diff --git a/ext/fts3/fts3.c b/ext/fts3/fts3.c
index 5296f9d6e7..892fc36d33 100644
--- a/ext/fts3/fts3.c
+++ b/ext/fts3/fts3.c
@@ -2068,7 +2068,7 @@ static void fts3PutDeltaVarint(
   sqlite3_int64 *piPrev,          /* IN/OUT: Previous value written to list */
   sqlite3_int64 iVal              /* Write this value to the list */
 ){
-  assert( iVal-*piPrev > 0 || (*piPrev==0 && iVal==0) );
+  assert_fts3_nc( iVal-*piPrev > 0 || (*piPrev==0 && iVal==0) );
   *pp += sqlite3Fts3PutVarint(*pp, iVal-*piPrev);
   *piPrev = iVal;
 }
diff --git a/ext/fts5/fts5_index.c b/ext/fts5/fts5_index.c
index f33617465d..5e1155c2a9 100644
--- a/ext/fts5/fts5_index.c
+++ b/ext/fts5/fts5_index.c
@@ -2321,11 +2321,11 @@ static void fts5LeafSeek(
   }
 
  search_success:
-  pIter->iLeafOffset = iOff + nNew;
-  if( pIter->iLeafOffset>n || nNew<1 ){
+  if( (i64)iOff+nNew>n || nNew<1 ){
     p->rc = FTS5_CORRUPT;
     return;
   }
+  pIter->iLeafOffset = iOff + nNew;
   pIter->iTermLeafOffset = pIter->iLeafOffset;
   pIter->iTermLeafPgno = pIter->iLeafPgno;
 
diff --git a/ext/fts5/test/fts5corrupt3.test b/ext/fts5/test/fts5corrupt3.test
index 4e0ae64a9a..25aa094e97 100644
--- a/ext/fts5/test/fts5corrupt3.test
+++ b/ext/fts5/test/fts5corrupt3.test
@@ -10108,6 +10108,221 @@ do_catchsql_test 68.1 {
   INSERT INTO t1(t1) SELECT x FROM t2;
 } {1 {database disk image is malformed}}
 
+#-------------------------------------------------------------------------
+reset_db
+do_test 69.0 {
+  sqlite3 db {}
+  db deserialize [decode_hexdb {
+.open --hexdb
+| size 32768 pagesize 4096 filename crash-31c462b8b665d0.db
+| page 1 offset 0
+|      0: 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00   SQLite format 3.
+|     16: 10 00 01 01 00 40 20 20 00 00 00 00 00 00 00 08   .....@  ........
+|     32: 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|     96: 00 00 00 00 0d 0f c7 00 07 0d 92 00 0f 8d 0f 36   ...............6
+|    112: 0e cb 0e 6b 0e 0e 0d b6 0d 92 00 00 00 00 00 00   ...k............
+|   3472: 00 00 22 08 06 17 11 11 01 31 74 61 62 6c 65 74   .........1tablet
+|   3488: 32 74 32 08 43 52 45 41 54 45 20 54 41 42 4c 45   2t2.CREATE TABLE
+|   3504: 20 74 32 28 78 29 56 07 06 17 1f 1f 01 7d 74 61    t2(x)V.......ta
+|   3520: 62 6c 65 74 31 5f 63 6f 6e 66 69 67 74 31 5f 63   blet1_configt1_c
+|   3536: 6f 6e 66 69 67 07 43 52 45 41 54 45 20 54 41 42   onfig.CREATE TAB
+|   3552: 4c 45 20 27 74 31 5f 63 6f 6e 66 69 67 27 28 6b   LE 't1_config'(k
+|   3568: 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20 76 29    PRIMARY KEY, v)
+|   3584: 20 57 49 54 48 4f 55 54 20 52 4f 57 49 44 5b 06    WITHOUT ROWID[.
+|   3600: 07 17 21 21 01 81 01 74 61 62 6c 65 74 31 5f 64   ..!!...tablet1_d
+|   3616: 6f 63 73 69 7a 65 74 31 5f 64 6f 63 73 69 7a 65   ocsizet1_docsize
+|   3632: 06 43 52 45 41 54 45 20 54 41 42 4c 45 20 27 74   .CREATE TABLE 't
+|   3648: 31 5f 64 6f 63 73 69 7a 65 27 28 69 64 20 49 4e   1_docsize'(id IN
+|   3664: 54 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45   TEGER PRIMARY KE
+|   3680: 59 2c 20 73 7a 20 42 4c 4f 42 29 5e 05 07 17 21   Y, sz BLOB)^...!
+|   3696: 21 01 81 07 74 61 62 6c 65 74 31 5f 63 6f 6e 74   !...tablet1_cont
+|   3712: 65 6e 74 74 31 5f 63 6f 6e 74 65 6e 74 05 43 52   entt1_content.CR
+|   3728: 45 41 54 45 20 54 41 42 4c 45 20 27 74 31 5f 63   EATE TABLE 't1_c
+|   3744: 6f 6e 74 65 6e 74 27 28 69 64 20 49 4e 54 45 47   ontent'(id INTEG
+|   3760: 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59 2c 20   ER PRIMARY KEY, 
+|   3776: 63 39 2c 20 63 31 2c 20 63 32 29 69 04 07 17 19   c9, c1, c2)i....
