_METADATA
 /*
 ** Return the name of the database from which a result column derives.
 ** NULL is returned if the result column is an expression or constant or
 ** anything else which is not an unambiguous reference to a database column.
 */
 SQLITE_API const char *sqlite3_column_database_name(sqlite3_stmt *pStmt, int N){
-  return columnName(
-      pStmt, N, (const void*(*)(Mem*))sqlite3_value_text, COLNAME_DATABASE);
+  return columnName(pStmt, N, 0, COLNAME_DATABASE);
 }
 #ifndef SQLITE_OMIT_UTF16
 SQLITE_API const void *sqlite3_column_database_name16(sqlite3_stmt *pStmt, int N){
-  return columnName(
-      pStmt, N, (const void*(*)(Mem*))sqlite3_value_text16, COLNAME_DATABASE);
+  return columnName(pStmt, N, 1, COLNAME_DATABASE);
 }
 #endif /* SQLITE_OMIT_UTF16 */
 
 /*
 ** Return the name of the table from which a result column derives.
 ** NULL is returned if the result column is an expression or constant or
 ** anything else which is not an unambiguous reference to a database column.
 */
 SQLITE_API const char *sqlite3_column_table_name(sqlite3_stmt *pStmt, int N){
-  return columnName(
-      pStmt, N, (const void*(*)(Mem*))sqlite3_value_text, COLNAME_TABLE);
+  return columnName(pStmt, N, 0, COLNAME_TABLE);
 }
 #ifndef SQLITE_OMIT_UTF16
 SQLITE_API const void *sqlite3_column_table_name16(sqlite3_stmt *pStmt, int N){
-  return columnName(
-      pStmt, N, (const void*(*)(Mem*))sqlite3_value_text16, COLNAME_TABLE);
+  return columnName(pStmt, N, 1, COLNAME_TABLE);
 }
 #endif /* SQLITE_OMIT_UTF16 */
 
 /*
 ** Return the name of the table column from which a result column derives.
 ** NULL is returned if the result column is an expression or constant or
 ** anything else which is not an unambiguous reference to a database column.
 */
 SQLITE_API const char *sqlite3_column_origin_name(sqlite3_stmt *pStmt, int N){
-  return columnName(
-      pStmt, N, (const void*(*)(Mem*))sqlite3_value_text, COLNAME_COLUMN);
+  return columnName(pStmt, N, 0, COLNAME_COLUMN);
 }
 #ifndef SQLITE_OMIT_UTF16
 SQLITE_API const void *sqlite3_column_origin_name16(sqlite3_stmt *pStmt, int N){
-  return columnName(
-      pStmt, N, (const void*(*)(Mem*))sqlite3_value_text16, COLNAME_COLUMN);
+  return columnName(pStmt, N, 1, COLNAME_COLUMN);
 }
 #endif /* SQLITE_OMIT_UTF16 */
 #endif /* SQLITE_ENABLE_COLUMN_METADATA */
 
 
 /******************************* sqlite3_bind_  ***************************
 ** 
 ** Routines used to attach values to wildcards in a compiled SQL statement.
@@ -82693,16 +82904,24 @@ SQLITE_API sqlite3 *sqlite3_db_handle(sq
 ** Return true if the prepared statement is guaranteed to not modify the
 ** database.
 */
 SQLITE_API int sqlite3_stmt_readonly(sqlite3_stmt *pStmt){
   return pStmt ? ((Vdbe*)pStmt)->readOnly : 1;
 }
 
 /*
+** Return 1 if the statement is an EXPLAIN and return 2 if the
+** statement is an EXPLAIN QUERY PLAN
+*/
+SQLITE_API int sqlite3_stmt_isexplain(sqlite3_stmt *pStmt){
+  return pStmt ? ((Vdbe*)pStmt)->explain : 0;
+}
+
+/*
 ** Return true if the prepared statement is in need of being reset.
 */
 SQLITE_API int sqlite3_stmt_busy(sqlite3_stmt *pStmt){
   Vdbe *v = (Vdbe*)pStmt;
   return v!=0 && v->magic==VDBE_MAGIC_RUN && v->pc>=0;
 }
 
 /*
@@ -83381,35 +83600,43 @@ SQLITE_API int sqlite3_found_count = 0;
 # define UPDATE_MAX_BLOBSIZE(P)
 #endif
 
 /*
 ** Invoke the VDBE coverage callback, if that callback is defined.  This
 ** feature is used for test suite validation only and does not appear an
 ** production builds.
 **
-** M is an integer between 2 and 4.  2 indicates a ordinary two-way
-** branch (I=0 means fall through and I=1 means taken).  3 indicates
-** a 3-way branch where the third way is when one of the operands is
-** NULL.  4 indicates the OP_Jump instruction which has three destinations
-** depending on whether the first operand is less than, equal to, or greater
-** than the second. 
+** M is the type of branch.  I is the direction taken for this instance of
+** the branch.
+**
+**   M: 2 - two-way branch (I=0: fall-thru   1: jump                )
+**      3 - two-way + NULL (I=0: fall-thru   1: jump      2: NULL   )
+**      4 - OP_Jump        (I=0: jump p1     1: jump p2   2: jump p3)
+**
+** In other words, if M is 2, then I is either 0 (for fall-through) or
+** 1 (for when the branch is taken).  If M is 3, the I is 0 for an
+** ordinary fall-through, I is 1 if the branch was taken, and I is 2 
+** if the result of comparison is NULL.  For M=3, I=2 the jump may or
+** may not be taken, depending on the SQLITE_JUMPIFNULL flags in p5.
+** When M is 4, that means that an OP_Jump is being run.  I is 0, 1, or 2
+** depending on if the operands are less than, equal, or greater than.
 **
 ** iSrcLine is the source code line (from the __LINE__ macro) that
 ** generated the VDBE instruction combined with flag bits.  The source
 ** code line number is in the lower 24 bits of iSrcLine and the upper
 ** 8 bytes are flags.  The lower three bits of the flags indicate
 ** values for I that should never occur.  For example, if the branch is
 ** always taken, the flags should be 0x05 since the fall-through and
 ** alternate branch are never taken.  If a branch is never taken then
 ** flags should be 0x06 since only the fall-through approach is allowed.
 **
-** Bit 0x04 of the flags indicates an OP_Jump opcode that is only
+** Bit 0x08 of the flags indicates an OP_Jump opcode that is only
 ** interested in equal or not-equal.  In other words, I==0 and I==2
-** should be treated the same.
+** should be treated as equivalent
 **
 ** Since only a line number is retained, not the filename, this macro
 ** only works for amalgamation builds.  But that is ok, since these macros
 ** should be no-ops except for special builds used to measure test coverage.
 */
 #if !defined(SQLITE_VDBE_COVERAGE)
 # define VdbeBranchTaken(I,M)
 #else
@@ -83423,16 +83650,28 @@ SQLITE_API int sqlite3_found_count = 0;
     I = 1<<I;
     /* The upper 8 bits of iSrcLine are flags.  The lower three bits of
     ** the flags indicate directions that the branch can never go.  If
     ** a branch really does go in one of those directions, assert right
     ** away. */
     mNever = iSrcLine >> 24;
     assert( (I & mNever)==0 );
     if( sqlite3GlobalConfig.xVdbeBranch==0 ) return;  /*NO_TEST*/
+    /* Invoke the branch coverage callback with three arguments:
+    **    iSrcLine - the line number of the VdbeCoverage() macro, with
+    **               flags removed.
+    **    I        - Mask of bits 0x07 indicating which cases are are
+    **               fulfilled by this instance of the jump.  0x01 means
+    **               fall-thru, 0x02 means taken, 0x04 means NULL.  Any
+    **               impossible cases (ex: if the comparison is never NULL)
+    **               are filled in automatically so that the coverage
+    **               measurement logic does not flag those impossible cases
+    **               as missed coverage.
+    **    M        - Type of jump.  Same as M argument above
+    */
     I |= mNever;
     if( M==2 ) I |= 0x04;
     if( M==4 ){
       I |= 0x08;
       if( (mNever&0x08)!=0 && (I&0x05)!=0) I |= 0x05; /*NO_TEST*/
     }
     sqlite3GlobalConfig.xVdbeBranch(sqlite3GlobalConfig.pVdbeBranchArg,
                                     iSrcLine&0xffffff, I, M);
@@ -83970,38 +84209,38 @@ SQLITE_PRIVATE int sqlite3VdbeExec(
   Mem *pOut = 0;             /* Output operand */
 #ifdef VDBE_PROFILE
   u64 start;                 /* CPU clock count at start of opcode */
 #endif
   /*** INSERT STACK UNION HERE ***/
 
   assert( p->magic==VDBE_MAGIC_RUN );  /* sqlite3_step() verifies this */
   sqlite3VdbeEnter(p);
+#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
+  if( db->xProgress ){
+    u32 iPrior = p->aCounter[SQLITE_STMTSTATUS_VM_STEP];
+    assert( 0 < db->nProgressOps );
+    nProgressLimit = db->nProgressOps - (iPrior % db->nProgressOps);
+  }else{
+    nProgressLimit = 0xffffffff;
+  }
+#endif
   if( p->rc==SQLITE_NOMEM ){
     /* This happens if a malloc() inside a call to sqlite3_column_text() or
     ** sqlite3_column_text16() failed.  */
     goto no_mem;
   }
   assert( p->rc==SQLITE_OK || (p->rc&0xff)==SQLITE_BUSY );
   assert( p->bIsReader || p->readOnly!=0 );
   p->iCurrentTime = 0;
   assert( p->explain==0 );
   p->pResultSet = 0;
   db->busyHandler.nBusy = 0;
   if( db->u1.isInterrupted ) goto abort_due_to_interrupt;
   sqlite3VdbeIOTraceSql(p);
-#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
-  if( db->xProgress ){
-    u32 iPrior = p->aCounter[SQLITE_STMTSTATUS_VM_STEP];
-    assert( 0 < db->nProgressOps );
-    nProgressLimit = db->nProgressOps - (iPrior % db->nProgressOps);
-  }else{
-    nProgressLimit = 0xffffffff;
-  }
-#endif
 #ifdef SQLITE_DEBUG
   sqlite3BeginBenignMalloc();
   if( p->pc==0
    && (p->db->flags & (SQLITE_VdbeListing|SQLITE_VdbeEQP|SQLITE_VdbeTrace))!=0
   ){
     int i;
     int once = 1;
     sqlite3VdbePrintSql(p);
@@ -84167,20 +84406,21 @@ check_for_interrupt:
   if( db->u1.isInterrupted ) goto abort_due_to_interrupt;
 #ifndef SQLITE_OMIT_PROGRESS_CALLBACK
   /* Call the progress callback if it is configured and the required number
   ** of VDBE ops have been executed (either since this invocation of
   ** sqlite3VdbeExec() or since last time the progress callback was called).
   ** If the progress callback returns non-zero, exit the virtual machine with
   ** a return code SQLITE_ABORT.
   */
-  if( nVmStep>=nProgressLimit && db->xProgress!=0 ){
+  while( nVmStep>=nProgressLimit && db->xProgress!=0 ){
     assert( db->nProgressOps!=0 );
-    nProgressLimit = nVmStep + db->nProgressOps - (nVmStep%db->nProgressOps);
+    nProgressLimit += db->nProgressOps;
     if( db->xProgress(db->pProgressArg) ){
+      nProgressLimit = 0xffffffff;
       rc = SQLITE_INTERRUPT;
       goto abort_due_to_error;
     }
   }
 #endif
   
   break;
 }
@@ -84449,29 +84689,29 @@ case OP_String8: {         /* same as TK
   pOut = out2Prerelease(p, pOp);
   pOp->opcode = OP_String;
   pOp->p1 = sqlite3Strlen30(pOp->p4.z);
 
 #ifndef SQLITE_OMIT_UTF16
   if( encoding!=SQLITE_UTF8 ){
     rc = sqlite3VdbeMemSetStr(pOut, pOp->p4.z, -1, SQLITE_UTF8, SQLITE_STATIC);
     assert( rc==SQLITE_OK || rc==SQLITE_TOOBIG );
+    if( rc ) goto too_big;
     if( SQLITE_OK!=sqlite3VdbeChangeEncoding(pOut, encoding) ) goto no_mem;
     assert( pOut->szMalloc>0 && pOut->zMalloc==pOut->z );
     assert( VdbeMemDynamic(pOut)==0 );
     pOut->szMalloc = 0;
     pOut->flags |= MEM_Static;
     if( pOp->p4type==P4_DYNAMIC ){
       sqlite3DbFree(db, pOp->p4.z);
     }
     pOp->p4type = P4_DYNAMIC;
     pOp->p4.z = pOut->z;
     pOp->p1 = pOut->n;
   }
-  testcase( rc==SQLITE_TOOBIG );
 #endif
   if( pOp->p1>db->aLimit[SQLITE_LIMIT_LENGTH] ){
     goto too_big;
   }
   assert( rc==SQLITE_OK );
   /* Fall through to the next case, OP_String */
 }
   
@@ -84583,17 +84823,20 @@ case OP_Variable: {            /* out2 *
 
   assert( pOp->p1>0 && pOp->p1<=p->nVar );
   assert( pOp->p4.z==0 || pOp->p4.z==sqlite3VListNumToName(p->pVList,pOp->p1) );
   pVar = &p->aVar[pOp->p1 - 1];
   if( sqlite3VdbeMemTooBig(pVar) ){
     goto too_big;
   }
   pOut = &aMem[pOp->p2];
-  sqlite3VdbeMemShallowCopy(pOut, pVar, MEM_Static);
+  if( VdbeMemDynamic(pOut) ) sqlite3VdbeMemSetNull(pOut);
+  memcpy(pOut, pVar, MEMCELLSIZE);
+  pOut->flags &= ~(MEM_Dyn|MEM_Ephem);
+  pOut->flags |= MEM_Static|MEM_FromBind;
   UPDATE_MAX_BLOBSIZE(pOut);
   break;
 }
 
 /* Opcode: Move P1 P2 P3 * *
 ** Synopsis: r[P2@P3]=r[P1@P3]
 **
 ** Move the P3 values in register P1..P1+P3-1 over into
@@ -84716,28 +84959,16 @@ case OP_IntCopy: {            /* out2 */
 */
 case OP_ResultRow: {
   Mem *pMem;
   int i;
   assert( p->nResColumn==pOp->p2 );
   assert( pOp->p1>0 );
   assert( pOp->p1+pOp->p2<=(p->nMem+1 - p->nCursor)+1 );
 
-#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
-  /* Run the progress counter just before returning.
-  */
-  if( db->xProgress!=0
-   && nVmStep>=nProgressLimit 
-   && db->xProgress(db->pProgressArg)!=0
-  ){
-    rc = SQLITE_INTERRUPT;
-    goto abort_due_to_error;
-  }
-#endif
-
   /* If this statement has violated immediate foreign key constraints, do
   ** not return the number of rows modified. And do not RELEASE the statement
   ** transaction. It needs to be rolled back.  */
   if( SQLITE_OK!=(rc = sqlite3VdbeCheckFk(p, 0)) ){
     assert( db->flags&SQLITE_CountRows );
     assert( p->usesStmtJournal );
     goto abort_due_to_error;
   }
@@ -85093,26 +85324,27 @@ case OP_AddImm: {            /* in1 */
 ** in P1 is not an integer and cannot be converted into an integer
 ** without data loss, then jump immediately to P2, or if P2==0
 ** raise an SQLITE_MISMATCH exception.
 */
 case OP_MustBeInt: {            /* jump, in1 */
   pIn1 = &aMem[pOp->p1];
   if( (pIn1->flags & MEM_Int)==0 ){
     applyAffinity(pIn1, SQLITE_AFF_NUMERIC, encoding);
-    VdbeBranchTaken((pIn1->flags&MEM_Int)==0, 2);
     if( (pIn1->flags & MEM_Int)==0 ){
+      VdbeBranchTaken(1, 2);
       if( pOp->p2==0 ){
         rc = SQLITE_MISMATCH;
         goto abort_due_to_error;
       }else{
         goto jump_to_p2;
       }
     }
   }
+  VdbeBranchTaken(0, 2);
   MemSetTypeFlag(pIn1, MEM_Int);
   break;
 }
 
 #ifndef SQLITE_OMIT_FLOATING_POINT
 /* Opcode: RealAffinity P1 * * * *
 **
 ** If register P1 holds an integer convert it to a real value.
@@ -85277,26 +85509,25 @@ case OP_Ge: {             /* same as TK_
   flags3 = pIn3->flags;
   if( (flags1 | flags3)&MEM_Null ){
     /* One or both operands are NULL */
     if( pOp->p5 & SQLITE_NULLEQ ){
       /* If SQLITE_NULLEQ is set (which will only happen if the operator is
       ** OP_Eq or OP_Ne) then take the jump or not depending on whether
       ** or not both operands are null.
       */
-      assert( pOp->opcode==OP_Eq || pOp->opcode==OP_Ne );
       assert( (flags1 & MEM_Cleared)==0 );
       assert( (pOp->p5 & SQLITE_JUMPIFNULL)==0 || CORRUPT_DB );
       testcase( (pOp->p5 & SQLITE_JUMPIFNULL)!=0 );
       if( (flags1&flags3&MEM_Null)!=0
        && (flags3&MEM_Cleared)==0
       ){
         res = 0;  /* Operands are equal */
       }else{
-        res = 1;  /* Operands are not equal */
+        res = ((flags3 & MEM_Null) ? -1 : +1);  /* Operands are not equal */
       }
     }else{
       /* SQLITE_NULLEQ is clear and at least one operand is NULL,
       ** then the result is always NULL.
       ** The jump is taken if the SQLITE_JUMPIFNULL bit is set.
       */
       if( pOp->p5 & SQLITE_STOREP2 ){
         pOut = &aMem[pOp->p2];
@@ -85404,17 +85635,17 @@ compare_op:
       testcase( res2==1 && pOp->opcode==OP_Ne );
       if( (pOp->opcode==OP_Eq)==res2 ) break;
     }
     memAboutToChange(p, pOut);
     MemSetTypeFlag(pOut, MEM_Int);
     pOut->u.i = res2;
     REGISTER_TRACE(pOp->p2, pOut);
   }else{
-    VdbeBranchTaken(res!=0, (pOp->p5 & SQLITE_NULLEQ)?2:3);
+    VdbeBranchTaken(res2!=0, (pOp->p5 & SQLITE_NULLEQ)?2:3);
     if( res2 ){
       goto jump_to_p2;
     }
   }
   break;
 }
 
 /* Opcode: ElseNotEq * P2 * * *
@@ -85954,25 +86185,25 @@ case OP_Column: {
       /* Fill in pC->aType[i] and aOffset[i] values through the p2-th field. */
     op_column_read_header:
       i = pC->nHdrParsed;
       offset64 = aOffset[i];
       zHdr = zData + pC->iHdrOffset;
       zEndHdr = zData + aOffset[0];
       testcase( zHdr>=zEndHdr );
       do{
-        if( (t = zHdr[0])<0x80 ){
+        if( (pC->aType[i] = t = zHdr[0])<0x80 ){
           zHdr++;
           offset64 += sqlite3VdbeOneByteSerialTypeLen(t);
         }else{
           zHdr += sqlite3GetVarint32(zHdr, &t);
+          pC->aType[i] = t;
           offset64 += sqlite3VdbeSerialTypeLen(t);
         }
-        pC->aType[i++] = t;
-        aOffset[i] = (u32)(offset64 & 0xffffffff);
+        aOffset[++i] = (u32)(offset64 & 0xffffffff);
       }while( i<=p2 && zHdr<zEndHdr );
 
       /* The record is corrupt if any of the following are true:
       ** (1) the bytes of the header extend past the declared header size
       ** (2) the entire header was used but not all data was used
       ** (3) the end of the data extends beyond the end of the record.
       */
       if( (zHdr>=zEndHdr && (zHdr>zEndHdr || offset64!=pC->payloadSize))
@@ -86965,16 +87196,17 @@ case OP_OpenDup: {
 
   pCx = allocateCursor(p, pOp->p1, pOrig->nField, -1, CURTYPE_BTREE);
   if( pCx==0 ) goto no_mem;
   pCx->nullRow = 1;
   pCx->isEphemeral = 1;
   pCx->pKeyInfo = pOrig->pKeyInfo;
   pCx->isTable = pOrig->isTable;
   pCx->pgnoRoot = pOrig->pgnoRoot;
+  pCx->isOrdered = pOrig->isOrdered;
   rc = sqlite3BtreeCursor(pOrig->pBtx, pCx->pgnoRoot, BTREE_WRCSR,
                           pCx->pKeyInfo, pCx->uc.pCursor);
   /* The sqlite3BtreeCursor() routine can only fail for the first cursor
   ** opened for a database.  Since there is already an open cursor when this
   ** opcode is run, the sqlite3BtreeCursor() cannot fail */
   assert( rc==SQLITE_OK );
   break;
 }
@@ -88473,55 +88705,49 @@ case OP_SorterSort:    /* jump */
 case OP_Sort: {        /* jump */
 #ifdef SQLITE_TEST
   sqlite3_sort_count++;
   sqlite3_search_count--;
 #endif
   p->aCounter[SQLITE_STMTSTATUS_SORT]++;
   /* Fall through into OP_Rewind */
 }
-/* Opcode: Rewind P1 P2 * * P5
+/* Opcode: Rewind P1 P2 * * *
 **
 ** The next use of the Rowid or Column or Next instruction for P1 
 ** will refer to the first entry in the database table or index.
 ** If the table or index is empty, jump immediately to P2.
 ** If the table or index is not empty, fall through to the following 
 ** instruction.
 **
-** If P5 is non-zero and the table is not empty, then the "skip-next"
-** flag is set on the cursor so that the next OP_Next instruction 
-** executed on it is a no-op.
-**
 ** This opcode leaves the cursor configured to move in forward order,
 ** from the beginning toward the end.  In other words, the cursor is
 ** configured to use Next, not Prev.
 */
 case OP_Rewind: {        /* jump */
   VdbeCursor *pC;
   BtCursor *pCrsr;
   int res;
 
   assert( pOp->p1>=0 && pOp->p1<p->nCursor );
+  assert( pOp->p5==0 );
   pC = p->apCsr[pOp->p1];
   assert( pC!=0 );
   assert( isSorter(pC)==(pOp->opcode==OP_SorterSort) );
   res = 1;
 #ifdef SQLITE_DEBUG
   pC->seekOp = OP_Rewind;
 #endif
   if( isSorter(pC) ){
     rc = sqlite3VdbeSorterRewind(pC, &res);
   }else{
     assert( pC->eCurType==CURTYPE_BTREE );
     pCrsr = pC->uc.pCursor;
     assert( pCrsr );
     rc = sqlite3BtreeFirst(pCrsr, &res);
-#ifndef SQLITE_OMIT_WINDOWFUNC
-    if( pOp->p5 ) sqlite3BtreeSkipNext(pCrsr);
-#endif
     pC->deferredMoveto = 0;
     pC->cacheStatus = CACHE_STALE;
   }
   if( rc ) goto abort_due_to_error;
   pC->nullRow = (u8)res;
   assert( pOp->p2>0 && pOp->p2<p->nOp );
   VdbeBranchTaken(res!=0,2);
   if( res ) goto jump_to_p2;
@@ -89521,18 +89747,17 @@ case OP_Program: {        /* jump */
     int i;
     for(i=0; i<p->nMem; i++){
       aMem[i].pScopyFrom = 0;  /* Prevent false-positive AboutToChange() errs */
       aMem[i].flags |= MEM_Undefined; /* Cause a fault if this reg is reused */
     }
   }
 #endif
   pOp = &aOp[-1];
-
-  break;
+  goto check_for_interrupt;
 }
 
 /* Opcode: Param P1 P2 * * *
 **
 ** This opcode is only ever present in sub-programs called via the 
 ** OP_Program instruction. Copy a value currently stored in a memory 
 ** cell of the calling (parent) frame to cell P2 in the current frames 
 ** address space. This is used by trigger programs to access the new.* 
@@ -89894,16 +90119,17 @@ case OP_AggValue:
 case OP_AggFinal: {
   Mem *pMem;
   assert( pOp->p1>0 && pOp->p1<=(p->nMem+1 - p->nCursor) );
   assert( pOp->p3==0 || pOp->opcode==OP_AggValue );
   pMem = &aMem[pOp->p1];
   assert( (pMem->flags & ~(MEM_Null|MEM_Agg))==0 );
 #ifndef SQLITE_OMIT_WINDOWFUNC
   if( pOp->p3 ){
+    memAboutToChange(p, &aMem[pOp->p3]);
     rc = sqlite3VdbeMemAggValue(pMem, &aMem[pOp->p3], pOp->p4.pFunc);
     pMem = &aMem[pOp->p3];
   }else
 #endif
   {
     rc = sqlite3VdbeMemFinalize(pMem, pOp->p4.pFunc);
   }
   
@@ -90931,17 +91157,26 @@ abort_due_to_error:
   if( resetSchemaOnFault>0 ){
     sqlite3ResetOneSchema(db, resetSchemaOnFault-1);
   }
 
   /* This is the only way out of this procedure.  We have to
   ** release the mutexes on btrees that were acquired at the
   ** top. */
 vdbe_return:
-  testcase( nVmStep>0 );
+#ifndef SQLITE_OMIT_PROGRESS_CALLBACK
+  while( nVmStep>=nProgressLimit && db->xProgress!=0 ){
+    nProgressLimit += db->nProgressOps;
+    if( db->xProgress(db->pProgressArg) ){
+      nProgressLimit = 0xffffffff;
+      rc = SQLITE_INTERRUPT;
+      goto abort_due_to_error;
+    }
+  }
+#endif
   p->aCounter[SQLITE_STMTSTATUS_VM_STEP] += (int)nVmStep;
   sqlite3VdbeLeave(p);
   assert( rc!=SQLITE_OK || nExtraDelete==0 
        || sqlite3_strlike("DELETE%",p->zSql,0)!=0 
   );
   return rc;
 
   /* Jump to here if a string or blob larger than SQLITE_MAX_LENGTH
@@ -92018,17 +92253,17 @@ static int vdbePmaReadBlob(
     /* The requested data is not all available in the in-memory buffer.
     ** In this case, allocate space at p->aAlloc[] to copy the requested
     ** range into. Then return a copy of pointer p->aAlloc to the caller.  */
     int nRem;                     /* Bytes remaining to copy */
 
     /* Extend the p->aAlloc[] allocation if required. */
     if( p->nAlloc<nByte ){
       u8 *aNew;
-      int nNew = MAX(128, p->nAlloc*2);
+      sqlite3_int64 nNew = MAX(128, 2*(sqlite3_int64)p->nAlloc);
       while( nByte>nNew ) nNew = nNew*2;
       aNew = sqlite3Realloc(p->aAlloc, nNew);
       if( !aNew ) return SQLITE_NOMEM_BKPT;
       p->nAlloc = nNew;
       p->aAlloc = aNew;
     }
 
     /* Copy as much data as is available in the buffer into the start of
@@ -93309,25 +93544,29 @@ SQLITE_PRIVATE int sqlite3VdbeSorterWrit
     pSorter->mxKeysize = nPMA;
   }
 
   if( pSorter->list.aMemory ){
     int nMin = pSorter->iMemory + nReq;
 
     if( nMin>pSorter->nMemory ){
       u8 *aNew;
-      int iListOff = (u8*)pSorter->list.pList - pSorter->list.aMemory;
-      int nNew = pSorter->nMemory * 2;
+      sqlite3_int64 nNew = 2 * (sqlite3_int64)pSorter->nMemory;
+      int iListOff = -1;
+      if( pSorter->list.pList ){
+        iListOff = (u8*)pSorter->list.pList - pSorter->list.aMemory;
+      }
       while( nNew < nMin ) nNew = nNew*2;
       if( nNew > pSorter->mxPmaSize ) nNew = pSorter->mxPmaSize;
       if( nNew < nMin ) nNew = nMin;
-
       aNew = sqlite3Realloc(pSorter->list.aMemory, nNew);
       if( !aNew ) return SQLITE_NOMEM_BKPT;
-      pSorter->list.pList = (SorterRecord*)&aNew[iListOff];
+      if( iListOff>=0 ){
+        pSorter->list.pList = (SorterRecord*)&aNew[iListOff];
+      }
       pSorter->list.aMemory = aNew;
       pSorter->nMemory = nNew;
     }
 
     pNew = (SorterRecord*)&pSorter->list.aMemory[pSorter->iMemory];
     pSorter->iMemory += ROUND8(nReq);
     if( pSorter->list.pList ){
       pNew->u.iNext = (int)((u8*)(pSorter->list.pList) - pSorter->list.aMemory);
@@ -95304,16 +95543,20 @@ static int lookupName(
           assert( pExpr->pLeft==0 && pExpr->pRight==0 );
           assert( pExpr->x.pList==0 );
           assert( pExpr->x.pSelect==0 );
           pOrig = pEList->a[j].pExpr;
           if( (pNC->ncFlags&NC_AllowAgg)==0 && ExprHasProperty(pOrig, EP_Agg) ){
             sqlite3ErrorMsg(pParse, "misuse of aliased aggregate %s", zAs);
             return WRC_Abort;
           }
+          if( (pNC->ncFlags&NC_AllowWin)==0 && ExprHasProperty(pOrig, EP_Win) ){
+            sqlite3ErrorMsg(pParse, "misuse of aliased window function %s",zAs);
+            return WRC_Abort;
+          }
           if( sqlite3ExprVectorSize(pOrig)!=1 ){
             sqlite3ErrorMsg(pParse, "row value misused");
             return WRC_Abort;
           }
           resolveAlias(pParse, pEList, j, pExpr, "", nSubquery);
           cnt = 1;
           pMatch = 0;
           assert( zTab==0 && zDb==0 );
@@ -95594,16 +95837,17 @@ static int resolveExprStep(Walker *pWalk
       int n = pList ? pList->nExpr : 0;    /* Number of arguments */
       int no_such_func = 0;       /* True if no such function exists */
       int wrong_num_args = 0;     /* True if wrong number of arguments */
       int is_agg = 0;             /* True if is an aggregate function */
       int nId;                    /* Number of characters in function name */
       const char *zId;            /* The function name. */
       FuncDef *pDef;              /* Information about the function */
       u8 enc = ENC(pParse->db);   /* The database encoding */
+      int savedAllowFlags = (pNC->ncFlags & (NC_AllowAgg | NC_AllowWin));
 
       assert( !ExprHasProperty(pExpr, EP_xIsSelect) );
       zId = pExpr->u.zToken;
       nId = sqlite3Strlen30(zId);
       pDef = sqlite3FindFunction(pParse->db, zId, n, enc, 0);
       if( pDef==0 ){
         pDef = sqlite3FindFunction(pParse->db, zId, -2, enc, 0);
         if( pDef==0 ){
@@ -95715,18 +95959,21 @@ static int resolveExprStep(Walker *pWalk
           sqlite3ErrorMsg(pParse, "no such function: %.*s", nId, zId);
           pNC->nErr++;
         }else if( wrong_num_args ){
           sqlite3ErrorMsg(pParse,"wrong number of arguments to function %.*s()",
                nId, zId);
           pNC->nErr++;
         }
         if( is_agg ){
+          /* Window functions may not be arguments of aggregate functions.
+          ** Or arguments of other window functions. But aggregate functions
+          ** may be arguments for window functions.  */
 #ifndef SQLITE_OMIT_WINDOWFUNC
-          pNC->ncFlags &= ~(pExpr->y.pWin ? NC_AllowWin : NC_AllowAgg);
+          pNC->ncFlags &= ~(NC_AllowWin | (!pExpr->y.pWin ? NC_AllowAgg : 0));
 #else
           pNC->ncFlags &= ~NC_AllowAgg;
 #endif
         }
       }
       sqlite3WalkExprList(pWalker, pList);
       if( is_agg ){
 #ifndef SQLITE_OMIT_WINDOWFUNC
@@ -95737,17 +95984,17 @@ static int resolveExprStep(Walker *pWalk
           sqlite3WalkExprList(pWalker, pExpr->y.pWin->pOrderBy);
           sqlite3WalkExpr(pWalker, pExpr->y.pWin->pFilter);
           if( 0==pSel->pWin 
            || 0==sqlite3WindowCompare(pParse, pSel->pWin, pExpr->y.pWin) 
           ){
             pExpr->y.pWin->pNextWin = pSel->pWin;
             pSel->pWin = pExpr->y.pWin;
           }
-          pNC->ncFlags |= NC_AllowWin;
+          pNC->ncFlags |= NC_HasWin;
         }else
 #endif /* SQLITE_OMIT_WINDOWFUNC */
         {
           NameContext *pNC2 = pNC;
           pExpr->op = TK_AGG_FUNCTION;
           pExpr->op2 = 0;
           while( pNC2 && !sqlite3FunctionUsesThisSrc(pExpr, pNC2->pSrcList) ){
             pExpr->op2++;
@@ -95755,18 +96002,18 @@ static int resolveExprStep(Walker *pWalk
           }
           assert( pDef!=0 );
           if( pNC2 ){
             assert( SQLITE_FUNC_MINMAX==NC_MinMaxAgg );
             testcase( (pDef->funcFlags & SQLITE_FUNC_MINMAX)!=0 );
             pNC2->ncFlags |= NC_HasAgg | (pDef->funcFlags & SQLITE_FUNC_MINMAX);
 
           }
-          pNC->ncFlags |= NC_AllowAgg;
-        }
+        }
+        pNC->ncFlags |= savedAllowFlags;
       }
       /* FIX ME:  Compute pExpr->affinity based on the expected return
       ** type of the function 
       */
       return WRC_Prune;
     }
 #ifndef SQLITE_OMIT_SUBQUERY
     case TK_SELECT:
@@ -96293,17 +96540,17 @@ static int resolveSelectStep(Walker *pWa
       pSub->pOrderBy = p->pOrderBy;
       p->pOrderBy = 0;
     }
   
     /* Recursively resolve names in all subqueries
     */
     for(i=0; i<p->pSrc->nSrc; i++){
       struct SrcList_item *pItem = &p->pSrc->a[i];
-      if( pItem->pSelect ){
+      if( pItem->pSelect && (pItem->pSelect->selFlags & SF_Resolved)==0 ){
         NameContext *pNC;         /* Used to iterate name contexts */
         int nRef = 0;             /* Refcount for pOuterNC and outer contexts */
         const char *zSavedContext = pParse->zAuthContext;
 
         /* Count the total number of references to pOuterNC and all of its
         ** parent contexts. After resolving references to expressions in
         ** pItem->pSelect, check if this value has changed. If so, then
         ** SELECT statement pItem->pSelect must be correlated. Set the
@@ -96425,26 +96672,28 @@ static int resolveSelectStep(Walker *pWa
         if( ExprHasProperty(pItem->pExpr, EP_Agg) ){
           sqlite3ErrorMsg(pParse, "aggregate functions are not allowed in "
               "the GROUP BY clause");
           return WRC_Abort;
         }
       }
     }
 
+#ifndef SQLITE_OMIT_WINDOWFUNC
     if( IN_RENAME_OBJECT ){
       Window *pWin;
       for(pWin=p->pWinDefn; pWin; pWin=pWin->pNextWin){
         if( sqlite3ResolveExprListNames(&sNC, pWin->pOrderBy)
          || sqlite3ResolveExprListNames(&sNC, pWin->pPartition)
         ){
           return WRC_Abort;
         }
       }
     }
+#endif
 
     /* If this is part of a compound SELECT, check that it has the right
     ** number of expressions in the select list. */
     if( p->pNext && p->pEList->nExpr!=p->pNext->pEList->nExpr ){
       sqlite3SelectWrongNumTermsError(pParse, p->pNext);
       return WRC_Abort;
     }
 
@@ -96515,36 +96764,38 @@ static int resolveSelectStep(Walker *pWa
 SQLITE_PRIVATE int sqlite3ResolveExprNames( 
   NameContext *pNC,       /* Namespace to resolve expressions in. */
   Expr *pExpr             /* The expression to be analyzed. */
 ){
   u16 savedHasAgg;
   Walker w;
 
   if( pExpr==0 ) return SQLITE_OK;
-  savedHasAgg = pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg);
-  pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg);
+  savedHasAgg = pNC->ncFlags & (NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
+  pNC->ncFlags &= ~(NC_HasAgg|NC_MinMaxAgg|NC_HasWin);
   w.pParse = pNC->pParse;
   w.xExprCallback = resolveExprStep;
   w.xSelectCallback = resolveSelectStep;
   w.xSelectCallback2 = 0;
   w.u.pNC = pNC;
 #if SQLITE_MAX_EXPR_DEPTH>0
   w.pParse->nHeight += pExpr->nHeight;
   if( sqlite3ExprCheckHeight(w.pParse, w.pParse->nHeight) ){
     return SQLITE_ERROR;
   }
 #endif
   sqlite3WalkExpr(&w, pExpr);
 #if SQLITE_MAX_EXPR_DEPTH>0
   w.pParse->nHeight -= pExpr->nHeight;
 #endif
-  if( pNC->ncFlags & NC_HasAgg ){
-    ExprSetProperty(pExpr, EP_Agg);
-  }
+  assert( EP_Agg==NC_HasAgg );
+  assert( EP_Win==NC_HasWin );
+  testcase( pNC->ncFlags & NC_HasAgg );
+  testcase( pNC->ncFlags & NC_HasWin );
+  ExprSetProperty(pExpr, pNC->ncFlags & (NC_HasAgg|NC_HasWin) );
   pNC->ncFlags |= savedHasAgg;
   return pNC->nErr>0 || w.pParse->nErr>0;
 }
 
 /*
 ** Resolve all names for all expression in an expression list.  This is
 ** just like sqlite3ResolveExprNames() except that it works for an expression
 ** list rather than a single expression.
@@ -97490,17 +97741,17 @@ SQLITE_PRIVATE Expr *sqlite3PExpr(
   Expr *p;
   if( op==TK_AND && pParse->nErr==0 && !IN_RENAME_OBJECT ){
     /* Take advantage of short-circuit false optimization for AND */
     p = sqlite3ExprAnd(pParse->db, pLeft, pRight);
   }else{
     p = sqlite3DbMallocRawNN(pParse->db, sizeof(Expr));
     if( p ){
       memset(p, 0, sizeof(Expr));
-      p->op = op & TKFLG_MASK;
+      p->op = op & 0xff;
       p->iAgg = -1;
     }
     sqlite3ExprAttachSubtrees(pParse->db, p, pLeft, pRight);
   }
   if( p ) {
     sqlite3ExprCheckHeight(pParse, p->nHeight);
   }
   return p;
@@ -97955,17 +98206,17 @@ static Expr *exprDup(sqlite3 *db, Expr *
 ** Create and return a deep copy of the object passed as the second 
 ** argument. If an OOM condition is encountered, NULL is returned
 ** and the db->mallocFailed flag set.
 */
 #ifndef SQLITE_OMIT_CTE
 static With *withDup(sqlite3 *db, With *p){
   With *pRet = 0;
   if( p ){
-    int nByte = sizeof(*p) + sizeof(p->a[0]) * (p->nCte-1);
+    sqlite3_int64 nByte = sizeof(*p) + sizeof(p->a[0]) * (p->nCte-1);
     pRet = sqlite3DbMallocZero(db, nByte);
     if( pRet ){
       int i;
       pRet->nCte = p->nCte;
       for(i=0; i<p->nCte; i++){
         pRet->a[i].pSelect = sqlite3SelectDup(db, p->a[i].pSelect, 0);
         pRet->a[i].pCols = sqlite3ExprListDup(db, p->a[i].pCols, 0);
         pRet->a[i].zName = sqlite3DbStrDup(db, p->a[i].zName);
@@ -98220,17 +98471,17 @@ SQLITE_PRIVATE ExprList *sqlite3ExprList
     pList = sqlite3DbMallocRawNN(db, sizeof(ExprList) );
     if( pList==0 ){
       goto no_mem;
     }
     pList->nExpr = 0;
   }else if( (pList->nExpr & (pList->nExpr-1))==0 ){
     ExprList *pNew;
     pNew = sqlite3DbRealloc(db, pList, 
-             sizeof(*pList)+(2*pList->nExpr - 1)*sizeof(pList->a[0]));
+         sizeof(*pList)+(2*(sqlite3_int64)pList->nExpr-1)*sizeof(pList->a[0]));
     if( pNew==0 ){
       goto no_mem;
     }
     pList = pNew;
   }
   pItem = &pList->a[pList->nExpr++];
   assert( offsetof(struct ExprList_item,zName)==sizeof(pItem->pExpr) );
   assert( offsetof(struct ExprList_item,pExpr)==0 );
@@ -101665,16 +101916,27 @@ static int impliesNotNullRow(Walker *pWa
 ** This routine is used to check if a LEFT JOIN can be converted into
 ** an ordinary JOIN.  The p argument is the WHERE clause.  If the WHERE
 ** clause requires that some column of the right table of the LEFT JOIN
 ** be non-NULL, then the LEFT JOIN can be safely converted into an
 ** ordinary join.
 */
 SQLITE_PRIVATE int sqlite3ExprImpliesNonNullRow(Expr *p, int iTab){
   Walker w;
+  p = sqlite3ExprSkipCollate(p);
+  while( p ){
+    if( p->op==TK_NOTNULL ){
+      p = p->pLeft;
+    }else if( p->op==TK_AND ){
+      if( sqlite3ExprImpliesNonNullRow(p->pLeft, iTab) ) return 1;
+      p = p->pRight;
+    }else{
+      break;
+    }
+  }
   w.xExprCallback = impliesNotNullRow;
   w.xSelectCallback = 0;
   w.xSelectCallback2 = 0;
   w.eCode = 0;
   w.u.iCur = iTab;
   sqlite3WalkExpr(&w, p);
   return w.eCode;
 }
@@ -102246,25 +102508,25 @@ SQLITE_PRIVATE void sqlite3AlterRenameTa
   if( IsVirtual(pTab) ){
     pVTab = sqlite3GetVTable(db, pTab);
     if( pVTab->pVtab->pModule->xRename==0 ){
       pVTab = 0;
     }
   }
 #endif
 
-  /* Begin a transaction for database iDb. 
-  ** Then modify the schema cookie (since the ALTER TABLE modifies the
-  ** schema). Open a statement transaction if the table is a virtual
-  ** table.
-  */
+  /* Begin a transaction for database iDb. Then modify the schema cookie
+  ** (since the ALTER TABLE modifies the schema). Call sqlite3MayAbort(),
+  ** as the scalar functions (e.g. sqlite_rename_table()) invoked by the 
+  ** nested SQL may raise an exception.  */
   v = sqlite3GetVdbe(pParse);
   if( v==0 ){
     goto exit_rename_table;
   }
+  sqlite3MayAbort(pParse);
 
   /* figure out how many UTF-8 characters are in zName */
   zTabName = pTab->zName;
   nTabName = sqlite3Utf8CharLen(zTabName, -1);
 
   /* Rewrite all CREATE TABLE, INDEX, TRIGGER or VIEW statements in
   ** the schema to use the new table name.  */
   sqlite3NestedParse(pParse, 
@@ -102323,17 +102585,16 @@ SQLITE_PRIVATE void sqlite3AlterRenameTa
   ** of any resources used by the v-table implementation (including other
   ** SQLite tables) that are identified by the name of the virtual table.
   */
 #ifndef SQLITE_OMIT_VIRTUALTABLE
   if( pVTab ){
     int i = ++pParse->nMem;
     sqlite3VdbeLoadString(v, i, zName);
     sqlite3VdbeAddOp4(v, OP_VRename, i, 0, 0,(const char*)pVTab, P4_VTAB);
-    sqlite3MayAbort(pParse);
   }
 #endif
 
   renameReloadSchema(pParse, iDb);
   renameTestSchema(pParse, zDb, iDb==1);
 
 exit_rename_table:
   sqlite3SrcListDelete(db, pSrc);
@@ -102644,16 +102905,17 @@ SQLITE_PRIVATE void sqlite3AlterRenameCo
     sqlite3ErrorMsg(pParse, "no such column: \"%s\"", zOld);
     goto exit_rename_column;
   }
 
