diff --git a/ext/fts3/fts3_aux.c b/ext/fts3/fts3_aux.c
index b6e651853b..d3b194c942 100644
--- a/ext/fts3/fts3_aux.c
+++ b/ext/fts3/fts3_aux.c
@@ -297,6 +297,7 @@ static int fts3auxNextMethod(sqlite3_vtab_cursor *pCursor){
     if( fts3auxGrowStatArray(pCsr, 2) ) return SQLITE_NOMEM;
     memset(pCsr->aStat, 0, sizeof(struct Fts3auxColstats) * pCsr->nStat);
     iCol = 0;
+    rc = SQLITE_OK;
 
     while( i<nDoclist ){
       sqlite3_int64 v = 0;
@@ -340,6 +341,10 @@ static int fts3auxNextMethod(sqlite3_vtab_cursor *pCursor){
         /* State 3. The integer just read is a column number. */
         default: assert( eState==3 );
           iCol = (int)v;
+          if( iCol<1 ){
+            rc = SQLITE_CORRUPT_VTAB;
+            break;
+          }
           if( fts3auxGrowStatArray(pCsr, iCol+2) ) return SQLITE_NOMEM;
           pCsr->aStat[iCol+1].nDoc++;
           eState = 2;
@@ -348,7 +353,6 @@ static int fts3auxNextMethod(sqlite3_vtab_cursor *pCursor){
     }
 
     pCsr->iCol = 0;
-    rc = SQLITE_OK;
   }else{
     pCsr->isEof = 1;
   }
diff --git a/ext/misc/json1.c b/ext/misc/json1.c
index 0adf710ef0..7fcd7342a6 100644
--- a/ext/misc/json1.c
+++ b/ext/misc/json1.c
@@ -1662,8 +1662,11 @@ static JsonNode *jsonMergePatch(
           if( pNew==0 ) return 0;
           pTarget = &pParse->aNode[iTarget];
           if( pNew!=&pTarget[j+1] ){
-            assert( pTarget[j+1].eU==0 || pTarget[j+1].eU==1 );
+            assert( pTarget[j+1].eU==0
+                 || pTarget[j+1].eU==1
+                 || pTarget[j+1].eU==2 );
             testcase( pTarget[j+1].eU==1 );
+            testcase( pTarget[j+1].eU==2 );
             VVA( pTarget[j+1].eU = 5 );
             pTarget[j+1].u.pPatch = pNew;
             pTarget[j+1].jnFlags |= JNODE_PATCH;
diff --git a/ext/rtree/rtree.c b/ext/rtree/rtree.c
index cd718073e7..49053a2bcc 100644
--- a/ext/rtree/rtree.c
+++ b/ext/rtree/rtree.c
@@ -1287,20 +1287,29 @@ static void rtreeNonleafConstraint(
   switch( p->op ){
     case RTREE_TRUE:  return;   /* Always satisfied */
     case RTREE_FALSE: break;    /* Never satisfied */
-    case RTREE_LE:
-    case RTREE_LT:
     case RTREE_EQ:
+      RTREE_DECODE_COORD(eInt, pCellData, val);
+      /* val now holds the lower bound of the coordinate pair */
+      if( p->u.rValue>=val ){
+        pCellData += 4;
+        RTREE_DECODE_COORD(eInt, pCellData, val);
+        /* val now holds the upper bound of the coordinate pair */
+        if( p->u.rValue<=val ) return;
+      }
+      break;
+    case RTREE_LE:
+    case RTREE_LT:
       RTREE_DECODE_COORD(eInt, pCellData, val);
       /* val now holds the lower bound of the coordinate pair */
       if( p->u.rValue>=val ) return;
-      if( p->op!=RTREE_EQ ) break;  /* RTREE_LE and RTREE_LT end here */
-      /* Fall through for the RTREE_EQ case */
+      break;
 
