Add SQLITE_TESTCTRL_EDITSTMT for making rogue changes to the statement

bytecode, to test the death-cursor error detection mechanism.

FossilOrigin-Name: 58ffd5d97e86693ba669268154e6a28ccedf029abcdd2964635bcd8e5aa37172

manifest

@@ -1,5 +1,5 @@
-C Ensure\ssqlite3expert.c\sunregisters\sany\sSQL\suser-functions\sit\sregisters\swith\sthe\sdatabase\shandle\sbefore\sreturning.
-D 2024-08-08T15:26:11.708
+C Add\sSQLITE_TESTCTRL_EDITSTMT\sfor\smaking\srogue\schanges\sto\sthe\sstatement\nbytecode,\sto\stest\sthe\sdeath-cursor\serror\sdetection\smechanism.
+D 2024-08-09T13:56:12.251
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -710,7 +710,7 @@ F src/date.c 13dd752847afb32ed70510ad7345a5b9c841f51ad904dba5d010f1fa3a6a324e
 F src/dbpage.c 80e46e1df623ec40486da7a5086cb723b0275a6e2a7b01d9f9b5da0f04ba2782
 F src/dbstat.c 3b677254d512fcafd4d0b341bf267b38b235ccfddbef24f9154e19360fa22e43
 F src/delete.c cb766727c78e715f9fb7ec8a7d03658ed2a3016343ca687acfcec9083cdca500
-F src/expr.c fe958028b36af640b70b2174354c044f75b8c4a4645c921592122aa2a022083a
+F src/expr.c 4af62b98b54a1e6a3c16593fb3f253727df28418de292dd1f0ed37f3f0ef80d5
 F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
 F src/fkey.c 852f93c0ef995e0c2b8983059a2b97151c194cc8259e21f5bc2b7ac508348c2a
 F src/func.c 1f61e32e7a357e615b5d2e774bee563761fce4f2fd97ecb0f72c33e62a2ada5f
@@ -723,7 +723,7 @@ F src/insert.c 8ff11e9e54c5fc1fe89707b3d41cf44ad2822f712bd3b5da68338ea42518847e
 F src/json.c 5b6a1d6015997b9ee848a32948720bdb26a0ef2de5a2127ebf7355ce66dbdc0d
 F src/legacy.c d7874bc885906868cd51e6c2156698f2754f02d9eee1bae2d687323c3ca8e5aa
 F src/loadext.c 7432c944ff197046d67a1207790a1b13eec4548c85a9457eb0896bb3641dfb36
-F src/main.c 8a59d297ec77e6b78550433bfccb95a1b26f2fb69aaaf233206e21579a1cfcc1
+F src/main.c 05a2f97a06082640c5000a1d4db0b45e98f602d225a56b17679c8d2c34b05080
 F src/malloc.c 410e570b30c26cc36e3372577df50f7a96ee3eed5b2b161c6b6b48773c650c5e
 F src/mem0.c 6a55ebe57c46ca1a7d98da93aaa07f99f1059645
 F src/mem1.c 3bb59158c38e05f6270e761a9f435bf19827a264c13d1631c58b84bdc96d73b2
@@ -762,7 +762,7 @@ F src/resolve.c 7e8d23ce7cdbfedf351a47e759f2722e8182ca10fd7580be43f4ce1f1a228145
 F src/rowset.c 8432130e6c344b3401a8874c3cb49fefe6873fec593294de077afea2dce5ec97
 F src/select.c 6a95a2bffa6c09584dea99db5a7ae10c813305c09c92920ffc54f6eae2ba399e
 F src/shell.c.in 94571558b0fb28c37a5cf6dbd6ea27285341023a28a8cb5795cd2768fab67704
-F src/sqlite.h.in 1ad9110150773c38ebababbad11b5cb361bcd3997676dec1c91ac5e0416a7b86
+F src/sqlite.h.in d0e60f5c383964321984ef64f282db65a294803f6d9cc8959f5016e076e08e1c
 F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8
