Index: src/expr.c
==================================================================
--- src/expr.c
+++ src/expr.c
@@ -1324,14 +1324,21 @@
 ** an a newly duplicated SELECT statement and gather all of the Window
 ** objects found there, assembling them onto the linked list at Select->pWin.
 */
 static int gatherSelectWindowsCallback(Walker *pWalker, Expr *pExpr){
   if( pExpr->op==TK_FUNCTION && ExprHasProperty(pExpr, EP_WinFunc) ){
-    assert( pExpr->y.pWin );
+    Select *pSelect = pWalker->u.pSelect;
+    Window *pWin = pExpr->y.pWin;
+    assert( pWin );
     assert( IsWindowFunc(pExpr) );
-    pExpr->y.pWin->pNextWin = pWalker->u.pSelect->pWin;
-    pWalker->u.pSelect->pWin = pExpr->y.pWin;
+    if( pSelect->pWin ){
+      *pSelect->pWin->ppThis = pSelect->pWin->pNextWin;
+      pSelect->pWin->ppThis = &pWin->pNextWin;
+    }
+    pWin->pNextWin = pSelect->pWin;
+    pWin->ppThis = &pSelect->pWin;
+    pSelect->pWin = pWin;
   }
   return WRC_Continue;
 }
 static int gatherSelectWindowsSelectCallback(Walker *pWalker, Select *p){
   return p==pWalker->u.pSelect ? WRC_Continue : WRC_Prune;

Index: src/resolve.c
==================================================================
--- src/resolve.c
+++ src/resolve.c
@@ -899,21 +899,26 @@
       sqlite3WalkExprList(pWalker, pList);
       if( is_agg ){
 #ifndef SQLITE_OMIT_WINDOWFUNC
         if( pWin ){
           Select *pSel = pNC->pWinSelect;
+          assert( pWin==pExpr->y.pWin );
           if( IN_RENAME_OBJECT==0 ){
             sqlite3WindowUpdate(pParse, pSel->pWinDefn, pWin, pDef);
           }
           sqlite3WalkExprList(pWalker, pWin->pPartition);
           sqlite3WalkExprList(pWalker, pWin->pOrderBy);
           sqlite3WalkExpr(pWalker, pWin->pFilter);
           if( 0==pSel->pWin 
            || 0==sqlite3WindowCompare(pParse, pSel->pWin, pWin, 0)
           ){
-            pExpr->y.pWin->pNextWin = pSel->pWin;
-            pSel->pWin = pExpr->y.pWin;
+            pWin->pNextWin = pSel->pWin;
+            if( pSel->pWin ){
+              pSel->pWin->ppThis = &pWin->pNextWin;
+            }
+            pSel->pWin = pWin;
+            pWin->ppThis = &pSel->pWin;
           }
           pNC->ncFlags |= NC_HasWin;
         }else
 #endif /* SQLITE_OMIT_WINDOWFUNC */
         {
@@ -1293,39 +1298,40 @@
   return 0;
 }
 
 #ifndef SQLITE_OMIT_WINDOWFUNC
 /*
-** Walker callback for resolveRemoveWindows().
+** Walker callback for windowRemoveExprFromSelect().
 */
 static int resolveRemoveWindowsCb(Walker *pWalker, Expr *pExpr){
   if( ExprHasProperty(pExpr, EP_WinFunc) ){
-    Window **pp;
-    for(pp=&pWalker->u.pSelect->pWin; *pp; pp=&(*pp)->pNextWin){
-      if( *pp==pExpr->y.pWin ){
-        *pp = (*pp)->pNextWin;
-        break;
-      }    
+    Window *pWin = pExpr->y.pWin;
+    if( pWin->ppThis ){
+      *pWin->ppThis = pWin->pNextWin;
+      if( pWin->pNextWin ) pWin->pNextWin->ppThis = pWin->ppThis;
+      pWin->ppThis = 0;
     }
   }
   return WRC_Continue;
 }
 
 /*
 ** Remove any Window objects owned by the expression pExpr from the
 ** Select.pWin list of Select object pSelect.
 */
-static void resolveRemoveWindows(Select *pSelect, Expr *pExpr){
-  Walker sWalker;
-  memset(&sWalker, 0, sizeof(Walker));
-  sWalker.xExprCallback = resolveRemoveWindowsCb;
-  sWalker.u.pSelect = pSelect;
-  sqlite3WalkExpr(&sWalker, pExpr);
+static void windowRemoveExprFromSelect(Select *pSelect, Expr *pExpr){
+  if( pSelect->pWin ){
+    Walker sWalker;
+    memset(&sWalker, 0, sizeof(Walker));
+    sWalker.xExprCallback = resolveRemoveWindowsCb;
+    sWalker.u.pSelect = pSelect;
+    sqlite3WalkExpr(&sWalker, pExpr);
+  }
 }
 #else
-# define resolveRemoveWindows(x,y)
-#endif
+# define windowRemoveExprFromSelect(a, b)
+#endif /* SQLITE_OMIT_WINDOWFUNC */
 