-    default: /* RTREE_GT or RTREE_GE,  or fallthrough of RTREE_EQ */
+    default:
       pCellData += 4;
       RTREE_DECODE_COORD(eInt, pCellData, val);
       /* val now holds the upper bound of the coordinate pair */
       if( p->u.rValue<=val ) return;
+      break;
   }
   *peWithin = NOT_WITHIN;
 }
diff --git a/manifest b/manifest
index a8abc2e4d0..7abd8bbfb2 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
 C Merge\srecent\strunk\senhancements\sinto\sthe\sreuse-schema\sbranch.
-D 2021-11-09T14:00:57.967
+D 2021-11-22T16:05:44.148
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -88,7 +88,7 @@ F ext/fts3/README.txt 8c18f41574404623b76917b9da66fcb0ab38328d
 F ext/fts3/fts3.c da41de21622774b1cb8c3415e8d2a6961ad7c978ab534f2a54434f76a5c4dfbc
 F ext/fts3/fts3.h 3a10a0af180d502cecc50df77b1b22df142817fe
 F ext/fts3/fts3Int.h cff59b8b13dafe9d59924a5d710f771ed8b121a55cccbc99b6e2a723fcde14dc
-F ext/fts3/fts3_aux.c 1af58af8f2b00a49f4fb1c2602f8da2054ad60076f46c8ebf85c5410eccccb65
+F ext/fts3/fts3_aux.c f0dc9bd98582615b7750218899bd0c729879b6bbf94d1be57ca1833ff49afc6f
 F ext/fts3/fts3_expr.c 903bfb9433109fffb10e910d7066c49cbf8eeae316adc93f0499c4da7dfc932a
 F ext/fts3/fts3_hash.c 8b6e31bfb0844c27dc6092c2620bdb1fca17ed613072db057d96952c6bdb48b7
 F ext/fts3/fts3_hash.h 39cf6874dc239d6b4e30479b1975fe5b22a3caaf
@@ -307,7 +307,7 @@ F ext/misc/fileio.c 57fefd0efc535e62bb8b07fa146875171481da81a759bbfbe2fc91bab900
 F ext/misc/fossildelta.c 1240b2d3e52eab1d50c160c7fe1902a9bd210e052dc209200a750bbf885402d5
 F ext/misc/fuzzer.c eae560134f66333e9e1ca4c8ffea75df42056e2ce8456734565dbe1c2a92bf3d
 F ext/misc/ieee754.c 91a5594071143a4ab79c638fe9f059af1db09932faf2e704c3e29216a7d4f511
-F ext/misc/json1.c 1ad9d8f04f60f7a7c99e6a22ecf84d8f9bc0881782bed6c3d3a7bc6bf0213e2d
+F ext/misc/json1.c 89a988f06dcb3da0d0af9fdb2b09892452ad12dfd8f432600ee6437a6dcac310
 F ext/misc/memstat.c 3017a0832c645c0f8c773435620d663855f04690172316bd127270d1a7523d4d
 F ext/misc/memtrace.c 7c0d115d2ef716ad0ba632c91e05bd119cb16c1aedf3bec9f06196ead2d5537b
 F ext/misc/memvfs.c 7dffa8cc89c7f2d73da4bd4ccea1bcbd2bd283e3bb4cea398df7c372a197291b
@@ -396,7 +396,7 @@ F ext/repair/test/checkindex01.test b530f141413b587c9eb78ff734de6bb79bc3515c3350
 F ext/repair/test/test.tcl 686d76d888dffd021f64260abf29a55c57b2cedfa7fc69150b42b1d6119aac3c
 F ext/rtree/README 6315c0d73ebf0ec40dedb5aa0e942bc8b54e3761
 F ext/rtree/geopoly.c a7021cb524621573ccda213a35b0339371849dd4acc4909f689786ee1f964b7f
-F ext/rtree/rtree.c a602c5ba860c93a3087ec0c41ad4c4c0c2e9ba2f0008617d4b444200e3b3625d
+F ext/rtree/rtree.c d7b4b8b81d8d54376a7f81de5be85ec58b37c11604bcf42984a8418b34158d93
 F ext/rtree/rtree.h 4a690463901cb5e6127cf05eb8e642f127012fd5003830dbc974eca5802d9412
 F ext/rtree/rtree1.test 35c3bc0def71317b7601ee0d1149e7df2cd8fc4f13ec89a64761ac3f46ca123f
 F ext/rtree/rtree2.test 9d9deddbb16fd0c30c36e6b4fdc3ee3132d765567f0f9432ee71e1303d32603d
@@ -492,7 +492,7 @@ F src/auth.c f4fa91b6a90bbc8e0d0f738aa284551739c9543a367071f55574681e0f24f8cf
 F src/backup.c 3014889fa06e20e6adfa0d07b60097eec1f6e5b06671625f476a714d2356513d
 F src/bitvec.c 7c849aac407230278445cb069bebc5f89bf2ddd87c5ed9459b070a9175707b3d
 F src/btmutex.c 8acc2f464ee76324bf13310df5692a262b801808984c1b79defb2503bbafadb6
-F src/btree.c 2c8a52a7fd84b1aec4a79e7861b6368aecbf011a43247cc7d9a2946c7f0ae5ea
+F src/btree.c 13b965a0f3cd57221e3b4e61e24452ec264a5b163de347b03b5039ddcd95cd54
 F src/btree.h 74d64b8f28cfa4a894d14d4ed64fa432cd697b98b61708d4351482ae15913e22
 F src/btreeInt.h ee9348c4cb9077243b049edc93a82c1f32ca48baeabf2140d41362b9f9139ff7
 F src/build.c 71b0e15334b851cdaa98b5e93028355c4bc136ba3e7eff3cfa4fe1d5b341cff7
@@ -503,7 +503,7 @@ F src/date.c fa928630fecf1d436cdc7a7a5c950c781709023ca782c21b7a43cc7361a9451e
 F src/dbpage.c 8a01e865bf8bc6d7b1844b4314443a6436c07c3efe1d488ed89e81719047833a
 F src/dbstat.c 861e08690fcb0f2ee1165eff0060ea8d4f3e2ea10f80dab7d32ad70443a6ff2d
 F src/delete.c 0c151975fa99560767d7747f9b60543d0093d9f8b89f13d2d6058e9c83ad19e7
-F src/expr.c 5c021ca2495b1e908610276cf5d462133d63ec47863235c8958d36e61841c72d
+F src/expr.c 89c4a225af2ccf5e7f1d53a70170c405036c63cc55130467e013ec9553261cb1
 F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
 F src/fkey.c 187b67af20c5795953a592832c5d985e4313fe503ebd8f95e3e9e9ad5a730bb5
 F src/func.c 1cfb09d7ffca81238eccefdb0293e1f5b7cfebbd1816dfad5ec6024742a7496b
@@ -515,7 +515,7 @@ F src/in-operator.md 10cd8f4bcd225a32518407c2fb2484089112fd71
 F src/insert.c 7fcbbe9114ac402ea3c0c6a3810f13fc89cae8131ea1659ec472be7caac10192
 F src/legacy.c d7874bc885906868cd51e6c2156698f2754f02d9eee1bae2d687323c3ca8e5aa
 F src/loadext.c e1dcff1c916bf6834e150b492eddda5d9792453182d2ad64294d2266b6e93c4c
-F src/main.c 710a7201a26524a23c4cc819cf24bbea9823c8cad15f0c596c172537d5f0c1af
+F src/main.c 6f313292579f47d3cb2168211b56ce8adafb1c99223727de1d540dd55f9adb97
 F src/malloc.c ef796bcc0e81d845d59a469f1cf235056caf9024172fd524e32136e65593647b
 F src/mem0.c 6a55ebe57c46ca1a7d98da93aaa07f99f1059645
 F src/mem1.c c12a42539b1ba105e3707d0e628ad70e611040d8f5e38cf942cee30c867083de
@@ -535,7 +535,7 @@ F src/os.c b1c4f2d485961e9a5b6b648c36687d25047c252222e9660b7cc25a6e1ea436ab
 F src/os.h 26890f540b475598cd9881dcc68931377b8d429d3ea3e2eeb64470cde64199f8
 F src/os_common.h b2f4707a603e36811d9b1a13278bffd757857b85
 F src/os_setup.h 0dbaea40a7d36bf311613d31342e0b99e2536586
-F src/os_unix.c 8e14b40fd02f70e234030c2bee45215ff8835293adc13a08e9718c29bff61401
+F src/os_unix.c f5ad51cfd024116db8531feab9efd831c2621436dca1464e4ff1e8af9bf3252e
 F src/os_win.c 77d39873836f1831a9b0b91894fec45ab0e9ca8e067dc8c549e1d1eca1566fe9
 F src/os_win.h 7b073010f1451abe501be30d12f6bc599824944a
 F src/pager.c bc10c191d18bffd3d76eda5f162799e43a9f875ecfe7c4869f752e2ddef87ea2
@@ -551,16 +551,16 @@ F src/printf.c 5901672228f305f7d493cbc4e7d76a61a5caecdbc1cd06b1f9ec42ea4265cf8d
 F src/random.c 097dc8b31b8fba5a9aca1697aeb9fd82078ec91be734c16bffda620ced7ab83c
 F src/resolve.c 4a1db4aadd802683db40ca2dbbb268187bd195f10cbdb7206dbd8ac988795571
 F src/rowset.c ba9515a922af32abe1f7d39406b9d35730ed65efab9443dc5702693b60854c92
-F src/select.c b4b3a0f32e70d93efbb357783846853dbd8b266ec0d7035aa0a245c33eecf72d
-F src/shell.c.in dffed693f41dbd57e3b45aefc282da8e923766ca622fce19c315f0138f9a24a4
+F src/select.c 187e57a53c747e4d05b5751b133434574e333b512a5c89773d33cac06860f412
+F src/shell.c.in 30a29fca49ec0606a8911abd727c8ecbef9c8f0622e35d4556abc74c83ccc55c
 F src/sqlite.h.in d36a609734942eddefdfbb6e774f8bfa46f00030e1be45a1997f761249ccb339
 F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8
 F src/sqlite3ext.h 8ff2fd2c166150b2e48639f5e506fb44e29f1a3f65031710b9e89d1c126ac839
-F src/sqliteInt.h 12389e23589d5568455962176275866337e9c13cab0af27cc985cce056ee7548
+F src/sqliteInt.h d8f4c1145a67d9353c2f8e1dee50c25cea4f0643142b88b7193b0bd4a3f44e47
 F src/sqliteLimit.h d7323ffea5208c6af2734574bae933ca8ed2ab728083caa117c9738581a31657
 F src/status.c d0956e57c71160155f620a3efeb1e5c05a3f8b9a897dd09c5263268e5d237579
 F src/table.c 0f141b58a16de7e2fbe81c308379e7279f4c6b50eb08efeec5892794a0ba30d1
-F src/tclsqlite.c 78450c0a24bbd9379a8f4827d830e743d5f884389042d6644e4bcba17fdde952
+F src/tclsqlite.c 2291fa6e936c2292c43d8ed590bb0d65195f3f889d4ae0889a2ff3424b9bbc92
 F src/test1.c d6c945a8bb211ed72ea515f0b9743caeaf38c66da6418a7b1dcf3764e1368bbb
 F src/test2.c 3efb99ab7f1fc8d154933e02ae1378bac9637da5
 F src/test3.c 61798bb0d38b915067a8c8e03f5a534b431181f802659a6616f9b4ff7d872644
@@ -616,7 +616,7 @@ F src/test_windirent.h 90dfbe95442c9762357fe128dc7ae3dc199d006de93eb33ba3972e0a9
 F src/test_window.c cdae419fdcea5bad6dcd9368c685abdad6deb59e9fc8b84b153de513d394ba3f
 F src/test_wsd.c 41cadfd9d97fe8e3e4e44f61a4a8ccd6f7ca8fe9
 F src/threads.c 4ae07fa022a3dc7c5beb373cf744a85d3c5c6c3c
-F src/tokenize.c 9495a8272c339a330071d0078a85d1e2f36d1f4c39306495c2b080a2350060e1
+F src/tokenize.c 865911afa00fed589cd03b25c140ca88544842aaef7b81f7d41ed769a7a54120
 F src/treeview.c 9dfdb7ff7f6645d0a6458dbdf4ffac041c071c4533a6db8bb6e502b979ac67bc
 F src/trigger.c 7d65985d48b89af580a6e9a69a4a5033c8dce4fcb9d668d62c4467a621c72ada
 F src/update.c 69c4c10bc6873a80c0a77cb578f9fc60ee90003d03f9530bc3370fa24615772d
@@ -624,12 +624,12 @@ F src/upsert.c 8789047a8f0a601ea42fa0256d1ba3190c13746b6ba940fe2d25643a7e991937
 F src/utf.c ee39565f0843775cc2c81135751ddd93eceb91a673ea2c57f61c76f288b041a0
 F src/util.c 30df8356e231dad33be10bb27897655002668343280004ba28c734489414a167
 F src/vacuum.c 97424abbd3b5831d0142349a3c2dad52c364e39fab67f7e0f5c60d2694463940
