Fix a false-positive in the register validity tracking logic by moving the

temporary register release call before the jump that uses that temporary
register.

FossilOrigin-Name: 9da48a5ca66dc67c8f7fb2d2471dac7ea696e35ecba5ddf65747d08d452436c1

manifest

@@ -1,5 +1,5 @@
-C Improve\sa\stestcase\sin\stest/fuzzdata8.db\sto\smake\sit\smore\sresilient.
-D 2020-01-04T14:57:26.289
+C Fix\sa\sfalse-positive\sin\sthe\sregister\svalidity\stracking\slogic\sby\smoving\sthe\ntemporary\sregister\srelease\scall\sbefore\sthe\sjump\sthat\suses\sthat\stemporary\nregister.
+D 2020-01-04T15:21:47.201
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
 F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724
@@ -480,7 +480,7 @@ F src/date.c e1d8ac7102f3f283e63e13867acb0efa33861cf34f0faf4cdbaf9fa7a1eb7041
 F src/dbpage.c 135eb3b5e74f9ef74bde5cec2571192c90c86984fa534c88bf4a055076fa19b7
 F src/dbstat.c 427b13c25884ffdf55739a1d23c989326adbba284637b9d767d1aa7b21cadfc2
 F src/delete.c a5c59b9c0251cf7682bc52af0d64f09b1aefc6781a63592c8f1136f7b73c66e4
-F src/expr.c 70af050710e92b16dac5498005e77a8fd799eda31cac19f641da5b0531cccb03
+F src/expr.c e25df342c1b8b9b87b5d6f9990e5b36f94469b1227c0a492cb5894e379f983ea
 F src/fault.c 460f3e55994363812d9d60844b2a6de88826e007
 F src/fkey.c 92a248ec0fa4ed8ab60c98d9b188ce173aaf218f32e7737ba77deb2a684f9847
 F src/func.c 259496e4856bd0a3215d16804992f3339f3e8db29f129a5a7285c341488bbe9c
@@ -1575,7 +1575,7 @@ F test/trans.test 6e1b4c6a42dba31bd65f8fa5e61a2708e08ddde6
 F test/trans2.test 62bd045bfc7a1c14c5ba83ba64d21ade31583f76
 F test/trans3.test 91a100e5412b488e22a655fe423a14c26403ab94
 F test/transitive1.test 293300f46916569f08875cdb2fe2134be2c27677
-F test/trigger1.test 746dc327e2a0817a22bfc6f5a5e423483d3e77b3733ac20a8fe939e6541b5e53
+F test/trigger1.test d30cd09ae8ac365a088f09daba583cc5c0b8fc7d4e1d70809d0b4be3bf6ae2ab
 F test/trigger2.test d15da46f7012832faf3e0c536b47024409d5fb1722d2bb77e29c06d96d704bb1
 F test/trigger3.test aa640bb2bbb03edd5ff69c055117ea088f121945
 F test/trigger4.test 74700b76ebf3947b2f7a92405141eb2cf2a5d359
@@ -1853,7 +1853,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93
 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc
 F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e
 F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0
-P 61f873b14c2c835f3d10b018b357cb8b1f041e97e05709d7ab5a8055e5e05349
-R a6b030e798f523982578466cdc9cdeea
+P 139aefe60097e06b43df35652e6b2183b7a4b03341d1bde23deada3fa3358fee
+R 11e5473b5143d7846f38adea04bf0957
 U drh
-Z f7cd76a50975d6790984fae51f4c2498
+Z a198852404260f5a9fb2ceb446a14f63

manifest.uuid

@@ -1 +1 @@
-139aefe60097e06b43df35652e6b2183b7a4b03341d1bde23deada3fa3358fee
+9da48a5ca66dc67c8f7fb2d2471dac7ea696e35ecba5ddf65747d08d452436c1

src/expr.c

@@ -3209,6 +3209,7 @@ static void sqlite3ExprCodeIN(
       if( regCkNull && sqlite3ExprCanBeNull(pList->a[ii].pExpr) ){
         sqlite3VdbeAddOp3(v, OP_BitAnd, regCkNull, r2, regCkNull);
       }
+      sqlite3ReleaseTempReg(pParse, regToFree);
       if( ii<pList->nExpr-1 || destIfNull!=destIfFalse ){
         int op = rLhs!=r2 ? OP_Eq : OP_NotNull;
         sqlite3VdbeAddOp4(v, op, rLhs, labelOk, r2,
@@ -3227,7 +3228,6 @@ static void sqlite3ExprCodeIN(
         VdbeCoverageIf(v, op==OP_IsNull);
         sqlite3VdbeChangeP5(v, zAff[0] | SQLITE_JUMPIFNULL);
       }
-      sqlite3ReleaseTempReg(pParse, regToFree);
     }
     if( regCkNull ){
       sqlite3VdbeAddOp2(v, OP_IsNull, regCkNull, destIfNull); VdbeCoverage(v);

test/trigger1.test

@@ -798,4 +798,33 @@ do_execsql_test trigger1-21.1 {
   SELECT * FROM t0;
 } {2 0 9}
 
+# 2020-01-04 From Yongheng
+# The test case below caused problems for the register validity
+# tracking logic.  There was no bug in the release build.  The
+# only problem was a false-positive in the register validity
+# tracking.
+#
+reset_db
+do_execsql_test trigger1-22.10 {
+  CREATE TABLE t1(
+    a INTEGER PRIMARY KEY,
+    b DOUBLE
+  );
+  CREATE TRIGGER x AFTER UPDATE ON t1 BEGIN
+   SELECT sum(b)OVER(ORDER BY (SELECT b FROM t1 AS x 
+                               WHERE b IN (t1.a,127,t1.b)
+                               GROUP BY b))
+     FROM t1
+     GROUP BY a;
+  END;
+  CREATE TEMP TRIGGER x BEFORE INSERT ON t1 BEGIN
+    UPDATE t1
+       SET b=randomblob(10)
+     WHERE b >= 'E'
+       AND a < (SELECT a FROM t1 WHERE a<22 GROUP BY b);
+  END;
+  INSERT INTO t1(b) VALUES('Y'),('X'),('Z');
+  SELECT a, CASE WHEN typeof(b)='text' THEN quote(b) ELSE '<blob>' END, '|' FROM t1;
+} {1 <blob> | 2 'X' | 3 'Z' |}
+
 finish_test