Annotation of embedaddon/sqlite3/src/btree.c, revision 1.1

1.1     ! misho       1: /*
        !             2: ** 2004 April 6
        !             3: **
        !             4: ** The author disclaims copyright to this source code.  In place of
        !             5: ** a legal notice, here is a blessing:
        !             6: **
        !             7: **    May you do good and not evil.
        !             8: **    May you find forgiveness for yourself and forgive others.
        !             9: **    May you share freely, never taking more than you give.
        !            10: **
        !            11: *************************************************************************
        !            12: ** This file implements a external (disk-based) database using BTrees.
        !            13: ** See the header comment on "btreeInt.h" for additional information.
        !            14: ** Including a description of file format and an overview of operation.
        !            15: */
        !            16: #include "btreeInt.h"
        !            17: 
        !            18: /*
        !            19: ** The header string that appears at the beginning of every
        !            20: ** SQLite database.
        !            21: */
        !            22: static const char zMagicHeader[] = SQLITE_FILE_HEADER;
        !            23: 
        !            24: /*
        !            25: ** Set this global variable to 1 to enable tracing using the TRACE
        !            26: ** macro.
        !            27: */
        !            28: #if 0
        !            29: int sqlite3BtreeTrace=1;  /* True to enable tracing */
        !            30: # define TRACE(X)  if(sqlite3BtreeTrace){printf X;fflush(stdout);}
        !            31: #else
        !            32: # define TRACE(X)
        !            33: #endif
        !            34: 
        !            35: /*
        !            36: ** Extract a 2-byte big-endian integer from an array of unsigned bytes.
        !            37: ** But if the value is zero, make it 65536.
        !            38: **
        !            39: ** This routine is used to extract the "offset to cell content area" value
        !            40: ** from the header of a btree page.  If the page size is 65536 and the page
        !            41: ** is empty, the offset should be 65536, but the 2-byte value stores zero.
        !            42: ** This routine makes the necessary adjustment to 65536.
        !            43: */
        !            44: #define get2byteNotZero(X)  (((((int)get2byte(X))-1)&0xffff)+1)
        !            45: 
        !            46: #ifndef SQLITE_OMIT_SHARED_CACHE
        !            47: /*
        !            48: ** A list of BtShared objects that are eligible for participation
        !            49: ** in shared cache.  This variable has file scope during normal builds,
        !            50: ** but the test harness needs to access it so we make it global for 
        !            51: ** test builds.
        !            52: **
        !            53: ** Access to this variable is protected by SQLITE_MUTEX_STATIC_MASTER.
        !            54: */
        !            55: #ifdef SQLITE_TEST
        !            56: BtShared *SQLITE_WSD sqlite3SharedCacheList = 0;
        !            57: #else
        !            58: static BtShared *SQLITE_WSD sqlite3SharedCacheList = 0;
        !            59: #endif
        !            60: #endif /* SQLITE_OMIT_SHARED_CACHE */
        !            61: 
        !            62: #ifndef SQLITE_OMIT_SHARED_CACHE
        !            63: /*
        !            64: ** Enable or disable the shared pager and schema features.
        !            65: **
        !            66: ** This routine has no effect on existing database connections.
        !            67: ** The shared cache setting effects only future calls to
        !            68: ** sqlite3_open(), sqlite3_open16(), or sqlite3_open_v2().
        !            69: */
        !            70: int sqlite3_enable_shared_cache(int enable){
        !            71:   sqlite3GlobalConfig.sharedCacheEnabled = enable;
        !            72:   return SQLITE_OK;
        !            73: }
        !            74: #endif
        !            75: 
        !            76: 
        !            77: 
        !            78: #ifdef SQLITE_OMIT_SHARED_CACHE
        !            79:   /*
        !            80:   ** The functions querySharedCacheTableLock(), setSharedCacheTableLock(),
        !            81:   ** and clearAllSharedCacheTableLocks()
        !            82:   ** manipulate entries in the BtShared.pLock linked list used to store
        !            83:   ** shared-cache table level locks. If the library is compiled with the
        !            84:   ** shared-cache feature disabled, then there is only ever one user
        !            85:   ** of each BtShared structure and so this locking is not necessary. 
        !            86:   ** So define the lock related functions as no-ops.
        !            87:   */
        !            88:   #define querySharedCacheTableLock(a,b,c) SQLITE_OK
        !            89:   #define setSharedCacheTableLock(a,b,c) SQLITE_OK
        !            90:   #define clearAllSharedCacheTableLocks(a)
        !            91:   #define downgradeAllSharedCacheTableLocks(a)
        !            92:   #define hasSharedCacheTableLock(a,b,c,d) 1
        !            93:   #define hasReadConflicts(a, b) 0
        !            94: #endif
        !            95: 
        !            96: #ifndef SQLITE_OMIT_SHARED_CACHE
        !            97: 
        !            98: #ifdef SQLITE_DEBUG
        !            99: /*
        !           100: **** This function is only used as part of an assert() statement. ***
        !           101: **
        !           102: ** Check to see if pBtree holds the required locks to read or write to the 
        !           103: ** table with root page iRoot.   Return 1 if it does and 0 if not.
        !           104: **
        !           105: ** For example, when writing to a table with root-page iRoot via 
        !           106: ** Btree connection pBtree:
        !           107: **
        !           108: **    assert( hasSharedCacheTableLock(pBtree, iRoot, 0, WRITE_LOCK) );
        !           109: **
        !           110: ** When writing to an index that resides in a sharable database, the 
        !           111: ** caller should have first obtained a lock specifying the root page of
        !           112: ** the corresponding table. This makes things a bit more complicated,
        !           113: ** as this module treats each table as a separate structure. To determine
        !           114: ** the table corresponding to the index being written, this
        !           115: ** function has to search through the database schema.
        !           116: **
        !           117: ** Instead of a lock on the table/index rooted at page iRoot, the caller may
        !           118: ** hold a write-lock on the schema table (root page 1). This is also
        !           119: ** acceptable.
        !           120: */
        !           121: static int hasSharedCacheTableLock(
        !           122:   Btree *pBtree,         /* Handle that must hold lock */
        !           123:   Pgno iRoot,            /* Root page of b-tree */
        !           124:   int isIndex,           /* True if iRoot is the root of an index b-tree */
        !           125:   int eLockType          /* Required lock type (READ_LOCK or WRITE_LOCK) */
        !           126: ){
        !           127:   Schema *pSchema = (Schema *)pBtree->pBt->pSchema;
        !           128:   Pgno iTab = 0;
        !           129:   BtLock *pLock;
        !           130: 
        !           131:   /* If this database is not shareable, or if the client is reading
        !           132:   ** and has the read-uncommitted flag set, then no lock is required. 
        !           133:   ** Return true immediately.
        !           134:   */
        !           135:   if( (pBtree->sharable==0)
        !           136:    || (eLockType==READ_LOCK && (pBtree->db->flags & SQLITE_ReadUncommitted))
        !           137:   ){
        !           138:     return 1;
        !           139:   }
        !           140: 
        !           141:   /* If the client is reading  or writing an index and the schema is
        !           142:   ** not loaded, then it is too difficult to actually check to see if
        !           143:   ** the correct locks are held.  So do not bother - just return true.
        !           144:   ** This case does not come up very often anyhow.
        !           145:   */
        !           146:   if( isIndex && (!pSchema || (pSchema->flags&DB_SchemaLoaded)==0) ){
        !           147:     return 1;
        !           148:   }
        !           149: 
        !           150:   /* Figure out the root-page that the lock should be held on. For table
        !           151:   ** b-trees, this is just the root page of the b-tree being read or
        !           152:   ** written. For index b-trees, it is the root page of the associated
        !           153:   ** table.  */
        !           154:   if( isIndex ){
        !           155:     HashElem *p;
        !           156:     for(p=sqliteHashFirst(&pSchema->idxHash); p; p=sqliteHashNext(p)){
        !           157:       Index *pIdx = (Index *)sqliteHashData(p);
        !           158:       if( pIdx->tnum==(int)iRoot ){
        !           159:         iTab = pIdx->pTable->tnum;
        !           160:       }
        !           161:     }
        !           162:   }else{
        !           163:     iTab = iRoot;
        !           164:   }
        !           165: 
        !           166:   /* Search for the required lock. Either a write-lock on root-page iTab, a 
        !           167:   ** write-lock on the schema table, or (if the client is reading) a
        !           168:   ** read-lock on iTab will suffice. Return 1 if any of these are found.  */
        !           169:   for(pLock=pBtree->pBt->pLock; pLock; pLock=pLock->pNext){
        !           170:     if( pLock->pBtree==pBtree 
        !           171:      && (pLock->iTable==iTab || (pLock->eLock==WRITE_LOCK && pLock->iTable==1))
        !           172:      && pLock->eLock>=eLockType 
        !           173:     ){
        !           174:       return 1;
        !           175:     }
        !           176:   }
        !           177: 
        !           178:   /* Failed to find the required lock. */
        !           179:   return 0;
        !           180: }
        !           181: #endif /* SQLITE_DEBUG */
        !           182: 
        !           183: #ifdef SQLITE_DEBUG
        !           184: /*
        !           185: **** This function may be used as part of assert() statements only. ****
        !           186: **
        !           187: ** Return true if it would be illegal for pBtree to write into the
        !           188: ** table or index rooted at iRoot because other shared connections are
        !           189: ** simultaneously reading that same table or index.
        !           190: **
        !           191: ** It is illegal for pBtree to write if some other Btree object that
        !           192: ** shares the same BtShared object is currently reading or writing
        !           193: ** the iRoot table.  Except, if the other Btree object has the
        !           194: ** read-uncommitted flag set, then it is OK for the other object to
        !           195: ** have a read cursor.
        !           196: **
        !           197: ** For example, before writing to any part of the table or index
        !           198: ** rooted at page iRoot, one should call:
        !           199: **
        !           200: **    assert( !hasReadConflicts(pBtree, iRoot) );
        !           201: */
        !           202: static int hasReadConflicts(Btree *pBtree, Pgno iRoot){
        !           203:   BtCursor *p;
        !           204:   for(p=pBtree->pBt->pCursor; p; p=p->pNext){
        !           205:     if( p->pgnoRoot==iRoot 
        !           206:      && p->pBtree!=pBtree
        !           207:      && 0==(p->pBtree->db->flags & SQLITE_ReadUncommitted)
        !           208:     ){
        !           209:       return 1;
        !           210:     }
        !           211:   }
        !           212:   return 0;
        !           213: }
        !           214: #endif    /* #ifdef SQLITE_DEBUG */
        !           215: 
        !           216: /*
        !           217: ** Query to see if Btree handle p may obtain a lock of type eLock 
        !           218: ** (READ_LOCK or WRITE_LOCK) on the table with root-page iTab. Return
        !           219: ** SQLITE_OK if the lock may be obtained (by calling
        !           220: ** setSharedCacheTableLock()), or SQLITE_LOCKED if not.
        !           221: */
        !           222: static int querySharedCacheTableLock(Btree *p, Pgno iTab, u8 eLock){
        !           223:   BtShared *pBt = p->pBt;
        !           224:   BtLock *pIter;
        !           225: 
        !           226:   assert( sqlite3BtreeHoldsMutex(p) );
        !           227:   assert( eLock==READ_LOCK || eLock==WRITE_LOCK );
        !           228:   assert( p->db!=0 );
        !           229:   assert( !(p->db->flags&SQLITE_ReadUncommitted)||eLock==WRITE_LOCK||iTab==1 );
        !           230:   
        !           231:   /* If requesting a write-lock, then the Btree must have an open write
        !           232:   ** transaction on this file. And, obviously, for this to be so there 
        !           233:   ** must be an open write transaction on the file itself.
        !           234:   */
        !           235:   assert( eLock==READ_LOCK || (p==pBt->pWriter && p->inTrans==TRANS_WRITE) );
        !           236:   assert( eLock==READ_LOCK || pBt->inTransaction==TRANS_WRITE );
        !           237:   
        !           238:   /* This routine is a no-op if the shared-cache is not enabled */
        !           239:   if( !p->sharable ){
        !           240:     return SQLITE_OK;
        !           241:   }
        !           242: 
        !           243:   /* If some other connection is holding an exclusive lock, the
        !           244:   ** requested lock may not be obtained.
        !           245:   */
        !           246:   if( pBt->pWriter!=p && (pBt->btsFlags & BTS_EXCLUSIVE)!=0 ){
        !           247:     sqlite3ConnectionBlocked(p->db, pBt->pWriter->db);
        !           248:     return SQLITE_LOCKED_SHAREDCACHE;
        !           249:   }
        !           250: 
        !           251:   for(pIter=pBt->pLock; pIter; pIter=pIter->pNext){
        !           252:     /* The condition (pIter->eLock!=eLock) in the following if(...) 
        !           253:     ** statement is a simplification of:
        !           254:     **
        !           255:     **   (eLock==WRITE_LOCK || pIter->eLock==WRITE_LOCK)
        !           256:     **
        !           257:     ** since we know that if eLock==WRITE_LOCK, then no other connection
        !           258:     ** may hold a WRITE_LOCK on any table in this file (since there can
        !           259:     ** only be a single writer).
        !           260:     */
        !           261:     assert( pIter->eLock==READ_LOCK || pIter->eLock==WRITE_LOCK );
        !           262:     assert( eLock==READ_LOCK || pIter->pBtree==p || pIter->eLock==READ_LOCK);
        !           263:     if( pIter->pBtree!=p && pIter->iTable==iTab && pIter->eLock!=eLock ){
        !           264:       sqlite3ConnectionBlocked(p->db, pIter->pBtree->db);
        !           265:       if( eLock==WRITE_LOCK ){
        !           266:         assert( p==pBt->pWriter );
        !           267:         pBt->btsFlags |= BTS_PENDING;
        !           268:       }
        !           269:       return SQLITE_LOCKED_SHAREDCACHE;
        !           270:     }
        !           271:   }
        !           272:   return SQLITE_OK;
        !           273: }
        !           274: #endif /* !SQLITE_OMIT_SHARED_CACHE */
        !           275: 
        !           276: #ifndef SQLITE_OMIT_SHARED_CACHE
        !           277: /*
        !           278: ** Add a lock on the table with root-page iTable to the shared-btree used
        !           279: ** by Btree handle p. Parameter eLock must be either READ_LOCK or 
        !           280: ** WRITE_LOCK.
        !           281: **
        !           282: ** This function assumes the following:
        !           283: **
        !           284: **   (a) The specified Btree object p is connected to a sharable
        !           285: **       database (one with the BtShared.sharable flag set), and
        !           286: **
        !           287: **   (b) No other Btree objects hold a lock that conflicts
        !           288: **       with the requested lock (i.e. querySharedCacheTableLock() has
        !           289: **       already been called and returned SQLITE_OK).
        !           290: **
        !           291: ** SQLITE_OK is returned if the lock is added successfully. SQLITE_NOMEM 
        !           292: ** is returned if a malloc attempt fails.
        !           293: */
        !           294: static int setSharedCacheTableLock(Btree *p, Pgno iTable, u8 eLock){
        !           295:   BtShared *pBt = p->pBt;
        !           296:   BtLock *pLock = 0;
        !           297:   BtLock *pIter;
        !           298: 
        !           299:   assert( sqlite3BtreeHoldsMutex(p) );
        !           300:   assert( eLock==READ_LOCK || eLock==WRITE_LOCK );
        !           301:   assert( p->db!=0 );
        !           302: 
        !           303:   /* A connection with the read-uncommitted flag set will never try to
        !           304:   ** obtain a read-lock using this function. The only read-lock obtained
        !           305:   ** by a connection in read-uncommitted mode is on the sqlite_master 
        !           306:   ** table, and that lock is obtained in BtreeBeginTrans().  */
        !           307:   assert( 0==(p->db->flags&SQLITE_ReadUncommitted) || eLock==WRITE_LOCK );
        !           308: 
        !           309:   /* This function should only be called on a sharable b-tree after it 
        !           310:   ** has been determined that no other b-tree holds a conflicting lock.  */
        !           311:   assert( p->sharable );
        !           312:   assert( SQLITE_OK==querySharedCacheTableLock(p, iTable, eLock) );
        !           313: 
        !           314:   /* First search the list for an existing lock on this table. */
        !           315:   for(pIter=pBt->pLock; pIter; pIter=pIter->pNext){
        !           316:     if( pIter->iTable==iTable && pIter->pBtree==p ){
        !           317:       pLock = pIter;
        !           318:       break;
        !           319:     }
        !           320:   }
        !           321: 
        !           322:   /* If the above search did not find a BtLock struct associating Btree p
        !           323:   ** with table iTable, allocate one and link it into the list.
        !           324:   */
        !           325:   if( !pLock ){
        !           326:     pLock = (BtLock *)sqlite3MallocZero(sizeof(BtLock));
        !           327:     if( !pLock ){
        !           328:       return SQLITE_NOMEM;
        !           329:     }
        !           330:     pLock->iTable = iTable;
        !           331:     pLock->pBtree = p;
        !           332:     pLock->pNext = pBt->pLock;
        !           333:     pBt->pLock = pLock;
        !           334:   }
        !           335: 
        !           336:   /* Set the BtLock.eLock variable to the maximum of the current lock
        !           337:   ** and the requested lock. This means if a write-lock was already held
        !           338:   ** and a read-lock requested, we don't incorrectly downgrade the lock.
        !           339:   */
        !           340:   assert( WRITE_LOCK>READ_LOCK );
        !           341:   if( eLock>pLock->eLock ){
        !           342:     pLock->eLock = eLock;
        !           343:   }
        !           344: 
        !           345:   return SQLITE_OK;
        !           346: }
        !           347: #endif /* !SQLITE_OMIT_SHARED_CACHE */
        !           348: 
        !           349: #ifndef SQLITE_OMIT_SHARED_CACHE
        !           350: /*
        !           351: ** Release all the table locks (locks obtained via calls to
        !           352: ** the setSharedCacheTableLock() procedure) held by Btree object p.
        !           353: **
        !           354: ** This function assumes that Btree p has an open read or write 
        !           355: ** transaction. If it does not, then the BTS_PENDING flag
        !           356: ** may be incorrectly cleared.
        !           357: */
        !           358: static void clearAllSharedCacheTableLocks(Btree *p){
        !           359:   BtShared *pBt = p->pBt;
        !           360:   BtLock **ppIter = &pBt->pLock;
        !           361: 
        !           362:   assert( sqlite3BtreeHoldsMutex(p) );
        !           363:   assert( p->sharable || 0==*ppIter );
        !           364:   assert( p->inTrans>0 );
        !           365: 
        !           366:   while( *ppIter ){
        !           367:     BtLock *pLock = *ppIter;
        !           368:     assert( (pBt->btsFlags & BTS_EXCLUSIVE)==0 || pBt->pWriter==pLock->pBtree );
        !           369:     assert( pLock->pBtree->inTrans>=pLock->eLock );
        !           370:     if( pLock->pBtree==p ){
        !           371:       *ppIter = pLock->pNext;
        !           372:       assert( pLock->iTable!=1 || pLock==&p->lock );
        !           373:       if( pLock->iTable!=1 ){
        !           374:         sqlite3_free(pLock);
        !           375:       }
        !           376:     }else{
        !           377:       ppIter = &pLock->pNext;
        !           378:     }
        !           379:   }
        !           380: 
        !           381:   assert( (pBt->btsFlags & BTS_PENDING)==0 || pBt->pWriter );
        !           382:   if( pBt->pWriter==p ){
        !           383:     pBt->pWriter = 0;
        !           384:     pBt->btsFlags &= ~(BTS_EXCLUSIVE|BTS_PENDING);
        !           385:   }else if( pBt->nTransaction==2 ){
        !           386:     /* This function is called when Btree p is concluding its 
        !           387:     ** transaction. If there currently exists a writer, and p is not
        !           388:     ** that writer, then the number of locks held by connections other
        !           389:     ** than the writer must be about to drop to zero. In this case
        !           390:     ** set the BTS_PENDING flag to 0.
        !           391:     **
        !           392:     ** If there is not currently a writer, then BTS_PENDING must
        !           393:     ** be zero already. So this next line is harmless in that case.
        !           394:     */
        !           395:     pBt->btsFlags &= ~BTS_PENDING;
        !           396:   }
        !           397: }
        !           398: 
        !           399: /*
        !           400: ** This function changes all write-locks held by Btree p into read-locks.
        !           401: */
        !           402: static void downgradeAllSharedCacheTableLocks(Btree *p){
        !           403:   BtShared *pBt = p->pBt;
        !           404:   if( pBt->pWriter==p ){
        !           405:     BtLock *pLock;
        !           406:     pBt->pWriter = 0;
        !           407:     pBt->btsFlags &= ~(BTS_EXCLUSIVE|BTS_PENDING);
        !           408:     for(pLock=pBt->pLock; pLock; pLock=pLock->pNext){
        !           409:       assert( pLock->eLock==READ_LOCK || pLock->pBtree==p );
        !           410:       pLock->eLock = READ_LOCK;
        !           411:     }
        !           412:   }
        !           413: }
        !           414: 
        !           415: #endif /* SQLITE_OMIT_SHARED_CACHE */
        !           416: 
        !           417: static void releasePage(MemPage *pPage);  /* Forward reference */
        !           418: 
        !           419: /*
        !           420: ***** This routine is used inside of assert() only ****
        !           421: **
        !           422: ** Verify that the cursor holds the mutex on its BtShared
        !           423: */
        !           424: #ifdef SQLITE_DEBUG
        !           425: static int cursorHoldsMutex(BtCursor *p){
        !           426:   return sqlite3_mutex_held(p->pBt->mutex);
        !           427: }
        !           428: #endif
        !           429: 
        !           430: 
        !           431: #ifndef SQLITE_OMIT_INCRBLOB
        !           432: /*
        !           433: ** Invalidate the overflow page-list cache for cursor pCur, if any.
        !           434: */
        !           435: static void invalidateOverflowCache(BtCursor *pCur){
        !           436:   assert( cursorHoldsMutex(pCur) );
        !           437:   sqlite3_free(pCur->aOverflow);
        !           438:   pCur->aOverflow = 0;
        !           439: }
        !           440: 
        !           441: /*
        !           442: ** Invalidate the overflow page-list cache for all cursors opened
        !           443: ** on the shared btree structure pBt.
        !           444: */
        !           445: static void invalidateAllOverflowCache(BtShared *pBt){
        !           446:   BtCursor *p;
        !           447:   assert( sqlite3_mutex_held(pBt->mutex) );
        !           448:   for(p=pBt->pCursor; p; p=p->pNext){
        !           449:     invalidateOverflowCache(p);
        !           450:   }
        !           451: }
        !           452: 
        !           453: /*
        !           454: ** This function is called before modifying the contents of a table
        !           455: ** to invalidate any incrblob cursors that are open on the
        !           456: ** row or one of the rows being modified.
        !           457: **
        !           458: ** If argument isClearTable is true, then the entire contents of the
        !           459: ** table is about to be deleted. In this case invalidate all incrblob
        !           460: ** cursors open on any row within the table with root-page pgnoRoot.
        !           461: **
        !           462: ** Otherwise, if argument isClearTable is false, then the row with
        !           463: ** rowid iRow is being replaced or deleted. In this case invalidate
        !           464: ** only those incrblob cursors open on that specific row.
        !           465: */
        !           466: static void invalidateIncrblobCursors(
        !           467:   Btree *pBtree,          /* The database file to check */
        !           468:   i64 iRow,               /* The rowid that might be changing */
        !           469:   int isClearTable        /* True if all rows are being deleted */
        !           470: ){
        !           471:   BtCursor *p;
        !           472:   BtShared *pBt = pBtree->pBt;
        !           473:   assert( sqlite3BtreeHoldsMutex(pBtree) );
        !           474:   for(p=pBt->pCursor; p; p=p->pNext){
        !           475:     if( p->isIncrblobHandle && (isClearTable || p->info.nKey==iRow) ){
        !           476:       p->eState = CURSOR_INVALID;
        !           477:     }
        !           478:   }
        !           479: }
        !           480: 
        !           481: #else
        !           482:   /* Stub functions when INCRBLOB is omitted */
        !           483:   #define invalidateOverflowCache(x)
        !           484:   #define invalidateAllOverflowCache(x)
        !           485:   #define invalidateIncrblobCursors(x,y,z)
        !           486: #endif /* SQLITE_OMIT_INCRBLOB */
        !           487: 
        !           488: /*
        !           489: ** Set bit pgno of the BtShared.pHasContent bitvec. This is called 
        !           490: ** when a page that previously contained data becomes a free-list leaf 
        !           491: ** page.
        !           492: **
        !           493: ** The BtShared.pHasContent bitvec exists to work around an obscure
        !           494: ** bug caused by the interaction of two useful IO optimizations surrounding
        !           495: ** free-list leaf pages:
        !           496: **
        !           497: **   1) When all data is deleted from a page and the page becomes
        !           498: **      a free-list leaf page, the page is not written to the database
        !           499: **      (as free-list leaf pages contain no meaningful data). Sometimes
        !           500: **      such a page is not even journalled (as it will not be modified,
        !           501: **      why bother journalling it?).
        !           502: **
        !           503: **   2) When a free-list leaf page is reused, its content is not read
        !           504: **      from the database or written to the journal file (why should it
        !           505: **      be, if it is not at all meaningful?).
        !           506: **
        !           507: ** By themselves, these optimizations work fine and provide a handy
        !           508: ** performance boost to bulk delete or insert operations. However, if
        !           509: ** a page is moved to the free-list and then reused within the same
        !           510: ** transaction, a problem comes up. If the page is not journalled when
        !           511: ** it is moved to the free-list and it is also not journalled when it
        !           512: ** is extracted from the free-list and reused, then the original data
        !           513: ** may be lost. In the event of a rollback, it may not be possible
        !           514: ** to restore the database to its original configuration.
        !           515: **
        !           516: ** The solution is the BtShared.pHasContent bitvec. Whenever a page is 
        !           517: ** moved to become a free-list leaf page, the corresponding bit is
        !           518: ** set in the bitvec. Whenever a leaf page is extracted from the free-list,
        !           519: ** optimization 2 above is omitted if the corresponding bit is already
        !           520: ** set in BtShared.pHasContent. The contents of the bitvec are cleared
        !           521: ** at the end of every transaction.
        !           522: */
        !           523: static int btreeSetHasContent(BtShared *pBt, Pgno pgno){
        !           524:   int rc = SQLITE_OK;
        !           525:   if( !pBt->pHasContent ){
        !           526:     assert( pgno<=pBt->nPage );
        !           527:     pBt->pHasContent = sqlite3BitvecCreate(pBt->nPage);
        !           528:     if( !pBt->pHasContent ){
        !           529:       rc = SQLITE_NOMEM;
        !           530:     }
        !           531:   }
        !           532:   if( rc==SQLITE_OK && pgno<=sqlite3BitvecSize(pBt->pHasContent) ){
        !           533:     rc = sqlite3BitvecSet(pBt->pHasContent, pgno);
        !           534:   }
        !           535:   return rc;
        !           536: }
        !           537: 
        !           538: /*
        !           539: ** Query the BtShared.pHasContent vector.
        !           540: **
        !           541: ** This function is called when a free-list leaf page is removed from the
        !           542: ** free-list for reuse. It returns false if it is safe to retrieve the
        !           543: ** page from the pager layer with the 'no-content' flag set. True otherwise.
        !           544: */
        !           545: static int btreeGetHasContent(BtShared *pBt, Pgno pgno){
        !           546:   Bitvec *p = pBt->pHasContent;
        !           547:   return (p && (pgno>sqlite3BitvecSize(p) || sqlite3BitvecTest(p, pgno)));
        !           548: }
        !           549: 
        !           550: /*
        !           551: ** Clear (destroy) the BtShared.pHasContent bitvec. This should be
        !           552: ** invoked at the conclusion of each write-transaction.
        !           553: */
        !           554: static void btreeClearHasContent(BtShared *pBt){
        !           555:   sqlite3BitvecDestroy(pBt->pHasContent);
        !           556:   pBt->pHasContent = 0;
        !           557: }
        !           558: 
        !           559: /*
        !           560: ** Save the current cursor position in the variables BtCursor.nKey 
        !           561: ** and BtCursor.pKey. The cursor's state is set to CURSOR_REQUIRESEEK.
        !           562: **
        !           563: ** The caller must ensure that the cursor is valid (has eState==CURSOR_VALID)
        !           564: ** prior to calling this routine.  
        !           565: */
        !           566: static int saveCursorPosition(BtCursor *pCur){
        !           567:   int rc;
        !           568: 
        !           569:   assert( CURSOR_VALID==pCur->eState );
        !           570:   assert( 0==pCur->pKey );
        !           571:   assert( cursorHoldsMutex(pCur) );
        !           572: 
        !           573:   rc = sqlite3BtreeKeySize(pCur, &pCur->nKey);
        !           574:   assert( rc==SQLITE_OK );  /* KeySize() cannot fail */
        !           575: 
        !           576:   /* If this is an intKey table, then the above call to BtreeKeySize()
        !           577:   ** stores the integer key in pCur->nKey. In this case this value is
        !           578:   ** all that is required. Otherwise, if pCur is not open on an intKey
        !           579:   ** table, then malloc space for and store the pCur->nKey bytes of key 
        !           580:   ** data.
        !           581:   */
        !           582:   if( 0==pCur->apPage[0]->intKey ){
        !           583:     void *pKey = sqlite3Malloc( (int)pCur->nKey );
        !           584:     if( pKey ){
        !           585:       rc = sqlite3BtreeKey(pCur, 0, (int)pCur->nKey, pKey);
        !           586:       if( rc==SQLITE_OK ){
        !           587:         pCur->pKey = pKey;
        !           588:       }else{
        !           589:         sqlite3_free(pKey);
        !           590:       }
        !           591:     }else{
        !           592:       rc = SQLITE_NOMEM;
        !           593:     }
        !           594:   }
        !           595:   assert( !pCur->apPage[0]->intKey || !pCur->pKey );
        !           596: 
        !           597:   if( rc==SQLITE_OK ){
        !           598:     int i;
        !           599:     for(i=0; i<=pCur->iPage; i++){
        !           600:       releasePage(pCur->apPage[i]);
        !           601:       pCur->apPage[i] = 0;
        !           602:     }
        !           603:     pCur->iPage = -1;
        !           604:     pCur->eState = CURSOR_REQUIRESEEK;
        !           605:   }
        !           606: 
        !           607:   invalidateOverflowCache(pCur);
        !           608:   return rc;
        !           609: }
        !           610: 
        !           611: /*
        !           612: ** Save the positions of all cursors (except pExcept) that are open on
        !           613: ** the table  with root-page iRoot. Usually, this is called just before cursor
        !           614: ** pExcept is used to modify the table (BtreeDelete() or BtreeInsert()).
        !           615: */
        !           616: static int saveAllCursors(BtShared *pBt, Pgno iRoot, BtCursor *pExcept){
        !           617:   BtCursor *p;
        !           618:   assert( sqlite3_mutex_held(pBt->mutex) );
        !           619:   assert( pExcept==0 || pExcept->pBt==pBt );
        !           620:   for(p=pBt->pCursor; p; p=p->pNext){
        !           621:     if( p!=pExcept && (0==iRoot || p->pgnoRoot==iRoot) && 
        !           622:         p->eState==CURSOR_VALID ){
        !           623:       int rc = saveCursorPosition(p);
        !           624:       if( SQLITE_OK!=rc ){
        !           625:         return rc;
        !           626:       }
        !           627:     }
        !           628:   }
        !           629:   return SQLITE_OK;
        !           630: }
        !           631: 
        !           632: /*
        !           633: ** Clear the current cursor position.
        !           634: */
        !           635: void sqlite3BtreeClearCursor(BtCursor *pCur){
        !           636:   assert( cursorHoldsMutex(pCur) );
        !           637:   sqlite3_free(pCur->pKey);
        !           638:   pCur->pKey = 0;
        !           639:   pCur->eState = CURSOR_INVALID;
        !           640: }
        !           641: 
        !           642: /*
        !           643: ** In this version of BtreeMoveto, pKey is a packed index record
        !           644: ** such as is generated by the OP_MakeRecord opcode.  Unpack the
        !           645: ** record and then call BtreeMovetoUnpacked() to do the work.
        !           646: */
        !           647: static int btreeMoveto(
        !           648:   BtCursor *pCur,     /* Cursor open on the btree to be searched */
        !           649:   const void *pKey,   /* Packed key if the btree is an index */
        !           650:   i64 nKey,           /* Integer key for tables.  Size of pKey for indices */
        !           651:   int bias,           /* Bias search to the high end */
        !           652:   int *pRes           /* Write search results here */
        !           653: ){
        !           654:   int rc;                    /* Status code */
        !           655:   UnpackedRecord *pIdxKey;   /* Unpacked index key */
        !           656:   char aSpace[150];          /* Temp space for pIdxKey - to avoid a malloc */
        !           657:   char *pFree = 0;
        !           658: 
        !           659:   if( pKey ){
        !           660:     assert( nKey==(i64)(int)nKey );
        !           661:     pIdxKey = sqlite3VdbeAllocUnpackedRecord(
        !           662:         pCur->pKeyInfo, aSpace, sizeof(aSpace), &pFree
        !           663:     );
        !           664:     if( pIdxKey==0 ) return SQLITE_NOMEM;
        !           665:     sqlite3VdbeRecordUnpack(pCur->pKeyInfo, (int)nKey, pKey, pIdxKey);
        !           666:   }else{
        !           667:     pIdxKey = 0;
        !           668:   }
        !           669:   rc = sqlite3BtreeMovetoUnpacked(pCur, pIdxKey, nKey, bias, pRes);
        !           670:   if( pFree ){
        !           671:     sqlite3DbFree(pCur->pKeyInfo->db, pFree);
        !           672:   }
        !           673:   return rc;
        !           674: }
        !           675: 
        !           676: /*
        !           677: ** Restore the cursor to the position it was in (or as close to as possible)
        !           678: ** when saveCursorPosition() was called. Note that this call deletes the 
        !           679: ** saved position info stored by saveCursorPosition(), so there can be
        !           680: ** at most one effective restoreCursorPosition() call after each 
        !           681: ** saveCursorPosition().
        !           682: */
        !           683: static int btreeRestoreCursorPosition(BtCursor *pCur){
        !           684:   int rc;
        !           685:   assert( cursorHoldsMutex(pCur) );
        !           686:   assert( pCur->eState>=CURSOR_REQUIRESEEK );
        !           687:   if( pCur->eState==CURSOR_FAULT ){
        !           688:     return pCur->skipNext;
        !           689:   }
        !           690:   pCur->eState = CURSOR_INVALID;
        !           691:   rc = btreeMoveto(pCur, pCur->pKey, pCur->nKey, 0, &pCur->skipNext);
        !           692:   if( rc==SQLITE_OK ){
        !           693:     sqlite3_free(pCur->pKey);
        !           694:     pCur->pKey = 0;
        !           695:     assert( pCur->eState==CURSOR_VALID || pCur->eState==CURSOR_INVALID );
        !           696:   }
        !           697:   return rc;
        !           698: }
        !           699: 
        !           700: #define restoreCursorPosition(p) \
        !           701:   (p->eState>=CURSOR_REQUIRESEEK ? \
        !           702:          btreeRestoreCursorPosition(p) : \
        !           703:          SQLITE_OK)
        !           704: 
        !           705: /*
        !           706: ** Determine whether or not a cursor has moved from the position it
        !           707: ** was last placed at.  Cursors can move when the row they are pointing
        !           708: ** at is deleted out from under them.
        !           709: **
        !           710: ** This routine returns an error code if something goes wrong.  The
        !           711: ** integer *pHasMoved is set to one if the cursor has moved and 0 if not.
        !           712: */
        !           713: int sqlite3BtreeCursorHasMoved(BtCursor *pCur, int *pHasMoved){
        !           714:   int rc;
        !           715: 
        !           716:   rc = restoreCursorPosition(pCur);
        !           717:   if( rc ){
        !           718:     *pHasMoved = 1;
        !           719:     return rc;
        !           720:   }
        !           721:   if( pCur->eState!=CURSOR_VALID || pCur->skipNext!=0 ){
        !           722:     *pHasMoved = 1;
        !           723:   }else{
        !           724:     *pHasMoved = 0;
        !           725:   }
        !           726:   return SQLITE_OK;
        !           727: }
        !           728: 
        !           729: #ifndef SQLITE_OMIT_AUTOVACUUM
        !           730: /*
        !           731: ** Given a page number of a regular database page, return the page
        !           732: ** number for the pointer-map page that contains the entry for the
        !           733: ** input page number.
        !           734: **
        !           735: ** Return 0 (not a valid page) for pgno==1 since there is
        !           736: ** no pointer map associated with page 1.  The integrity_check logic
        !           737: ** requires that ptrmapPageno(*,1)!=1.
        !           738: */
        !           739: static Pgno ptrmapPageno(BtShared *pBt, Pgno pgno){
        !           740:   int nPagesPerMapPage;
        !           741:   Pgno iPtrMap, ret;
        !           742:   assert( sqlite3_mutex_held(pBt->mutex) );
        !           743:   if( pgno<2 ) return 0;
        !           744:   nPagesPerMapPage = (pBt->usableSize/5)+1;
        !           745:   iPtrMap = (pgno-2)/nPagesPerMapPage;
        !           746:   ret = (iPtrMap*nPagesPerMapPage) + 2; 
        !           747:   if( ret==PENDING_BYTE_PAGE(pBt) ){
        !           748:     ret++;
        !           749:   }
        !           750:   return ret;
        !           751: }
        !           752: 
        !           753: /*
        !           754: ** Write an entry into the pointer map.
        !           755: **
        !           756: ** This routine updates the pointer map entry for page number 'key'
        !           757: ** so that it maps to type 'eType' and parent page number 'pgno'.
        !           758: **
        !           759: ** If *pRC is initially non-zero (non-SQLITE_OK) then this routine is
        !           760: ** a no-op.  If an error occurs, the appropriate error code is written
        !           761: ** into *pRC.
        !           762: */
        !           763: static void ptrmapPut(BtShared *pBt, Pgno key, u8 eType, Pgno parent, int *pRC){
        !           764:   DbPage *pDbPage;  /* The pointer map page */
        !           765:   u8 *pPtrmap;      /* The pointer map data */
        !           766:   Pgno iPtrmap;     /* The pointer map page number */
        !           767:   int offset;       /* Offset in pointer map page */
        !           768:   int rc;           /* Return code from subfunctions */
        !           769: 
        !           770:   if( *pRC ) return;
        !           771: 
        !           772:   assert( sqlite3_mutex_held(pBt->mutex) );
        !           773:   /* The master-journal page number must never be used as a pointer map page */
        !           774:   assert( 0==PTRMAP_ISPAGE(pBt, PENDING_BYTE_PAGE(pBt)) );
        !           775: 
        !           776:   assert( pBt->autoVacuum );
        !           777:   if( key==0 ){
        !           778:     *pRC = SQLITE_CORRUPT_BKPT;
        !           779:     return;
        !           780:   }
        !           781:   iPtrmap = PTRMAP_PAGENO(pBt, key);
        !           782:   rc = sqlite3PagerGet(pBt->pPager, iPtrmap, &pDbPage);
        !           783:   if( rc!=SQLITE_OK ){
        !           784:     *pRC = rc;
        !           785:     return;
        !           786:   }
        !           787:   offset = PTRMAP_PTROFFSET(iPtrmap, key);
        !           788:   if( offset<0 ){
        !           789:     *pRC = SQLITE_CORRUPT_BKPT;
        !           790:     goto ptrmap_exit;
        !           791:   }
        !           792:   assert( offset <= (int)pBt->usableSize-5 );
        !           793:   pPtrmap = (u8 *)sqlite3PagerGetData(pDbPage);
        !           794: 
        !           795:   if( eType!=pPtrmap[offset] || get4byte(&pPtrmap[offset+1])!=parent ){
        !           796:     TRACE(("PTRMAP_UPDATE: %d->(%d,%d)\n", key, eType, parent));
        !           797:     *pRC= rc = sqlite3PagerWrite(pDbPage);
        !           798:     if( rc==SQLITE_OK ){
        !           799:       pPtrmap[offset] = eType;
        !           800:       put4byte(&pPtrmap[offset+1], parent);
        !           801:     }
        !           802:   }
        !           803: 
        !           804: ptrmap_exit:
        !           805:   sqlite3PagerUnref(pDbPage);
        !           806: }
        !           807: 
        !           808: /*
        !           809: ** Read an entry from the pointer map.
        !           810: **
        !           811: ** This routine retrieves the pointer map entry for page 'key', writing
        !           812: ** the type and parent page number to *pEType and *pPgno respectively.
        !           813: ** An error code is returned if something goes wrong, otherwise SQLITE_OK.
        !           814: */
        !           815: static int ptrmapGet(BtShared *pBt, Pgno key, u8 *pEType, Pgno *pPgno){
        !           816:   DbPage *pDbPage;   /* The pointer map page */
        !           817:   int iPtrmap;       /* Pointer map page index */
        !           818:   u8 *pPtrmap;       /* Pointer map page data */
        !           819:   int offset;        /* Offset of entry in pointer map */
        !           820:   int rc;
        !           821: 
        !           822:   assert( sqlite3_mutex_held(pBt->mutex) );
        !           823: 
        !           824:   iPtrmap = PTRMAP_PAGENO(pBt, key);
        !           825:   rc = sqlite3PagerGet(pBt->pPager, iPtrmap, &pDbPage);
        !           826:   if( rc!=0 ){
        !           827:     return rc;
        !           828:   }
        !           829:   pPtrmap = (u8 *)sqlite3PagerGetData(pDbPage);
        !           830: 
        !           831:   offset = PTRMAP_PTROFFSET(iPtrmap, key);
        !           832:   if( offset<0 ){
        !           833:     sqlite3PagerUnref(pDbPage);
        !           834:     return SQLITE_CORRUPT_BKPT;
        !           835:   }
        !           836:   assert( offset <= (int)pBt->usableSize-5 );
        !           837:   assert( pEType!=0 );
        !           838:   *pEType = pPtrmap[offset];
        !           839:   if( pPgno ) *pPgno = get4byte(&pPtrmap[offset+1]);
        !           840: 
        !           841:   sqlite3PagerUnref(pDbPage);
        !           842:   if( *pEType<1 || *pEType>5 ) return SQLITE_CORRUPT_BKPT;
        !           843:   return SQLITE_OK;
        !           844: }
        !           845: 
        !           846: #else /* if defined SQLITE_OMIT_AUTOVACUUM */
        !           847:   #define ptrmapPut(w,x,y,z,rc)
        !           848:   #define ptrmapGet(w,x,y,z) SQLITE_OK
        !           849:   #define ptrmapPutOvflPtr(x, y, rc)
        !           850: #endif
        !           851: 
        !           852: /*
        !           853: ** Given a btree page and a cell index (0 means the first cell on
        !           854: ** the page, 1 means the second cell, and so forth) return a pointer
        !           855: ** to the cell content.
        !           856: **
        !           857: ** This routine works only for pages that do not contain overflow cells.
        !           858: */
        !           859: #define findCell(P,I) \
        !           860:   ((P)->aData + ((P)->maskPage & get2byte(&(P)->aCellIdx[2*(I)])))
        !           861: #define findCellv2(D,M,O,I) (D+(M&get2byte(D+(O+2*(I)))))
        !           862: 
        !           863: 
        !           864: /*
        !           865: ** This a more complex version of findCell() that works for
        !           866: ** pages that do contain overflow cells.
        !           867: */
        !           868: static u8 *findOverflowCell(MemPage *pPage, int iCell){
        !           869:   int i;
        !           870:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !           871:   for(i=pPage->nOverflow-1; i>=0; i--){
        !           872:     int k;
        !           873:     struct _OvflCell *pOvfl;
        !           874:     pOvfl = &pPage->aOvfl[i];
        !           875:     k = pOvfl->idx;
        !           876:     if( k<=iCell ){
        !           877:       if( k==iCell ){
        !           878:         return pOvfl->pCell;
        !           879:       }
        !           880:       iCell--;
        !           881:     }
        !           882:   }
        !           883:   return findCell(pPage, iCell);
        !           884: }
        !           885: 
        !           886: /*
        !           887: ** Parse a cell content block and fill in the CellInfo structure.  There
        !           888: ** are two versions of this function.  btreeParseCell() takes a 
        !           889: ** cell index as the second argument and btreeParseCellPtr() 
        !           890: ** takes a pointer to the body of the cell as its second argument.
        !           891: **
        !           892: ** Within this file, the parseCell() macro can be called instead of
        !           893: ** btreeParseCellPtr(). Using some compilers, this will be faster.
        !           894: */
        !           895: static void btreeParseCellPtr(
        !           896:   MemPage *pPage,         /* Page containing the cell */
        !           897:   u8 *pCell,              /* Pointer to the cell text. */
        !           898:   CellInfo *pInfo         /* Fill in this structure */
        !           899: ){
        !           900:   u16 n;                  /* Number bytes in cell content header */
        !           901:   u32 nPayload;           /* Number of bytes of cell payload */
        !           902: 
        !           903:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !           904: 
        !           905:   pInfo->pCell = pCell;
        !           906:   assert( pPage->leaf==0 || pPage->leaf==1 );
        !           907:   n = pPage->childPtrSize;
        !           908:   assert( n==4-4*pPage->leaf );
        !           909:   if( pPage->intKey ){
        !           910:     if( pPage->hasData ){
        !           911:       n += getVarint32(&pCell[n], nPayload);
        !           912:     }else{
        !           913:       nPayload = 0;
        !           914:     }
        !           915:     n += getVarint(&pCell[n], (u64*)&pInfo->nKey);
        !           916:     pInfo->nData = nPayload;
        !           917:   }else{
        !           918:     pInfo->nData = 0;
        !           919:     n += getVarint32(&pCell[n], nPayload);
        !           920:     pInfo->nKey = nPayload;
        !           921:   }
        !           922:   pInfo->nPayload = nPayload;
        !           923:   pInfo->nHeader = n;
        !           924:   testcase( nPayload==pPage->maxLocal );
        !           925:   testcase( nPayload==pPage->maxLocal+1 );
        !           926:   if( likely(nPayload<=pPage->maxLocal) ){
        !           927:     /* This is the (easy) common case where the entire payload fits
        !           928:     ** on the local page.  No overflow is required.
        !           929:     */
        !           930:     if( (pInfo->nSize = (u16)(n+nPayload))<4 ) pInfo->nSize = 4;
        !           931:     pInfo->nLocal = (u16)nPayload;
        !           932:     pInfo->iOverflow = 0;
        !           933:   }else{
        !           934:     /* If the payload will not fit completely on the local page, we have
        !           935:     ** to decide how much to store locally and how much to spill onto
        !           936:     ** overflow pages.  The strategy is to minimize the amount of unused
        !           937:     ** space on overflow pages while keeping the amount of local storage
        !           938:     ** in between minLocal and maxLocal.
        !           939:     **
        !           940:     ** Warning:  changing the way overflow payload is distributed in any
        !           941:     ** way will result in an incompatible file format.
        !           942:     */
        !           943:     int minLocal;  /* Minimum amount of payload held locally */
        !           944:     int maxLocal;  /* Maximum amount of payload held locally */
        !           945:     int surplus;   /* Overflow payload available for local storage */
        !           946: 
        !           947:     minLocal = pPage->minLocal;
        !           948:     maxLocal = pPage->maxLocal;
        !           949:     surplus = minLocal + (nPayload - minLocal)%(pPage->pBt->usableSize - 4);
        !           950:     testcase( surplus==maxLocal );
        !           951:     testcase( surplus==maxLocal+1 );
        !           952:     if( surplus <= maxLocal ){
        !           953:       pInfo->nLocal = (u16)surplus;
        !           954:     }else{
        !           955:       pInfo->nLocal = (u16)minLocal;
        !           956:     }
        !           957:     pInfo->iOverflow = (u16)(pInfo->nLocal + n);
        !           958:     pInfo->nSize = pInfo->iOverflow + 4;
        !           959:   }
        !           960: }
        !           961: #define parseCell(pPage, iCell, pInfo) \
        !           962:   btreeParseCellPtr((pPage), findCell((pPage), (iCell)), (pInfo))
        !           963: static void btreeParseCell(
        !           964:   MemPage *pPage,         /* Page containing the cell */
        !           965:   int iCell,              /* The cell index.  First cell is 0 */
        !           966:   CellInfo *pInfo         /* Fill in this structure */
        !           967: ){
        !           968:   parseCell(pPage, iCell, pInfo);
        !           969: }
        !           970: 
        !           971: /*
        !           972: ** Compute the total number of bytes that a Cell needs in the cell
        !           973: ** data area of the btree-page.  The return number includes the cell
        !           974: ** data header and the local payload, but not any overflow page or
        !           975: ** the space used by the cell pointer.
        !           976: */
        !           977: static u16 cellSizePtr(MemPage *pPage, u8 *pCell){
        !           978:   u8 *pIter = &pCell[pPage->childPtrSize];
        !           979:   u32 nSize;
        !           980: 
        !           981: #ifdef SQLITE_DEBUG
        !           982:   /* The value returned by this function should always be the same as
        !           983:   ** the (CellInfo.nSize) value found by doing a full parse of the
        !           984:   ** cell. If SQLITE_DEBUG is defined, an assert() at the bottom of
        !           985:   ** this function verifies that this invariant is not violated. */
        !           986:   CellInfo debuginfo;
        !           987:   btreeParseCellPtr(pPage, pCell, &debuginfo);
        !           988: #endif
        !           989: 
        !           990:   if( pPage->intKey ){
        !           991:     u8 *pEnd;
        !           992:     if( pPage->hasData ){
        !           993:       pIter += getVarint32(pIter, nSize);
        !           994:     }else{
        !           995:       nSize = 0;
        !           996:     }
        !           997: 
        !           998:     /* pIter now points at the 64-bit integer key value, a variable length 
        !           999:     ** integer. The following block moves pIter to point at the first byte
        !          1000:     ** past the end of the key value. */
        !          1001:     pEnd = &pIter[9];
        !          1002:     while( (*pIter++)&0x80 && pIter<pEnd );
        !          1003:   }else{
        !          1004:     pIter += getVarint32(pIter, nSize);
        !          1005:   }
        !          1006: 
        !          1007:   testcase( nSize==pPage->maxLocal );
        !          1008:   testcase( nSize==pPage->maxLocal+1 );
        !          1009:   if( nSize>pPage->maxLocal ){
        !          1010:     int minLocal = pPage->minLocal;
        !          1011:     nSize = minLocal + (nSize - minLocal) % (pPage->pBt->usableSize - 4);
        !          1012:     testcase( nSize==pPage->maxLocal );
        !          1013:     testcase( nSize==pPage->maxLocal+1 );
        !          1014:     if( nSize>pPage->maxLocal ){
        !          1015:       nSize = minLocal;
        !          1016:     }
        !          1017:     nSize += 4;
        !          1018:   }
        !          1019:   nSize += (u32)(pIter - pCell);
        !          1020: 
        !          1021:   /* The minimum size of any cell is 4 bytes. */
        !          1022:   if( nSize<4 ){
        !          1023:     nSize = 4;
        !          1024:   }
        !          1025: 
        !          1026:   assert( nSize==debuginfo.nSize );
        !          1027:   return (u16)nSize;
        !          1028: }
        !          1029: 
        !          1030: #ifdef SQLITE_DEBUG
        !          1031: /* This variation on cellSizePtr() is used inside of assert() statements
        !          1032: ** only. */
        !          1033: static u16 cellSize(MemPage *pPage, int iCell){
        !          1034:   return cellSizePtr(pPage, findCell(pPage, iCell));
        !          1035: }
        !          1036: #endif
        !          1037: 
        !          1038: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          1039: /*
        !          1040: ** If the cell pCell, part of page pPage contains a pointer
        !          1041: ** to an overflow page, insert an entry into the pointer-map
        !          1042: ** for the overflow page.
        !          1043: */
        !          1044: static void ptrmapPutOvflPtr(MemPage *pPage, u8 *pCell, int *pRC){
        !          1045:   CellInfo info;
        !          1046:   if( *pRC ) return;
        !          1047:   assert( pCell!=0 );
        !          1048:   btreeParseCellPtr(pPage, pCell, &info);
        !          1049:   assert( (info.nData+(pPage->intKey?0:info.nKey))==info.nPayload );
        !          1050:   if( info.iOverflow ){
        !          1051:     Pgno ovfl = get4byte(&pCell[info.iOverflow]);
        !          1052:     ptrmapPut(pPage->pBt, ovfl, PTRMAP_OVERFLOW1, pPage->pgno, pRC);
        !          1053:   }
        !          1054: }
        !          1055: #endif
        !          1056: 
        !          1057: 
        !          1058: /*
        !          1059: ** Defragment the page given.  All Cells are moved to the
        !          1060: ** end of the page and all free space is collected into one
        !          1061: ** big FreeBlk that occurs in between the header and cell
        !          1062: ** pointer array and the cell content area.