-F src/vdbe.c 99eef8f9469a5fb9b3ed8de19b9ec6cd81d950692b2f3fd8b06eef97b176b93b
+F src/vdbe.c 53e94ef84e08c6a6ba13dae99a13dd39a77933b2c3a426cd798b4ec940b6d48c
 F src/vdbe.h bfde0b0f429a0ba4203e5319780a6a1c8b2a809c5cd6baa9ae22e257a657b8b3
 F src/vdbeInt.h 31fbabdc1ed61d9695337dfe5269ea94e1cf615c17f5cafeaa1bb01066820bab
-F src/vdbeapi.c f4bd14b42d9717a35baac5f20c0c4bfccbf3691d64dc6ec02fc0ef19374d3c92
-F src/vdbeaux.c 5b860382346acfc4b1748fa0ec9fd59999f5ed51de7a7e498eeee3bd4bf4cf73
-F src/vdbeblob.c 386d80da191031a1b809004a9983c17ede7e46028d2bc1d7934fbda4762d3567
+F src/vdbeapi.c 22c79072ae7d8a01e9bcae8ba16e918d60d202eaa9553b5fda38f99f7464d99a
+F src/vdbeaux.c 174a5de68ff24caebb26bf904ef396cf38faed7d086b643eac26337e30b7f574
+F src/vdbeblob.c a01a2a6d08a6ba108449d836939df78d5fa1251283939767f64ec60fb29fe919
 F src/vdbemem.c a3d91dc9bb9ef725db77e4e9de7e1acef43192c9f8406c307665d503e3c2837c
 F src/vdbesort.c 513b481c8bab4a6578c92194a60cf3bc3b48736e4a53f8d2d7918121c5b594e7
 F src/vdbetrace.c fe0bc29ebd4e02c8bc5c1945f1d2e6be5927ec12c06d89b03ef2a4def34bf823
@@ -661,6 +661,7 @@ F test/altercol.test b11fa1b131e80ab5b6ecfb3b725fb0419c14ca6efba5adb57aeabfc9baa
 F test/altercorrupt.test 2e1d705342cf9d7de884518ddbb053fd52d7e60d2b8869b7b63b2fda68435c12
 F test/alterdropcol.test a653a3945f964d26845ec0cd0a8e74189f46de3119a984c5bc45457da392612e
 F test/alterdropcol2.test 527fce683b200d620f560f666c44ae33e22728e990a10a48a543280dfd4b4d41
+F test/alterfault.test 2a19a9b8d4e42e2915ea82598341f089c2c16bb55b3f474572c9176eba0b9bc1
 F test/alterlegacy.test f38c6d06cda39e1f7b955bbce57f2e3ef5b7cb566d3d1234502093e228c15811
 F test/altermalloc.test 167a47de41b5c638f5f5c6efb59784002b196fff70f98d9b4ed3cd74a3fb80c9
 F test/altermalloc2.test ca3ebc01670d9313953a2b7628d8cc00dc5ea9988f229b3cbbbe1cca506dae45
@@ -814,7 +815,7 @@ F test/corruptL.test 7d3440831ca24ba64305583c4d4506d417d3f89f5775c0b7cc8102db078
 F test/corruptM.test 7d574320e08c1b36caa3e47262061f186367d593a7e305d35f15289cc2c3e067
 F test/corruptN.test 60b5a62944b4f0029ba07edaa5fd8e670539d6b0a8d99db26c068d435675cbfe
 F test/cost.test b11cdbf9f11ffe8ef99c9881bf390e61fe92baf2182bad1dbe6de59a7295c576
-F test/count.test 5364003488249957750a5f15ee42ca1cd7b100b1131c2dc71fff266a1250bf55
+F test/count.test 013d64569c15563c59472d17ec4ddc681034aaee65e8b01880bc88315fd4c673
 F test/countofview.test e17d6e6688cf74f22783c9ec6e788c0790ee4fbbaee713affd00b1ac0bb39b86
 F test/coveridxscan.test f35c7208dedc4f98e471c569df64c0f95a49f6e072d8dc7c8f99bdee2697de1b
 F test/crash.test fb9dc4a02dcba30d4aa5c2c226f98b220b2b959f
@@ -863,7 +864,7 @@ F test/e_blobclose.test 692fc02a058476c2222a63d97e3f3b2b809c1842e5525ded7f854d54
 F test/e_blobopen.test 29f6055ee453b8e679fe9570c4d3acfedbef821622c5dad16875148c5952ef50
 F test/e_blobwrite.test 3075ff539827576d9a34cbb5a2ac75eb65fb49cd5aadc27686b0719fbf99c156
 F test/e_changes.test 0f8c3e6aab7335cb772d5a3ea34ca4c82f98d0eb896e2eb3add971c16984b405
-F test/e_createtable.test 7997c0106c181243e0ac7db7ba8b9ae7233d0bfb0188605650322a7a02ea326e
+F test/e_createtable.test 04c50b7fe41c12ed9cd88fbbc09b4900bcfc66f98ad198874fc993a2771f3913
 F test/e_delete.test ab39084f26ae1f033c940b70ebdbbd523dc4962e
 F test/e_droptrigger.test 235c610f8bf8ec44513e222b9085c7e49fad65ad0c1975ac2577109dd06fd8fa
 F test/e_dropview.test 74e405df7fa0f762e0c9445b166fe03955856532e2bb234c372f7c51228d75e7
@@ -982,7 +983,7 @@ F test/fts3conf.test c84bbaec81281c1788aa545ac6e78a6bd6cde2bdbbce2da261690e3659f
 F test/fts3corrupt.test 79a32ffdcd5254e2f7fa121d9656e61949ad049c3c6554229911b7ceac37c9c6
 F test/fts3corrupt2.test e318f0676e5e78d5a4b702637e2bb25265954c08a1b1e4aaf93c7880bb0c67d0
 F test/fts3corrupt3.test 0d5b69a0998b4adf868cc301fc78f3d0707745f1d984ce044c205cdb764b491f
-F test/fts3corrupt4.test c0f71af1c5a5b73d66f2ab86be94190ba75576d22a3945fd8edc5aaf35e0b376
+F test/fts3corrupt4.test 799ff994b964fed7201be6b6b62c7ff2ef7bb3da6c02b9eaf0d96a5a4d9b6ca3
 F test/fts3corrupt5.test 0549f85ec4bd22e992f645f13c59b99d652f2f5e643dac75568bfd23a6db7ed5
 F test/fts3corrupt6.test 657b4b8e5791d8d4adc93c90588fb25f1c7346544dd877c6c298a0746749146d
 F test/fts3cov.test 7eacdbefd756cfa4dc2241974e3db2834e9b372ca215880e00032222f32194cf
@@ -1059,7 +1060,7 @@ F test/fuzz3.test 9c813e6613b837cb7a277b0383cd66bfa07042b4cf0317157c35852f30043c
 F test/fuzz4.test c229bcdb45518a89e1d208a21343e061503460ac69fae1539320a89f572eb634
 F test/fuzz_common.tcl b7197de6ed1ee8250a4f82d67876f4561b42ee8cbbfc6160dcb66331bad3f830
 F test/fuzz_malloc.test f348276e732e814802e39f042b1f6da6362a610af73a528d8f76898fde6b22f2
-F test/fuzzcheck.c 7a07718e3c017f31e88b56a891bb79a3eb42a413a811fd65b89a7b09fdd1adbd
+F test/fuzzcheck.c bdb852815048a0beebbe5768bca61e75295324a811a8d7216f97b96501befd1e
 F test/fuzzdata1.db d36e88741b4f23bcbaaf55b006290669d03c6c891cf13c7b3a53bc1b097b693f
 F test/fuzzdata2.db 128b3feeb78918d075c9b14b48610145a0dd4c8d6f1ca7c2870c7e425f5bf31f
 F test/fuzzdata3.db c6586d3e3cef0fbc18108f9bb649aa77bfc38aba
@@ -1067,7 +1068,7 @@ F test/fuzzdata4.db b502c7d5498261715812dd8b3c2005bad08b3a26e6489414bd13926cd3e4
 F test/fuzzdata5.db e35f64af17ec48926481cfaf3b3855e436bd40d1cfe2d59a9474cb4b748a52a5
 F test/fuzzdata6.db 92a80e4afc172c24f662a10a612d188fb272de4a9bd19e017927c95f737de6d7
 F test/fuzzdata7.db 0166b56fd7a6b9636a1d60ef0a060f86ddaecf99400a666bb6e5bbd7199ad1f2
-F test/fuzzdata8.db b0e8db9e34a52e97e6df2101e445e0d9780a1dbd772137de71c5c9def63e3ee0
+F test/fuzzdata8.db ef4d280ee69d6da0ebda7f81c0c66839fa577a97b29cc5790a564fde88be7183
 F test/fuzzer1.test 3d4c4b7e547aba5e5511a2991e3e3d07166cfbb8
 F test/fuzzer2.test a85ef814ce071293bce1ad8dffa217cbbaad4c14
 F test/fuzzerfault.test f64c4aef4c9e9edf1d6dc0d3f1e65dcc81e67c996403c88d14f09b74807a42bc
@@ -1149,7 +1150,7 @@ F test/jrnlmode3.test 556b447a05be0e0963f4311e95ab1632b11c9eaa
 F test/json101.test bb71538005f2d9e18620bdd3b76839a93ca0be61903eb8d751a64e78cf99b8fb
 F test/json102.test eeb54efa221e50b74a2d6fb9259963b48d7414dca3ce2fdfdeed45cb28487bc1
 F test/json103.test aff6b7a4c17d5a20b487a7bc1a274bfdc63b829413bdfb83bedac42ec7f67e3b
-F test/json104.test 317f4ec4b2d87afbba4d2460cf5be297aea76f2285eb618d276dbcd40a50950f
+F test/json104.test 2cb7ff2cca2c8214d3e5260eeb9ce45faec0926f68b3e40c1aaa6ca247284144
 F test/json105.test 45f7d6a9a54c85f8a9589b68d3e7a1f42d02f2359911a8cdbad1f9988f571173
 F test/keyword1.test 37ef6bba5d2ed5b07ecdd6810571de2956599dff
 F test/kvtest.c feb4358fb022da8ebd098c45811f2f6507688bb6c43aa72b3e840df19026317b
@@ -1908,7 +1909,7 @@ F tool/speedtest8.c 2902c46588c40b55661e471d7a86e4dd71a18224
 F tool/speedtest8inst1.c 7ce07da76b5e745783e703a834417d725b7d45fd
 F tool/split-sqlite3c.tcl 3efcd4240b738f6bb2b5af0aea7e1e0ef9bc1c61654f645076cec883030b710c
 F tool/sqldiff.c 9c639de9fa541a947ea9776435c84adf00f43945e262556e15219ef09f0d912c
-F tool/sqlite3_analyzer.c.in 7eeaae8b0d7577662acaabbb11107af0659d1b41bc1dfdd4d91422de27127968
+F tool/sqlite3_analyzer.c.in f88615bf33098945e0a42f17733f472083d150b58bdaaa5555a7129d0a51621c
 F tool/sqltclsh.c.in 1bcc2e9da58fadf17b0bf6a50e68c1159e602ce057210b655d50bad5aaaef898
 F tool/sqltclsh.tcl 862f4cf1418df5e1315b5db3b5ebe88969e2a784525af5fbf9596592f14ed848
 F tool/srcck1.c 371de5363b70154012955544f86fdee8f6e5326f
@@ -1942,7 +1943,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P b1fc3de81e46e13f9bf592e8910a576e7573a700e8eac5be0bc839e7e2be53b6 de10795a1cf70925088e9652998e813665b2e147ffa4a4edab18c7e2c66bf5ae
-R 058652cad19f9053f084d450ec5aa606
+P 748bce4c0172c60737c910c6f5b642259dcd4369b1fb473eb7fc48834fa0fcea 3024d7ca03541a6fe3d264fdc82dd49f8f6b51d2fbeec4dfc9c6dd72806b271a
+R 72dcc784fa86e8a7c60b7403bb3bca0a
 U drh
-Z d504b1e6a671952f46a8108abda21d5c
+Z 14861f156202adc82c4862547a2969a5
diff --git a/manifest.uuid b/manifest.uuid
index f5fd18f77e..d162e476a8 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-748bce4c0172c60737c910c6f5b642259dcd4369b1fb473eb7fc48834fa0fcea
\ No newline at end of file
+d08832cb938a50891963446276d4ada3e73412ba6c316520f7cb8b180ae4f0f5
\ No newline at end of file
diff --git a/src/btree.c b/src/btree.c
index 67611c3bf5..ba35af03f0 100644
--- a/src/btree.c
+++ b/src/btree.c
@@ -1488,7 +1488,7 @@ static int defragmentPage(MemPage *pPage, int nMaxFrag){
           if( iFree2+sz2 > usableSize ) return SQLITE_CORRUPT_PAGE(pPage);
           memmove(&data[iFree+sz+sz2], &data[iFree+sz], iFree2-(iFree+sz));
           sz += sz2;
-        }else if( iFree+sz>usableSize ){
+        }else if( NEVER(iFree+sz>usableSize) ){
           return SQLITE_CORRUPT_PAGE(pPage);
         }
 
