File:  [ELWIX - Embedded LightWeight unIX -] / embedaddon / sqlite3 / src / btree.c
Revision 1.1.1.1 (vendor branch): download - view: text, annotated - select for diffs - revision graph
Tue Feb 21 17:04:17 2012 UTC (12 years, 8 months ago) by misho
Branches: sqlite3, MAIN
CVS tags: v3_7_10, HEAD
sqlite3

    1: /*
    2: ** 2004 April 6
    3: **
    4: ** The author disclaims copyright to this source code.  In place of
    5: ** a legal notice, here is a blessing:
    6: **
    7: **    May you do good and not evil.
    8: **    May you find forgiveness for yourself and forgive others.
    9: **    May you share freely, never taking more than you give.
   10: **
   11: *************************************************************************
   12: ** This file implements a external (disk-based) database using BTrees.
   13: ** See the header comment on "btreeInt.h" for additional information.
   14: ** Including a description of file format and an overview of operation.
   15: */
   16: #include "btreeInt.h"
   17: 
   18: /*
   19: ** The header string that appears at the beginning of every
   20: ** SQLite database.
   21: */
   22: static const char zMagicHeader[] = SQLITE_FILE_HEADER;
   23: 
   24: /*
   25: ** Set this global variable to 1 to enable tracing using the TRACE
   26: ** macro.
   27: */
   28: #if 0
   29: int sqlite3BtreeTrace=1;  /* True to enable tracing */
   30: # define TRACE(X)  if(sqlite3BtreeTrace){printf X;fflush(stdout);}
   31: #else
   32: # define TRACE(X)
   33: #endif
   34: 
   35: /*
   36: ** Extract a 2-byte big-endian integer from an array of unsigned bytes.
   37: ** But if the value is zero, make it 65536.
   38: **
   39: ** This routine is used to extract the "offset to cell content area" value
   40: ** from the header of a btree page.  If the page size is 65536 and the page
   41: ** is empty, the offset should be 65536, but the 2-byte value stores zero.
   42: ** This routine makes the necessary adjustment to 65536.
   43: */
   44: #define get2byteNotZero(X)  (((((int)get2byte(X))-1)&0xffff)+1)
   45: 
   46: #ifndef SQLITE_OMIT_SHARED_CACHE
   47: /*
   48: ** A list of BtShared objects that are eligible for participation
   49: ** in shared cache.  This variable has file scope during normal builds,
   50: ** but the test harness needs to access it so we make it global for 
   51: ** test builds.
   52: **
   53: ** Access to this variable is protected by SQLITE_MUTEX_STATIC_MASTER.
   54: */
   55: #ifdef SQLITE_TEST
   56: BtShared *SQLITE_WSD sqlite3SharedCacheList = 0;
   57: #else
   58: static BtShared *SQLITE_WSD sqlite3SharedCacheList = 0;
   59: #endif
   60: #endif /* SQLITE_OMIT_SHARED_CACHE */
   61: 
   62: #ifndef SQLITE_OMIT_SHARED_CACHE
   63: /*
   64: ** Enable or disable the shared pager and schema features.
   65: **
   66: ** This routine has no effect on existing database connections.
   67: ** The shared cache setting effects only future calls to
   68: ** sqlite3_open(), sqlite3_open16(), or sqlite3_open_v2().
   69: */
   70: int sqlite3_enable_shared_cache(int enable){
   71:   sqlite3GlobalConfig.sharedCacheEnabled = enable;
   72:   return SQLITE_OK;
   73: }
   74: #endif
   75: 
   76: 
   77: 
   78: #ifdef SQLITE_OMIT_SHARED_CACHE
   79:   /*
   80:   ** The functions querySharedCacheTableLock(), setSharedCacheTableLock(),
   81:   ** and clearAllSharedCacheTableLocks()
   82:   ** manipulate entries in the BtShared.pLock linked list used to store
   83:   ** shared-cache table level locks. If the library is compiled with the
   84:   ** shared-cache feature disabled, then there is only ever one user
   85:   ** of each BtShared structure and so this locking is not necessary. 
   86:   ** So define the lock related functions as no-ops.
   87:   */
   88:   #define querySharedCacheTableLock(a,b,c) SQLITE_OK
   89:   #define setSharedCacheTableLock(a,b,c) SQLITE_OK
   90:   #define clearAllSharedCacheTableLocks(a)
   91:   #define downgradeAllSharedCacheTableLocks(a)
   92:   #define hasSharedCacheTableLock(a,b,c,d) 1
   93:   #define hasReadConflicts(a, b) 0
   94: #endif
   95: 
   96: #ifndef SQLITE_OMIT_SHARED_CACHE
   97: 
   98: #ifdef SQLITE_DEBUG
   99: /*
  100: **** This function is only used as part of an assert() statement. ***
  101: **
  102: ** Check to see if pBtree holds the required locks to read or write to the 
  103: ** table with root page iRoot.   Return 1 if it does and 0 if not.
  104: **
  105: ** For example, when writing to a table with root-page iRoot via 
  106: ** Btree connection pBtree:
  107: **
  108: **    assert( hasSharedCacheTableLock(pBtree, iRoot, 0, WRITE_LOCK) );
  109: **
  110: ** When writing to an index that resides in a sharable database, the 
  111: ** caller should have first obtained a lock specifying the root page of
  112: ** the corresponding table. This makes things a bit more complicated,
  113: ** as this module treats each table as a separate structure. To determine
  114: ** the table corresponding to the index being written, this
  115: ** function has to search through the database schema.
  116: **
  117: ** Instead of a lock on the table/index rooted at page iRoot, the caller may
  118: ** hold a write-lock on the schema table (root page 1). This is also
  119: ** acceptable.
  120: */
  121: static int hasSharedCacheTableLock(
  122:   Btree *pBtree,         /* Handle that must hold lock */
  123:   Pgno iRoot,            /* Root page of b-tree */
  124:   int isIndex,           /* True if iRoot is the root of an index b-tree */
  125:   int eLockType          /* Required lock type (READ_LOCK or WRITE_LOCK) */
  126: ){
  127:   Schema *pSchema = (Schema *)pBtree->pBt->pSchema;
  128:   Pgno iTab = 0;
  129:   BtLock *pLock;
  130: 
  131:   /* If this database is not shareable, or if the client is reading
  132:   ** and has the read-uncommitted flag set, then no lock is required. 
  133:   ** Return true immediately.
  134:   */
  135:   if( (pBtree->sharable==0)
  136:    || (eLockType==READ_LOCK && (pBtree->db->flags & SQLITE_ReadUncommitted))
  137:   ){
  138:     return 1;
  139:   }
  140: 
  141:   /* If the client is reading  or writing an index and the schema is
  142:   ** not loaded, then it is too difficult to actually check to see if
  143:   ** the correct locks are held.  So do not bother - just return true.
  144:   ** This case does not come up very often anyhow.
  145:   */
  146:   if( isIndex && (!pSchema || (pSchema->flags&DB_SchemaLoaded)==0) ){
  147:     return 1;
  148:   }
  149: 
  150:   /* Figure out the root-page that the lock should be held on. For table
  151:   ** b-trees, this is just the root page of the b-tree being read or
  152:   ** written. For index b-trees, it is the root page of the associated
  153:   ** table.  */
  154:   if( isIndex ){
  155:     HashElem *p;
  156:     for(p=sqliteHashFirst(&pSchema->idxHash); p; p=sqliteHashNext(p)){
  157:       Index *pIdx = (Index *)sqliteHashData(p);
  158:       if( pIdx->tnum==(int)iRoot ){
  159:         iTab = pIdx->pTable->tnum;
  160:       }
  161:     }
  162:   }else{
  163:     iTab = iRoot;
  164:   }
  165: 
  166:   /* Search for the required lock. Either a write-lock on root-page iTab, a 
  167:   ** write-lock on the schema table, or (if the client is reading) a
  168:   ** read-lock on iTab will suffice. Return 1 if any of these are found.  */
  169:   for(pLock=pBtree->pBt->pLock; pLock; pLock=pLock->pNext){
  170:     if( pLock->pBtree==pBtree 
  171:      && (pLock->iTable==iTab || (pLock->eLock==WRITE_LOCK && pLock->iTable==1))
  172:      && pLock->eLock>=eLockType 
  173:     ){
  174:       return 1;
  175:     }
  176:   }
  177: 
  178:   /* Failed to find the required lock. */
  179:   return 0;
  180: }
  181: #endif /* SQLITE_DEBUG */
  182: 
  183: #ifdef SQLITE_DEBUG
  184: /*
  185: **** This function may be used as part of assert() statements only. ****
  186: **
  187: ** Return true if it would be illegal for pBtree to write into the
  188: ** table or index rooted at iRoot because other shared connections are
  189: ** simultaneously reading that same table or index.
  190: **
  191: ** It is illegal for pBtree to write if some other Btree object that
  192: ** shares the same BtShared object is currently reading or writing
  193: ** the iRoot table.  Except, if the other Btree object has the
  194: ** read-uncommitted flag set, then it is OK for the other object to
  195: ** have a read cursor.
  196: **
  197: ** For example, before writing to any part of the table or index
  198: ** rooted at page iRoot, one should call:
  199: **
  200: **    assert( !hasReadConflicts(pBtree, iRoot) );
  201: */
  202: static int hasReadConflicts(Btree *pBtree, Pgno iRoot){
  203:   BtCursor *p;
  204:   for(p=pBtree->pBt->pCursor; p; p=p->pNext){
  205:     if( p->pgnoRoot==iRoot 
  206:      && p->pBtree!=pBtree
  207:      && 0==(p->pBtree->db->flags & SQLITE_ReadUncommitted)
  208:     ){
  209:       return 1;
  210:     }
  211:   }
  212:   return 0;
  213: }
  214: #endif    /* #ifdef SQLITE_DEBUG */
  215: 
  216: /*
  217: ** Query to see if Btree handle p may obtain a lock of type eLock 
  218: ** (READ_LOCK or WRITE_LOCK) on the table with root-page iTab. Return
  219: ** SQLITE_OK if the lock may be obtained (by calling
  220: ** setSharedCacheTableLock()), or SQLITE_LOCKED if not.
  221: */
  222: static int querySharedCacheTableLock(Btree *p, Pgno iTab, u8 eLock){
  223:   BtShared *pBt = p->pBt;
  224:   BtLock *pIter;
  225: 
  226:   assert( sqlite3BtreeHoldsMutex(p) );
  227:   assert( eLock==READ_LOCK || eLock==WRITE_LOCK );
  228:   assert( p->db!=0 );
  229:   assert( !(p->db->flags&SQLITE_ReadUncommitted)||eLock==WRITE_LOCK||iTab==1 );
  230:   
  231:   /* If requesting a write-lock, then the Btree must have an open write
  232:   ** transaction on this file. And, obviously, for this to be so there 
  233:   ** must be an open write transaction on the file itself.
  234:   */
  235:   assert( eLock==READ_LOCK || (p==pBt->pWriter && p->inTrans==TRANS_WRITE) );
  236:   assert( eLock==READ_LOCK || pBt->inTransaction==TRANS_WRITE );
  237:   
  238:   /* This routine is a no-op if the shared-cache is not enabled */
  239:   if( !p->sharable ){
  240:     return SQLITE_OK;
  241:   }
  242: 
  243:   /* If some other connection is holding an exclusive lock, the
  244:   ** requested lock may not be obtained.
  245:   */
  246:   if( pBt->pWriter!=p && (pBt->btsFlags & BTS_EXCLUSIVE)!=0 ){
  247:     sqlite3ConnectionBlocked(p->db, pBt->pWriter->db);
  248:     return SQLITE_LOCKED_SHAREDCACHE;
  249:   }
  250: 
  251:   for(pIter=pBt->pLock; pIter; pIter=pIter->pNext){
  252:     /* The condition (pIter->eLock!=eLock) in the following if(...) 
  253:     ** statement is a simplification of:
  254:     **
  255:     **   (eLock==WRITE_LOCK || pIter->eLock==WRITE_LOCK)
  256:     **
  257:     ** since we know that if eLock==WRITE_LOCK, then no other connection
  258:     ** may hold a WRITE_LOCK on any table in this file (since there can
  259:     ** only be a single writer).
  260:     */
  261:     assert( pIter->eLock==READ_LOCK || pIter->eLock==WRITE_LOCK );
  262:     assert( eLock==READ_LOCK || pIter->pBtree==p || pIter->eLock==READ_LOCK);
  263:     if( pIter->pBtree!=p && pIter->iTable==iTab && pIter->eLock!=eLock ){
  264:       sqlite3ConnectionBlocked(p->db, pIter->pBtree->db);
  265:       if( eLock==WRITE_LOCK ){
  266:         assert( p==pBt->pWriter );
  267:         pBt->btsFlags |= BTS_PENDING;
  268:       }
  269:       return SQLITE_LOCKED_SHAREDCACHE;
  270:     }
  271:   }
  272:   return SQLITE_OK;
  273: }
  274: #endif /* !SQLITE_OMIT_SHARED_CACHE */
  275: 
  276: #ifndef SQLITE_OMIT_SHARED_CACHE
  277: /*
  278: ** Add a lock on the table with root-page iTable to the shared-btree used
  279: ** by Btree handle p. Parameter eLock must be either READ_LOCK or 
  280: ** WRITE_LOCK.
  281: **
  282: ** This function assumes the following:
  283: **
  284: **   (a) The specified Btree object p is connected to a sharable
  285: **       database (one with the BtShared.sharable flag set), and
  286: **
  287: **   (b) No other Btree objects hold a lock that conflicts
  288: **       with the requested lock (i.e. querySharedCacheTableLock() has
  289: **       already been called and returned SQLITE_OK).
  290: **
  291: ** SQLITE_OK is returned if the lock is added successfully. SQLITE_NOMEM 
  292: ** is returned if a malloc attempt fails.
  293: */
  294: static int setSharedCacheTableLock(Btree *p, Pgno iTable, u8 eLock){
  295:   BtShared *pBt = p->pBt;
  296:   BtLock *pLock = 0;
  297:   BtLock *pIter;
  298: 
  299:   assert( sqlite3BtreeHoldsMutex(p) );
  300:   assert( eLock==READ_LOCK || eLock==WRITE_LOCK );
  301:   assert( p->db!=0 );
  302: 
  303:   /* A connection with the read-uncommitted flag set will never try to
  304:   ** obtain a read-lock using this function. The only read-lock obtained
  305:   ** by a connection in read-uncommitted mode is on the sqlite_master 
  306:   ** table, and that lock is obtained in BtreeBeginTrans().  */
  307:   assert( 0==(p->db->flags&SQLITE_ReadUncommitted) || eLock==WRITE_LOCK );
  308: 
  309:   /* This function should only be called on a sharable b-tree after it 
  310:   ** has been determined that no other b-tree holds a conflicting lock.  */
  311:   assert( p->sharable );
  312:   assert( SQLITE_OK==querySharedCacheTableLock(p, iTable, eLock) );
  313: 
  314:   /* First search the list for an existing lock on this table. */
  315:   for(pIter=pBt->pLock; pIter; pIter=pIter->pNext){
  316:     if( pIter->iTable==iTable && pIter->pBtree==p ){
  317:       pLock = pIter;
  318:       break;
  319:     }
  320:   }
  321: 
  322:   /* If the above search did not find a BtLock struct associating Btree p
  323:   ** with table iTable, allocate one and link it into the list.
  324:   */
  325:   if( !pLock ){
  326:     pLock = (BtLock *)sqlite3MallocZero(sizeof(BtLock));
  327:     if( !pLock ){
  328:       return SQLITE_NOMEM;
  329:     }
  330:     pLock->iTable = iTable;
  331:     pLock->pBtree = p;
  332:     pLock->pNext = pBt->pLock;
  333:     pBt->pLock = pLock;
  334:   }
  335: 
  336:   /* Set the BtLock.eLock variable to the maximum of the current lock
  337:   ** and the requested lock. This means if a write-lock was already held
  338:   ** and a read-lock requested, we don't incorrectly downgrade the lock.
  339:   */
  340:   assert( WRITE_LOCK>READ_LOCK );
  341:   if( eLock>pLock->eLock ){
  342:     pLock->eLock = eLock;
  343:   }
  344: 
  345:   return SQLITE_OK;
  346: }
  347: #endif /* !SQLITE_OMIT_SHARED_CACHE */
  348: 
  349: #ifndef SQLITE_OMIT_SHARED_CACHE
  350: /*
  351: ** Release all the table locks (locks obtained via calls to
  352: ** the setSharedCacheTableLock() procedure) held by Btree object p.
  353: **
  354: ** This function assumes that Btree p has an open read or write 
  355: ** transaction. If it does not, then the BTS_PENDING flag
  356: ** may be incorrectly cleared.
  357: */
  358: static void clearAllSharedCacheTableLocks(Btree *p){
  359:   BtShared *pBt = p->pBt;
  360:   BtLock **ppIter = &pBt->pLock;
  361: 
  362:   assert( sqlite3BtreeHoldsMutex(p) );
  363:   assert( p->sharable || 0==*ppIter );
  364:   assert( p->inTrans>0 );
  365: 
  366:   while( *ppIter ){
  367:     BtLock *pLock = *ppIter;
  368:     assert( (pBt->btsFlags & BTS_EXCLUSIVE)==0 || pBt->pWriter==pLock->pBtree );
  369:     assert( pLock->pBtree->inTrans>=pLock->eLock );
  370:     if( pLock->pBtree==p ){
  371:       *ppIter = pLock->pNext;
  372:       assert( pLock->iTable!=1 || pLock==&p->lock );
  373:       if( pLock->iTable!=1 ){
  374:         sqlite3_free(pLock);
  375:       }
  376:     }else{
  377:       ppIter = &pLock->pNext;
  378:     }
  379:   }
  380: 
  381:   assert( (pBt->btsFlags & BTS_PENDING)==0 || pBt->pWriter );
  382:   if( pBt->pWriter==p ){
  383:     pBt->pWriter = 0;
  384:     pBt->btsFlags &= ~(BTS_EXCLUSIVE|BTS_PENDING);
  385:   }else if( pBt->nTransaction==2 ){
  386:     /* This function is called when Btree p is concluding its 
  387:     ** transaction. If there currently exists a writer, and p is not
  388:     ** that writer, then the number of locks held by connections other
  389:     ** than the writer must be about to drop to zero. In this case
  390:     ** set the BTS_PENDING flag to 0.
  391:     **
  392:     ** If there is not currently a writer, then BTS_PENDING must
  393:     ** be zero already. So this next line is harmless in that case.
  394:     */
  395:     pBt->btsFlags &= ~BTS_PENDING;
  396:   }
  397: }
  398: 
  399: /*
  400: ** This function changes all write-locks held by Btree p into read-locks.
  401: */
  402: static void downgradeAllSharedCacheTableLocks(Btree *p){
  403:   BtShared *pBt = p->pBt;
  404:   if( pBt->pWriter==p ){
  405:     BtLock *pLock;
  406:     pBt->pWriter = 0;
  407:     pBt->btsFlags &= ~(BTS_EXCLUSIVE|BTS_PENDING);
  408:     for(pLock=pBt->pLock; pLock; pLock=pLock->pNext){
  409:       assert( pLock->eLock==READ_LOCK || pLock->pBtree==p );
  410:       pLock->eLock = READ_LOCK;
  411:     }
  412:   }
  413: }
  414: 
  415: #endif /* SQLITE_OMIT_SHARED_CACHE */
  416: 
  417: static void releasePage(MemPage *pPage);  /* Forward reference */
  418: 
  419: /*
  420: ***** This routine is used inside of assert() only ****
  421: **
  422: ** Verify that the cursor holds the mutex on its BtShared
  423: */
  424: #ifdef SQLITE_DEBUG
  425: static int cursorHoldsMutex(BtCursor *p){
  426:   return sqlite3_mutex_held(p->pBt->mutex);
  427: }
  428: #endif
  429: 
  430: 
  431: #ifndef SQLITE_OMIT_INCRBLOB
  432: /*
  433: ** Invalidate the overflow page-list cache for cursor pCur, if any.
  434: */
  435: static void invalidateOverflowCache(BtCursor *pCur){
  436:   assert( cursorHoldsMutex(pCur) );
  437:   sqlite3_free(pCur->aOverflow);
  438:   pCur->aOverflow = 0;
  439: }
  440: 
  441: /*
  442: ** Invalidate the overflow page-list cache for all cursors opened
  443: ** on the shared btree structure pBt.
  444: */
  445: static void invalidateAllOverflowCache(BtShared *pBt){
  446:   BtCursor *p;
  447:   assert( sqlite3_mutex_held(pBt->mutex) );
  448:   for(p=pBt->pCursor; p; p=p->pNext){
  449:     invalidateOverflowCache(p);
  450:   }
  451: }
  452: 
  453: /*
  454: ** This function is called before modifying the contents of a table
  455: ** to invalidate any incrblob cursors that are open on the
  456: ** row or one of the rows being modified.
  457: **
  458: ** If argument isClearTable is true, then the entire contents of the
  459: ** table is about to be deleted. In this case invalidate all incrblob
  460: ** cursors open on any row within the table with root-page pgnoRoot.
  461: **
  462: ** Otherwise, if argument isClearTable is false, then the row with
  463: ** rowid iRow is being replaced or deleted. In this case invalidate
  464: ** only those incrblob cursors open on that specific row.
  465: */
  466: static void invalidateIncrblobCursors(
  467:   Btree *pBtree,          /* The database file to check */
  468:   i64 iRow,               /* The rowid that might be changing */
  469:   int isClearTable        /* True if all rows are being deleted */
  470: ){
  471:   BtCursor *p;
  472:   BtShared *pBt = pBtree->pBt;
  473:   assert( sqlite3BtreeHoldsMutex(pBtree) );
  474:   for(p=pBt->pCursor; p; p=p->pNext){
  475:     if( p->isIncrblobHandle && (isClearTable || p->info.nKey==iRow) ){
  476:       p->eState = CURSOR_INVALID;
  477:     }
  478:   }
  479: }
  480: 
  481: #else
  482:   /* Stub functions when INCRBLOB is omitted */
  483:   #define invalidateOverflowCache(x)
  484:   #define invalidateAllOverflowCache(x)
  485:   #define invalidateIncrblobCursors(x,y,z)
  486: #endif /* SQLITE_OMIT_INCRBLOB */
  487: 
  488: /*
  489: ** Set bit pgno of the BtShared.pHasContent bitvec. This is called 
  490: ** when a page that previously contained data becomes a free-list leaf 
  491: ** page.
  492: **
  493: ** The BtShared.pHasContent bitvec exists to work around an obscure
  494: ** bug caused by the interaction of two useful IO optimizations surrounding
  495: ** free-list leaf pages:
  496: **
  497: **   1) When all data is deleted from a page and the page becomes
  498: **      a free-list leaf page, the page is not written to the database
  499: **      (as free-list leaf pages contain no meaningful data). Sometimes
  500: **      such a page is not even journalled (as it will not be modified,
  501: **      why bother journalling it?).
  502: **
  503: **   2) When a free-list leaf page is reused, its content is not read
  504: **      from the database or written to the journal file (why should it
  505: **      be, if it is not at all meaningful?).
  506: **
  507: ** By themselves, these optimizations work fine and provide a handy
  508: ** performance boost to bulk delete or insert operations. However, if
  509: ** a page is moved to the free-list and then reused within the same
  510: ** transaction, a problem comes up. If the page is not journalled when
  511: ** it is moved to the free-list and it is also not journalled when it
  512: ** is extracted from the free-list and reused, then the original data
  513: ** may be lost. In the event of a rollback, it may not be possible
  514: ** to restore the database to its original configuration.
  515: **
  516: ** The solution is the BtShared.pHasContent bitvec. Whenever a page is 
  517: ** moved to become a free-list leaf page, the corresponding bit is
  518: ** set in the bitvec. Whenever a leaf page is extracted from the free-list,
  519: ** optimization 2 above is omitted if the corresponding bit is already
  520: ** set in BtShared.pHasContent. The contents of the bitvec are cleared
  521: ** at the end of every transaction.
  522: */
  523: static int btreeSetHasContent(BtShared *pBt, Pgno pgno){
  524:   int rc = SQLITE_OK;
  525:   if( !pBt->pHasContent ){
  526:     assert( pgno<=pBt->nPage );
  527:     pBt->pHasContent = sqlite3BitvecCreate(pBt->nPage);
  528:     if( !pBt->pHasContent ){
  529:       rc = SQLITE_NOMEM;
  530:     }
  531:   }
  532:   if( rc==SQLITE_OK && pgno<=sqlite3BitvecSize(pBt->pHasContent) ){
  533:     rc = sqlite3BitvecSet(pBt->pHasContent, pgno);
  534:   }
  535:   return rc;
  536: }
  537: 
  538: /*
  539: ** Query the BtShared.pHasContent vector.
  540: **
  541: ** This function is called when a free-list leaf page is removed from the
  542: ** free-list for reuse. It returns false if it is safe to retrieve the
  543: ** page from the pager layer with the 'no-content' flag set. True otherwise.
  544: */
  545: static int btreeGetHasContent(BtShared *pBt, Pgno pgno){
  546:   Bitvec *p = pBt->pHasContent;
  547:   return (p && (pgno>sqlite3BitvecSize(p) || sqlite3BitvecTest(p, pgno)));
  548: }
  549: 
  550: /*
  551: ** Clear (destroy) the BtShared.pHasContent bitvec. This should be
  552: ** invoked at the conclusion of each write-transaction.
  553: */
  554: static void btreeClearHasContent(BtShared *pBt){
  555:   sqlite3BitvecDestroy(pBt->pHasContent);
  556:   pBt->pHasContent = 0;
  557: }
  558: 
  559: /*
  560: ** Save the current cursor position in the variables BtCursor.nKey 
  561: ** and BtCursor.pKey. The cursor's state is set to CURSOR_REQUIRESEEK.
  562: **
  563: ** The caller must ensure that the cursor is valid (has eState==CURSOR_VALID)
  564: ** prior to calling this routine.  
  565: */
  566: static int saveCursorPosition(BtCursor *pCur){
  567:   int rc;
  568: 
  569:   assert( CURSOR_VALID==pCur->eState );
  570:   assert( 0==pCur->pKey );
  571:   assert( cursorHoldsMutex(pCur) );
  572: 
  573:   rc = sqlite3BtreeKeySize(pCur, &pCur->nKey);
  574:   assert( rc==SQLITE_OK );  /* KeySize() cannot fail */
  575: 
  576:   /* If this is an intKey table, then the above call to BtreeKeySize()
  577:   ** stores the integer key in pCur->nKey. In this case this value is
  578:   ** all that is required. Otherwise, if pCur is not open on an intKey
  579:   ** table, then malloc space for and store the pCur->nKey bytes of key 
  580:   ** data.
  581:   */
  582:   if( 0==pCur->apPage[0]->intKey ){
  583:     void *pKey = sqlite3Malloc( (int)pCur->nKey );
  584:     if( pKey ){
  585:       rc = sqlite3BtreeKey(pCur, 0, (int)pCur->nKey, pKey);
  586:       if( rc==SQLITE_OK ){
  587:         pCur->pKey = pKey;
  588:       }else{
  589:         sqlite3_free(pKey);
  590:       }
  591:     }else{
  592:       rc = SQLITE_NOMEM;
  593:     }
  594:   }
  595:   assert( !pCur->apPage[0]->intKey || !pCur->pKey );
  596: 
  597:   if( rc==SQLITE_OK ){
  598:     int i;
  599:     for(i=0; i<=pCur->iPage; i++){
  600:       releasePage(pCur->apPage[i]);
  601:       pCur->apPage[i] = 0;
  602:     }
  603:     pCur->iPage = -1;
  604:     pCur->eState = CURSOR_REQUIRESEEK;
  605:   }
  606: 
  607:   invalidateOverflowCache(pCur);
  608:   return rc;
  609: }
  610: 
  611: /*
  612: ** Save the positions of all cursors (except pExcept) that are open on
  613: ** the table  with root-page iRoot. Usually, this is called just before cursor
  614: ** pExcept is used to modify the table (BtreeDelete() or BtreeInsert()).
  615: */
  616: static int saveAllCursors(BtShared *pBt, Pgno iRoot, BtCursor *pExcept){
  617:   BtCursor *p;
  618:   assert( sqlite3_mutex_held(pBt->mutex) );
  619:   assert( pExcept==0 || pExcept->pBt==pBt );
  620:   for(p=pBt->pCursor; p; p=p->pNext){
  621:     if( p!=pExcept && (0==iRoot || p->pgnoRoot==iRoot) && 
  622:         p->eState==CURSOR_VALID ){
  623:       int rc = saveCursorPosition(p);
  624:       if( SQLITE_OK!=rc ){
  625:         return rc;
  626:       }
  627:     }
  628:   }
  629:   return SQLITE_OK;
  630: }
  631: 
  632: /*
  633: ** Clear the current cursor position.
  634: */
  635: void sqlite3BtreeClearCursor(BtCursor *pCur){
  636:   assert( cursorHoldsMutex(pCur) );
  637:   sqlite3_free(pCur->pKey);
  638:   pCur->pKey = 0;
  639:   pCur->eState = CURSOR_INVALID;
  640: }
  641: 
  642: /*
  643: ** In this version of BtreeMoveto, pKey is a packed index record
  644: ** such as is generated by the OP_MakeRecord opcode.  Unpack the
  645: ** record and then call BtreeMovetoUnpacked() to do the work.
  646: */
  647: static int btreeMoveto(
  648:   BtCursor *pCur,     /* Cursor open on the btree to be searched */
  649:   const void *pKey,   /* Packed key if the btree is an index */
  650:   i64 nKey,           /* Integer key for tables.  Size of pKey for indices */
  651:   int bias,           /* Bias search to the high end */
  652:   int *pRes           /* Write search results here */
  653: ){
  654:   int rc;                    /* Status code */
  655:   UnpackedRecord *pIdxKey;   /* Unpacked index key */
  656:   char aSpace[150];          /* Temp space for pIdxKey - to avoid a malloc */
  657:   char *pFree = 0;
  658: 
  659:   if( pKey ){
  660:     assert( nKey==(i64)(int)nKey );
  661:     pIdxKey = sqlite3VdbeAllocUnpackedRecord(
  662:         pCur->pKeyInfo, aSpace, sizeof(aSpace), &pFree
  663:     );
  664:     if( pIdxKey==0 ) return SQLITE_NOMEM;
  665:     sqlite3VdbeRecordUnpack(pCur->pKeyInfo, (int)nKey, pKey, pIdxKey);
  666:   }else{
  667:     pIdxKey = 0;
  668:   }
  669:   rc = sqlite3BtreeMovetoUnpacked(pCur, pIdxKey, nKey, bias, pRes);
  670:   if( pFree ){
  671:     sqlite3DbFree(pCur->pKeyInfo->db, pFree);
  672:   }
  673:   return rc;
  674: }
  675: 
  676: /*
  677: ** Restore the cursor to the position it was in (or as close to as possible)
  678: ** when saveCursorPosition() was called. Note that this call deletes the 
  679: ** saved position info stored by saveCursorPosition(), so there can be
  680: ** at most one effective restoreCursorPosition() call after each 
  681: ** saveCursorPosition().
  682: */
  683: static int btreeRestoreCursorPosition(BtCursor *pCur){
  684:   int rc;
  685:   assert( cursorHoldsMutex(pCur) );
  686:   assert( pCur->eState>=CURSOR_REQUIRESEEK );
  687:   if( pCur->eState==CURSOR_FAULT ){
  688:     return pCur->skipNext;
  689:   }
  690:   pCur->eState = CURSOR_INVALID;
  691:   rc = btreeMoveto(pCur, pCur->pKey, pCur->nKey, 0, &pCur->skipNext);
  692:   if( rc==SQLITE_OK ){
  693:     sqlite3_free(pCur->pKey);
  694:     pCur->pKey = 0;
  695:     assert( pCur->eState==CURSOR_VALID || pCur->eState==CURSOR_INVALID );
  696:   }
  697:   return rc;
  698: }
  699: 
  700: #define restoreCursorPosition(p) \
  701:   (p->eState>=CURSOR_REQUIRESEEK ? \
  702:          btreeRestoreCursorPosition(p) : \
  703:          SQLITE_OK)
  704: 
  705: /*
  706: ** Determine whether or not a cursor has moved from the position it
  707: ** was last placed at.  Cursors can move when the row they are pointing
  708: ** at is deleted out from under them.
  709: **
  710: ** This routine returns an error code if something goes wrong.  The
  711: ** integer *pHasMoved is set to one if the cursor has moved and 0 if not.
  712: */
  713: int sqlite3BtreeCursorHasMoved(BtCursor *pCur, int *pHasMoved){
  714:   int rc;
  715: 
  716:   rc = restoreCursorPosition(pCur);
  717:   if( rc ){
  718:     *pHasMoved = 1;
  719:     return rc;
  720:   }
  721:   if( pCur->eState!=CURSOR_VALID || pCur->skipNext!=0 ){
  722:     *pHasMoved = 1;
  723:   }else{
  724:     *pHasMoved = 0;
  725:   }
  726:   return SQLITE_OK;
  727: }
  728: 
  729: #ifndef SQLITE_OMIT_AUTOVACUUM
  730: /*
  731: ** Given a page number of a regular database page, return the page
  732: ** number for the pointer-map page that contains the entry for the
  733: ** input page number.
  734: **
  735: ** Return 0 (not a valid page) for pgno==1 since there is
  736: ** no pointer map associated with page 1.  The integrity_check logic
  737: ** requires that ptrmapPageno(*,1)!=1.
  738: */
  739: static Pgno ptrmapPageno(BtShared *pBt, Pgno pgno){
  740:   int nPagesPerMapPage;
  741:   Pgno iPtrMap, ret;
  742:   assert( sqlite3_mutex_held(pBt->mutex) );
  743:   if( pgno<2 ) return 0;
  744:   nPagesPerMapPage = (pBt->usableSize/5)+1;
  745:   iPtrMap = (pgno-2)/nPagesPerMapPage;
  746:   ret = (iPtrMap*nPagesPerMapPage) + 2; 
  747:   if( ret==PENDING_BYTE_PAGE(pBt) ){
  748:     ret++;
  749:   }
  750:   return ret;
  751: }
  752: 
  753: /*
  754: ** Write an entry into the pointer map.
  755: **
  756: ** This routine updates the pointer map entry for page number 'key'
  757: ** so that it maps to type 'eType' and parent page number 'pgno'.
  758: **
  759: ** If *pRC is initially non-zero (non-SQLITE_OK) then this routine is
  760: ** a no-op.  If an error occurs, the appropriate error code is written
  761: ** into *pRC.
  762: */
  763: static void ptrmapPut(BtShared *pBt, Pgno key, u8 eType, Pgno parent, int *pRC){
  764:   DbPage *pDbPage;  /* The pointer map page */
  765:   u8 *pPtrmap;      /* The pointer map data */
  766:   Pgno iPtrmap;     /* The pointer map page number */
  767:   int offset;       /* Offset in pointer map page */
  768:   int rc;           /* Return code from subfunctions */
  769: 
  770:   if( *pRC ) return;
  771: 
  772:   assert( sqlite3_mutex_held(pBt->mutex) );
  773:   /* The master-journal page number must never be used as a pointer map page */
  774:   assert( 0==PTRMAP_ISPAGE(pBt, PENDING_BYTE_PAGE(pBt)) );
  775: 
  776:   assert( pBt->autoVacuum );
  777:   if( key==0 ){
  778:     *pRC = SQLITE_CORRUPT_BKPT;
  779:     return;
  780:   }
  781:   iPtrmap = PTRMAP_PAGENO(pBt, key);
  782:   rc = sqlite3PagerGet(pBt->pPager, iPtrmap, &pDbPage);
  783:   if( rc!=SQLITE_OK ){
  784:     *pRC = rc;
  785:     return;
  786:   }
  787:   offset = PTRMAP_PTROFFSET(iPtrmap, key);
  788:   if( offset<0 ){
  789:     *pRC = SQLITE_CORRUPT_BKPT;
  790:     goto ptrmap_exit;
  791:   }
  792:   assert( offset <= (int)pBt->usableSize-5 );
  793:   pPtrmap = (u8 *)sqlite3PagerGetData(pDbPage);
  794: 
  795:   if( eType!=pPtrmap[offset] || get4byte(&pPtrmap[offset+1])!=parent ){
  796:     TRACE(("PTRMAP_UPDATE: %d->(%d,%d)\n", key, eType, parent));
  797:     *pRC= rc = sqlite3PagerWrite(pDbPage);
  798:     if( rc==SQLITE_OK ){
  799:       pPtrmap[offset] = eType;
  800:       put4byte(&pPtrmap[offset+1], parent);
  801:     }
  802:   }
  803: 
  804: ptrmap_exit:
  805:   sqlite3PagerUnref(pDbPage);
  806: }
  807: 
  808: /*
  809: ** Read an entry from the pointer map.
  810: **
  811: ** This routine retrieves the pointer map entry for page 'key', writing
  812: ** the type and parent page number to *pEType and *pPgno respectively.
  813: ** An error code is returned if something goes wrong, otherwise SQLITE_OK.
  814: */
  815: static int ptrmapGet(BtShared *pBt, Pgno key, u8 *pEType, Pgno *pPgno){
  816:   DbPage *pDbPage;   /* The pointer map page */
  817:   int iPtrmap;       /* Pointer map page index */
  818:   u8 *pPtrmap;       /* Pointer map page data */
  819:   int offset;        /* Offset of entry in pointer map */
  820:   int rc;
  821: 
  822:   assert( sqlite3_mutex_held(pBt->mutex) );
  823: 
  824:   iPtrmap = PTRMAP_PAGENO(pBt, key);
  825:   rc = sqlite3PagerGet(pBt->pPager, iPtrmap, &pDbPage);
  826:   if( rc!=0 ){
  827:     return rc;
  828:   }
  829:   pPtrmap = (u8 *)sqlite3PagerGetData(pDbPage);
  830: 
  831:   offset = PTRMAP_PTROFFSET(iPtrmap, key);
  832:   if( offset<0 ){
  833:     sqlite3PagerUnref(pDbPage);
  834:     return SQLITE_CORRUPT_BKPT;
  835:   }
  836:   assert( offset <= (int)pBt->usableSize-5 );
  837:   assert( pEType!=0 );
  838:   *pEType = pPtrmap[offset];
  839:   if( pPgno ) *pPgno = get4byte(&pPtrmap[offset+1]);
  840: 
  841:   sqlite3PagerUnref(pDbPage);
  842:   if( *pEType<1 || *pEType>5 ) return SQLITE_CORRUPT_BKPT;
  843:   return SQLITE_OK;
  844: }
  845: 
  846: #else /* if defined SQLITE_OMIT_AUTOVACUUM */
  847:   #define ptrmapPut(w,x,y,z,rc)
  848:   #define ptrmapGet(w,x,y,z) SQLITE_OK
  849:   #define ptrmapPutOvflPtr(x, y, rc)
  850: #endif
  851: 
  852: /*
  853: ** Given a btree page and a cell index (0 means the first cell on
  854: ** the page, 1 means the second cell, and so forth) return a pointer
  855: ** to the cell content.
  856: **
  857: ** This routine works only for pages that do not contain overflow cells.
  858: */
  859: #define findCell(P,I) \
  860:   ((P)->aData + ((P)->maskPage & get2byte(&(P)->aCellIdx[2*(I)])))
  861: #define findCellv2(D,M,O,I) (D+(M&get2byte(D+(O+2*(I)))))
  862: 
  863: 
  864: /*
  865: ** This a more complex version of findCell() that works for
  866: ** pages that do contain overflow cells.
  867: */
  868: static u8 *findOverflowCell(MemPage *pPage, int iCell){
  869:   int i;
  870:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  871:   for(i=pPage->nOverflow-1; i>=0; i--){
  872:     int k;
  873:     struct _OvflCell *pOvfl;
  874:     pOvfl = &pPage->aOvfl[i];
  875:     k = pOvfl->idx;
  876:     if( k<=iCell ){
  877:       if( k==iCell ){
  878:         return pOvfl->pCell;
  879:       }
  880:       iCell--;
  881:     }
  882:   }
  883:   return findCell(pPage, iCell);
  884: }
  885: 
  886: /*
  887: ** Parse a cell content block and fill in the CellInfo structure.  There
  888: ** are two versions of this function.  btreeParseCell() takes a 
  889: ** cell index as the second argument and btreeParseCellPtr() 
  890: ** takes a pointer to the body of the cell as its second argument.
  891: **
  892: ** Within this file, the parseCell() macro can be called instead of
  893: ** btreeParseCellPtr(). Using some compilers, this will be faster.
  894: */
  895: static void btreeParseCellPtr(
  896:   MemPage *pPage,         /* Page containing the cell */
  897:   u8 *pCell,              /* Pointer to the cell text. */
  898:   CellInfo *pInfo         /* Fill in this structure */
  899: ){
  900:   u16 n;                  /* Number bytes in cell content header */
  901:   u32 nPayload;           /* Number of bytes of cell payload */
  902: 
  903:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
  904: 
  905:   pInfo->pCell = pCell;
  906:   assert( pPage->leaf==0 || pPage->leaf==1 );
  907:   n = pPage->childPtrSize;
  908:   assert( n==4-4*pPage->leaf );
  909:   if( pPage->intKey ){
  910:     if( pPage->hasData ){
  911:       n += getVarint32(&pCell[n], nPayload);
  912:     }else{
  913:       nPayload = 0;
  914:     }
  915:     n += getVarint(&pCell[n], (u64*)&pInfo->nKey);
  916:     pInfo->nData = nPayload;
  917:   }else{
  918:     pInfo->nData = 0;
  919:     n += getVarint32(&pCell[n], nPayload);
  920:     pInfo->nKey = nPayload;
  921:   }
  922:   pInfo->nPayload = nPayload;
  923:   pInfo->nHeader = n;
  924:   testcase( nPayload==pPage->maxLocal );
  925:   testcase( nPayload==pPage->maxLocal+1 );
  926:   if( likely(nPayload<=pPage->maxLocal) ){
  927:     /* This is the (easy) common case where the entire payload fits
  928:     ** on the local page.  No overflow is required.
  929:     */
  930:     if( (pInfo->nSize = (u16)(n+nPayload))<4 ) pInfo->nSize = 4;
  931:     pInfo->nLocal = (u16)nPayload;
  932:     pInfo->iOverflow = 0;
  933:   }else{
  934:     /* If the payload will not fit completely on the local page, we have
  935:     ** to decide how much to store locally and how much to spill onto
  936:     ** overflow pages.  The strategy is to minimize the amount of unused
  937:     ** space on overflow pages while keeping the amount of local storage
  938:     ** in between minLocal and maxLocal.
  939:     **
  940:     ** Warning:  changing the way overflow payload is distributed in any
  941:     ** way will result in an incompatible file format.
  942:     */
  943:     int minLocal;  /* Minimum amount of payload held locally */
  944:     int maxLocal;  /* Maximum amount of payload held locally */
  945:     int surplus;   /* Overflow payload available for local storage */
  946: 
  947:     minLocal = pPage->minLocal;
  948:     maxLocal = pPage->maxLocal;
  949:     surplus = minLocal + (nPayload - minLocal)%(pPage->pBt->usableSize - 4);
  950:     testcase( surplus==maxLocal );
  951:     testcase( surplus==maxLocal+1 );
  952:     if( surplus <= maxLocal ){
  953:       pInfo->nLocal = (u16)surplus;
  954:     }else{
  955:       pInfo->nLocal = (u16)minLocal;
  956:     }
  957:     pInfo->iOverflow = (u16)(pInfo->nLocal + n);
  958:     pInfo->nSize = pInfo->iOverflow + 4;
  959:   }
  960: }
  961: #define parseCell(pPage, iCell, pInfo) \
  962:   btreeParseCellPtr((pPage), findCell((pPage), (iCell)), (pInfo))
  963: static void btreeParseCell(
  964:   MemPage *pPage,         /* Page containing the cell */
  965:   int iCell,              /* The cell index.  First cell is 0 */
  966:   CellInfo *pInfo         /* Fill in this structure */
  967: ){
  968:   parseCell(pPage, iCell, pInfo);
  969: }
  970: 
  971: /*
  972: ** Compute the total number of bytes that a Cell needs in the cell
  973: ** data area of the btree-page.  The return number includes the cell
  974: ** data header and the local payload, but not any overflow page or
  975: ** the space used by the cell pointer.
  976: */
  977: static u16 cellSizePtr(MemPage *pPage, u8 *pCell){
  978:   u8 *pIter = &pCell[pPage->childPtrSize];
  979:   u32 nSize;
  980: 
  981: #ifdef SQLITE_DEBUG
  982:   /* The value returned by this function should always be the same as
  983:   ** the (CellInfo.nSize) value found by doing a full parse of the
  984:   ** cell. If SQLITE_DEBUG is defined, an assert() at the bottom of
  985:   ** this function verifies that this invariant is not violated. */
  986:   CellInfo debuginfo;
  987:   btreeParseCellPtr(pPage, pCell, &debuginfo);
  988: #endif
  989: 
  990:   if( pPage->intKey ){
  991:     u8 *pEnd;
  992:     if( pPage->hasData ){
  993:       pIter += getVarint32(pIter, nSize);
  994:     }else{
  995:       nSize = 0;
  996:     }
  997: 
  998:     /* pIter now points at the 64-bit integer key value, a variable length 
  999:     ** integer. The following block moves pIter to point at the first byte
 1000:     ** past the end of the key value. */
 1001:     pEnd = &pIter[9];
 1002:     while( (*pIter++)&0x80 && pIter<pEnd );
 1003:   }else{
 1004:     pIter += getVarint32(pIter, nSize);
 1005:   }
 1006: 
 1007:   testcase( nSize==pPage->maxLocal );
 1008:   testcase( nSize==pPage->maxLocal+1 );
 1009:   if( nSize>pPage->maxLocal ){
 1010:     int minLocal = pPage->minLocal;
 1011:     nSize = minLocal + (nSize - minLocal) % (pPage->pBt->usableSize - 4);
 1012:     testcase( nSize==pPage->maxLocal );
 1013:     testcase( nSize==pPage->maxLocal+1 );
 1014:     if( nSize>pPage->maxLocal ){
 1015:       nSize = minLocal;
 1016:     }
 1017:     nSize += 4;
 1018:   }
 1019:   nSize += (u32)(pIter - pCell);
 1020: 
 1021:   /* The minimum size of any cell is 4 bytes. */
 1022:   if( nSize<4 ){
 1023:     nSize = 4;
 1024:   }
 1025: 
 1026:   assert( nSize==debuginfo.nSize );
 1027:   return (u16)nSize;
 1028: }
 1029: 
 1030: #ifdef SQLITE_DEBUG
 1031: /* This variation on cellSizePtr() is used inside of assert() statements
 1032: ** only. */
 1033: static u16 cellSize(MemPage *pPage, int iCell){
 1034:   return cellSizePtr(pPage, findCell(pPage, iCell));
 1035: }
 1036: #endif
 1037: 
 1038: #ifndef SQLITE_OMIT_AUTOVACUUM
 1039: /*
 1040: ** If the cell pCell, part of page pPage contains a pointer
 1041: ** to an overflow page, insert an entry into the pointer-map
 1042: ** for the overflow page.
 1043: */
 1044: static void ptrmapPutOvflPtr(MemPage *pPage, u8 *pCell, int *pRC){
 1045:   CellInfo info;
 1046:   if( *pRC ) return;
 1047:   assert( pCell!=0 );
 1048:   btreeParseCellPtr(pPage, pCell, &info);
 1049:   assert( (info.nData+(pPage->intKey?0:info.nKey))==info.nPayload );
 1050:   if( info.iOverflow ){
 1051:     Pgno ovfl = get4byte(&pCell[info.iOverflow]);
 1052:     ptrmapPut(pPage->pBt, ovfl, PTRMAP_OVERFLOW1, pPage->pgno, pRC);
 1053:   }
 1054: }
 1055: #endif
 1056: 
 1057: 
 1058: /*
 1059: ** Defragment the page given.  All Cells are moved to the
 1060: ** end of the page and all free space is collected into one
 1061: ** big FreeBlk that occurs in between the header and cell
 1062: ** pointer array and the cell content area.
