Annotation of embedaddon/sqlite3/src/btree.c, revision 1.1.1.1

1.1       misho       1: /*
                      2: ** 2004 April 6
                      3: **
                      4: ** The author disclaims copyright to this source code.  In place of
                      5: ** a legal notice, here is a blessing:
                      6: **
                      7: **    May you do good and not evil.
                      8: **    May you find forgiveness for yourself and forgive others.
                      9: **    May you share freely, never taking more than you give.
                     10: **
                     11: *************************************************************************
                     12: ** This file implements a external (disk-based) database using BTrees.
                     13: ** See the header comment on "btreeInt.h" for additional information.
                     14: ** Including a description of file format and an overview of operation.
                     15: */
                     16: #include "btreeInt.h"
                     17: 
                     18: /*
                     19: ** The header string that appears at the beginning of every
                     20: ** SQLite database.
                     21: */
                     22: static const char zMagicHeader[] = SQLITE_FILE_HEADER;
                     23: 
                     24: /*
                     25: ** Set this global variable to 1 to enable tracing using the TRACE
                     26: ** macro.
                     27: */
                     28: #if 0
                     29: int sqlite3BtreeTrace=1;  /* True to enable tracing */
                     30: # define TRACE(X)  if(sqlite3BtreeTrace){printf X;fflush(stdout);}
                     31: #else
                     32: # define TRACE(X)
                     33: #endif
                     34: 
                     35: /*
                     36: ** Extract a 2-byte big-endian integer from an array of unsigned bytes.
                     37: ** But if the value is zero, make it 65536.
                     38: **
                     39: ** This routine is used to extract the "offset to cell content area" value
                     40: ** from the header of a btree page.  If the page size is 65536 and the page
                     41: ** is empty, the offset should be 65536, but the 2-byte value stores zero.
                     42: ** This routine makes the necessary adjustment to 65536.
                     43: */
                     44: #define get2byteNotZero(X)  (((((int)get2byte(X))-1)&0xffff)+1)
                     45: 
                     46: #ifndef SQLITE_OMIT_SHARED_CACHE
                     47: /*
                     48: ** A list of BtShared objects that are eligible for participation
                     49: ** in shared cache.  This variable has file scope during normal builds,
                     50: ** but the test harness needs to access it so we make it global for 
                     51: ** test builds.
                     52: **
                     53: ** Access to this variable is protected by SQLITE_MUTEX_STATIC_MASTER.
                     54: */
                     55: #ifdef SQLITE_TEST
                     56: BtShared *SQLITE_WSD sqlite3SharedCacheList = 0;
                     57: #else
                     58: static BtShared *SQLITE_WSD sqlite3SharedCacheList = 0;
                     59: #endif
                     60: #endif /* SQLITE_OMIT_SHARED_CACHE */
                     61: 
                     62: #ifndef SQLITE_OMIT_SHARED_CACHE
                     63: /*
                     64: ** Enable or disable the shared pager and schema features.
                     65: **
                     66: ** This routine has no effect on existing database connections.
                     67: ** The shared cache setting effects only future calls to
                     68: ** sqlite3_open(), sqlite3_open16(), or sqlite3_open_v2().
                     69: */
                     70: int sqlite3_enable_shared_cache(int enable){
                     71:   sqlite3GlobalConfig.sharedCacheEnabled = enable;
                     72:   return SQLITE_OK;
                     73: }
                     74: #endif
                     75: 
                     76: 
                     77: 
                     78: #ifdef SQLITE_OMIT_SHARED_CACHE
                     79:   /*
                     80:   ** The functions querySharedCacheTableLock(), setSharedCacheTableLock(),
                     81:   ** and clearAllSharedCacheTableLocks()
                     82:   ** manipulate entries in the BtShared.pLock linked list used to store
                     83:   ** shared-cache table level locks. If the library is compiled with the
                     84:   ** shared-cache feature disabled, then there is only ever one user
                     85:   ** of each BtShared structure and so this locking is not necessary. 
                     86:   ** So define the lock related functions as no-ops.
                     87:   */
                     88:   #define querySharedCacheTableLock(a,b,c) SQLITE_OK
                     89:   #define setSharedCacheTableLock(a,b,c) SQLITE_OK
                     90:   #define clearAllSharedCacheTableLocks(a)
                     91:   #define downgradeAllSharedCacheTableLocks(a)
                     92:   #define hasSharedCacheTableLock(a,b,c,d) 1
                     93:   #define hasReadConflicts(a, b) 0
                     94: #endif
                     95: 
                     96: #ifndef SQLITE_OMIT_SHARED_CACHE
                     97: 
                     98: #ifdef SQLITE_DEBUG
                     99: /*
                    100: **** This function is only used as part of an assert() statement. ***
                    101: **
                    102: ** Check to see if pBtree holds the required locks to read or write to the 
                    103: ** table with root page iRoot.   Return 1 if it does and 0 if not.
                    104: **
                    105: ** For example, when writing to a table with root-page iRoot via 
                    106: ** Btree connection pBtree:
                    107: **
                    108: **    assert( hasSharedCacheTableLock(pBtree, iRoot, 0, WRITE_LOCK) );
                    109: **
                    110: ** When writing to an index that resides in a sharable database, the 
                    111: ** caller should have first obtained a lock specifying the root page of
                    112: ** the corresponding table. This makes things a bit more complicated,
                    113: ** as this module treats each table as a separate structure. To determine
                    114: ** the table corresponding to the index being written, this
                    115: ** function has to search through the database schema.
                    116: **
                    117: ** Instead of a lock on the table/index rooted at page iRoot, the caller may
                    118: ** hold a write-lock on the schema table (root page 1). This is also
                    119: ** acceptable.
                    120: */
                    121: static int hasSharedCacheTableLock(
                    122:   Btree *pBtree,         /* Handle that must hold lock */
                    123:   Pgno iRoot,            /* Root page of b-tree */
                    124:   int isIndex,           /* True if iRoot is the root of an index b-tree */
                    125:   int eLockType          /* Required lock type (READ_LOCK or WRITE_LOCK) */
                    126: ){
                    127:   Schema *pSchema = (Schema *)pBtree->pBt->pSchema;
                    128:   Pgno iTab = 0;
                    129:   BtLock *pLock;
                    130: 
                    131:   /* If this database is not shareable, or if the client is reading
                    132:   ** and has the read-uncommitted flag set, then no lock is required. 
                    133:   ** Return true immediately.
                    134:   */
                    135:   if( (pBtree->sharable==0)
                    136:    || (eLockType==READ_LOCK && (pBtree->db->flags & SQLITE_ReadUncommitted))
                    137:   ){
                    138:     return 1;
                    139:   }
                    140: 
                    141:   /* If the client is reading  or writing an index and the schema is
                    142:   ** not loaded, then it is too difficult to actually check to see if
                    143:   ** the correct locks are held.  So do not bother - just return true.
                    144:   ** This case does not come up very often anyhow.
                    145:   */
                    146:   if( isIndex && (!pSchema || (pSchema->flags&DB_SchemaLoaded)==0) ){
                    147:     return 1;
                    148:   }
                    149: 
                    150:   /* Figure out the root-page that the lock should be held on. For table
                    151:   ** b-trees, this is just the root page of the b-tree being read or
                    152:   ** written. For index b-trees, it is the root page of the associated
                    153:   ** table.  */
                    154:   if( isIndex ){
                    155:     HashElem *p;
                    156:     for(p=sqliteHashFirst(&pSchema->idxHash); p; p=sqliteHashNext(p)){
                    157:       Index *pIdx = (Index *)sqliteHashData(p);
                    158:       if( pIdx->tnum==(int)iRoot ){
                    159:         iTab = pIdx->pTable->tnum;
                    160:       }
                    161:     }
                    162:   }else{
                    163:     iTab = iRoot;
                    164:   }
                    165: 
                    166:   /* Search for the required lock. Either a write-lock on root-page iTab, a 
                    167:   ** write-lock on the schema table, or (if the client is reading) a
                    168:   ** read-lock on iTab will suffice. Return 1 if any of these are found.  */
                    169:   for(pLock=pBtree->pBt->pLock; pLock; pLock=pLock->pNext){
                    170:     if( pLock->pBtree==pBtree 
                    171:      && (pLock->iTable==iTab || (pLock->eLock==WRITE_LOCK && pLock->iTable==1))
                    172:      && pLock->eLock>=eLockType 
                    173:     ){
                    174:       return 1;
                    175:     }
                    176:   }
                    177: 
                    178:   /* Failed to find the required lock. */
                    179:   return 0;
                    180: }
                    181: #endif /* SQLITE_DEBUG */
                    182: 
                    183: #ifdef SQLITE_DEBUG
                    184: /*
                    185: **** This function may be used as part of assert() statements only. ****
                    186: **
                    187: ** Return true if it would be illegal for pBtree to write into the
                    188: ** table or index rooted at iRoot because other shared connections are
                    189: ** simultaneously reading that same table or index.
                    190: **
                    191: ** It is illegal for pBtree to write if some other Btree object that
                    192: ** shares the same BtShared object is currently reading or writing
                    193: ** the iRoot table.  Except, if the other Btree object has the
                    194: ** read-uncommitted flag set, then it is OK for the other object to
                    195: ** have a read cursor.
                    196: **
                    197: ** For example, before writing to any part of the table or index
                    198: ** rooted at page iRoot, one should call:
                    199: **
                    200: **    assert( !hasReadConflicts(pBtree, iRoot) );
                    201: */
                    202: static int hasReadConflicts(Btree *pBtree, Pgno iRoot){
                    203:   BtCursor *p;
                    204:   for(p=pBtree->pBt->pCursor; p; p=p->pNext){
                    205:     if( p->pgnoRoot==iRoot 
                    206:      && p->pBtree!=pBtree
                    207:      && 0==(p->pBtree->db->flags & SQLITE_ReadUncommitted)
                    208:     ){
                    209:       return 1;
                    210:     }
                    211:   }
                    212:   return 0;
                    213: }
                    214: #endif    /* #ifdef SQLITE_DEBUG */
                    215: 
                    216: /*
                    217: ** Query to see if Btree handle p may obtain a lock of type eLock 
                    218: ** (READ_LOCK or WRITE_LOCK) on the table with root-page iTab. Return
                    219: ** SQLITE_OK if the lock may be obtained (by calling
                    220: ** setSharedCacheTableLock()), or SQLITE_LOCKED if not.
                    221: */
                    222: static int querySharedCacheTableLock(Btree *p, Pgno iTab, u8 eLock){
                    223:   BtShared *pBt = p->pBt;
                    224:   BtLock *pIter;
                    225: 
                    226:   assert( sqlite3BtreeHoldsMutex(p) );
                    227:   assert( eLock==READ_LOCK || eLock==WRITE_LOCK );
                    228:   assert( p->db!=0 );
                    229:   assert( !(p->db->flags&SQLITE_ReadUncommitted)||eLock==WRITE_LOCK||iTab==1 );
                    230:   
                    231:   /* If requesting a write-lock, then the Btree must have an open write
                    232:   ** transaction on this file. And, obviously, for this to be so there 
                    233:   ** must be an open write transaction on the file itself.
                    234:   */
                    235:   assert( eLock==READ_LOCK || (p==pBt->pWriter && p->inTrans==TRANS_WRITE) );
                    236:   assert( eLock==READ_LOCK || pBt->inTransaction==TRANS_WRITE );
                    237:   
                    238:   /* This routine is a no-op if the shared-cache is not enabled */
                    239:   if( !p->sharable ){
                    240:     return SQLITE_OK;
                    241:   }
                    242: 
                    243:   /* If some other connection is holding an exclusive lock, the
                    244:   ** requested lock may not be obtained.
                    245:   */
                    246:   if( pBt->pWriter!=p && (pBt->btsFlags & BTS_EXCLUSIVE)!=0 ){
                    247:     sqlite3ConnectionBlocked(p->db, pBt->pWriter->db);
                    248:     return SQLITE_LOCKED_SHAREDCACHE;
                    249:   }
                    250: 
                    251:   for(pIter=pBt->pLock; pIter; pIter=pIter->pNext){
                    252:     /* The condition (pIter->eLock!=eLock) in the following if(...) 
                    253:     ** statement is a simplification of:
                    254:     **
                    255:     **   (eLock==WRITE_LOCK || pIter->eLock==WRITE_LOCK)
                    256:     **
                    257:     ** since we know that if eLock==WRITE_LOCK, then no other connection
                    258:     ** may hold a WRITE_LOCK on any table in this file (since there can
                    259:     ** only be a single writer).
                    260:     */
                    261:     assert( pIter->eLock==READ_LOCK || pIter->eLock==WRITE_LOCK );
                    262:     assert( eLock==READ_LOCK || pIter->pBtree==p || pIter->eLock==READ_LOCK);
                    263:     if( pIter->pBtree!=p && pIter->iTable==iTab && pIter->eLock!=eLock ){
                    264:       sqlite3ConnectionBlocked(p->db, pIter->pBtree->db);
                    265:       if( eLock==WRITE_LOCK ){
                    266:         assert( p==pBt->pWriter );
                    267:         pBt->btsFlags |= BTS_PENDING;
                    268:       }
                    269:       return SQLITE_LOCKED_SHAREDCACHE;
                    270:     }
                    271:   }
                    272:   return SQLITE_OK;
                    273: }
                    274: #endif /* !SQLITE_OMIT_SHARED_CACHE */
                    275: 
                    276: #ifndef SQLITE_OMIT_SHARED_CACHE
                    277: /*
                    278: ** Add a lock on the table with root-page iTable to the shared-btree used
                    279: ** by Btree handle p. Parameter eLock must be either READ_LOCK or 
                    280: ** WRITE_LOCK.
                    281: **
                    282: ** This function assumes the following:
                    283: **
                    284: **   (a) The specified Btree object p is connected to a sharable
                    285: **       database (one with the BtShared.sharable flag set), and
                    286: **
                    287: **   (b) No other Btree objects hold a lock that conflicts
                    288: **       with the requested lock (i.e. querySharedCacheTableLock() has
                    289: **       already been called and returned SQLITE_OK).
                    290: **
                    291: ** SQLITE_OK is returned if the lock is added successfully. SQLITE_NOMEM 
                    292: ** is returned if a malloc attempt fails.
                    293: */
                    294: static int setSharedCacheTableLock(Btree *p, Pgno iTable, u8 eLock){
                    295:   BtShared *pBt = p->pBt;
                    296:   BtLock *pLock = 0;
                    297:   BtLock *pIter;
                    298: 
                    299:   assert( sqlite3BtreeHoldsMutex(p) );
                    300:   assert( eLock==READ_LOCK || eLock==WRITE_LOCK );
                    301:   assert( p->db!=0 );
                    302: 
                    303:   /* A connection with the read-uncommitted flag set will never try to
                    304:   ** obtain a read-lock using this function. The only read-lock obtained
                    305:   ** by a connection in read-uncommitted mode is on the sqlite_master 
                    306:   ** table, and that lock is obtained in BtreeBeginTrans().  */
                    307:   assert( 0==(p->db->flags&SQLITE_ReadUncommitted) || eLock==WRITE_LOCK );
                    308: 
                    309:   /* This function should only be called on a sharable b-tree after it 
                    310:   ** has been determined that no other b-tree holds a conflicting lock.  */
                    311:   assert( p->sharable );
                    312:   assert( SQLITE_OK==querySharedCacheTableLock(p, iTable, eLock) );
                    313: 
                    314:   /* First search the list for an existing lock on this table. */
                    315:   for(pIter=pBt->pLock; pIter; pIter=pIter->pNext){
                    316:     if( pIter->iTable==iTable && pIter->pBtree==p ){
                    317:       pLock = pIter;
                    318:       break;
                    319:     }
                    320:   }
                    321: 
                    322:   /* If the above search did not find a BtLock struct associating Btree p
                    323:   ** with table iTable, allocate one and link it into the list.
                    324:   */
                    325:   if( !pLock ){
                    326:     pLock = (BtLock *)sqlite3MallocZero(sizeof(BtLock));
                    327:     if( !pLock ){
                    328:       return SQLITE_NOMEM;
                    329:     }
                    330:     pLock->iTable = iTable;
                    331:     pLock->pBtree = p;
                    332:     pLock->pNext = pBt->pLock;
                    333:     pBt->pLock = pLock;
                    334:   }
                    335: 
                    336:   /* Set the BtLock.eLock variable to the maximum of the current lock
                    337:   ** and the requested lock. This means if a write-lock was already held
                    338:   ** and a read-lock requested, we don't incorrectly downgrade the lock.
                    339:   */
                    340:   assert( WRITE_LOCK>READ_LOCK );
                    341:   if( eLock>pLock->eLock ){
                    342:     pLock->eLock = eLock;
                    343:   }
                    344: 
                    345:   return SQLITE_OK;
                    346: }
                    347: #endif /* !SQLITE_OMIT_SHARED_CACHE */
                    348: 
                    349: #ifndef SQLITE_OMIT_SHARED_CACHE
                    350: /*
                    351: ** Release all the table locks (locks obtained via calls to
                    352: ** the setSharedCacheTableLock() procedure) held by Btree object p.
                    353: **
                    354: ** This function assumes that Btree p has an open read or write 
                    355: ** transaction. If it does not, then the BTS_PENDING flag
                    356: ** may be incorrectly cleared.
                    357: */
                    358: static void clearAllSharedCacheTableLocks(Btree *p){
                    359:   BtShared *pBt = p->pBt;
                    360:   BtLock **ppIter = &pBt->pLock;
                    361: 
                    362:   assert( sqlite3BtreeHoldsMutex(p) );
                    363:   assert( p->sharable || 0==*ppIter );
                    364:   assert( p->inTrans>0 );
                    365: 
                    366:   while( *ppIter ){
                    367:     BtLock *pLock = *ppIter;
                    368:     assert( (pBt->btsFlags & BTS_EXCLUSIVE)==0 || pBt->pWriter==pLock->pBtree );
                    369:     assert( pLock->pBtree->inTrans>=pLock->eLock );
                    370:     if( pLock->pBtree==p ){
                    371:       *ppIter = pLock->pNext;
                    372:       assert( pLock->iTable!=1 || pLock==&p->lock );
                    373:       if( pLock->iTable!=1 ){
                    374:         sqlite3_free(pLock);
                    375:       }
                    376:     }else{
                    377:       ppIter = &pLock->pNext;
                    378:     }
                    379:   }
                    380: 
                    381:   assert( (pBt->btsFlags & BTS_PENDING)==0 || pBt->pWriter );
                    382:   if( pBt->pWriter==p ){
                    383:     pBt->pWriter = 0;
                    384:     pBt->btsFlags &= ~(BTS_EXCLUSIVE|BTS_PENDING);
                    385:   }else if( pBt->nTransaction==2 ){
                    386:     /* This function is called when Btree p is concluding its 
                    387:     ** transaction. If there currently exists a writer, and p is not
                    388:     ** that writer, then the number of locks held by connections other
                    389:     ** than the writer must be about to drop to zero. In this case
                    390:     ** set the BTS_PENDING flag to 0.
                    391:     **
                    392:     ** If there is not currently a writer, then BTS_PENDING must
                    393:     ** be zero already. So this next line is harmless in that case.
                    394:     */
                    395:     pBt->btsFlags &= ~BTS_PENDING;
                    396:   }
                    397: }
                    398: 
                    399: /*
                    400: ** This function changes all write-locks held by Btree p into read-locks.
                    401: */
                    402: static void downgradeAllSharedCacheTableLocks(Btree *p){
                    403:   BtShared *pBt = p->pBt;
                    404:   if( pBt->pWriter==p ){
                    405:     BtLock *pLock;
                    406:     pBt->pWriter = 0;
                    407:     pBt->btsFlags &= ~(BTS_EXCLUSIVE|BTS_PENDING);
                    408:     for(pLock=pBt->pLock; pLock; pLock=pLock->pNext){
                    409:       assert( pLock->eLock==READ_LOCK || pLock->pBtree==p );
                    410:       pLock->eLock = READ_LOCK;
                    411:     }
                    412:   }
                    413: }
                    414: 
                    415: #endif /* SQLITE_OMIT_SHARED_CACHE */
                    416: 
                    417: static void releasePage(MemPage *pPage);  /* Forward reference */
                    418: 
                    419: /*
                    420: ***** This routine is used inside of assert() only ****
                    421: **
                    422: ** Verify that the cursor holds the mutex on its BtShared
                    423: */
                    424: #ifdef SQLITE_DEBUG
                    425: static int cursorHoldsMutex(BtCursor *p){
                    426:   return sqlite3_mutex_held(p->pBt->mutex);
                    427: }
                    428: #endif
                    429: 
                    430: 
                    431: #ifndef SQLITE_OMIT_INCRBLOB
                    432: /*
                    433: ** Invalidate the overflow page-list cache for cursor pCur, if any.
                    434: */
                    435: static void invalidateOverflowCache(BtCursor *pCur){
                    436:   assert( cursorHoldsMutex(pCur) );
                    437:   sqlite3_free(pCur->aOverflow);
                    438:   pCur->aOverflow = 0;
                    439: }
                    440: 
                    441: /*
                    442: ** Invalidate the overflow page-list cache for all cursors opened
                    443: ** on the shared btree structure pBt.
                    444: */
                    445: static void invalidateAllOverflowCache(BtShared *pBt){
                    446:   BtCursor *p;
                    447:   assert( sqlite3_mutex_held(pBt->mutex) );
                    448:   for(p=pBt->pCursor; p; p=p->pNext){
                    449:     invalidateOverflowCache(p);
                    450:   }
                    451: }
                    452: 
                    453: /*
                    454: ** This function is called before modifying the contents of a table
                    455: ** to invalidate any incrblob cursors that are open on the
                    456: ** row or one of the rows being modified.
                    457: **
                    458: ** If argument isClearTable is true, then the entire contents of the
                    459: ** table is about to be deleted. In this case invalidate all incrblob
                    460: ** cursors open on any row within the table with root-page pgnoRoot.
                    461: **
                    462: ** Otherwise, if argument isClearTable is false, then the row with
                    463: ** rowid iRow is being replaced or deleted. In this case invalidate
                    464: ** only those incrblob cursors open on that specific row.
                    465: */
                    466: static void invalidateIncrblobCursors(
                    467:   Btree *pBtree,          /* The database file to check */
                    468:   i64 iRow,               /* The rowid that might be changing */
                    469:   int isClearTable        /* True if all rows are being deleted */
                    470: ){
                    471:   BtCursor *p;
                    472:   BtShared *pBt = pBtree->pBt;
                    473:   assert( sqlite3BtreeHoldsMutex(pBtree) );
                    474:   for(p=pBt->pCursor; p; p=p->pNext){
                    475:     if( p->isIncrblobHandle && (isClearTable || p->info.nKey==iRow) ){
                    476:       p->eState = CURSOR_INVALID;
                    477:     }
                    478:   }
                    479: }
                    480: 
                    481: #else
                    482:   /* Stub functions when INCRBLOB is omitted */
                    483:   #define invalidateOverflowCache(x)
                    484:   #define invalidateAllOverflowCache(x)
                    485:   #define invalidateIncrblobCursors(x,y,z)
                    486: #endif /* SQLITE_OMIT_INCRBLOB */
                    487: 
                    488: /*
                    489: ** Set bit pgno of the BtShared.pHasContent bitvec. This is called 
                    490: ** when a page that previously contained data becomes a free-list leaf 
                    491: ** page.
                    492: **
                    493: ** The BtShared.pHasContent bitvec exists to work around an obscure
                    494: ** bug caused by the interaction of two useful IO optimizations surrounding
                    495: ** free-list leaf pages:
                    496: **
                    497: **   1) When all data is deleted from a page and the page becomes
                    498: **      a free-list leaf page, the page is not written to the database
                    499: **      (as free-list leaf pages contain no meaningful data). Sometimes
                    500: **      such a page is not even journalled (as it will not be modified,
                    501: **      why bother journalling it?).
                    502: **
                    503: **   2) When a free-list leaf page is reused, its content is not read
                    504: **      from the database or written to the journal file (why should it
                    505: **      be, if it is not at all meaningful?).
                    506: **
                    507: ** By themselves, these optimizations work fine and provide a handy
                    508: ** performance boost to bulk delete or insert operations. However, if
                    509: ** a page is moved to the free-list and then reused within the same
                    510: ** transaction, a problem comes up. If the page is not journalled when
                    511: ** it is moved to the free-list and it is also not journalled when it
                    512: ** is extracted from the free-list and reused, then the original data
                    513: ** may be lost. In the event of a rollback, it may not be possible
                    514: ** to restore the database to its original configuration.
                    515: **
                    516: ** The solution is the BtShared.pHasContent bitvec. Whenever a page is 
                    517: ** moved to become a free-list leaf page, the corresponding bit is
                    518: ** set in the bitvec. Whenever a leaf page is extracted from the free-list,
                    519: ** optimization 2 above is omitted if the corresponding bit is already
                    520: ** set in BtShared.pHasContent. The contents of the bitvec are cleared
                    521: ** at the end of every transaction.
                    522: */
                    523: static int btreeSetHasContent(BtShared *pBt, Pgno pgno){
                    524:   int rc = SQLITE_OK;
                    525:   if( !pBt->pHasContent ){
                    526:     assert( pgno<=pBt->nPage );
                    527:     pBt->pHasContent = sqlite3BitvecCreate(pBt->nPage);
                    528:     if( !pBt->pHasContent ){
                    529:       rc = SQLITE_NOMEM;
                    530:     }
                    531:   }
                    532:   if( rc==SQLITE_OK && pgno<=sqlite3BitvecSize(pBt->pHasContent) ){
                    533:     rc = sqlite3BitvecSet(pBt->pHasContent, pgno);
                    534:   }
                    535:   return rc;
                    536: }
                    537: 
                    538: /*
                    539: ** Query the BtShared.pHasContent vector.
                    540: **
                    541: ** This function is called when a free-list leaf page is removed from the
                    542: ** free-list for reuse. It returns false if it is safe to retrieve the
                    543: ** page from the pager layer with the 'no-content' flag set. True otherwise.
                    544: */
                    545: static int btreeGetHasContent(BtShared *pBt, Pgno pgno){
                    546:   Bitvec *p = pBt->pHasContent;
                    547:   return (p && (pgno>sqlite3BitvecSize(p) || sqlite3BitvecTest(p, pgno)));
                    548: }
                    549: 
                    550: /*
                    551: ** Clear (destroy) the BtShared.pHasContent bitvec. This should be
                    552: ** invoked at the conclusion of each write-transaction.
                    553: */
                    554: static void btreeClearHasContent(BtShared *pBt){
                    555:   sqlite3BitvecDestroy(pBt->pHasContent);
                    556:   pBt->pHasContent = 0;
                    557: }
                    558: 
                    559: /*
                    560: ** Save the current cursor position in the variables BtCursor.nKey 
                    561: ** and BtCursor.pKey. The cursor's state is set to CURSOR_REQUIRESEEK.
                    562: **
                    563: ** The caller must ensure that the cursor is valid (has eState==CURSOR_VALID)
                    564: ** prior to calling this routine.  
                    565: */
                    566: static int saveCursorPosition(BtCursor *pCur){
                    567:   int rc;
                    568: 
                    569:   assert( CURSOR_VALID==pCur->eState );
                    570:   assert( 0==pCur->pKey );
                    571:   assert( cursorHoldsMutex(pCur) );
                    572: 
                    573:   rc = sqlite3BtreeKeySize(pCur, &pCur->nKey);
                    574:   assert( rc==SQLITE_OK );  /* KeySize() cannot fail */
                    575: 
                    576:   /* If this is an intKey table, then the above call to BtreeKeySize()
                    577:   ** stores the integer key in pCur->nKey. In this case this value is
                    578:   ** all that is required. Otherwise, if pCur is not open on an intKey
                    579:   ** table, then malloc space for and store the pCur->nKey bytes of key 
                    580:   ** data.
                    581:   */
                    582:   if( 0==pCur->apPage[0]->intKey ){
                    583:     void *pKey = sqlite3Malloc( (int)pCur->nKey );
                    584:     if( pKey ){
                    585:       rc = sqlite3BtreeKey(pCur, 0, (int)pCur->nKey, pKey);
                    586:       if( rc==SQLITE_OK ){
                    587:         pCur->pKey = pKey;
                    588:       }else{
                    589:         sqlite3_free(pKey);
                    590:       }
                    591:     }else{
                    592:       rc = SQLITE_NOMEM;
                    593:     }
                    594:   }
                    595:   assert( !pCur->apPage[0]->intKey || !pCur->pKey );
                    596: 
                    597:   if( rc==SQLITE_OK ){
                    598:     int i;
                    599:     for(i=0; i<=pCur->iPage; i++){
                    600:       releasePage(pCur->apPage[i]);
                    601:       pCur->apPage[i] = 0;
                    602:     }
                    603:     pCur->iPage = -1;
                    604:     pCur->eState = CURSOR_REQUIRESEEK;
                    605:   }
                    606: 
                    607:   invalidateOverflowCache(pCur);
                    608:   return rc;
                    609: }
                    610: 
                    611: /*
                    612: ** Save the positions of all cursors (except pExcept) that are open on
                    613: ** the table  with root-page iRoot. Usually, this is called just before cursor
                    614: ** pExcept is used to modify the table (BtreeDelete() or BtreeInsert()).
                    615: */
                    616: static int saveAllCursors(BtShared *pBt, Pgno iRoot, BtCursor *pExcept){
                    617:   BtCursor *p;
                    618:   assert( sqlite3_mutex_held(pBt->mutex) );
                    619:   assert( pExcept==0 || pExcept->pBt==pBt );
                    620:   for(p=pBt->pCursor; p; p=p->pNext){
                    621:     if( p!=pExcept && (0==iRoot || p->pgnoRoot==iRoot) && 
                    622:         p->eState==CURSOR_VALID ){
                    623:       int rc = saveCursorPosition(p);
                    624:       if( SQLITE_OK!=rc ){
                    625:         return rc;
                    626:       }
                    627:     }
                    628:   }
                    629:   return SQLITE_OK;
                    630: }
                    631: 
                    632: /*
                    633: ** Clear the current cursor position.
                    634: */
                    635: void sqlite3BtreeClearCursor(BtCursor *pCur){
                    636:   assert( cursorHoldsMutex(pCur) );
                    637:   sqlite3_free(pCur->pKey);
                    638:   pCur->pKey = 0;
                    639:   pCur->eState = CURSOR_INVALID;
                    640: }
                    641: 
                    642: /*
                    643: ** In this version of BtreeMoveto, pKey is a packed index record
                    644: ** such as is generated by the OP_MakeRecord opcode.  Unpack the
                    645: ** record and then call BtreeMovetoUnpacked() to do the work.
                    646: */
                    647: static int btreeMoveto(
                    648:   BtCursor *pCur,     /* Cursor open on the btree to be searched */
                    649:   const void *pKey,   /* Packed key if the btree is an index */
                    650:   i64 nKey,           /* Integer key for tables.  Size of pKey for indices */
                    651:   int bias,           /* Bias search to the high end */
                    652:   int *pRes           /* Write search results here */
                    653: ){
                    654:   int rc;                    /* Status code */
                    655:   UnpackedRecord *pIdxKey;   /* Unpacked index key */
                    656:   char aSpace[150];          /* Temp space for pIdxKey - to avoid a malloc */
                    657:   char *pFree = 0;
                    658: 
                    659:   if( pKey ){
                    660:     assert( nKey==(i64)(int)nKey );
                    661:     pIdxKey = sqlite3VdbeAllocUnpackedRecord(
                    662:         pCur->pKeyInfo, aSpace, sizeof(aSpace), &pFree
                    663:     );
                    664:     if( pIdxKey==0 ) return SQLITE_NOMEM;
                    665:     sqlite3VdbeRecordUnpack(pCur->pKeyInfo, (int)nKey, pKey, pIdxKey);
                    666:   }else{
                    667:     pIdxKey = 0;
                    668:   }
                    669:   rc = sqlite3BtreeMovetoUnpacked(pCur, pIdxKey, nKey, bias, pRes);
                    670:   if( pFree ){
                    671:     sqlite3DbFree(pCur->pKeyInfo->db, pFree);
                    672:   }
                    673:   return rc;
                    674: }
                    675: 
                    676: /*
                    677: ** Restore the cursor to the position it was in (or as close to as possible)
                    678: ** when saveCursorPosition() was called. Note that this call deletes the 
                    679: ** saved position info stored by saveCursorPosition(), so there can be
                    680: ** at most one effective restoreCursorPosition() call after each 
                    681: ** saveCursorPosition().
                    682: */
                    683: static int btreeRestoreCursorPosition(BtCursor *pCur){
                    684:   int rc;
                    685:   assert( cursorHoldsMutex(pCur) );
                    686:   assert( pCur->eState>=CURSOR_REQUIRESEEK );
                    687:   if( pCur->eState==CURSOR_FAULT ){
                    688:     return pCur->skipNext;
                    689:   }
                    690:   pCur->eState = CURSOR_INVALID;
                    691:   rc = btreeMoveto(pCur, pCur->pKey, pCur->nKey, 0, &pCur->skipNext);
                    692:   if( rc==SQLITE_OK ){
                    693:     sqlite3_free(pCur->pKey);
                    694:     pCur->pKey = 0;
                    695:     assert( pCur->eState==CURSOR_VALID || pCur->eState==CURSOR_INVALID );
                    696:   }
                    697:   return rc;
                    698: }
                    699: 
                    700: #define restoreCursorPosition(p) \
                    701:   (p->eState>=CURSOR_REQUIRESEEK ? \
                    702:          btreeRestoreCursorPosition(p) : \
                    703:          SQLITE_OK)
                    704: 
                    705: /*
                    706: ** Determine whether or not a cursor has moved from the position it
                    707: ** was last placed at.  Cursors can move when the row they are pointing
                    708: ** at is deleted out from under them.
                    709: **
                    710: ** This routine returns an error code if something goes wrong.  The
                    711: ** integer *pHasMoved is set to one if the cursor has moved and 0 if not.
                    712: */
                    713: int sqlite3BtreeCursorHasMoved(BtCursor *pCur, int *pHasMoved){
                    714:   int rc;
                    715: 
                    716:   rc = restoreCursorPosition(pCur);
                    717:   if( rc ){
                    718:     *pHasMoved = 1;
                    719:     return rc;
                    720:   }
                    721:   if( pCur->eState!=CURSOR_VALID || pCur->skipNext!=0 ){
                    722:     *pHasMoved = 1;
                    723:   }else{
                    724:     *pHasMoved = 0;
                    725:   }
                    726:   return SQLITE_OK;
                    727: }
                    728: 
                    729: #ifndef SQLITE_OMIT_AUTOVACUUM
                    730: /*
                    731: ** Given a page number of a regular database page, return the page
                    732: ** number for the pointer-map page that contains the entry for the
                    733: ** input page number.
                    734: **
                    735: ** Return 0 (not a valid page) for pgno==1 since there is
                    736: ** no pointer map associated with page 1.  The integrity_check logic
                    737: ** requires that ptrmapPageno(*,1)!=1.
                    738: */
                    739: static Pgno ptrmapPageno(BtShared *pBt, Pgno pgno){
                    740:   int nPagesPerMapPage;
                    741:   Pgno iPtrMap, ret;
                    742:   assert( sqlite3_mutex_held(pBt->mutex) );
                    743:   if( pgno<2 ) return 0;
                    744:   nPagesPerMapPage = (pBt->usableSize/5)+1;
                    745:   iPtrMap = (pgno-2)/nPagesPerMapPage;
                    746:   ret = (iPtrMap*nPagesPerMapPage) + 2; 
                    747:   if( ret==PENDING_BYTE_PAGE(pBt) ){
                    748:     ret++;
                    749:   }
                    750:   return ret;
                    751: }
                    752: 
                    753: /*
                    754: ** Write an entry into the pointer map.
                    755: **
                    756: ** This routine updates the pointer map entry for page number 'key'
                    757: ** so that it maps to type 'eType' and parent page number 'pgno'.
                    758: **
                    759: ** If *pRC is initially non-zero (non-SQLITE_OK) then this routine is
                    760: ** a no-op.  If an error occurs, the appropriate error code is written
                    761: ** into *pRC.
                    762: */
                    763: static void ptrmapPut(BtShared *pBt, Pgno key, u8 eType, Pgno parent, int *pRC){
                    764:   DbPage *pDbPage;  /* The pointer map page */
                    765:   u8 *pPtrmap;      /* The pointer map data */
                    766:   Pgno iPtrmap;     /* The pointer map page number */
                    767:   int offset;       /* Offset in pointer map page */
                    768:   int rc;           /* Return code from subfunctions */
                    769: 
                    770:   if( *pRC ) return;
                    771: 
                    772:   assert( sqlite3_mutex_held(pBt->mutex) );
                    773:   /* The master-journal page number must never be used as a pointer map page */
                    774:   assert( 0==PTRMAP_ISPAGE(pBt, PENDING_BYTE_PAGE(pBt)) );
                    775: 
                    776:   assert( pBt->autoVacuum );
                    777:   if( key==0 ){
                    778:     *pRC = SQLITE_CORRUPT_BKPT;
                    779:     return;
                    780:   }
                    781:   iPtrmap = PTRMAP_PAGENO(pBt, key);
                    782:   rc = sqlite3PagerGet(pBt->pPager, iPtrmap, &pDbPage);
                    783:   if( rc!=SQLITE_OK ){
                    784:     *pRC = rc;
                    785:     return;
                    786:   }
                    787:   offset = PTRMAP_PTROFFSET(iPtrmap, key);
                    788:   if( offset<0 ){
                    789:     *pRC = SQLITE_CORRUPT_BKPT;
                    790:     goto ptrmap_exit;
                    791:   }
                    792:   assert( offset <= (int)pBt->usableSize-5 );
                    793:   pPtrmap = (u8 *)sqlite3PagerGetData(pDbPage);
                    794: 
                    795:   if( eType!=pPtrmap[offset] || get4byte(&pPtrmap[offset+1])!=parent ){
                    796:     TRACE(("PTRMAP_UPDATE: %d->(%d,%d)\n", key, eType, parent));
                    797:     *pRC= rc = sqlite3PagerWrite(pDbPage);
                    798:     if( rc==SQLITE_OK ){
                    799:       pPtrmap[offset] = eType;
                    800:       put4byte(&pPtrmap[offset+1], parent);
                    801:     }
                    802:   }
                    803: 
                    804: ptrmap_exit:
                    805:   sqlite3PagerUnref(pDbPage);
                    806: }
                    807: 
                    808: /*
                    809: ** Read an entry from the pointer map.
                    810: **
                    811: ** This routine retrieves the pointer map entry for page 'key', writing
                    812: ** the type and parent page number to *pEType and *pPgno respectively.
                    813: ** An error code is returned if something goes wrong, otherwise SQLITE_OK.
                    814: */
                    815: static int ptrmapGet(BtShared *pBt, Pgno key, u8 *pEType, Pgno *pPgno){
                    816:   DbPage *pDbPage;   /* The pointer map page */
                    817:   int iPtrmap;       /* Pointer map page index */
                    818:   u8 *pPtrmap;       /* Pointer map page data */
                    819:   int offset;        /* Offset of entry in pointer map */
                    820:   int rc;
                    821: 
                    822:   assert( sqlite3_mutex_held(pBt->mutex) );
                    823: 
                    824:   iPtrmap = PTRMAP_PAGENO(pBt, key);
                    825:   rc = sqlite3PagerGet(pBt->pPager, iPtrmap, &pDbPage);
                    826:   if( rc!=0 ){
                    827:     return rc;
                    828:   }
                    829:   pPtrmap = (u8 *)sqlite3PagerGetData(pDbPage);
                    830: 
                    831:   offset = PTRMAP_PTROFFSET(iPtrmap, key);
                    832:   if( offset<0 ){
                    833:     sqlite3PagerUnref(pDbPage);
                    834:     return SQLITE_CORRUPT_BKPT;
                    835:   }
                    836:   assert( offset <= (int)pBt->usableSize-5 );
                    837:   assert( pEType!=0 );
                    838:   *pEType = pPtrmap[offset];
                    839:   if( pPgno ) *pPgno = get4byte(&pPtrmap[offset+1]);
                    840: 
                    841:   sqlite3PagerUnref(pDbPage);
                    842:   if( *pEType<1 || *pEType>5 ) return SQLITE_CORRUPT_BKPT;
                    843:   return SQLITE_OK;
                    844: }
                    845: 
                    846: #else /* if defined SQLITE_OMIT_AUTOVACUUM */
                    847:   #define ptrmapPut(w,x,y,z,rc)
                    848:   #define ptrmapGet(w,x,y,z) SQLITE_OK
                    849:   #define ptrmapPutOvflPtr(x, y, rc)
                    850: #endif
                    851: 
                    852: /*
                    853: ** Given a btree page and a cell index (0 means the first cell on
                    854: ** the page, 1 means the second cell, and so forth) return a pointer
                    855: ** to the cell content.
                    856: **
                    857: ** This routine works only for pages that do not contain overflow cells.
                    858: */
                    859: #define findCell(P,I) \
                    860:   ((P)->aData + ((P)->maskPage & get2byte(&(P)->aCellIdx[2*(I)])))
                    861: #define findCellv2(D,M,O,I) (D+(M&get2byte(D+(O+2*(I)))))
                    862: 
                    863: 
                    864: /*
                    865: ** This a more complex version of findCell() that works for
                    866: ** pages that do contain overflow cells.
                    867: */
                    868: static u8 *findOverflowCell(MemPage *pPage, int iCell){
                    869:   int i;
                    870:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                    871:   for(i=pPage->nOverflow-1; i>=0; i--){
                    872:     int k;
                    873:     struct _OvflCell *pOvfl;
                    874:     pOvfl = &pPage->aOvfl[i];
                    875:     k = pOvfl->idx;
                    876:     if( k<=iCell ){
                    877:       if( k==iCell ){
                    878:         return pOvfl->pCell;
                    879:       }
                    880:       iCell--;
                    881:     }
                    882:   }
                    883:   return findCell(pPage, iCell);
                    884: }
                    885: 
                    886: /*
                    887: ** Parse a cell content block and fill in the CellInfo structure.  There
                    888: ** are two versions of this function.  btreeParseCell() takes a 
                    889: ** cell index as the second argument and btreeParseCellPtr() 
                    890: ** takes a pointer to the body of the cell as its second argument.
                    891: **
                    892: ** Within this file, the parseCell() macro can be called instead of
                    893: ** btreeParseCellPtr(). Using some compilers, this will be faster.
                    894: */
                    895: static void btreeParseCellPtr(
                    896:   MemPage *pPage,         /* Page containing the cell */
                    897:   u8 *pCell,              /* Pointer to the cell text. */
                    898:   CellInfo *pInfo         /* Fill in this structure */
                    899: ){
                    900:   u16 n;                  /* Number bytes in cell content header */
                    901:   u32 nPayload;           /* Number of bytes of cell payload */
                    902: 
                    903:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                    904: 
                    905:   pInfo->pCell = pCell;
                    906:   assert( pPage->leaf==0 || pPage->leaf==1 );
                    907:   n = pPage->childPtrSize;
                    908:   assert( n==4-4*pPage->leaf );
                    909:   if( pPage->intKey ){
                    910:     if( pPage->hasData ){
                    911:       n += getVarint32(&pCell[n], nPayload);
                    912:     }else{
                    913:       nPayload = 0;
                    914:     }
                    915:     n += getVarint(&pCell[n], (u64*)&pInfo->nKey);
                    916:     pInfo->nData = nPayload;
                    917:   }else{
                    918:     pInfo->nData = 0;
                    919:     n += getVarint32(&pCell[n], nPayload);
                    920:     pInfo->nKey = nPayload;
                    921:   }
                    922:   pInfo->nPayload = nPayload;
                    923:   pInfo->nHeader = n;
                    924:   testcase( nPayload==pPage->maxLocal );
                    925:   testcase( nPayload==pPage->maxLocal+1 );
                    926:   if( likely(nPayload<=pPage->maxLocal) ){
                    927:     /* This is the (easy) common case where the entire payload fits
                    928:     ** on the local page.  No overflow is required.
                    929:     */
                    930:     if( (pInfo->nSize = (u16)(n+nPayload))<4 ) pInfo->nSize = 4;
                    931:     pInfo->nLocal = (u16)nPayload;
                    932:     pInfo->iOverflow = 0;
                    933:   }else{
                    934:     /* If the payload will not fit completely on the local page, we have
                    935:     ** to decide how much to store locally and how much to spill onto
                    936:     ** overflow pages.  The strategy is to minimize the amount of unused
                    937:     ** space on overflow pages while keeping the amount of local storage
                    938:     ** in between minLocal and maxLocal.
                    939:     **
                    940:     ** Warning:  changing the way overflow payload is distributed in any
                    941:     ** way will result in an incompatible file format.
                    942:     */
                    943:     int minLocal;  /* Minimum amount of payload held locally */
                    944:     int maxLocal;  /* Maximum amount of payload held locally */
                    945:     int surplus;   /* Overflow payload available for local storage */
                    946: 
                    947:     minLocal = pPage->minLocal;
                    948:     maxLocal = pPage->maxLocal;
                    949:     surplus = minLocal + (nPayload - minLocal)%(pPage->pBt->usableSize - 4);
                    950:     testcase( surplus==maxLocal );
                    951:     testcase( surplus==maxLocal+1 );
                    952:     if( surplus <= maxLocal ){
                    953:       pInfo->nLocal = (u16)surplus;
                    954:     }else{
                    955:       pInfo->nLocal = (u16)minLocal;
                    956:     }
                    957:     pInfo->iOverflow = (u16)(pInfo->nLocal + n);
                    958:     pInfo->nSize = pInfo->iOverflow + 4;
                    959:   }
                    960: }
                    961: #define parseCell(pPage, iCell, pInfo) \
                    962:   btreeParseCellPtr((pPage), findCell((pPage), (iCell)), (pInfo))
                    963: static void btreeParseCell(
                    964:   MemPage *pPage,         /* Page containing the cell */
                    965:   int iCell,              /* The cell index.  First cell is 0 */
                    966:   CellInfo *pInfo         /* Fill in this structure */
                    967: ){
                    968:   parseCell(pPage, iCell, pInfo);
                    969: }
                    970: 
                    971: /*
                    972: ** Compute the total number of bytes that a Cell needs in the cell
                    973: ** data area of the btree-page.  The return number includes the cell
                    974: ** data header and the local payload, but not any overflow page or
                    975: ** the space used by the cell pointer.
                    976: */
                    977: static u16 cellSizePtr(MemPage *pPage, u8 *pCell){
                    978:   u8 *pIter = &pCell[pPage->childPtrSize];
                    979:   u32 nSize;
                    980: 
                    981: #ifdef SQLITE_DEBUG
                    982:   /* The value returned by this function should always be the same as
                    983:   ** the (CellInfo.nSize) value found by doing a full parse of the
                    984:   ** cell. If SQLITE_DEBUG is defined, an assert() at the bottom of
                    985:   ** this function verifies that this invariant is not violated. */
                    986:   CellInfo debuginfo;
                    987:   btreeParseCellPtr(pPage, pCell, &debuginfo);
                    988: #endif
                    989: 
                    990:   if( pPage->intKey ){
                    991:     u8 *pEnd;
                    992:     if( pPage->hasData ){
                    993:       pIter += getVarint32(pIter, nSize);
                    994:     }else{
                    995:       nSize = 0;
                    996:     }
                    997: 
                    998:     /* pIter now points at the 64-bit integer key value, a variable length 
                    999:     ** integer. The following block moves pIter to point at the first byte
                   1000:     ** past the end of the key value. */
                   1001:     pEnd = &pIter[9];
                   1002:     while( (*pIter++)&0x80 && pIter<pEnd );
                   1003:   }else{
                   1004:     pIter += getVarint32(pIter, nSize);
                   1005:   }
                   1006: 
                   1007:   testcase( nSize==pPage->maxLocal );
                   1008:   testcase( nSize==pPage->maxLocal+1 );
                   1009:   if( nSize>pPage->maxLocal ){
                   1010:     int minLocal = pPage->minLocal;
                   1011:     nSize = minLocal + (nSize - minLocal) % (pPage->pBt->usableSize - 4);
                   1012:     testcase( nSize==pPage->maxLocal );
                   1013:     testcase( nSize==pPage->maxLocal+1 );
                   1014:     if( nSize>pPage->maxLocal ){
                   1015:       nSize = minLocal;
                   1016:     }
                   1017:     nSize += 4;
                   1018:   }
                   1019:   nSize += (u32)(pIter - pCell);
                   1020: 
                   1021:   /* The minimum size of any cell is 4 bytes. */
                   1022:   if( nSize<4 ){
                   1023:     nSize = 4;
                   1024:   }
                   1025: 
                   1026:   assert( nSize==debuginfo.nSize );
                   1027:   return (u16)nSize;
                   1028: }
                   1029: 
                   1030: #ifdef SQLITE_DEBUG
                   1031: /* This variation on cellSizePtr() is used inside of assert() statements
                   1032: ** only. */
                   1033: static u16 cellSize(MemPage *pPage, int iCell){
                   1034:   return cellSizePtr(pPage, findCell(pPage, iCell));
                   1035: }
                   1036: #endif
                   1037: 
                   1038: #ifndef SQLITE_OMIT_AUTOVACUUM
                   1039: /*
                   1040: ** If the cell pCell, part of page pPage contains a pointer
                   1041: ** to an overflow page, insert an entry into the pointer-map
                   1042: ** for the overflow page.
                   1043: */
                   1044: static void ptrmapPutOvflPtr(MemPage *pPage, u8 *pCell, int *pRC){
                   1045:   CellInfo info;
                   1046:   if( *pRC ) return;
                   1047:   assert( pCell!=0 );
                   1048:   btreeParseCellPtr(pPage, pCell, &info);
                   1049:   assert( (info.nData+(pPage->intKey?0:info.nKey))==info.nPayload );
                   1050:   if( info.iOverflow ){
                   1051:     Pgno ovfl = get4byte(&pCell[info.iOverflow]);
                   1052:     ptrmapPut(pPage->pBt, ovfl, PTRMAP_OVERFLOW1, pPage->pgno, pRC);
                   1053:   }
                   1054: }
                   1055: #endif
                   1056: 
                   1057: 
                   1058: /*
                   1059: ** Defragment the page given.  All Cells are moved to the
                   1060: ** end of the page and all free space is collected into one
                   1061: ** big FreeBlk that occurs in between the header and cell
                   1062: ** pointer array and the cell content area.
