Index: Makefile.msc
==================================================================
--- Makefile.msc
+++ Makefile.msc
@@ -792,15 +792,15 @@
 !IFNDEF TCLLIBDIR
 TCLLIBDIR = c:\tcl\lib
 !ENDIF
 
 !IFNDEF LIBTCL
-LIBTCL = tcl85.lib
+LIBTCL = tcl86.lib
 !ENDIF
 
 !IFNDEF LIBTCLSTUB
-LIBTCLSTUB = tclstub85.lib
+LIBTCLSTUB = tclstub86.lib
 !ENDIF
 
 !IFNDEF LIBTCLPATH
 LIBTCLPATH = c:\tcl\bin
 !ENDIF
@@ -826,11 +826,11 @@
 # know the specific version we want to use.  This variable (TCLSH_CMD) may be
 # overridden via the environment prior to running nmake in order to select a
 # specific Tcl shell to use.
 #
 !IFNDEF TCLSH_CMD
-TCLSH_CMD = tclsh85
+TCLSH_CMD = tclsh
 !ENDIF
 # <</mark>>
 
 # Compiler options needed for programs that use the readline() library.
 #

Index: VERSION
==================================================================
--- VERSION
+++ VERSION
@@ -1,1 +1,1 @@
-3.15.0
+3.15.2

Index: configure
==================================================================
--- configure
+++ configure
@@ -1,8 +1,8 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for sqlite 3.15.0.
+# Generated by GNU Autoconf 2.69 for sqlite 3.15.2.
 #
 #
 # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc.
 #
 #
@@ -724,12 +724,12 @@
 MAKEFLAGS=
 
 # Identity of this package.
 PACKAGE_NAME='sqlite'
 PACKAGE_TARNAME='sqlite'
-PACKAGE_VERSION='3.15.0'
-PACKAGE_STRING='sqlite 3.15.0'
+PACKAGE_VERSION='3.15.2'
+PACKAGE_STRING='sqlite 3.15.2'
 PACKAGE_BUGREPORT=''
 PACKAGE_URL=''
 
 # Factoring default headers for most tests.
 ac_includes_default="\
@@ -1461,11 +1461,11 @@
 #
 if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures sqlite 3.15.0 to adapt to many kinds of systems.
+\`configure' configures sqlite 3.15.2 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
 To assign environment variables (e.g., CC, CFLAGS...), specify them as
 VAR=VALUE.  See below for descriptions of some of the useful variables.
@@ -1526,11 +1526,11 @@
 _ACEOF
 fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of sqlite 3.15.0:";;
+     short | recursive ) echo "Configuration of sqlite 3.15.2:";;
    esac
   cat <<\_ACEOF
 
 Optional Features:
   --disable-option-checking  ignore unrecognized --enable/--with options
@@ -1650,11 +1650,11 @@
 fi
 
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-sqlite configure 3.15.0
+sqlite configure 3.15.2
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
 This configure script is free software; the Free Software Foundation
 gives unlimited permission to copy, distribute and modify it.
@@ -2069,11 +2069,11 @@
 } # ac_fn_c_check_header_mongrel
 cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by sqlite $as_me 3.15.0, which was
+It was created by sqlite $as_me 3.15.2, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
 
 _ACEOF
@@ -12149,11 +12149,11 @@
 cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # Save the log message, to keep $0 and so on meaningful, and to
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by sqlite $as_me 3.15.0, which was
+This file was extended by sqlite $as_me 3.15.2, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
   CONFIG_HEADERS  = $CONFIG_HEADERS
   CONFIG_LINKS    = $CONFIG_LINKS
@@ -12215,11 +12215,11 @@
 
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-sqlite config.status 3.15.0
+sqlite config.status 3.15.2
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 
 Copyright (C) 2012 Free Software Foundation, Inc.
 This config.status script is free software; the Free Software Foundation

Index: ext/fts5/fts5_expr.c
==================================================================
--- ext/fts5/fts5_expr.c
+++ ext/fts5/fts5_expr.c
@@ -918,11 +918,11 @@
             pNode->bEof = 1;
             return rc;
           }
         }else{
           Fts5IndexIter *pIter = pPhrase->aTerm[j].pIter;
-          if( pIter->iRowid==iLast ) continue;
+          if( pIter->iRowid==iLast || pIter->bEof ) continue;
           bMatch = 0;
           if( fts5ExprAdvanceto(pIter, bDesc, &iLast, &rc, &pNode->bEof) ){
             return rc;
           }
         }

Index: ext/fts5/fts5_index.c
==================================================================
--- ext/fts5/fts5_index.c
+++ ext/fts5/fts5_index.c
@@ -2838,10 +2838,11 @@
   Fts5Iter *pIter,
   int bFrom,                      /* True if argument iFrom is valid */
   i64 iFrom                       /* Advance at least as far as this */
 ){
   int bUseFrom = bFrom;
+  assert( pIter->base.bEof==0 );
   while( p->rc==SQLITE_OK ){
     int iFirst = pIter->aFirst[1].iFirst;
     int bNewTerm = 0;
     Fts5SegIter *pSeg = &pIter->aSeg[iFirst];
     assert( p->rc==SQLITE_OK );

Index: ext/fts5/test/fts5simple3.test
==================================================================
--- ext/fts5/test/fts5simple3.test
+++ ext/fts5/test/fts5simple3.test
@@ -77,9 +77,43 @@
   INSERT INTO x3 VALUES('a b c');
   INSERT INTO x3 VALUES('c b a');
   INSERT INTO x3 VALUES('o t t');
   SELECT * FROM x3('x OR y OR z');
 }
+
+#-------------------------------------------------------------------------
+# Test that a crash occuring when the second or subsequent tokens in a
+# phrase matched zero rows has been fixed.
+#
+do_execsql_test 4.0 {
+  CREATE VIRTUAL TABLE t1 USING fts5(x);
+  INSERT INTO t1 VALUES('ab');
+  INSERT INTO t1 VALUES('cd');
+  INSERT INTO t1 VALUES('ab cd');
+  INSERT INTO t1 VALUES('ab cdXXX');
+  INSERT INTO t1 VALUES('abXXX cd');
+}
+do_execsql_test 4.1 {
+  SELECT * FROM t1('"ab cd" OR "ab cd" *');
+} {{ab cd} {ab cdXXX}}
+do_execsql_test 4.2 {
+  SELECT * FROM t1('"xy zz" OR "ab cd" *');
+} {{ab cd} {ab cdXXX}}
+do_execsql_test 4.3 {
+  SELECT * FROM t1('"xy zz" OR "xy zz" *');
+}
+do_execsql_test 4.4 {
+  SELECT * FROM t1('"ab cd" OR "xy zz" *');
+} {{ab cd}}
+do_execsql_test 4.5 {
+  CREATE VIRTUAL TABLE t2 USING fts5(x);
+  INSERT INTO t2 VALUES('ab');
+  INSERT INTO t2 VALUES('cd');
+  INSERT INTO t2 VALUES('ef');
+} 
+do_execsql_test 4.6 {
+  SELECT * FROM t2('ab + xyz');
+}
 