+|   3792: 19 01 81 2d 74 61 62 6c 65 74 31 5f 69 64 78 74   ...-tablet1_idxt
+|   3808: 31 5f 69 64 78 04 43 52 45 41 54 45 20 54 41 42   1_idx.CREATE TAB
+|   3824: 4c 45 20 27 74 31 5f 69 64 78 27 28 73 65 67 69   LE 't1_idx'(segi
+|   3840: 64 2c 20 74 65 72 6d 2c 20 70 67 6e 6f 2c 20 50   d, term, pgno, P
+|   3856: 52 49 4d 41 52 59 20 4b 45 59 28 73 65 67 69 64   RIMARY KEY(segid
+|   3872: 2c 20 74 65 72 6d 29 29 20 57 49 54 48 4f 55 54   , term)) WITHOUT
+|   3888: 20 52 4f 57 49 44 55 03 07 17 1b 1b 01 81 01 74    ROWIDU........t
+|   3904: 61 62 6c 65 74 31 5f 64 61 74 61 74 31 5f 64 61   ablet1_datat1_da
+|   3920: 74 61 03 43 52 45 41 54 45 20 54 41 42 4c 45 20   ta.CREATE TABLE 
+|   3936: 27 74 31 5f 64 61 74 61 27 28 69 64 20 49 4e 54   't1_data'(id INT
+|   3952: 45 47 45 52 20 50 52 49 4d 41 52 59 20 4b 45 59   EGER PRIMARY KEY
+|   3968: 2c 20 62 6c 6f 63 6b 20 42 4c 4f 42 29 38 02 06   , block BLOB)8..
+|   3984: 17 11 11 08 5f 74 61 62 6c 65 74 31 74 31 43 52   ...._tablet1t1CR
+|   4000: 45 41 54 45 20 56 49 52 54 55 41 4c 20 54 41 42   EATE VIRTUAL TAB
+|   4016: 4c 45 20 74 31 20 55 53 49 4e 47 20 66 74 73 35   LE t1 USING fts5
+|   4032: 28 61 2c 62 2c 63 29 00 00 00 00 00 00 00 00 00   (a,b,c).........
+| page 3 offset 8192
+|      0: 0d 00 00 00 03 0c 94 00 0f e6 0f ef 0c 94 00 00   ................
+|   3216: 00 00 00 00 86 4a 84 80 80 80 80 01 04 00 8d 18   .....J..........
+|   3232: 00 00 03 2b 02 30 30 01 02 06 01 02 06 01 02 06   ...+.00.........
+|   3248: 1f 02 03 01 02 03 01 02 03 01 08 32 30 31 36 30   ...........20160
+|   3264: 36 30 39 01 02 07 01 02 07 01 02 07 01 01 34 01   609...........4.
+|   3280: 02 05 01 02 05 01 02 05 01 01 35 01 02 04 01 02   ..........5.....
+|   3296: 04 01 02 04 02 07 30 30 30 30 30 30 30 1c 02 04   ......0000000...
+|   3312: 01 02 04 01 02 04 01 06 62 69 6e 61 72 79 03 06   ........binary..
+|   3328: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3344: 02 02 03 06 00 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3360: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3376: 03 06 01 02 02 03 06 01 02 02 01 08 63 6f 6d 70   ............comp
+|   3392: 69 6c 65 72 01 02 02 01 02 02 01 02 02 01 06 64   iler...........d
+|   3408: 62 73 74 61 74 07 02 03 01 02 03 01 02 03 02 04   bstat...........
+|   3424: 65 62 75 67 04 02 02 01 02 02 01 02 02 01 06 65   ebug...........e
+|   3440: 6e 61 62 6c 65 07 02 02 01 02 02 01 02 02 01 02   nable...........
+|   3456: 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02   ................
+|   3472: 01 02 02 01 02 02 01 02 02 01 02 02 01 02 02 01   ................
+|   3488: 01 02 01 02 02 01 02 02 01 02 02 01 02 02 01 02   ................
+|   3504: 02 01 02 02 02 08 78 74 65 6e 73 69 6f 6e 1f 02   ......xtension..
+|   3520: 04 01 02 04 01 02 04 01 04 66 74 73 34 1a 02 03   .........fts4...
+|   3536: 01 02 03 01 02 03 04 01 35 0d 02 03 01 02 03 01   ........5.......
+|   3552: 02 03 01 03 67 63 63 01 aa 03 01 02 03 01 02 03   ....gcc.........
+|   3568: 02 06 65 6f 70 6f 6c 79 10 02 03 02 02 03 01 02   ..eopoly........
+|   3584: 03 01 05 6a 73 6f 6e 31 13 02 03 01 02 03 01 02   ...json1........
+|   3600: 03 01 04 6c 6f 61 64 1f 02 03 01 02 03 01 02 03   ...load.........
+|   3616: 01 03 6d 61 78 1c 02 02 01 02 02 01 02 02 02 05   ..max...........
+|   3632: 65 6d 6f 72 79 1c 02 03 01 02 03 01 02 03 04 04   emory...........
+|   3648: 73 79 73 35 16 02 03 01 02 03 01 02 03 01 06 6e   sys5...........n
+|   3664: 6f 63 61 73 65 02 06 01 02 02 03 06 01 02 02 03   ocase...........
+|   3680: 06 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06   ................
+|   3696: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3712: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3728: 02 01 04 6f 6d 69 74 1f 02 02 01 02 02 01 02 01   ...omit.........
+|   3744: ff ff ff ff ff ff ff ff f0 00 00 00 00 00 01 02   ................
+|   3760: 58 81 96 4d 01 06 01 02 02 03 06 01 02 02 03 06   X..M............
+|   3776: 01 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01   ................
+|   3792: 02 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02   ................
+|   3808: 02 03 06 01 02 02 03 06 01 02 02 03 06 01 02 02   ................
+|   3824: 01 0a 74 68 72 65 61 64 73 61 66 65 22 02 02 01   ..threadsafe....
+|   3840: 02 02 01 02 02 01 04 76 74 61 62 07 02 04 01 02   .......vtab.....
+|   3856: 04 01 02 04 01 01 78 01 06 01 01 02 01 06 01 01   ......x.........
+|   3872: 02 01 06 01 1e 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3888: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3904: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   3920: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   3936: 00 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   3952: 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02   ................
+|   3968: 01 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01   ................
+|   3984: 06 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06   ................
+|   4000: 01 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01   ................
+|   4016: 01 02 01 06 01 01 02 01 06 01 01 02 01 06 01 01   ................