                   1063: */
                   1064: static int defragmentPage(MemPage *pPage){
                   1065:   int i;                     /* Loop counter */
                   1066:   int pc;                    /* Address of a i-th cell */
                   1067:   int hdr;                   /* Offset to the page header */
                   1068:   int size;                  /* Size of a cell */
                   1069:   int usableSize;            /* Number of usable bytes on a page */
                   1070:   int cellOffset;            /* Offset to the cell pointer array */
                   1071:   int cbrk;                  /* Offset to the cell content area */
                   1072:   int nCell;                 /* Number of cells on the page */
                   1073:   unsigned char *data;       /* The page data */
                   1074:   unsigned char *temp;       /* Temp area for cell content */
                   1075:   int iCellFirst;            /* First allowable cell index */
                   1076:   int iCellLast;             /* Last possible cell index */
                   1077: 
                   1078: 
                   1079:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
                   1080:   assert( pPage->pBt!=0 );
                   1081:   assert( pPage->pBt->usableSize <= SQLITE_MAX_PAGE_SIZE );
                   1082:   assert( pPage->nOverflow==0 );
                   1083:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                   1084:   temp = sqlite3PagerTempSpace(pPage->pBt->pPager);
                   1085:   data = pPage->aData;
                   1086:   hdr = pPage->hdrOffset;
                   1087:   cellOffset = pPage->cellOffset;
                   1088:   nCell = pPage->nCell;
                   1089:   assert( nCell==get2byte(&data[hdr+3]) );
                   1090:   usableSize = pPage->pBt->usableSize;
                   1091:   cbrk = get2byte(&data[hdr+5]);
                   1092:   memcpy(&temp[cbrk], &data[cbrk], usableSize - cbrk);
                   1093:   cbrk = usableSize;
                   1094:   iCellFirst = cellOffset + 2*nCell;
                   1095:   iCellLast = usableSize - 4;
                   1096:   for(i=0; i<nCell; i++){
                   1097:     u8 *pAddr;     /* The i-th cell pointer */
                   1098:     pAddr = &data[cellOffset + i*2];
                   1099:     pc = get2byte(pAddr);
                   1100:     testcase( pc==iCellFirst );
                   1101:     testcase( pc==iCellLast );
                   1102: #if !defined(SQLITE_ENABLE_OVERSIZE_CELL_CHECK)
                   1103:     /* These conditions have already been verified in btreeInitPage()
                   1104:     ** if SQLITE_ENABLE_OVERSIZE_CELL_CHECK is defined 
                   1105:     */
                   1106:     if( pc<iCellFirst || pc>iCellLast ){
                   1107:       return SQLITE_CORRUPT_BKPT;
                   1108:     }
                   1109: #endif
                   1110:     assert( pc>=iCellFirst && pc<=iCellLast );
                   1111:     size = cellSizePtr(pPage, &temp[pc]);
                   1112:     cbrk -= size;
                   1113: #if defined(SQLITE_ENABLE_OVERSIZE_CELL_CHECK)
                   1114:     if( cbrk<iCellFirst ){
                   1115:       return SQLITE_CORRUPT_BKPT;
                   1116:     }
                   1117: #else
                   1118:     if( cbrk<iCellFirst || pc+size>usableSize ){
                   1119:       return SQLITE_CORRUPT_BKPT;
                   1120:     }
                   1121: #endif
                   1122:     assert( cbrk+size<=usableSize && cbrk>=iCellFirst );
                   1123:     testcase( cbrk+size==usableSize );
                   1124:     testcase( pc+size==usableSize );
                   1125:     memcpy(&data[cbrk], &temp[pc], size);
                   1126:     put2byte(pAddr, cbrk);
                   1127:   }
                   1128:   assert( cbrk>=iCellFirst );
                   1129:   put2byte(&data[hdr+5], cbrk);
                   1130:   data[hdr+1] = 0;
                   1131:   data[hdr+2] = 0;
                   1132:   data[hdr+7] = 0;
                   1133:   memset(&data[iCellFirst], 0, cbrk-iCellFirst);
                   1134:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
                   1135:   if( cbrk-iCellFirst!=pPage->nFree ){
                   1136:     return SQLITE_CORRUPT_BKPT;
                   1137:   }
                   1138:   return SQLITE_OK;
                   1139: }
                   1140: 
                   1141: /*
                   1142: ** Allocate nByte bytes of space from within the B-Tree page passed
                   1143: ** as the first argument. Write into *pIdx the index into pPage->aData[]
                   1144: ** of the first byte of allocated space. Return either SQLITE_OK or
                   1145: ** an error code (usually SQLITE_CORRUPT).
                   1146: **
                   1147: ** The caller guarantees that there is sufficient space to make the
                   1148: ** allocation.  This routine might need to defragment in order to bring
                   1149: ** all the space together, however.  This routine will avoid using
                   1150: ** the first two bytes past the cell pointer area since presumably this
                   1151: ** allocation is being made in order to insert a new cell, so we will
                   1152: ** also end up needing a new cell pointer.
                   1153: */
                   1154: static int allocateSpace(MemPage *pPage, int nByte, int *pIdx){
                   1155:   const int hdr = pPage->hdrOffset;    /* Local cache of pPage->hdrOffset */
                   1156:   u8 * const data = pPage->aData;      /* Local cache of pPage->aData */
                   1157:   int nFrag;                           /* Number of fragmented bytes on pPage */
                   1158:   int top;                             /* First byte of cell content area */
                   1159:   int gap;        /* First byte of gap between cell pointers and cell content */
                   1160:   int rc;         /* Integer return code */
                   1161:   int usableSize; /* Usable size of the page */
                   1162:   
                   1163:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
                   1164:   assert( pPage->pBt );
                   1165:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                   1166:   assert( nByte>=0 );  /* Minimum cell size is 4 */
                   1167:   assert( pPage->nFree>=nByte );
                   1168:   assert( pPage->nOverflow==0 );
                   1169:   usableSize = pPage->pBt->usableSize;
                   1170:   assert( nByte < usableSize-8 );
                   1171: 
                   1172:   nFrag = data[hdr+7];
                   1173:   assert( pPage->cellOffset == hdr + 12 - 4*pPage->leaf );
                   1174:   gap = pPage->cellOffset + 2*pPage->nCell;
                   1175:   top = get2byteNotZero(&data[hdr+5]);
                   1176:   if( gap>top ) return SQLITE_CORRUPT_BKPT;
                   1177:   testcase( gap+2==top );
                   1178:   testcase( gap+1==top );
                   1179:   testcase( gap==top );
                   1180: 
                   1181:   if( nFrag>=60 ){
                   1182:     /* Always defragment highly fragmented pages */
                   1183:     rc = defragmentPage(pPage);
                   1184:     if( rc ) return rc;
                   1185:     top = get2byteNotZero(&data[hdr+5]);
                   1186:   }else if( gap+2<=top ){
                   1187:     /* Search the freelist looking for a free slot big enough to satisfy 
                   1188:     ** the request. The allocation is made from the first free slot in 
                   1189:     ** the list that is large enough to accomadate it.
                   1190:     */
                   1191:     int pc, addr;
                   1192:     for(addr=hdr+1; (pc = get2byte(&data[addr]))>0; addr=pc){
                   1193:       int size;            /* Size of the free slot */
                   1194:       if( pc>usableSize-4 || pc<addr+4 ){
                   1195:         return SQLITE_CORRUPT_BKPT;
                   1196:       }
                   1197:       size = get2byte(&data[pc+2]);
                   1198:       if( size>=nByte ){
                   1199:         int x = size - nByte;
                   1200:         testcase( x==4 );
                   1201:         testcase( x==3 );
                   1202:         if( x<4 ){
                   1203:           /* Remove the slot from the free-list. Update the number of
                   1204:           ** fragmented bytes within the page. */
                   1205:           memcpy(&data[addr], &data[pc], 2);
                   1206:           data[hdr+7] = (u8)(nFrag + x);
                   1207:         }else if( size+pc > usableSize ){
                   1208:           return SQLITE_CORRUPT_BKPT;
                   1209:         }else{
                   1210:           /* The slot remains on the free-list. Reduce its size to account
                   1211:           ** for the portion used by the new allocation. */
                   1212:           put2byte(&data[pc+2], x);
                   1213:         }
                   1214:         *pIdx = pc + x;
                   1215:         return SQLITE_OK;
                   1216:       }
                   1217:     }
                   1218:   }
                   1219: 
                   1220:   /* Check to make sure there is enough space in the gap to satisfy
                   1221:   ** the allocation.  If not, defragment.
                   1222:   */
                   1223:   testcase( gap+2+nByte==top );
                   1224:   if( gap+2+nByte>top ){
                   1225:     rc = defragmentPage(pPage);
                   1226:     if( rc ) return rc;
                   1227:     top = get2byteNotZero(&data[hdr+5]);
                   1228:     assert( gap+nByte<=top );
                   1229:   }
                   1230: 
                   1231: 
                   1232:   /* Allocate memory from the gap in between the cell pointer array
                   1233:   ** and the cell content area.  The btreeInitPage() call has already
                   1234:   ** validated the freelist.  Given that the freelist is valid, there
                   1235:   ** is no way that the allocation can extend off the end of the page.
                   1236:   ** The assert() below verifies the previous sentence.
                   1237:   */
                   1238:   top -= nByte;
                   1239:   put2byte(&data[hdr+5], top);
                   1240:   assert( top+nByte <= (int)pPage->pBt->usableSize );
                   1241:   *pIdx = top;
                   1242:   return SQLITE_OK;
                   1243: }
                   1244: 
                   1245: /*
                   1246: ** Return a section of the pPage->aData to the freelist.
                   1247: ** The first byte of the new free block is pPage->aDisk[start]
                   1248: ** and the size of the block is "size" bytes.
                   1249: **
                   1250: ** Most of the effort here is involved in coalesing adjacent
                   1251: ** free blocks into a single big free block.
                   1252: */
                   1253: static int freeSpace(MemPage *pPage, int start, int size){
                   1254:   int addr, pbegin, hdr;
                   1255:   int iLast;                        /* Largest possible freeblock offset */
                   1256:   unsigned char *data = pPage->aData;
                   1257: 
                   1258:   assert( pPage->pBt!=0 );
                   1259:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
                   1260:   assert( start>=pPage->hdrOffset+6+pPage->childPtrSize );
                   1261:   assert( (start + size) <= (int)pPage->pBt->usableSize );
                   1262:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                   1263:   assert( size>=0 );   /* Minimum cell size is 4 */
                   1264: 
                   1265:   if( pPage->pBt->btsFlags & BTS_SECURE_DELETE ){
                   1266:     /* Overwrite deleted information with zeros when the secure_delete
                   1267:     ** option is enabled */
                   1268:     memset(&data[start], 0, size);
                   1269:   }
                   1270: 
                   1271:   /* Add the space back into the linked list of freeblocks.  Note that
                   1272:   ** even though the freeblock list was checked by btreeInitPage(),
                   1273:   ** btreeInitPage() did not detect overlapping cells or
                   1274:   ** freeblocks that overlapped cells.   Nor does it detect when the
                   1275:   ** cell content area exceeds the value in the page header.  If these
                   1276:   ** situations arise, then subsequent insert operations might corrupt
                   1277:   ** the freelist.  So we do need to check for corruption while scanning
                   1278:   ** the freelist.
                   1279:   */
                   1280:   hdr = pPage->hdrOffset;
                   1281:   addr = hdr + 1;
                   1282:   iLast = pPage->pBt->usableSize - 4;
                   1283:   assert( start<=iLast );
                   1284:   while( (pbegin = get2byte(&data[addr]))<start && pbegin>0 ){
                   1285:     if( pbegin<addr+4 ){
                   1286:       return SQLITE_CORRUPT_BKPT;
                   1287:     }
                   1288:     addr = pbegin;
                   1289:   }
                   1290:   if( pbegin>iLast ){
                   1291:     return SQLITE_CORRUPT_BKPT;
                   1292:   }
                   1293:   assert( pbegin>addr || pbegin==0 );
                   1294:   put2byte(&data[addr], start);
                   1295:   put2byte(&data[start], pbegin);
                   1296:   put2byte(&data[start+2], size);
                   1297:   pPage->nFree = pPage->nFree + (u16)size;
                   1298: 
                   1299:   /* Coalesce adjacent free blocks */
                   1300:   addr = hdr + 1;
                   1301:   while( (pbegin = get2byte(&data[addr]))>0 ){
                   1302:     int pnext, psize, x;
                   1303:     assert( pbegin>addr );
                   1304:     assert( pbegin <= (int)pPage->pBt->usableSize-4 );
                   1305:     pnext = get2byte(&data[pbegin]);
                   1306:     psize = get2byte(&data[pbegin+2]);
                   1307:     if( pbegin + psize + 3 >= pnext && pnext>0 ){
                   1308:       int frag = pnext - (pbegin+psize);
                   1309:       if( (frag<0) || (frag>(int)data[hdr+7]) ){
                   1310:         return SQLITE_CORRUPT_BKPT;
                   1311:       }
                   1312:       data[hdr+7] -= (u8)frag;
                   1313:       x = get2byte(&data[pnext]);
                   1314:       put2byte(&data[pbegin], x);
                   1315:       x = pnext + get2byte(&data[pnext+2]) - pbegin;
                   1316:       put2byte(&data[pbegin+2], x);
                   1317:     }else{
                   1318:       addr = pbegin;
                   1319:     }
                   1320:   }
                   1321: 
                   1322:   /* If the cell content area begins with a freeblock, remove it. */
                   1323:   if( data[hdr+1]==data[hdr+5] && data[hdr+2]==data[hdr+6] ){
                   1324:     int top;
                   1325:     pbegin = get2byte(&data[hdr+1]);
                   1326:     memcpy(&data[hdr+1], &data[pbegin], 2);
                   1327:     top = get2byte(&data[hdr+5]) + get2byte(&data[pbegin+2]);
                   1328:     put2byte(&data[hdr+5], top);
                   1329:   }
                   1330:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
                   1331:   return SQLITE_OK;
                   1332: }
                   1333: 
                   1334: /*
                   1335: ** Decode the flags byte (the first byte of the header) for a page
                   1336: ** and initialize fields of the MemPage structure accordingly.
                   1337: **
                   1338: ** Only the following combinations are supported.  Anything different
                   1339: ** indicates a corrupt database files:
                   1340: **
                   1341: **         PTF_ZERODATA
                   1342: **         PTF_ZERODATA | PTF_LEAF
                   1343: **         PTF_LEAFDATA | PTF_INTKEY
                   1344: **         PTF_LEAFDATA | PTF_INTKEY | PTF_LEAF
                   1345: */
                   1346: static int decodeFlags(MemPage *pPage, int flagByte){
                   1347:   BtShared *pBt;     /* A copy of pPage->pBt */
                   1348: 
                   1349:   assert( pPage->hdrOffset==(pPage->pgno==1 ? 100 : 0) );
                   1350:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                   1351:   pPage->leaf = (u8)(flagByte>>3);  assert( PTF_LEAF == 1<<3 );
                   1352:   flagByte &= ~PTF_LEAF;
                   1353:   pPage->childPtrSize = 4-4*pPage->leaf;
                   1354:   pBt = pPage->pBt;
                   1355:   if( flagByte==(PTF_LEAFDATA | PTF_INTKEY) ){
                   1356:     pPage->intKey = 1;
                   1357:     pPage->hasData = pPage->leaf;
                   1358:     pPage->maxLocal = pBt->maxLeaf;
                   1359:     pPage->minLocal = pBt->minLeaf;
                   1360:   }else if( flagByte==PTF_ZERODATA ){
                   1361:     pPage->intKey = 0;
                   1362:     pPage->hasData = 0;
                   1363:     pPage->maxLocal = pBt->maxLocal;
                   1364:     pPage->minLocal = pBt->minLocal;
                   1365:   }else{
                   1366:     return SQLITE_CORRUPT_BKPT;
                   1367:   }
                   1368:   pPage->max1bytePayload = pBt->max1bytePayload;
                   1369:   return SQLITE_OK;
                   1370: }
                   1371: 
                   1372: /*
                   1373: ** Initialize the auxiliary information for a disk block.
                   1374: **
                   1375: ** Return SQLITE_OK on success.  If we see that the page does
                   1376: ** not contain a well-formed database page, then return 
                   1377: ** SQLITE_CORRUPT.  Note that a return of SQLITE_OK does not
                   1378: ** guarantee that the page is well-formed.  It only shows that
                   1379: ** we failed to detect any corruption.
                   1380: */
                   1381: static int btreeInitPage(MemPage *pPage){
                   1382: 
                   1383:   assert( pPage->pBt!=0 );
                   1384:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                   1385:   assert( pPage->pgno==sqlite3PagerPagenumber(pPage->pDbPage) );
                   1386:   assert( pPage == sqlite3PagerGetExtra(pPage->pDbPage) );
                   1387:   assert( pPage->aData == sqlite3PagerGetData(pPage->pDbPage) );
                   1388: 
                   1389:   if( !pPage->isInit ){
                   1390:     u16 pc;            /* Address of a freeblock within pPage->aData[] */
                   1391:     u8 hdr;            /* Offset to beginning of page header */
                   1392:     u8 *data;          /* Equal to pPage->aData */
                   1393:     BtShared *pBt;        /* The main btree structure */
                   1394:     int usableSize;    /* Amount of usable space on each page */
                   1395:     u16 cellOffset;    /* Offset from start of page to first cell pointer */
                   1396:     int nFree;         /* Number of unused bytes on the page */
                   1397:     int top;           /* First byte of the cell content area */
                   1398:     int iCellFirst;    /* First allowable cell or freeblock offset */
                   1399:     int iCellLast;     /* Last possible cell or freeblock offset */
                   1400: 
                   1401:     pBt = pPage->pBt;
                   1402: 
                   1403:     hdr = pPage->hdrOffset;
                   1404:     data = pPage->aData;
                   1405:     if( decodeFlags(pPage, data[hdr]) ) return SQLITE_CORRUPT_BKPT;
                   1406:     assert( pBt->pageSize>=512 && pBt->pageSize<=65536 );
                   1407:     pPage->maskPage = (u16)(pBt->pageSize - 1);
                   1408:     pPage->nOverflow = 0;
                   1409:     usableSize = pBt->usableSize;
                   1410:     pPage->cellOffset = cellOffset = hdr + 12 - 4*pPage->leaf;
                   1411:     pPage->aDataEnd = &data[usableSize];
                   1412:     pPage->aCellIdx = &data[cellOffset];
                   1413:     top = get2byteNotZero(&data[hdr+5]);
                   1414:     pPage->nCell = get2byte(&data[hdr+3]);
                   1415:     if( pPage->nCell>MX_CELL(pBt) ){
                   1416:       /* To many cells for a single page.  The page must be corrupt */
                   1417:       return SQLITE_CORRUPT_BKPT;
                   1418:     }
                   1419:     testcase( pPage->nCell==MX_CELL(pBt) );
                   1420: 
                   1421:     /* A malformed database page might cause us to read past the end
                   1422:     ** of page when parsing a cell.  
                   1423:     **
                   1424:     ** The following block of code checks early to see if a cell extends
                   1425:     ** past the end of a page boundary and causes SQLITE_CORRUPT to be 
                   1426:     ** returned if it does.
                   1427:     */
                   1428:     iCellFirst = cellOffset + 2*pPage->nCell;
                   1429:     iCellLast = usableSize - 4;
                   1430: #if defined(SQLITE_ENABLE_OVERSIZE_CELL_CHECK)
                   1431:     {
                   1432:       int i;            /* Index into the cell pointer array */
                   1433:       int sz;           /* Size of a cell */
                   1434: 
                   1435:       if( !pPage->leaf ) iCellLast--;
                   1436:       for(i=0; i<pPage->nCell; i++){
                   1437:         pc = get2byte(&data[cellOffset+i*2]);
                   1438:         testcase( pc==iCellFirst );
                   1439:         testcase( pc==iCellLast );
                   1440:         if( pc<iCellFirst || pc>iCellLast ){
                   1441:           return SQLITE_CORRUPT_BKPT;
                   1442:         }
                   1443:         sz = cellSizePtr(pPage, &data[pc]);
                   1444:         testcase( pc+sz==usableSize );
                   1445:         if( pc+sz>usableSize ){
                   1446:           return SQLITE_CORRUPT_BKPT;
                   1447:         }
                   1448:       }
                   1449:       if( !pPage->leaf ) iCellLast++;
                   1450:     }  
                   1451: #endif
                   1452: 
                   1453:     /* Compute the total free space on the page */
                   1454:     pc = get2byte(&data[hdr+1]);
                   1455:     nFree = data[hdr+7] + top;
                   1456:     while( pc>0 ){
                   1457:       u16 next, size;
                   1458:       if( pc<iCellFirst || pc>iCellLast ){
                   1459:         /* Start of free block is off the page */
                   1460:         return SQLITE_CORRUPT_BKPT; 
                   1461:       }
                   1462:       next = get2byte(&data[pc]);
                   1463:       size = get2byte(&data[pc+2]);
                   1464:       if( (next>0 && next<=pc+size+3) || pc+size>usableSize ){
                   1465:         /* Free blocks must be in ascending order. And the last byte of
                   1466:        ** the free-block must lie on the database page.  */
                   1467:         return SQLITE_CORRUPT_BKPT; 
                   1468:       }
                   1469:       nFree = nFree + size;
                   1470:       pc = next;
                   1471:     }
                   1472: 
                   1473:     /* At this point, nFree contains the sum of the offset to the start
                   1474:     ** of the cell-content area plus the number of free bytes within
                   1475:     ** the cell-content area. If this is greater than the usable-size
                   1476:     ** of the page, then the page must be corrupted. This check also
                   1477:     ** serves to verify that the offset to the start of the cell-content
                   1478:     ** area, according to the page header, lies within the page.
                   1479:     */
                   1480:     if( nFree>usableSize ){
                   1481:       return SQLITE_CORRUPT_BKPT; 
                   1482:     }
                   1483:     pPage->nFree = (u16)(nFree - iCellFirst);
                   1484:     pPage->isInit = 1;
                   1485:   }
                   1486:   return SQLITE_OK;
                   1487: }
                   1488: 
                   1489: /*
                   1490: ** Set up a raw page so that it looks like a database page holding
                   1491: ** no entries.
                   1492: */
                   1493: static void zeroPage(MemPage *pPage, int flags){
                   1494:   unsigned char *data = pPage->aData;
                   1495:   BtShared *pBt = pPage->pBt;
                   1496:   u8 hdr = pPage->hdrOffset;
                   1497:   u16 first;
                   1498: 
                   1499:   assert( sqlite3PagerPagenumber(pPage->pDbPage)==pPage->pgno );
                   1500:   assert( sqlite3PagerGetExtra(pPage->pDbPage) == (void*)pPage );
                   1501:   assert( sqlite3PagerGetData(pPage->pDbPage) == data );
                   1502:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
                   1503:   assert( sqlite3_mutex_held(pBt->mutex) );
                   1504:   if( pBt->btsFlags & BTS_SECURE_DELETE ){
                   1505:     memset(&data[hdr], 0, pBt->usableSize - hdr);
                   1506:   }
                   1507:   data[hdr] = (char)flags;
                   1508:   first = hdr + 8 + 4*((flags&PTF_LEAF)==0 ?1:0);
                   1509:   memset(&data[hdr+1], 0, 4);
                   1510:   data[hdr+7] = 0;
                   1511:   put2byte(&data[hdr+5], pBt->usableSize);
                   1512:   pPage->nFree = (u16)(pBt->usableSize - first);
                   1513:   decodeFlags(pPage, flags);
                   1514:   pPage->hdrOffset = hdr;
                   1515:   pPage->cellOffset = first;
                   1516:   pPage->aDataEnd = &data[pBt->usableSize];
                   1517:   pPage->aCellIdx = &data[first];
                   1518:   pPage->nOverflow = 0;
                   1519:   assert( pBt->pageSize>=512 && pBt->pageSize<=65536 );
                   1520:   pPage->maskPage = (u16)(pBt->pageSize - 1);
                   1521:   pPage->nCell = 0;
                   1522:   pPage->isInit = 1;
                   1523: }
                   1524: 
                   1525: 
                   1526: /*
                   1527: ** Convert a DbPage obtained from the pager into a MemPage used by
                   1528: ** the btree layer.
                   1529: */
                   1530: static MemPage *btreePageFromDbPage(DbPage *pDbPage, Pgno pgno, BtShared *pBt){
                   1531:   MemPage *pPage = (MemPage*)sqlite3PagerGetExtra(pDbPage);
                   1532:   pPage->aData = sqlite3PagerGetData(pDbPage);
                   1533:   pPage->pDbPage = pDbPage;
                   1534:   pPage->pBt = pBt;
                   1535:   pPage->pgno = pgno;
                   1536:   pPage->hdrOffset = pPage->pgno==1 ? 100 : 0;
                   1537:   return pPage; 
                   1538: }
                   1539: 
                   1540: /*
                   1541: ** Get a page from the pager.  Initialize the MemPage.pBt and
                   1542: ** MemPage.aData elements if needed.
                   1543: **
                   1544: ** If the noContent flag is set, it means that we do not care about
                   1545: ** the content of the page at this time.  So do not go to the disk
                   1546: ** to fetch the content.  Just fill in the content with zeros for now.
                   1547: ** If in the future we call sqlite3PagerWrite() on this page, that
                   1548: ** means we have started to be concerned about content and the disk
                   1549: ** read should occur at that point.
                   1550: */
                   1551: static int btreeGetPage(
                   1552:   BtShared *pBt,       /* The btree */
                   1553:   Pgno pgno,           /* Number of the page to fetch */
                   1554:   MemPage **ppPage,    /* Return the page in this parameter */
                   1555:   int noContent        /* Do not load page content if true */
                   1556: ){
                   1557:   int rc;
                   1558:   DbPage *pDbPage;
                   1559: 
                   1560:   assert( sqlite3_mutex_held(pBt->mutex) );
                   1561:   rc = sqlite3PagerAcquire(pBt->pPager, pgno, (DbPage**)&pDbPage, noContent);
                   1562:   if( rc ) return rc;
                   1563:   *ppPage = btreePageFromDbPage(pDbPage, pgno, pBt);
                   1564:   return SQLITE_OK;
                   1565: }
                   1566: 
                   1567: /*
                   1568: ** Retrieve a page from the pager cache. If the requested page is not
                   1569: ** already in the pager cache return NULL. Initialize the MemPage.pBt and
                   1570: ** MemPage.aData elements if needed.
                   1571: */
                   1572: static MemPage *btreePageLookup(BtShared *pBt, Pgno pgno){
                   1573:   DbPage *pDbPage;
                   1574:   assert( sqlite3_mutex_held(pBt->mutex) );
                   1575:   pDbPage = sqlite3PagerLookup(pBt->pPager, pgno);
                   1576:   if( pDbPage ){
                   1577:     return btreePageFromDbPage(pDbPage, pgno, pBt);
                   1578:   }
                   1579:   return 0;
                   1580: }
                   1581: 
                   1582: /*
                   1583: ** Return the size of the database file in pages. If there is any kind of
                   1584: ** error, return ((unsigned int)-1).
                   1585: */
                   1586: static Pgno btreePagecount(BtShared *pBt){
                   1587:   return pBt->nPage;
                   1588: }
                   1589: u32 sqlite3BtreeLastPage(Btree *p){
                   1590:   assert( sqlite3BtreeHoldsMutex(p) );
                   1591:   assert( ((p->pBt->nPage)&0x8000000)==0 );
                   1592:   return (int)btreePagecount(p->pBt);
                   1593: }
                   1594: 
                   1595: /*
                   1596: ** Get a page from the pager and initialize it.  This routine is just a
                   1597: ** convenience wrapper around separate calls to btreeGetPage() and 
                   1598: ** btreeInitPage().
                   1599: **
                   1600: ** If an error occurs, then the value *ppPage is set to is undefined. It
                   1601: ** may remain unchanged, or it may be set to an invalid value.
                   1602: */
                   1603: static int getAndInitPage(
                   1604:   BtShared *pBt,          /* The database file */
                   1605:   Pgno pgno,           /* Number of the page to get */
                   1606:   MemPage **ppPage     /* Write the page pointer here */
                   1607: ){
                   1608:   int rc;
                   1609:   assert( sqlite3_mutex_held(pBt->mutex) );
                   1610: 
                   1611:   if( pgno>btreePagecount(pBt) ){
                   1612:     rc = SQLITE_CORRUPT_BKPT;
                   1613:   }else{
                   1614:     rc = btreeGetPage(pBt, pgno, ppPage, 0);
                   1615:     if( rc==SQLITE_OK ){
                   1616:       rc = btreeInitPage(*ppPage);
                   1617:       if( rc!=SQLITE_OK ){
                   1618:         releasePage(*ppPage);
                   1619:       }
                   1620:     }
                   1621:   }
                   1622: 
                   1623:   testcase( pgno==0 );
                   1624:   assert( pgno!=0 || rc==SQLITE_CORRUPT );
                   1625:   return rc;
                   1626: }
                   1627: 
                   1628: /*
                   1629: ** Release a MemPage.  This should be called once for each prior
                   1630: ** call to btreeGetPage.
                   1631: */
                   1632: static void releasePage(MemPage *pPage){
                   1633:   if( pPage ){
                   1634:     assert( pPage->aData );
                   1635:     assert( pPage->pBt );
                   1636:     assert( sqlite3PagerGetExtra(pPage->pDbPage) == (void*)pPage );
                   1637:     assert( sqlite3PagerGetData(pPage->pDbPage)==pPage->aData );
                   1638:     assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                   1639:     sqlite3PagerUnref(pPage->pDbPage);
                   1640:   }
                   1641: }
                   1642: 
                   1643: /*
                   1644: ** During a rollback, when the pager reloads information into the cache
                   1645: ** so that the cache is restored to its original state at the start of
                   1646: ** the transaction, for each page restored this routine is called.
                   1647: **
                   1648: ** This routine needs to reset the extra data section at the end of the
                   1649: ** page to agree with the restored data.
                   1650: */
                   1651: static void pageReinit(DbPage *pData){
                   1652:   MemPage *pPage;
                   1653:   pPage = (MemPage *)sqlite3PagerGetExtra(pData);
                   1654:   assert( sqlite3PagerPageRefcount(pData)>0 );
                   1655:   if( pPage->isInit ){
                   1656:     assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                   1657:     pPage->isInit = 0;
                   1658:     if( sqlite3PagerPageRefcount(pData)>1 ){
                   1659:       /* pPage might not be a btree page;  it might be an overflow page
                   1660:       ** or ptrmap page or a free page.  In those cases, the following
                   1661:       ** call to btreeInitPage() will likely return SQLITE_CORRUPT.
                   1662:       ** But no harm is done by this.  And it is very important that
                   1663:       ** btreeInitPage() be called on every btree page so we make
                   1664:       ** the call for every page that comes in for re-initing. */
                   1665:       btreeInitPage(pPage);
                   1666:     }
                   1667:   }
                   1668: }
                   1669: 
                   1670: /*
                   1671: ** Invoke the busy handler for a btree.
                   1672: */
                   1673: static int btreeInvokeBusyHandler(void *pArg){
                   1674:   BtShared *pBt = (BtShared*)pArg;
                   1675:   assert( pBt->db );
                   1676:   assert( sqlite3_mutex_held(pBt->db->mutex) );
                   1677:   return sqlite3InvokeBusyHandler(&pBt->db->busyHandler);
                   1678: }
                   1679: 
                   1680: /*
                   1681: ** Open a database file.
                   1682: ** 
                   1683: ** zFilename is the name of the database file.  If zFilename is NULL
                   1684: ** then an ephemeral database is created.  The ephemeral database might
                   1685: ** be exclusively in memory, or it might use a disk-based memory cache.
                   1686: ** Either way, the ephemeral database will be automatically deleted 
                   1687: ** when sqlite3BtreeClose() is called.
                   1688: **
                   1689: ** If zFilename is ":memory:" then an in-memory database is created
                   1690: ** that is automatically destroyed when it is closed.
                   1691: **
                   1692: ** The "flags" parameter is a bitmask that might contain bits
                   1693: ** BTREE_OMIT_JOURNAL and/or BTREE_NO_READLOCK.  The BTREE_NO_READLOCK
                   1694: ** bit is also set if the SQLITE_NoReadlock flags is set in db->flags.
                   1695: ** These flags are passed through into sqlite3PagerOpen() and must
                   1696: ** be the same values as PAGER_OMIT_JOURNAL and PAGER_NO_READLOCK.
                   1697: **
                   1698: ** If the database is already opened in the same database connection
                   1699: ** and we are in shared cache mode, then the open will fail with an
                   1700: ** SQLITE_CONSTRAINT error.  We cannot allow two or more BtShared
                   1701: ** objects in the same database connection since doing so will lead
                   1702: ** to problems with locking.
                   1703: */
                   1704: int sqlite3BtreeOpen(
                   1705:   sqlite3_vfs *pVfs,      /* VFS to use for this b-tree */
                   1706:   const char *zFilename,  /* Name of the file containing the BTree database */
                   1707:   sqlite3 *db,            /* Associated database handle */
                   1708:   Btree **ppBtree,        /* Pointer to new Btree object written here */
                   1709:   int flags,              /* Options */
                   1710:   int vfsFlags            /* Flags passed through to sqlite3_vfs.xOpen() */
                   1711: ){
                   1712:   BtShared *pBt = 0;             /* Shared part of btree structure */
                   1713:   Btree *p;                      /* Handle to return */
                   1714:   sqlite3_mutex *mutexOpen = 0;  /* Prevents a race condition. Ticket #3537 */
                   1715:   int rc = SQLITE_OK;            /* Result code from this function */
                   1716:   u8 nReserve;                   /* Byte of unused space on each page */
                   1717:   unsigned char zDbHeader[100];  /* Database header content */
                   1718: 
                   1719:   /* True if opening an ephemeral, temporary database */
                   1720:   const int isTempDb = zFilename==0 || zFilename[0]==0;
                   1721: 
                   1722:   /* Set the variable isMemdb to true for an in-memory database, or 
                   1723:   ** false for a file-based database.
                   1724:   */
                   1725: #ifdef SQLITE_OMIT_MEMORYDB
                   1726:   const int isMemdb = 0;
                   1727: #else
                   1728:   const int isMemdb = (zFilename && strcmp(zFilename, ":memory:")==0)
                   1729:                        || (isTempDb && sqlite3TempInMemory(db));
                   1730: #endif
                   1731: 
                   1732:   assert( db!=0 );
                   1733:   assert( pVfs!=0 );
                   1734:   assert( sqlite3_mutex_held(db->mutex) );
                   1735:   assert( (flags&0xff)==flags );   /* flags fit in 8 bits */
                   1736: 
                   1737:   /* Only a BTREE_SINGLE database can be BTREE_UNORDERED */
                   1738:   assert( (flags & BTREE_UNORDERED)==0 || (flags & BTREE_SINGLE)!=0 );
                   1739: 
                   1740:   /* A BTREE_SINGLE database is always a temporary and/or ephemeral */
                   1741:   assert( (flags & BTREE_SINGLE)==0 || isTempDb );
                   1742: 
                   1743:   if( db->flags & SQLITE_NoReadlock ){
                   1744:     flags |= BTREE_NO_READLOCK;
                   1745:   }
                   1746:   if( isMemdb ){
                   1747:     flags |= BTREE_MEMORY;
                   1748:   }
                   1749:   if( (vfsFlags & SQLITE_OPEN_MAIN_DB)!=0 && (isMemdb || isTempDb) ){
                   1750:     vfsFlags = (vfsFlags & ~SQLITE_OPEN_MAIN_DB) | SQLITE_OPEN_TEMP_DB;
                   1751:   }
                   1752:   p = sqlite3MallocZero(sizeof(Btree));
                   1753:   if( !p ){
                   1754:     return SQLITE_NOMEM;
                   1755:   }
                   1756:   p->inTrans = TRANS_NONE;
                   1757:   p->db = db;
                   1758: #ifndef SQLITE_OMIT_SHARED_CACHE
                   1759:   p->lock.pBtree = p;
                   1760:   p->lock.iTable = 1;
                   1761: #endif
                   1762: 
                   1763: #if !defined(SQLITE_OMIT_SHARED_CACHE) && !defined(SQLITE_OMIT_DISKIO)
                   1764:   /*
                   1765:   ** If this Btree is a candidate for shared cache, try to find an
                   1766:   ** existing BtShared object that we can share with
                   1767:   */
                   1768:   if( isMemdb==0 && isTempDb==0 ){
                   1769:     if( vfsFlags & SQLITE_OPEN_SHAREDCACHE ){
                   1770:       int nFullPathname = pVfs->mxPathname+1;
                   1771:       char *zFullPathname = sqlite3Malloc(nFullPathname);
                   1772:       MUTEX_LOGIC( sqlite3_mutex *mutexShared; )
                   1773:       p->sharable = 1;
                   1774:       if( !zFullPathname ){
                   1775:         sqlite3_free(p);
                   1776:         return SQLITE_NOMEM;
                   1777:       }
                   1778:       rc = sqlite3OsFullPathname(pVfs, zFilename, nFullPathname, zFullPathname);
                   1779:       if( rc ){
                   1780:         sqlite3_free(zFullPathname);
                   1781:         sqlite3_free(p);
                   1782:         return rc;
                   1783:       }
                   1784: #if SQLITE_THREADSAFE
                   1785:       mutexOpen = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_OPEN);
                   1786:       sqlite3_mutex_enter(mutexOpen);
                   1787:       mutexShared = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER);
                   1788:       sqlite3_mutex_enter(mutexShared);
                   1789: #endif
                   1790:       for(pBt=GLOBAL(BtShared*,sqlite3SharedCacheList); pBt; pBt=pBt->pNext){
                   1791:         assert( pBt->nRef>0 );
                   1792:         if( 0==strcmp(zFullPathname, sqlite3PagerFilename(pBt->pPager))
                   1793:                  && sqlite3PagerVfs(pBt->pPager)==pVfs ){
                   1794:           int iDb;
                   1795:           for(iDb=db->nDb-1; iDb>=0; iDb--){
                   1796:             Btree *pExisting = db->aDb[iDb].pBt;
                   1797:             if( pExisting && pExisting->pBt==pBt ){
                   1798:               sqlite3_mutex_leave(mutexShared);
                   1799:               sqlite3_mutex_leave(mutexOpen);
                   1800:               sqlite3_free(zFullPathname);
                   1801:               sqlite3_free(p);
                   1802:               return SQLITE_CONSTRAINT;
                   1803:             }
                   1804:           }
                   1805:           p->pBt = pBt;
                   1806:           pBt->nRef++;
                   1807:           break;
                   1808:         }
                   1809:       }
                   1810:       sqlite3_mutex_leave(mutexShared);
                   1811:       sqlite3_free(zFullPathname);
                   1812:     }
                   1813: #ifdef SQLITE_DEBUG
                   1814:     else{
                   1815:       /* In debug mode, we mark all persistent databases as sharable
                   1816:       ** even when they are not.  This exercises the locking code and
                   1817:       ** gives more opportunity for asserts(sqlite3_mutex_held())
                   1818:       ** statements to find locking problems.
                   1819:       */
                   1820:       p->sharable = 1;
                   1821:     }
                   1822: #endif
                   1823:   }
                   1824: #endif
                   1825:   if( pBt==0 ){
                   1826:     /*
                   1827:     ** The following asserts make sure that structures used by the btree are
                   1828:     ** the right size.  This is to guard against size changes that result
                   1829:     ** when compiling on a different architecture.
                   1830:     */
                   1831:     assert( sizeof(i64)==8 || sizeof(i64)==4 );
                   1832:     assert( sizeof(u64)==8 || sizeof(u64)==4 );
                   1833:     assert( sizeof(u32)==4 );
                   1834:     assert( sizeof(u16)==2 );
                   1835:     assert( sizeof(Pgno)==4 );
                   1836:   
                   1837:     pBt = sqlite3MallocZero( sizeof(*pBt) );
                   1838:     if( pBt==0 ){
                   1839:       rc = SQLITE_NOMEM;
                   1840:       goto btree_open_out;
                   1841:     }
                   1842:     rc = sqlite3PagerOpen(pVfs, &pBt->pPager, zFilename,
                   1843:                           EXTRA_SIZE, flags, vfsFlags, pageReinit);
                   1844:     if( rc==SQLITE_OK ){
                   1845:       rc = sqlite3PagerReadFileheader(pBt->pPager,sizeof(zDbHeader),zDbHeader);
                   1846:     }
                   1847:     if( rc!=SQLITE_OK ){
                   1848:       goto btree_open_out;
                   1849:     }
                   1850:     pBt->openFlags = (u8)flags;
                   1851:     pBt->db = db;
                   1852:     sqlite3PagerSetBusyhandler(pBt->pPager, btreeInvokeBusyHandler, pBt);
                   1853:     p->pBt = pBt;
                   1854:   
                   1855:     pBt->pCursor = 0;
                   1856:     pBt->pPage1 = 0;
                   1857:     if( sqlite3PagerIsreadonly(pBt->pPager) ) pBt->btsFlags |= BTS_READ_ONLY;
                   1858: #ifdef SQLITE_SECURE_DELETE
                   1859:     pBt->btsFlags |= BTS_SECURE_DELETE;
                   1860: #endif
                   1861:     pBt->pageSize = (zDbHeader[16]<<8) | (zDbHeader[17]<<16);
                   1862:     if( pBt->pageSize<512 || pBt->pageSize>SQLITE_MAX_PAGE_SIZE
                   1863:          || ((pBt->pageSize-1)&pBt->pageSize)!=0 ){
                   1864:       pBt->pageSize = 0;
                   1865: #ifndef SQLITE_OMIT_AUTOVACUUM
                   1866:       /* If the magic name ":memory:" will create an in-memory database, then
                   1867:       ** leave the autoVacuum mode at 0 (do not auto-vacuum), even if
                   1868:       ** SQLITE_DEFAULT_AUTOVACUUM is true. On the other hand, if
                   1869:       ** SQLITE_OMIT_MEMORYDB has been defined, then ":memory:" is just a
                   1870:       ** regular file-name. In this case the auto-vacuum applies as per normal.
                   1871:       */
                   1872:       if( zFilename && !isMemdb ){
                   1873:         pBt->autoVacuum = (SQLITE_DEFAULT_AUTOVACUUM ? 1 : 0);
                   1874:         pBt->incrVacuum = (SQLITE_DEFAULT_AUTOVACUUM==2 ? 1 : 0);
                   1875:       }
                   1876: #endif
                   1877:       nReserve = 0;
                   1878:     }else{
                   1879:       nReserve = zDbHeader[20];
                   1880:       pBt->btsFlags |= BTS_PAGESIZE_FIXED;
                   1881: #ifndef SQLITE_OMIT_AUTOVACUUM
                   1882:       pBt->autoVacuum = (get4byte(&zDbHeader[36 + 4*4])?1:0);
                   1883:       pBt->incrVacuum = (get4byte(&zDbHeader[36 + 7*4])?1:0);
                   1884: #endif
                   1885:     }
                   1886:     rc = sqlite3PagerSetPagesize(pBt->pPager, &pBt->pageSize, nReserve);
                   1887:     if( rc ) goto btree_open_out;
                   1888:     pBt->usableSize = pBt->pageSize - nReserve;
                   1889:     assert( (pBt->pageSize & 7)==0 );  /* 8-byte alignment of pageSize */
                   1890:    
                   1891: #if !defined(SQLITE_OMIT_SHARED_CACHE) && !defined(SQLITE_OMIT_DISKIO)
                   1892:     /* Add the new BtShared object to the linked list sharable BtShareds.
                   1893:     */
                   1894:     if( p->sharable ){
                   1895:       MUTEX_LOGIC( sqlite3_mutex *mutexShared; )
                   1896:       pBt->nRef = 1;
                   1897:       MUTEX_LOGIC( mutexShared = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER);)
                   1898:       if( SQLITE_THREADSAFE && sqlite3GlobalConfig.bCoreMutex ){
                   1899:         pBt->mutex = sqlite3MutexAlloc(SQLITE_MUTEX_FAST);
                   1900:         if( pBt->mutex==0 ){
                   1901:           rc = SQLITE_NOMEM;
                   1902:           db->mallocFailed = 0;
                   1903:           goto btree_open_out;
                   1904:         }
                   1905:       }
                   1906:       sqlite3_mutex_enter(mutexShared);
                   1907:       pBt->pNext = GLOBAL(BtShared*,sqlite3SharedCacheList);
                   1908:       GLOBAL(BtShared*,sqlite3SharedCacheList) = pBt;
                   1909:       sqlite3_mutex_leave(mutexShared);
                   1910:     }
                   1911: #endif
                   1912:   }
                   1913: 
                   1914: #if !defined(SQLITE_OMIT_SHARED_CACHE) && !defined(SQLITE_OMIT_DISKIO)
                   1915:   /* If the new Btree uses a sharable pBtShared, then link the new
                   1916:   ** Btree into the list of all sharable Btrees for the same connection.
                   1917:   ** The list is kept in ascending order by pBt address.
                   1918:   */
                   1919:   if( p->sharable ){
                   1920:     int i;
                   1921:     Btree *pSib;
                   1922:     for(i=0; i<db->nDb; i++){
                   1923:       if( (pSib = db->aDb[i].pBt)!=0 && pSib->sharable ){
                   1924:         while( pSib->pPrev ){ pSib = pSib->pPrev; }
                   1925:         if( p->pBt<pSib->pBt ){
                   1926:           p->pNext = pSib;
                   1927:           p->pPrev = 0;
                   1928:           pSib->pPrev = p;
                   1929:         }else{
                   1930:           while( pSib->pNext && pSib->pNext->pBt<p->pBt ){
                   1931:             pSib = pSib->pNext;
                   1932:           }
                   1933:           p->pNext = pSib->pNext;
                   1934:           p->pPrev = pSib;
                   1935:           if( p->pNext ){
                   1936:             p->pNext->pPrev = p;
                   1937:           }
                   1938:           pSib->pNext = p;
                   1939:         }
                   1940:         break;
                   1941:       }
                   1942:     }
                   1943:   }
                   1944: #endif
                   1945:   *ppBtree = p;
                   1946: 
                   1947: btree_open_out:
                   1948:   if( rc!=SQLITE_OK ){
                   1949:     if( pBt && pBt->pPager ){
                   1950:       sqlite3PagerClose(pBt->pPager);
                   1951:     }
                   1952:     sqlite3_free(pBt);
                   1953:     sqlite3_free(p);
                   1954:     *ppBtree = 0;
                   1955:   }else{
                   1956:     /* If the B-Tree was successfully opened, set the pager-cache size to the
                   1957:     ** default value. Except, when opening on an existing shared pager-cache,
                   1958:     ** do not change the pager-cache size.
                   1959:     */
                   1960:     if( sqlite3BtreeSchema(p, 0, 0)==0 ){
                   1961:       sqlite3PagerSetCachesize(p->pBt->pPager, SQLITE_DEFAULT_CACHE_SIZE);
                   1962:     }
                   1963:   }
                   1964:   if( mutexOpen ){
                   1965:     assert( sqlite3_mutex_held(mutexOpen) );
                   1966:     sqlite3_mutex_leave(mutexOpen);
                   1967:   }
                   1968:   return rc;
                   1969: }
                   1970: 
                   1971: /*
                   1972: ** Decrement the BtShared.nRef counter.  When it reaches zero,
                   1973: ** remove the BtShared structure from the sharing list.  Return
                   1974: ** true if the BtShared.nRef counter reaches zero and return
                   1975: ** false if it is still positive.
                   1976: */
                   1977: static int removeFromSharingList(BtShared *pBt){
                   1978: #ifndef SQLITE_OMIT_SHARED_CACHE
                   1979:   MUTEX_LOGIC( sqlite3_mutex *pMaster; )
                   1980:   BtShared *pList;
                   1981:   int removed = 0;
                   1982: 
                   1983:   assert( sqlite3_mutex_notheld(pBt->mutex) );
                   1984:   MUTEX_LOGIC( pMaster = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER); )
                   1985:   sqlite3_mutex_enter(pMaster);
                   1986:   pBt->nRef--;
                   1987:   if( pBt->nRef<=0 ){
                   1988:     if( GLOBAL(BtShared*,sqlite3SharedCacheList)==pBt ){
                   1989:       GLOBAL(BtShared*,sqlite3SharedCacheList) = pBt->pNext;
                   1990:     }else{
                   1991:       pList = GLOBAL(BtShared*,sqlite3SharedCacheList);
                   1992:       while( ALWAYS(pList) && pList->pNext!=pBt ){
                   1993:         pList=pList->pNext;
                   1994:       }
                   1995:       if( ALWAYS(pList) ){
                   1996:         pList->pNext = pBt->pNext;
                   1997:       }
                   1998:     }
                   1999:     if( SQLITE_THREADSAFE ){
                   2000:       sqlite3_mutex_free(pBt->mutex);
                   2001:     }
                   2002:     removed = 1;
                   2003:   }
                   2004:   sqlite3_mutex_leave(pMaster);
                   2005:   return removed;
                   2006: #else
                   2007:   return 1;
                   2008: #endif
                   2009: }
                   2010: 
                   2011: /*
                   2012: ** Make sure pBt->pTmpSpace points to an allocation of 
                   2013: ** MX_CELL_SIZE(pBt) bytes.
                   2014: */
                   2015: static void allocateTempSpace(BtShared *pBt){
                   2016:   if( !pBt->pTmpSpace ){
                   2017:     pBt->pTmpSpace = sqlite3PageMalloc( pBt->pageSize );
                   2018:   }
                   2019: }
                   2020: 
                   2021: /*
                   2022: ** Free the pBt->pTmpSpace allocation
                   2023: */
                   2024: static void freeTempSpace(BtShared *pBt){
                   2025:   sqlite3PageFree( pBt->pTmpSpace);
                   2026:   pBt->pTmpSpace = 0;
                   2027: }
                   2028: 
                   2029: /*
                   2030: ** Close an open database and invalidate all cursors.
                   2031: */
                   2032: int sqlite3BtreeClose(Btree *p){
                   2033:   BtShared *pBt = p->pBt;
                   2034:   BtCursor *pCur;
                   2035: 
                   2036:   /* Close all cursors opened via this handle.  */
                   2037:   assert( sqlite3_mutex_held(p->db->mutex) );
                   2038:   sqlite3BtreeEnter(p);
                   2039:   pCur = pBt->pCursor;
                   2040:   while( pCur ){
                   2041:     BtCursor *pTmp = pCur;
                   2042:     pCur = pCur->pNext;
                   2043:     if( pTmp->pBtree==p ){
                   2044:       sqlite3BtreeCloseCursor(pTmp);
                   2045:     }
                   2046:   }
                   2047: 
                   2048:   /* Rollback any active transaction and free the handle structure.
                   2049:   ** The call to sqlite3BtreeRollback() drops any table-locks held by
                   2050:   ** this handle.
                   2051:   */
                   2052:   sqlite3BtreeRollback(p);
                   2053:   sqlite3BtreeLeave(p);
                   2054: 
                   2055:   /* If there are still other outstanding references to the shared-btree
                   2056:   ** structure, return now. The remainder of this procedure cleans 
                   2057:   ** up the shared-btree.
                   2058:   */
                   2059:   assert( p->wantToLock==0 && p->locked==0 );
                   2060:   if( !p->sharable || removeFromSharingList(pBt) ){
                   2061:     /* The pBt is no longer on the sharing list, so we can access
                   2062:     ** it without having to hold the mutex.
                   2063:     **
                   2064:     ** Clean out and delete the BtShared object.
                   2065:     */
                   2066:     assert( !pBt->pCursor );
                   2067:     sqlite3PagerClose(pBt->pPager);
                   2068:     if( pBt->xFreeSchema && pBt->pSchema ){
                   2069:       pBt->xFreeSchema(pBt->pSchema);
                   2070:     }
                   2071:     sqlite3DbFree(0, pBt->pSchema);
                   2072:     freeTempSpace(pBt);
                   2073:     sqlite3_free(pBt);
                   2074:   }
                   2075: 
                   2076: #ifndef SQLITE_OMIT_SHARED_CACHE
                   2077:   assert( p->wantToLock==0 );
                   2078:   assert( p->locked==0 );
                   2079:   if( p->pPrev ) p->pPrev->pNext = p->pNext;
                   2080:   if( p->pNext ) p->pNext->pPrev = p->pPrev;
                   2081: #endif
                   2082: 
                   2083:   sqlite3_free(p);
                   2084:   return SQLITE_OK;
                   2085: }
                   2086: 
                   2087: /*
                   2088: ** Change the limit on the number of pages allowed in the cache.
                   2089: **
                   2090: ** The maximum number of cache pages is set to the absolute
                   2091: ** value of mxPage.  If mxPage is negative, the pager will
                   2092: ** operate asynchronously - it will not stop to do fsync()s
                   2093: ** to insure data is written to the disk surface before
                   2094: ** continuing.  Transactions still work if synchronous is off,
                   2095: ** and the database cannot be corrupted if this program
                   2096: ** crashes.  But if the operating system crashes or there is
                   2097: ** an abrupt power failure when synchronous is off, the database
                   2098: ** could be left in an inconsistent and unrecoverable state.
                   2099: ** Synchronous is on by default so database corruption is not
                   2100: ** normally a worry.
                   2101: */
                   2102: int sqlite3BtreeSetCacheSize(Btree *p, int mxPage){
                   2103:   BtShared *pBt = p->pBt;
                   2104:   assert( sqlite3_mutex_held(p->db->mutex) );
                   2105:   sqlite3BtreeEnter(p);
                   2106:   sqlite3PagerSetCachesize(pBt->pPager, mxPage);
                   2107:   sqlite3BtreeLeave(p);
                   2108:   return SQLITE_OK;
                   2109: }
                   2110: 
                   2111: /*
                   2112: ** Change the way data is synced to disk in order to increase or decrease
                   2113: ** how well the database resists damage due to OS crashes and power
                   2114: ** failures.  Level 1 is the same as asynchronous (no syncs() occur and
                   2115: ** there is a high probability of damage)  Level 2 is the default.  There
                   2116: ** is a very low but non-zero probability of damage.  Level 3 reduces the
                   2117: ** probability of damage to near zero but with a write performance reduction.
