Fix a segfault caused by invoking a regular aggregate as a window-function.

And some problems with count(*) when used as a window-function.

FossilOrigin-Name: 4f3c8a82fd1c5b14d84f2301e34cfc8d52fe4b3a60840c39e895c11f2da529d9

manifest

@@ -1,5 +1,5 @@
-C Quick\spatch\sto\sthe\sLemon\sparser\stemplate\sto\savoid\san\sarray\soverread\sreported\nby\sOSSFuzz.\s\sA\sproper\sfix\sinvolves\senhancements\sto\sthe\stable\sgenerators\sin\nLemon\sto\smake\sthe\soverread\simpossible.\s\sThat\sfix\swill\stake\slonger\sto\nimplement.\s\sThe\scurrent\scheck-in\sis\sa\sstop-gap.
+C Fix\sa\ssegfault\scaused\sby\sinvoking\sa\sregular\saggregate\sas\sa\swindow-function.\nAnd\ssome\sproblems\swith\scount(*)\swhen\sused\sas\sa\swindow-function.
-D 2018-07-01T16:05:40.758
+D 2018-07-02T12:07:32.352
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F Makefile.in 0a3a6c81e6fcb969ff9106e882f0a08547014ba463cb6beca4c4efaecc924ee6
@@ -450,7 +450,7 @@ F src/delete.c 4c8c7604277a2041647f96b78f4b9a47858e9217e4fb333d35e7b5ab32c5b57f
 F src/expr.c 7e257eeffe9553c10a6ac0a1f0177bf740c4da834e7d6e2cbb7d3ebaa3d7f3e1
 F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
 F src/fkey.c b1da9ef8dc834603bb0d28972378a7ce65897847f9a1e89ab800bbdf24c788ee
-F src/func.c d2c66d8ec930d53e9ecd0d6cbe210c1a70f0427bfc49624516fb97aae2f5cfe8
+F src/func.c 4d573e690757f29674db05d7b29c1a27886157fd2b71fcb94c68141c0eb52cfb
 F src/global.c 9bf034fd560bdd514715170ed8460bb7f823cec113f0569ef3f18a20c7ccd128
 F src/hash.c a12580e143f10301ed5166ea4964ae2853d3905a511d4e0c44497245c7ce1f7a
 F src/hash.h ab34c5c54a9e9de2e790b24349ba5aab3dbb4fd4
@@ -493,7 +493,7 @@ F src/pragma.h bb83728944b42f6d409c77f5838a8edbdb0fe83046c5496ffc9602b40340a324
 F src/prepare.c e966ecc97c3671ff0e96227c8c877b83f2d33ea371ee190bbf1698b36b5605c0
 F src/printf.c 7f6f3cba8e0c49c19e30a1ff4e9aeda6e06814dcbad4b664a69e1b6cb6e7e365
 F src/random.c 80f5d666f23feb3e6665a6ce04c7197212a88384
-F src/resolve.c d8359c59c683fc33324c3a0abe0d393304861f05dd2e0d47e5974a501bcf4682
+F src/resolve.c f2f5533afd25cef8fa9d01cfd1ae0ef1e62872a9c7080778099b220b223b3816
 F src/rowset.c 7b7e7e479212e65b723bf40128c7b36dc5afdfac
 F src/select.c 82aa95aa1cfeadef5ecae1126afff1efca64c49050bbf7116425a8a1d4fc5e6c
 F src/shell.c.in 8578421c5fb2a972461b2a996f7173646e55e0dbd2a2eee30c8f5dc7d3dbadfd
@@ -555,7 +555,7 @@ F src/test_vfs.c f0186261a24de2671d080bcd8050732f0cb64f6e
 F src/test_vfstrace.c bab9594adc976cbe696ff3970728830b4c5ed698
 F src/test_windirent.c a895e2c068a06644eef91a7f0a32182445a893b9a0f33d0cdb4283dca2486ac1
 F src/test_windirent.h 90dfbe95442c9762357fe128dc7ae3dc199d006de93eb33ba3972e0a90484215
-F src/test_window.c add59ee68568868129516999f30a68e8ab2afd276e272aba4f633c9fc52c1bb1
+F src/test_window.c 0d19b33e7a262d3b55e85bc0fb84a70f503686cbd769939176162fe866ce7f9e