 
 finish_test
 

Index: ext/icu/icu.c
==================================================================
--- ext/icu/icu.c
+++ ext/icu/icu.c
@@ -347,11 +347,11 @@
 ** of the locale to use. Passing an empty string ("") or SQL NULL value
 ** as the second argument is the same as invoking the 1 argument version
 ** of upper() or lower().
 **
 **     lower('I', 'en_us') -> 'i'
-**     lower('I', 'tr_tr') -> 'ı' (small dotless i)
+**     lower('I', 'tr_tr') -> '\u131' (small dotless i)
 **
 ** http://www.icu-project.org/userguide/posix.html#case_mappings
 */
 static void icuCaseFunc16(sqlite3_context *p, int nArg, sqlite3_value **apArg){
   const UChar *zInput;            /* Pointer to input string */
@@ -498,24 +498,24 @@
     int nArg;                                 /* Number of arguments */
     int enc;                                  /* Optimal text encoding */
     void *pContext;                           /* sqlite3_user_data() context */
     void (*xFunc)(sqlite3_context*,int,sqlite3_value**);
   } scalars[] = {
-    {"regexp", 2, SQLITE_ANY,          0, icuRegexpFunc},
-
-    {"lower",  1, SQLITE_UTF16,        0, icuCaseFunc16},
-    {"lower",  2, SQLITE_UTF16,        0, icuCaseFunc16},
-    {"upper",  1, SQLITE_UTF16, (void*)1, icuCaseFunc16},
-    {"upper",  2, SQLITE_UTF16, (void*)1, icuCaseFunc16},
-
-    {"lower",  1, SQLITE_UTF8,         0, icuCaseFunc16},
-    {"lower",  2, SQLITE_UTF8,         0, icuCaseFunc16},
-    {"upper",  1, SQLITE_UTF8,  (void*)1, icuCaseFunc16},
-    {"upper",  2, SQLITE_UTF8,  (void*)1, icuCaseFunc16},
-
-    {"like",   2, SQLITE_UTF8,         0, icuLikeFunc},
-    {"like",   3, SQLITE_UTF8,         0, icuLikeFunc},
+    {"regexp", 2, SQLITE_ANY|SQLITE_DETERMINISTIC,          0, icuRegexpFunc},
+
+    {"lower",  1, SQLITE_UTF16|SQLITE_DETERMINISTIC,        0, icuCaseFunc16},
+    {"lower",  2, SQLITE_UTF16|SQLITE_DETERMINISTIC,        0, icuCaseFunc16},
+    {"upper",  1, SQLITE_UTF16|SQLITE_DETERMINISTIC, (void*)1, icuCaseFunc16},
+    {"upper",  2, SQLITE_UTF16|SQLITE_DETERMINISTIC, (void*)1, icuCaseFunc16},
+
+    {"lower",  1, SQLITE_UTF8|SQLITE_DETERMINISTIC,         0, icuCaseFunc16},
+    {"lower",  2, SQLITE_UTF8|SQLITE_DETERMINISTIC,         0, icuCaseFunc16},
+    {"upper",  1, SQLITE_UTF8|SQLITE_DETERMINISTIC,  (void*)1, icuCaseFunc16},
+    {"upper",  2, SQLITE_UTF8|SQLITE_DETERMINISTIC,  (void*)1, icuCaseFunc16},
+
+    {"like",   2, SQLITE_UTF8|SQLITE_DETERMINISTIC,         0, icuLikeFunc},
+    {"like",   3, SQLITE_UTF8|SQLITE_DETERMINISTIC,         0, icuLikeFunc},
 
     {"icu_load_collation",  2, SQLITE_UTF8, (void*)db, icuLoadCollation},
   };
 
   int rc = SQLITE_OK;

Index: ext/misc/json1.c
==================================================================
--- ext/misc/json1.c
+++ ext/misc/json1.c
@@ -47,17 +47,19 @@
 ** to pass signed char values.
 */
 #ifdef sqlite3Isdigit
    /* Use the SQLite core versions if this routine is part of the
    ** SQLite amalgamation */
-#  define safe_isdigit(x) sqlite3Isdigit(x)
-#  define safe_isalnum(x) sqlite3Isalnum(x)
+#  define safe_isdigit(x)  sqlite3Isdigit(x)
+#  define safe_isalnum(x)  sqlite3Isalnum(x)
+#  define safe_isxdigit(x) sqlite3Isxdigit(x)
 #else
    /* Use the standard library for separate compilation */
 #include <ctype.h>  /* amalgamator: keep */
-#  define safe_isdigit(x) isdigit((unsigned char)(x))
-#  define safe_isalnum(x) isalnum((unsigned char)(x))
+#  define safe_isdigit(x)  isdigit((unsigned char)(x))
+#  define safe_isalnum(x)  isalnum((unsigned char)(x))
+#  define safe_isxdigit(x) isxdigit((unsigned char)(x))
 #endif
 
 /*
 ** Growing our own isspace() routine this way is twice as fast as
 ** the library isspace() function, resulting in a 7% overall performance
@@ -699,10 +701,19 @@
   p->iVal = 0;
   p->n = n;
   p->u.zJContent = zContent;
   return pParse->nNode++;
 }
+
+/*
+** Return true if z[] begins with 4 (or more) hexadecimal digits
+*/
+static int jsonIs4Hex(const char *z){
+  int i;
+  for(i=0; i<4; i++) if( !safe_isxdigit(z[i]) ) return 0;
+  return 1;
+}
 
 /*
 ** Parse a single JSON value which begins at pParse->zJson[i].  Return the
 ** index of the first character past the end of the value parsed.
 **
@@ -774,12 +785,17 @@
     for(;;){
       c = pParse->zJson[j];
       if( c==0 ) return -1;
       if( c=='\\' ){
         c = pParse->zJson[++j];
-        if( c==0 ) return -1;
-        jnFlags = JNODE_ESCAPE;
+        if( c=='"' || c=='\\' || c=='/' || c=='b' || c=='f'
+           || c=='n' || c=='r' || c=='t'
+           || (c=='u' && jsonIs4Hex(pParse->zJson+j+1)) ){
+          jnFlags = JNODE_ESCAPE;
+        }else{
+          return -1;
+        }
       }else if( c=='"' ){
         break;
       }
       j++;
     }
@@ -1643,11 +1659,11 @@
   JsonString *pStr;
   pStr = (JsonString*)sqlite3_aggregate_context(ctx, 0);
   if( pStr ){
     jsonAppendChar(pStr, '}');
     if( pStr->bErr ){
-      if( pStr->bErr==0 ) sqlite3_result_error_nomem(ctx);
+      if( pStr->bErr==1 ) sqlite3_result_error_nomem(ctx);
       assert( pStr->bStatic );
     }else{
       sqlite3_result_text(ctx, pStr->zBuf, pStr->nUsed,
                           pStr->bStatic ? SQLITE_TRANSIENT : sqlite3_free);
       pStr->bStatic = 1;
@@ -1921,13 +1937,13 @@
         break;
       }
       /* For json_each() path and root are the same so fall through
       ** into the root case */
     }
-    case JEACH_ROOT: {
+    default: {
       const char *zRoot = p->zRoot;
-       if( zRoot==0 ) zRoot = "$";
+      if( zRoot==0 ) zRoot = "$";
       sqlite3_result_text(ctx, zRoot, -1, SQLITE_STATIC);
       break;
     }
     case JEACH_JSON: {
       assert( i==JEACH_JSON );

ADDED   ext/rbu/rbudor.test
Index: ext/rbu/rbudor.test
==================================================================
--- /dev/null
+++ ext/rbu/rbudor.test
@@ -0,0 +1,59 @@
+# 2016 October 21
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+#
+# This test file focuses on interactions between RBU and the feature
+# enabled by SQLITE_DIRECT_OVERFLOW_READ - Direct Overflow Read.
+#
+
+if {![info exists testdir]} {
+  set testdir [file join [file dirname [info script]] .. .. test]
+}
+source $testdir/tester.tcl
+set ::testprefix rbudor
+
+set bigA [string repeat a 5000]
+set bigB [string repeat b 5000]
+do_execsql_test 1.0 {
+  PRAGMA page_size = 1024;
+  CREATE TABLE t1(a INTEGER PRIMARY KEY, b BLOB);
+  INSERT INTO t1 VALUES(1, $bigA);
+} {}
+
+do_test 1.1 {
+  forcedelete rbu.db
+  sqlite3 rbu rbu.db 
+  rbu eval {
+    CREATE TABLE data_t1(a, b, rbu_control);
+    INSERT INTO data_t1 VALUES(2, $bigB, 0);
+  }
+  rbu close
+} {}
+
+do_test 1.2 {
+  sqlite3rbu rbu test.db rbu.db
+  while {[rbu state]!="checkpoint"} {
+    rbu step
+  }
+  rbu step
+  db eval { SELECT * FROM t1 }
+} [list 1 $bigA 2 $bigB]
+
+do_test 1.3 {
+  while {[rbu step]=="SQLITE_OK"} {}
+  rbu close
+} {SQLITE_DONE}
+
+do_execsql_test 1.4 {
+  SELECT * FROM t1 
+} [list 1 $bigA 2 $bigB]
+
+finish_test
+

Index: ext/session/session1.test
==================================================================
--- ext/session/session1.test
+++ ext/session/session1.test
@@ -567,7 +567,19 @@
   {INSERT $tblname 0 X. {} {t uvw t abc}}
   {DELETE $tblname 0 X. {t xyz t def} {}}
 "
 do_test 10.1.4 { S delete } {}
 