 1063: */
 1064: static int defragmentPage(MemPage *pPage){
 1065:   int i;                     /* Loop counter */
 1066:   int pc;                    /* Address of a i-th cell */
 1067:   int hdr;                   /* Offset to the page header */
 1068:   int size;                  /* Size of a cell */
 1069:   int usableSize;            /* Number of usable bytes on a page */
 1070:   int cellOffset;            /* Offset to the cell pointer array */
 1071:   int cbrk;                  /* Offset to the cell content area */
 1072:   int nCell;                 /* Number of cells on the page */
 1073:   unsigned char *data;       /* The page data */
 1074:   unsigned char *temp;       /* Temp area for cell content */
 1075:   int iCellFirst;            /* First allowable cell index */
 1076:   int iCellLast;             /* Last possible cell index */
 1077: 
 1078: 
 1079:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
 1080:   assert( pPage->pBt!=0 );
 1081:   assert( pPage->pBt->usableSize <= SQLITE_MAX_PAGE_SIZE );
 1082:   assert( pPage->nOverflow==0 );
 1083:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
 1084:   temp = sqlite3PagerTempSpace(pPage->pBt->pPager);
 1085:   data = pPage->aData;
 1086:   hdr = pPage->hdrOffset;
 1087:   cellOffset = pPage->cellOffset;
 1088:   nCell = pPage->nCell;
 1089:   assert( nCell==get2byte(&data[hdr+3]) );
 1090:   usableSize = pPage->pBt->usableSize;
 1091:   cbrk = get2byte(&data[hdr+5]);
 1092:   memcpy(&temp[cbrk], &data[cbrk], usableSize - cbrk);
 1093:   cbrk = usableSize;
 1094:   iCellFirst = cellOffset + 2*nCell;
 1095:   iCellLast = usableSize - 4;
 1096:   for(i=0; i<nCell; i++){
 1097:     u8 *pAddr;     /* The i-th cell pointer */
 1098:     pAddr = &data[cellOffset + i*2];
 1099:     pc = get2byte(pAddr);
 1100:     testcase( pc==iCellFirst );
 1101:     testcase( pc==iCellLast );
 1102: #if !defined(SQLITE_ENABLE_OVERSIZE_CELL_CHECK)
 1103:     /* These conditions have already been verified in btreeInitPage()
 1104:     ** if SQLITE_ENABLE_OVERSIZE_CELL_CHECK is defined 
 1105:     */
 1106:     if( pc<iCellFirst || pc>iCellLast ){
 1107:       return SQLITE_CORRUPT_BKPT;
 1108:     }
 1109: #endif
 1110:     assert( pc>=iCellFirst && pc<=iCellLast );
 1111:     size = cellSizePtr(pPage, &temp[pc]);
 1112:     cbrk -= size;
 1113: #if defined(SQLITE_ENABLE_OVERSIZE_CELL_CHECK)
 1114:     if( cbrk<iCellFirst ){
 1115:       return SQLITE_CORRUPT_BKPT;
 1116:     }
 1117: #else
 1118:     if( cbrk<iCellFirst || pc+size>usableSize ){
 1119:       return SQLITE_CORRUPT_BKPT;
 1120:     }
 1121: #endif
 1122:     assert( cbrk+size<=usableSize && cbrk>=iCellFirst );
 1123:     testcase( cbrk+size==usableSize );
 1124:     testcase( pc+size==usableSize );
 1125:     memcpy(&data[cbrk], &temp[pc], size);
 1126:     put2byte(pAddr, cbrk);
 1127:   }
 1128:   assert( cbrk>=iCellFirst );
 1129:   put2byte(&data[hdr+5], cbrk);
 1130:   data[hdr+1] = 0;
 1131:   data[hdr+2] = 0;
 1132:   data[hdr+7] = 0;
 1133:   memset(&data[iCellFirst], 0, cbrk-iCellFirst);
 1134:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
 1135:   if( cbrk-iCellFirst!=pPage->nFree ){
 1136:     return SQLITE_CORRUPT_BKPT;
 1137:   }
 1138:   return SQLITE_OK;
 1139: }
 1140: 
 1141: /*
 1142: ** Allocate nByte bytes of space from within the B-Tree page passed
 1143: ** as the first argument. Write into *pIdx the index into pPage->aData[]
 1144: ** of the first byte of allocated space. Return either SQLITE_OK or
 1145: ** an error code (usually SQLITE_CORRUPT).
 1146: **
 1147: ** The caller guarantees that there is sufficient space to make the
 1148: ** allocation.  This routine might need to defragment in order to bring
 1149: ** all the space together, however.  This routine will avoid using
 1150: ** the first two bytes past the cell pointer area since presumably this
 1151: ** allocation is being made in order to insert a new cell, so we will
 1152: ** also end up needing a new cell pointer.
 1153: */
 1154: static int allocateSpace(MemPage *pPage, int nByte, int *pIdx){
 1155:   const int hdr = pPage->hdrOffset;    /* Local cache of pPage->hdrOffset */
 1156:   u8 * const data = pPage->aData;      /* Local cache of pPage->aData */
 1157:   int nFrag;                           /* Number of fragmented bytes on pPage */
 1158:   int top;                             /* First byte of cell content area */
 1159:   int gap;        /* First byte of gap between cell pointers and cell content */
 1160:   int rc;         /* Integer return code */
 1161:   int usableSize; /* Usable size of the page */
 1162:   
 1163:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
 1164:   assert( pPage->pBt );
 1165:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
 1166:   assert( nByte>=0 );  /* Minimum cell size is 4 */
 1167:   assert( pPage->nFree>=nByte );
 1168:   assert( pPage->nOverflow==0 );
 1169:   usableSize = pPage->pBt->usableSize;
 1170:   assert( nByte < usableSize-8 );
 1171: 
 1172:   nFrag = data[hdr+7];
 1173:   assert( pPage->cellOffset == hdr + 12 - 4*pPage->leaf );
 1174:   gap = pPage->cellOffset + 2*pPage->nCell;
 1175:   top = get2byteNotZero(&data[hdr+5]);
 1176:   if( gap>top ) return SQLITE_CORRUPT_BKPT;
 1177:   testcase( gap+2==top );
 1178:   testcase( gap+1==top );
 1179:   testcase( gap==top );
 1180: 
 1181:   if( nFrag>=60 ){
 1182:     /* Always defragment highly fragmented pages */
 1183:     rc = defragmentPage(pPage);
 1184:     if( rc ) return rc;
 1185:     top = get2byteNotZero(&data[hdr+5]);
 1186:   }else if( gap+2<=top ){
 1187:     /* Search the freelist looking for a free slot big enough to satisfy 
 1188:     ** the request. The allocation is made from the first free slot in 
 1189:     ** the list that is large enough to accomadate it.
 1190:     */
 1191:     int pc, addr;
 1192:     for(addr=hdr+1; (pc = get2byte(&data[addr]))>0; addr=pc){
 1193:       int size;            /* Size of the free slot */
 1194:       if( pc>usableSize-4 || pc<addr+4 ){
 1195:         return SQLITE_CORRUPT_BKPT;
 1196:       }
 1197:       size = get2byte(&data[pc+2]);
 1198:       if( size>=nByte ){
 1199:         int x = size - nByte;
 1200:         testcase( x==4 );
 1201:         testcase( x==3 );
 1202:         if( x<4 ){
 1203:           /* Remove the slot from the free-list. Update the number of
 1204:           ** fragmented bytes within the page. */
 1205:           memcpy(&data[addr], &data[pc], 2);
 1206:           data[hdr+7] = (u8)(nFrag + x);
 1207:         }else if( size+pc > usableSize ){
 1208:           return SQLITE_CORRUPT_BKPT;
 1209:         }else{
 1210:           /* The slot remains on the free-list. Reduce its size to account
 1211:           ** for the portion used by the new allocation. */
 1212:           put2byte(&data[pc+2], x);
 1213:         }
 1214:         *pIdx = pc + x;
 1215:         return SQLITE_OK;
 1216:       }
 1217:     }
 1218:   }
 1219: 
 1220:   /* Check to make sure there is enough space in the gap to satisfy
 1221:   ** the allocation.  If not, defragment.
 1222:   */
 1223:   testcase( gap+2+nByte==top );
 1224:   if( gap+2+nByte>top ){
 1225:     rc = defragmentPage(pPage);
 1226:     if( rc ) return rc;
 1227:     top = get2byteNotZero(&data[hdr+5]);
 1228:     assert( gap+nByte<=top );
 1229:   }
 1230: 
 1231: 
 1232:   /* Allocate memory from the gap in between the cell pointer array
 1233:   ** and the cell content area.  The btreeInitPage() call has already
 1234:   ** validated the freelist.  Given that the freelist is valid, there
 1235:   ** is no way that the allocation can extend off the end of the page.
 1236:   ** The assert() below verifies the previous sentence.
 1237:   */
 1238:   top -= nByte;
 1239:   put2byte(&data[hdr+5], top);
 1240:   assert( top+nByte <= (int)pPage->pBt->usableSize );
 1241:   *pIdx = top;
 1242:   return SQLITE_OK;
 1243: }
 1244: 
 1245: /*
 1246: ** Return a section of the pPage->aData to the freelist.
 1247: ** The first byte of the new free block is pPage->aDisk[start]
 1248: ** and the size of the block is "size" bytes.
 1249: **
 1250: ** Most of the effort here is involved in coalesing adjacent
 1251: ** free blocks into a single big free block.
 1252: */
 1253: static int freeSpace(MemPage *pPage, int start, int size){
 1254:   int addr, pbegin, hdr;
 1255:   int iLast;                        /* Largest possible freeblock offset */
 1256:   unsigned char *data = pPage->aData;
 1257: 
 1258:   assert( pPage->pBt!=0 );
 1259:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
 1260:   assert( start>=pPage->hdrOffset+6+pPage->childPtrSize );
 1261:   assert( (start + size) <= (int)pPage->pBt->usableSize );
 1262:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
 1263:   assert( size>=0 );   /* Minimum cell size is 4 */
 1264: 
 1265:   if( pPage->pBt->btsFlags & BTS_SECURE_DELETE ){
 1266:     /* Overwrite deleted information with zeros when the secure_delete
 1267:     ** option is enabled */
 1268:     memset(&data[start], 0, size);
 1269:   }
 1270: 
 1271:   /* Add the space back into the linked list of freeblocks.  Note that
 1272:   ** even though the freeblock list was checked by btreeInitPage(),
 1273:   ** btreeInitPage() did not detect overlapping cells or
 1274:   ** freeblocks that overlapped cells.   Nor does it detect when the
 1275:   ** cell content area exceeds the value in the page header.  If these
 1276:   ** situations arise, then subsequent insert operations might corrupt
 1277:   ** the freelist.  So we do need to check for corruption while scanning
 1278:   ** the freelist.
 1279:   */
 1280:   hdr = pPage->hdrOffset;
 1281:   addr = hdr + 1;
 1282:   iLast = pPage->pBt->usableSize - 4;
 1283:   assert( start<=iLast );
 1284:   while( (pbegin = get2byte(&data[addr]))<start && pbegin>0 ){
 1285:     if( pbegin<addr+4 ){
 1286:       return SQLITE_CORRUPT_BKPT;
 1287:     }
 1288:     addr = pbegin;
 1289:   }
 1290:   if( pbegin>iLast ){
 1291:     return SQLITE_CORRUPT_BKPT;
 1292:   }
 1293:   assert( pbegin>addr || pbegin==0 );
 1294:   put2byte(&data[addr], start);
 1295:   put2byte(&data[start], pbegin);
 1296:   put2byte(&data[start+2], size);
 1297:   pPage->nFree = pPage->nFree + (u16)size;
 1298: 
 1299:   /* Coalesce adjacent free blocks */
 1300:   addr = hdr + 1;
 1301:   while( (pbegin = get2byte(&data[addr]))>0 ){
 1302:     int pnext, psize, x;
 1303:     assert( pbegin>addr );
 1304:     assert( pbegin <= (int)pPage->pBt->usableSize-4 );
 1305:     pnext = get2byte(&data[pbegin]);
 1306:     psize = get2byte(&data[pbegin+2]);
 1307:     if( pbegin + psize + 3 >= pnext && pnext>0 ){
 1308:       int frag = pnext - (pbegin+psize);
 1309:       if( (frag<0) || (frag>(int)data[hdr+7]) ){
 1310:         return SQLITE_CORRUPT_BKPT;
 1311:       }
 1312:       data[hdr+7] -= (u8)frag;
 1313:       x = get2byte(&data[pnext]);
 1314:       put2byte(&data[pbegin], x);
 1315:       x = pnext + get2byte(&data[pnext+2]) - pbegin;
 1316:       put2byte(&data[pbegin+2], x);
 1317:     }else{
 1318:       addr = pbegin;
 1319:     }
 1320:   }
 1321: 
 1322:   /* If the cell content area begins with a freeblock, remove it. */
 1323:   if( data[hdr+1]==data[hdr+5] && data[hdr+2]==data[hdr+6] ){
 1324:     int top;
 1325:     pbegin = get2byte(&data[hdr+1]);
 1326:     memcpy(&data[hdr+1], &data[pbegin], 2);
 1327:     top = get2byte(&data[hdr+5]) + get2byte(&data[pbegin+2]);
 1328:     put2byte(&data[hdr+5], top);
 1329:   }
 1330:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
 1331:   return SQLITE_OK;
 1332: }
 1333: 
 1334: /*
 1335: ** Decode the flags byte (the first byte of the header) for a page
 1336: ** and initialize fields of the MemPage structure accordingly.
 1337: **
 1338: ** Only the following combinations are supported.  Anything different
 1339: ** indicates a corrupt database files:
 1340: **
 1341: **         PTF_ZERODATA
 1342: **         PTF_ZERODATA | PTF_LEAF
 1343: **         PTF_LEAFDATA | PTF_INTKEY
 1344: **         PTF_LEAFDATA | PTF_INTKEY | PTF_LEAF
 1345: */
 1346: static int decodeFlags(MemPage *pPage, int flagByte){
 1347:   BtShared *pBt;     /* A copy of pPage->pBt */
 1348: 
 1349:   assert( pPage->hdrOffset==(pPage->pgno==1 ? 100 : 0) );
 1350:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
 1351:   pPage->leaf = (u8)(flagByte>>3);  assert( PTF_LEAF == 1<<3 );
 1352:   flagByte &= ~PTF_LEAF;
 1353:   pPage->childPtrSize = 4-4*pPage->leaf;
 1354:   pBt = pPage->pBt;
 1355:   if( flagByte==(PTF_LEAFDATA | PTF_INTKEY) ){
 1356:     pPage->intKey = 1;
 1357:     pPage->hasData = pPage->leaf;
 1358:     pPage->maxLocal = pBt->maxLeaf;
 1359:     pPage->minLocal = pBt->minLeaf;
 1360:   }else if( flagByte==PTF_ZERODATA ){
 1361:     pPage->intKey = 0;
 1362:     pPage->hasData = 0;
 1363:     pPage->maxLocal = pBt->maxLocal;
 1364:     pPage->minLocal = pBt->minLocal;
 1365:   }else{
 1366:     return SQLITE_CORRUPT_BKPT;
 1367:   }
 1368:   pPage->max1bytePayload = pBt->max1bytePayload;
 1369:   return SQLITE_OK;
 1370: }
 1371: 
 1372: /*
 1373: ** Initialize the auxiliary information for a disk block.
 1374: **
 1375: ** Return SQLITE_OK on success.  If we see that the page does
 1376: ** not contain a well-formed database page, then return 
 1377: ** SQLITE_CORRUPT.  Note that a return of SQLITE_OK does not
 1378: ** guarantee that the page is well-formed.  It only shows that
 1379: ** we failed to detect any corruption.
 1380: */
 1381: static int btreeInitPage(MemPage *pPage){
 1382: 
 1383:   assert( pPage->pBt!=0 );
 1384:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
 1385:   assert( pPage->pgno==sqlite3PagerPagenumber(pPage->pDbPage) );
 1386:   assert( pPage == sqlite3PagerGetExtra(pPage->pDbPage) );
 1387:   assert( pPage->aData == sqlite3PagerGetData(pPage->pDbPage) );
 1388: 
 1389:   if( !pPage->isInit ){
 1390:     u16 pc;            /* Address of a freeblock within pPage->aData[] */
 1391:     u8 hdr;            /* Offset to beginning of page header */
 1392:     u8 *data;          /* Equal to pPage->aData */
 1393:     BtShared *pBt;        /* The main btree structure */
 1394:     int usableSize;    /* Amount of usable space on each page */
 1395:     u16 cellOffset;    /* Offset from start of page to first cell pointer */
 1396:     int nFree;         /* Number of unused bytes on the page */
 1397:     int top;           /* First byte of the cell content area */
 1398:     int iCellFirst;    /* First allowable cell or freeblock offset */
 1399:     int iCellLast;     /* Last possible cell or freeblock offset */
 1400: 
 1401:     pBt = pPage->pBt;
 1402: 
 1403:     hdr = pPage->hdrOffset;
 1404:     data = pPage->aData;
 1405:     if( decodeFlags(pPage, data[hdr]) ) return SQLITE_CORRUPT_BKPT;
 1406:     assert( pBt->pageSize>=512 && pBt->pageSize<=65536 );
 1407:     pPage->maskPage = (u16)(pBt->pageSize - 1);
 1408:     pPage->nOverflow = 0;
 1409:     usableSize = pBt->usableSize;
 1410:     pPage->cellOffset = cellOffset = hdr + 12 - 4*pPage->leaf;
 1411:     pPage->aDataEnd = &data[usableSize];
 1412:     pPage->aCellIdx = &data[cellOffset];
 1413:     top = get2byteNotZero(&data[hdr+5]);
 1414:     pPage->nCell = get2byte(&data[hdr+3]);
 1415:     if( pPage->nCell>MX_CELL(pBt) ){
 1416:       /* To many cells for a single page.  The page must be corrupt */
 1417:       return SQLITE_CORRUPT_BKPT;
 1418:     }
 1419:     testcase( pPage->nCell==MX_CELL(pBt) );
 1420: 
 1421:     /* A malformed database page might cause us to read past the end
 1422:     ** of page when parsing a cell.  
 1423:     **
 1424:     ** The following block of code checks early to see if a cell extends
 1425:     ** past the end of a page boundary and causes SQLITE_CORRUPT to be 
 1426:     ** returned if it does.
 1427:     */
 1428:     iCellFirst = cellOffset + 2*pPage->nCell;
 1429:     iCellLast = usableSize - 4;
 1430: #if defined(SQLITE_ENABLE_OVERSIZE_CELL_CHECK)
 1431:     {
 1432:       int i;            /* Index into the cell pointer array */
 1433:       int sz;           /* Size of a cell */
 1434: 
 1435:       if( !pPage->leaf ) iCellLast--;
 1436:       for(i=0; i<pPage->nCell; i++){
 1437:         pc = get2byte(&data[cellOffset+i*2]);
 1438:         testcase( pc==iCellFirst );
 1439:         testcase( pc==iCellLast );
 1440:         if( pc<iCellFirst || pc>iCellLast ){
 1441:           return SQLITE_CORRUPT_BKPT;
 1442:         }
 1443:         sz = cellSizePtr(pPage, &data[pc]);
 1444:         testcase( pc+sz==usableSize );
 1445:         if( pc+sz>usableSize ){
 1446:           return SQLITE_CORRUPT_BKPT;
 1447:         }
 1448:       }
 1449:       if( !pPage->leaf ) iCellLast++;
 1450:     }  
 1451: #endif
 1452: 
 1453:     /* Compute the total free space on the page */
 1454:     pc = get2byte(&data[hdr+1]);
 1455:     nFree = data[hdr+7] + top;
 1456:     while( pc>0 ){
 1457:       u16 next, size;
 1458:       if( pc<iCellFirst || pc>iCellLast ){
 1459:         /* Start of free block is off the page */
 1460:         return SQLITE_CORRUPT_BKPT; 
 1461:       }
 1462:       next = get2byte(&data[pc]);
 1463:       size = get2byte(&data[pc+2]);
 1464:       if( (next>0 && next<=pc+size+3) || pc+size>usableSize ){
 1465:         /* Free blocks must be in ascending order. And the last byte of
 1466: 	** the free-block must lie on the database page.  */
 1467:         return SQLITE_CORRUPT_BKPT; 
 1468:       }
 1469:       nFree = nFree + size;
 1470:       pc = next;
 1471:     }
 1472: 
 1473:     /* At this point, nFree contains the sum of the offset to the start
 1474:     ** of the cell-content area plus the number of free bytes within
 1475:     ** the cell-content area. If this is greater than the usable-size
 1476:     ** of the page, then the page must be corrupted. This check also
 1477:     ** serves to verify that the offset to the start of the cell-content
 1478:     ** area, according to the page header, lies within the page.
 1479:     */
 1480:     if( nFree>usableSize ){
 1481:       return SQLITE_CORRUPT_BKPT; 
 1482:     }
 1483:     pPage->nFree = (u16)(nFree - iCellFirst);
 1484:     pPage->isInit = 1;
 1485:   }
 1486:   return SQLITE_OK;
 1487: }
 1488: 
 1489: /*
 1490: ** Set up a raw page so that it looks like a database page holding
 1491: ** no entries.
 1492: */
 1493: static void zeroPage(MemPage *pPage, int flags){
 1494:   unsigned char *data = pPage->aData;
 1495:   BtShared *pBt = pPage->pBt;
 1496:   u8 hdr = pPage->hdrOffset;
 1497:   u16 first;
 1498: 
 1499:   assert( sqlite3PagerPagenumber(pPage->pDbPage)==pPage->pgno );
 1500:   assert( sqlite3PagerGetExtra(pPage->pDbPage) == (void*)pPage );
 1501:   assert( sqlite3PagerGetData(pPage->pDbPage) == data );
 1502:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
 1503:   assert( sqlite3_mutex_held(pBt->mutex) );
 1504:   if( pBt->btsFlags & BTS_SECURE_DELETE ){
 1505:     memset(&data[hdr], 0, pBt->usableSize - hdr);
 1506:   }
 1507:   data[hdr] = (char)flags;
 1508:   first = hdr + 8 + 4*((flags&PTF_LEAF)==0 ?1:0);
 1509:   memset(&data[hdr+1], 0, 4);
 1510:   data[hdr+7] = 0;
 1511:   put2byte(&data[hdr+5], pBt->usableSize);
 1512:   pPage->nFree = (u16)(pBt->usableSize - first);
 1513:   decodeFlags(pPage, flags);
 1514:   pPage->hdrOffset = hdr;
 1515:   pPage->cellOffset = first;
 1516:   pPage->aDataEnd = &data[pBt->usableSize];
 1517:   pPage->aCellIdx = &data[first];
 1518:   pPage->nOverflow = 0;
 1519:   assert( pBt->pageSize>=512 && pBt->pageSize<=65536 );
 1520:   pPage->maskPage = (u16)(pBt->pageSize - 1);
 1521:   pPage->nCell = 0;
 1522:   pPage->isInit = 1;
 1523: }
 1524: 
 1525: 
 1526: /*
 1527: ** Convert a DbPage obtained from the pager into a MemPage used by
 1528: ** the btree layer.
 1529: */
 1530: static MemPage *btreePageFromDbPage(DbPage *pDbPage, Pgno pgno, BtShared *pBt){
 1531:   MemPage *pPage = (MemPage*)sqlite3PagerGetExtra(pDbPage);
 1532:   pPage->aData = sqlite3PagerGetData(pDbPage);
 1533:   pPage->pDbPage = pDbPage;
 1534:   pPage->pBt = pBt;
 1535:   pPage->pgno = pgno;
 1536:   pPage->hdrOffset = pPage->pgno==1 ? 100 : 0;
 1537:   return pPage; 
 1538: }
 1539: 
 1540: /*
 1541: ** Get a page from the pager.  Initialize the MemPage.pBt and
 1542: ** MemPage.aData elements if needed.
 1543: **
 1544: ** If the noContent flag is set, it means that we do not care about
 1545: ** the content of the page at this time.  So do not go to the disk
 1546: ** to fetch the content.  Just fill in the content with zeros for now.
 1547: ** If in the future we call sqlite3PagerWrite() on this page, that
 1548: ** means we have started to be concerned about content and the disk
 1549: ** read should occur at that point.
 1550: */
 1551: static int btreeGetPage(
 1552:   BtShared *pBt,       /* The btree */
 1553:   Pgno pgno,           /* Number of the page to fetch */
 1554:   MemPage **ppPage,    /* Return the page in this parameter */
 1555:   int noContent        /* Do not load page content if true */
 1556: ){
 1557:   int rc;
 1558:   DbPage *pDbPage;
 1559: 
 1560:   assert( sqlite3_mutex_held(pBt->mutex) );
 1561:   rc = sqlite3PagerAcquire(pBt->pPager, pgno, (DbPage**)&pDbPage, noContent);
 1562:   if( rc ) return rc;
 1563:   *ppPage = btreePageFromDbPage(pDbPage, pgno, pBt);
 1564:   return SQLITE_OK;
 1565: }
 1566: 
 1567: /*
 1568: ** Retrieve a page from the pager cache. If the requested page is not
 1569: ** already in the pager cache return NULL. Initialize the MemPage.pBt and
 1570: ** MemPage.aData elements if needed.
 1571: */
 1572: static MemPage *btreePageLookup(BtShared *pBt, Pgno pgno){
 1573:   DbPage *pDbPage;
 1574:   assert( sqlite3_mutex_held(pBt->mutex) );
 1575:   pDbPage = sqlite3PagerLookup(pBt->pPager, pgno);
 1576:   if( pDbPage ){
 1577:     return btreePageFromDbPage(pDbPage, pgno, pBt);
 1578:   }
 1579:   return 0;
 1580: }
 1581: 
 1582: /*
 1583: ** Return the size of the database file in pages. If there is any kind of
 1584: ** error, return ((unsigned int)-1).
 1585: */
 1586: static Pgno btreePagecount(BtShared *pBt){
 1587:   return pBt->nPage;
 1588: }
 1589: u32 sqlite3BtreeLastPage(Btree *p){
 1590:   assert( sqlite3BtreeHoldsMutex(p) );
 1591:   assert( ((p->pBt->nPage)&0x8000000)==0 );
 1592:   return (int)btreePagecount(p->pBt);
 1593: }
 1594: 
 1595: /*
 1596: ** Get a page from the pager and initialize it.  This routine is just a
 1597: ** convenience wrapper around separate calls to btreeGetPage() and 
 1598: ** btreeInitPage().
 1599: **
 1600: ** If an error occurs, then the value *ppPage is set to is undefined. It
 1601: ** may remain unchanged, or it may be set to an invalid value.
 1602: */
 1603: static int getAndInitPage(
 1604:   BtShared *pBt,          /* The database file */
 1605:   Pgno pgno,           /* Number of the page to get */
 1606:   MemPage **ppPage     /* Write the page pointer here */
 1607: ){
 1608:   int rc;
 1609:   assert( sqlite3_mutex_held(pBt->mutex) );
 1610: 
 1611:   if( pgno>btreePagecount(pBt) ){
 1612:     rc = SQLITE_CORRUPT_BKPT;
 1613:   }else{
 1614:     rc = btreeGetPage(pBt, pgno, ppPage, 0);
 1615:     if( rc==SQLITE_OK ){
 1616:       rc = btreeInitPage(*ppPage);
 1617:       if( rc!=SQLITE_OK ){
 1618:         releasePage(*ppPage);
 1619:       }
 1620:     }
 1621:   }
 1622: 
 1623:   testcase( pgno==0 );
 1624:   assert( pgno!=0 || rc==SQLITE_CORRUPT );
 1625:   return rc;
 1626: }
 1627: 
 1628: /*
 1629: ** Release a MemPage.  This should be called once for each prior
 1630: ** call to btreeGetPage.
 1631: */
 1632: static void releasePage(MemPage *pPage){
 1633:   if( pPage ){
 1634:     assert( pPage->aData );
 1635:     assert( pPage->pBt );
 1636:     assert( sqlite3PagerGetExtra(pPage->pDbPage) == (void*)pPage );
 1637:     assert( sqlite3PagerGetData(pPage->pDbPage)==pPage->aData );
 1638:     assert( sqlite3_mutex_held(pPage->pBt->mutex) );
 1639:     sqlite3PagerUnref(pPage->pDbPage);
 1640:   }
 1641: }
 1642: 
 1643: /*
 1644: ** During a rollback, when the pager reloads information into the cache
 1645: ** so that the cache is restored to its original state at the start of
 1646: ** the transaction, for each page restored this routine is called.
 1647: **
 1648: ** This routine needs to reset the extra data section at the end of the
 1649: ** page to agree with the restored data.
 1650: */
 1651: static void pageReinit(DbPage *pData){
 1652:   MemPage *pPage;
 1653:   pPage = (MemPage *)sqlite3PagerGetExtra(pData);
 1654:   assert( sqlite3PagerPageRefcount(pData)>0 );
 1655:   if( pPage->isInit ){
 1656:     assert( sqlite3_mutex_held(pPage->pBt->mutex) );
 1657:     pPage->isInit = 0;
 1658:     if( sqlite3PagerPageRefcount(pData)>1 ){
 1659:       /* pPage might not be a btree page;  it might be an overflow page
 1660:       ** or ptrmap page or a free page.  In those cases, the following
 1661:       ** call to btreeInitPage() will likely return SQLITE_CORRUPT.
 1662:       ** But no harm is done by this.  And it is very important that
 1663:       ** btreeInitPage() be called on every btree page so we make
 1664:       ** the call for every page that comes in for re-initing. */
 1665:       btreeInitPage(pPage);
 1666:     }
 1667:   }
 1668: }
 1669: 
 1670: /*
 1671: ** Invoke the busy handler for a btree.
 1672: */
 1673: static int btreeInvokeBusyHandler(void *pArg){
 1674:   BtShared *pBt = (BtShared*)pArg;
 1675:   assert( pBt->db );
 1676:   assert( sqlite3_mutex_held(pBt->db->mutex) );
 1677:   return sqlite3InvokeBusyHandler(&pBt->db->busyHandler);
 1678: }
 1679: 
 1680: /*
 1681: ** Open a database file.
 1682: ** 
 1683: ** zFilename is the name of the database file.  If zFilename is NULL
 1684: ** then an ephemeral database is created.  The ephemeral database might
 1685: ** be exclusively in memory, or it might use a disk-based memory cache.
 1686: ** Either way, the ephemeral database will be automatically deleted 
 1687: ** when sqlite3BtreeClose() is called.
 1688: **
 1689: ** If zFilename is ":memory:" then an in-memory database is created
 1690: ** that is automatically destroyed when it is closed.
 1691: **
 1692: ** The "flags" parameter is a bitmask that might contain bits
 1693: ** BTREE_OMIT_JOURNAL and/or BTREE_NO_READLOCK.  The BTREE_NO_READLOCK
 1694: ** bit is also set if the SQLITE_NoReadlock flags is set in db->flags.
 1695: ** These flags are passed through into sqlite3PagerOpen() and must
 1696: ** be the same values as PAGER_OMIT_JOURNAL and PAGER_NO_READLOCK.
 1697: **
 1698: ** If the database is already opened in the same database connection
 1699: ** and we are in shared cache mode, then the open will fail with an
 1700: ** SQLITE_CONSTRAINT error.  We cannot allow two or more BtShared
 1701: ** objects in the same database connection since doing so will lead
 1702: ** to problems with locking.
 1703: */
 1704: int sqlite3BtreeOpen(
 1705:   sqlite3_vfs *pVfs,      /* VFS to use for this b-tree */
 1706:   const char *zFilename,  /* Name of the file containing the BTree database */
 1707:   sqlite3 *db,            /* Associated database handle */
 1708:   Btree **ppBtree,        /* Pointer to new Btree object written here */
 1709:   int flags,              /* Options */
 1710:   int vfsFlags            /* Flags passed through to sqlite3_vfs.xOpen() */
 1711: ){
 1712:   BtShared *pBt = 0;             /* Shared part of btree structure */
 1713:   Btree *p;                      /* Handle to return */
 1714:   sqlite3_mutex *mutexOpen = 0;  /* Prevents a race condition. Ticket #3537 */
 1715:   int rc = SQLITE_OK;            /* Result code from this function */
 1716:   u8 nReserve;                   /* Byte of unused space on each page */
 1717:   unsigned char zDbHeader[100];  /* Database header content */
 1718: 
 1719:   /* True if opening an ephemeral, temporary database */
 1720:   const int isTempDb = zFilename==0 || zFilename[0]==0;
 1721: 
 1722:   /* Set the variable isMemdb to true for an in-memory database, or 
 1723:   ** false for a file-based database.
 1724:   */
 1725: #ifdef SQLITE_OMIT_MEMORYDB
 1726:   const int isMemdb = 0;
 1727: #else
 1728:   const int isMemdb = (zFilename && strcmp(zFilename, ":memory:")==0)
 1729:                        || (isTempDb && sqlite3TempInMemory(db));
 1730: #endif
 1731: 
 1732:   assert( db!=0 );
 1733:   assert( pVfs!=0 );
 1734:   assert( sqlite3_mutex_held(db->mutex) );
 1735:   assert( (flags&0xff)==flags );   /* flags fit in 8 bits */
 1736: 
 1737:   /* Only a BTREE_SINGLE database can be BTREE_UNORDERED */
 1738:   assert( (flags & BTREE_UNORDERED)==0 || (flags & BTREE_SINGLE)!=0 );
 1739: 
 1740:   /* A BTREE_SINGLE database is always a temporary and/or ephemeral */
 1741:   assert( (flags & BTREE_SINGLE)==0 || isTempDb );
 1742: 
 1743:   if( db->flags & SQLITE_NoReadlock ){
 1744:     flags |= BTREE_NO_READLOCK;
 1745:   }
 1746:   if( isMemdb ){
 1747:     flags |= BTREE_MEMORY;
 1748:   }
 1749:   if( (vfsFlags & SQLITE_OPEN_MAIN_DB)!=0 && (isMemdb || isTempDb) ){
 1750:     vfsFlags = (vfsFlags & ~SQLITE_OPEN_MAIN_DB) | SQLITE_OPEN_TEMP_DB;
 1751:   }
 1752:   p = sqlite3MallocZero(sizeof(Btree));
 1753:   if( !p ){
 1754:     return SQLITE_NOMEM;
 1755:   }
 1756:   p->inTrans = TRANS_NONE;
 1757:   p->db = db;
 1758: #ifndef SQLITE_OMIT_SHARED_CACHE
 1759:   p->lock.pBtree = p;
 1760:   p->lock.iTable = 1;
 1761: #endif
 1762: 
 1763: #if !defined(SQLITE_OMIT_SHARED_CACHE) && !defined(SQLITE_OMIT_DISKIO)
 1764:   /*
 1765:   ** If this Btree is a candidate for shared cache, try to find an
 1766:   ** existing BtShared object that we can share with
 1767:   */
 1768:   if( isMemdb==0 && isTempDb==0 ){
 1769:     if( vfsFlags & SQLITE_OPEN_SHAREDCACHE ){
 1770:       int nFullPathname = pVfs->mxPathname+1;
 1771:       char *zFullPathname = sqlite3Malloc(nFullPathname);
 1772:       MUTEX_LOGIC( sqlite3_mutex *mutexShared; )
 1773:       p->sharable = 1;
 1774:       if( !zFullPathname ){
 1775:         sqlite3_free(p);
 1776:         return SQLITE_NOMEM;
 1777:       }
 1778:       rc = sqlite3OsFullPathname(pVfs, zFilename, nFullPathname, zFullPathname);
 1779:       if( rc ){
 1780:         sqlite3_free(zFullPathname);
 1781:         sqlite3_free(p);
 1782:         return rc;
 1783:       }
 1784: #if SQLITE_THREADSAFE
 1785:       mutexOpen = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_OPEN);
 1786:       sqlite3_mutex_enter(mutexOpen);
 1787:       mutexShared = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER);
 1788:       sqlite3_mutex_enter(mutexShared);
 1789: #endif
 1790:       for(pBt=GLOBAL(BtShared*,sqlite3SharedCacheList); pBt; pBt=pBt->pNext){
 1791:         assert( pBt->nRef>0 );
 1792:         if( 0==strcmp(zFullPathname, sqlite3PagerFilename(pBt->pPager))
 1793:                  && sqlite3PagerVfs(pBt->pPager)==pVfs ){
 1794:           int iDb;
 1795:           for(iDb=db->nDb-1; iDb>=0; iDb--){
 1796:             Btree *pExisting = db->aDb[iDb].pBt;
 1797:             if( pExisting && pExisting->pBt==pBt ){
 1798:               sqlite3_mutex_leave(mutexShared);
 1799:               sqlite3_mutex_leave(mutexOpen);
 1800:               sqlite3_free(zFullPathname);
 1801:               sqlite3_free(p);
 1802:               return SQLITE_CONSTRAINT;
 1803:             }
 1804:           }
 1805:           p->pBt = pBt;
 1806:           pBt->nRef++;
 1807:           break;
 1808:         }
 1809:       }
 1810:       sqlite3_mutex_leave(mutexShared);
 1811:       sqlite3_free(zFullPathname);
 1812:     }
 1813: #ifdef SQLITE_DEBUG
 1814:     else{
 1815:       /* In debug mode, we mark all persistent databases as sharable
 1816:       ** even when they are not.  This exercises the locking code and
 1817:       ** gives more opportunity for asserts(sqlite3_mutex_held())
 1818:       ** statements to find locking problems.
 1819:       */
 1820:       p->sharable = 1;
 1821:     }
 1822: #endif
 1823:   }
 1824: #endif
 1825:   if( pBt==0 ){
 1826:     /*
 1827:     ** The following asserts make sure that structures used by the btree are
 1828:     ** the right size.  This is to guard against size changes that result
 1829:     ** when compiling on a different architecture.
 1830:     */
 1831:     assert( sizeof(i64)==8 || sizeof(i64)==4 );
 1832:     assert( sizeof(u64)==8 || sizeof(u64)==4 );
 1833:     assert( sizeof(u32)==4 );
 1834:     assert( sizeof(u16)==2 );
 1835:     assert( sizeof(Pgno)==4 );
 1836:   
 1837:     pBt = sqlite3MallocZero( sizeof(*pBt) );
 1838:     if( pBt==0 ){
 1839:       rc = SQLITE_NOMEM;
 1840:       goto btree_open_out;
 1841:     }
 1842:     rc = sqlite3PagerOpen(pVfs, &pBt->pPager, zFilename,
 1843:                           EXTRA_SIZE, flags, vfsFlags, pageReinit);
 1844:     if( rc==SQLITE_OK ){
 1845:       rc = sqlite3PagerReadFileheader(pBt->pPager,sizeof(zDbHeader),zDbHeader);
 1846:     }
 1847:     if( rc!=SQLITE_OK ){
 1848:       goto btree_open_out;
 1849:     }
 1850:     pBt->openFlags = (u8)flags;
 1851:     pBt->db = db;
 1852:     sqlite3PagerSetBusyhandler(pBt->pPager, btreeInvokeBusyHandler, pBt);
 1853:     p->pBt = pBt;
 1854:   
 1855:     pBt->pCursor = 0;
 1856:     pBt->pPage1 = 0;
 1857:     if( sqlite3PagerIsreadonly(pBt->pPager) ) pBt->btsFlags |= BTS_READ_ONLY;
 1858: #ifdef SQLITE_SECURE_DELETE
 1859:     pBt->btsFlags |= BTS_SECURE_DELETE;
 1860: #endif
 1861:     pBt->pageSize = (zDbHeader[16]<<8) | (zDbHeader[17]<<16);
 1862:     if( pBt->pageSize<512 || pBt->pageSize>SQLITE_MAX_PAGE_SIZE
 1863:          || ((pBt->pageSize-1)&pBt->pageSize)!=0 ){
 1864:       pBt->pageSize = 0;
 1865: #ifndef SQLITE_OMIT_AUTOVACUUM
 1866:       /* If the magic name ":memory:" will create an in-memory database, then
 1867:       ** leave the autoVacuum mode at 0 (do not auto-vacuum), even if
 1868:       ** SQLITE_DEFAULT_AUTOVACUUM is true. On the other hand, if
 1869:       ** SQLITE_OMIT_MEMORYDB has been defined, then ":memory:" is just a
 1870:       ** regular file-name. In this case the auto-vacuum applies as per normal.
 1871:       */
 1872:       if( zFilename && !isMemdb ){
 1873:         pBt->autoVacuum = (SQLITE_DEFAULT_AUTOVACUUM ? 1 : 0);
 1874:         pBt->incrVacuum = (SQLITE_DEFAULT_AUTOVACUUM==2 ? 1 : 0);
 1875:       }
 1876: #endif
 1877:       nReserve = 0;
 1878:     }else{
 1879:       nReserve = zDbHeader[20];
 1880:       pBt->btsFlags |= BTS_PAGESIZE_FIXED;
 1881: #ifndef SQLITE_OMIT_AUTOVACUUM
 1882:       pBt->autoVacuum = (get4byte(&zDbHeader[36 + 4*4])?1:0);
 1883:       pBt->incrVacuum = (get4byte(&zDbHeader[36 + 7*4])?1:0);
 1884: #endif
 1885:     }
 1886:     rc = sqlite3PagerSetPagesize(pBt->pPager, &pBt->pageSize, nReserve);
 1887:     if( rc ) goto btree_open_out;
 1888:     pBt->usableSize = pBt->pageSize - nReserve;
 1889:     assert( (pBt->pageSize & 7)==0 );  /* 8-byte alignment of pageSize */
 1890:    
 1891: #if !defined(SQLITE_OMIT_SHARED_CACHE) && !defined(SQLITE_OMIT_DISKIO)
 1892:     /* Add the new BtShared object to the linked list sharable BtShareds.
 1893:     */
 1894:     if( p->sharable ){
 1895:       MUTEX_LOGIC( sqlite3_mutex *mutexShared; )
 1896:       pBt->nRef = 1;
 1897:       MUTEX_LOGIC( mutexShared = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER);)
 1898:       if( SQLITE_THREADSAFE && sqlite3GlobalConfig.bCoreMutex ){
 1899:         pBt->mutex = sqlite3MutexAlloc(SQLITE_MUTEX_FAST);
 1900:         if( pBt->mutex==0 ){
 1901:           rc = SQLITE_NOMEM;
 1902:           db->mallocFailed = 0;
 1903:           goto btree_open_out;
 1904:         }
 1905:       }
 1906:       sqlite3_mutex_enter(mutexShared);
 1907:       pBt->pNext = GLOBAL(BtShared*,sqlite3SharedCacheList);
 1908:       GLOBAL(BtShared*,sqlite3SharedCacheList) = pBt;
 1909:       sqlite3_mutex_leave(mutexShared);
 1910:     }
 1911: #endif
 1912:   }
 1913: 
 1914: #if !defined(SQLITE_OMIT_SHARED_CACHE) && !defined(SQLITE_OMIT_DISKIO)
 1915:   /* If the new Btree uses a sharable pBtShared, then link the new
 1916:   ** Btree into the list of all sharable Btrees for the same connection.
 1917:   ** The list is kept in ascending order by pBt address.
 1918:   */
 1919:   if( p->sharable ){
 1920:     int i;
 1921:     Btree *pSib;
 1922:     for(i=0; i<db->nDb; i++){
 1923:       if( (pSib = db->aDb[i].pBt)!=0 && pSib->sharable ){
 1924:         while( pSib->pPrev ){ pSib = pSib->pPrev; }
 1925:         if( p->pBt<pSib->pBt ){
 1926:           p->pNext = pSib;
 1927:           p->pPrev = 0;
 1928:           pSib->pPrev = p;
 1929:         }else{
 1930:           while( pSib->pNext && pSib->pNext->pBt<p->pBt ){
 1931:             pSib = pSib->pNext;
 1932:           }
 1933:           p->pNext = pSib->pNext;
 1934:           p->pPrev = pSib;
 1935:           if( p->pNext ){
 1936:             p->pNext->pPrev = p;
 1937:           }
 1938:           pSib->pNext = p;
 1939:         }
 1940:         break;
 1941:       }
 1942:     }
 1943:   }
 1944: #endif
 1945:   *ppBtree = p;
 1946: 
 1947: btree_open_out:
 1948:   if( rc!=SQLITE_OK ){
 1949:     if( pBt && pBt->pPager ){
 1950:       sqlite3PagerClose(pBt->pPager);
 1951:     }
 1952:     sqlite3_free(pBt);
 1953:     sqlite3_free(p);
 1954:     *ppBtree = 0;
 1955:   }else{
 1956:     /* If the B-Tree was successfully opened, set the pager-cache size to the
 1957:     ** default value. Except, when opening on an existing shared pager-cache,
 1958:     ** do not change the pager-cache size.
 1959:     */
 1960:     if( sqlite3BtreeSchema(p, 0, 0)==0 ){
 1961:       sqlite3PagerSetCachesize(p->pBt->pPager, SQLITE_DEFAULT_CACHE_SIZE);
 1962:     }
 1963:   }
 1964:   if( mutexOpen ){
 1965:     assert( sqlite3_mutex_held(mutexOpen) );
 1966:     sqlite3_mutex_leave(mutexOpen);
 1967:   }
 1968:   return rc;
 1969: }
 1970: 
 1971: /*
 1972: ** Decrement the BtShared.nRef counter.  When it reaches zero,
 1973: ** remove the BtShared structure from the sharing list.  Return
 1974: ** true if the BtShared.nRef counter reaches zero and return
 1975: ** false if it is still positive.
 1976: */
 1977: static int removeFromSharingList(BtShared *pBt){
 1978: #ifndef SQLITE_OMIT_SHARED_CACHE
 1979:   MUTEX_LOGIC( sqlite3_mutex *pMaster; )
 1980:   BtShared *pList;
 1981:   int removed = 0;
 1982: 
 1983:   assert( sqlite3_mutex_notheld(pBt->mutex) );
 1984:   MUTEX_LOGIC( pMaster = sqlite3MutexAlloc(SQLITE_MUTEX_STATIC_MASTER); )
 1985:   sqlite3_mutex_enter(pMaster);
 1986:   pBt->nRef--;
 1987:   if( pBt->nRef<=0 ){
 1988:     if( GLOBAL(BtShared*,sqlite3SharedCacheList)==pBt ){
 1989:       GLOBAL(BtShared*,sqlite3SharedCacheList) = pBt->pNext;
 1990:     }else{
 1991:       pList = GLOBAL(BtShared*,sqlite3SharedCacheList);
 1992:       while( ALWAYS(pList) && pList->pNext!=pBt ){
 1993:         pList=pList->pNext;
 1994:       }
 1995:       if( ALWAYS(pList) ){
 1996:         pList->pNext = pBt->pNext;
 1997:       }
 1998:     }
 1999:     if( SQLITE_THREADSAFE ){
 2000:       sqlite3_mutex_free(pBt->mutex);
 2001:     }
 2002:     removed = 1;
 2003:   }
 2004:   sqlite3_mutex_leave(pMaster);
 2005:   return removed;
 2006: #else
 2007:   return 1;
 2008: #endif
 2009: }
 2010: 
 2011: /*
 2012: ** Make sure pBt->pTmpSpace points to an allocation of 
 2013: ** MX_CELL_SIZE(pBt) bytes.
 2014: */
 2015: static void allocateTempSpace(BtShared *pBt){
 2016:   if( !pBt->pTmpSpace ){
 2017:     pBt->pTmpSpace = sqlite3PageMalloc( pBt->pageSize );
 2018:   }
 2019: }
 2020: 
 2021: /*
 2022: ** Free the pBt->pTmpSpace allocation
 2023: */
 2024: static void freeTempSpace(BtShared *pBt){
 2025:   sqlite3PageFree( pBt->pTmpSpace);
 2026:   pBt->pTmpSpace = 0;
 2027: }
 2028: 
 2029: /*
 2030: ** Close an open database and invalidate all cursors.
 2031: */
 2032: int sqlite3BtreeClose(Btree *p){
 2033:   BtShared *pBt = p->pBt;
 2034:   BtCursor *pCur;
 2035: 
 2036:   /* Close all cursors opened via this handle.  */
 2037:   assert( sqlite3_mutex_held(p->db->mutex) );
 2038:   sqlite3BtreeEnter(p);
 2039:   pCur = pBt->pCursor;
 2040:   while( pCur ){
 2041:     BtCursor *pTmp = pCur;
 2042:     pCur = pCur->pNext;
 2043:     if( pTmp->pBtree==p ){
 2044:       sqlite3BtreeCloseCursor(pTmp);
 2045:     }
 2046:   }
 2047: 
 2048:   /* Rollback any active transaction and free the handle structure.
 2049:   ** The call to sqlite3BtreeRollback() drops any table-locks held by
 2050:   ** this handle.
 2051:   */
 2052:   sqlite3BtreeRollback(p);
 2053:   sqlite3BtreeLeave(p);
 2054: 
 2055:   /* If there are still other outstanding references to the shared-btree
 2056:   ** structure, return now. The remainder of this procedure cleans 
 2057:   ** up the shared-btree.
 2058:   */
 2059:   assert( p->wantToLock==0 && p->locked==0 );
 2060:   if( !p->sharable || removeFromSharingList(pBt) ){
 2061:     /* The pBt is no longer on the sharing list, so we can access
 2062:     ** it without having to hold the mutex.
 2063:     **
 2064:     ** Clean out and delete the BtShared object.
 2065:     */
 2066:     assert( !pBt->pCursor );
 2067:     sqlite3PagerClose(pBt->pPager);
 2068:     if( pBt->xFreeSchema && pBt->pSchema ){
 2069:       pBt->xFreeSchema(pBt->pSchema);
 2070:     }
 2071:     sqlite3DbFree(0, pBt->pSchema);
 2072:     freeTempSpace(pBt);
 2073:     sqlite3_free(pBt);
 2074:   }
 2075: 
 2076: #ifndef SQLITE_OMIT_SHARED_CACHE
 2077:   assert( p->wantToLock==0 );
 2078:   assert( p->locked==0 );
 2079:   if( p->pPrev ) p->pPrev->pNext = p->pNext;
 2080:   if( p->pNext ) p->pNext->pPrev = p->pPrev;
 2081: #endif
 2082: 
 2083:   sqlite3_free(p);
 2084:   return SQLITE_OK;
 2085: }
 2086: 
 2087: /*
 2088: ** Change the limit on the number of pages allowed in the cache.
 2089: **
 2090: ** The maximum number of cache pages is set to the absolute
 2091: ** value of mxPage.  If mxPage is negative, the pager will
 2092: ** operate asynchronously - it will not stop to do fsync()s
 2093: ** to insure data is written to the disk surface before
 2094: ** continuing.  Transactions still work if synchronous is off,
 2095: ** and the database cannot be corrupted if this program
 2096: ** crashes.  But if the operating system crashes or there is
 2097: ** an abrupt power failure when synchronous is off, the database
 2098: ** could be left in an inconsistent and unrecoverable state.
 2099: ** Synchronous is on by default so database corruption is not
 2100: ** normally a worry.
 2101: */
 2102: int sqlite3BtreeSetCacheSize(Btree *p, int mxPage){
 2103:   BtShared *pBt = p->pBt;
 2104:   assert( sqlite3_mutex_held(p->db->mutex) );
 2105:   sqlite3BtreeEnter(p);
 2106:   sqlite3PagerSetCachesize(pBt->pPager, mxPage);
 2107:   sqlite3BtreeLeave(p);
 2108:   return SQLITE_OK;
 2109: }
 2110: 
 2111: /*
 2112: ** Change the way data is synced to disk in order to increase or decrease
 2113: ** how well the database resists damage due to OS crashes and power
 2114: ** failures.  Level 1 is the same as asynchronous (no syncs() occur and
 2115: ** there is a high probability of damage)  Level 2 is the default.  There
 2116: ** is a very low but non-zero probability of damage.  Level 3 reduces the
 2117: ** probability of damage to near zero but with a write performance reduction.