                   2118: */
                   2119: #ifndef SQLITE_OMIT_PAGER_PRAGMAS
                   2120: int sqlite3BtreeSetSafetyLevel(
                   2121:   Btree *p,              /* The btree to set the safety level on */
                   2122:   int level,             /* PRAGMA synchronous.  1=OFF, 2=NORMAL, 3=FULL */
                   2123:   int fullSync,          /* PRAGMA fullfsync. */
                   2124:   int ckptFullSync       /* PRAGMA checkpoint_fullfync */
                   2125: ){
                   2126:   BtShared *pBt = p->pBt;
                   2127:   assert( sqlite3_mutex_held(p->db->mutex) );
                   2128:   assert( level>=1 && level<=3 );
                   2129:   sqlite3BtreeEnter(p);
                   2130:   sqlite3PagerSetSafetyLevel(pBt->pPager, level, fullSync, ckptFullSync);
                   2131:   sqlite3BtreeLeave(p);
                   2132:   return SQLITE_OK;
                   2133: }
                   2134: #endif
                   2135: 
                   2136: /*
                   2137: ** Return TRUE if the given btree is set to safety level 1.  In other
                   2138: ** words, return TRUE if no sync() occurs on the disk files.
                   2139: */
                   2140: int sqlite3BtreeSyncDisabled(Btree *p){
                   2141:   BtShared *pBt = p->pBt;
                   2142:   int rc;
                   2143:   assert( sqlite3_mutex_held(p->db->mutex) );  
                   2144:   sqlite3BtreeEnter(p);
                   2145:   assert( pBt && pBt->pPager );
                   2146:   rc = sqlite3PagerNosync(pBt->pPager);
                   2147:   sqlite3BtreeLeave(p);
                   2148:   return rc;
                   2149: }
                   2150: 
                   2151: /*
                   2152: ** Change the default pages size and the number of reserved bytes per page.
                   2153: ** Or, if the page size has already been fixed, return SQLITE_READONLY 
                   2154: ** without changing anything.
                   2155: **
                   2156: ** The page size must be a power of 2 between 512 and 65536.  If the page
                   2157: ** size supplied does not meet this constraint then the page size is not
                   2158: ** changed.
                   2159: **
                   2160: ** Page sizes are constrained to be a power of two so that the region
                   2161: ** of the database file used for locking (beginning at PENDING_BYTE,
                   2162: ** the first byte past the 1GB boundary, 0x40000000) needs to occur
                   2163: ** at the beginning of a page.
                   2164: **
                   2165: ** If parameter nReserve is less than zero, then the number of reserved
                   2166: ** bytes per page is left unchanged.
                   2167: **
                   2168: ** If the iFix!=0 then the BTS_PAGESIZE_FIXED flag is set so that the page size
                   2169: ** and autovacuum mode can no longer be changed.
                   2170: */
                   2171: int sqlite3BtreeSetPageSize(Btree *p, int pageSize, int nReserve, int iFix){
                   2172:   int rc = SQLITE_OK;
                   2173:   BtShared *pBt = p->pBt;
                   2174:   assert( nReserve>=-1 && nReserve<=255 );
                   2175:   sqlite3BtreeEnter(p);
                   2176:   if( pBt->btsFlags & BTS_PAGESIZE_FIXED ){
                   2177:     sqlite3BtreeLeave(p);
                   2178:     return SQLITE_READONLY;
                   2179:   }
                   2180:   if( nReserve<0 ){
                   2181:     nReserve = pBt->pageSize - pBt->usableSize;
                   2182:   }
                   2183:   assert( nReserve>=0 && nReserve<=255 );
                   2184:   if( pageSize>=512 && pageSize<=SQLITE_MAX_PAGE_SIZE &&
                   2185:         ((pageSize-1)&pageSize)==0 ){
                   2186:     assert( (pageSize & 7)==0 );
                   2187:     assert( !pBt->pPage1 && !pBt->pCursor );
                   2188:     pBt->pageSize = (u32)pageSize;
                   2189:     freeTempSpace(pBt);
                   2190:   }
                   2191:   rc = sqlite3PagerSetPagesize(pBt->pPager, &pBt->pageSize, nReserve);
                   2192:   pBt->usableSize = pBt->pageSize - (u16)nReserve;
                   2193:   if( iFix ) pBt->btsFlags |= BTS_PAGESIZE_FIXED;
                   2194:   sqlite3BtreeLeave(p);
                   2195:   return rc;
                   2196: }
                   2197: 
                   2198: /*
                   2199: ** Return the currently defined page size
                   2200: */
                   2201: int sqlite3BtreeGetPageSize(Btree *p){
                   2202:   return p->pBt->pageSize;
                   2203: }
                   2204: 
                   2205: #if !defined(SQLITE_OMIT_PAGER_PRAGMAS) || !defined(SQLITE_OMIT_VACUUM)
                   2206: /*
                   2207: ** Return the number of bytes of space at the end of every page that
                   2208: ** are intentually left unused.  This is the "reserved" space that is
                   2209: ** sometimes used by extensions.
                   2210: */
                   2211: int sqlite3BtreeGetReserve(Btree *p){
                   2212:   int n;
                   2213:   sqlite3BtreeEnter(p);
                   2214:   n = p->pBt->pageSize - p->pBt->usableSize;
                   2215:   sqlite3BtreeLeave(p);
                   2216:   return n;
                   2217: }
                   2218: 
                   2219: /*
                   2220: ** Set the maximum page count for a database if mxPage is positive.
                   2221: ** No changes are made if mxPage is 0 or negative.
                   2222: ** Regardless of the value of mxPage, return the maximum page count.
                   2223: */
                   2224: int sqlite3BtreeMaxPageCount(Btree *p, int mxPage){
                   2225:   int n;
                   2226:   sqlite3BtreeEnter(p);
                   2227:   n = sqlite3PagerMaxPageCount(p->pBt->pPager, mxPage);
                   2228:   sqlite3BtreeLeave(p);
                   2229:   return n;
                   2230: }
                   2231: 
                   2232: /*
                   2233: ** Set the BTS_SECURE_DELETE flag if newFlag is 0 or 1.  If newFlag is -1,
                   2234: ** then make no changes.  Always return the value of the BTS_SECURE_DELETE
                   2235: ** setting after the change.
                   2236: */
                   2237: int sqlite3BtreeSecureDelete(Btree *p, int newFlag){
                   2238:   int b;
                   2239:   if( p==0 ) return 0;
                   2240:   sqlite3BtreeEnter(p);
                   2241:   if( newFlag>=0 ){
                   2242:     p->pBt->btsFlags &= ~BTS_SECURE_DELETE;
                   2243:     if( newFlag ) p->pBt->btsFlags |= BTS_SECURE_DELETE;
                   2244:   } 
                   2245:   b = (p->pBt->btsFlags & BTS_SECURE_DELETE)!=0;
                   2246:   sqlite3BtreeLeave(p);
                   2247:   return b;
                   2248: }
                   2249: #endif /* !defined(SQLITE_OMIT_PAGER_PRAGMAS) || !defined(SQLITE_OMIT_VACUUM) */
                   2250: 
                   2251: /*
                   2252: ** Change the 'auto-vacuum' property of the database. If the 'autoVacuum'
                   2253: ** parameter is non-zero, then auto-vacuum mode is enabled. If zero, it
                   2254: ** is disabled. The default value for the auto-vacuum property is 
                   2255: ** determined by the SQLITE_DEFAULT_AUTOVACUUM macro.
                   2256: */
                   2257: int sqlite3BtreeSetAutoVacuum(Btree *p, int autoVacuum){
                   2258: #ifdef SQLITE_OMIT_AUTOVACUUM
                   2259:   return SQLITE_READONLY;
                   2260: #else
                   2261:   BtShared *pBt = p->pBt;
                   2262:   int rc = SQLITE_OK;
                   2263:   u8 av = (u8)autoVacuum;
                   2264: 
                   2265:   sqlite3BtreeEnter(p);
                   2266:   if( (pBt->btsFlags & BTS_PAGESIZE_FIXED)!=0 && (av ?1:0)!=pBt->autoVacuum ){
                   2267:     rc = SQLITE_READONLY;
                   2268:   }else{
                   2269:     pBt->autoVacuum = av ?1:0;
                   2270:     pBt->incrVacuum = av==2 ?1:0;
                   2271:   }
                   2272:   sqlite3BtreeLeave(p);
                   2273:   return rc;
                   2274: #endif
                   2275: }
                   2276: 
                   2277: /*
                   2278: ** Return the value of the 'auto-vacuum' property. If auto-vacuum is 
                   2279: ** enabled 1 is returned. Otherwise 0.
                   2280: */
                   2281: int sqlite3BtreeGetAutoVacuum(Btree *p){
                   2282: #ifdef SQLITE_OMIT_AUTOVACUUM
                   2283:   return BTREE_AUTOVACUUM_NONE;
                   2284: #else
                   2285:   int rc;
                   2286:   sqlite3BtreeEnter(p);
                   2287:   rc = (
                   2288:     (!p->pBt->autoVacuum)?BTREE_AUTOVACUUM_NONE:
                   2289:     (!p->pBt->incrVacuum)?BTREE_AUTOVACUUM_FULL:
                   2290:     BTREE_AUTOVACUUM_INCR
                   2291:   );
                   2292:   sqlite3BtreeLeave(p);
                   2293:   return rc;
                   2294: #endif
                   2295: }
                   2296: 
                   2297: 
                   2298: /*
                   2299: ** Get a reference to pPage1 of the database file.  This will
                   2300: ** also acquire a readlock on that file.
                   2301: **
                   2302: ** SQLITE_OK is returned on success.  If the file is not a
                   2303: ** well-formed database file, then SQLITE_CORRUPT is returned.
                   2304: ** SQLITE_BUSY is returned if the database is locked.  SQLITE_NOMEM
                   2305: ** is returned if we run out of memory. 
                   2306: */
                   2307: static int lockBtree(BtShared *pBt){
                   2308:   int rc;              /* Result code from subfunctions */
                   2309:   MemPage *pPage1;     /* Page 1 of the database file */
                   2310:   int nPage;           /* Number of pages in the database */
                   2311:   int nPageFile = 0;   /* Number of pages in the database file */
                   2312:   int nPageHeader;     /* Number of pages in the database according to hdr */
                   2313: 
                   2314:   assert( sqlite3_mutex_held(pBt->mutex) );
                   2315:   assert( pBt->pPage1==0 );
                   2316:   rc = sqlite3PagerSharedLock(pBt->pPager);
                   2317:   if( rc!=SQLITE_OK ) return rc;
                   2318:   rc = btreeGetPage(pBt, 1, &pPage1, 0);
                   2319:   if( rc!=SQLITE_OK ) return rc;
                   2320: 
                   2321:   /* Do some checking to help insure the file we opened really is
                   2322:   ** a valid database file. 
                   2323:   */
                   2324:   nPage = nPageHeader = get4byte(28+(u8*)pPage1->aData);
                   2325:   sqlite3PagerPagecount(pBt->pPager, &nPageFile);
                   2326:   if( nPage==0 || memcmp(24+(u8*)pPage1->aData, 92+(u8*)pPage1->aData,4)!=0 ){
                   2327:     nPage = nPageFile;
                   2328:   }
                   2329:   if( nPage>0 ){
                   2330:     u32 pageSize;
                   2331:     u32 usableSize;
                   2332:     u8 *page1 = pPage1->aData;
                   2333:     rc = SQLITE_NOTADB;
                   2334:     if( memcmp(page1, zMagicHeader, 16)!=0 ){
                   2335:       goto page1_init_failed;
                   2336:     }
                   2337: 
                   2338: #ifdef SQLITE_OMIT_WAL
                   2339:     if( page1[18]>1 ){
                   2340:       pBt->btsFlags |= BTS_READ_ONLY;
                   2341:     }
                   2342:     if( page1[19]>1 ){
                   2343:       goto page1_init_failed;
                   2344:     }
                   2345: #else
                   2346:     if( page1[18]>2 ){
                   2347:       pBt->btsFlags |= BTS_READ_ONLY;
                   2348:     }
                   2349:     if( page1[19]>2 ){
                   2350:       goto page1_init_failed;
                   2351:     }
                   2352: 
                   2353:     /* If the write version is set to 2, this database should be accessed
                   2354:     ** in WAL mode. If the log is not already open, open it now. Then 
                   2355:     ** return SQLITE_OK and return without populating BtShared.pPage1.
                   2356:     ** The caller detects this and calls this function again. This is
                   2357:     ** required as the version of page 1 currently in the page1 buffer
                   2358:     ** may not be the latest version - there may be a newer one in the log
                   2359:     ** file.
                   2360:     */
                   2361:     if( page1[19]==2 && (pBt->btsFlags & BTS_NO_WAL)==0 ){
                   2362:       int isOpen = 0;
                   2363:       rc = sqlite3PagerOpenWal(pBt->pPager, &isOpen);
                   2364:       if( rc!=SQLITE_OK ){
                   2365:         goto page1_init_failed;
                   2366:       }else if( isOpen==0 ){
                   2367:         releasePage(pPage1);
                   2368:         return SQLITE_OK;
                   2369:       }
                   2370:       rc = SQLITE_NOTADB;
                   2371:     }
                   2372: #endif
                   2373: 
                   2374:     /* The maximum embedded fraction must be exactly 25%.  And the minimum
                   2375:     ** embedded fraction must be 12.5% for both leaf-data and non-leaf-data.
                   2376:     ** The original design allowed these amounts to vary, but as of
                   2377:     ** version 3.6.0, we require them to be fixed.
                   2378:     */
                   2379:     if( memcmp(&page1[21], "\100\040\040",3)!=0 ){
                   2380:       goto page1_init_failed;
                   2381:     }
                   2382:     pageSize = (page1[16]<<8) | (page1[17]<<16);
                   2383:     if( ((pageSize-1)&pageSize)!=0
                   2384:      || pageSize>SQLITE_MAX_PAGE_SIZE 
                   2385:      || pageSize<=256 
                   2386:     ){
                   2387:       goto page1_init_failed;
                   2388:     }
                   2389:     assert( (pageSize & 7)==0 );
                   2390:     usableSize = pageSize - page1[20];
                   2391:     if( (u32)pageSize!=pBt->pageSize ){
                   2392:       /* After reading the first page of the database assuming a page size
                   2393:       ** of BtShared.pageSize, we have discovered that the page-size is
                   2394:       ** actually pageSize. Unlock the database, leave pBt->pPage1 at
                   2395:       ** zero and return SQLITE_OK. The caller will call this function
                   2396:       ** again with the correct page-size.
                   2397:       */
                   2398:       releasePage(pPage1);
                   2399:       pBt->usableSize = usableSize;
                   2400:       pBt->pageSize = pageSize;
                   2401:       freeTempSpace(pBt);
                   2402:       rc = sqlite3PagerSetPagesize(pBt->pPager, &pBt->pageSize,
                   2403:                                    pageSize-usableSize);
                   2404:       return rc;
                   2405:     }
                   2406:     if( (pBt->db->flags & SQLITE_RecoveryMode)==0 && nPage>nPageFile ){
                   2407:       rc = SQLITE_CORRUPT_BKPT;
                   2408:       goto page1_init_failed;
                   2409:     }
                   2410:     if( usableSize<480 ){
                   2411:       goto page1_init_failed;
                   2412:     }
                   2413:     pBt->pageSize = pageSize;
                   2414:     pBt->usableSize = usableSize;
                   2415: #ifndef SQLITE_OMIT_AUTOVACUUM
                   2416:     pBt->autoVacuum = (get4byte(&page1[36 + 4*4])?1:0);
                   2417:     pBt->incrVacuum = (get4byte(&page1[36 + 7*4])?1:0);
                   2418: #endif
                   2419:   }
                   2420: 
                   2421:   /* maxLocal is the maximum amount of payload to store locally for
                   2422:   ** a cell.  Make sure it is small enough so that at least minFanout
                   2423:   ** cells can will fit on one page.  We assume a 10-byte page header.
                   2424:   ** Besides the payload, the cell must store:
                   2425:   **     2-byte pointer to the cell
                   2426:   **     4-byte child pointer
                   2427:   **     9-byte nKey value
                   2428:   **     4-byte nData value
                   2429:   **     4-byte overflow page pointer
                   2430:   ** So a cell consists of a 2-byte pointer, a header which is as much as
                   2431:   ** 17 bytes long, 0 to N bytes of payload, and an optional 4 byte overflow
                   2432:   ** page pointer.
                   2433:   */
                   2434:   pBt->maxLocal = (u16)((pBt->usableSize-12)*64/255 - 23);
                   2435:   pBt->minLocal = (u16)((pBt->usableSize-12)*32/255 - 23);
                   2436:   pBt->maxLeaf = (u16)(pBt->usableSize - 35);
                   2437:   pBt->minLeaf = (u16)((pBt->usableSize-12)*32/255 - 23);
                   2438:   if( pBt->maxLocal>127 ){
                   2439:     pBt->max1bytePayload = 127;
                   2440:   }else{
                   2441:     pBt->max1bytePayload = (u8)pBt->maxLocal;
                   2442:   }
                   2443:   assert( pBt->maxLeaf + 23 <= MX_CELL_SIZE(pBt) );
                   2444:   pBt->pPage1 = pPage1;
                   2445:   pBt->nPage = nPage;
                   2446:   return SQLITE_OK;
                   2447: 
                   2448: page1_init_failed:
                   2449:   releasePage(pPage1);
                   2450:   pBt->pPage1 = 0;
                   2451:   return rc;
                   2452: }
                   2453: 
                   2454: /*
                   2455: ** If there are no outstanding cursors and we are not in the middle
                   2456: ** of a transaction but there is a read lock on the database, then
                   2457: ** this routine unrefs the first page of the database file which 
                   2458: ** has the effect of releasing the read lock.
                   2459: **
                   2460: ** If there is a transaction in progress, this routine is a no-op.
                   2461: */
                   2462: static void unlockBtreeIfUnused(BtShared *pBt){
                   2463:   assert( sqlite3_mutex_held(pBt->mutex) );
                   2464:   assert( pBt->pCursor==0 || pBt->inTransaction>TRANS_NONE );
                   2465:   if( pBt->inTransaction==TRANS_NONE && pBt->pPage1!=0 ){
                   2466:     assert( pBt->pPage1->aData );
                   2467:     assert( sqlite3PagerRefcount(pBt->pPager)==1 );
                   2468:     assert( pBt->pPage1->aData );
                   2469:     releasePage(pBt->pPage1);
                   2470:     pBt->pPage1 = 0;
                   2471:   }
                   2472: }
                   2473: 
                   2474: /*
                   2475: ** If pBt points to an empty file then convert that empty file
                   2476: ** into a new empty database by initializing the first page of
                   2477: ** the database.
                   2478: */
                   2479: static int newDatabase(BtShared *pBt){
                   2480:   MemPage *pP1;
                   2481:   unsigned char *data;
                   2482:   int rc;
                   2483: 
                   2484:   assert( sqlite3_mutex_held(pBt->mutex) );
                   2485:   if( pBt->nPage>0 ){
                   2486:     return SQLITE_OK;
                   2487:   }
                   2488:   pP1 = pBt->pPage1;
                   2489:   assert( pP1!=0 );
                   2490:   data = pP1->aData;
                   2491:   rc = sqlite3PagerWrite(pP1->pDbPage);
                   2492:   if( rc ) return rc;
                   2493:   memcpy(data, zMagicHeader, sizeof(zMagicHeader));
                   2494:   assert( sizeof(zMagicHeader)==16 );
                   2495:   data[16] = (u8)((pBt->pageSize>>8)&0xff);
                   2496:   data[17] = (u8)((pBt->pageSize>>16)&0xff);
                   2497:   data[18] = 1;
                   2498:   data[19] = 1;
                   2499:   assert( pBt->usableSize<=pBt->pageSize && pBt->usableSize+255>=pBt->pageSize);
                   2500:   data[20] = (u8)(pBt->pageSize - pBt->usableSize);
                   2501:   data[21] = 64;
                   2502:   data[22] = 32;
                   2503:   data[23] = 32;
                   2504:   memset(&data[24], 0, 100-24);
                   2505:   zeroPage(pP1, PTF_INTKEY|PTF_LEAF|PTF_LEAFDATA );
                   2506:   pBt->btsFlags |= BTS_PAGESIZE_FIXED;
                   2507: #ifndef SQLITE_OMIT_AUTOVACUUM
                   2508:   assert( pBt->autoVacuum==1 || pBt->autoVacuum==0 );
                   2509:   assert( pBt->incrVacuum==1 || pBt->incrVacuum==0 );
                   2510:   put4byte(&data[36 + 4*4], pBt->autoVacuum);
                   2511:   put4byte(&data[36 + 7*4], pBt->incrVacuum);
                   2512: #endif
                   2513:   pBt->nPage = 1;
                   2514:   data[31] = 1;
                   2515:   return SQLITE_OK;
                   2516: }
                   2517: 
                   2518: /*
                   2519: ** Attempt to start a new transaction. A write-transaction
                   2520: ** is started if the second argument is nonzero, otherwise a read-
                   2521: ** transaction.  If the second argument is 2 or more and exclusive
                   2522: ** transaction is started, meaning that no other process is allowed
                   2523: ** to access the database.  A preexisting transaction may not be
                   2524: ** upgraded to exclusive by calling this routine a second time - the
                   2525: ** exclusivity flag only works for a new transaction.
                   2526: **
                   2527: ** A write-transaction must be started before attempting any 
                   2528: ** changes to the database.  None of the following routines 
                   2529: ** will work unless a transaction is started first:
                   2530: **
                   2531: **      sqlite3BtreeCreateTable()
                   2532: **      sqlite3BtreeCreateIndex()
                   2533: **      sqlite3BtreeClearTable()
                   2534: **      sqlite3BtreeDropTable()
                   2535: **      sqlite3BtreeInsert()
                   2536: **      sqlite3BtreeDelete()
                   2537: **      sqlite3BtreeUpdateMeta()
                   2538: **
                   2539: ** If an initial attempt to acquire the lock fails because of lock contention
                   2540: ** and the database was previously unlocked, then invoke the busy handler
                   2541: ** if there is one.  But if there was previously a read-lock, do not
                   2542: ** invoke the busy handler - just return SQLITE_BUSY.  SQLITE_BUSY is 
                   2543: ** returned when there is already a read-lock in order to avoid a deadlock.
                   2544: **
                   2545: ** Suppose there are two processes A and B.  A has a read lock and B has
                   2546: ** a reserved lock.  B tries to promote to exclusive but is blocked because
                   2547: ** of A's read lock.  A tries to promote to reserved but is blocked by B.
                   2548: ** One or the other of the two processes must give way or there can be
                   2549: ** no progress.  By returning SQLITE_BUSY and not invoking the busy callback
                   2550: ** when A already has a read lock, we encourage A to give up and let B
                   2551: ** proceed.
                   2552: */
                   2553: int sqlite3BtreeBeginTrans(Btree *p, int wrflag){
                   2554:   sqlite3 *pBlock = 0;
                   2555:   BtShared *pBt = p->pBt;
                   2556:   int rc = SQLITE_OK;
                   2557: 
                   2558:   sqlite3BtreeEnter(p);
                   2559:   btreeIntegrity(p);
                   2560: 
                   2561:   /* If the btree is already in a write-transaction, or it
                   2562:   ** is already in a read-transaction and a read-transaction
                   2563:   ** is requested, this is a no-op.
                   2564:   */
                   2565:   if( p->inTrans==TRANS_WRITE || (p->inTrans==TRANS_READ && !wrflag) ){
                   2566:     goto trans_begun;
                   2567:   }
                   2568: 
                   2569:   /* Write transactions are not possible on a read-only database */
                   2570:   if( (pBt->btsFlags & BTS_READ_ONLY)!=0 && wrflag ){
                   2571:     rc = SQLITE_READONLY;
                   2572:     goto trans_begun;
                   2573:   }
                   2574: 
                   2575: #ifndef SQLITE_OMIT_SHARED_CACHE
                   2576:   /* If another database handle has already opened a write transaction 
                   2577:   ** on this shared-btree structure and a second write transaction is
                   2578:   ** requested, return SQLITE_LOCKED.
                   2579:   */
                   2580:   if( (wrflag && pBt->inTransaction==TRANS_WRITE)
                   2581:    || (pBt->btsFlags & BTS_PENDING)!=0
                   2582:   ){
                   2583:     pBlock = pBt->pWriter->db;
                   2584:   }else if( wrflag>1 ){
                   2585:     BtLock *pIter;
                   2586:     for(pIter=pBt->pLock; pIter; pIter=pIter->pNext){
                   2587:       if( pIter->pBtree!=p ){
                   2588:         pBlock = pIter->pBtree->db;
                   2589:         break;
                   2590:       }
                   2591:     }
                   2592:   }
                   2593:   if( pBlock ){
                   2594:     sqlite3ConnectionBlocked(p->db, pBlock);
                   2595:     rc = SQLITE_LOCKED_SHAREDCACHE;
                   2596:     goto trans_begun;
                   2597:   }
                   2598: #endif
                   2599: 
                   2600:   /* Any read-only or read-write transaction implies a read-lock on 
                   2601:   ** page 1. So if some other shared-cache client already has a write-lock 
                   2602:   ** on page 1, the transaction cannot be opened. */
                   2603:   rc = querySharedCacheTableLock(p, MASTER_ROOT, READ_LOCK);
                   2604:   if( SQLITE_OK!=rc ) goto trans_begun;
                   2605: 
                   2606:   pBt->btsFlags &= ~BTS_INITIALLY_EMPTY;
                   2607:   if( pBt->nPage==0 ) pBt->btsFlags |= BTS_INITIALLY_EMPTY;
                   2608:   do {
                   2609:     /* Call lockBtree() until either pBt->pPage1 is populated or
                   2610:     ** lockBtree() returns something other than SQLITE_OK. lockBtree()
                   2611:     ** may return SQLITE_OK but leave pBt->pPage1 set to 0 if after
                   2612:     ** reading page 1 it discovers that the page-size of the database 
                   2613:     ** file is not pBt->pageSize. In this case lockBtree() will update
                   2614:     ** pBt->pageSize to the page-size of the file on disk.
                   2615:     */
                   2616:     while( pBt->pPage1==0 && SQLITE_OK==(rc = lockBtree(pBt)) );
                   2617: 
                   2618:     if( rc==SQLITE_OK && wrflag ){
                   2619:       if( (pBt->btsFlags & BTS_READ_ONLY)!=0 ){
                   2620:         rc = SQLITE_READONLY;
                   2621:       }else{
                   2622:         rc = sqlite3PagerBegin(pBt->pPager,wrflag>1,sqlite3TempInMemory(p->db));
                   2623:         if( rc==SQLITE_OK ){
                   2624:           rc = newDatabase(pBt);
                   2625:         }
                   2626:       }
                   2627:     }
                   2628:   
                   2629:     if( rc!=SQLITE_OK ){
                   2630:       unlockBtreeIfUnused(pBt);
                   2631:     }
                   2632:   }while( (rc&0xFF)==SQLITE_BUSY && pBt->inTransaction==TRANS_NONE &&
                   2633:           btreeInvokeBusyHandler(pBt) );
                   2634: 
                   2635:   if( rc==SQLITE_OK ){
                   2636:     if( p->inTrans==TRANS_NONE ){
                   2637:       pBt->nTransaction++;
                   2638: #ifndef SQLITE_OMIT_SHARED_CACHE
                   2639:       if( p->sharable ){
                   2640:        assert( p->lock.pBtree==p && p->lock.iTable==1 );
                   2641:         p->lock.eLock = READ_LOCK;
                   2642:         p->lock.pNext = pBt->pLock;
                   2643:         pBt->pLock = &p->lock;
                   2644:       }
                   2645: #endif
                   2646:     }
                   2647:     p->inTrans = (wrflag?TRANS_WRITE:TRANS_READ);
                   2648:     if( p->inTrans>pBt->inTransaction ){
                   2649:       pBt->inTransaction = p->inTrans;
                   2650:     }
                   2651:     if( wrflag ){
                   2652:       MemPage *pPage1 = pBt->pPage1;
                   2653: #ifndef SQLITE_OMIT_SHARED_CACHE
                   2654:       assert( !pBt->pWriter );
                   2655:       pBt->pWriter = p;
                   2656:       pBt->btsFlags &= ~BTS_EXCLUSIVE;
                   2657:       if( wrflag>1 ) pBt->btsFlags |= BTS_EXCLUSIVE;
                   2658: #endif
                   2659: 
                   2660:       /* If the db-size header field is incorrect (as it may be if an old
                   2661:       ** client has been writing the database file), update it now. Doing
                   2662:       ** this sooner rather than later means the database size can safely 
                   2663:       ** re-read the database size from page 1 if a savepoint or transaction
                   2664:       ** rollback occurs within the transaction.
                   2665:       */
                   2666:       if( pBt->nPage!=get4byte(&pPage1->aData[28]) ){
                   2667:         rc = sqlite3PagerWrite(pPage1->pDbPage);
                   2668:         if( rc==SQLITE_OK ){
                   2669:           put4byte(&pPage1->aData[28], pBt->nPage);
                   2670:         }
                   2671:       }
                   2672:     }
                   2673:   }
                   2674: 
                   2675: 
                   2676: trans_begun:
                   2677:   if( rc==SQLITE_OK && wrflag ){
                   2678:     /* This call makes sure that the pager has the correct number of
                   2679:     ** open savepoints. If the second parameter is greater than 0 and
                   2680:     ** the sub-journal is not already open, then it will be opened here.
                   2681:     */
                   2682:     rc = sqlite3PagerOpenSavepoint(pBt->pPager, p->db->nSavepoint);
                   2683:   }
                   2684: 
                   2685:   btreeIntegrity(p);
                   2686:   sqlite3BtreeLeave(p);
                   2687:   return rc;
                   2688: }
                   2689: 
                   2690: #ifndef SQLITE_OMIT_AUTOVACUUM
                   2691: 
                   2692: /*
                   2693: ** Set the pointer-map entries for all children of page pPage. Also, if
                   2694: ** pPage contains cells that point to overflow pages, set the pointer
                   2695: ** map entries for the overflow pages as well.
                   2696: */
                   2697: static int setChildPtrmaps(MemPage *pPage){
                   2698:   int i;                             /* Counter variable */
                   2699:   int nCell;                         /* Number of cells in page pPage */
                   2700:   int rc;                            /* Return code */
                   2701:   BtShared *pBt = pPage->pBt;
                   2702:   u8 isInitOrig = pPage->isInit;
                   2703:   Pgno pgno = pPage->pgno;
                   2704: 
                   2705:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                   2706:   rc = btreeInitPage(pPage);
                   2707:   if( rc!=SQLITE_OK ){
                   2708:     goto set_child_ptrmaps_out;
                   2709:   }
                   2710:   nCell = pPage->nCell;
                   2711: 
                   2712:   for(i=0; i<nCell; i++){
                   2713:     u8 *pCell = findCell(pPage, i);
                   2714: 
                   2715:     ptrmapPutOvflPtr(pPage, pCell, &rc);
                   2716: 
                   2717:     if( !pPage->leaf ){
                   2718:       Pgno childPgno = get4byte(pCell);
                   2719:       ptrmapPut(pBt, childPgno, PTRMAP_BTREE, pgno, &rc);
                   2720:     }
                   2721:   }
                   2722: 
                   2723:   if( !pPage->leaf ){
                   2724:     Pgno childPgno = get4byte(&pPage->aData[pPage->hdrOffset+8]);
                   2725:     ptrmapPut(pBt, childPgno, PTRMAP_BTREE, pgno, &rc);
                   2726:   }
                   2727: 
                   2728: set_child_ptrmaps_out:
                   2729:   pPage->isInit = isInitOrig;
                   2730:   return rc;
                   2731: }
                   2732: 
                   2733: /*
                   2734: ** Somewhere on pPage is a pointer to page iFrom.  Modify this pointer so
                   2735: ** that it points to iTo. Parameter eType describes the type of pointer to
                   2736: ** be modified, as  follows:
                   2737: **
                   2738: ** PTRMAP_BTREE:     pPage is a btree-page. The pointer points at a child 
                   2739: **                   page of pPage.
                   2740: **
                   2741: ** PTRMAP_OVERFLOW1: pPage is a btree-page. The pointer points at an overflow
                   2742: **                   page pointed to by one of the cells on pPage.
                   2743: **
                   2744: ** PTRMAP_OVERFLOW2: pPage is an overflow-page. The pointer points at the next
                   2745: **                   overflow page in the list.
                   2746: */
                   2747: static int modifyPagePointer(MemPage *pPage, Pgno iFrom, Pgno iTo, u8 eType){
                   2748:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                   2749:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
                   2750:   if( eType==PTRMAP_OVERFLOW2 ){
                   2751:     /* The pointer is always the first 4 bytes of the page in this case.  */
                   2752:     if( get4byte(pPage->aData)!=iFrom ){
                   2753:       return SQLITE_CORRUPT_BKPT;
                   2754:     }
                   2755:     put4byte(pPage->aData, iTo);
                   2756:   }else{
                   2757:     u8 isInitOrig = pPage->isInit;
                   2758:     int i;
                   2759:     int nCell;
                   2760: 
                   2761:     btreeInitPage(pPage);
                   2762:     nCell = pPage->nCell;
                   2763: 
                   2764:     for(i=0; i<nCell; i++){
                   2765:       u8 *pCell = findCell(pPage, i);
                   2766:       if( eType==PTRMAP_OVERFLOW1 ){
                   2767:         CellInfo info;
                   2768:         btreeParseCellPtr(pPage, pCell, &info);
                   2769:         if( info.iOverflow
                   2770:          && pCell+info.iOverflow+3<=pPage->aData+pPage->maskPage
                   2771:          && iFrom==get4byte(&pCell[info.iOverflow])
                   2772:         ){
                   2773:           put4byte(&pCell[info.iOverflow], iTo);
                   2774:           break;
                   2775:         }
                   2776:       }else{
                   2777:         if( get4byte(pCell)==iFrom ){
                   2778:           put4byte(pCell, iTo);
                   2779:           break;
                   2780:         }
                   2781:       }
                   2782:     }
                   2783:   
                   2784:     if( i==nCell ){
                   2785:       if( eType!=PTRMAP_BTREE || 
                   2786:           get4byte(&pPage->aData[pPage->hdrOffset+8])!=iFrom ){
                   2787:         return SQLITE_CORRUPT_BKPT;
                   2788:       }
                   2789:       put4byte(&pPage->aData[pPage->hdrOffset+8], iTo);
                   2790:     }
                   2791: 
                   2792:     pPage->isInit = isInitOrig;
                   2793:   }
                   2794:   return SQLITE_OK;
                   2795: }
                   2796: 
                   2797: 
                   2798: /*
                   2799: ** Move the open database page pDbPage to location iFreePage in the 
                   2800: ** database. The pDbPage reference remains valid.
                   2801: **
                   2802: ** The isCommit flag indicates that there is no need to remember that
                   2803: ** the journal needs to be sync()ed before database page pDbPage->pgno 
                   2804: ** can be written to. The caller has already promised not to write to that
                   2805: ** page.
                   2806: */
                   2807: static int relocatePage(
                   2808:   BtShared *pBt,           /* Btree */
                   2809:   MemPage *pDbPage,        /* Open page to move */
                   2810:   u8 eType,                /* Pointer map 'type' entry for pDbPage */
                   2811:   Pgno iPtrPage,           /* Pointer map 'page-no' entry for pDbPage */
                   2812:   Pgno iFreePage,          /* The location to move pDbPage to */
                   2813:   int isCommit             /* isCommit flag passed to sqlite3PagerMovepage */
                   2814: ){
                   2815:   MemPage *pPtrPage;   /* The page that contains a pointer to pDbPage */
                   2816:   Pgno iDbPage = pDbPage->pgno;
                   2817:   Pager *pPager = pBt->pPager;
                   2818:   int rc;
                   2819: 
                   2820:   assert( eType==PTRMAP_OVERFLOW2 || eType==PTRMAP_OVERFLOW1 || 
                   2821:       eType==PTRMAP_BTREE || eType==PTRMAP_ROOTPAGE );
                   2822:   assert( sqlite3_mutex_held(pBt->mutex) );
                   2823:   assert( pDbPage->pBt==pBt );
                   2824: 
                   2825:   /* Move page iDbPage from its current location to page number iFreePage */
                   2826:   TRACE(("AUTOVACUUM: Moving %d to free page %d (ptr page %d type %d)\n", 
                   2827:       iDbPage, iFreePage, iPtrPage, eType));
                   2828:   rc = sqlite3PagerMovepage(pPager, pDbPage->pDbPage, iFreePage, isCommit);
                   2829:   if( rc!=SQLITE_OK ){
                   2830:     return rc;
                   2831:   }
                   2832:   pDbPage->pgno = iFreePage;
                   2833: 
                   2834:   /* If pDbPage was a btree-page, then it may have child pages and/or cells
                   2835:   ** that point to overflow pages. The pointer map entries for all these
                   2836:   ** pages need to be changed.
                   2837:   **
                   2838:   ** If pDbPage is an overflow page, then the first 4 bytes may store a
                   2839:   ** pointer to a subsequent overflow page. If this is the case, then
                   2840:   ** the pointer map needs to be updated for the subsequent overflow page.
                   2841:   */
                   2842:   if( eType==PTRMAP_BTREE || eType==PTRMAP_ROOTPAGE ){
                   2843:     rc = setChildPtrmaps(pDbPage);
                   2844:     if( rc!=SQLITE_OK ){
                   2845:       return rc;
                   2846:     }
                   2847:   }else{
                   2848:     Pgno nextOvfl = get4byte(pDbPage->aData);
                   2849:     if( nextOvfl!=0 ){
                   2850:       ptrmapPut(pBt, nextOvfl, PTRMAP_OVERFLOW2, iFreePage, &rc);
                   2851:       if( rc!=SQLITE_OK ){
                   2852:         return rc;
                   2853:       }
                   2854:     }
                   2855:   }
                   2856: 
                   2857:   /* Fix the database pointer on page iPtrPage that pointed at iDbPage so
                   2858:   ** that it points at iFreePage. Also fix the pointer map entry for
                   2859:   ** iPtrPage.
                   2860:   */
                   2861:   if( eType!=PTRMAP_ROOTPAGE ){
                   2862:     rc = btreeGetPage(pBt, iPtrPage, &pPtrPage, 0);
                   2863:     if( rc!=SQLITE_OK ){
                   2864:       return rc;
                   2865:     }
                   2866:     rc = sqlite3PagerWrite(pPtrPage->pDbPage);
                   2867:     if( rc!=SQLITE_OK ){
                   2868:       releasePage(pPtrPage);
                   2869:       return rc;
                   2870:     }
                   2871:     rc = modifyPagePointer(pPtrPage, iDbPage, iFreePage, eType);
                   2872:     releasePage(pPtrPage);
                   2873:     if( rc==SQLITE_OK ){
                   2874:       ptrmapPut(pBt, iFreePage, eType, iPtrPage, &rc);
                   2875:     }
                   2876:   }
                   2877:   return rc;
                   2878: }
                   2879: 
                   2880: /* Forward declaration required by incrVacuumStep(). */
                   2881: static int allocateBtreePage(BtShared *, MemPage **, Pgno *, Pgno, u8);
                   2882: 
                   2883: /*
                   2884: ** Perform a single step of an incremental-vacuum. If successful,
                   2885: ** return SQLITE_OK. If there is no work to do (and therefore no
                   2886: ** point in calling this function again), return SQLITE_DONE.
                   2887: **
                   2888: ** More specificly, this function attempts to re-organize the 
                   2889: ** database so that the last page of the file currently in use
                   2890: ** is no longer in use.
                   2891: **
                   2892: ** If the nFin parameter is non-zero, this function assumes
                   2893: ** that the caller will keep calling incrVacuumStep() until
                   2894: ** it returns SQLITE_DONE or an error, and that nFin is the
                   2895: ** number of pages the database file will contain after this 
                   2896: ** process is complete.  If nFin is zero, it is assumed that
                   2897: ** incrVacuumStep() will be called a finite amount of times
                   2898: ** which may or may not empty the freelist.  A full autovacuum
                   2899: ** has nFin>0.  A "PRAGMA incremental_vacuum" has nFin==0.
                   2900: */
                   2901: static int incrVacuumStep(BtShared *pBt, Pgno nFin, Pgno iLastPg){
                   2902:   Pgno nFreeList;           /* Number of pages still on the free-list */
                   2903:   int rc;
                   2904: 
                   2905:   assert( sqlite3_mutex_held(pBt->mutex) );
                   2906:   assert( iLastPg>nFin );
                   2907: 
                   2908:   if( !PTRMAP_ISPAGE(pBt, iLastPg) && iLastPg!=PENDING_BYTE_PAGE(pBt) ){
                   2909:     u8 eType;
                   2910:     Pgno iPtrPage;
                   2911: 
                   2912:     nFreeList = get4byte(&pBt->pPage1->aData[36]);
                   2913:     if( nFreeList==0 ){
                   2914:       return SQLITE_DONE;
                   2915:     }
                   2916: 
                   2917:     rc = ptrmapGet(pBt, iLastPg, &eType, &iPtrPage);
                   2918:     if( rc!=SQLITE_OK ){
                   2919:       return rc;
                   2920:     }
                   2921:     if( eType==PTRMAP_ROOTPAGE ){
                   2922:       return SQLITE_CORRUPT_BKPT;
                   2923:     }
                   2924: 
                   2925:     if( eType==PTRMAP_FREEPAGE ){
                   2926:       if( nFin==0 ){
                   2927:         /* Remove the page from the files free-list. This is not required
                   2928:         ** if nFin is non-zero. In that case, the free-list will be
                   2929:         ** truncated to zero after this function returns, so it doesn't 
                   2930:         ** matter if it still contains some garbage entries.
                   2931:         */
                   2932:         Pgno iFreePg;
                   2933:         MemPage *pFreePg;
                   2934:         rc = allocateBtreePage(pBt, &pFreePg, &iFreePg, iLastPg, 1);
                   2935:         if( rc!=SQLITE_OK ){
                   2936:           return rc;
                   2937:         }
                   2938:         assert( iFreePg==iLastPg );
                   2939:         releasePage(pFreePg);
                   2940:       }
                   2941:     } else {
                   2942:       Pgno iFreePg;             /* Index of free page to move pLastPg to */
                   2943:       MemPage *pLastPg;
                   2944: 
                   2945:       rc = btreeGetPage(pBt, iLastPg, &pLastPg, 0);
                   2946:       if( rc!=SQLITE_OK ){
                   2947:         return rc;
                   2948:       }
                   2949: 
                   2950:       /* If nFin is zero, this loop runs exactly once and page pLastPg
                   2951:       ** is swapped with the first free page pulled off the free list.
                   2952:       **
                   2953:       ** On the other hand, if nFin is greater than zero, then keep
                   2954:       ** looping until a free-page located within the first nFin pages
                   2955:       ** of the file is found.
                   2956:       */
                   2957:       do {
                   2958:         MemPage *pFreePg;
                   2959:         rc = allocateBtreePage(pBt, &pFreePg, &iFreePg, 0, 0);
                   2960:         if( rc!=SQLITE_OK ){
                   2961:           releasePage(pLastPg);
                   2962:           return rc;
                   2963:         }
                   2964:         releasePage(pFreePg);
                   2965:       }while( nFin!=0 && iFreePg>nFin );
                   2966:       assert( iFreePg<iLastPg );
                   2967:       
                   2968:       rc = sqlite3PagerWrite(pLastPg->pDbPage);
                   2969:       if( rc==SQLITE_OK ){
                   2970:         rc = relocatePage(pBt, pLastPg, eType, iPtrPage, iFreePg, nFin!=0);
                   2971:       }
                   2972:       releasePage(pLastPg);
                   2973:       if( rc!=SQLITE_OK ){
                   2974:         return rc;
                   2975:       }
                   2976:     }
                   2977:   }
                   2978: 
                   2979:   if( nFin==0 ){
                   2980:     iLastPg--;
                   2981:     while( iLastPg==PENDING_BYTE_PAGE(pBt)||PTRMAP_ISPAGE(pBt, iLastPg) ){
                   2982:       if( PTRMAP_ISPAGE(pBt, iLastPg) ){
                   2983:         MemPage *pPg;
                   2984:         rc = btreeGetPage(pBt, iLastPg, &pPg, 0);
                   2985:         if( rc!=SQLITE_OK ){
                   2986:           return rc;
                   2987:         }
                   2988:         rc = sqlite3PagerWrite(pPg->pDbPage);
                   2989:         releasePage(pPg);
                   2990:         if( rc!=SQLITE_OK ){
                   2991:           return rc;
                   2992:         }
                   2993:       }
                   2994:       iLastPg--;
                   2995:     }
                   2996:     sqlite3PagerTruncateImage(pBt->pPager, iLastPg);
                   2997:     pBt->nPage = iLastPg;
                   2998:   }
                   2999:   return SQLITE_OK;
                   3000: }
                   3001: 
                   3002: /*
                   3003: ** A write-transaction must be opened before calling this function.
                   3004: ** It performs a single unit of work towards an incremental vacuum.
                   3005: **
                   3006: ** If the incremental vacuum is finished after this function has run,
                   3007: ** SQLITE_DONE is returned. If it is not finished, but no error occurred,
                   3008: ** SQLITE_OK is returned. Otherwise an SQLite error code. 
                   3009: */
                   3010: int sqlite3BtreeIncrVacuum(Btree *p){
                   3011:   int rc;
                   3012:   BtShared *pBt = p->pBt;
                   3013: 
                   3014:   sqlite3BtreeEnter(p);
                   3015:   assert( pBt->inTransaction==TRANS_WRITE && p->inTrans==TRANS_WRITE );
                   3016:   if( !pBt->autoVacuum ){
                   3017:     rc = SQLITE_DONE;
                   3018:   }else{
                   3019:     invalidateAllOverflowCache(pBt);
                   3020:     rc = incrVacuumStep(pBt, 0, btreePagecount(pBt));
                   3021:     if( rc==SQLITE_OK ){
                   3022:       rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
                   3023:       put4byte(&pBt->pPage1->aData[28], pBt->nPage);
                   3024:     }
                   3025:   }
                   3026:   sqlite3BtreeLeave(p);
                   3027:   return rc;
                   3028: }
                   3029: 
                   3030: /*
                   3031: ** This routine is called prior to sqlite3PagerCommit when a transaction
                   3032: ** is commited for an auto-vacuum database.
                   3033: **
                   3034: ** If SQLITE_OK is returned, then *pnTrunc is set to the number of pages
                   3035: ** the database file should be truncated to during the commit process. 
                   3036: ** i.e. the database has been reorganized so that only the first *pnTrunc
                   3037: ** pages are in use.
                   3038: */
                   3039: static int autoVacuumCommit(BtShared *pBt){
                   3040:   int rc = SQLITE_OK;
                   3041:   Pager *pPager = pBt->pPager;
                   3042:   VVA_ONLY( int nRef = sqlite3PagerRefcount(pPager) );
                   3043: 
                   3044:   assert( sqlite3_mutex_held(pBt->mutex) );
                   3045:   invalidateAllOverflowCache(pBt);
                   3046:   assert(pBt->autoVacuum);
                   3047:   if( !pBt->incrVacuum ){
                   3048:     Pgno nFin;         /* Number of pages in database after autovacuuming */
                   3049:     Pgno nFree;        /* Number of pages on the freelist initially */
                   3050:     Pgno nPtrmap;      /* Number of PtrMap pages to be freed */
                   3051:     Pgno iFree;        /* The next page to be freed */
                   3052:     int nEntry;        /* Number of entries on one ptrmap page */
                   3053:     Pgno nOrig;        /* Database size before freeing */
                   3054: 
                   3055:     nOrig = btreePagecount(pBt);
                   3056:     if( PTRMAP_ISPAGE(pBt, nOrig) || nOrig==PENDING_BYTE_PAGE(pBt) ){
                   3057:       /* It is not possible to create a database for which the final page
                   3058:       ** is either a pointer-map page or the pending-byte page. If one
                   3059:       ** is encountered, this indicates corruption.
                   3060:       */
                   3061:       return SQLITE_CORRUPT_BKPT;
                   3062:     }
                   3063: 
                   3064:     nFree = get4byte(&pBt->pPage1->aData[36]);
                   3065:     nEntry = pBt->usableSize/5;
                   3066:     nPtrmap = (nFree-nOrig+PTRMAP_PAGENO(pBt, nOrig)+nEntry)/nEntry;
                   3067:     nFin = nOrig - nFree - nPtrmap;
                   3068:     if( nOrig>PENDING_BYTE_PAGE(pBt) && nFin<PENDING_BYTE_PAGE(pBt) ){
                   3069:       nFin--;
                   3070:     }
                   3071:     while( PTRMAP_ISPAGE(pBt, nFin) || nFin==PENDING_BYTE_PAGE(pBt) ){
                   3072:       nFin--;
                   3073:     }
                   3074:     if( nFin>nOrig ) return SQLITE_CORRUPT_BKPT;
                   3075: 
                   3076:     for(iFree=nOrig; iFree>nFin && rc==SQLITE_OK; iFree--){
                   3077:       rc = incrVacuumStep(pBt, nFin, iFree);
                   3078:     }
                   3079:     if( (rc==SQLITE_DONE || rc==SQLITE_OK) && nFree>0 ){
                   3080:       rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
                   3081:       put4byte(&pBt->pPage1->aData[32], 0);
                   3082:       put4byte(&pBt->pPage1->aData[36], 0);
                   3083:       put4byte(&pBt->pPage1->aData[28], nFin);
                   3084:       sqlite3PagerTruncateImage(pBt->pPager, nFin);
                   3085:       pBt->nPage = nFin;
                   3086:     }
                   3087:     if( rc!=SQLITE_OK ){
                   3088:       sqlite3PagerRollback(pPager);
                   3089:     }
                   3090:   }
                   3091: 
                   3092:   assert( nRef==sqlite3PagerRefcount(pPager) );
                   3093:   return rc;
                   3094: }
                   3095: 
                   3096: #else /* ifndef SQLITE_OMIT_AUTOVACUUM */
                   3097: # define setChildPtrmaps(x) SQLITE_OK
                   3098: #endif
                   3099: 
                   3100: /*
                   3101: ** This routine does the first phase of a two-phase commit.  This routine
                   3102: ** causes a rollback journal to be created (if it does not already exist)
                   3103: ** and populated with enough information so that if a power loss occurs
                   3104: ** the database can be restored to its original state by playing back
                   3105: ** the journal.  Then the contents of the journal are flushed out to
                   3106: ** the disk.  After the journal is safely on oxide, the changes to the
                   3107: ** database are written into the database file and flushed to oxide.
                   3108: ** At the end of this call, the rollback journal still exists on the
                   3109: ** disk and we are still holding all locks, so the transaction has not
                   3110: ** committed.  See sqlite3BtreeCommitPhaseTwo() for the second phase of the
                   3111: ** commit process.
                   3112: **
                   3113: ** This call is a no-op if no write-transaction is currently active on pBt.
                   3114: **
                   3115: ** Otherwise, sync the database file for the btree pBt. zMaster points to
                   3116: ** the name of a master journal file that should be written into the
                   3117: ** individual journal file, or is NULL, indicating no master journal file 
                   3118: ** (single database transaction).
                   3119: **
                   3120: ** When this is called, the master journal should already have been
                   3121: ** created, populated with this journal pointer and synced to disk.
                   3122: **
                   3123: ** Once this is routine has returned, the only thing required to commit
                   3124: ** the write-transaction for this database file is to delete the journal.
                   3125: */
                   3126: int sqlite3BtreeCommitPhaseOne(Btree *p, const char *zMaster){
                   3127:   int rc = SQLITE_OK;
                   3128:   if( p->inTrans==TRANS_WRITE ){
                   3129:     BtShared *pBt = p->pBt;
                   3130:     sqlite3BtreeEnter(p);
                   3131: #ifndef SQLITE_OMIT_AUTOVACUUM
                   3132:     if( pBt->autoVacuum ){
                   3133:       rc = autoVacuumCommit(pBt);
                   3134:       if( rc!=SQLITE_OK ){
                   3135:         sqlite3BtreeLeave(p);
                   3136:         return rc;
                   3137:       }
                   3138:     }
                   3139: #endif
                   3140:     rc = sqlite3PagerCommitPhaseOne(pBt->pPager, zMaster, 0);
                   3141:     sqlite3BtreeLeave(p);
                   3142:   }
                   3143:   return rc;
                   3144: }
                   3145: 
                   3146: /*
                   3147: ** This function is called from both BtreeCommitPhaseTwo() and BtreeRollback()
                   3148: ** at the conclusion of a transaction.