+|   4032: 02 01 06 01 01 02 01 06 01 01 02 04 15 13 0c 0c   ................
+|   4048: 12 44 13 11 0f 47 13 0f 0b 0e 11 10 0f 0e 10 0f   .D...G..........
+|   4064: 44 0f 10 40 15 0f 07 01 03 00 14 24 5a 24 24 0f   D..@.......$Z$$.
+|   4080: 0a 03 00 24 00 00 00 00 01 01 01 00 01 01 01 01   ...$............
+| page 4 offset 12288
+|      0: 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 00 00 00 00 00 00 05 04 09 0c 01 02   ................
+| page 5 offset 16384
+|      0: 0d 00 00 00 24 0c 0a 00 0f d8 0f af 0f 86 0f 74   ....$..........t
+|     16: 0f 61 0f 4e 0f 2f 0f 0f 0e ef 0e d7 0e be 0e a5   .a.N./..........
+|     32: 0e 8d 0e 74 0e 5b 0e 40 0e 24 0e 08 0d ef 0d d5   ...t.[.@.$......
+|     48: 0d bb 0d a0 0d 84 0d 68 0d 4f 0d 00 00 00 00 00   .......h.O......
+|   3072: 00 00 00 00 00 00 00 00 00 00 18 24 05 00 25 0f   ...........$..%.
+|   3088: 19 54 48 52 45 41 44 53 41 46 45 3d 30 58 42 49   .THREADSAFE=0XBI
+|   3104: 4e 41 52 59 18 23 05 00 25 0f 19 54 48 52 45 41   NARY.#..%..THREA
+|   3120: 44 53 41 46 45 3d 30 58 4e 4f 43 41 53 45 17 22   DSAFE=0XNOCASE..
+|   3136: 05 00 25 0f 17 54 48 52 45 41 44 53 41 46 45 3d   ..%..THREADSAFE=
+|   3152: 30 58 52 54 52 49 4d 1f 21 05 00 33 0f 19 4f 4d   0XRTRIM.!..3..OM
+|   3168: 49 54 20 4c 4f 41 44 20 45 58 54 45 4e 53 49 4f   IT LOAD EXTENSIO
+|   3184: 4e 58 42 49 4e 41 52 59 1f 20 05 00 33 d3 19 4f   NXBINARY. ..3..O
+|   3200: 4d 49 54 28 2c 4f 41 44 b2 04 55 85 44 54 e5 34   MIT(,OAD..U.DT.4
+|   3216: 94 f4 e5 84 e4 f4 34 15 34 51 e1 f0 50 03 30 f1   ......4.4Q..P.0.
+|   3232: 74 f4 d4 95 42 04 c4 f4 14 42 04 55 85 44 54 e5   t...B....B.U.DT.
+|   3248: 34 94 f4 e5 85 25 45 24 94 d1 f1 e0 50 03 30 f1   4....%E$....P.0.
+|   3264: 94 d4 15 82 04 d4 54 d4 f5 25 93 d3 53 03 03 03   ......T..%..S...
+|   3280: 03 03 03 05 84 24 94 e4 15 25 91 f1 d0 50 03 30   .....$...%...P.0
+|   3296: f1 94 d4 15 82 04 d4 54 d4 f5 25 93 d3 53 03 03   .......T..%..S..
+|   3312: 03 03 03 03 05 84 e4 f4 34 15 34 51 e1 c0 50 03   ........4.4Q..P.
+|   3328: 30 f1 74 d4 15 82 04 d4 54 d4 f5 25 93 d3 53 03   0.t.....T..%..S.
+|   3344: 03 03 03 03 03 05 85 25 45 24 94 d1 81 b0 50 02   .......%E$....P.
+|   3360: 50 f1 94 54 e4 14 24 c4 52 05 25 45 24 54 55 84   P..T..$.R.%E$TU.
+|   3376: 24 94 e4 15 25 91 81 a0 50 02 50 f1 94 54 e4 14   $...%...P.P..T..
+|   3392: 24 c4 52 05 25 45 24 54 55 84 e4 f4 34 15 34 51   $.R.%E$TU...4.4Q
+|   3408: 71 90 50 02 50 f1 74 54 e4 14 24 c4 52 05 25 45   q.P.P.tT..$.R.%E
+|   3424: 24 54 55 85 25 45 24 94 d1 a1 80 50 02 90 f1 94   $TU.%E$....P....
+|   3440: 54 e4 14 24 c4 52 04 d4 54 d5 35 95 33 55 84 24   T..$.R..T.5.3U.$
+|   3456: 94 e4 15 25 91 a1 70 50 02 90 f1 94 54 e4 14 24   ...%..pP....T..$
+|   3472: c4 52 04 d4 54 d5 35 95 33 55 84 e4 f4 34 15 34   .R..T.5.3U...4.4
+|   3488: 51 91 60 50 02 90 f1 74 54 e4 14 24 c4 52 04 d4   Q.`P...tT..$.R..
+|   3504: 54 d5 35 95 33 55 85 25 45 24 94 d1 81 50 50 02   T.5.3U.%E$...PP.
+|   3520: 50 f1 94 54 e4 14 24 c4 52 04 a5 34 f4 e3 15 84   P..T..$.R..4....
+|   3536: 24 94 e4 15 25 91 81 40 50 02 50 f1 94 54 e4 14   $...%..@P.P..T..
+|   3552: 24 c4 52 04 a5 34 f4 e3 15 84 e4 f4 34 15 34 51   $.R..4......4.4Q
+|   3568: 71 30 50 02 4f f1 74 54 e4 14 24 c4 52 04 a5 34   q0P.O.tT..$.R..4
+|   3584: f4 e3 15 85 25 45 24 94 d1 a1 20 50 02 90 f1 94   ....%E$... P....