 2118: */
 2119: #ifndef SQLITE_OMIT_PAGER_PRAGMAS
 2120: int sqlite3BtreeSetSafetyLevel(
 2121:   Btree *p,              /* The btree to set the safety level on */
 2122:   int level,             /* PRAGMA synchronous.  1=OFF, 2=NORMAL, 3=FULL */
 2123:   int fullSync,          /* PRAGMA fullfsync. */
 2124:   int ckptFullSync       /* PRAGMA checkpoint_fullfync */
 2125: ){
 2126:   BtShared *pBt = p->pBt;
 2127:   assert( sqlite3_mutex_held(p->db->mutex) );
 2128:   assert( level>=1 && level<=3 );
 2129:   sqlite3BtreeEnter(p);
 2130:   sqlite3PagerSetSafetyLevel(pBt->pPager, level, fullSync, ckptFullSync);
 2131:   sqlite3BtreeLeave(p);
 2132:   return SQLITE_OK;
 2133: }
 2134: #endif
 2135: 
 2136: /*
 2137: ** Return TRUE if the given btree is set to safety level 1.  In other
 2138: ** words, return TRUE if no sync() occurs on the disk files.
 2139: */
 2140: int sqlite3BtreeSyncDisabled(Btree *p){
 2141:   BtShared *pBt = p->pBt;
 2142:   int rc;
 2143:   assert( sqlite3_mutex_held(p->db->mutex) );  
 2144:   sqlite3BtreeEnter(p);
 2145:   assert( pBt && pBt->pPager );
 2146:   rc = sqlite3PagerNosync(pBt->pPager);
 2147:   sqlite3BtreeLeave(p);
 2148:   return rc;
 2149: }
 2150: 
 2151: /*
 2152: ** Change the default pages size and the number of reserved bytes per page.
 2153: ** Or, if the page size has already been fixed, return SQLITE_READONLY 
 2154: ** without changing anything.
 2155: **
 2156: ** The page size must be a power of 2 between 512 and 65536.  If the page
 2157: ** size supplied does not meet this constraint then the page size is not
 2158: ** changed.
 2159: **
 2160: ** Page sizes are constrained to be a power of two so that the region
 2161: ** of the database file used for locking (beginning at PENDING_BYTE,
 2162: ** the first byte past the 1GB boundary, 0x40000000) needs to occur
 2163: ** at the beginning of a page.
 2164: **
 2165: ** If parameter nReserve is less than zero, then the number of reserved
 2166: ** bytes per page is left unchanged.
 2167: **
 2168: ** If the iFix!=0 then the BTS_PAGESIZE_FIXED flag is set so that the page size
 2169: ** and autovacuum mode can no longer be changed.
 2170: */
 2171: int sqlite3BtreeSetPageSize(Btree *p, int pageSize, int nReserve, int iFix){
 2172:   int rc = SQLITE_OK;
 2173:   BtShared *pBt = p->pBt;
 2174:   assert( nReserve>=-1 && nReserve<=255 );
 2175:   sqlite3BtreeEnter(p);
 2176:   if( pBt->btsFlags & BTS_PAGESIZE_FIXED ){
 2177:     sqlite3BtreeLeave(p);
 2178:     return SQLITE_READONLY;
 2179:   }
 2180:   if( nReserve<0 ){
 2181:     nReserve = pBt->pageSize - pBt->usableSize;
 2182:   }
 2183:   assert( nReserve>=0 && nReserve<=255 );
 2184:   if( pageSize>=512 && pageSize<=SQLITE_MAX_PAGE_SIZE &&
 2185:         ((pageSize-1)&pageSize)==0 ){
 2186:     assert( (pageSize & 7)==0 );
 2187:     assert( !pBt->pPage1 && !pBt->pCursor );
 2188:     pBt->pageSize = (u32)pageSize;
 2189:     freeTempSpace(pBt);
 2190:   }
 2191:   rc = sqlite3PagerSetPagesize(pBt->pPager, &pBt->pageSize, nReserve);
 2192:   pBt->usableSize = pBt->pageSize - (u16)nReserve;
 2193:   if( iFix ) pBt->btsFlags |= BTS_PAGESIZE_FIXED;
 2194:   sqlite3BtreeLeave(p);
 2195:   return rc;
 2196: }
 2197: 
 2198: /*
 2199: ** Return the currently defined page size
 2200: */
 2201: int sqlite3BtreeGetPageSize(Btree *p){
 2202:   return p->pBt->pageSize;
 2203: }
 2204: 
 2205: #if !defined(SQLITE_OMIT_PAGER_PRAGMAS) || !defined(SQLITE_OMIT_VACUUM)
 2206: /*
 2207: ** Return the number of bytes of space at the end of every page that
 2208: ** are intentually left unused.  This is the "reserved" space that is
 2209: ** sometimes used by extensions.
 2210: */
 2211: int sqlite3BtreeGetReserve(Btree *p){
 2212:   int n;
 2213:   sqlite3BtreeEnter(p);
 2214:   n = p->pBt->pageSize - p->pBt->usableSize;
 2215:   sqlite3BtreeLeave(p);
 2216:   return n;
 2217: }
 2218: 
 2219: /*
 2220: ** Set the maximum page count for a database if mxPage is positive.
 2221: ** No changes are made if mxPage is 0 or negative.
 2222: ** Regardless of the value of mxPage, return the maximum page count.
 2223: */
 2224: int sqlite3BtreeMaxPageCount(Btree *p, int mxPage){
 2225:   int n;
 2226:   sqlite3BtreeEnter(p);
 2227:   n = sqlite3PagerMaxPageCount(p->pBt->pPager, mxPage);
 2228:   sqlite3BtreeLeave(p);
 2229:   return n;
 2230: }
 2231: 
 2232: /*
 2233: ** Set the BTS_SECURE_DELETE flag if newFlag is 0 or 1.  If newFlag is -1,
 2234: ** then make no changes.  Always return the value of the BTS_SECURE_DELETE
 2235: ** setting after the change.
 2236: */
 2237: int sqlite3BtreeSecureDelete(Btree *p, int newFlag){
 2238:   int b;
 2239:   if( p==0 ) return 0;
 2240:   sqlite3BtreeEnter(p);
 2241:   if( newFlag>=0 ){
 2242:     p->pBt->btsFlags &= ~BTS_SECURE_DELETE;
 2243:     if( newFlag ) p->pBt->btsFlags |= BTS_SECURE_DELETE;
 2244:   } 
 2245:   b = (p->pBt->btsFlags & BTS_SECURE_DELETE)!=0;
 2246:   sqlite3BtreeLeave(p);
 2247:   return b;
 2248: }
 2249: #endif /* !defined(SQLITE_OMIT_PAGER_PRAGMAS) || !defined(SQLITE_OMIT_VACUUM) */
 2250: 
 2251: /*
 2252: ** Change the 'auto-vacuum' property of the database. If the 'autoVacuum'
 2253: ** parameter is non-zero, then auto-vacuum mode is enabled. If zero, it
 2254: ** is disabled. The default value for the auto-vacuum property is 
 2255: ** determined by the SQLITE_DEFAULT_AUTOVACUUM macro.
 2256: */
 2257: int sqlite3BtreeSetAutoVacuum(Btree *p, int autoVacuum){
 2258: #ifdef SQLITE_OMIT_AUTOVACUUM
 2259:   return SQLITE_READONLY;
 2260: #else
 2261:   BtShared *pBt = p->pBt;
 2262:   int rc = SQLITE_OK;
 2263:   u8 av = (u8)autoVacuum;
 2264: 
 2265:   sqlite3BtreeEnter(p);
 2266:   if( (pBt->btsFlags & BTS_PAGESIZE_FIXED)!=0 && (av ?1:0)!=pBt->autoVacuum ){
 2267:     rc = SQLITE_READONLY;
 2268:   }else{
 2269:     pBt->autoVacuum = av ?1:0;
 2270:     pBt->incrVacuum = av==2 ?1:0;
 2271:   }
 2272:   sqlite3BtreeLeave(p);
 2273:   return rc;
 2274: #endif
 2275: }
 2276: 
 2277: /*
 2278: ** Return the value of the 'auto-vacuum' property. If auto-vacuum is 
 2279: ** enabled 1 is returned. Otherwise 0.
 2280: */
 2281: int sqlite3BtreeGetAutoVacuum(Btree *p){
 2282: #ifdef SQLITE_OMIT_AUTOVACUUM
 2283:   return BTREE_AUTOVACUUM_NONE;
 2284: #else
 2285:   int rc;
 2286:   sqlite3BtreeEnter(p);
 2287:   rc = (
 2288:     (!p->pBt->autoVacuum)?BTREE_AUTOVACUUM_NONE:
 2289:     (!p->pBt->incrVacuum)?BTREE_AUTOVACUUM_FULL:
 2290:     BTREE_AUTOVACUUM_INCR
 2291:   );
 2292:   sqlite3BtreeLeave(p);
 2293:   return rc;
 2294: #endif
 2295: }
 2296: 
 2297: 
 2298: /*
 2299: ** Get a reference to pPage1 of the database file.  This will
 2300: ** also acquire a readlock on that file.
 2301: **
 2302: ** SQLITE_OK is returned on success.  If the file is not a
 2303: ** well-formed database file, then SQLITE_CORRUPT is returned.
 2304: ** SQLITE_BUSY is returned if the database is locked.  SQLITE_NOMEM
 2305: ** is returned if we run out of memory. 
 2306: */
 2307: static int lockBtree(BtShared *pBt){
 2308:   int rc;              /* Result code from subfunctions */
 2309:   MemPage *pPage1;     /* Page 1 of the database file */
 2310:   int nPage;           /* Number of pages in the database */
 2311:   int nPageFile = 0;   /* Number of pages in the database file */
 2312:   int nPageHeader;     /* Number of pages in the database according to hdr */
 2313: 
 2314:   assert( sqlite3_mutex_held(pBt->mutex) );
 2315:   assert( pBt->pPage1==0 );
 2316:   rc = sqlite3PagerSharedLock(pBt->pPager);
 2317:   if( rc!=SQLITE_OK ) return rc;
 2318:   rc = btreeGetPage(pBt, 1, &pPage1, 0);
 2319:   if( rc!=SQLITE_OK ) return rc;
 2320: 
 2321:   /* Do some checking to help insure the file we opened really is
 2322:   ** a valid database file. 
 2323:   */
 2324:   nPage = nPageHeader = get4byte(28+(u8*)pPage1->aData);
 2325:   sqlite3PagerPagecount(pBt->pPager, &nPageFile);
 2326:   if( nPage==0 || memcmp(24+(u8*)pPage1->aData, 92+(u8*)pPage1->aData,4)!=0 ){
 2327:     nPage = nPageFile;
 2328:   }
 2329:   if( nPage>0 ){
 2330:     u32 pageSize;
 2331:     u32 usableSize;
 2332:     u8 *page1 = pPage1->aData;
 2333:     rc = SQLITE_NOTADB;
 2334:     if( memcmp(page1, zMagicHeader, 16)!=0 ){
 2335:       goto page1_init_failed;
 2336:     }
 2337: 
 2338: #ifdef SQLITE_OMIT_WAL
 2339:     if( page1[18]>1 ){
 2340:       pBt->btsFlags |= BTS_READ_ONLY;
 2341:     }
 2342:     if( page1[19]>1 ){
 2343:       goto page1_init_failed;
 2344:     }
 2345: #else
 2346:     if( page1[18]>2 ){
 2347:       pBt->btsFlags |= BTS_READ_ONLY;
 2348:     }
 2349:     if( page1[19]>2 ){
 2350:       goto page1_init_failed;
 2351:     }
 2352: 
 2353:     /* If the write version is set to 2, this database should be accessed
 2354:     ** in WAL mode. If the log is not already open, open it now. Then 
 2355:     ** return SQLITE_OK and return without populating BtShared.pPage1.
 2356:     ** The caller detects this and calls this function again. This is
 2357:     ** required as the version of page 1 currently in the page1 buffer
 2358:     ** may not be the latest version - there may be a newer one in the log
 2359:     ** file.
 2360:     */
 2361:     if( page1[19]==2 && (pBt->btsFlags & BTS_NO_WAL)==0 ){
 2362:       int isOpen = 0;
 2363:       rc = sqlite3PagerOpenWal(pBt->pPager, &isOpen);
 2364:       if( rc!=SQLITE_OK ){
 2365:         goto page1_init_failed;
 2366:       }else if( isOpen==0 ){
 2367:         releasePage(pPage1);
 2368:         return SQLITE_OK;
 2369:       }
 2370:       rc = SQLITE_NOTADB;
 2371:     }
 2372: #endif
 2373: 
 2374:     /* The maximum embedded fraction must be exactly 25%.  And the minimum
 2375:     ** embedded fraction must be 12.5% for both leaf-data and non-leaf-data.
 2376:     ** The original design allowed these amounts to vary, but as of
 2377:     ** version 3.6.0, we require them to be fixed.
 2378:     */
 2379:     if( memcmp(&page1[21], "\100\040\040",3)!=0 ){
 2380:       goto page1_init_failed;
 2381:     }
 2382:     pageSize = (page1[16]<<8) | (page1[17]<<16);
 2383:     if( ((pageSize-1)&pageSize)!=0
 2384:      || pageSize>SQLITE_MAX_PAGE_SIZE 
 2385:      || pageSize<=256 
 2386:     ){
 2387:       goto page1_init_failed;
 2388:     }
 2389:     assert( (pageSize & 7)==0 );
 2390:     usableSize = pageSize - page1[20];
 2391:     if( (u32)pageSize!=pBt->pageSize ){
 2392:       /* After reading the first page of the database assuming a page size
 2393:       ** of BtShared.pageSize, we have discovered that the page-size is
 2394:       ** actually pageSize. Unlock the database, leave pBt->pPage1 at
 2395:       ** zero and return SQLITE_OK. The caller will call this function
 2396:       ** again with the correct page-size.
 2397:       */
 2398:       releasePage(pPage1);
 2399:       pBt->usableSize = usableSize;
 2400:       pBt->pageSize = pageSize;
 2401:       freeTempSpace(pBt);
 2402:       rc = sqlite3PagerSetPagesize(pBt->pPager, &pBt->pageSize,
 2403:                                    pageSize-usableSize);
 2404:       return rc;
 2405:     }
 2406:     if( (pBt->db->flags & SQLITE_RecoveryMode)==0 && nPage>nPageFile ){
 2407:       rc = SQLITE_CORRUPT_BKPT;
 2408:       goto page1_init_failed;
 2409:     }
 2410:     if( usableSize<480 ){
 2411:       goto page1_init_failed;
 2412:     }
 2413:     pBt->pageSize = pageSize;
 2414:     pBt->usableSize = usableSize;
 2415: #ifndef SQLITE_OMIT_AUTOVACUUM
 2416:     pBt->autoVacuum = (get4byte(&page1[36 + 4*4])?1:0);
 2417:     pBt->incrVacuum = (get4byte(&page1[36 + 7*4])?1:0);
 2418: #endif
 2419:   }
 2420: 
 2421:   /* maxLocal is the maximum amount of payload to store locally for
 2422:   ** a cell.  Make sure it is small enough so that at least minFanout
 2423:   ** cells can will fit on one page.  We assume a 10-byte page header.
 2424:   ** Besides the payload, the cell must store:
 2425:   **     2-byte pointer to the cell
 2426:   **     4-byte child pointer
 2427:   **     9-byte nKey value
 2428:   **     4-byte nData value
 2429:   **     4-byte overflow page pointer
 2430:   ** So a cell consists of a 2-byte pointer, a header which is as much as
 2431:   ** 17 bytes long, 0 to N bytes of payload, and an optional 4 byte overflow
 2432:   ** page pointer.
 2433:   */
 2434:   pBt->maxLocal = (u16)((pBt->usableSize-12)*64/255 - 23);
 2435:   pBt->minLocal = (u16)((pBt->usableSize-12)*32/255 - 23);
 2436:   pBt->maxLeaf = (u16)(pBt->usableSize - 35);
 2437:   pBt->minLeaf = (u16)((pBt->usableSize-12)*32/255 - 23);
 2438:   if( pBt->maxLocal>127 ){
 2439:     pBt->max1bytePayload = 127;
 2440:   }else{
 2441:     pBt->max1bytePayload = (u8)pBt->maxLocal;
 2442:   }
 2443:   assert( pBt->maxLeaf + 23 <= MX_CELL_SIZE(pBt) );
 2444:   pBt->pPage1 = pPage1;
 2445:   pBt->nPage = nPage;
 2446:   return SQLITE_OK;
 2447: 
 2448: page1_init_failed:
 2449:   releasePage(pPage1);
 2450:   pBt->pPage1 = 0;
 2451:   return rc;
 2452: }
 2453: 
 2454: /*
 2455: ** If there are no outstanding cursors and we are not in the middle
 2456: ** of a transaction but there is a read lock on the database, then
 2457: ** this routine unrefs the first page of the database file which 
 2458: ** has the effect of releasing the read lock.
 2459: **
 2460: ** If there is a transaction in progress, this routine is a no-op.
 2461: */
 2462: static void unlockBtreeIfUnused(BtShared *pBt){
 2463:   assert( sqlite3_mutex_held(pBt->mutex) );
 2464:   assert( pBt->pCursor==0 || pBt->inTransaction>TRANS_NONE );
 2465:   if( pBt->inTransaction==TRANS_NONE && pBt->pPage1!=0 ){
 2466:     assert( pBt->pPage1->aData );
 2467:     assert( sqlite3PagerRefcount(pBt->pPager)==1 );
 2468:     assert( pBt->pPage1->aData );
 2469:     releasePage(pBt->pPage1);
 2470:     pBt->pPage1 = 0;
 2471:   }
 2472: }
 2473: 
 2474: /*
 2475: ** If pBt points to an empty file then convert that empty file
 2476: ** into a new empty database by initializing the first page of
 2477: ** the database.
 2478: */
 2479: static int newDatabase(BtShared *pBt){
 2480:   MemPage *pP1;
 2481:   unsigned char *data;
 2482:   int rc;
 2483: 
 2484:   assert( sqlite3_mutex_held(pBt->mutex) );
 2485:   if( pBt->nPage>0 ){
 2486:     return SQLITE_OK;
 2487:   }
 2488:   pP1 = pBt->pPage1;
 2489:   assert( pP1!=0 );
 2490:   data = pP1->aData;
 2491:   rc = sqlite3PagerWrite(pP1->pDbPage);
 2492:   if( rc ) return rc;
 2493:   memcpy(data, zMagicHeader, sizeof(zMagicHeader));
 2494:   assert( sizeof(zMagicHeader)==16 );
 2495:   data[16] = (u8)((pBt->pageSize>>8)&0xff);
 2496:   data[17] = (u8)((pBt->pageSize>>16)&0xff);
 2497:   data[18] = 1;
 2498:   data[19] = 1;
 2499:   assert( pBt->usableSize<=pBt->pageSize && pBt->usableSize+255>=pBt->pageSize);
 2500:   data[20] = (u8)(pBt->pageSize - pBt->usableSize);
 2501:   data[21] = 64;
 2502:   data[22] = 32;
 2503:   data[23] = 32;
 2504:   memset(&data[24], 0, 100-24);
 2505:   zeroPage(pP1, PTF_INTKEY|PTF_LEAF|PTF_LEAFDATA );
 2506:   pBt->btsFlags |= BTS_PAGESIZE_FIXED;
 2507: #ifndef SQLITE_OMIT_AUTOVACUUM
 2508:   assert( pBt->autoVacuum==1 || pBt->autoVacuum==0 );
 2509:   assert( pBt->incrVacuum==1 || pBt->incrVacuum==0 );
 2510:   put4byte(&data[36 + 4*4], pBt->autoVacuum);
 2511:   put4byte(&data[36 + 7*4], pBt->incrVacuum);
 2512: #endif
 2513:   pBt->nPage = 1;
 2514:   data[31] = 1;
 2515:   return SQLITE_OK;
 2516: }
 2517: 
 2518: /*
 2519: ** Attempt to start a new transaction. A write-transaction
 2520: ** is started if the second argument is nonzero, otherwise a read-
 2521: ** transaction.  If the second argument is 2 or more and exclusive
 2522: ** transaction is started, meaning that no other process is allowed
 2523: ** to access the database.  A preexisting transaction may not be
 2524: ** upgraded to exclusive by calling this routine a second time - the
 2525: ** exclusivity flag only works for a new transaction.
 2526: **
 2527: ** A write-transaction must be started before attempting any 
 2528: ** changes to the database.  None of the following routines 
 2529: ** will work unless a transaction is started first:
 2530: **
 2531: **      sqlite3BtreeCreateTable()
 2532: **      sqlite3BtreeCreateIndex()
 2533: **      sqlite3BtreeClearTable()
 2534: **      sqlite3BtreeDropTable()
 2535: **      sqlite3BtreeInsert()
 2536: **      sqlite3BtreeDelete()
 2537: **      sqlite3BtreeUpdateMeta()
 2538: **
 2539: ** If an initial attempt to acquire the lock fails because of lock contention
 2540: ** and the database was previously unlocked, then invoke the busy handler
 2541: ** if there is one.  But if there was previously a read-lock, do not
 2542: ** invoke the busy handler - just return SQLITE_BUSY.  SQLITE_BUSY is 
 2543: ** returned when there is already a read-lock in order to avoid a deadlock.
 2544: **
 2545: ** Suppose there are two processes A and B.  A has a read lock and B has
 2546: ** a reserved lock.  B tries to promote to exclusive but is blocked because
 2547: ** of A's read lock.  A tries to promote to reserved but is blocked by B.
 2548: ** One or the other of the two processes must give way or there can be
 2549: ** no progress.  By returning SQLITE_BUSY and not invoking the busy callback
 2550: ** when A already has a read lock, we encourage A to give up and let B
 2551: ** proceed.
 2552: */
 2553: int sqlite3BtreeBeginTrans(Btree *p, int wrflag){
 2554:   sqlite3 *pBlock = 0;
 2555:   BtShared *pBt = p->pBt;
 2556:   int rc = SQLITE_OK;
 2557: 
 2558:   sqlite3BtreeEnter(p);
 2559:   btreeIntegrity(p);
 2560: 
 2561:   /* If the btree is already in a write-transaction, or it
 2562:   ** is already in a read-transaction and a read-transaction
 2563:   ** is requested, this is a no-op.
 2564:   */
 2565:   if( p->inTrans==TRANS_WRITE || (p->inTrans==TRANS_READ && !wrflag) ){
 2566:     goto trans_begun;
 2567:   }
 2568: 
 2569:   /* Write transactions are not possible on a read-only database */
 2570:   if( (pBt->btsFlags & BTS_READ_ONLY)!=0 && wrflag ){
 2571:     rc = SQLITE_READONLY;
 2572:     goto trans_begun;
 2573:   }
 2574: 
 2575: #ifndef SQLITE_OMIT_SHARED_CACHE
 2576:   /* If another database handle has already opened a write transaction 
 2577:   ** on this shared-btree structure and a second write transaction is
 2578:   ** requested, return SQLITE_LOCKED.
 2579:   */
 2580:   if( (wrflag && pBt->inTransaction==TRANS_WRITE)
 2581:    || (pBt->btsFlags & BTS_PENDING)!=0
 2582:   ){
 2583:     pBlock = pBt->pWriter->db;
 2584:   }else if( wrflag>1 ){
 2585:     BtLock *pIter;
 2586:     for(pIter=pBt->pLock; pIter; pIter=pIter->pNext){
 2587:       if( pIter->pBtree!=p ){
 2588:         pBlock = pIter->pBtree->db;
 2589:         break;
 2590:       }
 2591:     }
 2592:   }
 2593:   if( pBlock ){
 2594:     sqlite3ConnectionBlocked(p->db, pBlock);
 2595:     rc = SQLITE_LOCKED_SHAREDCACHE;
 2596:     goto trans_begun;
 2597:   }
 2598: #endif
 2599: 
 2600:   /* Any read-only or read-write transaction implies a read-lock on 
 2601:   ** page 1. So if some other shared-cache client already has a write-lock 
 2602:   ** on page 1, the transaction cannot be opened. */
 2603:   rc = querySharedCacheTableLock(p, MASTER_ROOT, READ_LOCK);
 2604:   if( SQLITE_OK!=rc ) goto trans_begun;
 2605: 
 2606:   pBt->btsFlags &= ~BTS_INITIALLY_EMPTY;
 2607:   if( pBt->nPage==0 ) pBt->btsFlags |= BTS_INITIALLY_EMPTY;
 2608:   do {
 2609:     /* Call lockBtree() until either pBt->pPage1 is populated or
 2610:     ** lockBtree() returns something other than SQLITE_OK. lockBtree()
 2611:     ** may return SQLITE_OK but leave pBt->pPage1 set to 0 if after
 2612:     ** reading page 1 it discovers that the page-size of the database 
 2613:     ** file is not pBt->pageSize. In this case lockBtree() will update
 2614:     ** pBt->pageSize to the page-size of the file on disk.
 2615:     */
 2616:     while( pBt->pPage1==0 && SQLITE_OK==(rc = lockBtree(pBt)) );
 2617: 
 2618:     if( rc==SQLITE_OK && wrflag ){
 2619:       if( (pBt->btsFlags & BTS_READ_ONLY)!=0 ){
 2620:         rc = SQLITE_READONLY;
 2621:       }else{
 2622:         rc = sqlite3PagerBegin(pBt->pPager,wrflag>1,sqlite3TempInMemory(p->db));
 2623:         if( rc==SQLITE_OK ){
 2624:           rc = newDatabase(pBt);
 2625:         }
 2626:       }
 2627:     }
 2628:   
 2629:     if( rc!=SQLITE_OK ){
 2630:       unlockBtreeIfUnused(pBt);
 2631:     }
 2632:   }while( (rc&0xFF)==SQLITE_BUSY && pBt->inTransaction==TRANS_NONE &&
 2633:           btreeInvokeBusyHandler(pBt) );
 2634: 
 2635:   if( rc==SQLITE_OK ){
 2636:     if( p->inTrans==TRANS_NONE ){
 2637:       pBt->nTransaction++;
 2638: #ifndef SQLITE_OMIT_SHARED_CACHE
 2639:       if( p->sharable ){
 2640: 	assert( p->lock.pBtree==p && p->lock.iTable==1 );
 2641:         p->lock.eLock = READ_LOCK;
 2642:         p->lock.pNext = pBt->pLock;
 2643:         pBt->pLock = &p->lock;
 2644:       }
 2645: #endif
 2646:     }
 2647:     p->inTrans = (wrflag?TRANS_WRITE:TRANS_READ);
 2648:     if( p->inTrans>pBt->inTransaction ){
 2649:       pBt->inTransaction = p->inTrans;
 2650:     }
 2651:     if( wrflag ){
 2652:       MemPage *pPage1 = pBt->pPage1;
 2653: #ifndef SQLITE_OMIT_SHARED_CACHE
 2654:       assert( !pBt->pWriter );
 2655:       pBt->pWriter = p;
 2656:       pBt->btsFlags &= ~BTS_EXCLUSIVE;
 2657:       if( wrflag>1 ) pBt->btsFlags |= BTS_EXCLUSIVE;
 2658: #endif
 2659: 
 2660:       /* If the db-size header field is incorrect (as it may be if an old
 2661:       ** client has been writing the database file), update it now. Doing
 2662:       ** this sooner rather than later means the database size can safely 
 2663:       ** re-read the database size from page 1 if a savepoint or transaction
 2664:       ** rollback occurs within the transaction.
 2665:       */
 2666:       if( pBt->nPage!=get4byte(&pPage1->aData[28]) ){
 2667:         rc = sqlite3PagerWrite(pPage1->pDbPage);
 2668:         if( rc==SQLITE_OK ){
 2669:           put4byte(&pPage1->aData[28], pBt->nPage);
 2670:         }
 2671:       }
 2672:     }
 2673:   }
 2674: 
 2675: 
 2676: trans_begun:
 2677:   if( rc==SQLITE_OK && wrflag ){
 2678:     /* This call makes sure that the pager has the correct number of
 2679:     ** open savepoints. If the second parameter is greater than 0 and
 2680:     ** the sub-journal is not already open, then it will be opened here.
 2681:     */
 2682:     rc = sqlite3PagerOpenSavepoint(pBt->pPager, p->db->nSavepoint);
 2683:   }
 2684: 
 2685:   btreeIntegrity(p);
 2686:   sqlite3BtreeLeave(p);
 2687:   return rc;
 2688: }
 2689: 
 2690: #ifndef SQLITE_OMIT_AUTOVACUUM
 2691: 
 2692: /*
 2693: ** Set the pointer-map entries for all children of page pPage. Also, if
 2694: ** pPage contains cells that point to overflow pages, set the pointer
 2695: ** map entries for the overflow pages as well.
 2696: */
 2697: static int setChildPtrmaps(MemPage *pPage){
 2698:   int i;                             /* Counter variable */
 2699:   int nCell;                         /* Number of cells in page pPage */
 2700:   int rc;                            /* Return code */
 2701:   BtShared *pBt = pPage->pBt;
 2702:   u8 isInitOrig = pPage->isInit;
 2703:   Pgno pgno = pPage->pgno;
 2704: 
 2705:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
 2706:   rc = btreeInitPage(pPage);
 2707:   if( rc!=SQLITE_OK ){
 2708:     goto set_child_ptrmaps_out;
 2709:   }
 2710:   nCell = pPage->nCell;
 2711: 
 2712:   for(i=0; i<nCell; i++){
 2713:     u8 *pCell = findCell(pPage, i);
 2714: 
 2715:     ptrmapPutOvflPtr(pPage, pCell, &rc);
 2716: 
 2717:     if( !pPage->leaf ){
 2718:       Pgno childPgno = get4byte(pCell);
 2719:       ptrmapPut(pBt, childPgno, PTRMAP_BTREE, pgno, &rc);
 2720:     }
 2721:   }
 2722: 
 2723:   if( !pPage->leaf ){
 2724:     Pgno childPgno = get4byte(&pPage->aData[pPage->hdrOffset+8]);
 2725:     ptrmapPut(pBt, childPgno, PTRMAP_BTREE, pgno, &rc);
 2726:   }
 2727: 
 2728: set_child_ptrmaps_out:
 2729:   pPage->isInit = isInitOrig;
 2730:   return rc;
 2731: }
 2732: 
 2733: /*
 2734: ** Somewhere on pPage is a pointer to page iFrom.  Modify this pointer so
 2735: ** that it points to iTo. Parameter eType describes the type of pointer to
 2736: ** be modified, as  follows:
 2737: **
 2738: ** PTRMAP_BTREE:     pPage is a btree-page. The pointer points at a child 
 2739: **                   page of pPage.
 2740: **
 2741: ** PTRMAP_OVERFLOW1: pPage is a btree-page. The pointer points at an overflow
 2742: **                   page pointed to by one of the cells on pPage.
 2743: **
 2744: ** PTRMAP_OVERFLOW2: pPage is an overflow-page. The pointer points at the next
 2745: **                   overflow page in the list.
 2746: */
 2747: static int modifyPagePointer(MemPage *pPage, Pgno iFrom, Pgno iTo, u8 eType){
 2748:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
 2749:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
 2750:   if( eType==PTRMAP_OVERFLOW2 ){
 2751:     /* The pointer is always the first 4 bytes of the page in this case.  */
 2752:     if( get4byte(pPage->aData)!=iFrom ){
 2753:       return SQLITE_CORRUPT_BKPT;
 2754:     }
 2755:     put4byte(pPage->aData, iTo);
 2756:   }else{
 2757:     u8 isInitOrig = pPage->isInit;
 2758:     int i;
 2759:     int nCell;
 2760: 
 2761:     btreeInitPage(pPage);
 2762:     nCell = pPage->nCell;
 2763: 
 2764:     for(i=0; i<nCell; i++){
 2765:       u8 *pCell = findCell(pPage, i);
 2766:       if( eType==PTRMAP_OVERFLOW1 ){
 2767:         CellInfo info;
 2768:         btreeParseCellPtr(pPage, pCell, &info);
 2769:         if( info.iOverflow
 2770:          && pCell+info.iOverflow+3<=pPage->aData+pPage->maskPage
 2771:          && iFrom==get4byte(&pCell[info.iOverflow])
 2772:         ){
 2773:           put4byte(&pCell[info.iOverflow], iTo);
 2774:           break;
 2775:         }
 2776:       }else{
 2777:         if( get4byte(pCell)==iFrom ){
 2778:           put4byte(pCell, iTo);
 2779:           break;
 2780:         }
 2781:       }
 2782:     }
 2783:   
 2784:     if( i==nCell ){
 2785:       if( eType!=PTRMAP_BTREE || 
 2786:           get4byte(&pPage->aData[pPage->hdrOffset+8])!=iFrom ){
 2787:         return SQLITE_CORRUPT_BKPT;
 2788:       }
 2789:       put4byte(&pPage->aData[pPage->hdrOffset+8], iTo);
 2790:     }
 2791: 
 2792:     pPage->isInit = isInitOrig;
 2793:   }
 2794:   return SQLITE_OK;
 2795: }
 2796: 
 2797: 
 2798: /*
 2799: ** Move the open database page pDbPage to location iFreePage in the 
 2800: ** database. The pDbPage reference remains valid.
 2801: **
 2802: ** The isCommit flag indicates that there is no need to remember that
 2803: ** the journal needs to be sync()ed before database page pDbPage->pgno 
 2804: ** can be written to. The caller has already promised not to write to that
 2805: ** page.
 2806: */
 2807: static int relocatePage(
 2808:   BtShared *pBt,           /* Btree */
 2809:   MemPage *pDbPage,        /* Open page to move */
 2810:   u8 eType,                /* Pointer map 'type' entry for pDbPage */
 2811:   Pgno iPtrPage,           /* Pointer map 'page-no' entry for pDbPage */
 2812:   Pgno iFreePage,          /* The location to move pDbPage to */
 2813:   int isCommit             /* isCommit flag passed to sqlite3PagerMovepage */
 2814: ){
 2815:   MemPage *pPtrPage;   /* The page that contains a pointer to pDbPage */
 2816:   Pgno iDbPage = pDbPage->pgno;
 2817:   Pager *pPager = pBt->pPager;
 2818:   int rc;
 2819: 
 2820:   assert( eType==PTRMAP_OVERFLOW2 || eType==PTRMAP_OVERFLOW1 || 
 2821:       eType==PTRMAP_BTREE || eType==PTRMAP_ROOTPAGE );
 2822:   assert( sqlite3_mutex_held(pBt->mutex) );
 2823:   assert( pDbPage->pBt==pBt );
 2824: 
 2825:   /* Move page iDbPage from its current location to page number iFreePage */
 2826:   TRACE(("AUTOVACUUM: Moving %d to free page %d (ptr page %d type %d)\n", 
 2827:       iDbPage, iFreePage, iPtrPage, eType));
 2828:   rc = sqlite3PagerMovepage(pPager, pDbPage->pDbPage, iFreePage, isCommit);
 2829:   if( rc!=SQLITE_OK ){
 2830:     return rc;
 2831:   }
 2832:   pDbPage->pgno = iFreePage;
 2833: 
 2834:   /* If pDbPage was a btree-page, then it may have child pages and/or cells
 2835:   ** that point to overflow pages. The pointer map entries for all these
 2836:   ** pages need to be changed.
 2837:   **
 2838:   ** If pDbPage is an overflow page, then the first 4 bytes may store a
 2839:   ** pointer to a subsequent overflow page. If this is the case, then
 2840:   ** the pointer map needs to be updated for the subsequent overflow page.
 2841:   */
 2842:   if( eType==PTRMAP_BTREE || eType==PTRMAP_ROOTPAGE ){
 2843:     rc = setChildPtrmaps(pDbPage);
 2844:     if( rc!=SQLITE_OK ){
 2845:       return rc;
 2846:     }
 2847:   }else{
 2848:     Pgno nextOvfl = get4byte(pDbPage->aData);
 2849:     if( nextOvfl!=0 ){
 2850:       ptrmapPut(pBt, nextOvfl, PTRMAP_OVERFLOW2, iFreePage, &rc);
 2851:       if( rc!=SQLITE_OK ){
 2852:         return rc;
 2853:       }
 2854:     }
 2855:   }
 2856: 
 2857:   /* Fix the database pointer on page iPtrPage that pointed at iDbPage so
 2858:   ** that it points at iFreePage. Also fix the pointer map entry for
 2859:   ** iPtrPage.
 2860:   */
 2861:   if( eType!=PTRMAP_ROOTPAGE ){
 2862:     rc = btreeGetPage(pBt, iPtrPage, &pPtrPage, 0);
 2863:     if( rc!=SQLITE_OK ){
 2864:       return rc;
 2865:     }
 2866:     rc = sqlite3PagerWrite(pPtrPage->pDbPage);
 2867:     if( rc!=SQLITE_OK ){
 2868:       releasePage(pPtrPage);
 2869:       return rc;
 2870:     }
 2871:     rc = modifyPagePointer(pPtrPage, iDbPage, iFreePage, eType);
 2872:     releasePage(pPtrPage);
 2873:     if( rc==SQLITE_OK ){
 2874:       ptrmapPut(pBt, iFreePage, eType, iPtrPage, &rc);
 2875:     }
 2876:   }
 2877:   return rc;
 2878: }
 2879: 
 2880: /* Forward declaration required by incrVacuumStep(). */
 2881: static int allocateBtreePage(BtShared *, MemPage **, Pgno *, Pgno, u8);
 2882: 
 2883: /*
 2884: ** Perform a single step of an incremental-vacuum. If successful,
 2885: ** return SQLITE_OK. If there is no work to do (and therefore no
 2886: ** point in calling this function again), return SQLITE_DONE.
 2887: **
 2888: ** More specificly, this function attempts to re-organize the 
 2889: ** database so that the last page of the file currently in use
 2890: ** is no longer in use.
 2891: **
 2892: ** If the nFin parameter is non-zero, this function assumes
 2893: ** that the caller will keep calling incrVacuumStep() until
 2894: ** it returns SQLITE_DONE or an error, and that nFin is the
 2895: ** number of pages the database file will contain after this 
 2896: ** process is complete.  If nFin is zero, it is assumed that
 2897: ** incrVacuumStep() will be called a finite amount of times
 2898: ** which may or may not empty the freelist.  A full autovacuum
 2899: ** has nFin>0.  A "PRAGMA incremental_vacuum" has nFin==0.
 2900: */
 2901: static int incrVacuumStep(BtShared *pBt, Pgno nFin, Pgno iLastPg){
 2902:   Pgno nFreeList;           /* Number of pages still on the free-list */
 2903:   int rc;
 2904: 
 2905:   assert( sqlite3_mutex_held(pBt->mutex) );
 2906:   assert( iLastPg>nFin );
 2907: 
 2908:   if( !PTRMAP_ISPAGE(pBt, iLastPg) && iLastPg!=PENDING_BYTE_PAGE(pBt) ){
 2909:     u8 eType;
 2910:     Pgno iPtrPage;
 2911: 
 2912:     nFreeList = get4byte(&pBt->pPage1->aData[36]);
 2913:     if( nFreeList==0 ){
 2914:       return SQLITE_DONE;
 2915:     }
 2916: 
 2917:     rc = ptrmapGet(pBt, iLastPg, &eType, &iPtrPage);
 2918:     if( rc!=SQLITE_OK ){
 2919:       return rc;
 2920:     }
 2921:     if( eType==PTRMAP_ROOTPAGE ){
 2922:       return SQLITE_CORRUPT_BKPT;
 2923:     }
 2924: 
 2925:     if( eType==PTRMAP_FREEPAGE ){
 2926:       if( nFin==0 ){
 2927:         /* Remove the page from the files free-list. This is not required
 2928:         ** if nFin is non-zero. In that case, the free-list will be
 2929:         ** truncated to zero after this function returns, so it doesn't 
 2930:         ** matter if it still contains some garbage entries.
 2931:         */
 2932:         Pgno iFreePg;
 2933:         MemPage *pFreePg;
 2934:         rc = allocateBtreePage(pBt, &pFreePg, &iFreePg, iLastPg, 1);
 2935:         if( rc!=SQLITE_OK ){
 2936:           return rc;
 2937:         }
 2938:         assert( iFreePg==iLastPg );
 2939:         releasePage(pFreePg);
 2940:       }
 2941:     } else {
 2942:       Pgno iFreePg;             /* Index of free page to move pLastPg to */
 2943:       MemPage *pLastPg;
 2944: 
 2945:       rc = btreeGetPage(pBt, iLastPg, &pLastPg, 0);
 2946:       if( rc!=SQLITE_OK ){
 2947:         return rc;
 2948:       }
 2949: 
 2950:       /* If nFin is zero, this loop runs exactly once and page pLastPg
 2951:       ** is swapped with the first free page pulled off the free list.
 2952:       **
 2953:       ** On the other hand, if nFin is greater than zero, then keep
 2954:       ** looping until a free-page located within the first nFin pages
 2955:       ** of the file is found.
 2956:       */
 2957:       do {
 2958:         MemPage *pFreePg;
 2959:         rc = allocateBtreePage(pBt, &pFreePg, &iFreePg, 0, 0);
 2960:         if( rc!=SQLITE_OK ){
 2961:           releasePage(pLastPg);
 2962:           return rc;
 2963:         }
 2964:         releasePage(pFreePg);
 2965:       }while( nFin!=0 && iFreePg>nFin );
 2966:       assert( iFreePg<iLastPg );
 2967:       
 2968:       rc = sqlite3PagerWrite(pLastPg->pDbPage);
 2969:       if( rc==SQLITE_OK ){
 2970:         rc = relocatePage(pBt, pLastPg, eType, iPtrPage, iFreePg, nFin!=0);
 2971:       }
 2972:       releasePage(pLastPg);
 2973:       if( rc!=SQLITE_OK ){
 2974:         return rc;
 2975:       }
 2976:     }
 2977:   }
 2978: 
 2979:   if( nFin==0 ){
 2980:     iLastPg--;
 2981:     while( iLastPg==PENDING_BYTE_PAGE(pBt)||PTRMAP_ISPAGE(pBt, iLastPg) ){
 2982:       if( PTRMAP_ISPAGE(pBt, iLastPg) ){
 2983:         MemPage *pPg;
 2984:         rc = btreeGetPage(pBt, iLastPg, &pPg, 0);
 2985:         if( rc!=SQLITE_OK ){
 2986:           return rc;
 2987:         }
 2988:         rc = sqlite3PagerWrite(pPg->pDbPage);
 2989:         releasePage(pPg);
 2990:         if( rc!=SQLITE_OK ){
 2991:           return rc;
 2992:         }
 2993:       }
 2994:       iLastPg--;
 2995:     }
 2996:     sqlite3PagerTruncateImage(pBt->pPager, iLastPg);
 2997:     pBt->nPage = iLastPg;
 2998:   }
 2999:   return SQLITE_OK;
 3000: }
 3001: 
 3002: /*
 3003: ** A write-transaction must be opened before calling this function.
 3004: ** It performs a single unit of work towards an incremental vacuum.
 3005: **
 3006: ** If the incremental vacuum is finished after this function has run,
 3007: ** SQLITE_DONE is returned. If it is not finished, but no error occurred,
 3008: ** SQLITE_OK is returned. Otherwise an SQLite error code. 
 3009: */
 3010: int sqlite3BtreeIncrVacuum(Btree *p){
 3011:   int rc;
 3012:   BtShared *pBt = p->pBt;
 3013: 
 3014:   sqlite3BtreeEnter(p);
 3015:   assert( pBt->inTransaction==TRANS_WRITE && p->inTrans==TRANS_WRITE );
 3016:   if( !pBt->autoVacuum ){
 3017:     rc = SQLITE_DONE;
 3018:   }else{
 3019:     invalidateAllOverflowCache(pBt);
 3020:     rc = incrVacuumStep(pBt, 0, btreePagecount(pBt));
 3021:     if( rc==SQLITE_OK ){
 3022:       rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
 3023:       put4byte(&pBt->pPage1->aData[28], pBt->nPage);
 3024:     }
 3025:   }
 3026:   sqlite3BtreeLeave(p);
 3027:   return rc;
 3028: }
 3029: 
 3030: /*
 3031: ** This routine is called prior to sqlite3PagerCommit when a transaction
 3032: ** is commited for an auto-vacuum database.
 3033: **
 3034: ** If SQLITE_OK is returned, then *pnTrunc is set to the number of pages
 3035: ** the database file should be truncated to during the commit process. 
 3036: ** i.e. the database has been reorganized so that only the first *pnTrunc
 3037: ** pages are in use.
 3038: */
 3039: static int autoVacuumCommit(BtShared *pBt){
 3040:   int rc = SQLITE_OK;
 3041:   Pager *pPager = pBt->pPager;
 3042:   VVA_ONLY( int nRef = sqlite3PagerRefcount(pPager) );
 3043: 
 3044:   assert( sqlite3_mutex_held(pBt->mutex) );
 3045:   invalidateAllOverflowCache(pBt);
 3046:   assert(pBt->autoVacuum);
 3047:   if( !pBt->incrVacuum ){
 3048:     Pgno nFin;         /* Number of pages in database after autovacuuming */
 3049:     Pgno nFree;        /* Number of pages on the freelist initially */
 3050:     Pgno nPtrmap;      /* Number of PtrMap pages to be freed */
 3051:     Pgno iFree;        /* The next page to be freed */
 3052:     int nEntry;        /* Number of entries on one ptrmap page */
 3053:     Pgno nOrig;        /* Database size before freeing */
 3054: 
 3055:     nOrig = btreePagecount(pBt);
 3056:     if( PTRMAP_ISPAGE(pBt, nOrig) || nOrig==PENDING_BYTE_PAGE(pBt) ){
 3057:       /* It is not possible to create a database for which the final page
 3058:       ** is either a pointer-map page or the pending-byte page. If one
 3059:       ** is encountered, this indicates corruption.
 3060:       */
 3061:       return SQLITE_CORRUPT_BKPT;
 3062:     }
 3063: 
 3064:     nFree = get4byte(&pBt->pPage1->aData[36]);
 3065:     nEntry = pBt->usableSize/5;
 3066:     nPtrmap = (nFree-nOrig+PTRMAP_PAGENO(pBt, nOrig)+nEntry)/nEntry;
 3067:     nFin = nOrig - nFree - nPtrmap;
 3068:     if( nOrig>PENDING_BYTE_PAGE(pBt) && nFin<PENDING_BYTE_PAGE(pBt) ){
 3069:       nFin--;
 3070:     }
 3071:     while( PTRMAP_ISPAGE(pBt, nFin) || nFin==PENDING_BYTE_PAGE(pBt) ){
 3072:       nFin--;
 3073:     }
 3074:     if( nFin>nOrig ) return SQLITE_CORRUPT_BKPT;
 3075: 
 3076:     for(iFree=nOrig; iFree>nFin && rc==SQLITE_OK; iFree--){
 3077:       rc = incrVacuumStep(pBt, nFin, iFree);
 3078:     }
 3079:     if( (rc==SQLITE_DONE || rc==SQLITE_OK) && nFree>0 ){
 3080:       rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
 3081:       put4byte(&pBt->pPage1->aData[32], 0);
 3082:       put4byte(&pBt->pPage1->aData[36], 0);
 3083:       put4byte(&pBt->pPage1->aData[28], nFin);
 3084:       sqlite3PagerTruncateImage(pBt->pPager, nFin);
 3085:       pBt->nPage = nFin;
 3086:     }
 3087:     if( rc!=SQLITE_OK ){
 3088:       sqlite3PagerRollback(pPager);
 3089:     }
 3090:   }
 3091: 
 3092:   assert( nRef==sqlite3PagerRefcount(pPager) );
 3093:   return rc;
 3094: }
 3095: 
 3096: #else /* ifndef SQLITE_OMIT_AUTOVACUUM */
 3097: # define setChildPtrmaps(x) SQLITE_OK
 3098: #endif
 3099: 
 3100: /*
 3101: ** This routine does the first phase of a two-phase commit.  This routine
 3102: ** causes a rollback journal to be created (if it does not already exist)
 3103: ** and populated with enough information so that if a power loss occurs
 3104: ** the database can be restored to its original state by playing back
 3105: ** the journal.  Then the contents of the journal are flushed out to
 3106: ** the disk.  After the journal is safely on oxide, the changes to the
 3107: ** database are written into the database file and flushed to oxide.
 3108: ** At the end of this call, the rollback journal still exists on the
 3109: ** disk and we are still holding all locks, so the transaction has not
 3110: ** committed.  See sqlite3BtreeCommitPhaseTwo() for the second phase of the
 3111: ** commit process.
 3112: **
 3113: ** This call is a no-op if no write-transaction is currently active on pBt.
 3114: **
 3115: ** Otherwise, sync the database file for the btree pBt. zMaster points to
 3116: ** the name of a master journal file that should be written into the
 3117: ** individual journal file, or is NULL, indicating no master journal file 
 3118: ** (single database transaction).
 3119: **
 3120: ** When this is called, the master journal should already have been
 3121: ** created, populated with this journal pointer and synced to disk.
 3122: **
 3123: ** Once this is routine has returned, the only thing required to commit
 3124: ** the write-transaction for this database file is to delete the journal.
 3125: */
 3126: int sqlite3BtreeCommitPhaseOne(Btree *p, const char *zMaster){
 3127:   int rc = SQLITE_OK;
 3128:   if( p->inTrans==TRANS_WRITE ){
 3129:     BtShared *pBt = p->pBt;
 3130:     sqlite3BtreeEnter(p);
 3131: #ifndef SQLITE_OMIT_AUTOVACUUM
 3132:     if( pBt->autoVacuum ){
 3133:       rc = autoVacuumCommit(pBt);
 3134:       if( rc!=SQLITE_OK ){
 3135:         sqlite3BtreeLeave(p);
 3136:         return rc;
 3137:       }
 3138:     }
 3139: #endif
 3140:     rc = sqlite3PagerCommitPhaseOne(pBt->pPager, zMaster, 0);
 3141:     sqlite3BtreeLeave(p);
 3142:   }
 3143:   return rc;
 3144: }
 3145: 
 3146: /*
 3147: ** This function is called from both BtreeCommitPhaseTwo() and BtreeRollback()
 3148: ** at the conclusion of a transaction.