                   3149: */
                   3150: static void btreeEndTransaction(Btree *p){
                   3151:   BtShared *pBt = p->pBt;
                   3152:   assert( sqlite3BtreeHoldsMutex(p) );
                   3153: 
                   3154:   btreeClearHasContent(pBt);
                   3155:   if( p->inTrans>TRANS_NONE && p->db->activeVdbeCnt>1 ){
                   3156:     /* If there are other active statements that belong to this database
                   3157:     ** handle, downgrade to a read-only transaction. The other statements
                   3158:     ** may still be reading from the database.  */
                   3159:     downgradeAllSharedCacheTableLocks(p);
                   3160:     p->inTrans = TRANS_READ;
                   3161:   }else{
                   3162:     /* If the handle had any kind of transaction open, decrement the 
                   3163:     ** transaction count of the shared btree. If the transaction count 
                   3164:     ** reaches 0, set the shared state to TRANS_NONE. The unlockBtreeIfUnused()
                   3165:     ** call below will unlock the pager.  */
                   3166:     if( p->inTrans!=TRANS_NONE ){
                   3167:       clearAllSharedCacheTableLocks(p);
                   3168:       pBt->nTransaction--;
                   3169:       if( 0==pBt->nTransaction ){
                   3170:         pBt->inTransaction = TRANS_NONE;
                   3171:       }
                   3172:     }
                   3173: 
                   3174:     /* Set the current transaction state to TRANS_NONE and unlock the 
                   3175:     ** pager if this call closed the only read or write transaction.  */
                   3176:     p->inTrans = TRANS_NONE;
                   3177:     unlockBtreeIfUnused(pBt);
                   3178:   }
                   3179: 
                   3180:   btreeIntegrity(p);
                   3181: }
                   3182: 
                   3183: /*
                   3184: ** Commit the transaction currently in progress.
                   3185: **
                   3186: ** This routine implements the second phase of a 2-phase commit.  The
                   3187: ** sqlite3BtreeCommitPhaseOne() routine does the first phase and should
                   3188: ** be invoked prior to calling this routine.  The sqlite3BtreeCommitPhaseOne()
                   3189: ** routine did all the work of writing information out to disk and flushing the
                   3190: ** contents so that they are written onto the disk platter.  All this
                   3191: ** routine has to do is delete or truncate or zero the header in the
                   3192: ** the rollback journal (which causes the transaction to commit) and
                   3193: ** drop locks.
                   3194: **
                   3195: ** Normally, if an error occurs while the pager layer is attempting to 
                   3196: ** finalize the underlying journal file, this function returns an error and
                   3197: ** the upper layer will attempt a rollback. However, if the second argument
                   3198: ** is non-zero then this b-tree transaction is part of a multi-file 
                   3199: ** transaction. In this case, the transaction has already been committed 
                   3200: ** (by deleting a master journal file) and the caller will ignore this 
                   3201: ** functions return code. So, even if an error occurs in the pager layer,
                   3202: ** reset the b-tree objects internal state to indicate that the write
                   3203: ** transaction has been closed. This is quite safe, as the pager will have
                   3204: ** transitioned to the error state.
                   3205: **
                   3206: ** This will release the write lock on the database file.  If there
                   3207: ** are no active cursors, it also releases the read lock.
                   3208: */
                   3209: int sqlite3BtreeCommitPhaseTwo(Btree *p, int bCleanup){
                   3210: 
                   3211:   if( p->inTrans==TRANS_NONE ) return SQLITE_OK;
                   3212:   sqlite3BtreeEnter(p);
                   3213:   btreeIntegrity(p);
                   3214: 
                   3215:   /* If the handle has a write-transaction open, commit the shared-btrees 
                   3216:   ** transaction and set the shared state to TRANS_READ.
                   3217:   */
                   3218:   if( p->inTrans==TRANS_WRITE ){
                   3219:     int rc;
                   3220:     BtShared *pBt = p->pBt;
                   3221:     assert( pBt->inTransaction==TRANS_WRITE );
                   3222:     assert( pBt->nTransaction>0 );
                   3223:     rc = sqlite3PagerCommitPhaseTwo(pBt->pPager);
                   3224:     if( rc!=SQLITE_OK && bCleanup==0 ){
                   3225:       sqlite3BtreeLeave(p);
                   3226:       return rc;
                   3227:     }
                   3228:     pBt->inTransaction = TRANS_READ;
                   3229:   }
                   3230: 
                   3231:   btreeEndTransaction(p);
                   3232:   sqlite3BtreeLeave(p);
                   3233:   return SQLITE_OK;
                   3234: }
                   3235: 
                   3236: /*
                   3237: ** Do both phases of a commit.
                   3238: */
                   3239: int sqlite3BtreeCommit(Btree *p){
                   3240:   int rc;
                   3241:   sqlite3BtreeEnter(p);
                   3242:   rc = sqlite3BtreeCommitPhaseOne(p, 0);
                   3243:   if( rc==SQLITE_OK ){
                   3244:     rc = sqlite3BtreeCommitPhaseTwo(p, 0);
                   3245:   }
                   3246:   sqlite3BtreeLeave(p);
                   3247:   return rc;
                   3248: }
                   3249: 
                   3250: #ifndef NDEBUG
                   3251: /*
                   3252: ** Return the number of write-cursors open on this handle. This is for use
                   3253: ** in assert() expressions, so it is only compiled if NDEBUG is not
                   3254: ** defined.
                   3255: **
                   3256: ** For the purposes of this routine, a write-cursor is any cursor that
                   3257: ** is capable of writing to the databse.  That means the cursor was
                   3258: ** originally opened for writing and the cursor has not be disabled
                   3259: ** by having its state changed to CURSOR_FAULT.
                   3260: */
                   3261: static int countWriteCursors(BtShared *pBt){
                   3262:   BtCursor *pCur;
                   3263:   int r = 0;
                   3264:   for(pCur=pBt->pCursor; pCur; pCur=pCur->pNext){
                   3265:     if( pCur->wrFlag && pCur->eState!=CURSOR_FAULT ) r++; 
                   3266:   }
                   3267:   return r;
                   3268: }
                   3269: #endif
                   3270: 
                   3271: /*
                   3272: ** This routine sets the state to CURSOR_FAULT and the error
                   3273: ** code to errCode for every cursor on BtShared that pBtree
                   3274: ** references.
                   3275: **
                   3276: ** Every cursor is tripped, including cursors that belong
                   3277: ** to other database connections that happen to be sharing
                   3278: ** the cache with pBtree.
                   3279: **
                   3280: ** This routine gets called when a rollback occurs.
                   3281: ** All cursors using the same cache must be tripped
                   3282: ** to prevent them from trying to use the btree after
                   3283: ** the rollback.  The rollback may have deleted tables
                   3284: ** or moved root pages, so it is not sufficient to
                   3285: ** save the state of the cursor.  The cursor must be
                   3286: ** invalidated.
                   3287: */
                   3288: void sqlite3BtreeTripAllCursors(Btree *pBtree, int errCode){
                   3289:   BtCursor *p;
                   3290:   sqlite3BtreeEnter(pBtree);
                   3291:   for(p=pBtree->pBt->pCursor; p; p=p->pNext){
                   3292:     int i;
                   3293:     sqlite3BtreeClearCursor(p);
                   3294:     p->eState = CURSOR_FAULT;
                   3295:     p->skipNext = errCode;
                   3296:     for(i=0; i<=p->iPage; i++){
                   3297:       releasePage(p->apPage[i]);
                   3298:       p->apPage[i] = 0;
                   3299:     }
                   3300:   }
                   3301:   sqlite3BtreeLeave(pBtree);
                   3302: }
                   3303: 
                   3304: /*
                   3305: ** Rollback the transaction in progress.  All cursors will be
                   3306: ** invalided by this operation.  Any attempt to use a cursor
                   3307: ** that was open at the beginning of this operation will result
                   3308: ** in an error.
                   3309: **
                   3310: ** This will release the write lock on the database file.  If there
                   3311: ** are no active cursors, it also releases the read lock.
                   3312: */
                   3313: int sqlite3BtreeRollback(Btree *p){
                   3314:   int rc;
                   3315:   BtShared *pBt = p->pBt;
                   3316:   MemPage *pPage1;
                   3317: 
                   3318:   sqlite3BtreeEnter(p);
                   3319:   rc = saveAllCursors(pBt, 0, 0);
                   3320: #ifndef SQLITE_OMIT_SHARED_CACHE
                   3321:   if( rc!=SQLITE_OK ){
                   3322:     /* This is a horrible situation. An IO or malloc() error occurred whilst
                   3323:     ** trying to save cursor positions. If this is an automatic rollback (as
                   3324:     ** the result of a constraint, malloc() failure or IO error) then 
                   3325:     ** the cache may be internally inconsistent (not contain valid trees) so
                   3326:     ** we cannot simply return the error to the caller. Instead, abort 
                   3327:     ** all queries that may be using any of the cursors that failed to save.
                   3328:     */
                   3329:     sqlite3BtreeTripAllCursors(p, rc);
                   3330:   }
                   3331: #endif
                   3332:   btreeIntegrity(p);
                   3333: 
                   3334:   if( p->inTrans==TRANS_WRITE ){
                   3335:     int rc2;
                   3336: 
                   3337:     assert( TRANS_WRITE==pBt->inTransaction );
                   3338:     rc2 = sqlite3PagerRollback(pBt->pPager);
                   3339:     if( rc2!=SQLITE_OK ){
                   3340:       rc = rc2;
                   3341:     }
                   3342: 
                   3343:     /* The rollback may have destroyed the pPage1->aData value.  So
                   3344:     ** call btreeGetPage() on page 1 again to make
                   3345:     ** sure pPage1->aData is set correctly. */
                   3346:     if( btreeGetPage(pBt, 1, &pPage1, 0)==SQLITE_OK ){
                   3347:       int nPage = get4byte(28+(u8*)pPage1->aData);
                   3348:       testcase( nPage==0 );
                   3349:       if( nPage==0 ) sqlite3PagerPagecount(pBt->pPager, &nPage);
                   3350:       testcase( pBt->nPage!=nPage );
                   3351:       pBt->nPage = nPage;
                   3352:       releasePage(pPage1);
                   3353:     }
                   3354:     assert( countWriteCursors(pBt)==0 );
                   3355:     pBt->inTransaction = TRANS_READ;
                   3356:   }
                   3357: 
                   3358:   btreeEndTransaction(p);
                   3359:   sqlite3BtreeLeave(p);
                   3360:   return rc;
                   3361: }
                   3362: 
                   3363: /*
                   3364: ** Start a statement subtransaction. The subtransaction can can be rolled
                   3365: ** back independently of the main transaction. You must start a transaction 
                   3366: ** before starting a subtransaction. The subtransaction is ended automatically 
                   3367: ** if the main transaction commits or rolls back.
                   3368: **
                   3369: ** Statement subtransactions are used around individual SQL statements
                   3370: ** that are contained within a BEGIN...COMMIT block.  If a constraint
                   3371: ** error occurs within the statement, the effect of that one statement
                   3372: ** can be rolled back without having to rollback the entire transaction.
                   3373: **
                   3374: ** A statement sub-transaction is implemented as an anonymous savepoint. The
                   3375: ** value passed as the second parameter is the total number of savepoints,
                   3376: ** including the new anonymous savepoint, open on the B-Tree. i.e. if there
                   3377: ** are no active savepoints and no other statement-transactions open,
                   3378: ** iStatement is 1. This anonymous savepoint can be released or rolled back
                   3379: ** using the sqlite3BtreeSavepoint() function.
                   3380: */
                   3381: int sqlite3BtreeBeginStmt(Btree *p, int iStatement){
                   3382:   int rc;
                   3383:   BtShared *pBt = p->pBt;
                   3384:   sqlite3BtreeEnter(p);
                   3385:   assert( p->inTrans==TRANS_WRITE );
                   3386:   assert( (pBt->btsFlags & BTS_READ_ONLY)==0 );
                   3387:   assert( iStatement>0 );
                   3388:   assert( iStatement>p->db->nSavepoint );
                   3389:   assert( pBt->inTransaction==TRANS_WRITE );
                   3390:   /* At the pager level, a statement transaction is a savepoint with
                   3391:   ** an index greater than all savepoints created explicitly using
                   3392:   ** SQL statements. It is illegal to open, release or rollback any
                   3393:   ** such savepoints while the statement transaction savepoint is active.
                   3394:   */
                   3395:   rc = sqlite3PagerOpenSavepoint(pBt->pPager, iStatement);
                   3396:   sqlite3BtreeLeave(p);
                   3397:   return rc;
                   3398: }
                   3399: 
                   3400: /*
                   3401: ** The second argument to this function, op, is always SAVEPOINT_ROLLBACK
                   3402: ** or SAVEPOINT_RELEASE. This function either releases or rolls back the
                   3403: ** savepoint identified by parameter iSavepoint, depending on the value 
                   3404: ** of op.
                   3405: **
                   3406: ** Normally, iSavepoint is greater than or equal to zero. However, if op is
                   3407: ** SAVEPOINT_ROLLBACK, then iSavepoint may also be -1. In this case the 
                   3408: ** contents of the entire transaction are rolled back. This is different
                   3409: ** from a normal transaction rollback, as no locks are released and the
                   3410: ** transaction remains open.
                   3411: */
                   3412: int sqlite3BtreeSavepoint(Btree *p, int op, int iSavepoint){
                   3413:   int rc = SQLITE_OK;
                   3414:   if( p && p->inTrans==TRANS_WRITE ){
                   3415:     BtShared *pBt = p->pBt;
                   3416:     assert( op==SAVEPOINT_RELEASE || op==SAVEPOINT_ROLLBACK );
                   3417:     assert( iSavepoint>=0 || (iSavepoint==-1 && op==SAVEPOINT_ROLLBACK) );
                   3418:     sqlite3BtreeEnter(p);
                   3419:     rc = sqlite3PagerSavepoint(pBt->pPager, op, iSavepoint);
                   3420:     if( rc==SQLITE_OK ){
                   3421:       if( iSavepoint<0 && (pBt->btsFlags & BTS_INITIALLY_EMPTY)!=0 ){
                   3422:         pBt->nPage = 0;
                   3423:       }
                   3424:       rc = newDatabase(pBt);
                   3425:       pBt->nPage = get4byte(28 + pBt->pPage1->aData);
                   3426: 
                   3427:       /* The database size was written into the offset 28 of the header
                   3428:       ** when the transaction started, so we know that the value at offset
                   3429:       ** 28 is nonzero. */
                   3430:       assert( pBt->nPage>0 );
                   3431:     }
                   3432:     sqlite3BtreeLeave(p);
                   3433:   }
                   3434:   return rc;
                   3435: }
                   3436: 
                   3437: /*
                   3438: ** Create a new cursor for the BTree whose root is on the page
                   3439: ** iTable. If a read-only cursor is requested, it is assumed that
                   3440: ** the caller already has at least a read-only transaction open
                   3441: ** on the database already. If a write-cursor is requested, then
                   3442: ** the caller is assumed to have an open write transaction.
                   3443: **
                   3444: ** If wrFlag==0, then the cursor can only be used for reading.
                   3445: ** If wrFlag==1, then the cursor can be used for reading or for
                   3446: ** writing if other conditions for writing are also met.  These
                   3447: ** are the conditions that must be met in order for writing to
                   3448: ** be allowed:
                   3449: **
                   3450: ** 1:  The cursor must have been opened with wrFlag==1
                   3451: **
                   3452: ** 2:  Other database connections that share the same pager cache
                   3453: **     but which are not in the READ_UNCOMMITTED state may not have
                   3454: **     cursors open with wrFlag==0 on the same table.  Otherwise
                   3455: **     the changes made by this write cursor would be visible to
                   3456: **     the read cursors in the other database connection.
                   3457: **
                   3458: ** 3:  The database must be writable (not on read-only media)
                   3459: **
                   3460: ** 4:  There must be an active transaction.
                   3461: **
                   3462: ** No checking is done to make sure that page iTable really is the
                   3463: ** root page of a b-tree.  If it is not, then the cursor acquired
                   3464: ** will not work correctly.
                   3465: **
                   3466: ** It is assumed that the sqlite3BtreeCursorZero() has been called
                   3467: ** on pCur to initialize the memory space prior to invoking this routine.
                   3468: */
                   3469: static int btreeCursor(
                   3470:   Btree *p,                              /* The btree */
                   3471:   int iTable,                            /* Root page of table to open */
                   3472:   int wrFlag,                            /* 1 to write. 0 read-only */
                   3473:   struct KeyInfo *pKeyInfo,              /* First arg to comparison function */
                   3474:   BtCursor *pCur                         /* Space for new cursor */
                   3475: ){
                   3476:   BtShared *pBt = p->pBt;                /* Shared b-tree handle */
                   3477: 
                   3478:   assert( sqlite3BtreeHoldsMutex(p) );
                   3479:   assert( wrFlag==0 || wrFlag==1 );
                   3480: 
                   3481:   /* The following assert statements verify that if this is a sharable 
                   3482:   ** b-tree database, the connection is holding the required table locks, 
                   3483:   ** and that no other connection has any open cursor that conflicts with 
                   3484:   ** this lock.  */
                   3485:   assert( hasSharedCacheTableLock(p, iTable, pKeyInfo!=0, wrFlag+1) );
                   3486:   assert( wrFlag==0 || !hasReadConflicts(p, iTable) );
                   3487: 
                   3488:   /* Assert that the caller has opened the required transaction. */
                   3489:   assert( p->inTrans>TRANS_NONE );
                   3490:   assert( wrFlag==0 || p->inTrans==TRANS_WRITE );
                   3491:   assert( pBt->pPage1 && pBt->pPage1->aData );
                   3492: 
                   3493:   if( NEVER(wrFlag && (pBt->btsFlags & BTS_READ_ONLY)!=0) ){
                   3494:     return SQLITE_READONLY;
                   3495:   }
                   3496:   if( iTable==1 && btreePagecount(pBt)==0 ){
                   3497:     assert( wrFlag==0 );
                   3498:     iTable = 0;
                   3499:   }
                   3500: 
                   3501:   /* Now that no other errors can occur, finish filling in the BtCursor
                   3502:   ** variables and link the cursor into the BtShared list.  */
                   3503:   pCur->pgnoRoot = (Pgno)iTable;
                   3504:   pCur->iPage = -1;
                   3505:   pCur->pKeyInfo = pKeyInfo;
                   3506:   pCur->pBtree = p;
                   3507:   pCur->pBt = pBt;
                   3508:   pCur->wrFlag = (u8)wrFlag;
                   3509:   pCur->pNext = pBt->pCursor;
                   3510:   if( pCur->pNext ){
                   3511:     pCur->pNext->pPrev = pCur;
                   3512:   }
                   3513:   pBt->pCursor = pCur;
                   3514:   pCur->eState = CURSOR_INVALID;
                   3515:   pCur->cachedRowid = 0;
                   3516:   return SQLITE_OK;
                   3517: }
                   3518: int sqlite3BtreeCursor(
                   3519:   Btree *p,                                   /* The btree */
                   3520:   int iTable,                                 /* Root page of table to open */
                   3521:   int wrFlag,                                 /* 1 to write. 0 read-only */
                   3522:   struct KeyInfo *pKeyInfo,                   /* First arg to xCompare() */
                   3523:   BtCursor *pCur                              /* Write new cursor here */
                   3524: ){
                   3525:   int rc;
                   3526:   sqlite3BtreeEnter(p);
                   3527:   rc = btreeCursor(p, iTable, wrFlag, pKeyInfo, pCur);
                   3528:   sqlite3BtreeLeave(p);
                   3529:   return rc;
                   3530: }
                   3531: 
                   3532: /*
                   3533: ** Return the size of a BtCursor object in bytes.
                   3534: **
                   3535: ** This interfaces is needed so that users of cursors can preallocate
                   3536: ** sufficient storage to hold a cursor.  The BtCursor object is opaque
                   3537: ** to users so they cannot do the sizeof() themselves - they must call
                   3538: ** this routine.
                   3539: */
                   3540: int sqlite3BtreeCursorSize(void){
                   3541:   return ROUND8(sizeof(BtCursor));
                   3542: }
                   3543: 
                   3544: /*
                   3545: ** Initialize memory that will be converted into a BtCursor object.
                   3546: **
                   3547: ** The simple approach here would be to memset() the entire object
                   3548: ** to zero.  But it turns out that the apPage[] and aiIdx[] arrays
                   3549: ** do not need to be zeroed and they are large, so we can save a lot
                   3550: ** of run-time by skipping the initialization of those elements.
                   3551: */
                   3552: void sqlite3BtreeCursorZero(BtCursor *p){
                   3553:   memset(p, 0, offsetof(BtCursor, iPage));
                   3554: }
                   3555: 
                   3556: /*
                   3557: ** Set the cached rowid value of every cursor in the same database file
                   3558: ** as pCur and having the same root page number as pCur.  The value is
                   3559: ** set to iRowid.
                   3560: **
                   3561: ** Only positive rowid values are considered valid for this cache.
                   3562: ** The cache is initialized to zero, indicating an invalid cache.
                   3563: ** A btree will work fine with zero or negative rowids.  We just cannot
                   3564: ** cache zero or negative rowids, which means tables that use zero or
                   3565: ** negative rowids might run a little slower.  But in practice, zero
                   3566: ** or negative rowids are very uncommon so this should not be a problem.
                   3567: */
                   3568: void sqlite3BtreeSetCachedRowid(BtCursor *pCur, sqlite3_int64 iRowid){
                   3569:   BtCursor *p;
                   3570:   for(p=pCur->pBt->pCursor; p; p=p->pNext){
                   3571:     if( p->pgnoRoot==pCur->pgnoRoot ) p->cachedRowid = iRowid;
                   3572:   }
                   3573:   assert( pCur->cachedRowid==iRowid );
                   3574: }
                   3575: 
                   3576: /*
                   3577: ** Return the cached rowid for the given cursor.  A negative or zero
                   3578: ** return value indicates that the rowid cache is invalid and should be
                   3579: ** ignored.  If the rowid cache has never before been set, then a
                   3580: ** zero is returned.
                   3581: */
                   3582: sqlite3_int64 sqlite3BtreeGetCachedRowid(BtCursor *pCur){
                   3583:   return pCur->cachedRowid;
                   3584: }
                   3585: 
                   3586: /*
                   3587: ** Close a cursor.  The read lock on the database file is released
                   3588: ** when the last cursor is closed.
                   3589: */
                   3590: int sqlite3BtreeCloseCursor(BtCursor *pCur){
                   3591:   Btree *pBtree = pCur->pBtree;
                   3592:   if( pBtree ){
                   3593:     int i;
                   3594:     BtShared *pBt = pCur->pBt;
                   3595:     sqlite3BtreeEnter(pBtree);
                   3596:     sqlite3BtreeClearCursor(pCur);
                   3597:     if( pCur->pPrev ){
                   3598:       pCur->pPrev->pNext = pCur->pNext;
                   3599:     }else{
                   3600:       pBt->pCursor = pCur->pNext;
                   3601:     }
                   3602:     if( pCur->pNext ){
                   3603:       pCur->pNext->pPrev = pCur->pPrev;
                   3604:     }
                   3605:     for(i=0; i<=pCur->iPage; i++){
                   3606:       releasePage(pCur->apPage[i]);
                   3607:     }
                   3608:     unlockBtreeIfUnused(pBt);
                   3609:     invalidateOverflowCache(pCur);
                   3610:     /* sqlite3_free(pCur); */
                   3611:     sqlite3BtreeLeave(pBtree);
                   3612:   }
                   3613:   return SQLITE_OK;
                   3614: }
                   3615: 
                   3616: /*
                   3617: ** Make sure the BtCursor* given in the argument has a valid
                   3618: ** BtCursor.info structure.  If it is not already valid, call
                   3619: ** btreeParseCell() to fill it in.
                   3620: **
                   3621: ** BtCursor.info is a cache of the information in the current cell.
                   3622: ** Using this cache reduces the number of calls to btreeParseCell().
                   3623: **
                   3624: ** 2007-06-25:  There is a bug in some versions of MSVC that cause the
                   3625: ** compiler to crash when getCellInfo() is implemented as a macro.
                   3626: ** But there is a measureable speed advantage to using the macro on gcc
                   3627: ** (when less compiler optimizations like -Os or -O0 are used and the
                   3628: ** compiler is not doing agressive inlining.)  So we use a real function
                   3629: ** for MSVC and a macro for everything else.  Ticket #2457.
                   3630: */
                   3631: #ifndef NDEBUG
                   3632:   static void assertCellInfo(BtCursor *pCur){
                   3633:     CellInfo info;
                   3634:     int iPage = pCur->iPage;
                   3635:     memset(&info, 0, sizeof(info));
                   3636:     btreeParseCell(pCur->apPage[iPage], pCur->aiIdx[iPage], &info);
                   3637:     assert( memcmp(&info, &pCur->info, sizeof(info))==0 );
                   3638:   }
                   3639: #else
                   3640:   #define assertCellInfo(x)
                   3641: #endif
                   3642: #ifdef _MSC_VER
                   3643:   /* Use a real function in MSVC to work around bugs in that compiler. */
                   3644:   static void getCellInfo(BtCursor *pCur){
                   3645:     if( pCur->info.nSize==0 ){
                   3646:       int iPage = pCur->iPage;
                   3647:       btreeParseCell(pCur->apPage[iPage],pCur->aiIdx[iPage],&pCur->info);
                   3648:       pCur->validNKey = 1;
                   3649:     }else{
                   3650:       assertCellInfo(pCur);
                   3651:     }
                   3652:   }
                   3653: #else /* if not _MSC_VER */
                   3654:   /* Use a macro in all other compilers so that the function is inlined */
                   3655: #define getCellInfo(pCur)                                                      \
                   3656:   if( pCur->info.nSize==0 ){                                                   \
                   3657:     int iPage = pCur->iPage;                                                   \
                   3658:     btreeParseCell(pCur->apPage[iPage],pCur->aiIdx[iPage],&pCur->info); \
                   3659:     pCur->validNKey = 1;                                                       \
                   3660:   }else{                                                                       \
                   3661:     assertCellInfo(pCur);                                                      \
                   3662:   }
                   3663: #endif /* _MSC_VER */
                   3664: 
                   3665: #ifndef NDEBUG  /* The next routine used only within assert() statements */
                   3666: /*
                   3667: ** Return true if the given BtCursor is valid.  A valid cursor is one
                   3668: ** that is currently pointing to a row in a (non-empty) table.
                   3669: ** This is a verification routine is used only within assert() statements.
                   3670: */
                   3671: int sqlite3BtreeCursorIsValid(BtCursor *pCur){
                   3672:   return pCur && pCur->eState==CURSOR_VALID;
                   3673: }
                   3674: #endif /* NDEBUG */
                   3675: 
                   3676: /*
                   3677: ** Set *pSize to the size of the buffer needed to hold the value of
                   3678: ** the key for the current entry.  If the cursor is not pointing
                   3679: ** to a valid entry, *pSize is set to 0. 
                   3680: **
                   3681: ** For a table with the INTKEY flag set, this routine returns the key
                   3682: ** itself, not the number of bytes in the key.
                   3683: **
                   3684: ** The caller must position the cursor prior to invoking this routine.
                   3685: ** 
                   3686: ** This routine cannot fail.  It always returns SQLITE_OK.  
                   3687: */
                   3688: int sqlite3BtreeKeySize(BtCursor *pCur, i64 *pSize){
                   3689:   assert( cursorHoldsMutex(pCur) );
                   3690:   assert( pCur->eState==CURSOR_INVALID || pCur->eState==CURSOR_VALID );
                   3691:   if( pCur->eState!=CURSOR_VALID ){
                   3692:     *pSize = 0;
                   3693:   }else{
                   3694:     getCellInfo(pCur);
                   3695:     *pSize = pCur->info.nKey;
                   3696:   }
                   3697:   return SQLITE_OK;
                   3698: }
                   3699: 
                   3700: /*
                   3701: ** Set *pSize to the number of bytes of data in the entry the
                   3702: ** cursor currently points to.
                   3703: **
                   3704: ** The caller must guarantee that the cursor is pointing to a non-NULL
                   3705: ** valid entry.  In other words, the calling procedure must guarantee
                   3706: ** that the cursor has Cursor.eState==CURSOR_VALID.
                   3707: **
                   3708: ** Failure is not possible.  This function always returns SQLITE_OK.
                   3709: ** It might just as well be a procedure (returning void) but we continue
                   3710: ** to return an integer result code for historical reasons.
                   3711: */
                   3712: int sqlite3BtreeDataSize(BtCursor *pCur, u32 *pSize){
                   3713:   assert( cursorHoldsMutex(pCur) );
                   3714:   assert( pCur->eState==CURSOR_VALID );
                   3715:   getCellInfo(pCur);
                   3716:   *pSize = pCur->info.nData;
                   3717:   return SQLITE_OK;
                   3718: }
                   3719: 
                   3720: /*
                   3721: ** Given the page number of an overflow page in the database (parameter
                   3722: ** ovfl), this function finds the page number of the next page in the 
                   3723: ** linked list of overflow pages. If possible, it uses the auto-vacuum
                   3724: ** pointer-map data instead of reading the content of page ovfl to do so. 
                   3725: **
                   3726: ** If an error occurs an SQLite error code is returned. Otherwise:
                   3727: **
                   3728: ** The page number of the next overflow page in the linked list is 
                   3729: ** written to *pPgnoNext. If page ovfl is the last page in its linked 
                   3730: ** list, *pPgnoNext is set to zero. 
                   3731: **
                   3732: ** If ppPage is not NULL, and a reference to the MemPage object corresponding
                   3733: ** to page number pOvfl was obtained, then *ppPage is set to point to that
                   3734: ** reference. It is the responsibility of the caller to call releasePage()
                   3735: ** on *ppPage to free the reference. In no reference was obtained (because
                   3736: ** the pointer-map was used to obtain the value for *pPgnoNext), then
                   3737: ** *ppPage is set to zero.
                   3738: */
                   3739: static int getOverflowPage(
                   3740:   BtShared *pBt,               /* The database file */
                   3741:   Pgno ovfl,                   /* Current overflow page number */
                   3742:   MemPage **ppPage,            /* OUT: MemPage handle (may be NULL) */
                   3743:   Pgno *pPgnoNext              /* OUT: Next overflow page number */
                   3744: ){
                   3745:   Pgno next = 0;
                   3746:   MemPage *pPage = 0;
                   3747:   int rc = SQLITE_OK;
                   3748: 
                   3749:   assert( sqlite3_mutex_held(pBt->mutex) );
                   3750:   assert(pPgnoNext);
                   3751: 
                   3752: #ifndef SQLITE_OMIT_AUTOVACUUM
                   3753:   /* Try to find the next page in the overflow list using the
                   3754:   ** autovacuum pointer-map pages. Guess that the next page in 
                   3755:   ** the overflow list is page number (ovfl+1). If that guess turns 
                   3756:   ** out to be wrong, fall back to loading the data of page 
                   3757:   ** number ovfl to determine the next page number.
                   3758:   */
                   3759:   if( pBt->autoVacuum ){
                   3760:     Pgno pgno;
                   3761:     Pgno iGuess = ovfl+1;
                   3762:     u8 eType;
                   3763: 
                   3764:     while( PTRMAP_ISPAGE(pBt, iGuess) || iGuess==PENDING_BYTE_PAGE(pBt) ){
                   3765:       iGuess++;
                   3766:     }
                   3767: 
                   3768:     if( iGuess<=btreePagecount(pBt) ){
                   3769:       rc = ptrmapGet(pBt, iGuess, &eType, &pgno);
                   3770:       if( rc==SQLITE_OK && eType==PTRMAP_OVERFLOW2 && pgno==ovfl ){
                   3771:         next = iGuess;
                   3772:         rc = SQLITE_DONE;
                   3773:       }
                   3774:     }
                   3775:   }
                   3776: #endif
                   3777: 
                   3778:   assert( next==0 || rc==SQLITE_DONE );
                   3779:   if( rc==SQLITE_OK ){
                   3780:     rc = btreeGetPage(pBt, ovfl, &pPage, 0);
                   3781:     assert( rc==SQLITE_OK || pPage==0 );
                   3782:     if( rc==SQLITE_OK ){
                   3783:       next = get4byte(pPage->aData);
                   3784:     }
                   3785:   }
                   3786: 
                   3787:   *pPgnoNext = next;
                   3788:   if( ppPage ){
                   3789:     *ppPage = pPage;
                   3790:   }else{
                   3791:     releasePage(pPage);
                   3792:   }
                   3793:   return (rc==SQLITE_DONE ? SQLITE_OK : rc);
                   3794: }
                   3795: 
                   3796: /*
                   3797: ** Copy data from a buffer to a page, or from a page to a buffer.
                   3798: **
                   3799: ** pPayload is a pointer to data stored on database page pDbPage.
                   3800: ** If argument eOp is false, then nByte bytes of data are copied
                   3801: ** from pPayload to the buffer pointed at by pBuf. If eOp is true,
                   3802: ** then sqlite3PagerWrite() is called on pDbPage and nByte bytes
                   3803: ** of data are copied from the buffer pBuf to pPayload.
                   3804: **
                   3805: ** SQLITE_OK is returned on success, otherwise an error code.
                   3806: */
                   3807: static int copyPayload(
                   3808:   void *pPayload,           /* Pointer to page data */
                   3809:   void *pBuf,               /* Pointer to buffer */
                   3810:   int nByte,                /* Number of bytes to copy */
                   3811:   int eOp,                  /* 0 -> copy from page, 1 -> copy to page */
                   3812:   DbPage *pDbPage           /* Page containing pPayload */
                   3813: ){
                   3814:   if( eOp ){
                   3815:     /* Copy data from buffer to page (a write operation) */
                   3816:     int rc = sqlite3PagerWrite(pDbPage);
                   3817:     if( rc!=SQLITE_OK ){
                   3818:       return rc;
                   3819:     }
                   3820:     memcpy(pPayload, pBuf, nByte);
                   3821:   }else{
                   3822:     /* Copy data from page to buffer (a read operation) */
                   3823:     memcpy(pBuf, pPayload, nByte);
                   3824:   }
                   3825:   return SQLITE_OK;
                   3826: }
                   3827: 
                   3828: /*
                   3829: ** This function is used to read or overwrite payload information
                   3830: ** for the entry that the pCur cursor is pointing to. If the eOp
                   3831: ** parameter is 0, this is a read operation (data copied into
                   3832: ** buffer pBuf). If it is non-zero, a write (data copied from
                   3833: ** buffer pBuf).
                   3834: **
                   3835: ** A total of "amt" bytes are read or written beginning at "offset".
                   3836: ** Data is read to or from the buffer pBuf.
                   3837: **
                   3838: ** The content being read or written might appear on the main page
                   3839: ** or be scattered out on multiple overflow pages.
                   3840: **
                   3841: ** If the BtCursor.isIncrblobHandle flag is set, and the current
                   3842: ** cursor entry uses one or more overflow pages, this function
                   3843: ** allocates space for and lazily popluates the overflow page-list 
                   3844: ** cache array (BtCursor.aOverflow). Subsequent calls use this
                   3845: ** cache to make seeking to the supplied offset more efficient.
                   3846: **
                   3847: ** Once an overflow page-list cache has been allocated, it may be
                   3848: ** invalidated if some other cursor writes to the same table, or if
                   3849: ** the cursor is moved to a different row. Additionally, in auto-vacuum
                   3850: ** mode, the following events may invalidate an overflow page-list cache.
                   3851: **
                   3852: **   * An incremental vacuum,
                   3853: **   * A commit in auto_vacuum="full" mode,
                   3854: **   * Creating a table (may require moving an overflow page).
                   3855: */
                   3856: static int accessPayload(
                   3857:   BtCursor *pCur,      /* Cursor pointing to entry to read from */
                   3858:   u32 offset,          /* Begin reading this far into payload */
                   3859:   u32 amt,             /* Read this many bytes */
                   3860:   unsigned char *pBuf, /* Write the bytes into this buffer */ 
                   3861:   int eOp              /* zero to read. non-zero to write. */
                   3862: ){
                   3863:   unsigned char *aPayload;
                   3864:   int rc = SQLITE_OK;
                   3865:   u32 nKey;
                   3866:   int iIdx = 0;
                   3867:   MemPage *pPage = pCur->apPage[pCur->iPage]; /* Btree page of current entry */
                   3868:   BtShared *pBt = pCur->pBt;                  /* Btree this cursor belongs to */
                   3869: 
                   3870:   assert( pPage );
                   3871:   assert( pCur->eState==CURSOR_VALID );
                   3872:   assert( pCur->aiIdx[pCur->iPage]<pPage->nCell );
                   3873:   assert( cursorHoldsMutex(pCur) );
                   3874: 
                   3875:   getCellInfo(pCur);
                   3876:   aPayload = pCur->info.pCell + pCur->info.nHeader;
                   3877:   nKey = (pPage->intKey ? 0 : (int)pCur->info.nKey);
                   3878: 
                   3879:   if( NEVER(offset+amt > nKey+pCur->info.nData) 
                   3880:    || &aPayload[pCur->info.nLocal] > &pPage->aData[pBt->usableSize]
                   3881:   ){
                   3882:     /* Trying to read or write past the end of the data is an error */
                   3883:     return SQLITE_CORRUPT_BKPT;
                   3884:   }
                   3885: 
                   3886:   /* Check if data must be read/written to/from the btree page itself. */
                   3887:   if( offset<pCur->info.nLocal ){
                   3888:     int a = amt;
                   3889:     if( a+offset>pCur->info.nLocal ){
                   3890:       a = pCur->info.nLocal - offset;
                   3891:     }
                   3892:     rc = copyPayload(&aPayload[offset], pBuf, a, eOp, pPage->pDbPage);
                   3893:     offset = 0;
                   3894:     pBuf += a;
                   3895:     amt -= a;
                   3896:   }else{
                   3897:     offset -= pCur->info.nLocal;
                   3898:   }
                   3899: 
                   3900:   if( rc==SQLITE_OK && amt>0 ){
                   3901:     const u32 ovflSize = pBt->usableSize - 4;  /* Bytes content per ovfl page */
                   3902:     Pgno nextPage;
                   3903: 
                   3904:     nextPage = get4byte(&aPayload[pCur->info.nLocal]);
                   3905: 
                   3906: #ifndef SQLITE_OMIT_INCRBLOB
                   3907:     /* If the isIncrblobHandle flag is set and the BtCursor.aOverflow[]
                   3908:     ** has not been allocated, allocate it now. The array is sized at
                   3909:     ** one entry for each overflow page in the overflow chain. The
                   3910:     ** page number of the first overflow page is stored in aOverflow[0],
                   3911:     ** etc. A value of 0 in the aOverflow[] array means "not yet known"
                   3912:     ** (the cache is lazily populated).
                   3913:     */
                   3914:     if( pCur->isIncrblobHandle && !pCur->aOverflow ){
                   3915:       int nOvfl = (pCur->info.nPayload-pCur->info.nLocal+ovflSize-1)/ovflSize;
                   3916:       pCur->aOverflow = (Pgno *)sqlite3MallocZero(sizeof(Pgno)*nOvfl);
                   3917:       /* nOvfl is always positive.  If it were zero, fetchPayload would have
                   3918:       ** been used instead of this routine. */
                   3919:       if( ALWAYS(nOvfl) && !pCur->aOverflow ){
                   3920:         rc = SQLITE_NOMEM;
                   3921:       }
                   3922:     }
                   3923: 
                   3924:     /* If the overflow page-list cache has been allocated and the
                   3925:     ** entry for the first required overflow page is valid, skip
                   3926:     ** directly to it.
                   3927:     */
                   3928:     if( pCur->aOverflow && pCur->aOverflow[offset/ovflSize] ){
                   3929:       iIdx = (offset/ovflSize);
                   3930:       nextPage = pCur->aOverflow[iIdx];
                   3931:       offset = (offset%ovflSize);
                   3932:     }
                   3933: #endif
                   3934: 
                   3935:     for( ; rc==SQLITE_OK && amt>0 && nextPage; iIdx++){
                   3936: 
                   3937: #ifndef SQLITE_OMIT_INCRBLOB
                   3938:       /* If required, populate the overflow page-list cache. */
                   3939:       if( pCur->aOverflow ){
                   3940:         assert(!pCur->aOverflow[iIdx] || pCur->aOverflow[iIdx]==nextPage);
                   3941:         pCur->aOverflow[iIdx] = nextPage;
                   3942:       }
                   3943: #endif
                   3944: 
                   3945:       if( offset>=ovflSize ){
                   3946:         /* The only reason to read this page is to obtain the page
                   3947:         ** number for the next page in the overflow chain. The page
                   3948:         ** data is not required. So first try to lookup the overflow
                   3949:         ** page-list cache, if any, then fall back to the getOverflowPage()
                   3950:         ** function.
                   3951:         */
                   3952: #ifndef SQLITE_OMIT_INCRBLOB
                   3953:         if( pCur->aOverflow && pCur->aOverflow[iIdx+1] ){
                   3954:           nextPage = pCur->aOverflow[iIdx+1];
                   3955:         } else 
                   3956: #endif
                   3957:           rc = getOverflowPage(pBt, nextPage, 0, &nextPage);
                   3958:         offset -= ovflSize;
                   3959:       }else{
                   3960:         /* Need to read this page properly. It contains some of the
                   3961:         ** range of data that is being read (eOp==0) or written (eOp!=0).
                   3962:         */
                   3963: #ifdef SQLITE_DIRECT_OVERFLOW_READ
                   3964:         sqlite3_file *fd;
                   3965: #endif
                   3966:         int a = amt;
                   3967:         if( a + offset > ovflSize ){
                   3968:           a = ovflSize - offset;
                   3969:         }
                   3970: 
                   3971: #ifdef SQLITE_DIRECT_OVERFLOW_READ
                   3972:         /* If all the following are true:
                   3973:         **
                   3974:         **   1) this is a read operation, and 
                   3975:         **   2) data is required from the start of this overflow page, and
                   3976:         **   3) the database is file-backed, and
                   3977:         **   4) there is no open write-transaction, and
                   3978:         **   5) the database is not a WAL database,
                   3979:         **
                   3980:         ** then data can be read directly from the database file into the
                   3981:         ** output buffer, bypassing the page-cache altogether. This speeds
                   3982:         ** up loading large records that span many overflow pages.
                   3983:         */
                   3984:         if( eOp==0                                             /* (1) */
                   3985:          && offset==0                                          /* (2) */
                   3986:          && pBt->inTransaction==TRANS_READ                     /* (4) */
                   3987:          && (fd = sqlite3PagerFile(pBt->pPager))->pMethods     /* (3) */
                   3988:          && pBt->pPage1->aData[19]==0x01                       /* (5) */
                   3989:         ){
                   3990:           u8 aSave[4];
                   3991:           u8 *aWrite = &pBuf[-4];
                   3992:           memcpy(aSave, aWrite, 4);
                   3993:           rc = sqlite3OsRead(fd, aWrite, a+4, (i64)pBt->pageSize*(nextPage-1));
                   3994:           nextPage = get4byte(aWrite);
                   3995:           memcpy(aWrite, aSave, 4);
                   3996:         }else
                   3997: #endif
                   3998: 
                   3999:         {
                   4000:           DbPage *pDbPage;
                   4001:           rc = sqlite3PagerGet(pBt->pPager, nextPage, &pDbPage);
                   4002:           if( rc==SQLITE_OK ){
                   4003:             aPayload = sqlite3PagerGetData(pDbPage);
                   4004:             nextPage = get4byte(aPayload);
                   4005:             rc = copyPayload(&aPayload[offset+4], pBuf, a, eOp, pDbPage);
                   4006:             sqlite3PagerUnref(pDbPage);
                   4007:             offset = 0;
                   4008:           }
                   4009:         }
                   4010:         amt -= a;
                   4011:         pBuf += a;
                   4012:       }
                   4013:     }
                   4014:   }
                   4015: 
                   4016:   if( rc==SQLITE_OK && amt>0 ){
                   4017:     return SQLITE_CORRUPT_BKPT;
                   4018:   }
                   4019:   return rc;
                   4020: }
                   4021: 
                   4022: /*
                   4023: ** Read part of the key associated with cursor pCur.  Exactly
                   4024: ** "amt" bytes will be transfered into pBuf[].  The transfer
                   4025: ** begins at "offset".
                   4026: **
                   4027: ** The caller must ensure that pCur is pointing to a valid row
                   4028: ** in the table.
                   4029: **
                   4030: ** Return SQLITE_OK on success or an error code if anything goes
                   4031: ** wrong.  An error is returned if "offset+amt" is larger than
                   4032: ** the available payload.
                   4033: */
                   4034: int sqlite3BtreeKey(BtCursor *pCur, u32 offset, u32 amt, void *pBuf){
                   4035:   assert( cursorHoldsMutex(pCur) );
                   4036:   assert( pCur->eState==CURSOR_VALID );
                   4037:   assert( pCur->iPage>=0 && pCur->apPage[pCur->iPage] );
                   4038:   assert( pCur->aiIdx[pCur->iPage]<pCur->apPage[pCur->iPage]->nCell );
                   4039:   return accessPayload(pCur, offset, amt, (unsigned char*)pBuf, 0);
                   4040: }
                   4041: 
                   4042: /*
                   4043: ** Read part of the data associated with cursor pCur.  Exactly
                   4044: ** "amt" bytes will be transfered into pBuf[].  The transfer
                   4045: ** begins at "offset".
                   4046: **
                   4047: ** Return SQLITE_OK on success or an error code if anything goes
                   4048: ** wrong.  An error is returned if "offset+amt" is larger than
                   4049: ** the available payload.
                   4050: */
                   4051: int sqlite3BtreeData(BtCursor *pCur, u32 offset, u32 amt, void *pBuf){
                   4052:   int rc;
                   4053: 
                   4054: #ifndef SQLITE_OMIT_INCRBLOB
                   4055:   if ( pCur->eState==CURSOR_INVALID ){
                   4056:     return SQLITE_ABORT;
                   4057:   }
                   4058: #endif
                   4059: 
                   4060:   assert( cursorHoldsMutex(pCur) );
                   4061:   rc = restoreCursorPosition(pCur);
                   4062:   if( rc==SQLITE_OK ){
                   4063:     assert( pCur->eState==CURSOR_VALID );
                   4064:     assert( pCur->iPage>=0 && pCur->apPage[pCur->iPage] );
                   4065:     assert( pCur->aiIdx[pCur->iPage]<pCur->apPage[pCur->iPage]->nCell );
                   4066:     rc = accessPayload(pCur, offset, amt, pBuf, 0);
                   4067:   }
                   4068:   return rc;
                   4069: }
                   4070: 
                   4071: /*
                   4072: ** Return a pointer to payload information from the entry that the 
                   4073: ** pCur cursor is pointing to.  The pointer is to the beginning of
                   4074: ** the key if skipKey==0 and it points to the beginning of data if
                   4075: ** skipKey==1.  The number of bytes of available key/data is written
                   4076: ** into *pAmt.  If *pAmt==0, then the value returned will not be
                   4077: ** a valid pointer.
                   4078: **
                   4079: ** This routine is an optimization.  It is common for the entire key
                   4080: ** and data to fit on the local page and for there to be no overflow
                   4081: ** pages.  When that is so, this routine can be used to access the
                   4082: ** key and data without making a copy.  If the key and/or data spills
                   4083: ** onto overflow pages, then accessPayload() must be used to reassemble
                   4084: ** the key/data and copy it into a preallocated buffer.
                   4085: **
                   4086: ** The pointer returned by this routine looks directly into the cached
                   4087: ** page of the database.  The data might change or move the next time
                   4088: ** any btree routine is called.
                   4089: */
                   4090: static const unsigned char *fetchPayload(
                   4091:   BtCursor *pCur,      /* Cursor pointing to entry to read from */
                   4092:   int *pAmt,           /* Write the number of available bytes here */
                   4093:   int skipKey          /* read beginning at data if this is true */
                   4094: ){
                   4095:   unsigned char *aPayload;
                   4096:   MemPage *pPage;
                   4097:   u32 nKey;
                   4098:   u32 nLocal;
                   4099: 
                   4100:   assert( pCur!=0 && pCur->iPage>=0 && pCur->apPage[pCur->iPage]);
                   4101:   assert( pCur->eState==CURSOR_VALID );
                   4102:   assert( cursorHoldsMutex(pCur) );
                   4103:   pPage = pCur->apPage[pCur->iPage];
                   4104:   assert( pCur->aiIdx[pCur->iPage]<pPage->nCell );
                   4105:   if( NEVER(pCur->info.nSize==0) ){
                   4106:     btreeParseCell(pCur->apPage[pCur->iPage], pCur->aiIdx[pCur->iPage],
                   4107:                    &pCur->info);
                   4108:   }
                   4109:   aPayload = pCur->info.pCell;
                   4110:   aPayload += pCur->info.nHeader;
                   4111:   if( pPage->intKey ){
                   4112:     nKey = 0;
                   4113:   }else{
                   4114:     nKey = (int)pCur->info.nKey;
                   4115:   }
                   4116:   if( skipKey ){
                   4117:     aPayload += nKey;
                   4118:     nLocal = pCur->info.nLocal - nKey;
                   4119:   }else{
                   4120:     nLocal = pCur->info.nLocal;
                   4121:     assert( nLocal<=nKey );
                   4122:   }
                   4123:   *pAmt = nLocal;
                   4124:   return aPayload;
                   4125: }
                   4126: 
                   4127: 
                   4128: /*
                   4129: ** For the entry that cursor pCur is point to, return as
                   4130: ** many bytes of the key or data as are available on the local
                   4131: ** b-tree page.  Write the number of available bytes into *pAmt.
                   4132: **
                   4133: ** The pointer returned is ephemeral.  The key/data may move
                   4134: ** or be destroyed on the next call to any Btree routine,
                   4135: ** including calls from other threads against the same cache.
                   4136: ** Hence, a mutex on the BtShared should be held prior to calling
                   4137: ** this routine.
                   4138: **
                   4139: ** These routines is used to get quick access to key and data
                   4140: ** in the common case where no overflow pages are used.
                   4141: */
                   4142: const void *sqlite3BtreeKeyFetch(BtCursor *pCur, int *pAmt){
                   4143:   const void *p = 0;
                   4144:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
                   4145:   assert( cursorHoldsMutex(pCur) );
                   4146:   if( ALWAYS(pCur->eState==CURSOR_VALID) ){
                   4147:     p = (const void*)fetchPayload(pCur, pAmt, 0);
                   4148:   }
                   4149:   return p;
                   4150: }
                   4151: const void *sqlite3BtreeDataFetch(BtCursor *pCur, int *pAmt){
                   4152:   const void *p = 0;
                   4153:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
                   4154:   assert( cursorHoldsMutex(pCur) );
                   4155:   if( ALWAYS(pCur->eState==CURSOR_VALID) ){
                   4156:     p = (const void*)fetchPayload(pCur, pAmt, 1);
                   4157:   }
                   4158:   return p;
                   4159: }
                   4160: 
                   4161: 
                   4162: /*
                   4163: ** Move the cursor down to a new child page.  The newPgno argument is the
                   4164: ** page number of the child page to move to.
                   4165: **
                   4166: ** This function returns SQLITE_CORRUPT if the page-header flags field of
                   4167: ** the new child page does not match the flags field of the parent (i.e.
                   4168: ** if an intkey page appears to be the parent of a non-intkey page, or
                   4169: ** vice-versa).
                   4170: */
                   4171: static int moveToChild(BtCursor *pCur, u32 newPgno){
                   4172:   int rc;
                   4173:   int i = pCur->iPage;
                   4174:   MemPage *pNewPage;
                   4175:   BtShared *pBt = pCur->pBt;
                   4176: 
                   4177:   assert( cursorHoldsMutex(pCur) );
                   4178:   assert( pCur->eState==CURSOR_VALID );
                   4179:   assert( pCur->iPage<BTCURSOR_MAX_DEPTH );
                   4180:   if( pCur->iPage>=(BTCURSOR_MAX_DEPTH-1) ){
                   4181:     return SQLITE_CORRUPT_BKPT;
                   4182:   }
                   4183:   rc = getAndInitPage(pBt, newPgno, &pNewPage);
                   4184:   if( rc ) return rc;
                   4185:   pCur->apPage[i+1] = pNewPage;
                   4186:   pCur->aiIdx[i+1] = 0;
                   4187:   pCur->iPage++;
                   4188: 
                   4189:   pCur->info.nSize = 0;
                   4190:   pCur->validNKey = 0;
                   4191:   if( pNewPage->nCell<1 || pNewPage->intKey!=pCur->apPage[i]->intKey ){
                   4192:     return SQLITE_CORRUPT_BKPT;
                   4193:   }
                   4194:   return SQLITE_OK;
                   4195: }
                   4196: 
                   4197: #if 0
                   4198: /*
                   4199: ** Page pParent is an internal (non-leaf) tree page. This function 
                   4200: ** asserts that page number iChild is the left-child if the iIdx'th
                   4201: ** cell in page pParent. Or, if iIdx is equal to the total number of
                   4202: ** cells in pParent, that page number iChild is the right-child of
                   4203: ** the page.