@@ -7111,7 +7111,7 @@ static int rebuildPage(
 
   assert( i<iEnd );
   j = get2byte(&aData[hdr+5]);
-  if( j>(u32)usableSize ){ j = 0; }
+  if( NEVER(j>(u32)usableSize) ){ j = 0; }
   memcpy(&pTmp[j], &aData[j], usableSize - j);
 
   for(k=0; pCArray->ixNx[k]<=i && ALWAYS(k<NB*2); k++){}
diff --git a/src/expr.c b/src/expr.c
index 62d2691bc4..e41a4fd4e5 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -2803,7 +2803,8 @@ int sqlite3FindInIndex(
             CollSeq *pReq = sqlite3BinaryCompareCollSeq(pParse, pLhs, pRhs);
             int j;
   
-            assert( pReq!=0 || pRhs->iColumn==XN_ROWID || pParse->nErr );
+            assert( pReq!=0 || pRhs->iColumn==XN_ROWID 
+                   || pParse->nErr || db->mallocFailed );
             for(j=0; j<nExpr; j++){
               if( pIdx->aiColumn[j]!=pRhs->iColumn ) continue;
               assert( pIdx->azColl[j] );
@@ -5468,12 +5469,9 @@ int sqlite3ExprCompare(
     }
     return 2;
   }
-  if( pA->op!=TK_COLUMN
-   && pA->op!=TK_AGG_COLUMN
-   && ALWAYS(!ExprHasProperty(pA, EP_IntValue))
-   && pA->u.zToken
-  ){
-    assert( !ExprHasProperty(pB, EP_IntValue) );
+  assert( !ExprHasProperty(pA, EP_IntValue) );
+  assert( !ExprHasProperty(pB, EP_IntValue) );
+  if( pA->u.zToken ){
     if( pA->op==TK_FUNCTION || pA->op==TK_AGG_FUNCTION ){
       if( sqlite3StrICmp(pA->u.zToken,pB->u.zToken)!=0 ) return 2;
 #ifndef SQLITE_OMIT_WINDOWFUNC
@@ -5491,7 +5489,12 @@ int sqlite3ExprCompare(
       return 0;
     }else if( pA->op==TK_COLLATE ){
       if( sqlite3_stricmp(pA->u.zToken,pB->u.zToken)!=0 ) return 2;
-    }else if( ALWAYS(pB->u.zToken!=0) && strcmp(pA->u.zToken,pB->u.zToken)!=0 ){
+    }else 
+    if( pB->u.zToken!=0
+     && pA->op!=TK_COLUMN
+     && pA->op!=TK_AGG_COLUMN
+     && strcmp(pA->u.zToken,pB->u.zToken)!=0
+    ){
       return 2;
     }
   }
diff --git a/src/main.c b/src/main.c
index d84ecd6da9..cd7a9ebe7c 100644
--- a/src/main.c
+++ b/src/main.c
@@ -1472,7 +1472,7 @@ void sqlite3RollbackAll(sqlite3 *db, int tripCode){
   /* Any deferred constraint violations have now been resolved. */
   db->nDeferredCons = 0;
   db->nDeferredImmCons = 0;
-  db->flags &= ~(u64)SQLITE_DeferFKs;
+  db->flags &= ~(u64)(SQLITE_DeferFKs|SQLITE_CorruptRdOnly);
 
   /* If one has been configured, invoke the rollback-hook callback */
   if( db->xRollbackCallback && (inTrans || !db->autoCommit) ){
diff --git a/src/os_unix.c b/src/os_unix.c
index 0e184af3c1..cd619f5c04 100644
--- a/src/os_unix.c
+++ b/src/os_unix.c
@@ -5798,25 +5798,35 @@ static int fillInUnixFile(
   return rc;
 }
 
+/*
+** Directories to consider for temp files.
+*/
+static const char *azTempDirs[] = {
+  0,
+  0,
+  "/var/tmp",
+  "/usr/tmp",
+  "/tmp",
+  "."
+};
+
+/*
+** Initialize first two members of azTempDirs[] array.
+*/
+static void unixTempFileInit(void){
+  azTempDirs[0] = getenv("SQLITE_TMPDIR");
+  azTempDirs[1] = getenv("TMPDIR");
+}
+
 /*
 ** Return the name of a directory in which to put temporary files.
 ** If no suitable temporary file directory can be found, return NULL.
 */
 static const char *unixTempFileDir(void){
-  static const char *azDirs[] = {
-     0,
-     0,
-     "/var/tmp",
-     "/usr/tmp",
-     "/tmp",
-     "."
-  };
   unsigned int i = 0;
   struct stat buf;
   const char *zDir = sqlite3_temp_directory;
 
-  if( !azDirs[0] ) azDirs[0] = getenv("SQLITE_TMPDIR");
-  if( !azDirs[1] ) azDirs[1] = getenv("TMPDIR");
   while(1){
     if( zDir!=0
      && osStat(zDir, &buf)==0
@@ -5825,8 +5835,8 @@ static const char *unixTempFileDir(void){
     ){
       return zDir;
     }
-    if( i>=sizeof(azDirs)/sizeof(azDirs[0]) ) break;
-    zDir = azDirs[i++];
+    if( i>=sizeof(azTempDirs)/sizeof(azTempDirs[0]) ) break;
+    zDir = azTempDirs[i++];
   }
   return 0;
 }
@@ -8098,6 +8108,9 @@ int sqlite3_os_init(void){
   assert( UNIX_SHM_DMS==128   );  /* Byte offset of the deadman-switch */
 #endif
 
+  /* Initialize temp file dir array. */
+  unixTempFileInit();
+
   return SQLITE_OK; 
 }
 
diff --git a/src/select.c b/src/select.c
index ebb746467d..8067e5bc69 100644
--- a/src/select.c
+++ b/src/select.c
@@ -2209,6 +2209,9 @@ void sqlite3SelectAddColumnTypeAndCollation(
       if( pCol->zCnName ){
         memcpy(&pCol->zCnName[n+1], zType, m+1);
         pCol->colFlags |= COLFLAG_HASTYPE;
+      }else{
+        testcase( pCol->colFlags & COLFLAG_HASTYPE );
+        pCol->colFlags &= ~(COLFLAG_HASTYPE|COLFLAG_HASCOLL);
       }
     }
     if( pCol->affinity<=SQLITE_AFF_NONE ) pCol->affinity = aff;
@@ -4977,6 +4980,7 @@ static Table *isSimpleCount(Select *p, AggInfo *pAggInfo){
   pExpr = p->pEList->a[0].pExpr;
   assert( pExpr!=0 );
   if( pExpr->op!=TK_AGG_FUNCTION ) return 0;
+  if( pExpr->pAggInfo!=pAggInfo ) return 0;
   if( (pAggInfo->aFunc[0].pFunc->funcFlags&SQLITE_FUNC_COUNT)==0 ) return 0;
   assert( pAggInfo->aFunc[0].pFExpr==pExpr );
   testcase( ExprHasProperty(pExpr, EP_Distinct) );
diff --git a/src/shell.c.in b/src/shell.c.in
index 736de0f64a..2b5b64235f 100644
--- a/src/shell.c.in
+++ b/src/shell.c.in
@@ -1763,17 +1763,14 @@ static void output_csv(ShellState *p, const char *z, int bSep){
   if( z==0 ){
     utf8_printf(out,"%s",p->nullValue);
   }else{
-    int i;
-    int nSep = strlen30(p->colSeparator);
+    unsigned i;
     for(i=0; z[i]; i++){
-      if( needCsvQuote[((unsigned char*)z)[i]]
-         || (z[i]==p->colSeparator[0] &&
-             (nSep==1 || memcmp(z, p->colSeparator, nSep)==0)) ){
+      if( needCsvQuote[((unsigned char*)z)[i]] ){
         i = 0;
         break;
       }
     }
-    if( i==0 ){
+    if( i==0 || strstr(z, p->colSeparator)!=0 ){
       char *zQuoted = sqlite3_mprintf("\"%w\"", z);
       utf8_printf(out, "%s", zQuoted);
       sqlite3_free(zQuoted);
diff --git a/src/sqliteInt.h b/src/sqliteInt.h
index dd6016abf6..b1c08f9f67 100644
--- a/src/sqliteInt.h
+++ b/src/sqliteInt.h
@@ -1726,6 +1726,7 @@ struct sqlite3 {
 #define SQLITE_CountRows      HI(0x00001) /* Count rows changed by INSERT, */
                                           /*   DELETE, or UPDATE and return */
                                           /*   the count using a callback. */
+#define SQLITE_CorruptRdOnly  HI(0x00002) /* Prohibit writes due to error */
 