 3149: */
 3150: static void btreeEndTransaction(Btree *p){
 3151:   BtShared *pBt = p->pBt;
 3152:   assert( sqlite3BtreeHoldsMutex(p) );
 3153: 
 3154:   btreeClearHasContent(pBt);
 3155:   if( p->inTrans>TRANS_NONE && p->db->activeVdbeCnt>1 ){
 3156:     /* If there are other active statements that belong to this database
 3157:     ** handle, downgrade to a read-only transaction. The other statements
 3158:     ** may still be reading from the database.  */
 3159:     downgradeAllSharedCacheTableLocks(p);
 3160:     p->inTrans = TRANS_READ;
 3161:   }else{
 3162:     /* If the handle had any kind of transaction open, decrement the 
 3163:     ** transaction count of the shared btree. If the transaction count 
 3164:     ** reaches 0, set the shared state to TRANS_NONE. The unlockBtreeIfUnused()
 3165:     ** call below will unlock the pager.  */
 3166:     if( p->inTrans!=TRANS_NONE ){
 3167:       clearAllSharedCacheTableLocks(p);
 3168:       pBt->nTransaction--;
 3169:       if( 0==pBt->nTransaction ){
 3170:         pBt->inTransaction = TRANS_NONE;
 3171:       }
 3172:     }
 3173: 
 3174:     /* Set the current transaction state to TRANS_NONE and unlock the 
 3175:     ** pager if this call closed the only read or write transaction.  */
 3176:     p->inTrans = TRANS_NONE;
 3177:     unlockBtreeIfUnused(pBt);
 3178:   }
 3179: 
 3180:   btreeIntegrity(p);
 3181: }
 3182: 
 3183: /*
 3184: ** Commit the transaction currently in progress.
 3185: **
 3186: ** This routine implements the second phase of a 2-phase commit.  The
 3187: ** sqlite3BtreeCommitPhaseOne() routine does the first phase and should
 3188: ** be invoked prior to calling this routine.  The sqlite3BtreeCommitPhaseOne()
 3189: ** routine did all the work of writing information out to disk and flushing the
 3190: ** contents so that they are written onto the disk platter.  All this
 3191: ** routine has to do is delete or truncate or zero the header in the
 3192: ** the rollback journal (which causes the transaction to commit) and
 3193: ** drop locks.
 3194: **
 3195: ** Normally, if an error occurs while the pager layer is attempting to 
 3196: ** finalize the underlying journal file, this function returns an error and
 3197: ** the upper layer will attempt a rollback. However, if the second argument
 3198: ** is non-zero then this b-tree transaction is part of a multi-file 
 3199: ** transaction. In this case, the transaction has already been committed 
 3200: ** (by deleting a master journal file) and the caller will ignore this 
 3201: ** functions return code. So, even if an error occurs in the pager layer,
 3202: ** reset the b-tree objects internal state to indicate that the write
 3203: ** transaction has been closed. This is quite safe, as the pager will have
 3204: ** transitioned to the error state.
 3205: **
 3206: ** This will release the write lock on the database file.  If there
 3207: ** are no active cursors, it also releases the read lock.
 3208: */
 3209: int sqlite3BtreeCommitPhaseTwo(Btree *p, int bCleanup){
 3210: 
 3211:   if( p->inTrans==TRANS_NONE ) return SQLITE_OK;
 3212:   sqlite3BtreeEnter(p);
 3213:   btreeIntegrity(p);
 3214: 
 3215:   /* If the handle has a write-transaction open, commit the shared-btrees 
 3216:   ** transaction and set the shared state to TRANS_READ.
 3217:   */
 3218:   if( p->inTrans==TRANS_WRITE ){
 3219:     int rc;
 3220:     BtShared *pBt = p->pBt;
 3221:     assert( pBt->inTransaction==TRANS_WRITE );
 3222:     assert( pBt->nTransaction>0 );
 3223:     rc = sqlite3PagerCommitPhaseTwo(pBt->pPager);
 3224:     if( rc!=SQLITE_OK && bCleanup==0 ){
 3225:       sqlite3BtreeLeave(p);
 3226:       return rc;
 3227:     }
 3228:     pBt->inTransaction = TRANS_READ;
 3229:   }
 3230: 
 3231:   btreeEndTransaction(p);
 3232:   sqlite3BtreeLeave(p);
 3233:   return SQLITE_OK;
 3234: }
 3235: 
 3236: /*
 3237: ** Do both phases of a commit.
 3238: */
 3239: int sqlite3BtreeCommit(Btree *p){
 3240:   int rc;
 3241:   sqlite3BtreeEnter(p);
 3242:   rc = sqlite3BtreeCommitPhaseOne(p, 0);
 3243:   if( rc==SQLITE_OK ){
 3244:     rc = sqlite3BtreeCommitPhaseTwo(p, 0);
 3245:   }
 3246:   sqlite3BtreeLeave(p);
 3247:   return rc;
 3248: }
 3249: 
 3250: #ifndef NDEBUG
 3251: /*
 3252: ** Return the number of write-cursors open on this handle. This is for use
 3253: ** in assert() expressions, so it is only compiled if NDEBUG is not
 3254: ** defined.
 3255: **
 3256: ** For the purposes of this routine, a write-cursor is any cursor that
 3257: ** is capable of writing to the databse.  That means the cursor was
 3258: ** originally opened for writing and the cursor has not be disabled
 3259: ** by having its state changed to CURSOR_FAULT.
 3260: */
 3261: static int countWriteCursors(BtShared *pBt){
 3262:   BtCursor *pCur;
 3263:   int r = 0;
 3264:   for(pCur=pBt->pCursor; pCur; pCur=pCur->pNext){
 3265:     if( pCur->wrFlag && pCur->eState!=CURSOR_FAULT ) r++; 
 3266:   }
 3267:   return r;
 3268: }
 3269: #endif
 3270: 
 3271: /*
 3272: ** This routine sets the state to CURSOR_FAULT and the error
 3273: ** code to errCode for every cursor on BtShared that pBtree
 3274: ** references.
 3275: **
 3276: ** Every cursor is tripped, including cursors that belong
 3277: ** to other database connections that happen to be sharing
 3278: ** the cache with pBtree.
 3279: **
 3280: ** This routine gets called when a rollback occurs.
 3281: ** All cursors using the same cache must be tripped
 3282: ** to prevent them from trying to use the btree after
 3283: ** the rollback.  The rollback may have deleted tables
 3284: ** or moved root pages, so it is not sufficient to
 3285: ** save the state of the cursor.  The cursor must be
 3286: ** invalidated.
 3287: */
 3288: void sqlite3BtreeTripAllCursors(Btree *pBtree, int errCode){
 3289:   BtCursor *p;
 3290:   sqlite3BtreeEnter(pBtree);
 3291:   for(p=pBtree->pBt->pCursor; p; p=p->pNext){
 3292:     int i;
 3293:     sqlite3BtreeClearCursor(p);
 3294:     p->eState = CURSOR_FAULT;
 3295:     p->skipNext = errCode;
 3296:     for(i=0; i<=p->iPage; i++){
 3297:       releasePage(p->apPage[i]);
 3298:       p->apPage[i] = 0;
 3299:     }
 3300:   }
 3301:   sqlite3BtreeLeave(pBtree);
 3302: }
 3303: 
 3304: /*
 3305: ** Rollback the transaction in progress.  All cursors will be
 3306: ** invalided by this operation.  Any attempt to use a cursor
 3307: ** that was open at the beginning of this operation will result
 3308: ** in an error.
 3309: **
 3310: ** This will release the write lock on the database file.  If there
 3311: ** are no active cursors, it also releases the read lock.
 3312: */
 3313: int sqlite3BtreeRollback(Btree *p){
 3314:   int rc;
 3315:   BtShared *pBt = p->pBt;
 3316:   MemPage *pPage1;
 3317: 
 3318:   sqlite3BtreeEnter(p);
 3319:   rc = saveAllCursors(pBt, 0, 0);
 3320: #ifndef SQLITE_OMIT_SHARED_CACHE
 3321:   if( rc!=SQLITE_OK ){
 3322:     /* This is a horrible situation. An IO or malloc() error occurred whilst
 3323:     ** trying to save cursor positions. If this is an automatic rollback (as
 3324:     ** the result of a constraint, malloc() failure or IO error) then 
 3325:     ** the cache may be internally inconsistent (not contain valid trees) so
 3326:     ** we cannot simply return the error to the caller. Instead, abort 
 3327:     ** all queries that may be using any of the cursors that failed to save.
 3328:     */
 3329:     sqlite3BtreeTripAllCursors(p, rc);
 3330:   }
 3331: #endif
 3332:   btreeIntegrity(p);
 3333: 
 3334:   if( p->inTrans==TRANS_WRITE ){
 3335:     int rc2;
 3336: 
 3337:     assert( TRANS_WRITE==pBt->inTransaction );
 3338:     rc2 = sqlite3PagerRollback(pBt->pPager);
 3339:     if( rc2!=SQLITE_OK ){
 3340:       rc = rc2;
 3341:     }
 3342: 
 3343:     /* The rollback may have destroyed the pPage1->aData value.  So
 3344:     ** call btreeGetPage() on page 1 again to make
 3345:     ** sure pPage1->aData is set correctly. */
 3346:     if( btreeGetPage(pBt, 1, &pPage1, 0)==SQLITE_OK ){
 3347:       int nPage = get4byte(28+(u8*)pPage1->aData);
 3348:       testcase( nPage==0 );
 3349:       if( nPage==0 ) sqlite3PagerPagecount(pBt->pPager, &nPage);
 3350:       testcase( pBt->nPage!=nPage );
 3351:       pBt->nPage = nPage;
 3352:       releasePage(pPage1);
 3353:     }
 3354:     assert( countWriteCursors(pBt)==0 );
 3355:     pBt->inTransaction = TRANS_READ;
 3356:   }
 3357: 
 3358:   btreeEndTransaction(p);
 3359:   sqlite3BtreeLeave(p);
 3360:   return rc;
 3361: }
 3362: 
 3363: /*
 3364: ** Start a statement subtransaction. The subtransaction can can be rolled
 3365: ** back independently of the main transaction. You must start a transaction 
 3366: ** before starting a subtransaction. The subtransaction is ended automatically 
 3367: ** if the main transaction commits or rolls back.
 3368: **
 3369: ** Statement subtransactions are used around individual SQL statements
 3370: ** that are contained within a BEGIN...COMMIT block.  If a constraint
 3371: ** error occurs within the statement, the effect of that one statement
 3372: ** can be rolled back without having to rollback the entire transaction.
 3373: **
 3374: ** A statement sub-transaction is implemented as an anonymous savepoint. The
 3375: ** value passed as the second parameter is the total number of savepoints,
 3376: ** including the new anonymous savepoint, open on the B-Tree. i.e. if there
 3377: ** are no active savepoints and no other statement-transactions open,
 3378: ** iStatement is 1. This anonymous savepoint can be released or rolled back
 3379: ** using the sqlite3BtreeSavepoint() function.
 3380: */
 3381: int sqlite3BtreeBeginStmt(Btree *p, int iStatement){
 3382:   int rc;
 3383:   BtShared *pBt = p->pBt;
 3384:   sqlite3BtreeEnter(p);
 3385:   assert( p->inTrans==TRANS_WRITE );
 3386:   assert( (pBt->btsFlags & BTS_READ_ONLY)==0 );
 3387:   assert( iStatement>0 );
 3388:   assert( iStatement>p->db->nSavepoint );
 3389:   assert( pBt->inTransaction==TRANS_WRITE );
 3390:   /* At the pager level, a statement transaction is a savepoint with
 3391:   ** an index greater than all savepoints created explicitly using
 3392:   ** SQL statements. It is illegal to open, release or rollback any
 3393:   ** such savepoints while the statement transaction savepoint is active.
 3394:   */
 3395:   rc = sqlite3PagerOpenSavepoint(pBt->pPager, iStatement);
 3396:   sqlite3BtreeLeave(p);
 3397:   return rc;
 3398: }
 3399: 
 3400: /*
 3401: ** The second argument to this function, op, is always SAVEPOINT_ROLLBACK
 3402: ** or SAVEPOINT_RELEASE. This function either releases or rolls back the
 3403: ** savepoint identified by parameter iSavepoint, depending on the value 
 3404: ** of op.
 3405: **
 3406: ** Normally, iSavepoint is greater than or equal to zero. However, if op is
 3407: ** SAVEPOINT_ROLLBACK, then iSavepoint may also be -1. In this case the 
 3408: ** contents of the entire transaction are rolled back. This is different
 3409: ** from a normal transaction rollback, as no locks are released and the
 3410: ** transaction remains open.
 3411: */
 3412: int sqlite3BtreeSavepoint(Btree *p, int op, int iSavepoint){
 3413:   int rc = SQLITE_OK;
 3414:   if( p && p->inTrans==TRANS_WRITE ){
 3415:     BtShared *pBt = p->pBt;
 3416:     assert( op==SAVEPOINT_RELEASE || op==SAVEPOINT_ROLLBACK );
 3417:     assert( iSavepoint>=0 || (iSavepoint==-1 && op==SAVEPOINT_ROLLBACK) );
 3418:     sqlite3BtreeEnter(p);
 3419:     rc = sqlite3PagerSavepoint(pBt->pPager, op, iSavepoint);
 3420:     if( rc==SQLITE_OK ){
 3421:       if( iSavepoint<0 && (pBt->btsFlags & BTS_INITIALLY_EMPTY)!=0 ){
 3422:         pBt->nPage = 0;
 3423:       }
 3424:       rc = newDatabase(pBt);
 3425:       pBt->nPage = get4byte(28 + pBt->pPage1->aData);
 3426: 
 3427:       /* The database size was written into the offset 28 of the header
 3428:       ** when the transaction started, so we know that the value at offset
 3429:       ** 28 is nonzero. */
 3430:       assert( pBt->nPage>0 );
 3431:     }
 3432:     sqlite3BtreeLeave(p);
 3433:   }
 3434:   return rc;
 3435: }
 3436: 
 3437: /*
 3438: ** Create a new cursor for the BTree whose root is on the page
 3439: ** iTable. If a read-only cursor is requested, it is assumed that
 3440: ** the caller already has at least a read-only transaction open
 3441: ** on the database already. If a write-cursor is requested, then
 3442: ** the caller is assumed to have an open write transaction.
 3443: **
 3444: ** If wrFlag==0, then the cursor can only be used for reading.
 3445: ** If wrFlag==1, then the cursor can be used for reading or for
 3446: ** writing if other conditions for writing are also met.  These
 3447: ** are the conditions that must be met in order for writing to
 3448: ** be allowed:
 3449: **
 3450: ** 1:  The cursor must have been opened with wrFlag==1
 3451: **
 3452: ** 2:  Other database connections that share the same pager cache
 3453: **     but which are not in the READ_UNCOMMITTED state may not have
 3454: **     cursors open with wrFlag==0 on the same table.  Otherwise
 3455: **     the changes made by this write cursor would be visible to
 3456: **     the read cursors in the other database connection.
 3457: **
 3458: ** 3:  The database must be writable (not on read-only media)
 3459: **
 3460: ** 4:  There must be an active transaction.
 3461: **
 3462: ** No checking is done to make sure that page iTable really is the
 3463: ** root page of a b-tree.  If it is not, then the cursor acquired
 3464: ** will not work correctly.
 3465: **
 3466: ** It is assumed that the sqlite3BtreeCursorZero() has been called
 3467: ** on pCur to initialize the memory space prior to invoking this routine.
 3468: */
 3469: static int btreeCursor(
 3470:   Btree *p,                              /* The btree */
 3471:   int iTable,                            /* Root page of table to open */
 3472:   int wrFlag,                            /* 1 to write. 0 read-only */
 3473:   struct KeyInfo *pKeyInfo,              /* First arg to comparison function */
 3474:   BtCursor *pCur                         /* Space for new cursor */
 3475: ){
 3476:   BtShared *pBt = p->pBt;                /* Shared b-tree handle */
 3477: 
 3478:   assert( sqlite3BtreeHoldsMutex(p) );
 3479:   assert( wrFlag==0 || wrFlag==1 );
 3480: 
 3481:   /* The following assert statements verify that if this is a sharable 
 3482:   ** b-tree database, the connection is holding the required table locks, 
 3483:   ** and that no other connection has any open cursor that conflicts with 
 3484:   ** this lock.  */
 3485:   assert( hasSharedCacheTableLock(p, iTable, pKeyInfo!=0, wrFlag+1) );
 3486:   assert( wrFlag==0 || !hasReadConflicts(p, iTable) );
 3487: 
 3488:   /* Assert that the caller has opened the required transaction. */
 3489:   assert( p->inTrans>TRANS_NONE );
 3490:   assert( wrFlag==0 || p->inTrans==TRANS_WRITE );
 3491:   assert( pBt->pPage1 && pBt->pPage1->aData );
 3492: 
 3493:   if( NEVER(wrFlag && (pBt->btsFlags & BTS_READ_ONLY)!=0) ){
 3494:     return SQLITE_READONLY;
 3495:   }
 3496:   if( iTable==1 && btreePagecount(pBt)==0 ){
 3497:     assert( wrFlag==0 );
 3498:     iTable = 0;
 3499:   }
 3500: 
 3501:   /* Now that no other errors can occur, finish filling in the BtCursor
 3502:   ** variables and link the cursor into the BtShared list.  */
 3503:   pCur->pgnoRoot = (Pgno)iTable;
 3504:   pCur->iPage = -1;
 3505:   pCur->pKeyInfo = pKeyInfo;
 3506:   pCur->pBtree = p;
 3507:   pCur->pBt = pBt;
 3508:   pCur->wrFlag = (u8)wrFlag;
 3509:   pCur->pNext = pBt->pCursor;
 3510:   if( pCur->pNext ){
 3511:     pCur->pNext->pPrev = pCur;
 3512:   }
 3513:   pBt->pCursor = pCur;
 3514:   pCur->eState = CURSOR_INVALID;
 3515:   pCur->cachedRowid = 0;
 3516:   return SQLITE_OK;
 3517: }
 3518: int sqlite3BtreeCursor(
 3519:   Btree *p,                                   /* The btree */
 3520:   int iTable,                                 /* Root page of table to open */
 3521:   int wrFlag,                                 /* 1 to write. 0 read-only */
 3522:   struct KeyInfo *pKeyInfo,                   /* First arg to xCompare() */
 3523:   BtCursor *pCur                              /* Write new cursor here */
 3524: ){
 3525:   int rc;
 3526:   sqlite3BtreeEnter(p);
 3527:   rc = btreeCursor(p, iTable, wrFlag, pKeyInfo, pCur);
 3528:   sqlite3BtreeLeave(p);
 3529:   return rc;
 3530: }
 3531: 
 3532: /*
 3533: ** Return the size of a BtCursor object in bytes.
 3534: **
 3535: ** This interfaces is needed so that users of cursors can preallocate
 3536: ** sufficient storage to hold a cursor.  The BtCursor object is opaque
 3537: ** to users so they cannot do the sizeof() themselves - they must call
 3538: ** this routine.
 3539: */
 3540: int sqlite3BtreeCursorSize(void){
 3541:   return ROUND8(sizeof(BtCursor));
 3542: }
 3543: 
 3544: /*
 3545: ** Initialize memory that will be converted into a BtCursor object.
 3546: **
 3547: ** The simple approach here would be to memset() the entire object
 3548: ** to zero.  But it turns out that the apPage[] and aiIdx[] arrays
 3549: ** do not need to be zeroed and they are large, so we can save a lot
 3550: ** of run-time by skipping the initialization of those elements.
 3551: */
 3552: void sqlite3BtreeCursorZero(BtCursor *p){
 3553:   memset(p, 0, offsetof(BtCursor, iPage));
 3554: }
 3555: 
 3556: /*
 3557: ** Set the cached rowid value of every cursor in the same database file
 3558: ** as pCur and having the same root page number as pCur.  The value is
 3559: ** set to iRowid.
 3560: **
 3561: ** Only positive rowid values are considered valid for this cache.
 3562: ** The cache is initialized to zero, indicating an invalid cache.
 3563: ** A btree will work fine with zero or negative rowids.  We just cannot
 3564: ** cache zero or negative rowids, which means tables that use zero or
 3565: ** negative rowids might run a little slower.  But in practice, zero
 3566: ** or negative rowids are very uncommon so this should not be a problem.
 3567: */
 3568: void sqlite3BtreeSetCachedRowid(BtCursor *pCur, sqlite3_int64 iRowid){
 3569:   BtCursor *p;
 3570:   for(p=pCur->pBt->pCursor; p; p=p->pNext){
 3571:     if( p->pgnoRoot==pCur->pgnoRoot ) p->cachedRowid = iRowid;
 3572:   }
 3573:   assert( pCur->cachedRowid==iRowid );
 3574: }
 3575: 
 3576: /*
 3577: ** Return the cached rowid for the given cursor.  A negative or zero
 3578: ** return value indicates that the rowid cache is invalid and should be
 3579: ** ignored.  If the rowid cache has never before been set, then a
 3580: ** zero is returned.
 3581: */
 3582: sqlite3_int64 sqlite3BtreeGetCachedRowid(BtCursor *pCur){
 3583:   return pCur->cachedRowid;
 3584: }
 3585: 
 3586: /*
 3587: ** Close a cursor.  The read lock on the database file is released
 3588: ** when the last cursor is closed.
 3589: */
 3590: int sqlite3BtreeCloseCursor(BtCursor *pCur){
 3591:   Btree *pBtree = pCur->pBtree;
 3592:   if( pBtree ){
 3593:     int i;
 3594:     BtShared *pBt = pCur->pBt;
 3595:     sqlite3BtreeEnter(pBtree);
 3596:     sqlite3BtreeClearCursor(pCur);
 3597:     if( pCur->pPrev ){
 3598:       pCur->pPrev->pNext = pCur->pNext;
 3599:     }else{
 3600:       pBt->pCursor = pCur->pNext;
 3601:     }
 3602:     if( pCur->pNext ){
 3603:       pCur->pNext->pPrev = pCur->pPrev;
 3604:     }
 3605:     for(i=0; i<=pCur->iPage; i++){
 3606:       releasePage(pCur->apPage[i]);
 3607:     }
 3608:     unlockBtreeIfUnused(pBt);
 3609:     invalidateOverflowCache(pCur);
 3610:     /* sqlite3_free(pCur); */
 3611:     sqlite3BtreeLeave(pBtree);
 3612:   }
 3613:   return SQLITE_OK;
 3614: }
 3615: 
 3616: /*
 3617: ** Make sure the BtCursor* given in the argument has a valid
 3618: ** BtCursor.info structure.  If it is not already valid, call
 3619: ** btreeParseCell() to fill it in.
 3620: **
 3621: ** BtCursor.info is a cache of the information in the current cell.
 3622: ** Using this cache reduces the number of calls to btreeParseCell().
 3623: **
 3624: ** 2007-06-25:  There is a bug in some versions of MSVC that cause the
 3625: ** compiler to crash when getCellInfo() is implemented as a macro.
 3626: ** But there is a measureable speed advantage to using the macro on gcc
 3627: ** (when less compiler optimizations like -Os or -O0 are used and the
 3628: ** compiler is not doing agressive inlining.)  So we use a real function
 3629: ** for MSVC and a macro for everything else.  Ticket #2457.
 3630: */
 3631: #ifndef NDEBUG
 3632:   static void assertCellInfo(BtCursor *pCur){
 3633:     CellInfo info;
 3634:     int iPage = pCur->iPage;
 3635:     memset(&info, 0, sizeof(info));
 3636:     btreeParseCell(pCur->apPage[iPage], pCur->aiIdx[iPage], &info);
 3637:     assert( memcmp(&info, &pCur->info, sizeof(info))==0 );
 3638:   }
 3639: #else
 3640:   #define assertCellInfo(x)
 3641: #endif
 3642: #ifdef _MSC_VER
 3643:   /* Use a real function in MSVC to work around bugs in that compiler. */
 3644:   static void getCellInfo(BtCursor *pCur){
 3645:     if( pCur->info.nSize==0 ){
 3646:       int iPage = pCur->iPage;
 3647:       btreeParseCell(pCur->apPage[iPage],pCur->aiIdx[iPage],&pCur->info);
 3648:       pCur->validNKey = 1;
 3649:     }else{
 3650:       assertCellInfo(pCur);
 3651:     }
 3652:   }
 3653: #else /* if not _MSC_VER */
 3654:   /* Use a macro in all other compilers so that the function is inlined */
 3655: #define getCellInfo(pCur)                                                      \
 3656:   if( pCur->info.nSize==0 ){                                                   \
 3657:     int iPage = pCur->iPage;                                                   \
 3658:     btreeParseCell(pCur->apPage[iPage],pCur->aiIdx[iPage],&pCur->info); \
 3659:     pCur->validNKey = 1;                                                       \
 3660:   }else{                                                                       \
 3661:     assertCellInfo(pCur);                                                      \
 3662:   }
 3663: #endif /* _MSC_VER */
 3664: 
 3665: #ifndef NDEBUG  /* The next routine used only within assert() statements */
 3666: /*
 3667: ** Return true if the given BtCursor is valid.  A valid cursor is one
 3668: ** that is currently pointing to a row in a (non-empty) table.
 3669: ** This is a verification routine is used only within assert() statements.
 3670: */
 3671: int sqlite3BtreeCursorIsValid(BtCursor *pCur){
 3672:   return pCur && pCur->eState==CURSOR_VALID;
 3673: }
 3674: #endif /* NDEBUG */
 3675: 
 3676: /*
 3677: ** Set *pSize to the size of the buffer needed to hold the value of
 3678: ** the key for the current entry.  If the cursor is not pointing
 3679: ** to a valid entry, *pSize is set to 0. 
 3680: **
 3681: ** For a table with the INTKEY flag set, this routine returns the key
 3682: ** itself, not the number of bytes in the key.
 3683: **
 3684: ** The caller must position the cursor prior to invoking this routine.
 3685: ** 
 3686: ** This routine cannot fail.  It always returns SQLITE_OK.  
 3687: */
 3688: int sqlite3BtreeKeySize(BtCursor *pCur, i64 *pSize){
 3689:   assert( cursorHoldsMutex(pCur) );
 3690:   assert( pCur->eState==CURSOR_INVALID || pCur->eState==CURSOR_VALID );
 3691:   if( pCur->eState!=CURSOR_VALID ){
 3692:     *pSize = 0;
 3693:   }else{
 3694:     getCellInfo(pCur);
 3695:     *pSize = pCur->info.nKey;
 3696:   }
 3697:   return SQLITE_OK;
 3698: }
 3699: 
 3700: /*
 3701: ** Set *pSize to the number of bytes of data in the entry the
 3702: ** cursor currently points to.
 3703: **
 3704: ** The caller must guarantee that the cursor is pointing to a non-NULL
 3705: ** valid entry.  In other words, the calling procedure must guarantee
 3706: ** that the cursor has Cursor.eState==CURSOR_VALID.
 3707: **
 3708: ** Failure is not possible.  This function always returns SQLITE_OK.
 3709: ** It might just as well be a procedure (returning void) but we continue
 3710: ** to return an integer result code for historical reasons.
 3711: */
 3712: int sqlite3BtreeDataSize(BtCursor *pCur, u32 *pSize){
 3713:   assert( cursorHoldsMutex(pCur) );
 3714:   assert( pCur->eState==CURSOR_VALID );
 3715:   getCellInfo(pCur);
 3716:   *pSize = pCur->info.nData;
 3717:   return SQLITE_OK;
 3718: }
 3719: 
 3720: /*
 3721: ** Given the page number of an overflow page in the database (parameter
 3722: ** ovfl), this function finds the page number of the next page in the 
 3723: ** linked list of overflow pages. If possible, it uses the auto-vacuum
 3724: ** pointer-map data instead of reading the content of page ovfl to do so. 
 3725: **
 3726: ** If an error occurs an SQLite error code is returned. Otherwise:
 3727: **
 3728: ** The page number of the next overflow page in the linked list is 
 3729: ** written to *pPgnoNext. If page ovfl is the last page in its linked 
 3730: ** list, *pPgnoNext is set to zero. 
 3731: **
 3732: ** If ppPage is not NULL, and a reference to the MemPage object corresponding
 3733: ** to page number pOvfl was obtained, then *ppPage is set to point to that
 3734: ** reference. It is the responsibility of the caller to call releasePage()
 3735: ** on *ppPage to free the reference. In no reference was obtained (because
 3736: ** the pointer-map was used to obtain the value for *pPgnoNext), then
 3737: ** *ppPage is set to zero.
 3738: */
 3739: static int getOverflowPage(
 3740:   BtShared *pBt,               /* The database file */
 3741:   Pgno ovfl,                   /* Current overflow page number */
 3742:   MemPage **ppPage,            /* OUT: MemPage handle (may be NULL) */
 3743:   Pgno *pPgnoNext              /* OUT: Next overflow page number */
 3744: ){
 3745:   Pgno next = 0;
 3746:   MemPage *pPage = 0;
 3747:   int rc = SQLITE_OK;
 3748: 
 3749:   assert( sqlite3_mutex_held(pBt->mutex) );
 3750:   assert(pPgnoNext);
 3751: 
 3752: #ifndef SQLITE_OMIT_AUTOVACUUM
 3753:   /* Try to find the next page in the overflow list using the
 3754:   ** autovacuum pointer-map pages. Guess that the next page in 
 3755:   ** the overflow list is page number (ovfl+1). If that guess turns 
 3756:   ** out to be wrong, fall back to loading the data of page 
 3757:   ** number ovfl to determine the next page number.
 3758:   */
 3759:   if( pBt->autoVacuum ){
 3760:     Pgno pgno;
 3761:     Pgno iGuess = ovfl+1;
 3762:     u8 eType;
 3763: 
 3764:     while( PTRMAP_ISPAGE(pBt, iGuess) || iGuess==PENDING_BYTE_PAGE(pBt) ){
 3765:       iGuess++;
 3766:     }
 3767: 
 3768:     if( iGuess<=btreePagecount(pBt) ){
 3769:       rc = ptrmapGet(pBt, iGuess, &eType, &pgno);
 3770:       if( rc==SQLITE_OK && eType==PTRMAP_OVERFLOW2 && pgno==ovfl ){
 3771:         next = iGuess;
 3772:         rc = SQLITE_DONE;
 3773:       }
 3774:     }
 3775:   }
 3776: #endif
 3777: 
 3778:   assert( next==0 || rc==SQLITE_DONE );
 3779:   if( rc==SQLITE_OK ){
 3780:     rc = btreeGetPage(pBt, ovfl, &pPage, 0);
 3781:     assert( rc==SQLITE_OK || pPage==0 );
 3782:     if( rc==SQLITE_OK ){
 3783:       next = get4byte(pPage->aData);
 3784:     }
 3785:   }
 3786: 
 3787:   *pPgnoNext = next;
 3788:   if( ppPage ){
 3789:     *ppPage = pPage;
 3790:   }else{
 3791:     releasePage(pPage);
 3792:   }
 3793:   return (rc==SQLITE_DONE ? SQLITE_OK : rc);
 3794: }
 3795: 
 3796: /*
 3797: ** Copy data from a buffer to a page, or from a page to a buffer.
 3798: **
 3799: ** pPayload is a pointer to data stored on database page pDbPage.
 3800: ** If argument eOp is false, then nByte bytes of data are copied
 3801: ** from pPayload to the buffer pointed at by pBuf. If eOp is true,
 3802: ** then sqlite3PagerWrite() is called on pDbPage and nByte bytes
 3803: ** of data are copied from the buffer pBuf to pPayload.
 3804: **
 3805: ** SQLITE_OK is returned on success, otherwise an error code.
 3806: */
 3807: static int copyPayload(
 3808:   void *pPayload,           /* Pointer to page data */
 3809:   void *pBuf,               /* Pointer to buffer */
 3810:   int nByte,                /* Number of bytes to copy */
 3811:   int eOp,                  /* 0 -> copy from page, 1 -> copy to page */
 3812:   DbPage *pDbPage           /* Page containing pPayload */
 3813: ){
 3814:   if( eOp ){
 3815:     /* Copy data from buffer to page (a write operation) */
 3816:     int rc = sqlite3PagerWrite(pDbPage);
 3817:     if( rc!=SQLITE_OK ){
 3818:       return rc;
 3819:     }
 3820:     memcpy(pPayload, pBuf, nByte);
 3821:   }else{
 3822:     /* Copy data from page to buffer (a read operation) */
 3823:     memcpy(pBuf, pPayload, nByte);
 3824:   }
 3825:   return SQLITE_OK;
 3826: }
 3827: 
 3828: /*
 3829: ** This function is used to read or overwrite payload information
 3830: ** for the entry that the pCur cursor is pointing to. If the eOp
 3831: ** parameter is 0, this is a read operation (data copied into
 3832: ** buffer pBuf). If it is non-zero, a write (data copied from
 3833: ** buffer pBuf).
 3834: **
 3835: ** A total of "amt" bytes are read or written beginning at "offset".
 3836: ** Data is read to or from the buffer pBuf.
 3837: **
 3838: ** The content being read or written might appear on the main page
 3839: ** or be scattered out on multiple overflow pages.
 3840: **
 3841: ** If the BtCursor.isIncrblobHandle flag is set, and the current
 3842: ** cursor entry uses one or more overflow pages, this function
 3843: ** allocates space for and lazily popluates the overflow page-list 
 3844: ** cache array (BtCursor.aOverflow). Subsequent calls use this
 3845: ** cache to make seeking to the supplied offset more efficient.
 3846: **
 3847: ** Once an overflow page-list cache has been allocated, it may be
 3848: ** invalidated if some other cursor writes to the same table, or if
 3849: ** the cursor is moved to a different row. Additionally, in auto-vacuum
 3850: ** mode, the following events may invalidate an overflow page-list cache.
 3851: **
 3852: **   * An incremental vacuum,
 3853: **   * A commit in auto_vacuum="full" mode,
 3854: **   * Creating a table (may require moving an overflow page).
 3855: */
 3856: static int accessPayload(
 3857:   BtCursor *pCur,      /* Cursor pointing to entry to read from */
 3858:   u32 offset,          /* Begin reading this far into payload */
 3859:   u32 amt,             /* Read this many bytes */
 3860:   unsigned char *pBuf, /* Write the bytes into this buffer */ 
 3861:   int eOp              /* zero to read. non-zero to write. */
 3862: ){
 3863:   unsigned char *aPayload;
 3864:   int rc = SQLITE_OK;
 3865:   u32 nKey;
 3866:   int iIdx = 0;
 3867:   MemPage *pPage = pCur->apPage[pCur->iPage]; /* Btree page of current entry */
 3868:   BtShared *pBt = pCur->pBt;                  /* Btree this cursor belongs to */
 3869: 
 3870:   assert( pPage );
 3871:   assert( pCur->eState==CURSOR_VALID );
 3872:   assert( pCur->aiIdx[pCur->iPage]<pPage->nCell );
 3873:   assert( cursorHoldsMutex(pCur) );
 3874: 
 3875:   getCellInfo(pCur);
 3876:   aPayload = pCur->info.pCell + pCur->info.nHeader;
 3877:   nKey = (pPage->intKey ? 0 : (int)pCur->info.nKey);
 3878: 
 3879:   if( NEVER(offset+amt > nKey+pCur->info.nData) 
 3880:    || &aPayload[pCur->info.nLocal] > &pPage->aData[pBt->usableSize]
 3881:   ){
 3882:     /* Trying to read or write past the end of the data is an error */
 3883:     return SQLITE_CORRUPT_BKPT;
 3884:   }
 3885: 
 3886:   /* Check if data must be read/written to/from the btree page itself. */
 3887:   if( offset<pCur->info.nLocal ){
 3888:     int a = amt;
 3889:     if( a+offset>pCur->info.nLocal ){
 3890:       a = pCur->info.nLocal - offset;
 3891:     }
 3892:     rc = copyPayload(&aPayload[offset], pBuf, a, eOp, pPage->pDbPage);
 3893:     offset = 0;
 3894:     pBuf += a;
 3895:     amt -= a;
 3896:   }else{
 3897:     offset -= pCur->info.nLocal;
 3898:   }
 3899: 
 3900:   if( rc==SQLITE_OK && amt>0 ){
 3901:     const u32 ovflSize = pBt->usableSize - 4;  /* Bytes content per ovfl page */
 3902:     Pgno nextPage;
 3903: 
 3904:     nextPage = get4byte(&aPayload[pCur->info.nLocal]);
 3905: 
 3906: #ifndef SQLITE_OMIT_INCRBLOB
 3907:     /* If the isIncrblobHandle flag is set and the BtCursor.aOverflow[]
 3908:     ** has not been allocated, allocate it now. The array is sized at
 3909:     ** one entry for each overflow page in the overflow chain. The
 3910:     ** page number of the first overflow page is stored in aOverflow[0],
 3911:     ** etc. A value of 0 in the aOverflow[] array means "not yet known"
 3912:     ** (the cache is lazily populated).
 3913:     */
 3914:     if( pCur->isIncrblobHandle && !pCur->aOverflow ){
 3915:       int nOvfl = (pCur->info.nPayload-pCur->info.nLocal+ovflSize-1)/ovflSize;
 3916:       pCur->aOverflow = (Pgno *)sqlite3MallocZero(sizeof(Pgno)*nOvfl);
 3917:       /* nOvfl is always positive.  If it were zero, fetchPayload would have
 3918:       ** been used instead of this routine. */
 3919:       if( ALWAYS(nOvfl) && !pCur->aOverflow ){
 3920:         rc = SQLITE_NOMEM;
 3921:       }
 3922:     }
 3923: 
 3924:     /* If the overflow page-list cache has been allocated and the
 3925:     ** entry for the first required overflow page is valid, skip
 3926:     ** directly to it.
 3927:     */
 3928:     if( pCur->aOverflow && pCur->aOverflow[offset/ovflSize] ){
 3929:       iIdx = (offset/ovflSize);
 3930:       nextPage = pCur->aOverflow[iIdx];
 3931:       offset = (offset%ovflSize);
 3932:     }
 3933: #endif
 3934: 
 3935:     for( ; rc==SQLITE_OK && amt>0 && nextPage; iIdx++){
 3936: 
 3937: #ifndef SQLITE_OMIT_INCRBLOB
 3938:       /* If required, populate the overflow page-list cache. */
 3939:       if( pCur->aOverflow ){
 3940:         assert(!pCur->aOverflow[iIdx] || pCur->aOverflow[iIdx]==nextPage);
 3941:         pCur->aOverflow[iIdx] = nextPage;
 3942:       }
 3943: #endif
 3944: 
 3945:       if( offset>=ovflSize ){
 3946:         /* The only reason to read this page is to obtain the page
 3947:         ** number for the next page in the overflow chain. The page
 3948:         ** data is not required. So first try to lookup the overflow
 3949:         ** page-list cache, if any, then fall back to the getOverflowPage()
 3950:         ** function.
 3951:         */
 3952: #ifndef SQLITE_OMIT_INCRBLOB
 3953:         if( pCur->aOverflow && pCur->aOverflow[iIdx+1] ){
 3954:           nextPage = pCur->aOverflow[iIdx+1];
 3955:         } else 
 3956: #endif
 3957:           rc = getOverflowPage(pBt, nextPage, 0, &nextPage);
 3958:         offset -= ovflSize;
 3959:       }else{
 3960:         /* Need to read this page properly. It contains some of the
 3961:         ** range of data that is being read (eOp==0) or written (eOp!=0).
 3962:         */
 3963: #ifdef SQLITE_DIRECT_OVERFLOW_READ
 3964:         sqlite3_file *fd;
 3965: #endif
 3966:         int a = amt;
 3967:         if( a + offset > ovflSize ){
 3968:           a = ovflSize - offset;
 3969:         }
 3970: 
 3971: #ifdef SQLITE_DIRECT_OVERFLOW_READ
 3972:         /* If all the following are true:
 3973:         **
 3974:         **   1) this is a read operation, and 
 3975:         **   2) data is required from the start of this overflow page, and
 3976:         **   3) the database is file-backed, and
 3977:         **   4) there is no open write-transaction, and
 3978:         **   5) the database is not a WAL database,
 3979:         **
 3980:         ** then data can be read directly from the database file into the
 3981:         ** output buffer, bypassing the page-cache altogether. This speeds
 3982:         ** up loading large records that span many overflow pages.
 3983:         */
 3984:         if( eOp==0                                             /* (1) */
 3985:          && offset==0                                          /* (2) */
 3986:          && pBt->inTransaction==TRANS_READ                     /* (4) */
 3987:          && (fd = sqlite3PagerFile(pBt->pPager))->pMethods     /* (3) */
 3988:          && pBt->pPage1->aData[19]==0x01                       /* (5) */
 3989:         ){
 3990:           u8 aSave[4];
 3991:           u8 *aWrite = &pBuf[-4];
 3992:           memcpy(aSave, aWrite, 4);
 3993:           rc = sqlite3OsRead(fd, aWrite, a+4, (i64)pBt->pageSize*(nextPage-1));
 3994:           nextPage = get4byte(aWrite);
 3995:           memcpy(aWrite, aSave, 4);
 3996:         }else
 3997: #endif
 3998: 
 3999:         {
 4000:           DbPage *pDbPage;
 4001:           rc = sqlite3PagerGet(pBt->pPager, nextPage, &pDbPage);
 4002:           if( rc==SQLITE_OK ){
 4003:             aPayload = sqlite3PagerGetData(pDbPage);
 4004:             nextPage = get4byte(aPayload);
 4005:             rc = copyPayload(&aPayload[offset+4], pBuf, a, eOp, pDbPage);
 4006:             sqlite3PagerUnref(pDbPage);
 4007:             offset = 0;
 4008:           }
 4009:         }
 4010:         amt -= a;
 4011:         pBuf += a;
 4012:       }
 4013:     }
 4014:   }
 4015: 
 4016:   if( rc==SQLITE_OK && amt>0 ){
 4017:     return SQLITE_CORRUPT_BKPT;
 4018:   }
 4019:   return rc;
 4020: }
 4021: 
 4022: /*
 4023: ** Read part of the key associated with cursor pCur.  Exactly
 4024: ** "amt" bytes will be transfered into pBuf[].  The transfer
 4025: ** begins at "offset".
 4026: **
 4027: ** The caller must ensure that pCur is pointing to a valid row
 4028: ** in the table.
 4029: **
 4030: ** Return SQLITE_OK on success or an error code if anything goes
 4031: ** wrong.  An error is returned if "offset+amt" is larger than
 4032: ** the available payload.
 4033: */
 4034: int sqlite3BtreeKey(BtCursor *pCur, u32 offset, u32 amt, void *pBuf){
 4035:   assert( cursorHoldsMutex(pCur) );
 4036:   assert( pCur->eState==CURSOR_VALID );
 4037:   assert( pCur->iPage>=0 && pCur->apPage[pCur->iPage] );
 4038:   assert( pCur->aiIdx[pCur->iPage]<pCur->apPage[pCur->iPage]->nCell );
 4039:   return accessPayload(pCur, offset, amt, (unsigned char*)pBuf, 0);
 4040: }
 4041: 
 4042: /*
 4043: ** Read part of the data associated with cursor pCur.  Exactly
 4044: ** "amt" bytes will be transfered into pBuf[].  The transfer
 4045: ** begins at "offset".
 4046: **
 4047: ** Return SQLITE_OK on success or an error code if anything goes
 4048: ** wrong.  An error is returned if "offset+amt" is larger than
 4049: ** the available payload.
 4050: */
 4051: int sqlite3BtreeData(BtCursor *pCur, u32 offset, u32 amt, void *pBuf){
 4052:   int rc;
 4053: 
 4054: #ifndef SQLITE_OMIT_INCRBLOB
 4055:   if ( pCur->eState==CURSOR_INVALID ){
 4056:     return SQLITE_ABORT;
 4057:   }
 4058: #endif
 4059: 
 4060:   assert( cursorHoldsMutex(pCur) );
 4061:   rc = restoreCursorPosition(pCur);
 4062:   if( rc==SQLITE_OK ){
 4063:     assert( pCur->eState==CURSOR_VALID );
 4064:     assert( pCur->iPage>=0 && pCur->apPage[pCur->iPage] );
 4065:     assert( pCur->aiIdx[pCur->iPage]<pCur->apPage[pCur->iPage]->nCell );
 4066:     rc = accessPayload(pCur, offset, amt, pBuf, 0);
 4067:   }
 4068:   return rc;
 4069: }
 4070: 
 4071: /*
 4072: ** Return a pointer to payload information from the entry that the 
 4073: ** pCur cursor is pointing to.  The pointer is to the beginning of
 4074: ** the key if skipKey==0 and it points to the beginning of data if
 4075: ** skipKey==1.  The number of bytes of available key/data is written
 4076: ** into *pAmt.  If *pAmt==0, then the value returned will not be
 4077: ** a valid pointer.
 4078: **
 4079: ** This routine is an optimization.  It is common for the entire key
 4080: ** and data to fit on the local page and for there to be no overflow
 4081: ** pages.  When that is so, this routine can be used to access the
 4082: ** key and data without making a copy.  If the key and/or data spills
 4083: ** onto overflow pages, then accessPayload() must be used to reassemble
 4084: ** the key/data and copy it into a preallocated buffer.
 4085: **
 4086: ** The pointer returned by this routine looks directly into the cached
 4087: ** page of the database.  The data might change or move the next time
 4088: ** any btree routine is called.
 4089: */
 4090: static const unsigned char *fetchPayload(
 4091:   BtCursor *pCur,      /* Cursor pointing to entry to read from */
 4092:   int *pAmt,           /* Write the number of available bytes here */
 4093:   int skipKey          /* read beginning at data if this is true */
 4094: ){
 4095:   unsigned char *aPayload;
 4096:   MemPage *pPage;
 4097:   u32 nKey;
 4098:   u32 nLocal;
 4099: 
 4100:   assert( pCur!=0 && pCur->iPage>=0 && pCur->apPage[pCur->iPage]);
 4101:   assert( pCur->eState==CURSOR_VALID );
 4102:   assert( cursorHoldsMutex(pCur) );
 4103:   pPage = pCur->apPage[pCur->iPage];
 4104:   assert( pCur->aiIdx[pCur->iPage]<pPage->nCell );
 4105:   if( NEVER(pCur->info.nSize==0) ){
 4106:     btreeParseCell(pCur->apPage[pCur->iPage], pCur->aiIdx[pCur->iPage],
 4107:                    &pCur->info);
 4108:   }
 4109:   aPayload = pCur->info.pCell;
 4110:   aPayload += pCur->info.nHeader;
 4111:   if( pPage->intKey ){
 4112:     nKey = 0;
 4113:   }else{
 4114:     nKey = (int)pCur->info.nKey;
 4115:   }
 4116:   if( skipKey ){
 4117:     aPayload += nKey;
 4118:     nLocal = pCur->info.nLocal - nKey;
 4119:   }else{
 4120:     nLocal = pCur->info.nLocal;
 4121:     assert( nLocal<=nKey );
 4122:   }
 4123:   *pAmt = nLocal;
 4124:   return aPayload;
 4125: }
 4126: 
 4127: 
 4128: /*
 4129: ** For the entry that cursor pCur is point to, return as
 4130: ** many bytes of the key or data as are available on the local
 4131: ** b-tree page.  Write the number of available bytes into *pAmt.
 4132: **
 4133: ** The pointer returned is ephemeral.  The key/data may move
 4134: ** or be destroyed on the next call to any Btree routine,
 4135: ** including calls from other threads against the same cache.
 4136: ** Hence, a mutex on the BtShared should be held prior to calling
 4137: ** this routine.
 4138: **
 4139: ** These routines is used to get quick access to key and data
 4140: ** in the common case where no overflow pages are used.
 4141: */
 4142: const void *sqlite3BtreeKeyFetch(BtCursor *pCur, int *pAmt){
 4143:   const void *p = 0;
 4144:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
 4145:   assert( cursorHoldsMutex(pCur) );
 4146:   if( ALWAYS(pCur->eState==CURSOR_VALID) ){
 4147:     p = (const void*)fetchPayload(pCur, pAmt, 0);
 4148:   }
 4149:   return p;
 4150: }
 4151: const void *sqlite3BtreeDataFetch(BtCursor *pCur, int *pAmt){
 4152:   const void *p = 0;
 4153:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
 4154:   assert( cursorHoldsMutex(pCur) );
 4155:   if( ALWAYS(pCur->eState==CURSOR_VALID) ){
 4156:     p = (const void*)fetchPayload(pCur, pAmt, 1);
 4157:   }
 4158:   return p;
 4159: }
 4160: 
 4161: 
 4162: /*
 4163: ** Move the cursor down to a new child page.  The newPgno argument is the
 4164: ** page number of the child page to move to.
 4165: **
 4166: ** This function returns SQLITE_CORRUPT if the page-header flags field of
 4167: ** the new child page does not match the flags field of the parent (i.e.
 4168: ** if an intkey page appears to be the parent of a non-intkey page, or
 4169: ** vice-versa).
 4170: */
 4171: static int moveToChild(BtCursor *pCur, u32 newPgno){
 4172:   int rc;
 4173:   int i = pCur->iPage;
 4174:   MemPage *pNewPage;
 4175:   BtShared *pBt = pCur->pBt;
 4176: 
 4177:   assert( cursorHoldsMutex(pCur) );
 4178:   assert( pCur->eState==CURSOR_VALID );
 4179:   assert( pCur->iPage<BTCURSOR_MAX_DEPTH );
 4180:   if( pCur->iPage>=(BTCURSOR_MAX_DEPTH-1) ){
 4181:     return SQLITE_CORRUPT_BKPT;
 4182:   }
 4183:   rc = getAndInitPage(pBt, newPgno, &pNewPage);
 4184:   if( rc ) return rc;
 4185:   pCur->apPage[i+1] = pNewPage;
 4186:   pCur->aiIdx[i+1] = 0;
 4187:   pCur->iPage++;
 4188: 
 4189:   pCur->info.nSize = 0;
 4190:   pCur->validNKey = 0;
 4191:   if( pNewPage->nCell<1 || pNewPage->intKey!=pCur->apPage[i]->intKey ){
 4192:     return SQLITE_CORRUPT_BKPT;
 4193:   }
 4194:   return SQLITE_OK;
 4195: }
 4196: 
 4197: #if 0
 4198: /*
 4199: ** Page pParent is an internal (non-leaf) tree page. This function 
 4200: ** asserts that page number iChild is the left-child if the iIdx'th
 4201: ** cell in page pParent. Or, if iIdx is equal to the total number of
 4202: ** cells in pParent, that page number iChild is the right-child of
 4203: ** the page.