+#-------------------------------------------------------------------------
+# Test the effect of updating a column from 0.0 to 0.0.
+#
+reset_db
+do_execsql_test 11.1 {
+  CREATE TABLE t1(a INTEGER PRIMARY KEY, b REAL);
+  INSERT INTO t1 VALUES(1, 0.0);
+}
+do_iterator_test 11.2 * {
+  UPDATE t1 SET b = 0.0;
+} {
+}
 
 finish_test

Index: src/attach.c
==================================================================
--- src/attach.c
+++ src/attach.c
@@ -323,10 +323,11 @@
   NameContext sName;
   Vdbe *v;
   sqlite3* db = pParse->db;
   int regArgs;
 
+  if( pParse->nErr ) goto attach_end;
   memset(&sName, 0, sizeof(NameContext));
   sName.pParse = pParse;
 
   if( 
       SQLITE_OK!=(rc = resolveAttachExpr(&sName, pFilename)) ||

Index: src/btree.c
==================================================================
--- src/btree.c
+++ src/btree.c
@@ -4599,11 +4599,11 @@
         if( (eOp&0x01)==0                                      /* (1) */
          && offset==0                                          /* (2) */
          && (bEnd || a==ovflSize)                              /* (6) */
          && pBt->inTransaction==TRANS_READ                     /* (4) */
          && (fd = sqlite3PagerFile(pBt->pPager))->pMethods     /* (3) */
-         && pBt->pPage1->aData[19]==0x01                       /* (5) */
+         && 0==sqlite3PagerUseWal(pBt->pPager)                 /* (5) */
          && &pBuf[-4]>=pBufStart                               /* (7) */
         ){
           u8 aSave[4];
           u8 *aWrite = &pBuf[-4];
           assert( aWrite>=pBufStart );                         /* hence (7) */

Index: src/expr.c
==================================================================
--- src/expr.c
+++ src/expr.c
@@ -3294,11 +3294,11 @@
     }else{
       int i;
       iResult = pParse->nMem+1;
       pParse->nMem += nResult;
       for(i=0; i<nResult; i++){
-        sqlite3ExprCode(pParse, p->x.pList->a[i].pExpr, i+iResult);
+        sqlite3ExprCodeFactorable(pParse, p->x.pList->a[i].pExpr, i+iResult);
       }
     }
   }
   return iResult;
 }

Index: src/func.c
==================================================================
--- src/func.c
+++ src/func.c
@@ -206,10 +206,12 @@
     isText = 0;
   }else{
     zHaystack = sqlite3_value_text(argv[0]);
     zNeedle = sqlite3_value_text(argv[1]);
     isText = 1;
+    if( zNeedle==0 ) return;
+    assert( zHaystack );
   }
   while( nNeedle<=nHaystack && memcmp(zHaystack, zNeedle, nNeedle)!=0 ){
     N++;
     do{
       nHaystack--;

Index: src/os_win.c
==================================================================
--- src/os_win.c
+++ src/os_win.c
@@ -3485,10 +3485,16 @@
       }else{
         a[1] = winIoerrRetryDelay;
       }
       OSTRACE(("FCNTL file=%p, rc=SQLITE_OK\n", pFile->h));
       return SQLITE_OK;
+    }
+    case SQLITE_FCNTL_WIN32_GET_HANDLE: {
+      LPHANDLE phFile = (LPHANDLE)pArg;
+      *phFile = pFile->h;
+      OSTRACE(("FCNTL file=%p, rc=SQLITE_OK\n", pFile->h));
+      return SQLITE_OK;
     }
 #ifdef SQLITE_TEST
     case SQLITE_FCNTL_WIN32_SET_HANDLE: {
       LPHANDLE phFile = (LPHANDLE)pArg;
       HANDLE hOldFile = pFile->h;

Index: src/pager.c
==================================================================
--- src/pager.c
+++ src/pager.c
@@ -815,13 +815,14 @@
 /*
 ** Return true if this pager uses a write-ahead log instead of the usual
 ** rollback journal. Otherwise false.
 */
 #ifndef SQLITE_OMIT_WAL
-static int pagerUseWal(Pager *pPager){
+int sqlite3PagerUseWal(Pager *pPager){
   return (pPager->pWal!=0);
 }
+# define pagerUseWal(x) sqlite3PagerUseWal(x)
 #else
 # define pagerUseWal(x) 0
 # define pagerRollbackWal(x) 0
 # define pagerWalFrames(v,w,x,y) 0
 # define pagerOpenWalIfPresent(z) SQLITE_OK

Index: src/pager.h
==================================================================
--- src/pager.h
+++ src/pager.h
@@ -176,14 +176,17 @@
   int sqlite3PagerCheckpoint(Pager *pPager, int, int*, int*);
   int sqlite3PagerWalSupported(Pager *pPager);
   int sqlite3PagerWalCallback(Pager *pPager);
   int sqlite3PagerOpenWal(Pager *pPager, int *pisOpen);
   int sqlite3PagerCloseWal(Pager *pPager);
+  int sqlite3PagerUseWal(Pager *pPager);
 # ifdef SQLITE_ENABLE_SNAPSHOT
   int sqlite3PagerSnapshotGet(Pager *pPager, sqlite3_snapshot **ppSnapshot);
   int sqlite3PagerSnapshotOpen(Pager *pPager, sqlite3_snapshot *pSnapshot);
 # endif
+#else
+# define sqlite3PagerUseWal(x) 0
 #endif
 
 #ifdef SQLITE_ENABLE_ZIPVFS
   int sqlite3PagerWalFramesize(Pager *pPager);
 #endif

Index: src/resolve.c
==================================================================
--- src/resolve.c
+++ src/resolve.c
@@ -397,10 +397,14 @@
           assert( pExpr->x.pSelect==0 );
           pOrig = pEList->a[j].pExpr;
           if( (pNC->ncFlags&NC_AllowAgg)==0 && ExprHasProperty(pOrig, EP_Agg) ){
             sqlite3ErrorMsg(pParse, "misuse of aliased aggregate %s", zAs);
             return WRC_Abort;
+          }
+          if( sqlite3ExprVectorSize(pOrig)!=1 ){
+            sqlite3ErrorMsg(pParse, "row value misused");
+            return WRC_Abort;
           }
           resolveAlias(pParse, pEList, j, pExpr, "", nSubquery);
           cnt = 1;
           pMatch = 0;
           assert( zTab==0 && zDb==0 );
@@ -774,10 +778,11 @@
     }
     case TK_VARIABLE: {
       notValid(pParse, pNC, "parameters", NC_IsCheck|NC_PartIdx|NC_IdxExpr);
       break;
     }
+    case TK_BETWEEN:
     case TK_EQ:
     case TK_NE:
     case TK_LT:
     case TK_LE:
     case TK_GT:
@@ -784,23 +789,31 @@
     case TK_GE:
     case TK_IS:
     case TK_ISNOT: {
       int nLeft, nRight;
       if( pParse->db->mallocFailed ) break;
-      assert( pExpr->pRight!=0 );
       assert( pExpr->pLeft!=0 );
       nLeft = sqlite3ExprVectorSize(pExpr->pLeft);
-      nRight = sqlite3ExprVectorSize(pExpr->pRight);
+      if( pExpr->op==TK_BETWEEN ){
+        nRight = sqlite3ExprVectorSize(pExpr->x.pList->a[0].pExpr);
+        if( nRight==nLeft ){
+          nRight = sqlite3ExprVectorSize(pExpr->x.pList->a[1].pExpr);
+        }
+      }else{
+        assert( pExpr->pRight!=0 );
+        nRight = sqlite3ExprVectorSize(pExpr->pRight);
+      }
       if( nLeft!=nRight ){
         testcase( pExpr->op==TK_EQ );
         testcase( pExpr->op==TK_NE );
         testcase( pExpr->op==TK_LT );
         testcase( pExpr->op==TK_LE );
         testcase( pExpr->op==TK_GT );
         testcase( pExpr->op==TK_GE );
         testcase( pExpr->op==TK_IS );
         testcase( pExpr->op==TK_ISNOT );
+        testcase( pExpr->op==TK_BETWEEN );
         sqlite3ErrorMsg(pParse, "row value misused");
       }
       break; 
     }
   }