+|   3600: 54 e4 14 24 c4 52 04 74 54 f5 04 f4 c5 95 84 24   T..$.R.tT......$
+|   3616: 94 e4 15 25 91 a1 10 50 02 90 f1 94 54 e4 14 24   ...%...P....T..$
+|   3632: c4 52 04 74 54 f5 04 f4 c5 95 84 e4 f4 34 15 34   .R.tT........4.4
+|   3648: 51 91 00 50 02 90 f1 74 54 e4 14 24 c4 51 f4 74   Q..P...tT..$.Q.t
+|   3664: 54 f5 04 f4 c5 95 85 25 45 24 94 d1 70 f0 50 02   T......%E$..p.P.
+|   3680: 30 f1 94 54 e4 14 24 c5 20 46 54 53 35 58 42 49   0..T..$. FTS5XBI
+|   3696: 4e 41 52 59 17 0e 05 00 23 0f 19 45 4e 41 42 4c   NARY....#..ENABL
+|   3712: 45 20 46 54 53 35 58 4f 4f 43 41 53 45 16 0d 05   E FTS5XOOCASE...
+|   3728: 00 23 0f 17 45 4e 41 42 4c 45 20 46 54 53 35 58   .#..ENABLE FTS5X
+|   3744: 52 54 52 49 4d 17 0c 05 00 23 0f 19 45 4e 41 42   RTRIM....#..ENAB
+|   3760: 4c 45 20 46 54 53 34 58 42 49 4e 41 52 59 97 0b   LE FTS4XBINARY..
+|   3776: 05 00 23 0f 19 45 4e 41 42 4c 45 20 46 54 53 34   ..#..ENABLE FTS4
+|   3792: 58 4e 4f 43 41 53 45 16 0a 05 00 23 0f 17 45 4e   XNOCASE....#..EN
+|   3808: 41 42 4c 45 20 46 54 53 34 58 52 54 52 49 4d 1e   ABLE FTS4XRTRIM.
+|   3824: 09 05 00 3e 5f 19 45 4e 41 42 4c 45 20 44 42 53   ...>_.ENABLE DBS
+|   3840: 44 41 54 20 56 54 41 42 58 42 49 4e 41 52 59 1e   DAT VTABXBINARY.
+|   3856: 08 05 00 31 0f 19 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3872: 54 41 54 20 56 54 41 42 58 4e 4f 43 4d e3 45 1d   TAT VTABXNOCM.E.
+|   3888: 07 05 00 31 0f 17 45 4e 41 42 4c 45 20 44 42 53   ...1..ENABLE DBS
+|   3904: 54 41 54 20 56 54 41 42 58 52 54 52 49 4d 11 06   TAT VTABXRTRIM..
+|   3920: 05 00 17 0f 19 44 45 42 55 47 58 42 49 4e 41 52   .....DEBUGXBINAR
+|   3936: 59 11 05 05 00 17 0f 19 44 45 42 55 47 58 4e 4f   Y.......DEBUGXNO
+|   3952: 43 41 53 45 10 02 02 50 08 5f 17 44 45 42 55 47   CASE...P._.DEBUG
+|   3968: 58 52 54 52 49 4d 27 03 05 00 44 0f 19 43 4f 4d   XRTRIM'...D..COM
+|   3984: 50 49 4c 45 52 3d 67 63 63 2d 35 2e 34 2e 30 20   PILER=gcc-5.4.0 
+|   4000: 32 30 31 36 30 36 30 39 58 42 49 4e 41 52 59 27   20160609XBINARY'
+|   4016: 02 05 00 43 0f 19 43 4f 4d 50 49 4c 45 52 3d 67   ...C..COMPILER=g
+|   4032: 63 63 2d 35 2e 34 2e 30 20 32 30 31 36 30 36 30   cc-5.4.0 2016060
+|   4048: 39 58 4e 4f 43 41 53 45 26 01 05 00 43 c9 17 43   9XNOCASE&...C..C
+|   4064: 4f 4d 50 49 4c 47 02 3d 67 63 63 2d 35 2e 34 2e   OMPILG.=gcc-5.4.
+|   4080: 30 20 32 30 31 36 30 36 30 39 58 52 54 52 49 4d   0 20160609XRTRIM
+| page 6 offset 20480
+|      0: 0d 00 00 00 24 0e e0 00 0f f8 0f f0 0f e8 0f e0   ....$...........
+|     16: 0f d8 0f d0 0f c8 0f c0 0f b8 0f b0 0f a8 0f a0   ................
+|     32: 0f 98 0f 90 0f 88 0f 80 0f 78 0f 70 0f 68 0f 60   .........x.p.h.`
+|     48: 0f 58 0f 50 0f 48 0f 40 0f 38 00 00 00 00 00 00   .X.P.H.@.8......
+|   3808: 06 24 03 00 12 02 01 01 06 23 03 00 12 02 01 01   .$.......#......
+|   3824: 06 22 03 00 12 02 01 01 06 21 03 00 12 03 01 01   .........!......
+|   3840: 06 20 03 00 12 03 01 01 06 1f 03 00 12 03 01 01   . ..............
+|   3856: 06 1e 03 00 12 03 01 01 06 1d 03 00 12 03 01 01   ................
+|   3872: 06 1c 03 00 12 03 01 01 06 1b 03 00 12 02 01 01   ................
+|   3888: 06 1a 03 00 12 02 01 01 06 19 03 00 12 02 01 01   ................
+|   3904: 06 18 03 00 12 02 01 01 06 17 03 00 12 02 01 01   ................
+|   3920: 06 16 03 00 12 02 01 01 06 15 03 00 12 02 01 01   ................
+|   3936: 06 14 03 00 12 02 01 01 06 13 03 00 12 02 01 01   ................
+|   3952: 06 12 03 00 12 02 01 01 06 11 03 00 12 02 01 01   ................
+|   3968: 06 10 03 00 12 02 01 01 06 1f 03 00 12 02 01 01   ................
+|   3984: 06 0e 03 00 12 02 01 01 06 0d 03 00 12 02 01 01   ................