 F src/test_wsd.c 41cadfd9d97fe8e3e4e44f61a4a8ccd6f7ca8fe9
 F src/threads.c 4ae07fa022a3dc7c5beb373cf744a85d3c5c6c3c
 F src/tokenize.c e0a90f3d594e3db842581543abf157c8e63617655c91ad35d77e339a1bc36ce0
@@ -584,7 +584,7 @@ F src/where.c 0bcbf9e191ca07f9ea2008aa80e70ded46bcdffd26560c83397da501f00aece6
 F src/whereInt.h b90ef9b9707ef750eab2a7a080c48fb4900315033274689def32d0cf5a81ebe4
 F src/wherecode.c 3317f2b083a66d3e65a03edf316ade4ccb0a99c9956273282ebb579b95d4ba96
 F src/whereexpr.c 19cf35cdd9bf6d5589d8a5c960d99259761136187a2319a6e14d11cf1abe14c2
-F src/window.c 4403ae36b9645f105ad8ae16d986929c6db5f3bc7d3d3db43f5fa51c6bbfcbe8
+F src/window.c 7df0313f9b21c904e51226b24c0203aa26be502202f469143bacc5e74ebc0d38
 F test/8_3_names.test ebbb5cd36741350040fd28b432ceadf495be25b2
 F test/affinity2.test a6d901b436328bd67a79b41bb0ac2663918fe3bd
 F test/affinity3.test 6a101af2fc945ce2912f6fe54dd646018551710d
@@ -1621,12 +1621,12 @@ F test/win32nolock.test ac4f08811a562e45a5755e661f45ca85892bdbbc
 F test/window1.test 7cb260079cd88d6d6177b0f592686f2bbbc2d10f4f415c8a37cd153eb83c87ca
 F test/window2.tcl 9bfa842d8a62b0d36dc8c1b5972206393c43847433c6d75940b87fec93ce3143
 F test/window2.test 8e6d2a1b9f54dfebee1cde961c8590cd87b4db45c50f44947a211e1b63c2a05e
-F test/window3.tcl 9b82055c8977bdcab164fb4f71dabf86c511c9010c44f958352b610d313182c3
+F test/window3.tcl 577a3b1ff913208e5248c04dab9df17fd760ce159a752789e26d0cb4a5f91823
-F test/window3.test 47884c240d0d5234ad9c6da65452cfec1bfa69ec6f9c4158cd9750c3d88d3a25
+F test/window3.test 87fb18021903fc4d1659b8b2092aea55d611a9606cfa7272686234e5197c4b31
 F test/window4.tcl 7cec7e578aa9f78b7265bff8d552cda17a1d8d89f0449d0e74970a527b8846f5
 F test/window4.test dcd8767869988e0d23d56bc3f8b46ec116de23127b81b5f66fd48d5529072ed1
-F test/window5.test a4835b96d30eb3b81a1dbc683e333e57a614645eb6f2ae476a7ed2addf0b0f1f
+F test/window5.test 8187f46597c90b73e8f96659e893353cbda337479cc582f7a488eab351ba08d3
-F test/window6.test fb4e464993630c3d6023e906aa6705667062600a8341085b7fd8c201f4c2f411
+F test/window6.test 28e9126e1c35b99dec7b0609f1a242cecca5d0291382bcb5f61f498973c2b047
 F test/windowfault.test 97d5fc404308edb579a5a183e294ed874c844ecf01f0a28ba46df3141ebaee1f
 F test/with1.test 58475190cd8caaeebea8cfeb2a264ec97a0c492b8ffe9ad20cefbb23df462f96
 F test/with2.test e0030e2f0267a910d6c0e4f46f2dfe941c1cc0d4f659ba69b3597728e7e8f1ab
@@ -1744,7 +1744,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 65ff5144a55f1ba2b2ef812a0c988fa2522441177038b8d686eb1d0c558c75d5
+P 3f6730be4cb712a28401be6d96e56ccb3f2e98dd8961b477befec3f363715178
-R 3c4f5fbed7f648d733dce0ff7eec4d29
+R 119ac682f2311f0cb1cd57d00a75572a
-U drh
+U dan
-Z d7489229aa03ad09a6b5a39009aab4a6
+Z be71ee8fe3da4ce8850e5091c36fabce