        !          1063: */
        !          1064: static int defragmentPage(MemPage *pPage){
        !          1065:   int i;                     /* Loop counter */
        !          1066:   int pc;                    /* Address of a i-th cell */
        !          1067:   int hdr;                   /* Offset to the page header */
        !          1068:   int size;                  /* Size of a cell */
        !          1069:   int usableSize;            /* Number of usable bytes on a page */
        !          1070:   int cellOffset;            /* Offset to the cell pointer array */
        !          1071:   int cbrk;                  /* Offset to the cell content area */
        !          1072:   int nCell;                 /* Number of cells on the page */
        !          1073:   unsigned char *data;       /* The page data */
        !          1074:   unsigned char *temp;       /* Temp area for cell content */
        !          1075:   int iCellFirst;            /* First allowable cell index */
        !          1076:   int iCellLast;             /* Last possible cell index */
        !          1077: 
        !          1078: 
        !          1079:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
        !          1080:   assert( pPage->pBt!=0 );
        !          1081:   assert( pPage->pBt->usableSize <= SQLITE_MAX_PAGE_SIZE );
        !          1082:   assert( pPage->nOverflow==0 );
        !          1083:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !          1084:   temp = sqlite3PagerTempSpace(pPage->pBt->pPager);
        !          1085:   data = pPage->aData;
        !          1086:   hdr = pPage->hdrOffset;
        !          1087:   cellOffset = pPage->cellOffset;
        !          1088:   nCell = pPage->nCell;
        !          1089:   assert( nCell==get2byte(&data[hdr+3]) );
        !          1090:   usableSize = pPage->pBt->usableSize;
        !          1091:   cbrk = get2byte(&data[hdr+5]);
        !          1092:   memcpy(&temp[cbrk], &data[cbrk], usableSize - cbrk);
        !          1093:   cbrk = usableSize;
        !          1094:   iCellFirst = cellOffset + 2*nCell;
        !          1095:   iCellLast = usableSize - 4;
        !          1096:   for(i=0; i<nCell; i++){
        !          1097:     u8 *pAddr;     /* The i-th cell pointer */
        !          1098:     pAddr = &data[cellOffset + i*2];
        !          1099:     pc = get2byte(pAddr);
        !          1100:     testcase( pc==iCellFirst );
        !          1101:     testcase( pc==iCellLast );
        !          1102: #if !defined(SQLITE_ENABLE_OVERSIZE_CELL_CHECK)
        !          1103:     /* These conditions have already been verified in btreeInitPage()
        !          1104:     ** if SQLITE_ENABLE_OVERSIZE_CELL_CHECK is defined 
        !          1105:     */
        !          1106:     if( pc<iCellFirst || pc>iCellLast ){
        !          1107:       return SQLITE_CORRUPT_BKPT;
        !          1108:     }
        !          1109: #endif
        !          1110:     assert( pc>=iCellFirst && pc<=iCellLast );
        !          1111:     size = cellSizePtr(pPage, &temp[pc]);
        !          1112:     cbrk -= size;
        !          1113: #if defined(SQLITE_ENABLE_OVERSIZE_CELL_CHECK)
        !          1114:     if( cbrk<iCellFirst ){
        !          1115:       return SQLITE_CORRUPT_BKPT;
        !          1116:     }
        !          1117: #else
        !          1118:     if( cbrk<iCellFirst || pc+size>usableSize ){
        !          1119:       return SQLITE_CORRUPT_BKPT;
        !          1120:     }
        !          1121: #endif
        !          1122:     assert( cbrk+size<=usableSize && cbrk>=iCellFirst );
        !          1123:     testcase( cbrk+size==usableSize );
        !          1124:     testcase( pc+size==usableSize );
        !          1125:     memcpy(&data[cbrk], &temp[pc], size);
        !          1126:     put2byte(pAddr, cbrk);
        !          1127:   }
        !          1128:   assert( cbrk>=iCellFirst );
        !          1129:   put2byte(&data[hdr+5], cbrk);
        !          1130:   data[hdr+1] = 0;
        !          1131:   data[hdr+2] = 0;
        !          1132:   data[hdr+7] = 0;
        !          1133:   memset(&data[iCellFirst], 0, cbrk-iCellFirst);
        !          1134:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
        !          1135:   if( cbrk-iCellFirst!=pPage->nFree ){
        !          1136:     return SQLITE_CORRUPT_BKPT;
        !          1137:   }
        !          1138:   return SQLITE_OK;
        !          1139: }
        !          1140: 
        !          1141: /*
        !          1142: ** Allocate nByte bytes of space from within the B-Tree page passed
        !          1143: ** as the first argument. Write into *pIdx the index into pPage->aData[]
        !          1144: ** of the first byte of allocated space. Return either SQLITE_OK or
        !          1145: ** an error code (usually SQLITE_CORRUPT).
        !          1146: **
        !          1147: ** The caller guarantees that there is sufficient space to make the
        !          1148: ** allocation.  This routine might need to defragment in order to bring
        !          1149: ** all the space together, however.  This routine will avoid using
        !          1150: ** the first two bytes past the cell pointer area since presumably this
        !          1151: ** allocation is being made in order to insert a new cell, so we will
        !          1152: ** also end up needing a new cell pointer.
        !          1153: */
        !          1154: static int allocateSpace(MemPage *pPage, int nByte, int *pIdx){
        !          1155:   const int hdr = pPage->hdrOffset;    /* Local cache of pPage->hdrOffset */
        !          1156:   u8 * const data = pPage->aData;      /* Local cache of pPage->aData */
        !          1157:   int nFrag;                           /* Number of fragmented bytes on pPage */
        !          1158:   int top;                             /* First byte of cell content area */
        !          1159:   int gap;        /* First byte of gap between cell pointers and cell content */
        !          1160:   int rc;         /* Integer return code */
        !          1161:   int usableSize; /* Usable size of the page */
        !          1162:   
        !          1163:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
        !          1164:   assert( pPage->pBt );
        !          1165:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !          1166:   assert( nByte>=0 );  /* Minimum cell size is 4 */
        !          1167:   assert( pPage->nFree>=nByte );
        !          1168:   assert( pPage->nOverflow==0 );
        !          1169:   usableSize = pPage->pBt->usableSize;
        !          1170:   assert( nByte < usableSize-8 );
        !          1171: 
        !          1172:   nFrag = data[hdr+7];
        !          1173:   assert( pPage->cellOffset == hdr + 12 - 4*pPage->leaf );
        !          1174:   gap = pPage->cellOffset + 2*pPage->nCell;
        !          1175:   top = get2byteNotZero(&data[hdr+5]);
        !          1176:   if( gap>top ) return SQLITE_CORRUPT_BKPT;
        !          1177:   testcase( gap+2==top );
        !          1178:   testcase( gap+1==top );
        !          1179:   testcase( gap==top );
        !          1180: 
        !          1181:   if( nFrag>=60 ){
        !          1182:     /* Always defragment highly fragmented pages */
        !          1183:     rc = defragmentPage(pPage);
        !          1184:     if( rc ) return rc;
        !          1185:     top = get2byteNotZero(&data[hdr+5]);
        !          1186:   }else if( gap+2<=top ){
        !          1187:     /* Search the freelist looking for a free slot big enough to satisfy 
        !          1188:     ** the request. The allocation is made from the first free slot in 
        !          1189:     ** the list that is large enough to accomadate it.
        !          1190:     */
        !          1191:     int pc, addr;
        !          1192:     for(addr=hdr+1; (pc = get2byte(&data[addr]))>0; addr=pc){
        !          1193:       int size;            /* Size of the free slot */
        !          1194:       if( pc>usableSize-4 || pc<addr+4 ){
        !          1195:         return SQLITE_CORRUPT_BKPT;
        !          1196:       }
        !          1197:       size = get2byte(&data[pc+2]);
        !          1198:       if( size>=nByte ){
        !          1199:         int x = size - nByte;
        !          1200:         testcase( x==4 );
        !          1201:         testcase( x==3 );
        !          1202:         if( x<4 ){
        !          1203:           /* Remove the slot from the free-list. Update the number of
        !          1204:           ** fragmented bytes within the page. */
        !          1205:           memcpy(&data[addr], &data[pc], 2);
        !          1206:           data[hdr+7] = (u8)(nFrag + x);
        !          1207:         }else if( size+pc > usableSize ){
        !          1208:           return SQLITE_CORRUPT_BKPT;
        !          1209:         }else{
        !          1210:           /* The slot remains on the free-list. Reduce its size to account
        !          1211:           ** for the portion used by the new allocation. */
        !          1212:           put2byte(&data[pc+2], x);
        !          1213:         }
        !          1214:         *pIdx = pc + x;
        !          1215:         return SQLITE_OK;
        !          1216:       }
        !          1217:     }
        !          1218:   }
        !          1219: 
        !          1220:   /* Check to make sure there is enough space in the gap to satisfy
        !          1221:   ** the allocation.  If not, defragment.
        !          1222:   */
        !          1223:   testcase( gap+2+nByte==top );
        !          1224:   if( gap+2+nByte>top ){
        !          1225:     rc = defragmentPage(pPage);
        !          1226:     if( rc ) return rc;
        !          1227:     top = get2byteNotZero(&data[hdr+5]);
        !          1228:     assert( gap+nByte<=top );
        !          1229:   }
        !          1230: 
        !          1231: 
        !          1232:   /* Allocate memory from the gap in between the cell pointer array
        !          1233:   ** and the cell content area.  The btreeInitPage() call has already
        !          1234:   ** validated the freelist.  Given that the freelist is valid, there
        !          1235:   ** is no way that the allocation can extend off the end of the page.
        !          1236:   ** The assert() below verifies the previous sentence.
        !          1237:   */
        !          1238:   top -= nByte;
        !          1239:   put2byte(&data[hdr+5], top);
        !          1240:   assert( top+nByte <= (int)pPage->pBt->usableSize );
        !          1241:   *pIdx = top;
        !          1242:   return SQLITE_OK;
        !          1243: }
        !          1244: 
        !          1245: /*
        !          1246: ** Return a section of the pPage->aData to the freelist.
        !          1247: ** The first byte of the new free block is pPage->aDisk[start]
        !          1248: ** and the size of the block is "size" bytes.
        !          1249: **
        !          1250: ** Most of the effort here is involved in coalesing adjacent
        !          1251: ** free blocks into a single big free block.
        !          1252: */
        !          1253: static int freeSpace(MemPage *pPage, int start, int size){
        !          1254:   int addr, pbegin, hdr;
        !          1255:   int iLast;                        /* Largest possible freeblock offset */
        !          1256:   unsigned char *data = pPage->aData;
        !          1257: 
        !          1258:   assert( pPage->pBt!=0 );
        !          1259:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
        !          1260:   assert( start>=pPage->hdrOffset+6+pPage->childPtrSize );
        !          1261:   assert( (start + size) <= (int)pPage->pBt->usableSize );
        !          1262:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !          1263:   assert( size>=0 );   /* Minimum cell size is 4 */
        !          1264: 
        !          1265:   if( pPage->pBt->btsFlags & BTS_SECURE_DELETE ){
        !          1266:     /* Overwrite deleted information with zeros when the secure_delete
        !          1267:     ** option is enabled */
        !          1268:     memset(&data[start], 0, size);
        !          1269:   }
        !          1270: 
        !          1271:   /* Add the space back into the linked list of freeblocks.  Note that
        !          1272:   ** even though the freeblock list was checked by btreeInitPage(),
        !          1273:   ** btreeInitPage() did not detect overlapping cells or
        !          1274:   ** freeblocks that overlapped cells.   Nor does it detect when the
        !          1275:   ** cell content area exceeds the value in the page header.  If these
        !          1276:   ** situations arise, then subsequent insert operations might corrupt
        !          1277:   ** the freelist.  So we do need to check for corruption while scanning
        !          1278:   ** the freelist.
        !          1279:   */
        !          1280:   hdr = pPage->hdrOffset;
        !          1281:   addr = hdr + 1;
        !          1282:   iLast = pPage->pBt->usableSize - 4;
        !          1283:   assert( start<=iLast );
        !          1284:   while( (pbegin = get2byte(&data[addr]))<start && pbegin>0 ){
        !          1285:     if( pbegin<addr+4 ){
        !          1286:       return SQLITE_CORRUPT_BKPT;
        !          1287:     }
        !          1288:     addr = pbegin;
        !          1289:   }
        !          1290:   if( pbegin>iLast ){
        !          1291:     return SQLITE_CORRUPT_BKPT;
        !          1292:   }
        !          1293:   assert( pbegin>addr || pbegin==0 );
        !          1294:   put2byte(&data[addr], start);
        !          1295:   put2byte(&data[start], pbegin);
        !          1296:   put2byte(&data[start+2], size);
        !          1297:   pPage->nFree = pPage->nFree + (u16)size;
        !          1298: 
        !          1299:   /* Coalesce adjacent free blocks */
        !          1300:   addr = hdr + 1;
        !          1301:   while( (pbegin = get2byte(&data[addr]))>0 ){
        !          1302:     int pnext, psize, x;
        !          1303:     assert( pbegin>addr );
        !          1304:     assert( pbegin <= (int)pPage->pBt->usableSize-4 );
        !          1305:     pnext = get2byte(&data[pbegin]);
        !          1306:     psize = get2byte(&data[pbegin+2]);
        !          1307:     if( pbegin + psize + 3 >= pnext && pnext>0 ){
        !          1308:       int frag = pnext - (pbegin+psize);
        !          1309:       if( (frag<0) || (frag>(int)data[hdr+7]) ){
        !          1310:         return SQLITE_CORRUPT_BKPT;
        !          1311:       }
        !          1312:       data[hdr+7] -= (u8)frag;
        !          1313:       x = get2byte(&data[pnext]);
        !          1314:       put2byte(&data[pbegin], x);
        !          1315:       x = pnext + get2byte(&data[pnext+2]) - pbegin;
        !          1316:       put2byte(&data[pbegin+2], x);
        !          1317:     }else{
        !          1318:       addr = pbegin;
        !          1319:     }
        !          1320:   }
        !          1321: 
        !          1322:   /* If the cell content area begins with a freeblock, remove it. */
        !          1323:   if( data[hdr+1]==data[hdr+5] && data[hdr+2]==data[hdr+6] ){
        !          1324:     int top;
        !          1325:     pbegin = get2byte(&data[hdr+1]);
        !          1326:     memcpy(&data[hdr+1], &data[pbegin], 2);
        !          1327:     top = get2byte(&data[hdr+5]) + get2byte(&data[pbegin+2]);
        !          1328:     put2byte(&data[hdr+5], top);
        !          1329:   }
        !          1330:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
        !          1331:   return SQLITE_OK;
        !          1332: }
        !          1333: 
        !          1334: /*
        !          1335: ** Decode the flags byte (the first byte of the header) for a page
        !          1336: ** and initialize fields of the MemPage structure accordingly.
        !          1337: **
        !          1338: ** Only the following combinations are supported.  Anything different
        !          1339: ** indicates a corrupt database files:
        !          1340: **
        !          1341: **         PTF_ZERODATA
        !          1342: **         PTF_ZERODATA | PTF_LEAF
        !          1343: **         PTF_LEAFDATA | PTF_INTKEY
        !          1344: **         PTF_LEAFDATA | PTF_INTKEY | PTF_LEAF
        !          1345: */
        !          1346: static int decodeFlags(MemPage *pPage, int flagByte){
        !          1347:   BtShared *pBt;     /* A copy of pPage->pBt */
        !          1348: 
        !          1349:   assert( pPage->hdrOffset==(pPage->pgno==1 ? 100 : 0) );
        !          1350:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !          1351:   pPage->leaf = (u8)(flagByte>>3);  assert( PTF_LEAF == 1<<3 );
        !          1352:   flagByte &= ~PTF_LEAF;
        !          1353:   pPage->childPtrSize = 4-4*pPage->leaf;
        !          1354:   pBt = pPage->pBt;
        !          1355:   if( flagByte==(PTF_LEAFDATA | PTF_INTKEY) ){
        !          1356:     pPage->intKey = 1;
        !          1357:     pPage->hasData = pPage->leaf;
        !          1358:     pPage->maxLocal = pBt->maxLeaf;
        !          1359:     pPage->minLocal = pBt->minLeaf;
        !          1360:   }else if( flagByte==PTF_ZERODATA ){
        !          1361:     pPage->intKey = 0;
        !          1362:     pPage->hasData = 0;
        !          1363:     pPage->maxLocal = pBt->maxLocal;
        !          1364:     pPage->minLocal = pBt->minLocal;
        !          1365:   }else{
        !          1366:     return SQLITE_CORRUPT_BKPT;
        !          1367:   }
        !          1368:   pPage->max1bytePayload = pBt->max1bytePayload;
        !          1369:   return SQLITE_OK;
        !          1370: }
        !          1371: 
        !          1372: /*
        !          1373: ** Initialize the auxiliary information for a disk block.
        !          1374: **
        !          1375: ** Return SQLITE_OK on success.  If we see that the page does
        !          1376: ** not contain a well-formed database page, then return 
        !          1377: ** SQLITE_CORRUPT.  Note that a return of SQLITE_OK does not
        !          1378: ** guarantee that the page is well-formed.  It only shows that
        !          1379: ** we failed to detect any corruption.
        !          1380: */
        !          1381: static int btreeInitPage(MemPage *pPage){
        !          1382: 
        !          1383:   assert( pPage->pBt!=0 );
        !          1384:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !          1385:   assert( pPage->pgno==sqlite3PagerPagenumber(pPage->pDbPage) );
        !          1386:   assert( pPage == sqlite3PagerGetExtra(pPage->pDbPage) );
        !          1387:   assert( pPage->aData == sqlite3PagerGetData(pPage->pDbPage) );
        !          1388: 
        !          1389:   if( !pPage->isInit ){
        !          1390:     u16 pc;            /* Address of a freeblock within pPage->aData[] */
        !          1391:     u8 hdr;            /* Offset to beginning of page header */
        !          1392:     u8 *data;          /* Equal to pPage->aData */
        !          1393:     BtShared *pBt;        /* The main btree structure */
        !          1394:     int usableSize;    /* Amount of usable space on each page */
        !          1395:     u16 cellOffset;    /* Offset from start of page to first cell pointer */
        !          1396:     int nFree;         /* Number of unused bytes on the page */
        !          1397:     int top;           /* First byte of the cell content area */
        !          1398:     int iCellFirst;    /* First allowable cell or freeblock offset */
        !          1399:     int iCellLast;     /* Last possible cell or freeblock offset */
        !          1400: 
        !          1401:     pBt = pPage->pBt;
        !          1402: 
        !          1403:     hdr = pPage->hdrOffset;
        !          1404:     data = pPage->aData;
        !          1405:     if( decodeFlags(pPage, data[hdr]) ) return SQLITE_CORRUPT_BKPT;
        !          1406:     assert( pBt->pageSize>=512 && pBt->pageSize<=65536 );
        !          1407:     pPage->maskPage = (u16)(pBt->pageSize - 1);
        !          1408:     pPage->nOverflow = 0;
        !          1409:     usableSize = pBt->usableSize;
        !          1410:     pPage->cellOffset = cellOffset = hdr + 12 - 4*pPage->leaf;
        !          1411:     pPage->aDataEnd = &data[usableSize];
        !          1412:     pPage->aCellIdx = &data[cellOffset];
        !          1413:     top = get2byteNotZero(&data[hdr+5]);
        !          1414:     pPage->nCell = get2byte(&data[hdr+3]);
        !          1415:     if( pPage->nCell>MX_CELL(pBt) ){
        !          1416:       /* To many cells for a single page.  The page must be corrupt */
        !          1417:       return SQLITE_CORRUPT_BKPT;
        !          1418:     }
        !          1419:     testcase( pPage->nCell==MX_CELL(pBt) );
        !          1420: 
        !          1421:     /* A malformed database page might cause us to read past the end
        !          1422:     ** of page when parsing a cell.  
        !          1423:     **
        !          1424:     ** The following block of code checks early to see if a cell extends
        !          1425:     ** past the end of a page boundary and causes SQLITE_CORRUPT to be 
        !          1426:     ** returned if it does.
        !          1427:     */
        !          1428:     iCellFirst = cellOffset + 2*pPage->nCell;
        !          1429:     iCellLast = usableSize - 4;
        !          1430: #if defined(SQLITE_ENABLE_OVERSIZE_CELL_CHECK)
        !          1431:     {
        !          1432:       int i;            /* Index into the cell pointer array */
        !          1433:       int sz;           /* Size of a cell */
        !          1434: 
        !          1435:       if( !pPage->leaf ) iCellLast--;
        !          1436:       for(i=0; i<pPage->nCell; i++){
        !          1437:         pc = get2byte(&data[cellOffset+i*2]);
        !          1438:         testcase( pc==iCellFirst );
        !          1439:         testcase( pc==iCellLast );
        !          1440:         if( pc<iCellFirst || pc>iCellLast ){
        !          1441:           return SQLITE_CORRUPT_BKPT;
        !          1442:         }
        !          1443:         sz = cellSizePtr(pPage, &data[pc]);
        !          1444:         testcase( pc+sz==usableSize );
        !          1445:         if( pc+sz>usableSize ){
        !          1446:           return SQLITE_CORRUPT_BKPT;
        !          1447:         }
        !          1448:       }
        !          1449:       if( !pPage->leaf ) iCellLast++;
        !          1450:     }  
        !          1451: #endif
        !          1452: 
        !          1453:     /* Compute the total free space on the page */
        !          1454:     pc = get2byte(&data[hdr+1]);
        !          1455:     nFree = data[hdr+7] + top;
        !          1456:     while( pc>0 ){
        !          1457:       u16 next, size;
        !          1458:       if( pc<iCellFirst || pc>iCellLast ){
        !          1459:         /* Start of free block is off the page */
        !          1460:         return SQLITE_CORRUPT_BKPT; 
        !          1461:       }
        !          1462:       next = get2byte(&data[pc]);
        !          1463:       size = get2byte(&data[pc+2]);
        !          1464:       if( (next>0 && next<=pc+size+3) || pc+size>usableSize ){
        !          1465:         /* Free blocks must be in ascending order. And the last byte of
        !          1466:        ** the free-block must lie on the database page.  */
        !          1467:         return SQLITE_CORRUPT_BKPT; 
        !          1468:       }
        !          1469:       nFree = nFree + size;
        !          1470:       pc = next;
        !          1471:     }
        !          1472: 
        !          1473:     /* At this point, nFree contains the sum of the offset to the start
        !          1474:     ** of the cell-content area plus the number of free bytes within
        !          1475:     ** the cell-content area. If this is greater than the usable-size
        !          1476:     ** of the page, then the page must be corrupted. This check also
        !          1477:     ** serves to verify that the offset to the start of the cell-content
        !          1478:     ** area, according to the page header, lies within the page.
        !          1479:     */
        !          1480:     if( nFree>usableSize ){
        !          1481:       return SQLITE_CORRUPT_BKPT; 
        !          1482:     }
        !          1483:     pPage->nFree = (u16)(nFree - iCellFirst);
        !          1484:     pPage->isInit = 1;
        !          1485:   }
        !          1486:   return SQLITE_OK;
        !          1487: }
        !          1488: 
        !          1489: /*
        !          1490: ** Set up a raw page so that it looks like a database page holding
        !          1491: ** no entries.
        !          1492: */
        !          1493: static void zeroPage(MemPage *pPage, int flags){
        !          1494:   unsigned char *data = pPage->aData;
        !          1495:   BtShared *pBt = pPage->pBt;
        !          1496:   u8 hdr = pPage->hdrOffset;
        !          1497:   u16 first;
        !          1498: 
        !          1499:   assert( sqlite3PagerPagenumber(pPage->pDbPage)==pPage->pgno );
        !          1500:   assert( sqlite3PagerGetExtra(pPage->pDbPage) == (void*)pPage );
        !          1501:   assert( sqlite3PagerGetData(pPage->pDbPage) == data );
        !          1502:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
        !          1503:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          1504:   if( pBt->btsFlags & BTS_SECURE_DELETE ){
        !          1505:     memset(&data[hdr], 0, pBt->usableSize - hdr);
        !          1506:   }
        !          1507:   data[hdr] = (char)flags;
        !          1508:   first = hdr + 8 + 4*((flags&PTF_LEAF)==0 ?1:0);
        !          1509:   memset(&data[hdr+1], 0, 4);
        !          1510:   data[hdr+7] = 0;
        !          1511:   put2byte(&data[hdr+5], pBt->usableSize);
        !          1512:   pPage->nFree = (u16)(pBt->usableSize - first);
        !          1513:   decodeFlags(pPage, flags);
        !          1514:   pPage->hdrOffset = hdr;
        !          1515:   pPage->cellOffset = first;
        !          1516:   pPage->aDataEnd = &data[pBt->usableSize];
        !          1517:   pPage->aCellIdx = &data[first];
        !          1518:   pPage->nOverflow = 0;
        !          1519:   assert( pBt->pageSize>=512 && pBt->pageSize<=65536 );
        !          1520:   pPage->maskPage = (u16)(pBt->pageSize - 1);
        !          1521:   pPage->nCell = 0;
        !          1522:   pPage->isInit = 1;
        !          1523: }
        !          1524: 
        !          1525: 
        !          1526: /*
        !          1527: ** Convert a DbPage obtained from the pager into a MemPage used by
        !          1528: ** the btree layer.
        !          1529: */
        !          1530: static MemPage *btreePageFromDbPage(DbPage *pDbPage, Pgno pgno, BtShared *pBt){
        !          1531:   MemPage *pPage = (MemPage*)sqlite3PagerGetExtra(pDbPage);
        !          1532:   pPage->aData = sqlite3PagerGetData(pDbPage);
        !          1533:   pPage->pDbPage = pDbPage;
        !          1534:   pPage->pBt = pBt;
        !          1535:   pPage->pgno = pgno;
        !          1536:   pPage->hdrOffset = pPage->pgno==1 ? 100 : 0;
        !          1537:   return pPage; 
        !          1538: }
        !          1539: 
        !          1540: /*
        !          1541: ** Get a page from the pager.  Initialize the MemPage.pBt and
        !          1542: ** MemPage.aData elements if needed.
        !          1543: **
        !          1544: ** If the noContent flag is set, it means that we do not care about
        !          1545: ** the content of the page at this time.  So do not go to the disk
        !          1546: ** to fetch the content.  Just fill in the content with zeros for now.
        !          1547: ** If in the future we call sqlite3PagerWrite() on this page, that
        !          1548: ** means we have started to be concerned about content and the disk
        !          1549: ** read should occur at that point.
        !          1550: */
        !          1551: static int btreeGetPage(
        !          1552:   BtShared *pBt,       /* The btree */
        !          1553:   Pgno pgno,           /* Number of the page to fetch */
        !          1554:   MemPage **ppPage,    /* Return the page in this parameter */
        !          1555:   int noContent        /* Do not load page content if true */
        !          1556: ){
        !          1557:   int rc;
        !          1558:   DbPage *pDbPage;
        !          1559: 
        !          1560:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          1561:   rc = sqlite3PagerAcquire(pBt->pPager, pgno, (DbPage**)&pDbPage, noContent);
        !          1562:   if( rc ) return rc;
        !          1563:   *ppPage = btreePageFromDbPage(pDbPage, pgno, pBt);
        !          1564:   return SQLITE_OK;
        !          1565: }
        !          1566: 
        !          1567: /*
        !          1568: ** Retrieve a page from the pager cache. If the requested page is not
        !          1569: ** already in the pager cache return NULL. Initialize the MemPage.pBt and
        !          1570: ** MemPage.aData elements if needed.
        !          1571: */
        !          1572: static MemPage *btreePageLookup(BtShared *pBt, Pgno pgno){
        !          1573:   DbPage *pDbPage;
        !          1574:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          1575:   pDbPage = sqlite3PagerLookup(pBt->pPager, pgno);
        !          1576:   if( pDbPage ){
        !          1577:     return btreePageFromDbPage(pDbPage, pgno, pBt);
        !          1578:   }
        !          1579:   return 0;
        !          1580: }
        !          1581: 
        !          1582: /*
        !          1583: ** Return the size of the database file in pages. If there is any kind of
        !          1584: ** error, return ((unsigned int)-1).
        !          1585: */
        !          1586: static Pgno btreePagecount(BtShared *pBt){
        !          1587:   return pBt->nPage;
        !          1588: }
        !          1589: u32 sqlite3BtreeLastPage(Btree *p){
        !          1590:   assert( sqlite3BtreeHoldsMutex(p) );
        !          1591:   assert( ((p->pBt->nPage)&0x8000000)==0 );
        !          1592:   return (int)btreePagecount(p->pBt);
        !          1593: }
        !          1594: 
        !          1595: /*
        !          1596: ** Get a page from the pager and initialize it.  This routine is just a
        !          1597: ** convenience wrapper around separate calls to btreeGetPage() and 
        !          1598: ** btreeInitPage().
        !          1599: **
        !          1600: ** If an error occurs, then the value *ppPage is set to is undefined. It
        !          1601: ** may remain unchanged, or it may be set to an invalid value.
        !          1602: */
        !          1603: static int getAndInitPage(
        !          1604:   BtShared *pBt,          /* The database file */
        !          1605:   Pgno pgno,           /* Number of the page to get */
        !          1606:   MemPage **ppPage     /* Write the page pointer here */
        !          1607: ){
        !          1608:   int rc;
        !          1609:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          1610: 
        !          1611:   if( pgno>btreePagecount(pBt) ){
        !          1612:     rc = SQLITE_CORRUPT_BKPT;
        !          1613:   }else{
        !          1614:     rc = btreeGetPage(pBt, pgno, ppPage, 0);
        !          1615:     if( rc==SQLITE_OK ){
        !          1616:       rc = btreeInitPage(*ppPage);
        !          1617:       if( rc!=SQLITE_OK ){
        !          1618:         releasePage(*ppPage);
        !          1619:       }
        !          1620:     }
        !          1621:   }
        !          1622: 
        !          1623:   testcase( pgno==0 );
        !          1624:   assert( pgno!=0 || rc==SQLITE_CORRUPT );
        !          1625:   return rc;
        !          1626: }
        !          1627: 
        !          1628: /*
        !          1629: ** Release a MemPage.  This should be called once for each prior
        !          1630: ** call to btreeGetPage.
        !          1631: */
        !          1632: static void releasePage(MemPage *pPage){
        !          1633:   if( pPage ){
        !          1634:     assert( pPage->aData );
        !          1635:     assert( pPage->pBt );
        !          1636:     assert( sqlite3PagerGetExtra(pPage->pDbPage) == (void*)pPage );
        !          1637:     assert( sqlite3PagerGetData(pPage->pDbPage)==pPage->aData );
        !          1638:     assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !          1639:     sqlite3PagerUnref(pPage->pDbPage);
        !          1640:   }
        !          1641: }
        !          1642: 
        !          1643: /*
        !          1644: ** During a rollback, when the pager reloads information into the cache
        !          1645: ** so that the cache is restored to its original state at the start of
        !          1646: ** the transaction, for each page restored this routine is called.
        !          1647: **
        !          1648: ** This routine needs to reset the extra data section at the end of the
        !          1649: ** page to agree with the restored data.
        !          1650: */
        !          1651: static void pageReinit(DbPage *pData){
        !          1652:   MemPage *pPage;
        !          1653:   pPage = (MemPage *)sqlite3PagerGetExtra(pData);
        !          1654:   assert( sqlite3PagerPageRefcount(pData)>0 );
        !          1655:   if( pPage->isInit ){
        !          1656:     assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !          1657:     pPage->isInit = 0;
        !          1658:     if( sqlite3PagerPageRefcount(pData)>1 ){
        !          1659:       /* pPage might not be a btree page;  it might be an overflow page
        !          1660:       ** or ptrmap page or a free page.  In those cases, the following
        !          1661:       ** call to btreeInitPage() will likely return SQLITE_CORRUPT.
        !          1662:       ** But no harm is done by this.  And it is very important that
        !          1663:       ** btreeInitPage() be called on every btree page so we make
        !          1664:       ** the call for every page that comes in for re-initing. */
        !          1665:       btreeInitPage(pPage);
        !          1666:     }
        !          1667:   }
        !          1668: }
        !          1669: 
        !          1670: /*
        !          1671: ** Invoke the busy handler for a btree.
        !          1672: */
        !          1673: static int btreeInvokeBusyHandler(void *pArg){
        !          1674:   BtShared *pBt = (BtShared*)pArg;
        !          1675:   assert( pBt->db );
        !          1676:   assert( sqlite3_mutex_held(pBt->db->mutex) );
        !          1677:   return sqlite3InvokeBusyHandler(&pBt->db->busyHandler);
        !          1678: }
        !          1679: 
        !          1680: /*
        !          1681: ** Open a database file.
        !          1682: ** 
        !          1683: ** zFilename is the name of the database file.  If zFilename is NULL
        !          1684: ** then an ephemeral database is created.  The ephemeral database might
        !          1685: ** be exclusively in memory, or it might use a disk-based memory cache.
        !          1686: ** Either way, the ephemeral database will be automatically deleted 
        !          1687: ** when sqlite3BtreeClose() is called.
        !          1688: **
        !          1689: ** If zFilename is ":memory:" then an in-memory database is created
        !          1690: ** that is automatically destroyed when it is closed.
        !          1691: **
        !          1692: ** The "flags" parameter is a bitmask that might contain bits
        !          1693: ** BTREE_OMIT_JOURNAL and/or BTREE_NO_READLOCK.  The BTREE_NO_READLOCK
        !          1694: ** bit is also set if the SQLITE_NoReadlock flags is set in db->flags.
        !          1695: ** These flags are passed through into sqlite3PagerOpen() and must
        !          1696: ** be the same values as PAGER_OMIT_JOURNAL and PAGER_NO_READLOCK.
        !          1697: **
        !          1698: ** If the database is already opened in the same database connection
        !          1699: ** and we are in shared cache mode, then the open will fail with an
        !          1700: ** SQLITE_CONSTRAINT error.  We cannot allow two or more BtShared
        !          1701: ** objects in the same database connection since doing so will lead
        !          1702: ** to problems with locking.
        !          1703: */
        !          1704: int sqlite3BtreeOpen(
        !          1705:   sqlite3_vfs *pVfs,      /* VFS to use for this b-tree */
        !          1706:   const char *zFilename,  /* Name of the file containing the BTree database */
        !          1707:   sqlite3 *db,            /* Associated database handle */
        !          1708:   Btree **ppBtree,        /* Pointer to new Btree object written here */
        !          1709:   int flags,              /* Options */
        !          1710:   int vfsFlags            /* Flags passed through to sqlite3_vfs.xOpen() */
        !          1711: ){
        !          1712:   BtShared *pBt = 0;             /* Shared part of btree structure */
        !          1713:   Btree *p;                      /* Handle to return */
        !          1714:   sqlite3_mutex *mutexOpen = 0;  /* Prevents a race condition. Ticket #3537 */
        !          1715:   int rc = SQLITE_OK;            /* Result code from this function */
        !          1716:   u8 nReserve;                   /* Byte of unused space on each page */
        !          1717:   unsigned char zDbHeader[100];  /* Database header content */
        !          1718: 
        !          1719:   /* True if opening an ephemeral, temporary database */
        !          1720:   const int isTempDb = zFilename==0 || zFilename[0]==0;
        !          1721: 
        !          1722:   /* Set the variable isMemdb to true for an in-memory database, or 
        !          1723:   ** false for a file-based database.
        !          1724:   */
        !          1725: #ifdef SQLITE_OMIT_MEMORYDB
        !          1726:   const int isMemdb = 0;
        !          1727: #else
        !          1728:   const int isMemdb = (zFilename && strcmp(zFilename, ":memory:")==0)
        !          1729:                        || (isTempDb && sqlite3TempInMemory(db));
        !          1730: #endif
        !          1731: 
        !          1732:   assert( db!=0 );
        !          1733:   assert( pVfs!=0 );
        !          1734:   assert( sqlite3_mutex_held(db->mutex) );
        !          1735:   assert( (flags&0xff)==flags );   /* flags fit in 8 bits */
        !          1736: 
        !          1737:   /* Only a BTREE_SINGLE database can be BTREE_UNORDERED */
        !          1738:   assert( (flags & BTREE_UNORDERED)==0 || (flags & BTREE_SINGLE)!=0 );
        !          1739: 
        !          1740:   /* A BTREE_SINGLE database is always a temporary and/or ephemeral */
        !          1741:   assert( (flags & BTREE_SINGLE)==0 || isTempDb );
        !          1742: 
        !          1743:   if( db->flags & SQLITE_NoReadlock ){
        !          1744:     flags |= BTREE_NO_READLOCK;
        !          1745:   }
        !          1746:   if( isMemdb ){
        !          1747:     flags |= BTREE_MEMORY;
        !          1748:   }
        !          1749:   if( (vfsFlags & SQLITE_OPEN_MAIN_DB)!=0 && (isMemdb || isTempDb) ){
        !          1750:     vfsFlags = (vfsFlags & ~SQLITE_OPEN_MAIN_DB) | SQLITE_OPEN_TEMP_DB;
        !          1751:   }
        !          1752:   p = sqlite3MallocZero(sizeof(Btree));
        !          1753:   if( !p ){
        !          1754:     return SQLITE_NOMEM;
        !          1755:   }
        !          1756:   p->inTrans = TRANS_NONE;
        !          1757:   p->db = db;
        !          1758: #ifndef SQLITE_OMIT_SHARED_CACHE
        !          1759:   p->lock.pBtree = p;
        !          1760:   p->lock.iTable = 1;
        !          1761: #endif
        !          1762: 
        !          1763: #if !defined(SQLITE_OMIT_SHARED_CACHE) && !defined(SQLITE_OMIT_DISKIO)
        !          1764:   /*
        !          1765:   ** If this Btree is a candidate for shared cache, try to find an
        !          1766:   ** existing BtShared object that we can share with
        !          1767:   */
        !          1768:   if( isMemdb==0 && isTempDb==0 ){
        !          1769:     if( vfsFlags & SQLITE_OPEN_SHAREDCACHE ){
        !          1770:       int nFullPathname = pVfs->mxPathname+1;
        !          1771:       char *zFullPathname = sqlite3Malloc(nFullPathname);
        !          1772:       MUTEX_LOGIC( sqlite3_mutex *mutexShared; )
        !          1773:       p->sharable = 1;
        !          1774:       if( !zFullPathname ){
        !          1775:         sqlite3_free(p);
        !          1776:         return SQLITE_NOMEM;
        !          1777:       }
        !          1778:       rc = sqlite3OsFullPathname(pVfs, zFilename, nFullPathname, zFullPathname);
        !          1779:       if( rc ){
        !          1780:         sqlite3_free(zFullPathname);
        !          1781:         sqlite3_free(p);
        !          1782:         return rc;
        !          1783:       }
        !          1784: #if SQLITE_THREADSAFE
        !          1785:       mutexOpen = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_OPEN);
        !          1786:       sqlite3_mutex_enter(mutexOpen);
        !          1787:       mutexShared = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER);
        !          1788:       sqlite3_mutex_enter(mutexShared);
        !          1789: #endif
        !          1790:       for(pBt=GLOBAL(BtShared*,sqlite3SharedCacheList); pBt; pBt=pBt->pNext){
        !          1791:         assert( pBt->nRef>0 );
        !          1792:         if( 0==strcmp(zFullPathname, sqlite3PagerFilename(pBt->pPager))
        !          1793:                  && sqlite3PagerVfs(pBt->pPager)==pVfs ){
        !          1794:           int iDb;
        !          1795:           for(iDb=db->nDb-1; iDb>=0; iDb--){
        !          1796:             Btree *pExisting = db->aDb[iDb].pBt;
        !          1797:             if( pExisting && pExisting->pBt==pBt ){
        !          1798:               sqlite3_mutex_leave(mutexShared);
        !          1799:               sqlite3_mutex_leave(mutexOpen);
        !          1800:               sqlite3_free(zFullPathname);
        !          1801:               sqlite3_free(p);
        !          1802:               return SQLITE_CONSTRAINT;
        !          1803:             }
        !          1804:           }
        !          1805:           p->pBt = pBt;
        !          1806:           pBt->nRef++;
        !          1807:           break;
        !          1808:         }
        !          1809:       }
        !          1810:       sqlite3_mutex_leave(mutexShared);
        !          1811:       sqlite3_free(zFullPathname);
        !          1812:     }
        !          1813: #ifdef SQLITE_DEBUG
        !          1814:     else{
        !          1815:       /* In debug mode, we mark all persistent databases as sharable
        !          1816:       ** even when they are not.  This exercises the locking code and
        !          1817:       ** gives more opportunity for asserts(sqlite3_mutex_held())
        !          1818:       ** statements to find locking problems.
        !          1819:       */
        !          1820:       p->sharable = 1;
        !          1821:     }
        !          1822: #endif
        !          1823:   }
        !          1824: #endif
        !          1825:   if( pBt==0 ){
        !          1826:     /*
        !          1827:     ** The following asserts make sure that structures used by the btree are
        !          1828:     ** the right size.  This is to guard against size changes that result
        !          1829:     ** when compiling on a different architecture.
        !          1830:     */
        !          1831:     assert( sizeof(i64)==8 || sizeof(i64)==4 );
        !          1832:     assert( sizeof(u64)==8 || sizeof(u64)==4 );
        !          1833:     assert( sizeof(u32)==4 );
        !          1834:     assert( sizeof(u16)==2 );
        !          1835:     assert( sizeof(Pgno)==4 );
        !          1836:   
        !          1837:     pBt = sqlite3MallocZero( sizeof(*pBt) );
        !          1838:     if( pBt==0 ){
        !          1839:       rc = SQLITE_NOMEM;
        !          1840:       goto btree_open_out;
        !          1841:     }
        !          1842:     rc = sqlite3PagerOpen(pVfs, &pBt->pPager, zFilename,
        !          1843:                           EXTRA_SIZE, flags, vfsFlags, pageReinit);
        !          1844:     if( rc==SQLITE_OK ){
        !          1845:       rc = sqlite3PagerReadFileheader(pBt->pPager,sizeof(zDbHeader),zDbHeader);
        !          1846:     }
        !          1847:     if( rc!=SQLITE_OK ){
        !          1848:       goto btree_open_out;
        !          1849:     }
        !          1850:     pBt->openFlags = (u8)flags;
        !          1851:     pBt->db = db;
        !          1852:     sqlite3PagerSetBusyhandler(pBt->pPager, btreeInvokeBusyHandler, pBt);
        !          1853:     p->pBt = pBt;
        !          1854:   
        !          1855:     pBt->pCursor = 0;
        !          1856:     pBt->pPage1 = 0;
        !          1857:     if( sqlite3PagerIsreadonly(pBt->pPager) ) pBt->btsFlags |= BTS_READ_ONLY;
        !          1858: #ifdef SQLITE_SECURE_DELETE
        !          1859:     pBt->btsFlags |= BTS_SECURE_DELETE;
        !          1860: #endif
        !          1861:     pBt->pageSize = (zDbHeader[16]<<8) | (zDbHeader[17]<<16);
        !          1862:     if( pBt->pageSize<512 || pBt->pageSize>SQLITE_MAX_PAGE_SIZE
        !          1863:          || ((pBt->pageSize-1)&pBt->pageSize)!=0 ){
        !          1864:       pBt->pageSize = 0;
        !          1865: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          1866:       /* If the magic name ":memory:" will create an in-memory database, then
        !          1867:       ** leave the autoVacuum mode at 0 (do not auto-vacuum), even if
        !          1868:       ** SQLITE_DEFAULT_AUTOVACUUM is true. On the other hand, if
        !          1869:       ** SQLITE_OMIT_MEMORYDB has been defined, then ":memory:" is just a
        !          1870:       ** regular file-name. In this case the auto-vacuum applies as per normal.
        !          1871:       */
        !          1872:       if( zFilename && !isMemdb ){
        !          1873:         pBt->autoVacuum = (SQLITE_DEFAULT_AUTOVACUUM ? 1 : 0);
        !          1874:         pBt->incrVacuum = (SQLITE_DEFAULT_AUTOVACUUM==2 ? 1 : 0);
        !          1875:       }
        !          1876: #endif
        !          1877:       nReserve = 0;
        !          1878:     }else{
        !          1879:       nReserve = zDbHeader[20];
        !          1880:       pBt->btsFlags |= BTS_PAGESIZE_FIXED;
        !          1881: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          1882:       pBt->autoVacuum = (get4byte(&zDbHeader[36 + 4*4])?1:0);
        !          1883:       pBt->incrVacuum = (get4byte(&zDbHeader[36 + 7*4])?1:0);
        !          1884: #endif
        !          1885:     }
        !          1886:     rc = sqlite3PagerSetPagesize(pBt->pPager, &pBt->pageSize, nReserve);
        !          1887:     if( rc ) goto btree_open_out;
        !          1888:     pBt->usableSize = pBt->pageSize - nReserve;
        !          1889:     assert( (pBt->pageSize & 7)==0 );  /* 8-byte alignment of pageSize */
        !          1890:    
        !          1891: #if !defined(SQLITE_OMIT_SHARED_CACHE) && !defined(SQLITE_OMIT_DISKIO)
        !          1892:     /* Add the new BtShared object to the linked list sharable BtShareds.
        !          1893:     */
        !          1894:     if( p->sharable ){
        !          1895:       MUTEX_LOGIC( sqlite3_mutex *mutexShared; )
        !          1896:       pBt->nRef = 1;
        !          1897:       MUTEX_LOGIC( mutexShared = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER);)
        !          1898:       if( SQLITE_THREADSAFE && sqlite3GlobalConfig.bCoreMutex ){
        !          1899:         pBt->mutex = sqlite3MutexAlloc(SQLITE_MUTEX_FAST);
        !          1900:         if( pBt->mutex==0 ){
        !          1901:           rc = SQLITE_NOMEM;
        !          1902:           db->mallocFailed = 0;
        !          1903:           goto btree_open_out;
        !          1904:         }
        !          1905:       }
        !          1906:       sqlite3_mutex_enter(mutexShared);
        !          1907:       pBt->pNext = GLOBAL(BtShared*,sqlite3SharedCacheList);
        !          1908:       GLOBAL(BtShared*,sqlite3SharedCacheList) = pBt;
        !          1909:       sqlite3_mutex_leave(mutexShared);
        !          1910:     }
        !          1911: #endif
        !          1912:   }
        !          1913: 
        !          1914: #if !defined(SQLITE_OMIT_SHARED_CACHE) && !defined(SQLITE_OMIT_DISKIO)
        !          1915:   /* If the new Btree uses a sharable pBtShared, then link the new
        !          1916:   ** Btree into the list of all sharable Btrees for the same connection.
        !          1917:   ** The list is kept in ascending order by pBt address.
        !          1918:   */
        !          1919:   if( p->sharable ){
        !          1920:     int i;
        !          1921:     Btree *pSib;
        !          1922:     for(i=0; i<db->nDb; i++){
        !          1923:       if( (pSib = db->aDb[i].pBt)!=0 && pSib->sharable ){
        !          1924:         while( pSib->pPrev ){ pSib = pSib->pPrev; }
        !          1925:         if( p->pBt<pSib->pBt ){
        !          1926:           p->pNext = pSib;
        !          1927:           p->pPrev = 0;
        !          1928:           pSib->pPrev = p;
        !          1929:         }else{
        !          1930:           while( pSib->pNext && pSib->pNext->pBt<p->pBt ){
        !          1931:             pSib = pSib->pNext;
        !          1932:           }
        !          1933:           p->pNext = pSib->pNext;
        !          1934:           p->pPrev = pSib;
        !          1935:           if( p->pNext ){
        !          1936:             p->pNext->pPrev = p;
        !          1937:           }
        !          1938:           pSib->pNext = p;
        !          1939:         }
        !          1940:         break;
        !          1941:       }
        !          1942:     }
        !          1943:   }
        !          1944: #endif
        !          1945:   *ppBtree = p;
        !          1946: 
        !          1947: btree_open_out:
        !          1948:   if( rc!=SQLITE_OK ){
        !          1949:     if( pBt && pBt->pPager ){
        !          1950:       sqlite3PagerClose(pBt->pPager);
        !          1951:     }
        !          1952:     sqlite3_free(pBt);
        !          1953:     sqlite3_free(p);
        !          1954:     *ppBtree = 0;
        !          1955:   }else{
        !          1956:     /* If the B-Tree was successfully opened, set the pager-cache size to the
        !          1957:     ** default value. Except, when opening on an existing shared pager-cache,
        !          1958:     ** do not change the pager-cache size.
        !          1959:     */
        !          1960:     if( sqlite3BtreeSchema(p, 0, 0)==0 ){
        !          1961:       sqlite3PagerSetCachesize(p->pBt->pPager, SQLITE_DEFAULT_CACHE_SIZE);
        !          1962:     }
        !          1963:   }
        !          1964:   if( mutexOpen ){
        !          1965:     assert( sqlite3_mutex_held(mutexOpen) );
        !          1966:     sqlite3_mutex_leave(mutexOpen);
        !          1967:   }
        !          1968:   return rc;
        !          1969: }
        !          1970: 
        !          1971: /*
        !          1972: ** Decrement the BtShared.nRef counter.  When it reaches zero,
        !          1973: ** remove the BtShared structure from the sharing list.  Return
        !          1974: ** true if the BtShared.nRef counter reaches zero and return
        !          1975: ** false if it is still positive.
        !          1976: */
        !          1977: static int removeFromSharingList(BtShared *pBt){
        !          1978: #ifndef SQLITE_OMIT_SHARED_CACHE
        !          1979:   MUTEX_LOGIC( sqlite3_mutex *pMaster; )
        !          1980:   BtShared *pList;
        !          1981:   int removed = 0;
        !          1982: 
        !          1983:   assert( sqlite3_mutex_notheld(pBt->mutex) );
        !          1984:   MUTEX_LOGIC( pMaster = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER); )
        !          1985:   sqlite3_mutex_enter(pMaster);
        !          1986:   pBt->nRef--;
        !          1987:   if( pBt->nRef<=0 ){
        !          1988:     if( GLOBAL(BtShared*,sqlite3SharedCacheList)==pBt ){
        !          1989:       GLOBAL(BtShared*,sqlite3SharedCacheList) = pBt->pNext;
        !          1990:     }else{
        !          1991:       pList = GLOBAL(BtShared*,sqlite3SharedCacheList);
        !          1992:       while( ALWAYS(pList) && pList->pNext!=pBt ){
        !          1993:         pList=pList->pNext;
        !          1994:       }
        !          1995:       if( ALWAYS(pList) ){
        !          1996:         pList->pNext = pBt->pNext;
        !          1997:       }
        !          1998:     }
        !          1999:     if( SQLITE_THREADSAFE ){
        !          2000:       sqlite3_mutex_free(pBt->mutex);
        !          2001:     }
        !          2002:     removed = 1;
        !          2003:   }
        !          2004:   sqlite3_mutex_leave(pMaster);
        !          2005:   return removed;
        !          2006: #else
        !          2007:   return 1;
        !          2008: #endif
        !          2009: }
        !          2010: 
        !          2011: /*
        !          2012: ** Make sure pBt->pTmpSpace points to an allocation of 
        !          2013: ** MX_CELL_SIZE(pBt) bytes.
        !          2014: */
        !          2015: static void allocateTempSpace(BtShared *pBt){
        !          2016:   if( !pBt->pTmpSpace ){
        !          2017:     pBt->pTmpSpace = sqlite3PageMalloc( pBt->pageSize );
        !          2018:   }
        !          2019: }
        !          2020: 
        !          2021: /*
        !          2022: ** Free the pBt->pTmpSpace allocation
        !          2023: */
        !          2024: static void freeTempSpace(BtShared *pBt){
        !          2025:   sqlite3PageFree( pBt->pTmpSpace);
        !          2026:   pBt->pTmpSpace = 0;
        !          2027: }
        !          2028: 
        !          2029: /*
        !          2030: ** Close an open database and invalidate all cursors.
        !          2031: */
        !          2032: int sqlite3BtreeClose(Btree *p){
        !          2033:   BtShared *pBt = p->pBt;
        !          2034:   BtCursor *pCur;
        !          2035: 
        !          2036:   /* Close all cursors opened via this handle.  */
        !          2037:   assert( sqlite3_mutex_held(p->db->mutex) );
        !          2038:   sqlite3BtreeEnter(p);
        !          2039:   pCur = pBt->pCursor;
        !          2040:   while( pCur ){
        !          2041:     BtCursor *pTmp = pCur;
        !          2042:     pCur = pCur->pNext;
        !          2043:     if( pTmp->pBtree==p ){
        !          2044:       sqlite3BtreeCloseCursor(pTmp);
        !          2045:     }
        !          2046:   }
        !          2047: 
        !          2048:   /* Rollback any active transaction and free the handle structure.
        !          2049:   ** The call to sqlite3BtreeRollback() drops any table-locks held by
        !          2050:   ** this handle.
        !          2051:   */
        !          2052:   sqlite3BtreeRollback(p);
        !          2053:   sqlite3BtreeLeave(p);
        !          2054: 
        !          2055:   /* If there are still other outstanding references to the shared-btree
        !          2056:   ** structure, return now. The remainder of this procedure cleans 
        !          2057:   ** up the shared-btree.
        !          2058:   */
        !          2059:   assert( p->wantToLock==0 && p->locked==0 );
        !          2060:   if( !p->sharable || removeFromSharingList(pBt) ){
        !          2061:     /* The pBt is no longer on the sharing list, so we can access
        !          2062:     ** it without having to hold the mutex.
        !          2063:     **
        !          2064:     ** Clean out and delete the BtShared object.
        !          2065:     */
        !          2066:     assert( !pBt->pCursor );
        !          2067:     sqlite3PagerClose(pBt->pPager);
        !          2068:     if( pBt->xFreeSchema && pBt->pSchema ){
        !          2069:       pBt->xFreeSchema(pBt->pSchema);
        !          2070:     }
        !          2071:     sqlite3DbFree(0, pBt->pSchema);
        !          2072:     freeTempSpace(pBt);
        !          2073:     sqlite3_free(pBt);
        !          2074:   }
        !          2075: 
        !          2076: #ifndef SQLITE_OMIT_SHARED_CACHE
        !          2077:   assert( p->wantToLock==0 );
        !          2078:   assert( p->locked==0 );
        !          2079:   if( p->pPrev ) p->pPrev->pNext = p->pNext;
        !          2080:   if( p->pNext ) p->pNext->pPrev = p->pPrev;
        !          2081: #endif
        !          2082: 
        !          2083:   sqlite3_free(p);
        !          2084:   return SQLITE_OK;
        !          2085: }
        !          2086: 
        !          2087: /*
        !          2088: ** Change the limit on the number of pages allowed in the cache.
        !          2089: **
        !          2090: ** The maximum number of cache pages is set to the absolute
        !          2091: ** value of mxPage.  If mxPage is negative, the pager will
        !          2092: ** operate asynchronously - it will not stop to do fsync()s
        !          2093: ** to insure data is written to the disk surface before
        !          2094: ** continuing.  Transactions still work if synchronous is off,
        !          2095: ** and the database cannot be corrupted if this program
        !          2096: ** crashes.  But if the operating system crashes or there is
        !          2097: ** an abrupt power failure when synchronous is off, the database
        !          2098: ** could be left in an inconsistent and unrecoverable state.
        !          2099: ** Synchronous is on by default so database corruption is not
        !          2100: ** normally a worry.
        !          2101: */
        !          2102: int sqlite3BtreeSetCacheSize(Btree *p, int mxPage){
        !          2103:   BtShared *pBt = p->pBt;
        !          2104:   assert( sqlite3_mutex_held(p->db->mutex) );
        !          2105:   sqlite3BtreeEnter(p);
        !          2106:   sqlite3PagerSetCachesize(pBt->pPager, mxPage);
        !          2107:   sqlite3BtreeLeave(p);
        !          2108:   return SQLITE_OK;
        !          2109: }
        !          2110: 
        !          2111: /*
        !          2112: ** Change the way data is synced to disk in order to increase or decrease
        !          2113: ** how well the database resists damage due to OS crashes and power
        !          2114: ** failures.  Level 1 is the same as asynchronous (no syncs() occur and
        !          2115: ** there is a high probability of damage)  Level 2 is the default.  There
        !          2116: ** is a very low but non-zero probability of damage.  Level 3 reduces the
        !          2117: ** probability of damage to near zero but with a write performance reduction.