+|   4000: 06 0c 03 00 12 02 01 01 06 0b 03 00 12 02 01 01   ................
+|   4016: 06 0a 03 00 12 02 01 01 06 09 03 00 12 03 01 01   ................
+|   4032: 06 08 03 00 12 03 01 01 06 07 03 00 12 03 01 01   ................
+|   4048: 06 06 03 00 12 01 01 01 06 05 03 00 12 01 01 01   ................
+|   4064: 06 04 03 00 12 01 01 01 06 03 03 00 12 06 01 01   ................
+|   4080: 06 02 03 00 12 06 01 01 06 01 03 00 12 06 01 01   ................
+| page 7 offset 24576
+|      0: 0a 00 00 00 01 0f f4 00 0f f4 00 00 00 00 00 00   ................
+|   4080: 00 00 00 00 0b 03 1b 01 76 65 72 73 69 6f 6e 04   ........version.
+| page 8 offset 28672
+|      0: 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
+|   4048: 00 00 00 00 00 00 11 03 02 2b 69 6e 74 65 67 72   .........+integr
+|   4064: 69 74 79 2d 63 68 65 63 6b 09 00 00 00 00 00 00   ity-check.......
+| end crash-31c462b8b665d0.db
+}]} {}
+
+
+do_catchsql_test 69.2 {
+  SELECT * FROM t1 WHERE a MATCH 'fx*'
+} {1 {database disk image is malformed}}
 
 sqlite3_fts5_may_be_corrupt 0
 finish_test
diff --git a/manifest b/manifest
index 550c4e40bc..ba21d1f1c1 100644
--- a/manifest
+++ b/manifest
@@ -1,45 +1,50 @@
 B 7a876209a678a34c198b54ceef9e3c041f128a14dc73357f6a57cadadaa6cf7b
-C An\sattempt\sto\sget\sthe\sMin/Max\soptimization\sworking\swith\sIN\sconstraints.\nNot\scurrently\sworking.
-D 2020-07-10T19:09:40.123
+C Merge\slatest\schanges\sfrom\strunk.\s\sThis\sbranch\sstill\sdoes\snot\swork.
+D 2020-07-14T01:03:05.378
 F Makefile.in 19374a5db06c3199ec1bab71ab74a103d8abf21053c05e9389255dc58083f806
 F Makefile.msc 48f5a3fc32672c09ad73795749f6253e406a31526935fbbffd8f021108d54574
 F autoconf/Makefile.am a8d1d24affe52ebf8d7ddcf91aa973fa0316618ab95bb68c87cabf8faf527dc8
 F configure a97f98dfff699495aef66ae3d9c424345778a663f583e0d6e7522670518f87c1 x
 F configure.ac 40d01e89cb325c28b33f5957e61fede0bd17da2b5e37d9b223a90c8a318e88d4
 F doc/lemon.html 1edc0f916e771212792d4d077aedc05168bf13fd65d64d41b2c13e46ac0063a8
-F ext/fts3/fts3.c 5ffabd0d13210fb9cfe1c08184201282722adfeea49cd9e8e2ae29d1fefd7fcb
+F ext/fts3/fts3.c b8ed676b377b1f7f07596aa6272ea623acf087f529a3007b75d1f4908919e6b9
 F ext/fts3/fts3_write.c 723ed1b11ed46ad1b3a23c0d69fa39e77986783a82d5711bf87a5ce29e0a3b52
+F ext/fts5/fts5_index.c de14c9a30f45e2b847ff9284b14776d9d07961e545e8f1546a6aa3f915af721f
+F ext/fts5/test/fts5corrupt3.test 7afe0fea5b2160798fdc3306395048768c6fc13acefc0e7129d4075b6e1bb224
 F ext/lsm1/lsm_unix.c 11e0a5c19d754a4e1d93dfad06de8cc201f10f886b8e61a4c599ed34e334fc24
 F ext/misc/decimal.c c1897f624893d1c12e3c879d97ca7d1c4a36cae10d32afe632779de78c4aaa4f
 F ext/misc/ieee754.c bb6bd8e9eeeda5a7ac82839fcab5c0b8156b0532165387cc5458a97f60047b5d
 F main.mk b1cd0bc6aedad7ebb667b7f74f835f932f60ee33be2a5c3051fd93eb465f5c75
-F src/btree.c e8e4a7e4727f0ead6433fdafeff347bf078fec39bee55a24441c3481e5b85164
+F src/btree.c e8a64df5ebd1e9d5184ff89fc110e048cdf7b77cc300eb51c48969ef4e71c23b
 F src/btreeInt.h 19267385aa3bc00067d48e0e4ba83ae82dc08b0c15a3b3df20ea653cb462b5bf
 F src/build.c ba1bbe563a3dc02d5fed20537603181e5289c13ea30ae5e775f552e7557adbfa
-F src/expr.c a3ab84399b3415f66d2d0c25f5bcd98ef465c0c07ea1f19bf2a418b1c8fcad74
+F src/expr.c 90039a043658ce78c3237ba5064c0934b7294120f6adc387f8d0fba306028154
 F src/parse.y b6b4b02f8cc8f94ac1d93a922543e0344dbb30b04877898736c01ec7ec03eaaa
 F src/pragma.c ae499b5ab8f4e833f67e28bf2322500e9aa612aadf12581d1324333f848d8b51
 F src/pragma.h 8dc78ab7e9ec6ce3ded8332810a2066f1ef6267e2e03cd7356ee00276125c6cf
 F src/resolve.c 79cee37182fea66703f90365b8b0a646ed7e9bfa9238b91fa90dfc74258b940e
-F src/select.c 14d212b94088cf06f0074f080e46f858b36bf55a772029a7d006a16b305fe5a8
+F src/select.c d9f067b2dda2202d1f80f820449acbd3f423010f29a453ce4e4a517a4bd679cb
 F src/shell.c.in 81fa23ac1a3d6ac9ed13e9ae711a3d8806396ca7cc12c5d6a2e2536f70b0c7ad
-F src/sqliteInt.h f89ed824bc55b6bd90ca692518f85eeb22f8962d46e0e12cad989d4aee1e7b8c