 4204: */
 4205: static void assertParentIndex(MemPage *pParent, int iIdx, Pgno iChild){
 4206:   assert( iIdx<=pParent->nCell );
 4207:   if( iIdx==pParent->nCell ){
 4208:     assert( get4byte(&pParent->aData[pParent->hdrOffset+8])==iChild );
 4209:   }else{
 4210:     assert( get4byte(findCell(pParent, iIdx))==iChild );
 4211:   }
 4212: }
 4213: #else
 4214: #  define assertParentIndex(x,y,z) 
 4215: #endif
 4216: 
 4217: /*
 4218: ** Move the cursor up to the parent page.
 4219: **
 4220: ** pCur->idx is set to the cell index that contains the pointer
 4221: ** to the page we are coming from.  If we are coming from the
 4222: ** right-most child page then pCur->idx is set to one more than
 4223: ** the largest cell index.
 4224: */
 4225: static void moveToParent(BtCursor *pCur){
 4226:   assert( cursorHoldsMutex(pCur) );
 4227:   assert( pCur->eState==CURSOR_VALID );
 4228:   assert( pCur->iPage>0 );
 4229:   assert( pCur->apPage[pCur->iPage] );
 4230: 
 4231:   /* UPDATE: It is actually possible for the condition tested by the assert
 4232:   ** below to be untrue if the database file is corrupt. This can occur if
 4233:   ** one cursor has modified page pParent while a reference to it is held 
 4234:   ** by a second cursor. Which can only happen if a single page is linked
 4235:   ** into more than one b-tree structure in a corrupt database.  */
 4236: #if 0
 4237:   assertParentIndex(
 4238:     pCur->apPage[pCur->iPage-1], 
 4239:     pCur->aiIdx[pCur->iPage-1], 
 4240:     pCur->apPage[pCur->iPage]->pgno
 4241:   );
 4242: #endif
 4243:   testcase( pCur->aiIdx[pCur->iPage-1] > pCur->apPage[pCur->iPage-1]->nCell );
 4244: 
 4245:   releasePage(pCur->apPage[pCur->iPage]);
 4246:   pCur->iPage--;
 4247:   pCur->info.nSize = 0;
 4248:   pCur->validNKey = 0;
 4249: }
 4250: 
 4251: /*
 4252: ** Move the cursor to point to the root page of its b-tree structure.
 4253: **
 4254: ** If the table has a virtual root page, then the cursor is moved to point
 4255: ** to the virtual root page instead of the actual root page. A table has a
 4256: ** virtual root page when the actual root page contains no cells and a 
 4257: ** single child page. This can only happen with the table rooted at page 1.
 4258: **
 4259: ** If the b-tree structure is empty, the cursor state is set to 
 4260: ** CURSOR_INVALID. Otherwise, the cursor is set to point to the first
 4261: ** cell located on the root (or virtual root) page and the cursor state
 4262: ** is set to CURSOR_VALID.
 4263: **
 4264: ** If this function returns successfully, it may be assumed that the
 4265: ** page-header flags indicate that the [virtual] root-page is the expected 
 4266: ** kind of b-tree page (i.e. if when opening the cursor the caller did not
 4267: ** specify a KeyInfo structure the flags byte is set to 0x05 or 0x0D,
 4268: ** indicating a table b-tree, or if the caller did specify a KeyInfo 
 4269: ** structure the flags byte is set to 0x02 or 0x0A, indicating an index
 4270: ** b-tree).
 4271: */
 4272: static int moveToRoot(BtCursor *pCur){
 4273:   MemPage *pRoot;
 4274:   int rc = SQLITE_OK;
 4275:   Btree *p = pCur->pBtree;
 4276:   BtShared *pBt = p->pBt;
 4277: 
 4278:   assert( cursorHoldsMutex(pCur) );
 4279:   assert( CURSOR_INVALID < CURSOR_REQUIRESEEK );
 4280:   assert( CURSOR_VALID   < CURSOR_REQUIRESEEK );
 4281:   assert( CURSOR_FAULT   > CURSOR_REQUIRESEEK );
 4282:   if( pCur->eState>=CURSOR_REQUIRESEEK ){
 4283:     if( pCur->eState==CURSOR_FAULT ){
 4284:       assert( pCur->skipNext!=SQLITE_OK );
 4285:       return pCur->skipNext;
 4286:     }
 4287:     sqlite3BtreeClearCursor(pCur);
 4288:   }
 4289: 
 4290:   if( pCur->iPage>=0 ){
 4291:     int i;
 4292:     for(i=1; i<=pCur->iPage; i++){
 4293:       releasePage(pCur->apPage[i]);
 4294:     }
 4295:     pCur->iPage = 0;
 4296:   }else if( pCur->pgnoRoot==0 ){
 4297:     pCur->eState = CURSOR_INVALID;
 4298:     return SQLITE_OK;
 4299:   }else{
 4300:     rc = getAndInitPage(pBt, pCur->pgnoRoot, &pCur->apPage[0]);
 4301:     if( rc!=SQLITE_OK ){
 4302:       pCur->eState = CURSOR_INVALID;
 4303:       return rc;
 4304:     }
 4305:     pCur->iPage = 0;
 4306: 
 4307:     /* If pCur->pKeyInfo is not NULL, then the caller that opened this cursor
 4308:     ** expected to open it on an index b-tree. Otherwise, if pKeyInfo is
 4309:     ** NULL, the caller expects a table b-tree. If this is not the case,
 4310:     ** return an SQLITE_CORRUPT error.  */
 4311:     assert( pCur->apPage[0]->intKey==1 || pCur->apPage[0]->intKey==0 );
 4312:     if( (pCur->pKeyInfo==0)!=pCur->apPage[0]->intKey ){
 4313:       return SQLITE_CORRUPT_BKPT;
 4314:     }
 4315:   }
 4316: 
 4317:   /* Assert that the root page is of the correct type. This must be the
 4318:   ** case as the call to this function that loaded the root-page (either
 4319:   ** this call or a previous invocation) would have detected corruption 
 4320:   ** if the assumption were not true, and it is not possible for the flags 
 4321:   ** byte to have been modified while this cursor is holding a reference
 4322:   ** to the page.  */
 4323:   pRoot = pCur->apPage[0];
 4324:   assert( pRoot->pgno==pCur->pgnoRoot );
 4325:   assert( pRoot->isInit && (pCur->pKeyInfo==0)==pRoot->intKey );
 4326: 
 4327:   pCur->aiIdx[0] = 0;
 4328:   pCur->info.nSize = 0;
 4329:   pCur->atLast = 0;
 4330:   pCur->validNKey = 0;
 4331: 
 4332:   if( pRoot->nCell==0 && !pRoot->leaf ){
 4333:     Pgno subpage;
 4334:     if( pRoot->pgno!=1 ) return SQLITE_CORRUPT_BKPT;
 4335:     subpage = get4byte(&pRoot->aData[pRoot->hdrOffset+8]);
 4336:     pCur->eState = CURSOR_VALID;
 4337:     rc = moveToChild(pCur, subpage);
 4338:   }else{
 4339:     pCur->eState = ((pRoot->nCell>0)?CURSOR_VALID:CURSOR_INVALID);
 4340:   }
 4341:   return rc;
 4342: }
 4343: 
 4344: /*
 4345: ** Move the cursor down to the left-most leaf entry beneath the
 4346: ** entry to which it is currently pointing.
 4347: **
 4348: ** The left-most leaf is the one with the smallest key - the first
 4349: ** in ascending order.
 4350: */
 4351: static int moveToLeftmost(BtCursor *pCur){
 4352:   Pgno pgno;
 4353:   int rc = SQLITE_OK;
 4354:   MemPage *pPage;
 4355: 
 4356:   assert( cursorHoldsMutex(pCur) );
 4357:   assert( pCur->eState==CURSOR_VALID );
 4358:   while( rc==SQLITE_OK && !(pPage = pCur->apPage[pCur->iPage])->leaf ){
 4359:     assert( pCur->aiIdx[pCur->iPage]<pPage->nCell );
 4360:     pgno = get4byte(findCell(pPage, pCur->aiIdx[pCur->iPage]));
 4361:     rc = moveToChild(pCur, pgno);
 4362:   }
 4363:   return rc;
 4364: }
 4365: 
 4366: /*
 4367: ** Move the cursor down to the right-most leaf entry beneath the
 4368: ** page to which it is currently pointing.  Notice the difference
 4369: ** between moveToLeftmost() and moveToRightmost().  moveToLeftmost()
 4370: ** finds the left-most entry beneath the *entry* whereas moveToRightmost()
 4371: ** finds the right-most entry beneath the *page*.
 4372: **
 4373: ** The right-most entry is the one with the largest key - the last
 4374: ** key in ascending order.
 4375: */
 4376: static int moveToRightmost(BtCursor *pCur){
 4377:   Pgno pgno;
 4378:   int rc = SQLITE_OK;
 4379:   MemPage *pPage = 0;
 4380: 
 4381:   assert( cursorHoldsMutex(pCur) );
 4382:   assert( pCur->eState==CURSOR_VALID );
 4383:   while( rc==SQLITE_OK && !(pPage = pCur->apPage[pCur->iPage])->leaf ){
 4384:     pgno = get4byte(&pPage->aData[pPage->hdrOffset+8]);
 4385:     pCur->aiIdx[pCur->iPage] = pPage->nCell;
 4386:     rc = moveToChild(pCur, pgno);
 4387:   }
 4388:   if( rc==SQLITE_OK ){
 4389:     pCur->aiIdx[pCur->iPage] = pPage->nCell-1;
 4390:     pCur->info.nSize = 0;
 4391:     pCur->validNKey = 0;
 4392:   }
 4393:   return rc;
 4394: }
 4395: 
 4396: /* Move the cursor to the first entry in the table.  Return SQLITE_OK
 4397: ** on success.  Set *pRes to 0 if the cursor actually points to something
 4398: ** or set *pRes to 1 if the table is empty.
 4399: */
 4400: int sqlite3BtreeFirst(BtCursor *pCur, int *pRes){
 4401:   int rc;
 4402: 
 4403:   assert( cursorHoldsMutex(pCur) );
 4404:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
 4405:   rc = moveToRoot(pCur);
 4406:   if( rc==SQLITE_OK ){
 4407:     if( pCur->eState==CURSOR_INVALID ){
 4408:       assert( pCur->pgnoRoot==0 || pCur->apPage[pCur->iPage]->nCell==0 );
 4409:       *pRes = 1;
 4410:     }else{
 4411:       assert( pCur->apPage[pCur->iPage]->nCell>0 );
 4412:       *pRes = 0;
 4413:       rc = moveToLeftmost(pCur);
 4414:     }
 4415:   }
 4416:   return rc;
 4417: }
 4418: 
 4419: /* Move the cursor to the last entry in the table.  Return SQLITE_OK
 4420: ** on success.  Set *pRes to 0 if the cursor actually points to something
 4421: ** or set *pRes to 1 if the table is empty.
 4422: */
 4423: int sqlite3BtreeLast(BtCursor *pCur, int *pRes){
 4424:   int rc;
 4425:  
 4426:   assert( cursorHoldsMutex(pCur) );
 4427:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
 4428: 
 4429:   /* If the cursor already points to the last entry, this is a no-op. */
 4430:   if( CURSOR_VALID==pCur->eState && pCur->atLast ){
 4431: #ifdef SQLITE_DEBUG
 4432:     /* This block serves to assert() that the cursor really does point 
 4433:     ** to the last entry in the b-tree. */
 4434:     int ii;
 4435:     for(ii=0; ii<pCur->iPage; ii++){
 4436:       assert( pCur->aiIdx[ii]==pCur->apPage[ii]->nCell );
 4437:     }
 4438:     assert( pCur->aiIdx[pCur->iPage]==pCur->apPage[pCur->iPage]->nCell-1 );
 4439:     assert( pCur->apPage[pCur->iPage]->leaf );
 4440: #endif
 4441:     return SQLITE_OK;
 4442:   }
 4443: 
 4444:   rc = moveToRoot(pCur);
 4445:   if( rc==SQLITE_OK ){
 4446:     if( CURSOR_INVALID==pCur->eState ){
 4447:       assert( pCur->pgnoRoot==0 || pCur->apPage[pCur->iPage]->nCell==0 );
 4448:       *pRes = 1;
 4449:     }else{
 4450:       assert( pCur->eState==CURSOR_VALID );
 4451:       *pRes = 0;
 4452:       rc = moveToRightmost(pCur);
 4453:       pCur->atLast = rc==SQLITE_OK ?1:0;
 4454:     }
 4455:   }
 4456:   return rc;
 4457: }
 4458: 
 4459: /* Move the cursor so that it points to an entry near the key 
 4460: ** specified by pIdxKey or intKey.   Return a success code.
 4461: **
 4462: ** For INTKEY tables, the intKey parameter is used.  pIdxKey 
 4463: ** must be NULL.  For index tables, pIdxKey is used and intKey
 4464: ** is ignored.
 4465: **
 4466: ** If an exact match is not found, then the cursor is always
 4467: ** left pointing at a leaf page which would hold the entry if it
 4468: ** were present.  The cursor might point to an entry that comes
 4469: ** before or after the key.
 4470: **
 4471: ** An integer is written into *pRes which is the result of
 4472: ** comparing the key with the entry to which the cursor is 
 4473: ** pointing.  The meaning of the integer written into
 4474: ** *pRes is as follows:
 4475: **
 4476: **     *pRes<0      The cursor is left pointing at an entry that
 4477: **                  is smaller than intKey/pIdxKey or if the table is empty
 4478: **                  and the cursor is therefore left point to nothing.
 4479: **
 4480: **     *pRes==0     The cursor is left pointing at an entry that
 4481: **                  exactly matches intKey/pIdxKey.
 4482: **
 4483: **     *pRes>0      The cursor is left pointing at an entry that
 4484: **                  is larger than intKey/pIdxKey.
 4485: **
 4486: */
 4487: int sqlite3BtreeMovetoUnpacked(
 4488:   BtCursor *pCur,          /* The cursor to be moved */
 4489:   UnpackedRecord *pIdxKey, /* Unpacked index key */
 4490:   i64 intKey,              /* The table key */
 4491:   int biasRight,           /* If true, bias the search to the high end */
 4492:   int *pRes                /* Write search results here */
 4493: ){
 4494:   int rc;
 4495: 
 4496:   assert( cursorHoldsMutex(pCur) );
 4497:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
 4498:   assert( pRes );
 4499:   assert( (pIdxKey==0)==(pCur->pKeyInfo==0) );
 4500: 
 4501:   /* If the cursor is already positioned at the point we are trying
 4502:   ** to move to, then just return without doing any work */
 4503:   if( pCur->eState==CURSOR_VALID && pCur->validNKey 
 4504:    && pCur->apPage[0]->intKey 
 4505:   ){
 4506:     if( pCur->info.nKey==intKey ){
 4507:       *pRes = 0;
 4508:       return SQLITE_OK;
 4509:     }
 4510:     if( pCur->atLast && pCur->info.nKey<intKey ){
 4511:       *pRes = -1;
 4512:       return SQLITE_OK;
 4513:     }
 4514:   }
 4515: 
 4516:   rc = moveToRoot(pCur);
 4517:   if( rc ){
 4518:     return rc;
 4519:   }
 4520:   assert( pCur->pgnoRoot==0 || pCur->apPage[pCur->iPage] );
 4521:   assert( pCur->pgnoRoot==0 || pCur->apPage[pCur->iPage]->isInit );
 4522:   assert( pCur->eState==CURSOR_INVALID || pCur->apPage[pCur->iPage]->nCell>0 );
 4523:   if( pCur->eState==CURSOR_INVALID ){
 4524:     *pRes = -1;
 4525:     assert( pCur->pgnoRoot==0 || pCur->apPage[pCur->iPage]->nCell==0 );
 4526:     return SQLITE_OK;
 4527:   }
 4528:   assert( pCur->apPage[0]->intKey || pIdxKey );
 4529:   for(;;){
 4530:     int lwr, upr, idx;
 4531:     Pgno chldPg;
 4532:     MemPage *pPage = pCur->apPage[pCur->iPage];
 4533:     int c;
 4534: 
 4535:     /* pPage->nCell must be greater than zero. If this is the root-page
 4536:     ** the cursor would have been INVALID above and this for(;;) loop
 4537:     ** not run. If this is not the root-page, then the moveToChild() routine
 4538:     ** would have already detected db corruption. Similarly, pPage must
 4539:     ** be the right kind (index or table) of b-tree page. Otherwise
 4540:     ** a moveToChild() or moveToRoot() call would have detected corruption.  */
 4541:     assert( pPage->nCell>0 );
 4542:     assert( pPage->intKey==(pIdxKey==0) );
 4543:     lwr = 0;
 4544:     upr = pPage->nCell-1;
 4545:     if( biasRight ){
 4546:       pCur->aiIdx[pCur->iPage] = (u16)(idx = upr);
 4547:     }else{
 4548:       pCur->aiIdx[pCur->iPage] = (u16)(idx = (upr+lwr)/2);
 4549:     }
 4550:     for(;;){
 4551:       u8 *pCell;                          /* Pointer to current cell in pPage */
 4552: 
 4553:       assert( idx==pCur->aiIdx[pCur->iPage] );
 4554:       pCur->info.nSize = 0;
 4555:       pCell = findCell(pPage, idx) + pPage->childPtrSize;
 4556:       if( pPage->intKey ){
 4557:         i64 nCellKey;
 4558:         if( pPage->hasData ){
 4559:           u32 dummy;
 4560:           pCell += getVarint32(pCell, dummy);
 4561:         }
 4562:         getVarint(pCell, (u64*)&nCellKey);
 4563:         if( nCellKey==intKey ){
 4564:           c = 0;
 4565:         }else if( nCellKey<intKey ){
 4566:           c = -1;
 4567:         }else{
 4568:           assert( nCellKey>intKey );
 4569:           c = +1;
 4570:         }
 4571:         pCur->validNKey = 1;
 4572:         pCur->info.nKey = nCellKey;
 4573:       }else{
 4574:         /* The maximum supported page-size is 65536 bytes. This means that
 4575:         ** the maximum number of record bytes stored on an index B-Tree
 4576:         ** page is less than 16384 bytes and may be stored as a 2-byte
 4577:         ** varint. This information is used to attempt to avoid parsing 
 4578:         ** the entire cell by checking for the cases where the record is 
 4579:         ** stored entirely within the b-tree page by inspecting the first 
 4580:         ** 2 bytes of the cell.
 4581:         */
 4582:         int nCell = pCell[0];
 4583:         if( nCell<=pPage->max1bytePayload
 4584:          /* && (pCell+nCell)<pPage->aDataEnd */
 4585:         ){
 4586:           /* This branch runs if the record-size field of the cell is a
 4587:           ** single byte varint and the record fits entirely on the main
 4588:           ** b-tree page.  */
 4589:           testcase( pCell+nCell+1==pPage->aDataEnd );
 4590:           c = sqlite3VdbeRecordCompare(nCell, (void*)&pCell[1], pIdxKey);
 4591:         }else if( !(pCell[1] & 0x80) 
 4592:           && (nCell = ((nCell&0x7f)<<7) + pCell[1])<=pPage->maxLocal
 4593:           /* && (pCell+nCell+2)<=pPage->aDataEnd */
 4594:         ){
 4595:           /* The record-size field is a 2 byte varint and the record 
 4596:           ** fits entirely on the main b-tree page.  */
 4597:           testcase( pCell+nCell+2==pPage->aDataEnd );
 4598:           c = sqlite3VdbeRecordCompare(nCell, (void*)&pCell[2], pIdxKey);
 4599:         }else{
 4600:           /* The record flows over onto one or more overflow pages. In
 4601:           ** this case the whole cell needs to be parsed, a buffer allocated
 4602:           ** and accessPayload() used to retrieve the record into the
 4603:           ** buffer before VdbeRecordCompare() can be called. */
 4604:           void *pCellKey;
 4605:           u8 * const pCellBody = pCell - pPage->childPtrSize;
 4606:           btreeParseCellPtr(pPage, pCellBody, &pCur->info);
 4607:           nCell = (int)pCur->info.nKey;
 4608:           pCellKey = sqlite3Malloc( nCell );
 4609:           if( pCellKey==0 ){
 4610:             rc = SQLITE_NOMEM;
 4611:             goto moveto_finish;
 4612:           }
 4613:           rc = accessPayload(pCur, 0, nCell, (unsigned char*)pCellKey, 0);
 4614:           if( rc ){
 4615:             sqlite3_free(pCellKey);
 4616:             goto moveto_finish;
 4617:           }
 4618:           c = sqlite3VdbeRecordCompare(nCell, pCellKey, pIdxKey);
 4619:           sqlite3_free(pCellKey);
 4620:         }
 4621:       }
 4622:       if( c==0 ){
 4623:         if( pPage->intKey && !pPage->leaf ){
 4624:           lwr = idx;
 4625:           break;
 4626:         }else{
 4627:           *pRes = 0;
 4628:           rc = SQLITE_OK;
 4629:           goto moveto_finish;
 4630:         }
 4631:       }
 4632:       if( c<0 ){
 4633:         lwr = idx+1;
 4634:       }else{
 4635:         upr = idx-1;
 4636:       }
 4637:       if( lwr>upr ){
 4638:         break;
 4639:       }
 4640:       pCur->aiIdx[pCur->iPage] = (u16)(idx = (lwr+upr)/2);
 4641:     }
 4642:     assert( lwr==upr+1 || (pPage->intKey && !pPage->leaf) );
 4643:     assert( pPage->isInit );
 4644:     if( pPage->leaf ){
 4645:       chldPg = 0;
 4646:     }else if( lwr>=pPage->nCell ){
 4647:       chldPg = get4byte(&pPage->aData[pPage->hdrOffset+8]);
 4648:     }else{
 4649:       chldPg = get4byte(findCell(pPage, lwr));
 4650:     }
 4651:     if( chldPg==0 ){
 4652:       assert( pCur->aiIdx[pCur->iPage]<pCur->apPage[pCur->iPage]->nCell );
 4653:       *pRes = c;
 4654:       rc = SQLITE_OK;
 4655:       goto moveto_finish;
 4656:     }
 4657:     pCur->aiIdx[pCur->iPage] = (u16)lwr;
 4658:     pCur->info.nSize = 0;
 4659:     pCur->validNKey = 0;
 4660:     rc = moveToChild(pCur, chldPg);
 4661:     if( rc ) goto moveto_finish;
 4662:   }
 4663: moveto_finish:
 4664:   return rc;
 4665: }
 4666: 
 4667: 
 4668: /*
 4669: ** Return TRUE if the cursor is not pointing at an entry of the table.
 4670: **
 4671: ** TRUE will be returned after a call to sqlite3BtreeNext() moves
 4672: ** past the last entry in the table or sqlite3BtreePrev() moves past
 4673: ** the first entry.  TRUE is also returned if the table is empty.
 4674: */
 4675: int sqlite3BtreeEof(BtCursor *pCur){
 4676:   /* TODO: What if the cursor is in CURSOR_REQUIRESEEK but all table entries
 4677:   ** have been deleted? This API will need to change to return an error code
 4678:   ** as well as the boolean result value.
 4679:   */
 4680:   return (CURSOR_VALID!=pCur->eState);
 4681: }
 4682: 
 4683: /*
 4684: ** Advance the cursor to the next entry in the database.  If
 4685: ** successful then set *pRes=0.  If the cursor
 4686: ** was already pointing to the last entry in the database before
 4687: ** this routine was called, then set *pRes=1.
 4688: */
 4689: int sqlite3BtreeNext(BtCursor *pCur, int *pRes){
 4690:   int rc;
 4691:   int idx;
 4692:   MemPage *pPage;
 4693: 
 4694:   assert( cursorHoldsMutex(pCur) );
 4695:   rc = restoreCursorPosition(pCur);
 4696:   if( rc!=SQLITE_OK ){
 4697:     return rc;
 4698:   }
 4699:   assert( pRes!=0 );
 4700:   if( CURSOR_INVALID==pCur->eState ){
 4701:     *pRes = 1;
 4702:     return SQLITE_OK;
 4703:   }
 4704:   if( pCur->skipNext>0 ){
 4705:     pCur->skipNext = 0;
 4706:     *pRes = 0;
 4707:     return SQLITE_OK;
 4708:   }
 4709:   pCur->skipNext = 0;
 4710: 
 4711:   pPage = pCur->apPage[pCur->iPage];
 4712:   idx = ++pCur->aiIdx[pCur->iPage];
 4713:   assert( pPage->isInit );
 4714: 
 4715:   /* If the database file is corrupt, it is possible for the value of idx 
 4716:   ** to be invalid here. This can only occur if a second cursor modifies
 4717:   ** the page while cursor pCur is holding a reference to it. Which can
 4718:   ** only happen if the database is corrupt in such a way as to link the
 4719:   ** page into more than one b-tree structure. */
 4720:   testcase( idx>pPage->nCell );
 4721: 
 4722:   pCur->info.nSize = 0;
 4723:   pCur->validNKey = 0;
 4724:   if( idx>=pPage->nCell ){
 4725:     if( !pPage->leaf ){
 4726:       rc = moveToChild(pCur, get4byte(&pPage->aData[pPage->hdrOffset+8]));
 4727:       if( rc ) return rc;
 4728:       rc = moveToLeftmost(pCur);
 4729:       *pRes = 0;
 4730:       return rc;
 4731:     }
 4732:     do{
 4733:       if( pCur->iPage==0 ){
 4734:         *pRes = 1;
 4735:         pCur->eState = CURSOR_INVALID;
 4736:         return SQLITE_OK;
 4737:       }
 4738:       moveToParent(pCur);
 4739:       pPage = pCur->apPage[pCur->iPage];
 4740:     }while( pCur->aiIdx[pCur->iPage]>=pPage->nCell );
 4741:     *pRes = 0;
 4742:     if( pPage->intKey ){
 4743:       rc = sqlite3BtreeNext(pCur, pRes);
 4744:     }else{
 4745:       rc = SQLITE_OK;
 4746:     }
 4747:     return rc;
 4748:   }
 4749:   *pRes = 0;
 4750:   if( pPage->leaf ){
 4751:     return SQLITE_OK;
 4752:   }
 4753:   rc = moveToLeftmost(pCur);
 4754:   return rc;
 4755: }
 4756: 
 4757: 
 4758: /*
 4759: ** Step the cursor to the back to the previous entry in the database.  If
 4760: ** successful then set *pRes=0.  If the cursor
 4761: ** was already pointing to the first entry in the database before
 4762: ** this routine was called, then set *pRes=1.
 4763: */
 4764: int sqlite3BtreePrevious(BtCursor *pCur, int *pRes){
 4765:   int rc;
 4766:   MemPage *pPage;
 4767: 
 4768:   assert( cursorHoldsMutex(pCur) );
 4769:   rc = restoreCursorPosition(pCur);
 4770:   if( rc!=SQLITE_OK ){
 4771:     return rc;
 4772:   }
 4773:   pCur->atLast = 0;
 4774:   if( CURSOR_INVALID==pCur->eState ){
 4775:     *pRes = 1;
 4776:     return SQLITE_OK;
 4777:   }
 4778:   if( pCur->skipNext<0 ){
 4779:     pCur->skipNext = 0;
 4780:     *pRes = 0;
 4781:     return SQLITE_OK;
 4782:   }
 4783:   pCur->skipNext = 0;
 4784: 
 4785:   pPage = pCur->apPage[pCur->iPage];
 4786:   assert( pPage->isInit );
 4787:   if( !pPage->leaf ){
 4788:     int idx = pCur->aiIdx[pCur->iPage];
 4789:     rc = moveToChild(pCur, get4byte(findCell(pPage, idx)));
 4790:     if( rc ){
 4791:       return rc;
 4792:     }
 4793:     rc = moveToRightmost(pCur);
 4794:   }else{
 4795:     while( pCur->aiIdx[pCur->iPage]==0 ){
 4796:       if( pCur->iPage==0 ){
 4797:         pCur->eState = CURSOR_INVALID;
 4798:         *pRes = 1;
 4799:         return SQLITE_OK;
 4800:       }
 4801:       moveToParent(pCur);
 4802:     }
 4803:     pCur->info.nSize = 0;
 4804:     pCur->validNKey = 0;
 4805: 
 4806:     pCur->aiIdx[pCur->iPage]--;
 4807:     pPage = pCur->apPage[pCur->iPage];
 4808:     if( pPage->intKey && !pPage->leaf ){
 4809:       rc = sqlite3BtreePrevious(pCur, pRes);
 4810:     }else{
 4811:       rc = SQLITE_OK;
 4812:     }
 4813:   }
 4814:   *pRes = 0;
 4815:   return rc;
 4816: }
 4817: 
 4818: /*
 4819: ** Allocate a new page from the database file.
 4820: **
 4821: ** The new page is marked as dirty.  (In other words, sqlite3PagerWrite()
 4822: ** has already been called on the new page.)  The new page has also
 4823: ** been referenced and the calling routine is responsible for calling
 4824: ** sqlite3PagerUnref() on the new page when it is done.
 4825: **
 4826: ** SQLITE_OK is returned on success.  Any other return value indicates
 4827: ** an error.  *ppPage and *pPgno are undefined in the event of an error.
 4828: ** Do not invoke sqlite3PagerUnref() on *ppPage if an error is returned.
 4829: **
 4830: ** If the "nearby" parameter is not 0, then a (feeble) effort is made to 
 4831: ** locate a page close to the page number "nearby".  This can be used in an
 4832: ** attempt to keep related pages close to each other in the database file,
 4833: ** which in turn can make database access faster.
 4834: **
 4835: ** If the "exact" parameter is not 0, and the page-number nearby exists 
 4836: ** anywhere on the free-list, then it is guarenteed to be returned. This
 4837: ** is only used by auto-vacuum databases when allocating a new table.
 4838: */
 4839: static int allocateBtreePage(
 4840:   BtShared *pBt, 
 4841:   MemPage **ppPage, 
 4842:   Pgno *pPgno, 
 4843:   Pgno nearby,
 4844:   u8 exact
 4845: ){
 4846:   MemPage *pPage1;
 4847:   int rc;
 4848:   u32 n;     /* Number of pages on the freelist */
 4849:   u32 k;     /* Number of leaves on the trunk of the freelist */
 4850:   MemPage *pTrunk = 0;
 4851:   MemPage *pPrevTrunk = 0;
 4852:   Pgno mxPage;     /* Total size of the database file */
 4853: 
 4854:   assert( sqlite3_mutex_held(pBt->mutex) );
 4855:   pPage1 = pBt->pPage1;
 4856:   mxPage = btreePagecount(pBt);
 4857:   n = get4byte(&pPage1->aData[36]);
 4858:   testcase( n==mxPage-1 );
 4859:   if( n>=mxPage ){
 4860:     return SQLITE_CORRUPT_BKPT;
 4861:   }
 4862:   if( n>0 ){
 4863:     /* There are pages on the freelist.  Reuse one of those pages. */
 4864:     Pgno iTrunk;
 4865:     u8 searchList = 0; /* If the free-list must be searched for 'nearby' */
 4866:     
 4867:     /* If the 'exact' parameter was true and a query of the pointer-map
 4868:     ** shows that the page 'nearby' is somewhere on the free-list, then
 4869:     ** the entire-list will be searched for that page.
 4870:     */
 4871: #ifndef SQLITE_OMIT_AUTOVACUUM
 4872:     if( exact && nearby<=mxPage ){
 4873:       u8 eType;
 4874:       assert( nearby>0 );
 4875:       assert( pBt->autoVacuum );
 4876:       rc = ptrmapGet(pBt, nearby, &eType, 0);
 4877:       if( rc ) return rc;
 4878:       if( eType==PTRMAP_FREEPAGE ){
 4879:         searchList = 1;
 4880:       }
 4881:       *pPgno = nearby;
 4882:     }
 4883: #endif
 4884: 
 4885:     /* Decrement the free-list count by 1. Set iTrunk to the index of the
 4886:     ** first free-list trunk page. iPrevTrunk is initially 1.
 4887:     */
 4888:     rc = sqlite3PagerWrite(pPage1->pDbPage);
 4889:     if( rc ) return rc;
 4890:     put4byte(&pPage1->aData[36], n-1);
 4891: 
 4892:     /* The code within this loop is run only once if the 'searchList' variable
 4893:     ** is not true. Otherwise, it runs once for each trunk-page on the
 4894:     ** free-list until the page 'nearby' is located.
 4895:     */
 4896:     do {
 4897:       pPrevTrunk = pTrunk;
 4898:       if( pPrevTrunk ){
 4899:         iTrunk = get4byte(&pPrevTrunk->aData[0]);
 4900:       }else{
 4901:         iTrunk = get4byte(&pPage1->aData[32]);
 4902:       }
 4903:       testcase( iTrunk==mxPage );
 4904:       if( iTrunk>mxPage ){
 4905:         rc = SQLITE_CORRUPT_BKPT;
 4906:       }else{
 4907:         rc = btreeGetPage(pBt, iTrunk, &pTrunk, 0);
 4908:       }
 4909:       if( rc ){
 4910:         pTrunk = 0;
 4911:         goto end_allocate_page;
 4912:       }
 4913:       assert( pTrunk!=0 );
 4914:       assert( pTrunk->aData!=0 );
 4915: 
 4916:       k = get4byte(&pTrunk->aData[4]); /* # of leaves on this trunk page */
 4917:       if( k==0 && !searchList ){
 4918:         /* The trunk has no leaves and the list is not being searched. 
 4919:         ** So extract the trunk page itself and use it as the newly 
 4920:         ** allocated page */
 4921:         assert( pPrevTrunk==0 );
 4922:         rc = sqlite3PagerWrite(pTrunk->pDbPage);
 4923:         if( rc ){
 4924:           goto end_allocate_page;
 4925:         }
 4926:         *pPgno = iTrunk;
 4927:         memcpy(&pPage1->aData[32], &pTrunk->aData[0], 4);
 4928:         *ppPage = pTrunk;
 4929:         pTrunk = 0;
 4930:         TRACE(("ALLOCATE: %d trunk - %d free pages left\n", *pPgno, n-1));
 4931:       }else if( k>(u32)(pBt->usableSize/4 - 2) ){
 4932:         /* Value of k is out of range.  Database corruption */
 4933:         rc = SQLITE_CORRUPT_BKPT;
 4934:         goto end_allocate_page;
 4935: #ifndef SQLITE_OMIT_AUTOVACUUM
 4936:       }else if( searchList && nearby==iTrunk ){
 4937:         /* The list is being searched and this trunk page is the page
 4938:         ** to allocate, regardless of whether it has leaves.
 4939:         */
 4940:         assert( *pPgno==iTrunk );
 4941:         *ppPage = pTrunk;
 4942:         searchList = 0;
 4943:         rc = sqlite3PagerWrite(pTrunk->pDbPage);
 4944:         if( rc ){
 4945:           goto end_allocate_page;
 4946:         }
 4947:         if( k==0 ){
 4948:           if( !pPrevTrunk ){
 4949:             memcpy(&pPage1->aData[32], &pTrunk->aData[0], 4);
 4950:           }else{
 4951:             rc = sqlite3PagerWrite(pPrevTrunk->pDbPage);
 4952:             if( rc!=SQLITE_OK ){
 4953:               goto end_allocate_page;
 4954:             }
 4955:             memcpy(&pPrevTrunk->aData[0], &pTrunk->aData[0], 4);
 4956:           }
 4957:         }else{
 4958:           /* The trunk page is required by the caller but it contains 
 4959:           ** pointers to free-list leaves. The first leaf becomes a trunk
 4960:           ** page in this case.
 4961:           */
 4962:           MemPage *pNewTrunk;
 4963:           Pgno iNewTrunk = get4byte(&pTrunk->aData[8]);
 4964:           if( iNewTrunk>mxPage ){ 
 4965:             rc = SQLITE_CORRUPT_BKPT;
 4966:             goto end_allocate_page;
 4967:           }
 4968:           testcase( iNewTrunk==mxPage );
 4969:           rc = btreeGetPage(pBt, iNewTrunk, &pNewTrunk, 0);
 4970:           if( rc!=SQLITE_OK ){
 4971:             goto end_allocate_page;
 4972:           }
 4973:           rc = sqlite3PagerWrite(pNewTrunk->pDbPage);
 4974:           if( rc!=SQLITE_OK ){
 4975:             releasePage(pNewTrunk);
 4976:             goto end_allocate_page;
 4977:           }
 4978:           memcpy(&pNewTrunk->aData[0], &pTrunk->aData[0], 4);
 4979:           put4byte(&pNewTrunk->aData[4], k-1);
 4980:           memcpy(&pNewTrunk->aData[8], &pTrunk->aData[12], (k-1)*4);
 4981:           releasePage(pNewTrunk);
 4982:           if( !pPrevTrunk ){
 4983:             assert( sqlite3PagerIswriteable(pPage1->pDbPage) );
 4984:             put4byte(&pPage1->aData[32], iNewTrunk);
 4985:           }else{
 4986:             rc = sqlite3PagerWrite(pPrevTrunk->pDbPage);
 4987:             if( rc ){
 4988:               goto end_allocate_page;
 4989:             }
 4990:             put4byte(&pPrevTrunk->aData[0], iNewTrunk);
 4991:           }
 4992:         }
 4993:         pTrunk = 0;
 4994:         TRACE(("ALLOCATE: %d trunk - %d free pages left\n", *pPgno, n-1));
 4995: #endif
 4996:       }else if( k>0 ){
 4997:         /* Extract a leaf from the trunk */
 4998:         u32 closest;
 4999:         Pgno iPage;
 5000:         unsigned char *aData = pTrunk->aData;
 5001:         if( nearby>0 ){
 5002:           u32 i;
 5003:           int dist;
 5004:           closest = 0;
 5005:           dist = sqlite3AbsInt32(get4byte(&aData[8]) - nearby);
 5006:           for(i=1; i<k; i++){
 5007:             int d2 = sqlite3AbsInt32(get4byte(&aData[8+i*4]) - nearby);
 5008:             if( d2<dist ){
 5009:               closest = i;
 5010:               dist = d2;
 5011:             }
 5012:           }
 5013:         }else{
 5014:           closest = 0;
 5015:         }
 5016: 
 5017:         iPage = get4byte(&aData[8+closest*4]);
 5018:         testcase( iPage==mxPage );
 5019:         if( iPage>mxPage ){
 5020:           rc = SQLITE_CORRUPT_BKPT;
 5021:           goto end_allocate_page;
 5022:         }
 5023:         testcase( iPage==mxPage );
 5024:         if( !searchList || iPage==nearby ){
 5025:           int noContent;
 5026:           *pPgno = iPage;
 5027:           TRACE(("ALLOCATE: %d was leaf %d of %d on trunk %d"
 5028:                  ": %d more free pages\n",
 5029:                  *pPgno, closest+1, k, pTrunk->pgno, n-1));
 5030:           rc = sqlite3PagerWrite(pTrunk->pDbPage);
 5031:           if( rc ) goto end_allocate_page;
 5032:           if( closest<k-1 ){
 5033:             memcpy(&aData[8+closest*4], &aData[4+k*4], 4);
 5034:           }
 5035:           put4byte(&aData[4], k-1);
 5036:           noContent = !btreeGetHasContent(pBt, *pPgno);
 5037:           rc = btreeGetPage(pBt, *pPgno, ppPage, noContent);
 5038:           if( rc==SQLITE_OK ){
 5039:             rc = sqlite3PagerWrite((*ppPage)->pDbPage);
 5040:             if( rc!=SQLITE_OK ){
 5041:               releasePage(*ppPage);
 5042:             }
 5043:           }
 5044:           searchList = 0;
 5045:         }
 5046:       }
 5047:       releasePage(pPrevTrunk);
 5048:       pPrevTrunk = 0;
 5049:     }while( searchList );
 5050:   }else{
 5051:     /* There are no pages on the freelist, so create a new page at the
 5052:     ** end of the file */
 5053:     rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
 5054:     if( rc ) return rc;
 5055:     pBt->nPage++;
 5056:     if( pBt->nPage==PENDING_BYTE_PAGE(pBt) ) pBt->nPage++;
 5057: 
 5058: #ifndef SQLITE_OMIT_AUTOVACUUM
 5059:     if( pBt->autoVacuum && PTRMAP_ISPAGE(pBt, pBt->nPage) ){
 5060:       /* If *pPgno refers to a pointer-map page, allocate two new pages
 5061:       ** at the end of the file instead of one. The first allocated page
 5062:       ** becomes a new pointer-map page, the second is used by the caller.
 5063:       */
 5064:       MemPage *pPg = 0;
 5065:       TRACE(("ALLOCATE: %d from end of file (pointer-map page)\n", pBt->nPage));
 5066:       assert( pBt->nPage!=PENDING_BYTE_PAGE(pBt) );
 5067:       rc = btreeGetPage(pBt, pBt->nPage, &pPg, 1);
 5068:       if( rc==SQLITE_OK ){
 5069:         rc = sqlite3PagerWrite(pPg->pDbPage);
 5070:         releasePage(pPg);
 5071:       }
 5072:       if( rc ) return rc;
 5073:       pBt->nPage++;
 5074:       if( pBt->nPage==PENDING_BYTE_PAGE(pBt) ){ pBt->nPage++; }
 5075:     }
 5076: #endif
 5077:     put4byte(28 + (u8*)pBt->pPage1->aData, pBt->nPage);
 5078:     *pPgno = pBt->nPage;
 5079: 
 5080:     assert( *pPgno!=PENDING_BYTE_PAGE(pBt) );
 5081:     rc = btreeGetPage(pBt, *pPgno, ppPage, 1);
 5082:     if( rc ) return rc;
 5083:     rc = sqlite3PagerWrite((*ppPage)->pDbPage);
 5084:     if( rc!=SQLITE_OK ){
 5085:       releasePage(*ppPage);
 5086:     }
 5087:     TRACE(("ALLOCATE: %d from end of file\n", *pPgno));
 5088:   }
 5089: 
 5090:   assert( *pPgno!=PENDING_BYTE_PAGE(pBt) );
 5091: 
 5092: end_allocate_page:
 5093:   releasePage(pTrunk);
 5094:   releasePage(pPrevTrunk);
 5095:   if( rc==SQLITE_OK ){
 5096:     if( sqlite3PagerPageRefcount((*ppPage)->pDbPage)>1 ){
 5097:       releasePage(*ppPage);
 5098:       return SQLITE_CORRUPT_BKPT;
 5099:     }
 5100:     (*ppPage)->isInit = 0;
 5101:   }else{
 5102:     *ppPage = 0;
 5103:   }
 5104:   assert( rc!=SQLITE_OK || sqlite3PagerIswriteable((*ppPage)->pDbPage) );
 5105:   return rc;
 5106: }
 5107: 
 5108: /*
 5109: ** This function is used to add page iPage to the database file free-list. 
 5110: ** It is assumed that the page is not already a part of the free-list.
 5111: **
 5112: ** The value passed as the second argument to this function is optional.
 5113: ** If the caller happens to have a pointer to the MemPage object 
 5114: ** corresponding to page iPage handy, it may pass it as the second value. 
 5115: ** Otherwise, it may pass NULL.
 5116: **
 5117: ** If a pointer to a MemPage object is passed as the second argument,
 5118: ** its reference count is not altered by this function.
 5119: */
 5120: static int freePage2(BtShared *pBt, MemPage *pMemPage, Pgno iPage){
 5121:   MemPage *pTrunk = 0;                /* Free-list trunk page */
 5122:   Pgno iTrunk = 0;                    /* Page number of free-list trunk page */ 
 5123:   MemPage *pPage1 = pBt->pPage1;      /* Local reference to page 1 */
 5124:   MemPage *pPage;                     /* Page being freed. May be NULL. */
 5125:   int rc;                             /* Return Code */
 5126:   int nFree;                          /* Initial number of pages on free-list */
 5127: 
 5128:   assert( sqlite3_mutex_held(pBt->mutex) );
 5129:   assert( iPage>1 );
 5130:   assert( !pMemPage || pMemPage->pgno==iPage );
 5131: 
 5132:   if( pMemPage ){
 5133:     pPage = pMemPage;
 5134:     sqlite3PagerRef(pPage->pDbPage);
 5135:   }else{
 5136:     pPage = btreePageLookup(pBt, iPage);
 5137:   }
 5138: 
 5139:   /* Increment the free page count on pPage1 */
 5140:   rc = sqlite3PagerWrite(pPage1->pDbPage);
 5141:   if( rc ) goto freepage_out;
 5142:   nFree = get4byte(&pPage1->aData[36]);
 5143:   put4byte(&pPage1->aData[36], nFree+1);
 5144: 
 5145:   if( pBt->btsFlags & BTS_SECURE_DELETE ){
 5146:     /* If the secure_delete option is enabled, then
 5147:     ** always fully overwrite deleted information with zeros.
 5148:     */
 5149:     if( (!pPage && ((rc = btreeGetPage(pBt, iPage, &pPage, 0))!=0) )
 5150:      ||            ((rc = sqlite3PagerWrite(pPage->pDbPage))!=0)
 5151:     ){
 5152:       goto freepage_out;
 5153:     }
 5154:     memset(pPage->aData, 0, pPage->pBt->pageSize);
 5155:   }
 5156: 
 5157:   /* If the database supports auto-vacuum, write an entry in the pointer-map
 5158:   ** to indicate that the page is free.
 5159:   */
 5160:   if( ISAUTOVACUUM ){
 5161:     ptrmapPut(pBt, iPage, PTRMAP_FREEPAGE, 0, &rc);
 5162:     if( rc ) goto freepage_out;
 5163:   }
 5164: 
 5165:   /* Now manipulate the actual database free-list structure. There are two
 5166:   ** possibilities. If the free-list is currently empty, or if the first
 5167:   ** trunk page in the free-list is full, then this page will become a
 5168:   ** new free-list trunk page. Otherwise, it will become a leaf of the
 5169:   ** first trunk page in the current free-list. This block tests if it
 5170:   ** is possible to add the page as a new free-list leaf.
 5171:   */
 5172:   if( nFree!=0 ){
 5173:     u32 nLeaf;                /* Initial number of leaf cells on trunk page */
 5174: 
 5175:     iTrunk = get4byte(&pPage1->aData[32]);
 5176:     rc = btreeGetPage(pBt, iTrunk, &pTrunk, 0);
 5177:     if( rc!=SQLITE_OK ){
 5178:       goto freepage_out;
 5179:     }
 5180: 
 5181:     nLeaf = get4byte(&pTrunk->aData[4]);
 5182:     assert( pBt->usableSize>32 );
 5183:     if( nLeaf > (u32)pBt->usableSize/4 - 2 ){
 5184:       rc = SQLITE_CORRUPT_BKPT;
 5185:       goto freepage_out;
 5186:     }
 5187:     if( nLeaf < (u32)pBt->usableSize/4 - 8 ){
 5188:       /* In this case there is room on the trunk page to insert the page
 5189:       ** being freed as a new leaf.
 5190:       **
 5191:       ** Note that the trunk page is not really full until it contains
 5192:       ** usableSize/4 - 2 entries, not usableSize/4 - 8 entries as we have
 5193:       ** coded.  But due to a coding error in versions of SQLite prior to
 5194:       ** 3.6.0, databases with freelist trunk pages holding more than
 5195:       ** usableSize/4 - 8 entries will be reported as corrupt.  In order
 5196:       ** to maintain backwards compatibility with older versions of SQLite,
 5197:       ** we will continue to restrict the number of entries to usableSize/4 - 8
 5198:       ** for now.  At some point in the future (once everyone has upgraded
 5199:       ** to 3.6.0 or later) we should consider fixing the conditional above
 5200:       ** to read "usableSize/4-2" instead of "usableSize/4-8".
 5201:       */
 5202:       rc = sqlite3PagerWrite(pTrunk->pDbPage);
 5203:       if( rc==SQLITE_OK ){
 5204:         put4byte(&pTrunk->aData[4], nLeaf+1);
 5205:         put4byte(&pTrunk->aData[8+nLeaf*4], iPage);
 5206:         if( pPage && (pBt->btsFlags & BTS_SECURE_DELETE)==0 ){
 5207:           sqlite3PagerDontWrite(pPage->pDbPage);
 5208:         }
 5209:         rc = btreeSetHasContent(pBt, iPage);
 5210:       }
 5211:       TRACE(("FREE-PAGE: %d leaf on trunk page %d\n",pPage->pgno,pTrunk->pgno));
 5212:       goto freepage_out;
 5213:     }
 5214:   }
 5215: 
 5216:   /* If control flows to this point, then it was not possible to add the
 5217:   ** the page being freed as a leaf page of the first trunk in the free-list.
 5218:   ** Possibly because the free-list is empty, or possibly because the 
 5219:   ** first trunk in the free-list is full. Either way, the page being freed
 5220:   ** will become the new first trunk page in the free-list.