 /* Flags used only if debugging */
 #ifdef SQLITE_DEBUG
@@ -5158,7 +5159,7 @@ const char *sqlite3JournalModename(int);
 # define sqlite3CteDelete(D,C)
 # define sqlite3CteWithAdd(P,W,C) ((void*)0)
 # define sqlite3WithDelete(x,y)
-# define sqlite3WithPush(x,y,z)
+# define sqlite3WithPush(x,y,z) ((void*)0)
 #endif
 #ifndef SQLITE_OMIT_UPSERT
   Upsert *sqlite3UpsertNew(sqlite3*,ExprList*,Expr*,ExprList*,Expr*,Upsert*);
diff --git a/src/tclsqlite.c b/src/tclsqlite.c
index a4ded26945..f1d04a63ac 100644
--- a/src/tclsqlite.c
+++ b/src/tclsqlite.c
@@ -3988,7 +3988,9 @@ static const char *tclsh_main_loop(void){
   return zMainloop;
 }
 
-#define TCLSH_MAIN main   /* Needed to fake out mktclapp */
+#ifndef TCLSH_MAIN
+# define TCLSH_MAIN main
+#endif
 int SQLITE_CDECL TCLSH_MAIN(int argc, char **argv){
   Tcl_Interp *interp;
   int i;
diff --git a/src/tokenize.c b/src/tokenize.c
index 8a7c4019b1..e128d16148 100644
--- a/src/tokenize.c
+++ b/src/tokenize.c
@@ -573,7 +573,7 @@ int sqlite3RunParser(Parse *pParse, const char *zSql, char **pzErrMsg){
   int lastTokenParsed = -1;       /* type of the previous token */
   sqlite3 *db = pParse->db;       /* The database connection */
   int mxSqlLen;                   /* Max length of an SQL string */
-  Parse *pParentParse = db->pParse;
+  Parse *pParentParse = 0;        /* Outer parse context, if any */
 #ifdef sqlite3Parser_ENGINEALWAYSONSTACK
   yyParser sEngine;    /* Space to hold the Lemon-generated Parser object */
 #endif
@@ -609,6 +609,7 @@ int sqlite3RunParser(Parse *pParse, const char *zSql, char **pzErrMsg){
   assert( pParse->pNewTrigger==0 );
   assert( pParse->nVar==0 );
   assert( pParse->pVList==0 );
+  pParentParse = db->pParse;
   db->pParse = pParse;
   while( 1 ){
     n = sqlite3GetToken((u8*)zSql, &tokenType);
diff --git a/src/vdbe.c b/src/vdbe.c
index 36420ec4b6..b9160574ca 100644
--- a/src/vdbe.c
+++ b/src/vdbe.c
@@ -3665,8 +3665,15 @@ case OP_Transaction: {
   assert( pOp->p1>=0 && pOp->p1<db->nDb );
   assert( DbMaskTest(p->btreeMask, pOp->p1) );
   assert( rc==SQLITE_OK );
-  if( pOp->p2 && (db->flags & SQLITE_QueryOnly)!=0 ){
-    rc = SQLITE_READONLY;
+  if( pOp->p2 && (db->flags & (SQLITE_QueryOnly|SQLITE_CorruptRdOnly))!=0 ){
+    if( db->flags & SQLITE_QueryOnly ){
+      /* Writes prohibited by the "PRAGMA query_only=TRUE" statement */
+      rc = SQLITE_READONLY;
+    }else{
+      /* Writes prohibited due to a prior SQLITE_CORRUPT in the current
+      ** transaction */
+      rc = SQLITE_CORRUPT;
+    }
     goto abort_due_to_error;
   }
   pBt = db->aDb[pOp->p1].pBt;
@@ -7735,6 +7742,7 @@ case OP_VFilter: {   /* jump */
   pCur = p->apCsr[pOp->p1];
   assert( memIsValid(pQuery) );
   REGISTER_TRACE(pOp->p3, pQuery);
+  assert( pCur!=0 );
   assert( pCur->eCurType==CURTYPE_VTAB );
   pVCur = pCur->uc.pVCur;
   pVtab = pVCur->pVtab;
@@ -7783,6 +7791,7 @@ case OP_VColumn: {
   sqlite3_context sContext;
 
   VdbeCursor *pCur = p->apCsr[pOp->p1];
+  assert( pCur!=0 );
   assert( pCur->eCurType==CURTYPE_VTAB );
   assert( pOp->p3>0 && pOp->p3<=(p->nMem+1 - p->nCursor) );
   pDest = &aMem[pOp->p3];
@@ -7836,6 +7845,7 @@ case OP_VNext: {   /* jump */
   VdbeCursor *pCur;
 
   pCur = p->apCsr[pOp->p1];
+  assert( pCur!=0 );
   assert( pCur->eCurType==CURTYPE_VTAB );
   if( pCur->nullRow ){
     break;
@@ -7931,7 +7941,7 @@ case OP_VUpdate: {
   const sqlite3_module *pModule;
   int nArg;
   int i;
-  sqlite_int64 rowid;
+  sqlite_int64 rowid = 0;
   Mem **apArg;
   Mem *pX;
 
@@ -8378,7 +8388,14 @@ abort_due_to_error:
   assert( rc );
 #ifdef SQLITE_DEBUG
   if( db->flags & SQLITE_VdbeTrace ){
-     printf("ABORT-due-to-error.  rc=%d\n", rc);
+    const char *zTrace = p->zSql;
+    if( zTrace==0 ){
+      if( aOp[0].opcode==OP_Trace ){
+        zTrace = aOp[0].p4.z;
+      }
+      if( zTrace==0 ) zTrace = "???";
+    }
+    printf("ABORT-due-to-error (rc=%d): %s\n", rc, zTrace);
   }
 #endif
   if( p->zErrMsg==0 && rc!=SQLITE_IOERR_NOMEM ){
@@ -8391,6 +8408,9 @@ abort_due_to_error:
                    (int)(pOp - aOp), p->zSql, p->zErrMsg);
   sqlite3VdbeHalt(p);
   if( rc==SQLITE_IOERR_NOMEM ) sqlite3OomFault(db);
+  if( rc==SQLITE_CORRUPT && db->autoCommit==0 ){
+    db->flags |= SQLITE_CorruptRdOnly;
+  }
   rc = SQLITE_ERROR;
   if( resetSchemaOnFault>0 ){
     sqlite3ResetOneSchema(db, resetSchemaOnFault-1);
diff --git a/src/vdbeapi.c b/src/vdbeapi.c
index 5eeb5d1c0e..17df807de4 100644
--- a/src/vdbeapi.c
+++ b/src/vdbeapi.c
@@ -1850,6 +1850,7 @@ int sqlite3_preupdate_old(sqlite3 *db, int iIdx, sqlite3_value **ppValue){
     u32 nRec;
     u8 *aRec;
 
+    assert( p->pCsr->eCurType==CURTYPE_BTREE );
     nRec = sqlite3BtreePayloadSize(p->pCsr->uc.pCursor);
     aRec = sqlite3DbMallocRaw(db, nRec);
     if( !aRec ) goto preupdate_old_out;
diff --git a/src/vdbeaux.c b/src/vdbeaux.c
index 748501f83a..592b5e64b2 100644
--- a/src/vdbeaux.c
+++ b/src/vdbeaux.c
@@ -3058,9 +3058,15 @@ int sqlite3VdbeHalt(Vdbe *p){
     sqlite3VdbeEnter(p);
 
     /* Check for one of the special errors */
-    mrc = p->rc & 0xff;
-    isSpecialError = mrc==SQLITE_NOMEM || mrc==SQLITE_IOERR
-                     || mrc==SQLITE_INTERRUPT || mrc==SQLITE_FULL;
+    if( p->rc ){
+      mrc = p->rc & 0xff;
+      isSpecialError = mrc==SQLITE_NOMEM
+                    || mrc==SQLITE_IOERR
+                    || mrc==SQLITE_INTERRUPT
+                    || mrc==SQLITE_FULL;
+    }else{
+      mrc = isSpecialError = 0;
+    }
     if( isSpecialError ){
       /* If the query was read-only and the error code is SQLITE_INTERRUPT, 
       ** no rollback is necessary. Otherwise, at least a savepoint 
@@ -3112,6 +3118,9 @@ int sqlite3VdbeHalt(Vdbe *p){
             return SQLITE_ERROR;
           }
           rc = SQLITE_CONSTRAINT_FOREIGNKEY;
+        }else if( db->flags & SQLITE_CorruptRdOnly ){
+          rc = SQLITE_CORRUPT;
+          db->flags &= ~SQLITE_CorruptRdOnly;
         }else{ 
           /* The auto-commit flag is true, the vdbe program was successful 
           ** or hit an 'OR FAIL' constraint and there are no deferred foreign
@@ -5216,6 +5225,8 @@ void sqlite3VdbePreUpdateHook(
     }
   }
 