        !          2118: */
        !          2119: #ifndef SQLITE_OMIT_PAGER_PRAGMAS
        !          2120: int sqlite3BtreeSetSafetyLevel(
        !          2121:   Btree *p,              /* The btree to set the safety level on */
        !          2122:   int level,             /* PRAGMA synchronous.  1=OFF, 2=NORMAL, 3=FULL */
        !          2123:   int fullSync,          /* PRAGMA fullfsync. */
        !          2124:   int ckptFullSync       /* PRAGMA checkpoint_fullfync */
        !          2125: ){
        !          2126:   BtShared *pBt = p->pBt;
        !          2127:   assert( sqlite3_mutex_held(p->db->mutex) );
        !          2128:   assert( level>=1 && level<=3 );
        !          2129:   sqlite3BtreeEnter(p);
        !          2130:   sqlite3PagerSetSafetyLevel(pBt->pPager, level, fullSync, ckptFullSync);
        !          2131:   sqlite3BtreeLeave(p);
        !          2132:   return SQLITE_OK;
        !          2133: }
        !          2134: #endif
        !          2135: 
        !          2136: /*
        !          2137: ** Return TRUE if the given btree is set to safety level 1.  In other
        !          2138: ** words, return TRUE if no sync() occurs on the disk files.
        !          2139: */
        !          2140: int sqlite3BtreeSyncDisabled(Btree *p){
        !          2141:   BtShared *pBt = p->pBt;
        !          2142:   int rc;
        !          2143:   assert( sqlite3_mutex_held(p->db->mutex) );  
        !          2144:   sqlite3BtreeEnter(p);
        !          2145:   assert( pBt && pBt->pPager );
        !          2146:   rc = sqlite3PagerNosync(pBt->pPager);
        !          2147:   sqlite3BtreeLeave(p);
        !          2148:   return rc;
        !          2149: }
        !          2150: 
        !          2151: /*
        !          2152: ** Change the default pages size and the number of reserved bytes per page.
        !          2153: ** Or, if the page size has already been fixed, return SQLITE_READONLY 
        !          2154: ** without changing anything.
        !          2155: **
        !          2156: ** The page size must be a power of 2 between 512 and 65536.  If the page
        !          2157: ** size supplied does not meet this constraint then the page size is not
        !          2158: ** changed.
        !          2159: **
        !          2160: ** Page sizes are constrained to be a power of two so that the region
        !          2161: ** of the database file used for locking (beginning at PENDING_BYTE,
        !          2162: ** the first byte past the 1GB boundary, 0x40000000) needs to occur
        !          2163: ** at the beginning of a page.
        !          2164: **
        !          2165: ** If parameter nReserve is less than zero, then the number of reserved
        !          2166: ** bytes per page is left unchanged.
        !          2167: **
        !          2168: ** If the iFix!=0 then the BTS_PAGESIZE_FIXED flag is set so that the page size
        !          2169: ** and autovacuum mode can no longer be changed.
        !          2170: */
        !          2171: int sqlite3BtreeSetPageSize(Btree *p, int pageSize, int nReserve, int iFix){
        !          2172:   int rc = SQLITE_OK;
        !          2173:   BtShared *pBt = p->pBt;
        !          2174:   assert( nReserve>=-1 && nReserve<=255 );
        !          2175:   sqlite3BtreeEnter(p);
        !          2176:   if( pBt->btsFlags & BTS_PAGESIZE_FIXED ){
        !          2177:     sqlite3BtreeLeave(p);
        !          2178:     return SQLITE_READONLY;
        !          2179:   }
        !          2180:   if( nReserve<0 ){
        !          2181:     nReserve = pBt->pageSize - pBt->usableSize;
        !          2182:   }
        !          2183:   assert( nReserve>=0 && nReserve<=255 );
        !          2184:   if( pageSize>=512 && pageSize<=SQLITE_MAX_PAGE_SIZE &&
        !          2185:         ((pageSize-1)&pageSize)==0 ){
        !          2186:     assert( (pageSize & 7)==0 );
        !          2187:     assert( !pBt->pPage1 && !pBt->pCursor );
        !          2188:     pBt->pageSize = (u32)pageSize;
        !          2189:     freeTempSpace(pBt);
        !          2190:   }
        !          2191:   rc = sqlite3PagerSetPagesize(pBt->pPager, &pBt->pageSize, nReserve);
        !          2192:   pBt->usableSize = pBt->pageSize - (u16)nReserve;
        !          2193:   if( iFix ) pBt->btsFlags |= BTS_PAGESIZE_FIXED;
        !          2194:   sqlite3BtreeLeave(p);
        !          2195:   return rc;
        !          2196: }
        !          2197: 
        !          2198: /*
        !          2199: ** Return the currently defined page size
        !          2200: */
        !          2201: int sqlite3BtreeGetPageSize(Btree *p){
        !          2202:   return p->pBt->pageSize;
        !          2203: }
        !          2204: 
        !          2205: #if !defined(SQLITE_OMIT_PAGER_PRAGMAS) || !defined(SQLITE_OMIT_VACUUM)
        !          2206: /*
        !          2207: ** Return the number of bytes of space at the end of every page that
        !          2208: ** are intentually left unused.  This is the "reserved" space that is
        !          2209: ** sometimes used by extensions.
        !          2210: */
        !          2211: int sqlite3BtreeGetReserve(Btree *p){
        !          2212:   int n;
        !          2213:   sqlite3BtreeEnter(p);
        !          2214:   n = p->pBt->pageSize - p->pBt->usableSize;
        !          2215:   sqlite3BtreeLeave(p);
        !          2216:   return n;
        !          2217: }
        !          2218: 
        !          2219: /*
        !          2220: ** Set the maximum page count for a database if mxPage is positive.
        !          2221: ** No changes are made if mxPage is 0 or negative.
        !          2222: ** Regardless of the value of mxPage, return the maximum page count.
        !          2223: */
        !          2224: int sqlite3BtreeMaxPageCount(Btree *p, int mxPage){
        !          2225:   int n;
        !          2226:   sqlite3BtreeEnter(p);
        !          2227:   n = sqlite3PagerMaxPageCount(p->pBt->pPager, mxPage);
        !          2228:   sqlite3BtreeLeave(p);
        !          2229:   return n;
        !          2230: }
        !          2231: 
        !          2232: /*
        !          2233: ** Set the BTS_SECURE_DELETE flag if newFlag is 0 or 1.  If newFlag is -1,
        !          2234: ** then make no changes.  Always return the value of the BTS_SECURE_DELETE
        !          2235: ** setting after the change.
        !          2236: */
        !          2237: int sqlite3BtreeSecureDelete(Btree *p, int newFlag){
        !          2238:   int b;
        !          2239:   if( p==0 ) return 0;
        !          2240:   sqlite3BtreeEnter(p);
        !          2241:   if( newFlag>=0 ){
        !          2242:     p->pBt->btsFlags &= ~BTS_SECURE_DELETE;
        !          2243:     if( newFlag ) p->pBt->btsFlags |= BTS_SECURE_DELETE;
        !          2244:   } 
        !          2245:   b = (p->pBt->btsFlags & BTS_SECURE_DELETE)!=0;
        !          2246:   sqlite3BtreeLeave(p);
        !          2247:   return b;
        !          2248: }
        !          2249: #endif /* !defined(SQLITE_OMIT_PAGER_PRAGMAS) || !defined(SQLITE_OMIT_VACUUM) */
        !          2250: 
        !          2251: /*
        !          2252: ** Change the 'auto-vacuum' property of the database. If the 'autoVacuum'
        !          2253: ** parameter is non-zero, then auto-vacuum mode is enabled. If zero, it
        !          2254: ** is disabled. The default value for the auto-vacuum property is 
        !          2255: ** determined by the SQLITE_DEFAULT_AUTOVACUUM macro.
        !          2256: */
        !          2257: int sqlite3BtreeSetAutoVacuum(Btree *p, int autoVacuum){
        !          2258: #ifdef SQLITE_OMIT_AUTOVACUUM
        !          2259:   return SQLITE_READONLY;
        !          2260: #else
        !          2261:   BtShared *pBt = p->pBt;
        !          2262:   int rc = SQLITE_OK;
        !          2263:   u8 av = (u8)autoVacuum;
        !          2264: 
        !          2265:   sqlite3BtreeEnter(p);
        !          2266:   if( (pBt->btsFlags & BTS_PAGESIZE_FIXED)!=0 && (av ?1:0)!=pBt->autoVacuum ){
        !          2267:     rc = SQLITE_READONLY;
        !          2268:   }else{
        !          2269:     pBt->autoVacuum = av ?1:0;
        !          2270:     pBt->incrVacuum = av==2 ?1:0;
        !          2271:   }
        !          2272:   sqlite3BtreeLeave(p);
        !          2273:   return rc;
        !          2274: #endif
        !          2275: }
        !          2276: 
        !          2277: /*
        !          2278: ** Return the value of the 'auto-vacuum' property. If auto-vacuum is 
        !          2279: ** enabled 1 is returned. Otherwise 0.
        !          2280: */
        !          2281: int sqlite3BtreeGetAutoVacuum(Btree *p){
        !          2282: #ifdef SQLITE_OMIT_AUTOVACUUM
        !          2283:   return BTREE_AUTOVACUUM_NONE;
        !          2284: #else
        !          2285:   int rc;
        !          2286:   sqlite3BtreeEnter(p);
        !          2287:   rc = (
        !          2288:     (!p->pBt->autoVacuum)?BTREE_AUTOVACUUM_NONE:
        !          2289:     (!p->pBt->incrVacuum)?BTREE_AUTOVACUUM_FULL:
        !          2290:     BTREE_AUTOVACUUM_INCR
        !          2291:   );
        !          2292:   sqlite3BtreeLeave(p);
        !          2293:   return rc;
        !          2294: #endif
        !          2295: }
        !          2296: 
        !          2297: 
        !          2298: /*
        !          2299: ** Get a reference to pPage1 of the database file.  This will
        !          2300: ** also acquire a readlock on that file.
        !          2301: **
        !          2302: ** SQLITE_OK is returned on success.  If the file is not a
        !          2303: ** well-formed database file, then SQLITE_CORRUPT is returned.
        !          2304: ** SQLITE_BUSY is returned if the database is locked.  SQLITE_NOMEM
        !          2305: ** is returned if we run out of memory. 
        !          2306: */
        !          2307: static int lockBtree(BtShared *pBt){
        !          2308:   int rc;              /* Result code from subfunctions */
        !          2309:   MemPage *pPage1;     /* Page 1 of the database file */
        !          2310:   int nPage;           /* Number of pages in the database */
        !          2311:   int nPageFile = 0;   /* Number of pages in the database file */
        !          2312:   int nPageHeader;     /* Number of pages in the database according to hdr */
        !          2313: 
        !          2314:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          2315:   assert( pBt->pPage1==0 );
        !          2316:   rc = sqlite3PagerSharedLock(pBt->pPager);
        !          2317:   if( rc!=SQLITE_OK ) return rc;
        !          2318:   rc = btreeGetPage(pBt, 1, &pPage1, 0);
        !          2319:   if( rc!=SQLITE_OK ) return rc;
        !          2320: 
        !          2321:   /* Do some checking to help insure the file we opened really is
        !          2322:   ** a valid database file. 
        !          2323:   */
        !          2324:   nPage = nPageHeader = get4byte(28+(u8*)pPage1->aData);
        !          2325:   sqlite3PagerPagecount(pBt->pPager, &nPageFile);
        !          2326:   if( nPage==0 || memcmp(24+(u8*)pPage1->aData, 92+(u8*)pPage1->aData,4)!=0 ){
        !          2327:     nPage = nPageFile;
        !          2328:   }
        !          2329:   if( nPage>0 ){
        !          2330:     u32 pageSize;
        !          2331:     u32 usableSize;
        !          2332:     u8 *page1 = pPage1->aData;
        !          2333:     rc = SQLITE_NOTADB;
        !          2334:     if( memcmp(page1, zMagicHeader, 16)!=0 ){
        !          2335:       goto page1_init_failed;
        !          2336:     }
        !          2337: 
        !          2338: #ifdef SQLITE_OMIT_WAL
        !          2339:     if( page1[18]>1 ){
        !          2340:       pBt->btsFlags |= BTS_READ_ONLY;
        !          2341:     }
        !          2342:     if( page1[19]>1 ){
        !          2343:       goto page1_init_failed;
        !          2344:     }
        !          2345: #else
        !          2346:     if( page1[18]>2 ){
        !          2347:       pBt->btsFlags |= BTS_READ_ONLY;
        !          2348:     }
        !          2349:     if( page1[19]>2 ){
        !          2350:       goto page1_init_failed;
        !          2351:     }
        !          2352: 
        !          2353:     /* If the write version is set to 2, this database should be accessed
        !          2354:     ** in WAL mode. If the log is not already open, open it now. Then 
        !          2355:     ** return SQLITE_OK and return without populating BtShared.pPage1.
        !          2356:     ** The caller detects this and calls this function again. This is
        !          2357:     ** required as the version of page 1 currently in the page1 buffer
        !          2358:     ** may not be the latest version - there may be a newer one in the log
        !          2359:     ** file.
        !          2360:     */
        !          2361:     if( page1[19]==2 && (pBt->btsFlags & BTS_NO_WAL)==0 ){
        !          2362:       int isOpen = 0;
        !          2363:       rc = sqlite3PagerOpenWal(pBt->pPager, &isOpen);
        !          2364:       if( rc!=SQLITE_OK ){
        !          2365:         goto page1_init_failed;
        !          2366:       }else if( isOpen==0 ){
        !          2367:         releasePage(pPage1);
        !          2368:         return SQLITE_OK;
        !          2369:       }
        !          2370:       rc = SQLITE_NOTADB;
        !          2371:     }
        !          2372: #endif
        !          2373: 
        !          2374:     /* The maximum embedded fraction must be exactly 25%.  And the minimum
        !          2375:     ** embedded fraction must be 12.5% for both leaf-data and non-leaf-data.
        !          2376:     ** The original design allowed these amounts to vary, but as of
        !          2377:     ** version 3.6.0, we require them to be fixed.
        !          2378:     */
        !          2379:     if( memcmp(&page1[21], "\100\040\040",3)!=0 ){
        !          2380:       goto page1_init_failed;
        !          2381:     }
        !          2382:     pageSize = (page1[16]<<8) | (page1[17]<<16);
        !          2383:     if( ((pageSize-1)&pageSize)!=0
        !          2384:      || pageSize>SQLITE_MAX_PAGE_SIZE 
        !          2385:      || pageSize<=256 
        !          2386:     ){
        !          2387:       goto page1_init_failed;
        !          2388:     }
        !          2389:     assert( (pageSize & 7)==0 );
        !          2390:     usableSize = pageSize - page1[20];
        !          2391:     if( (u32)pageSize!=pBt->pageSize ){
        !          2392:       /* After reading the first page of the database assuming a page size
        !          2393:       ** of BtShared.pageSize, we have discovered that the page-size is
        !          2394:       ** actually pageSize. Unlock the database, leave pBt->pPage1 at
        !          2395:       ** zero and return SQLITE_OK. The caller will call this function
        !          2396:       ** again with the correct page-size.
        !          2397:       */
        !          2398:       releasePage(pPage1);
        !          2399:       pBt->usableSize = usableSize;
        !          2400:       pBt->pageSize = pageSize;
        !          2401:       freeTempSpace(pBt);
        !          2402:       rc = sqlite3PagerSetPagesize(pBt->pPager, &pBt->pageSize,
        !          2403:                                    pageSize-usableSize);
        !          2404:       return rc;
        !          2405:     }
        !          2406:     if( (pBt->db->flags & SQLITE_RecoveryMode)==0 && nPage>nPageFile ){
        !          2407:       rc = SQLITE_CORRUPT_BKPT;
        !          2408:       goto page1_init_failed;
        !          2409:     }
        !          2410:     if( usableSize<480 ){
        !          2411:       goto page1_init_failed;
        !          2412:     }
        !          2413:     pBt->pageSize = pageSize;
        !          2414:     pBt->usableSize = usableSize;
        !          2415: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          2416:     pBt->autoVacuum = (get4byte(&page1[36 + 4*4])?1:0);
        !          2417:     pBt->incrVacuum = (get4byte(&page1[36 + 7*4])?1:0);
        !          2418: #endif
        !          2419:   }
        !          2420: 
        !          2421:   /* maxLocal is the maximum amount of payload to store locally for
        !          2422:   ** a cell.  Make sure it is small enough so that at least minFanout
        !          2423:   ** cells can will fit on one page.  We assume a 10-byte page header.
        !          2424:   ** Besides the payload, the cell must store:
        !          2425:   **     2-byte pointer to the cell
        !          2426:   **     4-byte child pointer
        !          2427:   **     9-byte nKey value
        !          2428:   **     4-byte nData value
        !          2429:   **     4-byte overflow page pointer
        !          2430:   ** So a cell consists of a 2-byte pointer, a header which is as much as
        !          2431:   ** 17 bytes long, 0 to N bytes of payload, and an optional 4 byte overflow
        !          2432:   ** page pointer.
        !          2433:   */
        !          2434:   pBt->maxLocal = (u16)((pBt->usableSize-12)*64/255 - 23);
        !          2435:   pBt->minLocal = (u16)((pBt->usableSize-12)*32/255 - 23);
        !          2436:   pBt->maxLeaf = (u16)(pBt->usableSize - 35);
        !          2437:   pBt->minLeaf = (u16)((pBt->usableSize-12)*32/255 - 23);
        !          2438:   if( pBt->maxLocal>127 ){
        !          2439:     pBt->max1bytePayload = 127;
        !          2440:   }else{
        !          2441:     pBt->max1bytePayload = (u8)pBt->maxLocal;
        !          2442:   }
        !          2443:   assert( pBt->maxLeaf + 23 <= MX_CELL_SIZE(pBt) );
        !          2444:   pBt->pPage1 = pPage1;
        !          2445:   pBt->nPage = nPage;
        !          2446:   return SQLITE_OK;
        !          2447: 
        !          2448: page1_init_failed:
        !          2449:   releasePage(pPage1);
        !          2450:   pBt->pPage1 = 0;
        !          2451:   return rc;
        !          2452: }
        !          2453: 
        !          2454: /*
        !          2455: ** If there are no outstanding cursors and we are not in the middle
        !          2456: ** of a transaction but there is a read lock on the database, then
        !          2457: ** this routine unrefs the first page of the database file which 
        !          2458: ** has the effect of releasing the read lock.
        !          2459: **
        !          2460: ** If there is a transaction in progress, this routine is a no-op.
        !          2461: */
        !          2462: static void unlockBtreeIfUnused(BtShared *pBt){
        !          2463:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          2464:   assert( pBt->pCursor==0 || pBt->inTransaction>TRANS_NONE );
        !          2465:   if( pBt->inTransaction==TRANS_NONE && pBt->pPage1!=0 ){
        !          2466:     assert( pBt->pPage1->aData );
        !          2467:     assert( sqlite3PagerRefcount(pBt->pPager)==1 );
        !          2468:     assert( pBt->pPage1->aData );
        !          2469:     releasePage(pBt->pPage1);
        !          2470:     pBt->pPage1 = 0;
        !          2471:   }
        !          2472: }
        !          2473: 
        !          2474: /*
        !          2475: ** If pBt points to an empty file then convert that empty file
        !          2476: ** into a new empty database by initializing the first page of
        !          2477: ** the database.
        !          2478: */
        !          2479: static int newDatabase(BtShared *pBt){
        !          2480:   MemPage *pP1;
        !          2481:   unsigned char *data;
        !          2482:   int rc;
        !          2483: 
        !          2484:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          2485:   if( pBt->nPage>0 ){
        !          2486:     return SQLITE_OK;
        !          2487:   }
        !          2488:   pP1 = pBt->pPage1;
        !          2489:   assert( pP1!=0 );
        !          2490:   data = pP1->aData;
        !          2491:   rc = sqlite3PagerWrite(pP1->pDbPage);
        !          2492:   if( rc ) return rc;
        !          2493:   memcpy(data, zMagicHeader, sizeof(zMagicHeader));
        !          2494:   assert( sizeof(zMagicHeader)==16 );
        !          2495:   data[16] = (u8)((pBt->pageSize>>8)&0xff);
        !          2496:   data[17] = (u8)((pBt->pageSize>>16)&0xff);
        !          2497:   data[18] = 1;
        !          2498:   data[19] = 1;
        !          2499:   assert( pBt->usableSize<=pBt->pageSize && pBt->usableSize+255>=pBt->pageSize);
        !          2500:   data[20] = (u8)(pBt->pageSize - pBt->usableSize);
        !          2501:   data[21] = 64;
        !          2502:   data[22] = 32;
        !          2503:   data[23] = 32;
        !          2504:   memset(&data[24], 0, 100-24);
        !          2505:   zeroPage(pP1, PTF_INTKEY|PTF_LEAF|PTF_LEAFDATA );
        !          2506:   pBt->btsFlags |= BTS_PAGESIZE_FIXED;
        !          2507: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          2508:   assert( pBt->autoVacuum==1 || pBt->autoVacuum==0 );
        !          2509:   assert( pBt->incrVacuum==1 || pBt->incrVacuum==0 );
        !          2510:   put4byte(&data[36 + 4*4], pBt->autoVacuum);
        !          2511:   put4byte(&data[36 + 7*4], pBt->incrVacuum);
        !          2512: #endif
        !          2513:   pBt->nPage = 1;
        !          2514:   data[31] = 1;
        !          2515:   return SQLITE_OK;
        !          2516: }
        !          2517: 
        !          2518: /*
        !          2519: ** Attempt to start a new transaction. A write-transaction
        !          2520: ** is started if the second argument is nonzero, otherwise a read-
        !          2521: ** transaction.  If the second argument is 2 or more and exclusive
        !          2522: ** transaction is started, meaning that no other process is allowed
        !          2523: ** to access the database.  A preexisting transaction may not be
        !          2524: ** upgraded to exclusive by calling this routine a second time - the
        !          2525: ** exclusivity flag only works for a new transaction.
        !          2526: **
        !          2527: ** A write-transaction must be started before attempting any 
        !          2528: ** changes to the database.  None of the following routines 
        !          2529: ** will work unless a transaction is started first:
        !          2530: **
        !          2531: **      sqlite3BtreeCreateTable()
        !          2532: **      sqlite3BtreeCreateIndex()
        !          2533: **      sqlite3BtreeClearTable()
        !          2534: **      sqlite3BtreeDropTable()
        !          2535: **      sqlite3BtreeInsert()
        !          2536: **      sqlite3BtreeDelete()
        !          2537: **      sqlite3BtreeUpdateMeta()
        !          2538: **
        !          2539: ** If an initial attempt to acquire the lock fails because of lock contention
        !          2540: ** and the database was previously unlocked, then invoke the busy handler
        !          2541: ** if there is one.  But if there was previously a read-lock, do not
        !          2542: ** invoke the busy handler - just return SQLITE_BUSY.  SQLITE_BUSY is 
        !          2543: ** returned when there is already a read-lock in order to avoid a deadlock.
        !          2544: **
        !          2545: ** Suppose there are two processes A and B.  A has a read lock and B has
        !          2546: ** a reserved lock.  B tries to promote to exclusive but is blocked because
        !          2547: ** of A's read lock.  A tries to promote to reserved but is blocked by B.
        !          2548: ** One or the other of the two processes must give way or there can be
        !          2549: ** no progress.  By returning SQLITE_BUSY and not invoking the busy callback
        !          2550: ** when A already has a read lock, we encourage A to give up and let B
        !          2551: ** proceed.
        !          2552: */
        !          2553: int sqlite3BtreeBeginTrans(Btree *p, int wrflag){
        !          2554:   sqlite3 *pBlock = 0;
        !          2555:   BtShared *pBt = p->pBt;
        !          2556:   int rc = SQLITE_OK;
        !          2557: 
        !          2558:   sqlite3BtreeEnter(p);
        !          2559:   btreeIntegrity(p);
        !          2560: 
        !          2561:   /* If the btree is already in a write-transaction, or it
        !          2562:   ** is already in a read-transaction and a read-transaction
        !          2563:   ** is requested, this is a no-op.
        !          2564:   */
        !          2565:   if( p->inTrans==TRANS_WRITE || (p->inTrans==TRANS_READ && !wrflag) ){
        !          2566:     goto trans_begun;
        !          2567:   }
        !          2568: 
        !          2569:   /* Write transactions are not possible on a read-only database */
        !          2570:   if( (pBt->btsFlags & BTS_READ_ONLY)!=0 && wrflag ){
        !          2571:     rc = SQLITE_READONLY;
        !          2572:     goto trans_begun;
        !          2573:   }
        !          2574: 
        !          2575: #ifndef SQLITE_OMIT_SHARED_CACHE
        !          2576:   /* If another database handle has already opened a write transaction 
        !          2577:   ** on this shared-btree structure and a second write transaction is
        !          2578:   ** requested, return SQLITE_LOCKED.
        !          2579:   */
        !          2580:   if( (wrflag && pBt->inTransaction==TRANS_WRITE)
        !          2581:    || (pBt->btsFlags & BTS_PENDING)!=0
        !          2582:   ){
        !          2583:     pBlock = pBt->pWriter->db;
        !          2584:   }else if( wrflag>1 ){
        !          2585:     BtLock *pIter;
        !          2586:     for(pIter=pBt->pLock; pIter; pIter=pIter->pNext){
        !          2587:       if( pIter->pBtree!=p ){
        !          2588:         pBlock = pIter->pBtree->db;
        !          2589:         break;
        !          2590:       }
        !          2591:     }
        !          2592:   }
        !          2593:   if( pBlock ){
        !          2594:     sqlite3ConnectionBlocked(p->db, pBlock);
        !          2595:     rc = SQLITE_LOCKED_SHAREDCACHE;
        !          2596:     goto trans_begun;
        !          2597:   }
        !          2598: #endif
        !          2599: 
        !          2600:   /* Any read-only or read-write transaction implies a read-lock on 
        !          2601:   ** page 1. So if some other shared-cache client already has a write-lock 
        !          2602:   ** on page 1, the transaction cannot be opened. */
        !          2603:   rc = querySharedCacheTableLock(p, MASTER_ROOT, READ_LOCK);
        !          2604:   if( SQLITE_OK!=rc ) goto trans_begun;
        !          2605: 
        !          2606:   pBt->btsFlags &= ~BTS_INITIALLY_EMPTY;
        !          2607:   if( pBt->nPage==0 ) pBt->btsFlags |= BTS_INITIALLY_EMPTY;
        !          2608:   do {
        !          2609:     /* Call lockBtree() until either pBt->pPage1 is populated or
        !          2610:     ** lockBtree() returns something other than SQLITE_OK. lockBtree()
        !          2611:     ** may return SQLITE_OK but leave pBt->pPage1 set to 0 if after
        !          2612:     ** reading page 1 it discovers that the page-size of the database 
        !          2613:     ** file is not pBt->pageSize. In this case lockBtree() will update
        !          2614:     ** pBt->pageSize to the page-size of the file on disk.
        !          2615:     */
        !          2616:     while( pBt->pPage1==0 && SQLITE_OK==(rc = lockBtree(pBt)) );
        !          2617: 
        !          2618:     if( rc==SQLITE_OK && wrflag ){
        !          2619:       if( (pBt->btsFlags & BTS_READ_ONLY)!=0 ){
        !          2620:         rc = SQLITE_READONLY;
        !          2621:       }else{
        !          2622:         rc = sqlite3PagerBegin(pBt->pPager,wrflag>1,sqlite3TempInMemory(p->db));
        !          2623:         if( rc==SQLITE_OK ){
        !          2624:           rc = newDatabase(pBt);
        !          2625:         }
        !          2626:       }
        !          2627:     }
        !          2628:   
        !          2629:     if( rc!=SQLITE_OK ){
        !          2630:       unlockBtreeIfUnused(pBt);
        !          2631:     }
        !          2632:   }while( (rc&0xFF)==SQLITE_BUSY && pBt->inTransaction==TRANS_NONE &&
        !          2633:           btreeInvokeBusyHandler(pBt) );
        !          2634: 
        !          2635:   if( rc==SQLITE_OK ){
        !          2636:     if( p->inTrans==TRANS_NONE ){
        !          2637:       pBt->nTransaction++;
        !          2638: #ifndef SQLITE_OMIT_SHARED_CACHE
        !          2639:       if( p->sharable ){
        !          2640:        assert( p->lock.pBtree==p && p->lock.iTable==1 );
        !          2641:         p->lock.eLock = READ_LOCK;
        !          2642:         p->lock.pNext = pBt->pLock;
        !          2643:         pBt->pLock = &p->lock;
        !          2644:       }
        !          2645: #endif
        !          2646:     }
        !          2647:     p->inTrans = (wrflag?TRANS_WRITE:TRANS_READ);
        !          2648:     if( p->inTrans>pBt->inTransaction ){
        !          2649:       pBt->inTransaction = p->inTrans;
        !          2650:     }
        !          2651:     if( wrflag ){
        !          2652:       MemPage *pPage1 = pBt->pPage1;
        !          2653: #ifndef SQLITE_OMIT_SHARED_CACHE
        !          2654:       assert( !pBt->pWriter );
        !          2655:       pBt->pWriter = p;
        !          2656:       pBt->btsFlags &= ~BTS_EXCLUSIVE;
        !          2657:       if( wrflag>1 ) pBt->btsFlags |= BTS_EXCLUSIVE;
        !          2658: #endif
        !          2659: 
        !          2660:       /* If the db-size header field is incorrect (as it may be if an old
        !          2661:       ** client has been writing the database file), update it now. Doing
        !          2662:       ** this sooner rather than later means the database size can safely 
        !          2663:       ** re-read the database size from page 1 if a savepoint or transaction
        !          2664:       ** rollback occurs within the transaction.
        !          2665:       */
        !          2666:       if( pBt->nPage!=get4byte(&pPage1->aData[28]) ){
        !          2667:         rc = sqlite3PagerWrite(pPage1->pDbPage);
        !          2668:         if( rc==SQLITE_OK ){
        !          2669:           put4byte(&pPage1->aData[28], pBt->nPage);
        !          2670:         }
        !          2671:       }
        !          2672:     }
        !          2673:   }
        !          2674: 
        !          2675: 
        !          2676: trans_begun:
        !          2677:   if( rc==SQLITE_OK && wrflag ){
        !          2678:     /* This call makes sure that the pager has the correct number of
        !          2679:     ** open savepoints. If the second parameter is greater than 0 and
        !          2680:     ** the sub-journal is not already open, then it will be opened here.
        !          2681:     */
        !          2682:     rc = sqlite3PagerOpenSavepoint(pBt->pPager, p->db->nSavepoint);
        !          2683:   }
        !          2684: 
        !          2685:   btreeIntegrity(p);
        !          2686:   sqlite3BtreeLeave(p);
        !          2687:   return rc;
        !          2688: }
        !          2689: 
        !          2690: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          2691: 
        !          2692: /*
        !          2693: ** Set the pointer-map entries for all children of page pPage. Also, if
        !          2694: ** pPage contains cells that point to overflow pages, set the pointer
        !          2695: ** map entries for the overflow pages as well.
        !          2696: */
        !          2697: static int setChildPtrmaps(MemPage *pPage){
        !          2698:   int i;                             /* Counter variable */
        !          2699:   int nCell;                         /* Number of cells in page pPage */
        !          2700:   int rc;                            /* Return code */
        !          2701:   BtShared *pBt = pPage->pBt;
        !          2702:   u8 isInitOrig = pPage->isInit;
        !          2703:   Pgno pgno = pPage->pgno;
        !          2704: 
        !          2705:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !          2706:   rc = btreeInitPage(pPage);
        !          2707:   if( rc!=SQLITE_OK ){
        !          2708:     goto set_child_ptrmaps_out;
        !          2709:   }
        !          2710:   nCell = pPage->nCell;
        !          2711: 
        !          2712:   for(i=0; i<nCell; i++){
        !          2713:     u8 *pCell = findCell(pPage, i);
        !          2714: 
        !          2715:     ptrmapPutOvflPtr(pPage, pCell, &rc);
        !          2716: 
        !          2717:     if( !pPage->leaf ){
        !          2718:       Pgno childPgno = get4byte(pCell);
        !          2719:       ptrmapPut(pBt, childPgno, PTRMAP_BTREE, pgno, &rc);
        !          2720:     }
        !          2721:   }
        !          2722: 
        !          2723:   if( !pPage->leaf ){
        !          2724:     Pgno childPgno = get4byte(&pPage->aData[pPage->hdrOffset+8]);
        !          2725:     ptrmapPut(pBt, childPgno, PTRMAP_BTREE, pgno, &rc);
        !          2726:   }
        !          2727: 
        !          2728: set_child_ptrmaps_out:
        !          2729:   pPage->isInit = isInitOrig;
        !          2730:   return rc;
        !          2731: }
        !          2732: 
        !          2733: /*
        !          2734: ** Somewhere on pPage is a pointer to page iFrom.  Modify this pointer so
        !          2735: ** that it points to iTo. Parameter eType describes the type of pointer to
        !          2736: ** be modified, as  follows:
        !          2737: **
        !          2738: ** PTRMAP_BTREE:     pPage is a btree-page. The pointer points at a child 
        !          2739: **                   page of pPage.
        !          2740: **
        !          2741: ** PTRMAP_OVERFLOW1: pPage is a btree-page. The pointer points at an overflow
        !          2742: **                   page pointed to by one of the cells on pPage.
        !          2743: **
        !          2744: ** PTRMAP_OVERFLOW2: pPage is an overflow-page. The pointer points at the next
        !          2745: **                   overflow page in the list.
        !          2746: */
        !          2747: static int modifyPagePointer(MemPage *pPage, Pgno iFrom, Pgno iTo, u8 eType){
        !          2748:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !          2749:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
        !          2750:   if( eType==PTRMAP_OVERFLOW2 ){
        !          2751:     /* The pointer is always the first 4 bytes of the page in this case.  */
        !          2752:     if( get4byte(pPage->aData)!=iFrom ){
        !          2753:       return SQLITE_CORRUPT_BKPT;
        !          2754:     }
        !          2755:     put4byte(pPage->aData, iTo);
        !          2756:   }else{
        !          2757:     u8 isInitOrig = pPage->isInit;
        !          2758:     int i;
        !          2759:     int nCell;
        !          2760: 
        !          2761:     btreeInitPage(pPage);
        !          2762:     nCell = pPage->nCell;
        !          2763: 
        !          2764:     for(i=0; i<nCell; i++){
        !          2765:       u8 *pCell = findCell(pPage, i);
        !          2766:       if( eType==PTRMAP_OVERFLOW1 ){
        !          2767:         CellInfo info;
        !          2768:         btreeParseCellPtr(pPage, pCell, &info);
        !          2769:         if( info.iOverflow
        !          2770:          && pCell+info.iOverflow+3<=pPage->aData+pPage->maskPage
        !          2771:          && iFrom==get4byte(&pCell[info.iOverflow])
        !          2772:         ){
        !          2773:           put4byte(&pCell[info.iOverflow], iTo);
        !          2774:           break;
        !          2775:         }
        !          2776:       }else{
        !          2777:         if( get4byte(pCell)==iFrom ){
        !          2778:           put4byte(pCell, iTo);
        !          2779:           break;
        !          2780:         }
        !          2781:       }
        !          2782:     }
        !          2783:   
        !          2784:     if( i==nCell ){
        !          2785:       if( eType!=PTRMAP_BTREE || 
        !          2786:           get4byte(&pPage->aData[pPage->hdrOffset+8])!=iFrom ){
        !          2787:         return SQLITE_CORRUPT_BKPT;
        !          2788:       }
        !          2789:       put4byte(&pPage->aData[pPage->hdrOffset+8], iTo);
        !          2790:     }
        !          2791: 
        !          2792:     pPage->isInit = isInitOrig;
        !          2793:   }
        !          2794:   return SQLITE_OK;
        !          2795: }
        !          2796: 
        !          2797: 
        !          2798: /*
        !          2799: ** Move the open database page pDbPage to location iFreePage in the 
        !          2800: ** database. The pDbPage reference remains valid.
        !          2801: **
        !          2802: ** The isCommit flag indicates that there is no need to remember that
        !          2803: ** the journal needs to be sync()ed before database page pDbPage->pgno 
        !          2804: ** can be written to. The caller has already promised not to write to that
        !          2805: ** page.
        !          2806: */
        !          2807: static int relocatePage(
        !          2808:   BtShared *pBt,           /* Btree */
        !          2809:   MemPage *pDbPage,        /* Open page to move */
        !          2810:   u8 eType,                /* Pointer map 'type' entry for pDbPage */
        !          2811:   Pgno iPtrPage,           /* Pointer map 'page-no' entry for pDbPage */
        !          2812:   Pgno iFreePage,          /* The location to move pDbPage to */
        !          2813:   int isCommit             /* isCommit flag passed to sqlite3PagerMovepage */
        !          2814: ){
        !          2815:   MemPage *pPtrPage;   /* The page that contains a pointer to pDbPage */
        !          2816:   Pgno iDbPage = pDbPage->pgno;
        !          2817:   Pager *pPager = pBt->pPager;
        !          2818:   int rc;
        !          2819: 
        !          2820:   assert( eType==PTRMAP_OVERFLOW2 || eType==PTRMAP_OVERFLOW1 || 
        !          2821:       eType==PTRMAP_BTREE || eType==PTRMAP_ROOTPAGE );
        !          2822:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          2823:   assert( pDbPage->pBt==pBt );
        !          2824: 
        !          2825:   /* Move page iDbPage from its current location to page number iFreePage */
        !          2826:   TRACE(("AUTOVACUUM: Moving %d to free page %d (ptr page %d type %d)\n", 
        !          2827:       iDbPage, iFreePage, iPtrPage, eType));
        !          2828:   rc = sqlite3PagerMovepage(pPager, pDbPage->pDbPage, iFreePage, isCommit);
        !          2829:   if( rc!=SQLITE_OK ){
        !          2830:     return rc;
        !          2831:   }
        !          2832:   pDbPage->pgno = iFreePage;
        !          2833: 
        !          2834:   /* If pDbPage was a btree-page, then it may have child pages and/or cells
        !          2835:   ** that point to overflow pages. The pointer map entries for all these
        !          2836:   ** pages need to be changed.
        !          2837:   **
        !          2838:   ** If pDbPage is an overflow page, then the first 4 bytes may store a
        !          2839:   ** pointer to a subsequent overflow page. If this is the case, then
        !          2840:   ** the pointer map needs to be updated for the subsequent overflow page.
        !          2841:   */
        !          2842:   if( eType==PTRMAP_BTREE || eType==PTRMAP_ROOTPAGE ){
        !          2843:     rc = setChildPtrmaps(pDbPage);
        !          2844:     if( rc!=SQLITE_OK ){
        !          2845:       return rc;
        !          2846:     }
        !          2847:   }else{
        !          2848:     Pgno nextOvfl = get4byte(pDbPage->aData);
        !          2849:     if( nextOvfl!=0 ){
        !          2850:       ptrmapPut(pBt, nextOvfl, PTRMAP_OVERFLOW2, iFreePage, &rc);
        !          2851:       if( rc!=SQLITE_OK ){
        !          2852:         return rc;
        !          2853:       }
        !          2854:     }
        !          2855:   }
        !          2856: 
        !          2857:   /* Fix the database pointer on page iPtrPage that pointed at iDbPage so
        !          2858:   ** that it points at iFreePage. Also fix the pointer map entry for
        !          2859:   ** iPtrPage.
        !          2860:   */
        !          2861:   if( eType!=PTRMAP_ROOTPAGE ){
        !          2862:     rc = btreeGetPage(pBt, iPtrPage, &pPtrPage, 0);
        !          2863:     if( rc!=SQLITE_OK ){
        !          2864:       return rc;
        !          2865:     }
        !          2866:     rc = sqlite3PagerWrite(pPtrPage->pDbPage);
        !          2867:     if( rc!=SQLITE_OK ){
        !          2868:       releasePage(pPtrPage);
        !          2869:       return rc;
        !          2870:     }
        !          2871:     rc = modifyPagePointer(pPtrPage, iDbPage, iFreePage, eType);
        !          2872:     releasePage(pPtrPage);
        !          2873:     if( rc==SQLITE_OK ){
        !          2874:       ptrmapPut(pBt, iFreePage, eType, iPtrPage, &rc);
        !          2875:     }
        !          2876:   }
        !          2877:   return rc;
        !          2878: }
        !          2879: 
        !          2880: /* Forward declaration required by incrVacuumStep(). */
        !          2881: static int allocateBtreePage(BtShared *, MemPage **, Pgno *, Pgno, u8);
        !          2882: 
        !          2883: /*
        !          2884: ** Perform a single step of an incremental-vacuum. If successful,
        !          2885: ** return SQLITE_OK. If there is no work to do (and therefore no
        !          2886: ** point in calling this function again), return SQLITE_DONE.
        !          2887: **
        !          2888: ** More specificly, this function attempts to re-organize the 
        !          2889: ** database so that the last page of the file currently in use
        !          2890: ** is no longer in use.
        !          2891: **
        !          2892: ** If the nFin parameter is non-zero, this function assumes
        !          2893: ** that the caller will keep calling incrVacuumStep() until
        !          2894: ** it returns SQLITE_DONE or an error, and that nFin is the
        !          2895: ** number of pages the database file will contain after this 
        !          2896: ** process is complete.  If nFin is zero, it is assumed that
        !          2897: ** incrVacuumStep() will be called a finite amount of times
        !          2898: ** which may or may not empty the freelist.  A full autovacuum
        !          2899: ** has nFin>0.  A "PRAGMA incremental_vacuum" has nFin==0.
        !          2900: */
        !          2901: static int incrVacuumStep(BtShared *pBt, Pgno nFin, Pgno iLastPg){
        !          2902:   Pgno nFreeList;           /* Number of pages still on the free-list */
        !          2903:   int rc;
        !          2904: 
        !          2905:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          2906:   assert( iLastPg>nFin );
        !          2907: 
        !          2908:   if( !PTRMAP_ISPAGE(pBt, iLastPg) && iLastPg!=PENDING_BYTE_PAGE(pBt) ){
        !          2909:     u8 eType;
        !          2910:     Pgno iPtrPage;
        !          2911: 
        !          2912:     nFreeList = get4byte(&pBt->pPage1->aData[36]);
        !          2913:     if( nFreeList==0 ){
        !          2914:       return SQLITE_DONE;
        !          2915:     }
        !          2916: 
        !          2917:     rc = ptrmapGet(pBt, iLastPg, &eType, &iPtrPage);
        !          2918:     if( rc!=SQLITE_OK ){
        !          2919:       return rc;
        !          2920:     }
        !          2921:     if( eType==PTRMAP_ROOTPAGE ){
        !          2922:       return SQLITE_CORRUPT_BKPT;
        !          2923:     }
        !          2924: 
        !          2925:     if( eType==PTRMAP_FREEPAGE ){
        !          2926:       if( nFin==0 ){
        !          2927:         /* Remove the page from the files free-list. This is not required
        !          2928:         ** if nFin is non-zero. In that case, the free-list will be
        !          2929:         ** truncated to zero after this function returns, so it doesn't 
        !          2930:         ** matter if it still contains some garbage entries.
        !          2931:         */
        !          2932:         Pgno iFreePg;
        !          2933:         MemPage *pFreePg;
        !          2934:         rc = allocateBtreePage(pBt, &pFreePg, &iFreePg, iLastPg, 1);
        !          2935:         if( rc!=SQLITE_OK ){
        !          2936:           return rc;
        !          2937:         }
        !          2938:         assert( iFreePg==iLastPg );
        !          2939:         releasePage(pFreePg);
        !          2940:       }
        !          2941:     } else {
        !          2942:       Pgno iFreePg;             /* Index of free page to move pLastPg to */
        !          2943:       MemPage *pLastPg;
        !          2944: 
        !          2945:       rc = btreeGetPage(pBt, iLastPg, &pLastPg, 0);
        !          2946:       if( rc!=SQLITE_OK ){
        !          2947:         return rc;
        !          2948:       }
        !          2949: 
        !          2950:       /* If nFin is zero, this loop runs exactly once and page pLastPg
        !          2951:       ** is swapped with the first free page pulled off the free list.
        !          2952:       **
        !          2953:       ** On the other hand, if nFin is greater than zero, then keep
        !          2954:       ** looping until a free-page located within the first nFin pages
        !          2955:       ** of the file is found.
        !          2956:       */
        !          2957:       do {
        !          2958:         MemPage *pFreePg;
        !          2959:         rc = allocateBtreePage(pBt, &pFreePg, &iFreePg, 0, 0);
        !          2960:         if( rc!=SQLITE_OK ){
        !          2961:           releasePage(pLastPg);
        !          2962:           return rc;
        !          2963:         }
        !          2964:         releasePage(pFreePg);
        !          2965:       }while( nFin!=0 && iFreePg>nFin );
        !          2966:       assert( iFreePg<iLastPg );
        !          2967:       
        !          2968:       rc = sqlite3PagerWrite(pLastPg->pDbPage);
        !          2969:       if( rc==SQLITE_OK ){
        !          2970:         rc = relocatePage(pBt, pLastPg, eType, iPtrPage, iFreePg, nFin!=0);
        !          2971:       }
        !          2972:       releasePage(pLastPg);
        !          2973:       if( rc!=SQLITE_OK ){
        !          2974:         return rc;
        !          2975:       }
        !          2976:     }
        !          2977:   }
        !          2978: 
        !          2979:   if( nFin==0 ){
        !          2980:     iLastPg--;
        !          2981:     while( iLastPg==PENDING_BYTE_PAGE(pBt)||PTRMAP_ISPAGE(pBt, iLastPg) ){
        !          2982:       if( PTRMAP_ISPAGE(pBt, iLastPg) ){
        !          2983:         MemPage *pPg;
        !          2984:         rc = btreeGetPage(pBt, iLastPg, &pPg, 0);
        !          2985:         if( rc!=SQLITE_OK ){
        !          2986:           return rc;
        !          2987:         }
        !          2988:         rc = sqlite3PagerWrite(pPg->pDbPage);
        !          2989:         releasePage(pPg);
        !          2990:         if( rc!=SQLITE_OK ){
        !          2991:           return rc;
        !          2992:         }
        !          2993:       }
        !          2994:       iLastPg--;
        !          2995:     }
        !          2996:     sqlite3PagerTruncateImage(pBt->pPager, iLastPg);
        !          2997:     pBt->nPage = iLastPg;
        !          2998:   }
        !          2999:   return SQLITE_OK;
        !          3000: }
        !          3001: 
        !          3002: /*
        !          3003: ** A write-transaction must be opened before calling this function.
        !          3004: ** It performs a single unit of work towards an incremental vacuum.
        !          3005: **
        !          3006: ** If the incremental vacuum is finished after this function has run,
        !          3007: ** SQLITE_DONE is returned. If it is not finished, but no error occurred,
        !          3008: ** SQLITE_OK is returned. Otherwise an SQLite error code. 
        !          3009: */
        !          3010: int sqlite3BtreeIncrVacuum(Btree *p){
        !          3011:   int rc;
        !          3012:   BtShared *pBt = p->pBt;
        !          3013: 
        !          3014:   sqlite3BtreeEnter(p);
        !          3015:   assert( pBt->inTransaction==TRANS_WRITE && p->inTrans==TRANS_WRITE );
        !          3016:   if( !pBt->autoVacuum ){
        !          3017:     rc = SQLITE_DONE;
        !          3018:   }else{
        !          3019:     invalidateAllOverflowCache(pBt);
        !          3020:     rc = incrVacuumStep(pBt, 0, btreePagecount(pBt));
        !          3021:     if( rc==SQLITE_OK ){
        !          3022:       rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
        !          3023:       put4byte(&pBt->pPage1->aData[28], pBt->nPage);
        !          3024:     }
        !          3025:   }
        !          3026:   sqlite3BtreeLeave(p);
        !          3027:   return rc;
        !          3028: }
        !          3029: 
        !          3030: /*
        !          3031: ** This routine is called prior to sqlite3PagerCommit when a transaction
        !          3032: ** is commited for an auto-vacuum database.
        !          3033: **
        !          3034: ** If SQLITE_OK is returned, then *pnTrunc is set to the number of pages
        !          3035: ** the database file should be truncated to during the commit process. 
        !          3036: ** i.e. the database has been reorganized so that only the first *pnTrunc
        !          3037: ** pages are in use.
        !          3038: */
        !          3039: static int autoVacuumCommit(BtShared *pBt){
        !          3040:   int rc = SQLITE_OK;
        !          3041:   Pager *pPager = pBt->pPager;
        !          3042:   VVA_ONLY( int nRef = sqlite3PagerRefcount(pPager) );
        !          3043: 
        !          3044:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          3045:   invalidateAllOverflowCache(pBt);
        !          3046:   assert(pBt->autoVacuum);
        !          3047:   if( !pBt->incrVacuum ){
        !          3048:     Pgno nFin;         /* Number of pages in database after autovacuuming */
        !          3049:     Pgno nFree;        /* Number of pages on the freelist initially */
        !          3050:     Pgno nPtrmap;      /* Number of PtrMap pages to be freed */
        !          3051:     Pgno iFree;        /* The next page to be freed */
        !          3052:     int nEntry;        /* Number of entries on one ptrmap page */
        !          3053:     Pgno nOrig;        /* Database size before freeing */
        !          3054: 
        !          3055:     nOrig = btreePagecount(pBt);
        !          3056:     if( PTRMAP_ISPAGE(pBt, nOrig) || nOrig==PENDING_BYTE_PAGE(pBt) ){
        !          3057:       /* It is not possible to create a database for which the final page
        !          3058:       ** is either a pointer-map page or the pending-byte page. If one
        !          3059:       ** is encountered, this indicates corruption.
        !          3060:       */
        !          3061:       return SQLITE_CORRUPT_BKPT;
        !          3062:     }
        !          3063: 
        !          3064:     nFree = get4byte(&pBt->pPage1->aData[36]);
        !          3065:     nEntry = pBt->usableSize/5;
        !          3066:     nPtrmap = (nFree-nOrig+PTRMAP_PAGENO(pBt, nOrig)+nEntry)/nEntry;
        !          3067:     nFin = nOrig - nFree - nPtrmap;
        !          3068:     if( nOrig>PENDING_BYTE_PAGE(pBt) && nFin<PENDING_BYTE_PAGE(pBt) ){
        !          3069:       nFin--;
        !          3070:     }
        !          3071:     while( PTRMAP_ISPAGE(pBt, nFin) || nFin==PENDING_BYTE_PAGE(pBt) ){
        !          3072:       nFin--;
        !          3073:     }
        !          3074:     if( nFin>nOrig ) return SQLITE_CORRUPT_BKPT;
        !          3075: 
        !          3076:     for(iFree=nOrig; iFree>nFin && rc==SQLITE_OK; iFree--){
        !          3077:       rc = incrVacuumStep(pBt, nFin, iFree);
        !          3078:     }
        !          3079:     if( (rc==SQLITE_DONE || rc==SQLITE_OK) && nFree>0 ){
        !          3080:       rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
        !          3081:       put4byte(&pBt->pPage1->aData[32], 0);
        !          3082:       put4byte(&pBt->pPage1->aData[36], 0);
        !          3083:       put4byte(&pBt->pPage1->aData[28], nFin);
        !          3084:       sqlite3PagerTruncateImage(pBt->pPager, nFin);
        !          3085:       pBt->nPage = nFin;
        !          3086:     }
        !          3087:     if( rc!=SQLITE_OK ){
        !          3088:       sqlite3PagerRollback(pPager);
        !          3089:     }
        !          3090:   }
        !          3091: 
        !          3092:   assert( nRef==sqlite3PagerRefcount(pPager) );
        !          3093:   return rc;
        !          3094: }
        !          3095: 
        !          3096: #else /* ifndef SQLITE_OMIT_AUTOVACUUM */
        !          3097: # define setChildPtrmaps(x) SQLITE_OK
        !          3098: #endif
        !          3099: 
        !          3100: /*
        !          3101: ** This routine does the first phase of a two-phase commit.  This routine
        !          3102: ** causes a rollback journal to be created (if it does not already exist)
        !          3103: ** and populated with enough information so that if a power loss occurs
        !          3104: ** the database can be restored to its original state by playing back
        !          3105: ** the journal.  Then the contents of the journal are flushed out to
        !          3106: ** the disk.  After the journal is safely on oxide, the changes to the
        !          3107: ** database are written into the database file and flushed to oxide.
        !          3108: ** At the end of this call, the rollback journal still exists on the
        !          3109: ** disk and we are still holding all locks, so the transaction has not
        !          3110: ** committed.  See sqlite3BtreeCommitPhaseTwo() for the second phase of the
        !          3111: ** commit process.
        !          3112: **
        !          3113: ** This call is a no-op if no write-transaction is currently active on pBt.
        !          3114: **
        !          3115: ** Otherwise, sync the database file for the btree pBt. zMaster points to
        !          3116: ** the name of a master journal file that should be written into the
        !          3117: ** individual journal file, or is NULL, indicating no master journal file 
        !          3118: ** (single database transaction).
        !          3119: **
        !          3120: ** When this is called, the master journal should already have been
        !          3121: ** created, populated with this journal pointer and synced to disk.
        !          3122: **
        !          3123: ** Once this is routine has returned, the only thing required to commit
        !          3124: ** the write-transaction for this database file is to delete the journal.
        !          3125: */
        !          3126: int sqlite3BtreeCommitPhaseOne(Btree *p, const char *zMaster){
        !          3127:   int rc = SQLITE_OK;
        !          3128:   if( p->inTrans==TRANS_WRITE ){
        !          3129:     BtShared *pBt = p->pBt;
        !          3130:     sqlite3BtreeEnter(p);
        !          3131: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          3132:     if( pBt->autoVacuum ){
        !          3133:       rc = autoVacuumCommit(pBt);
        !          3134:       if( rc!=SQLITE_OK ){
        !          3135:         sqlite3BtreeLeave(p);
        !          3136:         return rc;
        !          3137:       }
        !          3138:     }
        !          3139: #endif
        !          3140:     rc = sqlite3PagerCommitPhaseOne(pBt->pPager, zMaster, 0);
        !          3141:     sqlite3BtreeLeave(p);
        !          3142:   }
        !          3143:   return rc;
        !          3144: }
        !          3145: 
        !          3146: /*
        !          3147: ** This function is called from both BtreeCommitPhaseTwo() and BtreeRollback()
        !          3148: ** at the conclusion of a transaction.