   /* Do the rename operation using a recursive UPDATE statement that
   ** uses the sqlite_rename_column() SQL function to compute the new
   ** CREATE statement text for the sqlite_master table.
   */
+  sqlite3MayAbort(pParse);
   zNew = sqlite3NameFromToken(db, pNew);
   if( !zNew ) goto exit_rename_column;
   assert( pNew->n>0 );
   bQuote = sqlite3Isquote(pNew->z[0]);
   sqlite3NestedParse(pParse, 
       "UPDATE \"%w\".%s SET "
       "sql = sqlite_rename_column(sql, type, name, %Q, %Q, %d, %Q, %d, %d) "
       "WHERE name NOT LIKE 'sqlite_%%' AND (type != 'index' OR tbl_name = %Q)"
@@ -105898,22 +106160,24 @@ static void attachFunc(
   ** If this fails, or if opening the file failed, then close the file and 
   ** remove the entry from the db->aDb[] array. i.e. put everything back the
   ** way we found it.
   */
   if( rc==SQLITE_OK ){
     sqlite3BtreeEnterAll(db);
     db->init.iDb = 0;
     db->mDbFlags &= ~(DBFLAG_SchemaKnownOk);
-    rc = sqlite3Init(db, &zErrDyn);
+    if( !REOPEN_AS_MEMDB(db) ){
+      rc = sqlite3Init(db, &zErrDyn);
+    }
     sqlite3BtreeLeaveAll(db);
     assert( zErrDyn==0 || rc!=SQLITE_OK );
   }
 #ifdef SQLITE_USER_AUTHENTICATION
-  if( rc==SQLITE_OK ){
+  if( rc==SQLITE_OK && !REOPEN_AS_MEMDB(db) ){
     u8 newAuth = 0;
     rc = sqlite3UserAuthCheckLogin(db, zName, &newAuth);
     if( newAuth<db->auth.authLevel ){
       rc = SQLITE_AUTH_USER;
     }
   }
 #endif
   if( rc ){
@@ -106832,17 +107096,22 @@ SQLITE_PRIVATE void sqlite3NestedParse(P
   char saveBuf[PARSE_TAIL_SZ];
 
   if( pParse->nErr ) return;
   assert( pParse->nested<10 );  /* Nesting should only be of limited depth */
   va_start(ap, zFormat);
   zSql = sqlite3VMPrintf(db, zFormat, ap);
   va_end(ap);
   if( zSql==0 ){
-    return;   /* A malloc must have failed */
+    /* This can result either from an OOM or because the formatted string
+    ** exceeds SQLITE_LIMIT_LENGTH.  In the latter case, we need to set
+    ** an error */
+    if( !db->mallocFailed ) pParse->rc = SQLITE_TOOBIG;
+    pParse->nErr++;
+    return;
   }
   pParse->nested++;
   memcpy(saveBuf, PARSE_TAIL(pParse), PARSE_TAIL_SZ);
   memset(PARSE_TAIL(pParse), 0, PARSE_TAIL_SZ);
   sqlite3RunParser(pParse, zSql, &zErrMsg);
   sqlite3DbFree(db, zErrMsg);
   sqlite3DbFree(db, zSql);
   memcpy(PARSE_TAIL(pParse), saveBuf, PARSE_TAIL_SZ);
@@ -107972,17 +108241,18 @@ SQLITE_PRIVATE void sqlite3AddPrimaryKey
     }
   }
   if( nTerm==1
    && pCol
    && sqlite3StrICmp(sqlite3ColumnType(pCol,""), "INTEGER")==0
    && sortOrder!=SQLITE_SO_DESC
   ){
     if( IN_RENAME_OBJECT && pList ){
-      sqlite3RenameTokenRemap(pParse, &pTab->iPKey, pList->a[0].pExpr);
+      Expr *pCExpr = sqlite3ExprSkipCollate(pList->a[0].pExpr);
+      sqlite3RenameTokenRemap(pParse, &pTab->iPKey, pCExpr);
     }
     pTab->iPKey = iCol;
     pTab->keyConf = (u8)onError;
     assert( autoInc==0 || autoInc==1 );
     pTab->tabFlags |= autoInc*TF_Autoincrement;
     if( pList ) pParse->iPkSortOrder = pList->a[0].sortOrder;
   }else if( autoInc ){
 #ifndef SQLITE_OMIT_AUTOINCREMENT
@@ -108393,16 +108663,17 @@ static void convertToWithoutRowidTable(P
     assert( pParse->pNewTable==pTab );
     sqlite3CreateIndex(pParse, 0, 0, 0, pList, pTab->keyConf, 0, 0, 0, 0,
                        SQLITE_IDXTYPE_PRIMARYKEY);
     if( db->mallocFailed || pParse->nErr ) return;
     pPk = sqlite3PrimaryKeyIndex(pTab);
     pTab->iPKey = -1;
   }else{
     pPk = sqlite3PrimaryKeyIndex(pTab);
+    assert( pPk!=0 );
 
     /*
     ** Remove all redundant columns from the PRIMARY KEY.  For example, change
     ** "PRIMARY KEY(a,b,a,b,c,b,c,d)" into just "PRIMARY KEY(a,b,c,d)".  Later
     ** code assumes the PRIMARY KEY contains no repeated columns.
     */
     for(i=j=1; i<pPk->nKeyCol; i++){
       if( hasColumn(pPk->aiColumn, j, pPk->aiColumn[i]) ){
@@ -108562,16 +108833,21 @@ SQLITE_PRIVATE void sqlite3EndTable(
     if( pSelect ){
       sqlite3ErrorMsg(pParse, "");
       return;
     }
     p->tnum = db->init.newTnum;
     if( p->tnum==1 ) p->tabFlags |= TF_Readonly;
   }
 
+  assert( (p->tabFlags & TF_HasPrimaryKey)==0
+       || p->iPKey>=0 || sqlite3PrimaryKeyIndex(p)!=0 );
+  assert( (p->tabFlags & TF_HasPrimaryKey)!=0
+       || (p->iPKey<0 && sqlite3PrimaryKeyIndex(p)==0) );
+
   /* Special processing for WITHOUT ROWID Tables */
   if( tabOpts & TF_WithoutRowid ){
     if( (p->tabFlags & TF_Autoincrement) ){
       sqlite3ErrorMsg(pParse,
           "AUTOINCREMENT not allowed on WITHOUT ROWID tables");
       return;
     }
     if( (p->tabFlags & TF_HasPrimaryKey)==0 ){
@@ -109715,23 +109991,23 @@ SQLITE_PRIVATE void sqlite3CreateIndex(
     iDb = sqlite3SchemaToIndex(db, pTab->pSchema);
   }
   pDb = &db->aDb[iDb];
 
   assert( pTab!=0 );
   assert( pParse->nErr==0 );
   if( sqlite3StrNICmp(pTab->zName, "sqlite_", 7)==0 
        && db->init.busy==0
+       && pTblName!=0
 #if SQLITE_USER_AUTHENTICATION
        && sqlite3UserAuthTable(pTab->zName)==0
 #endif
 #ifdef SQLITE_ALLOW_SQLITE_MASTER_INDEX
        && sqlite3StrICmp(&pTab->zName[7],"master")!=0
 #endif
-       && sqlite3StrNICmp(&pTab->zName[7],"altertab_",9)!=0
  ){
     sqlite3ErrorMsg(pParse, "table %s may not be indexed", pTab->zName);
     goto exit_create_index;
   }
 #ifndef SQLITE_OMIT_VIEW
   if( pTab->pSelect ){
     sqlite3ErrorMsg(pParse, "views may not be indexed");
     goto exit_create_index;
@@ -109825,16 +110101,17 @@ SQLITE_PRIVATE void sqlite3CreateIndex(
     sqlite3TokenInit(&prevCol, pCol->zName);
     pList = sqlite3ExprListAppend(pParse, 0,
               sqlite3ExprAlloc(db, TK_ID, &prevCol, 0));
     if( pList==0 ) goto exit_create_index;
     assert( pList->nExpr==1 );
     sqlite3ExprListSetSortOrder(pList, sortOrder);
   }else{
     sqlite3ExprListCheckLength(pParse, pList, "index");
+    if( pParse->nErr ) goto exit_create_index;
   }
 
   /* Figure out how many bytes of space are required to store explicitly
   ** specified collation sequence names.
   */
   for(i=0; i<pList->nExpr; i++){
     Expr *pExpr = pList->a[i].pExpr;
     assert( pExpr!=0 );
@@ -109843,16 +110120,17 @@ SQLITE_PRIVATE void sqlite3CreateIndex(
     }
   }
 
   /* 
   ** Allocate the index structure. 
   */
   nName = sqlite3Strlen30(zName);
   nExtraCol = pPk ? pPk->nKeyCol : 1;
+  assert( pList->nExpr + nExtraCol <= 32767 /* Fits in i16 */ );
   pIndex = sqlite3AllocateIndexObject(db, pList->nExpr + nExtraCol,
                                       nName + nExtra + 1, &zExtra);
   if( db->mallocFailed ){
     goto exit_create_index;
   }
   assert( EIGHT_BYTE_ALIGNMENT(pIndex->aiRowLogEst) );
   assert( EIGHT_BYTE_ALIGNMENT(pIndex->azColl) );
   pIndex->zName = zExtra;
@@ -110326,29 +110604,28 @@ exit_drop_index:
 SQLITE_PRIVATE void *sqlite3ArrayAllocate(
   sqlite3 *db,      /* Connection to notify of malloc failures */
   void *pArray,     /* Array of objects.  Might be reallocated */
   int szEntry,      /* Size of each object in the array */
   int *pnEntry,     /* Number of objects currently in use */
   int *pIdx         /* Write the index of a new slot here */
 ){
   char *z;
-  int n = *pnEntry;
+  sqlite3_int64 n = *pIdx = *pnEntry;
   if( (n & (n-1))==0 ){
-    int sz = (n==0) ? 1 : 2*n;
+    sqlite3_int64 sz = (n==0) ? 1 : 2*n;
     void *pNew = sqlite3DbRealloc(db, pArray, sz*szEntry);
     if( pNew==0 ){
       *pIdx = -1;
       return pArray;
     }
     pArray = pNew;
   }
   z = (char*)pArray;
   memset(&z[n * szEntry], 0, szEntry);
-  *pIdx = n;
   ++*pnEntry;
   return pArray;
 }
 
 /*
 ** Append a new element to the given IdList.  Create a new IdList if
 ** need be.
 **
@@ -110449,17 +110726,17 @@ SQLITE_PRIVATE SrcList *sqlite3SrcListEn
   assert( iStart>=0 );
   assert( nExtra>=1 );
   assert( pSrc!=0 );
   assert( iStart<=pSrc->nSrc );
 
   /* Allocate additional space if needed */
   if( (u32)pSrc->nSrc+nExtra>pSrc->nAlloc ){
     SrcList *pNew;
-    int nAlloc = pSrc->nSrc*2+nExtra;
+    sqlite3_int64 nAlloc = 2*(sqlite3_int64)pSrc->nSrc+nExtra;
     sqlite3 *db = pParse->db;
 
     if( pSrc->nSrc+nExtra>=SQLITE_MAX_SRCLIST ){
       sqlite3ErrorMsg(pParse, "too many FROM clause terms, max: %d",
                       SQLITE_MAX_SRCLIST);
       return 0;
     }
     if( nAlloc>SQLITE_MAX_SRCLIST ) nAlloc = SQLITE_MAX_SRCLIST;
@@ -110956,17 +111233,18 @@ SQLITE_PRIVATE void sqlite3UniqueConstra
   int onError,      /* Constraint type */
   Index *pIdx       /* The index that triggers the constraint */
 ){
   char *zErr;
   int j;
   StrAccum errMsg;
   Table *pTab = pIdx->pTable;
 
-  sqlite3StrAccumInit(&errMsg, pParse->db, 0, 0, 200);
+  sqlite3StrAccumInit(&errMsg, pParse->db, 0, 0, 
+                      pParse->db->aLimit[SQLITE_LIMIT_LENGTH]);
   if( pIdx->aColExpr ){
     sqlite3_str_appendf(&errMsg, "index '%q'", pIdx->zName);
   }else{
     for(j=0; j<pIdx->nKeyCol; j++){
       char *zCol;
       assert( pIdx->aiColumn[j]>=0 );
       zCol = pTab->aCol[pIdx->aiColumn[j]].zName;
       if( j ) sqlite3_str_append(&errMsg, ", ", 2);
@@ -111205,17 +111483,17 @@ SQLITE_PRIVATE With *sqlite3WithAdd(
     for(i=0; i<pWith->nCte; i++){
       if( sqlite3StrICmp(zName, pWith->a[i].zName)==0 ){
         sqlite3ErrorMsg(pParse, "duplicate WITH table name: %s", zName);
       }
     }
   }
 
   if( pWith ){
-    int nByte = sizeof(*pWith) + (sizeof(pWith->a[1]) * pWith->nCte);
+    sqlite3_int64 nByte = sizeof(*pWith) + (sizeof(pWith->a[1]) * pWith->nCte);
     pNew = sqlite3DbRealloc(db, pWith, nByte);
   }else{
     pNew = sqlite3DbMallocZero(db, sizeof(*pWith));
   }
   assert( (pNew!=0 && zName!=0) || db->mallocFailed );
 
   if( db->mallocFailed ){
     sqlite3ExprListDelete(db, pArglist);
@@ -114513,16 +114791,20 @@ SQLITE_PRIVATE void sqlite3RegisterPerCo
 ** Set the LIKEOPT flag on the 2-argument function with the given name.
 */
 static void setLikeOptFlag(sqlite3 *db, const char *zName, u8 flagVal){
   FuncDef *pDef;
   pDef = sqlite3FindFunction(db, zName, 2, SQLITE_UTF8, 0);
   if( ALWAYS(pDef) ){
     pDef->funcFlags |= flagVal;
   }
+  pDef = sqlite3FindFunction(db, zName, 3, SQLITE_UTF8, 0);
+  if( pDef ){
+    pDef->funcFlags |= flagVal;
+  }
 }
 
 /*
 ** Register the built-in LIKE and GLOB functions.  The caseSensitive
 ** parameter determines whether or not the LIKE operator is case
 ** sensitive.  GLOB is always case sensitive.
 */
 SQLITE_PRIVATE void sqlite3RegisterLikeFunctions(sqlite3 *db, int caseSensitive){
@@ -117835,17 +118117,19 @@ SQLITE_PRIVATE void sqlite3GenerateConst
         }
         sqlite3VdbeAddOp2(v, iField<0 ? OP_IntCopy : OP_SCopy, x, regIdx+i);
         VdbeComment((v, "%s", iField<0 ? "rowid" : pTab->aCol[iField].zName));
       }
     }
     sqlite3VdbeAddOp3(v, OP_MakeRecord, regIdx, pIdx->nColumn, aRegIdx[ix]);
     VdbeComment((v, "for %s", pIdx->zName));
 #ifdef SQLITE_ENABLE_NULL_TRIM
-    if( pIdx->idxType==2 ) sqlite3SetMakeRecordP5(v, pIdx->pTable);
+    if( pIdx->idxType==SQLITE_IDXTYPE_PRIMARYKEY ){
+      sqlite3SetMakeRecordP5(v, pIdx->pTable);
+    }
 #endif
 
     /* In an UPDATE operation, if this index is the PRIMARY KEY index 
     ** of a WITHOUT ROWID table and there has been no change the
     ** primary key, then no collision is possible.  The collision detection
     ** logic below can all be skipped. */
     if( isUpdate && pPk==pIdx && pkChng==0 ){
       sqlite3VdbeResolveLabel(v, addrUniqueOk);
@@ -118439,16 +118723,23 @@ static int xferOptimization(
       destHasUniqueIdx = 1;
     }
     for(pSrcIdx=pSrc->pIndex; pSrcIdx; pSrcIdx=pSrcIdx->pNext){
       if( xferCompatibleIndex(pDestIdx, pSrcIdx) ) break;
     }
     if( pSrcIdx==0 ){
       return 0;    /* pDestIdx has no corresponding index in pSrc */
     }
+    if( pSrcIdx->tnum==pDestIdx->tnum && pSrc->pSchema==pDest->pSchema
+         && sqlite3FaultSim(411)==SQLITE_OK ){
+      /* The sqlite3FaultSim() call allows this corruption test to be
+      ** bypassed during testing, in order to exercise other corruption tests
+      ** further downstream. */
+      return 0;   /* Corrupt schema - two indexes on the same btree */
+    }
   }
 #ifndef SQLITE_OMIT_CHECK
   if( pDest->pCheck && sqlite3ExprListCompare(pSrc->pCheck,pDest->pCheck,-1) ){
     return 0;   /* Tables have different CHECK constraints.  Ticket #2252 */
   }
 #endif
 #ifndef SQLITE_OMIT_FOREIGN_KEY
   /* Disallow the transfer optimization if the destination table constains
@@ -118516,17 +118807,17 @@ static int xferOptimization(
     if( pDest->iPKey>=0 ){
       addr1 = sqlite3VdbeAddOp2(v, OP_Rowid, iSrc, regRowid);
       sqlite3VdbeVerifyAbortable(v, onError);
       addr2 = sqlite3VdbeAddOp3(v, OP_NotExists, iDest, 0, regRowid);
       VdbeCoverage(v);
       sqlite3RowidConstraint(pParse, onError, pDest);
       sqlite3VdbeJumpHere(v, addr2);
       autoIncStep(pParse, regAutoinc, regRowid);
-    }else if( pDest->pIndex==0 ){
+    }else if( pDest->pIndex==0 && !(db->mDbFlags & DBFLAG_VacuumInto) ){
       addr1 = sqlite3VdbeAddOp2(v, OP_NewRowid, iDest, regRowid);
     }else{
       addr1 = sqlite3VdbeAddOp2(v, OP_Rowid, iSrc, regRowid);
       assert( (pDest->tabFlags & TF_Autoincrement)==0 );
     }
     sqlite3VdbeAddOp3(v, OP_RowData, iSrc, regData, 1);
     if( db->mDbFlags & DBFLAG_Vacuum ){
       sqlite3VdbeAddOp1(v, OP_SeekEnd, iDest);
@@ -118579,17 +118870,17 @@ static int xferOptimization(
         const char *zColl = pSrcIdx->azColl[i];
         if( sqlite3_stricmp(sqlite3StrBINARY, zColl) ) break;
       }
       if( i==pSrcIdx->nColumn ){
         idxInsFlags = OPFLAG_USESEEKRESULT;
         sqlite3VdbeAddOp1(v, OP_SeekEnd, iDest);
       }
     }
-    if( !HasRowid(pSrc) && pDestIdx->idxType==2 ){
+    if( !HasRowid(pSrc) && pDestIdx->idxType==SQLITE_IDXTYPE_PRIMARYKEY ){
       idxInsFlags |= OPFLAG_NCHANGE;
     }
     sqlite3VdbeAddOp2(v, OP_IdxInsert, iDest, regData);
     sqlite3VdbeChangeP5(v, idxInsFlags|OPFLAG_APPEND);
     sqlite3VdbeAddOp2(v, OP_Next, iSrc, addr1+1); VdbeCoverage(v);
     sqlite3VdbeJumpHere(v, addr1);
     sqlite3VdbeAddOp2(v, OP_Close, iSrc, 0);
     sqlite3VdbeAddOp2(v, OP_Close, iDest, 0);
@@ -119091,16 +119382,19 @@ struct sqlite3_api_routines {
   int (*create_window_function)(sqlite3*,const char*,int,int,void*,
                             void (*xStep)(sqlite3_context*,int,sqlite3_value**),
                             void (*xFinal)(sqlite3_context*),
                             void (*xValue)(sqlite3_context*),
                             void (*xInv)(sqlite3_context*,int,sqlite3_value**),
                             void(*xDestroy)(void*));
   /* Version 3.26.0 and later */
   const char *(*normalized_sql)(sqlite3_stmt*);
+  /* Version 3.28.0 and later */
+  int (*stmt_isexplain)(sqlite3_stmt*);
+  int (*value_frombind)(sqlite3_value*);
 };
 
 /*
 ** This is the function signature used for all extension entry points.  It
 ** is also defined in the file "loadext.c".
 */
 typedef int (*sqlite3_loadext_entry)(
   sqlite3 *db,                       /* Handle to the database. */
@@ -119380,16 +119674,19 @@ typedef int (*sqlite3_loadext_entry)(
 #define sqlite3_str_reset              sqlite3_api->str_reset
 #define sqlite3_str_errcode            sqlite3_api->str_errcode
 #define sqlite3_str_length             sqlite3_api->str_length
 #define sqlite3_str_value              sqlite3_api->str_value
 /* Version 3.25.0 and later */
 #define sqlite3_create_window_function sqlite3_api->create_window_function
 /* Version 3.26.0 and later */
 #define sqlite3_normalized_sql         sqlite3_api->normalized_sql
+/* Version 3.28.0 and later */
+#define sqlite3_stmt_isexplain         sqlite3_api->isexplain
+#define sqlite3_value_frombind         sqlite3_api->frombind
 #endif /* !defined(SQLITE_CORE) && !defined(SQLITE_OMIT_LOAD_EXTENSION) */
 
 #if !defined(SQLITE_CORE) && !defined(SQLITE_OMIT_LOAD_EXTENSION)
   /* This case when the file really is being compiled as a loadable 
   ** extension */
 # define SQLITE_EXTENSION_INIT1     const sqlite3_api_routines *sqlite3_api=0;
 # define SQLITE_EXTENSION_INIT2(v)  sqlite3_api=v;
 # define SQLITE_EXTENSION_INIT3     \
@@ -119839,20 +120136,23 @@ static const sqlite3_api_routines sqlite
   sqlite3_str_reset,
   sqlite3_str_errcode,
   sqlite3_str_length,
   sqlite3_str_value,
   /* Version 3.25.0 and later */
   sqlite3_create_window_function,
   /* Version 3.26.0 and later */
 #ifdef SQLITE_ENABLE_NORMALIZE
-  sqlite3_normalized_sql
-#else
-  0
-#endif
+  sqlite3_normalized_sql,
+#else
+  0,
+#endif
+  /* Version 3.28.0 and later */
+  sqlite3_stmt_isexplain,
+  sqlite3_value_frombind
 };
 
 /*
 ** Attempt to load an SQLite extension library contained in the file
 ** zFile.  The entry point is zProc.  zProc may be 0 in which case a
 ** default entry point name (sqlite3_extension_init) is used.  Use
 ** of the default name is recommended.
 **
@@ -129622,17 +129922,17 @@ static void finalizeAggFunctions(Parse *
 
 
 /*
 ** Update the accumulator memory cells for an aggregate based on
 ** the current cursor position.
 **
 ** If regAcc is non-zero and there are no min() or max() aggregates
 ** in pAggInfo, then only populate the pAggInfo->nAccumulator accumulator
-** registers i register regAcc contains 0. The caller will take care
+** registers if register regAcc contains 0. The caller will take care
 ** of setting and clearing regAcc.
 */
 static void updateAccumulator(Parse *pParse, int regAcc, AggInfo *pAggInfo){
   Vdbe *v = pParse->pVdbe;
   int i;
   int regHit = 0;
   int addrHitTest = 0;
   struct AggInfo_func *pF;
@@ -133714,51 +134014,55 @@ SQLITE_PRIVATE void sqlite3Vacuum(Parse 
 build_vacuum_end:
   sqlite3ExprDelete(pParse->db, pInto);
   return;
 }
 
 /*
 ** This routine implements the OP_Vacuum opcode of the VDBE.
 */
-SQLITE_PRIVATE int sqlite3RunVacuum(
+SQLITE_PRIVATE SQLITE_NOINLINE int sqlite3RunVacuum(
   char **pzErrMsg,        /* Write error message here */
   sqlite3 *db,            /* Database connection */
   int iDb,                /* Which attached DB to vacuum */
-  sqlite3_value *pOut     /* Write results here, if not NULL */
+  sqlite3_value *pOut     /* Write results here, if not NULL. VACUUM INTO */
 ){
   int rc = SQLITE_OK;     /* Return code from service routines */
   Btree *pMain;           /* The database being vacuumed */
   Btree *pTemp;           /* The temporary database we vacuum into */
   u32 saved_mDbFlags;     /* Saved value of db->mDbFlags */
   u64 saved_flags;        /* Saved value of db->flags */
   int saved_nChange;      /* Saved value of db->nChange */
   int saved_nTotalChange; /* Saved value of db->nTotalChange */
+  u32 saved_openFlags;    /* Saved value of db->openFlags */
   u8 saved_mTrace;        /* Saved trace settings */
   Db *pDb = 0;            /* Database to detach at end of vacuum */
   int isMemDb;            /* True if vacuuming a :memory: database */
   int nRes;               /* Bytes of reserved space at the end of each page */
   int nDb;                /* Number of attached databases */
   const char *zDbMain;    /* Schema name of database to vacuum */
   const char *zOut;       /* Name of output file */
 
   if( !db->autoCommit ){
     sqlite3SetString(pzErrMsg, db, "cannot VACUUM from within a transaction");
-    return SQLITE_ERROR;
+    return SQLITE_ERROR; /* IMP: R-12218-18073 */
   }
   if( db->nVdbeActive>1 ){
     sqlite3SetString(pzErrMsg, db,"cannot VACUUM - SQL statements in progress");
-    return SQLITE_ERROR;
-  }
+    return SQLITE_ERROR; /* IMP: R-15610-35227 */
+  }
+  saved_openFlags = db->openFlags;
   if( pOut ){
     if( sqlite3_value_type(pOut)!=SQLITE_TEXT ){
       sqlite3SetString(pzErrMsg, db, "non-text filename");
       return SQLITE_ERROR;
     }
     zOut = (const char*)sqlite3_value_text(pOut);
+    db->openFlags &= ~SQLITE_OPEN_READONLY;
+    db->openFlags |= SQLITE_OPEN_CREATE|SQLITE_OPEN_READWRITE;
   }else{
     zOut = "";
   }
 
   /* Save the current value of the database flags so that it can be 
   ** restored before returning. Then set the writable-schema flag, and
   ** disable CHECK and foreign key constraints.  */
   saved_flags = db->flags;
@@ -133787,29 +134091,31 @@ SQLITE_PRIVATE int sqlite3RunVacuum(
   ** that actually made the VACUUM run slower.  Very little journalling
   ** actually occurs when doing a vacuum since the vacuum_db is initially
   ** empty.  Only the journal header is written.  Apparently it takes more
   ** time to parse and run the PRAGMA to turn journalling off than it does
   ** to write the journal header file.
   */
   nDb = db->nDb;
   rc = execSqlF(db, pzErrMsg, "ATTACH %Q AS vacuum_db", zOut);
+  db->openFlags = saved_openFlags;
   if( rc!=SQLITE_OK ) goto end_of_vacuum;
   assert( (db->nDb-1)==nDb );
   pDb = &db->aDb[nDb];
   assert( strcmp(pDb->zDbSName,"vacuum_db")==0 );
   pTemp = pDb->pBt;
   if( pOut ){
     sqlite3_file *id = sqlite3PagerFile(sqlite3BtreePager(pTemp));
     i64 sz = 0;
     if( id->pMethods!=0 && (sqlite3OsFileSize(id, &sz)!=SQLITE_OK || sz>0) ){
       rc = SQLITE_ERROR;
       sqlite3SetString(pzErrMsg, db, "output file already exists");
       goto end_of_vacuum;
     }
+    db->mDbFlags |= DBFLAG_VacuumInto;
   }
   nRes = sqlite3BtreeGetOptimalReserve(pMain);
 
   /* A VACUUM cannot change the pagesize of an encrypted database. */
 #ifdef SQLITE_HAS_CODEC
   if( db->nextPagesize ){
     extern void sqlite3CodecGetKey(sqlite3*, int, void**, int*);
     int nKey;
@@ -134288,19 +134594,23 @@ SQLITE_PRIVATE void sqlite3VtabClear(sql
 }
 
 /*
 ** Add a new module argument to pTable->azModuleArg[].
 ** The string is not copied - the pointer is stored.  The
 ** string will be freed automatically when the table is
 ** deleted.
 */
-static void addModuleArgument(sqlite3 *db, Table *pTable, char *zArg){
-  int nBytes = sizeof(char *)*(2+pTable->nModuleArg);
+static void addModuleArgument(Parse *pParse, Table *pTable, char *zArg){
+  sqlite3_int64 nBytes = sizeof(char *)*(2+pTable->nModuleArg);
   char **azModuleArg;
+  sqlite3 *db = pParse->db;
+  if( pTable->nModuleArg+3>=db->aLimit[SQLITE_LIMIT_COLUMN] ){
+    sqlite3ErrorMsg(pParse, "too many columns on %s", pTable->zName);
+  }
   azModuleArg = sqlite3DbRealloc(db, pTable->azModuleArg, nBytes);
   if( azModuleArg==0 ){
     sqlite3DbFree(db, zArg);
   }else{
     int i = pTable->nModuleArg++;
     azModuleArg[i] = zArg;
     azModuleArg[i+1] = 0;
     pTable->azModuleArg = azModuleArg;
@@ -134325,19 +134635,19 @@ SQLITE_PRIVATE void sqlite3VtabBeginPars
   sqlite3StartTable(pParse, pName1, pName2, 0, 0, 1, ifNotExists);
   pTable = pParse->pNewTable;
   if( pTable==0 ) return;
   assert( 0==pTable->pIndex );
 
   db = pParse->db;
 
   assert( pTable->nModuleArg==0 );
-  addModuleArgument(db, pTable, sqlite3NameFromToken(db, pModuleName));
-  addModuleArgument(db, pTable, 0);
-  addModuleArgument(db, pTable, sqlite3DbStrDup(db, pTable->zName));
+  addModuleArgument(pParse, pTable, sqlite3NameFromToken(db, pModuleName));
+  addModuleArgument(pParse, pTable, 0);
+  addModuleArgument(pParse, pTable, sqlite3DbStrDup(db, pTable->zName));
   assert( (pParse->sNameToken.z==pName2->z && pName2->z!=0)
        || (pParse->sNameToken.z==pName1->z && pName2->z==0)
   );
   pParse->sNameToken.n = (int)(
       &pModuleName->z[pModuleName->n] - pParse->sNameToken.z
   );
 
 #ifndef SQLITE_OMIT_AUTHORIZATION
@@ -134360,17 +134670,17 @@ SQLITE_PRIVATE void sqlite3VtabBeginPars
 ** in pParse->zArg[] and appends it to the list of arguments on the
 ** virtual table currently under construction in pParse->pTable.
 */
 static void addArgumentToVtab(Parse *pParse){
   if( pParse->sArg.z && pParse->pNewTable ){
     const char *z = (const char*)pParse->sArg.z;
     int n = pParse->sArg.n;
     sqlite3 *db = pParse->db;
-    addModuleArgument(db, pParse->pNewTable, sqlite3DbStrNDup(db, z, n));
+    addModuleArgument(pParse, pParse->pNewTable, sqlite3DbStrNDup(db, z, n));
   }
 }
 
 /*
 ** The parser calls this routine after the CREATE VIRTUAL TABLE statement
 ** has been completely parsed.
 */
 SQLITE_PRIVATE void sqlite3VtabFinishParse(Parse *pParse, Token *pEnd){
@@ -134649,17 +134959,18 @@ SQLITE_PRIVATE int sqlite3VtabCallConnec
 ** more v-table. Return SQLITE_NOMEM if a malloc fails, or SQLITE_OK otherwise.
 */
 static int growVTrans(sqlite3 *db){
   const int ARRAY_INCR = 5;
 
   /* Grow the sqlite3.aVTrans array if required */
   if( (db->nVTrans%ARRAY_INCR)==0 ){
     VTable **aVTrans;
-    int nBytes = sizeof(sqlite3_vtab *) * (db->nVTrans + ARRAY_INCR);
+    sqlite3_int64 nBytes = sizeof(sqlite3_vtab*)*
+                                 ((sqlite3_int64)db->nVTrans + ARRAY_INCR);
     aVTrans = sqlite3DbRealloc(db, (void *)db->aVTrans, nBytes);
     if( !aVTrans ){
       return SQLITE_NOMEM_BKPT;
     }
     memset(&aVTrans[db->nVTrans], 0, sizeof(sqlite3_vtab *)*ARRAY_INCR);
     db->aVTrans = aVTrans;
   }
 
@@ -135145,19 +135456,19 @@ SQLITE_PRIVATE int sqlite3VtabEponymousT
     sqlite3DbFree(db, pTab);
     return 0;
   }
   pMod->pEpoTab = pTab;
   pTab->nTabRef = 1;
   pTab->pSchema = db->aDb[0].pSchema;
   assert( pTab->nModuleArg==0 );
   pTab->iPKey = -1;
-  addModuleArgument(db, pTab, sqlite3DbStrDup(db, pTab->zName));
-  addModuleArgument(db, pTab, 0);
-  addModuleArgument(db, pTab, sqlite3DbStrDup(db, pTab->zName));
+  addModuleArgument(pParse, pTab, sqlite3DbStrDup(db, pTab->zName));
+  addModuleArgument(pParse, pTab, 0);
+  addModuleArgument(pParse, pTab, sqlite3DbStrDup(db, pTab->zName));
   rc = vtabCallConstructor(db, pTab, pMod, pModule->xConnect, &zErr);
   if( rc ){
     sqlite3ErrorMsg(pParse, "%s", zErr);
     sqlite3DbFree(db, zErr);
     sqlite3VtabEponymousTableClear(db, pMod);
     return 0;
   }
   return 1;
@@ -136986,16 +137297,44 @@ static void whereIndexExprTrans(
     x.pIdxExpr = aColExpr->a[iIdxCol].pExpr;
     sqlite3WalkExpr(&w, pWInfo->pWhere);
     sqlite3WalkExprList(&w, pWInfo->pOrderBy);
     sqlite3WalkExprList(&w, pWInfo->pResultSet);
   }
 }
 
 /*
+** The pTruth expression is always true because it is the WHERE clause
+** a partial index that is driving a query loop.  Look through all of the
+** WHERE clause terms on the query, and if any of those terms must be
+** true because pTruth is true, then mark those WHERE clause terms as
+** coded.
+*/
+static void whereApplyPartialIndexConstraints(
+  Expr *pTruth,
+  int iTabCur,
+  WhereClause *pWC
+){
+  int i;
+  WhereTerm *pTerm;
+  while( pTruth->op==TK_AND ){
+    whereApplyPartialIndexConstraints(pTruth->pLeft, iTabCur, pWC);
+    pTruth = pTruth->pRight;
+  }
+  for(i=0, pTerm=pWC->a; i<pWC->nTerm; i++, pTerm++){
+    Expr *pExpr;
+    if( pTerm->wtFlags & TERM_CODED ) continue;
+    pExpr = pTerm->pExpr;
+    if( sqlite3ExprCompare(0, pExpr, pTruth, iTabCur)==0 ){
+      pTerm->wtFlags |= TERM_CODED;
+    }
+  }
+}
+
+/*
 ** Generate code for the start of the iLevel-th loop in the WHERE clause
 ** implementation described by pWInfo.
 */
 SQLITE_PRIVATE Bitmask sqlite3WhereCodeOneLoopStart(
   Parse *pParse,       /* Parsing context */
   Vdbe *v,             /* Prepared statement under construction */
   WhereInfo *pWInfo,   /* Complete information about the WHERE clause */
   int iLevel,          /* Which level of pWInfo->a[] should be coded */
@@ -137594,16 +137933,24 @@ SQLITE_PRIVATE Bitmask sqlite3WhereCodeO
     ** OR clause, since the transformation will become invalid once we
     ** move forward to the next index.
     ** https://sqlite.org/src/info/4e8e4857d32d401f
     */
     if( pLevel->iLeftJoin==0 && (pWInfo->wctrlFlags & WHERE_OR_SUBCLAUSE)==0 ){
       whereIndexExprTrans(pIdx, iCur, iIdxCur, pWInfo);
     }
 
+    /* If a partial index is driving the loop, try to eliminate WHERE clause
+    ** terms from the query that must be true due to the WHERE clause of
+    ** the partial index
+    */
+    if( pIdx->pPartIdxWhere ){
+      whereApplyPartialIndexConstraints(pIdx->pPartIdxWhere, iCur, pWC);
+    }
+
     /* Record the instruction used to terminate the loop. */
     if( pLoop->wsFlags & WHERE_ONEROW ){
       pLevel->op = OP_Noop;
     }else if( bRev ){
       pLevel->op = OP_Prev;
     }else{
       pLevel->op = OP_Next;
     }
@@ -137757,17 +138104,22 @@ SQLITE_PRIVATE Bitmask sqlite3WhereCodeO
         testcase( pWC->a[iTerm].wtFlags & TERM_CODED );
         if( (pWC->a[iTerm].wtFlags & (TERM_VIRTUAL|TERM_CODED))!=0 ) continue;
         if( (pWC->a[iTerm].eOperator & WO_ALL)==0 ) continue;
         testcase( pWC->a[iTerm].wtFlags & TERM_ORINFO );
         pExpr = sqlite3ExprDup(db, pExpr, 0);
         pAndExpr = sqlite3ExprAnd(db, pAndExpr, pExpr);
       }
       if( pAndExpr ){
-        pAndExpr = sqlite3PExpr(pParse, TK_AND|TKFLG_DONTFOLD, 0, pAndExpr);
+        /* The extra 0x10000 bit on the opcode is masked off and does not
+        ** become part of the new Expr.op.  However, it does make the
+        ** op==TK_AND comparison inside of sqlite3PExpr() false, and this
+        ** prevents sqlite3PExpr() from implementing AND short-circuit 
+        ** optimization, which we do not want here. */
+        pAndExpr = sqlite3PExpr(pParse, TK_AND|0x10000, 0, pAndExpr);
       }
     }
 
     /* Run a separate WHERE clause for each term of the OR clause.  After
     ** eliminating duplicates from other WHERE clauses, the action for each
     ** sub-WHERE clause is to to invoke the main loop body as a subroutine.
     */
     wctrlFlags =  WHERE_OR_SUBCLAUSE | (pWInfo->wctrlFlags & WHERE_SEEK_TABLE);
@@ -137987,18 +138339,19 @@ SQLITE_PRIVATE Bitmask sqlite3WhereCodeO
         ** for strings.  So do not skip the call to the function on the pass
         ** that compares BLOBs. */
 #ifdef SQLITE_LIKE_DOESNT_MATCH_BLOBS
         continue;
 #else
         u32 x = pLevel->iLikeRepCntr;
         if( x>0 ){
           skipLikeAddr = sqlite3VdbeAddOp1(v, (x&1)?OP_IfNot:OP_If,(int)(x>>1));
-        }
-        VdbeCoverage(v);
+          VdbeCoverageIf(v, (x&1)==1);
+          VdbeCoverageIf(v, (x&1)==0);
+        }
 #endif
       }
 #ifdef WHERETRACE_ENABLED /* 0xffff */
       if( sqlite3WhereTrace ){
         VdbeNoopComment((v, "WhereTerm[%d] (%p) priority=%d",
                          pWC->nTerm-j, pTerm, iLoop));
       }
 #endif
@@ -139590,16 +139943,22 @@ SQLITE_PRIVATE Bitmask sqlite3WhereExprU
     mask |= sqlite3WhereExprUsageNN(pMaskSet, p->pRight);
     assert( p->x.pList==0 );
   }else if( ExprHasProperty(p, EP_xIsSelect) ){
     if( ExprHasProperty(p, EP_VarSelect) ) pMaskSet->bVarSelect = 1;
     mask |= exprSelectUsage(pMaskSet, p->x.pSelect);
   }else if( p->x.pList ){
     mask |= sqlite3WhereExprListUsage(pMaskSet, p->x.pList);
   }
+#ifndef SQLITE_OMIT_WINDOWFUNC
+  if( p->op==TK_FUNCTION && p->y.pWin ){
+    mask |= sqlite3WhereExprListUsage(pMaskSet, p->y.pWin->pPartition);
+    mask |= sqlite3WhereExprListUsage(pMaskSet, p->y.pWin->pOrderBy);
+  }
+#endif
   return mask;
 }
 SQLITE_PRIVATE Bitmask sqlite3WhereExprUsage(WhereMaskSet *pMaskSet, Expr *p){
   return p ? sqlite3WhereExprUsageNN(pMaskSet,p) : 0;
 }
 SQLITE_PRIVATE Bitmask sqlite3WhereExprListUsage(WhereMaskSet *pMaskSet, ExprList *pList){
   int i;
   Bitmask mask = 0;
@@ -143006,21 +143365,21 @@ static int whereLoopAddVirtual(
   }
 
   /* First call xBestIndex() with all constraints usable. */
   WHERETRACE(0x800, ("BEGIN %s.addVirtual()\n", pSrc->pTab->zName));
   WHERETRACE(0x40, ("  VirtualOne: all usable\n"));
   rc = whereLoopAddVirtualOne(pBuilder, mPrereq, ALLBITS, 0, p, mNoOmit, &bIn);
 
   /* If the call to xBestIndex() with all terms enabled produced a plan
-  ** that does not require any source tables (IOW: a plan with mBest==0),
-  ** then there is no point in making any further calls to xBestIndex() 
-  ** since they will all return the same result (if the xBestIndex()
-  ** implementation is sane). */
-  if( rc==SQLITE_OK && (mBest = (pNew->prereq & ~mPrereq))!=0 ){
+  ** that does not require any source tables (IOW: a plan with mBest==0)
+  ** and does not use an IN(...) operator, then there is no point in making 
+  ** any further calls to xBestIndex() since they will all return the same
+  ** result (if the xBestIndex() implementation is sane). */
+  if( rc==SQLITE_OK && ((mBest = (pNew->prereq & ~mPrereq))!=0 || bIn) ){
     int seenZero = 0;             /* True if a plan with no prereqs seen */
     int seenZeroNoIN = 0;         /* Plan with no prereqs and no IN(...) seen */
     Bitmask mPrev = 0;
     Bitmask mBestNoIn = 0;
 
     /* If the plan produced by the earlier call uses an IN(...) term, call
     ** xBestIndex again, this time with IN(...) terms disabled. */
     if( bIn ){
@@ -145244,16 +145603,106 @@ static void dense_rankValueFunc(sqlite3_
       p->nValue++;
       p->nStep = 0;
     }
     sqlite3_result_int64(pCtx, p->nValue);
   }
 }
 
 /*
+** Implementation of built-in window function nth_value(). This
+** implementation is used in "slow mode" only - when the EXCLUDE clause
+** is not set to the default value "NO OTHERS".
+*/
+struct NthValueCtx {
+  i64 nStep;
+  sqlite3_value *pValue;
+};
+static void nth_valueStepFunc(
+  sqlite3_context *pCtx, 
+  int nArg,
+  sqlite3_value **apArg
+){
+  struct NthValueCtx *p;
+  p = (struct NthValueCtx*)sqlite3_aggregate_context(pCtx, sizeof(*p));
+  if( p ){
+    i64 iVal;
+    switch( sqlite3_value_numeric_type(apArg[1]) ){
+      case SQLITE_INTEGER:
+        iVal = sqlite3_value_int64(apArg[1]);
+        break;
+      case SQLITE_FLOAT: {
+        double fVal = sqlite3_value_double(apArg[1]);
+        if( ((i64)fVal)!=fVal ) goto error_out;
+        iVal = (i64)fVal;
+        break;
+      }
+      default:
+        goto error_out;
+    }
+    if( iVal<=0 ) goto error_out;
+
+    p->nStep++;
+    if( iVal==p->nStep ){
+      p->pValue = sqlite3_value_dup(apArg[0]);
+      if( !p->pValue ){
+        sqlite3_result_error_nomem(pCtx);
+      }
+    }
+  }
+  UNUSED_PARAMETER(nArg);
+  UNUSED_PARAMETER(apArg);
+  return;
+
+ error_out:
+  sqlite3_result_error(
+      pCtx, "second argument to nth_value must be a positive integer", -1
+  );
+}
+static void nth_valueFinalizeFunc(sqlite3_context *pCtx){
+  struct NthValueCtx *p;
+  p = (struct NthValueCtx*)sqlite3_aggregate_context(pCtx, 0);
+  if( p && p->pValue ){
+    sqlite3_result_value(pCtx, p->pValue);
+    sqlite3_value_free(p->pValue);
+    p->pValue = 0;
+  }
+}
+#define nth_valueInvFunc noopStepFunc
+#define nth_valueValueFunc noopValueFunc
+
+static void first_valueStepFunc(
+  sqlite3_context *pCtx, 
+  int nArg,
+  sqlite3_value **apArg
+){
+  struct NthValueCtx *p;
+  p = (struct NthValueCtx*)sqlite3_aggregate_context(pCtx, sizeof(*p));
+  if( p && p->pValue==0 ){
+    p->pValue = sqlite3_value_dup(apArg[0]);
+    if( !p->pValue ){
+      sqlite3_result_error_nomem(pCtx);
+    }
+  }
+  UNUSED_PARAMETER(nArg);
+  UNUSED_PARAMETER(apArg);
+}
+static void first_valueFinalizeFunc(sqlite3_context *pCtx){
+  struct NthValueCtx *p;
+  p = (struct NthValueCtx*)sqlite3_aggregate_context(pCtx, sizeof(*p));
+  if( p && p->pValue ){
+    sqlite3_result_value(pCtx, p->pValue);
+    sqlite3_value_free(p->pValue);
+    p->pValue = 0;
+  }
+}
+#define first_valueInvFunc noopStepFunc
+#define first_valueValueFunc noopValueFunc
+
+/*
 ** Implementation of built-in window function rank(). Assumes that
 ** the window frame has been set to:
 **
 **   RANGE BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW 
 */
 static void rankStepFunc(
   sqlite3_context *pCtx, 
   int nArg,
@@ -145278,140 +145727,166 @@ static void rankValueFunc(sqlite3_contex
     p->nValue = 0;
   }
 }
 