Index: src/sqlite.h.in
==================================================================
--- src/sqlite.h.in
+++ src/sqlite.h.in
@@ -975,10 +975,16 @@
 ** <li>[[SQLITE_FCNTL_HAS_MOVED]]
 ** The [SQLITE_FCNTL_HAS_MOVED] file control interprets its argument as a
 ** pointer to an integer and it writes a boolean into that integer depending
 ** on whether or not the file has been renamed, moved, or deleted since it
 ** was first opened.
+**
+** <li>[[SQLITE_FCNTL_WIN32_GET_HANDLE]]
+** The [SQLITE_FCNTL_WIN32_GET_HANDLE] opcode can be used to obtain the
+** underlying native file handle associated with a file handle.  This file
+** control interprets its argument as a pointer to a native file handle and
+** writes the resulting value there.
 **
 ** <li>[[SQLITE_FCNTL_WIN32_SET_HANDLE]]
 ** The [SQLITE_FCNTL_WIN32_SET_HANDLE] opcode is used for debugging.  This
 ** opcode causes the xFileControl method to swap the file handle with the one
 ** pointed to by the pArg argument.  This capability is used during testing
@@ -1026,10 +1032,11 @@
 #define SQLITE_FCNTL_WAL_BLOCK              24
 #define SQLITE_FCNTL_ZIPVFS                 25
 #define SQLITE_FCNTL_RBU                    26
 #define SQLITE_FCNTL_VFS_POINTER            27
 #define SQLITE_FCNTL_JOURNAL_POINTER        28
+#define SQLITE_FCNTL_WIN32_GET_HANDLE       29
 
 /* deprecated names */
 #define SQLITE_GET_LOCKPROXYFILE      SQLITE_FCNTL_GET_LOCKPROXYFILE
 #define SQLITE_SET_LOCKPROXYFILE      SQLITE_FCNTL_SET_LOCKPROXYFILE
 #define SQLITE_LAST_ERRNO             SQLITE_FCNTL_LAST_ERRNO

Index: src/sqliteInt.h
==================================================================
--- src/sqliteInt.h
+++ src/sqliteInt.h
@@ -2944,19 +2944,19 @@
     int iReg;             /* Reg with value of this column. 0 means none. */
     int lru;              /* Least recently used entry has the smallest value */
   } aColCache[SQLITE_N_COLCACHE];  /* One for each column cache entry */
   int aTempReg[8];        /* Holding area for temporary registers */
   Token sNameToken;       /* Token with unqualified schema object name */
-  Token sLastToken;       /* The last token parsed */
 
   /************************************************************************
   ** Above is constant between recursions.  Below is reset before and after
   ** each recursion.  The boundary between these two regions is determined
-  ** using offsetof(Parse,nVar) so the nVar field must be the first field
-  ** in the recursive region.
+  ** using offsetof(Parse,sLastToken) so the sLastToken field must be the
+  ** first field in the recursive region.
   ************************************************************************/
 
+  Token sLastToken;       /* The last token parsed */
   ynVar nVar;               /* Number of '?' variables seen in the SQL so far */
   int nzVar;                /* Number of available slots in azVar[] */
   u8 iPkSortOrder;          /* ASC or DESC for INTEGER PRIMARY KEY */
   u8 explain;               /* True if the EXPLAIN flag is found on the query */
 #ifndef SQLITE_OMIT_VIRTUALTABLE
@@ -2986,11 +2986,11 @@
 
 /*
 ** Sizes and pointers of various parts of the Parse object.
 */
 #define PARSE_HDR_SZ offsetof(Parse,aColCache) /* Recursive part w/o aColCache*/
-#define PARSE_RECURSE_SZ offsetof(Parse,nVar)  /* Recursive part */
+#define PARSE_RECURSE_SZ offsetof(Parse,sLastToken)    /* Recursive part */
 #define PARSE_TAIL_SZ (sizeof(Parse)-PARSE_RECURSE_SZ) /* Non-recursive part */
 #define PARSE_TAIL(X) (((char*)(X))+PARSE_RECURSE_SZ)  /* Pointer to tail */
 
 /*
 ** Return true if currently inside an sqlite3_declare_vtab() call.

Index: src/test1.c
==================================================================
--- src/test1.c
+++ src/test1.c
@@ -5674,10 +5674,42 @@
   rc = sqlite3_file_control(db, NULL, SQLITE_FCNTL_WIN32_AV_RETRY, (void*)a);
   sqlite3_snprintf(sizeof(z), z, "%d %d %d", rc, a[0], a[1]);
   Tcl_AppendResult(interp, z, (char*)0);
   return TCL_OK;  
 }
+
+/*
+** tclcmd:   file_control_win32_get_handle DB
+**
+** This TCL command runs the sqlite3_file_control interface with
+** the SQLITE_FCNTL_WIN32_GET_HANDLE opcode.
+*/
+static int file_control_win32_get_handle(
+  ClientData clientData, /* Pointer to sqlite3_enable_XXX function */
+  Tcl_Interp *interp,    /* The TCL interpreter that invoked this command */
+  int objc,              /* Number of arguments */
+  Tcl_Obj *CONST objv[]  /* Command arguments */
+){
+  sqlite3 *db;
+  int rc;
+  HANDLE hFile = NULL;
+  char z[100];
+
+  if( objc!=2 ){
+    Tcl_AppendResult(interp, "wrong # args: should be \"",
+        Tcl_GetStringFromObj(objv[0], 0), " DB", 0);
+    return TCL_ERROR;
+  }
+  if( getDbPointer(interp, Tcl_GetString(objv[1]), &db) ){
+    return TCL_ERROR;
+  }
+  rc = sqlite3_file_control(db, NULL, SQLITE_FCNTL_WIN32_GET_HANDLE,
+                            (void*)&hFile);
+  sqlite3_snprintf(sizeof(z), z, "%d %p", rc, (void*)hFile);
+  Tcl_AppendResult(interp, z, (char*)0);
+  return TCL_OK;
+}
 
 /*
 ** tclcmd:   file_control_win32_set_handle DB HANDLE
 **
 ** This TCL command runs the sqlite3_file_control interface with
@@ -7439,10 +7471,11 @@
      { "file_control_lockproxy_test", file_control_lockproxy_test,  0   },
      { "file_control_chunksize_test", file_control_chunksize_test,  0   },
      { "file_control_sizehint_test",  file_control_sizehint_test,   0   },
 #if SQLITE_OS_WIN
      { "file_control_win32_av_retry", file_control_win32_av_retry,  0   },
+     { "file_control_win32_get_handle", file_control_win32_get_handle, 0  },
      { "file_control_win32_set_handle", file_control_win32_set_handle, 0  },
 #endif
      { "file_control_persist_wal",    file_control_persist_wal,     0   },
      { "file_control_powersafe_overwrite",file_control_powersafe_overwrite,0},
      { "file_control_vfsname",        file_control_vfsname,         0   },

Index: src/vacuum.c
==================================================================
--- src/vacuum.c
+++ src/vacuum.c
@@ -189,11 +189,11 @@
   }
 #endif
 
   sqlite3BtreeSetCacheSize(pTemp, db->aDb[iDb].pSchema->cache_size);
   sqlite3BtreeSetSpillSize(pTemp, sqlite3BtreeSetSpillSize(pMain,0));
-  sqlite3BtreeSetPagerFlags(pTemp, PAGER_SYNCHRONOUS_OFF);
+  sqlite3BtreeSetPagerFlags(pTemp, PAGER_SYNCHRONOUS_OFF|PAGER_CACHESPILL);
 
   /* Begin a transaction and take an exclusive lock on the main database
   ** file. This is done before the sqlite3BtreeGetPageSize(pMain) call below,
   ** to ensure that we do not try to change the page-size on a WAL database.
   */

Index: src/vdbeInt.h
==================================================================
--- src/vdbeInt.h
+++ src/vdbeInt.h
@@ -428,12 +428,12 @@
   UnpackedRecord *pUnpacked;      /* Unpacked version of aRecord[] */
   UnpackedRecord *pNewUnpacked;   /* Unpacked version of new.* record */
   int iNewReg;                    /* Register for new.* values */
   i64 iKey1;                      /* First key value passed to hook */
   i64 iKey2;                      /* Second key value passed to hook */
-  int iPKey;                      /* If not negative index of IPK column */
   Mem *aNew;                      /* Array of new.* values */
+  Table *pTab;                    /* Schema object being upated */          
 };
 