+F src/sqliteInt.h 8366e482a1330e9c103c9c9053c53894e373daf1fb9dd65bd953ffc0b3ad7a8b
 F src/test1.c fe56c4bcaa2685ca9aa25d817a0ee9345e189aff4a5a71a3d8ba946c7776feb8
 F src/update.c 6a0484134635f167594d597a33d186051125d3ef41803a90b246cea6cf7f11f9
 F src/util.c c0bacc165f46169d2b720c37c8719165e383211698fad1de39dd16a8c161815a
 F src/vdbe.c 981666c49d33039df6dc9fccd40191575586ac4866255b2f57819cc5eb99f572
 F src/vdbeapi.c c1a9004ac554d8d48794d2ce5f80397f8e419fd28643a543cc1e004c7713c3ef
 F src/where.c a485bc1ec23b04ef6e7868abc559b8adc4c3fdc3314222386928b2e47f1e4505
+F src/window.c 0dec178bfa541c757d15a2be78f34aea36393a0966600366810e5f8739ccf370
 F test/altertab.test b8b2104212e8ea87c75c3cbe3cb78ed7236a6c828ee2e59ed09d3dbe9812d002
 F test/busy2.test 415364312743992641f9bf679c84918327296067f85a5d00012b339dc35acbd7
+F test/corruptL.test 01cfda6b28f463d1713ac72a101e65549250568129ce5317ec6729729ecaf477
 F test/decimal.test 12739a01bdba4c4d79f95b323e6b67b9fad1ab6ffb56116bd2b9c81a5b19e1d9
 F test/filter1.test 6c483ecf7886c8843a8612c021aa23f33c581f584151f251842b3a3592c95ac8
 F test/fkey5.test 321fd41e8754389526b2b8e8769348dc9ff23a65d4d48b19c27df17459e82ec5
-F test/fts3corrupt4.test 07cabb7a5a3a4d5bbae08b537e0d9e22eebdb49b7b7a98646ef8c258308ae66f
-F test/fuzzdata8.db 0ae860b36b79fd41cafddc9e6602358b2d5c331cf200283221e659f86e196c0c
+F test/fts3corrupt4.test b77dcdfa207c11d7966e71837c518cb0639c78fd109dec89c65d45a3bfd36701
+F test/fuzzdata8.db ef83ab1c8d130daabef304cb440bae2215208120de741b8476de66e16237808d
 F test/gencol1.test b05e6c5edb9b10d48efb634ed07342441bddc89d225043e17095c36e567521a0
 F test/ieee754.test b0945d12be7d255f3dfa18e2511b17ca37e0edd2b803231c52d05b86c04ab26e
 F test/speedtest1.c a8b5afe72d78ff365012aba48d3f0c579e957facb7630f765f58a6ae4656d20d
+F test/window1.test e52b81fff0c3cb122a1240f336688eb81bea2967a99c4ddb78969adec7aadc2a
 F tool/lemon.c 600a58b9d1b8ec5419373982428e927ca208826edacb91ca42ab94514d006039
 F tool/mkautoconfamal.sh f62353eb6c06ab264da027fd4507d09914433dbdcab9cb011cdc18016f1ab3b8
 F tool/mkpragmatab.tcl ae5585ae76ca26e4d6ccd5ea9cdebaf5efefb318bf989497a0e846cd711d9ab1
@@ -47,10 +52,7 @@ F tool/mksqlite3c.tcl f4ef476510eca4124c874a72029f1e01bc54a896b1724e8f9eef0d8bfa
 F tool/mksqlite3h.tcl 1f5e4a1dbbbc43c83cc6e74fe32c6c620502240b66c7c0f33a51378e78fc4edf
 F tool/showlocks.c 9cc5e66d4ebbf2d194f39db2527ece92077e86ae627ddd233ee48e16e8142564
 F tool/speed-check.sh 615cbdf50f1409ef3bbf9f682e396df80f49d97ed93ed3e61c8e91fae6afde58
-P ccff8cb8267d4c5605484f7a35c1836937f20b3d6879fe84cd84dc24bbbffc77
-R 35d6b9743e23c38e933ae2f7f81185b9
-T *branch * minmax-opt-exp
-T *sym-minmax-opt-exp *
-T -sym-trunk *
+P 4a64c16fb7a07431e534fb9bbcf778646be8a1c718d5d10873fbccb0c867aac7 9cb03beae42d814a1b1b69f72865fde502d3f443313ec29edd010d1de40225eb
+R b5d39bb30ff84871e9397d6d2ffce041
 U drh
-Z 4df4fe61b85919c997c14bcb75af2a60
+Z cf6e9dd9fd5e835801e651e2c806ed31
diff --git a/manifest.uuid b/manifest.uuid
index ddb1bc4f91..67d0f7a6d0 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-4a64c16fb7a07431e534fb9bbcf778646be8a1c718d5d10873fbccb0c867aac7
\ No newline at end of file
+6144387238c03b8b33ae98d624f7ffa44a7829d3e0d4a0a01b5528e71ab4f08b
\ No newline at end of file
diff --git a/src/btree.c b/src/btree.c
index 00915abec5..76069a33eb 100644
--- a/src/btree.c
+++ b/src/btree.c
@@ -8772,7 +8772,11 @@ int sqlite3BtreeInsert(
   assert( pPage->intKey || pX->nKey>=0 );
   assert( pPage->leaf || !pPage->intKey );
   if( pPage->nFree<0 ){
-    rc = btreeComputeFreeSpace(pPage);
+    if( pCur->eState>CURSOR_INVALID ){
+      rc = SQLITE_CORRUPT_BKPT;
+    }else{
+      rc = btreeComputeFreeSpace(pPage);
+    }
     if( rc ) return rc;
   }
 
diff --git a/src/expr.c b/src/expr.c
index 9b63a569bc..abc4b12cf6 100644
--- a/src/expr.c
+++ b/src/expr.c
@@ -52,12 +52,10 @@ char sqlite3ExprAffinity(const Expr *pExpr){
   op = pExpr->op;
   if( op==TK_SELECT ){