 /*
 ** Implementation of built-in window function percent_rank(). Assumes that
 ** the window frame has been set to:
 **
-**   RANGE BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW 
+**   GROUPS BETWEEN CURRENT ROW AND UNBOUNDED FOLLOWING
 */
 static void percent_rankStepFunc(
   sqlite3_context *pCtx, 
   int nArg,
   sqlite3_value **apArg
 ){
   struct CallCount *p;
-  UNUSED_PARAMETER(nArg); assert( nArg==1 );
-
+  UNUSED_PARAMETER(nArg); assert( nArg==0 );
+  UNUSED_PARAMETER(apArg);
   p = (struct CallCount*)sqlite3_aggregate_context(pCtx, sizeof(*p));
   if( p ){
-    if( p->nTotal==0 ){
-      p->nTotal = sqlite3_value_int64(apArg[0]);
-    }
-    p->nStep++;
-    if( p->nValue==0 ){
-      p->nValue = p->nStep;
-    }
-  }
+    p->nTotal++;
+  }
+}
+static void percent_rankInvFunc(
+  sqlite3_context *pCtx, 
+  int nArg,
+  sqlite3_value **apArg
+){
+  struct CallCount *p;
+  UNUSED_PARAMETER(nArg); assert( nArg==0 );
+  UNUSED_PARAMETER(apArg);
+  p = (struct CallCount*)sqlite3_aggregate_context(pCtx, sizeof(*p));
+  p->nStep++;
 }
 static void percent_rankValueFunc(sqlite3_context *pCtx){
   struct CallCount *p;
   p = (struct CallCount*)sqlite3_aggregate_context(pCtx, sizeof(*p));
   if( p ){
+    p->nValue = p->nStep;
     if( p->nTotal>1 ){
-      double r = (double)(p->nValue-1) / (double)(p->nTotal-1);
+      double r = (double)p->nValue / (double)(p->nTotal-1);
       sqlite3_result_double(pCtx, r);
     }else{
       sqlite3_result_double(pCtx, 0.0);
     }
-    p->nValue = 0;
-  }
-}
+  }
+}
+#define percent_rankFinalizeFunc percent_rankValueFunc
 
 /*
 ** Implementation of built-in window function cume_dist(). Assumes that
 ** the window frame has been set to:
 **
-**   RANGE BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW 
+**   GROUPS BETWEEN 1 FOLLOWING AND UNBOUNDED FOLLOWING
 */
 static void cume_distStepFunc(
   sqlite3_context *pCtx, 
   int nArg,
   sqlite3_value **apArg
 ){
   struct CallCount *p;
-  assert( nArg==1 ); UNUSED_PARAMETER(nArg);
-
+  UNUSED_PARAMETER(nArg); assert( nArg==0 );
+  UNUSED_PARAMETER(apArg);
   p = (struct CallCount*)sqlite3_aggregate_context(pCtx, sizeof(*p));
   if( p ){
-    if( p->nTotal==0 ){
-      p->nTotal = sqlite3_value_int64(apArg[0]);
-    }
-    p->nStep++;
-  }
+    p->nTotal++;
+  }
+}
+static void cume_distInvFunc(
+  sqlite3_context *pCtx, 
+  int nArg,
+  sqlite3_value **apArg
+){
+  struct CallCount *p;
+  UNUSED_PARAMETER(nArg); assert( nArg==0 );
+  UNUSED_PARAMETER(apArg);
+  p = (struct CallCount*)sqlite3_aggregate_context(pCtx, sizeof(*p));
+  p->nStep++;
 }
 static void cume_distValueFunc(sqlite3_context *pCtx){
   struct CallCount *p;
-  p = (struct CallCount*)sqlite3_aggregate_context(pCtx, sizeof(*p));
-  if( p && p->nTotal ){
+  p = (struct CallCount*)sqlite3_aggregate_context(pCtx, 0);
+  if( p ){
     double r = (double)(p->nStep) / (double)(p->nTotal);
     sqlite3_result_double(pCtx, r);
   }
 }
+#define cume_distFinalizeFunc cume_distValueFunc
 
 /*
 ** Context object for ntile() window function.
 */
 struct NtileCtx {
   i64 nTotal;                     /* Total rows in partition */
   i64 nParam;                     /* Parameter passed to ntile(N) */
   i64 iRow;                       /* Current row */
 };
 
 /*
 ** Implementation of ntile(). This assumes that the window frame has
 ** been coerced to:
 **
-**   ROWS UNBOUNDED PRECEDING AND CURRENT ROW
+**   ROWS CURRENT ROW AND UNBOUNDED FOLLOWING
 */
 static void ntileStepFunc(
   sqlite3_context *pCtx, 
   int nArg,
   sqlite3_value **apArg
 ){
   struct NtileCtx *p;
-  assert( nArg==2 ); UNUSED_PARAMETER(nArg);
+  assert( nArg==1 ); UNUSED_PARAMETER(nArg);
   p = (struct NtileCtx*)sqlite3_aggregate_context(pCtx, sizeof(*p));
   if( p ){
     if( p->nTotal==0 ){
       p->nParam = sqlite3_value_int64(apArg[0]);
-      p->nTotal = sqlite3_value_int64(apArg[1]);
       if( p->nParam<=0 ){
         sqlite3_result_error(
             pCtx, "argument of ntile must be a positive integer", -1
         );
       }
     }
-    p->iRow++;
-  }
+    p->nTotal++;
+  }
+}
+static void ntileInvFunc(
+  sqlite3_context *pCtx, 
+  int nArg,
+  sqlite3_value **apArg
+){
+  struct NtileCtx *p;
+  assert( nArg==1 ); UNUSED_PARAMETER(nArg);
+  UNUSED_PARAMETER(apArg);
+  p = (struct NtileCtx*)sqlite3_aggregate_context(pCtx, sizeof(*p));
+  p->iRow++;
 }
 static void ntileValueFunc(sqlite3_context *pCtx){
   struct NtileCtx *p;
   p = (struct NtileCtx*)sqlite3_aggregate_context(pCtx, sizeof(*p));
   if( p && p->nParam>0 ){
     int nSize = (p->nTotal / p->nParam);
     if( nSize==0 ){
-      sqlite3_result_int64(pCtx, p->iRow);
+      sqlite3_result_int64(pCtx, p->iRow+1);
     }else{
       i64 nLarge = p->nTotal - p->nParam*nSize;
       i64 iSmall = nLarge*(nSize+1);
-      i64 iRow = p->iRow-1;
+      i64 iRow = p->iRow;
 
       assert( (nLarge*(nSize+1) + (p->nParam-nLarge)*nSize)==p->nTotal );
 
       if( iRow<iSmall ){
         sqlite3_result_int64(pCtx, 1 + iRow/(nSize+1));
       }else{
         sqlite3_result_int64(pCtx, 1 + nLarge + (iRow-iSmall)/nSize);
       }
     }
   }
 }
+#define ntileFinalizeFunc ntileValueFunc
 
 /*
 ** Context object for last_value() window function.
 */
 struct LastValueCtx {
   sqlite3_value *pVal;
   int nVal;
 };
@@ -145451,17 +145926,17 @@ static void last_valueInvFunc(
     if( p->nVal==0 ){
       sqlite3_value_free(p->pVal);
       p->pVal = 0;
     }
   }
 }
 static void last_valueValueFunc(sqlite3_context *pCtx){
   struct LastValueCtx *p;
-  p = (struct LastValueCtx*)sqlite3_aggregate_context(pCtx, sizeof(*p));
+  p = (struct LastValueCtx*)sqlite3_aggregate_context(pCtx, 0);
   if( p && p->pVal ){
     sqlite3_result_value(pCtx, p->pVal);
   }
 }
 static void last_valueFinalizeFunc(sqlite3_context *pCtx){
   struct LastValueCtx *p;
   p = (struct LastValueCtx*)sqlite3_aggregate_context(pCtx, sizeof(*p));
   if( p && p->pVal ){
@@ -145541,32 +146016,43 @@ static void noopValueFunc(sqlite3_contex
 /*
 ** Register those built-in window functions that are not also aggregates.
 */
 SQLITE_PRIVATE void sqlite3WindowFunctions(void){
   static FuncDef aWindowFuncs[] = {
     WINDOWFUNCX(row_number, 0, 0),
     WINDOWFUNCX(dense_rank, 0, 0),
     WINDOWFUNCX(rank, 0, 0),
-    WINDOWFUNCX(percent_rank, 0, SQLITE_FUNC_WINDOW_SIZE),
-    WINDOWFUNCX(cume_dist, 0, SQLITE_FUNC_WINDOW_SIZE),
-    WINDOWFUNCX(ntile, 1, SQLITE_FUNC_WINDOW_SIZE),
+    WINDOWFUNCALL(percent_rank, 0, 0),
+    WINDOWFUNCALL(cume_dist, 0, 0),
+    WINDOWFUNCALL(ntile, 1, 0),
     WINDOWFUNCALL(last_value, 1, 0),
-    WINDOWFUNCNOOP(nth_value, 2, 0),
-    WINDOWFUNCNOOP(first_value, 1, 0),
+    WINDOWFUNCALL(nth_value, 2, 0),
+    WINDOWFUNCALL(first_value, 1, 0),
     WINDOWFUNCNOOP(lead, 1, 0),
     WINDOWFUNCNOOP(lead, 2, 0),
     WINDOWFUNCNOOP(lead, 3, 0),
     WINDOWFUNCNOOP(lag, 1, 0),
     WINDOWFUNCNOOP(lag, 2, 0),
     WINDOWFUNCNOOP(lag, 3, 0),
   };
   sqlite3InsertBuiltinFuncs(aWindowFuncs, ArraySize(aWindowFuncs));
 }
 
+static Window *windowFind(Parse *pParse, Window *pList, const char *zName){
+  Window *p;
+  for(p=pList; p; p=p->pNextWin){
+    if( sqlite3StrICmp(p->zName, zName)==0 ) break;
+  }
+  if( p==0 ){
+    sqlite3ErrorMsg(pParse, "no such window: %s", zName);
+  }
+  return p;
+}
+
 /*
 ** This function is called immediately after resolving the function name
 ** for a window function within a SELECT statement. Argument pList is a
 ** linked list of WINDOW definitions for the current SELECT statement.
 ** Argument pFunc is the function definition just resolved and pWin
 ** is the Window object representing the associated OVER clause. This
 ** function updates the contents of pWin as follows:
 **
@@ -145580,58 +146066,76 @@ SQLITE_PRIVATE void sqlite3WindowFunctio
 **     of this file), pWin is updated here.
 */
 SQLITE_PRIVATE void sqlite3WindowUpdate(
   Parse *pParse, 
   Window *pList,                  /* List of named windows for this SELECT */
   Window *pWin,                   /* Window frame to update */
   FuncDef *pFunc                  /* Window function definition */
 ){
-  if( pWin->zName && pWin->eType==0 ){
-    Window *p;
-    for(p=pList; p; p=p->pNextWin){
-      if( sqlite3StrICmp(p->zName, pWin->zName)==0 ) break;
-    }
-    if( p==0 ){
-      sqlite3ErrorMsg(pParse, "no such window: %s", pWin->zName);
-      return;
-    }
+  if( pWin->zName && pWin->eFrmType==0 ){
+    Window *p = windowFind(pParse, pList, pWin->zName);
+    if( p==0 ) return;
     pWin->pPartition = sqlite3ExprListDup(pParse->db, p->pPartition, 0);
     pWin->pOrderBy = sqlite3ExprListDup(pParse->db, p->pOrderBy, 0);
     pWin->pStart = sqlite3ExprDup(pParse->db, p->pStart, 0);
     pWin->pEnd = sqlite3ExprDup(pParse->db, p->pEnd, 0);
     pWin->eStart = p->eStart;
     pWin->eEnd = p->eEnd;
-    pWin->eType = p->eType;
-  }
+    pWin->eFrmType = p->eFrmType;
+    pWin->eExclude = p->eExclude;
+  }else{
+    sqlite3WindowChain(pParse, pWin, pList);
+  }
+  if( (pWin->eFrmType==TK_RANGE)
+   && (pWin->pStart || pWin->pEnd) 
+   && (pWin->pOrderBy==0 || pWin->pOrderBy->nExpr!=1)
+  ){
+    sqlite3ErrorMsg(pParse, 
+      "RANGE with offset PRECEDING/FOLLOWING requires one ORDER BY expression"
+    );
+  }else
   if( pFunc->funcFlags & SQLITE_FUNC_WINDOW ){
     sqlite3 *db = pParse->db;
     if( pWin->pFilter ){
       sqlite3ErrorMsg(pParse, 
           "FILTER clause may only be used with aggregate window functions"
       );
-    }else
-    if( pFunc->zName==row_numberName || pFunc->zName==ntileName ){
-      sqlite3ExprDelete(db, pWin->pStart);
-      sqlite3ExprDelete(db, pWin->pEnd);
-      pWin->pStart = pWin->pEnd = 0;
-      pWin->eType = TK_ROWS;
-      pWin->eStart = TK_UNBOUNDED;
-      pWin->eEnd = TK_CURRENT;
-    }else
-
-    if( pFunc->zName==dense_rankName || pFunc->zName==rankName
-     || pFunc->zName==percent_rankName || pFunc->zName==cume_distName
-    ){
-      sqlite3ExprDelete(db, pWin->pStart);
-      sqlite3ExprDelete(db, pWin->pEnd);
-      pWin->pStart = pWin->pEnd = 0;
-      pWin->eType = TK_RANGE;
-      pWin->eStart = TK_UNBOUNDED;
-      pWin->eEnd = TK_CURRENT;
+    }else{
+      struct WindowUpdate {
+        const char *zFunc;
+        int eFrmType;
+        int eStart;
+        int eEnd;
+      } aUp[] = {
+        { row_numberName,   TK_ROWS,   TK_UNBOUNDED, TK_CURRENT }, 
+        { dense_rankName,   TK_RANGE,  TK_UNBOUNDED, TK_CURRENT }, 
+        { rankName,         TK_RANGE,  TK_UNBOUNDED, TK_CURRENT }, 
+        { percent_rankName, TK_GROUPS, TK_CURRENT,   TK_UNBOUNDED }, 
+        { cume_distName,    TK_GROUPS, TK_FOLLOWING, TK_UNBOUNDED }, 
+        { ntileName,        TK_ROWS,   TK_CURRENT,   TK_UNBOUNDED }, 
+        { leadName,         TK_ROWS,   TK_UNBOUNDED, TK_UNBOUNDED }, 
+        { lagName,          TK_ROWS,   TK_UNBOUNDED, TK_CURRENT }, 
+      };
+      int i;
+      for(i=0; i<ArraySize(aUp); i++){
+        if( pFunc->zName==aUp[i].zFunc ){
+          sqlite3ExprDelete(db, pWin->pStart);
+          sqlite3ExprDelete(db, pWin->pEnd);
+          pWin->pEnd = pWin->pStart = 0;
+          pWin->eFrmType = aUp[i].eFrmType;
+          pWin->eStart = aUp[i].eStart;
+          pWin->eEnd = aUp[i].eEnd;
+          pWin->eExclude = 0;
+          if( pWin->eStart==TK_FOLLOWING ){
+            pWin->pStart = sqlite3Expr(db, TK_INTEGER, "1");
+          }
+          break;
+        }
+      }
     }
   }
   pWin->pFunc = pFunc;
 }
 
 /*
 ** Context object passed through sqlite3WalkExprList() to
 ** selectWindowRewriteExprCb() by selectWindowRewriteEList().
@@ -145826,16 +146330,17 @@ SQLITE_PRIVATE int sqlite3WindowRewrite(
         p->pOrderBy = 0;
       }
     }
 
     /* Assign a cursor number for the ephemeral table used to buffer rows.
     ** The OpenEphemeral instruction is coded later, after it is known how
     ** many columns the table will have.  */
     pMWin->iEphCsr = pParse->nTab++;
+    pParse->nTab += 3;
 
     selectWindowRewriteEList(pParse, pMWin, pSrc, p->pEList, &pSublist);
     selectWindowRewriteEList(pParse, pMWin, pSrc, p->pOrderBy, &pSublist);
     pMWin->nBufferCol = (pSublist ? pSublist->nExpr : 0);
 
     /* Append the PARTITION BY and ORDER BY expressions to the to the 
     ** sub-select expression list. They are required to figure out where 
     ** boundaries for partitions and sets of peer rows lie.  */
@@ -145881,16 +146386,19 @@ SQLITE_PRIVATE int sqlite3WindowRewrite(
         rc = SQLITE_NOMEM;
       }else{
         pSub->selFlags |= SF_Expanded;
         p->selFlags &= ~SF_Aggregate;
         sqlite3SelectPrep(pParse, pSub, 0);
       }
 
       sqlite3VdbeAddOp2(v, OP_OpenEphemeral, pMWin->iEphCsr, pSublist->nExpr);
+      sqlite3VdbeAddOp2(v, OP_OpenDup, pMWin->iEphCsr+1, pMWin->iEphCsr);
+      sqlite3VdbeAddOp2(v, OP_OpenDup, pMWin->iEphCsr+2, pMWin->iEphCsr);
+      sqlite3VdbeAddOp2(v, OP_OpenDup, pMWin->iEphCsr+3, pMWin->iEphCsr);
     }else{
       sqlite3SelectDelete(db, pSub);
     }
     if( db->mallocFailed ) rc = SQLITE_NOMEM;
   }
 
   return rc;
 }
@@ -145901,16 +146409,17 @@ SQLITE_PRIVATE int sqlite3WindowRewrite(
 SQLITE_PRIVATE void sqlite3WindowDelete(sqlite3 *db, Window *p){
   if( p ){
     sqlite3ExprDelete(db, p->pFilter);
     sqlite3ExprListDelete(db, p->pPartition);
     sqlite3ExprListDelete(db, p->pOrderBy);
     sqlite3ExprDelete(db, p->pEnd);
     sqlite3ExprDelete(db, p->pStart);
     sqlite3DbFree(db, p->zName);
+    sqlite3DbFree(db, p->zBase);
     sqlite3DbFree(db, p);
   }
 }
 
 /*
 ** Free the linked list of Window objects starting at the second argument.
 */
 SQLITE_PRIVATE void sqlite3WindowListDelete(sqlite3 *db, Window *p){
@@ -145937,40 +146446,38 @@ static Expr *sqlite3WindowOffsetExpr(Par
   return pExpr;
 }
 
 /*
 ** Allocate and return a new Window object describing a Window Definition.
 */
 SQLITE_PRIVATE Window *sqlite3WindowAlloc(
   Parse *pParse,    /* Parsing context */
-  int eType,        /* Frame type. TK_RANGE or TK_ROWS */
+  int eType,        /* Frame type. TK_RANGE, TK_ROWS, TK_GROUPS, or 0 */
   int eStart,       /* Start type: CURRENT, PRECEDING, FOLLOWING, UNBOUNDED */
   Expr *pStart,     /* Start window size if TK_PRECEDING or FOLLOWING */
   int eEnd,         /* End type: CURRENT, FOLLOWING, TK_UNBOUNDED, PRECEDING */
-  Expr *pEnd        /* End window size if TK_FOLLOWING or PRECEDING */
+  Expr *pEnd,       /* End window size if TK_FOLLOWING or PRECEDING */
+  u8 eExclude       /* EXCLUDE clause */
 ){
   Window *pWin = 0;
+  int bImplicitFrame = 0;
 
   /* Parser assures the following: */
-  assert( eType==TK_RANGE || eType==TK_ROWS );
+  assert( eType==0 || eType==TK_RANGE || eType==TK_ROWS || eType==TK_GROUPS );
   assert( eStart==TK_CURRENT || eStart==TK_PRECEDING
            || eStart==TK_UNBOUNDED || eStart==TK_FOLLOWING );
   assert( eEnd==TK_CURRENT || eEnd==TK_FOLLOWING
            || eEnd==TK_UNBOUNDED || eEnd==TK_PRECEDING );
   assert( (eStart==TK_PRECEDING || eStart==TK_FOLLOWING)==(pStart!=0) );
   assert( (eEnd==TK_FOLLOWING || eEnd==TK_PRECEDING)==(pEnd!=0) );
 
-
-  /* If a frame is declared "RANGE" (not "ROWS"), then it may not use
-  ** either "<expr> PRECEDING" or "<expr> FOLLOWING".
-  */
-  if( eType==TK_RANGE && (pStart!=0 || pEnd!=0) ){
-    sqlite3ErrorMsg(pParse, "RANGE must use only UNBOUNDED or CURRENT ROW");
-    goto windowAllocErr;
+  if( eType==0 ){
+    bImplicitFrame = 1;
+    eType = TK_RANGE;
   }
 
   /* Additionally, the
   ** starting boundary type may not occur earlier in the following list than
   ** the ending boundary type:
   **
   **   UNBOUNDED PRECEDING
   **   <expr> PRECEDING
@@ -145980,36 +146487,104 @@ SQLITE_PRIVATE Window *sqlite3WindowAllo
   **
   ** The parser ensures that "UNBOUNDED PRECEDING" cannot be used as an ending
   ** boundary, and than "UNBOUNDED FOLLOWING" cannot be used as a starting
   ** frame boundary.
   */
   if( (eStart==TK_CURRENT && eEnd==TK_PRECEDING)
    || (eStart==TK_FOLLOWING && (eEnd==TK_PRECEDING || eEnd==TK_CURRENT))
   ){
-    sqlite3ErrorMsg(pParse, "unsupported frame delimiter for ROWS");
+    sqlite3ErrorMsg(pParse, "unsupported frame specification");
     goto windowAllocErr;
   }
 
   pWin = (Window*)sqlite3DbMallocZero(pParse->db, sizeof(Window));
   if( pWin==0 ) goto windowAllocErr;
-  pWin->eType = eType;
+  pWin->eFrmType = eType;
   pWin->eStart = eStart;
   pWin->eEnd = eEnd;
+  if( eExclude==0 && OptimizationDisabled(pParse->db, SQLITE_WindowFunc) ){
+    eExclude = TK_NO;
+  }
+  pWin->eExclude = eExclude;
+  pWin->bImplicitFrame = bImplicitFrame;
   pWin->pEnd = sqlite3WindowOffsetExpr(pParse, pEnd);
   pWin->pStart = sqlite3WindowOffsetExpr(pParse, pStart);
   return pWin;
 
 windowAllocErr:
   sqlite3ExprDelete(pParse->db, pEnd);
   sqlite3ExprDelete(pParse->db, pStart);
   return 0;
 }
 
 /*
+** Attach PARTITION and ORDER BY clauses pPartition and pOrderBy to window
+** pWin. Also, if parameter pBase is not NULL, set pWin->zBase to the
+** equivalent nul-terminated string.
+*/
+SQLITE_PRIVATE Window *sqlite3WindowAssemble(
+  Parse *pParse, 
+  Window *pWin, 
+  ExprList *pPartition, 
+  ExprList *pOrderBy, 
+  Token *pBase
+){
+  if( pWin ){
+    pWin->pPartition = pPartition;
+    pWin->pOrderBy = pOrderBy;
+    if( pBase ){
+      pWin->zBase = sqlite3DbStrNDup(pParse->db, pBase->z, pBase->n);
+    }
+  }else{
+    sqlite3ExprListDelete(pParse->db, pPartition);
+    sqlite3ExprListDelete(pParse->db, pOrderBy);
+  }
+  return pWin;
+}
+
+/*
+** Window *pWin has just been created from a WINDOW clause. Tokne pBase
+** is the base window. Earlier windows from the same WINDOW clause are
+** stored in the linked list starting at pWin->pNextWin. This function
+** either updates *pWin according to the base specification, or else
+** leaves an error in pParse.
+*/
+SQLITE_PRIVATE void sqlite3WindowChain(Parse *pParse, Window *pWin, Window *pList){
+  if( pWin->zBase ){
+    sqlite3 *db = pParse->db;
+    Window *pExist = windowFind(pParse, pList, pWin->zBase);
+    if( pExist ){
+      const char *zErr = 0;
+      /* Check for errors */
+      if( pWin->pPartition ){
+        zErr = "PARTITION clause";
+      }else if( pExist->pOrderBy && pWin->pOrderBy ){
+        zErr = "ORDER BY clause";
+      }else if( pExist->bImplicitFrame==0 ){
+        zErr = "frame specification";
+      }
+      if( zErr ){
+        sqlite3ErrorMsg(pParse, 
+            "cannot override %s of window: %s", zErr, pWin->zBase
+        );
+      }else{
+        pWin->pPartition = sqlite3ExprListDup(db, pExist->pPartition, 0);
+        if( pExist->pOrderBy ){
+          assert( pWin->pOrderBy==0 );
+          pWin->pOrderBy = sqlite3ExprListDup(db, pExist->pOrderBy, 0);
+        }
+        sqlite3DbFree(db, pWin->zBase);
+        pWin->zBase = 0;
+      }
+    }
+  }
+}
+
+/*
 ** Attach window object pWin to expression p.
 */
 SQLITE_PRIVATE void sqlite3WindowAttach(Parse *pParse, Expr *p, Window *pWin){
   if( p ){
     assert( p->op==TK_FUNCTION );
     /* This routine is only called for the parser.  If pWin was not
     ** allocated due to an OOM, then the parser would fail before ever
     ** invoking this routine */
@@ -146027,41 +146602,57 @@ SQLITE_PRIVATE void sqlite3WindowAttach(
   }
 }
 
 /*
 ** Return 0 if the two window objects are identical, or non-zero otherwise.
 ** Identical window objects can be processed in a single scan.
 */
 SQLITE_PRIVATE int sqlite3WindowCompare(Parse *pParse, Window *p1, Window *p2){
-  if( p1->eType!=p2->eType ) return 1;
+  if( p1->eFrmType!=p2->eFrmType ) return 1;
   if( p1->eStart!=p2->eStart ) return 1;
   if( p1->eEnd!=p2->eEnd ) return 1;
+  if( p1->eExclude!=p2->eExclude ) return 1;
   if( sqlite3ExprCompare(pParse, p1->pStart, p2->pStart, -1) ) return 1;
   if( sqlite3ExprCompare(pParse, p1->pEnd, p2->pEnd, -1) ) return 1;
   if( sqlite3ExprListCompare(p1->pPartition, p2->pPartition, -1) ) return 1;
   if( sqlite3ExprListCompare(p1->pOrderBy, p2->pOrderBy, -1) ) return 1;
   return 0;
 }
 
 
 /*
 ** This is called by code in select.c before it calls sqlite3WhereBegin()
 ** to begin iterating through the sub-query results. It is used to allocate
 ** and initialize registers and cursors used by sqlite3WindowCodeStep().
 */
 SQLITE_PRIVATE void sqlite3WindowCodeInit(Parse *pParse, Window *pMWin){
   Window *pWin;
   Vdbe *v = sqlite3GetVdbe(pParse);
-  int nPart = (pMWin->pPartition ? pMWin->pPartition->nExpr : 0);
-  nPart += (pMWin->pOrderBy ? pMWin->pOrderBy->nExpr : 0);
-  if( nPart ){
+
+  /* Allocate registers to use for PARTITION BY values, if any. Initialize
+  ** said registers to NULL.  */
+  if( pMWin->pPartition ){
+    int nExpr = pMWin->pPartition->nExpr;
     pMWin->regPart = pParse->nMem+1;
-    pParse->nMem += nPart;
-    sqlite3VdbeAddOp3(v, OP_Null, 0, pMWin->regPart, pMWin->regPart+nPart-1);
+    pParse->nMem += nExpr;
+    sqlite3VdbeAddOp3(v, OP_Null, 0, pMWin->regPart, pMWin->regPart+nExpr-1);
+  }
+
+  pMWin->regOne = ++pParse->nMem;
+  sqlite3VdbeAddOp2(v, OP_Integer, 1, pMWin->regOne);
+
+  if( pMWin->eExclude ){
+    pMWin->regStartRowid = ++pParse->nMem;
+    pMWin->regEndRowid = ++pParse->nMem;
+    pMWin->csrApp = pParse->nTab++;
+    sqlite3VdbeAddOp2(v, OP_Integer, 1, pMWin->regStartRowid);
+    sqlite3VdbeAddOp2(v, OP_Integer, 0, pMWin->regEndRowid);
+    sqlite3VdbeAddOp2(v, OP_OpenDup, pMWin->csrApp, pMWin->iEphCsr);
+    return;
   }
 
   for(pWin=pMWin; pWin; pWin=pWin->pNextWin){
     FuncDef *p = pWin->pFunc;
     if( (p->funcFlags & SQLITE_FUNC_MINMAX) && pWin->eStart!=TK_UNBOUNDED ){
       /* The inline versions of min() and max() require a single ephemeral
       ** table and 3 registers. The registers are used as follows:
       **
@@ -146080,56 +146671,77 @@ SQLITE_PRIVATE void sqlite3WindowCodeIni
       }
       sqlite3VdbeAddOp2(v, OP_OpenEphemeral, pWin->csrApp, 2);
       sqlite3VdbeAppendP4(v, pKeyInfo, P4_KEYINFO);
       sqlite3VdbeAddOp2(v, OP_Integer, 0, pWin->regApp+1);
     }
     else if( p->zName==nth_valueName || p->zName==first_valueName ){
       /* Allocate two registers at pWin->regApp. These will be used to
       ** store the start and end index of the current frame.  */
-      assert( pMWin->iEphCsr );
       pWin->regApp = pParse->nMem+1;
       pWin->csrApp = pParse->nTab++;
       pParse->nMem += 2;
       sqlite3VdbeAddOp2(v, OP_OpenDup, pWin->csrApp, pMWin->iEphCsr);
     }
     else if( p->zName==leadName || p->zName==lagName ){
-      assert( pMWin->iEphCsr );
       pWin->csrApp = pParse->nTab++;
       sqlite3VdbeAddOp2(v, OP_OpenDup, pWin->csrApp, pMWin->iEphCsr);
     }
   }
 }
 
+#define WINDOW_STARTING_INT  0
+#define WINDOW_ENDING_INT    1
+#define WINDOW_NTH_VALUE_INT 2
+#define WINDOW_STARTING_NUM  3
+#define WINDOW_ENDING_NUM    4
+
 /*
 ** A "PRECEDING <expr>" (eCond==0) or "FOLLOWING <expr>" (eCond==1) or the
 ** value of the second argument to nth_value() (eCond==2) has just been
 ** evaluated and the result left in register reg. This function generates VM
 ** code to check that the value is a non-negative integer and throws an
 ** exception if it is not.
 */
-static void windowCheckIntValue(Parse *pParse, int reg, int eCond){
+static void windowCheckValue(Parse *pParse, int reg, int eCond){
   static const char *azErr[] = {
     "frame starting offset must be a non-negative integer",
     "frame ending offset must be a non-negative integer",
-    "second argument to nth_value must be a positive integer"
+    "second argument to nth_value must be a positive integer",
+    "frame starting offset must be a non-negative number",
+    "frame ending offset must be a non-negative number",
   };
-  static int aOp[] = { OP_Ge, OP_Ge, OP_Gt };
+  static int aOp[] = { OP_Ge, OP_Ge, OP_Gt, OP_Ge, OP_Ge };
   Vdbe *v = sqlite3GetVdbe(pParse);
   int regZero = sqlite3GetTempReg(pParse);
-  assert( eCond==0 || eCond==1 || eCond==2 );
+  assert( eCond>=0 && eCond<ArraySize(azErr) );
   sqlite3VdbeAddOp2(v, OP_Integer, 0, regZero);
-  sqlite3VdbeAddOp2(v, OP_MustBeInt, reg, sqlite3VdbeCurrentAddr(v)+2);
-  VdbeCoverageIf(v, eCond==0);
-  VdbeCoverageIf(v, eCond==1);
-  VdbeCoverageIf(v, eCond==2);
+  if( eCond>=WINDOW_STARTING_NUM ){
+    int regString = sqlite3GetTempReg(pParse);
+    sqlite3VdbeAddOp4(v, OP_String8, 0, regString, 0, "", P4_STATIC);
+    sqlite3VdbeAddOp3(v, OP_Ge, regString, sqlite3VdbeCurrentAddr(v)+2, reg);
+    sqlite3VdbeChangeP5(v, SQLITE_AFF_NUMERIC|SQLITE_JUMPIFNULL);
+    VdbeCoverage(v);
+    assert( eCond==3 || eCond==4 );
+    VdbeCoverageIf(v, eCond==3);
+    VdbeCoverageIf(v, eCond==4);
+  }else{
+    sqlite3VdbeAddOp2(v, OP_MustBeInt, reg, sqlite3VdbeCurrentAddr(v)+2);
+    VdbeCoverage(v);
+    assert( eCond==0 || eCond==1 || eCond==2 );
+    VdbeCoverageIf(v, eCond==0);
+    VdbeCoverageIf(v, eCond==1);
+    VdbeCoverageIf(v, eCond==2);
+  }
   sqlite3VdbeAddOp3(v, aOp[eCond], regZero, sqlite3VdbeCurrentAddr(v)+2, reg);
-  VdbeCoverageNeverNullIf(v, eCond==0);
-  VdbeCoverageNeverNullIf(v, eCond==1);
+  VdbeCoverageNeverNullIf(v, eCond==0); /* NULL case captured by */
+  VdbeCoverageNeverNullIf(v, eCond==1); /*   the OP_MustBeInt */
   VdbeCoverageNeverNullIf(v, eCond==2);
+  VdbeCoverageNeverNullIf(v, eCond==3); /* NULL case caught by */
+  VdbeCoverageNeverNullIf(v, eCond==4); /*   the OP_Ge */
   sqlite3MayAbort(pParse);
   sqlite3VdbeAddOp2(v, OP_Halt, SQLITE_ERROR, OE_Abort);
   sqlite3VdbeAppendP4(v, (void*)azErr[eCond], P4_STATIC);
   sqlite3ReleaseTempReg(pParse, regZero);
 }
 
 /*
 ** Return the number of arguments passed to the window-function associated
@@ -146159,323 +146771,350 @@ static int windowArgCount(Window *pWin){
 ** If argument regPartSize is non-zero, then it is a register containing the
 ** number of rows in the current partition.
 */
 static void windowAggStep(
   Parse *pParse, 
   Window *pMWin,                  /* Linked list of window functions */
   int csr,                        /* Read arguments from this cursor */
   int bInverse,                   /* True to invoke xInverse instead of xStep */
-  int reg,                        /* Array of registers */
-  int regPartSize                 /* Register containing size of partition */
+  int reg                         /* Array of registers */
 ){
   Vdbe *v = sqlite3GetVdbe(pParse);
   Window *pWin;
   for(pWin=pMWin; pWin; pWin=pWin->pNextWin){
-    int flags = pWin->pFunc->funcFlags;
+    FuncDef *pFunc = pWin->pFunc;
     int regArg;
     int nArg = windowArgCount(pWin);
-
-    if( csr>=0 ){
-      int i;
-      for(i=0; i<nArg; i++){
+    int i;
+
+    for(i=0; i<nArg; i++){
+      if( i!=1 || pFunc->zName!=nth_valueName ){
         sqlite3VdbeAddOp3(v, OP_Column, csr, pWin->iArgCol+i, reg+i);
-      }
-      regArg = reg;
-      if( flags & SQLITE_FUNC_WINDOW_SIZE ){
-        if( nArg==0 ){
-          regArg = regPartSize;
-        }else{
-          sqlite3VdbeAddOp2(v, OP_SCopy, regPartSize, reg+nArg);
-        }
-        nArg++;
-      }
-    }else{
-      assert( !(flags & SQLITE_FUNC_WINDOW_SIZE) );
-      regArg = reg + pWin->iArgCol;
-    }
-
-    if( (pWin->pFunc->funcFlags & SQLITE_FUNC_MINMAX) 
-      && pWin->eStart!=TK_UNBOUNDED 
+      }else{
+        sqlite3VdbeAddOp3(v, OP_Column, pMWin->iEphCsr, pWin->iArgCol+i, reg+i);
+      }
+    }
+    regArg = reg;
+
+    if( pMWin->regStartRowid==0
+     && (pFunc->funcFlags & SQLITE_FUNC_MINMAX) 
+     && (pWin->eStart!=TK_UNBOUNDED)
     ){
       int addrIsNull = sqlite3VdbeAddOp1(v, OP_IsNull, regArg);
       VdbeCoverage(v);
       if( bInverse==0 ){
         sqlite3VdbeAddOp2(v, OP_AddImm, pWin->regApp+1, 1);
         sqlite3VdbeAddOp2(v, OP_SCopy, regArg, pWin->regApp);
         sqlite3VdbeAddOp3(v, OP_MakeRecord, pWin->regApp, 2, pWin->regApp+2);
         sqlite3VdbeAddOp2(v, OP_IdxInsert, pWin->csrApp, pWin->regApp+2);
       }else{
         sqlite3VdbeAddOp4Int(v, OP_SeekGE, pWin->csrApp, 0, regArg, 1);
         VdbeCoverageNeverTaken(v);
         sqlite3VdbeAddOp1(v, OP_Delete, pWin->csrApp);
         sqlite3VdbeJumpHere(v, sqlite3VdbeCurrentAddr(v)-2);
       }
       sqlite3VdbeJumpHere(v, addrIsNull);
     }else if( pWin->regApp ){
-      assert( pWin->pFunc->zName==nth_valueName
-           || pWin->pFunc->zName==first_valueName
+      assert( pFunc->zName==nth_valueName
+           || pFunc->zName==first_valueName
       );
       assert( bInverse==0 || bInverse==1 );
       sqlite3VdbeAddOp2(v, OP_AddImm, pWin->regApp+1-bInverse, 1);
-    }else if( pWin->pFunc->zName==leadName
-           || pWin->pFunc->zName==lagName
-    ){
-      /* no-op */
-    }else{
+    }else if( pFunc->xSFunc!=noopStepFunc ){
       int addrIf = 0;
       if( pWin->pFilter ){
         int regTmp;
         assert( nArg==0 || nArg==pWin->pOwner->x.pList->nExpr );
         assert( nArg || pWin->pOwner->x.pList==0 );
-        if( csr>0 ){
-          regTmp = sqlite3GetTempReg(pParse);
-          sqlite3VdbeAddOp3(v, OP_Column, csr, pWin->iArgCol+nArg,regTmp);
-        }else{
-          regTmp = regArg + nArg;
-        }
+        regTmp = sqlite3GetTempReg(pParse);
+        sqlite3VdbeAddOp3(v, OP_Column, csr, pWin->iArgCol+nArg,regTmp);
         addrIf = sqlite3VdbeAddOp3(v, OP_IfNot, regTmp, 0, 1);
         VdbeCoverage(v);
-        if( csr>0 ){
-          sqlite3ReleaseTempReg(pParse, regTmp);
-        }
-      }
-      if( pWin->pFunc->funcFlags & SQLITE_FUNC_NEEDCOLL ){
+        sqlite3ReleaseTempReg(pParse, regTmp);
+      }
+      if( pFunc->funcFlags & SQLITE_FUNC_NEEDCOLL ){
         CollSeq *pColl;
         assert( nArg>0 );
         pColl = sqlite3ExprNNCollSeq(pParse, pWin->pOwner->x.pList->a[0].pExpr);
         sqlite3VdbeAddOp4(v, OP_CollSeq, 0,0,0, (const char*)pColl, P4_COLLSEQ);
       }
       sqlite3VdbeAddOp3(v, bInverse? OP_AggInverse : OP_AggStep, 
                         bInverse, regArg, pWin->regAccum);
-      sqlite3VdbeAppendP4(v, pWin->pFunc, P4_FUNCDEF);
+      sqlite3VdbeAppendP4(v, pFunc, P4_FUNCDEF);
       sqlite3VdbeChangeP5(v, (u8)nArg);
       if( addrIf ) sqlite3VdbeJumpHere(v, addrIf);
     }
   }
 }
 
-/*
-** Generate VM code to invoke either xValue() (bFinal==0) or xFinalize()
-** (bFinal==1) for each window function in the linked list starting at
+typedef struct WindowCodeArg WindowCodeArg;
+typedef struct WindowCsrAndReg WindowCsrAndReg;
+struct WindowCsrAndReg {
+  int csr;
+  int reg;
+};
+
+struct WindowCodeArg {
+  Parse *pParse;
+  Window *pMWin;
+  Vdbe *pVdbe;
+  int regGosub;
+  int addrGosub;
+  int regArg;
+  int eDelete;
+
+  WindowCsrAndReg start;
+  WindowCsrAndReg current;
+  WindowCsrAndReg end;
+};
+
+/*
+** Values that may be passed as the second argument to windowCodeOp().
+*/
+#define WINDOW_RETURN_ROW 1
+#define WINDOW_AGGINVERSE 2
+#define WINDOW_AGGSTEP    3
+
+/*
+** Generate VM code to read the window frames peer values from cursor csr into
+** an array of registers starting at reg.
+*/
+static void windowReadPeerValues(
+  WindowCodeArg *p,
+  int csr,
+  int reg
+){
+  Window *pMWin = p->pMWin;
+  ExprList *pOrderBy = pMWin->pOrderBy;
+  if( pOrderBy ){
+    Vdbe *v = sqlite3GetVdbe(p->pParse);
+    ExprList *pPart = pMWin->pPartition;
+    int iColOff = pMWin->nBufferCol + (pPart ? pPart->nExpr : 0);
+    int i;
+    for(i=0; i<pOrderBy->nExpr; i++){
+      sqlite3VdbeAddOp3(v, OP_Column, csr, iColOff+i, reg+i);
+    }
+  }
+}
+
+/*
+** Generate VM code to invoke either xValue() (bFin==0) or xFinalize()
+** (bFin==1) for each window function in the linked list starting at
 ** pMWin. Or, for built-in window-functions that do not use the standard
 ** API, generate the equivalent VM code.
 */
-static void windowAggFinal(Parse *pParse, Window *pMWin, int bFinal){
+static void windowAggFinal(WindowCodeArg *p, int bFin){
+  Parse *pParse = p->pParse;
+  Window *pMWin = p->pMWin;
   Vdbe *v = sqlite3GetVdbe(pParse);
   Window *pWin;
 
   for(pWin=pMWin; pWin; pWin=pWin->pNextWin){
-    if( (pWin->pFunc->funcFlags & SQLITE_FUNC_MINMAX) 
-     && pWin->eStart!=TK_UNBOUNDED 
+    if( pMWin->regStartRowid==0
+     && (pWin->pFunc->funcFlags & SQLITE_FUNC_MINMAX) 
+     && (pWin->eStart!=TK_UNBOUNDED)
     ){
       sqlite3VdbeAddOp2(v, OP_Null, 0, pWin->regResult);
       sqlite3VdbeAddOp1(v, OP_Last, pWin->csrApp);
       VdbeCoverage(v);
       sqlite3VdbeAddOp3(v, OP_Column, pWin->csrApp, 0, pWin->regResult);
       sqlite3VdbeJumpHere(v, sqlite3VdbeCurrentAddr(v)-2);
-      if( bFinal ){
-        sqlite3VdbeAddOp1(v, OP_ResetSorter, pWin->csrApp);
-      }
     }else if( pWin->regApp ){
-    }else{
-      if( bFinal ){
-        sqlite3VdbeAddOp2(v, OP_AggFinal, pWin->regAccum, windowArgCount(pWin));
+      assert( pMWin->regStartRowid==0 );
+    }else{
+      int nArg = windowArgCount(pWin);
+      if( bFin ){
+        sqlite3VdbeAddOp2(v, OP_AggFinal, pWin->regAccum, nArg);
         sqlite3VdbeAppendP4(v, pWin->pFunc, P4_FUNCDEF);
         sqlite3VdbeAddOp2(v, OP_Copy, pWin->regAccum, pWin->regResult);
         sqlite3VdbeAddOp2(v, OP_Null, 0, pWin->regAccum);
       }else{
-        sqlite3VdbeAddOp3(v, OP_AggValue, pWin->regAccum, windowArgCount(pWin),
-                             pWin->regResult);
+        sqlite3VdbeAddOp3(v, OP_AggValue,pWin->regAccum,nArg,pWin->regResult);
         sqlite3VdbeAppendP4(v, pWin->pFunc, P4_FUNCDEF);
       }
     }
   }
 }
 