 /*
 ** Function prototypes
 */

Index: src/vdbeapi.c
==================================================================
--- src/vdbeapi.c
+++ src/vdbeapi.c
@@ -1708,13 +1708,18 @@
   }
 
   if( iIdx>=p->pUnpacked->nField ){
     *ppValue = (sqlite3_value *)columnNullValue();
   }else{
+    Mem *pMem = *ppValue = &p->pUnpacked->aMem[iIdx];
     *ppValue = &p->pUnpacked->aMem[iIdx];
-    if( iIdx==p->iPKey ){
-      sqlite3VdbeMemSetInt64(*ppValue, p->iKey1);
+    if( iIdx==p->pTab->iPKey ){
+      sqlite3VdbeMemSetInt64(pMem, p->iKey1);
+    }else if( p->pTab->aCol[iIdx].affinity==SQLITE_AFF_REAL ){
+      if( pMem->flags & MEM_Int ){
+        sqlite3VdbeMemRealify(pMem);
+      }
     }
   }
 
  preupdate_old_out:
   sqlite3Error(db, rc);
@@ -1787,11 +1792,11 @@
     }
     if( iIdx>=pUnpack->nField ){
       pMem = (sqlite3_value *)columnNullValue();
     }else{
       pMem = &pUnpack->aMem[iIdx];
-      if( iIdx==p->iPKey ){
+      if( iIdx==p->pTab->iPKey ){
         sqlite3VdbeMemSetInt64(pMem, p->iKey2);
       }
     }
   }else{
     /* For an UPDATE, memory cell (p->iNewReg+1+iIdx) contains the required
@@ -1808,11 +1813,11 @@
       }
     }
     assert( iIdx>=0 && iIdx<p->pCsr->nField );
     pMem = &p->aNew[iIdx];
     if( pMem->flags==0 ){
-      if( iIdx==p->iPKey ){
+      if( iIdx==p->pTab->iPKey ){
         sqlite3VdbeMemSetInt64(pMem, p->iKey2);
       }else{
         rc = sqlite3VdbeMemCopy(pMem, &p->v->aMem[p->iNewReg+1+iIdx]);
         if( rc!=SQLITE_OK ) goto preupdate_new_out;
       }

Index: src/vdbeaux.c
==================================================================
--- src/vdbeaux.c
+++ src/vdbeaux.c
@@ -4615,11 +4615,11 @@
   preupdate.keyinfo.enc = ENC(db);
   preupdate.keyinfo.nField = pTab->nCol;
   preupdate.keyinfo.aSortOrder = (u8*)&fakeSortOrder;
   preupdate.iKey1 = iKey1;
   preupdate.iKey2 = iKey2;
-  preupdate.iPKey = pTab->iPKey;
+  preupdate.pTab = pTab;
 
   db->pPreUpdate = &preupdate;
   db->xPreUpdateCallback(db->pPreUpdateArg, db, op, zDb, zTbl, iKey1, iKey2);
   db->pPreUpdate = 0;
   sqlite3DbFree(db, preupdate.aRecord);

Index: src/where.c
==================================================================
--- src/where.c
+++ src/where.c
@@ -4858,17 +4858,19 @@
                         pLevel->addrLikeRep);
       VdbeCoverage(v);
     }
 #endif
     if( pLevel->iLeftJoin ){
+      int ws = pLoop->wsFlags;
       addr = sqlite3VdbeAddOp1(v, OP_IfPos, pLevel->iLeftJoin); VdbeCoverage(v);
-      assert( (pLoop->wsFlags & WHERE_IDX_ONLY)==0
-           || (pLoop->wsFlags & WHERE_INDEXED)!=0 );
-      if( (pLoop->wsFlags & WHERE_IDX_ONLY)==0 ){
+      assert( (ws & WHERE_IDX_ONLY)==0 || (ws & WHERE_INDEXED)!=0 );
+      if( (ws & WHERE_IDX_ONLY)==0 ){
         sqlite3VdbeAddOp1(v, OP_NullRow, pTabList->a[i].iCursor);
       }
-      if( pLoop->wsFlags & WHERE_INDEXED ){
+      if( (ws & WHERE_INDEXED) 
+       || ((ws & WHERE_MULTI_OR) && pLevel->u.pCovidx) 
+      ){
         sqlite3VdbeAddOp1(v, OP_NullRow, pLevel->iIdxCur);
       }
       if( pLevel->op==OP_Return ){
         sqlite3VdbeAddOp2(v, OP_Gosub, pLevel->p1, pLevel->addrFirst);
       }else{

Index: src/wherecode.c
==================================================================
--- src/wherecode.c
+++ src/wherecode.c
@@ -444,10 +444,11 @@
     if( (pX->flags & EP_xIsSelect)==0 || pX->x.pSelect->pEList->nExpr==1 ){
       eType = sqlite3FindInIndex(pParse, pX, IN_INDEX_LOOP, 0, 0);
     }else{
       Select *pSelect = pX->x.pSelect;
       sqlite3 *db = pParse->db;
+      u16 savedDbOptFlags = db->dbOptFlags;
       ExprList *pOrigRhs = pSelect->pEList;
       ExprList *pOrigLhs = pX->pLeft->x.pList;
       ExprList *pRhs = 0;         /* New Select.pEList for RHS */
       ExprList *pLhs = 0;         /* New pX->pLeft vector */
 
@@ -487,11 +488,13 @@
           pLeft->x.pList = pLhs;
           aiMap = (int*)sqlite3DbMallocZero(pParse->db, sizeof(int) * nEq);
           testcase( aiMap==0 );
         }
         pSelect->pEList = pRhs;
+        db->dbOptFlags |= SQLITE_QueryFlattener;
         eType = sqlite3FindInIndex(pParse, pX, IN_INDEX_LOOP, 0, aiMap);
+        db->dbOptFlags = savedDbOptFlags;
         testcase( aiMap!=0 && aiMap[0]!=0 );
         pSelect->pEList = pOrigRhs;
         pLeft->x.pList = pOrigLhs;
         pX->pLeft = pLeft;
       }

Index: src/whereexpr.c
==================================================================
--- src/whereexpr.c
+++ src/whereexpr.c
@@ -1196,10 +1196,11 @@
       Expr *pNew;
       Expr *pLeft = sqlite3ExprForVectorField(pParse, pExpr->pLeft, i);
       Expr *pRight = sqlite3ExprForVectorField(pParse, pExpr->pRight, i);
 
       pNew = sqlite3PExpr(pParse, pExpr->op, pLeft, pRight, 0);
+      transferJoinMarkings(pNew, pExpr);
       idxNew = whereClauseInsert(pWC, pNew, TERM_DYNAMIC);
       exprAnalyze(pSrc, pWC, idxNew);
     }
     pTerm = &pWC->a[idxTerm];
     pTerm->wtFlags = TERM_CODED|TERM_VIRTUAL;  /* Disable the original */
@@ -1267,10 +1268,12 @@
 #endif /* SQLITE_ENABLE_STAT3_OR_STAT4 */
 
   /* Prevent ON clause terms of a LEFT JOIN from being used to drive
   ** an index for tables to the left of the join.
   */
+  testcase( pTerm!=&pWC->a[idxTerm] );
+  pTerm = &pWC->a[idxTerm];
   pTerm->prereqRight |= extraRight;
 }
 
 /***************************************************************************
 ** Routines with file scope above.  Interface to the rest of the where.c

Index: test/cursorhint2.test
==================================================================
--- test/cursorhint2.test
+++ test/cursorhint2.test
@@ -162,19 +162,21 @@
   SELECT * FROM x1 LEFT JOIN x2 ON (a=x) WHERE x2.b = 32+32
 } {
   x2 {AND(EQ(c1,ADD(32,32)),EQ(c0,r[2]))}
 }
 
-do_extract_hints_test 2.11 {
-  SELECT * FROM x1 LEFT JOIN x2 ON (a=x) WHERE x2.b LIKE 'abc%'
-} {
-  x2 {AND(expr,EQ(c0,r[2]))}
+ifcapable !icu {
+  # This test only works using the built-in LIKE, not the ICU LIKE extension.
+  do_extract_hints_test 2.11 {
+    SELECT * FROM x1 LEFT JOIN x2 ON (a=x) WHERE x2.b LIKE 'abc%'
+  } {
+    x2 {AND(expr,EQ(c0,r[2]))}
+  }
 }
 