 F src/sqlite3ext.h 3f046c04ea3595d6bfda99b781926b17e672fd6d27da2ba6d8d8fc39981dcb54
 F src/sqliteInt.h e3f3b3d80a666a7c5c85b4db102d41ca831c5624f0b3001814479d376f00c19d
@@ -831,11 +831,11 @@ F src/upsert.c 2e60567a0e9e8520c18671b30712a88dc73534474304af94f32bb5f3ef65ac65
 F src/utf.c f23165685a67b4caf8ec08fb274cb3f319103decfb2a980b7cfd55d18dfa855e
 F src/util.c 5d1a0134cf4240648d1c6bb5cc8efaca0ea2b5d5c840985aec7e947271f04375
 F src/vacuum.c 604fcdaebe76f3497c855afcbf91b8fa5046b32de3045bab89cc008d68e40104
-F src/vdbe.c de13de572eccb688b2b7cf50e2f9005c44bf9ae89e35245ef8eadfc60dfd2764
-F src/vdbe.h c2549a215898a390de6669cfa32adba56f0d7e17ba5a7f7b14506d6fd5f0c36a
+F src/vdbe.c 60429733c423a695045ab2dfe3c9dbd97dfd8ea512cb83271fe64be30bc10ba6
+F src/vdbe.h 2087847de3cf8d50120ac29b1d7ed0f8b0dc4fb3801c6a448df8120f37194d8d
 F src/vdbeInt.h 949669dfd8a41550d27dcb905b494f2ccde9a2e6c1b0b04daa1227e2e74c2b2c
 F src/vdbeapi.c 80235ac380e9467fec1cb0883354d841f2a771976e766995f7e0c77f845406df
-F src/vdbeaux.c 25d685cafe119ff890c94345e884ea558a6b5d823bfa52ba708eb8ff3c70aa71
+F src/vdbeaux.c 84b5e691ed6ea4af4ed8bb4206651288ad38e0e2378b9216aa45681dd96adae0
 F src/vdbeblob.c 13f9287b55b6356b4b1845410382d6bede203ceb29ef69388a4a3d007ffacbe5
 F src/vdbemem.c 831a244831eaa45335f9ae276b50a7a82ee10d8c46c2c72492d4eb8c98d94d89
 F src/vdbesort.c d0a3c7056c081703c8b6d91ad60f17da5e062a5c64bf568ed0fa1b5f4cae311f
@@ -846,7 +846,7 @@ F src/vxworks.h d2988f4e5a61a4dfe82c6524dd3d6e4f2ce3cdb9
 F src/wal.c 887fc4ca3f020ebb2e376f222069570834ac63bf50111ef0cbf3ae417048ed89
 F src/wal.h ba252daaa94f889f4b2c17c027e823d9be47ce39da1d3799886bbd51f0490452
 F src/walker.c 7c7ea0115345851c3da4e04e2e239a29983b61fb5b038b94eede6aba462640e2
-F src/where.c 5bbe53db73ae6c8ee34a5eab693a5586ad8ff4f094ff0e524df965b683bec884
+F src/where.c 4d2317e9894d3db396ea8fbd145e4d4cbdd61fc64aa3a0f11796d877e1ebbc9c
 F src/whereInt.h 002adc3aa2cc10733b9b27958fdbe893987cd989fab25a9853941c1f9b9b0a65
 F src/wherecode.c c9cac0b0b8e809c5e7e79d7796918907fb685ad99be2aaa9737f9787aa47349c
 F src/whereexpr.c 7d0d34b42b9edfd8e8ca66beb3a6ef63fe211c001af54caf2ccbcd989b783290
@@ -2204,8 +2204,8 @@ F vsixtest/vsixtest.tcl 6195aba1f12a5e10efc2b8c0009532167be5e301abe5b31385638080
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 797b0a13fd7a42b0a48ecbf0cd1961aa932da3e9c9ccffd903a3a4d963d0cc54
-R 524433c41a8ffc46e95c387bd9dc2975
-U dan
-Z fa7382f01ce16aee65751b978df534e7
+P 8894b243ef533cd3d85afa3f3884e52df8c21ddd6cbb20716389a2ce28f130ab
+R 4cfcb7c3940a4d87692af3d2d3ac5b01
+U drh
+Z c7a3fc75d5a79189317ebfd3f320fe9e
 # Remove this line to create a well-formed Fossil manifest.