 5221:   */
 5222:   if( pPage==0 && SQLITE_OK!=(rc = btreeGetPage(pBt, iPage, &pPage, 0)) ){
 5223:     goto freepage_out;
 5224:   }
 5225:   rc = sqlite3PagerWrite(pPage->pDbPage);
 5226:   if( rc!=SQLITE_OK ){
 5227:     goto freepage_out;
 5228:   }
 5229:   put4byte(pPage->aData, iTrunk);
 5230:   put4byte(&pPage->aData[4], 0);
 5231:   put4byte(&pPage1->aData[32], iPage);
 5232:   TRACE(("FREE-PAGE: %d new trunk page replacing %d\n", pPage->pgno, iTrunk));
 5233: 
 5234: freepage_out:
 5235:   if( pPage ){
 5236:     pPage->isInit = 0;
 5237:   }
 5238:   releasePage(pPage);
 5239:   releasePage(pTrunk);
 5240:   return rc;
 5241: }
 5242: static void freePage(MemPage *pPage, int *pRC){
 5243:   if( (*pRC)==SQLITE_OK ){
 5244:     *pRC = freePage2(pPage->pBt, pPage, pPage->pgno);
 5245:   }
 5246: }
 5247: 
 5248: /*
 5249: ** Free any overflow pages associated with the given Cell.
 5250: */
 5251: static int clearCell(MemPage *pPage, unsigned char *pCell){
 5252:   BtShared *pBt = pPage->pBt;
 5253:   CellInfo info;
 5254:   Pgno ovflPgno;
 5255:   int rc;
 5256:   int nOvfl;
 5257:   u32 ovflPageSize;
 5258: 
 5259:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
 5260:   btreeParseCellPtr(pPage, pCell, &info);
 5261:   if( info.iOverflow==0 ){
 5262:     return SQLITE_OK;  /* No overflow pages. Return without doing anything */
 5263:   }
 5264:   if( pCell+info.iOverflow+3 > pPage->aData+pPage->maskPage ){
 5265:     return SQLITE_CORRUPT;  /* Cell extends past end of page */
 5266:   }
 5267:   ovflPgno = get4byte(&pCell[info.iOverflow]);
 5268:   assert( pBt->usableSize > 4 );
 5269:   ovflPageSize = pBt->usableSize - 4;
 5270:   nOvfl = (info.nPayload - info.nLocal + ovflPageSize - 1)/ovflPageSize;
 5271:   assert( ovflPgno==0 || nOvfl>0 );
 5272:   while( nOvfl-- ){
 5273:     Pgno iNext = 0;
 5274:     MemPage *pOvfl = 0;
 5275:     if( ovflPgno<2 || ovflPgno>btreePagecount(pBt) ){
 5276:       /* 0 is not a legal page number and page 1 cannot be an 
 5277:       ** overflow page. Therefore if ovflPgno<2 or past the end of the 
 5278:       ** file the database must be corrupt. */
 5279:       return SQLITE_CORRUPT_BKPT;
 5280:     }
 5281:     if( nOvfl ){
 5282:       rc = getOverflowPage(pBt, ovflPgno, &pOvfl, &iNext);
 5283:       if( rc ) return rc;
 5284:     }
 5285: 
 5286:     if( ( pOvfl || ((pOvfl = btreePageLookup(pBt, ovflPgno))!=0) )
 5287:      && sqlite3PagerPageRefcount(pOvfl->pDbPage)!=1
 5288:     ){
 5289:       /* There is no reason any cursor should have an outstanding reference 
 5290:       ** to an overflow page belonging to a cell that is being deleted/updated.
 5291:       ** So if there exists more than one reference to this page, then it 
 5292:       ** must not really be an overflow page and the database must be corrupt. 
 5293:       ** It is helpful to detect this before calling freePage2(), as 
 5294:       ** freePage2() may zero the page contents if secure-delete mode is
 5295:       ** enabled. If this 'overflow' page happens to be a page that the
 5296:       ** caller is iterating through or using in some other way, this
 5297:       ** can be problematic.
 5298:       */
 5299:       rc = SQLITE_CORRUPT_BKPT;
 5300:     }else{
 5301:       rc = freePage2(pBt, pOvfl, ovflPgno);
 5302:     }
 5303: 
 5304:     if( pOvfl ){
 5305:       sqlite3PagerUnref(pOvfl->pDbPage);
 5306:     }
 5307:     if( rc ) return rc;
 5308:     ovflPgno = iNext;
 5309:   }
 5310:   return SQLITE_OK;
 5311: }
 5312: 
 5313: /*
 5314: ** Create the byte sequence used to represent a cell on page pPage
 5315: ** and write that byte sequence into pCell[].  Overflow pages are
 5316: ** allocated and filled in as necessary.  The calling procedure
 5317: ** is responsible for making sure sufficient space has been allocated
 5318: ** for pCell[].
 5319: **
 5320: ** Note that pCell does not necessary need to point to the pPage->aData
 5321: ** area.  pCell might point to some temporary storage.  The cell will
 5322: ** be constructed in this temporary area then copied into pPage->aData
 5323: ** later.
 5324: */
 5325: static int fillInCell(
 5326:   MemPage *pPage,                /* The page that contains the cell */
 5327:   unsigned char *pCell,          /* Complete text of the cell */
 5328:   const void *pKey, i64 nKey,    /* The key */
 5329:   const void *pData,int nData,   /* The data */
 5330:   int nZero,                     /* Extra zero bytes to append to pData */
 5331:   int *pnSize                    /* Write cell size here */
 5332: ){
 5333:   int nPayload;
 5334:   const u8 *pSrc;
 5335:   int nSrc, n, rc;
 5336:   int spaceLeft;
 5337:   MemPage *pOvfl = 0;
 5338:   MemPage *pToRelease = 0;
 5339:   unsigned char *pPrior;
 5340:   unsigned char *pPayload;
 5341:   BtShared *pBt = pPage->pBt;
 5342:   Pgno pgnoOvfl = 0;
 5343:   int nHeader;
 5344:   CellInfo info;
 5345: 
 5346:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
 5347: 
 5348:   /* pPage is not necessarily writeable since pCell might be auxiliary
 5349:   ** buffer space that is separate from the pPage buffer area */
 5350:   assert( pCell<pPage->aData || pCell>=&pPage->aData[pBt->pageSize]
 5351:             || sqlite3PagerIswriteable(pPage->pDbPage) );
 5352: 
 5353:   /* Fill in the header. */
 5354:   nHeader = 0;
 5355:   if( !pPage->leaf ){
 5356:     nHeader += 4;
 5357:   }
 5358:   if( pPage->hasData ){
 5359:     nHeader += putVarint(&pCell[nHeader], nData+nZero);
 5360:   }else{
 5361:     nData = nZero = 0;
 5362:   }
 5363:   nHeader += putVarint(&pCell[nHeader], *(u64*)&nKey);
 5364:   btreeParseCellPtr(pPage, pCell, &info);
 5365:   assert( info.nHeader==nHeader );
 5366:   assert( info.nKey==nKey );
 5367:   assert( info.nData==(u32)(nData+nZero) );
 5368:   
 5369:   /* Fill in the payload */
 5370:   nPayload = nData + nZero;
 5371:   if( pPage->intKey ){
 5372:     pSrc = pData;
 5373:     nSrc = nData;
 5374:     nData = 0;
 5375:   }else{ 
 5376:     if( NEVER(nKey>0x7fffffff || pKey==0) ){
 5377:       return SQLITE_CORRUPT_BKPT;
 5378:     }
 5379:     nPayload += (int)nKey;
 5380:     pSrc = pKey;
 5381:     nSrc = (int)nKey;
 5382:   }
 5383:   *pnSize = info.nSize;
 5384:   spaceLeft = info.nLocal;
 5385:   pPayload = &pCell[nHeader];
 5386:   pPrior = &pCell[info.iOverflow];
 5387: 
 5388:   while( nPayload>0 ){
 5389:     if( spaceLeft==0 ){
 5390: #ifndef SQLITE_OMIT_AUTOVACUUM
 5391:       Pgno pgnoPtrmap = pgnoOvfl; /* Overflow page pointer-map entry page */
 5392:       if( pBt->autoVacuum ){
 5393:         do{
 5394:           pgnoOvfl++;
 5395:         } while( 
 5396:           PTRMAP_ISPAGE(pBt, pgnoOvfl) || pgnoOvfl==PENDING_BYTE_PAGE(pBt) 
 5397:         );
 5398:       }
 5399: #endif
 5400:       rc = allocateBtreePage(pBt, &pOvfl, &pgnoOvfl, pgnoOvfl, 0);
 5401: #ifndef SQLITE_OMIT_AUTOVACUUM
 5402:       /* If the database supports auto-vacuum, and the second or subsequent
 5403:       ** overflow page is being allocated, add an entry to the pointer-map
 5404:       ** for that page now. 
 5405:       **
 5406:       ** If this is the first overflow page, then write a partial entry 
 5407:       ** to the pointer-map. If we write nothing to this pointer-map slot,
 5408:       ** then the optimistic overflow chain processing in clearCell()
 5409:       ** may misinterpret the uninitialised values and delete the
 5410:       ** wrong pages from the database.
 5411:       */
 5412:       if( pBt->autoVacuum && rc==SQLITE_OK ){
 5413:         u8 eType = (pgnoPtrmap?PTRMAP_OVERFLOW2:PTRMAP_OVERFLOW1);
 5414:         ptrmapPut(pBt, pgnoOvfl, eType, pgnoPtrmap, &rc);
 5415:         if( rc ){
 5416:           releasePage(pOvfl);
 5417:         }
 5418:       }
 5419: #endif
 5420:       if( rc ){
 5421:         releasePage(pToRelease);
 5422:         return rc;
 5423:       }
 5424: 
 5425:       /* If pToRelease is not zero than pPrior points into the data area
 5426:       ** of pToRelease.  Make sure pToRelease is still writeable. */
 5427:       assert( pToRelease==0 || sqlite3PagerIswriteable(pToRelease->pDbPage) );
 5428: 
 5429:       /* If pPrior is part of the data area of pPage, then make sure pPage
 5430:       ** is still writeable */
 5431:       assert( pPrior<pPage->aData || pPrior>=&pPage->aData[pBt->pageSize]
 5432:             || sqlite3PagerIswriteable(pPage->pDbPage) );
 5433: 
 5434:       put4byte(pPrior, pgnoOvfl);
 5435:       releasePage(pToRelease);
 5436:       pToRelease = pOvfl;
 5437:       pPrior = pOvfl->aData;
 5438:       put4byte(pPrior, 0);
 5439:       pPayload = &pOvfl->aData[4];
 5440:       spaceLeft = pBt->usableSize - 4;
 5441:     }
 5442:     n = nPayload;
 5443:     if( n>spaceLeft ) n = spaceLeft;
 5444: 
 5445:     /* If pToRelease is not zero than pPayload points into the data area
 5446:     ** of pToRelease.  Make sure pToRelease is still writeable. */
 5447:     assert( pToRelease==0 || sqlite3PagerIswriteable(pToRelease->pDbPage) );
 5448: 
 5449:     /* If pPayload is part of the data area of pPage, then make sure pPage
 5450:     ** is still writeable */
 5451:     assert( pPayload<pPage->aData || pPayload>=&pPage->aData[pBt->pageSize]
 5452:             || sqlite3PagerIswriteable(pPage->pDbPage) );
 5453: 
 5454:     if( nSrc>0 ){
 5455:       if( n>nSrc ) n = nSrc;
 5456:       assert( pSrc );
 5457:       memcpy(pPayload, pSrc, n);
 5458:     }else{
 5459:       memset(pPayload, 0, n);
 5460:     }
 5461:     nPayload -= n;
 5462:     pPayload += n;
 5463:     pSrc += n;
 5464:     nSrc -= n;
 5465:     spaceLeft -= n;
 5466:     if( nSrc==0 ){
 5467:       nSrc = nData;
 5468:       pSrc = pData;
 5469:     }
 5470:   }
 5471:   releasePage(pToRelease);
 5472:   return SQLITE_OK;
 5473: }
 5474: 
 5475: /*
 5476: ** Remove the i-th cell from pPage.  This routine effects pPage only.
 5477: ** The cell content is not freed or deallocated.  It is assumed that
 5478: ** the cell content has been copied someplace else.  This routine just
 5479: ** removes the reference to the cell from pPage.
 5480: **
 5481: ** "sz" must be the number of bytes in the cell.
 5482: */
 5483: static void dropCell(MemPage *pPage, int idx, int sz, int *pRC){
 5484:   u32 pc;         /* Offset to cell content of cell being deleted */
 5485:   u8 *data;       /* pPage->aData */
 5486:   u8 *ptr;        /* Used to move bytes around within data[] */
 5487:   u8 *endPtr;     /* End of loop */
 5488:   int rc;         /* The return code */
 5489:   int hdr;        /* Beginning of the header.  0 most pages.  100 page 1 */
 5490: 
 5491:   if( *pRC ) return;
 5492: 
 5493:   assert( idx>=0 && idx<pPage->nCell );
 5494:   assert( sz==cellSize(pPage, idx) );
 5495:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
 5496:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
 5497:   data = pPage->aData;
 5498:   ptr = &pPage->aCellIdx[2*idx];
 5499:   pc = get2byte(ptr);
 5500:   hdr = pPage->hdrOffset;
 5501:   testcase( pc==get2byte(&data[hdr+5]) );
 5502:   testcase( pc+sz==pPage->pBt->usableSize );
 5503:   if( pc < (u32)get2byte(&data[hdr+5]) || pc+sz > pPage->pBt->usableSize ){
 5504:     *pRC = SQLITE_CORRUPT_BKPT;
 5505:     return;
 5506:   }
 5507:   rc = freeSpace(pPage, pc, sz);
 5508:   if( rc ){
 5509:     *pRC = rc;
 5510:     return;
 5511:   }
 5512:   endPtr = &pPage->aCellIdx[2*pPage->nCell - 2];
 5513:   assert( (SQLITE_PTR_TO_INT(ptr)&1)==0 );  /* ptr is always 2-byte aligned */
 5514:   while( ptr<endPtr ){
 5515:     *(u16*)ptr = *(u16*)&ptr[2];
 5516:     ptr += 2;
 5517:   }
 5518:   pPage->nCell--;
 5519:   put2byte(&data[hdr+3], pPage->nCell);
 5520:   pPage->nFree += 2;
 5521: }
 5522: 
 5523: /*
 5524: ** Insert a new cell on pPage at cell index "i".  pCell points to the
 5525: ** content of the cell.
 5526: **
 5527: ** If the cell content will fit on the page, then put it there.  If it
 5528: ** will not fit, then make a copy of the cell content into pTemp if
 5529: ** pTemp is not null.  Regardless of pTemp, allocate a new entry
 5530: ** in pPage->aOvfl[] and make it point to the cell content (either
 5531: ** in pTemp or the original pCell) and also record its index. 
 5532: ** Allocating a new entry in pPage->aCell[] implies that 
 5533: ** pPage->nOverflow is incremented.
 5534: **
 5535: ** If nSkip is non-zero, then do not copy the first nSkip bytes of the
 5536: ** cell. The caller will overwrite them after this function returns. If
 5537: ** nSkip is non-zero, then pCell may not point to an invalid memory location 
 5538: ** (but pCell+nSkip is always valid).
 5539: */
 5540: static void insertCell(
 5541:   MemPage *pPage,   /* Page into which we are copying */
 5542:   int i,            /* New cell becomes the i-th cell of the page */
 5543:   u8 *pCell,        /* Content of the new cell */
 5544:   int sz,           /* Bytes of content in pCell */
 5545:   u8 *pTemp,        /* Temp storage space for pCell, if needed */
 5546:   Pgno iChild,      /* If non-zero, replace first 4 bytes with this value */
 5547:   int *pRC          /* Read and write return code from here */
 5548: ){
 5549:   int idx = 0;      /* Where to write new cell content in data[] */
 5550:   int j;            /* Loop counter */
 5551:   int end;          /* First byte past the last cell pointer in data[] */
 5552:   int ins;          /* Index in data[] where new cell pointer is inserted */
 5553:   int cellOffset;   /* Address of first cell pointer in data[] */
 5554:   u8 *data;         /* The content of the whole page */
 5555:   u8 *ptr;          /* Used for moving information around in data[] */
 5556:   u8 *endPtr;       /* End of the loop */
 5557: 
 5558:   int nSkip = (iChild ? 4 : 0);
 5559: 
 5560:   if( *pRC ) return;
 5561: 
 5562:   assert( i>=0 && i<=pPage->nCell+pPage->nOverflow );
 5563:   assert( pPage->nCell<=MX_CELL(pPage->pBt) && MX_CELL(pPage->pBt)<=10921 );
 5564:   assert( pPage->nOverflow<=ArraySize(pPage->aOvfl) );
 5565:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
 5566:   /* The cell should normally be sized correctly.  However, when moving a
 5567:   ** malformed cell from a leaf page to an interior page, if the cell size
 5568:   ** wanted to be less than 4 but got rounded up to 4 on the leaf, then size
 5569:   ** might be less than 8 (leaf-size + pointer) on the interior node.  Hence
 5570:   ** the term after the || in the following assert(). */
 5571:   assert( sz==cellSizePtr(pPage, pCell) || (sz==8 && iChild>0) );
 5572:   if( pPage->nOverflow || sz+2>pPage->nFree ){
 5573:     if( pTemp ){
 5574:       memcpy(pTemp+nSkip, pCell+nSkip, sz-nSkip);
 5575:       pCell = pTemp;
 5576:     }
 5577:     if( iChild ){
 5578:       put4byte(pCell, iChild);
 5579:     }
 5580:     j = pPage->nOverflow++;
 5581:     assert( j<(int)(sizeof(pPage->aOvfl)/sizeof(pPage->aOvfl[0])) );
 5582:     pPage->aOvfl[j].pCell = pCell;
 5583:     pPage->aOvfl[j].idx = (u16)i;
 5584:   }else{
 5585:     int rc = sqlite3PagerWrite(pPage->pDbPage);
 5586:     if( rc!=SQLITE_OK ){
 5587:       *pRC = rc;
 5588:       return;
 5589:     }
 5590:     assert( sqlite3PagerIswriteable(pPage->pDbPage) );
 5591:     data = pPage->aData;
 5592:     cellOffset = pPage->cellOffset;
 5593:     end = cellOffset + 2*pPage->nCell;
 5594:     ins = cellOffset + 2*i;
 5595:     rc = allocateSpace(pPage, sz, &idx);
 5596:     if( rc ){ *pRC = rc; return; }
 5597:     /* The allocateSpace() routine guarantees the following two properties
 5598:     ** if it returns success */
 5599:     assert( idx >= end+2 );
 5600:     assert( idx+sz <= (int)pPage->pBt->usableSize );
 5601:     pPage->nCell++;
 5602:     pPage->nFree -= (u16)(2 + sz);
 5603:     memcpy(&data[idx+nSkip], pCell+nSkip, sz-nSkip);
 5604:     if( iChild ){
 5605:       put4byte(&data[idx], iChild);
 5606:     }
 5607:     ptr = &data[end];
 5608:     endPtr = &data[ins];
 5609:     assert( (SQLITE_PTR_TO_INT(ptr)&1)==0 );  /* ptr is always 2-byte aligned */
 5610:     while( ptr>endPtr ){
 5611:       *(u16*)ptr = *(u16*)&ptr[-2];
 5612:       ptr -= 2;
 5613:     }
 5614:     put2byte(&data[ins], idx);
 5615:     put2byte(&data[pPage->hdrOffset+3], pPage->nCell);
 5616: #ifndef SQLITE_OMIT_AUTOVACUUM
 5617:     if( pPage->pBt->autoVacuum ){
 5618:       /* The cell may contain a pointer to an overflow page. If so, write
 5619:       ** the entry for the overflow page into the pointer map.
 5620:       */
 5621:       ptrmapPutOvflPtr(pPage, pCell, pRC);
 5622:     }
 5623: #endif
 5624:   }
 5625: }
 5626: 
 5627: /*
 5628: ** Add a list of cells to a page.  The page should be initially empty.
 5629: ** The cells are guaranteed to fit on the page.
 5630: */
 5631: static void assemblePage(
 5632:   MemPage *pPage,   /* The page to be assemblied */
 5633:   int nCell,        /* The number of cells to add to this page */
 5634:   u8 **apCell,      /* Pointers to cell bodies */
 5635:   u16 *aSize        /* Sizes of the cells */
 5636: ){
 5637:   int i;            /* Loop counter */
 5638:   u8 *pCellptr;     /* Address of next cell pointer */
 5639:   int cellbody;     /* Address of next cell body */
 5640:   u8 * const data = pPage->aData;             /* Pointer to data for pPage */
 5641:   const int hdr = pPage->hdrOffset;           /* Offset of header on pPage */
 5642:   const int nUsable = pPage->pBt->usableSize; /* Usable size of page */
 5643: 
 5644:   assert( pPage->nOverflow==0 );
 5645:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
 5646:   assert( nCell>=0 && nCell<=(int)MX_CELL(pPage->pBt)
 5647:             && (int)MX_CELL(pPage->pBt)<=10921);
 5648:   assert( sqlite3PagerIswriteable(pPage->pDbPage) );
 5649: 
 5650:   /* Check that the page has just been zeroed by zeroPage() */
 5651:   assert( pPage->nCell==0 );
 5652:   assert( get2byteNotZero(&data[hdr+5])==nUsable );
 5653: 
 5654:   pCellptr = &pPage->aCellIdx[nCell*2];
 5655:   cellbody = nUsable;
 5656:   for(i=nCell-1; i>=0; i--){
 5657:     u16 sz = aSize[i];
 5658:     pCellptr -= 2;
 5659:     cellbody -= sz;
 5660:     put2byte(pCellptr, cellbody);
 5661:     memcpy(&data[cellbody], apCell[i], sz);
 5662:   }
 5663:   put2byte(&data[hdr+3], nCell);
 5664:   put2byte(&data[hdr+5], cellbody);
 5665:   pPage->nFree -= (nCell*2 + nUsable - cellbody);
 5666:   pPage->nCell = (u16)nCell;
 5667: }
 5668: 
 5669: /*
 5670: ** The following parameters determine how many adjacent pages get involved
 5671: ** in a balancing operation.  NN is the number of neighbors on either side
 5672: ** of the page that participate in the balancing operation.  NB is the
 5673: ** total number of pages that participate, including the target page and
 5674: ** NN neighbors on either side.
 5675: **
 5676: ** The minimum value of NN is 1 (of course).  Increasing NN above 1
 5677: ** (to 2 or 3) gives a modest improvement in SELECT and DELETE performance
 5678: ** in exchange for a larger degradation in INSERT and UPDATE performance.
 5679: ** The value of NN appears to give the best results overall.
 5680: */
 5681: #define NN 1             /* Number of neighbors on either side of pPage */
 5682: #define NB (NN*2+1)      /* Total pages involved in the balance */
 5683: 
 5684: 
 5685: #ifndef SQLITE_OMIT_QUICKBALANCE
 5686: /*
 5687: ** This version of balance() handles the common special case where
 5688: ** a new entry is being inserted on the extreme right-end of the
 5689: ** tree, in other words, when the new entry will become the largest
 5690: ** entry in the tree.
 5691: **
 5692: ** Instead of trying to balance the 3 right-most leaf pages, just add
 5693: ** a new page to the right-hand side and put the one new entry in
 5694: ** that page.  This leaves the right side of the tree somewhat
 5695: ** unbalanced.  But odds are that we will be inserting new entries
 5696: ** at the end soon afterwards so the nearly empty page will quickly
 5697: ** fill up.  On average.
 5698: **
 5699: ** pPage is the leaf page which is the right-most page in the tree.
 5700: ** pParent is its parent.  pPage must have a single overflow entry
 5701: ** which is also the right-most entry on the page.
 5702: **
 5703: ** The pSpace buffer is used to store a temporary copy of the divider
 5704: ** cell that will be inserted into pParent. Such a cell consists of a 4
 5705: ** byte page number followed by a variable length integer. In other
 5706: ** words, at most 13 bytes. Hence the pSpace buffer must be at
 5707: ** least 13 bytes in size.
 5708: */
 5709: static int balance_quick(MemPage *pParent, MemPage *pPage, u8 *pSpace){
 5710:   BtShared *const pBt = pPage->pBt;    /* B-Tree Database */
 5711:   MemPage *pNew;                       /* Newly allocated page */
 5712:   int rc;                              /* Return Code */
 5713:   Pgno pgnoNew;                        /* Page number of pNew */
 5714: 
 5715:   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
 5716:   assert( sqlite3PagerIswriteable(pParent->pDbPage) );
 5717:   assert( pPage->nOverflow==1 );
 5718: 
 5719:   /* This error condition is now caught prior to reaching this function */
 5720:   if( pPage->nCell<=0 ) return SQLITE_CORRUPT_BKPT;
 5721: 
 5722:   /* Allocate a new page. This page will become the right-sibling of 
 5723:   ** pPage. Make the parent page writable, so that the new divider cell
 5724:   ** may be inserted. If both these operations are successful, proceed.
 5725:   */
 5726:   rc = allocateBtreePage(pBt, &pNew, &pgnoNew, 0, 0);
 5727: 
 5728:   if( rc==SQLITE_OK ){
 5729: 
 5730:     u8 *pOut = &pSpace[4];
 5731:     u8 *pCell = pPage->aOvfl[0].pCell;
 5732:     u16 szCell = cellSizePtr(pPage, pCell);
 5733:     u8 *pStop;
 5734: 
 5735:     assert( sqlite3PagerIswriteable(pNew->pDbPage) );
 5736:     assert( pPage->aData[0]==(PTF_INTKEY|PTF_LEAFDATA|PTF_LEAF) );
 5737:     zeroPage(pNew, PTF_INTKEY|PTF_LEAFDATA|PTF_LEAF);
 5738:     assemblePage(pNew, 1, &pCell, &szCell);
 5739: 
 5740:     /* If this is an auto-vacuum database, update the pointer map
 5741:     ** with entries for the new page, and any pointer from the 
 5742:     ** cell on the page to an overflow page. If either of these
 5743:     ** operations fails, the return code is set, but the contents
 5744:     ** of the parent page are still manipulated by thh code below.
 5745:     ** That is Ok, at this point the parent page is guaranteed to
 5746:     ** be marked as dirty. Returning an error code will cause a
 5747:     ** rollback, undoing any changes made to the parent page.
 5748:     */
 5749:     if( ISAUTOVACUUM ){
 5750:       ptrmapPut(pBt, pgnoNew, PTRMAP_BTREE, pParent->pgno, &rc);
 5751:       if( szCell>pNew->minLocal ){
 5752:         ptrmapPutOvflPtr(pNew, pCell, &rc);
 5753:       }
 5754:     }
 5755:   
 5756:     /* Create a divider cell to insert into pParent. The divider cell
 5757:     ** consists of a 4-byte page number (the page number of pPage) and
 5758:     ** a variable length key value (which must be the same value as the
 5759:     ** largest key on pPage).
 5760:     **
 5761:     ** To find the largest key value on pPage, first find the right-most 
 5762:     ** cell on pPage. The first two fields of this cell are the 
 5763:     ** record-length (a variable length integer at most 32-bits in size)
 5764:     ** and the key value (a variable length integer, may have any value).
 5765:     ** The first of the while(...) loops below skips over the record-length
 5766:     ** field. The second while(...) loop copies the key value from the
 5767:     ** cell on pPage into the pSpace buffer.
 5768:     */
 5769:     pCell = findCell(pPage, pPage->nCell-1);
 5770:     pStop = &pCell[9];
 5771:     while( (*(pCell++)&0x80) && pCell<pStop );
 5772:     pStop = &pCell[9];
 5773:     while( ((*(pOut++) = *(pCell++))&0x80) && pCell<pStop );
 5774: 
 5775:     /* Insert the new divider cell into pParent. */
 5776:     insertCell(pParent, pParent->nCell, pSpace, (int)(pOut-pSpace),
 5777:                0, pPage->pgno, &rc);
 5778: 
 5779:     /* Set the right-child pointer of pParent to point to the new page. */
 5780:     put4byte(&pParent->aData[pParent->hdrOffset+8], pgnoNew);
 5781:   
 5782:     /* Release the reference to the new page. */
 5783:     releasePage(pNew);
 5784:   }
 5785: 
 5786:   return rc;
 5787: }
 5788: #endif /* SQLITE_OMIT_QUICKBALANCE */
 5789: 
 5790: #if 0
 5791: /*
 5792: ** This function does not contribute anything to the operation of SQLite.
 5793: ** it is sometimes activated temporarily while debugging code responsible 
 5794: ** for setting pointer-map entries.
 5795: */
 5796: static int ptrmapCheckPages(MemPage **apPage, int nPage){
 5797:   int i, j;
 5798:   for(i=0; i<nPage; i++){
 5799:     Pgno n;
 5800:     u8 e;
 5801:     MemPage *pPage = apPage[i];
 5802:     BtShared *pBt = pPage->pBt;
 5803:     assert( pPage->isInit );
 5804: 
 5805:     for(j=0; j<pPage->nCell; j++){
 5806:       CellInfo info;
 5807:       u8 *z;
 5808:      
 5809:       z = findCell(pPage, j);
 5810:       btreeParseCellPtr(pPage, z, &info);
 5811:       if( info.iOverflow ){
 5812:         Pgno ovfl = get4byte(&z[info.iOverflow]);
 5813:         ptrmapGet(pBt, ovfl, &e, &n);
 5814:         assert( n==pPage->pgno && e==PTRMAP_OVERFLOW1 );
 5815:       }
 5816:       if( !pPage->leaf ){
 5817:         Pgno child = get4byte(z);
 5818:         ptrmapGet(pBt, child, &e, &n);
 5819:         assert( n==pPage->pgno && e==PTRMAP_BTREE );
 5820:       }
 5821:     }
 5822:     if( !pPage->leaf ){
 5823:       Pgno child = get4byte(&pPage->aData[pPage->hdrOffset+8]);
 5824:       ptrmapGet(pBt, child, &e, &n);
 5825:       assert( n==pPage->pgno && e==PTRMAP_BTREE );
 5826:     }
 5827:   }
 5828:   return 1;
 5829: }
 5830: #endif
 5831: 
 5832: /*
 5833: ** This function is used to copy the contents of the b-tree node stored 
 5834: ** on page pFrom to page pTo. If page pFrom was not a leaf page, then
 5835: ** the pointer-map entries for each child page are updated so that the
 5836: ** parent page stored in the pointer map is page pTo. If pFrom contained
 5837: ** any cells with overflow page pointers, then the corresponding pointer
 5838: ** map entries are also updated so that the parent page is page pTo.
 5839: **
 5840: ** If pFrom is currently carrying any overflow cells (entries in the
 5841: ** MemPage.aOvfl[] array), they are not copied to pTo. 
 5842: **
 5843: ** Before returning, page pTo is reinitialized using btreeInitPage().
 5844: **
 5845: ** The performance of this function is not critical. It is only used by 
 5846: ** the balance_shallower() and balance_deeper() procedures, neither of
 5847: ** which are called often under normal circumstances.
 5848: */
 5849: static void copyNodeContent(MemPage *pFrom, MemPage *pTo, int *pRC){
 5850:   if( (*pRC)==SQLITE_OK ){
 5851:     BtShared * const pBt = pFrom->pBt;
 5852:     u8 * const aFrom = pFrom->aData;
 5853:     u8 * const aTo = pTo->aData;
 5854:     int const iFromHdr = pFrom->hdrOffset;
 5855:     int const iToHdr = ((pTo->pgno==1) ? 100 : 0);
 5856:     int rc;
 5857:     int iData;
 5858:   
 5859:   
 5860:     assert( pFrom->isInit );
 5861:     assert( pFrom->nFree>=iToHdr );
 5862:     assert( get2byte(&aFrom[iFromHdr+5]) <= (int)pBt->usableSize );
 5863:   
 5864:     /* Copy the b-tree node content from page pFrom to page pTo. */
 5865:     iData = get2byte(&aFrom[iFromHdr+5]);
 5866:     memcpy(&aTo[iData], &aFrom[iData], pBt->usableSize-iData);
 5867:     memcpy(&aTo[iToHdr], &aFrom[iFromHdr], pFrom->cellOffset + 2*pFrom->nCell);
 5868:   
 5869:     /* Reinitialize page pTo so that the contents of the MemPage structure
 5870:     ** match the new data. The initialization of pTo can actually fail under
 5871:     ** fairly obscure circumstances, even though it is a copy of initialized 
 5872:     ** page pFrom.
 5873:     */
 5874:     pTo->isInit = 0;
 5875:     rc = btreeInitPage(pTo);
 5876:     if( rc!=SQLITE_OK ){
 5877:       *pRC = rc;
 5878:       return;
 5879:     }
 5880:   
 5881:     /* If this is an auto-vacuum database, update the pointer-map entries
 5882:     ** for any b-tree or overflow pages that pTo now contains the pointers to.
 5883:     */
 5884:     if( ISAUTOVACUUM ){
 5885:       *pRC = setChildPtrmaps(pTo);
 5886:     }
 5887:   }
 5888: }
 5889: 
 5890: /*
 5891: ** This routine redistributes cells on the iParentIdx'th child of pParent
 5892: ** (hereafter "the page") and up to 2 siblings so that all pages have about the
 5893: ** same amount of free space. Usually a single sibling on either side of the
 5894: ** page are used in the balancing, though both siblings might come from one
 5895: ** side if the page is the first or last child of its parent. If the page 
 5896: ** has fewer than 2 siblings (something which can only happen if the page
 5897: ** is a root page or a child of a root page) then all available siblings
 5898: ** participate in the balancing.
 5899: **
 5900: ** The number of siblings of the page might be increased or decreased by 
 5901: ** one or two in an effort to keep pages nearly full but not over full. 
 5902: **
 5903: ** Note that when this routine is called, some of the cells on the page
 5904: ** might not actually be stored in MemPage.aData[]. This can happen
 5905: ** if the page is overfull. This routine ensures that all cells allocated
 5906: ** to the page and its siblings fit into MemPage.aData[] before returning.
 5907: **
 5908: ** In the course of balancing the page and its siblings, cells may be
 5909: ** inserted into or removed from the parent page (pParent). Doing so
 5910: ** may cause the parent page to become overfull or underfull. If this
 5911: ** happens, it is the responsibility of the caller to invoke the correct
 5912: ** balancing routine to fix this problem (see the balance() routine). 
 5913: **
 5914: ** If this routine fails for any reason, it might leave the database
 5915: ** in a corrupted state. So if this routine fails, the database should
 5916: ** be rolled back.
 5917: **
 5918: ** The third argument to this function, aOvflSpace, is a pointer to a
 5919: ** buffer big enough to hold one page. If while inserting cells into the parent
 5920: ** page (pParent) the parent page becomes overfull, this buffer is
 5921: ** used to store the parent's overflow cells. Because this function inserts
 5922: ** a maximum of four divider cells into the parent page, and the maximum
 5923: ** size of a cell stored within an internal node is always less than 1/4
 5924: ** of the page-size, the aOvflSpace[] buffer is guaranteed to be large
 5925: ** enough for all overflow cells.
 5926: **
 5927: ** If aOvflSpace is set to a null pointer, this function returns 
 5928: ** SQLITE_NOMEM.
 5929: */
 5930: static int balance_nonroot(
 5931:   MemPage *pParent,               /* Parent page of siblings being balanced */
 5932:   int iParentIdx,                 /* Index of "the page" in pParent */
 5933:   u8 *aOvflSpace,                 /* page-size bytes of space for parent ovfl */
 5934:   int isRoot                      /* True if pParent is a root-page */
 5935: ){
 5936:   BtShared *pBt;               /* The whole database */
 5937:   int nCell = 0;               /* Number of cells in apCell[] */
 5938:   int nMaxCells = 0;           /* Allocated size of apCell, szCell, aFrom. */
 5939:   int nNew = 0;                /* Number of pages in apNew[] */
 5940:   int nOld;                    /* Number of pages in apOld[] */
 5941:   int i, j, k;                 /* Loop counters */
 5942:   int nxDiv;                   /* Next divider slot in pParent->aCell[] */
 5943:   int rc = SQLITE_OK;          /* The return code */
 5944:   u16 leafCorrection;          /* 4 if pPage is a leaf.  0 if not */
 5945:   int leafData;                /* True if pPage is a leaf of a LEAFDATA tree */
 5946:   int usableSpace;             /* Bytes in pPage beyond the header */
 5947:   int pageFlags;               /* Value of pPage->aData[0] */
 5948:   int subtotal;                /* Subtotal of bytes in cells on one page */
 5949:   int iSpace1 = 0;             /* First unused byte of aSpace1[] */
 5950:   int iOvflSpace = 0;          /* First unused byte of aOvflSpace[] */
 5951:   int szScratch;               /* Size of scratch memory requested */
 5952:   MemPage *apOld[NB];          /* pPage and up to two siblings */
 5953:   MemPage *apCopy[NB];         /* Private copies of apOld[] pages */
 5954:   MemPage *apNew[NB+2];        /* pPage and up to NB siblings after balancing */
 5955:   u8 *pRight;                  /* Location in parent of right-sibling pointer */
 5956:   u8 *apDiv[NB-1];             /* Divider cells in pParent */
 5957:   int cntNew[NB+2];            /* Index in aCell[] of cell after i-th page */
 5958:   int szNew[NB+2];             /* Combined size of cells place on i-th page */
 5959:   u8 **apCell = 0;             /* All cells begin balanced */
 5960:   u16 *szCell;                 /* Local size of all cells in apCell[] */
 5961:   u8 *aSpace1;                 /* Space for copies of dividers cells */
 5962:   Pgno pgno;                   /* Temp var to store a page number in */
 5963: 
 5964:   pBt = pParent->pBt;
 5965:   assert( sqlite3_mutex_held(pBt->mutex) );
 5966:   assert( sqlite3PagerIswriteable(pParent->pDbPage) );
 5967: 
 5968: #if 0
 5969:   TRACE(("BALANCE: begin page %d child of %d\n", pPage->pgno, pParent->pgno));
 5970: #endif
 5971: 
 5972:   /* At this point pParent may have at most one overflow cell. And if
 5973:   ** this overflow cell is present, it must be the cell with 
 5974:   ** index iParentIdx. This scenario comes about when this function
 5975:   ** is called (indirectly) from sqlite3BtreeDelete().
 5976:   */
 5977:   assert( pParent->nOverflow==0 || pParent->nOverflow==1 );
 5978:   assert( pParent->nOverflow==0 || pParent->aOvfl[0].idx==iParentIdx );
 5979: 
 5980:   if( !aOvflSpace ){
 5981:     return SQLITE_NOMEM;
 5982:   }
 5983: 
 5984:   /* Find the sibling pages to balance. Also locate the cells in pParent 
 5985:   ** that divide the siblings. An attempt is made to find NN siblings on 
 5986:   ** either side of pPage. More siblings are taken from one side, however, 
 5987:   ** if there are fewer than NN siblings on the other side. If pParent
 5988:   ** has NB or fewer children then all children of pParent are taken.  
 5989:   **
 5990:   ** This loop also drops the divider cells from the parent page. This
 5991:   ** way, the remainder of the function does not have to deal with any
 5992:   ** overflow cells in the parent page, since if any existed they will
 5993:   ** have already been removed.
 5994:   */
 5995:   i = pParent->nOverflow + pParent->nCell;
 5996:   if( i<2 ){
 5997:     nxDiv = 0;
 5998:     nOld = i+1;
 5999:   }else{
 6000:     nOld = 3;
 6001:     if( iParentIdx==0 ){                 
 6002:       nxDiv = 0;
 6003:     }else if( iParentIdx==i ){
 6004:       nxDiv = i-2;
 6005:     }else{
 6006:       nxDiv = iParentIdx-1;
 6007:     }
 6008:     i = 2;
 6009:   }
 6010:   if( (i+nxDiv-pParent->nOverflow)==pParent->nCell ){
 6011:     pRight = &pParent->aData[pParent->hdrOffset+8];
 6012:   }else{
 6013:     pRight = findCell(pParent, i+nxDiv-pParent->nOverflow);
 6014:   }
 6015:   pgno = get4byte(pRight);
 6016:   while( 1 ){
 6017:     rc = getAndInitPage(pBt, pgno, &apOld[i]);
 6018:     if( rc ){
 6019:       memset(apOld, 0, (i+1)*sizeof(MemPage*));
 6020:       goto balance_cleanup;
 6021:     }
 6022:     nMaxCells += 1+apOld[i]->nCell+apOld[i]->nOverflow;
 6023:     if( (i--)==0 ) break;
 6024: 
 6025:     if( i+nxDiv==pParent->aOvfl[0].idx && pParent->nOverflow ){
 6026:       apDiv[i] = pParent->aOvfl[0].pCell;
 6027:       pgno = get4byte(apDiv[i]);
 6028:       szNew[i] = cellSizePtr(pParent, apDiv[i]);
 6029:       pParent->nOverflow = 0;
 6030:     }else{
 6031:       apDiv[i] = findCell(pParent, i+nxDiv-pParent->nOverflow);
 6032:       pgno = get4byte(apDiv[i]);
 6033:       szNew[i] = cellSizePtr(pParent, apDiv[i]);
 6034: 
 6035:       /* Drop the cell from the parent page. apDiv[i] still points to
 6036:       ** the cell within the parent, even though it has been dropped.
 6037:       ** This is safe because dropping a cell only overwrites the first
 6038:       ** four bytes of it, and this function does not need the first
 6039:       ** four bytes of the divider cell. So the pointer is safe to use
 6040:       ** later on.  
 6041:       **
 6042:       ** But not if we are in secure-delete mode. In secure-delete mode,
 6043:       ** the dropCell() routine will overwrite the entire cell with zeroes.
 6044:       ** In this case, temporarily copy the cell into the aOvflSpace[]
 6045:       ** buffer. It will be copied out again as soon as the aSpace[] buffer
 6046:       ** is allocated.  */
 6047:       if( pBt->btsFlags & BTS_SECURE_DELETE ){
 6048:         int iOff;
 6049: 
 6050:         iOff = SQLITE_PTR_TO_INT(apDiv[i]) - SQLITE_PTR_TO_INT(pParent->aData);
 6051:         if( (iOff+szNew[i])>(int)pBt->usableSize ){
 6052:           rc = SQLITE_CORRUPT_BKPT;
 6053:           memset(apOld, 0, (i+1)*sizeof(MemPage*));
 6054:           goto balance_cleanup;
 6055:         }else{
 6056:           memcpy(&aOvflSpace[iOff], apDiv[i], szNew[i]);
 6057:           apDiv[i] = &aOvflSpace[apDiv[i]-pParent->aData];
 6058:         }
 6059:       }
 6060:       dropCell(pParent, i+nxDiv-pParent->nOverflow, szNew[i], &rc);
 6061:     }
 6062:   }
 6063: 
 6064:   /* Make nMaxCells a multiple of 4 in order to preserve 8-byte
 6065:   ** alignment */
 6066:   nMaxCells = (nMaxCells + 3)&~3;
 6067: 
 6068:   /*
 6069:   ** Allocate space for memory structures
 6070:   */
 6071:   k = pBt->pageSize + ROUND8(sizeof(MemPage));
 6072:   szScratch =
 6073:        nMaxCells*sizeof(u8*)                       /* apCell */
 6074:      + nMaxCells*sizeof(u16)                       /* szCell */
 6075:      + pBt->pageSize                               /* aSpace1 */
 6076:      + k*nOld;                                     /* Page copies (apCopy) */
 6077:   apCell = sqlite3ScratchMalloc( szScratch ); 
 6078:   if( apCell==0 ){
 6079:     rc = SQLITE_NOMEM;
 6080:     goto balance_cleanup;
 6081:   }
 6082:   szCell = (u16*)&apCell[nMaxCells];
 6083:   aSpace1 = (u8*)&szCell[nMaxCells];
 6084:   assert( EIGHT_BYTE_ALIGNMENT(aSpace1) );
 6085: 
 6086:   /*
 6087:   ** Load pointers to all cells on sibling pages and the divider cells
 6088:   ** into the local apCell[] array.  Make copies of the divider cells
 6089:   ** into space obtained from aSpace1[] and remove the the divider Cells
 6090:   ** from pParent.
 6091:   **
 6092:   ** If the siblings are on leaf pages, then the child pointers of the
 6093:   ** divider cells are stripped from the cells before they are copied
 6094:   ** into aSpace1[].  In this way, all cells in apCell[] are without
 6095:   ** child pointers.  If siblings are not leaves, then all cell in
 6096:   ** apCell[] include child pointers.  Either way, all cells in apCell[]
 6097:   ** are alike.
 6098:   **
 6099:   ** leafCorrection:  4 if pPage is a leaf.  0 if pPage is not a leaf.
 6100:   **       leafData:  1 if pPage holds key+data and pParent holds only keys.
 6101:   */
 6102:   leafCorrection = apOld[0]->leaf*4;
 6103:   leafData = apOld[0]->hasData;
 6104:   for(i=0; i<nOld; i++){
 6105:     int limit;
 6106:     
 6107:     /* Before doing anything else, take a copy of the i'th original sibling
 6108:     ** The rest of this function will use data from the copies rather
 6109:     ** that the original pages since the original pages will be in the
 6110:     ** process of being overwritten.  */
 6111:     MemPage *pOld = apCopy[i] = (MemPage*)&aSpace1[pBt->pageSize + k*i];
 6112:     memcpy(pOld, apOld[i], sizeof(MemPage));
 6113:     pOld->aData = (void*)&pOld[1];
 6114:     memcpy(pOld->aData, apOld[i]->aData, pBt->pageSize);
 6115: 
 6116:     limit = pOld->nCell+pOld->nOverflow;
 6117:     if( pOld->nOverflow>0 ){
 6118:       for(j=0; j<limit; j++){
 6119:         assert( nCell<nMaxCells );
 6120:         apCell[nCell] = findOverflowCell(pOld, j);
 6121:         szCell[nCell] = cellSizePtr(pOld, apCell[nCell]);
 6122:         nCell++;
 6123:       }
 6124:     }else{
 6125:       u8 *aData = pOld->aData;
 6126:       u16 maskPage = pOld->maskPage;
 6127:       u16 cellOffset = pOld->cellOffset;
 6128:       for(j=0; j<limit; j++){
 6129:         assert( nCell<nMaxCells );
 6130:         apCell[nCell] = findCellv2(aData, maskPage, cellOffset, j);
 6131:         szCell[nCell] = cellSizePtr(pOld, apCell[nCell]);
 6132:         nCell++;
 6133:       }
 6134:     }       
 6135:     if( i<nOld-1 && !leafData){
 6136:       u16 sz = (u16)szNew[i];
 6137:       u8 *pTemp;
 6138:       assert( nCell<nMaxCells );
 6139:       szCell[nCell] = sz;
 6140:       pTemp = &aSpace1[iSpace1];
 6141:       iSpace1 += sz;
 6142:       assert( sz<=pBt->maxLocal+23 );
 6143:       assert( iSpace1 <= (int)pBt->pageSize );
 6144:       memcpy(pTemp, apDiv[i], sz);
 6145:       apCell[nCell] = pTemp+leafCorrection;
 6146:       assert( leafCorrection==0 || leafCorrection==4 );
 6147:       szCell[nCell] = szCell[nCell] - leafCorrection;
 6148:       if( !pOld->leaf ){
 6149:         assert( leafCorrection==0 );
 6150:         assert( pOld->hdrOffset==0 );
 6151:         /* The right pointer of the child page pOld becomes the left
 6152:         ** pointer of the divider cell */
 6153:         memcpy(apCell[nCell], &pOld->aData[8], 4);
 6154:       }else{
 6155:         assert( leafCorrection==4 );
 6156:         if( szCell[nCell]<4 ){
 6157:           /* Do not allow any cells smaller than 4 bytes. */
 6158:           szCell[nCell] = 4;
 6159:         }
 6160:       }
 6161:       nCell++;
 6162:     }
 6163:   }
 6164: 
 6165:   /*
 6166:   ** Figure out the number of pages needed to hold all nCell cells.
 6167:   ** Store this number in "k".  Also compute szNew[] which is the total
 6168:   ** size of all cells on the i-th page and cntNew[] which is the index
 6169:   ** in apCell[] of the cell that divides page i from page i+1.  
 6170:   ** cntNew[k] should equal nCell.
 6171:   **
 6172:   ** Values computed by this block:
 6173:   **
 6174:   **           k: The total number of sibling pages
 6175:   **    szNew[i]: Spaced used on the i-th sibling page.
 6176:   **   cntNew[i]: Index in apCell[] and szCell[] for the first cell to
 6177:   **              the right of the i-th sibling page.
 6178:   ** usableSpace: Number of bytes of space available on each sibling.
 6179:   ** 
 6180:   */
 6181:   usableSpace = pBt->usableSize - 12 + leafCorrection;
 6182:   for(subtotal=k=i=0; i<nCell; i++){
 6183:     assert( i<nMaxCells );
 6184:     subtotal += szCell[i] + 2;
 6185:     if( subtotal > usableSpace ){
 6186:       szNew[k] = subtotal - szCell[i];
 6187:       cntNew[k] = i;
 6188:       if( leafData ){ i--; }
 6189:       subtotal = 0;
 6190:       k++;
 6191:       if( k>NB+1 ){ rc = SQLITE_CORRUPT_BKPT; goto balance_cleanup; }
 6192:     }
 6193:   }
 6194:   szNew[k] = subtotal;
 6195:   cntNew[k] = nCell;
 6196:   k++;
 6197: 
 6198:   /*
 6199:   ** The packing computed by the previous block is biased toward the siblings
 6200:   ** on the left side.  The left siblings are always nearly full, while the
 6201:   ** right-most sibling might be nearly empty.  This block of code attempts
 6202:   ** to adjust the packing of siblings to get a better balance.
 6203:   **
 6204:   ** This adjustment is more than an optimization.  The packing above might
 6205:   ** be so out of balance as to be illegal.  For example, the right-most
 6206:   ** sibling might be completely empty.  This adjustment is not optional.
