diff --git a/manifest b/manifest
index f8018cc7f5..91444f52b7 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Merge\sthe\spre-3.8.6\schanges\sfrom\strunk\sinto\sthe\sapple-osx\sbranch.
-D 2014-08-14T13:39:49.761
+C Merge\sthe\s3.8.6\schanges\sinto\sthe\sapple-osx\sbranch.
+D 2014-08-15T16:10:41.678
 F Makefile.arm-wince-mingw32ce-gcc d6df77f1f48d690bd73162294bbba7f59507c72f
 F Makefile.in c1a047f376270fb6f201ca44640b43e690bc3db0
 F Makefile.linux-gcc 91d710bdc4998cb015f39edf3cb314ec4f4d7e23
@@ -170,7 +170,7 @@ F src/auth.c 523da7fb4979469955d822ff9298352d6b31de34
 F src/backup.c a729e63cf5cd1829507cb7b8e89f99b95141bb53
 F src/bitvec.c 19a4ba637bd85f8f63fc8c9bae5ade9fb05ec1cb
 F src/btmutex.c 976f45a12e37293e32cae0281b15a21d48a8aaa7
-F src/btree.c cc753a6219d420e15f776905fdbbf8abd8b42e14
+F src/btree.c 7d780ca1211169b7b705a54f666d9c58a75d8e2f
 F src/btree.h 4245a349bfe09611d7ff887dbc3a80cee8b7955a
 F src/btreeInt.h cf180d86b2e9e418f638d65baa425c4c69c0e0e3
 F src/build.c 5abf794fe8a605f2005b422e98a3cedad9b9ef5b
@@ -417,7 +417,7 @@ F test/corruptE.test 193b4ca4e927e77c1d5f4f56203ddc998432a7ee
 F test/corruptF.test be9fde98e4c93648f1ba52b74e5318edc8f59fe4
 F test/corruptG.test 1ab3bf97ee7bdba70e0ff3ba2320657df55d1804
 F test/corruptH.test 88ed71a086e13591c917aac6de32750e7c7281cb
-F test/corruptI.test b3e4203d420490fc3d3062711597bc1dea06a789
+F test/corruptI.test 0afbba50bfae006094cc548b4605f521c1179502
 F test/cost.test 19d314526616ce4473eb4e4e450fcb94499ce318
 F test/count.test 42a251178e32f617eda33f76236a7f79825a50b5
 F test/coveridxscan.test cdb47d01acc4a634a34fd25abe85189e0d0f1e62
@@ -1191,7 +1191,7 @@ F tool/vdbe_profile.tcl 67746953071a9f8f2f668b73fe899074e2c6d8c1
 F tool/warnings-clang.sh f6aa929dc20ef1f856af04a730772f59283631d4
 F tool/warnings.sh 0abfd78ceb09b7f7c27c688c8e3fe93268a13b32
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
-P b2e01080cce405de2bba7a5294001f9cc463a3c4 13a2d90a2869c53b79754de39045bbbdbc7688e3
-R db4ff9fa49b206f34cb01052bc7831eb
+P 08058df3af18d28c3fbd306527734f507c06f156 9491ba7d738528f168657adb43a198238abde19e
+R 25b75c2b2deb7dc6064c599b41cbb415
 U drh
-Z 38e0ab5281238789a23f83493f5517d9
+Z 9f710fff5c282a7578b97b13a967f77e
diff --git a/manifest.uuid b/manifest.uuid
index 8f472c8c1f..ee2f18c66c 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-08058df3af18d28c3fbd306527734f507c06f156
\ No newline at end of file
+b91fcb3b1b6d383e023bd0818a2075018fd33b98
\ No newline at end of file
diff --git a/src/btree.c b/src/btree.c
index 545f4444ed..9554cbd5f8 100644
--- a/src/btree.c
+++ b/src/btree.c
@@ -5768,7 +5768,8 @@ static void insertCell(
   if( *pRC ) return;
 
   assert( i>=0 && i<=pPage->nCell+pPage->nOverflow );
-  assert( pPage->nCell<=MX_CELL(pPage->pBt) && MX_CELL(pPage->pBt)<=10921 );
+  assert( MX_CELL(pPage->pBt)<=10921 );
+  assert( pPage->nCell<=MX_CELL(pPage->pBt) || CORRUPT_DB );
   assert( pPage->nOverflow<=ArraySize(pPage->apOvfl) );
   assert( ArraySize(pPage->apOvfl)==ArraySize(pPage->aiOvfl) );
   assert( sqlite3_mutex_held(pPage->pBt->mutex) );
diff --git a/test/corruptI.test b/test/corruptI.test
index ed34c0f8c3..41200c5409 100644
--- a/test/corruptI.test
+++ b/test/corruptI.test
@@ -75,5 +75,31 @@ do_test 2.2 {
   catchsql { SELECT * FROM r WHERE x >= 10 }
 } {1 {database disk image is malformed}}
 
+reset_db
+
+do_execsql_test 3.1 {
+  PRAGMA page_size = 512;
+  CREATE TABLE t1(a INTEGER PRIMARY KEY, b);
+  WITH s(a, b) AS (
+    SELECT 2, 'abcdefghij'
+    UNION ALL
+    SELECT a+2, b FROM s WHERe a < 40
+  )
+  INSERT INTO t1 SELECT * FROM s;
+} {}
+
+do_test 3.2 {
+  hexio_write test.db [expr 512+3] 0054
+  db close
+  sqlite3 db test.db
+  execsql { INSERT INTO t1 VALUES(5, 'klmnopqrst') }
+  execsql { INSERT INTO t1 VALUES(7, 'klmnopqrst') }
+} {}
+
+db close
+sqlite3 db test.db
+do_catchsql_test 3.2 {
+  INSERT INTO t1 VALUES(9, 'klmnopqrst');
+} {1 {database disk image is malformed}}
 
 finish_test