     assert( pExpr->flags&EP_xIsSelect );
-    if( ALWAYS(pExpr->x.pSelect)
-     && pExpr->x.pSelect->pEList
-     && ALWAYS(pExpr->x.pSelect->pEList->a[0].pExpr)
-    ){
-      return sqlite3ExprAffinity(pExpr->x.pSelect->pEList->a[0].pExpr);
-    }
+    assert( pExpr->x.pSelect!=0 );
+    assert( pExpr->x.pSelect->pEList!=0 );
+    assert( pExpr->x.pSelect->pEList->a[0].pExpr!=0 );
+    return sqlite3ExprAffinity(pExpr->x.pSelect->pEList->a[0].pExpr);
   }
   if( op==TK_REGISTER ) op = pExpr->op2;
 #ifndef SQLITE_OMIT_CAST
@@ -200,7 +198,7 @@ CollSeq *sqlite3ExprCollSeq(Parse *pParse, const Expr *pExpr){
          && ALWAYS(!ExprHasProperty(p, EP_xIsSelect))
         ){
           int i;
-          for(i=0; i<p->x.pList->nExpr; i++){
+          for(i=0; ALWAYS(i<p->x.pList->nExpr); i++){
             if( ExprHasProperty(p->x.pList->a[i].pExpr, EP_Collate) ){
               pNext = p->x.pList->a[i].pExpr;
               break;
diff --git a/src/select.c b/src/select.c
index fcaf5aaee6..16a79ab292 100644
--- a/src/select.c
+++ b/src/select.c
@@ -175,21 +175,6 @@ void sqlite3SelectDelete(sqlite3 *db, Select *p){
   if( OK_IF_ALWAYS_TRUE(p) ) clearSelect(db, p, 1);
 }
 
-/*
-** Delete all the substructure for p, but keep p allocated.  Redefine
-** p to be a single SELECT where every column of the result set has a
-** value of NULL.
-*/
-void sqlite3SelectReset(Parse *pParse, Select *p){
-  if( ALWAYS(p) ){
-    clearSelect(pParse->db, p, 0);
-    memset(&p->iLimit, 0, sizeof(Select) - offsetof(Select,iLimit));
-    p->pEList = sqlite3ExprListAppend(pParse, 0,
-                     sqlite3ExprAlloc(pParse->db,TK_NULL,0,0));
-    p->pSrc = sqlite3DbMallocZero(pParse->db, sizeof(SrcList));
-  }
-}
-
 /*
 ** Return a pointer to the right-most SELECT statement in a compound.
 */
diff --git a/src/sqliteInt.h b/src/sqliteInt.h
index a862f4a6c0..f64ef5d237 100644
--- a/src/sqliteInt.h
+++ b/src/sqliteInt.h
@@ -4248,7 +4248,6 @@ int sqlite3Select(Parse*, Select*, SelectDest*);
 Select *sqlite3SelectNew(Parse*,ExprList*,SrcList*,Expr*,ExprList*,
                          Expr*,ExprList*,u32,Expr*);
 void sqlite3SelectDelete(sqlite3*, Select*);
-void sqlite3SelectReset(Parse*, Select*);
 Table *sqlite3SrcListLookup(Parse*, SrcList*);
 int sqlite3IsReadOnly(Parse*, Table*, int);
 void sqlite3OpenTable(Parse*, int iCur, int iDb, Table*, int);
diff --git a/src/window.c b/src/window.c
index 8656f51b02..602af784a9 100644
--- a/src/window.c
+++ b/src/window.c
@@ -803,6 +803,7 @@ static int selectWindowRewriteExprCb(Walker *pWalker, Expr *pExpr){
         p->pSub = sqlite3ExprListAppend(pParse, p->pSub, pDup);
       }
       if( p->pSub ){
+        int f = pExpr->flags & EP_Collate;
         assert( ExprHasProperty(pExpr, EP_Static)==0 );
         ExprSetProperty(pExpr, EP_Static);
         sqlite3ExprDelete(pParse->db, pExpr);
@@ -813,6 +814,7 @@ static int selectWindowRewriteExprCb(Walker *pWalker, Expr *pExpr){
         pExpr->iColumn = (iCol<0 ? p->pSub->nExpr-1: iCol);
         pExpr->iTable = p->pWin->iEphCsr;
         pExpr->y.pTab = p->pTab;
+        pExpr->flags = f;
       }
       if( pParse->db->mallocFailed ) return WRC_Abort;
       break;
@@ -1082,7 +1084,6 @@ int sqlite3WindowRewrite(Parse *pParse, Select *p){
       assert( pParse->db->mallocFailed );
       sqlite3ErrorToParser(pParse->db, SQLITE_NOMEM);
     }
-    sqlite3SelectReset(pParse, p);
   }
   return rc;
 }
diff --git a/test/corruptL.test b/test/corruptL.test
index 3c26f1d215..6a2fa94fc1 100644
--- a/test/corruptL.test
+++ b/test/corruptL.test
@@ -1266,5 +1266,30 @@ do_test 15.0 {
 do_execsql_test 15.1 {
   UPDATE c1 SET c= NOT EXISTS(SELECT 1 FROM c1 ORDER BY (SELECT 1 FROM c1 ORDER BY a)) +10 WHERE d BETWEEN 4 AND 7;
 } {}
+
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 16.0 {
+  CREATE TABLE t1(w, x, y, z, UNIQUE(w, x), UNIQUE(y, z));
+  INSERT INTO t1 VALUES(1, 1, 1, 1);
+