 6207:   */
 6208:   for(i=k-1; i>0; i--){
 6209:     int szRight = szNew[i];  /* Size of sibling on the right */
 6210:     int szLeft = szNew[i-1]; /* Size of sibling on the left */
 6211:     int r;              /* Index of right-most cell in left sibling */
 6212:     int d;              /* Index of first cell to the left of right sibling */
 6213: 
 6214:     r = cntNew[i-1] - 1;
 6215:     d = r + 1 - leafData;
 6216:     assert( d<nMaxCells );
 6217:     assert( r<nMaxCells );
 6218:     while( szRight==0 || szRight+szCell[d]+2<=szLeft-(szCell[r]+2) ){
 6219:       szRight += szCell[d] + 2;
 6220:       szLeft -= szCell[r] + 2;
 6221:       cntNew[i-1]--;
 6222:       r = cntNew[i-1] - 1;
 6223:       d = r + 1 - leafData;
 6224:     }
 6225:     szNew[i] = szRight;
 6226:     szNew[i-1] = szLeft;
 6227:   }
 6228: 
 6229:   /* Either we found one or more cells (cntnew[0])>0) or pPage is
 6230:   ** a virtual root page.  A virtual root page is when the real root
 6231:   ** page is page 1 and we are the only child of that page.
 6232:   **
 6233:   ** UPDATE:  The assert() below is not necessarily true if the database
 6234:   ** file is corrupt.  The corruption will be detected and reported later
 6235:   ** in this procedure so there is no need to act upon it now.
 6236:   */
 6237: #if 0
 6238:   assert( cntNew[0]>0 || (pParent->pgno==1 && pParent->nCell==0) );
 6239: #endif
 6240: 
 6241:   TRACE(("BALANCE: old: %d %d %d  ",
 6242:     apOld[0]->pgno, 
 6243:     nOld>=2 ? apOld[1]->pgno : 0,
 6244:     nOld>=3 ? apOld[2]->pgno : 0
 6245:   ));
 6246: 
 6247:   /*
 6248:   ** Allocate k new pages.  Reuse old pages where possible.
 6249:   */
 6250:   if( apOld[0]->pgno<=1 ){
 6251:     rc = SQLITE_CORRUPT_BKPT;
 6252:     goto balance_cleanup;
 6253:   }
 6254:   pageFlags = apOld[0]->aData[0];
 6255:   for(i=0; i<k; i++){
 6256:     MemPage *pNew;
 6257:     if( i<nOld ){
 6258:       pNew = apNew[i] = apOld[i];
 6259:       apOld[i] = 0;
 6260:       rc = sqlite3PagerWrite(pNew->pDbPage);
 6261:       nNew++;
 6262:       if( rc ) goto balance_cleanup;
 6263:     }else{
 6264:       assert( i>0 );
 6265:       rc = allocateBtreePage(pBt, &pNew, &pgno, pgno, 0);
 6266:       if( rc ) goto balance_cleanup;
 6267:       apNew[i] = pNew;
 6268:       nNew++;
 6269: 
 6270:       /* Set the pointer-map entry for the new sibling page. */
 6271:       if( ISAUTOVACUUM ){
 6272:         ptrmapPut(pBt, pNew->pgno, PTRMAP_BTREE, pParent->pgno, &rc);
 6273:         if( rc!=SQLITE_OK ){
 6274:           goto balance_cleanup;
 6275:         }
 6276:       }
 6277:     }
 6278:   }
 6279: 
 6280:   /* Free any old pages that were not reused as new pages.
 6281:   */
 6282:   while( i<nOld ){
 6283:     freePage(apOld[i], &rc);
 6284:     if( rc ) goto balance_cleanup;
 6285:     releasePage(apOld[i]);
 6286:     apOld[i] = 0;
 6287:     i++;
 6288:   }
 6289: 
 6290:   /*
 6291:   ** Put the new pages in accending order.  This helps to
 6292:   ** keep entries in the disk file in order so that a scan
 6293:   ** of the table is a linear scan through the file.  That
 6294:   ** in turn helps the operating system to deliver pages
 6295:   ** from the disk more rapidly.
 6296:   **
 6297:   ** An O(n^2) insertion sort algorithm is used, but since
 6298:   ** n is never more than NB (a small constant), that should
 6299:   ** not be a problem.
 6300:   **
 6301:   ** When NB==3, this one optimization makes the database
 6302:   ** about 25% faster for large insertions and deletions.
 6303:   */
 6304:   for(i=0; i<k-1; i++){
 6305:     int minV = apNew[i]->pgno;
 6306:     int minI = i;
 6307:     for(j=i+1; j<k; j++){
 6308:       if( apNew[j]->pgno<(unsigned)minV ){
 6309:         minI = j;
 6310:         minV = apNew[j]->pgno;
 6311:       }
 6312:     }
 6313:     if( minI>i ){
 6314:       MemPage *pT;
 6315:       pT = apNew[i];
 6316:       apNew[i] = apNew[minI];
 6317:       apNew[minI] = pT;
 6318:     }
 6319:   }
 6320:   TRACE(("new: %d(%d) %d(%d) %d(%d) %d(%d) %d(%d)\n",
 6321:     apNew[0]->pgno, szNew[0],
 6322:     nNew>=2 ? apNew[1]->pgno : 0, nNew>=2 ? szNew[1] : 0,
 6323:     nNew>=3 ? apNew[2]->pgno : 0, nNew>=3 ? szNew[2] : 0,
 6324:     nNew>=4 ? apNew[3]->pgno : 0, nNew>=4 ? szNew[3] : 0,
 6325:     nNew>=5 ? apNew[4]->pgno : 0, nNew>=5 ? szNew[4] : 0));
 6326: 
 6327:   assert( sqlite3PagerIswriteable(pParent->pDbPage) );
 6328:   put4byte(pRight, apNew[nNew-1]->pgno);
 6329: 
 6330:   /*
 6331:   ** Evenly distribute the data in apCell[] across the new pages.
 6332:   ** Insert divider cells into pParent as necessary.
 6333:   */
 6334:   j = 0;
 6335:   for(i=0; i<nNew; i++){
 6336:     /* Assemble the new sibling page. */
 6337:     MemPage *pNew = apNew[i];
 6338:     assert( j<nMaxCells );
 6339:     zeroPage(pNew, pageFlags);
 6340:     assemblePage(pNew, cntNew[i]-j, &apCell[j], &szCell[j]);
 6341:     assert( pNew->nCell>0 || (nNew==1 && cntNew[0]==0) );
 6342:     assert( pNew->nOverflow==0 );
 6343: 
 6344:     j = cntNew[i];
 6345: 
 6346:     /* If the sibling page assembled above was not the right-most sibling,
 6347:     ** insert a divider cell into the parent page.
 6348:     */
 6349:     assert( i<nNew-1 || j==nCell );
 6350:     if( j<nCell ){
 6351:       u8 *pCell;
 6352:       u8 *pTemp;
 6353:       int sz;
 6354: 
 6355:       assert( j<nMaxCells );
 6356:       pCell = apCell[j];
 6357:       sz = szCell[j] + leafCorrection;
 6358:       pTemp = &aOvflSpace[iOvflSpace];
 6359:       if( !pNew->leaf ){
 6360:         memcpy(&pNew->aData[8], pCell, 4);
 6361:       }else if( leafData ){
 6362:         /* If the tree is a leaf-data tree, and the siblings are leaves, 
 6363:         ** then there is no divider cell in apCell[]. Instead, the divider 
 6364:         ** cell consists of the integer key for the right-most cell of 
 6365:         ** the sibling-page assembled above only.
 6366:         */
 6367:         CellInfo info;
 6368:         j--;
 6369:         btreeParseCellPtr(pNew, apCell[j], &info);
 6370:         pCell = pTemp;
 6371:         sz = 4 + putVarint(&pCell[4], info.nKey);
 6372:         pTemp = 0;
 6373:       }else{
 6374:         pCell -= 4;
 6375:         /* Obscure case for non-leaf-data trees: If the cell at pCell was
 6376:         ** previously stored on a leaf node, and its reported size was 4
 6377:         ** bytes, then it may actually be smaller than this 
 6378:         ** (see btreeParseCellPtr(), 4 bytes is the minimum size of
 6379:         ** any cell). But it is important to pass the correct size to 
 6380:         ** insertCell(), so reparse the cell now.
 6381:         **
 6382:         ** Note that this can never happen in an SQLite data file, as all
 6383:         ** cells are at least 4 bytes. It only happens in b-trees used
 6384:         ** to evaluate "IN (SELECT ...)" and similar clauses.
 6385:         */
 6386:         if( szCell[j]==4 ){
 6387:           assert(leafCorrection==4);
 6388:           sz = cellSizePtr(pParent, pCell);
 6389:         }
 6390:       }
 6391:       iOvflSpace += sz;
 6392:       assert( sz<=pBt->maxLocal+23 );
 6393:       assert( iOvflSpace <= (int)pBt->pageSize );
 6394:       insertCell(pParent, nxDiv, pCell, sz, pTemp, pNew->pgno, &rc);
 6395:       if( rc!=SQLITE_OK ) goto balance_cleanup;
 6396:       assert( sqlite3PagerIswriteable(pParent->pDbPage) );
 6397: 
 6398:       j++;
 6399:       nxDiv++;
 6400:     }
 6401:   }
 6402:   assert( j==nCell );
 6403:   assert( nOld>0 );
 6404:   assert( nNew>0 );
 6405:   if( (pageFlags & PTF_LEAF)==0 ){
 6406:     u8 *zChild = &apCopy[nOld-1]->aData[8];
 6407:     memcpy(&apNew[nNew-1]->aData[8], zChild, 4);
 6408:   }
 6409: 
 6410:   if( isRoot && pParent->nCell==0 && pParent->hdrOffset<=apNew[0]->nFree ){
 6411:     /* The root page of the b-tree now contains no cells. The only sibling
 6412:     ** page is the right-child of the parent. Copy the contents of the
 6413:     ** child page into the parent, decreasing the overall height of the
 6414:     ** b-tree structure by one. This is described as the "balance-shallower"
 6415:     ** sub-algorithm in some documentation.
 6416:     **
 6417:     ** If this is an auto-vacuum database, the call to copyNodeContent() 
 6418:     ** sets all pointer-map entries corresponding to database image pages 
 6419:     ** for which the pointer is stored within the content being copied.
 6420:     **
 6421:     ** The second assert below verifies that the child page is defragmented
 6422:     ** (it must be, as it was just reconstructed using assemblePage()). This
 6423:     ** is important if the parent page happens to be page 1 of the database
 6424:     ** image.  */
 6425:     assert( nNew==1 );
 6426:     assert( apNew[0]->nFree == 
 6427:         (get2byte(&apNew[0]->aData[5])-apNew[0]->cellOffset-apNew[0]->nCell*2) 
 6428:     );
 6429:     copyNodeContent(apNew[0], pParent, &rc);
 6430:     freePage(apNew[0], &rc);
 6431:   }else if( ISAUTOVACUUM ){
 6432:     /* Fix the pointer-map entries for all the cells that were shifted around. 
 6433:     ** There are several different types of pointer-map entries that need to
 6434:     ** be dealt with by this routine. Some of these have been set already, but
 6435:     ** many have not. The following is a summary:
 6436:     **
 6437:     **   1) The entries associated with new sibling pages that were not
 6438:     **      siblings when this function was called. These have already
 6439:     **      been set. We don't need to worry about old siblings that were
 6440:     **      moved to the free-list - the freePage() code has taken care
 6441:     **      of those.
 6442:     **
 6443:     **   2) The pointer-map entries associated with the first overflow
 6444:     **      page in any overflow chains used by new divider cells. These 
 6445:     **      have also already been taken care of by the insertCell() code.
 6446:     **
 6447:     **   3) If the sibling pages are not leaves, then the child pages of
 6448:     **      cells stored on the sibling pages may need to be updated.
 6449:     **
 6450:     **   4) If the sibling pages are not internal intkey nodes, then any
 6451:     **      overflow pages used by these cells may need to be updated
 6452:     **      (internal intkey nodes never contain pointers to overflow pages).
 6453:     **
 6454:     **   5) If the sibling pages are not leaves, then the pointer-map
 6455:     **      entries for the right-child pages of each sibling may need
 6456:     **      to be updated.
 6457:     **
 6458:     ** Cases 1 and 2 are dealt with above by other code. The next
 6459:     ** block deals with cases 3 and 4 and the one after that, case 5. Since
 6460:     ** setting a pointer map entry is a relatively expensive operation, this
 6461:     ** code only sets pointer map entries for child or overflow pages that have
 6462:     ** actually moved between pages.  */
 6463:     MemPage *pNew = apNew[0];
 6464:     MemPage *pOld = apCopy[0];
 6465:     int nOverflow = pOld->nOverflow;
 6466:     int iNextOld = pOld->nCell + nOverflow;
 6467:     int iOverflow = (nOverflow ? pOld->aOvfl[0].idx : -1);
 6468:     j = 0;                             /* Current 'old' sibling page */
 6469:     k = 0;                             /* Current 'new' sibling page */
 6470:     for(i=0; i<nCell; i++){
 6471:       int isDivider = 0;
 6472:       while( i==iNextOld ){
 6473:         /* Cell i is the cell immediately following the last cell on old
 6474:         ** sibling page j. If the siblings are not leaf pages of an
 6475:         ** intkey b-tree, then cell i was a divider cell. */
 6476:         assert( j+1 < ArraySize(apCopy) );
 6477:         pOld = apCopy[++j];
 6478:         iNextOld = i + !leafData + pOld->nCell + pOld->nOverflow;
 6479:         if( pOld->nOverflow ){
 6480:           nOverflow = pOld->nOverflow;
 6481:           iOverflow = i + !leafData + pOld->aOvfl[0].idx;
 6482:         }
 6483:         isDivider = !leafData;  
 6484:       }
 6485: 
 6486:       assert(nOverflow>0 || iOverflow<i );
 6487:       assert(nOverflow<2 || pOld->aOvfl[0].idx==pOld->aOvfl[1].idx-1);
 6488:       assert(nOverflow<3 || pOld->aOvfl[1].idx==pOld->aOvfl[2].idx-1);
 6489:       if( i==iOverflow ){
 6490:         isDivider = 1;
 6491:         if( (--nOverflow)>0 ){
 6492:           iOverflow++;
 6493:         }
 6494:       }
 6495: 
 6496:       if( i==cntNew[k] ){
 6497:         /* Cell i is the cell immediately following the last cell on new
 6498:         ** sibling page k. If the siblings are not leaf pages of an
 6499:         ** intkey b-tree, then cell i is a divider cell.  */
 6500:         pNew = apNew[++k];
 6501:         if( !leafData ) continue;
 6502:       }
 6503:       assert( j<nOld );
 6504:       assert( k<nNew );
 6505: 
 6506:       /* If the cell was originally divider cell (and is not now) or
 6507:       ** an overflow cell, or if the cell was located on a different sibling
 6508:       ** page before the balancing, then the pointer map entries associated
 6509:       ** with any child or overflow pages need to be updated.  */
 6510:       if( isDivider || pOld->pgno!=pNew->pgno ){
 6511:         if( !leafCorrection ){
 6512:           ptrmapPut(pBt, get4byte(apCell[i]), PTRMAP_BTREE, pNew->pgno, &rc);
 6513:         }
 6514:         if( szCell[i]>pNew->minLocal ){
 6515:           ptrmapPutOvflPtr(pNew, apCell[i], &rc);
 6516:         }
 6517:       }
 6518:     }
 6519: 
 6520:     if( !leafCorrection ){
 6521:       for(i=0; i<nNew; i++){
 6522:         u32 key = get4byte(&apNew[i]->aData[8]);
 6523:         ptrmapPut(pBt, key, PTRMAP_BTREE, apNew[i]->pgno, &rc);
 6524:       }
 6525:     }
 6526: 
 6527: #if 0
 6528:     /* The ptrmapCheckPages() contains assert() statements that verify that
 6529:     ** all pointer map pages are set correctly. This is helpful while 
 6530:     ** debugging. This is usually disabled because a corrupt database may
 6531:     ** cause an assert() statement to fail.  */
 6532:     ptrmapCheckPages(apNew, nNew);
 6533:     ptrmapCheckPages(&pParent, 1);
 6534: #endif
 6535:   }
 6536: 
 6537:   assert( pParent->isInit );
 6538:   TRACE(("BALANCE: finished: old=%d new=%d cells=%d\n",
 6539:           nOld, nNew, nCell));
 6540: 
 6541:   /*
 6542:   ** Cleanup before returning.
 6543:   */
 6544: balance_cleanup:
 6545:   sqlite3ScratchFree(apCell);
 6546:   for(i=0; i<nOld; i++){
 6547:     releasePage(apOld[i]);
 6548:   }
 6549:   for(i=0; i<nNew; i++){
 6550:     releasePage(apNew[i]);
 6551:   }
 6552: 
 6553:   return rc;
 6554: }
 6555: 
 6556: 
 6557: /*
 6558: ** This function is called when the root page of a b-tree structure is
 6559: ** overfull (has one or more overflow pages).
 6560: **
 6561: ** A new child page is allocated and the contents of the current root
 6562: ** page, including overflow cells, are copied into the child. The root
 6563: ** page is then overwritten to make it an empty page with the right-child 
 6564: ** pointer pointing to the new page.
 6565: **
 6566: ** Before returning, all pointer-map entries corresponding to pages 
 6567: ** that the new child-page now contains pointers to are updated. The
 6568: ** entry corresponding to the new right-child pointer of the root
 6569: ** page is also updated.
 6570: **
 6571: ** If successful, *ppChild is set to contain a reference to the child 
 6572: ** page and SQLITE_OK is returned. In this case the caller is required
 6573: ** to call releasePage() on *ppChild exactly once. If an error occurs,
 6574: ** an error code is returned and *ppChild is set to 0.
 6575: */
 6576: static int balance_deeper(MemPage *pRoot, MemPage **ppChild){
 6577:   int rc;                        /* Return value from subprocedures */
 6578:   MemPage *pChild = 0;           /* Pointer to a new child page */
 6579:   Pgno pgnoChild = 0;            /* Page number of the new child page */
 6580:   BtShared *pBt = pRoot->pBt;    /* The BTree */
 6581: 
 6582:   assert( pRoot->nOverflow>0 );
 6583:   assert( sqlite3_mutex_held(pBt->mutex) );
 6584: 
 6585:   /* Make pRoot, the root page of the b-tree, writable. Allocate a new 
 6586:   ** page that will become the new right-child of pPage. Copy the contents
 6587:   ** of the node stored on pRoot into the new child page.
 6588:   */
 6589:   rc = sqlite3PagerWrite(pRoot->pDbPage);
 6590:   if( rc==SQLITE_OK ){
 6591:     rc = allocateBtreePage(pBt,&pChild,&pgnoChild,pRoot->pgno,0);
 6592:     copyNodeContent(pRoot, pChild, &rc);
 6593:     if( ISAUTOVACUUM ){
 6594:       ptrmapPut(pBt, pgnoChild, PTRMAP_BTREE, pRoot->pgno, &rc);
 6595:     }
 6596:   }
 6597:   if( rc ){
 6598:     *ppChild = 0;
 6599:     releasePage(pChild);
 6600:     return rc;
 6601:   }
 6602:   assert( sqlite3PagerIswriteable(pChild->pDbPage) );
 6603:   assert( sqlite3PagerIswriteable(pRoot->pDbPage) );
 6604:   assert( pChild->nCell==pRoot->nCell );
 6605: 
 6606:   TRACE(("BALANCE: copy root %d into %d\n", pRoot->pgno, pChild->pgno));
 6607: 
 6608:   /* Copy the overflow cells from pRoot to pChild */
 6609:   memcpy(pChild->aOvfl, pRoot->aOvfl, pRoot->nOverflow*sizeof(pRoot->aOvfl[0]));
 6610:   pChild->nOverflow = pRoot->nOverflow;
 6611: 
 6612:   /* Zero the contents of pRoot. Then install pChild as the right-child. */
 6613:   zeroPage(pRoot, pChild->aData[0] & ~PTF_LEAF);
 6614:   put4byte(&pRoot->aData[pRoot->hdrOffset+8], pgnoChild);
 6615: 
 6616:   *ppChild = pChild;
 6617:   return SQLITE_OK;
 6618: }
 6619: 
 6620: /*
 6621: ** The page that pCur currently points to has just been modified in
 6622: ** some way. This function figures out if this modification means the
 6623: ** tree needs to be balanced, and if so calls the appropriate balancing 
 6624: ** routine. Balancing routines are:
 6625: **
 6626: **   balance_quick()
 6627: **   balance_deeper()
 6628: **   balance_nonroot()
 6629: */
 6630: static int balance(BtCursor *pCur){
 6631:   int rc = SQLITE_OK;
 6632:   const int nMin = pCur->pBt->usableSize * 2 / 3;
 6633:   u8 aBalanceQuickSpace[13];
 6634:   u8 *pFree = 0;
 6635: 
 6636:   TESTONLY( int balance_quick_called = 0 );
 6637:   TESTONLY( int balance_deeper_called = 0 );
 6638: 
 6639:   do {
 6640:     int iPage = pCur->iPage;
 6641:     MemPage *pPage = pCur->apPage[iPage];
 6642: 
 6643:     if( iPage==0 ){
 6644:       if( pPage->nOverflow ){
 6645:         /* The root page of the b-tree is overfull. In this case call the
 6646:         ** balance_deeper() function to create a new child for the root-page
 6647:         ** and copy the current contents of the root-page to it. The
 6648:         ** next iteration of the do-loop will balance the child page.
 6649:         */ 
 6650:         assert( (balance_deeper_called++)==0 );
 6651:         rc = balance_deeper(pPage, &pCur->apPage[1]);
 6652:         if( rc==SQLITE_OK ){
 6653:           pCur->iPage = 1;
 6654:           pCur->aiIdx[0] = 0;
 6655:           pCur->aiIdx[1] = 0;
 6656:           assert( pCur->apPage[1]->nOverflow );
 6657:         }
 6658:       }else{
 6659:         break;
 6660:       }
 6661:     }else if( pPage->nOverflow==0 && pPage->nFree<=nMin ){
 6662:       break;
 6663:     }else{
 6664:       MemPage * const pParent = pCur->apPage[iPage-1];
 6665:       int const iIdx = pCur->aiIdx[iPage-1];
 6666: 
 6667:       rc = sqlite3PagerWrite(pParent->pDbPage);
 6668:       if( rc==SQLITE_OK ){
 6669: #ifndef SQLITE_OMIT_QUICKBALANCE
 6670:         if( pPage->hasData
 6671:          && pPage->nOverflow==1
 6672:          && pPage->aOvfl[0].idx==pPage->nCell
 6673:          && pParent->pgno!=1
 6674:          && pParent->nCell==iIdx
 6675:         ){
 6676:           /* Call balance_quick() to create a new sibling of pPage on which
 6677:           ** to store the overflow cell. balance_quick() inserts a new cell
 6678:           ** into pParent, which may cause pParent overflow. If this
 6679:           ** happens, the next interation of the do-loop will balance pParent 
 6680:           ** use either balance_nonroot() or balance_deeper(). Until this
 6681:           ** happens, the overflow cell is stored in the aBalanceQuickSpace[]
 6682:           ** buffer. 
 6683:           **
 6684:           ** The purpose of the following assert() is to check that only a
 6685:           ** single call to balance_quick() is made for each call to this
 6686:           ** function. If this were not verified, a subtle bug involving reuse
 6687:           ** of the aBalanceQuickSpace[] might sneak in.
 6688:           */
 6689:           assert( (balance_quick_called++)==0 );
 6690:           rc = balance_quick(pParent, pPage, aBalanceQuickSpace);
 6691:         }else
 6692: #endif
 6693:         {
 6694:           /* In this case, call balance_nonroot() to redistribute cells
 6695:           ** between pPage and up to 2 of its sibling pages. This involves
 6696:           ** modifying the contents of pParent, which may cause pParent to
 6697:           ** become overfull or underfull. The next iteration of the do-loop
 6698:           ** will balance the parent page to correct this.
 6699:           ** 
 6700:           ** If the parent page becomes overfull, the overflow cell or cells
 6701:           ** are stored in the pSpace buffer allocated immediately below. 
 6702:           ** A subsequent iteration of the do-loop will deal with this by
 6703:           ** calling balance_nonroot() (balance_deeper() may be called first,
 6704:           ** but it doesn't deal with overflow cells - just moves them to a
 6705:           ** different page). Once this subsequent call to balance_nonroot() 
 6706:           ** has completed, it is safe to release the pSpace buffer used by
 6707:           ** the previous call, as the overflow cell data will have been 
 6708:           ** copied either into the body of a database page or into the new
 6709:           ** pSpace buffer passed to the latter call to balance_nonroot().
 6710:           */
 6711:           u8 *pSpace = sqlite3PageMalloc(pCur->pBt->pageSize);
 6712:           rc = balance_nonroot(pParent, iIdx, pSpace, iPage==1);
 6713:           if( pFree ){
 6714:             /* If pFree is not NULL, it points to the pSpace buffer used 
 6715:             ** by a previous call to balance_nonroot(). Its contents are
 6716:             ** now stored either on real database pages or within the 
 6717:             ** new pSpace buffer, so it may be safely freed here. */
 6718:             sqlite3PageFree(pFree);
 6719:           }
 6720: 
 6721:           /* The pSpace buffer will be freed after the next call to
 6722:           ** balance_nonroot(), or just before this function returns, whichever
 6723:           ** comes first. */
 6724:           pFree = pSpace;
 6725:         }
 6726:       }
 6727: 
 6728:       pPage->nOverflow = 0;
 6729: 
 6730:       /* The next iteration of the do-loop balances the parent page. */
 6731:       releasePage(pPage);
 6732:       pCur->iPage--;
 6733:     }
 6734:   }while( rc==SQLITE_OK );
 6735: 
 6736:   if( pFree ){
 6737:     sqlite3PageFree(pFree);
 6738:   }
 6739:   return rc;
 6740: }
 6741: 
 6742: 
 6743: /*
 6744: ** Insert a new record into the BTree.  The key is given by (pKey,nKey)
 6745: ** and the data is given by (pData,nData).  The cursor is used only to
 6746: ** define what table the record should be inserted into.  The cursor
 6747: ** is left pointing at a random location.
 6748: **
 6749: ** For an INTKEY table, only the nKey value of the key is used.  pKey is
 6750: ** ignored.  For a ZERODATA table, the pData and nData are both ignored.
 6751: **
 6752: ** If the seekResult parameter is non-zero, then a successful call to
 6753: ** MovetoUnpacked() to seek cursor pCur to (pKey, nKey) has already
 6754: ** been performed. seekResult is the search result returned (a negative
 6755: ** number if pCur points at an entry that is smaller than (pKey, nKey), or
 6756: ** a positive value if pCur points at an etry that is larger than 
 6757: ** (pKey, nKey)). 
 6758: **
 6759: ** If the seekResult parameter is non-zero, then the caller guarantees that
 6760: ** cursor pCur is pointing at the existing copy of a row that is to be
 6761: ** overwritten.  If the seekResult parameter is 0, then cursor pCur may
 6762: ** point to any entry or to no entry at all and so this function has to seek
 6763: ** the cursor before the new key can be inserted.
 6764: */
 6765: int sqlite3BtreeInsert(
 6766:   BtCursor *pCur,                /* Insert data into the table of this cursor */
 6767:   const void *pKey, i64 nKey,    /* The key of the new record */
 6768:   const void *pData, int nData,  /* The data of the new record */
 6769:   int nZero,                     /* Number of extra 0 bytes to append to data */
 6770:   int appendBias,                /* True if this is likely an append */
 6771:   int seekResult                 /* Result of prior MovetoUnpacked() call */
 6772: ){
 6773:   int rc;
 6774:   int loc = seekResult;          /* -1: before desired location  +1: after */
 6775:   int szNew = 0;
 6776:   int idx;
 6777:   MemPage *pPage;
 6778:   Btree *p = pCur->pBtree;
 6779:   BtShared *pBt = p->pBt;
 6780:   unsigned char *oldCell;
 6781:   unsigned char *newCell = 0;
 6782: 
 6783:   if( pCur->eState==CURSOR_FAULT ){
 6784:     assert( pCur->skipNext!=SQLITE_OK );
 6785:     return pCur->skipNext;
 6786:   }
 6787: 
 6788:   assert( cursorHoldsMutex(pCur) );
 6789:   assert( pCur->wrFlag && pBt->inTransaction==TRANS_WRITE
 6790:               && (pBt->btsFlags & BTS_READ_ONLY)==0 );
 6791:   assert( hasSharedCacheTableLock(p, pCur->pgnoRoot, pCur->pKeyInfo!=0, 2) );
 6792: 
 6793:   /* Assert that the caller has been consistent. If this cursor was opened
 6794:   ** expecting an index b-tree, then the caller should be inserting blob
 6795:   ** keys with no associated data. If the cursor was opened expecting an
 6796:   ** intkey table, the caller should be inserting integer keys with a
 6797:   ** blob of associated data.  */
 6798:   assert( (pKey==0)==(pCur->pKeyInfo==0) );
 6799: 
 6800:   /* If this is an insert into a table b-tree, invalidate any incrblob 
 6801:   ** cursors open on the row being replaced (assuming this is a replace
 6802:   ** operation - if it is not, the following is a no-op).  */
 6803:   if( pCur->pKeyInfo==0 ){
 6804:     invalidateIncrblobCursors(p, nKey, 0);
 6805:   }
 6806: 
 6807:   /* Save the positions of any other cursors open on this table.
 6808:   **
 6809:   ** In some cases, the call to btreeMoveto() below is a no-op. For
 6810:   ** example, when inserting data into a table with auto-generated integer
 6811:   ** keys, the VDBE layer invokes sqlite3BtreeLast() to figure out the 
 6812:   ** integer key to use. It then calls this function to actually insert the 
 6813:   ** data into the intkey B-Tree. In this case btreeMoveto() recognizes
 6814:   ** that the cursor is already where it needs to be and returns without
 6815:   ** doing any work. To avoid thwarting these optimizations, it is important
 6816:   ** not to clear the cursor here.
 6817:   */
 6818:   rc = saveAllCursors(pBt, pCur->pgnoRoot, pCur);
 6819:   if( rc ) return rc;
 6820:   if( !loc ){
 6821:     rc = btreeMoveto(pCur, pKey, nKey, appendBias, &loc);
 6822:     if( rc ) return rc;
 6823:   }
 6824:   assert( pCur->eState==CURSOR_VALID || (pCur->eState==CURSOR_INVALID && loc) );
 6825: 
 6826:   pPage = pCur->apPage[pCur->iPage];
 6827:   assert( pPage->intKey || nKey>=0 );
 6828:   assert( pPage->leaf || !pPage->intKey );
 6829: 
 6830:   TRACE(("INSERT: table=%d nkey=%lld ndata=%d page=%d %s\n",
 6831:           pCur->pgnoRoot, nKey, nData, pPage->pgno,
 6832:           loc==0 ? "overwrite" : "new entry"));
 6833:   assert( pPage->isInit );
 6834:   allocateTempSpace(pBt);
 6835:   newCell = pBt->pTmpSpace;
 6836:   if( newCell==0 ) return SQLITE_NOMEM;
 6837:   rc = fillInCell(pPage, newCell, pKey, nKey, pData, nData, nZero, &szNew);
 6838:   if( rc ) goto end_insert;
 6839:   assert( szNew==cellSizePtr(pPage, newCell) );
 6840:   assert( szNew <= MX_CELL_SIZE(pBt) );
 6841:   idx = pCur->aiIdx[pCur->iPage];
 6842:   if( loc==0 ){
 6843:     u16 szOld;
 6844:     assert( idx<pPage->nCell );
 6845:     rc = sqlite3PagerWrite(pPage->pDbPage);
 6846:     if( rc ){
 6847:       goto end_insert;
 6848:     }
 6849:     oldCell = findCell(pPage, idx);
 6850:     if( !pPage->leaf ){
 6851:       memcpy(newCell, oldCell, 4);
 6852:     }
 6853:     szOld = cellSizePtr(pPage, oldCell);
 6854:     rc = clearCell(pPage, oldCell);
 6855:     dropCell(pPage, idx, szOld, &rc);
 6856:     if( rc ) goto end_insert;
 6857:   }else if( loc<0 && pPage->nCell>0 ){
 6858:     assert( pPage->leaf );
 6859:     idx = ++pCur->aiIdx[pCur->iPage];
 6860:   }else{
 6861:     assert( pPage->leaf );
 6862:   }
 6863:   insertCell(pPage, idx, newCell, szNew, 0, 0, &rc);
 6864:   assert( rc!=SQLITE_OK || pPage->nCell>0 || pPage->nOverflow>0 );
 6865: 
 6866:   /* If no error has occured and pPage has an overflow cell, call balance() 
 6867:   ** to redistribute the cells within the tree. Since balance() may move
 6868:   ** the cursor, zero the BtCursor.info.nSize and BtCursor.validNKey
 6869:   ** variables.
 6870:   **
 6871:   ** Previous versions of SQLite called moveToRoot() to move the cursor
 6872:   ** back to the root page as balance() used to invalidate the contents
 6873:   ** of BtCursor.apPage[] and BtCursor.aiIdx[]. Instead of doing that,
 6874:   ** set the cursor state to "invalid". This makes common insert operations
 6875:   ** slightly faster.
 6876:   **
 6877:   ** There is a subtle but important optimization here too. When inserting
 6878:   ** multiple records into an intkey b-tree using a single cursor (as can
 6879:   ** happen while processing an "INSERT INTO ... SELECT" statement), it
 6880:   ** is advantageous to leave the cursor pointing to the last entry in
 6881:   ** the b-tree if possible. If the cursor is left pointing to the last
 6882:   ** entry in the table, and the next row inserted has an integer key
 6883:   ** larger than the largest existing key, it is possible to insert the
 6884:   ** row without seeking the cursor. This can be a big performance boost.
 6885:   */
 6886:   pCur->info.nSize = 0;
 6887:   pCur->validNKey = 0;
 6888:   if( rc==SQLITE_OK && pPage->nOverflow ){
 6889:     rc = balance(pCur);
 6890: 
 6891:     /* Must make sure nOverflow is reset to zero even if the balance()
 6892:     ** fails. Internal data structure corruption will result otherwise. 
 6893:     ** Also, set the cursor state to invalid. This stops saveCursorPosition()
 6894:     ** from trying to save the current position of the cursor.  */
 6895:     pCur->apPage[pCur->iPage]->nOverflow = 0;
 6896:     pCur->eState = CURSOR_INVALID;
 6897:   }
 6898:   assert( pCur->apPage[pCur->iPage]->nOverflow==0 );
 6899: 
 6900: end_insert:
 6901:   return rc;
 6902: }
 6903: 
 6904: /*
 6905: ** Delete the entry that the cursor is pointing to.  The cursor
 6906: ** is left pointing at a arbitrary location.
 6907: */
 6908: int sqlite3BtreeDelete(BtCursor *pCur){
 6909:   Btree *p = pCur->pBtree;
 6910:   BtShared *pBt = p->pBt;              
 6911:   int rc;                              /* Return code */
 6912:   MemPage *pPage;                      /* Page to delete cell from */
 6913:   unsigned char *pCell;                /* Pointer to cell to delete */
 6914:   int iCellIdx;                        /* Index of cell to delete */
 6915:   int iCellDepth;                      /* Depth of node containing pCell */ 
 6916: 
 6917:   assert( cursorHoldsMutex(pCur) );
 6918:   assert( pBt->inTransaction==TRANS_WRITE );
 6919:   assert( (pBt->btsFlags & BTS_READ_ONLY)==0 );
 6920:   assert( pCur->wrFlag );
 6921:   assert( hasSharedCacheTableLock(p, pCur->pgnoRoot, pCur->pKeyInfo!=0, 2) );
 6922:   assert( !hasReadConflicts(p, pCur->pgnoRoot) );
 6923: 
 6924:   if( NEVER(pCur->aiIdx[pCur->iPage]>=pCur->apPage[pCur->iPage]->nCell) 
 6925:    || NEVER(pCur->eState!=CURSOR_VALID)
 6926:   ){
 6927:     return SQLITE_ERROR;  /* Something has gone awry. */
 6928:   }
 6929: 
 6930:   /* If this is a delete operation to remove a row from a table b-tree,
 6931:   ** invalidate any incrblob cursors open on the row being deleted.  */
 6932:   if( pCur->pKeyInfo==0 ){
 6933:     invalidateIncrblobCursors(p, pCur->info.nKey, 0);
 6934:   }
 6935: 
 6936:   iCellDepth = pCur->iPage;
 6937:   iCellIdx = pCur->aiIdx[iCellDepth];
 6938:   pPage = pCur->apPage[iCellDepth];
 6939:   pCell = findCell(pPage, iCellIdx);
 6940: 
 6941:   /* If the page containing the entry to delete is not a leaf page, move
 6942:   ** the cursor to the largest entry in the tree that is smaller than
 6943:   ** the entry being deleted. This cell will replace the cell being deleted
 6944:   ** from the internal node. The 'previous' entry is used for this instead
 6945:   ** of the 'next' entry, as the previous entry is always a part of the
 6946:   ** sub-tree headed by the child page of the cell being deleted. This makes
 6947:   ** balancing the tree following the delete operation easier.  */
 6948:   if( !pPage->leaf ){
 6949:     int notUsed;
 6950:     rc = sqlite3BtreePrevious(pCur, &notUsed);
 6951:     if( rc ) return rc;
 6952:   }
 6953: 
 6954:   /* Save the positions of any other cursors open on this table before
 6955:   ** making any modifications. Make the page containing the entry to be 
 6956:   ** deleted writable. Then free any overflow pages associated with the 
 6957:   ** entry and finally remove the cell itself from within the page.  
 6958:   */
 6959:   rc = saveAllCursors(pBt, pCur->pgnoRoot, pCur);
 6960:   if( rc ) return rc;
 6961:   rc = sqlite3PagerWrite(pPage->pDbPage);
 6962:   if( rc ) return rc;
 6963:   rc = clearCell(pPage, pCell);
 6964:   dropCell(pPage, iCellIdx, cellSizePtr(pPage, pCell), &rc);
 6965:   if( rc ) return rc;
 6966: 
 6967:   /* If the cell deleted was not located on a leaf page, then the cursor
 6968:   ** is currently pointing to the largest entry in the sub-tree headed
 6969:   ** by the child-page of the cell that was just deleted from an internal
 6970:   ** node. The cell from the leaf node needs to be moved to the internal
 6971:   ** node to replace the deleted cell.  */
 6972:   if( !pPage->leaf ){
 6973:     MemPage *pLeaf = pCur->apPage[pCur->iPage];
 6974:     int nCell;
 6975:     Pgno n = pCur->apPage[iCellDepth+1]->pgno;
 6976:     unsigned char *pTmp;
 6977: 
 6978:     pCell = findCell(pLeaf, pLeaf->nCell-1);
 6979:     nCell = cellSizePtr(pLeaf, pCell);
 6980:     assert( MX_CELL_SIZE(pBt) >= nCell );
 6981: 
 6982:     allocateTempSpace(pBt);
 6983:     pTmp = pBt->pTmpSpace;
 6984: 
 6985:     rc = sqlite3PagerWrite(pLeaf->pDbPage);
 6986:     insertCell(pPage, iCellIdx, pCell-4, nCell+4, pTmp, n, &rc);
 6987:     dropCell(pLeaf, pLeaf->nCell-1, nCell, &rc);
 6988:     if( rc ) return rc;
 6989:   }
 6990: 
 6991:   /* Balance the tree. If the entry deleted was located on a leaf page,
 6992:   ** then the cursor still points to that page. In this case the first
 6993:   ** call to balance() repairs the tree, and the if(...) condition is
 6994:   ** never true.
 6995:   **
 6996:   ** Otherwise, if the entry deleted was on an internal node page, then
 6997:   ** pCur is pointing to the leaf page from which a cell was removed to
 6998:   ** replace the cell deleted from the internal node. This is slightly
 6999:   ** tricky as the leaf node may be underfull, and the internal node may
 7000:   ** be either under or overfull. In this case run the balancing algorithm
 7001:   ** on the leaf node first. If the balance proceeds far enough up the
 7002:   ** tree that we can be sure that any problem in the internal node has
 7003:   ** been corrected, so be it. Otherwise, after balancing the leaf node,
 7004:   ** walk the cursor up the tree to the internal node and balance it as 
 7005:   ** well.  */
 7006:   rc = balance(pCur);
 7007:   if( rc==SQLITE_OK && pCur->iPage>iCellDepth ){
 7008:     while( pCur->iPage>iCellDepth ){
 7009:       releasePage(pCur->apPage[pCur->iPage--]);
 7010:     }
 7011:     rc = balance(pCur);
 7012:   }
 7013: 
 7014:   if( rc==SQLITE_OK ){
 7015:     moveToRoot(pCur);
 7016:   }
 7017:   return rc;
 7018: }
 7019: 
 7020: /*
 7021: ** Create a new BTree table.  Write into *piTable the page
 7022: ** number for the root page of the new table.
 7023: **
 7024: ** The type of type is determined by the flags parameter.  Only the
 7025: ** following values of flags are currently in use.  Other values for
 7026: ** flags might not work:
 7027: **
 7028: **     BTREE_INTKEY|BTREE_LEAFDATA     Used for SQL tables with rowid keys
 7029: **     BTREE_ZERODATA                  Used for SQL indices
 7030: */
 7031: static int btreeCreateTable(Btree *p, int *piTable, int createTabFlags){
 7032:   BtShared *pBt = p->pBt;
 7033:   MemPage *pRoot;
 7034:   Pgno pgnoRoot;
 7035:   int rc;
 7036:   int ptfFlags;          /* Page-type flage for the root page of new table */
 7037: 
 7038:   assert( sqlite3BtreeHoldsMutex(p) );
 7039:   assert( pBt->inTransaction==TRANS_WRITE );
 7040:   assert( (pBt->btsFlags & BTS_READ_ONLY)==0 );
 7041: 
 7042: #ifdef SQLITE_OMIT_AUTOVACUUM
 7043:   rc = allocateBtreePage(pBt, &pRoot, &pgnoRoot, 1, 0);
 7044:   if( rc ){
 7045:     return rc;
 7046:   }
 7047: #else
 7048:   if( pBt->autoVacuum ){
 7049:     Pgno pgnoMove;      /* Move a page here to make room for the root-page */
 7050:     MemPage *pPageMove; /* The page to move to. */
 7051: 
 7052:     /* Creating a new table may probably require moving an existing database
 7053:     ** to make room for the new tables root page. In case this page turns
 7054:     ** out to be an overflow page, delete all overflow page-map caches
 7055:     ** held by open cursors.
 7056:     */
 7057:     invalidateAllOverflowCache(pBt);
 7058: 
 7059:     /* Read the value of meta[3] from the database to determine where the
 7060:     ** root page of the new table should go. meta[3] is the largest root-page
 7061:     ** created so far, so the new root-page is (meta[3]+1).
 7062:     */
 7063:     sqlite3BtreeGetMeta(p, BTREE_LARGEST_ROOT_PAGE, &pgnoRoot);
 7064:     pgnoRoot++;
 7065: 
 7066:     /* The new root-page may not be allocated on a pointer-map page, or the
 7067:     ** PENDING_BYTE page.
 7068:     */
 7069:     while( pgnoRoot==PTRMAP_PAGENO(pBt, pgnoRoot) ||
 7070:         pgnoRoot==PENDING_BYTE_PAGE(pBt) ){
 7071:       pgnoRoot++;
 7072:     }
 7073:     assert( pgnoRoot>=3 );
 7074: 
 7075:     /* Allocate a page. The page that currently resides at pgnoRoot will
 7076:     ** be moved to the allocated page (unless the allocated page happens
 7077:     ** to reside at pgnoRoot).
 7078:     */
 7079:     rc = allocateBtreePage(pBt, &pPageMove, &pgnoMove, pgnoRoot, 1);
 7080:     if( rc!=SQLITE_OK ){
 7081:       return rc;
 7082:     }
 7083: 
 7084:     if( pgnoMove!=pgnoRoot ){
 7085:       /* pgnoRoot is the page that will be used for the root-page of
 7086:       ** the new table (assuming an error did not occur). But we were
 7087:       ** allocated pgnoMove. If required (i.e. if it was not allocated
 7088:       ** by extending the file), the current page at position pgnoMove
 7089:       ** is already journaled.
 7090:       */
 7091:       u8 eType = 0;
 7092:       Pgno iPtrPage = 0;
 7093: 
 7094:       releasePage(pPageMove);
 7095: 
 7096:       /* Move the page currently at pgnoRoot to pgnoMove. */
 7097:       rc = btreeGetPage(pBt, pgnoRoot, &pRoot, 0);
 7098:       if( rc!=SQLITE_OK ){
 7099:         return rc;
 7100:       }
 7101:       rc = ptrmapGet(pBt, pgnoRoot, &eType, &iPtrPage);
 7102:       if( eType==PTRMAP_ROOTPAGE || eType==PTRMAP_FREEPAGE ){
 7103:         rc = SQLITE_CORRUPT_BKPT;
 7104:       }
 7105:       if( rc!=SQLITE_OK ){
 7106:         releasePage(pRoot);
 7107:         return rc;
 7108:       }
 7109:       assert( eType!=PTRMAP_ROOTPAGE );
 7110:       assert( eType!=PTRMAP_FREEPAGE );
 7111:       rc = relocatePage(pBt, pRoot, eType, iPtrPage, pgnoMove, 0);
 7112:       releasePage(pRoot);
 7113: 
 7114:       /* Obtain the page at pgnoRoot */
 7115:       if( rc!=SQLITE_OK ){
 7116:         return rc;
 7117:       }
 7118:       rc = btreeGetPage(pBt, pgnoRoot, &pRoot, 0);
 7119:       if( rc!=SQLITE_OK ){
 7120:         return rc;
 7121:       }
 7122:       rc = sqlite3PagerWrite(pRoot->pDbPage);
 7123:       if( rc!=SQLITE_OK ){
 7124:         releasePage(pRoot);
 7125:         return rc;
 7126:       }
 7127:     }else{
 7128:       pRoot = pPageMove;
 7129:     } 
 7130: 
 7131:     /* Update the pointer-map and meta-data with the new root-page number. */
 7132:     ptrmapPut(pBt, pgnoRoot, PTRMAP_ROOTPAGE, 0, &rc);
 7133:     if( rc ){
 7134:       releasePage(pRoot);
 7135:       return rc;
 7136:     }
 7137: 
 7138:     /* When the new root page was allocated, page 1 was made writable in
 7139:     ** order either to increase the database filesize, or to decrement the
 7140:     ** freelist count.  Hence, the sqlite3BtreeUpdateMeta() call cannot fail.
 7141:     */
 7142:     assert( sqlite3PagerIswriteable(pBt->pPage1->pDbPage) );
 7143:     rc = sqlite3BtreeUpdateMeta(p, 4, pgnoRoot);
 7144:     if( NEVER(rc) ){
 7145:       releasePage(pRoot);
 7146:       return rc;
 7147:     }
 7148: 
 7149:   }else{
 7150:     rc = allocateBtreePage(pBt, &pRoot, &pgnoRoot, 1, 0);
 7151:     if( rc ) return rc;
 7152:   }
 7153: #endif
 7154:   assert( sqlite3PagerIswriteable(pRoot->pDbPage) );
 7155:   if( createTabFlags & BTREE_INTKEY ){
 7156:     ptfFlags = PTF_INTKEY | PTF_LEAFDATA | PTF_LEAF;
 7157:   }else{
 7158:     ptfFlags = PTF_ZERODATA | PTF_LEAF;
 7159:   }
 7160:   zeroPage(pRoot, ptfFlags);
 7161:   sqlite3PagerUnref(pRoot->pDbPage);
 7162:   assert( (pBt->openFlags & BTREE_SINGLE)==0 || pgnoRoot==2 );
 7163:   *piTable = (int)pgnoRoot;
 7164:   return SQLITE_OK;
 7165: }
 7166: int sqlite3BtreeCreateTable(Btree *p, int *piTable, int flags){
 7167:   int rc;
 7168:   sqlite3BtreeEnter(p);
 7169:   rc = btreeCreateTable(p, piTable, flags);
 7170:   sqlite3BtreeLeave(p);
 7171:   return rc;
 7172: }
 7173: 
 7174: /*
 7175: ** Erase the given database page and all its children.  Return
 7176: ** the page to the freelist.
 7177: */
 7178: static int clearDatabasePage(
 7179:   BtShared *pBt,           /* The BTree that contains the table */
 7180:   Pgno pgno,               /* Page number to clear */
 7181:   int freePageFlag,        /* Deallocate page if true */
 7182:   int *pnChange            /* Add number of Cells freed to this counter */
 7183: ){
 7184:   MemPage *pPage;
 7185:   int rc;
 7186:   unsigned char *pCell;
 7187:   int i;
 7188: 
 7189:   assert( sqlite3_mutex_held(pBt->mutex) );
 7190:   if( pgno>btreePagecount(pBt) ){
 7191:     return SQLITE_CORRUPT_BKPT;
 7192:   }
 7193: 
 7194:   rc = getAndInitPage(pBt, pgno, &pPage);
 7195:   if( rc ) return rc;
 7196:   for(i=0; i<pPage->nCell; i++){
 7197:     pCell = findCell(pPage, i);
 7198:     if( !pPage->leaf ){
 7199:       rc = clearDatabasePage(pBt, get4byte(pCell), 1, pnChange);
 7200:       if( rc ) goto cleardatabasepage_out;
 7201:     }
 7202:     rc = clearCell(pPage, pCell);
 7203:     if( rc ) goto cleardatabasepage_out;
 7204:   }
 7205:   if( !pPage->leaf ){
 7206:     rc = clearDatabasePage(pBt, get4byte(&pPage->aData[8]), 1, pnChange);
 7207:     if( rc ) goto cleardatabasepage_out;
 7208:   }else if( pnChange ){
 7209:     assert( pPage->intKey );
 7210:     *pnChange += pPage->nCell;
 7211:   }
 7212:   if( freePageFlag ){
 7213:     freePage(pPage, &rc);
 7214:   }else if( (rc = sqlite3PagerWrite(pPage->pDbPage))==0 ){
 7215:     zeroPage(pPage, pPage->aData[0] | PTF_LEAF);
 7216:   }
 7217: 
 7218: cleardatabasepage_out:
 7219:   releasePage(pPage);
 7220:   return rc;
 7221: }
 7222: 
 7223: /*
 7224: ** Delete all information from a single table in the database.  iTable is
 7225: ** the page number of the root of the table.  After this routine returns,
 7226: ** the root page is empty, but still exists.