 /*
-** This function generates VM code to invoke the sub-routine at address
-** lblFlushPart once for each partition with the entire partition cached in
-** the Window.iEphCsr temp table.
-*/
-static void windowPartitionCache(
-  Parse *pParse,
-  Select *p,                      /* The rewritten SELECT statement */
-  WhereInfo *pWInfo,              /* WhereInfo to call WhereEnd() on */
-  int regFlushPart,               /* Register to use with Gosub lblFlushPart */
-  int lblFlushPart,               /* Subroutine to Gosub to */
-  int *pRegSize                   /* OUT: Register containing partition size */
-){
-  Window *pMWin = p->pWin;
-  Vdbe *v = sqlite3GetVdbe(pParse);
-  int iSubCsr = p->pSrc->a[0].iCursor;
-  int nSub = p->pSrc->a[0].pTab->nCol;
-  int k;
-
-  int reg = pParse->nMem+1;
-  int regRecord = reg+nSub;
-  int regRowid = regRecord+1;
-
-  *pRegSize = regRowid;
-  pParse->nMem += nSub + 2;
-
-  /* Load the column values for the row returned by the sub-select
-  ** into an array of registers starting at reg. */
-  for(k=0; k<nSub; k++){
-    sqlite3VdbeAddOp3(v, OP_Column, iSubCsr, k, reg+k);
-  }
-  sqlite3VdbeAddOp3(v, OP_MakeRecord, reg, nSub, regRecord);
-
-  /* Check if this is the start of a new partition. If so, call the
-  ** flush_partition sub-routine.  */
-  if( pMWin->pPartition ){
+** Generate code to calculate the current values of all window functions in the
+** p->pMWin list by doing a full scan of the current window frame. Store the
+** results in the Window.regResult registers, ready to return the upper
+** layer.
+*/
+static void windowFullScan(WindowCodeArg *p){
+  Window *pWin;
+  Parse *pParse = p->pParse;
+  Window *pMWin = p->pMWin;
+  Vdbe *v = p->pVdbe;
+
+  int regCRowid = 0;              /* Current rowid value */
+  int regCPeer = 0;               /* Current peer values */
+  int regRowid = 0;               /* AggStep rowid value */
+  int regPeer = 0;                /* AggStep peer values */
+
+  int nPeer;
+  int lblNext;
+  int lblBrk;
+  int addrNext;
+  int csr = pMWin->csrApp;
+
+  nPeer = (pMWin->pOrderBy ? pMWin->pOrderBy->nExpr : 0);
+
+  lblNext = sqlite3VdbeMakeLabel(pParse);
+  lblBrk = sqlite3VdbeMakeLabel(pParse);
+
+  regCRowid = sqlite3GetTempReg(pParse);
+  regRowid = sqlite3GetTempReg(pParse);
+  if( nPeer ){
+    regCPeer = sqlite3GetTempRange(pParse, nPeer);
+    regPeer = sqlite3GetTempRange(pParse, nPeer);
+  }
+
+  sqlite3VdbeAddOp2(v, OP_Rowid, pMWin->iEphCsr, regCRowid);
+  windowReadPeerValues(p, pMWin->iEphCsr, regCPeer);
+
+  for(pWin=pMWin; pWin; pWin=pWin->pNextWin){
+    sqlite3VdbeAddOp2(v, OP_Null, 0, pWin->regAccum);
+  }
+
+  sqlite3VdbeAddOp3(v, OP_SeekGE, csr, lblBrk, pMWin->regStartRowid);
+  VdbeCoverage(v);
+  addrNext = sqlite3VdbeCurrentAddr(v);
+  sqlite3VdbeAddOp2(v, OP_Rowid, csr, regRowid);
+  sqlite3VdbeAddOp3(v, OP_Gt, pMWin->regEndRowid, lblBrk, regRowid);
+  VdbeCoverageNeverNull(v);
+
+  if( pMWin->eExclude==TK_CURRENT ){
+    sqlite3VdbeAddOp3(v, OP_Eq, regCRowid, lblNext, regRowid);
+    VdbeCoverageNeverNull(v);
+  }else if( pMWin->eExclude!=TK_NO ){
     int addr;
-    ExprList *pPart = pMWin->pPartition;
-    int nPart = pPart->nExpr;
-    int regNewPart = reg + pMWin->nBufferCol;
-    KeyInfo *pKeyInfo = sqlite3KeyInfoFromExprList(pParse, pPart, 0, 0);
-
-    addr = sqlite3VdbeAddOp3(v, OP_Compare, regNewPart, pMWin->regPart,nPart);
-    sqlite3VdbeAppendP4(v, (void*)pKeyInfo, P4_KEYINFO);
-    sqlite3VdbeAddOp3(v, OP_Jump, addr+2, addr+4, addr+2);
-    VdbeCoverageEqNe(v);
-    sqlite3VdbeAddOp3(v, OP_Copy, regNewPart, pMWin->regPart, nPart-1);
-    sqlite3VdbeAddOp2(v, OP_Gosub, regFlushPart, lblFlushPart);
-    VdbeComment((v, "call flush_partition"));
-  }
-
-  /* Buffer the current row in the ephemeral table. */
-  sqlite3VdbeAddOp2(v, OP_NewRowid, pMWin->iEphCsr, regRowid);
-  sqlite3VdbeAddOp3(v, OP_Insert, pMWin->iEphCsr, regRecord, regRowid);
-
-  /* End of the input loop */
-  sqlite3WhereEnd(pWInfo);
-
-  /* Invoke "flush_partition" to deal with the final (or only) partition */
-  sqlite3VdbeAddOp2(v, OP_Gosub, regFlushPart, lblFlushPart);
-  VdbeComment((v, "call flush_partition"));
+    int addrEq = 0;
+    KeyInfo *pKeyInfo = 0;
+
+    if( pMWin->pOrderBy ){
+      pKeyInfo = sqlite3KeyInfoFromExprList(pParse, pMWin->pOrderBy, 0, 0);
+    }
+    if( pMWin->eExclude==TK_TIES ){
+      addrEq = sqlite3VdbeAddOp3(v, OP_Eq, regCRowid, 0, regRowid);
+      VdbeCoverageNeverNull(v);
+    }
+    if( pKeyInfo ){
+      windowReadPeerValues(p, csr, regPeer);
+      sqlite3VdbeAddOp3(v, OP_Compare, regPeer, regCPeer, nPeer);
+      sqlite3VdbeAppendP4(v, (void*)pKeyInfo, P4_KEYINFO);
+      addr = sqlite3VdbeCurrentAddr(v)+1;
+      sqlite3VdbeAddOp3(v, OP_Jump, addr, lblNext, addr);
+      VdbeCoverageEqNe(v);
+    }else{
+      sqlite3VdbeAddOp2(v, OP_Goto, 0, lblNext);
+    }
+    if( addrEq ) sqlite3VdbeJumpHere(v, addrEq);
+  }
+
+  windowAggStep(pParse, pMWin, csr, 0, p->regArg);
+
+  sqlite3VdbeResolveLabel(v, lblNext);
+  sqlite3VdbeAddOp2(v, OP_Next, csr, addrNext);
+  VdbeCoverage(v);
+  sqlite3VdbeJumpHere(v, addrNext-1);
+  sqlite3VdbeJumpHere(v, addrNext+1);
+  sqlite3ReleaseTempReg(pParse, regRowid);
+  sqlite3ReleaseTempReg(pParse, regCRowid);
+  if( nPeer ){
+    sqlite3ReleaseTempRange(pParse, regPeer, nPeer);
+    sqlite3ReleaseTempRange(pParse, regCPeer, nPeer);
+  }
+
+  windowAggFinal(p, 1);
 }
 
 /*
 ** Invoke the sub-routine at regGosub (generated by code in select.c) to
 ** return the current row of Window.iEphCsr. If all window functions are
 ** aggregate window functions that use the standard API, a single
 ** OP_Gosub instruction is all that this routine generates. Extra VM code
 ** for per-row processing is only generated for the following built-in window
 ** functions:
 **
 **   nth_value()
 **   first_value()
 **   lag()
 **   lead()
 */
-static void windowReturnOneRow(
-  Parse *pParse,
-  Window *pMWin,
-  int regGosub,
-  int addrGosub
-){
-  Vdbe *v = sqlite3GetVdbe(pParse);
-  Window *pWin;
-  for(pWin=pMWin; pWin; pWin=pWin->pNextWin){
-    FuncDef *pFunc = pWin->pFunc;
-    if( pFunc->zName==nth_valueName
-     || pFunc->zName==first_valueName
-    ){
-      int csr = pWin->csrApp;
-      int lbl = sqlite3VdbeMakeLabel(pParse);
-      int tmpReg = sqlite3GetTempReg(pParse);
-      sqlite3VdbeAddOp2(v, OP_Null, 0, pWin->regResult);
-
-      if( pFunc->zName==nth_valueName ){
-        sqlite3VdbeAddOp3(v, OP_Column, pMWin->iEphCsr, pWin->iArgCol+1,tmpReg);
-        windowCheckIntValue(pParse, tmpReg, 2);
-      }else{
-        sqlite3VdbeAddOp2(v, OP_Integer, 1, tmpReg);
-      }
-      sqlite3VdbeAddOp3(v, OP_Add, tmpReg, pWin->regApp, tmpReg);
-      sqlite3VdbeAddOp3(v, OP_Gt, pWin->regApp+1, lbl, tmpReg);
-      VdbeCoverageNeverNull(v);
-      sqlite3VdbeAddOp3(v, OP_SeekRowid, csr, 0, tmpReg);
-      VdbeCoverageNeverTaken(v);
-      sqlite3VdbeAddOp3(v, OP_Column, csr, pWin->iArgCol, pWin->regResult);
-      sqlite3VdbeResolveLabel(v, lbl);
-      sqlite3ReleaseTempReg(pParse, tmpReg);
-    }
-    else if( pFunc->zName==leadName || pFunc->zName==lagName ){
-      int nArg = pWin->pOwner->x.pList->nExpr;
-      int iEph = pMWin->iEphCsr;
-      int csr = pWin->csrApp;
-      int lbl = sqlite3VdbeMakeLabel(pParse);
-      int tmpReg = sqlite3GetTempReg(pParse);
-
-      if( nArg<3 ){
+static void windowReturnOneRow(WindowCodeArg *p){
+  Window *pMWin = p->pMWin;
+  Vdbe *v = p->pVdbe;
+
+  if( pMWin->regStartRowid ){
+    windowFullScan(p);
+  }else{
+    Parse *pParse = p->pParse;
+    Window *pWin;
+
+    for(pWin=pMWin; pWin; pWin=pWin->pNextWin){
+      FuncDef *pFunc = pWin->pFunc;
+      if( pFunc->zName==nth_valueName
+       || pFunc->zName==first_valueName
+      ){
+        int csr = pWin->csrApp;
+        int lbl = sqlite3VdbeMakeLabel(pParse);
+        int tmpReg = sqlite3GetTempReg(pParse);
         sqlite3VdbeAddOp2(v, OP_Null, 0, pWin->regResult);
-      }else{
-        sqlite3VdbeAddOp3(v, OP_Column, iEph, pWin->iArgCol+2, pWin->regResult);
-      }
-      sqlite3VdbeAddOp2(v, OP_Rowid, iEph, tmpReg);
-      if( nArg<2 ){
-        int val = (pFunc->zName==leadName ? 1 : -1);
-        sqlite3VdbeAddOp2(v, OP_AddImm, tmpReg, val);
-      }else{
-        int op = (pFunc->zName==leadName ? OP_Add : OP_Subtract);
-        int tmpReg2 = sqlite3GetTempReg(pParse);
-        sqlite3VdbeAddOp3(v, OP_Column, iEph, pWin->iArgCol+1, tmpReg2);
-        sqlite3VdbeAddOp3(v, op, tmpReg2, tmpReg, tmpReg);
-        sqlite3ReleaseTempReg(pParse, tmpReg2);
-      }
-
-      sqlite3VdbeAddOp3(v, OP_SeekRowid, csr, lbl, tmpReg);
-      VdbeCoverage(v);
-      sqlite3VdbeAddOp3(v, OP_Column, csr, pWin->iArgCol, pWin->regResult);
-      sqlite3VdbeResolveLabel(v, lbl);
-      sqlite3ReleaseTempReg(pParse, tmpReg);
-    }
-  }
-  sqlite3VdbeAddOp2(v, OP_Gosub, regGosub, addrGosub);
-}
-
-/*
-** Invoke the code generated by windowReturnOneRow() and, optionally, the
-** xInverse() function for each window function, for one or more rows
-** from the Window.iEphCsr temp table. This routine generates VM code
-** similar to:
-**
-**   while( regCtr>0 ){
-**     regCtr--;
-**     windowReturnOneRow()
-**     if( bInverse ){
-**       AggInverse
-**     }
-**     Next (Window.iEphCsr)
-**   }
-*/
-static void windowReturnRows(
-  Parse *pParse,
-  Window *pMWin,                  /* List of window functions */
-  int regCtr,                     /* Register containing number of rows */
-  int regGosub,                   /* Register for Gosub addrGosub */
-  int addrGosub,                  /* Address of sub-routine for ReturnOneRow */
-  int regInvArg,                  /* Array of registers for xInverse args */
-  int regInvSize                  /* Register containing size of partition */
-){
-  int addr;
-  Vdbe *v = sqlite3GetVdbe(pParse);
-  windowAggFinal(pParse, pMWin, 0);
-  addr = sqlite3VdbeAddOp3(v, OP_IfPos, regCtr, sqlite3VdbeCurrentAddr(v)+2 ,1);
-  VdbeCoverage(v);
-  sqlite3VdbeAddOp2(v, OP_Goto, 0, 0);
-  windowReturnOneRow(pParse, pMWin, regGosub, addrGosub);
-  if( regInvArg ){
-    windowAggStep(pParse, pMWin, pMWin->iEphCsr, 1, regInvArg, regInvSize);
-  }
-  sqlite3VdbeAddOp2(v, OP_Next, pMWin->iEphCsr, addr);
-  VdbeCoverage(v);
-  sqlite3VdbeJumpHere(v, addr+1);   /* The OP_Goto */
+  
+        if( pFunc->zName==nth_valueName ){
+          sqlite3VdbeAddOp3(v, OP_Column,pMWin->iEphCsr,pWin->iArgCol+1,tmpReg);
+          windowCheckValue(pParse, tmpReg, 2);
+        }else{
+          sqlite3VdbeAddOp2(v, OP_Integer, 1, tmpReg);
+        }
+        sqlite3VdbeAddOp3(v, OP_Add, tmpReg, pWin->regApp, tmpReg);
+        sqlite3VdbeAddOp3(v, OP_Gt, pWin->regApp+1, lbl, tmpReg);
+        VdbeCoverageNeverNull(v);
+        sqlite3VdbeAddOp3(v, OP_SeekRowid, csr, 0, tmpReg);
+        VdbeCoverageNeverTaken(v);
+        sqlite3VdbeAddOp3(v, OP_Column, csr, pWin->iArgCol, pWin->regResult);
+        sqlite3VdbeResolveLabel(v, lbl);
+        sqlite3ReleaseTempReg(pParse, tmpReg);
+      }
+      else if( pFunc->zName==leadName || pFunc->zName==lagName ){
+        int nArg = pWin->pOwner->x.pList->nExpr;
+        int csr = pWin->csrApp;
+        int lbl = sqlite3VdbeMakeLabel(pParse);
+        int tmpReg = sqlite3GetTempReg(pParse);
+        int iEph = pMWin->iEphCsr;
+  
+        if( nArg<3 ){
+          sqlite3VdbeAddOp2(v, OP_Null, 0, pWin->regResult);
+        }else{
+          sqlite3VdbeAddOp3(v, OP_Column, iEph,pWin->iArgCol+2,pWin->regResult);
+        }
+        sqlite3VdbeAddOp2(v, OP_Rowid, iEph, tmpReg);
+        if( nArg<2 ){
+          int val = (pFunc->zName==leadName ? 1 : -1);
+          sqlite3VdbeAddOp2(v, OP_AddImm, tmpReg, val);
+        }else{
+          int op = (pFunc->zName==leadName ? OP_Add : OP_Subtract);
+          int tmpReg2 = sqlite3GetTempReg(pParse);
+          sqlite3VdbeAddOp3(v, OP_Column, iEph, pWin->iArgCol+1, tmpReg2);
+          sqlite3VdbeAddOp3(v, op, tmpReg2, tmpReg, tmpReg);
+          sqlite3ReleaseTempReg(pParse, tmpReg2);
+        }
+  
+        sqlite3VdbeAddOp3(v, OP_SeekRowid, csr, lbl, tmpReg);
+        VdbeCoverage(v);
+        sqlite3VdbeAddOp3(v, OP_Column, csr, pWin->iArgCol, pWin->regResult);
+        sqlite3VdbeResolveLabel(v, lbl);
+        sqlite3ReleaseTempReg(pParse, tmpReg);
+      }
+    }
+  }
+  sqlite3VdbeAddOp2(v, OP_Gosub, p->regGosub, p->addrGosub);
 }
 
 /*
 ** Generate code to set the accumulator register for each window function
 ** in the linked list passed as the second argument to NULL. And perform
 ** any equivalent initialization required by any built-in window functions
 ** in the list.
 */
@@ -146483,718 +147122,295 @@ static int windowInitAccum(Parse *pParse
   Vdbe *v = sqlite3GetVdbe(pParse);
   int regArg;
   int nArg = 0;
   Window *pWin;
   for(pWin=pMWin; pWin; pWin=pWin->pNextWin){
     FuncDef *pFunc = pWin->pFunc;
     sqlite3VdbeAddOp2(v, OP_Null, 0, pWin->regAccum);
     nArg = MAX(nArg, windowArgCount(pWin));
-    if( pFunc->zName==nth_valueName
-     || pFunc->zName==first_valueName
-    ){
-      sqlite3VdbeAddOp2(v, OP_Integer, 0, pWin->regApp);
-      sqlite3VdbeAddOp2(v, OP_Integer, 0, pWin->regApp+1);
-    }
-
-    if( (pFunc->funcFlags & SQLITE_FUNC_MINMAX) && pWin->csrApp ){
-      assert( pWin->eStart!=TK_UNBOUNDED );
-      sqlite3VdbeAddOp1(v, OP_ResetSorter, pWin->csrApp);
-      sqlite3VdbeAddOp2(v, OP_Integer, 0, pWin->regApp+1);
+    if( pMWin->regStartRowid==0 ){
+      if( pFunc->zName==nth_valueName || pFunc->zName==first_valueName ){
+        sqlite3VdbeAddOp2(v, OP_Integer, 0, pWin->regApp);
+        sqlite3VdbeAddOp2(v, OP_Integer, 0, pWin->regApp+1);
+      }
+
+      if( (pFunc->funcFlags & SQLITE_FUNC_MINMAX) && pWin->csrApp ){
+        assert( pWin->eStart!=TK_UNBOUNDED );
+        sqlite3VdbeAddOp1(v, OP_ResetSorter, pWin->csrApp);
+        sqlite3VdbeAddOp2(v, OP_Integer, 0, pWin->regApp+1);
+      }
     }
   }
   regArg = pParse->nMem+1;
   pParse->nMem += nArg;
   return regArg;
 }
 
-
-/*
-** This function does the work of sqlite3WindowCodeStep() for all "ROWS"
-** window frame types except for "BETWEEN UNBOUNDED PRECEDING AND CURRENT
-** ROW". Pseudo-code for each follows.
-**
-** ROWS BETWEEN <expr1> PRECEDING AND <expr2> FOLLOWING
-**
-**     ...
-**       if( new partition ){
-**         Gosub flush_partition
-**       }
-**       Insert (record in eph-table)
-**     sqlite3WhereEnd()
-**     Gosub flush_partition
-**  
-**   flush_partition:
-**     Once {
-**       OpenDup (iEphCsr -> csrStart)
-**       OpenDup (iEphCsr -> csrEnd)
-**     }
-**     regStart = <expr1>                // PRECEDING expression
-**     regEnd = <expr2>                  // FOLLOWING expression
-**     if( regStart<0 || regEnd<0 ){ error! }
-**     Rewind (csr,csrStart,csrEnd)      // if EOF goto flush_partition_done
-**       Next(csrEnd)                    // if EOF skip Aggstep
-**       Aggstep (csrEnd)
-**       if( (regEnd--)<=0 ){
-**         AggFinal (xValue)
-**         Gosub addrGosub
-**         Next(csr)                // if EOF goto flush_partition_done
-**         if( (regStart--)<=0 ){
-**           AggInverse (csrStart)
-**           Next(csrStart)
-**         }
-**       }
-**   flush_partition_done:
-**     ResetSorter (csr)
-**     Return
-**
-** ROWS BETWEEN <expr> PRECEDING    AND CURRENT ROW
-** ROWS BETWEEN CURRENT ROW         AND <expr> FOLLOWING
-** ROWS BETWEEN UNBOUNDED PRECEDING AND <expr> FOLLOWING
-**
-**   These are similar to the above. For "CURRENT ROW", intialize the
-**   register to 0. For "UNBOUNDED PRECEDING" to infinity.
-**
-** ROWS BETWEEN <expr> PRECEDING    AND UNBOUNDED FOLLOWING
-** ROWS BETWEEN CURRENT ROW         AND UNBOUNDED FOLLOWING
-**
-**     Rewind (csr,csrStart,csrEnd)    // if EOF goto flush_partition_done
-**     while( 1 ){
-**       Next(csrEnd)                  // Exit while(1) at EOF
-**       Aggstep (csrEnd)
-**     }
-**     while( 1 ){
-**       AggFinal (xValue)
-**       Gosub addrGosub
-**       Next(csr)                     // if EOF goto flush_partition_done
-**       if( (regStart--)<=0 ){
-**         AggInverse (csrStart)
-**         Next(csrStart)
-**       }
-**     }
-**
-**   For the "CURRENT ROW AND UNBOUNDED FOLLOWING" case, the final if() 
-**   condition is always true (as if regStart were initialized to 0).
-**
-** RANGE BETWEEN CURRENT ROW AND UNBOUNDED FOLLOWING
-** 
-**   This is the only RANGE case handled by this routine. It modifies the
-**   second while( 1 ) loop in "ROWS BETWEEN CURRENT ... UNBOUNDED..." to
-**   be:
-**
-**     while( 1 ){
-**       AggFinal (xValue)
-**       while( 1 ){
-**         regPeer++
-**         Gosub addrGosub
-**         Next(csr)                     // if EOF goto flush_partition_done
-**         if( new peer ) break;
-**       }
-**       while( (regPeer--)>0 ){
-**         AggInverse (csrStart)
-**         Next(csrStart)
-**       }
-**     }
-**
-** ROWS BETWEEN <expr> FOLLOWING    AND <expr> FOLLOWING
-**
-**   regEnd = regEnd - regStart
-**   Rewind (csr,csrStart,csrEnd)   // if EOF goto flush_partition_done
-**     Aggstep (csrEnd)
-**     Next(csrEnd)                 // if EOF fall-through
-**     if( (regEnd--)<=0 ){
-**       if( (regStart--)<=0 ){
-**         AggFinal (xValue)
-**         Gosub addrGosub
-**         Next(csr)              // if EOF goto flush_partition_done
-**       }
-**       AggInverse (csrStart)
-**       Next (csrStart)
-**     }
-**
-** ROWS BETWEEN <expr> PRECEDING    AND <expr> PRECEDING
-**
-**   Replace the bit after "Rewind" in the above with:
-**
-**     if( (regEnd--)<=0 ){
-**       AggStep (csrEnd)
-**       Next (csrEnd)
-**     }
-**     AggFinal (xValue)
-**     Gosub addrGosub
-**     Next(csr)                  // if EOF goto flush_partition_done
-**     if( (regStart--)<=0 ){
-**       AggInverse (csr2)
-**       Next (csr2)
-**     }
-**
-*/
-static void windowCodeRowExprStep(
-  Parse *pParse, 
-  Select *p,
-  WhereInfo *pWInfo,
-  int regGosub, 
-  int addrGosub
-){
-  Window *pMWin = p->pWin;
+/* 
+** Return true if the current frame should be cached in the ephemeral table,
+** even if there are no xInverse() calls required.
+*/
+static int windowCacheFrame(Window *pMWin){
+  Window *pWin;
+  if( pMWin->regStartRowid ) return 1;
+  for(pWin=pMWin; pWin; pWin=pWin->pNextWin){
+    FuncDef *pFunc = pWin->pFunc;
+    if( (pFunc->zName==nth_valueName)
+     || (pFunc->zName==first_valueName)
+     || (pFunc->zName==leadName)
+     || (pFunc->zName==lagName)
+    ){
+      return 1;
+    }
+  }
+  return 0;
+}
+
+/*
+** regOld and regNew are each the first register in an array of size
+** pOrderBy->nExpr. This function generates code to compare the two
+** arrays of registers using the collation sequences and other comparison
+** parameters specified by pOrderBy. 
+**
+** If the two arrays are not equal, the contents of regNew is copied to 
+** regOld and control falls through. Otherwise, if the contents of the arrays
+** are equal, an OP_Goto is executed. The address of the OP_Goto is returned.
+*/
+static void windowIfNewPeer(
+  Parse *pParse,
+  ExprList *pOrderBy,
+  int regNew,                     /* First in array of new values */
+  int regOld,                     /* First in array of old values */
+  int addr                        /* Jump here */
+){
+  Vdbe *v = sqlite3GetVdbe(pParse);
+  if( pOrderBy ){
+    int nVal = pOrderBy->nExpr;
+    KeyInfo *pKeyInfo = sqlite3KeyInfoFromExprList(pParse, pOrderBy, 0, 0);
+    sqlite3VdbeAddOp3(v, OP_Compare, regOld, regNew, nVal);
+    sqlite3VdbeAppendP4(v, (void*)pKeyInfo, P4_KEYINFO);
+    sqlite3VdbeAddOp3(v, OP_Jump, 
+      sqlite3VdbeCurrentAddr(v)+1, addr, sqlite3VdbeCurrentAddr(v)+1
+    );
+    VdbeCoverageEqNe(v);
+    sqlite3VdbeAddOp3(v, OP_Copy, regNew, regOld, nVal-1);
+  }else{
+    sqlite3VdbeAddOp2(v, OP_Goto, 0, addr);
+  }
+}
+
+/*
+** This function is called as part of generating VM programs for RANGE
+** offset PRECEDING/FOLLOWING frame boundaries. Assuming "ASC" order for
+** the ORDER BY term in the window, it generates code equivalent to:
+**
+**   if( csr1.peerVal + regVal >= csr2.peerVal ) goto lbl;
+**
+** A special type of arithmetic is used such that if csr.peerVal is not
+** a numeric type (real or integer), then the result of the addition is
+** a copy of csr1.peerVal.
+*/
+static void windowCodeRangeTest(
+  WindowCodeArg *p, 
+  int op,                          /* OP_Ge or OP_Gt */
+  int csr1, 
+  int regVal, 
+  int csr2,
+  int lbl
+){
+  Parse *pParse = p->pParse;
   Vdbe *v = sqlite3GetVdbe(pParse);
-  int regFlushPart;               /* Register for "Gosub flush_partition" */
-  int lblFlushPart;               /* Label for "Gosub flush_partition" */
-  int lblFlushDone;               /* Label for "Gosub flush_partition_done" */
-
-  int regArg;
-  int addr;
-  int csrStart = pParse->nTab++;
-  int csrEnd = pParse->nTab++;
-  int regStart;                    /* Value of <expr> PRECEDING */
-  int regEnd;                      /* Value of <expr> FOLLOWING */
-  int addrGoto;
-  int addrTop;
-  int addrIfPos1 = 0;
-  int addrIfPos2 = 0;
-  int regSize = 0;
-
-  assert( pMWin->eStart==TK_PRECEDING 
-       || pMWin->eStart==TK_CURRENT 
-       || pMWin->eStart==TK_FOLLOWING 
-       || pMWin->eStart==TK_UNBOUNDED 
-  );
-  assert( pMWin->eEnd==TK_FOLLOWING 
-       || pMWin->eEnd==TK_CURRENT 
-       || pMWin->eEnd==TK_UNBOUNDED 
-       || pMWin->eEnd==TK_PRECEDING 
-  );
-
-  /* Allocate register and label for the "flush_partition" sub-routine. */
-  regFlushPart = ++pParse->nMem;
-  lblFlushPart = sqlite3VdbeMakeLabel(pParse);
-  lblFlushDone = sqlite3VdbeMakeLabel(pParse);
-
-  regStart = ++pParse->nMem;
-  regEnd = ++pParse->nMem;
-
-  windowPartitionCache(pParse, p, pWInfo, regFlushPart, lblFlushPart, &regSize);
-
-  addrGoto = sqlite3VdbeAddOp0(v, OP_Goto);
-
-  /* Start of "flush_partition" */
-  sqlite3VdbeResolveLabel(v, lblFlushPart);
-  sqlite3VdbeAddOp2(v, OP_Once, 0, sqlite3VdbeCurrentAddr(v)+3);
+  int reg1 = sqlite3GetTempReg(pParse);
+  int reg2 = sqlite3GetTempReg(pParse);
+  int arith = OP_Add;
+  int addrGe;
+
+  int regString = ++pParse->nMem;
+
+  assert( op==OP_Ge || op==OP_Gt || op==OP_Le );
+  assert( p->pMWin->pOrderBy && p->pMWin->pOrderBy->nExpr==1 );
+  if( p->pMWin->pOrderBy->a[0].sortOrder ){
+    switch( op ){
+      case OP_Ge: op = OP_Le; break;
+      case OP_Gt: op = OP_Lt; break;
+      default: assert( op==OP_Le ); op = OP_Ge; break;
+    }
+    arith = OP_Subtract;
+  }
+
+  windowReadPeerValues(p, csr1, reg1);
+  windowReadPeerValues(p, csr2, reg2);
+
+  /* Check if the peer value for csr1 value is a text or blob by comparing
+  ** it to the smallest possible string - ''. If it is, jump over the
+  ** OP_Add or OP_Subtract operation and proceed directly to the comparison. */
+  sqlite3VdbeAddOp4(v, OP_String8, 0, regString, 0, "", P4_STATIC);
+  addrGe = sqlite3VdbeAddOp3(v, OP_Ge, regString, 0, reg1);
   VdbeCoverage(v);
-  VdbeComment((v, "Flush_partition subroutine"));
-  sqlite3VdbeAddOp2(v, OP_OpenDup, csrStart, pMWin->iEphCsr);
-  sqlite3VdbeAddOp2(v, OP_OpenDup, csrEnd, pMWin->iEphCsr);
-
-  /* If either regStart or regEnd are not non-negative integers, throw 
-  ** an exception.  */
-  if( pMWin->pStart ){
-    sqlite3ExprCode(pParse, pMWin->pStart, regStart);
-    windowCheckIntValue(pParse, regStart, 0);
-  }
-  if( pMWin->pEnd ){
-    sqlite3ExprCode(pParse, pMWin->pEnd, regEnd);
-    windowCheckIntValue(pParse, regEnd, 1);
-  }
-
-  /* If this is "ROWS <expr1> FOLLOWING AND ROWS <expr2> FOLLOWING", do:
-  **
-  **   if( regEnd<regStart ){
-  **     // The frame always consists of 0 rows
-  **     regStart = regSize;
-  **   }
-  **   regEnd = regEnd - regStart;
-  */
-  if( pMWin->pEnd && pMWin->eStart==TK_FOLLOWING ){
-    assert( pMWin->pStart!=0 );
-    assert( pMWin->eEnd==TK_FOLLOWING );
-    sqlite3VdbeAddOp3(v, OP_Ge, regStart, sqlite3VdbeCurrentAddr(v)+2, regEnd);
-    VdbeCoverageNeverNull(v);
-    sqlite3VdbeAddOp2(v, OP_Copy, regSize, regStart);
-    sqlite3VdbeAddOp3(v, OP_Subtract, regStart, regEnd, regEnd);
-  }
-
-  if( pMWin->pStart && pMWin->eEnd==TK_PRECEDING ){
-    assert( pMWin->pEnd!=0 );
-    assert( pMWin->eStart==TK_PRECEDING );
-    sqlite3VdbeAddOp3(v, OP_Le, regStart, sqlite3VdbeCurrentAddr(v)+3, regEnd);
-    VdbeCoverageNeverNull(v);
-    sqlite3VdbeAddOp2(v, OP_Copy, regSize, regStart);
-    sqlite3VdbeAddOp2(v, OP_Copy, regSize, regEnd);
-  }
-
-  /* Initialize the accumulator register for each window function to NULL */
-  regArg = windowInitAccum(pParse, pMWin);
-
-  sqlite3VdbeAddOp2(v, OP_Rewind, pMWin->iEphCsr, lblFlushDone);
-  VdbeCoverage(v);
-  sqlite3VdbeAddOp2(v, OP_Rewind, csrStart, lblFlushDone);
-  VdbeCoverageNeverTaken(v);
-  sqlite3VdbeChangeP5(v, 1);
-  sqlite3VdbeAddOp2(v, OP_Rewind, csrEnd, lblFlushDone);
-  VdbeCoverageNeverTaken(v);
-  sqlite3VdbeChangeP5(v, 1);
-
-  /* Invoke AggStep function for each window function using the row that
-  ** csrEnd currently points to. Or, if csrEnd is already at EOF,
-  ** do nothing.  */
-  addrTop = sqlite3VdbeCurrentAddr(v);
-  if( pMWin->eEnd==TK_PRECEDING ){
-    addrIfPos1 = sqlite3VdbeAddOp3(v, OP_IfPos, regEnd, 0 , 1);
-    VdbeCoverage(v);
-  }
-  sqlite3VdbeAddOp2(v, OP_Next, csrEnd, sqlite3VdbeCurrentAddr(v)+2);
-  VdbeCoverage(v);
-  addr = sqlite3VdbeAddOp0(v, OP_Goto);
-  windowAggStep(pParse, pMWin, csrEnd, 0, regArg, regSize);
-  if( pMWin->eEnd==TK_UNBOUNDED ){
-    sqlite3VdbeAddOp2(v, OP_Goto, 0, addrTop);
-    sqlite3VdbeJumpHere(v, addr);
-    addrTop = sqlite3VdbeCurrentAddr(v);
-  }else{
-    sqlite3VdbeJumpHere(v, addr);
-    if( pMWin->eEnd==TK_PRECEDING ){
-      sqlite3VdbeJumpHere(v, addrIfPos1);
-    }
-  }
-
-  if( pMWin->eEnd==TK_FOLLOWING ){
-    addrIfPos1 = sqlite3VdbeAddOp3(v, OP_IfPos, regEnd, 0 , 1);
-    VdbeCoverage(v);
-  }
-  if( pMWin->eStart==TK_FOLLOWING ){
-    addrIfPos2 = sqlite3VdbeAddOp3(v, OP_IfPos, regStart, 0 , 1);
-    VdbeCoverage(v);
-  }
-  windowAggFinal(pParse, pMWin, 0);
-  windowReturnOneRow(pParse, pMWin, regGosub, addrGosub);
-  sqlite3VdbeAddOp2(v, OP_Next, pMWin->iEphCsr, sqlite3VdbeCurrentAddr(v)+2);
-  VdbeCoverage(v);
-  sqlite3VdbeAddOp2(v, OP_Goto, 0, lblFlushDone);
-  if( pMWin->eStart==TK_FOLLOWING ){
-    sqlite3VdbeJumpHere(v, addrIfPos2);
-  }
-
-  if( pMWin->eStart==TK_CURRENT 
-   || pMWin->eStart==TK_PRECEDING 
-   || pMWin->eStart==TK_FOLLOWING 
-  ){
-    int lblSkipInverse = sqlite3VdbeMakeLabel(pParse);;
-    if( pMWin->eStart==TK_PRECEDING ){
-      sqlite3VdbeAddOp3(v, OP_IfPos, regStart, lblSkipInverse, 1);
-      VdbeCoverage(v);
-    }
-    if( pMWin->eStart==TK_FOLLOWING ){
-      sqlite3VdbeAddOp2(v, OP_Next, csrStart, sqlite3VdbeCurrentAddr(v)+2);
+  sqlite3VdbeAddOp3(v, arith, regVal, reg1, reg1);
+  sqlite3VdbeJumpHere(v, addrGe);
+  sqlite3VdbeAddOp3(v, op, reg2, lbl, reg1); VdbeCoverage(v);
+  sqlite3VdbeChangeP5(v, SQLITE_NULLEQ);
+  assert( op==OP_Ge || op==OP_Gt || op==OP_Lt || op==OP_Le );
+  testcase(op==OP_Ge); VdbeCoverageIf(v, op==OP_Ge);
+  testcase(op==OP_Lt); VdbeCoverageIf(v, op==OP_Lt);
+  testcase(op==OP_Le); VdbeCoverageIf(v, op==OP_Le);
+  testcase(op==OP_Gt); VdbeCoverageIf(v, op==OP_Gt);
+
+  sqlite3ReleaseTempReg(pParse, reg1);
+  sqlite3ReleaseTempReg(pParse, reg2);
+}
+
+/*
+** Helper function for sqlite3WindowCodeStep(). Each call to this function
+** generates VM code for a single RETURN_ROW, AGGSTEP or AGGINVERSE 
+** operation. Refer to the header comment for sqlite3WindowCodeStep() for
+** details.
+*/
+static int windowCodeOp(
+ WindowCodeArg *p,                /* Context object */
+ int op,                          /* WINDOW_RETURN_ROW, AGGSTEP or AGGINVERSE */
+ int regCountdown,                /* Register for OP_IfPos countdown */
+ int jumpOnEof                    /* Jump here if stepped cursor reaches EOF */
+){
+  int csr, reg;
+  Parse *pParse = p->pParse;
+  Window *pMWin = p->pMWin;
+  int ret = 0;
+  Vdbe *v = p->pVdbe;
+  int addrIf = 0; 
+  int addrContinue = 0;
+  int addrGoto = 0;
+  int bPeer = (pMWin->eFrmType!=TK_ROWS);
+
+  int lblDone = sqlite3VdbeMakeLabel(pParse);
+  int addrNextRange = 0;
+
+  /* Special case - WINDOW_AGGINVERSE is always a no-op if the frame
+  ** starts with UNBOUNDED PRECEDING. */
+  if( op==WINDOW_AGGINVERSE && pMWin->eStart==TK_UNBOUNDED ){
+    assert( regCountdown==0 && jumpOnEof==0 );
+    return 0;
+  }
+
+  if( regCountdown>0 ){
+    if( pMWin->eFrmType==TK_RANGE ){
+      addrNextRange = sqlite3VdbeCurrentAddr(v);
+      assert( op==WINDOW_AGGINVERSE || op==WINDOW_AGGSTEP );
+      if( op==WINDOW_AGGINVERSE ){
+        if( pMWin->eStart==TK_FOLLOWING ){
+          windowCodeRangeTest(
+              p, OP_Le, p->current.csr, regCountdown, p->start.csr, lblDone
+          );
+        }else{
+          windowCodeRangeTest(
+              p, OP_Ge, p->start.csr, regCountdown, p->current.csr, lblDone
+          );
+        }
+      }else{
+        windowCodeRangeTest(
+            p, OP_Gt, p->end.csr, regCountdown, p->current.csr, lblDone
+        );
+      }
+    }else{
+      addrIf = sqlite3VdbeAddOp3(v, OP_IfPos, regCountdown, 0, 1);
       VdbeCoverage(v);
-      sqlite3VdbeAddOp2(v, OP_Goto, 0, lblSkipInverse);
-    }else{
-      sqlite3VdbeAddOp2(v, OP_Next, csrStart, sqlite3VdbeCurrentAddr(v)+1);
-      VdbeCoverageAlwaysTaken(v);
-    }
-    windowAggStep(pParse, pMWin, csrStart, 1, regArg, regSize);
-    sqlite3VdbeResolveLabel(v, lblSkipInverse);
-  }
-  if( pMWin->eEnd==TK_FOLLOWING ){
-    sqlite3VdbeJumpHere(v, addrIfPos1);
-  }
-  sqlite3VdbeAddOp2(v, OP_Goto, 0, addrTop);
-
-  /* flush_partition_done: */
-  sqlite3VdbeResolveLabel(v, lblFlushDone);
-  sqlite3VdbeAddOp1(v, OP_ResetSorter, pMWin->iEphCsr);
-  sqlite3VdbeAddOp1(v, OP_Return, regFlushPart);
-  VdbeComment((v, "end flush_partition subroutine"));
-
-  /* Jump to here to skip over flush_partition */
-  sqlite3VdbeJumpHere(v, addrGoto);
-}
-
-/*
-** This function does the work of sqlite3WindowCodeStep() for cases that
-** would normally be handled by windowCodeDefaultStep() when there are
-** one or more built-in window-functions that require the entire partition
-** to be cached in a temp table before any rows can be returned. Additionally.
-** "RANGE BETWEEN CURRENT ROW AND UNBOUNDED FOLLOWING" is always handled by
-** this function.
-**
-** Pseudo-code corresponding to the VM code generated by this function
-** for each type of window follows.
-**
-** RANGE BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW
-**
-**   flush_partition:
-**     Once {
-**       OpenDup (iEphCsr -> csrLead)
-**     }
-**     Integer ctr 0
-**     foreach row (csrLead){
-**       if( new peer ){
-**         AggFinal (xValue)
-**         for(i=0; i<ctr; i++){
-**           Gosub addrGosub
-**           Next iEphCsr
-**         }
-**         Integer ctr 0
-**       }
-**       AggStep (csrLead)
-**       Incr ctr
-**     }
-**
-**     AggFinal (xFinalize)
-**     for(i=0; i<ctr; i++){
-**       Gosub addrGosub
-**       Next iEphCsr
-**     }
-**
-**     ResetSorter (csr)
-**     Return
-**
-** ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW
-**
-**   As above, except that the "if( new peer )" branch is always taken.
-**
-** RANGE BETWEEN CURRENT ROW AND CURRENT ROW 
-**
-**   As above, except that each of the for() loops becomes:
-**
-**         for(i=0; i<ctr; i++){
-**           Gosub addrGosub
-**           AggInverse (iEphCsr)
-**           Next iEphCsr
-**         }
-**
-** RANGE BETWEEN UNBOUNDED PRECEDING AND UNBOUNDED FOLLOWING
-**
-**   flush_partition:
-**     Once {
-**       OpenDup (iEphCsr -> csrLead)
-**     }
-**     foreach row (csrLead) {
-**       AggStep (csrLead)
-**     }
-**     foreach row (iEphCsr) {
-**       Gosub addrGosub
-**     }
-** 
-** RANGE BETWEEN CURRENT ROW AND UNBOUNDED FOLLOWING
-**
-**   flush_partition:
-**     Once {
-**       OpenDup (iEphCsr -> csrLead)
-**     }
-**     foreach row (csrLead){
-**       AggStep (csrLead)
-**     }
-**     Rewind (csrLead)
-**     Integer ctr 0
-**     foreach row (csrLead){
-**       if( new peer ){
-**         AggFinal (xValue)
-**         for(i=0; i<ctr; i++){
-**           Gosub addrGosub
-**           AggInverse (iEphCsr)
-**           Next iEphCsr
-**         }
-**         Integer ctr 0
-**       }
-**       Incr ctr
-**     }
-**
-**     AggFinal (xFinalize)
-**     for(i=0; i<ctr; i++){
-**       Gosub addrGosub
-**       Next iEphCsr
-**     }
-**
-**     ResetSorter (csr)
-**     Return
-*/
-static void windowCodeCacheStep(
-  Parse *pParse, 
-  Select *p,
-  WhereInfo *pWInfo,
-  int regGosub, 
-  int addrGosub
-){
-  Window *pMWin = p->pWin;
-  Vdbe *v = sqlite3GetVdbe(pParse);
-  int k;
-  int addr;
-  ExprList *pPart = pMWin->pPartition;
-  ExprList *pOrderBy = pMWin->pOrderBy;
-  int nPeer = pOrderBy ? pOrderBy->nExpr : 0;
-  int regNewPeer;
-
-  int addrGoto;                   /* Address of Goto used to jump flush_par.. */
-  int addrNext;                   /* Jump here for next iteration of loop */
-  int regFlushPart;
-  int lblFlushPart;
-  int csrLead;
-  int regCtr;
-  int regArg;                     /* Register array to martial function args */
-  int regSize;
-  int lblEmpty;
-  int bReverse = pMWin->pOrderBy && pMWin->eStart==TK_CURRENT 
-          && pMWin->eEnd==TK_UNBOUNDED;
-
-  assert( (pMWin->eStart==TK_UNBOUNDED && pMWin->eEnd==TK_CURRENT) 
-       || (pMWin->eStart==TK_UNBOUNDED && pMWin->eEnd==TK_UNBOUNDED) 
-       || (pMWin->eStart==TK_CURRENT && pMWin->eEnd==TK_CURRENT) 
-       || (pMWin->eStart==TK_CURRENT && pMWin->eEnd==TK_UNBOUNDED) 
-  );
-
-  lblEmpty = sqlite3VdbeMakeLabel(pParse);
-  regNewPeer = pParse->nMem+1;
-  pParse->nMem += nPeer;
-
-  /* Allocate register and label for the "flush_partition" sub-routine. */
-  regFlushPart = ++pParse->nMem;
-  lblFlushPart = sqlite3VdbeMakeLabel(pParse);
-
-  csrLead = pParse->nTab++;
-  regCtr = ++pParse->nMem;
-
-  windowPartitionCache(pParse, p, pWInfo, regFlushPart, lblFlushPart, &regSize);
-  addrGoto = sqlite3VdbeAddOp0(v, OP_Goto);
-
-  /* Start of "flush_partition" */
-  sqlite3VdbeResolveLabel(v, lblFlushPart);
-  sqlite3VdbeAddOp2(v, OP_Once, 0, sqlite3VdbeCurrentAddr(v)+2);
-  VdbeCoverage(v);
-  sqlite3VdbeAddOp2(v, OP_OpenDup, csrLead, pMWin->iEphCsr);
-
-  /* Initialize the accumulator register for each window function to NULL */
-  regArg = windowInitAccum(pParse, pMWin);
-
-  sqlite3VdbeAddOp2(v, OP_Integer, 0, regCtr);
-  sqlite3VdbeAddOp2(v, OP_Rewind, csrLead, lblEmpty);
-  VdbeCoverage(v);
-  sqlite3VdbeAddOp2(v, OP_Rewind, pMWin->iEphCsr, lblEmpty);
-  VdbeCoverageNeverTaken(v);
-
-  if( bReverse ){
-    int addr2 = sqlite3VdbeCurrentAddr(v);
-    windowAggStep(pParse, pMWin, csrLead, 0, regArg, regSize);
-    sqlite3VdbeAddOp2(v, OP_Next, csrLead, addr2);
+    }
+  }
+
+  if( op==WINDOW_RETURN_ROW && pMWin->regStartRowid==0 ){
+    windowAggFinal(p, 0);
+  }
+  addrContinue = sqlite3VdbeCurrentAddr(v);
+  switch( op ){
+    case WINDOW_RETURN_ROW:
+      csr = p->current.csr;
+      reg = p->current.reg;
+      windowReturnOneRow(p);
+      break;
+
+    case WINDOW_AGGINVERSE:
+      csr = p->start.csr;
+      reg = p->start.reg;
+      if( pMWin->regStartRowid ){
+        assert( pMWin->regEndRowid );
+        sqlite3VdbeAddOp2(v, OP_AddImm, pMWin->regStartRowid, 1);
+      }else{
+        windowAggStep(pParse, pMWin, csr, 1, p->regArg);
+      }
+      break;
+
+    default:
+      assert( op==WINDOW_AGGSTEP );
+      csr = p->end.csr;
+      reg = p->end.reg;
+      if( pMWin->regStartRowid ){
+        assert( pMWin->regEndRowid );
+        sqlite3VdbeAddOp2(v, OP_AddImm, pMWin->regEndRowid, 1);
+      }else{
+        windowAggStep(pParse, pMWin, csr, 0, p->regArg);
+      }
+      break;
+  }
+
+  if( op==p->eDelete ){
+    sqlite3VdbeAddOp1(v, OP_Delete, csr);
+    sqlite3VdbeChangeP5(v, OPFLAG_SAVEPOSITION);
+  }
+
+  if( jumpOnEof ){
+    sqlite3VdbeAddOp2(v, OP_Next, csr, sqlite3VdbeCurrentAddr(v)+2);
     VdbeCoverage(v);
-    sqlite3VdbeAddOp2(v, OP_Rewind, csrLead, lblEmpty);
-    VdbeCoverageNeverTaken(v);
-  }
-  addrNext = sqlite3VdbeCurrentAddr(v);
-
-  if( pOrderBy && (pMWin->eEnd==TK_CURRENT || pMWin->eStart==TK_CURRENT) ){
-    int bCurrent = (pMWin->eStart==TK_CURRENT);
-    int addrJump = 0;             /* Address of OP_Jump below */
-    if( pMWin->eType==TK_RANGE ){
-      int iOff = pMWin->nBufferCol + (pPart ? pPart->nExpr : 0);
-      int regPeer = pMWin->regPart + (pPart ? pPart->nExpr : 0);
-      KeyInfo *pKeyInfo = sqlite3KeyInfoFromExprList(pParse, pOrderBy, 0, 0);
-      for(k=0; k<nPeer; k++){
-        sqlite3VdbeAddOp3(v, OP_Column, csrLead, iOff+k, regNewPeer+k);
-      }
-      addr = sqlite3VdbeAddOp3(v, OP_Compare, regNewPeer, regPeer, nPeer);
-      sqlite3VdbeAppendP4(v, (void*)pKeyInfo, P4_KEYINFO);
-      addrJump = sqlite3VdbeAddOp3(v, OP_Jump, addr+2, 0, addr+2);
-      VdbeCoverage(v);
-      sqlite3VdbeAddOp3(v, OP_Copy, regNewPeer, regPeer, nPeer-1);
-    }
-
-    windowReturnRows(pParse, pMWin, regCtr, regGosub, addrGosub, 
-        (bCurrent ? regArg : 0), (bCurrent ? regSize : 0)
-    );
-    if( addrJump ) sqlite3VdbeJumpHere(v, addrJump);
-  }
-
-  if( bReverse==0 ){
-    windowAggStep(pParse, pMWin, csrLead, 0, regArg, regSize);
-  }
-  sqlite3VdbeAddOp2(v, OP_AddImm, regCtr, 1);
-  sqlite3VdbeAddOp2(v, OP_Next, csrLead, addrNext);
-  VdbeCoverage(v);
-
-  windowReturnRows(pParse, pMWin, regCtr, regGosub, addrGosub, 0, 0);
-
-  sqlite3VdbeResolveLabel(v, lblEmpty);
-  sqlite3VdbeAddOp1(v, OP_ResetSorter, pMWin->iEphCsr);
-  sqlite3VdbeAddOp1(v, OP_Return, regFlushPart);
-
-  /* Jump to here to skip over flush_partition */
-  sqlite3VdbeJumpHere(v, addrGoto);
-}
-
-
-/*
-** RANGE BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW
-**
-**   ...
-**     if( new partition ){
-**       AggFinal (xFinalize)
-**       Gosub addrGosub
-**       ResetSorter eph-table
-**     }
-**     else if( new peer ){
-**       AggFinal (xValue)
-**       Gosub addrGosub
-**       ResetSorter eph-table
-**     }
-**     AggStep
-**     Insert (record into eph-table)
-**   sqlite3WhereEnd()
-**   AggFinal (xFinalize)
-**   Gosub addrGosub
-**
-** RANGE BETWEEN UNBOUNDED PRECEDING AND UNBOUNDED FOLLOWING
-**
-**   As above, except take no action for a "new peer". Invoke
-**   the sub-routine once only for each partition.
-**
-** RANGE BETWEEN CURRENT ROW AND CURRENT ROW
-**
-**   As above, except that the "new peer" condition is handled in the
-**   same way as "new partition" (so there is no "else if" block).
-**
-** ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW
-** 
-**   As above, except assume every row is a "new peer".
-*/
-static void windowCodeDefaultStep(
-  Parse *pParse, 
-  Select *p,
-  WhereInfo *pWInfo,
-  int regGosub, 
-  int addrGosub
-){
-  Window *pMWin = p->pWin;
-  Vdbe *v = sqlite3GetVdbe(pParse);
-  int k;
-  int iSubCsr = p->pSrc->a[0].iCursor;
-  int nSub = p->pSrc->a[0].pTab->nCol;
-  int reg = pParse->nMem+1;
-  int regRecord = reg+nSub;
-  int regRowid = regRecord+1;
-  int addr;
-  ExprList *pPart = pMWin->pPartition;
-  ExprList *pOrderBy = pMWin->pOrderBy;
-
-  assert( pMWin->eType==TK_RANGE 
-      || (pMWin->eStart==TK_UNBOUNDED && pMWin->eEnd==TK_CURRENT)
-  );
-
-  assert( (pMWin->eStart==TK_UNBOUNDED && pMWin->eEnd==TK_CURRENT)
-       || (pMWin->eStart==TK_UNBOUNDED && pMWin->eEnd==TK_UNBOUNDED)
-       || (pMWin->eStart==TK_CURRENT && pMWin->eEnd==TK_CURRENT)
-       || (pMWin->eStart==TK_CURRENT && pMWin->eEnd==TK_UNBOUNDED && !pOrderBy)
-  );
-
-  if( pMWin->eEnd==TK_UNBOUNDED ){
-    pOrderBy = 0;
-  }
-
-  pParse->nMem += nSub + 2;
-
-  /* Load the individual column values of the row returned by
-  ** the sub-select into an array of registers. */
-  for(k=0; k<nSub; k++){
-    sqlite3VdbeAddOp3(v, OP_Column, iSubCsr, k, reg+k);
-  }
-
-  /* Check if this is the start of a new partition or peer group. */
-  if( pPart || pOrderBy ){
-    int nPart = (pPart ? pPart->nExpr : 0);
-    int addrGoto = 0;
-    int addrJump = 0;
-    int nPeer = (pOrderBy ? pOrderBy->nExpr : 0);
-
-    if( pPart ){
-      int regNewPart = reg + pMWin->nBufferCol;
-      KeyInfo *pKeyInfo = sqlite3KeyInfoFromExprList(pParse, pPart, 0, 0);
-      addr = sqlite3VdbeAddOp3(v, OP_Compare, regNewPart, pMWin->regPart,nPart);
-      sqlite3VdbeAppendP4(v, (void*)pKeyInfo, P4_KEYINFO);
-      addrJump = sqlite3VdbeAddOp3(v, OP_Jump, addr+2, 0, addr+2);
-      VdbeCoverageEqNe(v);
-      windowAggFinal(pParse, pMWin, 1);
-      if( pOrderBy ){
-        addrGoto = sqlite3VdbeAddOp0(v, OP_Goto);
-      }
-    }
-
-    if( pOrderBy ){
-      int regNewPeer = reg + pMWin->nBufferCol + nPart;
-      int regPeer = pMWin->regPart + nPart;
-
-      if( addrJump ) sqlite3VdbeJumpHere(v, addrJump);
-      if( pMWin->eType==TK_RANGE ){
-        KeyInfo *pKeyInfo = sqlite3KeyInfoFromExprList(pParse, pOrderBy, 0, 0);
-        addr = sqlite3VdbeAddOp3(v, OP_Compare, regNewPeer, regPeer, nPeer);
-        sqlite3VdbeAppendP4(v, (void*)pKeyInfo, P4_KEYINFO);
-        addrJump = sqlite3VdbeAddOp3(v, OP_Jump, addr+2, 0, addr+2);
-        VdbeCoverage(v);
-      }else{
-        addrJump = 0;
-      }
-      windowAggFinal(pParse, pMWin, pMWin->eStart==TK_CURRENT);
-      if( addrGoto ) sqlite3VdbeJumpHere(v, addrGoto);
-    }
-
-    sqlite3VdbeAddOp2(v, OP_Rewind, pMWin->iEphCsr,sqlite3VdbeCurrentAddr(v)+3);
+    ret = sqlite3VdbeAddOp0(v, OP_Goto);
+  }else{
+    sqlite3VdbeAddOp2(v, OP_Next, csr, sqlite3VdbeCurrentAddr(v)+1+bPeer);
     VdbeCoverage(v);
-    sqlite3VdbeAddOp2(v, OP_Gosub, regGosub, addrGosub);
-    sqlite3VdbeAddOp2(v, OP_Next, pMWin->iEphCsr, sqlite3VdbeCurrentAddr(v)-1);
-    VdbeCoverage(v);
-
-    sqlite3VdbeAddOp1(v, OP_ResetSorter, pMWin->iEphCsr);
-    sqlite3VdbeAddOp3(
-        v, OP_Copy, reg+pMWin->nBufferCol, pMWin->regPart, nPart+nPeer-1
-    );
-
-    if( addrJump ) sqlite3VdbeJumpHere(v, addrJump);
-  }
-
-  /* Invoke step function for window functions */
-  windowAggStep(pParse, pMWin, -1, 0, reg, 0);
-
-  /* Buffer the current row in the ephemeral table. */
-  if( pMWin->nBufferCol>0 ){
-    sqlite3VdbeAddOp3(v, OP_MakeRecord, reg, pMWin->nBufferCol, regRecord);
-  }else{
-    sqlite3VdbeAddOp2(v, OP_Blob, 0, regRecord);
-    sqlite3VdbeAppendP4(v, (void*)"", 0);
-  }
-  sqlite3VdbeAddOp2(v, OP_NewRowid, pMWin->iEphCsr, regRowid);
-  sqlite3VdbeAddOp3(v, OP_Insert, pMWin->iEphCsr, regRecord, regRowid);
-
-  /* End the database scan loop. */
-  sqlite3WhereEnd(pWInfo);
-
-  windowAggFinal(pParse, pMWin, 1);
-  sqlite3VdbeAddOp2(v, OP_Rewind, pMWin->iEphCsr,sqlite3VdbeCurrentAddr(v)+3);
-  VdbeCoverage(v);
-  sqlite3VdbeAddOp2(v, OP_Gosub, regGosub, addrGosub);
-  sqlite3VdbeAddOp2(v, OP_Next, pMWin->iEphCsr, sqlite3VdbeCurrentAddr(v)-1);
-  VdbeCoverage(v);
-}
+    if( bPeer ){
+      addrGoto = sqlite3VdbeAddOp0(v, OP_Goto);
+    }
+  }
+
+  if( bPeer ){
+    int nReg = (pMWin->pOrderBy ? pMWin->pOrderBy->nExpr : 0);
+    int regTmp = (nReg ? sqlite3GetTempRange(pParse, nReg) : 0);
+    windowReadPeerValues(p, csr, regTmp);
+    windowIfNewPeer(pParse, pMWin->pOrderBy, regTmp, reg, addrContinue);
+    sqlite3ReleaseTempRange(pParse, regTmp, nReg);
+  }
+
+  if( addrNextRange ){
+    sqlite3VdbeAddOp2(v, OP_Goto, 0, addrNextRange);
+  }
+  sqlite3VdbeResolveLabel(v, lblDone);
+  if( addrGoto ) sqlite3VdbeJumpHere(v, addrGoto);
+  if( addrIf ) sqlite3VdbeJumpHere(v, addrIf);
+  return ret;
+}
+
 