-do_extract_hints_test 2.11 {
+do_extract_hints_test 2.12 {
   SELECT * FROM x1 LEFT JOIN x2 ON (a=x) WHERE coalesce(x2.b, 1)
 } {
   x2 {EQ(c0,r[2])}
 }
 
 finish_test
-

Index: test/filectrl.test
==================================================================
--- test/filectrl.test
+++ test/filectrl.test
@@ -41,6 +41,32 @@
   set fn [file_control_tempfilename db]
   set fn
 } {/etilqs_/}
 db close
 forcedelete .test_control_lockproxy.db-conch test.proxy
+forcedelete test.db test2.db
+
+if {$tcl_platform(platform)=="windows"} {
+  do_test filectrl-2.1 {
+    sqlite3 db test2.db
+    set size [file size test2.db]
+    set handle [file_control_win32_get_handle db]
+    db close
+    forcedelete test2.db
+    list $size $handle [expr {$handle != 0}]
+  } {/^0 \{0 \d+\} 1$/}
+
+  do_test filectrl-2.2 {
+    sqlite3 db test2.db
+    execsql {
+      CREATE TABLE t1(x);
+      INSERT INTO t1 (x) VALUES(RANDOMBLOB(1048576));
+    }
+    set size [file size test2.db]
+    set handle [file_control_win32_get_handle db]
+    db close
+    forcedelete test2.db
+    list $size $handle [expr {$handle != 0}]
+  } {/^1\d+ \{0 \d+\} 1$/}
+}
+
 finish_test

Index: test/fuzz-oss1.test
==================================================================
--- test/fuzz-oss1.test
+++ test/fuzz-oss1.test
@@ -1995,7 +1995,11 @@
 "nco:PersonContact1"."ID" AS "1_u" FROM "nco:PersonContact" AS
 "nco:PersonContact1") ORDER BY "1_u";
   }
 } {/.* Goto .*/}
 
+# Crash reported by OSS-FUZZ on 2016-11-10
+do_catchsql_test fuzz-oss1-detach {
+  DETACH x IS #1;
+} {1 {near "#1": syntax error}}
 
 finish_test

ADDED   test/instrfault.test
Index: test/instrfault.test
==================================================================
--- /dev/null
+++ test/instrfault.test
@@ -0,0 +1,68 @@
+# 2016 November 4
+#
+# The author disclaims copyright to this source code.  In place of
+# a legal notice, here is a blessing:
+#
+#    May you do good and not evil.
+#    May you find forgiveness for yourself and forgive others.
+#    May you share freely, never taking more than you give.
+#
+#***********************************************************************
+# This file implements regression tests for SQLite library.  The
+# focus of this file is testing OOM error handling within the built-in 
+# INSTR() function.
+#
+
+
+set testdir [file dirname $argv0]
+source $testdir/tester.tcl
+set testprefix instrfault
+
+# Use big NEEDLE and HAYSTACK strings. Strings so large they cannot
+# use lookaside buffers.
+#
+set ::NEEDLE [string repeat "abcdefghijklmnopqrstuvwxyz" 10]
+set ::HAYSTACK "[string repeat 123 10]$NEEDLE[string repeat 456 10]"
+
+foreach {enc} {
+  utf8
+  utf16
+} {
+  reset_db
+  execsql "PRAGMA encoding = $enc"
+  do_execsql_test 1.$enc.1 {
+    CREATE TABLE t1(n, h);
+    INSERT INTO t1 VALUES($::NEEDLE, $::HAYSTACK);
+  } {}
+
+  do_faultsim_test 1.$enc.1 -faults oom-t* -prep {
+    execsql { SELECT instr(h, n) FROM t1 }
+  } -body {
+    execsql { SELECT instr(h, n) FROM t1 }
+  } -test {
+    faultsim_test_result {0 31}
+  }
+
+  do_faultsim_test 1.$enc.2 -faults oom-t* -prep {
+    execsql { SELECT instr($::HAYSTACK, $::NEEDLE) FROM t1 }
+  } -body {
+    execsql { SELECT instr($::HAYSTACK, $::NEEDLE) FROM t1 }
+  } -test {
+    faultsim_test_result {0 31}
+  }
+
+  do_faultsim_test 1.$enc.3 -faults oom-t* -prep {
+    set ::stmt [sqlite3_prepare_v2 db "SELECT instr(?, ?)" -1 dummy]
+    sqlite3_bind_text $::stmt 1 $::HAYSTACK [string length $::HAYSTACK]
+    sqlite3_bind_text $::stmt 2 $::NEEDLE [string length $::NEEDLE]
+  } -body {
+    set rc [sqlite3_step $::stmt]
+    if {$rc=="SQLITE_NOMEM"} { error "out of memory" }
+    sqlite3_column_int $::stmt 0
+  } -test {
+    faultsim_test_result {0 31}
+    sqlite3_finalize $::stmt
+  }
+}
+
+finish_test

Index: test/json101.test
==================================================================
--- test/json101.test
+++ test/json101.test
@@ -380,10 +380,313 @@
 } {1 {wrong number of arguments to function json_quote()}}
 do_catchsql_test json-9.7 {
   SELECT json_quote()
 } {1 {wrong number of arguments to function json_quote()}}
 