        !          3149: */
        !          3150: static void btreeEndTransaction(Btree *p){
        !          3151:   BtShared *pBt = p->pBt;
        !          3152:   assert( sqlite3BtreeHoldsMutex(p) );
        !          3153: 
        !          3154:   btreeClearHasContent(pBt);
        !          3155:   if( p->inTrans>TRANS_NONE && p->db->activeVdbeCnt>1 ){
        !          3156:     /* If there are other active statements that belong to this database
        !          3157:     ** handle, downgrade to a read-only transaction. The other statements
        !          3158:     ** may still be reading from the database.  */
        !          3159:     downgradeAllSharedCacheTableLocks(p);
        !          3160:     p->inTrans = TRANS_READ;
        !          3161:   }else{
        !          3162:     /* If the handle had any kind of transaction open, decrement the 
        !          3163:     ** transaction count of the shared btree. If the transaction count 
        !          3164:     ** reaches 0, set the shared state to TRANS_NONE. The unlockBtreeIfUnused()
        !          3165:     ** call below will unlock the pager.  */
        !          3166:     if( p->inTrans!=TRANS_NONE ){
        !          3167:       clearAllSharedCacheTableLocks(p);
        !          3168:       pBt->nTransaction--;
        !          3169:       if( 0==pBt->nTransaction ){
        !          3170:         pBt->inTransaction = TRANS_NONE;
        !          3171:       }
        !          3172:     }
        !          3173: 
        !          3174:     /* Set the current transaction state to TRANS_NONE and unlock the 
        !          3175:     ** pager if this call closed the only read or write transaction.  */
        !          3176:     p->inTrans = TRANS_NONE;
        !          3177:     unlockBtreeIfUnused(pBt);
        !          3178:   }
        !          3179: 
        !          3180:   btreeIntegrity(p);
        !          3181: }
        !          3182: 
        !          3183: /*
        !          3184: ** Commit the transaction currently in progress.
        !          3185: **
        !          3186: ** This routine implements the second phase of a 2-phase commit.  The
        !          3187: ** sqlite3BtreeCommitPhaseOne() routine does the first phase and should
        !          3188: ** be invoked prior to calling this routine.  The sqlite3BtreeCommitPhaseOne()
        !          3189: ** routine did all the work of writing information out to disk and flushing the
        !          3190: ** contents so that they are written onto the disk platter.  All this
        !          3191: ** routine has to do is delete or truncate or zero the header in the
        !          3192: ** the rollback journal (which causes the transaction to commit) and
        !          3193: ** drop locks.
        !          3194: **
        !          3195: ** Normally, if an error occurs while the pager layer is attempting to 
        !          3196: ** finalize the underlying journal file, this function returns an error and
        !          3197: ** the upper layer will attempt a rollback. However, if the second argument
        !          3198: ** is non-zero then this b-tree transaction is part of a multi-file 
        !          3199: ** transaction. In this case, the transaction has already been committed 
        !          3200: ** (by deleting a master journal file) and the caller will ignore this 
        !          3201: ** functions return code. So, even if an error occurs in the pager layer,
        !          3202: ** reset the b-tree objects internal state to indicate that the write
        !          3203: ** transaction has been closed. This is quite safe, as the pager will have
        !          3204: ** transitioned to the error state.
        !          3205: **
        !          3206: ** This will release the write lock on the database file.  If there
        !          3207: ** are no active cursors, it also releases the read lock.
        !          3208: */
        !          3209: int sqlite3BtreeCommitPhaseTwo(Btree *p, int bCleanup){
        !          3210: 
        !          3211:   if( p->inTrans==TRANS_NONE ) return SQLITE_OK;
        !          3212:   sqlite3BtreeEnter(p);
        !          3213:   btreeIntegrity(p);
        !          3214: 
        !          3215:   /* If the handle has a write-transaction open, commit the shared-btrees 
        !          3216:   ** transaction and set the shared state to TRANS_READ.
        !          3217:   */
        !          3218:   if( p->inTrans==TRANS_WRITE ){
        !          3219:     int rc;
        !          3220:     BtShared *pBt = p->pBt;
        !          3221:     assert( pBt->inTransaction==TRANS_WRITE );
        !          3222:     assert( pBt->nTransaction>0 );
        !          3223:     rc = sqlite3PagerCommitPhaseTwo(pBt->pPager);
        !          3224:     if( rc!=SQLITE_OK && bCleanup==0 ){
        !          3225:       sqlite3BtreeLeave(p);
        !          3226:       return rc;
        !          3227:     }
        !          3228:     pBt->inTransaction = TRANS_READ;
        !          3229:   }
        !          3230: 
        !          3231:   btreeEndTransaction(p);
        !          3232:   sqlite3BtreeLeave(p);
        !          3233:   return SQLITE_OK;
        !          3234: }
        !          3235: 
        !          3236: /*
        !          3237: ** Do both phases of a commit.
        !          3238: */
        !          3239: int sqlite3BtreeCommit(Btree *p){
        !          3240:   int rc;
        !          3241:   sqlite3BtreeEnter(p);
        !          3242:   rc = sqlite3BtreeCommitPhaseOne(p, 0);
        !          3243:   if( rc==SQLITE_OK ){
        !          3244:     rc = sqlite3BtreeCommitPhaseTwo(p, 0);
        !          3245:   }
        !          3246:   sqlite3BtreeLeave(p);
        !          3247:   return rc;
        !          3248: }
        !          3249: 
        !          3250: #ifndef NDEBUG
        !          3251: /*
        !          3252: ** Return the number of write-cursors open on this handle. This is for use
        !          3253: ** in assert() expressions, so it is only compiled if NDEBUG is not
        !          3254: ** defined.
        !          3255: **
        !          3256: ** For the purposes of this routine, a write-cursor is any cursor that
        !          3257: ** is capable of writing to the databse.  That means the cursor was
        !          3258: ** originally opened for writing and the cursor has not be disabled
        !          3259: ** by having its state changed to CURSOR_FAULT.
        !          3260: */
        !          3261: static int countWriteCursors(BtShared *pBt){
        !          3262:   BtCursor *pCur;
        !          3263:   int r = 0;
        !          3264:   for(pCur=pBt->pCursor; pCur; pCur=pCur->pNext){
        !          3265:     if( pCur->wrFlag && pCur->eState!=CURSOR_FAULT ) r++; 
        !          3266:   }
        !          3267:   return r;
        !          3268: }
        !          3269: #endif
        !          3270: 
        !          3271: /*
        !          3272: ** This routine sets the state to CURSOR_FAULT and the error
        !          3273: ** code to errCode for every cursor on BtShared that pBtree
        !          3274: ** references.
        !          3275: **
        !          3276: ** Every cursor is tripped, including cursors that belong
        !          3277: ** to other database connections that happen to be sharing
        !          3278: ** the cache with pBtree.
        !          3279: **
        !          3280: ** This routine gets called when a rollback occurs.
        !          3281: ** All cursors using the same cache must be tripped
        !          3282: ** to prevent them from trying to use the btree after
        !          3283: ** the rollback.  The rollback may have deleted tables
        !          3284: ** or moved root pages, so it is not sufficient to
        !          3285: ** save the state of the cursor.  The cursor must be
        !          3286: ** invalidated.
        !          3287: */
        !          3288: void sqlite3BtreeTripAllCursors(Btree *pBtree, int errCode){
        !          3289:   BtCursor *p;
        !          3290:   sqlite3BtreeEnter(pBtree);
        !          3291:   for(p=pBtree->pBt->pCursor; p; p=p->pNext){
        !          3292:     int i;
        !          3293:     sqlite3BtreeClearCursor(p);
        !          3294:     p->eState = CURSOR_FAULT;
        !          3295:     p->skipNext = errCode;
        !          3296:     for(i=0; i<=p->iPage; i++){
        !          3297:       releasePage(p->apPage[i]);
        !          3298:       p->apPage[i] = 0;
        !          3299:     }
        !          3300:   }
        !          3301:   sqlite3BtreeLeave(pBtree);
        !          3302: }
        !          3303: 
        !          3304: /*
        !          3305: ** Rollback the transaction in progress.  All cursors will be
        !          3306: ** invalided by this operation.  Any attempt to use a cursor
        !          3307: ** that was open at the beginning of this operation will result
        !          3308: ** in an error.
        !          3309: **
        !          3310: ** This will release the write lock on the database file.  If there
        !          3311: ** are no active cursors, it also releases the read lock.
        !          3312: */
        !          3313: int sqlite3BtreeRollback(Btree *p){
        !          3314:   int rc;
        !          3315:   BtShared *pBt = p->pBt;
        !          3316:   MemPage *pPage1;
        !          3317: 
        !          3318:   sqlite3BtreeEnter(p);
        !          3319:   rc = saveAllCursors(pBt, 0, 0);
        !          3320: #ifndef SQLITE_OMIT_SHARED_CACHE
        !          3321:   if( rc!=SQLITE_OK ){
        !          3322:     /* This is a horrible situation. An IO or malloc() error occurred whilst
        !          3323:     ** trying to save cursor positions. If this is an automatic rollback (as
        !          3324:     ** the result of a constraint, malloc() failure or IO error) then 
        !          3325:     ** the cache may be internally inconsistent (not contain valid trees) so
        !          3326:     ** we cannot simply return the error to the caller. Instead, abort 
        !          3327:     ** all queries that may be using any of the cursors that failed to save.
        !          3328:     */
        !          3329:     sqlite3BtreeTripAllCursors(p, rc);
        !          3330:   }
        !          3331: #endif
        !          3332:   btreeIntegrity(p);
        !          3333: 
        !          3334:   if( p->inTrans==TRANS_WRITE ){
        !          3335:     int rc2;
        !          3336: 
        !          3337:     assert( TRANS_WRITE==pBt->inTransaction );
        !          3338:     rc2 = sqlite3PagerRollback(pBt->pPager);
        !          3339:     if( rc2!=SQLITE_OK ){
        !          3340:       rc = rc2;
        !          3341:     }
        !          3342: 
        !          3343:     /* The rollback may have destroyed the pPage1->aData value.  So
        !          3344:     ** call btreeGetPage() on page 1 again to make
        !          3345:     ** sure pPage1->aData is set correctly. */
        !          3346:     if( btreeGetPage(pBt, 1, &pPage1, 0)==SQLITE_OK ){
        !          3347:       int nPage = get4byte(28+(u8*)pPage1->aData);
        !          3348:       testcase( nPage==0 );
        !          3349:       if( nPage==0 ) sqlite3PagerPagecount(pBt->pPager, &nPage);
        !          3350:       testcase( pBt->nPage!=nPage );
        !          3351:       pBt->nPage = nPage;
        !          3352:       releasePage(pPage1);
        !          3353:     }
        !          3354:     assert( countWriteCursors(pBt)==0 );
        !          3355:     pBt->inTransaction = TRANS_READ;
        !          3356:   }
        !          3357: 
        !          3358:   btreeEndTransaction(p);
        !          3359:   sqlite3BtreeLeave(p);
        !          3360:   return rc;
        !          3361: }
        !          3362: 
        !          3363: /*
        !          3364: ** Start a statement subtransaction. The subtransaction can can be rolled
        !          3365: ** back independently of the main transaction. You must start a transaction 
        !          3366: ** before starting a subtransaction. The subtransaction is ended automatically 
        !          3367: ** if the main transaction commits or rolls back.
        !          3368: **
        !          3369: ** Statement subtransactions are used around individual SQL statements
        !          3370: ** that are contained within a BEGIN...COMMIT block.  If a constraint
        !          3371: ** error occurs within the statement, the effect of that one statement
        !          3372: ** can be rolled back without having to rollback the entire transaction.
        !          3373: **
        !          3374: ** A statement sub-transaction is implemented as an anonymous savepoint. The
        !          3375: ** value passed as the second parameter is the total number of savepoints,
        !          3376: ** including the new anonymous savepoint, open on the B-Tree. i.e. if there
        !          3377: ** are no active savepoints and no other statement-transactions open,
        !          3378: ** iStatement is 1. This anonymous savepoint can be released or rolled back
        !          3379: ** using the sqlite3BtreeSavepoint() function.
        !          3380: */
        !          3381: int sqlite3BtreeBeginStmt(Btree *p, int iStatement){
        !          3382:   int rc;
        !          3383:   BtShared *pBt = p->pBt;
        !          3384:   sqlite3BtreeEnter(p);
        !          3385:   assert( p->inTrans==TRANS_WRITE );
        !          3386:   assert( (pBt->btsFlags & BTS_READ_ONLY)==0 );
        !          3387:   assert( iStatement>0 );
        !          3388:   assert( iStatement>p->db->nSavepoint );
        !          3389:   assert( pBt->inTransaction==TRANS_WRITE );
        !          3390:   /* At the pager level, a statement transaction is a savepoint with
        !          3391:   ** an index greater than all savepoints created explicitly using
        !          3392:   ** SQL statements. It is illegal to open, release or rollback any
        !          3393:   ** such savepoints while the statement transaction savepoint is active.
        !          3394:   */
        !          3395:   rc = sqlite3PagerOpenSavepoint(pBt->pPager, iStatement);
        !          3396:   sqlite3BtreeLeave(p);
        !          3397:   return rc;
        !          3398: }
        !          3399: 
        !          3400: /*
        !          3401: ** The second argument to this function, op, is always SAVEPOINT_ROLLBACK
        !          3402: ** or SAVEPOINT_RELEASE. This function either releases or rolls back the
        !          3403: ** savepoint identified by parameter iSavepoint, depending on the value 
        !          3404: ** of op.
        !          3405: **
        !          3406: ** Normally, iSavepoint is greater than or equal to zero. However, if op is
        !          3407: ** SAVEPOINT_ROLLBACK, then iSavepoint may also be -1. In this case the 
        !          3408: ** contents of the entire transaction are rolled back. This is different
        !          3409: ** from a normal transaction rollback, as no locks are released and the
        !          3410: ** transaction remains open.
        !          3411: */
        !          3412: int sqlite3BtreeSavepoint(Btree *p, int op, int iSavepoint){
        !          3413:   int rc = SQLITE_OK;
        !          3414:   if( p && p->inTrans==TRANS_WRITE ){
        !          3415:     BtShared *pBt = p->pBt;
        !          3416:     assert( op==SAVEPOINT_RELEASE || op==SAVEPOINT_ROLLBACK );
        !          3417:     assert( iSavepoint>=0 || (iSavepoint==-1 && op==SAVEPOINT_ROLLBACK) );
        !          3418:     sqlite3BtreeEnter(p);
        !          3419:     rc = sqlite3PagerSavepoint(pBt->pPager, op, iSavepoint);
        !          3420:     if( rc==SQLITE_OK ){
        !          3421:       if( iSavepoint<0 && (pBt->btsFlags & BTS_INITIALLY_EMPTY)!=0 ){
        !          3422:         pBt->nPage = 0;
        !          3423:       }
        !          3424:       rc = newDatabase(pBt);
        !          3425:       pBt->nPage = get4byte(28 + pBt->pPage1->aData);
        !          3426: 
        !          3427:       /* The database size was written into the offset 28 of the header
        !          3428:       ** when the transaction started, so we know that the value at offset
        !          3429:       ** 28 is nonzero. */
        !          3430:       assert( pBt->nPage>0 );
        !          3431:     }
        !          3432:     sqlite3BtreeLeave(p);
        !          3433:   }
        !          3434:   return rc;
        !          3435: }
        !          3436: 
        !          3437: /*
        !          3438: ** Create a new cursor for the BTree whose root is on the page
        !          3439: ** iTable. If a read-only cursor is requested, it is assumed that
        !          3440: ** the caller already has at least a read-only transaction open
        !          3441: ** on the database already. If a write-cursor is requested, then
        !          3442: ** the caller is assumed to have an open write transaction.
        !          3443: **
        !          3444: ** If wrFlag==0, then the cursor can only be used for reading.
        !          3445: ** If wrFlag==1, then the cursor can be used for reading or for
        !          3446: ** writing if other conditions for writing are also met.  These
        !          3447: ** are the conditions that must be met in order for writing to
        !          3448: ** be allowed:
        !          3449: **
        !          3450: ** 1:  The cursor must have been opened with wrFlag==1
        !          3451: **
        !          3452: ** 2:  Other database connections that share the same pager cache
        !          3453: **     but which are not in the READ_UNCOMMITTED state may not have
        !          3454: **     cursors open with wrFlag==0 on the same table.  Otherwise
        !          3455: **     the changes made by this write cursor would be visible to
        !          3456: **     the read cursors in the other database connection.
        !          3457: **
        !          3458: ** 3:  The database must be writable (not on read-only media)
        !          3459: **
        !          3460: ** 4:  There must be an active transaction.
        !          3461: **
        !          3462: ** No checking is done to make sure that page iTable really is the
        !          3463: ** root page of a b-tree.  If it is not, then the cursor acquired
        !          3464: ** will not work correctly.
        !          3465: **
        !          3466: ** It is assumed that the sqlite3BtreeCursorZero() has been called
        !          3467: ** on pCur to initialize the memory space prior to invoking this routine.
        !          3468: */
        !          3469: static int btreeCursor(
        !          3470:   Btree *p,                              /* The btree */
        !          3471:   int iTable,                            /* Root page of table to open */
        !          3472:   int wrFlag,                            /* 1 to write. 0 read-only */
        !          3473:   struct KeyInfo *pKeyInfo,              /* First arg to comparison function */
        !          3474:   BtCursor *pCur                         /* Space for new cursor */
        !          3475: ){
        !          3476:   BtShared *pBt = p->pBt;                /* Shared b-tree handle */
        !          3477: 
        !          3478:   assert( sqlite3BtreeHoldsMutex(p) );
        !          3479:   assert( wrFlag==0 || wrFlag==1 );
        !          3480: 
        !          3481:   /* The following assert statements verify that if this is a sharable 
        !          3482:   ** b-tree database, the connection is holding the required table locks, 
        !          3483:   ** and that no other connection has any open cursor that conflicts with 
        !          3484:   ** this lock.  */
        !          3485:   assert( hasSharedCacheTableLock(p, iTable, pKeyInfo!=0, wrFlag+1) );
        !          3486:   assert( wrFlag==0 || !hasReadConflicts(p, iTable) );
        !          3487: 
        !          3488:   /* Assert that the caller has opened the required transaction. */
        !          3489:   assert( p->inTrans>TRANS_NONE );
        !          3490:   assert( wrFlag==0 || p->inTrans==TRANS_WRITE );
        !          3491:   assert( pBt->pPage1 && pBt->pPage1->aData );
        !          3492: 
        !          3493:   if( NEVER(wrFlag && (pBt->btsFlags & BTS_READ_ONLY)!=0) ){
        !          3494:     return SQLITE_READONLY;
        !          3495:   }
        !          3496:   if( iTable==1 && btreePagecount(pBt)==0 ){
        !          3497:     assert( wrFlag==0 );
        !          3498:     iTable = 0;
        !          3499:   }
        !          3500: 
        !          3501:   /* Now that no other errors can occur, finish filling in the BtCursor
        !          3502:   ** variables and link the cursor into the BtShared list.  */
        !          3503:   pCur->pgnoRoot = (Pgno)iTable;
        !          3504:   pCur->iPage = -1;
        !          3505:   pCur->pKeyInfo = pKeyInfo;
        !          3506:   pCur->pBtree = p;
        !          3507:   pCur->pBt = pBt;
        !          3508:   pCur->wrFlag = (u8)wrFlag;
        !          3509:   pCur->pNext = pBt->pCursor;
        !          3510:   if( pCur->pNext ){
        !          3511:     pCur->pNext->pPrev = pCur;
        !          3512:   }
        !          3513:   pBt->pCursor = pCur;
        !          3514:   pCur->eState = CURSOR_INVALID;
        !          3515:   pCur->cachedRowid = 0;
        !          3516:   return SQLITE_OK;
        !          3517: }
        !          3518: int sqlite3BtreeCursor(
        !          3519:   Btree *p,                                   /* The btree */
        !          3520:   int iTable,                                 /* Root page of table to open */
        !          3521:   int wrFlag,                                 /* 1 to write. 0 read-only */
        !          3522:   struct KeyInfo *pKeyInfo,                   /* First arg to xCompare() */
        !          3523:   BtCursor *pCur                              /* Write new cursor here */
        !          3524: ){
        !          3525:   int rc;
        !          3526:   sqlite3BtreeEnter(p);
        !          3527:   rc = btreeCursor(p, iTable, wrFlag, pKeyInfo, pCur);
        !          3528:   sqlite3BtreeLeave(p);
        !          3529:   return rc;
        !          3530: }
        !          3531: 
        !          3532: /*
        !          3533: ** Return the size of a BtCursor object in bytes.
        !          3534: **
        !          3535: ** This interfaces is needed so that users of cursors can preallocate
        !          3536: ** sufficient storage to hold a cursor.  The BtCursor object is opaque
        !          3537: ** to users so they cannot do the sizeof() themselves - they must call
        !          3538: ** this routine.
        !          3539: */
        !          3540: int sqlite3BtreeCursorSize(void){
        !          3541:   return ROUND8(sizeof(BtCursor));
        !          3542: }
        !          3543: 
        !          3544: /*
        !          3545: ** Initialize memory that will be converted into a BtCursor object.
        !          3546: **
        !          3547: ** The simple approach here would be to memset() the entire object
        !          3548: ** to zero.  But it turns out that the apPage[] and aiIdx[] arrays
        !          3549: ** do not need to be zeroed and they are large, so we can save a lot
        !          3550: ** of run-time by skipping the initialization of those elements.
        !          3551: */
        !          3552: void sqlite3BtreeCursorZero(BtCursor *p){
        !          3553:   memset(p, 0, offsetof(BtCursor, iPage));
        !          3554: }
        !          3555: 
        !          3556: /*
        !          3557: ** Set the cached rowid value of every cursor in the same database file
        !          3558: ** as pCur and having the same root page number as pCur.  The value is
        !          3559: ** set to iRowid.
        !          3560: **
        !          3561: ** Only positive rowid values are considered valid for this cache.
        !          3562: ** The cache is initialized to zero, indicating an invalid cache.
        !          3563: ** A btree will work fine with zero or negative rowids.  We just cannot
        !          3564: ** cache zero or negative rowids, which means tables that use zero or
        !          3565: ** negative rowids might run a little slower.  But in practice, zero
        !          3566: ** or negative rowids are very uncommon so this should not be a problem.
        !          3567: */
        !          3568: void sqlite3BtreeSetCachedRowid(BtCursor *pCur, sqlite3_int64 iRowid){
        !          3569:   BtCursor *p;
        !          3570:   for(p=pCur->pBt->pCursor; p; p=p->pNext){
        !          3571:     if( p->pgnoRoot==pCur->pgnoRoot ) p->cachedRowid = iRowid;
        !          3572:   }
        !          3573:   assert( pCur->cachedRowid==iRowid );
        !          3574: }
        !          3575: 
        !          3576: /*
        !          3577: ** Return the cached rowid for the given cursor.  A negative or zero
        !          3578: ** return value indicates that the rowid cache is invalid and should be
        !          3579: ** ignored.  If the rowid cache has never before been set, then a
        !          3580: ** zero is returned.
        !          3581: */
        !          3582: sqlite3_int64 sqlite3BtreeGetCachedRowid(BtCursor *pCur){
        !          3583:   return pCur->cachedRowid;
        !          3584: }
        !          3585: 
        !          3586: /*
        !          3587: ** Close a cursor.  The read lock on the database file is released
        !          3588: ** when the last cursor is closed.
        !          3589: */
        !          3590: int sqlite3BtreeCloseCursor(BtCursor *pCur){
        !          3591:   Btree *pBtree = pCur->pBtree;
        !          3592:   if( pBtree ){
        !          3593:     int i;
        !          3594:     BtShared *pBt = pCur->pBt;
        !          3595:     sqlite3BtreeEnter(pBtree);
        !          3596:     sqlite3BtreeClearCursor(pCur);
        !          3597:     if( pCur->pPrev ){
        !          3598:       pCur->pPrev->pNext = pCur->pNext;
        !          3599:     }else{
        !          3600:       pBt->pCursor = pCur->pNext;
        !          3601:     }
        !          3602:     if( pCur->pNext ){
        !          3603:       pCur->pNext->pPrev = pCur->pPrev;
        !          3604:     }
        !          3605:     for(i=0; i<=pCur->iPage; i++){
        !          3606:       releasePage(pCur->apPage[i]);
        !          3607:     }
        !          3608:     unlockBtreeIfUnused(pBt);
        !          3609:     invalidateOverflowCache(pCur);
        !          3610:     /* sqlite3_free(pCur); */
        !          3611:     sqlite3BtreeLeave(pBtree);
        !          3612:   }
        !          3613:   return SQLITE_OK;
        !          3614: }
        !          3615: 
        !          3616: /*
        !          3617: ** Make sure the BtCursor* given in the argument has a valid
        !          3618: ** BtCursor.info structure.  If it is not already valid, call
        !          3619: ** btreeParseCell() to fill it in.
        !          3620: **
        !          3621: ** BtCursor.info is a cache of the information in the current cell.
        !          3622: ** Using this cache reduces the number of calls to btreeParseCell().
        !          3623: **
        !          3624: ** 2007-06-25:  There is a bug in some versions of MSVC that cause the
        !          3625: ** compiler to crash when getCellInfo() is implemented as a macro.
        !          3626: ** But there is a measureable speed advantage to using the macro on gcc
        !          3627: ** (when less compiler optimizations like -Os or -O0 are used and the
        !          3628: ** compiler is not doing agressive inlining.)  So we use a real function
        !          3629: ** for MSVC and a macro for everything else.  Ticket #2457.
        !          3630: */
        !          3631: #ifndef NDEBUG
        !          3632:   static void assertCellInfo(BtCursor *pCur){
        !          3633:     CellInfo info;
        !          3634:     int iPage = pCur->iPage;
        !          3635:     memset(&info, 0, sizeof(info));
        !          3636:     btreeParseCell(pCur->apPage[iPage], pCur->aiIdx[iPage], &info);
        !          3637:     assert( memcmp(&info, &pCur->info, sizeof(info))==0 );
        !          3638:   }
        !          3639: #else
        !          3640:   #define assertCellInfo(x)
        !          3641: #endif
        !          3642: #ifdef _MSC_VER
        !          3643:   /* Use a real function in MSVC to work around bugs in that compiler. */
        !          3644:   static void getCellInfo(BtCursor *pCur){
        !          3645:     if( pCur->info.nSize==0 ){
        !          3646:       int iPage = pCur->iPage;
        !          3647:       btreeParseCell(pCur->apPage[iPage],pCur->aiIdx[iPage],&pCur->info);
        !          3648:       pCur->validNKey = 1;
        !          3649:     }else{
        !          3650:       assertCellInfo(pCur);
        !          3651:     }
        !          3652:   }
        !          3653: #else /* if not _MSC_VER */
        !          3654:   /* Use a macro in all other compilers so that the function is inlined */
        !          3655: #define getCellInfo(pCur)                                                      \
        !          3656:   if( pCur->info.nSize==0 ){                                                   \
        !          3657:     int iPage = pCur->iPage;                                                   \
        !          3658:     btreeParseCell(pCur->apPage[iPage],pCur->aiIdx[iPage],&pCur->info); \
        !          3659:     pCur->validNKey = 1;                                                       \
        !          3660:   }else{                                                                       \
        !          3661:     assertCellInfo(pCur);                                                      \
        !          3662:   }
        !          3663: #endif /* _MSC_VER */
        !          3664: 
        !          3665: #ifndef NDEBUG  /* The next routine used only within assert() statements */
        !          3666: /*
        !          3667: ** Return true if the given BtCursor is valid.  A valid cursor is one
        !          3668: ** that is currently pointing to a row in a (non-empty) table.
        !          3669: ** This is a verification routine is used only within assert() statements.
        !          3670: */
        !          3671: int sqlite3BtreeCursorIsValid(BtCursor *pCur){
        !          3672:   return pCur && pCur->eState==CURSOR_VALID;
        !          3673: }
        !          3674: #endif /* NDEBUG */
        !          3675: 
        !          3676: /*
        !          3677: ** Set *pSize to the size of the buffer needed to hold the value of
        !          3678: ** the key for the current entry.  If the cursor is not pointing
        !          3679: ** to a valid entry, *pSize is set to 0. 
        !          3680: **
        !          3681: ** For a table with the INTKEY flag set, this routine returns the key
        !          3682: ** itself, not the number of bytes in the key.
        !          3683: **
        !          3684: ** The caller must position the cursor prior to invoking this routine.
        !          3685: ** 
        !          3686: ** This routine cannot fail.  It always returns SQLITE_OK.  
        !          3687: */
        !          3688: int sqlite3BtreeKeySize(BtCursor *pCur, i64 *pSize){
        !          3689:   assert( cursorHoldsMutex(pCur) );
        !          3690:   assert( pCur->eState==CURSOR_INVALID || pCur->eState==CURSOR_VALID );
        !          3691:   if( pCur->eState!=CURSOR_VALID ){
        !          3692:     *pSize = 0;
        !          3693:   }else{
        !          3694:     getCellInfo(pCur);
        !          3695:     *pSize = pCur->info.nKey;
        !          3696:   }
        !          3697:   return SQLITE_OK;
        !          3698: }
        !          3699: 
        !          3700: /*
        !          3701: ** Set *pSize to the number of bytes of data in the entry the
        !          3702: ** cursor currently points to.
        !          3703: **
        !          3704: ** The caller must guarantee that the cursor is pointing to a non-NULL
        !          3705: ** valid entry.  In other words, the calling procedure must guarantee
        !          3706: ** that the cursor has Cursor.eState==CURSOR_VALID.
        !          3707: **
        !          3708: ** Failure is not possible.  This function always returns SQLITE_OK.
        !          3709: ** It might just as well be a procedure (returning void) but we continue
        !          3710: ** to return an integer result code for historical reasons.
        !          3711: */
        !          3712: int sqlite3BtreeDataSize(BtCursor *pCur, u32 *pSize){
        !          3713:   assert( cursorHoldsMutex(pCur) );
        !          3714:   assert( pCur->eState==CURSOR_VALID );
        !          3715:   getCellInfo(pCur);
        !          3716:   *pSize = pCur->info.nData;
        !          3717:   return SQLITE_OK;
        !          3718: }
        !          3719: 
        !          3720: /*
        !          3721: ** Given the page number of an overflow page in the database (parameter
        !          3722: ** ovfl), this function finds the page number of the next page in the 
        !          3723: ** linked list of overflow pages. If possible, it uses the auto-vacuum
        !          3724: ** pointer-map data instead of reading the content of page ovfl to do so. 
        !          3725: **
        !          3726: ** If an error occurs an SQLite error code is returned. Otherwise:
        !          3727: **
        !          3728: ** The page number of the next overflow page in the linked list is 
        !          3729: ** written to *pPgnoNext. If page ovfl is the last page in its linked 
        !          3730: ** list, *pPgnoNext is set to zero. 
        !          3731: **
        !          3732: ** If ppPage is not NULL, and a reference to the MemPage object corresponding
        !          3733: ** to page number pOvfl was obtained, then *ppPage is set to point to that
        !          3734: ** reference. It is the responsibility of the caller to call releasePage()
        !          3735: ** on *ppPage to free the reference. In no reference was obtained (because
        !          3736: ** the pointer-map was used to obtain the value for *pPgnoNext), then
        !          3737: ** *ppPage is set to zero.
        !          3738: */
        !          3739: static int getOverflowPage(
        !          3740:   BtShared *pBt,               /* The database file */
        !          3741:   Pgno ovfl,                   /* Current overflow page number */
        !          3742:   MemPage **ppPage,            /* OUT: MemPage handle (may be NULL) */
        !          3743:   Pgno *pPgnoNext              /* OUT: Next overflow page number */
        !          3744: ){
        !          3745:   Pgno next = 0;
        !          3746:   MemPage *pPage = 0;
        !          3747:   int rc = SQLITE_OK;
        !          3748: 
        !          3749:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          3750:   assert(pPgnoNext);
        !          3751: 
        !          3752: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          3753:   /* Try to find the next page in the overflow list using the
        !          3754:   ** autovacuum pointer-map pages. Guess that the next page in 
        !          3755:   ** the overflow list is page number (ovfl+1). If that guess turns 
        !          3756:   ** out to be wrong, fall back to loading the data of page 
        !          3757:   ** number ovfl to determine the next page number.
        !          3758:   */
        !          3759:   if( pBt->autoVacuum ){
        !          3760:     Pgno pgno;
        !          3761:     Pgno iGuess = ovfl+1;
        !          3762:     u8 eType;
        !          3763: 
        !          3764:     while( PTRMAP_ISPAGE(pBt, iGuess) || iGuess==PENDING_BYTE_PAGE(pBt) ){
        !          3765:       iGuess++;
        !          3766:     }
        !          3767: 
        !          3768:     if( iGuess<=btreePagecount(pBt) ){
        !          3769:       rc = ptrmapGet(pBt, iGuess, &eType, &pgno);
        !          3770:       if( rc==SQLITE_OK && eType==PTRMAP_OVERFLOW2 && pgno==ovfl ){
        !          3771:         next = iGuess;
        !          3772:         rc = SQLITE_DONE;
        !          3773:       }
        !          3774:     }
        !          3775:   }
        !          3776: #endif
        !          3777: 
        !          3778:   assert( next==0 || rc==SQLITE_DONE );
        !          3779:   if( rc==SQLITE_OK ){
        !          3780:     rc = btreeGetPage(pBt, ovfl, &pPage, 0);
        !          3781:     assert( rc==SQLITE_OK || pPage==0 );
        !          3782:     if( rc==SQLITE_OK ){
        !          3783:       next = get4byte(pPage->aData);
        !          3784:     }
        !          3785:   }
        !          3786: 
        !          3787:   *pPgnoNext = next;
        !          3788:   if( ppPage ){
        !          3789:     *ppPage = pPage;
        !          3790:   }else{
        !          3791:     releasePage(pPage);
        !          3792:   }
        !          3793:   return (rc==SQLITE_DONE ? SQLITE_OK : rc);
        !          3794: }
        !          3795: 
        !          3796: /*
        !          3797: ** Copy data from a buffer to a page, or from a page to a buffer.
        !          3798: **
        !          3799: ** pPayload is a pointer to data stored on database page pDbPage.
        !          3800: ** If argument eOp is false, then nByte bytes of data are copied
        !          3801: ** from pPayload to the buffer pointed at by pBuf. If eOp is true,
        !          3802: ** then sqlite3PagerWrite() is called on pDbPage and nByte bytes
        !          3803: ** of data are copied from the buffer pBuf to pPayload.
        !          3804: **
        !          3805: ** SQLITE_OK is returned on success, otherwise an error code.
        !          3806: */
        !          3807: static int copyPayload(
        !          3808:   void *pPayload,           /* Pointer to page data */
        !          3809:   void *pBuf,               /* Pointer to buffer */
        !          3810:   int nByte,                /* Number of bytes to copy */
        !          3811:   int eOp,                  /* 0 -> copy from page, 1 -> copy to page */
        !          3812:   DbPage *pDbPage           /* Page containing pPayload */
        !          3813: ){
        !          3814:   if( eOp ){
        !          3815:     /* Copy data from buffer to page (a write operation) */
        !          3816:     int rc = sqlite3PagerWrite(pDbPage);
        !          3817:     if( rc!=SQLITE_OK ){
        !          3818:       return rc;
        !          3819:     }
        !          3820:     memcpy(pPayload, pBuf, nByte);
        !          3821:   }else{
        !          3822:     /* Copy data from page to buffer (a read operation) */
        !          3823:     memcpy(pBuf, pPayload, nByte);
        !          3824:   }
        !          3825:   return SQLITE_OK;
        !          3826: }
        !          3827: 
        !          3828: /*
        !          3829: ** This function is used to read or overwrite payload information
        !          3830: ** for the entry that the pCur cursor is pointing to. If the eOp
        !          3831: ** parameter is 0, this is a read operation (data copied into
        !          3832: ** buffer pBuf). If it is non-zero, a write (data copied from
        !          3833: ** buffer pBuf).
        !          3834: **
        !          3835: ** A total of "amt" bytes are read or written beginning at "offset".
        !          3836: ** Data is read to or from the buffer pBuf.
        !          3837: **
        !          3838: ** The content being read or written might appear on the main page
        !          3839: ** or be scattered out on multiple overflow pages.
        !          3840: **
        !          3841: ** If the BtCursor.isIncrblobHandle flag is set, and the current
        !          3842: ** cursor entry uses one or more overflow pages, this function
        !          3843: ** allocates space for and lazily popluates the overflow page-list 
        !          3844: ** cache array (BtCursor.aOverflow). Subsequent calls use this
        !          3845: ** cache to make seeking to the supplied offset more efficient.
        !          3846: **
        !          3847: ** Once an overflow page-list cache has been allocated, it may be
        !          3848: ** invalidated if some other cursor writes to the same table, or if
        !          3849: ** the cursor is moved to a different row. Additionally, in auto-vacuum
        !          3850: ** mode, the following events may invalidate an overflow page-list cache.
        !          3851: **
        !          3852: **   * An incremental vacuum,
        !          3853: **   * A commit in auto_vacuum="full" mode,
        !          3854: **   * Creating a table (may require moving an overflow page).
        !          3855: */
        !          3856: static int accessPayload(
        !          3857:   BtCursor *pCur,      /* Cursor pointing to entry to read from */
        !          3858:   u32 offset,          /* Begin reading this far into payload */
        !          3859:   u32 amt,             /* Read this many bytes */
        !          3860:   unsigned char *pBuf, /* Write the bytes into this buffer */ 
        !          3861:   int eOp              /* zero to read. non-zero to write. */
        !          3862: ){
        !          3863:   unsigned char *aPayload;
        !          3864:   int rc = SQLITE_OK;
        !          3865:   u32 nKey;
        !          3866:   int iIdx = 0;
        !          3867:   MemPage *pPage = pCur->apPage[pCur->iPage]; /* Btree page of current entry */
        !          3868:   BtShared *pBt = pCur->pBt;                  /* Btree this cursor belongs to */
        !          3869: 
        !          3870:   assert( pPage );
        !          3871:   assert( pCur->eState==CURSOR_VALID );
        !          3872:   assert( pCur->aiIdx[pCur->iPage]<pPage->nCell );
        !          3873:   assert( cursorHoldsMutex(pCur) );
        !          3874: 
        !          3875:   getCellInfo(pCur);
        !          3876:   aPayload = pCur->info.pCell + pCur->info.nHeader;
        !          3877:   nKey = (pPage->intKey ? 0 : (int)pCur->info.nKey);
        !          3878: 
        !          3879:   if( NEVER(offset+amt > nKey+pCur->info.nData) 
        !          3880:    || &aPayload[pCur->info.nLocal] > &pPage->aData[pBt->usableSize]
        !          3881:   ){
        !          3882:     /* Trying to read or write past the end of the data is an error */
        !          3883:     return SQLITE_CORRUPT_BKPT;
        !          3884:   }
        !          3885: 
        !          3886:   /* Check if data must be read/written to/from the btree page itself. */
        !          3887:   if( offset<pCur->info.nLocal ){
        !          3888:     int a = amt;
        !          3889:     if( a+offset>pCur->info.nLocal ){
        !          3890:       a = pCur->info.nLocal - offset;
        !          3891:     }
        !          3892:     rc = copyPayload(&aPayload[offset], pBuf, a, eOp, pPage->pDbPage);
        !          3893:     offset = 0;
        !          3894:     pBuf += a;
        !          3895:     amt -= a;
        !          3896:   }else{
        !          3897:     offset -= pCur->info.nLocal;
        !          3898:   }
        !          3899: 
        !          3900:   if( rc==SQLITE_OK && amt>0 ){
        !          3901:     const u32 ovflSize = pBt->usableSize - 4;  /* Bytes content per ovfl page */
        !          3902:     Pgno nextPage;
        !          3903: 
        !          3904:     nextPage = get4byte(&aPayload[pCur->info.nLocal]);
        !          3905: 
        !          3906: #ifndef SQLITE_OMIT_INCRBLOB
        !          3907:     /* If the isIncrblobHandle flag is set and the BtCursor.aOverflow[]
        !          3908:     ** has not been allocated, allocate it now. The array is sized at
        !          3909:     ** one entry for each overflow page in the overflow chain. The
        !          3910:     ** page number of the first overflow page is stored in aOverflow[0],
        !          3911:     ** etc. A value of 0 in the aOverflow[] array means "not yet known"
        !          3912:     ** (the cache is lazily populated).
        !          3913:     */
        !          3914:     if( pCur->isIncrblobHandle && !pCur->aOverflow ){
        !          3915:       int nOvfl = (pCur->info.nPayload-pCur->info.nLocal+ovflSize-1)/ovflSize;
        !          3916:       pCur->aOverflow = (Pgno *)sqlite3MallocZero(sizeof(Pgno)*nOvfl);
        !          3917:       /* nOvfl is always positive.  If it were zero, fetchPayload would have
        !          3918:       ** been used instead of this routine. */
        !          3919:       if( ALWAYS(nOvfl) && !pCur->aOverflow ){
        !          3920:         rc = SQLITE_NOMEM;
        !          3921:       }
        !          3922:     }
        !          3923: 
        !          3924:     /* If the overflow page-list cache has been allocated and the
        !          3925:     ** entry for the first required overflow page is valid, skip
        !          3926:     ** directly to it.
        !          3927:     */
        !          3928:     if( pCur->aOverflow && pCur->aOverflow[offset/ovflSize] ){
        !          3929:       iIdx = (offset/ovflSize);
        !          3930:       nextPage = pCur->aOverflow[iIdx];
        !          3931:       offset = (offset%ovflSize);
        !          3932:     }
        !          3933: #endif
        !          3934: 
        !          3935:     for( ; rc==SQLITE_OK && amt>0 && nextPage; iIdx++){
        !          3936: 
        !          3937: #ifndef SQLITE_OMIT_INCRBLOB
        !          3938:       /* If required, populate the overflow page-list cache. */
        !          3939:       if( pCur->aOverflow ){
        !          3940:         assert(!pCur->aOverflow[iIdx] || pCur->aOverflow[iIdx]==nextPage);
        !          3941:         pCur->aOverflow[iIdx] = nextPage;
        !          3942:       }
        !          3943: #endif
        !          3944: 
        !          3945:       if( offset>=ovflSize ){
        !          3946:         /* The only reason to read this page is to obtain the page
        !          3947:         ** number for the next page in the overflow chain. The page
        !          3948:         ** data is not required. So first try to lookup the overflow
        !          3949:         ** page-list cache, if any, then fall back to the getOverflowPage()
        !          3950:         ** function.
        !          3951:         */
        !          3952: #ifndef SQLITE_OMIT_INCRBLOB
        !          3953:         if( pCur->aOverflow && pCur->aOverflow[iIdx+1] ){
        !          3954:           nextPage = pCur->aOverflow[iIdx+1];
        !          3955:         } else 
        !          3956: #endif
        !          3957:           rc = getOverflowPage(pBt, nextPage, 0, &nextPage);
        !          3958:         offset -= ovflSize;
        !          3959:       }else{
        !          3960:         /* Need to read this page properly. It contains some of the
        !          3961:         ** range of data that is being read (eOp==0) or written (eOp!=0).
        !          3962:         */
        !          3963: #ifdef SQLITE_DIRECT_OVERFLOW_READ
        !          3964:         sqlite3_file *fd;
        !          3965: #endif
        !          3966:         int a = amt;
        !          3967:         if( a + offset > ovflSize ){
        !          3968:           a = ovflSize - offset;
        !          3969:         }
        !          3970: 
        !          3971: #ifdef SQLITE_DIRECT_OVERFLOW_READ
        !          3972:         /* If all the following are true:
        !          3973:         **
        !          3974:         **   1) this is a read operation, and 
        !          3975:         **   2) data is required from the start of this overflow page, and
        !          3976:         **   3) the database is file-backed, and
        !          3977:         **   4) there is no open write-transaction, and
        !          3978:         **   5) the database is not a WAL database,
        !          3979:         **
        !          3980:         ** then data can be read directly from the database file into the
        !          3981:         ** output buffer, bypassing the page-cache altogether. This speeds
        !          3982:         ** up loading large records that span many overflow pages.
        !          3983:         */
        !          3984:         if( eOp==0                                             /* (1) */
        !          3985:          && offset==0                                          /* (2) */
        !          3986:          && pBt->inTransaction==TRANS_READ                     /* (4) */
        !          3987:          && (fd = sqlite3PagerFile(pBt->pPager))->pMethods     /* (3) */
        !          3988:          && pBt->pPage1->aData[19]==0x01                       /* (5) */
        !          3989:         ){
        !          3990:           u8 aSave[4];
        !          3991:           u8 *aWrite = &pBuf[-4];
        !          3992:           memcpy(aSave, aWrite, 4);
        !          3993:           rc = sqlite3OsRead(fd, aWrite, a+4, (i64)pBt->pageSize*(nextPage-1));
        !          3994:           nextPage = get4byte(aWrite);
        !          3995:           memcpy(aWrite, aSave, 4);
        !          3996:         }else
        !          3997: #endif
        !          3998: 
        !          3999:         {
        !          4000:           DbPage *pDbPage;
        !          4001:           rc = sqlite3PagerGet(pBt->pPager, nextPage, &pDbPage);
        !          4002:           if( rc==SQLITE_OK ){
        !          4003:             aPayload = sqlite3PagerGetData(pDbPage);
        !          4004:             nextPage = get4byte(aPayload);
        !          4005:             rc = copyPayload(&aPayload[offset+4], pBuf, a, eOp, pDbPage);
        !          4006:             sqlite3PagerUnref(pDbPage);
        !          4007:             offset = 0;
        !          4008:           }
        !          4009:         }
        !          4010:         amt -= a;
        !          4011:         pBuf += a;
        !          4012:       }
        !          4013:     }
        !          4014:   }
        !          4015: 
        !          4016:   if( rc==SQLITE_OK && amt>0 ){
        !          4017:     return SQLITE_CORRUPT_BKPT;
        !          4018:   }
        !          4019:   return rc;
        !          4020: }
        !          4021: 
        !          4022: /*
        !          4023: ** Read part of the key associated with cursor pCur.  Exactly
        !          4024: ** "amt" bytes will be transfered into pBuf[].  The transfer
        !          4025: ** begins at "offset".
        !          4026: **
        !          4027: ** The caller must ensure that pCur is pointing to a valid row
        !          4028: ** in the table.
        !          4029: **
        !          4030: ** Return SQLITE_OK on success or an error code if anything goes
        !          4031: ** wrong.  An error is returned if "offset+amt" is larger than
        !          4032: ** the available payload.
        !          4033: */
        !          4034: int sqlite3BtreeKey(BtCursor *pCur, u32 offset, u32 amt, void *pBuf){
        !          4035:   assert( cursorHoldsMutex(pCur) );
        !          4036:   assert( pCur->eState==CURSOR_VALID );
        !          4037:   assert( pCur->iPage>=0 && pCur->apPage[pCur->iPage] );
        !          4038:   assert( pCur->aiIdx[pCur->iPage]<pCur->apPage[pCur->iPage]->nCell );
        !          4039:   return accessPayload(pCur, offset, amt, (unsigned char*)pBuf, 0);
        !          4040: }
        !          4041: 
        !          4042: /*
        !          4043: ** Read part of the data associated with cursor pCur.  Exactly
        !          4044: ** "amt" bytes will be transfered into pBuf[].  The transfer
        !          4045: ** begins at "offset".
        !          4046: **
        !          4047: ** Return SQLITE_OK on success or an error code if anything goes
        !          4048: ** wrong.  An error is returned if "offset+amt" is larger than
        !          4049: ** the available payload.
        !          4050: */
        !          4051: int sqlite3BtreeData(BtCursor *pCur, u32 offset, u32 amt, void *pBuf){
        !          4052:   int rc;
        !          4053: 
        !          4054: #ifndef SQLITE_OMIT_INCRBLOB
        !          4055:   if ( pCur->eState==CURSOR_INVALID ){
        !          4056:     return SQLITE_ABORT;
        !          4057:   }
        !          4058: #endif
        !          4059: 
        !          4060:   assert( cursorHoldsMutex(pCur) );
        !          4061:   rc = restoreCursorPosition(pCur);
        !          4062:   if( rc==SQLITE_OK ){
        !          4063:     assert( pCur->eState==CURSOR_VALID );
        !          4064:     assert( pCur->iPage>=0 && pCur->apPage[pCur->iPage] );
        !          4065:     assert( pCur->aiIdx[pCur->iPage]<pCur->apPage[pCur->iPage]->nCell );
        !          4066:     rc = accessPayload(pCur, offset, amt, pBuf, 0);
        !          4067:   }
        !          4068:   return rc;
        !          4069: }
        !          4070: 
        !          4071: /*
        !          4072: ** Return a pointer to payload information from the entry that the 
        !          4073: ** pCur cursor is pointing to.  The pointer is to the beginning of
        !          4074: ** the key if skipKey==0 and it points to the beginning of data if
        !          4075: ** skipKey==1.  The number of bytes of available key/data is written
        !          4076: ** into *pAmt.  If *pAmt==0, then the value returned will not be
        !          4077: ** a valid pointer.
        !          4078: **
        !          4079: ** This routine is an optimization.  It is common for the entire key
        !          4080: ** and data to fit on the local page and for there to be no overflow
        !          4081: ** pages.  When that is so, this routine can be used to access the
        !          4082: ** key and data without making a copy.  If the key and/or data spills
        !          4083: ** onto overflow pages, then accessPayload() must be used to reassemble
        !          4084: ** the key/data and copy it into a preallocated buffer.
        !          4085: **
        !          4086: ** The pointer returned by this routine looks directly into the cached
        !          4087: ** page of the database.  The data might change or move the next time
        !          4088: ** any btree routine is called.
        !          4089: */
        !          4090: static const unsigned char *fetchPayload(
        !          4091:   BtCursor *pCur,      /* Cursor pointing to entry to read from */
        !          4092:   int *pAmt,           /* Write the number of available bytes here */
        !          4093:   int skipKey          /* read beginning at data if this is true */
        !          4094: ){
        !          4095:   unsigned char *aPayload;
        !          4096:   MemPage *pPage;
        !          4097:   u32 nKey;
        !          4098:   u32 nLocal;
        !          4099: 
        !          4100:   assert( pCur!=0 && pCur->iPage>=0 && pCur->apPage[pCur->iPage]);
        !          4101:   assert( pCur->eState==CURSOR_VALID );
        !          4102:   assert( cursorHoldsMutex(pCur) );
        !          4103:   pPage = pCur->apPage[pCur->iPage];
        !          4104:   assert( pCur->aiIdx[pCur->iPage]<pPage->nCell );
        !          4105:   if( NEVER(pCur->info.nSize==0) ){
        !          4106:     btreeParseCell(pCur->apPage[pCur->iPage], pCur->aiIdx[pCur->iPage],
        !          4107:                    &pCur->info);
        !          4108:   }
        !          4109:   aPayload = pCur->info.pCell;
        !          4110:   aPayload += pCur->info.nHeader;
        !          4111:   if( pPage->intKey ){
        !          4112:     nKey = 0;
        !          4113:   }else{
        !          4114:     nKey = (int)pCur->info.nKey;
        !          4115:   }
        !          4116:   if( skipKey ){
        !          4117:     aPayload += nKey;
        !          4118:     nLocal = pCur->info.nLocal - nKey;
        !          4119:   }else{
        !          4120:     nLocal = pCur->info.nLocal;
        !          4121:     assert( nLocal<=nKey );
        !          4122:   }
        !          4123:   *pAmt = nLocal;
        !          4124:   return aPayload;
        !          4125: }
        !          4126: 
        !          4127: 
        !          4128: /*
        !          4129: ** For the entry that cursor pCur is point to, return as
        !          4130: ** many bytes of the key or data as are available on the local
        !          4131: ** b-tree page.  Write the number of available bytes into *pAmt.
        !          4132: **
        !          4133: ** The pointer returned is ephemeral.  The key/data may move
        !          4134: ** or be destroyed on the next call to any Btree routine,
        !          4135: ** including calls from other threads against the same cache.
        !          4136: ** Hence, a mutex on the BtShared should be held prior to calling
        !          4137: ** this routine.
        !          4138: **
        !          4139: ** These routines is used to get quick access to key and data
        !          4140: ** in the common case where no overflow pages are used.
        !          4141: */
        !          4142: const void *sqlite3BtreeKeyFetch(BtCursor *pCur, int *pAmt){
        !          4143:   const void *p = 0;
        !          4144:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
        !          4145:   assert( cursorHoldsMutex(pCur) );
        !          4146:   if( ALWAYS(pCur->eState==CURSOR_VALID) ){
        !          4147:     p = (const void*)fetchPayload(pCur, pAmt, 0);
        !          4148:   }
        !          4149:   return p;
        !          4150: }
        !          4151: const void *sqlite3BtreeDataFetch(BtCursor *pCur, int *pAmt){
        !          4152:   const void *p = 0;
        !          4153:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
        !          4154:   assert( cursorHoldsMutex(pCur) );
        !          4155:   if( ALWAYS(pCur->eState==CURSOR_VALID) ){
        !          4156:     p = (const void*)fetchPayload(pCur, pAmt, 1);
        !          4157:   }
        !          4158:   return p;
        !          4159: }
        !          4160: 
        !          4161: 
        !          4162: /*
        !          4163: ** Move the cursor down to a new child page.  The newPgno argument is the
        !          4164: ** page number of the child page to move to.
        !          4165: **
        !          4166: ** This function returns SQLITE_CORRUPT if the page-header flags field of
        !          4167: ** the new child page does not match the flags field of the parent (i.e.
        !          4168: ** if an intkey page appears to be the parent of a non-intkey page, or
        !          4169: ** vice-versa).