manifest.uuid

@@ -1 +1 @@
-3f6730be4cb712a28401be6d96e56ccb3f2e98dd8961b477befec3f363715178
+4f3c8a82fd1c5b14d84f2301e34cfc8d52fe4b3a60840c39e895c11f2da529d9

src/func.c

@@ -1572,6 +1572,9 @@ static void totalFinalize(sqlite3_context *context){
 typedef struct CountCtx CountCtx;
 struct CountCtx {
   i64 n;
+#ifdef SQLITE_DEBUG
+  int bInverse;                   /* True if xInverse() ever called */
+#endif
 };
 
 /*
@@ -1589,7 +1592,7 @@ static void countStep(sqlite3_context *context, int argc, sqlite3_value **argv){
   ** sure it still operates correctly, verify that its count agrees with our 
   ** internal count when using count(*) and when the total count can be
   ** expressed as a 32-bit integer. */
-  assert( argc==1 || p==0 || p->n>0x7fffffff
+  assert( argc==1 || p==0 || p->n>0x7fffffff || p->bInverse
           || p->n==sqlite3_aggregate_count(context) );
 #endif
 }   
@@ -1598,6 +1601,18 @@ static void countFinalize(sqlite3_context *context){
   p = sqlite3_aggregate_context(context, 0);
   sqlite3_result_int64(context, p ? p->n : 0);
 }
+#ifndef SQLITE_OMIT_WINDOWFUNC
+static void countInverse(sqlite3_context *ctx, int argc, sqlite3_value **argv){
+  CountCtx *p;
+  p = sqlite3_aggregate_context(ctx, sizeof(*p));
+  if( (argc==0 || SQLITE_NULL!=sqlite3_value_type(argv[0])) && p ){
+    p->n--;
+#ifdef SQLITE_DEBUG
+    p->bInverse = 1;
+#endif
+  }
+}   
+#endif
 
 /*
 ** Routines to implement min() and max() aggregate functions.
@@ -1943,8 +1958,10 @@ void sqlite3RegisterBuiltinFunctions(void){
     WAGGREGATE(sum,   1,0,0, sumStep, sumFinalize, sumFinalize, sumInverse, 0),
     WAGGREGATE(total, 1,0,0, sumStep,totalFinalize,totalFinalize,sumInverse, 0),
     WAGGREGATE(avg,   1,0,0, sumStep, avgFinalize, avgFinalize, sumInverse, 0),
-    AGGREGATE2(count, 0,0,0, countStep, countFinalize, SQLITE_FUNC_COUNT  ),
+    WAGGREGATE(count, 0,0,0, countStep, 
-    WAGGREGATE(count, 1,0,0, countStep, countFinalize, 0, 0, 0 ),
+        countFinalize, countFinalize, countInverse, SQLITE_FUNC_COUNT  ),
+    WAGGREGATE(count, 1,0,0, countStep, 
+        countFinalize, countFinalize, countInverse, 0  ),
     WAGGREGATE(group_concat, 1, 0, 0, groupConcatStep, 
         groupConcatFinalize, groupConcatValue, groupConcatInverse, 0),
     WAGGREGATE(group_concat, 2, 0, 0, groupConcatStep, 

src/resolve.c

@@ -758,7 +758,11 @@ static int resolveExprStep(Walker *pWalker, Expr *pExpr){
       }
 