-
-
+# Make sure only valid backslash-escapes are accepted.
+#
+do_execsql_test json-10.1 {
+  SELECT json_valid('" \  "');
+} {0}
+do_execsql_test json-10.2 {
+  SELECT json_valid('" \! "');
+} {0}
+do_execsql_test json-10.3 {
+  SELECT json_valid('" \" "');
+} {1}
+do_execsql_test json-10.4 {
+  SELECT json_valid('" \# "');
+} {0}
+do_execsql_test json-10.5 {
+  SELECT json_valid('" \$ "');
+} {0}
+do_execsql_test json-10.6 {
+  SELECT json_valid('" \% "');
+} {0}
+do_execsql_test json-10.7 {
+  SELECT json_valid('" \& "');
+} {0}
+do_execsql_test json-10.8 {
+  SELECT json_valid('" \'' "');
+} {0}
+do_execsql_test json-10.9 {
+  SELECT json_valid('" \( "');
+} {0}
+do_execsql_test json-10.10 {
+  SELECT json_valid('" \) "');
+} {0}
+do_execsql_test json-10.11 {
+  SELECT json_valid('" \* "');
+} {0}
+do_execsql_test json-10.12 {
+  SELECT json_valid('" \+ "');
+} {0}
+do_execsql_test json-10.13 {
+  SELECT json_valid('" \, "');
+} {0}
+do_execsql_test json-10.14 {
+  SELECT json_valid('" \- "');
+} {0}
+do_execsql_test json-10.15 {
+  SELECT json_valid('" \. "');
+} {0}
+do_execsql_test json-10.16 {
+  SELECT json_valid('" \/ "');
+} {1}
+do_execsql_test json-10.17 {
+  SELECT json_valid('" \0 "');
+} {0}
+do_execsql_test json-10.18 {
+  SELECT json_valid('" \1 "');
+} {0}
+do_execsql_test json-10.19 {
+  SELECT json_valid('" \2 "');
+} {0}
+do_execsql_test json-10.20 {
+  SELECT json_valid('" \3 "');
+} {0}
+do_execsql_test json-10.21 {
+  SELECT json_valid('" \4 "');
+} {0}
+do_execsql_test json-10.22 {
+  SELECT json_valid('" \5 "');
+} {0}
+do_execsql_test json-10.23 {
+  SELECT json_valid('" \6 "');
+} {0}
+do_execsql_test json-10.24 {
+  SELECT json_valid('" \7 "');
+} {0}
+do_execsql_test json-10.25 {
+  SELECT json_valid('" \8 "');
+} {0}
+do_execsql_test json-10.26 {
+  SELECT json_valid('" \9 "');
+} {0}
+do_execsql_test json-10.27 {
+  SELECT json_valid('" \: "');
+} {0}
+do_execsql_test json-10.28 {
+  SELECT json_valid('" \; "');
+} {0}
+do_execsql_test json-10.29 {
+  SELECT json_valid('" \< "');
+} {0}
+do_execsql_test json-10.30 {
+  SELECT json_valid('" \= "');
+} {0}
+do_execsql_test json-10.31 {
+  SELECT json_valid('" \> "');
+} {0}
+do_execsql_test json-10.32 {
+  SELECT json_valid('" \? "');
+} {0}
+do_execsql_test json-10.33 {
+  SELECT json_valid('" \@ "');
+} {0}
+do_execsql_test json-10.34 {
+  SELECT json_valid('" \A "');
+} {0}
+do_execsql_test json-10.35 {
+  SELECT json_valid('" \B "');
+} {0}
+do_execsql_test json-10.36 {
+  SELECT json_valid('" \C "');
+} {0}
+do_execsql_test json-10.37 {
+  SELECT json_valid('" \D "');
+} {0}
+do_execsql_test json-10.38 {
+  SELECT json_valid('" \E "');
+} {0}
+do_execsql_test json-10.39 {
+  SELECT json_valid('" \F "');
+} {0}
+do_execsql_test json-10.40 {
+  SELECT json_valid('" \G "');
+} {0}
+do_execsql_test json-10.41 {
+  SELECT json_valid('" \H "');
+} {0}
+do_execsql_test json-10.42 {
+  SELECT json_valid('" \I "');
+} {0}
+do_execsql_test json-10.43 {
+  SELECT json_valid('" \J "');
+} {0}
+do_execsql_test json-10.44 {
+  SELECT json_valid('" \K "');
+} {0}
+do_execsql_test json-10.45 {
+  SELECT json_valid('" \L "');
+} {0}
+do_execsql_test json-10.46 {
+  SELECT json_valid('" \M "');
+} {0}
+do_execsql_test json-10.47 {
+  SELECT json_valid('" \N "');
+} {0}
+do_execsql_test json-10.48 {
+  SELECT json_valid('" \O "');
+} {0}
+do_execsql_test json-10.49 {
+  SELECT json_valid('" \P "');
+} {0}
+do_execsql_test json-10.50 {
+  SELECT json_valid('" \Q "');
+} {0}
+do_execsql_test json-10.51 {
+  SELECT json_valid('" \R "');
+} {0}
+do_execsql_test json-10.52 {
+  SELECT json_valid('" \S "');
+} {0}
+do_execsql_test json-10.53 {
+  SELECT json_valid('" \T "');
+} {0}
+do_execsql_test json-10.54 {
+  SELECT json_valid('" \U "');
+} {0}
+do_execsql_test json-10.55 {
+  SELECT json_valid('" \V "');
+} {0}
+do_execsql_test json-10.56 {
+  SELECT json_valid('" \W "');
+} {0}
+do_execsql_test json-10.57 {
+  SELECT json_valid('" \X "');
+} {0}
+do_execsql_test json-10.58 {
+  SELECT json_valid('" \Y "');
+} {0}
+do_execsql_test json-10.59 {
+  SELECT json_valid('" \Z "');
+} {0}
+do_execsql_test json-10.60 {
+  SELECT json_valid('" \[ "');
+} {0}
+do_execsql_test json-10.61 {
+  SELECT json_valid('" \\ "');
+} {1}
+do_execsql_test json-10.62 {
+  SELECT json_valid('" \] "');
+} {0}
+do_execsql_test json-10.63 {
+  SELECT json_valid('" \^ "');
+} {0}
+do_execsql_test json-10.64 {
+  SELECT json_valid('" \_ "');
+} {0}
+do_execsql_test json-10.65 {
+  SELECT json_valid('" \` "');
+} {0}
+do_execsql_test json-10.66 {
+  SELECT json_valid('" \a "');
+} {0}
+do_execsql_test json-10.67 {
+  SELECT json_valid('" \b "');
+} {1}
+do_execsql_test json-10.68 {
+  SELECT json_valid('" \c "');
+} {0}
+do_execsql_test json-10.69 {
+  SELECT json_valid('" \d "');
+} {0}
+do_execsql_test json-10.70 {
+  SELECT json_valid('" \e "');
+} {0}
+do_execsql_test json-10.71 {
+  SELECT json_valid('" \f "');
+} {1}
+do_execsql_test json-10.72 {
+  SELECT json_valid('" \g "');
+} {0}
+do_execsql_test json-10.73 {
+  SELECT json_valid('" \h "');
+} {0}
+do_execsql_test json-10.74 {
+  SELECT json_valid('" \i "');
+} {0}
+do_execsql_test json-10.75 {
+  SELECT json_valid('" \j "');
+} {0}
+do_execsql_test json-10.76 {
+  SELECT json_valid('" \k "');
+} {0}
+do_execsql_test json-10.77 {
+  SELECT json_valid('" \l "');
+} {0}
+do_execsql_test json-10.78 {
+  SELECT json_valid('" \m "');
+} {0}
+do_execsql_test json-10.79 {
+  SELECT json_valid('" \n "');
+} {1}
+do_execsql_test json-10.80 {
+  SELECT json_valid('" \o "');
+} {0}
+do_execsql_test json-10.81 {
+  SELECT json_valid('" \p "');
+} {0}
+do_execsql_test json-10.82 {
+  SELECT json_valid('" \q "');
+} {0}
+do_execsql_test json-10.83 {
+  SELECT json_valid('" \r "');
+} {1}
+do_execsql_test json-10.84 {
+  SELECT json_valid('" \s "');
+} {0}
+do_execsql_test json-10.85 {
+  SELECT json_valid('" \t "');
+} {1}
+do_execsql_test json-10.86.0 {
+  SELECT json_valid('" \u "');
+} {0}
+do_execsql_test json-10.86.1 {
+  SELECT json_valid('" \ua "');
+} {0}
+do_execsql_test json-10.86.2 {
+  SELECT json_valid('" \uab "');
+} {0}
+do_execsql_test json-10.86.3 {
+  SELECT json_valid('" \uabc "');
+} {0}
+do_execsql_test json-10.86.4 {
+  SELECT json_valid('" \uabcd "');
+} {1}
+do_execsql_test json-10.86.5 {
+  SELECT json_valid('" \uFEDC "');
+} {1}
+do_execsql_test json-10.86.6 {
+  SELECT json_valid('" \u1234 "');
+} {1}
+do_execsql_test json-10.87 {
+  SELECT json_valid('" \v "');
+} {0}
+do_execsql_test json-10.88 {
+  SELECT json_valid('" \w "');
+} {0}
+do_execsql_test json-10.89 {
+  SELECT json_valid('" \x "');
+} {0}
+do_execsql_test json-10.90 {
+  SELECT json_valid('" \y "');
+} {0}
+do_execsql_test json-10.91 {
+  SELECT json_valid('" \z "');
+} {0}
+do_execsql_test json-10.92 {
+  SELECT json_valid('" \{ "');
+} {0}
+do_execsql_test json-10.93 {
+  SELECT json_valid('" \| "');
+} {0}
+do_execsql_test json-10.94 {
+  SELECT json_valid('" \} "');
+} {0}
+do_execsql_test json-10.95 {
+  SELECT json_valid('" \~ "');
+} {0}
 
 
 finish_test

Index: test/rowvalue.test
==================================================================
--- test/rowvalue.test
+++ test/rowvalue.test
@@ -253,7 +253,44 @@
 } {1 {row value misused}}
 do_catchsql_test 11.8 {
   SELECT * FROM t11 WHERE (a,a) IS NOT 1;
 } {1 {row value misused}}
 
+# 2016-10-27: https://www.sqlite.org/src/tktview/fef4bb4bd9185ec8f
+# Incorrect result from a LEFT JOIN with a row-value constraint
+#
+do_execsql_test 12.1 {
+  DROP TABLE IF EXISTS t1;
+  CREATE TABLE t1(a,b); INSERT INTO t1 VALUES(1,2);
+  DROP TABLE IF EXISTS t2;
+  CREATE TABLE t2(x,y); INSERT INTO t2 VALUES(3,4);
+  SELECT *,'x' FROM t1 LEFT JOIN t2 ON (a,b)=(x,y);
+} {1 2 {} {} x}
+
+
+foreach {tn sql} {
+  0 "SELECT (1,2) AS x WHERE x=3"
+  1 "SELECT (1,2) BETWEEN 1 AND 2"
+  2 "SELECT 1 BETWEEN (1,2) AND 2"
+  3 "SELECT 2 BETWEEN 1 AND (1,2)"
+  4 "SELECT (1,2) FROM (SELECT 1) ORDER BY 1"
+  5 "SELECT (1,2) FROM (SELECT 1) GROUP BY 1"
+} {
+  do_catchsql_test 13.$tn $sql {1 {row value misused}}
+}
+
+do_execsql_test 14.0 {
+  CREATE TABLE t12(x);
+  INSERT INTO t12 VALUES(2), (4);
+}
+do_execsql_test 14.1 "SELECT 1 WHERE (2,2) BETWEEN (1,1) AND (3,3)" 1
+do_execsql_test 14.2 "SELECT CASE (2,2) WHEN (1, 1) THEN 2 ELSE 1 END" 1
+do_execsql_test 14.3 "SELECT CASE (SELECT 2,2) WHEN (1, 1) THEN 2 ELSE 1 END" 1
+do_execsql_test 14.4 "SELECT 1 WHERE (SELECT 2,2) BETWEEN (1,1) AND (3,3)" 1
+do_execsql_test 14.5 "SELECT 1 FROM t12 WHERE (x,1) BETWEEN (1,1) AND (3,3)" 1
+do_execsql_test 14.6 {
+  SELECT 1 FROM t12 WHERE (1,x) BETWEEN (1,1) AND (3,3)
+} {1 1}
 
 finish_test
+
+

Index: test/rowvalue3.test
==================================================================
--- test/rowvalue3.test
+++ test/rowvalue3.test
@@ -199,8 +199,22 @@
     " $res
   }
 }
 