 /*
 ** Allocate and return a duplicate of the Window object indicated by the
 ** third argument. Set the Window.pOwner field of the new object to
 ** pOwner.
 */
 SQLITE_PRIVATE Window *sqlite3WindowDup(sqlite3 *db, Expr *pOwner, Window *p){
   Window *pNew = 0;
   if( ALWAYS(p) ){
     pNew = sqlite3DbMallocZero(db, sizeof(Window));
     if( pNew ){
       pNew->zName = sqlite3DbStrDup(db, p->zName);
       pNew->pFilter = sqlite3ExprDup(db, p->pFilter, 0);
       pNew->pFunc = p->pFunc;
       pNew->pPartition = sqlite3ExprListDup(db, p->pPartition, 0);
       pNew->pOrderBy = sqlite3ExprListDup(db, p->pOrderBy, 0);
-      pNew->eType = p->eType;
+      pNew->eFrmType = p->eFrmType;
       pNew->eEnd = p->eEnd;
       pNew->eStart = p->eStart;
+      pNew->eExclude = p->eExclude;
       pNew->pStart = sqlite3ExprDup(db, p->pStart, 0);
       pNew->pEnd = sqlite3ExprDup(db, p->pEnd, 0);
       pNew->pOwner = pOwner;
     }
   }
   return pNew;
 }
 
@@ -147212,99 +147428,693 @@ SQLITE_PRIVATE Window *sqlite3WindowList
     if( *pp==0 ) break;
     pp = &((*pp)->pNextWin);
   }
 
   return pRet;
 }
 
 /*
+** Return true if it can be determined at compile time that expression 
+** pExpr evaluates to a value that, when cast to an integer, is greater 
+** than zero. False otherwise.
+**
+** If an OOM error occurs, this function sets the Parse.db.mallocFailed 
+** flag and returns zero.
+*/
+static int windowExprGtZero(Parse *pParse, Expr *pExpr){
+  int ret = 0;
+  sqlite3 *db = pParse->db;
+  sqlite3_value *pVal = 0;
+  sqlite3ValueFromExpr(db, pExpr, db->enc, SQLITE_AFF_NUMERIC, &pVal);
+  if( pVal && sqlite3_value_int(pVal)>0 ){
+    ret = 1;
+  }
+  sqlite3ValueFree(pVal);
+  return ret;
+}
+
+/*
 ** sqlite3WhereBegin() has already been called for the SELECT statement 
 ** passed as the second argument when this function is invoked. It generates
-** code to populate the Window.regResult register for each window function and
-** invoke the sub-routine at instruction addrGosub once for each row.
-** This function calls sqlite3WhereEnd() before returning. 
+** code to populate the Window.regResult register for each window function 
+** and invoke the sub-routine at instruction addrGosub once for each row.
+** sqlite3WhereEnd() is always called before returning. 
+**
+** This function handles several different types of window frames, which
+** require slightly different processing. The following pseudo code is
+** used to implement window frames of the form:
+**
+**   ROWS BETWEEN <expr1> PRECEDING AND <expr2> FOLLOWING
+**
+** Other window frame types use variants of the following:
+**
+**     ... loop started by sqlite3WhereBegin() ...
+**       if( new partition ){
+**         Gosub flush
+**       }
+**       Insert new row into eph table.
+**       
+**       if( first row of partition ){
+**         // Rewind three cursors, all open on the eph table.
+**         Rewind(csrEnd);
+**         Rewind(csrStart);
+**         Rewind(csrCurrent);
+**       
+**         regEnd = <expr2>          // FOLLOWING expression
+**         regStart = <expr1>        // PRECEDING expression
+**       }else{
+**         // First time this branch is taken, the eph table contains two 
+**         // rows. The first row in the partition, which all three cursors
+**         // currently point to, and the following row.
+**         AGGSTEP
+**         if( (regEnd--)<=0 ){
+**           RETURN_ROW
+**           if( (regStart--)<=0 ){
+**             AGGINVERSE
+**           }
+**         }
+**       }
+**     }
+**     flush:
+**       AGGSTEP
+**       while( 1 ){
+**         RETURN ROW
+**         if( csrCurrent is EOF ) break;
+**         if( (regStart--)<=0 ){
+**           AggInverse(csrStart)
+**           Next(csrStart)
+**         }
+**       }
+**
+** The pseudo-code above uses the following shorthand:
+**
+**   AGGSTEP:    invoke the aggregate xStep() function for each window function
+**               with arguments read from the current row of cursor csrEnd, then
+**               step cursor csrEnd forward one row (i.e. sqlite3BtreeNext()).
+**
+**   RETURN_ROW: return a row to the caller based on the contents of the 
+**               current row of csrCurrent and the current state of all 
+**               aggregates. Then step cursor csrCurrent forward one row.
+**
+**   AGGINVERSE: invoke the aggregate xInverse() function for each window 
+**               functions with arguments read from the current row of cursor
+**               csrStart. Then step csrStart forward one row.
+**
+** There are two other ROWS window frames that are handled significantly
+** differently from the above - "BETWEEN <expr> PRECEDING AND <expr> PRECEDING"
+** and "BETWEEN <expr> FOLLOWING AND <expr> FOLLOWING". These are special 
+** cases because they change the order in which the three cursors (csrStart,
+** csrCurrent and csrEnd) iterate through the ephemeral table. Cases that
+** use UNBOUNDED or CURRENT ROW are much simpler variations on one of these
+** three.
+**
+**   ROWS BETWEEN <expr1> PRECEDING AND <expr2> PRECEDING
+**
+**     ... loop started by sqlite3WhereBegin() ...
+**       if( new partition ){
+**         Gosub flush
+**       }
+**       Insert new row into eph table.
+**       if( first row of partition ){
+**         Rewind(csrEnd) ; Rewind(csrStart) ; Rewind(csrCurrent)
+**         regEnd = <expr2>
+**         regStart = <expr1>
+**       }else{
+**         if( (regEnd--)<=0 ){
+**           AGGSTEP
+**         }
+**         RETURN_ROW
+**         if( (regStart--)<=0 ){
+**           AGGINVERSE
+**         }
+**       }
+**     }
+**     flush:
+**       if( (regEnd--)<=0 ){
+**         AGGSTEP
+**       }
+**       RETURN_ROW
+**
+**
+**   ROWS BETWEEN <expr1> FOLLOWING AND <expr2> FOLLOWING
+**
+**     ... loop started by sqlite3WhereBegin() ...
+**     if( new partition ){
+**       Gosub flush
+**     }
+**     Insert new row into eph table.
+**     if( first row of partition ){
+**       Rewind(csrEnd) ; Rewind(csrStart) ; Rewind(csrCurrent)
+**       regEnd = <expr2>
+**       regStart = regEnd - <expr1>
+**     }else{
+**       AGGSTEP
+**       if( (regEnd--)<=0 ){
+**         RETURN_ROW
+**       }
+**       if( (regStart--)<=0 ){
+**         AGGINVERSE
+**       }
+**     }
+**   }
+**   flush:
+**     AGGSTEP
+**     while( 1 ){
+**       if( (regEnd--)<=0 ){
+**         RETURN_ROW
+**         if( eof ) break;
+**       }
+**       if( (regStart--)<=0 ){
+**         AGGINVERSE
+**         if( eof ) break
+**       }
+**     }
+**     while( !eof csrCurrent ){
+**       RETURN_ROW
+**     }
+**
+** For the most part, the patterns above are adapted to support UNBOUNDED by
+** assuming that it is equivalent to "infinity PRECEDING/FOLLOWING" and
+** CURRENT ROW by assuming that it is equivilent to "0 PRECEDING/FOLLOWING".
+** This is optimized of course - branches that will never be taken and
+** conditions that are always true are omitted from the VM code. The only
+** exceptional case is:
+**
+**   ROWS BETWEEN <expr1> FOLLOWING AND UNBOUNDED FOLLOWING
+**
+**     ... loop started by sqlite3WhereBegin() ...
+**     if( new partition ){
+**       Gosub flush
+**     }
+**     Insert new row into eph table.
+**     if( first row of partition ){
+**       Rewind(csrEnd) ; Rewind(csrStart) ; Rewind(csrCurrent)
+**       regStart = <expr1>
+**     }else{
+**       AGGSTEP
+**     }
+**   }
+**   flush:
+**     AGGSTEP
+**     while( 1 ){
+**       if( (regStart--)<=0 ){
+**         AGGINVERSE
+**         if( eof ) break
+**       }
+**       RETURN_ROW
+**     }
+**     while( !eof csrCurrent ){
+**       RETURN_ROW
+**     }
+**
+** Also requiring special handling are the cases:
+**
+**   ROWS BETWEEN <expr1> PRECEDING AND <expr2> PRECEDING
+**   ROWS BETWEEN <expr1> FOLLOWING AND <expr2> FOLLOWING
+**
+** when (expr1 < expr2). This is detected at runtime, not by this function.
+** To handle this case, the pseudo-code programs depicted above are modified
+** slightly to be:
+**
+**     ... loop started by sqlite3WhereBegin() ...
+**     if( new partition ){
+**       Gosub flush
+**     }
+**     Insert new row into eph table.
+**     if( first row of partition ){
+**       Rewind(csrEnd) ; Rewind(csrStart) ; Rewind(csrCurrent)
+**       regEnd = <expr2>
+**       regStart = <expr1>
+**       if( regEnd < regStart ){
+**         RETURN_ROW
+**         delete eph table contents
+**         continue
+**       }
+**     ...
+**
+** The new "continue" statement in the above jumps to the next iteration
+** of the outer loop - the one started by sqlite3WhereBegin().
+**
+** The various GROUPS cases are implemented using the same patterns as
+** ROWS. The VM code is modified slightly so that:
+**
+**   1. The else branch in the main loop is only taken if the row just
+**      added to the ephemeral table is the start of a new group. In
+**      other words, it becomes:
+**
+**         ... loop started by sqlite3WhereBegin() ...
+**         if( new partition ){
+**           Gosub flush
+**         }
+**         Insert new row into eph table.
+**         if( first row of partition ){
+**           Rewind(csrEnd) ; Rewind(csrStart) ; Rewind(csrCurrent)
+**           regEnd = <expr2>
+**           regStart = <expr1>
+**         }else if( new group ){
+**           ... 
+**         }
+**       }
+**
+**   2. Instead of processing a single row, each RETURN_ROW, AGGSTEP or 
+**      AGGINVERSE step processes the current row of the relevant cursor and
+**      all subsequent rows belonging to the same group.
+**
+** RANGE window frames are a little different again. As for GROUPS, the 
+** main loop runs once per group only. And RETURN_ROW, AGGSTEP and AGGINVERSE
+** deal in groups instead of rows. As for ROWS and GROUPS, there are three
+** basic cases:
+**
+**   RANGE BETWEEN <expr1> PRECEDING AND <expr2> FOLLOWING
+**
+**     ... loop started by sqlite3WhereBegin() ...
+**       if( new partition ){
+**         Gosub flush
+**       }
+**       Insert new row into eph table.
+**       if( first row of partition ){
+**         Rewind(csrEnd) ; Rewind(csrStart) ; Rewind(csrCurrent)
+**         regEnd = <expr2>
+**         regStart = <expr1>
+**       }else{
+**         AGGSTEP
+**         while( (csrCurrent.key + regEnd) < csrEnd.key ){
+**           RETURN_ROW
+**           while( csrStart.key + regStart) < csrCurrent.key ){
+**             AGGINVERSE
+**           }
+**         }
+**       }
+**     }
+**     flush:
+**       AGGSTEP
+**       while( 1 ){
+**         RETURN ROW
+**         if( csrCurrent is EOF ) break;
+**           while( csrStart.key + regStart) < csrCurrent.key ){
+**             AGGINVERSE
+**           }
+**         }
+**       }
+**
+** In the above notation, "csr.key" means the current value of the ORDER BY 
+** expression (there is only ever 1 for a RANGE that uses an <expr> FOLLOWING
+** or <expr PRECEDING) read from cursor csr.
+**
+**   RANGE BETWEEN <expr1> PRECEDING AND <expr2> PRECEDING
+**
+**     ... loop started by sqlite3WhereBegin() ...
+**       if( new partition ){
+**         Gosub flush
+**       }
+**       Insert new row into eph table.
+**       if( first row of partition ){
+**         Rewind(csrEnd) ; Rewind(csrStart) ; Rewind(csrCurrent)
+**         regEnd = <expr2>
+**         regStart = <expr1>
+**       }else{
+**         if( (csrEnd.key + regEnd) <= csrCurrent.key ){
+**           AGGSTEP
+**         }
+**         while( (csrStart.key + regStart) < csrCurrent.key ){
+**           AGGINVERSE
+**         }
+**         RETURN_ROW
+**       }
+**     }
+**     flush:
+**       while( (csrEnd.key + regEnd) <= csrCurrent.key ){
+**         AGGSTEP
+**       }
+**       while( (csrStart.key + regStart) < csrCurrent.key ){
+**         AGGINVERSE
+**       }
+**       RETURN_ROW
+**
+**   RANGE BETWEEN <expr1> FOLLOWING AND <expr2> FOLLOWING
+**
+**     ... loop started by sqlite3WhereBegin() ...
+**       if( new partition ){
+**         Gosub flush
+**       }
+**       Insert new row into eph table.
+**       if( first row of partition ){
+**         Rewind(csrEnd) ; Rewind(csrStart) ; Rewind(csrCurrent)
+**         regEnd = <expr2>
+**         regStart = <expr1>
+**       }else{
+**         AGGSTEP
+**         while( (csrCurrent.key + regEnd) < csrEnd.key ){
+**           while( (csrCurrent.key + regStart) > csrStart.key ){
+**             AGGINVERSE
+**           }
+**           RETURN_ROW
+**         }
+**       }
+**     }
+**     flush:
+**       AGGSTEP
+**       while( 1 ){
+**         while( (csrCurrent.key + regStart) > csrStart.key ){
+**           AGGINVERSE
+**           if( eof ) break "while( 1 )" loop.
+**         }
+**         RETURN_ROW
+**       }
+**       while( !eof csrCurrent ){
+**         RETURN_ROW
+**       }
+**
+** The text above leaves out many details. Refer to the code and comments
+** below for a more complete picture.
 */
 SQLITE_PRIVATE void sqlite3WindowCodeStep(
   Parse *pParse,                  /* Parse context */
   Select *p,                      /* Rewritten SELECT statement */
   WhereInfo *pWInfo,              /* Context returned by sqlite3WhereBegin() */
   int regGosub,                   /* Register for OP_Gosub */
   int addrGosub                   /* OP_Gosub here to return each row */
 ){
   Window *pMWin = p->pWin;
-
-  /* There are three different functions that may be used to do the work
-  ** of this one, depending on the window frame and the specific built-in
-  ** window functions used (if any).
-  **
-  ** windowCodeRowExprStep() handles all "ROWS" window frames, except for:
-  **
-  **   ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW
-  **
-  ** The exception is because windowCodeRowExprStep() implements all window
-  ** frame types by caching the entire partition in a temp table, and
-  ** "ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW" is easy enough to
-  ** implement without such a cache.
-  **
-  ** windowCodeCacheStep() is used for:
-  **
-  **   RANGE BETWEEN CURRENT ROW AND UNBOUNDED FOLLOWING
-  **
-  ** It is also used for anything not handled by windowCodeRowExprStep() 
-  ** that invokes a built-in window function that requires the entire 
-  ** partition to be cached in a temp table before any rows are returned
-  ** (e.g. nth_value() or percent_rank()).
-  **
-  ** Finally, assuming there is no built-in window function that requires
-  ** the partition to be cached, windowCodeDefaultStep() is used for:
-  **
-  **   RANGE BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW 
-  **   RANGE BETWEEN UNBOUNDED PRECEDING AND UNBOUNDED FOLLOWING
-  **   RANGE BETWEEN CURRENT ROW AND CURRENT ROW 
-  **   ROWS BETWEEN UNBOUNDED PRECEDING AND CURRENT ROW
-  **
-  ** windowCodeDefaultStep() is the only one of the three functions that
-  ** does not cache each partition in a temp table before beginning to
-  ** return rows.
-  */
-  if( pMWin->eType==TK_ROWS 
-   && (pMWin->eStart!=TK_UNBOUNDED||pMWin->eEnd!=TK_CURRENT||!pMWin->pOrderBy)
-  ){
-    VdbeModuleComment((pParse->pVdbe, "Begin RowExprStep()"));
-    windowCodeRowExprStep(pParse, p, pWInfo, regGosub, addrGosub);
-  }else{
-    Window *pWin;
-    int bCache = 0;               /* True to use CacheStep() */
-
-    if( pMWin->eStart==TK_CURRENT && pMWin->eEnd==TK_UNBOUNDED ){
-      bCache = 1;
-    }else{
-      for(pWin=pMWin; pWin; pWin=pWin->pNextWin){
-        FuncDef *pFunc = pWin->pFunc;
-        if( (pFunc->funcFlags & SQLITE_FUNC_WINDOW_SIZE)
-         || (pFunc->zName==nth_valueName)
-         || (pFunc->zName==first_valueName)
-         || (pFunc->zName==leadName)
-         || (pFunc->zName==lagName)
-        ){
-          bCache = 1;
-          break;
-        }
-      }
-    }
-
-    /* Otherwise, call windowCodeDefaultStep().  */
-    if( bCache ){
-      VdbeModuleComment((pParse->pVdbe, "Begin CacheStep()"));
-      windowCodeCacheStep(pParse, p, pWInfo, regGosub, addrGosub);
-    }else{
-      VdbeModuleComment((pParse->pVdbe, "Begin DefaultStep()"));
-      windowCodeDefaultStep(pParse, p, pWInfo, regGosub, addrGosub);
-    }
+  ExprList *pOrderBy = pMWin->pOrderBy;
+  Vdbe *v = sqlite3GetVdbe(pParse);
+  int csrWrite;                   /* Cursor used to write to eph. table */
+  int csrInput = p->pSrc->a[0].iCursor;     /* Cursor of sub-select */
+  int nInput = p->pSrc->a[0].pTab->nCol;    /* Number of cols returned by sub */
+  int iInput;                               /* To iterate through sub cols */
+  int addrNe;                     /* Address of OP_Ne */
+  int addrGosubFlush = 0;         /* Address of OP_Gosub to flush: */
+  int addrInteger = 0;            /* Address of OP_Integer */
+  int addrEmpty;                  /* Address of OP_Rewind in flush: */
+  int regStart = 0;               /* Value of <expr> PRECEDING */
+  int regEnd = 0;                 /* Value of <expr> FOLLOWING */
+  int regNew;                     /* Array of registers holding new input row */
+  int regRecord;                  /* regNew array in record form */
+  int regRowid;                   /* Rowid for regRecord in eph table */
+  int regNewPeer = 0;             /* Peer values for new row (part of regNew) */
+  int regPeer = 0;                /* Peer values for current row */
+  int regFlushPart = 0;           /* Register for "Gosub flush_partition" */
+  WindowCodeArg s;                /* Context object for sub-routines */
+  int lblWhereEnd;                /* Label just before sqlite3WhereEnd() code */
+
+  assert( pMWin->eStart==TK_PRECEDING || pMWin->eStart==TK_CURRENT 
+       || pMWin->eStart==TK_FOLLOWING || pMWin->eStart==TK_UNBOUNDED 
+  );
+  assert( pMWin->eEnd==TK_FOLLOWING || pMWin->eEnd==TK_CURRENT 
+       || pMWin->eEnd==TK_UNBOUNDED || pMWin->eEnd==TK_PRECEDING 
+  );
+  assert( pMWin->eExclude==0 || pMWin->eExclude==TK_CURRENT
+       || pMWin->eExclude==TK_GROUP || pMWin->eExclude==TK_TIES
+       || pMWin->eExclude==TK_NO
+  );
+
+  lblWhereEnd = sqlite3VdbeMakeLabel(pParse);
+
+  /* Fill in the context object */
+  memset(&s, 0, sizeof(WindowCodeArg));
+  s.pParse = pParse;
+  s.pMWin = pMWin;
+  s.pVdbe = v;
+  s.regGosub = regGosub;
+  s.addrGosub = addrGosub;
+  s.current.csr = pMWin->iEphCsr;
+  csrWrite = s.current.csr+1;
+  s.start.csr = s.current.csr+2;
+  s.end.csr = s.current.csr+3;
+
+  /* Figure out when rows may be deleted from the ephemeral table. There
+  ** are four options - they may never be deleted (eDelete==0), they may 
+  ** be deleted as soon as they are no longer part of the window frame
+  ** (eDelete==WINDOW_AGGINVERSE), they may be deleted as after the row 
+  ** has been returned to the caller (WINDOW_RETURN_ROW), or they may
+  ** be deleted after they enter the frame (WINDOW_AGGSTEP). */
+  switch( pMWin->eStart ){
+    case TK_FOLLOWING:
+      if( pMWin->eFrmType!=TK_RANGE
+       && windowExprGtZero(pParse, pMWin->pStart)
+      ){
+        s.eDelete = WINDOW_RETURN_ROW;
+      }
+      break;
+    case TK_UNBOUNDED:
+      if( windowCacheFrame(pMWin)==0 ){
+        if( pMWin->eEnd==TK_PRECEDING ){
+          if( pMWin->eFrmType!=TK_RANGE
+           && windowExprGtZero(pParse, pMWin->pEnd)
+          ){
+            s.eDelete = WINDOW_AGGSTEP;
+          }
+        }else{
+          s.eDelete = WINDOW_RETURN_ROW;
+        }
+      }
+      break;
+    default:
+      s.eDelete = WINDOW_AGGINVERSE;
+      break;
+  }
+
+  /* Allocate registers for the array of values from the sub-query, the
+  ** samve values in record form, and the rowid used to insert said record
+  ** into the ephemeral table.  */
+  regNew = pParse->nMem+1;
+  pParse->nMem += nInput;
+  regRecord = ++pParse->nMem;
+  regRowid = ++pParse->nMem;
+
+  /* If the window frame contains an "<expr> PRECEDING" or "<expr> FOLLOWING"
+  ** clause, allocate registers to store the results of evaluating each
+  ** <expr>.  */
+  if( pMWin->eStart==TK_PRECEDING || pMWin->eStart==TK_FOLLOWING ){
+    regStart = ++pParse->nMem;
+  }
+  if( pMWin->eEnd==TK_PRECEDING || pMWin->eEnd==TK_FOLLOWING ){
+    regEnd = ++pParse->nMem;
+  }
+
+  /* If this is not a "ROWS BETWEEN ..." frame, then allocate arrays of
+  ** registers to store copies of the ORDER BY expressions (peer values) 
+  ** for the main loop, and for each cursor (start, current and end). */
+  if( pMWin->eFrmType!=TK_ROWS ){
+    int nPeer = (pOrderBy ? pOrderBy->nExpr : 0);
+    regNewPeer = regNew + pMWin->nBufferCol;
+    if( pMWin->pPartition ) regNewPeer += pMWin->pPartition->nExpr;
+    regPeer = pParse->nMem+1;       pParse->nMem += nPeer;
+    s.start.reg = pParse->nMem+1;   pParse->nMem += nPeer;
+    s.current.reg = pParse->nMem+1; pParse->nMem += nPeer;
+    s.end.reg = pParse->nMem+1;     pParse->nMem += nPeer;
+  }
+
+  /* Load the column values for the row returned by the sub-select
+  ** into an array of registers starting at regNew. Assemble them into
+  ** a record in register regRecord. */
+  for(iInput=0; iInput<nInput; iInput++){
+    sqlite3VdbeAddOp3(v, OP_Column, csrInput, iInput, regNew+iInput);
+  }
+  sqlite3VdbeAddOp3(v, OP_MakeRecord, regNew, nInput, regRecord);
+
+  /* An input row has just been read into an array of registers starting
+  ** at regNew. If the window has a PARTITION clause, this block generates 
+  ** VM code to check if the input row is the start of a new partition.
+  ** If so, it does an OP_Gosub to an address to be filled in later. The
+  ** address of the OP_Gosub is stored in local variable addrGosubFlush. */
+  if( pMWin->pPartition ){
+    int addr;
+    ExprList *pPart = pMWin->pPartition;
+    int nPart = pPart->nExpr;
+    int regNewPart = regNew + pMWin->nBufferCol;
+    KeyInfo *pKeyInfo = sqlite3KeyInfoFromExprList(pParse, pPart, 0, 0);
+
+    regFlushPart = ++pParse->nMem;
+    addr = sqlite3VdbeAddOp3(v, OP_Compare, regNewPart, pMWin->regPart, nPart);
+    sqlite3VdbeAppendP4(v, (void*)pKeyInfo, P4_KEYINFO);
+    sqlite3VdbeAddOp3(v, OP_Jump, addr+2, addr+4, addr+2);
+    VdbeCoverageEqNe(v);
+    addrGosubFlush = sqlite3VdbeAddOp1(v, OP_Gosub, regFlushPart);
+    VdbeComment((v, "call flush_partition"));
+    sqlite3VdbeAddOp3(v, OP_Copy, regNewPart, pMWin->regPart, nPart-1);
+  }
+
+  /* Insert the new row into the ephemeral table */
+  sqlite3VdbeAddOp2(v, OP_NewRowid, csrWrite, regRowid);
+  sqlite3VdbeAddOp3(v, OP_Insert, csrWrite, regRecord, regRowid);
+  addrNe = sqlite3VdbeAddOp3(v, OP_Ne, pMWin->regOne, 0, regRowid);
+  VdbeCoverageNeverNull(v);
+
+  /* This block is run for the first row of each partition */
+  s.regArg = windowInitAccum(pParse, pMWin);
+
+  if( regStart ){
+    sqlite3ExprCode(pParse, pMWin->pStart, regStart);
+    windowCheckValue(pParse, regStart, 0 + (pMWin->eFrmType==TK_RANGE ? 3 : 0));
+  }
+  if( regEnd ){
+    sqlite3ExprCode(pParse, pMWin->pEnd, regEnd);
+    windowCheckValue(pParse, regEnd, 1 + (pMWin->eFrmType==TK_RANGE ? 3 : 0));
+  }
+
+  if( pMWin->eStart==pMWin->eEnd && regStart ){
+    int op = ((pMWin->eStart==TK_FOLLOWING) ? OP_Ge : OP_Le);
+    int addrGe = sqlite3VdbeAddOp3(v, op, regStart, 0, regEnd);
+    VdbeCoverageNeverNullIf(v, op==OP_Ge); /* NeverNull because bound <expr> */
+    VdbeCoverageNeverNullIf(v, op==OP_Le); /*   values previously checked */
+    windowAggFinal(&s, 0);
+    sqlite3VdbeAddOp2(v, OP_Rewind, s.current.csr, 1);
+    VdbeCoverageNeverTaken(v);
+    windowReturnOneRow(&s);
+    sqlite3VdbeAddOp1(v, OP_ResetSorter, s.current.csr);
+    sqlite3VdbeAddOp2(v, OP_Goto, 0, lblWhereEnd);
+    sqlite3VdbeJumpHere(v, addrGe);
+  }
+  if( pMWin->eStart==TK_FOLLOWING && pMWin->eFrmType!=TK_RANGE && regEnd ){
+    assert( pMWin->eEnd==TK_FOLLOWING );
+    sqlite3VdbeAddOp3(v, OP_Subtract, regStart, regEnd, regStart);
+  }
+
+  if( pMWin->eStart!=TK_UNBOUNDED ){
+    sqlite3VdbeAddOp2(v, OP_Rewind, s.start.csr, 1);
+    VdbeCoverageNeverTaken(v);
+  }
+  sqlite3VdbeAddOp2(v, OP_Rewind, s.current.csr, 1);
+  VdbeCoverageNeverTaken(v);
+  sqlite3VdbeAddOp2(v, OP_Rewind, s.end.csr, 1);
+  VdbeCoverageNeverTaken(v);
+  if( regPeer && pOrderBy ){
+    sqlite3VdbeAddOp3(v, OP_Copy, regNewPeer, regPeer, pOrderBy->nExpr-1);
+    sqlite3VdbeAddOp3(v, OP_Copy, regPeer, s.start.reg, pOrderBy->nExpr-1);
+    sqlite3VdbeAddOp3(v, OP_Copy, regPeer, s.current.reg, pOrderBy->nExpr-1);
+    sqlite3VdbeAddOp3(v, OP_Copy, regPeer, s.end.reg, pOrderBy->nExpr-1);
+  }
+
+  sqlite3VdbeAddOp2(v, OP_Goto, 0, lblWhereEnd);
+
+  sqlite3VdbeJumpHere(v, addrNe);
+
+  /* Beginning of the block executed for the second and subsequent rows. */
+  if( regPeer ){
+    windowIfNewPeer(pParse, pOrderBy, regNewPeer, regPeer, lblWhereEnd);
+  }
+  if( pMWin->eStart==TK_FOLLOWING ){
+    windowCodeOp(&s, WINDOW_AGGSTEP, 0, 0);
+    if( pMWin->eEnd!=TK_UNBOUNDED ){
+      if( pMWin->eFrmType==TK_RANGE ){
+        int lbl = sqlite3VdbeMakeLabel(pParse);
+        int addrNext = sqlite3VdbeCurrentAddr(v);
+        windowCodeRangeTest(&s, OP_Ge, s.current.csr, regEnd, s.end.csr, lbl);
+        windowCodeOp(&s, WINDOW_AGGINVERSE, regStart, 0);
+        windowCodeOp(&s, WINDOW_RETURN_ROW, 0, 0);
+        sqlite3VdbeAddOp2(v, OP_Goto, 0, addrNext);
+        sqlite3VdbeResolveLabel(v, lbl);
+      }else{
+        windowCodeOp(&s, WINDOW_RETURN_ROW, regEnd, 0);
+        windowCodeOp(&s, WINDOW_AGGINVERSE, regStart, 0);
+      }
+    }
+  }else
+  if( pMWin->eEnd==TK_PRECEDING ){
+    int bRPS = (pMWin->eStart==TK_PRECEDING && pMWin->eFrmType==TK_RANGE);
+    windowCodeOp(&s, WINDOW_AGGSTEP, regEnd, 0);
+    if( bRPS ) windowCodeOp(&s, WINDOW_AGGINVERSE, regStart, 0);
+    windowCodeOp(&s, WINDOW_RETURN_ROW, 0, 0);
+    if( !bRPS ) windowCodeOp(&s, WINDOW_AGGINVERSE, regStart, 0);
+  }else{
+    int addr = 0;
+    windowCodeOp(&s, WINDOW_AGGSTEP, 0, 0);
+    if( pMWin->eEnd!=TK_UNBOUNDED ){
+      if( pMWin->eFrmType==TK_RANGE ){
+        int lbl = 0;
+        addr = sqlite3VdbeCurrentAddr(v);
+        if( regEnd ){
+          lbl = sqlite3VdbeMakeLabel(pParse);
+          windowCodeRangeTest(&s, OP_Ge, s.current.csr, regEnd, s.end.csr, lbl);
+        }
+        windowCodeOp(&s, WINDOW_RETURN_ROW, 0, 0);
+        windowCodeOp(&s, WINDOW_AGGINVERSE, regStart, 0);
+        if( regEnd ){
+          sqlite3VdbeAddOp2(v, OP_Goto, 0, addr);
+          sqlite3VdbeResolveLabel(v, lbl);
+        }
+      }else{
+        if( regEnd ){
+          addr = sqlite3VdbeAddOp3(v, OP_IfPos, regEnd, 0, 1);
+          VdbeCoverage(v);
+        }
+        windowCodeOp(&s, WINDOW_RETURN_ROW, 0, 0);
+        windowCodeOp(&s, WINDOW_AGGINVERSE, regStart, 0);
+        if( regEnd ) sqlite3VdbeJumpHere(v, addr);
+      }
+    }
+  }
+
+  /* End of the main input loop */
+  sqlite3VdbeResolveLabel(v, lblWhereEnd);
+  sqlite3WhereEnd(pWInfo);
+
+  /* Fall through */
+  if( pMWin->pPartition ){
+    addrInteger = sqlite3VdbeAddOp2(v, OP_Integer, 0, regFlushPart);
+    sqlite3VdbeJumpHere(v, addrGosubFlush);
+  }
+
+  addrEmpty = sqlite3VdbeAddOp1(v, OP_Rewind, csrWrite);
+  VdbeCoverage(v);
+  if( pMWin->eEnd==TK_PRECEDING ){
+    int bRPS = (pMWin->eStart==TK_PRECEDING && pMWin->eFrmType==TK_RANGE);
+    windowCodeOp(&s, WINDOW_AGGSTEP, regEnd, 0);
+    if( bRPS ) windowCodeOp(&s, WINDOW_AGGINVERSE, regStart, 0);
+    windowCodeOp(&s, WINDOW_RETURN_ROW, 0, 0);
+  }else if( pMWin->eStart==TK_FOLLOWING ){
+    int addrStart;
+    int addrBreak1;
+    int addrBreak2;
+    int addrBreak3;
+    windowCodeOp(&s, WINDOW_AGGSTEP, 0, 0);
+    if( pMWin->eFrmType==TK_RANGE ){
+      addrStart = sqlite3VdbeCurrentAddr(v);
+      addrBreak2 = windowCodeOp(&s, WINDOW_AGGINVERSE, regStart, 1);
+      addrBreak1 = windowCodeOp(&s, WINDOW_RETURN_ROW, 0, 1);
+    }else
+    if( pMWin->eEnd==TK_UNBOUNDED ){
+      addrStart = sqlite3VdbeCurrentAddr(v);
+      addrBreak1 = windowCodeOp(&s, WINDOW_RETURN_ROW, regStart, 1);
+      addrBreak2 = windowCodeOp(&s, WINDOW_AGGINVERSE, 0, 1);
+    }else{
+      assert( pMWin->eEnd==TK_FOLLOWING );
+      addrStart = sqlite3VdbeCurrentAddr(v);
+      addrBreak1 = windowCodeOp(&s, WINDOW_RETURN_ROW, regEnd, 1);
+      addrBreak2 = windowCodeOp(&s, WINDOW_AGGINVERSE, regStart, 1);
+    }
+    sqlite3VdbeAddOp2(v, OP_Goto, 0, addrStart);
+    sqlite3VdbeJumpHere(v, addrBreak2);
+    addrStart = sqlite3VdbeCurrentAddr(v);
+    addrBreak3 = windowCodeOp(&s, WINDOW_RETURN_ROW, 0, 1);
+    sqlite3VdbeAddOp2(v, OP_Goto, 0, addrStart);
+    sqlite3VdbeJumpHere(v, addrBreak1);
+    sqlite3VdbeJumpHere(v, addrBreak3);
+  }else{
+    int addrBreak;
+    int addrStart;
+    windowCodeOp(&s, WINDOW_AGGSTEP, 0, 0);
+    addrStart = sqlite3VdbeCurrentAddr(v);
+    addrBreak = windowCodeOp(&s, WINDOW_RETURN_ROW, 0, 1);
+    windowCodeOp(&s, WINDOW_AGGINVERSE, regStart, 0);
+    sqlite3VdbeAddOp2(v, OP_Goto, 0, addrStart);
+    sqlite3VdbeJumpHere(v, addrBreak);
+  }
+  sqlite3VdbeJumpHere(v, addrEmpty);
+
+  sqlite3VdbeAddOp1(v, OP_ResetSorter, s.current.csr);
+  if( pMWin->pPartition ){
+    if( pMWin->regStartRowid ){
+      sqlite3VdbeAddOp2(v, OP_Integer, 1, pMWin->regStartRowid);
+      sqlite3VdbeAddOp2(v, OP_Integer, 0, pMWin->regEndRowid);
+    }
+    sqlite3VdbeChangeP1(v, addrInteger, sqlite3VdbeCurrentAddr(v));
+    sqlite3VdbeAddOp1(v, OP_Return, regFlushPart);
   }
 }
 