                   4204: */
                   4205: static void assertParentIndex(MemPage *pParent, int iIdx, Pgno iChild){
                   4206:   assert( iIdx<=pParent->nCell );
                   4207:   if( iIdx==pParent->nCell ){
                   4208:     assert( get4byte(&pParent->aData[pParent->hdrOffset+8])==iChild );
                   4209:   }else{
                   4210:     assert( get4byte(findCell(pParent, iIdx))==iChild );
                   4211:   }
                   4212: }
                   4213: #else
                   4214: #  define assertParentIndex(x,y,z) 
                   4215: #endif
                   4216: 
                   4217: /*
                   4218: ** Move the cursor up to the parent page.
                   4219: **
                   4220: ** pCur->idx is set to the cell index that contains the pointer
                   4221: ** to the page we are coming from.  If we are coming from the
                   4222: ** right-most child page then pCur->idx is set to one more than
                   4223: ** the largest cell index.
                   4224: */
                   4225: static void moveToParent(BtCursor *pCur){
                   4226:   assert( cursorHoldsMutex(pCur) );
                   4227:   assert( pCur->eState==CURSOR_VALID );
                   4228:   assert( pCur->iPage>0 );
                   4229:   assert( pCur->apPage[pCur->iPage] );
                   4230: 
                   4231:   /* UPDATE: It is actually possible for the condition tested by the assert
                   4232:   ** below to be untrue if the database file is corrupt. This can occur if
                   4233:   ** one cursor has modified page pParent while a reference to it is held 
                   4234:   ** by a second cursor. Which can only happen if a single page is linked
                   4235:   ** into more than one b-tree structure in a corrupt database.  */
                   4236: #if 0
                   4237:   assertParentIndex(
                   4238:     pCur->apPage[pCur->iPage-1], 
                   4239:     pCur->aiIdx[pCur->iPage-1], 
                   4240:     pCur->apPage[pCur->iPage]->pgno
                   4241:   );
                   4242: #endif
                   4243:   testcase( pCur->aiIdx[pCur->iPage-1] > pCur->apPage[pCur->iPage-1]->nCell );
                   4244: 
                   4245:   releasePage(pCur->apPage[pCur->iPage]);
                   4246:   pCur->iPage--;
                   4247:   pCur->info.nSize = 0;
                   4248:   pCur->validNKey = 0;
                   4249: }
                   4250: 
                   4251: /*
                   4252: ** Move the cursor to point to the root page of its b-tree structure.
                   4253: **
                   4254: ** If the table has a virtual root page, then the cursor is moved to point
                   4255: ** to the virtual root page instead of the actual root page. A table has a
                   4256: ** virtual root page when the actual root page contains no cells and a 
                   4257: ** single child page. This can only happen with the table rooted at page 1.
                   4258: **
                   4259: ** If the b-tree structure is empty, the cursor state is set to 
                   4260: ** CURSOR_INVALID. Otherwise, the cursor is set to point to the first
                   4261: ** cell located on the root (or virtual root) page and the cursor state
                   4262: ** is set to CURSOR_VALID.
                   4263: **
                   4264: ** If this function returns successfully, it may be assumed that the
                   4265: ** page-header flags indicate that the [virtual] root-page is the expected 
                   4266: ** kind of b-tree page (i.e. if when opening the cursor the caller did not
                   4267: ** specify a KeyInfo structure the flags byte is set to 0x05 or 0x0D,
                   4268: ** indicating a table b-tree, or if the caller did specify a KeyInfo 
                   4269: ** structure the flags byte is set to 0x02 or 0x0A, indicating an index
                   4270: ** b-tree).
                   4271: */
                   4272: static int moveToRoot(BtCursor *pCur){
                   4273:   MemPage *pRoot;
                   4274:   int rc = SQLITE_OK;
                   4275:   Btree *p = pCur->pBtree;
                   4276:   BtShared *pBt = p->pBt;
                   4277: 
                   4278:   assert( cursorHoldsMutex(pCur) );
                   4279:   assert( CURSOR_INVALID < CURSOR_REQUIRESEEK );
                   4280:   assert( CURSOR_VALID   < CURSOR_REQUIRESEEK );
                   4281:   assert( CURSOR_FAULT   > CURSOR_REQUIRESEEK );
                   4282:   if( pCur->eState>=CURSOR_REQUIRESEEK ){
                   4283:     if( pCur->eState==CURSOR_FAULT ){
                   4284:       assert( pCur->skipNext!=SQLITE_OK );
                   4285:       return pCur->skipNext;
                   4286:     }
                   4287:     sqlite3BtreeClearCursor(pCur);
                   4288:   }
                   4289: 
                   4290:   if( pCur->iPage>=0 ){
                   4291:     int i;
                   4292:     for(i=1; i<=pCur->iPage; i++){
                   4293:       releasePage(pCur->apPage[i]);
                   4294:     }
                   4295:     pCur->iPage = 0;
                   4296:   }else if( pCur->pgnoRoot==0 ){
                   4297:     pCur->eState = CURSOR_INVALID;
                   4298:     return SQLITE_OK;
                   4299:   }else{
                   4300:     rc = getAndInitPage(pBt, pCur->pgnoRoot, &pCur->apPage[0]);
                   4301:     if( rc!=SQLITE_OK ){
                   4302:       pCur->eState = CURSOR_INVALID;
                   4303:       return rc;
                   4304:     }
                   4305:     pCur->iPage = 0;
                   4306: 
                   4307:     /* If pCur->pKeyInfo is not NULL, then the caller that opened this cursor
                   4308:     ** expected to open it on an index b-tree. Otherwise, if pKeyInfo is
                   4309:     ** NULL, the caller expects a table b-tree. If this is not the case,
                   4310:     ** return an SQLITE_CORRUPT error.  */
                   4311:     assert( pCur->apPage[0]->intKey==1 || pCur->apPage[0]->intKey==0 );
                   4312:     if( (pCur->pKeyInfo==0)!=pCur->apPage[0]->intKey ){
                   4313:       return SQLITE_CORRUPT_BKPT;
                   4314:     }
                   4315:   }
                   4316: 
                   4317:   /* Assert that the root page is of the correct type. This must be the
                   4318:   ** case as the call to this function that loaded the root-page (either
                   4319:   ** this call or a previous invocation) would have detected corruption 
                   4320:   ** if the assumption were not true, and it is not possible for the flags 
                   4321:   ** byte to have been modified while this cursor is holding a reference
                   4322:   ** to the page.  */
                   4323:   pRoot = pCur->apPage[0];
                   4324:   assert( pRoot->pgno==pCur->pgnoRoot );
                   4325:   assert( pRoot->isInit && (pCur->pKeyInfo==0)==pRoot->intKey );
                   4326: 
                   4327:   pCur->aiIdx[0] = 0;
                   4328:   pCur->info.nSize = 0;
                   4329:   pCur->atLast = 0;
                   4330:   pCur->validNKey = 0;
                   4331: 
                   4332:   if( pRoot->nCell==0 && !pRoot->leaf ){
                   4333:     Pgno subpage;
                   4334:     if( pRoot->pgno!=1 ) return SQLITE_CORRUPT_BKPT;
                   4335:     subpage = get4byte(&pRoot->aData[pRoot->hdrOffset+8]);
                   4336:     pCur->eState = CURSOR_VALID;
                   4337:     rc = moveToChild(pCur, subpage);
                   4338:   }else{
                   4339:     pCur->eState = ((pRoot->nCell>0)?CURSOR_VALID:CURSOR_INVALID);
                   4340:   }
                   4341:   return rc;
                   4342: }
                   4343: 
                   4344: /*
                   4345: ** Move the cursor down to the left-most leaf entry beneath the
                   4346: ** entry to which it is currently pointing.
                   4347: **
                   4348: ** The left-most leaf is the one with the smallest key - the first
                   4349: ** in ascending order.
                   4350: */
                   4351: static int moveToLeftmost(BtCursor *pCur){
                   4352:   Pgno pgno;
                   4353:   int rc = SQLITE_OK;
                   4354:   MemPage *pPage;
                   4355: 
                   4356:   assert( cursorHoldsMutex(pCur) );
                   4357:   assert( pCur->eState==CURSOR_VALID );
                   4358:   while( rc==SQLITE_OK && !(pPage = pCur->apPage[pCur->iPage])->leaf ){
                   4359:     assert( pCur->aiIdx[pCur->iPage]<pPage->nCell );
                   4360:     pgno = get4byte(findCell(pPage, pCur->aiIdx[pCur->iPage]));
                   4361:     rc = moveToChild(pCur, pgno);
                   4362:   }
                   4363:   return rc;
                   4364: }
                   4365: 
                   4366: /*
                   4367: ** Move the cursor down to the right-most leaf entry beneath the
                   4368: ** page to which it is currently pointing.  Notice the difference
                   4369: ** between moveToLeftmost() and moveToRightmost().  moveToLeftmost()
                   4370: ** finds the left-most entry beneath the *entry* whereas moveToRightmost()
                   4371: ** finds the right-most entry beneath the *page*.
                   4372: **
                   4373: ** The right-most entry is the one with the largest key - the last
                   4374: ** key in ascending order.
                   4375: */
                   4376: static int moveToRightmost(BtCursor *pCur){
                   4377:   Pgno pgno;
                   4378:   int rc = SQLITE_OK;
                   4379:   MemPage *pPage = 0;
                   4380: 
                   4381:   assert( cursorHoldsMutex(pCur) );
                   4382:   assert( pCur->eState==CURSOR_VALID );
                   4383:   while( rc==SQLITE_OK && !(pPage = pCur->apPage[pCur->iPage])->leaf ){
                   4384:     pgno = get4byte(&pPage->aData[pPage->hdrOffset+8]);
                   4385:     pCur->aiIdx[pCur->iPage] = pPage->nCell;
                   4386:     rc = moveToChild(pCur, pgno);
                   4387:   }
                   4388:   if( rc==SQLITE_OK ){
                   4389:     pCur->aiIdx[pCur->iPage] = pPage->nCell-1;
                   4390:     pCur->info.nSize = 0;
                   4391:     pCur->validNKey = 0;
                   4392:   }
                   4393:   return rc;
                   4394: }
                   4395: 
                   4396: /* Move the cursor to the first entry in the table.  Return SQLITE_OK
                   4397: ** on success.  Set *pRes to 0 if the cursor actually points to something
                   4398: ** or set *pRes to 1 if the table is empty.
                   4399: */
                   4400: int sqlite3BtreeFirst(BtCursor *pCur, int *pRes){
                   4401:   int rc;
                   4402: 
                   4403:   assert( cursorHoldsMutex(pCur) );
                   4404:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
                   4405:   rc = moveToRoot(pCur);
                   4406:   if( rc==SQLITE_OK ){
                   4407:     if( pCur->eState==CURSOR_INVALID ){
                   4408:       assert( pCur->pgnoRoot==0 || pCur->apPage[pCur->iPage]->nCell==0 );
                   4409:       *pRes = 1;
                   4410:     }else{
                   4411:       assert( pCur->apPage[pCur->iPage]->nCell>0 );
                   4412:       *pRes = 0;
                   4413:       rc = moveToLeftmost(pCur);
                   4414:     }
                   4415:   }
                   4416:   return rc;
                   4417: }
                   4418: 
                   4419: /* Move the cursor to the last entry in the table.  Return SQLITE_OK
                   4420: ** on success.  Set *pRes to 0 if the cursor actually points to something
                   4421: ** or set *pRes to 1 if the table is empty.
                   4422: */
                   4423: int sqlite3BtreeLast(BtCursor *pCur, int *pRes){
                   4424:   int rc;
                   4425:  
                   4426:   assert( cursorHoldsMutex(pCur) );
                   4427:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
                   4428: 
                   4429:   /* If the cursor already points to the last entry, this is a no-op. */
                   4430:   if( CURSOR_VALID==pCur->eState && pCur->atLast ){
                   4431: #ifdef SQLITE_DEBUG
                   4432:     /* This block serves to assert() that the cursor really does point 
                   4433:     ** to the last entry in the b-tree. */
                   4434:     int ii;
                   4435:     for(ii=0; ii<pCur->iPage; ii++){
                   4436:       assert( pCur->aiIdx[ii]==pCur->apPage[ii]->nCell );
                   4437:     }
                   4438:     assert( pCur->aiIdx[pCur->iPage]==pCur->apPage[pCur->iPage]->nCell-1 );
                   4439:     assert( pCur->apPage[pCur->iPage]->leaf );
                   4440: #endif
                   4441:     return SQLITE_OK;
                   4442:   }
                   4443: 
                   4444:   rc = moveToRoot(pCur);
                   4445:   if( rc==SQLITE_OK ){
                   4446:     if( CURSOR_INVALID==pCur->eState ){
                   4447:       assert( pCur->pgnoRoot==0 || pCur->apPage[pCur->iPage]->nCell==0 );
                   4448:       *pRes = 1;
                   4449:     }else{
                   4450:       assert( pCur->eState==CURSOR_VALID );
                   4451:       *pRes = 0;
                   4452:       rc = moveToRightmost(pCur);
                   4453:       pCur->atLast = rc==SQLITE_OK ?1:0;
                   4454:     }
                   4455:   }
                   4456:   return rc;
                   4457: }
                   4458: 
                   4459: /* Move the cursor so that it points to an entry near the key 
                   4460: ** specified by pIdxKey or intKey.   Return a success code.
                   4461: **
                   4462: ** For INTKEY tables, the intKey parameter is used.  pIdxKey 
                   4463: ** must be NULL.  For index tables, pIdxKey is used and intKey
                   4464: ** is ignored.
                   4465: **
                   4466: ** If an exact match is not found, then the cursor is always
                   4467: ** left pointing at a leaf page which would hold the entry if it
                   4468: ** were present.  The cursor might point to an entry that comes
                   4469: ** before or after the key.
                   4470: **
                   4471: ** An integer is written into *pRes which is the result of
                   4472: ** comparing the key with the entry to which the cursor is 
                   4473: ** pointing.  The meaning of the integer written into
                   4474: ** *pRes is as follows:
                   4475: **
                   4476: **     *pRes<0      The cursor is left pointing at an entry that
                   4477: **                  is smaller than intKey/pIdxKey or if the table is empty
                   4478: **                  and the cursor is therefore left point to nothing.
                   4479: **
                   4480: **     *pRes==0     The cursor is left pointing at an entry that
                   4481: **                  exactly matches intKey/pIdxKey.
                   4482: **
                   4483: **     *pRes>0      The cursor is left pointing at an entry that
                   4484: **                  is larger than intKey/pIdxKey.
                   4485: **
                   4486: */
                   4487: int sqlite3BtreeMovetoUnpacked(
                   4488:   BtCursor *pCur,          /* The cursor to be moved */
                   4489:   UnpackedRecord *pIdxKey, /* Unpacked index key */
                   4490:   i64 intKey,              /* The table key */
                   4491:   int biasRight,           /* If true, bias the search to the high end */
                   4492:   int *pRes                /* Write search results here */
                   4493: ){
                   4494:   int rc;
                   4495: 
                   4496:   assert( cursorHoldsMutex(pCur) );
                   4497:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
                   4498:   assert( pRes );
                   4499:   assert( (pIdxKey==0)==(pCur->pKeyInfo==0) );
                   4500: 
                   4501:   /* If the cursor is already positioned at the point we are trying
                   4502:   ** to move to, then just return without doing any work */
                   4503:   if( pCur->eState==CURSOR_VALID && pCur->validNKey 
                   4504:    && pCur->apPage[0]->intKey 
                   4505:   ){
                   4506:     if( pCur->info.nKey==intKey ){
                   4507:       *pRes = 0;
                   4508:       return SQLITE_OK;
                   4509:     }
                   4510:     if( pCur->atLast && pCur->info.nKey<intKey ){
                   4511:       *pRes = -1;
                   4512:       return SQLITE_OK;
                   4513:     }
                   4514:   }
                   4515: 
                   4516:   rc = moveToRoot(pCur);
                   4517:   if( rc ){
                   4518:     return rc;
                   4519:   }
                   4520:   assert( pCur->pgnoRoot==0 || pCur->apPage[pCur->iPage] );
                   4521:   assert( pCur->pgnoRoot==0 || pCur->apPage[pCur->iPage]->isInit );
                   4522:   assert( pCur->eState==CURSOR_INVALID || pCur->apPage[pCur->iPage]->nCell>0 );
                   4523:   if( pCur->eState==CURSOR_INVALID ){
                   4524:     *pRes = -1;
                   4525:     assert( pCur->pgnoRoot==0 || pCur->apPage[pCur->iPage]->nCell==0 );
                   4526:     return SQLITE_OK;
                   4527:   }
                   4528:   assert( pCur->apPage[0]->intKey || pIdxKey );
                   4529:   for(;;){
                   4530:     int lwr, upr, idx;
                   4531:     Pgno chldPg;
                   4532:     MemPage *pPage = pCur->apPage[pCur->iPage];
                   4533:     int c;
                   4534: 
                   4535:     /* pPage->nCell must be greater than zero. If this is the root-page
                   4536:     ** the cursor would have been INVALID above and this for(;;) loop
                   4537:     ** not run. If this is not the root-page, then the moveToChild() routine
                   4538:     ** would have already detected db corruption. Similarly, pPage must
                   4539:     ** be the right kind (index or table) of b-tree page. Otherwise
                   4540:     ** a moveToChild() or moveToRoot() call would have detected corruption.  */
                   4541:     assert( pPage->nCell>0 );
                   4542:     assert( pPage->intKey==(pIdxKey==0) );
                   4543:     lwr = 0;
                   4544:     upr = pPage->nCell-1;
                   4545:     if( biasRight ){
                   4546:       pCur->aiIdx[pCur->iPage] = (u16)(idx = upr);
                   4547:     }else{
                   4548:       pCur->aiIdx[pCur->iPage] = (u16)(idx = (upr+lwr)/2);
                   4549:     }
                   4550:     for(;;){
                   4551:       u8 *pCell;                          /* Pointer to current cell in pPage */
                   4552: 
                   4553:       assert( idx==pCur->aiIdx[pCur->iPage] );
                   4554:       pCur->info.nSize = 0;
                   4555:       pCell = findCell(pPage, idx) + pPage->childPtrSize;
                   4556:       if( pPage->intKey ){
                   4557:         i64 nCellKey;
                   4558:         if( pPage->hasData ){
                   4559:           u32 dummy;
                   4560:           pCell += getVarint32(pCell, dummy);
                   4561:         }
                   4562:         getVarint(pCell, (u64*)&nCellKey);
                   4563:         if( nCellKey==intKey ){
                   4564:           c = 0;
                   4565:         }else if( nCellKey<intKey ){
                   4566:           c = -1;
                   4567:         }else{
                   4568:           assert( nCellKey>intKey );
                   4569:           c = +1;
                   4570:         }
                   4571:         pCur->validNKey = 1;
                   4572:         pCur->info.nKey = nCellKey;
                   4573:       }else{
                   4574:         /* The maximum supported page-size is 65536 bytes. This means that
                   4575:         ** the maximum number of record bytes stored on an index B-Tree
                   4576:         ** page is less than 16384 bytes and may be stored as a 2-byte
                   4577:         ** varint. This information is used to attempt to avoid parsing 
                   4578:         ** the entire cell by checking for the cases where the record is 
                   4579:         ** stored entirely within the b-tree page by inspecting the first 
                   4580:         ** 2 bytes of the cell.
                   4581:         */
                   4582:         int nCell = pCell[0];
                   4583:         if( nCell<=pPage->max1bytePayload
                   4584:          /* && (pCell+nCell)<pPage->aDataEnd */
                   4585:         ){
                   4586:           /* This branch runs if the record-size field of the cell is a
                   4587:           ** single byte varint and the record fits entirely on the main
                   4588:           ** b-tree page.  */
                   4589:           testcase( pCell+nCell+1==pPage->aDataEnd );
                   4590:           c = sqlite3VdbeRecordCompare(nCell, (void*)&pCell[1], pIdxKey);
                   4591:         }else if( !(pCell[1] & 0x80) 
                   4592:           && (nCell = ((nCell&0x7f)<<7) + pCell[1])<=pPage->maxLocal
                   4593:           /* && (pCell+nCell+2)<=pPage->aDataEnd */
                   4594:         ){
                   4595:           /* The record-size field is a 2 byte varint and the record 
                   4596:           ** fits entirely on the main b-tree page.  */
                   4597:           testcase( pCell+nCell+2==pPage->aDataEnd );
                   4598:           c = sqlite3VdbeRecordCompare(nCell, (void*)&pCell[2], pIdxKey);
                   4599:         }else{
                   4600:           /* The record flows over onto one or more overflow pages. In
                   4601:           ** this case the whole cell needs to be parsed, a buffer allocated
                   4602:           ** and accessPayload() used to retrieve the record into the
                   4603:           ** buffer before VdbeRecordCompare() can be called. */
                   4604:           void *pCellKey;
                   4605:           u8 * const pCellBody = pCell - pPage->childPtrSize;
                   4606:           btreeParseCellPtr(pPage, pCellBody, &pCur->info);
                   4607:           nCell = (int)pCur->info.nKey;
                   4608:           pCellKey = sqlite3Malloc( nCell );
                   4609:           if( pCellKey==0 ){
                   4610:             rc = SQLITE_NOMEM;
                   4611:             goto moveto_finish;
                   4612:           }
                   4613:           rc = accessPayload(pCur, 0, nCell, (unsigned char*)pCellKey, 0);
                   4614:           if( rc ){
                   4615:             sqlite3_free(pCellKey);
                   4616:             goto moveto_finish;
                   4617:           }
                   4618:           c = sqlite3VdbeRecordCompare(nCell, pCellKey, pIdxKey);
                   4619:           sqlite3_free(pCellKey);
                   4620:         }
                   4621:       }
                   4622:       if( c==0 ){
                   4623:         if( pPage->intKey && !pPage->leaf ){
                   4624:           lwr = idx;
                   4625:           break;
                   4626:         }else{
                   4627:           *pRes = 0;
                   4628:           rc = SQLITE_OK;
                   4629:           goto moveto_finish;
                   4630:         }
                   4631:       }
                   4632:       if( c<0 ){
                   4633:         lwr = idx+1;
                   4634:       }else{
                   4635:         upr = idx-1;
                   4636:       }
                   4637:       if( lwr>upr ){
                   4638:         break;
                   4639:       }
                   4640:       pCur->aiIdx[pCur->iPage] = (u16)(idx = (lwr+upr)/2);
                   4641:     }
                   4642:     assert( lwr==upr+1 || (pPage->intKey && !pPage->leaf) );
                   4643:     assert( pPage->isInit );
                   4644:     if( pPage->leaf ){
                   4645:       chldPg = 0;
                   4646:     }else if( lwr>=pPage->nCell ){
                   4647:       chldPg = get4byte(&pPage->aData[pPage->hdrOffset+8]);
                   4648:     }else{
                   4649:       chldPg = get4byte(findCell(pPage, lwr));
                   4650:     }
                   4651:     if( chldPg==0 ){
                   4652:       assert( pCur->aiIdx[pCur->iPage]<pCur->apPage[pCur->iPage]->nCell );
                   4653:       *pRes = c;
                   4654:       rc = SQLITE_OK;
                   4655:       goto moveto_finish;
                   4656:     }
                   4657:     pCur->aiIdx[pCur->iPage] = (u16)lwr;
                   4658:     pCur->info.nSize = 0;
                   4659:     pCur->validNKey = 0;
                   4660:     rc = moveToChild(pCur, chldPg);
                   4661:     if( rc ) goto moveto_finish;
                   4662:   }
                   4663: moveto_finish:
                   4664:   return rc;
                   4665: }
                   4666: 
                   4667: 
                   4668: /*
                   4669: ** Return TRUE if the cursor is not pointing at an entry of the table.
                   4670: **
                   4671: ** TRUE will be returned after a call to sqlite3BtreeNext() moves
                   4672: ** past the last entry in the table or sqlite3BtreePrev() moves past
                   4673: ** the first entry.  TRUE is also returned if the table is empty.
                   4674: */
                   4675: int sqlite3BtreeEof(BtCursor *pCur){
                   4676:   /* TODO: What if the cursor is in CURSOR_REQUIRESEEK but all table entries
                   4677:   ** have been deleted? This API will need to change to return an error code
                   4678:   ** as well as the boolean result value.
                   4679:   */
                   4680:   return (CURSOR_VALID!=pCur->eState);
                   4681: }
                   4682: 
                   4683: /*
                   4684: ** Advance the cursor to the next entry in the database.  If
                   4685: ** successful then set *pRes=0.  If the cursor
                   4686: ** was already pointing to the last entry in the database before
                   4687: ** this routine was called, then set *pRes=1.
                   4688: */
                   4689: int sqlite3BtreeNext(BtCursor *pCur, int *pRes){
                   4690:   int rc;
                   4691:   int idx;
                   4692:   MemPage *pPage;
                   4693: 
                   4694:   assert( cursorHoldsMutex(pCur) );
                   4695:   rc = restoreCursorPosition(pCur);
                   4696:   if( rc!=SQLITE_OK ){
                   4697:     return rc;
                   4698:   }
                   4699:   assert( pRes!=0 );
                   4700:   if( CURSOR_INVALID==pCur->eState ){
                   4701:     *pRes = 1;
                   4702:     return SQLITE_OK;
                   4703:   }
                   4704:   if( pCur->skipNext>0 ){
                   4705:     pCur->skipNext = 0;
                   4706:     *pRes = 0;
                   4707:     return SQLITE_OK;
                   4708:   }
                   4709:   pCur->skipNext = 0;
                   4710: 
                   4711:   pPage = pCur->apPage[pCur->iPage];
                   4712:   idx = ++pCur->aiIdx[pCur->iPage];
                   4713:   assert( pPage->isInit );
                   4714: 
                   4715:   /* If the database file is corrupt, it is possible for the value of idx 
                   4716:   ** to be invalid here. This can only occur if a second cursor modifies
                   4717:   ** the page while cursor pCur is holding a reference to it. Which can
                   4718:   ** only happen if the database is corrupt in such a way as to link the
                   4719:   ** page into more than one b-tree structure. */
                   4720:   testcase( idx>pPage->nCell );
                   4721: 
                   4722:   pCur->info.nSize = 0;
                   4723:   pCur->validNKey = 0;
                   4724:   if( idx>=pPage->nCell ){
                   4725:     if( !pPage->leaf ){
                   4726:       rc = moveToChild(pCur, get4byte(&pPage->aData[pPage->hdrOffset+8]));
                   4727:       if( rc ) return rc;
                   4728:       rc = moveToLeftmost(pCur);
                   4729:       *pRes = 0;
                   4730:       return rc;
                   4731:     }
                   4732:     do{
                   4733:       if( pCur->iPage==0 ){
                   4734:         *pRes = 1;
                   4735:         pCur->eState = CURSOR_INVALID;
                   4736:         return SQLITE_OK;
                   4737:       }
                   4738:       moveToParent(pCur);
                   4739:       pPage = pCur->apPage[pCur->iPage];
                   4740:     }while( pCur->aiIdx[pCur->iPage]>=pPage->nCell );
                   4741:     *pRes = 0;
                   4742:     if( pPage->intKey ){
                   4743:       rc = sqlite3BtreeNext(pCur, pRes);
                   4744:     }else{
                   4745:       rc = SQLITE_OK;
                   4746:     }
                   4747:     return rc;
                   4748:   }
                   4749:   *pRes = 0;
                   4750:   if( pPage->leaf ){
                   4751:     return SQLITE_OK;
                   4752:   }
                   4753:   rc = moveToLeftmost(pCur);
                   4754:   return rc;
                   4755: }
                   4756: 
                   4757: 
                   4758: /*
                   4759: ** Step the cursor to the back to the previous entry in the database.  If
                   4760: ** successful then set *pRes=0.  If the cursor
                   4761: ** was already pointing to the first entry in the database before
                   4762: ** this routine was called, then set *pRes=1.
                   4763: */
                   4764: int sqlite3BtreePrevious(BtCursor *pCur, int *pRes){
                   4765:   int rc;
                   4766:   MemPage *pPage;
                   4767: 
                   4768:   assert( cursorHoldsMutex(pCur) );
                   4769:   rc = restoreCursorPosition(pCur);
                   4770:   if( rc!=SQLITE_OK ){
                   4771:     return rc;
                   4772:   }
                   4773:   pCur->atLast = 0;
                   4774:   if( CURSOR_INVALID==pCur->eState ){
                   4775:     *pRes = 1;
                   4776:     return SQLITE_OK;
                   4777:   }
                   4778:   if( pCur->skipNext<0 ){
                   4779:     pCur->skipNext = 0;
                   4780:     *pRes = 0;
                   4781:     return SQLITE_OK;
                   4782:   }
                   4783:   pCur->skipNext = 0;
                   4784: 
                   4785:   pPage = pCur->apPage[pCur->iPage];
                   4786:   assert( pPage->isInit );
                   4787:   if( !pPage->leaf ){
                   4788:     int idx = pCur->aiIdx[pCur->iPage];
                   4789:     rc = moveToChild(pCur, get4byte(findCell(pPage, idx)));
                   4790:     if( rc ){
                   4791:       return rc;
                   4792:     }
                   4793:     rc = moveToRightmost(pCur);
                   4794:   }else{
                   4795:     while( pCur->aiIdx[pCur->iPage]==0 ){
                   4796:       if( pCur->iPage==0 ){
                   4797:         pCur->eState = CURSOR_INVALID;
                   4798:         *pRes = 1;
                   4799:         return SQLITE_OK;
                   4800:       }
                   4801:       moveToParent(pCur);
                   4802:     }
                   4803:     pCur->info.nSize = 0;
                   4804:     pCur->validNKey = 0;
                   4805: 
                   4806:     pCur->aiIdx[pCur->iPage]--;
                   4807:     pPage = pCur->apPage[pCur->iPage];
                   4808:     if( pPage->intKey && !pPage->leaf ){
                   4809:       rc = sqlite3BtreePrevious(pCur, pRes);
                   4810:     }else{
                   4811:       rc = SQLITE_OK;
                   4812:     }
                   4813:   }
                   4814:   *pRes = 0;
                   4815:   return rc;
                   4816: }
                   4817: 
                   4818: /*
                   4819: ** Allocate a new page from the database file.
                   4820: **
                   4821: ** The new page is marked as dirty.  (In other words, sqlite3PagerWrite()
                   4822: ** has already been called on the new page.)  The new page has also
                   4823: ** been referenced and the calling routine is responsible for calling
                   4824: ** sqlite3PagerUnref() on the new page when it is done.
                   4825: **
                   4826: ** SQLITE_OK is returned on success.  Any other return value indicates
                   4827: ** an error.  *ppPage and *pPgno are undefined in the event of an error.
                   4828: ** Do not invoke sqlite3PagerUnref() on *ppPage if an error is returned.
                   4829: **
                   4830: ** If the "nearby" parameter is not 0, then a (feeble) effort is made to 
                   4831: ** locate a page close to the page number "nearby".  This can be used in an
                   4832: ** attempt to keep related pages close to each other in the database file,
                   4833: ** which in turn can make database access faster.
                   4834: **
                   4835: ** If the "exact" parameter is not 0, and the page-number nearby exists 
                   4836: ** anywhere on the free-list, then it is guarenteed to be returned. This
                   4837: ** is only used by auto-vacuum databases when allocating a new table.
                   4838: */
                   4839: static int allocateBtreePage(
                   4840:   BtShared *pBt, 
                   4841:   MemPage **ppPage, 
                   4842:   Pgno *pPgno, 
                   4843:   Pgno nearby,
                   4844:   u8 exact
                   4845: ){
                   4846:   MemPage *pPage1;
                   4847:   int rc;
                   4848:   u32 n;     /* Number of pages on the freelist */
                   4849:   u32 k;     /* Number of leaves on the trunk of the freelist */
                   4850:   MemPage *pTrunk = 0;
                   4851:   MemPage *pPrevTrunk = 0;
                   4852:   Pgno mxPage;     /* Total size of the database file */
                   4853: 
                   4854:   assert( sqlite3_mutex_held(pBt->mutex) );
                   4855:   pPage1 = pBt->pPage1;
                   4856:   mxPage = btreePagecount(pBt);
                   4857:   n = get4byte(&pPage1->aData[36]);
                   4858:   testcase( n==mxPage-1 );
                   4859:   if( n>=mxPage ){
                   4860:     return SQLITE_CORRUPT_BKPT;
                   4861:   }
                   4862:   if( n>0 ){
                   4863:     /* There are pages on the freelist.  Reuse one of those pages. */
                   4864:     Pgno iTrunk;
                   4865:     u8 searchList = 0; /* If the free-list must be searched for 'nearby' */
                   4866:     
                   4867:     /* If the 'exact' parameter was true and a query of the pointer-map
                   4868:     ** shows that the page 'nearby' is somewhere on the free-list, then
                   4869:     ** the entire-list will be searched for that page.
                   4870:     */
                   4871: #ifndef SQLITE_OMIT_AUTOVACUUM
                   4872:     if( exact && nearby<=mxPage ){
                   4873:       u8 eType;
                   4874:       assert( nearby>0 );
                   4875:       assert( pBt->autoVacuum );
                   4876:       rc = ptrmapGet(pBt, nearby, &eType, 0);
                   4877:       if( rc ) return rc;
                   4878:       if( eType==PTRMAP_FREEPAGE ){
                   4879:         searchList = 1;
                   4880:       }
                   4881:       *pPgno = nearby;
                   4882:     }
                   4883: #endif
                   4884: 
                   4885:     /* Decrement the free-list count by 1. Set iTrunk to the index of the
                   4886:     ** first free-list trunk page. iPrevTrunk is initially 1.
                   4887:     */
                   4888:     rc = sqlite3PagerWrite(pPage1->pDbPage);
                   4889:     if( rc ) return rc;
                   4890:     put4byte(&pPage1->aData[36], n-1);
                   4891: 
                   4892:     /* The code within this loop is run only once if the 'searchList' variable
                   4893:     ** is not true. Otherwise, it runs once for each trunk-page on the
                   4894:     ** free-list until the page 'nearby' is located.
                   4895:     */
                   4896:     do {
                   4897:       pPrevTrunk = pTrunk;
                   4898:       if( pPrevTrunk ){
                   4899:         iTrunk = get4byte(&pPrevTrunk->aData[0]);
                   4900:       }else{
                   4901:         iTrunk = get4byte(&pPage1->aData[32]);
                   4902:       }
                   4903:       testcase( iTrunk==mxPage );
                   4904:       if( iTrunk>mxPage ){
                   4905:         rc = SQLITE_CORRUPT_BKPT;
                   4906:       }else{
                   4907:         rc = btreeGetPage(pBt, iTrunk, &pTrunk, 0);
                   4908:       }
                   4909:       if( rc ){
                   4910:         pTrunk = 0;
                   4911:         goto end_allocate_page;
                   4912:       }
                   4913:       assert( pTrunk!=0 );
                   4914:       assert( pTrunk->aData!=0 );
                   4915: 
                   4916:       k = get4byte(&pTrunk->aData[4]); /* # of leaves on this trunk page */
                   4917:       if( k==0 && !searchList ){
                   4918:         /* The trunk has no leaves and the list is not being searched. 
                   4919:         ** So extract the trunk page itself and use it as the newly 
                   4920:         ** allocated page */
                   4921:         assert( pPrevTrunk==0 );
                   4922:         rc = sqlite3PagerWrite(pTrunk->pDbPage);
                   4923:         if( rc ){
                   4924:           goto end_allocate_page;
                   4925:         }
                   4926:         *pPgno = iTrunk;
                   4927:         memcpy(&pPage1->aData[32], &pTrunk->aData[0], 4);
                   4928:         *ppPage = pTrunk;
                   4929:         pTrunk = 0;
                   4930:         TRACE(("ALLOCATE: %d trunk - %d free pages left\n", *pPgno, n-1));
                   4931:       }else if( k>(u32)(pBt->usableSize/4 - 2) ){
                   4932:         /* Value of k is out of range.  Database corruption */
                   4933:         rc = SQLITE_CORRUPT_BKPT;
                   4934:         goto end_allocate_page;
                   4935: #ifndef SQLITE_OMIT_AUTOVACUUM
                   4936:       }else if( searchList && nearby==iTrunk ){
                   4937:         /* The list is being searched and this trunk page is the page
                   4938:         ** to allocate, regardless of whether it has leaves.
                   4939:         */
                   4940:         assert( *pPgno==iTrunk );
                   4941:         *ppPage = pTrunk;
                   4942:         searchList = 0;
                   4943:         rc = sqlite3PagerWrite(pTrunk->pDbPage);
                   4944:         if( rc ){
                   4945:           goto end_allocate_page;
                   4946:         }
                   4947:         if( k==0 ){
                   4948:           if( !pPrevTrunk ){
                   4949:             memcpy(&pPage1->aData[32], &pTrunk->aData[0], 4);
                   4950:           }else{
                   4951:             rc = sqlite3PagerWrite(pPrevTrunk->pDbPage);
                   4952:             if( rc!=SQLITE_OK ){
                   4953:               goto end_allocate_page;
                   4954:             }
                   4955:             memcpy(&pPrevTrunk->aData[0], &pTrunk->aData[0], 4);
                   4956:           }
                   4957:         }else{
                   4958:           /* The trunk page is required by the caller but it contains 
                   4959:           ** pointers to free-list leaves. The first leaf becomes a trunk
                   4960:           ** page in this case.
                   4961:           */
                   4962:           MemPage *pNewTrunk;
                   4963:           Pgno iNewTrunk = get4byte(&pTrunk->aData[8]);
                   4964:           if( iNewTrunk>mxPage ){ 
                   4965:             rc = SQLITE_CORRUPT_BKPT;
                   4966:             goto end_allocate_page;
                   4967:           }
                   4968:           testcase( iNewTrunk==mxPage );
                   4969:           rc = btreeGetPage(pBt, iNewTrunk, &pNewTrunk, 0);
                   4970:           if( rc!=SQLITE_OK ){
                   4971:             goto end_allocate_page;
                   4972:           }
                   4973:           rc = sqlite3PagerWrite(pNewTrunk->pDbPage);
                   4974:           if( rc!=SQLITE_OK ){
                   4975:             releasePage(pNewTrunk);
                   4976:             goto end_allocate_page;
                   4977:           }
                   4978:           memcpy(&pNewTrunk->aData[0], &pTrunk->aData[0], 4);
                   4979:           put4byte(&pNewTrunk->aData[4], k-1);
                   4980:           memcpy(&pNewTrunk->aData[8], &pTrunk->aData[12], (k-1)*4);
                   4981:           releasePage(pNewTrunk);
                   4982:           if( !pPrevTrunk ){
                   4983:             assert( sqlite3PagerIswriteable(pPage1->pDbPage) );
                   4984:             put4byte(&pPage1->aData[32], iNewTrunk);
                   4985:           }else{
                   4986:             rc = sqlite3PagerWrite(pPrevTrunk->pDbPage);
                   4987:             if( rc ){
                   4988:               goto end_allocate_page;
                   4989:             }
                   4990:             put4byte(&pPrevTrunk->aData[0], iNewTrunk);
                   4991:           }
                   4992:         }
                   4993:         pTrunk = 0;
                   4994:         TRACE(("ALLOCATE: %d trunk - %d free pages left\n", *pPgno, n-1));
                   4995: #endif
                   4996:       }else if( k>0 ){
                   4997:         /* Extract a leaf from the trunk */
                   4998:         u32 closest;
                   4999:         Pgno iPage;
                   5000:         unsigned char *aData = pTrunk->aData;
                   5001:         if( nearby>0 ){
                   5002:           u32 i;
                   5003:           int dist;
                   5004:           closest = 0;
                   5005:           dist = sqlite3AbsInt32(get4byte(&aData[8]) - nearby);
                   5006:           for(i=1; i<k; i++){
                   5007:             int d2 = sqlite3AbsInt32(get4byte(&aData[8+i*4]) - nearby);
                   5008:             if( d2<dist ){
                   5009:               closest = i;
                   5010:               dist = d2;
                   5011:             }
                   5012:           }
                   5013:         }else{
                   5014:           closest = 0;
                   5015:         }
                   5016: 
                   5017:         iPage = get4byte(&aData[8+closest*4]);
                   5018:         testcase( iPage==mxPage );
                   5019:         if( iPage>mxPage ){
                   5020:           rc = SQLITE_CORRUPT_BKPT;
                   5021:           goto end_allocate_page;
                   5022:         }
                   5023:         testcase( iPage==mxPage );
                   5024:         if( !searchList || iPage==nearby ){
                   5025:           int noContent;
                   5026:           *pPgno = iPage;
                   5027:           TRACE(("ALLOCATE: %d was leaf %d of %d on trunk %d"
                   5028:                  ": %d more free pages\n",
                   5029:                  *pPgno, closest+1, k, pTrunk->pgno, n-1));
                   5030:           rc = sqlite3PagerWrite(pTrunk->pDbPage);
                   5031:           if( rc ) goto end_allocate_page;
                   5032:           if( closest<k-1 ){
                   5033:             memcpy(&aData[8+closest*4], &aData[4+k*4], 4);
                   5034:           }
                   5035:           put4byte(&aData[4], k-1);
                   5036:           noContent = !btreeGetHasContent(pBt, *pPgno);
                   5037:           rc = btreeGetPage(pBt, *pPgno, ppPage, noContent);
                   5038:           if( rc==SQLITE_OK ){
                   5039:             rc = sqlite3PagerWrite((*ppPage)->pDbPage);
                   5040:             if( rc!=SQLITE_OK ){
                   5041:               releasePage(*ppPage);
                   5042:             }
                   5043:           }
                   5044:           searchList = 0;
                   5045:         }
                   5046:       }
                   5047:       releasePage(pPrevTrunk);
                   5048:       pPrevTrunk = 0;
                   5049:     }while( searchList );
                   5050:   }else{
                   5051:     /* There are no pages on the freelist, so create a new page at the
                   5052:     ** end of the file */
                   5053:     rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
                   5054:     if( rc ) return rc;
                   5055:     pBt->nPage++;
                   5056:     if( pBt->nPage==PENDING_BYTE_PAGE(pBt) ) pBt->nPage++;
                   5057: 
                   5058: #ifndef SQLITE_OMIT_AUTOVACUUM
                   5059:     if( pBt->autoVacuum && PTRMAP_ISPAGE(pBt, pBt->nPage) ){
                   5060:       /* If *pPgno refers to a pointer-map page, allocate two new pages
                   5061:       ** at the end of the file instead of one. The first allocated page
                   5062:       ** becomes a new pointer-map page, the second is used by the caller.
                   5063:       */
                   5064:       MemPage *pPg = 0;
                   5065:       TRACE(("ALLOCATE: %d from end of file (pointer-map page)\n", pBt->nPage));
                   5066:       assert( pBt->nPage!=PENDING_BYTE_PAGE(pBt) );
                   5067:       rc = btreeGetPage(pBt, pBt->nPage, &pPg, 1);
                   5068:       if( rc==SQLITE_OK ){
                   5069:         rc = sqlite3PagerWrite(pPg->pDbPage);
                   5070:         releasePage(pPg);
                   5071:       }
                   5072:       if( rc ) return rc;
                   5073:       pBt->nPage++;
                   5074:       if( pBt->nPage==PENDING_BYTE_PAGE(pBt) ){ pBt->nPage++; }
                   5075:     }
                   5076: #endif
                   5077:     put4byte(28 + (u8*)pBt->pPage1->aData, pBt->nPage);
                   5078:     *pPgno = pBt->nPage;
                   5079: 
                   5080:     assert( *pPgno!=PENDING_BYTE_PAGE(pBt) );
                   5081:     rc = btreeGetPage(pBt, *pPgno, ppPage, 1);
                   5082:     if( rc ) return rc;
                   5083:     rc = sqlite3PagerWrite((*ppPage)->pDbPage);
                   5084:     if( rc!=SQLITE_OK ){
                   5085:       releasePage(*ppPage);
                   5086:     }
                   5087:     TRACE(("ALLOCATE: %d from end of file\n", *pPgno));
                   5088:   }
                   5089: 
                   5090:   assert( *pPgno!=PENDING_BYTE_PAGE(pBt) );
                   5091: 
                   5092: end_allocate_page:
                   5093:   releasePage(pTrunk);
                   5094:   releasePage(pPrevTrunk);
                   5095:   if( rc==SQLITE_OK ){
                   5096:     if( sqlite3PagerPageRefcount((*ppPage)->pDbPage)>1 ){
                   5097:       releasePage(*ppPage);
                   5098:       return SQLITE_CORRUPT_BKPT;
                   5099:     }
                   5100:     (*ppPage)->isInit = 0;
                   5101:   }else{
                   5102:     *ppPage = 0;
                   5103:   }
                   5104:   assert( rc!=SQLITE_OK || sqlite3PagerIswriteable((*ppPage)->pDbPage) );
                   5105:   return rc;
                   5106: }
                   5107: 
                   5108: /*
                   5109: ** This function is used to add page iPage to the database file free-list. 
                   5110: ** It is assumed that the page is not already a part of the free-list.
                   5111: **
                   5112: ** The value passed as the second argument to this function is optional.
                   5113: ** If the caller happens to have a pointer to the MemPage object 
                   5114: ** corresponding to page iPage handy, it may pass it as the second value. 
                   5115: ** Otherwise, it may pass NULL.
                   5116: **
                   5117: ** If a pointer to a MemPage object is passed as the second argument,
                   5118: ** its reference count is not altered by this function.
                   5119: */
                   5120: static int freePage2(BtShared *pBt, MemPage *pMemPage, Pgno iPage){
                   5121:   MemPage *pTrunk = 0;                /* Free-list trunk page */
                   5122:   Pgno iTrunk = 0;                    /* Page number of free-list trunk page */ 
                   5123:   MemPage *pPage1 = pBt->pPage1;      /* Local reference to page 1 */
                   5124:   MemPage *pPage;                     /* Page being freed. May be NULL. */
                   5125:   int rc;                             /* Return Code */
                   5126:   int nFree;                          /* Initial number of pages on free-list */
                   5127: 
                   5128:   assert( sqlite3_mutex_held(pBt->mutex) );
                   5129:   assert( iPage>1 );
                   5130:   assert( !pMemPage || pMemPage->pgno==iPage );
                   5131: 
                   5132:   if( pMemPage ){
                   5133:     pPage = pMemPage;
                   5134:     sqlite3PagerRef(pPage->pDbPage);
                   5135:   }else{
                   5136:     pPage = btreePageLookup(pBt, iPage);
                   5137:   }
                   5138: 
                   5139:   /* Increment the free page count on pPage1 */
                   5140:   rc = sqlite3PagerWrite(pPage1->pDbPage);
                   5141:   if( rc ) goto freepage_out;
                   5142:   nFree = get4byte(&pPage1->aData[36]);
                   5143:   put4byte(&pPage1->aData[36], nFree+1);
                   5144: 
                   5145:   if( pBt->btsFlags & BTS_SECURE_DELETE ){
                   5146:     /* If the secure_delete option is enabled, then
                   5147:     ** always fully overwrite deleted information with zeros.
                   5148:     */
                   5149:     if( (!pPage && ((rc = btreeGetPage(pBt, iPage, &pPage, 0))!=0) )
                   5150:      ||            ((rc = sqlite3PagerWrite(pPage->pDbPage))!=0)
                   5151:     ){
                   5152:       goto freepage_out;
                   5153:     }
                   5154:     memset(pPage->aData, 0, pPage->pBt->pageSize);
                   5155:   }
                   5156: 
                   5157:   /* If the database supports auto-vacuum, write an entry in the pointer-map
                   5158:   ** to indicate that the page is free.
                   5159:   */
                   5160:   if( ISAUTOVACUUM ){
                   5161:     ptrmapPut(pBt, iPage, PTRMAP_FREEPAGE, 0, &rc);
                   5162:     if( rc ) goto freepage_out;
                   5163:   }
                   5164: 
                   5165:   /* Now manipulate the actual database free-list structure. There are two
                   5166:   ** possibilities. If the free-list is currently empty, or if the first
                   5167:   ** trunk page in the free-list is full, then this page will become a
                   5168:   ** new free-list trunk page. Otherwise, it will become a leaf of the
                   5169:   ** first trunk page in the current free-list. This block tests if it
                   5170:   ** is possible to add the page as a new free-list leaf.
                   5171:   */
                   5172:   if( nFree!=0 ){
                   5173:     u32 nLeaf;                /* Initial number of leaf cells on trunk page */
                   5174: 
                   5175:     iTrunk = get4byte(&pPage1->aData[32]);
                   5176:     rc = btreeGetPage(pBt, iTrunk, &pTrunk, 0);
                   5177:     if( rc!=SQLITE_OK ){
                   5178:       goto freepage_out;
                   5179:     }
                   5180: 
                   5181:     nLeaf = get4byte(&pTrunk->aData[4]);
                   5182:     assert( pBt->usableSize>32 );
                   5183:     if( nLeaf > (u32)pBt->usableSize/4 - 2 ){
                   5184:       rc = SQLITE_CORRUPT_BKPT;
                   5185:       goto freepage_out;
                   5186:     }
                   5187:     if( nLeaf < (u32)pBt->usableSize/4 - 8 ){
                   5188:       /* In this case there is room on the trunk page to insert the page
                   5189:       ** being freed as a new leaf.
                   5190:       **
                   5191:       ** Note that the trunk page is not really full until it contains
                   5192:       ** usableSize/4 - 2 entries, not usableSize/4 - 8 entries as we have
                   5193:       ** coded.  But due to a coding error in versions of SQLite prior to
                   5194:       ** 3.6.0, databases with freelist trunk pages holding more than
                   5195:       ** usableSize/4 - 8 entries will be reported as corrupt.  In order
                   5196:       ** to maintain backwards compatibility with older versions of SQLite,
                   5197:       ** we will continue to restrict the number of entries to usableSize/4 - 8
                   5198:       ** for now.  At some point in the future (once everyone has upgraded
                   5199:       ** to 3.6.0 or later) we should consider fixing the conditional above
                   5200:       ** to read "usableSize/4-2" instead of "usableSize/4-8".
                   5201:       */
                   5202:       rc = sqlite3PagerWrite(pTrunk->pDbPage);
                   5203:       if( rc==SQLITE_OK ){
                   5204:         put4byte(&pTrunk->aData[4], nLeaf+1);
                   5205:         put4byte(&pTrunk->aData[8+nLeaf*4], iPage);
                   5206:         if( pPage && (pBt->btsFlags & BTS_SECURE_DELETE)==0 ){
                   5207:           sqlite3PagerDontWrite(pPage->pDbPage);
                   5208:         }
                   5209:         rc = btreeSetHasContent(pBt, iPage);
                   5210:       }
                   5211:       TRACE(("FREE-PAGE: %d leaf on trunk page %d\n",pPage->pgno,pTrunk->pgno));
                   5212:       goto freepage_out;
                   5213:     }
                   5214:   }
                   5215: 
                   5216:   /* If control flows to this point, then it was not possible to add the
                   5217:   ** the page being freed as a leaf page of the first trunk in the free-list.
                   5218:   ** Possibly because the free-list is empty, or possibly because the 
                   5219:   ** first trunk in the free-list is full. Either way, the page being freed
                   5220:   ** will become the new first trunk page in the free-list.