 #-------------------------------------------------------------------------
+
+# 2016-11-17.  Query flattening in a vector SELECT on the RHS of an IN
+# operator.  Ticket https://www.sqlite.org/src/info/da7841375186386c
+#
+do_execsql_test 5.0 {
+  DROP TABLE IF EXISTS t1;
+  DROP TABLE IF EXISTS t2;
+  CREATE TABLE T1(a TEXT);
+  INSERT INTO T1(a) VALUES ('aaa');
+  CREATE TABLE T2(a TEXT PRIMARY KEY,n INT);
+  INSERT INTO T2(a, n) VALUES('aaa',0);
+  SELECT * FROM T2
+  WHERE (a,n) IN (SELECT T1.a, V.n FROM T1, (SELECT * FROM (SELECT 0 n)) V);
+} {aaa 0}
 
 
 finish_test

Index: test/vacuum5.test
==================================================================
--- test/vacuum5.test
+++ test/vacuum5.test
@@ -12,10 +12,11 @@
 # This file implements a test for VACUUM on attached databases.
 #
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
+set testprefix vacuum5
 
 # If the VACUUM statement is disabled in the current build, skip all
 # the tests in this file.
 #
 ifcapable !vacuum {
@@ -108,7 +109,45 @@
 } $sizeTemp
 
 do_catchsql_test vacuum5-2.0 {
   VACUUM olaf;
 } {1 {unknown database olaf}}
+
+#-------------------------------------------------------------------------
+# Test that a temp file is opened as part of VACUUM.
+#
+if {$::TEMP_STORE<3 && [permutation]!="inmemory_journal"} {
+  db close
+  testvfs tvfs 
+  tvfs filter xOpen
+  tvfs script open_cb
+  forcedelete test.db
+
+  set ::openfiles [list]
+  proc open_cb {method args} {
+    lappend ::openfiles [file tail [lindex $args 0]]
+  }
+  sqlite3 db test.db -vfs tvfs
+
+  do_execsql_test 3.0 {
+    PRAGMA temp_store = file;
+    PRAGMA page_size = 1024;
+    PRAGMA cache_size = 50;
+    CREATE TABLE t1(i INTEGER PRIMARY KEY, j UNIQUE);
+    WITH s(i) AS (
+      VALUES(1) UNION ALL SELECT i+1 FROM s WHERE i<1000
+    )
+    INSERT INTO t1 SELECT NULL, randomblob(100) FROM s;
+  }
+
+  do_execsql_test 3.1 { VACUUM }
+
+  db close
+  tvfs delete
+  do_test 3.2 {
+    lrange $::openfiles 0 4
+  } {test.db test.db-journal test.db-journal {} test.db-journal}
+} 
+
+
 
 finish_test

Index: test/whereD.test
==================================================================
--- test/whereD.test
+++ test/whereD.test
@@ -334,7 +334,84 @@
   SELECT c FROM x1 WHERE c=11 OR a=1 OR b=6 
 } {11 3 7 search 7}
 do_searchcount_test 6.6.4 {
   SELECT c FROM x1 WHERE b=6 OR c=11 OR a=1
 } {7 11 3 search 7}
+
+#-------------------------------------------------------------------------
+#
+do_execsql_test 7.0 {
+  CREATE TABLE y1(a, b);
+  CREATE TABLE y2(x, y);
+  CREATE INDEX y2xy ON y2(x, y);
+  INSERT INTO y1 VALUES(1, 1);
+  INSERT INTO y2 VALUES(3, 3);
+}
+
+do_execsql_test 7.1 {
+  SELECT * FROM y1 LEFT JOIN y2 ON ((x=1 AND y=b) OR (x=2 AND y=b))
+} {1 1 {} {}}
+
+do_execsql_test 7.3 {
+  CREATE TABLE foo (Id INTEGER PRIMARY KEY, fa INTEGER, fb INTEGER); 
+  CREATE TABLE bar (Id INTEGER PRIMARY KEY, ba INTEGER, bb INTEGER);
+
+  INSERT INTO foo VALUES(1, 1, 1);
+  INSERT INTO foo VALUES(2, 1, 2);
+  INSERT INTO foo VALUES(3, 1, 3);
+  INSERT INTO foo VALUES(4, 1, 4);
+  INSERT INTO foo VALUES(5, 1, 5);
+  INSERT INTO foo VALUES(6, 1, 6);
+  INSERT INTO foo VALUES(7, 1, 7);
+  INSERT INTO foo VALUES(8, 1, 8);
+  INSERT INTO foo VALUES(9, 1, 9);
+
+  INSERT INTO bar VALUES(NULL, 1, 1);
+  INSERT INTO bar VALUES(NULL, 2, 2);
+  INSERT INTO bar VALUES(NULL, 3, 3);
+  INSERT INTO bar VALUES(NULL, 1, 4);
+  INSERT INTO bar VALUES(NULL, 2, 5);
+  INSERT INTO bar VALUES(NULL, 3, 6);
+  INSERT INTO bar VALUES(NULL, 1, 7);
+  INSERT INTO bar VALUES(NULL, 2, 8);
+  INSERT INTO bar VALUES(NULL, 3, 9);
+}
+
+do_execsql_test 7.4 {
+  SELECT 
+    bar.Id, bar.ba, bar.bb, foo.fb
+    FROM foo LEFT JOIN bar
+           ON (bar.ba = 1 AND bar.bb = foo.fb)
+           OR (bar.ba = 5 AND bar.bb = foo.fb);
+} {
+  1 1 1 1 
+  {} {} {} 2 
+  {} {} {} 3 
+  4 1 4 4 
+  {} {} {} 5 
+  {} {} {} 6 
+  7 1 7 7 
+  {} {} {} 8 
+  {} {} {} 9
+}
+
+do_execsql_test 7.5 {
+  CREATE INDEX idx_bar ON bar(ba, bb);
+  SELECT 
+    bar.Id, bar.ba, bar.bb, foo.fb
+    FROM foo LEFT JOIN bar
+           ON (bar.ba = 1 AND bar.bb = foo.fb)
+           OR (bar.ba = 5 AND bar.bb = foo.fb);
+} {
+  1 1 1 1 
+  {} {} {} 2 
+  {} {} {} 3 
+  4 1 4 4 
+  {} {} {} 5 
+  {} {} {} 6 
+  7 1 7 7 
+  {} {} {} 8 
+  {} {} {} 9
+}
+
 
 finish_test

Index: tool/build-all-msvc.bat
==================================================================
--- tool/build-all-msvc.bat
+++ tool/build-all-msvc.bat
@@ -266,11 +266,11 @@
 REM       along the PATH.
 REM
 IF DEFINED TCLSH_CMD (
   SET TCLSH_FILE=%TCLSH_CMD%
 ) ELSE (
-  SET TCLSH_FILE=tclsh85.exe
+  SET TCLSH_FILE=tclsh.exe
 )
 
 FOR %%T IN (%TCLSH_FILE%) DO (
   SET %%T_PATH=%%~dp$PATH:T
 )

Index: tool/mkvsix.tcl
==================================================================
--- tool/mkvsix.tcl
+++ tool/mkvsix.tcl
@@ -75,11 +75,11 @@
 # Studio version is "2013".  Typically, when on Windows, this script is
 # executed using commands similar to the following from a normal Windows
 # command prompt:
 #
 #                         CD /D C:\dev\sqlite\core
-#                         tclsh85 tool\mkvsix.tcl C:\Temp
+#                         tclsh tool\mkvsix.tcl C:\Temp
 #
 # In the example above, "C:\dev\sqlite\core" represents the root of the source
 # tree for SQLite and "C:\Temp" represents the top-level directory containing
 # the executable and other compiled binary files, organized into a directory
 # tree as described in item 6 of the PREREQUISITES section, above.