 7227: **
 7228: ** This routine will fail with SQLITE_LOCKED if there are any open
 7229: ** read cursors on the table.  Open write cursors are moved to the
 7230: ** root of the table.
 7231: **
 7232: ** If pnChange is not NULL, then table iTable must be an intkey table. The
 7233: ** integer value pointed to by pnChange is incremented by the number of
 7234: ** entries in the table.
 7235: */
 7236: int sqlite3BtreeClearTable(Btree *p, int iTable, int *pnChange){
 7237:   int rc;
 7238:   BtShared *pBt = p->pBt;
 7239:   sqlite3BtreeEnter(p);
 7240:   assert( p->inTrans==TRANS_WRITE );
 7241: 
 7242:   /* Invalidate all incrblob cursors open on table iTable (assuming iTable
 7243:   ** is the root of a table b-tree - if it is not, the following call is
 7244:   ** a no-op).  */
 7245:   invalidateIncrblobCursors(p, 0, 1);
 7246: 
 7247:   rc = saveAllCursors(pBt, (Pgno)iTable, 0);
 7248:   if( SQLITE_OK==rc ){
 7249:     rc = clearDatabasePage(pBt, (Pgno)iTable, 0, pnChange);
 7250:   }
 7251:   sqlite3BtreeLeave(p);
 7252:   return rc;
 7253: }
 7254: 
 7255: /*
 7256: ** Erase all information in a table and add the root of the table to
 7257: ** the freelist.  Except, the root of the principle table (the one on
 7258: ** page 1) is never added to the freelist.
 7259: **
 7260: ** This routine will fail with SQLITE_LOCKED if there are any open
 7261: ** cursors on the table.
 7262: **
 7263: ** If AUTOVACUUM is enabled and the page at iTable is not the last
 7264: ** root page in the database file, then the last root page 
 7265: ** in the database file is moved into the slot formerly occupied by
 7266: ** iTable and that last slot formerly occupied by the last root page
 7267: ** is added to the freelist instead of iTable.  In this say, all
 7268: ** root pages are kept at the beginning of the database file, which
 7269: ** is necessary for AUTOVACUUM to work right.  *piMoved is set to the 
 7270: ** page number that used to be the last root page in the file before
 7271: ** the move.  If no page gets moved, *piMoved is set to 0.
 7272: ** The last root page is recorded in meta[3] and the value of
 7273: ** meta[3] is updated by this procedure.
 7274: */
 7275: static int btreeDropTable(Btree *p, Pgno iTable, int *piMoved){
 7276:   int rc;
 7277:   MemPage *pPage = 0;
 7278:   BtShared *pBt = p->pBt;
 7279: 
 7280:   assert( sqlite3BtreeHoldsMutex(p) );
 7281:   assert( p->inTrans==TRANS_WRITE );
 7282: 
 7283:   /* It is illegal to drop a table if any cursors are open on the
 7284:   ** database. This is because in auto-vacuum mode the backend may
 7285:   ** need to move another root-page to fill a gap left by the deleted
 7286:   ** root page. If an open cursor was using this page a problem would 
 7287:   ** occur.
 7288:   **
 7289:   ** This error is caught long before control reaches this point.
 7290:   */
 7291:   if( NEVER(pBt->pCursor) ){
 7292:     sqlite3ConnectionBlocked(p->db, pBt->pCursor->pBtree->db);
 7293:     return SQLITE_LOCKED_SHAREDCACHE;
 7294:   }
 7295: 
 7296:   rc = btreeGetPage(pBt, (Pgno)iTable, &pPage, 0);
 7297:   if( rc ) return rc;
 7298:   rc = sqlite3BtreeClearTable(p, iTable, 0);
 7299:   if( rc ){
 7300:     releasePage(pPage);
 7301:     return rc;
 7302:   }
 7303: 
 7304:   *piMoved = 0;
 7305: 
 7306:   if( iTable>1 ){
 7307: #ifdef SQLITE_OMIT_AUTOVACUUM
 7308:     freePage(pPage, &rc);
 7309:     releasePage(pPage);
 7310: #else
 7311:     if( pBt->autoVacuum ){
 7312:       Pgno maxRootPgno;
 7313:       sqlite3BtreeGetMeta(p, BTREE_LARGEST_ROOT_PAGE, &maxRootPgno);
 7314: 
 7315:       if( iTable==maxRootPgno ){
 7316:         /* If the table being dropped is the table with the largest root-page
 7317:         ** number in the database, put the root page on the free list. 
 7318:         */
 7319:         freePage(pPage, &rc);
 7320:         releasePage(pPage);
 7321:         if( rc!=SQLITE_OK ){
 7322:           return rc;
 7323:         }
 7324:       }else{
 7325:         /* The table being dropped does not have the largest root-page
 7326:         ** number in the database. So move the page that does into the 
 7327:         ** gap left by the deleted root-page.
 7328:         */
 7329:         MemPage *pMove;
 7330:         releasePage(pPage);
 7331:         rc = btreeGetPage(pBt, maxRootPgno, &pMove, 0);
 7332:         if( rc!=SQLITE_OK ){
 7333:           return rc;
 7334:         }
 7335:         rc = relocatePage(pBt, pMove, PTRMAP_ROOTPAGE, 0, iTable, 0);
 7336:         releasePage(pMove);
 7337:         if( rc!=SQLITE_OK ){
 7338:           return rc;
 7339:         }
 7340:         pMove = 0;
 7341:         rc = btreeGetPage(pBt, maxRootPgno, &pMove, 0);
 7342:         freePage(pMove, &rc);
 7343:         releasePage(pMove);
 7344:         if( rc!=SQLITE_OK ){
 7345:           return rc;
 7346:         }
 7347:         *piMoved = maxRootPgno;
 7348:       }
 7349: 
 7350:       /* Set the new 'max-root-page' value in the database header. This
 7351:       ** is the old value less one, less one more if that happens to
 7352:       ** be a root-page number, less one again if that is the
 7353:       ** PENDING_BYTE_PAGE.
 7354:       */
 7355:       maxRootPgno--;
 7356:       while( maxRootPgno==PENDING_BYTE_PAGE(pBt)
 7357:              || PTRMAP_ISPAGE(pBt, maxRootPgno) ){
 7358:         maxRootPgno--;
 7359:       }
 7360:       assert( maxRootPgno!=PENDING_BYTE_PAGE(pBt) );
 7361: 
 7362:       rc = sqlite3BtreeUpdateMeta(p, 4, maxRootPgno);
 7363:     }else{
 7364:       freePage(pPage, &rc);
 7365:       releasePage(pPage);
 7366:     }
 7367: #endif
 7368:   }else{
 7369:     /* If sqlite3BtreeDropTable was called on page 1.
 7370:     ** This really never should happen except in a corrupt
 7371:     ** database. 
 7372:     */
 7373:     zeroPage(pPage, PTF_INTKEY|PTF_LEAF );
 7374:     releasePage(pPage);
 7375:   }
 7376:   return rc;  
 7377: }
 7378: int sqlite3BtreeDropTable(Btree *p, int iTable, int *piMoved){
 7379:   int rc;
 7380:   sqlite3BtreeEnter(p);
 7381:   rc = btreeDropTable(p, iTable, piMoved);
 7382:   sqlite3BtreeLeave(p);
 7383:   return rc;
 7384: }
 7385: 
 7386: 
 7387: /*
 7388: ** This function may only be called if the b-tree connection already
 7389: ** has a read or write transaction open on the database.
 7390: **
 7391: ** Read the meta-information out of a database file.  Meta[0]
 7392: ** is the number of free pages currently in the database.  Meta[1]
 7393: ** through meta[15] are available for use by higher layers.  Meta[0]
 7394: ** is read-only, the others are read/write.
 7395: ** 
 7396: ** The schema layer numbers meta values differently.  At the schema
 7397: ** layer (and the SetCookie and ReadCookie opcodes) the number of
 7398: ** free pages is not visible.  So Cookie[0] is the same as Meta[1].
 7399: */
 7400: void sqlite3BtreeGetMeta(Btree *p, int idx, u32 *pMeta){
 7401:   BtShared *pBt = p->pBt;
 7402: 
 7403:   sqlite3BtreeEnter(p);
 7404:   assert( p->inTrans>TRANS_NONE );
 7405:   assert( SQLITE_OK==querySharedCacheTableLock(p, MASTER_ROOT, READ_LOCK) );
 7406:   assert( pBt->pPage1 );
 7407:   assert( idx>=0 && idx<=15 );
 7408: 
 7409:   *pMeta = get4byte(&pBt->pPage1->aData[36 + idx*4]);
 7410: 
 7411:   /* If auto-vacuum is disabled in this build and this is an auto-vacuum
 7412:   ** database, mark the database as read-only.  */
 7413: #ifdef SQLITE_OMIT_AUTOVACUUM
 7414:   if( idx==BTREE_LARGEST_ROOT_PAGE && *pMeta>0 ){
 7415:     pBt->btsFlags |= BTS_READ_ONLY;
 7416:   }
 7417: #endif
 7418: 
 7419:   sqlite3BtreeLeave(p);
 7420: }
 7421: 
 7422: /*
 7423: ** Write meta-information back into the database.  Meta[0] is
 7424: ** read-only and may not be written.
 7425: */
 7426: int sqlite3BtreeUpdateMeta(Btree *p, int idx, u32 iMeta){
 7427:   BtShared *pBt = p->pBt;
 7428:   unsigned char *pP1;
 7429:   int rc;
 7430:   assert( idx>=1 && idx<=15 );
 7431:   sqlite3BtreeEnter(p);
 7432:   assert( p->inTrans==TRANS_WRITE );
 7433:   assert( pBt->pPage1!=0 );
 7434:   pP1 = pBt->pPage1->aData;
 7435:   rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
 7436:   if( rc==SQLITE_OK ){
 7437:     put4byte(&pP1[36 + idx*4], iMeta);
 7438: #ifndef SQLITE_OMIT_AUTOVACUUM
 7439:     if( idx==BTREE_INCR_VACUUM ){
 7440:       assert( pBt->autoVacuum || iMeta==0 );
 7441:       assert( iMeta==0 || iMeta==1 );
 7442:       pBt->incrVacuum = (u8)iMeta;
 7443:     }
 7444: #endif
 7445:   }
 7446:   sqlite3BtreeLeave(p);
 7447:   return rc;
 7448: }
 7449: 
 7450: #ifndef SQLITE_OMIT_BTREECOUNT
 7451: /*
 7452: ** The first argument, pCur, is a cursor opened on some b-tree. Count the
 7453: ** number of entries in the b-tree and write the result to *pnEntry.
 7454: **
 7455: ** SQLITE_OK is returned if the operation is successfully executed. 
 7456: ** Otherwise, if an error is encountered (i.e. an IO error or database
 7457: ** corruption) an SQLite error code is returned.
 7458: */
 7459: int sqlite3BtreeCount(BtCursor *pCur, i64 *pnEntry){
 7460:   i64 nEntry = 0;                      /* Value to return in *pnEntry */
 7461:   int rc;                              /* Return code */
 7462: 
 7463:   if( pCur->pgnoRoot==0 ){
 7464:     *pnEntry = 0;
 7465:     return SQLITE_OK;
 7466:   }
 7467:   rc = moveToRoot(pCur);
 7468: 
 7469:   /* Unless an error occurs, the following loop runs one iteration for each
 7470:   ** page in the B-Tree structure (not including overflow pages). 
 7471:   */
 7472:   while( rc==SQLITE_OK ){
 7473:     int iIdx;                          /* Index of child node in parent */
 7474:     MemPage *pPage;                    /* Current page of the b-tree */
 7475: 
 7476:     /* If this is a leaf page or the tree is not an int-key tree, then 
 7477:     ** this page contains countable entries. Increment the entry counter
 7478:     ** accordingly.
 7479:     */
 7480:     pPage = pCur->apPage[pCur->iPage];
 7481:     if( pPage->leaf || !pPage->intKey ){
 7482:       nEntry += pPage->nCell;
 7483:     }
 7484: 
 7485:     /* pPage is a leaf node. This loop navigates the cursor so that it 
 7486:     ** points to the first interior cell that it points to the parent of
 7487:     ** the next page in the tree that has not yet been visited. The
 7488:     ** pCur->aiIdx[pCur->iPage] value is set to the index of the parent cell
 7489:     ** of the page, or to the number of cells in the page if the next page
 7490:     ** to visit is the right-child of its parent.
 7491:     **
 7492:     ** If all pages in the tree have been visited, return SQLITE_OK to the
 7493:     ** caller.
 7494:     */
 7495:     if( pPage->leaf ){
 7496:       do {
 7497:         if( pCur->iPage==0 ){
 7498:           /* All pages of the b-tree have been visited. Return successfully. */
 7499:           *pnEntry = nEntry;
 7500:           return SQLITE_OK;
 7501:         }
 7502:         moveToParent(pCur);
 7503:       }while ( pCur->aiIdx[pCur->iPage]>=pCur->apPage[pCur->iPage]->nCell );
 7504: 
 7505:       pCur->aiIdx[pCur->iPage]++;
 7506:       pPage = pCur->apPage[pCur->iPage];
 7507:     }
 7508: 
 7509:     /* Descend to the child node of the cell that the cursor currently 
 7510:     ** points at. This is the right-child if (iIdx==pPage->nCell).
 7511:     */
 7512:     iIdx = pCur->aiIdx[pCur->iPage];
 7513:     if( iIdx==pPage->nCell ){
 7514:       rc = moveToChild(pCur, get4byte(&pPage->aData[pPage->hdrOffset+8]));
 7515:     }else{
 7516:       rc = moveToChild(pCur, get4byte(findCell(pPage, iIdx)));
 7517:     }
 7518:   }
 7519: 
 7520:   /* An error has occurred. Return an error code. */
 7521:   return rc;
 7522: }
 7523: #endif
 7524: 
 7525: /*
 7526: ** Return the pager associated with a BTree.  This routine is used for
 7527: ** testing and debugging only.
 7528: */
 7529: Pager *sqlite3BtreePager(Btree *p){
 7530:   return p->pBt->pPager;
 7531: }
 7532: 
 7533: #ifndef SQLITE_OMIT_INTEGRITY_CHECK
 7534: /*
 7535: ** Append a message to the error message string.
 7536: */
 7537: static void checkAppendMsg(
 7538:   IntegrityCk *pCheck,
 7539:   char *zMsg1,
 7540:   const char *zFormat,
 7541:   ...
 7542: ){
 7543:   va_list ap;
 7544:   if( !pCheck->mxErr ) return;
 7545:   pCheck->mxErr--;
 7546:   pCheck->nErr++;
 7547:   va_start(ap, zFormat);
 7548:   if( pCheck->errMsg.nChar ){
 7549:     sqlite3StrAccumAppend(&pCheck->errMsg, "\n", 1);
 7550:   }
 7551:   if( zMsg1 ){
 7552:     sqlite3StrAccumAppend(&pCheck->errMsg, zMsg1, -1);
 7553:   }
 7554:   sqlite3VXPrintf(&pCheck->errMsg, 1, zFormat, ap);
 7555:   va_end(ap);
 7556:   if( pCheck->errMsg.mallocFailed ){
 7557:     pCheck->mallocFailed = 1;
 7558:   }
 7559: }
 7560: #endif /* SQLITE_OMIT_INTEGRITY_CHECK */
 7561: 
 7562: #ifndef SQLITE_OMIT_INTEGRITY_CHECK
 7563: /*
 7564: ** Add 1 to the reference count for page iPage.  If this is the second
 7565: ** reference to the page, add an error message to pCheck->zErrMsg.
 7566: ** Return 1 if there are 2 ore more references to the page and 0 if
 7567: ** if this is the first reference to the page.
 7568: **
 7569: ** Also check that the page number is in bounds.
 7570: */
 7571: static int checkRef(IntegrityCk *pCheck, Pgno iPage, char *zContext){
 7572:   if( iPage==0 ) return 1;
 7573:   if( iPage>pCheck->nPage ){
 7574:     checkAppendMsg(pCheck, zContext, "invalid page number %d", iPage);
 7575:     return 1;
 7576:   }
 7577:   if( pCheck->anRef[iPage]==1 ){
 7578:     checkAppendMsg(pCheck, zContext, "2nd reference to page %d", iPage);
 7579:     return 1;
 7580:   }
 7581:   return  (pCheck->anRef[iPage]++)>1;
 7582: }
 7583: 
 7584: #ifndef SQLITE_OMIT_AUTOVACUUM
 7585: /*
 7586: ** Check that the entry in the pointer-map for page iChild maps to 
 7587: ** page iParent, pointer type ptrType. If not, append an error message
 7588: ** to pCheck.
 7589: */
 7590: static void checkPtrmap(
 7591:   IntegrityCk *pCheck,   /* Integrity check context */
 7592:   Pgno iChild,           /* Child page number */
 7593:   u8 eType,              /* Expected pointer map type */
 7594:   Pgno iParent,          /* Expected pointer map parent page number */
 7595:   char *zContext         /* Context description (used for error msg) */
 7596: ){
 7597:   int rc;
 7598:   u8 ePtrmapType;
 7599:   Pgno iPtrmapParent;
 7600: 
 7601:   rc = ptrmapGet(pCheck->pBt, iChild, &ePtrmapType, &iPtrmapParent);
 7602:   if( rc!=SQLITE_OK ){
 7603:     if( rc==SQLITE_NOMEM || rc==SQLITE_IOERR_NOMEM ) pCheck->mallocFailed = 1;
 7604:     checkAppendMsg(pCheck, zContext, "Failed to read ptrmap key=%d", iChild);
 7605:     return;
 7606:   }
 7607: 
 7608:   if( ePtrmapType!=eType || iPtrmapParent!=iParent ){
 7609:     checkAppendMsg(pCheck, zContext, 
 7610:       "Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)", 
 7611:       iChild, eType, iParent, ePtrmapType, iPtrmapParent);
 7612:   }
 7613: }
 7614: #endif
 7615: 
 7616: /*
 7617: ** Check the integrity of the freelist or of an overflow page list.
 7618: ** Verify that the number of pages on the list is N.
 7619: */
 7620: static void checkList(
 7621:   IntegrityCk *pCheck,  /* Integrity checking context */
 7622:   int isFreeList,       /* True for a freelist.  False for overflow page list */
 7623:   int iPage,            /* Page number for first page in the list */
 7624:   int N,                /* Expected number of pages in the list */
 7625:   char *zContext        /* Context for error messages */
 7626: ){
 7627:   int i;
 7628:   int expected = N;
 7629:   int iFirst = iPage;
 7630:   while( N-- > 0 && pCheck->mxErr ){
 7631:     DbPage *pOvflPage;
 7632:     unsigned char *pOvflData;
 7633:     if( iPage<1 ){
 7634:       checkAppendMsg(pCheck, zContext,
 7635:          "%d of %d pages missing from overflow list starting at %d",
 7636:           N+1, expected, iFirst);
 7637:       break;
 7638:     }
 7639:     if( checkRef(pCheck, iPage, zContext) ) break;
 7640:     if( sqlite3PagerGet(pCheck->pPager, (Pgno)iPage, &pOvflPage) ){
 7641:       checkAppendMsg(pCheck, zContext, "failed to get page %d", iPage);
 7642:       break;
 7643:     }
 7644:     pOvflData = (unsigned char *)sqlite3PagerGetData(pOvflPage);
 7645:     if( isFreeList ){
 7646:       int n = get4byte(&pOvflData[4]);
 7647: #ifndef SQLITE_OMIT_AUTOVACUUM
 7648:       if( pCheck->pBt->autoVacuum ){
 7649:         checkPtrmap(pCheck, iPage, PTRMAP_FREEPAGE, 0, zContext);
 7650:       }
 7651: #endif
 7652:       if( n>(int)pCheck->pBt->usableSize/4-2 ){
 7653:         checkAppendMsg(pCheck, zContext,
 7654:            "freelist leaf count too big on page %d", iPage);
 7655:         N--;
 7656:       }else{
 7657:         for(i=0; i<n; i++){
 7658:           Pgno iFreePage = get4byte(&pOvflData[8+i*4]);
 7659: #ifndef SQLITE_OMIT_AUTOVACUUM
 7660:           if( pCheck->pBt->autoVacuum ){
 7661:             checkPtrmap(pCheck, iFreePage, PTRMAP_FREEPAGE, 0, zContext);
 7662:           }
 7663: #endif
 7664:           checkRef(pCheck, iFreePage, zContext);
 7665:         }
 7666:         N -= n;
 7667:       }
 7668:     }
 7669: #ifndef SQLITE_OMIT_AUTOVACUUM
 7670:     else{
 7671:       /* If this database supports auto-vacuum and iPage is not the last
 7672:       ** page in this overflow list, check that the pointer-map entry for
 7673:       ** the following page matches iPage.
 7674:       */
 7675:       if( pCheck->pBt->autoVacuum && N>0 ){
 7676:         i = get4byte(pOvflData);
 7677:         checkPtrmap(pCheck, i, PTRMAP_OVERFLOW2, iPage, zContext);
 7678:       }
 7679:     }
 7680: #endif
 7681:     iPage = get4byte(pOvflData);
 7682:     sqlite3PagerUnref(pOvflPage);
 7683:   }
 7684: }
 7685: #endif /* SQLITE_OMIT_INTEGRITY_CHECK */
 7686: 
 7687: #ifndef SQLITE_OMIT_INTEGRITY_CHECK
 7688: /*
 7689: ** Do various sanity checks on a single page of a tree.  Return
 7690: ** the tree depth.  Root pages return 0.  Parents of root pages
 7691: ** return 1, and so forth.
 7692: ** 
 7693: ** These checks are done:
 7694: **
 7695: **      1.  Make sure that cells and freeblocks do not overlap
 7696: **          but combine to completely cover the page.
 7697: **  NO  2.  Make sure cell keys are in order.
 7698: **  NO  3.  Make sure no key is less than or equal to zLowerBound.
 7699: **  NO  4.  Make sure no key is greater than or equal to zUpperBound.
 7700: **      5.  Check the integrity of overflow pages.
 7701: **      6.  Recursively call checkTreePage on all children.
 7702: **      7.  Verify that the depth of all children is the same.
 7703: **      8.  Make sure this page is at least 33% full or else it is
 7704: **          the root of the tree.
 7705: */
 7706: static int checkTreePage(
 7707:   IntegrityCk *pCheck,  /* Context for the sanity check */
 7708:   int iPage,            /* Page number of the page to check */
 7709:   char *zParentContext, /* Parent context */
 7710:   i64 *pnParentMinKey, 
 7711:   i64 *pnParentMaxKey
 7712: ){
 7713:   MemPage *pPage;
 7714:   int i, rc, depth, d2, pgno, cnt;
 7715:   int hdr, cellStart;
 7716:   int nCell;
 7717:   u8 *data;
 7718:   BtShared *pBt;
 7719:   int usableSize;
 7720:   char zContext[100];
 7721:   char *hit = 0;
 7722:   i64 nMinKey = 0;
 7723:   i64 nMaxKey = 0;
 7724: 
 7725:   sqlite3_snprintf(sizeof(zContext), zContext, "Page %d: ", iPage);
 7726: 
 7727:   /* Check that the page exists
 7728:   */
 7729:   pBt = pCheck->pBt;
 7730:   usableSize = pBt->usableSize;
 7731:   if( iPage==0 ) return 0;
 7732:   if( checkRef(pCheck, iPage, zParentContext) ) return 0;
 7733:   if( (rc = btreeGetPage(pBt, (Pgno)iPage, &pPage, 0))!=0 ){
 7734:     checkAppendMsg(pCheck, zContext,
 7735:        "unable to get the page. error code=%d", rc);
 7736:     return 0;
 7737:   }
 7738: 
 7739:   /* Clear MemPage.isInit to make sure the corruption detection code in
 7740:   ** btreeInitPage() is executed.  */
 7741:   pPage->isInit = 0;
 7742:   if( (rc = btreeInitPage(pPage))!=0 ){
 7743:     assert( rc==SQLITE_CORRUPT );  /* The only possible error from InitPage */
 7744:     checkAppendMsg(pCheck, zContext, 
 7745:                    "btreeInitPage() returns error code %d", rc);
 7746:     releasePage(pPage);
 7747:     return 0;
 7748:   }
 7749: 
 7750:   /* Check out all the cells.
 7751:   */
 7752:   depth = 0;
 7753:   for(i=0; i<pPage->nCell && pCheck->mxErr; i++){
 7754:     u8 *pCell;
 7755:     u32 sz;
 7756:     CellInfo info;
 7757: 
 7758:     /* Check payload overflow pages
 7759:     */
 7760:     sqlite3_snprintf(sizeof(zContext), zContext,
 7761:              "On tree page %d cell %d: ", iPage, i);
 7762:     pCell = findCell(pPage,i);
 7763:     btreeParseCellPtr(pPage, pCell, &info);
 7764:     sz = info.nData;
 7765:     if( !pPage->intKey ) sz += (int)info.nKey;
 7766:     /* For intKey pages, check that the keys are in order.
 7767:     */
 7768:     else if( i==0 ) nMinKey = nMaxKey = info.nKey;
 7769:     else{
 7770:       if( info.nKey <= nMaxKey ){
 7771:         checkAppendMsg(pCheck, zContext, 
 7772:             "Rowid %lld out of order (previous was %lld)", info.nKey, nMaxKey);
 7773:       }
 7774:       nMaxKey = info.nKey;
 7775:     }
 7776:     assert( sz==info.nPayload );
 7777:     if( (sz>info.nLocal) 
 7778:      && (&pCell[info.iOverflow]<=&pPage->aData[pBt->usableSize])
 7779:     ){
 7780:       int nPage = (sz - info.nLocal + usableSize - 5)/(usableSize - 4);
 7781:       Pgno pgnoOvfl = get4byte(&pCell[info.iOverflow]);
 7782: #ifndef SQLITE_OMIT_AUTOVACUUM
 7783:       if( pBt->autoVacuum ){
 7784:         checkPtrmap(pCheck, pgnoOvfl, PTRMAP_OVERFLOW1, iPage, zContext);
 7785:       }
 7786: #endif
 7787:       checkList(pCheck, 0, pgnoOvfl, nPage, zContext);
 7788:     }
 7789: 
 7790:     /* Check sanity of left child page.
 7791:     */
 7792:     if( !pPage->leaf ){
 7793:       pgno = get4byte(pCell);
 7794: #ifndef SQLITE_OMIT_AUTOVACUUM
 7795:       if( pBt->autoVacuum ){
 7796:         checkPtrmap(pCheck, pgno, PTRMAP_BTREE, iPage, zContext);
 7797:       }
 7798: #endif
 7799:       d2 = checkTreePage(pCheck, pgno, zContext, &nMinKey, i==0 ? NULL : &nMaxKey);
 7800:       if( i>0 && d2!=depth ){
 7801:         checkAppendMsg(pCheck, zContext, "Child page depth differs");
 7802:       }
 7803:       depth = d2;
 7804:     }
 7805:   }
 7806: 
 7807:   if( !pPage->leaf ){
 7808:     pgno = get4byte(&pPage->aData[pPage->hdrOffset+8]);
 7809:     sqlite3_snprintf(sizeof(zContext), zContext, 
 7810:                      "On page %d at right child: ", iPage);
 7811: #ifndef SQLITE_OMIT_AUTOVACUUM
 7812:     if( pBt->autoVacuum ){
 7813:       checkPtrmap(pCheck, pgno, PTRMAP_BTREE, iPage, zContext);
 7814:     }
 7815: #endif
 7816:     checkTreePage(pCheck, pgno, zContext, NULL, !pPage->nCell ? NULL : &nMaxKey);
 7817:   }
 7818:  
 7819:   /* For intKey leaf pages, check that the min/max keys are in order
 7820:   ** with any left/parent/right pages.
 7821:   */
 7822:   if( pPage->leaf && pPage->intKey ){
 7823:     /* if we are a left child page */
 7824:     if( pnParentMinKey ){
 7825:       /* if we are the left most child page */
 7826:       if( !pnParentMaxKey ){
 7827:         if( nMaxKey > *pnParentMinKey ){
 7828:           checkAppendMsg(pCheck, zContext, 
 7829:               "Rowid %lld out of order (max larger than parent min of %lld)",
 7830:               nMaxKey, *pnParentMinKey);
 7831:         }
 7832:       }else{
 7833:         if( nMinKey <= *pnParentMinKey ){
 7834:           checkAppendMsg(pCheck, zContext, 
 7835:               "Rowid %lld out of order (min less than parent min of %lld)",
 7836:               nMinKey, *pnParentMinKey);
 7837:         }
 7838:         if( nMaxKey > *pnParentMaxKey ){
 7839:           checkAppendMsg(pCheck, zContext, 
 7840:               "Rowid %lld out of order (max larger than parent max of %lld)",
 7841:               nMaxKey, *pnParentMaxKey);
 7842:         }
 7843:         *pnParentMinKey = nMaxKey;
 7844:       }
 7845:     /* else if we're a right child page */
 7846:     } else if( pnParentMaxKey ){
 7847:       if( nMinKey <= *pnParentMaxKey ){
 7848:         checkAppendMsg(pCheck, zContext, 
 7849:             "Rowid %lld out of order (min less than parent max of %lld)",
 7850:             nMinKey, *pnParentMaxKey);
 7851:       }
 7852:     }
 7853:   }
 7854: 
 7855:   /* Check for complete coverage of the page
 7856:   */
 7857:   data = pPage->aData;
 7858:   hdr = pPage->hdrOffset;
 7859:   hit = sqlite3PageMalloc( pBt->pageSize );
 7860:   if( hit==0 ){
 7861:     pCheck->mallocFailed = 1;
 7862:   }else{
 7863:     int contentOffset = get2byteNotZero(&data[hdr+5]);
 7864:     assert( contentOffset<=usableSize );  /* Enforced by btreeInitPage() */
 7865:     memset(hit+contentOffset, 0, usableSize-contentOffset);
 7866:     memset(hit, 1, contentOffset);
 7867:     nCell = get2byte(&data[hdr+3]);
 7868:     cellStart = hdr + 12 - 4*pPage->leaf;
 7869:     for(i=0; i<nCell; i++){
 7870:       int pc = get2byte(&data[cellStart+i*2]);
 7871:       u32 size = 65536;
 7872:       int j;
 7873:       if( pc<=usableSize-4 ){
 7874:         size = cellSizePtr(pPage, &data[pc]);
 7875:       }
 7876:       if( (int)(pc+size-1)>=usableSize ){
 7877:         checkAppendMsg(pCheck, 0, 
 7878:             "Corruption detected in cell %d on page %d",i,iPage);
 7879:       }else{
 7880:         for(j=pc+size-1; j>=pc; j--) hit[j]++;
 7881:       }
 7882:     }
 7883:     i = get2byte(&data[hdr+1]);
 7884:     while( i>0 ){
 7885:       int size, j;
 7886:       assert( i<=usableSize-4 );     /* Enforced by btreeInitPage() */
 7887:       size = get2byte(&data[i+2]);
 7888:       assert( i+size<=usableSize );  /* Enforced by btreeInitPage() */
 7889:       for(j=i+size-1; j>=i; j--) hit[j]++;
 7890:       j = get2byte(&data[i]);
 7891:       assert( j==0 || j>i+size );  /* Enforced by btreeInitPage() */
 7892:       assert( j<=usableSize-4 );   /* Enforced by btreeInitPage() */
 7893:       i = j;
 7894:     }
 7895:     for(i=cnt=0; i<usableSize; i++){
 7896:       if( hit[i]==0 ){
 7897:         cnt++;
 7898:       }else if( hit[i]>1 ){
 7899:         checkAppendMsg(pCheck, 0,
 7900:           "Multiple uses for byte %d of page %d", i, iPage);
 7901:         break;
 7902:       }
 7903:     }
 7904:     if( cnt!=data[hdr+7] ){
 7905:       checkAppendMsg(pCheck, 0, 
 7906:           "Fragmentation of %d bytes reported as %d on page %d",
 7907:           cnt, data[hdr+7], iPage);
 7908:     }
 7909:   }
 7910:   sqlite3PageFree(hit);
 7911:   releasePage(pPage);
 7912:   return depth+1;
 7913: }
 7914: #endif /* SQLITE_OMIT_INTEGRITY_CHECK */
 7915: 
 7916: #ifndef SQLITE_OMIT_INTEGRITY_CHECK
 7917: /*
 7918: ** This routine does a complete check of the given BTree file.  aRoot[] is
 7919: ** an array of pages numbers were each page number is the root page of
 7920: ** a table.  nRoot is the number of entries in aRoot.
 7921: **
 7922: ** A read-only or read-write transaction must be opened before calling
 7923: ** this function.
 7924: **
 7925: ** Write the number of error seen in *pnErr.  Except for some memory
 7926: ** allocation errors,  an error message held in memory obtained from
 7927: ** malloc is returned if *pnErr is non-zero.  If *pnErr==0 then NULL is
 7928: ** returned.  If a memory allocation error occurs, NULL is returned.
 7929: */
 7930: char *sqlite3BtreeIntegrityCheck(
 7931:   Btree *p,     /* The btree to be checked */
 7932:   int *aRoot,   /* An array of root pages numbers for individual trees */
 7933:   int nRoot,    /* Number of entries in aRoot[] */
 7934:   int mxErr,    /* Stop reporting errors after this many */
 7935:   int *pnErr    /* Write number of errors seen to this variable */
 7936: ){
 7937:   Pgno i;
 7938:   int nRef;
 7939:   IntegrityCk sCheck;
 7940:   BtShared *pBt = p->pBt;
 7941:   char zErr[100];
 7942: 
 7943:   sqlite3BtreeEnter(p);
 7944:   assert( p->inTrans>TRANS_NONE && pBt->inTransaction>TRANS_NONE );
 7945:   nRef = sqlite3PagerRefcount(pBt->pPager);
 7946:   sCheck.pBt = pBt;
 7947:   sCheck.pPager = pBt->pPager;
 7948:   sCheck.nPage = btreePagecount(sCheck.pBt);
 7949:   sCheck.mxErr = mxErr;
 7950:   sCheck.nErr = 0;
 7951:   sCheck.mallocFailed = 0;
 7952:   *pnErr = 0;
 7953:   if( sCheck.nPage==0 ){
 7954:     sqlite3BtreeLeave(p);
 7955:     return 0;
 7956:   }
 7957:   sCheck.anRef = sqlite3Malloc( (sCheck.nPage+1)*sizeof(sCheck.anRef[0]) );
 7958:   if( !sCheck.anRef ){
 7959:     *pnErr = 1;
 7960:     sqlite3BtreeLeave(p);
 7961:     return 0;
 7962:   }
 7963:   for(i=0; i<=sCheck.nPage; i++){ sCheck.anRef[i] = 0; }
 7964:   i = PENDING_BYTE_PAGE(pBt);
 7965:   if( i<=sCheck.nPage ){
 7966:     sCheck.anRef[i] = 1;
 7967:   }
 7968:   sqlite3StrAccumInit(&sCheck.errMsg, zErr, sizeof(zErr), 20000);
 7969:   sCheck.errMsg.useMalloc = 2;
 7970: 
 7971:   /* Check the integrity of the freelist
 7972:   */
 7973:   checkList(&sCheck, 1, get4byte(&pBt->pPage1->aData[32]),
 7974:             get4byte(&pBt->pPage1->aData[36]), "Main freelist: ");
 7975: 
 7976:   /* Check all the tables.
 7977:   */
 7978:   for(i=0; (int)i<nRoot && sCheck.mxErr; i++){
 7979:     if( aRoot[i]==0 ) continue;
 7980: #ifndef SQLITE_OMIT_AUTOVACUUM
 7981:     if( pBt->autoVacuum && aRoot[i]>1 ){
 7982:       checkPtrmap(&sCheck, aRoot[i], PTRMAP_ROOTPAGE, 0, 0);
 7983:     }
 7984: #endif
 7985:     checkTreePage(&sCheck, aRoot[i], "List of tree roots: ", NULL, NULL);
 7986:   }
 7987: 
 7988:   /* Make sure every page in the file is referenced
 7989:   */
 7990:   for(i=1; i<=sCheck.nPage && sCheck.mxErr; i++){
 7991: #ifdef SQLITE_OMIT_AUTOVACUUM
 7992:     if( sCheck.anRef[i]==0 ){
 7993:       checkAppendMsg(&sCheck, 0, "Page %d is never used", i);
 7994:     }
 7995: #else
 7996:     /* If the database supports auto-vacuum, make sure no tables contain
 7997:     ** references to pointer-map pages.
 7998:     */
 7999:     if( sCheck.anRef[i]==0 && 
 8000:        (PTRMAP_PAGENO(pBt, i)!=i || !pBt->autoVacuum) ){
 8001:       checkAppendMsg(&sCheck, 0, "Page %d is never used", i);
 8002:     }
 8003:     if( sCheck.anRef[i]!=0 && 
 8004:        (PTRMAP_PAGENO(pBt, i)==i && pBt->autoVacuum) ){
 8005:       checkAppendMsg(&sCheck, 0, "Pointer map page %d is referenced", i);
 8006:     }
 8007: #endif
 8008:   }
 8009: 
 8010:   /* Make sure this analysis did not leave any unref() pages.
 8011:   ** This is an internal consistency check; an integrity check
 8012:   ** of the integrity check.
 8013:   */
 8014:   if( NEVER(nRef != sqlite3PagerRefcount(pBt->pPager)) ){
 8015:     checkAppendMsg(&sCheck, 0, 
 8016:       "Outstanding page count goes from %d to %d during this analysis",
 8017:       nRef, sqlite3PagerRefcount(pBt->pPager)
 8018:     );
 8019:   }
 8020: 
 8021:   /* Clean  up and report errors.
 8022:   */
 8023:   sqlite3BtreeLeave(p);
 8024:   sqlite3_free(sCheck.anRef);
 8025:   if( sCheck.mallocFailed ){
 8026:     sqlite3StrAccumReset(&sCheck.errMsg);
 8027:     *pnErr = sCheck.nErr+1;
 8028:     return 0;
 8029:   }
 8030:   *pnErr = sCheck.nErr;
 8031:   if( sCheck.nErr==0 ) sqlite3StrAccumReset(&sCheck.errMsg);
 8032:   return sqlite3StrAccumFinish(&sCheck.errMsg);
 8033: }
 8034: #endif /* SQLITE_OMIT_INTEGRITY_CHECK */
 8035: 
 8036: /*
 8037: ** Return the full pathname of the underlying database file.
 8038: **
 8039: ** The pager filename is invariant as long as the pager is
 8040: ** open so it is safe to access without the BtShared mutex.
 8041: */
 8042: const char *sqlite3BtreeGetFilename(Btree *p){
 8043:   assert( p->pBt->pPager!=0 );
 8044:   return sqlite3PagerFilename(p->pBt->pPager);
 8045: }
 8046: 
 8047: /*
 8048: ** Return the pathname of the journal file for this database. The return
 8049: ** value of this routine is the same regardless of whether the journal file
 8050: ** has been created or not.
 8051: **
 8052: ** The pager journal filename is invariant as long as the pager is
 8053: ** open so it is safe to access without the BtShared mutex.
 8054: */
 8055: const char *sqlite3BtreeGetJournalname(Btree *p){
 8056:   assert( p->pBt->pPager!=0 );
 8057:   return sqlite3PagerJournalname(p->pBt->pPager);
 8058: }
 8059: 
 8060: /*
 8061: ** Return non-zero if a transaction is active.
 8062: */
 8063: int sqlite3BtreeIsInTrans(Btree *p){
 8064:   assert( p==0 || sqlite3_mutex_held(p->db->mutex) );
 8065:   return (p && (p->inTrans==TRANS_WRITE));
 8066: }
 8067: 
 8068: #ifndef SQLITE_OMIT_WAL
 8069: /*
 8070: ** Run a checkpoint on the Btree passed as the first argument.
 8071: **
 8072: ** Return SQLITE_LOCKED if this or any other connection has an open 
 8073: ** transaction on the shared-cache the argument Btree is connected to.
 8074: **
 8075: ** Parameter eMode is one of SQLITE_CHECKPOINT_PASSIVE, FULL or RESTART.
 8076: */
 8077: int sqlite3BtreeCheckpoint(Btree *p, int eMode, int *pnLog, int *pnCkpt){
 8078:   int rc = SQLITE_OK;
 8079:   if( p ){
 8080:     BtShared *pBt = p->pBt;
 8081:     sqlite3BtreeEnter(p);
 8082:     if( pBt->inTransaction!=TRANS_NONE ){
 8083:       rc = SQLITE_LOCKED;
 8084:     }else{
 8085:       rc = sqlite3PagerCheckpoint(pBt->pPager, eMode, pnLog, pnCkpt);
 8086:     }
 8087:     sqlite3BtreeLeave(p);
 8088:   }
 8089:   return rc;
 8090: }
 8091: #endif
 8092: 
 8093: /*
 8094: ** Return non-zero if a read (or write) transaction is active.
 8095: */
 8096: int sqlite3BtreeIsInReadTrans(Btree *p){
 8097:   assert( p );
 8098:   assert( sqlite3_mutex_held(p->db->mutex) );
 8099:   return p->inTrans!=TRANS_NONE;
 8100: }
 8101: 
 8102: int sqlite3BtreeIsInBackup(Btree *p){
 8103:   assert( p );
 8104:   assert( sqlite3_mutex_held(p->db->mutex) );
 8105:   return p->nBackup!=0;
 8106: }
 8107: 
 8108: /*
 8109: ** This function returns a pointer to a blob of memory associated with
 8110: ** a single shared-btree. The memory is used by client code for its own
 8111: ** purposes (for example, to store a high-level schema associated with 
 8112: ** the shared-btree). The btree layer manages reference counting issues.
 8113: **
 8114: ** The first time this is called on a shared-btree, nBytes bytes of memory
 8115: ** are allocated, zeroed, and returned to the caller. For each subsequent 
 8116: ** call the nBytes parameter is ignored and a pointer to the same blob
 8117: ** of memory returned. 
 8118: **
 8119: ** If the nBytes parameter is 0 and the blob of memory has not yet been
 8120: ** allocated, a null pointer is returned. If the blob has already been
 8121: ** allocated, it is returned as normal.
 8122: **
 8123: ** Just before the shared-btree is closed, the function passed as the 
 8124: ** xFree argument when the memory allocation was made is invoked on the 
 8125: ** blob of allocated memory. The xFree function should not call sqlite3_free()
 8126: ** on the memory, the btree layer does that.
 8127: */
 8128: void *sqlite3BtreeSchema(Btree *p, int nBytes, void(*xFree)(void *)){
 8129:   BtShared *pBt = p->pBt;
 8130:   sqlite3BtreeEnter(p);
 8131:   if( !pBt->pSchema && nBytes ){
 8132:     pBt->pSchema = sqlite3DbMallocZero(0, nBytes);
 8133:     pBt->xFreeSchema = xFree;
 8134:   }
 8135:   sqlite3BtreeLeave(p);
 8136:   return pBt->pSchema;
 8137: }
 8138: 
 8139: /*
 8140: ** Return SQLITE_LOCKED_SHAREDCACHE if another user of the same shared 
 8141: ** btree as the argument handle holds an exclusive lock on the 
 8142: ** sqlite_master table. Otherwise SQLITE_OK.
 8143: */
 8144: int sqlite3BtreeSchemaLocked(Btree *p){
 8145:   int rc;
 8146:   assert( sqlite3_mutex_held(p->db->mutex) );
 8147:   sqlite3BtreeEnter(p);
 8148:   rc = querySharedCacheTableLock(p, MASTER_ROOT, READ_LOCK);
 8149:   assert( rc==SQLITE_OK || rc==SQLITE_LOCKED_SHAREDCACHE );
 8150:   sqlite3BtreeLeave(p);
 8151:   return rc;
 8152: }
 8153: 
 8154: 
 8155: #ifndef SQLITE_OMIT_SHARED_CACHE
 8156: /*
 8157: ** Obtain a lock on the table whose root page is iTab.  The
 8158: ** lock is a write lock if isWritelock is true or a read lock
 8159: ** if it is false.
 8160: */
 8161: int sqlite3BtreeLockTable(Btree *p, int iTab, u8 isWriteLock){
 8162:   int rc = SQLITE_OK;
 8163:   assert( p->inTrans!=TRANS_NONE );
 8164:   if( p->sharable ){
 8165:     u8 lockType = READ_LOCK + isWriteLock;
 8166:     assert( READ_LOCK+1==WRITE_LOCK );
 8167:     assert( isWriteLock==0 || isWriteLock==1 );
 8168: 
 8169:     sqlite3BtreeEnter(p);
 8170:     rc = querySharedCacheTableLock(p, iTab, lockType);
 8171:     if( rc==SQLITE_OK ){
 8172:       rc = setSharedCacheTableLock(p, iTab, lockType);
 8173:     }
 8174:     sqlite3BtreeLeave(p);
 8175:   }
 8176:   return rc;
 8177: }
 8178: #endif
 8179: 
 8180: #ifndef SQLITE_OMIT_INCRBLOB
 8181: /*
 8182: ** Argument pCsr must be a cursor opened for writing on an 
 8183: ** INTKEY table currently pointing at a valid table entry. 
 8184: ** This function modifies the data stored as part of that entry.
 8185: **
 8186: ** Only the data content may only be modified, it is not possible to 
 8187: ** change the length of the data stored. If this function is called with
 8188: ** parameters that attempt to write past the end of the existing data,
 8189: ** no modifications are made and SQLITE_CORRUPT is returned.
 8190: */
 8191: int sqlite3BtreePutData(BtCursor *pCsr, u32 offset, u32 amt, void *z){
 8192:   int rc;
 8193:   assert( cursorHoldsMutex(pCsr) );
 8194:   assert( sqlite3_mutex_held(pCsr->pBtree->db->mutex) );
 8195:   assert( pCsr->isIncrblobHandle );
 8196: 
 8197:   rc = restoreCursorPosition(pCsr);
 8198:   if( rc!=SQLITE_OK ){
 8199:     return rc;
 8200:   }
 8201:   assert( pCsr->eState!=CURSOR_REQUIRESEEK );
 8202:   if( pCsr->eState!=CURSOR_VALID ){
 8203:     return SQLITE_ABORT;
 8204:   }
 8205: 
 8206:   /* Check some assumptions: 
 8207:   **   (a) the cursor is open for writing,
 8208:   **   (b) there is a read/write transaction open,
 8209:   **   (c) the connection holds a write-lock on the table (if required),
 8210:   **   (d) there are no conflicting read-locks, and
 8211:   **   (e) the cursor points at a valid row of an intKey table.
 8212:   */
 8213:   if( !pCsr->wrFlag ){
 8214:     return SQLITE_READONLY;
 8215:   }
 8216:   assert( (pCsr->pBt->btsFlags & BTS_READ_ONLY)==0
 8217:               && pCsr->pBt->inTransaction==TRANS_WRITE );
 8218:   assert( hasSharedCacheTableLock(pCsr->pBtree, pCsr->pgnoRoot, 0, 2) );
 8219:   assert( !hasReadConflicts(pCsr->pBtree, pCsr->pgnoRoot) );
 8220:   assert( pCsr->apPage[pCsr->iPage]->intKey );
 8221: 
 8222:   return accessPayload(pCsr, offset, amt, (unsigned char *)z, 1);
 8223: }
 8224: 
 8225: /* 
 8226: ** Set a flag on this cursor to cache the locations of pages from the 
 8227: ** overflow list for the current row. This is used by cursors opened
 8228: ** for incremental blob IO only.
 8229: **
 8230: ** This function sets a flag only. The actual page location cache
 8231: ** (stored in BtCursor.aOverflow[]) is allocated and used by function
 8232: ** accessPayload() (the worker function for sqlite3BtreeData() and
 8233: ** sqlite3BtreePutData()).
 8234: */
 8235: void sqlite3BtreeCacheOverflow(BtCursor *pCur){
 8236:   assert( cursorHoldsMutex(pCur) );
 8237:   assert( sqlite3_mutex_held(pCur->pBtree->db->mutex) );
 8238:   invalidateOverflowCache(pCur);
 8239:   pCur->isIncrblobHandle = 1;
 8240: }
 8241: #endif
 8242: 
 8243: /*
 8244: ** Set both the "read version" (single byte at byte offset 18) and 
 8245: ** "write version" (single byte at byte offset 19) fields in the database
 8246: ** header to iVersion.
 8247: */
 8248: int sqlite3BtreeSetVersion(Btree *pBtree, int iVersion){
 8249:   BtShared *pBt = pBtree->pBt;
 8250:   int rc;                         /* Return code */
 8251:  
 8252:   assert( iVersion==1 || iVersion==2 );
 8253: 
 8254:   /* If setting the version fields to 1, do not automatically open the
 8255:   ** WAL connection, even if the version fields are currently set to 2.
 8256:   */
 8257:   pBt->btsFlags &= ~BTS_NO_WAL;
 8258:   if( iVersion==1 ) pBt->btsFlags |= BTS_NO_WAL;
 8259: 
 8260:   rc = sqlite3BtreeBeginTrans(pBtree, 0);
 8261:   if( rc==SQLITE_OK ){
 8262:     u8 *aData = pBt->pPage1->aData;
 8263:     if( aData[18]!=(u8)iVersion || aData[19]!=(u8)iVersion ){
 8264:       rc = sqlite3BtreeBeginTrans(pBtree, 2);
 8265:       if( rc==SQLITE_OK ){
 8266:         rc = sqlite3PagerWrite(pBt->pPage1->pDbPage);
 8267:         if( rc==SQLITE_OK ){
 8268:           aData[18] = (u8)iVersion;
 8269:           aData[19] = (u8)iVersion;
 8270:         }
 8271:       }
 8272:     }
 8273:   }
 8274: 
 8275:   pBt->btsFlags &= ~BTS_NO_WAL;
 8276:   return rc;
 8277: }

FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>