                   5221:   */
                   5222:   if( pPage==0 && SQLITE_OK!=(rc = btreeGetPage(pBt, iPage, &pPage, 0)) ){
                   5223:     goto freepage_out;
                   5224:   }
                   5225:   rc = sqlite3PagerWrite(pPage->pDbPage);
                   5226:   if( rc!=SQLITE_OK ){
                   5227:     goto freepage_out;
                   5228:   }
                   5229:   put4byte(pPage->aData, iTrunk);
                   5230:   put4byte(&pPage->aData[4], 0);
                   5231:   put4byte(&pPage1->aData[32], iPage);
                   5232:   TRACE(("FREE-PAGE: %d new trunk page replacing %d\n", pPage->pgno, iTrunk));
                   5233: 
                   5234: freepage_out:
                   5235:   if( pPage ){
                   5236:     pPage->isInit = 0;
                   5237:   }
                   5238:   releasePage(pPage);
                   5239:   releasePage(pTrunk);
                   5240:   return rc;
                   5241: }
                   5242: static void freePage(MemPage *pPage, int *pRC){
                   5243:   if( (*pRC)==SQLITE_OK ){
                   5244:     *pRC = freePage2(pPage->pBt, pPage, pPage->pgno);
                   5245:   }
                   5246: }
                   5247: 
                   5248: /*
                   5249: ** Free any overflow pages associated with the given Cell.
                   5250: */
                   5251: static int clearCell(MemPage *pPage, unsigned char *pCell){
                   5252:   BtShared *pBt = pPage->pBt;
                   5253:   CellInfo info;
                   5254:   Pgno ovflPgno;
                   5255:   int rc;
                   5256:   int nOvfl;
                   5257:   u32 ovflPageSize;
                   5258: 
                   5259:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                   5260:   btreeParseCellPtr(pPage, pCell, &info);
                   5261:   if( info.iOverflow==0 ){
                   5262:     return SQLITE_OK;  /* No overflow pages. Return without doing anything */
                   5263:   }
                   5264:   if( pCell+info.iOverflow+3 > pPage->aData+pPage->maskPage ){
                   5265:     return SQLITE_CORRUPT;  /* Cell extends past end of page */
                   5266:   }
                   5267:   ovflPgno = get4byte(&pCell[info.iOverflow]);
                   5268:   assert( pBt->usableSize > 4 );
                   5269:   ovflPageSize = pBt->usableSize - 4;
                   5270:   nOvfl = (info.nPayload - info.nLocal + ovflPageSize - 1)/ovflPageSize;
                   5271:   assert( ovflPgno==0 || nOvfl>0 );
                   5272:   while( nOvfl-- ){
                   5273:     Pgno iNext = 0;
                   5274:     MemPage *pOvfl = 0;
                   5275:     if( ovflPgno<2 || ovflPgno>btreePagecount(pBt) ){
                   5276:       /* 0 is not a legal page number and page 1 cannot be an 
                   5277:       ** overflow page. Therefore if ovflPgno<2 or past the end of the 
                   5278:       ** file the database must be corrupt. */
                   5279:       return SQLITE_CORRUPT_BKPT;
                   5280:     }
                   5281:     if( nOvfl ){
                   5282:       rc = getOverflowPage(pBt, ovflPgno, &pOvfl, &iNext);
                   5283:       if( rc ) return rc;
                   5284:     }
                   5285: 
                   5286:     if( ( pOvfl || ((pOvfl = btreePageLookup(pBt, ovflPgno))!=0) )
                   5287:      && sqlite3PagerPageRefcount(pOvfl->pDbPage)!=1
                   5288:     ){
                   5289:       /* There is no reason any cursor should have an outstanding reference 
                   5290:       ** to an overflow page belonging to a cell that is being deleted/updated.
                   5291:       ** So if there exists more than one reference to this page, then it 
                   5292:       ** must not really be an overflow page and the database must be corrupt. 
                   5293:       ** It is helpful to detect this before calling freePage2(), as 
                   5294:       ** freePage2() may zero the page contents if secure-delete mode is
                   5295:       ** enabled. If this 'overflow' page happens to be a page that the
                   5296:       ** caller is iterating through or using in some other way, this
                   5297:       ** can be problematic.
                   5298:       */
                   5299:       rc = SQLITE_CORRUPT_BKPT;
                   5300:     }else{
                   5301:       rc = freePage2(pBt, pOvfl, ovflPgno);
                   5302:     }
                   5303: 
                   5304:     if( pOvfl ){
                   5305:       sqlite3PagerUnref(pOvfl->pDbPage);
                   5306:     }
                   5307:     if( rc ) return rc;
                   5308:     ovflPgno = iNext;
                   5309:   }
                   5310:   return SQLITE_OK;
                   5311: }
                   5312: 
                   5313: /*
                   5314: ** Create the byte sequence used to represent a cell on page pPage
                   5315: ** and write that byte sequence into pCell[].  Overflow pages are
                   5316: ** allocated and filled in as necessary.  The calling procedure
                   5317: ** is responsible for making sure sufficient space has been allocated
                   5318: ** for pCell[].
                   5319: **
                   5320: ** Note that pCell does not necessary need to point to the pPage->aData
                   5321: ** area.  pCell might point to some temporary storage.  The cell will
                   5322: ** be constructed in this temporary area then copied into pPage->aData
                   5323: ** later.
                   5324: */
                   5325: static int fillInCell(
                   5326:   MemPage *pPage,                /* The page that contains the cell */
                   5327:   unsigned char *pCell,          /* Complete text of the cell */
                   5328:   const void *pKey, i64 nKey,    /* The key */
                   5329:   const void *pData,int nData,   /* The data */
                   5330:   int nZero,                     /* Extra zero bytes to append to pData */
                   5331:   int *pnSize                    /* Write cell size here */
                   5332: ){
                   5333:   int nPayload;
                   5334:   const u8 *pSrc;
                   5335:   int nSrc, n, rc;
                   5336:   int spaceLeft;
                   5337:   MemPage *pOvfl = 0;
                   5338:   MemPage *pToRelease = 0;
                   5339:   unsigned char *pPrior;
                   5340:   unsigned char *pPayload;
                   5341:   BtShared *pBt = pPage->pBt;
                   5342:   Pgno pgnoOvfl = 0;
                   5343:   int nHeader;
                   5344:   CellInfo info;
                   5345: 
                   5346:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                   5347: 
                   5348:   /* pPage is not necessarily writeable since pCell might be auxiliary
                   5349:   ** buffer space that is separate from the pPage buffer area */
                   5350:   assert( pCell<pPage->aData || pCell>=&pPage->aData[pBt->pageSize]
                   5351:             || sqlite3PagerIswriteable(pPage->pDbPage) );
                   5352: 
                   5353:   /* Fill in the header. */
                   5354:   nHeader = 0;
                   5355:   if( !pPage->leaf ){
                   5356:     nHeader += 4;
                   5357:   }
                   5358:   if( pPage->hasData ){
                   5359:     nHeader += putVarint(&pCell[nHeader], nData+nZero);
                   5360:   }else{
                   5361:     nData = nZero = 0;
                   5362:   }
                   5363:   nHeader += putVarint(&pCell[nHeader], *(u64*)&nKey);
                   5364:   btreeParseCellPtr(pPage, pCell, &info);
                   5365:   assert( info.nHeader==nHeader );
                   5366:   assert( info.nKey==nKey );
                   5367:   assert( info.nData==(u32)(nData+nZero) );
                   5368:   
                   5369:   /* Fill in the payload */
                   5370:   nPayload = nData + nZero;
                   5371:   if( pPage->intKey ){
                   5372:     pSrc = pData;
                   5373:     nSrc = nData;
                   5374:     nData = 0;
                   5375:   }else{ 
                   5376:     if( NEVER(nKey>0x7fffffff || pKey==0) ){
                   5377:       return SQLITE_CORRUPT_BKPT;
                   5378:     }
                   5379:     nPayload += (int)nKey;
                   5380:     pSrc = pKey;
                   5381:     nSrc = (int)nKey;
                   5382:   }
                   5383:   *pnSize = info.nSize;
                   5384:   spaceLeft = info.nLocal;
                   5385:   pPayload = &pCell[nHeader];
                   5386:   pPrior = &pCell[info.iOverflow];
                   5387: 
                   5388:   while( nPayload>0 ){
                   5389:     if( spaceLeft==0 ){
                   5390: #ifndef SQLITE_OMIT_AUTOVACUUM
                   5391:       Pgno pgnoPtrmap = pgnoOvfl; /* Overflow page pointer-map entry page */
                   5392:       if( pBt->autoVacuum ){
                   5393:         do{
                   5394:           pgnoOvfl++;
                   5395:         } while( 
                   5396:           PTRMAP_ISPAGE(pBt, pgnoOvfl) || pgnoOvfl==PENDING_BYTE_PAGE(pBt) 
                   5397:         );
                   5398:       }
                   5399: #endif
                   5400:       rc = allocateBtreePage(pBt, &pOvfl, &pgnoOvfl, pgnoOvfl, 0);
                   5401: #ifndef SQLITE_OMIT_AUTOVACUUM
                   5402:       /* If the database supports auto-vacuum, and the second or subsequent
                   5403:       ** overflow page is being allocated, add an entry to the pointer-map
                   5404:       ** for that page now. 
                   5405:       **
                   5406:       ** If this is the first overflow page, then write a partial entry 
                   5407:       ** to the pointer-map. If we write nothing to this pointer-map slot,
                   5408:       ** then the optimistic overflow chain processing in clearCell()
                   5409:       ** may misinterpret the uninitialised values and delete the
                   5410:       ** wrong pages from the database.
                   5411:       */
                   5412:       if( pBt->autoVacuum && rc==SQLITE_OK ){
                   5413:         u8 eType = (pgnoPtrmap?PTRMAP_OVERFLOW2:PTRMAP_OVERFLOW1);
                   5414:         ptrmapPut(pBt, pgnoOvfl, eType, pgnoPtrmap, &rc);
                   5415:         if( rc ){
                   5416:           releasePage(pOvfl);
                   5417:         }
                   5418:       }
                   5419: #endif
                   5420:       if( rc ){
                   5421:         releasePage(pToRelease);
                   5422:         return rc;
                   5423:       }
                   5424: 
                   5425:       /* If pToRelease is not zero than pPrior points into the data area
                   5426:       ** of pToRelease.  Make sure pToRelease is still writeable. */
                   5427:       assert( pToRelease==0 || sqlite3PagerIswriteable(pToRelease->pDbPage) );
                   5428: 
                   5429:       /* If pPrior is part of the data area of pPage, then make sure pPage
                   5430:       ** is still writeable */
                   5431:       assert( pPrior<pPage->aData || pPrior>=&pPage->aData[pBt->pageSize]
                   5432:             || sqlite3PagerIswriteable(pPage->pDbPage) );
                   5433: 
                   5434:       put4byte(pPrior, pgnoOvfl);
                   5435:       releasePage(pToRelease);
                   5436:       pToRelease = pOvfl;
                   5437:       pPrior = pOvfl->aData;
                   5438:       put4byte(pPrior, 0);
                   5439:       pPayload = &pOvfl->aData[4];
                   5440:       spaceLeft = pBt->usableSize - 4;
                   5441:     }
                   5442:     n = nPayload;
                   5443:     if( n>spaceLeft ) n = spaceLeft;
                   5444: 
                   5445:     /* If pToRelease is not zero than pPayload points into the data area
                   5446:     ** of pToRelease.  Make sure pToRelease is still writeable. */
                   5447:     assert( pToRelease==0 || sqlite3PagerIswriteable(pToRelease->pDbPage) );
                   5448: 
                   5449:     /* If pPayload is part of the data area of pPage, then make sure pPage
                   5450:     ** is still writeable */
                   5451:     assert( pPayload<pPage->aData || pPayload>=&pPage->aData[pBt->pageSize]
                   5452:             || sqlite3PagerIswriteable(pPage->pDbPage) );
                   5453: 
                   5454:     if( nSrc>0 ){
                   5455:       if( n>nSrc ) n = nSrc;
                   5456:       assert( pSrc );
                   5457:       memcpy(pPayload, pSrc, n);
                   5458:     }else{
                   5459:       memset(pPayload, 0, n);
                   5460:     }
                   5461:     nPayload -= n;
                   5462:     pPayload += n;
                   5463:     pSrc += n;
                   5464:     nSrc -= n;
                   5465:     spaceLeft -= n;
                   5466:     if( nSrc==0 ){
                   5467:       nSrc = nData;
                   5468:       pSrc = pData;
                   5469:     }
                   5470:   }
                   5471:   releasePage(pToRelease);
                   5472:   return SQLITE_OK;
                   5473: }
                   5474: 
                   5475: /*
                   5476: ** Remove the i-th cell from pPage.  This routine effects pPage only.
                   5477: ** The cell content is not freed or deallocated.  It is assumed that
                   5478: ** the cell content has been copied someplace else.  This routine just
                   5479: ** removes the reference to the cell from pPage.
                   5480: **
                   5481: ** "sz" must be the number of bytes in the cell.
                   5482: */
                   5483: static void dropCell(MemPage *pPage, int idx, int sz, int *pRC){
                   5484:   u32 pc;         /* Offset to cell content of cell being deleted */
                   5485:   u8 *data;       /* pPage->aData */
                   5486:   u8 *ptr;        /* Used to move bytes around within data[] */
                   5487:   u8 *endPtr;     /* End of loop */
                   5488:   int rc;         /* The return code */
                   5489:   int hdr;        /* Beginning of the header.  0 most pages.  100 page 1 */
                   5490: 
                   5491:   if( *pRC ) return;
                   5492: 
                   5493:   assert( idx>=0 && idx<pPage->nCell );
                   5494:   assert( sz==cellSize(pPage, idx) );
                   5495:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
                   5496:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                   5497:   data = pPage->aData;
                   5498:   ptr = &pPage->aCellIdx[2*idx];
                   5499:   pc = get2byte(ptr);
                   5500:   hdr = pPage->hdrOffset;
                   5501:   testcase( pc==get2byte(&data[hdr+5]) );
                   5502:   testcase( pc+sz==pPage->pBt->usableSize );
                   5503:   if( pc < (u32)get2byte(&data[hdr+5]) || pc+sz > pPage->pBt->usableSize ){
                   5504:     *pRC = SQLITE_CORRUPT_BKPT;
                   5505:     return;
                   5506:   }
                   5507:   rc = freeSpace(pPage, pc, sz);
                   5508:   if( rc ){
                   5509:     *pRC = rc;
                   5510:     return;
                   5511:   }
                   5512:   endPtr = &pPage->aCellIdx[2*pPage->nCell - 2];
                   5513:   assert( (SQLITE_PTR_TO_INT(ptr)&1)==0 );  /* ptr is always 2-byte aligned */
                   5514:   while( ptr<endPtr ){
                   5515:     *(u16*)ptr = *(u16*)&ptr[2];
                   5516:     ptr += 2;
                   5517:   }
                   5518:   pPage->nCell--;
                   5519:   put2byte(&data[hdr+3], pPage->nCell);
                   5520:   pPage->nFree += 2;
                   5521: }
                   5522: 
                   5523: /*
                   5524: ** Insert a new cell on pPage at cell index "i".  pCell points to the
                   5525: ** content of the cell.
                   5526: **
                   5527: ** If the cell content will fit on the page, then put it there.  If it
                   5528: ** will not fit, then make a copy of the cell content into pTemp if
                   5529: ** pTemp is not null.  Regardless of pTemp, allocate a new entry
                   5530: ** in pPage->aOvfl[] and make it point to the cell content (either
                   5531: ** in pTemp or the original pCell) and also record its index. 
                   5532: ** Allocating a new entry in pPage->aCell[] implies that 
                   5533: ** pPage->nOverflow is incremented.
                   5534: **
                   5535: ** If nSkip is non-zero, then do not copy the first nSkip bytes of the
                   5536: ** cell. The caller will overwrite them after this function returns. If
                   5537: ** nSkip is non-zero, then pCell may not point to an invalid memory location 
                   5538: ** (but pCell+nSkip is always valid).
                   5539: */
                   5540: static void insertCell(
                   5541:   MemPage *pPage,   /* Page into which we are copying */
                   5542:   int i,            /* New cell becomes the i-th cell of the page */
                   5543:   u8 *pCell,        /* Content of the new cell */
                   5544:   int sz,           /* Bytes of content in pCell */
                   5545:   u8 *pTemp,        /* Temp storage space for pCell, if needed */
                   5546:   Pgno iChild,      /* If non-zero, replace first 4 bytes with this value */
                   5547:   int *pRC          /* Read and write return code from here */
                   5548: ){
                   5549:   int idx = 0;      /* Where to write new cell content in data[] */
                   5550:   int j;            /* Loop counter */
                   5551:   int end;          /* First byte past the last cell pointer in data[] */
                   5552:   int ins;          /* Index in data[] where new cell pointer is inserted */
                   5553:   int cellOffset;   /* Address of first cell pointer in data[] */
                   5554:   u8 *data;         /* The content of the whole page */
                   5555:   u8 *ptr;          /* Used for moving information around in data[] */
                   5556:   u8 *endPtr;       /* End of the loop */
                   5557: 
                   5558:   int nSkip = (iChild ? 4 : 0);
                   5559: 
                   5560:   if( *pRC ) return;
                   5561: 
                   5562:   assert( i>=0 && i<=pPage->nCell+pPage->nOverflow );
                   5563:   assert( pPage->nCell<=MX_CELL(pPage->pBt) && MX_CELL(pPage->pBt)<=10921 );
                   5564:   assert( pPage->nOverflow<=ArraySize(pPage->aOvfl) );
                   5565:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                   5566:   /* The cell should normally be sized correctly.  However, when moving a
                   5567:   ** malformed cell from a leaf page to an interior page, if the cell size
                   5568:   ** wanted to be less than 4 but got rounded up to 4 on the leaf, then size
                   5569:   ** might be less than 8 (leaf-size + pointer) on the interior node.  Hence
                   5570:   ** the term after the || in the following assert(). */
                   5571:   assert( sz==cellSizePtr(pPage, pCell) || (sz==8 && iChild>0) );
                   5572:   if( pPage->nOverflow || sz+2>pPage->nFree ){
                   5573:     if( pTemp ){
                   5574:       memcpy(pTemp+nSkip, pCell+nSkip, sz-nSkip);
                   5575:       pCell = pTemp;
                   5576:     }
                   5577:     if( iChild ){
                   5578:       put4byte(pCell, iChild);
                   5579:     }
                   5580:     j = pPage->nOverflow++;
                   5581:     assert( j<(int)(sizeof(pPage->aOvfl)/sizeof(pPage->aOvfl[0])) );
                   5582:     pPage->aOvfl[j].pCell = pCell;
                   5583:     pPage->aOvfl[j].idx = (u16)i;
                   5584:   }else{
                   5585:     int rc = sqlite3PagerWrite(pPage->pDbPage);
                   5586:     if( rc!=SQLITE_OK ){
                   5587:       *pRC = rc;
                   5588:       return;
                   5589:     }
                   5590:     assert( sqlite3PagerIswriteable(pPage->pDbPage) );
                   5591:     data = pPage->aData;
                   5592:     cellOffset = pPage->cellOffset;
                   5593:     end = cellOffset + 2*pPage->nCell;
                   5594:     ins = cellOffset + 2*i;
                   5595:     rc = allocateSpace(pPage, sz, &idx);
                   5596:     if( rc ){ *pRC = rc; return; }
                   5597:     /* The allocateSpace() routine guarantees the following two properties
                   5598:     ** if it returns success */
                   5599:     assert( idx >= end+2 );
                   5600:     assert( idx+sz <= (int)pPage->pBt->usableSize );
                   5601:     pPage->nCell++;
                   5602:     pPage->nFree -= (u16)(2 + sz);
                   5603:     memcpy(&data[idx+nSkip], pCell+nSkip, sz-nSkip);
                   5604:     if( iChild ){
                   5605:       put4byte(&data[idx], iChild);
                   5606:     }
                   5607:     ptr = &data[end];
                   5608:     endPtr = &data[ins];
                   5609:     assert( (SQLITE_PTR_TO_INT(ptr)&1)==0 );  /* ptr is always 2-byte aligned */
                   5610:     while( ptr>endPtr ){
                   5611:       *(u16*)ptr = *(u16*)&ptr[-2];
                   5612:       ptr -= 2;
                   5613:     }
                   5614:     put2byte(&data[ins], idx);
                   5615:     put2byte(&data[pPage->hdrOffset+3], pPage->nCell);
                   5616: #ifndef SQLITE_OMIT_AUTOVACUUM
                   5617:     if( pPage->pBt->autoVacuum ){
                   5618:       /* The cell may contain a pointer to an overflow page. If so, write
                   5619:       ** the entry for the overflow page into the pointer map.
                   5620:       */
                   5621:       ptrmapPutOvflPtr(pPage, pCell, pRC);
                   5622:     }
                   5623: #endif
                   5624:   }
                   5625: }
                   5626: 
                   5627: /*
                   5628: ** Add a list of cells to a page.  The page should be initially empty.
                   5629: ** The cells are guaranteed to fit on the page.
                   5630: */
                   5631: static void assemblePage(
                   5632:   MemPage *pPage,   /* The page to be assemblied */
                   5633:   int nCell,        /* The number of cells to add to this page */
                   5634:   u8 **apCell,      /* Pointers to cell bodies */
                   5635:   u16 *aSize        /* Sizes of the cells */
                   5636: ){
                   5637:   int i;            /* Loop counter */
                   5638:   u8 *pCellptr;     /* Address of next cell pointer */
                   5639:   int cellbody;     /* Address of next cell body */
                   5640:   u8 * const data = pPage->aData;             /* Pointer to data for pPage */
                   5641:   const int hdr = pPage->hdrOffset;           /* Offset of header on pPage */
                   5642:   const int nUsable = pPage->pBt->usableSize; /* Usable size of page */
                   5643: 
                   5644:   assert( pPage->nOverflow==0 );
                   5645:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                   5646:   assert( nCell>=0 && nCell<=(int)MX_CELL(pPage->pBt)
                   5647:             && (int)MX_CELL(pPage->pBt)<=10921);
                   5648:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
                   5649: 
                   5650:   /* Check that the page has just been zeroed by zeroPage() */
                   5651:   assert( pPage->nCell==0 );
                   5652:   assert( get2byteNotZero(&data[hdr+5])==nUsable );
                   5653: 
                   5654:   pCellptr = &pPage->aCellIdx[nCell*2];
                   5655:   cellbody = nUsable;
                   5656:   for(i=nCell-1; i>=0; i--){
                   5657:     u16 sz = aSize[i];
                   5658:     pCellptr -= 2;
                   5659:     cellbody -= sz;
                   5660:     put2byte(pCellptr, cellbody);
                   5661:     memcpy(&data[cellbody], apCell[i], sz);
                   5662:   }
                   5663:   put2byte(&data[hdr+3], nCell);
                   5664:   put2byte(&data[hdr+5], cellbody);
                   5665:   pPage->nFree -= (nCell*2 + nUsable - cellbody);
                   5666:   pPage->nCell = (u16)nCell;
                   5667: }
                   5668: 
                   5669: /*
                   5670: ** The following parameters determine how many adjacent pages get involved
                   5671: ** in a balancing operation.  NN is the number of neighbors on either side
                   5672: ** of the page that participate in the balancing operation.  NB is the
                   5673: ** total number of pages that participate, including the target page and
                   5674: ** NN neighbors on either side.
                   5675: **
                   5676: ** The minimum value of NN is 1 (of course).  Increasing NN above 1
                   5677: ** (to 2 or 3) gives a modest improvement in SELECT and DELETE performance
                   5678: ** in exchange for a larger degradation in INSERT and UPDATE performance.
                   5679: ** The value of NN appears to give the best results overall.
                   5680: */
                   5681: #define NN 1             /* Number of neighbors on either side of pPage */
                   5682: #define NB (NN*2+1)      /* Total pages involved in the balance */
                   5683: 
                   5684: 
                   5685: #ifndef SQLITE_OMIT_QUICKBALANCE
                   5686: /*
                   5687: ** This version of balance() handles the common special case where
                   5688: ** a new entry is being inserted on the extreme right-end of the
                   5689: ** tree, in other words, when the new entry will become the largest
                   5690: ** entry in the tree.
                   5691: **
                   5692: ** Instead of trying to balance the 3 right-most leaf pages, just add
                   5693: ** a new page to the right-hand side and put the one new entry in
                   5694: ** that page.  This leaves the right side of the tree somewhat
                   5695: ** unbalanced.  But odds are that we will be inserting new entries
                   5696: ** at the end soon afterwards so the nearly empty page will quickly
                   5697: ** fill up.  On average.
                   5698: **
                   5699: ** pPage is the leaf page which is the right-most page in the tree.
                   5700: ** pParent is its parent.  pPage must have a single overflow entry
                   5701: ** which is also the right-most entry on the page.
                   5702: **
                   5703: ** The pSpace buffer is used to store a temporary copy of the divider
                   5704: ** cell that will be inserted into pParent. Such a cell consists of a 4
                   5705: ** byte page number followed by a variable length integer. In other
                   5706: ** words, at most 13 bytes. Hence the pSpace buffer must be at
                   5707: ** least 13 bytes in size.
                   5708: */
                   5709: static int balance_quick(MemPage *pParent, MemPage *pPage, u8 *pSpace){
                   5710:   BtShared *const pBt = pPage->pBt;    /* B-Tree Database */
                   5711:   MemPage *pNew;                       /* Newly allocated page */
                   5712:   int rc;                              /* Return Code */
                   5713:   Pgno pgnoNew;                        /* Page number of pNew */
                   5714: 
                   5715:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
                   5716:   assert( sqlite3PagerIswriteable(pParent->pDbPage) );
                   5717:   assert( pPage->nOverflow==1 );
                   5718: 
                   5719:   /* This error condition is now caught prior to reaching this function */
                   5720:   if( pPage->nCell<=0 ) return SQLITE_CORRUPT_BKPT;
                   5721: 
                   5722:   /* Allocate a new page. This page will become the right-sibling of 
                   5723:   ** pPage. Make the parent page writable, so that the new divider cell
                   5724:   ** may be inserted. If both these operations are successful, proceed.
                   5725:   */
                   5726:   rc = allocateBtreePage(pBt, &pNew, &pgnoNew, 0, 0);
                   5727: 
                   5728:   if( rc==SQLITE_OK ){
                   5729: 
                   5730:     u8 *pOut = &pSpace[4];
                   5731:     u8 *pCell = pPage->aOvfl[0].pCell;
                   5732:     u16 szCell = cellSizePtr(pPage, pCell);
                   5733:     u8 *pStop;
                   5734: 
                   5735:     assert( sqlite3PagerIswriteable(pNew->pDbPage) );
                   5736:     assert( pPage->aData[0]==(PTF_INTKEY|PTF_LEAFDATA|PTF_LEAF) );
                   5737:     zeroPage(pNew, PTF_INTKEY|PTF_LEAFDATA|PTF_LEAF);
                   5738:     assemblePage(pNew, 1, &pCell, &szCell);
                   5739: 
                   5740:     /* If this is an auto-vacuum database, update the pointer map
                   5741:     ** with entries for the new page, and any pointer from the 
                   5742:     ** cell on the page to an overflow page. If either of these
                   5743:     ** operations fails, the return code is set, but the contents
                   5744:     ** of the parent page are still manipulated by thh code below.
                   5745:     ** That is Ok, at this point the parent page is guaranteed to
                   5746:     ** be marked as dirty. Returning an error code will cause a
                   5747:     ** rollback, undoing any changes made to the parent page.
                   5748:     */
                   5749:     if( ISAUTOVACUUM ){
                   5750:       ptrmapPut(pBt, pgnoNew, PTRMAP_BTREE, pParent->pgno, &rc);
                   5751:       if( szCell>pNew->minLocal ){
                   5752:         ptrmapPutOvflPtr(pNew, pCell, &rc);
                   5753:       }
                   5754:     }
                   5755:   
                   5756:     /* Create a divider cell to insert into pParent. The divider cell
                   5757:     ** consists of a 4-byte page number (the page number of pPage) and
                   5758:     ** a variable length key value (which must be the same value as the
                   5759:     ** largest key on pPage).
                   5760:     **
                   5761:     ** To find the largest key value on pPage, first find the right-most 
                   5762:     ** cell on pPage. The first two fields of this cell are the 
                   5763:     ** record-length (a variable length integer at most 32-bits in size)
                   5764:     ** and the key value (a variable length integer, may have any value).
                   5765:     ** The first of the while(...) loops below skips over the record-length
                   5766:     ** field. The second while(...) loop copies the key value from the
                   5767:     ** cell on pPage into the pSpace buffer.
                   5768:     */
                   5769:     pCell = findCell(pPage, pPage->nCell-1);
                   5770:     pStop = &pCell[9];
                   5771:     while( (*(pCell++)&0x80) && pCell<pStop );
                   5772:     pStop = &pCell[9];
                   5773:     while( ((*(pOut++) = *(pCell++))&0x80) && pCell<pStop );
                   5774: 
                   5775:     /* Insert the new divider cell into pParent. */
                   5776:     insertCell(pParent, pParent->nCell, pSpace, (int)(pOut-pSpace),
                   5777:                0, pPage->pgno, &rc);
                   5778: 
                   5779:     /* Set the right-child pointer of pParent to point to the new page. */
                   5780:     put4byte(&pParent->aData[pParent->hdrOffset+8], pgnoNew);
                   5781:   
                   5782:     /* Release the reference to the new page. */
                   5783:     releasePage(pNew);
                   5784:   }
                   5785: 
                   5786:   return rc;
                   5787: }
                   5788: #endif /* SQLITE_OMIT_QUICKBALANCE */
                   5789: 
                   5790: #if 0
                   5791: /*
                   5792: ** This function does not contribute anything to the operation of SQLite.
                   5793: ** it is sometimes activated temporarily while debugging code responsible 
                   5794: ** for setting pointer-map entries.
                   5795: */
                   5796: static int ptrmapCheckPages(MemPage **apPage, int nPage){
                   5797:   int i, j;
                   5798:   for(i=0; i<nPage; i++){
                   5799:     Pgno n;
                   5800:     u8 e;
                   5801:     MemPage *pPage = apPage[i];
                   5802:     BtShared *pBt = pPage->pBt;
                   5803:     assert( pPage->isInit );
                   5804: 
                   5805:     for(j=0; j<pPage->nCell; j++){
                   5806:       CellInfo info;
                   5807:       u8 *z;
                   5808:      
                   5809:       z = findCell(pPage, j);
                   5810:       btreeParseCellPtr(pPage, z, &info);
                   5811:       if( info.iOverflow ){
                   5812:         Pgno ovfl = get4byte(&z[info.iOverflow]);
                   5813:         ptrmapGet(pBt, ovfl, &e, &n);
                   5814:         assert( n==pPage->pgno && e==PTRMAP_OVERFLOW1 );
                   5815:       }
                   5816:       if( !pPage->leaf ){
                   5817:         Pgno child = get4byte(z);
                   5818:         ptrmapGet(pBt, child, &e, &n);
                   5819:         assert( n==pPage->pgno && e==PTRMAP_BTREE );
                   5820:       }
                   5821:     }
                   5822:     if( !pPage->leaf ){
                   5823:       Pgno child = get4byte(&pPage->aData[pPage->hdrOffset+8]);
                   5824:       ptrmapGet(pBt, child, &e, &n);
                   5825:       assert( n==pPage->pgno && e==PTRMAP_BTREE );
                   5826:     }
                   5827:   }
                   5828:   return 1;
                   5829: }
                   5830: #endif
                   5831: 
                   5832: /*
                   5833: ** This function is used to copy the contents of the b-tree node stored 
                   5834: ** on page pFrom to page pTo. If page pFrom was not a leaf page, then
                   5835: ** the pointer-map entries for each child page are updated so that the
                   5836: ** parent page stored in the pointer map is page pTo. If pFrom contained
                   5837: ** any cells with overflow page pointers, then the corresponding pointer
                   5838: ** map entries are also updated so that the parent page is page pTo.
                   5839: **
                   5840: ** If pFrom is currently carrying any overflow cells (entries in the
                   5841: ** MemPage.aOvfl[] array), they are not copied to pTo. 
                   5842: **
                   5843: ** Before returning, page pTo is reinitialized using btreeInitPage().
                   5844: **
                   5845: ** The performance of this function is not critical. It is only used by 
                   5846: ** the balance_shallower() and balance_deeper() procedures, neither of
                   5847: ** which are called often under normal circumstances.
                   5848: */
                   5849: static void copyNodeContent(MemPage *pFrom, MemPage *pTo, int *pRC){
                   5850:   if( (*pRC)==SQLITE_OK ){
                   5851:     BtShared * const pBt = pFrom->pBt;
                   5852:     u8 * const aFrom = pFrom->aData;
                   5853:     u8 * const aTo = pTo->aData;
                   5854:     int const iFromHdr = pFrom->hdrOffset;
                   5855:     int const iToHdr = ((pTo->pgno==1) ? 100 : 0);
                   5856:     int rc;
                   5857:     int iData;
                   5858:   
                   5859:   
                   5860:     assert( pFrom->isInit );
                   5861:     assert( pFrom->nFree>=iToHdr );
                   5862:     assert( get2byte(&aFrom[iFromHdr+5]) <= (int)pBt->usableSize );
                   5863:   
                   5864:     /* Copy the b-tree node content from page pFrom to page pTo. */
                   5865:     iData = get2byte(&aFrom[iFromHdr+5]);
                   5866:     memcpy(&aTo[iData], &aFrom[iData], pBt->usableSize-iData);
                   5867:     memcpy(&aTo[iToHdr], &aFrom[iFromHdr], pFrom->cellOffset + 2*pFrom->nCell);
                   5868:   
                   5869:     /* Reinitialize page pTo so that the contents of the MemPage structure
                   5870:     ** match the new data. The initialization of pTo can actually fail under
                   5871:     ** fairly obscure circumstances, even though it is a copy of initialized 
                   5872:     ** page pFrom.
                   5873:     */
                   5874:     pTo->isInit = 0;
                   5875:     rc = btreeInitPage(pTo);
                   5876:     if( rc!=SQLITE_OK ){
                   5877:       *pRC = rc;
                   5878:       return;
                   5879:     }
                   5880:   
                   5881:     /* If this is an auto-vacuum database, update the pointer-map entries
                   5882:     ** for any b-tree or overflow pages that pTo now contains the pointers to.
                   5883:     */
                   5884:     if( ISAUTOVACUUM ){
                   5885:       *pRC = setChildPtrmaps(pTo);
                   5886:     }
                   5887:   }
                   5888: }
                   5889: 
                   5890: /*
                   5891: ** This routine redistributes cells on the iParentIdx'th child of pParent
                   5892: ** (hereafter "the page") and up to 2 siblings so that all pages have about the
                   5893: ** same amount of free space. Usually a single sibling on either side of the
                   5894: ** page are used in the balancing, though both siblings might come from one
                   5895: ** side if the page is the first or last child of its parent. If the page 
                   5896: ** has fewer than 2 siblings (something which can only happen if the page
                   5897: ** is a root page or a child of a root page) then all available siblings
                   5898: ** participate in the balancing.
                   5899: **
                   5900: ** The number of siblings of the page might be increased or decreased by 
                   5901: ** one or two in an effort to keep pages nearly full but not over full. 
                   5902: **
                   5903: ** Note that when this routine is called, some of the cells on the page
                   5904: ** might not actually be stored in MemPage.aData[]. This can happen
                   5905: ** if the page is overfull. This routine ensures that all cells allocated
                   5906: ** to the page and its siblings fit into MemPage.aData[] before returning.
                   5907: **
                   5908: ** In the course of balancing the page and its siblings, cells may be
                   5909: ** inserted into or removed from the parent page (pParent). Doing so
                   5910: ** may cause the parent page to become overfull or underfull. If this
                   5911: ** happens, it is the responsibility of the caller to invoke the correct
                   5912: ** balancing routine to fix this problem (see the balance() routine). 
                   5913: **
                   5914: ** If this routine fails for any reason, it might leave the database
                   5915: ** in a corrupted state. So if this routine fails, the database should
                   5916: ** be rolled back.
                   5917: **
                   5918: ** The third argument to this function, aOvflSpace, is a pointer to a
                   5919: ** buffer big enough to hold one page. If while inserting cells into the parent
                   5920: ** page (pParent) the parent page becomes overfull, this buffer is
                   5921: ** used to store the parent's overflow cells. Because this function inserts
                   5922: ** a maximum of four divider cells into the parent page, and the maximum
                   5923: ** size of a cell stored within an internal node is always less than 1/4
                   5924: ** of the page-size, the aOvflSpace[] buffer is guaranteed to be large
                   5925: ** enough for all overflow cells.
                   5926: **
                   5927: ** If aOvflSpace is set to a null pointer, this function returns 
                   5928: ** SQLITE_NOMEM.
                   5929: */
                   5930: static int balance_nonroot(
                   5931:   MemPage *pParent,               /* Parent page of siblings being balanced */
                   5932:   int iParentIdx,                 /* Index of "the page" in pParent */
                   5933:   u8 *aOvflSpace,                 /* page-size bytes of space for parent ovfl */
                   5934:   int isRoot                      /* True if pParent is a root-page */
                   5935: ){
                   5936:   BtShared *pBt;               /* The whole database */
                   5937:   int nCell = 0;               /* Number of cells in apCell[] */
                   5938:   int nMaxCells = 0;           /* Allocated size of apCell, szCell, aFrom. */
                   5939:   int nNew = 0;                /* Number of pages in apNew[] */
                   5940:   int nOld;                    /* Number of pages in apOld[] */
                   5941:   int i, j, k;                 /* Loop counters */
                   5942:   int nxDiv;                   /* Next divider slot in pParent->aCell[] */
                   5943:   int rc = SQLITE_OK;          /* The return code */
                   5944:   u16 leafCorrection;          /* 4 if pPage is a leaf.  0 if not */
                   5945:   int leafData;                /* True if pPage is a leaf of a LEAFDATA tree */
                   5946:   int usableSpace;             /* Bytes in pPage beyond the header */
                   5947:   int pageFlags;               /* Value of pPage->aData[0] */
                   5948:   int subtotal;                /* Subtotal of bytes in cells on one page */
                   5949:   int iSpace1 = 0;             /* First unused byte of aSpace1[] */
                   5950:   int iOvflSpace = 0;          /* First unused byte of aOvflSpace[] */
                   5951:   int szScratch;               /* Size of scratch memory requested */
                   5952:   MemPage *apOld[NB];          /* pPage and up to two siblings */
                   5953:   MemPage *apCopy[NB];         /* Private copies of apOld[] pages */
                   5954:   MemPage *apNew[NB+2];        /* pPage and up to NB siblings after balancing */
                   5955:   u8 *pRight;                  /* Location in parent of right-sibling pointer */
                   5956:   u8 *apDiv[NB-1];             /* Divider cells in pParent */
                   5957:   int cntNew[NB+2];            /* Index in aCell[] of cell after i-th page */
                   5958:   int szNew[NB+2];             /* Combined size of cells place on i-th page */
                   5959:   u8 **apCell = 0;             /* All cells begin balanced */
                   5960:   u16 *szCell;                 /* Local size of all cells in apCell[] */
                   5961:   u8 *aSpace1;                 /* Space for copies of dividers cells */
                   5962:   Pgno pgno;                   /* Temp var to store a page number in */
                   5963: 
                   5964:   pBt = pParent->pBt;
                   5965:   assert( sqlite3_mutex_held(pBt->mutex) );
                   5966:   assert( sqlite3PagerIswriteable(pParent->pDbPage) );
                   5967: 
                   5968: #if 0
                   5969:   TRACE(("BALANCE: begin page %d child of %d\n", pPage->pgno, pParent->pgno));
                   5970: #endif
                   5971: 
                   5972:   /* At this point pParent may have at most one overflow cell. And if
                   5973:   ** this overflow cell is present, it must be the cell with 
                   5974:   ** index iParentIdx. This scenario comes about when this function
                   5975:   ** is called (indirectly) from sqlite3BtreeDelete().
                   5976:   */
                   5977:   assert( pParent->nOverflow==0 || pParent->nOverflow==1 );
                   5978:   assert( pParent->nOverflow==0 || pParent->aOvfl[0].idx==iParentIdx );
                   5979: 
                   5980:   if( !aOvflSpace ){
                   5981:     return SQLITE_NOMEM;
                   5982:   }
                   5983: 
                   5984:   /* Find the sibling pages to balance. Also locate the cells in pParent 
                   5985:   ** that divide the siblings. An attempt is made to find NN siblings on 
                   5986:   ** either side of pPage. More siblings are taken from one side, however, 
                   5987:   ** if there are fewer than NN siblings on the other side. If pParent
                   5988:   ** has NB or fewer children then all children of pParent are taken.  
                   5989:   **
                   5990:   ** This loop also drops the divider cells from the parent page. This
                   5991:   ** way, the remainder of the function does not have to deal with any
                   5992:   ** overflow cells in the parent page, since if any existed they will
                   5993:   ** have already been removed.
                   5994:   */
                   5995:   i = pParent->nOverflow + pParent->nCell;
                   5996:   if( i<2 ){
                   5997:     nxDiv = 0;
                   5998:     nOld = i+1;
                   5999:   }else{
                   6000:     nOld = 3;
                   6001:     if( iParentIdx==0 ){                 
                   6002:       nxDiv = 0;
                   6003:     }else if( iParentIdx==i ){
                   6004:       nxDiv = i-2;
                   6005:     }else{
                   6006:       nxDiv = iParentIdx-1;
                   6007:     }
                   6008:     i = 2;
                   6009:   }
                   6010:   if( (i+nxDiv-pParent->nOverflow)==pParent->nCell ){
                   6011:     pRight = &pParent->aData[pParent->hdrOffset+8];
                   6012:   }else{
                   6013:     pRight = findCell(pParent, i+nxDiv-pParent->nOverflow);
                   6014:   }
                   6015:   pgno = get4byte(pRight);
                   6016:   while( 1 ){
                   6017:     rc = getAndInitPage(pBt, pgno, &apOld[i]);
                   6018:     if( rc ){
                   6019:       memset(apOld, 0, (i+1)*sizeof(MemPage*));
                   6020:       goto balance_cleanup;
                   6021:     }
                   6022:     nMaxCells += 1+apOld[i]->nCell+apOld[i]->nOverflow;
                   6023:     if( (i--)==0 ) break;
                   6024: 
                   6025:     if( i+nxDiv==pParent->aOvfl[0].idx && pParent->nOverflow ){
                   6026:       apDiv[i] = pParent->aOvfl[0].pCell;
                   6027:       pgno = get4byte(apDiv[i]);
                   6028:       szNew[i] = cellSizePtr(pParent, apDiv[i]);
                   6029:       pParent->nOverflow = 0;
                   6030:     }else{
                   6031:       apDiv[i] = findCell(pParent, i+nxDiv-pParent->nOverflow);
                   6032:       pgno = get4byte(apDiv[i]);
                   6033:       szNew[i] = cellSizePtr(pParent, apDiv[i]);
                   6034: 
                   6035:       /* Drop the cell from the parent page. apDiv[i] still points to
                   6036:       ** the cell within the parent, even though it has been dropped.
                   6037:       ** This is safe because dropping a cell only overwrites the first
                   6038:       ** four bytes of it, and this function does not need the first
                   6039:       ** four bytes of the divider cell. So the pointer is safe to use
                   6040:       ** later on.  
                   6041:       **
                   6042:       ** But not if we are in secure-delete mode. In secure-delete mode,
                   6043:       ** the dropCell() routine will overwrite the entire cell with zeroes.
                   6044:       ** In this case, temporarily copy the cell into the aOvflSpace[]
                   6045:       ** buffer. It will be copied out again as soon as the aSpace[] buffer
                   6046:       ** is allocated.  */
                   6047:       if( pBt->btsFlags & BTS_SECURE_DELETE ){
                   6048:         int iOff;
                   6049: 
                   6050:         iOff = SQLITE_PTR_TO_INT(apDiv[i]) - SQLITE_PTR_TO_INT(pParent->aData);
                   6051:         if( (iOff+szNew[i])>(int)pBt->usableSize ){
                   6052:           rc = SQLITE_CORRUPT_BKPT;
                   6053:           memset(apOld, 0, (i+1)*sizeof(MemPage*));
                   6054:           goto balance_cleanup;
                   6055:         }else{
                   6056:           memcpy(&aOvflSpace[iOff], apDiv[i], szNew[i]);
                   6057:           apDiv[i] = &aOvflSpace[apDiv[i]-pParent->aData];
                   6058:         }
                   6059:       }
                   6060:       dropCell(pParent, i+nxDiv-pParent->nOverflow, szNew[i], &rc);
                   6061:     }
                   6062:   }
                   6063: 
                   6064:   /* Make nMaxCells a multiple of 4 in order to preserve 8-byte
                   6065:   ** alignment */
                   6066:   nMaxCells = (nMaxCells + 3)&~3;
                   6067: 
                   6068:   /*
                   6069:   ** Allocate space for memory structures
                   6070:   */
                   6071:   k = pBt->pageSize + ROUND8(sizeof(MemPage));
                   6072:   szScratch =
                   6073:        nMaxCells*sizeof(u8*)                       /* apCell */
                   6074:      + nMaxCells*sizeof(u16)                       /* szCell */
                   6075:      + pBt->pageSize                               /* aSpace1 */
                   6076:      + k*nOld;                                     /* Page copies (apCopy) */
                   6077:   apCell = sqlite3ScratchMalloc( szScratch ); 
                   6078:   if( apCell==0 ){
                   6079:     rc = SQLITE_NOMEM;
                   6080:     goto balance_cleanup;
                   6081:   }
                   6082:   szCell = (u16*)&apCell[nMaxCells];
                   6083:   aSpace1 = (u8*)&szCell[nMaxCells];
                   6084:   assert( EIGHT_BYTE_ALIGNMENT(aSpace1) );
                   6085: 
                   6086:   /*
                   6087:   ** Load pointers to all cells on sibling pages and the divider cells
                   6088:   ** into the local apCell[] array.  Make copies of the divider cells
                   6089:   ** into space obtained from aSpace1[] and remove the the divider Cells
                   6090:   ** from pParent.
                   6091:   **
                   6092:   ** If the siblings are on leaf pages, then the child pointers of the
                   6093:   ** divider cells are stripped from the cells before they are copied
                   6094:   ** into aSpace1[].  In this way, all cells in apCell[] are without
                   6095:   ** child pointers.  If siblings are not leaves, then all cell in
                   6096:   ** apCell[] include child pointers.  Either way, all cells in apCell[]
                   6097:   ** are alike.
                   6098:   **
                   6099:   ** leafCorrection:  4 if pPage is a leaf.  0 if pPage is not a leaf.
                   6100:   **       leafData:  1 if pPage holds key+data and pParent holds only keys.
                   6101:   */
                   6102:   leafCorrection = apOld[0]->leaf*4;
                   6103:   leafData = apOld[0]->hasData;
                   6104:   for(i=0; i<nOld; i++){
                   6105:     int limit;
                   6106:     
                   6107:     /* Before doing anything else, take a copy of the i'th original sibling
                   6108:     ** The rest of this function will use data from the copies rather
                   6109:     ** that the original pages since the original pages will be in the
                   6110:     ** process of being overwritten.  */
                   6111:     MemPage *pOld = apCopy[i] = (MemPage*)&aSpace1[pBt->pageSize + k*i];
                   6112:     memcpy(pOld, apOld[i], sizeof(MemPage));
                   6113:     pOld->aData = (void*)&pOld[1];
                   6114:     memcpy(pOld->aData, apOld[i]->aData, pBt->pageSize);
                   6115: 
                   6116:     limit = pOld->nCell+pOld->nOverflow;
                   6117:     if( pOld->nOverflow>0 ){
                   6118:       for(j=0; j<limit; j++){
                   6119:         assert( nCell<nMaxCells );
                   6120:         apCell[nCell] = findOverflowCell(pOld, j);
                   6121:         szCell[nCell] = cellSizePtr(pOld, apCell[nCell]);
                   6122:         nCell++;
                   6123:       }
                   6124:     }else{
                   6125:       u8 *aData = pOld->aData;
                   6126:       u16 maskPage = pOld->maskPage;
                   6127:       u16 cellOffset = pOld->cellOffset;
                   6128:       for(j=0; j<limit; j++){
                   6129:         assert( nCell<nMaxCells );
                   6130:         apCell[nCell] = findCellv2(aData, maskPage, cellOffset, j);
                   6131:         szCell[nCell] = cellSizePtr(pOld, apCell[nCell]);
                   6132:         nCell++;
                   6133:       }
                   6134:     }       
                   6135:     if( i<nOld-1 && !leafData){
                   6136:       u16 sz = (u16)szNew[i];
                   6137:       u8 *pTemp;
                   6138:       assert( nCell<nMaxCells );
                   6139:       szCell[nCell] = sz;
                   6140:       pTemp = &aSpace1[iSpace1];
                   6141:       iSpace1 += sz;
                   6142:       assert( sz<=pBt->maxLocal+23 );
                   6143:       assert( iSpace1 <= (int)pBt->pageSize );
                   6144:       memcpy(pTemp, apDiv[i], sz);
                   6145:       apCell[nCell] = pTemp+leafCorrection;
                   6146:       assert( leafCorrection==0 || leafCorrection==4 );
                   6147:       szCell[nCell] = szCell[nCell] - leafCorrection;
                   6148:       if( !pOld->leaf ){
                   6149:         assert( leafCorrection==0 );
                   6150:         assert( pOld->hdrOffset==0 );
                   6151:         /* The right pointer of the child page pOld becomes the left
                   6152:         ** pointer of the divider cell */
                   6153:         memcpy(apCell[nCell], &pOld->aData[8], 4);
                   6154:       }else{
                   6155:         assert( leafCorrection==4 );
                   6156:         if( szCell[nCell]<4 ){
                   6157:           /* Do not allow any cells smaller than 4 bytes. */
                   6158:           szCell[nCell] = 4;
                   6159:         }
                   6160:       }
                   6161:       nCell++;
                   6162:     }
                   6163:   }
                   6164: 
                   6165:   /*
                   6166:   ** Figure out the number of pages needed to hold all nCell cells.
                   6167:   ** Store this number in "k".  Also compute szNew[] which is the total
                   6168:   ** size of all cells on the i-th page and cntNew[] which is the index
                   6169:   ** in apCell[] of the cell that divides page i from page i+1.  
                   6170:   ** cntNew[k] should equal nCell.
                   6171:   **
                   6172:   ** Values computed by this block:
                   6173:   **
                   6174:   **           k: The total number of sibling pages
                   6175:   **    szNew[i]: Spaced used on the i-th sibling page.
                   6176:   **   cntNew[i]: Index in apCell[] and szCell[] for the first cell to
                   6177:   **              the right of the i-th sibling page.
                   6178:   ** usableSpace: Number of bytes of space available on each sibling.
                   6179:   ** 
                   6180:   */
                   6181:   usableSpace = pBt->usableSize - 12 + leafCorrection;
                   6182:   for(subtotal=k=i=0; i<nCell; i++){
                   6183:     assert( i<nMaxCells );
                   6184:     subtotal += szCell[i] + 2;
                   6185:     if( subtotal > usableSpace ){
                   6186:       szNew[k] = subtotal - szCell[i];
                   6187:       cntNew[k] = i;
                   6188:       if( leafData ){ i--; }
                   6189:       subtotal = 0;
                   6190:       k++;
                   6191:       if( k>NB+1 ){ rc = SQLITE_CORRUPT_BKPT; goto balance_cleanup; }
                   6192:     }
                   6193:   }
                   6194:   szNew[k] = subtotal;
                   6195:   cntNew[k] = nCell;
                   6196:   k++;
                   6197: 
                   6198:   /*
                   6199:   ** The packing computed by the previous block is biased toward the siblings
                   6200:   ** on the left side.  The left siblings are always nearly full, while the
                   6201:   ** right-most sibling might be nearly empty.  This block of code attempts
                   6202:   ** to adjust the packing of siblings to get a better balance.
                   6203:   **
                   6204:   ** This adjustment is more than an optimization.  The packing above might
                   6205:   ** be so out of balance as to be illegal.  For example, the right-most
                   6206:   ** sibling might be completely empty.  This adjustment is not optional.