        !          4170: */
        !          4171: static int moveToChild(BtCursor *pCur, u32 newPgno){
        !          4172:   int rc;
        !          4173:   int i = pCur->iPage;
        !          4174:   MemPage *pNewPage;
        !          4175:   BtShared *pBt = pCur->pBt;
        !          4176: 
        !          4177:   assert( cursorHoldsMutex(pCur) );
        !          4178:   assert( pCur->eState==CURSOR_VALID );
        !          4179:   assert( pCur->iPage<BTCURSOR_MAX_DEPTH );
        !          4180:   if( pCur->iPage>=(BTCURSOR_MAX_DEPTH-1) ){
        !          4181:     return SQLITE_CORRUPT_BKPT;
        !          4182:   }
        !          4183:   rc = getAndInitPage(pBt, newPgno, &pNewPage);
        !          4184:   if( rc ) return rc;
        !          4185:   pCur->apPage[i+1] = pNewPage;
        !          4186:   pCur->aiIdx[i+1] = 0;
        !          4187:   pCur->iPage++;
        !          4188: 
        !          4189:   pCur->info.nSize = 0;
        !          4190:   pCur->validNKey = 0;
        !          4191:   if( pNewPage->nCell<1 || pNewPage->intKey!=pCur->apPage[i]->intKey ){
        !          4192:     return SQLITE_CORRUPT_BKPT;
        !          4193:   }
        !          4194:   return SQLITE_OK;
        !          4195: }
        !          4196: 
        !          4197: #if 0
        !          4198: /*
        !          4199: ** Page pParent is an internal (non-leaf) tree page. This function 
        !          4200: ** asserts that page number iChild is the left-child if the iIdx'th
        !          4201: ** cell in page pParent. Or, if iIdx is equal to the total number of
        !          4202: ** cells in pParent, that page number iChild is the right-child of
        !          4203: ** the page.
        !          4204: */
        !          4205: static void assertParentIndex(MemPage *pParent, int iIdx, Pgno iChild){
        !          4206:   assert( iIdx<=pParent->nCell );
        !          4207:   if( iIdx==pParent->nCell ){
        !          4208:     assert( get4byte(&pParent->aData[pParent->hdrOffset+8])==iChild );
        !          4209:   }else{
        !          4210:     assert( get4byte(findCell(pParent, iIdx))==iChild );
        !          4211:   }
        !          4212: }
        !          4213: #else
        !          4214: #  define assertParentIndex(x,y,z) 
        !          4215: #endif
        !          4216: 
        !          4217: /*
        !          4218: ** Move the cursor up to the parent page.
        !          4219: **
        !          4220: ** pCur->idx is set to the cell index that contains the pointer
        !          4221: ** to the page we are coming from.  If we are coming from the
        !          4222: ** right-most child page then pCur->idx is set to one more than
        !          4223: ** the largest cell index.
        !          4224: */
        !          4225: static void moveToParent(BtCursor *pCur){
        !          4226:   assert( cursorHoldsMutex(pCur) );
        !          4227:   assert( pCur->eState==CURSOR_VALID );
        !          4228:   assert( pCur->iPage>0 );
        !          4229:   assert( pCur->apPage[pCur->iPage] );
        !          4230: 
        !          4231:   /* UPDATE: It is actually possible for the condition tested by the assert
        !          4232:   ** below to be untrue if the database file is corrupt. This can occur if
        !          4233:   ** one cursor has modified page pParent while a reference to it is held 
        !          4234:   ** by a second cursor. Which can only happen if a single page is linked
        !          4235:   ** into more than one b-tree structure in a corrupt database.  */
        !          4236: #if 0
        !          4237:   assertParentIndex(
        !          4238:     pCur->apPage[pCur->iPage-1], 
        !          4239:     pCur->aiIdx[pCur->iPage-1], 
        !          4240:     pCur->apPage[pCur->iPage]->pgno
        !          4241:   );
        !          4242: #endif
        !          4243:   testcase( pCur->aiIdx[pCur->iPage-1] > pCur->apPage[pCur->iPage-1]->nCell );
        !          4244: 
        !          4245:   releasePage(pCur->apPage[pCur->iPage]);
        !          4246:   pCur->iPage--;
        !          4247:   pCur->info.nSize = 0;
        !          4248:   pCur->validNKey = 0;
        !          4249: }
        !          4250: 
        !          4251: /*
        !          4252: ** Move the cursor to point to the root page of its b-tree structure.
        !          4253: **
        !          4254: ** If the table has a virtual root page, then the cursor is moved to point
        !          4255: ** to the virtual root page instead of the actual root page. A table has a
        !          4256: ** virtual root page when the actual root page contains no cells and a 
        !          4257: ** single child page. This can only happen with the table rooted at page 1.
        !          4258: **
        !          4259: ** If the b-tree structure is empty, the cursor state is set to 
        !          4260: ** CURSOR_INVALID. Otherwise, the cursor is set to point to the first
        !          4261: ** cell located on the root (or virtual root) page and the cursor state
        !          4262: ** is set to CURSOR_VALID.
        !          4263: **
        !          4264: ** If this function returns successfully, it may be assumed that the
        !          4265: ** page-header flags indicate that the [virtual] root-page is the expected 
        !          4266: ** kind of b-tree page (i.e. if when opening the cursor the caller did not
        !          4267: ** specify a KeyInfo structure the flags byte is set to 0x05 or 0x0D,
        !          4268: ** indicating a table b-tree, or if the caller did specify a KeyInfo 
        !          4269: ** structure the flags byte is set to 0x02 or 0x0A, indicating an index
        !          4270: ** b-tree).
        !          4271: */
        !          4272: static int moveToRoot(BtCursor *pCur){
        !          4273:   MemPage *pRoot;
        !          4274:   int rc = SQLITE_OK;
        !          4275:   Btree *p = pCur->pBtree;
        !          4276:   BtShared *pBt = p->pBt;
        !          4277: 
        !          4278:   assert( cursorHoldsMutex(pCur) );
        !          4279:   assert( CURSOR_INVALID < CURSOR_REQUIRESEEK );
        !          4280:   assert( CURSOR_VALID   < CURSOR_REQUIRESEEK );
        !          4281:   assert( CURSOR_FAULT   > CURSOR_REQUIRESEEK );
        !          4282:   if( pCur->eState>=CURSOR_REQUIRESEEK ){
        !          4283:     if( pCur->eState==CURSOR_FAULT ){
        !          4284:       assert( pCur->skipNext!=SQLITE_OK );
        !          4285:       return pCur->skipNext;
        !          4286:     }
        !          4287:     sqlite3BtreeClearCursor(pCur);
        !          4288:   }
        !          4289: 
        !          4290:   if( pCur->iPage>=0 ){
        !          4291:     int i;
        !          4292:     for(i=1; i<=pCur->iPage; i++){
        !          4293:       releasePage(pCur->apPage[i]);
        !          4294:     }
        !          4295:     pCur->iPage = 0;
        !          4296:   }else if( pCur->pgnoRoot==0 ){
        !          4297:     pCur->eState = CURSOR_INVALID;
        !          4298:     return SQLITE_OK;
        !          4299:   }else{
        !          4300:     rc = getAndInitPage(pBt, pCur->pgnoRoot, &pCur->apPage[0]);
        !          4301:     if( rc!=SQLITE_OK ){
        !          4302:       pCur->eState = CURSOR_INVALID;
        !          4303:       return rc;
        !          4304:     }
        !          4305:     pCur->iPage = 0;
        !          4306: 
        !          4307:     /* If pCur->pKeyInfo is not NULL, then the caller that opened this cursor
        !          4308:     ** expected to open it on an index b-tree. Otherwise, if pKeyInfo is
        !          4309:     ** NULL, the caller expects a table b-tree. If this is not the case,
        !          4310:     ** return an SQLITE_CORRUPT error.  */
        !          4311:     assert( pCur->apPage[0]->intKey==1 || pCur->apPage[0]->intKey==0 );
        !          4312:     if( (pCur->pKeyInfo==0)!=pCur->apPage[0]->intKey ){
        !          4313:       return SQLITE_CORRUPT_BKPT;
        !          4314:     }
        !          4315:   }
        !          4316: 
        !          4317:   /* Assert that the root page is of the correct type. This must be the
        !          4318:   ** case as the call to this function that loaded the root-page (either
        !          4319:   ** this call or a previous invocation) would have detected corruption 
        !          4320:   ** if the assumption were not true, and it is not possible for the flags 
        !          4321:   ** byte to have been modified while this cursor is holding a reference
        !          4322:   ** to the page.  */
        !          4323:   pRoot = pCur->apPage[0];
        !          4324:   assert( pRoot->pgno==pCur->pgnoRoot );
        !          4325:   assert( pRoot->isInit && (pCur->pKeyInfo==0)==pRoot->intKey );
        !          4326: 
        !          4327:   pCur->aiIdx[0] = 0;
        !          4328:   pCur->info.nSize = 0;
        !          4329:   pCur->atLast = 0;
        !          4330:   pCur->validNKey = 0;
        !          4331: 
        !          4332:   if( pRoot->nCell==0 && !pRoot->leaf ){
        !          4333:     Pgno subpage;
        !          4334:     if( pRoot->pgno!=1 ) return SQLITE_CORRUPT_BKPT;
        !          4335:     subpage = get4byte(&pRoot->aData[pRoot->hdrOffset+8]);
        !          4336:     pCur->eState = CURSOR_VALID;
        !          4337:     rc = moveToChild(pCur, subpage);
        !          4338:   }else{
        !          4339:     pCur->eState = ((pRoot->nCell>0)?CURSOR_VALID:CURSOR_INVALID);
        !          4340:   }
        !          4341:   return rc;
        !          4342: }
        !          4343: 
        !          4344: /*
        !          4345: ** Move the cursor down to the left-most leaf entry beneath the
        !          4346: ** entry to which it is currently pointing.
        !          4347: **
        !          4348: ** The left-most leaf is the one with the smallest key - the first
        !          4349: ** in ascending order.
        !          4350: */
        !          4351: static int moveToLeftmost(BtCursor *pCur){
        !          4352:   Pgno pgno;
        !          4353:   int rc = SQLITE_OK;
        !          4354:   MemPage *pPage;
        !          4355: 
        !          4356:   assert( cursorHoldsMutex(pCur) );
        !          4357:   assert( pCur->eState==CURSOR_VALID );
        !          4358:   while( rc==SQLITE_OK && !(pPage = pCur->apPage[pCur->iPage])->leaf ){
        !          4359:     assert( pCur->aiIdx[pCur->iPage]<pPage->nCell );
        !          4360:     pgno = get4byte(findCell(pPage, pCur->aiIdx[pCur->iPage]));
        !          4361:     rc = moveToChild(pCur, pgno);
        !          4362:   }
        !          4363:   return rc;
        !          4364: }
        !          4365: 
        !          4366: /*
        !          4367: ** Move the cursor down to the right-most leaf entry beneath the
        !          4368: ** page to which it is currently pointing.  Notice the difference
        !          4369: ** between moveToLeftmost() and moveToRightmost().  moveToLeftmost()
        !          4370: ** finds the left-most entry beneath the *entry* whereas moveToRightmost()
        !          4371: ** finds the right-most entry beneath the *page*.
        !          4372: **
        !          4373: ** The right-most entry is the one with the largest key - the last
        !          4374: ** key in ascending order.
        !          4375: */
        !          4376: static int moveToRightmost(BtCursor *pCur){
        !          4377:   Pgno pgno;
        !          4378:   int rc = SQLITE_OK;
        !          4379:   MemPage *pPage = 0;
        !          4380: 
        !          4381:   assert( cursorHoldsMutex(pCur) );
        !          4382:   assert( pCur->eState==CURSOR_VALID );
        !          4383:   while( rc==SQLITE_OK && !(pPage = pCur->apPage[pCur->iPage])->leaf ){
        !          4384:     pgno = get4byte(&pPage->aData[pPage->hdrOffset+8]);
        !          4385:     pCur->aiIdx[pCur->iPage] = pPage->nCell;
        !          4386:     rc = moveToChild(pCur, pgno);
        !          4387:   }
        !          4388:   if( rc==SQLITE_OK ){
        !          4389:     pCur->aiIdx[pCur->iPage] = pPage->nCell-1;
        !          4390:     pCur->info.nSize = 0;
        !          4391:     pCur->validNKey = 0;
        !          4392:   }
        !          4393:   return rc;
        !          4394: }
        !          4395: 
        !          4396: /* Move the cursor to the first entry in the table.  Return SQLITE_OK
        !          4397: ** on success.  Set *pRes to 0 if the cursor actually points to something
        !          4398: ** or set *pRes to 1 if the table is empty.
        !          4399: */
        !          4400: int sqlite3BtreeFirst(BtCursor *pCur, int *pRes){
        !          4401:   int rc;
        !          4402: 
        !          4403:   assert( cursorHoldsMutex(pCur) );
        !          4404:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
        !          4405:   rc = moveToRoot(pCur);
        !          4406:   if( rc==SQLITE_OK ){
        !          4407:     if( pCur->eState==CURSOR_INVALID ){
        !          4408:       assert( pCur->pgnoRoot==0 || pCur->apPage[pCur->iPage]->nCell==0 );
        !          4409:       *pRes = 1;
        !          4410:     }else{
        !          4411:       assert( pCur->apPage[pCur->iPage]->nCell>0 );
        !          4412:       *pRes = 0;
        !          4413:       rc = moveToLeftmost(pCur);
        !          4414:     }
        !          4415:   }
        !          4416:   return rc;
        !          4417: }
        !          4418: 
        !          4419: /* Move the cursor to the last entry in the table.  Return SQLITE_OK
        !          4420: ** on success.  Set *pRes to 0 if the cursor actually points to something
        !          4421: ** or set *pRes to 1 if the table is empty.
        !          4422: */
        !          4423: int sqlite3BtreeLast(BtCursor *pCur, int *pRes){
        !          4424:   int rc;
        !          4425:  
        !          4426:   assert( cursorHoldsMutex(pCur) );
        !          4427:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
        !          4428: 
        !          4429:   /* If the cursor already points to the last entry, this is a no-op. */
        !          4430:   if( CURSOR_VALID==pCur->eState && pCur->atLast ){
        !          4431: #ifdef SQLITE_DEBUG
        !          4432:     /* This block serves to assert() that the cursor really does point 
        !          4433:     ** to the last entry in the b-tree. */
        !          4434:     int ii;
        !          4435:     for(ii=0; ii<pCur->iPage; ii++){
        !          4436:       assert( pCur->aiIdx[ii]==pCur->apPage[ii]->nCell );
        !          4437:     }
        !          4438:     assert( pCur->aiIdx[pCur->iPage]==pCur->apPage[pCur->iPage]->nCell-1 );
        !          4439:     assert( pCur->apPage[pCur->iPage]->leaf );
        !          4440: #endif
        !          4441:     return SQLITE_OK;
        !          4442:   }
        !          4443: 
        !          4444:   rc = moveToRoot(pCur);
        !          4445:   if( rc==SQLITE_OK ){
        !          4446:     if( CURSOR_INVALID==pCur->eState ){
        !          4447:       assert( pCur->pgnoRoot==0 || pCur->apPage[pCur->iPage]->nCell==0 );
        !          4448:       *pRes = 1;
        !          4449:     }else{
        !          4450:       assert( pCur->eState==CURSOR_VALID );
        !          4451:       *pRes = 0;
        !          4452:       rc = moveToRightmost(pCur);
        !          4453:       pCur->atLast = rc==SQLITE_OK ?1:0;
        !          4454:     }
        !          4455:   }
        !          4456:   return rc;
        !          4457: }
        !          4458: 
        !          4459: /* Move the cursor so that it points to an entry near the key 
        !          4460: ** specified by pIdxKey or intKey.   Return a success code.
        !          4461: **
        !          4462: ** For INTKEY tables, the intKey parameter is used.  pIdxKey 
        !          4463: ** must be NULL.  For index tables, pIdxKey is used and intKey
        !          4464: ** is ignored.
        !          4465: **
        !          4466: ** If an exact match is not found, then the cursor is always
        !          4467: ** left pointing at a leaf page which would hold the entry if it
        !          4468: ** were present.  The cursor might point to an entry that comes
        !          4469: ** before or after the key.
        !          4470: **
        !          4471: ** An integer is written into *pRes which is the result of
        !          4472: ** comparing the key with the entry to which the cursor is 
        !          4473: ** pointing.  The meaning of the integer written into
        !          4474: ** *pRes is as follows:
        !          4475: **
        !          4476: **     *pRes<0      The cursor is left pointing at an entry that
        !          4477: **                  is smaller than intKey/pIdxKey or if the table is empty
        !          4478: **                  and the cursor is therefore left point to nothing.
        !          4479: **
        !          4480: **     *pRes==0     The cursor is left pointing at an entry that
        !          4481: **                  exactly matches intKey/pIdxKey.
        !          4482: **
        !          4483: **     *pRes>0      The cursor is left pointing at an entry that
        !          4484: **                  is larger than intKey/pIdxKey.
        !          4485: **
        !          4486: */
        !          4487: int sqlite3BtreeMovetoUnpacked(
        !          4488:   BtCursor *pCur,          /* The cursor to be moved */
        !          4489:   UnpackedRecord *pIdxKey, /* Unpacked index key */
        !          4490:   i64 intKey,              /* The table key */
        !          4491:   int biasRight,           /* If true, bias the search to the high end */
        !          4492:   int *pRes                /* Write search results here */
        !          4493: ){
        !          4494:   int rc;
        !          4495: 
        !          4496:   assert( cursorHoldsMutex(pCur) );
        !          4497:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
        !          4498:   assert( pRes );
        !          4499:   assert( (pIdxKey==0)==(pCur->pKeyInfo==0) );
        !          4500: 
        !          4501:   /* If the cursor is already positioned at the point we are trying
        !          4502:   ** to move to, then just return without doing any work */
        !          4503:   if( pCur->eState==CURSOR_VALID && pCur->validNKey 
        !          4504:    && pCur->apPage[0]->intKey 
        !          4505:   ){
        !          4506:     if( pCur->info.nKey==intKey ){
        !          4507:       *pRes = 0;
        !          4508:       return SQLITE_OK;
        !          4509:     }
        !          4510:     if( pCur->atLast && pCur->info.nKey<intKey ){
        !          4511:       *pRes = -1;
        !          4512:       return SQLITE_OK;
        !          4513:     }
        !          4514:   }
        !          4515: 
        !          4516:   rc = moveToRoot(pCur);
        !          4517:   if( rc ){
        !          4518:     return rc;
        !          4519:   }
        !          4520:   assert( pCur->pgnoRoot==0 || pCur->apPage[pCur->iPage] );
        !          4521:   assert( pCur->pgnoRoot==0 || pCur->apPage[pCur->iPage]->isInit );
        !          4522:   assert( pCur->eState==CURSOR_INVALID || pCur->apPage[pCur->iPage]->nCell>0 );
        !          4523:   if( pCur->eState==CURSOR_INVALID ){
        !          4524:     *pRes = -1;
        !          4525:     assert( pCur->pgnoRoot==0 || pCur->apPage[pCur->iPage]->nCell==0 );
        !          4526:     return SQLITE_OK;
        !          4527:   }
        !          4528:   assert( pCur->apPage[0]->intKey || pIdxKey );
        !          4529:   for(;;){
        !          4530:     int lwr, upr, idx;
        !          4531:     Pgno chldPg;
        !          4532:     MemPage *pPage = pCur->apPage[pCur->iPage];
        !          4533:     int c;
        !          4534: 
        !          4535:     /* pPage->nCell must be greater than zero. If this is the root-page
        !          4536:     ** the cursor would have been INVALID above and this for(;;) loop
        !          4537:     ** not run. If this is not the root-page, then the moveToChild() routine
        !          4538:     ** would have already detected db corruption. Similarly, pPage must
        !          4539:     ** be the right kind (index or table) of b-tree page. Otherwise
        !          4540:     ** a moveToChild() or moveToRoot() call would have detected corruption.  */
        !          4541:     assert( pPage->nCell>0 );
        !          4542:     assert( pPage->intKey==(pIdxKey==0) );
        !          4543:     lwr = 0;
        !          4544:     upr = pPage->nCell-1;
        !          4545:     if( biasRight ){
        !          4546:       pCur->aiIdx[pCur->iPage] = (u16)(idx = upr);
        !          4547:     }else{
        !          4548:       pCur->aiIdx[pCur->iPage] = (u16)(idx = (upr+lwr)/2);
        !          4549:     }
        !          4550:     for(;;){
        !          4551:       u8 *pCell;                          /* Pointer to current cell in pPage */
        !          4552: 
        !          4553:       assert( idx==pCur->aiIdx[pCur->iPage] );
        !          4554:       pCur->info.nSize = 0;
        !          4555:       pCell = findCell(pPage, idx) + pPage->childPtrSize;
        !          4556:       if( pPage->intKey ){
        !          4557:         i64 nCellKey;
        !          4558:         if( pPage->hasData ){
        !          4559:           u32 dummy;
        !          4560:           pCell += getVarint32(pCell, dummy);
        !          4561:         }
        !          4562:         getVarint(pCell, (u64*)&nCellKey);
        !          4563:         if( nCellKey==intKey ){
        !          4564:           c = 0;
        !          4565:         }else if( nCellKey<intKey ){
        !          4566:           c = -1;
        !          4567:         }else{
        !          4568:           assert( nCellKey>intKey );
        !          4569:           c = +1;
        !          4570:         }
        !          4571:         pCur->validNKey = 1;
        !          4572:         pCur->info.nKey = nCellKey;
        !          4573:       }else{
        !          4574:         /* The maximum supported page-size is 65536 bytes. This means that
        !          4575:         ** the maximum number of record bytes stored on an index B-Tree
        !          4576:         ** page is less than 16384 bytes and may be stored as a 2-byte
        !          4577:         ** varint. This information is used to attempt to avoid parsing 
        !          4578:         ** the entire cell by checking for the cases where the record is 
        !          4579:         ** stored entirely within the b-tree page by inspecting the first 
        !          4580:         ** 2 bytes of the cell.
        !          4581:         */
        !          4582:         int nCell = pCell[0];
        !          4583:         if( nCell<=pPage->max1bytePayload
        !          4584:          /* && (pCell+nCell)<pPage->aDataEnd */
        !          4585:         ){
        !          4586:           /* This branch runs if the record-size field of the cell is a
        !          4587:           ** single byte varint and the record fits entirely on the main
        !          4588:           ** b-tree page.  */
        !          4589:           testcase( pCell+nCell+1==pPage->aDataEnd );
        !          4590:           c = sqlite3VdbeRecordCompare(nCell, (void*)&pCell[1], pIdxKey);
        !          4591:         }else if( !(pCell[1] & 0x80) 
        !          4592:           && (nCell = ((nCell&0x7f)<<7) + pCell[1])<=pPage->maxLocal
        !          4593:           /* && (pCell+nCell+2)<=pPage->aDataEnd */
        !          4594:         ){
        !          4595:           /* The record-size field is a 2 byte varint and the record 
        !          4596:           ** fits entirely on the main b-tree page.  */
        !          4597:           testcase( pCell+nCell+2==pPage->aDataEnd );
        !          4598:           c = sqlite3VdbeRecordCompare(nCell, (void*)&pCell[2], pIdxKey);
        !          4599:         }else{
        !          4600:           /* The record flows over onto one or more overflow pages. In
        !          4601:           ** this case the whole cell needs to be parsed, a buffer allocated
        !          4602:           ** and accessPayload() used to retrieve the record into the
        !          4603:           ** buffer before VdbeRecordCompare() can be called. */
        !          4604:           void *pCellKey;
        !          4605:           u8 * const pCellBody = pCell - pPage->childPtrSize;
        !          4606:           btreeParseCellPtr(pPage, pCellBody, &pCur->info);
        !          4607:           nCell = (int)pCur->info.nKey;
        !          4608:           pCellKey = sqlite3Malloc( nCell );
        !          4609:           if( pCellKey==0 ){
        !          4610:             rc = SQLITE_NOMEM;
        !          4611:             goto moveto_finish;
        !          4612:           }
        !          4613:           rc = accessPayload(pCur, 0, nCell, (unsigned char*)pCellKey, 0);
        !          4614:           if( rc ){
        !          4615:             sqlite3_free(pCellKey);
        !          4616:             goto moveto_finish;
        !          4617:           }
        !          4618:           c = sqlite3VdbeRecordCompare(nCell, pCellKey, pIdxKey);
        !          4619:           sqlite3_free(pCellKey);
        !          4620:         }
        !          4621:       }
        !          4622:       if( c==0 ){
        !          4623:         if( pPage->intKey && !pPage->leaf ){
        !          4624:           lwr = idx;
        !          4625:           break;
        !          4626:         }else{
        !          4627:           *pRes = 0;
        !          4628:           rc = SQLITE_OK;
        !          4629:           goto moveto_finish;
        !          4630:         }
        !          4631:       }
        !          4632:       if( c<0 ){
        !          4633:         lwr = idx+1;
        !          4634:       }else{
        !          4635:         upr = idx-1;
        !          4636:       }
        !          4637:       if( lwr>upr ){
        !          4638:         break;
        !          4639:       }
        !          4640:       pCur->aiIdx[pCur->iPage] = (u16)(idx = (lwr+upr)/2);
        !          4641:     }
        !          4642:     assert( lwr==upr+1 || (pPage->intKey && !pPage->leaf) );
        !          4643:     assert( pPage->isInit );
        !          4644:     if( pPage->leaf ){
        !          4645:       chldPg = 0;
        !          4646:     }else if( lwr>=pPage->nCell ){
        !          4647:       chldPg = get4byte(&pPage->aData[pPage->hdrOffset+8]);
        !          4648:     }else{
        !          4649:       chldPg = get4byte(findCell(pPage, lwr));
        !          4650:     }
        !          4651:     if( chldPg==0 ){
        !          4652:       assert( pCur->aiIdx[pCur->iPage]<pCur->apPage[pCur->iPage]->nCell );
        !          4653:       *pRes = c;
        !          4654:       rc = SQLITE_OK;
        !          4655:       goto moveto_finish;
        !          4656:     }
        !          4657:     pCur->aiIdx[pCur->iPage] = (u16)lwr;
        !          4658:     pCur->info.nSize = 0;
        !          4659:     pCur->validNKey = 0;
        !          4660:     rc = moveToChild(pCur, chldPg);
        !          4661:     if( rc ) goto moveto_finish;
        !          4662:   }
        !          4663: moveto_finish:
        !          4664:   return rc;
        !          4665: }
        !          4666: 
        !          4667: 
        !          4668: /*
        !          4669: ** Return TRUE if the cursor is not pointing at an entry of the table.
        !          4670: **
        !          4671: ** TRUE will be returned after a call to sqlite3BtreeNext() moves
        !          4672: ** past the last entry in the table or sqlite3BtreePrev() moves past
        !          4673: ** the first entry.  TRUE is also returned if the table is empty.
        !          4674: */
        !          4675: int sqlite3BtreeEof(BtCursor *pCur){
        !          4676:   /* TODO: What if the cursor is in CURSOR_REQUIRESEEK but all table entries
        !          4677:   ** have been deleted? This API will need to change to return an error code
        !          4678:   ** as well as the boolean result value.
        !          4679:   */
        !          4680:   return (CURSOR_VALID!=pCur->eState);
        !          4681: }
        !          4682: 
        !          4683: /*
        !          4684: ** Advance the cursor to the next entry in the database.  If
        !          4685: ** successful then set *pRes=0.  If the cursor
        !          4686: ** was already pointing to the last entry in the database before
        !          4687: ** this routine was called, then set *pRes=1.
        !          4688: */
        !          4689: int sqlite3BtreeNext(BtCursor *pCur, int *pRes){
        !          4690:   int rc;
        !          4691:   int idx;
        !          4692:   MemPage *pPage;
        !          4693: 
        !          4694:   assert( cursorHoldsMutex(pCur) );
        !          4695:   rc = restoreCursorPosition(pCur);
        !          4696:   if( rc!=SQLITE_OK ){
        !          4697:     return rc;
        !          4698:   }
        !          4699:   assert( pRes!=0 );
        !          4700:   if( CURSOR_INVALID==pCur->eState ){
        !          4701:     *pRes = 1;
        !          4702:     return SQLITE_OK;
        !          4703:   }
        !          4704:   if( pCur->skipNext>0 ){
        !          4705:     pCur->skipNext = 0;
        !          4706:     *pRes = 0;
        !          4707:     return SQLITE_OK;
        !          4708:   }
        !          4709:   pCur->skipNext = 0;
        !          4710: 
        !          4711:   pPage = pCur->apPage[pCur->iPage];
        !          4712:   idx = ++pCur->aiIdx[pCur->iPage];
        !          4713:   assert( pPage->isInit );
        !          4714: 
        !          4715:   /* If the database file is corrupt, it is possible for the value of idx 
        !          4716:   ** to be invalid here. This can only occur if a second cursor modifies
        !          4717:   ** the page while cursor pCur is holding a reference to it. Which can
        !          4718:   ** only happen if the database is corrupt in such a way as to link the
        !          4719:   ** page into more than one b-tree structure. */
        !          4720:   testcase( idx>pPage->nCell );
        !          4721: 
        !          4722:   pCur->info.nSize = 0;
        !          4723:   pCur->validNKey = 0;
        !          4724:   if( idx>=pPage->nCell ){
        !          4725:     if( !pPage->leaf ){
        !          4726:       rc = moveToChild(pCur, get4byte(&pPage->aData[pPage->hdrOffset+8]));
        !          4727:       if( rc ) return rc;
        !          4728:       rc = moveToLeftmost(pCur);
        !          4729:       *pRes = 0;
        !          4730:       return rc;
        !          4731:     }
        !          4732:     do{
        !          4733:       if( pCur->iPage==0 ){
        !          4734:         *pRes = 1;
        !          4735:         pCur->eState = CURSOR_INVALID;
        !          4736:         return SQLITE_OK;
        !          4737:       }
        !          4738:       moveToParent(pCur);
        !          4739:       pPage = pCur->apPage[pCur->iPage];
        !          4740:     }while( pCur->aiIdx[pCur->iPage]>=pPage->nCell );
        !          4741:     *pRes = 0;
        !          4742:     if( pPage->intKey ){
        !          4743:       rc = sqlite3BtreeNext(pCur, pRes);
        !          4744:     }else{
        !          4745:       rc = SQLITE_OK;
        !          4746:     }
        !          4747:     return rc;
        !          4748:   }
        !          4749:   *pRes = 0;
        !          4750:   if( pPage->leaf ){
        !          4751:     return SQLITE_OK;
        !          4752:   }
        !          4753:   rc = moveToLeftmost(pCur);
        !          4754:   return rc;
        !          4755: }
        !          4756: 
        !          4757: 
        !          4758: /*
        !          4759: ** Step the cursor to the back to the previous entry in the database.  If
        !          4760: ** successful then set *pRes=0.  If the cursor
        !          4761: ** was already pointing to the first entry in the database before
        !          4762: ** this routine was called, then set *pRes=1.
        !          4763: */
        !          4764: int sqlite3BtreePrevious(BtCursor *pCur, int *pRes){
        !          4765:   int rc;
        !          4766:   MemPage *pPage;
        !          4767: 
        !          4768:   assert( cursorHoldsMutex(pCur) );
        !          4769:   rc = restoreCursorPosition(pCur);
        !          4770:   if( rc!=SQLITE_OK ){
        !          4771:     return rc;
        !          4772:   }
        !          4773:   pCur->atLast = 0;
        !          4774:   if( CURSOR_INVALID==pCur->eState ){
        !          4775:     *pRes = 1;
        !          4776:     return SQLITE_OK;
        !          4777:   }
        !          4778:   if( pCur->skipNext<0 ){
        !          4779:     pCur->skipNext = 0;
        !          4780:     *pRes = 0;
        !          4781:     return SQLITE_OK;
        !          4782:   }
        !          4783:   pCur->skipNext = 0;
        !          4784: 
        !          4785:   pPage = pCur->apPage[pCur->iPage];
        !          4786:   assert( pPage->isInit );
        !          4787:   if( !pPage->leaf ){
        !          4788:     int idx = pCur->aiIdx[pCur->iPage];
        !          4789:     rc = moveToChild(pCur, get4byte(findCell(pPage, idx)));
        !          4790:     if( rc ){
        !          4791:       return rc;
        !          4792:     }
        !          4793:     rc = moveToRightmost(pCur);
        !          4794:   }else{
        !          4795:     while( pCur->aiIdx[pCur->iPage]==0 ){
        !          4796:       if( pCur->iPage==0 ){
        !          4797:         pCur->eState = CURSOR_INVALID;
        !          4798:         *pRes = 1;
        !          4799:         return SQLITE_OK;
        !          4800:       }
        !          4801:       moveToParent(pCur);
        !          4802:     }
        !          4803:     pCur->info.nSize = 0;
        !          4804:     pCur->validNKey = 0;
        !          4805: 
        !          4806:     pCur->aiIdx[pCur->iPage]--;
        !          4807:     pPage = pCur->apPage[pCur->iPage];
        !          4808:     if( pPage->intKey && !pPage->leaf ){
        !          4809:       rc = sqlite3BtreePrevious(pCur, pRes);
        !          4810:     }else{
        !          4811:       rc = SQLITE_OK;
        !          4812:     }
        !          4813:   }
        !          4814:   *pRes = 0;
        !          4815:   return rc;
        !          4816: }
        !          4817: 
        !          4818: /*
        !          4819: ** Allocate a new page from the database file.
        !          4820: **
        !          4821: ** The new page is marked as dirty.  (In other words, sqlite3PagerWrite()
        !          4822: ** has already been called on the new page.)  The new page has also
        !          4823: ** been referenced and the calling routine is responsible for calling
        !          4824: ** sqlite3PagerUnref() on the new page when it is done.
        !          4825: **
        !          4826: ** SQLITE_OK is returned on success.  Any other return value indicates
        !          4827: ** an error.  *ppPage and *pPgno are undefined in the event of an error.
        !          4828: ** Do not invoke sqlite3PagerUnref() on *ppPage if an error is returned.
        !          4829: **
        !          4830: ** If the "nearby" parameter is not 0, then a (feeble) effort is made to 
        !          4831: ** locate a page close to the page number "nearby".  This can be used in an
        !          4832: ** attempt to keep related pages close to each other in the database file,
        !          4833: ** which in turn can make database access faster.
        !          4834: **
        !          4835: ** If the "exact" parameter is not 0, and the page-number nearby exists 
        !          4836: ** anywhere on the free-list, then it is guarenteed to be returned. This
        !          4837: ** is only used by auto-vacuum databases when allocating a new table.
        !          4838: */
        !          4839: static int allocateBtreePage(
        !          4840:   BtShared *pBt, 
        !          4841:   MemPage **ppPage, 
        !          4842:   Pgno *pPgno, 
        !          4843:   Pgno nearby,
        !          4844:   u8 exact
        !          4845: ){
        !          4846:   MemPage *pPage1;
        !          4847:   int rc;
        !          4848:   u32 n;     /* Number of pages on the freelist */
        !          4849:   u32 k;     /* Number of leaves on the trunk of the freelist */
        !          4850:   MemPage *pTrunk = 0;
        !          4851:   MemPage *pPrevTrunk = 0;
        !          4852:   Pgno mxPage;     /* Total size of the database file */
        !          4853: 
        !          4854:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          4855:   pPage1 = pBt->pPage1;
        !          4856:   mxPage = btreePagecount(pBt);
        !          4857:   n = get4byte(&pPage1->aData[36]);
        !          4858:   testcase( n==mxPage-1 );
        !          4859:   if( n>=mxPage ){
        !          4860:     return SQLITE_CORRUPT_BKPT;
        !          4861:   }
        !          4862:   if( n>0 ){
        !          4863:     /* There are pages on the freelist.  Reuse one of those pages. */
        !          4864:     Pgno iTrunk;
        !          4865:     u8 searchList = 0; /* If the free-list must be searched for 'nearby' */
        !          4866:     
        !          4867:     /* If the 'exact' parameter was true and a query of the pointer-map
        !          4868:     ** shows that the page 'nearby' is somewhere on the free-list, then
        !          4869:     ** the entire-list will be searched for that page.
        !          4870:     */
        !          4871: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          4872:     if( exact && nearby<=mxPage ){
        !          4873:       u8 eType;
        !          4874:       assert( nearby>0 );
        !          4875:       assert( pBt->autoVacuum );
        !          4876:       rc = ptrmapGet(pBt, nearby, &eType, 0);
        !          4877:       if( rc ) return rc;
        !          4878:       if( eType==PTRMAP_FREEPAGE ){
        !          4879:         searchList = 1;
        !          4880:       }
        !          4881:       *pPgno = nearby;
        !          4882:     }
        !          4883: #endif
        !          4884: 
        !          4885:     /* Decrement the free-list count by 1. Set iTrunk to the index of the
        !          4886:     ** first free-list trunk page. iPrevTrunk is initially 1.
        !          4887:     */
        !          4888:     rc = sqlite3PagerWrite(pPage1->pDbPage);
        !          4889:     if( rc ) return rc;
        !          4890:     put4byte(&pPage1->aData[36], n-1);
        !          4891: 
        !          4892:     /* The code within this loop is run only once if the 'searchList' variable
        !          4893:     ** is not true. Otherwise, it runs once for each trunk-page on the
        !          4894:     ** free-list until the page 'nearby' is located.
        !          4895:     */
        !          4896:     do {
        !          4897:       pPrevTrunk = pTrunk;
        !          4898:       if( pPrevTrunk ){
        !          4899:         iTrunk = get4byte(&pPrevTrunk->aData[0]);
        !          4900:       }else{
        !          4901:         iTrunk = get4byte(&pPage1->aData[32]);
        !          4902:       }
        !          4903:       testcase( iTrunk==mxPage );
        !          4904:       if( iTrunk>mxPage ){
        !          4905:         rc = SQLITE_CORRUPT_BKPT;
        !          4906:       }else{
        !          4907:         rc = btreeGetPage(pBt, iTrunk, &pTrunk, 0);
        !          4908:       }
        !          4909:       if( rc ){
        !          4910:         pTrunk = 0;
        !          4911:         goto end_allocate_page;
        !          4912:       }
        !          4913:       assert( pTrunk!=0 );
        !          4914:       assert( pTrunk->aData!=0 );
        !          4915: 
        !          4916:       k = get4byte(&pTrunk->aData[4]); /* # of leaves on this trunk page */
        !          4917:       if( k==0 && !searchList ){
        !          4918:         /* The trunk has no leaves and the list is not being searched. 
        !          4919:         ** So extract the trunk page itself and use it as the newly 
        !          4920:         ** allocated page */
        !          4921:         assert( pPrevTrunk==0 );
        !          4922:         rc = sqlite3PagerWrite(pTrunk->pDbPage);
        !          4923:         if( rc ){
        !          4924:           goto end_allocate_page;
        !          4925:         }
        !          4926:         *pPgno = iTrunk;
        !          4927:         memcpy(&pPage1->aData[32], &pTrunk->aData[0], 4);
        !          4928:         *ppPage = pTrunk;
        !          4929:         pTrunk = 0;
        !          4930:         TRACE(("ALLOCATE: %d trunk - %d free pages left\n", *pPgno, n-1));
        !          4931:       }else if( k>(u32)(pBt->usableSize/4 - 2) ){
        !          4932:         /* Value of k is out of range.  Database corruption */
        !          4933:         rc = SQLITE_CORRUPT_BKPT;
        !          4934:         goto end_allocate_page;
        !          4935: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          4936:       }else if( searchList && nearby==iTrunk ){
        !          4937:         /* The list is being searched and this trunk page is the page
        !          4938:         ** to allocate, regardless of whether it has leaves.
        !          4939:         */
        !          4940:         assert( *pPgno==iTrunk );
        !          4941:         *ppPage = pTrunk;
        !          4942:         searchList = 0;
        !          4943:         rc = sqlite3PagerWrite(pTrunk->pDbPage);
        !          4944:         if( rc ){
        !          4945:           goto end_allocate_page;
        !          4946:         }
        !          4947:         if( k==0 ){
        !          4948:           if( !pPrevTrunk ){
        !          4949:             memcpy(&pPage1->aData[32], &pTrunk->aData[0], 4);
        !          4950:           }else{
        !          4951:             rc = sqlite3PagerWrite(pPrevTrunk->pDbPage);
        !          4952:             if( rc!=SQLITE_OK ){
        !          4953:               goto end_allocate_page;
        !          4954:             }
        !          4955:             memcpy(&pPrevTrunk->aData[0], &pTrunk->aData[0], 4);
        !          4956:           }
        !          4957:         }else{
        !          4958:           /* The trunk page is required by the caller but it contains 
        !          4959:           ** pointers to free-list leaves. The first leaf becomes a trunk
        !          4960:           ** page in this case.
        !          4961:           */
        !          4962:           MemPage *pNewTrunk;
        !          4963:           Pgno iNewTrunk = get4byte(&pTrunk->aData[8]);
        !          4964:           if( iNewTrunk>mxPage ){ 
        !          4965:             rc = SQLITE_CORRUPT_BKPT;
        !          4966:             goto end_allocate_page;
        !          4967:           }
        !          4968:           testcase( iNewTrunk==mxPage );
        !          4969:           rc = btreeGetPage(pBt, iNewTrunk, &pNewTrunk, 0);
        !          4970:           if( rc!=SQLITE_OK ){
        !          4971:             goto end_allocate_page;
        !          4972:           }
        !          4973:           rc = sqlite3PagerWrite(pNewTrunk->pDbPage);
        !          4974:           if( rc!=SQLITE_OK ){
        !          4975:             releasePage(pNewTrunk);
        !          4976:             goto end_allocate_page;
        !          4977:           }
        !          4978:           memcpy(&pNewTrunk->aData[0], &pTrunk->aData[0], 4);
        !          4979:           put4byte(&pNewTrunk->aData[4], k-1);
        !          4980:           memcpy(&pNewTrunk->aData[8], &pTrunk->aData[12], (k-1)*4);
        !          4981:           releasePage(pNewTrunk);
        !          4982:           if( !pPrevTrunk ){
        !          4983:             assert( sqlite3PagerIswriteable(pPage1->pDbPage) );
        !          4984:             put4byte(&pPage1->aData[32], iNewTrunk);
        !          4985:           }else{
        !          4986:             rc = sqlite3PagerWrite(pPrevTrunk->pDbPage);
        !          4987:             if( rc ){
        !          4988:               goto end_allocate_page;
        !          4989:             }
        !          4990:             put4byte(&pPrevTrunk->aData[0], iNewTrunk);
        !          4991:           }
        !          4992:         }
        !          4993:         pTrunk = 0;
        !          4994:         TRACE(("ALLOCATE: %d trunk - %d free pages left\n", *pPgno, n-1));
        !          4995: #endif
        !          4996:       }else if( k>0 ){
        !          4997:         /* Extract a leaf from the trunk */
        !          4998:         u32 closest;
        !          4999:         Pgno iPage;
        !          5000:         unsigned char *aData = pTrunk->aData;
        !          5001:         if( nearby>0 ){
        !          5002:           u32 i;
        !          5003:           int dist;
        !          5004:           closest = 0;
        !          5005:           dist = sqlite3AbsInt32(get4byte(&aData[8]) - nearby);
        !          5006:           for(i=1; i<k; i++){
        !          5007:             int d2 = sqlite3AbsInt32(get4byte(&aData[8+i*4]) - nearby);
        !          5008:             if( d2<dist ){
        !          5009:               closest = i;
        !          5010:               dist = d2;
        !          5011:             }
        !          5012:           }
        !          5013:         }else{
        !          5014:           closest = 0;
        !          5015:         }
        !          5016: 
        !          5017:         iPage = get4byte(&aData[8+closest*4]);
        !          5018:         testcase( iPage==mxPage );
        !          5019:         if( iPage>mxPage ){
        !          5020:           rc = SQLITE_CORRUPT_BKPT;
        !          5021:           goto end_allocate_page;
        !          5022:         }
        !          5023:         testcase( iPage==mxPage );
        !          5024:         if( !searchList || iPage==nearby ){
        !          5025:           int noContent;
        !          5026:           *pPgno = iPage;
        !          5027:           TRACE(("ALLOCATE: %d was leaf %d of %d on trunk %d"
        !          5028:                  ": %d more free pages\n",
        !          5029:                  *pPgno, closest+1, k, pTrunk->pgno, n-1));
        !          5030:           rc = sqlite3PagerWrite(pTrunk->pDbPage);
        !          5031:           if( rc ) goto end_allocate_page;
        !          5032:           if( closest<k-1 ){
        !          5033:             memcpy(&aData[8+closest*4], &aData[4+k*4], 4);
        !          5034:           }
        !          5035:           put4byte(&aData[4], k-1);
        !          5036:           noContent = !btreeGetHasContent(pBt, *pPgno);
        !          5037:           rc = btreeGetPage(pBt, *pPgno, ppPage, noContent);
        !          5038:           if( rc==SQLITE_OK ){
        !          5039:             rc = sqlite3PagerWrite((*ppPage)->pDbPage);
        !          5040:             if( rc!=SQLITE_OK ){
        !          5041:               releasePage(*ppPage);
        !          5042:             }
        !          5043:           }
        !          5044:           searchList = 0;
        !          5045:         }
        !          5046:       }
        !          5047:       releasePage(pPrevTrunk);
        !          5048:       pPrevTrunk = 0;
        !          5049:     }while( searchList );
        !          5050:   }else{
        !          5051:     /* There are no pages on the freelist, so create a new page at the
        !          5052:     ** end of the file */
        !          5053:     rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
        !          5054:     if( rc ) return rc;
        !          5055:     pBt->nPage++;
        !          5056:     if( pBt->nPage==PENDING_BYTE_PAGE(pBt) ) pBt->nPage++;
        !          5057: 
        !          5058: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          5059:     if( pBt->autoVacuum && PTRMAP_ISPAGE(pBt, pBt->nPage) ){
        !          5060:       /* If *pPgno refers to a pointer-map page, allocate two new pages
        !          5061:       ** at the end of the file instead of one. The first allocated page
        !          5062:       ** becomes a new pointer-map page, the second is used by the caller.
        !          5063:       */
        !          5064:       MemPage *pPg = 0;
        !          5065:       TRACE(("ALLOCATE: %d from end of file (pointer-map page)\n", pBt->nPage));
        !          5066:       assert( pBt->nPage!=PENDING_BYTE_PAGE(pBt) );
        !          5067:       rc = btreeGetPage(pBt, pBt->nPage, &pPg, 1);
        !          5068:       if( rc==SQLITE_OK ){
        !          5069:         rc = sqlite3PagerWrite(pPg->pDbPage);
        !          5070:         releasePage(pPg);
        !          5071:       }
        !          5072:       if( rc ) return rc;
        !          5073:       pBt->nPage++;
        !          5074:       if( pBt->nPage==PENDING_BYTE_PAGE(pBt) ){ pBt->nPage++; }
        !          5075:     }
        !          5076: #endif
        !          5077:     put4byte(28 + (u8*)pBt->pPage1->aData, pBt->nPage);
        !          5078:     *pPgno = pBt->nPage;
        !          5079: 
        !          5080:     assert( *pPgno!=PENDING_BYTE_PAGE(pBt) );
        !          5081:     rc = btreeGetPage(pBt, *pPgno, ppPage, 1);
        !          5082:     if( rc ) return rc;
        !          5083:     rc = sqlite3PagerWrite((*ppPage)->pDbPage);
        !          5084:     if( rc!=SQLITE_OK ){
        !          5085:       releasePage(*ppPage);
        !          5086:     }
        !          5087:     TRACE(("ALLOCATE: %d from end of file\n", *pPgno));
        !          5088:   }
        !          5089: 
        !          5090:   assert( *pPgno!=PENDING_BYTE_PAGE(pBt) );
        !          5091: 
        !          5092: end_allocate_page:
        !          5093:   releasePage(pTrunk);
        !          5094:   releasePage(pPrevTrunk);
        !          5095:   if( rc==SQLITE_OK ){
        !          5096:     if( sqlite3PagerPageRefcount((*ppPage)->pDbPage)>1 ){
        !          5097:       releasePage(*ppPage);
        !          5098:       return SQLITE_CORRUPT_BKPT;
        !          5099:     }
        !          5100:     (*ppPage)->isInit = 0;
        !          5101:   }else{
        !          5102:     *ppPage = 0;
        !          5103:   }
        !          5104:   assert( rc!=SQLITE_OK || sqlite3PagerIswriteable((*ppPage)->pDbPage) );
        !          5105:   return rc;
        !          5106: }
        !          5107: 
        !          5108: /*
        !          5109: ** This function is used to add page iPage to the database file free-list. 
        !          5110: ** It is assumed that the page is not already a part of the free-list.
        !          5111: **
        !          5112: ** The value passed as the second argument to this function is optional.
        !          5113: ** If the caller happens to have a pointer to the MemPage object 
        !          5114: ** corresponding to page iPage handy, it may pass it as the second value. 
        !          5115: ** Otherwise, it may pass NULL.
        !          5116: **
        !          5117: ** If a pointer to a MemPage object is passed as the second argument,
        !          5118: ** its reference count is not altered by this function.
        !          5119: */
        !          5120: static int freePage2(BtShared *pBt, MemPage *pMemPage, Pgno iPage){
        !          5121:   MemPage *pTrunk = 0;                /* Free-list trunk page */
        !          5122:   Pgno iTrunk = 0;                    /* Page number of free-list trunk page */ 
        !          5123:   MemPage *pPage1 = pBt->pPage1;      /* Local reference to page 1 */
        !          5124:   MemPage *pPage;                     /* Page being freed. May be NULL. */
        !          5125:   int rc;                             /* Return Code */
        !          5126:   int nFree;                          /* Initial number of pages on free-list */
        !          5127: 
        !          5128:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          5129:   assert( iPage>1 );
        !          5130:   assert( !pMemPage || pMemPage->pgno==iPage );
        !          5131: 
        !          5132:   if( pMemPage ){
        !          5133:     pPage = pMemPage;
        !          5134:     sqlite3PagerRef(pPage->pDbPage);
        !          5135:   }else{
        !          5136:     pPage = btreePageLookup(pBt, iPage);
        !          5137:   }
        !          5138: 
        !          5139:   /* Increment the free page count on pPage1 */
        !          5140:   rc = sqlite3PagerWrite(pPage1->pDbPage);
        !          5141:   if( rc ) goto freepage_out;
        !          5142:   nFree = get4byte(&pPage1->aData[36]);
        !          5143:   put4byte(&pPage1->aData[36], nFree+1);
        !          5144: 
        !          5145:   if( pBt->btsFlags & BTS_SECURE_DELETE ){
        !          5146:     /* If the secure_delete option is enabled, then
        !          5147:     ** always fully overwrite deleted information with zeros.
        !          5148:     */
        !          5149:     if( (!pPage && ((rc = btreeGetPage(pBt, iPage, &pPage, 0))!=0) )
        !          5150:      ||            ((rc = sqlite3PagerWrite(pPage->pDbPage))!=0)
        !          5151:     ){
        !          5152:       goto freepage_out;
        !          5153:     }
        !          5154:     memset(pPage->aData, 0, pPage->pBt->pageSize);
        !          5155:   }
        !          5156: 
        !          5157:   /* If the database supports auto-vacuum, write an entry in the pointer-map
        !          5158:   ** to indicate that the page is free.
        !          5159:   */
        !          5160:   if( ISAUTOVACUUM ){
        !          5161:     ptrmapPut(pBt, iPage, PTRMAP_FREEPAGE, 0, &rc);
        !          5162:     if( rc ) goto freepage_out;
        !          5163:   }
        !          5164: 
        !          5165:   /* Now manipulate the actual database free-list structure. There are two
        !          5166:   ** possibilities. If the free-list is currently empty, or if the first
        !          5167:   ** trunk page in the free-list is full, then this page will become a
        !          5168:   ** new free-list trunk page. Otherwise, it will become a leaf of the
        !          5169:   ** first trunk page in the current free-list. This block tests if it
        !          5170:   ** is possible to add the page as a new free-list leaf.
        !          5171:   */
        !          5172:   if( nFree!=0 ){
        !          5173:     u32 nLeaf;                /* Initial number of leaf cells on trunk page */
        !          5174: 
        !          5175:     iTrunk = get4byte(&pPage1->aData[32]);
        !          5176:     rc = btreeGetPage(pBt, iTrunk, &pTrunk, 0);
        !          5177:     if( rc!=SQLITE_OK ){
        !          5178:       goto freepage_out;
        !          5179:     }
        !          5180: 
        !          5181:     nLeaf = get4byte(&pTrunk->aData[4]);
        !          5182:     assert( pBt->usableSize>32 );
        !          5183:     if( nLeaf > (u32)pBt->usableSize/4 - 2 ){
        !          5184:       rc = SQLITE_CORRUPT_BKPT;
        !          5185:       goto freepage_out;
        !          5186:     }
        !          5187:     if( nLeaf < (u32)pBt->usableSize/4 - 8 ){
        !          5188:       /* In this case there is room on the trunk page to insert the page
        !          5189:       ** being freed as a new leaf.
        !          5190:       **
        !          5191:       ** Note that the trunk page is not really full until it contains
        !          5192:       ** usableSize/4 - 2 entries, not usableSize/4 - 8 entries as we have
        !          5193:       ** coded.  But due to a coding error in versions of SQLite prior to
        !          5194:       ** 3.6.0, databases with freelist trunk pages holding more than
        !          5195:       ** usableSize/4 - 8 entries will be reported as corrupt.  In order
        !          5196:       ** to maintain backwards compatibility with older versions of SQLite,
        !          5197:       ** we will continue to restrict the number of entries to usableSize/4 - 8
        !          5198:       ** for now.  At some point in the future (once everyone has upgraded
        !          5199:       ** to 3.6.0 or later) we should consider fixing the conditional above
        !          5200:       ** to read "usableSize/4-2" instead of "usableSize/4-8".
        !          5201:       */
        !          5202:       rc = sqlite3PagerWrite(pTrunk->pDbPage);
        !          5203:       if( rc==SQLITE_OK ){
        !          5204:         put4byte(&pTrunk->aData[4], nLeaf+1);
        !          5205:         put4byte(&pTrunk->aData[8+nLeaf*4], iPage);
        !          5206:         if( pPage && (pBt->btsFlags & BTS_SECURE_DELETE)==0 ){
        !          5207:           sqlite3PagerDontWrite(pPage->pDbPage);
        !          5208:         }
        !          5209:         rc = btreeSetHasContent(pBt, iPage);
        !          5210:       }
        !          5211:       TRACE(("FREE-PAGE: %d leaf on trunk page %d\n",pPage->pgno,pTrunk->pgno));
        !          5212:       goto freepage_out;
        !          5213:     }
        !          5214:   }
        !          5215: 
        !          5216:   /* If control flows to this point, then it was not possible to add the
        !          5217:   ** the page being freed as a leaf page of the first trunk in the free-list.
        !          5218:   ** Possibly because the free-list is empty, or possibly because the 
        !          5219:   ** first trunk in the free-list is full. Either way, the page being freed
        !          5220:   ** will become the new first trunk page in the free-list.
