Fix an obscure b-tree bug that applied to transient trees used for IN(...) expressions. (CVS 3987)

FossilOrigin-Name: 96c7232f8b208cd1c50063f7946bb6dbc386abd6

src/btree.c

@@ -9,7 +9,7 @@
 **    May you share freely, never taking more than you give.
 **
 *************************************************************************
-** $Id: btree.c,v 1.379 2007/05/08 21:45:27 drh Exp $
+** $Id: btree.c,v 1.380 2007/05/12 09:30:47 danielk1977 Exp $
 **
 ** This file implements a external (disk-based) database using BTrees.
 ** See the header comment on "btreeInt.h" for additional information.
@@ -4731,6 +4731,21 @@ static int balance_nonroot(MemPage *pPage){
         pTemp = &aSpace[iSpace];
         iSpace += sz;
         assert( iSpace<=pBt->pageSize*5 );
+        /* Obscure case for non-leaf-data trees: If the cell at pCell was
+        ** previously stored on a leaf node, and it's reported size was 4
+        ** bytes, then it may actually be smaller than this 
+        ** (see sqlite3BtreeParseCellPtr(), 4 bytes is the minimum size of
+        ** any cell). But it's important to pass the correct size to 
+        ** insertCell(), so reparse the cell now.
+        **
+        ** Note that this can never happen in an SQLite data file, as all
+        ** cells are at least 4 bytes. It only happens in b-trees used
+        ** to evaluate "IN (SELECT ...)" and similar clauses.
+        */
+        if( szCell[j]==4 ){
+          assert(leafCorrection==4);
+          sz = cellSizePtr(pParent, pCell);
+        }
       }
       rc = insertCell(pParent, nxDiv, pCell, sz, pTemp, 4);
       if( rc!=SQLITE_OK ) goto balance_cleanup;