                   6207:   */
                   6208:   for(i=k-1; i>0; i--){
                   6209:     int szRight = szNew[i];  /* Size of sibling on the right */
                   6210:     int szLeft = szNew[i-1]; /* Size of sibling on the left */
                   6211:     int r;              /* Index of right-most cell in left sibling */
                   6212:     int d;              /* Index of first cell to the left of right sibling */
                   6213: 
                   6214:     r = cntNew[i-1] - 1;
                   6215:     d = r + 1 - leafData;
                   6216:     assert( d<nMaxCells );
                   6217:     assert( r<nMaxCells );
                   6218:     while( szRight==0 || szRight+szCell[d]+2<=szLeft-(szCell[r]+2) ){
                   6219:       szRight += szCell[d] + 2;
                   6220:       szLeft -= szCell[r] + 2;
                   6221:       cntNew[i-1]--;
                   6222:       r = cntNew[i-1] - 1;
                   6223:       d = r + 1 - leafData;
                   6224:     }
                   6225:     szNew[i] = szRight;
                   6226:     szNew[i-1] = szLeft;
                   6227:   }
                   6228: 
                   6229:   /* Either we found one or more cells (cntnew[0])>0) or pPage is
                   6230:   ** a virtual root page.  A virtual root page is when the real root
                   6231:   ** page is page 1 and we are the only child of that page.
                   6232:   **
                   6233:   ** UPDATE:  The assert() below is not necessarily true if the database
                   6234:   ** file is corrupt.  The corruption will be detected and reported later
                   6235:   ** in this procedure so there is no need to act upon it now.
                   6236:   */
                   6237: #if 0
                   6238:   assert( cntNew[0]>0 || (pParent->pgno==1 && pParent->nCell==0) );
                   6239: #endif
                   6240: 
                   6241:   TRACE(("BALANCE: old: %d %d %d  ",
                   6242:     apOld[0]->pgno, 
                   6243:     nOld>=2 ? apOld[1]->pgno : 0,
                   6244:     nOld>=3 ? apOld[2]->pgno : 0
                   6245:   ));
                   6246: 
                   6247:   /*
                   6248:   ** Allocate k new pages.  Reuse old pages where possible.
                   6249:   */
                   6250:   if( apOld[0]->pgno<=1 ){
                   6251:     rc = SQLITE_CORRUPT_BKPT;
                   6252:     goto balance_cleanup;
                   6253:   }
                   6254:   pageFlags = apOld[0]->aData[0];
                   6255:   for(i=0; i<k; i++){
                   6256:     MemPage *pNew;
                   6257:     if( i<nOld ){
                   6258:       pNew = apNew[i] = apOld[i];
                   6259:       apOld[i] = 0;
                   6260:       rc = sqlite3PagerWrite(pNew->pDbPage);
                   6261:       nNew++;
                   6262:       if( rc ) goto balance_cleanup;
                   6263:     }else{
                   6264:       assert( i>0 );
                   6265:       rc = allocateBtreePage(pBt, &pNew, &pgno, pgno, 0);
                   6266:       if( rc ) goto balance_cleanup;
                   6267:       apNew[i] = pNew;
                   6268:       nNew++;
                   6269: 
                   6270:       /* Set the pointer-map entry for the new sibling page. */
                   6271:       if( ISAUTOVACUUM ){
                   6272:         ptrmapPut(pBt, pNew->pgno, PTRMAP_BTREE, pParent->pgno, &rc);
                   6273:         if( rc!=SQLITE_OK ){
                   6274:           goto balance_cleanup;
                   6275:         }
                   6276:       }
                   6277:     }
                   6278:   }
                   6279: 
                   6280:   /* Free any old pages that were not reused as new pages.
                   6281:   */
                   6282:   while( i<nOld ){
                   6283:     freePage(apOld[i], &rc);
                   6284:     if( rc ) goto balance_cleanup;
                   6285:     releasePage(apOld[i]);
                   6286:     apOld[i] = 0;
                   6287:     i++;
                   6288:   }
                   6289: 
                   6290:   /*
                   6291:   ** Put the new pages in accending order.  This helps to
                   6292:   ** keep entries in the disk file in order so that a scan
                   6293:   ** of the table is a linear scan through the file.  That
                   6294:   ** in turn helps the operating system to deliver pages
                   6295:   ** from the disk more rapidly.
                   6296:   **
                   6297:   ** An O(n^2) insertion sort algorithm is used, but since
                   6298:   ** n is never more than NB (a small constant), that should
                   6299:   ** not be a problem.
                   6300:   **
                   6301:   ** When NB==3, this one optimization makes the database
                   6302:   ** about 25% faster for large insertions and deletions.
                   6303:   */
                   6304:   for(i=0; i<k-1; i++){
                   6305:     int minV = apNew[i]->pgno;
                   6306:     int minI = i;
                   6307:     for(j=i+1; j<k; j++){
                   6308:       if( apNew[j]->pgno<(unsigned)minV ){
                   6309:         minI = j;
                   6310:         minV = apNew[j]->pgno;
                   6311:       }
                   6312:     }
                   6313:     if( minI>i ){
                   6314:       MemPage *pT;
                   6315:       pT = apNew[i];
                   6316:       apNew[i] = apNew[minI];
                   6317:       apNew[minI] = pT;
                   6318:     }
                   6319:   }
                   6320:   TRACE(("new: %d(%d) %d(%d) %d(%d) %d(%d) %d(%d)\n",
                   6321:     apNew[0]->pgno, szNew[0],
                   6322:     nNew>=2 ? apNew[1]->pgno : 0, nNew>=2 ? szNew[1] : 0,
                   6323:     nNew>=3 ? apNew[2]->pgno : 0, nNew>=3 ? szNew[2] : 0,
                   6324:     nNew>=4 ? apNew[3]->pgno : 0, nNew>=4 ? szNew[3] : 0,
                   6325:     nNew>=5 ? apNew[4]->pgno : 0, nNew>=5 ? szNew[4] : 0));
                   6326: 
                   6327:   assert( sqlite3PagerIswriteable(pParent->pDbPage) );
                   6328:   put4byte(pRight, apNew[nNew-1]->pgno);
                   6329: 
                   6330:   /*
                   6331:   ** Evenly distribute the data in apCell[] across the new pages.
                   6332:   ** Insert divider cells into pParent as necessary.
                   6333:   */
                   6334:   j = 0;
                   6335:   for(i=0; i<nNew; i++){
                   6336:     /* Assemble the new sibling page. */
                   6337:     MemPage *pNew = apNew[i];
                   6338:     assert( j<nMaxCells );
                   6339:     zeroPage(pNew, pageFlags);
                   6340:     assemblePage(pNew, cntNew[i]-j, &apCell[j], &szCell[j]);
                   6341:     assert( pNew->nCell>0 || (nNew==1 && cntNew[0]==0) );
                   6342:     assert( pNew->nOverflow==0 );
                   6343: 
                   6344:     j = cntNew[i];
                   6345: 
                   6346:     /* If the sibling page assembled above was not the right-most sibling,
                   6347:     ** insert a divider cell into the parent page.
                   6348:     */
                   6349:     assert( i<nNew-1 || j==nCell );
                   6350:     if( j<nCell ){
                   6351:       u8 *pCell;
                   6352:       u8 *pTemp;
                   6353:       int sz;
                   6354: 
                   6355:       assert( j<nMaxCells );
                   6356:       pCell = apCell[j];
                   6357:       sz = szCell[j] + leafCorrection;
                   6358:       pTemp = &aOvflSpace[iOvflSpace];
                   6359:       if( !pNew->leaf ){
                   6360:         memcpy(&pNew->aData[8], pCell, 4);
                   6361:       }else if( leafData ){
                   6362:         /* If the tree is a leaf-data tree, and the siblings are leaves, 
                   6363:         ** then there is no divider cell in apCell[]. Instead, the divider 
                   6364:         ** cell consists of the integer key for the right-most cell of 
                   6365:         ** the sibling-page assembled above only.
                   6366:         */
                   6367:         CellInfo info;
                   6368:         j--;
                   6369:         btreeParseCellPtr(pNew, apCell[j], &info);
                   6370:         pCell = pTemp;
                   6371:         sz = 4 + putVarint(&pCell[4], info.nKey);
                   6372:         pTemp = 0;
                   6373:       }else{
                   6374:         pCell -= 4;
                   6375:         /* Obscure case for non-leaf-data trees: If the cell at pCell was
                   6376:         ** previously stored on a leaf node, and its reported size was 4
                   6377:         ** bytes, then it may actually be smaller than this 
                   6378:         ** (see btreeParseCellPtr(), 4 bytes is the minimum size of
                   6379:         ** any cell). But it is important to pass the correct size to 
                   6380:         ** insertCell(), so reparse the cell now.
                   6381:         **
                   6382:         ** Note that this can never happen in an SQLite data file, as all
                   6383:         ** cells are at least 4 bytes. It only happens in b-trees used
                   6384:         ** to evaluate "IN (SELECT ...)" and similar clauses.
                   6385:         */
                   6386:         if( szCell[j]==4 ){
                   6387:           assert(leafCorrection==4);
                   6388:           sz = cellSizePtr(pParent, pCell);
                   6389:         }
                   6390:       }
                   6391:       iOvflSpace += sz;
                   6392:       assert( sz<=pBt->maxLocal+23 );
                   6393:       assert( iOvflSpace <= (int)pBt->pageSize );
                   6394:       insertCell(pParent, nxDiv, pCell, sz, pTemp, pNew->pgno, &rc);
                   6395:       if( rc!=SQLITE_OK ) goto balance_cleanup;
                   6396:       assert( sqlite3PagerIswriteable(pParent->pDbPage) );
                   6397: 
                   6398:       j++;
                   6399:       nxDiv++;
                   6400:     }
                   6401:   }
                   6402:   assert( j==nCell );
                   6403:   assert( nOld>0 );
                   6404:   assert( nNew>0 );
                   6405:   if( (pageFlags & PTF_LEAF)==0 ){
                   6406:     u8 *zChild = &apCopy[nOld-1]->aData[8];
                   6407:     memcpy(&apNew[nNew-1]->aData[8], zChild, 4);
                   6408:   }
                   6409: 
                   6410:   if( isRoot && pParent->nCell==0 && pParent->hdrOffset<=apNew[0]->nFree ){
                   6411:     /* The root page of the b-tree now contains no cells. The only sibling
                   6412:     ** page is the right-child of the parent. Copy the contents of the
                   6413:     ** child page into the parent, decreasing the overall height of the
                   6414:     ** b-tree structure by one. This is described as the "balance-shallower"
                   6415:     ** sub-algorithm in some documentation.
                   6416:     **
                   6417:     ** If this is an auto-vacuum database, the call to copyNodeContent() 
                   6418:     ** sets all pointer-map entries corresponding to database image pages 
                   6419:     ** for which the pointer is stored within the content being copied.
                   6420:     **
                   6421:     ** The second assert below verifies that the child page is defragmented
                   6422:     ** (it must be, as it was just reconstructed using assemblePage()). This
                   6423:     ** is important if the parent page happens to be page 1 of the database
                   6424:     ** image.  */
                   6425:     assert( nNew==1 );
                   6426:     assert( apNew[0]->nFree == 
                   6427:         (get2byte(&apNew[0]->aData[5])-apNew[0]->cellOffset-apNew[0]->nCell*2) 
                   6428:     );
                   6429:     copyNodeContent(apNew[0], pParent, &rc);
                   6430:     freePage(apNew[0], &rc);
                   6431:   }else if( ISAUTOVACUUM ){
                   6432:     /* Fix the pointer-map entries for all the cells that were shifted around. 
                   6433:     ** There are several different types of pointer-map entries that need to
                   6434:     ** be dealt with by this routine. Some of these have been set already, but
                   6435:     ** many have not. The following is a summary:
                   6436:     **
                   6437:     **   1) The entries associated with new sibling pages that were not
                   6438:     **      siblings when this function was called. These have already
                   6439:     **      been set. We don't need to worry about old siblings that were
                   6440:     **      moved to the free-list - the freePage() code has taken care
                   6441:     **      of those.
                   6442:     **
                   6443:     **   2) The pointer-map entries associated with the first overflow
                   6444:     **      page in any overflow chains used by new divider cells. These 
                   6445:     **      have also already been taken care of by the insertCell() code.
                   6446:     **
                   6447:     **   3) If the sibling pages are not leaves, then the child pages of
                   6448:     **      cells stored on the sibling pages may need to be updated.
                   6449:     **
                   6450:     **   4) If the sibling pages are not internal intkey nodes, then any
                   6451:     **      overflow pages used by these cells may need to be updated
                   6452:     **      (internal intkey nodes never contain pointers to overflow pages).
                   6453:     **
                   6454:     **   5) If the sibling pages are not leaves, then the pointer-map
                   6455:     **      entries for the right-child pages of each sibling may need
                   6456:     **      to be updated.
                   6457:     **
                   6458:     ** Cases 1 and 2 are dealt with above by other code. The next
                   6459:     ** block deals with cases 3 and 4 and the one after that, case 5. Since
                   6460:     ** setting a pointer map entry is a relatively expensive operation, this
                   6461:     ** code only sets pointer map entries for child or overflow pages that have
                   6462:     ** actually moved between pages.  */
                   6463:     MemPage *pNew = apNew[0];
                   6464:     MemPage *pOld = apCopy[0];
                   6465:     int nOverflow = pOld->nOverflow;
                   6466:     int iNextOld = pOld->nCell + nOverflow;
                   6467:     int iOverflow = (nOverflow ? pOld->aOvfl[0].idx : -1);
                   6468:     j = 0;                             /* Current 'old' sibling page */
                   6469:     k = 0;                             /* Current 'new' sibling page */
                   6470:     for(i=0; i<nCell; i++){
                   6471:       int isDivider = 0;
                   6472:       while( i==iNextOld ){
                   6473:         /* Cell i is the cell immediately following the last cell on old
                   6474:         ** sibling page j. If the siblings are not leaf pages of an
                   6475:         ** intkey b-tree, then cell i was a divider cell. */
                   6476:         assert( j+1 < ArraySize(apCopy) );
                   6477:         pOld = apCopy[++j];
                   6478:         iNextOld = i + !leafData + pOld->nCell + pOld->nOverflow;
                   6479:         if( pOld->nOverflow ){
                   6480:           nOverflow = pOld->nOverflow;
                   6481:           iOverflow = i + !leafData + pOld->aOvfl[0].idx;
                   6482:         }
                   6483:         isDivider = !leafData;  
                   6484:       }
                   6485: 
                   6486:       assert(nOverflow>0 || iOverflow<i );
                   6487:       assert(nOverflow<2 || pOld->aOvfl[0].idx==pOld->aOvfl[1].idx-1);
                   6488:       assert(nOverflow<3 || pOld->aOvfl[1].idx==pOld->aOvfl[2].idx-1);
                   6489:       if( i==iOverflow ){
                   6490:         isDivider = 1;
                   6491:         if( (--nOverflow)>0 ){
                   6492:           iOverflow++;
                   6493:         }
                   6494:       }
                   6495: 
                   6496:       if( i==cntNew[k] ){
                   6497:         /* Cell i is the cell immediately following the last cell on new
                   6498:         ** sibling page k. If the siblings are not leaf pages of an
                   6499:         ** intkey b-tree, then cell i is a divider cell.  */
                   6500:         pNew = apNew[++k];
                   6501:         if( !leafData ) continue;
                   6502:       }
                   6503:       assert( j<nOld );
                   6504:       assert( k<nNew );
                   6505: 
                   6506:       /* If the cell was originally divider cell (and is not now) or
                   6507:       ** an overflow cell, or if the cell was located on a different sibling
                   6508:       ** page before the balancing, then the pointer map entries associated
                   6509:       ** with any child or overflow pages need to be updated.  */
                   6510:       if( isDivider || pOld->pgno!=pNew->pgno ){
                   6511:         if( !leafCorrection ){
                   6512:           ptrmapPut(pBt, get4byte(apCell[i]), PTRMAP_BTREE, pNew->pgno, &rc);
                   6513:         }
                   6514:         if( szCell[i]>pNew->minLocal ){
                   6515:           ptrmapPutOvflPtr(pNew, apCell[i], &rc);
                   6516:         }
                   6517:       }
                   6518:     }
                   6519: 
                   6520:     if( !leafCorrection ){
                   6521:       for(i=0; i<nNew; i++){
                   6522:         u32 key = get4byte(&apNew[i]->aData[8]);
                   6523:         ptrmapPut(pBt, key, PTRMAP_BTREE, apNew[i]->pgno, &rc);
                   6524:       }
                   6525:     }
                   6526: 
                   6527: #if 0
                   6528:     /* The ptrmapCheckPages() contains assert() statements that verify that
                   6529:     ** all pointer map pages are set correctly. This is helpful while 
                   6530:     ** debugging. This is usually disabled because a corrupt database may
                   6531:     ** cause an assert() statement to fail.  */
                   6532:     ptrmapCheckPages(apNew, nNew);
                   6533:     ptrmapCheckPages(&pParent, 1);
                   6534: #endif
                   6535:   }
                   6536: 
                   6537:   assert( pParent->isInit );
                   6538:   TRACE(("BALANCE: finished: old=%d new=%d cells=%d\n",
                   6539:           nOld, nNew, nCell));
                   6540: 
                   6541:   /*
                   6542:   ** Cleanup before returning.
                   6543:   */
                   6544: balance_cleanup:
                   6545:   sqlite3ScratchFree(apCell);
                   6546:   for(i=0; i<nOld; i++){
                   6547:     releasePage(apOld[i]);
                   6548:   }
                   6549:   for(i=0; i<nNew; i++){
                   6550:     releasePage(apNew[i]);
                   6551:   }
                   6552: 
                   6553:   return rc;
                   6554: }
                   6555: 
                   6556: 
                   6557: /*
                   6558: ** This function is called when the root page of a b-tree structure is
                   6559: ** overfull (has one or more overflow pages).
                   6560: **
                   6561: ** A new child page is allocated and the contents of the current root
                   6562: ** page, including overflow cells, are copied into the child. The root
                   6563: ** page is then overwritten to make it an empty page with the right-child 
                   6564: ** pointer pointing to the new page.
                   6565: **
                   6566: ** Before returning, all pointer-map entries corresponding to pages 
                   6567: ** that the new child-page now contains pointers to are updated. The
                   6568: ** entry corresponding to the new right-child pointer of the root
                   6569: ** page is also updated.
                   6570: **
                   6571: ** If successful, *ppChild is set to contain a reference to the child 
                   6572: ** page and SQLITE_OK is returned. In this case the caller is required
                   6573: ** to call releasePage() on *ppChild exactly once. If an error occurs,
                   6574: ** an error code is returned and *ppChild is set to 0.
                   6575: */
                   6576: static int balance_deeper(MemPage *pRoot, MemPage **ppChild){
                   6577:   int rc;                        /* Return value from subprocedures */
                   6578:   MemPage *pChild = 0;           /* Pointer to a new child page */
                   6579:   Pgno pgnoChild = 0;            /* Page number of the new child page */
                   6580:   BtShared *pBt = pRoot->pBt;    /* The BTree */
                   6581: 
                   6582:   assert( pRoot->nOverflow>0 );
                   6583:   assert( sqlite3_mutex_held(pBt->mutex) );
                   6584: 
                   6585:   /* Make pRoot, the root page of the b-tree, writable. Allocate a new 
                   6586:   ** page that will become the new right-child of pPage. Copy the contents
                   6587:   ** of the node stored on pRoot into the new child page.
                   6588:   */
                   6589:   rc = sqlite3PagerWrite(pRoot->pDbPage);
                   6590:   if( rc==SQLITE_OK ){
                   6591:     rc = allocateBtreePage(pBt,&pChild,&pgnoChild,pRoot->pgno,0);
                   6592:     copyNodeContent(pRoot, pChild, &rc);
                   6593:     if( ISAUTOVACUUM ){
                   6594:       ptrmapPut(pBt, pgnoChild, PTRMAP_BTREE, pRoot->pgno, &rc);
                   6595:     }
                   6596:   }
                   6597:   if( rc ){
                   6598:     *ppChild = 0;
                   6599:     releasePage(pChild);
                   6600:     return rc;
                   6601:   }
                   6602:   assert( sqlite3PagerIswriteable(pChild->pDbPage) );
                   6603:   assert( sqlite3PagerIswriteable(pRoot->pDbPage) );
                   6604:   assert( pChild->nCell==pRoot->nCell );
                   6605: 
                   6606:   TRACE(("BALANCE: copy root %d into %d\n", pRoot->pgno, pChild->pgno));
                   6607: 
                   6608:   /* Copy the overflow cells from pRoot to pChild */
                   6609:   memcpy(pChild->aOvfl, pRoot->aOvfl, pRoot->nOverflow*sizeof(pRoot->aOvfl[0]));
                   6610:   pChild->nOverflow = pRoot->nOverflow;
                   6611: 
                   6612:   /* Zero the contents of pRoot. Then install pChild as the right-child. */
                   6613:   zeroPage(pRoot, pChild->aData[0] & ~PTF_LEAF);
                   6614:   put4byte(&pRoot->aData[pRoot->hdrOffset+8], pgnoChild);
                   6615: 
                   6616:   *ppChild = pChild;
                   6617:   return SQLITE_OK;
                   6618: }
                   6619: 
                   6620: /*
                   6621: ** The page that pCur currently points to has just been modified in
                   6622: ** some way. This function figures out if this modification means the
                   6623: ** tree needs to be balanced, and if so calls the appropriate balancing 
                   6624: ** routine. Balancing routines are:
                   6625: **
                   6626: **   balance_quick()
                   6627: **   balance_deeper()
                   6628: **   balance_nonroot()
                   6629: */
                   6630: static int balance(BtCursor *pCur){
                   6631:   int rc = SQLITE_OK;
                   6632:   const int nMin = pCur->pBt->usableSize * 2 / 3;
                   6633:   u8 aBalanceQuickSpace[13];
                   6634:   u8 *pFree = 0;
                   6635: 
                   6636:   TESTONLY( int balance_quick_called = 0 );
                   6637:   TESTONLY( int balance_deeper_called = 0 );
                   6638: 
                   6639:   do {
                   6640:     int iPage = pCur->iPage;
                   6641:     MemPage *pPage = pCur->apPage[iPage];
                   6642: 
                   6643:     if( iPage==0 ){
                   6644:       if( pPage->nOverflow ){
                   6645:         /* The root page of the b-tree is overfull. In this case call the
                   6646:         ** balance_deeper() function to create a new child for the root-page
                   6647:         ** and copy the current contents of the root-page to it. The
                   6648:         ** next iteration of the do-loop will balance the child page.
                   6649:         */ 
                   6650:         assert( (balance_deeper_called++)==0 );
                   6651:         rc = balance_deeper(pPage, &pCur->apPage[1]);
                   6652:         if( rc==SQLITE_OK ){
                   6653:           pCur->iPage = 1;
                   6654:           pCur->aiIdx[0] = 0;
                   6655:           pCur->aiIdx[1] = 0;
                   6656:           assert( pCur->apPage[1]->nOverflow );
                   6657:         }
                   6658:       }else{
                   6659:         break;
                   6660:       }
                   6661:     }else if( pPage->nOverflow==0 && pPage->nFree<=nMin ){
                   6662:       break;
                   6663:     }else{
                   6664:       MemPage * const pParent = pCur->apPage[iPage-1];
                   6665:       int const iIdx = pCur->aiIdx[iPage-1];
                   6666: 
                   6667:       rc = sqlite3PagerWrite(pParent->pDbPage);
                   6668:       if( rc==SQLITE_OK ){
                   6669: #ifndef SQLITE_OMIT_QUICKBALANCE
                   6670:         if( pPage->hasData
                   6671:          && pPage->nOverflow==1
                   6672:          && pPage->aOvfl[0].idx==pPage->nCell
                   6673:          && pParent->pgno!=1
                   6674:          && pParent->nCell==iIdx
                   6675:         ){
                   6676:           /* Call balance_quick() to create a new sibling of pPage on which
                   6677:           ** to store the overflow cell. balance_quick() inserts a new cell
                   6678:           ** into pParent, which may cause pParent overflow. If this
                   6679:           ** happens, the next interation of the do-loop will balance pParent 
                   6680:           ** use either balance_nonroot() or balance_deeper(). Until this
                   6681:           ** happens, the overflow cell is stored in the aBalanceQuickSpace[]
                   6682:           ** buffer. 
                   6683:           **
                   6684:           ** The purpose of the following assert() is to check that only a
                   6685:           ** single call to balance_quick() is made for each call to this
                   6686:           ** function. If this were not verified, a subtle bug involving reuse
                   6687:           ** of the aBalanceQuickSpace[] might sneak in.
                   6688:           */
                   6689:           assert( (balance_quick_called++)==0 );
                   6690:           rc = balance_quick(pParent, pPage, aBalanceQuickSpace);
                   6691:         }else
                   6692: #endif
                   6693:         {
                   6694:           /* In this case, call balance_nonroot() to redistribute cells
                   6695:           ** between pPage and up to 2 of its sibling pages. This involves
                   6696:           ** modifying the contents of pParent, which may cause pParent to
                   6697:           ** become overfull or underfull. The next iteration of the do-loop
                   6698:           ** will balance the parent page to correct this.
                   6699:           ** 
                   6700:           ** If the parent page becomes overfull, the overflow cell or cells
                   6701:           ** are stored in the pSpace buffer allocated immediately below. 
                   6702:           ** A subsequent iteration of the do-loop will deal with this by
                   6703:           ** calling balance_nonroot() (balance_deeper() may be called first,
                   6704:           ** but it doesn't deal with overflow cells - just moves them to a
                   6705:           ** different page). Once this subsequent call to balance_nonroot() 
                   6706:           ** has completed, it is safe to release the pSpace buffer used by
                   6707:           ** the previous call, as the overflow cell data will have been 
                   6708:           ** copied either into the body of a database page or into the new
                   6709:           ** pSpace buffer passed to the latter call to balance_nonroot().
                   6710:           */
                   6711:           u8 *pSpace = sqlite3PageMalloc(pCur->pBt->pageSize);
                   6712:           rc = balance_nonroot(pParent, iIdx, pSpace, iPage==1);
                   6713:           if( pFree ){
                   6714:             /* If pFree is not NULL, it points to the pSpace buffer used 
                   6715:             ** by a previous call to balance_nonroot(). Its contents are
                   6716:             ** now stored either on real database pages or within the 
                   6717:             ** new pSpace buffer, so it may be safely freed here. */
                   6718:             sqlite3PageFree(pFree);
                   6719:           }
                   6720: 
                   6721:           /* The pSpace buffer will be freed after the next call to
                   6722:           ** balance_nonroot(), or just before this function returns, whichever
                   6723:           ** comes first. */
                   6724:           pFree = pSpace;
                   6725:         }
                   6726:       }
                   6727: 
                   6728:       pPage->nOverflow = 0;
                   6729: 
                   6730:       /* The next iteration of the do-loop balances the parent page. */
                   6731:       releasePage(pPage);
                   6732:       pCur->iPage--;
                   6733:     }
                   6734:   }while( rc==SQLITE_OK );
                   6735: 
                   6736:   if( pFree ){
                   6737:     sqlite3PageFree(pFree);
                   6738:   }
                   6739:   return rc;
                   6740: }
                   6741: 
                   6742: 
                   6743: /*
                   6744: ** Insert a new record into the BTree.  The key is given by (pKey,nKey)
                   6745: ** and the data is given by (pData,nData).  The cursor is used only to
                   6746: ** define what table the record should be inserted into.  The cursor
                   6747: ** is left pointing at a random location.
                   6748: **
                   6749: ** For an INTKEY table, only the nKey value of the key is used.  pKey is
                   6750: ** ignored.  For a ZERODATA table, the pData and nData are both ignored.
                   6751: **
                   6752: ** If the seekResult parameter is non-zero, then a successful call to
                   6753: ** MovetoUnpacked() to seek cursor pCur to (pKey, nKey) has already
                   6754: ** been performed. seekResult is the search result returned (a negative
                   6755: ** number if pCur points at an entry that is smaller than (pKey, nKey), or
                   6756: ** a positive value if pCur points at an etry that is larger than 
                   6757: ** (pKey, nKey)). 
                   6758: **
                   6759: ** If the seekResult parameter is non-zero, then the caller guarantees that
                   6760: ** cursor pCur is pointing at the existing copy of a row that is to be
                   6761: ** overwritten.  If the seekResult parameter is 0, then cursor pCur may
                   6762: ** point to any entry or to no entry at all and so this function has to seek
                   6763: ** the cursor before the new key can be inserted.
                   6764: */
                   6765: int sqlite3BtreeInsert(
                   6766:   BtCursor *pCur,                /* Insert data into the table of this cursor */
                   6767:   const void *pKey, i64 nKey,    /* The key of the new record */
                   6768:   const void *pData, int nData,  /* The data of the new record */
                   6769:   int nZero,                     /* Number of extra 0 bytes to append to data */
                   6770:   int appendBias,                /* True if this is likely an append */
                   6771:   int seekResult                 /* Result of prior MovetoUnpacked() call */
                   6772: ){
                   6773:   int rc;
                   6774:   int loc = seekResult;          /* -1: before desired location  +1: after */
                   6775:   int szNew = 0;
                   6776:   int idx;
                   6777:   MemPage *pPage;
                   6778:   Btree *p = pCur->pBtree;
                   6779:   BtShared *pBt = p->pBt;
                   6780:   unsigned char *oldCell;
                   6781:   unsigned char *newCell = 0;
                   6782: 
                   6783:   if( pCur->eState==CURSOR_FAULT ){
                   6784:     assert( pCur->skipNext!=SQLITE_OK );
                   6785:     return pCur->skipNext;
                   6786:   }
                   6787: 
                   6788:   assert( cursorHoldsMutex(pCur) );
                   6789:   assert( pCur->wrFlag && pBt->inTransaction==TRANS_WRITE
                   6790:               && (pBt->btsFlags & BTS_READ_ONLY)==0 );
                   6791:   assert( hasSharedCacheTableLock(p, pCur->pgnoRoot, pCur->pKeyInfo!=0, 2) );
                   6792: 
                   6793:   /* Assert that the caller has been consistent. If this cursor was opened
                   6794:   ** expecting an index b-tree, then the caller should be inserting blob
                   6795:   ** keys with no associated data. If the cursor was opened expecting an
                   6796:   ** intkey table, the caller should be inserting integer keys with a
                   6797:   ** blob of associated data.  */
                   6798:   assert( (pKey==0)==(pCur->pKeyInfo==0) );
                   6799: 
                   6800:   /* If this is an insert into a table b-tree, invalidate any incrblob 
                   6801:   ** cursors open on the row being replaced (assuming this is a replace
                   6802:   ** operation - if it is not, the following is a no-op).  */
                   6803:   if( pCur->pKeyInfo==0 ){
                   6804:     invalidateIncrblobCursors(p, nKey, 0);
                   6805:   }
                   6806: 
                   6807:   /* Save the positions of any other cursors open on this table.
                   6808:   **
                   6809:   ** In some cases, the call to btreeMoveto() below is a no-op. For
                   6810:   ** example, when inserting data into a table with auto-generated integer
                   6811:   ** keys, the VDBE layer invokes sqlite3BtreeLast() to figure out the 
                   6812:   ** integer key to use. It then calls this function to actually insert the 
                   6813:   ** data into the intkey B-Tree. In this case btreeMoveto() recognizes
                   6814:   ** that the cursor is already where it needs to be and returns without
                   6815:   ** doing any work. To avoid thwarting these optimizations, it is important
                   6816:   ** not to clear the cursor here.
                   6817:   */
                   6818:   rc = saveAllCursors(pBt, pCur->pgnoRoot, pCur);
                   6819:   if( rc ) return rc;
                   6820:   if( !loc ){
                   6821:     rc = btreeMoveto(pCur, pKey, nKey, appendBias, &loc);
                   6822:     if( rc ) return rc;
                   6823:   }
                   6824:   assert( pCur->eState==CURSOR_VALID || (pCur->eState==CURSOR_INVALID && loc) );
                   6825: 
                   6826:   pPage = pCur->apPage[pCur->iPage];
                   6827:   assert( pPage->intKey || nKey>=0 );
                   6828:   assert( pPage->leaf || !pPage->intKey );
                   6829: 
                   6830:   TRACE(("INSERT: table=%d nkey=%lld ndata=%d page=%d %s\n",
                   6831:           pCur->pgnoRoot, nKey, nData, pPage->pgno,
                   6832:           loc==0 ? "overwrite" : "new entry"));
                   6833:   assert( pPage->isInit );
                   6834:   allocateTempSpace(pBt);
                   6835:   newCell = pBt->pTmpSpace;
                   6836:   if( newCell==0 ) return SQLITE_NOMEM;
                   6837:   rc = fillInCell(pPage, newCell, pKey, nKey, pData, nData, nZero, &szNew);
                   6838:   if( rc ) goto end_insert;
                   6839:   assert( szNew==cellSizePtr(pPage, newCell) );
                   6840:   assert( szNew <= MX_CELL_SIZE(pBt) );
                   6841:   idx = pCur->aiIdx[pCur->iPage];
                   6842:   if( loc==0 ){
                   6843:     u16 szOld;
                   6844:     assert( idx<pPage->nCell );
                   6845:     rc = sqlite3PagerWrite(pPage->pDbPage);
                   6846:     if( rc ){
                   6847:       goto end_insert;
                   6848:     }
                   6849:     oldCell = findCell(pPage, idx);
                   6850:     if( !pPage->leaf ){
                   6851:       memcpy(newCell, oldCell, 4);
                   6852:     }
                   6853:     szOld = cellSizePtr(pPage, oldCell);
                   6854:     rc = clearCell(pPage, oldCell);
                   6855:     dropCell(pPage, idx, szOld, &rc);
                   6856:     if( rc ) goto end_insert;
                   6857:   }else if( loc<0 && pPage->nCell>0 ){
                   6858:     assert( pPage->leaf );
                   6859:     idx = ++pCur->aiIdx[pCur->iPage];
                   6860:   }else{
                   6861:     assert( pPage->leaf );
                   6862:   }
                   6863:   insertCell(pPage, idx, newCell, szNew, 0, 0, &rc);
                   6864:   assert( rc!=SQLITE_OK || pPage->nCell>0 || pPage->nOverflow>0 );
                   6865: 
                   6866:   /* If no error has occured and pPage has an overflow cell, call balance() 
                   6867:   ** to redistribute the cells within the tree. Since balance() may move
                   6868:   ** the cursor, zero the BtCursor.info.nSize and BtCursor.validNKey
                   6869:   ** variables.
                   6870:   **
                   6871:   ** Previous versions of SQLite called moveToRoot() to move the cursor
                   6872:   ** back to the root page as balance() used to invalidate the contents
                   6873:   ** of BtCursor.apPage[] and BtCursor.aiIdx[]. Instead of doing that,
                   6874:   ** set the cursor state to "invalid". This makes common insert operations
                   6875:   ** slightly faster.
                   6876:   **
                   6877:   ** There is a subtle but important optimization here too. When inserting
                   6878:   ** multiple records into an intkey b-tree using a single cursor (as can
                   6879:   ** happen while processing an "INSERT INTO ... SELECT" statement), it
                   6880:   ** is advantageous to leave the cursor pointing to the last entry in
                   6881:   ** the b-tree if possible. If the cursor is left pointing to the last
                   6882:   ** entry in the table, and the next row inserted has an integer key
                   6883:   ** larger than the largest existing key, it is possible to insert the
                   6884:   ** row without seeking the cursor. This can be a big performance boost.
                   6885:   */
                   6886:   pCur->info.nSize = 0;
                   6887:   pCur->validNKey = 0;
                   6888:   if( rc==SQLITE_OK && pPage->nOverflow ){
                   6889:     rc = balance(pCur);
                   6890: 
                   6891:     /* Must make sure nOverflow is reset to zero even if the balance()
                   6892:     ** fails. Internal data structure corruption will result otherwise. 
                   6893:     ** Also, set the cursor state to invalid. This stops saveCursorPosition()
                   6894:     ** from trying to save the current position of the cursor.  */
                   6895:     pCur->apPage[pCur->iPage]->nOverflow = 0;
                   6896:     pCur->eState = CURSOR_INVALID;
                   6897:   }
                   6898:   assert( pCur->apPage[pCur->iPage]->nOverflow==0 );
                   6899: 
                   6900: end_insert:
                   6901:   return rc;
                   6902: }
                   6903: 
                   6904: /*
                   6905: ** Delete the entry that the cursor is pointing to.  The cursor
                   6906: ** is left pointing at a arbitrary location.
                   6907: */
                   6908: int sqlite3BtreeDelete(BtCursor *pCur){
                   6909:   Btree *p = pCur->pBtree;
                   6910:   BtShared *pBt = p->pBt;              
                   6911:   int rc;                              /* Return code */
                   6912:   MemPage *pPage;                      /* Page to delete cell from */
                   6913:   unsigned char *pCell;                /* Pointer to cell to delete */
                   6914:   int iCellIdx;                        /* Index of cell to delete */
                   6915:   int iCellDepth;                      /* Depth of node containing pCell */ 
                   6916: 
                   6917:   assert( cursorHoldsMutex(pCur) );
                   6918:   assert( pBt->inTransaction==TRANS_WRITE );
                   6919:   assert( (pBt->btsFlags & BTS_READ_ONLY)==0 );
                   6920:   assert( pCur->wrFlag );
                   6921:   assert( hasSharedCacheTableLock(p, pCur->pgnoRoot, pCur->pKeyInfo!=0, 2) );
                   6922:   assert( !hasReadConflicts(p, pCur->pgnoRoot) );
                   6923: 
                   6924:   if( NEVER(pCur->aiIdx[pCur->iPage]>=pCur->apPage[pCur->iPage]->nCell) 
                   6925:    || NEVER(pCur->eState!=CURSOR_VALID)
                   6926:   ){
                   6927:     return SQLITE_ERROR;  /* Something has gone awry. */
                   6928:   }
                   6929: 
                   6930:   /* If this is a delete operation to remove a row from a table b-tree,
                   6931:   ** invalidate any incrblob cursors open on the row being deleted.  */
                   6932:   if( pCur->pKeyInfo==0 ){
                   6933:     invalidateIncrblobCursors(p, pCur->info.nKey, 0);
                   6934:   }
                   6935: 
                   6936:   iCellDepth = pCur->iPage;
                   6937:   iCellIdx = pCur->aiIdx[iCellDepth];
                   6938:   pPage = pCur->apPage[iCellDepth];
                   6939:   pCell = findCell(pPage, iCellIdx);
                   6940: 
                   6941:   /* If the page containing the entry to delete is not a leaf page, move
                   6942:   ** the cursor to the largest entry in the tree that is smaller than
                   6943:   ** the entry being deleted. This cell will replace the cell being deleted
                   6944:   ** from the internal node. The 'previous' entry is used for this instead
                   6945:   ** of the 'next' entry, as the previous entry is always a part of the
                   6946:   ** sub-tree headed by the child page of the cell being deleted. This makes
                   6947:   ** balancing the tree following the delete operation easier.  */
                   6948:   if( !pPage->leaf ){
                   6949:     int notUsed;
                   6950:     rc = sqlite3BtreePrevious(pCur, &notUsed);
                   6951:     if( rc ) return rc;
                   6952:   }
                   6953: 
                   6954:   /* Save the positions of any other cursors open on this table before
                   6955:   ** making any modifications. Make the page containing the entry to be 
                   6956:   ** deleted writable. Then free any overflow pages associated with the 
                   6957:   ** entry and finally remove the cell itself from within the page.  
                   6958:   */
                   6959:   rc = saveAllCursors(pBt, pCur->pgnoRoot, pCur);
                   6960:   if( rc ) return rc;
                   6961:   rc = sqlite3PagerWrite(pPage->pDbPage);
                   6962:   if( rc ) return rc;
                   6963:   rc = clearCell(pPage, pCell);
                   6964:   dropCell(pPage, iCellIdx, cellSizePtr(pPage, pCell), &rc);
                   6965:   if( rc ) return rc;
                   6966: 
                   6967:   /* If the cell deleted was not located on a leaf page, then the cursor
                   6968:   ** is currently pointing to the largest entry in the sub-tree headed
                   6969:   ** by the child-page of the cell that was just deleted from an internal
                   6970:   ** node. The cell from the leaf node needs to be moved to the internal
                   6971:   ** node to replace the deleted cell.  */
                   6972:   if( !pPage->leaf ){
                   6973:     MemPage *pLeaf = pCur->apPage[pCur->iPage];
                   6974:     int nCell;
                   6975:     Pgno n = pCur->apPage[iCellDepth+1]->pgno;
                   6976:     unsigned char *pTmp;
                   6977: 
                   6978:     pCell = findCell(pLeaf, pLeaf->nCell-1);
                   6979:     nCell = cellSizePtr(pLeaf, pCell);
                   6980:     assert( MX_CELL_SIZE(pBt) >= nCell );
                   6981: 
                   6982:     allocateTempSpace(pBt);
                   6983:     pTmp = pBt->pTmpSpace;
                   6984: 
                   6985:     rc = sqlite3PagerWrite(pLeaf->pDbPage);
                   6986:     insertCell(pPage, iCellIdx, pCell-4, nCell+4, pTmp, n, &rc);
                   6987:     dropCell(pLeaf, pLeaf->nCell-1, nCell, &rc);
                   6988:     if( rc ) return rc;
                   6989:   }
                   6990: 
                   6991:   /* Balance the tree. If the entry deleted was located on a leaf page,
                   6992:   ** then the cursor still points to that page. In this case the first
                   6993:   ** call to balance() repairs the tree, and the if(...) condition is
                   6994:   ** never true.
                   6995:   **
                   6996:   ** Otherwise, if the entry deleted was on an internal node page, then
                   6997:   ** pCur is pointing to the leaf page from which a cell was removed to
                   6998:   ** replace the cell deleted from the internal node. This is slightly
                   6999:   ** tricky as the leaf node may be underfull, and the internal node may
                   7000:   ** be either under or overfull. In this case run the balancing algorithm
                   7001:   ** on the leaf node first. If the balance proceeds far enough up the
                   7002:   ** tree that we can be sure that any problem in the internal node has
                   7003:   ** been corrected, so be it. Otherwise, after balancing the leaf node,
                   7004:   ** walk the cursor up the tree to the internal node and balance it as 
                   7005:   ** well.  */
                   7006:   rc = balance(pCur);
                   7007:   if( rc==SQLITE_OK && pCur->iPage>iCellDepth ){
                   7008:     while( pCur->iPage>iCellDepth ){
                   7009:       releasePage(pCur->apPage[pCur->iPage--]);
                   7010:     }
                   7011:     rc = balance(pCur);
                   7012:   }
                   7013: 
                   7014:   if( rc==SQLITE_OK ){
                   7015:     moveToRoot(pCur);
                   7016:   }
                   7017:   return rc;
                   7018: }
                   7019: 
                   7020: /*
                   7021: ** Create a new BTree table.  Write into *piTable the page
                   7022: ** number for the root page of the new table.
                   7023: **
                   7024: ** The type of type is determined by the flags parameter.  Only the
                   7025: ** following values of flags are currently in use.  Other values for
                   7026: ** flags might not work:
                   7027: **
                   7028: **     BTREE_INTKEY|BTREE_LEAFDATA     Used for SQL tables with rowid keys
                   7029: **     BTREE_ZERODATA                  Used for SQL indices
                   7030: */
                   7031: static int btreeCreateTable(Btree *p, int *piTable, int createTabFlags){
                   7032:   BtShared *pBt = p->pBt;
                   7033:   MemPage *pRoot;
                   7034:   Pgno pgnoRoot;
                   7035:   int rc;
                   7036:   int ptfFlags;          /* Page-type flage for the root page of new table */
                   7037: 
                   7038:   assert( sqlite3BtreeHoldsMutex(p) );
                   7039:   assert( pBt->inTransaction==TRANS_WRITE );
                   7040:   assert( (pBt->btsFlags & BTS_READ_ONLY)==0 );
                   7041: 
                   7042: #ifdef SQLITE_OMIT_AUTOVACUUM
                   7043:   rc = allocateBtreePage(pBt, &pRoot, &pgnoRoot, 1, 0);
                   7044:   if( rc ){
                   7045:     return rc;
                   7046:   }
                   7047: #else
                   7048:   if( pBt->autoVacuum ){
                   7049:     Pgno pgnoMove;      /* Move a page here to make room for the root-page */
                   7050:     MemPage *pPageMove; /* The page to move to. */
                   7051: 
                   7052:     /* Creating a new table may probably require moving an existing database
                   7053:     ** to make room for the new tables root page. In case this page turns
                   7054:     ** out to be an overflow page, delete all overflow page-map caches
                   7055:     ** held by open cursors.
                   7056:     */
                   7057:     invalidateAllOverflowCache(pBt);
                   7058: 
                   7059:     /* Read the value of meta[3] from the database to determine where the
                   7060:     ** root page of the new table should go. meta[3] is the largest root-page
                   7061:     ** created so far, so the new root-page is (meta[3]+1).
                   7062:     */
                   7063:     sqlite3BtreeGetMeta(p, BTREE_LARGEST_ROOT_PAGE, &pgnoRoot);
                   7064:     pgnoRoot++;
                   7065: 
                   7066:     /* The new root-page may not be allocated on a pointer-map page, or the
                   7067:     ** PENDING_BYTE page.
                   7068:     */
                   7069:     while( pgnoRoot==PTRMAP_PAGENO(pBt, pgnoRoot) ||
                   7070:         pgnoRoot==PENDING_BYTE_PAGE(pBt) ){
                   7071:       pgnoRoot++;
                   7072:     }
                   7073:     assert( pgnoRoot>=3 );
                   7074: 
                   7075:     /* Allocate a page. The page that currently resides at pgnoRoot will
                   7076:     ** be moved to the allocated page (unless the allocated page happens
                   7077:     ** to reside at pgnoRoot).
                   7078:     */
                   7079:     rc = allocateBtreePage(pBt, &pPageMove, &pgnoMove, pgnoRoot, 1);
                   7080:     if( rc!=SQLITE_OK ){
                   7081:       return rc;
                   7082:     }
                   7083: 
                   7084:     if( pgnoMove!=pgnoRoot ){
                   7085:       /* pgnoRoot is the page that will be used for the root-page of
                   7086:       ** the new table (assuming an error did not occur). But we were
                   7087:       ** allocated pgnoMove. If required (i.e. if it was not allocated
                   7088:       ** by extending the file), the current page at position pgnoMove
                   7089:       ** is already journaled.
                   7090:       */
                   7091:       u8 eType = 0;
                   7092:       Pgno iPtrPage = 0;
                   7093: 
                   7094:       releasePage(pPageMove);
                   7095: 
                   7096:       /* Move the page currently at pgnoRoot to pgnoMove. */
                   7097:       rc = btreeGetPage(pBt, pgnoRoot, &pRoot, 0);
                   7098:       if( rc!=SQLITE_OK ){
                   7099:         return rc;
                   7100:       }
                   7101:       rc = ptrmapGet(pBt, pgnoRoot, &eType, &iPtrPage);
                   7102:       if( eType==PTRMAP_ROOTPAGE || eType==PTRMAP_FREEPAGE ){
                   7103:         rc = SQLITE_CORRUPT_BKPT;
                   7104:       }
                   7105:       if( rc!=SQLITE_OK ){
                   7106:         releasePage(pRoot);
                   7107:         return rc;
                   7108:       }
                   7109:       assert( eType!=PTRMAP_ROOTPAGE );
                   7110:       assert( eType!=PTRMAP_FREEPAGE );
                   7111:       rc = relocatePage(pBt, pRoot, eType, iPtrPage, pgnoMove, 0);
                   7112:       releasePage(pRoot);
                   7113: 
                   7114:       /* Obtain the page at pgnoRoot */
                   7115:       if( rc!=SQLITE_OK ){
                   7116:         return rc;
                   7117:       }
                   7118:       rc = btreeGetPage(pBt, pgnoRoot, &pRoot, 0);
                   7119:       if( rc!=SQLITE_OK ){
                   7120:         return rc;
                   7121:       }
                   7122:       rc = sqlite3PagerWrite(pRoot->pDbPage);
                   7123:       if( rc!=SQLITE_OK ){
                   7124:         releasePage(pRoot);
                   7125:         return rc;
                   7126:       }
                   7127:     }else{
                   7128:       pRoot = pPageMove;
                   7129:     } 
                   7130: 
                   7131:     /* Update the pointer-map and meta-data with the new root-page number. */
                   7132:     ptrmapPut(pBt, pgnoRoot, PTRMAP_ROOTPAGE, 0, &rc);
                   7133:     if( rc ){
                   7134:       releasePage(pRoot);
                   7135:       return rc;
                   7136:     }
                   7137: 
                   7138:     /* When the new root page was allocated, page 1 was made writable in
                   7139:     ** order either to increase the database filesize, or to decrement the
                   7140:     ** freelist count.  Hence, the sqlite3BtreeUpdateMeta() call cannot fail.
                   7141:     */
                   7142:     assert( sqlite3PagerIswriteable(pBt->pPage1->pDbPage) );
                   7143:     rc = sqlite3BtreeUpdateMeta(p, 4, pgnoRoot);
                   7144:     if( NEVER(rc) ){
                   7145:       releasePage(pRoot);
                   7146:       return rc;
                   7147:     }
                   7148: 
                   7149:   }else{
                   7150:     rc = allocateBtreePage(pBt, &pRoot, &pgnoRoot, 1, 0);
                   7151:     if( rc ) return rc;
                   7152:   }
                   7153: #endif
                   7154:   assert( sqlite3PagerIswriteable(pRoot->pDbPage) );
                   7155:   if( createTabFlags & BTREE_INTKEY ){
                   7156:     ptfFlags = PTF_INTKEY | PTF_LEAFDATA | PTF_LEAF;
                   7157:   }else{
                   7158:     ptfFlags = PTF_ZERODATA | PTF_LEAF;
                   7159:   }
                   7160:   zeroPage(pRoot, ptfFlags);
                   7161:   sqlite3PagerUnref(pRoot->pDbPage);
                   7162:   assert( (pBt->openFlags & BTREE_SINGLE)==0 || pgnoRoot==2 );
                   7163:   *piTable = (int)pgnoRoot;
                   7164:   return SQLITE_OK;
                   7165: }
                   7166: int sqlite3BtreeCreateTable(Btree *p, int *piTable, int flags){
                   7167:   int rc;
                   7168:   sqlite3BtreeEnter(p);
                   7169:   rc = btreeCreateTable(p, piTable, flags);
                   7170:   sqlite3BtreeLeave(p);
                   7171:   return rc;
                   7172: }
                   7173: 
                   7174: /*
                   7175: ** Erase the given database page and all its children.  Return
                   7176: ** the page to the freelist.
                   7177: */
                   7178: static int clearDatabasePage(
                   7179:   BtShared *pBt,           /* The BTree that contains the table */
                   7180:   Pgno pgno,               /* Page number to clear */
                   7181:   int freePageFlag,        /* Deallocate page if true */
                   7182:   int *pnChange            /* Add number of Cells freed to this counter */
                   7183: ){
                   7184:   MemPage *pPage;
                   7185:   int rc;
                   7186:   unsigned char *pCell;
                   7187:   int i;
                   7188: 
                   7189:   assert( sqlite3_mutex_held(pBt->mutex) );
                   7190:   if( pgno>btreePagecount(pBt) ){
                   7191:     return SQLITE_CORRUPT_BKPT;
                   7192:   }
                   7193: 
                   7194:   rc = getAndInitPage(pBt, pgno, &pPage);
                   7195:   if( rc ) return rc;
                   7196:   for(i=0; i<pPage->nCell; i++){
                   7197:     pCell = findCell(pPage, i);
                   7198:     if( !pPage->leaf ){
                   7199:       rc = clearDatabasePage(pBt, get4byte(pCell), 1, pnChange);
                   7200:       if( rc ) goto cleardatabasepage_out;
                   7201:     }
                   7202:     rc = clearCell(pPage, pCell);
                   7203:     if( rc ) goto cleardatabasepage_out;
                   7204:   }
                   7205:   if( !pPage->leaf ){
                   7206:     rc = clearDatabasePage(pBt, get4byte(&pPage->aData[8]), 1, pnChange);
                   7207:     if( rc ) goto cleardatabasepage_out;
                   7208:   }else if( pnChange ){
                   7209:     assert( pPage->intKey );
                   7210:     *pnChange += pPage->nCell;
                   7211:   }
                   7212:   if( freePageFlag ){
                   7213:     freePage(pPage, &rc);
                   7214:   }else if( (rc = sqlite3PagerWrite(pPage->pDbPage))==0 ){
                   7215:     zeroPage(pPage, pPage->aData[0] | PTF_LEAF);
                   7216:   }
                   7217: 
                   7218: cleardatabasepage_out:
                   7219:   releasePage(pPage);
                   7220:   return rc;
                   7221: }
                   7222: 
                   7223: /*
                   7224: ** Delete all information from a single table in the database.  iTable is
                   7225: ** the page number of the root of the table.  After this routine returns,
                   7226: ** the root page is empty, but still exists.
