Ensure that the window function rewrite does not leave the parse tree

in an invalid state that might cause problems downstream before the
error is recognized and unwinds the stack.  Also take steps such that
an invalid parse tree does not cause problems even if it goes 
unrecognized.  
[forum:/forumpost/398e9d5aa9|Forum post 398e9d5aa9].

FossilOrigin-Name: 0f9fc6b6073365d5159cd71e7fe08f8dadbc7b42abd324361e809502f4359155

src/window.c

@@ -1099,7 +1099,11 @@ int sqlite3WindowRewrite(Parse *pParse, Select *p){
       sqlite3SelectDelete(db, pSub);
     }
     if( db->mallocFailed ) rc = SQLITE_NOMEM;
-    sqlite3DbFree(db, pTab);
+
+    /* Defer deleting the temporary table pTab because if an error occurred,
+    ** there could still be references to that table embedded in the
+    ** result-set or ORDER BY clause of the SELECT statement p.  */
+    sqlite3ParserAddCleanup(pParse, sqlite3DbFree, pTab);
   }
 
   if( rc ){