 #ifndef SQLITE_OMIT_WINDOWFUNC
-      if( is_agg==0 && pExpr->pWin ){
+      assert( is_agg==0 || (pDef->funcFlags & SQLITE_FUNC_MINMAX)
+          || (pDef->xValue==0 && pDef->xInverse==0)
+          || (pDef->xValue && pDef->xInverse && pDef->xSFunc && pDef->xFinalize)
+      );
+      if( pDef && pDef->xValue==0 && pExpr->pWin ){
         sqlite3ErrorMsg(pParse, 
             "%.*s() may not be used as a window function", nId, zId
         );

src/test_window.c

@@ -302,6 +302,32 @@ static int SQLITE_TCLAPI test_create_sumint(
   return TCL_OK;
 }
 
+static int SQLITE_TCLAPI test_override_sum(
+  void * clientData,
+  Tcl_Interp *interp,
+  int objc,
+  Tcl_Obj *CONST objv[]
+){
+  sqlite3 *db;
+  int rc;
+
+  if( objc!=2 ){
+    Tcl_WrongNumArgs(interp, 1, objv, "DB");
+    return TCL_ERROR;
+  }
+  if( getDbPointer(interp, Tcl_GetString(objv[1]), &db) ) return TCL_ERROR;
+
+  rc = sqlite3_create_function(db, "sum", -1, SQLITE_UTF8, 0,
+      0, sumintStep, sumintFinal
+  );
+
+  if( rc!=SQLITE_OK ){
+    Tcl_SetObjResult(interp, Tcl_NewStringObj(sqlite3ErrName(rc), -1));
+    return TCL_ERROR;
+  }
+  return TCL_OK;
+}
+
 int Sqlitetest_window_Init(Tcl_Interp *interp){
   static struct {
      char *zName;
@@ -311,6 +337,7 @@ int Sqlitetest_window_Init(Tcl_Interp *interp){
      { "sqlite3_create_window_function", test_create_window, 0 },
      { "test_create_window_function_misuse", test_create_window_misuse, 0 },
      { "test_create_sumint", test_create_sumint, 0 },
+     { "test_override_sum", test_override_sum, 0 },
   };
   int i;
   for(i=0; i<sizeof(aObjCmd)/sizeof(aObjCmd[0]); i++){

src/window.c

@@ -1594,17 +1594,21 @@ static void windowCodeRowExprStep(
    || pMWin->eStart==TK_PRECEDING 
    || pMWin->eStart==TK_FOLLOWING 
   ){
-    int addrJumpHere = 0;
+    int lblSkipInverse = sqlite3VdbeMakeLabel(v);;
     if( pMWin->eStart==TK_PRECEDING ){
-      addrJumpHere = sqlite3VdbeAddOp3(v, OP_IfPos, regStart, 0 , 1);
+      sqlite3VdbeAddOp3(v, OP_IfPos, regStart, lblSkipInverse, 1);
       VdbeCoverage(v);
     }
-    sqlite3VdbeAddOp2(v, OP_Next, csrStart, sqlite3VdbeCurrentAddr(v)+1);
+    if( pMWin->eStart==TK_FOLLOWING ){
-    VdbeCoverage(v);
+      sqlite3VdbeAddOp2(v, OP_Next, csrStart, sqlite3VdbeCurrentAddr(v)+2);
-    windowAggStep(pParse, pMWin, csrStart, 1, regArg, regSize);
+      VdbeCoverage(v);
-    if( addrJumpHere ){
+      sqlite3VdbeAddOp2(v, OP_Goto, 0, lblSkipInverse);
-      sqlite3VdbeJumpHere(v, addrJumpHere);
+    }else{
+      sqlite3VdbeAddOp2(v, OP_Next, csrStart, sqlite3VdbeCurrentAddr(v)+1);
+      VdbeCoverage(v);
     }
+    windowAggStep(pParse, pMWin, csrStart, 1, regArg, regSize);
+    sqlite3VdbeResolveLabel(v, lblSkipInverse);
   }
   if( pMWin->eEnd==TK_FOLLOWING ){
     sqlite3VdbeJumpHere(v, addrIfPos1);