 #endif /* SQLITE_OMIT_WINDOWFUNC */
 
 /************** End of window.c **********************************************/
 /************** Begin file parse.c *******************************************/
 /*
@@ -147483,16 +148293,20 @@ static void disableLookaside(Parse *pPar
         && pParse->db->init.busy==0
     ){
       sqlite3ErrorMsg(pParse, "syntax error after column name \"%.*s\"",
                          pIdToken->n, pIdToken->z);
     }
     sqlite3ExprListSetName(pParse, p, pIdToken, 1);
     return p;
   }
+
+#if TK_SPAN>255
+# error too many tokens in the grammar
+#endif
 /**************** End of %include directives **********************************/
 /* These constants specify the various numeric values for terminal symbols
 ** in a format understandable to "makeheaders".  This section is blank unless
 ** "lemon" is run with the "-m" command-line option.
 ***************** Begin makeheaders token definitions *************************/
 /**************** End makeheaders token definitions ***************************/
 
 /* The next sections is a series of control #defines.
@@ -147546,63 +148360,64 @@ static void disableLookaside(Parse *pPar
 **    YY_MIN_REDUCE      Minimum value for reduce actions
 **    YY_MAX_REDUCE      Maximum value for reduce actions
 */
 #ifndef INTERFACE
 # define INTERFACE 1
 #endif
 /************* Begin control #defines *****************************************/
 #define YYCODETYPE unsigned short int
-#define YYNOCODE 278
+#define YYNOCODE 301
 #define YYACTIONTYPE unsigned short int
-#define YYWILDCARD 91
+#define YYWILDCARD 95
 #define sqlite3ParserTOKENTYPE Token
 typedef union {
   int yyinit;
   sqlite3ParserTOKENTYPE yy0;
-  ExprList* yy42;
-  int yy96;
-  TriggerStep* yy119;
-  Window* yy147;
-  SrcList* yy167;
-  Upsert* yy266;
-  struct FrameBound yy317;
-  IdList* yy336;
-  struct TrigEvent yy350;
-  struct {int value; int mask;} yy367;
-  Select* yy423;
-  const char* yy464;
-  Expr* yy490;
-  With* yy499;
+  With* yy59;
+  IdList* yy62;
+  struct TrigEvent yy90;
+  Upsert* yy136;
+  struct FrameBound yy201;
+  u8 yy238;
+  const char* yy294;
+  Window* yy295;
+  struct {int value; int mask;} yy355;
+  ExprList* yy434;
+  TriggerStep* yy455;
+  Select* yy457;
+  SrcList* yy483;
+  int yy494;
+  Expr* yy524;
 } YYMINORTYPE;
 #ifndef YYSTACKDEPTH
 #define YYSTACKDEPTH 100
 #endif
 #define sqlite3ParserARG_SDECL
 #define sqlite3ParserARG_PDECL
 #define sqlite3ParserARG_PARAM
 #define sqlite3ParserARG_FETCH
 #define sqlite3ParserARG_STORE
 #define sqlite3ParserCTX_SDECL Parse *pParse;
 #define sqlite3ParserCTX_PDECL ,Parse *pParse
 #define sqlite3ParserCTX_PARAM ,pParse
 #define sqlite3ParserCTX_FETCH Parse *pParse=yypParser->pParse;
 #define sqlite3ParserCTX_STORE yypParser->pParse=pParse;
 #define YYFALLBACK 1
-#define YYNSTATE             524
-#define YYNRULE              369
-#define YYNTOKEN             155
-#define YY_MAX_SHIFT         523
-#define YY_MIN_SHIFTREDUCE   760
-#define YY_MAX_SHIFTREDUCE   1128
-#define YY_ERROR_ACTION      1129
-#define YY_ACCEPT_ACTION     1130
-#define YY_NO_ACTION         1131
-#define YY_MIN_REDUCE        1132
-#define YY_MAX_REDUCE        1500
+#define YYNSTATE             541
+#define YYNRULE              375
+#define YYNTOKEN             176
+#define YY_MAX_SHIFT         540
+#define YY_MIN_SHIFTREDUCE   784
+#define YY_MAX_SHIFTREDUCE   1158
+#define YY_ERROR_ACTION      1159
+#define YY_ACCEPT_ACTION     1160
+#define YY_NO_ACTION         1161
+#define YY_MIN_REDUCE        1162
+#define YY_MAX_REDUCE        1536
 /************* End control #defines *******************************************/
 #define YY_NLOOKAHEAD ((int)(sizeof(yy_lookahead)/sizeof(yy_lookahead[0])))
 