+  assert( pCsr!=0 );
+  assert( pCsr->eCurType==CURTYPE_BTREE );
   assert( pCsr->nField==pTab->nCol 
        || (pCsr->nField==pTab->nCol+1 && op==SQLITE_DELETE && iReg==-1)
   );
diff --git a/src/vdbeblob.c b/src/vdbeblob.c
index febe6ccbd8..a930f50b00 100644
--- a/src/vdbeblob.c
+++ b/src/vdbeblob.c
@@ -75,7 +75,10 @@ static int blobSeekToRow(Incrblob *p, sqlite3_int64 iRow, char **pzErr){
   }
   if( rc==SQLITE_ROW ){
     VdbeCursor *pC = v->apCsr[0];
-    u32 type = pC->nHdrParsed>p->iCol ? pC->aType[p->iCol] : 0;
+    u32 type;
+    assert( pC!=0 );
+    assert( pC->eCurType==CURTYPE_BTREE );
+    type = pC->nHdrParsed>p->iCol ? pC->aType[p->iCol] : 0;
     testcase( pC->nHdrParsed==p->iCol );
     testcase( pC->nHdrParsed==p->iCol+1 );
     if( type<12 ){
@@ -426,6 +429,8 @@ static int blobReadWrite(
       */
       sqlite3_int64 iKey;
       iKey = sqlite3BtreeIntegerKey(p->pCsr);
+      assert( v->apCsr[0]!=0 );
+      assert( v->apCsr[0]->eCurType==CURTYPE_BTREE );
       sqlite3VdbePreUpdateHook(
           v, v->apCsr[0], SQLITE_DELETE, p->zDb, p->pTab, iKey, -1, p->iCol
       );
diff --git a/test/alterfault.test b/test/alterfault.test
new file mode 100644
index 0000000000..a2a9677c9e
--- /dev/null
+++ b/test/alterfault.test
@@ -0,0 +1,35 @@
+# 2021 November 16
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+# This file implements regression tests for SQLite library.
+#
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+set testprefix alterfault
+
+do_execsql_test 1.0 {
+  CREATE TABLE t1(a);                 
+}
+faultsim_save_and_close
+
+do_faultsim_test 1.1 -faults oom* -prep {
+  faultsim_restore_and_reopen
+} -body {
+  execsql {
+    ALTER TABLE t1 ADD COLUMN b CHECK (a!=1)
+  }
+} -test {
+  faultsim_test_result {0 {}}
+}
+
+
+
+finish_test
diff --git a/test/count.test b/test/count.test
index 9769b765f4..fdcb21e81d 100644
--- a/test/count.test
+++ b/test/count.test
@@ -233,5 +233,16 @@ do_eqp_test count-7.4 {
   `--SCAN t1
 }
 
+do_execsql_test count-8.0 {
+  CREATE TABLE t7(a INT,b TEXT,c BLOB,d REAL);
+  CREATE TABLE t8(a INT,b TEXT,c BLOB,d REAL);
+  CREATE INDEX t8a ON t8(a);
+}
+do_catchsql_test count-8.1 {
+  SELECT * FROM t8 WHERE (a, b) IN (
+      SELECT count(t8.b), count(*) FROM t7 AS ra0 ORDER BY count(*)
+  ) AND t8.b=0; 
+} {1 {misuse of aggregate: count()}}
+
 
 finish_test
diff --git a/test/e_createtable.test b/test/e_createtable.test
index c2cd1bc2c1..fa43d94b54 100644
--- a/test/e_createtable.test
+++ b/test/e_createtable.test
@@ -1272,9 +1272,10 @@ do_createtable_tests 4.4 {
   14   "INSERT INTO t2 VALUES(NULL, NULL)"           {}
 }
 
-# EVIDENCE-OF: R-35113-43214 Unless the column is an INTEGER PRIMARY KEY
-# or the table is a WITHOUT ROWID table or the column is declared NOT
-# NULL, SQLite allows NULL values in a PRIMARY KEY column.
+# EVIDENCE-OF: R-40010-16873 Unless the column is an INTEGER PRIMARY KEY
+# or the table is a WITHOUT ROWID table or a STRICT table or the column
+# is declared NOT NULL, SQLite allows NULL values in a PRIMARY KEY
+# column.
 #
 #     If the column is an integer primary key, attempting to insert a NULL
 #     into the column triggers the auto-increment behavior. Attempting
@@ -1304,6 +1305,14 @@ do_catchsql_test 4.5.5 {
   CREATE TABLE t5(s, u INT PRIMARY KEY NOT NULL, v);
   INSERT INTO t5 VALUES(1, NULL, 2);
 } {1 {NOT NULL constraint failed: t5.u}}
+do_catchsql_test 4.5.6 {
+  CREATE TABLE t6(s INT, u INT PRIMARY KEY, v INT) STRICT;
+  INSERT INTO t6 VALUES(1, NULL, 2);
+} {1 {NOT NULL constraint failed: t6.u}}
+do_catchsql_test 4.5.7 {
+  CREATE TABLE t7(s INT, u INT PRIMARY KEY NOT NULL, v INT) STRICT;
+  INSERT INTO t7 VALUES(1, NULL, 2);
+} {1 {NOT NULL constraint failed: t7.u}}
 
 # EVIDENCE-OF: R-00227-21080 A UNIQUE constraint is similar to a PRIMARY
 # KEY constraint, except that a single table may have any number of
diff --git a/test/fts3corrupt4.test b/test/fts3corrupt4.test
index 41847c5062..f0b83a3901 100644
--- a/test/fts3corrupt4.test
+++ b/test/fts3corrupt4.test
@@ -7031,6 +7031,202 @@ do_catchsql_test 51.1 {
 } {1 {database disk image is malformed}}
 set sqlite_fts3_enable_parentheses $saved
 