test/window3.tcl

@@ -308,24 +308,29 @@ foreach {tn window} {
   "
 
   execsql_test 1.$tn.15.1 "
-    SELECT string_agg(CAST(b AS TEXT), '.') 
+    SELECT count(*) OVER win, string_agg(CAST(b AS TEXT), '.') 
-    FILTER (WHERE a%2=0) OVER (ORDER BY a $window) FROM t2
+    FILTER (WHERE a%2=0) OVER win FROM t2
+    WINDOW win AS (ORDER BY a $window)
   "
 
   execsql_test 1.$tn.15.2 "
-    SELECT string_agg(CAST(b AS TEXT), '.') 
+    SELECT count(*) OVER win, string_agg(CAST(b AS TEXT), '.') 
-    FILTER (WHERE 0=1) OVER (ORDER BY a $window) FROM t2
+    FILTER (WHERE 0=1) OVER win FROM t2
+    WINDOW win AS (ORDER BY a $window)
   "
 
   execsql_test 1.$tn.15.3 "
-    SELECT string_agg(CAST(b AS TEXT), '.') 
+    SELECT count(*) OVER win, string_agg(CAST(b AS TEXT), '.') 
-    FILTER (WHERE 1=0) OVER (PARTITION BY (a%10) ORDER BY a $window) FROM t2
+    FILTER (WHERE 1=0) OVER win FROM t2
+    WINDOW win AS (PARTITION BY (a%10) ORDER BY a $window)
   "
 
   execsql_test 1.$tn.15.4 "
-    SELECT string_agg(CAST(b AS TEXT), '.') 
+    SELECT count(*) OVER win, string_agg(CAST(b AS TEXT), '.') 
-    FILTER (WHERE a%2=0) OVER (PARTITION BY (a%10) ORDER BY a $window) FROM t2
+    FILTER (WHERE a%2=0) OVER win FROM t2
+    WINDOW win AS (PARTITION BY (a%10) ORDER BY a $window)
   "
+
 }
 
 finish_test

test/window5.test

@@ -82,6 +82,16 @@ do_execsql_test 2.1 {
   SELECT sumint(a) OVER (ORDER BY rowid ROWS BETWEEN 1 PRECEDING AND 1 FOLLOWING) FROM t1 ORDER BY rowid;
 } {10 11 12 8 10 5}
 
+test_override_sum db
+do_catchsql_test 3.0 {
+  SELECT sum(a) OVER 
+  (ORDER BY b ROWS BETWEEN 1 PRECEDING AND CURRENT ROW) 
+  FROM t1;
+} {1 {sum() may not be used as a window function}}
+do_execsql_test 3.1 {
+  SELECT sum(a) FROM t1;
+} {21}
+
 
 finish_test
 

test/window6.test

@@ -139,5 +139,19 @@ do_execsql_test 5.4 {
   SELECT sum(window) OVER window window FROM window window window window AS (ORDER BY window);
 } {2 6 12}
 
+do_execsql_test 5.5 {
+  SELECT count(*) OVER win FROM over
+  WINDOW win AS (ORDER BY x ROWS BETWEEN +2 FOLLOWING AND +3 FOLLOWING)
+} {1 0 0}
+
+#-------------------------------------------------------------------------
+#
+do_execsql_test 6.0 {
+  SELECT LIKE("!","","!")""WHeRE"";
+} {1}
+do_catchsql_test 6.1 {
+  SELECT LIKE("!","","!")""window"";
+} {1 {near "window": syntax error}}
+
 finish_test