 /* Define the yytestcase() macro to be a no-op if is not already defined
 ** otherwise.
 **
 ** Applications can choose to define yytestcase() in the %include section
 ** to a macro that can assist in verifying code coverage.  For production
@@ -147659,579 +148474,613 @@ typedef union {
 **                     yy_action.  Used to detect hash collisions.
 **  yy_shift_ofst[]    For each state, the offset into yy_action for
 **                     shifting terminals.
 **  yy_reduce_ofst[]   For each state, the offset into yy_action for
 **                     shifting non-terminals after a reduce.
 **  yy_default[]       Default action for each state.
 **
 *********** Begin parsing tables **********************************************/
-#define YY_ACTTAB_COUNT (2009)
+#define YY_ACTTAB_COUNT (2142)
 static const YYACTIONTYPE yy_action[] = {
- /*     0 */   377,  518,  371,  107,  104,  200, 1293,  518, 1130,    1,
- /*    10 */     1,  523,    2, 1134,  518, 1203, 1203, 1262,  277,  373,
- /*    20 */   129,  495,   37,   37, 1397, 1201, 1201, 1211,   65,   65,
- /*    30 */   480,  891,  107,  104,  200,   37,   37, 1043, 1494,  892,
- /*    40 */   346, 1494,  342,  114,  115,  105, 1106, 1106,  957,  960,
- /*    50 */   950,  950,  112,  112,  113,  113,  113,  113,  285,  254,
- /*    60 */   254,  518,  254,  254,  500,  518,  495,  518,  107,  104,
- /*    70 */   200, 1085,  515,  481,  386,  515, 1464,  442,  501,  230,
- /*    80 */   197,  439,   37,   37, 1172,  210,   65,   65,   65,   65,
- /*    90 */   254,  254,  111,  111,  111,  111,  110,  110,  109,  109,
- /*   100 */   109,  108,  404,  515,  404,  155, 1041,  431,  401,  400,
- /*   110 */   254,  254,  373, 1431, 1427,  408, 1110, 1085, 1086, 1087,
- /*   120 */   284, 1112,  500,  515,  500,  368, 1433, 1421, 1428, 1111,
- /*   130 */  1261,  499,  373,  502,  108,  404,  114,  115,  105, 1106,
- /*   140 */  1106,  957,  960,  950,  950,  112,  112,  113,  113,  113,
- /*   150 */   113,  276,  509, 1113,  369, 1113,  114,  115,  105, 1106,
- /*   160 */  1106,  957,  960,  950,  950,  112,  112,  113,  113,  113,
- /*   170 */   113,  496, 1420, 1431,  493, 1468, 1065,  260, 1063,  433,
- /*   180 */    74,  107,  104,  200,  498,  111,  111,  111,  111,  110,
- /*   190 */   110,  109,  109,  109,  108,  404,  373,  113,  113,  113,
- /*   200 */   113,  106,  131,   91, 1361,  111,  111,  111,  111,  110,
- /*   210 */   110,  109,  109,  109,  108,  404,  113,  113,  113,  113,
- /*   220 */   114,  115,  105, 1106, 1106,  957,  960,  950,  950,  112,
- /*   230 */   112,  113,  113,  113,  113,  111,  111,  111,  111,  110,
- /*   240 */   110,  109,  109,  109,  108,  404,  116,  110,  110,  109,
- /*   250 */   109,  109,  108,  404,  111,  111,  111,  111,  110,  110,
- /*   260 */   109,  109,  109,  108,  404,  917,  512,  512,  512,  111,
- /*   270 */   111,  111,  111,  110,  110,  109,  109,  109,  108,  404,
- /*   280 */   517, 1198, 1177,  181,  109,  109,  109,  108,  404,  373,
- /*   290 */  1198,  402,  402,  402,   75,  360,  111,  111,  111,  111,
- /*   300 */   110,  110,  109,  109,  109,  108,  404,  382,  299,  419,
- /*   310 */   287,  170,  518,  114,  115,  105, 1106, 1106,  957,  960,
- /*   320 */   950,  950,  112,  112,  113,  113,  113,  113, 1444,  523,
- /*   330 */     2, 1134,  518,   13,   13,  337,  277, 1085,  129,  226,
- /*   340 */   937, 1058, 1000,  471,  917, 1211,  453,  384, 1085,  395,
- /*   350 */   162, 1057,  155,   45,   45,  416,  928,  401,  400,  479,
- /*   360 */   927,   12,  111,  111,  111,  111,  110,  110,  109,  109,
- /*   370 */   109,  108,  404,  226,  286,  254,  254,  254,  254,  518,
- /*   380 */    16,   16,  373, 1085, 1086, 1087,  314,  299,  515,  472,
- /*   390 */   515,  927,  927,  929, 1085, 1086, 1087,  378,  276,  509,
- /*   400 */    65,   65, 1113,  210, 1113, 1085,  114,  115,  105, 1106,
- /*   410 */  1106,  957,  960,  950,  950,  112,  112,  113,  113,  113,
- /*   420 */   113, 1448,  222, 1134, 1089,  461,  458,  457,  277,  180,
- /*   430 */   129,  378,  392,  408,  423,  456,  500, 1211,  240,  257,
- /*   440 */   324,  464,  319,  463,  227,  470,   12,  317,  424,  300,
- /*   450 */   317, 1085, 1086, 1087,  485,  111,  111,  111,  111,  110,
- /*   460 */   110,  109,  109,  109,  108,  404,  181,  118, 1085,  254,
- /*   470 */   254, 1089,  518,   90,  351,  373,  518, 1181,  365,  798,
- /*   480 */  1440,  339,  515,  248,  248,   77,  325,  133, 1085,  249,
- /*   490 */   424,  300,  794,   49,   49,  210,  515,   65,   65,  114,
- /*   500 */   115,  105, 1106, 1106,  957,  960,  950,  950,  112,  112,
- /*   510 */   113,  113,  113,  113, 1085, 1086, 1087,  222, 1085,  438,
- /*   520 */   461,  458,  457,  937,  787,  408,  171,  857,  362, 1021,
- /*   530 */   456,  136,  198,  486, 1085, 1086, 1087,  448,  794,  928,
- /*   540 */     5,  193,  192,  927, 1022,  107,  104,  200,  111,  111,
- /*   550 */   111,  111,  110,  110,  109,  109,  109,  108,  404, 1023,
- /*   560 */   254,  254,  803, 1085, 1085, 1086, 1087,  437,  373, 1085,
- /*   570 */   344,  787,  791,  515,  927,  927,  929, 1085, 1408, 1396,
- /*   580 */   832, 1085,  176,    3,  852, 1085,  518, 1439,  429,  851,
- /*   590 */   833,  518,  114,  115,  105, 1106, 1106,  957,  960,  950,
- /*   600 */   950,  112,  112,  113,  113,  113,  113,   13,   13, 1085,
- /*   610 */  1086, 1087,   13,   13,  518, 1085, 1086, 1087, 1496,  358,
- /*   620 */  1085,  389, 1234, 1085, 1086, 1087,  391, 1085, 1086, 1087,
- /*   630 */   448, 1085, 1086, 1087,  518,   65,   65,  947,  947,  958,
- /*   640 */   961,  111,  111,  111,  111,  110,  110,  109,  109,  109,
- /*   650 */   108,  404,  518,  382,  878,   13,   13,  518,  877,  518,
- /*   660 */   263,  373,  518,  431,  448, 1070, 1085, 1086, 1087,  267,
- /*   670 */   448,  488, 1360,   64,   64,  431,  812,  155,   50,   50,
- /*   680 */    65,   65,  518,   65,   65,  114,  115,  105, 1106, 1106,
- /*   690 */   957,  960,  950,  950,  112,  112,  113,  113,  113,  113,
- /*   700 */   518,  951,  382,   13,   13,  415,  411,  462,  414, 1085,
- /*   710 */  1366,  777, 1210,  292,  297,  813,  399,  497,  181,  403,
- /*   720 */   261,   15,   15,  276,  509,  414,  413, 1366, 1368,  410,
- /*   730 */   372,  345, 1209,  264,  111,  111,  111,  111,  110,  110,
- /*   740 */   109,  109,  109,  108,  404,  265,  254,  254,  229, 1405,
- /*   750 */   268, 1215,  268, 1103,  373, 1085, 1086, 1087,  938,  515,
- /*   760 */   393,  409,  876,  515,  254,  254, 1152,  482,  473,  262,
- /*   770 */   422,  476,  325,  503,  289,  518,  291,  515,  114,  115,
- /*   780 */   105, 1106, 1106,  957,  960,  950,  950,  112,  112,  113,
- /*   790 */   113,  113,  113,  414, 1021, 1366,   39,   39,  254,  254,
- /*   800 */   254,  254,  980,  254,  254,  254,  254,  255,  255, 1022,
- /*   810 */   279,  515,  516,  515,  846,  846,  515,  138,  515,  518,
- /*   820 */   515, 1043, 1495,  251, 1023, 1495,  876,  111,  111,  111,
- /*   830 */   111,  110,  110,  109,  109,  109,  108,  404,  518, 1353,
- /*   840 */    51,   51,  518,  199,  518,  506,  290,  373,  518,  276,
- /*   850 */   509,  922,    9,  483,  233, 1005, 1005,  445,  189,   52,
- /*   860 */    52,  325,  280,   53,   53,   54,   54,  373,  876,   55,
- /*   870 */    55,  114,  115,  105, 1106, 1106,  957,  960,  950,  950,
- /*   880 */   112,  112,  113,  113,  113,  113,   97,  518,   95, 1104,
- /*   890 */  1041,  114,  115,  105, 1106, 1106,  957,  960,  950,  950,
- /*   900 */   112,  112,  113,  113,  113,  113,  135,  199,   56,   56,
- /*   910 */   765,  766,  767,  225,  224,  223,  518,  283,  437,  233,
- /*   920 */   111,  111,  111,  111,  110,  110,  109,  109,  109,  108,
- /*   930 */   404, 1002,  876,  326,  518, 1002, 1104,   40,   40,  518,
- /*   940 */   111,  111,  111,  111,  110,  110,  109,  109,  109,  108,
- /*   950 */   404,  518,  448,  518, 1104,   41,   41,  518,   17,  518,
- /*   960 */    43,   43, 1155,  379,  518,  448,  518,  443,  518,  390,
- /*   970 */   518,  194,   44,   44,   57,   57, 1247,  518,   58,   58,
- /*   980 */    59,   59,  518,  466,  326,   14,   14,   60,   60,  120,
- /*   990 */   120,   61,   61,  449, 1206,   93,  518,  425,   46,   46,
- /*  1000 */   518, 1104,  518,   62,   62,  518,  437,  305,  518,  852,
- /*  1010 */   518,  298,  518, 1246,  851,  373,  518,   63,   63, 1293,
- /*  1020 */   397,   47,   47,  142,  142, 1467,  143,  143,  821,   70,
- /*  1030 */    70,   48,   48,   66,   66,  373,  518,  121,  121,  114,
- /*  1040 */   115,  105, 1106, 1106,  957,  960,  950,  950,  112,  112,
- /*  1050 */   113,  113,  113,  113,  518,  418,  518,   67,   67,  114,
- /*  1060 */   115,  105, 1106, 1106,  957,  960,  950,  950,  112,  112,
- /*  1070 */   113,  113,  113,  113,  312,  122,  122,  123,  123, 1293,
- /*  1080 */   518,  357, 1126,   88,  518,  435,  325,  387,  111,  111,
- /*  1090 */   111,  111,  110,  110,  109,  109,  109,  108,  404,  266,
- /*  1100 */   518,  119,  119,  518, 1293,  141,  141,  518,  111,  111,
- /*  1110 */   111,  111,  110,  110,  109,  109,  109,  108,  404,  518,
- /*  1120 */   801,  140,  140,  518,  127,  127,  511,  379,  126,  126,
- /*  1130 */   518,  137,  518, 1308,  518,  307,  518,  310,  518,  203,
- /*  1140 */   124,  124, 1307,   96,  125,  125,  207,  388, 1441,  468,
- /*  1150 */  1127,   69,   69,   71,   71,   68,   68,   38,   38,   42,
- /*  1160 */    42,  357, 1042,  373, 1293,  276,  509,  801,  185,  469,
- /*  1170 */   494,  436,  444,    6,  380,  156,  253,  197,  469,  134,
- /*  1180 */   426,   33, 1038,  373, 1121,  359, 1411,  114,  115,  105,
- /*  1190 */  1106, 1106,  957,  960,  950,  950,  112,  112,  113,  113,
- /*  1200 */   113,  113,  914,  296,   27,  293,   90,  114,  103,  105,
- /*  1210 */  1106, 1106,  957,  960,  950,  950,  112,  112,  113,  113,
- /*  1220 */   113,  113,  919,  275,  430,  232,  891,  232,  432,  256,
- /*  1230 */  1127,  232,  398,  370,  892,   28,  111,  111,  111,  111,
- /*  1240 */   110,  110,  109,  109,  109,  108,  404,  301,  454, 1385,
- /*  1250 */    90,  228,  209,  987,  811,  810,  111,  111,  111,  111,
- /*  1260 */   110,  110,  109,  109,  109,  108,  404,  315,  818,  819,
- /*  1270 */    90,  323,  983,  931,  885,  228,  373,  232,  999,  849,
- /*  1280 */   999,  322,  102,  998, 1384,  998,  785,  850,  440,  132,
- /*  1290 */   102,  302, 1243,  306,  309,  311,  373,  313, 1194, 1180,
- /*  1300 */   987,  115,  105, 1106, 1106,  957,  960,  950,  950,  112,
- /*  1310 */   112,  113,  113,  113,  113, 1178, 1179,  318,  327,  328,
- /*  1320 */   931, 1255,  105, 1106, 1106,  957,  960,  950,  950,  112,
- /*  1330 */   112,  113,  113,  113,  113, 1292, 1230, 1457,  273, 1241,
- /*  1340 */   504,  505, 1298,  100,  510,  246,    4, 1161, 1154,  111,
- /*  1350 */   111,  111,  111,  110,  110,  109,  109,  109,  108,  404,
- /*  1360 */   513, 1143,  187, 1142,  202, 1144, 1451,  356, 1227,  111,
- /*  1370 */   111,  111,  111,  110,  110,  109,  109,  109,  108,  404,
- /*  1380 */    11, 1277,  330,  405,  332,  334,  191, 1285,  364,  195,
- /*  1390 */   295,  417,  288,  100,  510,  507,    4,  434,  459,  321,
- /*  1400 */  1177,  349, 1357, 1356,  336,  155,  190, 1454, 1121,  158,
- /*  1410 */   513,  508,  235, 1404,  937, 1402, 1118,  381,   77,  428,
- /*  1420 */    98,   98,    8, 1282,  168,   30,  152,   99,  160,  405,
- /*  1430 */   520,  519,   88,  405,  927, 1362, 1274,  420,  163,   73,
- /*  1440 */   164,   76,  165,  166,  421,  507,  452,  212,  361,  363,
- /*  1450 */   427,  276,  509,   31, 1288,  172,  491,  441,  216, 1351,
- /*  1460 */    82,  490,  447, 1373,  937,  927,  927,  929,  930,   24,
- /*  1470 */    98,   98,  304,  247,  218,  177,  308,   99,  219,  405,
- /*  1480 */   520,  519,  450, 1145,  927,  220,  366, 1197,  100,  510,
- /*  1490 */   465,    4, 1188, 1196, 1195,  394,  803, 1169, 1187,  367,
- /*  1500 */  1168,  396,  484,  320, 1167,  513, 1466,   87,  475,  100,
- /*  1510 */   510,  271,    4,  272,  478,  927,  927,  929,  930,   24,
- /*  1520 */  1443, 1074,  407, 1238, 1239,  258,  513,  329,  405,  331,
- /*  1530 */   355,  355,  354,  243,  352,  234,  489,  774,  498,  184,
- /*  1540 */   507,  338, 1422,  339,  117, 1220,   10,  341,  333,  405,
- /*  1550 */   204,  491,  282, 1219, 1237, 1236,  492,  335,  343,  937,
- /*  1560 */   281,  507,   94, 1337,  186,   98,   98,  347,   89,  487,
- /*  1570 */   348,  241,   99,   29,  405,  520,  519,  274, 1151,  927,
- /*  1580 */   937,  521, 1080,  245,  242,  244,   98,   98,  856,  522,
- /*  1590 */   206, 1140, 1135,   99,  144,  405,  520,  519,  147,  375,
- /*  1600 */   927,  149,  376,  157, 1389, 1390, 1388, 1387,  205,  145,
- /*  1610 */   927,  927,  929,  930,   24,  146,  130,  761, 1165, 1164,
- /*  1620 */    72,  100,  510, 1162,    4,  269,  406,  188,  278,  201,
- /*  1630 */   259,  927,  927,  929,  930,   24,  128,  911,  513,  997,
- /*  1640 */   995,  159,  374,  208,  148,  161,  835,  276,  509,  211,
- /*  1650 */   294, 1011,  915,  167,  150,  383,  169,   78,  385,   79,
- /*  1660 */    80,  405,   81,  151, 1014,  213,  214, 1010,  139,   18,
- /*  1670 */   412,  215,  303,  507,  232, 1115, 1003,  446,  173,  217,
- /*  1680 */   174,   32,  776,  451,  491,  322,  221,  175,  814,  490,
- /*  1690 */    83,  455,  937,   19,  460,  316,   20,   84,   98,   98,
- /*  1700 */   270,  182,   85,  467,  153,   99,  154,  405,  520,  519,
- /*  1710 */  1074,  407,  927,  183,  258,  963, 1046,   86,   34,  355,
- /*  1720 */   355,  354,  243,  352,  474, 1047,  774,   35,  477,  196,
- /*  1730 */   250,  100,  510,  252,    4,  884,  178,  231, 1060,  204,
- /*  1740 */    21,  282,  102,  927,  927,  929,  930,   24,  513,  281,
- /*  1750 */   879,   22, 1064, 1062, 1051,    7,  340,   23,  978,  179,
- /*  1760 */    90,   92,  510,  964,    4,  236,  962,  966, 1020, 1019,
- /*  1770 */   237,  405,  967,   25,   36,  514,  932,  786,  513,  206,
- /*  1780 */   101,   26,  845,  507,  238,  239, 1459,  147,  350, 1458,
- /*  1790 */   149,  353, 1075, 1131, 1131, 1131, 1131,  205, 1131, 1131,
- /*  1800 */  1131,  405,  937, 1131, 1131, 1131, 1131, 1131,   98,   98,
- /*  1810 */  1131, 1131, 1131,  507, 1131,   99, 1131,  405,  520,  519,
- /*  1820 */  1131, 1131,  927, 1131, 1131, 1131, 1131, 1131, 1131, 1131,
- /*  1830 */  1131,  374,  937, 1131, 1131, 1131,  276,  509,   98,   98,
- /*  1840 */  1131, 1131, 1131, 1131, 1131,   99, 1131,  405,  520,  519,
- /*  1850 */  1131, 1131,  927,  927,  927,  929,  930,   24, 1131,  412,
- /*  1860 */  1131, 1131, 1131,  258, 1131, 1131, 1131, 1131,  355,  355,
- /*  1870 */   354,  243,  352, 1131, 1131,  774, 1131, 1131, 1131, 1131,
- /*  1880 */  1131, 1131, 1131,  927,  927,  929,  930,   24,  204, 1131,
- /*  1890 */   282, 1131, 1131, 1131, 1131, 1131, 1131, 1131,  281, 1131,
- /*  1900 */  1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131,
- /*  1910 */  1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131,
- /*  1920 */  1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131,  206, 1131,
- /*  1930 */  1131, 1131, 1131, 1131, 1131, 1131,  147, 1131, 1131,  149,
- /*  1940 */  1131, 1131, 1131, 1131, 1131, 1131,  205, 1131, 1131, 1131,
- /*  1950 */  1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131,
- /*  1960 */  1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131,
- /*  1970 */  1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131,
- /*  1980 */   374, 1131, 1131, 1131, 1131,  276,  509, 1131, 1131, 1131,
- /*  1990 */  1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131,
- /*  2000 */  1131, 1131, 1131, 1131, 1131, 1131, 1131, 1131,  412,
+ /*     0 */   535, 1323,  112,  109,  209,  112,  109,  209, 1160,    1,
+ /*    10 */     1,  540,    2, 1164,  535, 1292, 1228, 1207,  289,  384,
+ /*    20 */   134,   42,   42, 1427,  382, 1228,    9, 1241,  242,  492,
+ /*    30 */  1291,  915,  373,  379, 1026,   70,   70,  427, 1026,  916,
+ /*    40 */   529,  529,  529,  119,  120,  110, 1136, 1136,  981,  984,
+ /*    50 */   974,  974,  117,  117,  118,  118,  118,  118,  380,  264,
+ /*    60 */   264,  264,  264, 1134,  264,  264,  112,  109,  209,  397,
+ /*    70 */   454,  517,  532,  491,  532, 1233, 1233,  532,  239,  206,
+ /*    80 */   493,  112,  109,  209,  464,  219,  118,  118,  118,  118,
+ /*    90 */   111,  393,  440,  444,   16,   16,  116,  116,  116,  116,
+ /*   100 */   115,  115,  114,  114,  114,  113,  415,  971,  971,  982,
+ /*   110 */   985,  235, 1463,  351, 1134,  419,  384,  116,  116,  116,
+ /*   120 */   116,  115,  115,  114,  114,  114,  113,  415,  116,  116,
+ /*   130 */   116,  116,  115,  115,  114,  114,  114,  113,  415,  961,
+ /*   140 */   119,  120,  110, 1136, 1136,  981,  984,  974,  974,  117,
+ /*   150 */   117,  118,  118,  118,  118,  952,  415,  941,  298,  951,
+ /*   160 */   941, 1480,  540,    2, 1164, 1115,  535, 1458,  160,  289,
+ /*   170 */     6,  134, 1504,  389,  406,  975,  338, 1024, 1241,  337,
+ /*   180 */  1089, 1476, 1089,  118,  118,  118,  118,   42,   42,  329,
+ /*   190 */   951,  951,  953,  116,  116,  116,  116,  115,  115,  114,
+ /*   200 */   114,  114,  113,  415,  311,  430,  299,  311,  881,  160,
+ /*   210 */   264,  264,  401,  384,  324, 1115, 1116, 1117,  288,  526,
+ /*   220 */    96,  159, 1441,  532,  141,  116,  116,  116,  116,  115,
+ /*   230 */   115,  114,  114,  114,  113,  415,  219,  119,  120,  110,
+ /*   240 */  1136, 1136,  981,  984,  974,  974,  117,  117,  118,  118,
+ /*   250 */   118,  118,  115,  115,  114,  114,  114,  113,  415,  288,
+ /*   260 */   526,  403,  533,  121,  870,  870,  419,  250,  267,  336,
+ /*   270 */   475,  331,  474,  236,  160,  319, 1084,  322, 1465,  329,
+ /*   280 */   350,   12,  535,  384,  502, 1115, 1084,  435,  312, 1084,
+ /*   290 */   116,  116,  116,  116,  115,  115,  114,  114,  114,  113,
+ /*   300 */   415,  535,  836,   42,   42,  138,  426,  119,  120,  110,
+ /*   310 */  1136, 1136,  981,  984,  974,  974,  117,  117,  118,  118,
+ /*   320 */   118,  118,   70,   70,  288,  526,  412,  411,  480, 1457,
+ /*   330 */   335,   79,    6,  473, 1140, 1115, 1116, 1117,  501, 1142,
+ /*   340 */   334,  837,  811, 1484,  512, 1164,  534, 1141,  123,  187,
+ /*   350 */   289,  384,  134,  448,  434, 1115,   80,  349,  498, 1241,
+ /*   360 */   116,  116,  116,  116,  115,  115,  114,  114,  114,  113,
+ /*   370 */   415, 1143, 1115, 1143,  459,  119,  120,  110, 1136, 1136,
+ /*   380 */   981,  984,  974,  974,  117,  117,  118,  118,  118,  118,
+ /*   390 */   404,  264,  264,  811, 1463,  506,  368, 1156,  535,  114,
+ /*   400 */   114,  114,  113,  415,  532, 1115, 1116, 1117,  231,  518,
+ /*   410 */  1500,  472,  469,  468,  175,  497,  422,  219, 1202,   70,
+ /*   420 */    70,  467, 1115, 1116, 1117,  176,  201,  200,  116,  116,
+ /*   430 */   116,  116,  115,  115,  114,  114,  114,  113,  415,  535,
+ /*   440 */  1115,  264,  264,  435,  312, 1115,  273,  419,  384,  513,
+ /*   450 */  1450, 1115,  326, 1084,  532,  517,   82, 1084,  167,  388,
+ /*   460 */    69,   69, 1115, 1084,  519,  509, 1084, 1084,   12, 1157,
+ /*   470 */  1084,  420,  119,  120,  110, 1136, 1136,  981,  984,  974,
+ /*   480 */   974,  117,  117,  118,  118,  118,  118,  258,  258,  535,
+ /*   490 */  1115, 1116, 1117, 1045,  535, 1115, 1116, 1117, 1323,  535,
+ /*   500 */   532, 1115, 1116, 1117,  296,  483, 1211,  818, 1046,  448,
+ /*   510 */    70,   70, 1115, 1116, 1117,   50,   50,  448,  356,  500,
+ /*   520 */    70,   70,  207, 1047,   32,  116,  116,  116,  116,  115,
+ /*   530 */   115,  114,  114,  114,  113,  415,  453,  264,  264, 1115,
+ /*   540 */   450,  449,  961,  508,  856,  384,  517,    5,  900,  822,
+ /*   550 */   532,  484,  181, 1115,  857,  516,  517,  818,  952,  507,
+ /*   560 */     3, 1115,  951, 1231, 1231,  482,  398, 1115, 1095,  119,
+ /*   570 */   120,  110, 1136, 1136,  981,  984,  974,  974,  117,  117,
+ /*   580 */   118,  118,  118,  118, 1115,  535,  238, 1115, 1391, 1115,
+ /*   590 */  1116, 1117,  159,  951,  951,  953,  231, 1115,  259,  472,
+ /*   600 */   469,  468,  310, 1115, 1116, 1117,   13,   13,  297,  467,
+ /*   610 */   276, 1115, 1116, 1117,  412,  411, 1095, 1115, 1116, 1117,
+ /*   620 */   395,  355,  116,  116,  116,  116,  115,  115,  114,  114,
+ /*   630 */   114,  113,  415,  208, 1115, 1116, 1117, 1115, 1116, 1117,
+ /*   640 */   264,  264,  384,  337,  902,  393,  815, 1115, 1116, 1117,
+ /*   650 */   413,  413,  413,  532,  112,  109,  209,  309,  900, 1143,
+ /*   660 */   535, 1143,  535,  393,  901, 1210,  119,  120,  110, 1136,
+ /*   670 */  1136,  981,  984,  974,  974,  117,  117,  118,  118,  118,
+ /*   680 */   118,   13,   13,   13,   13,  265,  265,  535,  143,  264,
+ /*   690 */   264,  288,  526,  535, 1119,  400,  535,  402,  532,  510,
+ /*   700 */  1457,  512,  532,    6,  113,  415, 1067, 1530,   70,   70,
+ /*   710 */  1530,  535,  271,  535,   70,   70,  535,   13,   13,  116,
+ /*   720 */   116,  116,  116,  115,  115,  114,  114,  114,  113,  415,
+ /*   730 */   272,  277,   13,   13,   13,   13,  535,   13,   13,  384,
+ /*   740 */   535,  304,  425, 1100,  284, 1119,  184,  801,  185,  338,
+ /*   750 */   285,  514, 1532,  369, 1239, 1438, 1182,   70,   70,  425,
+ /*   760 */   424,   70,   70,  119,  120,  110, 1136, 1136,  981,  984,
+ /*   770 */   974,  974,  117,  117,  118,  118,  118,  118,  190, 1065,
+ /*   780 */  1067, 1531,  442,  107, 1531,  408,  264,  264,  264,  264,
+ /*   790 */   383, 1396,  261,  410,   95,  900,  485,  414,  421,  532,
+ /*   800 */  1045,  532,  301, 1133,  303,  488,  433, 1451, 1396, 1398,
+ /*   810 */   278,  535,  278,  520, 1435, 1046,  116,  116,  116,  116,
+ /*   820 */   115,  115,  114,  114,  114,  113,  415,  425,  264,  264,
+ /*   830 */  1047,  190,   54,   54,  535,  291,  384,  264,  264,  362,
+ /*   840 */   962,  532, 1004,  376, 1084,  264,  264, 1029, 1029,  456,
+ /*   850 */   532,  523,  270, 1065, 1084,   55,   55, 1084,  532,  442,
+ /*   860 */   119,  120,  110, 1136, 1136,  981,  984,  974,  974,  117,
+ /*   870 */   117,  118,  118,  118,  118,  535, 1396,  190,  302, 1383,
+ /*   880 */   208,  535,  789,  790,  791,  535,  515,  535, 1323,  371,
+ /*   890 */   337,  234,  233,  232,  459,  515,   15,   15,  459,  477,
+ /*   900 */   459,  459,   44,   44,  136,  900,   56,   56,   57,   57,
+ /*   910 */  1185,  390,  197,  116,  116,  116,  116,  115,  115,  114,
+ /*   920 */   114,  114,  113,  415,  535,  876,  535,  442,  535,  274,
+ /*   930 */   875, 1323,  357,  384,  353,  140, 1426,  946, 1455, 1323,
+ /*   940 */  1390,    6, 1240, 1236,  292,   58,   58,   59,   59,   60,
+ /*   950 */    60,  535, 1456,  384,  535,    6,  399,  119,  120,  110,
+ /*   960 */  1136, 1136,  981,  984,  974,  974,  117,  117,  118,  118,
+ /*   970 */   118,  118,   61,   61,  535,   45,   45,  119,  120,  110,
+ /*   980 */  1136, 1136,  981,  984,  974,  974,  117,  117,  118,  118,
+ /*   990 */   118,  118, 1477,  479,  202,   46,   46,  275,   95,  455,
+ /*  1000 */   535,  212,  535,  337,  535, 1454,  535,  409,    6,  242,
+ /*  1010 */   116,  116,  116,  116,  115,  115,  114,  114,  114,  113,
+ /*  1020 */   415,   48,   48,   49,   49,   62,   62,   63,   63,  535,
+ /*  1030 */   116,  116,  116,  116,  115,  115,  114,  114,  114,  113,
+ /*  1040 */   415,  535,  459,  535, 1134,  535, 1151,  535,  142,  535,
+ /*  1050 */    64,   64,  535, 1338,  535,  494,  535,  446,  535, 1264,
+ /*  1060 */   535, 1337,   14,   14,   65,   65,  125,  125,   66,   66,
+ /*  1070 */    51,   51,  535,   67,   67,   68,   68,   52,   52,  147,
+ /*  1080 */   147,  148,  148, 1453,  317,   98,    6,  535, 1245,  481,
+ /*  1090 */   535,  827,  535,   75,   75, 1134,  102,  481,  100,  535,
+ /*  1100 */   532,  535,  368, 1066, 1503,  384,  535,  845,   53,   53,
+ /*  1110 */    93,   71,   71,  126,  126,  295,  528,  390,  288,  526,
+ /*  1120 */    72,   72,  127,  127,  139,  384,   38,  128,  128,  119,
+ /*  1130 */   120,  110, 1136, 1136,  981,  984,  974,  974,  117,  117,
+ /*  1140 */   118,  118,  118,  118,  535,  495,  535,  447,  535,  119,
+ /*  1150 */   120,  110, 1136, 1136,  981,  984,  974,  974,  117,  117,
+ /*  1160 */   118,  118,  118,  118,  235,  124,  124,  146,  146,  145,
+ /*  1170 */   145,  287,  535, 1277,  535, 1157,  535,  391,  161,  263,
+ /*  1180 */   206,  381,  116,  116,  116,  116,  115,  115,  114,  114,
+ /*  1190 */   114,  113,  415,  132,  132,  131,  131,  129,  129,  535,
+ /*  1200 */    30,  535,  116,  116,  116,  116,  115,  115,  114,  114,
+ /*  1210 */   114,  113,  415,  535,  216, 1062, 1276,  535,  370,  535,
+ /*  1220 */   130,  130,   74,   74,  535,  915,  389,  876,   17,  437,
+ /*  1230 */   429,   31,  875,  916,   76,   76,  266,  101,   73,   73,
+ /*  1240 */    43,   43,  835,  834,  308,   47,   47,   95,  825,  943,
+ /*  1250 */   441,  938,  241,  241,  305,  443,  313,  384,  241,   95,
+ /*  1260 */   842,  843,  193,  465, 1209,  327,  237,  436,   95, 1011,
+ /*  1270 */  1007,  909,  873,  237,  241,  107, 1023,  384, 1023,  955,
+ /*  1280 */  1415,  119,  120,  110, 1136, 1136,  981,  984,  974,  974,
+ /*  1290 */   117,  117,  118,  118,  118,  118, 1022,  809, 1022,  825,
+ /*  1300 */   137,  119,  108,  110, 1136, 1136,  981,  984,  974,  974,
+ /*  1310 */   117,  117,  118,  118,  118,  118,  874, 1414,  451,  107,
+ /*  1320 */  1011,  314, 1273,  318,  218,  321,  323,  325, 1224, 1208,
+ /*  1330 */   955,  330,  339,  340,  116,  116,  116,  116,  115,  115,
+ /*  1340 */   114,  114,  114,  113,  415, 1285, 1322, 1260, 1493, 1470,
+ /*  1350 */  1271,  283,  521, 1328,  116,  116,  116,  116,  115,  115,
+ /*  1360 */   114,  114,  114,  113,  415, 1191, 1184, 1173, 1172, 1174,
+ /*  1370 */   522, 1487,  211,  460,  384,  256,  199,  367, 1257,  342,
+ /*  1380 */   195,  470,  307,  344,   11,  333,  525,  445, 1307, 1315,
+ /*  1390 */   375,  203, 1207, 1151,  384,  346, 1387,  188,  360,  120,
+ /*  1400 */   110, 1136, 1136,  981,  984,  974,  974,  117,  117,  118,
+ /*  1410 */   118,  118,  118, 1386,  428, 1490,  245,  300,  348, 1148,
+ /*  1420 */   110, 1136, 1136,  981,  984,  974,  974,  117,  117,  118,
+ /*  1430 */   118,  118,  118,  189,  198, 1434, 1432,   78,   81,  163,
+ /*  1440 */    82,  392,  439, 1392,  173,  105,  527,   35,    4,  157,
+ /*  1450 */  1312,  116,  116,  116,  116,  115,  115,  114,  114,  114,
+ /*  1460 */   113,  415,  530,  165,   93, 1304,  431,  432,  168,  463,
+ /*  1470 */   221,  116,  116,  116,  116,  115,  115,  114,  114,  114,
+ /*  1480 */   113,  415,  169,  452,  170,  416,  171,  374,  372,  438,
+ /*  1490 */    36, 1318,  177,  225, 1381,   87,  458,  524, 1403,  316,
+ /*  1500 */   257,  105,  527,  227,    4,  182,  461,  160,  320,  228,
+ /*  1510 */   377, 1175,  476,  229, 1227, 1226,  405, 1225,  530, 1218,
+ /*  1520 */   961,  378, 1199, 1198,  827,  332,  103,  103, 1197,  407,
+ /*  1530 */     8, 1217, 1502,  104,  487,  416,  537,  536,  281,  282,
+ /*  1540 */   951,  416,  490, 1268,  496,   92,  341,  243, 1269,  343,
+ /*  1550 */   244, 1267,  122,  524,  345, 1461,  515,  288,  526,   10,
+ /*  1560 */   354, 1266, 1460,  352,  504, 1250,   99, 1367,   94,  503,
+ /*  1570 */   499,  951,  951,  953,  954,   27,  961,  347, 1249,  194,
+ /*  1580 */   251,  358,  103,  103,  359, 1181,   34,  538, 1110,  104,
+ /*  1590 */   255,  416,  537,  536,  286,  252,  951,  254,  539,  149,
+ /*  1600 */  1170, 1419, 1165, 1420, 1418,  150, 1417,  135,  279,  785,
+ /*  1610 */   151,  417, 1195,  196,  290,  210,  386, 1194,  269,  387,
+ /*  1620 */   162, 1021,  133,   77, 1192, 1019,  935,  951,  951,  953,
+ /*  1630 */   954,   27, 1479, 1104,  418,  164,  153,  268,  217,  166,
+ /*  1640 */   859,  306,  366,  366,  365,  253,  363,  220, 1035,  798,
+ /*  1650 */   172,  939,  105,  527,  155,    4,  394,  174,  396,  156,
+ /*  1660 */    83, 1038,  213,   84,  294,   85,   86,  223,  222,  530,
+ /*  1670 */  1034,  144,  293,   18,  224,  315,  241, 1027, 1145,  178,
+ /*  1680 */   457,  226,  179,   37,  800,  334,  462,  230,  328,  466,
+ /*  1690 */   180,  471,  416,   88,   19,   20,   89,  280,  838,  158,
+ /*  1700 */   191,   90,  215,  478,  524, 1097,  204,  192,  987,   91,
+ /*  1710 */   152, 1070,   39,  154, 1071,  504,  486,   40,  489,  205,
+ /*  1720 */   505,  260,  105,  527,  214,    4,  908,  961,  262,  183,
+ /*  1730 */   240,   21,  903,  103,  103,  107,   22, 1086,   23,  530,
+ /*  1740 */   104, 1088,  416,  537,  536,   24, 1093,  951,   25, 1074,
+ /*  1750 */  1090, 1094,    7,   33,  511,  186,   26, 1002,  385,   95,
+ /*  1760 */   988,  986,  416,  288,  526,  990, 1044,  246, 1043,  247,
+ /*  1770 */   991,   28,   41,  106,  524,  956,  810,   29,  951,  951,
+ /*  1780 */   953,  954,   27,  531,  361,  504,  423,  248,  869,  249,
+ /*  1790 */   503, 1495,  364, 1105, 1161, 1494, 1161,  961, 1161, 1161,
+ /*  1800 */  1161, 1161, 1161,  103,  103, 1161, 1161, 1161, 1161, 1161,
+ /*  1810 */   104, 1161,  416,  537,  536, 1104,  418,  951, 1161,  268,
+ /*  1820 */  1161, 1161, 1161, 1161,  366,  366,  365,  253,  363, 1161,
+ /*  1830 */  1161,  798, 1161, 1161, 1161, 1161,  105,  527, 1161,    4,
+ /*  1840 */  1161, 1161, 1161, 1161,  213, 1161,  294, 1161,  951,  951,
+ /*  1850 */   953,  954,   27,  530,  293, 1161, 1161, 1161, 1161, 1161,
+ /*  1860 */  1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161,
+ /*  1870 */  1161, 1161, 1161, 1161, 1161, 1161,  416, 1161, 1161, 1161,
+ /*  1880 */  1161, 1161, 1161, 1161,  215, 1161, 1161, 1161,  524, 1161,
+ /*  1890 */  1161, 1161,  152, 1161, 1161,  154,  105,  527, 1161,    4,
+ /*  1900 */  1161, 1161, 1161, 1161, 1161, 1161,  214, 1161, 1161, 1161,
+ /*  1910 */  1161,  961, 1161,  530, 1161, 1161, 1161,  103,  103,  880,
+ /*  1920 */  1161, 1161, 1161, 1161,  104, 1161,  416,  537,  536, 1161,
+ /*  1930 */  1161,  951, 1161, 1161, 1161, 1161,  416, 1161, 1161, 1161,
+ /*  1940 */   385, 1161, 1161, 1161, 1161,  288,  526, 1161,  524, 1161,
+ /*  1950 */  1161, 1161, 1161, 1161, 1161, 1161,   97,  527, 1161,    4,
+ /*  1960 */  1161, 1161,  951,  951,  953,  954,   27, 1161,  423, 1161,
+ /*  1970 */  1161,  961, 1161,  530, 1161, 1161, 1161,  103,  103, 1161,
+ /*  1980 */  1161, 1161, 1161, 1161,  104, 1161,  416,  537,  536, 1161,
+ /*  1990 */  1161,  951,  268, 1161, 1161, 1161,  416,  366,  366,  365,
+ /*  2000 */   253,  363, 1161, 1161,  798, 1161, 1161, 1161,  524, 1161,
+ /*  2010 */  1161, 1161, 1161, 1161, 1161, 1161, 1161,  213, 1161,  294,
+ /*  2020 */  1161, 1161,  951,  951,  953,  954,   27,  293, 1161, 1161,
+ /*  2030 */  1161,  961, 1161, 1161, 1161, 1161, 1161,  103,  103, 1161,
+ /*  2040 */  1161, 1161, 1161, 1161,  104, 1161,  416,  537,  536, 1161,
+ /*  2050 */  1161,  951, 1161, 1161, 1161, 1161, 1161,  215, 1161, 1161,
+ /*  2060 */  1161, 1161, 1161, 1161, 1161,  152, 1161, 1161,  154, 1161,
+ /*  2070 */  1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161,  214,
+ /*  2080 */  1161, 1161,  951,  951,  953,  954,   27, 1161, 1161, 1161,
+ /*  2090 */  1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161,
+ /*  2100 */  1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161,
+ /*  2110 */  1161, 1161, 1161,  385, 1161, 1161, 1161, 1161,  288,  526,
+ /*  2120 */  1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161,
+ /*  2130 */  1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161, 1161,
+ /*  2140 */  1161,  423,
 };
 static const YYCODETYPE yy_lookahead[] = {
- /*     0 */   168,  163,  184,  238,  239,  240,  163,  163,  155,  156,
- /*    10 */   157,  158,  159,  160,  163,  202,  203,  187,  165,   19,
- /*    20 */   167,  163,  184,  185,  259,  202,  203,  174,  184,  185,
- /*    30 */   174,   31,  238,  239,  240,  184,  185,   22,   23,   39,
- /*    40 */   216,   26,  218,   43,   44,   45,   46,   47,   48,   49,
- /*    50 */    50,   51,   52,   53,   54,   55,   56,   57,  174,  206,
- /*    60 */   207,  163,  206,  207,  220,  163,  163,  163,  238,  239,
- /*    70 */   240,   59,  219,  229,  231,  219,  183,  245,  174,  223,
- /*    80 */   224,  249,  184,  185,  191,  232,  184,  185,  184,  185,
- /*    90 */   206,  207,   92,   93,   94,   95,   96,   97,   98,   99,
- /*   100 */   100,  101,  102,  219,  102,   81,   91,  163,   96,   97,
- /*   110 */   206,  207,   19,  275,  276,  262,  104,  105,  106,  107,
- /*   120 */   163,  109,  220,  219,  220,  184,  275,  269,  277,  117,
- /*   130 */   187,  229,   19,  229,  101,  102,   43,   44,   45,   46,
- /*   140 */    47,   48,   49,   50,   51,   52,   53,   54,   55,   56,
- /*   150 */    57,  127,  128,  141,  184,  143,   43,   44,   45,   46,
- /*   160 */    47,   48,   49,   50,   51,   52,   53,   54,   55,   56,
- /*   170 */    57,  268,  269,  275,  276,  197,   83,  233,   85,  163,
- /*   180 */    67,  238,  239,  240,  134,   92,   93,   94,   95,   96,
- /*   190 */    97,   98,   99,  100,  101,  102,   19,   54,   55,   56,
- /*   200 */    57,   58,  152,   26,  247,   92,   93,   94,   95,   96,
- /*   210 */    97,   98,   99,  100,  101,  102,   54,   55,   56,   57,
- /*   220 */    43,   44,   45,   46,   47,   48,   49,   50,   51,   52,
- /*   230 */    53,   54,   55,   56,   57,   92,   93,   94,   95,   96,
- /*   240 */    97,   98,   99,  100,  101,  102,   69,   96,   97,   98,
- /*   250 */    99,  100,  101,  102,   92,   93,   94,   95,   96,   97,
- /*   260 */    98,   99,  100,  101,  102,   73,  179,  180,  181,   92,
- /*   270 */    93,   94,   95,   96,   97,   98,   99,  100,  101,  102,
- /*   280 */   163,  191,  192,  163,   98,   99,  100,  101,  102,   19,
- /*   290 */   200,  179,  180,  181,   24,  175,   92,   93,   94,   95,
- /*   300 */    96,   97,   98,   99,  100,  101,  102,  163,  116,  117,
- /*   310 */   118,   22,  163,   43,   44,   45,   46,   47,   48,   49,
- /*   320 */    50,   51,   52,   53,   54,   55,   56,   57,  157,  158,
- /*   330 */   159,  160,  163,  184,  185,  163,  165,   59,  167,   46,
- /*   340 */    90,   76,   11,  174,   73,  174,   19,  198,   59,   19,
- /*   350 */    72,   86,   81,  184,  185,  234,  106,   96,   97,  163,
- /*   360 */   110,  182,   92,   93,   94,   95,   96,   97,   98,   99,
- /*   370 */   100,  101,  102,   46,  230,  206,  207,  206,  207,  163,
- /*   380 */   184,  185,   19,  105,  106,  107,   23,  116,  219,  220,
- /*   390 */   219,  141,  142,  143,  105,  106,  107,  104,  127,  128,
- /*   400 */   184,  185,  141,  232,  143,   59,   43,   44,   45,   46,
- /*   410 */    47,   48,   49,   50,   51,   52,   53,   54,   55,   56,
- /*   420 */    57,  158,  108,  160,   59,  111,  112,  113,  165,  250,
- /*   430 */   167,  104,  102,  262,  255,  121,  220,  174,  108,  109,
- /*   440 */   110,  111,  112,  113,  114,  229,  182,  120,  117,  118,
- /*   450 */   120,  105,  106,  107,  163,   92,   93,   94,   95,   96,
- /*   460 */    97,   98,   99,  100,  101,  102,  163,   22,   59,  206,
- /*   470 */   207,  106,  163,   26,  171,   19,  163,  193,  175,   23,
- /*   480 */   163,   22,  219,  206,  207,  139,  163,   22,   59,  182,
- /*   490 */   117,  118,   59,  184,  185,  232,  219,  184,  185,   43,
- /*   500 */    44,   45,   46,   47,   48,   49,   50,   51,   52,   53,
- /*   510 */    54,   55,   56,   57,  105,  106,  107,  108,   59,  255,
- /*   520 */   111,  112,  113,   90,   59,  262,   22,   98,  174,   12,
- /*   530 */   121,  208,  163,  220,  105,  106,  107,  163,  105,  106,
- /*   540 */    22,   96,   97,  110,   27,  238,  239,  240,   92,   93,
- /*   550 */    94,   95,   96,   97,   98,   99,  100,  101,  102,   42,
- /*   560 */   206,  207,  115,   59,  105,  106,  107,  163,   19,   59,
- /*   570 */   163,  106,   23,  219,  141,  142,  143,   59,  163,  205,
- /*   580 */    63,   59,   72,   22,  124,   59,  163,  270,  234,  129,
- /*   590 */    73,  163,   43,   44,   45,   46,   47,   48,   49,   50,
- /*   600 */    51,   52,   53,   54,   55,   56,   57,  184,  185,  105,
- /*   610 */   106,  107,  184,  185,  163,  105,  106,  107,  265,  266,
- /*   620 */    59,  198,  225,  105,  106,  107,  198,  105,  106,  107,
- /*   630 */   163,  105,  106,  107,  163,  184,  185,   46,   47,   48,
- /*   640 */    49,   92,   93,   94,   95,   96,   97,   98,   99,  100,
- /*   650 */   101,  102,  163,  163,  132,  184,  185,  163,  132,  163,
- /*   660 */   256,   19,  163,  163,  163,   23,  105,  106,  107,  198,
- /*   670 */   163,  220,  205,  184,  185,  163,   35,   81,  184,  185,
- /*   680 */   184,  185,  163,  184,  185,   43,   44,   45,   46,   47,
- /*   690 */    48,   49,   50,   51,   52,   53,   54,   55,   56,   57,
- /*   700 */   163,  110,  163,  184,  185,  109,  205,   66,  163,   59,
- /*   710 */   163,   21,  205,   16,  174,   74,  220,  198,  163,  220,
- /*   720 */   230,  184,  185,  127,  128,  180,  181,  180,  181,  163,
- /*   730 */   175,  242,  174,  233,   92,   93,   94,   95,   96,   97,
- /*   740 */    98,   99,  100,  101,  102,  233,  206,  207,   26,  163,
- /*   750 */   195,  207,  197,   26,   19,  105,  106,  107,   23,  219,
- /*   760 */   119,  260,   26,  219,  206,  207,  174,   19,  174,  230,
- /*   770 */    80,  174,  163,  174,   77,  163,   79,  219,   43,   44,
- /*   780 */    45,   46,   47,   48,   49,   50,   51,   52,   53,   54,
- /*   790 */    55,   56,   57,  248,   12,  248,  184,  185,  206,  207,
- /*   800 */   206,  207,  112,  206,  207,  206,  207,  206,  207,   27,
- /*   810 */   163,  219,  123,  219,  125,  126,  219,  208,  219,  163,
- /*   820 */   219,   22,   23,   23,   42,   26,   26,   92,   93,   94,
- /*   830 */    95,   96,   97,   98,   99,  100,  101,  102,  163,  149,
- /*   840 */   184,  185,  163,  107,  163,   63,  149,   19,  163,  127,
- /*   850 */   128,   23,   22,  105,   24,  116,  117,  118,  131,  184,
- /*   860 */   185,  163,  163,  184,  185,  184,  185,   19,  132,  184,
- /*   870 */   185,   43,   44,   45,   46,   47,   48,   49,   50,   51,
- /*   880 */    52,   53,   54,   55,   56,   57,  146,  163,  148,   59,
- /*   890 */    91,   43,   44,   45,   46,   47,   48,   49,   50,   51,
- /*   900 */    52,   53,   54,   55,   56,   57,  208,  107,  184,  185,
- /*   910 */     7,    8,    9,  116,  117,  118,  163,  163,  163,   24,
- /*   920 */    92,   93,   94,   95,   96,   97,   98,   99,  100,  101,
- /*   930 */   102,   29,  132,  163,  163,   33,  106,  184,  185,  163,
- /*   940 */    92,   93,   94,   95,   96,   97,   98,   99,  100,  101,
- /*   950 */   102,  163,  163,  163,   59,  184,  185,  163,   22,  163,
- /*   960 */   184,  185,  177,  178,  163,  163,  163,   65,  163,  199,
- /*   970 */   163,   26,  184,  185,  184,  185,  163,  163,  184,  185,
- /*   980 */   184,  185,  163,   98,  163,  184,  185,  184,  185,  184,
- /*   990 */   185,  184,  185,  252,  205,  147,  163,   61,  184,  185,
- /*  1000 */   163,  106,  163,  184,  185,  163,  163,  205,  163,  124,
- /*  1010 */   163,  256,  163,  163,  129,   19,  163,  184,  185,  163,
- /*  1020 */   199,  184,  185,  184,  185,   23,  184,  185,   26,  184,
- /*  1030 */   185,  184,  185,  184,  185,   19,  163,  184,  185,   43,
- /*  1040 */    44,   45,   46,   47,   48,   49,   50,   51,   52,   53,
- /*  1050 */    54,   55,   56,   57,  163,  163,  163,  184,  185,   43,
- /*  1060 */    44,   45,   46,   47,   48,   49,   50,   51,   52,   53,
- /*  1070 */    54,   55,   56,   57,   16,  184,  185,  184,  185,  163,
- /*  1080 */   163,   22,   23,  138,  163,   19,  163,  231,   92,   93,
- /*  1090 */    94,   95,   96,   97,   98,   99,  100,  101,  102,  256,
- /*  1100 */   163,  184,  185,  163,  163,  184,  185,  163,   92,   93,
- /*  1110 */    94,   95,   96,   97,   98,   99,  100,  101,  102,  163,
- /*  1120 */    59,  184,  185,  163,  184,  185,  177,  178,  184,  185,
- /*  1130 */   163,  208,  163,  237,  163,   77,  163,   79,  163,   15,
- /*  1140 */   184,  185,  237,  147,  184,  185,   24,  231,  153,  154,
- /*  1150 */    91,  184,  185,  184,  185,  184,  185,  184,  185,  184,
- /*  1160 */   185,   22,   23,   19,  163,  127,  128,  106,   24,  273,
- /*  1170 */   271,  105,  231,  274,  263,  264,  223,  224,  273,   22,
- /*  1180 */   118,   24,   23,   19,   60,   26,  163,   43,   44,   45,
- /*  1190 */    46,   47,   48,   49,   50,   51,   52,   53,   54,   55,
- /*  1200 */    56,   57,  140,   23,   22,  163,   26,   43,   44,   45,
- /*  1210 */    46,   47,   48,   49,   50,   51,   52,   53,   54,   55,
- /*  1220 */    56,   57,   23,  211,   23,   26,   31,   26,   23,   22,
- /*  1230 */    91,   26,  231,  221,   39,   53,   92,   93,   94,   95,
- /*  1240 */    96,   97,   98,   99,  100,  101,  102,   23,   23,  163,
- /*  1250 */    26,   26,  130,   59,  109,  110,   92,   93,   94,   95,
- /*  1260 */    96,   97,   98,   99,  100,  101,  102,   23,    7,    8,
- /*  1270 */    26,  110,   23,   59,   23,   26,   19,   26,  141,   23,
- /*  1280 */   143,  120,   26,  141,  163,  143,   23,   23,  163,   26,
- /*  1290 */    26,  163,  163,  163,  163,  163,   19,  163,  163,  193,
- /*  1300 */   106,   44,   45,   46,   47,   48,   49,   50,   51,   52,
- /*  1310 */    53,   54,   55,   56,   57,  163,  193,  163,  163,  163,
- /*  1320 */   106,  163,   45,   46,   47,   48,   49,   50,   51,   52,
- /*  1330 */    53,   54,   55,   56,   57,  163,  163,  130,  222,  163,
- /*  1340 */   163,  203,  163,   19,   20,  251,   22,  163,  163,   92,
- /*  1350 */    93,   94,   95,   96,   97,   98,   99,  100,  101,  102,
- /*  1360 */    36,  163,  209,  163,  261,  163,  163,  161,  222,   92,
- /*  1370 */    93,   94,   95,   96,   97,   98,   99,  100,  101,  102,
- /*  1380 */   210,  213,  222,   59,  222,  222,  182,  213,  213,  196,
- /*  1390 */   257,  226,  226,   19,   20,   71,   22,  257,  188,  187,
- /*  1400 */   192,  212,  187,  187,  226,   81,  210,  166,   60,  261,
- /*  1410 */    36,  244,  130,  170,   90,  170,   38,  170,  139,  104,
- /*  1420 */    96,   97,   48,  236,   22,  235,   43,  103,  201,  105,
- /*  1430 */   106,  107,  138,   59,  110,  247,  213,   18,  204,  258,
- /*  1440 */   204,  258,  204,  204,  170,   71,   18,  169,  213,  236,
- /*  1450 */   213,  127,  128,  235,  201,  201,   82,  170,  169,  213,
- /*  1460 */   146,   87,   62,  254,   90,  141,  142,  143,  144,  145,
- /*  1470 */    96,   97,  253,  170,  169,   22,  170,  103,  169,  105,
- /*  1480 */   106,  107,  189,  170,  110,  169,  189,  186,   19,   20,
- /*  1490 */   104,   22,  194,  186,  186,   64,  115,  186,  194,  189,
- /*  1500 */   188,  102,  133,  186,  186,   36,  186,  104,  189,   19,
- /*  1510 */    20,  246,   22,  246,  189,  141,  142,  143,  144,  145,
- /*  1520 */     0,    1,    2,  228,  228,    5,   36,  227,   59,  227,
- /*  1530 */    10,   11,   12,   13,   14,  170,   84,   17,  134,  216,
- /*  1540 */    71,  272,  270,   22,  137,  217,   22,  216,  227,   59,
- /*  1550 */    30,   82,   32,  217,  228,  228,   87,  227,  170,   90,
- /*  1560 */    40,   71,  146,  241,  215,   96,   97,  214,  136,  135,
- /*  1570 */   213,   25,  103,   26,  105,  106,  107,  243,  173,  110,
- /*  1580 */    90,  172,   13,    6,  164,  164,   96,   97,   98,  162,
- /*  1590 */    70,  162,  162,  103,  176,  105,  106,  107,   78,  267,
- /*  1600 */   110,   81,  267,  264,  182,  182,  182,  182,   88,  176,
- /*  1610 */   141,  142,  143,  144,  145,  176,  190,    4,  182,  182,
- /*  1620 */   182,   19,   20,  182,   22,  190,    3,   22,  151,   15,
- /*  1630 */    89,  141,  142,  143,  144,  145,   16,  128,   36,   23,
- /*  1640 */    23,  139,  122,   24,  119,  131,   20,  127,  128,  133,
- /*  1650 */    16,    1,  140,  131,  119,   61,  139,   53,   37,   53,
- /*  1660 */    53,   59,   53,  119,  105,   34,  130,    1,    5,   22,
- /*  1670 */   150,  104,  149,   71,   26,   75,   68,   41,   68,  130,
- /*  1680 */   104,   24,   20,   19,   82,  120,  114,   22,   28,   87,
- /*  1690 */    22,   67,   90,   22,   67,   23,   22,   22,   96,   97,
- /*  1700 */    67,   23,  138,   22,   37,  103,  153,  105,  106,  107,
- /*  1710 */     1,    2,  110,   23,    5,   23,   23,   26,   22,   10,
- /*  1720 */    11,   12,   13,   14,   24,   23,   17,   22,   24,  130,
- /*  1730 */    23,   19,   20,   23,   22,  105,   22,   34,   85,   30,
- /*  1740 */    34,   32,   26,  141,  142,  143,  144,  145,   36,   40,
- /*  1750 */   132,   34,   75,   83,   23,   44,   24,   34,   23,   26,
- /*  1760 */    26,   19,   20,   23,   22,   26,   23,   23,   23,   23,
- /*  1770 */    22,   59,   11,   22,   22,   26,   23,   23,   36,   70,
- /*  1780 */    22,   22,  124,   71,  130,  130,  130,   78,   23,  130,
- /*  1790 */    81,   15,    1,  278,  278,  278,  278,   88,  278,  278,
- /*  1800 */   278,   59,   90,  278,  278,  278,  278,  278,   96,   97,
- /*  1810 */   278,  278,  278,   71,  278,  103,  278,  105,  106,  107,
- /*  1820 */   278,  278,  110,  278,  278,  278,  278,  278,  278,  278,
- /*  1830 */   278,  122,   90,  278,  278,  278,  127,  128,   96,   97,
- /*  1840 */   278,  278,  278,  278,  278,  103,  278,  105,  106,  107,
- /*  1850 */   278,  278,  110,  141,  142,  143,  144,  145,  278,  150,
- /*  1860 */   278,  278,  278,    5,  278,  278,  278,  278,   10,   11,
- /*  1870 */    12,   13,   14,  278,  278,   17,  278,  278,  278,  278,
- /*  1880 */   278,  278,  278,  141,  142,  143,  144,  145,   30,  278,
- /*  1890 */    32,  278,  278,  278,  278,  278,  278,  278,   40,  278,
- /*  1900 */   278,  278,  278,  278,  278,  278,  278,  278,  278,  278,
- /*  1910 */   278,  278,  278,  278,  278,  278,  278,  278,  278,  278,
- /*  1920 */   278,  278,  278,  278,  278,  278,  278,  278,   70,  278,
- /*  1930 */   278,  278,  278,  278,  278,  278,   78,  278,  278,   81,
- /*  1940 */   278,  278,  278,  278,  278,  278,   88,  278,  278,  278,
- /*  1950 */   278,  278,  278,  278,  278,  278,  278,  278,  278,  278,
- /*  1960 */   278,  278,  278,  278,  278,  278,  278,  278,  278,  278,
- /*  1970 */   278,  278,  278,  278,  278,  278,  278,  278,  278,  278,
- /*  1980 */   122,  278,  278,  278,  278,  127,  128,  278,  278,  278,
- /*  1990 */   278,  278,  278,  278,  278,  278,  278,  278,  278,  278,
- /*  2000 */   278,  278,  278,  278,  278,  278,  278,  278,  150,  278,
- /*  2010 */   278,  278,  278,  278,  278,  278,  278,  278,  278,
-};
-#define YY_SHIFT_COUNT    (523)
+ /*     0 */   184,  184,  259,  260,  261,  259,  260,  261,  176,  177,
+ /*    10 */   178,  179,  180,  181,  184,  208,  212,  213,  186,   19,
+ /*    20 */   188,  205,  206,  280,  205,  221,   22,  195,   24,  195,
+ /*    30 */   208,   31,  195,  205,   29,  205,  206,  255,   33,   39,
+ /*    40 */   200,  201,  202,   43,   44,   45,   46,   47,   48,   49,
+ /*    50 */    50,   51,   52,   53,   54,   55,   56,   57,  205,  227,
+ /*    60 */   228,  227,  228,   59,  227,  228,  259,  260,  261,  252,
+ /*    70 */    65,  241,  240,  184,  240,  223,  224,  240,  244,  245,
+ /*    80 */   250,  259,  260,  261,   19,  253,   54,   55,   56,   57,
+ /*    90 */    58,  184,  255,  184,  205,  206,   96,   97,   98,   99,
+ /*   100 */   100,  101,  102,  103,  104,  105,  106,   46,   47,   48,
+ /*   110 */    49,   46,  296,  297,  110,  283,   19,   96,   97,   98,
+ /*   120 */    99,  100,  101,  102,  103,  104,  105,  106,   96,   97,
+ /*   130 */    98,   99,  100,  101,  102,  103,  104,  105,  106,   94,
+ /*   140 */    43,   44,   45,   46,   47,   48,   49,   50,   51,   52,
+ /*   150 */    53,   54,   55,   56,   57,  110,  106,   73,  251,  114,
+ /*   160 */    73,  178,  179,  180,  181,   59,  184,  292,   81,  186,
+ /*   170 */   295,  188,  218,  108,   19,  114,  184,   11,  195,  184,
+ /*   180 */    83,  184,   85,   54,   55,   56,   57,  205,  206,  124,
+ /*   190 */   145,  146,  147,   96,   97,   98,   99,  100,  101,  102,
+ /*   200 */   103,  104,  105,  106,  120,  121,  122,  120,  102,   81,
+ /*   210 */   227,  228,  220,   19,   16,  109,  110,  111,  131,  132,
+ /*   220 */    26,  184,  184,  240,  229,   96,   97,   98,   99,  100,
+ /*   230 */   101,  102,  103,  104,  105,  106,  253,   43,   44,   45,
+ /*   240 */    46,   47,   48,   49,   50,   51,   52,   53,   54,   55,
+ /*   250 */    56,   57,  100,  101,  102,  103,  104,  105,  106,  131,
+ /*   260 */   132,  106,  127,   69,  129,  130,  283,  112,  113,  114,
+ /*   270 */   115,  116,  117,  118,   81,   77,   76,   79,  296,  124,
+ /*   280 */   298,  203,  184,   19,   84,   59,   86,  121,  122,   89,
+ /*   290 */    96,   97,   98,   99,  100,  101,  102,  103,  104,  105,
+ /*   300 */   106,  184,   35,  205,  206,   22,  113,   43,   44,   45,
+ /*   310 */    46,   47,   48,   49,   50,   51,   52,   53,   54,   55,
+ /*   320 */    56,   57,  205,  206,  131,  132,  100,  101,  291,  292,
+ /*   330 */   114,   67,  295,   66,  108,  109,  110,  111,  138,  113,
+ /*   340 */   124,   74,   59,  179,  184,  181,  184,  121,   22,  271,
+ /*   350 */   186,   19,  188,  184,  276,   59,   24,  184,  241,  195,
+ /*   360 */    96,   97,   98,   99,  100,  101,  102,  103,  104,  105,
+ /*   370 */   106,  145,   59,  147,  184,   43,   44,   45,   46,   47,
+ /*   380 */    48,   49,   50,   51,   52,   53,   54,   55,   56,   57,
+ /*   390 */   123,  227,  228,  110,  296,  297,   22,   23,  184,  102,
+ /*   400 */   103,  104,  105,  106,  240,  109,  110,  111,  112,  195,
+ /*   410 */   204,  115,  116,  117,   22,  184,  226,  253,  212,  205,
+ /*   420 */   206,  125,  109,  110,  111,   22,  100,  101,   96,   97,
+ /*   430 */    98,   99,  100,  101,  102,  103,  104,  105,  106,  184,
+ /*   440 */    59,  227,  228,  121,  122,   59,  277,  283,   19,  289,
+ /*   450 */   290,   59,   23,   76,  240,  241,  143,   76,   72,  189,
+ /*   460 */   205,  206,   59,   86,  250,   84,   89,   86,  203,   95,
+ /*   470 */    89,  281,   43,   44,   45,   46,   47,   48,   49,   50,
+ /*   480 */    51,   52,   53,   54,   55,   56,   57,  227,  228,  184,
+ /*   490 */   109,  110,  111,   12,  184,  109,  110,  111,  184,  184,
+ /*   500 */   240,  109,  110,  111,  184,  195,  214,   59,   27,  184,
+ /*   510 */   205,  206,  109,  110,  111,  205,  206,  184,  263,  138,
+ /*   520 */   205,  206,  184,   42,   22,   96,   97,   98,   99,  100,
+ /*   530 */   101,  102,  103,  104,  105,  106,  266,  227,  228,   59,
+ /*   540 */   270,  276,   94,   66,   63,   19,  241,   22,   26,   23,
+ /*   550 */   240,  241,   72,   59,   73,  250,  241,  109,  110,   82,
+ /*   560 */    22,   59,  114,  223,  224,  250,  252,   59,   91,   43,
+ /*   570 */    44,   45,   46,   47,   48,   49,   50,   51,   52,   53,
+ /*   580 */    54,   55,   56,   57,   59,  184,   26,   59,  268,  109,
+ /*   590 */   110,  111,  184,  145,  146,  147,  112,   59,  203,  115,
+ /*   600 */   116,  117,  277,  109,  110,  111,  205,  206,  195,  125,
+ /*   610 */   277,  109,  110,  111,  100,  101,  139,  109,  110,  111,
+ /*   620 */   219,  184,   96,   97,   98,   99,  100,  101,  102,  103,
+ /*   630 */   104,  105,  106,  111,  109,  110,  111,  109,  110,  111,
+ /*   640 */   227,  228,   19,  184,  136,  184,   23,  109,  110,  111,
+ /*   650 */   200,  201,  202,  240,  259,  260,  261,  195,  136,  145,
+ /*   660 */   184,  147,  184,  184,  136,  214,   43,   44,   45,   46,
+ /*   670 */    47,   48,   49,   50,   51,   52,   53,   54,   55,   56,
+ /*   680 */    57,  205,  206,  205,  206,  227,  228,  184,  229,  227,
+ /*   690 */   228,  131,  132,  184,   59,  219,  184,  219,  240,  291,
+ /*   700 */   292,  184,  240,  295,  105,  106,   22,   23,  205,  206,
+ /*   710 */    26,  184,  251,  184,  205,  206,  184,  205,  206,   96,
+ /*   720 */    97,   98,   99,  100,  101,  102,  103,  104,  105,  106,
+ /*   730 */   251,  219,  205,  206,  205,  206,  184,  205,  206,   19,
+ /*   740 */   184,   16,  184,   23,  241,  110,  219,   21,  219,  184,
+ /*   750 */   241,  219,  286,  287,  195,  184,  195,  205,  206,  201,
+ /*   760 */   202,  205,  206,   43,   44,   45,   46,   47,   48,   49,
+ /*   770 */    50,   51,   52,   53,   54,   55,   56,   57,  184,   95,
+ /*   780 */    22,   23,  184,   26,   26,  220,  227,  228,  227,  228,
+ /*   790 */   196,  184,   23,  241,   26,   26,  195,  241,  184,  240,
+ /*   800 */    12,  240,   77,   26,   79,  195,   80,  290,  201,  202,
+ /*   810 */   216,  184,  218,  195,  184,   27,   96,   97,   98,   99,
+ /*   820 */   100,  101,  102,  103,  104,  105,  106,  269,  227,  228,
+ /*   830 */    42,  184,  205,  206,  184,  184,   19,  227,  228,  192,
+ /*   840 */    23,  240,  116,  196,   76,  227,  228,  120,  121,  122,
+ /*   850 */   240,   63,  254,   95,   86,  205,  206,   89,  240,  184,
+ /*   860 */    43,   44,   45,   46,   47,   48,   49,   50,   51,   52,
+ /*   870 */    53,   54,   55,   56,   57,  184,  269,  184,  153,  153,
+ /*   880 */   111,  184,    7,    8,    9,  184,  138,  184,  184,  196,
+ /*   890 */   184,  120,  121,  122,  184,  138,  205,  206,  184,  102,
+ /*   900 */   184,  184,  205,  206,  156,  136,  205,  206,  205,  206,
+ /*   910 */   198,  199,  135,   96,   97,   98,   99,  100,  101,  102,
+ /*   920 */   103,  104,  105,  106,  184,  128,  184,  184,  184,  254,
+ /*   930 */   133,  184,  237,   19,  239,  229,  226,   23,  292,  184,
+ /*   940 */   226,  295,  226,  226,  184,  205,  206,  205,  206,  205,
+ /*   950 */   206,  184,  292,   19,  184,  295,  252,   43,   44,   45,
+ /*   960 */    46,   47,   48,   49,   50,   51,   52,   53,   54,   55,
+ /*   970 */    56,   57,  205,  206,  184,  205,  206,   43,   44,   45,
+ /*   980 */    46,   47,   48,   49,   50,   51,   52,   53,   54,   55,
+ /*   990 */    56,   57,  157,  158,   26,  205,  206,  254,   26,  252,
+ /*  1000 */   184,   15,  184,  184,  184,  292,  184,  252,  295,   24,
+ /*  1010 */    96,   97,   98,   99,  100,  101,  102,  103,  104,  105,
+ /*  1020 */   106,  205,  206,  205,  206,  205,  206,  205,  206,  184,
+ /*  1030 */    96,   97,   98,   99,  100,  101,  102,  103,  104,  105,
+ /*  1040 */   106,  184,  184,  184,   59,  184,   60,  184,  229,  184,
+ /*  1050 */   205,  206,  184,  258,  184,   19,  184,   19,  184,  246,
+ /*  1060 */   184,  258,  205,  206,  205,  206,  205,  206,  205,  206,
+ /*  1070 */   205,  206,  184,  205,  206,  205,  206,  205,  206,  205,
+ /*  1080 */   206,  205,  206,  292,  226,  151,  295,  184,  228,  294,
+ /*  1090 */   184,  119,  184,  205,  206,  110,  150,  294,  152,  184,
+ /*  1100 */   240,  184,   22,   23,   23,   19,  184,   26,  205,  206,
+ /*  1110 */   142,  205,  206,  205,  206,  184,  198,  199,  131,  132,
+ /*  1120 */   205,  206,  205,  206,   22,   19,   24,  205,  206,   43,
+ /*  1130 */    44,   45,   46,   47,   48,   49,   50,   51,   52,   53,
+ /*  1140 */    54,   55,   56,   57,  184,  109,  184,  109,  184,   43,
+ /*  1150 */    44,   45,   46,   47,   48,   49,   50,   51,   52,   53,
+ /*  1160 */    54,   55,   56,   57,   46,  205,  206,  205,  206,  205,
+ /*  1170 */   206,  232,  184,  184,  184,   95,  184,  284,  285,  244,
+ /*  1180 */   245,  242,   96,   97,   98,   99,  100,  101,  102,  103,
+ /*  1190 */   104,  105,  106,  205,  206,  205,  206,  205,  206,  184,
+ /*  1200 */    22,  184,   96,   97,   98,   99,  100,  101,  102,  103,
+ /*  1210 */   104,  105,  106,  184,   24,   23,  184,  184,   26,  184,
+ /*  1220 */   205,  206,  205,  206,  184,   31,  108,  128,   22,  122,
+ /*  1230 */   184,   53,  133,   39,  205,  206,   22,  151,  205,  206,
+ /*  1240 */   205,  206,  113,  114,   23,  205,  206,   26,   59,   23,
+ /*  1250 */    23,  144,   26,   26,  184,   23,   23,   19,   26,   26,
+ /*  1260 */     7,    8,   24,   23,  214,   23,   26,   61,   26,   59,
+ /*  1270 */    23,   23,   23,   26,   26,   26,  145,   19,  147,   59,
+ /*  1280 */   184,   43,   44,   45,   46,   47,   48,   49,   50,   51,
+ /*  1290 */    52,   53,   54,   55,   56,   57,  145,   23,  147,  110,
+ /*  1300 */    26,   43,   44,   45,   46,   47,   48,   49,   50,   51,
+ /*  1310 */    52,   53,   54,   55,   56,   57,   23,  184,  184,   26,
+ /*  1320 */   110,  184,  184,  184,  134,  184,  184,  184,  184,  184,
+ /*  1330 */   110,  184,  184,  184,   96,   97,   98,   99,  100,  101,
+ /*  1340 */   102,  103,  104,  105,  106,  184,  184,  184,  134,  300,
+ /*  1350 */   184,  243,  184,  184,   96,   97,   98,   99,  100,  101,
+ /*  1360 */   102,  103,  104,  105,  106,  184,  184,  184,  184,  184,
+ /*  1370 */   224,  184,  282,  273,   19,  272,  203,  182,  243,  243,
+ /*  1380 */   230,  209,  278,  243,  231,  208,  265,  278,  234,  234,
+ /*  1390 */   234,  217,  213,   60,   19,  243,  208,  237,  233,   44,
+ /*  1400 */    45,   46,   47,   48,   49,   50,   51,   52,   53,   54,
+ /*  1410 */    55,   56,   57,  208,  247,  187,  134,  247,  247,   38,
+ /*  1420 */    45,   46,   47,   48,   49,   50,   51,   52,   53,   54,
+ /*  1430 */    55,   56,   57,  237,  231,  191,  191,  279,  279,  282,
+ /*  1440 */   143,  191,  108,  268,   22,   19,   20,  256,   22,   43,
+ /*  1450 */   257,   96,   97,   98,   99,  100,  101,  102,  103,  104,
+ /*  1460 */   105,  106,   36,  222,  142,  234,   18,  191,  225,   18,
+ /*  1470 */   190,   96,   97,   98,   99,  100,  101,  102,  103,  104,
+ /*  1480 */   105,  106,  225,  191,  225,   59,  225,  257,  234,  234,
+ /*  1490 */   256,  222,  222,  190,  234,  150,   62,   71,  275,  274,
+ /*  1500 */   191,   19,   20,  190,   22,   22,  210,   81,  191,  190,
+ /*  1510 */   210,  191,  108,  190,  207,  207,   64,  207,   36,  215,
+ /*  1520 */    94,  210,  207,  209,  119,  207,  100,  101,  207,  106,
+ /*  1530 */    48,  215,  207,  107,  210,  109,  110,  111,  267,  267,
+ /*  1540 */   114,   59,  210,  249,  137,  108,  248,  191,  249,  248,
+ /*  1550 */    88,  249,  141,   71,  248,  299,  138,  131,  132,   22,
+ /*  1560 */   191,  249,  299,  237,   82,  238,  150,  262,  140,   87,
+ /*  1570 */   139,  145,  146,  147,  148,  149,   94,  248,  238,  236,
+ /*  1580 */    25,  235,  100,  101,  234,  194,   26,  193,   13,  107,
+ /*  1590 */     6,  109,  110,  111,  264,  185,  114,  185,  183,  197,
+ /*  1600 */   183,  203,  183,  203,  203,  197,  203,  211,  211,    4,
+ /*  1610 */   197,    3,  203,   22,  155,   15,  288,  203,   93,  288,
+ /*  1620 */   285,   23,   16,  203,  203,   23,  132,  145,  146,  147,
+ /*  1630 */   148,  149,    0,    1,    2,  143,  123,    5,   24,  135,
+ /*  1640 */    20,   16,   10,   11,   12,   13,   14,  137,    1,   17,
+ /*  1650 */   135,  144,   19,   20,  123,   22,   61,  143,   37,  123,
+ /*  1660 */    53,  109,   30,   53,   32,   53,   53,  134,   34,   36,
+ /*  1670 */     1,    5,   40,   22,  108,  153,   26,   68,   75,   68,
+ /*  1680 */    41,  134,  108,   24,   20,  124,   19,  118,   23,   67,
+ /*  1690 */    22,   67,   59,   22,   22,   22,   22,   67,   28,   37,
+ /*  1700 */    23,  142,   70,   22,   71,   23,  157,   23,   23,   26,
+ /*  1710 */    78,   23,   22,   81,   23,   82,   24,   22,   24,  134,
+ /*  1720 */    87,   23,   19,   20,   92,   22,  109,   94,   23,   22,
+ /*  1730 */    34,   34,  136,  100,  101,   26,   34,   85,   34,   36,
+ /*  1740 */   107,   83,  109,  110,  111,   34,   90,  114,   34,   23,
+ /*  1750 */    75,   75,   44,   22,   24,   26,   34,   23,  126,   26,
+ /*  1760 */    23,   23,   59,  131,  132,   23,   23,   26,   23,   22,
+ /*  1770 */    11,   22,   22,   22,   71,   23,   23,   22,  145,  146,
+ /*  1780 */   147,  148,  149,   26,   23,   82,  154,  134,  128,  134,
+ /*  1790 */    87,  134,   15,    1,  301,  134,  301,   94,  301,  301,
+ /*  1800 */   301,  301,  301,  100,  101,  301,  301,  301,  301,  301,
+ /*  1810 */   107,  301,  109,  110,  111,    1,    2,  114,  301,    5,
+ /*  1820 */   301,  301,  301,  301,   10,   11,   12,   13,   14,  301,
+ /*  1830 */   301,   17,  301,  301,  301,  301,   19,   20,  301,   22,
+ /*  1840 */   301,  301,  301,  301,   30,  301,   32,  301,  145,  146,
+ /*  1850 */   147,  148,  149,   36,   40,  301,  301,  301,  301,  301,
+ /*  1860 */   301,  301,  301,  301,  301,  301,  301,  301,  301,  301,
+ /*  1870 */   301,  301,  301,  301,  301,  301,   59,  301,  301,  301,
+ /*  1880 */   301,  301,  301,  301,   70,  301,  301,  301,   71,  301,
+ /*  1890 */   301,  301,   78,  301,  301,   81,   19,   20,  301,   22,
+ /*  1900 */   301,  301,  301,  301,  301,  301,   92,  301,  301,  301,
+ /*  1910 */   301,   94,  301,   36,  301,  301,  301,  100,  101,  102,
+ /*  1920 */   301,  301,  301,  301,  107,  301,  109,  110,  111,  301,
+ /*  1930 */   301,  114,  301,  301,  301,  301,   59,  301,  301,  301,
+ /*  1940 */   126,  301,  301,  301,  301,  131,  132,  301,   71,  301,
+ /*  1950 */   301,  301,  301,  301,  301,  301,   19,   20,  301,   22,
+ /*  1960 */   301,  301,  145,  146,  147,  148,  149,  301,  154,  301,
+ /*  1970 */   301,   94,  301,   36,  301,  301,  301,  100,  101,  301,
+ /*  1980 */   301,  301,  301,  301,  107,  301,  109,  110,  111,  301,
+ /*  1990 */   301,  114,    5,  301,  301,  301,   59,   10,   11,   12,
+ /*  2000 */    13,   14,  301,  301,   17,  301,  301,  301,   71,  301,
+ /*  2010 */   301,  301,  301,  301,  301,  301,  301,   30,  301,   32,
+ /*  2020 */   301,  301,  145,  146,  147,  148,  149,   40,  301,  301,
+ /*  2030 */   301,   94,  301,  301,  301,  301,  301,  100,  101,  301,
+ /*  2040 */   301,  301,  301,  301,  107,  301,  109,  110,  111,  301,
+ /*  2050 */   301,  114,  301,  301,  301,  301,  301,   70,  301,  301,
+ /*  2060 */   301,  301,  301,  301,  301,   78,  301,  301,   81,  301,
+ /*  2070 */   301,  301,  301,  301,  301,  301,  301,  301,  301,   92,
+ /*  2080 */   301,  301,  145,  146,  147,  148,  149,  301,  301,  301,
+ /*  2090 */   301,  301,  301,  301,  301,  301,  301,  301,  301,  301,
+ /*  2100 */   301,  301,  301,  301,  301,  301,  301,  301,  301,  301,
+ /*  2110 */   301,  301,  301,  126,  301,  301,  301,  301,  131,  132,
+ /*  2120 */   301,  301,  301,  301,  301,  301,  301,  301,  301,  301,
+ /*  2130 */   301,  301,  301,  301,  301,  301,  301,  301,  301,  301,
+ /*  2140 */   301,  154,  301,  301,  301,  301,  301,  301,  301,  301,
+ /*  2150 */   301,  301,  301,  301,  301,  301,  301,  301,  301,  301,
+ /*  2160 */   301,  301,  301,  301,  301,  301,  301,  301,  301,
+};
+#define YY_SHIFT_COUNT    (540)
 #define YY_SHIFT_MIN      (0)
-#define YY_SHIFT_MAX      (1858)
+#define YY_SHIFT_MAX      (1987)
 static const unsigned short int yy_shift_ofst[] = {
- /*     0 */  1709, 1520, 1858, 1324, 1324,   24, 1374, 1469, 1602, 1712,
- /*    10 */  1712, 1712,  271,    0,    0,  113, 1016, 1712, 1712, 1712,
- /*    20 */  1712, 1712, 1712, 1712, 1712, 1712, 1712,   12,   12,  409,
- /*    30 */   596,   24,   24,   24,   24,   24,   24,   93,  177,  270,
- /*    40 */   363,  456,  549,  642,  735,  828,  848,  996, 1144, 1016,
- /*    50 */  1016, 1016, 1016, 1016, 1016, 1016, 1016, 1016, 1016, 1016,
- /*    60 */  1016, 1016, 1016, 1016, 1016, 1016, 1016, 1164, 1016, 1257,
- /*    70 */  1277, 1277, 1490, 1712, 1712, 1712, 1712, 1712, 1712, 1712,
- /*    80 */  1712, 1712, 1712, 1712, 1712, 1712, 1712, 1712, 1712, 1712,
- /*    90 */  1712, 1712, 1712, 1712, 1712, 1712, 1712, 1712, 1712, 1712,
- /*   100 */  1712, 1712, 1712, 1712, 1712, 1742, 1712, 1712, 1712, 1712,
- /*   110 */  1712, 1712, 1712, 1712, 1712, 1712, 1712, 1712, 1712,  143,
- /*   120 */   162,  162,  162,  162,  162,  204,  151,  186,  650,  690,
- /*   130 */   327,  650,  261,  261,  650,  722,  722,  722,  722,  373,
- /*   140 */    33,    2, 2009, 2009,  330,  330,  330,  346,  289,  278,
- /*   150 */   289,  289,  517,  517,  459,  510,   15,  799,  650,  650,
- /*   160 */   650,  650,  650,  650,  650,  650,  650,  650,  650,  650,
- /*   170 */   650,  650,  650,  650,  650,  650,  650,  650,  650,  650,
- /*   180 */   331,  365,  995,  995,  265,  365,   50, 1038, 2009, 2009,
- /*   190 */  2009,  433,  250,  250,  504,  314,  429,  518,  522,  526,
- /*   200 */   561,  650,  650,  650,  650,  650,  650,  650,  650,  650,
- /*   210 */   192,  650,  650,  650,  650,  650,  650,  650,  650,  650,
- /*   220 */   650,  650,  650,  641,  641,  641,  650,  650,  650,  650,
- /*   230 */   800,  650,  650,  650,  830,  650,  650,  782,  650,  650,
- /*   240 */   650,  650,  650,  650,  650,  650,  739,  902,  689,  895,
- /*   250 */   895,  895,  895,  736,  689,  689,  885,  445,  903, 1124,
- /*   260 */   945,  748,  748, 1066,  945,  945, 1066,  447, 1002,  293,
- /*   270 */  1195, 1195, 1195,  748,  740,  727,  460, 1157, 1348, 1282,
- /*   280 */  1282, 1378, 1378, 1282, 1279, 1315, 1402, 1383, 1294, 1419,
- /*   290 */  1419, 1419, 1419, 1282, 1428, 1294, 1294, 1315, 1402, 1383,
- /*   300 */  1383, 1294, 1282, 1428, 1314, 1400, 1282, 1428, 1453, 1282,
- /*   310 */  1428, 1282, 1428, 1453, 1386, 1386, 1386, 1431, 1453, 1386,
- /*   320 */  1381, 1386, 1431, 1386, 1386, 1453, 1399, 1399, 1453, 1369,
- /*   330 */  1403, 1369, 1403, 1369, 1403, 1369, 1403, 1282, 1404, 1452,
- /*   340 */  1521, 1407, 1404, 1524, 1282, 1416, 1407, 1432, 1434, 1294,
- /*   350 */  1546, 1547, 1569, 1569, 1577, 1577, 1577, 2009, 2009, 2009,
- /*   360 */  2009, 2009, 2009, 2009, 2009, 2009, 2009, 2009, 2009, 2009,
- /*   370 */  2009, 2009, 2009,  591,  697, 1059, 1139, 1058,  797,  465,
- /*   380 */  1159, 1182, 1122, 1062, 1180,  936, 1199, 1201, 1205, 1224,
- /*   390 */  1225, 1244, 1061, 1145, 1261, 1161, 1194, 1249, 1251, 1256,
- /*   400 */  1137, 1142, 1263, 1264, 1214, 1207, 1613, 1623, 1605, 1477,
- /*   410 */  1614, 1541, 1620, 1616, 1617, 1509, 1502, 1525, 1619, 1514,
- /*   420 */  1626, 1516, 1634, 1650, 1522, 1512, 1535, 1594, 1621, 1517,
- /*   430 */  1604, 1606, 1607, 1609, 1544, 1559, 1631, 1536, 1666, 1663,
- /*   440 */  1647, 1567, 1523, 1608, 1648, 1610, 1600, 1636, 1549, 1576,
- /*   450 */  1657, 1662, 1664, 1565, 1572, 1665, 1624, 1668, 1671, 1672,
- /*   460 */  1674, 1627, 1660, 1675, 1633, 1667, 1678, 1564, 1681, 1553,
- /*   470 */  1690, 1692, 1691, 1693, 1696, 1700, 1702, 1705, 1704, 1599,
- /*   480 */  1707, 1710, 1630, 1703, 1714, 1618, 1716, 1706, 1716, 1717,
- /*   490 */  1653, 1677, 1670, 1711, 1731, 1732, 1733, 1734, 1723, 1735,
- /*   500 */  1716, 1740, 1743, 1744, 1745, 1739, 1746, 1748, 1761, 1751,
- /*   510 */  1752, 1753, 1754, 1758, 1759, 1749, 1658, 1654, 1655, 1656,
- /*   520 */  1659, 1765, 1776, 1791,
-};
-#define YY_REDUCE_COUNT (372)
-#define YY_REDUCE_MIN   (-235)
-#define YY_REDUCE_MAX   (1441)
+ /*     0 */  1814, 1632, 1987, 1426, 1426,  128, 1482, 1633, 1703, 1877,
+ /*    10 */  1877, 1877,   87,    0,    0,  264, 1106, 1877, 1877, 1877,
+ /*    20 */  1877, 1877, 1877, 1877, 1877, 1877, 1877, 1877, 1877, 1877,
+ /*    30 */   226,  226,  381,  381,  296,  193,  128,  128,  128,  128,
+ /*    40 */   128,  128,   97,  194,  332,  429,  526,  623,  720,  817,
+ /*    50 */   914,  934, 1086, 1238, 1106, 1106, 1106, 1106, 1106, 1106,
+ /*    60 */  1106, 1106, 1106, 1106, 1106, 1106, 1106, 1106, 1106, 1106,
+ /*    70 */  1106, 1106, 1258, 1106, 1355, 1375, 1375, 1817, 1877, 1877,
+ /*    80 */  1877, 1877, 1877, 1877, 1877, 1877, 1877, 1877, 1877, 1877,
+ /*    90 */  1877, 1877, 1877, 1877, 1877, 1877, 1877, 1877, 1877, 1877,
+ /*   100 */  1877, 1877, 1877, 1877, 1877, 1877, 1877, 1877, 1877, 1877,
+ /*   110 */  1937, 1877, 1877, 1877, 1877, 1877, 1877, 1877, 1877, 1877,
+ /*   120 */  1877, 1877, 1877, 1877,   32,  129,  129,  129,  129,  129,
+ /*   130 */    21,  152,  297,  494,  726,   65,  494,  514,  514,  494,
+ /*   140 */   560,  560,  560,  560,  322,  599,   50, 2142, 2142,  155,
+ /*   150 */   155,  155,  313,  392,  386,  392,  392,  481,  481,  200,
+ /*   160 */   480,  684,  758,  494,  494,  494,  494,  494,  494,  494,
+ /*   170 */   494,  494,  494,  494,  494,  494,  494,  494,  494,  494,
+ /*   180 */   494,  494,  494,  494,  768,  768,  494,  166,  377,  377,
+ /*   190 */   635,  835,  835,  635,  748,  987, 2142, 2142, 2142,  448,
+ /*   200 */    45,   45,  403,  484,  502,  106,  525,  508,  528,  538,
+ /*   210 */   494,  494,  494,  494,  494,  494,  494,  494,  494,   84,
+ /*   220 */   494,  494,  494,  494,  494,  494,  494,  494,  494,  494,
+ /*   230 */   494,  494,  267,  267,  267,  494,  494,  494,  494,  769,
+ /*   240 */   494,  494,  494,    4,  477,  494,  494,  788,  494,  494,
+ /*   250 */   494,  494,  494,  494,  494,  494,  727,    5,  135,  985,
+ /*   260 */   985,  985,  985,  522,  135,  135,  797,  326,  875,  986,
+ /*   270 */   968, 1036, 1036, 1038,  968,  968, 1038,  972, 1081, 1118,
+ /*   280 */  1194, 1194, 1194, 1036,  757,  757,  946,  777, 1099, 1102,
+ /*   290 */  1333, 1282, 1282, 1381, 1381, 1282, 1297, 1334, 1422, 1406,
+ /*   300 */  1322, 1448, 1448, 1448, 1448, 1282, 1451, 1322, 1322, 1334,
+ /*   310 */  1422, 1406, 1406, 1322, 1282, 1451, 1345, 1434, 1282, 1451,
+ /*   320 */  1483, 1282, 1451, 1282, 1451, 1483, 1404, 1404, 1404, 1452,
+ /*   330 */  1483, 1404, 1405, 1404, 1452, 1404, 1404, 1483, 1423, 1423,
+ /*   340 */  1483, 1407, 1437, 1407, 1437, 1407, 1437, 1407, 1437, 1282,
+ /*   350 */  1462, 1462, 1411, 1418, 1537, 1282, 1416, 1411, 1428, 1431,
+ /*   360 */  1322, 1555, 1560, 1575, 1575, 1584, 1584, 1584, 2142, 2142,
+ /*   370 */  2142, 2142, 2142, 2142, 2142, 2142, 2142, 2142, 2142, 2142,
+ /*   380 */  2142, 2142, 2142, 2142,   61,  725,  374, 1080,  198,  771,
+ /*   390 */   283, 1192, 1178, 1190, 1107, 1221, 1206, 1226, 1227, 1232,
+ /*   400 */  1233, 1240, 1242, 1189, 1129, 1253,  216, 1210, 1247, 1248,
+ /*   410 */  1249, 1131, 1151, 1274, 1293, 1220, 1214, 1605, 1608, 1591,
+ /*   420 */  1459, 1600, 1525, 1606, 1598, 1602, 1494, 1492, 1513, 1614,
+ /*   430 */  1504, 1620, 1510, 1625, 1647, 1515, 1507, 1531, 1595, 1621,
+ /*   440 */  1514, 1607, 1610, 1612, 1613, 1536, 1552, 1634, 1533, 1669,
+ /*   450 */  1666, 1651, 1566, 1522, 1609, 1650, 1611, 1603, 1639, 1547,
+ /*   460 */  1574, 1659, 1664, 1667, 1561, 1569, 1668, 1622, 1671, 1672,
+ /*   470 */  1665, 1673, 1624, 1670, 1674, 1630, 1662, 1677, 1559, 1681,
+ /*   480 */  1682, 1549, 1684, 1685, 1683, 1688, 1690, 1692, 1691, 1695,
+ /*   490 */  1694, 1585, 1698, 1705, 1617, 1696, 1707, 1596, 1709, 1697,
+ /*   500 */  1702, 1704, 1711, 1652, 1675, 1658, 1708, 1676, 1656, 1714,
+ /*   510 */  1726, 1731, 1730, 1729, 1733, 1722, 1734, 1709, 1737, 1738,
+ /*   520 */  1742, 1743, 1741, 1745, 1747, 1759, 1749, 1750, 1752, 1753,
+ /*   530 */  1751, 1755, 1757, 1660, 1653, 1655, 1657, 1661, 1761, 1777,
+ /*   540 */  1792,
+};
+#define YY_REDUCE_COUNT (383)
+#define YY_REDUCE_MIN   (-257)
+#define YY_REDUCE_MAX   (1421)
 static const short yy_reduce_ofst[] = {
- /*     0 */  -147,  171,  263,  -96,  169, -144, -162, -149, -102, -156,
- /*    10 */   -98,  216,  354, -170,  -57, -235,  307,  149,  423,  428,
- /*    20 */   471,  313,  451,  519,  489,  496,  499,  545,  547,  555,
- /*    30 */  -116,  540,  558,  592,  594,  597,  599, -206, -206, -206,
- /*    40 */  -206, -206, -206, -206, -206, -206, -206, -206, -206, -206,
- /*    50 */  -206, -206, -206, -206, -206, -206, -206, -206, -206, -206,
- /*    60 */  -206, -206, -206, -206, -206, -206, -206, -206, -206, -206,
- /*    70 */  -206, -206,  196,  309,  494,  537,  612,  656,  675,  679,
- /*    80 */   681,  685,  724,  753,  771,  776,  788,  790,  794,  796,
- /*    90 */   801,  803,  805,  807,  814,  819,  833,  837,  839,  842,
- /*   100 */   845,  847,  849,  853,  873,  891,  893,  917,  921,  937,
- /*   110 */   940,  944,  956,  960,  967,  969,  971,  973,  975, -206,
- /*   120 */  -206, -206, -206, -206, -206, -206, -206, -206,  501, -168,
- /*   130 */    90,  -97,   87,  112,  303,  277,  601,  277,  601,  179,
- /*   140 */  -206, -206, -206, -206, -107, -107, -107,  -43,  -56,  323,
- /*   150 */   500,  512, -187, -177,  317,  609,  353,  353,  120,  144,
- /*   160 */   490,  539,  698,  374,  467,  507,  789,  404, -157,  755,
- /*   170 */   856,  916,  843,  941,  802,  770,  923,  821, 1001, -142,
- /*   180 */   264,  785,  896,  905,  899,  949, -176,  544,  911,  953,
- /*   190 */  1012, -182,  -59,  -30,   16,  -22,  117,  172,  291,  369,
- /*   200 */   407,  415,  566,  586,  647,  699,  754,  813,  850,  892,
- /*   210 */   121, 1023, 1042, 1086, 1121, 1125, 1128, 1129, 1130, 1131,
- /*   220 */  1132, 1134, 1135,  284, 1106, 1123, 1152, 1154, 1155, 1156,
- /*   230 */   397, 1158, 1172, 1173, 1116, 1176, 1177, 1138, 1179,  117,
- /*   240 */  1184, 1185, 1198, 1200, 1202, 1203,  741, 1094, 1153, 1146,
- /*   250 */  1160, 1162, 1163,  397, 1153, 1153, 1170, 1204, 1206, 1103,
- /*   260 */  1168, 1165, 1166, 1133, 1174, 1175, 1140, 1210, 1193, 1208,
- /*   270 */  1212, 1215, 1216, 1178, 1167, 1189, 1196, 1241, 1148, 1243,
- /*   280 */  1245, 1181, 1183, 1247, 1188, 1187, 1190, 1227, 1223, 1234,
- /*   290 */  1236, 1238, 1239, 1274, 1278, 1235, 1237, 1213, 1218, 1253,
- /*   300 */  1254, 1246, 1287, 1289, 1209, 1219, 1303, 1305, 1293, 1306,
- /*   310 */  1309, 1313, 1316, 1297, 1301, 1307, 1308, 1298, 1310, 1311,
- /*   320 */  1312, 1317, 1304, 1318, 1320, 1319, 1265, 1267, 1325, 1295,
- /*   330 */  1300, 1296, 1302, 1326, 1321, 1327, 1330, 1365, 1323, 1269,
- /*   340 */  1272, 1328, 1331, 1322, 1388, 1334, 1336, 1349, 1353, 1357,
- /*   350 */  1405, 1409, 1420, 1421, 1427, 1429, 1430, 1332, 1335, 1339,
- /*   360 */  1418, 1422, 1423, 1424, 1425, 1433, 1426, 1435, 1436, 1437,
- /*   370 */  1438, 1441, 1439,
+ /*     0 */  -168,  -17,  164,  214,  310, -166, -184,  -18,   98, -170,
+ /*    10 */   305,  315, -163, -193, -178, -257,  395,  401,  476,  478,
+ /*    20 */   512,  117,  527,  529,  503,  509,  532,  255,  552,  556,
+ /*    30 */   558,  607,   37,  408,  594,  413,  462,  559,  561,  601,
+ /*    40 */   610,  618, -254, -254, -254, -254, -254, -254, -254, -254,
+ /*    50 */  -254, -254, -254, -254, -254, -254, -254, -254, -254, -254,
+ /*    60 */  -254, -254, -254, -254, -254, -254, -254, -254, -254, -254,
+ /*    70 */  -254, -254, -254, -254, -254, -254, -254, -111,  627,  650,
+ /*    80 */   691,  697,  701,  703,  740,  742,  744,  767,  770,  790,
+ /*    90 */   816,  818,  820,  822,  845,  857,  859,  861,  863,  865,
+ /*   100 */   868,  870,  872,  874,  876,  888,  903,  906,  908,  915,
+ /*   110 */   917,  922,  960,  962,  964,  988,  990,  992, 1015, 1017,
+ /*   120 */  1029, 1033, 1035, 1040, -254, -254, -254, -254, -254, -254,
+ /*   130 */  -254, -254, -254,  190,  270, -196,  160, -160,  450,  647,
+ /*   140 */   260,  458,  260,  458,   78, -254, -254, -254, -254,  206,
+ /*   150 */   206,  206,  320,  598,   -5,  675,  743, -148,  340, -125,
+ /*   160 */   459,  466,  466,  693,  -93,  461,  479,  706,  710,  714,
+ /*   170 */   716,  717,  169, -183,  325,  314,  704,  333,  747,  858,
+ /*   180 */    -8,  819,  565,  755,  646,  660,  517,  265,  713,  791,
+ /*   190 */   712,  795,  803,  918,  695,  860,  893,  935,  939, -181,
+ /*   200 */  -172, -147,  -91,  -46,   -3,  162,  173,  231,  338,  437,
+ /*   210 */   571,  614,  630,  651,  760,  931,  989, 1032, 1046, -218,
+ /*   220 */    38, 1070, 1096, 1133, 1134, 1137, 1138, 1139, 1141, 1142,
+ /*   230 */  1143, 1144,  292,  451, 1050, 1145, 1147, 1148, 1149,  813,
+ /*   240 */  1161, 1162, 1163, 1108, 1049, 1166, 1168, 1146, 1169,  162,
+ /*   250 */  1181, 1182, 1183, 1184, 1185, 1187, 1100, 1103, 1150, 1135,
+ /*   260 */  1136, 1140, 1152,  813, 1150, 1150, 1153, 1173, 1195, 1090,
+ /*   270 */  1154, 1167, 1170, 1104, 1155, 1156, 1109, 1172, 1174, 1179,
+ /*   280 */  1177, 1188, 1205, 1171, 1160, 1196, 1121, 1165, 1203, 1228,
+ /*   290 */  1157, 1244, 1245, 1158, 1159, 1250, 1175, 1193, 1191, 1241,
+ /*   300 */  1231, 1243, 1257, 1259, 1261, 1276, 1280, 1254, 1255, 1230,
+ /*   310 */  1234, 1269, 1270, 1260, 1292, 1303, 1223, 1225, 1309, 1313,
+ /*   320 */  1296, 1317, 1319, 1320, 1323, 1300, 1307, 1308, 1310, 1304,
+ /*   330 */  1311, 1315, 1314, 1318, 1316, 1321, 1325, 1324, 1271, 1272,
+ /*   340 */  1332, 1294, 1298, 1299, 1301, 1302, 1306, 1312, 1329, 1356,
+ /*   350 */  1256, 1263, 1327, 1326, 1305, 1369, 1330, 1340, 1343, 1346,
+ /*   360 */  1350, 1391, 1394, 1410, 1412, 1415, 1417, 1419, 1328, 1331,
+ /*   370 */  1335, 1402, 1398, 1400, 1401, 1403, 1408, 1396, 1397, 1409,
+ /*   380 */  1414, 1420, 1421, 1413,
 };
 static const YYACTIONTYPE yy_default[] = {
- /*     0 */  1500, 1500, 1500, 1346, 1129, 1235, 1129, 1129, 1129, 1346,
- /*    10 */  1346, 1346, 1129, 1265, 1265, 1399, 1160, 1129, 1129, 1129,
- /*    20 */  1129, 1129, 1129, 1129, 1345, 1129, 1129, 1129, 1129, 1129,
- /*    30 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1271, 1129,
- /*    40 */  1129, 1129, 1129, 1129, 1347, 1348, 1129, 1129, 1129, 1398,
- /*    50 */  1400, 1363, 1281, 1280, 1279, 1278, 1381, 1252, 1276, 1269,
- /*    60 */  1273, 1341, 1342, 1340, 1344, 1348, 1347, 1129, 1272, 1312,
- /*    70 */  1326, 1311, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*    80 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*    90 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*   100 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*   110 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1320,
- /*   120 */  1325, 1331, 1324, 1321, 1314, 1313, 1315, 1316, 1129, 1150,
- /*   130 */  1199, 1129, 1129, 1129, 1129, 1417, 1416, 1129, 1129, 1160,
- /*   140 */  1317, 1318, 1328, 1327, 1406, 1456, 1455, 1364, 1129, 1129,
- /*   150 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*   160 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*   170 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*   180 */  1160, 1156, 1306, 1305, 1426, 1156, 1259, 1129, 1412, 1235,
- /*   190 */  1226, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*   200 */  1129, 1129, 1129, 1129, 1403, 1401, 1129, 1129, 1129, 1129,
- /*   210 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*   220 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*   230 */  1129, 1129, 1129, 1129, 1231, 1129, 1129, 1129, 1129, 1129,
- /*   240 */  1129, 1129, 1129, 1129, 1129, 1450, 1129, 1376, 1213, 1231,
- /*   250 */  1231, 1231, 1231, 1233, 1214, 1212, 1225, 1160, 1136, 1492,
- /*   260 */  1275, 1254, 1254, 1489, 1275, 1275, 1489, 1174, 1470, 1171,
- /*   270 */  1265, 1265, 1265, 1254, 1343, 1232, 1225, 1129, 1492, 1240,
- /*   280 */  1240, 1491, 1491, 1240, 1364, 1284, 1290, 1202, 1275, 1208,
- /*   290 */  1208, 1208, 1208, 1240, 1147, 1275, 1275, 1284, 1290, 1202,
- /*   300 */  1202, 1275, 1240, 1147, 1380, 1486, 1240, 1147, 1354, 1240,
- /*   310 */  1147, 1240, 1147, 1354, 1200, 1200, 1200, 1189, 1354, 1200,
- /*   320 */  1174, 1200, 1189, 1200, 1200, 1354, 1358, 1358, 1354, 1258,
- /*   330 */  1253, 1258, 1253, 1258, 1253, 1258, 1253, 1240, 1259, 1425,
- /*   340 */  1129, 1270, 1259, 1349, 1240, 1129, 1270, 1268, 1266, 1275,
- /*   350 */  1153, 1192, 1453, 1453, 1449, 1449, 1449, 1497, 1497, 1412,
- /*   360 */  1465, 1160, 1160, 1160, 1160, 1465, 1176, 1176, 1160, 1160,
- /*   370 */  1160, 1160, 1465, 1129, 1129, 1129, 1129, 1129, 1129, 1460,
- /*   380 */  1129, 1365, 1244, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*   390 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*   400 */  1129, 1129, 1129, 1129, 1129, 1295, 1129, 1132, 1409, 1129,
- /*   410 */  1129, 1407, 1129, 1129, 1129, 1129, 1129, 1129, 1245, 1129,
- /*   420 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*   430 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1488, 1129, 1129,
- /*   440 */  1129, 1129, 1129, 1129, 1379, 1378, 1129, 1129, 1242, 1129,
- /*   450 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*   460 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*   470 */  1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*   480 */  1129, 1129, 1129, 1129, 1129, 1129, 1267, 1129, 1424, 1129,
- /*   490 */  1129, 1129, 1129, 1129, 1129, 1129, 1438, 1260, 1129, 1129,
- /*   500 */  1479, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129, 1129,
- /*   510 */  1129, 1129, 1129, 1129, 1129, 1474, 1216, 1297, 1129, 1296,
- /*   520 */  1300, 1129, 1141, 1129,
+ /*     0 */  1536, 1536, 1536, 1376, 1159, 1265, 1159, 1159, 1159, 1376,
+ /*    10 */  1376, 1376, 1159, 1295, 1295, 1429, 1190, 1159, 1159, 1159,
+ /*    20 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1375, 1159, 1159,
+ /*    30 */  1159, 1159, 1459, 1459, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*    40 */  1159, 1159, 1159, 1301, 1159, 1159, 1159, 1159, 1159, 1377,
+ /*    50 */  1378, 1159, 1159, 1159, 1428, 1430, 1393, 1311, 1310, 1309,
+ /*    60 */  1308, 1411, 1282, 1306, 1299, 1303, 1371, 1372, 1370, 1374,
+ /*    70 */  1378, 1377, 1159, 1302, 1342, 1356, 1341, 1159, 1159, 1159,
+ /*    80 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*    90 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   100 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   110 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   120 */  1159, 1159, 1159, 1159, 1350, 1355, 1361, 1354, 1351, 1344,
+ /*   130 */  1343, 1345, 1346, 1159, 1180, 1229, 1159, 1159, 1159, 1159,
+ /*   140 */  1447, 1446, 1159, 1159, 1190, 1347, 1348, 1358, 1357, 1436,
+ /*   150 */  1492, 1491, 1394, 1159, 1159, 1159, 1159, 1159, 1159, 1459,
+ /*   160 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   170 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   180 */  1159, 1159, 1159, 1159, 1459, 1459, 1159, 1190, 1459, 1459,
+ /*   190 */  1186, 1336, 1335, 1186, 1289, 1159, 1442, 1265, 1256, 1159,
+ /*   200 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   210 */  1159, 1159, 1159, 1433, 1431, 1159, 1159, 1159, 1159, 1159,
+ /*   220 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   230 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   240 */  1159, 1159, 1159, 1261, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   250 */  1159, 1159, 1159, 1159, 1159, 1486, 1159, 1406, 1243, 1261,
+ /*   260 */  1261, 1261, 1261, 1263, 1244, 1242, 1255, 1190, 1166, 1528,
+ /*   270 */  1305, 1284, 1284, 1525, 1305, 1305, 1525, 1204, 1506, 1201,
+ /*   280 */  1295, 1295, 1295, 1284, 1289, 1289, 1373, 1262, 1255, 1159,
+ /*   290 */  1528, 1270, 1270, 1527, 1527, 1270, 1394, 1314, 1320, 1232,
+ /*   300 */  1305, 1238, 1238, 1238, 1238, 1270, 1177, 1305, 1305, 1314,
+ /*   310 */  1320, 1232, 1232, 1305, 1270, 1177, 1410, 1522, 1270, 1177,
+ /*   320 */  1384, 1270, 1177, 1270, 1177, 1384, 1230, 1230, 1230, 1219,
+ /*   330 */  1384, 1230, 1204, 1230, 1219, 1230, 1230, 1384, 1388, 1388,
+ /*   340 */  1384, 1288, 1283, 1288, 1283, 1288, 1283, 1288, 1283, 1270,
+ /*   350 */  1469, 1469, 1300, 1289, 1379, 1270, 1159, 1300, 1298, 1296,
+ /*   360 */  1305, 1183, 1222, 1489, 1489, 1485, 1485, 1485, 1533, 1533,
+ /*   370 */  1442, 1501, 1190, 1190, 1190, 1190, 1501, 1206, 1206, 1190,
+ /*   380 */  1190, 1190, 1190, 1501, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   390 */  1496, 1159, 1395, 1274, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   400 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   410 */  1159, 1159, 1159, 1159, 1159, 1159, 1325, 1159, 1162, 1439,
+ /*   420 */  1159, 1159, 1437, 1159, 1159, 1159, 1159, 1159, 1159, 1275,
+ /*   430 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   440 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1524, 1159,
+ /*   450 */  1159, 1159, 1159, 1159, 1159, 1409, 1408, 1159, 1159, 1272,
+ /*   460 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   470 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   480 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   490 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1297, 1159,
+ /*   500 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   510 */  1159, 1159, 1159, 1474, 1290, 1159, 1159, 1515, 1159, 1159,
+ /*   520 */  1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159, 1159,
+ /*   530 */  1159, 1159, 1510, 1246, 1327, 1159, 1326, 1330, 1159, 1171,
+ /*   540 */  1159,
 };
 /********** End of lemon-generated parsing tables *****************************/
 