manifest.uuid

@@ -1 +1 @@
-123b154ce3b6fee1bbf483704812bd6f8538966f9687520b4470d700f0270719
+58ffd5d97e86693ba669268154e6a28ccedf029abcdd2964635bcd8e5aa37172

src/expr.c

@@ -5439,6 +5439,14 @@ expr_code_doover:
       break;
     }
 #endif
+
+    /* Special opcode used to generate a cursor that raises an
+    ** SQLITE_INTERNAL error if it is every accessed.  Used by the
+    ** sqlite3OpenDeathCursor() routine. */
+    case TK_TABLE: {
+      sqlite3VdbeAddOp3(v, OP_OpenPseudo, pExpr->iTable, -99, 1);
+      break;
+    }
   }
   sqlite3ReleaseTempReg(pParse, regFree1);
   sqlite3ReleaseTempReg(pParse, regFree2);

src/main.c

@@ -4693,6 +4693,30 @@ int sqlite3_test_control(int op, ...){
 #endif
       break;
     }
+
+    /* sqlite3_test_control(SQLITE_TESTCTRL_EDITSTMT, pStmt,iAddr,iField,iVal)
+    **
+    ** Make changes to the bytecode in prepared statement pStmt.  Modify
+    ** instruction iAddr.  iField is 1, 2, or 3 for p1, p2, or p3.  iVal
+    ** is the new value.
+    **
+    ** This operation is used to deliberately corrupt bytecode in order to
+    ** exercise the internal self-checks that prevent crashes due to bugs in
+    ** the query planner and/or code generator.
+    */
+    case SQLITE_TESTCTRL_EDITSTMT: {
+      sqlite3_stmt *p;   /* The prepared statement */
+      int iAddr;         /* Instruction to change */
+      int iField;        /* 1, 2, or 3 for P1, P2, or P3 */
+      int iVal;          /* New value */
+
+      p = va_arg(ap, sqlite3_stmt*);
+      iAddr = va_arg(ap, int);
+      iField = va_arg(ap, int);
+      iVal = va_arg(ap, int);
+      sqlite3VdbeEditStmt(p,iAddr,iField,iVal);
+      break;
+    }
   }
   va_end(ap);
 #endif /* SQLITE_UNTESTABLE */

src/sqlite.h.in

@@ -8330,6 +8330,7 @@ int sqlite3_test_control(int op, ...);
 #define SQLITE_TESTCTRL_JSON_SELFCHECK          14
 #define SQLITE_TESTCTRL_OPTIMIZATIONS           15
 #define SQLITE_TESTCTRL_ISKEYWORD               16  /* NOT USED */
+#define SQLITE_TESTCTRL_EDITSTMT                16
 #define SQLITE_TESTCTRL_SCRATCHMALLOC           17  /* NOT USED */
 #define SQLITE_TESTCTRL_INTERNAL_FUNCTIONS      17
 #define SQLITE_TESTCTRL_LOCALTIME_FAULT         18

src/vdbe.c

@@ -2942,7 +2942,7 @@ case OP_Column: {            /* ncycle */
 op_column_restart:
   assert( pC!=0 );
   assert( p2<(u32)pC->nField
-       || (pC->eCurType==CURTYPE_PSEUDO && pC->seekResult==0) );
+       || (pC->eCurType==CURTYPE_PSEUDO && pC->seekResult<=0) );
   aOffset = pC->aOffset;
   assert( aOffset==pC->aType+pC->nField );
   assert( pC->eCurType!=CURTYPE_VTAB );
@@ -2959,6 +2959,10 @@ op_column_restart:
         assert( memIsValid(pReg) );
         pC->payloadSize = pC->szRow = pReg->n;
         pC->aRow = (u8*)pReg->z;
+      }else if( pC->eCurType==CURTYPE_PSEUDO && pC->seekResult<0 ){
+        rc = SQLITE_INTERNAL;
+        sqlite3VdbeError(p, "bad bytecode");
+        goto abort_due_to_error;
       }else{
         pDest = &aMem[pOp->p3];
         memAboutToChange(p, pDest);

src/vdbe.h

@@ -266,6 +266,7 @@ void sqlite3VdbeSetP4KeyInfo(Parse*, Index*);
 void sqlite3VdbeUsesBtree(Vdbe*, int);
 VdbeOp *sqlite3VdbeGetOp(Vdbe*, int);
 VdbeOp *sqlite3VdbeGetLastOp(Vdbe*);
+void sqlite3VdbeEditStmt(sqlite3_stmt*,int,int,int);
 int sqlite3VdbeMakeLabel(Parse*);
 void sqlite3VdbeRunOnlyOnce(Vdbe*);
 void sqlite3VdbeReusable(Vdbe*);

src/vdbeaux.c

@@ -1706,6 +1706,20 @@ VdbeOp *sqlite3VdbeGetLastOp(Vdbe *p){
   return sqlite3VdbeGetOp(p, p->nOp - 1);
 }
 