                   7227: **
                   7228: ** This routine will fail with SQLITE_LOCKED if there are any open
                   7229: ** read cursors on the table.  Open write cursors are moved to the
                   7230: ** root of the table.
                   7231: **
                   7232: ** If pnChange is not NULL, then table iTable must be an intkey table. The
                   7233: ** integer value pointed to by pnChange is incremented by the number of
                   7234: ** entries in the table.
                   7235: */
                   7236: int sqlite3BtreeClearTable(Btree *p, int iTable, int *pnChange){
                   7237:   int rc;
                   7238:   BtShared *pBt = p->pBt;
                   7239:   sqlite3BtreeEnter(p);
                   7240:   assert( p->inTrans==TRANS_WRITE );
                   7241: 
                   7242:   /* Invalidate all incrblob cursors open on table iTable (assuming iTable
                   7243:   ** is the root of a table b-tree - if it is not, the following call is
                   7244:   ** a no-op).  */
                   7245:   invalidateIncrblobCursors(p, 0, 1);
                   7246: 
                   7247:   rc = saveAllCursors(pBt, (Pgno)iTable, 0);
                   7248:   if( SQLITE_OK==rc ){
                   7249:     rc = clearDatabasePage(pBt, (Pgno)iTable, 0, pnChange);
                   7250:   }
                   7251:   sqlite3BtreeLeave(p);
                   7252:   return rc;
                   7253: }
                   7254: 
                   7255: /*
                   7256: ** Erase all information in a table and add the root of the table to
                   7257: ** the freelist.  Except, the root of the principle table (the one on
                   7258: ** page 1) is never added to the freelist.
                   7259: **
                   7260: ** This routine will fail with SQLITE_LOCKED if there are any open
                   7261: ** cursors on the table.
                   7262: **
                   7263: ** If AUTOVACUUM is enabled and the page at iTable is not the last
                   7264: ** root page in the database file, then the last root page 
                   7265: ** in the database file is moved into the slot formerly occupied by
                   7266: ** iTable and that last slot formerly occupied by the last root page
                   7267: ** is added to the freelist instead of iTable.  In this say, all
                   7268: ** root pages are kept at the beginning of the database file, which
                   7269: ** is necessary for AUTOVACUUM to work right.  *piMoved is set to the 
                   7270: ** page number that used to be the last root page in the file before
                   7271: ** the move.  If no page gets moved, *piMoved is set to 0.
                   7272: ** The last root page is recorded in meta[3] and the value of
                   7273: ** meta[3] is updated by this procedure.
                   7274: */
                   7275: static int btreeDropTable(Btree *p, Pgno iTable, int *piMoved){
                   7276:   int rc;
                   7277:   MemPage *pPage = 0;
                   7278:   BtShared *pBt = p->pBt;
                   7279: 
                   7280:   assert( sqlite3BtreeHoldsMutex(p) );
                   7281:   assert( p->inTrans==TRANS_WRITE );
                   7282: 
                   7283:   /* It is illegal to drop a table if any cursors are open on the
                   7284:   ** database. This is because in auto-vacuum mode the backend may
                   7285:   ** need to move another root-page to fill a gap left by the deleted
                   7286:   ** root page. If an open cursor was using this page a problem would 
                   7287:   ** occur.
                   7288:   **
                   7289:   ** This error is caught long before control reaches this point.
                   7290:   */
                   7291:   if( NEVER(pBt->pCursor) ){
                   7292:     sqlite3ConnectionBlocked(p->db, pBt->pCursor->pBtree->db);
                   7293:     return SQLITE_LOCKED_SHAREDCACHE;
                   7294:   }
                   7295: 
                   7296:   rc = btreeGetPage(pBt, (Pgno)iTable, &pPage, 0);
                   7297:   if( rc ) return rc;
                   7298:   rc = sqlite3BtreeClearTable(p, iTable, 0);
                   7299:   if( rc ){
                   7300:     releasePage(pPage);
                   7301:     return rc;
                   7302:   }
                   7303: 
                   7304:   *piMoved = 0;
                   7305: 
                   7306:   if( iTable>1 ){
                   7307: #ifdef SQLITE_OMIT_AUTOVACUUM
                   7308:     freePage(pPage, &rc);
                   7309:     releasePage(pPage);
                   7310: #else
                   7311:     if( pBt->autoVacuum ){
                   7312:       Pgno maxRootPgno;
                   7313:       sqlite3BtreeGetMeta(p, BTREE_LARGEST_ROOT_PAGE, &maxRootPgno);
                   7314: 
                   7315:       if( iTable==maxRootPgno ){
                   7316:         /* If the table being dropped is the table with the largest root-page
                   7317:         ** number in the database, put the root page on the free list. 
                   7318:         */
                   7319:         freePage(pPage, &rc);
                   7320:         releasePage(pPage);
                   7321:         if( rc!=SQLITE_OK ){
                   7322:           return rc;
                   7323:         }
                   7324:       }else{
                   7325:         /* The table being dropped does not have the largest root-page
                   7326:         ** number in the database. So move the page that does into the 
                   7327:         ** gap left by the deleted root-page.
                   7328:         */
                   7329:         MemPage *pMove;
                   7330:         releasePage(pPage);
                   7331:         rc = btreeGetPage(pBt, maxRootPgno, &pMove, 0);
                   7332:         if( rc!=SQLITE_OK ){
                   7333:           return rc;
                   7334:         }
                   7335:         rc = relocatePage(pBt, pMove, PTRMAP_ROOTPAGE, 0, iTable, 0);
                   7336:         releasePage(pMove);
                   7337:         if( rc!=SQLITE_OK ){
                   7338:           return rc;
                   7339:         }
                   7340:         pMove = 0;
                   7341:         rc = btreeGetPage(pBt, maxRootPgno, &pMove, 0);
                   7342:         freePage(pMove, &rc);
                   7343:         releasePage(pMove);
                   7344:         if( rc!=SQLITE_OK ){
                   7345:           return rc;
                   7346:         }
                   7347:         *piMoved = maxRootPgno;
                   7348:       }
                   7349: 
                   7350:       /* Set the new 'max-root-page' value in the database header. This
                   7351:       ** is the old value less one, less one more if that happens to
                   7352:       ** be a root-page number, less one again if that is the
                   7353:       ** PENDING_BYTE_PAGE.
                   7354:       */
                   7355:       maxRootPgno--;
                   7356:       while( maxRootPgno==PENDING_BYTE_PAGE(pBt)
                   7357:              || PTRMAP_ISPAGE(pBt, maxRootPgno) ){
                   7358:         maxRootPgno--;
                   7359:       }
                   7360:       assert( maxRootPgno!=PENDING_BYTE_PAGE(pBt) );
                   7361: 
                   7362:       rc = sqlite3BtreeUpdateMeta(p, 4, maxRootPgno);
                   7363:     }else{
                   7364:       freePage(pPage, &rc);
                   7365:       releasePage(pPage);
                   7366:     }
                   7367: #endif
                   7368:   }else{
                   7369:     /* If sqlite3BtreeDropTable was called on page 1.
                   7370:     ** This really never should happen except in a corrupt
                   7371:     ** database. 
                   7372:     */
                   7373:     zeroPage(pPage, PTF_INTKEY|PTF_LEAF );
                   7374:     releasePage(pPage);
                   7375:   }
                   7376:   return rc;  
                   7377: }
                   7378: int sqlite3BtreeDropTable(Btree *p, int iTable, int *piMoved){
                   7379:   int rc;
                   7380:   sqlite3BtreeEnter(p);
                   7381:   rc = btreeDropTable(p, iTable, piMoved);
                   7382:   sqlite3BtreeLeave(p);
                   7383:   return rc;
                   7384: }
                   7385: 
                   7386: 
                   7387: /*
                   7388: ** This function may only be called if the b-tree connection already
                   7389: ** has a read or write transaction open on the database.
                   7390: **
                   7391: ** Read the meta-information out of a database file.  Meta[0]
                   7392: ** is the number of free pages currently in the database.  Meta[1]
                   7393: ** through meta[15] are available for use by higher layers.  Meta[0]
                   7394: ** is read-only, the others are read/write.
                   7395: ** 
                   7396: ** The schema layer numbers meta values differently.  At the schema
                   7397: ** layer (and the SetCookie and ReadCookie opcodes) the number of
                   7398: ** free pages is not visible.  So Cookie[0] is the same as Meta[1].
                   7399: */
                   7400: void sqlite3BtreeGetMeta(Btree *p, int idx, u32 *pMeta){
                   7401:   BtShared *pBt = p->pBt;
                   7402: 
                   7403:   sqlite3BtreeEnter(p);
                   7404:   assert( p->inTrans>TRANS_NONE );
                   7405:   assert( SQLITE_OK==querySharedCacheTableLock(p, MASTER_ROOT, READ_LOCK) );
                   7406:   assert( pBt->pPage1 );
                   7407:   assert( idx>=0 && idx<=15 );
                   7408: 
                   7409:   *pMeta = get4byte(&pBt->pPage1->aData[36 + idx*4]);
                   7410: 
                   7411:   /* If auto-vacuum is disabled in this build and this is an auto-vacuum
                   7412:   ** database, mark the database as read-only.  */
                   7413: #ifdef SQLITE_OMIT_AUTOVACUUM
                   7414:   if( idx==BTREE_LARGEST_ROOT_PAGE && *pMeta>0 ){
                   7415:     pBt->btsFlags |= BTS_READ_ONLY;
                   7416:   }
                   7417: #endif
                   7418: 
                   7419:   sqlite3BtreeLeave(p);
                   7420: }
                   7421: 
                   7422: /*
                   7423: ** Write meta-information back into the database.  Meta[0] is
                   7424: ** read-only and may not be written.
                   7425: */
                   7426: int sqlite3BtreeUpdateMeta(Btree *p, int idx, u32 iMeta){
                   7427:   BtShared *pBt = p->pBt;
                   7428:   unsigned char *pP1;
                   7429:   int rc;
                   7430:   assert( idx>=1 && idx<=15 );
                   7431:   sqlite3BtreeEnter(p);
                   7432:   assert( p->inTrans==TRANS_WRITE );
                   7433:   assert( pBt->pPage1!=0 );
                   7434:   pP1 = pBt->pPage1->aData;
                   7435:   rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
                   7436:   if( rc==SQLITE_OK ){
                   7437:     put4byte(&pP1[36 + idx*4], iMeta);
                   7438: #ifndef SQLITE_OMIT_AUTOVACUUM
                   7439:     if( idx==BTREE_INCR_VACUUM ){
                   7440:       assert( pBt->autoVacuum || iMeta==0 );
                   7441:       assert( iMeta==0 || iMeta==1 );
                   7442:       pBt->incrVacuum = (u8)iMeta;
                   7443:     }
                   7444: #endif
                   7445:   }
                   7446:   sqlite3BtreeLeave(p);
                   7447:   return rc;
                   7448: }
                   7449: 
                   7450: #ifndef SQLITE_OMIT_BTREECOUNT
                   7451: /*
                   7452: ** The first argument, pCur, is a cursor opened on some b-tree. Count the
                   7453: ** number of entries in the b-tree and write the result to *pnEntry.
                   7454: **
                   7455: ** SQLITE_OK is returned if the operation is successfully executed. 
                   7456: ** Otherwise, if an error is encountered (i.e. an IO error or database
                   7457: ** corruption) an SQLite error code is returned.
                   7458: */
                   7459: int sqlite3BtreeCount(BtCursor *pCur, i64 *pnEntry){
                   7460:   i64 nEntry = 0;                      /* Value to return in *pnEntry */
                   7461:   int rc;                              /* Return code */
                   7462: 
                   7463:   if( pCur->pgnoRoot==0 ){
                   7464:     *pnEntry = 0;
                   7465:     return SQLITE_OK;
                   7466:   }
                   7467:   rc = moveToRoot(pCur);
                   7468: 
                   7469:   /* Unless an error occurs, the following loop runs one iteration for each
                   7470:   ** page in the B-Tree structure (not including overflow pages). 
                   7471:   */
                   7472:   while( rc==SQLITE_OK ){
                   7473:     int iIdx;                          /* Index of child node in parent */
                   7474:     MemPage *pPage;                    /* Current page of the b-tree */
                   7475: 
                   7476:     /* If this is a leaf page or the tree is not an int-key tree, then 
                   7477:     ** this page contains countable entries. Increment the entry counter
                   7478:     ** accordingly.
                   7479:     */
                   7480:     pPage = pCur->apPage[pCur->iPage];
                   7481:     if( pPage->leaf || !pPage->intKey ){
                   7482:       nEntry += pPage->nCell;
                   7483:     }
                   7484: 
                   7485:     /* pPage is a leaf node. This loop navigates the cursor so that it 
                   7486:     ** points to the first interior cell that it points to the parent of
                   7487:     ** the next page in the tree that has not yet been visited. The
                   7488:     ** pCur->aiIdx[pCur->iPage] value is set to the index of the parent cell
                   7489:     ** of the page, or to the number of cells in the page if the next page
                   7490:     ** to visit is the right-child of its parent.
                   7491:     **
                   7492:     ** If all pages in the tree have been visited, return SQLITE_OK to the
                   7493:     ** caller.
                   7494:     */
                   7495:     if( pPage->leaf ){
                   7496:       do {
                   7497:         if( pCur->iPage==0 ){
                   7498:           /* All pages of the b-tree have been visited. Return successfully. */
                   7499:           *pnEntry = nEntry;
                   7500:           return SQLITE_OK;
                   7501:         }
                   7502:         moveToParent(pCur);
                   7503:       }while ( pCur->aiIdx[pCur->iPage]>=pCur->apPage[pCur->iPage]->nCell );
                   7504: 
                   7505:       pCur->aiIdx[pCur->iPage]++;
                   7506:       pPage = pCur->apPage[pCur->iPage];
                   7507:     }
                   7508: 
                   7509:     /* Descend to the child node of the cell that the cursor currently 
                   7510:     ** points at. This is the right-child if (iIdx==pPage->nCell).
                   7511:     */
                   7512:     iIdx = pCur->aiIdx[pCur->iPage];
                   7513:     if( iIdx==pPage->nCell ){
                   7514:       rc = moveToChild(pCur, get4byte(&pPage->aData[pPage->hdrOffset+8]));
                   7515:     }else{
                   7516:       rc = moveToChild(pCur, get4byte(findCell(pPage, iIdx)));
                   7517:     }
                   7518:   }
                   7519: 
                   7520:   /* An error has occurred. Return an error code. */
                   7521:   return rc;
                   7522: }
                   7523: #endif
                   7524: 
                   7525: /*
                   7526: ** Return the pager associated with a BTree.  This routine is used for
                   7527: ** testing and debugging only.
                   7528: */
                   7529: Pager *sqlite3BtreePager(Btree *p){
                   7530:   return p->pBt->pPager;
                   7531: }
                   7532: 
                   7533: #ifndef SQLITE_OMIT_INTEGRITY_CHECK
                   7534: /*
                   7535: ** Append a message to the error message string.
                   7536: */
                   7537: static void checkAppendMsg(
                   7538:   IntegrityCk *pCheck,
                   7539:   char *zMsg1,
                   7540:   const char *zFormat,
                   7541:   ...
                   7542: ){
                   7543:   va_list ap;
                   7544:   if( !pCheck->mxErr ) return;
                   7545:   pCheck->mxErr--;
                   7546:   pCheck->nErr++;
                   7547:   va_start(ap, zFormat);
                   7548:   if( pCheck->errMsg.nChar ){
                   7549:     sqlite3StrAccumAppend(&pCheck->errMsg, "\n", 1);
                   7550:   }
                   7551:   if( zMsg1 ){
                   7552:     sqlite3StrAccumAppend(&pCheck->errMsg, zMsg1, -1);
                   7553:   }
                   7554:   sqlite3VXPrintf(&pCheck->errMsg, 1, zFormat, ap);
                   7555:   va_end(ap);
                   7556:   if( pCheck->errMsg.mallocFailed ){
                   7557:     pCheck->mallocFailed = 1;
                   7558:   }
                   7559: }
                   7560: #endif /* SQLITE_OMIT_INTEGRITY_CHECK */
                   7561: 
                   7562: #ifndef SQLITE_OMIT_INTEGRITY_CHECK
                   7563: /*
                   7564: ** Add 1 to the reference count for page iPage.  If this is the second
                   7565: ** reference to the page, add an error message to pCheck->zErrMsg.
                   7566: ** Return 1 if there are 2 ore more references to the page and 0 if
                   7567: ** if this is the first reference to the page.
                   7568: **
                   7569: ** Also check that the page number is in bounds.
                   7570: */
                   7571: static int checkRef(IntegrityCk *pCheck, Pgno iPage, char *zContext){
                   7572:   if( iPage==0 ) return 1;
                   7573:   if( iPage>pCheck->nPage ){
                   7574:     checkAppendMsg(pCheck, zContext, "invalid page number %d", iPage);
                   7575:     return 1;
                   7576:   }
                   7577:   if( pCheck->anRef[iPage]==1 ){
                   7578:     checkAppendMsg(pCheck, zContext, "2nd reference to page %d", iPage);
                   7579:     return 1;
                   7580:   }
                   7581:   return  (pCheck->anRef[iPage]++)>1;
                   7582: }
                   7583: 
                   7584: #ifndef SQLITE_OMIT_AUTOVACUUM
                   7585: /*
                   7586: ** Check that the entry in the pointer-map for page iChild maps to 
                   7587: ** page iParent, pointer type ptrType. If not, append an error message
                   7588: ** to pCheck.
                   7589: */
                   7590: static void checkPtrmap(
                   7591:   IntegrityCk *pCheck,   /* Integrity check context */
                   7592:   Pgno iChild,           /* Child page number */
                   7593:   u8 eType,              /* Expected pointer map type */
                   7594:   Pgno iParent,          /* Expected pointer map parent page number */
                   7595:   char *zContext         /* Context description (used for error msg) */
                   7596: ){
                   7597:   int rc;
                   7598:   u8 ePtrmapType;
                   7599:   Pgno iPtrmapParent;
                   7600: 
                   7601:   rc = ptrmapGet(pCheck->pBt, iChild, &ePtrmapType, &iPtrmapParent);
                   7602:   if( rc!=SQLITE_OK ){
                   7603:     if( rc==SQLITE_NOMEM || rc==SQLITE_IOERR_NOMEM ) pCheck->mallocFailed = 1;
                   7604:     checkAppendMsg(pCheck, zContext, "Failed to read ptrmap key=%d", iChild);
                   7605:     return;
                   7606:   }
                   7607: 
                   7608:   if( ePtrmapType!=eType || iPtrmapParent!=iParent ){
                   7609:     checkAppendMsg(pCheck, zContext, 
                   7610:       "Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)", 
                   7611:       iChild, eType, iParent, ePtrmapType, iPtrmapParent);
                   7612:   }
                   7613: }
                   7614: #endif
                   7615: 
                   7616: /*
                   7617: ** Check the integrity of the freelist or of an overflow page list.
                   7618: ** Verify that the number of pages on the list is N.
                   7619: */
                   7620: static void checkList(
                   7621:   IntegrityCk *pCheck,  /* Integrity checking context */
                   7622:   int isFreeList,       /* True for a freelist.  False for overflow page list */
                   7623:   int iPage,            /* Page number for first page in the list */
                   7624:   int N,                /* Expected number of pages in the list */
                   7625:   char *zContext        /* Context for error messages */
                   7626: ){
                   7627:   int i;
                   7628:   int expected = N;
                   7629:   int iFirst = iPage;
                   7630:   while( N-- > 0 && pCheck->mxErr ){
                   7631:     DbPage *pOvflPage;
                   7632:     unsigned char *pOvflData;
                   7633:     if( iPage<1 ){
                   7634:       checkAppendMsg(pCheck, zContext,
                   7635:          "%d of %d pages missing from overflow list starting at %d",
                   7636:           N+1, expected, iFirst);
                   7637:       break;
                   7638:     }
                   7639:     if( checkRef(pCheck, iPage, zContext) ) break;
                   7640:     if( sqlite3PagerGet(pCheck->pPager, (Pgno)iPage, &pOvflPage) ){
                   7641:       checkAppendMsg(pCheck, zContext, "failed to get page %d", iPage);
                   7642:       break;
                   7643:     }
                   7644:     pOvflData = (unsigned char *)sqlite3PagerGetData(pOvflPage);
                   7645:     if( isFreeList ){
                   7646:       int n = get4byte(&pOvflData[4]);
                   7647: #ifndef SQLITE_OMIT_AUTOVACUUM
                   7648:       if( pCheck->pBt->autoVacuum ){
                   7649:         checkPtrmap(pCheck, iPage, PTRMAP_FREEPAGE, 0, zContext);
                   7650:       }
                   7651: #endif
                   7652:       if( n>(int)pCheck->pBt->usableSize/4-2 ){
                   7653:         checkAppendMsg(pCheck, zContext,
                   7654:            "freelist leaf count too big on page %d", iPage);
                   7655:         N--;
                   7656:       }else{
                   7657:         for(i=0; i<n; i++){
                   7658:           Pgno iFreePage = get4byte(&pOvflData[8+i*4]);
                   7659: #ifndef SQLITE_OMIT_AUTOVACUUM
                   7660:           if( pCheck->pBt->autoVacuum ){
                   7661:             checkPtrmap(pCheck, iFreePage, PTRMAP_FREEPAGE, 0, zContext);
                   7662:           }
                   7663: #endif
                   7664:           checkRef(pCheck, iFreePage, zContext);
                   7665:         }
                   7666:         N -= n;
                   7667:       }
                   7668:     }
                   7669: #ifndef SQLITE_OMIT_AUTOVACUUM
                   7670:     else{
                   7671:       /* If this database supports auto-vacuum and iPage is not the last
                   7672:       ** page in this overflow list, check that the pointer-map entry for
                   7673:       ** the following page matches iPage.
                   7674:       */
                   7675:       if( pCheck->pBt->autoVacuum && N>0 ){
                   7676:         i = get4byte(pOvflData);
                   7677:         checkPtrmap(pCheck, i, PTRMAP_OVERFLOW2, iPage, zContext);
                   7678:       }
                   7679:     }
                   7680: #endif
                   7681:     iPage = get4byte(pOvflData);
                   7682:     sqlite3PagerUnref(pOvflPage);
                   7683:   }
                   7684: }
                   7685: #endif /* SQLITE_OMIT_INTEGRITY_CHECK */
                   7686: 
                   7687: #ifndef SQLITE_OMIT_INTEGRITY_CHECK
                   7688: /*
                   7689: ** Do various sanity checks on a single page of a tree.  Return
                   7690: ** the tree depth.  Root pages return 0.  Parents of root pages
                   7691: ** return 1, and so forth.
                   7692: ** 
                   7693: ** These checks are done:
                   7694: **
                   7695: **      1.  Make sure that cells and freeblocks do not overlap
                   7696: **          but combine to completely cover the page.
                   7697: **  NO  2.  Make sure cell keys are in order.
                   7698: **  NO  3.  Make sure no key is less than or equal to zLowerBound.
                   7699: **  NO  4.  Make sure no key is greater than or equal to zUpperBound.
                   7700: **      5.  Check the integrity of overflow pages.
                   7701: **      6.  Recursively call checkTreePage on all children.
                   7702: **      7.  Verify that the depth of all children is the same.
                   7703: **      8.  Make sure this page is at least 33% full or else it is
                   7704: **          the root of the tree.
                   7705: */
                   7706: static int checkTreePage(
                   7707:   IntegrityCk *pCheck,  /* Context for the sanity check */
                   7708:   int iPage,            /* Page number of the page to check */
                   7709:   char *zParentContext, /* Parent context */
                   7710:   i64 *pnParentMinKey, 
                   7711:   i64 *pnParentMaxKey
                   7712: ){
                   7713:   MemPage *pPage;
                   7714:   int i, rc, depth, d2, pgno, cnt;
                   7715:   int hdr, cellStart;
                   7716:   int nCell;
                   7717:   u8 *data;
                   7718:   BtShared *pBt;
                   7719:   int usableSize;
                   7720:   char zContext[100];
                   7721:   char *hit = 0;
                   7722:   i64 nMinKey = 0;
                   7723:   i64 nMaxKey = 0;
                   7724: 
                   7725:   sqlite3_snprintf(sizeof(zContext), zContext, "Page %d: ", iPage);
                   7726: 
                   7727:   /* Check that the page exists
                   7728:   */
                   7729:   pBt = pCheck->pBt;
                   7730:   usableSize = pBt->usableSize;
                   7731:   if( iPage==0 ) return 0;
                   7732:   if( checkRef(pCheck, iPage, zParentContext) ) return 0;
                   7733:   if( (rc = btreeGetPage(pBt, (Pgno)iPage, &pPage, 0))!=0 ){
                   7734:     checkAppendMsg(pCheck, zContext,
                   7735:        "unable to get the page. error code=%d", rc);
                   7736:     return 0;
                   7737:   }
                   7738: 
                   7739:   /* Clear MemPage.isInit to make sure the corruption detection code in
                   7740:   ** btreeInitPage() is executed.  */
                   7741:   pPage->isInit = 0;
                   7742:   if( (rc = btreeInitPage(pPage))!=0 ){
                   7743:     assert( rc==SQLITE_CORRUPT );  /* The only possible error from InitPage */
                   7744:     checkAppendMsg(pCheck, zContext, 
                   7745:                    "btreeInitPage() returns error code %d", rc);
                   7746:     releasePage(pPage);
                   7747:     return 0;
                   7748:   }
                   7749: 
                   7750:   /* Check out all the cells.
                   7751:   */
                   7752:   depth = 0;
                   7753:   for(i=0; i<pPage->nCell && pCheck->mxErr; i++){
                   7754:     u8 *pCell;
                   7755:     u32 sz;
                   7756:     CellInfo info;
                   7757: 
                   7758:     /* Check payload overflow pages
                   7759:     */
                   7760:     sqlite3_snprintf(sizeof(zContext), zContext,
                   7761:              "On tree page %d cell %d: ", iPage, i);
                   7762:     pCell = findCell(pPage,i);
                   7763:     btreeParseCellPtr(pPage, pCell, &info);
                   7764:     sz = info.nData;
                   7765:     if( !pPage->intKey ) sz += (int)info.nKey;
                   7766:     /* For intKey pages, check that the keys are in order.
                   7767:     */
                   7768:     else if( i==0 ) nMinKey = nMaxKey = info.nKey;
                   7769:     else{
                   7770:       if( info.nKey <= nMaxKey ){
                   7771:         checkAppendMsg(pCheck, zContext, 
                   7772:             "Rowid %lld out of order (previous was %lld)", info.nKey, nMaxKey);
                   7773:       }
                   7774:       nMaxKey = info.nKey;
                   7775:     }
                   7776:     assert( sz==info.nPayload );
                   7777:     if( (sz>info.nLocal) 
                   7778:      && (&pCell[info.iOverflow]<=&pPage->aData[pBt->usableSize])
                   7779:     ){
                   7780:       int nPage = (sz - info.nLocal + usableSize - 5)/(usableSize - 4);
                   7781:       Pgno pgnoOvfl = get4byte(&pCell[info.iOverflow]);
                   7782: #ifndef SQLITE_OMIT_AUTOVACUUM
                   7783:       if( pBt->autoVacuum ){
                   7784:         checkPtrmap(pCheck, pgnoOvfl, PTRMAP_OVERFLOW1, iPage, zContext);
                   7785:       }
                   7786: #endif
                   7787:       checkList(pCheck, 0, pgnoOvfl, nPage, zContext);
                   7788:     }
                   7789: 
                   7790:     /* Check sanity of left child page.
                   7791:     */
                   7792:     if( !pPage->leaf ){
                   7793:       pgno = get4byte(pCell);
                   7794: #ifndef SQLITE_OMIT_AUTOVACUUM
                   7795:       if( pBt->autoVacuum ){
                   7796:         checkPtrmap(pCheck, pgno, PTRMAP_BTREE, iPage, zContext);
                   7797:       }
                   7798: #endif
                   7799:       d2 = checkTreePage(pCheck, pgno, zContext, &nMinKey, i==0 ? NULL : &nMaxKey);
                   7800:       if( i>0 && d2!=depth ){
                   7801:         checkAppendMsg(pCheck, zContext, "Child page depth differs");
                   7802:       }
                   7803:       depth = d2;
                   7804:     }
                   7805:   }
                   7806: 
                   7807:   if( !pPage->leaf ){
                   7808:     pgno = get4byte(&pPage->aData[pPage->hdrOffset+8]);
                   7809:     sqlite3_snprintf(sizeof(zContext), zContext, 
                   7810:                      "On page %d at right child: ", iPage);
                   7811: #ifndef SQLITE_OMIT_AUTOVACUUM
                   7812:     if( pBt->autoVacuum ){
                   7813:       checkPtrmap(pCheck, pgno, PTRMAP_BTREE, iPage, zContext);
                   7814:     }
                   7815: #endif
                   7816:     checkTreePage(pCheck, pgno, zContext, NULL, !pPage->nCell ? NULL : &nMaxKey);
                   7817:   }
                   7818:  
                   7819:   /* For intKey leaf pages, check that the min/max keys are in order
                   7820:   ** with any left/parent/right pages.
                   7821:   */
                   7822:   if( pPage->leaf && pPage->intKey ){
                   7823:     /* if we are a left child page */
                   7824:     if( pnParentMinKey ){
                   7825:       /* if we are the left most child page */
                   7826:       if( !pnParentMaxKey ){
                   7827:         if( nMaxKey > *pnParentMinKey ){
                   7828:           checkAppendMsg(pCheck, zContext, 
                   7829:               "Rowid %lld out of order (max larger than parent min of %lld)",
                   7830:               nMaxKey, *pnParentMinKey);
                   7831:         }
                   7832:       }else{
                   7833:         if( nMinKey <= *pnParentMinKey ){
                   7834:           checkAppendMsg(pCheck, zContext, 
                   7835:               "Rowid %lld out of order (min less than parent min of %lld)",
                   7836:               nMinKey, *pnParentMinKey);
                   7837:         }
                   7838:         if( nMaxKey > *pnParentMaxKey ){
                   7839:           checkAppendMsg(pCheck, zContext, 
                   7840:               "Rowid %lld out of order (max larger than parent max of %lld)",
                   7841:               nMaxKey, *pnParentMaxKey);
                   7842:         }
                   7843:         *pnParentMinKey = nMaxKey;
                   7844:       }
                   7845:     /* else if we're a right child page */
                   7846:     } else if( pnParentMaxKey ){
                   7847:       if( nMinKey <= *pnParentMaxKey ){
                   7848:         checkAppendMsg(pCheck, zContext, 
                   7849:             "Rowid %lld out of order (min less than parent max of %lld)",
                   7850:             nMinKey, *pnParentMaxKey);
                   7851:       }
                   7852:     }
                   7853:   }
                   7854: 
                   7855:   /* Check for complete coverage of the page
                   7856:   */
                   7857:   data = pPage->aData;
                   7858:   hdr = pPage->hdrOffset;
                   7859:   hit = sqlite3PageMalloc( pBt->pageSize );
                   7860:   if( hit==0 ){
                   7861:     pCheck->mallocFailed = 1;
                   7862:   }else{
                   7863:     int contentOffset = get2byteNotZero(&data[hdr+5]);
                   7864:     assert( contentOffset<=usableSize );  /* Enforced by btreeInitPage() */
                   7865:     memset(hit+contentOffset, 0, usableSize-contentOffset);
                   7866:     memset(hit, 1, contentOffset);
                   7867:     nCell = get2byte(&data[hdr+3]);
                   7868:     cellStart = hdr + 12 - 4*pPage->leaf;
                   7869:     for(i=0; i<nCell; i++){
                   7870:       int pc = get2byte(&data[cellStart+i*2]);
                   7871:       u32 size = 65536;
                   7872:       int j;
                   7873:       if( pc<=usableSize-4 ){
                   7874:         size = cellSizePtr(pPage, &data[pc]);
                   7875:       }
                   7876:       if( (int)(pc+size-1)>=usableSize ){
                   7877:         checkAppendMsg(pCheck, 0, 
                   7878:             "Corruption detected in cell %d on page %d",i,iPage);
                   7879:       }else{
                   7880:         for(j=pc+size-1; j>=pc; j--) hit[j]++;
                   7881:       }
                   7882:     }
                   7883:     i = get2byte(&data[hdr+1]);
                   7884:     while( i>0 ){
                   7885:       int size, j;
                   7886:       assert( i<=usableSize-4 );     /* Enforced by btreeInitPage() */
                   7887:       size = get2byte(&data[i+2]);
                   7888:       assert( i+size<=usableSize );  /* Enforced by btreeInitPage() */
                   7889:       for(j=i+size-1; j>=i; j--) hit[j]++;
                   7890:       j = get2byte(&data[i]);
                   7891:       assert( j==0 || j>i+size );  /* Enforced by btreeInitPage() */
                   7892:       assert( j<=usableSize-4 );   /* Enforced by btreeInitPage() */
                   7893:       i = j;
                   7894:     }
                   7895:     for(i=cnt=0; i<usableSize; i++){
                   7896:       if( hit[i]==0 ){
                   7897:         cnt++;
                   7898:       }else if( hit[i]>1 ){
                   7899:         checkAppendMsg(pCheck, 0,
                   7900:           "Multiple uses for byte %d of page %d", i, iPage);
                   7901:         break;
                   7902:       }
                   7903:     }
                   7904:     if( cnt!=data[hdr+7] ){
                   7905:       checkAppendMsg(pCheck, 0, 
                   7906:           "Fragmentation of %d bytes reported as %d on page %d",
                   7907:           cnt, data[hdr+7], iPage);
                   7908:     }
                   7909:   }
                   7910:   sqlite3PageFree(hit);
                   7911:   releasePage(pPage);
                   7912:   return depth+1;
                   7913: }
                   7914: #endif /* SQLITE_OMIT_INTEGRITY_CHECK */
                   7915: 
                   7916: #ifndef SQLITE_OMIT_INTEGRITY_CHECK
                   7917: /*
                   7918: ** This routine does a complete check of the given BTree file.  aRoot[] is
                   7919: ** an array of pages numbers were each page number is the root page of
                   7920: ** a table.  nRoot is the number of entries in aRoot.
                   7921: **
                   7922: ** A read-only or read-write transaction must be opened before calling
                   7923: ** this function.
                   7924: **
                   7925: ** Write the number of error seen in *pnErr.  Except for some memory
                   7926: ** allocation errors,  an error message held in memory obtained from
                   7927: ** malloc is returned if *pnErr is non-zero.  If *pnErr==0 then NULL is
                   7928: ** returned.  If a memory allocation error occurs, NULL is returned.
                   7929: */
                   7930: char *sqlite3BtreeIntegrityCheck(
                   7931:   Btree *p,     /* The btree to be checked */
                   7932:   int *aRoot,   /* An array of root pages numbers for individual trees */
                   7933:   int nRoot,    /* Number of entries in aRoot[] */
                   7934:   int mxErr,    /* Stop reporting errors after this many */
                   7935:   int *pnErr    /* Write number of errors seen to this variable */
                   7936: ){
                   7937:   Pgno i;
                   7938:   int nRef;
                   7939:   IntegrityCk sCheck;
                   7940:   BtShared *pBt = p->pBt;
                   7941:   char zErr[100];
                   7942: 
                   7943:   sqlite3BtreeEnter(p);
                   7944:   assert( p->inTrans>TRANS_NONE && pBt->inTransaction>TRANS_NONE );
                   7945:   nRef = sqlite3PagerRefcount(pBt->pPager);
                   7946:   sCheck.pBt = pBt;
                   7947:   sCheck.pPager = pBt->pPager;
                   7948:   sCheck.nPage = btreePagecount(sCheck.pBt);
                   7949:   sCheck.mxErr = mxErr;
                   7950:   sCheck.nErr = 0;
                   7951:   sCheck.mallocFailed = 0;
                   7952:   *pnErr = 0;
                   7953:   if( sCheck.nPage==0 ){
                   7954:     sqlite3BtreeLeave(p);
                   7955:     return 0;
                   7956:   }
                   7957:   sCheck.anRef = sqlite3Malloc( (sCheck.nPage+1)*sizeof(sCheck.anRef[0]) );
                   7958:   if( !sCheck.anRef ){
                   7959:     *pnErr = 1;
                   7960:     sqlite3BtreeLeave(p);
                   7961:     return 0;
                   7962:   }
                   7963:   for(i=0; i<=sCheck.nPage; i++){ sCheck.anRef[i] = 0; }
                   7964:   i = PENDING_BYTE_PAGE(pBt);
                   7965:   if( i<=sCheck.nPage ){
                   7966:     sCheck.anRef[i] = 1;
                   7967:   }
                   7968:   sqlite3StrAccumInit(&sCheck.errMsg, zErr, sizeof(zErr), 20000);
                   7969:   sCheck.errMsg.useMalloc = 2;
                   7970: 
                   7971:   /* Check the integrity of the freelist
                   7972:   */
                   7973:   checkList(&sCheck, 1, get4byte(&pBt->pPage1->aData[32]),
                   7974:             get4byte(&pBt->pPage1->aData[36]), "Main freelist: ");
                   7975: 
                   7976:   /* Check all the tables.
                   7977:   */
                   7978:   for(i=0; (int)i<nRoot && sCheck.mxErr; i++){
                   7979:     if( aRoot[i]==0 ) continue;
                   7980: #ifndef SQLITE_OMIT_AUTOVACUUM
                   7981:     if( pBt->autoVacuum && aRoot[i]>1 ){
                   7982:       checkPtrmap(&sCheck, aRoot[i], PTRMAP_ROOTPAGE, 0, 0);
                   7983:     }
                   7984: #endif
                   7985:     checkTreePage(&sCheck, aRoot[i], "List of tree roots: ", NULL, NULL);
                   7986:   }
                   7987: 
                   7988:   /* Make sure every page in the file is referenced
                   7989:   */
                   7990:   for(i=1; i<=sCheck.nPage && sCheck.mxErr; i++){
                   7991: #ifdef SQLITE_OMIT_AUTOVACUUM
                   7992:     if( sCheck.anRef[i]==0 ){
                   7993:       checkAppendMsg(&sCheck, 0, "Page %d is never used", i);
                   7994:     }
                   7995: #else
                   7996:     /* If the database supports auto-vacuum, make sure no tables contain
                   7997:     ** references to pointer-map pages.
                   7998:     */
                   7999:     if( sCheck.anRef[i]==0 && 
                   8000:        (PTRMAP_PAGENO(pBt, i)!=i || !pBt->autoVacuum) ){
                   8001:       checkAppendMsg(&sCheck, 0, "Page %d is never used", i);
                   8002:     }
                   8003:     if( sCheck.anRef[i]!=0 && 
                   8004:        (PTRMAP_PAGENO(pBt, i)==i && pBt->autoVacuum) ){
                   8005:       checkAppendMsg(&sCheck, 0, "Pointer map page %d is referenced", i);
                   8006:     }
                   8007: #endif
                   8008:   }
                   8009: 
                   8010:   /* Make sure this analysis did not leave any unref() pages.
                   8011:   ** This is an internal consistency check; an integrity check
                   8012:   ** of the integrity check.
                   8013:   */
                   8014:   if( NEVER(nRef != sqlite3PagerRefcount(pBt->pPager)) ){
                   8015:     checkAppendMsg(&sCheck, 0, 
                   8016:       "Outstanding page count goes from %d to %d during this analysis",
                   8017:       nRef, sqlite3PagerRefcount(pBt->pPager)
                   8018:     );
                   8019:   }
                   8020: 
                   8021:   /* Clean  up and report errors.
                   8022:   */
                   8023:   sqlite3BtreeLeave(p);
                   8024:   sqlite3_free(sCheck.anRef);
                   8025:   if( sCheck.mallocFailed ){
                   8026:     sqlite3StrAccumReset(&sCheck.errMsg);
                   8027:     *pnErr = sCheck.nErr+1;
                   8028:     return 0;
                   8029:   }
                   8030:   *pnErr = sCheck.nErr;
                   8031:   if( sCheck.nErr==0 ) sqlite3StrAccumReset(&sCheck.errMsg);
                   8032:   return sqlite3StrAccumFinish(&sCheck.errMsg);
                   8033: }
                   8034: #endif /* SQLITE_OMIT_INTEGRITY_CHECK */
                   8035: 
                   8036: /*
                   8037: ** Return the full pathname of the underlying database file.
                   8038: **
                   8039: ** The pager filename is invariant as long as the pager is
                   8040: ** open so it is safe to access without the BtShared mutex.
                   8041: */
                   8042: const char *sqlite3BtreeGetFilename(Btree *p){
                   8043:   assert( p->pBt->pPager!=0 );
                   8044:   return sqlite3PagerFilename(p->pBt->pPager);
                   8045: }
                   8046: 
                   8047: /*
                   8048: ** Return the pathname of the journal file for this database. The return
                   8049: ** value of this routine is the same regardless of whether the journal file
                   8050: ** has been created or not.
                   8051: **
                   8052: ** The pager journal filename is invariant as long as the pager is
                   8053: ** open so it is safe to access without the BtShared mutex.
                   8054: */
                   8055: const char *sqlite3BtreeGetJournalname(Btree *p){
                   8056:   assert( p->pBt->pPager!=0 );
                   8057:   return sqlite3PagerJournalname(p->pBt->pPager);
                   8058: }
                   8059: 
                   8060: /*
                   8061: ** Return non-zero if a transaction is active.
                   8062: */
                   8063: int sqlite3BtreeIsInTrans(Btree *p){
                   8064:   assert( p==0 || sqlite3_mutex_held(p->db->mutex) );
                   8065:   return (p && (p->inTrans==TRANS_WRITE));
                   8066: }
                   8067: 
                   8068: #ifndef SQLITE_OMIT_WAL
                   8069: /*
                   8070: ** Run a checkpoint on the Btree passed as the first argument.
                   8071: **
                   8072: ** Return SQLITE_LOCKED if this or any other connection has an open 
                   8073: ** transaction on the shared-cache the argument Btree is connected to.
                   8074: **
                   8075: ** Parameter eMode is one of SQLITE_CHECKPOINT_PASSIVE, FULL or RESTART.
                   8076: */
                   8077: int sqlite3BtreeCheckpoint(Btree *p, int eMode, int *pnLog, int *pnCkpt){
                   8078:   int rc = SQLITE_OK;
                   8079:   if( p ){
                   8080:     BtShared *pBt = p->pBt;
                   8081:     sqlite3BtreeEnter(p);
                   8082:     if( pBt->inTransaction!=TRANS_NONE ){
                   8083:       rc = SQLITE_LOCKED;
                   8084:     }else{
                   8085:       rc = sqlite3PagerCheckpoint(pBt->pPager, eMode, pnLog, pnCkpt);
                   8086:     }
                   8087:     sqlite3BtreeLeave(p);
                   8088:   }
                   8089:   return rc;
                   8090: }
                   8091: #endif
                   8092: 
                   8093: /*
                   8094: ** Return non-zero if a read (or write) transaction is active.
                   8095: */
                   8096: int sqlite3BtreeIsInReadTrans(Btree *p){
                   8097:   assert( p );
                   8098:   assert( sqlite3_mutex_held(p->db->mutex) );
                   8099:   return p->inTrans!=TRANS_NONE;
                   8100: }
                   8101: 
                   8102: int sqlite3BtreeIsInBackup(Btree *p){
                   8103:   assert( p );
                   8104:   assert( sqlite3_mutex_held(p->db->mutex) );
                   8105:   return p->nBackup!=0;
                   8106: }
                   8107: 
                   8108: /*
                   8109: ** This function returns a pointer to a blob of memory associated with
                   8110: ** a single shared-btree. The memory is used by client code for its own
                   8111: ** purposes (for example, to store a high-level schema associated with 
                   8112: ** the shared-btree). The btree layer manages reference counting issues.
                   8113: **
                   8114: ** The first time this is called on a shared-btree, nBytes bytes of memory
                   8115: ** are allocated, zeroed, and returned to the caller. For each subsequent 
                   8116: ** call the nBytes parameter is ignored and a pointer to the same blob
                   8117: ** of memory returned. 
                   8118: **
                   8119: ** If the nBytes parameter is 0 and the blob of memory has not yet been
                   8120: ** allocated, a null pointer is returned. If the blob has already been
                   8121: ** allocated, it is returned as normal.
                   8122: **
                   8123: ** Just before the shared-btree is closed, the function passed as the 
                   8124: ** xFree argument when the memory allocation was made is invoked on the 
                   8125: ** blob of allocated memory. The xFree function should not call sqlite3_free()
                   8126: ** on the memory, the btree layer does that.
                   8127: */
                   8128: void *sqlite3BtreeSchema(Btree *p, int nBytes, void(*xFree)(void *)){
                   8129:   BtShared *pBt = p->pBt;
                   8130:   sqlite3BtreeEnter(p);
                   8131:   if( !pBt->pSchema && nBytes ){
                   8132:     pBt->pSchema = sqlite3DbMallocZero(0, nBytes);
                   8133:     pBt->xFreeSchema = xFree;
                   8134:   }
                   8135:   sqlite3BtreeLeave(p);
                   8136:   return pBt->pSchema;
                   8137: }
                   8138: 
                   8139: /*
                   8140: ** Return SQLITE_LOCKED_SHAREDCACHE if another user of the same shared 
                   8141: ** btree as the argument handle holds an exclusive lock on the 
                   8142: ** sqlite_master table. Otherwise SQLITE_OK.
                   8143: */
                   8144: int sqlite3BtreeSchemaLocked(Btree *p){
                   8145:   int rc;
                   8146:   assert( sqlite3_mutex_held(p->db->mutex) );
                   8147:   sqlite3BtreeEnter(p);
                   8148:   rc = querySharedCacheTableLock(p, MASTER_ROOT, READ_LOCK);
                   8149:   assert( rc==SQLITE_OK || rc==SQLITE_LOCKED_SHAREDCACHE );
                   8150:   sqlite3BtreeLeave(p);
                   8151:   return rc;
                   8152: }
                   8153: 
                   8154: 
                   8155: #ifndef SQLITE_OMIT_SHARED_CACHE
                   8156: /*
                   8157: ** Obtain a lock on the table whose root page is iTab.  The
                   8158: ** lock is a write lock if isWritelock is true or a read lock
                   8159: ** if it is false.
                   8160: */
                   8161: int sqlite3BtreeLockTable(Btree *p, int iTab, u8 isWriteLock){
                   8162:   int rc = SQLITE_OK;
                   8163:   assert( p->inTrans!=TRANS_NONE );
                   8164:   if( p->sharable ){
                   8165:     u8 lockType = READ_LOCK + isWriteLock;
                   8166:     assert( READ_LOCK+1==WRITE_LOCK );
                   8167:     assert( isWriteLock==0 || isWriteLock==1 );
                   8168: 
                   8169:     sqlite3BtreeEnter(p);
                   8170:     rc = querySharedCacheTableLock(p, iTab, lockType);
                   8171:     if( rc==SQLITE_OK ){
                   8172:       rc = setSharedCacheTableLock(p, iTab, lockType);
                   8173:     }
                   8174:     sqlite3BtreeLeave(p);
                   8175:   }
                   8176:   return rc;
                   8177: }
                   8178: #endif
                   8179: 
                   8180: #ifndef SQLITE_OMIT_INCRBLOB
                   8181: /*
                   8182: ** Argument pCsr must be a cursor opened for writing on an 
                   8183: ** INTKEY table currently pointing at a valid table entry. 
                   8184: ** This function modifies the data stored as part of that entry.
                   8185: **
                   8186: ** Only the data content may only be modified, it is not possible to 
                   8187: ** change the length of the data stored. If this function is called with
                   8188: ** parameters that attempt to write past the end of the existing data,
                   8189: ** no modifications are made and SQLITE_CORRUPT is returned.
                   8190: */
                   8191: int sqlite3BtreePutData(BtCursor *pCsr, u32 offset, u32 amt, void *z){
                   8192:   int rc;
                   8193:   assert( cursorHoldsMutex(pCsr) );
                   8194:   assert( sqlite3_mutex_held(pCsr->pBtree->db->mutex) );
                   8195:   assert( pCsr->isIncrblobHandle );
                   8196: 
                   8197:   rc = restoreCursorPosition(pCsr);
                   8198:   if( rc!=SQLITE_OK ){
                   8199:     return rc;
                   8200:   }
                   8201:   assert( pCsr->eState!=CURSOR_REQUIRESEEK );
                   8202:   if( pCsr->eState!=CURSOR_VALID ){
                   8203:     return SQLITE_ABORT;
                   8204:   }
                   8205: 
                   8206:   /* Check some assumptions: 
                   8207:   **   (a) the cursor is open for writing,
                   8208:   **   (b) there is a read/write transaction open,
                   8209:   **   (c) the connection holds a write-lock on the table (if required),
                   8210:   **   (d) there are no conflicting read-locks, and
                   8211:   **   (e) the cursor points at a valid row of an intKey table.
                   8212:   */
                   8213:   if( !pCsr->wrFlag ){
                   8214:     return SQLITE_READONLY;
                   8215:   }
                   8216:   assert( (pCsr->pBt->btsFlags & BTS_READ_ONLY)==0
                   8217:               && pCsr->pBt->inTransaction==TRANS_WRITE );
                   8218:   assert( hasSharedCacheTableLock(pCsr->pBtree, pCsr->pgnoRoot, 0, 2) );
                   8219:   assert( !hasReadConflicts(pCsr->pBtree, pCsr->pgnoRoot) );
                   8220:   assert( pCsr->apPage[pCsr->iPage]->intKey );
                   8221: 
                   8222:   return accessPayload(pCsr, offset, amt, (unsigned char *)z, 1);
                   8223: }
                   8224: 
                   8225: /* 
                   8226: ** Set a flag on this cursor to cache the locations of pages from the 
                   8227: ** overflow list for the current row. This is used by cursors opened
                   8228: ** for incremental blob IO only.
                   8229: **
                   8230: ** This function sets a flag only. The actual page location cache
                   8231: ** (stored in BtCursor.aOverflow[]) is allocated and used by function
                   8232: ** accessPayload() (the worker function for sqlite3BtreeData() and
                   8233: ** sqlite3BtreePutData()).
                   8234: */
                   8235: void sqlite3BtreeCacheOverflow(BtCursor *pCur){
                   8236:   assert( cursorHoldsMutex(pCur) );
                   8237:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
                   8238:   invalidateOverflowCache(pCur);
                   8239:   pCur->isIncrblobHandle = 1;
                   8240: }
                   8241: #endif
                   8242: 
                   8243: /*
                   8244: ** Set both the "read version" (single byte at byte offset 18) and 
                   8245: ** "write version" (single byte at byte offset 19) fields in the database
                   8246: ** header to iVersion.
                   8247: */
                   8248: int sqlite3BtreeSetVersion(Btree *pBtree, int iVersion){
                   8249:   BtShared *pBt = pBtree->pBt;
                   8250:   int rc;                         /* Return code */
                   8251:  
                   8252:   assert( iVersion==1 || iVersion==2 );
                   8253: 
                   8254:   /* If setting the version fields to 1, do not automatically open the
                   8255:   ** WAL connection, even if the version fields are currently set to 2.
                   8256:   */
                   8257:   pBt->btsFlags &= ~BTS_NO_WAL;
                   8258:   if( iVersion==1 ) pBt->btsFlags |= BTS_NO_WAL;
                   8259: 
                   8260:   rc = sqlite3BtreeBeginTrans(pBtree, 0);
                   8261:   if( rc==SQLITE_OK ){
                   8262:     u8 *aData = pBt->pPage1->aData;
                   8263:     if( aData[18]!=(u8)iVersion || aData[19]!=(u8)iVersion ){
                   8264:       rc = sqlite3BtreeBeginTrans(pBtree, 2);
                   8265:       if( rc==SQLITE_OK ){
                   8266:         rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
                   8267:         if( rc==SQLITE_OK ){
                   8268:           aData[18] = (u8)iVersion;
                   8269:           aData[19] = (u8)iVersion;
                   8270:         }
                   8271:       }
                   8272:     }
                   8273:   }
                   8274: 
                   8275:   pBt->btsFlags &= ~BTS_NO_WAL;
                   8276:   return rc;
                   8277: }

FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>