 /* The next table maps tokens (terminal symbols) into fallback tokens.  
 ** If a construct like the following:
 ** 
 **      %fallback ID X Y Z.
 **
@@ -148329,16 +149178,20 @@ static const YYCODETYPE yyFallback[] = {
    59,  /*    VIRTUAL => ID */
    59,  /*       WITH => ID */
    59,  /*    CURRENT => ID */
    59,  /*  FOLLOWING => ID */
    59,  /*  PARTITION => ID */
    59,  /*  PRECEDING => ID */
    59,  /*      RANGE => ID */
    59,  /*  UNBOUNDED => ID */
+   59,  /*    EXCLUDE => ID */
+   59,  /*     GROUPS => ID */
+   59,  /*     OTHERS => ID */
+   59,  /*       TIES => ID */
    59,  /*    REINDEX => ID */
    59,  /*     RENAME => ID */
    59,  /*   CTIME_KW => ID */
 };
 #endif /* YYFALLBACK */
 
 /* The following structure represents a single element of the
 ** parser's stack.  Information stored includes:
@@ -148507,206 +149360,229 @@ static const char *const yyTokenName[] =
   /*   80 */ "VIRTUAL",
   /*   81 */ "WITH",
   /*   82 */ "CURRENT",
   /*   83 */ "FOLLOWING",
   /*   84 */ "PARTITION",
   /*   85 */ "PRECEDING",
   /*   86 */ "RANGE",
   /*   87 */ "UNBOUNDED",
-  /*   88 */ "REINDEX",
-  /*   89 */ "RENAME",
-  /*   90 */ "CTIME_KW",
-  /*   91 */ "ANY",
-  /*   92 */ "BITAND",
-  /*   93 */ "BITOR",
-  /*   94 */ "LSHIFT",
-  /*   95 */ "RSHIFT",
-  /*   96 */ "PLUS",
-  /*   97 */ "MINUS",
-  /*   98 */ "STAR",
-  /*   99 */ "SLASH",
-  /*  100 */ "REM",
-  /*  101 */ "CONCAT",
-  /*  102 */ "COLLATE",
-  /*  103 */ "BITNOT",
-  /*  104 */ "ON",
-  /*  105 */ "INDEXED",
-  /*  106 */ "STRING",
-  /*  107 */ "JOIN_KW",
-  /*  108 */ "CONSTRAINT",
-  /*  109 */ "DEFAULT",
-  /*  110 */ "NULL",
-  /*  111 */ "PRIMARY",
-  /*  112 */ "UNIQUE",
-  /*  113 */ "CHECK",
-  /*  114 */ "REFERENCES",
-  /*  115 */ "AUTOINCR",
-  /*  116 */ "INSERT",
-  /*  117 */ "DELETE",
-  /*  118 */ "UPDATE",
-  /*  119 */ "SET",
-  /*  120 */ "DEFERRABLE",
-  /*  121 */ "FOREIGN",
-  /*  122 */ "DROP",
-  /*  123 */ "UNION",
-  /*  124 */ "ALL",
-  /*  125 */ "EXCEPT",
-  /*  126 */ "INTERSECT",
-  /*  127 */ "SELECT",
-  /*  128 */ "VALUES",
-  /*  129 */ "DISTINCT",
-  /*  130 */ "DOT",
-  /*  131 */ "FROM",
-  /*  132 */ "JOIN",
-  /*  133 */ "USING",
-  /*  134 */ "ORDER",
-  /*  135 */ "GROUP",
-  /*  136 */ "HAVING",
-  /*  137 */ "LIMIT",
-  /*  138 */ "WHERE",
-  /*  139 */ "INTO",
-  /*  140 */ "NOTHING",
-  /*  141 */ "FLOAT",
-  /*  142 */ "BLOB",
-  /*  143 */ "INTEGER",
-  /*  144 */ "VARIABLE",
-  /*  145 */ "CASE",
-  /*  146 */ "WHEN",
-  /*  147 */ "THEN",
-  /*  148 */ "ELSE",
-  /*  149 */ "INDEX",
-  /*  150 */ "ALTER",
-  /*  151 */ "ADD",
-  /*  152 */ "WINDOW",
-  /*  153 */ "OVER",
-  /*  154 */ "FILTER",
-  /*  155 */ "input",
-  /*  156 */ "cmdlist",
-  /*  157 */ "ecmd",
-  /*  158 */ "cmdx",
-  /*  159 */ "explain",
-  /*  160 */ "cmd",
-  /*  161 */ "transtype",
-  /*  162 */ "trans_opt",
-  /*  163 */ "nm",
-  /*  164 */ "savepoint_opt",
-  /*  165 */ "create_table",
-  /*  166 */ "create_table_args",
-  /*  167 */ "createkw",
-  /*  168 */ "temp",
-  /*  169 */ "ifnotexists",
-  /*  170 */ "dbnm",
-  /*  171 */ "columnlist",
-  /*  172 */ "conslist_opt",
-  /*  173 */ "table_options",
-  /*  174 */ "select",
-  /*  175 */ "columnname",
-  /*  176 */ "carglist",
-  /*  177 */ "typetoken",
-  /*  178 */ "typename",
-  /*  179 */ "signed",
-  /*  180 */ "plus_num",
-  /*  181 */ "minus_num",
-  /*  182 */ "scanpt",
-  /*  183 */ "ccons",
-  /*  184 */ "term",
-  /*  185 */ "expr",
-  /*  186 */ "onconf",
-  /*  187 */ "sortorder",
-  /*  188 */ "autoinc",
-  /*  189 */ "eidlist_opt",
-  /*  190 */ "refargs",
-  /*  191 */ "defer_subclause",
-  /*  192 */ "refarg",
-  /*  193 */ "refact",
-  /*  194 */ "init_deferred_pred_opt",
-  /*  195 */ "conslist",
-  /*  196 */ "tconscomma",
-  /*  197 */ "tcons",
-  /*  198 */ "sortlist",
-  /*  199 */ "eidlist",
-  /*  200 */ "defer_subclause_opt",
-  /*  201 */ "orconf",
-  /*  202 */ "resolvetype",
-  /*  203 */ "raisetype",
-  /*  204 */ "ifexists",
-  /*  205 */ "fullname",
-  /*  206 */ "selectnowith",
-  /*  207 */ "oneselect",
-  /*  208 */ "wqlist",
-  /*  209 */ "multiselect_op",
-  /*  210 */ "distinct",
-  /*  211 */ "selcollist",
-  /*  212 */ "from",
-  /*  213 */ "where_opt",
-  /*  214 */ "groupby_opt",
-  /*  215 */ "having_opt",
-  /*  216 */ "orderby_opt",
-  /*  217 */ "limit_opt",
-  /*  218 */ "window_clause",
-  /*  219 */ "values",
-  /*  220 */ "nexprlist",
-  /*  221 */ "sclp",
-  /*  222 */ "as",
-  /*  223 */ "seltablist",
-  /*  224 */ "stl_prefix",
-  /*  225 */ "joinop",
-  /*  226 */ "indexed_opt",
-  /*  227 */ "on_opt",
-  /*  228 */ "using_opt",
-  /*  229 */ "exprlist",
-  /*  230 */ "xfullname",
-  /*  231 */ "idlist",
-  /*  232 */ "with",
-  /*  233 */ "setlist",
-  /*  234 */ "insert_cmd",
-  /*  235 */ "idlist_opt",
-  /*  236 */ "upsert",
-  /*  237 */ "over_clause",
-  /*  238 */ "likeop",
-  /*  239 */ "between_op",
-  /*  240 */ "in_op",
-  /*  241 */ "paren_exprlist",
-  /*  242 */ "case_operand",
-  /*  243 */ "case_exprlist",
-  /*  244 */ "case_else",
-  /*  245 */ "uniqueflag",
-  /*  246 */ "collate",
-  /*  247 */ "vinto",
-  /*  248 */ "nmnum",
-  /*  249 */ "trigger_decl",
-  /*  250 */ "trigger_cmd_list",
-  /*  251 */ "trigger_time",
-  /*  252 */ "trigger_event",
-  /*  253 */ "foreach_clause",
-  /*  254 */ "when_clause",
-  /*  255 */ "trigger_cmd",
-  /*  256 */ "trnm",
-  /*  257 */ "tridxby",
-  /*  258 */ "database_kw_opt",
-  /*  259 */ "key_opt",
-  /*  260 */ "add_column_fullname",
-  /*  261 */ "kwcolumn_opt",
-  /*  262 */ "create_vtab",
-  /*  263 */ "vtabarglist",
-  /*  264 */ "vtabarg",
-  /*  265 */ "vtabargtoken",
-  /*  266 */ "lp",
-  /*  267 */ "anylist",
-  /*  268 */ "windowdefn_list",
-  /*  269 */ "windowdefn",
-  /*  270 */ "window",
-  /*  271 */ "frame_opt",
-  /*  272 */ "part_opt",
-  /*  273 */ "filter_opt",
-  /*  274 */ "range_or_rows",
-  /*  275 */ "frame_bound",
-  /*  276 */ "frame_bound_s",
-  /*  277 */ "frame_bound_e",
+  /*   88 */ "EXCLUDE",
+  /*   89 */ "GROUPS",
+  /*   90 */ "OTHERS",
+  /*   91 */ "TIES",
+  /*   92 */ "REINDEX",
+  /*   93 */ "RENAME",
+  /*   94 */ "CTIME_KW",
+  /*   95 */ "ANY",
+  /*   96 */ "BITAND",
+  /*   97 */ "BITOR",
+  /*   98 */ "LSHIFT",
+  /*   99 */ "RSHIFT",
+  /*  100 */ "PLUS",
+  /*  101 */ "MINUS",
+  /*  102 */ "STAR",
+  /*  103 */ "SLASH",
+  /*  104 */ "REM",
+  /*  105 */ "CONCAT",
+  /*  106 */ "COLLATE",
+  /*  107 */ "BITNOT",
+  /*  108 */ "ON",
+  /*  109 */ "INDEXED",
+  /*  110 */ "STRING",
+  /*  111 */ "JOIN_KW",
+  /*  112 */ "CONSTRAINT",
+  /*  113 */ "DEFAULT",
+  /*  114 */ "NULL",
+  /*  115 */ "PRIMARY",
+  /*  116 */ "UNIQUE",
+  /*  117 */ "CHECK",
+  /*  118 */ "REFERENCES",
+  /*  119 */ "AUTOINCR",
+  /*  120 */ "INSERT",
+  /*  121 */ "DELETE",
+  /*  122 */ "UPDATE",
+  /*  123 */ "SET",
+  /*  124 */ "DEFERRABLE",
+  /*  125 */ "FOREIGN",
+  /*  126 */ "DROP",
+  /*  127 */ "UNION",
+  /*  128 */ "ALL",
+  /*  129 */ "EXCEPT",
+  /*  130 */ "INTERSECT",
+  /*  131 */ "SELECT",
+  /*  132 */ "VALUES",
+  /*  133 */ "DISTINCT",
+  /*  134 */ "DOT",
+  /*  135 */ "FROM",
+  /*  136 */ "JOIN",
+  /*  137 */ "USING",
+  /*  138 */ "ORDER",
+  /*  139 */ "GROUP",
+  /*  140 */ "HAVING",
+  /*  141 */ "LIMIT",
+  /*  142 */ "WHERE",
+  /*  143 */ "INTO",
+  /*  144 */ "NOTHING",
+  /*  145 */ "FLOAT",
+  /*  146 */ "BLOB",
+  /*  147 */ "INTEGER",
+  /*  148 */ "VARIABLE",
+  /*  149 */ "CASE",
+  /*  150 */ "WHEN",
+  /*  151 */ "THEN",
+  /*  152 */ "ELSE",
+  /*  153 */ "INDEX",
+  /*  154 */ "ALTER",
+  /*  155 */ "ADD",
+  /*  156 */ "WINDOW",
+  /*  157 */ "OVER",
+  /*  158 */ "FILTER",
+  /*  159 */ "TRUEFALSE",
+  /*  160 */ "ISNOT",
+  /*  161 */ "FUNCTION",
+  /*  162 */ "COLUMN",
+  /*  163 */ "AGG_FUNCTION",
+  /*  164 */ "AGG_COLUMN",
+  /*  165 */ "UMINUS",
+  /*  166 */ "UPLUS",
+  /*  167 */ "TRUTH",
+  /*  168 */ "REGISTER",
+  /*  169 */ "VECTOR",
+  /*  170 */ "SELECT_COLUMN",
+  /*  171 */ "IF_NULL_ROW",
+  /*  172 */ "ASTERISK",
+  /*  173 */ "SPAN",
+  /*  174 */ "SPACE",
+  /*  175 */ "ILLEGAL",
+  /*  176 */ "input",
+  /*  177 */ "cmdlist",
+  /*  178 */ "ecmd",
+  /*  179 */ "cmdx",
+  /*  180 */ "explain",
+  /*  181 */ "cmd",
+  /*  182 */ "transtype",
+  /*  183 */ "trans_opt",
+  /*  184 */ "nm",
+  /*  185 */ "savepoint_opt",
+  /*  186 */ "create_table",
+  /*  187 */ "create_table_args",
+  /*  188 */ "createkw",
+  /*  189 */ "temp",
+  /*  190 */ "ifnotexists",
+  /*  191 */ "dbnm",
+  /*  192 */ "columnlist",
+  /*  193 */ "conslist_opt",
+  /*  194 */ "table_options",
+  /*  195 */ "select",
+  /*  196 */ "columnname",
+  /*  197 */ "carglist",
+  /*  198 */ "typetoken",
+  /*  199 */ "typename",
+  /*  200 */ "signed",
+  /*  201 */ "plus_num",
+  /*  202 */ "minus_num",
+  /*  203 */ "scanpt",
+  /*  204 */ "ccons",
+  /*  205 */ "term",
+  /*  206 */ "expr",
+  /*  207 */ "onconf",
+  /*  208 */ "sortorder",
+  /*  209 */ "autoinc",
+  /*  210 */ "eidlist_opt",
+  /*  211 */ "refargs",
+  /*  212 */ "defer_subclause",
+  /*  213 */ "refarg",
+  /*  214 */ "refact",
+  /*  215 */ "init_deferred_pred_opt",
+  /*  216 */ "conslist",
+  /*  217 */ "tconscomma",
+  /*  218 */ "tcons",
+  /*  219 */ "sortlist",
+  /*  220 */ "eidlist",
+  /*  221 */ "defer_subclause_opt",
+  /*  222 */ "orconf",
+  /*  223 */ "resolvetype",
+  /*  224 */ "raisetype",
+  /*  225 */ "ifexists",
+  /*  226 */ "fullname",
+  /*  227 */ "selectnowith",
+  /*  228 */ "oneselect",
+  /*  229 */ "wqlist",
+  /*  230 */ "multiselect_op",
+  /*  231 */ "distinct",
+  /*  232 */ "selcollist",
+  /*  233 */ "from",
+  /*  234 */ "where_opt",
+  /*  235 */ "groupby_opt",
+  /*  236 */ "having_opt",
+  /*  237 */ "orderby_opt",
+  /*  238 */ "limit_opt",
+  /*  239 */ "window_clause",
+  /*  240 */ "values",
+  /*  241 */ "nexprlist",
+  /*  242 */ "sclp",
+  /*  243 */ "as",
+  /*  244 */ "seltablist",
+  /*  245 */ "stl_prefix",
+  /*  246 */ "joinop",
+  /*  247 */ "indexed_opt",
+  /*  248 */ "on_opt",
+  /*  249 */ "using_opt",
+  /*  250 */ "exprlist",
+  /*  251 */ "xfullname",
+  /*  252 */ "idlist",
+  /*  253 */ "with",
+  /*  254 */ "setlist",
+  /*  255 */ "insert_cmd",
+  /*  256 */ "idlist_opt",
+  /*  257 */ "upsert",
+  /*  258 */ "over_clause",
+  /*  259 */ "likeop",
+  /*  260 */ "between_op",
+  /*  261 */ "in_op",