+#-------------------------------------------------------------------------
+#
+reset_db
+do_test 52.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+.open --hexdb
+| size 28672 pagesize 4096 filename crash-fd33f4b1c8348b.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 92 00 00 00 07   .....@  ........
+|     32: 00 00 00 00 00 00 00 00 00 00 00 07 00 00 00 04   ................
+|     96: 00 00 00 00 0d 0e ef 00 08 0d 13 00 0f bd 0f 5f   ..............._
+|    112: 0e f7 0e 06 0e bc 0d a4 0d 4d 0d 13 00 00 00 00   .........M......
+|   3344: 00 00 00 38 08 06 17 11 11 08 5f 74 61 62 6c 65   ...8......_table
+|   3360: 74 32 74 32 43 52 45 41 54 45 20 56 49 52 54 55   t2t2CREATE VIRTU
+|   3376: 41 4c 20 54 41 42 4c 45 20 74 32 20 55 53 49 4e   AL TABLE t2 USIN
+|   3392: 47 20 66 74 73 34 61 75 78 28 74 31 29 55 07 07   G fts4aux(t1)U..
+|   3408: 17 1b 1b 01 81 01 74 61 62 6c 65 74 31 5f 73 74   ......tablet1_st
+|   3424: 61 74 74 31 5f 73 74 61 74 07 43 52 45 41 54 45   att1_stat.CREATE
+|   3440: 20 54 41 42 4c 45 20 27 74 31 5f 73 74 61 74 27    TABLE 't1_stat'
+|   3456: 28 69 64 20 49 4e 54 45 47 45 52 20 50 52 49 4d   (id INTEGER PRIM
+|   3472: 41 52 59 20 4b 45 59 2c 20 76 61 6c 75 65 20 42   ARY KEY, value B
+|   3488: 4c 4f 42 29 60 06 07 17 21 21 01 81 0b 74 61 62   LOB)`...!!...tab
+|   3504: 6c 65 74 31 5f 64 6f 63 73 69 7a 65 74 31 5f 64   let1_docsizet1_d
+|   3520: 6f 63 73 69 7a 65 06 43 52 45 41 54 45 20 54 41   ocsize.CREATE TA
+|   3536: 42 4c 45 20 27 74 31 5f 64 6f 63 73 69 7a 65 27   BLE 't1_docsize'
+|   3552: 28 64 6f 63 69 64 20 49 4e 54 45 47 45 52 20 50   (docid INTEGER P
+|   3568: 52 49 4d 41 52 59 20 4b 45 59 2c 20 73 69 7a 65   RIMARY KEY, size
+|   3584: 20 42 4c 4f 42 29 81 33 04 07 17 1f 1f 01 82 35    BLOB).3.......5
+|   3600: 74 61 62 6c 65 74 31 5f 73 65 67 64 69 72 74 31   tablet1_segdirt1
+|   3616: 5f 73 65 67 64 69 72 04 43 52 45 41 54 45 20 54   _segdir.CREATE T
+|   3632: 41 42 4c 45 20 27 74 31 5f 73 65 67 64 69 72 27   ABLE 't1_segdir'
+|   3648: 28 6c 65 76 65 6c 20 49 4e 54 45 47 45 52 2c 69   (level INTEGER,i
+|   3664: 64 78 20 49 4e 64 45 47 45 52 2c 73 74 61 72 74   dx INdEGER,start
+|   3680: 5f 62 6c 6f 63 6b 20 49 4e 54 45 47 45 52 2c 6c   _block INTEGER,l
+|   3696: 65 61 76 65 73 5f 65 6e 64 5f 62 6c 6f 63 6b 20   eaves_end_block 
+|   3712: 49 4e 54 45 47 45 52 2c 65 6e 64 5f 62 6c 6f 63   INTEGER,end_bloc
+|   3728: 6b 20 49 4e 54 45 47 45 52 2c 72 6f 6f 74 20 42   k INTEGER,root B
+|   3744: 4c 4f 42 2c 50 52 49 4d 41 52 59 20 4b 45 59 28   LOB,PRIMARY KEY(
+|   3760: 6c 65 76 65 6c 2c 20 69 64 78 29 29 31 05 06 17   level, idx))1...
+|   3776: 45 1f 01 00 69 6e 64 65 78 73 71 6c 69 74 65 5f   E...indexsqlite_
+|   3792: 61 75 74 6f 69 6e 64 65 78 5f 74 31 5f 73 65 67   autoindex_t1_seg
+|   3808: 64 69 72 5f 31 74 31 5f 73 65 67 64 69 72 05 00   dir_1t1_segdir..
+|   3824: 00 00 08 00 00 00 00 66 03 07 17 23 23 01 81 13   .......f...##...
+|   3840: 74 61 62 6c 65 74 31 5f 73 65 67 6d 65 6e 74 73   tablet1_segments
+|   3856: 74 31 5f 73 65 67 6d 65 6e 74 73 03 43 52 45 41   t1_segments.CREA
+|   3872: 54 45 20 54 41 42 4c 45 20 27 74 31 5f 73 65 67   TE TABLE 't1_seg
+|   3888: 6d 65 6e 74 73 27 28 62 6c 6f 63 6b 69 64 20 49   ments'(blockid I
+|   3904: 4e 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b   NTEGER PRIMARY K
+|   3920: 45 59 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 5c   EY, block BLOB).
+|   3936: 02 07 17 21 21 01 81 03 74 61 62 6c 65 74 31 5f   ...!!...tablet1_
+|   3952: 63 6f 6e 74 65 6e 74 74 31 5f 63 6f 6e 74 65 6e   contentt1_conten
+|   3968: 74 02 43 52 45 41 54 45 20 54 41 42 4c 45 20 27   t.CREATE TABLE '
+|   3984: 74 31 5f 63 6f 6e 74 65 6e 74 27 28 64 6f 63 69   t1_content'(doci
+|   4000: 64 20 49 4e 54 45 47 45 52 e6 50 52 49 4d 41 52   d INTEGER.PRIMAR
+|   4016: 59 20 4b 45 59 2c 20 27 63 30 61 27 29 41 01 06   Y KEY, 'c0a')A..
+|   4032: 17 11 11 08 71 74 61 62 6c 65 74 31 74 31 43 52   ....qtablet1t1CR
+|   4048: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4064: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 34   LE t1 USING fts4
+|   4080: 28 61 2c 70 72 65 66 69 78 3d 27 31 2c 32 27 29   (a,prefix='1,2')
+| page 2 offset 4096
+|      0: 0d 00 00 00 08 0e 22 00 0f c4 0f 00 00 00 00 00   ................
+|   3616: 00 00 42 08 04 00 81 09 73 75 6e 74 20 69 6e 20   ..B.....sunt in 
+|   3632: 63 75 6c 70 61 20 71 75 69 20 6f 66 66 69 63 69   culpa qui offici
+|   3648: 61 20 64 65 73 65 72 75 6e 74 20 6d 6f 6c 6c 69   a deserunt molli
+|   3664: 74 20 61 6e 69 6d 20 69 64 20 65 73 74 20 7c 61   t anim id est |a
+|   3680: 62 6f 72 75 6d 2e 32 07 03 00 6b 45 78 63 65 70   borum.2...kExcep
+|   3696: 74 65 75 72 20 73 69 6e 74 20 6f 63 63 61 65 63   teur sint occaec
+|   3712: 61 74 20 63 75 70 69 64 61 74 61 74 20 6e 6f 6e   at cupidatat non
+|   3728: 20 70 72 6f 69 64 65 6e 74 2c 29 06 03 00 59 63    proident,)...Yc
+|   3744: 69 6c 6c 75 6d 20 64 6f 6c 6f 72 65 20 65 20 66   illum dolore e f
+|   3760: 75 67 69 61 74 20 6e 75 6c 6c 61 20 70 61 72 69   ugiat nulla pari
+|   3776: 61 74 75 72 2e 42 05 04 00 81 09 44 75 69 73 20   atur.B.....Duis 
+|   3792: 61 75 74 65 20 69 72 75 72 65 20 64 6f 6c 6f 72   aute irure dolor
+|   3808: 20 69 6e 20 72 65 60 72 65 68 65 6e 64 65 72 69    in re`rehenderi
+|   3824: 74 20 69 6e 20 76 70 6c 75 70 74 61 74 65 20 76   t in vpluptate v
+|   3840: 65 6c 69 72 c0 65 73 73 65 29 04 03 00 59 6e 69   elir.esse)...Yni
+|   3856: 73 6a 20 75 74 20 61 6c 69 71 75 69 70 20 65 20   sj ut aliquip e 
+|   3872: 65 20 63 6f 6d 6d 6f 64 6f 20 63 6f 6e 73 65 71   e commodo conseq
+|   3888: 75 61 74 2e 46 03 04 00 29 11 55 74 20 65 6e 69   uat.F...).Ut eni
+|   3904: 6d 20 61 64 20 6d 69 6e 69 6d 20 76 65 6e 69 61   m ad minim venia
+|   3920: 6d 2c 20 71 75 69 73 20 6e 6f 73 74 72 75 64 20   m, quis nostrud 
+|   3936: 65 78 65 72 63 69 7a 71 74 69 6f 6e 20 75 6c 6c   exercizqtion ull
+|   3952: 61 6d 63 6f 20 6c 61 62 6f 72 69 73 46 02 04 00   amco laborisF...
+|   3968: 81 11 73 65 64 20 64 6f 20 65 69 75 73 6d 6f 64   ..sed do eiusmod
+|   3984: 20 74 65 6d 70 6f 72 20 69 6e 63 69 64 69 64 75    tempor incididu
+|   4000: 6e 74 20 75 74 20 6c 61 62 6f 72 65 20 65 74 20   nt ut labore et 
+|   4016: 64 6f 6c 6f 72 65 20 6d 61 67 6e 61 20 61 6c 69   dolore magna ali
+|   4032: 71 75 61 2e 3a 01 03 00 7b 4c 6f 72 65 6d 20 69   qua.:....Lorem i
+|   4048: 72 63 75 6d 20 64 6f 6c 6f 72 20 73 69 74 20 61   rcum dolor sit a
+|   4064: 6d 65 74 2c 20 63 6f 6e 78 65 63 74 65 64 75 72   met, conxectedur
+|   4080: 20 61 64 69 70 69 73 00 00 00 00 00 00 00 00 00    adipis.........
+| page 4 offset 12288
+|      0: 0d 00 00 00 03 0a c1 00 0d 61 0c 54 0a c1 00 00   .........a.T....
+|   2752: 00 83 10 03 08 02 08 08 08 17 86 0e 08 00 30 20   ..............0 
+|   2768: 33 38 35 00 02 61 64 06 01 08 00 02 04 00 01 01   385..ad.........
+|   2784: 6c 06 02 0c 00 02 04 00 01 01 6d 03 01 06 10 01   l.........m.....
+|   2800: 01 6e 03 08 09 00 01 01 75 03 05 03 00 00 02 63   .n......u......c
+|   2816: 69 03 06 02 00 01 01 6f 07 01 07 00 03 07 03 00   i......o........
+|   2832: 01 01 75 06 75 05 00 01 04 00 00 02 64 65 03 08   ..u.u.......de..
+|   2848: 07 00 01 01 6f 0d 01 04 00 01 03 09 00 03 05 00   ....o...........
+|   2864: 01 03 00 01 01 75 03 05 02 00 00 02 65 69 03 02   .....u......ei..
+|   2880: 04 00 01 01 6c 03 01 44 00 01 01 6e 03 03 03 00   ....l..D...n....
+|   2896: 01 01 73 06 05 0b 00 03 0b 00 01 01 74 03 02 09   ..s.........t...
+|   2912: 00 01 01 78 06 03 09 00 04 02 00 00 02 66 75 03   ...x.........fu.
+|   2928: 06 05 00 00 02 69 64 03 08 0a 00 01 01 6e 0a 02   .....id......n..
+|   2944: 06 00 03 06 04 00 03 03 00 01 01 70 03 01 03 00   ...........p....
+|   2960: 01 01 72 03 05 04 00 00 02 6c 61 09 02 08 00 01   ..r......la.....
+|   2976: 0b 00 05 0c 00 01 01 6f 03 01 02 00 00 02 6d 61   .......o......ma
+|   2992: 03 02 0b 00 01 01 69 03 03 05 00 01 01 6f 03 08   ......i......o..
+|   3008: 08 00 00 02 6e 69 03 04 02 00 01 01 6f 06 03 08   ....ni......o...
+|   3024: 00 04 06 00 01 01 75 03 06 06 00 00 02 6f 63 03   ......u......oc.
+|   3040: 07 04 00 01 01 66 03 08 06 00 00 02 70 61 03 06   .....f......pa..
+|   3056: 07 00 01 11 72 03 07 07 00 00 02 71 75 06 03 07   ....r......qu...
+|   3072: 00 05 05 00 00 02 72 65 03 05 07 00 00 02 73 65   ......re......se
+|   3088: 03 02 02 00 01 01 69 06 01 05 00 06 03 00 01 01   ......i.........
+|   3104: 75 03 08 02 00 00 02 74 65 03 02 05 00 00 02 75   u......te......u
+|   3120: 6c 13 03 0a 00 01 01 74 09 02 07 00 01 02 00 01   l......t........
+|   3136: 02 ff ff 02 76 65 06 03 06 00 02 0a 00 01 01 6f   ....ve.........o
+|   3152: 03 05 09 00 82 0a 02 08 02 08 08 08 17 84 02 04   ................
+|   3168: 00 30 20 32 35 31 00 01 61 13 01 06 04 00 01 0c   .0 251..a.......
+|   3184: 00 01 04 00 01 04 00 01 03 00 03 09 00 00 01 63   ...............c
+|   3200: 10 01 07 00 03 07 03 00 02 02 00 01 05 00 01 04   ................
+|   3216: 00 00 01 64 11 01 04 00 01 03 09 00 03 02 05 00   ...d............
+|   3232: 01 03 00 02 07 00 00 01 65 1b 01 09 00 01 04 07   ........e.......
+|   3248: 00 01 03 08 00 01 05 03 00 01 1c eb 01 04 00 01   ................
+|   3264: 0e 80 01 0b 00 00 01 66 03 06 05 00 00 01 69 0f   .......f......i.
+|   3280: 01 03 00 01 06 0b 23 04 04 04 00 03 03 09 00 00   ......#.........
+|   3296: 01 6c 0c 01 02 00 01 08 00 01 0b 00 05 0c 00 00   .l..............
+|   3312: 01 6d 09 02 0b 00 01 05 00 05 08 00 00 01 6e 0c   .m............n.
+|   3328: 03 08 00 01 02 00 02 06 00 01 06 00 00 01 6f 06   ..............o.
+|   3344: 07 04 00 01 06 00 00 01 70 06 06 07 00 01 07 00   ........p.......
+|   3360: 00 01 71 06 03 07 00 05 05 00 00 01 72 03 05 07   ..q.........r...
+|   3376: 00 00 02 73 0c 01 05 00 01 02 00 05 03 00 01 02   ...s............
+|   3392: 00 00 01 74 03 02 05 00 00 01 75 0a 02 07 00 01   ...t......u.....
+|   3408: 02 0a 00 01 03 00 00 01 76 07 03 06 00 02 09 03   ........v.......
+|   3424: 00 85 1c 01 08 08 08 08 08 17 8a 2a 30 20 36 35   ...........*0 65
+|   3440: 35 00 02 61 64 03 03 04 00 02 08 69 70 69 73 63   5..ad......ipisc
+|   3456: 69 6e 67 03 01 08 00 01 05 6c 69 71 75 61 03 02   ing......liqua..
+|   3472: 0c 00 05 02 69 70 03 04 04 00 01 03 6d 65 74 03   ....ip......met.
+|   3488: 01 06 00 01 03 6e 69 6d 03 08 09 00 01 03 75 74   .....nim......ut
+|   3504: 65 03 05 03 00 00 06 63 69 6c 6c 75 6d 03 06 02   e......cillum...
+|   3520: 00 01 06 6f 6d 6d 6f 64 6f 03 04 07 00 02 09 6e   ...ommodo......n
+|   3536: 73 65 63 74 65 74 75 72 03 01 07 00 05 04 71 75   sectetur......qu
+|   3552: 61 73 03 04 08 00 01 04 75 6c 70 61 03 08 04 00   as......ulpa....
+|   3568: 02 07 70 69 64 61 74 61 74 03 07 05 00 00 08 64   ..pidatat......d
+|   3584: 65 73 65 72 75 6e 74 03 08 07 00 01 01 6f 03 09   eserunt......o..
+|   3600: b3 00 02 03 6c 6f 72 06 01 04 00 04 05 00 05 01   ....lor.........
+|   3616: 65 06 02 0a 00 04 03 00 01 03 75 69 73 03 05 02   e.........uis...
+|   3632: 00 00 01 65 07 04 05 03 00 02 04 00 01 06 69 75   ...e..........iu
+|   3648: 73 6d 6f 64 03 02 04 00 01 03 6c 69 74 03 01 09   smod......lit...
+|   3664: 00 01 03 6e 69 6d 03 03 03 00 01 03 73 73 65 03   ...nim......sse.
+|   3680: 05 0b 00 02 01 74 03 08 0b 00 01 01 74 03 02 09   .....t......t...
+|   3696: 00 01 08 78 63 65 70 64 65 75 72 03 07 02 00 02   ...xcepdeur.....
+|   3712: 0a 65 72 63 69 74 61 74 69 6f 6e 03 03 09 00 00   .ercitation.....
+|   3728: 06 66 75 67 69 61 74 03 06 05 00 00 02 69 64 03   .fugiat......id.
+|   3744: 08 0a 00 01 01 6e 07 05 06 04 00 03 03 00 02 08   .....n..........
+|   3760: 63 69 64 69 64 75 6e 74 03 02 06 00 01 04 70 73   cididunt......ps
+|   3776: 75 6c f3 01 03 00 01 04 72 75 72 65 03 05 04 00   ul......rure....
+|   3792: 00 06 6c 61 62 6f 72 65 03 02 08 00 05 02 69 73   ..labore......is
+|   3808: 03 03 0b 00 05 02 75 6d 03 08 0c 00 01 04 6f 72   ......um......or
+|   3824: 65 6d 03 01 02 00 00 05 6d 61 67 6e 61 03 02 0b   em......magna...
+|   3840: 00 01 04 69 6e 69 6d 03 03 05 00 01 05 6f 6c 6c   ...inim......oll
+|   3856: 69 74 03 08 08 00 00 04 6e 69 73 69 03 04 02 00   it......nisi....
+|   3872: 01 02 6f 6e 03 07 06 00 02 05 73 74 72 75 64 03   ..on......strud.
+|   3888: 03 08 00 01 04 75 6c 6c 61 03 06 06 00 00 08 6f   .....ulla......o
+|   3904: 63 63 61 65 63 61 74 03 07 04 00 01 06 66 66 69   ccaecat......ffi
+|   3920: 63 69 61 03 08 06 00 00 08 70 61 72 69 61 74 75   cia......pariatu
+|   3936: 72 03 06 07 00 01 07 72 6f 69 64 65 6e 74 03 07   r......roident..
+|   3952: 07 00 00 03 71 75 69 03 08 15 00 03 01 73 03 03   ....qui......s..
+|   3968: 07 00 00 0d 72 65 70 72 65 68 65 6e 64 65 72 69   ....reprehenderi
+|   3984: 74 03 05 07 00 00 03 73 65 64 03 02 01 ff ff f0   t......sed......
+|   4000: b9 6e 74 03 07 03 00 02 01 74 03 01 05 00 01 03   .nt......t......
+|   4016: 75 6e 74 03 08 02 00 00 06 74 65 6d 70 6f 72 03   unt......tempor.
+|   4032: 02 05 00 00 07 75 6c 6c 61 6d 63 6f 03 03 0a 00   .....ullamco....
+|   4048: 01 01 74 09 02 07 00 01 02 00 01 03 00 00 05 76   ..t............v
+|   4064: 65 6c 69 74 03 05 0a 00 02 04 6e 69 61 6d 03 03   elit......niam..
+|   4080: 06 00 01 08 6f 6c 75 70 74 61 74 65 03 05 09 00   ....oluptate....
+| page 5 offset 16384
+|      0: 0a 00 00 00 03 0f eb 00 0f fb 0f f3 00 00 00 00   ................
+|   4064: 00 00 00 00 00 00 00 00 00 00 00 07 04 02 08 01   ................
+|   4080: 08 00 03 07 04 02 08 01 04 00 02 04 04 08 08 09   ................
+| page 6 offset 20480
+|      0: 0d 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00   ................
+|   4048: 04 08 03 00 0e 0b 04 07 03 00 0e 06 04 06 03 00   ................
+|   4064: 0e 06 04 05 03 00 0e 0a 04 04 03 00 0e 07 04 03   ................
+|   4080: 03 00 0d fa 04 02 03 00 0e 0b 04 00 00 00 00 00   ................
+| page 7 offset 24576
+|   4080: 00 00 00 00 00 00 00 07 00 03 00 00 00 00 00 00   ................
+| end crash-fd33f4b1c8348b.db
+}]} {}
+
+do_catchsql_test 52.1 {
+  SELECT * FROM t1, t2;
+} {1 {database disk image is malformed}}
 