+  CREATE TABLE t1idx(x, y, i INTEGER, PRIMARY KEY(x)) WITHOUT ROWID;
+  INSERT INTO t1idx VALUES(10, NULL, 5);
+
+  PRAGMA writable_schema = 1;
+  UPDATE sqlite_master SET rootpage = (
+    SELECT rootpage FROM sqlite_master WHERE name='t1idx'
+  ) WHERE type = 'index';
+}
+
+db close
+sqlite3 db test.db
+
+do_catchsql_test 16.1 {
+  PRAGMA writable_schema = ON;
+  INSERT INTO t1(rowid, w, x, y, z) VALUES(5, 10, 11, 10, NULL);
+} {1 {database disk image is malformed}}
+
 finish_test
 
+
diff --git a/test/fts3corrupt4.test b/test/fts3corrupt4.test
index 85d62b33a4..90a7c7d4c2 100644
--- a/test/fts3corrupt4.test
+++ b/test/fts3corrupt4.test
@@ -6266,5 +6266,20 @@ do_catchsql_test 45.2 {
   INSERT INTO x1(x1) VALUES( 'merge=1' )
 } {1 {database disk image is malformed}}
 
+#-------------------------------------------------------------------------
+reset_db
+set saved $sqlite_fts3_enable_parentheses
+set sqlite_fts3_enable_parentheses 1
+do_execsql_test 46.1 {
+  CREATE VIRTUAL TABLE t0 USING fts3(a INTEGER PRIMARY KEY,b,c,d);
+  INSERT INTO t0_segdir VALUES(0,0,0,0,'0 42',X'0001310301c9000103323334050d8000f200000461616161050101020200000462626262050101030200');
+} {}
+
+do_catchsql_test 46.2 {
+  SELECT * FROM t0
+    WHERE t0 MATCH x'2b0a312b0a312a312a2a0b5d0a0b0b0a312a0a0b0b0a312a0b310a392a0b0a27312a2a0b5d0a312a0b310a31315d0b310a312a316d2a0b313b15bceaa50a312a0b0a27312a2a0b5d0a312a0b310a312b0b2a310a312a0b2a0b2a0b2e5d0a0bff313336e34a2a312a0b0a3c310b0a0b4b4b0b4b2a4bec40322b2a0b310a0a312a0a0a0a0a0a0a0a0a0b310a312a2a2a0b5d0a0b0b0a312a0b310a312a0b0a4e4541530b310a5df5ced70a0a0a0a0a4f520a0a0a0a0a0a0a312a0b0a4e4541520b310a5d616161610a0a0a0a4f520a0a0a0a0a0a312b0a312a312a0a0a0a0a0a0a004a0b0a310b220a0b0a310a4a22310a0b0a7e6fe0e0e030e0e0e0e0e01176e02000e0e0e0e0e01131320226310a0b0a310a4a22310a0b0a310a766f8b8b4ee0e0300ae0090909090909090909090909090909090909090909090909090909090909090947aaaa540b09090909090909090909090909090909090909090909090909090909090909fae0e0f2f22164e0e0f273e07fefefef7d6dfafafafa6d6d6d6d';
+} {1 {database disk image is malformed}}
+
+set sqlite_fts3_enable_parentheses $saved
 
 finish_test
diff --git a/test/fuzzdata8.db b/test/fuzzdata8.db
index 77e2b9fa15..d45392ac7c 100644
Binary files a/test/fuzzdata8.db and b/test/fuzzdata8.db differ
diff --git a/test/window1.test b/test/window1.test
index 618d95e685..dbaf4388fb 100644
--- a/test/window1.test
+++ b/test/window1.test
@@ -1947,4 +1947,58 @@ do_execsql_test 63.3 {
   FROM t1;
 } {{}}
 
+#-------------------------------------------------------------------------
+reset_db 
+do_execsql_test 64.1 {
+  CREATE TABLE t1(a INTEGER PRIMARY KEY, b);
+  INSERT INTO t1 VALUES(1, 'abcd');
+  INSERT INTO t1 VALUES(2, 'BCDE');
+  INSERT INTO t1 VALUES(3, 'cdef');
+  INSERT INTO t1 VALUES(4, 'DEFG');
+}
+
+do_execsql_test 64.2 {
+  SELECT rowid, max(b COLLATE nocase)||'' 
+  FROM t1 
+  GROUP BY rowid
+  ORDER BY max(b COLLATE nocase)||'';
+} {1 abcd 2 BCDE 3 cdef 4 DEFG}
+
+do_execsql_test 64.3 {
+  SELECT count() OVER (), rowid, max(b COLLATE nocase)||'' 
+  FROM t1 
+  GROUP BY rowid
+  ORDER BY max(b COLLATE nocase)||'';
+} {4 1 abcd   4 2 BCDE   4 3 cdef   4 4 DEFG}
+
+do_execsql_test 64.4 {
+  SELECT count() OVER (), rowid, max(b COLLATE nocase)
+  FROM t1 
+  GROUP BY rowid
+  ORDER BY max(b COLLATE nocase);
+} {4 1 abcd   4 2 BCDE   4 3 cdef   4 4 DEFG}
+
+#-------------------------------------------------------------------------
+reset_db 
+do_execsql_test 65.1 {
+  CREATE TABLE t1(c1);
+  INSERT INTO t1 VALUES('abcd');
+}
+do_execsql_test 65.2 {
+  SELECT max(c1 COLLATE nocase) IN (SELECT 'aBCd') FROM t1;
+} {1}
+
+do_execsql_test 65.3 {
+  SELECT 
+     count() OVER (), 
+     group_concat(c1 COLLATE nocase) IN (SELECT 'aBCd') FROM t1;
+} {1 1}
+
+do_execsql_test 65.4 {
+  SELECT COUNT() OVER () LIKE lead(102030) OVER(
+      ORDER BY sum('abcdef' COLLATE nocase) IN (SELECT 54321) 
+  )
+  FROM t1;
+} {{}}
+
 finish_test