 /*
 ** pOrderBy is an ORDER BY or GROUP BY clause in SELECT statement pSelect.
 ** The Name context of the SELECT statement is pNC.  zType is either
 ** "ORDER" or "GROUP" depending on which type of clause pOrderBy is.
@@ -1392,11 +1398,11 @@
     for(j=0; j<pSelect->pEList->nExpr; j++){
       if( sqlite3ExprCompare(0, pE, pSelect->pEList->a[j].pExpr, -1)==0 ){
         /* Since this expresion is being changed into a reference
         ** to an identical expression in the result set, remove all Window
         ** objects belonging to the expression from the Select.pWin list. */
-        resolveRemoveWindows(pSelect, pE);
+        windowRemoveExprFromSelect(pSelect, pE);
         pItem->u.x.iOrderByCol = j+1;
       }
     }
   }
   return sqlite3ResolveOrderGroupBy(pParse, pSelect, pOrderBy, zType);

Index: src/select.c
==================================================================
--- src/select.c
+++ src/select.c
@@ -100,10 +100,11 @@
     if( OK_IF_ALWAYS_TRUE(p->pWinDefn) ){
       sqlite3WindowListDelete(db, p->pWinDefn);
     }
 #endif
     if( OK_IF_ALWAYS_TRUE(p->pWith) ) sqlite3WithDelete(db, p->pWith);
+    assert( p->pWin==0 );
     if( bFree ) sqlite3DbFreeNN(db, p);
     p = pPrior;
     bFree = 1;
   }
 }

Index: src/sqliteInt.h
==================================================================
--- src/sqliteInt.h
+++ src/sqliteInt.h
@@ -3592,10 +3592,11 @@
   u8 eEnd;                /* UNBOUNDED, CURRENT, PRECEDING or FOLLOWING */
   u8 bImplicitFrame;      /* True if frame was implicitly specified */
   u8 eExclude;            /* TK_NO, TK_CURRENT, TK_TIES, TK_GROUP, or 0 */
   Expr *pStart;           /* Expression for "<expr> PRECEDING" */
   Expr *pEnd;             /* Expression for "<expr> FOLLOWING" */
+  Window **ppThis;        /* Pointer to this object in Select.pWin list */
   Window *pNextWin;       /* Next window function belonging to this SELECT */
   Expr *pFilter;          /* The FILTER expression */
   FuncDef *pFunc;         /* The function */
   int iEphCsr;            /* Partition buffer or Peer buffer */
   int regAccum;

Index: src/window.c
==================================================================
--- src/window.c
+++ src/window.c
@@ -1020,10 +1020,14 @@
 /*
 ** Free the Window object passed as the second argument.
 */
 void sqlite3WindowDelete(sqlite3 *db, Window *p){
   if( p ){
+    if( p->ppThis ){
+      *p->ppThis = p->pNextWin;
+      if( p->pNextWin ) p->pNextWin->ppThis = p->ppThis;
+    }
     sqlite3ExprDelete(db, p->pFilter);
     sqlite3ExprListDelete(db, p->pPartition);
     sqlite3ExprListDelete(db, p->pOrderBy);
     sqlite3ExprDelete(db, p->pEnd);
     sqlite3ExprDelete(db, p->pStart);

Index: test/window9.test
==================================================================
--- test/window9.test
+++ test/window9.test
@@ -95,8 +95,32 @@
   SELECT b=='2' FROM t1
 } {1     0}
 do_execsql_test 2.2.2 {
   SELECT b=='2', rank() OVER (ORDER BY a) FROM t1
 } {1 1   0 2}
+
+#-------------------------------------------------------------------------
+reset_db
+do_execsql_test 3.0 {
+  CREATE TABLE t1(a);
+  CREATE TABLE t2(a,b,c);
+}
+
+do_execsql_test 3.1 {
+  SELECT EXISTS(SELECT 1 FROM t1 ORDER BY sum(a) OVER ()) FROM t1;
+}
+
+do_execsql_test 3.2 {
+  SELECT sum(a) OVER () FROM t2
+   ORDER BY EXISTS(SELECT 1 FROM t2 ORDER BY sum(a) OVER ());
+}
+
+do_catchsql_test 3.3 {
+  SELECT a, sum(a) OVER (ORDER BY a DESC) FROM t2 
+  ORDER BY EXISTS(
+    SELECT 1 FROM t2 ORDER BY sum(a) OVER (ORDER BY a)
+  ) OVER (ORDER BY a);
+} {1 {near "OVER": syntax error}}
+
 
 finish_test