        !          5221:   */
        !          5222:   if( pPage==0 && SQLITE_OK!=(rc = btreeGetPage(pBt, iPage, &pPage, 0)) ){
        !          5223:     goto freepage_out;
        !          5224:   }
        !          5225:   rc = sqlite3PagerWrite(pPage->pDbPage);
        !          5226:   if( rc!=SQLITE_OK ){
        !          5227:     goto freepage_out;
        !          5228:   }
        !          5229:   put4byte(pPage->aData, iTrunk);
        !          5230:   put4byte(&pPage->aData[4], 0);
        !          5231:   put4byte(&pPage1->aData[32], iPage);
        !          5232:   TRACE(("FREE-PAGE: %d new trunk page replacing %d\n", pPage->pgno, iTrunk));
        !          5233: 
        !          5234: freepage_out:
        !          5235:   if( pPage ){
        !          5236:     pPage->isInit = 0;
        !          5237:   }
        !          5238:   releasePage(pPage);
        !          5239:   releasePage(pTrunk);
        !          5240:   return rc;
        !          5241: }
        !          5242: static void freePage(MemPage *pPage, int *pRC){
        !          5243:   if( (*pRC)==SQLITE_OK ){
        !          5244:     *pRC = freePage2(pPage->pBt, pPage, pPage->pgno);
        !          5245:   }
        !          5246: }
        !          5247: 
        !          5248: /*
        !          5249: ** Free any overflow pages associated with the given Cell.
        !          5250: */
        !          5251: static int clearCell(MemPage *pPage, unsigned char *pCell){
        !          5252:   BtShared *pBt = pPage->pBt;
        !          5253:   CellInfo info;
        !          5254:   Pgno ovflPgno;
        !          5255:   int rc;
        !          5256:   int nOvfl;
        !          5257:   u32 ovflPageSize;
        !          5258: 
        !          5259:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !          5260:   btreeParseCellPtr(pPage, pCell, &info);
        !          5261:   if( info.iOverflow==0 ){
        !          5262:     return SQLITE_OK;  /* No overflow pages. Return without doing anything */
        !          5263:   }
        !          5264:   if( pCell+info.iOverflow+3 > pPage->aData+pPage->maskPage ){
        !          5265:     return SQLITE_CORRUPT;  /* Cell extends past end of page */
        !          5266:   }
        !          5267:   ovflPgno = get4byte(&pCell[info.iOverflow]);
        !          5268:   assert( pBt->usableSize > 4 );
        !          5269:   ovflPageSize = pBt->usableSize - 4;
        !          5270:   nOvfl = (info.nPayload - info.nLocal + ovflPageSize - 1)/ovflPageSize;
        !          5271:   assert( ovflPgno==0 || nOvfl>0 );
        !          5272:   while( nOvfl-- ){
        !          5273:     Pgno iNext = 0;
        !          5274:     MemPage *pOvfl = 0;
        !          5275:     if( ovflPgno<2 || ovflPgno>btreePagecount(pBt) ){
        !          5276:       /* 0 is not a legal page number and page 1 cannot be an 
        !          5277:       ** overflow page. Therefore if ovflPgno<2 or past the end of the 
        !          5278:       ** file the database must be corrupt. */
        !          5279:       return SQLITE_CORRUPT_BKPT;
        !          5280:     }
        !          5281:     if( nOvfl ){
        !          5282:       rc = getOverflowPage(pBt, ovflPgno, &pOvfl, &iNext);
        !          5283:       if( rc ) return rc;
        !          5284:     }
        !          5285: 
        !          5286:     if( ( pOvfl || ((pOvfl = btreePageLookup(pBt, ovflPgno))!=0) )
        !          5287:      && sqlite3PagerPageRefcount(pOvfl->pDbPage)!=1
        !          5288:     ){
        !          5289:       /* There is no reason any cursor should have an outstanding reference 
        !          5290:       ** to an overflow page belonging to a cell that is being deleted/updated.
        !          5291:       ** So if there exists more than one reference to this page, then it 
        !          5292:       ** must not really be an overflow page and the database must be corrupt. 
        !          5293:       ** It is helpful to detect this before calling freePage2(), as 
        !          5294:       ** freePage2() may zero the page contents if secure-delete mode is
        !          5295:       ** enabled. If this 'overflow' page happens to be a page that the
        !          5296:       ** caller is iterating through or using in some other way, this
        !          5297:       ** can be problematic.
        !          5298:       */
        !          5299:       rc = SQLITE_CORRUPT_BKPT;
        !          5300:     }else{
        !          5301:       rc = freePage2(pBt, pOvfl, ovflPgno);
        !          5302:     }
        !          5303: 
        !          5304:     if( pOvfl ){
        !          5305:       sqlite3PagerUnref(pOvfl->pDbPage);
        !          5306:     }
        !          5307:     if( rc ) return rc;
        !          5308:     ovflPgno = iNext;
        !          5309:   }
        !          5310:   return SQLITE_OK;
        !          5311: }
        !          5312: 
        !          5313: /*
        !          5314: ** Create the byte sequence used to represent a cell on page pPage
        !          5315: ** and write that byte sequence into pCell[].  Overflow pages are
        !          5316: ** allocated and filled in as necessary.  The calling procedure
        !          5317: ** is responsible for making sure sufficient space has been allocated
        !          5318: ** for pCell[].
        !          5319: **
        !          5320: ** Note that pCell does not necessary need to point to the pPage->aData
        !          5321: ** area.  pCell might point to some temporary storage.  The cell will
        !          5322: ** be constructed in this temporary area then copied into pPage->aData
        !          5323: ** later.
        !          5324: */
        !          5325: static int fillInCell(
        !          5326:   MemPage *pPage,                /* The page that contains the cell */
        !          5327:   unsigned char *pCell,          /* Complete text of the cell */
        !          5328:   const void *pKey, i64 nKey,    /* The key */
        !          5329:   const void *pData,int nData,   /* The data */
        !          5330:   int nZero,                     /* Extra zero bytes to append to pData */
        !          5331:   int *pnSize                    /* Write cell size here */
        !          5332: ){
        !          5333:   int nPayload;
        !          5334:   const u8 *pSrc;
        !          5335:   int nSrc, n, rc;
        !          5336:   int spaceLeft;
        !          5337:   MemPage *pOvfl = 0;
        !          5338:   MemPage *pToRelease = 0;
        !          5339:   unsigned char *pPrior;
        !          5340:   unsigned char *pPayload;
        !          5341:   BtShared *pBt = pPage->pBt;
        !          5342:   Pgno pgnoOvfl = 0;
        !          5343:   int nHeader;
        !          5344:   CellInfo info;
        !          5345: 
        !          5346:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !          5347: 
        !          5348:   /* pPage is not necessarily writeable since pCell might be auxiliary
        !          5349:   ** buffer space that is separate from the pPage buffer area */
        !          5350:   assert( pCell<pPage->aData || pCell>=&pPage->aData[pBt->pageSize]
        !          5351:             || sqlite3PagerIswriteable(pPage->pDbPage) );
        !          5352: 
        !          5353:   /* Fill in the header. */
        !          5354:   nHeader = 0;
        !          5355:   if( !pPage->leaf ){
        !          5356:     nHeader += 4;
        !          5357:   }
        !          5358:   if( pPage->hasData ){
        !          5359:     nHeader += putVarint(&pCell[nHeader], nData+nZero);
        !          5360:   }else{
        !          5361:     nData = nZero = 0;
        !          5362:   }
        !          5363:   nHeader += putVarint(&pCell[nHeader], *(u64*)&nKey);
        !          5364:   btreeParseCellPtr(pPage, pCell, &info);
        !          5365:   assert( info.nHeader==nHeader );
        !          5366:   assert( info.nKey==nKey );
        !          5367:   assert( info.nData==(u32)(nData+nZero) );
        !          5368:   
        !          5369:   /* Fill in the payload */
        !          5370:   nPayload = nData + nZero;
        !          5371:   if( pPage->intKey ){
        !          5372:     pSrc = pData;
        !          5373:     nSrc = nData;
        !          5374:     nData = 0;
        !          5375:   }else{ 
        !          5376:     if( NEVER(nKey>0x7fffffff || pKey==0) ){
        !          5377:       return SQLITE_CORRUPT_BKPT;
        !          5378:     }
        !          5379:     nPayload += (int)nKey;
        !          5380:     pSrc = pKey;
        !          5381:     nSrc = (int)nKey;
        !          5382:   }
        !          5383:   *pnSize = info.nSize;
        !          5384:   spaceLeft = info.nLocal;
        !          5385:   pPayload = &pCell[nHeader];
        !          5386:   pPrior = &pCell[info.iOverflow];
        !          5387: 
        !          5388:   while( nPayload>0 ){
        !          5389:     if( spaceLeft==0 ){
        !          5390: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          5391:       Pgno pgnoPtrmap = pgnoOvfl; /* Overflow page pointer-map entry page */
        !          5392:       if( pBt->autoVacuum ){
        !          5393:         do{
        !          5394:           pgnoOvfl++;
        !          5395:         } while( 
        !          5396:           PTRMAP_ISPAGE(pBt, pgnoOvfl) || pgnoOvfl==PENDING_BYTE_PAGE(pBt) 
        !          5397:         );
        !          5398:       }
        !          5399: #endif
        !          5400:       rc = allocateBtreePage(pBt, &pOvfl, &pgnoOvfl, pgnoOvfl, 0);
        !          5401: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          5402:       /* If the database supports auto-vacuum, and the second or subsequent
        !          5403:       ** overflow page is being allocated, add an entry to the pointer-map
        !          5404:       ** for that page now. 
        !          5405:       **
        !          5406:       ** If this is the first overflow page, then write a partial entry 
        !          5407:       ** to the pointer-map. If we write nothing to this pointer-map slot,
        !          5408:       ** then the optimistic overflow chain processing in clearCell()
        !          5409:       ** may misinterpret the uninitialised values and delete the
        !          5410:       ** wrong pages from the database.
        !          5411:       */
        !          5412:       if( pBt->autoVacuum && rc==SQLITE_OK ){
        !          5413:         u8 eType = (pgnoPtrmap?PTRMAP_OVERFLOW2:PTRMAP_OVERFLOW1);
        !          5414:         ptrmapPut(pBt, pgnoOvfl, eType, pgnoPtrmap, &rc);
        !          5415:         if( rc ){
        !          5416:           releasePage(pOvfl);
        !          5417:         }
        !          5418:       }
        !          5419: #endif
        !          5420:       if( rc ){
        !          5421:         releasePage(pToRelease);
        !          5422:         return rc;
        !          5423:       }
        !          5424: 
        !          5425:       /* If pToRelease is not zero than pPrior points into the data area
        !          5426:       ** of pToRelease.  Make sure pToRelease is still writeable. */
        !          5427:       assert( pToRelease==0 || sqlite3PagerIswriteable(pToRelease->pDbPage) );
        !          5428: 
        !          5429:       /* If pPrior is part of the data area of pPage, then make sure pPage
        !          5430:       ** is still writeable */
        !          5431:       assert( pPrior<pPage->aData || pPrior>=&pPage->aData[pBt->pageSize]
        !          5432:             || sqlite3PagerIswriteable(pPage->pDbPage) );
        !          5433: 
        !          5434:       put4byte(pPrior, pgnoOvfl);
        !          5435:       releasePage(pToRelease);
        !          5436:       pToRelease = pOvfl;
        !          5437:       pPrior = pOvfl->aData;
        !          5438:       put4byte(pPrior, 0);
        !          5439:       pPayload = &pOvfl->aData[4];
        !          5440:       spaceLeft = pBt->usableSize - 4;
        !          5441:     }
        !          5442:     n = nPayload;
        !          5443:     if( n>spaceLeft ) n = spaceLeft;
        !          5444: 
        !          5445:     /* If pToRelease is not zero than pPayload points into the data area
        !          5446:     ** of pToRelease.  Make sure pToRelease is still writeable. */
        !          5447:     assert( pToRelease==0 || sqlite3PagerIswriteable(pToRelease->pDbPage) );
        !          5448: 
        !          5449:     /* If pPayload is part of the data area of pPage, then make sure pPage
        !          5450:     ** is still writeable */
        !          5451:     assert( pPayload<pPage->aData || pPayload>=&pPage->aData[pBt->pageSize]
        !          5452:             || sqlite3PagerIswriteable(pPage->pDbPage) );
        !          5453: 
        !          5454:     if( nSrc>0 ){
        !          5455:       if( n>nSrc ) n = nSrc;
        !          5456:       assert( pSrc );
        !          5457:       memcpy(pPayload, pSrc, n);
        !          5458:     }else{
        !          5459:       memset(pPayload, 0, n);
        !          5460:     }
        !          5461:     nPayload -= n;
        !          5462:     pPayload += n;
        !          5463:     pSrc += n;
        !          5464:     nSrc -= n;
        !          5465:     spaceLeft -= n;
        !          5466:     if( nSrc==0 ){
        !          5467:       nSrc = nData;
        !          5468:       pSrc = pData;
        !          5469:     }
        !          5470:   }
        !          5471:   releasePage(pToRelease);
        !          5472:   return SQLITE_OK;
        !          5473: }
        !          5474: 
        !          5475: /*
        !          5476: ** Remove the i-th cell from pPage.  This routine effects pPage only.
        !          5477: ** The cell content is not freed or deallocated.  It is assumed that
        !          5478: ** the cell content has been copied someplace else.  This routine just
        !          5479: ** removes the reference to the cell from pPage.
        !          5480: **
        !          5481: ** "sz" must be the number of bytes in the cell.
        !          5482: */
        !          5483: static void dropCell(MemPage *pPage, int idx, int sz, int *pRC){
        !          5484:   u32 pc;         /* Offset to cell content of cell being deleted */
        !          5485:   u8 *data;       /* pPage->aData */
        !          5486:   u8 *ptr;        /* Used to move bytes around within data[] */
        !          5487:   u8 *endPtr;     /* End of loop */
        !          5488:   int rc;         /* The return code */
        !          5489:   int hdr;        /* Beginning of the header.  0 most pages.  100 page 1 */
        !          5490: 
        !          5491:   if( *pRC ) return;
        !          5492: 
        !          5493:   assert( idx>=0 && idx<pPage->nCell );
        !          5494:   assert( sz==cellSize(pPage, idx) );
        !          5495:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
        !          5496:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !          5497:   data = pPage->aData;
        !          5498:   ptr = &pPage->aCellIdx[2*idx];
        !          5499:   pc = get2byte(ptr);
        !          5500:   hdr = pPage->hdrOffset;
        !          5501:   testcase( pc==get2byte(&data[hdr+5]) );
        !          5502:   testcase( pc+sz==pPage->pBt->usableSize );
        !          5503:   if( pc < (u32)get2byte(&data[hdr+5]) || pc+sz > pPage->pBt->usableSize ){
        !          5504:     *pRC = SQLITE_CORRUPT_BKPT;
        !          5505:     return;
        !          5506:   }
        !          5507:   rc = freeSpace(pPage, pc, sz);
        !          5508:   if( rc ){
        !          5509:     *pRC = rc;
        !          5510:     return;
        !          5511:   }
        !          5512:   endPtr = &pPage->aCellIdx[2*pPage->nCell - 2];
        !          5513:   assert( (SQLITE_PTR_TO_INT(ptr)&1)==0 );  /* ptr is always 2-byte aligned */
        !          5514:   while( ptr<endPtr ){
        !          5515:     *(u16*)ptr = *(u16*)&ptr[2];
        !          5516:     ptr += 2;
        !          5517:   }
        !          5518:   pPage->nCell--;
        !          5519:   put2byte(&data[hdr+3], pPage->nCell);
        !          5520:   pPage->nFree += 2;
        !          5521: }
        !          5522: 
        !          5523: /*
        !          5524: ** Insert a new cell on pPage at cell index "i".  pCell points to the
        !          5525: ** content of the cell.
        !          5526: **
        !          5527: ** If the cell content will fit on the page, then put it there.  If it
        !          5528: ** will not fit, then make a copy of the cell content into pTemp if
        !          5529: ** pTemp is not null.  Regardless of pTemp, allocate a new entry
        !          5530: ** in pPage->aOvfl[] and make it point to the cell content (either
        !          5531: ** in pTemp or the original pCell) and also record its index. 
        !          5532: ** Allocating a new entry in pPage->aCell[] implies that 
        !          5533: ** pPage->nOverflow is incremented.
        !          5534: **
        !          5535: ** If nSkip is non-zero, then do not copy the first nSkip bytes of the
        !          5536: ** cell. The caller will overwrite them after this function returns. If
        !          5537: ** nSkip is non-zero, then pCell may not point to an invalid memory location 
        !          5538: ** (but pCell+nSkip is always valid).
        !          5539: */
        !          5540: static void insertCell(
        !          5541:   MemPage *pPage,   /* Page into which we are copying */
        !          5542:   int i,            /* New cell becomes the i-th cell of the page */
        !          5543:   u8 *pCell,        /* Content of the new cell */
        !          5544:   int sz,           /* Bytes of content in pCell */
        !          5545:   u8 *pTemp,        /* Temp storage space for pCell, if needed */
        !          5546:   Pgno iChild,      /* If non-zero, replace first 4 bytes with this value */
        !          5547:   int *pRC          /* Read and write return code from here */
        !          5548: ){
        !          5549:   int idx = 0;      /* Where to write new cell content in data[] */
        !          5550:   int j;            /* Loop counter */
        !          5551:   int end;          /* First byte past the last cell pointer in data[] */
        !          5552:   int ins;          /* Index in data[] where new cell pointer is inserted */
        !          5553:   int cellOffset;   /* Address of first cell pointer in data[] */
        !          5554:   u8 *data;         /* The content of the whole page */
        !          5555:   u8 *ptr;          /* Used for moving information around in data[] */
        !          5556:   u8 *endPtr;       /* End of the loop */
        !          5557: 
        !          5558:   int nSkip = (iChild ? 4 : 0);
        !          5559: 
        !          5560:   if( *pRC ) return;
        !          5561: 
        !          5562:   assert( i>=0 && i<=pPage->nCell+pPage->nOverflow );
        !          5563:   assert( pPage->nCell<=MX_CELL(pPage->pBt) && MX_CELL(pPage->pBt)<=10921 );
        !          5564:   assert( pPage->nOverflow<=ArraySize(pPage->aOvfl) );
        !          5565:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !          5566:   /* The cell should normally be sized correctly.  However, when moving a
        !          5567:   ** malformed cell from a leaf page to an interior page, if the cell size
        !          5568:   ** wanted to be less than 4 but got rounded up to 4 on the leaf, then size
        !          5569:   ** might be less than 8 (leaf-size + pointer) on the interior node.  Hence
        !          5570:   ** the term after the || in the following assert(). */
        !          5571:   assert( sz==cellSizePtr(pPage, pCell) || (sz==8 && iChild>0) );
        !          5572:   if( pPage->nOverflow || sz+2>pPage->nFree ){
        !          5573:     if( pTemp ){
        !          5574:       memcpy(pTemp+nSkip, pCell+nSkip, sz-nSkip);
        !          5575:       pCell = pTemp;
        !          5576:     }
        !          5577:     if( iChild ){
        !          5578:       put4byte(pCell, iChild);
        !          5579:     }
        !          5580:     j = pPage->nOverflow++;
        !          5581:     assert( j<(int)(sizeof(pPage->aOvfl)/sizeof(pPage->aOvfl[0])) );
        !          5582:     pPage->aOvfl[j].pCell = pCell;
        !          5583:     pPage->aOvfl[j].idx = (u16)i;
        !          5584:   }else{
        !          5585:     int rc = sqlite3PagerWrite(pPage->pDbPage);
        !          5586:     if( rc!=SQLITE_OK ){
        !          5587:       *pRC = rc;
        !          5588:       return;
        !          5589:     }
        !          5590:     assert( sqlite3PagerIswriteable(pPage->pDbPage) );
        !          5591:     data = pPage->aData;
        !          5592:     cellOffset = pPage->cellOffset;
        !          5593:     end = cellOffset + 2*pPage->nCell;
        !          5594:     ins = cellOffset + 2*i;
        !          5595:     rc = allocateSpace(pPage, sz, &idx);
        !          5596:     if( rc ){ *pRC = rc; return; }
        !          5597:     /* The allocateSpace() routine guarantees the following two properties
        !          5598:     ** if it returns success */
        !          5599:     assert( idx >= end+2 );
        !          5600:     assert( idx+sz <= (int)pPage->pBt->usableSize );
        !          5601:     pPage->nCell++;
        !          5602:     pPage->nFree -= (u16)(2 + sz);
        !          5603:     memcpy(&data[idx+nSkip], pCell+nSkip, sz-nSkip);
        !          5604:     if( iChild ){
        !          5605:       put4byte(&data[idx], iChild);
        !          5606:     }
        !          5607:     ptr = &data[end];
        !          5608:     endPtr = &data[ins];
        !          5609:     assert( (SQLITE_PTR_TO_INT(ptr)&1)==0 );  /* ptr is always 2-byte aligned */
        !          5610:     while( ptr>endPtr ){
        !          5611:       *(u16*)ptr = *(u16*)&ptr[-2];
        !          5612:       ptr -= 2;
        !          5613:     }
        !          5614:     put2byte(&data[ins], idx);
        !          5615:     put2byte(&data[pPage->hdrOffset+3], pPage->nCell);
        !          5616: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          5617:     if( pPage->pBt->autoVacuum ){
        !          5618:       /* The cell may contain a pointer to an overflow page. If so, write
        !          5619:       ** the entry for the overflow page into the pointer map.
        !          5620:       */
        !          5621:       ptrmapPutOvflPtr(pPage, pCell, pRC);
        !          5622:     }
        !          5623: #endif
        !          5624:   }
        !          5625: }
        !          5626: 
        !          5627: /*
        !          5628: ** Add a list of cells to a page.  The page should be initially empty.
        !          5629: ** The cells are guaranteed to fit on the page.
        !          5630: */
        !          5631: static void assemblePage(
        !          5632:   MemPage *pPage,   /* The page to be assemblied */
        !          5633:   int nCell,        /* The number of cells to add to this page */
        !          5634:   u8 **apCell,      /* Pointers to cell bodies */
        !          5635:   u16 *aSize        /* Sizes of the cells */
        !          5636: ){
        !          5637:   int i;            /* Loop counter */
        !          5638:   u8 *pCellptr;     /* Address of next cell pointer */
        !          5639:   int cellbody;     /* Address of next cell body */
        !          5640:   u8 * const data = pPage->aData;             /* Pointer to data for pPage */
        !          5641:   const int hdr = pPage->hdrOffset;           /* Offset of header on pPage */
        !          5642:   const int nUsable = pPage->pBt->usableSize; /* Usable size of page */
        !          5643: 
        !          5644:   assert( pPage->nOverflow==0 );
        !          5645:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !          5646:   assert( nCell>=0 && nCell<=(int)MX_CELL(pPage->pBt)
        !          5647:             && (int)MX_CELL(pPage->pBt)<=10921);
        !          5648:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
        !          5649: 
        !          5650:   /* Check that the page has just been zeroed by zeroPage() */
        !          5651:   assert( pPage->nCell==0 );
        !          5652:   assert( get2byteNotZero(&data[hdr+5])==nUsable );
        !          5653: 
        !          5654:   pCellptr = &pPage->aCellIdx[nCell*2];
        !          5655:   cellbody = nUsable;
        !          5656:   for(i=nCell-1; i>=0; i--){
        !          5657:     u16 sz = aSize[i];
        !          5658:     pCellptr -= 2;
        !          5659:     cellbody -= sz;
        !          5660:     put2byte(pCellptr, cellbody);
        !          5661:     memcpy(&data[cellbody], apCell[i], sz);
        !          5662:   }
        !          5663:   put2byte(&data[hdr+3], nCell);
        !          5664:   put2byte(&data[hdr+5], cellbody);
        !          5665:   pPage->nFree -= (nCell*2 + nUsable - cellbody);
        !          5666:   pPage->nCell = (u16)nCell;
        !          5667: }
        !          5668: 
        !          5669: /*
        !          5670: ** The following parameters determine how many adjacent pages get involved
        !          5671: ** in a balancing operation.  NN is the number of neighbors on either side
        !          5672: ** of the page that participate in the balancing operation.  NB is the
        !          5673: ** total number of pages that participate, including the target page and
        !          5674: ** NN neighbors on either side.
        !          5675: **
        !          5676: ** The minimum value of NN is 1 (of course).  Increasing NN above 1
        !          5677: ** (to 2 or 3) gives a modest improvement in SELECT and DELETE performance
        !          5678: ** in exchange for a larger degradation in INSERT and UPDATE performance.
        !          5679: ** The value of NN appears to give the best results overall.
        !          5680: */
        !          5681: #define NN 1             /* Number of neighbors on either side of pPage */
        !          5682: #define NB (NN*2+1)      /* Total pages involved in the balance */
        !          5683: 
        !          5684: 
        !          5685: #ifndef SQLITE_OMIT_QUICKBALANCE
        !          5686: /*
        !          5687: ** This version of balance() handles the common special case where
        !          5688: ** a new entry is being inserted on the extreme right-end of the
        !          5689: ** tree, in other words, when the new entry will become the largest
        !          5690: ** entry in the tree.
        !          5691: **
        !          5692: ** Instead of trying to balance the 3 right-most leaf pages, just add
        !          5693: ** a new page to the right-hand side and put the one new entry in
        !          5694: ** that page.  This leaves the right side of the tree somewhat
        !          5695: ** unbalanced.  But odds are that we will be inserting new entries
        !          5696: ** at the end soon afterwards so the nearly empty page will quickly
        !          5697: ** fill up.  On average.
        !          5698: **
        !          5699: ** pPage is the leaf page which is the right-most page in the tree.
        !          5700: ** pParent is its parent.  pPage must have a single overflow entry
        !          5701: ** which is also the right-most entry on the page.
        !          5702: **
        !          5703: ** The pSpace buffer is used to store a temporary copy of the divider
        !          5704: ** cell that will be inserted into pParent. Such a cell consists of a 4
        !          5705: ** byte page number followed by a variable length integer. In other
        !          5706: ** words, at most 13 bytes. Hence the pSpace buffer must be at
        !          5707: ** least 13 bytes in size.
        !          5708: */
        !          5709: static int balance_quick(MemPage *pParent, MemPage *pPage, u8 *pSpace){
        !          5710:   BtShared *const pBt = pPage->pBt;    /* B-Tree Database */
        !          5711:   MemPage *pNew;                       /* Newly allocated page */
        !          5712:   int rc;                              /* Return Code */
        !          5713:   Pgno pgnoNew;                        /* Page number of pNew */
        !          5714: 
        !          5715:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
        !          5716:   assert( sqlite3PagerIswriteable(pParent->pDbPage) );
        !          5717:   assert( pPage->nOverflow==1 );
        !          5718: 
        !          5719:   /* This error condition is now caught prior to reaching this function */
        !          5720:   if( pPage->nCell<=0 ) return SQLITE_CORRUPT_BKPT;
        !          5721: 
        !          5722:   /* Allocate a new page. This page will become the right-sibling of 
        !          5723:   ** pPage. Make the parent page writable, so that the new divider cell
        !          5724:   ** may be inserted. If both these operations are successful, proceed.
        !          5725:   */
        !          5726:   rc = allocateBtreePage(pBt, &pNew, &pgnoNew, 0, 0);
        !          5727: 
        !          5728:   if( rc==SQLITE_OK ){
        !          5729: 
        !          5730:     u8 *pOut = &pSpace[4];
        !          5731:     u8 *pCell = pPage->aOvfl[0].pCell;
        !          5732:     u16 szCell = cellSizePtr(pPage, pCell);
        !          5733:     u8 *pStop;
        !          5734: 
        !          5735:     assert( sqlite3PagerIswriteable(pNew->pDbPage) );
        !          5736:     assert( pPage->aData[0]==(PTF_INTKEY|PTF_LEAFDATA|PTF_LEAF) );
        !          5737:     zeroPage(pNew, PTF_INTKEY|PTF_LEAFDATA|PTF_LEAF);
        !          5738:     assemblePage(pNew, 1, &pCell, &szCell);
        !          5739: 
        !          5740:     /* If this is an auto-vacuum database, update the pointer map
        !          5741:     ** with entries for the new page, and any pointer from the 
        !          5742:     ** cell on the page to an overflow page. If either of these
        !          5743:     ** operations fails, the return code is set, but the contents
        !          5744:     ** of the parent page are still manipulated by thh code below.
        !          5745:     ** That is Ok, at this point the parent page is guaranteed to
        !          5746:     ** be marked as dirty. Returning an error code will cause a
        !          5747:     ** rollback, undoing any changes made to the parent page.
        !          5748:     */
        !          5749:     if( ISAUTOVACUUM ){
        !          5750:       ptrmapPut(pBt, pgnoNew, PTRMAP_BTREE, pParent->pgno, &rc);
        !          5751:       if( szCell>pNew->minLocal ){
        !          5752:         ptrmapPutOvflPtr(pNew, pCell, &rc);
        !          5753:       }
        !          5754:     }
        !          5755:   
        !          5756:     /* Create a divider cell to insert into pParent. The divider cell
        !          5757:     ** consists of a 4-byte page number (the page number of pPage) and
        !          5758:     ** a variable length key value (which must be the same value as the
        !          5759:     ** largest key on pPage).
        !          5760:     **
        !          5761:     ** To find the largest key value on pPage, first find the right-most 
        !          5762:     ** cell on pPage. The first two fields of this cell are the 
        !          5763:     ** record-length (a variable length integer at most 32-bits in size)
        !          5764:     ** and the key value (a variable length integer, may have any value).
        !          5765:     ** The first of the while(...) loops below skips over the record-length
        !          5766:     ** field. The second while(...) loop copies the key value from the
        !          5767:     ** cell on pPage into the pSpace buffer.
        !          5768:     */
        !          5769:     pCell = findCell(pPage, pPage->nCell-1);
        !          5770:     pStop = &pCell[9];
        !          5771:     while( (*(pCell++)&0x80) && pCell<pStop );
        !          5772:     pStop = &pCell[9];
        !          5773:     while( ((*(pOut++) = *(pCell++))&0x80) && pCell<pStop );
        !          5774: 
        !          5775:     /* Insert the new divider cell into pParent. */
        !          5776:     insertCell(pParent, pParent->nCell, pSpace, (int)(pOut-pSpace),
        !          5777:                0, pPage->pgno, &rc);
        !          5778: 
        !          5779:     /* Set the right-child pointer of pParent to point to the new page. */
        !          5780:     put4byte(&pParent->aData[pParent->hdrOffset+8], pgnoNew);
        !          5781:   
        !          5782:     /* Release the reference to the new page. */
        !          5783:     releasePage(pNew);
        !          5784:   }
        !          5785: 
        !          5786:   return rc;
        !          5787: }
        !          5788: #endif /* SQLITE_OMIT_QUICKBALANCE */
        !          5789: 
        !          5790: #if 0
        !          5791: /*
        !          5792: ** This function does not contribute anything to the operation of SQLite.
        !          5793: ** it is sometimes activated temporarily while debugging code responsible 
        !          5794: ** for setting pointer-map entries.
        !          5795: */
        !          5796: static int ptrmapCheckPages(MemPage **apPage, int nPage){
        !          5797:   int i, j;
        !          5798:   for(i=0; i<nPage; i++){
        !          5799:     Pgno n;
        !          5800:     u8 e;
        !          5801:     MemPage *pPage = apPage[i];
        !          5802:     BtShared *pBt = pPage->pBt;
        !          5803:     assert( pPage->isInit );
        !          5804: 
        !          5805:     for(j=0; j<pPage->nCell; j++){
        !          5806:       CellInfo info;
        !          5807:       u8 *z;
        !          5808:      
        !          5809:       z = findCell(pPage, j);
        !          5810:       btreeParseCellPtr(pPage, z, &info);
        !          5811:       if( info.iOverflow ){
        !          5812:         Pgno ovfl = get4byte(&z[info.iOverflow]);
        !          5813:         ptrmapGet(pBt, ovfl, &e, &n);
        !          5814:         assert( n==pPage->pgno && e==PTRMAP_OVERFLOW1 );
        !          5815:       }
        !          5816:       if( !pPage->leaf ){
        !          5817:         Pgno child = get4byte(z);
        !          5818:         ptrmapGet(pBt, child, &e, &n);
        !          5819:         assert( n==pPage->pgno && e==PTRMAP_BTREE );
        !          5820:       }
        !          5821:     }
        !          5822:     if( !pPage->leaf ){
        !          5823:       Pgno child = get4byte(&pPage->aData[pPage->hdrOffset+8]);
        !          5824:       ptrmapGet(pBt, child, &e, &n);
        !          5825:       assert( n==pPage->pgno && e==PTRMAP_BTREE );
        !          5826:     }
        !          5827:   }
        !          5828:   return 1;
        !          5829: }
        !          5830: #endif
        !          5831: 
        !          5832: /*
        !          5833: ** This function is used to copy the contents of the b-tree node stored 
        !          5834: ** on page pFrom to page pTo. If page pFrom was not a leaf page, then
        !          5835: ** the pointer-map entries for each child page are updated so that the
        !          5836: ** parent page stored in the pointer map is page pTo. If pFrom contained
        !          5837: ** any cells with overflow page pointers, then the corresponding pointer
        !          5838: ** map entries are also updated so that the parent page is page pTo.
        !          5839: **
        !          5840: ** If pFrom is currently carrying any overflow cells (entries in the
        !          5841: ** MemPage.aOvfl[] array), they are not copied to pTo. 
        !          5842: **
        !          5843: ** Before returning, page pTo is reinitialized using btreeInitPage().
        !          5844: **
        !          5845: ** The performance of this function is not critical. It is only used by 
        !          5846: ** the balance_shallower() and balance_deeper() procedures, neither of
        !          5847: ** which are called often under normal circumstances.
        !          5848: */
        !          5849: static void copyNodeContent(MemPage *pFrom, MemPage *pTo, int *pRC){
        !          5850:   if( (*pRC)==SQLITE_OK ){
        !          5851:     BtShared * const pBt = pFrom->pBt;
        !          5852:     u8 * const aFrom = pFrom->aData;
        !          5853:     u8 * const aTo = pTo->aData;
        !          5854:     int const iFromHdr = pFrom->hdrOffset;
        !          5855:     int const iToHdr = ((pTo->pgno==1) ? 100 : 0);
        !          5856:     int rc;
        !          5857:     int iData;
        !          5858:   
        !          5859:   
        !          5860:     assert( pFrom->isInit );
        !          5861:     assert( pFrom->nFree>=iToHdr );
        !          5862:     assert( get2byte(&aFrom[iFromHdr+5]) <= (int)pBt->usableSize );
        !          5863:   
        !          5864:     /* Copy the b-tree node content from page pFrom to page pTo. */
        !          5865:     iData = get2byte(&aFrom[iFromHdr+5]);
        !          5866:     memcpy(&aTo[iData], &aFrom[iData], pBt->usableSize-iData);
        !          5867:     memcpy(&aTo[iToHdr], &aFrom[iFromHdr], pFrom->cellOffset + 2*pFrom->nCell);
        !          5868:   
        !          5869:     /* Reinitialize page pTo so that the contents of the MemPage structure
        !          5870:     ** match the new data. The initialization of pTo can actually fail under
        !          5871:     ** fairly obscure circumstances, even though it is a copy of initialized 
        !          5872:     ** page pFrom.
        !          5873:     */
        !          5874:     pTo->isInit = 0;
        !          5875:     rc = btreeInitPage(pTo);
        !          5876:     if( rc!=SQLITE_OK ){
        !          5877:       *pRC = rc;
        !          5878:       return;
        !          5879:     }
        !          5880:   
        !          5881:     /* If this is an auto-vacuum database, update the pointer-map entries
        !          5882:     ** for any b-tree or overflow pages that pTo now contains the pointers to.
        !          5883:     */
        !          5884:     if( ISAUTOVACUUM ){
        !          5885:       *pRC = setChildPtrmaps(pTo);
        !          5886:     }
        !          5887:   }
        !          5888: }
        !          5889: 
        !          5890: /*
        !          5891: ** This routine redistributes cells on the iParentIdx'th child of pParent
        !          5892: ** (hereafter "the page") and up to 2 siblings so that all pages have about the
        !          5893: ** same amount of free space. Usually a single sibling on either side of the
        !          5894: ** page are used in the balancing, though both siblings might come from one
        !          5895: ** side if the page is the first or last child of its parent. If the page 
        !          5896: ** has fewer than 2 siblings (something which can only happen if the page
        !          5897: ** is a root page or a child of a root page) then all available siblings
        !          5898: ** participate in the balancing.
        !          5899: **
        !          5900: ** The number of siblings of the page might be increased or decreased by 
        !          5901: ** one or two in an effort to keep pages nearly full but not over full. 
        !          5902: **
        !          5903: ** Note that when this routine is called, some of the cells on the page
        !          5904: ** might not actually be stored in MemPage.aData[]. This can happen
        !          5905: ** if the page is overfull. This routine ensures that all cells allocated
        !          5906: ** to the page and its siblings fit into MemPage.aData[] before returning.
        !          5907: **
        !          5908: ** In the course of balancing the page and its siblings, cells may be
        !          5909: ** inserted into or removed from the parent page (pParent). Doing so
        !          5910: ** may cause the parent page to become overfull or underfull. If this
        !          5911: ** happens, it is the responsibility of the caller to invoke the correct
        !          5912: ** balancing routine to fix this problem (see the balance() routine). 
        !          5913: **
        !          5914: ** If this routine fails for any reason, it might leave the database
        !          5915: ** in a corrupted state. So if this routine fails, the database should
        !          5916: ** be rolled back.
        !          5917: **
        !          5918: ** The third argument to this function, aOvflSpace, is a pointer to a
        !          5919: ** buffer big enough to hold one page. If while inserting cells into the parent
        !          5920: ** page (pParent) the parent page becomes overfull, this buffer is
        !          5921: ** used to store the parent's overflow cells. Because this function inserts
        !          5922: ** a maximum of four divider cells into the parent page, and the maximum
        !          5923: ** size of a cell stored within an internal node is always less than 1/4
        !          5924: ** of the page-size, the aOvflSpace[] buffer is guaranteed to be large
        !          5925: ** enough for all overflow cells.
        !          5926: **
        !          5927: ** If aOvflSpace is set to a null pointer, this function returns 
        !          5928: ** SQLITE_NOMEM.
        !          5929: */
        !          5930: static int balance_nonroot(
        !          5931:   MemPage *pParent,               /* Parent page of siblings being balanced */
        !          5932:   int iParentIdx,                 /* Index of "the page" in pParent */
        !          5933:   u8 *aOvflSpace,                 /* page-size bytes of space for parent ovfl */
        !          5934:   int isRoot                      /* True if pParent is a root-page */
        !          5935: ){
        !          5936:   BtShared *pBt;               /* The whole database */
        !          5937:   int nCell = 0;               /* Number of cells in apCell[] */
        !          5938:   int nMaxCells = 0;           /* Allocated size of apCell, szCell, aFrom. */
        !          5939:   int nNew = 0;                /* Number of pages in apNew[] */
        !          5940:   int nOld;                    /* Number of pages in apOld[] */
        !          5941:   int i, j, k;                 /* Loop counters */
        !          5942:   int nxDiv;                   /* Next divider slot in pParent->aCell[] */
        !          5943:   int rc = SQLITE_OK;          /* The return code */
        !          5944:   u16 leafCorrection;          /* 4 if pPage is a leaf.  0 if not */
        !          5945:   int leafData;                /* True if pPage is a leaf of a LEAFDATA tree */
        !          5946:   int usableSpace;             /* Bytes in pPage beyond the header */
        !          5947:   int pageFlags;               /* Value of pPage->aData[0] */
        !          5948:   int subtotal;                /* Subtotal of bytes in cells on one page */
        !          5949:   int iSpace1 = 0;             /* First unused byte of aSpace1[] */
        !          5950:   int iOvflSpace = 0;          /* First unused byte of aOvflSpace[] */
        !          5951:   int szScratch;               /* Size of scratch memory requested */
        !          5952:   MemPage *apOld[NB];          /* pPage and up to two siblings */
        !          5953:   MemPage *apCopy[NB];         /* Private copies of apOld[] pages */
        !          5954:   MemPage *apNew[NB+2];        /* pPage and up to NB siblings after balancing */
        !          5955:   u8 *pRight;                  /* Location in parent of right-sibling pointer */
        !          5956:   u8 *apDiv[NB-1];             /* Divider cells in pParent */
        !          5957:   int cntNew[NB+2];            /* Index in aCell[] of cell after i-th page */
        !          5958:   int szNew[NB+2];             /* Combined size of cells place on i-th page */
        !          5959:   u8 **apCell = 0;             /* All cells begin balanced */
        !          5960:   u16 *szCell;                 /* Local size of all cells in apCell[] */
        !          5961:   u8 *aSpace1;                 /* Space for copies of dividers cells */
        !          5962:   Pgno pgno;                   /* Temp var to store a page number in */
        !          5963: 
        !          5964:   pBt = pParent->pBt;
        !          5965:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          5966:   assert( sqlite3PagerIswriteable(pParent->pDbPage) );
        !          5967: 
        !          5968: #if 0
        !          5969:   TRACE(("BALANCE: begin page %d child of %d\n", pPage->pgno, pParent->pgno));
        !          5970: #endif
        !          5971: 
        !          5972:   /* At this point pParent may have at most one overflow cell. And if
        !          5973:   ** this overflow cell is present, it must be the cell with 
        !          5974:   ** index iParentIdx. This scenario comes about when this function
        !          5975:   ** is called (indirectly) from sqlite3BtreeDelete().
        !          5976:   */
        !          5977:   assert( pParent->nOverflow==0 || pParent->nOverflow==1 );
        !          5978:   assert( pParent->nOverflow==0 || pParent->aOvfl[0].idx==iParentIdx );
        !          5979: 
        !          5980:   if( !aOvflSpace ){
        !          5981:     return SQLITE_NOMEM;
        !          5982:   }
        !          5983: 
        !          5984:   /* Find the sibling pages to balance. Also locate the cells in pParent 
        !          5985:   ** that divide the siblings. An attempt is made to find NN siblings on 
        !          5986:   ** either side of pPage. More siblings are taken from one side, however, 
        !          5987:   ** if there are fewer than NN siblings on the other side. If pParent
        !          5988:   ** has NB or fewer children then all children of pParent are taken.  
        !          5989:   **
        !          5990:   ** This loop also drops the divider cells from the parent page. This
        !          5991:   ** way, the remainder of the function does not have to deal with any
        !          5992:   ** overflow cells in the parent page, since if any existed they will
        !          5993:   ** have already been removed.
        !          5994:   */
        !          5995:   i = pParent->nOverflow + pParent->nCell;
        !          5996:   if( i<2 ){
        !          5997:     nxDiv = 0;
        !          5998:     nOld = i+1;
        !          5999:   }else{
        !          6000:     nOld = 3;
        !          6001:     if( iParentIdx==0 ){                 
        !          6002:       nxDiv = 0;
        !          6003:     }else if( iParentIdx==i ){
        !          6004:       nxDiv = i-2;
        !          6005:     }else{
        !          6006:       nxDiv = iParentIdx-1;
        !          6007:     }
        !          6008:     i = 2;
        !          6009:   }
        !          6010:   if( (i+nxDiv-pParent->nOverflow)==pParent->nCell ){
        !          6011:     pRight = &pParent->aData[pParent->hdrOffset+8];
        !          6012:   }else{
        !          6013:     pRight = findCell(pParent, i+nxDiv-pParent->nOverflow);
        !          6014:   }
        !          6015:   pgno = get4byte(pRight);
        !          6016:   while( 1 ){
        !          6017:     rc = getAndInitPage(pBt, pgno, &apOld[i]);
        !          6018:     if( rc ){
        !          6019:       memset(apOld, 0, (i+1)*sizeof(MemPage*));
        !          6020:       goto balance_cleanup;
        !          6021:     }
        !          6022:     nMaxCells += 1+apOld[i]->nCell+apOld[i]->nOverflow;
        !          6023:     if( (i--)==0 ) break;
        !          6024: 
        !          6025:     if( i+nxDiv==pParent->aOvfl[0].idx && pParent->nOverflow ){
        !          6026:       apDiv[i] = pParent->aOvfl[0].pCell;
        !          6027:       pgno = get4byte(apDiv[i]);
        !          6028:       szNew[i] = cellSizePtr(pParent, apDiv[i]);
        !          6029:       pParent->nOverflow = 0;
        !          6030:     }else{
        !          6031:       apDiv[i] = findCell(pParent, i+nxDiv-pParent->nOverflow);
        !          6032:       pgno = get4byte(apDiv[i]);
        !          6033:       szNew[i] = cellSizePtr(pParent, apDiv[i]);
        !          6034: 
        !          6035:       /* Drop the cell from the parent page. apDiv[i] still points to
        !          6036:       ** the cell within the parent, even though it has been dropped.
        !          6037:       ** This is safe because dropping a cell only overwrites the first
        !          6038:       ** four bytes of it, and this function does not need the first
        !          6039:       ** four bytes of the divider cell. So the pointer is safe to use
        !          6040:       ** later on.  
        !          6041:       **
        !          6042:       ** But not if we are in secure-delete mode. In secure-delete mode,
        !          6043:       ** the dropCell() routine will overwrite the entire cell with zeroes.
        !          6044:       ** In this case, temporarily copy the cell into the aOvflSpace[]
        !          6045:       ** buffer. It will be copied out again as soon as the aSpace[] buffer
        !          6046:       ** is allocated.  */
        !          6047:       if( pBt->btsFlags & BTS_SECURE_DELETE ){
        !          6048:         int iOff;
        !          6049: 
        !          6050:         iOff = SQLITE_PTR_TO_INT(apDiv[i]) - SQLITE_PTR_TO_INT(pParent->aData);
        !          6051:         if( (iOff+szNew[i])>(int)pBt->usableSize ){
        !          6052:           rc = SQLITE_CORRUPT_BKPT;
        !          6053:           memset(apOld, 0, (i+1)*sizeof(MemPage*));
        !          6054:           goto balance_cleanup;
        !          6055:         }else{
        !          6056:           memcpy(&aOvflSpace[iOff], apDiv[i], szNew[i]);
        !          6057:           apDiv[i] = &aOvflSpace[apDiv[i]-pParent->aData];
        !          6058:         }
        !          6059:       }
        !          6060:       dropCell(pParent, i+nxDiv-pParent->nOverflow, szNew[i], &rc);
        !          6061:     }
        !          6062:   }
        !          6063: 
        !          6064:   /* Make nMaxCells a multiple of 4 in order to preserve 8-byte
        !          6065:   ** alignment */
        !          6066:   nMaxCells = (nMaxCells + 3)&~3;
        !          6067: 
        !          6068:   /*
        !          6069:   ** Allocate space for memory structures
        !          6070:   */
        !          6071:   k = pBt->pageSize + ROUND8(sizeof(MemPage));
        !          6072:   szScratch =
        !          6073:        nMaxCells*sizeof(u8*)                       /* apCell */
        !          6074:      + nMaxCells*sizeof(u16)                       /* szCell */
        !          6075:      + pBt->pageSize                               /* aSpace1 */
        !          6076:      + k*nOld;                                     /* Page copies (apCopy) */
        !          6077:   apCell = sqlite3ScratchMalloc( szScratch ); 
        !          6078:   if( apCell==0 ){
        !          6079:     rc = SQLITE_NOMEM;
        !          6080:     goto balance_cleanup;
        !          6081:   }
        !          6082:   szCell = (u16*)&apCell[nMaxCells];
        !          6083:   aSpace1 = (u8*)&szCell[nMaxCells];
        !          6084:   assert( EIGHT_BYTE_ALIGNMENT(aSpace1) );
        !          6085: 
        !          6086:   /*
        !          6087:   ** Load pointers to all cells on sibling pages and the divider cells
        !          6088:   ** into the local apCell[] array.  Make copies of the divider cells
        !          6089:   ** into space obtained from aSpace1[] and remove the the divider Cells
        !          6090:   ** from pParent.
        !          6091:   **
        !          6092:   ** If the siblings are on leaf pages, then the child pointers of the
        !          6093:   ** divider cells are stripped from the cells before they are copied
        !          6094:   ** into aSpace1[].  In this way, all cells in apCell[] are without
        !          6095:   ** child pointers.  If siblings are not leaves, then all cell in
        !          6096:   ** apCell[] include child pointers.  Either way, all cells in apCell[]
        !          6097:   ** are alike.
        !          6098:   **
        !          6099:   ** leafCorrection:  4 if pPage is a leaf.  0 if pPage is not a leaf.
        !          6100:   **       leafData:  1 if pPage holds key+data and pParent holds only keys.
        !          6101:   */
        !          6102:   leafCorrection = apOld[0]->leaf*4;
        !          6103:   leafData = apOld[0]->hasData;
        !          6104:   for(i=0; i<nOld; i++){
        !          6105:     int limit;
        !          6106:     
        !          6107:     /* Before doing anything else, take a copy of the i'th original sibling
        !          6108:     ** The rest of this function will use data from the copies rather
        !          6109:     ** that the original pages since the original pages will be in the
        !          6110:     ** process of being overwritten.  */
        !          6111:     MemPage *pOld = apCopy[i] = (MemPage*)&aSpace1[pBt->pageSize + k*i];
        !          6112:     memcpy(pOld, apOld[i], sizeof(MemPage));
        !          6113:     pOld->aData = (void*)&pOld[1];
        !          6114:     memcpy(pOld->aData, apOld[i]->aData, pBt->pageSize);
        !          6115: 
        !          6116:     limit = pOld->nCell+pOld->nOverflow;
        !          6117:     if( pOld->nOverflow>0 ){
        !          6118:       for(j=0; j<limit; j++){
        !          6119:         assert( nCell<nMaxCells );
        !          6120:         apCell[nCell] = findOverflowCell(pOld, j);
        !          6121:         szCell[nCell] = cellSizePtr(pOld, apCell[nCell]);
        !          6122:         nCell++;
        !          6123:       }
        !          6124:     }else{
        !          6125:       u8 *aData = pOld->aData;
        !          6126:       u16 maskPage = pOld->maskPage;
        !          6127:       u16 cellOffset = pOld->cellOffset;
        !          6128:       for(j=0; j<limit; j++){
        !          6129:         assert( nCell<nMaxCells );
        !          6130:         apCell[nCell] = findCellv2(aData, maskPage, cellOffset, j);
        !          6131:         szCell[nCell] = cellSizePtr(pOld, apCell[nCell]);
        !          6132:         nCell++;
        !          6133:       }
        !          6134:     }       
        !          6135:     if( i<nOld-1 && !leafData){
        !          6136:       u16 sz = (u16)szNew[i];
        !          6137:       u8 *pTemp;
        !          6138:       assert( nCell<nMaxCells );
        !          6139:       szCell[nCell] = sz;
        !          6140:       pTemp = &aSpace1[iSpace1];
        !          6141:       iSpace1 += sz;
        !          6142:       assert( sz<=pBt->maxLocal+23 );
        !          6143:       assert( iSpace1 <= (int)pBt->pageSize );
        !          6144:       memcpy(pTemp, apDiv[i], sz);
        !          6145:       apCell[nCell] = pTemp+leafCorrection;
        !          6146:       assert( leafCorrection==0 || leafCorrection==4 );
        !          6147:       szCell[nCell] = szCell[nCell] - leafCorrection;
        !          6148:       if( !pOld->leaf ){
        !          6149:         assert( leafCorrection==0 );
        !          6150:         assert( pOld->hdrOffset==0 );
        !          6151:         /* The right pointer of the child page pOld becomes the left
        !          6152:         ** pointer of the divider cell */
        !          6153:         memcpy(apCell[nCell], &pOld->aData[8], 4);
        !          6154:       }else{
        !          6155:         assert( leafCorrection==4 );
        !          6156:         if( szCell[nCell]<4 ){
        !          6157:           /* Do not allow any cells smaller than 4 bytes. */
        !          6158:           szCell[nCell] = 4;
        !          6159:         }
        !          6160:       }
        !          6161:       nCell++;
        !          6162:     }
        !          6163:   }
        !          6164: 
        !          6165:   /*
        !          6166:   ** Figure out the number of pages needed to hold all nCell cells.
        !          6167:   ** Store this number in "k".  Also compute szNew[] which is the total
        !          6168:   ** size of all cells on the i-th page and cntNew[] which is the index
        !          6169:   ** in apCell[] of the cell that divides page i from page i+1.  
        !          6170:   ** cntNew[k] should equal nCell.
        !          6171:   **
        !          6172:   ** Values computed by this block:
        !          6173:   **
        !          6174:   **           k: The total number of sibling pages
        !          6175:   **    szNew[i]: Spaced used on the i-th sibling page.
        !          6176:   **   cntNew[i]: Index in apCell[] and szCell[] for the first cell to
        !          6177:   **              the right of the i-th sibling page.
        !          6178:   ** usableSpace: Number of bytes of space available on each sibling.
        !          6179:   ** 
        !          6180:   */
        !          6181:   usableSpace = pBt->usableSize - 12 + leafCorrection;
        !          6182:   for(subtotal=k=i=0; i<nCell; i++){
        !          6183:     assert( i<nMaxCells );
        !          6184:     subtotal += szCell[i] + 2;
        !          6185:     if( subtotal > usableSpace ){
        !          6186:       szNew[k] = subtotal - szCell[i];
        !          6187:       cntNew[k] = i;
        !          6188:       if( leafData ){ i--; }
        !          6189:       subtotal = 0;
        !          6190:       k++;
        !          6191:       if( k>NB+1 ){ rc = SQLITE_CORRUPT_BKPT; goto balance_cleanup; }
        !          6192:     }
        !          6193:   }
        !          6194:   szNew[k] = subtotal;
        !          6195:   cntNew[k] = nCell;
        !          6196:   k++;
        !          6197: 
        !          6198:   /*
        !          6199:   ** The packing computed by the previous block is biased toward the siblings
        !          6200:   ** on the left side.  The left siblings are always nearly full, while the
        !          6201:   ** right-most sibling might be nearly empty.  This block of code attempts
        !          6202:   ** to adjust the packing of siblings to get a better balance.
        !          6203:   **
        !          6204:   ** This adjustment is more than an optimization.  The packing above might
        !          6205:   ** be so out of balance as to be illegal.  For example, the right-most
        !          6206:   ** sibling might be completely empty.  This adjustment is not optional.