 
 finish_test
diff --git a/test/fuzzcheck.c b/test/fuzzcheck.c
index b8b0fee460..f5a7b092e3 100644
--- a/test/fuzzcheck.c
+++ b/test/fuzzcheck.c
@@ -843,7 +843,7 @@ static int block_troublesome_sql(
   (void)zArg4;
   if( eCode==SQLITE_PRAGMA ){
     if( sqlite3_stricmp("busy_timeout",zArg1)==0
-     && (zArg2==0 || strtoll(zArg2,0,0)>100)
+     && (zArg2==0 || strtoll(zArg2,0,0)>100 || strtoll(zArg2,0,10)>100)
     ){
       return SQLITE_DENY;
     }else if( eVerbosity==0 ){
diff --git a/test/fuzzdata8.db b/test/fuzzdata8.db
index 514bffd085..966b73730c 100644
Binary files a/test/fuzzdata8.db and b/test/fuzzdata8.db differ
diff --git a/test/json104.test b/test/json104.test
index e56e7edeff..8d95e60140 100644
--- a/test/json104.test
+++ b/test/json104.test
@@ -125,6 +125,9 @@ do_execsql_test json104-313 {
 do_execsql_test json104-314 {
   SELECT json_patch('{}','{"a":{"bb":{"ccc":null}}}');
 } {{{"a":{"bb":{}}}}}
+do_execsql_test json104-320 {
+  SELECT json_patch('{"x":{"one":1}}','{"x":{"two":2},"x":"three"}');
+} {{{"x":"three"}}}
 
 #-------------------------------------------------------------------------
 
diff --git a/tool/sqlite3_analyzer.c.in b/tool/sqlite3_analyzer.c.in
index e830521e08..d8b000209f 100644
--- a/tool/sqlite3_analyzer.c.in
+++ b/tool/sqlite3_analyzer.c.in
@@ -14,7 +14,7 @@
 #define SQLITE_DEFAULT_MEMSTATUS 0
 #define SQLITE_MAX_EXPR_DEPTH 0
 #define SQLITE_OMIT_LOAD_EXTENSION 1
-#ifndef USE_EXTERNAL_SQLITE
+#if !defined(SQLITE_AMALGAMATION) && !defined(USE_EXTERNAL_SQLITE)
 INCLUDE sqlite3.c
 #endif
 INCLUDE $ROOT/src/tclsqlite.c