+/* Edit the bytecode of a runable prepared statement.  Used to implement
+** SQLITE_TESTCTRL_EDITSTMT.
+*/
+void sqlite3VdbeEditStmt(sqlite3_stmt *p, int iAddr, int iField, int iVal){
+  VdbeOp *pOp = &((Vdbe*)p)->aOp[iAddr];
+  if( iField==1 ){
+    pOp->p1 = iVal;
+  }else if( iField==2 ){
+    pOp->p2 = iVal;
+  }else{
+    pOp->p3 = iVal;
+  }
+}
+
 #if defined(SQLITE_ENABLE_EXPLAIN_COMMENTS)
 /*
 ** Return an integer value for one of the parameters to the opcode pOp

src/where.c

@@ -7078,25 +7078,19 @@ whereBeginError:
   }
 #endif
 
-#ifdef SQLITE_DEBUG
 /*
-** Return true if cursor iCur is opened by instruction k of the
-** bytecode.  Used inside of assert() only.
+** Make arrangements to open cursor number iCur in the startup code of
+** the prepared statement.  If this cursor is every accessed via OP_Cursor,
+** it will cause an SQLITE_INTERNAL error to be raised.
 */
-static int cursorIsOpen(Vdbe *v, int iCur, int k){
-  while( k>=0 ){
-    VdbeOp *pOp = sqlite3VdbeGetOp(v,k--);
-    if( pOp->p1!=iCur ) continue;
-    if( pOp->opcode==OP_Close ) return 0;
-    if( pOp->opcode==OP_OpenRead ) return 1;
-    if( pOp->opcode==OP_OpenWrite ) return 1;
-    if( pOp->opcode==OP_OpenDup ) return 1;
-    if( pOp->opcode==OP_OpenAutoindex ) return 1;
-    if( pOp->opcode==OP_OpenEphemeral ) return 1;
-  }
-  return 0;
+static SQLITE_NOINLINE void sqlite3OpenDeathCursor(Parse *pParse, int iCur){
+  Expr e;
+  memset(&e, 0, sizeof(e));
+  e.op = TK_TABLE;
+  e.iTable = iCur;
+  sqlite3ExprCodeRunJustOnce(pParse, &e, -1);
 }
-#endif /* SQLITE_DEBUG */
+
 
 /*
 ** Generate the end of the WHERE loop.  See comments on
@@ -7376,37 +7370,27 @@ void sqlite3WhereEnd(WhereInfo *pWInfo){
           assert( pIdx->pTable==pTab );
 #ifdef SQLITE_ENABLE_OFFSET_SQL_FUNC
           if( pOp->opcode==OP_Offset ){
-            /* Do not need to translate the column number */
+            x = 0;
           }else
 #endif
-          if( !HasRowid(pTab) ){
-            Index *pPk = sqlite3PrimaryKeyIndex(pTab);
-            x = pPk->aiColumn[x];
-            assert( x>=0 );
-          }else{
-            testcase( x!=sqlite3StorageColumnToTable(pTab,x) );
-            x = sqlite3StorageColumnToTable(pTab,x);
+          {
+            if( !HasRowid(pTab) ){
+              Index *pPk = sqlite3PrimaryKeyIndex(pTab);
+              x = pPk->aiColumn[x];
+              assert( x>=0 );
+            }else{
+              testcase( x!=sqlite3StorageColumnToTable(pTab,x) );
+              x = sqlite3StorageColumnToTable(pTab,x);
+            }
+            x = sqlite3TableColumnToIndex(pIdx, x);
           }
-          x = sqlite3TableColumnToIndex(pIdx, x);
           if( x>=0 ){
             pOp->p2 = x;
             pOp->p1 = pLevel->iIdxCur;
             OpcodeRewriteTrace(db, k, pOp);
-          }else{
-            /* Unable to translate the table reference into an index
-            ** reference.  Verify that this is harmless - that the
-            ** table being referenced really is open.
-            */
-#ifdef SQLITE_ENABLE_OFFSET_SQL_FUNC
-            assert( (pLoop->wsFlags & WHERE_IDX_ONLY)==0
-                 || cursorIsOpen(v,pOp->p1,k)
-                 || pOp->opcode==OP_Offset
-            );
-#else
-            assert( (pLoop->wsFlags & WHERE_IDX_ONLY)==0
-                 || cursorIsOpen(v,pOp->p1,k)
-            );
-#endif
+          }else if( pLoop->wsFlags & WHERE_IDX_ONLY ){
+            OpcodeRewriteTrace(db, k, pOp);
+            sqlite3OpenDeathCursor(pParse, pLevel->iTabCur);
           }
         }else if( pOp->opcode==OP_Rowid ){
           pOp->p1 = pLevel->iIdxCur;