        !          6207:   */
        !          6208:   for(i=k-1; i>0; i--){
        !          6209:     int szRight = szNew[i];  /* Size of sibling on the right */
        !          6210:     int szLeft = szNew[i-1]; /* Size of sibling on the left */
        !          6211:     int r;              /* Index of right-most cell in left sibling */
        !          6212:     int d;              /* Index of first cell to the left of right sibling */
        !          6213: 
        !          6214:     r = cntNew[i-1] - 1;
        !          6215:     d = r + 1 - leafData;
        !          6216:     assert( d<nMaxCells );
        !          6217:     assert( r<nMaxCells );
        !          6218:     while( szRight==0 || szRight+szCell[d]+2<=szLeft-(szCell[r]+2) ){
        !          6219:       szRight += szCell[d] + 2;
        !          6220:       szLeft -= szCell[r] + 2;
        !          6221:       cntNew[i-1]--;
        !          6222:       r = cntNew[i-1] - 1;
        !          6223:       d = r + 1 - leafData;
        !          6224:     }
        !          6225:     szNew[i] = szRight;
        !          6226:     szNew[i-1] = szLeft;
        !          6227:   }
        !          6228: 
        !          6229:   /* Either we found one or more cells (cntnew[0])>0) or pPage is
        !          6230:   ** a virtual root page.  A virtual root page is when the real root
        !          6231:   ** page is page 1 and we are the only child of that page.
        !          6232:   **
        !          6233:   ** UPDATE:  The assert() below is not necessarily true if the database
        !          6234:   ** file is corrupt.  The corruption will be detected and reported later
        !          6235:   ** in this procedure so there is no need to act upon it now.
        !          6236:   */
        !          6237: #if 0
        !          6238:   assert( cntNew[0]>0 || (pParent->pgno==1 && pParent->nCell==0) );
        !          6239: #endif
        !          6240: 
        !          6241:   TRACE(("BALANCE: old: %d %d %d  ",
        !          6242:     apOld[0]->pgno, 
        !          6243:     nOld>=2 ? apOld[1]->pgno : 0,
        !          6244:     nOld>=3 ? apOld[2]->pgno : 0
        !          6245:   ));
        !          6246: 
        !          6247:   /*
        !          6248:   ** Allocate k new pages.  Reuse old pages where possible.
        !          6249:   */
        !          6250:   if( apOld[0]->pgno<=1 ){
        !          6251:     rc = SQLITE_CORRUPT_BKPT;
        !          6252:     goto balance_cleanup;
        !          6253:   }
        !          6254:   pageFlags = apOld[0]->aData[0];
        !          6255:   for(i=0; i<k; i++){
        !          6256:     MemPage *pNew;
        !          6257:     if( i<nOld ){
        !          6258:       pNew = apNew[i] = apOld[i];
        !          6259:       apOld[i] = 0;
        !          6260:       rc = sqlite3PagerWrite(pNew->pDbPage);
        !          6261:       nNew++;
        !          6262:       if( rc ) goto balance_cleanup;
        !          6263:     }else{
        !          6264:       assert( i>0 );
        !          6265:       rc = allocateBtreePage(pBt, &pNew, &pgno, pgno, 0);
        !          6266:       if( rc ) goto balance_cleanup;
        !          6267:       apNew[i] = pNew;
        !          6268:       nNew++;
        !          6269: 
        !          6270:       /* Set the pointer-map entry for the new sibling page. */
        !          6271:       if( ISAUTOVACUUM ){
        !          6272:         ptrmapPut(pBt, pNew->pgno, PTRMAP_BTREE, pParent->pgno, &rc);
        !          6273:         if( rc!=SQLITE_OK ){
        !          6274:           goto balance_cleanup;
        !          6275:         }
        !          6276:       }
        !          6277:     }
        !          6278:   }
        !          6279: 
        !          6280:   /* Free any old pages that were not reused as new pages.
        !          6281:   */
        !          6282:   while( i<nOld ){
        !          6283:     freePage(apOld[i], &rc);
        !          6284:     if( rc ) goto balance_cleanup;
        !          6285:     releasePage(apOld[i]);
        !          6286:     apOld[i] = 0;
        !          6287:     i++;
        !          6288:   }
        !          6289: 
        !          6290:   /*
        !          6291:   ** Put the new pages in accending order.  This helps to
        !          6292:   ** keep entries in the disk file in order so that a scan
        !          6293:   ** of the table is a linear scan through the file.  That
        !          6294:   ** in turn helps the operating system to deliver pages
        !          6295:   ** from the disk more rapidly.
        !          6296:   **
        !          6297:   ** An O(n^2) insertion sort algorithm is used, but since
        !          6298:   ** n is never more than NB (a small constant), that should
        !          6299:   ** not be a problem.
        !          6300:   **
        !          6301:   ** When NB==3, this one optimization makes the database
        !          6302:   ** about 25% faster for large insertions and deletions.
        !          6303:   */
        !          6304:   for(i=0; i<k-1; i++){
        !          6305:     int minV = apNew[i]->pgno;
        !          6306:     int minI = i;
        !          6307:     for(j=i+1; j<k; j++){
        !          6308:       if( apNew[j]->pgno<(unsigned)minV ){
        !          6309:         minI = j;
        !          6310:         minV = apNew[j]->pgno;
        !          6311:       }
        !          6312:     }
        !          6313:     if( minI>i ){
        !          6314:       MemPage *pT;
        !          6315:       pT = apNew[i];
        !          6316:       apNew[i] = apNew[minI];
        !          6317:       apNew[minI] = pT;
        !          6318:     }
        !          6319:   }
        !          6320:   TRACE(("new: %d(%d) %d(%d) %d(%d) %d(%d) %d(%d)\n",
        !          6321:     apNew[0]->pgno, szNew[0],
        !          6322:     nNew>=2 ? apNew[1]->pgno : 0, nNew>=2 ? szNew[1] : 0,
        !          6323:     nNew>=3 ? apNew[2]->pgno : 0, nNew>=3 ? szNew[2] : 0,
        !          6324:     nNew>=4 ? apNew[3]->pgno : 0, nNew>=4 ? szNew[3] : 0,
        !          6325:     nNew>=5 ? apNew[4]->pgno : 0, nNew>=5 ? szNew[4] : 0));
        !          6326: 
        !          6327:   assert( sqlite3PagerIswriteable(pParent->pDbPage) );
        !          6328:   put4byte(pRight, apNew[nNew-1]->pgno);
        !          6329: 
        !          6330:   /*
        !          6331:   ** Evenly distribute the data in apCell[] across the new pages.
        !          6332:   ** Insert divider cells into pParent as necessary.
        !          6333:   */
        !          6334:   j = 0;
        !          6335:   for(i=0; i<nNew; i++){
        !          6336:     /* Assemble the new sibling page. */
        !          6337:     MemPage *pNew = apNew[i];
        !          6338:     assert( j<nMaxCells );
        !          6339:     zeroPage(pNew, pageFlags);
        !          6340:     assemblePage(pNew, cntNew[i]-j, &apCell[j], &szCell[j]);
        !          6341:     assert( pNew->nCell>0 || (nNew==1 && cntNew[0]==0) );
        !          6342:     assert( pNew->nOverflow==0 );
        !          6343: 
        !          6344:     j = cntNew[i];
        !          6345: 
        !          6346:     /* If the sibling page assembled above was not the right-most sibling,
        !          6347:     ** insert a divider cell into the parent page.
        !          6348:     */
        !          6349:     assert( i<nNew-1 || j==nCell );
        !          6350:     if( j<nCell ){
        !          6351:       u8 *pCell;
        !          6352:       u8 *pTemp;
        !          6353:       int sz;
        !          6354: 
        !          6355:       assert( j<nMaxCells );
        !          6356:       pCell = apCell[j];
        !          6357:       sz = szCell[j] + leafCorrection;
        !          6358:       pTemp = &aOvflSpace[iOvflSpace];
        !          6359:       if( !pNew->leaf ){
        !          6360:         memcpy(&pNew->aData[8], pCell, 4);
        !          6361:       }else if( leafData ){
        !          6362:         /* If the tree is a leaf-data tree, and the siblings are leaves, 
        !          6363:         ** then there is no divider cell in apCell[]. Instead, the divider 
        !          6364:         ** cell consists of the integer key for the right-most cell of 
        !          6365:         ** the sibling-page assembled above only.
        !          6366:         */
        !          6367:         CellInfo info;
        !          6368:         j--;
        !          6369:         btreeParseCellPtr(pNew, apCell[j], &info);
        !          6370:         pCell = pTemp;
        !          6371:         sz = 4 + putVarint(&pCell[4], info.nKey);
        !          6372:         pTemp = 0;
        !          6373:       }else{
        !          6374:         pCell -= 4;
        !          6375:         /* Obscure case for non-leaf-data trees: If the cell at pCell was
        !          6376:         ** previously stored on a leaf node, and its reported size was 4
        !          6377:         ** bytes, then it may actually be smaller than this 
        !          6378:         ** (see btreeParseCellPtr(), 4 bytes is the minimum size of
        !          6379:         ** any cell). But it is important to pass the correct size to 
        !          6380:         ** insertCell(), so reparse the cell now.
        !          6381:         **
        !          6382:         ** Note that this can never happen in an SQLite data file, as all
        !          6383:         ** cells are at least 4 bytes. It only happens in b-trees used
        !          6384:         ** to evaluate "IN (SELECT ...)" and similar clauses.
        !          6385:         */
        !          6386:         if( szCell[j]==4 ){
        !          6387:           assert(leafCorrection==4);
        !          6388:           sz = cellSizePtr(pParent, pCell);
        !          6389:         }
        !          6390:       }
        !          6391:       iOvflSpace += sz;
        !          6392:       assert( sz<=pBt->maxLocal+23 );
        !          6393:       assert( iOvflSpace <= (int)pBt->pageSize );
        !          6394:       insertCell(pParent, nxDiv, pCell, sz, pTemp, pNew->pgno, &rc);
        !          6395:       if( rc!=SQLITE_OK ) goto balance_cleanup;
        !          6396:       assert( sqlite3PagerIswriteable(pParent->pDbPage) );
        !          6397: 
        !          6398:       j++;
        !          6399:       nxDiv++;
        !          6400:     }
        !          6401:   }
        !          6402:   assert( j==nCell );
        !          6403:   assert( nOld>0 );
        !          6404:   assert( nNew>0 );
        !          6405:   if( (pageFlags & PTF_LEAF)==0 ){
        !          6406:     u8 *zChild = &apCopy[nOld-1]->aData[8];
        !          6407:     memcpy(&apNew[nNew-1]->aData[8], zChild, 4);
        !          6408:   }
        !          6409: 
        !          6410:   if( isRoot && pParent->nCell==0 && pParent->hdrOffset<=apNew[0]->nFree ){
        !          6411:     /* The root page of the b-tree now contains no cells. The only sibling
        !          6412:     ** page is the right-child of the parent. Copy the contents of the
        !          6413:     ** child page into the parent, decreasing the overall height of the
        !          6414:     ** b-tree structure by one. This is described as the "balance-shallower"
        !          6415:     ** sub-algorithm in some documentation.
        !          6416:     **
        !          6417:     ** If this is an auto-vacuum database, the call to copyNodeContent() 
        !          6418:     ** sets all pointer-map entries corresponding to database image pages 
        !          6419:     ** for which the pointer is stored within the content being copied.
        !          6420:     **
        !          6421:     ** The second assert below verifies that the child page is defragmented
        !          6422:     ** (it must be, as it was just reconstructed using assemblePage()). This
        !          6423:     ** is important if the parent page happens to be page 1 of the database
        !          6424:     ** image.  */
        !          6425:     assert( nNew==1 );
        !          6426:     assert( apNew[0]->nFree == 
        !          6427:         (get2byte(&apNew[0]->aData[5])-apNew[0]->cellOffset-apNew[0]->nCell*2) 
        !          6428:     );
        !          6429:     copyNodeContent(apNew[0], pParent, &rc);
        !          6430:     freePage(apNew[0], &rc);
        !          6431:   }else if( ISAUTOVACUUM ){
        !          6432:     /* Fix the pointer-map entries for all the cells that were shifted around. 
        !          6433:     ** There are several different types of pointer-map entries that need to
        !          6434:     ** be dealt with by this routine. Some of these have been set already, but
        !          6435:     ** many have not. The following is a summary:
        !          6436:     **
        !          6437:     **   1) The entries associated with new sibling pages that were not
        !          6438:     **      siblings when this function was called. These have already
        !          6439:     **      been set. We don't need to worry about old siblings that were
        !          6440:     **      moved to the free-list - the freePage() code has taken care
        !          6441:     **      of those.
        !          6442:     **
        !          6443:     **   2) The pointer-map entries associated with the first overflow
        !          6444:     **      page in any overflow chains used by new divider cells. These 
        !          6445:     **      have also already been taken care of by the insertCell() code.
        !          6446:     **
        !          6447:     **   3) If the sibling pages are not leaves, then the child pages of
        !          6448:     **      cells stored on the sibling pages may need to be updated.
        !          6449:     **
        !          6450:     **   4) If the sibling pages are not internal intkey nodes, then any
        !          6451:     **      overflow pages used by these cells may need to be updated
        !          6452:     **      (internal intkey nodes never contain pointers to overflow pages).
        !          6453:     **
        !          6454:     **   5) If the sibling pages are not leaves, then the pointer-map
        !          6455:     **      entries for the right-child pages of each sibling may need
        !          6456:     **      to be updated.
        !          6457:     **
        !          6458:     ** Cases 1 and 2 are dealt with above by other code. The next
        !          6459:     ** block deals with cases 3 and 4 and the one after that, case 5. Since
        !          6460:     ** setting a pointer map entry is a relatively expensive operation, this
        !          6461:     ** code only sets pointer map entries for child or overflow pages that have
        !          6462:     ** actually moved between pages.  */
        !          6463:     MemPage *pNew = apNew[0];
        !          6464:     MemPage *pOld = apCopy[0];
        !          6465:     int nOverflow = pOld->nOverflow;
        !          6466:     int iNextOld = pOld->nCell + nOverflow;
        !          6467:     int iOverflow = (nOverflow ? pOld->aOvfl[0].idx : -1);
        !          6468:     j = 0;                             /* Current 'old' sibling page */
        !          6469:     k = 0;                             /* Current 'new' sibling page */
        !          6470:     for(i=0; i<nCell; i++){
        !          6471:       int isDivider = 0;
        !          6472:       while( i==iNextOld ){
        !          6473:         /* Cell i is the cell immediately following the last cell on old
        !          6474:         ** sibling page j. If the siblings are not leaf pages of an
        !          6475:         ** intkey b-tree, then cell i was a divider cell. */
        !          6476:         assert( j+1 < ArraySize(apCopy) );
        !          6477:         pOld = apCopy[++j];
        !          6478:         iNextOld = i + !leafData + pOld->nCell + pOld->nOverflow;
        !          6479:         if( pOld->nOverflow ){
        !          6480:           nOverflow = pOld->nOverflow;
        !          6481:           iOverflow = i + !leafData + pOld->aOvfl[0].idx;
        !          6482:         }
        !          6483:         isDivider = !leafData;  
        !          6484:       }
        !          6485: 
        !          6486:       assert(nOverflow>0 || iOverflow<i );
        !          6487:       assert(nOverflow<2 || pOld->aOvfl[0].idx==pOld->aOvfl[1].idx-1);
        !          6488:       assert(nOverflow<3 || pOld->aOvfl[1].idx==pOld->aOvfl[2].idx-1);
        !          6489:       if( i==iOverflow ){
        !          6490:         isDivider = 1;
        !          6491:         if( (--nOverflow)>0 ){
        !          6492:           iOverflow++;
        !          6493:         }
        !          6494:       }
        !          6495: 
        !          6496:       if( i==cntNew[k] ){
        !          6497:         /* Cell i is the cell immediately following the last cell on new
        !          6498:         ** sibling page k. If the siblings are not leaf pages of an
        !          6499:         ** intkey b-tree, then cell i is a divider cell.  */
        !          6500:         pNew = apNew[++k];
        !          6501:         if( !leafData ) continue;
        !          6502:       }
        !          6503:       assert( j<nOld );
        !          6504:       assert( k<nNew );
        !          6505: 
        !          6506:       /* If the cell was originally divider cell (and is not now) or
        !          6507:       ** an overflow cell, or if the cell was located on a different sibling
        !          6508:       ** page before the balancing, then the pointer map entries associated
        !          6509:       ** with any child or overflow pages need to be updated.  */
        !          6510:       if( isDivider || pOld->pgno!=pNew->pgno ){
        !          6511:         if( !leafCorrection ){
        !          6512:           ptrmapPut(pBt, get4byte(apCell[i]), PTRMAP_BTREE, pNew->pgno, &rc);
        !          6513:         }
        !          6514:         if( szCell[i]>pNew->minLocal ){
        !          6515:           ptrmapPutOvflPtr(pNew, apCell[i], &rc);
        !          6516:         }
        !          6517:       }
        !          6518:     }
        !          6519: 
        !          6520:     if( !leafCorrection ){
        !          6521:       for(i=0; i<nNew; i++){
        !          6522:         u32 key = get4byte(&apNew[i]->aData[8]);
        !          6523:         ptrmapPut(pBt, key, PTRMAP_BTREE, apNew[i]->pgno, &rc);
        !          6524:       }
        !          6525:     }
        !          6526: 
        !          6527: #if 0
        !          6528:     /* The ptrmapCheckPages() contains assert() statements that verify that
        !          6529:     ** all pointer map pages are set correctly. This is helpful while 
        !          6530:     ** debugging. This is usually disabled because a corrupt database may
        !          6531:     ** cause an assert() statement to fail.  */
        !          6532:     ptrmapCheckPages(apNew, nNew);
        !          6533:     ptrmapCheckPages(&pParent, 1);
        !          6534: #endif
        !          6535:   }
        !          6536: 
        !          6537:   assert( pParent->isInit );
        !          6538:   TRACE(("BALANCE: finished: old=%d new=%d cells=%d\n",
        !          6539:           nOld, nNew, nCell));
        !          6540: 
        !          6541:   /*
        !          6542:   ** Cleanup before returning.
        !          6543:   */
        !          6544: balance_cleanup:
        !          6545:   sqlite3ScratchFree(apCell);
        !          6546:   for(i=0; i<nOld; i++){
        !          6547:     releasePage(apOld[i]);
        !          6548:   }
        !          6549:   for(i=0; i<nNew; i++){
        !          6550:     releasePage(apNew[i]);
        !          6551:   }
        !          6552: 
        !          6553:   return rc;
        !          6554: }
        !          6555: 
        !          6556: 
        !          6557: /*
        !          6558: ** This function is called when the root page of a b-tree structure is
        !          6559: ** overfull (has one or more overflow pages).
        !          6560: **
        !          6561: ** A new child page is allocated and the contents of the current root
        !          6562: ** page, including overflow cells, are copied into the child. The root
        !          6563: ** page is then overwritten to make it an empty page with the right-child 
        !          6564: ** pointer pointing to the new page.
        !          6565: **
        !          6566: ** Before returning, all pointer-map entries corresponding to pages 
        !          6567: ** that the new child-page now contains pointers to are updated. The
        !          6568: ** entry corresponding to the new right-child pointer of the root
        !          6569: ** page is also updated.
        !          6570: **
        !          6571: ** If successful, *ppChild is set to contain a reference to the child 
        !          6572: ** page and SQLITE_OK is returned. In this case the caller is required
        !          6573: ** to call releasePage() on *ppChild exactly once. If an error occurs,
        !          6574: ** an error code is returned and *ppChild is set to 0.
        !          6575: */
        !          6576: static int balance_deeper(MemPage *pRoot, MemPage **ppChild){
        !          6577:   int rc;                        /* Return value from subprocedures */
        !          6578:   MemPage *pChild = 0;           /* Pointer to a new child page */
        !          6579:   Pgno pgnoChild = 0;            /* Page number of the new child page */
        !          6580:   BtShared *pBt = pRoot->pBt;    /* The BTree */
        !          6581: 
        !          6582:   assert( pRoot->nOverflow>0 );
        !          6583:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          6584: 
        !          6585:   /* Make pRoot, the root page of the b-tree, writable. Allocate a new 
        !          6586:   ** page that will become the new right-child of pPage. Copy the contents
        !          6587:   ** of the node stored on pRoot into the new child page.
        !          6588:   */
        !          6589:   rc = sqlite3PagerWrite(pRoot->pDbPage);
        !          6590:   if( rc==SQLITE_OK ){
        !          6591:     rc = allocateBtreePage(pBt,&pChild,&pgnoChild,pRoot->pgno,0);
        !          6592:     copyNodeContent(pRoot, pChild, &rc);
        !          6593:     if( ISAUTOVACUUM ){
        !          6594:       ptrmapPut(pBt, pgnoChild, PTRMAP_BTREE, pRoot->pgno, &rc);
        !          6595:     }
        !          6596:   }
        !          6597:   if( rc ){
        !          6598:     *ppChild = 0;
        !          6599:     releasePage(pChild);
        !          6600:     return rc;
        !          6601:   }
        !          6602:   assert( sqlite3PagerIswriteable(pChild->pDbPage) );
        !          6603:   assert( sqlite3PagerIswriteable(pRoot->pDbPage) );
        !          6604:   assert( pChild->nCell==pRoot->nCell );
        !          6605: 
        !          6606:   TRACE(("BALANCE: copy root %d into %d\n", pRoot->pgno, pChild->pgno));
        !          6607: 
        !          6608:   /* Copy the overflow cells from pRoot to pChild */
        !          6609:   memcpy(pChild->aOvfl, pRoot->aOvfl, pRoot->nOverflow*sizeof(pRoot->aOvfl[0]));
        !          6610:   pChild->nOverflow = pRoot->nOverflow;
        !          6611: 
        !          6612:   /* Zero the contents of pRoot. Then install pChild as the right-child. */
        !          6613:   zeroPage(pRoot, pChild->aData[0] & ~PTF_LEAF);
        !          6614:   put4byte(&pRoot->aData[pRoot->hdrOffset+8], pgnoChild);
        !          6615: 
        !          6616:   *ppChild = pChild;
        !          6617:   return SQLITE_OK;
        !          6618: }
        !          6619: 
        !          6620: /*
        !          6621: ** The page that pCur currently points to has just been modified in
        !          6622: ** some way. This function figures out if this modification means the
        !          6623: ** tree needs to be balanced, and if so calls the appropriate balancing 
        !          6624: ** routine. Balancing routines are:
        !          6625: **
        !          6626: **   balance_quick()
        !          6627: **   balance_deeper()
        !          6628: **   balance_nonroot()
        !          6629: */
        !          6630: static int balance(BtCursor *pCur){
        !          6631:   int rc = SQLITE_OK;
        !          6632:   const int nMin = pCur->pBt->usableSize * 2 / 3;
        !          6633:   u8 aBalanceQuickSpace[13];
        !          6634:   u8 *pFree = 0;
        !          6635: 
        !          6636:   TESTONLY( int balance_quick_called = 0 );
        !          6637:   TESTONLY( int balance_deeper_called = 0 );
        !          6638: 
        !          6639:   do {
        !          6640:     int iPage = pCur->iPage;
        !          6641:     MemPage *pPage = pCur->apPage[iPage];
        !          6642: 
        !          6643:     if( iPage==0 ){
        !          6644:       if( pPage->nOverflow ){
        !          6645:         /* The root page of the b-tree is overfull. In this case call the
        !          6646:         ** balance_deeper() function to create a new child for the root-page
        !          6647:         ** and copy the current contents of the root-page to it. The
        !          6648:         ** next iteration of the do-loop will balance the child page.
        !          6649:         */ 
        !          6650:         assert( (balance_deeper_called++)==0 );
        !          6651:         rc = balance_deeper(pPage, &pCur->apPage[1]);
        !          6652:         if( rc==SQLITE_OK ){
        !          6653:           pCur->iPage = 1;
        !          6654:           pCur->aiIdx[0] = 0;
        !          6655:           pCur->aiIdx[1] = 0;
        !          6656:           assert( pCur->apPage[1]->nOverflow );
        !          6657:         }
        !          6658:       }else{
        !          6659:         break;
        !          6660:       }
        !          6661:     }else if( pPage->nOverflow==0 && pPage->nFree<=nMin ){
        !          6662:       break;
        !          6663:     }else{
        !          6664:       MemPage * const pParent = pCur->apPage[iPage-1];
        !          6665:       int const iIdx = pCur->aiIdx[iPage-1];
        !          6666: 
        !          6667:       rc = sqlite3PagerWrite(pParent->pDbPage);
        !          6668:       if( rc==SQLITE_OK ){
        !          6669: #ifndef SQLITE_OMIT_QUICKBALANCE
        !          6670:         if( pPage->hasData
        !          6671:          && pPage->nOverflow==1
        !          6672:          && pPage->aOvfl[0].idx==pPage->nCell
        !          6673:          && pParent->pgno!=1
        !          6674:          && pParent->nCell==iIdx
        !          6675:         ){
        !          6676:           /* Call balance_quick() to create a new sibling of pPage on which
        !          6677:           ** to store the overflow cell. balance_quick() inserts a new cell
        !          6678:           ** into pParent, which may cause pParent overflow. If this
        !          6679:           ** happens, the next interation of the do-loop will balance pParent 
        !          6680:           ** use either balance_nonroot() or balance_deeper(). Until this
        !          6681:           ** happens, the overflow cell is stored in the aBalanceQuickSpace[]
        !          6682:           ** buffer. 
        !          6683:           **
        !          6684:           ** The purpose of the following assert() is to check that only a
        !          6685:           ** single call to balance_quick() is made for each call to this
        !          6686:           ** function. If this were not verified, a subtle bug involving reuse
        !          6687:           ** of the aBalanceQuickSpace[] might sneak in.
        !          6688:           */
        !          6689:           assert( (balance_quick_called++)==0 );
        !          6690:           rc = balance_quick(pParent, pPage, aBalanceQuickSpace);
        !          6691:         }else
        !          6692: #endif
        !          6693:         {
        !          6694:           /* In this case, call balance_nonroot() to redistribute cells
        !          6695:           ** between pPage and up to 2 of its sibling pages. This involves
        !          6696:           ** modifying the contents of pParent, which may cause pParent to
        !          6697:           ** become overfull or underfull. The next iteration of the do-loop
        !          6698:           ** will balance the parent page to correct this.
        !          6699:           ** 
        !          6700:           ** If the parent page becomes overfull, the overflow cell or cells
        !          6701:           ** are stored in the pSpace buffer allocated immediately below. 
        !          6702:           ** A subsequent iteration of the do-loop will deal with this by
        !          6703:           ** calling balance_nonroot() (balance_deeper() may be called first,
        !          6704:           ** but it doesn't deal with overflow cells - just moves them to a
        !          6705:           ** different page). Once this subsequent call to balance_nonroot() 
        !          6706:           ** has completed, it is safe to release the pSpace buffer used by
        !          6707:           ** the previous call, as the overflow cell data will have been 
        !          6708:           ** copied either into the body of a database page or into the new
        !          6709:           ** pSpace buffer passed to the latter call to balance_nonroot().
        !          6710:           */
        !          6711:           u8 *pSpace = sqlite3PageMalloc(pCur->pBt->pageSize);
        !          6712:           rc = balance_nonroot(pParent, iIdx, pSpace, iPage==1);
        !          6713:           if( pFree ){
        !          6714:             /* If pFree is not NULL, it points to the pSpace buffer used 
        !          6715:             ** by a previous call to balance_nonroot(). Its contents are
        !          6716:             ** now stored either on real database pages or within the 
        !          6717:             ** new pSpace buffer, so it may be safely freed here. */
        !          6718:             sqlite3PageFree(pFree);
        !          6719:           }
        !          6720: 
        !          6721:           /* The pSpace buffer will be freed after the next call to
        !          6722:           ** balance_nonroot(), or just before this function returns, whichever
        !          6723:           ** comes first. */
        !          6724:           pFree = pSpace;
        !          6725:         }
        !          6726:       }
        !          6727: 
        !          6728:       pPage->nOverflow = 0;
        !          6729: 
        !          6730:       /* The next iteration of the do-loop balances the parent page. */
        !          6731:       releasePage(pPage);
        !          6732:       pCur->iPage--;
        !          6733:     }
        !          6734:   }while( rc==SQLITE_OK );
        !          6735: 
        !          6736:   if( pFree ){
        !          6737:     sqlite3PageFree(pFree);
        !          6738:   }
        !          6739:   return rc;
        !          6740: }
        !          6741: 
        !          6742: 
        !          6743: /*
        !          6744: ** Insert a new record into the BTree.  The key is given by (pKey,nKey)
        !          6745: ** and the data is given by (pData,nData).  The cursor is used only to
        !          6746: ** define what table the record should be inserted into.  The cursor
        !          6747: ** is left pointing at a random location.
        !          6748: **
        !          6749: ** For an INTKEY table, only the nKey value of the key is used.  pKey is
        !          6750: ** ignored.  For a ZERODATA table, the pData and nData are both ignored.
        !          6751: **
        !          6752: ** If the seekResult parameter is non-zero, then a successful call to
        !          6753: ** MovetoUnpacked() to seek cursor pCur to (pKey, nKey) has already
        !          6754: ** been performed. seekResult is the search result returned (a negative
        !          6755: ** number if pCur points at an entry that is smaller than (pKey, nKey), or
        !          6756: ** a positive value if pCur points at an etry that is larger than 
        !          6757: ** (pKey, nKey)). 
        !          6758: **
        !          6759: ** If the seekResult parameter is non-zero, then the caller guarantees that
        !          6760: ** cursor pCur is pointing at the existing copy of a row that is to be
        !          6761: ** overwritten.  If the seekResult parameter is 0, then cursor pCur may
        !          6762: ** point to any entry or to no entry at all and so this function has to seek
        !          6763: ** the cursor before the new key can be inserted.
        !          6764: */
        !          6765: int sqlite3BtreeInsert(
        !          6766:   BtCursor *pCur,                /* Insert data into the table of this cursor */
        !          6767:   const void *pKey, i64 nKey,    /* The key of the new record */
        !          6768:   const void *pData, int nData,  /* The data of the new record */
        !          6769:   int nZero,                     /* Number of extra 0 bytes to append to data */
        !          6770:   int appendBias,                /* True if this is likely an append */
        !          6771:   int seekResult                 /* Result of prior MovetoUnpacked() call */
        !          6772: ){
        !          6773:   int rc;
        !          6774:   int loc = seekResult;          /* -1: before desired location  +1: after */
        !          6775:   int szNew = 0;
        !          6776:   int idx;
        !          6777:   MemPage *pPage;
        !          6778:   Btree *p = pCur->pBtree;
        !          6779:   BtShared *pBt = p->pBt;
        !          6780:   unsigned char *oldCell;
        !          6781:   unsigned char *newCell = 0;
        !          6782: 
        !          6783:   if( pCur->eState==CURSOR_FAULT ){
        !          6784:     assert( pCur->skipNext!=SQLITE_OK );
        !          6785:     return pCur->skipNext;
        !          6786:   }
        !          6787: 
        !          6788:   assert( cursorHoldsMutex(pCur) );
        !          6789:   assert( pCur->wrFlag && pBt->inTransaction==TRANS_WRITE
        !          6790:               && (pBt->btsFlags & BTS_READ_ONLY)==0 );
        !          6791:   assert( hasSharedCacheTableLock(p, pCur->pgnoRoot, pCur->pKeyInfo!=0, 2) );
        !          6792: 
        !          6793:   /* Assert that the caller has been consistent. If this cursor was opened
        !          6794:   ** expecting an index b-tree, then the caller should be inserting blob
        !          6795:   ** keys with no associated data. If the cursor was opened expecting an
        !          6796:   ** intkey table, the caller should be inserting integer keys with a
        !          6797:   ** blob of associated data.  */
        !          6798:   assert( (pKey==0)==(pCur->pKeyInfo==0) );
        !          6799: 
        !          6800:   /* If this is an insert into a table b-tree, invalidate any incrblob 
        !          6801:   ** cursors open on the row being replaced (assuming this is a replace
        !          6802:   ** operation - if it is not, the following is a no-op).  */
        !          6803:   if( pCur->pKeyInfo==0 ){
        !          6804:     invalidateIncrblobCursors(p, nKey, 0);
        !          6805:   }
        !          6806: 
        !          6807:   /* Save the positions of any other cursors open on this table.
        !          6808:   **
        !          6809:   ** In some cases, the call to btreeMoveto() below is a no-op. For
        !          6810:   ** example, when inserting data into a table with auto-generated integer
        !          6811:   ** keys, the VDBE layer invokes sqlite3BtreeLast() to figure out the 
        !          6812:   ** integer key to use. It then calls this function to actually insert the 
        !          6813:   ** data into the intkey B-Tree. In this case btreeMoveto() recognizes
        !          6814:   ** that the cursor is already where it needs to be and returns without
        !          6815:   ** doing any work. To avoid thwarting these optimizations, it is important
        !          6816:   ** not to clear the cursor here.
        !          6817:   */
        !          6818:   rc = saveAllCursors(pBt, pCur->pgnoRoot, pCur);
        !          6819:   if( rc ) return rc;
        !          6820:   if( !loc ){
        !          6821:     rc = btreeMoveto(pCur, pKey, nKey, appendBias, &loc);
        !          6822:     if( rc ) return rc;
        !          6823:   }
        !          6824:   assert( pCur->eState==CURSOR_VALID || (pCur->eState==CURSOR_INVALID && loc) );
        !          6825: 
        !          6826:   pPage = pCur->apPage[pCur->iPage];
        !          6827:   assert( pPage->intKey || nKey>=0 );
        !          6828:   assert( pPage->leaf || !pPage->intKey );
        !          6829: 
        !          6830:   TRACE(("INSERT: table=%d nkey=%lld ndata=%d page=%d %s\n",
        !          6831:           pCur->pgnoRoot, nKey, nData, pPage->pgno,
        !          6832:           loc==0 ? "overwrite" : "new entry"));
        !          6833:   assert( pPage->isInit );
        !          6834:   allocateTempSpace(pBt);
        !          6835:   newCell = pBt->pTmpSpace;
        !          6836:   if( newCell==0 ) return SQLITE_NOMEM;
        !          6837:   rc = fillInCell(pPage, newCell, pKey, nKey, pData, nData, nZero, &szNew);
        !          6838:   if( rc ) goto end_insert;
        !          6839:   assert( szNew==cellSizePtr(pPage, newCell) );
        !          6840:   assert( szNew <= MX_CELL_SIZE(pBt) );
        !          6841:   idx = pCur->aiIdx[pCur->iPage];
        !          6842:   if( loc==0 ){
        !          6843:     u16 szOld;
        !          6844:     assert( idx<pPage->nCell );
        !          6845:     rc = sqlite3PagerWrite(pPage->pDbPage);
        !          6846:     if( rc ){
        !          6847:       goto end_insert;
        !          6848:     }
        !          6849:     oldCell = findCell(pPage, idx);
        !          6850:     if( !pPage->leaf ){
        !          6851:       memcpy(newCell, oldCell, 4);
        !          6852:     }
        !          6853:     szOld = cellSizePtr(pPage, oldCell);
        !          6854:     rc = clearCell(pPage, oldCell);
        !          6855:     dropCell(pPage, idx, szOld, &rc);
        !          6856:     if( rc ) goto end_insert;
        !          6857:   }else if( loc<0 && pPage->nCell>0 ){
        !          6858:     assert( pPage->leaf );
        !          6859:     idx = ++pCur->aiIdx[pCur->iPage];
        !          6860:   }else{
        !          6861:     assert( pPage->leaf );
        !          6862:   }
        !          6863:   insertCell(pPage, idx, newCell, szNew, 0, 0, &rc);
        !          6864:   assert( rc!=SQLITE_OK || pPage->nCell>0 || pPage->nOverflow>0 );
        !          6865: 
        !          6866:   /* If no error has occured and pPage has an overflow cell, call balance() 
        !          6867:   ** to redistribute the cells within the tree. Since balance() may move
        !          6868:   ** the cursor, zero the BtCursor.info.nSize and BtCursor.validNKey
        !          6869:   ** variables.
        !          6870:   **
        !          6871:   ** Previous versions of SQLite called moveToRoot() to move the cursor
        !          6872:   ** back to the root page as balance() used to invalidate the contents
        !          6873:   ** of BtCursor.apPage[] and BtCursor.aiIdx[]. Instead of doing that,
        !          6874:   ** set the cursor state to "invalid". This makes common insert operations
        !          6875:   ** slightly faster.
        !          6876:   **
        !          6877:   ** There is a subtle but important optimization here too. When inserting
        !          6878:   ** multiple records into an intkey b-tree using a single cursor (as can
        !          6879:   ** happen while processing an "INSERT INTO ... SELECT" statement), it
        !          6880:   ** is advantageous to leave the cursor pointing to the last entry in
        !          6881:   ** the b-tree if possible. If the cursor is left pointing to the last
        !          6882:   ** entry in the table, and the next row inserted has an integer key
        !          6883:   ** larger than the largest existing key, it is possible to insert the
        !          6884:   ** row without seeking the cursor. This can be a big performance boost.
        !          6885:   */
        !          6886:   pCur->info.nSize = 0;
        !          6887:   pCur->validNKey = 0;
        !          6888:   if( rc==SQLITE_OK && pPage->nOverflow ){
        !          6889:     rc = balance(pCur);
        !          6890: 
        !          6891:     /* Must make sure nOverflow is reset to zero even if the balance()
        !          6892:     ** fails. Internal data structure corruption will result otherwise. 
        !          6893:     ** Also, set the cursor state to invalid. This stops saveCursorPosition()
        !          6894:     ** from trying to save the current position of the cursor.  */
        !          6895:     pCur->apPage[pCur->iPage]->nOverflow = 0;
        !          6896:     pCur->eState = CURSOR_INVALID;
        !          6897:   }
        !          6898:   assert( pCur->apPage[pCur->iPage]->nOverflow==0 );
        !          6899: 
        !          6900: end_insert:
        !          6901:   return rc;
        !          6902: }
        !          6903: 
        !          6904: /*
        !          6905: ** Delete the entry that the cursor is pointing to.  The cursor
        !          6906: ** is left pointing at a arbitrary location.
        !          6907: */
        !          6908: int sqlite3BtreeDelete(BtCursor *pCur){
        !          6909:   Btree *p = pCur->pBtree;
        !          6910:   BtShared *pBt = p->pBt;              
        !          6911:   int rc;                              /* Return code */
        !          6912:   MemPage *pPage;                      /* Page to delete cell from */
        !          6913:   unsigned char *pCell;                /* Pointer to cell to delete */
        !          6914:   int iCellIdx;                        /* Index of cell to delete */
        !          6915:   int iCellDepth;                      /* Depth of node containing pCell */ 
        !          6916: 
        !          6917:   assert( cursorHoldsMutex(pCur) );
        !          6918:   assert( pBt->inTransaction==TRANS_WRITE );
        !          6919:   assert( (pBt->btsFlags & BTS_READ_ONLY)==0 );
        !          6920:   assert( pCur->wrFlag );
        !          6921:   assert( hasSharedCacheTableLock(p, pCur->pgnoRoot, pCur->pKeyInfo!=0, 2) );
        !          6922:   assert( !hasReadConflicts(p, pCur->pgnoRoot) );
        !          6923: 
        !          6924:   if( NEVER(pCur->aiIdx[pCur->iPage]>=pCur->apPage[pCur->iPage]->nCell) 
        !          6925:    || NEVER(pCur->eState!=CURSOR_VALID)
        !          6926:   ){
        !          6927:     return SQLITE_ERROR;  /* Something has gone awry. */
        !          6928:   }
        !          6929: 
        !          6930:   /* If this is a delete operation to remove a row from a table b-tree,
        !          6931:   ** invalidate any incrblob cursors open on the row being deleted.  */
        !          6932:   if( pCur->pKeyInfo==0 ){
        !          6933:     invalidateIncrblobCursors(p, pCur->info.nKey, 0);
        !          6934:   }
        !          6935: 
        !          6936:   iCellDepth = pCur->iPage;
        !          6937:   iCellIdx = pCur->aiIdx[iCellDepth];
        !          6938:   pPage = pCur->apPage[iCellDepth];
        !          6939:   pCell = findCell(pPage, iCellIdx);
        !          6940: 
        !          6941:   /* If the page containing the entry to delete is not a leaf page, move
        !          6942:   ** the cursor to the largest entry in the tree that is smaller than
        !          6943:   ** the entry being deleted. This cell will replace the cell being deleted
        !          6944:   ** from the internal node. The 'previous' entry is used for this instead
        !          6945:   ** of the 'next' entry, as the previous entry is always a part of the
        !          6946:   ** sub-tree headed by the child page of the cell being deleted. This makes
        !          6947:   ** balancing the tree following the delete operation easier.  */
        !          6948:   if( !pPage->leaf ){
        !          6949:     int notUsed;
        !          6950:     rc = sqlite3BtreePrevious(pCur, &notUsed);
        !          6951:     if( rc ) return rc;
        !          6952:   }
        !          6953: 
        !          6954:   /* Save the positions of any other cursors open on this table before
        !          6955:   ** making any modifications. Make the page containing the entry to be 
        !          6956:   ** deleted writable. Then free any overflow pages associated with the 
        !          6957:   ** entry and finally remove the cell itself from within the page.  
        !          6958:   */
        !          6959:   rc = saveAllCursors(pBt, pCur->pgnoRoot, pCur);
        !          6960:   if( rc ) return rc;
        !          6961:   rc = sqlite3PagerWrite(pPage->pDbPage);
        !          6962:   if( rc ) return rc;
        !          6963:   rc = clearCell(pPage, pCell);
        !          6964:   dropCell(pPage, iCellIdx, cellSizePtr(pPage, pCell), &rc);
        !          6965:   if( rc ) return rc;
        !          6966: 
        !          6967:   /* If the cell deleted was not located on a leaf page, then the cursor
        !          6968:   ** is currently pointing to the largest entry in the sub-tree headed
        !          6969:   ** by the child-page of the cell that was just deleted from an internal
        !          6970:   ** node. The cell from the leaf node needs to be moved to the internal
        !          6971:   ** node to replace the deleted cell.  */
        !          6972:   if( !pPage->leaf ){
        !          6973:     MemPage *pLeaf = pCur->apPage[pCur->iPage];
        !          6974:     int nCell;
        !          6975:     Pgno n = pCur->apPage[iCellDepth+1]->pgno;
        !          6976:     unsigned char *pTmp;
        !          6977: 
        !          6978:     pCell = findCell(pLeaf, pLeaf->nCell-1);
        !          6979:     nCell = cellSizePtr(pLeaf, pCell);
        !          6980:     assert( MX_CELL_SIZE(pBt) >= nCell );
        !          6981: 
        !          6982:     allocateTempSpace(pBt);
        !          6983:     pTmp = pBt->pTmpSpace;
        !          6984: 
        !          6985:     rc = sqlite3PagerWrite(pLeaf->pDbPage);
        !          6986:     insertCell(pPage, iCellIdx, pCell-4, nCell+4, pTmp, n, &rc);
        !          6987:     dropCell(pLeaf, pLeaf->nCell-1, nCell, &rc);
        !          6988:     if( rc ) return rc;
        !          6989:   }
        !          6990: 
        !          6991:   /* Balance the tree. If the entry deleted was located on a leaf page,
        !          6992:   ** then the cursor still points to that page. In this case the first
        !          6993:   ** call to balance() repairs the tree, and the if(...) condition is
        !          6994:   ** never true.
        !          6995:   **
        !          6996:   ** Otherwise, if the entry deleted was on an internal node page, then
        !          6997:   ** pCur is pointing to the leaf page from which a cell was removed to
        !          6998:   ** replace the cell deleted from the internal node. This is slightly
        !          6999:   ** tricky as the leaf node may be underfull, and the internal node may
        !          7000:   ** be either under or overfull. In this case run the balancing algorithm
        !          7001:   ** on the leaf node first. If the balance proceeds far enough up the
        !          7002:   ** tree that we can be sure that any problem in the internal node has
        !          7003:   ** been corrected, so be it. Otherwise, after balancing the leaf node,
        !          7004:   ** walk the cursor up the tree to the internal node and balance it as 
        !          7005:   ** well.  */
        !          7006:   rc = balance(pCur);
        !          7007:   if( rc==SQLITE_OK && pCur->iPage>iCellDepth ){
        !          7008:     while( pCur->iPage>iCellDepth ){
        !          7009:       releasePage(pCur->apPage[pCur->iPage--]);
        !          7010:     }
        !          7011:     rc = balance(pCur);
        !          7012:   }
        !          7013: 
        !          7014:   if( rc==SQLITE_OK ){
        !          7015:     moveToRoot(pCur);
        !          7016:   }
        !          7017:   return rc;
        !          7018: }
        !          7019: 
        !          7020: /*
        !          7021: ** Create a new BTree table.  Write into *piTable the page
        !          7022: ** number for the root page of the new table.
        !          7023: **
        !          7024: ** The type of type is determined by the flags parameter.  Only the
        !          7025: ** following values of flags are currently in use.  Other values for
        !          7026: ** flags might not work:
        !          7027: **
        !          7028: **     BTREE_INTKEY|BTREE_LEAFDATA     Used for SQL tables with rowid keys
        !          7029: **     BTREE_ZERODATA                  Used for SQL indices
        !          7030: */
        !          7031: static int btreeCreateTable(Btree *p, int *piTable, int createTabFlags){
        !          7032:   BtShared *pBt = p->pBt;
        !          7033:   MemPage *pRoot;
        !          7034:   Pgno pgnoRoot;
        !          7035:   int rc;
        !          7036:   int ptfFlags;          /* Page-type flage for the root page of new table */
        !          7037: 
        !          7038:   assert( sqlite3BtreeHoldsMutex(p) );
        !          7039:   assert( pBt->inTransaction==TRANS_WRITE );
        !          7040:   assert( (pBt->btsFlags & BTS_READ_ONLY)==0 );
        !          7041: 
        !          7042: #ifdef SQLITE_OMIT_AUTOVACUUM
        !          7043:   rc = allocateBtreePage(pBt, &pRoot, &pgnoRoot, 1, 0);
        !          7044:   if( rc ){
        !          7045:     return rc;
        !          7046:   }
        !          7047: #else
        !          7048:   if( pBt->autoVacuum ){
        !          7049:     Pgno pgnoMove;      /* Move a page here to make room for the root-page */
        !          7050:     MemPage *pPageMove; /* The page to move to. */
        !          7051: 
        !          7052:     /* Creating a new table may probably require moving an existing database
        !          7053:     ** to make room for the new tables root page. In case this page turns
        !          7054:     ** out to be an overflow page, delete all overflow page-map caches
        !          7055:     ** held by open cursors.
        !          7056:     */
        !          7057:     invalidateAllOverflowCache(pBt);
        !          7058: 
        !          7059:     /* Read the value of meta[3] from the database to determine where the
        !          7060:     ** root page of the new table should go. meta[3] is the largest root-page
        !          7061:     ** created so far, so the new root-page is (meta[3]+1).
        !          7062:     */
        !          7063:     sqlite3BtreeGetMeta(p, BTREE_LARGEST_ROOT_PAGE, &pgnoRoot);
        !          7064:     pgnoRoot++;
        !          7065: 
        !          7066:     /* The new root-page may not be allocated on a pointer-map page, or the
        !          7067:     ** PENDING_BYTE page.
        !          7068:     */
        !          7069:     while( pgnoRoot==PTRMAP_PAGENO(pBt, pgnoRoot) ||
        !          7070:         pgnoRoot==PENDING_BYTE_PAGE(pBt) ){
        !          7071:       pgnoRoot++;
        !          7072:     }
        !          7073:     assert( pgnoRoot>=3 );
        !          7074: 
        !          7075:     /* Allocate a page. The page that currently resides at pgnoRoot will
        !          7076:     ** be moved to the allocated page (unless the allocated page happens
        !          7077:     ** to reside at pgnoRoot).
        !          7078:     */
        !          7079:     rc = allocateBtreePage(pBt, &pPageMove, &pgnoMove, pgnoRoot, 1);
        !          7080:     if( rc!=SQLITE_OK ){
        !          7081:       return rc;
        !          7082:     }
        !          7083: 
        !          7084:     if( pgnoMove!=pgnoRoot ){
        !          7085:       /* pgnoRoot is the page that will be used for the root-page of
        !          7086:       ** the new table (assuming an error did not occur). But we were
        !          7087:       ** allocated pgnoMove. If required (i.e. if it was not allocated
        !          7088:       ** by extending the file), the current page at position pgnoMove
        !          7089:       ** is already journaled.
        !          7090:       */
        !          7091:       u8 eType = 0;
        !          7092:       Pgno iPtrPage = 0;
        !          7093: 
        !          7094:       releasePage(pPageMove);
        !          7095: 
        !          7096:       /* Move the page currently at pgnoRoot to pgnoMove. */
        !          7097:       rc = btreeGetPage(pBt, pgnoRoot, &pRoot, 0);
        !          7098:       if( rc!=SQLITE_OK ){
        !          7099:         return rc;
        !          7100:       }
        !          7101:       rc = ptrmapGet(pBt, pgnoRoot, &eType, &iPtrPage);
        !          7102:       if( eType==PTRMAP_ROOTPAGE || eType==PTRMAP_FREEPAGE ){
        !          7103:         rc = SQLITE_CORRUPT_BKPT;
        !          7104:       }
        !          7105:       if( rc!=SQLITE_OK ){
        !          7106:         releasePage(pRoot);
        !          7107:         return rc;
        !          7108:       }
        !          7109:       assert( eType!=PTRMAP_ROOTPAGE );
        !          7110:       assert( eType!=PTRMAP_FREEPAGE );
        !          7111:       rc = relocatePage(pBt, pRoot, eType, iPtrPage, pgnoMove, 0);
        !          7112:       releasePage(pRoot);
        !          7113: 
        !          7114:       /* Obtain the page at pgnoRoot */
        !          7115:       if( rc!=SQLITE_OK ){
        !          7116:         return rc;
        !          7117:       }
        !          7118:       rc = btreeGetPage(pBt, pgnoRoot, &pRoot, 0);
        !          7119:       if( rc!=SQLITE_OK ){
        !          7120:         return rc;
        !          7121:       }
        !          7122:       rc = sqlite3PagerWrite(pRoot->pDbPage);
        !          7123:       if( rc!=SQLITE_OK ){
        !          7124:         releasePage(pRoot);
        !          7125:         return rc;
        !          7126:       }
        !          7127:     }else{
        !          7128:       pRoot = pPageMove;
        !          7129:     } 
        !          7130: 
        !          7131:     /* Update the pointer-map and meta-data with the new root-page number. */
        !          7132:     ptrmapPut(pBt, pgnoRoot, PTRMAP_ROOTPAGE, 0, &rc);
        !          7133:     if( rc ){
        !          7134:       releasePage(pRoot);
        !          7135:       return rc;
        !          7136:     }
        !          7137: 
        !          7138:     /* When the new root page was allocated, page 1 was made writable in
        !          7139:     ** order either to increase the database filesize, or to decrement the
        !          7140:     ** freelist count.  Hence, the sqlite3BtreeUpdateMeta() call cannot fail.
        !          7141:     */
        !          7142:     assert( sqlite3PagerIswriteable(pBt->pPage1->pDbPage) );
        !          7143:     rc = sqlite3BtreeUpdateMeta(p, 4, pgnoRoot);
        !          7144:     if( NEVER(rc) ){
        !          7145:       releasePage(pRoot);
        !          7146:       return rc;
        !          7147:     }
        !          7148: 
        !          7149:   }else{
        !          7150:     rc = allocateBtreePage(pBt, &pRoot, &pgnoRoot, 1, 0);
        !          7151:     if( rc ) return rc;
        !          7152:   }
        !          7153: #endif
        !          7154:   assert( sqlite3PagerIswriteable(pRoot->pDbPage) );
        !          7155:   if( createTabFlags & BTREE_INTKEY ){
        !          7156:     ptfFlags = PTF_INTKEY | PTF_LEAFDATA | PTF_LEAF;
        !          7157:   }else{
        !          7158:     ptfFlags = PTF_ZERODATA | PTF_LEAF;
        !          7159:   }
        !          7160:   zeroPage(pRoot, ptfFlags);
        !          7161:   sqlite3PagerUnref(pRoot->pDbPage);
        !          7162:   assert( (pBt->openFlags & BTREE_SINGLE)==0 || pgnoRoot==2 );
        !          7163:   *piTable = (int)pgnoRoot;
        !          7164:   return SQLITE_OK;
        !          7165: }
        !          7166: int sqlite3BtreeCreateTable(Btree *p, int *piTable, int flags){
        !          7167:   int rc;
        !          7168:   sqlite3BtreeEnter(p);
        !          7169:   rc = btreeCreateTable(p, piTable, flags);
        !          7170:   sqlite3BtreeLeave(p);
        !          7171:   return rc;
        !          7172: }
        !          7173: 
        !          7174: /*
        !          7175: ** Erase the given database page and all its children.  Return
        !          7176: ** the page to the freelist.
        !          7177: */
        !          7178: static int clearDatabasePage(
        !          7179:   BtShared *pBt,           /* The BTree that contains the table */
        !          7180:   Pgno pgno,               /* Page number to clear */
        !          7181:   int freePageFlag,        /* Deallocate page if true */
        !          7182:   int *pnChange            /* Add number of Cells freed to this counter */
        !          7183: ){
        !          7184:   MemPage *pPage;
        !          7185:   int rc;
        !          7186:   unsigned char *pCell;
        !          7187:   int i;
        !          7188: 
        !          7189:   assert( sqlite3_mutex_held(pBt->mutex) );
        !          7190:   if( pgno>btreePagecount(pBt) ){
        !          7191:     return SQLITE_CORRUPT_BKPT;
        !          7192:   }
        !          7193: 
        !          7194:   rc = getAndInitPage(pBt, pgno, &pPage);
        !          7195:   if( rc ) return rc;
        !          7196:   for(i=0; i<pPage->nCell; i++){
        !          7197:     pCell = findCell(pPage, i);
        !          7198:     if( !pPage->leaf ){
        !          7199:       rc = clearDatabasePage(pBt, get4byte(pCell), 1, pnChange);
        !          7200:       if( rc ) goto cleardatabasepage_out;
        !          7201:     }
        !          7202:     rc = clearCell(pPage, pCell);
        !          7203:     if( rc ) goto cleardatabasepage_out;
        !          7204:   }
        !          7205:   if( !pPage->leaf ){
        !          7206:     rc = clearDatabasePage(pBt, get4byte(&pPage->aData[8]), 1, pnChange);
        !          7207:     if( rc ) goto cleardatabasepage_out;
        !          7208:   }else if( pnChange ){
        !          7209:     assert( pPage->intKey );
        !          7210:     *pnChange += pPage->nCell;
        !          7211:   }
        !          7212:   if( freePageFlag ){
        !          7213:     freePage(pPage, &rc);
        !          7214:   }else if( (rc = sqlite3PagerWrite(pPage->pDbPage))==0 ){
        !          7215:     zeroPage(pPage, pPage->aData[0] | PTF_LEAF);
        !          7216:   }
        !          7217: 
        !          7218: cleardatabasepage_out:
        !          7219:   releasePage(pPage);
        !          7220:   return rc;
        !          7221: }
        !          7222: 
        !          7223: /*
        !          7224: ** Delete all information from a single table in the database.  iTable is
        !          7225: ** the page number of the root of the table.  After this routine returns,
        !          7226: ** the root page is empty, but still exists.
        !          7227: **
        !          7228: ** This routine will fail with SQLITE_LOCKED if there are any open
        !          7229: ** read cursors on the table.  Open write cursors are moved to the
        !          7230: ** root of the table.
        !          7231: **
        !          7232: ** If pnChange is not NULL, then table iTable must be an intkey table. The
        !          7233: ** integer value pointed to by pnChange is incremented by the number of
        !          7234: ** entries in the table.
        !          7235: */
        !          7236: int sqlite3BtreeClearTable(Btree *p, int iTable, int *pnChange){
        !          7237:   int rc;
        !          7238:   BtShared *pBt = p->pBt;
        !          7239:   sqlite3BtreeEnter(p);
        !          7240:   assert( p->inTrans==TRANS_WRITE );
        !          7241: 
        !          7242:   /* Invalidate all incrblob cursors open on table iTable (assuming iTable
        !          7243:   ** is the root of a table b-tree - if it is not, the following call is
        !          7244:   ** a no-op).  */
        !          7245:   invalidateIncrblobCursors(p, 0, 1);
        !          7246: 
        !          7247:   rc = saveAllCursors(pBt, (Pgno)iTable, 0);
        !          7248:   if( SQLITE_OK==rc ){
        !          7249:     rc = clearDatabasePage(pBt, (Pgno)iTable, 0, pnChange);
        !          7250:   }
        !          7251:   sqlite3BtreeLeave(p);
        !          7252:   return rc;
        !          7253: }
        !          7254: 
        !          7255: /*
        !          7256: ** Erase all information in a table and add the root of the table to
        !          7257: ** the freelist.  Except, the root of the principle table (the one on
        !          7258: ** page 1) is never added to the freelist.
        !          7259: **
        !          7260: ** This routine will fail with SQLITE_LOCKED if there are any open
        !          7261: ** cursors on the table.
        !          7262: **
        !          7263: ** If AUTOVACUUM is enabled and the page at iTable is not the last
        !          7264: ** root page in the database file, then the last root page 
        !          7265: ** in the database file is moved into the slot formerly occupied by
        !          7266: ** iTable and that last slot formerly occupied by the last root page
        !          7267: ** is added to the freelist instead of iTable.  In this say, all
        !          7268: ** root pages are kept at the beginning of the database file, which
        !          7269: ** is necessary for AUTOVACUUM to work right.  *piMoved is set to the 
        !          7270: ** page number that used to be the last root page in the file before
        !          7271: ** the move.  If no page gets moved, *piMoved is set to 0.
        !          7272: ** The last root page is recorded in meta[3] and the value of
        !          7273: ** meta[3] is updated by this procedure.
        !          7274: */
        !          7275: static int btreeDropTable(Btree *p, Pgno iTable, int *piMoved){
        !          7276:   int rc;
        !          7277:   MemPage *pPage = 0;
        !          7278:   BtShared *pBt = p->pBt;
        !          7279: 
        !          7280:   assert( sqlite3BtreeHoldsMutex(p) );
        !          7281:   assert( p->inTrans==TRANS_WRITE );
        !          7282: 
        !          7283:   /* It is illegal to drop a table if any cursors are open on the
        !          7284:   ** database. This is because in auto-vacuum mode the backend may
        !          7285:   ** need to move another root-page to fill a gap left by the deleted
        !          7286:   ** root page. If an open cursor was using this page a problem would 
        !          7287:   ** occur.
        !          7288:   **
        !          7289:   ** This error is caught long before control reaches this point.
        !          7290:   */
        !          7291:   if( NEVER(pBt->pCursor) ){
        !          7292:     sqlite3ConnectionBlocked(p->db, pBt->pCursor->pBtree->db);
        !          7293:     return SQLITE_LOCKED_SHAREDCACHE;
        !          7294:   }
        !          7295: 
        !          7296:   rc = btreeGetPage(pBt, (Pgno)iTable, &pPage, 0);
        !          7297:   if( rc ) return rc;
        !          7298:   rc = sqlite3BtreeClearTable(p, iTable, 0);
        !          7299:   if( rc ){
        !          7300:     releasePage(pPage);
        !          7301:     return rc;
        !          7302:   }
        !          7303: 
        !          7304:   *piMoved = 0;
        !          7305: 
        !          7306:   if( iTable>1 ){
        !          7307: #ifdef SQLITE_OMIT_AUTOVACUUM
        !          7308:     freePage(pPage, &rc);
        !          7309:     releasePage(pPage);
        !          7310: #else
        !          7311:     if( pBt->autoVacuum ){
        !          7312:       Pgno maxRootPgno;
        !          7313:       sqlite3BtreeGetMeta(p, BTREE_LARGEST_ROOT_PAGE, &maxRootPgno);
        !          7314: 
        !          7315:       if( iTable==maxRootPgno ){
        !          7316:         /* If the table being dropped is the table with the largest root-page
        !          7317:         ** number in the database, put the root page on the free list. 
        !          7318:         */
        !          7319:         freePage(pPage, &rc);
        !          7320:         releasePage(pPage);
        !          7321:         if( rc!=SQLITE_OK ){
        !          7322:           return rc;
        !          7323:         }
        !          7324:       }else{
        !          7325:         /* The table being dropped does not have the largest root-page
        !          7326:         ** number in the database. So move the page that does into the 
        !          7327:         ** gap left by the deleted root-page.
        !          7328:         */
        !          7329:         MemPage *pMove;
        !          7330:         releasePage(pPage);
        !          7331:         rc = btreeGetPage(pBt, maxRootPgno, &pMove, 0);
        !          7332:         if( rc!=SQLITE_OK ){
        !          7333:           return rc;
        !          7334:         }
        !          7335:         rc = relocatePage(pBt, pMove, PTRMAP_ROOTPAGE, 0, iTable, 0);
        !          7336:         releasePage(pMove);
        !          7337:         if( rc!=SQLITE_OK ){
        !          7338:           return rc;
        !          7339:         }
        !          7340:         pMove = 0;
        !          7341:         rc = btreeGetPage(pBt, maxRootPgno, &pMove, 0);
        !          7342:         freePage(pMove, &rc);
        !          7343:         releasePage(pMove);
        !          7344:         if( rc!=SQLITE_OK ){
        !          7345:           return rc;
        !          7346:         }
        !          7347:         *piMoved = maxRootPgno;
        !          7348:       }
        !          7349: 
        !          7350:       /* Set the new 'max-root-page' value in the database header. This
        !          7351:       ** is the old value less one, less one more if that happens to
        !          7352:       ** be a root-page number, less one again if that is the
        !          7353:       ** PENDING_BYTE_PAGE.
        !          7354:       */
        !          7355:       maxRootPgno--;
        !          7356:       while( maxRootPgno==PENDING_BYTE_PAGE(pBt)
        !          7357:              || PTRMAP_ISPAGE(pBt, maxRootPgno) ){
        !          7358:         maxRootPgno--;
        !          7359:       }
        !          7360:       assert( maxRootPgno!=PENDING_BYTE_PAGE(pBt) );
        !          7361: 
        !          7362:       rc = sqlite3BtreeUpdateMeta(p, 4, maxRootPgno);
        !          7363:     }else{
        !          7364:       freePage(pPage, &rc);
        !          7365:       releasePage(pPage);
        !          7366:     }
        !          7367: #endif
        !          7368:   }else{
        !          7369:     /* If sqlite3BtreeDropTable was called on page 1.
        !          7370:     ** This really never should happen except in a corrupt
        !          7371:     ** database. 
        !          7372:     */
        !          7373:     zeroPage(pPage, PTF_INTKEY|PTF_LEAF );
        !          7374:     releasePage(pPage);
        !          7375:   }
        !          7376:   return rc;  
        !          7377: }
        !          7378: int sqlite3BtreeDropTable(Btree *p, int iTable, int *piMoved){
        !          7379:   int rc;
        !          7380:   sqlite3BtreeEnter(p);
        !          7381:   rc = btreeDropTable(p, iTable, piMoved);
        !          7382:   sqlite3BtreeLeave(p);
        !          7383:   return rc;
        !          7384: }
        !          7385: 
        !          7386: 
        !          7387: /*
        !          7388: ** This function may only be called if the b-tree connection already
        !          7389: ** has a read or write transaction open on the database.
        !          7390: **
        !          7391: ** Read the meta-information out of a database file.  Meta[0]
        !          7392: ** is the number of free pages currently in the database.  Meta[1]
        !          7393: ** through meta[15] are available for use by higher layers.  Meta[0]
        !          7394: ** is read-only, the others are read/write.
        !          7395: ** 
        !          7396: ** The schema layer numbers meta values differently.  At the schema
        !          7397: ** layer (and the SetCookie and ReadCookie opcodes) the number of
        !          7398: ** free pages is not visible.  So Cookie[0] is the same as Meta[1].
        !          7399: */
        !          7400: void sqlite3BtreeGetMeta(Btree *p, int idx, u32 *pMeta){
        !          7401:   BtShared *pBt = p->pBt;
        !          7402: 
        !          7403:   sqlite3BtreeEnter(p);
        !          7404:   assert( p->inTrans>TRANS_NONE );
        !          7405:   assert( SQLITE_OK==querySharedCacheTableLock(p, MASTER_ROOT, READ_LOCK) );
        !          7406:   assert( pBt->pPage1 );
        !          7407:   assert( idx>=0 && idx<=15 );
        !          7408: 
        !          7409:   *pMeta = get4byte(&pBt->pPage1->aData[36 + idx*4]);
        !          7410: 
        !          7411:   /* If auto-vacuum is disabled in this build and this is an auto-vacuum
        !          7412:   ** database, mark the database as read-only.  */
        !          7413: #ifdef SQLITE_OMIT_AUTOVACUUM
        !          7414:   if( idx==BTREE_LARGEST_ROOT_PAGE && *pMeta>0 ){
        !          7415:     pBt->btsFlags |= BTS_READ_ONLY;
        !          7416:   }
        !          7417: #endif
        !          7418: 
        !          7419:   sqlite3BtreeLeave(p);
        !          7420: }
        !          7421: 
        !          7422: /*
        !          7423: ** Write meta-information back into the database.  Meta[0] is
        !          7424: ** read-only and may not be written.
        !          7425: */
        !          7426: int sqlite3BtreeUpdateMeta(Btree *p, int idx, u32 iMeta){
        !          7427:   BtShared *pBt = p->pBt;
        !          7428:   unsigned char *pP1;
        !          7429:   int rc;
        !          7430:   assert( idx>=1 && idx<=15 );
        !          7431:   sqlite3BtreeEnter(p);
        !          7432:   assert( p->inTrans==TRANS_WRITE );
        !          7433:   assert( pBt->pPage1!=0 );
        !          7434:   pP1 = pBt->pPage1->aData;
        !          7435:   rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
        !          7436:   if( rc==SQLITE_OK ){
        !          7437:     put4byte(&pP1[36 + idx*4], iMeta);
        !          7438: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          7439:     if( idx==BTREE_INCR_VACUUM ){
        !          7440:       assert( pBt->autoVacuum || iMeta==0 );
        !          7441:       assert( iMeta==0 || iMeta==1 );
        !          7442:       pBt->incrVacuum = (u8)iMeta;
        !          7443:     }
        !          7444: #endif
        !          7445:   }
        !          7446:   sqlite3BtreeLeave(p);
        !          7447:   return rc;
        !          7448: }
        !          7449: 
        !          7450: #ifndef SQLITE_OMIT_BTREECOUNT
        !          7451: /*
        !          7452: ** The first argument, pCur, is a cursor opened on some b-tree. Count the
        !          7453: ** number of entries in the b-tree and write the result to *pnEntry.
        !          7454: **
        !          7455: ** SQLITE_OK is returned if the operation is successfully executed. 
        !          7456: ** Otherwise, if an error is encountered (i.e. an IO error or database
        !          7457: ** corruption) an SQLite error code is returned.
        !          7458: */
        !          7459: int sqlite3BtreeCount(BtCursor *pCur, i64 *pnEntry){
        !          7460:   i64 nEntry = 0;                      /* Value to return in *pnEntry */
        !          7461:   int rc;                              /* Return code */
        !          7462: 
        !          7463:   if( pCur->pgnoRoot==0 ){
        !          7464:     *pnEntry = 0;
        !          7465:     return SQLITE_OK;
        !          7466:   }
        !          7467:   rc = moveToRoot(pCur);
        !          7468: 
        !          7469:   /* Unless an error occurs, the following loop runs one iteration for each
        !          7470:   ** page in the B-Tree structure (not including overflow pages). 
        !          7471:   */
        !          7472:   while( rc==SQLITE_OK ){
        !          7473:     int iIdx;                          /* Index of child node in parent */
        !          7474:     MemPage *pPage;                    /* Current page of the b-tree */
        !          7475: 
        !          7476:     /* If this is a leaf page or the tree is not an int-key tree, then 
        !          7477:     ** this page contains countable entries. Increment the entry counter
        !          7478:     ** accordingly.
        !          7479:     */
        !          7480:     pPage = pCur->apPage[pCur->iPage];
        !          7481:     if( pPage->leaf || !pPage->intKey ){
        !          7482:       nEntry += pPage->nCell;
        !          7483:     }
        !          7484: 
        !          7485:     /* pPage is a leaf node. This loop navigates the cursor so that it 
        !          7486:     ** points to the first interior cell that it points to the parent of
        !          7487:     ** the next page in the tree that has not yet been visited. The
        !          7488:     ** pCur->aiIdx[pCur->iPage] value is set to the index of the parent cell
        !          7489:     ** of the page, or to the number of cells in the page if the next page
        !          7490:     ** to visit is the right-child of its parent.
        !          7491:     **
        !          7492:     ** If all pages in the tree have been visited, return SQLITE_OK to the
        !          7493:     ** caller.
        !          7494:     */
        !          7495:     if( pPage->leaf ){
        !          7496:       do {
        !          7497:         if( pCur->iPage==0 ){
        !          7498:           /* All pages of the b-tree have been visited. Return successfully. */
        !          7499:           *pnEntry = nEntry;
        !          7500:           return SQLITE_OK;
        !          7501:         }
        !          7502:         moveToParent(pCur);
        !          7503:       }while ( pCur->aiIdx[pCur->iPage]>=pCur->apPage[pCur->iPage]->nCell );
        !          7504: 
        !          7505:       pCur->aiIdx[pCur->iPage]++;
        !          7506:       pPage = pCur->apPage[pCur->iPage];
        !          7507:     }
        !          7508: 
        !          7509:     /* Descend to the child node of the cell that the cursor currently 
        !          7510:     ** points at. This is the right-child if (iIdx==pPage->nCell).
        !          7511:     */
        !          7512:     iIdx = pCur->aiIdx[pCur->iPage];
        !          7513:     if( iIdx==pPage->nCell ){
        !          7514:       rc = moveToChild(pCur, get4byte(&pPage->aData[pPage->hdrOffset+8]));
        !          7515:     }else{
        !          7516:       rc = moveToChild(pCur, get4byte(findCell(pPage, iIdx)));
        !          7517:     }
        !          7518:   }
        !          7519: 
        !          7520:   /* An error has occurred. Return an error code. */
        !          7521:   return rc;
        !          7522: }
        !          7523: #endif
        !          7524: 
        !          7525: /*
        !          7526: ** Return the pager associated with a BTree.  This routine is used for
        !          7527: ** testing and debugging only.
        !          7528: */
        !          7529: Pager *sqlite3BtreePager(Btree *p){
        !          7530:   return p->pBt->pPager;
        !          7531: }
        !          7532: 
        !          7533: #ifndef SQLITE_OMIT_INTEGRITY_CHECK
        !          7534: /*
        !          7535: ** Append a message to the error message string.
        !          7536: */
        !          7537: static void checkAppendMsg(
        !          7538:   IntegrityCk *pCheck,
        !          7539:   char *zMsg1,
        !          7540:   const char *zFormat,
        !          7541:   ...
        !          7542: ){
        !          7543:   va_list ap;
        !          7544:   if( !pCheck->mxErr ) return;
        !          7545:   pCheck->mxErr--;
        !          7546:   pCheck->nErr++;
        !          7547:   va_start(ap, zFormat);
        !          7548:   if( pCheck->errMsg.nChar ){
        !          7549:     sqlite3StrAccumAppend(&pCheck->errMsg, "\n", 1);
        !          7550:   }
        !          7551:   if( zMsg1 ){
        !          7552:     sqlite3StrAccumAppend(&pCheck->errMsg, zMsg1, -1);
        !          7553:   }
        !          7554:   sqlite3VXPrintf(&pCheck->errMsg, 1, zFormat, ap);
        !          7555:   va_end(ap);
        !          7556:   if( pCheck->errMsg.mallocFailed ){
        !          7557:     pCheck->mallocFailed = 1;
        !          7558:   }
        !          7559: }
        !          7560: #endif /* SQLITE_OMIT_INTEGRITY_CHECK */
        !          7561: 
        !          7562: #ifndef SQLITE_OMIT_INTEGRITY_CHECK
        !          7563: /*
        !          7564: ** Add 1 to the reference count for page iPage.  If this is the second
        !          7565: ** reference to the page, add an error message to pCheck->zErrMsg.
        !          7566: ** Return 1 if there are 2 ore more references to the page and 0 if
        !          7567: ** if this is the first reference to the page.
        !          7568: **
        !          7569: ** Also check that the page number is in bounds.
        !          7570: */
        !          7571: static int checkRef(IntegrityCk *pCheck, Pgno iPage, char *zContext){
        !          7572:   if( iPage==0 ) return 1;
        !          7573:   if( iPage>pCheck->nPage ){
        !          7574:     checkAppendMsg(pCheck, zContext, "invalid page number %d", iPage);
        !          7575:     return 1;
        !          7576:   }
        !          7577:   if( pCheck->anRef[iPage]==1 ){
        !          7578:     checkAppendMsg(pCheck, zContext, "2nd reference to page %d", iPage);
        !          7579:     return 1;
        !          7580:   }
        !          7581:   return  (pCheck->anRef[iPage]++)>1;
        !          7582: }
        !          7583: 
        !          7584: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          7585: /*
        !          7586: ** Check that the entry in the pointer-map for page iChild maps to 
        !          7587: ** page iParent, pointer type ptrType. If not, append an error message
        !          7588: ** to pCheck.
        !          7589: */
        !          7590: static void checkPtrmap(
        !          7591:   IntegrityCk *pCheck,   /* Integrity check context */
        !          7592:   Pgno iChild,           /* Child page number */
        !          7593:   u8 eType,              /* Expected pointer map type */
        !          7594:   Pgno iParent,          /* Expected pointer map parent page number */
        !          7595:   char *zContext         /* Context description (used for error msg) */
        !          7596: ){
        !          7597:   int rc;
        !          7598:   u8 ePtrmapType;
        !          7599:   Pgno iPtrmapParent;
        !          7600: 
        !          7601:   rc = ptrmapGet(pCheck->pBt, iChild, &ePtrmapType, &iPtrmapParent);
        !          7602:   if( rc!=SQLITE_OK ){
        !          7603:     if( rc==SQLITE_NOMEM || rc==SQLITE_IOERR_NOMEM ) pCheck->mallocFailed = 1;
        !          7604:     checkAppendMsg(pCheck, zContext, "Failed to read ptrmap key=%d", iChild);
        !          7605:     return;
        !          7606:   }
        !          7607: 
        !          7608:   if( ePtrmapType!=eType || iPtrmapParent!=iParent ){
        !          7609:     checkAppendMsg(pCheck, zContext, 
        !          7610:       "Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)", 
        !          7611:       iChild, eType, iParent, ePtrmapType, iPtrmapParent);
        !          7612:   }
        !          7613: }
        !          7614: #endif
        !          7615: 
        !          7616: /*
        !          7617: ** Check the integrity of the freelist or of an overflow page list.
        !          7618: ** Verify that the number of pages on the list is N.
        !          7619: */
        !          7620: static void checkList(
        !          7621:   IntegrityCk *pCheck,  /* Integrity checking context */
        !          7622:   int isFreeList,       /* True for a freelist.  False for overflow page list */
        !          7623:   int iPage,            /* Page number for first page in the list */
        !          7624:   int N,                /* Expected number of pages in the list */
        !          7625:   char *zContext        /* Context for error messages */
        !          7626: ){
        !          7627:   int i;
        !          7628:   int expected = N;
        !          7629:   int iFirst = iPage;
        !          7630:   while( N-- > 0 && pCheck->mxErr ){
        !          7631:     DbPage *pOvflPage;
        !          7632:     unsigned char *pOvflData;
        !          7633:     if( iPage<1 ){
        !          7634:       checkAppendMsg(pCheck, zContext,
        !          7635:          "%d of %d pages missing from overflow list starting at %d",
        !          7636:           N+1, expected, iFirst);
        !          7637:       break;
        !          7638:     }
        !          7639:     if( checkRef(pCheck, iPage, zContext) ) break;
        !          7640:     if( sqlite3PagerGet(pCheck->pPager, (Pgno)iPage, &pOvflPage) ){
        !          7641:       checkAppendMsg(pCheck, zContext, "failed to get page %d", iPage);
        !          7642:       break;
        !          7643:     }
        !          7644:     pOvflData = (unsigned char *)sqlite3PagerGetData(pOvflPage);
        !          7645:     if( isFreeList ){
        !          7646:       int n = get4byte(&pOvflData[4]);
        !          7647: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          7648:       if( pCheck->pBt->autoVacuum ){
        !          7649:         checkPtrmap(pCheck, iPage, PTRMAP_FREEPAGE, 0, zContext);
        !          7650:       }
        !          7651: #endif
        !          7652:       if( n>(int)pCheck->pBt->usableSize/4-2 ){
        !          7653:         checkAppendMsg(pCheck, zContext,
        !          7654:            "freelist leaf count too big on page %d", iPage);
        !          7655:         N--;
        !          7656:       }else{
        !          7657:         for(i=0; i<n; i++){
        !          7658:           Pgno iFreePage = get4byte(&pOvflData[8+i*4]);
        !          7659: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          7660:           if( pCheck->pBt->autoVacuum ){
        !          7661:             checkPtrmap(pCheck, iFreePage, PTRMAP_FREEPAGE, 0, zContext);
        !          7662:           }
        !          7663: #endif
        !          7664:           checkRef(pCheck, iFreePage, zContext);
        !          7665:         }
        !          7666:         N -= n;
        !          7667:       }
        !          7668:     }
        !          7669: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          7670:     else{
        !          7671:       /* If this database supports auto-vacuum and iPage is not the last
        !          7672:       ** page in this overflow list, check that the pointer-map entry for
        !          7673:       ** the following page matches iPage.
        !          7674:       */
        !          7675:       if( pCheck->pBt->autoVacuum && N>0 ){
        !          7676:         i = get4byte(pOvflData);
        !          7677:         checkPtrmap(pCheck, i, PTRMAP_OVERFLOW2, iPage, zContext);
        !          7678:       }
        !          7679:     }
        !          7680: #endif
        !          7681:     iPage = get4byte(pOvflData);
        !          7682:     sqlite3PagerUnref(pOvflPage);
        !          7683:   }
        !          7684: }
        !          7685: #endif /* SQLITE_OMIT_INTEGRITY_CHECK */
        !          7686: 
        !          7687: #ifndef SQLITE_OMIT_INTEGRITY_CHECK
        !          7688: /*
        !          7689: ** Do various sanity checks on a single page of a tree.  Return
        !          7690: ** the tree depth.  Root pages return 0.  Parents of root pages
        !          7691: ** return 1, and so forth.
        !          7692: ** 
        !          7693: ** These checks are done:
        !          7694: **
        !          7695: **      1.  Make sure that cells and freeblocks do not overlap
        !          7696: **          but combine to completely cover the page.
        !          7697: **  NO  2.  Make sure cell keys are in order.
        !          7698: **  NO  3.  Make sure no key is less than or equal to zLowerBound.
        !          7699: **  NO  4.  Make sure no key is greater than or equal to zUpperBound.
        !          7700: **      5.  Check the integrity of overflow pages.
        !          7701: **      6.  Recursively call checkTreePage on all children.
        !          7702: **      7.  Verify that the depth of all children is the same.
        !          7703: **      8.  Make sure this page is at least 33% full or else it is
        !          7704: **          the root of the tree.
        !          7705: */
        !          7706: static int checkTreePage(
        !          7707:   IntegrityCk *pCheck,  /* Context for the sanity check */
        !          7708:   int iPage,            /* Page number of the page to check */
        !          7709:   char *zParentContext, /* Parent context */
        !          7710:   i64 *pnParentMinKey, 
        !          7711:   i64 *pnParentMaxKey
        !          7712: ){
        !          7713:   MemPage *pPage;
        !          7714:   int i, rc, depth, d2, pgno, cnt;
        !          7715:   int hdr, cellStart;
        !          7716:   int nCell;
        !          7717:   u8 *data;
        !          7718:   BtShared *pBt;
        !          7719:   int usableSize;
        !          7720:   char zContext[100];
        !          7721:   char *hit = 0;
        !          7722:   i64 nMinKey = 0;
        !          7723:   i64 nMaxKey = 0;
        !          7724: 
        !          7725:   sqlite3_snprintf(sizeof(zContext), zContext, "Page %d: ", iPage);
        !          7726: 
        !          7727:   /* Check that the page exists
        !          7728:   */
        !          7729:   pBt = pCheck->pBt;
        !          7730:   usableSize = pBt->usableSize;
        !          7731:   if( iPage==0 ) return 0;
        !          7732:   if( checkRef(pCheck, iPage, zParentContext) ) return 0;
        !          7733:   if( (rc = btreeGetPage(pBt, (Pgno)iPage, &pPage, 0))!=0 ){
        !          7734:     checkAppendMsg(pCheck, zContext,
        !          7735:        "unable to get the page. error code=%d", rc);
        !          7736:     return 0;
        !          7737:   }
        !          7738: 
        !          7739:   /* Clear MemPage.isInit to make sure the corruption detection code in
        !          7740:   ** btreeInitPage() is executed.  */
        !          7741:   pPage->isInit = 0;
        !          7742:   if( (rc = btreeInitPage(pPage))!=0 ){
        !          7743:     assert( rc==SQLITE_CORRUPT );  /* The only possible error from InitPage */
        !          7744:     checkAppendMsg(pCheck, zContext, 
        !          7745:                    "btreeInitPage() returns error code %d", rc);
        !          7746:     releasePage(pPage);
        !          7747:     return 0;
        !          7748:   }
        !          7749: 
        !          7750:   /* Check out all the cells.
        !          7751:   */
        !          7752:   depth = 0;
        !          7753:   for(i=0; i<pPage->nCell && pCheck->mxErr; i++){
        !          7754:     u8 *pCell;
        !          7755:     u32 sz;
        !          7756:     CellInfo info;
        !          7757: 
        !          7758:     /* Check payload overflow pages
        !          7759:     */
        !          7760:     sqlite3_snprintf(sizeof(zContext), zContext,
        !          7761:              "On tree page %d cell %d: ", iPage, i);
        !          7762:     pCell = findCell(pPage,i);
        !          7763:     btreeParseCellPtr(pPage, pCell, &info);
        !          7764:     sz = info.nData;
        !          7765:     if( !pPage->intKey ) sz += (int)info.nKey;
        !          7766:     /* For intKey pages, check that the keys are in order.
        !          7767:     */
        !          7768:     else if( i==0 ) nMinKey = nMaxKey = info.nKey;
        !          7769:     else{
        !          7770:       if( info.nKey <= nMaxKey ){
        !          7771:         checkAppendMsg(pCheck, zContext, 
        !          7772:             "Rowid %lld out of order (previous was %lld)", info.nKey, nMaxKey);
        !          7773:       }
        !          7774:       nMaxKey = info.nKey;
        !          7775:     }
        !          7776:     assert( sz==info.nPayload );
        !          7777:     if( (sz>info.nLocal) 
        !          7778:      && (&pCell[info.iOverflow]<=&pPage->aData[pBt->usableSize])
        !          7779:     ){
        !          7780:       int nPage = (sz - info.nLocal + usableSize - 5)/(usableSize - 4);
        !          7781:       Pgno pgnoOvfl = get4byte(&pCell[info.iOverflow]);
        !          7782: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          7783:       if( pBt->autoVacuum ){
        !          7784:         checkPtrmap(pCheck, pgnoOvfl, PTRMAP_OVERFLOW1, iPage, zContext);
        !          7785:       }
        !          7786: #endif
        !          7787:       checkList(pCheck, 0, pgnoOvfl, nPage, zContext);
        !          7788:     }
        !          7789: 
        !          7790:     /* Check sanity of left child page.
        !          7791:     */
        !          7792:     if( !pPage->leaf ){
        !          7793:       pgno = get4byte(pCell);
        !          7794: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          7795:       if( pBt->autoVacuum ){
        !          7796:         checkPtrmap(pCheck, pgno, PTRMAP_BTREE, iPage, zContext);
        !          7797:       }
        !          7798: #endif
        !          7799:       d2 = checkTreePage(pCheck, pgno, zContext, &nMinKey, i==0 ? NULL : &nMaxKey);
        !          7800:       if( i>0 && d2!=depth ){
        !          7801:         checkAppendMsg(pCheck, zContext, "Child page depth differs");
        !          7802:       }
        !          7803:       depth = d2;
        !          7804:     }
        !          7805:   }
        !          7806: 
        !          7807:   if( !pPage->leaf ){
        !          7808:     pgno = get4byte(&pPage->aData[pPage->hdrOffset+8]);
        !          7809:     sqlite3_snprintf(sizeof(zContext), zContext, 
        !          7810:                      "On page %d at right child: ", iPage);
        !          7811: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          7812:     if( pBt->autoVacuum ){
        !          7813:       checkPtrmap(pCheck, pgno, PTRMAP_BTREE, iPage, zContext);
        !          7814:     }
        !          7815: #endif
        !          7816:     checkTreePage(pCheck, pgno, zContext, NULL, !pPage->nCell ? NULL : &nMaxKey);
        !          7817:   }
        !          7818:  
        !          7819:   /* For intKey leaf pages, check that the min/max keys are in order
        !          7820:   ** with any left/parent/right pages.
        !          7821:   */
        !          7822:   if( pPage->leaf && pPage->intKey ){
        !          7823:     /* if we are a left child page */
        !          7824:     if( pnParentMinKey ){
        !          7825:       /* if we are the left most child page */
        !          7826:       if( !pnParentMaxKey ){
        !          7827:         if( nMaxKey > *pnParentMinKey ){
        !          7828:           checkAppendMsg(pCheck, zContext, 
        !          7829:               "Rowid %lld out of order (max larger than parent min of %lld)",
        !          7830:               nMaxKey, *pnParentMinKey);
        !          7831:         }
        !          7832:       }else{
        !          7833:         if( nMinKey <= *pnParentMinKey ){
        !          7834:           checkAppendMsg(pCheck, zContext, 
        !          7835:               "Rowid %lld out of order (min less than parent min of %lld)",
        !          7836:               nMinKey, *pnParentMinKey);
        !          7837:         }
        !          7838:         if( nMaxKey > *pnParentMaxKey ){
        !          7839:           checkAppendMsg(pCheck, zContext, 
        !          7840:               "Rowid %lld out of order (max larger than parent max of %lld)",
        !          7841:               nMaxKey, *pnParentMaxKey);
        !          7842:         }
        !          7843:         *pnParentMinKey = nMaxKey;
        !          7844:       }
        !          7845:     /* else if we're a right child page */
        !          7846:     } else if( pnParentMaxKey ){
        !          7847:       if( nMinKey <= *pnParentMaxKey ){
        !          7848:         checkAppendMsg(pCheck, zContext, 
        !          7849:             "Rowid %lld out of order (min less than parent max of %lld)",
        !          7850:             nMinKey, *pnParentMaxKey);
        !          7851:       }
        !          7852:     }
        !          7853:   }
        !          7854: 
        !          7855:   /* Check for complete coverage of the page
        !          7856:   */
        !          7857:   data = pPage->aData;
        !          7858:   hdr = pPage->hdrOffset;
        !          7859:   hit = sqlite3PageMalloc( pBt->pageSize );
        !          7860:   if( hit==0 ){
        !          7861:     pCheck->mallocFailed = 1;
        !          7862:   }else{
        !          7863:     int contentOffset = get2byteNotZero(&data[hdr+5]);
        !          7864:     assert( contentOffset<=usableSize );  /* Enforced by btreeInitPage() */
        !          7865:     memset(hit+contentOffset, 0, usableSize-contentOffset);
        !          7866:     memset(hit, 1, contentOffset);
        !          7867:     nCell = get2byte(&data[hdr+3]);
        !          7868:     cellStart = hdr + 12 - 4*pPage->leaf;
        !          7869:     for(i=0; i<nCell; i++){
        !          7870:       int pc = get2byte(&data[cellStart+i*2]);
        !          7871:       u32 size = 65536;
        !          7872:       int j;
        !          7873:       if( pc<=usableSize-4 ){
        !          7874:         size = cellSizePtr(pPage, &data[pc]);
        !          7875:       }
        !          7876:       if( (int)(pc+size-1)>=usableSize ){
        !          7877:         checkAppendMsg(pCheck, 0, 
        !          7878:             "Corruption detected in cell %d on page %d",i,iPage);
        !          7879:       }else{
        !          7880:         for(j=pc+size-1; j>=pc; j--) hit[j]++;
        !          7881:       }
        !          7882:     }
        !          7883:     i = get2byte(&data[hdr+1]);
        !          7884:     while( i>0 ){
        !          7885:       int size, j;
        !          7886:       assert( i<=usableSize-4 );     /* Enforced by btreeInitPage() */
        !          7887:       size = get2byte(&data[i+2]);
        !          7888:       assert( i+size<=usableSize );  /* Enforced by btreeInitPage() */
        !          7889:       for(j=i+size-1; j>=i; j--) hit[j]++;
        !          7890:       j = get2byte(&data[i]);
        !          7891:       assert( j==0 || j>i+size );  /* Enforced by btreeInitPage() */
        !          7892:       assert( j<=usableSize-4 );   /* Enforced by btreeInitPage() */
        !          7893:       i = j;
        !          7894:     }
        !          7895:     for(i=cnt=0; i<usableSize; i++){
        !          7896:       if( hit[i]==0 ){
        !          7897:         cnt++;
        !          7898:       }else if( hit[i]>1 ){
        !          7899:         checkAppendMsg(pCheck, 0,
        !          7900:           "Multiple uses for byte %d of page %d", i, iPage);
        !          7901:         break;
        !          7902:       }
        !          7903:     }
        !          7904:     if( cnt!=data[hdr+7] ){
        !          7905:       checkAppendMsg(pCheck, 0, 
        !          7906:           "Fragmentation of %d bytes reported as %d on page %d",
        !          7907:           cnt, data[hdr+7], iPage);
        !          7908:     }
        !          7909:   }
        !          7910:   sqlite3PageFree(hit);
        !          7911:   releasePage(pPage);
        !          7912:   return depth+1;
        !          7913: }
        !          7914: #endif /* SQLITE_OMIT_INTEGRITY_CHECK */
        !          7915: 
        !          7916: #ifndef SQLITE_OMIT_INTEGRITY_CHECK
        !          7917: /*
        !          7918: ** This routine does a complete check of the given BTree file.  aRoot[] is
        !          7919: ** an array of pages numbers were each page number is the root page of
        !          7920: ** a table.  nRoot is the number of entries in aRoot.
        !          7921: **
        !          7922: ** A read-only or read-write transaction must be opened before calling
        !          7923: ** this function.
        !          7924: **
        !          7925: ** Write the number of error seen in *pnErr.  Except for some memory
        !          7926: ** allocation errors,  an error message held in memory obtained from
        !          7927: ** malloc is returned if *pnErr is non-zero.  If *pnErr==0 then NULL is
        !          7928: ** returned.  If a memory allocation error occurs, NULL is returned.
        !          7929: */
        !          7930: char *sqlite3BtreeIntegrityCheck(
        !          7931:   Btree *p,     /* The btree to be checked */
        !          7932:   int *aRoot,   /* An array of root pages numbers for individual trees */
        !          7933:   int nRoot,    /* Number of entries in aRoot[] */
        !          7934:   int mxErr,    /* Stop reporting errors after this many */
        !          7935:   int *pnErr    /* Write number of errors seen to this variable */
        !          7936: ){
        !          7937:   Pgno i;
        !          7938:   int nRef;
        !          7939:   IntegrityCk sCheck;
        !          7940:   BtShared *pBt = p->pBt;
        !          7941:   char zErr[100];
        !          7942: 
        !          7943:   sqlite3BtreeEnter(p);
        !          7944:   assert( p->inTrans>TRANS_NONE && pBt->inTransaction>TRANS_NONE );
        !          7945:   nRef = sqlite3PagerRefcount(pBt->pPager);
        !          7946:   sCheck.pBt = pBt;
        !          7947:   sCheck.pPager = pBt->pPager;
        !          7948:   sCheck.nPage = btreePagecount(sCheck.pBt);
        !          7949:   sCheck.mxErr = mxErr;
        !          7950:   sCheck.nErr = 0;
        !          7951:   sCheck.mallocFailed = 0;
        !          7952:   *pnErr = 0;
        !          7953:   if( sCheck.nPage==0 ){
        !          7954:     sqlite3BtreeLeave(p);
        !          7955:     return 0;
        !          7956:   }
        !          7957:   sCheck.anRef = sqlite3Malloc( (sCheck.nPage+1)*sizeof(sCheck.anRef[0]) );
        !          7958:   if( !sCheck.anRef ){
        !          7959:     *pnErr = 1;
        !          7960:     sqlite3BtreeLeave(p);
        !          7961:     return 0;
        !          7962:   }
        !          7963:   for(i=0; i<=sCheck.nPage; i++){ sCheck.anRef[i] = 0; }
        !          7964:   i = PENDING_BYTE_PAGE(pBt);
        !          7965:   if( i<=sCheck.nPage ){
        !          7966:     sCheck.anRef[i] = 1;
        !          7967:   }
        !          7968:   sqlite3StrAccumInit(&sCheck.errMsg, zErr, sizeof(zErr), 20000);
        !          7969:   sCheck.errMsg.useMalloc = 2;
        !          7970: 
        !          7971:   /* Check the integrity of the freelist
        !          7972:   */
        !          7973:   checkList(&sCheck, 1, get4byte(&pBt->pPage1->aData[32]),
        !          7974:             get4byte(&pBt->pPage1->aData[36]), "Main freelist: ");
        !          7975: 
        !          7976:   /* Check all the tables.
        !          7977:   */
        !          7978:   for(i=0; (int)i<nRoot && sCheck.mxErr; i++){
        !          7979:     if( aRoot[i]==0 ) continue;
        !          7980: #ifndef SQLITE_OMIT_AUTOVACUUM
        !          7981:     if( pBt->autoVacuum && aRoot[i]>1 ){
        !          7982:       checkPtrmap(&sCheck, aRoot[i], PTRMAP_ROOTPAGE, 0, 0);
        !          7983:     }
        !          7984: #endif
        !          7985:     checkTreePage(&sCheck, aRoot[i], "List of tree roots: ", NULL, NULL);
        !          7986:   }
        !          7987: 
        !          7988:   /* Make sure every page in the file is referenced
        !          7989:   */
        !          7990:   for(i=1; i<=sCheck.nPage && sCheck.mxErr; i++){
        !          7991: #ifdef SQLITE_OMIT_AUTOVACUUM
        !          7992:     if( sCheck.anRef[i]==0 ){
        !          7993:       checkAppendMsg(&sCheck, 0, "Page %d is never used", i);
        !          7994:     }
        !          7995: #else
        !          7996:     /* If the database supports auto-vacuum, make sure no tables contain
        !          7997:     ** references to pointer-map pages.
        !          7998:     */
        !          7999:     if( sCheck.anRef[i]==0 && 
        !          8000:        (PTRMAP_PAGENO(pBt, i)!=i || !pBt->autoVacuum) ){
        !          8001:       checkAppendMsg(&sCheck, 0, "Page %d is never used", i);
        !          8002:     }
        !          8003:     if( sCheck.anRef[i]!=0 && 
        !          8004:        (PTRMAP_PAGENO(pBt, i)==i && pBt->autoVacuum) ){
        !          8005:       checkAppendMsg(&sCheck, 0, "Pointer map page %d is referenced", i);
        !          8006:     }
        !          8007: #endif
        !          8008:   }
        !          8009: 
        !          8010:   /* Make sure this analysis did not leave any unref() pages.
        !          8011:   ** This is an internal consistency check; an integrity check
        !          8012:   ** of the integrity check.
        !          8013:   */
        !          8014:   if( NEVER(nRef != sqlite3PagerRefcount(pBt->pPager)) ){
        !          8015:     checkAppendMsg(&sCheck, 0, 
        !          8016:       "Outstanding page count goes from %d to %d during this analysis",
        !          8017:       nRef, sqlite3PagerRefcount(pBt->pPager)
        !          8018:     );
        !          8019:   }
        !          8020: 
        !          8021:   /* Clean  up and report errors.
        !          8022:   */
        !          8023:   sqlite3BtreeLeave(p);
        !          8024:   sqlite3_free(sCheck.anRef);
        !          8025:   if( sCheck.mallocFailed ){
        !          8026:     sqlite3StrAccumReset(&sCheck.errMsg);
        !          8027:     *pnErr = sCheck.nErr+1;
        !          8028:     return 0;
        !          8029:   }
        !          8030:   *pnErr = sCheck.nErr;
        !          8031:   if( sCheck.nErr==0 ) sqlite3StrAccumReset(&sCheck.errMsg);
        !          8032:   return sqlite3StrAccumFinish(&sCheck.errMsg);
        !          8033: }
        !          8034: #endif /* SQLITE_OMIT_INTEGRITY_CHECK */
        !          8035: 
        !          8036: /*
        !          8037: ** Return the full pathname of the underlying database file.
        !          8038: **
        !          8039: ** The pager filename is invariant as long as the pager is
        !          8040: ** open so it is safe to access without the BtShared mutex.
        !          8041: */
        !          8042: const char *sqlite3BtreeGetFilename(Btree *p){
        !          8043:   assert( p->pBt->pPager!=0 );
        !          8044:   return sqlite3PagerFilename(p->pBt->pPager);
        !          8045: }
        !          8046: 
        !          8047: /*
        !          8048: ** Return the pathname of the journal file for this database. The return
        !          8049: ** value of this routine is the same regardless of whether the journal file
        !          8050: ** has been created or not.
        !          8051: **
        !          8052: ** The pager journal filename is invariant as long as the pager is
        !          8053: ** open so it is safe to access without the BtShared mutex.
        !          8054: */
        !          8055: const char *sqlite3BtreeGetJournalname(Btree *p){
        !          8056:   assert( p->pBt->pPager!=0 );
        !          8057:   return sqlite3PagerJournalname(p->pBt->pPager);
        !          8058: }
        !          8059: 
        !          8060: /*
        !          8061: ** Return non-zero if a transaction is active.
        !          8062: */
        !          8063: int sqlite3BtreeIsInTrans(Btree *p){
        !          8064:   assert( p==0 || sqlite3_mutex_held(p->db->mutex) );
        !          8065:   return (p && (p->inTrans==TRANS_WRITE));
        !          8066: }
        !          8067: 
        !          8068: #ifndef SQLITE_OMIT_WAL
        !          8069: /*
        !          8070: ** Run a checkpoint on the Btree passed as the first argument.
        !          8071: **
        !          8072: ** Return SQLITE_LOCKED if this or any other connection has an open 
        !          8073: ** transaction on the shared-cache the argument Btree is connected to.
        !          8074: **
        !          8075: ** Parameter eMode is one of SQLITE_CHECKPOINT_PASSIVE, FULL or RESTART.
        !          8076: */
        !          8077: int sqlite3BtreeCheckpoint(Btree *p, int eMode, int *pnLog, int *pnCkpt){
        !          8078:   int rc = SQLITE_OK;
        !          8079:   if( p ){
        !          8080:     BtShared *pBt = p->pBt;
        !          8081:     sqlite3BtreeEnter(p);
        !          8082:     if( pBt->inTransaction!=TRANS_NONE ){
        !          8083:       rc = SQLITE_LOCKED;
        !          8084:     }else{
        !          8085:       rc = sqlite3PagerCheckpoint(pBt->pPager, eMode, pnLog, pnCkpt);
        !          8086:     }
        !          8087:     sqlite3BtreeLeave(p);
        !          8088:   }
        !          8089:   return rc;
        !          8090: }
        !          8091: #endif
        !          8092: 
        !          8093: /*
        !          8094: ** Return non-zero if a read (or write) transaction is active.
        !          8095: */
        !          8096: int sqlite3BtreeIsInReadTrans(Btree *p){
        !          8097:   assert( p );
        !          8098:   assert( sqlite3_mutex_held(p->db->mutex) );
        !          8099:   return p->inTrans!=TRANS_NONE;
        !          8100: }
        !          8101: 
        !          8102: int sqlite3BtreeIsInBackup(Btree *p){
        !          8103:   assert( p );
        !          8104:   assert( sqlite3_mutex_held(p->db->mutex) );
        !          8105:   return p->nBackup!=0;
        !          8106: }
        !          8107: 
        !          8108: /*
        !          8109: ** This function returns a pointer to a blob of memory associated with
        !          8110: ** a single shared-btree. The memory is used by client code for its own
        !          8111: ** purposes (for example, to store a high-level schema associated with 
        !          8112: ** the shared-btree). The btree layer manages reference counting issues.
        !          8113: **
        !          8114: ** The first time this is called on a shared-btree, nBytes bytes of memory
        !          8115: ** are allocated, zeroed, and returned to the caller. For each subsequent 
        !          8116: ** call the nBytes parameter is ignored and a pointer to the same blob
        !          8117: ** of memory returned. 
        !          8118: **
        !          8119: ** If the nBytes parameter is 0 and the blob of memory has not yet been
        !          8120: ** allocated, a null pointer is returned. If the blob has already been
        !          8121: ** allocated, it is returned as normal.
        !          8122: **
        !          8123: ** Just before the shared-btree is closed, the function passed as the 
        !          8124: ** xFree argument when the memory allocation was made is invoked on the 
        !          8125: ** blob of allocated memory. The xFree function should not call sqlite3_free()
        !          8126: ** on the memory, the btree layer does that.
        !          8127: */
        !          8128: void *sqlite3BtreeSchema(Btree *p, int nBytes, void(*xFree)(void *)){
        !          8129:   BtShared *pBt = p->pBt;
        !          8130:   sqlite3BtreeEnter(p);
        !          8131:   if( !pBt->pSchema && nBytes ){
        !          8132:     pBt->pSchema = sqlite3DbMallocZero(0, nBytes);
        !          8133:     pBt->xFreeSchema = xFree;
        !          8134:   }
        !          8135:   sqlite3BtreeLeave(p);
        !          8136:   return pBt->pSchema;
        !          8137: }
        !          8138: 
        !          8139: /*
        !          8140: ** Return SQLITE_LOCKED_SHAREDCACHE if another user of the same shared 
        !          8141: ** btree as the argument handle holds an exclusive lock on the 
        !          8142: ** sqlite_master table. Otherwise SQLITE_OK.
        !          8143: */
        !          8144: int sqlite3BtreeSchemaLocked(Btree *p){
        !          8145:   int rc;
        !          8146:   assert( sqlite3_mutex_held(p->db->mutex) );
        !          8147:   sqlite3BtreeEnter(p);
        !          8148:   rc = querySharedCacheTableLock(p, MASTER_ROOT, READ_LOCK);
        !          8149:   assert( rc==SQLITE_OK || rc==SQLITE_LOCKED_SHAREDCACHE );
        !          8150:   sqlite3BtreeLeave(p);
        !          8151:   return rc;
        !          8152: }
        !          8153: 
        !          8154: 
        !          8155: #ifndef SQLITE_OMIT_SHARED_CACHE
        !          8156: /*
        !          8157: ** Obtain a lock on the table whose root page is iTab.  The
        !          8158: ** lock is a write lock if isWritelock is true or a read lock
        !          8159: ** if it is false.
        !          8160: */
        !          8161: int sqlite3BtreeLockTable(Btree *p, int iTab, u8 isWriteLock){
        !          8162:   int rc = SQLITE_OK;
        !          8163:   assert( p->inTrans!=TRANS_NONE );
        !          8164:   if( p->sharable ){
        !          8165:     u8 lockType = READ_LOCK + isWriteLock;
        !          8166:     assert( READ_LOCK+1==WRITE_LOCK );
        !          8167:     assert( isWriteLock==0 || isWriteLock==1 );
        !          8168: 
        !          8169:     sqlite3BtreeEnter(p);
        !          8170:     rc = querySharedCacheTableLock(p, iTab, lockType);
        !          8171:     if( rc==SQLITE_OK ){
        !          8172:       rc = setSharedCacheTableLock(p, iTab, lockType);
        !          8173:     }
        !          8174:     sqlite3BtreeLeave(p);
        !          8175:   }
        !          8176:   return rc;
        !          8177: }
        !          8178: #endif
        !          8179: 
        !          8180: #ifndef SQLITE_OMIT_INCRBLOB
        !          8181: /*
        !          8182: ** Argument pCsr must be a cursor opened for writing on an 
        !          8183: ** INTKEY table currently pointing at a valid table entry. 
        !          8184: ** This function modifies the data stored as part of that entry.
        !          8185: **
        !          8186: ** Only the data content may only be modified, it is not possible to 
        !          8187: ** change the length of the data stored. If this function is called with
        !          8188: ** parameters that attempt to write past the end of the existing data,
        !          8189: ** no modifications are made and SQLITE_CORRUPT is returned.
        !          8190: */
        !          8191: int sqlite3BtreePutData(BtCursor *pCsr, u32 offset, u32 amt, void *z){
        !          8192:   int rc;
        !          8193:   assert( cursorHoldsMutex(pCsr) );
        !          8194:   assert( sqlite3_mutex_held(pCsr->pBtree->db->mutex) );
        !          8195:   assert( pCsr->isIncrblobHandle );
        !          8196: 
        !          8197:   rc = restoreCursorPosition(pCsr);
        !          8198:   if( rc!=SQLITE_OK ){
        !          8199:     return rc;
        !          8200:   }
        !          8201:   assert( pCsr->eState!=CURSOR_REQUIRESEEK );
        !          8202:   if( pCsr->eState!=CURSOR_VALID ){
        !          8203:     return SQLITE_ABORT;
        !          8204:   }
        !          8205: 
        !          8206:   /* Check some assumptions: 
        !          8207:   **   (a) the cursor is open for writing,
        !          8208:   **   (b) there is a read/write transaction open,
        !          8209:   **   (c) the connection holds a write-lock on the table (if required),
        !          8210:   **   (d) there are no conflicting read-locks, and
        !          8211:   **   (e) the cursor points at a valid row of an intKey table.
        !          8212:   */
        !          8213:   if( !pCsr->wrFlag ){
        !          8214:     return SQLITE_READONLY;
        !          8215:   }
        !          8216:   assert( (pCsr->pBt->btsFlags & BTS_READ_ONLY)==0
        !          8217:               && pCsr->pBt->inTransaction==TRANS_WRITE );
        !          8218:   assert( hasSharedCacheTableLock(pCsr->pBtree, pCsr->pgnoRoot, 0, 2) );
        !          8219:   assert( !hasReadConflicts(pCsr->pBtree, pCsr->pgnoRoot) );
        !          8220:   assert( pCsr->apPage[pCsr->iPage]->intKey );
        !          8221: 
        !          8222:   return accessPayload(pCsr, offset, amt, (unsigned char *)z, 1);
        !          8223: }
        !          8224: 
        !          8225: /* 
        !          8226: ** Set a flag on this cursor to cache the locations of pages from the 
        !          8227: ** overflow list for the current row. This is used by cursors opened
        !          8228: ** for incremental blob IO only.
        !          8229: **
        !          8230: ** This function sets a flag only. The actual page location cache
        !          8231: ** (stored in BtCursor.aOverflow[]) is allocated and used by function
        !          8232: ** accessPayload() (the worker function for sqlite3BtreeData() and
        !          8233: ** sqlite3BtreePutData()).
        !          8234: */
        !          8235: void sqlite3BtreeCacheOverflow(BtCursor *pCur){
        !          8236:   assert( cursorHoldsMutex(pCur) );
        !          8237:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
        !          8238:   invalidateOverflowCache(pCur);
        !          8239:   pCur->isIncrblobHandle = 1;
        !          8240: }
        !          8241: #endif
        !          8242: 
        !          8243: /*
        !          8244: ** Set both the "read version" (single byte at byte offset 18) and 
        !          8245: ** "write version" (single byte at byte offset 19) fields in the database
        !          8246: ** header to iVersion.
        !          8247: */
        !          8248: int sqlite3BtreeSetVersion(Btree *pBtree, int iVersion){
        !          8249:   BtShared *pBt = pBtree->pBt;
        !          8250:   int rc;                         /* Return code */
        !          8251:  
        !          8252:   assert( iVersion==1 || iVersion==2 );
        !          8253: 
        !          8254:   /* If setting the version fields to 1, do not automatically open the
        !          8255:   ** WAL connection, even if the version fields are currently set to 2.
        !          8256:   */
        !          8257:   pBt->btsFlags &= ~BTS_NO_WAL;
        !          8258:   if( iVersion==1 ) pBt->btsFlags |= BTS_NO_WAL;
        !          8259: 
        !          8260:   rc = sqlite3BtreeBeginTrans(pBtree, 0);
        !          8261:   if( rc==SQLITE_OK ){
        !          8262:     u8 *aData = pBt->pPage1->aData;
        !          8263:     if( aData[18]!=(u8)iVersion || aData[19]!=(u8)iVersion ){
        !          8264:       rc = sqlite3BtreeBeginTrans(pBtree, 2);
        !          8265:       if( rc==SQLITE_OK ){
        !          8266:         rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
        !          8267:         if( rc==SQLITE_OK ){
        !          8268:           aData[18] = (u8)iVersion;
        !          8269:           aData[19] = (u8)iVersion;
        !          8270:         }
        !          8271:       }
        !          8272:     }
        !          8273:   }
        !          8274: 
        !          8275:   pBt->btsFlags &= ~BTS_NO_WAL;
        !          8276:   return rc;
        !          8277: }

FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>